sj 2UdZddlZddlZddlZddlZddlZddlmZddl m Z m Z m Z m Z mZmZddlmZddlmZddlmZe Ze ZeZe Zeejedz dd lmZmZdd lmZdd lm Z dd lm!Z!ddl"m#Z#dZ$ddlm%Z&de'fdZ(de'de'fdZ)d]de'dzde'fdZ*dede+e,e'effdZ-dZ.dede'fdZ/dede,e'dze'dzffdZ0dede'fdZ1 d^dedzde,e2dfdzddfd Z3d!e'de'dzfd"Z4d#e5de+e'fd$Z6de+e'fd%Z7d&e'de5fd'Z8de5fd(Z9d)e:de5fd*Z;d+e'de'fd,Zd1e'de5fd2Z?d_d4e'd5e'fd6Z@d_d4e'd5e'fd7ZAd_d4e'd5e'fd8ZBd4e'fd9ZCd:ZDdd;lEmFZGd]de'ddfd?ZId4e'd5e'd@e'dAe+e'ddf dBZJdCZKe,e,e'e'e'fdfeLdD<dEZMe,e'dfeLdF<dGZNe,e,e'e'fdfeLdH<dIe:dzde+e,e'e'ffdJZOdKe:dzde+e,e'e'ffdLZPdIe:dzdKe:dzde+e,e'e'ffdMZQ d^dIe:dzdKe:dzde+e,e'e'ffdNZRdeSe'dzfdOZTd/e+e:de+e:fdPZUde'dzfdQZVdAe+e'ddfdRZWdAe+e'ddfdSZXd`dUe5dAdVddfdWZYdAe+e'ddfdXZZda[e+dzeLdY<de+fdZZ\dad[Z]d\Z^dS)bzK Doctor command for hermes CLI. Diagnoses issues with Hermes Agent setup. N)Path)detect_install_method get_env_pathget_hermes_homeget_project_rootis_nix_install_method%recommended_update_command_for_method)load_hermes_dotenv)display_hermes_home)agent_browser_runnable.env) hermes_home project_env)Colorscolor)_HERMES_USER_AGENT)describe_vercel_auth)OPENROUTER_MODELS_URL)base_url_host_matches)DEEPINFRA_API_KEYOPENROUTER_API_KEYOPENAI_API_KEYANTHROPIC_API_KEYANTHROPIC_TOKENOPENAI_BASE_URL NOUS_API_KEY GLM_API_KEY ZAI_API_KEY Z_AI_API_KEY KIMI_API_KEYKIMI_CN_API_KEY GMI_API_KEYFIREWORKS_API_KEYACTUAL_API_KEYACTUAL_BASE_URLMINIMAX_API_KEYMINIMAX_CN_API_KEYKILOCODE_API_KEYDEEPSEEK_API_KEYDASHSCOPE_API_KEYHF_TOKENAI_GATEWAY_API_KEYOPENCODE_ZEN_API_KEYOPENCODE_GO_API_KEYCOMMANDCODE_API_KEYXIAOMI_API_KEYTOKENHUB_API_KEY) is_termuxreturnc&trdndS)Nzpython -m pip installzuv pip install) _is_termux5/home/agent/.hermes/hermes-agent/hermes_cli/doctor.py_python_install_cmdr9Ls&0ll H " "8HHr7pkgc\trd|Stjdkrd|Sd|S)Nz pkg install darwinz brew install zsudo apt install )r5sysplatform)r:s r8_system_package_install_cmdr?PsE||$#c### |x$s$$$ $s $ $$r7install_methodc|ptt}|dkrt|}d|d}n;t|rt|}n|dkrdt|d}nd}d|dS) zAReturn an actionable SQLite upgrade hint for this install layout.dockerzrun `z&`, then recreate all Hermes containersapt`zrun `hermes update`(u\; fixed versions: 3.51.3+ / 3.50.7 / 3.44.6 — see https://sqlite.org/wal.html#walresetbug))r PROJECT_ROOTr r)r@methodcommandactions r8_sqlite_upgrade_hintrJXs  B4\BBF 7??HHHH v & &'6v>> 5I>vFFIII& 7F 7 7 7r7rcddlm}fd|D}tdz dz dD]9}|t ||f:|S)zFReturn (display name, path) pairs for Hermes-managed SQLite databases.r)_QUICK_STATE_FILEScHg|]}|d||z fS)z.dbendswith).0namers r8 z*_hermes_database_paths..psE  ==   {T!"r7kanbanboardsz */kanban.db)hermes_cli.backuprLsortedglobappendstr relative_to)rrLentriesboard_dbs` r8_hermes_database_pathsr]ks544444&G K(2X=CCMRRSSKKH00==>>IJJJJ Nr7sSQLite format 3db_pathc |n&#t$r}t|cYd}~Sd}~wwxYwtj|tjsd|SdS)uvExplain why a database file could not be read, without opening it. ``read_header_bytes_preopen`` collapses every ``OSError`` into ``None``, but doctor's job is to say *which* problem it hit. ``stat()`` and ``access()`` answer that from directory metadata alone — neither takes a file descriptor, so neither can cancel the file's POSIX advisory locks. Nzpermission denied: zfile could not be read)statOSErrorrYosaccessR_OK)r^excs r8_unreadable_reasonrf~st  3xx 9Wbg & &/.W... # #s :5::cFddlm}m}||d}|||rdSdt|fSt |dkrdSt |dks|t sdS|d d krd S|d d krd Sdd|d fS)u"Return (journal mode, error) from the file header without opening the database. Header byte 18 is 2 for WAL and 1 for a rollback journal. Opening the database through the SQLite engine — even read-only — creates -wal/-shm sidecar files, which a diagnostic must not do. The byte read is routed through ``read_header_bytes_preopen`` rather than a bare ``open()``: closing *any* descriptor for a database file cancels this process's POSIX advisory locks on it, so a raw read would drop the locks a live connection is holding (see ``hermes_cli.sqlite_safe_read``). ``run_doctor`` is also called in-process by the dashboard console, which holds live ``SessionDB`` connections. The helper refuses in that case and the mode is reported as unreadable instead. r)has_live_connectionread_header_bytes_preopen)lengthN)Nz database is open in this process)Nz file is empty)Nzfile is not a database)walN)rollbackNz!unrecognized file-format version )hermes_cli.sqlite_safe_readrhrirflen startswith_SQLITE_HEADER_MAGIC)r^rhriheaders r8_read_journal_modervs ' &wr : : :F ~  w ' ' <;;'0000 6{{a$$ 6{{Rv001EFF-- bzQ{ bzQ AVBZAA AAr7c|ddlm} |j}n#t$rYdSwxYw||S)Nr) _format_sizez size unknown)rUrxr`st_sizera)r^rxnbytess r8_format_db_sizer{s_/.....' ~~ <  s " 00 version_info.cddlm}m}||}||nt} t |}n*#t $r}t d|Yd}~dSd}~wwxYwg}|D]\} } | st| \} } t| } | 0|rt | dd| dWt| d| d m| d krD|r,| | t | d | d d t| d | d |rt| d| dt| d| d |rtd|dSdS)zIList each database's journal mode; warn on WAL under a vulnerable SQLite.r)_wal_reset_repair_hintis_sqlite_wal_reset_vulnerableNz!Could not list Hermes databases: z : journal mode could not be readrEz; cannot rule out WAL exposure)z": journal mode could not be read ()rnz is in WAL mode (z7(exposed to the WAL-reset bug until SQLite is upgraded)z: WAL journal mode (z: rollback journal mode (z, not exposed)zTo clear the exposure: ) hermes_stater~r HERMES_HOMEr] Exception check_warnis_filervr{ check_inforX)rr|r~r vulnerablehome databasesreexposedrQpathmodeerrorsizes r8_report_database_journal_modesrsB TSSSSSSS// ==J%1;;{D*400 >>> dNNeNNNOOOO U]] At$$$55d555M d?????@@@@  B $MMMMM N N N N $@@@@@ A A A AIG-C-C-E-EGGHHHHHIIs0 AAAcmdcN tj|S#t$rYdSwxYw)zCshutil.which wrapper resilient to platform monkeypatching in tests.N)shutilwhichr)rs r8 _safe_whichrs9|C   tts  $$node_installedcg}d}|s||d|dz }||d||dzd|S)Nroz) pkg install nodejsz) npm install -g agent-browserz) agent-browser install)rX)rstepssteps r8_termux_browser_setup_stepsrswE D  222333   LLD888999 LLD1H555666 Lr7c gdS)N)z`Termux install profile: use .[termux-all] for broad compatibility (installer default on Termux).zNMatrix E2EE extra is excluded on Termux (python-olm currently fails to build).zYLocal faster-whisper extra is excluded on Termux (ctranslate2/av build path unavailable).zaSTT fallback: use Groq Whisper (set GROQ_API_KEY) or OpenAI Whisper (set VOICE_TOOLS_OPENAI_KEY).r6r6r7r8"_termux_install_all_fallback_notesrs   r7contentcDtfdtDS)zIReturn True when ~/.hermes/.env contains provider auth/base URL settings.c3 K|]}|vV dSNr6)rPkeyrs r8 z+_has_provider_env_config.. s'==#sg~======r7)any_PROVIDER_ENV_HINTS)rs`r8_has_provider_env_configrs' ====)<=== = ==r7c ddlm}|}t|jo |jp|jS#t$rYdSwxYw)zRReturn True when Honcho is configured, even if this process has no active session.r)HonchoClientConfigF)plugins.memory.honcho.clientrfrom_global_configboolenabledapi_keybase_urlr)rcfgs r8 _honcho_is_configured_for_doctorr sjCCCCCC 3355CKAS[%@CLBBB uus;> A  A itemc|ddkrdStjdrdS|dpg}t|ot d|DS)zQReturn True when Kanban is unavailable only because this is not a worker process.rQrSFHERMES_KANBAN_TASKtoolsc3ZK|]&}t|dV'dS)kanban_N)rYrs)rPtools r8rz-_is_kanban_worker_env_gate.. s6QQ4s4yy33I>>QQQQQQr7)getrbenvironrall)rrs r8_is_kanban_worker_env_gatersx xx8##u z~~*++u HHW   #E ;; Q3QQ5QQQQQQr7toolsetcT|dkr!tjdsdSdS)zKOptional explanatory suffix for toolsets whose doctor status needs context.rSrz;(runtime-gated; loaded only for dispatcher-spawned workers))rbrr)rs r8 _doctor_tool_availability_detailr#s,(2:>>2F#G#GLL 2r7cg} ddlm}m}ddlm}m}|n#t $r|cYSwxYwd|fd|ffD]\}} |}n#t $rd}YnwxYw||d|df>t|d dpt|j }||r|d |d |d f|d|d |d f|S)aXReturn doctor rows for web search/extract provider readiness (#78412). Each row is ``(status, label, detail)`` where *status* is ``ok`` or ``warn``. Uses the same active-provider resolvers as the tools, but reports readiness from ``is_available()`` so an explicitly selected but unconfigured backend does not look healthy. r)get_active_extract_providerget_active_search_provider)_ensure_web_plugins_loaded_provider_is_readyz web searchz web extractNwarnz$(no provider selected or registered)rQokrErz# selected; provider not configured)) agent.web_search_registryrrtools.web_toolsrrrrXgetattrtype__name__) rowsrrrr capabilitygetterproviderrQs r8_doctor_web_capability_rowsr*s(*D          SRRRRRRR #"$$$$   12 34 F vxxHH   HHH    KK:    x..I$x..2I  h ' '  KKz;t;;;7 8 8 8 8 KKAAAA     Ks .. A  AA available unavailablec8t|}g}|D]}|d}t|rd|vr|d@|dkr(t rd|vr|dn||||fS)z>Adjust runtime-gated tool availability for doctor diagnostics.rQrShoncho)listrrrXr)rrupdated_availableupdated_unavailablerrQs r8)_apply_doctor_tool_availability_overridesr`sY ) )xx %d + + 000!((222  8   @ B B 000!((222 ""4(((( 1 11r7provider_labelc~|pd}|dkrD ddlm}t |pidS#t $rYdSwxYw|dkrD ddlm}t |pidS#t $rYdSwxYwdS) ajReturn True when a direct API-key probe failure is non-blocking. Some provider families support both a direct API-key path and a separate OAuth runtime path. When the OAuth path is already healthy, doctor should still show a failed API-key connectivity row, but it should not promote that direct-key problem into the final blocking summary. rminimaxr)get_minimax_oauth_auth_status logged_inFxaiget_xai_oauth_auth_status)striplowerhermes_cli.authrrrrr)r normalizedrrs r8/_has_healthy_oauth_fallback_for_apikey_providerrrs !&B--//5577JY  E E E E E E6688>BCCKPPQQ Q   55 U  A A A A A A2244:?? LLMM M   55  5s#1A"" A0/A0:1B,, B:9B:rtextdetailctdtdtjd||rdt|tjndzdS)N ✓ r)printrrGREENDIMrrs r8check_okrsY 2uUFL)) 2 2D 2 2Y_6g6U% :S:S6U6U6Ueg hiiiiir7ctdtdtjd||rdt|tjndzdS)Nr⚠rr)rrrYELLOWrrs r8rrsY 3uUFM** 3 3T 3 3Z`7h7V5;T;T7V7V7Vfh ijjjjjr7ctdtdtjd||rdt|tjndzdS)Nr✗rr)rrrREDrrs r8 check_failrsY 0uUFJ'' 0 0$ 0 0W]4e4Sffj8Q8Q4S4S4Sce fgggggr7c`tdtdtjd|dS)N u→r)rrrCYAN)rs r8rrs3 3ufk** 3 3T 3 344444r7i@) format_bytesstatscg}|pi}|d}|d}|d}g}|%|dt||d||ddd|||dd |%|d t||r.|d d d |zdfg}|d||ddd|d||ddd|dr|d|d|||d|r+|d d |df|d}|rPd|D} |d d| rd | ndzdf||t kr{d} |duo+|do|ddu} |ds| r| dz } |dd t|d!d"| d!f|S)#uTurn a collect_state_db_stats() dict into doctor output lines. Returns a list of ``(kind, text, detail)`` tuples where kind is one of 'info' / 'warn'. Pure formatting — no I/O — so it is unit-testable without spawning the doctor CLI. Tolerates None in every field. logical_size_byteswal_size_bytesfreelist_countNz logical size page_count,z pagesz freezWAL infoz state.db , rmessagesz messagessessionsz sessions journal_modez journal_mode=z process(es) holding the DB open fts_tablescg|] \}}|| Sr6r6)rPtrs r8rRz*_render_state_db_stats..s!444B41444r7z FTS tables: nonezDconsider enabling sessions.auto_prune in config.yaml to bound growthmessages_fts_trigramfts_storage_versionfts_rebuild_pendingzb; run 'hermes sessions optimize-storage' offline (with the gateway stopped) to compact FTS storagerzstate.db is large (rrE)rrX _human_bytesjoinitemsSTATE_DB_SIZE_WARN_BYTES) rholderslineslogicalrnfreelist size_bitsrow_bitsftspresentrlegacy_trigrams r8_render_state_db_statsrsgE KREii,--G ))$ % %Cyy)**HI@g)>)>@@AAA yy*E,/9999:::H----... 3 S 1 133444G fkDIIi,@,@@"EFFFH yy(5,9999::: yy(5,9999::: yy  A?n(=??@@@7DDDEEE8 fdii1126777 ))L ! !C  44#))++444  GGdii000 H     w)AAA   tO 9.// 9 /00D8  99* + + ~  D F   :,w"7"7 : : : MMM     Lr7titlectttd|tjtjdS)u@Print a doctor section banner: blank line + bold cyan ◆ title.u◆ N)rrrrBOLD)rs r8_sectionrs5 GGG %u V[ 9 9:::::r7fixissuescPt||||dS)z?Emit a check_fail and append the corresponding fix instruction.N)rrX)rrrr s r8_fail_and_issuer"s*tV MM#r7))displaytool_progress_overrideszdisplay.platforms) delegationmax_async_childrenz"delegation.max_concurrent_children_DEPRECATED_CONFIG_KEYS) summary_modelsummary_providersummary_base_url$_DEPRECATED_COMPRESSION_SUMMARY_KEYS))HERMES_TOOL_PROGRESSuSdisplay.tool_progress in config.yaml — ignored/unsupported since config floor v12)HERMES_TOOL_PROGRESS_MODEz$display.tool_progress in config.yaml) TERMINAL_CWDterminal.cwd in config.yaml) MESSAGING_CWDr/)QQ_HOME_CHANNELQQBOT_HOME_CHANNEL)QQ_HOME_CHANNEL_NAMEQQBOT_HOME_CHANNEL_NAME_DEPRECATED_ENV_VARS raw_configcg}t|ts|StD]P\}}}||}t|tr ||vr||d||fQ|d}t|tr(t D] }||vr|d|df!|S)u)Return ``(legacy_path, replacement)`` for deprecated keys present in *raw_config*. Only keys that appear in the on-disk YAML are reported (raw file load, not merged defaults). Empty containers still count — presence of the legacy key is the signal that the user should migrate. . compressionz compression.zauxiliary.compression) isinstancedictr'rrXr+)r6findingssectionr replacement section_valr9s r8collect_deprecated_config_keysr@s')H j$ ' '%<??!k nnW-- k4 ( ( ?SK-?-? OO//#//= > > >..//K+t$$Q7 Q QCk!!!5!5!57N OPPP Or7env_mapcg}t|ts|StD]X\}}||}|vals r8collect_deprecated_env_varsrD6s ')H gt $ $111kkk$ ?s3xx~~//255 OOT;/ 0 0 0 Or7c~ddlm}m}m}m}g}t |t rh|d}t |t r>||dD]}|d|d|f t |pi} g||RD]:} | | vr4tj | tj | | | <;t| |d s)|| D]} || d |d f|S) z?Return actionable findings for the removed Hermes Relay plugin.r)LEGACY_RELAY_EXPORT_ENV_VARSRELAY_PLUGINS_CONFIG_ENV configured_legacy_relay_env_varslegacy_relay_plugin_keyspluginsrzplugins.enabled: zremove it and configure Nrzmove exporter settings to z; this variable is now ignored) hermes_cli.relay_plugin_cutoverrFrGrHrIr:r;rrXrbrrYr) r6rArFrGrHrIr<rJr effective_envrQs r8%collect_relay_plugin_cutover_findingsrMFs ')H*d## ..++ gt $ $ // I0F0FGG  1C11M3KMMB''MI.I0HII33 } $ $)=)=)I"$*T"2M$  }  !92>> ? ? E E G G44]CC  D OO31I333     Or7ct|}|t|t||}||z}|st d|S|D]2\}}t d|d|dt d|d|d3|D]1\}}t d|d |d t d |d |2|S) a!Emit non-failing doctor warnings for deprecated config keys and env vars. Returns the list of ``(legacy, replacement)`` findings that were reported (empty when nothing deprecated is present). Does not mutate config/env and does not append to the blocking ``issues`` list. z%No deprecated config keys or env varsz Deprecated: z(use z instead)zReplace u → z$ (warn-only; not auto-migrated here)zBreaking Relay migration: rErzMigrate : )r@extendrDrMrrr)r6rA deprecated relay_cutoverr<legacyr>s r8 report_deprecated_config_and_envrTns30 ;;J1'::;;;9*gNNMM)H 8999)^^  #6 # # *K * * *    \f\\;\\\]]]],77  1 1 1        5f55 556666 Or7c~ ddlm}ddlm}d||pidDS#t$rYdSwxYw)zHReturn toolsets enabled for the CLI, or None if config resolution fails.r load_config)_get_platform_toolsc,h|]}t|Sr6)rY)rPrs r8 z3_enabled_cli_toolsets_for_doctor..s\\\G \\\r7cliN)hermes_cli.configrWhermes_cli.tools_configrXr)rWrXs r8 _enabled_cli_toolsets_for_doctorr^s|111111??????\\,?,? @SQSUZ,[,[\\\\ tts +. <<c\d|D}t|Sfd|DS)zAFilter unavailable API-key toolsets to those enabled for the CLI.cfg|].}|ds|d,|/S) missing_varsenv_varsrrPrs r8rRz9_missing_api_key_toolsets_for_summary..sN 88N # #'+xx ';'; r7Nc`g|]*}t|dpdv(|+S)rQr)rYr)rPrenabled_toolsetss r8rRz9_missing_api_key_toolsets_for_summary..sH    txx%2 & &*: : : : : :r7)r^)rapi_key_unavailablerfs @r8%_missing_api_key_toolsets_for_summaryrhsg$899""    ,   r7c$tdz } |d}n#t$rYdSwxYwd}|D]}|}|dr|dr|dk}G|r||d rgd |vrc|d d d }|d d d d}|pdcSdS)a>Read the ``version = "..."`` from ``pyproject.toml`` at the project root. Returns None when running from an installed wheel (no pyproject.toml ships with the package) or when the file can't be parsed. Reads only the ``[project]`` version, ignoring any version strings that appear in other tables. zpyproject.tomlutf-8encodingNF[]z [project]version=ro#rz"')rF read_textra splitlinesrrsrOsplit) pyprojectr in_projectrawlinevalues r8_read_pyproject_versionrzs0//I""G"44 ttJ  !!yy{{ ??3   DMM#$6$6 ,J   !$//)44 !JJsA&&q)EKKQ''*002288??E=D 4s # 11c ddlm}n#t$rYdSwxYwt}|dS||krt dd|ddSt dd|d |dd |dS) alVerify pyproject.toml version matches hermes_cli.__version__. A git conflict resolution (reset/merge) can revert one file without the other, leaving ``hermes --version`` reporting a stale version while ``pyproject.toml`` is current. Detect that drift so users can re-sync. Silent no-op for installed wheels where pyproject.toml isn't present. r) __version__NzVersion files consistentrErz%Version mismatch between source filesz(pyproject.toml z != hermes_cli/__init__.py zsRe-sync version files (e.g. run 'hermes update', or set hermes_cli/__init__.py __version__ to match pyproject.toml)) hermes_clir|rrzrr")r  init_versionpyproject_versions r8_check_version_consistencyrs::::::: /11 L((+-@-@-@-@AAAAA 3 \0 \ \\ \ \ \ J       s  c P ddlm}m}n#t$rYdSwxYw|dkrdSt d|dD]<}|rt |d*t|d=}|std dStfd |D}t d |d t|d t|dkr&dd t|dndzdS)a Inside a container under our s6 /init, surface what s6 sees. Runs as a counterpart to :func:`_check_gateway_service_linger` for the systemd-on-host case. No-op everywhere except in the s6 container so host runs aren't cluttered with irrelevant output. Reports: - Whether the main-hermes and dashboard static services are up - How many per-profile gateway slots are registered (via ``S6ServiceManager.list_profile_gateways()``) and how many are currently supervised as ``up`` r)S6ServiceManagerdetect_service_managerNs6zs6 Supervision)z main-hermes dashboardz: upz(: down (expected if not enabled via env)uYNo per-profile gateways registered yet — create one with `hermes profile create `c3LK|]}d|dVdS)zgateway-roN) is_running)rPpmgrs r8rz(_check_s6_supervision..s:II#..A*H*HI1IIIIIIr7zPer-profile gateways: /z supervised upz (rrr) hermes_cli.service_managerrrrrrrrlist_profile_gatewayssumrrrrV)r rrstaticprofilesup_countrs @r8_check_s6_supervisionrs          4''     C/LL >>& ! ! L ___ % % % % &JJJ K K K K((**H noooIIIIhIIIIIH IIICMMIII25h--12D2D . &**++ . . . ." Ns  F should_fixz list | Nonec8 ddlm}ddlm}n5#t$r(}t dt |Yd}~dSd}~wwxYw |tddS#|$r}t |}Yd}~n8d}~wt$r(}t dt |Yd}~dSd}~wwxYw|s7td||#| dtj d dStd|td  tjtj d d d ddgddd}nZ#t$rM}tdt ||#| dtj dYd}~dSd}~wwxYw|jdkrO|jp|jpddd}td||#| dtj ddSddl} dtjDD]"} tj| d#| j |tddS#|$rE}tdt ||| dYd}~dSYd}~dSd}~wwxYw)uVerify the certifi CA bundle is loadable. Surfaces the SSLConfigurationError user-friendly path before they hit a wall of tracebacks on the first outbound HTTPS call. With ``--fix``, a broken bundle (missing/corrupt ``cacert.pem`` — e.g. after a brew Python upgrade rebuilt the venv, #29866) is repaired by force-reinstalling certifi into THIS interpreter's environment and re-verifying. r)verify_ca_bundle_with_fallback)SSLConfigurationErrorzSSL certificate check skippedNz"SSL CA certificate bundle is validz#SSL CA certificate bundle is brokenz5Repair the CA bundle: run `hermes doctor --fix`, or `z* -m pip install --force-reinstall certifi`u0 → Repairing: force-reinstalling certifi...z-mpipinstallz--force-reinstallcertifiTi,)capture_outputrtimeoutz certifi repair could not run pipzReinstall certifi manually: z) -m pip install --force-reinstall certifiri zcertifi reinstall failedcHg|]}|dks|d| S)rzcertifi.)rs)rPms r8rRz&check_certificates..Ts-ZZZ1qI~~jAYAY~Q~~~r7z8SSL CA certificate bundle repaired (certifi reinstalled)z6SSL CA certificate bundle still broken after reinstallucertifi reinstall did not restore the CA bundle — check for a custom CA env var (SSL_CERT_FILE/REQUESTS_CA_BUNDLE) pointing at a missing file, or recreate the venv.)agent.ssl_guardr agent.errorsrrrrYrrrXr= executabler subprocessrun returncodestderrstdout importlibmodulespopinvalidate_caches) rr rre first_errorresultretailrmod_names r8check_certificatesrsBBBBBB6666666 2CFF;;;&&(((5666 !ff 2CFF;;; 8+FFF   MMONOOO     4kBBB <=== ^T5)5H) T     5s3xx@@@   MM,s~,,,    A 44"dee<-t444   MM,s~,,,    ZZ ZZZ(( $''''I!!! &&(((KLLLLL KSQRVVTTT   MM;               sg  A<AA B.%A99 B.B))B. (D33 F =AFF 4IJ4JJc ddlm}m}m}ddlm}n,#t $r}tdd|dYd}~dSd}~wwxYw|sdS|dkrdS|}|sdStd |\}}|d urtd d dS|d ur6tddtd| ddStdd|ddS)u$Warn when a systemd user gateway service will stop after logout. Skipped inside a container running under s6 — the linger concept (user-systemd surviving SSH logout) doesn't apply there, and the s6 supervision state is surfaced separately by ``_check_s6_supervision``. r)get_systemd_linger_statusget_systemd_unit_pathis_linux)rzGateway service lingerz#(could not import gateway helpers: rNrzGateway ServiceTzSystemd linger enabledz!(gateway service survives logout)FzSystemd linger disabledz(gateway may stop after logout)z&Run: sudo loginctl enable-linger $USERzMEnable linger for the gateway user service: sudo loginctl enable-linger $USERzCould not verify systemd lingerrE) hermes_cli.gatewayrrrrrrrexistsrrrrX) r rrrrr unit_pathlinger_enabled linger_details r8_check_gateway_service_lingerres           FEEEEEE +-WST-W-W-WXXX 8:: 4''%%''I      $=$=$?$?!NM)+NOOOOO 5 ,.OPPP;<<< efffff46J-6J6J6JKKKKKs <7<_APIKEY_PROVIDERS_CACHEcgd}d|D}t}iddddddd d d d d ddddddddddddddddddd d!d"}|D]\}}||hd#}|| d$d%lm}d$d&lm} d$d'lm } n"#t$rd(td)tfd*} YnwxYw|D]} t| |r| j d+ks| js&| jp| j}||vs | j|vrB| | jh} | jpd,D] } | | | !| |zrt%d-| jD} t'd.| jDd/}| s| jr$| jp| jd0d1znd/}t/| d2d3}||| |||fn#t$rYnwxYw|S)4uHBuild the API-key provider health-check list once and cache it. Tuple format: (name, env_vars, default_url, base_env, supports_models_endpoint) Base list augmented with any ProviderProfile with auth_type="api_key" not already present — adding plugins/model-providers// is sufficient to get into doctor. )) Z.AI / GLM)rrrz#https://api.z.ai/api/paas/v4/models GLM_BASE_URLT)Kimi / Moonshot)r z!https://api.moonshot.ai/v1/models KIMI_BASE_URLT)StepFun Step Plan)STEPFUN_API_KEYz*https://api.stepfun.ai/step_plan/v1/modelsSTEPFUN_BASE_URLT)Kimi / Moonshot (China))r!z!https://api.moonshot.cn/v1/modelsNT)Arcee AI)ARCEEAI_API_KEYz"https://api.arcee.ai/api/v1/modelsARCEE_BASE_URLT) GMI Cloud)r"z%https://api.gmi-serving.com/v1/models GMI_BASE_URLT)DeepSeek)r)z"https://api.deepseek.com/v1/modelsDEEPSEEK_BASE_URLT) Hugging Face)r+z'https://router.huggingface.co/v1/models HF_BASE_URLT) NVIDIA NIM)NVIDIA_API_KEYz*https://integrate.api.nvidia.com/v1/modelsNVIDIA_BASE_URLT)Alibaba/DashScope)r*z=https://dashscope-intl.aliyuncs.com/compatible-mode/v1/modelsDASHSCOPE_BASE_URLT)MiniMax)r&z https://api.minimax.io/v1/modelsMINIMAX_BASE_URLT)MiniMax (China))r'z"https://api.minimaxi.com/v1/modelsMINIMAX_CN_BASE_URLF)Vercel AI Gateway)r,z&https://ai-gateway.vercel.sh/v1/modelsAI_GATEWAY_BASE_URLT) Kilo Code)r(z&https://api.kilo.ai/api/gateway/modelsKILOCODE_BASE_URLT) OpenCode Zen)r-z!https://opencode.ai/zen/v1/modelsOPENCODE_ZEN_BASE_URLT) OpenCode Go)r.NOPENCODE_GO_BASE_URLFch|] }|d S)rr6)rPrs r8rZz/_build_apikey_providers_list..s***QAaD***r7rzairz kimi-codingrstepfunrzkimi-coding-cnrarceergmirdeepseekr huggingfacernvidiaralibabarrrz minimax-cnr ai-gatewayrkilocoder opencode-zenrz opencode-go>bedrock anthropic openrouterr)list_providers)ProviderProfile)normalize_provider_namer3cR|pdS)Nr)rr)rs r8_normalize_providerz9_build_apikey_providers_list.._normalize_providers$ **,,22444r7rr6c3nK|]0}|d|d,|V1dS _BASE_URL_URLNrNrPvs r8rz/_build_apikey_providers_list..s\zz+..78zz&7I7Ir7c3nK|]0}|ds|d,|V1dSrrNrs r8rz/_build_apikey_providers_list..sEZZqAJJ{,C,CZqzzRXGYGYZZZZZZZr7Nr/modelssupports_health_checkT)setraddupdate providersrproviders.baserhermes_cli.providersrrrYr: auth_typerb display_namerQaliasestuplenextr models_urlrstriprrX)_static _known_names_known_canonical_name_to_canonical_label _canonical_dedicated_canonicalr_PPr_pp _candidates_alias _key_vars _base_var _models_url_hcs r8_build_apikey_providers_listrsG*+*'***L"% e .  Y (ACS  G )% 2## M MCc3'' 3=I+E+ES\+E%1F%%5E)E)E..sx889K;," = = 3 3F ; ;<<<<11 <IZZCLZZZI <*ICL$7$7$<$|d|jjd|jd|jd|jjd | }| D]<}|jj|vr,t=|jd|jd!|jjd"=nt?d#n)#t@$r}t=d$|Yd}~nd}~wwxYwt#d% dd&l!m"}dd'l#m$}|%d(pi}d}tM|tNrt|(D]o\}}tM|tNs|||}|s*|dz }t=d)|d*d+ ||d,|d-p|dkrt?d.n)#t@$r}t=d/|Yd}~nd}~wwxYwt#d0tj)}|d1kr(t?d2|j*d3|j+d3|j,n|d4kr7t?d2|j*d3|j+d3|j,t=d5nY|d6kr)t=d2|j*d3|j+d3|j,d7n*t[d2|j*d3|j+d3|j,d8d9| ddl.}dd:l/m0}m1}|j2}|} tg| d;kr | dd;dtint?d=||!rtkd?|!tmn)#t@$r}t=d@|Yd}~nd}~wwxYwtj7tj8k}"|"rt?dAnt=dBdCts|t#dDtu||Et#dFgdG}#gdH}$|#D][\}%} tw|%t?|%#tx$r*t[|dIdJ|dKt{dL|%|YXwxYw|$D]E\}%} tw|%t?|dM&#tx$rt=|dNYBwxYwt#dOt}t~dPz }&|&@rt?tdQ |&BdRS}'n&#t$r|&BdTS}'YnwxYwt|'rt?dUn*t=dVtdW|dXntdPz }(|(@rt?dYnt-tdZ|r|&jFGd[d[\|&H tjIt|&d]n#t$rYnwxYwt?d^tdWtkdX|dz }n$tkd_|d`t~daz })|)@rt?tdb ddcl!mL}*|*|)}+|+%ddpi},|,%depdfM}-|-N}.|,%dgp|,%ddpdfM}/t}0 ddhlPmQ}1mR}2t|1Shdiz}0n#t@$rd}2YnwxYw ddjl!mT}3ddklUmV}4mW}5mX}6n#t@$r d}3d}4d}5d}6YnwxYwg}7|3 |3|+}7n#t@$rg}7YnwxYw|+%dl}8tM|8tNr;ddml!mY|0Zfdn|8(D|7D]}tM|tNst|%dopdfM}t|%dppdfM}9|r!|4|0Z|4||9t|0}:|.r|.hn t};|54|0D]1}< |:[|5|<"#t@$rY.wxYw|.}=|.r:|28|.dqvr4 |2|.}=|;[|=n#t@$r|.}=YnwxYw|.}>|.r5|63|.dqvr/|6|.|8|7}?|?|?jnd}>|>|;[|>|.rV|.drkrP|>|0rL|;|:zsG|0r"d t|0nds}@t[dt|-dudv|@ddt|-dw|@dx||=p|>}At|ApdfMN}Bhdy}C|B|Cvp|Bdzkp|B\d{}D|/r;d||/vr7|Br5|Ds3t=d}|/d~|-dd|d}|/d|-d|=r<|=dvr7 |=dkrlddl!m]}Ett|EdpdfMp+t|EdpdfM}FnddlPmQ}1m_}G|1%|=}Hd[}F|Hrnt|HddfdkrY|G|=pi}It|I%dp)|I%dp|I%d}F|Fs"t[dt|=ddd|=dtd|n#t@$rYnwxYwn#t@$r}t=dd|dYd}~nd}~wwxYwtdz }J|J@rt?dn|r|)jFGd[d[\tdz }K|K@rHtjat|Kt|)t?dtdn+ddl!mb}Lmc}M|M|Lt?dtd|dz }nt=ddt~daz })|)@r ddl!md}Nme}O|N\}P}Q|P|Qkrt=d|Pd|Qdd|ra |Oddt?d|dz }ng#t@$r1}Rt=d|R|dYd}R~Rn1d}R~RwwxYw|dnt?d|Pdn#t@$rYnwxYw ddcl!mL}*|*|)fddD}S|Sr+t=dd |Sd|r%dd}TtM|TtNr|T},nNtM|Ttr1|TMrdg|TMi},|,dd<ni},|,dd<|SD]G}U|,%|Usf|U|,|U<1f|UHddl!mg}V|V|)t?d|dz }n|dn#t@$rYnwxYw ddl!mh}WmL}*mi}X|*|)%d}YtM|YtNr|Y%dnd}Z|Z%d}Z|W%d}[|ZduoG|[duoCt|ZMt|[Mk}\|\rt=d|[d|Zdd|rR|Xdrt?d|Zd|dz }nCt=d|dtdn|dn#t@$rYnwxYw ddl!mh}]ddcl!mL}^|^|)}_ |]}`n#t@$ri}`YnwxYwt|_|`n#t@$rYnwxYw ddl!mk}a|a}b|brt#d|bD]{}c|cjldkrt-|cjmnt=|cjm|cjnoD]}dtk|d||cjm|n#t@$rYnwxYw|)@sF ddl!mh}] |]}`n#t@$ri}`YnwxYwti|`n#t@$rYnwxYwt#d dd&l!m"}ddlpmq}emr}fms}g|}h|f|h}i|ist?dnW|iD]}jt=|g|jtkd|e|dtg|id|en+#t@$r}kt=dd|kdYd}k~knd}k~kwwxYwt#dƦ ddlPmt}lmu}mmv}n|l}o|o%drt?ddɦnt=ddʦ|m}p|p%drt?ddɦnXt=ddʦ|p%drtk|pdtd̦stkdͦ|n}q|q%dr+|q%ddϦ}rt?dd|rdnt=ddʦn+#t@$r}t=dd|dYd}~nd}~wwxYw ddlPmx}s|spi}t|t%drt?ddɦn:t=ddʦ|t%drtk|tdn#t@$rYnwxYwt#d֦t~}u|u@rt?tdםnO|r5|uGd[d[\t?dtd؝|dz }nt=tdٝdڦgdۢ}v|vD]}w|u|wz }x|x@rt?td||wdܝ6|r8|xGd[d[\t?dtd||wd||dz }pt=td||wdݝdڦ|udz }y|y@rx|yBdRSM}'d߄|'oD}z|zrt?tdntktdnjt=tdd|rP|yjFGd[d[\|yyddRSt?dtd|dz }|udz }{|{@rt?td|{dz }||{dz }}||@rItg||BdRSM}~t?d|~dntkd|}@rItg|}BdRSM}~t?d|~dn^tkdnNt=tddڦ|r4|{Gd[d[\t?dtd|dz }|udz }|@r5 ddl.}|zt|}|{d}||d}|}t?td|dddl/m~}m}||}| t=tdd|d|r||}|%drb|%drt|djnd}t?dd|%dd|d|dz }nit=dd|%dd|%dd|dn|dn#t@$r}ddl/m}m}||rt=tdd|d|rU||}|%dr |zt|}|{d|d}|}n#t@$rd}YnwxYw|%drt|djnd}t?d|dd|%dd|d|dz }nt=dd|%dd|%dd|dn1|dnt=td |Yd}~nd}~wwxYw dd l/m}m}||}||}t || D]]\}}}|d kr7t=||d |vr!|dd|vrdndfzDtk||rdL|ndfz^nC#t@$r}tkd|dYd}~n d}~wwxYwtktd|udz }|@r, |j}|dkrt=d|dzdd|rddl.}|zt|}|{d|}|@r|jnd}t?d|dzd|dzd|dz }n7|dn |dkrtkd |dzd!n#t@$rYnwxYwt|t|tjd"kr4t#d#d}d$D],}t|z d%z d&z }|@r|}n-tj%d'df}ttj%d(pd)|v}|r|rt|d%z }d*}ntjd+z d%z }d,}|d&z }|4t=d-d.|d/td0n(t?d1|td|r|}|}||krt?|d2nt=|d3d4|d5|d|rG|||t?d6|d7||dz }n?|d8|d9n"|@rt?|d:nt-|d;d<|r|Gd[d[\||t?d=|d7||dz }tj%d>dftj}t||vr0t=|d?d@|dA|dBn|dC|dDt#dEtdFrt?dFnt=dGdMtdHrt?dIdJn4t=dKdLtkdMt'dNtjdOdP} ddQlm}|}n#t@$rd}YnwxYw|r|dRkrtkdSdP}|dRkrtdRrm t/jdRdTgd[dUV}n#t.j$rd}YnwxYw||jdkrt?dRdWnt[dXdfdY|nlt[dZd[d\|nVtdRrt?dRdMn4t7rtkd]n|rnt=dZdM|d^kr)tjd_}|rtjd`}tjda}tjdb}|r|dc|n|}gdd}|r|de|gz }|r%|dftj|gz }||dggz } t/j|d[d[dRdhdij}n#t.j$rd}YnwxYw||jdkrt?dk|n0t[dk|dfdl||nt[dmdndo||dpkrtjdq}|rt?drdsnt[dtdudv| ddwlm}t?dxdyn%#tx$rt[dzd{d||YnwxYw|d}krtjd~dMpd}ddlm}||vrt?dd|dn4d |}t[dd|d|dd||tjddM}|dvrt?ddnt[ddd|tDjdt?ddynt[ddd|tK}|jrt?dd|jdnV|j\drt[dd|jdd|nt[dd|jdd||jD]}tkd|tjddNdv}|rtkdntkdtdr*t?dd} ddlm}m}|d}n#t@$rd}YnwxYw|rT||rIt?ddd[}|r2ddlm}|rtkdntkdn|r%t[|rt?ddd[}n|rt=dd|dnvt7rUtkdtkdtkdt]d[D]}tk|nt=dd|rސt7s ddlm}m}m}m}m}|p,t|p|dup |}|su|rt?ddnt=ddtjd"krtkdtdntkdtdn#t@$rYn{wxYwnvt7rUtkdtkdtkdt]dD]}tk|nt=ddtd}|r ddlm}|}n#t@$rtdz dz }YnwxYwtddgftdÐdĐdgftdƐdĐdgf|dgfg}|D]\}}}|rtn|}|Đdz @s+ t/j|dʐdg|ât|d[d[dRdhd̐ͦ}ddl}|jMr|Ơ|jni}|Ǡ%di%di}|Ƞ%dd}|Ƞ%dd}|Ƞ%dd}||z|z}|r|ddkrd}n|Ðdgkr d|dԝ}nd|d՝}|dkrt?|›d֝dצn|dks|dkr|r|ɛd|ʛd|˛d|͛}n|ɛd|ʛd|˛d۝}t=|›d֝d|Λd|r|ddkrtkdܦ||›d|̛d|dkrdndϛn&t?|›d֝d|˛d|dkrdndϛd#t@$rYwxYwt7r1tkdtsD]}tk|Ϧt#dddlm}ddlm}|ѐdgdg}Ґdffd }Ӑdffd }Ԑdffd dffd }Րdffd }|Ҡd|f|Ҡd|ft|tat|D],}|\}}}}}|Ҡ||||||ffd f-|Ҡd|f|Ҡd|ftdtdtg|Ҧdtjdfd[tj%d}ݐdtjd< |Рdd5fd|D}ސd|D}dddn #1swxYwY|݀"tjfddnJ|tjd<n9#|݀"tjfddn|tjd<wxYwtddf|D]}|jD]8\}}}|rtd|dL|dL|"td|dL|9t|j}|rt|jrg}|D]}||t#d tjdttddlm}m}|\}}t||\}}g}d|vstd|Dr+t}|rd|D}d|D}|D]J}|%|i}t?|%do|t|K|D].\}I}}|Idkrt?||t=||/|D]z}|%dp|%dpg}|r1d |}t=|dod|dct=|dod{t|}td|D}|s|r|dn,#t@$r}t=d d|dYd}~nd}~wwxYwt#d t~d z d z }|@rt?d |dz }|@r ddl}||BdRS}tg|%di}t?d|dn"#t@$rt=ddYnwxYw|dz }|@r-td|Dnd}|dkrt=|ddnt=ddddl!m]}Edtfd}|Edp |Ed}|rt?dn9|rt?ddnt=d d!td"t#d#df} ddcl!mL}t~daz }|@re||} dd$lm}||}n#t@$rYnwxYw|%d%pi%dedf}n#t@$rYnwxYw|st?d&d'nm|d(kr dd)lm}m֐}|}|}|@s<|js|jrt?d*d+|d,nt=d-d.nې|jstkd/|d0n|js|jst[d1d.d2|ndd3lmې}mܐ}| ||t?d4d5|jd6|jd7|jnB#t@$r5}t[d8t|d9||Yd}~n d}~wwxYwn #tx$rt[d:d;d<|Ynt@$r/}t=d=t|Yd}~nd}~wwxYw|d>kr dd?lm}|}|%ddf}|rVt?d@tkdA|%dBddC|%dDdnt[dEdFdG|n #tx$rt[dHdIdJ|Ynt@$r.}t=dKt|Yd}~nd}~wwxYw ddLlm} | |} | r)| rt?|dMn.| rt=|dNdOnt=|dPd.n>#t@$r1}t=|dQt|Yd}~n d}~wwxYw ddRlm} m} m} ddl}dS| D}|rMt#dTt?tg|dU| }|D]+}g}|jr|dV|jr%||jdd̅|jdaz @s|dW|jdPz @s|dX||jz }|@s|dY|rd |nd}It?d|jdK|I-|rː|D]}|s |BdRS}'dZ|'vro|d[|'}|rS| |ds3t=d\|jd]|dd^#t@$rYwxYwn#tx$rYnt@$rYnwxYw dd_lm}|||n#t@$rYnwxYwt||z}|r|dkrttd`tjttda|dbtjtjdf|rFttdLtg|dctjtjntt|rAt|dD] \}}td|dd|!tnF|rttd`tjttdetg|dftjtjtt|dD] \}}td|dd|!t|s(ttdgtjn[ttd`tjttdhtjtjtdS(izRun diagnostic checks.rFackNHERMES_INTERACTIVE1r) ADVISORIES ack_advisorych|] }|j Sr6)id)rPas r8rZzrun_doctor..s...aQT...r7zUnknown advisory ID: z . Known IDs: rz(none)rmu ✓ Acknowledged advisory z,. It will no longer trigger startup banners.u ✗ Failed to persist ack for z*. Check ~/.hermes/config.yaml is writable.rou┌─────────────────────────────────────────────────────────┐uA│ 🩺 Hermes Doctor │u└─────────────────────────────────────────────────────────┘zSecurity Advisories)detect_compromisedfilter_unackedfull_remediation_text get_acked_idsrEz==rrzResolve security advisory z : uninstall z7 and rotate credentials, then run `hermes doctor --ack z`.z still installed (advisory z acknowledged)zNo active security advisoriesz Security advisory check failed: zMCP Server SecurityrV)validate_mcp_server_entry mcp_serversz MCP server 'z' has suspicious stdio commandz; zReview/remove mcp_servers.zC in config.yaml; rotate any credentials that may have been exposed.z No suspicious MCP stdio commandszMCP security check failed: zPython Environment) zPython r8)r3 zHPython 3.11+ recommended for RL Training tools (tinker requires >= 3.11))r3rz(3.10+ recommended)z(3.10+ required)zUpgrade Python to 3.10+)rsqlite_source_id0u…zSQLite z (WAL-reset bug)zSQLite source id: zSQLite version probe failed: zVirtual environment activezNot in virtual environmentz (recommended)zSSL / CA Certificates)rr zRequired Packages))openaiz OpenAI SDK)richzRich (terminal UI))dotenvz python-dotenv)yamlPyYAML)httpxHTTPX))croniterzCroniter (cron expressions))telegramzpython-telegram-bot)discordz discord.pyz (missing)zInstall rOrz (optional)z(optional, not installed)zConfiguration Filesr z/.env file existsrjrkzlatin-1z%API key or custom endpoint configuredzNo API key found in z/.envz(Run 'hermes setup' to configure API keysz'.env file exists (in project directory)z/.env file missingT)parentsexist_okizCreated empty z Run 'hermes setup' to create onez!Run 'hermes setup' to create .envz config.yamlz/config.yaml exists)read_user_config_rawmodelrrdefault)PROVIDER_REGISTRYresolve_provider>moaautocustomr)get_compatible_custom_providers)custom_provider_aliasesrresolve_provider_fullr)is_provider_enabledc3K|]f\}}t|&|1t|VgdSr)rYrr)rPrQprov_cfgrOs r8rzrun_doctor..4s''&h4yy(('.A-@-J-J'IIOO%%++--''''''r7rQ provider_key>rJrKrJz (unavailable)zmodel.provider 'z' is not a recognised providerz(known: z' is unknown. Valid providers: z>. Fix: run 'hermes config set model.provider '> rJnousrrlmstudio deepinfra fireworksrrrrrKzcustom:rzmodel.default 'z,' uses a vendor/model slug but provider is ''z=(vendor-prefixed slugs belong to aggregators like openrouter)z,' is vendor-prefixed but model.provider is 'zH'. Either set model.provider to 'openrouter', or drop the vendor prefix.)rJrKr) get_env_valuerr)rGget_auth_statusrr configuredrz%' is set but no API key is configuredz,(check ~/.hermes/.env or run 'hermes setup')z#No credentials found for provider 'z7'. Run 'hermes setup' or set the provider's API key in zI/.env, or switch providers with 'hermes config set model.provider 'z(Could not validate model/provider configzcli-config.yamlz-cli-config.yaml exists (in project directory)zcli-config.yaml.examplezCreated z)/config.yaml from cli-config.yaml.example)DEFAULT_CONFIG save_configz/config.yaml from defaultszconfig.yaml not foundz(using defaults))check_config_versionmigrate_configzConfig version outdated (vu → vz(new settings available)) interactivequietz!Config migrated to latest versionzAuto-migration failed: z$Run 'hermes setup' to migrate configz=Run 'hermes doctor --fix' or 'hermes setup' to migrate configzConfig version up to date (vcRg|]#}|vt|t!|$Sr6)r:rY)rPkr6s r8rRzrun_doctor..s5yyyQa:ooZdeopqertwZxZxoqooor7)rrzStale root-level config keys: z"(should be under 'model:' section))atomic_config_writez1Migrated stale root-level keys into model sectionuOStale root-level provider/base_url in config.yaml — run 'hermes doctor --fix')load_envrDremove_env_valueagent max_turnsHERMES_MAX_ITERATIONSzHERMES_MAX_ITERATIONS=z! in .env shadows agent.max_turns=z in config.yamlz0(stale ghost from an earlier `hermes setup` run)zKRemoved stale HERMES_MAX_ITERATIONS from .env (config.yaml agent.max_turns=z is now authoritative)z0Could not remove HERMES_MAX_ITERATIONS from .envz4Manually delete the HERMES_MAX_ITERATIONS line from u7/.env — config.yaml agent.max_turns is authoritative.uUStale HERMES_MAX_ITERATIONS in .env shadows config.yaml — run 'hermes doctor --fix')rd)validate_config_structurezConfig Structurerz#xAI Model Retirement (May 15, 2026))MIGRATION_GUIDE_URLfind_retired_xai_refs format_issuezNo retired xAI models in configzMigration guide: zUpdate u7 retired xAI model reference(s) in config.yaml — see zxAI retirement check skippedzAuth Providers)get_nous_auth_status_localget_codex_auth_statusrzNous Portal authz (logged in)z(not logged in)zOpenAI Codex authcodexufcodex CLI not installed (optional — only required to import tokens from an existing Codex CLI login)regionglobalz MiniMax OAuthz(logged in, region=zAuth provider statusz(could not check: rz xAI OAuthzDirectory Structurez directory existsz directoryz not foundz(will be created on first use))cronrlogsskillsmemoriesz/ existsz / not foundzSOUL.mdcg|]?}||d=|@S))zrq)rrs)rPls r8rRzrun_doctor..sAqqqqAGGIIqaggiiFZFZ[oFpFpqqqqr7z$/SOUL.md exists (persona configured)uA/SOUL.md exists but is empty — edit it to customize personalityz/SOUL.md not foundz/(create it to give Hermes a custom personality)z# Hermes Agent Persona You are Hermes, a helpful AI assistant. z/SOUL.md with basic templateruz/memories/ directory existsz MEMORY.mdzUSER.mdzMEMORY.md exists (z chars)zPMEMORY.md not created yet (will be created when the agent first writes a memory)zUSER.md exists (zNUSER.md not created yet (will be created when the agent first writes a memory)z/memories/ not foundz /memories/zstate.dbzSELECT COUNT(*) FROM sessionsz/state.db exists (z sessions))_db_opens_cleanlyrepair_state_db_schemaz?/state.db fails a write-health probe (FTS index may be corrupt)repaired backup_pathzn/az"Repaired state.db FTS write healthz (strategy: strategyz ; backup: z>state.db FTS write-health repair did not recover automaticallyuestate.db FTS write corruption and auto-repair failed — restore from the backup copy beside state.dburstate.db FTS write corruption — run 'hermes doctor --fix' (or 'hermes sessions repair') to rebuild the FTS index)is_malformed_db_errorryz>/state.db schema is malformed (sessions hidden until repaired)?zRepaired state.db schema (z sessions recovered)z4state.db schema repair did not recover automaticallyuastate.db schema malformed and auto-repair failed — restore from the backup copy beside state.dbupstate.db schema malformed — run 'hermes doctor --fix' (or 'hermes sessions repair') to recover hidden sessionsz!/state.db exists but has issues: )collect_state_db_statscount_db_holders)rr auto_pruneu?state.db is large — enable sessions.auto_prune in config.yamlzoptimize-storagezE and run 'hermes sessions optimize-storage' offline (gateway stopped)zstate.db stats unavailable (zr0rzVercel disk settingz(uses platform default)zVercel custom disk unsupportedz((reset terminal.container_disk to 51200)zSVercel Sandbox does not support custom container_disk; use the shared default 51200vercelz vercel SDKzvercel SDK not installedz$(pip install 'hermes-agent[vercel]')zJInstall the Vercel optional dependency: pip install 'hermes-agent[vercel]'z Vercel authpartialzVercel auth incompletez@Set VERCEL_TOKEN, VERCEL_PROJECT_ID, and VERCEL_TEAM_ID togetherzVercel auth not configuredzVConfigure Vercel Sandbox auth with VERCEL_TOKEN, VERCEL_PROJECT_ID, and VERCEL_TEAM_IDz Vercel auth TERMINAL_CONTAINER_PERSISTENTtrue>r'onyesrz^Vercel persistence: snapshot filesystem only; live processes do not survive sandbox recreationz(Vercel persistence: ephemeral filesystemnodezNode.js)_find_agent_browser_is_npx_agent_browser_sentinel)validatez agent-browserz(resolves via npx on first use))warm_agent_browser_npx_cachez$ Warmed npx cache for agent-browserz7 Could not warm npx cache (offline or npx unavailable)z(browser automation)z$agent-browser found but not runnablez(broken symlink at z#? run: npx agent-browser --version)zCagent-browser is not installed (expected in the tested Termux path)zUInstall it manually later with: npm install -g agent-browser && agent-browser installzTermux browser setup:)rzagent-browser not installedz(requires npm/npx on PATH))_chromium_installed_is_camofox_mode_get_cloud_provider_get_cdp_override_raw_using_lightpanda_enginezPlaywright Chromiumz(browser engine)z!Playwright Chromium not installedz/(browser_* tools will be hidden from the agent)zInstall with: cd z# && npx playwright install chromiumz/ && npx playwright install --with-deps chromiumzHNode.js not found (browser tools are optional in the tested Termux path)z2Install Node.js on Termux with: pkg install nodejszNode.js not foundz$(optional, needed for browser tools)npm)resolve_whatsapp_bridge_dirscriptszwhatsapp-bridgezBrowser tools (agent-browser)z--workspaces=falsez web workspacez --workspacewebzui-tui workspacezui-tuizWhatsApp bridge node_modulesaudit--json)cwdrrrlrrmetadatavulnerabilitiescriticalhighmoderatezcd z$ && npm audit fix --workspaces=falsez && npm audit fixz depsz(no known vulnerabilities)z critical, z high, u moderate — run: u; moderate — build-tool advisory; clears via lockfile bumpu ^ build-time tooling (not runtime); if manual npm remediation errors with an arborist crash it's a known npm bug — clears via a lockfile bumpz has z npm vulnerabilityz moderate zTermux compatibility fallbacks:zAPI Connectivity) namedtuple_ConnectivityResult)labelrr r3c tjd}|sAdtdtjdtdtjfggS ddl}|tdd|id }|j d kr)dtd tj dd fggS|j d krBdtdtj dtdtjfgdgS|j dkrBdtdtj dtdtjfgdgS|j dkrBdtdtj dtdtjfgdgSdtdtj dtd|j dtjfggS#t$rP}dtdtj dtd|dtjfgdgcYd}~Sd}~wwxYw)NrOpenRouter APIrz(not configured)r AuthorizationBearer r5headersrrrr(invalid API key)z Check OPENROUTER_API_KEY in .enviu%(out of credits — payment required)zOpenRouter account has insufficient credits. Fix: run 'hermes config set model.provider ' to switch providers, or fund your OpenRouter account at https://openrouter.ai/settings/creditsiz(rate limited)uSOpenRouter rate limit hit — consider switching to a different provider or waiting(HTTP rrEzCheck network connectivity) rbgetenvrrrrr=rr status_coderrr)rr=rrrs r8_probe_openrouterz%run_doctor.._probe_openrouter si,-- && v}--/?*FJ779:   2  LLL %(/C//:A }##**$E6<002BBGH }##**$E6:..0@/<<>?78  }##**$E6:..0@CVZPPRSAB }##**$E6:..0@,fj99;<78 '& vz**,<11116:>>@A      && vz**,<A&*--/0-.        s<AG%4A G%A G%A G%A G%% H?/AH:4H?:H?c b ddlm}|}|s  dggS ddl}ddlm}m}m}m ddi}||}|r$d||d<d ||z|d <n||d <| d |d }|r|j dkrd|j vrgd|j vrLd  fd|Dt|z|d <| d |d }|j dkr) dtdtjddfggS|j dkrA dtdtjdtdtjfggS dtdtjdtdtjfggS#t($rO}  dtdtjdtd| dtjfggcYd} ~ Sd} ~ wwxYw)Nr)get_anthropic_key Anthropic API)_is_oauth_token _COMMON_BETAS_OAUTH_ONLY_BETAS_CONTEXT_1M_BETAzanthropic-versionz 2023-06-01rrrzanthropic-betaz x-api-keyz#https://api.anthropic.com/v1/modelsr5rizlong context betaznot yet availablec g|] }|k| Sr6r6)rPbrs r8rRz8run_doctor.._probe_anthropic.. s$GGG16F1F1FQ1F1F1Fr7rrrrrrrz(couldn't verify)rEr)rrr=agent.anthropic_adapterrrrrrrrrrrrrrrrrr) rrr=rrrris_oauthrrrrs @r8_probe_anthropicz$run_doctor.._probe_anthropic s555555!! @&&B?? ?>  LLL             +L9G&s++H ++:S??(,/HH]EV5V,W,W())'* $ 5A MS(('16<<>>99'16<<>>99,/HHGGGG GGG,--.--()II9#R}##**#E6<00/2FG }##**#E6:../<<>?  '&v}--+VZ88:;      &&v}--A&*--/0        s-D$GA GAG H.AH)#H.)H.c Td}|D]}tj|d}|rn|s |ggS|d}|sA|tdtj|tdtjfggS ddl}|rtj|dnd} | s|drd} | r9| d d rdd l m } | | } t| d r@| d d r| dd z} | r| ddzn|} d|td} t| d rd| d<| r+t| dr| dd|| d<|| | d} |dkr%| s#| jdkr|d| d} | jdkr)|tdtj|dfggS| jdkrL|tdtj|tdtjfgd|ddgS|td tj|td!| jd"tjfggS#t($rO}|td tj|td#|d"tjfggcYd}~Sd}~wwxYw)$Nrrjrz(key configured)rzsk-kimi-zhttps://api.kimi.com/coding/v1rz /anthropic)_to_openai_base_urlz api.kimi.comz/codingz/v1rr)r User-Agentzclaude-code/0.1.0rz!generativelanguage.googleapis.comrzx-goog-api-keyr5rrrz8https://dashscope.aliyuncs.com/compatible-mode/v1/modelsrrrzCheck z in .envrrrrE)rbrljustrrrrr=rsrrOagent.auxiliary_clientrrrrrrrrr)pnamerb default_urlbase_envrrevrr=baserurlrrrrs r8_probe_apikey_providerz*run_doctor.._probe_apikey_provider- s   B)B##C   6&&ub"55 5 B$ &&v|,,e*FJ779:   B  LLL.6>29Xr***BD 8CNN:66 87 1 C((11,?? 1FFFFFF**400$T>:: 0t{{3?O?O?X?XYb?c?c 0{{3''%/48I4;;s##i//kC!030G%T>:: <(; % 0,S2UVV 0 OT222,/() #w ;;A,,,-MS((IIN#R}##**E6<00%<= }##**E6:../<<>?3hqk3334  '&v}--u11116:>>@A      &&v}--uA&*--/0        s. F"K-AKA K L'AL"L'"L'c ddlm}m}m}n#t$rdggcYSwxYw|s dggS|}|}dd} ddl}ddlm}|dddd i }| d || } | } t| d g} dtdtj|td|d|d| dtjfggS#t$radtdtj|tdt$jdtjfgdt$jdgcYSt($rk} t+| j} dtdtj|td| d| dtjfgd| dgcYd} ~ Sd} ~ wwxYw)Nr)has_aws_credentialsresolve_aws_auth_env_varresolve_bedrock_region AWS Bedrockrj)Configr5 max_attemptsro)connect_timeout read_timeoutretriesr) region_nameconfigmodelSummariesrrErz models)ru(boto3 not installed — z -m pip install boto3)zInstall boto3 for Bedrock: z -m pip install boto3rOrz AWS Bedrock: u; — check IAM permissions for bedrock:ListFoundationModels)agent.bedrock_adapterrrr ImportErrorrboto3botocore.configrclientlist_foundation_modelsrrrrrrrrr=rrrr)rrrauth_varrprr _BotoConfigrrrespnrerr_namers r8_probe_bedrockz"run_doctor.._probe_bedrock s >             > > >&&}b"== = = = >""$$ >&&}b"== =++--''))##B''#  LLL = = = = = =+ !'+C \\)\LLF0022DDHH-r2233A&&v|,,e=H====!===vzJJLM      &&v}--uZCNZZZ $$%&Us~TTTU       Aww'H&&v}--u,H,,,,,fj99;<11112        s3 ((,B3D A(G> G>A G93G>9G>c dd} ddlm}|}t|tr|dni}t|ts dggSt |dpd}t |dpd}|d ks|d kr dggSn#t$rdggcYSwxYw dd l m }m }m }m} n`#t$rS} dtd t j|td | dt jfgd| gcYd} ~ Sd} ~ wwxYw| sPdtd t j|tdt jfgdt&jdgS|dpi} t| tsi} t | dpdp|} || } || d}|drx|dpg}|rd|nd}dtdt j|td|d| dt jfggS|d pd!}|d"pd#}dtd t j|td|dt jfgd$|d%|gS)&uProbe Azure Foundry Entra ID auth, parallel to ``_probe_bedrock``. Skipped unless the active config has ``model.provider: azure-foundry`` AND ``model.auth_mode: entra_id`` — we don't probe the token-service / CLI chain for users on plain API-key Azure. Bounded by a 10s timeout (via :func:`agent.azure_identity_adapter.describe_active_credential`) so a slow token service can't pad the doctor run. Azure Foundry (Entra ID)rrVrErr auth_modez azure-foundryentra_id)EntraIdentityConfigSCOPE_AI_AZURE_DEFAULTdescribe_active_credentialhas_azure_identity_installedrz(adapter import failed: rz%Azure Foundry adapter import failed: Nz(azure-identity not installed)zInstall azure-identity: z -m pip install azure-identityentrascope)rg$@)rtimeout_secondsr env_sourcesrzdefault credential chainrrEz, scope=rzcredential chain exhaustedhintzqRun `az login`, set AZURE_TENANT_ID/AZURE_CLIENT_ID/AZURE_CLIENT_SECRET, or attach a managed identity to this VM.zAzure Foundry Entra: . )rr\rWr:r;rrYrrragent.azure_identity_adapterr r r rrrrrr=rrr)rrWr model_cfg cfg_providerr r r r rre entra_cfgrrrrtagerrrrs r8_probe_azure_entraz&run_doctor.._probe_azure_entra sz+0044 K 5 5 5 5 5 5+--C,6sD,A,AI(((rIi.. O**+Er2NNNy}}Z88>B??EEGGMMOOLIMM+66<"==CCEEKKMMI..)z2I2I**+Er2NNN3J K K K&&'A2rJJ J J J K                  &&*v}--u939996:FFHI>>>?        ,+-- &&*v}--u8&*EEGHZCNZZZ[  MM'**0b )T** I  g&&," - - 3 3 5 5 &% %$   *)NNN 88D>> ((=117RK,7W$))K(((=WC&&*v|,,e1C111116:>>@A   hhw?#?xx  L #" &E6=))5JJJJ ++- . 2S 2 2D 2 2 3    s8AD 6B(D D:9D:> E F(AF#F(#F(rrc"|||||Srr6)rrursrs r8zrun_doctor.. s 6 6q!Q1 E Er7rrrzRunning u# connectivity checks in parallel…)endflushAWS_EC2_METADATA_DISABLEDrz doctor-probe) max_workersthread_name_prefixc@g|]\}}|Sr6)submit)rP__fn_exs r8rRzrun_doctor... s' G G GVQC G G Gr7c6g|]}|Sr6r)rP_fs r8rRzrun_doctor../ s @@@ @@@r7zH )r zTool Availability)check_tool_availabilityTOOLSET_REQUIREMENTSc3HK|]}|ddkVdS)rQrNrcrds r8rzrun_doctor..P s3$W$W4TXXf%5%5%>$W$W$W$W$W$Wr7cg|] }|dk| S)rr6)rPtids r8rRzrun_doctor..S sFFFSSr7cDg|]}|ddk|S)rQrrcrds r8rRzrun_doctor..T s/YYYtxx?O?OSX?X?Xt?X?X?Xr7rrarbz (missing z(system dependency not met)c3*K|]\}}}|dkVdS)rNr6)rPstatusr's r8rzrun_doctor..l s,HH|vq!FdNHHHHHHr7zERun 'hermes setup' to configure missing API keys for full tool accessz!Could not check tool availabilityz Skills Hubrtz.hubzSkills Hub directory existsz lock.json installedzLock file OK (z hub-installed skill(s))z Lock filez(corrupted or unreadable) quarantinec3BK|]}|dVdS)roN)is_dir)rPds r8rzrun_doctor.. s/DDADaDDDDDDr7z skill(s) in quarantinez(pending review)z$Skills Hub directory not initializedz(run: hermes skills list)c tjgddd}|jdkS#ttjf$rYdSwxYw)z?Check if gh CLI is authenticated via token file or device flow.)ghauthr4r authenticatedTr5rrF)rrrFileNotFoundErrorTimeoutExpiredr+s r8_gh_authenticatedz%run_doctor.._gh_authenticated se ^CCC#RF$) )!:#<=   55 s#&AA GITHUB_TOKENGH_TOKENz2GitHub token configured (authenticated API access)zGitHub authenticated via gh CLIu,(full API access — no GITHUB_TOKEN needed)zNo GITHUB_TOKENu!(60 req/hr rate limit — set in z/.env for better rates)zMemory ProviderrmemoryzBuilt-in memory activeu2(no external provider configured — this is fine)r)rresolve_config_pathz+Honcho configured via environment variablesz config file z( not found, using HONCHO_API_KEY env varzHoncho config not foundzrun: hermes memory setupz&Honcho disabled (set enabled: true in z to activate)z"Honcho API key or base URL not setu/No Honcho API key — run 'hermes memory setup')get_honcho_clientreset_honcho_clientzHoncho connectedz workspace=z mode=z freq=zHoncho connection failedzHoncho unreachable: zhoncho-ai not installedzpip install honcho-aiz?Honcho is set as memory provider but honcho-ai is not installedzHoncho check failedmem0) _load_configzMem0 API key configuredzuser_id=user_idz agent_id=agent_idzMem0 API key not setz5(set MEM0_API_KEY in .env or run hermes memory setup)z5Mem0 is set as memory provider but API key is missingzMem0 plugin not loadablezpip install mem0aiz:Mem0 is set as memory provider but mem0ai is not installedzMem0 check failed)load_memory_providerz provider activez configured but not availablezrun: hermes memory statusz plugin not foundz check failed) list_profiles_get_wrapper_dirprofile_existsc g|] }|j | Sr6) is_default)rPrs r8rRzrun_doctor.. sIIIALI!IIIr7Profilesz profile(s) foundzgateway runningu⚠ missing configzno .envzno aliasz hermes -pzhermes -p (\S+)zOrphan alias: u → profile 'z' no longer exists)maybe_run_live_checksu────────────────────────────────────────────────────────────z Fixed z issue(s).z& issue(s) require manual intervention.rz Found z issue(s) to address:z= Tip: run 'hermes doctor --fix' to auto-fix what's possible.u All checks passed! 🎉)rrbr setdefaulthermes_cli.security_advisoriesr(r)rrrrVrrr=exitrrrr-r.r/r0radvisoryrpackageinstalled_versionrrXr+rrrr\rWhermes_cli.mcp_securityr1rr:r;rr|majorminormicror"sqlite3rrr6sqlite_versionrrrJrrprefix base_prefixrr __import__rr9r#rr_DHHrrUnicodeDecodeErrorrrFparentmkdirtouchchmodrYrarDrrrrrGrHkeysrLrrMrrNrOrrrsrXrrYrcopy2r[r\r]r^rrcrdrerTriseveritymessagerrshermes_cli.xai_retirementrjrkrlrmrnrrr write_textconnectexecutefetchonecloserxryrrQr}rrrr`ryrrr>rrZ is_symlinkresolveunlink symlink_tortpathsepr?rhermes_constantsrrrr?rr5r expanduserrrtools.terminal_toolrrutil find_specrrr detail_linestools.browser_toolrrrr rrrrrr!gateway.platforms.whatsapp_commonrjsonrloadsrconcurrent.futuresfutures collectionsrrrrThreadPoolExecutorrrr rinsert model_toolsr-r.rrrrrhriterdirr}rapply_managed_overlayrrrDrrrrrErF workspace_id recall_modewrite_frequencyplugins.memory.mem0rHplugins.memoryrK is_availablehermes_cli.profilesrLrMrNregateway_runningrEr8rsearchgrouphermes_cli.doctor_liverRr enumerate(argsr ack_targetr(r) valid_idsr  manual_issues fixed_countr-r.r/r0all_hits fresh_hitshitrx acked_idshrrWr1servers suspiciousrQentry issues_found py_versionr]rr6 _sqlite_ver _sqlite_src_sqlite_src_shortin_venvrequired_packagesoptional_packagesmoduleenv_pathr fallback_env config_pathrDr model_section provider_rawr default_modelknown_providersrG_resolve_auth_provider_compatible_custom_providers_custom_provider_aliases_normalize_catalog_provider_resolve_provider_fullcustom_providersuser_providersrRvalid_provider_idsprovider_ids_to_acceptknown_providerruntime_providercatalog_provider provider_def known_listprovider_for_policyprovider_policy_id providers_accepting_vendor_slugsprovider_accepts_vendor_slugrXrZrYpconfigr4fallback_configexample_configr[r\r]r^ current_ver latest_vermig_errstale_root_keys raw_modelrbrcrdre agent_cfg cfg_max_turns env_ghostdrift_load_env_depr_read_raw_depr _raw_for_depr _env_for_deprri config_issuesci hint_linerjrkrl_xai_cfg retired_refsref_xai_check_errrmrnr nous_status codex_statusminimax_statusrprxai_oauth_statusrexpected_subdirs subdir_name subdir_path soul_pathr memories_dir memory_file user_filer state_db_pathconncursorcountrxry _write_reasonreport backup_namer}rr _db_stats _db_holders_kind_text_detail _stats_excwal_pathwal_sizenew_size _venv_bin _venv_name _candidate_prefix_is_termux_env _cmd_link_dir_cmd_link_display _cmd_link_target _expected _path_dirs terminal_env _is_containerrunning_in_containerrssh_hostssh_userssh_portssh_keytargetr daytona_keyrruntimer supporteddisk auth_status persistentagent_browser_okrr _resolved_abrrrrrrrskip_chromium_check_npm_binr_whatsapp_bridge_dirnpm_audit_targetsnpm_dirr audit_extra check_dir audit_result_json audit_data vuln_countrrrtotalfix_cmd vuln_detailnote_futures _namedtuple_probesrrrr_entry_pname _env_vars _default_url _base_env _supports _imds_prev_futures_in_order_results_r_glyphr _issues_to_add_issuer-r.rrweb_rowsr1rrrrbvars_str api_disabled web_not_readyhub_dir lock_filer lock_datar6q_countr@ github_token_active_memory_provider _read_raw_mem _mem_cfg_path_raw_cfgrrrDhcfg_honcho_cfg_pathrErF_e_load_mem0_configmem0_cfgmem0_keyrK _providerrLrMrN_renamed_profiles wrapper_dirrpartswrapper_mrRremaining_issuesiissuerr)rrOr6s @@@@@r8 run_doctorrN sTue,,Jud++JJ.444         /.:... Y & & %> >>99VI..//;8>>     HQKKK < # #  %>z>>>      %<:<<<     HQKKK FMK GGG %DFLFQ R RSSS %SU[U` a abbb %DFLFQ R RSSS "###+;            &%''#^H--  6!  |)+? ??s'<??? 21#66  D AU4%?%?AABBBB$$@@@!$@@030E@@-0LO@@@& I  :=I--9CC(;CC%&Z]CCC  4 5 5 5 ;;;9a99::::::::; "###6111111EEEEEE+--##M228b gt $ $ %gmmoo66   e!%..88uEE #a N$NNNPTPYPYZfPgPghhh$$zzzz ?? 7 8 8 8 666444555555556 !"""!JWS:+SSj.>SSAQSSTTTT w  S:+SSj.>SSAQSSTTT]^^^^ v  UZ-UU 0@UU:CSUUWlmmmm Nj& N N)9 N NJ ? ? ? ? $222 3 3 3 C%%dT%BBB   HS]]E2222D5$555666EFFFq =>>> ABBB -KWHD---...A M > > > > > >&&{33CGGG,,2M)--j99?RFFHHL#))++H*..y99]]=N=Nw=W=W][]ddffM#&55O #&&7&<&<&>&>"?"?BiBiBi"i   )-&  .mmmmmm  . . ./3,+/(.2+)-&&&  . " +7*'C'CC'H'H$$ ***')$$$*!WW[11N.$// AAAAAA&&''''*8*>*>*@*@''' *  !%..599V,,23399;;"599^#<#<#BCCIIKK 4@#**00|DD"%_!5!5 3;%FhZZ "*6&5!!N!*../J/J>/Z/Z[[[[$!!! ! (  0*6$6660'='=h'G'G$*../?@@@@ 000'/$$$0 (  A*6$66655hP`aa 6B6NB!?!?!E!E!G!G!M!M!O!O 000 ,(#&FF<%1<%00;; )  =((&)4)pmppampppS \m\\am\\\ ! $4 > > > > >--k::Jyyyy*ByyyO uQTYY5O5OQQ8u!+w 7 7I!)T22<(1 #Is33< 8I8I<)2IOO4E4E(F .; 7++(* .; 7+,..,0033./9~~a/@/@M!,,&NN1----EEEEEE'' Z@@@PQQQ1$KKMM"sttt    D ,  Z Z Z Z Z Z Z Z Z Z--k::J"w//Ii.. k***  $ *{ ; ;   '>??IT)IT)I &&,,..#i..2F2F2H2HH   FYFF'4FFFF ''(?@@  b@@ A A A  @#l++@@*=@@    JJJ13H~3H3H3HIIIIIIIIJ (F          1022 ??; ' ' > ' 7 7 7 7 )+< = = =,,..   K ( (  (- 8 8 8 8 *,= > > >(( 2<0111 w'' 8 7688   k * * ;#''(;;F _&EF&E&E&E F F F F (9 : : : FFF)+D+D+D+DEEEEEEEEF  ======4466<"    , , 6 [- 0 0 0 0 {$5 6 6 6##G,, 6+G4555       "###KJD+++,,,, J$666,D,,,---q d&&&(HIIIJII' ] ] !K/      ] 44{444 5 5 5 5  ]   dT  : : : 555{555 6 6 6 1 KK $99999;[ \ \ \ \i'I%%w%77==??qqG..00qqq  c BBB C C C C $aaa b b b bd...0abbb     " "4$ " ? ? ?  <! !    BBBB C C C 1 K+LD555666"[0  9,      k{,,g,>>DDFFGGD 7$777 8 8 8 8 i j j j      iy**G*<<BBDDEED 5555 6 6 6 6 g h h h hd0002RSSS     td  ; ; ; 0000 1 1 1 1 K *,MZ^ J NNN??3}#5#566D\\"ABBFOO%%a(E JJLLL AAAAA B B B O N N N N N N N--m<C$!@Z&**Z*@*@ZZKZZZ$q( "\[ 7 3 3[[vzz-?X?X[[[ K MMQ/ J/ J/ J R R R R R R R R$$Q'', J [[[HHH!33MBBFzz*--(#*??3}3E3E#F#FD$(LL ?%%&hjj%,E!JJLLLL(((($'EEE( &zz-88DD !677<<>C$!TTTTZ&**Z*@*@ZZKZZZ$q( "R[ 7 3 3[[vzz-?X?X[[[ K MMS dHHQHHIII_/ Jl E M M M M M M M M..}==I**=99K)?;*** K K%ugF??ug...#w.. - $6#@#@!<!>DLL!ABBBJJLLL:B//:K:KRx}}66QRHf(d:JffRZ^bRbfffggg1$KKMM"^____,,,c(y*Acccddd    D "&)))&!!! |w'((( +  J% 2U:XEJ  "" &   *..2..bjnn-=>>??dCY]dCd  /g / MME1M -   IKK(2U:M . !H,   ,d     r\rrr     W1F1F|1T1TWWW X X X##%%( o#++--%--// i'' 1MMMNNNN,LLLDDD DDD"u!((***!,,Y777 !]3D!]!]R[!]!]^^^#q(  &s;L&s&s&stttt!!## o-KKKLLLL(;;;Do!''t'DDD((333[1B[[PY[[\\\1$K"$!;!;!A!A"*!M!MJ=));;"0FFFc&,,-T4E-T-T-TUUUMM"m->"m"m"mnnn 52?L1114[!78888+-OPPPY1LY1W1WYYZZZ9^W55L%BBBBBB,} %%%$% # 8 # # B    #Lx x   #6(:4Y[\\\,    !f&71&<&<#56666 ;RAVX^____ "47      X  5<(((( 5XYYYY 5 %|444u9011  y!455Hy!455Hi 233G19G--8---xFJJJC (h'' ;bg0099:: FI& &C ##'   ,    !f&71&<&<8h889999 ?X ? ?EndlEnEnpvwwww +1/    y  i 122   & 7 7 7 7 )5:      ' ' ' ' ' ' ]M 2 2 2 2    +':       ''')5x@@FFHHTHBBBBBB 0 0 0 %~7~~~ 6 6 6 6 "<==I ,/G//9///E)EE    y2G<<BBDD % % % *,E F F F F 0:e     > # #H - - 9 \= 1 1 1 1 *6\    +,, >  ]$< (9$<$<$< = = = =   ) )) 4 4  ((K%(((R      ,(K%(((h      , . .D ,d,, - - - -Y>GGMMOOSmm  C w x x x x A B B B6hP! ^ ^ ^ ^ ^ ^ ^ ^..>>>LL   LLL   T::<HH T _&G H H H#  Z LKKKKK//11ZEFFFFXYYY  T4\BB T _&< = = =#    T 6WlWWW    \\ T \ ] ] ] n o o o . / / /34HHH ! !4     ! 46R S S S * JLL* )  %$&&21133442**,,D820/11 $ +**,, !68JKKKK"?M<722&!BL!B!B!B '!NL!N!N!N9    @ P]^^^GHHH*+++/uEEE  D t      &(NOOO5!!H_ P U U U U U U#>#>#@#@  P P P#/)#;>O#O  P:=Q>*a88!~~fa00%>>*a88 4(2 ?;q>]#B#B#GG %9$:::QGQQQGG>G>>>GA::___.JKKKK\\TAXX'ggDgggg^egg$ (LLDLLLLL$ *K***# {1~'F'F #2 MM RRuRR.3qjj??>ORR  VHVV.6!mm??ARVVV     ||4555688  D t        *)))))555555%+;;;G;2;;;;;;zC1CCCCCCJS9LSSSSSSj1/111111fN 3N N N N N N b NN$&78999 NNO%56777&">"@"@)HH@F= <I 9 )2i!F!F!F!F!FG H H H H NNM>2333 NN.0BCDDD `uQG QQQSYS]^^ ` ` ;<>xHH    '/||H'='='C&H&HUW&X&X #       #SK)+_```` H , ,+ 7 \ \ \ \ \ \ \ \%88::D2244 #**,, n<V4=VEa'7aaa 8:TUUUU\ ncDTcccddddl ndm n8.E `_______##%%%n%%d+++*lT%6lld>NllVZVjll!nnn#$>BId`bIdIdflmmmmmmmmn    )'Q        7 7 7 ,c"gg 6 6 6 6 6 6 6 6 7 F * * 5 M M M M M M((**H||Ir22H 2333nhll9c&B&Bnnx||\fhkOlOlnnoooo*KK      *$L        5 5 5 *CGG 4 4 4 4 4 4 4 4 5 K ; ; ; ; ; ;,,-DEEI fY3355 f3EEEFFFF f5TTTVqrrrr5HHHJdeee K K K 1@@@#b'' J J J J J J J J K) WWWWWWWWWWII]]__III   Z N++>>> ? ? ?**,,K# 2 2$4LL!23337/LL"....66887LL!5666//11,LL+++%.~~''-LL,,,-2D5))) 0af00001111!!## *2244  G"??,,! ")"3"3W"3"E"E&'11!$,>!H!HB!y..!*E*Ey *+wGL+w+wXZX`X`abXcXc+w+w+w x x x$            @@@@@@dM2222       GGG -MkAoo eJ --... e6{666 fkRRXZ[[[[   %YC 011YYY[a[hjpjuvv w w w w GGG   %&6:: ) )5'1''''(((( GGG  M eJ ../// eKs#344KKKV]\b\ghhiii !"2A66 % %HAu #q##E## $ $ $ $  f %WY_Ycdd e e e eJ --... e/v{KKLLL GGGGGs2D7L L9L44L9 C(P55 Q?QQ>BW X'W>>XZ//1[#"[#.\\+*\+^ ^;:^;"b'' b43b4?B1z1.h z h/,z.h//z3iziziz! i-,z- i<9z;i<EAMM AM'M&AM'M+AN1N ANN AN1N ANNAN1NANNAN1N1 AN>N=AN>OBAQ"Q" AQ/Q.AQ/RAR<R ARRAR<R AR(R%AR<R'AR(R(AR<R< AS SAS SBAU+U+ AVU5AVVAVV&D,A[[ A[;[A[6[6A[;[?A2A]2]2 A]?]>A]?lF"Ass Azs AAz t!A#AvvAz v AvvAz vAvvC1Az z AzzBA|%|% A} |/A}}A} ~DBBB BB,B+BB,SBSS BS'S&BS'TBT=T=BUUBUZBZ>Z>B[[B[].B^^B^*^)B^*g,Bhh BhhBhl4Bo2o2 Bo?o>Bo?r BrrBr;r:Br;tG B{={= B| | B| CCE C5CD D CE D CD$D$CE D'CD$D(CE E 6CFI G)CP4P4 CQP>CQQCQR?A&CT&T&CUUCUY /C[Y9CZZC[Z CZ#Z C[Z"CZ#Z#/C[[ C[ [C[ \CCa_r[s    544444000000333333!! o  LNN y/\F=RSSSS++++++++000000777777222222''''''@544444ISIIII%S%S%%%%ts&  eCI6F1G     .$$$$$$"!B!BsTz3:/E)F!B!B!B!BH  T  c      $+/*I*I*IS/D(*I *I*I*I*IZSS4ZcDI>c>d>>>> $RTRdRRRRcc4T%S# *>%?4444l2c2QUVZQ[2`efjknfoquvzq{f{`|2222$CD0jj3jjjjjkkSk#kkkkhhSh#hhhh5S5555 2 <;;;;;MM$MMMMM`;C;D;;;; #sd3iD=uS#s]3S899$eCHo 5eE#s(OS01   td{tE#s(O?T2  eCHo9N     %t % D[% %S/%%%%R#t  D[ %S/B#c(T/ tDz d4j    t4 tCy T    8-$s)-----`SS4SSRVSSSSl)L$s))L)L)L)L)LX(,+++ZdZZZZzLLLL2E! E! E! E! E! r7