`gjUUdZddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl m Z ddl m Z mZmZddlmZmZmZddlmZej,dZgdZgd Zd d gZgd Zeeed <ehdZ eeed<ehdZ!eeed<dZ"de de#fdZ$de fdZ%ehdZ&ehdZ'ehdZ(ehdZ)de fdZ*de fdZ+de fdZ,de fdZ-d edefd!Z.d eddfd"Z/d eddfd#Z0d ede fd$Z1d ede#fd%Z2d edeefd&Z3de#fd'Z4dkd ed(eedee fd)Z5d ede#fd*Z6de ddfd+Z7d,edeefd-Z8d.Z9de:eeffd/Z;e Gd0d1Zde de=fd3Z?de de#fd4Z@iZAe:ee=eBeBeCffed5<d6ZDd7e deBfd8ZEde deCfd9ZFde de fd:ZGde de:fd;ZHddd<de d=eed>ee#ddfd?ZIdee<fd@ZJdAe#deeee ffdBZK dld edCeedDe#dEe#dFe#dGe#d=eede fdHZLdmde dIe#dee:fdJZMdmdIe#deefdKZNdLede deeCfdMZOdLede ddfdNZPde ddfdOZQdmd edPe#de fdQZRd,eddfdRZSd,eddfdSZTd ede ddfdTZUde ddfdUZVdefdVZWd eddfdWZXdefdXZYdYe fdZZZd ed[ede fd\Z[d]edeefd^Z\d_e d`e ddfdaZ]d_e de^efdbZ_dkdced eede fddZ`deedfedge ddfdhZadeedfede fdiZbd,edefdjZcy)nu_ Profile management for multiple isolated Hermes instances. Each profile is a fully independent HERMES_HOME directory with its own config.yaml, .env, memory, sessions, skills, gateway, cron, and logs. Profiles live under ``~/.hermes/profiles//`` by default. The "default" profile is ``~/.hermes`` itself — backward compatible, zero migration needed. Usage:: hermes profile create coder # fresh profile + bundled skills hermes profile create coder --clone # also copy config, .env, SOUL.md, skills hermes profile create coder --clone-all # full copy of source profile coder chat # use via wrapper alias hermes -p coder chat # or via flag hermes profile use coder # set as sticky default hermes profile delete coder # remove profile + alias + service N) dataclass)Path PurePosixPathPureWindowsPath)ListOptionalTuple)is_excluded_skill_pathz^[a-z0-9][a-z0-9_-]{0,63}$) memoriessessionsskillsskinslogsplans workspacecronhome) config.yaml.envSOUL.mdzmemories/MEMORY.mdzmemories/USER.md) gateway.pidgateway_state.jsonprocesses.json_CLONE_ALL_STRIP>binprofiles node_modules .worktrees hermes-agent_CLONE_ALL_DEFAULT_EXCLUDE_ROOT>state-snapshotsbackupsr checkpointsstate.db state.db-shm state.db-wal_CLONE_ALL_HISTORY_EXCLUDE_ROOTz.no-bundled-skills profile_dirreturncP |tz jS#t$rYywxYw)z>Return True if the profile opted out of bundled-skill seeding.F)NO_BUNDLED_SKILLS_MARKERexistsOSErrorr(s F/root/.hermes/venv/lib/python3.12/site-packages/hermes_cli/profiles.pyhas_bundled_skills_opt_outr0s.66>>@@ s  %% source_dirc|jtjk(dtdttdttffd }|S)uWExclude infrastructure artifacts when cloning a profile via --clone-all. Three categories: 1. Root-level entries in ``_CLONE_ALL_HISTORY_EXCLUDE_ROOT`` — session history, backups, and snapshots that belong to the SOURCE profile and should never carry into a fresh clone. Applies to any source. 2. Root-level entries in ``_CLONE_ALL_DEFAULT_EXCLUDE_ROOT`` — known Hermes infrastructure directories that only the default profile (``~/.hermes``) ever contains. Gated on ``source_dir`` actually being the default profile so a named-profile source never has its own data silently dropped. 3. Universal exclusions at any depth — Python bytecode caches that are stale or regenerable (``__pycache__``, ``*.pyc``, ``*.pyo``) and runtime sockets / temp files (``*.sock``, ``*.tmp``). The export-side ignore (``_default_export_ignore``) uses the same two-tier pattern with the broader ``_DEFAULT_EXPORT_EXCLUDE_ROOT`` set because the export archive is a portable snapshot rather than a live clone. directorynamesr)cFg}|D]}|dk(s|jdr|j|+ t|jk(}|sK|t vr|j|esh|tvsq|j||S#tt f$rd}YQwxYw)N __pycache__)z.pycz.pyo.sock.tmpF)endswithappendrresolver- ValueErrorr'r )r3r4ignoredentryat_rootis_default_sourcesource_resolveds r/_ignorez+_clone_all_copytree_ignore.._ignores *E&>>"CDu% y/113F ;;NN5)$2Q)QNN5)- *.Z(    sB  B B )r;_get_default_hermes_homestrr)r1rBr@rAs @@r/_clone_all_copytree_ignorerEsT*!((*O'+C+E+M+M+OO3tCyT#Y6 N> auth.lock errors.log .update_check.hermes_historyhermes_state.dbresponse_store.dbresponse_store.db-shmresponse_store.db-walrrr sandboxes audio_cacher# image_cacheractive_profiledocument_cachebrowser_screenshotsrr$ auth.jsonrrrr%r&rr>USER.md AGENTS.md CLAUDE.md MEMORY.md todo.json .cursorrulessystem_prompt.mdrr pluginsscriptsr r knowledge preferencesrr>tmprootsudotesthermesdefault>acpmcpchatrdumploginmodelsetuptoolsconfigdoctorhonchologoutr statusupdategatewaypairingr]profileversioninsightsr whatsapp uninstallctdz S)aReturn the directory where named profiles are stored. Anchored to the hermes root, NOT to the current HERMES_HOME (which may itself be a profile). This ensures ``coder profile list`` can see all profiles. In Docker/custom deployments where HERMES_HOME points outside ``~/.hermes``, profiles live under ``HERMES_HOME/profiles/`` so they persist on the mounted volume. rrCrFr/_get_profiles_rootrs $ % 22rFcddlm}|S)zReturn the default (pre-profile) HERMES_HOME path. In standard deployments this is ``~/.hermes``. In Docker/custom deployments where HERMES_HOME is outside ``~/.hermes`` (e.g. ``/opt/data``), returns HERMES_HOME directly. rget_default_hermes_root)hermes_constantsrrs r/rCrCs9 " $$rFctdz S)z2Return the path to the sticky active_profile file.rRr}r~rFr/_get_active_profile_pathr!s # %(8 88rFc6tjdz dz S)z)Return the directory for wrapper scripts.z.localr)rrr~rFr/_get_wrapper_dirr&s 99; !E ))rFnamect|ts t|}|j}|s td|j dk(ry|j S)uReturn the canonical profile id used on disk and in CLI ``-p`` argv. Named profiles are stored lowercase under ``profiles//``. The special alias ``default`` is matched case-insensitively (``Default`` → ``default``). Dashboards and tools may pass title-cased display labels; normalize before validation, assignment, and subprocess spawn (see issue #18498). zprofile name cannot be emptyrf) isinstancerDstripr<casefoldlower)rstrippeds r/normalize_profile_namer/sR dC 4yzz|H 788i' >> rFc|dk(rytj|std|d|tvrtd|dy)uRaise ``ValueError`` if *name* is not a valid profile identifier. Validates the input as-given — strict lowercase match. Callers that accept mixed-case or title-cased input from users (dashboard UI, CLI args) should call :func:`normalize_profile_name` first. This separation keeps validate honest about what the on-disk directory name must look like, while ingress-point normalization handles UX flexibility (see #18498). Also rejects names in :data:`_RESERVED_NAMES` (``hermes``, ``test``, ``tmp``, ``root``, ``sudo``) that would create confusing on-disk collisions (a ``hermes`` profile inside ``~/.hermes/``) or get refused at alias-creation time anyway. ``default`` is a special pass-through — it's a valid alias for the built-in root profile. rfNzInvalid profile name %. Must match [a-z0-9][a-z0-9_-]{0,63}z Profile name uz is reserved — it collides with either the Hermes installation itself or a common system binary. Pick a different name.)_PROFILE_ID_REmatchr<_RESERVED_NAMESrs r/validate_profile_namerAsh y    %#D8,) *   D8$% &  rFcLtj|std|dy)uRaise ``ValueError`` if *name* is not a safe wrapper-alias identifier. The alias is used verbatim as a filename under :func:`_get_wrapper_dir` (``~/.local/bin``), so it must be a single safe command name with no path separators or traversal segments — otherwise a value like ``../../.bashrc`` would escape the wrapper directory and clobber arbitrary user files. We reuse the profile id regex, which already forbids ``/``, ``.``, and ``..``. zInvalid alias name rN)rrr<rs r/validate_alias_namer_s5    %!$*) *   &rFcPt|}|dk(r tSt|z S)z4Resolve a profile name to its HERMES_HOME directory.rf)rrCrrcanons r/get_profile_dirros+ "4 (E '))  % ''rFcVt|}|dk(ryt|jS)z)Check whether a profile directory exists.rfT)rris_dirrs r/profile_existsrws+ "4 (E  5 ! ( ( **rFclt|} t||tvrd|dS|t vrd|dSt }tjdk(} tj|rdnd|gddd }|jd k(re|jjjd }||r|d n|z }|t|k(r |j}d |vry d|d|dS y#t$r}t|cYd}~Sd}~wwxYw#t $rY7wxYw#t"tj$f$rYywxYw)zReturn a human-readable collision message, or None if the name is safe. Checks: alias-name validity, reserved names, hermes subcommands, existing binaries in PATH. N'z' is a reserved namez$' conflicts with a hermes subcommandwin32wherewhichT)capture_outputtexttimeoutr.bat hermes -pz&' conflicts with an existing command ())rrr<rDr_HERMES_SUBCOMMANDSrsysplatform subprocessrun returncodestdoutr splitlines read_text ExceptionFileNotFoundErrorTimeoutExpired) rrexc wrapper_dir is_windowsresult existing_pathexpectedcontents r/check_alias_collisionrsq #4 (EE" 5'-.. ##5'=>>#$K(J "W 7dA     !"MM//1<<>qAM" tnNHH -&002G"g-#.ugCM?RST T " = 3x0! z88 9   sT C'A3DD D' D0 D:DD DDDDD32D3ctt}|tjj ddj tj vS)z!Check if ~/.local/bin is in PATH.PATH)rDrosenvirongetsplitpathsep)rs r/_is_wrapper_dir_in_pathrs9&()K "**..4::2::F FFrFtargetc,t|}|r t|n|}t|t} |jddt jdk(}|r ||dz } |jd|d |S||z } tjd xsd }|jd tj|d |d|j|jjtj ztj"ztj$z|S#t$r}t d|d|Yd}~yd}~wwxYw#t$r}t d |d|Yd}~yd}~wwxYw#t$r}t d |d|Yd}~yd}~wwxYw)uCreate a shell wrapper script at ~/.local/bin/. The wrapper file is named after ``name`` (the alias). The profile it activates is ``target`` if given, otherwise ``name`` — this lets a custom alias name point at a differently-named profile without a post-hoc rewrite. On Windows, creates a ``.bat`` file instead of a POSIX shell script. Returns the path to the created wrapper, or None if creation failed. Tparentsexist_oku⚠ Could not create : Nrrz@echo off hermes -p z %* u ⚠ Could not create wrapper at rez#!/bin/sh exec z -p z "$@" )rrrmkdirr-printrr write_textshutilrshlexquotechmodstatst_modeS_IEXECS_IXGRPS_IXOTH) rrrrwrer wrapper_path hermes_exes r/create_wrapper_scriptrs #4 (E06$V,EG"$K$6 (J"wd^3    # #&=gYg$N O  #U*  h/;8J  # #&6u{{:7N6OtT[S\\c$d e   |002::T\\IDLLX[_[g[gg h '  %k]"QC89  4\N"QCH I   4\N"QCH I sHD!"E?B!E/! E*EE E,E''E,/ F8FFcft}t|} t|tj dk(}||z g}|r|j d||dz |D]:}|js |j}d|vr|jy<y#t$rYywxYw#t$rYXwxYw)zARemove the wrapper script for a profile. Returns True if removed.FrrrrT) rrrr<rrinsertr,runlinkr)rrrr candidatesrrs r/remove_wrapper_scriptrs"$K "4 (EE"(J%&J![eWD>9:"      &002') '')*  ' "  s# B,$B$ B! B!$ B0/B0c|dz }|jsy ddlm}m}ddlm}m}|t|} |\}}||kr |dd||y#||wxYw#t$rYywxYw) uBring a copied profile config.yaml up to the current schema. Profile creation can clone a config file that predates schema tracking (no ``_config_version``) or that is simply older than the running Hermes. If we leave it untouched, the first desktop/doctor view of the new profile shows a scary ``v0 → latest`` warning even though we just created the profile. Scope the normal migration pipeline to the new profile and keep it non-interactive. rNr)reset_hermes_home_overrideset_hermes_home_override)check_config_versionmigrate_configFT) interactivequiet) r,rrrhermes_cli.configrrrDr) r( config_pathrrrrtoken current_ver latest_vers r/#_migrate_profile_config_if_outdatedrs -K     YJ([)9: .&:&< #KZ'5= &u - &u -    s(!A)AA) A&&A)) A54A5 profile_namecFtjt|S)uReturn the alias name of the wrapper that activates *profile_name*, or None. A wrapper created by :func:`create_wrapper_script` is a file named after the alias whose body invokes ``hermes -p ``. When the alias name equals the profile name this is trivial, but a custom alias (``hermes profile alias --name ``) produces a differently-named file — so the display side cannot assume ``wrapper == profile`` and must reverse-look-up. A custom alias (name != profile) is preferred over the profile-named wrapper so ``profile list``/``show`` surface the command the user actually typed. Results are sorted for deterministic output when several aliases match. For listing ALL profiles at once, prefer :func:`build_alias_map` — calling this per-profile re-reads every wrapper file N times (O(N*M)); on a wrapper dir like ``~/.local/bin`` that also holds large unrelated binaries (ffmpeg etc.) that meant multi-second ``list_profiles`` latency and desktop timeouts. )build_alias_maprr)rs r/find_alias_for_profilers$   !7 !E FFrFi ct}i}|js|Stjdk(}d}t |j D]}|j s|r|jdk7r'|s |jr6 t|ddd5}|jt}dddj|}|d k(r{||t|zd}|jr#|j!dd d jnd } | st#| } |r |j$n |j&} | | k(r|j)| | | || < |S#1swYxYw#ttf$rY*wxYw) aSingle-pass reverse map ``{canonical_profile -> alias_name}``. Scans the wrapper dir ONCE (vs. :func:`find_alias_for_profile` per profile) and reads only a small head slice of each candidate wrapper, skipping binaries. A custom alias (file name != profile) wins over the profile-named wrapper, matching ``find_alias_for_profile``'s preference; deterministic via sorted iteration. rz hermes -p rrutf-8strict)encodingerrorsNrr)rrrrsortediterdiris_filesuffixopenread_WRAPPER_READ_LIMITr-UnicodeDecodeErrorfindlenrrrstemr setdefault) rrrprefixr>fridxrestraliass r/rr9sm#$KF     (J F ++-."}}  %,,&0 ell  eS78D 6&&!45 6 ll6" "9 sS[()*26**, 4#A&,,.B &u-( ejj E>   eU +!F5M;"< M+ 6 6+,   s*E%E)E%E" E%%E87E8ceZdZUdZeed<eed<eed<eed<dZe eed<dZ e eed<d Z eed <d Z e ed <dZe eed <dZe eed<dZe eed<dZe eed<dZe eed<dZeed<d Zeed<y) ProfileInfoz$Summary information about a profile.rpath is_defaultgateway_runningNrlproviderFhas_envr skill_count alias_path alias_namedistribution_namedistribution_versiondistribution_sourcer descriptiondescription_auto)__name__ __module__ __qualname____doc__rD__annotations__rboolrlrrrrintrrrrrrrr~rFr/rrns. I JE8C="Hhsm"GTK!%J%!%J $'+x}+*.(3-.)-#- K #d"rFrcL|dz }|jsy ddl}t|dd5}|j|xsi}dddt t sy|j d|j d |j d fS#1swYLxYw#t$rYywxYw) uReturn ``(name, version, source)`` from the profile's ``distribution.yaml`` if present; ``(None, None, None)`` otherwise. Failures (missing file, bad YAML) are swallowed — a bad manifest should never break ``hermes profile list`` for an unrelated profile. zdistribution.yaml)NNNrNrrrrrxsource)ryamlr safe_loadrdictrr)r(mf_pathr'r datas r/_read_distribution_metar,s//G ??    '3 1 +Q>>!$*D +$%# HHV  HHY  HHX    + +   s.BB B1B BB B#"B#c|dz }|jsy ddl}t|dd5}|j|xsi}dddj di}t |t r|dfSt |tr5|j d xs|j d|j d fSy#1swYuxYw#t$rYywxYw) zLRead model/provider from a profile's config.yaml. Returns (model, provider).r)NNrNrrr%rlrfr) r,r'rr(rrrDr)r)r(rr'r cfg model_cfgs r/_read_config_modelr0s -K      +sW 5 *..#)rC *GGGR( i %d? " i &==+Ey}}W/Ey}}U_G`` ` * * s/CB4-C.AC4B=9C C  C c ddlm}||dz d y ddlm}m}||d z }||| duS#t$rY+wxYw#t$rYywxYw) uCheck if a gateway is running for a given profile directory. Primary signal is the profile's ``gateway.pid`` (verified against the runtime lock). That check fails closed whenever the lock isn't held by *this* reader — which is exactly the case for a dashboard process that is a separate s6 service from the gateway it's reporting on (Docker), or any launch-service-managed gateway that left a fresh ``gateway_state.json`` but no live PID file. In those cases fall back to validating the PID recorded in the profile's own ``gateway_state.json`` against the live process table, mirroring the ``/api/status`` sidebar's liveness logic so the two surfaces agree. Parameterized by ``profile_dir`` so it never mutates ``HERMES_HOME``. r)get_running_pidrF) cleanup_staleNT)get_runtime_status_running_pidread_runtime_statusr) expected_home)gateway.statusr2rr4r5)r(r2r4r5runtimes r/_check_gateway_runningr9s 2 K-7u M    &k4H&HI-g[QY]]]     s 8A AA AA_SKILL_COUNT_CACHEg>@ skills_dircl |jj} tj|5}|D]8} |j dr#|jdj}||kDr|}: ddd|S#t$rYywxYw#t$rY`wxYw#1swY|SxYw#t$rY|SwxYw)a\Cheap change-signature for a skills tree. Max mtime of ``skills_dir`` and its immediate children (category dirs). Adding/removing a category bumps ``skills_dir``'s mtime; adding/removing a skill inside a category bumps that category dir's mtime. One ``scandir`` (not a recursive walk) keeps this O(#categories), not O(#files). gF)follow_symlinksN)rst_mtimer-rscandirr)r;sigitr>ms r/_skills_dir_signaturerCsoo((  ZZ # r ||E|:!JJuJ=FFs7"#C    J   J   J sbA;B&B5B .B1B&; BB BBBBB#B&#B&& B32B3cV|dz }|jsyt|}t|}tj}tj |}||d|k(r||dz t kr|dSd}|jdD]}t|r|dz }|||ft|<|S)zECount installed skills in a profile (cached by skills-dir signature).r rrzSKILL.md) rrDrCtimer:r_SKILL_COUNT_TTL_SECONDSrglobr )r(r;key signaturenowcachedcountmds r/ _count_skillsrOsx'J     j/C%j1I ))+C  # #C (F 1I " 6!9_ 8 8ay Ez* !" %    )#u5s LrFc |dz S)Nz profile.yamlr~r.s r/_profile_yaml_pathrQ+s  ''rFct|}|jsdddS ddl}t|dd5}|j |xsi}dddt tsdddSt|jd xsdjt|jd ddS#1swYfxYw#t $rdddcYSwxYw) uRead ``/profile.yaml`` and return a dict. Returns ``{"description": "", "description_auto": False}`` when the file is missing or unreadable. Never raises — a corrupt profile.yaml on an unrelated profile must not break ``hermes profile list``. rFrrrNrrr%rr) rQrr'rr(rrr)rDrrr")r(rr'r r+s r/read_profile_metarT/s k *D <<>!u==> $g . +!>>!$*D + dD !!u==488M28b9??A *!u==>s(B;B/ B;/B84B;;C  C rSrrc|jstd|ddl}t|}i}|j r? t |dd5}|j |xsi}dddttr|}||j|d<|t||d<t |d d5}|j||d d dddy#1swYmxYw#t$ri}YkwxYw#1swYyxYw) zUpdate ``/profile.yaml`` in place. Only the explicitly passed fields are overwritten; unspecified fields preserve existing values. Creates the file if missing. Profile directory itself must exist. z"profile directory does not exist: rNrrr%rrwF) sort_keysdefault_flow_style) rrr'rQrrr(rr)rrr" safe_dump)r(rrr'rexistingr loadeds r/write_profile_metar\Hs    "D[M RSS k *DH ||~ dC'2 1a*0b 1&$'!"-"3"3"5#'+,<'=#$ dC' *Oa xeNOO 1 1 H  OOs6CC%C2C.CC C+*C+.C7c>g}t}t}|jrt|\}}t |\}}}t |}|j td|dt||||dz jt|||||jdd|jdd t} | jrIt} t| jD]"} | js| j } | dk(r't"j%| s=t| \}}| jt'| } | r t(j*d k(}||r| d n| z }nd }t | \}}}t | }|j t| | dt| ||| dz jt| |r|jr|nd | ||||jdd|jdd %|S) z4Return info for all profiles, including the default.rfTrrrrF) rrrrrlrrrrrrrrrrN)rrrrrlrrrrrrrrrr)rrCrr0r,rTr:rr9r,rOrrrrrrrrrrr)rr default_homerlr dist_name dist_version dist_sourcemeta profiles_root alias_mapr>rrrrs r/ list_profilesremsH"$K,-L,\:x/F|/T, < . 2<@!F*224%l3'!- +3!XX&8%@  "'(M$% M1134! E<<>::Dy !''-07OE8"'=d'CDJ \\W4 (:zl$,?S]^ ! 3J53Q 0I|[$U+D OOK 6u =!//1)%0*49J9J9L:SW%"+%1$/ HH]B7!%*rs r/profiles_to_serverks(% & 3)F 0122&/1I1K%L$ME&(MM1134 (E<<>::Dy !''- LL$ ' ( LrF clone_from clone_all clone_configno_alias no_skillsc|r||s|r tdt|}t||dk(r tdt|}|j rt d|d|d} ||s|rV|ddlm} | } n!t|}t|t|} | jstd |xsd d | |rF| rDtj| |d t|  tD]} || z jd n"|jd d t D]} || z jd d | t"D]Y} | | z }|j s|| z }tj$||| dk(s: t'j(t+|d[| dz }|jrtj||dz d d t.D]P}| |z }|j s||z }|j0jd d tj$||R|dz }|j s3 |j3ddt'j(t+|d|dz }|j s ddlm}|j3|d|r |t:z j3dd|s t=||r-|j?r tA||j?dtC||S#t,$rYwxYw#t,$rYwxYw#t8$rYwxYw#t,$rYwxYw#t8$rYUwxYw)aCreate a new profile directory. Parameters ---------- name: Profile identifier (lowercase, alphanumeric, hyphens, underscores). clone_from: Source profile to clone from. If ``None`` and clone_config/clone_all is True, defaults to the currently active profile. clone_all: If True, do a full copytree of the source (all state). clone_config: If True, copy config files (config.yaml, .env, SOUL.md), installed skills, and selected profile identity files from the source profile. no_alias: If True, skip wrapper script creation. no_skills: If True, create an empty profile with no bundled skills, and write a marker file so ``hermes update`` skips re-seeding this profile's skills. Mutually exclusive with ``clone_config``/``clone_all`` (those explicitly copy skills from the source). Returns ------- Path The newly created profile directory. Nz--no-skills is mutually exclusive with --clone / --clone-from / --clone-all (cloning explicitly copies skills from the source profile).rfuSCannot create a profile named 'default' — it is the built-in profile (~/.hermes). Profile '' already exists at rget_hermes_homezSource profile 'riz' does not exist at Tsymlinksignore missing_okrrr )rw dirs_exist_ok# Per-profile secrets for this Hermes profile. # API keys and tokens set here override the shell environment. # Behavioral settings belong in config.yaml, not here. rr%r)DEFAULT_SOUL_MDzThis profile opted out of bundled-skill seeding (`hermes profile create --no-skills`). Delete this file to re-enable sync on the next `hermes update`. FrS)"r<rrrr,FileExistsErrorrrurrrcopytreerErrr _PROFILE_DIRS_CLONE_CONFIG_FILEScopy2rrrDr-_CLONE_SUBDIR_FILESparentrhermes_cli.default_soulr~rr+rrr\_maybe_register_gateway_service)rrlrmrnrorprrr(r1rustalesubdirfilenamesrcdst source_skillsrelpathenv_path soul_pathr~s r/create_profilersHj,  J   #4 (E%   a  "%(K %0D[MRSSJl   8(*J/ ;J !* -(4J  "#":#9"::Nzl[ Z  -j9  & :E 5 ( (D ( 9 : $6# FF 6 ! ( ( ( E F  !/ ! 8+::<%0CLLc*  6)!HHSXu5 !&'1M##% {X/EPTdhi/ + 7*::<%/CJJ$$TD$ALLc*  +V#H ??     K!   HHS]E * i'I      ?  7 C   3 3 ? ?T! @  +K8 {((*  '--/!& $E* u '! !F         *   sZL 2L L*(L9"M LL L'&L'* L65L69 MM MMrc$t|rgggddSttjjj } t j tjddgitjdt|it|ddd}|jdk(rG|jjr-tj |jjS|s[t#d |j|j$jr)t#d |j$jd d y #t j&$r|s t#d Yy t($r}|st#d|Yd }~y d }~wwxYw)uSeed bundled skills into a profile via subprocess. Uses subprocess because sync_skills() caches HERMES_HOME at module level. Returns the sync result dict, or None on failure. Profiles that opted out of bundled skills (via ``hermes profile create --no-skills`` — which writes ``.no-bundled-skills`` to the profile root) are skipped and get an empty-result dict so callers can report "opted out" instead of "failed". T)copiedupdated user_modifiedskipped_opt_outz-cziimport json; from tools.skills_sync import sync_skills; r = sync_skills(quiet=True); print(json.dumps(r)) HERMES_HOME<)envcwdrrrru%⚠ Skill seeding returned exit code z Nu!⚠ Skill seeding timed out (60s)u⚠ Skill seeding failed: )r0r__file__rr;rrr executablerrrDrrrjsonloadsrstderrrr)r(r project_rootrrs r/seed_profile_skillsrsc"+.#   >((//779L ^^TA B@2::?}c+.>?L!dB      !fmm&9&9&;::fmm1134 4 9&:K:K9LM N}}""$6==..0#6789  $ $ 5 6  .qc2 3s&B'E -AE F-F5F  Fcg}t}|js|Stdz }t|j D]}|jrt j |js3|jdk(rC|dz }|jrY |jrtj||n|jddtjt|d|j!|j|S#t"$r'}|st%d|jd|Yd }~d }~wwxYw) uGive every named profile that predates per-profile ``.env`` files one. Profiles created before the dashboard/CLI started seeding a ``.env`` (PR #44792) have none, so once the Channels/Keys endpoints became profile-scoped those profiles stopped inheriting the root install's credentials and showed everything as unconfigured. To avoid breaking anyone on update, copy the DEFAULT install's ``.env`` into each named profile that lacks one — that preserves the effective credentials those profiles were already running with (they previously read the root ``.env`` via the process environment). Users can then diverge per profile from there. Falls back to the placeholder header when the default install has no ``.env`` itself. Never overwrites an existing profile ``.env``. Returns the list of profile names that received a backfilled ``.env``. rrfr}rr%r{u%⚠ Could not seed .env for profile 'z': N)rrrCrrrrrr,rrrrrrrDr:r-r)r backfilledrc default_envr>rrs r/backfill_profile_envsrs/$J&(M    !*,v5K --/0R||~^%9%9%**%E  :: " 6> ??   R""$ [(3##O% $ HHS]E *   ejj )'R0   R=ejj\QCPQ RsA4D E EErcf ddl} |j}t j h} |j t j j}|.|j|j|j}|. |j t j j}hd}d}g} |jgdD]} | j} | jd} | | |vr)|| jd|k7r@| jdxsg} | sXd j| tjj!| dj#}t%fd |Dxs|d k(xs|j'd }|s| Dchc]}|j#}}||zsd }t)| D]j\}}|d vr*|dzt+| krt-| |dz|k(s0d}n9|j'dsFt-|j/ddd|k(shd}n|sE | j1xsijdd}|rt3|j|k(rd}|r| j5| | S#t$rgcYSwxYw#t$r|}YwxYw#t$rYBwxYw#t$rd}Y"wxYwcc}w#t$rYmwxYw#|j6|j8|j:f$rYHt$rYSwxYw)uPIDs of running Hermes *backends* bound to this profile. The ``gateway.pid`` file only tracks the messaging gateway. A Desktop app spawns a headless ``serve`` (or legacy ``dashboard --no-open``) backend per profile that holds the profile's SQLite connection open and keeps writing sessions/WAL/sandbox files — the writer that makes ``rmtree`` hit ``ENOTEMPTY`` (and, pre-fix, resurrected the tree). ``gateway.pid`` never names it, so find it by inspection: a Hermes backend subcommand (``serve``/``dashboard``/``gateway``) that is bound to *this* profile either by a ``--profile `` / ``-p `` selector or by a ``HERMES_HOME`` that resolves to ``profile_dir``. Best-effort and tightly scoped: current-user processes only, backend subcommands only (never an interactive ``chat``/``tui``), and never this process or its ancestors. Returns an empty list if ``psutil`` can't inspect anything. rN>rjru dashboard)zhermes_cli.mainzhermes-gateway tui_gateway)pidrusernamecmdlinerrr c3&K|]}|v ywNr~).0markerjoineds r/ z._profile_bound_backend_pids..BsBFf$BsreF>-p --profilerTz --profile==rr)psutilrr;r-rgetpidProcessraddrr process_iterinforjoinrbasenamerany startswith enumeraterrrrrr: NoSuchProcess AccessDenied ZombieProcess)rr(r resolved_dirskipr current_userbackend_tokenshermes_markerspidsprocrrargvexe_name is_hermestoktokensboundienv_homers @r/_profile_bound_backend_pidsrs:$#"**, iik]D  ,335 HHVZZ ]]_F ~~biik2;;= 7NIND##$JK;: 99D((5/C{cTk'DHHZ,@L,P88I&,"DXXd^Fww''Q0668HB>BB1x'1&&x0  .22cciik2F2^+E#D/ 3--!a%#d)2C-d1q5k:eC $^^L1-ciiQ.?.BCuL $  $  4"99-LHDN$:$:$< $L $  C o;z Ks   #" #     D3,!$$f&9&96;O;OP     sJ"J3A K1K!#K;K;K;4A1K;&K;*K'K; K;AK, K;" J0/J03 KK KK K$#K$'K;, K85K;7K88K;;&L0$L0/L0c"t||}|sy ddlmm}|D] } || tjdz}tj|krBtfd|Dsn-tjdtj|krB|D]}|s ||dtd t|d y#t$rYywxYw#t t tf$rYwxYw#t t tf$rYqwxYw) aTerminate any Desktop-spawned / stray backends bound to this profile. Complements ``_stop_gateway_process`` (which only knows ``gateway.pid``): without this, a live ``serve``/``dashboard`` backend keeps creating files under the profile dir while ``rmtree`` walks it, so the final ``rmdir`` fails with ``ENOTEMPTY`` and the delete doesn't converge. Best-effort: any failure is reported and swallowed so it never makes delete worse. Nr) _pid_exists terminate_pidg$@c3.K|] }|ywrr~)rrrs r/rz)_stop_profile_backends..s4;s#4s?Tforceu ✓ Stopped z profile backend process(es)) rr7rrrProcessLookupErrorPermissionErrorr-rFrsleeprr)rr(r_terminate_pidrdeadliners @r/_stop_profile_backendsrps 'uk :D O  3 yy{T!H ))+ 4t44  3 ))+  s  s$/ LT #? @A/  #OW=   'A  s4CC) C7 CCC43C47D DcXd}d}t|D]} tj||y||y#t$rtj||YywxYw#t$rE}|}|j sYd}~y||dz krt jd|dzzYd}~d}~wwxYw)a``shutil.rmtree`` with a short retry loop for transient races. Even after stopping the gateway and profile backends, a just-terminated process can leave in-flight writes (SQLite ``-wal``/``-shm`` checkpoints, sandbox temp files) that land after ``rmtree`` has walked past a directory, surfacing as ``ENOTEMPTY`` (POSIX) or a transient ``PermissionError`` (Windows file lock still releasing). A few spaced retries let those settle instead of failing the whole delete on a race the next attempt would win. N)onexc)onerrorrg333333?)rangerrmtree TypeErrorr-r,rFr)r( onexc_handlerattemptslast_excattemptrs r/_rmtree_with_retryrsH#H? 0 0 B k?  0 B k=A  B 0H%%'A% 3'A+./  0s34 AAAA B)$B$<#B$$B)yescDt|}t||dk(r tdt|}|j st d|dt |\}}t|}t|}t|\}} } td|td||rtd||rd|d nd z|rtd ||r%td |d | xsd| rtd| dg} t|z } | j} | r| jd| d td| D]}td||r td|s:t td|dj}||k7r td|St%||t'||r t)|t+||| rt-|rtd| d} d}t/||td| t3}||k(rt5dtd|t7d|d||td |d!|S#t t"f$rtd|cYSwxYw#t0$r}td|d||}Yd}~d}~wwxYw#t0$rY{wxYw)"zDelete a profile, its wrapper script, and its gateway service. Stops the gateway if running. Disables systemd/launchd service first to prevent auto-restart. Returns the path that was removed. rfzZCannot delete the default profile (~/.hermes). To remove everything, use: hermes uninstallrr' does not exist.z Profile: z Path: z Model: z (rrz Skills: zDistribution: @?zInstalled from: z;All config, API keys, memories, sessions, skills, cron jobszCommand alias (z This will permanently delete:u • u0 ⚠ Gateway is running — it will be stopped.zType 'z' to confirm: z Cancelled.z Cancelled.u ✓ Removed Ncddl}t|tr|d}t|tr t j |t j|j |jztjj|}|rA t j |t j|j |jz||y#t$rYwwxYw#t$rY$wxYw)aonexc/onerror handler: add +w on PermissionError so rmtree can proceed. Handles two cases on NixOS (and other systems with read-only copies from immutable stores): 1. The path itself isn't writable (e.g. a file with mode 0444) 2. The *parent* directory isn't writable (e.g. mode 0555) Compatible with both the ``onexc`` API (3.12+, receives an exception instance) and the ``onerror`` API (3.11-, receives ``sys.exc_info()`` tuple). rNr) rrtuplerrrrS_IWUSRr-rdirname)funcrr_statrs r/_make_writablez&delete_profile.._make_writables ! #u%!f#/HHT2774=#8#85==#HI.)@)@5==)PQT #s%AC AC& C#"C#& C21C2u⚠ Could not remove ru#✓ Active profile reset to defaultz#Could not remove profile directory z Profile 'z ' deleted.)rrr<rrrr0r9rOr,rrr,r:inputrKeyboardInterruptEOFError_cleanup_gateway_service!_maybe_unregister_gateway_service_stop_gateway_processrrrrget_active_profileset_active_profile RuntimeError)rrrr(rlr gw_runningrr_r`raitemsr has_wrapperitemconfirm remove_errorrrris r/delete_profiler s  #4 (E%   :  "%(K    )E72C DEE)5OE8' 4J ,K+B;+O(I|[ Kw   Ik] #$  %!r(1%5rJK +'( yk<+>3*?@A  $[M2 3 F E $%-L%%'K |nA67 +, tfo @A   fUG>:;AACG e  ,  UK0&e,k*5+.  ' L/ 0&*L*# J ;7 [M*+  #% U? y ) 7 8@ RP\~^_eqq Kwj )* s"8,  . !  P  %k]"QC89     s<#I I*>%JI'&I'* J3J  J JJc ddlm}|dk7ryddlm}|}|j sy |j |dy#t$rYyt$rYywxYw#t$rYyt$r}td|Yd}~yd}~wwxYw) uRegister a profile's gateway with s6 inside the container. No-op on host (systemd/launchd/windows) — those backends raise ``NotImplementedError`` on ``register_profile_gateway`` and the existing per-profile unit-generation paths handle lifecycle. Best-effort: any error (no backend detected, s6 not yet ready, etc.) is logged and swallowed so profile creation doesn't fail because the s6 supervision tree is in a weird state. The user can re-register manually later via the gateway start command, which goes through the same dispatch path. Port selection: each supervised profile gateway loads its own ``HERMES_HOME`` and binds the port resolved by ``gateway/config.py`` from that profile's environment — ``API_SERVER_PORT`` (or ``platforms.api_server.extra.port`` in the profile's ``config.yaml``), defaulting to 8642. There is no ``[gateway] port`` key and no Python-side allocator (PR #30136 review item I5 retired the SHA-256-derived range [9200, 9800) as dead code), so two profiles that both leave the port at its default will both try to bind 8642 — give each profile a distinct ``API_SERVER_PORT`` in its ``.env``. Host short-circuit: check ``detect_service_manager()`` first and return immediately if it isn't ``"s6"``. This keeps host (systemd/launchd/windows) profile creation completely silent — no ``get_service_manager()`` call, no exception path, no chance of the ``⚠ Could not register s6 gateway service`` warning ever rendering on a non-container machine. The earlier ``supports_runtime_registration()`` check still catches the case where detection somehow returns ``"s6"`` but the backend isn't actually the S6 one. rdetect_service_managers6Nget_service_managerF) start_nowu+⚠ Could not register s6 gateway service: ) hermes_cli.service_managerr rrrsupports_runtime_registrationregister_profile_gatewayr<rrr rmgrrs r/rrNsD E ! #t + B!#  , , .C $$\U$C       C ;C5ABBCs9A AA AAA B *B 2BB c ddlm}|dk7ryddlm}|}|j sy |j |y#t$rYyt$rYywxYw#t$r}td|Yd}~yd}~wwxYw)uTear down a profile's s6 gateway service inside the container. No-op on host. Idempotent: absent services are silently skipped by ``unregister_profile_gateway``. Same host short-circuit as :func:`_maybe_register_gateway_service` — see that docstring. rr r Nru-⚠ Could not unregister s6 gateway service: )rr rrrrunregister_profile_gatewayrrs r/rrs E ! #t + B!#  , , .E &&|4   E =cUCDDEs3A AA AAA A>&A99A>c.ddl}tjjd} t |tjd<ddlm}m}|jdk(r|}tjdz dz dz |d z }|jrtjd d d |gd ddtjd d d|gd dd|jd tjgdd ddtd|dnl|jdk(rY|}|jrBtjddt |gd dd|jd td||tjd<ydtjvrtjd=yy#t $r} td| Yd} ~ Wd} ~ wwxYw#||tjd<wdtjvrtjd=wwxYw)z9Disable and remove systemd/launchd service for a profile.rNr)get_service_nameget_launchd_plist_pathLinuxz.configsystemduserz.service systemctl--userdisableTF )rcheckrstopry)rrz daemon-reloadu ✓ Service z removedDarwin launchctlunloadu✓ Launchd service removedu⚠ Service cleanup: )rrrrrDhermes_cli.gatewayrrsystemrrr,rrrrr) rr( _platformold_homerrsvc_namesvc_file plist_pathrs r/rrs zz~~m,H&*$' $4 =!O     (')Hyy{Y.:VC RZF[[H  (Ix@#'ub (FH=#'ub40<#'ub XJh78    8 +/1J  " (C O<#'ub!!T!234  (0BJJ} % bjj ( =)) + %aS)**+  (0BJJ} % bjj ( =))s*EF44 G=G GGG``. Returns ``"custom"`` if HERMES_HOME is set to an unrecognized path. rrtrfrcustom) rrur;rCr relative_topartsrrrr<)ru hermes_homeresolveddefault_resolvedrcrelr>s r/rhrh(s1!#K""$H/199;##&(002M ""=1  u:?~33E!H=8O     sAB B*)B*root_dirc8dtdtdtffd }|S)uReturn an *ignore* callable for :func:`shutil.copytree`. Two-tier filtering: * **Root-level allow-list** — only entries whose name appears in ``_DEFAULT_EXPORT_INCLUDE_ROOT`` survive. Everything else (such as an unrelated ``x11-dev/`` directory in a Docker deployment where HERMES_HOME equals the cwd) is excluded. Blacklisting was tried first and proved unable to anticipate every non-Hermes file the user may have lying alongside HERMES_HOME (#58394). * **Universal exclusions at any depth** — ``__pycache__``, sockets, temp files; plus npm lockfiles, which may appear at the root. All other profile artifacts are copied through untouched. r3contentsr)ct}|D]@}|dk(s|jdr|j|+|dvs0|j|Bt|k(r|j d|D|S)Nr6)r7r8> package.jsonpackage-lock.jsonc32K|]}|tvs |ywr)_DEFAULT_EXPORT_INCLUDE_ROOT)rr>s r/rz:_default_export_ignore.._ignore..dsurCs r/rBz'_default_export_ignore.._ignoreXs|u #E %8I)J E"?? E"  #  ?h & NN#+ rF)rDlistrK)rCrBs` r/_default_export_ignorerMGs$"3$3" NrF output_pathc  ddl}t|}t|t|}|j st d|dt |}t|jdjd}|dk(rm|j5}t |dz }tj||dt| tj|d |d} t | cdddS|j5}t ||z }d d h tj||d fd  tj|d ||} t | cdddS#1swYtxYw#1swYyxYw)zMExport a profile to a tar.gz archive. Returns the output file path. rNrrrz.tar.gzz.tgzrfTrvgztarrUrc t|zSr)rK)drE_CREDENTIAL_FILESs r/z export_profile..s'83x='HrF)tempfilerrrrrrrD removesuffixTemporaryDirectoryrrrM make_archive) rrNrUrr(outputbasetmpdirstagedrrSs @r/export_profiler]lsd  "4 (E% !%(K    )E72C DEE + F v; # #I . ; ;F CD  ( ( * f&\I-F OO-k:   ((w JF<   $ $ & &f%(&1  H  $$T7FEBF|     sAEr.c3&K|] }|dk( yw)z..Nr~)rparts r/rz3_normalize_profile_archive_parts..s7 7s)r:rr is_absolutedriver<r>r)r^normalized_name posix_path windows_pathrdr>s r/ _normalize_profile_archive_partsrjs!))$4O/J";/L   ! ! #  # # %   7 }EFF(.. Hd$i2GT HE H C7777 }EFF L Is 3 B'=B'archive destinationc ddl}|j|d5}|jD]}t|j}|j |}|j r|jddL|jstd|j|jjdd|j|}|td|j|5t|d5}tj||dddddd tj||j d z dddy#1swYBxYw#1swYFxYw#t"$rYGwxYw#1swYyxYw) zAExtract a profile archive without allowing path escapes or links.rNr:gzTrz!Unsupported archive member type: zCannot read archive member: wbi)tarfiler getmembersrjrjoinpathisdirrisfiler<r extractfiler copyfileobjrrmoder-) rkrlrptfmemberr>r extractedrs r/_safe_extract_profile_archiver{s_ gv &"mmo F4V[[AE)[))51F||~ TD 9==? 7 }E MM  t  <v.I  #? }!MNN 3D. 3#""9c2 3 3 u!45- & 3 3 3 3   1s`CE3& E3E EE3#E#>E3 E EE E3# E0,E3/E00E33E<cddl}|j|d5}|jDchc]:}t|j}t |dkDs|j r|d<}}}|sC|jDchc]*}|j rt|jd,}}ddd|Scc}}wcc}w#1swYSxYw)aReturn the archive's top-level directory names. Profile imports expect exactly one root directory. Inspecting the archive before extraction lets us stage the import safely instead of mutating a live profile tree first and reconciling names later. rNrnr)rprrqrjrrrs)rkrprxryr>top_dirss r/_inspect_profile_archive_rootsr~s gv & "--/ :6;;G5zA~ !H  !mmo<<>1=a@H  O   Os(C?B<*C/C0C< CC archive_pathc"ddl}t|}|jstd|t |}t |dk(r|j nd}|xs|}|s td| tdt|}t||dk(r tdt|}|jrtd |d |t} | jd d |jd 5} t| } t|| | |z } | j!std|| } ||k7r| |z } | j#| t%j&t)| t)|ddd|S#1swY|SxYw)zImport a profile from a tar.gz archive. If *name* is not given, infers it from the archive's top-level directory. Returns the imported profile directory. rNzArchive not found: rzpCannot determine profile name from archive. Specify it explicitly: hermes profile import --name z=Profile archive must contain exactly one top-level directory.rfuCannot import as 'default' — that is the built-in root profile (~/.hermes). Specify a different name: hermes profile import --name rrrsTrhermes_profile_import_)r z,Profile archive root is missing or invalid: )rUrr,rr~rpopr<rrrrrrrWr{rrenamermoverD)rrrUrkr} archive_root inferred_namerr(rcr[ staging_rootrz final_sources r/import_profilers < G >> "5gY ?@@-g6H%(]a%78<<>TL(LM  S   K   #= 1E%   V  "%(K %0D[MRSS&(Mt4  $ $,D $ E9F| %g|< </ !>|nM ! 5 '%/L   \ * C %s;'789" #9" s :BFFold_namenew_namenew_dircnd|}d|}d|}|dz tdz tjdz dz g}t}|D]} |j } | |vs|j s*|j|  tj|jd} | jd} t| ts|| vr|n|} | | vr|| vrtd |d || | } t| trKd | vrG| j!dr| j#d d d }nd| vr| j#dd d n| }|| d <| j%| | |<|j'|j(dz} |j+tj,| dddzd|j/|td| d|y#t $r|} YwxYw#t tjf$rYwxYw#t $r' |j1dn#t $rYnwxYwYwxYw)zGRename Honcho host blocks for a renamed profile without changing peers.hermes_zhermes.z honcho.jsonz.honchoz config.jsonrr%hostsu$⚠ Honcho host block not migrated: z already exists in aiPeerr4rrbr8rEF)indent ensure_asciir8Tryu✓ Honcho host updated:  → N)rCrrrKr;r-rrrrrJSONDecodeErrorrrr)rrrrr9rrdumpsr:r)rrrold_hostlegacy_old_hostnew_hostrseenrr@r3r source_hostblockbareras r/_migrate_honcho_profile_hostr*se #Hz*O #H - "]2 i-/J eD,H ||~H t 4<<>   **T^^W^=>C %& "*e"3h e #  u  8 BUVZU[\ ] k" eT "xu'<%%i0"((a037:k7I{((a03{"E(O))K0ht{{V34  NN4::c!%H4OZaN b KK  )+eH:FGY,H H --.   4   d +     sZ G%G$=H G! G!$HH H4H! H4! H-*H4,H--H43H4ct|}t|}t|t||dk(r td|dk(r tdt|}t|}|j st d|d|j rtd|dt|rt||t||j|td|jd|jt|||t|t!|}|st#|td |ntd |d | t%|k(rt'|td ||S#t($rY|SwxYw) zrRename a profile: directory, wrapper script, service, active_profile. Returns the new profile directory. rfz"Cannot rename the default profile.u.Cannot rename to 'default' — it is reserved.rrrz' already exists.u ✓ Renamed ru✓ Alias updated: u⚠ Cannot create alias 'u' — u✓ Active profile updated: )rrr<rrrr,rr9rrrrrrrrrrrr)rr old_canon new_canonold_dirr collisions r/rename_profilerfs 'x0I&x0I)$)$I=>>IIJJi(Gi(G >> )I;6G HII~~ )4EFGGg& G4g& NN7 LeGLL> :;!Iw?)$%i0I i( #I;/0 ))F9+FG  9 , y ) 0 < = N   N s &E22 E?>E?ct|}t|t|}|dk7r!|jst d|d|t |S)zResolve a profile name to a HERMES_HOME path string. Called early in the CLI entry point, before any hermes modules are imported, to set the HERMES_HOME environment variable. rfrrr7)rrrrrrD)rrr(s r/resolve_profile_envrsc #< 0E% !%(K +"4"4"6w55:G =  { rFr)NFFFFN)F)dr rrrerrrrrrF dataclassesrpathlibrrrtypingrrr agent.skill_utilsr compilerrrrrrLrDr! frozensetr r'r+r"r0rE_DEFAULT_EXPORT_EXCLUDE_ROOTrJrrrrCrrrrrrrrrrrrrrr)rrrr,r0r9r:floatr#rGrCrOrQrTr\rerkrrrrrrr rrrrrrrhrMr]rjr{rKr~rrrrr~rFr/rs+*  !88((49: "$s),3<=33,3<=33 0DT343t )* B )*   ! 3D 3%$%9$9 *$*$   <  c  d  (#($(+++'' 'TGG ((Xc](htn(V< T d >GG#G6.c3h.j ## #@  % 2DU&R;=DeE5#$5667<du6tP(D(T(4D8"&'+ OO#Otn O  OJEtK(EP&&$uS$Y/?*@&V!%!%~ ~ ~~ ~  ~  ~#~ ~B*T*$*8D>*Z11$s)1hmsmm$s)m`&B#&BD&BT&BRDD"T"J++3+4+\#$s)(4dt@DSX2<<HSM<T<F9H39H#9H9HQU9Hx4S4C4D4vccrF