Upload folder using huggingface_hub

app.py

@@ -1,52 +1,37 @@
 """
 Hermes Agent - Zero-Outbound Webhook Architecture on Hugging Face Spaces
 100% Reliable Inbound Telegram Webhook + Direct JSON Response + Gradio Dashboard
+
+Stability rules:
+- Module import is lightweight: no blocking pip install, no blocking agent init.
+- Heavy setup (hermes runtime install, token refresh, agent init) runs in a
+  background thread; /health answers immediately.
+- The webhook route never blocks the asyncio event loop: all work runs in the
+  Starlette thread pool.
+- Chat calls are capped at CHAT_BUDGET_SECONDS; if the model is slower the
+  webhook still answers within Telegram's window and the result is delivered
+  asynchronously as a fallback.
 """
 import os
 import sys
 import json
 import subprocess
+import threading
 import time
+from concurrent.futures import ThreadPoolExecutor, TimeoutError as FutureTimeoutError
+
 import psutil
+import requests
 from fastapi import FastAPI, Request
 from fastapi.responses import JSONResponse
+from starlette.concurrency import run_in_threadpool
 import gradio as gr
 from dotenv import load_dotenv
 
 CURRENT_DIR = os.path.dirname(os.path.abspath(__file__))
 load_dotenv(os.path.join(CURRENT_DIR, ".env"))
 
-# 0. Install and load Hermes Agent runtime if not present
-AIAgent = None
-try:
-    from run_agent import AIAgent
-except ImportError:
-    try:
-        print("[SETUP] Installing hermes-agent runtime...")
-        subprocess.run([sys.executable, "-m", "pip", "install", "--no-deps", "hermes-agent"], check=False)
-        from run_agent import AIAgent
-        print("[SETUP] hermes-agent loaded successfully!")
-    except Exception as e:
-        print(f"[WARN] Failed loading AIAgent: {e}")
-
-# 1. Load Nous Portal OAuth state into ~/.hermes & os.environ
-NOUS_ACCESS_TOKEN = ""
-try:
-    auth_state_path = os.path.join(CURRENT_DIR, "nous_auth_state.json")
-    if os.path.exists(auth_state_path):
-        from hermes_cli.auth import _write_shared_nous_state
-        with open(auth_state_path, "r", encoding="utf-8") as f:
-            state = json.load(f)
-        _write_shared_nous_state(state)
-        NOUS_ACCESS_TOKEN = state.get("access_token", "")
-        if NOUS_ACCESS_TOKEN:
-            os.environ["NOUS_API_KEY"] = NOUS_ACCESS_TOKEN
-            os.environ["NOUS_JWT"] = NOUS_ACCESS_TOKEN
-        print("[SETUP] Nous Portal OAuth state loaded successfully into environment!")
-except Exception as e:
-    print(f"[SETUP WARN] Load nous auth state: {e}")
-
-# 2. Environment & Configuration
+# 1. Environment & Configuration
 BOT_TOKEN = os.getenv("TELEGRAM_BOT_TOKEN", "").strip()
 ALLOWED_USER_ID_RAW = os.getenv("ALLOWED_USER_ID", "0").strip()
 try:
@@ -60,6 +45,14 @@ MODEL_NAME = os.getenv("HERMES_MODEL", "stepfun/step-3.7-flash:free").strip()
 START_TIME = time.time()
 TELEGRAM_LOGS = []
 
+AUTH_STATE_PATH = os.path.join(CURRENT_DIR, "nous_auth_state.json")
+NOUS_BASE_URL = "https://inference-api.nousresearch.com/v1"
+TOKEN_REFRESH_SKEW_SECONDS = 180
+CHAT_BUDGET_SECONDS = 45
+PROVIDER_REQUEST_TIMEOUT = 60
+SETUP_START = time.time()
+
+
 def add_log(msg: str):
     timestamp = time.strftime("%H:%M:%S")
     log_entry = f"[{timestamp}] {msg}"
@@ -68,36 +61,283 @@ def add_log(msg: str):
     if len(TELEGRAM_LOGS) > 100:
         TELEGRAM_LOGS.pop(0)
 
-# 3. Hermes Agent Instance Loader
+
+# 2. Runtime state (guarded by locks, mutated from worker threads)
+AIAgent = None
 agent_instance = None
+NOUS_ACCESS_TOKEN = ""
+SETUP_STATUS = "starting"
+SETUP_LOCK = threading.Lock()
+CHAT_LOCK = threading.Lock()
+chat_executor = ThreadPoolExecutor(max_workers=1, thread_name_prefix="hermes-chat")
 
-def init_hermes_agent(model_name=MODEL_NAME):
-    global agent_instance
-    if not AIAgent:
+
+def get_setup_status() -> str:
+    if SETUP_STATUS == "ready" and agent_instance is None:
+        return "agent-init-failed"
+    return SETUP_STATUS
+
+
+def _hermes_home() -> str:
+    return os.environ.get("HERMES_HOME") or os.path.join(os.path.expanduser("~"), ".hermes")
+
+
+def ensure_provider_timeout_config(timeout_seconds: int = PROVIDER_REQUEST_TIMEOUT):
+    """Cap Nous request timeouts in ~/.hermes/config.yaml (hermes reads this)."""
+    try:
+        import yaml
+
+        home = _hermes_home()
+        os.makedirs(home, exist_ok=True)
+        path = os.path.join(home, "config.yaml")
+        cfg = {}
+        if os.path.exists(path):
+            with open(path, "r", encoding="utf-8") as f:
+                cfg = yaml.safe_load(f) or {}
+        if not isinstance(cfg, dict):
+            cfg = {}
+        providers = cfg.setdefault("providers", {})
+        if not isinstance(providers, dict):
+            providers = cfg["providers"] = {}
+        nous = providers.setdefault("nous", {})
+        if not isinstance(nous, dict):
+            nous = providers["nous"] = {}
+        if nous.get("request_timeout_seconds") == timeout_seconds:
+            return
+        nous["request_timeout_seconds"] = timeout_seconds
+        tmp = path + ".tmp"
+        with open(tmp, "w", encoding="utf-8") as f:
+            yaml.safe_dump(cfg, f, sort_keys=False, allow_unicode=True)
+        os.replace(tmp, path)
+        add_log(f"[SETUP] provider request timeout set to {timeout_seconds}s")
+    except Exception as e:
+        add_log(f"[SETUP WARN] provider timeout config skipped: {e}")
+
+
+def load_auth_state() -> dict | None:
+    try:
+        if not os.path.exists(AUTH_STATE_PATH):
+            return None
+        with open(AUTH_STATE_PATH, "r", encoding="utf-8") as f:
+            state = json.load(f)
+        return state if isinstance(state, dict) else None
+    except Exception as e:
+        add_log(f"[SETUP WARN] read nous auth state: {e}")
         return None
+
+
+def persist_auth_state(state: dict):
+    """Persist rotated OAuth state to the space file + hermes shared store."""
+    global NOUS_ACCESS_TOKEN
+    if not isinstance(state, dict):
+        return
+    try:
+        tmp = AUTH_STATE_PATH + ".tmp"
+        with open(tmp, "w", encoding="utf-8") as f:
+            json.dump(state, f, indent=2, ensure_ascii=False)
+        os.replace(tmp, AUTH_STATE_PATH)
+    except Exception as e:
+        add_log(f"[SETUP WARN] write nous auth state: {e}")
+    try:
+        from hermes_cli.auth import _write_shared_nous_state
+
+        _write_shared_nous_state(state)
+    except Exception:
+        pass
+    token = state.get("access_token") or ""
+    if token:
+        NOUS_ACCESS_TOKEN = token
+        os.environ["NOUS_API_KEY"] = token
+        os.environ["NOUS_JWT"] = token
+
+
+def _token_needs_refresh(state: dict) -> bool:
+    expires_at = state.get("expires_at")
+    if not expires_at:
+        return True
+    try:
+        from datetime import datetime, timezone
+
+        exp = datetime.fromisoformat(str(expires_at).replace("Z", "+00:00"))
+        if exp.tzinfo is None:
+            exp = exp.replace(tzinfo=timezone.utc)
+        now = datetime.now(timezone.utc)
+        return (exp - now).total_seconds() < TOKEN_REFRESH_SKEW_SECONDS
+    except Exception:
+        return True
+
+
+def ensure_nous_token(force: bool = False) -> tuple[bool, str]:
+    """Refresh the Nous OAuth access token when expired/near-expiry."""
+    state = load_auth_state()
+    if not state:
+        return False, "nous_auth_state.json missing"
+    if not force and not _token_needs_refresh(state):
+        if NOUS_ACCESS_TOKEN != state.get("access_token"):
+            persist_auth_state(state)
+        return True, "token valid"
     try:
-        if NOUS_ACCESS_TOKEN:
-            os.environ["NOUS_API_KEY"] = NOUS_ACCESS_TOKEN
-            os.environ["NOUS_JWT"] = NOUS_ACCESS_TOKEN
+        from hermes_cli.auth import refresh_nous_oauth_from_state
+
+        new_state = refresh_nous_oauth_from_state(
+            state,
+            timeout_seconds=20,
+            force_refresh=force,
+            on_state_update=lambda s, _ev: persist_auth_state(s),
+        )
+    except Exception as e:
+        add_log(f"[TOKEN] refresh failed: {e}")
+        return False, f"refresh failed: {e}"
+    if not isinstance(new_state, dict) or not new_state.get("access_token"):
+        return False, "empty token after refresh"
+    if new_state != state:
+        persist_auth_state(new_state)
+        add_log("[TOKEN] access token refreshed and persisted")
+    elif not NOUS_ACCESS_TOKEN:
+        persist_auth_state(new_state)
+    return True, "token ready"
+
 
-        agent_instance = AIAgent(
+def init_hermes_agent(model_name: str | None = None):
+    global agent_instance, MODEL_NAME
+    if AIAgent is None:
+        return None
+    model_name = model_name or MODEL_NAME
+    token = NOUS_ACCESS_TOKEN
+    try:
+        if token:
+            os.environ["NOUS_API_KEY"] = token
+            os.environ["NOUS_JWT"] = token
+        agent = AIAgent(
             model=model_name,
             provider="nous",
-            api_key=NOUS_ACCESS_TOKEN if NOUS_ACCESS_TOKEN else None,
-            base_url="https://inference-api.nousresearch.com/v1",
-            quiet_mode=True
+            api_key=token or None,
+            base_url=NOUS_BASE_URL,
+            quiet_mode=True,
         )
-        add_log(f"Hermes Agent ({model_name}) via Nous Portal initialized successfully!")
-        return agent_instance
+        agent_instance = agent
+        MODEL_NAME = model_name
+        add_log(f"Hermes Agent ({model_name}) via Nous Portal initialized!")
+        return agent
     except Exception as e:
         add_log(f"AIAgent Nous init error ({model_name}): {e}")
         return None
 
-init_hermes_agent(MODEL_NAME)
 
-# 4. Message Processing (Direct Webhook JSON Response)
+def ensure_agent_ready() -> bool:
+    global agent_instance
+    if agent_instance is not None:
+        return True
+    if AIAgent is None:
+        return False
+    with SETUP_LOCK:
+        if agent_instance is not None:
+            return True
+        ok, msg = ensure_nous_token()
+        if not ok:
+            add_log(f"[AGENT] token not ready: {msg}")
+        return init_hermes_agent(MODEL_NAME) is not None
+
+
+def _setup_worker():
+    """Runs off the import path: install hermes, refresh token, init agent."""
+    global AIAgent, SETUP_STATUS
+    try:
+        try:
+            from run_agent import AIAgent as _AIAgent
+        except ImportError:
+            add_log("[SETUP] hermes-agent runtime missing -> installing (background)")
+            try:
+                subprocess.run(
+                    [
+                        sys.executable, "-m", "pip", "install", "--no-deps",
+                        "--timeout", "20", "--retries", "2", "hermes-agent",
+                    ],
+                    check=False,
+                    timeout=420,
+                )
+            except subprocess.TimeoutExpired:
+                add_log("[SETUP WARN] pip install hermes-agent timed out (420s)")
+            from run_agent import AIAgent as _AIAgent
+
+        AIAgent = _AIAgent
+        add_log("[SETUP] hermes runtime loaded")
+    except Exception as e:
+        SETUP_STATUS = f"hermes-unavailable: {e}"
+        add_log(f"[SETUP ERROR] hermes runtime unavailable: {e}")
+        return
+
+    ensure_provider_timeout_config(PROVIDER_REQUEST_TIMEOUT)
+
+    state = load_auth_state()
+    if state:
+        persist_auth_state(state)
+        ok, msg = ensure_nous_token()
+        add_log(f"[SETUP] nous token: {msg} (ok={ok})")
+    else:
+        add_log("[SETUP WARN] nous_auth_state.json not found")
+
+    with SETUP_LOCK:
+        if agent_instance is None:
+            if init_hermes_agent(MODEL_NAME) is None:
+                SETUP_STATUS = "agent-init-failed"
+                add_log("[SETUP ERROR] agent init failed")
+                return
+    SETUP_STATUS = "ready"
+    add_log(f"[SETUP] ready in {round(time.time() - SETUP_START, 1)}s")
+
+
+def _is_unauthorized(exc: Exception) -> bool:
+    text = str(exc).lower()
+    return "401" in text or "unauthorized" in text or "invalid api key" in text or "out of funds" in text
+
+
+def _chat_worker(text: str) -> str:
+    global agent_instance
+    ok, msg = ensure_nous_token()
+    if not ok:
+        add_log(f"[CHAT] token issue: {msg}")
+    if not ensure_agent_ready():
+        return "⚠️ Chưa khởi tạo được Hermes Agent qua Nous Portal."
+    try:
+        return agent_instance.chat(text)
+    except Exception as e:
+        add_log(f"[CHAT] error: {e}")
+        if _is_unauthorized(e):
+            ok, msg = ensure_nous_token(force=True)
+            add_log(f"[CHAT] force token refresh -> {msg} (ok={ok})")
+            if ok and ensure_agent_ready():
+                try:
+                    return agent_instance.chat(text)
+                except Exception as e2:
+                    return f"❌ Lỗi Hermes Agent: {e2}"
+            return f"❌ Token Nous Portal không hợp lệ: {msg}"
+        return f"❌ Lỗi Hermes Agent: {e}"
+
+
+def send_telegram_message(chat_id, text: str) -> bool:
+    """Async-delivery fallback used only when the webhook budget is exceeded."""
+    if not BOT_TOKEN:
+        return False
+    try:
+        if len(text) > 4000:
+            text = text[:4000] + "\n... [Cắt bớt do quá dài]"
+        resp = requests.post(
+            f"https://api.telegram.org/bot{BOT_TOKEN}/sendMessage",
+            json={"chat_id": chat_id, "text": text},
+            timeout=15,
+        )
+        if not resp.ok:
+            add_log(f"[TG] sendMessage failed: HTTP {resp.status_code}")
+            return False
+        return True
+    except Exception as e:
+        add_log(f"[TG] sendMessage error: {e}")
+        return False
+
+
+# 3. Message Processing (Direct Webhook JSON Response)
 def process_update(update: dict) -> dict | None:
-    global MODEL_NAME, agent_instance
     msg = update.get("message")
     if not msg:
         return None
@@ -108,17 +348,16 @@ def process_update(update: dict) -> dict | None:
     text = (msg.get("text") or "").strip()
 
     if sender_id != ALLOWED_USER_ID:
-        add_log(f"Blocked unauthorized message from User ID {sender_id} (@{sender.get('username')})")
+        add_log(f"Blocked unauthorized message from User ID {sender_id}")
         return None
 
     add_log(f"Processing webhook message from {sender_id}: {text[:60]}")
 
-    # Helper for building Telegram JSON reply
-    def make_reply(reply_text: str, parse_mode: str = "Markdown"):
+    def make_reply(reply_text: str, parse_mode: str | None = "Markdown"):
         payload = {
             "method": "sendMessage",
             "chat_id": chat_id,
-            "text": reply_text
+            "text": reply_text,
         }
         if parse_mode:
             payload["parse_mode"] = parse_mode
@@ -133,6 +372,7 @@ def process_update(update: dict) -> dict | None:
             f"• Model mặc định: `{MODEL_NAME}` (Free 100% Nous Portal)\n"
             "• `/model` : Xem hoặc đổi sang các model Free khác của Nous.\n"
             "• `/status` : Xem Uptime, CPU, RAM và trạng thái hệ thống.\n"
+            "• `/login_nous` : Buộc làm mới token Nous Portal.\n"
             "• `/sh <lệnh>` : Chạy lệnh shell/CLI trên máy chủ.\n"
             "• Nhắn tin bất kỳ để chat và nhờ Hermes Agent giải quyết task."
         )
@@ -143,15 +383,18 @@ def process_update(update: dict) -> dict | None:
         uptime_sec = int(time.time() - START_TIME)
         uptime_str = f"{uptime_sec // 3600}h {(uptime_sec % 3600) // 60}m {uptime_sec % 60}s"
         mem = psutil.virtual_memory()
+        state = load_auth_state() or {}
         stat_msg = (
             f"📊 *HỆ THỐNG TELEMETRY (WEBHOOK)*\n"
             f"━━━━━━━━━━━━━━━━━━━\n"
             f"⏱ *Uptime:* `{uptime_str}`\n"
             f"💻 *CPU Load:* `{psutil.cpu_percent()}%`\n"
             f"🧠 *RAM:* `{round(mem.used / 1024**2, 1)}MB / {round(mem.total / 1024**2, 1)}MB`\n"
-            f"🌐 *Provider:* `Nous Portal (OAuth Active)`\n"
+            f"🌐 *Provider:* `Nous Portal (OAuth)`\n"
             f"🤖 *Active Model:* `{MODEL_NAME}`\n"
             f"🔑 *Authorized User ID:* `{ALLOWED_USER_ID}`\n"
+            f"⚙️ *Setup:* `{get_setup_status()}`\n"
+            f"🎟 *Token expires:* `{state.get('expires_at', 'unknown')}`\n"
         )
         return make_reply(stat_msg)
 
@@ -170,12 +413,22 @@ def process_update(update: dict) -> dict | None:
 
     if text.startswith("/model "):
         new_model = text.split(" ", 1)[1].strip()
-        new_agent = init_hermes_agent(new_model)
+        with SETUP_LOCK:
+            new_agent = init_hermes_agent(new_model)
         if new_agent:
-            MODEL_NAME = new_model
             return make_reply(f"✅ Đã chuyển sang Model Nous: `{MODEL_NAME}` thành công!")
-        else:
-            return make_reply(f"⚠️ Không thể khởi tạo model `{new_model}`. Vui lòng kiểm tra lại.")
+        return make_reply(f"⚠️ Không thể khởi tạo model `{new_model}`. Vui lòng kiểm tra lại.")
+
+    # Command: /login_nous - force token refresh
+    if text in ["/login_nous", "/refresh_token"]:
+        ok, msg = ensure_nous_token(force=True)
+        state = load_auth_state() or {}
+        if ok:
+            return make_reply(
+                f"✅ Token Nous Portal đã làm mới.\n`{msg}`\n"
+                f"🎟 Hết hạn: `{state.get('expires_at', 'unknown')}`"
+            )
+        return make_reply(f"❌ Làm mới token thất bại: `{msg}`")
 
     # Command: /sh or /cmd
     if text.startswith("/sh ") or text.startswith("/cmd "):
@@ -195,63 +448,104 @@ def process_update(update: dict) -> dict | None:
         except Exception as e:
             return make_reply(f"❌ Lỗi CLI: {str(e)}")
 
-    # Chat with Hermes Agent via Nous Portal
-    if not agent_instance:
-        init_hermes_agent(MODEL_NAME)
-        if not agent_instance:
-            return make_reply("⚠️ Chưa khởi tạo được Hermes Agent qua Nous Portal.")
+    # Chat with Hermes Agent via Nous Portal (bounded wait, never hangs the bot)
+    if not CHAT_LOCK.acquire(blocking=False):
+        return make_reply("⏳ Một job khác đang chạy, gửi lại sau giây lát.")
 
+    released = False
     try:
-        reply = agent_instance.chat(text)
-        return make_reply(reply, parse_mode=None)
+        future = chat_executor.submit(_chat_worker, text)
+        try:
+            reply = future.result(timeout=CHAT_BUDGET_SECONDS)
+            return make_reply(reply or "(Hermes trả về rỗng)", parse_mode=None)
+        except FutureTimeoutError:
+            def _deliver_later():
+                try:
+                    payload = future.result()
+                except Exception as e:
+                    payload = f"❌ Hermes Agent lỗi: {e}"
+                try:
+                    send_telegram_message(chat_id, payload)
+                finally:
+                    CHAT_LOCK.release()
+
+            threading.Thread(target=_deliver_later, daemon=True).start()
+            released = True
+            return make_reply(
+                f"⏳ Mô hình đang trả lời lâu hơn {CHAT_BUDGET_SECONDS}s. "
+                "Tôi sẽ gửi kết quả ngay khi hoàn tất."
+            )
     except Exception as e:
-        return make_reply(f"❌ Lỗi Hermes Agent: {str(e)}", parse_mode=None)
+        return make_reply(f"❌ Lỗi chat: {e}", parse_mode=None)
+    finally:
+        if not released:
+            CHAT_LOCK.release()
+
 
-# 5. FastAPI Application & Webhook Route
+# 4. FastAPI Application & Webhook Route
 app = FastAPI(title="Hermes Agent Telegram Webhook")
 
+
 @app.post("/webhook")
 async def telegram_webhook(request: Request):
     try:
         data = await request.json()
-        resp_data = process_update(data)
-        if resp_data:
-            return JSONResponse(content=resp_data)
+    except Exception:
+        return {"status": "ok"}
+    try:
+        resp_data = await run_in_threadpool(process_update, data)
     except Exception as e:
         add_log(f"Webhook processing exception: {e}")
+        resp_data = None
+    if resp_data:
+        return JSONResponse(content=resp_data)
     return {"status": "ok"}
 
+
 @app.get("/health")
 def health():
-    return {"status": "online", "model": MODEL_NAME, "user_id": ALLOWED_USER_ID}
+    return {
+        "status": "online",
+        "setup": get_setup_status(),
+        "agent_ready": agent_instance is not None,
+        "model": MODEL_NAME,
+        "user_id": ALLOWED_USER_ID,
+        "uptime_seconds": int(time.time() - START_TIME),
+    }
+
 
-# 6. Gradio Dashboard for Space
+# 5. Gradio Dashboard for Space
 def get_system_telemetry():
     uptime_sec = int(time.time() - START_TIME)
     uptime_str = f"{uptime_sec // 3600}h {(uptime_sec % 3600) // 60}m {uptime_sec % 60}s"
     mem = psutil.virtual_memory()
     logs_str = "\n".join(TELEGRAM_LOGS[-20:]) if TELEGRAM_LOGS else "Chưa có log..."
+    state = load_auth_state() or {}
     status_summary = (
         f"🟢 **STATUS: ONLINE (HF WEBHOOK MODE)**\n\n"
         f"• **Telegram Bot Token:** {'✅ Đã nạp' if BOT_TOKEN else '❌ Chưa nạp'}\n"
         f"• **Authorized User ID:** `{ALLOWED_USER_ID}`\n"
-        f"• **Provider:** `Nous Portal (OAuth Active)`\n"
+        f"• **Provider:** `Nous Portal (OAuth)`\n"
         f"• **Active Model:** `{MODEL_NAME}`\n"
+        f"• **Setup:** `{get_setup_status()}`\n"
+        f"• **Agent Ready:** `{'✅' if agent_instance else '❌'}`\n"
+        f"• **Token expires:** `{state.get('expires_at', 'unknown')}`\n"
         f"• **CPU Usage:** `{psutil.cpu_percent()}%`\n"
         f"• **RAM Usage:** `{round(mem.used / 1024**2, 1)}MB / {round(mem.total / 1024**2, 1)}MB`\n"
         f"• **Uptime:** `{uptime_str}`\n"
     )
     return status_summary, logs_str
 
+
 with gr.Blocks(title="Hermes Agent Telegram Webhook Core") as demo:
     gr.Markdown("# 🛡️ Hermes Agent Telegram Webhook Core (Nous Portal Free)")
     gr.Markdown("Hệ thống Private Telegram Webhook đang tiếp nhận tin nhắn từ Telegram và phản hồi tức thì.")
-    
+
     with gr.Row():
         status_box = gr.Markdown()
     with gr.Row():
         logs_box = gr.Textbox(label="Recent Security & Webhook Logs", lines=10, max_lines=20, interactive=False)
-    
+
     btn_refresh = gr.Button("🔄 Cập nhật trạng thái", variant="primary")
     btn_refresh.click(fn=get_system_telemetry, outputs=[status_box, logs_box])
     demo.load(fn=get_system_telemetry, outputs=[status_box, logs_box])
@@ -259,6 +553,10 @@ with gr.Blocks(title="Hermes Agent Telegram Webhook Core") as demo:
 # Mount Gradio onto FastAPI app
 app = gr.mount_gradio_app(app, demo, path="/")
 
+# Background setup: never blocks the import path / server start
+threading.Thread(target=_setup_worker, name="hermes-setup", daemon=True).start()
+
 if __name__ == "__main__":
     import uvicorn
-    uvicorn.run(app, host="0.0.0.0", port=7860)
+
+    uvicorn.run(app, host="0.0.0.0", port=7860, timeout_keep_alive=15)

nous_auth_state.json

@@ -1,13 +1,22 @@
 {
-  "_schema": 1,
-  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InByb2QtMjAyNi0wNS0wOC0xIn0.eyJjbGllbnRfaWQiOiJoZXJtZXMtY2xpIiwib3JnX2lkIjoibmFzX29yZ2FuaXNhdGlvbjo5MzdjNjYyNC1jNzEwLTQzMTEtOTkxMy05MDg2YTFiNjZlMzMiLCJlbWFpbCI6InRlYW1zaW92bkBnbWFpbC5jb20iLCJtYW5hZ2VkX3Rvb2xzIjpmYWxzZSwic2NvcGUiOiJpbmZlcmVuY2U6aW52b2tlIiwidG9rZW5fdXNlIjoiYWNjZXNzIiwib2F1dGhfY29udHJhY3RfdmVyc2lvbiI6MSwic2lkIjoic2lkX3A4T1hVTHFwQ2xuLVQ0STctYUVpbk81LSIsInByb2R1Y3RfaWQiOiJub3VzLWhlcm1lcy1hZ2VudCIsIm5vdXNfY2xpZW50IjoiaGVybWVzLWFnZW50IiwidG9vbF9nYXRld2F5X2FkbWluIjpmYWxzZSwicGFpZF9hY2Nlc3MiOmZhbHNlLCJwcml2YWN5X21vZGUiOiJzdGFuZGFyZCIsInBvbGljeV9wcmVzZW50IjpmYWxzZSwibWVtYmVyX3NwZW5kX2NhcF9leGNlZWRlZCI6ZmFsc2UsIm1lbWJlcl9zcGVuZF9jYXBfdXNkIjpudWxsLCJtZW1iZXJfc3BlbmRfdXNkIjoiMCIsIm1lbWJlcl9zcGVuZF9jYXBfcmVtYWluaW5nX3VzZCI6bnVsbCwibWVtYmVyX2Zyb250aWVyX3NwZW5kX2NhcF9leGNlZWRlZCI6ZmFsc2UsIm1lbWJlcl9mcm9udGllcl9zcGVuZF9jYXBfdXNkIjpudWxsLCJtZW1iZXJfZnJvbnRpZXJfc3BlbmRfdXNkIjoiMCIsIm1lbWJlcl9mcm9udGllcl9zcGVuZF9jYXBfcmVtYWluaW5nX3VzZCI6bnVsbCwidG9vbF9hY2Nlc3MiOnsiZW5hYmxlZCI6ZmFsc2UsImNvdmVyYWdlIjp7ImZpcmVjcmF3bCI6dHJ1ZSwiZmFsIjp0cnVlLCJmYWwtdmlkZW8iOmZhbHNlLCJvcGVuYWktYXVkaW8iOnRydWUsImJyb3dzZXItdXNlIjp0cnVlLCJtb2RhbCI6dHJ1ZSwia3JlYSI6ZmFsc2V9fSwicmF0ZV9saW1pdF9wcm9maWxlX2lkIjotMTIsInJhdGVfbGltaXRfcnBtIjo1MCwicmF0ZV9saW1pdF90cG0iOjUwMDAwMCwicmF0ZV9saW1pdF9ycGgiOjIxMDAsInJhdGVfbGltaXRfdHBoIjo2MDAwMDAwLCJyYXRlX2xpbWl0X3NvdXJjZSI6ImZyZWVfaGVybWVzX2FnZW50Iiwic3ViIjoibmFzX3VzZXI6ZTc1OTc3YTktMDRjYy00YmYzLTk0MTMtNzM0YTIxMmZhZjQ0IiwiaXNzIjoiaHR0cHM6Ly9wb3J0YWwubm91c3Jlc2VhcmNoLmNvbSIsImF1ZCI6Imhlcm1lcy1jbGk6aGVybWVzLWNsaSIsImlhdCI6MTc5MTI1ODk3MCwiZXhwIjoxNzkxMjYyNTcwLCJqdGkiOiJxQ0lfaGZCTTNaUnpVYlM1QWI1WnNRIn0.zfGtBG8gA-TmA_Gsy7LTZ6ZMUmP83jquHgUwMhY3reOsavn4yCOMC-5vYTKcS0WOilf9gnrQP66TMa0UKPheRmUyFRobsN4AecjuXKs9QYf6DkqqVEa3WD-ZF_76l3VYewfRwFaBdfPdRsQDmRR67bpzRBlfclPRouAap5D7MnYySsO1hfe8OdM2D5euduN5EfmIvCtvWsIcBxsEO9pb9Xt-tGnY4kI0EsXvsaMUmEEcvu3W4bLilRcd6bCskxs2PLb9KQKGXjrBf0Sr0MzYKFpbr1fezq44MQmhFo99vLBhKSZapuPxX0S9eMuH02lQHZGb-ZspkMn60Cpjc1zI0A",
+  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InByb2QtMjAyNi0wNS0wOC0xIn0.eyJjbGllbnRfaWQiOiJoZXJtZXMtY2xpIiwib3JnX2lkIjoibmFzX29yZ2FuaXNhdGlvbjo5MzdjNjYyNC1jNzEwLTQzMTEtOTkxMy05MDg2YTFiNjZlMzMiLCJlbWFpbCI6InRlYW1zaW92bkBnbWFpbC5jb20iLCJtYW5hZ2VkX3Rvb2xzIjpmYWxzZSwic2NvcGUiOiJpbmZlcmVuY2U6aW52b2tlIiwidG9rZW5fdXNlIjoiYWNjZXNzIiwib2F1dGhfY29udHJhY3RfdmVyc2lvbiI6MSwic2lkIjoic2lkX3A4T1hVTHFwQ2xuLVQ0STctYUVpbk81LSIsInByb2R1Y3RfaWQiOiJub3VzLWhlcm1lcy1hZ2VudCIsIm5vdXNfY2xpZW50IjoiaGVybWVzLWFnZW50IiwidG9vbF9nYXRld2F5X2FkbWluIjpmYWxzZSwicGFpZF9hY2Nlc3MiOmZhbHNlLCJwcml2YWN5X21vZGUiOiJzdGFuZGFyZCIsInBvbGljeV9wcmVzZW50IjpmYWxzZSwibWVtYmVyX3NwZW5kX2NhcF9leGNlZWRlZCI6ZmFsc2UsIm1lbWJlcl9zcGVuZF9jYXBfdXNkIjpudWxsLCJtZW1iZXJfc3BlbmRfdXNkIjoiMCIsIm1lbWJlcl9zcGVuZF9jYXBfcmVtYWluaW5nX3VzZCI6bnVsbCwibWVtYmVyX2Zyb250aWVyX3NwZW5kX2NhcF9leGNlZWRlZCI6ZmFsc2UsIm1lbWJlcl9mcm9udGllcl9zcGVuZF9jYXBfdXNkIjpudWxsLCJtZW1iZXJfZnJvbnRpZXJfc3BlbmRfdXNkIjoiMCIsIm1lbWJlcl9mcm9udGllcl9zcGVuZF9jYXBfcmVtYWluaW5nX3VzZCI6bnVsbCwidG9vbF9hY2Nlc3MiOnsiZW5hYmxlZCI6ZmFsc2UsImNvdmVyYWdlIjp7ImZpcmVjcmF3bCI6dHJ1ZSwiZmFsIjp0cnVlLCJmYWwtdmlkZW8iOmZhbHNlLCJvcGVuYWktYXVkaW8iOnRydWUsImJyb3dzZXItdXNlIjp0cnVlLCJtb2RhbCI6dHJ1ZSwia3JlYSI6ZmFsc2V9fSwicmF0ZV9saW1pdF9wcm9maWxlX2lkIjotMTIsInJhdGVfbGltaXRfcnBtIjo1MCwicmF0ZV9saW1pdF90cG0iOjUwMDAwMCwicmF0ZV9saW1pdF9ycGgiOjIxMDAsInJhdGVfbGltaXRfdHBoIjo2MDAwMDAwLCJyYXRlX2xpbWl0X3NvdXJjZSI6ImZyZWVfaGVybWVzX2FnZW50Iiwic3ViIjoibmFzX3VzZXI6ZTc1OTc3YTktMDRjYy00YmYzLTk0MTMtNzM0YTIxMmZhZjQ0IiwiaXNzIjoiaHR0cHM6Ly9wb3J0YWwubm91c3Jlc2VhcmNoLmNvbSIsImF1ZCI6Imhlcm1lcy1jbGk6aGVybWVzLWNsaSIsImlhdCI6MTc5MTI3MzYxNiwiZXhwIjoxNzkxMjc3MjE2LCJqdGkiOiJid29GMFROdGxSSHNXLVVPRDcwQ3pnIn0.wkEpdoQnKADOjDW5Zwj_yLRml_8WnDW-WrZn4FHDrx37o6H6ujm5QtN6OwFkjqFxbBWEI1y_4QfubZFdqRzl7f-ZvKllE1kMxLYsavo-Hhe8H2vfiG8dDNWIBFIKZ0PX_QT5JAiQQPatGpnBsdFING9AXDICiX-c6_a7Gt9KWDvBiqRCh0RHS6BUqCv97mgLqCC8WLJ99gEZ3zdoprITjHsanG-KV_FSUf4zlWpQs6_bBPTB1WvZvlseAmB02va5HLh9N-0CThOmDTQRVJp32KxYTcKyp-tt-5WDABzhvufBE6syCARirBswEo3yes3_BbQoInJSlJvrSyye3u5Ivw",
+  "refresh_token": "rt_gDn0-mNF0bY3aW86OpBSAakUcqWov-ORZd_X9gJCP4zCyqq6IEiPxZFIwDGUTSit",
   "client_id": "hermes-cli",
-  "expires_at": "2026-10-06T04:56:10+00:00",
-  "inference_base_url": "https://inference-api.nousresearch.com/v1",
-  "obtained_at": null,
   "portal_base_url": "https://portal.nousresearch.com",
-  "refresh_token": "rt_QDXhzkEOLxLhf3mYp4NnbJgIrzR3RQ5SEeWJdq6EvSQuhunPt_ADzHqFiQxAvL0N",
-  "scope": "inference:invoke",
+  "inference_base_url": "https://inference-api.nousresearch.com/v1",
   "token_type": "Bearer",
-  "updated_at": "2026-10-06T03:56:11.189668+00:00"
+  "scope": "inference:invoke",
+  "obtained_at": "2026-10-06T08:00:16.364298+00:00",
+  "expires_at": "2026-10-06T09:00:16+00:00",
+  "agent_key": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InByb2QtMjAyNi0wNS0wOC0xIn0.eyJjbGllbnRfaWQiOiJoZXJtZXMtY2xpIiwib3JnX2lkIjoibmFzX29yZ2FuaXNhdGlvbjo5MzdjNjYyNC1jNzEwLTQzMTEtOTkxMy05MDg2YTFiNjZlMzMiLCJlbWFpbCI6InRlYW1zaW92bkBnbWFpbC5jb20iLCJtYW5hZ2VkX3Rvb2xzIjpmYWxzZSwic2NvcGUiOiJpbmZlcmVuY2U6aW52b2tlIiwidG9rZW5fdXNlIjoiYWNjZXNzIiwib2F1dGhfY29udHJhY3RfdmVyc2lvbiI6MSwic2lkIjoic2lkX3A4T1hVTHFwQ2xuLVQ0STctYUVpbk81LSIsInByb2R1Y3RfaWQiOiJub3VzLWhlcm1lcy1hZ2VudCIsIm5vdXNfY2xpZW50IjoiaGVybWVzLWFnZW50IiwidG9vbF9nYXRld2F5X2FkbWluIjpmYWxzZSwicGFpZF9hY2Nlc3MiOmZhbHNlLCJwcml2YWN5X21vZGUiOiJzdGFuZGFyZCIsInBvbGljeV9wcmVzZW50IjpmYWxzZSwibWVtYmVyX3NwZW5kX2NhcF9leGNlZWRlZCI6ZmFsc2UsIm1lbWJlcl9zcGVuZF9jYXBfdXNkIjpudWxsLCJtZW1iZXJfc3BlbmRfdXNkIjoiMCIsIm1lbWJlcl9zcGVuZF9jYXBfcmVtYWluaW5nX3VzZCI6bnVsbCwibWVtYmVyX2Zyb250aWVyX3NwZW5kX2NhcF9leGNlZWRlZCI6ZmFsc2UsIm1lbWJlcl9mcm9udGllcl9zcGVuZF9jYXBfdXNkIjpudWxsLCJtZW1iZXJfZnJvbnRpZXJfc3BlbmRfdXNkIjoiMCIsIm1lbWJlcl9mcm9udGllcl9zcGVuZF9jYXBfcmVtYWluaW5nX3VzZCI6bnVsbCwidG9vbF9hY2Nlc3MiOnsiZW5hYmxlZCI6ZmFsc2UsImNvdmVyYWdlIjp7ImZpcmVjcmF3bCI6dHJ1ZSwiZmFsIjp0cnVlLCJmYWwtdmlkZW8iOmZhbHNlLCJvcGVuYWktYXVkaW8iOnRydWUsImJyb3dzZXItdXNlIjp0cnVlLCJtb2RhbCI6dHJ1ZSwia3JlYSI6ZmFsc2V9fSwicmF0ZV9saW1pdF9wcm9maWxlX2lkIjotMTIsInJhdGVfbGltaXRfcnBtIjo1MCwicmF0ZV9saW1pdF90cG0iOjUwMDAwMCwicmF0ZV9saW1pdF9ycGgiOjIxMDAsInJhdGVfbGltaXRfdHBoIjo2MDAwMDAwLCJyYXRlX2xpbWl0X3NvdXJjZSI6ImZyZWVfaGVybWVzX2FnZW50Iiwic3ViIjoibmFzX3VzZXI6ZTc1OTc3YTktMDRjYy00YmYzLTk0MTMtNzM0YTIxMmZhZjQ0IiwiaXNzIjoiaHR0cHM6Ly9wb3J0YWwubm91c3Jlc2VhcmNoLmNvbSIsImF1ZCI6Imhlcm1lcy1jbGk6aGVybWVzLWNsaSIsImlhdCI6MTc5MTI3MzYxNiwiZXhwIjoxNzkxMjc3MjE2LCJqdGkiOiJid29GMFROdGxSSHNXLVVPRDcwQ3pnIn0.wkEpdoQnKADOjDW5Zwj_yLRml_8WnDW-WrZn4FHDrx37o6H6ujm5QtN6OwFkjqFxbBWEI1y_4QfubZFdqRzl7f-ZvKllE1kMxLYsavo-Hhe8H2vfiG8dDNWIBFIKZ0PX_QT5JAiQQPatGpnBsdFING9AXDICiX-c6_a7Gt9KWDvBiqRCh0RHS6BUqCv97mgLqCC8WLJ99gEZ3zdoprITjHsanG-KV_FSUf4zlWpQs6_bBPTB1WvZvlseAmB02va5HLh9N-0CThOmDTQRVJp32KxYTcKyp-tt-5WDABzhvufBE6syCARirBswEo3yes3_BbQoInJSlJvrSyye3u5Ivw",
+  "agent_key_expires_at": "2026-10-06T09:00:16+00:00",
+  "tls": {
+    "insecure": false,
+    "ca_bundle": null
+  },
+  "expires_in": 3599,
+  "agent_key_id": null,
+  "agent_key_expires_in": 3599,
+  "agent_key_reused": false,
+  "agent_key_obtained_at": "2026-10-06T08:00:16.394580+00:00"
 }

requirements.txt

@@ -2,9 +2,24 @@ python-telegram-bot>=21.0
 requests
 psutil
 python-dotenv
-openai
+openai==2.24.0
 croniter
 pathspec
 rich
 ruamel.yaml
 fire
+# hermes-agent runtime deps (hermes itself is installed with --no-deps at
+# runtime because its Pillow==12.2.0 pin conflicts with gradio 5.x)
+prompt_toolkit
+Markdown
+PyJWT[crypto]
+cryptography
+websockets
+pyyaml
+tenacity
+httpx[socks]
+jinja2
+packaging
+python-multipart
+ptyprocess; sys_platform != "win32"
+concurrent-log-handler; sys_platform == "win32"