ekko
747 lines
25 KiB
TypeScript
747 lines
25 KiB
TypeScript
import { createReadStream, existsSync, readFileSync, readdirSync, renameSync, rmSync, unlinkSync, writeFileSync } from 'fs'
|
||
import { mkdir, writeFile } from 'fs/promises'
|
||
import { basename, join } from 'path'
|
||
import { tmpdir } from 'os'
|
||
import { getWebUiHome } from '../../config'
|
||
import * as hermesCli from '../../services/hermes/hermes-cli'
|
||
import { SessionDeleter } from '../../services/hermes/session-deleter'
|
||
import { AgentBridgeClient } from '../../services/hermes/agent-bridge'
|
||
import {
|
||
getGatewayRuntimeStatusForProfile,
|
||
restartGatewayForProfile as restartGatewayRuntimeForProfile,
|
||
} from '../../services/hermes/gateway-autostart'
|
||
import { logger } from '../../services/logger'
|
||
import { smartCloneCleanup } from '../../services/hermes/profile-credentials'
|
||
import { detectHermesRootHome } from '../../services/hermes/hermes-path'
|
||
import { getActiveProfileName } from '../../services/hermes/hermes-profile'
|
||
import { HermesSkillInjector } from '../../services/hermes/skill-injector'
|
||
import type { HermesProfile } from '../../services/hermes/hermes-cli'
|
||
import { listUserProfiles } from '../../db/hermes/users-store'
|
||
|
||
const bridgeCleanupClient = () => new AgentBridgeClient({ connectRetryMs: 0, timeoutMs: 5000 })
|
||
|
||
interface ProfileAvatarMeta {
|
||
type: 'generated' | 'image'
|
||
seed?: string
|
||
file?: string
|
||
mime?: string
|
||
updatedAt?: number
|
||
}
|
||
|
||
interface ProfileAvatarResponse {
|
||
type: 'generated' | 'image'
|
||
seed?: string
|
||
dataUrl?: string
|
||
updatedAt?: number
|
||
}
|
||
|
||
const RESERVED_PROFILE_NAMES = new Set([
|
||
'hermes', 'default', 'test', 'tmp', 'root', 'sudo',
|
||
])
|
||
|
||
const HERMES_SUBCOMMAND_PROFILE_NAMES = new Set([
|
||
'chat', 'model', 'gateway', 'setup', 'whatsapp', 'login', 'logout',
|
||
'status', 'cron', 'doctor', 'dump', 'config', 'pairing', 'skills', 'tools',
|
||
'mcp', 'sessions', 'insights', 'version', 'update', 'uninstall',
|
||
'profile', 'plugins', 'honcho', 'acp',
|
||
])
|
||
|
||
function normalizeProfileName(name: string): string {
|
||
return String(name || '').trim().toLowerCase()
|
||
}
|
||
|
||
function isForbiddenProfileName(name: string): boolean {
|
||
const normalized = normalizeProfileName(name)
|
||
if (!normalized || normalized === 'default') return false
|
||
return RESERVED_PROFILE_NAMES.has(normalized) || HERMES_SUBCOMMAND_PROFILE_NAMES.has(normalized)
|
||
}
|
||
|
||
function getActiveProfileFile(): string {
|
||
return join(detectHermesRootHome(), 'active_profile')
|
||
}
|
||
|
||
function listProfilesFromDisk(activeProfileName: string): HermesProfile[] {
|
||
const base = detectHermesRootHome()
|
||
const profiles: HermesProfile[] = [{
|
||
name: 'default',
|
||
active: activeProfileName === 'default',
|
||
model: '—',
|
||
alias: '',
|
||
}]
|
||
const profilesDir = join(base, 'profiles')
|
||
if (!existsSync(profilesDir)) return profiles
|
||
for (const entry of readdirSync(profilesDir, { withFileTypes: true })) {
|
||
if (!entry.isDirectory()) continue
|
||
const name = entry.name
|
||
const dir = join(profilesDir, name)
|
||
if (!existsSync(join(dir, 'config.yaml')) && !existsSync(dir)) continue
|
||
profiles.push({
|
||
name,
|
||
active: name === activeProfileName,
|
||
model: '—',
|
||
alias: '',
|
||
})
|
||
}
|
||
return profiles
|
||
}
|
||
|
||
function profileExistsForManualSwitch(name: string): boolean {
|
||
const base = detectHermesRootHome()
|
||
if (!name || name === 'default') return true
|
||
return existsSync(join(base, 'profiles', name, 'config.yaml')) || existsSync(join(base, 'profiles', name))
|
||
}
|
||
|
||
async function injectBundledSkillsForProfile(name: string): Promise<void> {
|
||
try {
|
||
const targetDir = HermesSkillInjector.resolveTargetDirForProfile(name)
|
||
const result = await new HermesSkillInjector(undefined, targetDir).injectMissingSkills()
|
||
const target = result.targets[0]
|
||
if (target && (target.injected.length > 0 || target.updated.length > 0)) {
|
||
logger.info({
|
||
profile: name,
|
||
targetDir,
|
||
injected: target.injected,
|
||
updated: target.updated,
|
||
}, '[profiles] synced bundled skills for profile')
|
||
}
|
||
} catch (err: any) {
|
||
logger.warn(err, '[profiles] failed to sync bundled skills for profile "%s"', name)
|
||
}
|
||
}
|
||
|
||
function deleteForbiddenProfileFromDisk(name: string): boolean {
|
||
if (!isForbiddenProfileName(name)) return false
|
||
const base = detectHermesRootHome()
|
||
const profileDir = join(base, 'profiles', name)
|
||
if (!existsSync(profileDir)) return false
|
||
rmSync(profileDir, { recursive: true, force: true })
|
||
try {
|
||
if (normalizeProfileName(getActiveProfileName()) === normalizeProfileName(name)) {
|
||
writeFileSync(getActiveProfileFile(), 'default\n', 'utf-8')
|
||
}
|
||
} catch {}
|
||
logger.warn('[deleteProfile] removed reserved profile "%s" from disk after Hermes CLI rejected deletion', name)
|
||
return true
|
||
}
|
||
|
||
function filterVisibleProfiles(profiles: HermesProfile[]): HermesProfile[] {
|
||
return profiles.filter(profile => !isForbiddenProfileName(profile.name))
|
||
}
|
||
|
||
function requestedProfileName(ctx: any): string {
|
||
return ctx.state?.profile?.name || ctx.get?.('x-hermes-profile') || getActiveProfileName()
|
||
}
|
||
|
||
function filterProfilesForUser(ctx: any, profiles: HermesProfile[]): HermesProfile[] {
|
||
const user = ctx.state?.user
|
||
if (!user || user.role === 'super_admin') return profiles
|
||
const allowed = new Set(listUserProfiles(user.id).map(profile => profile.profile_name))
|
||
return profiles.filter(profile => allowed.has(profile.name))
|
||
}
|
||
|
||
function canAccessProfile(ctx: any, profileName: string): boolean {
|
||
const user = ctx.state?.user
|
||
if (!user || user.role === 'super_admin') return true
|
||
return listUserProfiles(user.id).some(profile => profile.profile_name === profileName)
|
||
}
|
||
|
||
function denyProfile(ctx: any, profileName: string): boolean {
|
||
if (canAccessProfile(ctx, profileName)) return false
|
||
ctx.status = 403
|
||
ctx.body = { error: `Profile "${profileName}" is not available for this user` }
|
||
return true
|
||
}
|
||
|
||
function profileMetadataRoot(): string {
|
||
return join(getWebUiHome(), 'profile-metadata')
|
||
}
|
||
|
||
function profileMetadataDir(name: string): string {
|
||
const segment = Buffer.from(name || 'default', 'utf-8').toString('base64url')
|
||
return join(profileMetadataRoot(), segment)
|
||
}
|
||
|
||
function profileAvatarMetaPath(name: string): string {
|
||
return join(profileMetadataDir(name), 'avatar.json')
|
||
}
|
||
|
||
function profileAvatarImagePath(name: string, file = 'avatar.bin'): string {
|
||
return join(profileMetadataDir(name), file)
|
||
}
|
||
|
||
function readProfileAvatar(name: string): ProfileAvatarResponse | null {
|
||
const metaPath = profileAvatarMetaPath(name)
|
||
if (!existsSync(metaPath)) return null
|
||
try {
|
||
const meta = JSON.parse(readFileSync(metaPath, 'utf-8')) as ProfileAvatarMeta
|
||
if (meta.type === 'generated') {
|
||
return {
|
||
type: 'generated',
|
||
seed: typeof meta.seed === 'string' ? meta.seed : name,
|
||
updatedAt: meta.updatedAt,
|
||
}
|
||
}
|
||
if (meta.type === 'image' && meta.file && meta.mime) {
|
||
const imagePath = profileAvatarImagePath(name, meta.file)
|
||
if (!existsSync(imagePath)) return null
|
||
const data = readFileSync(imagePath).toString('base64')
|
||
return {
|
||
type: 'image',
|
||
dataUrl: `data:${meta.mime};base64,${data}`,
|
||
updatedAt: meta.updatedAt,
|
||
}
|
||
}
|
||
} catch (err) {
|
||
logger.warn(err, '[profiles] failed to read avatar metadata for profile "%s"', name)
|
||
}
|
||
return null
|
||
}
|
||
|
||
function attachProfileAvatars<T extends HermesProfile>(profiles: T[]): Array<T & { avatar: ProfileAvatarResponse | null }> {
|
||
return profiles.map(profile => ({
|
||
...profile,
|
||
avatar: readProfileAvatar(profile.name),
|
||
}))
|
||
}
|
||
|
||
function parseAvatarDataUrl(dataUrl: string): { mime: string; buffer: Buffer } {
|
||
const match = dataUrl.match(/^data:(image\/(?:png|jpeg|webp));base64,([a-zA-Z0-9+/=]+)$/)
|
||
if (!match) throw new Error('Avatar image must be a PNG, JPEG, or WebP data URL')
|
||
const buffer = Buffer.from(match[2], 'base64')
|
||
if (buffer.length > 1024 * 1024) throw new Error('Avatar image must be 1MB or smaller')
|
||
return { mime: match[1], buffer }
|
||
}
|
||
|
||
function removeProfileMetadata(name: string): void {
|
||
rmSync(profileMetadataDir(name), { recursive: true, force: true })
|
||
}
|
||
|
||
function renameProfileMetadata(oldName: string, newName: string): void {
|
||
const oldDir = profileMetadataDir(oldName)
|
||
const newDir = profileMetadataDir(newName)
|
||
if (!existsSync(oldDir) || oldDir === newDir) return
|
||
rmSync(newDir, { recursive: true, force: true })
|
||
renameSync(oldDir, newDir)
|
||
}
|
||
|
||
async function useProfileWithFallback(name: string): Promise<string> {
|
||
if (isForbiddenProfileName(name)) {
|
||
throw new Error(`Profile name '${name}' is reserved and cannot be activated`)
|
||
}
|
||
try {
|
||
return await hermesCli.useProfile(name)
|
||
} catch (err: any) {
|
||
if (!profileExistsForManualSwitch(name)) throw err
|
||
|
||
const base = detectHermesRootHome()
|
||
writeFileSync(join(base, 'active_profile'), `${name}\n`, 'utf-8')
|
||
logger.warn(err, '[switchProfile] hermes profile use failed; wrote active_profile directly for existing profile "%s"', name)
|
||
return `Switched to profile ${name}`
|
||
}
|
||
}
|
||
|
||
async function readBridgeWorkers(): Promise<{ reachable: boolean; workers: Record<string, boolean>; error?: string }> {
|
||
try {
|
||
const result = await new AgentBridgeClient({ timeoutMs: 5000 }).ping()
|
||
return {
|
||
reachable: true,
|
||
workers: ((result as any).workers || {}) as Record<string, boolean>,
|
||
}
|
||
} catch (err: any) {
|
||
return {
|
||
reachable: false,
|
||
workers: {},
|
||
error: err?.message || 'Bridge broker is not reachable',
|
||
}
|
||
}
|
||
}
|
||
|
||
function gatewayStatusLooksRunning(status?: string): boolean {
|
||
const normalized = String(status || '').trim().toLowerCase()
|
||
if (!normalized || normalized === '—') return false
|
||
if (normalized.includes('not running') || normalized === 'stopped' || normalized === 'stop') return false
|
||
return normalized.includes('running') || normalized === 'active'
|
||
}
|
||
|
||
async function buildRuntimeStatus(profile: HermesProfile | string, bridgeState?: Awaited<ReturnType<typeof readBridgeWorkers>>) {
|
||
const name = typeof profile === 'string' ? profile : profile.name
|
||
const bridge = bridgeState || await readBridgeWorkers()
|
||
let gateway: { running: boolean; profile: string; error?: string }
|
||
if (typeof profile !== 'string' && profile.gatewayStatus !== undefined) {
|
||
const profileListRunning = gatewayStatusLooksRunning(profile.gatewayStatus)
|
||
if (profileListRunning) {
|
||
gateway = {
|
||
running: true,
|
||
profile: name,
|
||
}
|
||
} else {
|
||
try {
|
||
gateway = await getGatewayRuntimeStatusForProfile(name)
|
||
} catch (err: any) {
|
||
gateway = {
|
||
running: false,
|
||
profile: name,
|
||
error: err?.message || 'Gateway status check failed',
|
||
}
|
||
}
|
||
}
|
||
} else {
|
||
try {
|
||
gateway = await getGatewayRuntimeStatusForProfile(name)
|
||
} catch (err: any) {
|
||
gateway = {
|
||
running: false,
|
||
profile: name,
|
||
error: err?.message || 'Gateway status check failed',
|
||
}
|
||
}
|
||
}
|
||
|
||
return {
|
||
profile: name,
|
||
bridge: {
|
||
running: !!bridge.workers[name],
|
||
profile: name,
|
||
reachable: bridge.reachable,
|
||
error: bridge.reachable ? undefined : bridge.error,
|
||
},
|
||
gateway,
|
||
}
|
||
}
|
||
|
||
export async function list(ctx: any) {
|
||
try {
|
||
let profiles: HermesProfile[]
|
||
try {
|
||
profiles = await hermesCli.listProfiles()
|
||
} catch (err: any) {
|
||
const { getActiveProfileName } = await import('../../services/hermes/hermes-profile')
|
||
const activeProfileName = getActiveProfileName()
|
||
if (!isForbiddenProfileName(activeProfileName)) throw err
|
||
|
||
logger.warn(err, '[listProfiles] active_profile "%s" is invalid/reserved; resetting to default and listing profiles from disk', activeProfileName)
|
||
writeFileSync(getActiveProfileFile(), 'default\n', 'utf-8')
|
||
profiles = listProfilesFromDisk('default')
|
||
}
|
||
|
||
const activeProfileName = requestedProfileName(ctx)
|
||
|
||
profiles = filterVisibleProfiles(profiles)
|
||
profiles = filterProfilesForUser(ctx, profiles)
|
||
|
||
// Web UI active profile is request-scoped and comes from X-Hermes-Profile.
|
||
profiles.forEach(p => {
|
||
p.active = (p.name === activeProfileName)
|
||
})
|
||
|
||
ctx.body = { profiles: attachProfileAvatars(profiles) }
|
||
} catch (err: any) {
|
||
ctx.status = 500
|
||
ctx.body = { error: err.message }
|
||
}
|
||
}
|
||
|
||
export async function create(ctx: any) {
|
||
const { name, clone } = ctx.request.body as { name?: string; clone?: boolean }
|
||
if (!name) {
|
||
ctx.status = 400
|
||
ctx.body = { error: 'Missing profile name' }
|
||
return
|
||
}
|
||
if (isForbiddenProfileName(name)) {
|
||
ctx.status = 400
|
||
ctx.body = { error: `Profile name '${name}' is reserved and cannot be created` }
|
||
return
|
||
}
|
||
try {
|
||
const output = await hermesCli.createProfile(name, clone)
|
||
|
||
// clone=true 时执行智能清理：
|
||
// - 删除 .env 中的独占平台凭据（Weixin / Telegram / Slack / ...）
|
||
// - 禁用 config.yaml 中对应的平台节点
|
||
// 避免新 profile 与源 profile 共享同一个 bot token 导致互斥冲突。
|
||
let strippedCredentials: string[] = []
|
||
let disabledPlatforms: string[] = []
|
||
let strippedConfigCredentials: string[] = []
|
||
if (clone) {
|
||
try {
|
||
const cleanup = smartCloneCleanup(name)
|
||
strippedCredentials = cleanup.strippedCredentials
|
||
disabledPlatforms = cleanup.disabledPlatforms
|
||
strippedConfigCredentials = cleanup.strippedConfigCredentials
|
||
if (
|
||
strippedCredentials.length > 0 ||
|
||
disabledPlatforms.length > 0 ||
|
||
strippedConfigCredentials.length > 0
|
||
) {
|
||
logger.info(
|
||
'Smart clone cleanup for "%s": stripped %d env credentials (%s), disabled %d platforms (%s), stripped %d config credentials (%s)',
|
||
name,
|
||
strippedCredentials.length, strippedCredentials.join(','),
|
||
disabledPlatforms.length, disabledPlatforms.join(','),
|
||
strippedConfigCredentials.length, strippedConfigCredentials.join(','),
|
||
)
|
||
}
|
||
} catch (err: any) {
|
||
// 清理失败不应阻断 profile 创建，仅记日志
|
||
logger.error(err, 'Smart clone cleanup failed for "%s"', name)
|
||
}
|
||
}
|
||
|
||
await injectBundledSkillsForProfile(name)
|
||
|
||
ctx.body = {
|
||
success: true,
|
||
message: output.trim(),
|
||
strippedCredentials,
|
||
disabledPlatforms,
|
||
strippedConfigCredentials,
|
||
}
|
||
} catch (err: any) {
|
||
ctx.status = 500
|
||
ctx.body = { error: err.message }
|
||
}
|
||
}
|
||
|
||
export async function get(ctx: any) {
|
||
const name = String(ctx.params.name || '').trim() || 'default'
|
||
if (denyProfile(ctx, name)) return
|
||
try {
|
||
const profile = await hermesCli.getProfile(name)
|
||
ctx.body = { profile: { ...profile, avatar: readProfileAvatar(profile.name) } }
|
||
} catch (err: any) {
|
||
ctx.status = err.message.includes('not found') ? 404 : 500
|
||
ctx.body = { error: err.message }
|
||
}
|
||
}
|
||
|
||
export async function updateAvatar(ctx: any) {
|
||
const name = String(ctx.params.name || '').trim() || 'default'
|
||
if (denyProfile(ctx, name)) return
|
||
if (isForbiddenProfileName(name)) {
|
||
ctx.status = 400
|
||
ctx.body = { error: `Profile name '${name}' is reserved` }
|
||
return
|
||
}
|
||
const body = ctx.request.body as { type?: string; seed?: string; dataUrl?: string }
|
||
try {
|
||
const dir = profileMetadataDir(name)
|
||
await mkdir(dir, { recursive: true })
|
||
const updatedAt = Date.now()
|
||
|
||
if (body.type === 'generated') {
|
||
const seed = String(body.seed || name).trim() || name
|
||
const meta: ProfileAvatarMeta = { type: 'generated', seed, updatedAt }
|
||
rmSync(profileAvatarImagePath(name), { force: true })
|
||
await writeFile(profileAvatarMetaPath(name), JSON.stringify(meta, null, 2) + '\n', { mode: 0o600 })
|
||
ctx.body = { avatar: readProfileAvatar(name) }
|
||
return
|
||
}
|
||
|
||
if (body.type === 'image' && typeof body.dataUrl === 'string') {
|
||
const { mime, buffer } = parseAvatarDataUrl(body.dataUrl)
|
||
const meta: ProfileAvatarMeta = { type: 'image', file: 'avatar.bin', mime, updatedAt }
|
||
await writeFile(profileAvatarImagePath(name), buffer, { mode: 0o600 })
|
||
await writeFile(profileAvatarMetaPath(name), JSON.stringify(meta, null, 2) + '\n', { mode: 0o600 })
|
||
ctx.body = { avatar: readProfileAvatar(name) }
|
||
return
|
||
}
|
||
|
||
ctx.status = 400
|
||
ctx.body = { error: 'Invalid avatar payload' }
|
||
} catch (err: any) {
|
||
ctx.status = 400
|
||
ctx.body = { error: err.message }
|
||
}
|
||
}
|
||
|
||
export async function deleteAvatar(ctx: any) {
|
||
const name = String(ctx.params.name || '').trim() || 'default'
|
||
if (denyProfile(ctx, name)) return
|
||
try {
|
||
removeProfileMetadata(name)
|
||
ctx.body = { success: true }
|
||
} catch (err: any) {
|
||
ctx.status = 500
|
||
ctx.body = { error: err.message }
|
||
}
|
||
}
|
||
|
||
export async function runtimeStatus(ctx: any) {
|
||
const name = String(ctx.params.name || '').trim() || 'default'
|
||
if (denyProfile(ctx, name)) return
|
||
if (isForbiddenProfileName(name)) {
|
||
ctx.status = 400
|
||
ctx.body = { error: `Profile name '${name}' is reserved` }
|
||
return
|
||
}
|
||
try {
|
||
const profiles = await listProfilesForStatus()
|
||
const profile = profiles.find(item => item.name === name)
|
||
ctx.body = await buildRuntimeStatus(profile || name)
|
||
} catch {
|
||
ctx.body = await buildRuntimeStatus(name)
|
||
}
|
||
}
|
||
|
||
export async function runtimeStatuses(ctx: any) {
|
||
try {
|
||
const profiles = filterProfilesForUser(ctx, await listProfilesForStatus())
|
||
const bridge = await readBridgeWorkers()
|
||
const statuses = await Promise.all(profiles.map(profile => buildRuntimeStatus(profile, bridge)))
|
||
ctx.body = { profiles: statuses }
|
||
} catch (err: any) {
|
||
ctx.status = 500
|
||
ctx.body = { error: err.message }
|
||
}
|
||
}
|
||
|
||
async function listProfilesForStatus(): Promise<HermesProfile[]> {
|
||
let profiles: HermesProfile[]
|
||
try {
|
||
profiles = await hermesCli.listProfiles()
|
||
} catch {
|
||
profiles = listProfilesFromDisk(getActiveProfileName())
|
||
}
|
||
return filterVisibleProfiles(profiles)
|
||
}
|
||
|
||
export async function restartGatewayForProfile(ctx: any) {
|
||
const name = String(ctx.params.name || '').trim() || 'default'
|
||
if (denyProfile(ctx, name)) return
|
||
if (isForbiddenProfileName(name)) {
|
||
ctx.status = 400
|
||
ctx.body = { error: `Profile name '${name}' is reserved` }
|
||
return
|
||
}
|
||
try {
|
||
const gateway = await restartGatewayRuntimeForProfile(name)
|
||
try {
|
||
const result = await bridgeCleanupClient().destroyProfile(name)
|
||
logger.info('[profiles] destroyed bridge sessions after gateway restart profile=%s destroyed=%s', name, result.destroyed)
|
||
} catch (err) {
|
||
logger.warn(err, '[profiles] failed to destroy bridge sessions after gateway restart profile=%s', name)
|
||
}
|
||
ctx.body = { success: true, gateway }
|
||
} catch (err: any) {
|
||
ctx.status = 500
|
||
ctx.body = { error: err.message }
|
||
}
|
||
}
|
||
|
||
export async function restartProfileRuntime(ctx: any) {
|
||
const name = String(ctx.params.name || '').trim() || 'default'
|
||
if (denyProfile(ctx, name)) return
|
||
if (isForbiddenProfileName(name)) {
|
||
ctx.status = 400
|
||
ctx.body = { error: `Profile name '${name}' is reserved` }
|
||
return
|
||
}
|
||
try {
|
||
const result = await bridgeCleanupClient().destroyProfile(name)
|
||
logger.info('[profiles] destroyed bridge sessions after profile restart profile=%s destroyed=%s', name, result.destroyed)
|
||
const profiles = await listProfilesForStatus()
|
||
const profile = profiles.find(item => item.name === name)
|
||
ctx.body = {
|
||
success: true,
|
||
destroyed: result.destroyed,
|
||
status: await buildRuntimeStatus(profile || name),
|
||
}
|
||
} catch (err: any) {
|
||
ctx.status = 500
|
||
ctx.body = { error: err.message }
|
||
}
|
||
}
|
||
|
||
export async function remove(ctx: any) {
|
||
const { name } = ctx.params
|
||
if (denyProfile(ctx, name)) return
|
||
if (name === 'default') {
|
||
ctx.status = 400
|
||
ctx.body = { error: 'Cannot delete the default profile' }
|
||
return
|
||
}
|
||
try {
|
||
try {
|
||
const result = await bridgeCleanupClient().destroyProfile(name)
|
||
logger.info('[profiles] destroyed bridge sessions for deleted profile "%s" destroyed=%s', name, result.destroyed)
|
||
} catch (err) {
|
||
logger.warn(err, '[profiles] failed to destroy bridge sessions for deleted profile "%s"', name)
|
||
}
|
||
const ok = await hermesCli.deleteProfile(name)
|
||
if (ok) {
|
||
removeProfileMetadata(name)
|
||
ctx.body = { success: true }
|
||
} else if (deleteForbiddenProfileFromDisk(name)) {
|
||
removeProfileMetadata(name)
|
||
ctx.body = { success: true, fallback: 'removed_reserved_profile_from_disk' }
|
||
} else {
|
||
ctx.status = 500
|
||
ctx.body = { error: 'Failed to delete profile' }
|
||
}
|
||
} catch (err: any) {
|
||
ctx.status = 500
|
||
ctx.body = { error: err.message }
|
||
}
|
||
}
|
||
|
||
export async function rename(ctx: any) {
|
||
if (denyProfile(ctx, ctx.params.name)) return
|
||
const { new_name } = ctx.request.body as { new_name?: string }
|
||
if (!new_name) {
|
||
ctx.status = 400
|
||
ctx.body = { error: 'Missing new_name' }
|
||
return
|
||
}
|
||
try {
|
||
const ok = await hermesCli.renameProfile(ctx.params.name, new_name)
|
||
if (ok) {
|
||
renameProfileMetadata(ctx.params.name, new_name)
|
||
ctx.body = { success: true }
|
||
} else {
|
||
ctx.status = 500
|
||
ctx.body = { error: 'Failed to rename profile' }
|
||
}
|
||
} catch (err: any) {
|
||
ctx.status = 500
|
||
ctx.body = { error: err.message }
|
||
}
|
||
}
|
||
|
||
export async function switchProfile(ctx: any) {
|
||
const { name } = ctx.request.body as { name?: string }
|
||
if (!name) {
|
||
ctx.status = 400
|
||
ctx.body = { error: 'Missing profile name' }
|
||
return
|
||
}
|
||
if (isForbiddenProfileName(name)) {
|
||
ctx.status = 400
|
||
ctx.body = { error: `Profile name '${name}' is reserved and cannot be activated` }
|
||
return
|
||
}
|
||
try {
|
||
if (denyProfile(ctx, name)) return
|
||
|
||
const output = await useProfileWithFallback(name)
|
||
|
||
const actualActive = getActiveProfileName()
|
||
if (actualActive !== name) {
|
||
ctx.status = 500
|
||
ctx.body = { error: `Profile switch verification failed - active profile is ${actualActive}` }
|
||
return
|
||
}
|
||
|
||
try {
|
||
const result = await bridgeCleanupClient().destroyProfile(name)
|
||
logger.info('[switchProfile] destroyed bridge sessions for Hermes profile "%s" destroyed=%s', name, result.destroyed)
|
||
} catch (err: any) {
|
||
logger.warn(err, '[switchProfile] failed to destroy bridge sessions for profile "%s"', name)
|
||
}
|
||
|
||
try {
|
||
const detail = await hermesCli.getProfile(name)
|
||
logger.debug('Profile detail.path = %s', detail.path)
|
||
|
||
const profileConfig = join(detail.path, 'config.yaml')
|
||
if (!existsSync(profileConfig)) {
|
||
writeFileSync(profileConfig, '# Hermes Agent Configuration\n', 'utf-8')
|
||
logger.info('Created config.yaml for: %s', detail.path)
|
||
}
|
||
|
||
const profileEnv = join(detail.path, '.env')
|
||
if (!existsSync(profileEnv)) {
|
||
writeFileSync(profileEnv, '# Hermes Agent Environment Configuration\n', 'utf-8')
|
||
logger.info('Created .env for: %s', detail.path)
|
||
}
|
||
} catch (err: any) {
|
||
logger.error(err, 'Ensure config failed')
|
||
}
|
||
|
||
await injectBundledSkillsForProfile(name)
|
||
SessionDeleter.getInstance().switchProfile(name)
|
||
logger.info('[switchProfile] switched session deleter to Hermes profile "%s"', name)
|
||
|
||
ctx.body = {
|
||
success: true,
|
||
message: output.trim(),
|
||
active: name,
|
||
}
|
||
} catch (err: any) {
|
||
ctx.status = 500
|
||
ctx.body = { error: err.message }
|
||
}
|
||
}
|
||
|
||
export async function exportProfile(ctx: any) {
|
||
const { name } = ctx.params
|
||
if (denyProfile(ctx, name)) return
|
||
const outputPath = join(tmpdir(), `hermes-profile-${name}.tar.gz`)
|
||
try {
|
||
await hermesCli.exportProfile(name, outputPath)
|
||
if (!existsSync(outputPath)) {
|
||
ctx.status = 500
|
||
ctx.body = { error: 'Export file not found' }
|
||
return
|
||
}
|
||
const filename = basename(outputPath)
|
||
ctx.set('Content-Disposition', `attachment; filename="${filename}"`)
|
||
ctx.set('Content-Type', 'application/gzip')
|
||
ctx.body = createReadStream(outputPath)
|
||
ctx.res.on('finish', () => { try { unlinkSync(outputPath) } catch { } })
|
||
} catch (err: any) {
|
||
ctx.status = 500
|
||
ctx.body = { error: err.message }
|
||
}
|
||
}
|
||
|
||
export async function importProfile(ctx: any) {
|
||
const contentType = ctx.get('content-type') || ''
|
||
if (!contentType.startsWith('multipart/form-data')) {
|
||
ctx.status = 400
|
||
ctx.body = { error: 'Expected multipart/form-data' }
|
||
return
|
||
}
|
||
const boundary = '--' + contentType.split('boundary=')[1]
|
||
if (!boundary || boundary === '--undefined') {
|
||
ctx.status = 400
|
||
ctx.body = { error: 'Missing boundary' }
|
||
return
|
||
}
|
||
const tmpDir = join(tmpdir(), 'hermes-import')
|
||
await mkdir(tmpDir, { recursive: true })
|
||
const chunks: Buffer[] = []
|
||
for await (const chunk of ctx.req) chunks.push(chunk)
|
||
const body = Buffer.concat(chunks).toString('latin1')
|
||
const parts = body.split(boundary).slice(1, -1)
|
||
let archivePath = ''
|
||
for (const part of parts) {
|
||
const headerEnd = part.indexOf('\r\n\r\n')
|
||
if (headerEnd === -1) continue
|
||
const header = part.substring(0, headerEnd)
|
||
const data = part.substring(headerEnd + 4, part.length - 2)
|
||
const filenameMatch = header.match(/filename="([^"]+)"/)
|
||
if (!filenameMatch) continue
|
||
const filename = filenameMatch[1]
|
||
const ext = filename.includes('.') ? '.' + filename.split('.').pop() : ''
|
||
if (!['.gz', '.tar.gz', '.zip', '.tgz'].includes(ext)) continue
|
||
archivePath = join(tmpDir, filename)
|
||
await writeFile(archivePath, Buffer.from(data, 'binary'))
|
||
break
|
||
}
|
||
if (!archivePath) {
|
||
ctx.status = 400
|
||
ctx.body = { error: 'No archive file found (.gz, .zip, .tgz)' }
|
||
return
|
||
}
|
||
try {
|
||
const result = await hermesCli.importProfile(archivePath)
|
||
try { unlinkSync(archivePath) } catch { }
|
||
ctx.body = { success: true, message: result.trim() }
|
||
} catch (err: any) {
|
||
try { unlinkSync(archivePath) } catch { }
|
||
ctx.status = 500
|
||
ctx.body = { error: err.message }
|
||
}
|
||
}
|