Files
hermes-agent/website/docs/reference/cli-commands.md
Teknium 8d59881a62 feat(auth): same-provider credential pools with rotation, custom endpoint support, and interactive CLI (#2647)
* feat(auth): add same-provider credential pools and rotation UX

Add same-provider credential pooling so Hermes can rotate across
multiple credentials for a single provider, recover from exhausted
credentials without jumping providers immediately, and configure
that behavior directly in hermes setup.

- agent/credential_pool.py: persisted per-provider credential pools
- hermes auth add/list/remove/reset CLI commands
- 429/402/401 recovery with pool rotation in run_agent.py
- Setup wizard integration for pool strategy configuration
- Auto-seeding from env vars and existing OAuth state

Co-authored-by: kshitijk4poor <82637225+kshitijk4poor@users.noreply.github.com>
Salvaged from PR #2647

* fix(tests): prevent pool auto-seeding from host env in credential pool tests

Tests for non-pool Anthropic paths and auth remove were failing when
host env vars (ANTHROPIC_API_KEY) or file-backed OAuth credentials
were present. The pool auto-seeding picked these up, causing unexpected
pool entries in tests.

- Mock _select_pool_entry in auxiliary_client OAuth flag tests
- Clear Anthropic env vars and mock _seed_from_singletons in auth remove test

* feat(auth): add thread safety, least_used strategy, and request counting

- Add threading.Lock to CredentialPool for gateway thread safety
  (concurrent requests from multiple gateway sessions could race on
  pool state mutations without this)
- Add 'least_used' rotation strategy that selects the credential
  with the lowest request_count, distributing load more evenly
- Add request_count field to PooledCredential for usage tracking
- Add mark_used() method to increment per-credential request counts
- Wrap select(), mark_exhausted_and_rotate(), and try_refresh_current()
  with lock acquisition
- Add tests: least_used selection, mark_used counting, concurrent
  thread safety (4 threads × 20 selects with no corruption)

* feat(auth): add interactive mode for bare 'hermes auth' command

When 'hermes auth' is called without a subcommand, it now launches an
interactive wizard that:

1. Shows full credential pool status across all providers
2. Offers a menu: add, remove, reset cooldowns, set strategy
3. For OAuth-capable providers (anthropic, nous, openai-codex), the
   add flow explicitly asks 'API key or OAuth login?' — making it
   clear that both auth types are supported for the same provider
4. Strategy picker shows all 4 options (fill_first, round_robin,
   least_used, random) with the current selection marked
5. Remove flow shows entries with indices for easy selection

The subcommand paths (hermes auth add/list/remove/reset) still work
exactly as before for scripted/non-interactive use.

* fix(tests): update runtime_provider tests for config.yaml source of truth (#4165)

Tests were using OPENAI_BASE_URL env var which is no longer consulted
after #4165. Updated to use model config (provider, base_url, api_key)
which is the new single source of truth for custom endpoint URLs.

* feat(auth): support custom endpoint credential pools keyed by provider name

Custom OpenAI-compatible endpoints all share provider='custom', making
the provider-keyed pool useless. Now pools for custom endpoints are
keyed by 'custom:<normalized_name>' where the name comes from the
custom_providers config list (auto-generated from URL hostname).

- Pool key format: 'custom:together.ai', 'custom:local-(localhost:8080)'
- load_pool('custom:name') seeds from custom_providers api_key AND
  model.api_key when base_url matches
- hermes auth add/list now shows custom endpoints alongside registry
  providers
- _resolve_openrouter_runtime and _resolve_named_custom_runtime check
  pool before falling back to single config key
- 6 new tests covering custom pool keying, seeding, and listing

* docs: add Excalidraw diagram of full credential pool flow

Comprehensive architecture diagram showing:
- Credential sources (env vars, auth.json OAuth, config.yaml, CLI)
- Pool storage and auto-seeding
- Runtime resolution paths (registry, custom, OpenRouter)
- Error recovery (429 retry-then-rotate, 402 immediate, 401 refresh)
- CLI management commands and strategy configuration

Open at: https://excalidraw.com/#json=2Ycqhqpi6f12E_3ITyiwh,c7u9jSt5BwrmiVzHGbm87g

* fix(tests): update setup wizard pool tests for unified select_provider_and_model flow

The setup wizard now delegates to select_provider_and_model() instead
of using its own prompt_choice-based provider picker. Tests needed:
- Mock select_provider_and_model as no-op (provider pre-written to config)
- Call _stub_tts BEFORE custom prompt_choice mock (it overwrites it)
- Pre-write model.provider to config so the pool step is reached

* docs: add comprehensive credential pool documentation

- New page: website/docs/user-guide/features/credential-pools.md
  Full guide covering quick start, CLI commands, rotation strategies,
  error recovery, custom endpoint pools, auto-discovery, thread safety,
  architecture, and storage format.
- Updated fallback-providers.md to reference credential pools as the
  first layer of resilience (same-provider rotation before cross-provider)
- Added hermes auth to CLI commands reference with usage examples
- Added credential_pool_strategies to configuration guide

* chore: remove excalidraw diagram from repo (external link only)

* refactor: simplify credential pool code — extract helpers, collapse extras, dedup patterns

- _load_config_safe(): replace 4 identical try/except/import blocks
- _iter_custom_providers(): shared generator for custom provider iteration
- PooledCredential.extra dict: collapse 11 round-trip-only fields
  (token_type, scope, client_id, portal_base_url, obtained_at,
  expires_in, agent_key_id, agent_key_expires_in, agent_key_reused,
  agent_key_obtained_at, tls) into a single extra dict with
  __getattr__ for backward-compatible access
- _available_entries(): shared exhaustion-check between select and peek
- Dedup anthropic OAuth seeding (hermes_pkce + claude_code identical)
- SimpleNamespace replaces class _Args boilerplate in auth_commands
- _try_resolve_from_custom_pool(): shared pool-check in runtime_provider

Net -17 lines. All 383 targeted tests pass.

---------

Co-authored-by: kshitijk4poor <82637225+kshitijk4poor@users.noreply.github.com>
2026-03-31 03:10:01 -07:00

22 KiB

sidebar_position, title, description
sidebar_position title description
1 CLI Commands Reference Authoritative reference for Hermes terminal commands and command families

CLI Commands Reference

This page covers the terminal commands you run from your shell.

For in-chat slash commands, see Slash Commands Reference.

Global entrypoint

hermes [global-options] <command> [subcommand/options]

Global options

Option Description
--version, -V Show version and exit.
--profile <name>, -p <name> Select which Hermes profile to use for this invocation. Overrides the sticky default set by hermes profile use.
--resume <session>, -r <session> Resume a previous session by ID or title.
--continue [name], -c [name] Resume the most recent session, or the most recent session matching a title.
--worktree, -w Start in an isolated git worktree for parallel-agent workflows.
--yolo Bypass dangerous-command approval prompts.
--pass-session-id Include the session ID in the agent's system prompt.

Top-level commands

Command Purpose
hermes chat Interactive or one-shot chat with the agent.
hermes model Interactively choose the default provider and model.
hermes gateway Run or manage the messaging gateway service.
hermes setup Interactive setup wizard for all or part of the configuration.
hermes whatsapp Configure and pair the WhatsApp bridge.
hermes login / logout Authenticate with OAuth-backed providers.
hermes auth Manage credential pools — add, list, remove, reset, set strategy.
hermes status Show agent, auth, and platform status.
hermes cron Inspect and tick the cron scheduler.
hermes webhook Manage dynamic webhook subscriptions for event-driven activation.
hermes doctor Diagnose config and dependency issues.
hermes config Show, edit, migrate, and query configuration files.
hermes pairing Approve or revoke messaging pairing codes.
hermes skills Browse, install, publish, audit, and configure skills.
hermes honcho Manage Honcho cross-session memory integration.
hermes acp Run Hermes as an ACP server for editor integration.
hermes mcp Manage MCP server configurations and run Hermes as an MCP server.
hermes plugins Manage Hermes Agent plugins (install, enable, disable, remove).
hermes tools Configure enabled tools per platform.
hermes sessions Browse, export, prune, rename, and delete sessions.
hermes insights Show token/cost/activity analytics.
hermes claw OpenClaw migration helpers.
hermes profile Manage profiles — multiple isolated Hermes instances.
hermes completion Print shell completion scripts (bash/zsh).
hermes version Show version information.
hermes update Pull latest code and reinstall dependencies.
hermes uninstall Remove Hermes from the system.

hermes chat

hermes chat [options]

Common options:

Option Description
-q, --query "..." One-shot, non-interactive prompt.
-m, --model <model> Override the model for this run.
-t, --toolsets <csv> Enable a comma-separated set of toolsets.
--provider <provider> Force a provider: auto, openrouter, nous, openai-codex, copilot-acp, copilot, anthropic, huggingface, zai, kimi-coding, minimax, minimax-cn, kilocode.
-s, --skills <name> Preload one or more skills for the session (can be repeated or comma-separated).
-v, --verbose Verbose output.
-Q, --quiet Programmatic mode: suppress banner/spinner/tool previews.
--resume <session> / --continue [name] Resume a session directly from chat.
--worktree Create an isolated git worktree for this run.
--checkpoints Enable filesystem checkpoints before destructive file changes.
--yolo Skip approval prompts.
--pass-session-id Pass the session ID into the system prompt.
--source <tag> Session source tag for filtering (default: cli). Use tool for third-party integrations that should not appear in user session lists.

Examples:

hermes
hermes chat -q "Summarize the latest PRs"
hermes chat --provider openrouter --model anthropic/claude-sonnet-4.6
hermes chat --toolsets web,terminal,skills
hermes chat --quiet -q "Return only JSON"
hermes chat --worktree -q "Review this repo and open a PR"

hermes model

Interactive provider + model selector.

hermes model

Use this when you want to:

  • switch default providers
  • log into OAuth-backed providers during model selection
  • pick from provider-specific model lists
  • configure a custom/self-hosted endpoint
  • save the new default into config

/model slash command (mid-session)

Switch models without leaving a session:

/model                              # Show current model and available options
/model claude-sonnet-4              # Switch model (auto-detects provider)
/model zai:glm-5                    # Switch provider and model
/model custom:qwen-2.5              # Use model on your custom endpoint
/model custom                       # Auto-detect model from custom endpoint
/model custom:local:qwen-2.5        # Use a named custom provider
/model openrouter:anthropic/claude-sonnet-4  # Switch back to cloud

Provider and base URL changes are persisted to config.yaml automatically. When switching away from a custom endpoint, the stale base URL is cleared to prevent it leaking into other providers.

hermes gateway

hermes gateway <subcommand>

Subcommands:

Subcommand Description
run Run the gateway in the foreground.
start Start the installed gateway service.
stop Stop the service.
restart Restart the service.
status Show service status.
install Install as a user service (systemd on Linux, launchd on macOS).
uninstall Remove the installed service.
setup Interactive messaging-platform setup.

hermes setup

hermes setup [model|terminal|gateway|tools|agent] [--non-interactive] [--reset]

Use the full wizard or jump into one section:

Section Description
model Provider and model setup.
terminal Terminal backend and sandbox setup.
gateway Messaging platform setup.
tools Enable/disable tools per platform.
agent Agent behavior settings.

Options:

Option Description
--non-interactive Use defaults / environment values without prompts.
--reset Reset configuration to defaults before setup.

hermes whatsapp

hermes whatsapp

Runs the WhatsApp pairing/setup flow, including mode selection and QR-code pairing.

hermes login / hermes logout

hermes login [--provider nous|openai-codex] [--portal-url ...] [--inference-url ...]
hermes logout [--provider nous|openai-codex]

login supports:

  • Nous Portal OAuth/device flow
  • OpenAI Codex OAuth/device flow

Useful options for login:

  • --no-browser
  • --timeout <seconds>
  • --ca-bundle <pem>
  • --insecure

hermes auth

Manage credential pools for same-provider key rotation. See Credential Pools for full documentation.

hermes auth                                              # Interactive wizard
hermes auth list                                         # Show all pools
hermes auth list openrouter                              # Show specific provider
hermes auth add openrouter --api-key sk-or-v1-xxx        # Add API key
hermes auth add anthropic --type oauth                   # Add OAuth credential
hermes auth remove openrouter 2                          # Remove by index
hermes auth reset openrouter                             # Clear cooldowns

Subcommands: add, list, remove, reset. When called with no subcommand, launches the interactive management wizard.

hermes status

hermes status [--all] [--deep]
Option Description
--all Show all details in a shareable redacted format.
--deep Run deeper checks that may take longer.

hermes cron

hermes cron <list|create|edit|pause|resume|run|remove|status|tick>
Subcommand Description
list Show scheduled jobs.
create / add Create a scheduled job from a prompt, optionally attaching one or more skills via repeated --skill.
edit Update a job's schedule, prompt, name, delivery, repeat count, or attached skills. Supports --clear-skills, --add-skill, and --remove-skill.
pause Pause a job without deleting it.
resume Resume a paused job and compute its next future run.
run Trigger a job on the next scheduler tick.
remove Delete a scheduled job.
status Check whether the cron scheduler is running.
tick Run due jobs once and exit.

hermes webhook

hermes webhook <subscribe|list|remove|test>

Manage dynamic webhook subscriptions for event-driven agent activation. Requires the webhook platform to be enabled in config — if not configured, prints setup instructions.

Subcommand Description
subscribe / add Create a webhook route. Returns the URL and HMAC secret to configure on your service.
list / ls Show all agent-created subscriptions.
remove / rm Delete a dynamic subscription. Static routes from config.yaml are not affected.
test Send a test POST to verify a subscription is working.

hermes webhook subscribe

hermes webhook subscribe <name> [options]
Option Description
--prompt Prompt template with {dot.notation} payload references.
--events Comma-separated event types to accept (e.g. issues,pull_request). Empty = all.
--description Human-readable description.
--skills Comma-separated skill names to load for the agent run.
--deliver Delivery target: log (default), telegram, discord, slack, github_comment.
--deliver-chat-id Target chat/channel ID for cross-platform delivery.
--secret Custom HMAC secret. Auto-generated if omitted.

Subscriptions persist to ~/.hermes/webhook_subscriptions.json and are hot-reloaded by the webhook adapter without a gateway restart.

hermes doctor

hermes doctor [--fix]
Option Description
--fix Attempt automatic repairs where possible.

hermes config

hermes config <subcommand>

Subcommands:

Subcommand Description
show Show current config values.
edit Open config.yaml in your editor.
set <key> <value> Set a config value.
path Print the config file path.
env-path Print the .env file path.
check Check for missing or stale config.
migrate Add newly introduced options interactively.

hermes pairing

hermes pairing <list|approve|revoke|clear-pending>
Subcommand Description
list Show pending and approved users.
approve <platform> <code> Approve a pairing code.
revoke <platform> <user-id> Revoke a user's access.
clear-pending Clear pending pairing codes.

hermes skills

hermes skills <subcommand>

Subcommands:

Subcommand Description
browse Paginated browser for skill registries.
search Search skill registries.
install Install a skill.
inspect Preview a skill without installing it.
list List installed skills.
check Check installed hub skills for upstream updates.
update Reinstall hub skills with upstream changes when available.
audit Re-scan installed hub skills.
uninstall Remove a hub-installed skill.
publish Publish a skill to a registry.
snapshot Export/import skill configurations.
tap Manage custom skill sources.
config Interactive enable/disable configuration for skills by platform.

Common examples:

hermes skills browse
hermes skills browse --source official
hermes skills search react --source skills-sh
hermes skills search https://mintlify.com/docs --source well-known
hermes skills inspect official/security/1password
hermes skills inspect skills-sh/vercel-labs/json-render/json-render-react
hermes skills install official/migration/openclaw-migration
hermes skills install skills-sh/anthropics/skills/pdf --force
hermes skills check
hermes skills update
hermes skills config

Notes:

  • --force can override non-dangerous policy blocks for third-party/community skills.
  • --force does not override a dangerous scan verdict.
  • --source skills-sh searches the public skills.sh directory.
  • --source well-known lets you point Hermes at a site exposing /.well-known/skills/index.json.

hermes honcho

hermes honcho <subcommand>

Subcommands:

Subcommand Description
setup Interactive Honcho setup wizard.
status Show current Honcho config and connection status.
sessions List known Honcho session mappings.
map Map the current directory to a Honcho session name.
peer Show or update peer names and dialectic reasoning level.
mode Show or set memory mode: hybrid, honcho, or local.
tokens Show or set token budgets for context and dialectic.
identity Seed or show the AI peer identity representation.
migrate Migration guide from openclaw-honcho to Hermes Honcho.

hermes acp

hermes acp

Starts Hermes as an ACP (Agent Client Protocol) stdio server for editor integration.

Related entrypoints:

hermes-acp
python -m acp_adapter

Install support first:

pip install -e '.[acp]'

See ACP Editor Integration and ACP Internals.

hermes mcp

hermes mcp <subcommand>

Manage MCP (Model Context Protocol) server configurations and run Hermes as an MCP server.

Subcommand Description
serve [-v|--verbose] Run Hermes as an MCP server — expose conversations to other agents.
add <name> [--url URL] [--command CMD] [--args ...] [--auth oauth|header] Add an MCP server with automatic tool discovery.
remove <name> (alias: rm) Remove an MCP server from config.
list (alias: ls) List configured MCP servers.
test <name> Test connection to an MCP server.
configure <name> (alias: config) Toggle tool selection for a server.

See MCP Config Reference, Use MCP with Hermes, and MCP Server Mode.

hermes plugins

hermes plugins [subcommand]

Manage Hermes Agent plugins. Running hermes plugins with no subcommand launches an interactive curses checklist to enable/disable installed plugins.

Subcommand Description
(none) Interactive toggle UI — enable/disable plugins with arrow keys and space.
install <identifier> [--force] Install a plugin from a Git URL or owner/repo.
update <name> Pull latest changes for an installed plugin.
remove <name> (aliases: rm, uninstall) Remove an installed plugin.
enable <name> Enable a disabled plugin.
disable <name> Disable a plugin without removing it.
list (alias: ls) List installed plugins with enabled/disabled status.

Disabled plugins are stored in config.yaml under plugins.disabled and skipped during loading.

See Plugins and Build a Hermes Plugin.

hermes tools

hermes tools [--summary]
Option Description
--summary Print the current enabled-tools summary and exit.

Without --summary, this launches the interactive per-platform tool configuration UI.

hermes sessions

hermes sessions <subcommand>

Subcommands:

Subcommand Description
list List recent sessions.
browse Interactive session picker with search and resume.
export <output> [--session-id ID] Export sessions to JSONL.
delete <session-id> Delete one session.
prune Delete old sessions.
stats Show session-store statistics.
rename <session-id> <title> Set or change a session title.

hermes insights

hermes insights [--days N] [--source platform]
Option Description
--days <n> Analyze the last n days (default: 30).
--source <platform> Filter by source such as cli, telegram, or discord.

hermes claw

hermes claw migrate [options]

Migrate your OpenClaw setup to Hermes. Reads from ~/.openclaw (or a custom path) and writes to ~/.hermes. Automatically detects legacy directory names (~/.clawdbot, ~/.moldbot) and config filenames (clawdbot.json, moldbot.json).

Option Description
--dry-run Preview what would be migrated without writing anything.
--preset <name> Migration preset: full (default, includes secrets) or user-data (excludes API keys).
--overwrite Overwrite existing Hermes files on conflicts (default: skip).
--migrate-secrets Include API keys in migration (enabled by default with --preset full).
--source <path> Custom OpenClaw directory (default: ~/.openclaw).
--workspace-target <path> Target directory for workspace instructions (AGENTS.md).
--skill-conflict <mode> Handle skill name collisions: skip (default), overwrite, or rename.
--yes Skip the confirmation prompt.

What gets migrated

The migration covers 30+ categories across persona, memory, skills, model providers, messaging platforms, agent behavior, session policies, MCP servers, TTS, and more. Items are either directly imported into Hermes equivalents or archived for manual review.

Directly imported: SOUL.md, MEMORY.md, USER.md, AGENTS.md, skills (4 source directories), default model, custom providers, MCP servers, messaging platform tokens and allowlists (Telegram, Discord, Slack, WhatsApp, Signal, Matrix, Mattermost), agent defaults (reasoning effort, compression, human delay, timezone, sandbox), session reset policies, approval rules, TTS config, browser settings, tool settings, exec timeout, command allowlist, gateway config, and API keys from 3 sources.

Archived for manual review: Cron jobs, plugins, hooks/webhooks, memory backend (QMD), skills registry config, UI/identity, logging, multi-agent setup, channel bindings, IDENTITY.md, TOOLS.md, HEARTBEAT.md, BOOTSTRAP.md.

API key resolution checks three sources in priority order: config values → ~/.openclaw/.envauth-profiles.json. All token fields handle plain strings, env templates (${VAR}), and SecretRef objects.

For the complete config key mapping, SecretRef handling details, and post-migration checklist, see the full migration guide.

Examples

# Preview what would be migrated
hermes claw migrate --dry-run

# Full migration including API keys
hermes claw migrate --preset full

# Migrate user data only (no secrets), overwrite conflicts
hermes claw migrate --preset user-data --overwrite

# Migrate from a custom OpenClaw path
hermes claw migrate --source /home/user/old-openclaw

hermes profile

hermes profile <subcommand>

Manage profiles — multiple isolated Hermes instances, each with its own config, sessions, skills, and home directory.

Subcommand Description
list List all profiles.
use <name> Set a sticky default profile.
create <name> [--clone] [--no-alias] Create a new profile. --clone copies config, .env, and SOUL.md from the active profile.
delete <name> [-y] Delete a profile.
show <name> Show profile details (home directory, config, etc.).
alias <name> [--remove] [--name NAME] Manage wrapper scripts for quick profile access.
rename <old> <new> Rename a profile.
export <name> [-o FILE] Export a profile to a .tar.gz archive.
import <archive> [--name NAME] Import a profile from a .tar.gz archive.

Examples:

hermes profile list
hermes profile create work --clone
hermes profile use work
hermes profile alias work --name h-work
hermes profile export work -o work-backup.tar.gz
hermes profile import work-backup.tar.gz --name restored
hermes -p work chat -q "Hello from work profile"

hermes completion

hermes completion [bash|zsh]

Print a shell completion script to stdout. Source the output in your shell profile for tab-completion of Hermes commands, subcommands, and profile names.

Examples:

# Bash
hermes completion bash >> ~/.bashrc

# Zsh
hermes completion zsh >> ~/.zshrc

Maintenance commands

Command Description
hermes version Print version information.
hermes update Pull latest changes and reinstall dependencies.
hermes uninstall [--full] [--yes] Remove Hermes, optionally deleting all config/data.

See also