Add hermesagent (ct)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

CHANGELOG.md

@@ -467,6 +467,46 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-05-27
+
+### 💾 Core
+
+  - #### 🐞 Bug Fixes
+
+    - [tools.func]: `setup_gs()` fix getting dotted release format [@tremor021](https://github.com/tremor021) ([#14745](https://github.com/community-scripts/ProxmoxVE/pull/14745))
+
+## 2026-05-26
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Add directory creation to Profilarr update script [@ryansully](https://github.com/ryansully) ([#14740](https://github.com/community-scripts/ProxmoxVE/pull/14740))
+    - profilarr: Fix ARCH assignment in profilarr.sh to support Profilarr build usage [@mpeleshenko](https://github.com/mpeleshenko) ([#14709](https://github.com/community-scripts/ProxmoxVE/pull/14709))
+    - Jackett: Remove quotes in Service File [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#14729](https://github.com/community-scripts/ProxmoxVE/pull/14729))
+    - Open-archiver: approve pnpm build scripts and run build:oss without subshell [@MickLesk](https://github.com/MickLesk) ([#14711](https://github.com/community-scripts/ProxmoxVE/pull/14711))
+    - Docuseal: read Ruby version from Gemfile, upgrade on update if needed [@MickLesk](https://github.com/MickLesk) ([#14715](https://github.com/community-scripts/ProxmoxVE/pull/14715))
+
+  - #### ✨ New Features
+
+    - Birdnet-GO: install libonnxruntime.so from release tarball [@MickLesk](https://github.com/MickLesk) ([#14716](https://github.com/community-scripts/ProxmoxVE/pull/14716))
+
+### 💾 Core
+
+  - #### ✨ New Features
+
+    - tools.func: better error diagnostics, consistent OS detection, setup function ordering [@MickLesk](https://github.com/MickLesk) ([#14692](https://github.com/community-scripts/ProxmoxVE/pull/14692))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - IPTag-Tool: use qm set for VM tags to handle snapshot sections crrectly [@MickLesk](https://github.com/MickLesk) ([#14713](https://github.com/community-scripts/ProxmoxVE/pull/14713))
+
+  - #### ✨ New Features
+
+    - Netdata: extend PVE version support to 9.x [@MickLesk](https://github.com/MickLesk) ([#14714](https://github.com/community-scripts/ProxmoxVE/pull/14714))
+
 ## 2026-05-25
 
 ### 🚀 Updated Scripts

ct/birdnet-go.sh

@@ -43,6 +43,7 @@ function update_script() {
     cp /opt/birdnet/birdnet-go /usr/local/bin/birdnet-go
     chmod +x /usr/local/bin/birdnet-go
     cp -r /opt/birdnet/libtensorflowlite_c.so /usr/local/lib/ || true
+    cp -r /opt/birdnet/libonnxruntime.so /usr/local/lib/ || true
     ldconfig
     msg_ok "Deployed Binary"
 

ct/docuseal.sh

@@ -42,6 +42,13 @@ function update_script() {
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "docuseal" "docusealco/docuseal" "tarball"
 
+    local required_ruby current_ruby
+    required_ruby=$(grep -m1 '^ruby ' /opt/docuseal/Gemfile | grep -oP '[0-9]+\.[0-9]+\.[0-9]+')
+    current_ruby=$(PATH="/root/.rbenv/bin:/root/.rbenv/shims:${PATH}" rbenv global 2>/dev/null || true)
+    if [[ -n "$required_ruby" && "$required_ruby" != "$current_ruby" ]]; then
+      RUBY_VERSION="${required_ruby}" RUBY_INSTALL_RAILS="false" HOME=/root setup_ruby
+    fi
+
     msg_info "Restoring Data"
     mv /opt/docuseal.env.bak /opt/docuseal/.env
     [[ -d /opt/docuseal_data.bak ]] && mv /opt/docuseal_data.bak /opt/docuseal/data

ct/headers/hermesagent

@@ -0,0 +1,6 @@
+    __  __                                 ___                    __ 
+   / / / /__  _________ ___  ___  _____   /   | ____ ____  ____  / /_
+  / /_/ / _ \/ ___/ __ `__ \/ _ \/ ___/  / /| |/ __ `/ _ \/ __ \/ __/
+ / __  /  __/ /  / / / / / /  __(__  )  / ___ / /_/ /  __/ / / / /_  
+/_/ /_/\___/_/  /_/ /_/ /_/\___/____/  /_/  |_\__, /\___/_/ /_/\__/  
+                                             /____/                  

ct/hermesagent.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Stephen Chin (steveonjava)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://hermes-agent.nousresearch.com/
+
+APP="Hermes Agent"
+var_tags="${var_tags:-ai;automation;agent}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-20}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -x /home/hermes/.local/bin/hermes ]]; then
+    msg_error "No Hermes Agent Installation Found!"
+    exit
+  fi
+
+  msg_warn "WARNING: This script will run an external installer from a third-party source (https://hermes-agent.nousresearch.com/)."
+  msg_warn "The following code is NOT maintained or audited by our repository."
+  msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+  msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  hermes update (https://hermes-agent.nousresearch.com/)"
+  echo
+  read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+  if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+    msg_error "Aborted by user. No changes have been made."
+    exit 10
+  fi
+
+  msg_info "Stopping Services"
+  systemctl stop hermes-dashboard
+  msg_ok "Stopped Services"
+
+  msg_info "Updating Hermes Agent"
+  $STD setsid --wait bash -c '
+    set -a; source /etc/default/hermes; set +a
+    /home/hermes/.local/bin/hermes update --yes
+  '
+  chown -R hermes:hermes /home/hermes
+  msg_ok "Updated Hermes Agent"
+
+  msg_info "Starting Services"
+  systemctl start hermes-dashboard
+  msg_ok "Started Services"
+  msg_ok "Updated successfully!"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+echo -e "${CREATING}${GN}Hermes Agent setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Configure your model provider and gateway server inside the container:${CL}"
+echo -e "${TAB}${BGN}hermes-setup${CL}"
+echo -e "${INFO} When prompted to install the gateway service, choose 'user service'.${CL}"
+echo -e "${INFO}${YW} Key for Hermes API Server stored in:${CL}"
+echo -e "${TAB}${BGN}/home/hermes/.hermes/.env${CL}"

ct/open-archiver.sh

@@ -43,6 +43,7 @@ function update_script() {
     msg_info "Updating Open Archiver"
     cd /opt/openarchiver
     $STD pnpm install --shamefully-hoist --frozen-lockfile --prod=false
+    $STD pnpm approve-builds --yes
     $STD pnpm run build:oss
     $STD pnpm db:migrate
     msg_ok "Updated Open Archiver"

ct/profilarr.sh

@@ -37,8 +37,9 @@ function update_script() {
     exit
   fi
 
+  ARCH=$(uname -m)
+
   if check_for_gh_release "deno" "denoland/deno" "v2.7.5" "Deno is pinned to 2.7.5 because the known WouldBlock: Resource temporarily unavailable (os error 11) Issue"; then
-    ARCH=$(uname -m)
     fetch_and_deploy_gh_release "deno" "denoland/deno" "v2.7.5" "latest" "/usr/local/bin" "deno-${ARCH}-unknown-linux-gnu.zip"
   fi
 
@@ -90,6 +91,7 @@ EOF
     msg_ok "Built Profilarr"
 
     msg_info "Updating Profilarr"
+    mkdir -p /opt/profilarr/app
     cp dist/build/profilarr /opt/profilarr/app/profilarr
     cp dist/build/server.js /opt/profilarr/app/server.js
     cp -r dist/build/static /opt/profilarr/app/static

install/birdnet-go-install.sh

@@ -27,6 +27,7 @@ msg_info "Setting up BirdNET-Go"
 cp /opt/birdnet/birdnet-go /usr/local/bin/birdnet-go
 chmod +x /usr/local/bin/birdnet-go
 cp -r /opt/birdnet/libtensorflowlite_c.so /usr/local/lib/ || true
+cp -r /opt/birdnet/libonnxruntime.so /usr/local/lib/ || true
 ldconfig
 mkdir -p /opt/birdnet/data/clips
 msg_ok "Set up BirdNET-Go"

install/docuseal-install.sh

@@ -31,7 +31,6 @@ $STD apt install -y \
 msg_ok "Installed Dependencies"
 
 NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
-RUBY_VERSION="4.0.1" RUBY_INSTALL_RAILS="false" HOME=/root setup_ruby
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="docuseal" PG_DB_USER="docuseal" setup_postgresql_db
 
@@ -56,6 +55,9 @@ msg_ok "Downloaded Fonts and PDFium"
 
 fetch_and_deploy_gh_release "docuseal" "docusealco/docuseal" "tarball"
 
+RUBY_VERSION=$(grep -m1 '^ruby ' /opt/docuseal/Gemfile | grep -oP '[0-9]+\.[0-9]+\.[0-9]+')
+RUBY_VERSION="${RUBY_VERSION}" RUBY_INSTALL_RAILS="false" HOME=/root setup_ruby
+
 msg_info "Downloading Field Detection Model"
 mkdir -p /opt/docuseal/tmp
 curl -fsSL -o /opt/docuseal/tmp/model.onnx \

install/hermesagent-install.sh

@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Stephen Chin (steveonjava)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://hermes-agent.nousresearch.com/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y git
+msg_ok "Installed Dependencies"
+
+NODE_VERSION="22" setup_nodejs
+
+msg_info "Creating Hermes User"
+useradd -m -s /bin/bash hermes
+loginctl enable-linger hermes
+echo 'export XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"' >>/home/hermes/.profile
+msg_ok "Created Hermes User"
+
+msg_info "Configuring Service Environment"
+cat <<EOF >/etc/default/hermes
+HOME=/home/hermes
+PATH=/home/hermes/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+NODE_OPTIONS=${NODE_OPTIONS}
+EOF
+msg_ok "Configured Service Environment"
+
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://hermes-agent.nousresearch.com/)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://hermes-agent.nousresearch.com/install.sh"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi
+
+msg_info "Installing Hermes Agent"
+$STD setsid --wait bash -c '
+  set -a; source /etc/default/hermes; set +a
+  bash <(curl -fsSL https://hermes-agent.nousresearch.com/install.sh) --skip-setup --hermes-home /home/hermes/.hermes --dir /home/hermes/.hermes/hermes-agent
+'
+chown -R hermes:hermes /home/hermes
+chmod 750 /home/hermes
+chmod 700 /home/hermes/.hermes
+git config --system --add safe.directory /home/hermes/.hermes/hermes-agent 2>/dev/null || true
+msg_ok "Installed Hermes Agent"
+
+msg_info "Configuring API Server"
+API_SERVER_KEY=$(openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | cut -c1-32)
+mkdir -p /home/hermes/.hermes
+cat <<EOF >/home/hermes/.hermes/.env
+API_SERVER_ENABLED=true
+API_SERVER_HOST=0.0.0.0
+API_SERVER_PORT=8642
+API_SERVER_KEY=${API_SERVER_KEY}
+EOF
+chmod 600 /home/hermes/.hermes/.env
+msg_ok "Configured API Server"
+
+msg_info "Creating Dashboard Service"
+cat <<EOF >/etc/systemd/system/hermes-dashboard.service
+[Unit]
+Description=Hermes Agent Web Dashboard
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=hermes
+Group=hermes
+UMask=0077
+WorkingDirectory=/home/hermes
+ExecStart=/home/hermes/.local/bin/hermes dashboard --host 127.0.0.1 --port 9119 --no-open
+EnvironmentFile=/etc/default/hermes
+Restart=on-failure
+RestartSec=5
+ProtectProc=invisible
+ProcSubset=pid
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now hermes-dashboard
+msg_ok "Created Dashboard Service"
+
+msg_info "Creating Setup Helper"
+cat <<'SETUP' >/usr/bin/hermes-setup
+#!/usr/bin/env bash
+set -a; source /etc/default/hermes; set +a
+/home/hermes/.local/bin/hermes setup
+chown -R hermes:hermes /home/hermes
+chmod 750 /home/hermes
+chmod 700 /home/hermes/.hermes
+if [[ -f /home/hermes/.config/systemd/user/hermes-gateway.service ]]; then
+  su - hermes -c 'systemctl --user enable --now hermes-gateway'
+fi
+echo "Hermes setup complete. File permissions restored."
+SETUP
+chmod +x /usr/bin/hermes-setup
+msg_ok "Created Setup Helper"
+
+msg_info "Configuring Login Hints"
+cat <<'HINT' >/etc/profile.d/hermes-hint.sh
+if [[ "$(id -u)" -eq 0 ]]; then
+  echo "  Run 'hermes-setup' to configure your model provider and gateway server."
+  echo "  Use 'su - hermes' (with the dash) to switch to the hermes user."
+fi
+HINT
+msg_ok "Configured Login Hints"
+
+motd_ssh
+customize
+cleanup_lxc

install/jackett-install.sh

@@ -29,7 +29,7 @@ Type=simple
 WorkingDirectory=/opt/Jackett
 ExecStart=/bin/sh /opt/Jackett/jackett_launcher.sh
 TimeoutStopSec=30
-EnvironmentFile="/opt/.env"
+EnvironmentFile=/opt/.env
 
 [Install]
 WantedBy=multi-user.target

install/open-archiver-install.sh

@@ -46,6 +46,7 @@ sed -i "s|^ENCRYPTION_KEY=.*|ENCRYPTION_KEY=$SECRET_KEY|g" /opt/openarchiver/.en
 sed -i "s|^TIKA_URL=.*|TIKA_URL=|g" /opt/openarchiver/.env
 sed -i "s|^ORIGIN=.*|ORIGIN=http://$LOCAL_IP:3000|g" /opt/openarchiver/.env
 $STD pnpm install --shamefully-hoist --frozen-lockfile --prod=false
+$STD pnpm approve-builds --yes
 $STD pnpm run build:oss
 $STD pnpm db:migrate
 msg_ok "Setup Open Archiver"

misc/error_handler.func

@@ -358,6 +358,55 @@ error_handler() {
     fi
   fi
 
+  # ── Log-pattern analysis: detect common failure causes and emit actionable hints ──
+  if [[ -n "$active_log" && -s "$active_log" ]]; then
+    local _log_tail
+    _log_tail=$(tail -n 60 "$active_log" 2>/dev/null || true)
+
+    # 1. APT/dpkg dependency conflict
+    if echo "$_log_tail" | grep -qE "Depends:|depends on.*but.*not installed|broken packages|unmet dep|dependency problems"; then
+      # Check for PostgreSQL-specific version mismatch (most actionable)
+      local _pg_conflict
+      _pg_conflict=$(echo "$_log_tail" | grep -oE 'postgresql-[0-9]+ but.*installed' | head -1 || true)
+      if [[ -n "$_pg_conflict" ]]; then
+        if declare -f msg_warn >/dev/null 2>&1; then
+          msg_warn "PostgreSQL version conflict: ${_pg_conflict}"
+          msg_warn "Hint: A package requires a specific PostgreSQL version that is not installed. Your distribution may have installed a different PG version than expected."
+        fi
+      else
+        if declare -f msg_warn >/dev/null 2>&1; then
+          msg_warn "APT dependency conflict detected. A required package is not available or is the wrong version for this system."
+          msg_warn "Hint: Run 'apt-get install -f' inside the container or check that all required repositories are configured for your distribution."
+        fi
+      fi
+    # 2. APT/GPG signature verification failure
+    elif echo "$_log_tail" | grep -qE "sqv|KEYEXPIRED|NO_PUBKEY|key is not certified|signature verification failed|is not signed|Sub-process.*sqv"; then
+      if declare -f msg_warn >/dev/null 2>&1; then
+        msg_warn "APT repository signature error detected."
+        msg_warn "Hint: A repository GPG key may be missing, expired, or the keyring file is not yet present (/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc etc.)."
+        msg_warn "Hint: Install the 'postgresql-common' package first, or re-add the repository with its correct signing key."
+      fi
+    # 3. Network / DNS failure during apt-get or curl
+    elif echo "$_log_tail" | grep -qE "Could not resolve|Failed to fetch|Unable to connect|Name or service not known|Network is unreachable|curl.*resolve"; then
+      if declare -f msg_warn >/dev/null 2>&1; then
+        msg_warn "Network or DNS failure detected."
+        msg_warn "Hint: Check the container's network connectivity, DNS settings, and whether any firewall or ad-blocker is intercepting traffic."
+      fi
+    # 4. APT lock held by another process
+    elif echo "$_log_tail" | grep -qE "Could not get lock|dpkg frontend lock|waiting for it to exit|E: Unable to lock"; then
+      if declare -f msg_warn >/dev/null 2>&1; then
+        msg_warn "APT or dpkg lock conflict detected."
+        msg_warn "Hint: Another package manager process may be running. Try 'rm /var/lib/dpkg/lock-frontend && dpkg --configure -a' inside the container."
+      fi
+    # 5. Disk space exhaustion
+    elif echo "$_log_tail" | grep -qE "No space left on device|disk quota exceeded|ENOSPC"; then
+      if declare -f msg_warn >/dev/null 2>&1; then
+        msg_warn "Disk space exhausted during installation."
+        msg_warn "Hint: Increase the container's disk size (pct resize <ctid> rootfs +2G) or clean up space first."
+      fi
+    fi
+  fi
+
   # Detect context: Container (INSTALL_LOG set + inside container /root) vs Host
   if [[ -n "${INSTALL_LOG:-}" && -f "${INSTALL_LOG:-}" && -d /root ]]; then
     # CONTAINER CONTEXT: Copy log and create flag file for host

tools/addon/netdata.sh

@@ -47,7 +47,7 @@ function msg_ok() {
 function msg_error() { echo -e "${RD}✗ $1${CL}"; }
 
 # This function checks the version of Proxmox Virtual Environment (PVE) and exits if the version is not supported.
-# Supported: Proxmox VE 8.0.x – 8.9.x and 9.0–9.1.x
+# Supported: Proxmox VE 8.0.x – 8.9.x and 9.0–9.x
 pve_check() {
   local PVE_VER
   PVE_VER="$(pveversion | awk -F'/' '{print $2}' | awk -F'-' '{print $1}')"
@@ -63,20 +63,14 @@ pve_check() {
     return 0
   fi
 
-  # Check for Proxmox VE 9.x: allow 9.0–9.1.x
+  # Check for Proxmox VE 9.x: allow 9.0–9.x
   if [[ "$PVE_VER" =~ ^9\.([0-9]+) ]]; then
-    local MINOR="${BASH_REMATCH[1]}"
-    if ((MINOR < 0 || MINOR > 1)); then
-      msg_error "This version of Proxmox VE is not yet supported."
-      msg_error "Supported: Proxmox VE version 9.0–9.1.x"
-      exit 105
-    fi
     return 0
   fi
 
   # All other unsupported versions
   msg_error "This version of Proxmox VE is not supported."
-  msg_error "Supported versions: Proxmox VE 8.0 – 8.9 or 9.0–9.1.x"
+  msg_error "Supported versions: Proxmox VE 8.0 – 8.9 or 9.0–9.x"
   exit 105
 }
 

tools/pve/add-iptag.sh

@@ -811,13 +811,7 @@ update_tags() {
         if [[ "$type" == "lxc" ]]; then
             pct set "${vmid}" -tags "$(IFS=';'; echo "${next_tags[*]}")" &>/dev/null
         else
-            local vm_config="/etc/pve/qemu-server/${vmid}.conf"
-            if [[ -f "$vm_config" ]]; then
-                sed -i '/^tags:/d' "$vm_config"
-                if [[ ${#next_tags[@]} -gt 0 ]]; then
-                    echo "tags: $(IFS=';'; echo "${next_tags[*]}")" >> "$vm_config"
-                fi
-            fi
+            qm set "${vmid}" --tags "$(IFS=';'; echo "${next_tags[*]}")" &>/dev/null
         fi
     else
         # Tags unchanged