compose/ai/hermes/fix-permissions.sh

#!/bin/bash
# Startup permission fix + TTS patch.
# Runs as root before the entrypoint drops to the hermes user.
set -e

HERMES_HOME="${HERMES_HOME:-/opt/data}"

# Fix ownership on critical writable directories
chown -R hermes:hermes \
  "$HERMES_HOME/sessions" \
  "$HERMES_HOME/checkpoints" \
  "$HERMES_HOME/skills" \
  "$HERMES_HOME/memories" \
  "$HERMES_HOME/workspace" \
  "$HERMES_HOME/pastes" \
  "$HERMES_HOME/logs" \
  "$HERMES_HOME/cron" \
  "$HERMES_HOME/plans" \
  "$HERMES_HOME/hooks" \
  "$HERMES_HOME/cache" \
  2>/dev/null || true

# Fix data volume root ownership
if [ "$(stat -c %u "$HERMES_HOME" 2>/dev/null)" != "$(id -u hermes)" ]; then
  chown hermes:hermes "$HERMES_HOME" 2>/dev/null || true
fi

# ---------- Patch tts_tool.py: replace Edge TTS with Piper ----------
# Fallback runtime patch in case the volume's site-packages differ from the image.
# Idempotent: if already patched, the script does nothing.
PATCH_SCRIPT="/opt/hermes/patch_tts_tool.py"
if [ -f "$PATCH_SCRIPT" ]; then
  echo "Applying TTS patch (Piper only, no Edge fallback)..."
  /opt/hermes/.venv/bin/python3 "$PATCH_SCRIPT" 2>&1 || true
fi

# Chain to the official Hermes entrypoint
exec /opt/hermes/docker/entrypoint.sh "$@"