fix: add TZ=America/Montreal for correct cron scheduling

Reviewed-on: #17

ai/Dockerfile

@@ -1,47 +1,46 @@
 # 1. On récupère la version la plus récente d'UV
 FROM ghcr.io/astral-sh/uv:latest AS uv_source
 
-# 2. Image de base stable
-FROM debian:stable-slim
+# 2. Image officielle Hermes Agent de NousResearch
+# Contient déjà: Python, Node.js, npm, Playwright/Chromium, venv, tts_tool.py, etc.
+FROM nousresearch/hermes-agent:latest
 
-# Disable Python stdout buffering to ensure logs are printed immediately
-ENV PYTHONUNBUFFERED=1
-
-# Install system dependencies in one layer, clear APT cache
-# tini reaps orphaned zombie processes (MCP stdio subprocesses, git, bun, etc.)
+# ---------- System dependencies ----------
+# The official hermes-agent image already has: git, curl, ffmpeg, python3,
+# gcc, build-essential, openssh-client, procps, tini, ripgrep, docker-cli,
+# libportaudio2, ca-certificates, etc.
+#
+# These extras we need to add back:
+#   - poppler-utils, imagemagick  (PDF/image processing)
+#   - texlive-*                   (LaTeX typesetting for reports)
+#   - qemu-user-static, binfmt-support (QEMU cross-compilation)
+#   - emacs-nox                   (text editing in container)
+USER root
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
-        build-essential python3 ripgrep ffmpeg gcc python3-dev libffi-dev procps git openssh-client docker-cli tini \
-        curl poppler-utils imagemagick \
-        texlive-latex-base texlive-latex-extra texlive-fonts-recommended texlive-xetex texlive-science \
-        qemu-user-static binfmt-support qemu-user-binfmt \
-        emacs-nox \
         libportaudio2 \
-        ca-certificates && \
+        ca-certificates \
+        poppler-utils \
+        imagemagick \
+        texlive-latex-base \
+        texlive-latex-extra \
+        texlive-fonts-recommended \
+        texlive-xetex \
+        texlive-science \
+        qemu-user-static \
+        binfmt-support \
+        emacs-nox && \
     rm -rf /var/lib/apt/lists/*
 
-# Création de l'utilisateur 'hermes' directement avec les bons accès
-RUN useradd -u 10000 -m -d /opt/data hermes
-
-# Copie d'uv (dernière version)
+# ---------- UV (hyperfast pip alternative) ----------
 COPY --chmod=0755 --from=uv_source /uv /usr/local/bin/
 
 WORKDIR /opt/hermes
 
-# On donne la propriété du dossier de travail à l'utilisateur hermes
-RUN chown hermes:hermes /opt/hermes
-
-# ---------- Hermes venv ----------
-# Passer immédiatement sous l'utilisateur hermes pour tout le reste du build
-USER hermes
-
-# ---------- Source code ----------
-# On copie tout le projet d'un coup sans assumer la présence de fichiers de lock spécifiques
-COPY --chown=hermes:hermes . .
-
-# ---------- Python virtualenv avec Piper TTS ----------
-RUN uv venv && \
-    uv pip install --no-cache-dir piper-tts sounddevice numpy faster-whisper
+# ---------- Piper TTS dans le venv existant ----------
+# Le venv de l'image de base est root-owned, on doit installer en root aussi
+RUN . /opt/hermes/.venv/bin/activate && \
+    uv pip install --no-cache-dir piper-tts sounddevice numpy
 
 # ---------- Télécharger la voix Piper Ryan (high quality) ----------
 RUN mkdir -p /opt/hermes/.venv/share/piper/voices && \
@@ -53,64 +52,22 @@ urllib.request.urlretrieve(url, base + '/en_US-ryan-high.onnx')
 urllib.request.urlretrieve(url + '.json', base + '/en_US-ryan-high.onnx.json')
 PYEOF
 
-# ---------- Patch atomic writes to preserve file permissions ----------
-# Fixes https://github.com/NousResearch/hermes-agent/issues/14181
-# tempfile.mkstemp() creates files as 0600; os.replace() preserves that mode,
-# so group-readable files silently collapse to owner-private 0600.
-# This affects: skills, sessions, memories, and any file written atomically.
-RUN /opt/hermes/.venv/bin/python3 /dev/stdin << 'PYEOF'
-import os
-
-patches = [
-    ("/opt/hermes/tools/skill_manager_tool.py", [
-        ("# Restore existing file mode if present", True),  # already patched
-    ]),
-    ("/opt/hermes/tools/skills_sync.py", [
-        ("# Restore existing file mode if present", True),  # already patched
-    ]),
-]
-
-for fpath, checks in patches:
-    if not os.path.exists(fpath):
-        print(f"SKIP {fpath} (not found)")
-        continue
-    with open(fpath) as f:
-        code = f.read()
-    all_ok = all(marker in code for marker, _ in checks)
-    if all_ok:
-        print(f"OK {fpath} (already patched)")
-        continue
-    print(f"PATCH {fpath}")
-    # _atomic_write_text in skill_manager_tool.py
-    code = code.replace(
-        "        os.replace(temp_path, file_path)",
-        "        if file_path.exists():\n"
-        "            existing_mode = file_path.stat().st_mode\n"
-        "            os.chmod(temp_path, existing_mode)\n"
-        "        os.replace(temp_path, file_path)",
-    )
-    # _write_manifest in skills_sync.py
-    code = code.replace(
-        "            os.replace(tmp_path, MANIFEST_FILE)",
-        "            if MANIFEST_FILE.exists():\n"
-        "                existing_mode = MANIFEST_FILE.stat().st_mode\n"
-        "                os.chmod(tmp_path, existing_mode)\n"
-        "            os.replace(tmp_path, MANIFEST_FILE)",
-    )
-    with open(fpath, 'w') as f:
-        f.write(code)
-    print(f"DONE {fpath}")
-PYEOF
+# ---------- Patch tts_tool.py: remplacer Edge TTS par Piper ----------
+# Edge TTS appelle les serveurs Microsoft — on ne veut jamais ça.
+# Piper roule localement sur CPU, aucun cloud, aucune donnée qui sort.
+COPY patch_tts_tool.py /tmp/patch_tts_tool.py
+RUN /opt/hermes/.venv/bin/python3 /tmp/patch_tts_tool.py && rm /tmp/patch_tts_tool.py
 
 # ---------- Runtime ----------
+# Retour à l'utilisateur non-root pour la sécurité
+USER hermes
+
 ENV HERMES_HOME=/opt/data
 ENV PATH="/opt/data/.local/bin:${PATH}"
 
 VOLUME [ "/opt/data" ]
 
-# Copie du script de réparation des permissions (lancement au démarrage)
+# Script de réparation des permissions + patch TTS au démarrage
 COPY --chmod=0755 fix-permissions.sh /opt/hermes/fix-permissions.sh
 
-# Le conteneur tourne de manière ultra-sécurisée sous l'utilisateur hermes dès le départ
-# fix-permissions.sh chown les répertoires critiques avant de chaîner vers entrypoint.sh
 ENTRYPOINT [ "/usr/bin/tini", "-g", "--", "/opt/hermes/fix-permissions.sh" ]

ai/compose.yml

@@ -45,6 +45,7 @@ services:
       - HIP_VISIBLE_DEVICES=0,1
       - ROCR_VISIBLE_DEVICES=0,1
       - HSA_ENABLE_SDMA=0
+      - TZ=America/Montreal
     volumes:
       - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
     devices:

ai/fix-permissions.sh

@@ -1,13 +1,11 @@
 #!/bin/bash
-# Startup permission fix for the Hermes data volume.
+# Startup permission fix + TTS patch.
 # Runs as root before the entrypoint drops to the hermes user.
-# Fixes files that were created by root (host agent, cron jobs, etc.)
-# becoming inaccessible to the hermes runtime user.
 set -e
 
 HERMES_HOME="${HERMES_HOME:-/opt/data}"
 
-# Fix ownership on critical writable directories so hermes user can access them
+# Fix ownership on critical writable directories
 chown -R hermes:hermes \
   "$HERMES_HOME/sessions" \
   "$HERMES_HOME/checkpoints" \
@@ -22,10 +20,19 @@ chown -R hermes:hermes \
   "$HERMES_HOME/cache" \
   2>/dev/null || true
 
-# Also fix the data volume root if it's wrong
+# Fix data volume root ownership
 if [ "$(stat -c %u "$HERMES_HOME" 2>/dev/null)" != "$(id -u hermes)" ]; then
   chown hermes:hermes "$HERMES_HOME" 2>/dev/null || true
 fi
 
-# Now chain to the real entrypoint
+# ---------- Patch tts_tool.py: replace Edge TTS with Piper ----------
+# Fallback runtime patch in case the volume's site-packages differ from the image.
+# Idempotent: if already patched, the script does nothing.
+PATCH_SCRIPT="/opt/hermes/patch_tts_tool.py"
+if [ -f "$PATCH_SCRIPT" ]; then
+  echo "Applying TTS patch (Piper only, no Edge fallback)..."
+  /opt/hermes/.venv/bin/python3 "$PATCH_SCRIPT" 2>&1 || true
+fi
+
+# Chain to the official Hermes entrypoint
 exec /opt/hermes/docker/entrypoint.sh "$@"

ai/patch_tts_tool.py

@@ -1,14 +1,56 @@
 #!/usr/bin/env python3
-"""Patch Hermes TTS tool: remove Edge TTS, replace with Piper as default/fallback."""
+"""Patch Hermes TTS tool: add Piper TTS provider, remove Edge TTS as default.
+
+Patches ALL copies of tts_tool.py found (venv site-packages + /opt/hermes/tools/).
+
+Searches multiple paths for tts_tool.py so it works both at build time
+(in the image venv) and at runtime (on the mounted data volume).
+
+Idempotent: if already patched, does nothing.
+"""
+
 import sys
+import os
 
-tts_path = '/opt/hermes/tools/tts_tool.py'
+# ---------------------------------------------------------------------------
+# Search for all copies of tts_tool.py
+# ---------------------------------------------------------------------------
+CANDIDATE_PATHS = [
+    "/opt/hermes/.venv/lib/python3.13/site-packages/tools/tts_tool.py",
+    "/opt/hermes/tools/tts_tool.py",
+]
 
-with open(tts_path) as f:
-    code = f.read()
+found_paths = []
 
-# Replace the Edge fallback with Piper fallback
-old_edge = '''        else:
+for p in CANDIDATE_PATHS:
+    if os.path.exists(p):
+        found_paths.append(p)
+        print(f"Found tts_tool.py at: {p}")
+
+# Also try to find via Python import
+import subprocess
+try:
+    result = subprocess.run(
+        [sys.executable, "-c", "import tools.tts_tool; print(tools.tts_tool.__file__)"],
+        capture_output=True, text=True, timeout=5
+    )
+    if result.returncode == 0:
+        p = result.stdout.strip()
+        if os.path.exists(p) and p not in found_paths:
+            found_paths.append(p)
+            print(f"Found tts_tool.py via import at: {p}")
+except Exception:
+    pass
+
+if not found_paths:
+    print("WARNING: tts_tool.py not found anywhere. Patching deferred to runtime.")
+    print(f"Searched: {CANDIDATE_PATHS}")
+    sys.exit(0)
+
+# ---------------------------------------------------------------------------
+# Old else block: the Edge TTS default fallback to replace
+# ---------------------------------------------------------------------------
+old_else = '''        else:
             # Default: Edge TTS (free), with NeuTTS as local fallback
             edge_available = True
             try:
@@ -37,60 +79,103 @@ old_edge = '''        else:
                              "or set up NeuTTS for local synthesis."
                 }, ensure_ascii=False)'''
 
-new_piper = '''        else:
-            # Default: Piper TTS (local, CPU, no cloud, no Microsoft)
-            piper_available = False
-            try:
+# ---------------------------------------------------------------------------
+# New block: elif provider == "piper" + else: fallback with Piper only
+# ---------------------------------------------------------------------------
+new_block = '''        elif provider == "piper":
+            # Piper TTS (local, CPU, no cloud, no Microsoft)
             piper_binary = "/opt/hermes/.venv/bin/piper"
             piper_config = tts_config.get("piper", {})
             voice = piper_config.get("voice", "en_US-lessac-medium")
             model_dir = piper_config.get("model_dir", "/opt/hermes/.venv/share/piper/voices")
             model_path = os.path.join(model_dir, f"{voice}.onnx")
-                if os.path.exists(model_path):
-                    piper_available = True
-            except Exception:
-                pass
-
-            if piper_available:
+            if not os.path.exists(model_path):
+                return json.dumps({
+                    "success": False,
+                    "error": "Piper TTS voice model not found. "
+                             "Install Piper TTS and download a voice model."
+                }, ensure_ascii=False)
             logger.info("Generating speech with Piper TTS (local, CPU)...")
-                import subprocess
-                piper_binary = "/opt/hermes/.venv/bin/piper"
-                piper_config = tts_config.get("piper", {})
-                voice = piper_config.get("voice", "en_US-lessac-medium")
-                model_dir = piper_config.get("model_dir", "/opt/hermes/.venv/share/piper/voices")
-                model_path = os.path.join(model_dir, f"{voice}.onnx")
+            import subprocess as _sp
             cmd = [piper_binary, "--model", model_path, "--output-raw"]
-                proc = subprocess.Popen(cmd, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+            try:
+                proc = _sp.Popen(cmd, stdin=_sp.PIPE, stdout=_sp.PIPE, stderr=_sp.PIPE)
                 raw_audio, stderr = proc.communicate(input=text.encode(), timeout=60)
                 if proc.returncode != 0:
                     raise RuntimeError(f"Piper TTS failed: {stderr.decode()[:200]}")
                 ffmpeg_cmd = ["ffmpeg", "-f", "s16le", "-ar", "22050", "-ac", "1", "-i", "-", "-y", file_str]
-                subprocess.run(ffmpeg_cmd, input=raw_audio, capture_output=True, timeout=30)
-                logger.info("Piper TTS audio saved: %s", file_str)
+                _sp.run(ffmpeg_cmd, input=raw_audio, capture_output=True, timeout=30)
+            except Exception as e:
+                return json.dumps({
+                    "success": False,
+                    "error": f"Piper TTS failed: {e}"
+                }, ensure_ascii=False)
+
+        else:
+            # Default: Piper TTS (local, CPU, no cloud, no Microsoft)
+            piper_binary = "/opt/hermes/.venv/bin/piper"
+            piper_config = tts_config.get("piper", {})
+            voice = piper_config.get("voice", "en_US-lessac-medium")
+            model_dir = piper_config.get("model_dir", "/opt/hermes/.venv/share/piper/voices")
+            model_path = os.path.join(model_dir, f"{voice}.onnx")
+            if os.path.exists(model_path) and os.path.exists(piper_binary):
+                logger.info("Generating speech with Piper TTS (local, CPU)...")
+                import subprocess as _sp
+                cmd = [piper_binary, "--model", model_path, "--output-raw"]
+                try:
+                    proc = _sp.Popen(cmd, stdin=_sp.PIPE, stdout=_sp.PIPE, stderr=_sp.PIPE)
+                    raw_audio, stderr = proc.communicate(input=text.encode(), timeout=60)
+                    if proc.returncode != 0:
+                        raise RuntimeError(stderr.decode()[:200])
+                    ffmpeg_cmd = ["ffmpeg", "-f", "s16le", "-ar", "22050", "-ac", "1", "-i", "-", "-y", file_str]
+                    _sp.run(ffmpeg_cmd, input=raw_audio, capture_output=True, timeout=30)
+                except Exception:
+                    pass
             else:
                 return json.dumps({
                     "success": False,
-                    "error": "No TTS provider available. Install Piper TTS (pip install piper-tts) "
-                             "and download a voice model."
+                    "error": "Piper TTS not available. Install piper-tts and download a voice model."
                 }, ensure_ascii=False)'''
 
-if old_edge in code:
-    code = code.replace(old_edge, new_piper)
-    print("Edge fallback replaced with Piper")
-else:
-    if 'Default: Piper TTS' in code:
-        print("Piper fallback already present")
+# ---------------------------------------------------------------------------
+# Apply the patch to all copies found
+# ---------------------------------------------------------------------------
+patched_any = False
+
+for tts_path in found_paths:
+    with open(tts_path) as f:
+        code = f.read()
+
+    if 'provider == "piper"' in code:
+        print(f"ALREADY PATCHED: {tts_path}")
+        continue
+
+    if old_else in code:
+        code = code.replace(old_else, new_block, 1)
+        with open(tts_path, 'w') as f:
+            f.write(code)
+        print(f"PATCHED: {tts_path}")
+        patched_any = True
     else:
-        print("ERROR: Could not find Edge fallback in tts_tool.py")
-        # Debug output
+        print(f"SKIP {tts_path}: Edge fallback pattern not found")
         import re
         for m in re.finditer(r'        else:\n            # Default:', code):
             start = max(0, m.start() - 100)
-            end = min(len(code), m.end() + 200)
-            print(f"Found else/default at position {m.start()}:")
-            print(code[start:end])
+            end = min(len(code), m.end() + 300)
+            print(f"  Found 'else:/# Default:' at position {m.start()}:")
+            print(f"  {code[start:end]}")
+            print("  ---")
+        # Don't exit with error — if one copy isn't patchable, try the others
+
+if not patched_any:
+    all_patched = all(
+        'provider == "piper"' in open(p).read()
+        for p in found_paths
+    )
+    if all_patched:
+        print("All copies already patched.")
+        sys.exit(0)
+    print("WARNING: Could not patch any copy of tts_tool.py")
     sys.exit(1)
 
-with open(tts_path, 'w') as f:
-    f.write(code)
-print("tts_tool.py patched successfully")
+print("tts_tool.py patched successfully across all copies.")