feat(packaging): add langfuse optional extra

pyproject.toml

@@ -154,6 +154,9 @@ edge-tts = ["edge-tts==7.2.7"]
 modal = ["modal==1.3.4"]
 daytona = ["daytona==0.155.0"]
 hindsight = ["hindsight-client==0.6.1"]
+# Optional observability plugin dependency. Keep out of [all] so default
+# installs stay unchanged; packagers can opt in with hermes-agent[langfuse].
+langfuse = ["langfuse==4.9.0"]
 dev = ["debugpy==1.8.20", "pytest==9.0.2", "pytest-asyncio==1.3.0", "mcp==1.26.0", "starlette==1.0.1", "ty==0.0.21", "ruff==0.15.10", "setuptools==81.0.0"]  # starlette: CVE-2026-48710; setuptools: latest <82 (torch >=2.11 caps setuptools<82)
 messaging = ["python-telegram-bot[webhooks]==22.6", "discord.py[voice]==2.7.1", "aiohttp==3.13.4", "brotlicffi==1.2.0.1", "slack-bolt==1.27.0", "slack-sdk==3.40.1", "qrcode==7.4.2"]  # aiohttp: CVE-2026-34513/34518/34519/34520/34525
 cron = []  # croniter is now a core dependency; this extra kept for back-compat

website/docs/getting-started/nix-setup.md

@@ -679,6 +679,15 @@ services.hermes-agent = {
 };
 ```
 
+```nix
+# Enable the bundled Langfuse observability plugin
+services.hermes-agent = {
+  extraDependencyGroups = [ "langfuse" ];
+  settings.plugins.enabled = [ "observability/langfuse" ];
+  environmentFiles = [ "/run/secrets/hermes-langfuse.env" ];
+};
+```
+
 This is resolved by uv alongside core dependencies — no PYTHONPATH patching, no collision risk. Available groups:
 
 | Group | What it enables |
@@ -693,6 +702,7 @@ This is resolved by uv alongside core dependencies — no PYTHONPATH patching, n
 | `anthropic` | Native Anthropic SDK (not needed via OpenRouter) |
 | `bedrock` | AWS Bedrock (boto3) |
 | `azure-identity` | Azure Entra ID auth |
+| `langfuse` | Langfuse observability plugin SDK |
 | `honcho` | Honcho memory provider |
 | `hindsight` | Hindsight memory provider |
 | `modal` | Modal terminal backend |

website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/getting-started/nix-setup.md

@@ -656,7 +656,16 @@ services.hermes-agent = {
 };
 ```
 
-这由 uv 与核心依赖在单次解析中完成——不需要 PYTHONPATH 补丁，没有冲突风险。可用的组与 `pyproject.toml` 中 `[project.optional-dependencies]` 的键对应（例如 `"hindsight"`、`"honcho"`、`"voice"`、`"matrix"`、`"mistral"`、`"bedrock"`）。
+```nix
+# 启用内置 Langfuse 可观测性插件
+services.hermes-agent = {
+  extraDependencyGroups = [ "langfuse" ];
+  settings.plugins.enabled = [ "observability/langfuse" ];
+  environmentFiles = [ "/run/secrets/hermes-langfuse.env" ];
+};
+```
+
+这由 uv 与核心依赖在单次解析中完成——不需要 PYTHONPATH 补丁，没有冲突风险。可用的组与 `pyproject.toml` 中 `[project.optional-dependencies]` 的键对应（例如 `"hindsight"`、`"honcho"`、`"langfuse"`、`"voice"`、`"matrix"`、`"mistral"`、`"bedrock"`）。
 
 **何时使用哪个：**
 
@@ -972,4 +981,4 @@ nix-store --query --roots $(docker exec hermes-agent readlink /data/current-pack
 | `nix-collect-garbage` 删除了 hermes | GC root 缺失 | 重启服务（preStart 会重新创建 GC root） |
 | `no container with name or ID "hermes-agent"`（Podman） | Podman rootful 容器对普通用户不可见 | 为 podman 添加免密 sudo（参见[容器模式](#container-mode)章节） |
 | `unable to find user hermes` | 容器仍在启动中（入口点尚未创建用户） | 等待几秒后重试——CLI 会自动重试 |
-| 通过 `extraPackages` 添加的工具在终端中找不到 | 需要 `nixos-rebuild switch` 更新每用户 profile | 重建并重启：`nixos-rebuild switch && systemctl restart hermes-agent` |
+| 通过 `extraPackages` 添加的工具在终端中找不到 | 需要 `nixos-rebuild switch` 更新每用户 profile | 重建并重启：`nixos-rebuild switch && systemctl restart hermes-agent` |