@atomic-chat/core 0.20.7 → 0.21.0

package/dist/integrations/configure/hermes.d.ts

@@ -3,17 +3,34 @@
  *
  * That is deliberate: the file is hand-edited, heavily commented, and its `custom_providers` list
  * carries the user's own bridges (Telegram, WhatsApp, …). A YAML round trip would drop every comment
- * and reflow every block for the sake of three scalars. So we rewrite only the lines we own and
+ * and reflow every block for the sake of a few scalars. So we rewrite only the lines we own and
  * splice our list entry in, leaving everything else byte-identical.
  *
- * Hermes ignores the API key entirely (`api_key` is accepted for call-site symmetry and reserved),
- * and `.env` is patched only when it already exists — creating one would shadow the agent's own
- * defaults.
+ * The route is bare `custom` with `model.base_url` and `model.api_key`: Hermes trusts that URL while
+ * `model.provider` is `custom` and takes the key from the same section, so the route needs nothing
+ * outside it — unlike `custom:atomic-chat`, which needs our `custom_providers` entry, and that cannot
+ * be added to an inline `custom_providers: [...]` list. The entry is still written where it can be,
+ * for `hermes model` and detection. What the edit replaced is recorded in
+ * `config.yaml.atomic-chat-backup.json` for the app's Disconnect. `.env` is patched only when it
+ * already exists — creating one would shadow the agent's own defaults.
+ *
+ * Mirrors `configure_hermes_at` in the app's `core/system/commands.rs`, byte for byte.
  */
 import type { ConfigFs } from '../config-io.js';
 import type { ConfigureWriter } from './registry.js';
 /** Rewrite everything after the first colon, with no quoting — the values here never need it. */
 export declare function replaceYamlScalarValue(line: string, value: string): string;
+/**
+ * Point the top-level `model:` section at our endpoint, and touch nothing outside it.
+ *
+ * Hermes' chat route comes from `model.default` (`model.model` is an alias), `model.provider` and
+ * `model.base_url`; a section it cannot read leaves it on its built-in default, an empty model on
+ * provider `auto`, which falls through to OpenRouter. The same keys recur under `auxiliary:`,
+ * `delegation:`, `compression:` and others, so only direct children of the top-level `model:` key are
+ * ours. A missing key is added, a scalar `model: <id>` (also valid Hermes) becomes a block, and a file
+ * with no `model:` at all gets one appended.
+ */
+export declare function patchModelSection(content: string, wanted: Array<[string, string]>): string;
 /**
  * Split the document into (before, entries, after) around `custom_providers:`. `entries` is one
  * array of raw lines per list item; blank lines inside the block are dropped, which is why a rerun
@@ -26,16 +43,52 @@ export declare function splitCustomProviders(content: string): {
 };
 /** Re-emit the block: items at column 0, or `custom_providers: []` when nothing is left. */
 export declare function rebuildCustomProviders(before: string[], entries: string[][], after: string[]): string;
-/** Add or update only our entry, leaving the user's other bridges untouched and in order. */
-export declare function upsertAtomicProvider(content: string, apiUrl: string, model: string, ctx: number): string;
+/**
+ * Add or update only our entry, leaving the user's other bridges untouched and in order; also says
+ * whether the `custom_providers` key itself was added. `key` is already a YAML scalar.
+ */
+export declare function upsertAtomicProvider(content: string, apiUrl: string, model: string, ctx: number, key: string): [string, boolean];
 /**
  * Ensure `providers.<id>.request_timeout_seconds` exists, creating the `providers:` map and the
  * provider sub-block as needed. A value the user already set is left alone — we only fill the gap.
+ * Also returns what it created, for Disconnect: `providers`, `providers:{}` (an empty inline map
+ * turned into a block), `providers.<id>` and `providers.<id>.request_timeout_seconds`.
+ */
+export declare function upsertProviderRequestTimeout(content: string, providerId: string, seconds: number): [string, string[]];
+/** One `model:` key Connect wrote: the lines it replaced (absent: none) and the value it wrote. */
+interface KeyBackup {
+    before?: string[];
+    ours: string;
+}
+/** What Connect changed in `config.yaml` (the app's `HermesBackup`). */
+export interface HermesBackup {
+    /** The `model:` line before Connect; absent when there was no section. */
+    header?: string;
+    keys: Record<string, KeyBackup>;
+    /** What Connect added that was not there at all (see `upsertProviderRequestTimeout`). */
+    created: string[];
+}
+export declare function parseHermesBackup(text: string): HermesBackup | undefined;
+export declare function renderHermesBackup(backup: HermesBackup): string;
+/**
+ * The backup of a Connect that wrote `route` over `content`. A key an earlier Connect recorded keeps
+ * that record's original while it still holds the value that Connect wrote; otherwise the user
+ * changed it since, and the current lines are the ones to return to.
+ */
+export declare function hermesBackup(content: string, route: Array<[string, string]>, previous: HermesBackup | undefined, created: string[]): HermesBackup;
+/**
+ * `HERMES_HOME` as Hermes reads it (`os.path.expanduser(os.path.expandvars(...))`): `$NAME`,
+ * `${NAME}` and `%NAME%` take the variable's value (an unset one stays as written), then a leading
+ * `~` is the user's home.
  */
-export declare function upsertProviderRequestTimeout(content: string, providerId: string, seconds: number): string;
+export declare function expandHermesHome(raw: string, env: NodeJS.ProcessEnv, home: string): string;
 /**
- * `~/.hermes` everywhere except Windows, where the installer writes `HERMES_HOME` to the user
- * environment and the CLI honours it.
+ * The directory whose `config.yaml` the `hermes` CLI reads (`resolve_hermes_dir` in the app):
+ * `HERMES_HOME` (expanded) or the platform default (`%LOCALAPPDATA%/hermes` on Windows, `~/.hermes`
+ * elsewhere) is the root; a `HERMES_HOME` naming a profile (`<root>/profiles/<name>`) is used as it
+ * is; otherwise the sticky profile `hermes profile use <name>` leaves in `<root>/active_profile` is
+ * what every `hermes` without `-p` runs, from `<root>/profiles/<name>`.
  */
-export declare function hermesDir(env: NodeJS.ProcessEnv, platform: NodeJS.Platform, fs: ConfigFs): string;
+export declare function hermesDir(env: NodeJS.ProcessEnv, platform: NodeJS.Platform, fs: ConfigFs): Promise<string>;
 export declare const configureHermes: ConfigureWriter;
+export {};

package/dist/integrations/configure/hermes.js

@@ -3,29 +3,30 @@
  *
  * That is deliberate: the file is hand-edited, heavily commented, and its `custom_providers` list
  * carries the user's own bridges (Telegram, WhatsApp, …). A YAML round trip would drop every comment
- * and reflow every block for the sake of three scalars. So we rewrite only the lines we own and
+ * and reflow every block for the sake of a few scalars. So we rewrite only the lines we own and
  * splice our list entry in, leaving everything else byte-identical.
  *
- * Hermes ignores the API key entirely (`api_key` is accepted for call-site symmetry and reserved),
- * and `.env` is patched only when it already exists — creating one would shadow the agent's own
- * defaults.
+ * The route is bare `custom` with `model.base_url` and `model.api_key`: Hermes trusts that URL while
+ * `model.provider` is `custom` and takes the key from the same section, so the route needs nothing
+ * outside it — unlike `custom:atomic-chat`, which needs our `custom_providers` entry, and that cannot
+ * be added to an inline `custom_providers: [...]` list. The entry is still written where it can be,
+ * for `hermes model` and detection. What the edit replaced is recorded in
+ * `config.yaml.atomic-chat-backup.json` for the app's Disconnect. `.env` is patched only when it
+ * already exists — creating one would shadow the agent's own defaults.
+ *
+ * Mirrors `configure_hermes_at` in the app's `core/system/commands.rs`, byte for byte.
  */
 import { HERMES_CONTEXT_LENGTH } from '../catalog.js';
+import { canonicalJson } from '../config-io.js';
+import { BACKUP_SUFFIX, writeBackupText } from './json-key-backup.js';
 import { registerWriter } from './registry.js';
 const PROVIDER_NAME = 'atomic-chat';
+/** The provider older releases wrote: our named `custom_providers` entry. */
+const LEGACY_PROVIDER = `custom:${PROVIDER_NAME}`;
 /** Hermes otherwise waits out its legacy 1800s default; a tighter cap lets a wedged turn fail fast. */
 const REQUEST_TIMEOUT_SECONDS = 180;
-/**
- * Seeded when no config exists. The installer runs with `--skip-setup`, which skips the wizard that
- * would create one, so on a fresh install there was nothing to patch at all. This carries exactly
- * the anchors the patch logic below looks for.
- */
-const DEFAULT_CONFIG = `model:
-  default: anthropic/claude-opus-4.6
-  provider: auto
-  base_url: https://openrouter.ai/api/v1
-custom_providers: []
-`;
+const NO_PROXY_LINE = 'NO_PROXY=localhost,127.0.0.1,0.0.0.0';
+const NO_PROXY_EXPORT_LINE = 'export no_proxy=localhost,127.0.0.1,0.0.0.0';
 /** Rust's `str::lines`: split on `\n`, drop the empty tail, strip a trailing `\r` from each line. */
 function lines(text) {
     const parts = text.split('\n');
@@ -41,6 +42,143 @@ export function replaceYamlScalarValue(line, value) {
     const colon = line.indexOf(':');
     return colon < 0 ? line : `${line.slice(0, colon + 1)} ${value}`;
 }
+/** A column-0 mapping key: not indented, not a list item, not a comment, not blank. */
+function isTopLevelYamlKey(line) {
+    const c = line.charAt(0);
+    return c !== '' && c !== ' ' && c !== '\t' && c !== '-' && c !== '#';
+}
+/** Drop a trailing `# comment` (YAML only starts one after whitespace). */
+function stripYamlComment(text) {
+    return text.replace(/(^|\s)#.*$/, '');
+}
+/** `key: value` of a column-0 mapping line, the value without its comment; `undefined` otherwise. */
+function topLevelYamlKey(line) {
+    if (!isTopLevelYamlKey(line))
+        return undefined;
+    const colon = line.indexOf(':');
+    if (colon < 0)
+        return undefined;
+    return { key: line.slice(0, colon).trim(), value: stripYamlComment(line.slice(colon + 1)).trim() };
+}
+function indentOf(line) {
+    return line.length - line.trimStart().length;
+}
+function isBlankOrComment(line) {
+    const t = line.trim();
+    return t === '' || t.startsWith('#');
+}
+function modelSection(out) {
+    const header = out.findIndex((line) => topLevelYamlKey(line)?.key === 'model');
+    if (header < 0)
+        return undefined;
+    let end = out.length;
+    for (let i = header + 1; i < out.length; i++) {
+        if (isTopLevelYamlKey(out[i])) {
+            end = i;
+            break;
+        }
+    }
+    return { header, end, isScalar: (topLevelYamlKey(out[header])?.value ?? '') !== '' };
+}
+function childIndent(out, section) {
+    const first = out.slice(section.header + 1, section.end).find((line) => !isBlankOrComment(line));
+    return first === undefined ? '  ' : first.slice(0, indentOf(first));
+}
+function isChildKey(line, indent, key) {
+    if (isBlankOrComment(line) || indentOf(line) !== indent)
+        return false;
+    const t = line.trim();
+    return t.startsWith(key) && t.slice(key.length).trimStart().startsWith(':');
+}
+/** The lines of the direct child `key` of a block section: its own line and the more-indented lines
+ * of a nested value after it (with any comments between those), as `[start, end)`. */
+function childSpan(out, section, key) {
+    if (section.isScalar)
+        return undefined;
+    const indent = childIndent(out, section).length;
+    let start = -1;
+    for (let i = section.header + 1; i < section.end; i++) {
+        if (isChildKey(out[i], indent, key)) {
+            start = i;
+            break;
+        }
+    }
+    if (start < 0)
+        return undefined;
+    let end = start + 1;
+    for (let i = start + 1; i < section.end;) {
+        const line = out[i];
+        if (isBlankOrComment(line))
+            i++;
+        else if (indentOf(line) > indent) {
+            i++;
+            end = i;
+        }
+        else
+            break;
+    }
+    return [start, end];
+}
+/** The value text of a `key: value` line, without its comment (quotes kept). */
+function scalarOf(line) {
+    const colon = line.indexOf(':');
+    return colon < 0 ? '' : stripYamlComment(line.slice(colon + 1)).trim();
+}
+function modelValue(out, section, key) {
+    const span = section === undefined ? undefined : childSpan(out, section, key);
+    return span === undefined ? undefined : scalarOf(out[span[0]]);
+}
+/**
+ * Point the top-level `model:` section at our endpoint, and touch nothing outside it.
+ *
+ * Hermes' chat route comes from `model.default` (`model.model` is an alias), `model.provider` and
+ * `model.base_url`; a section it cannot read leaves it on its built-in default, an empty model on
+ * provider `auto`, which falls through to OpenRouter. The same keys recur under `auxiliary:`,
+ * `delegation:`, `compression:` and others, so only direct children of the top-level `model:` key are
+ * ours. A missing key is added, a scalar `model: <id>` (also valid Hermes) becomes a block, and a file
+ * with no `model:` at all gets one appended.
+ */
+export function patchModelSection(content, wanted) {
+    const out = lines(content);
+    const block = (indent) => wanted.map(([key, value]) => `${indent}${key}: ${value}`);
+    const found = modelSection(out);
+    if (found === undefined) {
+        while (out.length > 0 && out[out.length - 1].trim() === '')
+            out.pop();
+        out.push('model:', ...block('  '));
+        return endWithNewline(out.join('\n'));
+    }
+    const { header: headerIdx, end, isScalar } = found;
+    // Anything still indented under a scalar `model: <id>` header is that scalar's continuation.
+    const section = out.slice(headerIdx + 1, end).filter((line) => !isScalar || isBlankOrComment(line));
+    if (isScalar) {
+        out.splice(headerIdx, end - headerIdx, 'model:', ...block('  '), ...section);
+        return endWithNewline(out.join('\n'));
+    }
+    const firstChild = section.find((line) => !isBlankOrComment(line));
+    const indent = firstChild === undefined ? '  ' : firstChild.slice(0, indentOf(firstChild));
+    const missing = [];
+    for (const [key, value] of wanted) {
+        const at = section.findIndex((line) => isChildKey(line, indent.length, key));
+        if (at < 0) {
+            missing.push(`${indent}${key}: ${value}`);
+            continue;
+        }
+        section[at] = replaceYamlScalarValue(section[at], value);
+        // A nested value (a mapping-valued `default`, a wrapped scalar) would dangle under the new one.
+        for (let i = at + 1; i < section.length;) {
+            const line = section[i];
+            if (isBlankOrComment(line))
+                i++;
+            else if (indentOf(line) > indent.length)
+                section.splice(i, 1);
+            else
+                break;
+        }
+    }
+    out.splice(headerIdx + 1, end - headerIdx - 1, ...missing, ...section);
+    return endWithNewline(out.join('\n'));
+}
 /**
  * Split the document into (before, entries, after) around `custom_providers:`. `entries` is one
  * array of raw lines per list item; blank lines inside the block are dropped, which is why a rerun
@@ -53,7 +191,7 @@ export function splitCustomProviders(content) {
     let phase = 'before';
     for (const line of lines(content)) {
         if (phase === 'before') {
-            const t = line.trim();
+            const t = stripYamlComment(line).trim();
             if (t === 'custom_providers:' || t === 'custom_providers: []' || t === 'custom_providers:[]') {
                 phase = t.includes('[]') ? 'after' : 'inBlock';
             }
@@ -114,45 +252,66 @@ export function rebuildCustomProviders(before, entries, after) {
     result.push(...after);
     return endWithNewline(result.join('\n'));
 }
-/** Add or update only our entry, leaving the user's other bridges untouched and in order. */
-export function upsertAtomicProvider(content, apiUrl, model, ctx) {
+/** Whether the top-level `custom_providers:` holds an inline list with entries. */
+function hasInlineCustomProviders(content) {
+    const inline = lines(content)
+        .map(topLevelYamlKey)
+        .find((entry) => entry?.key === 'custom_providers')?.value;
+    return inline !== undefined && inline !== '' && inline.replace(/\s/g, '') !== '[]';
+}
+/**
+ * Add or update only our entry, leaving the user's other bridges untouched and in order; also says
+ * whether the `custom_providers` key itself was added. `key` is already a YAML scalar.
+ */
+export function upsertAtomicProvider(content, apiUrl, model, ctx, key) {
+    // An inline list cannot be spliced, and a second `custom_providers:` would make the whole file
+    // unreadable to Hermes (duplicate key); leave it rather than append one.
+    if (hasInlineCustomProviders(content))
+        return [endWithNewline(content), false];
+    const hadKey = lines(content).some((line) => topLevelYamlKey(line)?.key === 'custom_providers');
     const { before, entries, after } = splitCustomProviders(content);
     const kept = entries.filter((entry) => !entryIsOurs(entry));
     kept.push([
         `- name: ${PROVIDER_NAME}`,
         `  base_url: ${apiUrl}`,
+        `  api_key: ${key}`,
         `  model: ${model}`,
         '  models:',
         `    ${model}:`,
         `      context_length: ${ctx}`,
     ]);
-    return rebuildCustomProviders(before, kept, after);
-}
-/** A column-0 mapping key: not indented, not a list item, not a comment, not blank. */
-function isTopLevelYamlKey(line) {
-    const c = line.charAt(0);
-    return c !== '' && c !== ' ' && c !== '\t' && c !== '-' && c !== '#';
+    return [rebuildCustomProviders(before, kept, after), !hadKey];
 }
 /**
  * Ensure `providers.<id>.request_timeout_seconds` exists, creating the `providers:` map and the
  * provider sub-block as needed. A value the user already set is left alone — we only fill the gap.
+ * Also returns what it created, for Disconnect: `providers`, `providers:{}` (an empty inline map
+ * turned into a block), `providers.<id>` and `providers.<id>.request_timeout_seconds`.
  */
 export function upsertProviderRequestTimeout(content, providerId, seconds) {
     const out = lines(content);
+    const created = [];
     const provKeyLine = `  ${providerId}:`;
     const fieldLine = `    request_timeout_seconds: ${seconds}`;
-    const providersIdx = out.findIndex((line) => {
-        const t = line.replace(/\s+$/, '');
-        return isTopLevelYamlKey(line) && (t === 'providers:' || t === 'providers: {}' || t === 'providers:{}');
-    });
-    if (providersIdx < 0) {
+    const providerLabel = `providers.${providerId}`;
+    const fieldLabel = `providers.${providerId}.request_timeout_seconds`;
+    const providersIdx = out.findIndex((line) => topLevelYamlKey(line)?.key === 'providers');
+    const providers = providersIdx < 0 ? undefined : topLevelYamlKey(out[providersIdx]);
+    if (providers === undefined) {
         while (out.length > 0 && out[out.length - 1].trim() === '')
             out.pop();
         out.push('providers:', provKeyLine, fieldLine);
-        return endWithNewline(out.join('\n'));
+        created.push('providers', providerLabel, fieldLabel);
+        return [endWithNewline(out.join('\n')), created];
     }
-    if (out[providersIdx].replace(/\s+$/, '') !== 'providers:')
+    // Hermes' YAML reader rejects a duplicate key, and then runs on its defaults: an inline map we
+    // cannot edit line by line is left as it is rather than shadowed by a second `providers:`.
+    if (providers.value !== '' && providers.value.replace(/\s/g, '') !== '{}')
+        return [endWithNewline(out.join('\n')), created];
+    if (providers.value !== '') {
         out[providersIdx] = 'providers:';
+        created.push('providers:{}');
+    }
     // The providers block runs until the next column-0 key.
     let blockEnd = out.length;
     for (let i = providersIdx + 1; i < out.length; i++) {
@@ -170,7 +329,8 @@ export function upsertProviderRequestTimeout(content, providerId, seconds) {
     }
     if (provIdx < 0) {
         out.splice(providersIdx + 1, 0, provKeyLine, fieldLine);
-        return endWithNewline(out.join('\n'));
+        created.push(providerLabel, fieldLabel);
+        return [endWithNewline(out.join('\n')), created];
     }
     // This provider's sub-block runs until the next key at indent <= 2 (a sibling provider).
     let subEnd = blockEnd;
@@ -186,62 +346,187 @@ export function upsertProviderRequestTimeout(content, providerId, seconds) {
     const hasField = out
         .slice(provIdx + 1, subEnd)
         .some((line) => line.trimStart().startsWith('request_timeout_seconds:'));
-    if (!hasField)
+    if (!hasField) {
         out.splice(provIdx + 1, 0, fieldLine);
-    return endWithNewline(out.join('\n'));
+        created.push(fieldLabel);
+    }
+    return [endWithNewline(out.join('\n')), created];
+}
+/** `value` without one pair of surrounding quotes. */
+function unquote(value) {
+    for (const quote of ['"', "'"]) {
+        if (value.length >= 2 && value.startsWith(quote) && value.endsWith(quote))
+            return value.slice(1, -1);
+    }
+    return value;
+}
+/** Whether `current` is the value Connect wrote; Hermes may persist bare `custom` under our name. */
+function valueIsOurs(key, current, ours) {
+    const value = unquote(current);
+    return value === unquote(ours) || (key === 'provider' && ours === 'custom' && value === LEGACY_PROVIDER);
+}
+export function parseHermesBackup(text) {
+    try {
+        const root = JSON.parse(text);
+        const created = root.created;
+        const keys = root.model?.keys;
+        if (!Array.isArray(created) || !created.every((c) => typeof c === 'string'))
+            return undefined;
+        if (typeof keys !== 'object' || keys === null)
+            return undefined;
+        const parsed = {};
+        for (const [key, entry] of Object.entries(keys)) {
+            if (typeof entry?.ours !== 'string')
+                return undefined;
+            const before = entry.before;
+            if (before !== undefined && !(Array.isArray(before) && before.every((l) => typeof l === 'string')))
+                return undefined;
+            parsed[key] = { ours: entry.ours, ...(before !== undefined ? { before: before } : {}) };
+        }
+        const header = root.model?.header;
+        return { ...(typeof header === 'string' ? { header } : {}), keys: parsed, created: created };
+    }
+    catch {
+        return undefined;
+    }
+}
+export function renderHermesBackup(backup) {
+    return canonicalJson({
+        created: [...new Set(backup.created)].sort(),
+        model: { ...(backup.header !== undefined ? { header: backup.header } : {}), keys: backup.keys },
+    });
+}
+/**
+ * The backup of a Connect that wrote `route` over `content`. A key an earlier Connect recorded keeps
+ * that record's original while it still holds the value that Connect wrote; otherwise the user
+ * changed it since, and the current lines are the ones to return to.
+ */
+export function hermesBackup(content, route, previous, created) {
+    const out = lines(content);
+    const section = modelSection(out);
+    const stillOurs = (prev) => Object.entries(prev.keys).every(([key, entry]) => {
+        const value = modelValue(out, section, key);
+        return value !== undefined && valueIsOurs(key, value, entry.ours);
+    });
+    const header = previous !== undefined && stillOurs(previous)
+        ? previous.header
+        : section === undefined
+            ? undefined
+            : out[section.header];
+    const keys = {};
+    for (const [key, ours] of route) {
+        const earlier = previous?.keys[key];
+        const current = modelValue(out, section, key);
+        let before;
+        if (earlier !== undefined && current !== undefined && valueIsOurs(key, current, earlier.ours)) {
+            before = earlier.before;
+        }
+        else {
+            const span = section === undefined ? undefined : childSpan(out, section, key);
+            before =
+                span === undefined ? undefined : out.slice(span[0], span[1]).filter((l) => !isBlankOrComment(l));
+        }
+        keys[key] = { ours, ...(before !== undefined ? { before } : {}) };
+    }
+    return {
+        ...(header !== undefined ? { header } : {}),
+        keys,
+        created: [...new Set([...(previous?.created ?? []), ...created])].sort(),
+    };
+}
+// ── where Hermes reads its config ───────────────────────────────────────────────────────────────
+/**
+ * `HERMES_HOME` as Hermes reads it (`os.path.expanduser(os.path.expandvars(...))`): `$NAME`,
+ * `${NAME}` and `%NAME%` take the variable's value (an unset one stays as written), then a leading
+ * `~` is the user's home.
+ */
+export function expandHermesHome(raw, env, home) {
+    const value = (name) => {
+        const v = env[name];
+        return v !== undefined && v.trim() !== '' ? v : undefined;
+    };
+    const expanded = raw.replace(/\$\{([^}]*)\}|\$([A-Za-z0-9_]+)|%([^%]+)%/g, (match, braced, bare, percent) => value((braced ?? bare ?? percent)) ?? match);
+    if (expanded === '~')
+        return home;
+    if (expanded.startsWith('~/') || expanded.startsWith('~\\'))
+        return `${home}${expanded.slice(1)}`;
+    return expanded;
 }
+const parentName = (path) => path
+    .split(/[\\/]+/)
+    .filter(Boolean)
+    .slice(-2, -1)[0];
 /**
- * `~/.hermes` everywhere except Windows, where the installer writes `HERMES_HOME` to the user
- * environment and the CLI honours it.
+ * The directory whose `config.yaml` the `hermes` CLI reads (`resolve_hermes_dir` in the app):
+ * `HERMES_HOME` (expanded) or the platform default (`%LOCALAPPDATA%/hermes` on Windows, `~/.hermes`
+ * elsewhere) is the root; a `HERMES_HOME` naming a profile (`<root>/profiles/<name>`) is used as it
+ * is; otherwise the sticky profile `hermes profile use <name>` leaves in `<root>/active_profile` is
+ * what every `hermes` without `-p` runs, from `<root>/profiles/<name>`.
  */
-export function hermesDir(env, platform, fs) {
-    if (platform !== 'win32')
-        return '.hermes';
-    const explicit = env['HERMES_HOME'];
-    if (explicit && explicit !== '')
-        return explicit;
+export async function hermesDir(env, platform, fs) {
     const localAppData = env['LOCALAPPDATA'];
-    return localAppData && localAppData !== '' ? `${localAppData}/hermes` : fs.absolute('hermes');
+    const native = platform === 'win32'
+        ? `${localAppData && localAppData.trim() !== '' ? localAppData : `${fs.home}/AppData/Local`}/hermes`
+        : '.hermes';
+    const raw = env['HERMES_HOME']?.trim();
+    const envHome = raw ? expandHermesHome(raw, env, fs.home) : undefined;
+    if (envHome !== undefined && parentName(envHome) === 'profiles')
+        return envHome;
+    // The root holding `active_profile`: the platform default for anything under it, else
+    // `HERMES_HOME` itself (Docker and custom roots).
+    const nativeAbs = fs.absolute(native).replace(/[\\/]+$/, '');
+    const under = envHome !== undefined &&
+        (fs.absolute(envHome) === nativeAbs ||
+            fs.absolute(envHome).startsWith(`${nativeAbs}/`) ||
+            fs.absolute(envHome).startsWith(`${nativeAbs}\\`));
+    const root = envHome !== undefined && !under ? envHome : native;
+    const base = envHome ?? native;
+    const active = ((await fs.read(`${root}/active_profile`)) ?? '')
+        .replace(/^\uFEFF/, '')
+        .trim()
+        .toLowerCase();
+    if (active !== '' && active !== 'default') {
+        const profile = `${base}/profiles/${active}`;
+        if (await fs.exists(profile))
+            return profile;
+    }
+    return base;
 }
-export const configureHermes = async ({ apiUrl, model, fs, env, platform }) => {
-    const dir = hermesDir(env, platform, fs);
+export const configureHermes = async ({ apiUrl, model, apiKey, fs, env, platform, contextLength, }) => {
+    const dir = await hermesDir(env, platform, fs);
     const configPath = `${dir}/config.yaml`;
     const envPath = `${dir}/.env`;
-    let content = await fs.read(configPath);
-    if (content === undefined) {
-        await fs.write(configPath, DEFAULT_CONFIG);
-        content = DEFAULT_CONFIG;
-    }
-    // Only the FIRST occurrence of each key is ours: a later `default:` belongs to some other block.
-    let didDefault = false;
-    let didProvider = false;
-    let didBaseUrl = false;
-    const patched = lines(content).map((line) => {
-        const t = line.trim();
-        if (!didDefault && t.startsWith('default:')) {
-            didDefault = true;
-            return replaceYamlScalarValue(line, model);
-        }
-        if (!didProvider && t.startsWith('provider:')) {
-            didProvider = true;
-            return replaceYamlScalarValue(line, 'custom');
-        }
-        if (!didBaseUrl && t.startsWith('base_url:')) {
-            didBaseUrl = true;
-            return replaceYamlScalarValue(line, apiUrl);
-        }
-        return line;
-    });
-    // Hermes refuses any model whose context window is below 64K, so the floor is not negotiable.
-    const withProvider = upsertAtomicProvider(patched.join('\n'), apiUrl, model, HERMES_CONTEXT_LENGTH);
-    const withTimeout = upsertProviderRequestTimeout(withProvider, 'custom', REQUEST_TIMEOUT_SECONDS);
-    await fs.write(configPath, content.endsWith('\n') ? endWithNewline(withTimeout) : withTimeout);
+    // The installer runs with `--skip-setup`, so a fresh install may have no config at all; Hermes
+    // fills every key we do not write with its own defaults.
+    const content = (await fs.read(configPath)) ?? '';
+    const previousText = await fs.read(`${configPath}${BACKUP_SUFFIX}`);
+    const previous = previousText === undefined ? undefined : parseHermesBackup(previousText);
+    // Hermes refuses any model whose window is below 64K, so an unknown window is written as that floor;
+    // a known one is written as served.
+    const ctx = contextLength ?? HERMES_CONTEXT_LENGTH;
+    const key = JSON.stringify(apiKey === '' ? 'atomic' : apiKey);
+    const route = [
+        ['default', model],
+        ['provider', 'custom'],
+        ['base_url', apiUrl],
+        ['api_key', key],
+        ['context_length', String(ctx)],
+    ];
+    const patched = patchModelSection(content, route);
+    const [withProvider, addedList] = upsertAtomicProvider(patched, apiUrl, model, ctx, key);
+    const [withTimeout, created] = upsertProviderRequestTimeout(withProvider, 'custom', REQUEST_TIMEOUT_SECONDS);
+    if (addedList)
+        created.push('custom_providers');
     // Bypass a system proxy for loopback. Only ever a patch: we never create the file.
     const envContent = await fs.read(envPath);
     if (envContent !== undefined && !envContent.includes('NO_PROXY=') && !envContent.includes('no_proxy=')) {
         const separator = envContent.endsWith('\n') ? '' : '\n';
-        await fs.write(envPath, `${envContent}${separator}\nNO_PROXY=localhost,127.0.0.1,0.0.0.0\nexport no_proxy=localhost,127.0.0.1,0.0.0.0`);
+        await fs.write(envPath, `${envContent}${separator}\n${NO_PROXY_LINE}\n${NO_PROXY_EXPORT_LINE}`);
+        created.push('env.no_proxy');
     }
+    const backup = hermesBackup(content, route, previous, created);
+    await fs.write(configPath, withTimeout);
+    await writeBackupText(fs, configPath, renderHermesBackup(backup));
 };
 registerWriter('hermes', configureHermes);
 //# sourceMappingURL=hermes.js.map