@botcord/daemon 0.2.27 → 0.2.29

package/src/gateway/runtimes/hermes-agent.ts

@@ -1,8 +1,10 @@
-import { mkdirSync, renameSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
 import path from "node:path";
 import {
   agentHermesHomeDir,
   agentHermesWorkspaceDir,
+  ensureAttachedHermesProfileSkills,
   ensureAgentHermesWorkspace,
 } from "../../agent-workspace.js";
 import { buildCliEnv } from "../cli-resolver.js";
@@ -65,6 +67,139 @@ export function probeHermesAgent(deps: ProbeDeps = {}): RuntimeProbeResult {
   };
 }
 
+/**
+ * Discovered hermes profile entry (daemon-side shape; wire shape lives in
+ * protocol-core's `HermesProfileProbe`). Occupancy is filled in later by
+ * `provision.ts` from local credentials, not here.
+ */
+export interface HermesProfileInfo {
+  name: string;
+  home: string;
+  isDefault?: boolean;
+  isActive?: boolean;
+  modelName?: string;
+  sessionsCount?: number;
+  hasSoul?: boolean;
+}
+
+/**
+ * Resolve the hermes root (`~/.hermes`) — this is the location of the
+ * synthetic `default` profile per upstream's "default profile = HERMES_HOME
+ * itself" convention (`hermes_cli/profiles.py:8`).
+ */
+export function hermesRootDir(): string {
+  return path.join(homedir(), ".hermes");
+}
+
+/** Profile-name shape mirrors `hermes_cli/profiles.py:_PROFILE_ID_RE`. */
+const HERMES_PROFILE_NAME_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+
+export function isValidHermesProfileName(name: string): boolean {
+  return name === "default" || HERMES_PROFILE_NAME_RE.test(name);
+}
+
+/**
+ * Resolve a hermes profile's HERMES_HOME directory. `default` maps to
+ * `~/.hermes`; all other names map to `~/.hermes/profiles/<name>`. Mirrors
+ * `hermes_cli/profiles.py:get_profile_dir`.
+ */
+export function hermesProfileHomeDir(name: string): string {
+  if (!isValidHermesProfileName(name)) {
+    throw new Error(`Invalid hermes profile name: ${name}`);
+  }
+  if (name === "default") return hermesRootDir();
+  return path.join(hermesRootDir(), "profiles", name);
+}
+
+function readActiveProfileName(): string {
+  try {
+    const raw = readFileSync(path.join(hermesRootDir(), "active_profile"), "utf8").trim();
+    return raw || "default";
+  } catch {
+    return "default";
+  }
+}
+
+function readProfileModelName(profileHome: string): string | undefined {
+  try {
+    const raw = readFileSync(path.join(profileHome, "config.yaml"), "utf8");
+    // Cheap surface-level YAML peek — config.yaml's first block is
+    // `model:\n  default: <name>`. Avoid pulling in a YAML dependency for
+    // a single optional field.
+    const match = raw.match(/^model:\s*\n(?:[ \t]+[^\n]*\n)*?[ \t]+default:\s*([^\n#]+)/m);
+    if (!match) return undefined;
+    return match[1].trim().replace(/^['"]|['"]$/g, "") || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function countSessions(profileHome: string): number | undefined {
+  try {
+    const dir = path.join(profileHome, "sessions");
+    if (!existsSync(dir)) return 0;
+    return readdirSync(dir).filter((f) => f.endsWith(".jsonl")).length;
+  } catch {
+    return undefined;
+  }
+}
+
+function hasSoul(profileHome: string): boolean {
+  return existsSync(path.join(profileHome, "SOUL.md"));
+}
+
+/**
+ * Enumerate available hermes profiles on this device. Pure local filesystem
+ * scan — does not invoke any hermes binary. Returns the synthetic `default`
+ * entry first when `~/.hermes` exists (which it should, given that the probe
+ * already located `hermes-acp`); each `~/.hermes/profiles/<name>/` directory
+ * follows.
+ */
+export function listHermesProfiles(): HermesProfileInfo[] {
+  const out: HermesProfileInfo[] = [];
+  const root = hermesRootDir();
+  const active = readActiveProfileName();
+
+  if (existsSync(root)) {
+    out.push({
+      name: "default",
+      home: root,
+      isDefault: true,
+      isActive: active === "default",
+      modelName: readProfileModelName(root),
+      sessionsCount: countSessions(root),
+      hasSoul: hasSoul(root),
+    });
+  }
+
+  const profilesDir = path.join(root, "profiles");
+  let entries: string[] = [];
+  try {
+    entries = readdirSync(profilesDir);
+  } catch {
+    return out;
+  }
+  for (const name of entries) {
+    if (!HERMES_PROFILE_NAME_RE.test(name)) continue;
+    const home = path.join(profilesDir, name);
+    try {
+      if (!statSync(home).isDirectory()) continue;
+    } catch {
+      continue;
+    }
+    out.push({
+      name,
+      home,
+      isActive: active === name,
+      modelName: readProfileModelName(home),
+      sessionsCount: countSessions(home),
+      hasSoul: hasSoul(home),
+    });
+  }
+
+  return out;
+}
+
 /**
  * Hermes Agent adapter. Drives `hermes-acp` (the ACP stdio adapter shipped
  * with `pip install "hermes-agent[acp]"`).
@@ -141,7 +276,15 @@ export class HermesAgentAdapter extends AcpRuntimeAdapter {
       // Route dangerous tool calls through ACP request_permission.
       HERMES_INTERACTIVE: "1",
     };
-    if (opts.accountId) {
+    // Attach mode: BotCord agent shares a hermes profile (state.db /
+    // sessions / skills / .env) with the user's command-line `hermes`. In
+    // this mode we DO NOT seed a private home — AGENTS.md is written under
+    // the per-agent hermes-workspace cwd (NOT into the profile root) by
+    // `prepareTurn`, while bundled BotCord skills are installed into the
+    // attached profile's `skills/` directory so hermes can discover them.
+    if (opts.hermesProfile) {
+      env.HERMES_HOME = hermesProfileHomeDir(opts.hermesProfile);
+    } else if (opts.accountId) {
       env.HERMES_HOME = agentHermesHomeDir(opts.accountId);
     }
     return env;
@@ -160,7 +303,12 @@ export class HermesAgentAdapter extends AcpRuntimeAdapter {
    */
   protected prepareTurn(opts: RuntimeRunOptions): void {
     if (!opts.accountId) return;
-    const { hermesWorkspace } = ensureAgentHermesWorkspace(opts.accountId);
+    const { hermesWorkspace } = ensureAgentHermesWorkspace(opts.accountId, {
+      attached: !!opts.hermesProfile,
+    });
+    if (opts.hermesProfile) {
+      ensureAttachedHermesProfileSkills(hermesProfileHomeDir(opts.hermesProfile));
+    }
     const target = path.join(hermesWorkspace, "AGENTS.md");
     const tmp = path.join(hermesWorkspace, `.AGENTS.md.${process.pid}.tmp`);
     mkdirSync(hermesWorkspace, { recursive: true, mode: 0o700 });

package/src/gateway/runtimes/openclaw-acp.ts

@@ -140,9 +140,11 @@ interface SpawnDeps {
  *
  * Spawns `openclaw acp --url <gateway> [--token <token>]` per
  * `(accountId, gatewayName)` pair and reuses the process across turns. The
- * child speaks JSON-RPC over stdio; we send `initialize` once, then
- * `newSession` (with `_meta.sessionKey`) when the daemon has no persisted
- * runtime session id, and `prompt` for each turn. Streaming `session/update`
+ * child speaks JSON-RPC over stdio; we send `initialize` once, then derive a
+ * stable OpenClaw `sessionKey` for the BotCord conversation. The persisted
+ * `runtimeSessionId` is only an ACP transport handle cached from a previous
+ * turn, so every resume first goes through `session/load` with
+ * `_meta.sessionKey` before `prompt`. Streaming `session/update`
  * notifications are relayed to `onBlock`.
  *
  * Process-pool lifetime + abort/cancel semantics live at module scope; see
@@ -190,6 +192,8 @@ export class OpenclawAcpAdapter implements RuntimeAdapter {
     handle.inFlight += 1;
     if (handle.idleTimer) clearTimeout(handle.idleTimer);
 
+    // ACP session ids are process-local transport handles. They are useful as
+    // a cache, but the stable conversation identity is `sessionKey`.
     let acpSessionId = opts.sessionId ?? "";
     let seq = 0;
     let assistantText = "";
@@ -230,8 +234,27 @@ export class OpenclawAcpAdapter implements RuntimeAdapter {
 
     let abortListener: (() => void) | undefined;
     try {
-      // Ensure we have an ACP session id. When the dispatcher doesn't carry
-      // one, ask the child to create or rebind one for our sessionKey.
+      // Ensure we have a live ACP transport session. If the dispatcher passes a
+      // cached session id, ask OpenClaw to load/rebind it with the stable
+      // sessionKey. If that handle is gone, discard it and create a fresh one.
+      if (acpSessionId) {
+        try {
+          acpSessionId = await this.loadSession(handle, {
+            sessionId: acpSessionId,
+            cwd: opts.cwd,
+            sessionKey,
+          });
+        } catch (err) {
+          if (!isSessionNotFoundError(err)) throw err;
+          log.warn("openclaw-acp.session-load-not-found", {
+            accountId: opts.accountId,
+            oldSessionId: acpSessionId,
+            sessionKey,
+          });
+          acpSessionId = "";
+        }
+      }
+
       if (!acpSessionId) {
         try {
           acpSessionId = await this.newSession(handle, {
@@ -261,11 +284,16 @@ export class OpenclawAcpAdapter implements RuntimeAdapter {
           text: opts.text,
         });
       } catch (err) {
-        const msg = (err as Error).message ?? "prompt failed";
         // If the child says the session is gone (process restart, GC),
         // recreate it so the next turn doesn't hard-fail.
-        if (/session not found|unknown session/i.test(msg)) {
+        if (isSessionNotFoundError(err)) {
           try {
+            const oldSessionId = acpSessionId;
+            log.warn("openclaw-acp.prompt-session-not-found-retry", {
+              accountId: opts.accountId,
+              oldSessionId,
+              sessionKey,
+            });
             const fresh = await this.newSession(handle, {
               cwd: opts.cwd,
               sessionKey,
@@ -273,6 +301,12 @@ export class OpenclawAcpAdapter implements RuntimeAdapter {
             handle.subscribers.delete(acpSessionId);
             acpSessionId = fresh;
             handle.subscribers.set(acpSessionId, onNotification);
+            log.info("openclaw-acp.session-recreated", {
+              accountId: opts.accountId,
+              oldSessionId,
+              newSessionId: acpSessionId,
+              sessionKey,
+            });
             promptResult = await this.prompt(handle, {
               sessionId: acpSessionId,
               text: opts.text,
@@ -299,7 +333,11 @@ export class OpenclawAcpAdapter implements RuntimeAdapter {
         newSessionId: acpSessionId,
       };
     } catch (err) {
-      return failResult(acpSessionId, `openclaw-acp: ${(err as Error).message}`);
+      const message = err instanceof Error ? err.message : String(err);
+      return failResult(
+        isSessionNotFoundError(err) ? "" : acpSessionId,
+        `openclaw-acp: ${message}`,
+      );
     } finally {
       if (abortListener && opts.signal) {
         try {
@@ -426,6 +464,22 @@ export class OpenclawAcpAdapter implements RuntimeAdapter {
     return result.sessionId;
   }
 
+  private async loadSession(
+    handle: AcpProcessHandle,
+    args: { sessionId: string; cwd: string; sessionKey: string },
+  ): Promise<string> {
+    const result = (await sendRequest(handle, "session/load", {
+      sessionId: args.sessionId,
+      cwd: args.cwd,
+      mcpServers: [],
+      _meta: { sessionKey: args.sessionKey },
+    })) as { sessionId?: string } | null;
+    if (result?.sessionId && typeof result.sessionId === "string") {
+      return result.sessionId;
+    }
+    return args.sessionId;
+  }
+
   private async prompt(
     handle: AcpProcessHandle,
     args: { sessionId: string; text: string },
@@ -469,7 +523,7 @@ function routeMessage(handle: AcpProcessHandle, msg: any): void {
     if (!pending) return;
     handle.pending.delete(id);
     if (msg.error) {
-      const message = typeof msg.error?.message === "string" ? msg.error.message : "rpc error";
+      const message = formatRpcError(msg.error);
       pending.reject(new Error(message));
     } else {
       pending.resolve(msg.result);
@@ -539,6 +593,25 @@ function failResult(sessionId: string, error: string): RuntimeRunResult {
   };
 }
 
+function formatRpcError(error: unknown): string {
+  if (!error || typeof error !== "object") return "rpc error";
+  const e = error as Record<string, unknown>;
+  const message = typeof e.message === "string" ? e.message : "rpc error";
+  const data = e.data;
+  if (data && typeof data === "object") {
+    const details = (data as Record<string, unknown>).details;
+    if (typeof details === "string" && details.length > 0) {
+      return `${message}: ${details}`;
+    }
+  }
+  return message;
+}
+
+function isSessionNotFoundError(err: unknown): boolean {
+  const msg = err instanceof Error ? err.message : String(err);
+  return /session(?:\s+[\w-]+)?\s+not\s+found|unknown\s+session/i.test(msg);
+}
+
 function classifyAcpUpdate(note: AcpNotification): StreamBlock["kind"] {
   const update = note.params?.update;
   const kind: string | undefined = update?.sessionUpdate;

package/src/gateway/types.ts

@@ -45,6 +45,14 @@ export interface GatewayRoute {
   trustLevel?: TrustLevel;
   /** Required when `runtime === "openclaw-acp"`. Resolved at config-load time. */
   gateway?: ResolvedOpenclawGateway;
+  /**
+   * Hermes profile name to attach to. Set when `runtime === "hermes-agent"`
+   * and the agent is bound to a specific `~/.hermes/profiles/<name>/`. The
+   * dispatcher forwards this to the adapter as
+   * {@link RuntimeRunOptions.hermesProfile}, which is what the adapter uses
+   * to switch `HERMES_HOME` at spawn time.
+   */
+  hermesProfile?: string;
 }
 
 // ---------------------------------------------------------------------------
@@ -362,6 +370,15 @@ export interface RuntimeRunOptions {
    * lifting service URLs out of `extraArgs` into typed first-class fields.
    */
   gateway?: ResolvedOpenclawGateway;
+  /**
+   * Hermes profile to attach to. Only meaningful when `runtime ===
+   * "hermes-agent"`. When set, the adapter switches
+   * `HERMES_HOME=~/.hermes/profiles/<name>/` (or `~/.hermes` for `default`)
+   * so the BotCord agent shares state.db / sessions / skills with the
+   * user's command-line `hermes`. Mirrors how `gateway` is lifted out of
+   * `extraArgs` for the openclaw-acp runtime.
+   */
+  hermesProfile?: string;
 }
 
 /** Result returned by a runtime adapter after a turn completes. */

package/src/openclaw-discovery.ts

@@ -5,7 +5,11 @@ import type { DaemonConfig, OpenclawGatewayProfile } from "./config.js";
 import { log as daemonLog } from "./log.js";
 import { probeOpenclawAgents, type WsEndpointProbeFn } from "./provision.js";
 
-export type DiscoveredOpenclawGatewaySource = "config-file" | "env" | "default-port";
+export type DiscoveredOpenclawGatewaySource =
+  | "config-file"
+  | "env"
+  | "systemd-unit"
+  | "default-port";
 
 export interface DiscoveredOpenclawGateway {
   name: string;
@@ -21,6 +25,7 @@ export interface OpenclawGatewayDiscoveryOptions {
   probe?: WsEndpointProbeFn;
   timeoutMs?: number;
   env?: NodeJS.ProcessEnv;
+  systemdUnitPaths?: string[];
 }
 
 export interface MergeOpenclawGatewayResult {
@@ -36,6 +41,14 @@ const DEFAULT_TOKEN_FILE_PATHS = [
   "/var/run/openclaw/gateway-token",
   "~/.openclaw/gateway-token",
 ];
+const DEFAULT_SYSTEMD_UNIT_PATHS = [
+  "/etc/systemd/system/openclaw.service",
+  "/etc/systemd/system/openclaw-gateway.service",
+  "/lib/systemd/system/openclaw.service",
+  "/lib/systemd/system/openclaw-gateway.service",
+  "/usr/lib/systemd/system/openclaw.service",
+  "/usr/lib/systemd/system/openclaw-gateway.service",
+];
 
 export async function discoverLocalOpenclawGateways(
   opts: OpenclawGatewayDiscoveryOptions = {},
@@ -47,6 +60,7 @@ export async function discoverLocalOpenclawGateways(
 
   const env = opts.env ?? process.env;
   found.push(...discoverFromEnv(env));
+  found.push(...discoverFromSystemdUnits(opts.systemdUnitPaths ?? DEFAULT_SYSTEMD_UNIT_PATHS));
   const envAuth = pickOpenclawEnvAuth(env) ?? pickDefaultTokenFile();
 
   const ports = opts.defaultPorts ?? DEFAULT_PORTS;
@@ -75,6 +89,164 @@ export async function discoverLocalOpenclawGateways(
   return dedupeDiscovered(found);
 }
 
+function discoverFromSystemdUnits(paths: string[]): DiscoveredOpenclawGateway[] {
+  const out: DiscoveredOpenclawGateway[] = [];
+  for (const unitPath of paths) {
+    try {
+      if (!existsSync(unitPath)) continue;
+      const parsed = parseSystemdUnit(readFileSync(unitPath, "utf8"), path.dirname(unitPath));
+      const url = parsed.url ?? urlFromGatewayPort(parsed.env);
+      if (!url) continue;
+      const auth = pickOpenclawEnvAuth(parsed.env);
+      out.push({
+        name: nameFromUrl(url),
+        url,
+        source: "systemd-unit",
+        ...auth,
+      });
+    } catch (err) {
+      daemonLog.debug("openclaw discovery systemd unit skipped", {
+        file: unitPath,
+        error: err instanceof Error ? err.message : String(err),
+      });
+    }
+  }
+  return out;
+}
+
+function parseSystemdUnit(
+  raw: string,
+  unitDir: string,
+): { env: NodeJS.ProcessEnv; url?: string } {
+  const env: NodeJS.ProcessEnv = {};
+  let url: string | undefined;
+  for (const line of joinedSystemdLines(raw)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eq = trimmed.indexOf("=");
+    if (eq <= 0) continue;
+    const key = trimmed.slice(0, eq);
+    const value = trimmed.slice(eq + 1).trim();
+    if (key === "Environment") {
+      Object.assign(env, parseSystemdEnvironment(value));
+    } else if (key === "EnvironmentFile") {
+      for (const file of splitSystemdWords(value)) {
+        const optional = file.startsWith("-");
+        const resolved = path.resolve(unitDir, expandHome(optional ? file.slice(1) : file));
+        try {
+          Object.assign(env, parseEnvFile(readFileSync(resolved, "utf8")));
+        } catch (err) {
+          if (!optional) {
+            daemonLog.debug("openclaw discovery environment file skipped", {
+              file: resolved,
+              error: err instanceof Error ? err.message : String(err),
+            });
+          }
+        }
+      }
+    } else if (key === "ExecStart") {
+      url = urlFromExecStart(value) ?? url;
+    }
+  }
+  return { env, url };
+}
+
+function joinedSystemdLines(raw: string): string[] {
+  const out: string[] = [];
+  let cur = "";
+  for (const line of raw.split(/\r?\n/)) {
+    const trimmedEnd = line.replace(/\s+$/, "");
+    if (trimmedEnd.endsWith("\\")) {
+      cur += trimmedEnd.slice(0, -1) + " ";
+      continue;
+    }
+    out.push(cur + line);
+    cur = "";
+  }
+  if (cur) out.push(cur);
+  return out;
+}
+
+function parseSystemdEnvironment(raw: string): NodeJS.ProcessEnv {
+  const env: NodeJS.ProcessEnv = {};
+  for (const word of splitSystemdWords(raw)) {
+    const eq = word.indexOf("=");
+    if (eq <= 0) continue;
+    env[word.slice(0, eq)] = word.slice(eq + 1);
+  }
+  return env;
+}
+
+function parseEnvFile(raw: string): NodeJS.ProcessEnv {
+  const env: NodeJS.ProcessEnv = {};
+  for (const line of raw.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eq = trimmed.indexOf("=");
+    if (eq <= 0) continue;
+    env[trimmed.slice(0, eq)] = unquote(trimmed.slice(eq + 1).trim());
+  }
+  return env;
+}
+
+function urlFromExecStart(raw: string): string | undefined {
+  const words = splitSystemdWords(raw);
+  const portIdx = words.indexOf("--port");
+  const rawPort =
+    portIdx >= 0 ? words[portIdx + 1] : words.find((w) => w.startsWith("--port="))?.slice(7);
+  if (!rawPort) return undefined;
+  const port = Number(rawPort);
+  if (!Number.isInteger(port) || port <= 0 || port > 65535) return undefined;
+  return `ws://127.0.0.1:${port}`;
+}
+
+function splitSystemdWords(raw: string): string[] {
+  const words: string[] = [];
+  let cur = "";
+  let quote: '"' | "'" | null = null;
+  let escaped = false;
+  for (const ch of raw) {
+    if (escaped) {
+      cur += ch;
+      escaped = false;
+      continue;
+    }
+    if (ch === "\\") {
+      escaped = true;
+      continue;
+    }
+    if (quote) {
+      if (ch === quote) quote = null;
+      else cur += ch;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      if (cur) {
+        words.push(cur);
+        cur = "";
+      }
+      continue;
+    }
+    cur += ch;
+  }
+  if (cur) words.push(cur);
+  return words.map(unquote);
+}
+
+function unquote(raw: string): string {
+  if (
+    (raw.startsWith('"') && raw.endsWith('"')) ||
+    (raw.startsWith("'") && raw.endsWith("'"))
+  ) {
+    return raw.slice(1, -1);
+  }
+  return raw;
+}
+
 function discoverFromEnv(env: NodeJS.ProcessEnv): DiscoveredOpenclawGateway[] {
   const url =
     pickEnv(env, "OPENCLAW_ACP_URL") ??
@@ -275,8 +447,9 @@ function pickString(obj: Record<string, unknown>, keys: string[]): string | unde
 
 function dedupeDiscovered(items: DiscoveredOpenclawGateway[]): DiscoveredOpenclawGateway[] {
   const priority: Record<DiscoveredOpenclawGatewaySource, number> = {
-    "config-file": 3,
-    env: 2,
+    "config-file": 4,
+    env: 3,
+    "systemd-unit": 2,
     "default-port": 1,
   };
   const byUrl = new Map<string, DiscoveredOpenclawGateway>();
@@ -343,6 +516,10 @@ export function defaultOpenclawDiscoveryTokenFilePaths(): string[] {
   return DEFAULT_TOKEN_FILE_PATHS.slice();
 }
 
+export function defaultOpenclawDiscoverySystemdUnitPaths(): string[] {
+  return DEFAULT_SYSTEMD_UNIT_PATHS.slice();
+}
+
 export function openclawDiscoveryConfigEnabled(cfg: DaemonConfig): boolean {
   return cfg.openclawDiscovery?.enabled !== false;
 }