@delorenj/pjangler 1.2.19 → 1.2.25

package/templates/hermes-agent/tests/test_telegram_provisioning.py

@@ -0,0 +1,475 @@
+from __future__ import annotations
+
+import os
+import shutil
+import stat
+import subprocess
+from concurrent.futures import ThreadPoolExecutor
+from pathlib import Path
+
+import yaml
+
+
+ROOT = Path(__file__).parents[1]
+TELEGRAM_SCRIPT = ROOT / "template" / ".scripts" / "30-telegram.sh"
+LIB_SCRIPT = ROOT / "template" / ".scripts" / "_lib.sh"
+REGISTRY_SCRIPT = ROOT / "template" / ".scripts" / "80-registry.sh"
+
+BOT_TOKEN = "123456:profile-only-secret"
+OTHER_TOKEN = "654321:different-profile-secret"
+
+
+def _make_role(tmp_path: Path) -> tuple[Path, Path, Path]:
+    role = tmp_path / "role"
+    scripts = role / ".scripts"
+    runtime = role / "runtime"
+    scripts.mkdir(parents=True)
+    runtime.mkdir()
+    shutil.copy2(TELEGRAM_SCRIPT, scripts / TELEGRAM_SCRIPT.name)
+    shutil.copy2(LIB_SCRIPT, scripts / LIB_SCRIPT.name)
+    (role / "role.yaml").write_text(
+        """repo: demo
+role: pm
+agent_id: demo-pm
+display_name: "Demo PM"
+profile: demo-pm
+telegram:
+  provisioning_status: "deferred"
+  bot_username: "demo_pm_bot"
+  bot_id: ""
+slack:
+  provisioning_status: "deferred"
+  team_id: ""
+  team_name: ""
+  bot_user_id: ""
+  bot_id: ""
+  bot_username: ""
+bloodbank:
+  gateway_scope: fleet
+  target_agent_id: demo-pm
+plane:
+  workspace: "test"
+  identifier: ""
+runtime:
+  github_owner: "test"
+  github_repo: "agent-hm-demo-pm"
+""",
+        encoding="utf-8",
+    )
+    registry = tmp_path / "agents-registry.yaml"
+    registry.write_text("schema_version: 1\nagents: {}\n", encoding="utf-8")
+    return role, runtime, registry
+
+
+def _fake_bin(tmp_path: Path) -> Path:
+    bindir = tmp_path / "bin"
+    bindir.mkdir(exist_ok=True)
+    curl = bindir / "curl"
+    curl.write_text(
+        """#!/usr/bin/env python3
+import json
+import os
+import sys
+
+url = sys.argv[-1]
+expected = os.environ.get("EXPECTED_TELEGRAM_TOKEN", "")
+assert expected and url == f"https://api.telegram.org/bot{expected}/getMe"
+print(json.dumps({"ok": True, "result": {"id": 424242, "username": "verified_demo_bot"}}))
+""",
+        encoding="utf-8",
+    )
+    curl.chmod(0o755)
+    hermes = bindir / "hermes"
+    hermes.write_text("#!/usr/bin/env bash\nexit 0\n", encoding="utf-8")
+    hermes.chmod(0o755)
+    return bindir
+
+
+def _run(
+    role: Path,
+    registry: Path,
+    home: Path,
+    bindir: Path,
+    overrides: dict[str, str] | None = None,
+) -> subprocess.CompletedProcess[str]:
+    env = {
+        key: value
+        for key, value in os.environ.items()
+        if not key.startswith("TELEGRAM_") and key != "SKIP_TELEGRAM"
+    }
+    env.update(
+        {
+            "HOME": str(home),
+            "PATH": f"{bindir}:{env['PATH']}",
+            "HERMES_BIN": str(bindir / "hermes"),
+            "HERMES_FLEET_ENV": str(home / ".hermes" / "fleet.env"),
+            "REGISTRY_FILE": str(registry),
+        }
+    )
+    env.update(overrides or {})
+    return subprocess.run(
+        ["bash", str(role / ".scripts" / "30-telegram.sh")],
+        env=env,
+        input="",
+        text=True,
+        capture_output=True,
+        check=False,
+    )
+
+
+def _inject_parent_fsync_failure(
+    tmp_path: Path, overrides: dict[str, str], parent: Path
+) -> None:
+    site_dir = tmp_path / "fsync-failure-site"
+    site_dir.mkdir()
+    (site_dir / "sitecustomize.py").write_text(
+        """import errno
+import os
+import stat
+
+_real_fsync = os.fsync
+_failed_parent = os.path.realpath(os.environ["FAIL_PARENT_FSYNC"])
+
+def _fsync(fd):
+    if stat.S_ISDIR(os.fstat(fd).st_mode):
+        resolved = os.path.realpath(f"/proc/self/fd/{fd}")
+        if resolved == _failed_parent:
+            raise OSError(errno.EIO, "injected parent directory fsync failure")
+    return _real_fsync(fd)
+
+os.fsync = _fsync
+""",
+        encoding="utf-8",
+    )
+    overrides["PYTHONPATH"] = str(site_dir)
+    overrides["FAIL_PARENT_FSYNC"] = str(parent)
+
+
+def test_telegram_ignores_shared_fleet_token_and_defers_noninteractive(tmp_path: Path) -> None:
+    role, runtime, registry = _make_role(tmp_path)
+    home = tmp_path / "home"
+    fleet = home / ".hermes" / "fleet.env"
+    fleet.parent.mkdir(parents=True)
+    fleet.write_text(
+        f"TELEGRAM_BOT_TOKEN={BOT_TOKEN}\nTELEGRAM_ALLOWED_USERS=111\n",
+        encoding="utf-8",
+    )
+
+    result = _run(role, registry, home, _fake_bin(tmp_path))
+
+    assert result.returncode == 0, result.stderr
+    assert "deferred" in result.stderr
+    assert not (runtime / ".env").exists()
+    assert BOT_TOKEN not in result.stdout + result.stderr
+    assert BOT_TOKEN in fleet.read_text(encoding="utf-8")
+
+
+def test_explicit_token_writes_only_private_runtime_env_and_identity(tmp_path: Path) -> None:
+    role, runtime, registry = _make_role(tmp_path)
+    home = tmp_path / "home"
+    fleet = home / ".hermes" / "fleet.env"
+    fleet.parent.mkdir(parents=True)
+    fleet.write_text("TELEGRAM_ALLOWED_USERS=111,222\n", encoding="utf-8")
+    shared = home / ".hermes" / ".env"
+    shared.write_text("PROVIDER_KEY=keep-me\n", encoding="utf-8")
+
+    result = _run(
+        role,
+        registry,
+        home,
+        _fake_bin(tmp_path),
+        {"TELEGRAM_BOT_TOKEN": BOT_TOKEN, "EXPECTED_TELEGRAM_TOKEN": BOT_TOKEN},
+    )
+
+    assert result.returncode == 0, result.stderr
+    env_file = runtime / ".env"
+    env_text = env_file.read_text(encoding="utf-8")
+    assert f'TELEGRAM_BOT_TOKEN="{BOT_TOKEN}"' in env_text
+    assert 'TELEGRAM_ALLOWED_USERS="111,222"' in env_text
+    assert stat.S_IMODE(env_file.stat().st_mode) == 0o600
+    assert shared.read_text(encoding="utf-8") == "PROVIDER_KEY=keep-me\n"
+    assert fleet.read_text(encoding="utf-8") == "TELEGRAM_ALLOWED_USERS=111,222\n"
+    assert BOT_TOKEN not in result.stdout + result.stderr
+
+    telegram = yaml.safe_load((role / "role.yaml").read_text(encoding="utf-8"))["telegram"]
+    assert telegram == {
+        "provisioning_status": "verified",
+        "bot_username": "verified_demo_bot",
+        "bot_id": "424242",
+    }
+
+
+def test_credential_parent_fsync_failure_is_reported_and_retryable(tmp_path: Path) -> None:
+    role, runtime, registry = _make_role(tmp_path)
+    home = tmp_path / "home"
+    fleet = home / ".hermes" / "fleet.env"
+    fleet.parent.mkdir(parents=True)
+    fleet.write_text("TELEGRAM_ALLOWED_USERS=111\n", encoding="utf-8")
+    bindir = _fake_bin(tmp_path)
+    overrides = {
+        "TELEGRAM_BOT_TOKEN": BOT_TOKEN,
+        "EXPECTED_TELEGRAM_TOKEN": BOT_TOKEN,
+    }
+    _inject_parent_fsync_failure(tmp_path, overrides, runtime)
+
+    failed = _run(role, registry, home, bindir, overrides)
+
+    assert failed.returncode != 0
+    assert "injected parent directory fsync failure" in failed.stderr
+    env_file = runtime / ".env"
+    assert f'TELEGRAM_BOT_TOKEN="{BOT_TOKEN}"' in env_file.read_text(encoding="utf-8")
+    assert stat.S_IMODE(env_file.stat().st_mode) == 0o600
+    assert BOT_TOKEN not in failed.stdout + failed.stderr
+    assert "demo-pm" in yaml.safe_load(registry.read_text(encoding="utf-8"))["agents"]
+    assert not (role / ".scripts" / ".done-30-telegram").exists()
+
+    retried = _run(
+        role,
+        registry,
+        home,
+        bindir,
+        {"TELEGRAM_BOT_TOKEN": BOT_TOKEN, "EXPECTED_TELEGRAM_TOKEN": BOT_TOKEN},
+    )
+
+    assert retried.returncode == 0, retried.stderr
+    assert (role / ".scripts" / ".done-30-telegram").exists()
+
+
+def test_rejects_token_parked_in_shared_fleet_env(tmp_path: Path) -> None:
+    role, runtime, registry = _make_role(tmp_path)
+    home = tmp_path / "home"
+    fleet = home / ".hermes" / "fleet.env"
+    fleet.parent.mkdir(parents=True)
+    fleet.write_text(f"TELEGRAM_BOT_TOKEN={BOT_TOKEN}\n", encoding="utf-8")
+
+    result = _run(
+        role,
+        registry,
+        home,
+        _fake_bin(tmp_path),
+        {
+            "TELEGRAM_BOT_TOKEN": BOT_TOKEN,
+            "TELEGRAM_ALLOWED_USERS": "111",
+            "EXPECTED_TELEGRAM_TOKEN": BOT_TOKEN,
+        },
+    )
+
+    assert result.returncode != 0
+    assert "already assigned to shared fleet environment" in result.stderr
+    assert BOT_TOKEN not in result.stdout + result.stderr
+    assert not (runtime / ".env").exists()
+
+
+def test_rejects_token_reused_by_another_profile(tmp_path: Path) -> None:
+    role, runtime, registry = _make_role(tmp_path)
+    home = tmp_path / "home"
+    home.mkdir()
+    other_role = tmp_path / "other-role"
+    other_runtime = other_role / "runtime"
+    other_runtime.mkdir(parents=True)
+    (other_runtime / ".env").write_text(
+        f'TELEGRAM_BOT_TOKEN="{BOT_TOKEN}"\n', encoding="utf-8"
+    )
+    registry.write_text(
+        yaml.safe_dump(
+            {
+                "schema_version": 1,
+                "agents": {
+                    "other-pm": {
+                        "role_dir": str(other_role),
+                        "telegram": {"bot_id": "999999"},
+                    }
+                },
+            },
+            sort_keys=False,
+        ),
+        encoding="utf-8",
+    )
+
+    result = _run(
+        role,
+        registry,
+        home,
+        _fake_bin(tmp_path),
+        {
+            "TELEGRAM_BOT_TOKEN": BOT_TOKEN,
+            "TELEGRAM_ALLOWED_USERS": "111",
+            "EXPECTED_TELEGRAM_TOKEN": BOT_TOKEN,
+        },
+    )
+
+    assert result.returncode != 0
+    assert "already assigned to agent other-pm" in result.stderr
+    assert BOT_TOKEN not in result.stdout + result.stderr
+    assert not (runtime / ".env").exists()
+
+
+def test_rejects_verified_bot_identity_owned_by_another_agent(tmp_path: Path) -> None:
+    role, runtime, registry = _make_role(tmp_path)
+    home = tmp_path / "home"
+    home.mkdir()
+    registry.write_text(
+        yaml.safe_dump(
+            {
+                "schema_version": 1,
+                "agents": {
+                    "other-pm": {
+                        "telegram": {
+                            "provisioning_status": "verified",
+                            "bot_username": "verified_demo_bot",
+                            "bot_id": "424242",
+                        }
+                    }
+                },
+            },
+            sort_keys=False,
+        ),
+        encoding="utf-8",
+    )
+
+    result = _run(
+        role,
+        registry,
+        home,
+        _fake_bin(tmp_path),
+        {
+            "TELEGRAM_BOT_TOKEN": OTHER_TOKEN,
+            "TELEGRAM_ALLOWED_USERS": "111",
+            "EXPECTED_TELEGRAM_TOKEN": OTHER_TOKEN,
+        },
+    )
+
+    assert result.returncode != 0
+    assert "bot identity is already assigned to agent other-pm" in result.stderr
+    assert OTHER_TOKEN not in result.stdout + result.stderr
+    assert not (runtime / ".env").exists()
+
+
+def test_refuses_runtime_env_symlink_before_get_me(tmp_path: Path) -> None:
+    role, runtime, registry = _make_role(tmp_path)
+    home = tmp_path / "home"
+    shared = home / ".hermes" / ".env"
+    shared.parent.mkdir(parents=True)
+    shared.write_text("PROVIDER_KEY=keep-me\n", encoding="utf-8")
+    (runtime / ".env").symlink_to(shared)
+
+    result = _run(
+        role,
+        registry,
+        home,
+        _fake_bin(tmp_path),
+        {
+            "TELEGRAM_BOT_TOKEN": BOT_TOKEN,
+            "TELEGRAM_ALLOWED_USERS": "111",
+            "EXPECTED_TELEGRAM_TOKEN": BOT_TOKEN,
+        },
+    )
+
+    assert result.returncode != 0
+    assert "refusing to write Telegram credentials through symlink" in result.stderr
+    assert shared.read_text(encoding="utf-8") == "PROVIDER_KEY=keep-me\n"
+
+
+def test_registry_persists_telegram_identity_without_token(tmp_path: Path) -> None:
+    role, _, registry = _make_role(tmp_path)
+    home = tmp_path / "home"
+    home.mkdir()
+    shutil.copy2(REGISTRY_SCRIPT, role / ".scripts" / REGISTRY_SCRIPT.name)
+    role_yaml = role / "role.yaml"
+    role_yaml.write_text(
+        role_yaml.read_text(encoding="utf-8")
+        .replace('provisioning_status: "deferred"', 'provisioning_status: "verified"', 1)
+        .replace('bot_username: "demo_pm_bot"', 'bot_username: "verified_demo_bot"')
+        .replace('bot_id: ""', 'bot_id: "424242"', 1),
+        encoding="utf-8",
+    )
+    env = {
+        key: value for key, value in os.environ.items() if not key.startswith("TELEGRAM_")
+    }
+    env.update(
+        {
+            "HOME": str(home),
+            "HERMES_FLEET_ENV": str(home / ".hermes" / "fleet.env"),
+            "REGISTRY_FILE": str(registry),
+        }
+    )
+
+    result = subprocess.run(
+        ["bash", str(role / ".scripts" / "80-registry.sh")],
+        env=env,
+        text=True,
+        capture_output=True,
+        check=False,
+    )
+
+    assert result.returncode == 0, result.stderr
+    serialized = registry.read_text(encoding="utf-8")
+    entry = yaml.safe_load(serialized)["agents"]["demo-pm"]
+    assert entry["telegram"] == {
+        "provisioning_status": "verified",
+        "bot_username": "verified_demo_bot",
+        "bot_id": "424242",
+    }
+    assert "TELEGRAM_BOT_TOKEN" not in serialized
+
+
+def test_concurrent_profiles_cannot_claim_same_telegram_identity(tmp_path: Path) -> None:
+    role_a, _, _ = _make_role(tmp_path / "a")
+    role_b, _, _ = _make_role(tmp_path / "b")
+    role_b_yaml = role_b / "role.yaml"
+    role_b_yaml.write_text(
+        role_b_yaml.read_text(encoding="utf-8").replace("demo-pm", "demo-reviewer"),
+        encoding="utf-8",
+    )
+    registry = tmp_path / "agents-registry.yaml"
+    registry.write_text("schema_version: 1\nagents: {}\n", encoding="utf-8")
+    home = tmp_path / "home"
+    home.mkdir()
+    bindir = _fake_bin(tmp_path)
+    overrides = {
+        "TELEGRAM_BOT_TOKEN": BOT_TOKEN,
+        "TELEGRAM_ALLOWED_USERS": "111",
+        "EXPECTED_TELEGRAM_TOKEN": BOT_TOKEN,
+    }
+
+    with ThreadPoolExecutor(max_workers=2) as pool:
+        results = list(
+            pool.map(
+                lambda role: _run(role, registry, home, bindir, overrides),
+                (role_a, role_b),
+            )
+        )
+
+    assert sorted(result.returncode for result in results) == [0, 1]
+    combined = "".join(result.stdout + result.stderr for result in results)
+    assert "bot identity is already assigned" in combined
+    assert BOT_TOKEN not in combined
+    agents = yaml.safe_load(registry.read_text(encoding="utf-8"))["agents"]
+    assert len(agents) == 1
+    assert next(iter(agents.values()))["telegram"]["bot_id"] == "424242"
+    assert stat.S_IMODE(registry.stat().st_mode) == 0o600
+    assert stat.S_IMODE(Path(f"{registry}.lock").stat().st_mode) == 0o600
+
+
+def test_telegram_refuses_registry_and_lock_symlinks(tmp_path: Path) -> None:
+    role, runtime, _ = _make_role(tmp_path)
+    home = tmp_path / "home"
+    home.mkdir()
+    bindir = _fake_bin(tmp_path)
+    target = tmp_path / "registry-target.yaml"
+    target.write_text("schema_version: 1\nagents: {}\n", encoding="utf-8")
+    registry = tmp_path / "agents-registry.yaml"
+    registry.unlink()
+    registry.symlink_to(target)
+    overrides = {
+        "TELEGRAM_BOT_TOKEN": BOT_TOKEN,
+        "TELEGRAM_ALLOWED_USERS": "111",
+        "EXPECTED_TELEGRAM_TOKEN": BOT_TOKEN,
+    }
+
+    result = _run(role, registry, home, bindir, overrides)
+
+    assert result.returncode != 0
+    assert "refusing" in result.stderr and "symlink" in result.stderr
+    assert not (runtime / ".env").exists()
+    assert target.read_text(encoding="utf-8") == "schema_version: 1\nagents: {}\n"

package/templates/commonproject/template/.mise/scripts/link-project-skills-to-clis.sh

@@ -1,110 +0,0 @@
-#!/bin/bash
-# Fan the project's enabled skill set out to every agent CLI that does NOT read
-# .agents/ natively, as per-skill symlinks.
-#
-#   SSOT:    .agents/skills/   (committed inherited skills + on-enter ./skills/* links)
-#   Targets: a table of per-CLI skill dirs, each with a SCOPE:
-#     global -> a shared per-user dir (e.g. ~/.codex/skills): link ours in, never
-#               clobber foreign entries, removed on leave (unlink-*-from-clis.sh).
-#     local  -> a project-scoped mirror dir (e.g. ./.kimi-code/skills) that is fully
-#               ours: stale real copies / foreign symlinks are replaced, and
-#               disabled/deferred skills are pruned. Persists across leave.
-#
-# Per-dev controls — .agents/local.json (see .agents/local.example.json):
-#   skills.disabled[]       never link these
-#   skills.defer_to_global  if true, skip any skill that ALSO exists in your global
-#                           SSOT (~/.agents/skills) so your global copy wins and you
-#                           get zero duplicates. Teammates omit it → inherit all.
-#
-# Add a CLI: append one "dir|scope" line to SKILL_TARGETS. That's the whole change.
-set -euo pipefail
-
-script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-project_root="$(cd "${script_dir}/../.." && pwd)"
-agents_skills="${project_root}/.agents/skills"
-
-SKILL_TARGETS=(
-  "${CODEX_HOME:-$HOME/.codex}/skills|global"
-  "${project_root}/.kimi-code/skills|local"
-)
-
-local_config="${project_root}/.agents/hooks/lib/local-config.sh"
-if [ -f "$local_config" ]; then
-  # shellcheck source=/dev/null
-  source "$local_config"
-else
-  skill_disabled() { return 1; }
-  skills_defer_to_global() { return 1; }
-  skill_is_global() { return 1; }
-fi
-
-if [ ! -d "$agents_skills" ]; then
-  echo "No .agents/skills/ found. Nothing to fan out."
-  exit 0
-fi
-
-defer=0
-skills_defer_to_global && defer=1
-
-# Should this skill be skipped (disabled, or deferred to the dev's global system)?
-is_skipped() {
-  local name="$1"
-  skill_disabled "$name" && return 0
-  [ "$defer" = "1" ] && skill_is_global "$name" && return 0
-  return 1
-}
-
-# readlink with any trailing slash stripped (older links were stored with one).
-_readlink_norm() {
-  local l; l="$(readlink "$1" 2>/dev/null || echo "")"
-  printf '%s' "${l%/}"
-}
-
-link_into() {
-  local dir="$1" scope="$2" linked=0 skipped=0 pruned=0
-  mkdir -p "$dir"
-  for skill_path in "$agents_skills"/*; do
-    [ -d "$skill_path" ] || continue
-    local name target
-    name="$(basename "$skill_path")"
-    [[ "$name" == ".system" ]] && continue
-    target="${dir}/${name}"
-
-    if is_skipped "$name"; then
-      # Yield the slot: remove a link WE previously made (so the dev's global copy
-      # can claim it), and prune stale entries from our fully-managed mirror.
-      if [ -L "$target" ] && [ "$(_readlink_norm "$target")" = "$skill_path" ]; then
-        rm -f "$target"
-        pruned=$((pruned + 1))
-      elif [ "$scope" = "local" ] && { [ -L "$target" ] || [ -e "$target" ]; }; then
-        rm -rf "$target"
-        pruned=$((pruned + 1))
-      fi
-      skipped=$((skipped + 1))
-      continue
-    fi
-
-    if [ -L "$target" ] && [ "$(_readlink_norm "$target")" = "$skill_path" ]; then
-      linked=$((linked + 1))
-      continue
-    fi
-
-    if [ -e "$target" ] || [ -L "$target" ]; then
-      if [ "$scope" = "local" ]; then
-        rm -rf "$target"            # our mirror: replace stale copy / foreign link
-      else
-        skipped=$((skipped + 1))    # shared dir: leave foreign entries untouched
-        continue
-      fi
-    fi
-
-    ln -s "$skill_path" "$target"
-    linked=$((linked + 1))
-  done
-  echo "  ${dir} (${scope}): ${linked} linked, ${skipped} skipped, ${pruned} pruned"
-}
-
-echo "Fanning .agents/skills -> agent CLIs (defer_to_global=${defer})"
-for entry in "${SKILL_TARGETS[@]}"; do
-  link_into "${entry%%|*}" "${entry##*|}"
-done

package/templates/commonproject/template/.mise/scripts/unlink-project-skills-from-clis.sh

@@ -1,45 +0,0 @@
-#!/bin/bash
-# Remove this project's skill symlinks from shared (global-scope) per-CLI dirs on
-# leave, so other projects / your global setup aren't polluted. Project-scoped
-# (local-scope) mirrors like ./.kimi-code/skills are left in place — they belong
-# to the repo and cost nothing to keep.
-#
-# Mirrors the SKILL_TARGETS table in link-project-skills-to-clis.sh.
-set -euo pipefail
-
-script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-project_root="$(cd "${script_dir}/../.." && pwd)"
-agents_skills="${project_root}/.agents/skills"
-
-SKILL_TARGETS=(
-  "${CODEX_HOME:-$HOME/.codex}/skills|global"
-  "${project_root}/.kimi-code/skills|local"
-)
-
-[ -d "$agents_skills" ] || exit 0
-
-_readlink_norm() {
-  local l; l="$(readlink "$1" 2>/dev/null || echo "")"
-  printf '%s' "${l%/}"
-}
-
-for entry in "${SKILL_TARGETS[@]}"; do
-  dir="${entry%%|*}"
-  scope="${entry##*|}"
-  [ "$scope" = "global" ] || continue
-  [ -d "$dir" ] || continue
-
-  unlinked=0
-  for skill_path in "$agents_skills"/*; do
-    [ -e "$skill_path" ] || continue
-    name="$(basename "$skill_path")"
-    [[ "$name" == ".system" ]] && continue
-    target="${dir}/${name}"
-    if [ -L "$target" ] && [ "$(_readlink_norm "$target")" = "$skill_path" ]; then
-      rm "$target"
-      unlinked=$((unlinked + 1))
-    fi
-  done
-  [ "$unlinked" -gt 0 ] && echo "Unlinked ${unlinked} project skill(s) from ${dir}"
-done
-exit 0

package/templates/hermes-agent/.codegraph/daemon.pid

@@ -1,6 +0,0 @@
-{
-  "pid": 868618,
-  "version": "0.9.9",
-  "socketPath": "/home/delorenj/code/hermes-agent-template/.codegraph/daemon.sock",
-  "startedAt": 1782538939056
-}

package/templates/hermes-agent/.omo/run-continuation/ses_0e5b28303ffeXxL53hZjKggXDW.json

@@ -1,10 +0,0 @@
-{
-  "sessionID": "ses_0e5b28303ffeXxL53hZjKggXDW",
-  "updatedAt": "2026-06-30T21:06:55.034Z",
-  "sources": {
-    "background-task": {
-      "state": "idle",
-      "updatedAt": "2026-06-30T21:06:55.034Z"
-    }
-  }
-}