@delorenj/pjangler 1.2.25 → 1.2.33

package/templates/commonproject/template/mise.toml.jinja

@@ -18,9 +18,12 @@ _.file = [".env"]
 [[hooks.enter]]
 script = "'{% raw %}{{config_root}}{% endraw %}/.mise/scripts/link-agentfiles.sh'"
 [[hooks.enter]]
-script = "op inject -i .env.op > .env"
+# Atomic (PJAN-24/PJAN-57): shell complexity lives in the managed script so
+# mise never interpolates temporary variables. The script uses mktemp, traps
+# cleanup, and replaces .env only after op inject succeeds.
+script = "'{% raw %}{{config_root}}{% endraw %}/.mise/scripts/materialize-env.sh'"
 [[hooks.enter]]
-script = "python3 '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/provision-bmad-skills.py'"
+script = "python3 '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/provision-packs.py'"
 [[hooks.enter]]
 script = "python3 '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/sync-skills.py' --scope project"
 [[hooks.enter]]
@@ -52,12 +55,12 @@ run = "'{% raw %}{{config_root}}{% endraw %}/.mise/scripts/link-agentfiles.sh'"
 
 [tasks.skills-sync]
 description = "Sync skills from manifest to local CLI dirs"
-depends = ["skills-provision-bmad"]
+depends = ["skills-provision-packs"]
 run = "python3 '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/sync-skills.py' --scope project"
 
-[tasks.skills-provision-bmad]
-description = "Provision pinned BMAD skills from the Skillex pack"
-run = "python3 '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/provision-bmad-skills.py'"
+[tasks.skills-provision-packs]
+description = "Provision every Skillex pack declared in .agents/skills.json"
+run = "python3 '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/provision-packs.py'"
 {% if agent_hooks_layer %}
 # --- Project-scoped agent hooks + skill fan-out (see .agents/hooks/README.md) ---
 
@@ -74,5 +77,5 @@ description = "Remove per-user agent-hook injections (codex/kimi/hermes)"
 run = "'{% raw %}{{config_root}}{% endraw %}/.agents/hooks/sync.py' --uninstall"
 {% endif %}
 [tasks.hindsight-setup]
-description = "Provision this dev's shared project Hindsight key from 1Password into .env (op inject)"
+description = "Provision this dev's shared project Hindsight key from 1Password into .env (op read; upserts those two keys, leaves the rest of .env intact)"
 run = "'{% raw %}{{config_root}}{% endraw %}/.mise/scripts/hindsight-setup.sh'"

package/templates/hermes-agent/copier.yml

@@ -52,6 +52,7 @@ role:
     "Project Manager (pm)": pm
     "Developer (dev)": dev
     "Reviewer (review)": review
+    "Company Reporter — daily cross-project rollup (reporter)": reporter
     "Ops (ops)": ops
     "QA (qa)": qa
   validator: "{% if not role %}Required{% endif %}"
@@ -68,7 +69,7 @@ ticket_provider:
 agent_purpose:
   type: str
   help: "One-line description of what this agent does in this repo"
-  default: "Project management, triage, and continuous board reconciliation"
+  default: "{% if role == 'reporter' %}Company-wide evidence gathering, freshness-aware daily reporting, and critical delivery monitoring{% else %}Project management, triage, and continuous board reconciliation{% endif %}"
 
 model_provider:
   type: str

package/templates/hermes-agent/template/.gitignore.jinja

@@ -7,3 +7,4 @@ runtime/
 # Provisioning logs are host-local as well.
 .scripts/.provision.log
 .scripts/.last-run
+.scripts/.done-*

package/templates/hermes-agent/template/.scripts/20-runtime-repo.sh

@@ -62,12 +62,62 @@ for path in root.rglob("*"):
         except UnicodeDecodeError:
             pass
 PYEOF
+# Never let a literal secret reach the runtime. The scaffold is rendered from
+# templates, so a leaked credential shows up here before anything is copied.
+python3 "$(dirname "$0")/secret-scan.py" "$TMP"
 cp -an "$TMP/." "$RUNTIME_LOCAL/"
 
 # Seed mutable identity/config only when no local value exists.
-CANONICAL_PM_CONFIG="$(config_get fleet.canonical_pm_config "$HOME/.hermes/config.yaml")"
-if [[ -f "$CANONICAL_PM_CONFIG" && ! -e "$RUNTIME_LOCAL/config.yaml" ]]; then
-  cp "$CANONICAL_PM_CONFIG" "$RUNTIME_LOCAL/config.yaml"
+if [[ "$ROLE" == "reporter" ]]; then
+  # Generate a delta-only runtime config for least-privilege reporters. Never copy the shared PM
+  # config: it may carry dashboard credentials, write-capable MCPs, or broad tools.
+  MODEL_PROVIDER="$(yaml_get model.provider)"
+  MODEL_NAME="$(yaml_get model.name)"
+  CANONICAL_SKILLS_DIR="${CANONICAL_SKILLS_DIR:-$(config_get fleet.canonical_skills_dir "$HOME/.agents/skills")}"
+  if [[ ! -e "$RUNTIME_LOCAL/config.yaml" ]]; then
+    python3 - "$RUNTIME_LOCAL/config.yaml" "$PROJECT_PATH" "${HERMES_TIMEZONE:-America/New_York}" \
+      "$MODEL_PROVIDER" "$MODEL_NAME" "$CANONICAL_SKILLS_DIR" "$ROLE" <<'PYEOF'
+import json, pathlib, re, sys
+path, cwd, timezone, provider, model, skills, role = sys.argv[1:8]
+if not re.fullmatch(r"[A-Za-z_]+(?:/[A-Za-z_]+)*", timezone):
+    raise SystemExit("unsafe timezone")
+config = {
+    "timezone": timezone,
+    "terminal": {"cwd": cwd},
+    "skills": {"external_dirs": [skills]},
+}
+if provider or model:
+    config["model"] = {}
+    if provider:
+        config["model"]["provider"] = provider
+    if model:
+        config["model"]["default"] = model
+config["platform_toolsets"] = {
+    "cli": ["web", "delegation", "no_mcp"],
+    "cron": ["web", "delegation", "no_mcp"],
+}
+config["agent"] = {
+    "disabled_toolsets": [
+        "browser", "terminal", "file", "code_execution", "cronjob",
+        "kanban", "homeassistant", "computer_use", "project", "skills",
+    ]
+}
+config["delegation"] = {"max_spawn_depth": 1, "inherit_mcp_toolsets": False}
+pathlib.Path(path).write_text(json.dumps(config, indent=2) + "\n")
+PYEOF
+  fi
+  if [[ ! -e "$RUNTIME_LOCAL/profile.yaml" ]]; then
+    cat > "$RUNTIME_LOCAL/profile.yaml" <<'YAML'
+config:
+  inherit_from: default
+  save_mode: delta
+YAML
+  fi
+else
+  CANONICAL_PM_CONFIG="$(config_get fleet.canonical_pm_config "$HOME/.hermes/config.yaml")"
+  if [[ -f "$CANONICAL_PM_CONFIG" && ! -e "$RUNTIME_LOCAL/config.yaml" ]]; then
+    cp "$CANONICAL_PM_CONFIG" "$RUNTIME_LOCAL/config.yaml"
+  fi
 fi
 if [[ ! -e "$RUNTIME_LOCAL/SOUL.md" ]]; then
   cp "$ROLE_DIR/SOUL.md" "$RUNTIME_LOCAL/SOUL.md"
@@ -78,7 +128,14 @@ fi
 # operator can reconcile it explicitly instead of losing state.
 if [[ -d "$PROFILE_HOME" && ! -L "$PROFILE_HOME" ]]; then
   log "    migrating supported staging profile state into the local runtime"
-  for file_name in .env config.yaml; do
+  # A reporter never inherits .env; its credentials must be provisioned
+  # explicitly against a bot identity it owns.
+  if [[ "$ROLE" == "reporter" ]]; then
+    MIGRATE_FILES=(config.yaml profile.yaml)
+  else
+    MIGRATE_FILES=(.env config.yaml)
+  fi
+  for file_name in "${MIGRATE_FILES[@]}"; do
     [[ -f "$PROFILE_HOME/$file_name" && ! -e "$RUNTIME_LOCAL/$file_name" ]] && cp "$PROFILE_HOME/$file_name" "$RUNTIME_LOCAL/$file_name"
     [[ -f "$PROFILE_HOME/$file_name" ]] && rm -f -- "$PROFILE_HOME/$file_name"
   done

package/templates/hermes-agent/template/.scripts/70-systemd.sh

@@ -5,6 +5,13 @@
 source "$(dirname "$0")/_lib.sh"
 load_role_env
 
+if [[ "$ROLE" == "reporter" ]]; then
+  log "[70] reporter systemd — gateway/consumer intentionally not installed"
+  log "    use the reporter runtime's explicit install command after credential and policy preflight"
+  mark_done 70-systemd
+  exit 0
+fi
+
 RUNTIME="$ROLE_DIR/runtime"
 REPO_ROOT="$(project_repo_path)" || REPO_ROOT="$ROLE_DIR"
 SYS_DIR="$HOME/.config/systemd/user"

package/templates/hermes-agent/template/.scripts/lib/ticket-provider.sh

@@ -1,10 +1,10 @@
 # shellcheck shell=bash
-# Ticket-provider adapter dispatcher — the single seam between the heartbeat
+# Ticket-provider adapter dispatcher — the single seam between the Scrum Master
 # sentinel engine and a concrete ticket system (Linear | Plane | Trello).
 #
 # The engine NEVER calls a provider directly. It calls `tp <op> [args...]`,
-# which dispatches to providers/<provider>.sh. Swapping providers is a one-line
-# config change in role.yaml (ticket_provider.name) — no engine edits.
+# which dispatches to providers/<provider>.sh. Repo-root .project.json owns the
+# provider/board binding; role.yaml is only a legacy provider-name fallback.
 #
 # Contract (operations every provider must implement):
 #   resolve                       -> JSON {provider, board_id, board_url}
@@ -12,14 +12,22 @@
 #   list_issues                   -> JSON [ {id,key,title,state,state_type,
 #                                            updated_at,assignee,url}, ... ]
 #   get_issue <id>                -> JSON {id,key,title,description,acceptance,
-#                                          state,state_type,comments:[...]}
+#                                          state,state_type,comments:[...],
+#                                          attachments:[...]}
 #   comment <id> <body>           -> prints comment id
 #   transition <id> <normalized>  -> moves issue; normalized in
-#                                     backlog|unstarted|started|in_review|completed
+#                                     backlog|unstarted|started|in_review|completed|
+#                                     cancelled
 #   create_board <name> <id> <d>  -> JSON {board_id, board_url}
+#   create_issue [--if-absent] <title> [desc]
+#                                 -> JSON {issue_id, key, issue_url, created}
+#                                    Files a new ticket on the bound board.
+#                                    NOT idempotent by default (two issues may
+#                                    share a title); --if-absent reuses an exact
+#                                    title match and reports created:false.
 #
 # Each provider reads its credentials from the environment (see providers/*.sh
-# headers) and the board binding from role.yaml under `ticket_provider:`.
+# headers) and the board binding from repo-root .project.json.
 
 # Resolve the provider name: explicit env wins, then repo-root .project.json
 # (the SOT), then role.yaml (self-parsed so this works even when _lib.sh /
@@ -92,7 +100,7 @@ tp() {
 }
 
 # Normalized states the engine reasons in. Adapters map these to provider terms.
-TP_STATES="backlog unstarted started in_review completed"
+TP_STATES="backlog unstarted started in_review completed cancelled"
 
 tp_is_valid_state() {
   case " $TP_STATES " in

package/templates/hermes-agent/template/.scripts/providers/linear.sh

@@ -6,7 +6,8 @@
 #   name: linear
 #   team:    <TEAM_KEY>          e.g. DEL
 #   project: "<Project name>"    optional; scopes milestone/issue queries
-#   state_map: { in_review: "In Review", completed: "Done" }   optional overrides
+#   state_map: { in_review: "In Review", completed: "Done",
+#                cancelled: "Canceled" }   optional overrides
 #
 # Implements the contract in lib/ticket-provider.sh. All Linear access goes
 # through GraphQL so the same envelope works in unattended runs.
@@ -79,6 +80,7 @@ TEAM="$(pj_cfg team)"; [ -n "$TEAM" ] || TEAM="$(tp_cfg team)"
 PROJECT="$(pj_cfg project)"; [ -n "$PROJECT" ] || PROJECT="$(tp_cfg project)"
 SM_IN_REVIEW="$(tp_cfg in_review)"; SM_IN_REVIEW="${SM_IN_REVIEW:-In Review}"
 SM_DONE="$(tp_cfg completed)"; SM_DONE="${SM_DONE:-Done}"
+SM_CANCELLED="$(tp_cfg cancelled)"; SM_CANCELLED="${SM_CANCELLED:-Canceled}"
 
 # All Linear ops require the API key; fail fast and clean before any pipe.
 need_key
@@ -143,6 +145,7 @@ print(json.dumps({"id":i.get("id",""),"key":i.get("identifier",""),"title":i.get
     # Map normalized -> a concrete Linear state name, then resolve its id on the team.
     case "$TARGET" in
       completed)  WANT_TYPE=completed; WANT_NAME="$SM_DONE" ;;
+      cancelled)  WANT_TYPE=canceled;  WANT_NAME="$SM_CANCELLED" ;;
       in_review)  WANT_TYPE=started;   WANT_NAME="$SM_IN_REVIEW" ;;
       started)    WANT_TYPE=started;   WANT_NAME="" ;;
       unstarted)  WANT_TYPE=unstarted; WANT_NAME="" ;;
@@ -172,5 +175,42 @@ print(("ok " + (u.get("issue") or {}).get("identifier","")) if u.get("success")
     exec sh "$0" resolve
     ;;
 
+  create_issue)
+    # File a new issue on the bound team. Team comes from resolved config, never
+    # from an argument. Deliberately NOT idempotent by default: two issues may
+    # legitimately share a title. Pass --if-absent to reuse an issue whose title
+    # already matches instead.
+    IF_ABSENT=0
+    case "${1:-}" in --if-absent) IF_ABSENT=1; shift ;; esac
+    TITLE="${1:?usage: create_issue [--if-absent] <title> [description]}"; DESC="${2:-}"
+    [ -n "$TEAM" ] || die "ticket_provider.team (Linear team key) not set"
+    ISSUE=""; CREATED=true
+    if [ "$IF_ABSENT" = 1 ]; then
+      ISSUE="$(gql 'query($k:String!,$t:String!){ issues(first:1, filter:{team:{key:{eq:$k}}, title:{eq:$t}}){nodes{id identifier url}} }' \
+          "$(python3 -c 'import json,sys; print(json.dumps({"k":sys.argv[1],"t":sys.argv[2]}))' "$TEAM" "$TITLE")" \
+        | python3 -c 'import sys,json
+ns=((json.load(sys.stdin).get("issues") or {}).get("nodes")) or []
+print(json.dumps(ns[0]) if ns else "")')"
+      [ -z "$ISSUE" ] || CREATED=false
+    fi
+    if [ -z "$ISSUE" ]; then
+      TEAM_ID="$(gql 'query($k:String!){ teams(filter:{key:{eq:$k}}){nodes{id}} }' "$(printf '{"k":"%s"}' "$TEAM")" \
+        | python3 -c 'import sys,json
+ns=((json.load(sys.stdin).get("teams") or {}).get("nodes")) or []
+print(ns[0].get("id","") if ns else "")')"
+      [ -n "$TEAM_ID" ] || die "no Linear team with key '$TEAM'"
+      ISSUE="$(gql 'mutation($team:String!,$t:String!,$d:String){ issueCreate(input:{teamId:$team,title:$t,description:$d}){ success issue{id identifier url} } }' \
+          "$(python3 -c 'import json,sys; print(json.dumps({"team":sys.argv[1],"t":sys.argv[2],"d":sys.argv[3] or None}))' "$TEAM_ID" "$TITLE" "$DESC")" \
+        | python3 -c 'import sys,json
+r=json.load(sys.stdin).get("issueCreate") or {}
+print(json.dumps(r["issue"]) if r.get("success") and r.get("issue") else "")')"
+    fi
+    [ -n "$ISSUE" ] || die "create_issue failed"
+    printf '%s' "$ISSUE" | CREATED="$CREATED" python3 -c 'import sys,json,os
+i=json.load(sys.stdin)
+print(json.dumps({"issue_id":i.get("id",""),"key":i.get("identifier",""),
+                  "issue_url":i.get("url",""),"created":os.environ["CREATED"]=="true"}))'
+    ;;
+
   *) die "unknown op: $OP" ;;
 esac

package/templates/hermes-agent/template/.scripts/providers/plane.sh

@@ -1,13 +1,13 @@
 #!/usr/bin/env sh
 # Plane ticket-provider adapter.
 #
-# Credentials:  PLANE_API_KEY   (X-API-Key header)
+# Credentials:  PLANE_API_KEY or PLANE_<WORKSPACE>_API_KEY (X-API-Key header)
 # Endpoint:     PLANE_BASE       (default https://plane.delo.sh)
-# Board binding (role.yaml `ticket_provider:`):
-#   name: plane
+# Board binding (repo-root .project.json `ticket_provider:`):
 #   workspace: <workspace-slug>      (or env PLANE_WORKSPACE)
-#   project:   <project-uuid>        (set by create_board / 42-ticket-provider)
-#   state_map: { in_review: "In Review", completed: "Done" }   optional
+#   board_id:  <project-uuid>        (set by create_board / 42-ticket-provider)
+#   state_map: { in_review: "In Review", completed: "Done",
+#                cancelled: "Cancelled" }   optional
 #
 # Plane model:  project = board, cycle = milestone, state.group in
 #   backlog|unstarted|started|completed|cancelled.
@@ -21,9 +21,21 @@ ROLE_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
 ROLE_YAML="$ROLE_DIR/role.yaml"
 BASE="${PLANE_BASE:-https://plane.delo.sh}"
 
+FLEET_ENV="${HERMES_FLEET_ENV:-$HOME/.hermes/fleet.env}"
+if [ -f "$FLEET_ENV" ]; then
+  # shellcheck disable=SC1090
+  . "$FLEET_ENV"
+fi
+
 die() { echo "plane: $*" >&2; exit 1; }
 need_key() { [ -n "${PLANE_API_KEY:-}" ] || die "PLANE_API_KEY is not set"; }
 
+workspace_key() {
+  key="$(printf '%s' "${1:-default}" | tr '[:lower:]' '[:upper:]' | sed 's/[^A-Z0-9]/_/g')"
+  [ -n "$key" ] || key="DEFAULT"
+  printf 'PLANE_%s_API_KEY' "$key"
+}
+
 tp_cfg() {
   [ -f "$ROLE_YAML" ] || return 0
   python3 - "$ROLE_YAML" "$1" <<'PY'
@@ -54,13 +66,20 @@ else:
 PY
 }
 
-# Board binding: .project.json (SOT) first, then role.yaml, then env.
+# Board binding: .project.json (SOT) first, then legacy role.yaml, then env.
 WS="$(pj_cfg workspace)"; [ -n "$WS" ] || WS="$(tp_cfg workspace)"; WS="${WS:-${PLANE_WORKSPACE:-}}"
-PROJ="$(pj_cfg board_id)"; [ -n "$PROJ" ] || PROJ="$(tp_cfg project)"
+PROJ="$(pj_cfg board_id)"; [ -n "$PROJ" ] || PROJ="$(tp_cfg project)"; [ -n "$PROJ" ] || PROJ="$(tp_cfg board_id)"
 SM_IN_REVIEW="$(tp_cfg in_review)"; SM_IN_REVIEW="${SM_IN_REVIEW:-In Review}"
 SM_DONE="$(tp_cfg completed)"; SM_DONE="${SM_DONE:-Done}"
+SM_CANCELLED="$(tp_cfg cancelled)"; SM_CANCELLED="${SM_CANCELLED:-Cancelled}"
 API="$BASE/api/v1/workspaces/$WS"
 
+if [ -z "${PLANE_API_KEY:-}" ]; then
+  KEY="$(workspace_key "$WS")"
+  eval "PLANE_API_KEY=\${$KEY:-}"
+  export PLANE_API_KEY
+fi
+
 # api METHOD PATH [JSON_BODY] — call Plane REST, print response body.
 api() {
   need_key
@@ -68,9 +87,12 @@ api() {
   if [ -n "$body" ]; then
     curl -fsS -X "$method" "$API/$path" \
       -H "X-API-Key: $PLANE_API_KEY" -H "Content-Type: application/json" \
+      -H "User-Agent: curl/8.0" \
       -d "$body"
   else
-    curl -fsS -X "$method" "$API/$path" -H "X-API-Key: $PLANE_API_KEY"
+    curl -fsS -X "$method" "$API/$path" \
+      -H "X-API-Key: $PLANE_API_KEY" \
+      -H "User-Agent: curl/8.0"
   fi
 }
 
@@ -80,6 +102,7 @@ resolve_state_id() {
   [ -n "$PROJ" ] || die "ticket_provider.project not set"
   case "$want" in
     completed) grp=completed; nm="$SM_DONE" ;;
+    cancelled) grp=cancelled; nm="$SM_CANCELLED" ;;
     in_review) grp=started;   nm="$SM_IN_REVIEW" ;;
     started)   grp=started;   nm="" ;;
     unstarted) grp=unstarted; nm="" ;;
@@ -87,7 +110,7 @@ resolve_state_id() {
     *) die "invalid normalized state: $want" ;;
   esac
   api GET "projects/$PROJ/states/" | GRP="$grp" NM="$nm" python3 -c 'import sys,json,os
-d=json.load(sys.stdin); rows=d.get("results", d if isinstance(d,list) else [])
+d=json.load(sys.stdin); rows=d if isinstance(d,list) else d.get("results", []) if isinstance(d,dict) else []
 grp=os.environ["GRP"]; nm=os.environ.get("NM","")
 named=[s for s in rows if nm and (s.get("name","").lower()==nm.lower())]
 grouped=[s for s in rows if s.get("group")==grp]
@@ -100,8 +123,8 @@ need_key
 
 case "$OP" in
   resolve)
-    [ -n "$WS" ] || die "workspace not set (role.yaml ticket_provider.workspace or PLANE_WORKSPACE)"
-    [ -n "$PROJ" ] || die "project not set (run 42-ticket-provider.sh)"
+    [ -n "$WS" ] || die "workspace not set (.project.json ticket_provider.workspace or PLANE_WORKSPACE)"
+    [ -n "$PROJ" ] || die "project not set (.project.json ticket_provider.board_id; run 42-ticket-provider.sh)"
     printf '{"provider":"plane","board_id":"%s","board_url":"%s/%s/projects/%s/issues/"}\n' \
       "$PROJ" "$BASE" "$WS" "$PROJ"
     ;;
@@ -109,7 +132,7 @@ case "$OP" in
   active_milestone)
     [ -n "$PROJ" ] || die "project not set"
     api GET "projects/$PROJ/cycles/" | python3 -c 'import sys,json,datetime
-d=json.load(sys.stdin); rows=d.get("results", d if isinstance(d,list) else [])
+d=json.load(sys.stdin); rows=d if isinstance(d,list) else d.get("results", []) if isinstance(d,dict) else []
 now=datetime.datetime.now(datetime.timezone.utc)
 def cur(c):
     s,e=c.get("start_date"),c.get("end_date")
@@ -126,9 +149,9 @@ print(json.dumps({"id":m.get("id",""),"name":m.get("name",""),"state":"active" i
     ISSUES="$(api GET "projects/$PROJ/issues/")"
     printf '%s\n%s\n' "$STATES" "$ISSUES" | BASE="$BASE" WS="$WS" PROJ="$PROJ" python3 -c 'import sys,json,os
 parts=sys.stdin.read().split("\n",1)
-srows=json.loads(parts[0] or "{}"); srows=srows.get("results", srows if isinstance(srows,list) else [])
+srows=json.loads(parts[0] or "{}"); srows=srows if isinstance(srows,list) else srows.get("results", []) if isinstance(srows,dict) else []
 smap={s.get("id"):(s.get("name",""),s.get("group","")) for s in srows}
-d=json.loads(parts[1] or "{}"); rows=d.get("results", d if isinstance(d,list) else [])
+d=json.loads(parts[1] or "{}"); rows=d if isinstance(d,list) else d.get("results", []) if isinstance(d,dict) else []
 base,ws,proj=os.environ["BASE"],os.environ["WS"],os.environ["PROJ"]
 out=[]
 for n in rows:
@@ -146,19 +169,30 @@ print(json.dumps(out))'
     STATES="$(api GET "projects/$PROJ/states/")"
     ISSUE="$(api GET "projects/$PROJ/issues/$ID/")"
     COMM="$(api GET "projects/$PROJ/issues/$ID/comments/" 2>/dev/null || echo '[]')"
-    printf '%s\n%s\n%s\n' "$STATES" "$ISSUE" "$COMM" | python3 -c 'import sys,json,re
-parts=sys.stdin.read().split("\n",2)
-srows=json.loads(parts[0] or "{}"); srows=srows.get("results", srows if isinstance(srows,list) else [])
+    ATTACH="$(api GET "projects/$PROJ/issues/$ID/issue-attachments/" 2>/dev/null || echo '[]')"
+    printf '%s\n%s\n%s\n%s\n' "$STATES" "$ISSUE" "$COMM" "$ATTACH" | python3 -c 'import sys,json,re
+parts=sys.stdin.read().split("\n",3)
+srows=json.loads(parts[0] or "{}"); srows=srows if isinstance(srows,list) else srows.get("results", []) if isinstance(srows,dict) else []
 smap={s.get("id"):(s.get("name",""),s.get("group","")) for s in srows}
-i=json.loads(parts[1] or "{}"); c=json.loads(parts[2] or "[]")
-rows=c.get("results", c if isinstance(c,list) else [])
+i=json.loads(parts[1] or "{}"); c=json.loads(parts[2] or "[]"); a=json.loads(parts[3] or "[]")
+rows=c if isinstance(c,list) else c.get("results", []) if isinstance(c,dict) else []
+arows=a if isinstance(a,list) else a.get("results", []) if isinstance(a,dict) else []
 def strip(h): return re.sub(r"<[^>]+>","",h or "").strip()
 name,group=smap.get(i.get("state",""),("",""))
 desc=strip(i.get("description_html",""))
 cs=[{"id":x.get("id",""),"body":strip(x.get("comment_html","")),"author":""} for x in rows]
+ats=[]
+for x in arows:
+    attrs=x.get("attributes") or {}
+    ats.append({"id":x.get("id",""),"name":attrs.get("name",x.get("name","")),
+                "type":attrs.get("type",x.get("type","")),
+                "size":attrs.get("size",x.get("size",0)),"asset":x.get("asset",""),
+                "url":x.get("asset_url",x.get("url","")),
+                "created_at":x.get("created_at",""),"updated_at":x.get("updated_at",""),
+                "is_uploaded":x.get("is_uploaded",False)})
 print(json.dumps({"id":i.get("id",""),"key":i.get("sequence_id",""),"title":i.get("name",""),
                   "description":desc,"acceptance":desc,
-                  "state":name,"state_type":group,"comments":cs}))'
+                  "state":name,"state_type":group,"comments":cs,"attachments":ats}))'
     ;;
 
   comment)
@@ -180,7 +214,7 @@ print(json.dumps({"id":i.get("id",""),"key":i.get("sequence_id",""),"title":i.ge
     NAME="${1:?usage: create_board <name> <ident> <desc>}"; IDENT="${2:-}"; DESC="${3:-}"
     [ -n "$WS" ] || die "workspace not set"
     EXIST="$(api GET "projects/?per_page=200" | NAME="$NAME" IDENT="$IDENT" python3 -c 'import sys,json,os
-d=json.load(sys.stdin); rows=d.get("results", d if isinstance(d,list) else [])
+d=json.load(sys.stdin); rows=d if isinstance(d,list) else d.get("results", []) if isinstance(d,dict) else []
 name=os.environ["NAME"].strip().lower(); ident=os.environ["IDENT"].upper()
 # Repo NAME is the primary key — links an existing repo board even if its
 # identifier differs (Plane does not enforce unique names, so this prevents
@@ -198,5 +232,41 @@ print(pid)')"
     printf '{"board_id":"%s","board_url":"%s/%s/projects/%s/issues/"}\n' "$PID" "$BASE" "$WS" "$PID"
     ;;
 
+  create_issue)
+    # File a new ticket on the bound board. Board/workspace come from resolved
+    # config, never from an argument. Deliberately NOT idempotent by default:
+    # two issues may legitimately share a title. Pass --if-absent to reuse an
+    # issue whose title already matches exactly (case-insensitive) instead.
+    IF_ABSENT=0
+    case "${1:-}" in --if-absent) IF_ABSENT=1; shift ;; esac
+    TITLE="${1:?usage: create_issue [--if-absent] <title> [description]}"; DESC="${2:-}"
+    [ -n "$WS" ] || die "workspace not set (.project.json ticket_provider.workspace or PLANE_WORKSPACE)"
+    [ -n "$PROJ" ] || die "project not set (.project.json ticket_provider.board_id; run 42-ticket-provider.sh)"
+    IID=""; SEQ=""; CREATED=true
+    if [ "$IF_ABSENT" = 1 ]; then
+      HIT="$(api GET "projects/$PROJ/issues/?per_page=200" | TITLE="$TITLE" python3 -c 'import sys,json,os
+d=json.load(sys.stdin); rows=d if isinstance(d,list) else d.get("results", []) if isinstance(d,dict) else []
+want=os.environ["TITLE"].strip().lower()
+m=next((i for i in rows if (i.get("name") or "").strip().lower()==want), None)
+print((str(m.get("id","")) + " " + str(m.get("sequence_id","") or "")) if m else "")')"
+      if [ -n "$HIT" ]; then IID="${HIT%% *}"; SEQ="${HIT#* }"; CREATED=false; fi
+    fi
+    if [ -z "$IID" ]; then
+      NEW="$(api POST "projects/$PROJ/issues/" \
+        "$(python3 -c 'import html,json,sys
+body={"name": sys.argv[1]}
+desc=sys.argv[2]
+if desc: body["description_html"]="<p>"+html.escape(desc)+"</p>"
+print(json.dumps(body))' "$TITLE" "$DESC")" \
+        | python3 -c 'import sys,json
+d=json.load(sys.stdin)
+print(str(d.get("id","")) + " " + str(d.get("sequence_id","") or ""))')"
+      IID="${NEW%% *}"; SEQ="${NEW#* }"
+    fi
+    [ -n "$IID" ] || die "create_issue failed"
+    printf '{"issue_id":"%s","key":"%s","issue_url":"%s/%s/projects/%s/issues/%s","created":%s}\n' \
+      "$IID" "$SEQ" "$BASE" "$WS" "$PROJ" "$IID" "$CREATED"
+    ;;
+
   *) die "unknown op: $OP" ;;
 esac

package/templates/hermes-agent/template/.scripts/providers/trello.sh

@@ -6,7 +6,8 @@
 #   name: trello
 #   board: <board-id>                 (set by create_board / 42-ticket-provider)
 #   state_map: { backlog:"Backlog", unstarted:"To Do", started:"In Progress",
-#                in_review:"Review", completed:"Done" }   optional
+#                in_review:"Review", completed:"Done", cancelled:"Cancelled" }
+#                                              optional
 #
 # Trello model:  board = project & milestone, list = state, card = issue.
 # Trello has no milestone primitive, so active_milestone returns the board.
@@ -61,6 +62,7 @@ list_name_for() {
     started)   v="$(tp_cfg started)";   printf '%s' "${v:-In Progress}" ;;
     in_review) v="$(tp_cfg in_review)"; printf '%s' "${v:-Review}" ;;
     completed) v="$(tp_cfg completed)"; printf '%s' "${v:-Done}" ;;
+    cancelled) v="$(tp_cfg cancelled)"; printf '%s' "${v:-Cancelled}" ;;
     *) die "invalid normalized state: $1" ;;
   esac
 }
@@ -156,5 +158,36 @@ print(next((b["id"] for b in rows if b.get("name","").lower()==nm), ""))')"
 b=json.load(sys.stdin); print(json.dumps({"board_id":os.environ["BID"],"board_url":b.get("url","")}))'
     ;;
 
+  create_issue)
+    # File a new card on the bound board. Board comes from resolved config,
+    # never from an argument. Deliberately NOT idempotent by default: two cards
+    # may legitimately share a title. Pass --if-absent to reuse a card whose
+    # name already matches exactly (case-insensitive) instead.
+    IF_ABSENT=0
+    case "${1:-}" in --if-absent) IF_ABSENT=1; shift ;; esac
+    TITLE="${1:?usage: create_issue [--if-absent] <title> [description]}"; DESC="${2:-}"
+    [ -n "$BOARD" ] || die "board not set (run 42-ticket-provider.sh)"
+    CID=""; CREATED=true
+    if [ "$IF_ABSENT" = 1 ]; then
+      CID="$(api GET "boards/$BOARD/cards" "fields=name" | NM="$TITLE" python3 -c 'import sys,json,os
+rows=json.load(sys.stdin); nm=os.environ["NM"].strip().lower()
+print(next((c["id"] for c in rows if (c.get("name") or "").strip().lower()==nm), ""))')"
+      [ -z "$CID" ] || CREATED=false
+    fi
+    if [ -z "$CID" ]; then
+      # New cards land in the backlog list, falling back to the unstarted one.
+      LID="$(list_id_for backlog)"
+      [ -n "$LID" ] || LID="$(list_id_for unstarted)"
+      [ -n "$LID" ] || die "no Trello list mapped for 'backlog' or 'unstarted' (check state_map)"
+      CID="$(api POST "cards" "idList=$LID&name=$(python3 -c 'import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1]))' "$TITLE")&desc=$(python3 -c 'import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1]))' "$DESC")" \
+        | python3 -c 'import sys,json; print(json.load(sys.stdin).get("id",""))')"
+    fi
+    [ -n "$CID" ] || die "create_issue failed"
+    api GET "cards/$CID" "fields=url,shortLink" | CID="$CID" CREATED="$CREATED" python3 -c 'import sys,json,os
+c=json.load(sys.stdin)
+print(json.dumps({"issue_id":os.environ["CID"],"key":c.get("shortLink",""),
+                  "issue_url":c.get("url",""),"created":os.environ["CREATED"]=="true"}))'
+    ;;
+
   *) die "unknown op: $OP" ;;
 esac