@delorenj/pjangler 1.4.5 → 1.5.2

package/templates/hermes-agent/template/.scripts/10-hermes-profile.sh

@@ -1,222 +0,0 @@
-#!/usr/bin/env bash
-# Create or reconcile the initial named Hermes profile without cloning secrets.
-# The directory remains REAL. Step 20 delegates final shared-vs-owned link
-# topology to `pj migrate hermes.runtime-singleton`; no template step may
-# replace the profile itself with a symlink.
-
-if [[ "${SKIP_HOST_STATE:-0}" == "1" ]]; then
-  printf '%s\n' '[10] Hermes profile — DEFERRED (SKIP_HOST_STATE=1)' >&2
-  exit 0
-fi
-
-# shellcheck source=_lib.sh
-source "$(dirname "$0")/_lib.sh"
-load_role_env
-
-PROFILE_HOME="$HOME/.hermes/profiles/$PROFILE_NAME"
-
-# Older deployments made the named profile itself a symlink into project
-# state.  Following that link here would make the cleanup below delete files
-# from the link target before the singleton-runtime migration can preserve
-# them.  Refuse the legacy topology before any profile mutation.
-if [[ -L "$PROFILE_HOME" ]]; then
-  die "legacy named profile symlink detected at $PROFILE_HOME; refusing mutation. Run: pj migrate hermes.runtime-singleton '$(project_repo_path 2>/dev/null || printf '%s' "$ROLE_DIR")'"
-fi
-PROFILE_DELTA_SEEDER="$ROLE_DIR/.scripts/lib/profile-config-seed.py"
-[[ -f "$PROFILE_DELTA_SEEDER" && ! -L "$PROFILE_DELTA_SEEDER" ]] \
-  || die "trusted profile config seed helper is unavailable: $PROFILE_DELTA_SEEDER"
-
-already_done 10-hermes-profile \
-  && log "[10] profile marker found — revalidating required profile contract"
-
-# Skillex projects the canonical global catalog into ~/.agents/skills. These
-# six skills are the immutable deployed PM contract, not optional suggestions.
-# Validate the complete set before any profile mutation so a partial/missing
-# projection cannot warn and then be falsely reported as provisioned.
-CANONICAL_SKILLS_DIR="${CANONICAL_SKILLS_DIR:-$(config_get fleet.canonical_skills_dir "$HOME/.agents/skills")}"
-CORE_RUNTIME_SKILLS=(
-  33god-projects
-  delonet-conventions
-  delonet-dotenv
-  hermes-pm-template-maintenance
-  hindsight
-  subagent-driven-development
-)
-OPTIONAL_RUNTIME_SKILLS_TEXT="${SYMLINKED_RUNTIME_SKILLS:-$(config_get fleet.symlinked_runtime_skills '')}"
-read -r -a OPTIONAL_RUNTIME_SKILLS <<< "$OPTIONAL_RUNTIME_SKILLS_TEXT"
-SYMLINKED_RUNTIME_SKILLS=("${CORE_RUNTIME_SKILLS[@]}")
-for skill_name in "${OPTIONAL_RUNTIME_SKILLS[@]}"; do
-  [[ -n "$skill_name" ]] || continue
-  skill_present=0
-  for required_name in "${SYMLINKED_RUNTIME_SKILLS[@]}"; do
-    [[ "$required_name" == "$skill_name" ]] && { skill_present=1; break; }
-  done
-  [[ $skill_present -eq 1 ]] || SYMLINKED_RUNTIME_SKILLS+=("$skill_name")
-done
-missing_runtime_skills=()
-for skill_name in "${SYMLINKED_RUNTIME_SKILLS[@]}"; do
-  [[ -f "$CANONICAL_SKILLS_DIR/$skill_name/SKILL.md" ]] \
-    || missing_runtime_skills+=("$skill_name")
-done
-if [[ ${#missing_runtime_skills[@]} -gt 0 ]]; then
-  clear_done 10-hermes-profile
-  die "required Skillex projection missing SKILL.md for: ${missing_runtime_skills[*]} (run the global Skillex sync, then rerun)"
-fi
-log "[10] required Skillex skills validated: ${SYMLINKED_RUNTIME_SKILLS[*]}"
-
-log "[10] creating hermes profile: $PROFILE_NAME"
-
-if [[ -d "$PROFILE_HOME" ]]; then
-  log "    profile dir already exists; reusing"
-else
-  # `--clone` copies the default profile's .env before a provisioner can
-  # inspect it, transiently materializing every credential in the new profile.
-  # Start clean; required skills and the project SOUL are installed below.
-  "$HERMES_BIN" profile create "$PROFILE_NAME" --no-alias
-fi
-
-# Strip any inherited gateway/runtime state so this profile boots clean.
-rm -f "$PROFILE_HOME/gateway.pid" "$PROFILE_HOME/gateway_state.json" \
-      "$PROFILE_HOME/processes.json" "$PROFILE_HOME/state.db" 2>/dev/null || true
-# Belt-and-suspenders: if a profiles/ dir somehow exists, remove it
-[[ -d "$PROFILE_HOME/profiles" ]] && rm -rf "$PROFILE_HOME/profiles"
-
-# A new profile gets an empty Hermes-created .env. Existing profiles are never
-# migrated opportunistically: if a legacy deployment still has raw channel
-# credentials, fail closed and leave the approval-gated migration to the fleet
-# operator. Only key names are reported; values are never printed.
-PROFILE_ENV="$PROFILE_HOME/.env"
-if [[ -f "$PROFILE_ENV" ]]; then
-  python3 - "$PROFILE_ENV" <<'PYEOF'
-import sys, pathlib
-p = pathlib.Path(sys.argv[1])
-keys = (
-    "SLACK_BOT_TOKEN", "SLACK_APP_TOKEN", "SLACK_SIGNING_SECRET",
-    "TELEGRAM_BOT_TOKEN", "DISCORD_BOT_TOKEN",
-)
-found = []
-for raw in p.read_text(encoding="utf-8").splitlines():
-    line = raw.strip()
-    if not line or line.startswith("#"):
-        continue
-    if line.startswith("export "):
-        line = line[7:].lstrip()
-    name, sep, value = line.partition("=")
-    if sep and name.strip() in keys and value.strip():
-        found.append(name.strip())
-if found:
-    raise SystemExit(
-        "raw channel credential assignments require the approval-gated "
-        "1Password migration: " + ", ".join(sorted(set(found)))
-    )
-PYEOF
-  [[ -L "$PROFILE_ENV" ]] || chmod 600 "$PROFILE_ENV"
-fi
-
-# Never persist a project-specific terminal.cwd through the named profile.
-# The generated launchers pass TERMINAL_CWD process-locally instead.
-#
-# config.yaml is GENERATED, never hand-written and never a symlink to the fleet
-# base. It is deep_merge(~/.hermes/config.yaml, <profile>/config.delta.yaml).
-# The old symlink-to-base topology was actively harmful: Hermes' atomic writes
-# use os.replace, which REPLACES a symlink with a regular file, so the first
-# in-agent write (/model, onboarding, a config migration) silently detached the
-# profile onto a frozen copy of an old base — and a symlink gave the profile no
-# way to override anything in the first place.
-#
-# Seed an EMPTY delta: a new agent should be identical to the fleet base, and
-# every line here is an override someone must justify later.
-PROFILE_DELTA="$PROFILE_HOME/config.delta.yaml"
-profile_delta_seed_result="$(
-  python3 -I "$PROFILE_DELTA_SEEDER" --profile "$PROFILE_HOME"
-)" || die "config.delta.yaml seed reconciliation failed"
-if [[ "$profile_delta_seed_result" == "seeded" ]]; then
-  log "    seeding empty config.delta.yaml (override-only SSOT)"
-elif [[ "$profile_delta_seed_result" != "exists" ]]; then
-  die "profile config seed helper returned an invalid result"
-fi
-
-# Pin the identity-memory bank explicitly rather than relying on the fleet
-# bank_id_template (agent-{profile}). {profile} resolves through Hermes'
-# get_active_profile_name(), which calls Path.resolve() on HERMES_HOME and
-# requires a lowercase id sitting directly under profiles/. A symlinked profile
-# dir or an uppercase name silently yields the literal "custom" — which would
-# merge this agent's PRIVATE memory into a bank shared with every other agent
-# that also failed to resolve.
-PROFILE_MEM_CFG="$PROFILE_HOME/hindsight/config.json"
-mkdir -p "$(dirname "$PROFILE_MEM_CFG")"
-if [[ ! -f "$PROFILE_MEM_CFG" ]]; then
-  log "    pinning identity-memory bank: agent-$PROFILE_NAME"
-  printf '{\n  "bank_id": "agent-%s"\n}\n' "$PROFILE_NAME" > "$PROFILE_MEM_CFG"
-  chmod 600 "$PROFILE_MEM_CFG"
-fi
-
-# Render config.yaml from base + delta when the renderer is available. Without
-# it the profile still boots (Hermes reads whatever config.yaml exists), but it
-# is not yet under inheritance and `pj audit` will say so.
-PROFILE_RENDERER="${PROFILE_RENDERER:-$HOME/code/33GOD/hermes-agent-template/scripts/hermes-profile-config.py}"
-if [[ -x "$PROFILE_RENDERER" || -f "$PROFILE_RENDERER" ]]; then
-  log "    rendering config.yaml from fleet base + delta"
-  python3 "$PROFILE_RENDERER" render --profile "$PROFILE_NAME" >/dev/null 2>&1 \
-    || warn "    render failed; run hermes-profile-config.py render --profile $PROFILE_NAME"
-else
-  warn "    profile renderer not found at $PROFILE_RENDERER — config.yaml not rendered"
-fi
-
-# Canonical shared-skill source of truth + local PM fallback sync.
-CANONICAL_PM_SKILL_SRC="$CANONICAL_SKILLS_DIR/subagent-driven-development"
-LOCAL_PM_SKILL_DST="$PROFILE_HOME/skills/software-development/subagent-driven-development"
-
-if [[ -d "$CANONICAL_SKILLS_DIR" ]]; then
-  # skills.external_dirs is a FLEET setting and already lives in
-  # ~/.hermes/config.yaml, so every rendered profile inherits it. Writing it
-  # per-profile here would (a) be redundant, and (b) write into the GENERATED
-  # config.yaml, where the next render discards it — the classic "I set it and
-  # it reverted" trap. Verify inheritance instead of re-asserting it.
-  if ! env HERMES_HOME="$PROFILE_HOME" "$HERMES_BIN" config get skills.external_dirs 2>/dev/null \
-       | grep -qF "$CANONICAL_SKILLS_DIR"; then
-    warn "    skills.external_dirs does not include $CANONICAL_SKILLS_DIR"
-    warn "    add it to the FLEET base (~/.hermes/config.yaml), then: hermes-profile-config.py render --all"
-  else
-    log "    skills.external_dirs inherited from fleet base: $CANONICAL_SKILLS_DIR"
-  fi
-
-  # Ensure key PM/local-ops skills are symlinked into runtime/profile skills root.
-  # This preserves canonical ownership and keeps updates instant across agents.
-  mkdir -p "$PROFILE_HOME/skills"
-
-  for skill_name in "${SYMLINKED_RUNTIME_SKILLS[@]}"; do
-    src="$CANONICAL_SKILLS_DIR/$skill_name"
-    dst="$PROFILE_HOME/skills/$skill_name"
-
-    [[ -f "$src/SKILL.md" ]] \
-      || die "required Skillex skill disappeared during provisioning: $src/SKILL.md"
-
-    if [[ -L "$dst" && "$(readlink "$dst")" == "$src" ]]; then
-      log "    runtime skill symlink already set: $dst -> $src"
-      continue
-    fi
-
-    [[ -e "$dst" || -L "$dst" ]] && rm -rf "$dst"
-    ln -s "$src" "$dst"
-    log "    symlinked runtime skill: $dst -> $src"
-  done
-else
-  die "canonical Skillex projection directory disappeared during provisioning: $CANONICAL_SKILLS_DIR"
-fi
-
-if [[ -f "$CANONICAL_PM_SKILL_SRC/SKILL.md" ]]; then
-  log "    syncing canonical PM workflow skill -> $LOCAL_PM_SKILL_DST"
-  mkdir -p "$LOCAL_PM_SKILL_DST"
-  cp -f "$CANONICAL_PM_SKILL_SRC/SKILL.md" "$LOCAL_PM_SKILL_DST/SKILL.md"
-else
-  die "required canonical PM skill disappeared during provisioning: $CANONICAL_PM_SKILL_SRC/SKILL.md"
-fi
-
-# Install the project's SOUL.md into the profile so the agent loads it.
-if [[ -f "$ROLE_DIR/SOUL.md" ]]; then
-  cp "$ROLE_DIR/SOUL.md" "$PROFILE_HOME/SOUL.md"
-  log "    installed SOUL.md into profile"
-fi
-
-mark_done 10-hermes-profile

package/templates/hermes-agent/template/.scripts/20-runtime-repo.sh

@@ -1,199 +0,0 @@
-#!/usr/bin/env bash
-# Provision the per-agent, pure-local Hermes runtime without creating a Git
-# repository or a project submodule. Runtime durability belongs to Hindsight;
-# this directory may contain secrets and mutable agent state (PJAN-41).
-# shellcheck source=_lib.sh
-source "$(dirname "$0")/_lib.sh"
-load_role_env
-
-already_done 20-runtime-repo \
-  && log "[20] local runtime scaffold already set up — re-auditing singleton profile wiring"
-if [[ "${SKIP_RUNTIME_REPO:-0}" == "1" ]]; then
-  clear_done 20-runtime-repo
-  log "[20] local runtime — DEFERRED (SKIP_RUNTIME_REPO=1; completion marker cleared)"
-  exit 0
-fi
-
-PROFILE_HOME="$HOME/.hermes/profiles/$PROFILE_NAME"
-RUNTIME_LOCAL="$ROLE_DIR/runtime"
-PROJECT_PATH="$(project_repo_path)" || die "no project git root"
-REL_ROLE_PATH="$(realpath --relative-to="$PROJECT_PATH" "$ROLE_DIR")"
-REL_RUNTIME_PATH="${REL_ROLE_PATH}/runtime"
-
-log "[20] local runtime: $RUNTIME_LOCAL"
-
-# Fail closed if an older installation still models runtime as a project
-# submodule. `pjangler migrate` performs the non-destructive index transition;
-# this provisioner never removes or rewrites an existing nested repository.
-if git -C "$PROJECT_PATH" ls-files --stage -- "$REL_RUNTIME_PATH" | grep -q '^160000 '; then
-  die "$REL_RUNTIME_PATH is still a tracked gitlink; run 'pjangler migrate' before provisioning"
-fi
-if [[ -f "$PROJECT_PATH/.gitmodules" ]] &&
-   git -C "$PROJECT_PATH" config -f .gitmodules --get-regexp '^submodule\..*\.path$' 2>/dev/null |
-     awk -v expected="$REL_RUNTIME_PATH" '$2 == expected { found=1 } END { exit !found }'; then
-  die "$REL_RUNTIME_PATH still has a stale .gitmodules mapping; run 'pjangler migrate' before provisioning"
-fi
-
-mkdir -p "$RUNTIME_LOCAL"
-if [[ -e "$RUNTIME_LOCAL/.git" ]]; then
-  warn "    existing nested runtime repository preserved; no fetch, commit, or push will be attempted"
-fi
-
-# Render the scaffold in a temporary directory, then copy only missing paths.
-# Existing memory, configuration, credentials, and sessions always win.
-TMP="$(mktemp -d)"
-cleanup() { rm -rf -- "$TMP"; }
-trap cleanup EXIT
-cp -a "$RUNTIME_SCAFFOLD_DIR/." "$TMP/"
-python3 - "$TMP" "$AGENT_ID" "$REPO" "$ROLE" "$DISPLAY_NAME" <<'PYEOF'
-import pathlib
-import sys
-
-root, agent_id, repo, role, display = sys.argv[1:6]
-root = pathlib.Path(root)
-mapping = {
-    "{{agent_id}}": agent_id,
-    "{{repo}}": repo,
-    "{{role}}": role,
-    "{{display_name}}": display,
-}
-for path in root.rglob("*"):
-    if path.is_file() and path.suffix in (".md", ".yaml", ".yml", ".sh", ".py", ".gitignore", ".gitattributes"):
-        try:
-            text = path.read_text()
-            for source, target in mapping.items():
-                text = text.replace(source, target)
-            path.write_text(text)
-        except UnicodeDecodeError:
-            pass
-PYEOF
-# Never let a literal secret reach the runtime. The scaffold is rendered from
-# templates, so a leaked credential shows up here before anything is copied.
-python3 "$(dirname "$0")/secret-scan.py" "$TMP"
-python3 - "$TMP" "$RUNTIME_LOCAL" <<'PYEOF'
-import os, pathlib, shutil, sys
-
-source = pathlib.Path(sys.argv[1])
-target = pathlib.Path(sys.argv[2])
-for current in sorted(source.rglob("*")):
-    relative = current.relative_to(source)
-    destination = target / relative
-    if current.is_dir():
-        destination.mkdir(parents=True, exist_ok=True)
-        continue
-    if os.path.lexists(destination):
-        continue
-    destination.parent.mkdir(parents=True, exist_ok=True)
-    if current.is_symlink():
-        destination.symlink_to(os.readlink(current))
-    else:
-        shutil.copy2(current, destination, follow_symlinks=False)
-PYEOF
-
-# Seed mutable identity/config only when no local value exists.
-if [[ "$ROLE" == "reporter" ]]; then
-  # Generate a delta-only runtime config for least-privilege reporters. Never copy the shared PM
-  # config: it may carry dashboard credentials, write-capable MCPs, or broad tools.
-  MODEL_PROVIDER="$(yaml_get model.provider)"
-  MODEL_NAME="$(yaml_get model.name)"
-  CANONICAL_SKILLS_DIR="${CANONICAL_SKILLS_DIR:-$(config_get fleet.canonical_skills_dir "$HOME/.agents/skills")}"
-  if [[ ! -e "$RUNTIME_LOCAL/config.yaml" ]]; then
-    python3 - "$RUNTIME_LOCAL/config.yaml" "$PROJECT_PATH" "${HERMES_TIMEZONE:-America/New_York}" \
-      "$MODEL_PROVIDER" "$MODEL_NAME" "$CANONICAL_SKILLS_DIR" "$ROLE" <<'PYEOF'
-import json, pathlib, re, sys
-path, cwd, timezone, provider, model, skills, role = sys.argv[1:8]
-if not re.fullmatch(r"[A-Za-z_]+(?:/[A-Za-z_]+)*", timezone):
-    raise SystemExit("unsafe timezone")
-config = {
-    "timezone": timezone,
-    "terminal": {"cwd": cwd},
-    "skills": {"external_dirs": [skills]},
-}
-if provider or model:
-    config["model"] = {}
-    if provider:
-        config["model"]["provider"] = provider
-    if model:
-        config["model"]["default"] = model
-config["platform_toolsets"] = {
-    "cli": ["web", "delegation", "no_mcp"],
-    "cron": ["web", "delegation", "no_mcp"],
-}
-config["agent"] = {
-    "disabled_toolsets": [
-        "browser", "terminal", "file", "code_execution", "cronjob",
-        "kanban", "homeassistant", "computer_use", "project", "skills",
-    ]
-}
-config["delegation"] = {"max_spawn_depth": 1, "inherit_mcp_toolsets": False}
-pathlib.Path(path).write_text(json.dumps(config, indent=2) + "\n")
-PYEOF
-  fi
-  if [[ ! -e "$RUNTIME_LOCAL/profile.yaml" ]]; then
-    cat > "$RUNTIME_LOCAL/profile.yaml" <<'YAML'
-config:
-  inherit_from: default
-  save_mode: delta
-YAML
-  fi
-else
-  CANONICAL_PM_CONFIG="$(config_get fleet.canonical_pm_config "$HOME/.hermes/config.yaml")"
-  if [[ -f "$CANONICAL_PM_CONFIG" && ! -e "$RUNTIME_LOCAL/config.yaml" ]]; then
-    cp "$CANONICAL_PM_CONFIG" "$RUNTIME_LOCAL/config.yaml"
-  fi
-fi
-if [[ ! -e "$RUNTIME_LOCAL/SOUL.md" ]]; then
-  cp "$ROLE_DIR/SOUL.md" "$RUNTIME_LOCAL/SOUL.md"
-fi
-
-# Named-profile topology belongs exclusively to PJangler. Preview first, then
-# apply the one idempotent rule. This script never removes or replaces a real
-# profile directory and never creates the obsolete profile -> runtime symlink.
-if [[ "$PJANGLER_BIN" != */* ]]; then
-  PJANGLER_BIN="$(command -v "$PJANGLER_BIN" 2>/dev/null || true)"
-fi
-[[ -n "$PJANGLER_BIN" && -x "$PJANGLER_BIN" ]] \
-  || die "PJángler CLI not found; install 'pj' or set PJANGLER_BIN"
-"$PJANGLER_BIN" migrate hermes.runtime-singleton "$PROJECT_PATH" --dry-run --json >/dev/null \
-  || die "singleton-runtime audit failed; profile was left untouched"
-"$PJANGLER_BIN" migrate hermes.runtime-singleton "$PROJECT_PATH" --json >/dev/null \
-  || die "singleton-runtime migration failed; inspect with: pj migrate hermes.runtime-singleton '$PROJECT_PATH' --dry-run"
-[[ -d "$PROFILE_HOME" && ! -L "$PROFILE_HOME" ]] \
-  || die "PJángler did not establish a real named profile at $PROFILE_HOME"
-log "    singleton profile verified by pj migrate hermes.runtime-singleton: $PROFILE_HOME"
-
-# Never persist a project-specific terminal.cwd through the named profile.
-# config.yaml is fleet-shared in the singleton topology.  The manual and
-# service launchers pass TERMINAL_CWD process-locally for this role instead.
-
-if [[ "$ROLE" == "pm" ]]; then
-  VOX_PLUGIN_NAME="${VOX_PLUGIN_NAME:-$(config_get fleet.vox_plugin_name 'vox')}"
-  VOX_VOICE="${VOX_VOICE:-$(config_get fleet.vox_voice 'carlin')}"
-  VOX_PLUGIN_DIR="${VOX_PLUGIN_DIR:-$(config_get fleet.vox_plugin_dir "$HOME/code/voxxy/plugins/tts/$VOX_PLUGIN_NAME")}"
-  if [[ -d "$VOX_PLUGIN_DIR" ]]; then
-    mkdir -p "$PROFILE_HOME/plugins/tts"
-    ln -sfn "$VOX_PLUGIN_DIR" "$PROFILE_HOME/plugins/tts/$VOX_PLUGIN_NAME"
-    profile_voice_contract_set "$PROFILE_HOME" "$VOX_PLUGIN_NAME" "$VOX_VOICE" \
-      || die "could not write the canonical PM voice contract to config.delta.yaml"
-    python3 - "$PROFILE_HOME/config.yaml" "$VOX_PLUGIN_NAME" "$VOX_VOICE" <<'PYEOF' \
-      || die "PM voice config is not the canonical vox/carlin contract"
-import pathlib, sys
-try:
-    import yaml
-except ImportError:
-    raise SystemExit("PyYAML is required to validate PM voice config")
-config = yaml.safe_load(pathlib.Path(sys.argv[1]).read_text(encoding="utf-8")) or {}
-plugin, voice = sys.argv[2:4]
-enabled = ((config.get("plugins") or {}).get("enabled") or [])
-tts = config.get("tts") or {}
-actual_voice = ((tts.get(plugin) or {}).get("voice") or tts.get("voice") or "")
-if f"tts/{plugin}" not in enabled or tts.get("provider") != plugin or actual_voice != voice:
-    raise SystemExit(1)
-PYEOF
-    log "    PM voice verified: provider=$VOX_PLUGIN_NAME voice=$VOX_VOICE"
-  else
-    log "    optional Vox plugin not installed; PM voice activation deferred"
-  fi
-fi
-
-mark_done 20-runtime-repo