@eventmodelers/cli 1.0.99 → 1.0.101

package/README.md

@@ -217,15 +217,25 @@ server to register by hand (`<baseUrl>/mcp`, header `x-token` from `$EVENTMODELE
 Run `init-agents --hosts <harness>` to install the skills for a harness that does not read
 `.claude/skills`. There are no subagents: self-directed work is done inline.
 
-**In a container.** `docker/<agent>/Dockerfile` runs the modeling agent for one coding agent
-(so far `docker/opencode`). Build from this directory and pass the board's credentials as env vars:
+**In a container.** `docker/agent/Dockerfile` runs the modeling agent with Claude Code, OpenCode, Codex, Gemini CLI and Hermes all installed;
+`AGENT` (`claude` by default, or `opencode`, `codex`, `gemini`, `hermes`) picks which one runs. Build from this directory and pass the board's
+credentials as env vars:
 
 ```bash
-docker build -f docker/opencode/Dockerfile -t eventmodelers-agent-opencode .
-docker run --rm -e EVENTMODELERS_TOKEN=... -e EVENTMODELERS_ORGANIZATION_ID=... -e EVENTMODELERS_BOARD_ID=... \
-  -e OPENCODE_API_KEY=... eventmodelers-agent-opencode --model opencode/big-pickle
+docker build -f docker/agent/Dockerfile -t eventmodelers-agent .
+docker run --rm -e AGENT=codex -e OPENAI_API_KEY \
+  -e EVENTMODELERS_TOKEN=... -e EVENTMODELERS_ORGANIZATION_ID=... -e EVENTMODELERS_BOARD_ID=... \
+  eventmodelers-agent --model gpt-5-codex
 ```
 
+Claude authenticates with `ANTHROPIC_API_KEY`, or with your subscription via `CLAUDE_CODE_OAUTH_TOKEN` (run `claude setup-token`
+once). The container is the sandbox, so the image sets `EVENTMODELERS_CODEX_NO_SANDBOX=1`, which makes the `codex` preset run
+`--dangerously-bypass-approvals-and-sandbox` instead of `--full-auto`.
+
+Keys: `OPENAI_API_KEY` (codex), `GEMINI_API_KEY` (gemini), and for Hermes a provider key such as `OPENROUTER_API_KEY`. Hermes reads MCP
+servers only from `~/.hermes/config.yaml`, so the images ship the eventmodelers server there (env references, no secret); outside
+Docker the CLI logs the snippet to add. Run `hermes` in a container as `-e AGENT=hermes --model <provider/model>`.
+
 `--agent`, `--exec`, `--local-ai` and `--bash` each pick the runner, so pass at most one of them —
 any two together are rejected. For a local or self-hosted model use `--local-ai`, not `--agent`.
 
@@ -734,7 +744,7 @@ The workflow then:
 | `images` | Builds the six agent images for `linux/amd64` and `linux/arm64`, **scans each for credentials** (`.github/scripts/scan-image.sh`), and only then pushes it |
 | `merge` | Combines the two architectures into one multi-arch image per name, tagged `:<tag>` and `:latest` |
 
-Images land in `docker.io/nebulit/`: `eventmodelers-agent-claude`, `eventmodelers-agent-opencode`, and `em-studio-buildkit-{claude,opencode}-{node,java}`. They run the CLI from the tagged checkout, not from npm, so they don't wait on the npm publish.
+Images land in `docker.io/nebulit/`: `eventmodelers-agent` (modeling) and `em-studio-buildkit-{node,java,dotnet}` (building); each carries all three agent CLIs and `AGENT` selects one. They run the CLI from the tagged checkout, not from npm, so they don't wait on the npm publish.
 
 **One-time setup:** an `NPM_TOKEN` repo secret (an npm automation token allowed to publish `@eventmodelers/cli`). The images push with the built-in `GITHUB_TOKEN`; new GHCR packages start private, so make them public in the org's package settings if they should be pullable without a login.
 

package/cli.js

@@ -82,6 +82,9 @@ const AGENT_PRESETS = {
   opencode: { modeling: 'opencode run --standalone --auto', build: 'opencode run --standalone --auto --format json' },
   codex: { modeling: 'codex exec --full-auto', build: 'codex exec --json --full-auto' },
   gemini: { modeling: 'gemini --yolo -p', build: 'gemini --yolo --output-format stream-json -p' },
+  // -q takes the prompt, so the preset ends with it (the --model flag is inserted before it, below).
+  // -Q is the plain-text mode a modeling turn reads its answer from; --format stream-json is the build kit's.
+  hermes: { modeling: 'hermes chat --yolo -Q -q', build: 'hermes chat --yolo --format stream-json -q' },
 };
 
 function printAgentPresets() {
@@ -116,7 +119,13 @@ function resolveAgentPreset(opts, loop) {
     console.error('❌ --agent is mutually exclusive with --local-ai/--bash — pick one runner.');
     process.exit(1);
   }
-  return AGENT_PRESETS[name]?.[loop] ?? null;
+  const cmd = AGENT_PRESETS[name]?.[loop] ?? null;
+  // The docker images set this: Codex's own sandbox (landlock) can't start inside a container, and the
+  // container already is the sandbox — the flag Codex documents for externally sandboxed environments.
+  if (name === 'codex' && cmd && process.env.EVENTMODELERS_CODEX_NO_SANDBOX === '1') {
+    return cmd.replace('--full-auto', '--dangerously-bypass-approvals-and-sandbox');
+  }
+  return cmd;
 }
 
 const STACKS = {
@@ -3624,7 +3633,11 @@ credentialFlags(program
       console.error('❌ --model does not apply to --exec — put the harness\'s own model flag in the command (e.g. --exec "opencode run --standalone -m <id>"), or use --agent.');
       process.exit(1);
     }
-    if (model && agentExec) opts.exec = `${agentExec} -m '${model.replace(/'/g, `'\\''`)}'`;
+    if (model && agentExec) {
+      const modelFlag = `-m '${model.replace(/'/g, `'\\''`)}'`;
+      // A trailing -q takes the prompt as its value, so the model flag has to come before it.
+      opts.exec = agentExec.endsWith(' -q') ? `${agentExec.slice(0, -3)}${modelFlag} -q` : `${agentExec} ${modelFlag}`;
+    }
     else if (model && resolveLocalAiTarget(opts) !== null) process.env.LOCAL_AI_MODEL = model;
     // The default Claude runner: the build kit's ralph-claude.js reads RALPH_MODEL from the env it
     // inherits; the modeling loop takes it as runModeling's `model`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eventmodelers/cli",
-  "version": "1.0.99",
+  "version": "1.0.101",
   "description": "Eventmodelers CLI — real-time Claude agent + skills for Claude Code, for any stack (Node, Supabase, Axon, OpenCQRS, UmaDB, Kurrent, or modeling-only)",
   "type": "module",
   "bin": {

package/shared/build-kit/lib/mcp-register.js

@@ -1,8 +1,9 @@
-// Registers the eventmodelers MCP server with an external agent harness (OpenCode, Gemini, Codex),
+// Registers the eventmodelers MCP server with an external agent harness (OpenCode, Gemini, Codex, Hermes),
 // for both loops that hand turns to one: the modeling loop (lib/modeling-exec.js) and the build
 // loop (ralph-exec.js).
 
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
+import { homedir } from 'os';
 import { dirname, join } from 'path';
 
 // POSIX single-quote escaping: close, insert an escaped quote, reopen. A turn is multi-line
@@ -60,6 +61,18 @@ const MCP_REGISTRATIONS = {
     });
     return { command, file: ok ? '.gemini/settings.json' : null, manual: ok ? null : `add mcpServers.eventmodelers = ${JSON.stringify(entry)} to .gemini/settings.json` };
   },
+  // Hermes reads MCP servers from ~/.hermes/config.yaml only (there is no project-level file), so
+  // this never writes it — a user-wide file is not ours to rewrite. It reports the server as
+  // registered when the file already names it (the docker images ship it), and says what to add otherwise.
+  hermes: (command, _projectDir, url) => {
+    const file = join(process.env.HERMES_HOME || join(homedir(), '.hermes'), 'config.yaml');
+    const has = existsSync(file) && /^\s+eventmodelers:/m.test(readFileSync(file, 'utf8'));
+    return {
+      command,
+      file: null,
+      manual: has ? null : `add to ${file}:\nmcp_servers:\n  eventmodelers:\n    url: "${url}"\n    headers:\n      x-token: "\${EVENTMODELERS_TOKEN}"`,
+    };
+  },
   codex: (command, _projectDir, url) => ({
     // -c values are TOML; env_http_headers names the env var each header is read from.
     command: `${command} -c ${shellQuote(`mcp_servers.eventmodelers.url="${url}"`)} -c ${shellQuote('mcp_servers.eventmodelers.env_http_headers={x-token="EVENTMODELERS_TOKEN",x-agent-id="EVENTMODELERS_AGENT_ID"}')}`,
@@ -89,7 +102,7 @@ export function registerMcp(command, projectDir, baseUrl, log) {
     return { command, registered: false };
   }
   const reg = MCP_REGISTRATIONS[harness](command, projectDir, url);
-  if (reg.manual) log(`MCP: could not update the ${harness} config (not plain JSON) — ${reg.manual}`);
+  if (reg.manual) log(`MCP: could not update the ${harness} config${harness === 'hermes' ? '' : ' (not plain JSON)'} — ${reg.manual}`);
   else log(`MCP: eventmodelers registered for ${harness}${reg.file ? ` in ${reg.file}` : ' via -c flags'}`);
   return { command: reg.command, registered: !reg.manual };
 }