@hermespilot/link 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 HermesPilot
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,60 @@
+# Hermes Link
+
+`Hermes Link` is a secure companion service for hermes-agent. It provides the `hermeslink` CLI and a local service layer that lets HermesPilot App connect to a Hermes Agent running on the user's own computer or server.
+
+## Requirements
+
+- Node.js 22.14.0 or newer
+- A local hermes-agent setup on the same machine
+
+## Install
+
+```bash
+npm install -g @hermespilot/link
+```
+
+The package installs the `hermeslink` command. It does not start the service automatically during installation.
+
+## Common commands
+
+```bash
+hermeslink --version
+hermeslink status
+hermeslink pair
+hermeslink start
+hermeslink doctor
+```
+
+`hermeslink pair` requires HermesPilot Server and Relay to be available. The terminal side does not ask for a HermesPilot account; the App must be logged in before it scans or claims a pairing session.
+
+## Runtime data
+
+Hermes Link keeps its local identity and runtime state under:
+
+```text
+~/.hermeslink/
+```
+
+Uninstalling the npm package does not remove this directory, so the same Link ID can be reused after reinstalling.
+
+## Publish
+
+This package is published as a public scoped npm package:
+
+```bash
+npm publish --access public
+```
+
+Before publishing, run:
+
+```bash
+npm run release -- --version 0.1.1 --no-publish
+```
+
+The release script syncs `package.json`, `package-lock.json`, and `src/constants.ts`, then runs type checks, tests, and an npm pack dry run. To publish through the script, use `--publish` explicitly:
+
+```bash
+npm run release -- --version 0.1.1 --publish
+```
+
+The package command is always `hermeslink`; there is no `hermes-link` alias.

package/dist/chunk-YTX3DQGX.js

@@ -0,0 +1,255 @@
+// src/constants.ts
+var LINK_VERSION = "0.1.0";
+var LINK_COMMAND = "hermeslink";
+var LINK_DEFAULT_PORT = 52379;
+var LINK_RUNTIME_DIR_NAME = ".hermeslink";
+
+// src/runtime/paths.ts
+import os from "os";
+import path from "path";
+function resolveRuntimeHome() {
+  return process.env.HERMESLINK_HOME?.trim() ? path.resolve(process.env.HERMESLINK_HOME) : path.join(os.homedir(), LINK_RUNTIME_DIR_NAME);
+}
+function resolveRuntimePaths(homeDir = resolveRuntimeHome()) {
+  return {
+    homeDir,
+    identityFile: path.join(homeDir, "identity.json"),
+    configFile: path.join(homeDir, "config.json"),
+    stateFile: path.join(homeDir, "state.json"),
+    credentialsFile: path.join(homeDir, "credentials.json"),
+    databaseFile: path.join(homeDir, "link.db"),
+    logsDir: path.join(homeDir, "logs"),
+    runDir: path.join(homeDir, "run"),
+    pairingDir: path.join(homeDir, "pairing")
+  };
+}
+
+// src/storage/atomic-json.ts
+import { mkdir, open, readFile, rename, rm } from "fs/promises";
+import path2 from "path";
+async function readJsonFile(filePath) {
+  try {
+    const raw = await readFile(filePath, "utf8");
+    return JSON.parse(raw);
+  } catch (error) {
+    if (isNodeError(error, "ENOENT")) {
+      return null;
+    }
+    throw error;
+  }
+}
+async function writeJsonFile(filePath, value, mode = 384) {
+  await mkdir(path2.dirname(filePath), { recursive: true, mode: 448 });
+  const tmpPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+  const payload = `${JSON.stringify(value, null, 2)}
+`;
+  const handle = await open(tmpPath, "w", mode);
+  try {
+    await handle.writeFile(payload, "utf8");
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+  try {
+    await rename(tmpPath, filePath);
+  } catch (error) {
+    await rm(tmpPath, { force: true });
+    throw error;
+  }
+}
+function isNodeError(error, code) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}
+
+// src/config/config.ts
+var defaultLinkConfig = {
+  port: LINK_DEFAULT_PORT,
+  serverBaseUrl: "http://127.0.0.1:8787",
+  relayBaseUrl: "http://127.0.0.1:8788",
+  language: "zh-CN"
+};
+async function loadConfig(paths = resolveRuntimePaths()) {
+  const existing = await readJsonFile(paths.configFile);
+  return {
+    ...defaultLinkConfig,
+    ...existing ?? {}
+  };
+}
+
+// src/hermes/config.ts
+import { randomBytes } from "crypto";
+import { copyFile, mkdir as mkdir2, readFile as readFile2, writeFile } from "fs/promises";
+import os2 from "os";
+import path3 from "path";
+import YAML from "yaml";
+function resolveHermesProfileDir(profileName = "default") {
+  if (profileName === "default") {
+    return path3.join(os2.homedir(), ".hermes");
+  }
+  return path3.join(os2.homedir(), ".hermes", "profiles", profileName);
+}
+function resolveHermesConfigPath(profileName = "default") {
+  return path3.join(resolveHermesProfileDir(profileName), "config.yaml");
+}
+async function readHermesApiServerConfig(profileName = "default", configPath = resolveHermesConfigPath(profileName)) {
+  const existingRaw = await readFile2(configPath, "utf8").catch((error) => {
+    if (isNodeError2(error, "ENOENT")) {
+      return null;
+    }
+    throw error;
+  });
+  if (!existingRaw) {
+    return {};
+  }
+  const config = toRecord(YAML.parse(existingRaw));
+  const platforms = toRecord(config.platforms);
+  const apiServer = toRecord(platforms.api_server);
+  return readApiServerConfig(toRecord(apiServer.extra));
+}
+async function ensureHermesApiServerKey(profileName = "default", configPath = resolveHermesConfigPath(profileName)) {
+  const existingRaw = await readFile2(configPath, "utf8").catch((error) => {
+    if (isNodeError2(error, "ENOENT")) {
+      return null;
+    }
+    throw error;
+  });
+  const document = existingRaw ? YAML.parseDocument(existingRaw) : new YAML.Document({});
+  const config = toRecord(document.toJSON());
+  const platforms = ensureRecord(config, "platforms");
+  const apiServer = ensureRecord(platforms, "api_server");
+  const extra = ensureRecord(apiServer, "extra");
+  const beforeKey = typeof extra.key === "string" && extra.key.length > 0 ? extra.key : null;
+  let changed = false;
+  if (!beforeKey) {
+    extra.key = randomBytes(32).toString("base64url");
+    changed = true;
+  }
+  if (!changed) {
+    return {
+      configPath,
+      apiServer: readApiServerConfig(extra),
+      changed: false,
+      keyAdded: false,
+      backupPath: null,
+      notice: null
+    };
+  }
+  const backupPath = existingRaw ? `${configPath}.bak.${Date.now()}` : null;
+  await mkdir2(path3.dirname(configPath), { recursive: true, mode: 448 });
+  if (backupPath) {
+    await copyFile(configPath, backupPath);
+  }
+  document.contents = document.createNode(config);
+  await writeFile(configPath, document.toString(), { mode: 384 });
+  return {
+    configPath,
+    apiServer: readApiServerConfig(extra),
+    changed: true,
+    keyAdded: true,
+    backupPath,
+    notice: "\u5DF2\u4E3A Hermes API Server \u81EA\u52A8\u8865\u5145 key\uFF1B\u672A\u8986\u76D6\u5DF2\u6709 port/host/key\u3002"
+  };
+}
+function readApiServerConfig(extra) {
+  return {
+    host: typeof extra.host === "string" ? extra.host : void 0,
+    port: typeof extra.port === "number" ? extra.port : void 0,
+    key: typeof extra.key === "string" ? extra.key : void 0
+  };
+}
+function toRecord(value) {
+  return typeof value === "object" && value !== null ? value : {};
+}
+function ensureRecord(parent, key) {
+  const value = parent[key];
+  if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+    return value;
+  }
+  const next = {};
+  parent[key] = next;
+  return next;
+}
+function isNodeError2(error, code) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}
+
+// src/identity/identity.ts
+import { generateKeyPairSync, randomUUID, sign } from "crypto";
+import { mkdir as mkdir3, chmod } from "fs/promises";
+import { z } from "zod";
+var linkIdentitySchema = z.object({
+  install_id: z.string().min(1),
+  link_id: z.string().min(1).nullable().optional(),
+  public_key_pem: z.string().min(1),
+  private_key_pem: z.string().min(1),
+  created_at: z.string().min(1),
+  updated_at: z.string().min(1)
+});
+async function loadIdentity(paths = resolveRuntimePaths()) {
+  const value = await readJsonFile(paths.identityFile);
+  if (value === null) {
+    return null;
+  }
+  return linkIdentitySchema.parse(value);
+}
+async function ensureIdentity(paths = resolveRuntimePaths()) {
+  const existing = await loadIdentity(paths);
+  if (existing) {
+    return existing;
+  }
+  await mkdir3(paths.homeDir, { recursive: true, mode: 448 });
+  await chmod(paths.homeDir, 448).catch(() => void 0);
+  const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const identity = {
+    install_id: `install_${randomUUID().replaceAll("-", "")}`,
+    link_id: null,
+    public_key_pem: publicKey.export({ type: "spki", format: "pem" }).toString(),
+    private_key_pem: privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
+    created_at: now,
+    updated_at: now
+  };
+  await writeJsonFile(paths.identityFile, identity);
+  return identity;
+}
+async function saveAssignedLinkId(linkId, paths = resolveRuntimePaths()) {
+  const identity = await ensureIdentity(paths);
+  const next = {
+    ...identity,
+    link_id: linkId,
+    updated_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await writeJsonFile(paths.identityFile, next);
+  return next;
+}
+function signRelayNonce(identity, nonce) {
+  const signature = sign(null, Buffer.from(nonce, "utf8"), identity.private_key_pem);
+  return signature.toString("base64url");
+}
+function getIdentityStatus(identity) {
+  return {
+    installId: identity.install_id,
+    linkId: identity.link_id ?? null,
+    hasPrivateKey: identity.private_key_pem.trim().length > 0,
+    publicKeyPem: identity.public_key_pem
+  };
+}
+
+export {
+  LINK_VERSION,
+  LINK_COMMAND,
+  resolveRuntimePaths,
+  readJsonFile,
+  writeJsonFile,
+  loadConfig,
+  resolveHermesProfileDir,
+  resolveHermesConfigPath,
+  readHermesApiServerConfig,
+  ensureHermesApiServerKey,
+  loadIdentity,
+  ensureIdentity,
+  saveAssignedLinkId,
+  signRelayNonce,
+  getIdentityStatus
+};
+//# sourceMappingURL=chunk-YTX3DQGX.js.map

package/dist/chunk-YTX3DQGX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/constants.ts","../src/runtime/paths.ts","../src/storage/atomic-json.ts","../src/config/config.ts","../src/hermes/config.ts","../src/identity/identity.ts"],"sourcesContent":["export const LINK_VERSION = '0.1.0'\nexport const LINK_COMMAND = 'hermeslink'\nexport const LINK_DEFAULT_PORT = 52379\nexport const LINK_RUNTIME_DIR_NAME = '.hermeslink'\n\n","import os from 'node:os'\nimport path from 'node:path'\nimport { LINK_RUNTIME_DIR_NAME } from '../constants.js'\n\nexport interface RuntimePaths {\n  homeDir: string\n  identityFile: string\n  configFile: string\n  stateFile: string\n  credentialsFile: string\n  databaseFile: string\n  logsDir: string\n  runDir: string\n  pairingDir: string\n}\n\nexport function resolveRuntimeHome(): string {\n  return process.env.HERMESLINK_HOME?.trim()\n    ? path.resolve(process.env.HERMESLINK_HOME)\n    : path.join(os.homedir(), LINK_RUNTIME_DIR_NAME)\n}\n\nexport function resolveRuntimePaths(homeDir = resolveRuntimeHome()): RuntimePaths {\n  return {\n    homeDir,\n    identityFile: path.join(homeDir, 'identity.json'),\n    configFile: path.join(homeDir, 'config.json'),\n    stateFile: path.join(homeDir, 'state.json'),\n    credentialsFile: path.join(homeDir, 'credentials.json'),\n    databaseFile: path.join(homeDir, 'link.db'),\n    logsDir: path.join(homeDir, 'logs'),\n    runDir: path.join(homeDir, 'run'),\n    pairingDir: path.join(homeDir, 'pairing'),\n  }\n}\n\n","import { mkdir, open, readFile, rename, rm } from 'node:fs/promises'\nimport path from 'node:path'\n\nexport async function readJsonFile<T>(filePath: string): Promise<T | null> {\n  try {\n    const raw = await readFile(filePath, 'utf8')\n    return JSON.parse(raw) as T\n  } catch (error) {\n    if (isNodeError(error, 'ENOENT')) {\n      return null\n    }\n    throw error\n  }\n}\n\nexport async function writeJsonFile(filePath: string, value: unknown, mode = 0o600): Promise<void> {\n  await mkdir(path.dirname(filePath), { recursive: true, mode: 0o700 })\n  const tmpPath = `${filePath}.${process.pid}.${Date.now()}.tmp`\n  const payload = `${JSON.stringify(value, null, 2)}\\n`\n  const handle = await open(tmpPath, 'w', mode)\n  try {\n    await handle.writeFile(payload, 'utf8')\n    await handle.sync()\n  } finally {\n    await handle.close()\n  }\n  try {\n    await rename(tmpPath, filePath)\n  } catch (error) {\n    await rm(tmpPath, { force: true })\n    throw error\n  }\n}\n\nfunction isNodeError(error: unknown, code: string): boolean {\n  return typeof error === 'object' && error !== null && 'code' in error && error.code === code\n}\n\n","import { LINK_DEFAULT_PORT } from '../constants.js'\nimport { resolveRuntimePaths, type RuntimePaths } from '../runtime/paths.js'\nimport { readJsonFile, writeJsonFile } from '../storage/atomic-json.js'\n\nexport interface LinkConfig {\n  port: number\n  serverBaseUrl: string\n  relayBaseUrl: string\n  language: 'zh-CN' | 'en'\n}\n\nexport const defaultLinkConfig: LinkConfig = {\n  port: LINK_DEFAULT_PORT,\n  serverBaseUrl: 'http://127.0.0.1:8787',\n  relayBaseUrl: 'http://127.0.0.1:8788',\n  language: 'zh-CN',\n}\n\nexport async function loadConfig(paths: RuntimePaths = resolveRuntimePaths()): Promise<LinkConfig> {\n  const existing = await readJsonFile<Partial<LinkConfig>>(paths.configFile)\n  return {\n    ...defaultLinkConfig,\n    ...(existing ?? {}),\n  }\n}\n\nexport async function saveConfig(\n  patch: Partial<LinkConfig>,\n  paths: RuntimePaths = resolveRuntimePaths(),\n): Promise<LinkConfig> {\n  const current = await loadConfig(paths)\n  const next = { ...current, ...patch }\n  await writeJsonFile(paths.configFile, next)\n  return next\n}\n\n","import { randomBytes } from 'node:crypto'\nimport { copyFile, mkdir, readFile, writeFile } from 'node:fs/promises'\nimport os from 'node:os'\nimport path from 'node:path'\nimport YAML from 'yaml'\n\nexport interface HermesApiServerConfig {\n  host?: string\n  port?: number\n  key?: string\n}\n\nexport interface EnsureHermesConfigResult {\n  configPath: string\n  apiServer: HermesApiServerConfig\n  changed: boolean\n  keyAdded: boolean\n  backupPath: string | null\n  notice: string | null\n}\n\nexport function resolveHermesProfileDir(profileName = 'default'): string {\n  if (profileName === 'default') {\n    return path.join(os.homedir(), '.hermes')\n  }\n  return path.join(os.homedir(), '.hermes', 'profiles', profileName)\n}\n\nexport function resolveHermesConfigPath(profileName = 'default'): string {\n  return path.join(resolveHermesProfileDir(profileName), 'config.yaml')\n}\n\nexport async function readHermesApiServerConfig(\n  profileName = 'default',\n  configPath = resolveHermesConfigPath(profileName),\n): Promise<HermesApiServerConfig> {\n  const existingRaw = await readFile(configPath, 'utf8').catch((error: unknown) => {\n    if (isNodeError(error, 'ENOENT')) {\n      return null\n    }\n    throw error\n  })\n  if (!existingRaw) {\n    return {}\n  }\n  const config = toRecord(YAML.parse(existingRaw))\n  const platforms = toRecord(config.platforms)\n  const apiServer = toRecord(platforms.api_server)\n  return readApiServerConfig(toRecord(apiServer.extra))\n}\n\nexport async function ensureHermesApiServerKey(\n  profileName = 'default',\n  configPath = resolveHermesConfigPath(profileName),\n): Promise<EnsureHermesConfigResult> {\n  const existingRaw = await readFile(configPath, 'utf8').catch((error: unknown) => {\n    if (isNodeError(error, 'ENOENT')) {\n      return null\n    }\n    throw error\n  })\n  const document = existingRaw ? YAML.parseDocument(existingRaw) : new YAML.Document({})\n  const config = toRecord(document.toJSON())\n  const platforms = ensureRecord(config, 'platforms')\n  const apiServer = ensureRecord(platforms, 'api_server')\n  const extra = ensureRecord(apiServer, 'extra')\n  const beforeKey = typeof extra.key === 'string' && extra.key.length > 0 ? extra.key : null\n\n  let changed = false\n  if (!beforeKey) {\n    extra.key = randomBytes(32).toString('base64url')\n    changed = true\n  }\n\n  if (!changed) {\n    return {\n      configPath,\n      apiServer: readApiServerConfig(extra),\n      changed: false,\n      keyAdded: false,\n      backupPath: null,\n      notice: null,\n    }\n  }\n\n  const backupPath = existingRaw ? `${configPath}.bak.${Date.now()}` : null\n  await mkdir(path.dirname(configPath), { recursive: true, mode: 0o700 })\n  if (backupPath) {\n    await copyFile(configPath, backupPath)\n  }\n  document.contents = document.createNode(config)\n  await writeFile(configPath, document.toString(), { mode: 0o600 })\n\n  return {\n    configPath,\n    apiServer: readApiServerConfig(extra),\n    changed: true,\n    keyAdded: true,\n    backupPath,\n    notice: '已为 Hermes API Server 自动补充 key；未覆盖已有 port/host/key。',\n  }\n}\n\nfunction readApiServerConfig(extra: Record<string, unknown>): HermesApiServerConfig {\n  return {\n    host: typeof extra.host === 'string' ? extra.host : undefined,\n    port: typeof extra.port === 'number' ? extra.port : undefined,\n    key: typeof extra.key === 'string' ? extra.key : undefined,\n  }\n}\n\nfunction toRecord(value: unknown): Record<string, unknown> {\n  return typeof value === 'object' && value !== null ? (value as Record<string, unknown>) : {}\n}\n\nfunction ensureRecord(parent: Record<string, unknown>, key: string): Record<string, unknown> {\n  const value = parent[key]\n  if (typeof value === 'object' && value !== null && !Array.isArray(value)) {\n    return value as Record<string, unknown>\n  }\n  const next: Record<string, unknown> = {}\n  parent[key] = next\n  return next\n}\n\nfunction isNodeError(error: unknown, code: string): boolean {\n  return typeof error === 'object' && error !== null && 'code' in error && error.code === code\n}\n","import { generateKeyPairSync, randomUUID, sign } from 'node:crypto'\nimport { mkdir, chmod } from 'node:fs/promises'\nimport { z } from 'zod'\nimport { resolveRuntimePaths, type RuntimePaths } from '../runtime/paths.js'\nimport { readJsonFile, writeJsonFile } from '../storage/atomic-json.js'\n\nconst linkIdentitySchema = z.object({\n  install_id: z.string().min(1),\n  link_id: z.string().min(1).nullable().optional(),\n  public_key_pem: z.string().min(1),\n  private_key_pem: z.string().min(1),\n  created_at: z.string().min(1),\n  updated_at: z.string().min(1),\n})\n\nexport type LinkIdentity = z.infer<typeof linkIdentitySchema>\n\nexport interface IdentityStatus {\n  installId: string\n  linkId: string | null\n  hasPrivateKey: boolean\n  publicKeyPem: string\n}\n\nexport async function loadIdentity(paths: RuntimePaths = resolveRuntimePaths()): Promise<LinkIdentity | null> {\n  const value = await readJsonFile<unknown>(paths.identityFile)\n  if (value === null) {\n    return null\n  }\n  return linkIdentitySchema.parse(value)\n}\n\nexport async function ensureIdentity(paths: RuntimePaths = resolveRuntimePaths()): Promise<LinkIdentity> {\n  const existing = await loadIdentity(paths)\n  if (existing) {\n    return existing\n  }\n\n  await mkdir(paths.homeDir, { recursive: true, mode: 0o700 })\n  await chmod(paths.homeDir, 0o700).catch(() => undefined)\n\n  const { publicKey, privateKey } = generateKeyPairSync('ed25519')\n  const now = new Date().toISOString()\n  const identity: LinkIdentity = {\n    install_id: `install_${randomUUID().replaceAll('-', '')}`,\n    link_id: null,\n    public_key_pem: publicKey.export({ type: 'spki', format: 'pem' }).toString(),\n    private_key_pem: privateKey.export({ type: 'pkcs8', format: 'pem' }).toString(),\n    created_at: now,\n    updated_at: now,\n  }\n  await writeJsonFile(paths.identityFile, identity)\n  return identity\n}\n\nexport async function saveAssignedLinkId(\n  linkId: string,\n  paths: RuntimePaths = resolveRuntimePaths(),\n): Promise<LinkIdentity> {\n  const identity = await ensureIdentity(paths)\n  const next: LinkIdentity = {\n    ...identity,\n    link_id: linkId,\n    updated_at: new Date().toISOString(),\n  }\n  await writeJsonFile(paths.identityFile, next)\n  return next\n}\n\nexport function signRelayNonce(identity: LinkIdentity, nonce: string): string {\n  const signature = sign(null, Buffer.from(nonce, 'utf8'), identity.private_key_pem)\n  return signature.toString('base64url')\n}\n\nexport function getIdentityStatus(identity: LinkIdentity): IdentityStatus {\n  return {\n    installId: identity.install_id,\n    linkId: identity.link_id ?? null,\n    hasPrivateKey: identity.private_key_pem.trim().length > 0,\n    publicKeyPem: identity.public_key_pem,\n  }\n}\n\n"],"mappings":";AAAO,IAAM,eAAe;AACrB,IAAM,eAAe;AACrB,IAAM,oBAAoB;AAC1B,IAAM,wBAAwB;;;ACHrC,OAAO,QAAQ;AACf,OAAO,UAAU;AAeV,SAAS,qBAA6B;AAC3C,SAAO,QAAQ,IAAI,iBAAiB,KAAK,IACrC,KAAK,QAAQ,QAAQ,IAAI,eAAe,IACxC,KAAK,KAAK,GAAG,QAAQ,GAAG,qBAAqB;AACnD;AAEO,SAAS,oBAAoB,UAAU,mBAAmB,GAAiB;AAChF,SAAO;AAAA,IACL;AAAA,IACA,cAAc,KAAK,KAAK,SAAS,eAAe;AAAA,IAChD,YAAY,KAAK,KAAK,SAAS,aAAa;AAAA,IAC5C,WAAW,KAAK,KAAK,SAAS,YAAY;AAAA,IAC1C,iBAAiB,KAAK,KAAK,SAAS,kBAAkB;AAAA,IACtD,cAAc,KAAK,KAAK,SAAS,SAAS;AAAA,IAC1C,SAAS,KAAK,KAAK,SAAS,MAAM;AAAA,IAClC,QAAQ,KAAK,KAAK,SAAS,KAAK;AAAA,IAChC,YAAY,KAAK,KAAK,SAAS,SAAS;AAAA,EAC1C;AACF;;;AClCA,SAAS,OAAO,MAAM,UAAU,QAAQ,UAAU;AAClD,OAAOA,WAAU;AAEjB,eAAsB,aAAgB,UAAqC;AACzE,MAAI;AACF,UAAM,MAAM,MAAM,SAAS,UAAU,MAAM;AAC3C,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,SAAS,OAAO;AACd,QAAI,YAAY,OAAO,QAAQ,GAAG;AAChC,aAAO;AAAA,IACT;AACA,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,cAAc,UAAkB,OAAgB,OAAO,KAAsB;AACjG,QAAM,MAAMA,MAAK,QAAQ,QAAQ,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACpE,QAAM,UAAU,GAAG,QAAQ,IAAI,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC;AACxD,QAAM,UAAU,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA;AACjD,QAAM,SAAS,MAAM,KAAK,SAAS,KAAK,IAAI;AAC5C,MAAI;AACF,UAAM,OAAO,UAAU,SAAS,MAAM;AACtC,UAAM,OAAO,KAAK;AAAA,EACpB,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACA,MAAI;AACF,UAAM,OAAO,SAAS,QAAQ;AAAA,EAChC,SAAS,OAAO;AACd,UAAM,GAAG,SAAS,EAAE,OAAO,KAAK,CAAC;AACjC,UAAM;AAAA,EACR;AACF;AAEA,SAAS,YAAY,OAAgB,MAAuB;AAC1D,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,SAAS,MAAM,SAAS;AAC1F;;;ACzBO,IAAM,oBAAgC;AAAA,EAC3C,MAAM;AAAA,EACN,eAAe;AAAA,EACf,cAAc;AAAA,EACd,UAAU;AACZ;AAEA,eAAsB,WAAW,QAAsB,oBAAoB,GAAwB;AACjG,QAAM,WAAW,MAAM,aAAkC,MAAM,UAAU;AACzE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,GAAI,YAAY,CAAC;AAAA,EACnB;AACF;;;ACxBA,SAAS,mBAAmB;AAC5B,SAAS,UAAU,SAAAC,QAAO,YAAAC,WAAU,iBAAiB;AACrD,OAAOC,SAAQ;AACf,OAAOC,WAAU;AACjB,OAAO,UAAU;AAiBV,SAAS,wBAAwB,cAAc,WAAmB;AACvE,MAAI,gBAAgB,WAAW;AAC7B,WAAOA,MAAK,KAAKD,IAAG,QAAQ,GAAG,SAAS;AAAA,EAC1C;AACA,SAAOC,MAAK,KAAKD,IAAG,QAAQ,GAAG,WAAW,YAAY,WAAW;AACnE;AAEO,SAAS,wBAAwB,cAAc,WAAmB;AACvE,SAAOC,MAAK,KAAK,wBAAwB,WAAW,GAAG,aAAa;AACtE;AAEA,eAAsB,0BACpB,cAAc,WACd,aAAa,wBAAwB,WAAW,GAChB;AAChC,QAAM,cAAc,MAAMF,UAAS,YAAY,MAAM,EAAE,MAAM,CAAC,UAAmB;AAC/E,QAAIG,aAAY,OAAO,QAAQ,GAAG;AAChC,aAAO;AAAA,IACT;AACA,UAAM;AAAA,EACR,CAAC;AACD,MAAI,CAAC,aAAa;AAChB,WAAO,CAAC;AAAA,EACV;AACA,QAAM,SAAS,SAAS,KAAK,MAAM,WAAW,CAAC;AAC/C,QAAM,YAAY,SAAS,OAAO,SAAS;AAC3C,QAAM,YAAY,SAAS,UAAU,UAAU;AAC/C,SAAO,oBAAoB,SAAS,UAAU,KAAK,CAAC;AACtD;AAEA,eAAsB,yBACpB,cAAc,WACd,aAAa,wBAAwB,WAAW,GACb;AACnC,QAAM,cAAc,MAAMH,UAAS,YAAY,MAAM,EAAE,MAAM,CAAC,UAAmB;AAC/E,QAAIG,aAAY,OAAO,QAAQ,GAAG;AAChC,aAAO;AAAA,IACT;AACA,UAAM;AAAA,EACR,CAAC;AACD,QAAM,WAAW,cAAc,KAAK,cAAc,WAAW,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC;AACrF,QAAM,SAAS,SAAS,SAAS,OAAO,CAAC;AACzC,QAAM,YAAY,aAAa,QAAQ,WAAW;AAClD,QAAM,YAAY,aAAa,WAAW,YAAY;AACtD,QAAM,QAAQ,aAAa,WAAW,OAAO;AAC7C,QAAM,YAAY,OAAO,MAAM,QAAQ,YAAY,MAAM,IAAI,SAAS,IAAI,MAAM,MAAM;AAEtF,MAAI,UAAU;AACd,MAAI,CAAC,WAAW;AACd,UAAM,MAAM,YAAY,EAAE,EAAE,SAAS,WAAW;AAChD,cAAU;AAAA,EACZ;AAEA,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,MACL;AAAA,MACA,WAAW,oBAAoB,KAAK;AAAA,MACpC,SAAS;AAAA,MACT,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,QAAQ;AAAA,IACV;AAAA,EACF;AAEA,QAAM,aAAa,cAAc,GAAG,UAAU,QAAQ,KAAK,IAAI,CAAC,KAAK;AACrE,QAAMJ,OAAMG,MAAK,QAAQ,UAAU,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACtE,MAAI,YAAY;AACd,UAAM,SAAS,YAAY,UAAU;AAAA,EACvC;AACA,WAAS,WAAW,SAAS,WAAW,MAAM;AAC9C,QAAM,UAAU,YAAY,SAAS,SAAS,GAAG,EAAE,MAAM,IAAM,CAAC;AAEhE,SAAO;AAAA,IACL;AAAA,IACA,WAAW,oBAAoB,KAAK;AAAA,IACpC,SAAS;AAAA,IACT,UAAU;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,EACV;AACF;AAEA,SAAS,oBAAoB,OAAuD;AAClF,SAAO;AAAA,IACL,MAAM,OAAO,MAAM,SAAS,WAAW,MAAM,OAAO;AAAA,IACpD,MAAM,OAAO,MAAM,SAAS,WAAW,MAAM,OAAO;AAAA,IACpD,KAAK,OAAO,MAAM,QAAQ,WAAW,MAAM,MAAM;AAAA,EACnD;AACF;AAEA,SAAS,SAAS,OAAyC;AACzD,SAAO,OAAO,UAAU,YAAY,UAAU,OAAQ,QAAoC,CAAC;AAC7F;AAEA,SAAS,aAAa,QAAiC,KAAsC;AAC3F,QAAM,QAAQ,OAAO,GAAG;AACxB,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,GAAG;AACxE,WAAO;AAAA,EACT;AACA,QAAM,OAAgC,CAAC;AACvC,SAAO,GAAG,IAAI;AACd,SAAO;AACT;AAEA,SAASC,aAAY,OAAgB,MAAuB;AAC1D,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,SAAS,MAAM,SAAS;AAC1F;;;AC/HA,SAAS,qBAAqB,YAAY,YAAY;AACtD,SAAS,SAAAC,QAAO,aAAa;AAC7B,SAAS,SAAS;AAIlB,IAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC5B,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/C,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAChC,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACjC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC5B,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAC9B,CAAC;AAWD,eAAsB,aAAa,QAAsB,oBAAoB,GAAiC;AAC5G,QAAM,QAAQ,MAAM,aAAsB,MAAM,YAAY;AAC5D,MAAI,UAAU,MAAM;AAClB,WAAO;AAAA,EACT;AACA,SAAO,mBAAmB,MAAM,KAAK;AACvC;AAEA,eAAsB,eAAe,QAAsB,oBAAoB,GAA0B;AACvG,QAAM,WAAW,MAAM,aAAa,KAAK;AACzC,MAAI,UAAU;AACZ,WAAO;AAAA,EACT;AAEA,QAAMC,OAAM,MAAM,SAAS,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAC3D,QAAM,MAAM,MAAM,SAAS,GAAK,EAAE,MAAM,MAAM,MAAS;AAEvD,QAAM,EAAE,WAAW,WAAW,IAAI,oBAAoB,SAAS;AAC/D,QAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,QAAM,WAAyB;AAAA,IAC7B,YAAY,WAAW,WAAW,EAAE,WAAW,KAAK,EAAE,CAAC;AAAA,IACvD,SAAS;AAAA,IACT,gBAAgB,UAAU,OAAO,EAAE,MAAM,QAAQ,QAAQ,MAAM,CAAC,EAAE,SAAS;AAAA,IAC3E,iBAAiB,WAAW,OAAO,EAAE,MAAM,SAAS,QAAQ,MAAM,CAAC,EAAE,SAAS;AAAA,IAC9E,YAAY;AAAA,IACZ,YAAY;AAAA,EACd;AACA,QAAM,cAAc,MAAM,cAAc,QAAQ;AAChD,SAAO;AACT;AAEA,eAAsB,mBACpB,QACA,QAAsB,oBAAoB,GACnB;AACvB,QAAM,WAAW,MAAM,eAAe,KAAK;AAC3C,QAAM,OAAqB;AAAA,IACzB,GAAG;AAAA,IACH,SAAS;AAAA,IACT,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrC;AACA,QAAM,cAAc,MAAM,cAAc,IAAI;AAC5C,SAAO;AACT;AAEO,SAAS,eAAe,UAAwB,OAAuB;AAC5E,QAAM,YAAY,KAAK,MAAM,OAAO,KAAK,OAAO,MAAM,GAAG,SAAS,eAAe;AACjF,SAAO,UAAU,SAAS,WAAW;AACvC;AAEO,SAAS,kBAAkB,UAAwC;AACxE,SAAO;AAAA,IACL,WAAW,SAAS;AAAA,IACpB,QAAQ,SAAS,WAAW;AAAA,IAC5B,eAAe,SAAS,gBAAgB,KAAK,EAAE,SAAS;AAAA,IACxD,cAAc,SAAS;AAAA,EACzB;AACF;","names":["path","mkdir","readFile","os","path","isNodeError","mkdir","mkdir"]}

package/dist/cli/index.d.ts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/cli/index.js

@@ -0,0 +1,161 @@
+#!/usr/bin/env node
+import {
+  LINK_COMMAND,
+  LINK_VERSION,
+  ensureHermesApiServerKey,
+  ensureIdentity,
+  getIdentityStatus,
+  loadConfig,
+  loadIdentity,
+  resolveRuntimePaths,
+  saveAssignedLinkId,
+  signRelayNonce
+} from "../chunk-YTX3DQGX.js";
+
+// src/cli/index.ts
+import { Command } from "commander";
+
+// src/relay/bootstrap.ts
+async function bootstrapRelayLink(options) {
+  const fetcher = options.fetchImpl ?? fetch;
+  const baseUrl = options.relayBaseUrl.replace(/\/+$/u, "");
+  const commonPayload = {
+    install_id: options.identity.install_id,
+    link_id: options.identity.link_id ?? void 0,
+    public_key_pem: options.identity.public_key_pem
+  };
+  const challenge = await postJson(
+    fetcher,
+    `${baseUrl}/api/v1/relay/link/challenge`,
+    options.relayBootstrapToken,
+    commonPayload
+  );
+  if (challenge.ok !== true || typeof challenge.nonce !== "string") {
+    throw new Error("Relay did not return a valid install challenge");
+  }
+  const proof = {
+    nonce: challenge.nonce,
+    signature: signRelayNonce(options.identity, challenge.nonce)
+  };
+  const assigned = await postJson(
+    fetcher,
+    `${baseUrl}/api/v1/relay/link/bootstrap`,
+    options.relayBootstrapToken,
+    {
+      ...commonPayload,
+      proof
+    }
+  );
+  if (assigned.ok !== true || typeof assigned.link_id !== "string") {
+    throw new Error("Relay did not return a valid link_id");
+  }
+  await saveAssignedLinkId(assigned.link_id, options.paths ?? resolveRuntimePaths());
+  return {
+    linkId: assigned.link_id,
+    reused: assigned.reused === true
+  };
+}
+async function postJson(fetcher, url, token, body) {
+  const response = await fetcher(url, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${token}`,
+      "content-type": "application/json"
+    },
+    body: JSON.stringify(body)
+  });
+  const payload = await response.json().catch(() => null);
+  if (!response.ok) {
+    const message = readErrorMessage(payload) ?? `Relay request failed with HTTP ${response.status}`;
+    throw new Error(message);
+  }
+  if (!payload) {
+    throw new Error("Relay returned an empty response");
+  }
+  return payload;
+}
+function readErrorMessage(payload) {
+  if (typeof payload !== "object" || payload === null) {
+    return null;
+  }
+  const error = payload.error;
+  if (typeof error !== "object" || error === null) {
+    return null;
+  }
+  const message = error.message;
+  return typeof message === "string" ? message : null;
+}
+
+// src/cli/index.ts
+var program = new Command();
+program.name(LINK_COMMAND).description("Hermes Link companion service").version(LINK_VERSION, "-v, --version", "print Hermes Link version");
+program.command("status").option("--json", "print machine-readable status").description("Show local Hermes Link status").action(async (options) => {
+  const paths = resolveRuntimePaths();
+  const [identity, config] = await Promise.all([loadIdentity(paths), loadConfig(paths)]);
+  const payload = {
+    version: LINK_VERSION,
+    runtimeHome: paths.homeDir,
+    paired: Boolean(identity?.link_id),
+    mode: identity?.link_id ? "paired" : "local-only",
+    port: config.port,
+    identity: identity ? getIdentityStatus(identity) : null,
+    relay: {
+      configured: Boolean(config.relayBaseUrl),
+      connected: false
+    }
+  };
+  if (options.json) {
+    console.log(JSON.stringify(payload, null, 2));
+    return;
+  }
+  console.log(`Hermes Link ${payload.version}`);
+  console.log(`Runtime: ${payload.runtimeHome}`);
+  console.log(`Mode: ${payload.mode}`);
+  console.log(`Local port: ${payload.port}`);
+  console.log(`Link ID: ${payload.identity?.linkId ?? "not paired"}`);
+});
+program.command("start").description("Start Hermes Link daemon").action(async () => {
+  const identity = await loadIdentity();
+  if (!identity?.link_id) {
+    console.log("Hermes Link is not paired yet. Starting in local-only maintenance mode.");
+    console.log("Relay, Server polling, and LAN entrypoints stay disabled until you run `hermeslink pair`.");
+    return;
+  }
+  console.log("Daemon start is not wired yet in this scaffold. Protocol identity is ready.");
+});
+program.command("pair").option("--relay-bootstrap-token <token>", "short-lived relay bootstrap token from HermesPilot Server").description("Create a Hermes Link pairing session").action(async (options) => {
+  const paths = resolveRuntimePaths();
+  const identity = await ensureIdentity(paths);
+  const config = await loadConfig(paths);
+  const token = options.relayBootstrapToken ?? process.env.HERMESLINK_RELAY_BOOTSTRAP_TOKEN;
+  if (!token) {
+    console.log("Pairing requires HermesPilot Server and Relay.");
+    console.log("Server must issue a short-lived relay_bootstrap_token before Link can request a link_id.");
+    return;
+  }
+  const result = await bootstrapRelayLink({
+    relayBaseUrl: config.relayBaseUrl,
+    relayBootstrapToken: token,
+    identity,
+    paths
+  });
+  console.log(`Relay link_id: ${result.linkId}${result.reused ? " (reused)" : ""}`);
+});
+program.command("doctor").description("Run local diagnostics").action(async () => {
+  const identity = await ensureIdentity();
+  const hermesConfig = await ensureHermesApiServerKey();
+  console.log("Runtime identity: OK");
+  console.log(`Install ID: ${identity.install_id}`);
+  console.log(`Link ID: ${identity.link_id ?? "not assigned"}`);
+  if (hermesConfig.notice) {
+    console.log(hermesConfig.notice);
+    if (hermesConfig.backupPath) {
+      console.log(`Hermes config backup: ${hermesConfig.backupPath}`);
+    }
+  }
+});
+program.parseAsync(process.argv).catch((error) => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+});
+//# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/cli/index.ts","../../src/relay/bootstrap.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { Command } from 'commander'\nimport { LINK_COMMAND, LINK_VERSION } from '../constants.js'\nimport { loadConfig } from '../config/config.js'\nimport { ensureHermesApiServerKey } from '../hermes/config.js'\nimport { ensureIdentity, getIdentityStatus, loadIdentity } from '../identity/identity.js'\nimport { bootstrapRelayLink } from '../relay/bootstrap.js'\nimport { resolveRuntimePaths } from '../runtime/paths.js'\n\nconst program = new Command()\n\nprogram\n  .name(LINK_COMMAND)\n  .description('Hermes Link companion service')\n  .version(LINK_VERSION, '-v, --version', 'print Hermes Link version')\n\nprogram\n  .command('status')\n  .option('--json', 'print machine-readable status')\n  .description('Show local Hermes Link status')\n  .action(async (options: { json?: boolean }) => {\n    const paths = resolveRuntimePaths()\n    const [identity, config] = await Promise.all([loadIdentity(paths), loadConfig(paths)])\n    const payload = {\n      version: LINK_VERSION,\n      runtimeHome: paths.homeDir,\n      paired: Boolean(identity?.link_id),\n      mode: identity?.link_id ? 'paired' : 'local-only',\n      port: config.port,\n      identity: identity ? getIdentityStatus(identity) : null,\n      relay: {\n        configured: Boolean(config.relayBaseUrl),\n        connected: false,\n      },\n    }\n    if (options.json) {\n      console.log(JSON.stringify(payload, null, 2))\n      return\n    }\n    console.log(`Hermes Link ${payload.version}`)\n    console.log(`Runtime: ${payload.runtimeHome}`)\n    console.log(`Mode: ${payload.mode}`)\n    console.log(`Local port: ${payload.port}`)\n    console.log(`Link ID: ${payload.identity?.linkId ?? 'not paired'}`)\n  })\n\nprogram\n  .command('start')\n  .description('Start Hermes Link daemon')\n  .action(async () => {\n    const identity = await loadIdentity()\n    if (!identity?.link_id) {\n      console.log('Hermes Link is not paired yet. Starting in local-only maintenance mode.')\n      console.log('Relay, Server polling, and LAN entrypoints stay disabled until you run `hermeslink pair`.')\n      return\n    }\n    console.log('Daemon start is not wired yet in this scaffold. Protocol identity is ready.')\n  })\n\nprogram\n  .command('pair')\n  .option('--relay-bootstrap-token <token>', 'short-lived relay bootstrap token from HermesPilot Server')\n  .description('Create a Hermes Link pairing session')\n  .action(async (options: { relayBootstrapToken?: string }) => {\n    const paths = resolveRuntimePaths()\n    const identity = await ensureIdentity(paths)\n    const config = await loadConfig(paths)\n    const token = options.relayBootstrapToken ?? process.env.HERMESLINK_RELAY_BOOTSTRAP_TOKEN\n    if (!token) {\n      console.log('Pairing requires HermesPilot Server and Relay.')\n      console.log('Server must issue a short-lived relay_bootstrap_token before Link can request a link_id.')\n      return\n    }\n    const result = await bootstrapRelayLink({\n      relayBaseUrl: config.relayBaseUrl,\n      relayBootstrapToken: token,\n      identity,\n      paths,\n    })\n    console.log(`Relay link_id: ${result.linkId}${result.reused ? ' (reused)' : ''}`)\n  })\n\nprogram\n  .command('doctor')\n  .description('Run local diagnostics')\n  .action(async () => {\n    const identity = await ensureIdentity()\n    const hermesConfig = await ensureHermesApiServerKey()\n    console.log('Runtime identity: OK')\n    console.log(`Install ID: ${identity.install_id}`)\n    console.log(`Link ID: ${identity.link_id ?? 'not assigned'}`)\n    if (hermesConfig.notice) {\n      console.log(hermesConfig.notice)\n      if (hermesConfig.backupPath) {\n        console.log(`Hermes config backup: ${hermesConfig.backupPath}`)\n      }\n    }\n  })\n\nprogram.parseAsync(process.argv).catch((error) => {\n  console.error(error instanceof Error ? error.message : String(error))\n  process.exitCode = 1\n})\n","import { saveAssignedLinkId, signRelayNonce, type LinkIdentity } from '../identity/identity.js'\nimport { resolveRuntimePaths, type RuntimePaths } from '../runtime/paths.js'\n\nexport interface RelayBootstrapOptions {\n  relayBaseUrl: string\n  relayBootstrapToken: string\n  identity: LinkIdentity\n  paths?: RuntimePaths\n  fetchImpl?: typeof fetch\n}\n\nexport interface RelayBootstrapResult {\n  linkId: string\n  reused: boolean\n}\n\ninterface RelayChallengeResponse {\n  ok?: unknown\n  nonce?: unknown\n  expires_at?: unknown\n}\n\ninterface RelayBootstrapResponse {\n  ok?: unknown\n  link_id?: unknown\n  reused?: unknown\n}\n\nexport async function bootstrapRelayLink(options: RelayBootstrapOptions): Promise<RelayBootstrapResult> {\n  const fetcher = options.fetchImpl ?? fetch\n  const baseUrl = options.relayBaseUrl.replace(/\\/+$/u, '')\n  const commonPayload = {\n    install_id: options.identity.install_id,\n    link_id: options.identity.link_id ?? undefined,\n    public_key_pem: options.identity.public_key_pem,\n  }\n  const challenge = await postJson<RelayChallengeResponse>(\n    fetcher,\n    `${baseUrl}/api/v1/relay/link/challenge`,\n    options.relayBootstrapToken,\n    commonPayload,\n  )\n  if (challenge.ok !== true || typeof challenge.nonce !== 'string') {\n    throw new Error('Relay did not return a valid install challenge')\n  }\n\n  const proof = {\n    nonce: challenge.nonce,\n    signature: signRelayNonce(options.identity, challenge.nonce),\n  }\n  const assigned = await postJson<RelayBootstrapResponse>(\n    fetcher,\n    `${baseUrl}/api/v1/relay/link/bootstrap`,\n    options.relayBootstrapToken,\n    {\n      ...commonPayload,\n      proof,\n    },\n  )\n  if (assigned.ok !== true || typeof assigned.link_id !== 'string') {\n    throw new Error('Relay did not return a valid link_id')\n  }\n\n  await saveAssignedLinkId(assigned.link_id, options.paths ?? resolveRuntimePaths())\n  return {\n    linkId: assigned.link_id,\n    reused: assigned.reused === true,\n  }\n}\n\nasync function postJson<T>(\n  fetcher: typeof fetch,\n  url: string,\n  token: string,\n  body: Record<string, unknown>,\n): Promise<T> {\n  const response = await fetcher(url, {\n    method: 'POST',\n    headers: {\n      authorization: `Bearer ${token}`,\n      'content-type': 'application/json',\n    },\n    body: JSON.stringify(body),\n  })\n  const payload = (await response.json().catch(() => null)) as T | null\n  if (!response.ok) {\n    const message = readErrorMessage(payload) ?? `Relay request failed with HTTP ${response.status}`\n    throw new Error(message)\n  }\n  if (!payload) {\n    throw new Error('Relay returned an empty response')\n  }\n  return payload\n}\n\nfunction readErrorMessage(payload: unknown): string | null {\n  if (typeof payload !== 'object' || payload === null) {\n    return null\n  }\n  const error = (payload as { error?: unknown }).error\n  if (typeof error !== 'object' || error === null) {\n    return null\n  }\n  const message = (error as { message?: unknown }).message\n  return typeof message === 'string' ? message : null\n}\n"],"mappings":";;;;;;;;;;;;;;;AACA,SAAS,eAAe;;;AC2BxB,eAAsB,mBAAmB,SAA+D;AACtG,QAAM,UAAU,QAAQ,aAAa;AACrC,QAAM,UAAU,QAAQ,aAAa,QAAQ,SAAS,EAAE;AACxD,QAAM,gBAAgB;AAAA,IACpB,YAAY,QAAQ,SAAS;AAAA,IAC7B,SAAS,QAAQ,SAAS,WAAW;AAAA,IACrC,gBAAgB,QAAQ,SAAS;AAAA,EACnC;AACA,QAAM,YAAY,MAAM;AAAA,IACtB;AAAA,IACA,GAAG,OAAO;AAAA,IACV,QAAQ;AAAA,IACR;AAAA,EACF;AACA,MAAI,UAAU,OAAO,QAAQ,OAAO,UAAU,UAAU,UAAU;AAChE,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AAEA,QAAM,QAAQ;AAAA,IACZ,OAAO,UAAU;AAAA,IACjB,WAAW,eAAe,QAAQ,UAAU,UAAU,KAAK;AAAA,EAC7D;AACA,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA,GAAG,OAAO;AAAA,IACV,QAAQ;AAAA,IACR;AAAA,MACE,GAAG;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,OAAO,QAAQ,OAAO,SAAS,YAAY,UAAU;AAChE,UAAM,IAAI,MAAM,sCAAsC;AAAA,EACxD;AAEA,QAAM,mBAAmB,SAAS,SAAS,QAAQ,SAAS,oBAAoB,CAAC;AACjF,SAAO;AAAA,IACL,QAAQ,SAAS;AAAA,IACjB,QAAQ,SAAS,WAAW;AAAA,EAC9B;AACF;AAEA,eAAe,SACb,SACA,KACA,OACA,MACY;AACZ,QAAM,WAAW,MAAM,QAAQ,KAAK;AAAA,IAClC,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,eAAe,UAAU,KAAK;AAAA,MAC9B,gBAAgB;AAAA,IAClB;AAAA,IACA,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AACD,QAAM,UAAW,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AACvD,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,UAAU,iBAAiB,OAAO,KAAK,kCAAkC,SAAS,MAAM;AAC9F,UAAM,IAAI,MAAM,OAAO;AAAA,EACzB;AACA,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,kCAAkC;AAAA,EACpD;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,SAAiC;AACzD,MAAI,OAAO,YAAY,YAAY,YAAY,MAAM;AACnD,WAAO;AAAA,EACT;AACA,QAAM,QAAS,QAAgC;AAC/C,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,WAAO;AAAA,EACT;AACA,QAAM,UAAW,MAAgC;AACjD,SAAO,OAAO,YAAY,WAAW,UAAU;AACjD;;;ADhGA,IAAM,UAAU,IAAI,QAAQ;AAE5B,QACG,KAAK,YAAY,EACjB,YAAY,+BAA+B,EAC3C,QAAQ,cAAc,iBAAiB,2BAA2B;AAErE,QACG,QAAQ,QAAQ,EAChB,OAAO,UAAU,+BAA+B,EAChD,YAAY,+BAA+B,EAC3C,OAAO,OAAO,YAAgC;AAC7C,QAAM,QAAQ,oBAAoB;AAClC,QAAM,CAAC,UAAU,MAAM,IAAI,MAAM,QAAQ,IAAI,CAAC,aAAa,KAAK,GAAG,WAAW,KAAK,CAAC,CAAC;AACrF,QAAM,UAAU;AAAA,IACd,SAAS;AAAA,IACT,aAAa,MAAM;AAAA,IACnB,QAAQ,QAAQ,UAAU,OAAO;AAAA,IACjC,MAAM,UAAU,UAAU,WAAW;AAAA,IACrC,MAAM,OAAO;AAAA,IACb,UAAU,WAAW,kBAAkB,QAAQ,IAAI;AAAA,IACnD,OAAO;AAAA,MACL,YAAY,QAAQ,OAAO,YAAY;AAAA,MACvC,WAAW;AAAA,IACb;AAAA,EACF;AACA,MAAI,QAAQ,MAAM;AAChB,YAAQ,IAAI,KAAK,UAAU,SAAS,MAAM,CAAC,CAAC;AAC5C;AAAA,EACF;AACA,UAAQ,IAAI,eAAe,QAAQ,OAAO,EAAE;AAC5C,UAAQ,IAAI,YAAY,QAAQ,WAAW,EAAE;AAC7C,UAAQ,IAAI,SAAS,QAAQ,IAAI,EAAE;AACnC,UAAQ,IAAI,eAAe,QAAQ,IAAI,EAAE;AACzC,UAAQ,IAAI,YAAY,QAAQ,UAAU,UAAU,YAAY,EAAE;AACpE,CAAC;AAEH,QACG,QAAQ,OAAO,EACf,YAAY,0BAA0B,EACtC,OAAO,YAAY;AAClB,QAAM,WAAW,MAAM,aAAa;AACpC,MAAI,CAAC,UAAU,SAAS;AACtB,YAAQ,IAAI,yEAAyE;AACrF,YAAQ,IAAI,2FAA2F;AACvG;AAAA,EACF;AACA,UAAQ,IAAI,6EAA6E;AAC3F,CAAC;AAEH,QACG,QAAQ,MAAM,EACd,OAAO,mCAAmC,2DAA2D,EACrG,YAAY,sCAAsC,EAClD,OAAO,OAAO,YAA8C;AAC3D,QAAM,QAAQ,oBAAoB;AAClC,QAAM,WAAW,MAAM,eAAe,KAAK;AAC3C,QAAM,SAAS,MAAM,WAAW,KAAK;AACrC,QAAM,QAAQ,QAAQ,uBAAuB,QAAQ,IAAI;AACzD,MAAI,CAAC,OAAO;AACV,YAAQ,IAAI,gDAAgD;AAC5D,YAAQ,IAAI,0FAA0F;AACtG;AAAA,EACF;AACA,QAAM,SAAS,MAAM,mBAAmB;AAAA,IACtC,cAAc,OAAO;AAAA,IACrB,qBAAqB;AAAA,IACrB;AAAA,IACA;AAAA,EACF,CAAC;AACD,UAAQ,IAAI,kBAAkB,OAAO,MAAM,GAAG,OAAO,SAAS,cAAc,EAAE,EAAE;AAClF,CAAC;AAEH,QACG,QAAQ,QAAQ,EAChB,YAAY,uBAAuB,EACnC,OAAO,YAAY;AAClB,QAAM,WAAW,MAAM,eAAe;AACtC,QAAM,eAAe,MAAM,yBAAyB;AACpD,UAAQ,IAAI,sBAAsB;AAClC,UAAQ,IAAI,eAAe,SAAS,UAAU,EAAE;AAChD,UAAQ,IAAI,YAAY,SAAS,WAAW,cAAc,EAAE;AAC5D,MAAI,aAAa,QAAQ;AACvB,YAAQ,IAAI,aAAa,MAAM;AAC/B,QAAI,aAAa,YAAY;AAC3B,cAAQ,IAAI,yBAAyB,aAAa,UAAU,EAAE;AAAA,IAChE;AAAA,EACF;AACF,CAAC;AAEH,QAAQ,WAAW,QAAQ,IAAI,EAAE,MAAM,CAAC,UAAU;AAChD,UAAQ,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AACpE,UAAQ,WAAW;AACrB,CAAC;","names":[]}

package/dist/http/app.d.ts

@@ -0,0 +1,5 @@
+import Koa from 'koa';
+
+declare function createApp(): Promise<Koa>;
+
+export { createApp };

package/dist/http/app.js

@@ -0,0 +1,241 @@
+import {
+  LINK_VERSION,
+  ensureHermesApiServerKey,
+  loadConfig,
+  loadIdentity,
+  readHermesApiServerConfig,
+  readJsonFile,
+  resolveHermesConfigPath,
+  resolveHermesProfileDir,
+  resolveRuntimePaths,
+  writeJsonFile
+} from "../chunk-YTX3DQGX.js";
+
+// src/http/app.ts
+import Koa from "koa";
+import Router from "@koa/router";
+
+// src/hermes/profiles.ts
+import { mkdir, readdir, rename, rm, stat } from "fs/promises";
+import os from "os";
+import path from "path";
+var DEFAULT_PROFILE = "default";
+var PROFILE_NAME_PATTERN = /^[a-zA-Z0-9._-]{1,64}$/;
+async function listHermesProfiles(paths = resolveRuntimePaths()) {
+  const activeProfile = await getActiveProfile(paths);
+  const profiles = /* @__PURE__ */ new Map();
+  profiles.set(DEFAULT_PROFILE, profileInfo(DEFAULT_PROFILE, activeProfile));
+  const profilesDir = path.join(os.homedir(), ".hermes", "profiles");
+  const entries = await readdir(profilesDir, { withFileTypes: true }).catch((error) => {
+    if (isNodeError(error, "ENOENT")) {
+      return [];
+    }
+    throw error;
+  });
+  for (const entry of entries) {
+    if (entry.isDirectory() && PROFILE_NAME_PATTERN.test(entry.name)) {
+      profiles.set(entry.name, profileInfo(entry.name, activeProfile));
+    }
+  }
+  return [...profiles.values()].sort((left, right) => {
+    if (left.name === DEFAULT_PROFILE) {
+      return -1;
+    }
+    if (right.name === DEFAULT_PROFILE) {
+      return 1;
+    }
+    return left.name.localeCompare(right.name);
+  });
+}
+async function getHermesProfileStatus(name, paths = resolveRuntimePaths()) {
+  assertProfileName(name);
+  const profile = profileInfo(name, await getActiveProfile(paths));
+  const exists = await stat(profile.path).then((value) => value.isDirectory()).catch((error) => {
+    if (isNodeError(error, "ENOENT")) {
+      return false;
+    }
+    throw error;
+  });
+  const config = await readHermesApiServerConfig(name, profile.configPath);
+  return {
+    ...profile,
+    exists,
+    apiKeyConfigured: Boolean(config.key)
+  };
+}
+async function createHermesProfile(name) {
+  assertProfileName(name);
+  if (name === DEFAULT_PROFILE) {
+    throw new Error("default profile already exists");
+  }
+  const profile = profileInfo(name, DEFAULT_PROFILE);
+  if (await pathExists(profile.path)) {
+    throw new Error("profile already exists");
+  }
+  await mkdir(profile.path, { recursive: true, mode: 448 });
+  await ensureHermesApiServerKey(name, profile.configPath);
+  return profile;
+}
+async function useHermesProfile(name, paths = resolveRuntimePaths()) {
+  assertProfileName(name);
+  const profile = profileInfo(name, name);
+  await mkdir(profile.path, { recursive: true, mode: 448 });
+  const current = await readJsonFile(paths.stateFile) ?? {};
+  await writeJsonFile(paths.stateFile, { ...current, activeProfile: name });
+  return profile;
+}
+async function renameHermesProfile(oldName, newName) {
+  assertMutableProfile(oldName);
+  assertMutableProfile(newName);
+  const oldProfile = profileInfo(oldName, DEFAULT_PROFILE);
+  const newProfile = profileInfo(newName, DEFAULT_PROFILE);
+  await rename(oldProfile.path, newProfile.path);
+  return newProfile;
+}
+async function deleteHermesProfile(name) {
+  assertMutableProfile(name);
+  await rm(resolveHermesProfileDir(name), { recursive: true, force: true });
+}
+async function getActiveProfile(paths) {
+  const state = await readJsonFile(paths.stateFile);
+  return typeof state?.activeProfile === "string" && PROFILE_NAME_PATTERN.test(state.activeProfile) ? state.activeProfile : DEFAULT_PROFILE;
+}
+function profileInfo(name, activeProfile) {
+  return {
+    name,
+    active: name === activeProfile,
+    path: resolveHermesProfileDir(name),
+    configPath: resolveHermesConfigPath(name)
+  };
+}
+function assertMutableProfile(name) {
+  assertProfileName(name);
+  if (name === DEFAULT_PROFILE) {
+    throw new Error("default profile cannot be renamed or deleted");
+  }
+}
+function assertProfileName(name) {
+  if (!PROFILE_NAME_PATTERN.test(name)) {
+    throw new Error("invalid profile name");
+  }
+}
+async function pathExists(targetPath) {
+  return await stat(targetPath).then(() => true).catch((error) => {
+    if (isNodeError(error, "ENOENT")) {
+      return false;
+    }
+    throw error;
+  });
+}
+function isNodeError(error, code) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}
+
+// src/http/app.ts
+async function createApp() {
+  const app = new Koa();
+  const router = new Router();
+  app.use(async (ctx, next) => {
+    try {
+      await next();
+    } catch (error) {
+      ctx.status = error instanceof Error && error.message === "invalid profile name" ? 400 : 500;
+      ctx.body = {
+        ok: false,
+        error: {
+          code: ctx.status === 400 ? "invalid_profile_name" : "internal_error",
+          message: error instanceof Error ? error.message : "Internal error"
+        }
+      };
+    }
+  });
+  router.get("/api/v1/bootstrap", async (ctx) => {
+    const [identity, config] = await Promise.all([loadIdentity(), loadConfig()]);
+    ctx.set("cache-control", "no-store");
+    ctx.body = {
+      link_id: identity?.link_id ?? null,
+      display_name: identity?.link_id ? "Hermes Link" : "Unpaired Hermes Link",
+      version: LINK_VERSION,
+      api_version: 1,
+      paired: Boolean(identity?.link_id),
+      routes: identity?.link_id ? [
+        {
+          kind: "lan",
+          url: `http://127.0.0.1:${config.port}`,
+          priority: 10,
+          observed_at: (/* @__PURE__ */ new Date()).toISOString()
+        }
+      ] : [],
+      capabilities: {
+        runs: true,
+        sse: true,
+        relay: true,
+        profiles: true
+      }
+    };
+  });
+  router.get("/api/v1/profiles", async (ctx) => {
+    ctx.set("cache-control", "no-store");
+    ctx.body = {
+      ok: true,
+      profiles: await listHermesProfiles()
+    };
+  });
+  router.get("/api/v1/profiles/:name/status", async (ctx) => {
+    ctx.set("cache-control", "no-store");
+    ctx.body = {
+      ok: true,
+      profile: await getHermesProfileStatus(ctx.params.name)
+    };
+  });
+  router.post("/api/v1/profiles", async (ctx) => {
+    const body = await readJsonBody(ctx.req);
+    const name = readProfileName(body);
+    ctx.status = 201;
+    ctx.body = {
+      ok: true,
+      profile: await createHermesProfile(name)
+    };
+  });
+  router.post("/api/v1/profiles/:name/use", async (ctx) => {
+    ctx.body = {
+      ok: true,
+      profile: await useHermesProfile(ctx.params.name)
+    };
+  });
+  router.patch("/api/v1/profiles/:name", async (ctx) => {
+    const body = await readJsonBody(ctx.req);
+    const name = readProfileName(body);
+    ctx.body = {
+      ok: true,
+      profile: await renameHermesProfile(ctx.params.name, name)
+    };
+  });
+  router.delete("/api/v1/profiles/:name", async (ctx) => {
+    await deleteHermesProfile(ctx.params.name);
+    ctx.status = 204;
+  });
+  app.use(router.routes());
+  app.use(router.allowedMethods());
+  return app;
+}
+async function readJsonBody(request) {
+  const chunks = [];
+  for await (const chunk of request) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  }
+  if (chunks.length === 0) {
+    return {};
+  }
+  return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
+function readProfileName(body) {
+  if (typeof body.name !== "string") {
+    throw new Error("invalid profile name");
+  }
+  return body.name;
+}
+export {
+  createApp
+};
+//# sourceMappingURL=app.js.map

package/dist/http/app.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/http/app.ts","../../src/hermes/profiles.ts"],"sourcesContent":["import Koa from 'koa'\nimport Router from '@koa/router'\nimport { LINK_VERSION } from '../constants.js'\nimport { loadConfig } from '../config/config.js'\nimport {\n  createHermesProfile,\n  deleteHermesProfile,\n  getHermesProfileStatus,\n  listHermesProfiles,\n  renameHermesProfile,\n  useHermesProfile,\n} from '../hermes/profiles.js'\nimport { loadIdentity } from '../identity/identity.js'\n\nexport async function createApp(): Promise<Koa> {\n  const app = new Koa()\n  const router = new Router()\n\n  app.use(async (ctx, next) => {\n    try {\n      await next()\n    } catch (error) {\n      ctx.status = error instanceof Error && error.message === 'invalid profile name' ? 400 : 500\n      ctx.body = {\n        ok: false,\n        error: {\n          code: ctx.status === 400 ? 'invalid_profile_name' : 'internal_error',\n          message: error instanceof Error ? error.message : 'Internal error',\n        },\n      }\n    }\n  })\n\n  router.get('/api/v1/bootstrap', async (ctx) => {\n    const [identity, config] = await Promise.all([loadIdentity(), loadConfig()])\n    ctx.set('cache-control', 'no-store')\n    ctx.body = {\n      link_id: identity?.link_id ?? null,\n      display_name: identity?.link_id ? 'Hermes Link' : 'Unpaired Hermes Link',\n      version: LINK_VERSION,\n      api_version: 1,\n      paired: Boolean(identity?.link_id),\n      routes: identity?.link_id\n        ? [\n            {\n              kind: 'lan',\n              url: `http://127.0.0.1:${config.port}`,\n              priority: 10,\n              observed_at: new Date().toISOString(),\n            },\n          ]\n        : [],\n      capabilities: {\n        runs: true,\n        sse: true,\n        relay: true,\n        profiles: true,\n      },\n    }\n  })\n\n  router.get('/api/v1/profiles', async (ctx) => {\n    ctx.set('cache-control', 'no-store')\n    ctx.body = {\n      ok: true,\n      profiles: await listHermesProfiles(),\n    }\n  })\n\n  router.get('/api/v1/profiles/:name/status', async (ctx) => {\n    ctx.set('cache-control', 'no-store')\n    ctx.body = {\n      ok: true,\n      profile: await getHermesProfileStatus(ctx.params.name),\n    }\n  })\n\n  router.post('/api/v1/profiles', async (ctx) => {\n    const body = await readJsonBody(ctx.req)\n    const name = readProfileName(body)\n    ctx.status = 201\n    ctx.body = {\n      ok: true,\n      profile: await createHermesProfile(name),\n    }\n  })\n\n  router.post('/api/v1/profiles/:name/use', async (ctx) => {\n    ctx.body = {\n      ok: true,\n      profile: await useHermesProfile(ctx.params.name),\n    }\n  })\n\n  router.patch('/api/v1/profiles/:name', async (ctx) => {\n    const body = await readJsonBody(ctx.req)\n    const name = readProfileName(body)\n    ctx.body = {\n      ok: true,\n      profile: await renameHermesProfile(ctx.params.name, name),\n    }\n  })\n\n  router.delete('/api/v1/profiles/:name', async (ctx) => {\n    await deleteHermesProfile(ctx.params.name)\n    ctx.status = 204\n  })\n\n  app.use(router.routes())\n  app.use(router.allowedMethods())\n  return app\n}\n\nasync function readJsonBody(request: NodeJS.ReadableStream): Promise<Record<string, unknown>> {\n  const chunks: Buffer[] = []\n  for await (const chunk of request) {\n    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk))\n  }\n  if (chunks.length === 0) {\n    return {}\n  }\n  return JSON.parse(Buffer.concat(chunks).toString('utf8')) as Record<string, unknown>\n}\n\nfunction readProfileName(body: Record<string, unknown>): string {\n  if (typeof body.name !== 'string') {\n    throw new Error('invalid profile name')\n  }\n  return body.name\n}\n","import { mkdir, readdir, rename, rm, stat } from 'node:fs/promises'\nimport os from 'node:os'\nimport path from 'node:path'\nimport { resolveRuntimePaths, type RuntimePaths } from '../runtime/paths.js'\nimport { readJsonFile, writeJsonFile } from '../storage/atomic-json.js'\nimport {\n  ensureHermesApiServerKey,\n  readHermesApiServerConfig,\n  resolveHermesConfigPath,\n  resolveHermesProfileDir,\n} from './config.js'\n\nexport interface HermesProfile {\n  name: string\n  active: boolean\n  path: string\n  configPath: string\n}\n\ninterface ProfileState {\n  activeProfile: string\n}\n\nconst DEFAULT_PROFILE = 'default'\nconst PROFILE_NAME_PATTERN = /^[a-zA-Z0-9._-]{1,64}$/\n\nexport async function listHermesProfiles(paths: RuntimePaths = resolveRuntimePaths()): Promise<HermesProfile[]> {\n  const activeProfile = await getActiveProfile(paths)\n  const profiles = new Map<string, HermesProfile>()\n  profiles.set(DEFAULT_PROFILE, profileInfo(DEFAULT_PROFILE, activeProfile))\n\n  const profilesDir = path.join(os.homedir(), '.hermes', 'profiles')\n  const entries = await readdir(profilesDir, { withFileTypes: true }).catch((error: unknown) => {\n    if (isNodeError(error, 'ENOENT')) {\n      return []\n    }\n    throw error\n  })\n  for (const entry of entries) {\n    if (entry.isDirectory() && PROFILE_NAME_PATTERN.test(entry.name)) {\n      profiles.set(entry.name, profileInfo(entry.name, activeProfile))\n    }\n  }\n\n  return [...profiles.values()].sort((left, right) => {\n    if (left.name === DEFAULT_PROFILE) {\n      return -1\n    }\n    if (right.name === DEFAULT_PROFILE) {\n      return 1\n    }\n    return left.name.localeCompare(right.name)\n  })\n}\n\nexport async function getHermesProfileStatus(\n  name: string,\n  paths: RuntimePaths = resolveRuntimePaths(),\n): Promise<HermesProfile & { exists: boolean; apiKeyConfigured: boolean }> {\n  assertProfileName(name)\n  const profile = profileInfo(name, await getActiveProfile(paths))\n  const exists = await stat(profile.path)\n    .then((value) => value.isDirectory())\n    .catch((error: unknown) => {\n      if (isNodeError(error, 'ENOENT')) {\n        return false\n      }\n      throw error\n    })\n  const config = await readHermesApiServerConfig(name, profile.configPath)\n  return {\n    ...profile,\n    exists,\n    apiKeyConfigured: Boolean(config.key),\n  }\n}\n\nexport async function createHermesProfile(name: string): Promise<HermesProfile> {\n  assertProfileName(name)\n  if (name === DEFAULT_PROFILE) {\n    throw new Error('default profile already exists')\n  }\n  const profile = profileInfo(name, DEFAULT_PROFILE)\n  if (await pathExists(profile.path)) {\n    throw new Error('profile already exists')\n  }\n  await mkdir(profile.path, { recursive: true, mode: 0o700 })\n  await ensureHermesApiServerKey(name, profile.configPath)\n  return profile\n}\n\nexport async function useHermesProfile(\n  name: string,\n  paths: RuntimePaths = resolveRuntimePaths(),\n): Promise<HermesProfile> {\n  assertProfileName(name)\n  const profile = profileInfo(name, name)\n  await mkdir(profile.path, { recursive: true, mode: 0o700 })\n  const current = (await readJsonFile<Record<string, unknown>>(paths.stateFile)) ?? {}\n  await writeJsonFile(paths.stateFile, { ...current, activeProfile: name } satisfies ProfileState)\n  return profile\n}\n\nexport async function renameHermesProfile(oldName: string, newName: string): Promise<HermesProfile> {\n  assertMutableProfile(oldName)\n  assertMutableProfile(newName)\n  const oldProfile = profileInfo(oldName, DEFAULT_PROFILE)\n  const newProfile = profileInfo(newName, DEFAULT_PROFILE)\n  await rename(oldProfile.path, newProfile.path)\n  return newProfile\n}\n\nexport async function deleteHermesProfile(name: string): Promise<void> {\n  assertMutableProfile(name)\n  await rm(resolveHermesProfileDir(name), { recursive: true, force: true })\n}\n\nasync function getActiveProfile(paths: RuntimePaths): Promise<string> {\n  const state = await readJsonFile<Partial<ProfileState>>(paths.stateFile)\n  return typeof state?.activeProfile === 'string' && PROFILE_NAME_PATTERN.test(state.activeProfile)\n    ? state.activeProfile\n    : DEFAULT_PROFILE\n}\n\nfunction profileInfo(name: string, activeProfile: string): HermesProfile {\n  return {\n    name,\n    active: name === activeProfile,\n    path: resolveHermesProfileDir(name),\n    configPath: resolveHermesConfigPath(name),\n  }\n}\n\nfunction assertMutableProfile(name: string): void {\n  assertProfileName(name)\n  if (name === DEFAULT_PROFILE) {\n    throw new Error('default profile cannot be renamed or deleted')\n  }\n}\n\nfunction assertProfileName(name: string): void {\n  if (!PROFILE_NAME_PATTERN.test(name)) {\n    throw new Error('invalid profile name')\n  }\n}\n\nasync function pathExists(targetPath: string): Promise<boolean> {\n  return await stat(targetPath)\n    .then(() => true)\n    .catch((error: unknown) => {\n      if (isNodeError(error, 'ENOENT')) {\n        return false\n      }\n      throw error\n    })\n}\n\nfunction isNodeError(error: unknown, code: string): boolean {\n  return typeof error === 'object' && error !== null && 'code' in error && error.code === code\n}\n"],"mappings":";;;;;;;;;;;;;;AAAA,OAAO,SAAS;AAChB,OAAO,YAAY;;;ACDnB,SAAS,OAAO,SAAS,QAAQ,IAAI,YAAY;AACjD,OAAO,QAAQ;AACf,OAAO,UAAU;AAqBjB,IAAM,kBAAkB;AACxB,IAAM,uBAAuB;AAE7B,eAAsB,mBAAmB,QAAsB,oBAAoB,GAA6B;AAC9G,QAAM,gBAAgB,MAAM,iBAAiB,KAAK;AAClD,QAAM,WAAW,oBAAI,IAA2B;AAChD,WAAS,IAAI,iBAAiB,YAAY,iBAAiB,aAAa,CAAC;AAEzE,QAAM,cAAc,KAAK,KAAK,GAAG,QAAQ,GAAG,WAAW,UAAU;AACjE,QAAM,UAAU,MAAM,QAAQ,aAAa,EAAE,eAAe,KAAK,CAAC,EAAE,MAAM,CAAC,UAAmB;AAC5F,QAAI,YAAY,OAAO,QAAQ,GAAG;AAChC,aAAO,CAAC;AAAA,IACV;AACA,UAAM;AAAA,EACR,CAAC;AACD,aAAW,SAAS,SAAS;AAC3B,QAAI,MAAM,YAAY,KAAK,qBAAqB,KAAK,MAAM,IAAI,GAAG;AAChE,eAAS,IAAI,MAAM,MAAM,YAAY,MAAM,MAAM,aAAa,CAAC;AAAA,IACjE;AAAA,EACF;AAEA,SAAO,CAAC,GAAG,SAAS,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,UAAU;AAClD,QAAI,KAAK,SAAS,iBAAiB;AACjC,aAAO;AAAA,IACT;AACA,QAAI,MAAM,SAAS,iBAAiB;AAClC,aAAO;AAAA,IACT;AACA,WAAO,KAAK,KAAK,cAAc,MAAM,IAAI;AAAA,EAC3C,CAAC;AACH;AAEA,eAAsB,uBACpB,MACA,QAAsB,oBAAoB,GAC+B;AACzE,oBAAkB,IAAI;AACtB,QAAM,UAAU,YAAY,MAAM,MAAM,iBAAiB,KAAK,CAAC;AAC/D,QAAM,SAAS,MAAM,KAAK,QAAQ,IAAI,EACnC,KAAK,CAAC,UAAU,MAAM,YAAY,CAAC,EACnC,MAAM,CAAC,UAAmB;AACzB,QAAI,YAAY,OAAO,QAAQ,GAAG;AAChC,aAAO;AAAA,IACT;AACA,UAAM;AAAA,EACR,CAAC;AACH,QAAM,SAAS,MAAM,0BAA0B,MAAM,QAAQ,UAAU;AACvE,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,kBAAkB,QAAQ,OAAO,GAAG;AAAA,EACtC;AACF;AAEA,eAAsB,oBAAoB,MAAsC;AAC9E,oBAAkB,IAAI;AACtB,MAAI,SAAS,iBAAiB;AAC5B,UAAM,IAAI,MAAM,gCAAgC;AAAA,EAClD;AACA,QAAM,UAAU,YAAY,MAAM,eAAe;AACjD,MAAI,MAAM,WAAW,QAAQ,IAAI,GAAG;AAClC,UAAM,IAAI,MAAM,wBAAwB;AAAA,EAC1C;AACA,QAAM,MAAM,QAAQ,MAAM,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAC1D,QAAM,yBAAyB,MAAM,QAAQ,UAAU;AACvD,SAAO;AACT;AAEA,eAAsB,iBACpB,MACA,QAAsB,oBAAoB,GAClB;AACxB,oBAAkB,IAAI;AACtB,QAAM,UAAU,YAAY,MAAM,IAAI;AACtC,QAAM,MAAM,QAAQ,MAAM,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAC1D,QAAM,UAAW,MAAM,aAAsC,MAAM,SAAS,KAAM,CAAC;AACnF,QAAM,cAAc,MAAM,WAAW,EAAE,GAAG,SAAS,eAAe,KAAK,CAAwB;AAC/F,SAAO;AACT;AAEA,eAAsB,oBAAoB,SAAiB,SAAyC;AAClG,uBAAqB,OAAO;AAC5B,uBAAqB,OAAO;AAC5B,QAAM,aAAa,YAAY,SAAS,eAAe;AACvD,QAAM,aAAa,YAAY,SAAS,eAAe;AACvD,QAAM,OAAO,WAAW,MAAM,WAAW,IAAI;AAC7C,SAAO;AACT;AAEA,eAAsB,oBAAoB,MAA6B;AACrE,uBAAqB,IAAI;AACzB,QAAM,GAAG,wBAAwB,IAAI,GAAG,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAC1E;AAEA,eAAe,iBAAiB,OAAsC;AACpE,QAAM,QAAQ,MAAM,aAAoC,MAAM,SAAS;AACvE,SAAO,OAAO,OAAO,kBAAkB,YAAY,qBAAqB,KAAK,MAAM,aAAa,IAC5F,MAAM,gBACN;AACN;AAEA,SAAS,YAAY,MAAc,eAAsC;AACvE,SAAO;AAAA,IACL;AAAA,IACA,QAAQ,SAAS;AAAA,IACjB,MAAM,wBAAwB,IAAI;AAAA,IAClC,YAAY,wBAAwB,IAAI;AAAA,EAC1C;AACF;AAEA,SAAS,qBAAqB,MAAoB;AAChD,oBAAkB,IAAI;AACtB,MAAI,SAAS,iBAAiB;AAC5B,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AACF;AAEA,SAAS,kBAAkB,MAAoB;AAC7C,MAAI,CAAC,qBAAqB,KAAK,IAAI,GAAG;AACpC,UAAM,IAAI,MAAM,sBAAsB;AAAA,EACxC;AACF;AAEA,eAAe,WAAW,YAAsC;AAC9D,SAAO,MAAM,KAAK,UAAU,EACzB,KAAK,MAAM,IAAI,EACf,MAAM,CAAC,UAAmB;AACzB,QAAI,YAAY,OAAO,QAAQ,GAAG;AAChC,aAAO;AAAA,IACT;AACA,UAAM;AAAA,EACR,CAAC;AACL;AAEA,SAAS,YAAY,OAAgB,MAAuB;AAC1D,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,SAAS,MAAM,SAAS;AAC1F;;;ADjJA,eAAsB,YAA0B;AAC9C,QAAM,MAAM,IAAI,IAAI;AACpB,QAAM,SAAS,IAAI,OAAO;AAE1B,MAAI,IAAI,OAAO,KAAK,SAAS;AAC3B,QAAI;AACF,YAAM,KAAK;AAAA,IACb,SAAS,OAAO;AACd,UAAI,SAAS,iBAAiB,SAAS,MAAM,YAAY,yBAAyB,MAAM;AACxF,UAAI,OAAO;AAAA,QACT,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,MAAM,IAAI,WAAW,MAAM,yBAAyB;AAAA,UACpD,SAAS,iBAAiB,QAAQ,MAAM,UAAU;AAAA,QACpD;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AAED,SAAO,IAAI,qBAAqB,OAAO,QAAQ;AAC7C,UAAM,CAAC,UAAU,MAAM,IAAI,MAAM,QAAQ,IAAI,CAAC,aAAa,GAAG,WAAW,CAAC,CAAC;AAC3E,QAAI,IAAI,iBAAiB,UAAU;AACnC,QAAI,OAAO;AAAA,MACT,SAAS,UAAU,WAAW;AAAA,MAC9B,cAAc,UAAU,UAAU,gBAAgB;AAAA,MAClD,SAAS;AAAA,MACT,aAAa;AAAA,MACb,QAAQ,QAAQ,UAAU,OAAO;AAAA,MACjC,QAAQ,UAAU,UACd;AAAA,QACE;AAAA,UACE,MAAM;AAAA,UACN,KAAK,oBAAoB,OAAO,IAAI;AAAA,UACpC,UAAU;AAAA,UACV,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,QACtC;AAAA,MACF,IACA,CAAC;AAAA,MACL,cAAc;AAAA,QACZ,MAAM;AAAA,QACN,KAAK;AAAA,QACL,OAAO;AAAA,QACP,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,EACF,CAAC;AAED,SAAO,IAAI,oBAAoB,OAAO,QAAQ;AAC5C,QAAI,IAAI,iBAAiB,UAAU;AACnC,QAAI,OAAO;AAAA,MACT,IAAI;AAAA,MACJ,UAAU,MAAM,mBAAmB;AAAA,IACrC;AAAA,EACF,CAAC;AAED,SAAO,IAAI,iCAAiC,OAAO,QAAQ;AACzD,QAAI,IAAI,iBAAiB,UAAU;AACnC,QAAI,OAAO;AAAA,MACT,IAAI;AAAA,MACJ,SAAS,MAAM,uBAAuB,IAAI,OAAO,IAAI;AAAA,IACvD;AAAA,EACF,CAAC;AAED,SAAO,KAAK,oBAAoB,OAAO,QAAQ;AAC7C,UAAM,OAAO,MAAM,aAAa,IAAI,GAAG;AACvC,UAAM,OAAO,gBAAgB,IAAI;AACjC,QAAI,SAAS;AACb,QAAI,OAAO;AAAA,MACT,IAAI;AAAA,MACJ,SAAS,MAAM,oBAAoB,IAAI;AAAA,IACzC;AAAA,EACF,CAAC;AAED,SAAO,KAAK,8BAA8B,OAAO,QAAQ;AACvD,QAAI,OAAO;AAAA,MACT,IAAI;AAAA,MACJ,SAAS,MAAM,iBAAiB,IAAI,OAAO,IAAI;AAAA,IACjD;AAAA,EACF,CAAC;AAED,SAAO,MAAM,0BAA0B,OAAO,QAAQ;AACpD,UAAM,OAAO,MAAM,aAAa,IAAI,GAAG;AACvC,UAAM,OAAO,gBAAgB,IAAI;AACjC,QAAI,OAAO;AAAA,MACT,IAAI;AAAA,MACJ,SAAS,MAAM,oBAAoB,IAAI,OAAO,MAAM,IAAI;AAAA,IAC1D;AAAA,EACF,CAAC;AAED,SAAO,OAAO,0BAA0B,OAAO,QAAQ;AACrD,UAAM,oBAAoB,IAAI,OAAO,IAAI;AACzC,QAAI,SAAS;AAAA,EACf,CAAC;AAED,MAAI,IAAI,OAAO,OAAO,CAAC;AACvB,MAAI,IAAI,OAAO,eAAe,CAAC;AAC/B,SAAO;AACT;AAEA,eAAe,aAAa,SAAkE;AAC5F,QAAM,SAAmB,CAAC;AAC1B,mBAAiB,SAAS,SAAS;AACjC,WAAO,KAAK,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK,CAAC;AAAA,EACjE;AACA,MAAI,OAAO,WAAW,GAAG;AACvB,WAAO,CAAC;AAAA,EACV;AACA,SAAO,KAAK,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,CAAC;AAC1D;AAEA,SAAS,gBAAgB,MAAuC;AAC9D,MAAI,OAAO,KAAK,SAAS,UAAU;AACjC,UAAM,IAAI,MAAM,sBAAsB;AAAA,EACxC;AACA,SAAO,KAAK;AACd;","names":[]}

package/package.json

@@ -0,0 +1,65 @@
+{
+  "name": "@hermespilot/link",
+  "version": "0.1.0",
+  "private": false,
+  "description": "Hermes Link companion service and CLI for connecting hermes-agent through HermesPilot",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "hermeslink": "dist/cli/index.js"
+  },
+  "files": [
+    "dist",
+    "scripts/check-node-version.mjs",
+    "scripts/postinstall.mjs",
+    "README.md",
+    "LICENSE"
+  ],
+  "keywords": [
+    "hermespilot",
+    "hermes",
+    "hermes-agent",
+    "relay",
+    "link",
+    "cli"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsup src/cli/index.ts src/http/app.ts --format esm --target node22 --dts --sourcemap --clean",
+    "check": "tsc --noEmit",
+    "dev": "tsx src/cli/index.ts",
+    "preinstall": "node ./scripts/check-node-version.mjs",
+    "postinstall": "node ./scripts/postinstall.mjs",
+    "prepack": "npm run build",
+    "pack:dry-run": "npm pack --dry-run",
+    "release": "node ./scripts/release.mjs",
+    "start": "node ./dist/cli/index.js",
+    "test": "vitest",
+    "publish:npm": "npm publish --access public"
+  },
+  "dependencies": {
+    "@koa/router": "^13.1.0",
+    "commander": "^12.1.0",
+    "koa": "^2.15.3",
+    "qrcode-terminal": "^0.12.0",
+    "ws": "^8.18.0",
+    "yaml": "^2.6.1",
+    "zod": "^3.24.1"
+  },
+  "devDependencies": {
+    "@types/koa": "^2.15.0",
+    "@types/koa__router": "^12.0.4",
+    "@types/node": "^22.10.2",
+    "@types/qrcode-terminal": "^0.12.2",
+    "@types/ws": "^8.5.13",
+    "tsup": "^8.3.5",
+    "tsx": "^4.19.2",
+    "typescript": "^5.7.2",
+    "vitest": "^2.1.8"
+  },
+  "engines": {
+    "node": ">=22.14.0"
+  }
+}

package/scripts/check-node-version.mjs

@@ -0,0 +1,44 @@
+import process from "node:process";
+
+const MINIMUM_NODE_VERSION = "22.14.0";
+
+function parseVersion(input) {
+  const normalized = String(input ?? "")
+    .trim()
+    .replace(/^v/i, "");
+  const [major = "0", minor = "0", patch = "0"] = normalized.split(".");
+  return [
+    Number.parseInt(major, 10) || 0,
+    Number.parseInt(minor, 10) || 0,
+    Number.parseInt(patch, 10) || 0,
+  ];
+}
+
+function compareVersions(left, right) {
+  for (let index = 0; index < 3; index += 1) {
+    if (left[index] > right[index]) {
+      return 1;
+    }
+    if (left[index] < right[index]) {
+      return -1;
+    }
+  }
+  return 0;
+}
+
+const current = parseVersion(process.versions.node);
+const minimum = parseVersion(MINIMUM_NODE_VERSION);
+
+if (compareVersions(current, minimum) < 0) {
+  console.error("");
+  console.error("Hermes Link needs Node.js 22.14.0 or newer.");
+  console.error(`You are using Node.js ${process.versions.node}.`);
+  console.error("");
+  console.error("Why this is required:");
+  console.error("- Hermes Link targets the same modern Node.js runtime used by the Link daemon and CLI.");
+  console.error("- If installation continued on an older Node.js version, pairing or the background service could fail later.");
+  console.error("");
+  console.error("Please update Node.js first, then run the install command again.");
+  console.error("");
+  process.exit(1);
+}

package/scripts/postinstall.mjs

@@ -0,0 +1,30 @@
+import process from "node:process";
+
+function isTruthy(value) {
+  return ["1", "true", "yes", "on"].includes(String(value ?? "").toLowerCase());
+}
+
+function shouldPrintInstallHint() {
+  if (isTruthy(process.env.HERMESLINK_POSTINSTALL_QUIET)) {
+    return false;
+  }
+  if (isTruthy(process.env.CI)) {
+    return false;
+  }
+  return process.env.npm_config_global === "true";
+}
+
+async function main() {
+  if (!shouldPrintInstallHint()) {
+    return;
+  }
+
+  console.log("");
+  console.log("Hermes Link installed.");
+  console.log("Run `hermeslink pair` to connect this computer with HermesPilot App.");
+  console.log("");
+}
+
+main().catch(() => {
+  // Postinstall advice must never block npm install itself.
+});