@hermespilot/link 0.4.4 → 0.4.6

package/dist/{chunk-2CHGHWCY.js → chunk-DUQDO2LQ.js}

@@ -2080,6 +2080,14 @@ async function ensureHermesApiServerConfig(profileName = "default", configPath =
   }
   return ensureHermesApiServerConfigUnlocked(profileName, configPath);
 }
+async function repairHermesApiServerConfig(profileName = "default", configPath = resolveHermesConfigPath(profileName)) {
+  if (profileName !== "default") {
+    return withProfileApiServerPortAssignmentLock(
+      () => repairHermesApiServerConfigUnlocked(profileName, configPath)
+    );
+  }
+  return repairHermesApiServerConfigUnlocked(profileName, configPath);
+}
 async function ensureHermesApiServerConfigUnlocked(profileName = "default", configPath = resolveHermesConfigPath(profileName)) {
   const existingRaw = await readFile2(configPath, "utf8").catch(
     (error) => {
@@ -2096,47 +2104,60 @@ async function ensureHermesApiServerConfigUnlocked(profileName = "default", conf
   const extra = ensureRecord(apiServer, "extra");
   const configOnly = readApiServerConfig(apiServer);
   const envOverrides = await readHermesApiServerEnvOverrides(profileName);
-  const before = applyEnvOverrides(configOnly, envOverrides, false);
-  const beforeKey = before.key?.trim() ? before.key : null;
-  const beforeEnabled = before.enabled === true;
-  const beforeHost = before.host?.trim() ? before.host : null;
-  const beforePort = typeof before.port === "number" && Number.isFinite(before.port) ? before.port : null;
+  const configKey = configOnly.key?.trim() ? configOnly.key : null;
+  const envKey = envOverrides.key?.trim() ? envOverrides.key : null;
+  const configHost = configOnly.host?.trim() ? configOnly.host : null;
+  const envHost = envOverrides.host?.trim() ? envOverrides.host : null;
+  const configPort = readApiServerPort(configOnly.port);
+  const envPort = readApiServerPort(envOverrides.port);
+  const desiredHost = configHost ?? envHost ?? DEFAULT_HERMES_API_SERVER_HOST;
+  const desiredPort = await resolveDesiredApiServerPort({
+    profileName,
+    configPort,
+    envPort
+  });
+  const desiredKey = configKey ?? envKey ?? randomBytes(32).toString("base64url");
   let changed = false;
   let enabledAdded = false;
   let hostAdded = false;
   let portAdded = false;
-  let assignedPort = null;
-  if (!beforeEnabled) {
+  if (apiServer.enabled !== true) {
     apiServer.enabled = true;
     enabledAdded = true;
     changed = true;
   }
-  if (!beforeHost) {
-    extra.host = DEFAULT_HERMES_API_SERVER_HOST;
-    hostAdded = true;
+  if (configHost !== desiredHost) {
+    extra.host = desiredHost;
+    hostAdded = !configHost;
     changed = true;
   }
-  if (shouldAssignDedicatedProfileApiServerPort(profileName, configOnly.port)) {
-    assignedPort = await nextProfileApiServerPort(profileName);
-    extra.port = assignedPort;
-    portAdded = true;
-    changed = true;
-  } else if (!beforePort) {
-    assignedPort = DEFAULT_HERMES_API_SERVER_PORT;
-    extra.port = assignedPort;
+  if (configPort !== desiredPort) {
+    extra.port = desiredPort;
     portAdded = true;
     changed = true;
   }
-  if (!beforeKey) {
-    extra.key = randomBytes(32).toString("base64url");
+  if (configKey !== desiredKey) {
+    extra.key = desiredKey;
     changed = true;
   }
-  if (!changed) {
+  const desiredApiServer = readApiServerConfig(apiServer, true);
+  const backupPath = changed && existingRaw ? `${configPath}.bak.${Date.now()}` : null;
+  if (backupPath && existingRaw !== null) {
+    await atomicWriteFilePreservingMetadata(backupPath, existingRaw, {
+      metadataSourcePath: configPath
+    });
+  }
+  if (changed) {
+    document.contents = document.createNode(config);
+    await atomicWriteFilePreservingMetadata(configPath, document.toString());
+  }
+  const envChanged = await writeHermesApiServerEnv(profileName, desiredApiServer);
+  if (!changed && !envChanged) {
     return {
       configPath,
       apiServer: applyEnvOverrides(
         readApiServerConfig(apiServer, true),
-        envOverrides,
+        await readHermesApiServerEnvOverrides(profileName),
         true
       ),
       changed: false,
@@ -2148,36 +2169,79 @@ async function ensureHermesApiServerConfigUnlocked(profileName = "default", conf
       notice: null
     };
   }
-  const backupPath = existingRaw ? `${configPath}.bak.${Date.now()}` : null;
-  if (backupPath && existingRaw !== null) {
-    await atomicWriteFilePreservingMetadata(backupPath, existingRaw, {
-      metadataSourcePath: configPath
-    });
-  }
-  document.contents = document.createNode(config);
-  await atomicWriteFilePreservingMetadata(configPath, document.toString());
   return {
     configPath,
     apiServer: applyEnvOverrides(
       readApiServerConfig(apiServer, true),
-      envOverrides,
+      await readHermesApiServerEnvOverrides(profileName),
       true
     ),
     changed: true,
-    keyAdded: !beforeKey,
+    keyAdded: !configKey,
     enabledAdded,
     hostAdded,
     portAdded,
     backupPath,
     notice: buildNotice({
-      keyAdded: !beforeKey,
+      keyAdded: !configKey,
       enabledAdded,
       hostAdded,
       portAdded,
-      port: assignedPort ?? beforePort ?? void 0
+      port: desiredPort
     })
   };
 }
+async function repairHermesApiServerConfigUnlocked(profileName = "default", configPath = resolveHermesConfigPath(profileName)) {
+  const existingRaw = await readFile2(configPath, "utf8").catch(
+    (error) => {
+      if (isNodeError3(error, "ENOENT")) {
+        return null;
+      }
+      throw error;
+    }
+  );
+  const document = existingRaw ? YAML.parseDocument(existingRaw) : new YAML.Document({});
+  const config = toRecord(document.toJSON());
+  const platforms = ensureRecord(config, "platforms");
+  const apiServer = ensureRecord(platforms, "api_server");
+  const extra = ensureRecord(apiServer, "extra");
+  const previous = applyEnvOverrides(
+    readApiServerConfig(apiServer, true),
+    await readHermesApiServerEnvOverrides(profileName),
+    true
+  );
+  const freshPort = await nextProfileApiServerPort(profileName);
+  const freshKey = randomBytes(32).toString("base64url");
+  apiServer.enabled = true;
+  extra.host = DEFAULT_HERMES_API_SERVER_HOST;
+  extra.port = freshPort;
+  extra.key = freshKey;
+  const backupPath = existingRaw ? `${configPath}.bak.${Date.now()}` : null;
+  if (backupPath && existingRaw !== null) {
+    await atomicWriteFilePreservingMetadata(backupPath, existingRaw, {
+      metadataSourcePath: configPath
+    });
+  }
+  document.contents = document.createNode(config);
+  await atomicWriteFilePreservingMetadata(configPath, document.toString());
+  const apiServerConfig = readApiServerConfig(apiServer, true);
+  await writeHermesApiServerEnv(profileName, apiServerConfig, { force: true });
+  return {
+    configPath,
+    apiServer: applyEnvOverrides(
+      apiServerConfig,
+      await readHermesApiServerEnvOverrides(profileName),
+      true
+    ),
+    changed: true,
+    keyAdded: !previous.key,
+    enabledAdded: previous.enabled !== true,
+    hostAdded: previous.host !== DEFAULT_HERMES_API_SERVER_HOST,
+    portAdded: previous.port !== freshPort,
+    backupPath,
+    notice: "\u5DF2\u4E3A Hermes API Server \u91CD\u65B0\u5206\u914D\u672C\u673A\u7AEF\u53E3\u5E76\u8F6E\u6362 key\uFF0C\u7528\u4E8E\u4FEE\u590D\u65E7 Gateway \u6216 key \u4E0D\u4E00\u81F4\u5BFC\u81F4\u7684 401\u3002"
+  };
+}
 async function readHermesConfigDocument(configPath) {
   const existingRaw = await readFile2(configPath, "utf8").catch(
     (error) => {
@@ -3511,6 +3575,21 @@ function shouldAssignDedicatedProfileApiServerPort(profileName, configuredPort)
   }
   return configuredPort === void 0 || configuredPort === DEFAULT_HERMES_API_SERVER_PORT;
 }
+function readApiServerPort(value) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : null;
+}
+async function resolveDesiredApiServerPort(input) {
+  if (shouldAssignDedicatedProfileApiServerPort(
+    input.profileName,
+    input.configPort ?? void 0
+  )) {
+    if (input.profileName !== "default" && input.envPort !== null && input.envPort !== DEFAULT_HERMES_API_SERVER_PORT) {
+      return input.envPort;
+    }
+    return nextProfileApiServerPort(input.profileName);
+  }
+  return input.configPort ?? input.envPort ?? DEFAULT_HERMES_API_SERVER_PORT;
+}
 async function nextProfileApiServerPort(profileName) {
   const usedPorts = await readConfiguredApiServerPorts(profileName);
   for (let port = PROFILE_API_SERVER_PORT_START; port <= PROFILE_API_SERVER_PORT_END; port += 1) {
@@ -3602,17 +3681,6 @@ function isEnvValueConfigured(value) {
 }
 async function readHermesApiServerEnvOverrides(profileName) {
   const values = await readHermesEnvFile(profileName);
-  for (const key of [
-    "API_SERVER_ENABLED",
-    "API_SERVER_HOST",
-    "API_SERVER_PORT",
-    "API_SERVER_KEY"
-  ]) {
-    const value = process.env[key];
-    if (typeof value === "string" && value.trim()) {
-      values[key] = value;
-    }
-  }
   const port = Number.parseInt(values.API_SERVER_PORT ?? "", 10);
   return {
     enabled: parseEnvBoolean(values.API_SERVER_ENABLED),
@@ -3681,14 +3749,82 @@ async function writeHermesEnvValue(profileName, key, value) {
   }
   await atomicWriteFilePreservingMetadata(envPath, nextRaw);
 }
+async function writeHermesApiServerEnv(profileName, config, options = {}) {
+  const envPath = path3.join(resolveHermesProfileDir(profileName), ".env");
+  const existingRaw = await readFile2(envPath, "utf8").catch(
+    (error) => {
+      if (isNodeError3(error, "ENOENT")) {
+        return null;
+      }
+      throw error;
+    }
+  );
+  if (existingRaw === null && profileName === "default" && !options.force) {
+    return false;
+  }
+  return writeHermesEnvValues(
+    profileName,
+    [
+      ["API_SERVER_ENABLED", config.enabled === false ? "false" : "true"],
+      ["API_SERVER_HOST", config.host ?? DEFAULT_HERMES_API_SERVER_HOST],
+      ["API_SERVER_PORT", String(config.port ?? DEFAULT_HERMES_API_SERVER_PORT)],
+      ["API_SERVER_KEY", config.key ?? ""]
+    ],
+    existingRaw ?? ""
+  );
+}
+async function writeHermesEnvValues(profileName, values, existingRaw) {
+  const envPath = path3.join(resolveHermesProfileDir(profileName), ".env");
+  const raw = existingRaw ?? await readFile2(envPath, "utf8").catch((error) => {
+    if (isNodeError3(error, "ENOENT")) {
+      return "";
+    }
+    throw error;
+  });
+  const lines = raw ? raw.split(/\r?\n/u) : [];
+  const remaining = new Map(values);
+  const nextLines = lines.map((line) => {
+    const trimmed = line.trim();
+    for (const [key, value] of remaining) {
+      const keyPattern = new RegExp(
+        `^(?:export\\s+)?${escapeRegExp(key)}=`,
+        "u"
+      );
+      if (keyPattern.test(trimmed)) {
+        remaining.delete(key);
+        return `${key}=${formatEnvValue(value)}`;
+      }
+    }
+    return line;
+  });
+  if (remaining.size > 0 && nextLines.length > 0 && nextLines.at(-1) !== "") {
+    nextLines.push("");
+  }
+  for (const [key, value] of remaining) {
+    nextLines.push(`${key}=${formatEnvValue(value)}`);
+  }
+  const nextRaw = nextLines.join("\n").replace(/\n*$/u, "\n");
+  if (nextRaw === raw) {
+    return false;
+  }
+  if (raw) {
+    await atomicWriteFilePreservingMetadata(
+      `${envPath}.bak.${Date.now()}`,
+      raw,
+      { metadataSourcePath: envPath }
+    );
+  }
+  await atomicWriteFilePreservingMetadata(envPath, nextRaw);
+  return true;
+}
 function applyEnvOverrides(config, env, withDefaults) {
-  const host = config.host ?? env.host;
-  const port = config.port ?? env.port;
+  const host = env.host ?? config.host;
+  const port = env.port ?? config.port;
   return {
-    enabled: config.enabled ?? env.enabled,
+    enabled: env.enabled ?? config.enabled,
     host: withDefaults ? host ?? DEFAULT_HERMES_API_SERVER_HOST : host,
     port: withDefaults ? port ?? DEFAULT_HERMES_API_SERVER_PORT : port,
-    key: config.key ?? env.key
+    key: env.key ?? config.key
   };
 }
 function parseEnvBoolean(value) {
@@ -3996,7 +4132,7 @@ import os2 from "os";
 import path5 from "path";
 
 // src/constants.ts
-var LINK_VERSION = "0.4.4";
+var LINK_VERSION = "0.4.6";
 var LINK_COMMAND = "hermeslink";
 var LINK_DEFAULT_PORT = 52379;
 var LINK_RUNTIME_DIR_NAME = ".hermeslink";
@@ -4496,6 +4632,7 @@ var DASHBOARD_STATUS_URL = "http://127.0.0.1:9119/api/status";
 var DASHBOARD_STATUS_TIMEOUT_MS = 1500;
 var DEFAULT_VERSION_CACHE_TTL_MS = 6e4;
 var MAX_VERSION_LOG_OUTPUT_LENGTH = 1200;
+var HERMES_GATEWAY_ENV_BLOCKLIST_PREFIXES = ["API_SERVER_"];
 var gatewayStartInFlightByProfile = /* @__PURE__ */ new Map();
 var hermesVersionCache = /* @__PURE__ */ new Map();
 var hermesVersionInFlight = /* @__PURE__ */ new Map();
@@ -4558,6 +4695,47 @@ async function ensureHermesApiServerAvailable(options = {}) {
     });
     return { available: true, configResult, started: true, start, health };
   }
+  if (health.authInvalid) {
+    void options.logger?.warn("gateway_api_server_auth_repair_requested", {
+      profile: profileName,
+      port: configResult.apiServer.port ?? null,
+      issue: health.issue ?? "auth_invalid"
+    });
+    const repairedConfigResult = await repairHermesApiServerConfig(profileName);
+    const repairedStart = await startHermesGatewayOnce(
+      options.paths ?? resolveRuntimePaths(),
+      profileName,
+      options.logger
+    );
+    health = await waitForHermesApiHealth(
+      repairedConfigResult.apiServer,
+      fetcher,
+      options.timeoutMs ?? DEFAULT_START_TIMEOUT_MS
+    );
+    if (health.healthy) {
+      void options.logger?.info("gateway_api_server_auth_repair_succeeded", {
+        profile: profileName,
+        pid: repairedStart.pid,
+        port: repairedConfigResult.apiServer.port ?? null,
+        log_path: repairedStart.logPath,
+        hermes_version: repairedStart.version?.version ?? null
+      });
+      return {
+        available: true,
+        configResult: repairedConfigResult,
+        started: true,
+        start: repairedStart,
+        health
+      };
+    }
+    void options.logger?.error("gateway_api_server_auth_repair_failed", {
+      profile: profileName,
+      pid: repairedStart.pid,
+      port: repairedConfigResult.apiServer.port ?? null,
+      log_path: repairedStart.logPath,
+      issue: health.issue ?? "unknown"
+    });
+  }
   const logHint = await readRecentGatewayLogHint(start.logPath);
   void options.logger?.error("gateway_auto_start_failed", {
     profile: profileName,
@@ -4648,12 +4826,9 @@ async function readHermesVersion(options = {}) {
 }
 async function execHermesVersion(hermesBin, logger) {
   const failures = [];
-  for (const args of [["version"], ["--version"]]) {
+  for (const args of [["--version"], ["version"]]) {
     try {
-      return await execFileAsync2(hermesBin, args, {
-        timeout: 5e3,
-        windowsHide: true
-      });
+      return await spawnHermesVersionCommand(hermesBin, args, 5e3);
     } catch (error) {
       const failure = describeVersionCommandFailure(hermesBin, args, error);
       failures.push(failure);
@@ -4669,6 +4844,85 @@ async function execHermesVersion(hermesBin, logger) {
   });
   throw new Error(summary);
 }
+async function spawnHermesVersionCommand(hermesBin, args, timeoutMs) {
+  return await new Promise((resolve, reject) => {
+    const child = spawn(hermesBin, args, {
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsHide: true
+    });
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    const timer = setTimeout(() => {
+      finish(() => {
+        reject(
+          createVersionCommandError(
+            `${hermesBin} ${args.join(" ")} timed out after ${timeoutMs}ms`,
+            { stdout, stderr, killed: true }
+          )
+        );
+      }, true);
+    }, timeoutMs);
+    const finish = (callback, kill = false) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      clearTimeout(timer);
+      if (kill && child.pid && !child.killed) {
+        child.kill();
+      }
+      callback();
+    };
+    const resolveIfVersionPrinted = () => {
+      if (parseHermesVersion(stdout)) {
+        finish(() => resolve({ stdout: `${stdout}
+${stderr}`.trim() }), true);
+      }
+    };
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk.toString();
+      resolveIfVersionPrinted();
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.once("error", (error) => {
+      finish(() => {
+        reject(
+          createVersionCommandError(error.message, {
+            stdout,
+            stderr,
+            cause: error
+          })
+        );
+      });
+    });
+    child.once("close", (code, signal) => {
+      finish(() => {
+        const raw = `${stdout}
+${stderr}`.trim();
+        const version = parseHermesVersion(raw);
+        if (code === 0 && (raw || version)) {
+          resolve({ stdout: raw });
+          return;
+        }
+        reject(
+          createVersionCommandError(
+            `${hermesBin} ${args.join(" ")} exited with code ${code ?? "null"}`,
+            {
+              stdout,
+              stderr,
+              code,
+              signal,
+              killed: child.killed
+            }
+          )
+        );
+      });
+    });
+  });
+}
 function assertHermesRunsApiSupported(version, status) {
   if (status !== 404) {
     return;
@@ -4720,7 +4974,7 @@ async function startHermesGateway(paths, profileName, logger) {
   try {
     const child = spawn(resolveHermesBin(), gatewayRunArgs(profileName), {
       detached: true,
-      env: process.env,
+      env: buildHermesGatewayChildEnv(),
       stdio: ["ignore", "pipe", "pipe"],
       windowsHide: true
     });
@@ -4786,6 +5040,7 @@ async function restartHermesGatewayServiceIfAvailable(options) {
   }
   try {
     await execFileAsync2(resolveHermesBin(), ["gateway", "restart"], {
+      env: buildHermesGatewayChildEnv(),
       timeout: options.timeoutMs ?? DEFAULT_START_TIMEOUT_MS,
       windowsHide: true
     });
@@ -4840,6 +5095,17 @@ function gatewayRunArgs(profileName) {
 function formatHermesGatewayRunCommand(profileName) {
   return `${resolveHermesBin()} ${gatewayRunArgs(profileName).join(" ")}`;
 }
+function buildHermesGatewayChildEnv() {
+  const env = { ...process.env };
+  for (const key of Object.keys(env)) {
+    if (HERMES_GATEWAY_ENV_BLOCKLIST_PREFIXES.some(
+      (prefix) => key.startsWith(prefix)
+    )) {
+      delete env[key];
+    }
+  }
+  return env;
+}
 async function fileExists(filePath) {
   return access(filePath).then(() => true).catch(() => false);
 }
@@ -4875,6 +5141,10 @@ async function readHermesApiServerHealth(config, fetcher = fetch) {
     }
     const issue = describeDetailedHealthIssue(record);
     const terminal = isTerminalDetailedHealth(record);
+    const authIssue = issue ? null : await probeHermesApiServerAuth(resolvedConfig, fetcher);
+    if (authIssue) {
+      return authIssue;
+    }
     return {
       healthy: !issue,
       terminal,
@@ -4910,22 +5180,9 @@ async function readHermesApiServerHealth(config, fetcher = fetch) {
         detailed: record
       };
     }
-    if (resolvedConfig.key) {
-      const authProbe = await fetchWithTimeout(
-        `http://127.0.0.1:${resolvedConfig.port}/v1/models`,
-        {
-          method: "GET",
-          headers: authHeaders(resolvedConfig)
-        },
-        fetcher
-      );
-      if (authProbe?.status === 401) {
-        return {
-          healthy: false,
-          authInvalid: true,
-          issue: "Hermes API Server \u8FD4\u56DE 401\uFF0C\u5F53\u524D\u7AEF\u53E3\u53EF\u80FD\u5C5E\u4E8E\u53E6\u4E00\u4E2A Profile\uFF0C\u6216 API Server key \u5DF2\u53D8\u66F4\u3002"
-        };
-      }
+    const authIssue = await probeHermesApiServerAuth(resolvedConfig, fetcher);
+    if (authIssue) {
+      return authIssue;
     }
     return { healthy: true };
   }
@@ -4941,6 +5198,36 @@ async function readHermesApiServerHealth(config, fetcher = fetch) {
     issue: describePortHealthFailure(resolvedConfig.port)
   };
 }
+async function probeHermesApiServerAuth(config, fetcher) {
+  const response = await fetchWithTimeout(
+    `http://127.0.0.1:${config.port}/v1/models`,
+    {
+      method: "GET",
+      headers: authHeaders(config)
+    },
+    fetcher
+  );
+  if (!response) {
+    return {
+      healthy: false,
+      issue: "Hermes API Server \u9274\u6743\u63A2\u6D4B\u65E0\u54CD\u5E94\uFF1A/v1/models \u6CA1\u6709\u5728\u8D85\u65F6\u65F6\u95F4\u5185\u8FD4\u56DE\u3002"
+    };
+  }
+  if (response?.status === 401) {
+    return {
+      healthy: false,
+      authInvalid: true,
+      issue: "Hermes API Server \u8FD4\u56DE 401\uFF0C\u5F53\u524D\u7AEF\u53E3\u53EF\u80FD\u5C5E\u4E8E\u53E6\u4E00\u4E2A Profile\uFF0C\u6216 API Server key \u5DF2\u53D8\u66F4\u3002"
+    };
+  }
+  if (response && !response.ok) {
+    return {
+      healthy: false,
+      issue: `Hermes API Server \u9274\u6743\u63A2\u6D4B\u5931\u8D25\uFF1A/v1/models \u8FD4\u56DE HTTP ${response.status}\u3002`
+    };
+  }
+  return null;
+}
 function fetchWithTimeout(input, init, fetcher) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), HEALTH_TIMEOUT_MS);
@@ -5122,6 +5409,21 @@ async function probeHermesVersion(hermesBin, options) {
     }
   }
 }
+function createVersionCommandError(message, details) {
+  const error = new Error(message, { cause: details.cause });
+  error.stdout = details.stdout;
+  error.stderr = details.stderr;
+  if (details.code !== void 0) {
+    error.code = details.code;
+  }
+  if (details.signal !== void 0) {
+    error.signal = details.signal;
+  }
+  if (details.killed !== void 0) {
+    error.killed = details.killed;
+  }
+  return error;
+}
 function describeVersionCommandFailure(hermesBin, args, error) {
   const message = error instanceof Error ? error.message : String(error);
   const details = readExecErrorDetails(error, message);
@@ -8979,24 +9281,15 @@ var ConversationQueryCoordinator = class {
   async listConversationPage(options = {}) {
     const limit = normalizeConversationListPageLimit(options.limit);
     const cursor = decodeConversationListCursor(options.cursor);
-    const indexedPage = await listConversationStatsPage(this.deps.paths, {
+    return this.listIndexedConversationPage({
       limit,
-      cursor
-    });
-    if (indexedPage.records.length === 0) {
-      return this.listConversationPageFromStore({ limit, cursor });
-    }
-    const summaries = await this.summarizeIndexedConversations(
-      indexedPage.records
-    );
-    return {
-      conversations: summaries,
-      page: {
+      cursor,
+      fallback: () => this.listConversationPageFromStore({ limit, cursor }),
+      listPage: (pageCursor) => listConversationStatsPage(this.deps.paths, {
         limit,
-        has_more: indexedPage.hasMore,
-        next_cursor: indexedPage.hasMore && indexedPage.records.length > 0 ? encodeConversationListCursor(indexedPage.records.at(-1)) : null
-      }
-    };
+        cursor: pageCursor
+      })
+    });
   }
   async searchConversationPage(options = {}) {
     const query = normalizeConversationSearchQuery(options.query);
@@ -9005,20 +9298,72 @@ var ConversationQueryCoordinator = class {
     }
     const limit = normalizeConversationListPageLimit(options.limit);
     const cursor = decodeConversationListCursor(options.cursor);
-    const indexedPage = await searchConversationStatsPage(this.deps.paths, {
+    return this.listIndexedConversationPage({
       limit,
       cursor,
-      query
+      listPage: (pageCursor) => searchConversationStatsPage(this.deps.paths, {
+        limit,
+        cursor: pageCursor,
+        query
+      })
     });
-    const summaries = await this.summarizeIndexedConversations(
-      indexedPage.records
-    );
+  }
+  async listIndexedConversationPage(input) {
+    const collected = [];
+    const seenConversationIds = /* @__PURE__ */ new Set();
+    let scanCursor = input.cursor;
+    let usedIndex = false;
+    while (collected.length <= input.limit) {
+      const indexedPage = await input.listPage(scanCursor);
+      if (indexedPage.records.length === 0) {
+        if (!usedIndex && input.fallback) {
+          return input.fallback();
+        }
+        return this.buildConversationListPage({
+          limit: input.limit,
+          conversations: collected,
+          hasMore: false
+        });
+      }
+      usedIndex = true;
+      const summaries = await this.summarizeIndexedConversations(
+        indexedPage.records
+      );
+      for (const summary of summaries) {
+        if (!seenConversationIds.add(summary.id)) {
+          continue;
+        }
+        collected.push(summary);
+        if (collected.length > input.limit) {
+          break;
+        }
+      }
+      if (collected.length > input.limit) {
+        break;
+      }
+      if (!indexedPage.hasMore) {
+        return this.buildConversationListPage({
+          limit: input.limit,
+          conversations: collected,
+          hasMore: false
+        });
+      }
+      scanCursor = conversationListCursorFromRecord(indexedPage.records.at(-1));
+    }
+    return this.buildConversationListPage({
+      limit: input.limit,
+      conversations: collected,
+      hasMore: true
+    });
+  }
+  buildConversationListPage(input) {
+    const conversations = input.conversations.slice(0, input.limit);
     return {
-      conversations: summaries,
+      conversations,
       page: {
-        limit,
-        has_more: indexedPage.hasMore,
-        next_cursor: indexedPage.hasMore && indexedPage.records.length > 0 ? encodeConversationListCursor(indexedPage.records.at(-1)) : null
+        limit: input.limit,
+        has_more: input.hasMore,
+        next_cursor: input.hasMore && conversations.length > 0 ? encodeConversationListCursorFromSummary(conversations.at(-1)) : null
       }
     };
   }
@@ -9177,6 +9522,12 @@ function encodeConversationListCursor(record) {
     "utf8"
   ).toString("base64url");
 }
+function conversationListCursorFromRecord(record) {
+  return {
+    updatedAt: record.updatedAt,
+    conversationId: record.conversationId
+  };
+}
 function encodeConversationListCursorFromSummary(summary) {
   return encodeConversationListCursor({
     conversationId: summary.id,
@@ -11668,6 +12019,46 @@ async function callHermesApi(path26, init, options) {
     startedAt,
     response
   );
+  if (response.status !== 401) {
+    return response;
+  }
+  void options.logger?.warn("hermes_api_request_repairing_after_401", {
+    method,
+    path: path26,
+    profile: options.profileName ?? "default",
+    port: config.port ?? null,
+    duration_ms: Date.now() - startedAt
+  });
+  const profileName = options.profileName ?? "default";
+  const repairedConfig = await repairHermesApiServerConfig(profileName);
+  const repairedAvailability = await ensureHermesApiServerAvailable({
+    fetchImpl: options.fetchImpl,
+    forceRestart: true,
+    logger: options.logger,
+    profileName
+  });
+  config = repairedAvailability.configResult.apiServer ?? repairedConfig.apiServer;
+  try {
+    response = await request();
+  } catch (error) {
+    logHermesApiError(
+      options.logger,
+      method,
+      path26,
+      options.profileName,
+      startedAt,
+      error
+    );
+    throw error;
+  }
+  logHermesApiResponse(
+    options.logger,
+    method,
+    path26,
+    options.profileName,
+    startedAt,
+    response
+  );
   return response;
 }
 async function fetchHermesApi(fetcher, config, path26, init, options) {
@@ -15948,11 +16339,15 @@ function createHttpErrorMiddleware(logger) {
 }
 
 // src/hermes/profiles.ts
-import { readdir as readdir9, readFile as readFile12, rename as rename3, rm as rm6, stat as stat12 } from "fs/promises";
+import { execFile as execFile4 } from "child_process";
+import { readdir as readdir9, readFile as readFile12, rename as rename3, stat as stat12 } from "fs/promises";
 import path18 from "path";
+import { promisify as promisify4 } from "util";
 import YAML2 from "yaml";
 var DEFAULT_PROFILE = "default";
 var PROFILE_NAME_PATTERN4 = /^[a-zA-Z0-9._-]{1,64}$/;
+var PROFILE_DELETE_TIMEOUT_MS = 3e4;
+var execFileAsync4 = promisify4(execFile4);
 async function listHermesProfiles(paths = resolveRuntimePaths()) {
   const profiles = /* @__PURE__ */ new Map();
   profiles.set(DEFAULT_PROFILE, await profileInfo(DEFAULT_PROFILE, paths));
@@ -16024,12 +16419,7 @@ async function updateHermesProfileMetadata(name, metadata, paths = resolveRuntim
 async function deleteHermesProfile(name, paths = resolveRuntimePaths()) {
   assertMutableProfile(name);
   const profile = await profileInfo(name, paths);
-  const exists = await stat12(profile.path).then((value) => value.isDirectory()).catch((error) => {
-    if (isNodeError14(error, "ENOENT")) {
-      return false;
-    }
-    throw error;
-  });
+  const exists = await pathExists(profile.path);
   if (!exists) {
     throw new LinkHttpError(
       404,
@@ -16037,7 +16427,14 @@ async function deleteHermesProfile(name, paths = resolveRuntimePaths()) {
       `Profile "${name}" does not exist`
     );
   }
-  await rm6(resolveHermesProfileDir(name), { recursive: true, force: true });
+  await deleteHermesProfileWithCli(name);
+  if (await pathExists(profile.path)) {
+    throw new LinkHttpError(
+      502,
+      "hermes_profile_delete_incomplete",
+      `Hermes CLI reported success, but Profile "${name}" still exists at ${profile.path}`
+    );
+  }
   await deleteProfileIdentity(paths, {
     profileName: profile.name,
     profileUid: profile.uid
@@ -16093,6 +16490,52 @@ function assertProfileName(name) {
     throw new LinkHttpError(400, "invalid_profile_name", "invalid profile name");
   }
 }
+async function pathExists(targetPath) {
+  return await stat12(targetPath).then(() => true).catch((error) => {
+    if (isNodeError14(error, "ENOENT")) {
+      return false;
+    }
+    throw error;
+  });
+}
+async function deleteHermesProfileWithCli(name) {
+  try {
+    await execFileAsync4(resolveHermesBin(), ["profile", "delete", name, "--yes"], {
+      timeout: PROFILE_DELETE_TIMEOUT_MS,
+      windowsHide: true
+    });
+  } catch (error) {
+    throw new LinkHttpError(
+      502,
+      "hermes_profile_delete_failed",
+      `Hermes CLI could not delete Profile "${name}": ${formatExecError(error)}`
+    );
+  }
+}
+function formatExecError(error) {
+  if (!(error instanceof Error)) {
+    return String(error);
+  }
+  const output = readExecErrorOutput2(error);
+  return output ? `${error.message}
+${output}` : error.message;
+}
+function readExecErrorOutput2(error) {
+  const parts = [];
+  if ("stdout" in error && error.stdout != null) {
+    const stdout = String(error.stdout).trim();
+    if (stdout) {
+      parts.push(stdout);
+    }
+  }
+  if ("stderr" in error && error.stderr != null) {
+    const stderr = String(error.stderr).trim();
+    if (stderr) {
+      parts.push(stderr);
+    }
+  }
+  return parts.join("\n");
+}
 function isNodeError14(error, code) {
   return typeof error === "object" && error !== null && "code" in error && error.code === code;
 }
@@ -16806,7 +17249,7 @@ import {
   cp,
   mkdir as mkdir10,
   readFile as readFile13,
-  rm as rm7,
+  rm as rm6,
   stat as stat13
 } from "fs/promises";
 import path19 from "path";
@@ -17107,7 +17550,7 @@ async function generateProfileName(displayName, paths) {
   for (let attempt = 0; attempt < 100; attempt += 1) {
     const suffix = randomSuffix(attempt);
     const candidate = `${base}-${suffix}`.slice(0, 64).replace(/[-_]+$/u, "");
-    if (!existing.has(candidate) && !await pathExists(resolveHermesProfileDir(candidate))) {
+    if (!existing.has(candidate) && !await pathExists2(resolveHermesProfileDir(candidate))) {
       return candidate;
     }
   }
@@ -17133,7 +17576,7 @@ function randomSuffix(attempt) {
 }
 async function applyProfileCreationPostSteps(input) {
   const profilePath = resolveHermesProfileDir(input.profileName);
-  if (!await pathExists(profilePath)) {
+  if (!await pathExists2(profilePath)) {
     await ensureDirectoryWithInheritedMetadata(profilePath, 448);
   }
   if (input.sourceProfile && input.copyScopes.length > 0) {
@@ -17299,10 +17742,10 @@ async function writeEnvValues(profileName, values) {
 async function copySkills(sourceProfile, targetProfile) {
   const sourceSkills = path19.join(resolveHermesProfileDir(sourceProfile), "skills");
   const targetSkills = path19.join(resolveHermesProfileDir(targetProfile), "skills");
-  if (!await pathExists(sourceSkills)) {
+  if (!await pathExists2(sourceSkills)) {
     return;
   }
-  await rm7(targetSkills, { recursive: true, force: true });
+  await rm6(targetSkills, { recursive: true, force: true });
   await cp(sourceSkills, targetSkills, {
     recursive: true,
     force: true,
@@ -17350,7 +17793,7 @@ async function failProfileCreation(input) {
     await input.writer.write(`
 Rolling back ${input.rollbackProfileName}...
 `);
-    await rm7(resolveHermesProfileDir(input.rollbackProfileName), {
+    await rm6(resolveHermesProfileDir(input.rollbackProfileName), {
       recursive: true,
       force: true
     }).catch(() => void 0);
@@ -17401,14 +17844,14 @@ function profileCreationLogPath(paths) {
 async function clearProfileCreationLogFiles(paths) {
   const primary = profileCreationLogPath(paths);
   await Promise.all([
-    rm7(primary, { force: true }).catch(() => void 0),
+    rm6(primary, { force: true }).catch(() => void 0),
     ...Array.from(
       { length: PROFILE_CREATE_LOG_MAX_FILES },
-      (_, index) => rm7(`${primary}.${index + 1}`, { force: true }).catch(() => void 0)
+      (_, index) => rm6(`${primary}.${index + 1}`, { force: true }).catch(() => void 0)
     )
   ]);
 }
-async function pathExists(targetPath) {
+async function pathExists2(targetPath) {
   return await stat13(targetPath).then(() => true).catch((error) => {
     if (isNodeError15(error, "ENOENT")) {
       return false;
@@ -20260,7 +20703,7 @@ function readModelList(payload) {
 // src/hermes/updates.ts
 import { EventEmitter as EventEmitter3 } from "events";
 import { spawn as spawn3 } from "child_process";
-import { mkdir as mkdir11, readFile as readFile16, rm as rm8 } from "fs/promises";
+import { mkdir as mkdir11, readFile as readFile16, rm as rm7 } from "fs/promises";
 import path22 from "path";
 var SERVER_HERMES_RELEASES_LATEST_PATH = "/api/v1/hermes-agent/releases/latest";
 var RELEASE_CACHE_TTL_MS = 6 * 60 * 60 * 1e3;
@@ -20550,10 +20993,10 @@ function updateLogPath(paths) {
 async function clearUpdateLogFiles(paths) {
   const primary = updateLogPath(paths);
   await Promise.all([
-    rm8(primary, { force: true }).catch(() => void 0),
+    rm7(primary, { force: true }).catch(() => void 0),
     ...Array.from(
       { length: UPDATE_LOG_MAX_FILES },
-      (_, index) => rm8(`${primary}.${index + 1}`, { force: true }).catch(() => void 0)
+      (_, index) => rm7(`${primary}.${index + 1}`, { force: true }).catch(() => void 0)
     )
   ]);
 }
@@ -20645,20 +21088,22 @@ function readString17(payload, key) {
 // src/link/updates.ts
 import { spawn as spawn5 } from "child_process";
 import { EventEmitter as EventEmitter4 } from "events";
-import { mkdir as mkdir14, readFile as readFile18, rm as rm11 } from "fs/promises";
+import { mkdir as mkdir14, readFile as readFile18, rm as rm10 } from "fs/promises";
 import path24 from "path";
 
 // src/daemon/process.ts
 import { spawn as spawn4 } from "child_process";
-import { mkdir as mkdir13, readFile as readFile17, rm as rm10 } from "fs/promises";
+import { mkdir as mkdir13, readFile as readFile17, rm as rm9 } from "fs/promises";
 import path23 from "path";
 
 // src/daemon/service.ts
 import { createServer } from "http";
-import { mkdir as mkdir12, rm as rm9, writeFile as writeFile3 } from "fs/promises";
+import { mkdir as mkdir12, rm as rm8, writeFile as writeFile3 } from "fs/promises";
 
 // src/relay/control-client.ts
 import WebSocket from "ws";
+var RELAY_SSE_BATCH_FLUSH_INTERVAL_MS = 50;
+var RELAY_SSE_BATCH_FLUSH_BYTES = 2 * 1024;
 function connectRelayControl(options) {
   const wsUrl = new URL(`${options.relayBaseUrl.replace(/\/+$/u, "")}/api/v1/relay/link/connect`);
   wsUrl.protocol = wsUrl.protocol === "https:" ? "wss:" : "ws:";
@@ -20794,6 +21239,7 @@ async function handleFrame(socket, raw, localPort, abortControllers) {
   }
   const abortController = new AbortController();
   abortControllers.set(frame.id, abortController);
+  let sseBatcher = null;
   try {
     const response = await fetch(`http://127.0.0.1:${localPort}${frame.path}`, {
       method: frame.method,
@@ -20805,14 +21251,16 @@ async function handleFrame(socket, raw, localPort, abortControllers) {
     const contentType = response.headers.get("content-type") ?? "";
     if (response.body && contentType.includes("text/event-stream")) {
       socket.send(JSON.stringify({ type: "http.stream.start", id: frame.id, status: response.status, headers }));
+      sseBatcher = createRelayStreamChunkBatcher(socket, frame.id);
       const reader = response.body.getReader();
       while (true) {
         const next = await reader.read();
         if (next.done) {
           break;
         }
-        socket.send(JSON.stringify({ type: "http.stream.chunk", id: frame.id, bodyBase64: Buffer.from(next.value).toString("base64") }));
+        sseBatcher.push(next.value);
       }
+      sseBatcher.flush();
       socket.send(JSON.stringify({ type: "http.stream.end", id: frame.id }));
       return;
     }
@@ -20822,15 +21270,73 @@ async function handleFrame(socket, raw, localPort, abortControllers) {
     if (abortController.signal.aborted || isAbortError2(error)) {
       return;
     }
+    sseBatcher?.flush();
     const message = error instanceof Error ? error.message : "Relay request failed";
     socket.send(JSON.stringify({ type: "http.error", id: frame.id, status: 502, message }));
   } finally {
+    sseBatcher?.dispose();
     abortControllers.delete(frame.id);
   }
 }
 function isAbortError2(error) {
   return typeof error === "object" && error !== null && "name" in error && error.name === "AbortError";
 }
+function createRelayStreamChunkBatcher(socket, id) {
+  let chunks = [];
+  let totalBytes = 0;
+  let flushTimer = null;
+  const clearFlushTimer = () => {
+    if (flushTimer == null) {
+      return;
+    }
+    clearTimeout(flushTimer);
+    flushTimer = null;
+  };
+  const flush = () => {
+    clearFlushTimer();
+    if (totalBytes <= 0) {
+      return;
+    }
+    const bodyBase64 = Buffer.concat(chunks, totalBytes).toString("base64");
+    chunks = [];
+    totalBytes = 0;
+    if (socket.readyState !== WebSocket.OPEN) {
+      return;
+    }
+    socket.send(JSON.stringify({ type: "http.stream.chunk", id, bodyBase64 }));
+  };
+  const scheduleFlush = () => {
+    if (flushTimer != null) {
+      return;
+    }
+    flushTimer = setTimeout(() => {
+      flushTimer = null;
+      flush();
+    }, RELAY_SSE_BATCH_FLUSH_INTERVAL_MS);
+    flushTimer.unref?.();
+  };
+  return {
+    push(chunk) {
+      if (chunk.byteLength <= 0) {
+        return;
+      }
+      const buffer = Buffer.from(chunk);
+      chunks.push(buffer);
+      totalBytes += buffer.byteLength;
+      if (totalBytes >= RELAY_SSE_BATCH_FLUSH_BYTES) {
+        flush();
+        return;
+      }
+      scheduleFlush();
+    },
+    flush,
+    dispose() {
+      clearFlushTimer();
+      chunks = [];
+      totalBytes = 0;
+    }
+  };
+}
 
 // src/runtime/system-info.ts
 import { execFileSync } from "child_process";
@@ -21705,7 +22211,7 @@ async function startLinkService(options = {}) {
       await logger.info("service_stopped");
       await logger.flush();
       if (options.writePidFile) {
-        await rm9(pidFilePath(paths), { force: true }).catch(() => void 0);
+        await rm8(pidFilePath(paths), { force: true }).catch(() => void 0);
       }
     }
   };
@@ -21897,7 +22403,7 @@ async function stopDaemonProcess(paths = resolveRuntimePaths()) {
   try {
     process.kill(status.pid, "SIGTERM");
   } catch {
-    await rm10(pidFilePath(paths), { force: true }).catch(() => void 0);
+    await rm9(pidFilePath(paths), { force: true }).catch(() => void 0);
     return await getDaemonStatus(paths);
   }
   for (let index = 0; index < 20; index += 1) {
@@ -21919,7 +22425,7 @@ async function stopDaemonProcess(paths = resolveRuntimePaths()) {
     }
   }
   if (!isProcessAlive3(status.pid) || !await pidBackedServiceIsReachable(paths)) {
-    await rm10(pidFilePath(paths), { force: true }).catch(() => void 0);
+    await rm9(pidFilePath(paths), { force: true }).catch(() => void 0);
   }
   return await getDaemonStatus(paths);
 }
@@ -21927,7 +22433,7 @@ async function getDaemonStatus(paths = resolveRuntimePaths()) {
   const pidFile = pidFilePath(paths);
   const pid = await readPid(pidFile);
   if (pid && !isProcessAlive3(pid)) {
-    await rm10(pidFile, { force: true }).catch(() => void 0);
+    await rm9(pidFile, { force: true }).catch(() => void 0);
     return {
       running: false,
       pid: null,
@@ -22382,10 +22888,10 @@ function updateLogPath2(paths) {
 async function clearUpdateLogFiles2(paths) {
   const primary = updateLogPath2(paths);
   await Promise.all([
-    rm11(primary, { force: true }).catch(() => void 0),
+    rm10(primary, { force: true }).catch(() => void 0),
     ...Array.from(
       { length: UPDATE_LOG_MAX_FILES2 },
-      (_, index) => rm11(`${primary}.${index + 1}`, { force: true }).catch(() => void 0)
+      (_, index) => rm10(`${primary}.${index + 1}`, { force: true }).catch(() => void 0)
     )
   ]);
 }
@@ -22442,7 +22948,7 @@ function readString18(payload, key) {
 
 // src/pairing/pairing.ts
 import path25 from "path";
-import { rm as rm12 } from "fs/promises";
+import { rm as rm11 } from "fs/promises";
 
 // src/relay/bootstrap.ts
 var RelayNetworkError = class extends Error {
@@ -22704,7 +23210,7 @@ async function readPairingClaim(sessionId, paths = resolveRuntimePaths()) {
   };
 }
 async function clearPairingClaim(sessionId, paths = resolveRuntimePaths()) {
-  await rm12(pairingClaimPath(sessionId, paths), { force: true }).catch(() => void 0);
+  await rm11(pairingClaimPath(sessionId, paths), { force: true }).catch(() => void 0);
 }
 async function claimPairing(input) {
   const paths = input.paths ?? resolveRuntimePaths();

package/dist/cli/index.js

@@ -36,7 +36,7 @@ import {
   startDaemonProcess,
   startLinkService,
   stopDaemonProcess
-} from "../chunk-2CHGHWCY.js";
+} from "../chunk-DUQDO2LQ.js";
 
 // src/cli/index.ts
 import { Command } from "commander";

package/dist/http/app.js

@@ -1,6 +1,6 @@
 import {
   createApp
-} from "../chunk-2CHGHWCY.js";
+} from "../chunk-DUQDO2LQ.js";
 export {
   createApp
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hermespilot/link",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "private": false,
   "description": "Hermes Link companion service and CLI for connecting hermes-agent through HermesPilot",
   "license": "MIT",