@inline-chat/hermes-agent-adapter 0.0.5 → 0.0.6

package/README.md

@@ -27,7 +27,7 @@ Supported:
 - Realtime inbound messages, catch-up, replies to bot messages, and action callbacks.
 - Outbound text, Markdown parsing, opt-in edit-message streaming, long-message splitting, edits, deletes, typing, and presence.
 - Inline reply-thread routing, explicit-request auto mode, `/threads` controls, explicit `/follow` and `/unfollow` dialog relevance controls, parent chat metadata, parent/thread prompt fallback, and thread-specific skill bindings.
-- Native Hermes `inline` tool for current-chat/thread reads, bounded history and search, exact message lookup, editing/deleting bot-owned messages, reactions, pin/unpin/list pins, reply-thread creation, and avatar presence/status.
+- Native Hermes `inline` tool for current-chat/thread reads, bounded history and search, exact message lookup, editing/deleting bot-owned messages, reactions, pin/unpin/list pins, reply-thread creation, top-level thread/chat creation outside the current conversation, and avatar presence/status.
 - Cached, privacy-safe sender names/usernames plus chat/thread IDs, selective reply/thread/observed context, and parent-thread context, with first-name/username Markdown mention guidance and current chat/thread links.
 - OpenClaw-style entity summaries for live turns and tool-fetched history, including mentions, text links, thread links, thread-title links, code/pre blocks, bot commands, and group mentions as untrusted Hermes context.
 - DM and group policies, user allowlists, group sender allowlists, mention requirements, strict mention mode, allowed chats, and free-response chats.
@@ -58,6 +58,12 @@ hermes plugins enable inline-platform
 hermes gateway setup
 ```
 
+When installation runs as root but the Hermes home belongs to its service user,
+the installer automatically aligns the plugin directory ownership with that
+service user. Subsequent `/inline_update` commands replace the durable plugin
+directly; users do not need to maintain a second npm prefix or repeat the
+host-side install commands for routine updates.
+
 Select Inline in the messaging-platform picker. The default path is: go to
 **Inline → Settings → Bots → Create a new bot**, then paste its token. See the
 [Inline bot creation guide](https://inline.chat/docs/creating-a-bot). The
@@ -106,10 +112,12 @@ inline-hermes --version
 
 `doctor` verifies required plugin files, the Node executable used for the
 sidecar, the installed sidecar bundle hash, and whether Hermes config enables
-the external plugin with `plugins.enabled: [inline-platform]`. It honors
-`INLINE_NODE_BIN` and fails if that explicit path is missing, not executable,
-older than Node 20, or cannot report a Node version. It also fails if a copied
-plugin has drifted from the package bundle.
+the external plugin with `plugins.enabled: [inline-platform]`. It detects
+Inline credentials from the current environment, Hermes config, or the managed
+credential store used by `hermes gateway setup`, without printing token values.
+It honors `INLINE_NODE_BIN` and fails if that explicit path is missing, not
+executable, older than Node 20, or cannot report a Node version. It also fails
+if a copied plugin has drifted from the package bundle.
 
 Confirm Hermes sees the plugin:
 
@@ -121,7 +129,7 @@ uv run ./hermes plugins list --plain --no-bundled
 Expected local output includes:
 
 ```text
-enabled      user     0.0.5    inline-platform
+enabled      user     0.0.6    inline-platform
 ```
 
 ## Update Or Reinstall
@@ -144,10 +152,10 @@ mismatch, rerun the same command after rebuilding or upgrading the package.
 
 - Hermes Agent: requires the external user plugin registry and native platform
   plugin loader available in Hermes Agent `0.17.x`. This package was validated
-  against Hermes Agent `0.18.2` from source commit `9de9c25`.
+  against Hermes Agent `0.19.1` from source commit `cc4cab2`.
 - Node.js: `>=20` is required for the bundled sidecar. Hermes-managed Node 22,
   system Node, or an explicit `INLINE_NODE_BIN` path all work.
-- Inline transport: the sidecar uses `@inline-chat/realtime-sdk@0.0.13` and is
+- Inline transport: the sidecar uses `@inline-chat/realtime-sdk@0.0.14` and is
   bundled into the npm package, so Hermes startup does not run `npm install`.
 - Live sends require a valid Inline user or bot token in `INLINE_TOKEN`,
   `INLINE_BOT_TOKEN`, `platforms.inline.token`, or `inline.token`.
@@ -254,7 +262,7 @@ Access control follows Hermes' native platform model:
 | `INLINE_DM_POLICY=open|allowlist|disabled` | Controls direct-message intake. `allowlist` requires `INLINE_ALLOWED_USERS` or config `allow_from`. |
 | `INLINE_GROUP_POLICY=open|allowlist|disabled` | Controls group intake. `allowlist` requires `INLINE_GROUP_ALLOW_FROM`. |
 | `INLINE_GROUP_ALLOW_FROM` | Comma-separated Inline user ids allowed to invoke the bot from group chats. |
-| `INLINE_REQUIRE_MENTION` | Requires a mention or wake word in groups by default. Replies to the bot and followed eligible reply/fresh threads are accepted without the wake word. |
+| `INLINE_REQUIRE_MENTION` | Requires a mention or wake word in groups by default. Replies to the bot and dialogs already marked `FOLLOWING` are accepted without the wake word. |
 | `INLINE_STRICT_MENTION` | Requires a mention or wake word on every group turn, including replies to the bot and followed threads. Defaults to `false`. |
 | `INLINE_ALLOWED_CHATS` | Comma-separated group/thread chat ids where the bot may respond. Parent chat ids also match their Inline reply threads. DMs are not filtered. Empty means no chat restriction. |
 | `INLINE_FREE_RESPONSE_CHATS` | Comma-separated group/thread chat ids where no mention is required. Parent chat ids also match their Inline reply threads. Useful for dedicated agent rooms. |
@@ -324,7 +332,11 @@ normalizes names to Inline Bot API constraints
 (`^[a-z0-9_]+$`, max 32 characters), and calls `setMyCommands`. If Inline
 rejects the full list with `BOT_COMMANDS_TOO_MUCH`, the adapter retries with a
 smaller prefix. Menu sync failures are logged as warnings and do not prevent
-message transport; `/commands` remains the full fallback list.
+message transport; `/commands` remains the full fallback list. In chats with
+multiple bots, Inline may insert `/command@botusername` to disambiguate a menu
+choice. Hermes accepts that form only when the suffix matches its own username,
+then removes the suffix before command dispatch; commands addressed to another
+bot are ignored.
 
 Run `/inline_update` to install the newest adapter from the plugin's current
 npm release channel. Stable installs continue following `latest`, while
@@ -341,7 +353,18 @@ marker, so `hermes logs` and Hermes debug reports can surface the root cause.
 Run `/follow` in an Inline DM, group, or reply thread to explicitly opt into
 eligible unmentioned activity waking Hermes. Run `/unfollow` to explicitly opt
 out; server auto-follow heuristics will not turn following back on, while
-mentions and replies retain their normal relevance behavior.
+mentions and replies retain their normal relevance behavior. If an otherwise
+implicit follow/reply wake begins with a concrete mention of another person,
+Hermes treats that explicit address as higher priority and does not respond
+unless the bot is also explicitly mentioned.
+
+The model-callable `inline` tool keeps reply and top-level creation separate:
+`create_thread` creates a reply subthread under the current or explicit parent
+chat, while `create_chat` creates a new top-level destination. `create_chat`
+requires a title, defaults to private, accepts optional participant user IDs or
+a parent space ID, and requires both `space_id` and explicit `is_public: true`
+for space-wide visibility. It returns the new chat ID so Hermes can link it in
+the normal reply.
 
 The plugin id is `inline`, which is intentionally the same id an eventual
 bundled Hermes adapter should use.
@@ -349,7 +372,8 @@ bundled Hermes adapter should use.
 ## Troubleshooting
 
 Run `inline-hermes doctor --json` first. It checks the installed plugin path,
-required files, Node executable, and source/installed sidecar bundle hashes.
+required files, Node executable, source/installed sidecar bundle hashes, and
+whether an Inline token is available to Hermes.
 
 - `plugin is not installed`: run `inline-hermes install`.
 - `Hermes plugin 'inline-platform' is not enabled`: run

package/dist/install.js

@@ -6946,7 +6946,7 @@ var require_public_api = __commonJS((exports) => {
 
 // src/install.ts
 import { constants as fsConstants, existsSync, realpathSync } from "node:fs";
-import { access, cp, lstat, mkdir, readFile, realpath, rm, stat, symlink } from "node:fs/promises";
+import { access, chown, cp, lchown, lstat, mkdir, readFile, readdir, realpath, rm, stat, symlink } from "node:fs/promises";
 import http from "node:http";
 import { createHash, randomBytes } from "node:crypto";
 import { spawn, spawnSync } from "node:child_process";
@@ -7114,6 +7114,7 @@ async function installPlugin(params) {
       filter: shouldCopyPluginFile
     });
   }
+  await alignInstallOwnership(params.opts.hermesHome, params.target, params.opts.link);
   const after = await inspectInstall(params);
   return {
     ...after,
@@ -7139,7 +7140,7 @@ async function inspectInstall(params) {
   const sourceSidecar = await inspectSidecar(params.source);
   const targetSidecar = targetExists ? await inspectSidecar(params.target) : null;
   const node = await inspectNode();
-  const activation = await inspectActivation(params.opts.hermesHome);
+  const activation = await inspectActivation(params.opts.hermesHome, params.target);
   const issues = [];
   const warnings = [];
   if (!sourceValid) {
@@ -7164,7 +7165,10 @@ async function inspectInstall(params) {
     warnings.push("Inline platform config is not enabled. Add platforms.inline.enabled: true and set INLINE_TOKEN/INLINE_BOT_TOKEN in the gateway environment, or set platforms.inline.token/inline.token in Hermes config");
   }
   if (targetExists && activation.pluginEnabled && !activation.tokenConfigured) {
-    warnings.push("No Inline token was detected in INLINE_TOKEN, INLINE_BOT_TOKEN, or Hermes Inline config; live Inline realtime checks will not connect");
+    warnings.push("No Inline token was detected in INLINE_TOKEN, INLINE_BOT_TOKEN, the Hermes credential store, or Hermes Inline config; live Inline realtime checks will not connect");
+  }
+  if (targetExists && !activation.installOwnershipAligned) {
+    warnings.push("Installed plugin ownership differs from the Hermes home owner; internal /inline_update may fail until inline-hermes install --force repairs it");
   }
   return {
     ok: sourceValid && (!targetExists || targetValid) && node.ok && issues.length === 0,
@@ -7488,7 +7492,7 @@ async function inspectNode() {
     error
   };
 }
-async function inspectActivation(hermesHome) {
+async function inspectActivation(hermesHome, target) {
   const configPath = path.join(hermesHome, "config.yaml");
   let config = null;
   let configExists = false;
@@ -7500,16 +7504,106 @@ async function inspectActivation(hermesHome) {
   }
   const tokenPresent = Boolean(process.env.INLINE_TOKEN || process.env.INLINE_BOT_TOKEN);
   const configTokenConfigured = configTokenIsConfigured(config, ["platforms", defaultPluginId, "token"]) || configTokenIsConfigured(config, [defaultPluginId, "token"]);
+  const hermesCredentialStore = inspectHermesCredentialStore();
+  const installOwnershipAligned = await inspectInstallOwnership(hermesHome, target);
   return {
     configPath,
     configExists,
     pluginEnabled: readConfigList(config, ["plugins", "enabled"]).includes(pluginEnableKey),
     platformConfigured: readConfigBoolean(config, ["platforms", defaultPluginId, "enabled"]) || readConfigBoolean(config, [defaultPluginId, "enabled"]),
     configTokenConfigured,
+    hermesCredentialStoreChecked: hermesCredentialStore.checked,
+    hermesCredentialStoreTokenConfigured: hermesCredentialStore.tokenConfigured,
     tokenPresent,
-    tokenConfigured: tokenPresent || configTokenConfigured
+    tokenConfigured: tokenPresent || configTokenConfigured || hermesCredentialStore.tokenConfigured,
+    installOwnershipAligned
   };
 }
+async function inspectInstallOwnership(hermesHome, target) {
+  if (!await exists(target))
+    return true;
+  try {
+    const homeInfo = await stat(hermesHome);
+    const pluginsInfo = await stat(path.dirname(target));
+    return pluginsInfo.uid === homeInfo.uid && pluginsInfo.gid === homeInfo.gid && await treeOwnershipMatches(target, homeInfo.uid, homeInfo.gid);
+  } catch {
+    return false;
+  }
+}
+async function treeOwnershipMatches(target, uid, gid) {
+  const info = await lstat(target);
+  if (info.uid !== uid || info.gid !== gid)
+    return false;
+  if (!info.isDirectory())
+    return true;
+  const entries = await readdir(target);
+  for (const entry of entries) {
+    if (!await treeOwnershipMatches(path.join(target, entry), uid, gid))
+      return false;
+  }
+  return true;
+}
+async function alignInstallOwnership(hermesHome, target, linked) {
+  if (typeof process.getuid !== "function" || process.getuid() !== 0)
+    return;
+  const homeInfo = await stat(hermesHome);
+  if (homeInfo.uid === 0)
+    return;
+  await chown(path.dirname(target), homeInfo.uid, homeInfo.gid);
+  if (linked) {
+    await lchown(target, homeInfo.uid, homeInfo.gid);
+    return;
+  }
+  await chownTree(target, homeInfo.uid, homeInfo.gid);
+}
+async function chownTree(target, uid, gid) {
+  const info = await lstat(target);
+  if (info.isSymbolicLink()) {
+    await lchown(target, uid, gid);
+    return;
+  }
+  if (info.isDirectory()) {
+    const entries = await readdir(target);
+    for (const entry of entries)
+      await chownTree(path.join(target, entry), uid, gid);
+  }
+  await chown(target, uid, gid);
+}
+function inspectHermesCredentialStore() {
+  const configuredPython = normalizeToken(process.env.INLINE_HERMES_PYTHON_BIN);
+  const candidates = configuredPython ? [configuredPython] : hermesPythonCandidates();
+  const probe = [
+    "from hermes_cli import gateway",
+    "configured = bool(gateway.get_env_value('INLINE_TOKEN') or gateway.get_env_value('INLINE_BOT_TOKEN'))",
+    "print('__INLINE_HERMES_TOKEN_CONFIGURED__=' + ('1' if configured else '0'))"
+  ].join("; ");
+  for (const candidate of candidates) {
+    const result = spawnSync(candidate, ["-c", probe], {
+      encoding: "utf8",
+      timeout: 2000,
+      maxBuffer: 64 * 1024
+    });
+    if (result.status !== 0)
+      continue;
+    const match = /^__INLINE_HERMES_TOKEN_CONFIGURED__=([01])$/m.exec(result.stdout || "");
+    if (match)
+      return { checked: true, tokenConfigured: match[1] === "1" };
+  }
+  return { checked: false, tokenConfigured: false };
+}
+function hermesPythonCandidates() {
+  const candidates = ["/opt/hermes/.venv/bin/python"];
+  const hermesCommand = spawnSync("which", ["hermes"], { encoding: "utf8", timeout: 1000 });
+  const hermesPath = normalizeToken(hermesCommand.stdout);
+  if (hermesCommand.status === 0 && hermesPath) {
+    try {
+      const binDir = path.dirname(realpathSync(hermesPath));
+      candidates.push(path.join(binDir, "python"), path.join(binDir, "python3"));
+    } catch {}
+  }
+  candidates.push("python3", "python");
+  return [...new Set(candidates)];
+}
 function readConfigList(config, pathParts) {
   const value = readConfigValue(config, pathParts);
   if (Array.isArray(value))
@@ -7840,8 +7934,14 @@ function printInstallResult(result) {
   printStatus(result);
   if (result.installed || result.dryRun) {
     console.log("");
-    console.log(`Enable the Hermes plugin with \`hermes plugins enable ${pluginEnableKey}\`.`);
-    console.log("Then run `hermes gateway setup`, select Inline, and follow the guided bot setup.");
+    if (!result.activation.pluginEnabled) {
+      console.log(`Enable the Hermes plugin with \`hermes plugins enable ${pluginEnableKey}\`.`);
+    }
+    if (!result.activation.platformConfigured || !result.activation.tokenConfigured) {
+      console.log("Run `hermes gateway setup`, select Inline, and follow the guided bot setup.");
+    } else if (result.installed) {
+      console.log("Restart the Hermes gateway to load the updated Inline plugin files.");
+    }
   }
 }
 function printTestSendResult(result) {
@@ -7879,6 +7979,7 @@ function printStatus(status) {
   console.log(`node: ${formatNodeInfo(status.node)}`);
   console.log(`hermes plugin enabled: ${status.activation.pluginEnabled ? "yes" : "no"}`);
   console.log(`inline platform configured: ${status.activation.platformConfigured || status.activation.tokenConfigured ? "yes" : "no"}`);
+  console.log(`inline token configured: ${status.activation.tokenConfigured ? "yes" : "no"}`);
   if (status.warnings.length > 0) {
     console.log("warnings:");
     for (const warning of status.warnings)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inline-chat/hermes-agent-adapter",
-  "version": "0.0.5",
+  "version": "0.0.6",
   "description": "Hermes Agent platform adapter for Inline, with a native Python plugin and bundled Inline realtime sidecar.",
   "license": "Apache-2.0",
   "type": "module",
@@ -60,7 +60,7 @@
     "check": "bun run typecheck && bun run lint && bun run test"
   },
   "dependencies": {
-    "@inline-chat/realtime-sdk": "0.0.13",
+    "@inline-chat/realtime-sdk": "0.0.14",
     "yaml": "2.9.0"
   },
   "devDependencies": {
@@ -76,7 +76,7 @@
     "pluginId": "inline",
     "pluginPath": "plugin/inline",
     "minHermesVersion": "0.17.0",
-    "testedHermesVersion": "0.18.2",
-    "testedHermesCommit": "9de9c25"
+    "testedHermesVersion": "0.19.1",
+    "testedHermesCommit": "cc4cab2"
   }
 }