@jinn-network/client 0.1.5 → 0.1.6-canary.0b4ff7f9

package/dist/harnesses/impls/hermes-agent/adapter.d.ts

@@ -0,0 +1,34 @@
+import { spawn } from 'node:child_process';
+import type { TaskSessionInputs } from '../learner/types.js';
+import type { ConfigBuilderEnv } from './config-builder.js';
+export interface HermesHarnessAdapterConfig {
+    hermesPath?: string;
+    hermesModel?: string;
+    hermesProvider?: string;
+    daemonApiUrl: string;
+    daemonApiToken: string;
+    corpusEnv: ConfigBuilderEnv['corpusEnv'];
+    storePath?: string;
+    /**
+     * The operator's real Hermes home — auth credentials are seeded from here
+     * into each per-Task `$HERMES_HOME`. Defaults to `process.env.HERMES_HOME`
+     * (if the operator customised it) or `~/.hermes`. Tests pass an empty dir to
+     * make the seed a no-op.
+     */
+    operatorHermesHome?: string;
+    _spawnFn?: typeof spawn;
+}
+export declare class HermesHarnessAdapter {
+    readonly name = "hermes-agent";
+    private readonly hermesPath;
+    private readonly hermesModel;
+    private readonly hermesProvider;
+    private readonly daemonApiUrl;
+    private readonly daemonApiToken;
+    private readonly corpusEnv;
+    private readonly storePath;
+    private readonly operatorHermesHome;
+    private readonly spawnFn;
+    constructor(config: HermesHarnessAdapterConfig);
+    runTask(inputs: TaskSessionInputs): Promise<void>;
+}

package/dist/harnesses/impls/hermes-agent/adapter.js

@@ -0,0 +1,184 @@
+// client/src/harnesses/impls/hermes-agent/adapter.ts
+import { spawn } from 'node:child_process';
+import { createWriteStream, mkdirSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { finished } from 'node:stream/promises';
+import { HERMES_AGENT_HARNESS } from '../../names.js';
+import { writePerTaskHermesConfig } from './bootstrap.js';
+import { buildInitialPrompt } from './prompt.js';
+const ENV_ALLOWLIST = [
+    'PATH', 'HOME', 'USER', 'SHELL', 'LANG', 'TERM', 'TMPDIR',
+    'XDG_CONFIG_HOME', 'XDG_DATA_HOME', 'XDG_CACHE_HOME',
+    'NODE_PATH', 'NODE_OPTIONS', 'NPM_CONFIG_PREFIX',
+];
+function buildAgentEnv(extra) {
+    const env = {};
+    for (const key of ENV_ALLOWLIST) {
+        if (process.env[key])
+            env[key] = process.env[key];
+    }
+    return { ...env, ...extra };
+}
+export class HermesHarnessAdapter {
+    name = HERMES_AGENT_HARNESS;
+    hermesPath;
+    hermesModel;
+    hermesProvider;
+    daemonApiUrl;
+    daemonApiToken;
+    corpusEnv;
+    storePath;
+    operatorHermesHome;
+    spawnFn;
+    constructor(config) {
+        this.hermesPath = config.hermesPath ?? 'hermes';
+        this.hermesModel = config.hermesModel;
+        this.hermesProvider = config.hermesProvider;
+        this.daemonApiUrl = config.daemonApiUrl;
+        this.daemonApiToken = config.daemonApiToken;
+        this.corpusEnv = config.corpusEnv;
+        this.storePath = config.storePath;
+        this.operatorHermesHome =
+            config.operatorHermesHome ?? (process.env['HERMES_HOME']?.trim() || join(homedir(), '.hermes'));
+        this.spawnFn = config._spawnFn ?? spawn;
+    }
+    async runTask(inputs) {
+        const hermesHome = inputs.implStateDir;
+        const model = inputs.model ?? inputs.claudeModel ?? this.hermesModel;
+        // Step 1: bootstrap — seed auth from the operator's home, write config.yaml + .env.
+        //
+        // The MCP server (`client/src/mcp/server.ts`) reads task identity from a
+        // family of `DESIRED_STATE_*` env vars; without them, `submit_typed_payload`
+        // fails with `missing_solver_type` and `get_task` returns an empty record.
+        // Mirror what claude-code-learner / codex-code-learner adapters do.
+        const taskContextJson = (() => {
+            const ctx = inputs.taskBody?.['context'];
+            if (!ctx || typeof ctx !== 'object')
+                return '';
+            try {
+                return JSON.stringify(ctx);
+            }
+            catch {
+                return '';
+            }
+        })();
+        writePerTaskHermesConfig({
+            hermesHome,
+            workingDir: inputs.workingDir,
+            model,
+            provider: this.hermesProvider,
+            solverPluginRoots: inputs.pluginRoots ?? [],
+            env: {
+                storePath: this.storePath,
+                daemonApiUrl: this.daemonApiUrl,
+                daemonApiToken: this.daemonApiToken,
+                corpusEnv: this.corpusEnv,
+                task: {
+                    id: inputs.taskId,
+                    description: typeof inputs.taskBody?.description === 'string' ? inputs.taskBody.description : '',
+                    contextJson: taskContextJson,
+                    role: typeof inputs.taskBody?.role === 'string' ? inputs.taskBody.role : '',
+                    solverType: inputs.taskBody?.solverType ?? inputs.solverType ?? '',
+                    restorationRequestId: typeof inputs.taskBody?.restorationRequestId === 'string'
+                        ? inputs.taskBody.restorationRequestId : '',
+                    requestId: inputs.requestId ?? inputs.taskId,
+                    workingDir: inputs.workingDir,
+                },
+            },
+            seedFrom: this.operatorHermesHome,
+        });
+        // Step 2: build prompt + args.
+        //
+        // `hermes chat -q <prompt> -Q --yolo --accept-hooks` —
+        //   -q PROMPT     single-query non-interactive mode
+        //   -Q            quiet/programmatic (suppress banner, spinner, tool previews)
+        //   --yolo        bypass dangerous-command approval prompts (hardline floor
+        //                 — rm -rf /, mkfs, sudo password injection, etc. — still
+        //                 blocks even with --yolo). Required for daemon-driven
+        //                 execution: there is no human at a TTY to approve, so
+        //                 without this flag any tirith "warn" or pattern-based
+        //                 "dangerous command" verdict (e.g. git reset --hard,
+        //                 chmod -R 777) drops to the default-deny prompt path and
+        //                 the agent dead-ends. The per-Task workingDir is a fresh
+        //                 sandboxed tmpdir, so blast radius is bounded.
+        //   --accept-hooks  auto-approve any unseen shell hooks (config.yaml
+        //                 `hooks:` declarations) without a TTY prompt.
+        // Model/provider passed when the daemon or SolverNet config specifies
+        // them; otherwise Hermes resolves from $HERMES_HOME/config.yaml. No `-w`
+        // flag — `hermes chat` has `--worktree` (a boolean that makes Hermes
+        // create a git worktree, which we do NOT want); the working directory is
+        // set via the spawn cwd + `terminal.cwd` in the per-Task config.yaml.
+        const prompt = buildInitialPrompt(inputs);
+        const args = ['chat', '-q', prompt, '-Q', '--yolo', '--accept-hooks'];
+        if (model) {
+            args.push('--model', model);
+        }
+        if (this.hermesProvider) {
+            args.push('--provider', this.hermesProvider);
+        }
+        const env = buildAgentEnv({
+            HERMES_HOME: hermesHome,
+        });
+        const spawnOpts = {
+            stdio: ['ignore', 'pipe', 'pipe'],
+            env,
+            cwd: inputs.workingDir,
+        };
+        // Step 3: spawn + lifecycle
+        return new Promise((resolvePromise, reject) => {
+            const logDir = join(inputs.workingDir, '.hermes-agent');
+            mkdirSync(logDir, { recursive: true });
+            const stdoutLog = createWriteStream(join(logDir, 'stdout.log'), { flags: 'a' });
+            const stderrLog = createWriteStream(join(logDir, 'stderr.log'), { flags: 'a' });
+            const closeLogs = async () => {
+                if (!stdoutLog.writableEnded)
+                    stdoutLog.end();
+                if (!stderrLog.writableEnded)
+                    stderrLog.end();
+                await Promise.all([finished(stdoutLog), finished(stderrLog)]);
+            };
+            const child = this.spawnFn(this.hermesPath, args, spawnOpts);
+            if (inputs.abort.aborted) {
+                if (!child.killed)
+                    child.kill('SIGTERM');
+            }
+            const onAbort = () => {
+                if (!child.killed)
+                    child.kill('SIGTERM');
+            };
+            inputs.abort.addEventListener('abort', onAbort);
+            let stderr = '';
+            child.stdout?.on('data', (d) => stdoutLog.write(d));
+            child.stderr?.on('data', (d) => {
+                stderrLog.write(d);
+                stderr += d.toString();
+            });
+            let settled = false;
+            const settle = (cb, onLogErr = reject) => {
+                if (settled)
+                    return;
+                settled = true;
+                inputs.abort.removeEventListener('abort', onAbort);
+                closeLogs().then(cb, onLogErr);
+            };
+            child.on('exit', (code, signal) => {
+                settle(() => {
+                    if (code === 0) {
+                        resolvePromise();
+                    }
+                    else if (inputs.abort.aborted) {
+                        resolvePromise(); // graceful-abort exits are success
+                    }
+                    else {
+                        reject(new Error(`hermes-agent: child exited code=${code} signal=${signal}: ${stderr.slice(0, 500)}`));
+                    }
+                });
+            });
+            child.on('error', (err) => {
+                settle(() => reject(err), () => reject(err));
+            });
+        });
+    }
+}
+//# sourceMappingURL=adapter.js.map

package/dist/harnesses/impls/hermes-agent/adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../../../../src/harnesses/impls/hermes-agent/adapter.ts"],"names":[],"mappings":"AAAA,qDAAqD;AACrD,OAAO,EAAE,KAAK,EAAwC,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGjD,MAAM,aAAa,GAAG;IACpB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ;IACzD,iBAAiB,EAAE,eAAe,EAAE,gBAAgB;IACpD,WAAW,EAAE,cAAc,EAAE,mBAAmB;CACjD,CAAC;AAoBF,SAAS,aAAa,CAAC,KAA6B;IAClD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;IACrD,CAAC;IACD,OAAO,EAAE,GAAG,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,OAAO,oBAAoB;IACtB,IAAI,GAAG,oBAAoB,CAAC;IAEpB,UAAU,CAAS;IACnB,WAAW,CAAqB;IAChC,cAAc,CAAqB;IACnC,YAAY,CAAS;IACrB,cAAc,CAAS;IACvB,SAAS,CAAgC;IACzC,SAAS,CAAqB;IAC9B,kBAAkB,CAAS;IAC3B,OAAO,CAAe;IAEvC,YAAY,MAAkC;QAC5C,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,QAAQ,CAAC;QAChD,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACtC,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACxC,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAC5C,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,kBAAkB;YACrB,MAAM,CAAC,kBAAkB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;QAClG,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAyB;QACrC,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC;QAErE,oFAAoF;QACpF,EAAE;QACF,yEAAyE;QACzE,6EAA6E;QAC7E,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE;YAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC;YAC/C,IAAI,CAAC;gBAAC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,EAAE,CAAC;YAAC,CAAC;QAC1D,CAAC,CAAC,EAAE,CAAC;QACL,wBAAwB,CAAC;YACvB,UAAU;YACV,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,KAAK;YACL,QAAQ,EAAE,IAAI,CAAC,cAAc;YAC7B,iBAAiB,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;YAC3C,GAAG,EAAE;gBACH,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,IAAI,EAAE;oBACJ,EAAE,EAAE,MAAM,CAAC,MAAM;oBACjB,WAAW,EAAE,OAAO,MAAM,CAAC,QAAQ,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;oBAChG,WAAW,EAAE,eAAe;oBAC5B,IAAI,EAAE,OAAO,MAAM,CAAC,QAAQ,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;oBAC3E,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,IAAI,MAAM,CAAC,UAAU,IAAI,EAAE;oBAClE,oBAAoB,EAAE,OAAO,MAAM,CAAC,QAAQ,EAAE,oBAAoB,KAAK,QAAQ;wBAC7E,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE;oBAC7C,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM;oBAC5C,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B;aACF;YACD,QAAQ,EAAE,IAAI,CAAC,kBAAkB;SAClC,CAAC,CAAC;QAEH,+BAA+B;QAC/B,EAAE;QACF,uDAAuD;QACvD,oDAAoD;QACpD,+EAA+E;QAC/E,4EAA4E;QAC5E,0EAA0E;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,0EAA0E;QAC1E,0EAA0E;QAC1E,gEAAgE;QAChE,qEAAqE;QACrE,+DAA+D;QAC/D,sEAAsE;QACtE,yEAAyE;QACzE,qEAAqE;QACrE,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAa,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAChF,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,GAAG,GAAG,aAAa,CAAC;YACxB,WAAW,EAAE,UAAU;SACxB,CAAC,CAAC;QAEH,MAAM,SAAS,GAAiB;YAC9B,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,GAAG;YACH,GAAG,EAAE,MAAM,CAAC,UAAU;SACvB,CAAC;QAEF,4BAA4B;QAC5B,OAAO,IAAI,OAAO,CAAO,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;YAClD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;YACxD,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvC,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAChF,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAChF,MAAM,SAAS,GAAG,KAAK,IAAmB,EAAE;gBAC1C,IAAI,CAAC,SAAS,CAAC,aAAa;oBAAE,SAAS,CAAC,GAAG,EAAE,CAAC;gBAC9C,IAAI,CAAC,SAAS,CAAC,aAAa;oBAAE,SAAS,CAAC,GAAG,EAAE,CAAC;gBAC9C,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAChE,CAAC,CAAC;YAEF,MAAM,KAAK,GAAiB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YAE3E,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBACzB,IAAI,CAAC,KAAK,CAAC,MAAM;oBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,IAAI,CAAC,KAAK,CAAC,MAAM;oBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC3C,CAAC,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAEhD,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5D,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;gBACrC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACnB,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACzB,CAAC,CAAC,CAAC;YAEH,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,MAAM,GAAG,CAAC,EAAc,EAAE,WAA+B,MAAM,EAAE,EAAE;gBACvE,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACnD,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YACjC,CAAC,CAAC;YAEF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;gBAChC,MAAM,CAAC,GAAG,EAAE;oBACV,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;wBACf,cAAc,EAAE,CAAC;oBACnB,CAAC;yBAAM,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;wBAChC,cAAc,EAAE,CAAC,CAAC,mCAAmC;oBACvD,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,IAAI,KAAK,CACd,mCAAmC,IAAI,WAAW,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACpF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACxB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/harnesses/impls/hermes-agent/bootstrap.d.ts

@@ -0,0 +1,18 @@
+import { type ConfigBuilderEnv } from './config-builder.js';
+export interface WritePerTaskConfigInputs {
+    hermesHome: string;
+    workingDir: string;
+    model?: string;
+    provider?: string;
+    solverPluginRoots: readonly string[];
+    env: ConfigBuilderEnv;
+    /**
+     * The operator's real Hermes home (typically `process.env.HERMES_HOME` or
+     * `~/.hermes`). The operator's `config.yaml`, `.env`, and `auth/` are
+     * inherited from here — see the merge contract in `mergePerTaskConfig`.
+     * Omit (or pass a path equal to `hermesHome`) to skip inheritance — useful
+     * in tests.
+     */
+    seedFrom?: string;
+}
+export declare function writePerTaskHermesConfig(inputs: WritePerTaskConfigInputs): void;

package/dist/harnesses/impls/hermes-agent/bootstrap.js

@@ -0,0 +1,231 @@
+// client/src/harnesses/impls/hermes-agent/bootstrap.ts
+import { cpSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { parse as yamlParse, stringify as yamlStringify } from 'yaml';
+import { hermesConfigFromSolverPlugins, } from './config-builder.js';
+/**
+ * Toolset allowlist for Jinn-run Hermes sessions.
+ *
+ * Hermes's default-ON toolset surface is broader than Claude Code's built-ins
+ * and includes footguns under unattended automation (`messaging` can send
+ * messages; `cronjob` can schedule things; `computer_use`, `browser`,
+ * `tts`/`vision`/`image_gen` are out of scope for text code-issue tasks). We
+ * pin an explicit allowlist for `hermes-cli` (the platform Jinn spawns Hermes
+ * as); operators who want to expand it for a Jinn task can request a daemon
+ * config option later — they can NOT widen the allowlist by editing their
+ * `~/.hermes/config.yaml`'s `platform_toolsets.hermes-cli` because Jinn
+ * deliberately replaces that key (other `platform_toolsets.*` entries — e.g.
+ * for `hermes-telegram` — pass through unchanged).
+ */
+const TOOLSET_ALLOWLIST = [
+    'terminal',
+    'file',
+    'web',
+    'skills',
+    'memory',
+    'session_search',
+    'todo',
+    'code_execution',
+];
+/**
+ * Files copied verbatim from the operator's real Hermes home into the per-Task
+ * `$HERMES_HOME`. Hermes resolves OAuth creds from `$HERMES_HOME/auth/...` and
+ * pooled creds from `$HERMES_HOME/auth.json` with NO real-home fallback, so a
+ * fresh per-Task home (which the freeze contract requires) would otherwise
+ * have no credentials and Hermes would fail with "No … credentials found."
+ *
+ * `bin/` carries Hermes-managed binaries — most importantly `bin/tirith`, the
+ * shell-command security scanner Hermes runs before every `terminal_tool`
+ * invocation. Hermes resolves it from `$HERMES_HOME/bin/tirith` and falls back
+ * to an auto-download from `github.com/sheeki03/tirith/releases/latest` on
+ * first use. Without seeding, every per-Task run pays the multi-MB download
+ * cost on its first shell command — long enough to blow the harness budget.
+ *
+ * Hermes may refresh OAuth access tokens mid-task. The HermesHarness excludes
+ * these runtime-only files from the daemon state digest while still fencing the
+ * learning surface (memories/, skills/, sessions/, and ordinary files). The
+ * binary exception is intentionally limited to Hermes's managed `bin/tirith`
+ * security scanner instead of the whole `bin/` tree.
+ */
+const OPERATOR_STATE_TO_SEED = ['auth', 'auth.json', 'bin'];
+function seedOperatorState(hermesHome, seedFrom) {
+    if (seedFrom === hermesHome || !existsSync(seedFrom))
+        return;
+    for (const name of OPERATOR_STATE_TO_SEED) {
+        const src = join(seedFrom, name);
+        const dst = join(hermesHome, name);
+        if (existsSync(src) && !existsSync(dst)) {
+            cpSync(src, dst, { recursive: true });
+        }
+    }
+}
+// ────────────────────────────────────────────────────────────────────────────
+// Operator config.yaml inheritance — the merge contract.
+// ────────────────────────────────────────────────────────────────────────────
+//
+// Goal: anything the operator set in `~/.hermes/config.yaml` flows into the
+// per-Task config, EXCEPT for the small set of keys Jinn must own per Task.
+// This is the comprehensive form of operator-config inheritance — it replaces
+// the prior "fresh per-Task config with hand-written Jinn fields only" path,
+// which was a whack-a-mole source (auth/, then .env, then max_tokens; each
+// real-binary run surfaced another orphaned setting). With the merge, ANY
+// operator setting (model.max_tokens, model.context_length, model.base_url,
+// provider_routing, openrouter.response_cache, agent.iteration_budget,
+// compression.threshold, auxiliary.*, display.*, voice.*, security.*,
+// approvals.*, delegation.*, web.*, custom providers: overrides, etc.) just
+// flows through.
+//
+// Jinn-managed keys (per-Task authoritative; Jinn writes these every Task):
+//   - model.default        — if a daemon/SolverNet override was provided
+//   - model.provider       — if a daemon/SolverNet override was provided
+//   - terminal.backend     — forced to `local` (the per-Task workingDir is a
+//                            host filesystem path; remote backends would need
+//                            additional setup Jinn doesn't yet do)
+//   - terminal.cwd         — the per-Task workingDir
+//   - platform_toolsets['hermes-cli']   — the Jinn allowlist (replaces any
+//                            operator value; other platforms pass through)
+//   - mcp_servers.<name>   — operator's MCP servers preserved; Jinn adds its
+//                            SolverPlugin MCP servers; Jinn wins on collision
+//   - skills.external_dirs — operator's dirs preserved; Jinn appends the
+//                            SolverPlugin skill dirs
+//
+// Everything else from the operator's config.yaml passes through unchanged.
+//
+// Operator-set keys that DO inherit and matter for budget-capped providers:
+//   - model.max_tokens     — OpenRouter pre-bills on max_tokens; operators
+//                            with low monthly caps must lower this to fit.
+//   - model.context_length — total context window cap.
+//   - provider_routing     — OpenRouter routing knobs (sort by price, etc.).
+//   - providers.<name>     — per-provider timeout / model-specific overrides.
+function isObj(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+function readOperatorConfigYaml(seedFrom) {
+    const path = join(seedFrom, 'config.yaml');
+    if (!existsSync(path))
+        return {};
+    try {
+        const text = readFileSync(path, 'utf8');
+        const parsed = yamlParse(text);
+        return isObj(parsed) ? parsed : {};
+    }
+    catch {
+        // Operator config is unparseable — proceed with Jinn-only. Hermes would
+        // also fail to read it, so this isn't hiding any real signal.
+        return {};
+    }
+}
+function mergePerTaskConfig(operator, jinn, opts) {
+    const out = { ...operator };
+    // model: deep-merge — operator's max_tokens/context_length/base_url/
+    // provider_routing/etc. preserved; Jinn overrides default+provider only if
+    // specified by daemon/SolverNet config.
+    if (opts.model || opts.provider || isObj(out.model)) {
+        const opModel = isObj(out.model) ? out.model : {};
+        const jinnModel = {};
+        if (opts.model)
+            jinnModel.default = opts.model;
+        if (opts.provider)
+            jinnModel.provider = opts.provider;
+        out.model = { ...opModel, ...jinnModel };
+    }
+    // terminal: Jinn forces backend + cwd; operator's timeout / lifetime /
+    // sudo_password / docker_* fields preserved (the docker_* fields are inert
+    // under `backend: local`, which is fine).
+    const opTerminal = isObj(out.terminal) ? out.terminal : {};
+    out.terminal = {
+        ...opTerminal,
+        backend: 'local',
+        cwd: opts.workingDir,
+    };
+    // platform_toolsets: Jinn enforces its allowlist for the `hermes-cli`
+    // platform (the platform Jinn spawns Hermes as); other platforms
+    // (hermes-telegram, etc.) pass through unchanged.
+    const opPlatformToolsets = isObj(out.platform_toolsets) ? out.platform_toolsets : {};
+    out.platform_toolsets = {
+        ...opPlatformToolsets,
+        'hermes-cli': [...TOOLSET_ALLOWLIST],
+    };
+    // mcp_servers: operator's MCP servers preserved; Jinn adds its SolverPlugin
+    // MCP servers via key-merge (Jinn wins on name collision — the SolverPlugin
+    // MCP definition is the authority on what `jinn-client` etc. mean).
+    if (jinn.mcp_servers && Object.keys(jinn.mcp_servers).length > 0) {
+        const opMcp = isObj(out.mcp_servers) ? out.mcp_servers : {};
+        out.mcp_servers = { ...opMcp, ...jinn.mcp_servers };
+    }
+    // skills.external_dirs: operator's dirs preserved; Jinn appends SolverPlugin
+    // skill dirs. Duplicates de-duped (preserves order — operator first).
+    if (jinn.skills?.external_dirs && jinn.skills.external_dirs.length > 0) {
+        const opSkills = isObj(out.skills) ? out.skills : {};
+        const opDirs = Array.isArray(opSkills.external_dirs)
+            ? opSkills.external_dirs.filter((d) => typeof d === 'string')
+            : [];
+        const merged = [...opDirs];
+        for (const d of jinn.skills.external_dirs) {
+            if (!merged.includes(d))
+                merged.push(d);
+        }
+        out.skills = { ...opSkills, external_dirs: merged };
+    }
+    return out;
+}
+function snippetToEnvFile(env) {
+    const lines = [];
+    lines.push(`DAEMON_API_URL=${env.daemonApiUrl}`);
+    lines.push(`DAEMON_API_TOKEN=${env.daemonApiToken}`);
+    if (env.storePath)
+        lines.push(`STORE_PATH=${env.storePath}`);
+    if (env.corpusEnv.subgraphUrl)
+        lines.push(`JINN_CORPUS_SUBGRAPH_URL=${env.corpusEnv.subgraphUrl}`);
+    if (env.corpusEnv.ipfsGatewayUrl)
+        lines.push(`JINN_CORPUS_IPFS_GATEWAY_URL=${env.corpusEnv.ipfsGatewayUrl}`);
+    if (env.corpusEnv.rpcUrl)
+        lines.push(`JINN_CORPUS_RPC_URL=${env.corpusEnv.rpcUrl}`);
+    if (env.corpusEnv.chainId != null)
+        lines.push(`JINN_CORPUS_CHAIN_ID=${env.corpusEnv.chainId}`);
+    if (env.corpusEnv.identityRegistryAddress)
+        lines.push(`JINN_CORPUS_IDENTITY_REGISTRY_ADDRESS=${env.corpusEnv.identityRegistryAddress}`);
+    if (env.corpusEnv.fromBlock != null)
+        lines.push(`JINN_CORPUS_FROM_BLOCK=${env.corpusEnv.fromBlock}`);
+    return lines.join('\n') + '\n';
+}
+export function writePerTaskHermesConfig(inputs) {
+    mkdirSync(inputs.hermesHome, { recursive: true });
+    if (inputs.seedFrom) {
+        seedOperatorState(inputs.hermesHome, inputs.seedFrom);
+    }
+    const operator = inputs.seedFrom ? readOperatorConfigYaml(inputs.seedFrom) : {};
+    const snippet = hermesConfigFromSolverPlugins(inputs.solverPluginRoots, inputs.env);
+    const merged = mergePerTaskConfig(operator, snippet, {
+        model: inputs.model,
+        provider: inputs.provider,
+        workingDir: inputs.workingDir,
+    });
+    writeFileSync(join(inputs.hermesHome, 'config.yaml'), yamlStringify(merged, { lineWidth: 0 }), 'utf8');
+    // Per-Task .env = operator's .env (provider API keys, debug toggles, etc.)
+    // + Jinn-runtime keys. Jinn keys go LAST so they win on duplicate names
+    // (most dotenv loaders use last-wins; Hermes uses python-dotenv). Without
+    // the operator's keys, Jinn-run Hermes can't authenticate to any provider
+    // except google-gemini-cli (whose OAuth creds are seeded via auth/), so
+    // Hermes-as-default with OpenRouter / Anthropic / etc. requires this merge.
+    const operatorEnv = inputs.seedFrom ? readOperatorEnvFile(inputs.seedFrom) : '';
+    const trailingNewline = operatorEnv.endsWith('\n') ? '' : '\n';
+    const header = operatorEnv
+        ? `${operatorEnv}${trailingNewline}# --- Jinn-runtime keys (per-Task, override any operator entries above) ---\n`
+        : '';
+    const envFile = header + snippetToEnvFile(inputs.env);
+    writeFileSync(join(inputs.hermesHome, '.env'), envFile, 'utf8');
+}
+function readOperatorEnvFile(seedFrom) {
+    const path = join(seedFrom, '.env');
+    if (!existsSync(path))
+        return '';
+    try {
+        return readFileSync(path, 'utf8');
+    }
+    catch {
+        // Permissions / race — better to proceed with just Jinn keys than crash.
+        return '';
+    }
+}
+//# sourceMappingURL=bootstrap.js.map

package/dist/harnesses/impls/hermes-agent/bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../../../src/harnesses/impls/hermes-agent/bootstrap.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACrF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,EACL,6BAA6B,GAG9B,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;GAaG;AACH,MAAM,iBAAiB,GAAG;IACxB,UAAU;IACV,MAAM;IACN,KAAK;IACL,QAAQ;IACR,QAAQ;IACR,gBAAgB;IAChB,MAAM;IACN,gBAAgB;CACR,CAAC;AAEX;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,sBAAsB,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAU,CAAC;AAmBrE,SAAS,iBAAiB,CAAC,UAAkB,EAAE,QAAgB;IAC7D,IAAI,QAAQ,KAAK,UAAU,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO;IAC7D,KAAK,MAAM,IAAI,IAAI,sBAAsB,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,yDAAyD;AACzD,+EAA+E;AAC/E,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,0EAA0E;AAC1E,4EAA4E;AAC5E,uEAAuE;AACvE,sEAAsE;AACtE,4EAA4E;AAC5E,iBAAiB;AACjB,EAAE;AACF,4EAA4E;AAC5E,yEAAyE;AACzE,yEAAyE;AACzE,6EAA6E;AAC7E,8EAA8E;AAC9E,mEAAmE;AACnE,qDAAqD;AACrD,2EAA2E;AAC3E,2EAA2E;AAC3E,6EAA6E;AAC7E,8EAA8E;AAC9E,yEAAyE;AACzE,qDAAqD;AACrD,EAAE;AACF,4EAA4E;AAC5E,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,uDAAuD;AACvD,6EAA6E;AAC7E,8EAA8E;AAE9E,SAAS,KAAK,CAAC,CAAU;IACvB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,QAAiC,EACjC,IAAyB,EACzB,IAA+D;IAE/D,MAAM,GAAG,GAA4B,EAAE,GAAG,QAAQ,EAAE,CAAC;IAErD,qEAAqE;IACrE,2EAA2E;IAC3E,wCAAwC;IACxC,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,SAAS,GAA4B,EAAE,CAAC;QAC9C,IAAI,IAAI,CAAC,KAAK;YAAE,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;QAC/C,IAAI,IAAI,CAAC,QAAQ;YAAE,SAAS,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QACtD,GAAG,CAAC,KAAK,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC;IAC3C,CAAC;IAED,uEAAuE;IACvE,2EAA2E;IAC3E,0CAA0C;IAC1C,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,GAAG,CAAC,QAAQ,GAAG;QACb,GAAG,UAAU;QACb,OAAO,EAAE,OAAO;QAChB,GAAG,EAAE,IAAI,CAAC,UAAU;KACrB,CAAC;IAEF,sEAAsE;IACtE,iEAAiE;IACjE,kDAAkD;IAClD,MAAM,kBAAkB,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,GAAG,CAAC,iBAAiB,GAAG;QACtB,GAAG,kBAAkB;QACrB,YAAY,EAAE,CAAC,GAAG,iBAAiB,CAAC;KACrC,CAAC;IAEF,4EAA4E;IAC5E,4EAA4E;IAC5E,oEAAoE;IACpE,IAAI,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACtD,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IACtE,IAAI,IAAI,CAAC,MAAM,EAAE,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvE,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;YAClD,CAAC,CAAE,QAAQ,CAAC,aAA2B,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACzF,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,MAAM,GAAa,CAAC,GAAG,MAAM,CAAC,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,GAAG,CAAC,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IACtD,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAqB;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,kBAAkB,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;IACjD,KAAK,CAAC,IAAI,CAAC,oBAAoB,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;IACrD,IAAI,GAAG,CAAC,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7D,IAAI,GAAG,CAAC,SAAS,CAAC,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,4BAA4B,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;IACnG,IAAI,GAAG,CAAC,SAAS,CAAC,cAAc;QAAE,KAAK,CAAC,IAAI,CAAC,gCAAgC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC;IAC7G,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,uBAAuB,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACpF,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,wBAAwB,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/F,IAAI,GAAG,CAAC,SAAS,CAAC,uBAAuB;QAAE,KAAK,CAAC,IAAI,CAAC,yCAAyC,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,CAAC,CAAC;IACxI,IAAI,GAAG,CAAC,SAAS,CAAC,SAAS,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,0BAA0B,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;IACrG,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAgC;IACvE,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAElD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,iBAAiB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,MAAM,OAAO,GAAG,6BAA6B,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE;QACnD,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC,CAAC;IACH,aAAa,CACX,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,EACtC,aAAa,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EACvC,MAAM,CACP,CAAC;IAEF,2EAA2E;IAC3E,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,4EAA4E;IAC5E,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,MAAM,eAAe,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,MAAM,MAAM,GAAG,WAAW;QACxB,CAAC,CAAC,GAAG,WAAW,GAAG,eAAe,+EAA+E;QACjH,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,OAAO,GAAG,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtD,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/harnesses/impls/hermes-agent/config-builder.d.ts

@@ -0,0 +1,49 @@
+export interface McpStdioServer {
+    command: string;
+    args: string[];
+    cwd?: string;
+    env?: Record<string, string>;
+}
+export interface McpHttpServer {
+    url: string;
+    headers?: Record<string, string>;
+}
+export type McpServer = McpStdioServer | McpHttpServer;
+export interface HermesConfigSnippet {
+    mcp_servers?: Record<string, McpServer>;
+    skills?: {
+        external_dirs?: string[];
+    };
+}
+export interface ConfigBuilderEnv {
+    storePath?: string;
+    daemonApiUrl: string;
+    daemonApiToken: string;
+    corpusEnv: {
+        subgraphUrl?: string;
+        ipfsGatewayUrl?: string;
+        rpcUrl?: string;
+        chainId?: number;
+        identityRegistryAddress?: string;
+        fromBlock?: number;
+    };
+    /**
+     * Active-task identifiers injected into MCP server env so jinn-client tools
+     * (get_task, submit_typed_payload, …) know which Task they are operating on.
+     * Mirrors what claude-code and codex-code adapters thread through in
+     * `buildSubprocessEnv`. When unset (e.g. unit tests), the MCP server returns
+     * a default empty task — fine for tests, broken for live runs.
+     */
+    task?: {
+        id?: string;
+        description?: string;
+        /** Already-stringified JSON of `taskBody.context`; empty string when absent. */
+        contextJson?: string;
+        role?: string;
+        solverType?: string;
+        restorationRequestId?: string;
+        requestId?: string;
+        workingDir?: string;
+    };
+}
+export declare function hermesConfigFromSolverPlugins(roots: readonly string[], env: ConfigBuilderEnv): HermesConfigSnippet;

package/dist/harnesses/impls/hermes-agent/config-builder.js

@@ -0,0 +1,104 @@
+// client/src/harnesses/impls/hermes-agent/config-builder.ts
+import { existsSync, readFileSync } from 'node:fs';
+import { isAbsolute, join, resolve } from 'node:path';
+function buildJinnRuntimeEnv(env) {
+    const out = {
+        DAEMON_API_URL: env.daemonApiUrl,
+        DAEMON_API_TOKEN: env.daemonApiToken,
+    };
+    if (env.storePath)
+        out.STORE_PATH = env.storePath;
+    if (env.corpusEnv.subgraphUrl)
+        out.JINN_CORPUS_SUBGRAPH_URL = env.corpusEnv.subgraphUrl;
+    if (env.corpusEnv.ipfsGatewayUrl)
+        out.JINN_CORPUS_IPFS_GATEWAY_URL = env.corpusEnv.ipfsGatewayUrl;
+    if (env.corpusEnv.rpcUrl)
+        out.JINN_CORPUS_RPC_URL = env.corpusEnv.rpcUrl;
+    if (env.corpusEnv.chainId != null)
+        out.JINN_CORPUS_CHAIN_ID = String(env.corpusEnv.chainId);
+    if (env.corpusEnv.identityRegistryAddress) {
+        out.JINN_CORPUS_IDENTITY_REGISTRY_ADDRESS = env.corpusEnv.identityRegistryAddress;
+    }
+    if (env.corpusEnv.fromBlock != null)
+        out.JINN_CORPUS_FROM_BLOCK = String(env.corpusEnv.fromBlock);
+    // Active-task env — read by the jinn-client MCP server in
+    // `client/src/mcp/server.ts` to populate the `task` runtime context. Without
+    // these, submit_typed_payload errors with `missing_solver_type` and get_task
+    // returns an empty record.
+    if (env.task) {
+        if (env.task.id)
+            out.DESIRED_STATE_ID = env.task.id;
+        if (env.task.description)
+            out.DESIRED_STATE_DESCRIPTION = env.task.description;
+        if (env.task.contextJson)
+            out.DESIRED_STATE_CONTEXT = env.task.contextJson;
+        if (env.task.role)
+            out.DESIRED_STATE_ROLE = env.task.role;
+        if (env.task.solverType)
+            out.DESIRED_STATE_SOLVER_TYPE = env.task.solverType;
+        if (env.task.restorationRequestId)
+            out.RESTORATION_REQUEST_ID = env.task.restorationRequestId;
+        if (env.task.requestId)
+            out.REQUEST_ID = env.task.requestId;
+        if (env.task.workingDir)
+            out.JINN_WORKING_DIR = env.task.workingDir;
+    }
+    return out;
+}
+function resolvePathTemplate(value, pluginRoot) {
+    // Resolve ${CLAUDE_PLUGIN_ROOT} / ${CODEX_PLUGIN_ROOT} → pluginRoot,
+    // then resolve relative paths against pluginRoot.
+    const substituted = value
+        .replaceAll('${CLAUDE_PLUGIN_ROOT}', pluginRoot)
+        .replaceAll('${CODEX_PLUGIN_ROOT}', pluginRoot);
+    if (isAbsolute(substituted))
+        return substituted;
+    return resolve(pluginRoot, substituted);
+}
+function translateMcpFromFile(pluginRoot, jinnEnv) {
+    const mcpFile = join(pluginRoot, '.mcp.json');
+    if (!existsSync(mcpFile))
+        return {};
+    const raw = JSON.parse(readFileSync(mcpFile, 'utf8'));
+    const servers = raw.mcpServers ?? {};
+    const out = {};
+    for (const [name, server] of Object.entries(servers)) {
+        if ('url' in server) {
+            // HTTP MCP — pass through unchanged (no path resolution needed)
+            out[name] = { url: server.url, ...(server.headers ? { headers: server.headers } : {}) };
+            continue;
+        }
+        // Stdio MCP — resolve paths and merge env
+        const resolvedArgs = server.args.map((a) => resolvePathTemplate(a, pluginRoot));
+        const resolvedCwd = server.cwd ? resolvePathTemplate(server.cwd, pluginRoot) : pluginRoot;
+        out[name] = {
+            command: server.command,
+            args: resolvedArgs,
+            cwd: resolvedCwd,
+            env: { ...jinnEnv, ...(server.env ?? {}) },
+        };
+    }
+    return out;
+}
+function translateSkillsDir(pluginRoot) {
+    const skillsDir = join(pluginRoot, 'skills');
+    return existsSync(skillsDir) ? skillsDir : null;
+}
+export function hermesConfigFromSolverPlugins(roots, env) {
+    const jinnEnv = buildJinnRuntimeEnv(env);
+    const mcpServers = {};
+    const externalDirs = [];
+    for (const root of roots) {
+        Object.assign(mcpServers, translateMcpFromFile(root, jinnEnv));
+        const skills = translateSkillsDir(root);
+        if (skills)
+            externalDirs.push(skills);
+    }
+    const snippet = {};
+    if (Object.keys(mcpServers).length > 0)
+        snippet.mcp_servers = mcpServers;
+    if (externalDirs.length > 0)
+        snippet.skills = { external_dirs: externalDirs };
+    return snippet;
+}
+//# sourceMappingURL=config-builder.js.map