@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/dist/hermes-install.test.js

@@ -0,0 +1,866 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const node_test_1 = __importDefault(require("node:test"));
+const hermes_install_js_1 = require("./hermes-install.js");
+const INSTALLER = Buffer.from('# verified official installer fixture\n');
+const INSTALLER_HASH = (0, node_crypto_1.createHash)('sha256').update(INSTALLER).digest('hex');
+function manifest(overrides = {}) {
+    return {
+        schemaVersion: 2,
+        project: {
+            id: 'project-123',
+            shortId: 'abc123',
+            name: 'Scout',
+            createdAt: '2026-07-12T12:00:00.000Z',
+        },
+        install: {
+            productType: 'agent_setup',
+            runtime: 'hermes',
+            release: {
+                tag: 'v2026.7.20',
+                packageVersion: '0.19.0',
+                commitSha: '3ef6bbd201263d354fd83ec55b3c306ded2eb72a',
+                publishedAt: '2026-07-20T18:35:00.000Z',
+                reviewedAt: '2026-07-23T00:00:00.000Z',
+                installScriptSha256: { windows: INSTALLER_HASH, posix: INSTALLER_HASH },
+            },
+            profileName: 'scout',
+            distributionFiles: {
+                'distribution.yaml': 'name: scout\nversion: 1.0.0\nhermes_requires: ">=0.19.0"\n',
+                'SOUL.md': '# Scout\nBe careful and useful.\n',
+                'config.yaml': 'approvals:\n  mode: manual\n',
+                'README.md': '# Scout setup\nCredentials are entered during official setup.\n',
+                'skills/research/SKILL.md': '# Research\nUse primary sources.\n',
+            },
+            localSeedFiles: {
+                'memories/USER.md': 'The user prefers concise status updates.',
+                'memories/MEMORY.md': 'This profile was created by Lattice.',
+            },
+            selectedChannels: [],
+            providerSetup: 'portal',
+            terminalBackend: 'local',
+            requestedGatewaySetup: false,
+            ...overrides,
+        },
+    };
+}
+function fakeRuntime(root, options = {}) {
+    const calls = [];
+    const logs = [];
+    let profileExists = !!options.existingProfile;
+    const value = {
+        platform: 'linux',
+        arch: 'x64',
+        homeDir: root,
+        tempDir: (0, node_path_1.join)(root, 'temp'),
+        now: () => new Date('2026-07-12T12:00:00.000Z'),
+        log(message) { logs.push(message); },
+        async download() { return INSTALLER; },
+        run(command, args, runOptions) {
+            const call = {
+                command,
+                args,
+                quiet: runOptions?.quiet,
+                env: runOptions?.env,
+            };
+            if (runOptions?.timeoutMs !== undefined)
+                call.timeoutMs = runOptions.timeoutMs;
+            if (runOptions?.unsetEnv !== undefined)
+                call.unsetEnv = runOptions.unsetEnv;
+            calls.push(call);
+            const commandLine = args.join(' ');
+            if (command === 'git') {
+                if (args.includes('rev-parse'))
+                    return { status: 0, stdout: `${manifest().install.release.commitSha}\n` };
+                return { status: 0 };
+            }
+            if (options.failArgs && commandLine.includes(options.failArgs))
+                return { status: 1 };
+            if (args[0] === '--version')
+                return { status: 0, stdout: 'Hermes Agent v0.19.0\n' };
+            if (commandLine === 'profile show scout')
+                return { status: profileExists ? 0 : 1 };
+            if (args[0] === 'profile' && args[1] === 'install')
+                profileExists = true;
+            return { status: 0 };
+        },
+    };
+    return { value, calls, logs };
+}
+(0, node_test_1.default)('validates the runtime discriminator, allowed paths, memory limits, and secret boundary', () => {
+    strict_1.default.doesNotThrow(() => (0, hermes_install_js_1.validateHermesManifest)(manifest()));
+    strict_1.default.throws(() => (0, hermes_install_js_1.validateHermesManifest)(manifest({ distributionFiles: { ...manifest().install.distributionFiles, '../escape': 'bad' } })), /not allowed|Unsafe/);
+    strict_1.default.throws(() => (0, hermes_install_js_1.validateHermesManifest)(manifest({ distributionFiles: { ...manifest().install.distributionFiles, '.env': 'TOKEN=value' } })), /not allowed/);
+    strict_1.default.throws(() => (0, hermes_install_js_1.validateHermesManifest)(manifest({ localSeedFiles: { 'memories/USER.md': 'x'.repeat(1_376) } })), /1,375-character limit/);
+    strict_1.default.throws(() => (0, hermes_install_js_1.validateHermesManifest)(manifest({
+        distributionFiles: { ...manifest().install.distributionFiles, 'config.yaml': 'api_key: sk-exampletoken1234567890' },
+    })), /appears to contain a provider token/);
+});
+(0, node_test_1.default)('removes inherited Git redirection variables case-insensitively on Windows', () => {
+    const child = (0, hermes_install_js_1.buildChildEnvironment)({
+        Git_Dir: 'redirected-git-dir',
+        git_work_tree: 'redirected-work-tree',
+        GIT_INDEX_FILE: 'redirected-index',
+        KEEP_ME: 'present',
+    }, {
+        GIT_TERMINAL_PROMPT: '0',
+    }, ['GIT_DIR', 'GIT_WORK_TREE', 'GIT_INDEX_FILE'], 'win32');
+    strict_1.default.equal(child.Git_Dir, undefined);
+    strict_1.default.equal(child.git_work_tree, undefined);
+    strict_1.default.equal(child.GIT_INDEX_FILE, undefined);
+    strict_1.default.equal(child.GIT_TERMINAL_PROMPT, '0');
+    strict_1.default.equal(child.KEEP_ME, 'present');
+});
+(0, node_test_1.default)('dry run is side-effect free and reports the exact plan', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-hermes-dry-'));
+    const fake = fakeRuntime(root);
+    try {
+        const receipt = await (0, hermes_install_js_1.installHermes)(manifest(), { dryRun: true, hermesCommand: 'hermes' }, fake.value);
+        strict_1.default.equal(receipt.stage, 'planned');
+        strict_1.default.equal(receipt.filesApplied.length, 5);
+        strict_1.default.equal(fake.calls.length, 0);
+        await strict_1.default.rejects(node_fs_1.promises.access((0, node_path_1.join)(root, '.lattice')), /ENOENT/);
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('requires skip-install before an explicit Hermes command can bypass the managed launcher', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-hermes-explicit-command-'));
+    const fake = fakeRuntime(root);
+    try {
+        await strict_1.default.rejects((0, hermes_install_js_1.installHermes)(manifest(), { hermesHome: root, hermesCommand: 'other-hermes' }, fake.value), /explicit Hermes command requires --skip-hermes-install/);
+        strict_1.default.equal(fake.calls.length, 0);
+        await strict_1.default.rejects(node_fs_1.promises.access((0, node_path_1.join)(root, '.lattice')), /ENOENT/);
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('resolves current managed Hermes launchers before legacy venv layouts', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-hermes-command-'));
+    const install = (0, node_path_1.join)(root, 'hermes-agent');
+    const managed = (0, node_path_1.join)(install, '.hermes', 'bin', 'hermes');
+    const legacy = (0, node_path_1.join)(install, 'venv', 'bin', 'hermes');
+    try {
+        await node_fs_1.promises.mkdir((0, node_path_1.join)(install, '.hermes', 'bin'), { recursive: true });
+        await node_fs_1.promises.mkdir((0, node_path_1.join)(install, 'venv', 'bin'), { recursive: true });
+        await node_fs_1.promises.writeFile(managed, '', { mode: 0o700 });
+        await node_fs_1.promises.writeFile(legacy, '', { mode: 0o700 });
+        strict_1.default.equal(await (0, hermes_install_js_1.resolveHermesCommand)(root, 'linux'), managed);
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('uses the managed Hermes launcher by default with direct command arguments', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-hermes-command-default-'));
+    const managed = (0, node_path_1.join)(root, 'hermes-agent', '.hermes', 'bin', 'hermes');
+    const fake = fakeRuntime(root);
+    try {
+        await node_fs_1.promises.mkdir((0, node_path_1.join)(root, 'hermes-agent', '.hermes', 'bin'), { recursive: true });
+        await node_fs_1.promises.writeFile(managed, '', { mode: 0o700 });
+        const receipt = await (0, hermes_install_js_1.installHermes)(manifest(), {
+            hermesHome: root,
+            skipHermesInstall: true,
+            skipSetup: true,
+        }, fake.value);
+        strict_1.default.equal(receipt.stage, 'installed');
+        const versionCall = fake.calls.find((call) => call.args[0] === '--version');
+        strict_1.default.deepEqual(versionCall, {
+            command: managed,
+            args: ['--version'],
+            quiet: true,
+            env: { HERMES_HOME: root },
+            timeoutMs: 60_000,
+            unsetEnv: ['GIT_DIR', 'GIT_WORK_TREE', 'GIT_INDEX_FILE'],
+        });
+        (0, strict_1.default)(fake.calls.filter((call) => call.command === managed).every((call) => Array.isArray(call.args)));
+        (0, strict_1.default)(fake.calls.filter((call) => call.command === managed).every((call) => call.env?.HERMES_HOME === root));
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('passes the requested Hermes home into an isolated managed launcher process', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-hermes-child-env-'));
+    const launcher = (0, node_path_1.join)(root, 'synthetic-hermes.cjs');
+    const observations = (0, node_path_1.join)(root, 'observations.jsonl');
+    const profileMarker = (0, node_path_1.join)(root, 'profile-installed');
+    const fake = fakeRuntime(root);
+    try {
+        await node_fs_1.promises.writeFile(launcher, [
+            "const fs = require('node:fs');",
+            `const observations = ${JSON.stringify(observations)};`,
+            `const profileMarker = ${JSON.stringify(profileMarker)};`,
+            "const args = process.argv.slice(2);",
+            "fs.appendFileSync(observations, JSON.stringify({ args, hermesHome: process.env.HERMES_HOME || null }) + '\\n');",
+            "if (args[0] === '--version') { console.log('Hermes Agent v0.19.0'); process.exit(0); }",
+            "if (args[0] === 'profile' && args[1] === 'show') process.exit(fs.existsSync(profileMarker) ? 0 : 1);",
+            "if (args[0] === 'profile' && args[1] === 'install') fs.writeFileSync(profileMarker, 'installed');",
+        ].join('\n'));
+        const runtime = {
+            ...fake.value,
+            run(command, args, runOptions) {
+                strict_1.default.equal(command, 'synthetic-hermes');
+                const child = (0, node_child_process_1.spawnSync)(process.execPath, [launcher, ...args], {
+                    env: { ...process.env, ...runOptions?.env },
+                    encoding: 'utf8',
+                    shell: false,
+                });
+                return { status: child.status, error: child.error, stdout: child.stdout, stderr: child.stderr };
+            },
+        };
+        const receipt = await (0, hermes_install_js_1.installHermes)(manifest(), {
+            hermesHome: root,
+            hermesCommand: 'synthetic-hermes',
+            skipHermesInstall: true,
+            skipSetup: true,
+        }, runtime);
+        strict_1.default.equal(receipt.stage, 'installed');
+        const seen = (await node_fs_1.promises.readFile(observations, 'utf8')).trim().split('\n').map((line) => JSON.parse(line));
+        (0, strict_1.default)(seen.length >= 4);
+        (0, strict_1.default)(seen.every((entry) => entry.hermesHome === root));
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('reports quiet launcher stderr while redacting credential-shaped values', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-hermes-diagnostic-'));
+    const fake = fakeRuntime(root);
+    const runtime = {
+        ...fake.value,
+        run(command, args, runOptions) {
+            if (args[0] === '--version') {
+                return {
+                    status: 7,
+                    stderr: 'dependency environment missing; api_key=sk-exampletoken1234567890; authorization: Bearer fixture-secret-token',
+                };
+            }
+            return fake.value.run(command, args, runOptions);
+        },
+    };
+    try {
+        await strict_1.default.rejects((0, hermes_install_js_1.installHermes)(manifest(), {
+            hermesHome: root,
+            hermesCommand: 'synthetic-hermes',
+            skipHermesInstall: true,
+            skipSetup: true,
+        }, runtime), (error) => {
+            strict_1.default.match(error.message, /Hermes version check failed \(exit 7\): dependency environment missing/);
+            strict_1.default.match(error.message, /\[redacted/);
+            strict_1.default.doesNotMatch(error.message, /sk-exampletoken1234567890|fixture-secret-token/);
+            return true;
+        });
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('accepts the exact pinned Hermes header from either captured stream', async () => {
+    const cases = [
+        { stdout: 'Hermes Agent v0.22.2 · stable\n', stderr: undefined },
+        { stdout: undefined, stderr: 'Hermes Agent v0.22.2 (stable)\n' },
+    ];
+    for (const [index, versionOutput] of cases.entries()) {
+        const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), `lattice-hermes-version-ok-${index}-`));
+        const fake = fakeRuntime(root);
+        const runtime = {
+            ...fake.value,
+            run(command, args, runOptions) {
+                if (args[0] === '--version')
+                    return { status: 0, ...versionOutput };
+                return fake.value.run(command, args, runOptions);
+            },
+        };
+        const pinned = manifest({
+            release: { ...manifest().install.release, packageVersion: '0.22.2' },
+        });
+        try {
+            const receipt = await (0, hermes_install_js_1.installHermes)(pinned, {
+                hermesHome: root,
+                hermesCommand: 'synthetic-hermes',
+                skipHermesInstall: true,
+                skipSetup: true,
+            }, runtime);
+            strict_1.default.equal(receipt.stage, 'installed');
+        }
+        finally {
+            await node_fs_1.promises.rm(root, { recursive: true, force: true });
+        }
+    }
+});
+(0, node_test_1.default)('rejects absent, incidental, inexact, and conflicting Hermes version headers', async () => {
+    const cases = [
+        { label: 'empty', stdout: undefined, stderr: undefined },
+        { label: 'editable metadata', stdout: 'Hermes Agent v0.0.0\n', stderr: undefined },
+        { label: 'prefix collision', stdout: 'Hermes Agent v0.22.20\n', stderr: undefined },
+        { label: 'different release', stdout: 'Hermes Agent v0.22.1\n', stderr: undefined },
+        { label: 'incidental text', stdout: 'Update available for Hermes Agent v0.22.2\n', stderr: undefined },
+        { label: 'invalid suffix', stdout: 'Hermes Agent v0.22.2unexpected\n', stderr: undefined },
+        { label: 'conflict', stdout: 'Hermes Agent v0.22.2\n', stderr: 'Hermes Agent v0.22.20\n' },
+    ];
+    for (const versionOutput of cases) {
+        const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), `lattice-hermes-version-${versionOutput.label.replace(/\s/g, '-')}-`));
+        const fake = fakeRuntime(root);
+        const runtime = {
+            ...fake.value,
+            run(command, args, runOptions) {
+                if (args[0] === '--version')
+                    return { status: 0, stdout: versionOutput.stdout, stderr: versionOutput.stderr };
+                return fake.value.run(command, args, runOptions);
+            },
+        };
+        const pinned = manifest({
+            release: { ...manifest().install.release, packageVersion: '0.22.2' },
+        });
+        try {
+            await strict_1.default.rejects((0, hermes_install_js_1.installHermes)(pinned, {
+                hermesHome: root,
+                hermesCommand: 'synthetic-hermes',
+                skipHermesInstall: true,
+                skipSetup: true,
+            }, runtime), (error) => {
+                strict_1.default.match(error.message, /unexpected release\. Expected 0\.22\.2\./);
+                strict_1.default.match(error.message, /stdout: /);
+                strict_1.default.match(error.message, /stderr: /);
+                return true;
+            });
+        }
+        finally {
+            await node_fs_1.promises.rm(root, { recursive: true, force: true });
+        }
+    }
+});
+(0, node_test_1.default)('bounds and sanitizes both successful streams when the Hermes version mismatches', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-hermes-version-diagnostic-'));
+    const fake = fakeRuntime(root);
+    const runtime = {
+        ...fake.value,
+        run(command, args, runOptions) {
+            if (args[0] === '--version') {
+                return {
+                    status: 0,
+                    stdout: `stdout-prefix-${'x'.repeat(2_500)}\nHermes Agent v0.0.0\napi_key=sk-exampletoken1234567890`,
+                    stderr: `stderr-prefix-${'y'.repeat(2_500)}\nauthorization: Bearer fixture-secret-token`,
+                };
+            }
+            return fake.value.run(command, args, runOptions);
+        },
+    };
+    const pinned = manifest({
+        release: { ...manifest().install.release, packageVersion: '0.22.2' },
+    });
+    try {
+        await strict_1.default.rejects((0, hermes_install_js_1.installHermes)(pinned, {
+            hermesHome: root,
+            hermesCommand: 'synthetic-hermes',
+            skipHermesInstall: true,
+            skipSetup: true,
+        }, runtime), (error) => {
+            strict_1.default.match(error.message, /stdout: /);
+            strict_1.default.match(error.message, /stderr: /);
+            strict_1.default.match(error.message, /\[redacted/);
+            strict_1.default.doesNotMatch(error.message, /sk-exampletoken1234567890|fixture-secret-token/);
+            strict_1.default.doesNotMatch(error.message, /stdout-prefix|stderr-prefix/);
+            return true;
+        });
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('repairs a stale source stamp only after exact official tag, checkout, and clean-tree verification', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-hermes-source-identity-'));
+    const install = (0, node_path_1.join)(root, 'hermes-agent');
+    const managed = (0, node_path_1.join)(install, '.hermes', 'bin', 'hermes');
+    const pinned = manifest({
+        release: {
+            ...manifest().install.release,
+            tag: 'v0.22.2',
+            packageVersion: '0.22.2',
+            commitSha: 'd923a5eb487a17c0a68801bba9ef0f56c81040a8',
+        },
+    });
+    const staleStamp = `${JSON.stringify({
+        schemaVersion: 2,
+        commit: pinned.install.release.commitSha,
+        source: 'git',
+        updateMechanism: 'self',
+        baseVersion: '0.21.5',
+        displayVersion: '0.21.5+12940.gd923a5e',
+        distance: 12_940,
+        payload: 'bootstrap',
+        distribution: null,
+        tag: null,
+    }, null, 2)}\n`;
+    const fake = fakeRuntime(root);
+    const runtime = {
+        ...fake.value,
+        run(command, args, runOptions) {
+            if (command === 'git') {
+                fake.calls.push({ command, args, quiet: runOptions?.quiet, env: runOptions?.env, timeoutMs: runOptions?.timeoutMs, unsetEnv: runOptions?.unsetEnv });
+                if (args.includes('rev-parse'))
+                    return { status: 0, stdout: `${pinned.install.release.commitSha}\n` };
+                return { status: 0 };
+            }
+            if (args[0] === '--version') {
+                fake.calls.push({ command, args, quiet: runOptions?.quiet, env: runOptions?.env, timeoutMs: runOptions?.timeoutMs, unsetEnv: runOptions?.unsetEnv });
+                return { status: 0, stdout: 'Hermes Agent v0.22.2 · stable\n' };
+            }
+            return fake.value.run(command, args, runOptions);
+        },
+    };
+    try {
+        await node_fs_1.promises.mkdir((0, node_path_1.join)(install, '.hermes', 'bin'), { recursive: true });
+        await node_fs_1.promises.writeFile(managed, '', { mode: 0o700 });
+        await node_fs_1.promises.writeFile((0, node_path_1.join)(install, 'install-stamp.json'), staleStamp);
+        const receipt = await (0, hermes_install_js_1.installHermes)(pinned, { hermesHome: root, skipSetup: true }, runtime);
+        strict_1.default.equal(receipt.stage, 'installed');
+        strict_1.default.ok(receipt.runtimeIdentityBackup);
+        strict_1.default.equal(await node_fs_1.promises.readFile(receipt.runtimeIdentityBackup, 'utf8'), staleStamp);
+        await strict_1.default.rejects(node_fs_1.promises.access((0, node_path_1.join)(install, 'install-stamp.json')), /ENOENT/);
+        const fetchCall = fake.calls.find((call) => call.command === 'git' && call.args.includes('fetch'));
+        strict_1.default.deepEqual(fetchCall?.args, [
+            '-C', install, 'fetch', '--no-tags', 'https://github.com/NousResearch/hermes-agent.git',
+            'refs/tags/v0.22.2:refs/tags/v0.22.2',
+        ]);
+        strict_1.default.equal(fetchCall?.args.includes('--force'), false);
+        strict_1.default.equal(fetchCall?.timeoutMs, 90_000);
+        strict_1.default.equal(fetchCall?.env?.GIT_TERMINAL_PROMPT, '0');
+        strict_1.default.deepEqual(fetchCall?.unsetEnv, ['GIT_DIR', 'GIT_WORK_TREE', 'GIT_INDEX_FILE']);
+        const metadataCall = fake.calls.find((call) => call.command === 'git' && call.args.includes('HEAD^{commit}'));
+        strict_1.default.equal(metadataCall?.timeoutMs, 15_000);
+        strict_1.default.equal(fake.calls.filter((call) => call.command === 'git' && call.args.includes('HEAD^{commit}')).length, 2);
+        strict_1.default.ok(fake.calls.some((call) => call.command === 'git' && call.args.includes('refs/tags/v0.22.2^{commit}')));
+        strict_1.default.ok(fake.calls.some((call) => call.command === 'git' && call.args.includes('--cached')));
+        const versionCall = fake.calls.find((call) => call.command === managed && call.args[0] === '--version');
+        strict_1.default.equal(versionCall?.timeoutMs, 60_000);
+        strict_1.default.deepEqual(versionCall?.unsetEnv, ['GIT_DIR', 'GIT_WORK_TREE', 'GIT_INDEX_FILE']);
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('uses the Windows managed Git facts entry and preserves BOM-prefixed stamp bytes', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-hermes-windows-facts-'));
+    const install = (0, node_path_1.join)(root, 'hermes-agent');
+    const managedHermes = (0, node_path_1.join)(install, '.hermes', 'bin', 'hermes.exe');
+    const gitEntry = 'git-2.53.0+3-win32-x64';
+    const managedGit = (0, node_path_1.join)(root, 'tools', gitEntry, 'cmd', 'git.exe');
+    const pinned = manifest({
+        release: {
+            ...manifest().install.release,
+            tag: 'v0.22.2',
+            packageVersion: '0.22.2',
+            commitSha: 'd923a5eb487a17c0a68801bba9ef0f56c81040a8',
+        },
+    });
+    const staleStamp = `\uFEFF${JSON.stringify({
+        schemaVersion: 2,
+        commit: pinned.install.release.commitSha,
+        source: 'git',
+        updateMechanism: 'self',
+        baseVersion: '0.21.5',
+        displayVersion: '0.21.5+12940.gd923a5e',
+        distance: 12_940,
+        payload: 'bootstrap',
+        distribution: null,
+        tag: null,
+    })}\n`;
+    const fake = fakeRuntime(root);
+    const runtime = {
+        ...fake.value,
+        platform: 'win32',
+        run(command, args, runOptions) {
+            if (command === managedGit) {
+                fake.calls.push({ command, args, quiet: runOptions?.quiet, env: runOptions?.env, timeoutMs: runOptions?.timeoutMs, unsetEnv: runOptions?.unsetEnv });
+                if (args.includes('rev-parse'))
+                    return { status: 0, stdout: `${pinned.install.release.commitSha}\n` };
+                return { status: 0 };
+            }
+            if (args[0] === '--version')
+                return { status: 0, stdout: 'Hermes Agent v0.22.2\n' };
+            return fake.value.run(command, args, runOptions);
+        },
+    };
+    try {
+        await node_fs_1.promises.mkdir((0, node_path_1.join)(install, '.hermes', 'bin'), { recursive: true });
+        await node_fs_1.promises.mkdir((0, node_path_1.join)(root, 'tools', gitEntry, 'cmd'), { recursive: true });
+        await node_fs_1.promises.writeFile(managedHermes, '', { mode: 0o700 });
+        await node_fs_1.promises.writeFile(managedGit, '', { mode: 0o700 });
+        await node_fs_1.promises.writeFile((0, node_path_1.join)(root, 'tools', 'facts.json'), `\uFEFF${JSON.stringify({ schema: 1, packages: { git: { entry: gitEntry } } })}`);
+        await node_fs_1.promises.writeFile((0, node_path_1.join)(install, 'install-stamp.json'), staleStamp);
+        const receipt = await (0, hermes_install_js_1.installHermes)(pinned, { hermesHome: root, skipSetup: true }, runtime);
+        strict_1.default.ok(fake.calls.some((call) => call.command === managedGit && call.args.includes('fetch')));
+        strict_1.default.equal(await node_fs_1.promises.readFile(receipt.runtimeIdentityBackup, 'utf8'), staleStamp);
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('leaves unrelated packaged identity metadata untouched and fails closed', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-hermes-packaged-identity-'));
+    const install = (0, node_path_1.join)(root, 'hermes-agent');
+    const managed = (0, node_path_1.join)(install, '.hermes', 'bin', 'hermes');
+    const pinned = manifest({
+        release: {
+            ...manifest().install.release,
+            tag: 'v0.22.2',
+            packageVersion: '0.22.2',
+            commitSha: 'd923a5eb487a17c0a68801bba9ef0f56c81040a8',
+        },
+    });
+    const packagedStamp = `${JSON.stringify({
+        schemaVersion: 2,
+        commit: pinned.install.release.commitSha,
+        source: 'docker',
+        updateMechanism: 'external',
+        baseVersion: '0.21.5',
+        displayVersion: '0.21.5',
+        distance: 0,
+        payload: 'full',
+        distribution: 'docker',
+        tag: 'v0.21.5',
+    }, null, 2)}\n`;
+    const fake = fakeRuntime(root);
+    const runtime = {
+        ...fake.value,
+        run(command, args, runOptions) {
+            if (command === 'git') {
+                fake.calls.push({ command, args, quiet: runOptions?.quiet, env: runOptions?.env, timeoutMs: runOptions?.timeoutMs, unsetEnv: runOptions?.unsetEnv });
+                if (args.includes('rev-parse'))
+                    return { status: 0, stdout: `${pinned.install.release.commitSha}\n` };
+                return { status: 0 };
+            }
+            return fake.value.run(command, args, runOptions);
+        },
+    };
+    try {
+        await node_fs_1.promises.mkdir((0, node_path_1.join)(install, '.hermes', 'bin'), { recursive: true });
+        await node_fs_1.promises.writeFile(managed, '', { mode: 0o700 });
+        await node_fs_1.promises.writeFile((0, node_path_1.join)(install, 'install-stamp.json'), packagedStamp);
+        await strict_1.default.rejects((0, hermes_install_js_1.installHermes)(pinned, { hermesHome: root, skipSetup: true }, runtime), /does not describe the verified source checkout/);
+        strict_1.default.equal(await node_fs_1.promises.readFile((0, node_path_1.join)(install, 'install-stamp.json'), 'utf8'), packagedStamp);
+        await strict_1.default.rejects(node_fs_1.promises.access((0, node_path_1.join)(root, '.lattice', 'agent-setups', 'project-123', 'backups', '2026-07-12T12-00-00-000Z', 'runtime-identity')), /ENOENT/);
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('does not retire a stale source stamp when its exclusive backup path already exists', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-hermes-backup-collision-'));
+    const install = (0, node_path_1.join)(root, 'hermes-agent');
+    const managed = (0, node_path_1.join)(install, '.hermes', 'bin', 'hermes');
+    const backup = (0, node_path_1.join)(root, '.lattice', 'agent-setups', 'project-123', 'backups', '2026-07-12T12-00-00-000Z', 'runtime-identity', 'install-stamp.json');
+    const pinned = manifest({
+        release: {
+            ...manifest().install.release,
+            tag: 'v0.22.2',
+            packageVersion: '0.22.2',
+            commitSha: 'd923a5eb487a17c0a68801bba9ef0f56c81040a8',
+        },
+    });
+    const staleStamp = `${JSON.stringify({
+        schemaVersion: 2,
+        commit: pinned.install.release.commitSha,
+        source: 'git',
+        updateMechanism: 'self',
+        baseVersion: '0.21.5',
+        displayVersion: '0.21.5+12940.gd923a5e',
+        distance: 12_940,
+        payload: 'bootstrap',
+        distribution: null,
+        tag: null,
+    })}\n`;
+    const fake = fakeRuntime(root);
+    const runtime = {
+        ...fake.value,
+        run(command, args, runOptions) {
+            if (command === 'git') {
+                fake.calls.push({ command, args, quiet: runOptions?.quiet, env: runOptions?.env, timeoutMs: runOptions?.timeoutMs, unsetEnv: runOptions?.unsetEnv });
+                if (args.includes('rev-parse'))
+                    return { status: 0, stdout: `${pinned.install.release.commitSha}\n` };
+                return { status: 0 };
+            }
+            return fake.value.run(command, args, runOptions);
+        },
+    };
+    try {
+        await node_fs_1.promises.mkdir((0, node_path_1.join)(install, '.hermes', 'bin'), { recursive: true });
+        await node_fs_1.promises.writeFile(managed, '', { mode: 0o700 });
+        await node_fs_1.promises.writeFile((0, node_path_1.join)(install, 'install-stamp.json'), staleStamp);
+        await node_fs_1.promises.mkdir((0, node_path_1.join)(backup, '..'), { recursive: true });
+        await node_fs_1.promises.writeFile(backup, 'do-not-overwrite');
+        await strict_1.default.rejects((0, hermes_install_js_1.installHermes)(pinned, { hermesHome: root, skipSetup: true }, runtime), /EEXIST/);
+        strict_1.default.equal(await node_fs_1.promises.readFile((0, node_path_1.join)(install, 'install-stamp.json'), 'utf8'), staleStamp);
+        strict_1.default.equal(await node_fs_1.promises.readFile(backup, 'utf8'), 'do-not-overwrite');
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('official installs refuse an outside fallback or symlinked managed launcher', async () => {
+    const cases = ['outside fallback', 'symlinked launcher'];
+    for (const scenario of cases) {
+        const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), `lattice-hermes-launcher-${scenario.replace(/\s/g, '-')}-`));
+        const install = (0, node_path_1.join)(root, 'hermes-agent');
+        const fake = fakeRuntime(root);
+        try {
+            await node_fs_1.promises.mkdir(install, { recursive: true });
+            if (scenario === 'outside fallback') {
+                await node_fs_1.promises.mkdir((0, node_path_1.join)(root, 'bin'), { recursive: true });
+                await node_fs_1.promises.writeFile((0, node_path_1.join)(root, 'bin', 'hermes'), '', { mode: 0o700 });
+            }
+            else {
+                const external = (0, node_path_1.join)(root, 'external-launchers');
+                await node_fs_1.promises.mkdir((0, node_path_1.join)(external, 'bin'), { recursive: true });
+                await node_fs_1.promises.writeFile((0, node_path_1.join)(external, 'bin', 'hermes'), '', { mode: 0o700 });
+                await node_fs_1.promises.symlink(external, (0, node_path_1.join)(install, '.hermes'), 'junction');
+            }
+            await strict_1.default.rejects((0, hermes_install_js_1.installHermes)(manifest(), { hermesHome: root, skipSetup: true }, fake.value), scenario === 'outside fallback' ? /did not publish its managed launcher/ : /symbolic-link root|symbolic link/);
+            strict_1.default.equal(fake.calls.some((call) => call.args[0] === '--version'), false);
+        }
+        finally {
+            await node_fs_1.promises.rm(root, { recursive: true, force: true });
+        }
+    }
+});
+(0, node_test_1.default)('refuses dirty source, a conflicting official tag, and an unrelated old runtime', async () => {
+    const cases = [
+        { label: 'wrong head', fail: 'head', message: /Hermes checkout verification returned 0{40}/ },
+        { label: 'working tree', fail: 'working', message: /Hermes tracked-source verification failed/ },
+        { label: 'staged tree', fail: 'staged', message: /Hermes staged-source verification failed/ },
+        { label: 'conflicting tag', fail: 'fetch', message: /Official Hermes release tag fetch failed/ },
+        { label: 'wrong tag target', fail: 'tag', message: /Hermes release tag verification returned 0{40}/ },
+        { label: 'old runtime', fail: 'version', message: /unexpected release\. Expected 0\.22\.2/ },
+    ];
+    for (const scenario of cases) {
+        const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), `lattice-hermes-${scenario.label.replace(/\s/g, '-')}-`));
+        const install = (0, node_path_1.join)(root, 'hermes-agent');
+        const managed = (0, node_path_1.join)(install, '.hermes', 'bin', 'hermes');
+        const pinned = manifest({
+            release: {
+                ...manifest().install.release,
+                tag: 'v0.22.2',
+                packageVersion: '0.22.2',
+                commitSha: 'd923a5eb487a17c0a68801bba9ef0f56c81040a8',
+            },
+        });
+        const fake = fakeRuntime(root);
+        const runtime = {
+            ...fake.value,
+            run(command, args, runOptions) {
+                if (command === 'git') {
+                    fake.calls.push({ command, args, quiet: runOptions?.quiet, env: runOptions?.env, timeoutMs: runOptions?.timeoutMs, unsetEnv: runOptions?.unsetEnv });
+                    if (scenario.fail === 'working' && args.includes('diff') && !args.includes('--cached'))
+                        return { status: 1 };
+                    if (scenario.fail === 'staged' && args.includes('--cached'))
+                        return { status: 1 };
+                    if (scenario.fail === 'fetch' && args.includes('fetch'))
+                        return { status: 1, stderr: 'refusing to clobber existing tag' };
+                    if (args.includes('rev-parse')) {
+                        if (scenario.fail === 'head' && args.includes('HEAD^{commit}'))
+                            return { status: 0, stdout: `${'0'.repeat(40)}\n` };
+                        if (scenario.fail === 'tag' && args.some((value) => value.includes('refs/tags/')))
+                            return { status: 0, stdout: `${'0'.repeat(40)}\n` };
+                        return { status: 0, stdout: `${pinned.install.release.commitSha}\n` };
+                    }
+                    return { status: 0 };
+                }
+                if (args[0] === '--version') {
+                    return { status: 0, stdout: scenario.fail === 'version' ? 'Hermes Agent v0.21.5\n' : 'Hermes Agent v0.22.2\n' };
+                }
+                return fake.value.run(command, args, runOptions);
+            },
+        };
+        try {
+            await node_fs_1.promises.mkdir((0, node_path_1.join)(install, '.hermes', 'bin'), { recursive: true });
+            await node_fs_1.promises.writeFile(managed, '', { mode: 0o700 });
+            await strict_1.default.rejects((0, hermes_install_js_1.installHermes)(pinned, { hermesHome: root, skipSetup: true }, runtime), scenario.message);
+            if (scenario.fail !== 'version') {
+                strict_1.default.equal(fake.calls.some((call) => call.args[0] === '--version'), false);
+            }
+        }
+        finally {
+            await node_fs_1.promises.rm(root, { recursive: true, force: true });
+        }
+    }
+});
+(0, node_test_1.default)('resolves the current Windows managed executable without using a command shell', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-hermes-command-win-'));
+    const managed = (0, node_path_1.join)(root, 'hermes-agent', '.hermes', 'bin', 'hermes.exe');
+    try {
+        await node_fs_1.promises.mkdir((0, node_path_1.join)(root, 'hermes-agent', '.hermes', 'bin'), { recursive: true });
+        await node_fs_1.promises.writeFile(managed, 'fixture', { mode: 0o700 });
+        strict_1.default.equal(await (0, hermes_install_js_1.resolveHermesCommand)(root, 'win32'), managed);
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('resolves the stable launcher inside the requested Hermes home', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-hermes-command-home-'));
+    const managed = (0, node_path_1.join)(root, 'bin', 'hermes');
+    try {
+        await node_fs_1.promises.mkdir((0, node_path_1.join)(root, 'bin'), { recursive: true });
+        await node_fs_1.promises.writeFile(managed, '', { mode: 0o700 });
+        strict_1.default.equal(await (0, hermes_install_js_1.resolveHermesCommand)(root, 'linux'), managed);
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('retains the legacy Hermes venv layout and explicit command override', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-hermes-command-legacy-'));
+    const legacy = (0, node_path_1.join)(root, 'hermes-agent', 'venv', 'bin', 'hermes');
+    try {
+        await node_fs_1.promises.mkdir((0, node_path_1.join)(root, 'hermes-agent', 'venv', 'bin'), { recursive: true });
+        await node_fs_1.promises.writeFile(legacy, '', { mode: 0o700 });
+        strict_1.default.equal(await (0, hermes_install_js_1.resolveHermesCommand)(root, 'darwin'), legacy);
+        strict_1.default.equal(await (0, hermes_install_js_1.resolveHermesCommand)(root, 'linux', 'custom-hermes'), 'custom-hermes');
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('fails when no bounded managed or legacy Hermes launcher exists', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-hermes-command-missing-'));
+    try {
+        await strict_1.default.rejects((0, hermes_install_js_1.resolveHermesCommand)(root, 'linux'), /Hermes command was not published under the requested Hermes home/);
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('verifies the script hash, pins the commit, installs a persistent distribution, and writes an actionable receipt', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-hermes-ok-'));
+    const managed = (0, node_path_1.join)(root, 'hermes-agent', '.hermes', 'bin', 'hermes');
+    const fake = fakeRuntime(root);
+    try {
+        await node_fs_1.promises.mkdir((0, node_path_1.join)(root, 'hermes-agent', '.hermes', 'bin'), { recursive: true });
+        await node_fs_1.promises.writeFile(managed, '', { mode: 0o700 });
+        const receipt = await (0, hermes_install_js_1.installHermes)(manifest(), { hermesHome: root, skipSetup: true }, fake.value);
+        strict_1.default.equal(receipt.stage, 'installed');
+        strict_1.default.equal(await node_fs_1.promises.readFile((0, node_path_1.join)(receipt.distributionDirectory, 'SOUL.md'), 'utf8'), '# Scout\nBe careful and useful.\n');
+        strict_1.default.equal(await node_fs_1.promises.readFile((0, node_path_1.join)(receipt.profileDirectory, 'memories', 'USER.md'), 'utf8'), 'The user prefers concise status updates.');
+        const installCall = fake.calls.find((call) => call.command === 'bash');
+        strict_1.default.ok(installCall);
+        strict_1.default.ok(installCall.args.includes('--commit'));
+        strict_1.default.ok(installCall.args.includes(manifest().install.release.commitSha));
+        strict_1.default.ok(installCall.args.includes('--non-interactive'));
+        strict_1.default.ok(installCall.args.includes('--skip-setup'));
+        const profileCall = fake.calls.find((call) => call.args[0] === 'profile' && call.args[1] === 'install');
+        strict_1.default.ok(profileCall?.args.includes('--yes'));
+        strict_1.default.equal(profileCall?.args.includes('--force'), false);
+        const storedReceipt = await node_fs_1.promises.readFile((0, node_path_1.join)(root, '.lattice', 'agent-setups', 'project-123', 'receipt.json'), 'utf8');
+        strict_1.default.match(storedReceipt, /"resumeCommand"/);
+        strict_1.default.doesNotMatch(storedReceipt, /Be careful and useful/);
+        strict_1.default.ok(fake.calls.some((call) => call.args.join(' ') === '-p scout config check'));
+        strict_1.default.equal(fake.calls.some((call) => call.args.join(' ') === 'doctor'), false);
+        strict_1.default.ok(fake.logs.some((line) => line.includes('This setup is not yet verified')));
+        strict_1.default.ok(fake.calls.some((call) => call.command === 'git' && call.args.includes('fetch')));
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('refuses a script hash mismatch before executing it', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-hermes-hash-'));
+    const fake = fakeRuntime(root);
+    const bad = manifest({
+        release: { ...manifest().install.release, installScriptSha256: { windows: '0'.repeat(64), posix: '0'.repeat(64) } },
+    });
+    try {
+        await strict_1.default.rejects((0, hermes_install_js_1.installHermes)(bad, {}, fake.value), /integrity check failed/);
+        strict_1.default.equal(fake.calls.length, 0);
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('treats a same-name profile as a recoverable conflict and never forces it implicitly', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-hermes-conflict-'));
+    const fake = fakeRuntime(root, { existingProfile: true });
+    try {
+        await strict_1.default.rejects((0, hermes_install_js_1.installHermes)(manifest(), { skipHermesInstall: true, hermesCommand: 'hermes' }, fake.value), /--profile-name <new-name>.*--update-existing-profile/);
+        strict_1.default.equal(fake.calls.some((call) => call.args.includes('--force')), false);
+        await strict_1.default.rejects(node_fs_1.promises.access((0, node_path_1.join)(root, '.lattice', 'agent-setups', 'project-123', 'hermes-distribution')), /ENOENT/);
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('backs up and explicitly updates an existing Lattice-managed profile', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-hermes-update-'));
+    const fake = fakeRuntime(root, { existingProfile: true });
+    const profile = (0, node_path_1.join)(root, '.hermes', 'profiles', 'scout');
+    try {
+        await node_fs_1.promises.mkdir(profile, { recursive: true });
+        await node_fs_1.promises.writeFile((0, node_path_1.join)(profile, 'SOUL.md'), '# Original soul');
+        const receipt = await (0, hermes_install_js_1.installHermes)(manifest(), {
+            skipHermesInstall: true,
+            skipSetup: true,
+            updateExistingProfile: true,
+            hermesCommand: 'hermes',
+        }, fake.value);
+        strict_1.default.ok(fake.calls.some((call) => call.args[0] === 'profile' && call.args.includes('--force')));
+        strict_1.default.equal(await node_fs_1.promises.readFile((0, node_path_1.join)(receipt.backupDirectory, 'profile', 'SOUL.md'), 'utf8'), '# Original soul');
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('verifies the provider before running optional gateway setup', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-hermes-gateway-'));
+    const fake = fakeRuntime(root);
+    try {
+        const receipt = await (0, hermes_install_js_1.installHermes)(manifest({ requestedGatewaySetup: true, selectedChannels: ['telegram'] }), { skipHermesInstall: true, hermesCommand: 'hermes' }, fake.value);
+        strict_1.default.equal(receipt.stage, 'verified');
+        const lines = fake.calls.map((call) => call.args.join(' '));
+        const setupIndex = lines.indexOf('-p scout setup --portal');
+        const modelIndex = lines.indexOf('-p scout chat -q Reply with READY.');
+        const gatewayIndex = lines.indexOf('-p scout gateway setup');
+        strict_1.default.ok(setupIndex >= 0 && modelIndex > setupIndex && gatewayIndex > modelIndex);
+        strict_1.default.ok(fake.logs.some((line) => line.includes('provider quota')));
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('rolls back only Lattice-owned files when verification fails', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-hermes-rollback-'));
+    const fake = fakeRuntime(root, { failArgs: 'config check' });
+    const setupDistribution = (0, node_path_1.join)(root, '.lattice', 'agent-setups', 'project-123', 'hermes-distribution');
+    const profile = (0, node_path_1.join)(root, '.hermes', 'profiles', 'scout');
+    try {
+        await node_fs_1.promises.mkdir(setupDistribution, { recursive: true });
+        await node_fs_1.promises.mkdir((0, node_path_1.join)(profile, 'memories'), { recursive: true });
+        await node_fs_1.promises.writeFile((0, node_path_1.join)(setupDistribution, 'SOUL.md'), '# Prior distribution');
+        await node_fs_1.promises.writeFile((0, node_path_1.join)(profile, 'SOUL.md'), '# User profile state');
+        await node_fs_1.promises.writeFile((0, node_path_1.join)(profile, 'memories', 'USER.md'), 'Prior user memory');
+        await node_fs_1.promises.writeFile((0, node_path_1.join)(profile, '.env'), 'SECRET_STAYS_LOCAL=1');
+        await strict_1.default.rejects((0, hermes_install_js_1.installHermes)(manifest(), { skipHermesInstall: true, skipSetup: true, hermesCommand: 'hermes' }, fake.value), /Lattice-owned distribution and seed files were restored.*Hermes runtime installation.*gateway or service changes are not automatically reverted.*Resume with/);
+        strict_1.default.equal(await node_fs_1.promises.readFile((0, node_path_1.join)(setupDistribution, 'SOUL.md'), 'utf8'), '# Prior distribution');
+        strict_1.default.equal(await node_fs_1.promises.readFile((0, node_path_1.join)(profile, 'SOUL.md'), 'utf8'), '# User profile state');
+        strict_1.default.equal(await node_fs_1.promises.readFile((0, node_path_1.join)(profile, 'memories', 'USER.md'), 'utf8'), 'Prior user memory');
+        strict_1.default.equal(await node_fs_1.promises.readFile((0, node_path_1.join)(profile, '.env'), 'utf8'), 'SECRET_STAYS_LOCAL=1');
+        const receipt = await node_fs_1.promises.readFile((0, node_path_1.join)(root, '.lattice', 'agent-setups', 'project-123', 'receipt.json'), 'utf8');
+        strict_1.default.match(receipt, /"failedStage": "config-check"/);
+        strict_1.default.doesNotMatch(receipt, /SECRET_STAYS_LOCAL/);
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+//# sourceMappingURL=hermes-install.test.js.map