@minionry/minion 0.7.36

package/dist/server/engines/hermes/hermes-auth.js

@@ -0,0 +1,159 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { spawn as nodeSpawn } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { ProviderCredentialStore } from '../credentials/provider-credentials.js';
+export const HERMES_PROVIDER_ENV_VARS = {
+    nous: 'NOUS_API_KEY',
+    openrouter: 'OPENROUTER_API_KEY',
+    fireworks: 'FIREWORKS_API_KEY',
+    openai: 'OPENAI_API_KEY',
+    anthropic: 'ANTHROPIC_API_KEY',
+    google: 'GOOGLE_API_KEY',
+    huggingface: 'HF_TOKEN',
+    deepseek: 'DEEPSEEK_API_KEY',
+    nvidia: 'NVIDIA_API_KEY',
+    glm: 'GLM_API_KEY',
+    kimi: 'KIMI_API_KEY',
+    dashscope: 'DASHSCOPE_API_KEY',
+    azure_foundry: 'AZURE_FOUNDRY_API_KEY',
+};
+export const HERMES_PORTAL_LOGIN_COMMAND = 'hermes setup --portal';
+export const HERMES_PORTAL_STATUS_COMMAND = 'hermes portal status';
+export const HERMES_CONNECT_MESSAGE = 'Hermes has no credentials configured, so it cannot reach a model provider. Connect it in one of two ways:\n' +
+    '  • Add a provider API key (e.g. Nous Research, OpenRouter, OpenAI, Anthropic) in Settings, or\n' +
+    `  • Link a Nous Portal account by running \`${HERMES_PORTAL_LOGIN_COMMAND}\` in the Terminal view.`;
+async function resolveCommandSource(source) {
+    return typeof source === 'function' ? source() : source;
+}
+const defaultSpawn = (cmd, args) => new Promise((resolve) => {
+    const child = nodeSpawn(cmd, args, {
+        stdio: ['ignore', 'pipe', 'pipe'],
+        windowsHide: true,
+    });
+    let out = '';
+    const CAP = 8_000;
+    const append = (chunk) => {
+        out = (out + chunk.toString('utf8')).slice(-CAP);
+    };
+    child.stdout?.on('data', append);
+    child.stderr?.on('data', append);
+    child.on('error', () => resolve({ ok: false, stdout: out }));
+    child.on('exit', (code) => resolve({ ok: code === 0, stdout: out }));
+});
+export function hermesPortalAuthFilePath(env = process.env) {
+    return join(hermesHomeDir(env), 'auth.json');
+}
+export function hermesHomeDir(env = process.env) {
+    const override = env.HERMES_HOME;
+    if (override && override.trim().length > 0)
+        return override.trim();
+    return join(homedir(), '.hermes');
+}
+export function readHermesDotEnvValues(env = process.env) {
+    const values = new Map();
+    let contents;
+    try {
+        contents = readFileSync(join(hermesHomeDir(env), '.env'), 'utf8');
+    }
+    catch {
+        return values;
+    }
+    const providerByEnvVar = new Map(Object.entries(HERMES_PROVIDER_ENV_VARS).map(([providerId, envVar]) => [envVar, providerId]));
+    for (const rawLine of contents.split('\n')) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const eq = line.indexOf('=');
+        if (eq <= 0)
+            continue;
+        const name = line.slice(0, eq).trim().replace(/^export\s+/, '');
+        const providerId = providerByEnvVar.get(name);
+        if (!providerId)
+            continue;
+        const value = line
+            .slice(eq + 1)
+            .trim()
+            .replace(/^(['"])(.*)\1$/, '$2')
+            .trim();
+        if (value)
+            values.set(providerId, value);
+    }
+    return values;
+}
+export function readHermesDotEnvProviders(env = process.env) {
+    return new Set(readHermesDotEnvValues(env).keys());
+}
+export function collectHermesProviderCredentials(store, inheritedEnv = process.env) {
+    const env = {};
+    const providers = new Set(readHermesDotEnvProviders(inheritedEnv));
+    for (const [providerId, envVar] of Object.entries(HERMES_PROVIDER_ENV_VARS)) {
+        const stored = store.getApiKey(providerId);
+        if (stored) {
+            env[envVar] = stored;
+            providers.add(providerId);
+            continue;
+        }
+        const inherited = inheritedEnv[envVar];
+        if (typeof inherited === 'string' && inherited.trim().length > 0) {
+            providers.add(providerId);
+        }
+    }
+    return { env, providers: [...providers].sort() };
+}
+export async function probeHermesPortalConnected(command, deps = {}) {
+    const spawnFn = deps.spawn ?? defaultSpawn;
+    const result = await spawnFn(command, ['portal', 'status']);
+    if (!result.ok)
+        return false;
+    return !/not\s+(logged\s+in|authenticated|connected)|no\s+portal\s+(account|session)/i.test(result.stdout);
+}
+export async function getHermesConnectionStatus(command, deps = {}) {
+    const store = deps.store ?? new ProviderCredentialStore();
+    const inheritedEnv = deps.env ?? process.env;
+    const { providers } = collectHermesProviderCredentials(store, inheritedEnv);
+    if (providers.length > 0) {
+        return { path: 'provider', connected: true, providers, portalConnected: false };
+    }
+    const probe = deps.probePortal ?? ((cmd) => probeHermesPortalConnected(cmd, deps));
+    const portalConnected = await probe(await resolveCommandSource(command));
+    return {
+        path: portalConnected ? 'portal' : 'none',
+        connected: portalConnected,
+        providers,
+        portalConnected,
+    };
+}
+export async function hermesPortalLogin(command, deps = {}) {
+    const probe = deps.probePortal ?? ((cmd) => probeHermesPortalConnected(cmd, deps));
+    if (await probe(command)) {
+        return {
+            connected: true,
+            command: HERMES_PORTAL_LOGIN_COMMAND,
+            message: 'Nous Portal is already connected.',
+        };
+    }
+    return {
+        connected: false,
+        command: HERMES_PORTAL_LOGIN_COMMAND,
+        message: 'Nous Portal is not connected. Run this in the Terminal view to link your account ' +
+            '(a browser opens for the OAuth flow):\n  ' +
+            `${HERMES_PORTAL_LOGIN_COMMAND}\n` +
+            `Then verify with \`${HERMES_PORTAL_STATUS_COMMAND}\`. Minionry never stores the Portal ` +
+            'token — it lives in ~/.hermes/auth.json.',
+    };
+}
+export function createHermesAuth(deps = {}) {
+    const store = deps.store ?? new ProviderCredentialStore();
+    const inheritedEnv = deps.env ?? process.env;
+    return {
+        providerEnv() {
+            return collectHermesProviderCredentials(store, inheritedEnv).env;
+        },
+        connectionStatus(command) {
+            return getHermesConnectionStatus(command, { ...deps, store, env: inheritedEnv });
+        },
+    };
+}

package/dist/server/engines/hermes/hermes-gateway-home.js

@@ -0,0 +1,271 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { chmodSync, lstatSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { hlog } from '../../cli/headless/headless-logger.js';
+import { BROWSER_MCP_SERVER_NAME, buildBrowserMcpEntry, } from '../../cli/headless/mcp-config.js';
+import { writeFileAtomic } from '../../utils/file-store.js';
+import { readHermesDotEnvValues } from './hermes-auth.js';
+export const HERMES_GATEWAY_RECIPES = [
+    ['openrouter', { hermesProvider: 'openrouter', envVar: 'OPENROUTER_API_KEY' }],
+    [
+        'nous',
+        {
+            hermesProvider: 'openrouter',
+            envVar: 'OPENROUTER_API_KEY',
+            baseUrlEnvVar: 'OPENROUTER_BASE_URL',
+            baseUrl: 'https://inference-api.nousresearch.com/v1',
+        },
+    ],
+];
+export const PINNED_AUXILIARY_YAML = [
+    'auxiliary:',
+    '  free_only: true',
+    '  openrouter_model: "none"',
+    '  title_generation:',
+    '    enabled: false',
+    '  background_review:',
+    '    enabled: false',
+];
+function pinnedAuxiliaryYaml(baseUrl) {
+    return baseUrl ? `${PINNED_AUXILIARY_YAML.join('\n')}\n` : '';
+}
+function resolveRecipeKey(providerId, recipe, store, env) {
+    const stored = store.getApiKey(providerId)?.trim();
+    if (stored)
+        return stored;
+    const inherited = env[recipe.envVar]?.trim();
+    if (inherited)
+        return inherited;
+    return readHermesDotEnvValues(env).get(providerId);
+}
+function yamlScalar(value) {
+    return JSON.stringify(value);
+}
+export function renderHermesMcpServersYaml(browserMcp) {
+    const entry = buildBrowserMcpEntry(browserMcp);
+    const lines = [
+        'mcp_servers:',
+        `  ${BROWSER_MCP_SERVER_NAME}:`,
+        `    command: ${yamlScalar(entry.command)}`,
+        '    args:',
+        ...entry.args.map((arg) => `      - ${yamlScalar(arg)}`),
+        '    env:',
+        ...Object.entries(entry.env).map(([key, value]) => `      ${key}: ${yamlScalar(value)}`),
+    ];
+    return `${lines.join('\n')}\n`;
+}
+export function planHermesGatewayHome(model, store, env = process.env, browserMcp) {
+    for (const [providerId, recipe] of HERMES_GATEWAY_RECIPES) {
+        const key = resolveRecipeKey(providerId, recipe, store, env);
+        if (!key)
+            continue;
+        const spawnEnv = { [recipe.envVar]: key };
+        if (recipe.baseUrlEnvVar && recipe.baseUrl) {
+            spawnEnv[recipe.baseUrlEnvVar] = recipe.baseUrl;
+        }
+        return {
+            providerId,
+            configYaml: 'model:\n' +
+                `  default: ${model}\n` +
+                `  provider: ${recipe.hermesProvider}\n` +
+                (recipe.baseUrl ? `  base_url: ${recipe.baseUrl}\n` : '') +
+                pinnedAuxiliaryYaml(recipe.baseUrl) +
+                (browserMcp ? renderHermesMcpServersYaml(browserMcp) : ''),
+            spawnEnv,
+        };
+    }
+    return null;
+}
+export function planHermesProfileGatewayHome(profile, apiKey, browserMcp) {
+    if (!apiKey)
+        return null;
+    const spawnEnv = { OPENROUTER_API_KEY: apiKey };
+    if (profile.baseUrl)
+        spawnEnv.OPENROUTER_BASE_URL = profile.baseUrl;
+    return {
+        providerId: `profile:${profile.id}`,
+        configYaml: 'model:\n' +
+            `  default: ${profile.model}\n` +
+            '  provider: openrouter\n' +
+            (profile.baseUrl ? `  base_url: ${profile.baseUrl}\n` : '') +
+            pinnedAuxiliaryYaml(profile.baseUrl) +
+            (browserMcp ? renderHermesMcpServersYaml(browserMcp) : ''),
+        spawnEnv,
+    };
+}
+export const HERMES_ALL_TOOLSETS = [
+    'web',
+    'browser',
+    'terminal',
+    'file',
+    'code_execution',
+    'vision',
+    'video',
+    'image_gen',
+    'video_gen',
+    'x_search',
+    'tts',
+    'stt',
+    'skills',
+    'todo',
+    'memory',
+    'context_engine',
+    'session_search',
+    'clarify',
+    'delegation',
+    'cronjob',
+    'homeassistant',
+    'spotify',
+    'yuanbao',
+    'computer_use',
+    'a2a',
+    'bfl',
+    'connections',
+    'kanban',
+];
+export const HERMES_APP_RUN_ENV_ALLOWLIST = [
+    'PATH',
+    'HOME',
+    'USER',
+    'LOGNAME',
+    'SHELL',
+    'LANG',
+    'LANGUAGE',
+    'LC_ALL',
+    'LC_CTYPE',
+    'TZ',
+    'TMPDIR',
+    'TEMP',
+    'TMP',
+    'SSL_CERT_FILE',
+    'SSL_CERT_DIR',
+    'REQUESTS_CA_BUNDLE',
+    'HTTP_PROXY',
+    'HTTPS_PROXY',
+    'NO_PROXY',
+    'http_proxy',
+    'https_proxy',
+    'no_proxy',
+    'SYSTEMROOT',
+    'SystemRoot',
+    'COMSPEC',
+    'PATHEXT',
+    'USERPROFILE',
+    'APPDATA',
+    'LOCALAPPDATA',
+];
+export function hermesAppRunBaseEnv(env = process.env) {
+    const kept = {};
+    for (const name of HERMES_APP_RUN_ENV_ALLOWLIST) {
+        const value = env[name];
+        if (value !== undefined)
+            kept[name] = value;
+    }
+    return kept;
+}
+export const HERMES_APP_RUN_CWD_DIRNAME = 'cwd';
+export const HERMES_APP_RUN_CONTEXT_FILE = '# Session context\n\nThis session has no project files, no tools and no memory. Answer from the conversation alone.\n';
+export function planHermesAppRunGatewayHome(profile, apiKey, appRun) {
+    if (!apiKey)
+        return null;
+    const missing = HERMES_ALL_TOOLSETS.filter((name) => !appRun.disabledToolsets.includes(name));
+    if (missing.length > 0) {
+        throw new Error(`Hermes app-run must disable every toolset; missing: ${missing.join(', ')}`);
+    }
+    const spawnEnv = { OPENROUTER_API_KEY: apiKey };
+    if (profile.baseUrl)
+        spawnEnv.OPENROUTER_BASE_URL = profile.baseUrl;
+    const lines = [
+        'model:',
+        `  default: ${yamlScalar(profile.model)}`,
+        '  provider: openrouter',
+        ...(profile.baseUrl ? [`  base_url: ${yamlScalar(profile.baseUrl)}`] : []),
+        'agent:',
+        `  max_turns: ${positiveInteger(appRun.maxTurns, 'maxTurns')}`,
+        `  run_budget_seconds: ${positiveInteger(appRun.runBudgetSeconds, 'runBudgetSeconds')}`,
+        '  disabled_toolsets:',
+        ...appRun.disabledToolsets.map((name) => `    - ${yamlScalar(name)}`),
+        'terminal:',
+        `  cwd: ${yamlScalar(join(appRun.homeDir, HERMES_APP_RUN_CWD_DIRNAME))}`,
+        'memory:',
+        '  memory_enabled: false',
+        '  user_profile_enabled: false',
+        ...PINNED_AUXILIARY_YAML,
+        'security:',
+        '  tirith_enabled: false',
+        '  allow_lazy_installs: false',
+        'updates:',
+        '  check: false',
+        'models_dev:',
+        '  url: "file:///dev/null"',
+        'logging:',
+        '  level: WARNING',
+    ];
+    return {
+        providerId: `profile:${profile.id}`,
+        configYaml: `${lines.join('\n')}\n`,
+        spawnEnv,
+        homeDir: appRun.homeDir,
+    };
+}
+function positiveInteger(value, field) {
+    if (!Number.isSafeInteger(value) || value <= 0) {
+        throw new Error(`Hermes app-run ${field} must be a positive integer`);
+    }
+    return value;
+}
+export function provisionHermesGatewayHome(plan) {
+    if (isAppRunPlan(plan))
+        return provisionAppRunGatewayHome(plan);
+    const home = mkdtempSync(join(tmpdir(), 'minionry-hermes-'));
+    writeFileSync(join(home, 'config.yaml'), plan.configYaml, 'utf8');
+    hlog(`[hermes] provisioned managed gateway home (provider=${plan.providerId}) at ${home}`);
+    return {
+        home,
+        env: { HERMES_HOME: home, ...plan.spawnEnv },
+        persistent: false,
+        cleanup() {
+            try {
+                rmSync(home, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 });
+            }
+            catch {
+            }
+        },
+    };
+}
+function isAppRunPlan(plan) {
+    return typeof plan.homeDir === 'string';
+}
+function refuseSymlink(path) {
+    let isLink = false;
+    try {
+        isLink = lstatSync(path).isSymbolicLink();
+    }
+    catch {
+        return;
+    }
+    if (isLink)
+        throw new Error(`Refusing to provision a Hermes app-run home through a symlink: ${path}`);
+}
+function provisionAppRunGatewayHome(plan) {
+    const home = plan.homeDir;
+    const cwd = join(home, HERMES_APP_RUN_CWD_DIRNAME);
+    for (const path of [home, cwd, join(home, 'config.yaml'), join(cwd, '.hermes.md')]) {
+        refuseSymlink(path);
+    }
+    for (const dir of [home, cwd]) {
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        chmodSync(dir, 0o700);
+    }
+    writeFileAtomic(join(home, 'config.yaml'), plan.configYaml, { mode: 0o600 });
+    writeFileAtomic(join(cwd, '.hermes.md'), HERMES_APP_RUN_CONTEXT_FILE, { mode: 0o600 });
+    hlog(`[hermes] provisioned app-run gateway home (provider=${plan.providerId}) at ${home}`);
+    return {
+        home,
+        env: { HERMES_HOME: home, ...plan.spawnEnv },
+        persistent: true,
+        cleanup() { },
+    };
+}