@minionry/minion 0.7.36

package/dist/server/engines/hermes/hermes-invoker.js

@@ -0,0 +1,350 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { hlog } from '../../cli/headless/headless-logger.js';
+function asRecord(value) {
+    return typeof value === 'object' && value !== null
+        ? value
+        : undefined;
+}
+function asString(value) {
+    return typeof value === 'string' ? value : undefined;
+}
+function asNumber(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
+}
+function asResultString(value) {
+    if (typeof value === 'string')
+        return value;
+    if (value === undefined || value === null)
+        return '';
+    const partsText = contentPartsText(value);
+    if (partsText !== undefined)
+        return partsText;
+    try {
+        return JSON.stringify(value);
+    }
+    catch {
+        return String(value);
+    }
+}
+function contentPartsText(value) {
+    if (!Array.isArray(value) || value.length === 0)
+        return undefined;
+    const texts = [];
+    for (const part of value) {
+        const text = asString(asRecord(part)?.text);
+        if (text === undefined)
+            return undefined;
+        texts.push(text);
+    }
+    return texts.join('');
+}
+function asTokenCount(value) {
+    const count = asNumber(value);
+    return count === undefined ? undefined : Math.max(0, count);
+}
+function parseToolArguments(value) {
+    const record = asRecord(value);
+    if (record)
+        return record;
+    const str = asString(value);
+    if (!str)
+        return {};
+    try {
+        return asRecord(JSON.parse(str)) ?? {};
+    }
+    catch {
+        return {};
+    }
+}
+export const HERMES_TRANSPORT_CAPABILITIES = {
+    transport: 'responses-sse',
+    reportsUsage: true,
+    usageGranularity: 'per-turn',
+    produces: {
+        'message.delta': true,
+        'message.thinking': true,
+        'tool.start': true,
+        'tool.end': true,
+        'usage.update': true,
+        'session.idle': true,
+        'engine.error': true,
+    },
+    declaredAbsent: {
+        'permission.request': true,
+        'question.request': true,
+        streamingToolInput: true,
+    },
+};
+export class HermesEventMapper {
+    sessionId;
+    now;
+    usage;
+    _lastResponseId;
+    pendingTools = new Map();
+    startedTools = new Set();
+    endedTools = new Set();
+    syntheticToolCounter = 0;
+    constructor(options) {
+        this.sessionId = options.sessionId;
+        this.now = options.now ?? Date.now;
+        this.usage = {
+            inputTokens: 0,
+            outputTokens: 0,
+            cacheCreationTokens: 0,
+            cacheReadTokens: 0,
+            lastUpdatedAt: this.now(),
+        };
+    }
+    get lastResponseId() {
+        return this._lastResponseId;
+    }
+    getUsage() {
+        return { ...this.usage };
+    }
+    ingestFrame(frame) {
+        const parsed = parseSseFrame(frame);
+        if (!parsed) {
+            if (carriesPayload(frame))
+                hlog(`[hermes] skipping malformed SSE frame: ${frame.slice(0, 120)}`);
+            return [];
+        }
+        const { type, data } = parsed;
+        switch (type) {
+            case 'response.created':
+                this.captureResponseId(data);
+                return [];
+            case 'response.output_text.delta':
+                return this.mapTextDelta(data);
+            case 'response.reasoning_text.delta':
+            case 'response.reasoning_summary_text.delta':
+                return this.mapThinkingDelta(data);
+            case 'response.output_item.added':
+            case 'response.output_item.done':
+                return this.mapOutputItem(asRecord(data.item));
+            case 'response.completed':
+            case 'response.incomplete':
+                return this.mapCompleted(data);
+            case 'response.failed':
+                return this.mapFailed(data);
+            case 'error':
+                return [this.errorEvent(data)];
+            case 'response.in_progress':
+            case 'response.output_text.done':
+            case 'response.content_part.added':
+            case 'response.content_part.done':
+                return [];
+            default:
+                hlog(`[hermes] dropping unmapped SSE event type: ${type ?? '(none)'}`);
+                return [];
+        }
+    }
+    stampSessionId() {
+        return this.sessionId;
+    }
+    captureResponseId(data) {
+        const id = asString(asRecord(data.response)?.id) ?? asString(data.id);
+        if (id)
+            this._lastResponseId = id;
+    }
+    mapTextDelta(data) {
+        const text = asString(data.delta) ?? asString(data.text);
+        if (!text)
+            return [];
+        return [
+            { kind: 'message.delta', sessionId: this.stampSessionId(), timestamp: this.now(), text },
+        ];
+    }
+    mapThinkingDelta(data) {
+        const text = asString(data.delta) ?? asString(data.text);
+        if (!text)
+            return [];
+        return [
+            { kind: 'message.thinking', sessionId: this.stampSessionId(), timestamp: this.now(), text },
+        ];
+    }
+    mapOutputItem(item) {
+        if (!item)
+            return [];
+        const itemType = asString(item.type);
+        if (itemType === 'function_call')
+            return this.startTool(item);
+        if (itemType === 'function_call_output')
+            return this.endTool(item);
+        return [];
+    }
+    startTool(item) {
+        const callId = asString(item.call_id) ?? asString(item.id) ?? `hermes-tool-${++this.syntheticToolCounter}`;
+        const toolName = asString(item.name) ?? 'function_call';
+        const input = parseToolArguments(item.arguments);
+        const startedAt = this.pendingTools.get(callId)?.startedAt ?? this.now();
+        this.pendingTools.set(callId, { toolName, input, startedAt });
+        if (this.startedTools.has(callId))
+            return [];
+        this.startedTools.add(callId);
+        return [
+            {
+                kind: 'tool.start',
+                sessionId: this.stampSessionId(),
+                timestamp: startedAt,
+                toolCallId: callId,
+                toolName,
+                input,
+            },
+        ];
+    }
+    endTool(item) {
+        const callId = asString(item.call_id) ?? asString(item.id) ?? `hermes-tool-${++this.syntheticToolCounter}`;
+        if (this.endedTools.has(callId))
+            return [];
+        this.endedTools.add(callId);
+        const pending = this.pendingTools.get(callId);
+        const toolName = pending?.toolName ?? asString(item.name) ?? 'function_call';
+        const input = pending?.input ?? {};
+        const timestamp = this.now();
+        const durationMs = Math.max(0, timestamp - (pending?.startedAt ?? timestamp));
+        const isError = item.error !== undefined || asString(item.status) === 'failed';
+        const events = [];
+        if (!this.startedTools.has(callId)) {
+            this.startedTools.add(callId);
+            events.push({
+                kind: 'tool.start',
+                sessionId: this.stampSessionId(),
+                timestamp,
+                toolCallId: callId,
+                toolName,
+                input,
+            });
+        }
+        events.push({
+            kind: 'tool.end',
+            sessionId: this.stampSessionId(),
+            timestamp,
+            toolCallId: callId,
+            toolName,
+            input,
+            result: asResultString(item.output ?? item.result ?? item.error),
+            isError,
+            durationMs,
+        });
+        this.pendingTools.delete(callId);
+        return events;
+    }
+    mapCompleted(data) {
+        const resp = asRecord(data.response) ?? data;
+        this.captureResponseId(data);
+        const events = this.mapUsage(resp, data);
+        const status = asString(resp.status);
+        const notice = status === 'incomplete' ? incompleteNotice(resp) : undefined;
+        events.push({
+            kind: 'session.idle',
+            sessionId: this.stampSessionId(),
+            timestamp: this.now(),
+            stopReason: status ?? 'end_turn',
+            ...(notice ? { notice } : {}),
+            raw: data,
+        });
+        return events;
+    }
+    mapFailed(data) {
+        const resp = asRecord(data.response) ?? data;
+        this.captureResponseId(data);
+        return [
+            ...this.mapUsage(resp, data),
+            this.errorEvent(data),
+            {
+                kind: 'session.idle',
+                sessionId: this.stampSessionId(),
+                timestamp: this.now(),
+                stopReason: 'error',
+                raw: data,
+            },
+        ];
+    }
+    errorEvent(data) {
+        const errObj = asRecord(data.error) ?? asRecord(asRecord(data.response)?.error);
+        return {
+            kind: 'engine.error',
+            sessionId: this.stampSessionId(),
+            timestamp: this.now(),
+            code: 'HERMES_STREAM_ERROR',
+            message: asString(errObj?.message) ?? asString(data.message) ?? 'Hermes reported an error',
+            fatal: false,
+            raw: data,
+        };
+    }
+    mapUsage(resp, data) {
+        if (!this.foldUsage(asRecord(resp.usage) ?? asRecord(data.usage)))
+            return [];
+        return [
+            {
+                kind: 'usage.update',
+                sessionId: this.stampSessionId(),
+                timestamp: this.now(),
+                inputTokens: this.usage.inputTokens,
+                outputTokens: this.usage.outputTokens,
+                cacheCreationTokens: this.usage.cacheCreationTokens,
+                cacheReadTokens: this.usage.cacheReadTokens,
+            },
+        ];
+    }
+    foldUsage(usage) {
+        if (!usage)
+            return false;
+        const input = asTokenCount(usage.input_tokens) ??
+            asTokenCount(usage.prompt_tokens) ??
+            asTokenCount(usage.inputTokens);
+        const output = asTokenCount(usage.output_tokens) ??
+            asTokenCount(usage.completion_tokens) ??
+            asTokenCount(usage.outputTokens);
+        const cacheRead = asTokenCount(usage.cached_input_tokens) ?? asTokenCount(usage.cacheReadTokens);
+        if (input === undefined && output === undefined && cacheRead === undefined) {
+            return false;
+        }
+        const cur = this.usage;
+        this.usage = {
+            inputTokens: cur.inputTokens + (input ?? 0),
+            outputTokens: cur.outputTokens + (output ?? 0),
+            cacheCreationTokens: cur.cacheCreationTokens,
+            cacheReadTokens: (cur.cacheReadTokens ?? 0) + (cacheRead ?? 0),
+            lastUpdatedAt: this.now(),
+        };
+        return true;
+    }
+}
+function carriesPayload(frame) {
+    return frame
+        .split('\n')
+        .some((line) => line.startsWith('data:') && line.slice('data:'.length).trim() !== '[DONE]');
+}
+function incompleteNotice(resp) {
+    const reason = asString(asRecord(resp.incomplete_details)?.reason);
+    return reason ? `The run stopped early: ${reason}.` : 'The run stopped early at a limit.';
+}
+export function parseSseFrame(frame) {
+    let eventType;
+    const dataLines = [];
+    for (const rawLine of frame.split('\n')) {
+        const line = rawLine.replace(/\r$/, '');
+        if (line.startsWith(':'))
+            continue;
+        if (line.startsWith('event:')) {
+            eventType = line.slice('event:'.length).trim();
+        }
+        else if (line.startsWith('data:')) {
+            dataLines.push(line.slice('data:'.length).replace(/^ /, ''));
+        }
+    }
+    const dataStr = dataLines.join('\n').trim();
+    if (!dataStr || dataStr === '[DONE]')
+        return undefined;
+    try {
+        const data = asRecord(JSON.parse(dataStr));
+        if (!data)
+            return undefined;
+        return { type: eventType ?? asString(data.type), data };
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/server/engines/hermes/hermes-provision.js

@@ -0,0 +1,318 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { spawn } from 'node:child_process';
+import { existsSync, mkdtempSync, rmSync } from 'node:fs';
+import { homedir, tmpdir } from 'node:os';
+import { delimiter, join } from 'node:path';
+import { getSettings } from '../../services/settings.js';
+import { HERMES_ALL_TOOLSETS, hermesAppRunBaseEnv } from './hermes-gateway-home.js';
+export const HERMES_INSTALL_URL = 'https://hermes-agent.nousresearch.com/install.sh';
+export const HERMES_INSTALL_COMMAND = `curl -fsSL ${HERMES_INSTALL_URL} | bash`;
+export const MINIMUM_HERMES_VERSION = '0.19.0';
+export const MINIMUM_HERMES_APP_RUN_VERSION = '0.20.5';
+const HERMES_EXE = process.platform === 'win32' ? 'hermes.exe' : 'hermes';
+function defaultResolveHermesBinary(pathExists, pathValue, home) {
+    const dirs = [];
+    for (const dir of pathValue.split(delimiter)) {
+        if (dir.trim().length > 0)
+            dirs.push(dir);
+    }
+    dirs.push(join(home, '.local', 'bin'));
+    dirs.push(join(home, '.hermes', 'bin'));
+    for (const dir of dirs) {
+        const candidate = join(dir, HERMES_EXE);
+        if (pathExists(candidate))
+            return candidate;
+    }
+    return null;
+}
+function defaultHasInstallConsent() {
+    if (process.env.HERMES_INSTALL_CONSENT === '1')
+        return true;
+    try {
+        const settings = getSettings();
+        return settings.hermesInstallConsent === true;
+    }
+    catch {
+        return false;
+    }
+}
+const defaultSpawn = (cmd, args, opts) => new Promise((resolveExit) => {
+    const child = spawn(cmd, args, {
+        cwd: opts.cwd,
+        stdio: ['ignore', 'pipe', 'pipe'],
+        env: opts.env ?? process.env,
+        windowsHide: true,
+    });
+    let tail = '';
+    const TAIL_CAP = 4_000;
+    const append = (chunk) => {
+        const text = chunk.toString('utf8');
+        tail = (tail + text).slice(-TAIL_CAP);
+        if (opts.onLine) {
+            for (const line of text.split('\n')) {
+                if (line.trim().length > 0)
+                    opts.onLine(line);
+            }
+        }
+    };
+    child.stdout?.on('data', append);
+    child.stderr?.on('data', append);
+    child.on('error', (err) => {
+        tail = `${tail}\nspawn error: ${err.message}`.slice(-TAIL_CAP);
+        resolveExit({ ok: false, code: null, tail });
+    });
+    child.on('exit', (code) => resolveExit({ ok: code === 0, code, tail }));
+});
+export function parseHermesVersion(output) {
+    const m = output.match(/(\d+)\.(\d+)\.(\d+)/);
+    return m ? `${m[1]}.${m[2]}.${m[3]}` : null;
+}
+export function isHermesVersionTooOld(version, minimum) {
+    const v = parseHermesVersion(version);
+    const min = parseHermesVersion(minimum);
+    if (!v || !min)
+        return false;
+    const [va, vb, vc] = v.split('.').map(Number);
+    const [ma, mb, mc] = min.split('.').map(Number);
+    if (va !== ma)
+        return va < ma;
+    if (vb !== mb)
+        return vb < mb;
+    return vc < mc;
+}
+export class HermesRuntimeProvisioner {
+    resolveHermesBinary;
+    pathExists;
+    probeVersion;
+    spawnFn;
+    hasInstallConsent;
+    env;
+    home;
+    constructor(deps = {}) {
+        this.env = deps.env ?? process.env;
+        this.home = deps.home ?? homedir();
+        this.pathExists = deps.pathExists ?? existsSync;
+        this.spawnFn = deps.spawn ?? defaultSpawn;
+        this.hasInstallConsent = deps.hasInstallConsent ?? defaultHasInstallConsent;
+        const pathValue = deps.pathValue ?? this.env.PATH ?? this.env.Path ?? '';
+        this.resolveHermesBinary =
+            deps.resolveHermesBinary ??
+                (() => defaultResolveHermesBinary(this.pathExists, pathValue, this.home));
+        this.probeVersion = deps.probeVersion ?? ((binary) => this.defaultProbeVersion(binary));
+    }
+    async defaultProbeVersion(binary) {
+        const r = await this.spawnFn(binary, ['--version'], { cwd: this.home, env: this.env });
+        if (!r.ok)
+            return null;
+        return parseHermesVersion(r.tail);
+    }
+    async detect() {
+        const binaryPath = this.resolveHermesBinary();
+        if (!binaryPath) {
+            return { provisioned: false, binaryPath: null, version: null, state: 'missing' };
+        }
+        const version = await this.probeVersion(binaryPath);
+        if (version && isHermesVersionTooOld(version, MINIMUM_HERMES_VERSION)) {
+            return { provisioned: false, binaryPath, version, state: 'too-old' };
+        }
+        return { provisioned: true, binaryPath, version, state: 'ok' };
+    }
+    async provision(onLine) {
+        const log = onLine ?? (() => { });
+        const before = await this.detect();
+        if (before.state === 'ok') {
+            return { ok: true, status: before, action: 'noop' };
+        }
+        if (!this.hasInstallConsent()) {
+            return { ok: false, status: before, action: 'offered', error: this.describeOffer(before) };
+        }
+        await this.runInstaller(log);
+        const after = await this.detect();
+        if (after.state === 'ok') {
+            return { ok: true, status: after, action: 'installed' };
+        }
+        return { ok: false, status: after, action: 'failed', error: this.describeFailure(after) };
+    }
+    async runInstaller(log) {
+        log(`Installing Hermes via the official installer: ${HERMES_INSTALL_COMMAND}`);
+        const r = await this.spawnFn('bash', ['-c', HERMES_INSTALL_COMMAND], {
+            cwd: this.home,
+            onLine: log,
+            env: this.env,
+        });
+        if (!r.ok) {
+            log(`Hermes installer exited with code ${r.code ?? 'null'}.`);
+        }
+        return r;
+    }
+    describeOffer(status) {
+        if (status.state === 'too-old') {
+            return (`Hermes ${status.version ?? '(unknown)'} is installed but Minionry requires ` +
+                `v${MINIMUM_HERMES_VERSION} or newer. Update it with the official installer:\n  ` +
+                `${HERMES_INSTALL_COMMAND}`);
+        }
+        return (`Hermes is not installed. Install it with the official installer:\n  ` +
+            `${HERMES_INSTALL_COMMAND}\n` +
+            `Then retry, or set HERMES_COMMAND to an existing hermes binary.`);
+    }
+    describeFailure(status) {
+        if (status.state === 'too-old') {
+            return (`Hermes is still on ${status.version ?? '(unknown)'} after running the installer ` +
+                `(requires v${MINIMUM_HERMES_VERSION}+). Update it manually:\n  ${HERMES_INSTALL_COMMAND}`);
+        }
+        return (`The Hermes installer ran but no usable \`hermes\` binary could be found afterward. ` +
+            `Install it manually:\n  ${HERMES_INSTALL_COMMAND}\n` +
+            `Then set HERMES_COMMAND if it is not on PATH.`);
+    }
+}
+let inFlight = null;
+let lastFailureAt = 0;
+let lastFailureResult = null;
+export const PROVISION_FAILURE_COOLDOWN_MS = 60_000;
+export function ensureHermesProvisioned(onLine, deps) {
+    if (inFlight)
+        return inFlight;
+    if (lastFailureResult && now() - lastFailureAt < PROVISION_FAILURE_COOLDOWN_MS) {
+        return Promise.resolve(lastFailureResult);
+    }
+    const run = new HermesRuntimeProvisioner(deps)
+        .provision(onLine)
+        .then((result) => {
+        if (result.action === 'failed') {
+            lastFailureResult = result;
+            lastFailureAt = now();
+        }
+        else {
+            lastFailureResult = null;
+        }
+        return result;
+    })
+        .finally(() => {
+        inFlight = null;
+    });
+    inFlight = run;
+    return run;
+}
+export async function resolveHermesCommand(onLine, deps) {
+    const override = process.env.HERMES_COMMAND;
+    if (override && override.trim().length > 0) {
+        return override;
+    }
+    const result = await ensureHermesProvisioned(onLine, deps);
+    if (result.ok && result.status.binaryPath) {
+        return result.status.binaryPath;
+    }
+    throw new Error(result.error ??
+        `Hermes is not installed and could not be provisioned. Install it with:\n  ` +
+            `${HERMES_INSTALL_COMMAND}\nThen set HERMES_COMMAND if it is not on PATH.`);
+}
+export function isHermesProvisioning() {
+    return inFlight !== null;
+}
+export const HERMES_AVAILABILITY_TTL_MS = 60_000;
+let availabilityCache = null;
+export function parseHermesToolsetNames(output) {
+    const names = [];
+    for (const line of output.split('\n')) {
+        const match = line.match(/^\s*\S+\s+(?:enabled|disabled)\s+(\S+)/);
+        if (match)
+            names.push(match[1]);
+    }
+    return names;
+}
+async function defaultListToolsets(binary, spawnFn, env) {
+    let home;
+    try {
+        home = mkdtempSync(join(tmpdir(), 'minionry-hermes-tools-'));
+    }
+    catch {
+        return null;
+    }
+    try {
+        const lines = [];
+        const result = await spawnFn(binary, ['tools', 'list', '--platform', 'api_server'], {
+            cwd: home,
+            env: { ...hermesAppRunBaseEnv(env), HERMES_HOME: home },
+            onLine: (line) => lines.push(line),
+        });
+        if (!result.ok)
+            return null;
+        return parseHermesToolsetNames(lines.join('\n'));
+    }
+    finally {
+        rmSync(home, { recursive: true, force: true });
+    }
+}
+async function computeHermesAvailability(deps) {
+    const env = deps.env ?? process.env;
+    const override = env.HERMES_COMMAND?.trim();
+    const provisioner = new HermesRuntimeProvisioner({
+        ...deps,
+        ...(override ? { resolveHermesBinary: () => override } : {}),
+    });
+    const detected = await provisioner.detect();
+    const base = { binaryPath: detected.binaryPath, version: detected.version, unknownToolsets: [] };
+    if (!detected.binaryPath) {
+        return {
+            ...base,
+            available: false,
+            state: 'missing',
+            reason: `Hermes is not installed. Install it with the official installer:\n  ${HERMES_INSTALL_COMMAND}`,
+        };
+    }
+    if (!detected.version || isHermesVersionTooOld(detected.version, MINIMUM_HERMES_APP_RUN_VERSION)) {
+        return {
+            ...base,
+            available: false,
+            state: 'too-old',
+            reason: `Hermes ${detected.version ?? '(unknown version)'} cannot run app sessions; ` +
+                `v${MINIMUM_HERMES_APP_RUN_VERSION} or newer is required. Update it with:\n  ${HERMES_INSTALL_COMMAND}`,
+        };
+    }
+    const spawnFn = deps.spawn ?? defaultSpawn;
+    const listed = await (deps.listToolsets ?? ((binary) => defaultListToolsets(binary, spawnFn, env)))(detected.binaryPath);
+    if (!listed || listed.length === 0) {
+        return {
+            ...base,
+            available: false,
+            state: 'unknown-toolsets',
+            reason: 'Hermes did not list its toolsets, so an app session cannot be confirmed tool-free.',
+        };
+    }
+    const known = new Set(HERMES_ALL_TOOLSETS);
+    const unknownToolsets = [...new Set(listed.filter((name) => !known.has(name)))];
+    if (unknownToolsets.length > 0) {
+        return {
+            ...base,
+            unknownToolsets,
+            available: false,
+            state: 'unknown-toolsets',
+            reason: `Hermes lists toolsets an app session cannot disable yet: ${unknownToolsets.join(', ')}.`,
+        };
+    }
+    return { ...base, available: true, state: 'ok' };
+}
+export function hermesAvailability(deps = {}) {
+    const at = now();
+    if (availabilityCache && at - availabilityCache.at < HERMES_AVAILABILITY_TTL_MS) {
+        return availabilityCache.result;
+    }
+    const result = computeHermesAvailability(deps);
+    const entry = { at, result };
+    availabilityCache = entry;
+    result.catch(() => {
+        if (availabilityCache === entry)
+            availabilityCache = null;
+    });
+    return result;
+}
+function now() {
+    return Date.now();
+}
+export function resetHermesProvisionStateForTests() {
+    inFlight = null;
+    lastFailureAt = 0;
+    lastFailureResult = null;
+    availabilityCache = null;
+}

package/dist/server/engines/read-only.js

@@ -0,0 +1,20 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { WORKSPACE_WRITE_TOOLS } from '../services/sdk/run-profile.js';
+export function sessionIsReadOnly(options) {
+    const disallowed = options.disallowedTools ?? [];
+    return WORKSPACE_WRITE_TOOLS.some((tool) => disallowed.includes(tool));
+}
+export function readOnlyDisallowedTools() {
+    return [...WORKSPACE_WRITE_TOOLS];
+}
+export const READ_ONLY_UNSUPPORTED = 'READ_ONLY_UNSUPPORTED';
+export const HERMES_READ_ONLY_REFUSAL = 'Hermes cannot run a read-only session: its file tools can always write. Choose Claude Code or Codex for this.';
+const READ_ONLY_REFUSALS = {
+    'claude-code': null,
+    codex: null,
+    hermes: HERMES_READ_ONLY_REFUSAL,
+};
+export function readOnlyRefusal(engineId) {
+    return READ_ONLY_REFUSALS[engineId] ?? null;
+}