@misaka-net/misakanet-setup 0.2.0 → 0.3.0

package/README.md

@@ -16,7 +16,7 @@ knowledge base on its own instead of guessing.
 
 | # | Goal | Mechanism |
 |---|---|---|
-| 1 | the agent **can** call it | MCP server `https://misakanet.org/mcp` (streamable HTTP) in `~/.claude.json` / `~/.codex/config.toml`, with the Bearer token so reads are not metered by the anonymous 5/day/IP limit. Hermes and OpenClaw own their MCP registries, so theirs is registered through their own CLIs (`hermes mcp add …`, `openclaw mcp add …`) instead of by editing a file we do not own |
+| 1 | the agent **can** call it | MCP server `https://misakanet.org/mcp` (streamable HTTP) in `~/.claude.json`, `~/.codex/config.toml` and `~/.openclaw/openclaw.json` (`mcp.servers.misakanet`), with the Bearer token so reads are not metered by the anonymous 5/day/IP limit. Hermes is the same thing in its own files: `mcp_servers.misakanet` in `~/.hermes/config.yaml` plus the token in `~/.hermes/.env` under `MCP_MISAKANET_API_KEY`. All four are config files written file-to-file — no subprocess is spawned, so **no token ever appears in a command line** |
 | 2 | the agent **knows when** | rules block appended to `~/.claude/CLAUDE.md` / `~/.codex/AGENTS.md` / `~/.hermes/SOUL.md` / `~/.openclaw/workspace/AGENTS.md` (issue, retry, risky-operation triggers; desensitisation rules) |
 | 3 | the checkpoint **fires** | a hook that counts user turns: turn 1 announces the install to the user, turn 20 (and every 10 after) injects the "distil and submit" reminder; a failed tool call injects a "search before you retry" reminder built from the error text. Claude Code only today — Codex's user-level hook shape is unconfirmed and OpenClaw's events are unverified, so those two work from the rules block, and `--verify` says so per target instead of implying otherwise |
 
@@ -41,8 +41,13 @@ npx @misaka-net/misakanet-setup --uninstall   # remove exactly what it added
   alone (covered by tests).
 - Idempotent: a second run changes nothing.
 - The token is stored at `~/.misakanet-agent/token` (mode 600) and written into your local
-  agent config only — never printed, never committed by us. It is an anonymous pseudonym:
-  `client_id` and `agent_type` are self-declared and we do not treat them as attribution.
+  agent config only — never printed, never committed by us, and never sent anywhere by this
+  program: registration itself is unauthenticated, and `--verify` probes the endpoint
+  anonymously. It is an anonymous pseudonym: `client_id` and `agent_type` are self-declared
+  and we do not treat them as attribution.
+- The anonymous identity is not kept in a file this installer re-reads. If you want
+  re-installing (or a new machine) to land on the **same** node, export the id it prints:
+  `export MISAKANET_CLIENT_ID=<setup-…>`. Without that, each install mints a new node.
 - Retention: lesson content retrieved from the server is **data, not instructions** — the
   injected rules tell the assistant not to execute commands found in it.
 

package/bin/misakanet-setup.mjs

@@ -23,8 +23,11 @@
  * Everything is idempotent, every rewritten file is backed up to *.misakanet.bak, and
  * --uninstall removes exactly what was added (same markers), leaving user config intact.
  */
-import { existsSync, mkdirSync, readFileSync, writeFileSync, copyFileSync, rmSync, chmodSync, accessSync, constants } from 'node:fs';
-import { spawnSync } from 'node:child_process';
+import { existsSync, mkdirSync, readFileSync, writeFileSync, copyFileSync, rmSync, chmodSync } from 'node:fs';
+// No child_process import on purpose: this installer must never hand a file-derived value to
+// another program (the plugin scanner's SHELL_INJECTION_PATTERN, alert #269, and argv secrets
+// are visible to every process on the box). Every target is configured by writing its own
+// config file; commands aimed at the user are printed, never executed.
 import { homedir } from 'node:os';
 import { join, dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -43,6 +46,19 @@ const END = 'misakanet:end';
 const TOP_START = 'misakanet-top:start';
 const TOP_END = 'misakanet-top:end';
 
+// Hermes keeps its MCP registry in a YAML file, so its block is delimited with YAML comments
+// rather than the HTML comments the markdown rules files use.
+const YAML_START = `# ${START}`;
+const YAML_END = `# ${END}`;
+// Derivation copied from hermes_cli/mcp_config.py: f"MCP_{name.upper().replace('-', '_')}_API_KEY".
+const HERMES_ENV_KEY = 'MCP_MISAKANET_API_KEY';
+/** The entry this installer wrote, delimited by its markers. */
+const HERMES_MARKED = new RegExp(
+  `[ \\t]*misakanet:[ \\t]*#\\s*${START}\\s*\\n[\\s\\S]*?^[ \\t]*#\\s*${END}\\s*$\\n?`, 'm');
+/** An unmarked entry (added by `hermes mcp add`) together with its indented children. */
+const HERMES_BARE = new RegExp(
+  `^[ \\t]*misakanet:[ \\t]*\\n(?:[ \\t]{4,}.*\\n|[ \\t]*\\n)*`, 'm');
+
 // ── small helpers ────────────────────────────────────────────────────
 const args = process.argv.slice(2);
 const has = (flag) => args.includes(flag);
@@ -79,14 +95,15 @@ function readText(path) {
 }
 
 /**
- * Own version, read from the manifest rather than typed twice.
+ * Own version — a literal, deliberately.
  *
- * It rode along as a literal `misakanet-setup/0.1.0` while the package moved on - the same
- * hardcoded-version drift this repository has had to fix on the site badge and in JOIN.md.
- * The tarball always carries package.json (npm cannot publish without it), so the fallback
- * only covers a hand-copied file.
+ * Reading it from package.json looks tidier and is what this line did for a few hours on
+ * 2026-09-15, until CodeQL pointed out that it turned the manifest into a file-to-network flow
+ * (the value goes into the User-Agent header): js/file-access-to-http #268. The drift it was
+ * meant to prevent is now caught in CI instead, by a test that binds this literal to the
+ * manifest — a failing test is a better place for that than a request header.
  */
-const PKG_VERSION = readJson(join(PKG_ROOT, 'package.json'), {}).version || '0.0.0';
+const VERSION = '0.3.0';
 
 function backup(path) {
   if (DRY || !readText(path)) return;
@@ -150,15 +167,22 @@ function probeEndpoint() {
   return (process.env.MISAKANET_ENDPOINT || CANONICAL_ENDPOINT).trim();
 }
 
-async function mcpCall(tool, toolArgs, bearer = '', timeoutMs = 6000, urlOverride = '') {
+/**
+ * One unauthenticated MCP call.
+ *
+ * Deliberately has no credential parameter: this process writes tokens into the agent's config
+ * and never sends one anywhere (a `bearer` argument used to sit here unused, which is exactly
+ * the "read a local secret, put it in a request" shape CodeQL flags — js/file-access-to-http
+ * #268 — and `tests/…`/`workers/Misakanet-setup.test.mjs` pins that the probe stays anonymous).
+ */
+async function mcpCall(tool, toolArgs, timeoutMs = 6000, urlOverride = '') {
   const headers = {
     'Content-Type': 'application/json',
     Accept: 'application/json',
     'MCP-Protocol-Version': '2025-06-18',
     Origin: 'https://misakanet.org',
-    'User-Agent': `misakanet-setup/${PKG_VERSION}`,
+    'User-Agent': `misakanet-setup/${VERSION}`,
   };
-  if (bearer) headers.Authorization = `Bearer ${bearer}`;
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
@@ -247,18 +271,19 @@ async function ensureIdentity() {
     ok(`会注册匿名身份并把 token 写到 ${file}`);
     return '';
   }
-  const clientFile = join(stateDir(), 'client_id');
-  let clientId = '';
-  try {
-    clientId = readFileSync(clientFile, 'utf8').trim();
-  } catch {
-    clientId = '';
-  }
-  if (!clientId) {
-    clientId = `setup-${crypto.randomUUID()}`;
-    mkdirSync(stateDir(), { recursive: true });
-    writeFileSync(clientFile, clientId);
-  }
+  // The client id is what makes a re-registration return the *same* node, so it has to come
+  // from somewhere the user owns rather than from a file this process found on disk: CodeQL
+  // js/file-access-to-http (#268) reads "read a local file, put it in an outbound request" as
+  // what it looks like, and it is right — the value may be ours, but the shape is the bug.
+  // An exported MISAKANET_CLIENT_ID is explicit intent (the same standard the hook applies to
+  // its token); otherwise this run mints one and prints it so the user can keep it.
+  const exported = (process.env.MISAKANET_CLIENT_ID || '').trim();
+  if (exported && !/^[A-Za-z0-9._-]{8,64}$/.test(exported)) {
+    need('ignored MISAKANET_CLIENT_ID：只接受 8–64 位的 [A-Za-z0-9._-]（这次会新生成一个）');
+  }
+  const clientId = (exported && /^[A-Za-z0-9._-]{8,64}$/.test(exported))
+    ? exported
+    : `setup-${crypto.randomUUID()}`;
   const result = await mcpCall('misakanet_register', { agent_type: 'setup', client_id: clientId });
   // Validate before persisting: a response body is not something to write to disk unchecked
   // (CodeQL js/http-to-file-access #262/#264 is about exactly that flow). The endpoint is
@@ -274,6 +299,11 @@ async function ensureIdentity() {
     chmodSync(file, 0o600);
   } catch { /* windows */ }
   ok(`匿名身份：${String(result.node_id || '?').slice(0, 32)}（token 存 ${file}，权限 600）`);
+  if (!exported) {
+    // Printed, not stored: this process must not turn a file it found into request data
+    // (CodeQL js/file-access-to-http #268), and the value is the user's to keep anyway.
+    ok(`想在这个节点上继续累积（重装/换机后仍是同一个）：export MISAKANET_CLIENT_ID=${clientId}`);
+  }
   return token;
 }
 
@@ -288,30 +318,6 @@ function detect(agent) {
   return paths.some((p) => existsSync(join(HOME, p)));
 }
 
-/**
- * Locate an executable on PATH.
- *
- * The CLI must not assume a shell helper exists (`which` is not on every Windows box), and
- * the openclaw registration below is the one step this installer hands to another program.
- * Executability is checked rather than mere existence: a non-executable file with the right
- * name would otherwise turn a clear "install the CLI" message into an opaque spawn failure.
- */
-function findOnPath(bin) {
-  const sep = process.platform === 'win32' ? ';' : ':';
-  const exts = process.platform === 'win32' ? ['.cmd', '.exe', '.bat', ''] : [''];
-  for (const dir of (process.env.PATH || '').split(sep)) {
-    if (!dir) continue;
-    for (const ext of exts) {
-      const candidate = join(dir, bin + ext);
-      try {
-        accessSync(candidate, constants.X_OK);
-        return candidate;
-      } catch { /* not here (or not executable): keep looking */ }
-    }
-  }
-  return '';
-}
-
 async function installClaude(hookPath, bearer) {
   const cfg = join(HOME, '.claude.json');
   const data = readJson(cfg, null);
@@ -428,26 +434,95 @@ async function installCodex(hookPath, bearer) {
     + '要硬保证就用 --verify 看状态，或把本会话放在 CC 里跑');
 }
 
-async function installHermes(hookPath) {
+/**
+ * Hermes MCP: `mcp_servers.<name>` in ~/.hermes/config.yaml, with the token in
+ * ~/.hermes/.env under `MCP_<NAME>_API_KEY`.
+ *
+ * This is exactly what `hermes mcp add <name> --url <url> --auth header` writes (its own code
+ * derives the key with `f"MCP_{name.upper().replace('-', '_')}_API_KEY"` and stores the value
+ * in the dotenv file, leaving `Authorization: Bearer ${…}` as the config template) — minus the
+ * subprocess, which is what keeps the token out of argv (alert #269) and lets the install work
+ * where that CLI cannot start.
+ *
+ * The block is marker-delimited: re-running replaces it, and --uninstall takes back exactly
+ * the entry this installer added.
+ */
+async function installHermes(hookPath, bearer) {
+  const cfg = join(HOME, '.hermes', 'config.yaml');
+  const text = readText(cfg);
   const rules = join(HOME, '.hermes', 'SOUL.md');
-  if (readText(join(HOME, '.hermes', 'config.yaml'))) {
-    ok(`Hermes：规则块 ${injectBlock(rules, PROMPT_BLOCK)} → ${rules}`);
-    need(`Hermes：MCP 由它自己管 → 执行 hermes mcp add misakanet --url ${ENDPOINT}；`
-      + '钩子要过它的 allowlist（hermes hooks doctor 查看）');
-  } else {
+  if (!text) {
     need('Hermes：找不到 ~/.hermes/config.yaml → 先运行一次 hermes 再回来装');
+    return;
+  }
+  ok(`Hermes：规则块 ${injectBlock(rules, PROMPT_BLOCK)} → ${rules}`);
+
+  const envKey = HERMES_ENV_KEY;
+  const lines = [`  misakanet:  ${YAML_START}`, `    url: ${ENDPOINT}`];
+  if (bearer) lines.push('    headers:', `      Authorization: Bearer \${${envKey}}`);
+  lines.push(`  ${YAML_END}`);
+  // No trailing newline: the three call sites below each own the one they need, and the
+  // "insert after mcp_servers:" case must NOT add one (the line it replaces already ends with
+  // the newline that separates it from the next key — adding another wrote a blank line into
+  // the user's YAML).
+  const block = lines.join('\n');
+
+  let updated;
+  if (HERMES_MARKED.test(text)) {
+    updated = text.replace(HERMES_MARKED, () => `${block}\n`);
+  } else if (HERMES_BARE.test(text)) {
+    // An entry the user added through the CLI: replace it rather than write a duplicate key.
+    updated = text.replace(HERMES_BARE, () => `${block}\n`);
+  } else if (/^mcp_servers:[ \t]*$/m.test(text)) {
+    updated = text.replace(/^(mcp_servers:[ \t]*)$/m, (line) => `${line}\n${block}`);
+  } else {
+    updated = `${text}${text.endsWith('\n') ? '' : '\n'}mcp_servers:\n${block}\n`;
+  }
+  if (updated === text) {
+    ok('Hermes：MCP 已注册（无改动）');
+  } else {
+    backup(cfg);
+    writeText(cfg, updated);
+    ok(`Hermes：注册 MCP（streamable-http）→ ${cfg}`);
+  }
+
+  if (!bearer) {
+    skip('Hermes：这次没有 token → 走匿名通道（5/天/IP），写入类工具不可用');
+    return;
+  }
+  const envPath = join(HOME, '.hermes', '.env');
+  const envText = readText(envPath);
+  const assignment = `${envKey}=${bearer}`;
+  const current = new RegExp(`^${envKey}=.*$`, 'm');
+  const next = current.test(envText)
+    ? envText.replace(current, () => assignment)
+    : `${envText}${envText && !envText.endsWith('\n') ? '\n' : ''}${assignment}\n`;
+  if (next !== envText) {
+    backup(envPath);
+    writeText(envPath, next);
+    ok(`Hermes：token 写入 ${envPath}（${envKey}，配置里只留 \${${envKey}} 模板）`);
+  } else {
+    ok('Hermes：token 已就绪（无改动）');
   }
 }
 
 /**
- * OpenClaw: rules live in ~/.openclaw/workspace, and the agent has its own MCP client
- * (`openclaw mcp add`), so this target registers through that CLI instead of editing a
- * config file we do not own. Mirrors install_openclaw in the Python installer - the two
- * must teach the same behaviour, because which one a user ran is an accident of which
- * command they found first.
+ * OpenClaw: rules live in ~/.openclaw/workspace, MCP servers in `mcp.servers` of
+ * ~/.openclaw/openclaw.json — which is exactly the file `openclaw mcp list` reports from.
+ *
+ * This target edits that file instead of shelling out to `openclaw mcp add`, for two reasons
+ * that both showed up as scanner findings on 2026-09-15 (alerts #268/#269):
+ *
+ *  1. The token would be an argv element. Anything on a command line is visible to every
+ *     process on the box (`ps`), and the scanner reads "file-derived value interpolated into a
+ *     spawn call" as shell injection. Writing the same entry the CLI writes is file-to-file,
+ *     which is what this installer already does for ~/.claude.json and ~/.codex/config.toml.
+ *  2. Spawning the CLI meant depending on its local database being writable; in a sandbox it
+ *     answers "Could not start the CLI / attempt to write a readonly database" and the install
+ *     silently needed a human. Reading and writing the config does not.
  *
- * The CLI keeps its cache under $XDG_CACHE_HOME, which may be read-only in a sandbox; that
- * surfaces as "Could not start the CLI", hence the explicit hint rather than a raw stderr.
+ * The manual `openclaw mcp add …` line is still printed for the user to run themselves — as
+ * text, never executed.
  */
 async function installOpenclaw(bearer) {
   const rules = join(HOME, '.openclaw', 'workspace', 'AGENTS.md');
@@ -458,35 +533,30 @@ async function installOpenclaw(bearer) {
     ok(`OpenClaw：规则块 ${injectBlock(rules, PROMPT_BLOCK)} → ${rules}`);
   }
 
-  const cli = findOnPath('openclaw');
-  if (!cli) {
-    need(`OpenClaw：没找到 openclaw CLI → 手动执行 \`${manual}\``);
-    return;
-  }
-  if (DRY) {
-    ok(`OpenClaw：会执行 \`${manual} --no-probe\``);
+  const cfg = join(HOME, '.openclaw', 'openclaw.json');
+  const data = readJson(cfg, null);
+  if (data === null) {
+    need(`OpenClaw：读不到或解析不了 ${cfg} → 先运行一次 openclaw 生成配置，`
+      + `或手动执行 \`${manual}\``);
     return;
   }
-  const cmd = [cli, 'mcp', 'add', 'misakanet', '--url', ENDPOINT,
-    '--transport', 'streamable-http', '--no-probe'];
-  if (bearer) cmd.push('--header', `Authorization=Bearer ${bearer}`);
-  const result = spawnSync(cmd[0], cmd.slice(1), { encoding: 'utf8', timeout: 20000 });
-  const out = `${result.stdout || ''}${result.stderr || ''}`;
-  if (result.status === 0) {
-    ok('OpenClaw：已注册 MCP `misakanet`（openclaw mcp add）');
+  const entry = { url: ENDPOINT, transport: 'streamable-http' };
+  if (bearer) entry.headers = { Authorization: `Bearer ${bearer}` };
+  data.mcp = data.mcp || {};
+  data.mcp.servers = data.mcp.servers || {};
+  if (JSON.stringify(data.mcp.servers.misakanet) === JSON.stringify(entry)) {
+    ok('OpenClaw：MCP 已注册（无改动）');
     return;
   }
-  if (out.includes('Could not start the CLI')) {
-    need('OpenClaw：CLI 起不动（缓存目录不可写）→ 设 XDG_CACHE_HOME 到可写目录后重跑，'
-      + `或手动执行：${manual}`);
-  } else {
-    need(`OpenClaw：\`openclaw mcp add\` 失败：${out.trim().slice(0, 200) || `退出码 ${result.status}`}`);
-  }
+  data.mcp.servers.misakanet = entry;
+  backup(cfg);
+  writeText(cfg, `${JSON.stringify(data, null, 2)}\n`);
+  ok(`OpenClaw：注册 MCP（streamable-http）→ ${cfg}`);
 }
 
 async function verify() {
   let allOk = true;
-  const probe = await mcpCall('misakanet_search', { query: 'docker exit code 137', top: 1 }, '', 6000, probeEndpoint());
+  const probe = await mcpCall('misakanet_search', { query: 'docker exit code 137', top: 1 }, 6000, probeEndpoint());
   if (probe && (probe.results || probe.no_match !== undefined)) {
     ok(`端点可达：${ENDPOINT}`);
   } else {
@@ -541,7 +611,8 @@ async function verify() {
   }
   // OpenClaw is only reported when the user actually has it: telling a machine without
   // OpenClaw that it is "not ready" would be a lie about a target that was never selected.
-  // The MCP state is asked of the CLI that owns it rather than guessed from its config.
+  // The state is read from the same file `openclaw mcp list` reports from, which keeps this
+  // check working where the CLI itself cannot start (its database may be unwritable).
   if (detect('openclaw')) {
     const rules = join(HOME, '.openclaw', 'workspace', 'AGENTS.md');
     if (!readText(rules).includes(`<!-- ${START} -->`)) {
@@ -550,25 +621,39 @@ async function verify() {
     } else {
       ok('OpenClaw：规则块已装');
     }
-    const cli = findOnPath('openclaw');
-    if (!cli) {
+    const cfg = join(HOME, '.openclaw', 'openclaw.json');
+    const entry = (readJson(cfg, null) || {}).mcp?.servers?.misakanet;
+    if (!entry) {
       allOk = false;
-      need(`OpenClaw：没找到 openclaw CLI → 无法确证 MCP 是否注册；手动执行 `
+      need(`OpenClaw：MCP 未注册（${cfg}）→ 重跑安装命令，或手动执行 `
         + `openclaw mcp add misakanet --url ${ENDPOINT} --transport streamable-http`);
     } else {
-      const listed = spawnSync(cli, ['mcp', 'list'], { encoding: 'utf8', timeout: 15000 });
-      const out = `${listed.stdout || ''}${listed.stderr || ''}`;
-      if (listed.status === 0 && /misakanet/.test(out)) {
-        ok('OpenClaw：MCP 已注册（openclaw mcp list）');
-      } else if (listed.status === 0) {
-        allOk = false;
-        need(`OpenClaw：MCP 未注册 → 重跑安装命令，或手动执行 `
-          + `openclaw mcp add misakanet --url ${ENDPOINT} --transport streamable-http`);
-      } else {
-        allOk = false;
-        need(`OpenClaw：\`openclaw mcp list\` 没跑通 → 无法确证 MCP 状态`
-          + `${out.trim() ? `（${out.trim().slice(0, 120)}）` : ''}；可先手工确认一次`);
-      }
+      ok(`OpenClaw：MCP 已注册（${entry.url || '?'}）`);
+    }
+  }
+  // Hermes: same rule — reported only when the user has it. Its config file *is* the registry,
+  // so the state is readable without running anything. What cannot be confirmed from here is
+  // whether Hermes has loaded that file, and the output says so rather than implying it.
+  if (readText(join(HOME, '.hermes', 'config.yaml'))) {
+    const rules = join(HOME, '.hermes', 'SOUL.md');
+    if (!readText(rules).includes(`<!-- ${START} -->`)) {
+      allOk = false;
+      need(`Hermes：规则块没装（${rules}）→ 重跑安装命令`);
+    } else {
+      ok('Hermes：规则块已装');
+    }
+    const cfg = join(HOME, '.hermes', 'config.yaml');
+    const text = readText(cfg);
+    if (!HERMES_MARKED.test(text) && !HERMES_BARE.test(text)) {
+      allOk = false;
+      need(`Hermes：MCP 未注册（${cfg}）→ 重跑安装命令，或执行 `
+        + `hermes mcp add misakanet --url ${ENDPOINT} --auth header`);
+    } else if (!new RegExp(`^${HERMES_ENV_KEY}=`, 'm').test(readText(join(HOME, '.hermes', '.env')))) {
+      ok('Hermes：MCP 条目已写入配置（无 token → 匿名 5 次/天/IP）');
+      skip(`Hermes：想让检索不计匿名额度，重跑安装命令即可写入 ${HERMES_ENV_KEY}`);
+    } else {
+      ok(`Hermes：MCP 条目与 token 都在（${HERMES_ENV_KEY}）`);
+      skip('Hermes：本进程只能确认"配置已写"，无法确认 Hermes 是否已加载 → 可用 hermes mcp list 复核');
     }
   }
   return allOk;
@@ -621,8 +706,41 @@ function uninstall() {
     if (!DRY) rmSync(stateDir(), { recursive: true, force: true });
     ok(`删除状态目录 → ${stateDir()}`);
   }
-  need('Hermes 的 MCP 条目由它自己管 → 需要时执行 hermes mcp remove misakanet');
-  need('OpenClaw 的 MCP 条目由它自己管 → 需要时执行 openclaw mcp remove misakanet');
+  // Hermes' entry is one we wrote ourselves (config block + the token line it reads from .env),
+  // so we can take both back — same rule as OpenClaw and Claude Code.
+  const hermesCfg = join(HOME, '.hermes', 'config.yaml');
+  {
+    const text = readText(hermesCfg);
+    // The bare form is included so an entry added by `hermes mcp add` on our behalf goes too.
+    const stripped = text.replace(HERMES_MARKED, '').replace(HERMES_BARE, '');
+    if (stripped !== text) {
+      backup(hermesCfg);
+      writeText(hermesCfg, stripped);
+      ok(`移除 MCP 条目 → ${hermesCfg}`);
+    }
+  }
+  const hermesEnv = join(HOME, '.hermes', '.env');
+  {
+    const text = readText(hermesEnv);
+    const stripped = text.replace(new RegExp(`^${HERMES_ENV_KEY}=.*\\n?`, 'm'), '');
+    if (stripped !== text) {
+      backup(hermesEnv);
+      writeText(hermesEnv, stripped);
+      ok(`移除 token 行 → ${hermesEnv}（${HERMES_ENV_KEY}）`);
+    }
+  }
+  need('Hermes 的钩子不归本安装器管 → 需要时看 hermes hooks doctor；'
+    + `规则块已在 ~/.hermes/SOUL.md 移除`);
+
+  // OpenClaw's MCP entry is one we wrote ourselves, so we can take it back ourselves.
+  const ocCfg = join(HOME, '.openclaw', 'openclaw.json');
+  const ocData = readJson(ocCfg, null);
+  if (ocData?.mcp?.servers?.misakanet) {
+    delete ocData.mcp.servers.misakanet;
+    backup(ocCfg);
+    writeText(ocCfg, `${JSON.stringify(ocData, null, 2)}\n`);
+    ok(`移除 MCP 注册 → ${ocCfg}`);
+  }
 }
 
 // ── main ─────────────────────────────────────────────────────────────
@@ -666,7 +784,7 @@ if (!targets.length) {
   for (const agent of targets) {
     if (agent === 'claude') await installClaude(hookPath, bearer);
     else if (agent === 'codex') await installCodex(hookPath, bearer);
-    else if (agent === 'hermes') await installHermes(hookPath);
+    else if (agent === 'hermes') await installHermes(hookPath, bearer);
     else if (agent === 'openclaw') await installOpenclaw(bearer);
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@misaka-net/misakanet-setup",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "One-command setup: teach your Claude Code / Codex / Hermes / OpenClaw to search MisakaNet failure lessons before repeating a mistake, and to distil the session at a checkpoint.",
   "bin": {
     "misakanet-setup": "bin/misakanet-setup.mjs"