@opentag/runner 0.2.0 → 0.3.1

package/dist/index.js

@@ -23,6 +23,8 @@ var nodeCommandRunner = {
           stderr: Buffer.concat(stderr).toString("utf8")
         });
       });
+      child.stdin.on("error", () => {
+      });
       if (options.input) {
         child.stdin.write(options.input);
       }
@@ -36,6 +38,143 @@ async function assertCommandSucceeded(result, label) {
   }
 }
 
+// src/executor-report.ts
+var EXECUTOR_REPORT_START = "OPENTAG_EXECUTOR_REPORT_START";
+var EXECUTOR_REPORT_END = "OPENTAG_EXECUTOR_REPORT_END";
+var REPORT_OUTCOMES = /* @__PURE__ */ new Set(["passed", "failed", "not_run"]);
+var MAX_REPORT_ITEMS = 8;
+var MAX_REPORT_TEXT_LENGTH = 600;
+function executorReportPromptLines() {
+  return [
+    "End with this exact machine-readable OpenTag executor report block. Put it last.",
+    "Replace every example value with the actual result. Use changes: [] if no files changed.",
+    "Use verification: [] if no checks ran. Use verification outcome exactly one of: passed, failed, not_run.",
+    EXECUTOR_REPORT_START,
+    JSON.stringify(
+      {
+        changes: [{ file: "README.md", summary: "Added one sentence describing the completed change." }],
+        verification: [{ command: "corepack pnpm test", outcome: "passed", summary: "Tests passed." }],
+        risks: []
+      },
+      null,
+      2
+    ),
+    EXECUTOR_REPORT_END
+  ];
+}
+function executorPolicyPromptLines() {
+  return [
+    "Work autonomously but keep the change narrow. Run relevant verification if you modify files.",
+    "OpenTag owns the source-control handoff after you finish.",
+    "Do not run, request, or recommend git add, git commit, git push, or gh pr create.",
+    "Do not ask the user to approve local source-control commands; summarize file changes and verification only.",
+    "OpenTag will publish the run branch and expose pull-request creation as a suggested action.",
+    ...executorReportPromptLines()
+  ];
+}
+function asRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function cleanReportText(value) {
+  if (typeof value !== "string") return void 0;
+  const text = value.replace(/\s+/g, " ").trim();
+  return text.length > 0 ? text.slice(0, MAX_REPORT_TEXT_LENGTH) : void 0;
+}
+function cleanStringArray(value) {
+  if (!Array.isArray(value)) return void 0;
+  const items = value.map(cleanReportText).filter((item) => Boolean(item));
+  return items.length > 0 ? items.slice(0, MAX_REPORT_ITEMS) : void 0;
+}
+function normalizeReport(value) {
+  const record = asRecord(value);
+  if (!record || !Array.isArray(record["changes"])) return void 0;
+  const changes = record["changes"].map((item) => {
+    const change = asRecord(item);
+    if (!change) return void 0;
+    const summary = cleanReportText(change["summary"]);
+    if (!summary) return void 0;
+    const file = cleanReportText(change["file"]);
+    return file ? { file, summary } : { summary };
+  }).filter((item) => Boolean(item)).slice(0, MAX_REPORT_ITEMS);
+  if (record["changes"].length > 0 && changes.length === 0) return void 0;
+  const verificationRaw = record["verification"];
+  const verification = Array.isArray(verificationRaw) ? verificationRaw.map((item) => {
+    const check = asRecord(item);
+    if (!check || typeof check["outcome"] !== "string" || !REPORT_OUTCOMES.has(check["outcome"])) return void 0;
+    const command = cleanReportText(check["command"]);
+    const summary = cleanReportText(check["summary"]);
+    return {
+      ...command ? { command } : {},
+      outcome: check["outcome"],
+      ...summary ? { summary } : {}
+    };
+  }).filter((item) => Boolean(item)).slice(0, MAX_REPORT_ITEMS) : void 0;
+  if (Array.isArray(verificationRaw) && verificationRaw.length > 0 && (!verification || verification.length === 0)) {
+    return void 0;
+  }
+  const risks = cleanStringArray(record["risks"]);
+  const notes = cleanStringArray(record["notes"]);
+  return {
+    changes,
+    ...verification && verification.length > 0 ? { verification } : {},
+    ...risks ? { risks } : {},
+    ...notes ? { notes } : {}
+  };
+}
+function markerCandidate(output) {
+  const startIndex = output.lastIndexOf(EXECUTOR_REPORT_START);
+  if (startIndex < 0) return void 0;
+  const afterStart = output.slice(startIndex + EXECUTOR_REPORT_START.length);
+  const endIndex = afterStart.indexOf(EXECUTOR_REPORT_END);
+  return (endIndex >= 0 ? afterStart.slice(0, endIndex) : afterStart).trim();
+}
+function parseCandidate(candidate) {
+  try {
+    return normalizeReport(JSON.parse(candidate));
+  } catch {
+    return void 0;
+  }
+}
+function parseExecutorReport(output) {
+  const marker = markerCandidate(output);
+  if (marker) {
+    const parsed = parseCandidate(marker);
+    if (parsed) return parsed;
+  }
+  return parseCandidate(output.trim());
+}
+function deterministicSummary(input) {
+  if (input.changedFiles.length === 0) {
+    return `${input.executorName} completed without file changes.`;
+  }
+  return `${input.executorName} changed ${input.changedFiles.length} file(s). Changed files: ${input.changedFiles.join(", ")}.`;
+}
+function renderExecutorReportSummary(input) {
+  const lines = [];
+  if (input.report.changes.length > 0) {
+    lines.push("What changed:");
+    for (const change of input.report.changes) {
+      lines.push(`- ${change.file ? `\`${change.file}\`: ` : ""}${change.summary}`);
+    }
+  }
+  if (input.report.verification?.length) {
+    if (lines.length > 0) lines.push("");
+    lines.push("Verified:");
+    for (const check of input.report.verification) {
+      const prefix = check.command ? `\`${check.command}\`: ${check.outcome}` : check.outcome;
+      lines.push(`- ${check.summary ? `${prefix} - ${check.summary}` : prefix}`);
+    }
+  }
+  if (input.report.risks?.length) {
+    if (lines.length > 0) lines.push("");
+    lines.push("Risks:");
+    for (const risk of input.report.risks) {
+      lines.push(`- ${risk}`);
+    }
+  }
+  return lines.length > 0 ? lines.join("\n") : deterministicSummary(input);
+}
+
 // src/executor.ts
 import { contextPointerLabel } from "@opentag/core";
 function renderContextPacketForPrompt(packet) {
@@ -75,11 +214,23 @@ function branchNameForRun(runId) {
   const safeRunId = runId.replace(/[^a-zA-Z0-9._-]/g, "-");
   return `opentag/${safeRunId}`;
 }
+var STATUS_PORCELAIN_Z_ARGS = ["-c", "core.quotePath=false", "status", "--porcelain", "-z"];
 function parseStatusEntries(statusOutput) {
-  return statusOutput.split("\n").map((line) => line.replace(/\r$/, "")).filter(Boolean).map((line) => ({
-    status: line.slice(0, 2),
-    path: line.slice(3).trim()
-  })).filter((entry) => entry.path.length > 0);
+  const records = statusOutput.split("\0");
+  const entries = [];
+  for (let index = 0; index < records.length; index += 1) {
+    const record = records[index];
+    if (!record) continue;
+    const status = record.slice(0, 2);
+    const path = record.slice(3);
+    const isRenameOrCopy = status.includes("R") || status.includes("C");
+    if (isRenameOrCopy) {
+      index += 1;
+    }
+    if (path.length === 0) continue;
+    entries.push({ status, path });
+  }
+  return entries;
 }
 function isInternalArtifactPath(path) {
   return INTERNAL_ARTIFACT_ROOTS.some((root) => path === root || path.startsWith(`${root}/`));
@@ -118,12 +269,12 @@ async function deleteRunBranch(input) {
   await assertCommandSucceeded(result, "delete empty run branch");
 }
 async function changedFiles(input) {
-  const result = await input.runner.run("git", ["status", "--porcelain"], { cwd: input.workspacePath });
+  const result = await input.runner.run("git", STATUS_PORCELAIN_Z_ARGS, { cwd: input.workspacePath });
   await assertCommandSucceeded(result, "read changed files");
   return parseChangedFiles(result.stdout);
 }
 async function cleanupInternalArtifacts(input) {
-  const statusResult = await input.runner.run("git", ["status", "--porcelain"], { cwd: input.workspacePath });
+  const statusResult = await input.runner.run("git", STATUS_PORCELAIN_Z_ARGS, { cwd: input.workspacePath });
   await assertCommandSucceeded(statusResult, "scan internal artifacts");
   const untrackedRoots = Array.from(
     new Set(
@@ -163,9 +314,44 @@ async function pushBranch(input) {
 }
 
 // src/result.ts
+var MAX_EXECUTOR_SUMMARY_LENGTH = 4e3;
+var DIRECT_SOURCE_CONTROL_COMMAND_PATTERN = /^\s*(?:[-*]\s*)?(?:`{1,3})?\s*(?:git\s+(?:add|commit|push|checkout)|gh\s+pr\s+create)\b/i;
+var GIT_HANDOFF_PATTERNS = [
+  DIRECT_SOURCE_CONTROL_COMMAND_PATTERN,
+  /\b(?:interactive user approval|permission system)\b.*\b(?:git|source-control|commit|push|pull request|pr)\b/i,
+  /\b(?:git|source-control|commit|push|pull request|pr)\b.*\b(?:interactive user approval|permission system)\b/i,
+  /(?=.*\b(?:git\s+(?:add|commit|push|checkout)|gh\s+pr\s+create|commit|push|pull request|pr)\b)(?=.*\b(?:approval|approve|manual|need|needs|cannot|can't|please|requires?|required|finish|next action|remaining work|blocked|blocker|permission)\b)/i
+];
+var HANDOFF_HEADING_PATTERN = /^(?:#{1,6}\s*)?(?:\*\*)?\s*(?:blocker|recommended next action|next action|remaining work|manual steps|to finish)\b.*\b(?:git|source-control|commit|push|pull request|pr)\b/i;
+function looksLikeGitHandoff(line) {
+  return GIT_HANDOFF_PATTERNS.some((pattern) => pattern.test(line));
+}
+function stripGitHandoffTail(line) {
+  if (!looksLikeGitHandoff(line)) return line;
+  return line.replace(/\s*(?:Blocker|Recommended next action|Next action|Remaining work|Manual steps|To finish)\s*:.*$/i, "").trimEnd();
+}
+function cleanOrFallbackExecutorSummary(input) {
+  const rawSummary = input.output.slice(-MAX_EXECUTOR_SUMMARY_LENGTH).replace(/\r\n/g, "\n");
+  const filteredLines = [];
+  for (const rawLine of rawSummary.split("\n")) {
+    const trimmed = rawLine.trim();
+    if (HANDOFF_HEADING_PATTERN.test(trimmed)) continue;
+    const withoutHandoffTail = stripGitHandoffTail(rawLine);
+    if (looksLikeGitHandoff(withoutHandoffTail)) continue;
+    if (withoutHandoffTail.trim().length === 0 && trimmed.length > 0) continue;
+    filteredLines.push(withoutHandoffTail);
+  }
+  const summary = filteredLines.join("\n").replace(/(?:^|\n)\s*(?:To finish|Manual steps):\s*\n```[^\n]*\n\s*```/gi, "\n").replace(/```[^\n]*\n\s*```/g, "").replace(/\n{3,}/g, "\n\n").trim();
+  if (summary.length > 0) return summary;
+  if (input.changedFiles.length === 0) {
+    return `${input.executorName} completed without file changes.`;
+  }
+  return `${input.executorName} changed ${input.changedFiles.length} file(s). Changed files: ${input.changedFiles.join(", ")}.`;
+}
 function createExecutorRunResult(input) {
   const proposalId = `proposal_${input.runId}`;
-  const summary = input.output.slice(-4e3);
+  const report = parseExecutorReport(input.output);
+  const summary = report ? renderExecutorReportSummary({ ...input, report }) : cleanOrFallbackExecutorSummary(input);
   const suggestedChanges = input.changedFiles.length > 0 ? [
     {
       proposalId,
@@ -248,8 +434,7 @@ function buildPrompt(input) {
     "Context pointers:",
     contextLines(input.context),
     "",
-    "Work autonomously but keep the change narrow. Run relevant verification if you modify files.",
-    "End with a concise summary of what changed, what was verified, and the recommended next action."
+    ...executorPolicyPromptLines()
   ].join("\n");
 }
 function createClaudeCodeExecutor(options = {}) {
@@ -258,6 +443,40 @@ function createClaudeCodeExecutor(options = {}) {
   return {
     id: "claude-code",
     displayName: "Claude Code Executor",
+    capability: {
+      id: "claude-code",
+      invocation: "spawn",
+      supportsProfile: false,
+      supportsStreaming: false,
+      supportsCancel: false,
+      supportsHookCompletion: false,
+      progressEvents: "audit",
+      approvalMode: "opentag_policy",
+      contextAccess: ["context_packet", "context_pointers", "workspace"],
+      promptAssembly: "executor_adapter",
+      writeAccess: "workspace",
+      conversationAccess: "request",
+      promptMutation: "none",
+      rawContextAccess: false,
+      writeActionAccess: "none",
+      workspaceIsolation: "branch",
+      requiredSecrets: [
+        {
+          id: "anthropic_api_key",
+          label: "Anthropic API key",
+          required: false,
+          env: "ANTHROPIC_API_KEY",
+          description: "Needed when the local Claude Code CLI is configured to authenticate from environment."
+        }
+      ],
+      completionSignals: [
+        {
+          type: "process_exit",
+          required: true,
+          description: "OpenTag treats a successful `claude --print` process exit as the normal completion signal."
+        }
+      ]
+    },
     async canRun(input) {
       try {
         const claudeVersion = await runner.run(claudeCommand, ["--version"], { cwd: input.workspacePath });
@@ -561,7 +780,7 @@ function buildPrompt2(input) {
     "Context pointers:",
     contextLines2(input.context),
     "",
-    "Work autonomously but keep the change narrow. Run relevant verification if you modify files. End with a concise summary."
+    ...executorPolicyPromptLines()
   ].join("\n");
 }
 function createCodexExecutor(options = {}) {
@@ -570,6 +789,40 @@ function createCodexExecutor(options = {}) {
   return {
     id: "codex",
     displayName: "Codex Executor",
+    capability: {
+      id: "codex",
+      invocation: "spawn",
+      supportsProfile: false,
+      supportsStreaming: false,
+      supportsCancel: false,
+      supportsHookCompletion: false,
+      progressEvents: "audit",
+      approvalMode: "opentag_policy",
+      contextAccess: ["context_packet", "context_pointers", "workspace"],
+      promptAssembly: "executor_adapter",
+      writeAccess: "workspace",
+      conversationAccess: "request",
+      promptMutation: "none",
+      rawContextAccess: false,
+      writeActionAccess: "none",
+      workspaceIsolation: "worktree",
+      requiredSecrets: [
+        {
+          id: "openai_api_key",
+          label: "OpenAI API key",
+          required: false,
+          env: "OPENAI_API_KEY",
+          description: "Needed when the local Codex CLI is configured to authenticate from environment."
+        }
+      ],
+      completionSignals: [
+        {
+          type: "process_exit",
+          required: true,
+          description: "OpenTag treats a successful `codex exec` process exit as the normal completion signal."
+        }
+      ]
+    },
     async canRun(input) {
       const codexVersion = await runner.run(codexCommand, ["--version"], { cwd: input.workspacePath });
       if (codexVersion.exitCode !== 0) {
@@ -731,6 +984,32 @@ function createEchoExecutor() {
   return {
     id: "echo",
     displayName: "Echo Executor",
+    capability: {
+      id: "echo",
+      invocation: "spawn",
+      supportsProfile: false,
+      supportsStreaming: false,
+      supportsCancel: false,
+      supportsHookCompletion: false,
+      progressEvents: "audit",
+      approvalMode: "opentag_policy",
+      contextAccess: ["context_packet", "context_pointers"],
+      promptAssembly: "opentag",
+      writeAccess: "none",
+      conversationAccess: "request",
+      promptMutation: "none",
+      rawContextAccess: false,
+      writeActionAccess: "none",
+      workspaceIsolation: "none",
+      requiredSecrets: [],
+      completionSignals: [
+        {
+          type: "process_exit",
+          required: true,
+          description: "The in-process echo executor returns a structured result immediately."
+        }
+      ]
+    },
     async canRun() {
       return { ready: true };
     },
@@ -766,8 +1045,254 @@ function createEchoExecutor() {
     }
   };
 }
+
+// src/session-profile.ts
+import { formatProjectTargetRef, projectTargetRefFromEvent } from "@opentag/core";
+var DEFAULT_AGENT_SESSION_PROFILE_TEMPLATE = "opentag-{provider}-{accountId}-{conversationId}-{owner}-{repo}-{actorId}";
+function metadataString(metadata, key) {
+  const value = metadata?.[key];
+  if (typeof value === "string") return value;
+  if (typeof value === "number" && Number.isFinite(value)) return String(value);
+  return "";
+}
+function sanitizeAgentSessionProfileId(profile) {
+  return profile.replace(/[^A-Za-z0-9_.-]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+}
+function profileTemplateValue(input) {
+  if (input.key === "runId") return input.runId;
+  if (input.key === "provider" || input.key === "sourceProvider") return input.sourceProvider;
+  if (input.key === "projectTarget") return input.projectTargetRef ? formatProjectTargetRef(input.projectTargetRef) : "";
+  if (input.key === "repoProvider") return input.projectTargetRef?.provider ?? metadataString(input.metadata, "repoProvider");
+  if (input.key === "owner") return input.projectTargetRef?.owner ?? metadataString(input.metadata, "owner");
+  if (input.key === "repo") return input.projectTargetRef?.repo ?? metadataString(input.metadata, "repo");
+  if (input.key === "actorId") return input.actorId ?? "";
+  return metadataString(input.metadata, input.key);
+}
+function createAgentSessionProfile(input) {
+  const template = input.template ?? DEFAULT_AGENT_SESSION_PROFILE_TEMPLATE;
+  const metadata = input.metadata ?? {};
+  const projectTargetRef = input.projectTargetRef ?? void 0;
+  const profile = template.replace(
+    /\{([^}]+)\}/g,
+    (_match, key) => profileTemplateValue({
+      key,
+      runId: input.runId,
+      sourceProvider: input.sourceProvider,
+      metadata,
+      ...projectTargetRef ? { projectTargetRef } : {},
+      ...input.actorId ? { actorId: input.actorId } : {}
+    })
+  );
+  const id = sanitizeAgentSessionProfileId(profile) || (input.fallbackId ? sanitizeAgentSessionProfileId(input.fallbackId) : "");
+  if (!id) return void 0;
+  const accountId = metadataString(metadata, "accountId");
+  const conversationId = metadataString(metadata, "conversationId");
+  return {
+    id,
+    template,
+    sourceProvider: input.sourceProvider,
+    ...projectTargetRef ? { projectTarget: formatProjectTargetRef(projectTargetRef) } : {},
+    ...accountId ? { accountId } : {},
+    ...conversationId ? { conversationId } : {},
+    ...input.actorId ? { actorId: input.actorId } : {}
+  };
+}
+function createAgentSessionProfileForEvent(input) {
+  return createAgentSessionProfile({
+    runId: input.runId,
+    sourceProvider: input.event.source,
+    metadata: input.metadata ?? input.event.metadata,
+    projectTargetRef: projectTargetRefFromEvent(input.event),
+    actorId: input.event.actor.providerUserId,
+    ...input.template ? { template: input.template } : {},
+    ...input.fallbackId ? { fallbackId: input.fallbackId } : {}
+  });
+}
+function resolveAgentSessionProfile(input) {
+  if (input.profile) {
+    const id = sanitizeAgentSessionProfileId(input.profile);
+    const metadata = input.metadata ?? {};
+    const accountId = metadataString(metadata, "accountId") || input.fallback?.accountId;
+    const conversationId = metadataString(metadata, "conversationId") || input.fallback?.conversationId;
+    const actorId = input.actorId ?? input.fallback?.actorId;
+    const projectTarget = input.projectTargetRef ? formatProjectTargetRef(input.projectTargetRef) : input.fallback?.projectTarget;
+    return id ? {
+      id,
+      template: input.profile,
+      sourceProvider: input.fallback?.sourceProvider || metadataString(input.metadata, "provider") || "unknown",
+      ...projectTarget ? { projectTarget } : {},
+      ...accountId ? { accountId } : {},
+      ...conversationId ? { conversationId } : {},
+      ...actorId ? { actorId } : {}
+    } : input.fallback;
+  }
+  if (input.profileTemplate) {
+    return createAgentSessionProfile({
+      runId: metadataString(input.metadata, "runId") || input.fallback?.id || "run",
+      sourceProvider: metadataString(input.metadata, "provider") || input.fallback?.sourceProvider || "unknown",
+      ...input.metadata ? { metadata: input.metadata } : {},
+      ...input.projectTargetRef ? { projectTargetRef: input.projectTargetRef } : {},
+      ...input.actorId ? { actorId: input.actorId } : {},
+      template: input.profileTemplate,
+      ...input.fallback?.id ? { fallbackId: input.fallback.id } : {}
+    });
+  }
+  return input.fallback;
+}
+
+// src/hermes.ts
+import { contextPointerLabel as contextPointerLabel4 } from "@opentag/core";
+function contextLines3(context) {
+  if (!context.length) return "No additional context pointers were provided.";
+  return context.map((pointer) => `- ${contextPointerLabel4(pointer)}: ${pointer.uri}`).join("\n");
+}
+function buildPrompt3(input) {
+  return [
+    "You are executing an OpenTag run in a local checkout.",
+    `Run ID: ${input.runId}`,
+    "",
+    "User request:",
+    input.rawText,
+    "",
+    ...renderContextPacketForPrompt(input.contextPacket),
+    ...input.contextPacket ? [""] : [],
+    "Context pointers:",
+    contextLines3(input.context),
+    "",
+    "Use only the selected Hermes profile for tools, skills, memory, and session behavior.",
+    "Work autonomously but keep the change narrow. Run relevant verification if you modify files.",
+    "End with a concise summary of what changed, what was verified, and the recommended next action."
+  ].join("\n");
+}
+function createHermesExecutor(options = {}) {
+  const runner = options.runner ?? nodeCommandRunner;
+  const hermesCommand = options.hermesCommand ?? "hermes";
+  return {
+    id: "hermes",
+    displayName: "Hermes Executor",
+    capability: {
+      id: "hermes",
+      invocation: "spawn",
+      supportsProfile: true,
+      supportsStreaming: false,
+      supportsCancel: false,
+      supportsHookCompletion: false,
+      progressEvents: "audit",
+      approvalMode: "opentag_policy",
+      contextAccess: ["context_packet", "context_pointers", "workspace"],
+      promptAssembly: "executor_adapter",
+      writeAccess: "workspace",
+      conversationAccess: "request",
+      promptMutation: "none",
+      rawContextAccess: false,
+      writeActionAccess: "none",
+      workspaceIsolation: "branch",
+      requiredSecrets: [],
+      completionSignals: [
+        {
+          type: "process_exit",
+          required: true,
+          description: "OpenTag treats a successful `hermes -z` process exit as the normal completion signal."
+        }
+      ]
+    },
+    async canRun(input) {
+      try {
+        const hermesVersion = await runner.run(hermesCommand, ["--version"], { cwd: input.workspacePath });
+        if (hermesVersion.exitCode !== 0) {
+          return { ready: false, reason: `Hermes CLI is not available: ${hermesVersion.stderr || hermesVersion.stdout}` };
+        }
+      } catch (error) {
+        return { ready: false, reason: `Hermes CLI is not available: ${error instanceof Error ? error.message : String(error)}` };
+      }
+      let gitStatus;
+      try {
+        gitStatus = await runner.run("git", ["status", "--porcelain"], { cwd: input.workspacePath });
+      } catch (error) {
+        return { ready: false, reason: `Workspace is not a git checkout: ${error instanceof Error ? error.message : String(error)}` };
+      }
+      if (gitStatus.exitCode !== 0) {
+        return { ready: false, reason: `Workspace is not a git checkout: ${gitStatus.stderr || gitStatus.stdout}` };
+      }
+      if (gitStatus.stdout.trim().length > 0) {
+        return { ready: false, reason: "Workspace has uncommitted changes; refusing to run Hermes executor." };
+      }
+      return { ready: true };
+    },
+    async run(input, sink) {
+      const branchName = branchNameForRun(input.runId);
+      await sink.emit({
+        type: "executor.started",
+        message: `Creating isolated branch ${branchName}`,
+        at: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      await createRunBranch({
+        runner,
+        workspacePath: input.workspacePath,
+        branchName,
+        ...input.baseBranch ? { startPoint: input.baseBranch } : {}
+      });
+      await sink.emit({
+        type: "executor.progress",
+        message: "Starting hermes -z",
+        at: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      const prompt = buildPrompt3({
+        runId: input.runId,
+        rawText: input.command.rawText,
+        context: input.context,
+        contextPacket: input.contextPacket
+      });
+      const profile = resolveAgentSessionProfile({
+        ...options.profile ? { profile: options.profile } : {},
+        ...options.profileTemplate ? { profileTemplate: options.profileTemplate } : {},
+        metadata: {
+          ...input.metadata ?? {},
+          runId: input.runId
+        },
+        ...input.sessionProfile ? { fallback: input.sessionProfile } : {}
+      });
+      const args = [...profile ? ["-p", profile.id] : [], "-z", prompt];
+      let hermesResult;
+      try {
+        hermesResult = await runner.run(hermesCommand, args, { cwd: input.workspacePath });
+        await assertCommandSucceeded(hermesResult, "hermes -z");
+      } finally {
+        const cleanedArtifacts = await cleanupInternalArtifacts({ runner, workspacePath: input.workspacePath });
+        if (cleanedArtifacts.length > 0) {
+          await sink.emit({
+            type: "executor.progress",
+            message: `Cleaned internal artifacts: ${cleanedArtifacts.join(", ")}`,
+            at: (/* @__PURE__ */ new Date()).toISOString()
+          });
+        }
+      }
+      if (!hermesResult) throw new Error("Hermes did not return a result.");
+      const files = await changedFiles({ runner, workspacePath: input.workspacePath });
+      await sink.emit({
+        type: "executor.completed",
+        message: `Hermes executor completed with ${files.length} changed file(s)`,
+        at: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      const output = hermesResult.stdout.trim() || hermesResult.stderr.trim() || "Hermes completed without textual output.";
+      return createExecutorRunResult({
+        executorName: "Hermes",
+        runId: input.runId,
+        branchName,
+        ...input.baseBranch ? { baseBranch: input.baseBranch } : {},
+        output,
+        changedFiles: files
+      });
+    },
+    async cancel() {
+      return;
+    }
+  };
+}
 export {
+  DEFAULT_AGENT_SESSION_PROFILE_TEMPLATE,
   DEFAULT_SAFE_ENV_NAMES,
+  STATUS_PORCELAIN_Z_ARGS,
   assertCommandSucceeded,
   assessRunnerSecurity,
   branchNameForRun,
@@ -775,10 +1300,13 @@ export {
   cleanupInternalArtifacts,
   commitChangedFiles,
   commitRunChanges,
+  createAgentSessionProfile,
+  createAgentSessionProfileForEvent,
   createClaudeCodeExecutor,
   createCodexExecutor,
   createEchoExecutor,
   createExecutorRunResult,
+  createHermesExecutor,
   createRunBranch,
   createRunWorktree,
   deleteRunBranch,
@@ -790,6 +1318,8 @@ export {
   pushBranch,
   removeRunWorktree,
   renderContextPacketForPrompt,
+  resolveAgentSessionProfile,
+  sanitizeAgentSessionProfileId,
   scrubEnvironment,
   worktreePathForRun
 };