@ours.network/fleet 1.1.4 → 1.2.0-nightly.1

package/dist/harness/codex.js

@@ -167,6 +167,10 @@ function codexAgentLaunch(role, prep) {
             ...(options?.search ? ['--search'] : []),
             'app-server',
         ];
+        // Fleet delivers wakes through the native session itself. The ours-codex
+        // launcher owns a remote TUI and cannot serve this stdio transport.
+        if (launcher === 'auto' && role.monitor?.mode === 'fleet')
+            return { argv: ['codex', ...flags], env: prep.env };
         // Preserve the established `auto` launcher contract without resolving PATH
         // during synchronous launch preparation. The static shell fragment passes
         // every dynamic value as an argv element and `exec`s the selected process.

package/dist/harness/hermes-compatibility.d.ts

@@ -0,0 +1,24 @@
+import { type Exec } from '../exec.js';
+export declare const TESTED_HERMES_ARTIFACT: {
+    readonly commit: "d15ed4445207dda418b984e8bda0f68f48b8c6f3";
+    readonly hermesVersion: "0.21.1";
+    readonly acpVersion: "0.9.0";
+    readonly protocolVersion: 1;
+};
+export interface HermesCompatibilityReport {
+    artifact: typeof TESTED_HERMES_ARTIFACT & {
+        sourceRoot: string;
+        executable: string;
+    };
+    /** Scoped prerequisite only: ACP connection/tool availability and other launch checks remain separate. */
+    pluginMcp: 'absent-in-validated-sources';
+}
+export interface HermesCompatibilityRequest {
+    argv: string[];
+    env: Record<string, string>;
+    home: string;
+}
+/** Check original, unwrapped argv. This does not certify an isolation wrapper or claim MCP tool readiness. */
+export declare function inspectHermesCompatibility(request: HermesCompatibilityRequest, exec?: Exec): Promise<HermesCompatibilityReport>;
+/** Native identity check, separate from session model/provider validation and first actual MCP use. */
+export declare function validateHermesInitialize(response: unknown): void;

package/dist/harness/hermes-compatibility.js

@@ -0,0 +1,191 @@
+import { accessSync, constants, lstatSync, readFileSync, readdirSync, realpathSync } from 'node:fs';
+import { basename, delimiter, dirname, isAbsolute, join, resolve } from 'node:path';
+import YAML from 'yaml';
+import { realExec } from '../exec.js';
+export const TESTED_HERMES_ARTIFACT = {
+    commit: 'd15ed4445207dda418b984e8bda0f68f48b8c6f3', hermesVersion: '0.21.1', acpVersion: '0.9.0', protocolVersion: 1,
+};
+const fail = (detail) => { throw new Error(`Hermes compatibility: ${detail}. Use the tested Hermes source/build and a supported hermes-acp launcher, or validate the new artifact before launch`); };
+const object = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+function stat(path) {
+    try {
+        return lstatSync(path);
+    }
+    catch (e) {
+        if (e.code === 'ENOENT')
+            return undefined;
+        return fail('cannot inspect a required artifact or plugin file');
+    }
+}
+function read(path) {
+    const info = stat(path);
+    if (!info)
+        return undefined;
+    if (!info.isFile() || info.isSymbolicLink())
+        return fail('artifact and plugin inputs must be regular non-symlink files');
+    try {
+        return new TextDecoder('utf-8', { fatal: true }).decode(readFileSync(path));
+    }
+    catch {
+        return fail('cannot read a required UTF-8 artifact or plugin file');
+    }
+}
+function document(path) {
+    const text = read(path);
+    if (text === undefined)
+        return {};
+    try {
+        const value = path.endsWith('.json') ? JSON.parse(text) : YAML.parse(text);
+        if (object(value))
+            return value;
+    }
+    catch { /* parser diagnostics may contain secrets */ }
+    return fail('invalid artifact or plugin configuration');
+}
+const CONSOLE_BODY = '# -*- coding: utf-8 -*-\nimport sys\nfrom acp_adapter.entry import main\nif __name__ == "__main__":\n    if sys.argv[0].endswith("-script.pyw"):\n        sys.argv[0] = sys.argv[0][:-11]\n    elif sys.argv[0].endswith(".exe"):\n        sys.argv[0] = sys.argv[0][:-4]\n    sys.exit(main())\n';
+function launcher(request) {
+    if (request.argv.length !== 1 || !request.argv[0])
+        return fail('only the original hermes-acp executable without shell commands or extra flags has been tested');
+    const command = request.argv[0];
+    const candidates = isAbsolute(command) ? [command] : command.includes('/') ? [resolve(command)] : (request.env.PATH ?? '').split(delimiter).filter(Boolean).map(path => join(path, command));
+    let executable;
+    for (const path of candidates) {
+        try {
+            accessSync(path, constants.X_OK);
+            executable = realpathSync(path);
+            break;
+        }
+        catch { /* next PATH entry */ }
+    }
+    if (!executable)
+        return fail('hermes-acp executable was not found');
+    const text = read(executable);
+    if (!text || text.length > 4096)
+        return fail('unrecognized hermes-acp launcher');
+    const sourceRoot = dirname(dirname(dirname(executable)));
+    const interpreter = join(sourceRoot, 'venv/bin/python3');
+    if (basename(executable) === 'hermes-acp' && text === `#!${interpreter}\n${CONSOLE_BODY}`)
+        return { executable, sourceRoot, interpreter };
+    const shim = /^#!\/usr\/bin\/env bash\nunset PYTHONPATH\nunset PYTHONHOME\nexec "([^"\n]+)\/venv\/bin\/python" "\1\/hermes" acp "\$@"\n$/.exec(text);
+    if (shim && isAbsolute(shim[1]))
+        return { executable, sourceRoot: shim[1], interpreter: join(shim[1], 'venv/bin/python') };
+    return fail('unrecognized hermes-acp launcher; a version string alone does not identify tested code');
+}
+// Standard-library metadata only. No Hermes config, dotenv, plugin module, or credential loader is imported.
+const METADATA_PROBE = `import importlib.metadata as m, importlib.util as u, json
+s=u.find_spec('acp_adapter')
+e=m.entry_points()
+e=e.select(group='hermes_agent.plugins') if hasattr(e,'select') else e.get('hermes_agent.plugins',[])
+print(json.dumps({'hermesVersion':m.version('hermes-agent'),'acpVersion':m.version('agent-client-protocol'),'adapterOrigin':s.origin if s else None,'entryPoints':[{'name':x.name,'value':x.value} for x in e]}))`;
+function collectPlugins(directory, source, skip = new Set(), prefix = '', depth = 0) {
+    const info = stat(directory);
+    if (!info)
+        return [];
+    if (!info.isDirectory() || info.isSymbolicLink())
+        return fail('plugin source must be a non-symlink directory');
+    const found = [];
+    for (const entry of readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+        if (depth === 0 && skip.has(entry.name))
+            continue;
+        if (entry.isSymbolicLink())
+            return fail('unverified symlink in plugin discovery');
+        if (!entry.isDirectory())
+            continue;
+        const path = join(directory, entry.name);
+        const filename = ['plugin.yaml', 'plugin.yml', 'plugin.json'].find(name => stat(join(path, name)));
+        if (!filename) {
+            if (depth === 0)
+                found.push(...collectPlugins(path, source, new Set(), entry.name, 1));
+            continue;
+        }
+        const data = document(join(path, filename));
+        const name = typeof data.name === 'string' && data.name ? data.name : entry.name;
+        found.push({ name, key: prefix ? `${prefix}/${entry.name}` : name, source, portable: filename === 'plugin.json', path });
+    }
+    return found;
+}
+function names(value, field) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.some(name => typeof name !== 'string'))
+        return fail(`plugins.${field} must contain literal names`);
+    if (value.some(name => /\$\{/.test(name)))
+        return fail(`plugins.${field} interpolation is unsupported; use literal names`);
+    return value;
+}
+function validatePluginSources(request, sourceRoot, metadata) {
+    for (const name of ['HERMES_BUNDLED_PLUGINS', 'HERMES_ENABLE_PROJECT_PLUGINS'])
+        if (request.env[name] !== undefined)
+            return fail('plugin discovery environment overrides are unsupported');
+    for (const filename of ['.env', '.op.env']) {
+        const content = read(join(request.home, filename));
+        if (content === undefined)
+            continue;
+        if (/[\0\u001c-\u001f\u0085]/.test(content))
+            return fail('unsupported plugin dotenv encoding');
+        for (const line of content.split(/\r\n?|\n/)) {
+            const match = /^\s*(?:export\s+)?(?:'([^']+)'|([^\s=#]+))\s*=/.exec(line);
+            if (match && ['HERMES_BUNDLED_PLUGINS', 'HERMES_ENABLE_PROJECT_PLUGINS'].includes(match[1] ?? match[2]))
+                return fail('plugin discovery redirection in selected-home dotenv is unsupported; remove it with the role stopped');
+        }
+    }
+    const config = document(join(request.home, 'config.yaml'));
+    if (config.plugins !== undefined && !object(config.plugins))
+        return fail('plugins configuration must be a map');
+    const plugins = object(config.plugins) ? config.plugins : {};
+    const enabled = names(plugins.enabled, 'enabled');
+    const disabled = names(plugins.disabled, 'disabled') ?? [];
+    const bundled = join(sourceRoot, 'plugins');
+    // Match native precedence: bundled, bundled/platforms, home, then entry points. Project plugins are refused above.
+    const all = [...collectPlugins(bundled, 'bundled', new Set(['memory', 'context_engine', 'platforms', 'model-providers'])), ...collectPlugins(join(bundled, 'platforms'), 'bundled'), ...collectPlugins(join(request.home, 'plugins'), 'home'), ...metadata.entryPoints.map(entry => ({ name: entry.name, key: entry.name, source: 'entrypoint', portable: false }))];
+    const winners = new Map(all.map(plugin => [plugin.key, plugin]));
+    for (const plugin of winners.values()) {
+        if ([plugin.key, plugin.name].some(name => disabled.includes(name)))
+            continue;
+        // Known bundled code includes native auto-loaded backends. It is part of the pinned clean source.
+        if (plugin.source !== 'bundled' && enabled && ![plugin.key, plugin.name].some(name => enabled.includes(name)))
+            continue;
+        if (!plugin.portable && plugin.source !== 'bundled')
+            return fail('enabled unreviewed home/entry-point plugin code cannot be verified MCP-free; disable that plugin or validate its artifact');
+        if (plugin.portable && plugin.path && stat(join(plugin.path, 'mcp.json'))) {
+            const mcp = document(join(plugin.path, 'mcp.json'));
+            if (!object(mcp.mcpServers) || Object.keys(mcp.mcpServers).length)
+                return fail('enabled plugin provides MCP; disable the plugin and declare extras through ACP mcpServers');
+        }
+    }
+}
+/** Check original, unwrapped argv. This does not certify an isolation wrapper or claim MCP tool readiness. */
+export async function inspectHermesCompatibility(request, exec = realExec) {
+    const chain = launcher(request);
+    // Use ordinary supervisor execution state, not role overrides, for inspection subprocesses.
+    const env = { PATH: process.env.PATH, HOME: request.env.HOME, HERMES_HOME: request.home };
+    const opts = { env, timeout: 10_000 };
+    const [head, status] = await Promise.all([
+        exec('git', ['-C', chain.sourceRoot, 'rev-parse', 'HEAD'], opts),
+        exec('git', ['-C', chain.sourceRoot, 'status', '--porcelain', '--untracked-files=all'], opts),
+    ]);
+    if (head.code || status.code || head.stdout.trim() !== TESTED_HERMES_ARTIFACT.commit || status.stdout.trim())
+        return fail('source checkout is not the tested clean Git artifact');
+    const result = await exec(chain.interpreter, ['-I', '-B', '-c', METADATA_PROBE], opts);
+    if (result.code)
+        return fail('could not inspect the tested Python package metadata');
+    let metadata;
+    try {
+        const value = JSON.parse(result.stdout);
+        if (!object(value) || typeof value.adapterOrigin !== 'string' || !Array.isArray(value.entryPoints) || value.entryPoints.some(entry => !object(entry) || typeof entry.name !== 'string' || typeof entry.value !== 'string'))
+            return fail('invalid Python package metadata');
+        metadata = value;
+    }
+    catch {
+        return fail('invalid Python package metadata');
+    }
+    if (metadata.hermesVersion !== TESTED_HERMES_ARTIFACT.hermesVersion || metadata.acpVersion !== TESTED_HERMES_ARTIFACT.acpVersion || resolve(metadata.adapterOrigin) !== join(chain.sourceRoot, 'acp_adapter/__init__.py'))
+        return fail('Python packages or ACP source origin differ from the tested build');
+    validatePluginSources(request, chain.sourceRoot, metadata);
+    return { artifact: { ...TESTED_HERMES_ARTIFACT, sourceRoot: chain.sourceRoot, executable: chain.executable }, pluginMcp: 'absent-in-validated-sources' };
+}
+/** Native identity check, separate from session model/provider validation and first actual MCP use. */
+export function validateHermesInitialize(response) {
+    if (!object(response) || response.protocolVersion !== TESTED_HERMES_ARTIFACT.protocolVersion || !object(response.agentInfo) || response.agentInfo.name !== 'hermes-agent' || response.agentInfo.version !== TESTED_HERMES_ARTIFACT.hermesVersion)
+        fail('ACP initialize identity/protocol does not match the tested Hermes artifact');
+}

package/dist/harness/hermes-config.d.ts

@@ -0,0 +1,12 @@
+import type { ResolvedRole } from '../config.js';
+import { type McpServerSpec } from './acp-mcp.js';
+import type { AcpMcpServer, RoleDirs, SessionPrep, ValidationError } from './types.js';
+export interface HermesOptions {
+    mcp_servers?: Record<string, McpServerSpec>;
+}
+export declare function validateHermesOptions(options: unknown): ValidationError[];
+export declare function validateHermesRole(role: ResolvedRole): ValidationError[];
+/** Complete environment: transport MUST use inheritEnvironment:false after this final merge. */
+export declare function hermesChildEnvironment(role: ResolvedRole, home: string, trustedFleetEnv: Record<string, string>, inherited?: NodeJS.ProcessEnv): Record<string, string>;
+export declare function hermesMcpServers(role: ResolvedRole, trustedFleetEnv?: Record<string, string>): AcpMcpServer[];
+export declare function prepareHermesConfig(role: ResolvedRole, dirs: RoleDirs): Promise<SessionPrep>;

package/dist/harness/hermes-config.js

@@ -0,0 +1,367 @@
+import { chmodSync, lstatSync, mkdirSync, readFileSync, readdirSync } from 'node:fs';
+import { join, parse, resolve } from 'node:path';
+import YAML from 'yaml';
+import { replaceFileAtomically, withFileLock } from '../atomic-file.js';
+import { harnessRuntimeDir } from '../isolation/policy.js';
+import { acpMcpServersFor, validateMcpServers } from './acp-mcp.js';
+import { translateHermesPermissions } from './hermes-permissions.js';
+const mapping = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const credentialPathName = (key) => /(?:^|_)CREDENTIALS(?:_PATH|_FILE)?$/i.test(key);
+const reserved = (key) => /^(?:_?HERMES_|OURS_|COPILOT_|CODEX_HOME$|TERMINAL_|OPENAI_|ANTHROPIC_|AZURE_|AWS_|GOOGLE_|GEMINI_|GROQ_|OPENROUTER_|NOUS_|TOGETHER_|FIREWORKS_|DEEPSEEK_|XAI_|MISTRAL_|COHERE_|OLLAMA_|LM_STUDIO_|VLLM_)/i.test(key)
+    || /(?:_API_KEY|_TOKEN|_SECRET|_PASSWORD|_BASE_URL|_KEY)$/i.test(key) || credentialPathName(key);
+// Native providers may choose arbitrary credential variable names (key_env).
+// An execution allowlist is therefore the inherited baseline, not a credential denylist.
+const executionKey = (key) => /^(?:PATH|HOME|USER|LOGNAME|SHELL|LANG|LANGUAGE|LC_[A-Z_]+|TERM|COLORTERM|TMPDIR|TMP|TEMP|TZ|SystemRoot|SYSTEMROOT|WINDIR|COMSPEC|ComSpec|PATHEXT|USERPROFILE|HOMEDRIVE|HOMEPATH|APPDATA|LOCALAPPDATA|PROGRAMDATA|PROGRAMFILES|ProgramFiles|NUMBER_OF_PROCESSORS|OS|PROCESSOR_ARCHITECTURE)$/i.test(key);
+export function validateHermesOptions(options) {
+    if (options == null)
+        return [];
+    if (!mapping(options))
+        return [{ path: 'harness_options', message: 'must be a map' }];
+    const errors = Object.keys(options).filter(key => key !== 'mcp_servers').map(key => ({ path: `harness_options.${key}`, message: 'unsupported Hermes option; allowed: mcp_servers (provider and credentials must be provisioned in the stopped native home)' }));
+    errors.push(...validateMcpServers(options.mcp_servers));
+    if (!errors.length && options.mcp_servers != null) {
+        const servers = options.mcp_servers;
+        for (const [name, server] of Object.entries(servers)) {
+            const remote = server.type === 'http' || server.type === 'sse';
+            const allowed = remote ? ['type', 'url', 'headers'] : ['type', 'command', 'args', 'env'];
+            for (const key of Object.keys(server))
+                if (!allowed.includes(key))
+                    errors.push({ path: `harness_options.mcp_servers.${name}.${key}`, message: 'unsupported field for this MCP transport' });
+            for (const key of Object.keys(server.env ?? {}))
+                if (/^(?:OURS_|_?HERMES_)/i.test(key))
+                    errors.push({ path: `harness_options.mcp_servers.${name}.env.${key}`, message: 'reserved Fleet/Hermes environment variable' });
+            if (remote) {
+                try {
+                    if (!['http:', 'https:'].includes(new URL(server.url).protocol))
+                        throw new Error();
+                }
+                catch {
+                    errors.push({ path: `harness_options.mcp_servers.${name}.url`, message: 'must be an absolute HTTP(S) URL' });
+                }
+            }
+        }
+        if (servers.ours && !identicalOurs(servers.ours))
+            errors.push({ path: 'harness_options.mcp_servers.ours', message: 'reserved ours connector must be { command: ours-mcp, args: [proxy] } with no overrides' });
+    }
+    return errors;
+}
+function identicalOurs(server) {
+    return Object.keys(server).every(key => ['type', 'command', 'args', 'env'].includes(key))
+        && (server.type == null || server.type === 'stdio') && server.command === 'ours-mcp'
+        && JSON.stringify(server.args) === '["proxy"]' && Object.keys(server.env ?? {}).length === 0;
+}
+export function validateHermesRole(role) {
+    const errors = validateHermesOptions(role.harness_options);
+    if (typeof role.model !== 'string' || !role.model.trim())
+        errors.push({ path: 'model', message: 'Hermes requires an explicit non-empty Brain model' });
+    for (const key of ['effort', 'model_chain'])
+        if (role[key] != null)
+            errors.push({ path: key, message: `Hermes does not support ${key}` });
+    if (role.session !== 'acp')
+        errors.push({ path: 'session', message: 'Hermes requires session: acp' });
+    if (role.monitor?.mode === 'native')
+        errors.push({ path: 'monitor.mode', message: 'Hermes requires Fleet-owned monitoring' });
+    if (role.monitor?.interrupt === 'after_tool')
+        errors.push({ path: 'monitor.interrupt', message: 'Hermes does not support after_tool' });
+    const permissions = translateHermesPermissions(role.permissions);
+    if (!permissions.supported)
+        errors.push({ path: 'permissions', message: permissions.reason });
+    for (const key of Object.keys(role.env ?? {}))
+        if (reserved(key))
+            errors.push({ path: `env.${key}`, message: 'reserved Hermes/Fleet or provider variable; provision provider credentials in the stopped native home' });
+    return errors;
+}
+function throwErrors(errors) {
+    if (errors.length)
+        throw new Error(errors.map(e => `${e.path}: ${e.message}`).join('; '));
+}
+// Match the supported native config expander's ${VAR} and ${env:VAR} shapes.
+const hasNativeInterpolation = (value) => typeof value === 'string' && /\$\{[^}]+\}/.test(value);
+// Native config.py's credential vocabulary, plus its model.api alias below.
+const credentialFields = new Set(['api_key', 'apikey', 'key', 'token', 'access_token', 'refresh_token', 'id_token', 'secret', 'client_secret', 'password', 'passwd', 'auth', 'authorization', 'private_key', 'bearer', 'jwt']);
+const credentialEnvName = (key) => credentialFields.has(key.toLowerCase()) || /(?:_API_KEY|_TOKEN|_SECRET|_PASSWORD|_PASSWD|_KEY)$/i.test(key) || credentialPathName(key);
+function configReferences(value) {
+    return [...value.matchAll(/\$\{([^}]+)\}/g)].flatMap(match => {
+        const inner = match[1].trim();
+        const name = inner.startsWith('env:') ? inner.slice(4).trim()
+            : /^[a-z][a-z0-9_-]*:/.test(inner) ? '' : inner;
+        return name ? [name] : [];
+    });
+}
+function nativeCredentialKeys(config) {
+    const keys = new Set();
+    // YAML aliases can reach the same object through ordinary and credential fields.
+    const seen = [new Set(), new Set()];
+    const visit = (value, credential = false) => {
+        if (typeof value === 'string') {
+            if (credential)
+                for (const name of configReferences(value))
+                    keys.add(name);
+            return;
+        }
+        if (value === null || typeof value !== 'object' || seen[Number(credential)].has(value))
+            return;
+        seen[Number(credential)].add(value);
+        for (const [key, child] of Object.entries(value)) {
+            if ((key === 'key_env' || key === 'api_key_env') && typeof child === 'string' && child.trim()) {
+                if (hasNativeInterpolation(child))
+                    throw new Error('Hermes credential variable names do not support interpolation in a Fleet-managed home; provision literal key_env/api_key_env names with the role stopped');
+                keys.add(child.trim());
+            }
+            else
+                visit(child, credential || credentialFields.has(key.toLowerCase()) || key === 'extra_headers' || (value === config.model && key === 'api'));
+        }
+    };
+    visit(config);
+    return keys;
+}
+function dotenvSources(content, sources) {
+    const lines = content.split(/\r\n?|\n/);
+    for (let i = 0; i < lines.length; i++) {
+        const assignment = /^\s*(?:export\s+)?(?:'([^']+)'|([^\s=#]+))\s*=/.exec(lines[i]);
+        if (!assignment)
+            continue;
+        const key = assignment[1] ?? assignment[2];
+        let value = lines[i].slice(assignment[0].length).trimStart();
+        let ambiguous = false;
+        if (value.startsWith('"') || value.startsWith("'")) {
+            // Only discover references: do not expand values or resolve assignment precedence.
+            const quoted = value.startsWith('"') ? /^"((?:\\"|[^"])*)"/ : /^'((?:\\'|[^'])*)'/;
+            let match = quoted.exec(value);
+            let last = i;
+            let combined = value;
+            while (!match && last + 1 < lines.length) {
+                combined += '\n' + lines[++last];
+                match = quoted.exec(combined);
+            }
+            if (match) {
+                value = match[1];
+                ambiguous = last !== i;
+                i = last;
+            }
+            else
+                ambiguous = true;
+        }
+        else
+            value = value.replace(/\s+#.*$/, '').trimEnd();
+        // python-dotenv uses ${NAME} / ${NAME:-default}, not Hermes config's env: prefix.
+        const references = [...value.matchAll(/\$\{([^}:]*)(?::-[^}]*)?\}/g)].map(match => match[1]);
+        const source = sources.get(key) ?? { references: new Set(), ambiguous: false };
+        for (const name of references)
+            source.references.add(name);
+        source.ambiguous ||= references.length > 0 && (ambiguous || value.includes('\\'));
+        sources.set(key, source);
+    }
+}
+function validateNativeCredentialOverrides(role, config, home) {
+    const keys = nativeCredentialKeys(config);
+    const sources = new Map();
+    for (const name of ['.env', '.op.env']) {
+        const content = validateHomeDotenv(join(home, name));
+        if (content !== undefined)
+            dotenvSources(content, sources);
+    }
+    for (const key of sources.keys())
+        if (credentialEnvName(key))
+            keys.add(key);
+    // Set iteration visits newly added dependencies; cycles terminate without evaluating secrets.
+    for (const key of keys) {
+        const source = sources.get(key);
+        if (source?.ambiguous)
+            throw new Error('Hermes credential dotenv interpolation must use single-line assignments without escape encoding; provision it with the role stopped');
+        for (const dependency of source?.references ?? [])
+            keys.add(dependency);
+    }
+    for (const key of keys)
+        if (Object.hasOwn(role.env ?? {}, key))
+            throw new Error('role.env overrides a native credential variable; provision credentials in the stopped Hermes home');
+    return keys;
+}
+/** Complete environment: transport MUST use inheritEnvironment:false after this final merge. */
+export function hermesChildEnvironment(role, home, trustedFleetEnv, inherited = process.env) {
+    for (const key of Object.keys(role.env ?? {}))
+        if (reserved(key))
+            throw new Error(`env.${key} is reserved; provision native credentials in the stopped Hermes home`);
+    const credentialKeys = validateNativeCredentialOverrides(role, readConfig(join(home, 'config.yaml')), home);
+    const env = {};
+    for (const [key, value] of Object.entries(inherited))
+        if (value !== undefined && executionKey(key) && !credentialKeys.has(key))
+            env[key] = value;
+    Object.assign(env, role.env);
+    for (const [key, value] of Object.entries(trustedFleetEnv))
+        if (key.startsWith('OURS_'))
+            env[key] = value;
+    env.HERMES_HOME = home;
+    env.HERMES_ACP_SKIP_CONFIGURED_MCP = '1';
+    return env;
+}
+export function hermesMcpServers(role, trustedFleetEnv = {}) {
+    throwErrors(validateHermesOptions(role.harness_options));
+    const options = (role.harness_options ?? {});
+    const oursEnv = Object.fromEntries(Object.entries(trustedFleetEnv).filter(([key]) => key.startsWith('OURS_')));
+    return acpMcpServersFor({ ours: { command: 'ours-mcp', args: ['proxy'], env: oursEnv }, ...Object.fromEntries(Object.entries(options.mcp_servers ?? {}).filter(([name]) => name !== 'ours')) });
+}
+function stat(path) {
+    try {
+        return lstatSync(path);
+    }
+    catch (e) {
+        if (e.code === 'ENOENT')
+            return undefined;
+        throw e;
+    }
+}
+function regular(path) {
+    const info = stat(path);
+    if (!info)
+        return false;
+    if (info.isSymbolicLink() || !info.isFile() || info.nlink !== 1)
+        throw new Error(`Hermes requires a regular, non-symlink, unshared file: ${path}`);
+    return true;
+}
+function privateDirectory(path) {
+    const absolute = resolve(path);
+    let current = parse(absolute).root;
+    for (const component of absolute.slice(current.length).split('/').filter(Boolean)) {
+        current = join(current, component);
+        const info = stat(current);
+        if (info?.isSymbolicLink() || (info && !info.isDirectory()))
+            throw new Error(`Hermes home path must contain directories without symlinks: ${current}`);
+        if (!info)
+            mkdirSync(current, { mode: 0o700 });
+    }
+    chmodSync(absolute, 0o700);
+}
+function parseNativeFile(path) {
+    try {
+        return path.endsWith('.json') ? JSON.parse(readFileSync(path, 'utf8')) : YAML.parse(readFileSync(path, 'utf8'));
+    }
+    catch {
+        throw new Error(`Invalid Hermes configuration file; repair it with the role stopped: ${path}`);
+    }
+}
+function validateHomeDotenv(path) {
+    if (!regular(path))
+        return;
+    // Native dotenv accepts export and single-quoted keys. Read keys only; never
+    // return credential values or native parser diagnostics that may contain them.
+    // Native startup rewrites UTF-16 and strips NULs before parsing. Refuse those
+    // inputs rather than normalize credentials or validate a different assignment.
+    const bytes = readFileSync(path);
+    let content;
+    try {
+        if (bytes.includes(0))
+            throw new Error();
+        content = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+        // Python treats these controls as whitespace; JavaScript's key scanner does not.
+        if (/[\u001c-\u001f\u0085]/.test(content))
+            throw new Error();
+    }
+    catch {
+        throw new Error(`Unsupported Hermes dotenv encoding; use UTF-8 without NUL or unsupported control characters with the role stopped: ${path}`);
+    }
+    for (const line of content.split(/\r\n?|\n/)) {
+        const match = /^\s*(?:export\s+)?(?:'([^']+)'|([^\s=#]+))\s*=/.exec(line);
+        if (!match)
+            continue;
+        const key = match[1] ?? match[2];
+        if (/^OURS_/i.test(key) || /^(?:_?HERMES_(?:HOME|PROFILE|CONFIG(?:_PATH)?|ENV(?:_PATH)?|SHARED_AUTH_DIR|MANAGED_DIR|YOLO_MODE|INTERACTIVE|EXEC_ASK|GATEWAY_SESSION|CRON_SESSION|SINGLE_QUERY_SESSION|SESSION_.*|ACP_AUTO_APPROVE|ACP_SKIP_CONFIGURED_MCP|MODEL|ENABLE_PROJECT_PLUGINS|OPTIONAL_MCPS|SAFE_MODE|IGNORE_USER_CONFIG))$/i.test(key)) {
+            throw new Error(`Hermes home dotenv contains a reserved Fleet/Hermes setting; remove it with the role stopped: ${path}`);
+        }
+    }
+    return content;
+}
+function readConfig(path) {
+    if (!regular(path))
+        return {};
+    const doc = parseNativeFile(path);
+    if (!mapping(doc))
+        throw new Error(`Hermes configuration must be a YAML mapping: ${path}`);
+    return doc;
+}
+function managedMapping(config, key) {
+    if (config[key] === undefined)
+        return {};
+    if (!mapping(config[key]))
+        throw new Error(`Hermes configuration ${key} must be a mapping`);
+    return config[key];
+}
+function validateHomeMcp(config, home) {
+    if (config.mcp_servers != null) {
+        if (!mapping(config.mcp_servers))
+            throw new Error('Hermes home mcp_servers must be a map');
+        for (const server of Object.values(config.mcp_servers)) {
+            if (!mapping(server) || server.enabled !== false)
+                throw new Error(`Disable home-configured MCP servers in ${join(home, 'config.yaml')}; declare extras through Fleet harness_options.mcp_servers`);
+        }
+    }
+    const plugins = config.plugins;
+    if (plugins != null && !mapping(plugins))
+        throw new Error('Hermes home plugins must be a map');
+    if (mapping(plugins)) {
+        for (const gate of ['enabled', 'disabled']) {
+            const names = plugins[gate];
+            if (Array.isArray(names) && names.some(hasNativeInterpolation))
+                throw new Error('Hermes plugins.enabled/disabled do not support interpolation in a Fleet-managed home; provision literal plugin names with the role stopped');
+        }
+    }
+    const enabled = mapping(plugins) && Array.isArray(plugins.enabled) && plugins.enabled.every(x => typeof x === 'string') ? plugins.enabled : undefined;
+    const disabled = mapping(plugins) && Array.isArray(plugins.disabled) ? plugins.disabled : [];
+    if (enabled?.length === 0)
+        return;
+    const scan = (directory, prefix = '', depth = 0) => {
+        const info = stat(directory);
+        if (!info)
+            return;
+        if (info.isSymbolicLink() || !info.isDirectory())
+            throw new Error(`Hermes plugins directory must be a non-symlink directory: ${directory}`);
+        for (const entry of readdirSync(directory, { withFileTypes: true })) {
+            if (entry.isSymbolicLink())
+                throw new Error(`Hermes plugin paths must not be symlinks: ${join(directory, entry.name)}`);
+            if (!entry.isDirectory())
+                continue;
+            const root = join(directory, entry.name);
+            const key = prefix ? `${prefix}/${entry.name}` : entry.name;
+            const manifests = ['plugin.yaml', 'plugin.yml', 'plugin.json'];
+            const manifest = manifests.find(name => stat(join(root, name)));
+            if (!manifest) {
+                if (depth === 0)
+                    scan(root, key, 1);
+                continue;
+            }
+            regular(join(root, manifest));
+            const value = parseNativeFile(join(root, manifest));
+            const name = mapping(value) && typeof value.name === 'string' ? value.name : entry.name;
+            if (disabled.includes(key) || disabled.includes(name) || (enabled && !enabled.includes(key) && !enabled.includes(name)))
+                continue;
+            const mcpPath = join(root, 'mcp.json');
+            if (manifest === 'plugin.json' && regular(mcpPath)) {
+                const mcp = parseNativeFile(mcpPath);
+                if (!mapping(mcp) || !mapping(mcp.mcpServers) || Object.keys(mcp.mcpServers).length)
+                    throw new Error(`Disable MCP-providing agent plugin ${key} in ${join(home, 'config.yaml')}; declare MCP extras through Fleet`);
+            }
+        }
+    };
+    scan(join(home, 'plugins'));
+}
+export async function prepareHermesConfig(role, dirs) {
+    throwErrors(validateHermesRole(role));
+    const home = harnessRuntimeDir(dirs.stateDir, 'hermes');
+    privateDirectory(home);
+    const file = join(home, 'config.yaml');
+    const lock = `${file}.lock`;
+    const lockStat = stat(lock);
+    if (lockStat?.isSymbolicLink() || (lockStat && !lockStat.isDirectory()))
+        throw new Error(`Hermes configuration lock must be a non-symlink directory: ${lock}`);
+    await withFileLock(lock, () => {
+        const config = readConfig(file);
+        const model = managedMapping(config, 'model');
+        const approvals = managedMapping(config, 'approvals');
+        validateNativeCredentialOverrides(role, config, home);
+        validateHomeMcp(config, home);
+        config.model = { ...model, default: role.model };
+        config.approvals = { ...approvals, mode: 'manual' };
+        replaceFileAtomically(file, YAML.stringify(config), 0o600);
+    });
+    return { env: hermesChildEnvironment(role, home, { OURS_BIND_IDENTITY: role.identity }) };
+}

package/dist/harness/hermes-permissions.d.ts

@@ -0,0 +1,4 @@
+import type { CommonPermissions } from '../config.js';
+import type { PermissionTranslation } from './types.js';
+export declare function hermesPermissionMode(permissions: CommonPermissions): 'default' | 'accept_edits' | 'dont_ask';
+export declare function translateHermesPermissions(permissions: CommonPermissions): PermissionTranslation;

package/dist/harness/hermes-permissions.js

@@ -0,0 +1,36 @@
+export function hermesPermissionMode(permissions) {
+    if (permissions.approval === 'deny')
+        throw new Error('Hermes does not support legacy approval: deny');
+    const modes = { ask: 'default', auto: 'accept_edits', allow: 'dont_ask' };
+    const mode = modes[permissions.approval];
+    if (!mode)
+        throw new Error('Hermes approval must be ask, auto or allow');
+    return mode;
+}
+export function translateHermesPermissions(permissions) {
+    if (permissions.filesystem === 'read-only')
+        return { supported: false, reason: 'Hermes does not support read-only filesystem mode, including with Fleet isolation' };
+    if (!['workspace', 'unrestricted'].includes(permissions.filesystem))
+        return { supported: false, reason: 'Hermes filesystem must be workspace or unrestricted' };
+    let mode;
+    try {
+        mode = hermesPermissionMode(permissions);
+    }
+    catch (e) {
+        return { supported: false, reason: e.message };
+    }
+    const capabilities = ['read-state', 'messaging', 'monitor', 'status-commands'];
+    if (permissions.approval !== 'ask')
+        capabilities.push('write-state', 'workspace-edit');
+    return {
+        supported: true,
+        native: { permission_mode: mode, approvals_mode: 'manual' },
+        exact: false,
+        capabilities,
+        warnings: [
+            'Hermes modes mediate dangerous terminal commands and write_file/patch; browser, memory, skills, delegation and MCP side effects are not universally approval-mediated.',
+            'Unattended wait is bounded by Fleet’s 50-second permission timeout and the tested Hermes native 60-second dangerous-command timeout; protected-action floors remain active.',
+            ...(permissions.filesystem === 'workspace' ? ['Workspace confinement is an approximation unless enforcing Fleet isolation is verified on this platform.'] : []),
+        ],
+    };
+}