@ours.network/hermes 0.17.0-nightly.2 → 0.17.0-nightly.4

package/README.md

@@ -11,7 +11,7 @@ It mirrors the Claude Code plugin (`packages/claude-code`), adapted to Hermes:
    invites, contacts, send/read, files, control plane), in Hermes `SKILL.md`
    format, plus `writing-agent-bios`.
 3. **Reactivity** — in-session wake-on-mail: the agent tails
-   `ours-mcp watch <identity>` via its `terminal` tool (backgrounded) and drains
+   `ours-mcp watch --application hermes <identity>` via its `terminal` tool (backgrounded) and drains
    each new-mail line with `mcp_ours_get_messages`. No connector, no webhook, no
    secret — same stream Claude Code's native Monitor tails.
 
@@ -20,7 +20,7 @@ It mirrors the Claude Code plugin (`packages/claude-code`), adapted to Hermes:
 Wake-on-mail is **in-session**, driven by the agent itself — there is no webhook
 route, no HMAC secret, and no connector process. Once an identity is bound:
 
-- **WATCH**: the agent runs `ours-mcp watch <identity>` in the background via
+- **WATCH**: the agent runs `ours-mcp watch --application hermes <identity>` in the background via
   Hermes's `terminal` tool. This tails the same new-mail stream Claude Code's
   native Monitor tails; each new message emits a line.
 - **DRAIN**: on each new-mail line the agent reacts, draining the inbox with
@@ -65,7 +65,7 @@ Wake-on-mail is enabled **in-session**, not by the installer. Once ours is insta
 
 1. In your Hermes agent, **bind (or create) an identity** via the `ours` skill.
 2. Ask the `ours` skill to **"wake me on new mail"**. The agent starts tailing
-   `ours-mcp watch <identity>` in the background via its `terminal` tool and reacts
+   `ours-mcp watch --application hermes <identity>` in the background via its `terminal` tool and reacts
    to each new-mail line by draining with `mcp_ours_get_messages` (or, as a fallback,
    polls `get_messages` every ~5s while it's live). No route, no secret, no connector.
 
@@ -116,7 +116,7 @@ Then run **`/reload-mcp`** in Hermes so it loads the `mcp_ours_*` tools.
 3. `/reload-mcp` in Hermes.
 
 To get woken on new mail, ask the `ours` skill in-session to wake you: it tails
-`ours-mcp watch <identity>` via the `terminal` tool and drains with `get_messages`.
+`ours-mcp watch --application hermes <identity>` via the `terminal` tool and drains with `get_messages`.
 
 ## Verify
 

package/bin/hermes-config-install.mjs

@@ -23,7 +23,12 @@ const SENTINEL_END = '# <<< ours.network plugin';
 // could corrupt existing YAML.
 export function planConfigInstall(text) {
   const t = text ?? '';
-  if (t.includes(SENTINEL)) return { action: 'noop', reason: 'ours block already present' };
+  if (t.includes(SENTINEL)) {
+    if (!t.includes(SENTINEL_END)) return { action: 'manual', reason: 'ours managed block is incomplete' };
+    return t.includes('--application') && t.includes('hermes')
+      ? { action: 'noop', reason: 'ours block already present' }
+      : { action: 'replace', reason: 'migrate the managed block to its durable daemon association' };
+  }
   if (!t.trim()) return { action: 'write', reason: 'no existing config' };
   if (/^mcp_servers:/m.test(t)) {
     return {
@@ -42,7 +47,7 @@ export function renderConfigBlock() {
 mcp_servers:
   ours:
     command: "ours-mcp"
-    args: ["proxy"]
+    args: ["proxy", "--application", "hermes"]
     enabled: true
 ${SENTINEL_END}
 `;
@@ -67,9 +72,13 @@ function main() {
     process.exitCode = 3;
     return;
   }
-  const next = plan.action === 'write' ? block : existing.replace(/\s*$/, '\n\n') + block;
+  const next = plan.action === 'write' ? block
+    : plan.action === 'replace'
+      ? existing.replace(new RegExp(`${SENTINEL.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}[\\s\\S]*?${SENTINEL_END.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\n?`), block)
+      : existing.replace(/\s*$/, '\n\n') + block;
   writeFileSync(cfgPath, next);
-  console.log(`ours: ${plan.action === 'write' ? 'wrote' : 'appended ours block to'} ${cfgPath}. Run /reload-mcp in Hermes.`);
+  const verb = plan.action === 'write' ? 'wrote' : plan.action === 'replace' ? 'updated ours block in' : 'appended ours block to';
+  console.log(`ours: ${verb} ${cfgPath}. Run /reload-mcp in Hermes.`);
 }
 
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) main();

package/config/ours.mcp.example.yaml

@@ -12,5 +12,5 @@
 mcp_servers:
   ours:
     command: "ours-mcp"
-    args: ["proxy"]
+    args: ["proxy", "--application", "hermes"]
     enabled: true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/hermes",
-  "version": "0.17.0-nightly.2",
+  "version": "0.17.0-nightly.4",
   "description": "Hermes (Nous Research) plugin for ours — secure agent-to-agent messaging over ADAPT. Registers the ours MCP server, bundles the ours skill, and wires in-session wake-on-mail via `ours-mcp watch` (no webhook, no external watcher).",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",

package/skills/ours/SKILL.md

@@ -100,7 +100,7 @@ Walk the user through these, checking each. Stop and help at the first one that
 4. **Connect.** Generate an invite to share, or paste one to add a contact. Same-host
    identities skip invites via the local contact book.
 5. **(Optional) Wake on mail.** Wake is enabled **in-session by you**, after an identity is
-   bound: offer to enter **autonomous watch mode** — hold a blocking `ours-mcp watch <identity>`
+   bound: offer to enter **autonomous watch mode** — hold a blocking `ours-mcp watch --application hermes <identity>`
    via the `terminal` tool and react to each new message from that loop (see *Getting woken on new mail*
    below). **Be honest that this BLOCKS the session** (unlike Claude Code's background Monitor) —
    don't sell it as "just works". The installer never sets this up.
@@ -190,7 +190,7 @@ the bio, so a persona prompt is only needed if they want to role-play it).
 2. **Wake check.** The `choose_identity` / `create_identity` response may prompt you to "arm a
    message monitor" — that is the Claude-Code seam, and the intent is the same in Hermes: **you**
    enable wake in-session, right after binding, by entering **autonomous watch mode** (hold a
-   blocking `ours-mcp watch <identity>` and handle each message from that loop — see *Wake on new
+   blocking `ours-mcp watch --application hermes <identity>` and handle each message from that loop — see *Wake on new
    mail*). If the user wants live reactivity for the just-bound identity, offer to enter watch
    mode now.
 
@@ -364,7 +364,7 @@ When you bind an identity, offer the user, in plain language:
 
 > "Want this session to **auto-wake** when a new message arrives, or **check manually**?"
 
-- **Auto-wake** → arm the monitor: you hold a live `ours-mcp watch <id>` and react to each message as it arrives. **Be upfront:** while watching, this session is **busy** — you can't send it new prompts. To do something else: press **ESCAPE** to interrupt the watch, type your prompt, then ask it to **resume** watching. *(On Claude Code this same monitor runs non-blocking in the background — a Claude Code advantage.)*
+- **Auto-wake** → arm the monitor: you hold a live `ours-mcp watch --application hermes <id>` and react to each message as it arrives. **Be upfront:** while watching, this session is **busy** — you can't send it new prompts. To do something else: press **ESCAPE** to interrupt the watch, type your prompt, then ask it to **resume** watching. *(On Claude Code this same monitor runs non-blocking in the background — a Claude Code advantage.)*
 - **Manual** → don't arm it; ask it to check `get_messages` whenever you want. No blocking.
 
 ## Control plane — human oversight of a fleet
@@ -394,7 +394,7 @@ feature and still works; it is described above.
   event (sender + id + date) to `$OURS_STATE_DIR/<identity>/notifications.log` (the wake
   signal `ours-mcp watch` reads) and refreshes a body-free `unread.json`. Text lives in the
   packet and leaves it solely via `get_messages`.
-- **The wake signal is uniform.** `ours-mcp watch <identity>` is the common stream; each harness
+- **The wake signal is uniform.** `ours-mcp watch --application hermes <identity>` is Hermes' associated stream; each harness
   drives it in-session. Claude Code uses its native `Monitor` tool; **Hermes uses autonomous watch
   mode** — the agent holds a blocking `ours-mcp watch` via the `terminal` tool and reacts from that
   loop (see *Getting woken on new mail*). The ours daemon, identities, and tools are identical across

package/skills/ours/references/configuration.md

@@ -1,8 +1,9 @@
 # ours configuration & self-service
 
-The daemon is a **shared, host-wide singleton** reachable only on `127.0.0.1`
-(loopback — there is no host knob, by design). Configuration is resolved
-**env var > `~/.ours/config.json` > built-in default**:
+Each daemon is local-only on `127.0.0.1`. Nightly supports multiple isolated
+profiles. Hermes' managed MCP block runs `ours-mcp proxy --application hermes`,
+and documented watch commands use the same application. Resolution is
+**explicit env > Hermes' Nightly association > `~/.ours/config.json` > default**:
 
 | Setting | Env | config.json | Default |
 |---|---|---|---|
@@ -12,10 +13,9 @@ The daemon is a **shared, host-wide singleton** reachable only on `127.0.0.1`
 | GC interval (ms) | `OURS_GC_INTERVAL_MS` | `gcIntervalMs` | `3600000` |
 | Auto-start daemon | `OURS_AUTOSTART` | `autoStart` | `false` |
 
-**The port is shared.** Every process that dials the daemon — the `ours-mcp proxy` MCP
-server and `ours-mcp watch` — connects to `127.0.0.1:<OURS_PORT>`, and the daemon binds the
-same port (both read `OURS_PORT`/`config.json`). Change it **once in shared config**, never
-per-side, or a dialer won't find the daemon.
+Registry/config/daemon state drift and protected-auth failures stop rather than falling back.
+Explicit `OURS_CONFIG`, `OURS_PORT`, and `OURS_STATE_DIR` still win. Never add a duplicate ours
+MCP registration; reload the installer-managed block instead.
 
 **Changing config (consent-first — never on your own initiative):**
 - Interactive: `ours-mcp config` (a survey). It needs a TTY, so ask the **user**