@rudderhq/agent-runtime-hermes-gateway 0.7.2

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export declare const type = "hermes_gateway";
+export declare const label = "Hermes API Server";
+export declare const models: {
+    id: string;
+    label: string;
+}[];
+export declare const agentConfigurationDoc = "# hermes_gateway agent configuration\n\nAdapter: hermes_gateway\n\nUse when Rudder should invoke a running Hermes API Server over HTTP.\n\nCore fields:\n- url (string, required): Hermes API Server base URL (http:// or https://)\n- apiKey/authToken/token (string, optional): API_SERVER_KEY bearer token\n- model (string, optional): Hermes model or configured model route alias\n- timeoutSec (number, optional): total run budget (default 120)\n- sessionKeyStrategy (issue|fixed|run, optional): upstream Hermes session mapping\n- sessionKey (string, optional): fixed session key when strategy=fixed\n- payloadTemplate (object, optional): extra /v1/runs fields\n\nHermes tool and approval events are projected into Rudder as bounded\nsynthetic_tool_continuity evidence. They are never labeled native or lossless.\n";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,IAAI,mBAAmB,CAAC;AACrC,eAAO,MAAM,KAAK,sBAAsB,CAAC;AACzC,eAAO,MAAM,MAAM,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAO,CAAC;AAE1D,eAAO,MAAM,qBAAqB,+yBAiBjC,CAAC"}

package/dist/index.js

@@ -0,0 +1,22 @@
+export const type = "hermes_gateway";
+export const label = "Hermes API Server";
+export const models = [];
+export const agentConfigurationDoc = `# hermes_gateway agent configuration
+
+Adapter: hermes_gateway
+
+Use when Rudder should invoke a running Hermes API Server over HTTP.
+
+Core fields:
+- url (string, required): Hermes API Server base URL (http:// or https://)
+- apiKey/authToken/token (string, optional): API_SERVER_KEY bearer token
+- model (string, optional): Hermes model or configured model route alias
+- timeoutSec (number, optional): total run budget (default 120)
+- sessionKeyStrategy (issue|fixed|run, optional): upstream Hermes session mapping
+- sessionKey (string, optional): fixed session key when strategy=fixed
+- payloadTemplate (object, optional): extra /v1/runs fields
+
+Hermes tool and approval events are projected into Rudder as bounded
+synthetic_tool_continuity evidence. They are never labeled native or lossless.
+`;
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,IAAI,GAAG,gBAAgB,CAAC;AACrC,MAAM,CAAC,MAAM,KAAK,GAAG,mBAAmB,CAAC;AACzC,MAAM,CAAC,MAAM,MAAM,GAAoC,EAAE,CAAC;AAE1D,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;CAiBpC,CAAC"}

package/dist/server/execute.d.ts

@@ -0,0 +1,3 @@
+import type { AgentRuntimeExecutionContext, AgentRuntimeExecutionResult } from "@rudderhq/agent-runtime-utils";
+export declare function execute(ctx: AgentRuntimeExecutionContext): Promise<AgentRuntimeExecutionResult>;
+//# sourceMappingURL=execute.d.ts.map

package/dist/server/execute.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execute.d.ts","sourceRoot":"","sources":["../../src/server/execute.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AA2R/G,wBAAsB,OAAO,CAAC,GAAG,EAAE,4BAA4B,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAiWrG"}

package/dist/server/execute.js

@@ -0,0 +1,610 @@
+import { asNumber, asString, parseObject } from "@rudderhq/agent-runtime-utils/server-utils";
+import { createHash } from "node:crypto";
+import { asRecord, baseUrl, endpoint, hasBearerAuth, positiveMs, preflightBaseUrl, requestHeaders, requestJson, textFrom } from "./http.js";
+const MAX_PROJECTED_EVENTS = 200;
+const MAX_PROJECTED_EVENT_BYTES = 64 * 1024;
+const MAX_PROJECTED_CONTEXT_BYTES = 512 * 1024;
+const MAX_PROJECTED_TOKENS = 32_000;
+const MAX_SAFE_EVENT_TEXT = MAX_PROJECTED_EVENT_BYTES;
+const STOP_RECONCILIATION_MS = 1_500;
+function sessionKey(ctx) {
+    const config = parseObject(ctx.config);
+    const configured = asString(config.sessionKey, "").trim();
+    const strategy = asString(config.sessionKeyStrategy, "issue").trim().toLowerCase();
+    const issueId = asString(ctx.context.issueId ?? ctx.context.taskId, "").trim();
+    if (strategy === "run")
+        return `rudder:run:${ctx.runId}`;
+    if (strategy === "fixed" && configured)
+        return configured;
+    if (issueId)
+        return `rudder:issue:${issueId}`;
+    return configured || `rudder:run:${ctx.runId}`;
+}
+function storedSessionId(ctx) {
+    const runtimeParams = parseObject(ctx.runtime.sessionParams);
+    const configured = asString(runtimeParams.hermesSessionId ?? runtimeParams.sessionId, "").trim();
+    return configured || asString(ctx.runtime.sessionId, "").trim() || null;
+}
+function responseSessionId(body) {
+    const session = asRecord(body.session);
+    const id = asString(session?.id ?? body.id ?? body.session_id, "").trim();
+    return id || null;
+}
+async function resolveHermesSession(params) {
+    let providerSessionId = storedSessionId(params.ctx);
+    let created = false;
+    if (providerSessionId) {
+        const current = await requestJson(endpoint(params.base, `/api/sessions/${encodeURIComponent(providerSessionId)}`), params.config, {}, params.requestTimeout);
+        if (!current.response.ok) {
+            throw new Error(`Hermes session mapping could not be read (HTTP ${current.response.status}).`);
+        }
+        const returnedId = responseSessionId(current.body);
+        if (!returnedId || returnedId !== providerSessionId) {
+            throw new Error("Hermes session mapping returned a conflicting provider ID.");
+        }
+    }
+    else {
+        const createdResponse = await requestJson(endpoint(params.base, "/api/sessions"), params.config, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+                source: "rudder",
+                ...(params.model ? { model: params.model } : {}),
+            }),
+        }, params.requestTimeout);
+        if (!createdResponse.response.ok) {
+            throw new Error(`Hermes session mapping could not be created (HTTP ${createdResponse.response.status}).`);
+        }
+        providerSessionId = responseSessionId(createdResponse.body);
+        if (!providerSessionId) {
+            throw new Error("Hermes session creation did not return a provider session ID.");
+        }
+        created = true;
+    }
+    const messages = await requestJson(endpoint(params.base, `/api/sessions/${encodeURIComponent(providerSessionId)}/messages`), params.config, {}, params.requestTimeout);
+    if (!messages.response.ok) {
+        throw new Error(`Hermes session messages could not be read (HTTP ${messages.response.status}).`);
+    }
+    const messageData = Array.isArray(messages.body.data) ? messages.body.data : [];
+    const returnedMessageSessionId = asString(messages.body.session_id, "").trim();
+    if (returnedMessageSessionId && returnedMessageSessionId !== providerSessionId) {
+        throw new Error("Hermes session messages returned a conflicting provider ID.");
+    }
+    return { providerSessionId, messageCount: messageData.length, created };
+}
+function shortHash(value) {
+    return createHash("sha256").update(JSON.stringify(value)).digest("hex");
+}
+function boundedText(value) {
+    const text = textFrom(value);
+    return text ? text.slice(0, MAX_SAFE_EVENT_TEXT) : null;
+}
+function buildToolContextProjection(ctx, sessionId) {
+    const raw = Array.isArray(ctx.context.rudderToolContext)
+        ? ctx.context.rudderToolContext
+        : Array.isArray(ctx.context.transcript)
+            ? ctx.context.transcript
+            : [];
+    const source = raw.slice(0, MAX_PROJECTED_EVENTS).map((entry) => asRecord(entry) ?? {});
+    const ids = new Set();
+    const projected = source.map((entry, index) => {
+        const kind = asString(entry.kind ?? entry.type ?? entry.event, "event").trim().slice(0, 64);
+        const toolCallId = asString(entry.toolCallId ?? entry.tool_call_id ?? entry.id, "").trim().slice(0, 160) || null;
+        if (kind === "tool_call" && toolCallId)
+            ids.add(toolCallId);
+        const content = textFrom(entry.content ?? entry.text ?? entry.output) ?? "";
+        return {
+            index,
+            kind,
+            tool: asString(entry.tool ?? entry.name, "").trim().slice(0, 160) || null,
+            toolCallId,
+            approvalId: asString(entry.approvalId ?? entry.approval_id, "").trim().slice(0, 160) || null,
+            status: asString(entry.status, "").trim().slice(0, 64) || null,
+            contentHash: shortHash(boundedText(content) ?? ""),
+            contentBytes: Buffer.byteLength(content, "utf8"),
+        };
+    });
+    const unpaired = projected.some((entry) => (entry.kind === "tool_result" || entry.kind === "approval") && entry.toolCallId && !ids.has(entry.toolCallId));
+    const projection = {
+        version: "RUDDER_TOOL_CONTEXT_V1",
+        sessionId,
+        transcriptHash: shortHash(projected),
+        events: projected,
+    };
+    const serialized = JSON.stringify(projection);
+    const projectedBytes = Buffer.byteLength(serialized, "utf8");
+    const refusal = raw.length > MAX_PROJECTED_EVENTS
+        ? "canonical tool context exceeds the 200-event limit"
+        : projected.some((entry) => entry.contentBytes > MAX_PROJECTED_EVENT_BYTES)
+            ? "a canonical event exceeds the 64 KiB per-event limit"
+            : projectedBytes > MAX_PROJECTED_CONTEXT_BYTES
+                ? "bounded tool context exceeds the 512 KiB aggregate limit"
+                : Math.ceil(projectedBytes / 4) > MAX_PROJECTED_TOKENS
+                    ? "bounded tool context exceeds the 32,000-token estimate"
+                    : unpaired
+                        ? "causal tool/approval pairing is incomplete"
+                        : null;
+    const bounded = refusal ? JSON.stringify({ version: "RUDDER_TOOL_CONTEXT_V1", sessionId, transcriptHash: shortHash([]), events: [] }) : serialized;
+    return {
+        text: `\n\nRUDDER_TOOL_CONTEXT_V1\n${bounded}`,
+        hash: shortHash(bounded),
+        eventCount: refusal ? 0 : projected.length,
+        refusal,
+    };
+}
+function runMessage(ctx, toolContext) {
+    const context = ctx.context;
+    const chatPrompt = context.chatMode === true ? asString(context.chatPrompt, "").trim() : "";
+    if (chatPrompt)
+        return `${chatPrompt}${toolContext}`;
+    const reason = asString(context.wakeReason, "manual");
+    const issueId = asString(context.issueId ?? context.taskId, "");
+    return [
+        "Rudder wake event for Hermes API Server.",
+        `run_id=${ctx.runId}`,
+        `agent_id=${ctx.agent.id}`,
+        `wake_reason=${reason}`,
+        issueId ? `issue_id=${issueId}` : null,
+        "Use the authenticated Rudder context for this run and return a concise result.",
+    ].filter(Boolean).join("\n") + toolContext;
+}
+function terminalStatus(status) {
+    return ["completed", "failed", "cancelled", "stopped", "error"].includes(status.toLowerCase());
+}
+function statusFromTerminalEvent(event) {
+    const kind = asString(event?.event, "");
+    if (kind === "run.completed")
+        return "completed";
+    if (kind === "run.failed")
+        return "failed";
+    if (kind === "run.cancelled")
+        return "cancelled";
+    return null;
+}
+function eventText(event) {
+    return textFrom(event.delta) ?? textFrom(event.output) ?? textFrom(event.content) ?? textFrom(event.message);
+}
+function usageFrom(value) {
+    const record = asRecord(value);
+    if (!record)
+        return undefined;
+    const inputTokens = asNumber(record.input_tokens ?? record.inputTokens, 0);
+    const outputTokens = asNumber(record.output_tokens ?? record.outputTokens, 0);
+    return inputTokens || outputTokens ? { inputTokens, outputTokens } : undefined;
+}
+function safeEvent(event) {
+    return {
+        event: asString(event.event, "event").slice(0, 80),
+        run_id: asString(event.run_id, "").slice(0, 120) || undefined,
+        tool: asString(event.tool ?? event.name, "").slice(0, 160) || undefined,
+        tool_call_id: asString(event.tool_call_id ?? event.call_id, "").slice(0, 160) || undefined,
+        approval_id: asString(event.approval_id ?? event.approvalId, "").slice(0, 160) || undefined,
+        status: asString(event.status, "").slice(0, 64) || undefined,
+        choice: asString(event.choice, "").slice(0, 32) || undefined,
+        deltaHash: event.delta !== undefined ? shortHash(boundedText(event.delta) ?? "") : undefined,
+        outputHash: event.output !== undefined ? shortHash(boundedText(event.output) ?? "") : undefined,
+    };
+}
+function boundedLogText(value) {
+    return typeof value === "string" ? value.slice(0, MAX_SAFE_EVENT_TEXT) : undefined;
+}
+function transcriptLogEvent(event) {
+    return {
+        ...safeEvent(event),
+        // Keep transcript text available while bounding each field independently.
+        // The result projection above remains hash-only.
+        delta: boundedLogText(event.delta),
+        output: boundedLogText(event.output),
+        content: boundedLogText(event.content),
+        message: boundedLogText(event.message),
+        error: boundedLogText(event.error),
+    };
+}
+async function consumeSse(response, onEvent) {
+    if (!response.body)
+        return { malformed: true };
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = "";
+    let malformed = false;
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        buffer += decoder.decode(value, { stream: true });
+        const lines = buffer.split(/\r?\n/);
+        buffer = lines.pop() ?? "";
+        for (const line of lines) {
+            if (!line.startsWith("data:"))
+                continue;
+            const raw = line.slice(5).trim();
+            if (!raw)
+                continue;
+            try {
+                const parsed = JSON.parse(raw);
+                const event = asRecord(parsed);
+                if (event)
+                    await onEvent(event);
+            }
+            catch {
+                // Ignore malformed keepalive/application fragments; terminal status is
+                // reconciled with GET /v1/runs below.
+                malformed = true;
+            }
+        }
+    }
+    if (buffer.trim())
+        malformed = true;
+    return { malformed };
+}
+export async function execute(ctx) {
+    const config = parseObject(ctx.config);
+    const base = baseUrl(config.url);
+    if (!base)
+        return { exitCode: 1, signal: null, timedOut: false, errorMessage: "Hermes API Server URL is missing or invalid.", errorCode: "hermes_gateway_url_invalid" };
+    const endpointPreflight = await preflightBaseUrl(base);
+    if (!endpointPreflight.ok)
+        return { exitCode: 1, signal: null, timedOut: false, errorMessage: endpointPreflight.reason, errorCode: "hermes_gateway_endpoint_rejected" };
+    if (!hasBearerAuth(config))
+        return { exitCode: 1, signal: null, timedOut: false, errorMessage: "Hermes API Server requires an explicit Bearer API key.", errorCode: "hermes_gateway_bearer_missing" };
+    const timeoutMs = positiveMs(config.timeoutMs ?? (asNumber(config.timeoutSec, 120) * 1000), 120_000);
+    const requestTimeout = Math.min(timeoutMs, 15_000);
+    const template = parseObject(config.payloadTemplate);
+    const workstreamKey = sessionKey(ctx);
+    const preliminaryToolContext = buildToolContextProjection(ctx, workstreamKey);
+    if (preliminaryToolContext.refusal) {
+        return {
+            exitCode: 1,
+            signal: null,
+            timedOut: false,
+            errorMessage: `Hermes tool context refused: ${preliminaryToolContext.refusal}.`,
+            errorCode: "hermes_gateway_continuity_refused",
+            resultJson: {
+                synthetic_tool_continuity: {
+                    mode: "synthetic_tool_continuity",
+                    native: false,
+                    lossless: false,
+                    projectionVersion: "RUDDER_TOOL_CONTEXT_V1",
+                    refusal: preliminaryToolContext.refusal,
+                },
+            },
+        };
+    }
+    let session;
+    try {
+        session = await resolveHermesSession({
+            base,
+            config,
+            ctx,
+            model: asString(config.model, "").trim(),
+            requestTimeout,
+        });
+    }
+    catch (error) {
+        return {
+            exitCode: 1,
+            signal: null,
+            timedOut: false,
+            errorMessage: error instanceof Error ? error.message : "Hermes session mapping failed.",
+            errorCode: "hermes_gateway_session_mapping_failed",
+            resultJson: { sessionMapping: { mode: "hermes_sessions_api_v1", verified: false } },
+        };
+    }
+    const toolContext = buildToolContextProjection(ctx, session.providerSessionId);
+    if (toolContext.refusal) {
+        return {
+            exitCode: 1,
+            signal: null,
+            timedOut: false,
+            errorMessage: `Hermes tool context refused: ${toolContext.refusal}.`,
+            errorCode: "hermes_gateway_continuity_refused",
+            sessionParams: { sessionId: session.providerSessionId, hermesSessionId: session.providerSessionId },
+            sessionDisplayId: session.providerSessionId,
+            resultJson: {
+                synthetic_tool_continuity: {
+                    mode: "synthetic_tool_continuity",
+                    native: false,
+                    lossless: false,
+                    projectionVersion: "RUDDER_TOOL_CONTEXT_V1",
+                    refusal: toolContext.refusal,
+                },
+            },
+        };
+    }
+    const input = runMessage(ctx, toolContext.text);
+    const body = {
+        ...template,
+        input,
+        session_id: session.providerSessionId,
+        idempotency_key: ctx.runId,
+        ...(asString(config.model, "").trim() ? { model: asString(config.model, "").trim() } : {}),
+    };
+    delete body.message;
+    if (ctx.onMeta) {
+        await ctx.onMeta({ agentRuntimeType: "hermes_gateway", command: "hermes-api", commandArgs: ["POST", endpoint(base, "/v1/runs").toString()], context: ctx.context });
+    }
+    await ctx.onLog("stdout", `[hermes-gateway] submitting run upstream=hermes-api base=${base.origin}\n`);
+    let upstreamRunId = null;
+    let stopSent = false;
+    let stopStartedAt = null;
+    let stopRequestAccepted = false;
+    let stopRequestError = null;
+    const stopUpstream = async () => {
+        if (!upstreamRunId)
+            return false;
+        if (stopSent)
+            return stopRequestAccepted;
+        stopSent = true;
+        stopStartedAt = Date.now();
+        try {
+            const response = await requestJson(endpoint(base, `/v1/runs/${encodeURIComponent(upstreamRunId)}/stop`), config, { method: "POST", body: JSON.stringify({ reason: "rudder_abort" }), headers: { "content-type": "application/json" } }, requestTimeout);
+            stopRequestAccepted = response.response.ok && ["stopping", "cancelled", "stopped"].includes(asString(response.body.status, "").toLowerCase());
+            if (!stopRequestAccepted)
+                stopRequestError = `HTTP ${response.response.status}`;
+            await ctx.onLog("stdout", `[hermes-gateway] stop requested upstreamRunId=${upstreamRunId} accepted=${stopRequestAccepted}\n`);
+        }
+        catch (error) {
+            stopRequestError = error instanceof Error ? error.message : String(error);
+            await ctx.onLog("stderr", `[hermes-gateway] stop request failed upstreamRunId=${upstreamRunId}\n`);
+        }
+        return stopRequestAccepted;
+    };
+    const abortHandler = () => { void stopUpstream(); };
+    ctx.abortSignal?.addEventListener("abort", abortHandler, { once: true });
+    const started = await requestJson(endpoint(base, "/v1/runs"), config, { method: "POST", headers: { "content-type": "application/json", "x-hermes-session-key": workstreamKey }, body: JSON.stringify(body) }, requestTimeout);
+    if (!started.response.ok) {
+        ctx.abortSignal?.removeEventListener("abort", abortHandler);
+        const message = textFrom(started.body) ?? `Hermes run submission returned HTTP ${started.response.status}`;
+        return { exitCode: 1, signal: null, timedOut: false, errorMessage: message, errorCode: "hermes_gateway_submission_failed", resultJson: started.body };
+    }
+    upstreamRunId = asString(started.body.run_id ?? started.body.id, "").trim() || null;
+    if (!upstreamRunId) {
+        ctx.abortSignal?.removeEventListener("abort", abortHandler);
+        return { exitCode: 1, signal: null, timedOut: false, errorMessage: "Hermes API Server did not return a run_id.", errorCode: "hermes_gateway_submission_indeterminate", resultJson: started.body };
+    }
+    await ctx.onLog("stdout", `[hermes-gateway] run accepted upstreamRunId=${upstreamRunId}\n`);
+    let controlLease = null;
+    if (ctx.controlAttempt) {
+        controlLease = await ctx.controlAttempt.register({
+            runtimeType: "hermes_gateway",
+            providerThreadId: session.providerSessionId,
+            providerTurnId: upstreamRunId,
+            capabilities: { steer: "interrupt_continue", interrupt: "remote" },
+            async steer() {
+                return { disposition: "unsupported", reason: "Hermes Runs does not expose native steer." };
+            },
+            async interrupt() {
+                return (await stopUpstream()) ? "acknowledged" : "unverified";
+            },
+            async dispose() { },
+        });
+        if (!controlLease) {
+            await stopUpstream();
+            ctx.abortSignal?.removeEventListener("abort", abortHandler);
+            return { exitCode: 1, signal: null, timedOut: false, errorMessage: "Hermes runtime control lease was lost.", errorCode: "hermes_gateway_control_lost", sessionParams: { sessionId: session.providerSessionId, hermesSessionId: session.providerSessionId }, sessionDisplayId: session.providerSessionId };
+        }
+    }
+    const startedAt = Date.now();
+    const events = [];
+    const assistant = [];
+    let latestStatus = { ...started.body };
+    let terminalEvent = null;
+    let sseConnected = false;
+    let sseMalformed = false;
+    let sseError = null;
+    let approvalPending = false;
+    let approvalResolved = false;
+    let approvalError = null;
+    let approvalDecision = null;
+    let rudderApprovalId = null;
+    const approvalChoice = (value) => {
+        const normalized = asString(value, "").trim().toLowerCase();
+        if (["approved", "approve", "allow", "once"].includes(normalized))
+            return "once";
+        if (["deny", "denied", "rejected", "reject"].includes(normalized))
+            return "deny";
+        return null;
+    };
+    const resolveApproval = async (requestedChoice) => {
+        const choice = requestedChoice ?? approvalChoice(ctx.context.approvalStatus);
+        if (!choice)
+            return;
+        const response = await requestJson(endpoint(base, `/v1/runs/${encodeURIComponent(upstreamRunId)}/approval`), config, { method: "POST", body: JSON.stringify({ choice }), headers: { "content-type": "application/json" } }, requestTimeout);
+        if (!response.response.ok)
+            throw new Error(`Hermes approval returned HTTP ${response.response.status}`);
+        approvalResolved = true;
+        approvalDecision = choice;
+        await ctx.onLog("stdout", `[hermes-gateway] approval resolved upstreamRunId=${upstreamRunId} choice=${choice}\n`);
+    };
+    const recordEvent = async (event) => {
+        if (events.length < MAX_PROJECTED_EVENTS)
+            events.push(event);
+        const kind = asString(event.event, "event");
+        await ctx.onLog("stdout", `[hermes-gateway:event] run=${upstreamRunId} type=${kind} data=${JSON.stringify(transcriptLogEvent(event))}\n`);
+        // Preserve leading/trailing whitespace in streaming deltas. `textFrom`
+        // intentionally trims ordinary result fields, but trimming each delta
+        // corrupts word boundaries when Hermes splits a sentence across events.
+        const text = kind === "message.delta" && typeof event.delta === "string"
+            ? event.delta
+            : eventText(event);
+        if (kind === "message.delta" && text)
+            assistant.push(text);
+        if (["run.completed", "run.failed", "run.cancelled"].includes(kind))
+            terminalEvent = event;
+        if (kind === "approval.request") {
+            approvalPending = true;
+            try {
+                const configuredChoice = approvalChoice(ctx.context.approvalStatus);
+                if (configuredChoice) {
+                    await resolveApproval(configuredChoice);
+                }
+                else if (ctx.requestApproval && ctx.waitForApproval) {
+                    const request = await ctx.requestApproval({
+                        type: "agent_runtime",
+                        payload: {
+                            provider: "hermes",
+                            runtimeType: "hermes_gateway",
+                            upstreamRunId,
+                            sessionId: session.providerSessionId,
+                            event: safeEvent(event),
+                            choices: ["once", "deny"],
+                        },
+                    });
+                    rudderApprovalId = request.id;
+                    await ctx.onLog("stdout", `[hermes-gateway] Rudder approval requested id=${request.id} upstreamRunId=${upstreamRunId}\n`);
+                    const decision = await ctx.waitForApproval(request.id, timeoutMs);
+                    if (decision.status === "approved")
+                        await resolveApproval("once");
+                    else if (decision.status === "rejected")
+                        await resolveApproval("deny");
+                    else
+                        approvalError = "Hermes approval remained unresolved before the bounded wait expired.";
+                }
+                else {
+                    approvalError = "Hermes approval is pending and no Rudder approval bridge is available.";
+                }
+            }
+            catch (error) {
+                approvalError = error instanceof Error ? error.message : String(error);
+            }
+            await ctx.onLog("stderr", `[hermes-gateway] approval required upstreamRunId=${upstreamRunId} resolved=${approvalResolved}\n`);
+        }
+    };
+    try {
+        const sseController = new AbortController();
+        const abortSse = () => sseController.abort();
+        ctx.abortSignal?.addEventListener("abort", abortSse, { once: true });
+        const sseTimer = setTimeout(() => sseController.abort(), timeoutMs);
+        try {
+            const sse = await fetch(endpoint(base, `/v1/runs/${encodeURIComponent(upstreamRunId)}/events`), { headers: requestHeaders(config), redirect: "error", signal: sseController.signal });
+            if (sse.ok) {
+                sseConnected = true;
+                const stream = await consumeSse(sse, recordEvent);
+                sseMalformed = stream.malformed;
+            }
+            else {
+                sseError = `events_http_${sse.status}`;
+                await ctx.onLog("stderr", `[hermes-gateway] events endpoint returned HTTP ${sse.status}; reconciling status\n`);
+            }
+        }
+        finally {
+            clearTimeout(sseTimer);
+            ctx.abortSignal?.removeEventListener("abort", abortSse);
+        }
+    }
+    catch (error) {
+        sseError = error instanceof Error ? error.message : "events_stream_failed";
+        await ctx.onLog("stderr", `[hermes-gateway] events stream ended: ${error instanceof Error ? error.message : String(error)}\n`);
+    }
+    // Hermes emits the terminal lifecycle event before closing the SSE stream,
+    // while the initial POST response intentionally remains `started`. Preserve
+    // that authoritative terminal observation so a completed run cannot fall
+    // through to the bounded timeout loop when the status GET races the stream.
+    const observedTerminalEvent = terminalEvent;
+    const eventStatus = statusFromTerminalEvent(observedTerminalEvent);
+    if (eventStatus && !terminalStatus(asString(latestStatus.status, ""))) {
+        latestStatus = {
+            ...latestStatus,
+            status: eventStatus,
+            ...(observedTerminalEvent?.output !== undefined ? { output: observedTerminalEvent.output } : {}),
+            ...(observedTerminalEvent?.error !== undefined ? { error: observedTerminalEvent.error } : {}),
+            ...(observedTerminalEvent?.usage !== undefined ? { usage: observedTerminalEvent.usage } : {}),
+        };
+    }
+    const reconciliationDeadline = () => stopSent && stopStartedAt ? stopStartedAt + STOP_RECONCILIATION_MS : startedAt + timeoutMs;
+    while (!terminalStatus(asString(latestStatus.status, "")) && Date.now() < reconciliationDeadline()) {
+        if (ctx.abortSignal?.aborted) {
+            await stopUpstream();
+        }
+        await new Promise((resolve) => setTimeout(resolve, 250));
+        try {
+            const polled = await requestJson(endpoint(base, `/v1/runs/${encodeURIComponent(upstreamRunId)}`), config, {}, Math.min(requestTimeout, 5_000));
+            latestStatus = polled.body;
+            const status = asString(latestStatus.status, "");
+            if (terminalStatus(status))
+                break;
+        }
+        catch {
+            // Keep the last authenticated status and allow the bounded timeout to
+            // produce an honest indeterminate result.
+        }
+    }
+    ctx.abortSignal?.removeEventListener("abort", abortHandler);
+    await controlLease?.release();
+    if (!terminalStatus(asString(latestStatus.status, "")) && !stopSent) {
+        await stopUpstream();
+        while (!terminalStatus(asString(latestStatus.status, "")) && Date.now() < reconciliationDeadline()) {
+            await new Promise((resolve) => setTimeout(resolve, 250));
+            try {
+                const polled = await requestJson(endpoint(base, `/v1/runs/${encodeURIComponent(upstreamRunId)}`), config, {}, Math.min(requestTimeout, 5_000));
+                latestStatus = polled.body;
+            }
+            catch {
+                // Keep the last authenticated status; the final result records that cancellation was unverified.
+            }
+        }
+    }
+    const status = asString(latestStatus.status, "").toLowerCase();
+    const terminal = terminalEvent;
+    const output = assistant.join("").trim() || textFrom(terminal) || textFrom(latestStatus.output) || null;
+    const usage = usageFrom(terminal?.usage ?? latestStatus.usage);
+    const continuity = {
+        mode: "synthetic_tool_continuity",
+        native: false,
+        lossless: false,
+        projectionVersion: "RUDDER_TOOL_CONTEXT_V1",
+        maxEvents: MAX_PROJECTED_EVENTS,
+        maxEventBytes: MAX_PROJECTED_EVENT_BYTES,
+        maxAggregateBytes: MAX_PROJECTED_CONTEXT_BYTES,
+        maxTokenEstimate: MAX_PROJECTED_TOKENS,
+        eventCount: events.length,
+        toolContextHash: toolContext.hash,
+        projectedEventCount: toolContext.eventCount,
+    };
+    if (approvalPending && !approvalResolved && !approvalError) {
+        approvalError = "Hermes approval is pending and no Rudder approval decision was supplied.";
+    }
+    const resultJson = {
+        upstreamRunId,
+        status,
+        output,
+        events: events.map((event) => safeEvent(event)),
+        synthetic_tool_continuity: continuity,
+        sessionMapping: {
+            mode: "hermes_sessions_api_v1",
+            providerSessionId: session.providerSessionId,
+            created: session.created,
+            verified: true,
+            messageCount: session.messageCount,
+        },
+        control: { stopRequested: stopSent, stopAccepted: stopRequestAccepted, stopRequestError },
+        approval: { pending: approvalPending, resolved: approvalResolved, decision: approvalDecision, rudderApprovalId, error: approvalError },
+        eventCompleteness: {
+            status: terminalEvent
+                ? (sseMalformed ? "partial" : "complete")
+                : (sseConnected || sseError ? "partial" : "terminal_only"),
+            sseConnected,
+            terminalEventObserved: Boolean(terminalEvent),
+            malformedEvents: sseMalformed,
+            eventCount: events.length,
+            reason: sseError ?? (sseMalformed ? "malformed_sse_event" : terminalEvent ? null : "terminal_status_reconciled_without_terminal_event"),
+        },
+    };
+    if (approvalError) {
+        return { exitCode: 1, signal: null, timedOut: false, errorMessage: approvalError, errorCode: "hermes_gateway_approval_unresolved", sessionParams: { sessionId: session.providerSessionId, hermesSessionId: session.providerSessionId }, sessionDisplayId: session.providerSessionId, resultJson };
+    }
+    if (ctx.abortSignal?.aborted || stopSent || status === "cancelled" || status === "stopped") {
+        if (!terminalStatus(status) || !["cancelled", "stopped"].includes(status)) {
+            return { exitCode: 1, signal: "SIGTERM", timedOut: false, errorMessage: "Hermes stop was requested but terminal state was not verified.", errorCode: "hermes_gateway_cancel_unverified", sessionParams: { sessionId: session.providerSessionId, hermesSessionId: session.providerSessionId }, sessionDisplayId: session.providerSessionId, resultJson, ...(output ? { summary: output } : {}) };
+        }
+        return { exitCode: 1, signal: "SIGTERM", timedOut: false, errorMessage: "Hermes run stopped.", errorCode: "hermes_gateway_stopped", sessionParams: { sessionId: session.providerSessionId, hermesSessionId: session.providerSessionId }, sessionDisplayId: session.providerSessionId, resultJson, ...(output ? { summary: output } : {}) };
+    }
+    if (!terminalStatus(status) || Date.now() - startedAt >= timeoutMs) {
+        return { exitCode: 1, signal: null, timedOut: !stopSent, errorMessage: stopSent ? "Hermes stop was requested but terminal state was not verified." : `Hermes run timed out after ${timeoutMs}ms.`, errorCode: stopSent ? "hermes_gateway_cancel_unverified" : "hermes_gateway_timeout", sessionParams: { sessionId: session.providerSessionId, hermesSessionId: session.providerSessionId }, sessionDisplayId: session.providerSessionId, resultJson };
+    }
+    if (status !== "completed") {
+        return { exitCode: 1, signal: null, timedOut: false, errorMessage: textFrom(latestStatus.error) ?? `Hermes run ended with status ${status}.`, errorCode: "hermes_gateway_run_failed", sessionParams: { sessionId: session.providerSessionId, hermesSessionId: session.providerSessionId }, sessionDisplayId: session.providerSessionId, resultJson, ...(output ? { summary: output } : {}) };
+    }
+    return { exitCode: 0, signal: null, timedOut: false, provider: "hermes", model: asString(latestStatus.model, "") || null, ...(usage ? { usage } : {}), sessionParams: { sessionId: session.providerSessionId, hermesSessionId: session.providerSessionId }, sessionDisplayId: session.providerSessionId, resultJson, ...(output ? { summary: output } : {}) };
+}
+//# sourceMappingURL=execute.js.map