@runfusion/fusion 0.76.0-beta.3 → 0.77.0-beta.0

package/dist/plugins/fusion-plugin-hermes-runtime/bundled.js

@@ -5,6 +5,9 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/plugin-sdk-core-runtime-shim.mjs
+import { spawn } from "node:child_process";
+
 // ../../node_modules/.pnpm/drizzle-orm@0.45.2_@opentelemetry+api@1.9.0_better-sqlite3@12.9.0_pg@8.22.0_postgres@3.4.9/node_modules/drizzle-orm/entity.js
 var entityKind = Symbol.for("drizzle:entityKind");
 var hasOwnEntityKind = Symbol.for("drizzle:hasOwnEntityKind");
@@ -5776,7 +5779,9 @@ __export(project_exports, {
   workflowSettings: () => workflowSettings,
   workflowSteps: () => workflowSteps,
   workflowWorkItems: () => workflowWorkItems,
-  workflows: () => workflows
+  workflows: () => workflows,
+  workspaceCoordinationLeases: () => workspaceCoordinationLeases,
+  workspaceLandIntents: () => workspaceLandIntents
 });
 var projectSchema = pgSchema(PROJECT_SCHEMA);
 var tasks = projectSchema.table("tasks", {
@@ -6043,6 +6048,9 @@ var tasks = projectSchema.table("tasks", {
   the gate is a full tasks-table scan. Sparse: most rows have NULL parent.
   */
   index("idxTasksSourceParentTaskId").on(t.sourceParentTaskId),
+  /* FNXC:TaskRecommendations 2026-08-13-22:23: duplicate intake filters source
+   * lineage on recommendation/agent creates; this sparse index avoids a task-table scan. */
+  index("idxTasksProjectSourceAgentId").on(t.projectId, t.sourceAgentId).where(sql`${t.sourceAgentId} IS NOT NULL`),
   // FNXC:EphemeralAgentTaskCreation 2026-07-30-12:00: proposal retries share one stable key, so the database—not a read-before-create race—enforces at-most-once materialization.
   uniqueIndex("uqTasksProjectProposalClaimId").on(t.projectId, t.proposalClaimId).where(sql`${t.proposalClaimId} IS NOT NULL`),
   /*
@@ -6277,6 +6285,52 @@ var distributedTaskIdReservations = projectSchema.table("distributed_task_id_res
   index("idxDistributedTaskIdReservationsPrefixStatus").on(t.prefix, t.status),
   index("idxDistributedTaskIdReservationsExpiry").on(t.status, t.expiresAt)
 ]);
+var workspaceCoordinationLeases = projectSchema.table("workspace_coordination_leases", {
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
+  leaseKey: text("lease_key").notNull(),
+  kind: text("kind").notNull(),
+  ownerTaskId: text("owner_task_id").notNull(),
+  ownerNodeId: text("owner_node_id").notNull(),
+  ownerIncarnationId: text("owner_incarnation_id").notNull(),
+  ownerRunId: text("owner_run_id"),
+  fenceToken: bigint("fence_token", { mode: "bigint" }).notNull().default(sql`0`),
+  fenceRefName: text("fence_ref_name"),
+  fenceRefSha: text("fence_ref_sha"),
+  status: text("status").notNull(),
+  acquiredAt: text("acquired_at").notNull(),
+  renewedAt: text("renewed_at").notNull(),
+  expiresAt: text("expires_at").notNull(),
+  createdAt: text("created_at").notNull(),
+  updatedAt: text("updated_at").notNull()
+}, (t) => [
+  primaryKey({ columns: [t.projectId, t.leaseKey] }),
+  check("workspace_coordination_leases_kind_check", sql`${t.kind} IN ('acquire', 'land', 'merge-dispatch')`),
+  check("workspace_coordination_leases_status_check", sql`${t.status} IN ('held', 'released', 'expired')`),
+  index("idxWorkspaceCoordinationLeasesOwnerTask").on(t.projectId, t.ownerTaskId),
+  index("idxWorkspaceCoordinationLeasesOwnerNode").on(t.projectId, t.ownerNodeId),
+  index("idxWorkspaceCoordinationLeasesExpiry").on(t.status, t.expiresAt)
+]);
+var workspaceLandIntents = projectSchema.table("workspace_land_intents", {
+  projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
+  taskId: text("task_id").notNull(),
+  repoRelPath: text("repo_rel_path").notNull(),
+  remoteUrl: text("remote_url").notNull(),
+  integrationRef: text("integration_ref").notNull(),
+  intendedSha: text("intended_sha").notNull(),
+  expectedTip: text("expected_tip").notNull(),
+  fenceRefName: text("fence_ref_name").notNull(),
+  fenceRefSha: text("fence_ref_sha").notNull(),
+  ownerTaskId: text("owner_task_id").notNull(),
+  ownerNodeId: text("owner_node_id").notNull(),
+  ownerIncarnationId: text("owner_incarnation_id").notNull(),
+  fenceToken: bigint("fence_token", { mode: "bigint" }).notNull(),
+  status: text("status").notNull(),
+  resolvedSha: text("resolved_sha"),
+  resolution: text("resolution"),
+  createdAt: text("created_at").notNull(),
+  updatedAt: text("updated_at").notNull(),
+  resolvedAt: text("resolved_at")
+}, (t) => [primaryKey({ columns: [t.projectId, t.taskId, t.repoRelPath] }), check("workspace_land_intents_status_check", sql`${t.status} IN ('pending', 'recorded', 'abandoned')`), check("workspace_land_intents_resolution_check", sql`${t.resolution} IS NULL OR ${t.resolution} IN ('landed', 'not-landed')`), index("idxWorkspaceLandIntentsStatus").on(t.projectId, t.status)]);
 var symbolLocks = projectSchema.table("symbol_locks", {
   projectId: text("project_id").notNull().default(sql`current_setting('fusion.project_id', true)`),
   symbolKey: text("symbol_key").notNull(),
@@ -8851,6 +8905,11 @@ var DEFAULT_GLOBAL_SETTINGS = {
   Critical-action confirmation dialogs stay enabled by default. This global-only preference may opt an operator into primary/default auto-approval, but project settings cannot enable it for collaborators.
   */
   skipConfirmationDialogs: false,
+  /*
+  FNXC:QuickEntry 2026-08-16-03:15:
+  Quick Add keeps its historical Enter-to-submit behavior by default; only an operator's global preference may opt into newline-first entry.
+  */
+  quickAddSubmitOnEnter: true,
   language: void 0,
   defaultProvider: void 0,
   defaultCredentialInstanceId: void 0,
@@ -9313,9 +9372,6 @@ var DEFAULT_PROJECT_SETTINGS = {
    * New and unconfigured projects default AI merge to sync a dirty checked-out integration branch, restoring the legacy stash → fast-forward → restore landing behavior. Explicit persisted merger.allowDirtyLocalCheckoutSync values still win, and no existing-project migration stamps this default into storage.
    */
   merger: { mode: "ai", maxReviewPasses: 3, allowDirtyLocalCheckoutSync: true },
-  mergeDiffVolumeMinLines: void 0,
-  mergeDiffVolumeThreshold: void 0,
-  mergeDiffVolumeAllowlist: void 0,
   requiredChecks: void 0,
   mergeStrategyOverlapBehavior: "flip-to-prefer-branch",
   postMergeAuditMode: "warn",
@@ -16059,8 +16115,8 @@ async function resolveWorkflowIrById(store, workflowId, irCache) {
   } catch {
     projectId = void 0;
   }
-  const cacheKey = projectId ? `${workflowId}\0${projectId}` : workflowId;
-  const cached = irCache?.get(cacheKey);
+  const cacheKey2 = projectId ? `${workflowId}\0${projectId}` : workflowId;
+  const cached = irCache?.get(cacheKey2);
   if (cached) return cached;
   if (isBuiltinWorkflowId(workflowId)) {
     const builtin = getBuiltinWorkflow(workflowId);
@@ -16070,14 +16126,14 @@ async function resolveWorkflowIrById(store, workflowId, irCache) {
     const overrides = projectId ? await (store.getWorkflowPromptOverridesAsync?.(workflowId, projectId) ?? store.getWorkflowPromptOverrides?.(workflowId, projectId)) : void 0;
     const effective = applyPromptOverridesToIr(resolved, overrides);
     const answer = fellBackToDefault ? markFellBack(effective) : effective;
-    irCache?.set(cacheKey, answer);
+    irCache?.set(cacheKey2, answer);
     return answer;
   }
   try {
     const def = await store.getWorkflowDefinition(workflowId);
     if (!def) return markFellBack(defaultCodingWorkflowIr());
     const ir = typeof def.ir === "string" ? parseWorkflowIr(def.ir) : def.ir;
-    irCache?.set(cacheKey, ir);
+    irCache?.set(cacheKey2, ir);
     return ir;
   } catch {
     return markFellBack(defaultCodingWorkflowIr());
@@ -17966,10 +18022,6 @@ var AgentStore = class _AgentStore extends EventEmitter {
       };
       await this.writeAgent(updated);
       this.emit("agent:stateChanged", agentId, currentState, newState);
-      if (this.asyncLayer) try {
-        await appendAgentActivityEvent(this.asyncLayer, { type: "agent:state-changed", attributionClaim: resolveAgentActivityAttribution([{ id: agentId, provenance: "roster" }], "executor"), taskId: updated.taskId, occurredAt: updated.updatedAt, discriminator: updated.updatedAt, metadata: { fromState: currentState, toState: newState, source: "update" } });
-      } catch {
-      }
       this.emit("agent:updated", updated, currentState);
       return updated;
     });
@@ -18461,10 +18513,10 @@ var AgentStore = class _AgentStore extends EventEmitter {
     return agents2;
   }
   /*
-  FNXC:MemoryAgent 2026-08-11-09:41:
-  Memory Keeper is custom because it is not a workflow-stage principal. Unlike the four routed
-  owners its heartbeat is enabled, while auto-claim remains off because it only maintains memory.
-  This runs during init, where createAgent name collisions would abort startup; preflight probes,
+  FNXC:MemoryAgent 2026-08-16-02:31:
+  Memory Keeper is custom because it is not a workflow-stage principal. Its heartbeat defaults off
+  until an operator opts in, while auto-claim remains off because it only maintains memory. This
+  runs during init, where createAgent name collisions would abort startup; preflight probes,
   a fallback name, a null degraded result, and the init-side catch keep an operator's same-named
   agent untouched and the project runnable.
   */
@@ -18490,7 +18542,13 @@ var AgentStore = class _AgentStore extends EventEmitter {
             roles: [...BUILTIN_MEMORY_AGENT_DEFAULT.roles],
             title: BUILTIN_MEMORY_AGENT_DEFAULT.title,
             metadata: { [BUILTIN_MEMORY_AGENT_PROVENANCE_KEY]: true },
-            runtimeConfig: { enabled: true, autoClaimRelevantTasks: false, heartbeatIntervalMs: 36e5 },
+            /*
+            FNXC:MemoryAgent 2026-08-16-02:31:
+            Memory consolidation is opt-in: newly provisioned Memory Keepers must not begin
+            hourly autonomous heartbeats until an operator enables the existing heartbeat toggle.
+            Keep auto-claim off and the one-hour interval ready for that later opt-in.
+            */
+            runtimeConfig: { enabled: false, autoClaimRelevantTasks: false, heartbeatIntervalMs: 36e5 },
             instructionsText: BUILTIN_MEMORY_AGENT_DEFAULT.instructionsText,
             soul: BUILTIN_MEMORY_AGENT_DEFAULT.soul,
             bundleConfig: { ...BUILTIN_MEMORY_AGENT_DEFAULT.bundleConfig, files: [...BUILTIN_MEMORY_AGENT_DEFAULT.bundleConfig.files] }
@@ -18505,7 +18563,9 @@ var AgentStore = class _AgentStore extends EventEmitter {
         return owner;
       }
       const metadata = { ...owner.metadata ?? {}, [BUILTIN_MEMORY_AGENT_PROVENANCE_KEY]: true };
-      const runtimeConfig = { ...owner.runtimeConfig ?? {}, enabled: true, autoClaimRelevantTasks: false, heartbeatIntervalMs: 36e5 };
+      const currentRuntimeConfig = owner.runtimeConfig ?? {};
+      const enabled = typeof currentRuntimeConfig.enabled === "boolean" ? currentRuntimeConfig.enabled : false;
+      const runtimeConfig = currentRuntimeConfig.enabled === enabled && currentRuntimeConfig.autoClaimRelevantTasks === false && currentRuntimeConfig.heartbeatIntervalMs === DEFAULT_AGENT_HEARTBEAT_INTERVAL_MS ? currentRuntimeConfig : { ...currentRuntimeConfig, enabled, autoClaimRelevantTasks: false, heartbeatIntervalMs: DEFAULT_AGENT_HEARTBEAT_INTERVAL_MS };
       const updates = {
         roles: [...BUILTIN_MEMORY_AGENT_DEFAULT.roles],
         role: "custom",
@@ -18515,7 +18575,9 @@ var AgentStore = class _AgentStore extends EventEmitter {
         instructionsText: owner.instructionsText?.trim() ? owner.instructionsText : BUILTIN_MEMORY_AGENT_DEFAULT.instructionsText,
         soul: owner.soul?.trim() ? owner.soul : BUILTIN_MEMORY_AGENT_DEFAULT.soul
       };
-      owner = { ...owner, ...updates, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+      const nextOwner = { ...owner, ...updates };
+      if (JSON.stringify(nextOwner) === JSON.stringify(owner)) return owner;
+      owner = { ...nextOwner, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
       await this.writeAgent(owner, executor);
       return owner;
     };
@@ -19387,19 +19449,6 @@ var AgentStore = class _AgentStore extends EventEmitter {
         this.agentSnapshotCache.set(agent.id, this.watchSnapshotOf(agent));
         if (stateChanged) {
           this.emit("agent:stateChanged", agent.id, previousState, agent.state);
-          if (this.asyncLayer) {
-            try {
-              await appendAgentActivityEvent(this.asyncLayer, {
-                type: "agent:state-changed",
-                attributionClaim: resolveAgentActivityAttribution([{ id: agent.id, provenance: "roster" }], "executor"),
-                taskId: agent.taskId,
-                occurredAt: agent.updatedAt,
-                discriminator: agent.updatedAt,
-                metadata: { fromState: previousState, toState: agent.state, source: "reconciliation" }
-              });
-            } catch {
-            }
-          }
           this.emit("agent:updated", agent, previousState);
         } else {
           this.emit("agent:updated", agent);
@@ -19458,36 +19507,204 @@ var AgentStore = class _AgentStore extends EventEmitter {
   }
 };
 
+// src/plugin-sdk-core-runtime-shim.mjs
+function superviseSpawn(command, args = [], options = {}) {
+  const killGraceMs = options.killGraceMs ?? 2e3;
+  const maxLifetimeMs = options.maxLifetimeMs;
+  const spawnOptions = { ...options };
+  delete spawnOptions.killGraceMs;
+  delete spawnOptions.maxLifetimeMs;
+  const processGroup = globalThis.process.platform !== "win32";
+  const child = spawn(command, [...args], { ...spawnOptions, detached: processGroup });
+  const pgid = processGroup && typeof child.pid === "number" ? child.pid : null;
+  let settled = false;
+  let resolveExit;
+  const waitExit = new Promise((resolve3) => {
+    resolveExit = resolve3;
+  });
+  const killProcess = (signal = "SIGTERM") => {
+    if (typeof child.pid !== "number") return;
+    try {
+      if (pgid != null) globalThis.process.kill(-pgid, signal);
+      else child.kill(signal);
+    } catch {
+      try {
+        child.kill(signal);
+      } catch {
+      }
+    }
+  };
+  let lifetimeTimer = null;
+  if (typeof maxLifetimeMs === "number" && Number.isFinite(maxLifetimeMs) && maxLifetimeMs > 0) {
+    lifetimeTimer = globalThis.setTimeout(() => {
+      if (settled) return;
+      killProcess("SIGTERM");
+      const escalationTimer = globalThis.setTimeout(() => {
+        if (!settled) killProcess("SIGKILL");
+      }, killGraceMs);
+      escalationTimer.unref?.();
+    }, maxLifetimeMs);
+    lifetimeTimer.unref?.();
+  }
+  child.once("close", (code, signal) => {
+    settled = true;
+    if (lifetimeTimer) globalThis.clearTimeout(lifetimeTimer);
+    resolveExit?.({ code, signal });
+  });
+  child.on("error", () => {
+  });
+  return {
+    pid: child.pid,
+    pgid,
+    child,
+    kill(signal = "SIGTERM") {
+      if (settled) return;
+      killProcess(signal);
+      if (signal === "SIGTERM") {
+        const escalationTimer = globalThis.setTimeout(() => {
+          if (!settled) killProcess("SIGKILL");
+        }, killGraceMs);
+        escalationTimer.unref?.();
+      }
+    },
+    waitExit() {
+      return waitExit;
+    }
+  };
+}
+
 // ../plugin-sdk/src/index.ts
 function definePlugin(plugin2) {
   return plugin2;
 }
 
 // ../../plugins/fusion-plugin-hermes-runtime/src/cli-spawn.ts
-import { spawn, spawnSync } from "node:child_process";
+import { spawn as spawn3 } from "node:child_process";
 import os from "node:os";
-import path, { sep as PATH_SEP } from "node:path";
-var resolvedBinaryCache = /* @__PURE__ */ new Map();
-function resolveBinaryForSpawn(binary) {
-  if (process.platform !== "win32") return binary;
-  if (binary.includes(PATH_SEP) || binary.includes("/") || /\.[a-z]{2,4}$/i.test(binary)) {
-    return binary;
-  }
-  const cached = resolvedBinaryCache.get(binary);
-  if (cached) return cached;
-  try {
-    const result = spawnSync("where", [binary], { encoding: "utf-8" });
-    if (result.status === 0) {
-      const first = (result.stdout ?? "").trim().split(/\r?\n/)[0];
-      if (first?.length) {
-        resolvedBinaryCache.set(binary, first);
-        return first;
-      }
+import path from "node:path";
+
+// ../../plugins/fusion-plugin-hermes-runtime/src/windows-binary-launch.ts
+import { spawn as spawn2 } from "node:child_process";
+import { win32 } from "node:path";
+var DEFAULT_PATHEXT = ".COM;.EXE;.BAT;.CMD";
+var NEGATIVE_RESULT_TTL_MS = 3e4;
+var MAX_CACHE_ENTRIES = 32;
+var resolutionCache = /* @__PURE__ */ new Map();
+function effectivePathExt(env) {
+  const raw = env.PATHEXT?.trim() || DEFAULT_PATHEXT;
+  return raw.split(";").map((entry) => entry.trim()).filter(Boolean).map((entry) => (entry.startsWith(".") ? entry : `.${entry}`).toLowerCase());
+}
+function isWindowsPath(value) {
+  return value.includes("\\") || value.includes("/") || /^[A-Za-z]:/.test(value) || /^\\\\/.test(value);
+}
+function cacheKey(binary, platform, env) {
+  return `${platform}|${binary.toLowerCase()}|${env.PATH ?? ""}|${env.PATHEXT ?? ""}`;
+}
+function evictOldestIfNeeded() {
+  while (resolutionCache.size >= MAX_CACHE_ENTRIES) {
+    const oldest = resolutionCache.keys().next().value;
+    if (!oldest) return;
+    resolutionCache.delete(oldest);
+  }
+}
+async function defaultRunWhere(binary, env) {
+  return new Promise((resolve3) => {
+    let child;
+    try {
+      child = spawn2("where", [binary], {
+        env,
+        windowsHide: true,
+        stdio: ["ignore", "pipe", "ignore"]
+      });
+    } catch {
+      resolve3(void 0);
+      return;
     }
-  } catch {
+    let stdout = "";
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk.toString("utf8");
+    });
+    child.once("error", () => resolve3(void 0));
+    child.once("close", (code) => resolve3(code === 0 && stdout.trim() ? stdout : void 0));
+  });
+}
+function chooseWhereCandidate(stdout, env) {
+  const directories = [];
+  const byDirectory = /* @__PURE__ */ new Map();
+  for (const entry of stdout.split(/\r?\n/).map((line2) => line2.trim()).filter(Boolean)) {
+    const directory = win32.dirname(entry).replace(/[\\/]+$/, "").toLowerCase();
+    const group = byDirectory.get(directory) ?? { entries: [] };
+    if (!byDirectory.has(directory)) {
+      byDirectory.set(directory, group);
+      directories.push(group);
+    }
+    group.entries.push(entry);
+  }
+  const firstDirectory = directories[0];
+  if (!firstDirectory) return void 0;
+  const pathExt = effectivePathExt(env);
+  return [...firstDirectory.entries].sort((left, right) => {
+    const leftIndex = pathExt.indexOf(win32.extname(left).toLowerCase());
+    const rightIndex = pathExt.indexOf(win32.extname(right).toLowerCase());
+    const normalizedLeft = leftIndex === -1 ? Number.MAX_SAFE_INTEGER : leftIndex;
+    const normalizedRight = rightIndex === -1 ? Number.MAX_SAFE_INTEGER : rightIndex;
+    return normalizedLeft - normalizedRight;
+  })[0];
+}
+async function resolveHermesBinaryPath(binary, deps = {}) {
+  const platform = deps.platform ?? process.platform;
+  const env = deps.env ?? process.env;
+  if (platform !== "win32" || isWindowsPath(binary)) return platform === "win32" && isWindowsPath(binary) ? binary : void 0;
+  const lookup = async () => {
+    const output = await (deps.runWhere ?? defaultRunWhere)(binary, env);
+    return output ? chooseWhereCandidate(output, env) : void 0;
+  };
+  if (deps.runWhere) return lookup();
+  const key = cacheKey(binary, platform, env);
+  const cached = resolutionCache.get(key);
+  if (cached) {
+    const result = await cached.promise;
+    if (result !== void 0 || Date.now() - cached.createdAt < NEGATIVE_RESULT_TTL_MS) return result;
+    resolutionCache.delete(key);
+  }
+  evictOldestIfNeeded();
+  const entry = { promise: lookup(), createdAt: Date.now() };
+  resolutionCache.set(key, entry);
+  entry.promise.catch(() => {
+    if (resolutionCache.get(key) === entry) resolutionCache.delete(key);
+  });
+  return entry.promise;
+}
+function escapeWindowsShellCommand(command) {
+  return command.replace(/([()%!^<>&|;,\s])/g, "^$1");
+}
+function escapeWindowsShellArgument(arg) {
+  const quoted = arg.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\*)$/g, "$1$1");
+  return `"${quoted}"`.replace(/([()%!^<>&|;,])/g, "^$1");
+}
+async function resolveHermesLaunch(binary, args, deps = {}) {
+  const platform = deps.platform ?? process.platform;
+  if (platform !== "win32") return { command: binary, args: [...args] };
+  const env = deps.env ?? process.env;
+  const resolved = await resolveHermesBinaryPath(binary, { ...deps, platform, env });
+  const executable = resolved ?? binary;
+  const extension = win32.extname(executable).toLowerCase();
+  if (extension === ".cmd" || extension === ".bat") {
+    const commandLine = `"${escapeWindowsShellCommand(executable)} ${args.map(escapeWindowsShellArgument).join(" ")}"`;
+    return {
+      command: env.ComSpec ?? "cmd.exe",
+      args: ["/d", "/s", "/c", commandLine],
+      windowsVerbatimArguments: true,
+      resolvedBinaryPath: resolved
+    };
   }
-  return binary;
+  return { command: executable, args: [...args], resolvedBinaryPath: resolved };
+}
+function __resetHermesLaunchCacheForTests() {
+  resolutionCache.clear();
 }
+
+// ../../plugins/fusion-plugin-hermes-runtime/src/cli-spawn.ts
 var ANSI_RE = /\x1b\[[0-9;]*[A-Za-z]/g;
 var SESSION_ID_RE = /^session_id:\s+([0-9]{8}_[0-9]{6}_[0-9a-f]{6})\s*$/m;
 var CHROME_LINE_RES = [
@@ -19534,13 +19751,16 @@ function hermesProfileHome(profileName) {
   return path.join(base, "profiles", profileName);
 }
 async function listHermesProfiles(opts) {
-  const binary = resolveBinaryForSpawn(opts?.binaryPath ?? "hermes");
+  const binary = opts?.binaryPath ?? "hermes";
   const timeoutMs = opts?.timeoutMs ?? 5e3;
+  const spawnEnv = { ...process.env };
+  const launch = await resolveHermesLaunch(binary, ["profile", "list"], { env: spawnEnv });
   return new Promise((resolve3, reject) => {
     let settled = false;
-    const child = spawn(binary, ["profile", "list"], {
+    const child = spawn3(launch.command, launch.args, {
       stdio: ["ignore", "pipe", "pipe"],
-      env: { ...process.env }
+      env: spawnEnv,
+      windowsVerbatimArguments: launch.windowsVerbatimArguments
     });
     const timer = setTimeout(() => {
       if (settled) return;
@@ -19652,22 +19872,26 @@ function buildHermesArgs(prompt, settings, resumeSessionId) {
 }
 async function invokeHermesCli(prompt, settings, resumeSessionId, signal) {
   const args = buildHermesArgs(prompt, settings, resumeSessionId);
-  const binary = resolveBinaryForSpawn(settings.binaryPath);
+  const spawnEnv = { ...process.env, PYTHONUNBUFFERED: "1" };
+  if (settings.profile) {
+    spawnEnv.HERMES_HOME = hermesProfileHome(settings.profile);
+  }
+  const launch = await resolveHermesLaunch(settings.binaryPath, args, { env: spawnEnv });
   return new Promise((resolve3, reject) => {
     let settled = false;
-    const spawnEnv = { ...process.env, PYTHONUNBUFFERED: "1" };
-    if (settings.profile) {
-      spawnEnv.HERMES_HOME = hermesProfileHome(settings.profile);
-    }
-    const child = spawn(binary, args, {
+    const supervised = superviseSpawn(launch.command, launch.args, {
       stdio: ["ignore", "pipe", "pipe"],
-      env: spawnEnv
+      env: spawnEnv,
+      windowsVerbatimArguments: launch.windowsVerbatimArguments,
+      maxLifetimeMs: settings.cliTimeoutMs + 2100,
+      killGraceMs: 2e3
     });
+    const child = supervised.child;
     const hardKillTimer = setTimeout(() => {
       if (settled) return;
       settled = true;
       try {
-        child.kill("SIGKILL");
+        supervised.kill("SIGKILL");
       } catch {
       }
       reject(new Error(`hermes: process timed out after ${settings.cliTimeoutMs}ms`));
@@ -19677,7 +19901,7 @@ async function invokeHermesCli(prompt, settings, resumeSessionId, signal) {
       settled = true;
       clearTimeout(hardKillTimer);
       try {
-        child.kill("SIGTERM");
+        supervised.kill("SIGTERM");
       } catch {
       }
       reject(new Error("hermes: invocation aborted"));
@@ -19961,20 +20185,22 @@ ${prompt}`;
 };
 
 // ../../plugins/fusion-plugin-hermes-runtime/src/probe.ts
-import { spawn as spawn2 } from "node:child_process";
+import { spawn as spawn4 } from "node:child_process";
 var DEFAULT_PROBE_TIMEOUT_MS = 2e3;
 async function probeHermesBinary(opts) {
   const startedAt = Date.now();
   const binary = typeof opts?.binaryPath === "string" && opts.binaryPath.trim().length > 0 ? opts.binaryPath.trim() : "hermes";
   const timeoutMs = opts?.timeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS;
-  const resolvedPath = await tryResolveBinaryPath(binary);
+  const launch = await resolveHermesLaunch(binary, ["--version"], { env: process.env });
+  const resolvedPath = launch.resolvedBinaryPath ?? await tryResolvePosixBinaryPath(binary);
   return new Promise((resolvePromise) => {
     const finish = (result) => {
       resolvePromise({ ...result, probeDurationMs: Date.now() - startedAt });
     };
     let settled = false;
-    const child = spawn2(resolvedPath ?? binary, ["--version"], {
-      stdio: ["ignore", "pipe", "pipe"]
+    const child = spawn4(launch.command, launch.args, {
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsVerbatimArguments: launch.windowsVerbatimArguments
     });
     const timer = setTimeout(() => {
       if (settled) return;
@@ -20028,10 +20254,10 @@ async function probeHermesBinary(opts) {
     });
   });
 }
-async function tryResolveBinaryPath(binary) {
+async function tryResolvePosixBinaryPath(binary) {
+  if (process.platform === "win32") return void 0;
   return new Promise((resolvePromise) => {
-    const which = process.platform === "win32" ? "where" : "which";
-    const child = spawn2(which, [binary], { stdio: ["ignore", "pipe", "ignore"] });
+    const child = spawn4("which", [binary], { stdio: ["ignore", "pipe", "ignore"] });
     let out = "";
     child.stdout?.on("data", (chunk) => {
       out += chunk.toString("utf-8");
@@ -20111,8 +20337,11 @@ export {
   COMPUTER_USE_SKILL_NAME,
   HERMES_RUNTIME_ID,
   HermesRuntimeAdapter,
+  __resetHermesLaunchCacheForTests,
   buildHermesArgs,
   index_default as default,
+  escapeWindowsShellArgument,
+  escapeWindowsShellCommand,
   getComputerUseSkillSourceCandidates,
   hermesRuntimeFactory,
   hermesRuntimeMetadata,
@@ -20125,6 +20354,8 @@ export {
   resolveBundledComputerUseSkillSource,
   resolveBundledFusionSkillSource,
   resolveCliSettings,
+  resolveHermesBinaryPath,
   resolveHermesHome,
+  resolveHermesLaunch,
   shouldInstallComputerUseSkill
 };

package/dist/plugins/fusion-plugin-hermes-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fusion-plugin-examples/hermes-runtime",
-  "version": "0.2.85-beta.3",
+  "version": "0.2.86-beta.0",
   "type": "module",
   "exports": {
     ".": {