@securecoms/agent-bridge 0.6.0 → 0.8.0

package/dist/bin.js

@@ -7042,7 +7042,372 @@ function uninstallService(input, deps) {
 }
 
 // src/service/install-prep.ts
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
+
+// src/service/wire.ts
+import { join as join8, dirname as dirname5 } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// src/service/hermes-config.ts
+var HERMES_PLUGIN_NAME = "securecoms-platform";
+function indentOf(line) {
+  const m = line.match(/^( *)/);
+  return m ? m[1].length : 0;
+}
+function isCommentLine(line) {
+  return /^\s*#/.test(line);
+}
+function isBlank(line) {
+  return line.trim() === "";
+}
+function parseKeyLine(line, key) {
+  const m = line.match(new RegExp(`^( *)${key}:(.*)$`));
+  if (!m) return null;
+  const indent = m[1].length;
+  const rest = m[2].trim();
+  if (rest === "" || rest.startsWith("#")) return { idx: -1, indent, inline: null };
+  return { idx: -1, indent, inline: rest };
+}
+function findKeyLine(lines, key, start, end) {
+  for (let i = start; i < end; i++) {
+    const parsed = parseKeyLine(lines[i], key);
+    if (parsed) return { ...parsed, idx: i };
+  }
+  return null;
+}
+function findBlockEnd(lines, start, parentIndent) {
+  let i = start;
+  for (; i < lines.length; i++) {
+    if (isBlank(lines[i])) continue;
+    if (indentOf(lines[i]) > parentIndent) continue;
+    break;
+  }
+  return i;
+}
+function stripQuotesAndComment(raw) {
+  let value = raw.replace(/\s+#.*$/, "").trim();
+  if (value.length >= 2) {
+    const first = value[0];
+    const last = value[value.length - 1];
+    if (first === '"' && last === '"' || first === "'" && last === "'") {
+      value = value.slice(1, -1);
+    }
+  }
+  return value;
+}
+function collectItems(lines, start) {
+  const items = [];
+  let i = start;
+  for (; i < lines.length; i++) {
+    const line = lines[i];
+    if (isCommentLine(line)) {
+      return { items, endIdx: i, ambiguous: true };
+    }
+    const m = line.match(/^( *)-\s*(.+?)\s*$/);
+    if (!m) break;
+    items.push({ idx: i, indent: m[1].length, value: stripQuotesAndComment(m[2]) });
+  }
+  return { items, endIdx: i, ambiguous: false };
+}
+var SIBLING_KEY_RE = /^[\w.-]+:(\s|$)/;
+function isLegitimateListEnd(lines, stopIdx, itemCol, enabledIndent) {
+  if (stopIdx >= lines.length) return true;
+  if (!isBlank(lines[stopIdx])) {
+    return indentOf(lines[stopIdx]) === enabledIndent && SIBLING_KEY_RE.test(lines[stopIdx].trim());
+  }
+  let i = stopIdx;
+  while (i < lines.length && isBlank(lines[i])) i++;
+  if (i >= lines.length) return true;
+  return indentOf(lines[i]) < itemCol;
+}
+function parseInlineList(inline) {
+  const trimmed = inline.trim();
+  if (!trimmed.startsWith("[") || !trimmed.endsWith("]")) return [];
+  const inner = trimmed.slice(1, -1).trim();
+  if (inner === "") return [];
+  return inner.split(",").map((s) => stripQuotesAndComment(s.trim()));
+}
+function noop(reason) {
+  return reason ? { action: "noop", reason } : { action: "noop" };
+}
+var MANUAL_INSTRUCTIONS = [
+  "add the following manually under the plugin's config (`~/.hermes/config.yaml`):",
+  "  plugins:",
+  "    enabled:",
+  `      - ${HERMES_PLUGIN_NAME}`
+].join("\n");
+function ensureHermesPluginEnabled(configText) {
+  const eol = configText.includes("\r\n") ? "\r\n" : "\n";
+  const lines = configText.split(/\r\n|\n/);
+  const pluginsIdx = lines.findIndex((l) => /^plugins:\s*(#.*)?$/.test(l));
+  if (pluginsIdx === -1) {
+    return noop(`no \`plugins:\` block found in config.yaml \u2014 ${MANUAL_INSTRUCTIONS}`);
+  }
+  const pluginsIndent = indentOf(lines[pluginsIdx]);
+  const blockEnd = findBlockEnd(lines, pluginsIdx + 1, pluginsIndent);
+  const enabledKey = findKeyLine(lines, "enabled", pluginsIdx + 1, blockEnd);
+  if (!enabledKey) {
+    return noop(`no \`plugins.enabled\` key found in config.yaml \u2014 ${MANUAL_INSTRUCTIONS}`);
+  }
+  if (enabledKey.inline !== null) {
+    return noop(
+      `plugins.enabled uses the inline \`enabled: [...]\` form, which this editor refuses to rewrite (never reformat) \u2014 ${MANUAL_INSTRUCTIONS}`
+    );
+  }
+  const { items, endIdx, ambiguous } = collectItems(lines, enabledKey.idx + 1);
+  if (ambiguous) {
+    return noop(
+      `a comment line interrupts the plugins.enabled list \u2014 refusing rather than guess whether it belongs to the item above or below; ${MANUAL_INSTRUCTIONS}`
+    );
+  }
+  if (items.length === 0) {
+    return noop(`plugins.enabled has no items to copy an indent column from (empty list) \u2014 ${MANUAL_INSTRUCTIONS}`);
+  }
+  const col = items[0].indent;
+  if (items.some((it) => it.indent !== col)) {
+    return noop(`plugins.enabled items are inconsistently indented \u2014 refusing to guess the right column; ${MANUAL_INSTRUCTIONS}`);
+  }
+  const disabledKey = findKeyLine(lines, "disabled", pluginsIdx + 1, blockEnd);
+  let disabledEntries = [];
+  if (disabledKey) {
+    if (disabledKey.inline !== null) {
+      disabledEntries = parseInlineList(disabledKey.inline);
+    } else {
+      disabledEntries = collectItems(lines, disabledKey.idx + 1).items.map((it) => it.value);
+    }
+  }
+  if (disabledEntries.includes(HERMES_PLUGIN_NAME)) {
+    return noop(
+      `${HERMES_PLUGIN_NAME} is listed under plugins.disabled, which wins over plugins.enabled in the Hermes loader \u2014 remove it from plugins.disabled (or move it to plugins.enabled) manually, then re-run wire.`
+    );
+  }
+  if (items.some((it) => it.value === HERMES_PLUGIN_NAME)) {
+    return { action: "noop" };
+  }
+  if (!isLegitimateListEnd(lines, endIdx, col, enabledKey.indent)) {
+    return noop(
+      `plugins.enabled's list doesn't end at a recognized boundary (expected a sibling key, a blank-then-dedent, or end of file) \u2014 refusing to insert at an unverified spot; ${MANUAL_INSTRUCTIONS}`
+    );
+  }
+  const insertLine = `${" ".repeat(col)}- ${HERMES_PLUGIN_NAME}`;
+  const newLines = [...lines.slice(0, endIdx), insertLine, ...lines.slice(endIdx)];
+  return { action: "edited", text: newLines.join(eol) };
+}
+
+// src/service/wire.ts
+var CONNECTOR_FILE_EXTENSIONS = {
+  openclaw: [".js", ".json"],
+  hermes: [".py", ".yaml", ".json"]
+};
+var CONNECTOR_SKIP_DIRS = /* @__PURE__ */ new Set(["tests", "__pycache__"]);
+function detectHarness(home, statDir) {
+  if (statDir(`${home}/.openclaw`)) return "openclaw";
+  if (statDir(`${home}/.hermes`)) return "hermes";
+  return null;
+}
+function connectorTargetDir(home, harness) {
+  if (harness === "openclaw") return `${home}/.openclaw/local-plugins/securecoms`;
+  return `${home}/.hermes/plugins/securecoms`;
+}
+function connectorsSrcDir(importMetaUrl, harness) {
+  const pkgRoot = dirname5(dirname5(fileURLToPath(importMetaUrl)));
+  return join8(pkgRoot, "connectors", harness);
+}
+function hermesConfigPath(home) {
+  return `${home}/.hermes/config.yaml`;
+}
+function hermesConfigBackupPath(configPath, ts, pid) {
+  return `${configPath}.bak-wire-${ts}-${pid}`;
+}
+function enableHermesConfig(home, deps) {
+  const path = hermesConfigPath(home);
+  const text = deps.readHermesConfig(path);
+  if (text === null) {
+    return {
+      ok: false,
+      message: `Hermes config.yaml not found at ${path} (is ~/.hermes installed?) \u2014 add the plugin manually:
+  plugins:
+    enabled:
+      - ${HERMES_PLUGIN_NAME}`
+    };
+  }
+  const result = ensureHermesPluginEnabled(text);
+  if (result.action === "noop") {
+    if (result.reason) return { ok: false, message: result.reason };
+    return { ok: true, message: `${HERMES_PLUGIN_NAME} is already enabled in ${path}.` };
+  }
+  deps.backupHermesConfig(path, text);
+  deps.writeHermesConfig(path, result.text);
+  return {
+    ok: true,
+    message: `enabled ${HERMES_PLUGIN_NAME} in ${path} (the original was backed up alongside it as config.yaml.bak-wire-<ts>-<pid>).`
+  };
+}
+function parseArg(argv, flag) {
+  const i = argv.indexOf(flag);
+  return i >= 0 ? argv[i + 1] : void 0;
+}
+function resolveEntry(deps) {
+  const identityArg = parseArg(deps.argv, "--identity");
+  if (!identityArg) {
+    deps.log("wire: missing --identity <id|slug>");
+    return null;
+  }
+  const entry = deps.readFleet().find((e) => e.identityId === identityArg || e.slug === identityArg);
+  if (!entry) {
+    deps.log(`wire: unknown identity "${identityArg}" (not found in the local fleet)`);
+    return null;
+  }
+  const harnessArg = parseArg(deps.argv, "--harness");
+  if (harnessArg !== "openclaw" && harnessArg !== "hermes") {
+    deps.log("wire: missing/invalid --harness <openclaw|hermes> (auto-detection did not resolve one)");
+    return null;
+  }
+  return { entry, harness: harnessArg };
+}
+function runWire(deps) {
+  const resolved = resolveEntry(deps);
+  if (!resolved) return 1;
+  const { entry, harness } = resolved;
+  const targetDir = connectorTargetDir(deps.home, harness);
+  deps.copyConnector(deps.connectorsSrcDir(harness), targetDir, harness);
+  deps.writeBinding(targetDir, entry.identityId);
+  if (harness === "hermes") {
+    const enabled = enableHermesConfig(deps.home, deps);
+    deps.log(`[securecoms] ${enabled.message}`);
+    if (!enabled.ok) {
+      deps.log(
+        "wire: Hermes connector files were copied and the binding was written, but the config.yaml plugin entry was NOT enabled automatically \u2014 the harness is NOT wired until you add it manually (see above) and restart the gateway."
+      );
+      return 1;
+    }
+  }
+  if (typeof entry.port === "number") {
+    const h = deps.getHealth(entry.port);
+    if (h && (h.agent_sessions ?? 0) >= 1) {
+      deps.log(`wire: ${entry.slug} attached (agent_sessions=${h.agent_sessions})`);
+    } else {
+      deps.log(`wire: connector installed but not yet attached \u2014 restart the harness to pick it up.`);
+    }
+  } else {
+    deps.log(`wire: connector installed (no bridge port known yet) \u2014 restart the harness to pick it up.`);
+  }
+  if (harness === "hermes") {
+    deps.log(
+      "wire: restart the Hermes gateway (`launchctl kickstart -k gui/$UID/ai.hermes.gateway` or your service manager) to pick up the connector."
+    );
+  }
+  return 0;
+}
+function runUnwire(deps) {
+  const resolved = resolveEntry(deps);
+  if (!resolved) return 1;
+  const { harness } = resolved;
+  deps.removeBinding(connectorTargetDir(deps.home, harness));
+  if (harness === "hermes") {
+    deps.log(
+      "[securecoms] Hermes binding removed. The connector files under ~/.hermes/plugins/securecoms and the plugins.enabled entry in config.yaml remain \u2014 removing a listed plugin's files would make Hermes log load errors at boot. Edit config.yaml manually to fully remove it, then restart the gateway."
+    );
+  }
+  return 0;
+}
+
+// src/service/harness-wire.ts
+function customFacts(input) {
+  const ws = `ws://127.0.0.1:${input.port ?? "<PORT>"}/v1/ws`;
+  return [
+    `  bridge WS:   ${ws}`,
+    `  token file:  ${input.tokenFilePath}`,
+    `  Bring your own connector: open the WS with the bearer token read from that file.`,
+    `  Protocol reference: the "WebSocket" section of the agent-bridge README.`
+  ].join("\n");
+}
+function autoWireHarness(input, deps) {
+  const h = input.harness;
+  if (!h || h === "none") return { echo: "", wired: false, error: false };
+  if (h === "openclaw") {
+    const retry = `agent-bridge wire --harness openclaw --identity ${input.slug}`;
+    const parent = `${input.home}/.openclaw`;
+    if (!deps.statDir(parent)) {
+      return {
+        echo: `[securecoms] OpenClaw not found at ~/.openclaw \u2014 the bridge service is installed, but the harness was NOT wired.
+  Install OpenClaw, then re-run install, or run: ${retry}
+  (or re-run install with --harness custom).`,
+        wired: false,
+        error: true
+      };
+    }
+    const targetDir = connectorTargetDir(input.home, "openclaw");
+    try {
+      const prev = deps.readBinding(targetDir);
+      deps.copyConnector(input.connectorsSrcDir, targetDir, "openclaw");
+      deps.writeBinding(targetDir, input.identityId);
+      const rebind = prev && prev !== input.identityId ? `
+  rebind: ${prev} \u2192 ${input.identityId}` : "";
+      return {
+        echo: `[securecoms] OpenClaw connector installed and bound to identity ${input.identityId}.${rebind}
+  Now restart OpenClaw to pick up the connector.`,
+        wired: true,
+        error: false
+      };
+    } catch (e) {
+      return {
+        echo: `[securecoms] the bridge service is installed, but wiring the OpenClaw connector FAILED: ${e.message}
+  Retry after fixing the path: ${retry}`,
+        wired: false,
+        error: true
+      };
+    }
+  }
+  if (h === "hermes") {
+    const retry = `agent-bridge wire --harness hermes --identity ${input.slug}`;
+    const parent = `${input.home}/.hermes`;
+    if (!deps.statDir(parent)) {
+      return {
+        echo: `[securecoms] Hermes not found at ~/.hermes \u2014 the bridge service is installed, but the harness was NOT wired.
+  Install Hermes, then re-run install, or run: ${retry}
+  (or re-run install with --harness custom).`,
+        wired: false,
+        error: true
+      };
+    }
+    const targetDir = connectorTargetDir(input.home, "hermes");
+    try {
+      const prev = deps.readBinding(targetDir);
+      deps.copyConnector(input.connectorsSrcDir, targetDir, "hermes");
+      deps.writeBinding(targetDir, input.identityId);
+      const enabled = enableHermesConfig(input.home, deps);
+      if (!enabled.ok) {
+        return {
+          echo: `[securecoms] Hermes connector copied and bound to identity ${input.identityId}, but the config.yaml plugin entry was NOT enabled automatically: ${enabled.message}
+  The harness is NOT wired until you add it manually and restart the gateway.`,
+          wired: false,
+          error: true
+        };
+      }
+      const rebind = prev && prev !== input.identityId ? `
+  rebind: ${prev} \u2192 ${input.identityId}` : "";
+      return {
+        echo: `[securecoms] Hermes connector installed and bound to identity ${input.identityId}.${rebind}
+  ${enabled.message}
+  Restart the Hermes gateway (\`launchctl kickstart -k gui/$UID/ai.hermes.gateway\` or your service manager) after install completes.`,
+        wired: true,
+        error: false
+      };
+    } catch (e) {
+      return {
+        echo: `[securecoms] the bridge service is installed, but wiring the Hermes connector FAILED: ${e.message}
+  Retry after fixing the path: ${retry}`,
+        wired: false,
+        error: true
+      };
+    }
+  }
+  return { echo: `[securecoms] Custom harness \u2014 bring your own connector:
+${customFacts(input)}`, wired: false, error: false };
+}
+
+// src/service/install-prep.ts
 function assertReadableCredential(absPath, deps) {
   let raw;
   try {
@@ -7065,10 +7430,10 @@ function assertReadableCredential(absPath, deps) {
   return { deviceId: json2.device_id, identityId: json2.identity_id, issuedAt };
 }
 function durableDir(home, slug) {
-  return join8(home, `securecoms-agent-${slug}`);
+  return join9(home, `securecoms-agent-${slug}`);
 }
 function durableCredentialPath(home, slug) {
-  return join8(durableDir(home, slug), `${slug}.json`);
+  return join9(durableDir(home, slug), `${slug}.json`);
 }
 function takeCustody(args2, deps) {
   const dir = durableDir(args2.home, args2.slug);
@@ -7115,7 +7480,7 @@ function readSiblingDefs(dir, prefix, deps) {
   for (const n of names) {
     if (!n.startsWith(prefix)) continue;
     try {
-      out.push(deps.readFile(join8(dir, n)));
+      out.push(deps.readFile(join9(dir, n)));
     } catch {
     }
   }
@@ -7147,15 +7512,6 @@ async function verifyDaemonUp(args2, deps) {
   }
   return false;
 }
-function harnessSnippet(args2) {
-  const label = args2.harness === "hermes" ? "Hermes" : args2.harness === "openclaw" ? "OpenClaw" : "your harness";
-  return [
-    `# ${label}: optional daemon-supervised path. Prefer 'agent-bridge wire' + the connection file.`,
-    `SECURECOMS_BRIDGE_URL=ws://127.0.0.1:${args2.port}/v1/ws`,
-    `SECURECOMS_CONNECTION_FILE=~/.securecoms/connections/${args2.identityId}.json`,
-    `SECURECOMS_BRIDGE_TOKEN_FILE=${args2.tokenFilePath}`
-  ].join("\n");
-}
 async function orchestrateInstall(ctx) {
   const parsed = assertReadableCredential(ctx.credentialAbsPath, ctx.prepDeps);
   const stemForSlug = ctx.label ?? ctx.credentialAbsPath.replace(/^.*[\\/]/, "").replace(/\.[^.]*$/, "");
@@ -7189,22 +7545,24 @@ async function orchestrateInstall(ctx) {
     `  token:   ${result.tokenHint}`,
     `  (Re-running install is the only way to update a live credential \u2014 replacing the download alone does nothing.)`
   ];
-  let harnessSnippetShown = false;
-  if (ctx.harness && ctx.harness !== "none") {
-    lines.push(
-      "",
-      `Primary: run 'agent-bridge wire --identity ${slug}' to attach a harness; the daemon writes ~/.securecoms/connections/${parsed.identityId}.json on startup.`,
-      "",
-      "Optional (daemon-supervised):",
-      harnessSnippet({ slug, port, tokenFilePath: result.tokenHint, harness: ctx.harness, identityId: parsed.identityId })
-    );
-    harnessSnippetShown = true;
-  }
-  return { echo: lines.join("\n") + "\n", harnessSnippetShown };
+  const wire = autoWireHarness(
+    {
+      harness: ctx.harness,
+      identityId: parsed.identityId,
+      slug,
+      port,
+      home: ctx.home,
+      tokenFilePath: result.tokenHint,
+      connectorsSrcDir: ctx.connectorsSrcDir
+    },
+    ctx.autoWireDeps
+  );
+  if (wire.echo) lines.push("", wire.echo);
+  return { echo: lines.join("\n") + "\n", harnessWired: wire.wired, harnessError: wire.error };
 }
 
 // src/service/fleet.ts
-import { dirname as dirname5 } from "node:path";
+import { dirname as dirname6 } from "node:path";
 function parseArgFromDef(def, flag) {
   const esc = flag.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const re = new RegExp(`${esc}(?:<\\/string>\\s*<string>|\\s+)([^<\\s]+)`);
@@ -7248,7 +7606,7 @@ function readFleet(deps) {
       let identityId = `unknown:${slug}`, deviceId = "", label = slug, env = "unknown";
       let credDir = null;
       if (credPath) {
-        credDir = dirname5(credPath);
+        credDir = dirname6(credPath);
         try {
           const c = JSON.parse(deps.readFile(credPath));
           if (c.identity_id) identityId = c.identity_id;
@@ -7314,81 +7672,6 @@ function renderStatusTable(rows) {
   return [fmt(head), ...body.map(fmt)].join("\n") + "\n";
 }
 
-// src/service/wire.ts
-import { join as join9, dirname as dirname6 } from "node:path";
-import { fileURLToPath } from "node:url";
-function detectHarness(home, statDir) {
-  if (statDir(`${home}/.openclaw`)) return "openclaw";
-  if (statDir(`${home}/.hermes`)) return "hermes";
-  return null;
-}
-function connectorTargetDir(home, harness) {
-  if (harness === "openclaw") return `${home}/.openclaw/local-plugins/securecoms`;
-  return `${home}/.hermes/local-plugins/securecoms`;
-}
-function connectorsSrcDir(importMetaUrl) {
-  const pkgRoot = dirname6(dirname6(fileURLToPath(importMetaUrl)));
-  return join9(pkgRoot, "connectors", "openclaw");
-}
-function parseArg(argv, flag) {
-  const i = argv.indexOf(flag);
-  return i >= 0 ? argv[i + 1] : void 0;
-}
-function resolveEntry(deps) {
-  const identityArg = parseArg(deps.argv, "--identity");
-  if (!identityArg) {
-    deps.log("wire: missing --identity <id|slug>");
-    return null;
-  }
-  const entry = deps.readFleet().find((e) => e.identityId === identityArg || e.slug === identityArg);
-  if (!entry) {
-    deps.log(`wire: unknown identity "${identityArg}" (not found in the local fleet)`);
-    return null;
-  }
-  const harnessArg = parseArg(deps.argv, "--harness");
-  if (harnessArg !== "openclaw" && harnessArg !== "hermes") {
-    deps.log("wire: missing/invalid --harness <openclaw|hermes> (auto-detection did not resolve one)");
-    return null;
-  }
-  return { entry, harness: harnessArg };
-}
-function runWire(deps) {
-  const resolved = resolveEntry(deps);
-  if (!resolved) return 1;
-  const { entry, harness } = resolved;
-  if (harness === "hermes") {
-    deps.log(
-      "[securecoms] Hermes connector is not available yet (fast-follow); detection and target dir only. Nothing installed."
-    );
-    return 1;
-  }
-  const targetDir = connectorTargetDir(deps.home, harness);
-  deps.copyConnector(deps.connectorsSrcDir, targetDir);
-  deps.writeBinding(targetDir, entry.identityId);
-  if (typeof entry.port === "number") {
-    const h = deps.getHealth(entry.port);
-    if (h && (h.agent_sessions ?? 0) >= 1) {
-      deps.log(`wire: ${entry.slug} attached (agent_sessions=${h.agent_sessions})`);
-    } else {
-      deps.log(`wire: connector installed but not yet attached \u2014 restart the harness to pick it up.`);
-    }
-  } else {
-    deps.log(`wire: connector installed (no bridge port known yet) \u2014 restart the harness to pick it up.`);
-  }
-  return 0;
-}
-function runUnwire(deps) {
-  const resolved = resolveEntry(deps);
-  if (!resolved) return 1;
-  const { harness } = resolved;
-  if (harness === "hermes") {
-    deps.log("[securecoms] Hermes connector is not available yet (fast-follow); nothing to remove.");
-    return 0;
-  }
-  deps.removeBinding(connectorTargetDir(deps.home, harness));
-  return 0;
-}
-
 // src/service/connection-file.ts
 import {
   chmodSync,
@@ -7606,15 +7889,18 @@ function runStatus() {
   else process.stdout.write(renderStatusTable(rows));
   process.exit(0);
 }
-function realCopyConnector(srcDir, dstDir) {
+function realCopyConnector(srcDir, dstDir, harness) {
+  const allowedExt = CONNECTOR_FILE_EXTENSIONS[harness];
   mkdirSync2(dstDir, { recursive: true });
   for (const name of readdirSync(srcDir)) {
     const srcPath = join11(srcDir, name);
     if (statSync2(srcPath).isDirectory()) {
-      realCopyConnector(srcPath, join11(dstDir, name));
+      if (CONNECTOR_SKIP_DIRS.has(name)) continue;
+      realCopyConnector(srcPath, join11(dstDir, name), harness);
       continue;
     }
-    if (!/\.(js|json)$/.test(name)) continue;
+    if (name.includes(".test.")) continue;
+    if (!allowedExt.some((ext) => name.endsWith(ext))) continue;
     writeFileSync3(join11(dstDir, name), readFileSync7(srcPath));
   }
 }
@@ -7622,6 +7908,14 @@ function realWriteBinding(dstDir, identityId) {
   mkdirSync2(dstDir, { recursive: true });
   writeFileSync3(join11(dstDir, "securecoms.binding.json"), JSON.stringify({ identity_id: identityId }) + "\n", { mode: 384 });
 }
+function realReadBinding(dstDir) {
+  try {
+    const parsed = JSON.parse(readFileSync7(join11(dstDir, "securecoms.binding.json"), "utf8"));
+    return parsed.identity_id ?? null;
+  } catch {
+    return null;
+  }
+}
 function realRemoveBinding(dstDir) {
   rmSync(join11(dstDir, "securecoms.binding.json"), { force: true });
 }
@@ -7632,6 +7926,19 @@ function realStatDir(p) {
     return false;
   }
 }
+function realReadHermesConfig(p) {
+  try {
+    return readFileSync7(p, "utf8");
+  } catch {
+    return null;
+  }
+}
+function realBackupHermesConfig(p, originalText) {
+  writeFileSync3(hermesConfigBackupPath(p, Date.now(), process.pid), originalText, "utf8");
+}
+function realWriteHermesConfig(p, newText) {
+  writeFileSync3(p, newText, "utf8");
+}
 function realWireArgv() {
   if (process.argv.includes("--harness")) return process.argv;
   const detected = detectHarness(homedir2(), realStatDir);
@@ -7648,8 +7955,12 @@ function realWireDeps() {
     getHealth: realGetHealth,
     log: (s) => process.stdout.write(s + "\n"),
     // bin.ts's OWN import.meta.url — see connectorsSrcDir's doc comment in
-    // wire.ts for why it must be the entry point's URL, not wire.ts's.
-    connectorsSrcDir: connectorsSrcDir(import.meta.url)
+    // wire.ts for why it must be the entry point's URL, not wire.ts's. Keyed
+    // by harness (Task 6) so one WireDeps instance can wire either harness.
+    connectorsSrcDir: (h) => connectorsSrcDir(import.meta.url, h),
+    readHermesConfig: realReadHermesConfig,
+    backupHermesConfig: realBackupHermesConfig,
+    writeHermesConfig: realWriteHermesConfig
   };
 }
 function runWireVerb(verb) {
@@ -7678,12 +7989,27 @@ async function runServiceVerb(verb) {
         argOrEnv("--exec-path", "SECURECOMS_EXEC_PATH"),
         realResolveNodeDeps()
       );
+      const installHarness = argOrEnv("--harness", "SECURECOMS_HARNESS");
       const r = await orchestrateInstall({
         credentialAbsPath: credAbs,
         label,
         explicitPort: portStr ? Number(portStr) : void 0,
-        harness: argOrEnv("--harness", "SECURECOMS_HARNESS"),
+        harness: installHarness,
         home: homedir2(),
+        connectorsSrcDir: connectorsSrcDir(import.meta.url, installHarness === "hermes" ? "hermes" : "openclaw"),
+        autoWireDeps: {
+          statDir: realStatDir,
+          // reuse bin.ts:266
+          readBinding: realReadBinding,
+          copyConnector: realCopyConnector,
+          // bin.ts:225 — one copy impl
+          writeBinding: realWriteBinding,
+          // bin.ts:245 — writes {identity_id}
+          readHermesConfig: realReadHermesConfig,
+          backupHermesConfig: realBackupHermesConfig,
+          writeHermesConfig: realWriteHermesConfig,
+          log: (s) => process.stderr.write(s + "\n")
+        },
         prepDeps: realPrepDeps(),
         // O-1: the real installService is 2-arg; partially apply the deps so
         // orchestrateInstall only ever sees the 1-arg seam.
@@ -7701,6 +8027,7 @@ async function runServiceVerb(verb) {
         })
       });
       process.stdout.write(r.echo);
+      if (r.harnessError) process.exit(1);
     } else {
       const input = {
         credentialPath: credentialPath ?? "",
@@ -7827,6 +8154,7 @@ export {
   chooseInstallExecPath,
   nodeMajorOk,
   parseVerb,
+  realCopyConnector,
   slugFromCredentialPath,
   tokenFingerprint
 };

package/dist/service/harness-wire.d.ts

@@ -0,0 +1,22 @@
+import { type HermesConfigIoDeps, type Harness } from "./wire.js";
+export interface AutoWireInput {
+    harness: string | undefined;
+    identityId: string;
+    slug: string;
+    port: number | null;
+    home: string;
+    tokenFilePath: string;
+    connectorsSrcDir: string;
+}
+export interface AutoWireDeps extends HermesConfigIoDeps {
+    statDir: (p: string) => boolean;
+    readBinding: (dstDir: string) => string | null;
+    copyConnector: (srcDir: string, dstDir: string, harness: Harness) => void;
+    writeBinding: (dstDir: string, identityId: string) => void;
+    log: (s: string) => void;
+}
+export declare function autoWireHarness(input: AutoWireInput, deps: AutoWireDeps): {
+    echo: string;
+    wired: boolean;
+    error: boolean;
+};