@securecoms/agent-bridge 0.7.0 → 0.9.0

package/dist/bin.js

@@ -27,6 +27,8 @@ function loadConfig(opts) {
   let memoryProvider;
   let memoryBaseDir;
   let memoryAgent;
+  let memoryWorkspaceDir;
+  let memoryFactsCharBudget;
   if (memProvRaw === "none") {
     memoryProvider = "none";
   } else if (memProvRaw === "hermes") {
@@ -40,6 +42,10 @@ function loadConfig(opts) {
     memoryBaseDir = typeof bd === "string" && bd ? bd : "~/.openclaw";
     const ag = oc?.agent;
     memoryAgent = typeof ag === "string" && ag ? ag : void 0;
+    const wd = oc?.workspace_dir;
+    memoryWorkspaceDir = typeof wd === "string" && wd ? wd : void 0;
+    const fb = oc?.facts_char_budget;
+    memoryFactsCharBudget = typeof fb === "number" && Number.isInteger(fb) && fb >= 0 ? fb : void 0;
   } else {
     memoryProvider = "securecoms";
   }
@@ -56,7 +62,9 @@ function loadConfig(opts) {
     rateLimitRefillPerMinute,
     memoryProvider,
     memoryBaseDir,
-    memoryAgent
+    memoryAgent,
+    memoryWorkspaceDir,
+    memoryFactsCharBudget
   };
 }
 function arg(argv, flag) {
@@ -3947,7 +3955,7 @@ function loadPackageMeta(importMetaUrl) {
 
 // src/bridge-agent.ts
 import { promises as fsp } from "node:fs";
-import { join as join7, dirname as dirname3 } from "node:path";
+import { join as join8, dirname as dirname3 } from "node:path";
 
 // src/latency.ts
 var DEFAULT_CAPACITY = 1024;
@@ -4460,29 +4468,153 @@ function readRecentTurns(baseDir, agent, sessionId, k) {
   return k > 0 ? turns.slice(-k) : [];
 }
 
+// src/memory/openclaw-workspace-facts.ts
+import { readdirSync, readFileSync as readFileSync5, statSync as statSync2 } from "node:fs";
+import { join as join7 } from "node:path";
+var DEFAULT_FACTS_BUDGET = 8e3;
+var MEMORY_MD_CAP = 6e3;
+var MIN_FRAGMENT = 200;
+var MAX_SOURCE_BYTES = 1024 * 1024;
+var DAILY_RE = /^\d{4}-\d{2}-\d{2}\.md$/;
+function resolveWorkspaceDir(baseDir, agent, override) {
+  if (override) return expandHome(override);
+  const base = expandHome(baseDir);
+  const isMain2 = agent === "" || agent === "main";
+  try {
+    const cfg = JSON.parse(readFileSync5(join7(base, "openclaw.json"), "utf8"));
+    const agents = cfg?.agents;
+    if (agents && typeof agents === "object") {
+      const list = Array.isArray(agents.list) ? agents.list : [];
+      const wanted = isMain2 ? "main" : agent;
+      const entry = list.find((e) => e && typeof e === "object" && e.id === wanted);
+      const ws = entry?.workspace;
+      if (typeof ws === "string" && ws) return expandHome(ws);
+      const def = agents.defaults?.workspace;
+      if (typeof def === "string" && def) return expandHome(def);
+    }
+  } catch {
+  }
+  return isMain2 ? join7(base, "workspace") : join7(base, `workspace-${agent}`);
+}
+var TRUNC = "\u2026[truncated]";
+function headSlice(s, n) {
+  if (s.length <= n) return { text: s, clipped: false };
+  let out = s.slice(0, n);
+  const last = out.charCodeAt(out.length - 1);
+  if (last >= 55296 && last <= 56319) out = out.slice(0, -1);
+  return { text: out, clipped: true };
+}
+function tailSlice(s, n) {
+  if (s.length <= n) return { text: s, clipped: false };
+  let out = s.slice(s.length - n);
+  const first = out.charCodeAt(0);
+  if (first >= 56320 && first <= 57343) out = out.slice(1);
+  return { text: out, clipped: true };
+}
+function readBounded(path) {
+  if (statSync2(path).size > MAX_SOURCE_BYTES) return { text: null, oversize: true };
+  return { text: readFileSync5(path, "utf8"), oversize: false };
+}
+function readWorkspaceFacts(baseDir, agent, opts) {
+  const raw = opts?.charBudget;
+  const budget = typeof raw === "number" && Number.isInteger(raw) && raw >= 0 ? raw : DEFAULT_FACTS_BUDGET;
+  if (budget === 0) return { facts: [], truncated: false, missing: false };
+  const dir = resolveWorkspaceDir(baseDir, agent, opts?.workspaceDir);
+  const facts = [];
+  let truncated = false;
+  let remaining = budget;
+  try {
+    const r = readBounded(join7(dir, "MEMORY.md"));
+    if (r.oversize) truncated = true;
+    else if (r.text && r.text.trim()) {
+      const { text, clipped } = headSlice(r.text, Math.min(MEMORY_MD_CAP, budget));
+      truncated ||= clipped;
+      facts.push(`workspace MEMORY.md:
+${text}${clipped ? `
+${TRUNC}` : ""}`);
+      remaining -= text.length;
+    }
+  } catch {
+  }
+  try {
+    const dailies = readdirSync(join7(dir, "memory")).filter((f) => DAILY_RE.test(f)).sort().reverse().slice(0, 2);
+    for (const f of dailies) {
+      if (remaining < MIN_FRAGMENT) {
+        truncated = true;
+        break;
+      }
+      let r;
+      try {
+        r = readBounded(join7(dir, "memory", f));
+      } catch {
+        continue;
+      }
+      if (r.oversize) {
+        truncated = true;
+        continue;
+      }
+      if (!r.text || !r.text.trim()) continue;
+      const { text, clipped } = tailSlice(r.text, remaining);
+      truncated ||= clipped;
+      facts.push(`workspace memory/${f} (daily):
+${clipped ? `${TRUNC}
+` : ""}${text}`);
+      remaining -= text.length;
+    }
+  } catch {
+  }
+  return { facts, truncated, missing: facts.length === 0 };
+}
+
 // src/memory/openclaw-provider.ts
 var DEFAULT_K2 = 200;
 var OpenClawMemoryProvider = class {
-  constructor(store, baseDir, agent) {
+  // gauge: last successful returned total, including prefixes/markers
+  constructor(store, baseDir, agent, factsOpts) {
     this.store = store;
     this.baseDir = baseDir;
     this.agent = agent;
+    this.factsOpts = factsOpts;
   }
   noSession = 0;
   readFailed = 0;
+  factsMissing = 0;
+  // absence-shaped: resolved path missing or zero sources (per-call)
+  factsReadFailed = 0;
+  // anything THROWN out of the facts computation
+  factsTruncated = 0;
+  // budget clipped/dropped a source (incl. the 1MB skip)
+  factsChars = 0;
   async record(input) {
     if (input.modality !== "voice") return { seq: 0, deduped: true };
     return this.store.recordMemory({ ...input, text: `[voice] ${input.text}` });
   }
   async context(conversationId, limit) {
     const k = limit ?? DEFAULT_K2;
+    let wsFacts = [];
+    try {
+      const r = readWorkspaceFacts(this.baseDir, this.agent, {
+        workspaceDir: this.factsOpts?.workspaceDir,
+        charBudget: this.factsOpts?.factsCharBudget
+      });
+      wsFacts = r.facts;
+      if (r.missing) this.factsMissing++;
+      if (r.truncated) this.factsTruncated++;
+      this.factsChars = r.facts.reduce((n, f) => n + f.length, 0);
+    } catch {
+      this.factsReadFailed++;
+    }
+    const withFacts = (res) => ({
+      recent: res.recent,
+      facts: [...wsFacts, ...res.facts]
+    });
     const voice = await this.store.memoryContext(conversationId, k);
     let textTurns = [];
     try {
       const sid = resolveOwnerDmSession(this.baseDir, this.agent);
       if (!sid) {
         this.noSession++;
-        return voice;
+        return withFacts(voice);
       }
       textTurns = readRecentTurns(this.baseDir, this.agent, sid, k).map((t) => ({
         seq: 0,
@@ -4492,7 +4624,7 @@ var OpenClawMemoryProvider = class {
       }));
     } catch {
       this.readFailed++;
-      return voice;
+      return withFacts(voice);
     }
     const tagged = [
       ...textTurns.map((t, i) => ({ ...t, _src: 0, _i: i })),
@@ -4511,10 +4643,17 @@ var OpenClawMemoryProvider = class {
       text: t.text,
       ts: t.ts
     }));
-    return { recent, facts: voice.facts };
+    return withFacts({ recent, facts: voice.facts });
   }
   stats() {
-    return { openclaw_no_session: this.noSession, openclaw_read_failed: this.readFailed };
+    return {
+      openclaw_no_session: this.noSession,
+      openclaw_read_failed: this.readFailed,
+      openclaw_facts_missing: this.factsMissing,
+      openclaw_facts_read_failed: this.factsReadFailed,
+      openclaw_facts_truncated: this.factsTruncated,
+      openclaw_facts_chars: this.factsChars
+    };
   }
 };
 
@@ -4538,10 +4677,10 @@ var NullMemory = class {
     return { recent: [], facts: [] };
   }
 };
-function createMemoryProvider(provider, store, baseDir, agent) {
+function createMemoryProvider(provider, store, baseDir, agent, openclawFacts) {
   if (provider === "none") return new NullMemory();
   if (provider === "hermes") return new HermesMemoryProvider(baseDir ?? "~/.hermes");
-  if (provider === "openclaw") return new OpenClawMemoryProvider(store, baseDir ?? "~/.openclaw", agent ?? "");
+  if (provider === "openclaw") return new OpenClawMemoryProvider(store, baseDir ?? "~/.openclaw", agent ?? "", openclawFacts);
   return new SecureComsLocalMemory(store);
 }
 
@@ -4649,7 +4788,10 @@ var BridgeAgent = class _BridgeAgent {
       identityId: cfg.identityId,
       cipherFor: () => new KeyedInboxCipher(deriveMlsStoreKey(seed))
     });
-    this.memory = createMemoryProvider(this.cfg.memoryProvider, this.store, this.cfg.memoryBaseDir, this.cfg.memoryAgent);
+    this.memory = createMemoryProvider(this.cfg.memoryProvider, this.store, this.cfg.memoryBaseDir, this.cfg.memoryAgent, {
+      workspaceDir: this.cfg.memoryWorkspaceDir,
+      factsCharBudget: this.cfg.memoryFactsCharBudget
+    });
     this.provider = new MlsGroupKeyProvider({
       store: this.store,
       backend: this.backend,
@@ -4729,7 +4871,7 @@ var BridgeAgent = class _BridgeAgent {
       const j = await res.json();
       return String(j.attachment_id);
     };
-    this.attachmentsDirImpl = deps.attachmentsDir ?? join7(dirname3(cfg.storePath), "attachments");
+    this.attachmentsDirImpl = deps.attachmentsDir ?? join8(dirname3(cfg.storePath), "attachments");
     this.action = {
       begin: (channelId) => this.actionBegin(channelId),
       start: (opts) => this.actionStart(opts),
@@ -6257,11 +6399,11 @@ var BridgeAgent = class _BridgeAgent {
 
 // src/auth.ts
 import { randomBytes as randomBytes3, timingSafeEqual } from "node:crypto";
-import { existsSync, readFileSync as readFileSync5, writeFileSync } from "node:fs";
+import { existsSync, readFileSync as readFileSync6, writeFileSync } from "node:fs";
 function resolveToken(opts) {
   if (opts.token) return opts.token;
   const f = opts.tokenFile;
-  if (f && existsSync(f)) return readFileSync5(f, "utf8").trim();
+  if (f && existsSync(f)) return readFileSync6(f, "utf8").trim();
   const tok = randomBytes3(32).toString("base64url");
   if (f) writeFileSync(f, tok, { mode: 384 });
   return tok;
@@ -6832,8 +6974,8 @@ async function handleInbound(sock, agent, data, inflight) {
 }
 
 // src/bin.ts
-import { readFileSync as readFileSync7, mkdirSync as mkdirSync2, writeFileSync as writeFileSync3, rmSync, existsSync as existsSync2, realpathSync, readdirSync, statSync as statSync2 } from "node:fs";
-import { join as join11, dirname as dirname7, isAbsolute as isAbsolute2, resolve as resolve2 } from "node:path";
+import { readFileSync as readFileSync8, mkdirSync as mkdirSync2, writeFileSync as writeFileSync3, rmSync, existsSync as existsSync2, realpathSync, readdirSync as readdirSync2, statSync as statSync3 } from "node:fs";
+import { join as join12, dirname as dirname7, isAbsolute as isAbsolute2, resolve as resolve2 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { homedir as homedir2, userInfo } from "node:os";
 import { spawnSync } from "node:child_process";
@@ -7042,11 +7184,164 @@ function uninstallService(input, deps) {
 }
 
 // src/service/install-prep.ts
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 
 // src/service/wire.ts
-import { join as join8, dirname as dirname5 } from "node:path";
+import { join as join9, dirname as dirname5 } from "node:path";
 import { fileURLToPath } from "node:url";
+
+// src/service/hermes-config.ts
+var HERMES_PLUGIN_NAME = "securecoms-platform";
+function indentOf(line) {
+  const m = line.match(/^( *)/);
+  return m ? m[1].length : 0;
+}
+function isCommentLine(line) {
+  return /^\s*#/.test(line);
+}
+function isBlank(line) {
+  return line.trim() === "";
+}
+function parseKeyLine(line, key) {
+  const m = line.match(new RegExp(`^( *)${key}:(.*)$`));
+  if (!m) return null;
+  const indent = m[1].length;
+  const rest = m[2].trim();
+  if (rest === "" || rest.startsWith("#")) return { idx: -1, indent, inline: null };
+  return { idx: -1, indent, inline: rest };
+}
+function findKeyLine(lines, key, start, end) {
+  for (let i = start; i < end; i++) {
+    const parsed = parseKeyLine(lines[i], key);
+    if (parsed) return { ...parsed, idx: i };
+  }
+  return null;
+}
+function findBlockEnd(lines, start, parentIndent) {
+  let i = start;
+  for (; i < lines.length; i++) {
+    if (isBlank(lines[i])) continue;
+    if (indentOf(lines[i]) > parentIndent) continue;
+    break;
+  }
+  return i;
+}
+function stripQuotesAndComment(raw) {
+  let value = raw.replace(/\s+#.*$/, "").trim();
+  if (value.length >= 2) {
+    const first = value[0];
+    const last = value[value.length - 1];
+    if (first === '"' && last === '"' || first === "'" && last === "'") {
+      value = value.slice(1, -1);
+    }
+  }
+  return value;
+}
+function collectItems(lines, start) {
+  const items = [];
+  let i = start;
+  for (; i < lines.length; i++) {
+    const line = lines[i];
+    if (isCommentLine(line)) {
+      return { items, endIdx: i, ambiguous: true };
+    }
+    const m = line.match(/^( *)-\s*(.+?)\s*$/);
+    if (!m) break;
+    items.push({ idx: i, indent: m[1].length, value: stripQuotesAndComment(m[2]) });
+  }
+  return { items, endIdx: i, ambiguous: false };
+}
+var SIBLING_KEY_RE = /^[\w.-]+:(\s|$)/;
+function isLegitimateListEnd(lines, stopIdx, itemCol, enabledIndent) {
+  if (stopIdx >= lines.length) return true;
+  if (!isBlank(lines[stopIdx])) {
+    return indentOf(lines[stopIdx]) === enabledIndent && SIBLING_KEY_RE.test(lines[stopIdx].trim());
+  }
+  let i = stopIdx;
+  while (i < lines.length && isBlank(lines[i])) i++;
+  if (i >= lines.length) return true;
+  return indentOf(lines[i]) < itemCol;
+}
+function parseInlineList(inline) {
+  const trimmed = inline.trim();
+  if (!trimmed.startsWith("[") || !trimmed.endsWith("]")) return [];
+  const inner = trimmed.slice(1, -1).trim();
+  if (inner === "") return [];
+  return inner.split(",").map((s) => stripQuotesAndComment(s.trim()));
+}
+function noop(reason) {
+  return reason ? { action: "noop", reason } : { action: "noop" };
+}
+var MANUAL_INSTRUCTIONS = [
+  "add the following manually under the plugin's config (`~/.hermes/config.yaml`):",
+  "  plugins:",
+  "    enabled:",
+  `      - ${HERMES_PLUGIN_NAME}`
+].join("\n");
+function ensureHermesPluginEnabled(configText) {
+  const eol = configText.includes("\r\n") ? "\r\n" : "\n";
+  const lines = configText.split(/\r\n|\n/);
+  const pluginsIdx = lines.findIndex((l) => /^plugins:\s*(#.*)?$/.test(l));
+  if (pluginsIdx === -1) {
+    return noop(`no \`plugins:\` block found in config.yaml \u2014 ${MANUAL_INSTRUCTIONS}`);
+  }
+  const pluginsIndent = indentOf(lines[pluginsIdx]);
+  const blockEnd = findBlockEnd(lines, pluginsIdx + 1, pluginsIndent);
+  const enabledKey = findKeyLine(lines, "enabled", pluginsIdx + 1, blockEnd);
+  if (!enabledKey) {
+    return noop(`no \`plugins.enabled\` key found in config.yaml \u2014 ${MANUAL_INSTRUCTIONS}`);
+  }
+  if (enabledKey.inline !== null) {
+    return noop(
+      `plugins.enabled uses the inline \`enabled: [...]\` form, which this editor refuses to rewrite (never reformat) \u2014 ${MANUAL_INSTRUCTIONS}`
+    );
+  }
+  const { items, endIdx, ambiguous } = collectItems(lines, enabledKey.idx + 1);
+  if (ambiguous) {
+    return noop(
+      `a comment line interrupts the plugins.enabled list \u2014 refusing rather than guess whether it belongs to the item above or below; ${MANUAL_INSTRUCTIONS}`
+    );
+  }
+  if (items.length === 0) {
+    return noop(`plugins.enabled has no items to copy an indent column from (empty list) \u2014 ${MANUAL_INSTRUCTIONS}`);
+  }
+  const col = items[0].indent;
+  if (items.some((it) => it.indent !== col)) {
+    return noop(`plugins.enabled items are inconsistently indented \u2014 refusing to guess the right column; ${MANUAL_INSTRUCTIONS}`);
+  }
+  const disabledKey = findKeyLine(lines, "disabled", pluginsIdx + 1, blockEnd);
+  let disabledEntries = [];
+  if (disabledKey) {
+    if (disabledKey.inline !== null) {
+      disabledEntries = parseInlineList(disabledKey.inline);
+    } else {
+      disabledEntries = collectItems(lines, disabledKey.idx + 1).items.map((it) => it.value);
+    }
+  }
+  if (disabledEntries.includes(HERMES_PLUGIN_NAME)) {
+    return noop(
+      `${HERMES_PLUGIN_NAME} is listed under plugins.disabled, which wins over plugins.enabled in the Hermes loader \u2014 remove it from plugins.disabled (or move it to plugins.enabled) manually, then re-run wire.`
+    );
+  }
+  if (items.some((it) => it.value === HERMES_PLUGIN_NAME)) {
+    return { action: "noop" };
+  }
+  if (!isLegitimateListEnd(lines, endIdx, col, enabledKey.indent)) {
+    return noop(
+      `plugins.enabled's list doesn't end at a recognized boundary (expected a sibling key, a blank-then-dedent, or end of file) \u2014 refusing to insert at an unverified spot; ${MANUAL_INSTRUCTIONS}`
+    );
+  }
+  const insertLine = `${" ".repeat(col)}- ${HERMES_PLUGIN_NAME}`;
+  const newLines = [...lines.slice(0, endIdx), insertLine, ...lines.slice(endIdx)];
+  return { action: "edited", text: newLines.join(eol) };
+}
+
+// src/service/wire.ts
+var CONNECTOR_FILE_EXTENSIONS = {
+  openclaw: [".js", ".json"],
+  hermes: [".py", ".yaml", ".json"]
+};
+var CONNECTOR_SKIP_DIRS = /* @__PURE__ */ new Set(["tests", "__pycache__"]);
 function detectHarness(home, statDir) {
   if (statDir(`${home}/.openclaw`)) return "openclaw";
   if (statDir(`${home}/.hermes`)) return "hermes";
@@ -7054,11 +7349,41 @@ function detectHarness(home, statDir) {
 }
 function connectorTargetDir(home, harness) {
   if (harness === "openclaw") return `${home}/.openclaw/local-plugins/securecoms`;
-  return `${home}/.hermes/local-plugins/securecoms`;
+  return `${home}/.hermes/plugins/securecoms`;
 }
-function connectorsSrcDir(importMetaUrl) {
+function connectorsSrcDir(importMetaUrl, harness) {
   const pkgRoot = dirname5(dirname5(fileURLToPath(importMetaUrl)));
-  return join8(pkgRoot, "connectors", "openclaw");
+  return join9(pkgRoot, "connectors", harness);
+}
+function hermesConfigPath(home) {
+  return `${home}/.hermes/config.yaml`;
+}
+function hermesConfigBackupPath(configPath, ts, pid) {
+  return `${configPath}.bak-wire-${ts}-${pid}`;
+}
+function enableHermesConfig(home, deps) {
+  const path = hermesConfigPath(home);
+  const text = deps.readHermesConfig(path);
+  if (text === null) {
+    return {
+      ok: false,
+      message: `Hermes config.yaml not found at ${path} (is ~/.hermes installed?) \u2014 add the plugin manually:
+  plugins:
+    enabled:
+      - ${HERMES_PLUGIN_NAME}`
+    };
+  }
+  const result = ensureHermesPluginEnabled(text);
+  if (result.action === "noop") {
+    if (result.reason) return { ok: false, message: result.reason };
+    return { ok: true, message: `${HERMES_PLUGIN_NAME} is already enabled in ${path}.` };
+  }
+  deps.backupHermesConfig(path, text);
+  deps.writeHermesConfig(path, result.text);
+  return {
+    ok: true,
+    message: `enabled ${HERMES_PLUGIN_NAME} in ${path} (the original was backed up alongside it as config.yaml.bak-wire-<ts>-<pid>).`
+  };
 }
 function parseArg(argv, flag) {
   const i = argv.indexOf(flag);
@@ -7086,15 +7411,19 @@ function runWire(deps) {
   const resolved = resolveEntry(deps);
   if (!resolved) return 1;
   const { entry, harness } = resolved;
-  if (harness === "hermes") {
-    deps.log(
-      "[securecoms] Hermes connector is not available yet (fast-follow); detection and target dir only. Nothing installed."
-    );
-    return 1;
-  }
   const targetDir = connectorTargetDir(deps.home, harness);
-  deps.copyConnector(deps.connectorsSrcDir, targetDir);
+  deps.copyConnector(deps.connectorsSrcDir(harness), targetDir, harness);
   deps.writeBinding(targetDir, entry.identityId);
+  if (harness === "hermes") {
+    const enabled = enableHermesConfig(deps.home, deps);
+    deps.log(`[securecoms] ${enabled.message}`);
+    if (!enabled.ok) {
+      deps.log(
+        "wire: Hermes connector files were copied and the binding was written, but the config.yaml plugin entry was NOT enabled automatically \u2014 the harness is NOT wired until you add it manually (see above) and restart the gateway."
+      );
+      return 1;
+    }
+  }
   if (typeof entry.port === "number") {
     const h = deps.getHealth(entry.port);
     if (h && (h.agent_sessions ?? 0) >= 1) {
@@ -7105,17 +7434,23 @@ function runWire(deps) {
   } else {
     deps.log(`wire: connector installed (no bridge port known yet) \u2014 restart the harness to pick it up.`);
   }
+  if (harness === "hermes") {
+    deps.log(
+      "wire: restart the Hermes gateway (`launchctl kickstart -k gui/$UID/ai.hermes.gateway` or your service manager) to pick up the connector."
+    );
+  }
   return 0;
 }
 function runUnwire(deps) {
   const resolved = resolveEntry(deps);
   if (!resolved) return 1;
   const { harness } = resolved;
+  deps.removeBinding(connectorTargetDir(deps.home, harness));
   if (harness === "hermes") {
-    deps.log("[securecoms] Hermes connector is not available yet (fast-follow); nothing to remove.");
-    return 0;
+    deps.log(
+      "[securecoms] Hermes binding removed. The connector files under ~/.hermes/plugins/securecoms and the plugins.enabled entry in config.yaml remain \u2014 removing a listed plugin's files would make Hermes log load errors at boot. Edit config.yaml manually to fully remove it, then restart the gateway."
+    );
   }
-  deps.removeBinding(connectorTargetDir(deps.home, harness));
   return 0;
 }
 
@@ -7132,8 +7467,8 @@ function customFacts(input) {
 function autoWireHarness(input, deps) {
   const h = input.harness;
   if (!h || h === "none") return { echo: "", wired: false, error: false };
-  const retry = `agent-bridge wire --harness openclaw --identity ${input.slug}`;
   if (h === "openclaw") {
+    const retry = `agent-bridge wire --harness openclaw --identity ${input.slug}`;
     const parent = `${input.home}/.openclaw`;
     if (!deps.statDir(parent)) {
       return {
@@ -7147,7 +7482,7 @@ function autoWireHarness(input, deps) {
     const targetDir = connectorTargetDir(input.home, "openclaw");
     try {
       const prev = deps.readBinding(targetDir);
-      deps.copyConnector(input.connectorsSrcDir, targetDir);
+      deps.copyConnector(input.connectorsSrcDir, targetDir, "openclaw");
       deps.writeBinding(targetDir, input.identityId);
       const rebind = prev && prev !== input.identityId ? `
   rebind: ${prev} \u2192 ${input.identityId}` : "";
@@ -7167,8 +7502,48 @@ function autoWireHarness(input, deps) {
     }
   }
   if (h === "hermes") {
-    return { echo: `[securecoms] Hermes turnkey connector is coming (Phase 2). For now drive Hermes via the custom WS path:
-${customFacts(input)}`, wired: false, error: false };
+    const retry = `agent-bridge wire --harness hermes --identity ${input.slug}`;
+    const parent = `${input.home}/.hermes`;
+    if (!deps.statDir(parent)) {
+      return {
+        echo: `[securecoms] Hermes not found at ~/.hermes \u2014 the bridge service is installed, but the harness was NOT wired.
+  Install Hermes, then re-run install, or run: ${retry}
+  (or re-run install with --harness custom).`,
+        wired: false,
+        error: true
+      };
+    }
+    const targetDir = connectorTargetDir(input.home, "hermes");
+    try {
+      const prev = deps.readBinding(targetDir);
+      deps.copyConnector(input.connectorsSrcDir, targetDir, "hermes");
+      deps.writeBinding(targetDir, input.identityId);
+      const enabled = enableHermesConfig(input.home, deps);
+      if (!enabled.ok) {
+        return {
+          echo: `[securecoms] Hermes connector copied and bound to identity ${input.identityId}, but the config.yaml plugin entry was NOT enabled automatically: ${enabled.message}
+  The harness is NOT wired until you add it manually and restart the gateway.`,
+          wired: false,
+          error: true
+        };
+      }
+      const rebind = prev && prev !== input.identityId ? `
+  rebind: ${prev} \u2192 ${input.identityId}` : "";
+      return {
+        echo: `[securecoms] Hermes connector installed and bound to identity ${input.identityId}.${rebind}
+  ${enabled.message}
+  Restart the Hermes gateway (\`launchctl kickstart -k gui/$UID/ai.hermes.gateway\` or your service manager) after install completes.`,
+        wired: true,
+        error: false
+      };
+    } catch (e) {
+      return {
+        echo: `[securecoms] the bridge service is installed, but wiring the Hermes connector FAILED: ${e.message}
+  Retry after fixing the path: ${retry}`,
+        wired: false,
+        error: true
+      };
+    }
   }
   return { echo: `[securecoms] Custom harness \u2014 bring your own connector:
 ${customFacts(input)}`, wired: false, error: false };
@@ -7197,10 +7572,10 @@ function assertReadableCredential(absPath, deps) {
   return { deviceId: json2.device_id, identityId: json2.identity_id, issuedAt };
 }
 function durableDir(home, slug) {
-  return join9(home, `securecoms-agent-${slug}`);
+  return join10(home, `securecoms-agent-${slug}`);
 }
 function durableCredentialPath(home, slug) {
-  return join9(durableDir(home, slug), `${slug}.json`);
+  return join10(durableDir(home, slug), `${slug}.json`);
 }
 function takeCustody(args2, deps) {
   const dir = durableDir(args2.home, args2.slug);
@@ -7247,7 +7622,7 @@ function readSiblingDefs(dir, prefix, deps) {
   for (const n of names) {
     if (!n.startsWith(prefix)) continue;
     try {
-      out.push(deps.readFile(join9(dir, n)));
+      out.push(deps.readFile(join10(dir, n)));
     } catch {
     }
   }
@@ -7443,29 +7818,29 @@ function renderStatusTable(rows) {
 import {
   chmodSync,
   mkdirSync,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync7,
   renameSync,
   unlinkSync,
   writeFileSync as writeFileSync2
 } from "node:fs";
 import { randomUUID } from "node:crypto";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 var REAL_FS = {
   mkdir: (p, mode) => mkdirSync(p, { recursive: true, mode }),
   chmod: (p, mode) => chmodSync(p, mode),
   writeFile: (p, data, mode) => writeFileSync2(p, data, { mode }),
   rename: (a, b) => renameSync(a, b),
-  readFile: (p) => readFileSync6(p, "utf8"),
+  readFile: (p) => readFileSync7(p, "utf8"),
   unlink: (p) => unlinkSync(p)
 };
 function securecomsDir(home) {
-  return join10(home, ".securecoms");
+  return join11(home, ".securecoms");
 }
 function connectionsDir(home) {
-  return join10(securecomsDir(home), "connections");
+  return join11(securecomsDir(home), "connections");
 }
 function connectionFilePath(home, identityId) {
-  return join10(connectionsDir(home), `${identityId}.json`);
+  return join11(connectionsDir(home), `${identityId}.json`);
 }
 function newInstanceId() {
   return randomUUID();
@@ -7580,7 +7955,7 @@ function realResolveDeps() {
 }
 function realPrepDeps() {
   return {
-    readFile: (p) => readFileSync7(p, "utf8"),
+    readFile: (p) => readFileSync8(p, "utf8"),
     writeFileMode: (p, data, mode) => writeFileSync3(p, data, { mode }),
     mkdirp: (p, mode) => {
       mkdirSync2(p, { recursive: true, mode: mode ?? 493 });
@@ -7589,7 +7964,7 @@ function realPrepDeps() {
     realpath: (p) => realpathSync(p),
     listDir: (p) => {
       try {
-        return readdirSync(p);
+        return readdirSync2(p);
       } catch {
         return [];
       }
@@ -7631,12 +8006,12 @@ function realReadFleet() {
     home: homedir2(),
     listDir: (p) => {
       try {
-        return readdirSync(p);
+        return readdirSync2(p);
       } catch {
         return [];
       }
     },
-    readFile: (p) => readFileSync7(p, "utf8")
+    readFile: (p) => readFileSync8(p, "utf8")
   });
 }
 function runStatus() {
@@ -7656,40 +8031,56 @@ function runStatus() {
   else process.stdout.write(renderStatusTable(rows));
   process.exit(0);
 }
-function realCopyConnector(srcDir, dstDir) {
+function realCopyConnector(srcDir, dstDir, harness) {
+  const allowedExt = CONNECTOR_FILE_EXTENSIONS[harness];
   mkdirSync2(dstDir, { recursive: true });
-  for (const name of readdirSync(srcDir)) {
-    const srcPath = join11(srcDir, name);
-    if (statSync2(srcPath).isDirectory()) {
-      realCopyConnector(srcPath, join11(dstDir, name));
+  for (const name of readdirSync2(srcDir)) {
+    const srcPath = join12(srcDir, name);
+    if (statSync3(srcPath).isDirectory()) {
+      if (CONNECTOR_SKIP_DIRS.has(name)) continue;
+      realCopyConnector(srcPath, join12(dstDir, name), harness);
       continue;
     }
-    if (!/\.(js|json)$/.test(name)) continue;
-    writeFileSync3(join11(dstDir, name), readFileSync7(srcPath));
+    if (name.includes(".test.")) continue;
+    if (!allowedExt.some((ext) => name.endsWith(ext))) continue;
+    writeFileSync3(join12(dstDir, name), readFileSync8(srcPath));
   }
 }
 function realWriteBinding(dstDir, identityId) {
   mkdirSync2(dstDir, { recursive: true });
-  writeFileSync3(join11(dstDir, "securecoms.binding.json"), JSON.stringify({ identity_id: identityId }) + "\n", { mode: 384 });
+  writeFileSync3(join12(dstDir, "securecoms.binding.json"), JSON.stringify({ identity_id: identityId }) + "\n", { mode: 384 });
 }
 function realReadBinding(dstDir) {
   try {
-    const parsed = JSON.parse(readFileSync7(join11(dstDir, "securecoms.binding.json"), "utf8"));
+    const parsed = JSON.parse(readFileSync8(join12(dstDir, "securecoms.binding.json"), "utf8"));
     return parsed.identity_id ?? null;
   } catch {
     return null;
   }
 }
 function realRemoveBinding(dstDir) {
-  rmSync(join11(dstDir, "securecoms.binding.json"), { force: true });
+  rmSync(join12(dstDir, "securecoms.binding.json"), { force: true });
 }
 function realStatDir(p) {
   try {
-    return statSync2(p).isDirectory();
+    return statSync3(p).isDirectory();
   } catch {
     return false;
   }
 }
+function realReadHermesConfig(p) {
+  try {
+    return readFileSync8(p, "utf8");
+  } catch {
+    return null;
+  }
+}
+function realBackupHermesConfig(p, originalText) {
+  writeFileSync3(hermesConfigBackupPath(p, Date.now(), process.pid), originalText, "utf8");
+}
+function realWriteHermesConfig(p, newText) {
+  writeFileSync3(p, newText, "utf8");
+}
 function realWireArgv() {
   if (process.argv.includes("--harness")) return process.argv;
   const detected = detectHarness(homedir2(), realStatDir);
@@ -7706,8 +8097,12 @@ function realWireDeps() {
     getHealth: realGetHealth,
     log: (s) => process.stdout.write(s + "\n"),
     // bin.ts's OWN import.meta.url — see connectorsSrcDir's doc comment in
-    // wire.ts for why it must be the entry point's URL, not wire.ts's.
-    connectorsSrcDir: connectorsSrcDir(import.meta.url)
+    // wire.ts for why it must be the entry point's URL, not wire.ts's. Keyed
+    // by harness (Task 6) so one WireDeps instance can wire either harness.
+    connectorsSrcDir: (h) => connectorsSrcDir(import.meta.url, h),
+    readHermesConfig: realReadHermesConfig,
+    backupHermesConfig: realBackupHermesConfig,
+    writeHermesConfig: realWriteHermesConfig
   };
 }
 function runWireVerb(verb) {
@@ -7736,21 +8131,25 @@ async function runServiceVerb(verb) {
         argOrEnv("--exec-path", "SECURECOMS_EXEC_PATH"),
         realResolveNodeDeps()
       );
+      const installHarness = argOrEnv("--harness", "SECURECOMS_HARNESS");
       const r = await orchestrateInstall({
         credentialAbsPath: credAbs,
         label,
         explicitPort: portStr ? Number(portStr) : void 0,
-        harness: argOrEnv("--harness", "SECURECOMS_HARNESS"),
+        harness: installHarness,
         home: homedir2(),
-        connectorsSrcDir: connectorsSrcDir(import.meta.url),
+        connectorsSrcDir: connectorsSrcDir(import.meta.url, installHarness === "hermes" ? "hermes" : "openclaw"),
         autoWireDeps: {
           statDir: realStatDir,
-          // reuse bin.ts:235
+          // reuse bin.ts:266
           readBinding: realReadBinding,
           copyConnector: realCopyConnector,
-          // bin.ts:212 — one copy impl
+          // bin.ts:225 — one copy impl
           writeBinding: realWriteBinding,
-          // bin.ts:226 — writes {identity_id}
+          // bin.ts:245 — writes {identity_id}
+          readHermesConfig: realReadHermesConfig,
+          backupHermesConfig: realBackupHermesConfig,
+          writeHermesConfig: realWriteHermesConfig,
           log: (s) => process.stderr.write(s + "\n")
         },
         prepDeps: realPrepDeps(),
@@ -7830,11 +8229,11 @@ async function main() {
 `);
     process.exit(1);
   }
-  const tokenFile = daemon.tokenFile ?? join11(dirname7(credentialPath), "bridge-token");
+  const tokenFile = daemon.tokenFile ?? join12(dirname7(credentialPath), "bridge-token");
   const token = resolveToken({ tokenFile, token: daemon.token });
   const agent = new BridgeAgent(cfg);
   await agent.start();
-  const tls = daemon.tls ? { cert: readFileSync7(daemon.tlsCert, "utf8"), key: readFileSync7(daemon.tlsKey, "utf8") } : void 0;
+  const tls = daemon.tls ? { cert: readFileSync8(daemon.tlsCert, "utf8"), key: readFileSync8(daemon.tlsKey, "utf8") } : void 0;
   const { server, closeAllSseStreams } = createHttpServer(agent, { token, allowOrigins: daemon.allowOrigins, tls, websocket: true });
   const agentWs = attachAgentWebSocket(server, agent, { token, allowOrigins: daemon.allowOrigins });
   let down = false;
@@ -7897,6 +8296,7 @@ export {
   chooseInstallExecPath,
   nodeMajorOk,
   parseVerb,
+  realCopyConnector,
   slugFromCredentialPath,
   tokenFingerprint
 };