@simplr-ai/connect 0.7.6 → 0.7.8

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   spawnSync
 } from "child_process";
 import {
-  createHash,
+  createHash as createHash2,
   createPublicKey,
   randomBytes,
   randomUUID,
@@ -18,18 +18,52 @@ import {
   access,
   chmod,
   copyFile,
-  mkdir,
+  mkdir as mkdir2,
   open,
-  readFile,
-  readdir,
+  readFile as readFile2,
+  readdir as readdir2,
   rename,
+  symlink,
   unlink,
   writeFile
 } from "fs/promises";
 import { arch, homedir, hostname, platform } from "os";
-import { basename, join as join2 } from "path";
+import { basename, join as join3 } from "path";
 import { createServer } from "http";
 
+// src/execution-tools.ts
+import { createHash } from "crypto";
+import { cp, mkdir, readFile, readdir, rm } from "fs/promises";
+import { join, relative } from "path";
+async function directoryFingerprint(directory) {
+  const hash = createHash("sha256");
+  const visit = async (current) => {
+    const entries = await readdir(current, { withFileTypes: true });
+    for (const entry of entries.sort(
+      (left, right) => left.name.localeCompare(right.name)
+    )) {
+      const path = join(current, entry.name);
+      const name = relative(directory, path);
+      hash.update(`${entry.isDirectory() ? "directory" : "file"}:${name}\0`);
+      if (entry.isDirectory()) await visit(path);
+      else if (entry.isFile()) hash.update(await readFile(path));
+    }
+  };
+  await visit(directory);
+  return hash.digest("hex");
+}
+async function syncDirectoryContents(source, destination) {
+  const sourceFingerprint = await directoryFingerprint(source);
+  const destinationFingerprint = await directoryFingerprint(destination).catch(
+    () => void 0
+  );
+  if (sourceFingerprint === destinationFingerprint) return false;
+  await rm(destination, { recursive: true, force: true });
+  await mkdir(destination, { recursive: true, mode: 448 });
+  await cp(source, destination, { recursive: true, force: true });
+  return true;
+}
+
 // src/connections.ts
 function connectionKey(connection) {
   return `${connection.api_url}|${connection.organization_id}`;
@@ -86,7 +120,7 @@ function assertTenantEnvelope(connection, command) {
 }
 
 // src/hermes-config.ts
-import { join } from "path";
+import { join as join2 } from "path";
 function organizationIdsNeedingMcpConfiguration(connections, configuredVersion, requiredVersion) {
   if (configuredVersion === requiredVersion) return [];
   return connections.filter((connection) => connection.setup_status === "ready").map((connection) => connection.organization_id);
@@ -102,10 +136,10 @@ function mcpServerNamesFromConfiguration(contents) {
 }
 function mcpConfigurationPaths(homeDirectory, workingDirectory, organizationId) {
   return [
-    join(homeDirectory, ".codex", "config.toml"),
-    join(homeDirectory, ".claude.json"),
-    join(workingDirectory, ".mcp.json"),
-    join(
+    join2(homeDirectory, ".codex", "config.toml"),
+    join2(homeDirectory, ".claude.json"),
+    join2(workingDirectory, ".mcp.json"),
+    join2(
       homeDirectory,
       ".hermes",
       "profiles",
@@ -126,6 +160,29 @@ function workOrderClassification(payload) {
 function awaitsFeaturePlanApproval(classification) {
   return classification.work_order_kind === "feature" && classification.source_type === "feedback" && classification.execution_mode === "plan";
 }
+function isIncompleteCodeWorkResult(classification, output) {
+  if (!["fix", "fix_and_ship"].includes(String(classification.execution_mode)))
+    return false;
+  if (typeof output !== "string") return false;
+  const hasExecutorBlocker = /(?:executor|codex|claude code)[\s\S]{0,160}(?:blocked|unavailable|not installed|oauth)|(?:blocked|unavailable|not installed|oauth)[\s\S]{0,160}(?:executor|codex|claude code)/i.test(
+    output
+  ) || /stopped before code changes due to required executor blocker/i.test(output);
+  return /files changed:\s*(?:none|0)\b/i.test(output) && /pull request:\s*(?:none|not created)\b/i.test(output) && hasExecutorBlocker;
+}
+function isRecoverableIncompleteCompletion(entry) {
+  return entry.type === "run_hermes" && entry.status === "completed" && entry.source_type === "feedback" && isIncompleteCodeWorkResult(entry, entry.result);
+}
+function matchesCommandAcknowledgement(commandId, status, acknowledgement) {
+  return acknowledgement.command_id === commandId && acknowledgement.status === status;
+}
+function isHermesRunCancellation(message) {
+  return message === "Hermes run cancelled" || message === "Hermes run exceeded the 30 minute monitoring window and was stopped";
+}
+function shouldRestartHermesForExecutionTools(restartPending, journalStatuses) {
+  return restartPending && !journalStatuses.some(
+    (status) => ["preparing", "creating", "running", "waiting_approval"].includes(status)
+  );
+}
 function workOrderPayload(classification) {
   return {
     ...classification.work_order_kind ? { work_order_kind: classification.work_order_kind } : {},
@@ -200,7 +257,14 @@ var KanbanReconciliationError = class extends Error {
 };
 var DeferredUpdateError = class extends Error {
 };
-var APP_VERSION = "0.7.6";
+var HermesRequestError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+  }
+  status;
+};
+var APP_VERSION = "0.7.8";
 var STANDALONE_EXECUTABLE = process.env.SIMPLR_CONNECT_STANDALONE === "true";
 var MANIFEST_PUBLIC_KEY = process.env.SIMPLR_CONNECT_MANIFEST_PUBLIC_KEY || "";
 var HERMES_INSTALL_COMMIT = "542e146b055f0d43767ac43cdb9e78054b240263";
@@ -216,45 +280,45 @@ var hermesTraceMutation = Promise.resolve();
 var serviceExecutableSnapshot;
 function stateDirectory() {
   if (platform() === "darwin")
-    return join2(homedir(), "Library", "Application Support", "Simplr Connect");
+    return join3(homedir(), "Library", "Application Support", "Simplr Connect");
   if (platform() === "win32")
-    return join2(
-      process.env.APPDATA || join2(homedir(), "AppData", "Roaming"),
+    return join3(
+      process.env.APPDATA || join3(homedir(), "AppData", "Roaming"),
       "Simplr Connect"
     );
-  return join2(
-    process.env.XDG_CONFIG_HOME || join2(homedir(), ".config"),
+  return join3(
+    process.env.XDG_CONFIG_HOME || join3(homedir(), ".config"),
     "simplr-connect"
   );
 }
 function statePath() {
-  return join2(stateDirectory(), "state.json");
+  return join3(stateDirectory(), "state.json");
 }
 function encryptedCredentialPath(workstationId) {
-  return join2(
+  return join3(
     stateDirectory(),
     workstationId ? `credential-${workstationId}.bin` : "credential.bin"
   );
 }
 function encryptedAgentCredentialPath(workstationId) {
-  return join2(stateDirectory(), `agent-credential-${workstationId}.bin`);
+  return join3(stateDirectory(), `agent-credential-${workstationId}.bin`);
 }
 function encryptedHermesCredentialPath() {
-  return join2(stateDirectory(), "hermes-credential.bin");
+  return join3(stateDirectory(), "hermes-credential.bin");
 }
 function commandJournalPath() {
-  return join2(stateDirectory(), "commands.json");
+  return join3(stateDirectory(), "commands.json");
 }
 function hermesTracePath() {
-  return join2(stateDirectory(), "hermes-traces.json");
+  return join3(stateDirectory(), "hermes-traces.json");
 }
 function serviceLogPath() {
-  return join2(stateDirectory(), "connect.log");
+  return join3(stateDirectory(), "connect.log");
 }
 function serviceExecutablePath() {
   if (!STANDALONE_EXECUTABLE)
-    return join2(stateDirectory(), "simplr-connect.js");
-  return join2(
+    return join3(stateDirectory(), "simplr-connect.js");
+  return join3(
     stateDirectory(),
     platform() === "win32" ? "simplr-connect.exe" : "simplr-connect"
   );
@@ -266,28 +330,28 @@ function updateRollbackPath() {
   return `${serviceExecutablePath()}.rollback`;
 }
 function supervisorLockPath() {
-  return join2(stateDirectory(), "supervisor.lock");
+  return join3(stateDirectory(), "supervisor.lock");
 }
 function serviceLockPath() {
-  return join2(stateDirectory(), "service.lock");
+  return join3(stateDirectory(), "service.lock");
 }
 function serviceDefinitionPath() {
   if (platform() === "darwin")
-    return join2(
+    return join3(
       homedir(),
       "Library",
       "LaunchAgents",
       "ai.simplr.connect.plist"
     );
   if (platform() === "linux")
-    return join2(
+    return join3(
       homedir(),
       ".config",
       "systemd",
       "user",
       "simplr-connect.service"
     );
-  return join2(stateDirectory(), "simplr-connect-service.cmd");
+  return join3(stateDirectory(), "simplr-connect-service.cmd");
 }
 function apiUrl(override) {
   const value = override || process.env.SIMPLR_API_URL;
@@ -397,11 +461,11 @@ function hermesExecutableCandidates() {
     const localAppData = process.env.LOCALAPPDATA;
     if (localAppData)
       candidates.push(
-        join2(localAppData, "hermes", "hermes-agent", "bin", "hermes.exe")
+        join3(localAppData, "hermes", "hermes-agent", "bin", "hermes.exe")
       );
   } else {
     candidates.push(
-      join2(homedir(), ".local", "bin", "hermes"),
+      join3(homedir(), ".local", "bin", "hermes"),
       "/usr/local/bin/hermes"
     );
     if (platform() === "darwin") candidates.push("/opt/homebrew/bin/hermes");
@@ -722,15 +786,15 @@ async function existingDirectories(paths) {
 }
 async function detectSkills() {
   const paths = await existingDirectories([
-    join2(homedir(), ".agents", "skills"),
-    join2(homedir(), ".claude", "skills"),
-    join2(process.cwd(), ".agents", "skills"),
-    join2(process.cwd(), ".claude", "skills"),
-    join2(homedir(), ".hermes", "skills")
+    join3(homedir(), ".agents", "skills"),
+    join3(homedir(), ".claude", "skills"),
+    join3(process.cwd(), ".agents", "skills"),
+    join3(process.cwd(), ".claude", "skills"),
+    join3(homedir(), ".hermes", "skills")
   ]);
   const skills = /* @__PURE__ */ new Map();
   for (const path of paths) {
-    const entries = await readdir(path, { withFileTypes: true }).catch(
+    const entries = await readdir2(path, { withFileTypes: true }).catch(
       () => []
     );
     for (const entry of entries) {
@@ -751,7 +815,7 @@ async function detectMcpServers(state) {
     mcpConfigurationPaths(homedir(), process.cwd(), state.organization_id)
   );
   const contents = await Promise.all(
-    configPaths.map((path) => readFile(path, "utf8").catch(() => ""))
+    configPaths.map((path) => readFile2(path, "utf8").catch(() => ""))
   );
   const names = new Set(mcpServerNamesFromConfiguration(contents));
   for (const content of contents) {
@@ -845,7 +909,7 @@ async function get(url, token) {
   return payload.content;
 }
 async function saveState(state) {
-  await mkdir(stateDirectory(), { recursive: true, mode: 448 });
+  await mkdir2(stateDirectory(), { recursive: true, mode: 448 });
   const { device_token: legacyToken, ...safeState } = state;
   void legacyToken;
   await writeFile(statePath(), `${JSON.stringify(safeState, null, 2)}
@@ -856,7 +920,7 @@ async function saveState(state) {
   if (platform() !== "win32") await chmod(statePath(), 384);
 }
 async function loadState() {
-  const stored = JSON.parse(await readFile(statePath(), "utf8"));
+  const stored = JSON.parse(await readFile2(statePath(), "utf8"));
   if (stored.device_token) {
     await storeCredential(stored.workstation_id, stored.device_token);
     delete stored.device_token;
@@ -867,13 +931,13 @@ async function loadState() {
 }
 async function loadCommandJournal() {
   try {
-    return JSON.parse(await readFile(commandJournalPath(), "utf8"));
+    return JSON.parse(await readFile2(commandJournalPath(), "utf8"));
   } catch {
     return {};
   }
 }
 async function saveCommandJournal(journal) {
-  await mkdir(stateDirectory(), { recursive: true, mode: 448 });
+  await mkdir2(stateDirectory(), { recursive: true, mode: 448 });
   const temporaryPath = `${commandJournalPath()}.${process.pid}.tmp`;
   await writeFile(temporaryPath, `${JSON.stringify(journal, null, 2)}
 `, {
@@ -903,13 +967,13 @@ async function removeCommandJournalEntry(commandId) {
 }
 async function loadHermesTraces() {
   try {
-    return JSON.parse(await readFile(hermesTracePath(), "utf8"));
+    return JSON.parse(await readFile2(hermesTracePath(), "utf8"));
   } catch {
     return {};
   }
 }
 async function saveHermesTraces(traces) {
-  await mkdir(stateDirectory(), { recursive: true, mode: 448 });
+  await mkdir2(stateDirectory(), { recursive: true, mode: 448 });
   const retained = Object.fromEntries(Object.entries(traces).sort(([, left], [, right]) => Date.parse(right.last_event_at) - Date.parse(left.last_event_at)).slice(0, 25));
   const temporaryPath = `${hermesTracePath()}.${process.pid}.tmp`;
   await writeFile(temporaryPath, `${JSON.stringify(retained, null, 2)}
@@ -994,7 +1058,7 @@ async function storeMacKeychainCredential(account, service, token) {
     throw new Error("Could not protect the credential in macOS Keychain");
 }
 async function storeCredential(workstationId, token) {
-  await mkdir(stateDirectory(), { recursive: true, mode: 448 });
+  await mkdir2(stateDirectory(), { recursive: true, mode: 448 });
   if (platform() === "darwin") {
     await storeMacKeychainCredential(workstationId, "Simplr Connect", token);
     return;
@@ -1072,10 +1136,10 @@ async function loadCredential(state) {
     );
     if (result.ok && result.output) return result.output;
   } else {
-    const encrypted = await readFile(
+    const encrypted = await readFile2(
       encryptedCredentialPath(state.workstation_id),
       "utf8"
-    ).catch(() => readFile(encryptedCredentialPath(), "utf8"));
+    ).catch(() => readFile2(encryptedCredentialPath(), "utf8"));
     const script = "$e=[Convert]::FromBase64String([Console]::In.ReadToEnd());$b=[Security.Cryptography.ProtectedData]::Unprotect($e,$null,[Security.Cryptography.DataProtectionScope]::CurrentUser);[Text.Encoding]::UTF8.GetString($b)";
     const result = spawnSync(
       "powershell.exe",
@@ -1163,7 +1227,7 @@ async function loadAgentCredential(state) {
     );
     if (result.ok && result.output) return result.output;
   } else {
-    const encrypted = await readFile(
+    const encrypted = await readFile2(
       encryptedAgentCredentialPath(state.workstation_id),
       "utf8"
     );
@@ -1295,7 +1359,7 @@ async function loadHermesCredential(state) {
       }
     }
   } else {
-    const encrypted = await readFile(encryptedHermesCredentialPath(), "utf8");
+    const encrypted = await readFile2(encryptedHermesCredentialPath(), "utf8");
     const script = "$e=[Convert]::FromBase64String([Console]::In.ReadToEnd());$b=[Security.Cryptography.ProtectedData]::Unprotect($e,$null,[Security.Cryptography.DataProtectionScope]::CurrentUser);[Text.Encoding]::UTF8.GetString($b)";
     const result = spawnSync(
       "powershell.exe",
@@ -1324,7 +1388,10 @@ async function hermesRequest(state, path, options = {}) {
     }
   );
   if (!response.ok)
-    throw new Error(`Hermes request failed (${response.status})`);
+    throw new HermesRequestError(
+      `Hermes request failed (${response.status})`,
+      response.status
+    );
   return await response.json();
 }
 async function streamHermesRunEvents(state, command, runId) {
@@ -1384,7 +1451,7 @@ async function streamHermesRunEvents(state, command, runId) {
             hermesRunApprovals.set(runId, {
               approval_command: approvalCommand,
               approval_tool: tool,
-              approval_fingerprint: createHash("sha256").update(JSON.stringify({ run_id: runId, tool, command: approvalCommand })).digest("hex"),
+              approval_fingerprint: createHash2("sha256").update(JSON.stringify({ run_id: runId, tool, command: approvalCommand })).digest("hex"),
               approval_policy_decision: "approval_required"
             });
           }
@@ -1423,9 +1490,9 @@ async function waitForProcess(child) {
   });
 }
 async function installHermes() {
-  await mkdir(stateDirectory(), { recursive: true, mode: 448 });
+  await mkdir2(stateDirectory(), { recursive: true, mode: 448 });
   const windows = platform() === "win32";
-  const scriptPath = join2(
+  const scriptPath = join3(
     stateDirectory(),
     windows ? "hermes-install.ps1" : "hermes-install.sh"
   );
@@ -1482,14 +1549,14 @@ async function installHermes() {
     if (userPath.ok && userPath.output)
       process.env.PATH = `${userPath.output};${process.env.PATH || ""}`;
   } else {
-    process.env.PATH = `${join2(homedir(), ".local", "bin")}:${process.env.PATH || ""}`;
+    process.env.PATH = `${join3(homedir(), ".local", "bin")}:${process.env.PATH || ""}`;
   }
 }
 async function configureHermesEnvironment(apiKey) {
-  const directory = join2(homedir(), ".hermes");
-  const path = join2(directory, ".env");
-  await mkdir(directory, { recursive: true, mode: 448 });
-  const existing = await readFile(path, "utf8").catch(() => "");
+  const directory = join3(homedir(), ".hermes");
+  const path = join3(directory, ".env");
+  await mkdir2(directory, { recursive: true, mode: 448 });
+  const existing = await readFile2(path, "utf8").catch(() => "");
   const settings = {
     API_SERVER_ENABLED: "true",
     API_SERVER_HOST: "127.0.0.1",
@@ -1519,15 +1586,15 @@ function hermesProfileArgs(state) {
   return ["--profile", hermesProfile(state.organization_id)];
 }
 async function configureSimplrMcp(state, executable) {
-  const profileDirectory = join2(
+  const profileDirectory = join3(
     homedir(),
     ".hermes",
     "profiles",
     hermesProfile(state.organization_id)
   );
-  await mkdir(profileDirectory, { recursive: true, mode: 448 });
-  const environmentPath = join2(profileDirectory, ".env");
-  const existing = await readFile(environmentPath, "utf8").catch(() => "");
+  await mkdir2(profileDirectory, { recursive: true, mode: 448 });
+  const environmentPath = join3(profileDirectory, ".env");
+  const existing = await readFile2(environmentPath, "utf8").catch(() => "");
   const settings = {
     SIMPLR_API_URL: state.api_url,
     SIMPLR_API_KEY: await ensureAgentCredential(state),
@@ -1549,7 +1616,7 @@ async function configureSimplrMcp(state, executable) {
   });
   if (platform() !== "win32") await chmod(environmentPath, 384);
   const profileArgs = hermesProfileArgs(state);
-  const wrapperPath = join2(profileDirectory, "simplr-mcp.mjs");
+  const wrapperPath = join3(profileDirectory, "simplr-mcp.mjs");
   const wrapper = `#!/usr/bin/env node
 import { readFileSync } from "node:fs";
 import { spawn } from "node:child_process";
@@ -1608,8 +1675,8 @@ async function ensureSimplrMcpConfiguration(state) {
   state.mcp_configuration_version = SIMPLR_MCP_CONFIGURATION_VERSION;
   await saveState(state);
 }
-async function installHermesSkill(state) {
-  const directory = join2(
+async function installHermesSkills(state) {
+  const directory = join3(
     homedir(),
     ".hermes",
     "profiles",
@@ -1617,9 +1684,9 @@ async function installHermesSkill(state) {
     "skills",
     "simplr-remote-operations"
   );
-  await mkdir(directory, { recursive: true, mode: 448 });
+  await mkdir2(directory, { recursive: true, mode: 448 });
   await writeFile(
-    join2(directory, "SKILL.md"),
+    join3(directory, "SKILL.md"),
     `---
 name: simplr-remote-operations
 description: Execute a verified Simplr work-order envelope delivered by Simplr Connect. Do not use for direct local Hermes requests.
@@ -1653,6 +1720,79 @@ Never expose credentials, environment variables, tokens, keys, cookies, secret f
 `,
     { encoding: "utf8", mode: 384 }
   );
+  const bundledCodexSources = [
+    join3(homedir(), ".hermes", "skills", "autonomous-ai-agents", "codex"),
+    join3(
+      homedir(),
+      ".hermes",
+      "hermes-agent",
+      "skills",
+      "autonomous-ai-agents",
+      "codex"
+    )
+  ];
+  const codexSource = (await Promise.all(
+    bundledCodexSources.map(async (candidate) => {
+      try {
+        await access(join3(candidate, "SKILL.md"), constants.R_OK);
+        return candidate;
+      } catch {
+        return void 0;
+      }
+    })
+  )).find(Boolean);
+  if (!codexSource)
+    throw new Error("Hermes bundled Codex skill is unavailable");
+  const codexDestination = join3(
+    homedir(),
+    ".hermes",
+    "profiles",
+    hermesProfile(state.organization_id),
+    "skills",
+    "autonomous-ai-agents",
+    "codex"
+  );
+  return syncDirectoryContents(codexSource, codexDestination);
+}
+async function ensureCodexExecutor() {
+  if (platform() === "win32") return false;
+  const localBin = join3(homedir(), ".local", "bin");
+  const pathEntries = (process.env.PATH || "").split(":");
+  const pathChanged = !pathEntries.includes(localBin);
+  if (pathChanged)
+    process.env.PATH = `${localBin}:${process.env.PATH || ""}`;
+  if (commandVersion("codex")) return pathChanged;
+  if (platform() !== "darwin") return pathChanged;
+  const destination = join3(localBin, "codex");
+  const candidates = [
+    "/Applications/ChatGPT.app/Contents/Resources/codex",
+    "/Applications/Codex.app/Contents/Resources/codex"
+  ];
+  for (const candidate of candidates) {
+    try {
+      await access(candidate, constants.X_OK);
+      await mkdir2(localBin, { recursive: true, mode: 448 });
+      await symlink(candidate, destination).catch((error) => {
+        if (!(error instanceof Error) || !("code" in error) || error.code !== "EEXIST")
+          throw error;
+      });
+      if (commandVersion("codex")) return true;
+    } catch {
+    }
+  }
+  return pathChanged;
+}
+async function ensureHermesExecutionTools(state) {
+  let changed = await ensureCodexExecutor();
+  for (const connection of state.connections.filter(
+    (candidate) => candidate.setup_status === "ready"
+  )) {
+    const installed = await installHermesSkills(
+      stateForConnection(state, connection)
+    );
+    changed = changed || installed;
+  }
+  return changed;
 }
 function isSimplrWorkOrder(command) {
   return ["incident", "bug", "feature"].includes(
@@ -1921,6 +2061,7 @@ function updateSimplrKanbanTask(state, taskId, action, detail) {
   );
 }
 async function setupHermes(state, interactiveOAuth) {
+  await ensureCodexExecutor();
   let executable = detectHermesExecutable();
   if (!executable) {
     await installHermes();
@@ -1971,7 +2112,7 @@ async function setupHermes(state, interactiveOAuth) {
   );
   await configureHermesEnvironment(apiKey);
   await configureSimplrMcp(state, executable);
-  await installHermesSkill(state);
+  await installHermesSkills(state);
   const multiplex = commandResult(
     executable,
     [
@@ -2232,11 +2373,15 @@ async function acknowledgeCommand(state, commandId, status, result) {
   let lastError;
   for (let attempt = 1; attempt <= 5; attempt += 1) {
     try {
-      await post(
+      const acknowledged = await post(
         `${state.api_url}/v1/ai-workstations/commands/${commandId}/acknowledge`,
         { status, result: result.slice(0, 5e3) },
         token
       );
+      if (!matchesCommandAcknowledgement(commandId, status, acknowledged))
+        throw new Error(
+          `Command acknowledgement remained ${acknowledged.status}`
+        );
       await removeCommandJournalEntry(commandId);
       return;
     } catch (error) {
@@ -2304,7 +2449,11 @@ async function monitorHermesRun(state, command, runId, startedAt) {
           `/v1/runs/${encodeURIComponent(runId)}`
         );
         consecutivePollFailures = 0;
-      } catch {
+      } catch (error) {
+        if (error instanceof HermesRequestError && error.status === 404)
+          throw new Error(
+            "Hermes run is no longer available after a gateway restart"
+          );
         consecutivePollFailures += 1;
         if (consecutivePollFailures >= 3) {
           await repairConnector(state);
@@ -2315,6 +2464,23 @@ async function monitorHermesRun(state, command, runId, startedAt) {
       }
       if (status.status === "completed") {
         const output = status.output || "Hermes completed the task";
+        if (isIncompleteCodeWorkResult(
+          workOrderClassification(command.payload),
+          output
+        )) {
+          await updateCommandJournal({
+            command_id: command.id,
+            type: command.type,
+            label: command.reason,
+            ...workOrderClassification(command.payload),
+            run_id: runId,
+            status: "failed",
+            result: output,
+            started_at: startedAt,
+            updated_at: (/* @__PURE__ */ new Date()).toISOString()
+          });
+          throw new Error(output);
+        }
         await updateHermesTrace(command, state, runId, {
           status: "completed",
           current_action: "Hermes run completed",
@@ -2408,7 +2574,7 @@ ${output}` : output
     );
   } catch (error) {
     const message = error instanceof Error ? error.message : "Hermes run failed";
-    const cancelled = /cancelled|stopped/i.test(message);
+    const cancelled = isHermesRunCancellation(message);
     await updateHermesTrace(command, state, runId, {
       status: cancelled ? "cancelled" : "failed",
       current_action: cancelled ? "Hermes run stopped" : "Hermes run failed",
@@ -2426,6 +2592,8 @@ async function runHermesCommand(state, command) {
   const journal = await loadCommandJournal();
   const existing = journal[command.id];
   if (existing?.status === "completed") {
+    if (isIncompleteCodeWorkResult(existing, existing.result))
+      throw new Error(existing.result || "Hermes code work did not complete");
     const awaitingPlanApproval = awaitsFeaturePlanApproval(existing);
     updateSimplrKanbanTask(
       state,
@@ -2638,7 +2806,7 @@ async function stopManagedProcesses() {
   return `${processes.length} Simplr-managed AI process${processes.length === 1 ? "" : "es"} terminated`;
 }
 async function acquireProcessLock(lockPath, activeMessage) {
-  await mkdir(stateDirectory(), { recursive: true, mode: 448 });
+  await mkdir2(stateDirectory(), { recursive: true, mode: 448 });
   const create = async () => {
     const handle = await open(lockPath, "wx", 384);
     await handle.writeFile(`${process.pid}
@@ -2651,7 +2819,7 @@ async function acquireProcessLock(lockPath, activeMessage) {
     if (!(error instanceof Error) || !("code" in error) || error.code !== "EEXIST")
       throw error;
     const existingPid = Number.parseInt(
-      (await readFile(lockPath, "utf8").catch(() => "0")).trim(),
+      (await readFile2(lockPath, "utf8").catch(() => "0")).trim(),
       10
     );
     let active = false;
@@ -2866,16 +3034,44 @@ async function resumeHermesRuns(state) {
     );
   }
 }
+async function reconcileIncompleteCompletedRuns(state) {
+  const journal = await loadCommandJournal();
+  for (const entry of Object.values(journal)) {
+    if (!isRecoverableIncompleteCompletion(entry)) continue;
+    const connection = entry.organization_id ? state.connections.find(
+      (candidate) => candidate.organization_id === entry.organization_id && candidate.workstation_id === entry.workstation_id
+    ) : state.connections.length === 1 ? state.connections[0] : void 0;
+    if (!connection) continue;
+    await acknowledgeCommand(
+      stateForConnection(state, connection),
+      entry.command_id,
+      "failed",
+      entry.result || "Hermes code work did not complete"
+    );
+  }
+}
+async function restartHermesForExecutionToolsWhenIdle(state) {
+  const journal = await loadCommandJournal();
+  if (!shouldRestartHermesForExecutionTools(
+    Boolean(state.hermes_execution_tools_restart_pending),
+    Object.values(journal).map((entry) => entry.status)
+  ))
+    return false;
+  await restartHermesGateway(state);
+  state.hermes_execution_tools_restart_pending = false;
+  await saveState(state);
+  return true;
+}
 async function serviceInstallationPresent() {
   try {
     await access(serviceExecutablePath(), constants.R_OK);
     if (serviceExecutableSnapshot) {
-      const deployed = await readFile(serviceExecutablePath());
-      const expectedHash = createHash("sha256").update(serviceExecutableSnapshot).digest("hex");
-      const deployedHash = createHash("sha256").update(deployed).digest("hex");
+      const deployed = await readFile2(serviceExecutablePath());
+      const expectedHash = createHash2("sha256").update(serviceExecutableSnapshot).digest("hex");
+      const deployedHash = createHash2("sha256").update(deployed).digest("hex");
       if (expectedHash !== deployedHash) return false;
     }
-    const definition = await readFile(serviceDefinitionPath(), "utf8");
+    const definition = await readFile2(serviceDefinitionPath(), "utf8");
     if (!definition.includes(serviceExecutablePath()) || !definition.includes("watch"))
       return false;
     if (platform() !== "win32") return true;
@@ -2917,10 +3113,17 @@ async function watch() {
   const state = await loadState();
   const executableSource = STANDALONE_EXECUTABLE ? process.execPath : process.argv[1];
   if (executableSource)
-    serviceExecutableSnapshot = await readFile(executableSource).catch(
+    serviceExecutableSnapshot = await readFile2(executableSource).catch(
       () => void 0
     );
+  const executionToolsChanged = await ensureHermesExecutionTools(state);
   await ensureSimplrMcpConfiguration(state);
+  if (executionToolsChanged) {
+    state.hermes_execution_tools_restart_pending = true;
+    await saveState(state);
+  }
+  await restartHermesForExecutionToolsWhenIdle(state);
+  await reconcileIncompleteCompletedRuns(state);
   await resumeHermesRuns(state);
   let nextInventoryAt = 0;
   let nextServiceAuditAt = 0;
@@ -2933,6 +3136,7 @@ async function watch() {
         nextServiceAuditAt = Date.now() + 15 * 6e4;
       }
       if (Date.now() >= nextHermesAuditAt) {
+        await restartHermesForExecutionToolsWhenIdle(state);
         for (const connection of state.connections.filter(
           (item) => item.setup_status !== "ready"
         )) {
@@ -3133,10 +3337,10 @@ function systemdValue(value) {
 }
 async function deployServiceExecutable() {
   const source = STANDALONE_EXECUTABLE ? process.execPath : process.argv[1];
-  const executable = serviceExecutableSnapshot || (source ? await readFile(source) : void 0);
+  const executable = serviceExecutableSnapshot || (source ? await readFile2(source) : void 0);
   if (!executable)
     throw new Error("Simplr Connect executable path is unavailable");
-  await mkdir(stateDirectory(), { recursive: true, mode: 448 });
+  await mkdir2(stateDirectory(), { recursive: true, mode: 448 });
   await writeFile(serviceExecutablePath(), executable, {
     mode: 448
   });
@@ -3149,9 +3353,9 @@ async function installService(activate = true) {
   const nodePath = process.execPath;
   const connectPath = serviceExecutablePath();
   if (platform() === "darwin") {
-    const directory = join2(homedir(), "Library", "LaunchAgents");
+    const directory = join3(homedir(), "Library", "LaunchAgents");
     const path = serviceDefinitionPath();
-    await mkdir(directory, { recursive: true, mode: 448 });
+    await mkdir2(directory, { recursive: true, mode: 448 });
     const programArguments = STANDALONE_EXECUTABLE ? [connectPath, "watch"] : [nodePath, connectPath, "watch"];
     const plistArguments = programArguments.map((value) => `<string>${xmlValue(value)}</string>`).join("");
     const plist = `<?xml version="1.0" encoding="UTF-8"?>
@@ -3182,9 +3386,9 @@ async function installService(activate = true) {
     return "Simplr Connect self-healing service installed";
   }
   if (platform() === "linux") {
-    const directory = join2(homedir(), ".config", "systemd", "user");
+    const directory = join3(homedir(), ".config", "systemd", "user");
     const path = serviceDefinitionPath();
-    await mkdir(directory, { recursive: true, mode: 448 });
+    await mkdir2(directory, { recursive: true, mode: 448 });
     const serviceCommand = STANDALONE_EXECUTABLE ? `${systemdValue(connectPath)} watch` : `${systemdValue(nodePath)} ${systemdValue(connectPath)} watch`;
     const unit = `[Unit]
 Description=Simplr Connect secure workstation proxy
@@ -3199,7 +3403,7 @@ RestartSec=10
 NoNewPrivileges=true
 PrivateTmp=true
 ProtectSystem=strict
-ReadWritePaths=${systemdValue(stateDirectory())} ${systemdValue(join2(homedir(), ".hermes"))}
+ReadWritePaths=${systemdValue(stateDirectory())} ${systemdValue(join3(homedir(), ".hermes"))}
 
 [Install]
 WantedBy=default.target
@@ -3388,7 +3592,7 @@ async function updateConnector(apply, expectedVersion, reportStage, commandId, o
     status: "downloaded",
     artifact_sha256: artifact.sha256
   });
-  if (bytes.byteLength !== artifact.size || createHash("sha256").update(bytes).digest("hex") !== artifact.sha256)
+  if (bytes.byteLength !== artifact.size || createHash2("sha256").update(bytes).digest("hex") !== artifact.sha256)
     throw new Error("Downloaded update failed integrity verification");
   await reportStage?.({
     status: "verified",
@@ -3435,7 +3639,7 @@ async function updateConnector(apply, expectedVersion, reportStage, commandId, o
       1e4
     );
   else {
-    const helperPath = join2(stateDirectory(), "complete-update.ps1");
+    const helperPath = join3(stateDirectory(), "complete-update.ps1");
     const powershellValue = (value) => `'${value.replace(/'/g, "''")}'`;
     const helper = `$ErrorActionPreference = "Stop"\r
 & schtasks.exe /End /TN "Simplr Connect" | Out-Null\r

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simplr-ai/connect",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "description": "Simplr Connect workstation enrollment and AI tool inventory companion",
   "type": "module",
   "main": "dist/index.js",