codebase-onboarder 0.6.0 → 1.0.0

package/cli/agent/command.js

@@ -0,0 +1,177 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { parseArgs } from 'node:util';
+import { AGENT_MODES } from './contracts.js';
+import { agentHome, setupAgent, prepareAgentProfile, runtimePaths, hermesBinary, hermesEnvironment, HERMES_SOURCE, HERMES_REVISION } from './config.js';
+import { runAgent, savedRun } from './runner.js';
+import { runProcess, terminalText, redact } from './process.js';
+import { githubToken } from './github.js';
+export const AGENT_HELP = `
+  Onboarder agent — Hermes with repository and GitHub tools
+
+  onboarder agent setup                    Create a dedicated Hermes profile
+  onboarder chat [folder]                  Open the conversational harness with / commands
+  onboarder agent model                    Configure its model/provider interactively
+  onboarder agent doctor                   Check runtime and integration compatibility
+  onboarder agent source                   Fetch the researched official Hermes source
+  onboarder agent runs                     List saved runs
+  onboarder agent show <run-id>             Inspect a saved result and workspace
+  onboarder agent <workflow> [folder] --task "..."
+
+  Workflows: ask, review, triage, implement, pr, github
+  --pr <number>             Review/inspect a GitHub pull request
+  --issue <number>          Work from an issue
+  --base <branch>           PR target (default: origin HEAD, or current branch)
+  --allow-checks            Allow npm install/test/typecheck/build (repository code)
+  --allow-github-writes     Allow issue/review/comment updates and draft PR publishing
+  --max-turns <1–100>       Agent turn limit (default: 24)
+  --timeout <seconds>       Run limit, 15–3600 (default: 300)
+  --model <name> --provider <name>  Override the dedicated Hermes model
+  --resume <run-id>         Continue a session; repeat allowed permission flags
+  --dry-run                Print the plan without a model call or worktree
+  --json                   One JSON result; progress goes to stderr
+
+  implement/pr use a new Git worktree at committed HEAD. Uncommitted source
+  changes are excluded. Without --allow-github-writes, pr prepares a draft locally.
+  GitHub uses the checkout's github.com origin and GITHUB_TOKEN or GH_TOKEN.
+  Hermes is an optional separate Python runtime: https://github.com/NousResearch/hermes-agent
+  Profile/history: ONBOARDER_AGENT_HOME (default: ~/.config/onboarder/agent).
+
+  onboarder agent ask . --task "Explain the authentication flow"
+  onboarder agent review . --pr 42 --task "Find correctness and security issues"
+  onboarder agent triage . --issue 12 --task "Investigate and propose a fix"
+  onboarder agent implement . --task "Fix issue 12" --issue 12 --allow-checks
+  onboarder agent pr . --task "Fix issue 12 and open a draft PR" --issue 12 --allow-checks --allow-github-writes
+`;
+export const AGENT_OPTIONS = {
+    task: { type: 'string' }, pr: { type: 'string' }, issue: { type: 'string' },
+    'max-turns': { type: 'string' }, timeout: { type: 'string' }, resume: { type: 'string' },
+    'allow-checks': { type: 'boolean' }, 'allow-github-writes': { type: 'boolean' }, 'dry-run': { type: 'boolean' },
+    model: { type: 'string' }, provider: { type: 'string' }, json: { type: 'boolean' }, help: { type: 'boolean', short: 'h' },
+    base: { type: 'string' },
+};
+export async function agentDoctor(home = agentHome(), env = process.env) {
+    const paths = runtimePaths(home, env);
+    let runtime = false, compatible = false, detail = '';
+    try {
+        const result = await runProcess(hermesBinary(env), ['chat', '--help'], { env: hermesEnvironment(home, env), timeoutMs: 30_000, maxBytes: 128000 });
+        runtime = result.code === 0;
+        compatible = runtime && ['--query-file', 'stream-json', '--toolsets', '--run-budget', '--ignore-rules', '--no-restore-cwd'].every(s => result.stdout.includes(s));
+        if (!compatible)
+            detail = result.code ? result.stderr.slice(-2000) || 'Hermes could not start.' : 'Update Hermes to a runtime supporting structured one-shot chat and MCP selection.';
+    }
+    catch (e) {
+        detail = redact(e instanceof Error ? e.message : String(e), env);
+    }
+    const server = await fs.access(paths.server).then(() => true).catch(() => false);
+    const profile = await fs.access(path.join(paths.profile, 'config.yaml')).then(() => true).catch(() => false);
+    return { runtime, compatible, server, profile, githubToken: Boolean(githubToken(env)), home, ready: runtime && compatible && server && profile, detail,
+        next: !runtime ? 'Install Hermes from its official repository, then agent setup and agent model.' : !profile ? 'Run onboarder agent setup, then onboarder agent model.' : 'Model credentials are checked by Hermes when a task runs; use agent model to configure them.' };
+}
+export async function fetchHermesSource(home = agentHome(), signal) {
+    const target = path.join(home, 'upstream', 'hermes-agent');
+    await fs.mkdir(path.dirname(target), { recursive: true, mode: 0o700 });
+    const git = async (args) => {
+        const output = await runProcess('git', ['-c', 'http.version=HTTP/1.1', ...args], { signal, timeoutMs: 120_000, maxBytes: 2 * 1024 * 1024 });
+        if (output.code)
+            throw new Error(`Hermes source fetch failed: ${output.stderr.slice(-1500)}`);
+        return output.stdout.trim();
+    };
+    if (!await fs.access(target).then(() => true).catch(() => false)) {
+        const staging = target + '-' + randomUUID();
+        try {
+            await git(['clone', '--depth', '1', '--no-checkout', '--', HERMES_SOURCE, staging]);
+            await fs.rename(staging, target);
+        }
+        finally {
+            await fs.rm(staging, { recursive: true, force: true });
+        }
+    }
+    if (await git(['-C', target, 'remote', 'get-url', 'origin']) !== HERMES_SOURCE)
+        throw new Error('The source cache origin is not the official Hermes repository.');
+    if (await git(['-C', target, 'status', '--porcelain']) && await fs.access(path.join(target, 'LICENSE')).then(() => true).catch(() => false))
+        throw new Error('The source cache contains edits. Preserve them before updating it.');
+    await git(['-C', target, 'fetch', '--depth', '1', 'origin', HERMES_REVISION]);
+    await git(['-C', target, '-c', 'core.hooksPath=' + path.join(home, 'empty-hooks'), 'checkout', '--detach', HERMES_REVISION]);
+    return { source: HERMES_SOURCE, revision: HERMES_REVISION, directory: target, license: 'MIT', installed: false };
+}
+export async function agentCommand(sub = 'help', positionals = [], flags = {}, options = {}) {
+    const out = options.out || console.log, err = options.err || console.error, home = agentHome();
+    const print = (value) => out(typeof value === 'string' ? value : JSON.stringify(value, null, 2));
+    if (flags.help || sub === 'help') {
+        out(AGENT_HELP);
+        return 0;
+    }
+    if (sub === 'setup') {
+        const result = await prepareAgentProfile(home, process.env, options.signal);
+        print(flags.json ? result : `Dedicated Hermes profile: ${result.profile}\n${result.created ? 'Created.' : 'Existing model settings preserved.'} Run onboarder agent model to configure its provider.\nRun onboarder agent doctor to check the integration.`);
+        return 0;
+    }
+    if (sub === 'doctor') {
+        const report = await agentDoctor(home);
+        print(report);
+        return report.ready ? 0 : 1;
+    }
+    if (sub === 'source') {
+        print(await fetchHermesSource(home, options.signal));
+        return 0;
+    }
+    if (sub === 'model') {
+        if (!process.stdin.isTTY)
+            throw new Error('Run onboarder agent model in an interactive terminal.');
+        await setupAgent(home);
+        return new Promise((resolve, reject) => {
+            const child = spawn(hermesBinary(), ['model'], { env: hermesEnvironment(home), stdio: 'inherit', shell: false, signal: options.signal });
+            child.on('error', reject);
+            child.on('close', code => resolve(code ?? 1));
+        });
+    }
+    if (sub === 'runs') {
+        const names = await fs.readdir(runtimePaths(home).runs).catch(e => { if (e.code !== 'ENOENT')
+            throw e; return []; });
+        const runs = (await Promise.all(names.filter(n => /^[a-f\d-]{36}$/.test(n)).map(async (id) => {
+            try {
+                const { manifest, result } = await savedRun(id, home);
+                return { id, mode: manifest.mode, status: result?.status || 'unfinished', startedAt: manifest.startedAt, workspace: manifest.root, repository: manifest.repository };
+            }
+            catch {
+                return { id, status: 'unreadable' };
+            }
+        }))).sort((a, b) => (b.startedAt || '').localeCompare(a.startedAt || ''));
+        print(runs);
+        return 0;
+    }
+    if (sub === 'show') {
+        print(await savedRun(positionals[0] || '', home));
+        return 0;
+    }
+    if (!AGENT_MODES.includes(sub))
+        throw new Error('Unknown agent workflow. Run onboarder agent --help.');
+    if (positionals.length > 1)
+        throw new Error('Use one repository folder and --task "your task".');
+    const task = flags.task || (sub === 'review' ? `Review ${flags.pr ? 'pull request ' + flags.pr : 'local changes'} for actionable correctness and security issues.` : sub === 'triage' ? `Investigate ${flags.issue ? 'issue ' + flags.issue : 'open issues'} and propose a prioritized plan.` : '');
+    const result = await runAgent({ mode: sub, root: positionals[0] || options.root || '.', task,
+        pr: flags.pr === undefined ? undefined : Number(flags.pr), issue: flags.issue === undefined ? undefined : Number(flags.issue),
+        maxTurns: flags.maxTurns === undefined ? flags['max-turns'] : flags.maxTurns, timeoutSeconds: flags.timeout,
+        allowChecks: flags.allowChecks || flags['allow-checks'], allowGithubWrites: flags.allowGithubWrites || flags['allow-github-writes'], dryRun: flags.dryRun || flags['dry-run'],
+        model: flags.model, provider: flags.provider, resume: flags.resume, base: flags.base }, { signal: options.signal,
+        onEvent: event => {
+            if (event.type === 'tool_use')
+                err(`  ${terminalText(event.name || 'Tool')}…`);
+            if (event.type === 'tool_result' && event.is_error)
+                err(`  ${terminalText(event.name || 'Tool')} reported an error.`);
+        } });
+    if ('dryRun' in result || flags.json)
+        print(result);
+    else
+        out(`${terminalText(result.answer)}\n\nRun: ${result.id} (${result.status})\nWorkspace: ${result.workspace}${result.branch ? '\nBranch: ' + result.branch : ''}`);
+    return 'dryRun' in result || result.status === 'completed' ? 0 : result.status === 'cancelled' ? 130 : 1;
+}
+export async function explorerAgent(args, root, signal, out, err) {
+    const parsed = parseArgs({ args, options: AGENT_OPTIONS, allowPositionals: true });
+    await agentCommand(parsed.positionals[0], parsed.positionals.slice(1), parsed.values, { root, signal, out, err });
+    return '';
+}
+//# sourceMappingURL=command.js.map

package/cli/agent/command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.js","sourceRoot":"","sources":["../../src/cli/agent/command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,WAAW,EAAkB,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,mBAAmB,EAAE,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACxJ,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoCzB,CAAC;AACF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;IACtG,WAAW,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;IACnH,cAAc,EAAE,EAAE,IAAI,EAAE,SAAkB,EAAE,EAAE,qBAAqB,EAAE,EAAE,IAAI,EAAE,SAAkB,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,SAAkB,EAAE;IAC1I,KAAK,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAkB,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAkB,EAAE,KAAK,EAAE,GAAG,EAAE;IAC7J,IAAI,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;CAClC,CAAC;AACF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAI,GAAG,SAAS,EAAE,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IACxF,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtC,IAAI,OAAO,GAAG,KAAK,EAAE,UAAU,GAAG,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACnJ,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC;QAC5B,UAAU,GAAG,OAAO,IAAI,CAAC,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAClK,IAAI,CAAC,UAAU;YAAE,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,yBAAyB,CAAC,CAAC,CAAC,mFAAmF,CAAC;IACxL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QAAC,MAAM,GAAG,MAAM,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAAC,CAAC;IACjF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IAC7G,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,UAAU,IAAI,MAAM,IAAI,OAAO,EAAE,MAAM;QACpJ,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,gFAAgF,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,wDAAwD,CAAC,CAAC,CAAC,8FAA8F,EAAE,CAAC;AAC/Q,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAI,GAAG,SAAS,EAAE,EAAE,MAAoB;IAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;IAC3D,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,KAAK,EAAE,IAAc,EAAE,EAAE;QACnC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,uBAAuB,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;QAC5I,IAAI,MAAM,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9F,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,OAAO,GAAG,MAAM,GAAG,GAAG,GAAG,UAAU,EAAE,CAAC;QAC5C,IAAI,CAAC;YAAC,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;YAAC,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAAC,CAAC;gBACtH,CAAC;YAAC,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;IACrE,CAAC;IACD,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,KAAK,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IAClK,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACnO,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;IAC9E,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC;IAC7H,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACnH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAG,GAAG,MAAM,EAAE,WAAW,GAAa,EAAE,EAAE,KAAK,GAAwB,EAAE,EAAE,OAAO,GAAwG,EAAE;IAC7N,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,GAAG,SAAS,EAAE,CAAC;IAC/F,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1G,IAAI,KAAK,CAAC,IAAI,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAChE,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5E,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,6BAA6B,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,oCAAoC,6GAA6G,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IACzQ,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QAAC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;QAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAAC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAC7G,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QAAC,KAAK,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IACzF,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACnG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QACvB,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACzI,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACrH,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAC,EAAE,EAAC,EAAE;YACzF,IAAI,CAAC;gBAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;gBAAC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;YAAC,CAAC;YACpO,MAAM,CAAC;gBAAC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YAAC,CAAC;QAChD,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QAC1E,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IACpF,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAgB,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACpH,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACjG,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,kDAAkD,CAAC,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,kCAAkC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpS,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,IAAI,EAAE,GAAgB,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,IAAI,GAAG,EAAE,IAAI;QACvG,EAAE,EAAE,KAAK,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;QAC7H,QAAQ,EAAE,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC,OAAO;QAC3G,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,cAAc,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;QAC7K,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM;QAChH,OAAO,EAAE,KAAK,CAAC,EAAE;YACf,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;gBAAE,GAAG,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;YAC/E,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,QAAQ;gBAAE,GAAG,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACxH,CAAC,EAAE,CAAC,CAAC;IACP,IAAI,QAAQ,IAAI,MAAM,IAAI,KAAK,CAAC,IAAI;QAAE,KAAK,CAAC,MAAM,CAAC,CAAC;;QAC/C,GAAG,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,MAAM,iBAAiB,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvK,OAAO,QAAQ,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,IAAY,EAAE,MAAmB,EAAE,GAA2B,EAAE,GAA2B;IAC7I,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;IACnF,MAAM,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAClH,OAAO,EAAE,CAAC;AACZ,CAAC","sourcesContent":["import { promises as fs } from 'node:fs';\nimport path from 'node:path';\nimport { randomUUID } from 'node:crypto';\nimport { spawn } from 'node:child_process';\nimport { parseArgs } from 'node:util';\nimport { AGENT_MODES, type AgentMode } from './contracts.js';\nimport { agentHome, setupAgent, prepareAgentProfile, runtimePaths, hermesBinary, hermesEnvironment, HERMES_SOURCE, HERMES_REVISION } from './config.js';\nimport { runAgent, savedRun } from './runner.js';\nimport { runProcess, terminalText, redact } from './process.js';\nimport { githubToken } from './github.js';\n\nexport const AGENT_HELP = `\n  Onboarder agent — Hermes with repository and GitHub tools\n\n  onboarder agent setup                    Create a dedicated Hermes profile\n  onboarder chat [folder]                  Open the conversational harness with / commands\n  onboarder agent model                    Configure its model/provider interactively\n  onboarder agent doctor                   Check runtime and integration compatibility\n  onboarder agent source                   Fetch the researched official Hermes source\n  onboarder agent runs                     List saved runs\n  onboarder agent show <run-id>             Inspect a saved result and workspace\n  onboarder agent <workflow> [folder] --task \"...\"\n\n  Workflows: ask, review, triage, implement, pr, github\n  --pr <number>             Review/inspect a GitHub pull request\n  --issue <number>          Work from an issue\n  --base <branch>           PR target (default: origin HEAD, or current branch)\n  --allow-checks            Allow npm install/test/typecheck/build (repository code)\n  --allow-github-writes     Allow issue/review/comment updates and draft PR publishing\n  --max-turns <1–100>       Agent turn limit (default: 24)\n  --timeout <seconds>       Run limit, 15–3600 (default: 300)\n  --model <name> --provider <name>  Override the dedicated Hermes model\n  --resume <run-id>         Continue a session; repeat allowed permission flags\n  --dry-run                Print the plan without a model call or worktree\n  --json                   One JSON result; progress goes to stderr\n\n  implement/pr use a new Git worktree at committed HEAD. Uncommitted source\n  changes are excluded. Without --allow-github-writes, pr prepares a draft locally.\n  GitHub uses the checkout's github.com origin and GITHUB_TOKEN or GH_TOKEN.\n  Hermes is an optional separate Python runtime: https://github.com/NousResearch/hermes-agent\n  Profile/history: ONBOARDER_AGENT_HOME (default: ~/.config/onboarder/agent).\n\n  onboarder agent ask . --task \"Explain the authentication flow\"\n  onboarder agent review . --pr 42 --task \"Find correctness and security issues\"\n  onboarder agent triage . --issue 12 --task \"Investigate and propose a fix\"\n  onboarder agent implement . --task \"Fix issue 12\" --issue 12 --allow-checks\n  onboarder agent pr . --task \"Fix issue 12 and open a draft PR\" --issue 12 --allow-checks --allow-github-writes\n`;\nexport const AGENT_OPTIONS = {\n  task: { type: 'string' as const }, pr: { type: 'string' as const }, issue: { type: 'string' as const },\n  'max-turns': { type: 'string' as const }, timeout: { type: 'string' as const }, resume: { type: 'string' as const },\n  'allow-checks': { type: 'boolean' as const }, 'allow-github-writes': { type: 'boolean' as const }, 'dry-run': { type: 'boolean' as const },\n  model: { type: 'string' as const }, provider: { type: 'string' as const }, json: { type: 'boolean' as const }, help: { type: 'boolean' as const, short: 'h' },\n  base: { type: 'string' as const },\n};\nexport async function agentDoctor(home = agentHome(), env: NodeJS.ProcessEnv = process.env) {\n  const paths = runtimePaths(home, env);\n  let runtime = false, compatible = false, detail = '';\n  try {\n    const result = await runProcess(hermesBinary(env), ['chat', '--help'], { env: hermesEnvironment(home, env), timeoutMs: 30_000, maxBytes: 128000 });\n    runtime = result.code === 0;\n    compatible = runtime && ['--query-file', 'stream-json', '--toolsets', '--run-budget', '--ignore-rules', '--no-restore-cwd'].every(s => result.stdout.includes(s));\n    if (!compatible) detail = result.code ? result.stderr.slice(-2000) || 'Hermes could not start.' : 'Update Hermes to a runtime supporting structured one-shot chat and MCP selection.';\n  } catch (e) { detail = redact(e instanceof Error ? e.message : String(e), env); }\n  const server = await fs.access(paths.server).then(() => true).catch(() => false);\n  const profile = await fs.access(path.join(paths.profile, 'config.yaml')).then(() => true).catch(() => false);\n  return { runtime, compatible, server, profile, githubToken: Boolean(githubToken(env)), home, ready: runtime && compatible && server && profile, detail,\n    next: !runtime ? 'Install Hermes from its official repository, then agent setup and agent model.' : !profile ? 'Run onboarder agent setup, then onboarder agent model.' : 'Model credentials are checked by Hermes when a task runs; use agent model to configure them.' };\n}\nexport async function fetchHermesSource(home = agentHome(), signal?: AbortSignal) {\n  const target = path.join(home, 'upstream', 'hermes-agent');\n  await fs.mkdir(path.dirname(target), { recursive: true, mode: 0o700 });\n  const git = async (args: string[]) => {\n    const output = await runProcess('git', ['-c', 'http.version=HTTP/1.1', ...args], { signal, timeoutMs: 120_000, maxBytes: 2 * 1024 * 1024 });\n    if (output.code) throw new Error(`Hermes source fetch failed: ${output.stderr.slice(-1500)}`);\n    return output.stdout.trim();\n  };\n  if (!await fs.access(target).then(() => true).catch(() => false)) {\n    const staging = target + '-' + randomUUID();\n    try { await git(['clone', '--depth', '1', '--no-checkout', '--', HERMES_SOURCE, staging]); await fs.rename(staging, target); }\n    finally { await fs.rm(staging, { recursive: true, force: true }); }\n  }\n  if (await git(['-C', target, 'remote', 'get-url', 'origin']) !== HERMES_SOURCE) throw new Error('The source cache origin is not the official Hermes repository.');\n  if (await git(['-C', target, 'status', '--porcelain']) && await fs.access(path.join(target, 'LICENSE')).then(() => true).catch(() => false)) throw new Error('The source cache contains edits. Preserve them before updating it.');\n  await git(['-C', target, 'fetch', '--depth', '1', 'origin', HERMES_REVISION]);\n  await git(['-C', target, '-c', 'core.hooksPath=' + path.join(home, 'empty-hooks'), 'checkout', '--detach', HERMES_REVISION]);\n  return { source: HERMES_SOURCE, revision: HERMES_REVISION, directory: target, license: 'MIT', installed: false };\n}\n\nexport async function agentCommand(sub = 'help', positionals: string[] = [], flags: Record<string, any> = {}, options: { root?: string; signal?: AbortSignal; out?: (text: string) => void; err?: (text: string) => void } = {}) {\n  const out = options.out || console.log, err = options.err || console.error, home = agentHome();\n  const print = (value: unknown) => out(typeof value === 'string' ? value : JSON.stringify(value, null, 2));\n  if (flags.help || sub === 'help') { out(AGENT_HELP); return 0; }\n  if (sub === 'setup') {\n    const result = await prepareAgentProfile(home, process.env, options.signal);\n    print(flags.json ? result : `Dedicated Hermes profile: ${result.profile}\\n${result.created ? 'Created.' : 'Existing model settings preserved.'} Run onboarder agent model to configure its provider.\\nRun onboarder agent doctor to check the integration.`); return 0;\n  }\n  if (sub === 'doctor') { const report = await agentDoctor(home); print(report); return report.ready ? 0 : 1; }\n  if (sub === 'source') { print(await fetchHermesSource(home, options.signal)); return 0; }\n  if (sub === 'model') {\n    if (!process.stdin.isTTY) throw new Error('Run onboarder agent model in an interactive terminal.');\n    await setupAgent(home);\n    return new Promise<number>((resolve, reject) => {\n      const child = spawn(hermesBinary(), ['model'], { env: hermesEnvironment(home), stdio: 'inherit', shell: false, signal: options.signal });\n      child.on('error', reject); child.on('close', code => resolve(code ?? 1));\n    });\n  }\n  if (sub === 'runs') {\n    const names = await fs.readdir(runtimePaths(home).runs).catch(e => { if (e.code !== 'ENOENT') throw e; return []; });\n    const runs = (await Promise.all(names.filter(n => /^[a-f\\d-]{36}$/.test(n)).map(async id => {\n      try { const { manifest, result } = await savedRun(id, home); return { id, mode: manifest.mode, status: result?.status || 'unfinished', startedAt: manifest.startedAt, workspace: manifest.root, repository: manifest.repository }; }\n      catch { return { id, status: 'unreadable' }; }\n    }))).sort((a, b) => (b.startedAt || '').localeCompare(a.startedAt || ''));\n    print(runs); return 0;\n  }\n  if (sub === 'show') { print(await savedRun(positionals[0] || '', home)); return 0; }\n  if (!AGENT_MODES.includes(sub as AgentMode)) throw new Error('Unknown agent workflow. Run onboarder agent --help.');\n  if (positionals.length > 1) throw new Error('Use one repository folder and --task \"your task\".');\n  const task = flags.task || (sub === 'review' ? `Review ${flags.pr ? 'pull request ' + flags.pr : 'local changes'} for actionable correctness and security issues.` : sub === 'triage' ? `Investigate ${flags.issue ? 'issue ' + flags.issue : 'open issues'} and propose a prioritized plan.` : '');\n  const result = await runAgent({ mode: sub as AgentMode, root: positionals[0] || options.root || '.', task,\n    pr: flags.pr === undefined ? undefined : Number(flags.pr), issue: flags.issue === undefined ? undefined : Number(flags.issue),\n    maxTurns: flags.maxTurns === undefined ? flags['max-turns'] : flags.maxTurns, timeoutSeconds: flags.timeout,\n    allowChecks: flags.allowChecks || flags['allow-checks'], allowGithubWrites: flags.allowGithubWrites || flags['allow-github-writes'], dryRun: flags.dryRun || flags['dry-run'],\n    model: flags.model, provider: flags.provider, resume: flags.resume, base: flags.base }, { signal: options.signal,\n    onEvent: event => {\n      if (event.type === 'tool_use') err(`  ${terminalText(event.name || 'Tool')}…`);\n      if (event.type === 'tool_result' && event.is_error) err(`  ${terminalText(event.name || 'Tool')} reported an error.`);\n    } });\n  if ('dryRun' in result || flags.json) print(result);\n  else out(`${terminalText(result.answer)}\\n\\nRun: ${result.id} (${result.status})\\nWorkspace: ${result.workspace}${result.branch ? '\\nBranch: ' + result.branch : ''}`);\n  return 'dryRun' in result || result.status === 'completed' ? 0 : result.status === 'cancelled' ? 130 : 1;\n}\n\nexport async function explorerAgent(args: string[], root: string, signal: AbortSignal, out: (text: string) => void, err: (text: string) => void) {\n  const parsed = parseArgs({ args, options: AGENT_OPTIONS, allowPositionals: true });\n  await agentCommand(parsed.positionals[0], parsed.positionals.slice(1), parsed.values, { root, signal, out, err });\n  return '';\n}\n"]}

package/cli/agent/config.d.ts

@@ -0,0 +1,31 @@
+export declare const HERMES_SOURCE = "https://github.com/NousResearch/hermes-agent.git";
+export declare const HERMES_REVISION = "eb7e8620324b32424c06218f6a28094df2e921f8";
+export declare function agentHome(env?: NodeJS.ProcessEnv): string;
+export declare function hermesBinary(env?: NodeJS.ProcessEnv): string;
+export declare function runtimePaths(home?: string, env?: NodeJS.ProcessEnv): {
+    home: string;
+    profile: string;
+    runs: string;
+    workspaces: string;
+    server: string;
+};
+export declare function hermesEnvironment(home?: string, env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function setupAgent(home?: string, env?: NodeJS.ProcessEnv): Promise<{
+    home: string;
+    profile: string;
+    runs: string;
+    workspaces: string;
+    server: string;
+    configFile: string;
+    created: boolean;
+}>;
+/** Refresh only harness-owned settings; retain the model wizard's provider/auth choices. */
+export declare function prepareAgentProfile(home?: string, env?: NodeJS.ProcessEnv, signal?: AbortSignal): Promise<{
+    home: string;
+    profile: string;
+    runs: string;
+    workspaces: string;
+    server: string;
+    configFile: string;
+    created: boolean;
+}>;

package/cli/agent/config.js

@@ -0,0 +1,98 @@
+import { promises as fs } from 'node:fs';
+import { createHash } from 'node:crypto';
+import path from 'node:path';
+import os from 'node:os';
+import { fileURLToPath } from 'node:url';
+import { randomUUID } from 'node:crypto';
+import { runProcess } from './process.js';
+export const HERMES_SOURCE = 'https://github.com/NousResearch/hermes-agent.git';
+export const HERMES_REVISION = 'eb7e8620324b32424c06218f6a28094df2e921f8';
+export function agentHome(env = process.env) {
+    return path.resolve(env.ONBOARDER_AGENT_HOME || path.join(env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config'), 'onboarder', 'agent'));
+}
+export function hermesBinary(env = process.env) {
+    return env.ONBOARDER_HERMES_BIN || 'hermes';
+}
+export function runtimePaths(home = agentHome(), env = process.env) {
+    const native = process.platform === 'win32' ? path.join(env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'), 'hermes') : path.join(os.homedir(), '.hermes');
+    const configured = env.HERMES_HOME ? (path.basename(path.dirname(env.HERMES_HOME)) === 'profiles' ? path.dirname(path.dirname(env.HERMES_HOME)) : env.HERMES_HOME) : native;
+    // Named profiles share the installation's Python store, but not its config,
+    // credentials, sessions, memory, or MCP server selection.
+    const name = 'onboarder-' + createHash('sha256').update(path.resolve(home)).digest('hex').slice(0, 12);
+    return { home, profile: path.join(configured, 'profiles', name), runs: path.join(home, 'runs'), workspaces: path.join(home, 'workspaces'), server: fileURLToPath(new URL('./stdio.js', import.meta.url)) };
+}
+export function hermesEnvironment(home = agentHome(), env = process.env) {
+    return { ...env, HERMES_HOME: runtimePaths(home, env).profile, OPENAI_API_KEY: env.ONBOARDER_AI_API_KEY || env.OPENAI_API_KEY,
+        PATH: [path.join(os.homedir(), '.local', 'bin'), env.PATH || ''].join(path.delimiter) };
+}
+export async function setupAgent(home = agentHome(), env = process.env) {
+    const paths = runtimePaths(home, env);
+    for (const dir of [paths.profile, paths.runs, paths.workspaces])
+        await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+    const file = path.join(paths.profile, 'config.yaml');
+    const base = env.ONBOARDER_AI_BASE_URL || env.OPENAI_BASE_URL;
+    const model = env.ONBOARDER_AI_MODEL || env.OPENAI_MODEL;
+    // JSON is a YAML subset. Hermes can subsequently maintain this file with its own model wizard.
+    const config = {
+        ...(base && model ? { model: { provider: 'custom', base_url: base, default: model } } : {}),
+        agent: { max_turns: 24 }, memory: { memory_enabled: false, user_profile_enabled: false },
+        tools: { tool_search: { enabled: 'off' } },
+        mcp_servers: { onboarder: { command: process.execPath, args: [paths.server],
+                env: { ONBOARDER_AGENT_RUN: '${ONBOARDER_AGENT_RUN}', GITHUB_TOKEN: '${GITHUB_TOKEN}', GH_TOKEN: '${GH_TOKEN}' },
+                tools: { prompts: false, resources: false }, connect_timeout: 30, timeout: 150 } },
+    };
+    let created = false;
+    try {
+        await fs.writeFile(file, JSON.stringify(config, null, 2) + '\n', { mode: 0o600, flag: 'wx' });
+        created = true;
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+    }
+    return { ...paths, configFile: file, created };
+}
+/** Refresh only harness-owned settings; retain the model wizard's provider/auth choices. */
+export async function prepareAgentProfile(home = agentHome(), env = process.env, signal) {
+    const setup = await setupAgent(home, env);
+    if (setup.created)
+        return setup;
+    const server = { command: process.execPath, args: [setup.server],
+        env: { ONBOARDER_AGENT_RUN: '${ONBOARDER_AGENT_RUN}', GITHUB_TOKEN: '${GITHUB_TOKEN}', GH_TOKEN: '${GH_TOKEN}' },
+        tools: { prompts: false, resources: false }, connect_timeout: 30, timeout: 150 };
+    const source = await fs.readFile(setup.configFile, 'utf8');
+    let config = null;
+    try {
+        const value = JSON.parse(source);
+        if (value && typeof value === 'object' && !Array.isArray(value))
+            config = value;
+    }
+    catch { /* Hermes' model wizard writes native YAML. */ }
+    if (config) {
+        config.mcp_servers = { ...(config.mcp_servers || {}), onboarder: server };
+        config.tools = { ...(config.tools || {}), tool_search: { ...(config.tools?.tool_search || {}), enabled: 'off' } };
+        config.memory = { ...(config.memory || {}), memory_enabled: false, user_profile_enabled: false };
+        const next = JSON.stringify(config, null, 2) + '\n';
+        if (source !== next) {
+            const temporary = setup.configFile + '-' + randomUUID();
+            try {
+                await fs.writeFile(temporary, next, { flag: 'wx', mode: 0o600 });
+                await fs.rename(temporary, setup.configFile);
+            }
+            finally {
+                await fs.rm(temporary, { force: true });
+            }
+        }
+    }
+    else {
+        // Let Hermes parse/preserve its own YAML rather than adding a Node dependency
+        // or hand-editing the model wizard's configuration.
+        for (const [key, value] of [['mcp_servers.onboarder', JSON.stringify(server)], ['tools.tool_search.enabled', 'off'], ['memory.memory_enabled', 'false'], ['memory.user_profile_enabled', 'false']]) {
+            const result = await runProcess(hermesBinary(env), ['config', 'set', key, value], { env: hermesEnvironment(home, env), signal, timeoutMs: 30_000, maxBytes: 128000 });
+            if (result.code)
+                throw new Error(`Could not refresh the dedicated Hermes profile: ${result.stderr.slice(-1500) || result.stdout.slice(-1500)}`);
+        }
+    }
+    return setup;
+}
+//# sourceMappingURL=config.js.map

package/cli/agent/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/cli/agent/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,MAAM,CAAC,MAAM,aAAa,GAAG,kDAAkD,CAAC;AAChF,MAAM,CAAC,MAAM,eAAe,GAAG,0CAA0C,CAAC;AAC1E,MAAM,UAAU,SAAS,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9I,CAAC;AACD,MAAM,UAAU,YAAY,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC/D,OAAO,GAAG,CAAC,oBAAoB,IAAI,QAAQ,CAAC;AAC9C,CAAC;AACD,MAAM,UAAU,YAAY,CAAC,IAAI,GAAG,SAAS,EAAE,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IACnF,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACxK,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5K,4EAA4E;IAC5E,0DAA0D;IAC1D,MAAM,IAAI,GAAG,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AAC7M,CAAC;AACD,MAAM,UAAU,iBAAiB,CAAC,IAAI,GAAG,SAAS,EAAE,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IACxF,OAAO,EAAE,GAAG,GAAG,EAAE,WAAW,EAAE,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,CAAC,oBAAoB,IAAI,GAAG,CAAC,cAAc;QAC3H,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;AAC5F,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAI,GAAG,SAAS,EAAE,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IACvF,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC;QAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,GAAG,CAAC,qBAAqB,IAAI,GAAG,CAAC,eAAe,CAAC;IAC9D,MAAM,KAAK,GAAG,GAAG,CAAC,kBAAkB,IAAI,GAAG,CAAC,YAAY,CAAC;IACzD,+FAA+F;IAC/F,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE;QACxF,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1C,WAAW,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;gBACzE,GAAG,EAAE,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,YAAY,EAAE,iBAAiB,EAAE,QAAQ,EAAE,aAAa,EAAE;gBAChH,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;KACrF,CAAC;IACF,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,OAAO,GAAG,IAAI,CAAC;IAAC,CAAC;IACtH,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IAAC,CAAC;IACtF,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACjD,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAI,GAAG,SAAS,EAAE,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG,EAAE,MAAoB;IACtH,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;QAC9D,GAAG,EAAE,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,YAAY,EAAE,iBAAiB,EAAE,QAAQ,EAAE,aAAa,EAAE;QAChH,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IACnF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC3D,IAAI,MAAM,GAA+B,IAAI,CAAC;IAC9C,IAAI,CAAC;QAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,MAAM,GAAG,KAAK,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,8CAA8C,CAAC,CAAC;IACnL,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,WAAW,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAC1E,MAAM,CAAC,KAAK,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;QAClH,MAAM,CAAC,MAAM,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;QACjG,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;QACpD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,GAAG,GAAG,GAAG,UAAU,EAAE,CAAC;YACxD,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAAC,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;YAAC,CAAC;oBAC/G,CAAC;gBAAC,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;QACtD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,8EAA8E;QAC9E,oDAAoD;QACpD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,uBAAuB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,2BAA2B,EAAE,KAAK,CAAC,EAAE,CAAC,uBAAuB,EAAE,OAAO,CAAC,EAAE,CAAC,6BAA6B,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YACnM,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACtK,IAAI,MAAM,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClJ,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["import { promises as fs } from 'node:fs';\nimport { createHash } from 'node:crypto';\nimport path from 'node:path';\nimport os from 'node:os';\nimport { fileURLToPath } from 'node:url';\nimport { randomUUID } from 'node:crypto';\nimport { runProcess } from './process.js';\n\nexport const HERMES_SOURCE = 'https://github.com/NousResearch/hermes-agent.git';\nexport const HERMES_REVISION = 'eb7e8620324b32424c06218f6a28094df2e921f8';\nexport function agentHome(env: NodeJS.ProcessEnv = process.env): string {\n  return path.resolve(env.ONBOARDER_AGENT_HOME || path.join(env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config'), 'onboarder', 'agent'));\n}\nexport function hermesBinary(env: NodeJS.ProcessEnv = process.env): string {\n  return env.ONBOARDER_HERMES_BIN || 'hermes';\n}\nexport function runtimePaths(home = agentHome(), env: NodeJS.ProcessEnv = process.env) {\n  const native = process.platform === 'win32' ? path.join(env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'), 'hermes') : path.join(os.homedir(), '.hermes');\n  const configured = env.HERMES_HOME ? (path.basename(path.dirname(env.HERMES_HOME)) === 'profiles' ? path.dirname(path.dirname(env.HERMES_HOME)) : env.HERMES_HOME) : native;\n  // Named profiles share the installation's Python store, but not its config,\n  // credentials, sessions, memory, or MCP server selection.\n  const name = 'onboarder-' + createHash('sha256').update(path.resolve(home)).digest('hex').slice(0, 12);\n  return { home, profile: path.join(configured, 'profiles', name), runs: path.join(home, 'runs'), workspaces: path.join(home, 'workspaces'), server: fileURLToPath(new URL('./stdio.js', import.meta.url)) };\n}\nexport function hermesEnvironment(home = agentHome(), env: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {\n  return { ...env, HERMES_HOME: runtimePaths(home, env).profile, OPENAI_API_KEY: env.ONBOARDER_AI_API_KEY || env.OPENAI_API_KEY,\n    PATH: [path.join(os.homedir(), '.local', 'bin'), env.PATH || ''].join(path.delimiter) };\n}\nexport async function setupAgent(home = agentHome(), env: NodeJS.ProcessEnv = process.env) {\n  const paths = runtimePaths(home, env);\n  for (const dir of [paths.profile, paths.runs, paths.workspaces]) await fs.mkdir(dir, { recursive: true, mode: 0o700 });\n  const file = path.join(paths.profile, 'config.yaml');\n  const base = env.ONBOARDER_AI_BASE_URL || env.OPENAI_BASE_URL;\n  const model = env.ONBOARDER_AI_MODEL || env.OPENAI_MODEL;\n  // JSON is a YAML subset. Hermes can subsequently maintain this file with its own model wizard.\n  const config = {\n    ...(base && model ? { model: { provider: 'custom', base_url: base, default: model } } : {}),\n    agent: { max_turns: 24 }, memory: { memory_enabled: false, user_profile_enabled: false },\n    tools: { tool_search: { enabled: 'off' } },\n    mcp_servers: { onboarder: { command: process.execPath, args: [paths.server],\n      env: { ONBOARDER_AGENT_RUN: '${ONBOARDER_AGENT_RUN}', GITHUB_TOKEN: '${GITHUB_TOKEN}', GH_TOKEN: '${GH_TOKEN}' },\n      tools: { prompts: false, resources: false }, connect_timeout: 30, timeout: 150 } },\n  };\n  let created = false;\n  try { await fs.writeFile(file, JSON.stringify(config, null, 2) + '\\n', { mode: 0o600, flag: 'wx' }); created = true; }\n  catch (error) { if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error; }\n  return { ...paths, configFile: file, created };\n}\n\n/** Refresh only harness-owned settings; retain the model wizard's provider/auth choices. */\nexport async function prepareAgentProfile(home = agentHome(), env: NodeJS.ProcessEnv = process.env, signal?: AbortSignal) {\n  const setup = await setupAgent(home, env);\n  if (setup.created) return setup;\n  const server = { command: process.execPath, args: [setup.server],\n    env: { ONBOARDER_AGENT_RUN: '${ONBOARDER_AGENT_RUN}', GITHUB_TOKEN: '${GITHUB_TOKEN}', GH_TOKEN: '${GH_TOKEN}' },\n    tools: { prompts: false, resources: false }, connect_timeout: 30, timeout: 150 };\n  const source = await fs.readFile(setup.configFile, 'utf8');\n  let config: Record<string, any> | null = null;\n  try { const value = JSON.parse(source); if (value && typeof value === 'object' && !Array.isArray(value)) config = value; } catch { /* Hermes' model wizard writes native YAML. */ }\n  if (config) {\n    config.mcp_servers = { ...(config.mcp_servers || {}), onboarder: server };\n    config.tools = { ...(config.tools || {}), tool_search: { ...(config.tools?.tool_search || {}), enabled: 'off' } };\n    config.memory = { ...(config.memory || {}), memory_enabled: false, user_profile_enabled: false };\n    const next = JSON.stringify(config, null, 2) + '\\n';\n    if (source !== next) {\n      const temporary = setup.configFile + '-' + randomUUID();\n      try { await fs.writeFile(temporary, next, { flag: 'wx', mode: 0o600 }); await fs.rename(temporary, setup.configFile); }\n      finally { await fs.rm(temporary, { force: true }); }\n    }\n  } else {\n    // Let Hermes parse/preserve its own YAML rather than adding a Node dependency\n    // or hand-editing the model wizard's configuration.\n    for (const [key, value] of [['mcp_servers.onboarder', JSON.stringify(server)], ['tools.tool_search.enabled', 'off'], ['memory.memory_enabled', 'false'], ['memory.user_profile_enabled', 'false']]) {\n      const result = await runProcess(hermesBinary(env), ['config', 'set', key, value], { env: hermesEnvironment(home, env), signal, timeoutMs: 30_000, maxBytes: 128000 });\n      if (result.code) throw new Error(`Could not refresh the dedicated Hermes profile: ${result.stderr.slice(-1500) || result.stdout.slice(-1500)}`);\n    }\n  }\n  return setup;\n}\n"]}

package/cli/agent/contracts.d.ts

@@ -0,0 +1,77 @@
+export declare const AGENT_MODES: readonly ['ask', 'review', 'triage', 'implement', 'pr', 'github'];
+export type AgentMode = typeof AGENT_MODES[number];
+export interface AgentRequest {
+    mode: AgentMode;
+    root: string;
+    task: string;
+    pr?: number;
+    issue?: number;
+    maxTurns?: number;
+    timeoutSeconds?: number;
+    allowChecks?: boolean;
+    allowGithubWrites?: boolean;
+    dryRun?: boolean;
+    model?: string;
+    provider?: string;
+    resume?: string;
+    base?: string;
+}
+export interface RunManifest {
+    schemaVersion: 1;
+    id: string;
+    mode: AgentMode;
+    sourceRoot: string;
+    root: string;
+    repository: string | null;
+    remote: string | null;
+    branch: string | null;
+    baseBranch: string | null;
+    task: string;
+    pr?: number;
+    issue?: number;
+    permissions: {
+        files: boolean;
+        checks: boolean;
+        github: boolean;
+    };
+    startedAt: string;
+    timeoutSeconds: number;
+    maxTurns: number;
+    auditFile: string;
+}
+export interface AgentEvent {
+    type: 'system' | 'text' | 'tool_use' | 'tool_result' | 'result';
+    subtype?: string;
+    name?: string;
+    text?: string;
+    session_id?: string;
+    exit_code?: number;
+    error?: string;
+    is_error?: boolean;
+    tokens?: Record<string, number>;
+    duration_ms?: number;
+}
+export interface AgentResult {
+    id: string;
+    status: 'completed' | 'failed' | 'cancelled';
+    mode: AgentMode;
+    answer: string;
+    sessionId: string | null;
+    workspace: string;
+    branch: string | null;
+    repository: string | null;
+    auditFile: string;
+    completedAt: string;
+    tokens?: Record<string, number>;
+}
+export interface AgentTool {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: 'object';
+        properties: Record<string, unknown>;
+        required?: string[];
+        additionalProperties?: boolean;
+    };
+    run: (args: Record<string, unknown>) => Promise<unknown>;
+}

package/cli/agent/contracts.js

@@ -0,0 +1,2 @@
+export const AGENT_MODES = ['ask', 'review', 'triage', 'implement', 'pr', 'github'];
+//# sourceMappingURL=contracts.js.map

package/cli/agent/contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../src/cli/agent/contracts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAU,CAAC","sourcesContent":["export const AGENT_MODES = ['ask', 'review', 'triage', 'implement', 'pr', 'github'] as const;\nexport type AgentMode = typeof AGENT_MODES[number];\nexport interface AgentRequest {\n  mode: AgentMode;\n  root: string;\n  task: string;\n  pr?: number;\n  issue?: number;\n  maxTurns?: number;\n  timeoutSeconds?: number;\n  allowChecks?: boolean;\n  allowGithubWrites?: boolean;\n  dryRun?: boolean;\n  model?: string;\n  provider?: string;\n  resume?: string;\n  base?: string;\n}\nexport interface RunManifest {\n  schemaVersion: 1;\n  id: string;\n  mode: AgentMode;\n  sourceRoot: string;\n  root: string;\n  repository: string | null;\n  remote: string | null;\n  branch: string | null;\n  baseBranch: string | null;\n  task: string;\n  pr?: number;\n  issue?: number;\n  permissions: { files: boolean; checks: boolean; github: boolean };\n  startedAt: string;\n  timeoutSeconds: number;\n  maxTurns: number;\n  auditFile: string;\n}\nexport interface AgentEvent {\n  type: 'system' | 'text' | 'tool_use' | 'tool_result' | 'result';\n  subtype?: string;\n  name?: string;\n  text?: string;\n  session_id?: string;\n  exit_code?: number;\n  error?: string;\n  is_error?: boolean;\n  tokens?: Record<string, number>;\n  duration_ms?: number;\n}\nexport interface AgentResult {\n  id: string;\n  status: 'completed' | 'failed' | 'cancelled';\n  mode: AgentMode;\n  answer: string;\n  sessionId: string | null;\n  workspace: string;\n  branch: string | null;\n  repository: string | null;\n  auditFile: string;\n  completedAt: string;\n  tokens?: Record<string, number>;\n}\nexport interface AgentTool {\n  name: string;\n  description: string;\n  inputSchema: { type: 'object'; properties: Record<string, unknown>; required?: string[]; additionalProperties?: boolean };\n  run: (args: Record<string, unknown>) => Promise<unknown>;\n}\n"]}

package/cli/agent/files.d.ts

@@ -0,0 +1,19 @@
+export declare const FILE_LIMIT: number;
+export declare const hashText: (text: string) => string;
+export declare function safeRelative(file: string): string;
+export declare function scopedFile(root: string, file: string, createParents?: boolean): Promise<string>;
+export declare function readAgentFile(root: string, file: string): Promise<{
+    file: string;
+    content: string;
+    sha256: string;
+    lines: number;
+}>;
+export declare function writeAgentFile(root: string, file: string, content: string, expected: string): Promise<{
+    file: string;
+    sha256: string;
+    bytes: number;
+}>;
+export declare function deleteAgentFile(root: string, file: string, expected: string): Promise<{
+    file: string;
+    deleted: boolean;
+}>;

package/cli/agent/files.js

@@ -0,0 +1,109 @@
+import { promises as fs, constants } from 'node:fs';
+import path from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+export const FILE_LIMIT = 128 * 1024;
+export const hashText = (text) => createHash('sha256').update(text).digest('hex');
+export function safeRelative(file) {
+    if (!file || file.length > 500 || path.isAbsolute(file) || file.includes('\\') || /[\x00-\x1f]/.test(file))
+        throw new Error('Use a relative repository file path.');
+    const parts = file.split('/');
+    if (parts.some(p => !p || p === '..' || p === '.' || ['.git', 'node_modules', '.ssh', '.aws', '.npmrc', '.pypirc', '.netrc', '.git-credentials'].includes(p) || /^\.env(?:\.|$)/.test(p) || /^(?:id_rsa|id_ed25519)$|\.(?:pem|key)$/i.test(p)))
+        throw new Error('This path is outside the agent source-file scope.');
+    return file;
+}
+export async function scopedFile(root, file, createParents = false) {
+    safeRelative(file);
+    const canonical = await fs.realpath(root);
+    const parts = file.split('/');
+    let current = canonical;
+    for (let i = 0; i < parts.length; i++) {
+        current = path.join(current, parts[i]);
+        let stat;
+        try {
+            stat = await fs.lstat(current);
+        }
+        catch (e) {
+            if (e.code !== 'ENOENT')
+                throw e;
+            if (createParents && i < parts.length - 1)
+                await fs.mkdir(current);
+            else if (i < parts.length - 1)
+                throw new Error('The parent directory does not exist.');
+            continue;
+        }
+        if (stat.isSymbolicLink())
+            throw new Error('Agent file tools do not follow symbolic links.');
+        if (i < parts.length - 1 && !stat.isDirectory())
+            throw new Error('The parent path is not a directory.');
+        if (i === parts.length - 1 && !stat.isFile())
+            throw new Error('The path is not a regular file.');
+    }
+    return current;
+}
+async function readBounded(file) {
+    const handle = await fs.open(file, constants.O_RDONLY | (constants.O_NOFOLLOW || 0));
+    try {
+        const stat = await handle.stat();
+        if (!stat.isFile() || stat.size > FILE_LIMIT)
+            throw new Error(`File must be text and at most ${FILE_LIMIT} bytes.`);
+        const buffer = Buffer.alloc(FILE_LIMIT + 1);
+        let bytesRead = 0;
+        while (bytesRead < buffer.length) {
+            const read = await handle.read(buffer, bytesRead, buffer.length - bytesRead, bytesRead);
+            if (!read.bytesRead)
+                break;
+            bytesRead += read.bytesRead;
+        }
+        if (bytesRead > FILE_LIMIT || buffer.subarray(0, bytesRead).includes(0))
+            throw new Error('File exceeds the text-file limit or contains binary data.');
+        return buffer.subarray(0, bytesRead).toString('utf8');
+    }
+    finally {
+        await handle.close();
+    }
+}
+export async function readAgentFile(root, file) {
+    const content = await readBounded(await scopedFile(root, file));
+    return { file, content, sha256: hashText(content), lines: content.split('\n').length };
+}
+export async function writeAgentFile(root, file, content, expected) {
+    if (Buffer.byteLength(content) > FILE_LIMIT || content.includes('\0'))
+        throw new Error('New content exceeds the text-file limit.');
+    const target = await scopedFile(root, file, true);
+    const check = async () => {
+        try {
+            const current = await readBounded(target);
+            if (expected === 'new' || hashText(current) !== expected)
+                throw new Error('The file changed. Read it again before writing.');
+        }
+        catch (e) {
+            if (e.code === 'ENOENT' && expected === 'new')
+                return;
+            throw e;
+        }
+    };
+    await check();
+    const mode = await fs.stat(target).then(s => s.mode & 0o777).catch(() => 0o644);
+    const temporary = path.join(path.dirname(target), `.onboarder-${randomUUID()}.tmp`);
+    try {
+        await fs.writeFile(temporary, content, { mode, flag: 'wx' });
+        await check();
+        if (expected === 'new')
+            await fs.link(temporary, target);
+        else
+            await fs.rename(temporary, target);
+    }
+    finally {
+        await fs.unlink(temporary).catch(() => { });
+    }
+    return { file, sha256: hashText(content), bytes: Buffer.byteLength(content) };
+}
+export async function deleteAgentFile(root, file, expected) {
+    const target = await scopedFile(root, file);
+    const current = await readBounded(target);
+    if (hashText(current) !== expected)
+        throw new Error('The file changed. Read it again before deleting.');
+    await fs.unlink(target);
+    return { file, deleted: true };
+}
+//# sourceMappingURL=files.js.map

package/cli/agent/files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../../src/cli/agent/files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,CAAC,MAAM,UAAU,GAAG,GAAG,GAAG,IAAI,CAAC;AACrC,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1F,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACpK,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,yCAAyC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACrT,OAAO,IAAI,CAAC;AACd,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,IAAY,EAAE,aAAa,GAAG,KAAK;IAChF,YAAY,CAAC,IAAI,CAAC,CAAC;IACnB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAG,SAAS,CAAC;IACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QACvC,OAAO,CAAC,EAAE,CAAC;YACT,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,CAAC,CAAC;YAC5D,IAAI,aAAa,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;iBAC9D,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YACvF,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC7F,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACxG,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AACD,KAAK,UAAU,WAAW,CAAC,IAAY;IACrC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,UAAU,SAAS,CAAC,CAAC;QACpH,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QAC5C,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,OAAO,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,GAAG,SAAS,EAAE,SAAS,CAAC,CAAC;YACxF,IAAI,CAAC,IAAI,CAAC,SAAS;gBAAE,MAAM;YAC3B,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QAC9B,CAAC;QACD,IAAI,SAAS,GAAG,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QACtJ,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxD,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACrC,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,IAAY;IAC5D,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAChE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;AACzF,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,IAAY,EAAE,OAAe,EAAE,QAAgB;IAChG,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,UAAU,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACnI,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE;QACvB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAC/H,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,KAAK,KAAK;gBAAE,OAAO;YACjF,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CAAC;IACF,MAAM,KAAK,EAAE,CAAC;IACd,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,cAAc,UAAU,EAAE,MAAM,CAAC,CAAC;IACpF,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,KAAK,EAAE,CAAC;QACd,IAAI,QAAQ,KAAK,KAAK;YAAE,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;;YACpD,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IACzD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;AAChF,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,IAAY,EAAE,QAAgB;IAChF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACxG,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC","sourcesContent":["import { promises as fs, constants } from 'node:fs';\nimport path from 'node:path';\nimport { createHash, randomUUID } from 'node:crypto';\n\nexport const FILE_LIMIT = 128 * 1024;\nexport const hashText = (text: string) => createHash('sha256').update(text).digest('hex');\nexport function safeRelative(file: string): string {\n  if (!file || file.length > 500 || path.isAbsolute(file) || file.includes('\\\\') || /[\\x00-\\x1f]/.test(file)) throw new Error('Use a relative repository file path.');\n  const parts = file.split('/');\n  if (parts.some(p => !p || p === '..' || p === '.' || ['.git', 'node_modules', '.ssh', '.aws', '.npmrc', '.pypirc', '.netrc', '.git-credentials'].includes(p) || /^\\.env(?:\\.|$)/.test(p) || /^(?:id_rsa|id_ed25519)$|\\.(?:pem|key)$/i.test(p))) throw new Error('This path is outside the agent source-file scope.');\n  return file;\n}\nexport async function scopedFile(root: string, file: string, createParents = false): Promise<string> {\n  safeRelative(file);\n  const canonical = await fs.realpath(root);\n  const parts = file.split('/');\n  let current = canonical;\n  for (let i = 0; i < parts.length; i++) {\n    current = path.join(current, parts[i]);\n    let stat;\n    try { stat = await fs.lstat(current); }\n    catch (e) {\n      if ((e as NodeJS.ErrnoException).code !== 'ENOENT') throw e;\n      if (createParents && i < parts.length - 1) await fs.mkdir(current);\n      else if (i < parts.length - 1) throw new Error('The parent directory does not exist.');\n      continue;\n    }\n    if (stat.isSymbolicLink()) throw new Error('Agent file tools do not follow symbolic links.');\n    if (i < parts.length - 1 && !stat.isDirectory()) throw new Error('The parent path is not a directory.');\n    if (i === parts.length - 1 && !stat.isFile()) throw new Error('The path is not a regular file.');\n  }\n  return current;\n}\nasync function readBounded(file: string): Promise<string> {\n  const handle = await fs.open(file, constants.O_RDONLY | (constants.O_NOFOLLOW || 0));\n  try {\n    const stat = await handle.stat();\n    if (!stat.isFile() || stat.size > FILE_LIMIT) throw new Error(`File must be text and at most ${FILE_LIMIT} bytes.`);\n    const buffer = Buffer.alloc(FILE_LIMIT + 1);\n    let bytesRead = 0;\n    while (bytesRead < buffer.length) {\n      const read = await handle.read(buffer, bytesRead, buffer.length - bytesRead, bytesRead);\n      if (!read.bytesRead) break;\n      bytesRead += read.bytesRead;\n    }\n    if (bytesRead > FILE_LIMIT || buffer.subarray(0, bytesRead).includes(0)) throw new Error('File exceeds the text-file limit or contains binary data.');\n    return buffer.subarray(0, bytesRead).toString('utf8');\n  } finally { await handle.close(); }\n}\nexport async function readAgentFile(root: string, file: string) {\n  const content = await readBounded(await scopedFile(root, file));\n  return { file, content, sha256: hashText(content), lines: content.split('\\n').length };\n}\nexport async function writeAgentFile(root: string, file: string, content: string, expected: string) {\n  if (Buffer.byteLength(content) > FILE_LIMIT || content.includes('\\0')) throw new Error('New content exceeds the text-file limit.');\n  const target = await scopedFile(root, file, true);\n  const check = async () => {\n    try {\n      const current = await readBounded(target);\n      if (expected === 'new' || hashText(current) !== expected) throw new Error('The file changed. Read it again before writing.');\n    } catch (e) {\n      if ((e as NodeJS.ErrnoException).code === 'ENOENT' && expected === 'new') return;\n      throw e;\n    }\n  };\n  await check();\n  const mode = await fs.stat(target).then(s => s.mode & 0o777).catch(() => 0o644);\n  const temporary = path.join(path.dirname(target), `.onboarder-${randomUUID()}.tmp`);\n  try {\n    await fs.writeFile(temporary, content, { mode, flag: 'wx' });\n    await check();\n    if (expected === 'new') await fs.link(temporary, target);\n    else await fs.rename(temporary, target);\n  } finally { await fs.unlink(temporary).catch(() => {}); }\n  return { file, sha256: hashText(content), bytes: Buffer.byteLength(content) };\n}\nexport async function deleteAgentFile(root: string, file: string, expected: string) {\n  const target = await scopedFile(root, file);\n  const current = await readBounded(target);\n  if (hashText(current) !== expected) throw new Error('The file changed. Read it again before deleting.');\n  await fs.unlink(target);\n  return { file, deleted: true };\n}\n"]}