create-open-autonomy 2.4.8 → 2.4.10

package/README.md

@@ -34,7 +34,7 @@ hermes/              the agent: SOUL.md, its three skills (develop, pm, communit
 .open-autonomy/      the platform connection: config.yaml (account, publish policy, the model and rail bounds the platform holds the project's funds to), reporter.ts (the publisher:
                      sessions, the board, the setup), mint-key.ts (the key, the adopter way), start.ts (the agent's four
                      processes, the one way it starts), the vendored SDK, kit.json (which kit, version and parameters made this repository)
-container/           a real setup: one image whose entrypoint is start.ts as root, dropping the gateway to the image's user; the pinned Hermes
+container/           the default for a real deployment (bare is for development and fast debugging): one image whose entrypoint is start.ts as root, dropping the gateway to the image's user; the pinned Hermes
 .github/workflows/   ci.yml (the project's check on every branch), land.yml (the landing convention)
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-open-autonomy",
-  "version": "2.4.8",
+  "version": "2.4.10",
   "description": "The default Open Autonomy starter kit: a complete repository that runs its own Hermes agent against the platform, with the SDK wired in. `bun create open-autonomy <dir>` scaffolds one.",
   "license": "Apache-2.0",
   "repository": {

package/src/kit.ts

@@ -9,7 +9,7 @@
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join, relative, resolve } from 'node:path';
 
-export const KIT = { name: 'hermes', version: '2.4.8' } as const;
+export const KIT = { name: 'hermes', version: '2.4.10' } as const;
 export const KIT_FILE = '.open-autonomy/kit.json';
 const TEMPLATE = resolve(import.meta.dir, '..', 'template');
 

package/template/.open-autonomy/start.ts

@@ -1,8 +1,10 @@
 #!/usr/bin/env bun
 // Start the agent. The same processes wherever it runs; only how this script is started differs:
-//   on your machine   `bun .open-autonomy/start.ts` — everything as you, no isolation, for development
-//   in a container    the image's entrypoint, as root with the secrets mounted for root alone and `--as <user>`:
-//                     the gateway and the reporter run as that user and can reach no key (container/README.md)
+//   in a container    the default for a real deployment: the image's entrypoint, as root with the secrets mounted for
+//                     root alone and `--as <user>`; the gateway and the reporter run as that user and can reach no
+//                     key (container/README.md)
+//   on your machine   `bun .open-autonomy/start.ts` — everything as you, no isolation: for development and fast
+//                     debugging, where the agent reaching its own keys is an accepted trade
 //
 //   bun .open-autonomy/start.ts [--home <dir>] [--secrets <dir>] [--project <dir>] [--origin <url>] [--as <user>] [--valve <port>]
 //
@@ -58,7 +60,9 @@ const own = (path: string) => { if (user) Bun.spawnSync({ cmd: ['chown', '-R', `
 // through: a start from inside another agent's worker (a project's world, brought up by a task) would otherwise inherit
 // that worker's HERMES_KANBAN_DB, HERMES_KANBAN_HOME, its task and run, and file its work on the outer board.
 const inherited = (): Record<string, string> => { const env: Record<string, string> = {}; for (const [k, v] of Object.entries(process.env)) if (v !== undefined && !k.startsWith('HERMES_')) env[k] = v; return env; };
-const agentEnv = (): Record<string, string> => ({ ...inherited(), HERMES_HOME: home, ...(user ? { HOME: home, USER: user.name, LOGNAME: user.name } : {}), ...(existsSync(sock) ? { SSH_AUTH_SOCK: sock } : {}), GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND ?? 'ssh -o StrictHostKeyChecking=accept-new' });
+// TERMINAL_CWD: a conversation's shell (a channel message answered live) starts in the checkout, as a task's does —
+// Hermes would otherwise start it in the home, where the agent finds its own files and none of the project's.
+const agentEnv = (): Record<string, string> => ({ ...inherited(), HERMES_HOME: home, TERMINAL_CWD: project, ...(user ? { HOME: home, USER: user.name, LOGNAME: user.name } : {}), ...(existsSync(sock) ? { SSH_AUTH_SOCK: sock } : {}), GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND ?? 'ssh -o StrictHostKeyChecking=accept-new' });
 
 const children: Array<{ name: string; proc: ReturnType<typeof Bun.spawn> }> = [];
 let ending = false;

package/template/container/README.md

@@ -4,7 +4,7 @@ The agent is four processes: an ssh-agent holding the deploy key, the valve hold
 developer's on :8787, the treasurer's on :8788 — `--valve <port>` moves both — each re-read when its file changes), the keyless reporter, and
 the Hermes gateway. One script starts them, `.open-autonomy/start.ts`, and it is the only way they are started.
 
-**On your machine**, for development: everything as you, no isolation.
+**In a container** is the default for a real deployment. **On your machine**, for development and fast debugging: everything as you, no isolation, the agent able to reach its own keys — an accepted trade while debugging, never the shape of production.
 
 ```bash
 bun .open-autonomy/mint-key.ts                                   # the developer's key → ~/.config/open-autonomy/agent.env