cruo-agent 0.1.18 → 0.1.20

package/README.md

@@ -1,7 +1,9 @@
 # cruo-agent
 
 Run a Cruo agent. It watches your board, picks up the cards you assign it, and
-works them — on your machine, under your own Claude account.
+works them — on your machine, under your own account with the model's vendor:
+Claude Code by default, or Codex (GPT), Antigravity (Gemini) or Hermes Agent
+(GPT, Gemini, Grok, Hermes and open models).
 
 ```bash
 npx cruo-agent login cruo_pat_…    # the token Cruo showed you once
@@ -13,7 +15,7 @@ npx cruo-agent run                 # let it work
 
 | you need | check it with |
 |---|---|
-| [Claude Code](https://claude.com/claude-code) installed and signed in — it is the harness, and the agent reaches no model without it | `claude -p 'say ok'` |
+| [Claude Code](https://claude.com/claude-code) installed and signed in — it is the default harness, and the agent reaches no model without it. Using another model instead? See [Choosing the model](#choosing-the-model) | `claude -p 'say ok'` |
 | Node 20 or newer | `node -v` |
 
 Worth ten seconds, because both failures are silent. A missing harness exits 127
@@ -35,11 +37,59 @@ differently:
   to nothing, and nothing runs because it exists.
 - **The supervisor** is this program. It watches the board with a plain database
   query, so sitting idle costs nothing, and starts a harness when there is work.
-- **The harness** is Claude Code, started fresh for one card and gone when that
-  card is done. Nothing carries over between cards but the board itself.
+- **The harness** is the agent CLI that does the work — Claude Code unless you
+  choose [another](#choosing-the-model) — started fresh for one card and gone
+  when that card is done. Nothing carries over between cards but the board
+  itself.
 
 Cruo runs no model of its own and never bills you for inference.
 
+## Choosing the model
+
+`--harness-kind` picks which agent CLI works the card. Each runs on your own
+account with that vendor; Cruo bills you for no inference either way.
+
+| `--harness-kind` | models | needs | check |
+|---|---|---|---|
+| `claude` (default) | Claude | `claude` installed and signed in | `claude -p 'say ok'` |
+| `codex` · preview | GPT, on your ChatGPT plan | `brew install --cask codex`, then `codex login` | `codex exec 'say ok'` |
+| `antigravity` · preview | Gemini, on your Google sign-in | `brew install --cask antigravity-cli`, then sign in once with `agy` | `agy -p 'say ok'` |
+| `hermes` · preview | GPT, Gemini, Grok, Hermes and open models | [Hermes Agent](https://hermes-agent.nousresearch.com) with a provider key in `~/.hermes/.env`; needs `--provider` and `--model` | `hermes -z 'say ok' --provider openrouter -m openai/gpt-4o-mini` |
+
+```bash
+cruo run --worktree --harness-kind codex --allow "mcp__cruo,Read,Edit,Write,Bash"
+cruo run --worktree --harness-kind hermes --provider openrouter --model openai/gpt-4o-mini \
+  --allow "mcp__cruo,Read,Edit,Write,Bash"
+```
+
+**What each can touch outside the card's checkout** — the thing to know before
+leaving one running unattended:
+
+- **claude** — its file tools are held to the worktree; its shell (if `--allow`
+  includes `Bash`) is not, and known dangerous commands are denied by name.
+- **codex** — the strongest without a container. The operating system's sandbox
+  refuses writes outside the worktree and the git directories a commit needs;
+  `.git/hooks` and `.git/config` stay read-only, so a run cannot plant a hook
+  that your own git would later execute. Reads are not limited.
+- **antigravity** — runs with `--sandbox`: its terminal cannot write outside the
+  workspace. Whether its file-editing tool is held to the worktree is not
+  verified — Gemini declines to attempt a boundary test. Each run
+  adds a `cruo-run-*` server to `~/.gemini/config/mcp_config.json` and removes
+  it after; a supervisor sweeps any a killed run left behind.
+- **hermes** — **unconfined**: its shell and file tools reach anything your user
+  can. The supervisor says so at every start.
+
+`--allow` stays the one knob for all four: it is mapped onto each harness's own
+controls (Hermes toolsets; Codex and Antigravity drop to read-only / plan mode
+when it names no write tool).
+
+**Preview** means each has worked a real card end to end — claimed it, changed
+the file, committed, moved it and commented, checked on the branch and the
+board — but has not yet had the months of use Claude Code has. Codex's sandbox
+was also checked on disk: writes outside the worktree, into `.git/hooks` and
+into `.git/config` were refused while the commit still landed. `--usage`
+records tokens only for Claude Code.
+
 ## Getting a token
 
 Cruo → Settings → Members → **Add an agent**. The token is shown once; Cruo
@@ -109,6 +159,9 @@ given up on work nobody abandoned.
 | `--interval <seconds>` | how often to poll (default 20) |
 | `--worktree` | a checkout per card |
 | `--allow <tools>` | what the harness may use |
+| `--harness-kind <kind>` | `claude` (default), `codex`, `antigravity` or `hermes` — see [Choosing the model](#choosing-the-model) |
+| `--model <name>` | the model the harness uses. Required for `hermes`; the others fall back to the account's default |
+| `--provider <name>` | `hermes` only: where the model comes from, e.g. `openrouter` |
 | `--push` | publish the branch after a run that commits |
 | `--harness-timeout <seconds>` | kill a run that wedges (default 3000 — 50 minutes). It used to have to stay under an hour, because that is how long a run's board session lasted; since 0.1.17 the session is renewed under a running card, so what this bounds now is spend, not credentials |
 | `--max-attempts <n>` | give up on a card after n unproductive runs (default 3) |

package/dist/VERSION

@@ -1 +1 @@
-0.1.18
+0.1.20

package/dist/cli.js

@@ -15300,6 +15300,13 @@ var init_order = __esm({
   }
 });
 
+// ../../packages/core/dist/csv.js
+var init_csv = __esm({
+  "../../packages/core/dist/csv.js"() {
+    "use strict";
+  }
+});
+
 // ../../packages/core/dist/index.js
 var init_dist = __esm({
   "../../packages/core/dist/index.js"() {
@@ -15315,6 +15322,7 @@ var init_dist = __esm({
     init_tree();
     init_place();
     init_order();
+    init_csv();
   }
 });
 
@@ -46070,6 +46078,7 @@ var init_options = __esm({
       "cwd",
       "function",
       "harness",
+      "harness-kind",
       "harness-timeout",
       "interval",
       "limit",
@@ -46079,6 +46088,7 @@ var init_options = __esm({
       "model",
       "prepare",
       "prepare-timeout",
+      "provider",
       "project",
       "push-remote",
       "repo",
@@ -46695,6 +46705,223 @@ var init_claim = __esm({
   }
 });
 
+// src/hermes.ts
+function hermesToolsets(allow, mcpServerName = "cruo") {
+  const out = /* @__PURE__ */ new Set();
+  for (const raw of allow.split(",")) {
+    const t = raw.trim().replace(/\(.*$/, "");
+    if (!t || t.startsWith("mcp__")) continue;
+    const ts = TOOLSET_FOR[t];
+    if (ts) out.add(ts);
+  }
+  return [...out, mcpServerName];
+}
+function hermesConfigYaml(servers) {
+  const q = (s) => JSON.stringify(s);
+  const lines = ["mcp_servers:"];
+  for (const [name, s] of Object.entries(servers)) {
+    lines.push(`  ${q(name)}:`);
+    lines.push(`    command: ${q(s.command)}`);
+    lines.push(`    args: [${s.args.map(q).join(", ")}]`);
+    lines.push(`    env:`);
+    for (const [k, v] of Object.entries(s.env)) lines.push(`      ${q(k)}: ${q(v)}`);
+  }
+  return lines.join("\n") + "\n";
+}
+function providerKeysFrom(dotenv, already) {
+  const out = {};
+  for (const line of dotenv.split("\n")) {
+    const m = /^([A-Z][A-Z0-9_]*(?:_API_KEY|_TOKEN))=(.*)$/.exec(line.trim());
+    if (!m) continue;
+    const [, name, raw] = m;
+    const value = raw.replace(/^["']|["']$/g, "");
+    if (value && !already[name]) out[name] = value;
+  }
+  return out;
+}
+function hermesArgs(input) {
+  return [
+    "-z",
+    `${input.systemPrompt}
+
+---
+
+Your task for this run:
+
+${input.userPrompt}`,
+    "-t",
+    input.toolsets.join(","),
+    "--provider",
+    input.provider,
+    "-m",
+    input.model,
+    "--ignore-rules"
+  ];
+}
+function hermesPythonFrom(launcherText, readText) {
+  const shebangOf = (text) => /^#!\s*(\S*python[\d.]*)\s*$/m.exec(text.split("\n")[0] ?? "")?.[1] ?? null;
+  const direct = shebangOf(launcherText);
+  if (direct) return direct;
+  const target = /exec\s+"([^"]+)"/.exec(launcherText)?.[1];
+  if (!target) return null;
+  const targetText = readText(target);
+  return targetText ? shebangOf(targetText) : null;
+}
+var TOOLSET_FOR, HERMES_MCP_WAIT_SECONDS, HERMES_LAUNCHER_PY;
+var init_hermes = __esm({
+  "src/hermes.ts"() {
+    "use strict";
+    TOOLSET_FOR = {
+      Bash: "terminal",
+      Read: "file",
+      Glob: "file",
+      Grep: "file",
+      Edit: "file",
+      Write: "file",
+      NotebookEdit: "file"
+    };
+    HERMES_MCP_WAIT_SECONDS = 20;
+    HERMES_LAUNCHER_PY = [
+      "import sys",
+      "try:",
+      "    from tools.mcp_tool import discover_mcp_tools",
+      "    discover_mcp_tools()",
+      "    import hermes_cli.mcp_startup as _m",
+      "    _m._mcp_discovery_started = True",
+      "    _orig = _m.wait_for_mcp_discovery",
+      `    _m.wait_for_mcp_discovery = lambda timeout=0.75: _orig(timeout=max(timeout, ${HERMES_MCP_WAIT_SECONDS}.0))`,
+      "except Exception:",
+      "    pass",
+      "from hermes_cli.main import main",
+      "sys.argv = ['hermes'] + sys.argv[1:]",
+      "sys.exit(main())"
+    ].join("\n");
+  }
+});
+
+// src/codex.ts
+function codexMcpOverrides(name, s) {
+  const env = Object.entries(s.env).map(([k, v]) => `${tomlString(k)} = ${tomlString(v)}`).join(", ");
+  return [
+    "-c",
+    `mcp_servers.${name}.command=${tomlString(s.command)}`,
+    "-c",
+    `mcp_servers.${name}.args=[${s.args.map(tomlString).join(", ")}]`,
+    "-c",
+    `mcp_servers.${name}.env={ ${env} }`,
+    // Pre-approved. A headless run has nobody to approve a tool call, and
+    // without this Codex refused every board WRITE ("requires approval, while
+    // the approval policy is never"; seen 2026-09-23) — the agent could read
+    // its card and do the work, but not claim it, move it or comment. These
+    // tools act as the agent's own account under RLS, which is what Claude's
+    // `--allowedTools mcp__cruo` already grants. Values in 0.156.1: auto,
+    // prompt, writes, approve.
+    "-c",
+    `mcp_servers.${name}.default_tools_approval_mode="approve"`
+  ];
+}
+function gitWritableDirs(commonDir, gitDir) {
+  const dirs = [`${commonDir}/objects`, `${commonDir}/refs`, `${commonDir}/logs`];
+  if (gitDir !== commonDir) dirs.push(gitDir);
+  return dirs;
+}
+function codexCanWrite(allow) {
+  return allow.split(",").map((t) => t.trim().replace(/\(.*$/, "")).some((t) => ["Bash", "Edit", "Write", "NotebookEdit"].includes(t));
+}
+function codexArgs(input) {
+  return [
+    "exec",
+    // No `--system-prompt` in `codex exec`: the supervisor's standing rules lead
+    // the prompt, set apart from this run's task (same as Hermes).
+    `${input.systemPrompt}
+
+---
+
+Your task for this run:
+
+${input.userPrompt}`,
+    "--sandbox",
+    input.writable ? "workspace-write" : "read-only",
+    "-C",
+    input.cwd,
+    ...input.writable ? input.addDirs.flatMap((d) => ["--add-dir", d]) : [],
+    "--ignore-user-config",
+    "--ignore-rules",
+    // No session files left in CODEX_HOME for a run nobody will resume.
+    "--ephemeral",
+    "--color",
+    "never",
+    ...input.model ? ["-m", input.model] : [],
+    ...codexMcpOverrides(input.mcp.name, input.mcp.server)
+  ];
+}
+var tomlString;
+var init_codex = __esm({
+  "src/codex.ts"() {
+    "use strict";
+    tomlString = (s) => JSON.stringify(s);
+  }
+});
+
+// src/antigravity.ts
+function agyServerName(runId) {
+  return `${AGY_RUN_PREFIX}${runId.toLowerCase().replace(/[^a-z0-9-]/g, "-")}`;
+}
+function agyMcpAddArgs(name, s) {
+  return [
+    "mcp",
+    "add",
+    ...Object.entries(s.env).flatMap(([k, v]) => ["--env", `${k}=${v}`]),
+    name,
+    "--",
+    s.command,
+    ...s.args
+  ];
+}
+function agyMcpRemoveArgs(name) {
+  return ["mcp", "remove", name];
+}
+function staleAgyServers(configText) {
+  if (!configText.trim()) return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(configText);
+  } catch {
+    return [];
+  }
+  const root = parsed ?? {};
+  const servers = root.mcpServers ?? root;
+  return Object.keys(servers).filter((n2) => n2.startsWith(AGY_RUN_PREFIX));
+}
+function agyArgs(input) {
+  return [
+    // No system-prompt flag; the standing rules lead the prompt (as Hermes, Codex).
+    "-p",
+    `${input.systemPrompt}
+
+---
+
+Your task for this run:
+
+${input.userPrompt}`,
+    "--dangerously-skip-permissions",
+    "--sandbox",
+    // Without a write tool in --allow, plan mode: it can read and reason about
+    // the checkout and use the board, but not change files.
+    ...input.writable ? [] : ["--mode", "plan"],
+    ...input.model ? ["--model", input.model] : [],
+    "--output-format",
+    "text"
+  ];
+}
+var AGY_RUN_PREFIX;
+var init_antigravity = __esm({
+  "src/antigravity.ts"() {
+    "use strict";
+    AGY_RUN_PREFIX = "cruo-run-";
+  }
+});
+
 // src/harness-signal.ts
 function refusalIn(stdout) {
   if (!stdout.trim()) return null;
@@ -46847,7 +47074,19 @@ var init_harness_signal = __esm({
       // ("the endpoint is rate limited"), and the note above is explicit that a
       // false positive is the worse error: it credits an issue an attempt it
       // should have been charged.
-      [/rate limit(ed| exceeded|s? reached)\b.*\btry again/i, "the account is rate limited"]
+      [/rate limit(ed| exceeded|s? reached)\b.*\btry again/i, "the account is rate limited"],
+      // Hermes Agent (CRA-78) reports EVERY provider failure the same way — on
+      // STDOUT, with exit 0, which is the reply position: "API call failed after 3
+      // retries: HTTP 404: Grok 3 Mini is deprecated…" (observed 2026-09-23; 402
+      // for a key with no credit, 401, 429 alike). Unmatched, that reads as a model
+      // that ran and said something, and the card is charged for an outage — the
+      // CRA-75 / CRA-89 shape exactly. Anchored to a line start and the whole
+      // "after N retries: HTTP nnn" clause, so prose about API errors is not it.
+      // Not only HTTP errors: a provider that does not answer at all comes out as
+      // "API call failed after 3 retries: Connection error." (DeepSeek,
+      // 2026-09-23), with no status code. Same position, same meaning — the run
+      // never reached a model — so the whole "after N retries:" line is the tell.
+      [/^API call failed after \d+ retries: /m, "the model provider refused the call"]
     ];
     num = (v) => typeof v === "number" && Number.isFinite(v) ? v : void 0;
   }
@@ -47136,6 +47375,7 @@ var supervisor_exports = {};
 import { spawn } from "node:child_process";
 import { createRequire } from "node:module";
 import { mkdtemp, readdir as readdir3, readFile as readFile2, rm as rm3, stat as stat2, writeFile as writeFile3 } from "node:fs/promises";
+import { readFileSync as readFileSync2 } from "node:fs";
 import { homedir as homedir2, tmpdir } from "node:os";
 import { join as join3 } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -47527,6 +47767,138 @@ async function preflight() {
     await cleanup();
   }
 }
+async function prepareHermesRun(mcpConfig, cwd) {
+  const parsed = JSON.parse(await readFile2(mcpConfig, "utf8"));
+  const home = await mkdtemp(join3(tmpdir(), "cruo-hermes-"));
+  await writeFile3(join3(home, "config.yaml"), hermesConfigYaml(parsed.mcpServers), { mode: 384 });
+  const dotenv = await readFile2(join3(homedir2(), ".hermes", ".env"), "utf8").catch(() => "");
+  return {
+    env: {
+      ...providerKeysFrom(dotenv, process.env),
+      HERMES_HOME: home,
+      // Hermes's shell starts where this says; without it a run began in the
+      // wrong directory in the spike.
+      TERMINAL_CWD: cwd
+    },
+    // CRUO_KEEP_HERMES_HOME=1 keeps it, for reading Hermes's own logs
+    // (logs/mcp-stderr.log, logs/agent.log) after a run that went wrong. It
+    // holds the run's board session, so it is opt-in and says where it is.
+    cleanup: async () => {
+      if (process.env.CRUO_KEEP_HERMES_HOME) {
+        log(`  kept HERMES_HOME for inspection: ${home} (holds this run's board session \u2014 delete it)`);
+        return;
+      }
+      await rm3(home, { recursive: true, force: true });
+    }
+  };
+}
+async function cruoServerFrom(mcpConfig) {
+  const parsed = JSON.parse(await readFile2(mcpConfig, "utf8"));
+  return parsed.mcpServers.cruo;
+}
+async function gitDirsOf(cwd) {
+  try {
+    const out = await new Promise((resolve2, reject) => {
+      const c = spawn("git", ["rev-parse", "--path-format=absolute", "--git-common-dir", "--git-dir"], { cwd });
+      let buf = "";
+      c.stdout.on("data", (d) => buf += d.toString());
+      c.on("error", reject);
+      c.on("close", (code) => code === 0 ? resolve2(buf) : reject(new Error(`git exited ${code}`)));
+    });
+    const [common, gitDir] = out.trim().split("\n");
+    return common && gitDir ? { common, gitDir } : null;
+  } catch {
+    return null;
+  }
+}
+function runQuiet(command, args) {
+  return new Promise((resolve2, reject) => {
+    const c = spawn(command, args, { stdio: ["ignore", "ignore", "pipe"], env: harnessEnv() });
+    let err = "";
+    c.stderr?.on("data", (d) => err += d.toString());
+    c.on("error", reject);
+    c.on(
+      "close",
+      (code) => code === 0 ? resolve2() : reject(new Error(`${command} ${args.slice(0, 2).join(" ")} exited ${code}: ${err.trim().split("\n")[0] ?? ""}`))
+    );
+  });
+}
+async function resolveHermesPython() {
+  const read = (p) => {
+    try {
+      return readFileSync2(p, "utf8").slice(0, 2e3);
+    } catch {
+      return null;
+    }
+  };
+  const found = (process.env.PATH ?? "").split(":").map((d) => join3(d, options.harness)).find((p) => read(p) !== null);
+  if (!found) return null;
+  return hermesPythonFrom(read(found) ?? "", read);
+}
+async function sweepAgyServers() {
+  const text = await readFile2(join3(homedir2(), ".gemini", "config", "mcp_config.json"), "utf8").catch(() => "");
+  const stale = staleAgyServers(text);
+  for (const name of stale) {
+    await runQuiet(options.harness, agyMcpRemoveArgs(name)).catch(() => {
+    });
+  }
+  return stale.length;
+}
+async function prepareAltHarness(input) {
+  const { mcpConfig, cwd, worktree, hit, systemPromptText, userPromptText } = input;
+  switch (options.harnessKind) {
+    case "hermes": {
+      const run = await prepareHermesRun(mcpConfig, cwd);
+      const args = hermesArgs({
+        systemPrompt: systemPromptText,
+        userPrompt: userPromptText,
+        toolsets: hermesToolsets(options.allow),
+        model: options.model,
+        provider: options.provider
+      });
+      return hermesPython ? { command: hermesPython, args: ["-c", HERMES_LAUNCHER_PY, ...args], ...run } : { command: options.harness, args, ...run };
+    }
+    case "codex": {
+      const server = await cruoServerFrom(mcpConfig);
+      const dirs = worktree ? await gitDirsOf(cwd) : null;
+      return {
+        command: options.harness,
+        args: codexArgs({
+          systemPrompt: systemPromptText,
+          userPrompt: userPromptText,
+          cwd,
+          model: options.model,
+          writable: codexCanWrite(options.allow),
+          addDirs: dirs ? gitWritableDirs(dirs.common, dirs.gitDir) : [],
+          mcp: { name: "cruo", server }
+        }),
+        env: {},
+        cleanup: async () => {
+        }
+      };
+    }
+    case "antigravity": {
+      const server = await cruoServerFrom(mcpConfig);
+      const name = agyServerName(`${hit.ref}-${Date.now().toString(36)}`);
+      await runQuiet(options.harness, agyMcpAddArgs(name, server));
+      return {
+        command: options.harness,
+        args: agyArgs({
+          systemPrompt: systemPromptText,
+          userPrompt: userPromptText,
+          model: options.model,
+          writable: codexCanWrite(options.allow)
+        }),
+        env: {},
+        cleanup: () => runQuiet(options.harness, agyMcpRemoveArgs(name)).catch(
+          (e) => log(`  could not remove ${name} from Antigravity's MCP config: ${String(e)} \u2014 the next start sweeps it`)
+        )
+      };
+    }
+    default:
+      return null;
+  }
+}
 function harnessEnv() {
   const env = { ...process.env };
   for (const name of CRUO_OWNED_ENV) delete env[name];
@@ -47634,7 +48006,7 @@ async function invokeHarness(ctx, identity, hit, worktree) {
   const cwd = worktree?.path ?? options.cwd;
   const { path: mcpConfig, cleanup, keepSessionFresh } = await writeMcpConfig();
   const stopSessionRefresh = keepSessionFresh();
-  const streaming = options.usage === true;
+  const streaming = options.usage === true && options.harnessKind === "claude";
   const builtinTools = [
     ...new Set(
       options.allow.split(",").map((t) => t.trim()).filter((t) => t !== "" && !t.startsWith("mcp__")).map((t) => t.replace(/\(.*$/, ""))
@@ -47642,7 +48014,8 @@ async function invokeHarness(ctx, identity, hit, worktree) {
   ].join(",");
   const userPromptText = userPrompt(hit);
   const systemPromptText = systemPrompt(ctx, identity, worktree);
-  const args = [
+  const alt = await prepareAltHarness({ mcpConfig, cwd, worktree, hit, systemPromptText, userPromptText });
+  const args = alt ? alt.args : [
     "-p",
     userPromptText,
     "--mcp-config",
@@ -47659,6 +48032,14 @@ async function invokeHarness(ctx, identity, hit, worktree) {
     "--strict-mcp-config",
     "--allowedTools",
     options.allow,
+    // CRA-131. The local database is shared by every agent and person on the
+    // machine, so no agent resets it. `pnpm supabase:reset` refuses inside a
+    // run on its own (CRUO_AGENT_RUN, below); these are the spellings that
+    // bypass that script. A deny rule matches a prefix, so it is a fence and
+    // not a wall — `bash -c "…"` still gets round it — but it stops the
+    // ordinary command an agent reaches for, which is how 2026-09-19 happened.
+    "--disallowedTools",
+    DB_RESET_DENY.join(","),
     "--system-prompt",
     systemPromptText,
     ...options.model ? ["--model", options.model] : [],
@@ -47669,13 +48050,15 @@ async function invokeHarness(ctx, identity, hit, worktree) {
   ];
   try {
     return await new Promise((resolve2) => {
-      const child = spawn(options.harness, args, {
+      const child = spawn(alt?.command ?? options.harness, args, {
         // `pipe`, not `inherit`, so the streams can be counted on the way past.
         // Watching a live run is the whole point of a foreground supervisor, so
         // both are written straight through — this tees, it does not capture.
         stdio: ["ignore", "pipe", "pipe"],
         cwd,
-        env: harnessEnv()
+        // CRA-131: marks everything the harness runs as inside an agent run,
+        // which is what makes `pnpm supabase:reset` refuse with no override.
+        env: { ...harnessEnv(), CRUO_AGENT_RUN: hit.ref, ...alt?.env ?? {} }
       });
       const startedAtMs = Date.now();
       let stdoutBytes = 0;
@@ -47775,6 +48158,7 @@ async function invokeHarness(ctx, identity, hit, worktree) {
   } finally {
     stopSessionRefresh();
     await cleanup();
+    if (alt) await alt.cleanup();
   }
 }
 async function loadAttempts(ctx, hits) {
@@ -48080,7 +48464,9 @@ async function tick(ctx, identity, deadTicks, allowance) {
     log(`\u2192 ${hit.ref} "${hit.issue.title}" (${why})`);
     worked += 1;
     if (options.dryRun) {
-      log(`  dry run \u2014 would invoke: ${options.harness} -p \u2026  --allowedTools ${options.allow}`);
+      log(
+        options.harnessKind === "claude" ? `  dry run \u2014 would invoke: ${options.harness} -p \u2026  --allowedTools ${options.allow}` : `  dry run \u2014 would invoke ${options.harnessKind} (${options.harness}) with --allow ${options.allow}`
+      );
       continue;
     }
     invoked += 1;
@@ -48260,6 +48646,41 @@ async function main() {
   if (sessionEndpoint()) {
     log(`  sessions from ${sessionEndpoint()} \u2014 no service-role key needed here`);
   }
+  if (!HARNESS_KINDS.includes(options.harnessKind)) {
+    console.error(`--harness-kind must be one of ${HARNESS_KINDS.join(", ")}, not "${options.harnessKind}".`);
+    process.exit(2);
+  }
+  if (options.harnessKind === "hermes") {
+    if (!options.model || !options.provider) {
+      console.error(
+        "--harness-kind hermes needs --provider and --model, e.g. --provider openrouter --model openai/gpt-4o-mini"
+      );
+      process.exit(2);
+    }
+    log(`harness: hermes \xB7 ${options.provider} \xB7 ${options.model}`);
+    log(`! hermes runs UNCONFINED: its shell and file tools can reach anything this user can.`);
+    log(`  Claude Code's --restricted has no equivalent here; see CRA-78.`);
+    hermesPython = await resolveHermesPython();
+    log(
+      hermesPython ? `  launched through ${hermesPython}, with MCP discovered before the run (hermes -z otherwise races the board tools)` : `! could not find Hermes's own Python \u2014 running plain \`${options.harness}\`; the Cruo board tools may be missing from some runs`
+    );
+  }
+  if (options.harnessKind === "codex") {
+    log(`harness: codex${options.model ? ` \xB7 ${options.model}` : " \xB7 the account's default model"}`);
+    log(
+      codexCanWrite(options.allow) ? `  sandbox: workspace-write \u2014 writes only to the worktree and the git dirs a commit needs; hooks and config stay read-only; reads are not limited` : `  sandbox: read-only \u2014 --allow names no write tool`
+    );
+  }
+  if (options.harnessKind === "antigravity") {
+    log(`harness: antigravity (agy)${options.model ? ` \xB7 ${options.model}` : " \xB7 the account's default model"}`);
+    log(`! agy --sandbox restricts its terminal; whether its FILE edits are held to the worktree is not verified yet (CRA-78).`);
+    log(`  Each run registers the Cruo server in ~/.gemini/config/mcp_config.json as cruo-run-* and removes it after.`);
+    const swept = await sweepAgyServers();
+    if (swept > 0) log(`  removed ${swept} cruo-run-* server(s) a killed run left in Antigravity's MCP config`);
+  }
+  if (options.harnessKind !== "claude" && options.usage) {
+    log(`  --usage is Claude Code's and is ignored for ${options.harnessKind}; runs record no tokens.`);
+  }
   const staleConfigs = await sweepStaleConfigs();
   if (staleConfigs > 0) {
     log(`  cleared ${staleConfigs} temp config(s) left by a killed run`);
@@ -48400,7 +48821,7 @@ to catch: a second supervisor nothing could see or stop.
     if (stopping) return;
   }
 }
-var argv, flag, opt, num2, ms, readOptions, options, log, sessionRenewal, worktreeConfig, lastRefusal, CONFIG_DIR_PREFIX, CRUO_OWNED_ENV, HEAD_STORED, lastHolding, warnedAboutSpendTable, stopping, paused, stopRequestedAt, currentRun, pendingWait;
+var argv, flag, opt, num2, ms, HARNESS_KINDS, DEFAULT_HARNESS_COMMAND, readOptions, options, log, sessionRenewal, worktreeConfig, lastRefusal, CONFIG_DIR_PREFIX, CRUO_OWNED_ENV, hermesPython, DB_RESET_DENY, HEAD_STORED, lastHolding, warnedAboutSpendTable, stopping, paused, stopRequestedAt, currentRun, pendingWait;
 var init_supervisor = __esm({
   "src/supervisor.ts"() {
     "use strict";
@@ -48411,6 +48832,9 @@ var init_supervisor = __esm({
     init_auth();
     init_session_renewal();
     init_claim();
+    init_hermes();
+    init_codex();
+    init_antigravity();
     init_options();
     init_harness_signal();
     init_process();
@@ -48423,6 +48847,13 @@ var init_supervisor = __esm({
     opt = (name, fallback) => optIn(argv, name, fallback);
     num2 = (name, spec) => numericIn(argv, name, spec);
     ms = (name, fallbackSeconds) => secondsIn(argv, name, fallbackSeconds);
+    HARNESS_KINDS = ["claude", "hermes", "codex", "antigravity"];
+    DEFAULT_HARNESS_COMMAND = {
+      claude: "claude",
+      hermes: "hermes",
+      codex: "codex",
+      antigravity: "agy"
+    };
     readOptions = () => ({
       /** Override the function to poll for. Defaults to this agent's own. */
       function: opt("function"),
@@ -48441,8 +48872,19 @@ var init_supervisor = __esm({
       intervalMs: ms("interval", 20),
       once: flag("once"),
       dryRun: flag("dry-run"),
-      /** The harness command. Anything that takes a prompt and exits works. */
-      harness: opt("harness", "claude"),
+      /**
+       * Which harness this is, which decides how it is called — CRA-78. `claude`
+       * (Claude Code, the default, unchanged) or `hermes` (Hermes Agent, which runs
+       * GPT, Gemini, Grok, Hermes and other models; see ./hermes.ts). Validated in
+       * `main`, where an unknown kind is refused rather than guessed at.
+       */
+      harnessKind: opt("harness-kind", "claude"),
+      /** The harness command. Anything that takes a prompt and exits works. The
+       *  default follows the kind, so `--harness-kind codex` needs nothing else. */
+      harness: opt("harness", DEFAULT_HARNESS_COMMAND[opt("harness-kind") ?? "claude"] ?? "claude"),
+      /** The inference provider, for harnesses that take one — `hermes` requires it
+       *  (e.g. `openrouter`), since its per-run home has no default to fall back on. */
+      provider: opt("provider"),
       /**
        * Tools the harness may use. Cruo-only by default: the harness gets the
        * board and nothing else — no shell, no filesystem. That makes a PM agent
@@ -48628,6 +49070,13 @@ cruo-supervisor: ${error51.message}
       // stands in for. Cheap to list, and wrong to discover the hard way.
       "CRUO_SESSION"
     ];
+    hermesPython = null;
+    DB_RESET_DENY = [
+      "Bash(npx supabase db reset:*)",
+      "Bash(supabase db reset:*)",
+      "Bash(pnpm exec supabase db reset:*)",
+      "Bash(pnpm dlx supabase db reset:*)"
+    ];
     HEAD_STORED = 200;
     lastHolding = 0;
     warnedAboutSpendTable = false;
@@ -48710,6 +49159,10 @@ Common options
   --push                 publish the branch after a run that commits
   --interval <seconds>   how often to poll (default 20)
   --usage                record what each run costs (needs a Claude Code harness)
+  --harness-kind <kind>  which agent CLI works the card: claude (default), codex,
+                         antigravity or hermes \u2014 see cruo.space/docs#agents
+  --model <name>         the model it uses (hermes needs one; the others default)
+  --provider <name>      hermes only: where the model comes from, e.g. openrouter
 
   Full list and what each one is for: https://cruo.space/docs#agents
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cruo-agent",
-  "version": "0.1.18",
+  "version": "0.1.20",
   "description": "Run a Cruo agent: it watches your board, picks up the cards you assign it, and works them.",
   "license": "MIT",
   "homepage": "https://cruo.space/docs#agents",