dsh-cliworker-now 0.0.0-stage → 0.7.6

package/lib/types/host/hermes-installation.js

@@ -0,0 +1,162 @@
+import { constants } from 'node:fs';
+import { access, open, realpath } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import { dirname, join, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { nativeLaunchArgv } from './native-launch.mjs';
+export class HermesExecutableError extends Error {
+}
+export function hermesCommandInstallationHome(argv) {
+    return argv[2] === fileURLToPath(new URL('./hermes-native-entry.py', import.meta.url)) && argv[4]
+        ? dirname(dirname(dirname(argv[4])))
+        : undefined;
+}
+/** Reuse the current official checkout's committed dependency environment, not a
+ * directory selected by recency/hash guessing. A clean account home must not run
+ * the installer's borrowed-home sync. Older/self-contained entries retain their
+ * native launcher contract. The child rechecks this selection under its native lock. */
+export async function hermesNativeCommand(executable, args, signal) {
+    // The official Windows distlib exe selects the recorded store Python itself.
+    // Its fixed fallback cmd is decoded as data, never interpreted by cmd.exe.
+    // Keep bootstrap and update/lease behavior owned by the installed CLI.
+    if (process.platform === 'win32') {
+        signal?.throwIfAborted();
+        const command = nativeLaunchArgv([executable, ...args]);
+        await access(command[0], constants.R_OK);
+        return command;
+    }
+    let current = executable;
+    const read = async (path, limit) => {
+        const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        try {
+            const info = await file.stat();
+            if (!info.isFile() || info.nlink !== 1 || info.size > limit)
+                throw new Error('Unsafe Hermes installation record');
+            const result = await file.readFile('utf8');
+            if (Buffer.byteLength(result) > limit)
+                throw new Error('Oversized Hermes installation record');
+            signal?.throwIfAborted();
+            return result;
+        }
+        finally {
+            await file.close();
+        }
+    };
+    for (let depth = 0; depth < 4; depth++) {
+        signal?.throwIfAborted();
+        let path, source;
+        try {
+            path = await realpath(current);
+            source = await read(path, 128 * 1024);
+        }
+        catch (error) {
+            signal?.throwIfAborted();
+            if (error.code === 'ENOENT')
+                return [executable, ...args];
+            throw new HermesExecutableError('启动入口不可用，请修复安装');
+        }
+        const shim = /^#![^\r\n]*\b(?:sh|bash|zsh)\s*\r?\n\s*exec\s+(?:"(\/[^"\r\n$`]+)"|(\/[^\s$`"'\\;|&<>]+))\s+"\$@"\s*$/.exec(source);
+        if (shim) {
+            current = shim[1] ?? shim[2];
+            continue;
+        }
+        if (!path.endsWith(`${sep}.hermes${sep}bin${sep}hermes`) || !source.includes('hermes_bootstrap'))
+            return [executable, ...args];
+        const checkout = dirname(dirname(dirname(path)));
+        if (!source.includes(checkout))
+            throw new HermesExecutableError('Hermes 安装入口与源码不匹配');
+        const owner = dirname(checkout), key = createHash('sha256').update(checkout).digest('hex').slice(0, 16);
+        const install = join(owner, 'installs', key), facts = join(install, 'facts.json');
+        try {
+            const data = JSON.parse(await read(facts, 4 * 1024 * 1024));
+            const environment = data?.packages?.venv?.environment;
+            if (typeof environment !== 'string' ||
+                !environment.startsWith(join(install, 'environments') + sep) ||
+                (await realpath(environment)) !== environment)
+                throw new Error('Invalid Hermes dependency selection');
+            await read(join(environment, 'pyvenv.cfg'), 64 * 1024);
+            await access(join(environment, 'bin/python'), constants.X_OK);
+            for (const file of ['hermes_bootstrap.py', 'hermes_cli/main.py', 'pm/environments.py'])
+                await access(join(checkout, file), constants.R_OK);
+            return [
+                join(environment, 'bin/python'),
+                '-I',
+                fileURLToPath(new URL('./hermes-native-entry.py', import.meta.url)),
+                checkout,
+                facts,
+                environment,
+                ...args,
+            ];
+        }
+        catch {
+            signal?.throwIfAborted();
+            throw new HermesExecutableError('Hermes 当前安装依赖不可用，请在原生终端修复安装');
+        }
+    }
+    throw new HermesExecutableError('启动脚本异常，请修复安装');
+}
+/** Inspect the installed fixed exec shim without invoking its installer or auth UI. */
+export async function verifyHermesExecutable(executable, signal) {
+    signal.throwIfAborted();
+    if (process.platform === 'win32') {
+        try {
+            const command = nativeLaunchArgv([executable]);
+            await access(command[0], constants.R_OK);
+            if (!(await open(command[0], 'r').then(async (file) => {
+                try {
+                    return (await file.stat()).isFile();
+                }
+                finally {
+                    await file.close();
+                }
+            })))
+                throw new Error('Invalid Hermes entry');
+            signal.throwIfAborted();
+            return;
+        }
+        catch {
+            signal.throwIfAborted();
+            throw new HermesExecutableError('启动入口不可用，请修复安装');
+        }
+    }
+    let current = executable;
+    for (let depth = 0; depth < 4; depth++) {
+        let file;
+        try {
+            await access(current, constants.X_OK);
+            // Official per-user launchers may themselves be symbolic links.
+            file = await open(await realpath(current), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+            const info = await file.stat();
+            if (!info.isFile())
+                throw new Error('Invalid Hermes entry');
+            if (info.size > 16 * 1024)
+                return;
+            const bytes = Buffer.alloc(16 * 1024 + 1);
+            let source;
+            try {
+                const { bytesRead } = await file.read(bytes, 0, bytes.length, 0);
+                const after = await file.stat();
+                if (bytesRead !== info.size || after.size !== info.size || after.mtimeMs !== info.mtimeMs)
+                    throw new Error('Hermes entry changed during inspection');
+                source = bytes.subarray(0, bytesRead).toString('utf8');
+            }
+            finally {
+                bytes.fill(0);
+            }
+            signal.throwIfAborted();
+            const shim = /^#![^\r\n]*\b(?:sh|bash|zsh)\s*\r?\n\s*exec\s+(?:"(\/[^"\r\n$`]+)"|(\/[^\s$`"'\\;|&<>]+))\s+"\$@"\s*$/.exec(source);
+            if (!shim)
+                return;
+            current = shim[1] ?? shim[2];
+        }
+        catch {
+            signal.throwIfAborted();
+            throw new HermesExecutableError('启动入口不可用，请修复安装');
+        }
+        finally {
+            await file?.close();
+        }
+    }
+    throw new HermesExecutableError('启动脚本异常，请修复安装');
+}
+//# sourceMappingURL=hermes-installation.js.map

package/lib/types/host/hermes-installation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hermes-installation.js","sourceRoot":"","sources":["../../../src/host/hermes-installation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD,MAAM,OAAO,qBAAsB,SAAQ,KAAK;CAAG;AAEnD,MAAM,UAAU,6BAA6B,CAAC,IAAc;IAC1D,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,IAAI,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QAC/F,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED;;;wFAGwF;AACxF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAAkB,EAClB,IAAc,EACd,MAAoB;IAEpB,6EAA6E;IAC7E,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,MAAM,OAAO,GAAG,gBAAgB,CAAC,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAAC,CAAA;QACvD,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;QACzC,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,IAAI,OAAO,GAAG,UAAU,CAAA;IACxB,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAE,KAAa,EAAE,EAAE;QACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;QAC/F,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;YAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK;gBACzD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;YACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YAC1C,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;YAC9F,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,OAAO,MAAM,CAAA;QACf,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;QACpB,CAAC;IACH,CAAC,CAAA;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,IAAI,IAAY,EAAE,MAAc,CAAA;QAChC,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;YAC9B,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC,CAAA;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAAA;YACpF,MAAM,IAAI,qBAAqB,CAAC,eAAe,CAAC,CAAA;QAClD,CAAC;QACD,MAAM,IAAI,GACR,uGAAuG,CAAC,IAAI,CAC1G,MAAM,CACP,CAAA;QACH,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAE,CAAA;YAC7B,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YAC9F,OAAO,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAAA;QAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAChD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,mBAAmB,CAAC,CAAA;QACpF,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,EAC7B,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACxE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,EAC1C,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,CAAA;YAC3D,MAAM,WAAW,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAA;YACrD,IACE,OAAO,WAAW,KAAK,QAAQ;gBAC/B,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,GAAG,GAAG,CAAC;gBAC5D,CAAC,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC,KAAK,WAAW;gBAE7C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;YACxD,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,CAAA;YACtD,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;YAC7D,KAAK,MAAM,IAAI,IAAI,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,oBAAoB,CAAC;gBACpF,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;YACpD,OAAO;gBACL,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC;gBAC/B,IAAI;gBACJ,aAAa,CAAC,IAAI,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACnE,QAAQ;gBACR,KAAK;gBACL,WAAW;gBACX,GAAG,IAAI;aACR,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,MAAM,IAAI,qBAAqB,CAAC,6BAA6B,CAAC,CAAA;QAChE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,qBAAqB,CAAC,cAAc,CAAC,CAAA;AACjD,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,UAAkB,EAAE,MAAmB;IAClF,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,gBAAgB,CAAC,CAAC,UAAU,CAAC,CAAC,CAAA;YAC9C,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;YACzC,IACE,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBACjD,IAAI,CAAC;oBACH,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAA;gBACrC,CAAC;wBAAS,CAAC;oBACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;gBACpB,CAAC;YACH,CAAC,CAAC,CAAC;gBAEH,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;YACzC,MAAM,CAAC,cAAc,EAAE,CAAA;YACvB,OAAM;QACR,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,cAAc,EAAE,CAAA;YACvB,MAAM,IAAI,qBAAqB,CAAC,eAAe,CAAC,CAAA;QAClD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,UAAU,CAAA;IACxB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,IAAI,IAAkD,CAAA;QACtD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;YACrC,gEAAgE;YAChE,IAAI,GAAG,MAAM,IAAI,CACf,MAAM,QAAQ,CAAC,OAAO,CAAC,EACvB,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CACjE,CAAA;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;YAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;YAC3D,IAAI,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI;gBAAE,OAAM;YACjC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,CAAA;YACzC,IAAI,MAAc,CAAA;YAClB,IAAI,CAAC;gBACH,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;gBAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;gBAC/B,IAAI,SAAS,KAAK,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;oBACvF,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;gBAC3D,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YACxD,CAAC;oBAAS,CAAC;gBACT,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACf,CAAC;YACD,MAAM,CAAC,cAAc,EAAE,CAAA;YACvB,MAAM,IAAI,GACR,uGAAuG,CAAC,IAAI,CAC1G,MAAM,CACP,CAAA;YACH,IAAI,CAAC,IAAI;gBAAE,OAAM;YACjB,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAE,CAAA;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,cAAc,EAAE,CAAA;YACvB,MAAM,IAAI,qBAAqB,CAAC,eAAe,CAAC,CAAA;QAClD,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,EAAE,KAAK,EAAE,CAAA;QACrB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,qBAAqB,CAAC,cAAc,CAAC,CAAA;AACjD,CAAC"}

package/lib/types/host/hermes-models.d.ts

@@ -0,0 +1,26 @@
+import { type AccountModelScope } from './account-models.mjs';
+/** Native PooledCredential fields; a successful catalog cannot erase a native
+ * dead account, active exhaustion window or model-specific entitlement bench. */
+export declare function hermesPoolEntryUnavailable(entry: Record<string, any>, model?: string): boolean;
+/** Internal source material; callers must never publish or log the returned values. */
+export declare function readHermesAccountMaterial(home: string, signal?: AbortSignal): Promise<{
+    config: Record<string, any>;
+    auth: Record<string, any>;
+    env: Record<string, string>;
+    sourceIds: string[];
+}>;
+/** Native own stores only; never accept a broad manual:* prefix. */
+export declare function assertHermesOwnAccounts(home: string, signal?: AbortSignal): Promise<{
+    config: Record<string, any>;
+    auth: Record<string, any>;
+    env: Record<string, string>;
+    sourceIds: string[];
+}>;
+/** Current selected-provider account scope. Unknown provider/auth schemas fail closed.
+ * Route precedence follows Hermes runtime_provider_backends / credential_pool;
+ * only the canonical OpenRouter route and native Codex OAuth store are supported
+ * without an explicit endpoint. Ambiguous mirrors/custom pools are not guessed. */
+export declare function hermesAccountModels(home: string, provider: string, options?: {
+    signal?: AbortSignal;
+    fetch?: typeof fetch;
+}): Promise<AccountModelScope>;

package/lib/types/host/hermes-models.js

@@ -0,0 +1,328 @@
+import { constants } from 'node:fs';
+import { lstat, open } from 'node:fs/promises';
+import { join } from 'node:path';
+import { parse } from 'yaml';
+import { parseHermesOwnEnvironment } from "./hermes-env.js";
+import { hermesUnsuppressedEnvironment, projectHermesUnsuppressedAuth } from "./hermes-suppression.js";
+import { beginHermesNousCapabilities, fetchHermesNousModels, forgetHermesNousCapabilities, HermesNousError, selectHermesNousSource, } from "./hermes-nous.js";
+import { probeAccountModels } from './account-models.mjs';
+const object = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const literal = (value) => typeof value === 'string' &&
+    !!value.trim() &&
+    !/[\x00-\x1f]/.test(value) &&
+    !/^(?:op:\/\/|!|\$|<|your[_ -]|placeholder|changeme)/i.test(value.trim());
+const unknown = () => ({ state: 'unknown', source: 'unknown', models: [] });
+/** Native PooledCredential fields; a successful catalog cannot erase a native
+ * dead account, active exhaustion window or model-specific entitlement bench. */
+export function hermesPoolEntryUnavailable(entry, model) {
+    if (entry.disabled === true || entry.status === 'exhausted' || entry.last_status === 'dead')
+        return true;
+    if (entry.last_status === 'exhausted') {
+        const until = Number(entry.last_error_reset_at);
+        if (!Number.isFinite(until) || until <= 0 || until > Date.now() / 1000)
+            return true;
+    }
+    const cooldowns = object(entry.model_cooldowns) ? entry.model_cooldowns : {};
+    const values = model ? [cooldowns[model]] : Object.values(cooldowns);
+    return values.some((until) => typeof until === 'number' && until > Date.now() / 1000);
+}
+/** Private source reads only. Do not execute secret commands, expand arbitrary env,
+ * refresh OAuth, print native config, or import Hermes' side-effectful runtime. */
+async function read(path, signal) {
+    signal?.throwIfAborted();
+    let handle;
+    try {
+        handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        const info = await handle.stat();
+        if (!info.isFile() || info.nlink !== 1 || info.size > 1024 * 1024)
+            throw new Error('Unsafe metadata');
+        const buffer = Buffer.alloc(info.size + 1);
+        try {
+            let length = 0;
+            while (length < buffer.length) {
+                signal?.throwIfAborted();
+                const { bytesRead } = await handle.read(buffer, length, buffer.length - length, length);
+                if (!bytesRead)
+                    break;
+                length += bytesRead;
+            }
+            if (length > info.size)
+                throw new Error('Metadata changed');
+            return buffer.subarray(0, length).toString('utf8');
+        }
+        finally {
+            buffer.fill(0);
+        }
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        signal?.throwIfAborted();
+        throw new Error('Hermes 账号配置无法安全读取，请在原生登录设置中检查');
+    }
+    finally {
+        await handle?.close();
+    }
+}
+function dotenv(text) {
+    return parseHermesOwnEnvironment(text);
+}
+/** Internal source material; callers must never publish or log the returned values. */
+export async function readHermesAccountMaterial(home, signal) {
+    const config = parse((await read(join(home, 'config.yaml'), signal)) ?? '');
+    const auth = JSON.parse((await read(join(home, 'auth.json'), signal)) ?? '{}');
+    const env = dotenv((await read(join(home, '.env'), signal)) ?? '');
+    if (!object(config) || !object(auth))
+        throw new Error('Hermes 账号配置无效');
+    return { config, auth, env, sourceIds: [home] };
+}
+/** Exact native source/provider pairs from auth_commands and credential_pool.
+ * In particular manual:qwen_cli is still a foreign login, not a Hermes OAuth flow. */
+function ownPoolSource(provider, entry, material) {
+    const source = entry.source;
+    if ((!source || source === 'manual' || source === 'config') && entry.auth_type === 'api_key')
+        return true;
+    if (typeof source !== 'string')
+        return false;
+    if (source.startsWith('env:'))
+        return literal(material.env[source.slice(4)]);
+    const ownOAuth = {
+        anthropic: ['manual:hermes_pkce', 'hermes_pkce'],
+        'openai-codex': ['manual:device_code', 'manual:loopback_pkce', 'device_code'],
+        'xai-oauth': ['manual:device_code', 'device_code'],
+        'minimax-oauth': ['manual:minimax_oauth', 'oauth'],
+        nous: ['manual:device_code', 'device_code'],
+    };
+    if (entry.auth_type === 'oauth' && ownOAuth[provider]?.includes(source))
+        return true;
+    return provider === 'openrouter' && entry.auth_type === 'api_key' && source === 'manual:openrouter_pkce';
+}
+/** Native own stores only; never accept a broad manual:* prefix. */
+export async function assertHermesOwnAccounts(home, signal) {
+    const material = await readHermesAccountMaterial(home, signal);
+    try {
+        await lstat(join(home, '.cliworker-managed'));
+        throw new Error('Hermes 插件账号不能使用额外的托管配置');
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    try {
+        await lstat(join(home, '.op.env'));
+        throw new Error('Hermes 请使用自身 .env，暂不支持外部密码库配置');
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    if (Object.values(material.env).some((value) => /^(?:op:\/\/|!|\$\{|__BITWARDEN_MANAGED__)/.test(value)))
+        throw new Error('Hermes 请使用自身 API 配置，暂不支持外部密码库引用');
+    if (material.config.auth?.adopt_external_logins !== false)
+        throw new Error('请先关闭 Hermes 的 auth.adopt_external_logins');
+    if (material.config.model?.openai_runtime === 'codex_app_server' ||
+        material.config.model?.api_mode === 'codex_app_server')
+        throw new Error('Hermes 当前使用外部 Codex 登录，请改用自身账号');
+    // Native dotenv has override=True. Selector assignments would invalidate the
+    // account source selected by the Host, even when no API-key value is inherited.
+    for (const [provider, entries] of Object.entries(material.auth.credential_pool ?? {})) {
+        if (!Array.isArray(entries))
+            throw new Error('Hermes 账号来源无法确认');
+        for (const entry of entries) {
+            if (!object(entry))
+                throw new Error('Hermes 账号来源无法确认');
+            if (!ownPoolSource(provider, entry, material))
+                throw new Error('Hermes 含外部账号来源，请使用自身登录');
+        }
+    }
+    return material;
+}
+/** Current selected-provider account scope. Unknown provider/auth schemas fail closed.
+ * Route precedence follows Hermes runtime_provider_backends / credential_pool;
+ * only the canonical OpenRouter route and native Codex OAuth store are supported
+ * without an explicit endpoint. Ambiguous mirrors/custom pools are not guessed. */
+export async function hermesAccountModels(home, provider, options = {}) {
+    try {
+        const currentMaterial = async () => {
+            const raw = await assertHermesOwnAccounts(home, options.signal);
+            return {
+                ...raw,
+                auth: projectHermesUnsuppressedAuth(raw.auth),
+                env: hermesUnsuppressedEnvironment(raw.auth, raw.env, provider),
+            };
+        };
+        const material = await currentMaterial();
+        const { config, auth, env } = material;
+        if (!object(config) || !object(config.model) || config.model.provider !== provider)
+            return unknown();
+        if (config.providers?.[provider]?.enabled === false)
+            return unknown();
+        const cfg = config.model;
+        if (!object(auth))
+            return unknown();
+        // Extra headers, command secrets, endpoint overrides and unknown pool routes
+        // cannot be reconstructed faithfully from a public model catalog.
+        if (cfg.extra_headers && Object.keys(cfg.extra_headers).length)
+            return unknown();
+        const inputs = [];
+        if (provider === 'nous') {
+            const source = selectHermesNousSource(material);
+            const generation = beginHermesNousCapabilities(home, source);
+            try {
+                const result = await fetchHermesNousModels(home, source, options, generation);
+                options.signal?.throwIfAborted();
+                const current = selectHermesNousSource(await currentMaterial());
+                // A query never authorizes a credential that appeared while it was in flight.
+                // Stable task bindings intentionally ignore ordinary token rotation separately.
+                if (current.agentKey !== source.agentKey ||
+                    JSON.stringify(current.principal) !== JSON.stringify(source.principal) ||
+                    JSON.stringify(current.route) !== JSON.stringify(source.route) ||
+                    JSON.stringify(current.modelCooldowns) !== JSON.stringify(source.modelCooldowns))
+                    throw new HermesNousError('Nous 账号已变化，请重新刷新模型');
+                return result;
+            }
+            catch (error) {
+                forgetHermesNousCapabilities(home, source, generation);
+                throw error;
+            }
+        }
+        else if (provider === 'openai-codex') {
+            // This transport authenticates via a separate Codex app-server session;
+            // Hermes' OAuth store cannot prove that other account's model scope.
+            if (cfg.openai_runtime === 'codex_app_server' || cfg.api_mode === 'codex_app_server')
+                return unknown();
+            if (env.HERMES_CODEX_BASE_URL &&
+                env.HERMES_CODEX_BASE_URL.replace(/\/+$/, '') !== 'https://chatgpt.com/backend-api')
+                return unknown();
+            if (cfg.base_url && cfg.base_url.replace(/\/+$/, '') !== 'https://chatgpt.com/backend-api')
+                return unknown();
+            const state = auth.providers?.[provider], tokens = state?.tokens;
+            if (state?.auth_mode !== 'chatgpt' || !literal(tokens?.access_token))
+                return unknown();
+            // Native load_pool seeds this exact singleton as device_code. Additional
+            // accounts require their own proven scope, so do not authorize them via it.
+            const pool = auth.credential_pool?.[provider] ?? [];
+            if (!Array.isArray(pool) ||
+                pool.some((entry) => !object(entry) ||
+                    entry.source !== 'device_code' ||
+                    entry.auth_type !== 'oauth' ||
+                    hermesPoolEntryUnavailable(entry, cfg.default) ||
+                    entry.access_token !== tokens.access_token ||
+                    (entry.base_url && entry.base_url.replace(/\/+$/, '') !== 'https://chatgpt.com/backend-api')))
+                return unknown();
+            let expiry = typeof tokens.expires_at === 'number' ? tokens.expires_at : Date.parse(tokens.expires_at);
+            if (!Number.isFinite(expiry)) {
+                // Hermes' native Codex store uses the access JWT exp claim.
+                try {
+                    expiry = JSON.parse(Buffer.from(tokens.access_token.split('.')[1] ?? '', 'base64url').toString()).exp;
+                }
+                catch {
+                    return unknown();
+                }
+            }
+            inputs.push({
+                provider,
+                credential: {
+                    type: 'oauth',
+                    access: tokens.access_token,
+                    expires: expiry < 1e12 ? expiry * 1000 : expiry,
+                    accountId: tokens.account_id,
+                },
+            });
+        }
+        else if (provider === 'openrouter') {
+            const canonical = 'https://openrouter.ai/api/v1';
+            if ([cfg.base_url, env.OPENROUTER_BASE_URL, env.CUSTOM_BASE_URL].some((url) => url && (typeof url !== 'string' || url.replace(/\/+$/, '') !== canonical)) ||
+                env.OPENAI_BASE_URL)
+                return unknown();
+            const pool = auth.credential_pool?.openrouter;
+            const keys = new Set();
+            const envNames = new Set(['OPENROUTER_API_KEY']);
+            for (const name of Object.keys(env))
+                if (/^OPENROUTER_API_KEY_\d+$/.test(name))
+                    envNames.add(name);
+            if (Array.isArray(pool) && pool.length) {
+                if (pool.length > 8)
+                    return unknown();
+                // Native pool selection may rotate. Every potential credential must support
+                // the choice. Do not expose exhausted/expired/unknown entries via another key.
+                for (const entry of pool) {
+                    if (!object(entry) ||
+                        entry.auth_type !== 'api_key' ||
+                        hermesPoolEntryUnavailable(entry, cfg.default) ||
+                        (entry.base_url && entry.base_url.replace(/\/+$/, '') !== canonical))
+                        return unknown();
+                    if (typeof entry.source === 'string' && entry.source.startsWith('env:')) {
+                        const name = entry.source.slice(4);
+                        if (!/^[A-Z][A-Z0-9_]*$/.test(name) || !literal(env[name]))
+                            return unknown();
+                        envNames.add(name);
+                        continue;
+                    }
+                    if (!ownPoolSource(provider, entry, { config, auth, env, sourceIds: [home] }))
+                        return unknown();
+                    const key = entry.runtime_api_key || entry.access_token;
+                    if (!literal(key))
+                        return unknown();
+                    keys.add(key);
+                }
+            }
+            // Native pool loader seeds numbered environment keys and rehydrates env:
+            // rows on each load. A saved token cannot override its current env source.
+            for (const name of envNames)
+                if (env[name]) {
+                    if (!literal(env[name]) || env[name].includes('${'))
+                        return unknown();
+                    keys.add(env[name]);
+                }
+            if (!keys.size || keys.size > 8)
+                return unknown();
+            for (const key of keys)
+                inputs.push({ provider, baseUrl: canonical, credential: { type: 'api', key } });
+        }
+        else {
+            // Do not fabricate endpoint/key mappings for arbitrary provider plugins.
+            return unknown();
+        }
+        const scopes = [];
+        const deadline = AbortSignal.timeout(15000);
+        const probeOptions = {
+            ...options,
+            signal: options.signal ? AbortSignal.any([options.signal, deadline]) : deadline,
+        };
+        for (const input of inputs) {
+            options.signal?.throwIfAborted();
+            const scope = await probeAccountModels(input, probeOptions);
+            options.signal?.throwIfAborted();
+            if (scope.state !== 'supported')
+                return scope;
+            scopes.push(scope);
+        }
+        if (!scopes.length)
+            return unknown();
+        return {
+            state: 'supported',
+            source: 'account-models',
+            models: scopes[0].models.flatMap((model) => {
+                const matches = scopes.map((scope) => scope.models.find((candidate) => candidate.id === model.id));
+                // Native setup selected this model; public/account catalogs may also contain
+                // embeddings or other endpoints that Hermes chat cannot execute.
+                if (model.id !== cfg.default || matches.some((match) => !match))
+                    return [];
+                const cost = matches.every((match) => match.cost === 'free')
+                    ? 'free'
+                    : matches.every((match) => match.cost === 'paid')
+                        ? 'paid'
+                        : 'unknown';
+                return [{ ...model, cost }];
+            }),
+        };
+    }
+    catch (error) {
+        options.signal?.throwIfAborted();
+        if (error instanceof HermesNousError)
+            throw error;
+        return unknown();
+    }
+}
+//# sourceMappingURL=hermes-models.js.map

package/lib/types/host/hermes-models.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hermes-models.js","sourceRoot":"","sources":["../../../src/host/hermes-models.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAA;AAC5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,EAAE,6BAA6B,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAA;AACtG,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,4BAA4B,EAC5B,eAAe,EACf,sBAAsB,GACvB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,kBAAkB,EAAkD,MAAM,sBAAsB,CAAA;AAEzG,MAAM,MAAM,GAAG,CAAC,KAAc,EAAgC,EAAE,CAC9D,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AACtE,MAAM,OAAO,GAAG,CAAC,KAAc,EAAmB,EAAE,CAClD,OAAO,KAAK,KAAK,QAAQ;IACzB,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE;IACd,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;IAC1B,CAAC,qDAAqD,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;AAC3E,MAAM,OAAO,GAAG,GAAsB,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;AAE9F;iFACiF;AACjF,MAAM,UAAU,0BAA0B,CAAC,KAA0B,EAAE,KAAc;IACnF,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IACxG,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;YAAE,OAAO,IAAI,CAAA;IACrF,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAA;IAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACpE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;AACvF,CAAC;AAED;mFACmF;AACnF,KAAK,UAAU,IAAI,CAAC,IAAY,EAAE,MAAoB;IACpD,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,IAAI,MAAM,CAAA;IACV,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;QAC3F,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;QAChC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;QACrG,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAA;QAC1C,IAAI,CAAC;YACH,IAAI,MAAM,GAAG,CAAC,CAAA;YACd,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC9B,MAAM,EAAE,cAAc,EAAE,CAAA;gBACxB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC,CAAA;gBACvF,IAAI,CAAC,SAAS;oBAAE,MAAK;gBACrB,MAAM,IAAI,SAAS,CAAA;YACrB,CAAC;YACD,IAAI,MAAM,GAAG,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YAC3D,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QACpD,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAM;QAC9D,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAClD,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,EAAE,KAAK,EAAE,CAAA;IACvB,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAA;AACxC,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAAY,EAAE,MAAoB;IAChF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAA;IAC9E,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IAClE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAA;IACtE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,CAAA;AACjD,CAAC;AAED;sFACsF;AACtF,SAAS,aAAa,CACpB,QAAgB,EAChB,KAA0B,EAC1B,QAA+D;IAE/D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC3B,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ,CAAC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACzG,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC5C,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5E,MAAM,QAAQ,GAA6B;QACzC,SAAS,EAAE,CAAC,oBAAoB,EAAE,aAAa,CAAC;QAChD,cAAc,EAAE,CAAC,oBAAoB,EAAE,sBAAsB,EAAE,aAAa,CAAC;QAC7E,WAAW,EAAE,CAAC,oBAAoB,EAAE,aAAa,CAAC;QAClD,eAAe,EAAE,CAAC,sBAAsB,EAAE,OAAO,CAAC;QAClD,IAAI,EAAE,CAAC,oBAAoB,EAAE,aAAa,CAAC;KAC5C,CAAA;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IACpF,OAAO,QAAQ,KAAK,YAAY,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,KAAK,wBAAwB,CAAA;AAC1G,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAY,EAAE,MAAoB;IAC9E,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC9D,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAA;QAC7C,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAA;IACrE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAA;QAClC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAA;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,2CAA2C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtG,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IACpD,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,qBAAqB,KAAK,KAAK;QACvD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IAC7D,IACE,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,cAAc,KAAK,kBAAkB;QAC5D,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,KAAK,kBAAkB;QAEtD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IACnD,6EAA6E;IAC7E,gFAAgF;IAChF,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;QACtF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC/D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;YACtD,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;QAC1F,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;mFAGmF;AACnF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,QAAgB,EAChB,UAA0D,EAAE;IAE5D,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,KAAK,IAAI,EAAE;YACjC,MAAM,GAAG,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;YAC/D,OAAO;gBACL,GAAG,GAAG;gBACN,IAAI,EAAE,6BAA6B,CAAC,GAAG,CAAC,IAAI,CAAC;gBAC7C,GAAG,EAAE,6BAA6B,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC;aAChE,CAAA;QACH,CAAC,CAAA;QACD,MAAM,QAAQ,GAAG,MAAM,eAAe,EAAE,CAAA;QACxC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAA;QACtC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,OAAO,EAAE,CAAA;QACpG,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,KAAK,KAAK;YAAE,OAAO,OAAO,EAAE,CAAA;QACrE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAA;QACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,OAAO,EAAE,CAAA;QACnC,6EAA6E;QAC7E,kEAAkE;QAClE,IAAI,GAAG,CAAC,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM;YAAE,OAAO,OAAO,EAAE,CAAA;QAChF,MAAM,MAAM,GAAwB,EAAE,CAAA;QACtC,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAA;YAC/C,MAAM,UAAU,GAAG,2BAA2B,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAC5D,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAA;gBAC7E,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;gBAChC,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,eAAe,EAAE,CAAC,CAAA;gBAC/D,8EAA8E;gBAC9E,gFAAgF;gBAChF,IACE,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;oBACpC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC;oBACtE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;oBAC9D,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC;oBAEhF,MAAM,IAAI,eAAe,CAAC,oBAAoB,CAAC,CAAA;gBACjD,OAAO,MAAM,CAAA;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;gBACtD,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YACvC,wEAAwE;YACxE,qEAAqE;YACrE,IAAI,GAAG,CAAC,cAAc,KAAK,kBAAkB,IAAI,GAAG,CAAC,QAAQ,KAAK,kBAAkB;gBAAE,OAAO,OAAO,EAAE,CAAA;YACtG,IACE,GAAG,CAAC,qBAAqB;gBACzB,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,iCAAiC;gBAEnF,OAAO,OAAO,EAAE,CAAA;YAClB,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,iCAAiC;gBACxF,OAAO,OAAO,EAAE,CAAA;YAClB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,EACtC,MAAM,GAAG,KAAK,EAAE,MAAM,CAAA;YACxB,IAAI,KAAK,EAAE,SAAS,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC;gBAAE,OAAO,OAAO,EAAE,CAAA;YACtF,yEAAyE;YACzE,4EAA4E;YAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;YACnD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBACpB,IAAI,CAAC,IAAI,CACP,CAAC,KAAU,EAAE,EAAE,CACb,CAAC,MAAM,CAAC,KAAK,CAAC;oBACd,KAAK,CAAC,MAAM,KAAK,aAAa;oBAC9B,KAAK,CAAC,SAAS,KAAK,OAAO;oBAC3B,0BAA0B,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC;oBAC9C,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;oBAC1C,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,iCAAiC,CAAC,CAC/F;gBAED,OAAO,OAAO,EAAE,CAAA;YAClB,IAAI,MAAM,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;YACtG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7B,4DAA4D;gBAC5D,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CACjB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAC7E,CAAC,GAAG,CAAA;gBACP,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,OAAO,EAAE,CAAA;gBAClB,CAAC;YACH,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ;gBACR,UAAU,EAAE;oBACV,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,MAAM,CAAC,YAAY;oBAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM;oBAC/C,SAAS,EAAE,MAAM,CAAC,UAAU;iBAC7B;aACF,CAAC,CAAA;QACJ,CAAC;aAAM,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,8BAA8B,CAAA;YAChD,IACE,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAC/D,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,SAAS,CAAC,CACnF;gBACD,GAAG,CAAC,eAAe;gBAEnB,OAAO,OAAO,EAAE,CAAA;YAClB,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,EAAE,UAAU,CAAA;YAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;YAC9B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAA;YAChD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAClG,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBACvC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,OAAO,EAAE,CAAA;gBACrC,4EAA4E;gBAC5E,+EAA+E;gBAC/E,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;oBACzB,IACE,CAAC,MAAM,CAAC,KAAK,CAAC;wBACd,KAAK,CAAC,SAAS,KAAK,SAAS;wBAC7B,0BAA0B,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC;wBAC9C,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,SAAS,CAAC;wBAEpE,OAAO,OAAO,EAAE,CAAA;oBAClB,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;wBACxE,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;wBAClC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;4BAAE,OAAO,OAAO,EAAE,CAAA;wBAC5E,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;wBAClB,SAAQ;oBACV,CAAC;oBACD,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;wBAAE,OAAO,OAAO,EAAE,CAAA;oBAC/F,MAAM,GAAG,GAAG,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,YAAY,CAAA;oBACvD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;wBAAE,OAAO,OAAO,EAAE,CAAA;oBACnC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACf,CAAC;YACH,CAAC;YACD,yEAAyE;YACzE,2EAA2E;YAC3E,KAAK,MAAM,IAAI,IAAI,QAAQ;gBACzB,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACd,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;wBAAE,OAAO,OAAO,EAAE,CAAA;oBACrE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;gBACrB,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC;gBAAE,OAAO,OAAO,EAAE,CAAA;YACjD,KAAK,MAAM,GAAG,IAAI,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;QACzG,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,OAAO,OAAO,EAAE,CAAA;QAClB,CAAC;QACD,MAAM,MAAM,GAAwB,EAAE,CAAA;QACtC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC3C,MAAM,YAAY,GAAG;YACnB,GAAG,OAAO;YACV,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ;SAChF,CAAA;QACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;YAChC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;YAC3D,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;YAChC,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW;gBAAE,OAAO,KAAK,CAAA;YAC7C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,OAAO,EAAE,CAAA;QACpC,OAAO;YACL,KAAK,EAAE,WAAW;YAClB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;gBAClG,6EAA6E;gBAC7E,iEAAiE;gBACjE,IAAI,KAAK,CAAC,EAAE,KAAK,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;oBAAE,OAAO,EAAE,CAAA;gBAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAM,CAAC,IAAI,KAAK,MAAM,CAAC;oBAC3D,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAM,CAAC,IAAI,KAAK,MAAM,CAAC;wBAChD,CAAC,CAAC,MAAM;wBACR,CAAC,CAAC,SAAS,CAAA;gBACf,OAAO,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YAC7B,CAAC,CAAC;SACH,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;QAChC,IAAI,KAAK,YAAY,eAAe;YAAE,MAAM,KAAK,CAAA;QACjD,OAAO,OAAO,EAAE,CAAA;IAClB,CAAC;AACH,CAAC"}

package/lib/types/host/hermes-native-entry.py

@@ -0,0 +1,61 @@
+"""Use a verified current native venv with a separate account home, without installing.
+
+The official launcher, checkout-derived install key and committed facts are checked by
+Host. Recheck facts under the same install lock, then use Hermes' own generation lease.
+No account/config content is copied, imported from another home, or printed here.
+"""
+import fcntl
+import json
+import os
+from pathlib import Path
+import stat
+import sys
+
+checkout, facts, environment = map(Path, sys.argv[1:4])
+arguments = sys.argv[4:]
+if any(path.resolve() != path for path in (checkout, facts, environment)):
+    raise SystemExit("Hermes installation changed; reopen login settings")
+
+def selected():
+    fd = os.open(facts, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)
+    with os.fdopen(fd) as stream:
+        info = os.fstat(stream.fileno())
+        if not stat.S_ISREG(info.st_mode) or info.st_nlink != 1 or info.st_size > 4 * 1024 * 1024:
+            raise RuntimeError("Invalid Hermes installation record")
+        return json.load(stream).get("packages", {}).get("venv", {}).get("environment") == str(environment)
+
+release = None
+try:
+    with open(facts.parent / ".install.lock", "a+b") as lock:
+        fcntl.flock(lock.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
+        if not selected():
+            raise RuntimeError("Hermes installation changed; reopen login settings")
+        sys.path.insert(0, str(checkout))
+        from hermes_cli.runtime_state import lease_generation
+        release = lease_generation(environment)
+    os.environ["HERMES_DISABLE_LAZY_INSTALLS"] = "1"
+    os.environ.pop("PYTHONHOME", None)
+    os.environ.pop("PYTHONPATH", None)
+    os.environ.pop("VIRTUAL_ENV", None)
+    sys.argv = [str(checkout / "hermes_cli/main.py"), *arguments]
+    # The native API exposes these boundaries, but main/run_agent pass the
+    # checkout's .env as a fallback. Pin its own home and disable that fallback
+    # and secret-manager hydration before either module imports the function.
+    # No parser or provider/login flow is replaced.
+    account_home = Path(os.environ["HERMES_HOME"])
+    if (account_home / ".cliworker-managed").exists() or (account_home / ".op.env").exists():
+        raise RuntimeError("Hermes plugin login cannot use additional account configuration layers")
+    from hermes_cli import env_loader
+    native_dotenv = env_loader.load_hermes_dotenv
+    def own_dotenv(**_options):
+        if (account_home / ".cliworker-managed").exists():
+            raise RuntimeError("Hermes plugin login cannot use an additional managed configuration")
+        if (account_home / ".op.env").exists():
+            raise RuntimeError("Hermes plugin login supports its own .env; external secret stores are unavailable")
+        return native_dotenv(hermes_home=account_home, project_env=None, load_external_secrets=False)
+    env_loader.load_hermes_dotenv = own_dotenv
+    from hermes_cli.main import main
+    raise SystemExit(main())
+finally:
+    if release is not None:
+        release()