dsh-cliworker-now 0.7.6 → 0.7.7

package/lib/types/host/hermes-installation.js

@@ -4,6 +4,7 @@ import { createHash } from 'node:crypto';
 import { dirname, join, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { nativeLaunchArgv } from './native-launch.mjs';
+import { windowsHermesCheckout } from "./hermes-windows-installation.js";
 export class HermesExecutableError extends Error {
 }
 export function hermesCommandInstallationHome(argv) {
@@ -16,15 +17,6 @@ export function hermesCommandInstallationHome(argv) {
  * the installer's borrowed-home sync. Older/self-contained entries retain their
  * native launcher contract. The child rechecks this selection under its native lock. */
 export async function hermesNativeCommand(executable, args, signal) {
-    // The official Windows distlib exe selects the recorded store Python itself.
-    // Its fixed fallback cmd is decoded as data, never interpreted by cmd.exe.
-    // Keep bootstrap and update/lease behavior owned by the installed CLI.
-    if (process.platform === 'win32') {
-        signal?.throwIfAborted();
-        const command = nativeLaunchArgv([executable, ...args]);
-        await access(command[0], constants.R_OK);
-        return command;
-    }
     let current = executable;
     const read = async (path, limit) => {
         const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
@@ -42,29 +34,7 @@ export async function hermesNativeCommand(executable, args, signal) {
             await file.close();
         }
     };
-    for (let depth = 0; depth < 4; depth++) {
-        signal?.throwIfAborted();
-        let path, source;
-        try {
-            path = await realpath(current);
-            source = await read(path, 128 * 1024);
-        }
-        catch (error) {
-            signal?.throwIfAborted();
-            if (error.code === 'ENOENT')
-                return [executable, ...args];
-            throw new HermesExecutableError('启动入口不可用，请修复安装');
-        }
-        const shim = /^#![^\r\n]*\b(?:sh|bash|zsh)\s*\r?\n\s*exec\s+(?:"(\/[^"\r\n$`]+)"|(\/[^\s$`"'\\;|&<>]+))\s+"\$@"\s*$/.exec(source);
-        if (shim) {
-            current = shim[1] ?? shim[2];
-            continue;
-        }
-        if (!path.endsWith(`${sep}.hermes${sep}bin${sep}hermes`) || !source.includes('hermes_bootstrap'))
-            return [executable, ...args];
-        const checkout = dirname(dirname(dirname(path)));
-        if (!source.includes(checkout))
-            throw new HermesExecutableError('Hermes 安装入口与源码不匹配');
+    const pinned = async (checkout) => {
         const owner = dirname(checkout), key = createHash('sha256').update(checkout).digest('hex').slice(0, 16);
         const install = join(owner, 'installs', key), facts = join(install, 'facts.json');
         try {
@@ -75,11 +45,17 @@ export async function hermesNativeCommand(executable, args, signal) {
                 (await realpath(environment)) !== environment)
                 throw new Error('Invalid Hermes dependency selection');
             await read(join(environment, 'pyvenv.cfg'), 64 * 1024);
-            await access(join(environment, 'bin/python'), constants.X_OK);
-            for (const file of ['hermes_bootstrap.py', 'hermes_cli/main.py', 'pm/environments.py'])
+            const python = join(environment, ...(process.platform === 'win32' ? ['Scripts', 'python.exe'] : ['bin', 'python']));
+            await access(python, process.platform === 'win32' ? constants.R_OK : constants.X_OK);
+            for (const file of [
+                'hermes_bootstrap.py',
+                'hermes_cli/main.py',
+                'pm/environments.py',
+                ...(process.platform === 'win32' ? ['pm/filesystem.py'] : []),
+            ])
                 await access(join(checkout, file), constants.R_OK);
             return [
-                join(environment, 'bin/python'),
+                python,
                 '-I',
                 fileURLToPath(new URL('./hermes-native-entry.py', import.meta.url)),
                 checkout,
@@ -92,6 +68,49 @@ export async function hermesNativeCommand(executable, args, signal) {
             signal?.throwIfAborted();
             throw new HermesExecutableError('Hermes 当前安装依赖不可用，请在原生终端修复安装');
         }
+    };
+    if (process.platform === 'win32') {
+        signal?.throwIfAborted();
+        try {
+            const command = nativeLaunchArgv([executable, ...args]);
+            await access(command[0], constants.R_OK);
+            const checkout = await windowsHermesCheckout(executable, command, signal);
+            // A native source-install launcher records its checkout. Pin that install's
+            // committed venv while retaining the isolated HERMES_HOME. Other native
+            // installations keep their own launch contract; never guess a generation.
+            return checkout ? await pinned(checkout) : command;
+        }
+        catch (error) {
+            signal?.throwIfAborted();
+            if (error instanceof HermesExecutableError)
+                throw error;
+            throw new HermesExecutableError('启动入口不可用，请修复安装');
+        }
+    }
+    for (let depth = 0; depth < 4; depth++) {
+        signal?.throwIfAborted();
+        let path, source;
+        try {
+            path = await realpath(current);
+            source = await read(path, 128 * 1024);
+        }
+        catch (error) {
+            signal?.throwIfAborted();
+            if (error.code === 'ENOENT')
+                return [executable, ...args];
+            throw new HermesExecutableError('启动入口不可用，请修复安装');
+        }
+        const shim = /^#![^\r\n]*\b(?:sh|bash|zsh)\s*\r?\n\s*exec\s+(?:"(\/[^"\r\n$`]+)"|(\/[^\s$`"'\\;|&<>]+))\s+"\$@"\s*$/.exec(source);
+        if (shim) {
+            current = shim[1] ?? shim[2];
+            continue;
+        }
+        if (!path.endsWith(`${sep}.hermes${sep}bin${sep}hermes`) || !source.includes('hermes_bootstrap'))
+            return [executable, ...args];
+        const checkout = dirname(dirname(dirname(path)));
+        if (!source.includes(checkout))
+            throw new HermesExecutableError('Hermes 安装入口与源码不匹配');
+        return pinned(checkout);
     }
     throw new HermesExecutableError('启动脚本异常，请修复安装');
 }

package/lib/types/host/hermes-installation.js.map

@@ -1 +1 @@
-{"version":3,"file":"hermes-installation.js","sourceRoot":"","sources":["../../../src/host/hermes-installation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD,MAAM,OAAO,qBAAsB,SAAQ,KAAK;CAAG;AAEnD,MAAM,UAAU,6BAA6B,CAAC,IAAc;IAC1D,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,IAAI,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QAC/F,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED;;;wFAGwF;AACxF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAAkB,EAClB,IAAc,EACd,MAAoB;IAEpB,6EAA6E;IAC7E,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,MAAM,OAAO,GAAG,gBAAgB,CAAC,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAAC,CAAA;QACvD,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;QACzC,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,IAAI,OAAO,GAAG,UAAU,CAAA;IACxB,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAE,KAAa,EAAE,EAAE;QACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;QAC/F,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;YAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK;gBACzD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;YACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YAC1C,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;YAC9F,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,OAAO,MAAM,CAAA;QACf,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;QACpB,CAAC;IACH,CAAC,CAAA;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,IAAI,IAAY,EAAE,MAAc,CAAA;QAChC,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;YAC9B,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC,CAAA;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAAA;YACpF,MAAM,IAAI,qBAAqB,CAAC,eAAe,CAAC,CAAA;QAClD,CAAC;QACD,MAAM,IAAI,GACR,uGAAuG,CAAC,IAAI,CAC1G,MAAM,CACP,CAAA;QACH,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAE,CAAA;YAC7B,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YAC9F,OAAO,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAAA;QAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAChD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,mBAAmB,CAAC,CAAA;QACpF,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,EAC7B,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACxE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,EAC1C,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,CAAA;YAC3D,MAAM,WAAW,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAA;YACrD,IACE,OAAO,WAAW,KAAK,QAAQ;gBAC/B,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,GAAG,GAAG,CAAC;gBAC5D,CAAC,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC,KAAK,WAAW;gBAE7C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;YACxD,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,CAAA;YACtD,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;YAC7D,KAAK,MAAM,IAAI,IAAI,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,oBAAoB,CAAC;gBACpF,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;YACpD,OAAO;gBACL,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC;gBAC/B,IAAI;gBACJ,aAAa,CAAC,IAAI,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACnE,QAAQ;gBACR,KAAK;gBACL,WAAW;gBACX,GAAG,IAAI;aACR,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,MAAM,IAAI,qBAAqB,CAAC,6BAA6B,CAAC,CAAA;QAChE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,qBAAqB,CAAC,cAAc,CAAC,CAAA;AACjD,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,UAAkB,EAAE,MAAmB;IAClF,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,gBAAgB,CAAC,CAAC,UAAU,CAAC,CAAC,CAAA;YAC9C,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;YACzC,IACE,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBACjD,IAAI,CAAC;oBACH,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAA;gBACrC,CAAC;wBAAS,CAAC;oBACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;gBACpB,CAAC;YACH,CAAC,CAAC,CAAC;gBAEH,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;YACzC,MAAM,CAAC,cAAc,EAAE,CAAA;YACvB,OAAM;QACR,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,cAAc,EAAE,CAAA;YACvB,MAAM,IAAI,qBAAqB,CAAC,eAAe,CAAC,CAAA;QAClD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,UAAU,CAAA;IACxB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,IAAI,IAAkD,CAAA;QACtD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;YACrC,gEAAgE;YAChE,IAAI,GAAG,MAAM,IAAI,CACf,MAAM,QAAQ,CAAC,OAAO,CAAC,EACvB,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CACjE,CAAA;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;YAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;YAC3D,IAAI,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI;gBAAE,OAAM;YACjC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,CAAA;YACzC,IAAI,MAAc,CAAA;YAClB,IAAI,CAAC;gBACH,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;gBAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;gBAC/B,IAAI,SAAS,KAAK,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;oBACvF,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;gBAC3D,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YACxD,CAAC;oBAAS,CAAC;gBACT,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACf,CAAC;YACD,MAAM,CAAC,cAAc,EAAE,CAAA;YACvB,MAAM,IAAI,GACR,uGAAuG,CAAC,IAAI,CAC1G,MAAM,CACP,CAAA;YACH,IAAI,CAAC,IAAI;gBAAE,OAAM;YACjB,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAE,CAAA;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,cAAc,EAAE,CAAA;YACvB,MAAM,IAAI,qBAAqB,CAAC,eAAe,CAAC,CAAA;QAClD,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,EAAE,KAAK,EAAE,CAAA;QACrB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,qBAAqB,CAAC,cAAc,CAAC,CAAA;AACjD,CAAC"}
+{"version":3,"file":"hermes-installation.js","sourceRoot":"","sources":["../../../src/host/hermes-installation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AAExE,MAAM,OAAO,qBAAsB,SAAQ,KAAK;CAAG;AAEnD,MAAM,UAAU,6BAA6B,CAAC,IAAc;IAC1D,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,IAAI,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QAC/F,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED;;;wFAGwF;AACxF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAAkB,EAClB,IAAc,EACd,MAAoB;IAEpB,IAAI,OAAO,GAAG,UAAU,CAAA;IACxB,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAE,KAAa,EAAE,EAAE;QACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;QAC/F,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;YAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK;gBACzD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;YACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YAC1C,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;YAC9F,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,OAAO,MAAM,CAAA;QACf,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;QACpB,CAAC;IACH,CAAC,CAAA;IACD,MAAM,MAAM,GAAG,KAAK,EAAE,QAAgB,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,EAC7B,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACxE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,EAC1C,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,CAAA;YAC3D,MAAM,WAAW,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAA;YACrD,IACE,OAAO,WAAW,KAAK,QAAQ;gBAC/B,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,GAAG,GAAG,CAAC;gBAC5D,CAAC,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC,KAAK,WAAW;gBAE7C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;YACxD,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,CAAA;YACtD,MAAM,MAAM,GAAG,IAAI,CACjB,WAAW,EACX,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAClF,CAAA;YACD,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YACpF,KAAK,MAAM,IAAI,IAAI;gBACjB,qBAAqB;gBACrB,oBAAoB;gBACpB,oBAAoB;gBACpB,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D;gBACC,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;YACpD,OAAO;gBACL,MAAM;gBACN,IAAI;gBACJ,aAAa,CAAC,IAAI,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACnE,QAAQ;gBACR,KAAK;gBACL,WAAW;gBACX,GAAG,IAAI;aACR,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,MAAM,IAAI,qBAAqB,CAAC,6BAA6B,CAAC,CAAA;QAChE,CAAC;IACH,CAAC,CAAA;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,gBAAgB,CAAC,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAAC,CAAA;YACvD,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;YACzC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;YACzE,4EAA4E;YAC5E,wEAAwE;YACxE,0EAA0E;YAC1E,OAAO,QAAQ,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,IAAI,KAAK,YAAY,qBAAqB;gBAAE,MAAM,KAAK,CAAA;YACvD,MAAM,IAAI,qBAAqB,CAAC,eAAe,CAAC,CAAA;QAClD,CAAC;IACH,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,IAAI,IAAY,EAAE,MAAc,CAAA;QAChC,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;YAC9B,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC,CAAA;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAAA;YACpF,MAAM,IAAI,qBAAqB,CAAC,eAAe,CAAC,CAAA;QAClD,CAAC;QACD,MAAM,IAAI,GACR,uGAAuG,CAAC,IAAI,CAC1G,MAAM,CACP,CAAA;QACH,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAE,CAAA;YAC7B,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YAC9F,OAAO,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAAA;QAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAChD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,mBAAmB,CAAC,CAAA;QACpF,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAA;IACzB,CAAC;IACD,MAAM,IAAI,qBAAqB,CAAC,cAAc,CAAC,CAAA;AACjD,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,UAAkB,EAAE,MAAmB;IAClF,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,gBAAgB,CAAC,CAAC,UAAU,CAAC,CAAC,CAAA;YAC9C,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;YACzC,IACE,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBACjD,IAAI,CAAC;oBACH,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAA;gBACrC,CAAC;wBAAS,CAAC;oBACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;gBACpB,CAAC;YACH,CAAC,CAAC,CAAC;gBAEH,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;YACzC,MAAM,CAAC,cAAc,EAAE,CAAA;YACvB,OAAM;QACR,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,cAAc,EAAE,CAAA;YACvB,MAAM,IAAI,qBAAqB,CAAC,eAAe,CAAC,CAAA;QAClD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,UAAU,CAAA;IACxB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,IAAI,IAAkD,CAAA;QACtD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;YACrC,gEAAgE;YAChE,IAAI,GAAG,MAAM,IAAI,CACf,MAAM,QAAQ,CAAC,OAAO,CAAC,EACvB,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CACjE,CAAA;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;YAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;YAC3D,IAAI,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI;gBAAE,OAAM;YACjC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,CAAA;YACzC,IAAI,MAAc,CAAA;YAClB,IAAI,CAAC;gBACH,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;gBAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;gBAC/B,IAAI,SAAS,KAAK,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;oBACvF,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;gBAC3D,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YACxD,CAAC;oBAAS,CAAC;gBACT,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACf,CAAC;YACD,MAAM,CAAC,cAAc,EAAE,CAAA;YACvB,MAAM,IAAI,GACR,uGAAuG,CAAC,IAAI,CAC1G,MAAM,CACP,CAAA;YACH,IAAI,CAAC,IAAI;gBAAE,OAAM;YACjB,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAE,CAAA;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,cAAc,EAAE,CAAA;YACvB,MAAM,IAAI,qBAAqB,CAAC,eAAe,CAAC,CAAA;QAClD,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,EAAE,KAAK,EAAE,CAAA;QACrB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,qBAAqB,CAAC,cAAc,CAAC,CAAA;AACjD,CAAC"}

package/lib/types/host/hermes-native-entry.py

@@ -4,35 +4,53 @@ The official launcher, checkout-derived install key and committed facts are chec
 Host. Recheck facts under the same install lock, then use Hermes' own generation lease.
 No account/config content is copied, imported from another home, or printed here.
 """
-import fcntl
 import json
 import os
 from pathlib import Path
+import contextlib
+import logging
+import runpy
 import stat
 import sys
 
 checkout, facts, environment = map(Path, sys.argv[1:4])
 arguments = sys.argv[4:]
-if any(path.resolve() != path for path in (checkout, facts, environment)):
-    raise SystemExit("Hermes installation changed; reopen login settings")
 
 def selected():
-    fd = os.open(facts, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)
-    with os.fdopen(fd) as stream:
+    if facts.is_symlink():
+        raise RuntimeError("Invalid Hermes installation record")
+    fd = os.open(facts, os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0) | getattr(os, "O_NONBLOCK", 0))
+    with os.fdopen(fd, encoding="utf-8-sig") as stream:
         info = os.fstat(stream.fileno())
         if not stat.S_ISREG(info.st_mode) or info.st_nlink != 1 or info.st_size > 4 * 1024 * 1024:
             raise RuntimeError("Invalid Hermes installation record")
         return json.load(stream).get("packages", {}).get("venv", {}).get("environment") == str(environment)
 
-release = None
-try:
+def run_entry():
+    release_holder = []
+    try:
+        return enter(release_holder)
+    finally:
+        for release in release_holder:
+            release()
+
+
+def enter(release_holder):
+    if any(path.resolve() != path for path in (checkout, facts, environment)):
+        raise RuntimeError("Hermes installation changed; reopen login settings")
+    sys.path.insert(0, str(checkout))
     with open(facts.parent / ".install.lock", "a+b") as lock:
-        fcntl.flock(lock.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
+        if os.name == "nt":
+            from pm.filesystem import lock_fd
+            if not lock_fd(lock.fileno(), wait=False):
+                raise RuntimeError("Hermes installation is being updated; retry after it finishes")
+        else:
+            import fcntl
+            fcntl.flock(lock.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
         if not selected():
             raise RuntimeError("Hermes installation changed; reopen login settings")
-        sys.path.insert(0, str(checkout))
         from hermes_cli.runtime_state import lease_generation
-        release = lease_generation(environment)
+        release_holder.append(lease_generation(environment))
     os.environ["HERMES_DISABLE_LAZY_INSTALLS"] = "1"
     os.environ.pop("PYTHONHOME", None)
     os.environ.pop("PYTHONPATH", None)
@@ -54,8 +72,25 @@ try:
             raise RuntimeError("Hermes plugin login supports its own .env; external secret stores are unavailable")
         return native_dotenv(hermes_home=account_home, project_env=None, load_external_secrets=False)
     env_loader.load_hermes_dotenv = own_dotenv
+    if arguments and arguments[0].startswith("--cliworker-"):
+        if len(arguments) != 2 or arguments[0] != "--cliworker-nous-refresh":
+            return "unsupported"
+        own_dotenv()
+        operation = runpy.run_path(str(Path(__file__).with_name("hermes-nous-refresh.py")))
+        return operation["refresh_selected_nous"](account_home, arguments[1])
     from hermes_cli.main import main
     raise SystemExit(main())
-finally:
-    if release is not None:
-        release()
+
+
+if arguments and arguments[0].startswith("--cliworker-"):
+    # Fixed private operation has no native diagnostic/credential output. Keep
+    # SystemExit/KeyboardInterrupt semantics; ordinary failures are classified.
+    with open(os.devnull, "w") as quiet, contextlib.redirect_stdout(quiet), contextlib.redirect_stderr(quiet):
+        logging.disable(logging.CRITICAL)
+        try:
+            result = run_entry()
+        except Exception:
+            result = "unavailable"
+    print(json.dumps({"version": 1, "state": result}, separators=(",", ":")))
+else:
+    run_entry()

package/lib/types/host/hermes-nous-refresh.py

@@ -0,0 +1,331 @@
+"""One bounded, same-account Nous renewal inside the verified native environment.
+
+This module is loaded only by our fixed native-entry operation. Native OAuth
+owns token exchange and atomic persistence. No resolver, pool selection, login,
+anonymous identity, browser, model request or credential output is permitted.
+"""
+import base64
+import contextlib
+import hashlib
+import inspect
+import json
+import logging
+import math
+import os
+from pathlib import Path
+import re
+import signal
+import stat
+import time
+
+PORTAL = "https://portal.nousresearch.com"
+INFERENCE = "https://inference-api.nousresearch.com/v1"
+CLIENT = "hermes-cli"
+MAX_FILE = 4 * 1024 * 1024
+TOKEN_FIELDS = (
+    "access_token", "refresh_token", "token_type", "scope", "client_id",
+    "portal_base_url", "inference_base_url", "obtained_at", "expires_at", "expires_in",
+    "agent_key", "agent_key_id", "agent_key_expires_at", "agent_key_expires_in",
+    "agent_key_reused", "agent_key_obtained_at", "tls",
+)
+TERMINAL = {"invalid_grant", "invalid_token", "refresh_token_reused", "nous_auth_missing_refresh_token"}
+
+
+class Refusal(Exception):
+    def __init__(self, state="changed"):
+        self.state = state
+
+
+def text(value):
+    return isinstance(value, str) and 0 < len(value) <= 32768 and not re.search(r"[\x00-\x20\x7f]", value)
+
+
+def canonical(value, expected):
+    return isinstance(value, str) and value.rstrip("/") == expected
+
+
+def claims(token):
+    if not text(token) or not re.fullmatch(r"[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+", token):
+        raise Refusal()
+    raw = token.split(".")[1]
+    value = json.loads(base64.urlsafe_b64decode(raw + "=" * (-len(raw) % 4)))
+    if not isinstance(value, dict):
+        raise Refusal()
+    return value
+
+
+def scope_values(value):
+    if isinstance(value, str):
+        return re.split(r"[\s,]+", value)
+    if isinstance(value, list):
+        return [part for item in value for part in scope_values(item)]
+    return []
+
+
+def identity(state):
+    if not isinstance(state, dict) or state.get("auth_method") == "anonymous" or state.get("account_tier") == "anonymous":
+        raise Refusal()
+    token = claims(state.get("access_token"))
+    if token.get("account_tier") == "anonymous" or any(not text(token.get(key)) for key in ("sub", "org_id", "iss")):
+        raise Refusal()
+    client = token.get("client_id", "")
+    if client is None:
+        client = ""
+    if client != "" and not text(client):
+        raise Refusal()
+    expiry = token.get("exp")
+    if isinstance(expiry, bool) or not isinstance(expiry, (int, float)) or not math.isfinite(expiry):
+        raise Refusal()
+    if "inference:invoke" not in (scope_values(state.get("scope")) + scope_values(token.get("scope")) + scope_values(token.get("scp"))):
+        raise Refusal()
+    if not canonical(state.get("portal_base_url"), PORTAL) or not canonical(state.get("inference_base_url"), INFERENCE):
+        raise Refusal()
+    native_client = state.get("client_id") or CLIENT
+    if not text(native_client):
+        raise Refusal()
+    key = ["hermes-nous-v1", token["sub"], token["org_id"], token["iss"], client, PORTAL, INFERENCE]
+    digest = hashlib.sha256(json.dumps(key, ensure_ascii=False, separators=(",", ":")).encode("utf-8")).hexdigest()
+    return digest, native_client, float(expiry)
+
+
+def regular_file(path, *, optional=False):
+    try:
+        info = path.lstat()
+    except FileNotFoundError:
+        if optional:
+            return False
+        raise Refusal("unavailable")
+    if not stat.S_ISREG(info.st_mode) or info.st_nlink != 1 or info.st_size > MAX_FILE:
+        raise Refusal()
+    return True
+
+
+def read_json(path):
+    value = json.loads(read_private_text(path))
+    if not isinstance(value, dict):
+        raise Refusal()
+    return value
+
+
+def read_private_text(path):
+    regular_file(path)
+    fd = os.open(path, os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0) | getattr(os, "O_NONBLOCK", 0))
+    with os.fdopen(fd, "rb") as stream:
+        opened = os.fstat(stream.fileno())
+        current = path.lstat()
+        if (not stat.S_ISREG(opened.st_mode) or opened.st_nlink != 1 or opened.st_size > MAX_FILE
+                or stat.S_ISLNK(current.st_mode) or (opened.st_dev, opened.st_ino) != (current.st_dev, current.st_ino)):
+            raise Refusal()
+        data = stream.read(MAX_FILE + 1)
+        if len(data) > MAX_FILE:
+            raise Refusal()
+        return data.decode("utf-8-sig")
+
+
+def check_configuration(home):
+    # The native entry has already loaded only this home's dotenv. Do not import
+    # main/config resolution, which can consult profiles or external sources.
+    import hermes_yaml as yaml
+    config_path = home / "config.yaml"
+    config = yaml.safe_load(read_private_text(config_path))
+    if not isinstance(config, dict) or not isinstance(config.get("model"), dict):
+        raise Refusal()
+    if (config.get("auth") or {}).get("adopt_external_logins") is not False:
+        raise Refusal()
+    model = config["model"]
+    if model.get("provider") != "nous" or (config.get("providers") or {}).get("nous", {}).get("enabled") is False:
+        raise Refusal()
+    if model.get("api_key") or model.get("extra_headers") or any(os.environ.get(k) for k in ("NOUS_API_KEY", "CUSTOM_API_KEY")):
+        raise Refusal()
+    if any(re.fullmatch(r"NOUS_API_KEY_\d+", k) and v for k, v in os.environ.items()):
+        raise Refusal()
+    for value in (model.get("base_url"), os.environ.get("NOUS_INFERENCE_BASE_URL"), os.environ.get("CUSTOM_BASE_URL")):
+        if value and not canonical(value, INFERENCE):
+            raise Refusal()
+    for name in ("NOUS_PORTAL_BASE_URL", "HERMES_PORTAL_BASE_URL"):
+        if os.environ.get(name) and not canonical(os.environ[name], PORTAL):
+            raise Refusal()
+    if model.get("api_mode") not in (None, "chat_completions", "anthropic_messages"):
+        raise Refusal()
+    if (config.get("nous") or {}).get("anthropic_wire", "chat") not in ("chat", "native", "auto"):
+        raise Refusal()
+
+
+def check_available(row):
+    if row.get("disabled") is True or row.get("status") == "exhausted" or row.get("last_status") == "dead":
+        raise Refusal("unavailable")
+    if row.get("last_status") == "exhausted":
+        until = row.get("last_error_reset_at")
+        if not isinstance(until, (int, float)) or isinstance(until, bool) or not math.isfinite(until) or until <= 0 or until > time.time():
+            raise Refusal("unavailable")
+    cooldowns = row.get("model_cooldowns", {})
+    if not isinstance(cooldowns, dict) or any(
+        isinstance(until, (int, float)) and not isinstance(until, bool) and until > time.time()
+        for until in cooldowns.values()
+    ):
+        raise Refusal("unavailable")
+
+
+def checked_pool(store, state, expected):
+    if store.get("active_provider") != "nous" or state.get("agent_key") != state.get("access_token"):
+        raise Refusal()
+    if state.get("last_auth_error", {}).get("relogin_required") is True and not (state.get("access_token") or state.get("refresh_token")):
+        raise Refusal("relogin")
+    check_available(state)
+    rows = store.get("credential_pool", {}).get("nous")
+    if not isinstance(rows, list) or not 1 <= len(rows) <= 8:
+        raise Refusal()
+    for row in rows:
+        if not isinstance(row, dict) or row.get("auth_type") != "oauth" or row.get("source") not in ("device_code", "manual:device_code"):
+            raise Refusal()
+        if row.get("access_token") != state.get("access_token") or row.get("agent_key") != state.get("agent_key"):
+            raise Refusal()
+        if row.get("refresh_token") not in (None, state.get("refresh_token")):
+            raise Refusal()
+        for field, endpoint in (("portal_base_url", PORTAL), ("inference_base_url", INFERENCE), ("base_url", INFERENCE)):
+            if row.get(field) and not canonical(row[field], endpoint):
+                raise Refusal()
+        if (row.get("client_id") or CLIENT) != expected[1]:
+            raise Refusal()
+        check_available(row)
+    return rows
+
+
+def checked_shared(shared, expected):
+    if shared.get("_schema") != 1 or not text(shared.get("refresh_token")):
+        raise Refusal()
+    found = identity(shared)
+    if found[:2] != expected[:2]:
+        raise Refusal()
+    return found
+
+
+def _run(home, expected_digest, cancelled):
+    if not re.fullmatch(r"[a-f0-9]{64}", expected_digest or ""):
+        raise Refusal("unsupported")
+    from hermes_cli import auth
+    from hermes_constants import get_default_hermes_root
+    required = ("_provider_state_transaction", "_auth_file_path", "_nous_shared_store_path", "_nous_shared_store_lock",
+                "_save_provider_state_to_source", "_write_shared_nous_state", "_select_nous_invoke_jwt", "refresh_nous_oauth_from_state")
+    if any(not callable(getattr(auth, key, None)) for key in required):
+        raise Refusal("unsupported")
+    if "on_state_update" not in inspect.signature(auth.refresh_nous_oauth_from_state).parameters:
+        raise Refusal("unsupported")
+    home = Path(home)
+    if home != home.resolve() or not home.is_dir() or get_default_hermes_root().resolve() != home:
+        raise Refusal()
+    auth_path = home / "auth.json"
+    shared_path = auth._nous_shared_store_path()
+    if auth._auth_file_path().resolve() != auth_path or shared_path.parent != home / "shared" or shared_path.resolve() != shared_path:
+        raise Refusal()
+    if (home / "shared").exists() and not (home / "shared").is_dir():
+        raise Refusal()
+    check_configuration(home)
+    raw_ttl = os.environ.get("HERMES_NOUS_MIN_KEY_TTL_SECONDS", "120")
+    if not re.fullmatch(r"\d+", raw_ttl) or len(raw_ttl) > 9:
+        raise Refusal()
+    ttl = max(120, int(raw_ttl))
+    # Native cross-process ordering: auth first, shared second. No profile/global
+    # fallback or shared merge is allowed without the exact selected identity.
+    # Confirm the local provider exists before the native transaction can even
+    # consult a global fallback. Re-read under its lock to bind the snapshot.
+    if not isinstance(read_json(auth_path).get("providers", {}).get("nous"), dict):
+        raise Refusal()
+    with auth._provider_state_transaction("nous", timeout_seconds=1.0) as (store, state, source):
+        snapshot = read_json(auth_path)
+        if source is None or Path(source).resolve() != auth_path or not isinstance(store.get("providers", {}).get("nous"), dict):
+            raise Refusal()
+        if snapshot.get("providers", {}).get("nous") != state or snapshot.get("credential_pool") != store.get("credential_pool"):
+            raise Refusal()
+        check_configuration(home)
+        expected = identity(state)
+        if expected[0] != expected_digest:
+            raise Refusal()
+        rows = checked_pool(store, state, expected)
+        if cancelled[0]:
+            raise Refusal("unavailable")
+        with auth._nous_shared_store_lock(timeout_seconds=1.0):
+            shared = read_json(shared_path) if regular_file(shared_path, optional=True) else None
+            if shared is not None:
+                shared_identity = checked_shared(shared, expected)
+                different_pair = (shared.get("access_token"), shared.get("refresh_token")) != (state.get("access_token"), state.get("refresh_token"))
+                if different_pair and shared_identity[2] == expected[2]:
+                    raise Refusal()
+            else:
+                shared_identity, different_pair = None, False
+
+            def persist(update, _reason=None):
+                nonlocal state
+                merged = {**state, **{key: update[key] for key in TOKEN_FIELDS if key in update}}
+                if identity(merged)[:2] != expected[:2]:
+                    raise Refusal()
+                # Select only this already identity-checked invoke JWT. This has
+                # no network/I/O and keeps pool aliases consistent even if the
+                # pure refresher's later validation fails after token rotation.
+                auth._select_nous_invoke_jwt(merged)
+                if merged.get("agent_key") != merged.get("access_token"):
+                    raise Refusal("unsupported")
+                for row in rows:
+                    for key in TOKEN_FIELDS:
+                        if key in merged:
+                            row[key] = merged[key]
+                auth._save_provider_state_to_source(store, "nous", merged, source)
+                state = merged
+                # Native mirror is best-effort, so verify the saved pair before
+                # reporting ready. No outside-home store is ever touched.
+                auth._write_shared_nous_state(state)
+                saved = read_json(shared_path)
+                if checked_shared(saved, expected)[:2] != expected[:2] or any(saved.get(k) != state.get(k) for k in ("access_token", "refresh_token")):
+                    raise Refusal("unavailable")
+
+            # A newer peer rotation for this exact principal/client/route may
+            # be adopted. Equal-expiry differing tokens are not a proven chain.
+            if different_pair and shared_identity[2] > expected[2]:
+                persist(shared)
+            elif different_pair:
+                # The selected store is provably newer. Repair this same-home,
+                # same-principal mirror before a native resolver can adopt its
+                # older single-use refresh token back into the selected store.
+                persist(state)
+            current = identity(state)
+            if current[2] > time.time() + ttl:
+                return "ready"
+            if not text(state.get("refresh_token")):
+                raise Refusal("relogin")
+            if cancelled[0]:
+                raise Refusal("unavailable")
+            refreshed = auth.refresh_nous_oauth_from_state(
+                state, timeout_seconds=4.0, force_refresh=True, on_state_update=persist)
+            persist(refreshed)
+            if identity(state)[2] <= time.time() + 120:
+                raise Refusal("unavailable")
+            return "unavailable" if cancelled[0] else "ready"
+
+
+def refresh_selected_nous(home, expected_digest):
+    """Fixed safe receipt only. Exceptions and logs never cross the boundary."""
+    cancelled = [False]
+    handlers = {}
+    def on_cancel(_signal, _frame):
+        # Do not interrupt a successful single-use token exchange before its
+        # callback saves the rotation. Host must also await this bounded child
+        # on Windows, where Job termination cannot be deferred by Python.
+        cancelled[0] = True
+    for number in (signal.SIGTERM, signal.SIGINT):
+        handlers[number] = signal.signal(number, on_cancel)
+    old_disable = logging.root.manager.disable
+    try:
+        with open(os.devnull, "w") as quiet, contextlib.redirect_stdout(quiet), contextlib.redirect_stderr(quiet):
+            logging.disable(logging.CRITICAL)
+            try:
+                return _run(home, expected_digest, cancelled)
+            except Refusal as error:
+                return error.state
+            except Exception as error:
+                if getattr(error, "code", None) in TERMINAL and bool(getattr(error, "relogin_required", False)):
+                    return "relogin"
+                return "unavailable"
+    finally:
+        logging.disable(old_disable)
+        for number, handler in handlers.items():
+            signal.signal(number, handler)

package/lib/types/host/hermes-nous.d.ts

@@ -28,7 +28,9 @@ export interface HermesNousSource {
 }
 /** Hermes 6c80c327: flat providers.nous, native device-code pool and invoke JWT.
  * No refresh-only, guest, fallback store or different pooled principal is promoted. */
-export declare function projectHermesNousSource(auth: any, minTtlSeconds?: number): HermesNousSource;
+export declare function projectHermesNousSource(auth: any, minTtlSeconds?: number, options?: {
+    allowExpired?: boolean;
+}): HermesNousSource;
 export declare function hermesNousMinimumTtl(env: Record<string, string>): number;
 /** Runtime uses its supported MIN_KEY_TTL override (120s), matching the native
  * invoke-JWT skew. The native default 1800s is a proactive-refresh optimization,
@@ -37,6 +39,8 @@ export declare function selectHermesNousSource(material: {
     config: any;
     auth: any;
     env: Record<string, string>;
+}, options?: {
+    allowExpired?: boolean;
 }): HermesNousSource;
 export declare function hermesNousEfforts(home: string, source: HermesNousSource, model: string): Effort[];
 export declare function beginHermesNousCapabilities(home: string, source: HermesNousSource): symbol;

package/lib/types/host/hermes-nous.js

@@ -45,13 +45,13 @@ function unavailable(row) {
 }
 /** Hermes 6c80c327: flat providers.nous, native device-code pool and invoke JWT.
  * No refresh-only, guest, fallback store or different pooled principal is promoted. */
-export function projectHermesNousSource(auth, minTtlSeconds = 0) {
+export function projectHermesNousSource(auth, minTtlSeconds = 0, options = {}) {
     const state = auth?.providers?.nous;
     if (!object(state) ||
         auth.active_provider !== 'nous' ||
         state.auth_method === 'anonymous' ||
         state.account_tier === 'anonymous' ||
-        state.last_auth_error?.relogin_required === true ||
+        (state.last_auth_error?.relogin_required === true && !state.access_token && !state.refresh_token) ||
         unavailable(state))
         invalid();
     const access = state.access_token, agentKey = state.agent_key;
@@ -67,7 +67,7 @@ export function projectHermesNousSource(auth, minTtlSeconds = 0) {
         !Number.isFinite(token.exp) ||
         ![...scopes(state.scope), ...scopes(token.scope), ...scopes(token.scp)].includes('inference:invoke'))
         invalid();
-    if (token.exp * 1000 <= Date.now() + minTtlSeconds * 1000)
+    if (!options.allowExpired && token.exp * 1000 <= Date.now() + minTtlSeconds * 1000)
         throw new HermesNousError('Nous 登录即将过期或已过期，请在 Hermes 登录设置中重新登录');
     if (!canonical(state.portal_base_url, NOUS_PORTAL) || !canonical(state.inference_base_url, NOUS_INFERENCE))
         throw new HermesNousError('Nous 当前路由暂不支持账号模型查询');
@@ -111,7 +111,7 @@ export function hermesNousMinimumTtl(env) {
 /** Runtime uses its supported MIN_KEY_TTL override (120s), matching the native
  * invoke-JWT skew. The native default 1800s is a proactive-refresh optimization,
  * not invalid-account evidence. An explicit own-home setting still takes precedence. */
-export function selectHermesNousSource(material) {
+export function selectHermesNousSource(material, options = {}) {
     const { config, auth, env } = material;
     const cfg = config.model;
     if (!object(cfg) || cfg.provider !== 'nous' || config.providers?.nous?.enabled === false)
@@ -127,7 +127,7 @@ export function selectHermesNousSource(material) {
         [env.NOUS_PORTAL_BASE_URL, env.HERMES_PORTAL_BASE_URL].some((url) => url && !canonical(url, NOUS_PORTAL)) ||
         (cfg.api_mode && !['chat_completions', 'anthropic_messages'].includes(cfg.api_mode)))
         throw new HermesNousError('Nous 当前路由暂不支持账号模型查询');
-    const source = projectHermesNousSource(auth, hermesNousMinimumTtl(env));
+    const source = projectHermesNousSource(auth, hermesNousMinimumTtl(env), options);
     const wire = config.nous?.anthropic_wire ?? 'chat';
     if (!['chat', 'native', 'auto'].includes(wire))
         throw new HermesNousError('Nous 当前路由暂不支持账号模型查询');