herm-tui 1.0.0-dev.1

package/src/utils/hermes-kanban.ts

@@ -0,0 +1,154 @@
+// Window onto the shared ~/.hermes/kanban.db.
+//
+// Kanban is deliberately profile-agnostic (the board IS the
+// coordination primitive between profiles), so this reads the
+// HERMES_HOME-relative path and shows every tenant's tasks.
+//
+// Reads are sidecar SQLite (WAL lets us read alongside the
+// dispatcher's IMMEDIATE write txns). Writes route through
+// `shell.exec → hermes kanban <verb>` so upstream kanban_db.py owns
+// the state machine: recompute_ready, cycle detection, event log,
+// notify subscriptions. herm is the operator surface for that CLI —
+// create/assign/comment/unblock/archive/dispatch — not a competing
+// implementation.
+
+import { Database } from "bun:sqlite"
+import { existsSync, readdirSync, statSync, openSync, readSync, closeSync } from "node:fs"
+import { hermesPath } from "./hermes-home"
+
+export const STATUSES = ["triage", "todo", "ready", "running", "blocked", "done"] as const
+export type Status = typeof STATUSES[number]
+
+export type Task = {
+  id: string; title: string; body: string | null
+  assignee: string | null; status: Status; priority: number
+  created_at: number; updated_at: number; completed_at: number | null
+  result: string | null; error: string | null
+  tenant: string | null; pid: number | null
+}
+
+export type Detail = Task & {
+  parents: string[]; children: string[]
+  comments: Array<{ author: string; body: string; at: number }>
+}
+
+let ro: Database | null | undefined
+const db = (): Database | null => {
+  if (ro !== undefined) return ro
+  try { ro = new Database(hermesPath("kanban.db"), { readonly: true }) }
+  catch { ro = null }
+  return ro
+}
+export const resetKanban = () => { ro?.close(); ro = undefined }
+
+// completed_at / started_at / created_at → updated_at proxy. The
+// tasks table has no updated_at; newest-of-the-three is close enough
+// for sort-by-recency without joining task_events on every list.
+const AT = "COALESCE(completed_at, started_at, created_at)"
+
+const toTask = (r: Record<string, unknown>): Task => ({
+  id: String(r.id), title: String(r.title ?? ""),
+  body: (r.body as string) ?? null,
+  assignee: (r.assignee as string) ?? null,
+  status: (r.status as Status) ?? "todo",
+  priority: Number(r.priority) || 0,
+  created_at: Number(r.created_at) || 0,
+  updated_at: Number(r.updated_at) || 0,
+  completed_at: (r.completed_at as number) ?? null,
+  result: (r.result as string) ?? null,
+  error: (r.last_spawn_error as string) ?? null,
+  tenant: (r.tenant as string) ?? null,
+  pid: (r.worker_pid as number) ?? null,
+})
+
+/** All non-archived tasks, grouped by status column. Each column
+ *  sorted by (priority desc, updated_at desc) so the dispatcher's
+ *  pick-next ordering roughly matches the top of `ready`. */
+export function board(): Map<Status, Task[]> {
+  const out = new Map<Status, Task[]>(STATUSES.map(s => [s, []]))
+  const conn = db()
+  if (!conn) return out
+  try {
+    const rows = conn.query(
+      `SELECT id, title, body, assignee, status, priority, tenant,
+              created_at, completed_at, result, last_spawn_error, worker_pid,
+              ${AT} AS updated_at
+       FROM tasks WHERE status != 'archived'
+       ORDER BY priority DESC, updated_at DESC`,
+    ).all() as Array<Record<string, unknown>>
+    for (const r of rows) {
+      const t = toTask(r)
+      out.get(t.status)?.push(t)
+    }
+  } catch {}
+  return out
+}
+
+export function detail(id: string): Detail | null {
+  const conn = db()
+  if (!conn) return null
+  try {
+    const row = conn.query(
+      `SELECT *, ${AT} AS updated_at FROM tasks WHERE id = ?`,
+    ).get(id) as Record<string, unknown> | null
+    if (!row) return null
+    const parents = (conn.query(
+      "SELECT parent_id FROM task_links WHERE child_id = ?",
+    ).all(id) as Array<{ parent_id: string }>).map(r => r.parent_id)
+    const children = (conn.query(
+      "SELECT child_id FROM task_links WHERE parent_id = ?",
+    ).all(id) as Array<{ child_id: string }>).map(r => r.child_id)
+    const comments = (conn.query(
+      "SELECT author, body, created_at FROM task_comments WHERE task_id = ? ORDER BY created_at",
+    ).all(id) as Array<{ author: string; body: string; created_at: number }>)
+      .map(c => ({ author: c.author, body: c.body, at: c.created_at }))
+    return { ...toTask(row), parents, children, comments }
+  } catch { return null }
+}
+
+/** Candidate assignee names for the picker — union of profiles-on-disk
+ *  and any assignee already referenced on the board (a task can be
+ *  assigned to a profile that no longer exists; still show it so the
+ *  operator can reassign *away* from it). `(unassigned)` is prepended
+ *  at the call site. */
+export function assignees(): string[] {
+  const seen = new Set<string>()
+  const dir = hermesPath("profiles")
+  if (existsSync(dir))
+    for (const e of readdirSync(dir, { withFileTypes: true }))
+      if (e.isDirectory()) seen.add(e.name)
+  const conn = db()
+  if (conn) try {
+    for (const r of conn.query(
+      "SELECT DISTINCT assignee FROM tasks WHERE assignee IS NOT NULL AND status != 'archived'",
+    ).all() as Array<{ assignee: string }>) seen.add(r.assignee)
+  } catch {}
+  return [...seen].sort()
+}
+
+/** Tail of the worker log at ~/.hermes/kanban/logs/<id>.log. Mirrors
+ *  kanban_db.read_worker_log's seek-from-end + skip-partial-line. */
+export function tailLog(id: string, bytes = 16_384): string | null {
+  const path = hermesPath(`kanban/logs/${id}.log`)
+  if (!existsSync(path)) return null
+  try {
+    const size = statSync(path).size
+    const want = Math.min(size, bytes)
+    const fd = openSync(path, "r")
+    const buf = Buffer.alloc(want)
+    readSync(fd, buf, 0, want, size - want)
+    closeSync(fd)
+    let out = buf.toString("utf-8")
+    if (size > bytes) {
+      const nl = out.indexOf("\n")
+      if (nl >= 0 && nl < out.length - 1) out = out.slice(nl + 1)
+    }
+    return out
+  } catch { return null }
+}
+
+/** POSIX single-quote for shell.exec argv building. Wraps only when
+ *  the string contains shell metacharacters (keeps test assertions
+ *  and toast messages readable for plain ids). */
+export const q = (s: string): string =>
+  /^[A-Za-z0-9._\/:+=-]+$/.test(s) ? s : `'${s.replace(/'/g, `'\\''`)}'`

package/src/utils/hermes-profiles.ts

@@ -0,0 +1,217 @@
+// Profile discovery — direct filesystem reads, no gateway RPC needed.
+//
+// Profiles are inherently local: each is an isolated HERMES_HOME
+// directory under `<root>/profiles/<name>/`, where <root> is the
+// *default* hermes home (`~/.hermes` in the common case, even when
+// herm itself is running under a named profile).
+//
+// `is_active` is NOT a property of a profile on disk — it depends on
+// which HERMES_HOME the *gateway* was launched under, which may differ
+// from herm's own process env. Callers pass the gateway-reported home
+// (from `config.get key=profile`) and this module compares paths.
+//
+// All write ops (create/delete/rename/export/use) route through
+// `shell.exec → hermes profile <verb>` in src/tabs/Agents.tsx so the
+// authoritative CLI owns validation, skill seeding, wrapper aliases
+// and gateway cleanup.
+
+import { existsSync, readFileSync } from "node:fs"
+import { readdir } from "node:fs/promises"
+import { homedir } from "node:os"
+import { join, basename, dirname } from "node:path"
+import { Database } from "bun:sqlite"
+import type { Source } from "./hermes-home"
+
+export type ProfileInfo = {
+  name: string
+  path: string
+  is_default: boolean
+  is_active: boolean
+  is_sticky: boolean
+  gateway_running: boolean
+  model: string | null
+  provider: string | null
+  has_env: boolean
+  skill_count: number
+  has_alias: boolean
+  soul_preview: string
+  sources: {
+    dir: Source
+    config: Source
+    soul: Source
+    env: Source
+  }
+}
+
+const home = () => process.env.HOME || homedir()
+const hermesHome = () => process.env.HERMES_HOME || join(home(), ".hermes")
+
+// If HERMES_HOME is itself a named profile (…/profiles/<name>),
+// the root is two levels up; otherwise HERMES_HOME is the root.
+function root(): string {
+  const hh = hermesHome()
+  const parent = dirname(hh)
+  return basename(parent) === "profiles" ? dirname(parent) : hh
+}
+
+// Derive a profile name from an absolute HERMES_HOME path. Accepts
+// the gateway-reported home so "active" reflects the gateway's view,
+// not herm's own process environment.
+export function profileNameFrom(hh: string): string {
+  const parent = dirname(hh)
+  return basename(parent) === "profiles" ? basename(hh) : "default"
+}
+
+export function activeProfileName(): string {
+  return profileNameFrom(hermesHome())
+}
+
+// `hermes profile use <name>` writes the sticky default here.
+export function stickyDefault(): string | null {
+  try {
+    const raw = readFileSync(join(root(), "active_profile"), "utf-8").trim()
+    return raw || null
+  } catch { return null }
+}
+
+const ID_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/
+
+function readModel(dir: string): [string | null, string | null] {
+  try {
+    const raw = readFileSync(join(dir, "config.yaml"), "utf-8")
+    // Poor-man's YAML for two nested keys — avoids pulling the yaml lib
+    // here (hermes-home.ts already owns that dependency for full parsing).
+    const block = raw.split(/^model:\s*$/m)[1]?.split(/^\S/m)[0] ?? ""
+    const m = block.match(/^\s+(?:default|model):\s*(.+)$/m)?.[1]?.trim()
+          ?? raw.match(/^model:\s*(\S.+)$/m)?.[1]?.trim()
+    const p = block.match(/^\s+provider:\s*(.+)$/m)?.[1]?.trim()
+    const clean = (s?: string) => s?.replace(/^["']|["']$/g, "") ?? null
+    return [clean(m), clean(p)]
+  } catch { return [null, null] }
+}
+
+async function countSkills(dir: string): Promise<number> {
+  const glob = new Bun.Glob("**/SKILL.md")
+  let n = 0
+  try {
+    for await (const _ of glob.scan({ cwd: join(dir, "skills"), onlyFiles: true })) n++
+  } catch { /* missing dir */ }
+  return n
+}
+
+function gatewayRunning(dir: string): boolean {
+  try {
+    // Upstream moved to JSON pidfiles ({"pid":N,"kind":…}); older builds
+    // wrote a bare integer. Accept either.
+    const raw = readFileSync(join(dir, "gateway.pid"), "utf-8").trim()
+    const pid = raw.startsWith("{") ? Number((JSON.parse(raw) as { pid?: number }).pid) : Number(raw)
+    if (!Number.isFinite(pid) || pid <= 0) return false
+    process.kill(pid, 0)
+    return true
+  } catch { return false }
+}
+
+// Strip the leading H1 (everyone's SOUL.md starts `# <Name>\n\n`) and
+// following blank lines so the preview shows actual content, not the
+// filename repeated as a heading.
+function soul(dir: string): string {
+  try {
+    const raw = readFileSync(join(dir, "SOUL.md"), "utf-8")
+    const body = raw.replace(/^#[^\n]*\n+/, "").replace(/^\s+/, "")
+    return body.slice(0, 400)
+  } catch { return "" }
+}
+
+const src = (file: string, label: string): Source =>
+  ({ file, relative: file.replace(home() + "/", "~/"), label })
+
+async function info(name: string, dir: string, active: string, sticky: string | null): Promise<ProfileInfo> {
+  const [model, provider] = readModel(dir)
+  const alias = join(home(), ".local", "bin", name)
+  return {
+    name,
+    path: dir,
+    is_default: name === "default",
+    is_active: name === active,
+    is_sticky: name === sticky,
+    gateway_running: gatewayRunning(dir),
+    model, provider,
+    has_env: existsSync(join(dir, ".env")),
+    skill_count: await countSkills(dir),
+    has_alias: name !== "default" && existsSync(alias),
+    soul_preview: soul(dir),
+    sources: {
+      dir: src(dir, dir.replace(home() + "/", "~/")),
+      config: src(join(dir, "config.yaml"), "config.yaml"),
+      soul: src(join(dir, "SOUL.md"), "SOUL.md"),
+      env: src(join(dir, ".env"), ".env"),
+    },
+  }
+}
+
+// `activeHome`: the gateway's HERMES_HOME (from `config.get key=profile`).
+// Falls back to this process's env so the list is still usable offline.
+export async function listProfiles(activeHome?: string): Promise<ProfileInfo[]> {
+  const r = root()
+  const active = profileNameFrom(activeHome ?? hermesHome())
+  const sticky = stickyDefault()
+  const jobs: Promise<ProfileInfo>[] = []
+  if (existsSync(r)) jobs.push(info("default", r, active, sticky))
+  const pr = join(r, "profiles")
+  if (existsSync(pr)) {
+    for (const e of await readdir(pr, { withFileTypes: true })) {
+      if (!e.isDirectory() || !ID_RE.test(e.name)) continue
+      jobs.push(info(e.name, join(pr, e.name), active, sticky))
+    }
+  }
+  return Promise.all(jobs)
+}
+
+// Pre-flight UX only — the authoritative check is the CLI's own
+// validation when `hermes profile create` runs. This just lets the
+// dialog show inline error text before the user hits Enter.
+export function validateName(name: string, existing: string[]): string | null {
+  if (!ID_RE.test(name)) return "must match [a-z0-9][a-z0-9_-]{0,63}"
+  if (existing.includes(name)) return "already exists"
+  if (["hermes", "default", "test", "tmp", "root", "sudo"].includes(name)) return "reserved name"
+  return null
+}
+
+// ── Lazy per-profile stats ───────────────────────────────────────────
+//
+// Counts that require opening that profile's state.db or reading its
+// cron/jobs.json. Not part of listProfiles() — fetched on selection so
+// a 10-profile list doesn't open 10 sqlite connections per refresh.
+
+export type ProfileStats = {
+  sessions: number | null
+  messages: number | null
+  crons: number | null
+}
+
+export async function profileStats(dir: string): Promise<ProfileStats> {
+  let sessions: number | null = null
+  let messages: number | null = null
+  const dbPath = join(dir, "state.db")
+  if (existsSync(dbPath)) {
+    try {
+      const db = new Database(dbPath, { readonly: true })
+      const r = db.query("SELECT COUNT(*) AS s FROM sessions WHERE message_count > 0")
+        .get() as { s: number }
+      const m = db.query("SELECT COALESCE(SUM(message_count), 0) AS m FROM sessions")
+        .get() as { m: number }
+      sessions = r.s
+      messages = m.m
+      db.close()
+    } catch { /* schema drift or locked — leave null */ }
+  }
+  let crons: number | null = null
+  try {
+    const jobs = await Bun.file(join(dir, "cron", "jobs.json")).json() as unknown
+    crons = Array.isArray(jobs) ? jobs.length
+      : jobs && typeof jobs === "object" && Array.isArray((jobs as { jobs?: unknown[] }).jobs)
+        ? (jobs as { jobs: unknown[] }).jobs.length
+      : 0
+  } catch { crons = existsSync(join(dir, "cron")) ? 0 : null }
+  return { sessions, messages, crons }
+}

package/src/utils/interpolate.ts

@@ -0,0 +1,31 @@
+// `{!cmd}` inline shell interpolation in user prompts. Each span
+// is executed via the gateway's `shell.exec` RPC (not local spawn)
+// so it honors `terminal.backend` — a `{!ls}` in a docker/ssh-backed
+// session runs inside that environment, same as the agent's own
+// terminal tool. Stdout+stderr are trimmed and spliced in place;
+// a failed/timed-out command substitutes `(error)`.
+
+import type { Gateway } from "../app/gateway"
+
+export const INTERP_RE = /\{!(.+?)\}/g
+
+export const hasInterp = (s: string) => /\{!.+?\}/.test(s)
+
+type Sh = { stdout?: string; stderr?: string; code?: number }
+
+export async function interpolate(gw: Gateway, text: string): Promise<string> {
+  const hits = [...text.matchAll(INTERP_RE)]
+  if (hits.length === 0) return text
+  const outs = await Promise.all(hits.map(m =>
+    gw.request<Sh>("shell.exec", { command: m[1] })
+      .then(r => [r.stdout, r.stderr].filter(Boolean).join("\n").trim())
+      .catch(() => "(error)"),
+  ))
+  // Splice back-to-front so earlier match indices stay valid.
+  let out = text
+  for (let i = hits.length - 1; i >= 0; i--) {
+    const m = hits[i]
+    out = out.slice(0, m.index) + outs[i] + out.slice(m.index + m[0].length)
+  }
+  return out
+}