overmind-mcp 2.8.24 → 2.8.26

package/dist/lib/config.d.ts

@@ -35,4 +35,40 @@ export declare function isValidAgentName(name: string): boolean;
 export declare function getWorkspaceDir(): string;
 export declare function resolveConfigPath(configPath: string, workspaceDirOverride?: string): string;
 export declare function updateConfig(newSettingsPath?: string, newMcpPath?: string): void;
+/**
+ * Resolve the canonical HERMES_HOME directory for an agent.
+ *
+ * This is the SINGLE source of truth for where per-agent Hermes state lives.
+ * Prior implementations computed this from `process.cwd()` which was non-
+ * deterministic (any process spawned from a different cwd would create or
+ * read a different HERMES_HOME). That caused the "two HERMES_HOME" problem
+ * where one Overmind process wrote its agent's `.hermes/.env` to
+ * `<workflow>/.overmind/...` while another process (e.g. a CLI launched
+ * from `<backup root>/.overmind/...`) read a different `.hermes/.env`
+ * — leading to credential drift, stale auth.json, and silent 401s.
+ *
+ * Resolution order (deterministic, multi-OS, multi-install):
+ *   1. `OVERMIND_AGENT_HOME` env var (set by the install script or systemd
+ *      EnvironmentFile) — wins if set, because the operator declared it
+ *      explicitly. The runner just trusts it.
+ *   2. `<workspace>/.overmind/hermes/agent_<name>/.hermes` — the legacy
+ *      path. Kept as fallback for users who have existing state there.
+ *   3. `~/.overmind/hermes/agent_<name>/.hermes` — the canonical home dir
+ *      location for `npm -g sudo` installs (Linux/Mac prod) and
+ *      `%LOCALAPPDATA%\overmind\hermes\agent_<name>\.hermes` on Windows.
+ *      Created if missing.
+ *
+ * Both `.hermes/` directory AND its parent are returned via the two-call
+ * pattern: `getAgentHermesHome(name)` returns the `.hermes/` path,
+ * `getAgentOvermindHome(name)` returns the parent (where SOUL.md lives).
+ *
+ * Safe under all install modes:
+ *   - Dev local  (`pnpm dev` from source repo): uses workspace fallback
+ *   - Prod npm-g (Linux/Mac, `sudo npm i -g overmind-mcp`): uses HOME
+ *   - Prod npm-g (Windows): uses %LOCALAPPDATA%
+ *   - Docker / systemd: operator sets OVERMIND_AGENT_HOME explicitly
+ */
+export declare function getAgentHermesHome(agentName: string | null | undefined): string;
+/** Parent of getAgentHermesHome — the .overmind/hermes/agent_<name> dir. */
+export declare function getAgentOvermindHome(agentName: string | null | undefined): string;
 //# sourceMappingURL=config.d.ts.map

package/dist/lib/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE;YACL,QAAQ,EAAE,MAAM,CAAC;YACjB,GAAG,EAAE,MAAM,CAAC;SACb,CAAC;KACH,CAAC;IACF,IAAI,EAAE;QACJ,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE;YACL,QAAQ,EAAE,MAAM,CAAC;SAClB,CAAC;KACH,CAAC;IACF,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE;YACL,QAAQ,EAAE,MAAM,CAAC;SAClB,CAAC;KACH,CAAC;IACF,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAQD,QAAA,IAAI,WAAW,QAAU,CAAC;AAM1B,OAAO,EAAE,WAAW,EAAE,CAAC;AAEvB,eAAO,MAAM,cAAc,EAAE,UA0B5B,CAAC;AAGF,eAAO,MAAM,MAAM,EAAE,UAAuD,CAAC;AAI7E,wBAAgB,mBAAmB,SAElC;AAED,oDAAoD;AACpD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED,wBAAgB,eAAe,IAAI,MAAM,CA+DxC;AAQD,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,oBAAoB,CAAC,EAAE,MAAM,GAAG,MAAM,CAkB3F;AAED,wBAAgB,YAAY,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,QAGzE"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE;YACL,QAAQ,EAAE,MAAM,CAAC;YACjB,GAAG,EAAE,MAAM,CAAC;SACb,CAAC;KACH,CAAC;IACF,IAAI,EAAE;QACJ,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE;YACL,QAAQ,EAAE,MAAM,CAAC;SAClB,CAAC;KACH,CAAC;IACF,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE;YACL,QAAQ,EAAE,MAAM,CAAC;SAClB,CAAC;KACH,CAAC;IACF,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAQD,QAAA,IAAI,WAAW,QAAU,CAAC;AAM1B,OAAO,EAAE,WAAW,EAAE,CAAC;AAEvB,eAAO,MAAM,cAAc,EAAE,UA0B5B,CAAC;AAGF,eAAO,MAAM,MAAM,EAAE,UAAuD,CAAC;AAI7E,wBAAgB,mBAAmB,SAElC;AAED,oDAAoD;AACpD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED,wBAAgB,eAAe,IAAI,MAAM,CA+DxC;AAQD,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,oBAAoB,CAAC,EAAE,MAAM,GAAG,MAAM,CAkB3F;AAED,wBAAgB,YAAY,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,QAGzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAiD/E;AAED,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAEjF"}

package/dist/lib/config.js

@@ -136,4 +136,95 @@ export function updateConfig(newSettingsPath, newMcpPath) {
     if (newMcpPath)
         CONFIG.CLAUDE.PATHS.MCP = newMcpPath;
 }
+/**
+ * Resolve the canonical HERMES_HOME directory for an agent.
+ *
+ * This is the SINGLE source of truth for where per-agent Hermes state lives.
+ * Prior implementations computed this from `process.cwd()` which was non-
+ * deterministic (any process spawned from a different cwd would create or
+ * read a different HERMES_HOME). That caused the "two HERMES_HOME" problem
+ * where one Overmind process wrote its agent's `.hermes/.env` to
+ * `<workflow>/.overmind/...` while another process (e.g. a CLI launched
+ * from `<backup root>/.overmind/...`) read a different `.hermes/.env`
+ * — leading to credential drift, stale auth.json, and silent 401s.
+ *
+ * Resolution order (deterministic, multi-OS, multi-install):
+ *   1. `OVERMIND_AGENT_HOME` env var (set by the install script or systemd
+ *      EnvironmentFile) — wins if set, because the operator declared it
+ *      explicitly. The runner just trusts it.
+ *   2. `<workspace>/.overmind/hermes/agent_<name>/.hermes` — the legacy
+ *      path. Kept as fallback for users who have existing state there.
+ *   3. `~/.overmind/hermes/agent_<name>/.hermes` — the canonical home dir
+ *      location for `npm -g sudo` installs (Linux/Mac prod) and
+ *      `%LOCALAPPDATA%\overmind\hermes\agent_<name>\.hermes` on Windows.
+ *      Created if missing.
+ *
+ * Both `.hermes/` directory AND its parent are returned via the two-call
+ * pattern: `getAgentHermesHome(name)` returns the `.hermes/` path,
+ * `getAgentOvermindHome(name)` returns the parent (where SOUL.md lives).
+ *
+ * Safe under all install modes:
+ *   - Dev local  (`pnpm dev` from source repo): uses workspace fallback
+ *   - Prod npm-g (Linux/Mac, `sudo npm i -g overmind-mcp`): uses HOME
+ *   - Prod npm-g (Windows): uses %LOCALAPPDATA%
+ *   - Docker / systemd: operator sets OVERMIND_AGENT_HOME explicitly
+ */
+export function getAgentHermesHome(agentName) {
+    const name = agentName ? `agent_${agentName}` : 'central';
+    const hermesSub = '.hermes';
+    // 1. Explicit override (operator-declared, e.g. via systemd EnvironmentFile
+    //    or install script). The env var points to the PARENT directory
+    //    (the .overmind/hermes/agent_<name> dir, not the .hermes subdir).
+    if (process.env.OVERMIND_AGENT_HOME) {
+        return path.join(process.env.OVERMIND_AGENT_HOME, hermesSub);
+    }
+    // 2. Legacy fallback: <workspace>/.overmind/hermes/<name>/.hermes
+    //    Preserves backward compat with existing installs that have state
+    //    in the workspace-relative .overmind directory.
+    try {
+        const ws = getWorkspaceDir();
+        const legacy = path.join(ws, '.overmind', 'hermes', name, hermesSub);
+        // If the legacy path already exists (i.e. previous runs created state
+        // there), use it — this is the "be conservative, don't break existing
+        // installs" rule. Only fall through to HOME-based if legacy is fresh.
+        if (fs.existsSync(legacy))
+            return legacy;
+    }
+    catch {
+        // getWorkspaceDir can throw if HOME is unset in some sandboxed envs.
+        // That's OK — we still have the HOME-based fallback below.
+    }
+    // 3. HOME-based canonical location (works for sudo npm -g installs).
+    //    Linux/Mac: $HOME/.overmind/hermes/<name>/.hermes
+    //    Windows:   %LOCALAPPDATA%\overmind\hermes\<name>\.hermes
+    //    (USERPROFILE is also accepted as a Windows fallback.)
+    const homeBase = process.env.LOCALAPPDATA
+        || process.env.USERPROFILE
+        || os.homedir();
+    const overmindRoot = process.platform === 'win32'
+        ? path.join(homeBase, 'overmind', 'hermes', name)
+        : path.join(homeBase, '.overmind', 'hermes', name);
+    // Create parent if missing (write-enabled). This makes the function safe
+    // to call before any agent has been initialized.
+    try {
+        fs.mkdirSync(overmindRoot, { recursive: true });
+    }
+    catch (e) {
+        // Permission denied or readonly fs — fall back to legacy workspace path.
+        // We don't throw here because callers (writeAuthJson, spawnHermes) need
+        // to be able to continue even if HOME-based mkdir fails.
+        const ws = (() => { try {
+            return getWorkspaceDir();
+        }
+        catch {
+            return process.cwd();
+        } })();
+        return path.join(ws, '.overmind', 'hermes', name, hermesSub);
+    }
+    return path.join(overmindRoot, hermesSub);
+}
+/** Parent of getAgentHermesHome — the .overmind/hermes/agent_<name> dir. */
+export function getAgentOvermindHome(agentName) {
+    return path.dirname(getAgentHermesHome(agentName));
+}
 //# sourceMappingURL=config.js.map

package/dist/lib/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AA8B9C,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AAE3C,+CAA+C;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,IAAI,WAAW,GAAG,OAAO,CAAC;AAC1B,IAAI,CAAC;IACH,MAAM,GAAG,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC1C,WAAW,GAAG,GAAG,CAAC,OAAO,IAAI,WAAW,CAAC;AAC3C,CAAC;AAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;AAE1B,OAAO,EAAE,WAAW,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,cAAc,GAAe;IACxC,UAAU,EAAE,MAAM,EAAE,aAAa;IACjC,qBAAqB,EAAE,MAAM,EAAE,sDAAsD;IACrF,eAAe,EAAE,KAAK,EAAE,iCAAiC;IACzD,MAAM,EAAE;QACN,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,gCAAgC;QACxF,KAAK,EAAE;YACL,QAAQ,EAAE,yBAAyB;YACnC,GAAG,EAAE,WAAW;SACjB;KACF;IACD,IAAI,EAAE;QACJ,IAAI,EAAE,QAAQ;QACd,aAAa,EAAE,gBAAgB;QAC/B,KAAK,EAAE;YACL,QAAQ,EAAE,yBAAyB;SACpC;KACF;IACD,MAAM,EAAE;QACN,IAAI,EAAE,SAAS;QACf,aAAa,EAAE,cAAc;QAC7B,KAAK,EAAE;YACL,QAAQ,EAAE,yBAAyB;SACpC;KACF;CACF,CAAC;AAEF,8DAA8D;AAC9D,MAAM,CAAC,MAAM,MAAM,GAAe,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;AAE7E,IAAI,kBAAkB,GAAkB,IAAI,CAAC;AAE7C,MAAM,UAAU,mBAAmB;IACjC,kBAAkB,GAAG,IAAI,CAAC;AAC5B,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,IAAI,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,kBAAkB,CAAC;IAErF,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QACnC,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC9D,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,IACE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC1C,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,EAChD,CAAC;YACD,YAAY,GAAG,GAAG,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,IAAI,OAAO,GAAG,GAAG,CAAC;YAClB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,OAAO,EAAE,CAAC;gBACzC,IACE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;oBAC9C,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC,EACpD,CAAC;oBACD,YAAY,GAAG,OAAO,CAAC;oBACvB,MAAM;gBACR,CAAC;gBACD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAClC,CAAC;YAED,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAClD,IACE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;oBAC/C,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC,EACrD,CAAC;oBACD,YAAY,GAAG,QAAQ,CAAC;gBAC1B,CAAC;qBAAM,CAAC;oBACN,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;oBAC7B,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;oBACnD,IAAI,CAAC;wBACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;4BACjC,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;4BAChD,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,EACpC,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAC5C,CAAC;wBACJ,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,uCAAuC;wBACvC,YAAY,GAAG,GAAG,CAAC;oBACrB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,iGAAiG;IACjG,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC/D,IAAI,eAAe,EAAE,CAAC;QACpB,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,kBAAkB,GAAG,YAAY,CAAC;IAClC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,sEAAsE;AACtE,0EAA0E;AAC1E,0EAA0E;AAC1E,iFAAiF;AACjF,yEAAyE;AAEzE,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAE,oBAA6B;IACjF,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IAEnD,MAAM,YAAY,GAAG,oBAAoB,IAAI,eAAe,EAAE,CAAC;IAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAExD,0CAA0C;IAC1C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,4BAA4B,UAAU,6BAA6B,CAAC,CAAC;IACvF,CAAC;IAED,4DAA4D;IAC5D,IAAI,UAAU,KAAK,WAAW,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;QAChE,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IACjD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,eAAwB,EAAE,UAAmB;IACxE,IAAI,eAAe;QAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,eAAe,CAAC;IACpE,IAAI,UAAU;QAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,UAAU,CAAC;AACvD,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AA8B9C,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AAE3C,+CAA+C;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,IAAI,WAAW,GAAG,OAAO,CAAC;AAC1B,IAAI,CAAC;IACH,MAAM,GAAG,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC1C,WAAW,GAAG,GAAG,CAAC,OAAO,IAAI,WAAW,CAAC;AAC3C,CAAC;AAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;AAE1B,OAAO,EAAE,WAAW,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,cAAc,GAAe;IACxC,UAAU,EAAE,MAAM,EAAE,aAAa;IACjC,qBAAqB,EAAE,MAAM,EAAE,sDAAsD;IACrF,eAAe,EAAE,KAAK,EAAE,iCAAiC;IACzD,MAAM,EAAE;QACN,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,gCAAgC;QACxF,KAAK,EAAE;YACL,QAAQ,EAAE,yBAAyB;YACnC,GAAG,EAAE,WAAW;SACjB;KACF;IACD,IAAI,EAAE;QACJ,IAAI,EAAE,QAAQ;QACd,aAAa,EAAE,gBAAgB;QAC/B,KAAK,EAAE;YACL,QAAQ,EAAE,yBAAyB;SACpC;KACF;IACD,MAAM,EAAE;QACN,IAAI,EAAE,SAAS;QACf,aAAa,EAAE,cAAc;QAC7B,KAAK,EAAE;YACL,QAAQ,EAAE,yBAAyB;SACpC;KACF;CACF,CAAC;AAEF,8DAA8D;AAC9D,MAAM,CAAC,MAAM,MAAM,GAAe,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;AAE7E,IAAI,kBAAkB,GAAkB,IAAI,CAAC;AAE7C,MAAM,UAAU,mBAAmB;IACjC,kBAAkB,GAAG,IAAI,CAAC;AAC5B,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,IAAI,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,kBAAkB,CAAC;IAErF,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QACnC,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC9D,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,IACE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC1C,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,EAChD,CAAC;YACD,YAAY,GAAG,GAAG,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,IAAI,OAAO,GAAG,GAAG,CAAC;YAClB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,OAAO,EAAE,CAAC;gBACzC,IACE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;oBAC9C,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC,EACpD,CAAC;oBACD,YAAY,GAAG,OAAO,CAAC;oBACvB,MAAM;gBACR,CAAC;gBACD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAClC,CAAC;YAED,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAClD,IACE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;oBAC/C,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC,EACrD,CAAC;oBACD,YAAY,GAAG,QAAQ,CAAC;gBAC1B,CAAC;qBAAM,CAAC;oBACN,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;oBAC7B,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;oBACnD,IAAI,CAAC;wBACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;4BACjC,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;4BAChD,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,EACpC,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAC5C,CAAC;wBACJ,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,uCAAuC;wBACvC,YAAY,GAAG,GAAG,CAAC;oBACrB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,iGAAiG;IACjG,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC/D,IAAI,eAAe,EAAE,CAAC;QACpB,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,kBAAkB,GAAG,YAAY,CAAC;IAClC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,sEAAsE;AACtE,0EAA0E;AAC1E,0EAA0E;AAC1E,iFAAiF;AACjF,yEAAyE;AAEzE,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAE,oBAA6B;IACjF,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IAEnD,MAAM,YAAY,GAAG,oBAAoB,IAAI,eAAe,EAAE,CAAC;IAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAExD,0CAA0C;IAC1C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,4BAA4B,UAAU,6BAA6B,CAAC,CAAC;IACvF,CAAC;IAED,4DAA4D;IAC5D,IAAI,UAAU,KAAK,WAAW,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;QAChE,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IACjD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,eAAwB,EAAE,UAAmB;IACxE,IAAI,eAAe;QAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,eAAe,CAAC;IACpE,IAAI,UAAU;QAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,UAAU,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAoC;IACrE,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,MAAM,SAAS,GAAG,SAAS,CAAC;IAE5B,4EAA4E;IAC5E,oEAAoE;IACpE,sEAAsE;IACtE,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC;IAED,kEAAkE;IAClE,sEAAsE;IACtE,oDAAoD;IACpD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,eAAe,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QACrE,sEAAsE;QACtE,sEAAsE;QACtE,sEAAsE;QACtE,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,2DAA2D;IAC7D,CAAC;IAED,qEAAqE;IACrE,sDAAsD;IACtD,8DAA8D;IAC9D,2DAA2D;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY;WACpC,OAAO,CAAC,GAAG,CAAC,WAAW;WACvB,EAAE,CAAC,OAAO,EAAE,CAAC;IAClB,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC/C,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAErD,yEAAyE;IACzE,iDAAiD;IACjD,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,yEAAyE;QACzE,wEAAwE;QACxE,yDAAyD;QACzD,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAAC,OAAO,eAAe,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,oBAAoB,CAAC,SAAoC;IACvE,OAAO,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;AACrD,CAAC"}

package/dist/lib/envUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"envUtils.d.ts","sourceRoot":"","sources":["../../src/lib/envUtils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,KAAK,cAAc,GACf,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,SAAS,GACT,cAAc,EAAE,GAChB;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAAA;CAAE,CAAC;AAMtC,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,cAAc,EACnB,OAAO,GAAE,OAAO,CAAC,MAAM,CAAiB,GACvC,cAAc,CA8BhB;AAED,6FAA6F;AAC7F,wBAAgB,qBAAqB,IAAI,MAAM,EAAE,CAIhD"}
+{"version":3,"file":"envUtils.d.ts","sourceRoot":"","sources":["../../src/lib/envUtils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,KAAK,cAAc,GACf,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,SAAS,GACT,cAAc,EAAE,GAChB;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAAA;CAAE,CAAC;AAMtC,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,cAAc,EACnB,OAAO,GAAE,OAAO,CAAC,MAAM,CAAiB,GACvC,cAAc,CAsChB;AAED,6FAA6F;AAC7F,wBAAgB,qBAAqB,IAAI,MAAM,EAAE,CAIhD"}

package/dist/lib/envUtils.js

@@ -7,9 +7,18 @@
 const unresolvedVars = [];
 export function interpolateEnvVars(obj, visited = new WeakSet()) {
     if (typeof obj === 'string') {
-        // Replace unresolved vars with empty string and track which keys are missing
-        return obj.replace(/\$(\w+)|\${(\w+)}/g, (_, name1, name2) => {
-            const name = name1 || name2;
+        // Match $VAR and ${VAR}. The closing '}' MUST be inside the match so it does
+        // not leak into the output. The previous regex `\$(\w+)|\${\w+}` (a) had only
+        // one capture group (so `name2` was always undefined, and `${VAR}` crashed
+        // on `process.env[undefined]`), and (b) did not consume the '}' — leaking
+        // it as literal text. Fixed: explicit capture group on each alternation branch,
+        // closing brace consumed by the first branch.
+        return obj.replace(/\$\{(\w+)\}|\$(\w+)/g, (_, braced, bare) => {
+            const name = braced || bare;
+            // Defensive: should never happen, but if name is undefined (no capture
+            // matched), treat as literal text rather than crashing on process.env[undefined].
+            if (name === undefined)
+                return _;
             const value = process.env[name];
             if (value === undefined)
                 unresolvedVars.push(name);

package/dist/lib/envUtils.js.map

@@ -1 +1 @@
-{"version":3,"file":"envUtils.js","sourceRoot":"","sources":["../../src/lib/envUtils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH,+EAA+E;AAC/E,oFAAoF;AACpF,MAAM,cAAc,GAAa,EAAE,CAAC;AAEpC,MAAM,UAAU,kBAAkB,CAChC,GAAmB,EACnB,UAA2B,IAAI,OAAO,EAAE;IAExC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,6EAA6E;QAC7E,OAAO,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC3D,MAAM,IAAI,GAAG,KAAK,IAAI,KAAK,CAAC;YAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,KAAK,KAAK,SAAS;gBAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnD,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5C,+BAA+B;QAC/B,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,GAAG,CAAC,CAAC,cAAc;QAC5B,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEjB,MAAM,MAAM,GAAmC,EAAE,CAAC;QAClD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,qBAAqB;IACnC,MAAM,IAAI,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC;IACjC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"envUtils.js","sourceRoot":"","sources":["../../src/lib/envUtils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH,+EAA+E;AAC/E,oFAAoF;AACpF,MAAM,cAAc,GAAa,EAAE,CAAC;AAEpC,MAAM,UAAU,kBAAkB,CAChC,GAAmB,EACnB,UAA2B,IAAI,OAAO,EAAE;IAExC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,6EAA6E;QAC7E,8EAA8E;QAC9E,2EAA2E;QAC3E,0EAA0E;QAC1E,gFAAgF;QAChF,8CAA8C;QAC9C,OAAO,GAAG,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,IAAI,CAAC;YAC5B,uEAAuE;YACvE,kFAAkF;YAClF,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,KAAK,KAAK,SAAS;gBAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnD,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5C,+BAA+B;QAC/B,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,GAAG,CAAC,CAAC,cAAc;QAC5B,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEjB,MAAM,MAAM,GAAmC,EAAE,CAAC;QAClD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,qBAAqB;IACnC,MAAM,IAAI,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC;IACjC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/services/NousHermesRunner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"NousHermesRunner.d.ts","sourceRoot":"","sources":["../../src/services/NousHermesRunner.ts"],"names":[],"mappings":"AA2DA,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAsFD;;;;;;GAMG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,SAAS,CAAgB;IACjC,OAAO,CAAC,OAAO,CAAoB;;IAMnC,gBAAgB,IAAI,IAAI;IAclB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;IAkC3D,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;CAi1B1E"}
+{"version":3,"file":"NousHermesRunner.d.ts","sourceRoot":"","sources":["../../src/services/NousHermesRunner.ts"],"names":[],"mappings":"AA2DA,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAuGD;;;;;;GAMG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,SAAS,CAAgB;IACjC,OAAO,CAAC,OAAO,CAAoB;;IAMnC,gBAAgB,IAAI,IAAI;IAclB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;IAkC3D,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;CAk5B1E"}

package/dist/services/NousHermesRunner.js

@@ -3,7 +3,7 @@ import path from 'path';
 import { spawn } from 'child_process';
 import { exec } from 'child_process';
 import { promisify } from 'util';
-import { CONFIG, resolveConfigPath, getWorkspaceDir } from '../lib/config.js';
+import { CONFIG, resolveConfigPath, getWorkspaceDir, getAgentHermesHome, getAgentOvermindHome } from '../lib/config.js';
 import { getLastSessionId, saveSessionId } from '../lib/sessions.js';
 import { linkSessionToPid } from '../lib/processRegistry.js';
 import { interpolateEnvVars } from '../lib/envUtils.js';
@@ -52,6 +52,22 @@ const killProcessTree = (child) => {
         setTimeout(finish, 5000);
     });
 };
+/**
+ * Default base URL for a given provider. Used when settings_<agent>.json
+ * doesn't specify ANTHROPIC_BASE_URL. Each provider has its canonical
+ * endpoint baked in here so the runner doesn't need an external config.
+ */
+function defaultBaseUrlFor(provider) {
+    switch (provider) {
+        case 'minimax-cn': return 'https://api.minimaxi.com/anthropic';
+        case 'minimax': return 'https://api.minimax.com/anthropic';
+        case 'zai':
+        case 'z-ai': return 'https://api.z.ai/api/coding/paas/v4';
+        case 'anthropic': return 'https://api.anthropic.com';
+        case 'openai': return 'https://api.openai.com/v1';
+        default: return 'https://api.z.ai/api/coding/paas/v4';
+    }
+}
 /**
  * Find hermes binary across platforms (Windows, Linux, macOS)
  * Priority: HERMES_BIN_PATH env > PATH > platform-specific paths > pip show
@@ -203,11 +219,13 @@ export class NousHermesRunner {
         const MAX_BUF = 10 * 1024 * 1024;
         const timeoutMs = this.timeoutMs;
         const HARD_TIMEOUT_MS = 60000;
-        // HERMES_HOME setup
-        const overmindHermesPath = path.resolve(cwd, '.overmind', 'hermes', agentName ? `agent_${agentName}` : 'central');
-        const overmindHermesSubPath = path.join(overmindHermesPath, '.hermes');
+        // HERMES_HOME setup — use the canonical helper (multi-OS, multi-install safe).
+        // This replaces the previous cwd-relative resolution that caused HERMES_HOME
+        // drift between dev/prod installs and between different spawn cwd's.
+        const overmindHermesPath = getAgentOvermindHome(agentName);
+        const overmindHermesSubPath = getAgentHermesHome(agentName);
         if (agentName && !fs.existsSync(overmindHermesPath)) {
-            return { result: '', error: `INVALID_AGENT: Agent Hermes "${agentName}" non trouvé.` };
+            return { result: '', error: `INVALID_AGENT: Agent Hermes "${agentName}" non trouvé (HERMES_HOME=${overmindHermesSubPath}).` };
         }
         // Load agent settings + MCP config (same pattern as ClaudeRunner)
         let systemPrompt = '';
@@ -225,7 +243,7 @@ export class NousHermesRunner {
             // OVERMIND_AGENT_HOME tells Hermes (v0.13.0+) to read agent-specific .env FIRST
             // get_env_value() in Hermes checks OVERMIND_AGENT_HOME/.hermes/.env before HERMES_HOME/.env
             // This allows $VAR expansion done by Overmind to take precedence over gateway .env
-            ...(agentName ? { OVERMIND_AGENT_HOME: path.resolve(cwd, '.overmind', 'hermes', `agent_${agentName}`) } : {}),
+            ...(agentName ? { OVERMIND_AGENT_HOME: getAgentOvermindHome(agentName) } : {}),
             // NOTE: do NOT pre-seed GLM_API_KEY with '' here. The real value comes from
             // settings_<agent>.json (merged below) or from the agent's .hermes/.env file.
             // Seeding '' here used to win against Object.assign() whenever interpolateEnvVars()
@@ -425,6 +443,12 @@ export class NousHermesRunner {
         //   OpenRouter  → "sk-or-..."  → env OPENROUTER_API_KEY (BLOCKED for LLM)
         //   Mistral     → (variable)   → env MISTRAL_API_KEY_*
         //   Other       → unknown      → env ANTHROPIC_AUTH_TOKEN (default Anthropic)
+        //
+        // NOTE: This function-local copy mirrors the canonical implementation in
+        // src/services/hermesTokenResolver.ts. The runner uses these local closures
+        // so it doesn't have to thread env/logger through every call site; the
+        // canonical exported versions exist for testing and for any future caller
+        // that wants the same behavior without instantiating NousHermesRunner.
         const TOKEN_PREFIX_PROVIDERS = [
             // Z.AI: c78a134949fc4c369911c24e9fa4b84c.OZhHX5Obs6qF1ISt (32hex.32hex — 2 blocks)
             { test: (t) => /^[0-9a-f]{32}\.[0-9a-zA-Z]+$/i.test(t), provider: 'zai', envKey: 'ZAI_ANTHROPIC_FALLBACK_KEY' },
@@ -453,42 +477,10 @@ export class NousHermesRunner {
         // ============================================================
         // TOKEN RESOLUTION ORDER (settings.env first, then process.env, then detection)
         // ============================================================
-        // IMPORTANT — provider/credentials mapping (Hermes v0.16.0):
-        //   minimax-cn  → MINIMAX_CN_API_KEY  (NOT ANTHROPIC_AUTH_TOKEN)
-        //   minimax     → MINIMAX_API_KEY
-        //   zai         → GLM_API_KEY or ZAI_ANTHROPIC_FALLBACK_KEY
-        //   z-ai (alt)  → Z_AI_API_KEY
-        //   anthropic   → ANTHROPIC_AUTH_TOKEN (any of _1.._5, _E, _F, _Y)
-        //
-        // The agent's settings_<name>.json MUST use the env var name that matches
-        // its ANTHROPIC_PROVIDER value, otherwise Hermes upstream will silently
-        // 401 even though Overmind has the key. The minimax plugin in Hermes
-        // (plugins/model-providers/minimax/init.py) decides the env var name — not Overmind.
-        //
-        // Resolution order (NEW in 2.8.16+):
-        //   1. settings_<agent>.json env block (explicit, agent-specific — WINS)
-        //   2. agent's .hermes/.env (isolated override)
-        //   3. process.env (global .env via systemd EnvironmentFile)
-        //   4. Detection by token prefix (subtilisation — last resort, maps to right provider)
-        //
-        // (Full list moved to top of scope for use in RAW pre-interpolation capture.)
-        // See const TOKEN_KEYS at top of runHermesAgent() function.
-        /**
-         * Resolve a token with explicit settings priority + provider detection.
-         *
-         * Strategy:
-         *   1. Read settings_<agent>.json env block.
-         *      - If user set a LITERAL token (e.g. "sk-cp-..."), use it directly.
-         *      - If user set a $VAR REFERENCE (e.g. "$GLM_API_KEY_Y"), RESOLVE IT.
-         *        - If $VAR is found in process.env → use the resolved value.
-         *        - If $VAR is NOT found in process.env → FAIL LOUD. Do NOT silently
-         *          fall back to TOKEN_KEYS (the user explicitly said "use THIS var").
-         *      - If user set something else (e.g. template, expression), try to resolve.
-         *   2. If no settings token (or settings has no env block at all), fall back
-         *      to TOKEN_KEYS iteration in priority order from process.env.
-         *   3. For each candidate, sniff the token prefix to know which provider it
-         *      belongs to, and re-map to the right env var name for that provider.
-         */
+        // See src/services/hermesTokenResolver.ts for the canonical exported version
+        // and the rationale for the 3-pass strategy. The local closure below
+        // captures agentCustomEnv, TOKEN_KEYS, agentName, logger, and tmpSettingsPath
+        // from the enclosing scope so call sites stay terse.
         function resolveTokenWithDetection(explicitSettingsTokens) {
             // Step 1: settings_<agent>.json env block takes ABSOLUTE priority
             // (whatever the user explicitly set in their agent config wins)
@@ -520,21 +512,47 @@ export class NousHermesRunner {
                 logger.info({ agentName, tokenKey: t.key, detectedProvider: detected.provider, mappedTo: detected.envKey }, '[SUBTILISATION] Using explicit settings_<agent>.json token, re-mapping to detected provider env var.');
                 return { tokenEnvKey: t.key, tokenValue: resolvedValue, detectedProvider: detected.provider, source: 'settings-explicit' };
             }
-            // Step 2: iterate TOKEN_KEYS in priority order, picking the first non-empty
+            const candidates = [];
             for (const tk of TOKEN_KEYS) {
                 const v = agentCustomEnv[tk];
                 if (v && typeof v === 'string' && v.length > 0) {
-                    const detected = detectTokenProvider(v);
-                    // If the env-var name doesn't match the detected provider, re-map.
-                    // (e.g. ANTHROPIC_AUTH_TOKEN=sk-cp-... → real env should be MINIMAX_API_KEY)
-                    if (detected.envKey !== tk && detected.provider !== 'unknown') {
-                        logger.info({ agentName, sourceKey: tk, detectedProvider: detected.provider, remappedTo: detected.envKey }, '[SUBTILISATION] Token prefix detected provider mismatch — re-mapping env var.');
-                        return { tokenEnvKey: detected.envKey, tokenValue: v, detectedProvider: detected.provider, source: 'detected' };
-                    }
-                    return { tokenEnvKey: tk, tokenValue: v, detectedProvider: detected.provider, source: 'env-fallback' };
+                    candidates.push({ key: tk, value: v, detected: detectTokenProvider(v) });
                 }
             }
-            return null;
+            if (candidates.length === 0)
+                return null;
+            // Pass A: any candidate whose env-var name already matches its detected provider
+            // (e.g. MINIMAX_API_KEY=sk-cp-...  →  detected.envKey='MINIMAX_API_KEY' → match).
+            // TOKEN_KEYS ordering means provider-specific keys come first, so this preserves
+            // the user's explicit choice over a generic-key re-map.
+            for (const c of candidates) {
+                if (c.detected.provider !== 'unknown' && c.detected.envKey === c.key) {
+                    return {
+                        tokenEnvKey: c.key,
+                        tokenValue: c.value,
+                        detectedProvider: c.detected.provider,
+                        source: 'env-fallback',
+                    };
+                }
+            }
+            // Pass B: re-map the first candidate to the right provider env-var name.
+            const first = candidates[0];
+            if (first.detected.provider !== 'unknown' && first.detected.envKey !== first.key) {
+                logger.info({ agentName, sourceKey: first.key, detectedProvider: first.detected.provider, remappedTo: first.detected.envKey }, '[SUBTILISATION] Token prefix detected provider mismatch — re-mapping env var.');
+                return {
+                    tokenEnvKey: first.detected.envKey,
+                    tokenValue: first.value,
+                    detectedProvider: first.detected.provider,
+                    source: 'detected',
+                };
+            }
+            // Pass C (rare): all candidates have provider='unknown' or envKey already matches.
+            return {
+                tokenEnvKey: first.key,
+                tokenValue: first.value,
+                detectedProvider: first.detected.provider,
+                source: 'env-fallback',
+            };
         }
         const getAvailableFallbacks = () => {
             const fb = [];
@@ -586,6 +604,10 @@ export class NousHermesRunner {
         if (!fs.existsSync(overmindHermesSubPath))
             fs.mkdirSync(overmindHermesSubPath, { recursive: true });
         agentCustomEnv.HERMES_HOME = overmindHermesSubPath;
+        // HOME / USERPROFILE override: point Hermes at the parent .overmind dir,
+        // NOT the cwd. This makes relative .hermes lookups inside Hermes
+        // (e.g. `~/.hermes/.env` resolution) resolve to the same canonical
+        // location regardless of where the spawn came from.
         if (process.platform === 'win32')
             agentCustomEnv.USERPROFILE = overmindHermesPath;
         else
@@ -699,11 +721,32 @@ export class NousHermesRunner {
                     return;
                 try {
                     const authPath = path.join(overmindHermesSubPath, 'auth.json');
-                    const auth = { version: 1, providers: {}, credential_pool: {} };
-                    if (fs.existsSync(authPath))
-                        Object.assign(auth, JSON.parse(fs.readFileSync(authPath, 'utf8')));
-                    if (!auth.credential_pool)
-                        auth.credential_pool = {};
+                    // Read existing auth.json to preserve non-credential_pool state
+                    // (e.g. oauth tokens, settings, version). But we PRUNE credential_pool
+                    // entries for OTHER providers — those are stale from previous provider
+                    // configs and Hermes may pick them up by mistake, causing silent 401s
+                    // on the wrong endpoint. This is the source of the "auth.json drift"
+                    // bug where the runner would seed `minimax-cn` credentials while a stale
+                    // `zai` entry with last_status="exhausted" still existed in the pool.
+                    let preservedAuth = { version: 1, providers: {} };
+                    if (fs.existsSync(authPath)) {
+                        try {
+                            const parsed = JSON.parse(fs.readFileSync(authPath, 'utf8'));
+                            // Keep the version + any oauth providers; drop credential_pool entirely
+                            // (it will be re-seeded below with only the effectiveProvider's entries).
+                            preservedAuth = {
+                                version: parsed.version ?? 1,
+                                providers: parsed.providers ?? {},
+                            };
+                        }
+                        catch (e) {
+                            logger.warn({ authPath, error: e }, 'auth.json was malformed; re-creating from scratch');
+                        }
+                    }
+                    const auth = {
+                        ...preservedAuth,
+                        credential_pool: {},
+                    };
                     const cleanCp = auth.credential_pool;
                     // Determine effective provider from MULTIPLE signals
                     // Priority: TOKEN PREFIX (most reliable) > BASE_URL (very reliable) > settings.ANTHROPIC_PROVIDER (hint only)
@@ -739,6 +782,19 @@ export class NousHermesRunner {
                     // SPECIAL CASE: if token says "minimax" and URL says "minimax-cn" (or vice versa),
                     // the URL wins because the token prefix sk-cp- is shared between both endpoints.
                     // The URL is the only signal that can disambiguate CN vs GLOBAL.
+                    //
+                    // DEFAULT FOR MiniMax WHEN AMBIGUOUS:
+                    // The sk-cp- prefix is shared between MiniMax GLOBAL and MiniMax CN. The
+                    // URL is the only signal that disambiguates. For users whose setup
+                    // exclusively uses CN tokens (the most common case for non-China
+                    // operators), an absent/ambiguous URL should default to CN rather than
+                    // silently picking GLOBAL and getting a 401. Override via env var:
+                    //   OVERMIND_MINIMAX_DEFAULT=cn     (default: CN when ambiguous)
+                    //   OVERMIND_MINIMAX_DEFAULT=global (treat sk-cp-* as GLOBAL)
+                    //   OVERMIND_MINIMAX_DEFAULT=auto   (never infer, require URL to disambiguate)
+                    const minimaxDefault = (process.env.OVERMIND_MINIMAX_DEFAULT || 'cn').toLowerCase();
+                    const minimaxDefaults = { cn: 'minimax-cn', global: 'minimax', auto: 'minimax' };
+                    const minimaxFallback = minimaxDefaults[minimaxDefault] || minimaxDefaults.cn;
                     let effectiveProvider;
                     if (detectedFromToken.provider === 'minimax' && detectedFromUrl === 'minimax-cn') {
                         // URL has more specific info than the token prefix
@@ -749,6 +805,11 @@ export class NousHermesRunner {
                         effectiveProvider = 'minimax';
                         logger.info({ agentName, tokenSays: 'minimax-cn', urlSays: 'minimax', settingsHint }, '[SUBTILISATION] URL is more specific than token prefix (minimax vs minimax-cn) — using URL.');
                     }
+                    else if (detectedFromToken.provider === 'minimax' && !detectedFromUrl) {
+                        // Token says MiniMax, no URL hint — use OVERMIND_MINIMAX_DEFAULT
+                        effectiveProvider = minimaxFallback;
+                        logger.info({ agentName, tokenSays: 'minimax', urlSays: '(none)', minimaxDefault, effectiveProvider }, '[SUBTILISATION] MiniMax token without explicit URL — applying OVERMIND_MINIMAX_DEFAULT.');
+                    }
                     else if (detectedFromToken.provider !== 'unknown') {
                         effectiveProvider = detectedFromToken.provider;
                         if (settingsHint && settingsHint !== effectiveProvider) {
@@ -771,7 +832,7 @@ export class NousHermesRunner {
                             id: `${effectiveProvider}-default`, label: tokenInfo.tokenEnvKey, auth_type: 'api_key',
                             priority: 0, source: `env:${tokenInfo.tokenEnvKey}`, access_token: tokenInfo.tokenValue,
                             last_status: null, last_error_code: null,
-                            base_url: baseUrlHint || 'https://api.z.ai/api/coding/paas/v4',
+                            base_url: baseUrlHint || defaultBaseUrlFor(effectiveProvider),
                             request_count: 0,
                         }];
                     fs.writeFileSync(authPath, JSON.stringify(auth, null, 2), 'utf8');
@@ -789,7 +850,7 @@ export class NousHermesRunner {
                     // 2. ANTHROPIC_PROVIDER (the kebab-case provider name)
                     dotLines.push(`ANTHROPIC_PROVIDER=${effectiveProvider}`);
                     // 3. ANTHROPIC_BASE_URL (from settings, or fallback)
-                    const resolvedBaseUrl = baseUrlHint || 'https://api.z.ai/api/coding/paas/v4';
+                    const resolvedBaseUrl = baseUrlHint || defaultBaseUrlFor(effectiveProvider);
                     dotLines.push(`ANTHROPIC_BASE_URL=${resolvedBaseUrl}`);
                     // 4. ANTHROPIC_AUTH_TOKEN = literal token value (for backward compat with older Hermes versions)
                     // (Hermes reads this env var directly — no more provider-specific mapping)
@@ -819,7 +880,7 @@ export class NousHermesRunner {
                         // ANTHROPIC_AUTH_TOKEN already set above
                     }
                     fs.writeFileSync(dotEnvPath, dotLines.join('\n') + '\n', 'utf8');
-                    logger.info({ agentName, effectiveProvider, baseUrl: resolvedBaseUrl, model: finalModel, sourceKey: tokenInfo.tokenEnvKey, detectedProvider: detectedFromToken.provider }, '[AUTH] Wrote agent .env with 4 canonical Hermes fields + provider-specific seeds.');
+                    logger.info({ agentName, effectiveProvider, baseUrl: resolvedBaseUrl, model: finalModel, sourceKey: tokenInfo.tokenEnvKey, detectedProvider: detectedFromToken.provider, envKeysWritten: dotLines.length }, '[AUTH] Wrote agent .env with 4 canonical Hermes fields + provider-specific seeds.');
                 }
                 catch (e) {
                     logger.warn({ error: e, agentName }, '[AUTH] Failed to write auth.json or agent .env');