overmind-mcp 2.8.3 → 2.8.7

package/dist/services/NousHermesRunner.js

@@ -3,43 +3,54 @@ import path from 'path';
 import { spawn } from 'child_process';
 import { exec } from 'child_process';
 import { promisify } from 'util';
-import { CONFIG, resolveConfigPath } from '../lib/config.js';
+import { CONFIG, resolveConfigPath, getWorkspaceDir } from '../lib/config.js';
 import { getLastSessionId, saveSessionId } from '../lib/sessions.js';
+import { linkSessionToPid } from '../lib/processRegistry.js';
 import { interpolateEnvVars } from '../lib/envUtils.js';
 import { withSpan } from '../lib/telemetry.js';
 import { loadEnvQuietly } from '../lib/loadEnv.js';
 import pino from 'pino';
 import { registerProcess, appendOutput, updateProcessStatus, } from '../lib/processRegistry.js';
+import { registerLiveAgent, appendLiveOutput, setLiveStatus, unregisterLiveAgent, } from '../lib/agent_lifecycle.js';
 const execAsync = promisify(exec);
 const logger = pino({ name: 'NousHermesRunner' });
 // Sur Windows, child.kill() ne tue que le wrapper cmd.exe — le child réel devient
-// orphelin. On utilise taskkill /F /T pour propager au sous-arbre complet.
+// orphelin. On utilise taskkill /F /T pour propager le kill au sous-arbre complet.
 const killProcessTree = (child) => {
-    if (!child || child.exitCode !== null)
-        return;
-    if (process.platform === 'win32' && child.pid) {
-        exec(`taskkill /F /T /PID ${child.pid}`, () => {
-            // taskkill peut échouer si déjà mort — ignoré
-        });
-    }
-    else {
-        try {
-            child.kill('SIGTERM');
+    return new Promise((resolve) => {
+        if (!child || child.exitCode !== null || child.killed) {
+            resolve();
+            return;
         }
-        catch {
-            // Ignored
+        let settled = false;
+        const finish = () => {
+            if (settled)
+                return;
+            settled = true;
+            resolve();
+        };
+        child.once('exit', finish);
+        if (process.platform === 'win32' && child.pid) {
+            exec(`taskkill /F /T /PID ${child.pid}`, () => {
+                // taskkill peut échouer si le process est déjà mort
+            });
         }
-        setTimeout(() => {
-            if (child.exitCode === null && !child.killed) {
-                try {
-                    child.kill('SIGKILL');
-                }
-                catch {
-                    // Ignored
-                }
+        else {
+            try {
+                child.kill('SIGTERM');
             }
-        }, 5000);
-    }
+            catch { /* ignored */ }
+            setTimeout(() => {
+                if (child.exitCode === null && !child.killed) {
+                    try {
+                        child.kill('SIGKILL');
+                    }
+                    catch { /* ignored */ }
+                }
+            }, 2000);
+        }
+        setTimeout(finish, 5000);
+    });
 };
 /**
  * Find hermes binary across platforms (Windows, Linux, macOS)
@@ -149,586 +160,502 @@ export class NousHermesRunner {
         this.tempFiles = [];
     }
     async runAgent(options) {
-        return runAgentWrapper.call(this, options);
+        try {
+            const result = await withSpan('hermes.runAgent', async (span) => {
+                span.setAttribute('agentName', options.agentName || '');
+                span.setAttribute('model', options.model || '');
+                span.setAttribute('runner', 'hermes');
+                return await this.runAgentInternal(options);
+            }, {
+                agentName: options.agentName || '',
+                model: options.model || '',
+                runner: 'hermes',
+            });
+            this.cleanupTempFiles();
+            if (options.agentName && result.sessionId) {
+                await saveSessionId(options.agentName, result.sessionId, options.configPath, 'hermes');
+            }
+            return result;
+        }
+        catch (error) {
+            this.cleanupTempFiles();
+            logger.error({ error: error instanceof Error ? error.message : String(error), agentName: options.agentName }, 'Hermes runner failed');
+            throw error;
+        }
     }
     async runAgentInternal(options) {
         const { prompt, agentName, autoResume, silent } = options;
         let { sessionId } = options;
-        // --- Load .env files first (before anything else) ---
         const cwd = options.cwd || process.cwd();
+        const configPath = options.configPath || getWorkspaceDir();
+        // Load .env files FIRST
         loadEnvQuietly(path.join(cwd, '.env'));
         loadEnvQuietly(path.join(cwd, '../Workflow/.env'));
-        // --- Auto Resume ---
+        // Auto Resume
         if (autoResume && agentName && !sessionId) {
-            const lastId = await getLastSessionId(agentName, options.configPath, 'hermes');
+            const lastId = await getLastSessionId(agentName, configPath, 'hermes');
             if (lastId) {
                 sessionId = lastId;
+                if (!silent)
+                    console.error(`[NousHermesRunner] Auto-resume session: ${sessionId}`);
             }
         }
+        const MAX_BUF = 10 * 1024 * 1024;
+        const timeoutMs = this.timeoutMs;
+        const HARD_TIMEOUT_MS = 60000;
+        // HERMES_HOME setup
+        const overmindHermesPath = path.resolve(cwd, '.overmind', 'hermes', agentName ? `agent_${agentName}` : 'central');
+        const overmindHermesSubPath = path.join(overmindHermesPath, '.hermes');
+        if (agentName && !fs.existsSync(overmindHermesPath)) {
+            return { result: '', error: `INVALID_AGENT: Agent Hermes "${agentName}" non trouvé.` };
+        }
+        // Load agent settings + MCP config (same pattern as ClaudeRunner)
+        let systemPrompt = '';
+        let resolvedModel;
+        let resolvedProvider;
         const agentCustomEnv = {
             ...process.env,
-            PYTHONIOENCODING: 'utf-8',
-            PYTHONUTF8: '1',
-            PYTHONUNBUFFERED: '1',
-            PYTHONLEGACYWINDOWSSTDIO: '1',
-            TERM: 'emacs',
-            PROMPT_TOOLKIT_NO_INTERACTIVE: '1',
-            // Force non-interactive for prompt_toolkit
-            ANSICON: '1',
-            // Map OpenRouter key if needed
-            OPENROUTER_API_KEY: process.env.OPENROUTER_API_KEY || process.env.OVERMIND_EMBEDDING_KEY,
-            // Map NVIDIA NIM key
+            PYTHONIOENCODING: 'utf-8', PYTHONUTF8: '1', PYTHONUNBUFFERED: '1',
+            PYTHONLEGACYWINDOWSSTDIO: '1', TERM: 'emacs',
+            PROMPT_TOOLKIT_NO_INTERACTIVE: '1', ANSICON: '1',
+            OPENROUTER_API_KEY: process.env.OPENROUTER_API_KEY || '',
             NVIDIA_API_KEY: process.env.NVIDIA_API_KEY || process.env.NVAPI_KEY,
             NVIDIA_API_BASE: process.env.NVIDIA_API_BASE || 'https://integrate.api.nvidia.com/v1',
             ...(agentName ? { OVERMIND_AGENT_NAME: agentName } : {}),
+            // OVERMIND_AGENT_HOME tells Hermes (v0.13.0+) to read agent-specific .env FIRST
+            // get_env_value() in Hermes checks OVERMIND_AGENT_HOME/.hermes/.env before HERMES_HOME/.env
+            // This allows $VAR expansion done by Overmind to take precedence over gateway .env
+            ...(agentName ? { OVERMIND_AGENT_HOME: path.resolve(cwd, '.overmind', 'hermes', `agent_${agentName}`) } : {}),
+            // GLM_API_KEY in spawn env — zai provider resolves credentials via os.environ.get("GLM_API_KEY")
+            // before checking .env files. This is the most reliable path for Z.AI tokens.
+            ...(agentName ? { GLM_API_KEY: '' } : {}),
         };
-        // --- Isolation / Settings / Prompt ---
-        const overmindHermesPath = path.resolve(cwd, '.overmind', 'hermes', agentName ? `agent_${agentName}` : 'central');
-        const overmindHermesSubPath = path.join(overmindHermesPath, '.hermes');
-        if (!fs.existsSync(overmindHermesSubPath)) {
-            fs.mkdirSync(overmindHermesSubPath, { recursive: true });
-        }
-        // On définit l'environnement pour Hermes
-        // IMPORTANT: HERMES_HOME doit pointer vers le dossier contenant config.yaml
-        agentCustomEnv.HERMES_HOME = overmindHermesSubPath;
-        if (process.platform === 'win32') {
-            agentCustomEnv.USERPROFILE = overmindHermesPath;
-        }
-        else {
-            agentCustomEnv.HOME = overmindHermesPath;
-        }
-        // ─── Pre-write API keys to HERMES_HOME/.env ───────────────────────────────
-        // Hermes (et son credential pool) lisent ~/.hermes/.env très tôt au démarrage,
-        // avant même que le credential pool soit initialisé. On écrit les clés
-        // critiques dans:
-        //   1. HERMES_HOME/.env (notre isolation)
-        //   2. ~/.hermes/.env (fallback pour l'init Hermes avant lecture HERMES_HOME)
-        const writeHermesDotEnv = (dotEnvPath) => {
-            const dotEnvEntries = [];
-            const dotEnvKeys = [
-                'MINIMAXI_API_KEY',
-                'MINIMAX_API_KEY',
-                'ANTHROPIC_AUTH_TOKEN',
-                'ANTHROPIC_AUTH_TOKEN_1',
-                'ANTHROPIC_AUTH_TOKEN_2',
-                'ANTHROPIC_AUTH_TOKEN_3',
-                'ANTHROPIC_AUTH_TOKEN_4',
-                'MINIMAX_CN_API_KEY',
-                'OPENROUTER_API_KEY',
-                'OPENAI_API_KEY',
-                'Z_AI_API_KEY',
-                'GLM_API_KEY',
-                'Z_AI_API_KEY_2',
-                'MISTRAL_API_KEY',
-                'NVIDIA_API_KEY',
-            ];
-            for (const key of dotEnvKeys) {
-                if (agentCustomEnv[key]) {
-                    dotEnvEntries.push(`${key}=${agentCustomEnv[key]}`);
-                }
-            }
-            if (dotEnvEntries.length > 0) {
-                const existingContent = fs.existsSync(dotEnvPath)
-                    ? fs.readFileSync(dotEnvPath, 'utf8')
-                    : '';
-                const newContent = dotEnvEntries.join('\n') + '\n';
-                const finalContent = existingContent ? newContent + existingContent : newContent;
-                fs.writeFileSync(dotEnvPath, finalContent, 'utf8');
-                if (!silent)
-                    console.error(`[NousHermesRunner] Wrote ${dotEnvEntries.length} keys to ${dotEnvPath}`);
-            }
-        };
-        let systemPrompt = '';
+        let tmpSettingsPath = null;
+        let tmpMcpPath = null;
         if (agentName) {
+            const agentPromptPath = path.join(overmindHermesSubPath, 'SOUL.md');
+            if (fs.existsSync(agentPromptPath)) {
+                systemPrompt = fs.readFileSync(agentPromptPath, 'utf8');
+            }
+            // Load environment variables from .claude/settings_<agentName>.json
             try {
-                const settingsDir = path.dirname(CONFIG.CLAUDE.PATHS.SETTINGS);
-                const agentSettingsPath = resolveConfigPath(path.join(settingsDir, `settings_${agentName}.json`), options.configPath);
-                if (!fs.existsSync(agentSettingsPath)) {
-                    // Lister les agents disponibles pour aider au debugging
-                    let availableAgents = [];
-                    try {
-                        const files = fs.readdirSync(settingsDir);
-                        availableAgents = files
-                            .filter((f) => f.startsWith('settings_') && f.endsWith('.json'))
-                            .map((f) => f.replace('settings_', '').replace('.json', ''));
-                    }
-                    catch (e) {
-                        logger.warn({ settingsDir, error: e }, 'Error reading settings directory');
-                    }
-                    return {
-                        result: '',
-                        error: `INVALID_AGENT: Agent Hermes "${agentName}" non trouvé.
-              Veuillez utiliser 'create_agent' au préalable.
-              Fichier attendu: ${agentSettingsPath}
-              ${availableAgents.length > 0 ? `Agents disponibles: ${availableAgents.join(', ')}` : 'Aucun agent disponible'}
-            `
-                            .replace(/\s+/g, ' ')
-                            .trim(),
-                    };
-                }
-                const rawSettings = JSON.parse(fs.readFileSync(agentSettingsPath, 'utf8'));
-                const settings = interpolateEnvVars(rawSettings);
-                // Create a temporary settings file with interpolated values (same approach as ClaudeRunner)
-                // This ensures $VAR placeholders are resolved before Hermes reads them
-                const tmpSettingsPath = path.join(path.dirname(agentSettingsPath), `settings_${agentName}_tmp.json`);
-                fs.writeFileSync(tmpSettingsPath, JSON.stringify(settings, null, 2), 'utf8');
-                this.tempFiles.push(tmpSettingsPath);
-                const interpolatedSettingsPath = tmpSettingsPath;
-                // Only use settings.model if it's a string (not a config object like {provider:"custom",...})
-                if (!options.model && typeof settings.model === 'string') {
-                    options.model = settings.model;
-                }
-                // Extract ANTHROPIC_MODEL from env (used by some agents like sniperbot_analyst)
-                if (!options.model && settings.env?.ANTHROPIC_MODEL && !settings.env.ANTHROPIC_MODEL.startsWith('$')) {
-                    options.model = settings.env.ANTHROPIC_MODEL;
-                }
-                // Extract ANTHROPIC_PROVIDER from env if present
-                if (!options.provider && settings.env?.ANTHROPIC_PROVIDER && !settings.env.ANTHROPIC_PROVIDER.startsWith('$')) {
-                    options.provider = settings.env.ANTHROPIC_PROVIDER;
-                }
-                if (settings.env) {
-                    // Fusion intelligente : préserver les clés critiques (API keys)
-                    const criticalKeys = [
-                        // OpenAI
-                        'OPENAI_API_KEY',
-                        'OPENAI_API_BASE',
-                        'OPENAI_BASE_URL',
-                        // Mistral
-                        'MISTRAL_API_KEY',
-                        'MISTRAL_API_KEY_2',
-                        'MISTRAL_API_KEY_3',
-                        'MISTRAL_API_KEY_4',
-                        'MISTRAL_API_KEY_5',
-                        'MISTRAL_API_KEY_6',
-                        'MISTRAL_API_KEY_7',
-                        // NVIDIA
-                        'NVIDIA_API_KEY',
-                        'NVAPI_KEY',
-                        'NVIDIA_API_BASE',
-                        // OpenRouter / Overmind
-                        'OPENROUTER_API_KEY',
-                        'OVERMIND_EMBEDDING_KEY',
-                        // MiniMax
-                        'MINIMAXI_API_KEY',
-                        // ZhipuAI / GLM
-                        'Z_AI_API_KEY',
-                        // Google / Gemini
-                        'GOOGLE_API_KEY',
-                        'GEMINI_API_KEY',
-                        // Anthropic
-                        'ANTHROPIC_API_KEY',
-                        'ANTHROPIC_AUTH_TOKEN',
-                    ];
-                    const envCopy = { ...settings.env };
-                    for (const key of criticalKeys) {
-                        if (agentCustomEnv[key] && !envCopy[key]) {
-                            envCopy[key] = agentCustomEnv[key];
+                const agentSettingsPath = resolveConfigPath(path.join(path.dirname(CONFIG.CLAUDE.PATHS.SETTINGS), `settings_${agentName}.json`), configPath);
+                if (fs.existsSync(agentSettingsPath)) {
+                    let settings = JSON.parse(fs.readFileSync(agentSettingsPath, 'utf8'));
+                    settings = interpolateEnvVars(settings);
+                    // Create temporary settings file
+                    const tempSettings = path.join(path.dirname(agentSettingsPath), `settings_${agentName}_tmp.json`);
+                    fs.writeFileSync(tempSettings, JSON.stringify(settings, null, 2));
+                    tmpSettingsPath = tempSettings;
+                    this.tempFiles.push(tempSettings);
+                    if (settings.env) {
+                        Object.assign(agentCustomEnv, settings.env);
+                        if (!options.model && settings.env.MODEL) {
+                            agentCustomEnv.ANTHROPIC_MODEL = settings.env.MODEL;
                         }
                     }
-                    Object.assign(agentCustomEnv, envCopy);
-                    // ─── Resolve $VAR placeholders in agentCustomEnv values ───────────────
-                    // Hermes reads from process.env, so any "$ANTHROPIC_AUTH_TOKEN_2" style
-                    // placeholders must be resolved NOW before Hermes is spawned.
-                    // We iterate all keys and replace known placeholders with resolved values.
-                    const placeholders = {
-                        'ANTHROPIC_AUTH_TOKEN_2': process.env.ANTHROPIC_AUTH_TOKEN_2,
-                        'ANTHROPIC_AUTH_TOKEN_Y': process.env.ANTHROPIC_AUTH_TOKEN_Y,
-                        'ANTHROPIC_AUTH_TOKEN_E': process.env.ANTHROPIC_AUTH_TOKEN_E,
-                        'ANTHROPIC_BASE_URL_2': process.env.ANTHROPIC_BASE_URL_2,
-                        'ANTHROPIC_BASE_URL_Y': process.env.ANTHROPIC_BASE_URL_Y,
-                        'ANTHROPIC_BASE_URL_E': process.env.ANTHROPIC_BASE_URL_E,
-                        'MINIMAXI_API_KEY_2': process.env.MINIMAXI_API_KEY_2,
-                        'OPENAI_API_KEY_2': process.env.OPENAI_API_KEY_2,
-                        'Z_AI_API_KEY_2': process.env.Z_AI_API_KEY_2,
-                    };
-                    for (const [key, value] of Object.entries(agentCustomEnv)) {
-                        if (typeof value === 'string' && value.startsWith('$')) {
-                            const resolved = placeholders[value.substring(1)];
-                            if (resolved) {
-                                agentCustomEnv[key] = resolved;
-                                if (!silent)
-                                    console.error(`[NousHermesRunner] Resolved ${key}=${value.substring(1)} (resolved)`);
-                            }
-                        }
+                    // MCP configurations
+                    const agentMcpPath = resolveConfigPath(path.join(path.dirname(CONFIG.CLAUDE.PATHS.SETTINGS), `.mcp.${agentName}.json`), configPath);
+                    if (fs.existsSync(agentMcpPath)) {
+                        // Write temporary mcp path
+                        const tempMcp = path.join(path.dirname(agentSettingsPath), `mcp_${agentName}_tmp.json`);
+                        fs.writeFileSync(tempMcp, fs.readFileSync(agentMcpPath, 'utf8'));
+                        tmpMcpPath = tempMcp;
+                        this.tempFiles.push(tempMcp);
                     }
-                    // Map ANTHROPIC_AUTH_TOKEN to provider-specific env vars
-                    // Hermes z-ai provider needs GLM_API_KEY, not ANTHROPIC_AUTH_TOKEN
-                    const providerForEnv = options.provider || settings.env?.ANTHROPIC_PROVIDER || '';
-                    if (providerForEnv.toLowerCase().includes('z-ai') || providerForEnv.toLowerCase().includes('zai')) {
-                        if (agentCustomEnv.ANTHROPIC_AUTH_TOKEN && !agentCustomEnv['GLM_API_KEY']) {
-                            agentCustomEnv['GLM_API_KEY'] = agentCustomEnv.ANTHROPIC_AUTH_TOKEN;
-                            if (!silent)
-                                console.error(`[NousHermesRunner] Mapped ANTHROPIC_AUTH_TOKEN → GLM_API_KEY for z-ai provider`);
-                        }
-                    }
-                }
-                // --- Load System Prompt (agents/agentName.md) ---
-                const agentPromptPath = resolveConfigPath(path.join(path.dirname(settingsDir), 'agents', `${agentName}.md`), options.configPath);
-                if (fs.existsSync(agentPromptPath)) {
-                    systemPrompt = fs.readFileSync(agentPromptPath, 'utf8');
-                }
-                // --- MCP Config Translation (JSON -> YAML for Hermes) ---
-                const agentMcpPath = resolveConfigPath(path.join(path.dirname(settingsDir), `.mcp.${agentName}.json`), options.configPath);
-                if (fs.existsSync(agentMcpPath)) {
-                    try {
-                        const rawMcpConfig = JSON.parse(fs.readFileSync(agentMcpPath, 'utf8'));
-                        const mcpConfig = interpolateEnvVars(rawMcpConfig);
-                        const hermesConfigDir = overmindHermesSubPath;
-                        if (!fs.existsSync(hermesConfigDir))
-                            fs.mkdirSync(hermesConfigDir, { recursive: true });
-                        const mcpJsonPath = path.join(hermesConfigDir, 'mcp.json');
-                        const configYamlPath = path.join(hermesConfigDir, 'config.yaml');
-                        // Helper pour convertir le format MCP JSON vers le format mcp.json Hermes (identique à Claude Desktop)
-                        fs.writeFileSync(mcpJsonPath, JSON.stringify(mcpConfig, null, 2), 'utf8');
-                        // Generer aussi config.yaml (format snake_case attendu par Hermes)
-                        let yamlContent = 'mcp_servers:\n';
-                        for (const [name, server] of Object.entries(mcpConfig.mcpServers || {})) {
-                            const s = server;
-                            yamlContent += `  ${name}:\n`;
-                            if (s.command)
-                                yamlContent += `    command: "${s.command}"\n`;
-                            if (s.args && Array.isArray(s.args)) {
-                                yamlContent += `    args:\n`;
-                                for (const arg of s.args) {
-                                    yamlContent += `      - "${String(arg).replace(/"/g, '\\"')}"\n`;
-                                }
-                            }
-                            if (s.env && typeof s.env === 'object') {
-                                yamlContent += `    env:\n`;
-                                for (const [k, v] of Object.entries(s.env)) {
-                                    yamlContent += `      ${k}: "${String(v).replace(/"/g, '\\"')}"\n`;
+                    else if (settings.enableAllProjectMcpServers === false &&
+                        Array.isArray(settings.enabledMcpjsonServers)) {
+                        const projectMcpPath = resolveConfigPath(CONFIG.CLAUDE.PATHS.MCP, configPath);
+                        if (fs.existsSync(projectMcpPath)) {
+                            const fullMcp = JSON.parse(fs.readFileSync(projectMcpPath, 'utf8'));
+                            const filteredMcp = { mcpServers: {} };
+                            for (const serverName of settings.enabledMcpjsonServers) {
+                                if (fullMcp.mcpServers && fullMcp.mcpServers[serverName]) {
+                                    filteredMcp.mcpServers[serverName] = fullMcp.mcpServers[serverName];
                                 }
                             }
-                            if (s.url)
-                                yamlContent += `    url: "${s.url}"\n`;
+                            const tempMcp = path.join(path.dirname(agentSettingsPath), `mcp_${agentName}_tmp.json`);
+                            fs.writeFileSync(tempMcp, JSON.stringify(filteredMcp, null, 2));
+                            tmpMcpPath = tempMcp;
+                            this.tempFiles.push(tempMcp);
                         }
-                        fs.writeFileSync(configYamlPath, yamlContent, 'utf8');
-                        // Remove the model config append - it uses 'provider: custom' which Hermes doesn't accept
-                        // Instead, rely on MINIMAX_BASE_URL_OVERRIDE + MINIMAXI_API_KEY env vars for MiniMaxi
-                        // The model config in config.yaml is not the right approach
-                        if (!silent)
-                            console.error(`[NousHermesRunner] 🛠️  Hermes configs (mcp.json & config.yaml) generated in ${hermesConfigDir}`);
-                    }
-                    catch (err) {
-                        logger.error({ error: err }, 'Error translating MCP config');
                     }
                 }
             }
             catch (e) {
-                if (e instanceof Error && e.message?.includes('INVALID_AGENT'))
-                    throw e;
-                logger.warn({ agentName, error: e }, 'Error processing agent settings');
+                logger.warn({ error: e }, `Failed to process settings/mcp configurations for Hermes agent ${agentName}`);
             }
-        }
-        // --- CLI Arguments & Prompt Handling ---
-        const finalPrompt = systemPrompt ? `${systemPrompt}\n\n[USER QUERY]:\n${prompt}` : prompt;
-        // Tronquer si nécessaire pour éviter les limites Windows (8191)
-        const MAX_PROMPT_LEN = 7000;
-        let cliPrompt = finalPrompt;
-        if (cliPrompt.length > MAX_PROMPT_LEN) {
-            console.warn(`[NousHermesRunner] ⚠️  Prompt tronqué de ${cliPrompt.length} à ${MAX_PROMPT_LEN} chars`);
-            cliPrompt = cliPrompt.substring(0, MAX_PROMPT_LEN);
-        }
-        // Hermes CLI modes:
-        // - `hermes -z <prompt>` : top-level one-shot (no banner, clean stdout, auto-exit)
-        // - `hermes chat -q <prompt>` : query mode with banner (interactive)
-        // - `hermes chat -z <prompt>` : INVALID (subcommand doesn't accept -z)
-        // We use top-level `-z` for runner mode (clean output, auto-exit).
-        const cleanArgs = ['-z', cliPrompt];
-        // --- Model & Provider selection ---
-        const DEFAULT_MODEL = 'tencent/hy3-preview:free'; // Modèle OpenRouter gratuit
-        const originalModel = options.model || DEFAULT_MODEL;
-        // Guard: ensure model is always a string (not an object from settings.model)
-        const modelStr = typeof originalModel === 'string' ? originalModel : DEFAULT_MODEL;
-        // Don't use resolveKiloModel here - it adds provider prefix like "minimax/" which
-        // causes Hermes to route to OpenRouter instead of MiniMaxi
-        const model = modelStr;
-        const isNvidiaModel = model.includes('deepseek') || model.includes('nvidia');
-        const hasNvidiaKey = !!(agentCustomEnv.NVIDIA_API_KEY || agentCustomEnv.NVAPI_KEY);
-        const lowModel = model.toLowerCase();
-        const isOpenAIModel = lowModel.includes('gpt') ||
-            lowModel.includes('o1') ||
-            lowModel.includes('o3');
-        const hasOpenAIKey = !!agentCustomEnv.OPENAI_API_KEY;
-        const isMiniMaxModel = lowModel.includes('minimax') || lowModel.includes('mini-max');
-        const hasMiniMaxKey = !!(agentCustomEnv.MINIMAXI_API_KEY ||
-            agentCustomEnv.ANTHROPIC_AUTH_TOKEN ||
-            agentCustomEnv.ANTHROPIC_AUTH_TOKEN_1 ||
-            agentCustomEnv.ANTHROPIC_AUTH_TOKEN_2 ||
-            agentCustomEnv.ANTHROPIC_AUTH_TOKEN_3 ||
-            agentCustomEnv.ANTHROPIC_AUTH_TOKEN_4);
-        const isGLMModel = lowModel.includes('glm');
-        const hasGLMKey = !!agentCustomEnv.Z_AI_API_KEY;
-        const isMistralModel = model.includes('mistral') || model.includes('codestral') || model.includes('devstral');
-        const hasMistralKey = !!agentCustomEnv.MISTRAL_API_KEY;
-        cleanArgs.push('--model', model);
-        if (isOpenAIModel && hasOpenAIKey) {
-            logger.info({ model, provider: 'openai' }, 'Using OpenAI provider');
-            cleanArgs.push('--provider', 'openai');
-            // Nettoyage des clés conflictuelles
-            delete agentCustomEnv.OPENROUTER_API_KEY;
-            delete agentCustomEnv.NVIDIA_API_KEY;
-            delete agentCustomEnv.NVAPI_KEY;
-            delete agentCustomEnv.MINIMAXI_API_KEY;
-            delete agentCustomEnv.Z_AI_API_KEY;
-        }
-        else if (isMiniMaxModel && hasMiniMaxKey) {
-            // Use minimax-cn provider which correctly uses api.minimaxi.com (NOT api.minimax.io)
-            // The minimax provider hardcodes api.minimax.io which is wrong for MiniMaxi
-            logger.info({ model, provider: 'minimax-cn' }, 'Using MiniMax via minimax-cn provider');
-            cleanArgs.push('--provider', 'minimax-cn');
-            // Write base_url to config.yaml later (see below, after config generation)
-            const resolvedMiniMaxKey = agentCustomEnv.ANTHROPIC_AUTH_TOKEN_4 ||
-                agentCustomEnv.ANTHROPIC_AUTH_TOKEN_3 ||
-                agentCustomEnv.ANTHROPIC_AUTH_TOKEN_2 ||
-                agentCustomEnv.ANTHROPIC_AUTH_TOKEN ||
-                agentCustomEnv.MINIMAXI_API_KEY ||
-                process.env.MINIMAXI_API_KEY;
-            if (resolvedMiniMaxKey) {
-                agentCustomEnv.ANTHROPIC_TOKEN = resolvedMiniMaxKey;
-                agentCustomEnv.ANTHROPIC_AUTH_TOKEN = resolvedMiniMaxKey;
-                agentCustomEnv.ANTHROPIC_AUTH_TOKEN_4 = resolvedMiniMaxKey;
-                agentCustomEnv.MINIMAXI_API_KEY = resolvedMiniMaxKey;
-                agentCustomEnv.MINIMAX_API_KEY = resolvedMiniMaxKey;
-                // minimax-cn provider reads MINIMAX_CN_API_KEY specifically
-                agentCustomEnv.MINIMAX_CN_API_KEY = resolvedMiniMaxKey;
-                // Force rewrite the auth.json so Hermes picks up the new key
+            // Load environment from isolated .env file (to allow overrides)
+            const envPath = path.join(overmindHermesSubPath, '.env');
+            if (fs.existsSync(envPath)) {
                 try {
-                    const authPath = path.join(process.env.HOME || process.env.USERPROFILE || '', '.hermes', 'auth.json');
-                    if (fs.existsSync(authPath)) {
-                        const auth = JSON.parse(fs.readFileSync(authPath, 'utf8'));
-                        if (auth.credential_pool?.['minimax-cn']?.[0]) {
-                            auth.credential_pool['minimax-cn'][0].access_token = resolvedMiniMaxKey;
-                            auth.credential_pool['minimax-cn'][0].last_status = null;
-                            auth.credential_pool['minimax-cn'][0].last_error_code = null;
-                            fs.writeFileSync(authPath, JSON.stringify(auth, null, 2), 'utf8');
-                            if (!silent)
-                                console.error(`[NousHermesRunner] Updated minimax-cn credential in auth.json`);
+                    const content = fs.readFileSync(envPath, 'utf8');
+                    content.split('\n').forEach((line) => {
+                        const trimmed = line.trim();
+                        if (!trimmed || trimmed.startsWith('#'))
+                            return;
+                        const eqIdx = trimmed.indexOf('=');
+                        if (eqIdx === -1)
+                            return;
+                        const key = trimmed.slice(0, eqIdx).trim();
+                        let value = trimmed.slice(eqIdx + 1).trim();
+                        if (value.startsWith('"') && value.endsWith('"'))
+                            value = value.slice(1, -1);
+                        else if (value.startsWith("'") && value.endsWith("'"))
+                            value = value.slice(1, -1);
+                        if (key) {
+                            agentCustomEnv[key] = value;
                         }
-                    }
+                    });
+                }
+                catch (e) {
+                    logger.warn({ envPath, error: e }, 'Failed to read agent env file');
                 }
-                catch (e) { /* non-critical */ }
-                if (!silent)
-                    console.error(`[NousHermesRunner] Set ANTHROPIC_AUTH_TOKEN_4 for MiniMax via minimax-cn`);
             }
-            delete agentCustomEnv.OPENROUTER_API_KEY;
-            delete agentCustomEnv.OVERMIND_EMBEDDING_KEY;
-            delete agentCustomEnv.NVIDIA_API_KEY;
-            delete agentCustomEnv.NVIDIA_API_BASE;
-            delete agentCustomEnv.NVAPI_KEY;
-            delete agentCustomEnv.OPENAI_API_KEY;
-            delete agentCustomEnv.Z_AI_API_KEY;
-        }
-        else if (isGLMModel && hasGLMKey) {
-            logger.info({ model, provider: 'z-ai' }, 'Using ZhipuAI/GLM provider');
-            cleanArgs.push('--provider', 'z-ai');
-            // Hermes z-ai provider needs GLM_API_KEY specifically
-            const resolvedGLMKey = agentCustomEnv.Z_AI_API_KEY;
-            if (resolvedGLMKey) {
-                agentCustomEnv['GLM_API_KEY'] = resolvedGLMKey;
+            resolvedModel = agentCustomEnv.MODEL || agentCustomEnv.ANTHROPIC_MODEL;
+            resolvedProvider = agentCustomEnv.PROVIDER || agentCustomEnv.ANTHROPIC_PROVIDER;
+            if (resolvedProvider && (resolvedProvider.startsWith('http://') || resolvedProvider.startsWith('https://'))) {
+                if (resolvedProvider.includes('minimax')) {
+                    resolvedProvider = 'minimax-cn';
+                }
+                else if (resolvedProvider.includes('z.ai') || resolvedProvider.includes('bigmodel')) {
+                    resolvedProvider = 'zai';
+                }
+                else {
+                    resolvedProvider = undefined;
+                }
             }
-            // Nettoyage des clés conflictuelles
-            delete agentCustomEnv.OPENROUTER_API_KEY;
-            delete agentCustomEnv.NVIDIA_API_KEY;
-            delete agentCustomEnv.NVAPI_KEY;
-            delete agentCustomEnv.OPENAI_API_KEY;
-            delete agentCustomEnv.MINIMAXI_API_KEY;
-            delete agentCustomEnv.ANTHROPIC_AUTH_TOKEN_4;
-        }
-        else if (isMistralModel && hasMistralKey) {
-            logger.info({ model, provider: 'mistral' }, 'Using Mistral provider');
-            cleanArgs.push('--provider', 'mistral');
-            // Nettoyage des clés conflictuelles
-            delete agentCustomEnv.OPENROUTER_API_KEY;
-            delete agentCustomEnv.NVIDIA_API_KEY;
-            delete agentCustomEnv.NVAPI_KEY;
-            delete agentCustomEnv.OPENAI_API_KEY;
         }
-        else if (isNvidiaModel && hasNvidiaKey) {
-            logger.info({ model, provider: 'nvidia' }, 'Using NVIDIA NIM provider');
-            cleanArgs.push('--provider', 'nvidia');
-        }
-        else {
-            // Fallback OpenRouter pour tout le reste ou si clé NIM manquante
-            logger.info({ model, provider: 'openrouter' }, 'Using OpenRouter provider');
-            cleanArgs.push('--provider', 'openrouter');
+        const finalModel = options.model || resolvedModel || CONFIG.HERMES.DEFAULT_MODEL;
+        const finalPrompt = systemPrompt ? `${systemPrompt}\n\n[USER QUERY]:\n${prompt}` : prompt;
+        const cliPrompt = finalPrompt.length > 7000 ? finalPrompt.substring(0, 7000) : finalPrompt;
+        // Build CLI args: chat -q (persistent session, NOT -z oneshot)
+        // -z + --resume doesn't work — resume is ignored in oneshot mode
+        const cleanArgs = ['chat', '-q', cliPrompt, '-Q'];
+        cleanArgs.push('--model', finalModel);
+        if (options.provider || resolvedProvider) {
+            cleanArgs.push('--provider', options.provider || resolvedProvider);
         }
-        // Re-write .env with all provider-specific keys now resolved (e.g. GLM_API_KEY for z-ai)
-        const defaultHermesHome = path.join(process.env.HOME || process.env.USERPROFILE || '', '.hermes');
-        writeHermesDotEnv(path.join(overmindHermesSubPath, '.env'));
-        writeHermesDotEnv(path.join(defaultHermesHome, '.env'));
-        // --- Hermes-native flags: --resume, --mcp-config ---
-        // NOTE: --name is NOT supported by Hermes CLI v0.11.0+ (unrecognized argument error).
-        // Session naming works via --resume or --continue, not --name.
-        // --resume: continue existing session
-        if (sessionId) {
+        if (sessionId)
             cleanArgs.push('--resume', sessionId);
+        // Token fallback setup (same as ClaudeRunner)
+        const FALLBACK_KEYS = ['AUTH_FALLBACK_1', 'AUTH_FALLBACK_2', 'AUTH_FALLBACK_3'];
+        const TOKEN_KEYS = ['ANTHROPIC_AUTH_TOKEN', 'ANTHROPIC_AUTH_TOKEN_E', 'GLM_API_KEY', 'Z_AI_API_KEY', 'MINIMAX_CN_API_KEY'];
+        const getAvailableFallbacks = () => {
+            const fb = [];
+            for (const k of FALLBACK_KEYS) {
+                const v = agentCustomEnv[k];
+                if (v && typeof v === 'string' && v.length > 0)
+                    fb.push({ key: k, value: v });
+            }
+            return fb;
+        };
+        const getTokenForIndex = (idx) => {
+            if (idx === 0) {
+                for (const tk of TOKEN_KEYS) {
+                    const v = agentCustomEnv[tk];
+                    if (v && typeof v === 'string' && v.length > 0)
+                        return { tokenEnvKey: tk, tokenValue: v };
+                }
+                return null;
+            }
+            const fb = getAvailableFallbacks();
+            return fb[idx - 1] ? { tokenEnvKey: fb[idx - 1].key, tokenValue: fb[idx - 1].value } : null;
+        };
+        const isRetryableError = (stderr) => {
+            const lower = stderr.toLowerCase();
+            return lower.includes('401') || lower.includes('unauthorized') ||
+                lower.includes('invalid api key') || lower.includes('authentication failed') ||
+                lower.includes('invalid authentication') || lower.includes('429') ||
+                lower.includes('rate limit') || lower.includes('quota exhausted') ||
+                lower.includes('limit exhausted') || lower.includes('503') ||
+                lower.includes('service unavailable') || lower.includes('500') ||
+                lower.includes('internal server error');
+        };
+        // HERMES_HOME setup
+        if (!fs.existsSync(overmindHermesSubPath))
+            fs.mkdirSync(overmindHermesSubPath, { recursive: true });
+        agentCustomEnv.HERMES_HOME = overmindHermesSubPath;
+        if (process.platform === 'win32')
+            agentCustomEnv.USERPROFILE = overmindHermesPath;
+        else
+            agentCustomEnv.HOME = overmindHermesPath;
+        // Write .env to HERMES_HOME (credential auto-discovery) - Cleaned to prevent duplicates
+        // EXCLUDE all OpenRouter keys — OpenRouter is managed internally by Overmind, Hermes must never see it
+        const credRegex = /(?:api_key|auth_token|base_url|endpoint|url)$/i;
+        const openRouterPrefixes = ['OPENROUTER', 'OVERMIND_EMBEDDING'];
+        const envMap = new Map();
+        const dotPath = path.join(overmindHermesSubPath, '.env');
+        if (fs.existsSync(dotPath)) {
+            try {
+                const existing = fs.readFileSync(dotPath, 'utf8');
+                existing.split('\n').forEach((line) => {
+                    const trimmed = line.trim();
+                    if (!trimmed || trimmed.startsWith('#'))
+                        return;
+                    const eqIdx = trimmed.indexOf('=');
+                    if (eqIdx === -1)
+                        return;
+                    const k = trimmed.slice(0, eqIdx).trim();
+                    let v = trimmed.slice(eqIdx + 1).trim();
+                    if (v.startsWith('"') && v.endsWith('"'))
+                        v = v.slice(1, -1);
+                    else if (v.startsWith("'") && v.endsWith("'"))
+                        v = v.slice(1, -1);
+                    if (k) {
+                        if (openRouterPrefixes.some(p => k.toUpperCase().startsWith(p)))
+                            return;
+                        envMap.set(k, v);
+                    }
+                });
+            }
+            catch (e) {
+                logger.warn({ envPath: dotPath, error: e }, 'Failed to read existing agent env file for deduplication');
+            }
         }
-        // --mcp-config: point Hermes to our generated config.yaml
-        // Generated at lines 419-448 in overmindHermesSubPath
-        const configYamlPath = path.join(overmindHermesSubPath, 'config.yaml');
-        if (fs.existsSync(configYamlPath)) {
-            cleanArgs.push('--mcp-config', configYamlPath);
-            this.tempFiles.push(path.join(overmindHermesSubPath, 'mcp.json'), configYamlPath);
+        for (const [k, v] of Object.entries(agentCustomEnv)) {
+            if (typeof v === 'string' && v.length > 0 && credRegex.test(k)) {
+                if (openRouterPrefixes.some(p => k.toUpperCase().startsWith(p)))
+                    continue;
+                envMap.set(k, v);
+            }
+        }
+        const finalDotEntries = [];
+        for (const [k, v] of envMap.entries()) {
+            finalDotEntries.push(`${k}=${v}`);
         }
-        // --hermes-dir: isolate this agent's hermes state (auth.json, .env, sessions)
-        // Pass via HERMES_DIR env var (not as CLI flag — --hermes-dir is only for subcommands like "chat")
-        const hermesDirEnv = { HERMES_DIR: overmindHermesSubPath };
-        // --- Find Hermes Binary (cross-platform) ---
-        const spawnCommand = await findHermesBinary();
-        if (!silent) {
-            logger.info({ command: spawnCommand, args: cleanArgs }, 'Starting Hermes Agent');
+        fs.writeFileSync(dotPath, finalDotEntries.join('\n') + '\n', 'utf8');
+        // Generate config.yaml in HERMES_HOME (MCP servers)
+        if (tmpMcpPath && fs.existsSync(tmpMcpPath)) {
+            try {
+                const mc = JSON.parse(fs.readFileSync(tmpMcpPath, 'utf8'));
+                const yamlPath = path.join(overmindHermesSubPath, 'config.yaml');
+                // Preserve existing config.yaml (tts, llm, etc.) — merge mcp_servers only
+                let existingYaml = '';
+                if (fs.existsSync(yamlPath)) {
+                    existingYaml = fs.readFileSync(yamlPath, 'utf8');
+                }
+                // Build new mcp_servers section
+                let newMcpSection = 'mcp_servers:\n';
+                for (const [name, srv] of Object.entries(mc.mcpServers || {})) {
+                    const s = srv;
+                    newMcpSection += `  ${name}:\n`;
+                    if (s.url)
+                        newMcpSection += `    url: "${s.url}"\n`;
+                    if (s.command)
+                        newMcpSection += `    command: "${s.command}"\n`;
+                }
+                // Merge: replace mcp_servers block in existing yaml or append
+                let finalYaml;
+                if (existingYaml.includes('mcp_servers:')) {
+                    finalYaml = existingYaml.replace(/mcp_servers:\n([\s\S]*?)(?=\n\w|\n$|$)/, newMcpSection.trimEnd() + '\n');
+                }
+                else {
+                    finalYaml = existingYaml.trimEnd() + '\n' + newMcpSection;
+                }
+                fs.writeFileSync(yamlPath, finalYaml, 'utf8');
+                if (!silent)
+                    console.error(`[NousHermesRunner] MCP config.yaml written to ${yamlPath}`);
+            }
+            catch (e) {
+                console.error(`[NousHermesRunner] config.yaml error: ${e}`);
+            }
         }
+        // AbortSignal
+        if (options.signal?.aborted)
+            return Promise.reject(new Error('ABORTED'));
+        let currentChildRef = null;
         return new Promise((resolve) => {
             let resolved = false;
-            const safeResolve = (value) => {
-                if (!resolved) {
-                    resolved = true;
-                    resolve(value);
+            let retryCount = 0;
+            const maxRetries = getAvailableFallbacks().length + 1;
+            let currentSessionId = sessionId;
+            const safeResolve = (v) => { if (!resolved) {
+                resolved = true;
+                resolve(v);
+            } };
+            const cleanupTmpFiles = () => {
+                for (const f of [tmpSettingsPath, tmpMcpPath]) {
+                    if (f && fs.existsSync(f)) {
+                        try {
+                            fs.unlinkSync(f);
+                        }
+                        catch { /* ignored */ }
+                    }
                 }
             };
-            // shell: false if absolute path (direct binary), true if just "hermes" (needs PATH resolution)
-            const useShell = !path.isAbsolute(spawnCommand);
-            const child = spawn(spawnCommand, cleanArgs, {
-                cwd: options.cwd || process.cwd(),
-                shell: useShell,
-                windowsHide: true,
-                env: { ...agentCustomEnv, HERMES_DIR: overmindHermesSubPath },
-            });
-            if (child.pid) {
-                void registerProcess(child.pid, { agentName: agentName || '', runner: 'hermes', configPath: options.configPath });
-            }
-            let stdout = '';
-            let stderr = '';
-            child.stdout?.on('data', (d) => {
-                const chunk = d.toString();
-                if (child.pid)
-                    void appendOutput(child.pid, chunk, options.configPath);
-                if (stdout.length + chunk.length > this.MAX_BUF) {
-                    stdout = stdout.slice(-this.MAX_BUF);
-                }
-                stdout += chunk;
-                if (!silent) {
-                    process.stderr.write(`[Hermes] ${chunk}`);
-                }
-            });
-            child.stderr?.on('data', (d) => {
-                const chunk = d.toString();
-                if (stderr.length + chunk.length > this.MAX_BUF) {
-                    stderr = stderr.slice(-this.MAX_BUF);
+            const writeAuthJson = (tokenInfo) => {
+                if (!tokenInfo || !overmindHermesSubPath)
+                    return;
+                try {
+                    const authPath = path.join(overmindHermesSubPath, 'auth.json');
+                    const auth = { version: 1, providers: {}, credential_pool: {} };
+                    if (fs.existsSync(authPath))
+                        Object.assign(auth, JSON.parse(fs.readFileSync(authPath, 'utf8')));
+                    if (!auth.credential_pool)
+                        auth.credential_pool = {};
+                    const cleanCp = auth.credential_pool;
+                    // Déterminer le provider effectif (CLI > settings)
+                    const effectiveProvider = resolvedProvider || 'zai';
+                    cleanCp[effectiveProvider] = [{
+                            id: `${effectiveProvider}-default`, label: tokenInfo.tokenEnvKey, auth_type: 'api_key',
+                            priority: 0, source: `env:${tokenInfo.tokenEnvKey}`, access_token: tokenInfo.tokenValue,
+                            last_status: null, last_error_code: null,
+                            base_url: agentCustomEnv['GLM_BASE_URL'] || agentCustomEnv['ANTHROPIC_BASE_URL'] || 'https://api.z.ai/api/coding/paas/v4',
+                            request_count: 0,
+                        }];
+                    fs.writeFileSync(authPath, JSON.stringify(auth, null, 2), 'utf8');
+                    // Écrire .env pour OVERMIND_AGENT_HOME — le provider effective détermine la clé d'env à écrire
+                    // minimax-cn attend MINIMAX_CN_API_KEY, zai attend GLM_API_KEY (ou ANTHROPIC_AUTH_TOKEN)
+                    const dotEnvPath = path.join(overmindHermesSubPath, '.env');
+                    const baseUrl = agentCustomEnv['GLM_BASE_URL'] || agentCustomEnv['ANTHROPIC_BASE_URL'] || 'https://api.z.ai/api/coding/paas/v4';
+                    const dotLines = [
+                        `ANTHROPIC_PROVIDER=${effectiveProvider}`,
+                        `ANTHROPIC_BASE_URL=${baseUrl}`,
+                    ];
+                    // Le provider determine quelle variable d'env écrire dans .env pour seed credentials
+                    if (effectiveProvider === 'minimax-cn') {
+                        dotLines.unshift(`MINIMAX_CN_API_KEY=${tokenInfo.tokenValue}`);
+                    }
+                    else if (effectiveProvider === 'zai' || effectiveProvider === 'z-ai') {
+                        dotLines.unshift(`GLM_API_KEY=${tokenInfo.tokenValue}`);
+                    }
+                    else {
+                        // Default: ANTHROPIC_AUTH_TOKEN
+                        dotLines.unshift(`ANTHROPIC_AUTH_TOKEN=${tokenInfo.tokenValue}`);
+                    }
+                    fs.writeFileSync(dotEnvPath, dotLines.join('\n') + '\n', 'utf8');
                 }
-                stderr += chunk;
-                if (!silent) {
-                    process.stderr.write(`[Hermes:ERR] ${chunk}`);
+                catch (_e) { /* non-critical */ }
+            };
+            const spawnHermes = async (tokenInfo) => {
+                const spawnEnv = { ...process.env, ...agentCustomEnv };
+                if (tokenInfo) {
+                    for (const tk of TOKEN_KEYS)
+                        delete spawnEnv[tk];
+                    let resolvedToken = tokenInfo.tokenValue;
+                    if (resolvedToken.startsWith('$'))
+                        resolvedToken = process.env[resolvedToken.slice(1)] || resolvedToken;
+                    spawnEnv[tokenInfo.tokenEnvKey] = resolvedToken;
                 }
-            });
-            const timeout = setTimeout(() => {
-                killProcessTree(child);
-                if (child.pid)
-                    void updateProcessStatus(child.pid, 'failed', null, options.configPath);
-                safeResolve({
-                    result: stdout.trim(),
-                    error: 'TIMEOUT',
-                    rawOutput: stdout + '\n\n' + stderr,
-                    model,
-                    nickname: originalModel !== model ? originalModel : undefined,
+                writeAuthJson(tokenInfo);
+                // BLOCK: OpenRouter is for embeddings only — never pass to Hermes for LLM inference
+                delete spawnEnv['OPENROUTER_API_KEY'];
+                delete spawnEnv['OPENROUTER_BASE_URL'];
+                delete spawnEnv['OVERMIND_EMBEDDING_KEY'];
+                const hermesBin = await findHermesBinary();
+                const child = spawn(hermesBin, cleanArgs, {
+                    cwd, shell: false, windowsHide: true,
+                    env: {
+                        ...spawnEnv,
+                        HERMES_HOME: overmindHermesSubPath,
+                        VIRTUAL_ENV: process.env.HERMES_AGENT_ROOT
+                            ? path.join(process.env.HERMES_AGENT_ROOT, 'venv')
+                            : path.join(process.env.LOCALAPPDATA || '', 'hermes', 'hermes-agent', 'venv'),
+                        PATH: `${process.env.HERMES_AGENT_ROOT || path.join(process.env.LOCALAPPDATA || '', 'hermes', 'hermes-agent', 'venv')};${process.env.PATH || ''}`,
+                    },
                 });
-            }, this.timeoutMs);
-            // AbortSignal support (like ClaudeRunner)
-            if (options.signal) {
-                const onAbort = () => {
-                    clearTimeout(timeout);
-                    killProcessTree(child);
-                    if (child.pid)
-                        void updateProcessStatus(child.pid, 'failed', null, options.configPath);
-                    safeResolve({
-                        result: stdout.trim(),
-                        error: 'ABORTED',
-                        rawOutput: stdout + '\n\n' + stderr,
-                        model,
-                        nickname: originalModel !== model ? originalModel : undefined,
+                currentChildRef = child;
+                if (child.pid) {
+                    void registerProcess(child.pid, { agentName: agentName || '', runner: 'hermes', configPath });
+                    void registerLiveAgent({
+                        pid: child.pid, runner: 'hermes', agentName: agentName || '',
+                        sessionId: currentSessionId || '',
+                        cleanupFn: async () => { await killProcessTree(child); },
+                        childRef: child,
                     });
-                };
-                if (options.signal.aborted) {
-                    onAbort();
-                }
-                else {
-                    options.signal.addEventListener('abort', onAbort, { once: true });
-                }
-            }
-            child.on('close', async (code) => {
-                clearTimeout(timeout);
-                if (child.pid)
-                    void updateProcessStatus(child.pid, code === 0 ? 'done' : 'failed', code, options.configPath);
-                // Parse session ID from Hermes output (e.g. "Session: 20260515_204158_7093cd")
-                // This works even when Hermes exits with error, as the banner is still printed
-                let parsedSessionId = sessionId;
-                const sessionMatch = stdout.match(/Session:\s+(\S+)/);
-                if (sessionMatch) {
-                    parsedSessionId = sessionMatch[1];
-                }
-                // Hermes exits code 2 on API errors (e.g. max_tokens > 40000).
-                // When stdout has content, return it even on non-zero exit — it's useful output.
-                if (code !== 0 && !stdout) {
-                    return safeResolve({
-                        result: '',
-                        error: `EXIT_CODE_${code}`,
-                        rawOutput: stderr || stdout,
-                        sessionId: parsedSessionId,
-                        model,
-                        nickname: originalModel !== model ? originalModel : undefined,
+                    child.once('exit', (code) => {
+                        setLiveStatus(child.pid, code === 0 ? 'done' : 'failed', code ?? null);
+                        void unregisterLiveAgent(child.pid);
                     });
                 }
-                safeResolve({
-                    result: stdout.trim(),
-                    sessionId: parsedSessionId,
-                    rawOutput: stdout,
-                    model,
-                    nickname: originalModel !== model ? originalModel : undefined,
+                let stdout = '';
+                let stderr = '';
+                child.stdout?.on('data', (d) => {
+                    const chunk = d.toString();
+                    if (child.pid) {
+                        void appendOutput(child.pid, chunk, configPath);
+                        void appendLiveOutput(child.pid, chunk);
+                    }
+                    if (stdout.length + chunk.length > MAX_BUF)
+                        stdout = stdout.slice(-MAX_BUF);
+                    else
+                        stdout += chunk;
+                    if (!silent && agentName)
+                        process.stderr.write(`[Hermes:${agentName}] ${chunk}`);
                 });
+                child.stderr?.on('data', (d) => {
+                    const chunk = d.toString();
+                    if (stderr.length + chunk.length > MAX_BUF)
+                        stderr = stderr.slice(-MAX_BUF);
+                    else
+                        stderr += chunk;
+                    if (!silent && agentName)
+                        process.stderr.write(`[Hermes:${agentName}:ERR] ${chunk}`);
+                });
+                const timer = setTimeout(() => {
+                    if (child.stdin && !child.stdin.destroyed) {
+                        try {
+                            child.stdin.write('\n');
+                        }
+                        catch { /* ignore */ }
+                    }
+                    setTimeout(async () => {
+                        await killProcessTree(child);
+                        cleanupTmpFiles();
+                        safeResolve({ result: '', error: 'HARD_TIMEOUT', rawOutput: stdout + stderr });
+                    }, HARD_TIMEOUT_MS);
+                }, timeoutMs);
+                child.on('close', async (code) => {
+                    clearTimeout(timer);
+                    if (child.pid)
+                        void updateProcessStatus(child.pid, code === 0 ? 'done' : 'failed', code, configPath);
+                    const sessionMatch = stdout.match(/session_id:\s*(\S+)/i) ||
+                        stderr.match(/session_id:\s*(\S+)/i) ||
+                        stdout.match(/Session:\s*(\S+)/) ||
+                        stderr.match(/Session:\s*(\S+)/);
+                    if (sessionMatch)
+                        currentSessionId = sessionMatch[1];
+                    const retryable = isRetryableError(stderr) || isRetryableError(stdout);
+                    if (code !== 0 && retryable && retryCount < maxRetries) {
+                        retryCount++;
+                        const ti = getTokenForIndex(retryCount);
+                        if (!silent) {
+                            process.stderr.write(`\n\x1b[41m\x1b[37m[NousHermesRunner] Retry ${retryCount}/${maxRetries} avec ${ti?.tokenEnvKey || 'UNKNOWN'}...\x1b[0m\n`);
+                        }
+                        await killProcessTree(child);
+                        setImmediate(() => spawnHermes(ti));
+                        return;
+                    }
+                    cleanupTmpFiles();
+                    if (currentSessionId && agentName) {
+                        await saveSessionId(agentName, currentSessionId, configPath, 'hermes');
+                        if (child.pid)
+                            void linkSessionToPid(currentSessionId, child.pid, configPath);
+                    }
+                    if (code !== 0 && !stdout.trim()) {
+                        safeResolve({ result: '', error: `EXIT_CODE_${code}`, rawOutput: stderr || stdout, sessionId: currentSessionId });
+                        return;
+                    }
+                    safeResolve({ result: stdout.trim(), sessionId: currentSessionId, rawOutput: stdout });
+                });
+                child.on('error', (err) => {
+                    clearTimeout(timer);
+                    killProcessTree(child).then(() => {
+                        cleanupTmpFiles();
+                        safeResolve({ result: '', error: `SPAWN_ERROR: ${err.message}`, rawOutput: '' });
+                    });
+                });
+            };
+            options.signal?.addEventListener('abort', () => {
+                if (currentChildRef)
+                    killProcessTree(currentChildRef).then(() => {
+                        cleanupTmpFiles();
+                        safeResolve({ result: '', error: 'ABORTED', rawOutput: '' });
+                    });
             });
-            child.on('error', (err) => {
-                clearTimeout(timeout);
-                if (child.pid)
-                    void updateProcessStatus(child.pid, 'failed', null, options.configPath);
-                safeResolve({ result: '', error: `SPAWN_ERROR: ${err.message}`, rawOutput: '' });
-            });
-            // Do NOT call child.stdin.end() — it sends EOF and Hermes closes.
-            // Keep stdin open so Hermes stays alive for resume.
+            spawnHermes(getTokenForIndex(0));
         });
     }
 }
-/**
- * Run agent with proper cleanup and telemetry
- */
-async function runAgentWrapper(options) {
-    try {
-        const result = await withSpan('hermes.runAgent', async (span) => {
-            span.setAttribute('agentName', options.agentName || '');
-            span.setAttribute('model', options.model || '');
-            span.setAttribute('runner', 'hermes');
-            return await this.runAgentInternal(options);
-        }, {
-            agentName: options.agentName || '',
-            model: options.model || '',
-            runner: 'hermes',
-        });
-        // Cleanup on success
-        this.cleanupTempFiles();
-        // Save session if needed
-        if (options.agentName && result.sessionId) {
-            await saveSessionId(options.agentName, result.sessionId, options.configPath, 'hermes');
-        }
-        return result;
-    }
-    catch (error) {
-        // Cleanup on error
-        this.cleanupTempFiles();
-        logger.error({
-            error: error instanceof Error ? error.message : String(error),
-            agentName: options.agentName,
-        }, 'Hermes runner failed');
-        throw error;
-    }
-}
 //# sourceMappingURL=NousHermesRunner.js.map