overmind-mcp 2.8.43 → 2.8.45

package/dist/services/NousHermesRunner.js

@@ -1,7 +1,7 @@
 import fs from 'fs';
 import path from 'path';
 import { spawn } from 'child_process';
-import { exec } from 'child_process';
+import { exec, execSync } from 'child_process';
 import { promisify } from 'util';
 import { CONFIG, resolveConfigPath, getWorkspaceDir, getAgentHermesHome, getAgentOvermindHome, getSharedHermesHome } from '../lib/config.js';
 import { getLastSessionId, saveSessionId } from '../lib/sessions.js';
@@ -18,34 +18,55 @@ const logger = pino({ name: 'NousHermesRunner' });
 // orphelin. On utilise taskkill /F /T pour propager le kill au sous-arbre complet.
 const killProcessTree = (child) => {
     return new Promise((resolve) => {
-        if (!child || child.exitCode !== null || child.killed) {
+        if (!child) {
+            logger.debug('[KILL] No child process reference provided.');
             resolve();
             return;
         }
+        if (child.exitCode !== null || child.killed) {
+            logger.debug({ pid: child.pid, exitCode: child.exitCode, killed: child.killed }, '[KILL] Process is already dead or marked killed.');
+            resolve();
+            return;
+        }
+        logger.info({ pid: child.pid }, '[KILL] Initiating process tree termination...');
         let settled = false;
         const finish = () => {
             if (settled)
                 return;
             settled = true;
+            logger.debug({ pid: child.pid }, '[KILL] Process tree termination sequence completed.');
             resolve();
         };
         child.once('exit', finish);
-        if (process.platform === 'win32' && child.pid) {
-            exec(`taskkill /F /T /PID ${child.pid}`, () => {
-                // taskkill peut échouer si le process est déjà mort
+        if (process.platform === 'win32' && child.pid && typeof child.pid === 'number' && child.pid > 0) {
+            const cmd = `taskkill /F /T /PID ${child.pid}`;
+            logger.debug({ cmd }, '[KILL] Executing Windows taskkill...');
+            exec(cmd, (err, stdout, stderr) => {
+                if (err) {
+                    logger.debug({ err, stderr }, '[KILL] taskkill failed or process was already dead.');
+                }
+                else {
+                    logger.debug({ stdout }, '[KILL] taskkill completed successfully.');
+                }
             });
         }
         else {
             try {
+                logger.debug({ pid: child.pid }, '[KILL] Dispatched SIGTERM signal.');
                 child.kill('SIGTERM');
             }
-            catch { /* ignored */ }
+            catch (e) {
+                logger.debug({ pid: child.pid, error: e }, '[KILL] SIGTERM dispatch failed.');
+            }
             setTimeout(() => {
                 if (child.exitCode === null && !child.killed) {
                     try {
+                        logger.warn({ pid: child.pid }, '[KILL] SIGTERM ignored. Escalating to SIGKILL...');
                         child.kill('SIGKILL');
                     }
-                    catch { /* ignored */ }
+                    catch (e) {
+                        logger.debug({ pid: child.pid, error: e }, '[KILL] SIGKILL dispatch failed.');
+                    }
                 }
             }, 2000);
         }
@@ -95,30 +116,33 @@ async function findHermesBinary() {
         // Not found in PATH
     }
     // 3. Platform-specific paths
-    const platformPaths = isWin
-        ? [
-            // Hermes venv (Nous Research install) — PRIORITÉ haute (v0.13.0, supporte -z)
-            path.join(process.env.LOCALAPPDATA || '', 'hermes', 'hermes-agent', 'venv', 'Scripts', 'hermes.exe'),
-            // Officiel installer Windows (install.ps1) — chemin natif
-            path.join(process.env.LOCALAPPDATA || '', 'hermes', 'bin', 'hermes.exe'),
-            path.join(process.env.LOCALAPPDATA || '', 'hermes', 'hermes.exe'),
-            // Fallback installations via pip (legacy)
-            path.join(process.env.LOCALAPPDATA || '', 'Programs', 'Python', 'Python312', 'Scripts', 'hermes.exe'),
-            path.join(process.env.APPDATA || '', 'Python', 'Python312', 'Scripts', 'hermes.exe'),
-            path.join(process.env.LOCALAPPDATA || '', 'Programs', 'Python', 'Python311', 'Scripts', 'hermes.exe'),
-            path.join(process.env.APPDATA || '', 'Python', 'Python311', 'Scripts', 'hermes.exe'),
-            'C:\\Python312\\Scripts\\hermes.exe',
-            'C:\\Python311\\Scripts\\hermes.exe',
-            'C:\\Program Files\\Hermes\\hermes.exe',
-        ]
-        : [
-            path.join(process.env.HOME || '', '.local', 'bin', 'hermes'),
-            path.join(process.env.HOME || '', 'miniconda3', 'bin', 'hermes'),
-            path.join(process.env.HOME || '', 'anaconda3', 'bin', 'hermes'),
-            '/usr/local/bin/hermes',
-            '/usr/bin/hermes',
-            '/opt/homebrew/bin/hermes',
-        ];
+    const platformPaths = [];
+    if (isWin) {
+        platformPaths.push(
+        // Hermes venv (Nous Research install) — PRIORITÉ haute (v0.13.0, supporte -z)
+        path.join(process.env.LOCALAPPDATA || '', 'hermes', 'hermes-agent', 'venv', 'Scripts', 'hermes.exe'), 
+        // Officiel installer Windows (install.ps1) — chemin natif
+        path.join(process.env.LOCALAPPDATA || '', 'hermes', 'bin', 'hermes.exe'), path.join(process.env.LOCALAPPDATA || '', 'hermes', 'hermes.exe'));
+        // Dynamically scan for Python versions in LOCALAPPDATA
+        const programsPython = path.join(process.env.LOCALAPPDATA || '', 'Programs', 'Python');
+        if (fs.existsSync(programsPython)) {
+            try {
+                const dirs = fs.readdirSync(programsPython);
+                for (const dir of dirs) {
+                    if (dir.toLowerCase().startsWith('python')) {
+                        platformPaths.push(path.join(programsPython, dir, 'Scripts', 'hermes.exe'));
+                    }
+                }
+            }
+            catch { /* ignored */ }
+        }
+        platformPaths.push(
+        // Fallback installations via pip (legacy)
+        path.join(process.env.LOCALAPPDATA || '', 'Programs', 'Python', 'Python312', 'Scripts', 'hermes.exe'), path.join(process.env.APPDATA || '', 'Python', 'Python312', 'Scripts', 'hermes.exe'), path.join(process.env.LOCALAPPDATA || '', 'Programs', 'Python', 'Python311', 'Scripts', 'hermes.exe'), path.join(process.env.APPDATA || '', 'Python', 'Python311', 'Scripts', 'hermes.exe'), 'C:\\Python312\\Scripts\\hermes.exe', 'C:\\Python311\\Scripts\\hermes.exe', 'C:\\Program Files\\Hermes\\hermes.exe');
+    }
+    else {
+        platformPaths.push(path.join(process.env.HOME || '', '.local', 'bin', 'hermes'), path.join(process.env.HOME || '', 'miniconda3', 'bin', 'hermes'), path.join(process.env.HOME || '', 'anaconda3', 'bin', 'hermes'), '/usr/local/bin/hermes', '/usr/bin/hermes', '/opt/homebrew/bin/hermes');
+    }
     for (const p of platformPaths) {
         if (fs.existsSync(p)) {
             logger.info({ path: p }, 'Found hermes at platform path');
@@ -148,21 +172,111 @@ async function findHermesBinary() {
     return 'hermes';
 }
 /**
- * NousHermesRunner — Runner polyglote pour Hermes Agent (Overmind 2.8.27+).
+ * NousHermesRunner — Runner Hermes Agent pour Overmind (v2.8.45+).
+ *
+ * ╔══════════════════════════════════════════════════════════════════════════════╗
+ * ║  ⭐ ARCHITECTURE CREDENTIALS HERMES — LIRE CECI EN PREMIER                 ║
+ * ╠══════════════════════════════════════════════════════════════════════════════╣
+ * ║                                                                              ║
+ * ║  Les credentials Hermes sont dans LE DOSSIER NATIF HERMES UNIQUEMENT :      ║
+ * ║                                                                              ║
+ * ║    <HERMES_HOME>/agents/<name>/settings.json                                 ║
+ * ║                                                                              ║
+ * ║  Sur Linux (npm -g) :  /home/demon/.overmind/hermes/agents/<name>/           ║
+ * ║  Sur Windows (dev)  :  Workflow/.overmind/hermes/agents/<name>/              ║
+ * ║                                                                              ║
+ * ║  ❌ .claude/settings_<name>.json → CLAUDE CODE / KILO SEULEMENT             ║
+ * ║  ❌ NousHermesRunner NE LIT JAMAIS depuis .claude/                          ║
+ * ║  ❌ Ne pas éditer hermes/agents/<name>/settings.json manuellement           ║
+ * ║     entre les runs — le runner le met à jour automatiquement.               ║
+ * ║                                                                              ║
+ * ║  FORMAT du settings.json Hermes :                                            ║
+ * ║  {                                                                           ║
+ * ║    "env": {                                                                  ║
+ * ║      "ANTHROPIC_AUTH_TOKEN":  "sk-cp-...",   ← token MiniMax / Z.AI        ║
+ * ║      "ANTHROPIC_BASE_URL":    "https://api.minimaxi.com/anthropic",          ║
+ * ║      "ANTHROPIC_MODEL":       "MiniMax-M3",                                  ║
+ * ║      "ANTHROPIC_PROVIDER":    "minimax-cn",                                  ║
+ * ║      "MINIMAX_CN_API_KEY":    "sk-cp-...",   ← injecté auto par le runner   ║
+ * ║      "MINIMAX_CN_BASE_URL":   "https://api.minimaxi.com/anthropic"           ║
+ * ║    },                                                                        ║
+ * ║    "enableAllProjectMcpServers": false,                                      ║
+ * ║    "enabledMcpjsonServers": ["memory", "discord", "postgres"],               ║
+ * ║    "agent": "<name>",                                                        ║
+ * ║    "runner": "hermes"                                                        ║
+ * ║  }                                                                           ║
+ * ║                                                                              ║
+ * ║  Supporte l'interpolation $VAR (ex: "$ANTHROPIC_AUTH_TOKEN_1")              ║
+ * ║  résolue depuis process.env au moment du spawn.                             ║
+ * ║                                                                              ║
+ * ║  HERMES_HOME résolu dans l'ordre :                                           ║
+ * ║    1. OVERMIND_HERMES_HOME (env var explicite, ex: systemd EnvironmentFile) ║
+ * ║    2. <OVERMIND_WORKSPACE>/.overmind/hermes/ (dev local)                    ║
+ * ║    3. ~/.overmind/hermes/ (Linux) / %LOCALAPPDATA%/overmind/hermes/ (Win)   ║
+ * ╚══════════════════════════════════════════════════════════════════════════════╝
  *
- *  • Providers : OpenAI, MiniMax GLOBAL/CN, Zhipu/GLM, Mistral, NVIDIA NIM, OpenRouter (embeddings only)
- *  • Lit settings_<agent>.json + .mcp.<agent>.json depuis .claude/ comme les autres runners
- *  • Interpolation $VAR et ${VAR} sur tout settings + mcp config (via envUtils, regex fix 2.8.25)
- *  • Subtilisation 3-pass (Pass 1: settings-explicit, Pass A: prefer provider-specific,
- *    Pass B: re-map generic key, Pass C: rare fallback) — see hermesTokenResolver.ts
- *  • CN/GLOBAL disambiguation for sk-cp-* via ANTHROPIC_BASE_URL (URL wins)
- *  • OVERMIND_MINIMAX_DEFAULT=cn|global|auto for setups where all MiniMax tokens are CN
- *  • HERMES_HOME resolved via getAgentHermesHome() — deterministic across cwd (2.8.27+)
- *    Priority: OVERMIND_AGENT_HOME > legacy workspace > $HOME/.overmind/hermes/agent_<name>/
- *  • auth.json credential_pool is PRUNED every run (keep version+oauth, drop stale creds)
- *    to prevent Hermes from picking an exhausted bucket from a previous provider config
- *  • HOME/USERPROFILE propagated to spawned Hermes so ~/.hermes lookups resolve canonically
+ *  • Providers supportés : MiniMax CN/GLOBAL, Z.AI/GLM, Mistral, OpenAI, NVIDIA NIM
+ *  • OpenRouter = embeddings UNIQUEMENT (bloqué pour LLM inference)
+ *  • auth.json purgé à chaque run (évite les credentials stale de l'ancien provider)
+ *  • HOME/USERPROFILE propagé au process Hermes pour résolution ~/.hermes canonique
+ *  • Voir hermesTokenResolver.ts pour le 3-pass token detection (sk-cp-/32hex/sk-ant-)
  */
+function filterConfigYaml(sourceYamlPath, allowedServers) {
+    try {
+        if (!fs.existsSync(sourceYamlPath))
+            return 'mcp_servers: {}\n';
+        const yamlText = fs.readFileSync(sourceYamlPath, 'utf8');
+        const lines = yamlText.split(/\r?\n/);
+        let inMcpServers = false;
+        let currentServerName = '';
+        const serverBlocks = {};
+        const headerLines = [];
+        for (const line of lines) {
+            const trimmed = line.trim();
+            if (line.match(/^mcp_servers:\s*$/) || line.match(/^mcp_servers:\s*#.*$/)) {
+                inMcpServers = true;
+                headerLines.push(line);
+                continue;
+            }
+            if (inMcpServers) {
+                const indentMatch = line.match(/^(\s+)/);
+                if (!indentMatch) {
+                    inMcpServers = false;
+                    headerLines.push(line);
+                    continue;
+                }
+                const indent = indentMatch[1].length;
+                const keyMatch = trimmed.match(/^([a-zA-Z0-9_-]+)\s*:/);
+                if (keyMatch && indent === 2) {
+                    currentServerName = keyMatch[1];
+                    serverBlocks[currentServerName] = [line];
+                }
+                else if (currentServerName) {
+                    serverBlocks[currentServerName].push(line);
+                }
+            }
+            else {
+                headerLines.push(line);
+            }
+        }
+        let result = '';
+        for (const line of headerLines) {
+            result += line + '\n';
+            if (line.match(/^mcp_servers:\s*$/) || line.match(/^mcp_servers:\s*#.*$/)) {
+                for (const srv of allowedServers) {
+                    if (serverBlocks[srv]) {
+                        result += serverBlocks[srv].join('\n') + '\n';
+                    }
+                }
+            }
+        }
+        return result;
+    }
+    catch (err) {
+        logger.error({ sourceYamlPath, error: err }, '[YAML_FILTER] Unexpected failure while filtering config.yaml.');
+        return 'mcp_servers: {}\n';
+    }
+}
 export class NousHermesRunner {
     timeoutMs;
     tempFiles = [];
@@ -171,20 +285,22 @@ export class NousHermesRunner {
         this.timeoutMs = CONFIG.TIMEOUT_MS || 900000; // 15 min default
     }
     cleanupTempFiles() {
+        logger.debug({ count: this.tempFiles.length }, '[CLEANUP] Cleaning up temporary run files.');
         for (const tempFile of this.tempFiles) {
             try {
                 if (fs.existsSync(tempFile)) {
                     fs.unlinkSync(tempFile);
-                    logger.debug({ tempFile }, 'Cleaned up temp file');
+                    logger.debug({ tempFile }, '[CLEANUP] Cleaned up temp file');
                 }
             }
             catch (err) {
-                logger.warn({ tempFile, error: err }, 'Failed to cleanup temp file');
+                logger.warn({ tempFile, error: err }, '[CLEANUP] Failed to cleanup temp file');
             }
         }
         this.tempFiles = [];
     }
     async runAgent(options) {
+        logger.info({ agentName: options.agentName, model: options.model, sessionId: options.sessionId }, '[RUN_AGENT] Initiating runAgent entrypoint.');
         try {
             const result = await withSpan('hermes.runAgent', async (span) => {
                 span.setAttribute('agentName', options.agentName || '');
@@ -198,13 +314,14 @@ export class NousHermesRunner {
             });
             this.cleanupTempFiles();
             if (options.agentName && result.sessionId) {
+                logger.info({ agentName: options.agentName, sessionId: result.sessionId }, '[RUN_AGENT] Saving completed session ID.');
                 await saveSessionId(options.agentName, result.sessionId, options.configPath, 'hermes');
             }
             return result;
         }
         catch (error) {
             this.cleanupTempFiles();
-            logger.error({ error: error instanceof Error ? error.message : String(error), agentName: options.agentName }, 'Hermes runner failed');
+            logger.error({ error: error instanceof Error ? error.message : String(error), agentName: options.agentName }, '[RUN_AGENT] Hermes runner execution flow threw an error.');
             throw error;
         }
     }
@@ -213,29 +330,60 @@ export class NousHermesRunner {
         let { sessionId } = options;
         const cwd = options.cwd || process.cwd();
         const configPath = options.configPath || getWorkspaceDir();
+        logger.info({ agentName, autoResume, cwd, configPath, silent }, '[RUN_AGENT_INTERNAL] Starting internal agent runner workflow.');
         // Load .env files FIRST
-        loadEnvQuietly(path.join(cwd, '.env'));
-        loadEnvQuietly(path.join(cwd, '../Workflow/.env'));
+        const envPaths = [path.join(cwd, '.env'), path.join(cwd, '../Workflow/.env')];
+        for (const envPath of envPaths) {
+            if (fs.existsSync(envPath)) {
+                logger.debug({ envPath }, '[RUN_AGENT_INTERNAL] Loading quiet environment file.');
+                loadEnvQuietly(envPath);
+            }
+            else {
+                logger.debug({ envPath }, '[RUN_AGENT_INTERNAL] Environment file not found, skipping.');
+            }
+        }
         // Auto Resume
         if (autoResume && agentName && !sessionId) {
+            logger.info({ agentName }, '[RUN_AGENT_INTERNAL] Auto-resume enabled. Querying last session ID.');
             const lastId = await getLastSessionId(agentName, configPath, 'hermes');
             if (lastId) {
                 sessionId = lastId;
                 if (!silent)
                     console.error(`[NousHermesRunner] Auto-resume session: ${sessionId}`);
+                logger.info({ sessionId }, '[RUN_AGENT_INTERNAL] Resolved last session ID for resume.');
+            }
+            else {
+                logger.info('[RUN_AGENT_INTERNAL] No previous session ID found for auto-resume.');
             }
         }
         const MAX_BUF = 10 * 1024 * 1024;
         const timeoutMs = this.timeoutMs;
         const HARD_TIMEOUT_MS = 60000;
-        // HERMES_HOME setup — use the canonical helper (multi-OS, multi-install safe).
-        // This replaces the previous cwd-relative resolution that caused HERMES_HOME
-        // drift between dev/prod installs and between different spawn cwd's.
+        // ═══════════════════════════════════════════════════════════════════════════
+        // HERMES_HOME — résolu via getAgentHermesHome() (multi-OS, multi-install).
+        //   Priorité : OVERMIND_HERMES_HOME > <workspace>/.overmind/hermes/ > ~/.overmind/hermes/
+        // ═══════════════════════════════════════════════════════════════════════════
         const overmindHermesPath = getAgentOvermindHome(agentName);
         const overmindHermesSubPath = getAgentHermesHome(agentName);
-        const agentSettingsPath = agentName ? resolveConfigPath(path.join(path.dirname(CONFIG.CLAUDE.PATHS.SETTINGS), `settings_${agentName}.json`), configPath) : '';
-        if (agentName && !fs.existsSync(overmindHermesPath) && !fs.existsSync(agentSettingsPath)) {
-            return { result: '', error: `INVALID_AGENT: Agent Hermes "${agentName}" non trouvé (HERMES_HOME=${overmindHermesSubPath}).` };
+        // ═══════════════════════════════════════════════════════════════════════════
+        // ⭐ CHEMIN CREDENTIALS HERMES — SOURCE DE VÉRITÉ UNIQUE
+        //
+        //   <HERMES_HOME>/agents/<name>/settings.json
+        //
+        // ❌ NE PAS utiliser .claude/settings_<name>.json — c'est pour Claude/Kilo.
+        // ❌ Ce fichier EST le fichier natif Hermes. Le runner le lit ET le met à jour.
+        // ═══════════════════════════════════════════════════════════════════════════
+        const agentSettingsPath = agentName ? path.join(overmindHermesSubPath, 'settings.json') : '';
+        if (agentName && !fs.existsSync(overmindHermesSubPath)) {
+            return {
+                result: '',
+                error: `INVALID_AGENT: Dossier Hermes manquant pour l'agent "${agentName}". ` +
+                    `Créez le dossier et le fichier : ${agentSettingsPath} ` +
+                    `avec { "env": { "ANTHROPIC_AUTH_TOKEN": "sk-cp-...", ` +
+                    `"ANTHROPIC_BASE_URL": "https://api.minimaxi.com/anthropic", ` +
+                    `"ANTHROPIC_MODEL": "MiniMax-M3", "ANTHROPIC_PROVIDER": "minimax-cn" }, ` +
+                    `"agent": "${agentName}", "runner": "hermes" }`,
+            };
         }
         // Load agent settings + MCP config (same pattern as ClaudeRunner)
         let systemPrompt = '';
@@ -243,7 +391,7 @@ export class NousHermesRunner {
         let resolvedProvider;
         const agentCustomEnv = {
             ...process.env,
-            PYTHONIOENCODING: 'utf-8', PYTHONUTF8: '1', PYTHONUNBUFFERED: '1',
+            PYTHONIOENCODING: 'utf-8', PYTHONUNBUFFERED: '1',
             PYTHONLEGACYWINDOWSSTDIO: '1', TERM: 'emacs',
             PROMPT_TOOLKIT_NO_INTERACTIVE: '1', ANSICON: '1',
             OPENROUTER_API_KEY: process.env.OPENROUTER_API_KEY || '',
@@ -307,12 +455,12 @@ export class NousHermesRunner {
             const canonicalSoul = path.join(overmindHermesSubPath, 'SOUL.md');
             const legacySoul = path.join(getSharedHermesHome(), `agent_${agentName}`, '.hermes', 'SOUL.md');
             const claudeSoul = path.join(configPath, '.claude', 'agents', `${agentName}.md`);
-            const agentPromptPath = fs.existsSync(canonicalSoul)
-                ? canonicalSoul
-                : fs.existsSync(legacySoul)
-                    ? legacySoul
-                    : fs.existsSync(claudeSoul)
-                        ? claudeSoul
+            const agentPromptPath = fs.existsSync(claudeSoul)
+                ? claudeSoul
+                : fs.existsSync(canonicalSoul)
+                    ? canonicalSoul
+                    : fs.existsSync(legacySoul)
+                        ? legacySoul
                         : null;
             if (agentPromptPath && fs.existsSync(agentPromptPath)) {
                 systemPrompt = fs.readFileSync(agentPromptPath, 'utf8');
@@ -330,24 +478,29 @@ export class NousHermesRunner {
                     }
                 }
             }
-            // Load environment variables from .claude/settings_<agentName>.json
+            // ─────────────────────────────────────────────────────────────────────────
+            // LECTURE CREDENTIALS HERMES — <HERMES_HOME>/agents/<name>/settings.json
+            //
+            // Ce chemin est résolu UNE SEULE FOIS en haut de la fonction (agentSettingsPath).
+            // Il pointe vers le dossier natif Hermes, PAS vers .claude/.
+            // Si le fichier est absent, l'agent tourne sans LLM (erreur claire dans les logs).
+            // ─────────────────────────────────────────────────────────────────────────
             try {
-                const agentSettingsPath = resolveConfigPath(path.join(path.dirname(CONFIG.CLAUDE.PATHS.SETTINGS), `settings_${agentName}.json`), configPath);
-                // Diagnostic: if settings_<agent>.json is missing at the expected path, log it
-                // explicitly along with the alternative paths that DO exist. Without this log,
-                // a user putting the file under .claude/agents/ (or just `agents/`) will see a
-                // cryptic 401 ten minutes later with no breadcrumb back to the misplacement.
+                // agentSettingsPath = <HERMES_HOME>/agents/<name>/settings.json (défini ligne ~405)
+                // ❌ NE PAS changer ceci pour pointer vers .claude/ — c'est intentionnel.
                 if (!fs.existsSync(agentSettingsPath)) {
-                    const altPaths = [
-                        path.join(configPath, '.claude', 'agents', `settings_${agentName}.json`),
-                        path.join(configPath, `settings_${agentName}.json`),
-                        path.join(configPath, 'agents', `settings_${agentName}.json`),
-                    ];
-                    logger.warn({
+                    logger.error({
                         agentName,
-                        searched: agentSettingsPath,
-                        alsoChecked: altPaths.filter((p) => fs.existsSync(p)),
-                    }, 'settings_<agent>.json not found at expected path. The agent will run with no LLM credentials unless ~/.hermes/.env or process.env provides them.');
+                        expected: agentSettingsPath,
+                        hermesHome: overmindHermesSubPath,
+                        action: `Créer ${agentSettingsPath} avec les credentials. ` +
+                            `Format minimal : { "env": { "ANTHROPIC_AUTH_TOKEN": "sk-cp-...", ` +
+                            `"ANTHROPIC_BASE_URL": "https://api.minimaxi.com/anthropic", ` +
+                            `"ANTHROPIC_MODEL": "MiniMax-M3", "ANTHROPIC_PROVIDER": "minimax-cn" }, ` +
+                            `"agent": "${agentName}", "runner": "hermes" }`,
+                    }, '[HERMES] ❌ settings.json introuvable dans le dossier Hermes natif. ' +
+                        'Hermes NE cherche PAS dans .claude/ — uniquement dans .overmind/hermes/agents/<name>/settings.json. ' +
+                        'Voir la documentation dans le commentaire du constructeur NousHermesRunner.');
                 }
                 if (fs.existsSync(agentSettingsPath)) {
                     // Read the RAW settings (pre-interpolation) to capture $VAR references
@@ -366,8 +519,9 @@ export class NousHermesRunner {
                     let settings = rawSettings;
                     settings = interpolateEnvVars(settings);
                     loadedSettings = settings;
-                    // Create temporary settings file
-                    const tempSettings = path.join(path.dirname(agentSettingsPath), `settings_${agentName}_tmp.json`);
+                    // Fichier temporaire interpolé (valeurs $VAR résolues) — nettoyé après le spawn.
+                    // Situé dans le même dossier que settings.json : <HERMES_HOME>/agents/<name>/
+                    const tempSettings = path.join(path.dirname(agentSettingsPath), `settings_tmp.json`);
                     fs.writeFileSync(tempSettings, JSON.stringify(settings, null, 2));
                     tmpSettingsPath = tempSettings;
                     this.tempFiles.push(tempSettings);
@@ -377,17 +531,22 @@ export class NousHermesRunner {
                             agentCustomEnv.ANTHROPIC_MODEL = settings.env.MODEL;
                         }
                     }
-                    // MCP configurations
-                    const agentMcpPath = resolveConfigPath(path.join(path.dirname(CONFIG.CLAUDE.PATHS.SETTINGS), `.mcp.${agentName}.json`), configPath);
+                    // ─────────────────────────────────────────────────────────────────────
+                    // CONFIG MCP — Résolution dans l'ordre suivant :
+                    //   1. <HERMES_HOME>/agents/<name>/.mcp.json  (override par agent)
+                    //   2. <OVERMIND_WORKSPACE>/.mcp.json filtré par enabledMcpjsonServers
+                    // ─────────────────────────────────────────────────────────────────────
+                    const agentMcpPath = path.join(overmindHermesSubPath, '.mcp.json');
                     if (fs.existsSync(agentMcpPath)) {
-                        // Write temporary mcp path
-                        const tempMcp = path.join(path.dirname(agentSettingsPath), `mcp_${agentName}_tmp.json`);
+                        // Override MCP par agent : <HERMES_HOME>/agents/<name>/.mcp.json
+                        const tempMcp = path.join(path.dirname(agentSettingsPath), `mcp_tmp.json`);
                         fs.writeFileSync(tempMcp, fs.readFileSync(agentMcpPath, 'utf8'));
                         tmpMcpPath = tempMcp;
                         this.tempFiles.push(tempMcp);
                     }
                     else if (settings.enableAllProjectMcpServers === false &&
                         Array.isArray(settings.enabledMcpjsonServers)) {
+                        // Filtre le .mcp.json du workspace selon enabledMcpjsonServers
                         const projectMcpPath = resolveConfigPath(CONFIG.CLAUDE.PATHS.MCP, configPath);
                         if (fs.existsSync(projectMcpPath)) {
                             const fullMcp = JSON.parse(fs.readFileSync(projectMcpPath, 'utf8'));
@@ -397,7 +556,7 @@ export class NousHermesRunner {
                                     filteredMcp.mcpServers[serverName] = fullMcp.mcpServers[serverName];
                                 }
                             }
-                            const tempMcp = path.join(path.dirname(agentSettingsPath), `mcp_${agentName}_tmp.json`);
+                            const tempMcp = path.join(path.dirname(agentSettingsPath), `mcp_tmp.json`);
                             fs.writeFileSync(tempMcp, JSON.stringify(filteredMcp, null, 2));
                             tmpMcpPath = tempMcp;
                             this.tempFiles.push(tempMcp);
@@ -408,8 +567,8 @@ export class NousHermesRunner {
             catch (e) {
                 logger.warn({ error: e }, `Failed to process settings/mcp configurations for Hermes agent ${agentName}`);
             }
-            // Load environment from the agent's isolated .hermes/.env file, BUT only as a
-            // fallback for keys that the explicit settings_<agent>.json did NOT set.
+            // Charge le .env de l'agent (dans <HERMES_HOME>/agents/<name>/.env) en FALLBACK UNIQUEMENT.
+            // Les clés déjà définies dans settings.json ne sont PAS écrasées.
             //
             // CRITICAL (2.8.29): The .hermes/.env file is a STALE WRITE of the previous
             // spawn — it gets re-written by the runner itself at line ~1013, but if a
@@ -468,7 +627,7 @@ export class NousHermesRunner {
         }
         const finalModel = options.model || resolvedModel || CONFIG.HERMES.DEFAULT_MODEL;
         const finalPrompt = systemPrompt ? `${systemPrompt}\n\n[USER QUERY]:\n${prompt}` : prompt;
-        const cliPrompt = finalPrompt.length > 7000 ? finalPrompt.substring(0, 7000) : finalPrompt;
+        const cliPrompt = finalPrompt;
         // Build CLI args: chat -q (persistent session, NOT -z oneshot)
         // -z + --resume doesn't work — resume is ignored in oneshot mode
         //
@@ -493,25 +652,26 @@ export class NousHermesRunner {
             logger.info({ agentName, provider, model: finalModel }, '[HERMES_ARGS] Passing --provider (2.8.33: needed to bypass upstream auto-router that picked openrouter for MiniMax-M3).');
         }
         // ============================================================
-        // 2.8.36 — PASS --toolsets TO ACTIVATE MCP SERVERS
+        // 2.8.36 — TOOLSET DISCOVERY (LOG ONLY — NOT PASSED TO CLI)
         // ============================================================
-        // Hermes upstream ONLY loads MCP servers that are explicitly listed via
-        // -t/--toolsets (or registered in the agent's per-agent settings.json
-        // under a `toolsets` key — but the field is `enabledMcpjsonServers`,
-        // which we already write). Looking at Hermes upstream's CLI: the
-        // `enabledMcpjsonServers` field in settings.json is a *Hermes-side*
-        // filter, but it requires the toolset to be discovered first via
-        // `mcp.json` AND the runtime toolset registry to mark it enabled.
+        // Previously we passed MCP server names via `--toolsets` to Hermes.
+        // This caused `Warning: Unknown toolsets: mcp-memory, mcp-discord, ...`
+        // because Hermes's toolset registry does NOT use the `mcp-<name>` format.
+        //
+        // The MCP servers load correctly WITHOUT `--toolsets` because:
+        //   1. `HERMES_HOME` is overridden to the per-agent isolated run home.
+        //   2. `filterConfigYaml` writes a filtered `config.yaml` that lists only
+        //      the allowed MCP servers under `mcp_servers:`.
+        //   3. Hermes reads `config.yaml` at startup and connects to every server
+        //      listed there — no `--toolsets` flag needed.
         //
-        // The simplest, most reliable cross-version trick: pass the MCP server
-        // names as a comma-separated list via `--toolsets`. Hermes upstream
-        // will then ensure those toolsets are loaded AND exposed to the
-        // conversation as `mcp__<server>__<tool>` callable tools.
+        // We still build `toolsetList` for diagnostic logging so that the log
+        // shows which MCP servers are expected for this agent run.
         //
         // Source of truth for the list:
         //   - If settings has `enabledMcpjsonServers: [...non-empty...]`, use that.
         //   - Else, if `enableAllProjectMcpServers: true`, use ALL server names
-        //     from Workflow/.mcp.json.
+        //     from the Hermes config.yaml.
         //   - Else, skip — no toolset hint.
         const toolsetList = [];
         // Read the canonical settings.json we just wrote to find the MCP server hints.
@@ -570,19 +730,33 @@ export class NousHermesRunner {
                 const hermesConfigPath = path.join(getSharedHermesHome(), 'config.yaml');
                 if (fs.existsSync(hermesConfigPath)) {
                     const yamlText = fs.readFileSync(hermesConfigPath, 'utf8');
-                    // Tiny ad-hoc YAML parser for `mcp_servers:` block: capture the
-                    // top-level keys under that section. This is intentionally
-                    // dependency-free — we don't want to pull in a YAML lib for a
-                    // single field. Hermes' config.yaml uses simple `key: value` lines
-                    // and 2-space indent for the mcp_servers block.
-                    const mcpBlockMatch = yamlText.match(/^mcp_servers:\s*\n((?: {2}[^\n]+\n?)+)/m);
-                    if (mcpBlockMatch) {
-                        const block = mcpBlockMatch[1];
-                        const serverNames = [...block.matchAll(/^ {2}([a-zA-Z0-9_-]+):/gm)].map((m) => m[1]);
-                        if (serverNames.length > 0) {
-                            toolsetList.push(...serverNames);
+                    // Line-by-line YAML parser for the `mcp_servers` section (handles comments, varying indentation, and exits correctly)
+                    const lines = yamlText.split(/\r?\n/);
+                    let inMcpServers = false;
+                    const serverNames = [];
+                    for (const line of lines) {
+                        const trimmed = line.trim();
+                        if (!trimmed || trimmed.startsWith('#'))
+                            continue;
+                        if (line.match(/^mcp_servers:\s*$/) || line.match(/^mcp_servers:\s*#.*$/)) {
+                            inMcpServers = true;
+                            continue;
+                        }
+                        if (inMcpServers) {
+                            const indentMatch = line.match(/^(\s+)/);
+                            if (!indentMatch) {
+                                inMcpServers = false;
+                                continue;
+                            }
+                            const keyMatch = trimmed.match(/^([a-zA-Z0-9_-]+)\s*:/);
+                            if (keyMatch) {
+                                serverNames.push(keyMatch[1]);
+                            }
                         }
                     }
+                    if (serverNames.length > 0) {
+                        toolsetList.push(...serverNames);
+                    }
                 }
                 if (toolsetList.length === 0) {
                     // Fallback: read .mcp.json (Overmind format) for any servers not in
@@ -601,8 +775,10 @@ export class NousHermesRunner {
             }
         }
         if (toolsetList.length > 0) {
-            cleanArgs.push('--toolsets', toolsetList.join(','));
-            logger.info({ agentName, toolsets: toolsetList }, '[HERMES_ARGS] Passing --toolsets (2.8.36: activates MCP servers as callable tools in this session).');
+            // Log which MCP servers are expected for this run — do NOT pass to CLI.
+            // Hermes loads them via the isolated config.yaml; passing --toolsets
+            // would produce `Warning: Unknown toolsets: mcp-<name>` noise with no benefit.
+            logger.info({ agentName, expectedMcpServers: toolsetList }, '[HERMES_ARGS] Expected MCP servers for this run (loaded via config.yaml, NOT via --toolsets).');
         }
         if (sessionId)
             cleanArgs.push('--resume', sessionId);
@@ -690,10 +866,10 @@ export class NousHermesRunner {
                             `but process.env.${varName} is empty. Add it to /home/demon/.overmind/.env or fix the settings reference.`);
                     }
                     resolvedValue = fromEnv;
-                    logger.info({ agentName, sourceKey: t.key, referencedVar: varName, resolvedLen: resolvedValue.length }, '[SUBTILISATION] Resolved $VAR reference from settings_<agent>.json against process.env.');
+                    logger.info({ agentName, sourceKey: t.key, referencedVar: varName, resolvedLen: resolvedValue.length }, '[TOKEN_RESOLVER] Resolved $VAR reference from settings_<agent>.json against process.env.');
                 }
                 const detected = detectTokenProvider(resolvedValue);
-                logger.info({ agentName, tokenKey: t.key, detectedProvider: detected.provider, mappedTo: detected.envKey }, '[SUBTILISATION] Using explicit settings_<agent>.json token, re-mapping to detected provider env var.');
+                logger.info({ agentName, tokenKey: t.key, detectedProvider: detected.provider, mappedTo: detected.envKey }, '[TOKEN_RESOLVER] Using explicit settings_<agent>.json token, re-mapping to detected provider env var.');
                 return { tokenEnvKey: t.key, tokenValue: resolvedValue, detectedProvider: detected.provider, source: 'settings-explicit' };
             }
             const candidates = [];
@@ -722,7 +898,7 @@ export class NousHermesRunner {
             // Pass B: re-map the first candidate to the right provider env-var name.
             const first = candidates[0];
             if (first.detected.provider !== 'unknown' && first.detected.envKey !== first.key) {
-                logger.info({ agentName, sourceKey: first.key, detectedProvider: first.detected.provider, remappedTo: first.detected.envKey }, '[SUBTILISATION] Token prefix detected provider mismatch — re-mapping env var.');
+                logger.info({ agentName, sourceKey: first.key, detectedProvider: first.detected.provider, remappedTo: first.detected.envKey }, '[TOKEN_RESOLVER] Token prefix detected provider mismatch — re-mapping env var.');
                 return {
                     tokenEnvKey: first.detected.envKey,
                     tokenValue: first.value,
@@ -842,25 +1018,27 @@ export class NousHermesRunner {
         // AbortSignal
         if (options.signal?.aborted)
             return Promise.reject(new Error('ABORTED'));
-        // =============================================================
-        // 2.8.30 — WRITE CANONICAL Hermes SETTINGS
-        // =============================================================
-        // Hermes upstream uses the standard appdirs-style layout:
-        //   <HERMES_HOME>/agents/<name>/settings.json   ← per-agent env, mcp, persona
-        //   <HERMES_HOME>/agents/<name>/SOUL.md         ← per-agent system prompt
-        //   <HERMES_HOME>/config.yaml                   ← global, Hermes manages
-        //   <HERMES_HOME>/auth.json                     ← global, Hermes manages
+        // ═══════════════════════════════════════════════════════════════════════════
+        // MISE À JOUR settings.json Hermes natif (2.8.45)
+        // ═══════════════════════════════════════════════════════════════════════════
+        //
+        // Le runner LIT et ÉCRIT dans le MÊME fichier :
+        //   <HERMES_HOME>/agents/<name>/settings.json
         //
-        // Overmind's only job here is to:
-        //   1. Convert Workflow/.claude/settings_<name>.json (Overmind runner format)
-        //      into the canonical Hermes format and write it to <HERMES_HOME>/agents/<name>/settings.json
-        //   2. Make sure <HERMES_HOME>/agents/<name>/SOUL.md exists (canonical path)
-        //   3. Let Hermes upstream manage config.yaml, auth.json, sessions/, etc.
+        // Cycle complet :
+        //   1. LECTURE  : settings.json → interpolation $VAR → agentCustomEnv
+        //   2. DÉTECTION: token prefix (sk-cp-* → MiniMax, 32hex → Z.AI, etc.)
+        //   3. INJECTION: MINIMAX_CN_API_KEY, MINIMAX_CN_BASE_URL, etc. auto-injectés
+        //   4. ÉCRITURE : settings.json mis à jour avec les clés injectées
+        //   5. SPAWN    : hermes chat -q avec HERMES_HOME = runs/<name>/
         //
-        // This replaces the previous "polylgot" hack where Overmind wrote
-        // `<HERMES_HOME>/agent_<name>/.hermes/.env`, `.hermes/config.yaml`, and
-        // `.hermes/auth.json` — files that don't match Hermes's expected layout
-        // and caused credential drift + silent 401s.
+        // ❌ Overmind NE convertit PAS depuis .claude/ — c'est le chemin Claude/Kilo.
+        // ✅ settings.json est géré par l'utilisateur ET mis à jour par Overmind.
+        //    Les $VAR restent en tant que littéraux après la première résolution.
+        //    Pour changer un credential, éditer directement settings.json.
+        //
+        // Autres fichiers gérés par Hermes upstream (ne pas toucher) :
+        //   config.yaml, auth.json, sessions/, logs/
         if (agentName) {
             const agentHome = overmindHermesSubPath; // = <HERMES_HOME>/agents/<name>/
             if (!fs.existsSync(agentHome))
@@ -963,6 +1141,73 @@ export class NousHermesRunner {
             // edits were being silently deleted after each spawn.
             logger.info({ agentName, settingsPath: tmpAgentSettings, envKeys: Object.keys(settingsJson.env || {}).length }, '[HERMES] Wrote canonical agents/<name>/settings.json (env block from settings_<name>.json + provider-specific seeds).');
         }
+        let effectiveHermesHome = sharedHome;
+        if (agentName && enabledInSettings.length > 0) {
+            try {
+                const runsDir = path.join(sharedHome, 'runs');
+                if (!fs.existsSync(runsDir))
+                    fs.mkdirSync(runsDir, { recursive: true });
+                const runHome = path.join(runsDir, agentName);
+                if (!fs.existsSync(runHome))
+                    fs.mkdirSync(runHome, { recursive: true });
+                // Copy auth.json if exists
+                const sharedAuth = path.join(sharedHome, 'auth.json');
+                const runAuth = path.join(runHome, 'auth.json');
+                if (fs.existsSync(sharedAuth)) {
+                    fs.copyFileSync(sharedAuth, runAuth);
+                }
+                // Robust directory junction/symlink helper
+                const linkDirRobust = (target, source) => {
+                    if (!fs.existsSync(source)) {
+                        try {
+                            fs.mkdirSync(source, { recursive: true });
+                        }
+                        catch (e) {
+                            logger.warn({ source, error: e }, '[HERMES_HOME] Failed to create link source directory');
+                        }
+                    }
+                    let exists = false;
+                    let stats = null;
+                    try {
+                        stats = fs.lstatSync(target);
+                        exists = true;
+                    }
+                    catch {
+                        // target does not exist
+                    }
+                    if (exists) {
+                        logger.debug({ target, isJunction: stats ? (stats.isSymbolicLink() || stats.isDirectory()) : false }, '[HERMES_HOME] Target directory/link already exists. Skipping link creation.');
+                    }
+                    else {
+                        logger.info({ target, source }, '[HERMES_HOME] Creating junction/symbolic link.');
+                        if (process.platform === 'win32') {
+                            execSync(`cmd /c mklink /J "${target}" "${source}"`);
+                        }
+                        else {
+                            fs.symlinkSync(source, target);
+                        }
+                    }
+                };
+                // Link agents directory
+                const sharedAgents = path.join(sharedHome, 'agents');
+                const runAgents = path.join(runHome, 'agents');
+                linkDirRobust(runAgents, sharedAgents);
+                // Link sessions directory
+                const sharedSessions = path.join(sharedHome, 'sessions');
+                const runSessions = path.join(runHome, 'sessions');
+                linkDirRobust(runSessions, sharedSessions);
+                // Generate filtered config.yaml
+                const sharedConfig = path.join(sharedHome, 'config.yaml');
+                const runConfig = path.join(runHome, 'config.yaml');
+                const filteredConfig = filterConfigYaml(sharedConfig, enabledInSettings);
+                fs.writeFileSync(runConfig, filteredConfig, 'utf8');
+                effectiveHermesHome = runHome;
+                logger.info({ agentName, runHome, enabledMcp: enabledInSettings }, '[HERMES_HOME] Isolated agent Hermes Home and filtered config.yaml successfully.');
+            }
+            catch (e) {
+                logger.warn({ error: e }, 'Failed to setup isolated run home; falling back to sharedHome');
+            }
+        }
         // AbortSignal
         if (options.signal?.aborted)
             return Promise.reject(new Error('ABORTED'));
@@ -972,10 +1217,27 @@ export class NousHermesRunner {
             let retryCount = 0;
             const maxRetries = getAvailableFallbacks().length + 1;
             let currentSessionId = sessionId;
-            const safeResolve = (v) => { if (!resolved) {
-                resolved = true;
-                resolve(v);
-            } };
+            const abortListener = () => {
+                if (currentChildRef) {
+                    killProcessTree(currentChildRef).then(() => {
+                        cleanupTmpFiles();
+                        safeResolve({ result: '', error: 'ABORTED', rawOutput: '' });
+                    });
+                }
+                else {
+                    cleanupTmpFiles();
+                    safeResolve({ result: '', error: 'ABORTED', rawOutput: '' });
+                }
+            };
+            const safeResolve = (v) => {
+                if (!resolved) {
+                    resolved = true;
+                    if (options.signal) {
+                        options.signal.removeEventListener('abort', abortListener);
+                    }
+                    resolve(v);
+                }
+            };
             const cleanupTmpFiles = () => {
                 for (const f of [tmpSettingsPath, tmpMcpPath]) {
                     if (f && fs.existsSync(f)) {
@@ -1064,12 +1326,11 @@ export class NousHermesRunner {
                 // etc. relative to HERMES_HOME. Setting it to the per-agent home would
                 // tell Hermes "this IS the Hermes root" and make it look for config.yaml
                 // IN the agent dir — wrong layout.
-                const sharedHermesHome = getSharedHermesHome();
                 const child = spawn(hermesBin, cleanArgs, {
                     cwd, shell: false, windowsHide: true,
                     env: {
                         ...spawnEnv,
-                        HERMES_HOME: sharedHermesHome,
+                        HERMES_HOME: effectiveHermesHome,
                         ...(isVenvInstall
                             ? {
                                 VIRTUAL_ENV: venvRoot,
@@ -1100,8 +1361,8 @@ export class NousHermesRunner {
                         void appendOutput(child.pid, chunk, configPath);
                         void appendLiveOutput(child.pid, chunk);
                     }
-                    if (stdout.length + chunk.length > MAX_BUF)
-                        stdout = stdout.slice(-MAX_BUF);
+                    if (stdout.length + chunk.length > this.MAX_BUF)
+                        stdout = stdout.slice(-this.MAX_BUF);
                     else
                         stdout += chunk;
                     if (!silent && agentName)
@@ -1109,8 +1370,8 @@ export class NousHermesRunner {
                 });
                 child.stderr?.on('data', (d) => {
                     const chunk = d.toString();
-                    if (stderr.length + chunk.length > MAX_BUF)
-                        stderr = stderr.slice(-MAX_BUF);
+                    if (stderr.length + chunk.length > this.MAX_BUF)
+                        stderr = stderr.slice(-this.MAX_BUF);
                     else
                         stderr += chunk;
                     if (!silent && agentName)
@@ -1170,13 +1431,9 @@ export class NousHermesRunner {
                     });
                 });
             };
-            options.signal?.addEventListener('abort', () => {
-                if (currentChildRef)
-                    killProcessTree(currentChildRef).then(() => {
-                        cleanupTmpFiles();
-                        safeResolve({ result: '', error: 'ABORTED', rawOutput: '' });
-                    });
-            });
+            if (options.signal) {
+                options.signal.addEventListener('abort', abortListener);
+            }
             let firstToken;
             try {
                 firstToken = getTokenForIndex(0);