owlmem 0.7.3 → 0.7.6

package/README.md

@@ -29,7 +29,10 @@ page, where you sign in and click **Allow**. AI agents can read the setup guide
 
 An AI on your computer normally sees a task only when someone opens it. Auto-wake starts it as soon as it gets one:
 a small background program long-polls OwlMem and runs that AI's command line unattended — Claude Code with
-`claude -p`, Codex with `codex exec`, Antigravity with `agy -p` (for Codex and Antigravity, which refuse tool calls when nobody is watching, auto-wake approves just the two OwlMem tools used to report back: in `~/.codex/config.toml` and `~/.gemini/antigravity-cli/settings.json`) — with the task as the prompt. The AI marks the task done or declined as usual.
+`claude -p`, Codex with `codex exec`, Antigravity with `agy -p`, Hermes with `hermes -z` (for Codex and Antigravity, which refuse tool calls when nobody is watching, auto-wake approves just the two OwlMem tools used to report back: in `~/.codex/config.toml` and `~/.gemini/antigravity-cli/settings.json`; for Hermes, only if OwlMem is marked `trust: untrusted`, under `command_allowlist` in `~/.hermes/config.yaml`) — with the task as the prompt. The AI marks the task done or declined as usual.
+
+When someone turns auto-wake on for an AI in the console and no computer runs it yet, that AI is told so the next time it connects:
+with your OK it runs `npx -y owlmem wake enable` itself and sends you the pairing link to approve.
 
 ```sh
 npx -y owlmem install --wake     # or answer "y" when install asks; --yes alone leaves it off
@@ -71,13 +74,13 @@ npx owlmem vault import bitwarden_export.json   # also 1Password / KeePass CSV,
 Vault items are encrypted on your machine with a key only you hold; OwlMem stores ciphertext it cannot read.
 Every read or write needs the space owner's approval in the console (passkey, authenticator app or GitHub).
 
-For unattended jobs (scheduled tasks, overnight deploys) the owner can set a **standing grant**: one agent, on one machine,
-may read chosen items or a folder without asking each time, until a set date (90 days at most), optionally only during set hours.
-Run `npx owlmem device` on that machine to register it and print its fingerprint. The program signs every vault request with a
-device key kept next to its config, so the same token on another machine gets nothing. By default a standing grant covers
-`owlmem run` / `vault_run` only (the secret goes into a command); viewing in plain text must be allowed separately.
-Saving, deleting and exporting always need approval.
-If an agent without access asks for an item, the answer names up to three agents in the space with a standing grant for it,
+For unattended jobs (scheduled tasks, overnight deploys) the owner can turn on an agent's **standing grant**: in the console
+(Agents, one switch per agent), or while approving one of its requests. The agent can then use any vault item without asking,
+on computers the owner approved (a new computer asks once; approving remembers it), and only through `owlmem run` / `vault_run`,
+so the secret goes into a command. The program signs every vault request with a device key kept next to its config, so the same
+token on another machine gets nothing (`npx owlmem device` prints this machine's fingerprint). Viewing a secret, saving, deleting
+and exporting always need approval.
+If an agent without access asks for an item, the answer names up to three agents in the space with a standing grant,
 so it can hand the job to one of them (`kb_send` with `kind` `task`): that agent runs it with `vault_run` and sends back only
 the result. Secrets themselves never go into messages, documents or memory — OwlMem refuses text that looks like a key.
 

package/owlmem.mjs

@@ -19,18 +19,19 @@
 //   owlmem vault export [--format bitwarden-json|keepass-csv|env] > file
 //   owlmem run --env VAR=<name>[:field] [...] -- <command> [args]   run a command with secrets in its environment
 //   owlmem vault keygen                  (setup without a browser) print a new recovery code and its key check
-//   owlmem device                        register this machine and show its fingerprint (for standing grants)
+//   owlmem device                        show this machine's fingerprint (standing grants are bound to machines)
 //   owlmem mcp                           local MCP server for your AI (vault_list, vault_run, vault_get, vault_put)
 //                                        e.g. claude mcp add owlmem-vault -- node ~/owlmem.mjs mcp
 //
 // Reading, writing, deleting and exporting need the space owner's approval in the console; this program waits
 // for it (up to 5 minutes). Secrets go to stdout only; messages go to stderr.
 //
-// Standing grants (for unattended jobs): the owner can let one agent, on one machine, read chosen items without
-// asking each time — until a set date, optionally only during set hours. This program signs every vault request
-// with a device key kept on this machine (device.json next to config.json), and says whether the secret goes into a
-// command (`owlmem run`, vault_run) or is shown (`vault get`, vault_get). A token copied to another machine has no
-// device key there, so standing grants don't apply. Writing, deleting and exporting always need approval.
+// Standing grants (for unattended jobs): the owner turns one on for an agent in the console (Agents), or while approving
+// one of its requests. The agent can then use any vault item without asking, on computers the owner approved (a new
+// computer asks once; approving remembers it), and only through `owlmem run` / vault_run. This program signs every vault
+// request with a device key kept on this machine (device.json next to config.json), and says whether the secret goes into
+// a command (`owlmem run`, vault_run) or is shown (`vault get`, vault_get). A token copied to another machine has no
+// device key there, so standing grants don't apply. Viewing, writing, deleting and exporting always need approval.
 
 import { webcrypto as crypto } from "node:crypto";
 import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, copyFileSync, rmSync, statSync, realpathSync, openSync, closeSync, appendFileSync } from "node:fs";
@@ -39,7 +40,7 @@ import { join, dirname, basename, relative, isAbsolute } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawn, spawnSync } from "node:child_process";
 
-export const VERSION = "0.7.3";
+export const VERSION = "0.7.6";
 const BASE = (process.env.OWLMEM_URL || "https://owlmem.com").replace(/\/$/, "");
 const DIR = process.env.OWLMEM_HOME || join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "owlmem");
 const enc = new TextEncoder(), dec = new TextDecoder();
@@ -232,7 +233,7 @@ async function approved(method, path, body, kind = "access", mode = "other") {
     if (r.status < 400) return r.data;
     if (r.data.error !== "approval_required") throw new Fail(r.data.detail || r.data.error || "HTTP " + r.status);
     const id = r.data.request;
-    // the server may name other agents that could do this for us (a standing grant for this item) — names only
+    // the server may name other agents that could do this for us (they have a standing grant) — names only
     let hint = r.data.hint || "";
     say(`Waiting for approval in the OwlMem console (request ${id}${kind === "access" ? "" : ", " + kind}) …`);
     if (hint) say(hint);
@@ -245,7 +246,7 @@ async function approved(method, path, body, kind = "access", mode = "other") {
       if (st !== "pending") break;
     }
     const tail = hint ? " " + hint : "";
-    if (st === "pending") throw new Fail(`Waiting for approval (request ${id}). Ask the space owner to approve it in the OwlMem console (Vault), then try again. For unattended jobs, ask them for a standing grant for this agent and this machine (run: owlmem device).` + tail);
+    if (st === "pending") throw new Fail(`Waiting for approval (request ${id}). Ask the space owner to approve it in the OwlMem console (Vault), then try again. For unattended jobs, ask them to turn on your standing grant (console → Agents, or when they approve).` + tail);
     if (st !== "approved") throw new Fail((st === "denied" ? "The request was denied." : "The request expired before it was approved.") + tail);
     say("Approved.");
     if (kind !== "access") extra = (path.includes("?") ? "&" : "?") + "request=" + encodeURIComponent(id);
@@ -430,7 +431,7 @@ function pick(body, field) {
 const MCP_TOOLS = [
   { name: "vault_list", description: "List the credentials in the team vault (names and descriptions only; no secrets).", inputSchema: { type: "object", properties: {} } },
   { name: "vault_run",
-    description: "PREFERRED way to use a secret: run a shell command with vault items injected as environment variables. The secret values are masked as **** in the output returned to you, so they never enter the conversation. Needs the space owner's approval in the OwlMem console the first time (then 15 min – 2 h), unless they set a standing grant for you on this machine — standing grants cover vault_run only (not vault_get) unless the owner also allowed viewing.",
+    description: "PREFERRED way to use a secret: run a shell command with vault items injected as environment variables. The secret values are masked as **** in the output returned to you, so they never enter the conversation. Needs the space owner's approval in the OwlMem console the first time (then 15 min – 2 h), unless they turned on your standing grant and approved this computer — standing grants cover vault_run only, never vault_get.",
     inputSchema: { type: "object", properties: {
       command: { type: "string", description: "Shell command to run (sh -c)" },
       env: { type: "object", description: 'Map of ENV_VAR to "item" or "item:field", e.g. {"DB_PASSWORD": "prod/db:password"}', additionalProperties: { type: "string" } },
@@ -806,14 +807,22 @@ export const WAKE_CLIENTS = {
     command: ["claude", "-p", "--allowedTools", "mcp__owlmem__kb_task_update,mcp__owlmem__kb_inbox"], prompt: "stdin" },
   codex: { name: "Codex", bin: "codex", command: ["codex", "exec", "--skip-git-repo-check", "-"], prompt: "stdin" },
   // agy -p takes the prompt as an argument; headless it denies MCP tools unless settings.json allows them (see allowAntigravity)
-  antigravity: { name: "Antigravity", bin: "agy", home: [".gemini", "bin", "agy"], command: ["agy", "-p"], prompt: "arg" },
+  antigravity: { name: "Antigravity", bin: "agy", home: [[".gemini", "bin", "agy"]], command: ["agy", "-p"], prompt: "arg" },
+  // hermes -z runs one prompt (an argument) and exits; it calls MCP tools without asking unless OwlMem is marked untrusted (see allowHermes).
+  // Its installer puts hermes under ~/.hermes/hermes-agent or ~/.local/bin; a system-wide service install under /var/lib/hermes
+  hermes: { name: "Hermes", bin: "hermes", command: ["hermes", "-z"], prompt: "arg",
+    home: [[".hermes", "hermes-agent", ".hermes", "bin", "hermes"], [".local", "bin", "hermes"], "/var/lib/hermes/hermes-agent/.hermes/bin/hermes"] },
 };
-export const WAKE_APP_IDS = ["claude-code", "codex", "antigravity", "gemini", "custom"];
-// Where an app's command is: on PATH, or (Antigravity) its default install place, used by full path
-export function wakeBin(c, home_ = home(), exists = existsSync) {
-  if (onPath(c.bin)) return c.bin;
-  const p = c.home && join(home_, ...c.home);
-  return p && exists(p) ? p : null;
+export const WAKE_APP_IDS = ["claude-code", "codex", "antigravity", "hermes", "gemini", "custom"];
+// Where an app's command is: on PATH, or the first of its default install places that exists (path parts under your home
+// folder, or an absolute path), used by full path
+export function wakeBin(c, home_ = home(), exists = existsSync, path = onPath) {
+  if (path(c.bin)) return c.bin;
+  for (const w of c.home || []) {
+    const p = typeof w === "string" ? w : join(home_, ...w);
+    if (exists(p)) return p;
+  }
+  return null;
 }
 // codex exec runs with approval "never", so an MCP call that needs approval is refused: approve just the two OwlMem
 // tools it needs to report back, as tool tables under the [mcp_servers.owlmem] that install wrote (append only)
@@ -840,6 +849,56 @@ export function allowAntigravity(home_ = home()) {
   writeFileSync(f, JSON.stringify(j, null, 2) + "\n");
   return true;
 }
+// Hermes calls MCP tools without asking unless the server is marked `trust: untrusted` (or an unknown value) under mcp_servers in
+// ~/.hermes/config.yaml; then unattended runs refuse its write tools. Only in that case, add the two OwlMem tools it reports back
+// with to the top-level command_allowlist as mcp:<server>/<tool> (what Hermes itself writes for "Always"). Adds lines only,
+// never rewrites what's there; a command_allowlist it can't extend safely (not a plain block list) returns "manual".
+// false: nothing to do (no config, no OwlMem server in it, a trusted one, or the entries are already there).
+export function allowHermes(home_ = home(), env = process.env) {
+  const f = join(env.HERMES_HOME || join(home_, ".hermes"), "config.yaml");
+  let t; try { t = readFileSync(f, "utf8"); } catch { return false; }
+  const lines = t.split(/\r?\n/), ind = (l) => l.match(/^ */)[0].length, live = (l) => !!l.trim() && !l.trim().startsWith("#");
+  const top = lines.findIndex((l) => /^mcp_servers:\s*(#.*)?$/.test(l));
+  if (top < 0) return false;
+  let end = top + 1;
+  while (end < lines.length && (!live(lines[end]) || ind(lines[end]) > 0)) end++;
+  const kids = [];
+  let step = 0;
+  for (let i = top + 1; i < end; i++) if (live(lines[i])) { step ||= ind(lines[i]); if (ind(lines[i]) === step) kids.push(i); }
+  let server = null, trust = "full";
+  for (const [k, i] of kids.entries()) {         // the OwlMem entry: named owlmem, or its url is ours
+    const m = lines[i].trim().match(/^["']?([A-Za-z0-9_.-]+)["']?:\s*(#.*)?$/);
+    if (!m) continue;
+    const body = lines.slice(i + 1, k + 1 < kids.length ? kids[k + 1] : end), first = body.find(live);
+    if (m[1] !== "owlmem" && !body.some((l) => l.includes("owlmem.com/mcp"))) continue;
+    server = m[1];
+    const tr = first && body.find((l) => ind(l) === ind(first) && /^\s*trust:/.test(l));
+    if (tr) trust = tr.replace(/#.*/, "").slice(tr.indexOf(":") + 1).trim().replace(/^["']|["']$/g, "");
+    break;
+  }
+  if (!server || trust === "full") return false;
+  const need = ["kb_task_update", "kb_inbox"].map((n) => "mcp:" + server + "/" + n);
+  const at = lines.findIndex((l) => /^command_allowlist:/.test(l));
+  if (at < 0) {
+    writeFileSync(f, t.replace(/\n*$/, "\n") + "# OwlMem auto-wake: unattended hermes -z may call these two OwlMem tools to report back\ncommand_allowlist:\n" +
+      need.map((r) => "  - " + r + "\n").join(""));
+    return true;
+  }
+  if (!/^command_allowlist:\s*(#.*)?$/.test(lines[at])) return "manual";      // [a, b] on one line, or a string: leave it to the person
+  let last = at, pad = null;
+  for (let i = at + 1; i < lines.length && (!live(lines[i]) || ind(lines[i]) > 0 || lines[i].startsWith("- ")); i++) {
+    if (!live(lines[i])) continue;
+    if (!/^\s*- /.test(lines[i])) return "manual";
+    pad ??= lines[i].match(/^\s*/)[0];
+    last = i;
+  }
+  const have = lines.slice(at + 1, last + 1).map((l) => l.replace(/\s#.*/, "").trim().replace(/^-\s*/, "").replace(/^["']|["']$/g, ""));
+  const add = need.filter((r) => !have.includes(r));
+  if (!add.length) return false;
+  lines.splice(last + 1, 0, ...add.map((r) => (pad ?? "  ") + "- " + r));
+  writeFileSync(f, lines.join("\n"));
+  return true;
+}
 export const WAKE_DEFAULTS = { max_parallel: 2, timeout_min: 30 };
 const WAKE_UNIT = "owlmem-wake.service", WAKE_LABEL = "com.owlmem.wake", WAKE_TASK = "OwlMem Wake", WAKE_RUNKEY = "OwlMemWake";
 const wakeDir = (dir = DIR) => join(dir, "wake");
@@ -1158,6 +1217,15 @@ async function wakeRun() {
   if (out === "revoked") process.exit(0);
 }
 
+// No command line auto-wake can start: tell OwlMem support which AI apps this computer has, so it can add them. Only the
+// system, CPU architecture, node version and app names (what install detects) — no paths, user name or computer name.
+export async function wakeNoClients(api, items = null) {
+  let apps = [];
+  try { apps = (items || plan()).filter((r) => r.state !== "missing").map((r) => r.name); } catch {}
+  const r = await api("feedback", { os: platform(), arch: process.arch, node: process.versions.node, apps: [...new Set(apps)] });
+  return r.status === 200;
+}
+
 async function wakeEnable(args = []) {
   const boot = args.includes("--boot"), again = args.includes("--again");
   const num = (name, lo, hi) => { const i = args.indexOf(name); if (i < 0) return undefined; const n = Number(args[i + 1]); if (!Number.isInteger(n) || n < lo || n > hi) throw new Fail(`${name} takes a whole number from ${lo} to ${hi}.`); return n; };
@@ -1168,10 +1236,18 @@ async function wakeEnable(args = []) {
     const bin = !clients[id] && wakeBin(c);
     if (bin) clients[id] = { command: [bin, ...c.command.slice(1)], prompt: c.prompt };
   }
-  if (!Object.keys(clients).length)
-    throw new Fail("No AI command line found on this computer that auto-wake can start (Claude Code: claude, Codex: codex, Antigravity: agy). Install one, or add its command to " + wakeFile() + " under \"clients\".");
+  if (!Object.keys(clients).length) {
+    const told = await wakeNoClients(wakeApi()).catch(() => false);
+    throw new Fail("No AI command line found on this computer that auto-wake can start (Claude Code: claude, Codex: codex, Antigravity: agy, Hermes: hermes). Install one, or add its command to " + wakeFile() + " under \"clients\"." +
+      (told ? "\nOwlMem support has been told; you'll hear from us once your AI app is supported." : ""));
+  }
   if (clients.codex && allowCodex()) say("Let Codex report back to OwlMem when nobody is watching (2 tool approvals in ~/.codex/config.toml).");
   if (clients.antigravity && allowAntigravity()) say("Let Antigravity's command line report back to OwlMem when nobody is watching (2 rules in ~/.gemini/antigravity-cli/settings.json).");
+  if (clients.hermes) {
+    const h = allowHermes();
+    if (h === true) say("Let Hermes report back to OwlMem when nobody is watching (2 entries under command_allowlist in ~/.hermes/config.yaml).");
+    else if (h === "manual") say("Hermes treats OwlMem as untrusted: add mcp:<server>/kb_task_update and mcp:<server>/kb_inbox to command_allowlist in ~/.hermes/config.yaml, or it can't report back when nobody is watching.");
+  }
   const cfg = { v: 1, ...WAKE_DEFAULTS, ...old, machine: process.env.OWLMEM_DEVICE_NAME || hostname(), clients, ...(max ? { max_parallel: max } : {}), ...(timeout ? { timeout_min: timeout } : {}), boot: boot || !!old.boot };
   // OwlMem knows these app names; a command you add yourself to wake.json goes under "gemini" or "custom"
   const r = await wakeApi()("pair", { clients: Object.keys(clients).filter((c) => WAKE_APP_IDS.includes(c)), force: again });
@@ -1184,7 +1260,8 @@ async function wakeEnable(args = []) {
   say("Auto-wake is installed (" + a.kind + ": " + tilde(a.file) + ").");
   say("Apps it can start here: " + Object.keys(clients).map((c) => WAKE_CLIENTS[c]?.name || c).join(", ") + ". At most " + cfg.max_parallel + " at once, " + cfg.timeout_min + " minutes per task.");
   if (r.data.status === "pending") {
-    say("\nApprove this computer in the OwlMem console and pick which AI each app is:\n\n  " + r.data.url + "\n\nCheck that the console shows this code: " + r.data.code + "\nUntil then auto-wake waits and starts nothing.");
+    say("\nApprove this computer in the OwlMem console and pick which AI each app is:\n\n  " + r.data.url + "\n\nCheck that the console shows this code: " + r.data.code + "\nUntil then auto-wake waits and starts nothing." +
+      "\n(If you're an AI agent running this: send the link and the code to the person who turned auto-wake on, with kb_send.)");
     openBrowser(r.data.url);
   } else say("This computer is already paired (" + r.data.code + "). Turn auto-wake on or off for each AI in the console (AI agents → Agents).");
 }
@@ -1218,7 +1295,7 @@ async function wakeStatus() {
 const WAKE_HELP = `Usage: npx -y owlmem wake <enable|disable|status>
 
 Auto-wake starts the AI on this computer when it gets an OwlMem task (Claude Code with \`claude -p\`, Codex with
-\`codex exec\`), without you opening it. It runs in the background from login, for this user only.
+\`codex exec\`, Antigravity with \`agy -p\`, Hermes with \`hermes -z\`), without you opening it. It runs in the background from login, for this user only.
 
   enable [--boot] [--max N] [--timeout MIN] [--again]
                  install it and pair this computer (approve in the console). --boot (Linux): run from boot,
@@ -1262,12 +1339,12 @@ export async function main(argv) {
   if (cmd === "uninstall") { await install(["--uninstall", ...argv.slice(1)]); return; }
   if (cmd === "mcp") { await mcpServe(); return; }
   if (cmd === "wake") { await wakeCmd(sub, rest); return; }
-  if (cmd === "device") {          // register this machine for standing grants and show its fingerprint
+  if (cmd === "device") {          // show this machine's fingerprint (the console lists approved computers with it)
     const r = await call("POST", "device", {});
     if (r.status >= 400) throw new Fail(r.data.detail || r.data.error || "HTTP " + r.status);
     say("This machine: " + (process.env.OWLMEM_DEVICE_NAME || hostname()));
     console.log(r.data.device);
-    say("Registered for " + r.data.agent + ". In the OwlMem console (Vault → Standing grants) pick the machine with this fingerprint.");
+    say("This computer's fingerprint for " + r.data.agent + ". With a standing grant on, the first use here asks once; approving remembers this computer.");
     return;
   }
   if (cmd === "login") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "owlmem",
-  "version": "0.7.3",
+  "version": "0.7.6",
   "description": "OwlMem command line: connect your AI apps to OwlMem in one command (npx -y owlmem install), an end-to-end encrypted vault for your AI agents, and a local MCP server.",
   "type": "module",
   "bin": { "owlmem": "owlmem.mjs" },