owlmem 0.7.3 → 0.7.7

package/README.md

@@ -29,7 +29,10 @@ page, where you sign in and click **Allow**. AI agents can read the setup guide
 
 An AI on your computer normally sees a task only when someone opens it. Auto-wake starts it as soon as it gets one:
 a small background program long-polls OwlMem and runs that AI's command line unattended — Claude Code with
-`claude -p`, Codex with `codex exec`, Antigravity with `agy -p` (for Codex and Antigravity, which refuse tool calls when nobody is watching, auto-wake approves just the two OwlMem tools used to report back: in `~/.codex/config.toml` and `~/.gemini/antigravity-cli/settings.json`) — with the task as the prompt. The AI marks the task done or declined as usual.
+`claude -p`, Codex with `codex exec`, Antigravity with `agy -p`, Hermes with `hermes -z` (for Codex and Antigravity, which refuse tool calls when nobody is watching, auto-wake approves just the two OwlMem tools used to report back: in `~/.codex/config.toml` and `~/.gemini/antigravity-cli/settings.json`; for Hermes, only if OwlMem is marked `trust: untrusted`, under `command_allowlist` in `~/.hermes/config.yaml`) — with the task as the prompt. The AI marks the task done or declined as usual. When a task it gave out is done or declined, it is woken too, to read the result. The program updates itself (from npm, when nothing is running).
+
+When someone turns auto-wake on for an AI in the console and no computer runs it yet, that AI is told so the next time it connects:
+with your OK it runs `npx -y owlmem wake enable` itself and sends you the pairing link to approve.
 
 ```sh
 npx -y owlmem install --wake     # or answer "y" when install asks; --yes alone leaves it off
@@ -71,13 +74,13 @@ npx owlmem vault import bitwarden_export.json   # also 1Password / KeePass CSV,
 Vault items are encrypted on your machine with a key only you hold; OwlMem stores ciphertext it cannot read.
 Every read or write needs the space owner's approval in the console (passkey, authenticator app or GitHub).
 
-For unattended jobs (scheduled tasks, overnight deploys) the owner can set a **standing grant**: one agent, on one machine,
-may read chosen items or a folder without asking each time, until a set date (90 days at most), optionally only during set hours.
-Run `npx owlmem device` on that machine to register it and print its fingerprint. The program signs every vault request with a
-device key kept next to its config, so the same token on another machine gets nothing. By default a standing grant covers
-`owlmem run` / `vault_run` only (the secret goes into a command); viewing in plain text must be allowed separately.
-Saving, deleting and exporting always need approval.
-If an agent without access asks for an item, the answer names up to three agents in the space with a standing grant for it,
+For unattended jobs (scheduled tasks, overnight deploys) the owner can turn on an agent's **standing grant**: in the console
+(Agents, one switch per agent), or while approving one of its requests. The agent can then use any vault item without asking,
+on computers the owner approved (a new computer asks once; approving remembers it), and only through `owlmem run` / `vault_run`,
+so the secret goes into a command. The program signs every vault request with a device key kept next to its config, so the same
+token on another machine gets nothing (`npx owlmem device` prints this machine's fingerprint). Viewing a secret, saving, deleting
+and exporting always need approval.
+If an agent without access asks for an item, the answer names up to three agents in the space with a standing grant,
 so it can hand the job to one of them (`kb_send` with `kind` `task`): that agent runs it with `vault_run` and sends back only
 the result. Secrets themselves never go into messages, documents or memory — OwlMem refuses text that looks like a key.
 

package/owlmem.mjs

@@ -19,27 +19,29 @@
 //   owlmem vault export [--format bitwarden-json|keepass-csv|env] > file
 //   owlmem run --env VAR=<name>[:field] [...] -- <command> [args]   run a command with secrets in its environment
 //   owlmem vault keygen                  (setup without a browser) print a new recovery code and its key check
-//   owlmem device                        register this machine and show its fingerprint (for standing grants)
+//   owlmem device                        show this machine's fingerprint (standing grants are bound to machines)
 //   owlmem mcp                           local MCP server for your AI (vault_list, vault_run, vault_get, vault_put)
 //                                        e.g. claude mcp add owlmem-vault -- node ~/owlmem.mjs mcp
 //
 // Reading, writing, deleting and exporting need the space owner's approval in the console; this program waits
 // for it (up to 5 minutes). Secrets go to stdout only; messages go to stderr.
 //
-// Standing grants (for unattended jobs): the owner can let one agent, on one machine, read chosen items without
-// asking each time — until a set date, optionally only during set hours. This program signs every vault request
-// with a device key kept on this machine (device.json next to config.json), and says whether the secret goes into a
-// command (`owlmem run`, vault_run) or is shown (`vault get`, vault_get). A token copied to another machine has no
-// device key there, so standing grants don't apply. Writing, deleting and exporting always need approval.
-
-import { webcrypto as crypto } from "node:crypto";
-import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, copyFileSync, rmSync, statSync, realpathSync, openSync, closeSync, appendFileSync } from "node:fs";
+// Standing grants (for unattended jobs): the owner turns one on for an agent in the console (Agents), or while approving
+// one of its requests. The agent can then use any vault item without asking, on computers the owner approved (a new
+// computer asks once; approving remembers it), and only through `owlmem run` / vault_run. This program signs every vault
+// request with a device key kept on this machine (device.json next to config.json), and says whether the secret goes into
+// a command (`owlmem run`, vault_run) or is shown (`vault get`, vault_get). A token copied to another machine has no
+// device key there, so standing grants don't apply. Viewing, writing, deleting and exporting always need approval.
+
+import { webcrypto as crypto, createHash } from "node:crypto";
+import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, copyFileSync, rmSync, statSync, realpathSync, openSync, closeSync, appendFileSync, renameSync } from "node:fs";
+import { gunzipSync } from "node:zlib";
 import { homedir, hostname, userInfo } from "node:os";
 import { join, dirname, basename, relative, isAbsolute } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawn, spawnSync } from "node:child_process";
 
-export const VERSION = "0.7.3";
+export const VERSION = "0.7.7";
 const BASE = (process.env.OWLMEM_URL || "https://owlmem.com").replace(/\/$/, "");
 const DIR = process.env.OWLMEM_HOME || join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "owlmem");
 const enc = new TextEncoder(), dec = new TextDecoder();
@@ -232,7 +234,7 @@ async function approved(method, path, body, kind = "access", mode = "other") {
     if (r.status < 400) return r.data;
     if (r.data.error !== "approval_required") throw new Fail(r.data.detail || r.data.error || "HTTP " + r.status);
     const id = r.data.request;
-    // the server may name other agents that could do this for us (a standing grant for this item) — names only
+    // the server may name other agents that could do this for us (they have a standing grant) — names only
     let hint = r.data.hint || "";
     say(`Waiting for approval in the OwlMem console (request ${id}${kind === "access" ? "" : ", " + kind}) …`);
     if (hint) say(hint);
@@ -245,7 +247,7 @@ async function approved(method, path, body, kind = "access", mode = "other") {
       if (st !== "pending") break;
     }
     const tail = hint ? " " + hint : "";
-    if (st === "pending") throw new Fail(`Waiting for approval (request ${id}). Ask the space owner to approve it in the OwlMem console (Vault), then try again. For unattended jobs, ask them for a standing grant for this agent and this machine (run: owlmem device).` + tail);
+    if (st === "pending") throw new Fail(`Waiting for approval (request ${id}). Ask the space owner to approve it in the OwlMem console (Vault), then try again. For unattended jobs, ask them to turn on your standing grant (console → Agents, or when they approve).` + tail);
     if (st !== "approved") throw new Fail((st === "denied" ? "The request was denied." : "The request expired before it was approved.") + tail);
     say("Approved.");
     if (kind !== "access") extra = (path.includes("?") ? "&" : "?") + "request=" + encodeURIComponent(id);
@@ -430,7 +432,7 @@ function pick(body, field) {
 const MCP_TOOLS = [
   { name: "vault_list", description: "List the credentials in the team vault (names and descriptions only; no secrets).", inputSchema: { type: "object", properties: {} } },
   { name: "vault_run",
-    description: "PREFERRED way to use a secret: run a shell command with vault items injected as environment variables. The secret values are masked as **** in the output returned to you, so they never enter the conversation. Needs the space owner's approval in the OwlMem console the first time (then 15 min – 2 h), unless they set a standing grant for you on this machine — standing grants cover vault_run only (not vault_get) unless the owner also allowed viewing.",
+    description: "PREFERRED way to use a secret: run a shell command with vault items injected as environment variables. The secret values are masked as **** in the output returned to you, so they never enter the conversation. Needs the space owner's approval in the OwlMem console the first time (then 15 min – 2 h), unless they turned on your standing grant and approved this computer — standing grants cover vault_run only, never vault_get.",
     inputSchema: { type: "object", properties: {
       command: { type: "string", description: "Shell command to run (sh -c)" },
       env: { type: "object", description: 'Map of ENV_VAR to "item" or "item:field", e.g. {"DB_PASSWORD": "prod/db:password"}', additionalProperties: { type: "string" } },
@@ -796,7 +798,8 @@ function nextSteps(items, out) {
 // logon task) long-polls OwlMem. When an agent paired with this computer gets a task, it runs that agent's command line
 // unattended (`claude -p`, `codex exec`) with the task as the prompt. The woken AI uses its own OwlMem connection (the one
 // `owlmem install` set up), so it acts as itself. It gets no extra permissions: no --dangerously-* flags; anything that
-// needs a person, it declines with what the person has to do.
+// needs a person, it declines with what the person has to do. When a task the agent gave out is done or declined, it is
+// woken too, to read the result (OwlMem sends those only to 0.7.7 and later).
 // This computer is identified by its device key (device.json); the pairing is approved in the console, where each AI has an
 // auto-wake switch and the computer can be removed. If OwlMem answers 401 (computer removed, AI disconnected, account gone)
 // the program removes its own autostart entry and exits.
@@ -806,14 +809,22 @@ export const WAKE_CLIENTS = {
     command: ["claude", "-p", "--allowedTools", "mcp__owlmem__kb_task_update,mcp__owlmem__kb_inbox"], prompt: "stdin" },
   codex: { name: "Codex", bin: "codex", command: ["codex", "exec", "--skip-git-repo-check", "-"], prompt: "stdin" },
   // agy -p takes the prompt as an argument; headless it denies MCP tools unless settings.json allows them (see allowAntigravity)
-  antigravity: { name: "Antigravity", bin: "agy", home: [".gemini", "bin", "agy"], command: ["agy", "-p"], prompt: "arg" },
+  antigravity: { name: "Antigravity", bin: "agy", home: [[".gemini", "bin", "agy"]], command: ["agy", "-p"], prompt: "arg" },
+  // hermes -z runs one prompt (an argument) and exits; it calls MCP tools without asking unless OwlMem is marked untrusted (see allowHermes).
+  // Its installer puts hermes under ~/.hermes/hermes-agent or ~/.local/bin; a system-wide service install under /var/lib/hermes
+  hermes: { name: "Hermes", bin: "hermes", command: ["hermes", "-z"], prompt: "arg",
+    home: [[".hermes", "hermes-agent", ".hermes", "bin", "hermes"], [".local", "bin", "hermes"], "/var/lib/hermes/hermes-agent/.hermes/bin/hermes"] },
 };
-export const WAKE_APP_IDS = ["claude-code", "codex", "antigravity", "gemini", "custom"];
-// Where an app's command is: on PATH, or (Antigravity) its default install place, used by full path
-export function wakeBin(c, home_ = home(), exists = existsSync) {
-  if (onPath(c.bin)) return c.bin;
-  const p = c.home && join(home_, ...c.home);
-  return p && exists(p) ? p : null;
+export const WAKE_APP_IDS = ["claude-code", "codex", "antigravity", "hermes", "gemini", "custom"];
+// Where an app's command is: on PATH, or the first of its default install places that exists (path parts under your home
+// folder, or an absolute path), used by full path
+export function wakeBin(c, home_ = home(), exists = existsSync, path = onPath) {
+  if (path(c.bin)) return c.bin;
+  for (const w of c.home || []) {
+    const p = typeof w === "string" ? w : join(home_, ...w);
+    if (exists(p)) return p;
+  }
+  return null;
 }
 // codex exec runs with approval "never", so an MCP call that needs approval is refused: approve just the two OwlMem
 // tools it needs to report back, as tool tables under the [mcp_servers.owlmem] that install wrote (append only)
@@ -840,6 +851,56 @@ export function allowAntigravity(home_ = home()) {
   writeFileSync(f, JSON.stringify(j, null, 2) + "\n");
   return true;
 }
+// Hermes calls MCP tools without asking unless the server is marked `trust: untrusted` (or an unknown value) under mcp_servers in
+// ~/.hermes/config.yaml; then unattended runs refuse its write tools. Only in that case, add the two OwlMem tools it reports back
+// with to the top-level command_allowlist as mcp:<server>/<tool> (what Hermes itself writes for "Always"). Adds lines only,
+// never rewrites what's there; a command_allowlist it can't extend safely (not a plain block list) returns "manual".
+// false: nothing to do (no config, no OwlMem server in it, a trusted one, or the entries are already there).
+export function allowHermes(home_ = home(), env = process.env) {
+  const f = join(env.HERMES_HOME || join(home_, ".hermes"), "config.yaml");
+  let t; try { t = readFileSync(f, "utf8"); } catch { return false; }
+  const lines = t.split(/\r?\n/), ind = (l) => l.match(/^ */)[0].length, live = (l) => !!l.trim() && !l.trim().startsWith("#");
+  const top = lines.findIndex((l) => /^mcp_servers:\s*(#.*)?$/.test(l));
+  if (top < 0) return false;
+  let end = top + 1;
+  while (end < lines.length && (!live(lines[end]) || ind(lines[end]) > 0)) end++;
+  const kids = [];
+  let step = 0;
+  for (let i = top + 1; i < end; i++) if (live(lines[i])) { step ||= ind(lines[i]); if (ind(lines[i]) === step) kids.push(i); }
+  let server = null, trust = "full";
+  for (const [k, i] of kids.entries()) {         // the OwlMem entry: named owlmem, or its url is ours
+    const m = lines[i].trim().match(/^["']?([A-Za-z0-9_.-]+)["']?:\s*(#.*)?$/);
+    if (!m) continue;
+    const body = lines.slice(i + 1, k + 1 < kids.length ? kids[k + 1] : end), first = body.find(live);
+    if (m[1] !== "owlmem" && !body.some((l) => l.includes("owlmem.com/mcp"))) continue;
+    server = m[1];
+    const tr = first && body.find((l) => ind(l) === ind(first) && /^\s*trust:/.test(l));
+    if (tr) trust = tr.replace(/#.*/, "").slice(tr.indexOf(":") + 1).trim().replace(/^["']|["']$/g, "");
+    break;
+  }
+  if (!server || trust === "full") return false;
+  const need = ["kb_task_update", "kb_inbox"].map((n) => "mcp:" + server + "/" + n);
+  const at = lines.findIndex((l) => /^command_allowlist:/.test(l));
+  if (at < 0) {
+    writeFileSync(f, t.replace(/\n*$/, "\n") + "# OwlMem auto-wake: unattended hermes -z may call these two OwlMem tools to report back\ncommand_allowlist:\n" +
+      need.map((r) => "  - " + r + "\n").join(""));
+    return true;
+  }
+  if (!/^command_allowlist:\s*(#.*)?$/.test(lines[at])) return "manual";      // [a, b] on one line, or a string: leave it to the person
+  let last = at, pad = null;
+  for (let i = at + 1; i < lines.length && (!live(lines[i]) || ind(lines[i]) > 0 || lines[i].startsWith("- ")); i++) {
+    if (!live(lines[i])) continue;
+    if (!/^\s*- /.test(lines[i])) return "manual";
+    pad ??= lines[i].match(/^\s*/)[0];
+    last = i;
+  }
+  const have = lines.slice(at + 1, last + 1).map((l) => l.replace(/\s#.*/, "").trim().replace(/^-\s*/, "").replace(/^["']|["']$/g, ""));
+  const add = need.filter((r) => !have.includes(r));
+  if (!add.length) return false;
+  lines.splice(last + 1, 0, ...add.map((r) => (pad ?? "  ") + "- " + r));
+  writeFileSync(f, lines.join("\n"));
+  return true;
+}
 export const WAKE_DEFAULTS = { max_parallel: 2, timeout_min: 30 };
 const WAKE_UNIT = "owlmem-wake.service", WAKE_LABEL = "com.owlmem.wake", WAKE_TASK = "OwlMem Wake", WAKE_RUNKEY = "OwlMemWake";
 const wakeDir = (dir = DIR) => join(dir, "wake");
@@ -997,7 +1058,7 @@ export function planWorkdir(task, h = home(), git = gitRun) {
 }
 export function prepareWorkdir(task, plan, dir = DIR, git = gitRun) {
   if (plan.kind === "missing") throw new Fail("the task's directory doesn't exist on this computer: " + plan.dir);
-  if (plan.kind === "scratch") { const cwd = join(wakeDir(dir), "scratch", "task-" + task.id); mkdirSync(cwd, { recursive: true }); return { cwd }; }
+  if (plan.kind === "scratch") { const cwd = join(wakeDir(dir), "scratch", jobName(task)); mkdirSync(cwd, { recursive: true }); return { cwd }; }
   if (plan.kind === "dir") return { cwd: plan.dir };
   const branch = "owlmem/task-" + task.id, wt = join(wakeDir(dir), "worktrees", basename(plan.top) + "-task-" + task.id);
   if (!existsSync(wt)) {
@@ -1010,7 +1071,33 @@ export function prepareWorkdir(task, plan, dir = DIR, git = gitRun) {
   return { cwd: rel ? join(wt, rel) : wt, worktree: wt, branch, repo: plan.top };
 }
 
+// A job from OwlMem is a task given to this AI (type "task"), or the result of a task this AI gave someone else (type "reply":
+// the automatic note sent when that task was done or declined). Older OwlMem servers send no type: a task.
+const isReply = (t) => t?.type === "reply";
+const jobName = (t) => (isReply(t) ? "reply-" : "task-") + t.id;
+const shortName = (who) => { who = String(who || ""); return who.startsWith("user:") ? who.slice(5) : who.includes("/") ? who.split("/").slice(1).join("/") : who; };
+
+// Woken for a reply: read it (kb_inbox marks it read; that's how OwlMem knows it was handled), act on it only if needed.
+export function replyPrompt(r, o = {}) {
+  const by = shortName(r.by), done = r.result === "done", note = String(r.note || "").trim(), mins = o.timeout_min || WAKE_DEFAULTS.timeout_min;
+  if (r.zh) return `奥麦自动唤醒在 ${o.machine || "这台电脑"} 上启动了你（${r.agent}）。没有人在看这个会话，也没人能回答问题。
+
+你派的任务 #${r.task_id}「${r.task_title || ""}」有了结果：${by} ${done ? "完成" : "拒绝"}了，${done ? "结果" : "原因"}：${note || "（没写）"}
+
+先用 kb_inbox 看这封回信（#${r.id}，会标成已读）；需要接着做（换人派、把结果告诉站长、自己补做）就做；没有要做的就直接结束，不要发任何消息。
+不要把密码、令牌、密钥写进任何消息。你有 ${mins} 分钟。
+`;
+  return `OwlMem auto-wake started you (${r.agent}) on ${o.machine || "this computer"}. Nobody is watching this session and nobody can answer questions.
+
+The task you gave out, #${r.task_id} "${r.task_title || ""}", has a result: ${by} ${done ? "finished it" : "declined it"}. ${done ? "Result" : "Reason"}: ${note || "(none given)"}
+
+First read this reply with kb_inbox (#${r.id}; that marks it read). If something needs doing next (hand it to someone else, tell your user the result, do it yourself), do it. If nothing does, just end here and don't send any message.
+Never put passwords, tokens, keys or other secrets in any message. You have ${mins} minutes.
+`;
+}
+
 export function wakePrompt(task, place, o = {}) {
+  if (isReply(task)) return replyPrompt(task, o);
   const id = task.id, mins = o.timeout_min || WAKE_DEFAULTS.timeout_min;
   const where = place.worktree
     ? `Work in ${place.cwd}. It is a separate git worktree of ${place.repo} on the branch ${place.branch}, made for this task so it doesn't collide with other work. Commit your changes on this branch only. Don't merge, rebase or push other branches, and don't touch ${place.repo} itself. Put the branch name in your result so a person can review and merge it.`
@@ -1043,7 +1130,7 @@ export async function runTask(task, cfg, o = {}) {
   const prompt = wakePrompt(task, place, { machine: cfg.machine, timeout_min: cfg.timeout_min });
   const argv = [...cl.command, ...(cl.prompt === "arg" ? [prompt] : [])];
   mkdirSync(join(wakeDir(dir), "logs"), { recursive: true });
-  const logPath = join(wakeDir(dir), "logs", "task-" + task.id + ".log");
+  const logPath = join(wakeDir(dir), "logs", jobName(task) + ".log");
   const fd = openSync(logPath, "a");
   const win = (o.platform || platform()) === "win32";
   const ms = o.timeoutMs ?? (cfg.timeout_min || WAKE_DEFAULTS.timeout_min) * 60000;
@@ -1052,7 +1139,7 @@ export async function runTask(task, cfg, o = {}) {
       let ch, timedOut = false, killer = null;
       try {
         ch = spawn(argv[0], argv.slice(1), { cwd: place.cwd, stdio: ["pipe", fd, fd], detached: !win, shell: win, windowsHide: true,
-          env: { ...process.env, OWLMEM_NO_BROWSER: "1", OWLMEM_WAKE_TASK: String(task.id) } });
+          env: { ...process.env, OWLMEM_NO_BROWSER: "1", [isReply(task) ? "OWLMEM_WAKE_REPLY" : "OWLMEM_WAKE_TASK"]: String(task.id) } });
       } catch (e) { res({ outcome: "error", detail: "couldn't start " + argv[0] + ": " + e.message }); return; }
       const kill = (sig) => { try { if (win) spawnSync("taskkill", ["/T", "/F", "/PID", String(ch.pid)]); else process.kill(-ch.pid, sig); } catch { try { ch.kill(sig); } catch {} } };
       const timer = setTimeout(() => { timedOut = true; kill("SIGTERM"); killer = setTimeout(() => kill("SIGKILL"), 10000); }, ms);
@@ -1109,15 +1196,93 @@ export async function wakeLoop(o) {
     }
     backoff = 0;
     for (const t of r.data.tasks || []) {
-      const plan = o.plan ? o.plan(t) : planWorkdir(t);
-      log("Task #" + t.id + " for " + t.agent + ": starting " + t.client + (plan.dir ? " in " + plan.dir : "") + ".");
+      const plan = isReply(t) ? { kind: "scratch" } : o.plan ? o.plan(t) : planWorkdir(t);      // a reply is read in an empty folder
+      log((isReply(t) ? "Reply #" + t.id + " (task #" + t.task_id + ")" : "Task #" + t.id) + " for " + t.agent + ": starting " + t.client + (plan.dir ? " in " + plan.dir : "") + ".");
       sched.add({ id: t.id, agent: t.agent, lock: plan.lock || null, task: t, plan });
     }
+    // OwlMem says a newer version is out: update only while nothing runs or waits (no task is cut off), then restart
+    if (o.update && newer(r.data.latest, VERSION) && !(r.data.tasks || []).length && sched.size === 0) {
+      if ((await o.update(r.data.latest)) === "restart") return "updated";
+    }
     if (once) return r.data.status;
     if (Date.now() - t0 < 1000 && !(r.data.tasks || []).length) await sleep(1000);       // never spin
   }
 }
 
+// ── auto-wake updates itself ──
+// The program runs its own copy (wake/owlmem.mjs). When OwlMem's poll answer names a newer version (latest), and nothing is
+// running: download that version's package from the npm registry, check it against the registry's sha512, take owlmem.mjs
+// out of it, check that it runs and says it is that version, then swap it in (rename in the same folder, so it's all or
+// nothing) and restart. If anything fails the old copy keeps running, and that version isn't tried again for 24 hours.
+// Restart: on Linux and macOS the program exits with WAKE_RESTART_CODE; the systemd unit (Restart=on-failure) and the
+// LaunchAgent (KeepAlive unless the exit was successful) start it again 30 s later. On Windows nothing watches it, so it
+// starts the new copy itself (detached, like the logon launcher) and then exits.
+export const WAKE_RESTART_CODE = 75;
+const UPDATE_RETRY = 24 * 3600 * 1000;
+const REGISTRY = () => String(process.env.npm_config_registry || "https://registry.npmjs.org").replace(/\/+$/, "");
+export function newer(a, b) {
+  const p = (v) => (/^\d+\.\d+\.\d+$/.test(String(v || "")) ? String(v).split(".").map(Number) : null);
+  const x = p(a), y = p(b);
+  if (!x || !y) return false;
+  for (let i = 0; i < 3; i++) if (x[i] !== y[i]) return x[i] > y[i];
+  return false;
+}
+// The one file we need from an npm package (.tgz): plain ustar, read in memory.
+export function tarFile(tgz, want = "package/owlmem.mjs") {
+  const t = gunzipSync(tgz);
+  for (let off = 0; off + 512 <= t.length;) {
+    const h = t.subarray(off, off + 512);
+    if (h.every((b) => b === 0)) break;
+    const str = (a, b) => h.subarray(a, b).toString("utf8").replace(/\0.*$/s, "");
+    const name = (str(345, 500) ? str(345, 500) + "/" : "") + str(0, 100), size = parseInt(str(124, 136).trim() || "0", 8), type = str(156, 157);
+    if ((type === "0" || type === "") && name === want) return t.subarray(off + 512, off + 512 + size);
+    off += 512 + Math.ceil(size / 512) * 512;
+  }
+  return null;
+}
+// → "restart" (new copy in place) | "skip" (tried that version less than 24 h ago) | "failed" (old copy stays)
+export async function wakeUpdate(latest, o = {}) {
+  const dir = o.dir || DIR, log = o.log || (() => {}), now = o.now || Date.now, get = o.fetch || fetch;
+  const wd = wakeDir(dir), state = join(wd, "update.json"), target = join(wd, "owlmem.mjs"), tmpFile = join(wd, "owlmem.update.mjs");
+  let st = {}; try { st = JSON.parse(readFileSync(state, "utf8")); } catch {}
+  if (st.version === latest && now() - (st.at || 0) < UPDATE_RETRY) return "skip";
+  try { mkdirSync(wd, { recursive: true }); writeFileSync(state, JSON.stringify({ version: latest, at: now() }) + "\n"); } catch {}
+  log("Updating auto-wake from " + VERSION + " to " + latest + ".");
+  try {
+    const meta = await get(REGISTRY() + "/owlmem/" + encodeURIComponent(latest), { signal: AbortSignal.timeout(60000) });
+    if (!meta.ok) throw new Error("registry answered HTTP " + meta.status);
+    const dist = (await meta.json())?.dist || {};
+    const m = /^sha512-(.+)$/.exec(String(dist.integrity || ""));
+    if (!dist.tarball || !m) throw new Error("the registry gave no package or checksum");
+    const res = await get(dist.tarball, { signal: AbortSignal.timeout(120000) });
+    if (!res.ok) throw new Error("download answered HTTP " + res.status);
+    const tgz = Buffer.from(await res.arrayBuffer());
+    if (createHash("sha512").update(tgz).digest("base64") !== m[1]) throw new Error("the download doesn't match the registry's checksum");
+    const file = tarFile(tgz);
+    if (!file) throw new Error("owlmem.mjs isn't in the package");
+    writeFileSync(tmpFile, file);
+    const check = (o.check || ((f) => { const r = spawnSync(process.execPath, [f, "--version"], { encoding: "utf8", timeout: 30000, env: { ...process.env, OWLMEM_NO_BROWSER: "1" } }); return (r.stdout || "").trim(); }))(tmpFile);
+    if (check !== latest) throw new Error("the new copy says it is " + JSON.stringify(check) + ", not " + latest);
+    renameSync(tmpFile, target);
+  } catch (e) {
+    rmSync(tmpFile, { force: true });
+    log("Update to " + latest + " failed (" + (e?.message || e) + "); keeping " + VERSION + " and not trying " + latest + " again for 24 hours.");
+    return "failed";
+  }
+  log("Updated auto-wake to " + latest + "; restarting.");
+  return "restart";
+}
+// After an update: come back as the new copy (see above).
+export function wakeRestart(o = {}) {
+  const p = o.platform || platform(), exit = o.exit || ((c) => process.exit(c));
+  if (p === "win32") {
+    const run = o.spawn || ((argv) => spawn(argv[0], argv.slice(1), { stdio: "ignore", detached: true, windowsHide: true, env: process.env }).on("error", () => {}).unref());
+    run([process.execPath, join(wakeDir(o.dir || DIR), "owlmem.mjs"), "wake", "run"]);
+    return exit(0);
+  }
+  return exit(WAKE_RESTART_CODE);
+}
+
 function wakeApi() {
   return async (sub, body) => {
     const url = BASE + "/v1/wake/" + sub;
@@ -1145,7 +1310,7 @@ async function wakeRun() {
   if (!cfg) throw new Fail("Auto-wake isn't set up on this computer. Run: npx -y owlmem wake enable");
   const log = wakeLogger(), api = wakeApi();
   const report = async (j, res) => {
-    log("Task #" + j.id + ": " + res.outcome + (res.code != null ? " (exit code " + res.code + ")" : "") + (res.detail ? " — " + res.detail : ""));
+    log((isReply(j.task) ? "Reply #" : "Task #") + j.id + ": " + res.outcome + (res.code != null ? " (exit code " + res.code + ")" : "") + (res.detail ? " — " + res.detail : ""));
     for (let i = 0; i < 5; i++) {
       const r = await api("report", { id: j.id, outcome: res.outcome, code: res.code ?? null, detail: res.detail || "" });
       if (r.status === 200 || r.status === 404 || r.status === 401) return;
@@ -1154,8 +1319,19 @@ async function wakeRun() {
   };
   const sched = new Scheduler({ max: cfg.max_parallel || WAKE_DEFAULTS.max_parallel, start: (j) => runTask(j.task, cfg, { plan: j.plan }), onDone: (j, res) => { report(j, res); } });
   log("OwlMem auto-wake " + VERSION + " running on " + (cfg.machine || hostname()) + ".");
-  const out = await wakeLoop({ cfg, api, sched, log, cleanup: () => { try { wakeUninstall(autostartOpts(), wakeRunCmd, true); } catch (e) { log("cleanup: " + e.message); } } });
+  const out = await wakeLoop({ cfg, api, sched, log, update: (v) => wakeUpdate(v, { log }),
+    cleanup: () => { try { wakeUninstall(autostartOpts(), wakeRunCmd, true); } catch (e) { log("cleanup: " + e.message); } } });
   if (out === "revoked") process.exit(0);
+  if (out === "updated") wakeRestart();
+}
+
+// No command line auto-wake can start: tell OwlMem support which AI apps this computer has, so it can add them. Only the
+// system, CPU architecture, node version and app names (what install detects) — no paths, user name or computer name.
+export async function wakeNoClients(api, items = null) {
+  let apps = [];
+  try { apps = (items || plan()).filter((r) => r.state !== "missing").map((r) => r.name); } catch {}
+  const r = await api("feedback", { os: platform(), arch: process.arch, node: process.versions.node, apps: [...new Set(apps)] });
+  return r.status === 200;
 }
 
 async function wakeEnable(args = []) {
@@ -1168,10 +1344,18 @@ async function wakeEnable(args = []) {
     const bin = !clients[id] && wakeBin(c);
     if (bin) clients[id] = { command: [bin, ...c.command.slice(1)], prompt: c.prompt };
   }
-  if (!Object.keys(clients).length)
-    throw new Fail("No AI command line found on this computer that auto-wake can start (Claude Code: claude, Codex: codex, Antigravity: agy). Install one, or add its command to " + wakeFile() + " under \"clients\".");
+  if (!Object.keys(clients).length) {
+    const told = await wakeNoClients(wakeApi()).catch(() => false);
+    throw new Fail("No AI command line found on this computer that auto-wake can start (Claude Code: claude, Codex: codex, Antigravity: agy, Hermes: hermes). Install one, or add its command to " + wakeFile() + " under \"clients\"." +
+      (told ? "\nOwlMem support has been told; you'll hear from us once your AI app is supported." : ""));
+  }
   if (clients.codex && allowCodex()) say("Let Codex report back to OwlMem when nobody is watching (2 tool approvals in ~/.codex/config.toml).");
   if (clients.antigravity && allowAntigravity()) say("Let Antigravity's command line report back to OwlMem when nobody is watching (2 rules in ~/.gemini/antigravity-cli/settings.json).");
+  if (clients.hermes) {
+    const h = allowHermes();
+    if (h === true) say("Let Hermes report back to OwlMem when nobody is watching (2 entries under command_allowlist in ~/.hermes/config.yaml).");
+    else if (h === "manual") say("Hermes treats OwlMem as untrusted: add mcp:<server>/kb_task_update and mcp:<server>/kb_inbox to command_allowlist in ~/.hermes/config.yaml, or it can't report back when nobody is watching.");
+  }
   const cfg = { v: 1, ...WAKE_DEFAULTS, ...old, machine: process.env.OWLMEM_DEVICE_NAME || hostname(), clients, ...(max ? { max_parallel: max } : {}), ...(timeout ? { timeout_min: timeout } : {}), boot: boot || !!old.boot };
   // OwlMem knows these app names; a command you add yourself to wake.json goes under "gemini" or "custom"
   const r = await wakeApi()("pair", { clients: Object.keys(clients).filter((c) => WAKE_APP_IDS.includes(c)), force: again });
@@ -1184,7 +1368,8 @@ async function wakeEnable(args = []) {
   say("Auto-wake is installed (" + a.kind + ": " + tilde(a.file) + ").");
   say("Apps it can start here: " + Object.keys(clients).map((c) => WAKE_CLIENTS[c]?.name || c).join(", ") + ". At most " + cfg.max_parallel + " at once, " + cfg.timeout_min + " minutes per task.");
   if (r.data.status === "pending") {
-    say("\nApprove this computer in the OwlMem console and pick which AI each app is:\n\n  " + r.data.url + "\n\nCheck that the console shows this code: " + r.data.code + "\nUntil then auto-wake waits and starts nothing.");
+    say("\nApprove this computer in the OwlMem console and pick which AI each app is:\n\n  " + r.data.url + "\n\nCheck that the console shows this code: " + r.data.code + "\nUntil then auto-wake waits and starts nothing." +
+      "\n(If you're an AI agent running this: send the link and the code to the person who turned auto-wake on, with kb_send.)");
     openBrowser(r.data.url);
   } else say("This computer is already paired (" + r.data.code + "). Turn auto-wake on or off for each AI in the console (AI agents → Agents).");
 }
@@ -1218,7 +1403,7 @@ async function wakeStatus() {
 const WAKE_HELP = `Usage: npx -y owlmem wake <enable|disable|status>
 
 Auto-wake starts the AI on this computer when it gets an OwlMem task (Claude Code with \`claude -p\`, Codex with
-\`codex exec\`), without you opening it. It runs in the background from login, for this user only.
+\`codex exec\`, Antigravity with \`agy -p\`, Hermes with \`hermes -z\`), without you opening it. It runs in the background from login, for this user only.
 
   enable [--boot] [--max N] [--timeout MIN] [--again]
                  install it and pair this computer (approve in the console). --boot (Linux): run from boot,
@@ -1262,12 +1447,12 @@ export async function main(argv) {
   if (cmd === "uninstall") { await install(["--uninstall", ...argv.slice(1)]); return; }
   if (cmd === "mcp") { await mcpServe(); return; }
   if (cmd === "wake") { await wakeCmd(sub, rest); return; }
-  if (cmd === "device") {          // register this machine for standing grants and show its fingerprint
+  if (cmd === "device") {          // show this machine's fingerprint (the console lists approved computers with it)
     const r = await call("POST", "device", {});
     if (r.status >= 400) throw new Fail(r.data.detail || r.data.error || "HTTP " + r.status);
     say("This machine: " + (process.env.OWLMEM_DEVICE_NAME || hostname()));
     console.log(r.data.device);
-    say("Registered for " + r.data.agent + ". In the OwlMem console (Vault → Standing grants) pick the machine with this fingerprint.");
+    say("This computer's fingerprint for " + r.data.agent + ". With a standing grant on, the first use here asks once; approving remembers this computer.");
     return;
   }
   if (cmd === "login") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "owlmem",
-  "version": "0.7.3",
+  "version": "0.7.7",
   "description": "OwlMem command line: connect your AI apps to OwlMem in one command (npx -y owlmem install), an end-to-end encrypted vault for your AI agents, and a local MCP server.",
   "type": "module",
   "bin": { "owlmem": "owlmem.mjs" },