thinkpool-pair 0.7.234 → 0.7.236

package/bridge.mjs

@@ -264,6 +264,39 @@ if (argv[0] === 'set-default-dir') {
   process.exit(0)
 }
 if (argv[0] === 'provider') { const { runProvider } = await import('./provider.mjs'); await runProvider(argv.slice(1)); process.exit(0) }
+if (argv[0] === 'setup-hermes') {
+  const clone = argv.includes('--clone')
+  const clean = argv.includes('--clean')
+  if (clone && clean) { console.error('  choose one Hermes setup mode: --clone or --clean'); process.exit(1) }
+  let mode = clone ? 'clone' : clean ? 'clean' : undefined
+  if (!mode && process.stdin.isTTY) {
+    const answer = await new Promise((resolve) => {
+      const rl = readline.createInterface({ input: process.stdin, output: process.stderr })
+      rl.question('\n  Clone your active Hermes provider/config into an isolated thinkpool profile? [Y/n] ', (value) => { rl.close(); resolve(String(value).trim()) })
+    })
+    mode = /^n/i.test(answer) ? 'clean' : 'clone'
+  }
+  try {
+    const { setupHermesRuntime } = await import('./hermes-setup.mjs')
+    const result = setupHermesRuntime({ mode })
+    process.stderr.write(`\n  ◆ Hermes ${result.version || ''} is ready for ThinkPool ordinary lanes.\n    profile: ${result.profile} (${result.created ? `${result.mode} created` : 'existing'})\n    hidden delegation: blocked\n${result.created && result.mode === 'clean' ? '    provider: run `thinkpool setup` before the first model turn\n' : ''}\n`)
+    process.exit(0)
+  } catch (error) {
+    console.error(`\n  ◇ Hermes setup failed: ${error?.message || error}\n    New profile: npx thinkpool-pair@latest setup-hermes --clone\n    Clean profile: npx thinkpool-pair@latest setup-hermes --clean\n`)
+    process.exit(1)
+  }
+}
+if (argv[0] === 'verify-hermes-isolation') {
+  try {
+    const { verifyHermesMcpIsolation } = await import('./hermes-isolation.mjs')
+    const evidence = await verifyHermesMcpIsolation({ rounds: 2 })
+    process.stderr.write(`\n  ◆ Hermes MCP isolation HELD for ${evidence.length} consecutive two-lane rounds.\n    Each ACP session advertised only its lane-bound marker endpoint.\n    No model inference was used.\n\n`)
+    process.exit(0)
+  } catch (error) {
+    console.error(`\n  ◇ Hermes MCP isolation VIOLATED or unproven: ${error?.message || error}\n`)
+    process.exit(1)
+  }
+}
 
 // One-command launcher: a bare invocation on a TTY (or the `setup` alias) opens the
 // interactive menu instead of going straight to account mode. The menu only ASSEMBLES
@@ -310,6 +343,12 @@ if ((!argv[0] || argv[0] === 'setup') && process.stdin.isTTY) {
         : ['anthropic']
       await runProvider(args)
     },
+    setupHermes: async ({ mode }) => {
+      const { setupHermesRuntime } = await import('./hermes-setup.mjs')
+      const result = setupHermesRuntime({ mode })
+      io.print(`\n  ✓ Hermes ${result.version || ''} ready — isolated profile, ACP healthy, hidden delegation blocked.`)
+      if (result.created && result.mode === 'clean') io.print('    Run `thinkpool setup` once to choose a provider before the first model turn.')
+    },
   }
   await runLauncher({ actions, io, refresh: detectState })
   process.exit(0)

package/hermes-event-mapper.mjs

@@ -109,6 +109,18 @@ export class HermesEventMapper {
   }
 
   finishTurn({ stopReason = 'end_turn', usage = null } = {}) {
+    if (stopReason === 'cancelled') {
+      for (const [toolCallId, tool] of this.tools) {
+        this._emit({
+          kind: 'tool_result', toolUseId: toolCallId,
+          content: [{ type: 'text', text: '[cancelled]' }],
+          isError: false,
+          durationMs: tool.startedAt ? Date.now() - tool.startedAt : undefined,
+          parentToolUseId: null,
+        })
+      }
+    }
+    this.tools.clear()
     const blocks = []
     if (this.thought) blocks.push({ type: 'thinking', text: this.thought })
     if (this.text) blocks.push({ type: 'text', text: this.text })

package/hermes-isolation.mjs

@@ -0,0 +1,59 @@
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { randomUUID } from 'node:crypto'
+import { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk'
+import { startHermesSession } from './hermes-session.mjs'
+
+const waitFor = (predicate, timeoutMs = 25_000) => new Promise((resolve, reject) => {
+  const started = Date.now()
+  const timer = setInterval(() => {
+    if (predicate()) { clearInterval(timer); resolve() }
+    else if (Date.now() - started > timeoutMs) { clearInterval(timer); reject(new Error('Hermes MCP isolation probe timed out')) }
+  }, 50)
+})
+
+export function assertHermesIsolation(outputs, markers) {
+  if (!Array.isArray(outputs) || outputs.length !== 2 || !Array.isArray(markers) || markers.length !== 2) {
+    throw new TypeError('Hermes MCP isolation requires exactly two session outputs and markers')
+  }
+  for (let i = 0; i < 2; i++) {
+    if (!outputs[i].includes(`mcp__thinkpool__${markers[i]}`)) throw new Error(`Hermes lane ${i + 1} did not advertise its own MCP marker`)
+    if (outputs[i].includes(`mcp__thinkpool__${markers[1 - i]}`)) throw new Error(`Hermes lane ${i + 1} advertised the other lane's MCP marker`)
+  }
+  return true
+}
+
+export async function verifyHermesMcpIsolation({ rounds = 2, sessionFactory = startHermesSession } = {}) {
+  const evidence = []
+  for (let round = 0; round < rounds; round++) {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), 'tp-hermes-mcp-isolation-'))
+    const suffix = randomUUID().replaceAll('-', '').slice(0, 10)
+    const markers = [`lane_alpha_${suffix}`, `lane_beta_${suffix}`]
+    const events = [[], []]
+    const sessions = []
+    try {
+      for (let i = 0; i < 2; i++) {
+        const cwd = path.join(root, i === 0 ? 'alpha' : 'beta')
+        fs.mkdirSync(cwd)
+        const sdkServer = createSdkMcpServer({
+          name: 'thinkpool', version: '1.0.0',
+          tools: [tool(markers[i], 'Synthetic ThinkPool lane-isolation marker.', {}, async () => ({ content: [{ type: 'text', text: markers[i] }] }))],
+        })
+        sessions.push(sessionFactory({ cwd, lazy: true, mcpServers: { thinkpool: sdkServer }, onEvent: (event) => events[i].push(event) }))
+      }
+      sessions.forEach((session) => session.sendTurn('/tools'))
+      await waitFor(() => events.every((list) => list.some((event) => event.kind === 'result') || list.some((event) => event.kind === 'error')))
+      const errors = events.flatMap((list) => list.filter((event) => event.kind === 'error'))
+      if (errors.length) throw new Error(`Hermes MCP isolation probe failed: ${errors.map((event) => event.message).join('; ')}`)
+      const outputs = events.map((list) => list.filter((event) => event.kind === 'assistant_stream').map((event) => event.text).join(''))
+      assertHermesIsolation(outputs, markers)
+      evidence.push({ round: round + 1, markers, sessionIds: sessions.map((session) => session.sessionId) })
+    } finally {
+      sessions.forEach((session) => session.end())
+      await new Promise((resolve) => setTimeout(resolve, 250))
+      fs.rmSync(root, { recursive: true, force: true })
+    }
+  }
+  return evidence
+}

package/hermes-probe.mjs

@@ -2,17 +2,20 @@ import { execFileSync } from 'node:child_process'
 
 const clean = (value) => String(value || '').replace(/[\r\n]+/g, ' ').trim()
 
-export function probeHermesRuntime({ command = 'thinkpool', execFile = execFileSync, env = process.env } = {}) {
+export function probeHermesRuntime({ command = 'thinkpool', prefixArgs = [], execFile = execFileSync, env = process.env } = {}) {
   try {
-    const versionOutput = execFile(command, ['--version'], { encoding: 'utf8', env, timeout: 10_000, stdio: ['ignore', 'pipe', 'pipe'] })
+    const versionOutput = execFile(command, [...prefixArgs, '--version'], { encoding: 'utf8', env, timeout: 10_000, stdio: ['ignore', 'pipe', 'pipe'] })
     const version = clean(versionOutput).match(/Hermes Agent v([^\s]+)/i)?.[1] || null
-    execFile(command, ['acp', '--check'], { encoding: 'utf8', env, timeout: 15_000, stdio: ['ignore', 'pipe', 'pipe'] })
-    const hooksOutput = execFile(command, ['hooks', 'list'], { encoding: 'utf8', env, timeout: 10_000, stdio: ['ignore', 'pipe', 'pipe'] })
-    const guardOutput = execFile(command, ['hooks', 'test', 'pre_tool_call', '--for-tool', 'delegate_task'], { encoding: 'utf8', env, timeout: 10_000, stdio: ['ignore', 'pipe', 'pipe'] })
+    execFile(command, [...prefixArgs, 'acp', '--check'], { encoding: 'utf8', env, timeout: 15_000, stdio: ['ignore', 'pipe', 'pipe'] })
+    const hooksOutput = execFile(command, [...prefixArgs, 'hooks', 'list'], { encoding: 'utf8', env, timeout: 10_000, stdio: ['ignore', 'pipe', 'pipe'] })
+    const doctorOutput = execFile(command, [...prefixArgs, 'hooks', 'doctor'], { encoding: 'utf8', env, timeout: 10_000, stdio: ['ignore', 'pipe', 'pipe'] })
+    const guardOutput = execFile(command, [...prefixArgs, 'hooks', 'test', 'pre_tool_call', '--for-tool', 'delegate_task'], { encoding: 'utf8', env, timeout: 10_000, stdio: ['ignore', 'pipe', 'pipe'] })
+    const doctorHealthy = /All shell hooks look healthy/i.test(doctorOutput)
+      && !/(?:issue\(s\) found|modified since approval|⚠)/i.test(doctorOutput)
     const delegationBlocked = /(?:action|decision)["']?\s*[:=]\s*["']block/i.test(guardOutput)
       && /ThinkPool blocks hidden Hermes delegation/i.test(guardOutput)
       && /pre_tool_call[\s\S]*delegate_task[\s\S]*(?:✓ allowed|allowed)/i.test(hooksOutput)
-    if (!delegationBlocked) return { available: false, version, reason: 'delegate_task is not structurally blocked by the dedicated Hermes profile' }
+    if (!doctorHealthy || !delegationBlocked) return { available: false, version, reason: 'delegate_task guard is not healthy, unchanged, allowlisted, and structurally blocking in the dedicated Hermes profile' }
     return { available: true, version, acpProtocol: 1, delegationBlocked: true }
   } catch (error) {
     return { available: false, version: null, reason: clean(error?.stderr || error?.message || error) }

package/hermes-session.mjs

@@ -14,6 +14,7 @@ export const HERMES_ACP_PROTOCOL_VERSION = 1
 export const HERMES_SUPPORTED_MODES = new Set(['default', 'acceptEdits'])
 
 const HERMES_SECRET_ENV_KEY = /(?:TOKEN|SECRET|PASSWORD|PRIVATE_KEY|API_KEY|ACCESS_KEY|CREDENTIAL)/i
+const HERMES_REPLAY_UPDATES = new Set(['agent_message_chunk', 'agent_thought_chunk', 'tool_call', 'tool_call_update', 'plan'])
 export const hermesChildEnv = (env = {}) => Object.fromEntries(
   Object.entries(env).filter(([key]) => !HERMES_SECRET_ENV_KEY.test(key)),
 )
@@ -61,6 +62,10 @@ export function startHermesSession({
   let firstTurn = true
   let stderrTail = ''
   let promptChain = Promise.resolve()
+  let activeTurnId = 0
+  const abortedTurns = new Set()
+  let retireClient = () => {}
+  let resuming = false
 
   const emit = (event) => { try { onEvent?.(event) } catch { /* consumer isolation */ } }
 
@@ -79,7 +84,10 @@ export function startHermesSession({
   }
 
   function onNotification(method, params) {
-    if (method === 'session/update') mapper?.push(params)
+    if (method !== 'session/update') return
+    const update = params?.update || params
+    if (resuming && HERMES_REPLAY_UPDATES.has(update?.sessionUpdate)) return
+    mapper?.push(params)
   }
 
   async function boot() {
@@ -101,13 +109,15 @@ export function startHermesSession({
         const profile = probeHermesRuntime({ command, env: childEnv })
         if (!profile.available) throw new Error(`Hermes profile safety check failed: ${profile.reason || 'runtime unavailable'}`)
       }
+      let retired = false
+      retireClient = () => { retired = true }
       client = clientFactory({
         command, args, cwd: activeCwd, env: childEnv,
         onNotification,
         onRequest,
         onStderr: (text) => { stderrTail = (stderrTail + text).slice(-2000) },
         onClose: (error) => {
-          if (ended || crashed) return
+          if (ended || crashed || retired) return
           crashed = true
           turnActive = false
           emit({ kind: 'error', message: `Hermes ACP closed unexpectedly: ${error?.message || error}`, recoverable: true })
@@ -129,10 +139,14 @@ export function startHermesSession({
         if (!initialized?.agentCapabilities?.sessionCapabilities?.resume) {
           throw new Error(`Hermes session ${sessionId} cannot be resumed by this ACP release; no fresh session was substituted`)
         }
-        try { state = await client.request('session/resume', { ...params, sessionId }, 30_000) }
+        try {
+          resuming = true
+          state = await client.request('session/resume', { ...params, sessionId }, 30_000)
+        }
         catch (error) {
           throw new Error(`Hermes session ${sessionId} is not available; no fresh session was substituted (${error?.message || error})`)
         }
+        finally { resuming = false }
       } else state = await client.request('session/new', params, 30_000)
       if (!sessionId) sessionId = state?.sessionId || null
       if (!sessionId) throw new Error('Hermes ACP did not return a session id')
@@ -158,6 +172,15 @@ export function startHermesSession({
     return starting
   }
 
+  async function restartAfterCancelledResponseFailure() {
+    const oldClient = client
+    retireClient()
+    client = null
+    mapper = null
+    oldClient?.end()
+    await boot()
+  }
+
   function promptBlocks(text, options = {}) {
     const rawText = String(text)
     // Hermes handles /steer, /queue, /compact and /reset only when the slash is
@@ -175,14 +198,33 @@ export function startHermesSession({
   async function runPrompt(text, options = {}) {
     await boot()
     const steering = turnActive
+    const turnId = steering ? activeTurnId : ++activeTurnId
     const body = steering ? `/steer ${String(text)}` : String(text)
     if (!steering) turnActive = true
-    const result = await client.request('session/prompt', {
-      sessionId,
-      prompt: promptBlocks(body, options),
-      messageId: randomUUID(),
-    }, 0)
+    let result
+    try {
+      result = await client.request('session/prompt', {
+        sessionId,
+        prompt: promptBlocks(body, options),
+        messageId: randomUUID(),
+      }, 0)
+    } catch (error) {
+      // Hermes 0.18.2 successfully interrupts the model/tool, then its ACP
+      // prompt handler can reject with Internal error while constructing the
+      // cancelled response. The bridge already owns the canonical aborted
+      // boundary below, so a late response failure for that exact turn is not a
+      // second turn failure. Process-close errors still surface through onClose.
+      if (abortedTurns.has(turnId)) {
+        // Hermes 0.18.2 throws before clearing its transient is_running flag.
+        // Resume the same persisted session in a fresh per-lane ACP process so
+        // the next queued prompt cannot disappear into that stale runtime queue.
+        if (!ended) await restartAfterCancelledResponseFailure()
+        return { stopReason: 'cancelled' }
+      }
+      throw error
+    }
     if (!steering) {
+      if (abortedTurns.has(turnId)) return result
       turnActive = false
       firstTurn = false
       mapper.finishTurn({ stopReason: result?.stopReason, usage: result?.usage })
@@ -209,8 +251,23 @@ export function startHermesSession({
       return true
     },
     abort() {
-      if (!sessionId || !client?.alive) return
-      void client.notify('session/cancel', { sessionId }).catch(() => { /* process already closed */ })
+      if (!sessionId || !client?.alive || !turnActive) return
+      const turnId = activeTurnId
+      abortedTurns.add(turnId)
+      // Bound retained turn ids while preserving any concurrent /steer request
+      // that may settle after the primary prompt response.
+      if (abortedTurns.size > 32) abortedTurns.delete(abortedTurns.values().next().value)
+      turnActive = false
+      firstTurn = false
+      mapper?.finishTurn({ stopReason: 'cancelled' })
+      void client.notify('session/cancel', { sessionId }).catch((error) => {
+        // Never display a stopped lane while the un-cancelled Hermes process
+        // might still be executing. A transport failure tears down the ACP
+        // process and makes the lane honestly non-resumable until restart.
+        crashed = true
+        client?.end()
+        emit({ kind: 'error', message: `Hermes cancellation delivery failed; ACP process stopped: ${error?.message || error}`, recoverable: true })
+      })
     },
     end() {
       ended = true

package/hermes-setup.mjs

@@ -0,0 +1,157 @@
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { execFileSync } from 'node:child_process'
+import YAML from 'yaml'
+import { probeHermesRuntime } from './hermes-probe.mjs'
+
+export const HERMES_PROFILE = 'thinkpool'
+export const HERMES_GUARD_FILENAME = 'hermes-delegation-guard.mjs'
+
+const clean = (value) => String(value || '').replace(/[\r\n]+/g, ' ').trim()
+const commandText = (guardPath) => `node ${JSON.stringify(guardPath)}`
+const isObject = (value) => value != null && typeof value === 'object' && !Array.isArray(value)
+const isThinkPoolGuard = (entry) => isObject(entry)
+  && entry.matcher === '^delegate_task$'
+  && new RegExp(`${HERMES_GUARD_FILENAME.replaceAll('.', '\\.')}$`).test(String(entry.command || '').replace(/["']/g, ''))
+
+export function hermesGuardPath({ homeDir = os.homedir(), env = process.env, platform = process.platform } = {}) {
+  const dataRoot = platform === 'win32'
+    ? (env.LOCALAPPDATA || path.join(homeDir, 'AppData', 'Local'))
+    : (env.XDG_DATA_HOME || path.join(homeDir, '.local', 'share'))
+  return path.join(dataRoot, 'thinkpool-pair', HERMES_GUARD_FILENAME)
+}
+
+function atomicWrite(filePath, content, { fsImpl = fs, mode = 0o600 } = {}) {
+  fsImpl.mkdirSync(path.dirname(filePath), { recursive: true })
+  const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}`
+  try {
+    fsImpl.writeFileSync(tempPath, content, { mode })
+    fsImpl.chmodSync?.(tempPath, mode)
+    fsImpl.renameSync(tempPath, filePath)
+  } finally {
+    try { fsImpl.rmSync(tempPath, { force: true }) } catch { /* already renamed */ }
+  }
+}
+
+function snapshotFile(filePath, fsImpl) {
+  if (!fsImpl.existsSync(filePath)) return null
+  return {
+    content: fsImpl.readFileSync(filePath),
+    mode: fsImpl.statSync(filePath).mode & 0o777,
+    atimeMs: fsImpl.statSync(filePath).atimeMs,
+    mtimeMs: fsImpl.statSync(filePath).mtimeMs,
+  }
+}
+
+function restoreFile(filePath, snapshot, fsImpl) {
+  if (snapshot) {
+    atomicWrite(filePath, snapshot.content, { fsImpl, mode: snapshot.mode })
+    fsImpl.utimesSync?.(filePath, snapshot.atimeMs / 1000, snapshot.mtimeMs / 1000)
+  }
+  else fsImpl.rmSync(filePath, { force: true })
+}
+
+function profileAliasReady(output, profile) {
+  const escaped = profile.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+  return new RegExp(`Alias:\\s+${escaped}\\s+.*hermes\\s+-p\\s+${escaped}`, 'i').test(String(output || ''))
+}
+
+export function setupHermesRuntime({
+  mode,
+  profile = HERMES_PROFILE,
+  command = 'hermes',
+  env = process.env,
+  homeDir = os.homedir(),
+  platform = process.platform,
+  execFile = execFileSync,
+  fsImpl = fs,
+  guardSource = fs.readFileSync(new URL('./hermes-delegation-guard.mjs', import.meta.url), 'utf8'),
+} = {}) {
+  if (profile !== HERMES_PROFILE) throw new Error(`ThinkPool only manages the isolated Hermes profile ${HERMES_PROFILE}`)
+  if (mode != null && mode !== 'clone' && mode !== 'clean') throw new Error('Hermes setup mode must be clone or clean')
+
+  const run = (args, options = {}) => execFile(command, args, {
+    encoding: 'utf8', env: options.env || env, timeout: options.timeout || 20_000,
+    stdio: ['ignore', 'pipe', 'pipe'],
+  })
+  const profileArgs = ['-p', profile]
+  let show = ''
+  let created = false
+  try { show = run(['profile', 'show', profile]) } catch { /* absent */ }
+  if (!/Profile:\s*thinkpool/i.test(show)) {
+    if (!mode) throw new Error('No isolated Hermes thinkpool profile exists; choose --clone or --clean')
+    const createArgs = ['profile', 'create', profile, '--description', 'Isolated ThinkPool Code runtime.']
+    if (mode === 'clone') createArgs.push('--clone')
+    else createArgs.push('--no-skills')
+    run(createArgs, { timeout: 60_000 })
+    created = true
+    show = run(['profile', 'show', profile])
+  }
+
+  if (!profileAliasReady(show, profile)) {
+    run(['profile', 'alias', profile, '--name', profile])
+    show = run(['profile', 'show', profile])
+    if (!profileAliasReady(show, profile)) throw new Error('Hermes did not create the required thinkpool profile alias')
+  }
+
+  const rawConfigPath = clean(run([...profileArgs, 'config', 'path']))
+  if (!rawConfigPath) throw new Error('Hermes did not report the thinkpool profile config path')
+  const configPath = rawConfigPath.startsWith('~') ? path.join(homeDir, rawConfigPath.slice(1).replace(/^[/\\]/, '')) : path.resolve(rawConfigPath)
+  const profilePathMatch = String(show).match(/^Path:\s*(.+)$/mi)
+  if (!profilePathMatch) throw new Error('Hermes did not report the isolated thinkpool profile path')
+  const profilePath = profilePathMatch[1].trim().startsWith('~')
+    ? path.join(homeDir, profilePathMatch[1].trim().slice(1).replace(/^[/\\]/, ''))
+    : path.resolve(profilePathMatch[1].trim())
+  const relativeConfig = path.relative(profilePath, configPath)
+  if (relativeConfig.startsWith('..') || path.isAbsolute(relativeConfig)) throw new Error('Hermes reported a config path outside the isolated thinkpool profile')
+  let config = {}
+  if (fsImpl.existsSync(configPath)) {
+    const parsed = YAML.parse(fsImpl.readFileSync(configPath, 'utf8'))
+    if (parsed != null && !isObject(parsed)) throw new Error('Hermes thinkpool config is not a YAML mapping; refusing to overwrite it')
+    config = parsed || {}
+  }
+  if (config.hooks != null && !isObject(config.hooks)) throw new Error('Hermes thinkpool hooks config is not a mapping; refusing to overwrite it')
+  const hooks = config.hooks ||= {}
+  if (hooks.pre_tool_call != null && !Array.isArray(hooks.pre_tool_call)) throw new Error('Hermes pre_tool_call hooks are not a list; refusing to overwrite them')
+  const prior = hooks.pre_tool_call || []
+  hooks.pre_tool_call = [
+    ...prior.filter((entry) => !isThinkPoolGuard(entry)),
+    { matcher: '^delegate_task$', command: commandText(hermesGuardPath({ homeDir, env, platform })), timeout: 5 },
+  ]
+
+  const guardPath = hermesGuardPath({ homeDir, env, platform })
+  const allowlistPath = path.join(profilePath, 'shell-hooks-allowlist.json')
+  const guardSnapshot = snapshotFile(guardPath, fsImpl)
+  const configSnapshot = snapshotFile(configPath, fsImpl)
+  const allowlistSnapshot = snapshotFile(allowlistPath, fsImpl)
+  try {
+    atomicWrite(guardPath, guardSource, { fsImpl, mode: 0o700 })
+    atomicWrite(configPath, YAML.stringify(config, { lineWidth: 0 }), { fsImpl, mode: 0o600 })
+
+    const consentEnv = { ...env, HERMES_ACCEPT_HOOKS: '1' }
+    // Hermes does not refresh an existing approval when the same command's
+    // script mtime changes. Revoke only ThinkPool's exact guard command, then
+    // let the synthetic test consent to that exact command again.
+    run([...profileArgs, 'hooks', 'revoke', commandText(guardPath)], { env: consentEnv })
+    const testOutput = run([...profileArgs, 'hooks', 'test', 'pre_tool_call', '--for-tool', 'delegate_task'], { env: consentEnv })
+    if (!/(?:action|decision)["']?\s*[:=]\s*["']block/i.test(testOutput)
+      || !/ThinkPool blocks hidden Hermes delegation/i.test(testOutput)) {
+      throw new Error('Hermes ran the ThinkPool delegation guard but did not report an explicit block')
+    }
+    run([...profileArgs, 'hooks', 'doctor'], { env: consentEnv })
+    run([...profileArgs, 'acp', '--check'], { env: consentEnv })
+    const probe = probeHermesRuntime({ command, prefixArgs: profileArgs, execFile, env: consentEnv })
+    if (!probe.available) throw new Error(`Hermes setup did not pass the final runtime probe: ${probe.reason || 'unavailable'}`)
+    return { ...probe, profile, created, mode: created ? mode : 'existing', guardPath, configPath }
+  } catch (error) {
+    try {
+      restoreFile(configPath, configSnapshot, fsImpl)
+      restoreFile(guardPath, guardSnapshot, fsImpl)
+      restoreFile(allowlistPath, allowlistSnapshot, fsImpl)
+    } catch (rollbackError) {
+      error.message = `${error.message}; rollback also failed: ${clean(rollbackError.message)}`
+    }
+    throw error
+  }
+}

package/launcher.mjs

@@ -15,6 +15,7 @@ import fs from 'node:fs'
 import path from 'node:path'
 import { execSync } from 'node:child_process'
 import { detectProvider, fetchModels, ANTHROPIC_COMPATIBLE, gatewayHint } from './byok-detect.mjs'
+import { probeHermesRuntime } from './hermes-probe.mjs'
 
 const HOME = os.homedir()
 const CFG_DIR = path.join(HOME, '.thinkpool-pair')
@@ -74,12 +75,16 @@ export function detectState() {
   // provider.json is written with { provider, baseUrl, model } (see provider.mjs).
   // Anything whose `provider` field is set and not "anthropic" is a custom endpoint.
   const isCustom = !!provider?.provider && provider.provider !== 'anthropic'
+  const hermesInstalled = onPath('hermes')
+  const hermesReady = onPath('thinkpool') && probeHermesRuntime().available
   return {
     loggedIn: !!auth?.refresh_token,
     email: auth?.email || auth?.user?.email || null,
     provider: isCustom ? `Custom (${provider.baseUrl || 'endpoint'})` : 'Anthropic (default)',
     providerModel: isCustom ? (provider.model || null) : null,
-    agents: KNOWN_AGENTS.filter(a => onPath(a.cmd)),
+    agents: KNOWN_AGENTS.filter(a => onPath(a.cmd) && (a.cmd !== 'thinkpool' || hermesReady)),
+    hermesInstalled,
+    hermesReady,
     accountSvc: serviceLoaded(null),
     cwd: process.cwd(),
     version: VERSION,
@@ -206,24 +211,34 @@ export async function runLauncher({ actions, io, state = detectState(), refresh
 
   const settingsMenu = async () => {
     for (;;) {
-      const pick = await askChoice('\n  change', [
-        { label: 'LLM provider', hint: `current: ${state.provider}` },
-        { label: 'Account', hint: state.loggedIn ? `linked: ${state.email || 'yes'}` : 'not linked' },
-        { label: 'Restart & update the bridge', hint: state.accountSvc ? 'pull the newest published version, then restart — sessions resume' : 'none installed' },
-        { label: 'Remove the background service', hint: state.accountSvc ? '' : 'none installed' },
-        { label: '← Back to main menu', hint: '' },
-      ], 5)  // Enter = Back
-      if (pick === 4) return
-      if (pick === 0) await providerMenu()
-      else if (pick === 1) { await actions.login(); resync(); return }
-      else if (pick === 2) {
+      const options = [
+        { key: 'provider', label: 'LLM provider', hint: `current: ${state.provider}` },
+        { key: 'account', label: 'Account', hint: state.loggedIn ? `linked: ${state.email || 'yes'}` : 'not linked' },
+        { key: 'restart', label: 'Restart & update the bridge', hint: state.accountSvc ? 'pull the newest published version, then restart — sessions resume' : 'none installed' },
+        { key: 'remove', label: 'Remove the background service', hint: state.accountSvc ? '' : 'none installed' },
+      ]
+      if (state.hermesInstalled) options.push({ key: 'hermes', label: 'Hermes Agent', hint: state.hermesReady ? 'isolated profile ready' : 'set up isolated profile + delegation guard' })
+      options.push({ key: 'back', label: '← Back to main menu', hint: '' })
+      const picked = options[await askChoice('\n  change', options, options.length)]
+      if (picked.key === 'back') return
+      if (picked.key === 'provider') await providerMenu()
+      else if (picked.key === 'account') { await actions.login(); resync(); return }
+      else if (picked.key === 'restart') {
         if (state.accountSvc) { await actions.restartUpdateService({ room: null }); resync() }
         else io.print('  ' + C.yellow('no background service installed'))
       }
-      else {
+      else if (picked.key === 'remove') {
         if (state.accountSvc) { await actions.uninstallService({ room: null }); resync() }
         else io.print('  ' + C.yellow('no background service installed'))
       }
+      else if (picked.key === 'hermes') {
+        const setup = await askChoice('\n  Hermes profile', [
+          { label: 'Clone active profile', hint: 'copies provider/config explicitly; fresh ThinkPool session history' },
+          { label: 'Create clean profile', hint: 'no copied credentials or bundled skills; configure provider afterward' },
+          { label: '← Back', hint: '' },
+        ], 3)
+        if (setup !== 2) { await actions.setupHermes({ mode: setup === 0 ? 'clone' : 'clean' }); resync() }
+      }
     }
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.234",
+  "version": "0.7.236",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -24,6 +24,8 @@
     "hermes-session.mjs",
     "hermes-event-mapper.mjs",
     "hermes-probe.mjs",
+    "hermes-setup.mjs",
+    "hermes-isolation.mjs",
     "hermes-delegation-guard.mjs",
     "runtime-registry.mjs",
     "runtime-session.mjs",
@@ -81,6 +83,7 @@
     "@anthropic-ai/claude-agent-sdk": "^0.3.198",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@supabase/supabase-js": "^2.45.0",
+    "yaml": "2.9.0",
     "zod": "^4.4.3"
   },
   "optionalDependencies": {