nnemirovsky
diff --git a/‎CLAUDE.md‎
Lines changed: 17 additions & 2 deletions b/‎CLAUDE.md‎
Lines changed: 17 additions & 2 deletions
diff --git a/‎Caddyfile‎
Lines changed: 10 additions & 2 deletions b/‎Caddyfile‎
Lines changed: 10 additions & 2 deletions
diff --git a/‎bootstrap.sh‎
Lines changed: 151 additions & 0 deletions b/‎bootstrap.sh‎
Lines changed: 151 additions & 0 deletions
diff --git a/‎cmd/sluice/main.go‎
Lines changed: 40 additions & 9 deletions b/‎cmd/sluice/main.go‎
Lines changed: 40 additions & 9 deletions
diff --git a/‎compose.dev.yml‎
Lines changed: 28 additions & 13 deletions b/‎compose.dev.yml‎
Lines changed: 28 additions & 13 deletions
@@ -125,16 +125,31 @@ Profiles abstract per-agent runtime conventions so sluice's container managers s
 | Profile | Env file | Reload | MCP wiring |
 |---------|----------|--------|------------|
 | `openclaw` (default) | `~/.openclaw/.env` | `node -e <gateway_rpc.js> secrets.reload` over the agent's WebSocket gateway | `node -e <gateway_rpc.js> wire-mcp <name> <url>` patches `mcp.servers.<name>` |
-| `hermes` | `~/.hermes/.env` | None — Hermes has no documented in-place reload; new env values take effect on next message / restart | `python3 -c <script> <name> <url>` patches `mcp_servers.<name>.url` in `~/.hermes/config.yaml` (idempotent; relies on PyYAML which Hermes already requires) |
+| `hermes` | `~/.hermes/.env` | None — Hermes has no documented in-place reload; new env values take effect on next message / restart | `sh -c '[ -f /opt/hermes/.venv/bin/activate ] && . /opt/hermes/.venv/bin/activate; exec python3 -c <script>' <name> <url>` patches `mcp_servers.<name>.url` in `~/.hermes/config.yaml` (idempotent; activates Hermes' bundled venv when present so PyYAML is importable, falls back to system python3 for native installs) |
 
 Adding a new profile is a single edit to `internal/container/agent_profile.go`: register a struct in `builtinProfiles`. All three container backends (Docker, Apple Container, tart) consume the profile through `BuildEnvInjectionScriptForProfile`, `profile.ReloadCmd()`, and `profile.WireMCPCmd()`, so backend code does not need to know about specific agents.
 
 Hermes-specific caveats:
 
 - `ReloadCmd` is nil; `ReloadSecrets` logs a notice and returns nil. New phantom tokens take effect on the next Hermes message or `/reload-mcp` slash command.
-- `WireMCPCmd` rewrites `~/.hermes/config.yaml` directly. Hermes picks up the change on its next startup or via `/reload-mcp` from the chat session — sluice cannot trigger that command remotely.
+- `WireMCPCmd` rewrites `~/.hermes/config.yaml` directly via a sh wrapper that activates `/opt/hermes/.venv` (so PyYAML is on the import path inside the official Hermes Docker image). For native installs without the venv the activation is a no-op and the system `python3` is used. Hermes picks up the change on its next startup or via `/reload-mcp` from the chat session — sluice cannot trigger that command remotely.
 - Hermes' Modal, Daytona, and Vercel Sandbox terminal backends run code on third-party infrastructure that sluice cannot intercept. The local and Docker Hermes backends are the supported targets for sluice's network-layer governance.
 
+### Sluice-managed env block
+
+Sluice writes its phantom tokens into a fenced block inside the agent's env file:
+
+```
+# BEGIN sluice-managed (do not edit)
+KEY1='phantom-value-1'
+KEY2='phantom-value-2'
+# END sluice-managed
+```
+
+Values are wrapped in single quotes so the file is safe under both shell `source` (`set -a; . file; set +a`) and dotenv parsers. Embedded single quotes inside a value are escaped via the `'\''` idiom (close current quoted run, emit a backslash-escaped literal quote, reopen the quoted run). Validation rejects newlines and NUL bytes; every other byte (`$`, backticks, spaces, glob chars) is safe because the single quoting suppresses all expansion.
+
+Each injection rebuilds the block: existing markers are removed via an awk pre-pass that only deletes well-formed BEGIN..END pairs (an orphan BEGIN with no matching END is left intact so an operator inspecting a corrupted file sees exactly what is wrong), then a fresh block is appended. Anything outside the markers (keys written by `hermes claw migrate`, by the agent's own auth flow, or by an operator) is preserved across both incremental updates and full reconciliation runs. The `fullReplace` flag on `BuildEnvInjectionScript` is retained for API compatibility but no longer affects file behavior — every call reconciles the managed block. Removing a binding's `env_var` simply drops the key from the new block on the next injection.
+
 ## MCP Gateway Setup
 
 OpenClaw connects to sluice's MCP gateway via Streamable HTTP. This is a one-time setup per deployment:
 
@@ -3,7 +3,15 @@
 }
 
 :443 {
-	tls /etc/cloudflare/claw.pem /etc/cloudflare/claw.key
+	tls /etc/ssl/certs/agent.pem /etc/ssl/private/agent.key
 
-	reverse_proxy sluice-tun2proxy-1:18789
+	# Forward to the hermes-dashboard sidecar via tun2proxy. The
+	# dashboard service uses `network_mode: "service:tun2proxy"`, so
+	# it shares tun2proxy's network namespace and is reachable on
+	# tun2proxy's internal-network address (port 9119, where the
+	# dashboard binds). The hermes-dashboard service name itself has
+	# no network identity of its own. Using `tun2proxy` (the compose
+	# service name on the internal network) stays correct regardless
+	# of the compose project name or replica index.
+	reverse_proxy tun2proxy:9119
 }
@@ -0,0 +1,151 @@
+#!/usr/bin/env bash
+# One-shot bootstrap that imports an existing OpenClaw home volume into
+# a fresh Hermes home volume.
+#
+# Run once after replacing an OpenClaw deployment with the Hermes stack
+# in compose.yml. The legacy openclaw-home volume from the previous
+# deployment is mounted read-only; the migration target is the new
+# hermes-home volume created by compose.yml.
+#
+# Re-running this script overwrites Hermes-side files for any item that
+# would otherwise conflict, because we pass --overwrite to
+# `hermes claw migrate`. That is appropriate for the initial migration
+# (we want OpenClaw's persona, model config, and provider keys to
+# replace the bundled Hermes defaults that the entrypoint copies in on
+# first boot) but does mean a re-run will clobber edits the operator
+# made on the Hermes side after the first import. Set
+# BOOTSTRAP_OVERWRITE=0 to drop the flag for a strictly additive
+# re-run; the migrate command will then fail loudly on conflicts so
+# they can be reviewed.
+#
+# Usage:
+#   bash bootstrap.sh [project-name] [legacy-volume]
+#
+#   project-name   docker compose project (defaults to the basename of
+#                  the current directory, e.g. "hermes")
+#   legacy-volume  full name of the openclaw-home volume from the prior
+#                  deployment (defaults to sluice_openclaw-home which is
+#                  the historical default; pass an explicit name if your
+#                  prior project was named differently).
+#
+# What it does:
+#   1. Stage the legacy openclaw home under a path that does not match
+#      `pgrep -f openclaw` so the migrate command's running-instance
+#      check does not false-positive on its own argv. Chown to the
+#      hermes UID so the in-container migrator can read it.
+#   2. Run `hermes claw migrate --preset full --migrate-secrets
+#      --overwrite --no-backup --yes` against the staged source.
+#   3. Patch mcp_servers.sluice.url into ~/.hermes/config.yaml so
+#      Hermes registers sluice as an MCP server. Sluice's
+#      HermesProfile.WireMCPCmd does this from the running sluice
+#      container, but having a one-shot pre-write is helpful when
+#      rebootstrapping a stack from clean.
+#   4. Clean up the staging directory.
+set -euo pipefail
+
+PROJECT_NAME="${1:-$(basename "$PWD")}"
+LEGACY_VOLUME="${2:-sluice_openclaw-home}"
+HERMES_VOLUME="${PROJECT_NAME}_hermes-home"
+HERMES_IMAGE="${HERMES_IMAGE:-nousresearch/hermes-agent:v2026.4.30}"
+BOOTSTRAP_OVERWRITE="${BOOTSTRAP_OVERWRITE:-1}"
+
+# Honor compose.yml's HERMES_UID/HERMES_GID overrides so files chowned
+# by this bootstrap stay readable when the operator pinned the runtime
+# user to a non-default UID/GID. Defaults match the hermes user baked
+# into the upstream image (UID/GID 10000).
+HERMES_UID="${HERMES_UID:-10000}"
+HERMES_GID="${HERMES_GID:-10000}"
+
+migrate_args=(
+  --source /opt/data/.hermes/.migration-source
+  --preset full
+  --migrate-secrets
+  --no-backup
+  --yes
+)
+if [ "$BOOTSTRAP_OVERWRITE" = "1" ]; then
+  migrate_args+=(--overwrite)
+fi
+
+if ! docker volume inspect "$LEGACY_VOLUME" >/dev/null 2>&1; then
+  echo "==> legacy volume '$LEGACY_VOLUME' not found; skipping bootstrap (fresh install)"
+  exit 0
+fi
+
+echo "==> ensuring hermes-home volume exists"
+docker volume create "$HERMES_VOLUME" >/dev/null
+
+echo "==> staging legacy data (path renamed to avoid pgrep -f openclaw false-positive)"
+docker run --rm \
+  --user 0:0 \
+  -e HERMES_UID="$HERMES_UID" \
+  -e HERMES_GID="$HERMES_GID" \
+  -v "$LEGACY_VOLUME":/legacy:ro \
+  -v "$HERMES_VOLUME":/opt/data/.hermes \
+  --entrypoint /bin/bash \
+  "$HERMES_IMAGE" -c '
+    set -e
+    rm -rf /opt/data/.hermes/.migration-source
+    cp -a /legacy/.openclaw /opt/data/.hermes/.migration-source
+    chown -R "$HERMES_UID:$HERMES_GID" /opt/data/.hermes/.migration-source
+  '
+
+echo "==> running hermes claw migrate (overwrite=$BOOTSTRAP_OVERWRITE)"
+docker run --rm \
+  -e HERMES_HOME=/opt/data/.hermes \
+  -e HERMES_UID="$HERMES_UID" \
+  -e HERMES_GID="$HERMES_GID" \
+  -v "$HERMES_VOLUME":/opt/data/.hermes \
+  "$HERMES_IMAGE" \
+  claw migrate "${migrate_args[@]}" \
+  || echo "migrate exited non-zero (non-fatal warnings or refused on conflicts) -- continuing"
+
+echo "==> patching mcp_servers.sluice.url into config.yaml"
+docker run --rm \
+  -e HERMES_HOME=/opt/data/.hermes \
+  -e HERMES_UID="$HERMES_UID" \
+  -e HERMES_GID="$HERMES_GID" \
+  -v "$HERMES_VOLUME":/opt/data/.hermes \
+  --entrypoint /bin/bash \
+  "$HERMES_IMAGE" -c '
+    set -e
+    # Activate the bundled venv when present (PyYAML lives there on the
+    # official Hermes image). Fall back to system python3 otherwise so
+    # this script also works against custom Hermes builds that omit the
+    # venv. Mirrors the runtime wrapper in HermesProfile.WireMCPCmd.
+    if [ -f /opt/hermes/.venv/bin/activate ]; then
+      . /opt/hermes/.venv/bin/activate
+    fi
+    if ! python3 -c "import yaml" 2>/dev/null; then
+      echo "error: python3 PyYAML is required but not available; install it or use an image that bundles it" >&2
+      exit 1
+    fi
+    python3 - <<PY
+import os, yaml
+p = "/opt/data/.hermes/config.yaml"
+data = {}
+if os.path.exists(p):
+    with open(p) as fh:
+        data = yaml.safe_load(fh) or {}
+servers = data.setdefault("mcp_servers", {})
+existing = servers.get("sluice") or {}
+if existing.get("url") != "http://sluice:3000/mcp":
+    existing["url"] = "http://sluice:3000/mcp"
+    servers["sluice"] = existing
+    with open(p, "w") as fh:
+        yaml.safe_dump(data, fh, sort_keys=False)
+    print("patched", p)
+else:
+    print("already patched")
+PY
+    chown "$HERMES_UID:$HERMES_GID" /opt/data/.hermes/config.yaml
+  '
+
+echo "==> cleaning up staged migration source"
+docker run --rm \
+  --user 0:0 \
+  -v "$HERMES_VOLUME":/opt/data/.hermes \
+  --entrypoint /bin/bash \
+  "$HERMES_IMAGE" -c 'rm -rf /opt/data/.hermes/.migration-source'
+
+echo "==> bootstrap complete"
@@ -114,6 +114,7 @@ func main() {
 		log.Fatalf("invalid --agent value: %v", err)
 	}
 	log.Printf("agent profile: %s (env file ~/%s)", agentProfile.Name, agentProfile.EnvFileRelPath)
+	telegram.SetAgentDisplayName(agentDisplayName(agentProfile.Name))
 
 	// Open the SQLite store.
 	db, err := store.New(*dbPath)
@@ -461,15 +462,19 @@ func main() {
 		log.Printf("no approval channels configured (ask rules will auto-deny)")
 	}
 
-	// MCP gateway: if upstreams are configured, start the gateway and
-	// serve it via HTTP on /mcp alongside the API. The mcpHandler local
-	// is consumed by the startup goroutine below and by the HTTP API
-	// server that exposes /mcp.
+	// MCP gateway: always start (even with zero upstreams) so the
+	// /mcp endpoint is reachable for agents that register sluice as
+	// their MCP server. With zero upstreams the gateway exposes an
+	// empty tool list, which is a valid MCP response. This avoids a
+	// chicken-and-egg problem where the agent's MCP client gives up
+	// on a 404 before the operator has registered the first upstream.
 	var mcpHandler http.Handler
 	upstreamRows, mcpListErr := db.ListMCPUpstreams()
 	if mcpListErr != nil {
 		log.Printf("WARNING: failed to list MCP upstreams: %v", mcpListErr)
-	} else if len(upstreamRows) > 0 {
+		upstreamRows = nil
+	}
+	{
 		mcpUpstreams := make([]mcp.UpstreamConfig, len(upstreamRows))
 		for i, r := range upstreamRows {
 			mcpUpstreams[i] = mcp.UpstreamConfig{
@@ -546,7 +551,10 @@ func main() {
 	// API and SOCKS5 listeners come up immediately. All phases are no-ops
 	// outside a container runtime setup.
 	if containerMgr != nil && db != nil {
-		hasMCPGateway := mcpHandler != nil
+		// The MCP gateway always mounts now (even with zero upstreams).
+		// This constant is left in place so the wire-up phase below
+		// reads naturally and to make a future opt-out path obvious.
+		const hasMCPGateway = true
 		go func() {
 			// Phase 1: write .env file into the agent container with
 			// phantom tokens from bindings that declare env_var.
@@ -597,14 +605,19 @@ func main() {
 				return
 			}
 			// Phase 3: wire sluice's MCP gateway URL into the agent's
-			// openclaw.json config via WebSocket RPC. Idempotent.
+			// configuration. The exact storage and mechanism is
+			// profile-specific (openclaw patches openclaw.json via a
+			// gateway WebSocket RPC; hermes patches mcp_servers in
+			// ~/.hermes/config.yaml; future profiles plug their own
+			// AgentProfile.WireMCPCmd). Idempotent: a profile that
+			// has nothing to do here returns nil and we move on.
 			// deriveMCPBaseURL already returns a URL ending in /mcp.
 			mcpURL := deriveMCPBaseURL(*mcpBaseURL, *healthAddr)
 			wireCtx, wireCancel := context.WithTimeout(context.Background(), 15*time.Second)
 			if wireErr := containerMgr.WireMCPGateway(wireCtx, "sluice", mcpURL); wireErr != nil {
-				log.Printf("WARNING: failed to wire MCP gateway into agent config: %v", wireErr)
+				log.Printf("WARNING: failed to wire MCP gateway into agent config (%s profile): %v", agentProfile.Name, wireErr)
 			} else {
-				log.Printf("MCP gateway wired into agent config: mcp.servers.sluice.url=%s", mcpURL)
+				log.Printf("MCP gateway wired into agent config (%s profile): sluice -> %s", agentProfile.Name, mcpURL)
 			}
 			wireCancel()
 		}()
@@ -913,6 +926,24 @@ func isTartCLIAvailable() bool {
 	return err == nil
 }
 
+// agentDisplayName returns the human-readable label for an agent profile
+// name (e.g. "openclaw" -> "OpenClaw", "hermes" -> "Hermes"). Used to
+// brand approval messages with the active agent. Falls back to the input
+// string with the first letter upper-cased for unknown profiles.
+func agentDisplayName(profileName string) string {
+	switch profileName {
+	case "openclaw":
+		return "OpenClaw"
+	case "hermes":
+		return "Hermes"
+	default:
+		if profileName == "" {
+			return "agent"
+		}
+		return strings.ToUpper(profileName[:1]) + profileName[1:]
+	}
+}
+
 // startAPIServer starts the HTTP server with the generated chi router.
 // It serves /healthz (no auth), /api/* (bearer auth), and optionally
 // /mcp (MCP Streamable HTTP, no auth) when mcpHandler is non-nil.
 
@@ -1,13 +1,29 @@
 # Development compose file. Builds sluice from source.
 # Usage: docker compose -f compose.dev.yml up --build
+#
+# Mirrors compose.yml but builds the sluice image locally and omits the
+# caddy reverse-proxy / hermes-dashboard sidecar to keep the dev loop
+# fast. See compose.yml for the production stack and the full set of
+# inline rationale comments.
 services:
   sluice:
     build: .
     restart: unless-stopped
+    command: [
+      "-listen", "0.0.0.0:1080",
+      "-health-addr", "0.0.0.0:3000",
+      "-mcp-base-url", "http://sluice:3000",
+      "-db", "data/sluice.db",
+      "-config", "/etc/sluice/config.toml",
+      "-audit", "/var/log/sluice/audit.jsonl",
+      "-agent", "hermes",
+      "-container-name", "hermes",
+    ]
     environment:
       - TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN}
       - TELEGRAM_CHAT_ID=${TELEGRAM_CHAT_ID}
-      - SLUICE_AGENT_CONTAINER=openclaw
+      - SLUICE_AGENT_CONTAINER=hermes
+      - SLUICE_AGENT_PROFILE=hermes
     group_add:
       - "${DOCKER_GID:-0}"
     volumes:
@@ -35,7 +51,6 @@ services:
     devices:
       - /dev/net/tun:/dev/net/tun
     command: ["--proxy", "socks5://sluice:1080", "--bypass", "127.0.0.0/8", "--bypass", "::1/128"]
-    # See compose.yml for the full MCP wiring explanation.
     extra_hosts:
       - "sluice:172.30.0.2"
     healthcheck:
@@ -49,23 +64,23 @@ services:
       sluice:
         condition: service_healthy
 
-  openclaw:
-    image: ghcr.io/openclaw/openclaw:latest
+  hermes:
+    image: nousresearch/hermes-agent:v2026.4.30
     restart: unless-stopped
-    container_name: openclaw
+    container_name: hermes
     network_mode: "service:tun2proxy"
-    entrypoint: ["/bin/sh", "-c", "[ -f \"$HOME/.openclaw/.env\" ] && set -a && . \"$HOME/.openclaw/.env\" && set +a; exec docker-entrypoint.sh node openclaw.mjs gateway --allow-unconfigured"]
+    entrypoint: ["/bin/sh", "-c", "[ -f /opt/data/.hermes/.env ] && set -a && . /opt/data/.hermes/.env && set +a; exec /usr/bin/tini -g -- /opt/hermes/docker/entrypoint.sh \"$@\"", "--"]
+    command: ["gateway", "run"]
     environment:
-      - HOME=/home/node
-      - OPENCLAW_GATEWAY_TOKEN=${OPENCLAW_GATEWAY_TOKEN:-}
+      - HOME=/opt/data
+      - HERMES_HOME=/opt/data/.hermes
+      - HERMES_UID=${HERMES_UID:-10000}
+      - HERMES_GID=${HERMES_GID:-10000}
       - SSL_CERT_FILE=/usr/local/share/ca-certificates/sluice/sluice-ca.crt
       - REQUESTS_CA_BUNDLE=/usr/local/share/ca-certificates/sluice/sluice-ca.crt
       - NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/sluice/sluice-ca.crt
-      - NPM_CONFIG_PREFIX=/home/node/.npm-global
-      - PATH=/home/node/.npm-global/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
-      - NODE_COMPILE_CACHE=/home/node/.node-compile-cache
     volumes:
-      - openclaw-home:/home/node
+      - hermes-home:/opt/data/.hermes
       - sluice-ca:/usr/local/share/ca-certificates/sluice:ro
     depends_on:
       tun2proxy:
@@ -84,4 +99,4 @@ volumes:
   sluice-vault:
   sluice-audit:
   sluice-ca:
-  openclaw-home:
+  hermes-home: