From af9397d6721e8ddaad100891a609b37fd38c1580 Mon Sep 17 00:00:00 2001
From: root <root@abiba.dns.sysloggh.net>
Date: Mon, 28 Sep 2026 22:23:08 +0000
Subject: [PATCH] fix(alignment): accept multiple wrapper shapes in hermes-real
 check

The fleet's wrappers do not all use a hermes-real indirection. Some (tanko,
mumuni) exec the venv module directly. This check now:
  1. Tries hermes-real at {home}/.local/bin (koonimo's shape)
  2. Tries the venv under {home}/.hermes/hermes-agent/venv (tanko/mumuni shape)
  3. Tries /usr/local/lib/hermes-agent/venv (legacy system-wide shape)

Each match is reported with which shape it matched, so a genuinely broken
wrapper is still a failure while a different-but-valid shape is not.
---
 scripts/agent-health-check.py | 29 ++++++++++++++++++++---------
 1 file changed, 20 insertions(+), 9 deletions(-)

diff --git a/scripts/agent-health-check.py b/scripts/agent-health-check.py
index ccff866..69b12e6 100755
--- a/scripts/agent-health-check.py
+++ b/scripts/agent-health-check.py
@@ -646,20 +646,31 @@ def check_wrapper_integrity():
         else:
             print(f"  ℹ️  {name}: wrapper resolves creds without infisical (e.g. ~/.hermes/.env) — OK")
 
-        # Check hermes-real exists
+        # Check that the wrapper's target resolves. The fleet's wrappers do NOT
+        # all use a hermes-real indirection — some exec the venv module directly.
+        # Verify the wrapper actually points to something runnable.
         hermes_real = ssh(host,
             f"ls -la {home}/.local/bin/hermes-real 2>/dev/null || echo MISS",
             user=user)
-        if not hermes_real or hermes_real.strip() == "MISS":
-            # Check venv path
-            hermes_real = ssh(host,
-                "ls -la /usr/local/lib/hermes-agent/venv/bin/hermes 2>/dev/null || echo MISS",
+        if hermes_real and hermes_real.strip() != "MISS":
+            print(f"  ✅ {name}: wrapper shape: hermes-real at {home}/.local/bin/hermes-real")
+        else:
+            # Try the venv under home
+            venv_home = ssh(host,
+                f"test -x {home}/.hermes/hermes-agent/venv/bin/python && echo OK || echo MISS",
                 user=user)
-            if not hermes_real or hermes_real.strip() == "MISS":
-                print(f"  ❌ {name}: hermes-real NOT FOUND (wrapper broken)")
-                _fail(f"wrapper-no-hermes-real:{name}", name)
+            if venv_home and venv_home.strip().splitlines()[-1] == "OK":
+                print(f"  ✅ {name}: wrapper shape: direct venv exec ({home}/.hermes/hermes-agent/venv/bin/python)")
             else:
-                print(f"  ✅ {name}: hermes-real at alt path")
+                # Try the system-wide venv
+                venv_sys = ssh(host,
+                    "test -x /usr/local/lib/hermes-agent/venv/bin/python && echo OK || echo MISS",
+                    user=user)
+                if venv_sys and venv_sys.strip().splitlines()[-1] == "OK":
+                    print(f"  ✅ {name}: wrapper shape: system venv (/usr/local/lib/hermes-agent/venv/bin/python)")
+                else:
+                    print(f"  ❌ {name}: wrapper target NOT RESOLVABLE (no hermes-real, no venv)")
+                    _fail(f"wrapper-no-hermes-real:{name}", name)
 
         # Check the .env file has the key
         env_has_key = ssh(host,