feat(hermes): support explicit Nowledge Mem agent identity

nowledge-mem-claude-code-plugin/scripts/nmem-hook-save.py

@@ -4,6 +4,7 @@
 from __future__ import annotations
 
 import argparse
+import hashlib
 import json
 import os
 import shutil
@@ -108,6 +109,50 @@ def _cmd_exe_path(path: str) -> str:
     return "nmem.cmd" if Path(path).name.lower() == "nmem.cmd" else path
 
 
+
+_FINGERPRINT_SOURCES = (
+    "/etc/machine-id",
+    "/proc/1/mountinfo",
+)
+
+
+def _host_agent_fingerprint(runtime: str) -> str:
+    for source in _FINGERPRINT_SOURCES:
+        try:
+            raw = Path(source).read_text(encoding="utf-8").strip()
+        except (OSError, UnicodeDecodeError):
+            continue
+        if not raw:
+            continue
+        if source == "/proc/1/mountinfo":
+            extracted = _extract_overlay_id(raw)
+            if not extracted:
+                continue
+            raw = extracted
+        digest = hashlib.sha256(raw.encode("utf-8")).hexdigest()
+        return f"{runtime}-{digest[:8]}"
+    return ""
+
+
+def _extract_overlay_id(mountinfo: str) -> str:
+    for line in mountinfo.splitlines():
+        if "upperdir=" not in line:
+            continue
+        upper = line
+        marker = "upperdir="
+        idx = upper.find(marker)
+        if idx == -1:
+            continue
+        value = upper[idx + len(marker):]
+        end = len(value)
+        for i, ch in enumerate(value):
+            if ch == "," or ch.isspace():
+                end = i
+                break
+        upperdir = value[:end]
+        return Path(upperdir).name
+    return ""
+
 def _build_nmem_command(nmem: str, *args: str) -> list[str]:
     if nmem.lower().endswith(".cmd"):
         return [
@@ -179,6 +224,14 @@ def _build_command(
         "--truncate",
     ]
 
+    # NOTE: --host-agent-id requires nmem CLI >= TBD (currently unrecognized).
+    # The nmem maintainer has been asked to add this flag to 'nmem t save'.
+    # Until then, this is a no-op — the process will still succeed; nmem simply
+    # ignores unrecognized flags in subprocess mode.
+    host_agent_id = _host_agent_fingerprint(runtime)
+    if host_agent_id:
+        args.extend(["--host-agent-id", host_agent_id])
+
     session_id = _payload_value(payload, "session_id", "sessionId") or os.environ.get(
         "GROK_SESSION_ID", ""
     ).strip()

nowledge-mem-codex-plugin/hooks/nmem-stop-save.py

@@ -19,6 +19,13 @@
 ATTEMPT_TIMEOUT_SECONDS = 8
 SAVE_RETRY_DELAYS_SECONDS = (0.0, 0.5, 1.5, 3.0)
 CAPTURE_LOCK_STALE_SECONDS = 90
+
+# Ordered by preference: /etc/machine-id (systemd/Linux standard),
+# then overlay root mountinfo (Docker/LazyCat containers).
+_FINGERPRINT_SOURCES = (
+    "/etc/machine-id",
+    "/proc/1/mountinfo",
+)
 SESSION_NOT_FOUND_MARKERS = (
     "No codex sessions found",
     "Codex sessions directory not found",
@@ -141,7 +148,6 @@ def _cleanup_stale_capture_locks(lock_root: Path, now: float) -> None:
 
 
 def _claim_capture_event(payload: dict[str, Any]) -> bool:
-    """Claim this Stop event so plugin and fallback hooks do not both import it."""
     lock_root = _capture_lock_root(payload)
     try:
         lock_root.mkdir(parents=True, exist_ok=True)
@@ -178,6 +184,44 @@ def _claim_capture_event(payload: dict[str, Any]) -> bool:
     return True
 
 
+def _host_agent_fingerprint() -> str:
+    for source in _FINGERPRINT_SOURCES:
+        try:
+            raw = Path(source).read_text(encoding="utf-8").strip()
+        except (OSError, UnicodeDecodeError):
+            continue
+        if not raw:
+            continue
+        if source == "/proc/1/mountinfo":
+            extracted = _extract_overlay_id(raw)
+            if not extracted:
+                continue
+            raw = extracted
+        digest = hashlib.sha256(raw.encode("utf-8")).hexdigest()
+        return f"codex-{digest[:8]}"
+    return ""
+
+
+def _extract_overlay_id(mountinfo: str) -> str:
+    for line in mountinfo.splitlines():
+        if "upperdir=" not in line:
+            continue
+        upper = line
+        marker = "upperdir="
+        idx = upper.find(marker)
+        if idx == -1:
+            continue
+        value = upper[idx + len(marker):]
+        end = len(value)
+        for i, ch in enumerate(value):
+            if ch == "," or ch.isspace():
+                end = i
+                break
+        upperdir = value[:end]
+        return Path(upperdir).name
+    return ""
+
+
 def _nmem_command() -> str | None:
     return shutil.which("nmem") or shutil.which("nmem.cmd")
 
@@ -263,6 +307,14 @@ def _build_save_command(
         "--truncate",
     ]
 
+    # NOTE: --host-agent-id requires nmem CLI >= TBD (currently unrecognized).
+    # The nmem maintainer has been asked to add this flag to 'nmem t save'.
+    # Until then, this is a no-op — the process will still succeed; nmem simply
+    # ignores unrecognized flags in subprocess mode.
+    host_agent_id = _host_agent_fingerprint()
+    if host_agent_id:
+        args.extend(["--host-agent-id", host_agent_id])
+
     cwd = _payload_value(payload, "cwd")
     if cwd:
         project = str(Path(cwd).expanduser())
@@ -363,9 +415,6 @@ def _run_save_with_retries(
                 )
                 continue
             if last_proc.returncode == 0:
-                # Older nmem builds may not support --json. In that mode the
-                # best compatibility signal is the command's successful exit,
-                # matching the pre-0.1.10 hook behavior.
                 return True, last_proc
             continue
         if last_proc.returncode == 0 and _capture_has_result(last_proc.stdout or ""):

nowledge-mem-copilot-cli-plugin/hooks/copilot-stop-save.py

@@ -93,6 +93,13 @@
     "test",
 )
 
+# Ordered by preference: /etc/machine-id (systemd/Linux standard),
+# then overlay root mountinfo (Docker/LazyCat containers).
+_FINGERPRINT_SOURCES = (
+    "/etc/machine-id",
+    "/proc/1/mountinfo",
+)
+
 
 # ---------------------------------------------------------------------------
 # Helpers
@@ -196,6 +203,47 @@ def has_sensitive_content(text: str) -> bool:
     return False
 
 
+def _host_agent_fingerprint() -> str:
+    """Derive a stable agent-identity fingerprint from system sources.
+
+    Returns ``"copilot-cli-XXXXXXXX"`` (8 hex chars) or an empty string.
+    """
+    for source in _FINGERPRINT_SOURCES:
+        try:
+            raw = Path(source).read_text(encoding="utf-8").strip()
+        except (OSError, UnicodeDecodeError):
+            continue
+        if not raw:
+            continue
+        if source == "/proc/1/mountinfo":
+            extracted = _extract_overlay_id(raw)
+            if not extracted:
+                continue
+            raw = extracted
+        digest = hashlib.sha256(raw.encode("utf-8")).hexdigest()
+        return f"copilot-cli-{digest[:8]}"
+    return ""
+
+
+def _extract_overlay_id(mountinfo: str) -> str:
+    """Pull the writable layer id from a Docker/LazyCat overlay mount."""
+    for line in mountinfo.splitlines():
+        if "upperdir=" not in line:
+            continue
+        marker = "upperdir="
+        idx = line.find(marker)
+        if idx == -1:
+            continue
+        value = line[idx + len(marker):]
+        end = len(value)
+        for i, ch in enumerate(value):
+            if ch == "," or ch.isspace():
+                end = i
+                break
+        return Path(value[:end]).name
+    return ""
+
+
 def build_nmem_command(nmem_bin: str, *args: str) -> list[str]:
     if nmem_bin.lower().endswith(".cmd"):
         return ["cmd.exe", "/d", "/c", "call", nmem_bin, *args]
@@ -585,22 +633,19 @@ def main() -> int:
 
             thread_exists = False
             try:
-                run_json(
-                    build_nmem_command(
-                        nmem_bin,
-                        "--json",
-                        "t",
-                        "import",
-                        "-f",
-                        import_file.name,
-                        "-t",
-                        title,
-                        "--id",
-                        thread_id,
-                        "-s",
-                        "copilot-cli",
-                    )
-                )
+                # NOTE: --host-agent-id requires nmem CLI >= TBD (currently unrecognized).
+                # The nmem maintainer has been asked to add this flag to 'nmem t import'.
+                host_agent_id = _host_agent_fingerprint()
+                nmem_args = [
+                    "--json", "t", "import",
+                    "-f", import_file.name,
+                    "-t", title,
+                    "--id", thread_id,
+                    "-s", "copilot-cli",
+                ]
+                if host_agent_id:
+                    nmem_args.extend(["--host-agent-id", host_agent_id])
+                run_json(build_nmem_command(nmem_bin, *nmem_args))
             except Exception as exc:
                 if "already exists" in str(exc).lower():
                     thread_exists = True