ai-agent-book 精选快照（<2MB 代码与文档，来自 github.com/bojieli/ai-agent-book）

chapter9/hermes-self-evolution/run_experiment_9_8.py

@@ -0,0 +1,190 @@
+#!/usr/bin/env python3
+"""Clone a pinned Hermes snapshot and let Hermes audit/update its own code.
+
+The runner keeps credentials outside retained evidence. Normal working state is
+written beneath ignored ``worktree/`` and ``.hermes-home/`` directories; the
+curated manifest and patch are written to ``validation/<run-id>/``.
+"""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import shutil
+import subprocess
+import sys
+from datetime import datetime, timezone
+
+
+ROOT = Path(__file__).resolve().parent
+REPO_URL = "https://github.com/NousResearch/hermes-agent.git"
+PINNED_COMMIT = "85c8956ec7f2b4607509980794995e1c5e21e292"
+DEFAULT_MODEL = "openai/gpt-5.6-luna"
+SECRET_PATTERNS = (
+    re.compile(r"sk-or-v1-[A-Za-z0-9_-]{20,}"),
+    re.compile(r"sk-[A-Za-z0-9_-]{20,}"),
+)
+
+
+def run(
+    command: list[str],
+    *,
+    cwd: Path | None = None,
+    env: dict[str, str] | None = None,
+    capture: bool = True,
+) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(
+        command,
+        cwd=cwd,
+        env=env,
+        text=True,
+        stdout=subprocess.PIPE if capture else None,
+        stderr=subprocess.STDOUT if capture else None,
+        check=False,
+    )
+
+
+def sha256(path: Path) -> str:
+    digest = hashlib.sha256()
+    with path.open("rb") as handle:
+        for chunk in iter(lambda: handle.read(1024 * 1024), b""):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
+def assert_no_secrets(text: str) -> None:
+    for pattern in SECRET_PATTERNS:
+        if pattern.search(text):
+            raise RuntimeError("credential-shaped value detected in retained evidence")
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--run-id", default=None)
+    parser.add_argument("--model", default=os.getenv("HERMES_EXPERIMENT_MODEL", DEFAULT_MODEL))
+    parser.add_argument("--provider", default="openrouter")
+    parser.add_argument("--reuse-worktree", action="store_true")
+    parser.add_argument("--skip-install", action="store_true")
+    return parser.parse_args()
+
+
+def main() -> int:
+    args = parse_args()
+    if not os.getenv("OPENROUTER_API_KEY"):
+        print("OPENROUTER_API_KEY is required for the live run", file=sys.stderr)
+        return 2
+
+    run_id = args.run_id or datetime.now(timezone.utc).strftime("exp9-8-hermes-%Y%m%dT%H%M%SZ")
+    source = ROOT / "worktree" / "hermes-agent"
+    hermes_home = ROOT / ".hermes-home" / run_id
+    output = ROOT / "validation" / run_id
+    raw = output / "raw"
+    output.mkdir(parents=True, exist_ok=False)
+    raw.mkdir()
+
+    if source.exists() and not args.reuse_worktree:
+        shutil.rmtree(source)
+    if not source.exists():
+        source.parent.mkdir(parents=True, exist_ok=True)
+        cloned = run(["git", "clone", "--no-tags", REPO_URL, str(source)])
+        if cloned.returncode:
+            print(cloned.stdout, file=sys.stderr)
+            return cloned.returncode
+
+    checkout = run(["git", "checkout", "--detach", PINNED_COMMIT], cwd=source)
+    if checkout.returncode:
+        print(checkout.stdout, file=sys.stderr)
+        return checkout.returncode
+
+    baseline = run(["git", "rev-parse", "HEAD"], cwd=source).stdout.strip()
+    if baseline != PINNED_COMMIT:
+        raise RuntimeError(f"wrong baseline: {baseline}")
+
+    if not args.skip_install:
+        installed = run(["uv", "sync", "--python", "3.12"], cwd=source, capture=False)
+        if installed.returncode:
+            return installed.returncode
+
+    env = os.environ.copy()
+    env.update(
+        {
+            "HERMES_HOME": str(hermes_home),
+            "HERMES_YOLO_MODE": "1",
+            "PYTHONUNBUFFERED": "1",
+        }
+    )
+    prompt = (ROOT / "task.md").read_text(encoding="utf-8")
+    command = [
+        "uv",
+        "run",
+        "hermes",
+        "chat",
+        "--provider",
+        args.provider,
+        "--model",
+        args.model,
+        "--toolsets",
+        "terminal,skills",
+        "-q",
+        prompt,
+    ]
+    agent_run = run(command, cwd=source, env=env)
+    transcript = agent_run.stdout or ""
+    assert_no_secrets(transcript)
+    (raw / "hermes-transcript.txt").write_text(transcript, encoding="utf-8")
+
+    diff = run(["git", "diff", "--binary", "--", "."], cwd=source).stdout
+    untracked = run(["git", "ls-files", "--others", "--exclude-standard"], cwd=source).stdout.splitlines()
+    for name in untracked:
+        path = source / name
+        if path.is_file():
+            # Keep paths relative to ``source``. Absolute paths produce invalid
+            # ``diff --git ab/... bb/...`` headers after naive replacement.
+            addition = run(
+                ["git", "diff", "--no-index", "--binary", "--", "/dev/null", name],
+                cwd=source,
+            ).stdout
+            diff += addition
+    assert_no_secrets(diff)
+    patch_path = output / "hermes-self-evolution.patch"
+    patch_path.write_text(diff, encoding="utf-8")
+
+    report_source = source / "BOOK_SELF_EVOLUTION_REPORT.md"
+    if report_source.exists():
+        report_text = report_source.read_text(encoding="utf-8")
+        assert_no_secrets(report_text)
+        (output / "BOOK_SELF_EVOLUTION_REPORT.md").write_text(report_text, encoding="utf-8")
+
+    status = run(["git", "status", "--short"], cwd=source).stdout
+    manifest = {
+        "schema_version": 1,
+        "experiment": "9-8",
+        "run_id": run_id,
+        "started_from_commit": baseline,
+        "source_repository": REPO_URL,
+        "provider": args.provider,
+        "requested_model": args.model,
+        "credential_environment_variable": "OPENROUTER_API_KEY",
+        "agent_exit_code": agent_run.returncode,
+        "git_status": status.splitlines(),
+        "transcript_sha256": sha256(raw / "hermes-transcript.txt"),
+        "patch_sha256": sha256(patch_path),
+        "report_present": report_source.exists(),
+        "claim_boundary": (
+            "A completed coding run demonstrates autonomous auditing and patch generation; "
+            "it does not establish downstream task-quality uplift without the proposed ablation campaign."
+        ),
+    }
+    manifest_text = json.dumps(manifest, indent=2, ensure_ascii=False) + "\n"
+    assert_no_secrets(manifest_text)
+    (output / "manifest.json").write_text(manifest_text, encoding="utf-8")
+    print(json.dumps(manifest, indent=2, ensure_ascii=False))
+    return agent_run.returncode
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())