feat: Hermes single-harness edition + premium dual, with dashboard SSO

config/clawbox-hermes-dashboard-proxy.service

@@ -0,0 +1,18 @@
+[Unit]
+Description=ClawBox Hermes Dashboard Auth Proxy (LAN :8090, clawbox_session-gated)
+After=clawbox-hermes-dashboard.service clawbox-setup.service
+Wants=clawbox-hermes-dashboard.service
+
+[Service]
+Type=simple
+User=clawbox
+WorkingDirectory=/home/clawbox/clawbox
+Environment=HOME=/home/clawbox
+Environment=CLAWBOX_ROOT=/home/clawbox/clawbox
+Environment=HERMES_DASH_PROXY_PORT=8090
+ExecStart=/usr/bin/node /home/clawbox/clawbox/scripts/hermes-dashboard-proxy.js
+Restart=always
+RestartSec=3
+
+[Install]
+WantedBy=multi-user.target

config/clawbox-hermes-dashboard.service

@@ -0,0 +1,29 @@
+[Unit]
+Description=ClawBox Hermes Dashboard (host-local web UI, gated auth)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=clawbox
+WorkingDirectory=/home/clawbox
+Environment=HOME=/home/clawbox
+Environment=PATH=/home/clawbox/.local/bin:/usr/local/bin:/usr/bin:/bin
+# Stop any stray hermes server first so this instance can bind :9119 cleanly
+# (avoids an "address already in use" crash loop if a serve/dashboard from a
+# CLI chat or a prior run is still holding the port). Best-effort (`-`).
+ExecStartPre=-/home/clawbox/.local/bin/hermes dashboard --stop
+# Bind 127.0.0.2, NOT 127.0.0.1: Hermes only engages its cookie-session auth
+# gate on a non-loopback bind (plain loopback uses a legacy shared-token mode
+# that ignores session cookies, which a reverse proxy can't satisfy). 127.0.0.2
+# is still inside 127.0.0.0/8 — host-local, never LAN-reachable — so the
+# clawbox_session-gated proxy stays the only way in.
+# `hermes dashboard` builds the web dist on first run, so allow a generous
+# start window before the health check gives up.
+ExecStart=/home/clawbox/.local/bin/hermes dashboard --host 127.0.0.2 --port 9119 --no-open
+Restart=always
+RestartSec=5
+TimeoutStartSec=300
+
+[Install]
+WantedBy=multi-user.target

install.sh

@@ -61,6 +61,19 @@ PROJECT_DIR="/home/clawbox/clawbox"
 CLAWBOX_USER="clawbox"
 CLAWBOX_HOME="/home/clawbox"
 
+# ── Edition (single-harness lock) ────────────────────────────────────────────
+# openclaw | hermes | dual. Baked at flash time via env CLAWBOX_EDITION or
+# config/edition.txt. Empty/unknown → "openclaw" (the native product: single,
+# locked). "dual" is premium (both harnesses + switcher) and requires a signed
+# license; "hermes" is its own SKU. On "hermes", install.sh skips the OpenClaw
+# gateway steps and stands up Hermes + the dashboard proxy instead.
+CLAWBOX_EDITION="${CLAWBOX_EDITION:-}"
+if [ -z "$CLAWBOX_EDITION" ] && [ -f "$PROJECT_DIR/config/edition.txt" ]; then
+  CLAWBOX_EDITION="$(tr -d '[:space:]' < "$PROJECT_DIR/config/edition.txt" 2>/dev/null || true)"
+fi
+case "$CLAWBOX_EDITION" in openclaw|hermes|dual) ;; *) CLAWBOX_EDITION="openclaw" ;; esac
+is_hermes_edition() { [ "$CLAWBOX_EDITION" = "hermes" ]; }
+
 # CLAWBOX_TEST_MODE=1 skips hardware-only steps (Jetson power modes, CUDA
 # llama.cpp build, snap Chromium, WiFi AP, VNC, cloudflared, jtop) so the
 # installer can run inside a CI container. See e2e-install/README.md.
@@ -114,6 +127,20 @@ EXPECTED_INSTALLED_SERVICES=(
   clawbox-codex-auth-sync.service
 )
 
+# Hermes edition runs no OpenClaw gateway — drop it from the active set and add
+# the Hermes dashboard + auth-proxy so the generic service loop installs them.
+if is_hermes_edition; then
+  _active_svcs=()
+  for _s in "${EXPECTED_ACTIVE_SERVICES[@]}"; do
+    [ "$_s" = "clawbox-gateway.service" ] || _active_svcs+=("$_s")
+  done
+  EXPECTED_ACTIVE_SERVICES=(
+    "${_active_svcs[@]}"
+    clawbox-hermes-dashboard.service
+    clawbox-hermes-dashboard-proxy.service
+  )
+fi
+
 # Load persisted WiFi interface if available
 IFACE_ENV="$PROJECT_DIR/data/network.env"
 if [ -f "$IFACE_ENV" ]; then
@@ -756,12 +783,44 @@ step_build() {
 }
 
 step_openclaw_setup() {
+  is_hermes_edition && { log "  [hermes edition] skipping OpenClaw install"; return 0; }
   step_openclaw_install
   step_openclaw_patch
   step_openclaw_config
 }
 
+# Install the Hermes agent (git-based install into ~/.hermes). Only on the
+# hermes edition, and only if it isn't already present.
+step_hermes_install() {
+  is_hermes_edition || return 0
+  if [ -x "$CLAWBOX_HOME/.local/bin/hermes" ]; then
+    log "  Hermes already installed ($("$CLAWBOX_HOME/.local/bin/hermes" --version 2>/dev/null | head -1))"
+    return 0
+  fi
+  log "  Installing Hermes agent (NousResearch)..."
+  # Official installer clones NousResearch/hermes-agent + builds a venv. Runs as
+  # the clawbox user so it lands in ~/.hermes and ~/.local/bin.
+  runuser -u "$CLAWBOX_USER" -- bash -c \
+    'curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash' \
+    || echo "  Warning: Hermes install failed (non-fatal) — install it manually then re-run install.sh"
+}
+
+# Bake the single-harness edition lock into a root-owned systemd drop-in so a
+# customer can't flip the harness by editing config.json. No-op on "dual".
+step_edition_lock() {
+  case "$CLAWBOX_EDITION" in
+    openclaw|hermes) ;;
+    *) return 0 ;;
+  esac
+  mkdir -p /etc/systemd/system/clawbox-setup.service.d
+  printf '[Service]\nEnvironment=CLAWBOX_EDITION=%s\n' "$CLAWBOX_EDITION" \
+    > /etc/systemd/system/clawbox-setup.service.d/edition.conf
+  systemctl daemon-reload 2>/dev/null || true
+  log "  Baked edition lock: CLAWBOX_EDITION=$CLAWBOX_EDITION"
+}
+
 step_openclaw_install() {
+  is_hermes_edition && { log "  [hermes edition] skipping OpenClaw npm install"; return 0; }
   # Always re-assert the .bashrc PATH stanza before any early-return. The
   # function is idempotent (greps before appending), and skipping it here
   # was the root cause of the recurring `bash: openclaw: command not found`
@@ -963,6 +1022,7 @@ step_clawkeep_install() {
 }
 
 step_openclaw_patch() {
+  is_hermes_edition && return 0
   # Patcher restricts file searches to .js (runtime bundles) — newer openclaw
   # releases ship .d.ts declaration files alongside bundled JS, and literal
   # type strings would otherwise match files we cannot patch.
@@ -1060,6 +1120,7 @@ oc_config_set() {
 }
 
 step_openclaw_config() {
+  is_hermes_edition && return 0
   local CLAWBOX_CONFIG="$PROJECT_DIR/data/config.json"
   local CLAWBOX_AI_ENV="$PROJECT_DIR/.env"
   local CLAWBOX_AI_KEY="${CLAWBOX_AI_API_KEY:-}"
@@ -1783,6 +1844,7 @@ step_recover() {
 }
 
 step_gateway_setup() {
+  is_hermes_edition && { log "  [hermes edition] skipping OpenClaw gateway setup"; return 0; }
   cp "$PROJECT_DIR/config/clawbox-gateway.service" /etc/systemd/system/
 
   # Mask any leftover user-level openclaw-gateway.service. Standalone
@@ -2362,6 +2424,9 @@ step_build
 log "Installing and configuring OpenClaw..."
 step_openclaw_setup
 
+log "Installing Hermes (if this is the Hermes edition)..."
+step_hermes_install
+
 log "Installing ClawKeep CLI..."
 step_clawkeep_install
 
@@ -2406,9 +2471,22 @@ step_desktop_theme
 log "Ensuring clawbox user PATH (openclaw, claude, codex, gemini, hf, clawkeep)..."
 ensure_clawbox_bashrc_path
 
+# Bake the single-harness edition lock before services start so the first
+# clawbox-setup start already sees it (no-op on dual).
+step_edition_lock
+
 log "Starting services..."
 step_start_services
 
+# Hermes edition: seed shared identity, bake the edition lock, (re)start the
+# dashboard + auth-proxy. Runs after services so the lock's clawbox-setup
+# restart lands last. No-op on openclaw/dual editions.
+if is_hermes_edition; then
+  log "Applying Hermes edition (lock + dashboard + shared identity)..."
+  bash "$PROJECT_DIR/scripts/setup-hermes-edition.sh" \
+    || echo "  Warning: hermes-edition setup failed (non-fatal)"
+fi
+
 log "Validating services..."
 step_validate_services