add cursor hermes and glm harnesses

[Svector-anu]

summary

Add three adapter-backed harnesses to Aeon:

• Cursor CLI (agent -p) with CURSOR_API_KEY
• Hermes Agent via Nous Portal (hermes -z, HERMES_AUTH OAuth archive)
• GLM Coding Plan via Claude Code against Z.AI's documented Anthropic endpoint (GLM_API_KEY / ZAI_API_KEY)

The implementation follows the existing fx/codex/pi/vibe/kimi run-harness contract and wires resolver, installer, both workflows, dashboard harness/model/auth registries, MCP server dispatch, capability manifest, and regression tests.

verification

• bash scripts/tests/test_resolve_harness.sh
• bash scripts/tests/test_install_harness.sh
• bash scripts/tests/test_generate_harnesses_json.sh
• bash scripts/tests/test_run_harness_sandbox_gate.sh
• bash scripts/tests/test_harness_envelope.sh
• npm --prefix apps/dashboard run typecheck
• npm --prefix apps/dashboard test (195 passing)
• npm --prefix apps/mcp-server run typecheck
• git diff --check

Provider documentation used:

• https://cursor.com/docs/cli/headless
• https://hermes-agent.nousresearch.com/docs/reference/cli-commands
• https://hermes-agent.nousresearch.com/docs/integrations/nous-portal
• https://docs.z.ai/devpack/quick-start
• https://docs.z.ai/devpack/tool/others

Real provider-backed Actions runs require the corresponding repository secrets (CURSOR_API_KEY, HERMES_AUTH, and GLM_API_KEY/ZAI_API_KEY); the current fork has none of those three yet, so no successful live provider run is claimed here.

[Svector-anu]

CI is green across the PR checks (dashboard typecheck/test/build, shellcheck, CLI typecheck, MCP build, webhook bundle, repo tests).

I also dispatched the fork branch through the real Aeon workflow as Cursor run 32905417467. Cursor installed successfully on the GitHub runner, then the run failed closed exactly at the credential gate because CURSOR_API_KEY is not present in the fork. No provider-backed success is claimed until the corresponding subscription secrets are added. The same gate will apply to Hermes (HERMES_AUTH) and GLM (GLM_API_KEY or ZAI_API_KEY).

[Svector-anu]

Runtime follow-up (2026-08-26): Hermes Nous Portal was verified end-to-end on the fork branch after the two follow-up fixes.

• heartbeat run 32959217860: success; resolver Harness: hermes | auth: native-oauth | model: default; output HEARTBEAT_OK · STATUS_PAGE=OK.
• github-trending run 32960375092: success; same native-oauth resolver line; output GITHUB_TRENDING_OK with live trending=ok and gh_api=ok, 8/14 items kept, quality score 5/5.

GLM is implemented and CI-covered, but provider runtime verification is pending the operator adding GLM_API_KEY or ZAI_API_KEY as an Actions secret. No secret value is included here.

[Svector-anu]

Additional runtime verification (2026-08-26): GLM Coding Plan was tested through the real workflow on the fork branch.

• run 32965149319: success
• resolver: Harness: glm | model: glm-5.2
• output: HEARTBEAT_OK · STATUS_PAGE=OK (warming up)
• usage: input 39,055; output 23,786; cache-read 335,936

The secret value was never logged or included in this PR.

[Svector-anu]

Semantic runtime verification (2026-08-26): GLM also ran the read-only github-trending skill through the real workflow.

• run 32965844371: success
• resolver: Harness: glm | auth: native-key | model: glm-5.2
• output: GITHUB_TRENDING_OK — 8 picks, notified
• usage: input 58,001; output 26,360; cache-read 3,300,416
• quality scorer: 4/5, citing specific repos, star counts, URLs, trend classifications, provenance, and internally consistent figures

This verifies useful skill output, not only process exit 0.