feat: conditionally inject Semaphore block into SOUL.md when enabled

Author: aabichou

internal/resources/semaphore.go

@@ -53,3 +53,48 @@ func BuildSemaphoreSkill(inst *hermesv1.HermesInstance) *hermesv1.InstanceSkill
 func SemaphoreCleanupOnDelete(inst *hermesv1.HermesInstance) bool {
 	return SemaphoreEnabled(inst) && BoolValue(inst.Spec.Semaphore.CleanupOnDelete)
 }
+
+// SemaphoreSoulBlock returns the markdown block injected into SOUL.md
+// when Semaphore integration is enabled. It includes the API quickstart
+// and skill loading instructions.
+const SemaphoreSoulBlock = `
+
+# Semaphore UI — infrastructure automation
+
+You have access to a **Semaphore UI** instance for running Ansible
+playbooks, Terraform/OpenTofu plans, and general scripts with full
+run logs and audit trails.
+
+- **URL**: ` + "`$SEMAPHORE_URL`" + ` (injected automatically)
+- **Auth**: ` + "`$SEMAPHORE_TOKEN`" + ` (per-agent, scoped to this project)
+- **Skill**: Load the ` + "`semaphore-ui`" + ` skill (` + "`skill_view(name='semaphore-ui')`" + `)
+  for the full API reference, then use Semaphore for any multi-step
+  infrastructure operation that needs logging, rollback, or approval gates.
+
+When given an infra task that spans multiple hosts or needs an audit trail
+(Terraform, Ansible, DB migration, cluster upgrade), **default to Semaphore**.
+The ` + "`semaphore-ui`" + ` skill has templates for common tasks.
+
+**Quickstart** (fallback if skill not loaded):
+
+` + "```" + `python
+import http.client, json, os
+
+url = os.environ["SEMAPHORE_URL"]
+token = os.environ["SEMAPHORE_TOKEN"]
+host = url.split("://")[1].split(":")[0]
+port = int(url.split(":")[-1])
+
+def sema(method, path, body=None):
+    c = http.client.HTTPConnection(host, port)
+    h = {"Authorization": f"Bearer {token}"}
+    if body:
+        h["Content-Type"] = "application/json"
+        body = json.dumps(body)
+    c.request(method, path, body, h)
+    return json.loads(c.getresponse().read())
+
+# your projects (token-scoped)
+print(sema("GET", "/api/projects"))
+` + "```" + `
+`

internal/resources/workspace_configmap.go

@@ -38,7 +38,11 @@ func DecodeWorkspacePath(key string) string {
 func BuildWorkspaceConfigMap(inst *hermesv1.HermesInstance) *corev1.ConfigMap {
 	data := map[string]string{}
 	for _, f := range inst.Spec.Workspace.InitialFiles {
-		data[EncodeWorkspacePath(f.Path)] = f.Content
+		content := f.Content
+		if f.Path == "SOUL.md" && SemaphoreEnabled(inst) {
+			content += SemaphoreSoulBlock
+		}
+		data[EncodeWorkspacePath(f.Path)] = content
 	}
 	if len(inst.Spec.Workspace.InitialDirs) > 0 {
 		dirs := make([]string, len(inst.Spec.Workspace.InitialDirs))