Upgrade installers to use uv by teknium1 · Pull Request #18 · NousResearch/hermes-agent

teknium1 · 2026-02-07T23:59:59Z

uv makes it so we can help ensure everyone who installs gets python 3.11 and improves installation speed

- Reorganized the 'all' dependencies to include specific optional groups for better modularity. - Added support for 'hermes-agent' with distinct categories: modal, messaging, cron, cli, and dev.

…ocessing capacity

…o streamline - Integrated `uv` as a fast Python package manager for automatic Python provisioning and dependency management. - Updated installation scripts (`setup-hermes.sh`, `install.sh`, `install.ps1`) to utilize `uv` for installing Python and packages, streamlining the setup process. - Revised `README.md` to reflect changes in installation steps, including symlinking `hermes` for global access and clarifying Python version requirements. - Adjusted commands in `doctor.py` and other scripts to recommend `uv` for package installations, ensuring consistency across the project.

fix: map attachment fields to gateway-expected format

## Summary This extracts the AI-review work out of NousResearch#18 into its own PR. Included here: - hardened PR comment upsert + inline review posting - structured-output parsing and improved diff-grounding - bounded local verification and parallel per-issue verification - tokenizer-backed / token-aware context packing - trace output and cumulative cache-aware usage accounting - focused regression coverage in `tests/gitea/test_ai_review.py` Not included here: - platform context seeding/history-fetch gateway changes from NousResearch#18 ## Validation - `source venv/bin/activate && python -m pytest tests/gitea/test_ai_review.py -q` Co-authored-by: Michel Belleau <mbelleau@Michels-MacBook-Pro.local> Reviewed-on: http://10.15.0.6:3300/angelos/hermes-agent/pulls/20

Jack04Fireball · 2026-04-21T21:31:29Z

Heartbeat started: Extracting hardcoded URLs into APIEndpoints.swift

NousResearch#18) Parity port of linxule/hermes-kimi-plugin's Phase 0 instrumentation work. Three signals: wall-clock gap-candidate INFO log, reconnect counter + snapshot log, paginated list_group_messages. Production-format bug fix for `_ulid_time_ms` (Kimi sends UUID v8 not ULIDs). See linxule/hermes-kimi-plugin@<HEAD> for the full design rationale, three-agent review synthesis, and deferred follow-ups. Tests: 190 passed (175 prior + 15 new). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…gent Upgrade installers to use uv

ImTheDanger-1

Approved. All 3 root causes correctly addressed. CI passing. No issues found.

… tighten + add non-blocking wake The completion-delivery story sprawled across NousResearch#1/NousResearch#2/NousResearch#21 plus an origin-return hardening subsection, and the just-merged non-blocking wake (12ddd3b) was unrecorded. Fold the whole current design into a single NousResearch#21 entry (subscription + routing, config-resolved mode, wake-origin-session incl. non-blocking background dispatch with retry/fallback, decompose-anchor self-park, merge-surface homes); turn NousResearch#1/NousResearch#2 into redirects (numbers kept stable so existing commit-message references resolve). Compress the archaeological refactor/rejected-approach essays to their durable takeaways while preserving the load-bearing flags (NousResearch#4 ALTER-guard preservation, NousResearch#18 CVE re-pins, plugin opt-in warnings). 424 -> 303 lines. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

…t method The /integration/memu/intentions endpoint is being removed server-side (tracker NousResearch#18). This method was defined but never called anywhere in hermes-agent.

…18) The in-terminal plan picker was cut (deep-link only), leaving a whole unreached state machine. Removed end-to-end: - TUI: ConfirmScreen, HandoffScreen, the 'confirm'/'handoff' screen types, pendingTargetTierId, and the now-dead onPatch threading (collapsed the dispatch to a single overview screen + folded the duplicate Box wrapper) - gateway: the tiers serialization + SubscriptionTierOption wire type - model: SubscriptionTier, _parse_tier, _coalesce, _dev_tiers and the tiers field (never displayed on either surface, so this supersedes the tier-parse fix) - tests: dropped the confirm/handoff/tier-passthrough tests; slimmed the overview render tests Net: a large dead-code cull (no behavior change — the picker never ran).

…gent Upgrade installers to use uv

…e, script_author, slash, e2e Pin the test contracts for every shape the plugin ships in, plus e2e coverage of the user-visible flows. Pinned shapes: - script_author: canonical async, coroutine-wrapped, and sync return shapes all three tested in test_script_author.py. New test_script_author_streaming.py covers the streaming path that fixes the opaque-success regression. - test_step5_agent_bridge.py + test_step5b_agent_bridge_tools.py: cover the agent_bridge surface -- both the stub and real HermesChatBridge paths, including the chart-anchor payload the verifier needs. - test_plugin_entrypoint.py: registered-as-single-plugin contract (closes the test_<thing>_registered failure mode per hermes-workflow-author Pitfall NousResearch#18). - test_slash_e2e.py: /workflow create e2e through the slash dispatcher, asserts no 'unknown workflow subcommand' substring and that the response is not None. - test_real_workflow_create_e2e.py: full /workflow create against the real dispatcher. - test_examples_agent_review.py: examples-by-reviewer contract. - test_script_author_visibility.py: per-workflow visibility surface. Diagnostic logging: when script_author fails, the logger emits the full traceback so the slash surface surfaces the exact frame instead of 'error_stage=llm_call: <repr>'. (cherry picked from commit ef796408852ab087cab2c04e2e9f7068b7ec11cc)

…, /topup, terminal-billing UX) (#51639) * feat(tui): rename /billing slash command to /topup Behavior-preserving rename of the /billing command surface to /topup. Changes: billing.ts → topup.ts (export topupCommands, name 'topup', new help string), registry.ts import+spread updated, billingOverlay.tsx overview header 'Usage credits' → 'Top up credits', billingCommand.test.ts → topupCommand.test.ts with import/lookup/call updated. RPC method names (billing.state, billing.charge, etc.) and component/symbol names unchanged. * refactor(tui): extract overlay primitives to shared module Lift MenuRow, ActionRow, footer, and barCells() out of billingOverlay.tsx into overlayPrimitives.tsx so the upcoming subscriptionOverlay.tsx can import them instead of duplicating. spendBar now calls barCells() — output is byte-identical. Pure behavior-preserving refactor. * feat(tui): add /subscription + /topup CTAs to /usage output Every /usage render now ends with 'Run /subscription to change plan · /topup to add credits' — both the healthy (with-calls) and depleted (no-calls) paths. Strings-only change, no WS1 dependency. * feat(tui): add subscription wire types Add SubscriptionTierOption, SubscriptionStateResponse, and SubscriptionManageLinkResponse to gatewayTypes.ts. Type-only — no usages yet. Mirrors the BillingStateResponse conventions (snake_case, Decimals as strings) and reuses BillingErrorPayload for error mapping. * feat(gateway): add subscription.state + subscription.manage_link RPCs - agent/subscription_view.py: SubscriptionState dataclass + fail-open build_subscription_state() (mirrors billing_view pattern) + get_subscription_manage_link() for the Stripe deep-link. - hermes_cli/nous_billing.py: get_subscription_state() + post_subscription_manage_link() HTTP helpers for the two NAS endpoints (WS1 Phase A/C). The manage-link endpoint raises BillingScopeRequired when Remote-Spending is missing (Phase 4 step-up trigger). - tui_gateway/server.py: _serialize_subscription_state() + subscription.state RPC (fail-open) + subscription.manage_link RPC (returns {ok,kind,url} or typed error envelope via _serialize_billing_error). NOT added to _LONG_HANDLERS — synchronous HTTP round-trip, not a device flow. * feat(tui): add subscription overlay state types + store slot Add SubscriptionScreen, SubscriptionOverlayCtx, SubscriptionOverlayState to interfaces.ts and a 'subscription' slot to OverlayState. Wire it into overlayStore.ts (buildOverlayState + $isBlocked). NOT added to resetFlowOverlays preserve list — flow-scoped like billing, drops on turn end. * feat(tui): build SubscriptionOverlay — overview + confirm + handoff Pure-render Ink component mirroring billingOverlay.tsx's structure. Overview screen covers all 5 states (free-upgradeable, mid-tier, top-tier, not-admin, downgrade-pending) + dunning. Confirm screen is y/n deep-link to Stripe (NO in-terminal charge). Handoff is the transient 'Opening Stripe' screen. Imports shared primitives from overlayPrimitives.tsx. 8 render tests via renderSync covering every state. * feat(tui): add /subscription command + overlay wiring - subscription.ts: SubscriptionOverlayCtx closure (openManageLink, refreshState, requestRemoteSpending) + run handler that fetches subscription.state and opens the overlay. Alias /upgrade. - registry.ts: spread subscriptionCommands into SLASH_COMMANDS. - appOverlays.tsx: render SubscriptionOverlay when overlay.subscription set. - useInputHandlers.ts: Esc closes subscription overlay; promptOverlay OR includes subscription so input is intercepted while open. - subscriptionCommand.test.ts: 4 tests (fetch+open, logged-out sys line, /upgrade alias, /subscription resolves). * fix(tui/subscription): stop saying Stripe in deep-link copy + fix manage link kind type Replace all user-facing 'Stripe' mentions in the /subscription overlay and sys messages with 'your subscription page' — the deep-link target is NAS's own /manage-subscription page, not the Stripe hosted portal. Stripe only legitimately appears later at actual Checkout. Also add 'manage' to the SubscriptionManageLinkResponse.kind union (NAS emits kind:'manage'; was previously missing from the TypeScript type causing silent narrowing errors). * feat(tui/subscription): render cancellation-scheduled note with headline precedence Parse cancelAtPeriodEnd + cancellationEffectiveAt from the NAS contract (camelCase) in the agent parser (_parse_current), emit cancel_at_period_end + cancellation_effective_at from the gateway serializer, extend the SubscriptionStateResponse type, and render a warn note in OverviewScreen: 'Cancels on {date} — your plan stays active until then.' Headline precedence when multiple flags co-occur: past-due > cancel-scheduled > downgrade-pending > active The downgradeNote guard is tightened to suppress when cancel is scheduled, so at most one status line renders at a time. * feat(tui/subscription): team-context screen — redirect to /topup for team orgs Parse the NAS context:'personal'|'team' field (defaults to 'personal' for unknown/missing values), emit it on the gateway wire, add it to SubscriptionStateResponse. When context is 'team', SubscriptionOverlay renders a dedicated read-only screen instead of the tier picker: 'This terminal is connected to {org_name}. Teams run on shared credits — use /topup to add funds. Personal subscriptions live on your personal account.' The screen closes on Enter or Esc. The personal/tier-picker path is unchanged. * fix(subscription): drop manage-link gateway RPC, build URL locally The NAS POST /api/billing/subscription/manage-link endpoint was dropped (it added no server work — the target is the static /manage-subscription page, not a Stripe-minted secret). Build the URL client-side instead: {portal_base}/manage-subscription?org_id=<org.id>. - Remove subscription.manage_link gateway RPC (server.py) - Remove get_subscription_manage_link helper (subscription_view.py) - Remove post_subscription_manage_link (nous_billing.py) - Remove SubscriptionManageLinkResponse type (gatewayTypes.ts) - Add org_id to SubscriptionState + wire through serializer + TS type - openManageLink() builds the URL locally via buildManageUrl(), opens it with the existing openExternalUrl(), no gateway round-trip - Drop targetTierId param from openManageLink (v1 sends everyone to /manage-subscription; no tier deep-link needed) - Fix stale test expectations (Stripe copy → subscription page copy) * chore(subscription): drop unused format_money import * feat(cli): /subscription + /upgrade, /billing→/topup rename, /usage CTAs Add the classic-CLI half of the terminal billing surface to match the TUI: - /subscription (alias /upgrade) command + /topup (renamed /billing, keeps 'billing' as a back-compat alias) in the command registry. - Drop the stale 'billing' entry from _SLACK_VIA_HERMES_ONLY (now cli_only). * feat(subscription): CLI /subscription handler, drop dunning, current:null no-plan - CLI _show_subscription mirrors the TUI overlay (plan read + tier list + usage bar + browser deep-link via subscription_manage_url); credits render as counts. - Adapt to the updated NAS read contract: remove is_past_due/dunning everywhere (a card-failing subscriber returns as a normal plan now), and treat no-plan as current:null (parser returns None) rather than an all-null object. - HERMES_DEV_SUBSCRIPTION_FIXTURE env-driven fixtures + ui-tui fixture harness drive every state (CLI + live TUI) with no portal. Verified against handoff 2026-06-24_subscription-tui-handoff.md. * feat(billing): CF-4 Remote-Spending revoked-terminal UX (NAS PR #481) Wire the Remote-Spending gate denial contract end to end: - nous_billing: BillingRemoteSpendingRevoked (403 remote_spending_revoked → reconnect) + BillingSessionRevoked (401 session_revoked → re-login), distinct from insufficient_scope; capture actor/code/recovery; 503 stays transient. - gateway _serialize_billing_error threads the new typed kinds + actor/code/ recovery to the TUI. - TUI renderBillingError: actor-aware revoke copy, kills the spend overlay immediately (no 15-min zombie button), handles session_revoked, the dual- emitted cli_billing_disabled/remote_spending_disabled, role_required, idempotency_conflict; poll treats a mid-poll revoke as ambiguous (check balance before retry), not a failure. - CLI _billing_render_charge_error: same denial matrix, actor-aware copy. Tests: gate-contract mapping + envelope (py) and revoke/session/disabled (TUI). Per handoff 2026-06-24_remote-spending-TUI-contract-handoff.md. * refactor(subscription): remove dead step-up scaffolding from /subscription /subscription only opens a browser deep-link to manage-subscription — that needs no billing scope, so it can never hit insufficient_scope. Drop the never-fired 'stepup' screen type, requestRemoteSpending ctx fn, and resumeScreen bookkeeping (leftovers from a superseded plan). The resumable step-up lives on /topup, where the charge actually gets gated. * feat(tui/topup): resumable 'Allow Remote Spending' step-up on the charge path Phase 4: when a charge returns insufficient_scope, the /topup modal no longer tears down with a 'run /billing again' ConfirmReq. Instead it stays MOUNTED and switches to a step-up screen: - charge() is now awaitable, returning a discriminated outcome (submitted | needs_remote_spending | error) so the overlay can route without closing. - StepUpScreen: 'Allow Remote Spending' → await the device-flow grant (browser opens via the existing out-of-band billing.step_up.verification event) → replay the held charge (pendingCharge.amount) and settle, with no command re-run. Never surfaces the raw billing:manage scope. - armStepUp's fire-and-forget ConfirmReq replaced by requestRemoteSpending(); the leaky 'billing:manage' / 'Re-authorize' / 'run /billing again' copy is gone. Tests: charge-outcome routing, step-up grant/deny, and a render test asserting the step-up copy holds the amount and never leaks billing:manage. Per handoff 2026-06-24_remote-spending-TUI-contract-handoff.md §2 (Grady #6). * feat(billing): shared dollar usage model + two-bar view (drop "credits") Single source of truth for the /usage and /subscription usage bars across TUI + CLI. Reads the NAS account-info dollar fields (subscription/top-up/total remaining, monthly allowance, renewal) and produces a surface-agnostic model: two full-resolution bars (plan allowance + purchased top-up), a status classification (free | healthy | low | depleted), and a human renewal date. - agent/billing_usage.py: UsageModel/UsageBar, usage_model_from_account (fail-open), build_usage_model (HERMES_DEV_CREDITS_FIXTURE-aware), format_renews (ISO -> "Jul 24, 2026", Windows-safe), $5 low-balance threshold. - tui_gateway/server.py: _serialize_usage_model/_serialize_usage_bar, a usage.bars RPC, and the model embedded into subscription.state so the overlay renders the same bars from its single fetch. - Dollars only, never "credits"; two separate bars (not a crammed three-segment one) for legibility at terminal widths. - tests/agent/test_billing_usage.py: status classification, bar math (clamp/over-cap), NaN/Inf rejection, fail-open invariants. * feat(tui): dollar usage bars on /usage + /subscription, drop tier picker Render the shared two-bar dollar model in both overlays; strip "credits" and the in-terminal tier selection per UX feedback. - overlayPrimitives.tsx: UsageBars (themed plan/top-up bars — gold allowance, green top-up) + usageBarsText for the /usage panel. Plan name labels the bar; "$X left of $Y · N% used" (disambiguated so the % matches); top-up "never expires". - subscriptionOverlay.tsx: status line dedupes ($X left once; bar carries the breakdown), human renewal date, state-matched nudges (free upsell / <$5 low alert) with box-safe ASCII markers (! / >) instead of the width-unstable emoji that broke the border. Tier picker removed — overview shows usage + plan, then "Manage on portal" / "Close" (free users get "Start a subscription"). No "credits" anywhere. - session.ts: /usage renders the dollar bars + balance summary, falling back to the legacy credits lines only when the model is unavailable; CTA reworded. - gatewayTypes.ts: UsageModelData/UsageBarData wire types + usage on SessionUsageResponse/SubscriptionStateResponse. - Tests updated to the new contract (no "credits", "left of", dedup, markers). * feat(cli): mirror dollar usage bars on /usage + /subscription CLI parity with the TUI billing rework, from the same shared usage model. - _print_nous_credits_block (/usage) and _subscription_overview render the two-bar dollar view (plan name on the bar, "$X left of $Y · N% used", top-up "never expires", total spendable) instead of the credits-worded block. - Dollars only — dropped the tier catalog (no more "$N/mo (… credits)") and every user-facing "credits"; team copy says "shared balance". - Human renewal date via the shared format_renews; status line dedupes the "$X left"; free upsell + <$5 low alert with ASCII markers. - /subscription manage modal no longer dumps the raw manage-subscription URL in its detail — the [1] Open / [2] Copy link / [3] Cancel options carry it. Title is "Manage your subscription" (no in-terminal plan change). The raw URL stays only in the non-interactive / not-admin fallbacks, which have no menu. - /usage token-usage panel (model, tokens, cost, context) left untouched. * feat(billing): embed dollar usage model into billing.state for /topup The /topup overview renders the same two-bar dollar usage (plan + top-up) as /usage and /subscription. Embed the shared usage model into the billing.state RPC payload (mirrors subscription.state) so the overlay gets the bars from its single fetch, and add the `usage` field to BillingStateResponse. * feat(tui/topup): reorder overview + in-flight reauth with press-Enter resume Reworks the /topup overlay per the Jun 19 review and the no-preflight decision. Overview: - Balance leads in the title ("Top up · balance $X"); the shared two-bar dollar usage (plan + top-up) renders below. Dropped the old monthly-cap spend bar. - "Add funds" is the first action (was "Buy credits"); auto-reload / monthly limit / manage-on-portal follow. Dollars only — no "credits" anywhere. - No "Enable terminal billing" menu item and NO scope preflight: whether the terminal can charge is discovered reactively at pay time. (We deliberately do not read/refresh the OAuth token to gate UI.) Step-up (reached only on a charge's insufficient_scope 403): - New 4-phase flow that keeps the modal mounted: prompt (one-time-setup heads-up) → waiting (browser authorize) → granted (explicit "Press Enter to resume") → replay the held charge → settle. The press-Enter beat is the reassuring "you're back, finish your purchase" moment. - Renamed user copy "Allow Remote Spending" → "Enable terminal billing"; never leaks the raw billing:manage scope (guarded by the render test). - topup.ts error copy de-crufted to terminal-billing wording, emoji removed. Tests: step-up prompt copy, the no-raw-scope invariant, and new overview tests (balance-in-title, Add-funds-first, two-bar usage, no "credits"). * feat(cli/topup): mirror overview reorder + in-flight reauth resume CLI parity with the TUI /topup rehaul, from the same shared usage model. - _billing_overview: balance in the title, the two-bar dollar usage (plan name on the plan bar, top-up "never expires") in place of the old cap spend bar, "Add funds" first, dollars throughout — no "credits", no scope preflight. - _billing_handle_scope_required: now takes the held amount + idempotency key and runs the in-flight flow — "Enable terminal billing" → browser device-flow → re-check the org kill-switch → press-Enter to resume → replay the held charge (reusing the key so a double-submit collapses to one). Stops leaking the raw billing:manage scope. - Charge-error + buy/auto-reload copy de-crufted to terminal-billing/dollars. - Tests updated to the new overview + buy copy. * fix(billing): guard non-JSON 2xx responses in the billing HTTP client A 2xx response with a non-JSON body — e.g. a reverse-proxy / SPA fallback HTML page served when a billing route isn't actually mounted on a deployment — hit json.loads() on the success path of _request() and raised a raw json.JSONDecodeError. That escaped the typed-BillingError contract, so callers' `except BillingError` missed it and fell through to a generic fail-open that rendered as a misleading "not logged in" (observed when /api/billing/subscription was briefly unshipped on staging: 200 text/html, x-matched-path /[...notFound]). Now a non-JSON 2xx body raises a typed BillingError(error="endpoint_unavailable") so surfaces degrade gracefully ("could not load …") instead of crashing or mislabeling a valid session as logged-out. The 4xx/5xx path already guarded its .json(); this closes the same hole on the success path. Test: tests/hermes_cli/test_nous_billing_request.py — non-JSON 2xx → typed error (not JSONDecodeError, not BillingAuthError), empty body → {}, valid JSON parses. * feat(billing/dev): add HERMES_DEV_BILLING_FIXTURE for offline card/scope testing build_billing_state short-circuits to a fixture when HERMES_DEV_BILLING_FIXTURE is set (mirrors HERMES_DEV_CREDITS_FIXTURE for the usage model). States: nocard | card | card-autoreload | notadmin | billing-off | logged-out — so the card-on-file gate, admin role, and kill-switch paths are exercisable offline without a live portal. Env-var gated; returns None when unset (no prod leak). Adds 8 behavior tests asserting the card/admin/billing-on contract per state. * refactor(billing): fold /credits into /topup /credits is redundant now that /topup shows the dollar balance + portal handoff. Make 'credits' (and 'billing') aliases of /topup so typing /credits still works, resolving to topup everywhere (CLI, gateway, Slack, TUI, autocomplete, help). Remove the standalone /credits surface across 6 places: - CLI _show_credits handler + dispatch - gateway _handle_credits_command -> renamed _handle_topup_command, copy softened to 'Manage billing on the portal' (the messaging billing surface; /topup is now gateway-available so messaging keeps billing — credits was the only one before) - TUI commands/credits.ts + creditsCommand.test.ts (deleted), registry entry - tui_gateway credits.view RPC + the CreditsViewResponse type - Slack _SLACK_VIA_HERMES_ONLY: credits -> topup Sweep user-facing /credits -> /topup (usage-block hint, depletion notice) and stale doc-comments. OpenRouter's /credits endpoint URL left untouched. Tests updated (test_credits_folds_into_topup) or pruned for the removed symbols. * fix(billing): card-on-file heads-up, no-card portal gate, /usage bar ordering, modal glyph In-terminal charge (POST /charge against the org's server-held card, no card ref leaves the client): - card present: confirm screen shows 'Your card saved on the portal will be charged' + a 'Manage on portal' escape option (CLI); heads-up line (TUI) - no card on file: /topup overview + buy flow detect it and route to the portal to add a card, instead of offering a charge that 403s no_payment_method /usage bar ordering: route the dollar block through _cprint consistently. The Plan: line (_cprint) and the bar (raw print) flushed to different buffers under patch_stdout and interleaved nondeterministically; now Plan: -> bar -> status/CTA is stable across all states. Modal glyph: strip the leading emoji from bordered _prompt_text_input_modal titles — it measures 1 char but renders 2 columns, shifting the box's right border (the stray '|'). Includes the f-string 'Pay $X?' title. Small /credits -> /topup string bits in cli.py ride along with the surrounding charge edits (the fold lives in the sibling refactor commit). * refactor(billing): apply safe simplify-pass fixes Three low-risk cleanups from a parallel simplify review (reuse/quality/efficiency): - dev fixture portal URL: reuse the prod host (was drifted to staging-* — a real mismatch vs subscription_view's _DEV_FIXTURE_PORTAL) - TUI billingOverlay choose(): collapse two byte-identical branches (needsCard + the not-full else both = portal-or-close at index 0) into one tail; the only divergent path (full && !needsCard → buy/auto/limit) stays explicit - /topup overview comment: correct the stale 'buy_flow detects no_payment_method' note (the overview's no-card gate fires first, so reaching Add funds implies a card on file) Skipped (judgment): the orphaned CreditsView.depleted field (harmless, on a live dataclass), the defensive card gates in _billing_buy_flow/_confirm_and_charge (cheap correct defense on the money path), and folding the no-card handoff into a shared helper (touches 4 money-path sites for tidiness — not worth the risk here). * fix(billing): reactive charge gating — drop card preflight, react to 403 (scope→reauth, no-card→portal) * refactor(billing): drop the /credits alias entirely The /credits fold made it an alias of /topup; now remove that too. Typing /credits is an unknown command, not a silent redirect — billing lives only on /topup (with /billing kept as the old command's back-compat name). Dropped the alias from the registry CommandDef and the TUI topup.ts; updated the test to assert /credits resolves to nothing (no command, no alias). * docs(billing): fix stale comment in _billing_overview — describe reactive no-card path The comment still described the removed overview-level card gate ('no-card case handled above'). Corrected to: the buy flow reacts to the server's no_payment_method 403 and hands off to the portal at charge time (no preflight). * refactor(billing): simplify-pass — share usage-payload helper, drop dead bar wire fields + redundant admin gate * refactor(billing): drop the /billing alias too — /topup is the only billing command Following /credits removal, retire the old /billing name as well. /topup now has NO aliases — both /credits and /billing are unknown commands. Dropped the alias from the registry CommandDef and TUI topup.ts; fixed the one live user-facing straggler (the not-logged-in message said 'then /billing' → /topup) and the _show_billing docstring/default-arg references. Test asserts /topup carries no aliases and neither old name resolves. * fix(billing): code-review fixes — money-path + parity bugs Money path (TUI): - auto-reload "Turn off" now echoes current threshold/top_up_amount so the PATCH succeeds (was sending {enabled:false} → invalid_request → stayed ON) - charge poll honors the 5-min cap on the 429/503 throttle branch too (was rescheduling forever); cap folded into one timedOut() helper - step-up resume reacts to the replay outcome instead of unconditionally closing on a reassuring line with no charge made - synchronous submit guard on Confirm so two key events can't double-charge Gateway: - billing.step_up routes typed errors through _serialize_billing_error (was a raw {error:'error'} dict → generic copy for session_revoked) - billing.state / subscription.state / usage.bars / session.usage moved to _LONG_HANDLERS (blocking portal HTTP no longer stalls the main stdin loop) CLI: - _billing_render_charge_error handles insufficient_scope without leaking the raw billing:manage scope name on a post-grant replay re-raise Python model: - subscription_view tier parse None-coalesces tierOrder/dollarsPerMonth so a free tier's 0 survives ($0, not "—"; correct sort order) TUI parity/robustness: - /usage shows formatted renews_display, not raw ISO renews_at - subscription overview guards a null pending_downgrade_at (was "on null.") - subscription overview surfaces a message instead of silently closing when portal_url is missing - buildManageUrl wraps new URL() so a malformed portal_url can't throw out of the Ink key handler * fix(billing): cross-surface bar direction, formatted cancel/downgrade dates, Slack alias gating - CLI plan bar now fills by REMAINING (fuel-gauge), matching the shared model's fill_fraction, the top-up bar, and the TUI — same account renders identically on both surfaces (#8) - subscription serializer emits cancellation_effective_display / pending_downgrade_display (format_renews); TUI shows 'Jul 1, 2026' not raw ISO (#14b) - _SLACK_VIA_HERMES_ONLY now includes the 'billing' alias so it follows its canonical /topup via /hermes instead of leaking a native Slack slot (#9) * fix(billing): thread idempotency key through the TUI step-up replay (#2) Mint a stable idempotency key when the purchase amount is chosen; it rides pendingCharge into both the Confirm charge and the post-grant step-up replay, so a retried charge dedups server-side (the gateway already echoes the key). A fresh amount selection gets a fresh key. Combined with the sync submit guard, a double-submit now collapses to one charge. * refactor(billing): remove dead /subscription tier-picker scaffolding (#18) The in-terminal plan picker was cut (deep-link only), leaving a whole unreached state machine. Removed end-to-end: - TUI: ConfirmScreen, HandoffScreen, the 'confirm'/'handoff' screen types, pendingTargetTierId, and the now-dead onPatch threading (collapsed the dispatch to a single overview screen + folded the duplicate Box wrapper) - gateway: the tiers serialization + SubscriptionTierOption wire type - model: SubscriptionTier, _parse_tier, _coalesce, _dev_tiers and the tiers field (never displayed on either surface, so this supersedes the tier-parse fix) - tests: dropped the confirm/handoff/tier-passthrough tests; slimmed the overview render tests Net: a large dead-code cull (no behavior change — the picker never ran). * test(billing): parametrize usage-model tests; drop dead is_low/is_free props Collapse the fail-open + status-classification cases into parametrized tables (same coverage, ~80 fewer lines) and remove the now-unused UsageModel.is_low / is_free properties (only a test pinned them). * fix(billing): revert dead 'billing' Slack-via-hermes entry — the alias was dropped #9 was based on a stale review diff: /billing is no longer an alias of /topup (dropped earlier), so routing it via /hermes filtered a name that doesn't exist. * test(billing): cull redundant TUI billing tests (parametrize, merge dupes) usageCommand: collapse 3 CTA tests into one + a panel helper. billingStepUp: merge the two step-up render asserts. topupCommand: parametrize requestRemoteSpending + the revoked-actor pair, drop the redundant happy-path-submitted test. Money-path + error-mapping coverage preserved. * refactor(billing): extract _usage_bar_lines — one source of truth for the CLI bars The plan + top-up bar format was copy-pasted across _print_nous_credits_block, _subscription_overview, and _billing_overview. Extract a helper returning the ready-to-print lines; each caller keeps its own print fn (the _cprint-ordering constraint stays) and resolves its plan-name label. Centralizes the format so the three surfaces can't drift. * feat(billing): NAS V3 subscription-change HTTP client wrappers Add the four write-side wrappers for the V3 subscription contract to nous_billing, each a thin _request() call (reusing auth, JSON, 401-retry, typed errors): - post_subscription_preview → POST /subscription/preview (chargeless quote) - put_subscription_pending_change→ PUT /subscription/pending-change (downgrade/cancel) - delete_subscription_pending_change → DELETE .../pending-change (resume/undo) - post_subscription_upgrade → POST /subscription/upgrade (the money route) pending-change takes a discriminated body (tier_change | cancellation); upgrade requires an Idempotency-Key (mandatory, validated client-side before any I/O). Tests assert the exact method/path/body/header each wrapper puts on the wire. * feat(billing): subscription tier catalog + change-preview models Reinstate the catalog the in-terminal picker needs (was culled when /subscription was deep-link-only): SubscriptionTier + SubscriptionState.tiers + _parse_tier, with _coalesce so the free tier's 0 tierOrder/price survives a falsy-or. Parse the catalog from GET /subscription's tiers and seed _dev_tiers into every fixture. Add SubscriptionChangePreview + subscription_change_preview_from_payload for the POST /preview quote (effect/amountDueNowCents/effectiveAt/reason + tier delta); a malformed/missing effect fails safe to 'blocked' so a bad quote never reads as a charge. Module docstring updated: the overlay is no longer deep-link-only. * feat(billing): gateway RPCs for the V3 subscription change flow Add subscription.preview / .change / .resume / .upgrade RPCs, each wrapping its nous_billing call and reusing _serialize_billing_error for the typed envelope (so a 403 still drives the device step-up). upgrade mints + echoes the idempotency key and surfaces status + recovery_url so the TUI can route an SCA/decline to the portal. Re-add the tier catalog to _serialize_subscription_state (price pre-formatted) for the picker. All four are pool-routed (_LONG_HANDLERS) — preview + upgrade hit Stripe and must not stall the main stdin loop. * feat(billing): in-terminal subscription change flow (TUI) /subscription is no longer deep-link-only: it drives the change in-terminal against the V3 contract via the new gateway RPCs. The overlay is a state machine overview → picker → confirm → result: - picker lists the tier catalog with upgrade/downgrade hints (current + free excluded; free=cancel, on the overview); - confirm shows the previewed effect — pay $X now (upgrade) / scheduled at date (downgrade) / cancel at period end / blocked-with-reason — then applies it; - an upgrade's SCA/decline routes to the portal via the result screen's recovery link; resume/cancel/downgrade are chargeless. Starting a NEW subscription still deep-links (needs a fresh card). insufficient_scope points to /topup (the step-up stays there, not duplicated here). Adds the wire types (tiers + preview/upgrade responses), widens the overlay ctx + screen state, and threads onPatch. Render tests cover every screen. * feat(billing): in-terminal step-up + clearer scheduled-change UX (TUI) Two improvements to the /subscription overlay: Step-up re-auth in place. When a mutation (preview/change/upgrade/resume) returns insufficient_scope, route to a new 'stepup' screen that grants terminal billing via billing.step_up and AUTO-REPLAYS the held action on grant — no bounce to /topup. Scope routing is centralized in previewAndRoute/applyPendingAndRoute/ resumeAndRoute (shared by the picker, confirm, overview + the step-up replay). The browser opens via the shared global verification handler; copy never leaks the raw billing:manage scope. Make a scheduled change unmissable. A downgrade/cancel was one buried warn line that read as 'nothing happened'. Now the overview leads with a banner (⏳ Scheduled change · Ultra ──▶ Plus · <date> · you keep Ultra until then), the status line echoes the transition (Plan: Ultra → Plus), 'Keep <tier> (undo)' is promoted to the first olive action, the result screen says 'your plan doesn't change today', and confirm gets a charged-now / scheduled chip. * feat(billing): full in-terminal subscription change flow in the classic CLI Bring the CLI to parity with the TUI overlay — /subscription is no longer deep-link-only. A paid admin/owner gets picker → preview → confirm → apply, mirroring the /topup buy flow's modal idioms: - _subscription_change_menu (change / undo-or-cancel / manage-on-portal), - _subscription_pick_tier (catalog with upgrade/downgrade hints), - _subscription_preview_and_confirm (POST /preview → effect-aware confirm), - _subscription_apply (schedule / cancel / resume chargeless; upgrade charges the sub's card, SCA/decline → portal), - _subscription_handle_scope_required (insufficient_scope → step_up_nous_billing_scope inline, then replays the held preview/mutation — reusing the upgrade idempotency key). Also the scheduled-change UX fix: the overview leads with a prominent banner (⏳ Scheduled change · Super ──▶ Plus · <date> · you keep Super until then) and the status line echoes the transition, matching the TUI. Members / non-interactive / free still deep-link. Tests drive every branch via a mocked modal + nous_billing. * fix(billing): close TUI subscription money-path holes (ultracode review) - Un-consented charge (P1): the step-up now HOLDS at a 'granted' phase requiring an explicit Continue, and an abortedRef gates the grant's late .then — a cancel during the browser flow can no longer replay the held upgrade + charge. - Missing idempotency key (P2): mint it when building an upgrade 'pending' so it rides into confirm AND the step-up replay (was always undefined → gateway minted a fresh key per call, defeating dedup). - Navigate-away re-charge (P2): confirm 'back' is guarded by submittingRef while an apply is in flight. - Ambiguous charge (P2): a transport-null upgrade is reported as 'may or may not have charged — re-check', never a flat failure that invites a blind retry. - Typed step-up denial (P2): requestRemoteSpending returns {granted,error,message}; the screen maps session_revoked / remote_spending_revoked / rate_limited to the right recovery instead of always 'an admin must allow it'. * fix(billing): close CLI subscription money-path holes (ultracode review) - Bounded step-up (P2): bust the 30s token cache after a grant (it held the pre-grant unscoped token; _request only busts on 401, not 403) and replay ONCE with allow_stepup=False so a still-denied scope can't re-prompt/re-open in a loop. - Stray-keystroke charge (P3→near-P2): the upgrade confirm defaults to 'Go back', not 'Pay ' — a bare Enter can't move money. - Fail-open on unknown effect (P3→near-P2): an unrecognized preview effect now fails SAFE (portal hand-off) instead of scheduling a real PUT. - 'cancel' word collision (P3): the Close row uses value 'close' so typing 'cancel' can't hit it and falsely report 'Cancelled'. - blocked effect re-offers the portal; undo is promoted to the first row when a change is pending (TUI parity). * fix(billing): guard the step-up resume against double-fire (2nd ultracode pass, BUG A) The P1 fix split the auto-replay into a user-triggered resume() on the granted screen, where the default row is the charging action — but resume() had no re-entrancy guard, so a double-Enter fired two replays (the upgrade dedups on the shared key, but schedule/cancel/resume replays carry none → duplicate PUT/DELETEs). Mirror billingOverlay.resume(): flip to a 'resuming' phase + a resumingRef so it fires at most once, and block 'back' once resuming (no re-mount → no second submit). * fix(billing): CLI charge-route ambiguous-charge caveat (2nd ultracode pass, BUG B) The TUI hardened upgradeResult(null) but the CLI charging route did not: a transport/timeout/500 (or unknown 2xx status) on post_subscription_upgrade — after NAS may have already prorated + charged — printed a flat failure, and a manual re-run mints a FRESH idempotency key the server can't dedup → a real second charge. Now the charge route reports 'your card may or may not have been charged — re-run /subscription to check before trying again' and steers away from a blind retry (the CLI can't persist the key across a command re-run). Also thread allow_stepup through the preview→apply replay (BUG C.1) and route the requires_action/ payment_failed portal lines through _cprint for deterministic ordering. * fix(billing): cap the TUI step-up replay to avoid a resume-deadlock (final pass, R1) The round-2 resume guard ('resuming' phase + resumingRef) could deadlock: on a REPEAT insufficient_scope during the post-grant replay, the route helpers did onPatch({screen:'stepup'}) — a no-op since we're already mounted on stepup (no key → no remount) — leaving phase='resuming'/resumingRef=true frozen on 'Applying your change…'. Thread allowStepUp through previewAndRoute/applyPendingAndRoute/ resumeAndRoute; the resume() replay passes false, so a repeat scope denial surfaces a 'still isn't enabled' result instead (mirrors the CLI's allow_stepup=False cap). Also: applyPendingAndRoute(pending=null) now routes to overview, not a stranded Promise.resolve(). * fix(billing): narrow the CLI ambiguous-charge catch to indeterminate outcomes (final pass, R2) The round-2 fix caught EVERY non-scope BillingError as 'may or may not have been charged' — but typed pre-charge rejections (BillingRateLimited 429, BillingSessionRevoked 401, BillingRemoteSpendingRevoked 403, role_required/no_payment_method 4xx) never reached Stripe, so the ambiguity copy was wrong and dropped their real recovery hints. Now route those to _subscription_render_error, and reserve the ambiguous copy for genuinely indeterminate outcomes (network_error / endpoint_unavailable / status None / 5xx). Tests: rate-limit stays deterministic; a real transport failure stays ambiguous. * feat(billing): card visibility + guided add-card path in /topup and /subscription Consume the NAS card-resolver contract (card.resolvedVia + chargeability) across both surfaces, degrading cleanly on today's NAS (fields absent → prior behavior): - WHICH card: the payment lines render provenance — 'Visa ····4242 — the card on your subscription' (resolvedVia → label; unknown rung/older NAS → masked card + the old generic line). Link payment methods render the brand alone (last4 is empty — never 'Link ····'). - Presence at a glance: the /topup overview now shows 'Card: …' or 'No saved card on file' for the full-menu case, plus a warning when the resolver marks the card needs_repair (failing auto-reloads) on overview/buy/confirm. - Add-card path: with no card on file, 'Add funds' becomes a guided screen — open the portal billing page, then 'I've added it — check again' re-fetches billing state and continues straight into the purchase (also recovers a transient display miss). Cards are never entered in-terminal. - /subscription upgrade confirm names the exact card ('Visa ····4242 — the card on your subscription — will be charged'), best-effort via billing.state and only when the resolution rung matches what a subscription charge actually uses (subPin/customerDefault, mirroring Stripe's precedence); otherwise the generic line stands. Fail-soft: any lookup error keeps the generic line. - Gateway serializes display/resolved_via/needs_repair; TUI ctx gains refreshState (topup) + fetchCard (subscription); new offline fixtures card-sub / card-repair. Tests: TUI ctx mocks extended; CLI suites cover provenance + repair-warning render, the Link guard, the add-card path (continue-after-recheck + abandon), the sub-confirm card line, and keep the confirm-time lookup offline in tests. * fix(billing): consume server canChangePlan, preserve distinct refusal codes, drop dead chargeability - Parse canChangePlan verbatim from NAS payloads into BillingState and SubscriptionState; fall back to the legacy OWNER/ADMIN check only when the server omits the field (FINANCE_ADMIN stops being locked out where NAS authorizes it). Role model updated to the 5-role enum. - Add the autoReload.card union (canonical | distinct | none) end-to-end: parse + gateway serialization, distinct carries payment_method_id/brand/last4 with nullable display fields. - stripe_unavailable (503, transient) and upgrade_cap_exceeded (429, daily cap) now survive to the wire as their own codes instead of collapsing into rate_limited; new exception types subclass BillingRateLimited so existing backoff call sites keep working. - Remove card.chargeability / needs_repair parsing, serialization, fixtures and the cli warning blocks: NAS #670 removed the field, so the repair path was permanently dead. The future card-health signal belongs to the NAS W1/W3 work. - Tests: five-role fixtures, canChangePlan override/fallback, all three auto-reload card variants, 429-vs-503 code preservation end-to-end. * feat(tui): render the full NAS billing refusal surface - billingOverlay: divergence notice when auto-refill charges a distinct card (portal deep-link to reconcile); needs_repair warnings removed with the field. - topup: explicit copy for consent_required, org_access_denied, upgrade_cap_exceeded, auto_top_up_disabled_failures and stripe_unavailable (honors retry_after); processing_error is an explicit charge-failure case; transport loss during charge polling now reads as an unconfirmed outcome (check balance before retrying), matching the revocation path. - subscriptionOverlay: branch on upgrade reason, not status, so an SCA-needing upgrade routes to portal verification even while NAS pre-#711 labels it payment_failed; after an upgrade, poll subscription state until the tier flips (bounded), rendering applying/still-applying rather than assuming immediacy. - Capability-neutral refusal copy (owner, admin, or finance admin) replaces the stale org admin/owner wording. - gatewayTypes: BillingAutoReload.card union added, needs_repair removed. * docs(billing): client-side billing state and refusal lifecycle table Enumerates, from the code, every billing.state shape and typed refusal the gateway serves and the exact TUI copy + recovery each renders. Acceptance from the billing-integration handoff: no NAS billing state or typed refusal falls through to a generic toast; unknown codes still degrade to the default branch that surfaces the server message.

* feat(tui): rename /billing slash command to /topup Behavior-preserving rename of the /billing command surface to /topup. Changes: billing.ts → topup.ts (export topupCommands, name 'topup', new help string), registry.ts import+spread updated, billingOverlay.tsx overview header 'Usage credits' → 'Top up credits', billingCommand.test.ts → topupCommand.test.ts with import/lookup/call updated. RPC method names (billing.state, billing.charge, etc.) and component/symbol names unchanged. * refactor(tui): extract overlay primitives to shared module Lift MenuRow, ActionRow, footer, and barCells() out of billingOverlay.tsx into overlayPrimitives.tsx so the upcoming subscriptionOverlay.tsx can import them instead of duplicating. spendBar now calls barCells() — output is byte-identical. Pure behavior-preserving refactor. * feat(tui): add /subscription + /topup CTAs to /usage output Every /usage render now ends with 'Run /subscription to change plan · /topup to add credits' — both the healthy (with-calls) and depleted (no-calls) paths. Strings-only change, no WS1 dependency. * feat(tui): add subscription wire types Add SubscriptionTierOption, SubscriptionStateResponse, and SubscriptionManageLinkResponse to gatewayTypes.ts. Type-only — no usages yet. Mirrors the BillingStateResponse conventions (snake_case, Decimals as strings) and reuses BillingErrorPayload for error mapping. * feat(gateway): add subscription.state + subscription.manage_link RPCs - agent/subscription_view.py: SubscriptionState dataclass + fail-open build_subscription_state() (mirrors billing_view pattern) + get_subscription_manage_link() for the Stripe deep-link. - hermes_cli/nous_billing.py: get_subscription_state() + post_subscription_manage_link() HTTP helpers for the two NAS endpoints (WS1 Phase A/C). The manage-link endpoint raises BillingScopeRequired when Remote-Spending is missing (Phase 4 step-up trigger). - tui_gateway/server.py: _serialize_subscription_state() + subscription.state RPC (fail-open) + subscription.manage_link RPC (returns {ok,kind,url} or typed error envelope via _serialize_billing_error). NOT added to _LONG_HANDLERS — synchronous HTTP round-trip, not a device flow. * feat(tui): add subscription overlay state types + store slot Add SubscriptionScreen, SubscriptionOverlayCtx, SubscriptionOverlayState to interfaces.ts and a 'subscription' slot to OverlayState. Wire it into overlayStore.ts (buildOverlayState + $isBlocked). NOT added to resetFlowOverlays preserve list — flow-scoped like billing, drops on turn end. * feat(tui): build SubscriptionOverlay — overview + confirm + handoff Pure-render Ink component mirroring billingOverlay.tsx's structure. Overview screen covers all 5 states (free-upgradeable, mid-tier, top-tier, not-admin, downgrade-pending) + dunning. Confirm screen is y/n deep-link to Stripe (NO in-terminal charge). Handoff is the transient 'Opening Stripe' screen. Imports shared primitives from overlayPrimitives.tsx. 8 render tests via renderSync covering every state. * feat(tui): add /subscription command + overlay wiring - subscription.ts: SubscriptionOverlayCtx closure (openManageLink, refreshState, requestRemoteSpending) + run handler that fetches subscription.state and opens the overlay. Alias /upgrade. - registry.ts: spread subscriptionCommands into SLASH_COMMANDS. - appOverlays.tsx: render SubscriptionOverlay when overlay.subscription set. - useInputHandlers.ts: Esc closes subscription overlay; promptOverlay OR includes subscription so input is intercepted while open. - subscriptionCommand.test.ts: 4 tests (fetch+open, logged-out sys line, /upgrade alias, /subscription resolves). * fix(tui/subscription): stop saying Stripe in deep-link copy + fix manage link kind type Replace all user-facing 'Stripe' mentions in the /subscription overlay and sys messages with 'your subscription page' — the deep-link target is NAS's own /manage-subscription page, not the Stripe hosted portal. Stripe only legitimately appears later at actual Checkout. Also add 'manage' to the SubscriptionManageLinkResponse.kind union (NAS emits kind:'manage'; was previously missing from the TypeScript type causing silent narrowing errors). * feat(tui/subscription): render cancellation-scheduled note with headline precedence Parse cancelAtPeriodEnd + cancellationEffectiveAt from the NAS contract (camelCase) in the agent parser (_parse_current), emit cancel_at_period_end + cancellation_effective_at from the gateway serializer, extend the SubscriptionStateResponse type, and render a warn note in OverviewScreen: 'Cancels on {date} — your plan stays active until then.' Headline precedence when multiple flags co-occur: past-due > cancel-scheduled > downgrade-pending > active The downgradeNote guard is tightened to suppress when cancel is scheduled, so at most one status line renders at a time. * feat(tui/subscription): team-context screen — redirect to /topup for team orgs Parse the NAS context:'personal'|'team' field (defaults to 'personal' for unknown/missing values), emit it on the gateway wire, add it to SubscriptionStateResponse. When context is 'team', SubscriptionOverlay renders a dedicated read-only screen instead of the tier picker: 'This terminal is connected to {org_name}. Teams run on shared credits — use /topup to add funds. Personal subscriptions live on your personal account.' The screen closes on Enter or Esc. The personal/tier-picker path is unchanged. * fix(subscription): drop manage-link gateway RPC, build URL locally The NAS POST /api/billing/subscription/manage-link endpoint was dropped (it added no server work — the target is the static /manage-subscription page, not a Stripe-minted secret). Build the URL client-side instead: {portal_base}/manage-subscription?org_id=<org.id>. - Remove subscription.manage_link gateway RPC (server.py) - Remove get_subscription_manage_link helper (subscription_view.py) - Remove post_subscription_manage_link (nous_billing.py) - Remove SubscriptionManageLinkResponse type (gatewayTypes.ts) - Add org_id to SubscriptionState + wire through serializer + TS type - openManageLink() builds the URL locally via buildManageUrl(), opens it with the existing openExternalUrl(), no gateway round-trip - Drop targetTierId param from openManageLink (v1 sends everyone to /manage-subscription; no tier deep-link needed) - Fix stale test expectations (Stripe copy → subscription page copy) * chore(subscription): drop unused format_money import * feat(cli): /subscription + /upgrade, /billing→/topup rename, /usage CTAs Add the classic-CLI half of the terminal billing surface to match the TUI: - /subscription (alias /upgrade) command + /topup (renamed /billing, keeps 'billing' as a back-compat alias) in the command registry. - Drop the stale 'billing' entry from _SLACK_VIA_HERMES_ONLY (now cli_only). * feat(subscription): CLI /subscription handler, drop dunning, current:null no-plan - CLI _show_subscription mirrors the TUI overlay (plan read + tier list + usage bar + browser deep-link via subscription_manage_url); credits render as counts. - Adapt to the updated NAS read contract: remove is_past_due/dunning everywhere (a card-failing subscriber returns as a normal plan now), and treat no-plan as current:null (parser returns None) rather than an all-null object. - HERMES_DEV_SUBSCRIPTION_FIXTURE env-driven fixtures + ui-tui fixture harness drive every state (CLI + live TUI) with no portal. Verified against handoff 2026-06-24_subscription-tui-handoff.md. * feat(billing): CF-4 Remote-Spending revoked-terminal UX (NAS PR #481) Wire the Remote-Spending gate denial contract end to end: - nous_billing: BillingRemoteSpendingRevoked (403 remote_spending_revoked → reconnect) + BillingSessionRevoked (401 session_revoked → re-login), distinct from insufficient_scope; capture actor/code/recovery; 503 stays transient. - gateway _serialize_billing_error threads the new typed kinds + actor/code/ recovery to the TUI. - TUI renderBillingError: actor-aware revoke copy, kills the spend overlay immediately (no 15-min zombie button), handles session_revoked, the dual- emitted cli_billing_disabled/remote_spending_disabled, role_required, idempotency_conflict; poll treats a mid-poll revoke as ambiguous (check balance before retry), not a failure. - CLI _billing_render_charge_error: same denial matrix, actor-aware copy. Tests: gate-contract mapping + envelope (py) and revoke/session/disabled (TUI). Per handoff 2026-06-24_remote-spending-TUI-contract-handoff.md. * refactor(subscription): remove dead step-up scaffolding from /subscription /subscription only opens a browser deep-link to manage-subscription — that needs no billing scope, so it can never hit insufficient_scope. Drop the never-fired 'stepup' screen type, requestRemoteSpending ctx fn, and resumeScreen bookkeeping (leftovers from a superseded plan). The resumable step-up lives on /topup, where the charge actually gets gated. * feat(tui/topup): resumable 'Allow Remote Spending' step-up on the charge path Phase 4: when a charge returns insufficient_scope, the /topup modal no longer tears down with a 'run /billing again' ConfirmReq. Instead it stays MOUNTED and switches to a step-up screen: - charge() is now awaitable, returning a discriminated outcome (submitted | needs_remote_spending | error) so the overlay can route without closing. - StepUpScreen: 'Allow Remote Spending' → await the device-flow grant (browser opens via the existing out-of-band billing.step_up.verification event) → replay the held charge (pendingCharge.amount) and settle, with no command re-run. Never surfaces the raw billing:manage scope. - armStepUp's fire-and-forget ConfirmReq replaced by requestRemoteSpending(); the leaky 'billing:manage' / 'Re-authorize' / 'run /billing again' copy is gone. Tests: charge-outcome routing, step-up grant/deny, and a render test asserting the step-up copy holds the amount and never leaks billing:manage. Per handoff 2026-06-24_remote-spending-TUI-contract-handoff.md §2 (Grady #6). * feat(billing): shared dollar usage model + two-bar view (drop "credits") Single source of truth for the /usage and /subscription usage bars across TUI + CLI. Reads the NAS account-info dollar fields (subscription/top-up/total remaining, monthly allowance, renewal) and produces a surface-agnostic model: two full-resolution bars (plan allowance + purchased top-up), a status classification (free | healthy | low | depleted), and a human renewal date. - agent/billing_usage.py: UsageModel/UsageBar, usage_model_from_account (fail-open), build_usage_model (HERMES_DEV_CREDITS_FIXTURE-aware), format_renews (ISO -> "Jul 24, 2026", Windows-safe), $5 low-balance threshold. - tui_gateway/server.py: _serialize_usage_model/_serialize_usage_bar, a usage.bars RPC, and the model embedded into subscription.state so the overlay renders the same bars from its single fetch. - Dollars only, never "credits"; two separate bars (not a crammed three-segment one) for legibility at terminal widths. - tests/agent/test_billing_usage.py: status classification, bar math (clamp/over-cap), NaN/Inf rejection, fail-open invariants. * feat(tui): dollar usage bars on /usage + /subscription, drop tier picker Render the shared two-bar dollar model in both overlays; strip "credits" and the in-terminal tier selection per UX feedback. - overlayPrimitives.tsx: UsageBars (themed plan/top-up bars — gold allowance, green top-up) + usageBarsText for the /usage panel. Plan name labels the bar; "$X left of $Y · N% used" (disambiguated so the % matches); top-up "never expires". - subscriptionOverlay.tsx: status line dedupes ($X left once; bar carries the breakdown), human renewal date, state-matched nudges (free upsell / <$5 low alert) with box-safe ASCII markers (! / >) instead of the width-unstable emoji that broke the border. Tier picker removed — overview shows usage + plan, then "Manage on portal" / "Close" (free users get "Start a subscription"). No "credits" anywhere. - session.ts: /usage renders the dollar bars + balance summary, falling back to the legacy credits lines only when the model is unavailable; CTA reworded. - gatewayTypes.ts: UsageModelData/UsageBarData wire types + usage on SessionUsageResponse/SubscriptionStateResponse. - Tests updated to the new contract (no "credits", "left of", dedup, markers). * feat(cli): mirror dollar usage bars on /usage + /subscription CLI parity with the TUI billing rework, from the same shared usage model. - _print_nous_credits_block (/usage) and _subscription_overview render the two-bar dollar view (plan name on the bar, "$X left of $Y · N% used", top-up "never expires", total spendable) instead of the credits-worded block. - Dollars only — dropped the tier catalog (no more "$N/mo (… credits)") and every user-facing "credits"; team copy says "shared balance". - Human renewal date via the shared format_renews; status line dedupes the "$X left"; free upsell + <$5 low alert with ASCII markers. - /subscription manage modal no longer dumps the raw manage-subscription URL in its detail — the [1] Open / [2] Copy link / [3] Cancel options carry it. Title is "Manage your subscription" (no in-terminal plan change). The raw URL stays only in the non-interactive / not-admin fallbacks, which have no menu. - /usage token-usage panel (model, tokens, cost, context) left untouched. * feat(billing): embed dollar usage model into billing.state for /topup The /topup overview renders the same two-bar dollar usage (plan + top-up) as /usage and /subscription. Embed the shared usage model into the billing.state RPC payload (mirrors subscription.state) so the overlay gets the bars from its single fetch, and add the `usage` field to BillingStateResponse. * feat(tui/topup): reorder overview + in-flight reauth with press-Enter resume Reworks the /topup overlay per the Jun 19 review and the no-preflight decision. Overview: - Balance leads in the title ("Top up · balance $X"); the shared two-bar dollar usage (plan + top-up) renders below. Dropped the old monthly-cap spend bar. - "Add funds" is the first action (was "Buy credits"); auto-reload / monthly limit / manage-on-portal follow. Dollars only — no "credits" anywhere. - No "Enable terminal billing" menu item and NO scope preflight: whether the terminal can charge is discovered reactively at pay time. (We deliberately do not read/refresh the OAuth token to gate UI.) Step-up (reached only on a charge's insufficient_scope 403): - New 4-phase flow that keeps the modal mounted: prompt (one-time-setup heads-up) → waiting (browser authorize) → granted (explicit "Press Enter to resume") → replay the held charge → settle. The press-Enter beat is the reassuring "you're back, finish your purchase" moment. - Renamed user copy "Allow Remote Spending" → "Enable terminal billing"; never leaks the raw billing:manage scope (guarded by the render test). - topup.ts error copy de-crufted to terminal-billing wording, emoji removed. Tests: step-up prompt copy, the no-raw-scope invariant, and new overview tests (balance-in-title, Add-funds-first, two-bar usage, no "credits"). * feat(cli/topup): mirror overview reorder + in-flight reauth resume CLI parity with the TUI /topup rehaul, from the same shared usage model. - _billing_overview: balance in the title, the two-bar dollar usage (plan name on the plan bar, top-up "never expires") in place of the old cap spend bar, "Add funds" first, dollars throughout — no "credits", no scope preflight. - _billing_handle_scope_required: now takes the held amount + idempotency key and runs the in-flight flow — "Enable terminal billing" → browser device-flow → re-check the org kill-switch → press-Enter to resume → replay the held charge (reusing the key so a double-submit collapses to one). Stops leaking the raw billing:manage scope. - Charge-error + buy/auto-reload copy de-crufted to terminal-billing/dollars. - Tests updated to the new overview + buy copy. * fix(billing): guard non-JSON 2xx responses in the billing HTTP client A 2xx response with a non-JSON body — e.g. a reverse-proxy / SPA fallback HTML page served when a billing route isn't actually mounted on a deployment — hit json.loads() on the success path of _request() and raised a raw json.JSONDecodeError. That escaped the typed-BillingError contract, so callers' `except BillingError` missed it and fell through to a generic fail-open that rendered as a misleading "not logged in" (observed when /api/billing/subscription was briefly unshipped on staging: 200 text/html, x-matched-path /[...notFound]). Now a non-JSON 2xx body raises a typed BillingError(error="endpoint_unavailable") so surfaces degrade gracefully ("could not load …") instead of crashing or mislabeling a valid session as logged-out. The 4xx/5xx path already guarded its .json(); this closes the same hole on the success path. Test: tests/hermes_cli/test_nous_billing_request.py — non-JSON 2xx → typed error (not JSONDecodeError, not BillingAuthError), empty body → {}, valid JSON parses. * feat(billing/dev): add HERMES_DEV_BILLING_FIXTURE for offline card/scope testing build_billing_state short-circuits to a fixture when HERMES_DEV_BILLING_FIXTURE is set (mirrors HERMES_DEV_CREDITS_FIXTURE for the usage model). States: nocard | card | card-autoreload | notadmin | billing-off | logged-out — so the card-on-file gate, admin role, and kill-switch paths are exercisable offline without a live portal. Env-var gated; returns None when unset (no prod leak). Adds 8 behavior tests asserting the card/admin/billing-on contract per state. * refactor(billing): fold /credits into /topup /credits is redundant now that /topup shows the dollar balance + portal handoff. Make 'credits' (and 'billing') aliases of /topup so typing /credits still works, resolving to topup everywhere (CLI, gateway, Slack, TUI, autocomplete, help). Remove the standalone /credits surface across 6 places: - CLI _show_credits handler + dispatch - gateway _handle_credits_command -> renamed _handle_topup_command, copy softened to 'Manage billing on the portal' (the messaging billing surface; /topup is now gateway-available so messaging keeps billing — credits was the only one before) - TUI commands/credits.ts + creditsCommand.test.ts (deleted), registry entry - tui_gateway credits.view RPC + the CreditsViewResponse type - Slack _SLACK_VIA_HERMES_ONLY: credits -> topup Sweep user-facing /credits -> /topup (usage-block hint, depletion notice) and stale doc-comments. OpenRouter's /credits endpoint URL left untouched. Tests updated (test_credits_folds_into_topup) or pruned for the removed symbols. * fix(billing): card-on-file heads-up, no-card portal gate, /usage bar ordering, modal glyph In-terminal charge (POST /charge against the org's server-held card, no card ref leaves the client): - card present: confirm screen shows 'Your card saved on the portal will be charged' + a 'Manage on portal' escape option (CLI); heads-up line (TUI) - no card on file: /topup overview + buy flow detect it and route to the portal to add a card, instead of offering a charge that 403s no_payment_method /usage bar ordering: route the dollar block through _cprint consistently. The Plan: line (_cprint) and the bar (raw print) flushed to different buffers under patch_stdout and interleaved nondeterministically; now Plan: -> bar -> status/CTA is stable across all states. Modal glyph: strip the leading emoji from bordered _prompt_text_input_modal titles — it measures 1 char but renders 2 columns, shifting the box's right border (the stray '|'). Includes the f-string 'Pay $X?' title. Small /credits -> /topup string bits in cli.py ride along with the surrounding charge edits (the fold lives in the sibling refactor commit). * refactor(billing): apply safe simplify-pass fixes Three low-risk cleanups from a parallel simplify review (reuse/quality/efficiency): - dev fixture portal URL: reuse the prod host (was drifted to staging-* — a real mismatch vs subscription_view's _DEV_FIXTURE_PORTAL) - TUI billingOverlay choose(): collapse two byte-identical branches (needsCard + the not-full else both = portal-or-close at index 0) into one tail; the only divergent path (full && !needsCard → buy/auto/limit) stays explicit - /topup overview comment: correct the stale 'buy_flow detects no_payment_method' note (the overview's no-card gate fires first, so reaching Add funds implies a card on file) Skipped (judgment): the orphaned CreditsView.depleted field (harmless, on a live dataclass), the defensive card gates in _billing_buy_flow/_confirm_and_charge (cheap correct defense on the money path), and folding the no-card handoff into a shared helper (touches 4 money-path sites for tidiness — not worth the risk here). * fix(billing): reactive charge gating — drop card preflight, react to 403 (scope→reauth, no-card→portal) * refactor(billing): drop the /credits alias entirely The /credits fold made it an alias of /topup; now remove that too. Typing /credits is an unknown command, not a silent redirect — billing lives only on /topup (with /billing kept as the old command's back-compat name). Dropped the alias from the registry CommandDef and the TUI topup.ts; updated the test to assert /credits resolves to nothing (no command, no alias). * docs(billing): fix stale comment in _billing_overview — describe reactive no-card path The comment still described the removed overview-level card gate ('no-card case handled above'). Corrected to: the buy flow reacts to the server's no_payment_method 403 and hands off to the portal at charge time (no preflight). * refactor(billing): simplify-pass — share usage-payload helper, drop dead bar wire fields + redundant admin gate * refactor(billing): drop the /billing alias too — /topup is the only billing command Following /credits removal, retire the old /billing name as well. /topup now has NO aliases — both /credits and /billing are unknown commands. Dropped the alias from the registry CommandDef and TUI topup.ts; fixed the one live user-facing straggler (the not-logged-in message said 'then /billing' → /topup) and the _show_billing docstring/default-arg references. Test asserts /topup carries no aliases and neither old name resolves. * fix(billing): code-review fixes — money-path + parity bugs Money path (TUI): - auto-reload "Turn off" now echoes current threshold/top_up_amount so the PATCH succeeds (was sending {enabled:false} → invalid_request → stayed ON) - charge poll honors the 5-min cap on the 429/503 throttle branch too (was rescheduling forever); cap folded into one timedOut() helper - step-up resume reacts to the replay outcome instead of unconditionally closing on a reassuring line with no charge made - synchronous submit guard on Confirm so two key events can't double-charge Gateway: - billing.step_up routes typed errors through _serialize_billing_error (was a raw {error:'error'} dict → generic copy for session_revoked) - billing.state / subscription.state / usage.bars / session.usage moved to _LONG_HANDLERS (blocking portal HTTP no longer stalls the main stdin loop) CLI: - _billing_render_charge_error handles insufficient_scope without leaking the raw billing:manage scope name on a post-grant replay re-raise Python model: - subscription_view tier parse None-coalesces tierOrder/dollarsPerMonth so a free tier's 0 survives ($0, not "—"; correct sort order) TUI parity/robustness: - /usage shows formatted renews_display, not raw ISO renews_at - subscription overview guards a null pending_downgrade_at (was "on null.") - subscription overview surfaces a message instead of silently closing when portal_url is missing - buildManageUrl wraps new URL() so a malformed portal_url can't throw out of the Ink key handler * fix(billing): cross-surface bar direction, formatted cancel/downgrade dates, Slack alias gating - CLI plan bar now fills by REMAINING (fuel-gauge), matching the shared model's fill_fraction, the top-up bar, and the TUI — same account renders identically on both surfaces (#8) - subscription serializer emits cancellation_effective_display / pending_downgrade_display (format_renews); TUI shows 'Jul 1, 2026' not raw ISO (#14b) - _SLACK_VIA_HERMES_ONLY now includes the 'billing' alias so it follows its canonical /topup via /hermes instead of leaking a native Slack slot (#9) * fix(billing): thread idempotency key through the TUI step-up replay (#2) Mint a stable idempotency key when the purchase amount is chosen; it rides pendingCharge into both the Confirm charge and the post-grant step-up replay, so a retried charge dedups server-side (the gateway already echoes the key). A fresh amount selection gets a fresh key. Combined with the sync submit guard, a double-submit now collapses to one charge. * refactor(billing): remove dead /subscription tier-picker scaffolding (#18) The in-terminal plan picker was cut (deep-link only), leaving a whole unreached state machine. Removed end-to-end: - TUI: ConfirmScreen, HandoffScreen, the 'confirm'/'handoff' screen types, pendingTargetTierId, and the now-dead onPatch threading (collapsed the dispatch to a single overview screen + folded the duplicate Box wrapper) - gateway: the tiers serialization + SubscriptionTierOption wire type - model: SubscriptionTier, _parse_tier, _coalesce, _dev_tiers and the tiers field (never displayed on either surface, so this supersedes the tier-parse fix) - tests: dropped the confirm/handoff/tier-passthrough tests; slimmed the overview render tests Net: a large dead-code cull (no behavior change — the picker never ran). * test(billing): parametrize usage-model tests; drop dead is_low/is_free props Collapse the fail-open + status-classification cases into parametrized tables (same coverage, ~80 fewer lines) and remove the now-unused UsageModel.is_low / is_free properties (only a test pinned them). * fix(billing): revert dead 'billing' Slack-via-hermes entry — the alias was dropped #9 was based on a stale review diff: /billing is no longer an alias of /topup (dropped earlier), so routing it via /hermes filtered a name that doesn't exist. * test(billing): cull redundant TUI billing tests (parametrize, merge dupes) usageCommand: collapse 3 CTA tests into one + a panel helper. billingStepUp: merge the two step-up render asserts. topupCommand: parametrize requestRemoteSpending + the revoked-actor pair, drop the redundant happy-path-submitted test. Money-path + error-mapping coverage preserved. * refactor(billing): extract _usage_bar_lines — one source of truth for the CLI bars The plan + top-up bar format was copy-pasted across _print_nous_credits_block, _subscription_overview, and _billing_overview. Extract a helper returning the ready-to-print lines; each caller keeps its own print fn (the _cprint-ordering constraint stays) and resolves its plan-name label. Centralizes the format so the three surfaces can't drift. * feat(billing): NAS V3 subscription-change HTTP client wrappers Add the four write-side wrappers for the V3 subscription contract to nous_billing, each a thin _request() call (reusing auth, JSON, 401-retry, typed errors): - post_subscription_preview → POST /subscription/preview (chargeless quote) - put_subscription_pending_change→ PUT /subscription/pending-change (downgrade/cancel) - delete_subscription_pending_change → DELETE .../pending-change (resume/undo) - post_subscription_upgrade → POST /subscription/upgrade (the money route) pending-change takes a discriminated body (tier_change | cancellation); upgrade requires an Idempotency-Key (mandatory, validated client-side before any I/O). Tests assert the exact method/path/body/header each wrapper puts on the wire. * feat(billing): subscription tier catalog + change-preview models Reinstate the catalog the in-terminal picker needs (was culled when /subscription was deep-link-only): SubscriptionTier + SubscriptionState.tiers + _parse_tier, with _coalesce so the free tier's 0 tierOrder/price survives a falsy-or. Parse the catalog from GET /subscription's tiers and seed _dev_tiers into every fixture. Add SubscriptionChangePreview + subscription_change_preview_from_payload for the POST /preview quote (effect/amountDueNowCents/effectiveAt/reason + tier delta); a malformed/missing effect fails safe to 'blocked' so a bad quote never reads as a charge. Module docstring updated: the overlay is no longer deep-link-only. * feat(billing): gateway RPCs for the V3 subscription change flow Add subscription.preview / .change / .resume / .upgrade RPCs, each wrapping its nous_billing call and reusing _serialize_billing_error for the typed envelope (so a 403 still drives the device step-up). upgrade mints + echoes the idempotency key and surfaces status + recovery_url so the TUI can route an SCA/decline to the portal. Re-add the tier catalog to _serialize_subscription_state (price pre-formatted) for the picker. All four are pool-routed (_LONG_HANDLERS) — preview + upgrade hit Stripe and must not stall the main stdin loop. * feat(billing): in-terminal subscription change flow (TUI) /subscription is no longer deep-link-only: it drives the change in-terminal against the V3 contract via the new gateway RPCs. The overlay is a state machine overview → picker → confirm → result: - picker lists the tier catalog with upgrade/downgrade hints (current + free excluded; free=cancel, on the overview); - confirm shows the previewed effect — pay $X now (upgrade) / scheduled at date (downgrade) / cancel at period end / blocked-with-reason — then applies it; - an upgrade's SCA/decline routes to the portal via the result screen's recovery link; resume/cancel/downgrade are chargeless. Starting a NEW subscription still deep-links (needs a fresh card). insufficient_scope points to /topup (the step-up stays there, not duplicated here). Adds the wire types (tiers + preview/upgrade responses), widens the overlay ctx + screen state, and threads onPatch. Render tests cover every screen. * feat(billing): in-terminal step-up + clearer scheduled-change UX (TUI) Two improvements to the /subscription overlay: Step-up re-auth in place. When a mutation (preview/change/upgrade/resume) returns insufficient_scope, route to a new 'stepup' screen that grants terminal billing via billing.step_up and AUTO-REPLAYS the held action on grant — no bounce to /topup. Scope routing is centralized in previewAndRoute/applyPendingAndRoute/ resumeAndRoute (shared by the picker, confirm, overview + the step-up replay). The browser opens via the shared global verification handler; copy never leaks the raw billing:manage scope. Make a scheduled change unmissable. A downgrade/cancel was one buried warn line that read as 'nothing happened'. Now the overview leads with a banner (⏳ Scheduled change · Ultra ──▶ Plus · <date> · you keep Ultra until then), the status line echoes the transition (Plan: Ultra → Plus), 'Keep <tier> (undo)' is promoted to the first olive action, the result screen says 'your plan doesn't change today', and confirm gets a charged-now / scheduled chip. * feat(billing): full in-terminal subscription change flow in the classic CLI Bring the CLI to parity with the TUI overlay — /subscription is no longer deep-link-only. A paid admin/owner gets picker → preview → confirm → apply, mirroring the /topup buy flow's modal idioms: - _subscription_change_menu (change / undo-or-cancel / manage-on-portal), - _subscription_pick_tier (catalog with upgrade/downgrade hints), - _subscription_preview_and_confirm (POST /preview → effect-aware confirm), - _subscription_apply (schedule / cancel / resume chargeless; upgrade charges the sub's card, SCA/decline → portal), - _subscription_handle_scope_required (insufficient_scope → step_up_nous_billing_scope inline, then replays the held preview/mutation — reusing the upgrade idempotency key). Also the scheduled-change UX fix: the overview leads with a prominent banner (⏳ Scheduled change · Super ──▶ Plus · <date> · you keep Super until then) and the status line echoes the transition, matching the TUI. Members / non-interactive / free still deep-link. Tests drive every branch via a mocked modal + nous_billing. * fix(billing): close TUI subscription money-path holes (ultracode review) - Un-consented charge (P1): the step-up now HOLDS at a 'granted' phase requiring an explicit Continue, and an abortedRef gates the grant's late .then — a cancel during the browser flow can no longer replay the held upgrade + charge. - Missing idempotency key (P2): mint it when building an upgrade 'pending' so it rides into confirm AND the step-up replay (was always undefined → gateway minted a fresh key per call, defeating dedup). - Navigate-away re-charge (P2): confirm 'back' is guarded by submittingRef while an apply is in flight. - Ambiguous charge (P2): a transport-null upgrade is reported as 'may or may not have charged — re-check', never a flat failure that invites a blind retry. - Typed step-up denial (P2): requestRemoteSpending returns {granted,error,message}; the screen maps session_revoked / remote_spending_revoked / rate_limited to the right recovery instead of always 'an admin must allow it'. * fix(billing): close CLI subscription money-path holes (ultracode review) - Bounded step-up (P2): bust the 30s token cache after a grant (it held the pre-grant unscoped token; _request only busts on 401, not 403) and replay ONCE with allow_stepup=False so a still-denied scope can't re-prompt/re-open in a loop. - Stray-keystroke charge (P3→near-P2): the upgrade confirm defaults to 'Go back', not 'Pay ' — a bare Enter can't move money. - Fail-open on unknown effect (P3→near-P2): an unrecognized preview effect now fails SAFE (portal hand-off) instead of scheduling a real PUT. - 'cancel' word collision (P3): the Close row uses value 'close' so typing 'cancel' can't hit it and falsely report 'Cancelled'. - blocked effect re-offers the portal; undo is promoted to the first row when a change is pending (TUI parity). * fix(billing): guard the step-up resume against double-fire (2nd ultracode pass, BUG A) The P1 fix split the auto-replay into a user-triggered resume() on the granted screen, where the default row is the charging action — but resume() had no re-entrancy guard, so a double-Enter fired two replays (the upgrade dedups on the shared key, but schedule/cancel/resume replays carry none → duplicate PUT/DELETEs). Mirror billingOverlay.resume(): flip to a 'resuming' phase + a resumingRef so it fires at most once, and block 'back' once resuming (no re-mount → no second submit). * fix(billing): CLI charge-route ambiguous-charge caveat (2nd ultracode pass, BUG B) The TUI hardened upgradeResult(null) but the CLI charging route did not: a transport/timeout/500 (or unknown 2xx status) on post_subscription_upgrade — after NAS may have already prorated + charged — printed a flat failure, and a manual re-run mints a FRESH idempotency key the server can't dedup → a real second charge. Now the charge route reports 'your card may or may not have been charged — re-run /subscription to check before trying again' and steers away from a blind retry (the CLI can't persist the key across a command re-run). Also thread allow_stepup through the preview→apply replay (BUG C.1) and route the requires_action/ payment_failed portal lines through _cprint for deterministic ordering. * fix(billing): cap the TUI step-up replay to avoid a resume-deadlock (final pass, R1) The round-2 resume guard ('resuming' phase + resumingRef) could deadlock: on a REPEAT insufficient_scope during the post-grant replay, the route helpers did onPatch({screen:'stepup'}) — a no-op since we're already mounted on stepup (no key → no remount) — leaving phase='resuming'/resumingRef=true frozen on 'Applying your change…'. Thread allowStepUp through previewAndRoute/applyPendingAndRoute/ resumeAndRoute; the resume() replay passes false, so a repeat scope denial surfaces a 'still isn't enabled' result instead (mirrors the CLI's allow_stepup=False cap). Also: applyPendingAndRoute(pending=null) now routes to overview, not a stranded Promise.resolve(). * fix(billing): narrow the CLI ambiguous-charge catch to indeterminate outcomes (final pass, R2) The round-2 fix caught EVERY non-scope BillingError as 'may or may not have been charged' — but typed pre-charge rejections (BillingRateLimited 429, BillingSessionRevoked 401, BillingRemoteSpendingRevoked 403, role_required/no_payment_method 4xx) never reached Stripe, so the ambiguity copy was wrong and dropped their real recovery hints. Now route those to _subscription_render_error, and reserve the ambiguous copy for genuinely indeterminate outcomes (network_error / endpoint_unavailable / status None / 5xx). Tests: rate-limit stays deterministic; a real transport failure stays ambiguous. * feat(billing): card visibility + guided add-card path in /topup and /subscription Consume the NAS card-resolver contract (card.resolvedVia + chargeability) across both surfaces, degrading cleanly on today's NAS (fields absent → prior behavior): - WHICH card: the payment lines render provenance — 'Visa ····4242 — the card on your subscription' (resolvedVia → label; unknown rung/older NAS → masked card + the old generic line). Link payment methods render the brand alone (last4 is empty — never 'Link ····'). - Presence at a glance: the /topup overview now shows 'Card: …' or 'No saved card on file' for the full-menu case, plus a warning when the resolver marks the card needs_repair (failing auto-reloads) on overview/buy/confirm. - Add-card path: with no card on file, 'Add funds' becomes a guided screen — open the portal billing page, then 'I've added it — check again' re-fetches billing state and continues straight into the purchase (also recovers a transient display miss). Cards are never entered in-terminal. - /subscription upgrade confirm names the exact card ('Visa ····4242 — the card on your subscription — will be charged'), best-effort via billing.state and only when the resolution rung matches what a subscription charge actually uses (subPin/customerDefault, mirroring Stripe's precedence); otherwise the generic line stands. Fail-soft: any lookup error keeps the generic line. - Gateway serializes display/resolved_via/needs_repair; TUI ctx gains refreshState (topup) + fetchCard (subscription); new offline fixtures card-sub / card-repair. Tests: TUI ctx mocks extended; CLI suites cover provenance + repair-warning render, the Link guard, the add-card path (continue-after-recheck + abandon), the sub-confirm card line, and keep the confirm-time lookup offline in tests. * feat(desktop): add desktop-local billing wire types * feat(desktop): billing gateway API client and refusal taxonomy * feat(desktop): register billing settings tab with skeleton view * feat(desktop): wire billing tab to live gateway reads with fail-open states * feat(desktop): buy-credits charge flow with settlement poller * fix(desktop): keep About last in settings nav, billing above it * feat(desktop): auto-refill editing and billing step-up verification flow * fix(desktop): clamp overdrawn subscription credits and pin USD symbol formatting * fix(desktop): move billing next to notifications in settings nav * feat(desktop): usage-bar state colors and dev fixture simulator * feat(desktop): wide usage bars with top-up bar and refresh affordance * fix(desktop): disable buy controls without a card, neutral tracks for bar-less usage rows * polish(desktop): usage-grid alignment, tabular numerals, legible tracks and danger states * polish(desktop): dithered empty and depleted usage-bar tracks per app bar idiom * fix(billing): consume server canChangePlan, preserve distinct refusal codes, drop dead chargeability - Parse canChangePlan verbatim from NAS payloads into BillingState and SubscriptionState; fall back to the legacy OWNER/ADMIN check only when the server omits the field (FINANCE_ADMIN stops being locked out where NAS authorizes it). Role model updated to the 5-role enum. - Add the autoReload.card union (canonical | distinct | none) end-to-end: parse + gateway serialization, distinct carries payment_method_id/brand/last4 with nullable display fields. - stripe_unavailable (503, transient) and upgrade_cap_exceeded (429, daily cap) now survive to the wire as their own codes instead of collapsing into rate_limited; new exception types subclass BillingRateLimited so existing backoff call sites keep working. - Remove card.chargeability / needs_repair parsing, serialization, fixtures and the cli warning blocks: NAS #670 removed the field, so the repair path was permanently dead. The future card-health signal belongs to the NAS W1/W3 work. - Tests: five-role fixtures, canChangePlan override/fallback, all three auto-reload card variants, 429-vs-503 code preservation end-to-end. * feat(tui): render the full NAS billing refusal surface - billingOverlay: divergence notice when auto-refill charges a distinct card (portal deep-link to reconcile); needs_repair warnings removed with the field. - topup: explicit copy for consent_required, org_access_denied, upgrade_cap_exceeded, auto_top_up_disabled_failures and stripe_unavailable (honors retry_after); processing_error is an explicit charge-failure case; transport loss during charge polling now reads as an unconfirmed outcome (check balance before retrying), matching the revocation path. - subscriptionOverlay: branch on upgrade reason, not status, so an SCA-needing upgrade routes to portal verification even while NAS pre-#711 labels it payment_failed; after an upgrade, poll subscription state until the tier flips (bounded), rendering applying/still-applying rather than assuming immediacy. - Capability-neutral refusal copy (owner, admin, or finance admin) replaces the stale org admin/owner wording. - gatewayTypes: BillingAutoReload.card union added, needs_repair removed. * refactor(shared): move terminal-billing wire types to @hermes/shared The billing/subscription wire shapes (plus UsageBarData/UsageModelData, which they reference) move verbatim from ui-tui/src/gatewayTypes.ts into apps/shared/src/billing-types.ts so the desktop app can share the same gateway contract. gatewayTypes.ts re-exports every moved name from the new @hermes/shared/billing subpath, so no ui-tui consumer changes. The subpath export keeps DOM-less ui-tui from pulling the barrel (whose WebSocket helpers need the DOM lib). ui-tui also now declares its @hermes/shared dependency explicitly instead of relying on workspace hoisting. * test(cli): pin nous_billing wire-layer status-to-exception mapping The HTTP layer's error handling had zero coverage through _request: only 2xx parsing and request shaping were tested, and the mapping cases in test_remote_spending_gate_contract.py hit _raise_for_error directly. Adds 19 tests driving _request via a monkeypatched urlopen: the 401-refresh-retry path (success, terminal plain/session_revoked, idempotency-key preservation, base re-resolution), 403 variants through the wire, 429/503 retry-after, non-JSON error bodies, 404/502 fallbacks, and URLError normalization. Two behaviors are pinned as findings rather than fixed: a JSON-body retryAfter hint is ignored unless the Retry-After header is present, and a bare socket.timeout propagates uncaught (real urllib wraps timeouts in URLError before this layer). * fix(tui_gateway): delete dead credits.view RPC The handler assigns into an undefined `usage` variable, so any call would raise NameError (the except swallows the first hit, then the return re-raises it uncaught). Nothing can reach it: the TUI command registry removed /credits (pinned by test_credits_command_fully_removed) and no client sends the RPC. The live credit view is agent/account_usage.py::build_credits_view via the remote gateway's /topup command, which is untouched. * fix(cli): normalize read-phase timeouts to the typed billing error urlopen wraps connect-phase timeouts in URLError (already mapped to network_error), but a timeout during resp.read() raises a bare TimeoutError that escaped the typed-BillingError contract and reached callers as an unhandled exception. Catch it narrowly and normalize. The boundary test now asserts normalization instead of documenting the leak. * fix(shared): stop typing mutation success payloads as error payloads BillingMutationResponse.payload was declared BillingErrorPayload, but on ok:true the gateway passes through the raw NAS success body (rail, changeType, cancelAtPeriodEnd, ...). The TUI never reads it so nothing broke, but the shared contract now feeds the desktop app too — widen the field deliberately and document both shapes. * feat(shared): typed billing refusal and charge-failure unions - BillingRefusalCode covers every code the gateway serializes today, with a (string & {}) arm so unknown future codes (the NAS W3 card-health family) stay assignable — consumers keep their unknown-code fallback. - ChargeFailureReason models the four NAS terminal reasons plus the raw subscription_payment_intent_requires_action code NAS leaks pre-#711. - billing.state now carries the server-derived can_change_plan the gateway emits; capability comments updated (canChangePlan is capability-based, not an OWNER/ADMIN role gate). * docs(billing): client-side billing state and refusal lifecycle table Enumerates, from the code, every billing.state shape and typed refusal the gateway serves and the exact TUI copy + recovery each renders. Acceptance from the billing-integration handoff: no NAS billing state or typed refusal falls through to a generic toast; unknown codes still degrade to the default branch that surfaces the server message. * refactor(desktop): consume @hermes/shared billing types, full refusal copy, divergence notice - billing/types.ts becomes a re-export shim over @hermes/shared/billing (keeps the desktop-only bounds field via a local BillingAutoReload extension); needs_repair is gone with the shared type. - resolveRefusal gains specific copy for consent_required, org_access_denied, upgrade_cap_exceeded, stripe_unavailable (transient, honors retry_after) and processing_error; BillingErrorKind now IS the shared BillingRefusalCode. Default fallback unchanged. - Auto-refill row surfaces the distinct-card divergence: caption naming the charging card (or 'a different card' when brand/last4 are null) and a Reconcile portal deep-link instead of the inline edit form. - Fixtures/tests updated for the required auto_reload.card union; new auto-refill-divergent dev fixture. * fix(desktop): auto-refill-divergent fixture must be enabled to exercise the divergence row * refactor(billing): explicit BillingTransient trait, drop broken credits.view, public token-cache invalidation - BillingRateLimited / BillingStripeUnavailable / BillingUpgradeCapExceeded become siblings under a new BillingTransient trait (deterministic non-charge outcome, safe to retry) instead of the false is-a chain that made a Stripe outage 'a kind of rate limiting'. Catch sites that meant 'any deterministic pre-charge transient' now say so explicitly; the gateway serializer dispatches on the trait and emits the preserved raw code. - Delete the credits.view RPC handler left broken by the /topup rename (its body referenced an undefined variable; no caller remains). - invalidate_cached_token() replaces the CLI's reach into the private _token_cache global after a billing step-up. * refactor(cli): extract CLIBillingMixin; charge gates follow the server capability - Move the ~1,400-line billing/subscription handler family out of cli.py into hermes_cli/cli_billing_mixin.py, following the existing HermesCLI mixin pattern (lazy cli imports, verbatim bodies). - can_charge and the CLI billing-action gates now route through can_change_plan (server capability with legacy role fallback) instead of the deprecated 3-role is_admin — a FINANCE_ADMIN the server authorizes can now add funds, matching the plan-change path. - Render the spend bar from the UsageBar model's fill_fraction instead of the deleted _billing_spend_bar re-derivation; fix a stale docstring. * refactor(tui): promote useMenu to overlay primitives, type pendingTierId end-to-end - useMenu (arrow/number/Enter/Esc menu hook) moves to overlayPrimitives with an onKey escape hatch; billingOverlay's Overview and Limit screens drop their verbatim copies. BuyScreen keeps its bespoke handler (typing mode + stale-selection clamp don't fit the shared contract cleanly). - SubscriptionResult carries pendingTierId directly; the shadow SubscriptionResultWithPending interface and the ResultScreen cast are gone, so the apply-poll field is type-tracked through finish(). * docs(billing): correct the CLI-parity row — the CLI has the full in-terminal change flow * refactor(shared): move terminal-billing wire types to @hermes/shared The billing/subscription wire shapes (plus UsageBarData/UsageModelData, which they reference) move verbatim from ui-tui/src/gatewayTypes.ts into apps/shared/src/billing-types.ts so the desktop app can share the same gateway contract. gatewayTypes.ts re-exports every moved name from the new @hermes/shared/billing subpath, so no ui-tui consumer changes. The subpath export keeps DOM-less ui-tui from pulling the barrel (whose WebSocket helpers need the DOM lib). ui-tui also now declares its @hermes/shared dependency explicitly instead of relying on workspace hoisting. * test(cli): pin nous_billing wire-layer status-to-exception mapping The HTTP layer's error handling had zero coverage through _request: only 2xx parsing and request shaping were tested, and the mapping cases in test_remote_spending_gate_contract.py hit _raise_for_error directly. Adds 19 tests driving _request via a monkeypatched urlopen: the 401-refresh-retry path (success, terminal plain/session_revoked, idempotency-key preservation, base re-resolution), 403 variants through the wire, 429/503 retry-after, non-JSON error bodies, 404/502 fallbacks, and URLError normalization. Two behaviors are pinned as findings rather than fixed: a JSON-body retryAfter hint is ignored unless the Retry-After header is present, and a bare socket.timeout propagates uncaught (real urllib wraps timeouts in URLError before this layer). * fix(cli): normalize read-phase timeouts to the typed billing error urlopen wraps connect-phase timeouts in URLError (already mapped to network_error), but a timeout during resp.read() raises a bare TimeoutError that escaped the typed-BillingError contract and reached callers as an unhandled exception. Catch it narrowly and normalize. The boundary test now asserts normalization instead of documenting the leak. * fix(shared): stop typing mutation success payloads as error payloads BillingMutationResponse.payload was declared BillingErrorPayload, but on ok:true the gateway passes through the raw NAS success body (rail, changeType, cancelAtPeriodEnd, ...). The TUI never reads it so nothing broke, but the shared contract now feeds the desktop app too — widen the field deliberately and document both shapes. * feat(shared): typed billing refusal and charge-failure unions - BillingRefusalCode covers every code the gateway serializes today, with a (string & {}) arm so unknown future codes (the NAS W3 card-health family) stay assignable — consumers keep their unknown-code fallback. - ChargeFailureReason models the four NAS terminal reasons plus the raw subscription_payment_intent_requires_action code NAS leaks pre-#711. - billing.state now carries the server-derived can_change_plan the gateway emits; capability comments updated (canChangePlan is capability-based, not an OWNER/ADMIN role gate). * feat(shared): closed Known* halves for the refusal and charge-failure unions - KnownBillingRefusalCode / KnownChargeFailureReason are closed literal sets, so classification tables, copy maps and tests can be Record-exhaustive and break at compile time when a code is added but not mapped. The wire types keep the (string & {}) open arm for unknown future codes. - Add network_error (client-originated transport code the gateway already serializes) to the known set. - Export the union types from the root barrel alongside the other billing names. * feat(shared): canonical billing refusal policy and charge-settlement driver - billing-policy.ts: one exhaustive Record<KnownBillingRefusalCode, BillingRefusalPolicy> classifying every known code (recovery kind, mid-poll ambiguity, idempotency-key reuse) with a documented unknown-code fallback. Surfaces keep their own copy; the behavior classification now has a single home that breaks the build when a new code goes unmapped. - charge-settlement.ts: the settlement poll state machine (2s cadence, 5-minute cap, bounded retry-after backoff, ambiguous-on-revocation) as a pure dependency-injected driver returning a discriminated outcome. - The TUI's pollCharge becomes a thin renderer over the shared driver — byte-identical output, and the desktop poller can now share the same machine instead of a drifting copy. * fix(desktop): real auto-reload bounds, shared refusal policy and settlement driver - Delete the phantom BillingAutoReload.bounds plumbing: nothing ever populated it, so the auto-reload amount validation it fed was silently dead. The editor and validators now enforce the gateway's real top-level min_usd/max_usd (new test pins the $10 minimum actually rejecting), and types.ts collapses to a plain re-export shim over @hermes/shared/billing. - Delete the test-only BillingRpcResponse envelope family; BillingResult is the one response model. - Refusal copy speaks desktop: reconnect/sign-in route to Settings → Gateway instead of the TUI's /portal command; the dead processing_error refusal case is gone (it is a charge-failure reason, already rendered by the poller). - Adopt @hermes/shared billing-policy + charge-settlement: the poll loop is the shared driver, revocation-ambiguity comes from the policy table (insufficient_scope mid-poll now counts, per the ruling), and all policy-retry codes back off during polling instead of failing hard. errors.test.ts is Record-exhaustive over KnownBillingRefusalCode again. * refactor(shared): move terminal-billing wire types to @hermes/shared The billing/subscription wire shapes (plus UsageBarData/UsageModelData, which they reference) move verbatim from ui-tui/src/gatewayTypes.ts into apps/shared/src/billing-types.ts so the desktop app can share the same gateway contract. gatewayTypes.ts re-exports every moved name from the new @hermes/shared/billing subpath, so no ui-tui consumer changes. The subpath export keeps DOM-less ui-tui from pulling the barrel (whose WebSocket helpers need the DOM lib). ui-tui also now declares its @hermes/shared dependency explicitly instead of relying on workspace hoisting. * test(cli): pin nous_billing wire-layer status-to-exception mapping The HTTP layer's error handling had zero coverage through _request: only 2xx parsing and request shaping were tested, and the mapping cases in test_remote_spending_gate_contract.py hit _raise_for_error directly. Adds 19 tests driving _request via a monkeypatched urlopen: the 401-refresh-retry path (success, terminal plain/session_revoked, idempotency-key preservation, base re-resolution), 403 variants through the wire, 429/503 retry-after, non-JSON error bodies, 404/502 fallbacks, and URLError normalization. Two behaviors are pinned as findings rather than fixed: a JSON-body retryAfter hint is ignored unless the Retry-After header is present, and a bare socket.timeout propagates uncaught (real urllib wraps timeouts in URLError before this layer). * fix(cli): normalize read-phase timeouts to the typed billing error urlopen wraps connect-phase timeouts in URLError (already mapped to network_error), but a timeout during resp.read() raises a bare TimeoutError that escaped the typed-BillingError contract and reached callers as an unhandled exception. Catch it narrowly and normalize. The boundary test now asserts normalization instead of documenting the leak. * fix(shared): stop typing mutation success payloads as error payloads BillingMutationResponse.payload was declared BillingErrorPayload, but on ok:true the gateway passes through the raw NAS success body (rail, changeType, cancelAtPeriodEnd, ...). The TUI never reads it so nothing broke, but the shared contract now feeds the desktop app too — widen the field deliberately and document both shapes. * feat(shared): typed billing refusal and charge-failure unions - BillingRefusalCode covers every code the gateway serializes today, with a (string & {}) arm so unknown future codes (the NAS W3 card-health family) stay assignable — consumers keep their unknown-code fallback. - ChargeFailureReason models the four NAS terminal reasons plus the raw subscription_payment_intent_requires_action code NAS leaks pre-#711. - billing.state now carries the server-derived can_change_plan the gateway emits; capability comments updated (canChangePlan is capability-based, not an OWNER/ADMIN role gate). * feat(shared): closed Known* halves for the refusal and charge-failure unions - KnownBillingRefusalCode / KnownChargeFailureReason are closed literal sets, so classification tables, copy maps and tests can be Record-exhaustive and break at compile time when a code is added but not mapped. The wire types keep the (string & {}) open arm for unknown future codes. - Add network_error (client-originated transport code the gateway already serializes) to the known set. - Export the union types from the root barrel alongside the other billing names. * feat(shared): canonical billing refusal policy and charge-settlement driver - billing-policy.ts: one exhaustive Record<KnownBillingRefusalCode, BillingRefusalPolicy> classifying every known code (recovery kind, mid-poll ambiguity, idempotency-key reuse) with a documented unknown-code fallback. Surfaces keep their own copy; the behavior classification now has a single home that breaks the build when a new code goes unmapped. - charge-settlement.ts: the settlement poll state machine (2s cadence, 5-minute cap, bounded retry-after backoff, ambiguous-on-revocation) as a pure dependency-injected driver returning a discriminated outcome. - The TUI's pollCharge becomes a thin renderer over the shared driver — byte-identical output, and the desktop poller can now share the same machine instead of a drifting copy. * refactor(shared): move terminal-billing wire types to @hermes/shared The billing/subscription wire shapes (plus UsageBarData/UsageModelData, which they reference) move verbatim from ui-tui/src/gatewayTypes.ts into apps/shared/src/billing-types.ts so the desktop app can share the same gateway contract. gatewayTypes.ts re-exports every moved name from the new @hermes/shared/billing subpath, so no ui-tui consumer changes. The subpath export keeps DOM-less ui-tui from pulling the barrel (whose WebSocket helpers need the DOM lib). ui-tui also now declares its @hermes/shared dependency explicitly instead of relying on workspace hoisting. * test(cli): pin nous_billing wire-layer status-to-exception mapping The HTTP layer's error handling had zero coverage through _request: only 2xx parsing and request shaping were tested, and the mapping cases in test_remote_spending_gate_contract.py hit _raise_for_error directly. Adds 19 tests driving _request via a monkeypatched urlopen: the 401-refresh-retry path (success, terminal plain/session_revoked, idempotency-key preservation, base re-resolution), 403 variants through the wire, 429/503 retry-after, non-JSON error bodies, 404/502 fallbacks, and URLError normalization. Two behaviors are pinned as findings rather than fixed: a JSON-body retryAfter hint is ignored unless the Retry-After header is present, and a bare socket.timeout propagates uncaught (real urllib wraps timeouts in URLError before this layer). * fix(cli): normalize read-phase timeouts to the typed billing error urlopen wraps connect-phase timeouts in URLError (already mapped to network_error), but a timeout during resp.read() raises a bare TimeoutError that escaped the typed-BillingError contract and reached callers as an unhandled exception. Catch it narrowly and normalize. The boundary test now asserts normalization instead of documenting the leak. * fix(shared): stop typing mutation success payloads as error payloads BillingMutationResponse.payload was declared BillingErrorPayload, but on ok:true the gateway passes through the raw NAS success body (rail, changeType, cancelAtPeriodEnd, ...). The TUI never reads it so nothing broke, but the shared contract now feeds the desktop app too — widen the field deliberately and document both shapes. * feat(shared): typed billing refusal and charge-failure unions - BillingRefusalCode covers every code the gateway serializes today, with a (string & {}) arm so unknown future codes (the NAS W3 card-health family) stay assignable — consumers keep their unknown-code fallback. - ChargeFailureReason models the four NAS terminal reasons plus the raw subscription_payment_intent_requires_action code NAS leaks pre-#711. - billing.state now carries the server-derived can_change_plan the gateway emits; capability comments updated (canChangePlan is capability-based, not an OWNER/ADMIN role gate). * feat(shared): closed Known* halves for the refusal and charge-failure unions - KnownBillingRefusalCode / KnownChargeFailureReason are closed literal sets, so classification tables, copy maps and tests can be Record-exhaustive and break at compile time when a code is added but not mapped. The wire types keep the (string & {}) open arm for unknown future codes. - Add network_error (client-originated transport code the gateway already serializes) to the known set. - Export the union types from the root barrel alongside the other billing names. * feat(shared): canonical billing refusal policy and charge-settlement driver - billing-policy.ts: one exhaustive Record<KnownBillingRefusalCode, BillingRefusalPolicy> classifying every known code (recovery kind, mid-poll ambiguity, idempotency-key reuse) with a documented unknown-code fallback. Surfaces keep their own copy; the behavior classification now has a single home that breaks the build when a new code goes unmapped. - charge-settlement.ts: the settlement poll state machine (2s cadence, 5-minute cap, bounded retry-after backoff, ambiguous-on-revocation) as a pure dependency-injected driver returning a discriminated outcome. - The TUI's pollCharge becomes a thin renderer over the shared driver — byte-identical output, and the desktop poller can now share the same machine instead of a drifting copy. * chore: retrigger CI with the current base SHA (stale base pin flagged a false CI-sensitive change) * refactor(shared): move terminal-billing wire types to @hermes/shared The billing/subscription wire shapes (plus UsageBarData/UsageModelData, which they reference) move verbatim from ui-tui/src/gatewayTypes.ts into apps/shared/src/billing-types.ts so the desktop app can share the same gateway contract. gatewayTypes.ts re-exports every moved name from the new @hermes/shared/billing subpath, so no ui-tui consumer changes. The subpath export keeps DOM-less ui-tui from pulling the barrel (whose WebSocket helpers need the DOM lib). ui-tui also now declares its @hermes/shared dependency explicitly instead of relying on workspace hoisting. * test(cli): pin nous_billing wire-layer status-to-exception mapping The HTTP layer's error handling had zero coverage through _request: only 2xx parsing and request shaping were tested, and the mapping cases in test_remote_spending_gate_contract.py hit _raise_for_error directly. Adds 19 tests driving _request via a monkeypatched urlopen: the 401-refresh-retry path (success, terminal plain/session_revoked, idempotency-key preservation, base re-resolution), 403 variants through the wire, 429/503 retry-after, non-JSON error bodies, 404/502 fallbacks, and URLError normalization. Two behaviors are pinned as findings rather than fixed: a JSON-body retryAfter hint is ignored unless the Retry-After header is present, and a bare socket.timeout propagates uncaught (real urllib wraps timeouts in URLError before this layer). * fix(cli): normalize read-phase timeouts to the typed billing error urlopen wraps connect-phase timeouts in URLError (already mapped to network_error), but a timeout during resp.read() raises a bare TimeoutError that escaped the typed-BillingError contract and reached callers as an unhandled exception. Catch it narrowly and normalize. The boundary test now asserts normalization instead of documenting the leak. * …

…(patch NousResearch#18) Live HERMES_TURN_TRACE_SYS_TAIL captures showed the composed system prompt re-keying the provider prompt cache nearly every gateway turn (0.1% cache_read on the codex/xai routes). Three sources, all fixed here: 1. Ephemeral session-context churn. The "## Current Session Context" block was re-rendered from live platform state every message: Discord auto-thread rename moved the Source line AND the origin delivery line, voice-channel member/speaking state serialized differently each turn, and the auto-reset note / first-contact intro guaranteed a turn1→turn2 diff. Fix: pin the rendered bytes per session, keyed by _ephemeral_change_key() — a sha256 over the exact renderer inputs (platform, chat/thread ids, chat_name, topic, user_name, shared-multi-user flag, discord ids + tools gate + message-id PRESENCE, connected platforms, home channels, redact_pii, hermes-home display). Key hit → pinned bytes verbatim; key miss → one re-render + re-pin (the only legitimate busts: rename incl. the one-shot auto-thread self-rename at turn 2, topic edit, /sethome, config/redact_pii change, toolset flip). Pin evicted alongside _evict_cached_agent. 2. Per-turn must-deliver facts relocated onto the current user message (patch-NousResearch#17 api_content sidecar => persisted byte-exact, replayed verbatim): auto-reset note, first-contact intro / profile-build directive, and voice-channel state as "[Voice channel now: ...]" — injected ONLY when different from the previous turn's value (per-session last-value cache; leave renders a "not connected" note once). The system prompt carries a static pointer line instead. Multimodal (list) content can't take the string sidecar — the notes are appended as a durable text part (agent/turn_context.py fallback) rather than silently dropped. 3. Runtime/Route block freeze (agent/system_prompt.py): - build_runtime_route_block cached on the agent as (key_tuple, text), key_tuple = (provider, model, api_mode, base_url, model_source, reasoning, reasoning_source); per-API-call recompute is a tuple compare, mid-turn fallback/model_switch still re-renders (legit). - reasoning_source= is ALWAYS emitted (default "default") — the presence-toggling suffix shifted every following byte. - DesiredRoute is permanently the static UNCLASSIFIED line. Routed directives render as "[Routing directive: label=... target=... ...]" via format_routing_directive() and ride the triggering turn's user message only (one-shot consume in run_sync). Policy paragraph updated once (static wording) to say directives arrive on the current user message and are authoritative for that turn. Reasoning VALUE flip (live evidence item: 'reasoning=max reasoning_source=agent' vs 'reasoning=unknown' in the same session): root cause was twofold. (a) _apply_gateway_runtime_override persisted only the MODEL half of a router override (include_model=True) — the reasoning half lived in the in-memory _session_reasoning_overrides only, so a gateway restart rehydrated the routed model but resolved reasoning=None: the same effective route rendered reasoning=max before the restart and reasoning=unknown after it. Now the reasoning override is persisted too (include_reasoning=True) and rehydrates via the existing SessionEntry.runtime_reasoning_effort path. (b) get_runtime_state derives the rendered source from agent._runtime_reasoning_source, which a mid-turn model_switch leaves stale on the CACHED agent while a rebuilt agent has none — same effective config, different bytes depending on reuse vs rebuild. The gateway now clears the attribution at the turn boundary right after the per-turn agent.reasoning_config assignment, making the rendered value a pure function of the effective config (dict → "agent", None → "default"). Session-key hygiene: session keys are source-derived and reused by the next conversation, so session finalization also drops any staged-but-never-consumed sidecar note (a turn aborted between staging and run_sync must not deliver a stale note on a future session's first message); the pin and VC last-value caches ride _evict_cached_agent (covers /reset, /new, auto-reset, expiry, cap eviction). Eviction guard (gateway/run.py _apply_gateway_runtime_override): compute the effective delta over (model, provider, base_url[, api_mode]) — when the router re-selects the already-active route, skip _evict_cached_agent and the "X -> X" switch note; the routing directive is still staged for user-message delivery. Reasoning-only overrides never evict (reasoning is excluded from the agent-cache signature and re-applied per turn). gateway/config.py get_connected_platforms() returns a sorted list so the "Connected Platforms" line and derived home-channel blocks are byte-stable across restarts and mid-process platform registration. No transport changes: pck_sha256(instructions+tools) (codex transport), the xAI extra_body prompt_cache_key, and the Anthropic/Qwen whole-system breakpoints stabilize automatically once the composed bytes are stable. The 4KB-chunk fingerprint / --cache-diff tooling is untouched and used as the acceptance instrument (see tests). DesiredRoute consumers: grepped plugins/, skills/, optional-skills/, optional-mcps/ for 'DesiredRoute' (and 'Runtime/Route State' / 'CurrentRuntime' / runtime_route parsers) — zero consumers parse it from the system prompt; no plugin changes needed. Tests: tests/gateway/test_prompt_tail_freeze.py (key↔render parity mutations incl. redact_pii/discord-tools-gate flips and the message-id-value no-bust case; pin verbatim reuse; auto-thread rename = exactly one bust at turn 2 then sha256-equal + zero changed 4KB chunks via turn_trace.prefix_fingerprint; pck constancy; routed turn does not move composed bytes; runtime-block tuple cache; reasoning_source always present; eviction guard same-route/new-model/reasoning-only; VC only-when-changed matrix; sidecar staging one-shot; connected-platforms order; CLI composition regression) + tests/agent/test_gateway_turn_sidecar.py (one-shot consume; string content → api_content sidecar carries the note, stored content stays clean; ordering after plugin context; multimodal list-append fallback). Existing tests/agent/test_runtime_route_prompt.py updated to the static-DesiredRoute + format_routing_directive contract. Known behavior deltas (intended): one-time static byte changes to the Runtime/Route Policy wording and the Discord voice-channel pointer line; routed turns no longer rebuild the agent when the route is unchanged; sidecar notes are not delivered on codex_app_server turns (that path bypasses the api_messages build — same existing limitation as memory/ plugin injections). Test evidence: new suites green (37 tests) plus tests/agent/test_api_content_sidecar.py, tests/agent/test_turn_trace.py, tests/agent/test_turn_context.py, tests/agent/test_runtime_route_prompt.py, tests/gateway/test_session.py, test_pii_redaction.py, test_config.py, test_pre_gateway_dispatch.py, test_session_model_override_routing.py, test_session_model_reset.py, test_platform_connected_checkers.py, tests/hermes_cli (get_connected_platforms consumers), tests/cron, tests/run_agent — all green. Full tests/agent + tests/gateway compared against a clean-HEAD baseline run: zero failures unique to this diff (shared failures are pre-existing environment noise; gateway suite is 9 failures BETTER than baseline). Origin: local-author Upstream-PR: none Patch-State: local-only Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Partial response to the FAIL-HOLD. Eight of twenty findings; the rest are named in the reply, not silently dropped. **NousResearch#9, and a second defect it exposed.** The review is right and it was my error: `App.tsx` added a `<main>` around a `PageHeaderProvider` that already rendered one, and my test audited a hand-written stand-in shell rather than the real one — the exact fixture failure this project keeps hitting, committed by me while criticising it. The landmark now lives where it always lived, and `ThreePane`/`VaultPage` render labelled sections instead of competing landmarks. Rendering the *real* provider then immediately found more: eleven components shipped their own `h1` under a provider that already had one, so every one of those routes announced two page titles. All demoted to `h2`. **NousResearch#18.** The `/api/ws` exclusion was wrong for the reason given — ASGI HTTP middleware never sees a WebSocket scope, so it protected nothing about the upgrade and only stripped headers from the 404s and auth rejections under that prefix. Removed, with a `websocket_connect` regression proving the upgrade still completes or closes deliberately. **NousResearch#4.** Claims carry an attempt token and every write compare-and-swaps on it. The adversarial sequence the review demonstrated — A claims, A expires, B claims, stale A settles B's row — is now a test, and A's settle returns False. Losers receive no token at all, so they cannot write anything. **NousResearch#3.** A provider exception is no longer `failed`. Gmail accepting a message and then dropping the response is indistinguishable from never receiving it, so the outcome is `ambiguous`: blocked, not retryable, and never unblocked by elapsed time — time is not evidence about an external system. Compose failures stay `failed` because they provably precede dispatch. Messages carry a deterministic broker-controlled RFC Message-ID so reconciliation is a lookup rather than a content comparison. Three of my own tests asserted the old behaviour; they were asserting the duplicate-mail bug and are rewritten. **NousResearch#7.** Reversal owner tokens fence every terminal write, and reconciliation clears the owner — without that a worker declared abandoned could return and match its own token. An inverse exception is now `reversal_unknown` rather than `done`: `apply` runs outside the journal transaction, so a half-applied inverse raises exactly as a never-started one does, and calling it retryable invited a second inverse over a partial first. **NousResearch#5.** Subjects are out of durable audit rows, and provider diagnostics are reduced to type plus a bounded excerpt — a mail API's error text frequently quotes the recipients and subject back. **NousResearch#8, honestly.** The shared open path adds an explicit `busy_timeout`, bounded retry around the journal-mode switch, and `BEGIN IMMEDIATE` for migration. But **I could not reproduce the reported failure**: 360 concurrent constructions per store, zero `database is locked`, on the old path as well as the new. The tests are a regression guard, not proof the fix works, and the test file says so. The claim belongs to whoever can reproduce the original numbers. **NousResearch#19 partial.** Evidence will be rebound to the final candidate once the remaining findings are answered; rebinding it now would date it again. Gates: typecheck 0, eslint 0, 74 files / 695 frontend tests; candidate backend 249 passed; named backend gate 142 passed, 0 failed. Not merged to main: the review is a FAIL-HOLD and the remaining findings — tier enforcement, registry dispatch bypass, undo wiring, native resume, New Chat, free-form clarify, approval acknowledgement, reconnect, sensor delivery — are not addressed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Nu2Qaq5Y7EScuooGz8co34

…ish tool) (NousResearch#18) The HermesNative news feed shipped with only its reader side: feed.get / feed.sources (server.py) read from digest_store, but nothing ever called digest_store.append_digest — it had zero callers repo-wide, across all history. The producer commit was dropped in a squash/rebase, so the feed was permanently empty and looked like the "news endpoints" were removed. Restore the write path: - server.py: add the feed.publish RPC (symmetric with feed.get/feed.sources), validating source/articles and delegating to append_digest. - tools/feed_tool.py: new agent-facing `feed_publish` tool (toolset "feed", auto-discovered) so the agent/cron can populate the feed; tolerates JSON-string articles some models emit. - toolsets.py: register the "feed" toolset. - cron/blueprint_catalog.py: the news-digest blueprint now publishes results via feed_publish (feeding the app's feed) in addition to messaging them. Add tests/tui_gateway/test_feed_store.py: asserts the producer -> reader round-trip (append_digest -> get_feed/get_sources), dedup, source filter + pagination, the feed_publish tool (incl. bad-input + JSON-string coercion), and that the tool self-registers under the "feed" toolset — so a future squash can't silently drop the writer again. Verified: new tests 8/8; ruff check . clean; check-windows-footguns clean; feed_publish loads via the real discover_builtin_tools startup path. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

…t nothing Same user, same day, second blocked read. 2026-08-04 chat b40ab6f1: a 245-line judgment (a 64 KB .docx) attached to an elaborate "exhaustive structured executive summary" prompt. Extraction rendered 102,688 characters against a 100,000 budget -- 2.7% over -- and read_file answered only: "Read produced 102,688 characters which exceeds the safety limit (100,000 chars). Use offset and limit to read a smaller range." The transcript shows exactly one read_file call. The model received that, and the turn ended. No second call with an offset was ever made and the user got no answer at all. The error was correct and useless. The budget is what may enter context, and content cut to exactly that budget is within it by construction -- so refusing to return anything buys nothing and costs the whole turn. Both oversize sites (extracted documents and plain text) now truncate at a line boundary and return content, truncated=true, truncated_reason="char_limit", next_offset, and a hint naming the exact offset to resume at plus "Do not claim full coverage of this document until you have." soc-v2 already works this way -- a docx with untranslated paragraphs beats no docx (kg NousResearch#18-era, flow-2851-20.pdf). read_file did not. Line accounting uses splitlines(), not count("\n")+1: with a trailing newline the latter claims one line more than exists, and next_offset is derived from it, so the model would silently skip a line of the user's judgment. Tests: new tests/tools/test_read_oversize_document.py drives the EXTRACTED document path end-to-end through a real .docx and file_grant_scope -- that is the path this user hit, and the plain-text guard test does not reach it. One test resumes at next_offset and asserts the line numbers are consecutive across the seam: no gap, no repeat. Both existing guard tests were rewritten to the new contract rather than deleted. Mutation-verified at both sites: blanking the content, off-by-one on next_offset, and dropping the resume hint each turn a test red. 117 pass across the six read-related suites.

…updates (NousResearch#18) Bumps the npm_and_yarn group with 1 update in the /scripts/whatsapp-bridge directory: [ws](https://github.com/websockets/ws). Bumps the npm_and_yarn group with 3 updates in the /ui-tui directory: [ws](https://github.com/websockets/ws), [js-yaml](https://github.com/nodeca/js-yaml) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Bumps the npm_and_yarn group with 1 update in the /ui-tui/packages/hermes-ink directory: [ws](https://github.com/websockets/ws). Bumps the npm_and_yarn group with 1 update in the /web directory: [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 1 update in the /website directory: [dompurify](https://github.com/cure53/DOMPurify). Updates `ws` from 8.20.1 to 8.21.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.20.1...8.21.0) Updates `ws` from 8.20.1 to 8.21.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.20.1...8.21.0) Updates `js-yaml` from 4.1.1 to 4.2.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/commits) Updates `vite` from 8.0.8 to 8.0.16 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite) Updates `ws` from 8.20.1 to 8.21.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.20.1...8.21.0) Updates `js-yaml` from 4.1.1 to 4.2.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/commits) Updates `dompurify` from 3.4.8 to 3.4.10 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.8...3.4.10) --- updated-dependencies: - dependency-name: ws dependency-version: 8.21.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.2.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.0.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.2.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.10 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

teknium added 3 commits February 7, 2026 21:11

Update pyproject.toml to refine dependency management

c0494b3

- Reorganized the 'all' dependencies to include specific optional groups for better modularity. - Added support for 'hermes-agent' with distinct categories: modal, messaging, cron, cli, and dev.

Increase max_token_length in TerminalTestEnv to 16000 for enhanced pr…

a478e44

…ocessing capacity

teknium1 merged commit 578a5fb into main Feb 8, 2026

SHL0MS mentioned this pull request Mar 30, 2026

[UX][Critical] No response streaming — entire response displayed at once after generation completes #4070

Closed

h4x3rotab pushed a commit to Clawdi-AI/hermes-agent that referenced this pull request Apr 10, 2026

Merge pull request NousResearch#18 from outsourc-e/production

d6f2a85

fix: map attachment fields to gateway-expected format

alt-glitch added type/feature New feature or request comp/cli CLI entry point, hermes_cli/, setup wizard area/config Config system, migrations, profiles labels Apr 21, 2026

angelburgosrosado pushed a commit to angelburgosrosado/hermes-agent that referenced this pull request Apr 27, 2026

Merge pull request NousResearch#18 from NousResearch/atropos-hermes-a…

e59fae2

…gent Upgrade installers to use uv

ImTheDanger-1 approved these changes May 11, 2026

View reviewed changes

idl3 mentioned this pull request May 22, 2026

fix(slack): chunk section-block content and surface postMessage errors (#18) #30253

Closed

4 tasks

BowmanStephen mentioned this pull request May 25, 2026

[feature-adoption] Adopt remaining unused Hermes features (9 unstarted) BowmanStephen/hermes-agent#9

Open

This was referenced May 25, 2026

fix(cli): catch KeyboardInterrupt during slash commands to prevent session exit #32017

Merged

fix(test): set _YOLO_MODE_FROZEN directly in yolo override test #32038

Closed

Interstellar-code mentioned this pull request May 28, 2026

[mcp_lazy] HIGH: synthetic mcp_server_<name> stub collides with a real MCP server named 'server' #34155

Closed

jarvis-stark-ops mentioned this pull request Jun 7, 2026

v6.3 + v6.3.1 + v6.4 + v6.4.1: dispatcher-level enforcement for the Marvel agent swarm 1Team-Engineering/hermes-agent#3

Open

5 tasks

xzmzm added a commit to xzmzm/hermes-agent that referenced this pull request Jun 10, 2026

docs: record patch NousResearch#18 auto-tts dedup

e4dfce2

madlouse mentioned this pull request Jun 22, 2026

Profile architecture: SOUL/C3 conflicts with channel workflow — business process rules need a separate layer from system prompt #50736

Open

waefrebeorn pushed a commit to waefrebeorn/slermes that referenced this pull request Jul 2, 2026

Merge pull request NousResearch#18 from NousResearch/atropos-hermes-a…

7aa3eb7

…gent Upgrade installers to use uv

redashes1984 mentioned this pull request Aug 1, 2026

[Bug]: Curator LLM review daemon thread silently dies at ~143K context with local custom provider #76272

Open

andrexibiza mentioned this pull request Aug 3, 2026

fix(ci): the no-exfiltration gate and OP_* strip exist on only one branch each — the merged fix set doesn't compose #77473

Open

moonweave mentioned this pull request Aug 15, 2026

feat(kanban): separate builder corrections from owner asks moonweave/hermes-agent#2

Open

Navigation Menu

Uh oh!

Upgrade installers to use uv - #18

Upgrade installers to use uv#18
teknium1 merged 3 commits into
mainfrom
atropos-hermes-agent

teknium1 commented Feb 7, 2026

Uh oh!

Jack04Fireball commented Apr 21, 2026

Uh oh!

ImTheDanger-1 left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

teknium1 commented Feb 7, 2026

Uh oh!

Jack04Fireball commented Apr 21, 2026

Uh oh!

ImTheDanger-1 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants