fix: date-only timestamp to preserve KV-cache across same-day sessions by iamfoz · Pull Request #20451 · NousResearch/hermes-agent

iamfoz · 2026-05-05T22:31:57Z

Problem

Every new session injects a dynamic timestamp into the system prompt:

timestamp_line = f"Conversation started: {now.strftime('%A, %B %d, %Y %I:%M %p')}"

Because %I:%M %p changes every session, the model's KV-cache attention for the system prompt is invalidated on every new session. For providers that support prompt caching (Anthropic, Google, etc.), this means the first ~2-3k tokens of context are re-computed on every session instead of being served from cache.

Fix

Remove the time component from the timestamp. Keep the date, drop the precise time:

timestamp_line = f"Conversation started: {now.strftime('%A, %B %d, %Y')}"

The date still changes daily, but sessions within the same day now share cache hits on the timestamp line. The precise time is available to the agent via hermes_time tools if needed.

Impact

KV-cache: System prompt timestamp line now stable within a day → cache hit instead of re-compute on same-day sessions
Latency: Marginal improvement on same-day sessions (fewer tokens re-processed)
Cost: Slight reduction for providers that charge per input token on cache misses
User-facing: Agent sees "Conversation started: Tuesday, May 05, 2026" instead of "Conversation started: Tuesday, May 05, 2026 01:15 PM" — still useful, just less granular

The %I:%M %p time component changes every session, invalidating KV-cache attention for the system prompt. Removing it means same-day sessions share cache hits on the ~2-3k system prompt tokens.

iamfoz · 2026-05-18T01:07:28Z

Thanks @teknium1, great to see this expanded into the full stability story. Closing in favour of #27675.

@iamfoz

…ogging The system prompt's 'Conversation started:' line carried minute precision (%I:%M %p), making it byte-unstable across every rebuild path. Within a CLI session the in-memory cache held, but on the gateway path (fresh AIAgent per turn → restore from session DB), any silent failure in the read or write path dropped the cache stem and forced a full re-prefill on every subsequent turn. Local prefix-caching backends (llama.cpp / vLLM) saw this as KV-cache invalidation; remote prefix-caching providers saw it as an Anthropic-style cache miss. Three changes: 1. Date-only timestamp ('Sunday, May 17, 2026' instead of '... 03:42 PM'). System prompt now byte-stable for the full day. The model can still query exact time via tools when it actually needs it. Credit: @iamfoz (PR #20451). 2. Loud logging on session DB write failures. The update_system_prompt call used to log at DEBUG, hiding disk-full / locked-database / schema drift behind a silent fall-through that forced fresh rebuilds on every subsequent turn. Now WARN with the session id and exception so persistent issues show up in agent.log without verbose mode. 3. Three-way stored-state distinction on read. The previous 'session_row.get("system_prompt") or None' collapsed three states into one (missing row / null column / empty string). Now we tell them apart and WARN when a continuing session lands on null/empty (which means the previous turn's write never persisted — every subsequent turn rebuilds and the prefix cache misses every time). The restore block is extracted into _restore_or_build_system_prompt() so the prefix-cache path can be unit-tested in isolation. E2E proof: fresh AIAgent constructed for turn 2 across a minute-boundary sleep restores byte-identical bytes from the session DB. NULL stored prompt fires the new warning. Date-only timestamp survives the rebuild path. All on real SessionDB, no mocks. Tests: - tests/agent/test_system_prompt_restore.py (10 new tests) - tests/run_agent/test_run_agent.py::TestBuildSystemPrompt:: test_datetime_is_date_only_not_minute_precision Closes #20451 (date-only), #18547 (prefix stabilization), #8689 (stabilize timestamp across compression), #15866 (timestamp caching question), #8687 (compression timestamp), #27339 (claim #3: live timestamp in cached system prompt). Co-authored-by: Martyn Forryan <9133432+iamfoz@users.noreply.github.com>

teknium1 · 2026-05-18T06:21:27Z

Your date-only timestamp fix shipped in PR #27675 (merged commit 4a3f13b) — your authorship is preserved as Co-authored-by. Thank you for the clean diagnosis and minimal repro. The PR also bundled stronger gateway-side logging (loud warnings on session DB write failures + three-way stored-state distinction on read) so future regressions in this area surface in agent.log instead of silently breaking prefix-cache reuse.

@iamfoz

…ogging The system prompt's 'Conversation started:' line carried minute precision (%I:%M %p), making it byte-unstable across every rebuild path. Within a CLI session the in-memory cache held, but on the gateway path (fresh AIAgent per turn → restore from session DB), any silent failure in the read or write path dropped the cache stem and forced a full re-prefill on every subsequent turn. Local prefix-caching backends (llama.cpp / vLLM) saw this as KV-cache invalidation; remote prefix-caching providers saw it as an Anthropic-style cache miss. Three changes: 1. Date-only timestamp ('Sunday, May 17, 2026' instead of '... 03:42 PM'). System prompt now byte-stable for the full day. The model can still query exact time via tools when it actually needs it. Credit: @iamfoz (PR NousResearch#20451). 2. Loud logging on session DB write failures. The update_system_prompt call used to log at DEBUG, hiding disk-full / locked-database / schema drift behind a silent fall-through that forced fresh rebuilds on every subsequent turn. Now WARN with the session id and exception so persistent issues show up in agent.log without verbose mode. 3. Three-way stored-state distinction on read. The previous 'session_row.get("system_prompt") or None' collapsed three states into one (missing row / null column / empty string). Now we tell them apart and WARN when a continuing session lands on null/empty (which means the previous turn's write never persisted — every subsequent turn rebuilds and the prefix cache misses every time). The restore block is extracted into _restore_or_build_system_prompt() so the prefix-cache path can be unit-tested in isolation. E2E proof: fresh AIAgent constructed for turn 2 across a minute-boundary sleep restores byte-identical bytes from the session DB. NULL stored prompt fires the new warning. Date-only timestamp survives the rebuild path. All on real SessionDB, no mocks. Tests: - tests/agent/test_system_prompt_restore.py (10 new tests) - tests/run_agent/test_run_agent.py::TestBuildSystemPrompt:: test_datetime_is_date_only_not_minute_precision Closes NousResearch#20451 (date-only), NousResearch#18547 (prefix stabilization), NousResearch#8689 (stabilize timestamp across compression), NousResearch#15866 (timestamp caching question), NousResearch#8687 (compression timestamp), NousResearch#27339 (claim NousResearch#3: live timestamp in cached system prompt). Co-authored-by: Martyn Forryan <9133432+iamfoz@users.noreply.github.com>

@iamfoz

…ogging The system prompt's 'Conversation started:' line carried minute precision (%I:%M %p), making it byte-unstable across every rebuild path. Within a CLI session the in-memory cache held, but on the gateway path (fresh AIAgent per turn → restore from session DB), any silent failure in the read or write path dropped the cache stem and forced a full re-prefill on every subsequent turn. Local prefix-caching backends (llama.cpp / vLLM) saw this as KV-cache invalidation; remote prefix-caching providers saw it as an Anthropic-style cache miss. Three changes: 1. Date-only timestamp ('Sunday, May 17, 2026' instead of '... 03:42 PM'). System prompt now byte-stable for the full day. The model can still query exact time via tools when it actually needs it. Credit: @iamfoz (PR NousResearch#20451). 2. Loud logging on session DB write failures. The update_system_prompt call used to log at DEBUG, hiding disk-full / locked-database / schema drift behind a silent fall-through that forced fresh rebuilds on every subsequent turn. Now WARN with the session id and exception so persistent issues show up in agent.log without verbose mode. 3. Three-way stored-state distinction on read. The previous 'session_row.get("system_prompt") or None' collapsed three states into one (missing row / null column / empty string). Now we tell them apart and WARN when a continuing session lands on null/empty (which means the previous turn's write never persisted — every subsequent turn rebuilds and the prefix cache misses every time). The restore block is extracted into _restore_or_build_system_prompt() so the prefix-cache path can be unit-tested in isolation. E2E proof: fresh AIAgent constructed for turn 2 across a minute-boundary sleep restores byte-identical bytes from the session DB. NULL stored prompt fires the new warning. Date-only timestamp survives the rebuild path. All on real SessionDB, no mocks. Tests: - tests/agent/test_system_prompt_restore.py (10 new tests) - tests/run_agent/test_run_agent.py::TestBuildSystemPrompt:: test_datetime_is_date_only_not_minute_precision Closes NousResearch#20451 (date-only), NousResearch#18547 (prefix stabilization), NousResearch#8689 (stabilize timestamp across compression), NousResearch#15866 (timestamp caching question), NousResearch#8687 (compression timestamp), NousResearch#27339 (claim NousResearch#3: live timestamp in cached system prompt). Co-authored-by: Martyn Forryan <9133432+iamfoz@users.noreply.github.com>

@iamfoz

…ogging The system prompt's 'Conversation started:' line carried minute precision (%I:%M %p), making it byte-unstable across every rebuild path. Within a CLI session the in-memory cache held, but on the gateway path (fresh AIAgent per turn → restore from session DB), any silent failure in the read or write path dropped the cache stem and forced a full re-prefill on every subsequent turn. Local prefix-caching backends (llama.cpp / vLLM) saw this as KV-cache invalidation; remote prefix-caching providers saw it as an Anthropic-style cache miss. Three changes: 1. Date-only timestamp ('Sunday, May 17, 2026' instead of '... 03:42 PM'). System prompt now byte-stable for the full day. The model can still query exact time via tools when it actually needs it. Credit: @iamfoz (PR NousResearch#20451). 2. Loud logging on session DB write failures. The update_system_prompt call used to log at DEBUG, hiding disk-full / locked-database / schema drift behind a silent fall-through that forced fresh rebuilds on every subsequent turn. Now WARN with the session id and exception so persistent issues show up in agent.log without verbose mode. 3. Three-way stored-state distinction on read. The previous 'session_row.get("system_prompt") or None' collapsed three states into one (missing row / null column / empty string). Now we tell them apart and WARN when a continuing session lands on null/empty (which means the previous turn's write never persisted — every subsequent turn rebuilds and the prefix cache misses every time). The restore block is extracted into _restore_or_build_system_prompt() so the prefix-cache path can be unit-tested in isolation. E2E proof: fresh AIAgent constructed for turn 2 across a minute-boundary sleep restores byte-identical bytes from the session DB. NULL stored prompt fires the new warning. Date-only timestamp survives the rebuild path. All on real SessionDB, no mocks. Tests: - tests/agent/test_system_prompt_restore.py (10 new tests) - tests/run_agent/test_run_agent.py::TestBuildSystemPrompt:: test_datetime_is_date_only_not_minute_precision Closes NousResearch#20451 (date-only), NousResearch#18547 (prefix stabilization), NousResearch#8689 (stabilize timestamp across compression), NousResearch#15866 (timestamp caching question), NousResearch#8687 (compression timestamp), NousResearch#27339 (claim #3: live timestamp in cached system prompt). Co-authored-by: Martyn Forryan <9133432+iamfoz@users.noreply.github.com>

@iamfoz

…ogging The system prompt's 'Conversation started:' line carried minute precision (%I:%M %p), making it byte-unstable across every rebuild path. Within a CLI session the in-memory cache held, but on the gateway path (fresh AIAgent per turn → restore from session DB), any silent failure in the read or write path dropped the cache stem and forced a full re-prefill on every subsequent turn. Local prefix-caching backends (llama.cpp / vLLM) saw this as KV-cache invalidation; remote prefix-caching providers saw it as an Anthropic-style cache miss. Three changes: 1. Date-only timestamp ('Sunday, May 17, 2026' instead of '... 03:42 PM'). System prompt now byte-stable for the full day. The model can still query exact time via tools when it actually needs it. Credit: @iamfoz (PR #20451). 2. Loud logging on session DB write failures. The update_system_prompt call used to log at DEBUG, hiding disk-full / locked-database / schema drift behind a silent fall-through that forced fresh rebuilds on every subsequent turn. Now WARN with the session id and exception so persistent issues show up in agent.log without verbose mode. 3. Three-way stored-state distinction on read. The previous 'session_row.get("system_prompt") or None' collapsed three states into one (missing row / null column / empty string). Now we tell them apart and WARN when a continuing session lands on null/empty (which means the previous turn's write never persisted — every subsequent turn rebuilds and the prefix cache misses every time). The restore block is extracted into _restore_or_build_system_prompt() so the prefix-cache path can be unit-tested in isolation. E2E proof: fresh AIAgent constructed for turn 2 across a minute-boundary sleep restores byte-identical bytes from the session DB. NULL stored prompt fires the new warning. Date-only timestamp survives the rebuild path. All on real SessionDB, no mocks. Tests: - tests/agent/test_system_prompt_restore.py (10 new tests) - tests/run_agent/test_run_agent.py::TestBuildSystemPrompt:: test_datetime_is_date_only_not_minute_precision Closes #20451 (date-only), #18547 (prefix stabilization), #8689 (stabilize timestamp across compression), #15866 (timestamp caching question), #8687 (compression timestamp), #27339 (claim #3: live timestamp in cached system prompt). Co-authored-by: Martyn Forryan <9133432+iamfoz@users.noreply.github.com>

@iamfoz

…ogging The system prompt's 'Conversation started:' line carried minute precision (%I:%M %p), making it byte-unstable across every rebuild path. Within a CLI session the in-memory cache held, but on the gateway path (fresh AIAgent per turn → restore from session DB), any silent failure in the read or write path dropped the cache stem and forced a full re-prefill on every subsequent turn. Local prefix-caching backends (llama.cpp / vLLM) saw this as KV-cache invalidation; remote prefix-caching providers saw it as an Anthropic-style cache miss. Three changes: 1. Date-only timestamp ('Sunday, May 17, 2026' instead of '... 03:42 PM'). System prompt now byte-stable for the full day. The model can still query exact time via tools when it actually needs it. Credit: @iamfoz (PR NousResearch#20451). 2. Loud logging on session DB write failures. The update_system_prompt call used to log at DEBUG, hiding disk-full / locked-database / schema drift behind a silent fall-through that forced fresh rebuilds on every subsequent turn. Now WARN with the session id and exception so persistent issues show up in agent.log without verbose mode. 3. Three-way stored-state distinction on read. The previous 'session_row.get("system_prompt") or None' collapsed three states into one (missing row / null column / empty string). Now we tell them apart and WARN when a continuing session lands on null/empty (which means the previous turn's write never persisted — every subsequent turn rebuilds and the prefix cache misses every time). The restore block is extracted into _restore_or_build_system_prompt() so the prefix-cache path can be unit-tested in isolation. E2E proof: fresh AIAgent constructed for turn 2 across a minute-boundary sleep restores byte-identical bytes from the session DB. NULL stored prompt fires the new warning. Date-only timestamp survives the rebuild path. All on real SessionDB, no mocks. Tests: - tests/agent/test_system_prompt_restore.py (10 new tests) - tests/run_agent/test_run_agent.py::TestBuildSystemPrompt:: test_datetime_is_date_only_not_minute_precision Closes NousResearch#20451 (date-only), NousResearch#18547 (prefix stabilization), NousResearch#8689 (stabilize timestamp across compression), NousResearch#15866 (timestamp caching question), NousResearch#8687 (compression timestamp), NousResearch#27339 (claim NousResearch#3: live timestamp in cached system prompt). Co-authored-by: Martyn Forryan <9133432+iamfoz@users.noreply.github.com>

@iamfoz

…ogging The system prompt's 'Conversation started:' line carried minute precision (%I:%M %p), making it byte-unstable across every rebuild path. Within a CLI session the in-memory cache held, but on the gateway path (fresh AIAgent per turn → restore from session DB), any silent failure in the read or write path dropped the cache stem and forced a full re-prefill on every subsequent turn. Local prefix-caching backends (llama.cpp / vLLM) saw this as KV-cache invalidation; remote prefix-caching providers saw it as an Anthropic-style cache miss. Three changes: 1. Date-only timestamp ('Sunday, May 17, 2026' instead of '... 03:42 PM'). System prompt now byte-stable for the full day. The model can still query exact time via tools when it actually needs it. Credit: @iamfoz (PR NousResearch#20451). 2. Loud logging on session DB write failures. The update_system_prompt call used to log at DEBUG, hiding disk-full / locked-database / schema drift behind a silent fall-through that forced fresh rebuilds on every subsequent turn. Now WARN with the session id and exception so persistent issues show up in agent.log without verbose mode. 3. Three-way stored-state distinction on read. The previous 'session_row.get("system_prompt") or None' collapsed three states into one (missing row / null column / empty string). Now we tell them apart and WARN when a continuing session lands on null/empty (which means the previous turn's write never persisted — every subsequent turn rebuilds and the prefix cache misses every time). The restore block is extracted into _restore_or_build_system_prompt() so the prefix-cache path can be unit-tested in isolation. E2E proof: fresh AIAgent constructed for turn 2 across a minute-boundary sleep restores byte-identical bytes from the session DB. NULL stored prompt fires the new warning. Date-only timestamp survives the rebuild path. All on real SessionDB, no mocks. Tests: - tests/agent/test_system_prompt_restore.py (10 new tests) - tests/run_agent/test_run_agent.py::TestBuildSystemPrompt:: test_datetime_is_date_only_not_minute_precision Closes NousResearch#20451 (date-only), NousResearch#18547 (prefix stabilization), NousResearch#8689 (stabilize timestamp across compression), NousResearch#15866 (timestamp caching question), NousResearch#8687 (compression timestamp), NousResearch#27339 (claim #3: live timestamp in cached system prompt). Co-authored-by: Martyn Forryan <9133432+iamfoz@users.noreply.github.com>

@iamfoz

…ogging The system prompt's 'Conversation started:' line carried minute precision (%I:%M %p), making it byte-unstable across every rebuild path. Within a CLI session the in-memory cache held, but on the gateway path (fresh AIAgent per turn → restore from session DB), any silent failure in the read or write path dropped the cache stem and forced a full re-prefill on every subsequent turn. Local prefix-caching backends (llama.cpp / vLLM) saw this as KV-cache invalidation; remote prefix-caching providers saw it as an Anthropic-style cache miss. Three changes: 1. Date-only timestamp ('Sunday, May 17, 2026' instead of '... 03:42 PM'). System prompt now byte-stable for the full day. The model can still query exact time via tools when it actually needs it. Credit: @iamfoz (PR NousResearch#20451). 2. Loud logging on session DB write failures. The update_system_prompt call used to log at DEBUG, hiding disk-full / locked-database / schema drift behind a silent fall-through that forced fresh rebuilds on every subsequent turn. Now WARN with the session id and exception so persistent issues show up in agent.log without verbose mode. 3. Three-way stored-state distinction on read. The previous 'session_row.get("system_prompt") or None' collapsed three states into one (missing row / null column / empty string). Now we tell them apart and WARN when a continuing session lands on null/empty (which means the previous turn's write never persisted — every subsequent turn rebuilds and the prefix cache misses every time). The restore block is extracted into _restore_or_build_system_prompt() so the prefix-cache path can be unit-tested in isolation. E2E proof: fresh AIAgent constructed for turn 2 across a minute-boundary sleep restores byte-identical bytes from the session DB. NULL stored prompt fires the new warning. Date-only timestamp survives the rebuild path. All on real SessionDB, no mocks. Tests: - tests/agent/test_system_prompt_restore.py (10 new tests) - tests/run_agent/test_run_agent.py::TestBuildSystemPrompt:: test_datetime_is_date_only_not_minute_precision Closes NousResearch#20451 (date-only), NousResearch#18547 (prefix stabilization), NousResearch#8689 (stabilize timestamp across compression), NousResearch#15866 (timestamp caching question), NousResearch#8687 (compression timestamp), NousResearch#27339 (claim NousResearch#3: live timestamp in cached system prompt). Co-authored-by: Martyn Forryan <9133432+iamfoz@users.noreply.github.com>

@iamfoz

…ogging The system prompt's 'Conversation started:' line carried minute precision (%I:%M %p), making it byte-unstable across every rebuild path. Within a CLI session the in-memory cache held, but on the gateway path (fresh AIAgent per turn → restore from session DB), any silent failure in the read or write path dropped the cache stem and forced a full re-prefill on every subsequent turn. Local prefix-caching backends (llama.cpp / vLLM) saw this as KV-cache invalidation; remote prefix-caching providers saw it as an Anthropic-style cache miss. Three changes: 1. Date-only timestamp ('Sunday, May 17, 2026' instead of '... 03:42 PM'). System prompt now byte-stable for the full day. The model can still query exact time via tools when it actually needs it. Credit: @iamfoz (PR NousResearch#20451). 2. Loud logging on session DB write failures. The update_system_prompt call used to log at DEBUG, hiding disk-full / locked-database / schema drift behind a silent fall-through that forced fresh rebuilds on every subsequent turn. Now WARN with the session id and exception so persistent issues show up in agent.log without verbose mode. 3. Three-way stored-state distinction on read. The previous 'session_row.get("system_prompt") or None' collapsed three states into one (missing row / null column / empty string). Now we tell them apart and WARN when a continuing session lands on null/empty (which means the previous turn's write never persisted — every subsequent turn rebuilds and the prefix cache misses every time). The restore block is extracted into _restore_or_build_system_prompt() so the prefix-cache path can be unit-tested in isolation. E2E proof: fresh AIAgent constructed for turn 2 across a minute-boundary sleep restores byte-identical bytes from the session DB. NULL stored prompt fires the new warning. Date-only timestamp survives the rebuild path. All on real SessionDB, no mocks. Tests: - tests/agent/test_system_prompt_restore.py (10 new tests) - tests/run_agent/test_run_agent.py::TestBuildSystemPrompt:: test_datetime_is_date_only_not_minute_precision Closes NousResearch#20451 (date-only), NousResearch#18547 (prefix stabilization), NousResearch#8689 (stabilize timestamp across compression), NousResearch#15866 (timestamp caching question), NousResearch#8687 (compression timestamp), NousResearch#27339 (claim NousResearch#3: live timestamp in cached system prompt). Co-authored-by: Martyn Forryan <9133432+iamfoz@users.noreply.github.com>

…shows The system prompt carried a date and nothing else: no time, no timezone, built once per session and rebuilt only after compaction. That coarseness is deliberate and correct — minute precision would invalidate the provider's prefix KV cache on every rebuild path (PR NousResearch#20451) — but it left the model unable to tell the time, unable to tell which zone the date was on, and simply wrong about the date on any session running past midnight. It was also being told the wrong way to fix that: <mandatory_tool_use> instructed it to shell out to `date` for the current time, which reports the container clock. The container is UTC. On a UTC host with a Denver user those differ by a full calendar day for six hours of every day — 19:47 Aug 7 MDT is 01:47 Aug 8 UTC — which is the reported symptom. Put the clock on the current user turn instead, via the api_content sidecar the gateway already uses to keep volatile per-turn facts out of the system prompt. hermes_time.current_time_note() renders an explicit <current_time>… MDT (America/Denver)</current_time> — abbreviation and IANA name both, so the model never has to infer a zone or do offset arithmetic. Prefix cache cost is zero: prior turns replay their frozen sidecars and only the request tail changes, where a boundary already sits. It is computed ONCE per turn in build_turn_context, deliberately not inside compose_user_api_content. That function runs twice per turn — the prologue's sidecar stamp and the api_messages build in conversation_loop — and a clock read inside it could straddle a minute boundary, returning different strings to the two callers and breaking the invariant that the persisted sidecar equals the bytes on the wire. There is a test that pins the call count for exactly this reason. Multimodal turns get a durable text part instead, the same fallback the gateway notes use, so image turns don't silently lose the clock. The system prompt now names the zone alongside the date. The name is stable for the whole day, so it is free in cache terms while making the date unambiguous. The compaction temporal anchor gets the same treatment. The cronjob tool description now states that cron schedules are UTC and asks the model to convert and state both times when a user asks for a local hour — cron deliberately does not follow the display timezone (see cron/clock.py). On the desktop side, every Intl formatter in lib/time.ts was built with an undefined locale and no timeZone, so it rendered the OS zone and never printed a label. They now resolve in the configured Hermes zone, applied from the config hook alongside the other config-driven side effects, and fmtDayTime/fmtDateTime carry a zone suffix. The formatters stay memoized rather than per-render — the property the file header called out — with an explicit cache invalidation when the zone changes, and they fall back to the OS zone if the configured name is invalid so a stale config can't blank out every timestamp in the app. The exact-bytes sidecar tests silence the clock note through an autouse fixture so they keep testing what they were written to test; the note has its own coverage in tests/agent/test_turn_clock_note.py. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The "Conversation started:" line carried a bare date (%A, %B %d, %Y). Tools that accept instants -- nutrition, calendar and similar MCP servers -- reject naive datetimes and require an explicit UTC offset, so the model had to infer EST vs EDT from the date alone. Near a DST boundary that is a coin flip, and a wrong guess does not error: it silently writes the record onto the wrong day. Append the IANA zone (when configured), the zone abbreviation and the UTC offset, e.g.: Conversation started: Saturday, August 15, 2026 (America/New_York, EDT, UTC-04:00) get_timezone() returns None when no timezone is configured; in that case the line falls back to the abbreviation and offset of the server-local (still tz-aware) time, so behaviour is unchanged for users who never set one: Conversation started: Saturday, August 15, 2026 (EDT, UTC-04:00) Daily byte-stability is preserved -- the property the date-only format exists to protect (PR NousResearch#20451). Zone name, abbreviation and offset are all constant for the whole day; they shift only at a DST transition, where a change is correct. The static-prefix reconstruction guard in _restore_plugin_sections matches on "\n\nConversation started:" and is unaffected by a suffix after the date. test_datetime_is_date_only_not_minute_precision used `re.search(r":\d{2}")` over the whole line as a proxy for "no time-of-day". A UTC offset also matches that pattern, so the check now applies to the date portion (everything before the zone parenthetical) and the invariant is tightened rather than relaxed: - test_datetime_includes_utc_offset asserts the offset is present - test_datetime_line_is_stable_across_rebuilds asserts two rebuilds in the same day produce a byte-identical line Fixes NousResearch#87403 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The "Conversation started:" line carried a bare date (%A, %B %d, %Y). Tools that accept instants -- nutrition, calendar and similar MCP servers -- reject naive datetimes and require an explicit UTC offset, so the model had to infer EST vs EDT from the date alone. Near a DST boundary that is a coin flip, and a wrong guess does not error: it silently writes the record onto the wrong day. Append the IANA zone (when configured), the zone abbreviation and the UTC offset, e.g.: Conversation started: Saturday, August 15, 2026 (America/New_York, EDT, UTC-04:00) get_timezone() returns None when no timezone is configured; in that case the line falls back to the abbreviation and offset of the server-local (still tz-aware) time, so behaviour is unchanged for users who never set one: Conversation started: Saturday, August 15, 2026 (EDT, UTC-04:00) Daily byte-stability is preserved -- the property the date-only format exists to protect (PR #20451). Zone name, abbreviation and offset are all constant for the whole day; they shift only at a DST transition, where a change is correct. The static-prefix reconstruction guard in _restore_plugin_sections matches on "\n\nConversation started:" and is unaffected by a suffix after the date. test_datetime_is_date_only_not_minute_precision used `re.search(r":\d{2}")` over the whole line as a proxy for "no time-of-day". A UTC offset also matches that pattern, so the check now applies to the date portion (everything before the zone parenthetical) and the invariant is tightened rather than relaxed: - test_datetime_includes_utc_offset asserts the offset is present - test_datetime_line_is_stable_across_rebuilds asserts two rebuilds in the same day produce a byte-identical line Fixes #87403 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…keeping --ignore-scripts (#115) * fix(agent): preserve stalled-provider escalation * fix(agent): cover provider wait teardown paths * fix(sessions): surface open sessions skipped by prune * fix(sessions): address prune skip review notes * fix(sessions): align prune filter derivation * fix(agent+discord): guard truncated-response continuation loops and cap Discord split delivery (#86581) * fix(agent): bound worker finalization when iteration budget exhausted (#87096) Adds a bounded fallback path in turn_finalizer.py that always records a terminal timed_out outcome via _record_task_failure (CAS receipt path) when the iteration budget is exhausted, regardless of whether the normal fallback paths (interrupted/failed/anomalous exit_reason) were eligible. Previously, a kanban worker whose budget was exhausted but whose turn was interrupted, failed, or exited with an anomalous reason would silently leave its task in an ambiguous lifecycle state — the dispatcher would eventually detect it as a crashed or protocol-violation worker, but the failure was not bounded and could take a full tick cycle to reconcile. The CAS invariant in _end_run (WHERE ended_at IS NULL) guarantees idempotence: if another path already closed the run, the call is a no-op. Extracted the inline kanban-budget-exhausted recording into a shared helper function (_record_kanban_budget_exhausted) used by both the existing iteration_limit_fallback path and the new bounded fallback path. Closes #87096 * fix: guard exit watchdog against mid-cleanup overlap * fix(desktop): hard-exit a lock-losing second instance before ready app.quit() does not stop a lock-losing instance from reaching whenReady: the before-quit teardown coordinator defers the quit (event.preventDefault + async backend shutdown), and ready fires in that window. The losing instance then runs the full startup whose reapOrphans() SIGTERMs the running instance's live backend (#87295). The lock-loser holds no state and no backend — requestSingleInstanceLock() has already delivered the argv to the primary by the time it returns false — so there is nothing to clean up. app.exit(0) terminates immediately, before ready, so a second launch routes into the running window and never touches backend machinery. * fix(desktop): keep startHermes inert without the single-instance lock startHermes() is the only entry point that can reap, spawn, claim, and therefore destroy a backend. Belt-and-suspenders on the exact killing line: even if some future path reaches it in a lock-losing process (a refactor, a dev harness, a race), the instance stays inert — no reap, no spawn, no claim — instead of SIGTERMing the running instance's backend (#87295). * fix(desktop): never reap a backend whose parent Electron is alive reapOrphans() treats any recorded backend with a matching process identity as orphan-reapable — including a backend owned by another live instance. The ownership file is shared across instances, so a second launch that reaches reap (even without the lock) SIGTERMs the running instance's backend. Claims now record the spawning Electron (parentPid + parentStartMarker, the same values already passed to the backend as HERMES_PARENT_PID / HERMES_PARENT_START_MARKER), and reapOrphans() skips any entry whose parent is still running. Even a second instance that wins a stale lock can never kill a live instance's backend. Legacy entries without parent data keep the old behaviour. Known tradeoff: a parent-liveness probe failure preserves the record, so a genuinely orphaned backend under a still-running parent is leaked until it dies naturally. That is preferable to killing a live instance's backend. Tests: parent-aware reap in backend-ownership.test.ts (live parent preserved, dead parent still reaped, probe failure preserved, parent identity round-trips through claim/parse). * fix(agent): include timezone and UTC offset in system prompt timestamp The "Conversation started:" line carried a bare date (%A, %B %d, %Y). Tools that accept instants -- nutrition, calendar and similar MCP servers -- reject naive datetimes and require an explicit UTC offset, so the model had to infer EST vs EDT from the date alone. Near a DST boundary that is a coin flip, and a wrong guess does not error: it silently writes the record onto the wrong day. Append the IANA zone (when configured), the zone abbreviation and the UTC offset, e.g.: Conversation started: Saturday, August 15, 2026 (America/New_York, EDT, UTC-04:00) get_timezone() returns None when no timezone is configured; in that case the line falls back to the abbreviation and offset of the server-local (still tz-aware) time, so behaviour is unchanged for users who never set one: Conversation started: Saturday, August 15, 2026 (EDT, UTC-04:00) Daily byte-stability is preserved -- the property the date-only format exists to protect (PR #20451). Zone name, abbreviation and offset are all constant for the whole day; they shift only at a DST transition, where a change is correct. The static-prefix reconstruction guard in _restore_plugin_sections matches on "\n\nConversation started:" and is unaffected by a suffix after the date. test_datetime_is_date_only_not_minute_precision used `re.search(r":\d{2}")` over the whole line as a proxy for "no time-of-day". A UTC offset also matches that pattern, so the check now applies to the date portion (everything before the zone parenthetical) and the invariant is tightened rather than relaxed: - test_datetime_includes_utc_offset asserts the offset is present - test_datetime_line_is_stable_across_rebuilds asserts two rebuilds in the same day produce a byte-identical line Fixes #87403 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(gateway): make managed Node suppress PATH fallback * fix(agent): canonicalize duplicate tool call arguments * fix(agent): harden canonical tool call deduplication * fix(gateway): let an explicit workspace move win for a running session session.workspace.move refused a running live session with 4009 (session busy), but the desktop's Move-to-project flow calls exactly this RPC — so the UI updated its local grouping while state.db kept the old cwd and the agent's tools kept running in the old workspace. Two sources of truth disagreed (#86626). An explicit move now wins: the stored row and the live session re-anchor together. In-flight tool calls keep the cwd they were launched with; the next tool call uses the new workspace. * fix(ui): ignore inherited esbuild binary overrides * fix(ui): scrub esbuild override during builds * fix(codex): clamp xAI max/ultra aliases to the model's reasoning ceiling (#87279) * fix(backup): bound locked database snapshot waits * fix(gemini): raise maxOutputTokens when thinking is enabled Gemini bills thought tokens against maxOutputTokens/max_tokens, so a global 4096 cap can be fully consumed by thinking on the first request, leaving zero content tokens and aborting after 4 continuations. When thinking is enabled, raise the effective output cap to the 65,535 ceiling on both the native and chat-completions paths. Refs #83915 * fix(gateway): don't crash on a foreign XDG_RUNTIME_DIR in user-systemd preflight (#86558) runuser/su/sudo -u from a root shell leaks XDG_RUNTIME_DIR=/run/user/0 into the child. _user_systemd_socket_ready() stat-ed sockets under it with a bare Path.exists(), which only suppresses ENOENT/ENOTDIR/EBADF/ELOOP — EACCES on the 0700 root-owned dir escaped as a raw PermissionError traceback instead of the documented UserSystemdUnavailableError remediation path. - _path_exists_safe(): Path.exists() that treats EACCES as absent; used at both the readiness and DBUS-detection call sites. - _ensure_user_systemd_env(): drop an XDG_RUNTIME_DIR that is unset or owned by another user in favour of our own /run/user/{uid}, so the restart actually succeeds after su/sudo -u instead of only failing cleanly. Regression tests cover the EACCES readiness probe, foreign-dir replacement, and that preflight raises UserSystemdUnavailableError (not PermissionError). * fix(agent): do not let hygiene idle timeouts block in-agent compression Session hygiene persists compression_failure_cooldown_until after a 30s no-progress watchdog so the pre-agent pass can skip. The in-conversation compressor read the same column and then refused to run even though its own budget is sufficient. Ignore hygiene idle-timeout errors on the in-agent path. Real aux-model faults such as rate limits still block. Fixes #86972 * fix(agent): clear in-memory cooldown when hygiene overwrites the shared row A later hygiene idle-timeout write can replace an aux-model cooldown on the shared column. Drop the in-memory timer on that refresh so the in-agent compressor is not still blocked after the DB row is hygiene. * fix(gateway): persist hygiene failure cooldown rung * fix(gateway): offload hygiene streak persistence * fix(skills): resolve skills dir before relative_to so junction installs work (#86971) * fix(telegram): honor group_allowed_chats in early auth under multiplex profiles (#87132) With gateway.multiplex_profiles enabled, the primary Telegram message handler is the closure returned by _make_default_profile_message_handler(), so its __self__ is absent. The early intake filter (_is_user_authorized_from_message) recovered the GatewayRunner via self._message_handler.__self__ and, finding none, fell back to env-only authorization — never evaluating the configured chat allowlist through GatewayRunner._is_user_authorized(). Every non-global sender was then default-denied in an explicitly allowlisted group. Prefer the platform-bound authorization callback registered via set_authorization_check(): it routes through the runner's full auth chain (platform + group allowlists, pairing store, allow-all) and survives the closure wrapping, whereas the bound-handler lookup does not. The bound handler remains the fallback for setups without a registered callback, and the pairing-passthrough guard for unknown DMs is preserved. Fixes #87132 * fix(desktop): close safe preview blockers before update * fix(desktop): identify unsafe update blockers * fix(gateway): keep persisted model routes consistent * fix(desktop): don't cancel the running turn on Esc while an overlay is open The composer's global Esc-to-cancel listener (useComposerEscCancel) fires whenever the turn is busy and the active composer matches — but overlays (Settings, Command Center, agents, cron, …) cover the chat while the composer stays mounted and 'active' beneath them, so pressing Esc on any of those pages interrupted the session the user wasn't even looking at. OverlayView's own escape-layer Esc-to-close fired too, but the stream was already dead. Stand Esc down with composerFocusBlockedBySurface() — the same signal the type-to-focus path uses (BLOCKING_OVERLAY includes OverlayView's [data-overlay-surface] marker). Esc on an overlay now closes the overlay via its escape layer instead of canceling the stream beneath it. Fixes #82618 * fix(caching): engage prompt caching for LiteLLM Claude on the OpenAI wire anthropic_prompt_cache_policy() only granted Anthropic cache_control markers to LiteLLM over the native Anthropic wire (api_mode == "anthropic_messages"). A LiteLLM deployment exposing the OpenAI-compatible surface instead (/v1/chat/completions, /v1/messages -> 404) matched no grant branch and fell through to (False, False): no cache_control injected, the system prompt sent as a plain string, and the provider serving zero cache hits -- the entire prompt re-billed at full price on every turn. Silent: no error, no warning, usage simply shows 100% uncached input forever. Add one branch after the is_anthropic_wire/is_claude case that grants caching to Claude-family models on a LiteLLM endpoint regardless of wire, with the native inner-block layout. Same failure class already documented in-function for Qwen/DashScope. Design: - Gated on the Claude family only (is_claude); a Gemini/GPT/Qwen route through the same proxy must not receive markers (they may reject the cache_control block format -- cf. the DeepSeek/OpenCode exclusion). - Matches on provider string OR base_url host, since provider naming varies per install (litellm, custom:litellm, or a bare custom alias pointed at a LiteLLM host). - prompt_caching.cache_ttl: false still wins (the _cache_disabled early return is untouched). - Generic strict OpenAI-wire custom providers (e.g. Fireworks) remain excluded -- verified by the existing over-reach regression test. Tests: adds TestLiteLLMOpenAIWire covering the grant (several model spellings x provider/host signals), no-over-reach (non-Claude on the same proxy get nothing; operator disable wins), and adjacent behavior (LiteLLM in Anthropic proxy mode still native layout). Full module: 43 passed. Closes #84506. Original diagnosis, patch design, and measurements by @ottosulin. * fix(caching): use the envelope layout for LiteLLM Claude on the OpenAI wire Follow-up to the salvaged LiteLLM cache grant. The grant itself is right; four things about how it was scoped were not. 1. Layout. The branch returned the native inner-block layout (use_native_layout=True) on api_mode == "chat_completions". That layout writes a TOP-LEVEL msg["cache_control"] on role:tool and empty-content messages and depends on the Anthropic adapter to relocate it into the block — but that adapter only runs for api_mode == "anthropic_messages" (agent/transports/anthropic.py registers there), and the chat_completions transport does no relocation. Measured on a 3-tool-turn transcript: 2 of the 4 available breakpoints landed on markers the provider never sees. Worse, when LiteLLM itself relocates a top-level marker for an OpenRouter-backed Claude route (OpenrouterConfig._move_cache_control_to_content), the marker lands on an empty assistant turn and produces a cache_control-marked empty text block — the HTTP 400 "text content blocks must contain" shape already guarded in agent/anthropic_adapter.py (#69512). Switched to the envelope layout, matching every other OpenAI-wire grant in this function: 4 of 4 breakpoints honored, zero empty blocks. 2. Host matching. `"litellm" in base_url_hostname(...)` is the substring false-positive class base_url_hostname's own docstring warns against; it granted Anthropic markers to notlitellm.example.com, foolitellmbar.example and friends. Replaced with a label-token match in a named helper, so "litellm" must be a whole dot- or hyphen-delimited token. All three of the original test hosts still match; a "litellm" path segment on an unrelated host still does not. 3. Transport gate. `not is_anthropic_wire` also swept in codex_responses, bedrock_converse and codex_app_server. Gated on api_mode == "chat_completions" explicitly. 4. Operator override. The grant is inferred from a provider/host name, but the custom-provider capability lookup was gated on is_anthropic_wire, so an explicit `prompt_caching: false` for the route+model was honored on /v1/messages and silently ignored on /v1/chat/completions. The lookup now also runs for a LiteLLM route, and its layout follows the transport rather than the declaration (an explicit `true` must not promote a chat_completions request to the native layout). Tests: 64 passed. Adds the wire-shape contract the original matrix was missing (asserts no breakpoint sits on the message envelope, rather than only checking the returned tuple), plus lookalike-host, other-transport, and both operator-override directions. All five guards mutation-checked — reverting each fix turns the corresponding test red. * fix(caching): match the litellm provider id token-wise too Self-review follow-up. The previous commit fixed substring matching on the HOST but left the provider-id side as a bare substring, so a user-named provider like `custom:notlitellm` or `mylitellmthing` still matched and was handed Anthropic markers — the same bug class, half-fixed. Both signals now match `litellm` as a whole delimited token via a shared helper. Real spellings (`litellm`, `custom:litellm`, `litellm-router`, and the already-lowercased `LiteLLM`) still match; lookalikes no longer do. Tests: 71 passed. Adds lookalike-provider and real-spelling guards; both new guards mutation-checked. Differential matrix over 2688 configs vs origin/main: 60 changes, every one a Claude model on a genuine LiteLLM route getting the envelope layout, zero pre-existing routes altered. * perf(caching): narrow the widened capability lookup to the LiteLLM grant Self-review follow-up, caught by benchmarking the previous commit. Widening the custom-provider capability-lookup gate to `is_anthropic_wire or _is_litellm_route(...)` made EVERY chat_completions route with a litellm-ish provider/host enter the lookup, including non-Claude models that the grant branch below can never match. Measured on a route with no config.yaml (the uncached worst case) that was ~7.5us -> ~1528us per evaluation. Narrowed the gate to the exact condition the LiteLLM branch grants on (chat_completions + Claude + litellm route), computed once into a local and reused by the branch itself so the predicate no longer runs twice. Measured with a realistic config.yaml present (mtime cache warm), vs origin/main: live-agent policy 20.6us -> 61.7us destination planning 219.3us -> 347.7us Sub-millisecond and scoped to the routes that actually opted in. The earlier 1.5ms figures were a tempdir artifact: load_config_readonly's mtime cache cannot engage when no config.yaml exists, which is never true of a real install. Non-LiteLLM and non-Claude routes are unaffected (openrouter Claude measured flat at ~7.9us). Tests: 82 passed across the policy and TTL-propagation modules. * test(caching): pin signal precedence and the openrouter-host opt-out Review follow-up. Three coverage gaps in the LiteLLM matrix: - The operator opt-out on a litellm-named provider pointed at an OpenRouter host. That route previously took the OpenRouter branch and ignored an explicit per-model `prompt_caching: false`; it is the only cell in the differential matrix where the salvage REMOVES caching, so pin it as intended rather than leaving it to be read as a regression. - Signal precedence: an explicitly litellm-named provider grants even on a lookalike host, because the provider id is an independent signal and only the host-derived signal is token-gated. Intentional, now documented. - A hyphen-delimited host label (`my-litellm-gw.internal.example.com`), which the token matcher handles but nothing exercised. Traded the redundant `claude-3-7-sonnet` parametrize cell for the new host case, so the matrix covers more shapes with the same cell count. Tests: 83 passed. All three production fixes re-mutation-checked against the final stack. * fix(web_server): discover root user plugins under profile-scoped processes When the backend is spawned profile-scoped (`--profile <name>` sets HERMES_HOME=<root>/profiles/<name>), _discover_dashboard_plugins() scanned only get_process_hermes_home()/plugins — the profile directory, which has no plugins/ content. Pooled per-profile backends therefore discovered zero user plugins, mounted no plugin API routes, and every plugin REST call fell through to the SPA catch-all 404. Also scan get_default_hermes_root()/plugins (which unwraps <root>/profiles/<name> to <root> and leaves a custom HERMES_HOME untouched when it is itself the root), matching how hermes_cli.plugins resolves install locations. The profile home is scanned first, so a profile-local plugin of the same name stays authoritative via the existing seen_names dedupe. Adds regression tests for root-plugin discovery under a profile-scoped process and for profile-over-root precedence. Fixes #87197 (plugin discovery half — the misleading /api/* catch-all half is addressed separately in #87270). * fix(telegram): keep /loop and synthetic sends in the active DM topic Fixes #87051 * fix(desktop): show failed status for timed-out subagents in fallback stream path Fixes #87200 * fix(desktop): match custom provider aliases in model catalog menu Fixes #87035 * chore(contributors): map emails for P2-sweep salvage wave * fix(desktop): avoid PowerShell parent marker boot gate * fix(desktop): give Windows start-marker PowerShell probe a 30s budget PowerShell 5.1 cold starts take 2.4-8s on affected Windows hosts, so the shared 3s execText timeout hard-failed the parent start-marker probe for any PID that still needs the PowerShell path (e.g. backend children). Make execText's timeout overridable and raise the marker probe to 30s. Fixes #87169 * perf(desktop): hydrate transcripts with a small tail page + on-demand older-page backfill Replace the fixed 500-message REST hydration (getLatestSessionMessages) with a 120-row newest-first tail page. When the page comes back full, a new per-session tail store records "possibly truncated + next offset"; "Show earlier" — once the DOM budget and the in-memory store window are both exhausted — fetches the next older page via the new getOlderSessionMessages helper (order latest + offset, matching the backend's back-from-newest paging semantics) and prepends it to the session store, deduped by durable row id and race-guarded against session switches. Legacy backends without pagination metadata fall back to the one-shot full transcript and retire the action. Tail-page refreshes (background sync, post-turn rehydrate, re-activate, cold-resume prefetch) graft the refreshed tail onto any backfilled prefix instead of clobbering it, preserving reference identity on no-ops. includeCompacted stays on every read — compaction-archived rows remain part of the durable display history. * feat(desktop): MCP fleet cost/usage overlay with schema token estimates and 30-day usage Each configured server row on the MCP Capabilities page now shows what it costs and whether it earns its keep: - ~per-call token estimate of the server's tool schemas, summed over ENABLED tools only (ceil(schema_chars/4) via the existing include/exclude filter) - 30-day usage count from getUsageAnalytics(30), cached per scope profile like the Toolsets tab's toolCallsCache, mapped to servers via the mcp__<server>__<tool> registry-name convention (tools/mcp_tool.py) - a subtle muted "unused" pill on enabled, probed-ok servers with nonzero schema cost and zero 30-day uses — never a dialog Backend: the /api/mcp/servers/{name}/test probe now fills an additive per-tool `schema_chars` (length of the SAME converted registry schema the agent registers). Older backends omit it → renderer shows counts only; older renderers ignore the extra key. Display-only: nothing changes what schemas are sent to models, no config knobs. i18n keys (costTokens/usage30d/unusedPill) added to types/en/zh/zh-hant/ja (ar inherits en via defineLocale overrides). Pure math lives in lib/mcp-cost.ts with unit tests; Python wire shape pinned in tests/hermes_cli/test_web_server_profile_unification.py. * fix(tui): map lineage edit ordinals past compression prefix Desktop/TUI count full displayed lineage after compression, but prompt.submit validated truncate ordinals against tip-only history. Translate via display_history_prefix and recover stale 4018s on Desktop. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(desktop): hoist GatewayMock type into #82462 edit recovery suite CI typecheck failed because GatewayMock lived only in the previous describe. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(desktop): hermes:// deep link to install MCP servers with explicit confirmation Adds hermes://mcp/install?name=NAME&config=B64 (base64url or standard base64 JSON), mirroring Cursor's mcp/install deep link, so vendors and docs can offer an "Add to Hermes" button. - Electron: the existing generic hermes:// handler already forwards {kind, name, params}; only its comment is updated (no new handler). - Renderer: use-desktop-integrations routes kind=mcp/name=install into a pending-install store; a new confirmation dialog shows the server name and the FULL pretty-printed config (attacker-controllable input), with a prominent caution for stdio command entries. Nothing is written until the user confirms; existing names require a rename or cancel. On confirm the server is merged over a fresh fetch of the current map via saveMcpServers, then navigation lands on /skills?tab=mcp&server=… so useDeepLinkHighlight focuses the new row. - Validation: name ^[A-Za-z0-9._-]{1,64}$; config must decode to an object with a string http(s) `url` or a string `command` (never both); payloads over 32KB rejected; failures surface as a toast. - Pure parser in src/lib/mcp-deeplink.ts with unit tests (url shape, command shape, bad base64, non-object, javascript: URL, oversized). - i18n keys in types + en/zh/zh-hant/ja/ar. - Docs: "Add to Hermes link" section in the MCP config reference. * fmt(js): `npm run fix` on merge (#87599) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * feat(desktop): background MCP health checks with re-auth nudges MCP server problems (expired OAuth tokens especially) were only discovered when the user visited the MCP page and a probe ran. Now a renderer-side background checker (store/mcp-health.ts) sweeps the active profile's enabled HTTP/SSE MCP servers on gateway connect and every 30 minutes, and fires an in-app notification with a "Sign in" action ("<name> MCP needs re-authentication") that navigates to the MCP page with ?server=<name> so useDeepLinkHighlight focuses the server and its Authenticate button. Navigation only — OAuth flows are never auto-launched. stdio servers are deliberately excluded: probing a stdio server SPAWNS a local process, so a background timer must never touch them. Only url-shaped servers (where OAuth expiry lives) are swept, sequentially. The tab's probeCache/serverFingerprint/probeKey/NEEDS_AUTH_RE moved to a shared lib/mcp-probe-cache.ts (behavior identical) so the page and the checker share one probe cache and its 5-minute TTL — neither surface re-probes what the other just learned. Notifications fire only on a TRANSITION into needs-auth/error (pure state machine, unit-tested), hard-capped at one per server per app session, keyed per profile. Profile switches drop pending timers and re-arm for the new profile; sweeps never run while the gateway is disconnected. No new config knobs. i18n keys added across en/zh/zh-hant/ja/ar + types. * fmt(js): `npm run fix` on merge (#87607) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * fix(desktop): scope messaging to active remote profile Complete the sidebar profile-scope contract across remote Electron routing, older-backend fallbacks, standalone messaging refreshes, and pagination. Reject stale profile responses and keep the explicit all-profiles view unified. Co-authored-by: 墨綠BG <s5460703@gmail.com> Co-authored-by: liuhao1024 <sunsky.lau@gmail.com> * fix(desktop): retain messaging totals per profile Key resolved platform totals by Desktop profile and source so profile switches neither inherit another profile's count nor discard a count that was already resolved. Keep the full reset for connection configuration changes. Co-authored-by: frendo <frendo.wu@gmail.com> * fix(desktop): ignore stale messaging page responses Sequence per-profile platform pagination so an older overlapping response cannot replace a newer, larger page. * docs(desktop): document profile scope helpers Add JSDoc to the exported helpers introduced by the profile-scoped sidebar change. * fix(desktop): reject stale profile refreshes * fix(desktop): harden profile-scoped refreshes * fix(desktop): resolve sessions from sidebar caches Consult messaging and cron caches before the by-id fallback so opening a sidebar row neither depends on a redundant network lookup nor duplicates it into regular recents. Co-authored-by: protas-box <protas.box@icloud.com> * fix(tools-config): stop reconfigure flow clobbering image_gen.use_gateway on managed FAL rows The Nous Subscription image_gen row carries imagegen_backend="fal", so _reconfigure_provider's post-model-picker step ran img_cfg["use_gateway"] = False unconditionally at two sites, immediately after the managed branch had written use_gateway=True. A user who picked Nous Subscription and then re-entered `hermes tools` to change the model was silently flipped onto their personal FAL_KEY. Same bug class as fe63353cb, which fixed the plugin-provider selector but missed these two legacy-backend sites in the reconfigure flow. Both now write bool(managed_feature), matching the existing correct site in _configure_provider. Adds regression tests driven through the real TOOL_CATEGORIES managed row; sabotage-verified (tests fail with the old behavior restored). * feat(desktop): make the multi-gateway Connections registry discoverable The multi-connection registry (Settings -> Connections) shipped with no entry point outside the settings nav, and the product-owner report was blunt: 'I didn't see any obvious way to hook up multiple gateways.' - Profile rail: a plug pill pinned beside Manage ('Connect another Hermes gateway...') deep-links to /settings?tab=connections. Always visible, including for single-profile first-run users. - Command palette: Settings -> Connections is now a searchable entry (keywords: add gateway, remote, ssh, cloud, instances, registry). - i18n: profiles.connectGateway added to en/types/zh; other locales fall back through defineLocale. - Tests: profile-rail-connect.test.tsx covers the deep link and the single-profile visibility guarantee. * docs: full multi-gateway setup guide for Hermes Desktop Expand user-guide/multi-connection-desktop.md into a complete setup walkthrough: where to find the pane (settings nav, profile-rail plug, command palette), the exact add-connection editor fields (Name, Gateway URL, Authentication: Session token/OAuth, SSH host), Primary / This device pills, Test semantics, agent roster + profile-rail switching and per-profile session/cron/messaging scoping, token storage via Electron safeStorage with the keyring-less Linux plain- text opt-in, and troubleshooting. All quoted labels match the desktop i18n strings. Cross-link the rail entry point from desktop.md. * fix(desktop): never resolve a missing named gateway scope to the primary activeGateway() fell back to the primary gateway when the active key named a registry-agent scope (conn:<id>::<profile>) whose secondaries entry had been evicted — e.g. closeSecondaryGateways() during a soft gateway switch — so sends and session ops silently executed against the WRONG machine. A named scope now resolves to its own socket or null, and every eviction path (closeSecondaryGateways, pruneSecondaryGateways) explicitly restores the primary as active when it evicts the active scope, keeping the 'activeKey always resolves' invariant with the atoms following. * fix(desktop): sync connection atoms and share the switch mutex for agent activation ensureGatewayForAgent (the SDK ensureAgent door) skipped the two invariants the profile path provides: - $connection / $activeGatewayProfile were only updated when a socket was freshly dialed (setConnection inside openSecondary), so activating an ALREADY-OPEN registry agent left both describing the previous backend — /api/fs, /api/media and image.attach routed to the wrong machine (same class as #46651) and newSessionInProfile targeted the stale profile. - Activations bypassed the gatewaySwitch mutex, so a rapid agent/profile interleave could complete out of order with the earlier setActive() landing last. Add profile.ts ensureGatewayAgent: the (connectionId, profile) analogue of ensureGatewayProfile that shares the same gatewaySwitch mutex, moves $activeGatewayProfile on every activation, and resyncs $connection from getConnectionFor (best-effort, like the profile path). The SDK ensureAgent now routes through it; local/null connectionId falls through to the profile path unchanged. * feat(desktop): expose busy turn flags on plugin SDK Plugins can now read host.state.busy and host.state.awaitingResponse for the focused chat. These follow the same session slice the chat pane uses, so a draft falls back to the global flags and a background turn does not leak. * fix(desktop): make plugin SDK turn flags follow the focused chat Follow-up to the salvaged #87558 commit: the PR's docs promised the flags follow "the focused chat", but PRIMARY_SESSION_VIEW is the primary workspace tab only — a focused session TILE would read the wrong chat. Wire host.state.busy / host.state.awaitingResponse through the focused slice ($focusedStoredSessionId / $focusedSessionState), same semantics as the statusbar busy pulse, with the primary view (and its draft fallback) while the workspace holds focus. Adds a tile-focus vitest case and corrects the docs wording. * feat(desktop): paste-anything MCP server import Add a compact Import popover to the MCP Capabilities page that accepts anything a user might copy from an MCP server README and infers the server config: - mcp.json snippets (mcpServers-wrapped, bare name->config maps, single unnamed server objects, Cursor/Claude `type` normalized to `transport`) - bare npx/bunx/uvx/node/docker command lines (name inferred from the package basename, e.g. server-filesystem -> filesystem) - `claude mcp add NAME [--transport http|sse] [-e K=V] [-H ...] [--] CMD ARGS...` and `claude mcp add NAME URL` - bare http(s) URLs (name inferred from the hostname) - Cursor deeplinks (cursor://anysphere.cursor-deeplink/mcp/install with a base64-encoded JSON config payload) The parser is a pure module (src/lib/mcp-import.ts) with unit tests for every format plus garbage input. The popover previews the inferred name + config and, on confirm, merges the entries into the editor draft exactly like addServer's starter entry: unique keys, dirty (unsaved) draft, first new block focused. Placeholder env values (YOUR_KEY, TOKEN_HERE, ...) are kept verbatim for the user to edit in the editor before saving. i18n keys added under settings.mcp for en, zh, zh-hant, ja (ar falls back through defineLocale). * feat(desktop): running is not busy Gate composer submit and plugin host busy on the target session slice, not a leftover foreground busyRef. Staff can keep typing while a worker session is running. Includes the follow-up test that submit uses the target session busy flag. * fix(desktop): lint and map contributor email for running-is-not-busy Drop the redundant Boolean() on selected in $primaryBusy and add the professorpalmer9@gmail.com mapping so attribution CI can resolve the PR. * feat(desktop-sdk): expose focused-session state atoms to plugins Disk plugins read app state exclusively through host.state, which only exposed the primary workspace tab ($activeSessionId). In the multi-tile layout, clicking a tile never touches that atom — and tile focus is a pure renderer concern, invisible to both gateway RPC and the event stream — so a plugin cannot follow the session the user is actually looking at. The core statusbar solves this same problem by reading the focused- session atoms (use-statusbar-items.tsx). Widen the generic plugin surface with the same signals, per the contribution rubric: - host.state.focusedSessionId — runtime id of the focused session (interacted tile, else the primary), the key for session.* RPC - host.state.focusedStoredSessionId — durable id for navigation and session-list matching - host.state.focusedUsage — live streamed UsageStats projection (context_used/max/percent, tokens, cost_usd), no RPC needed Additive only; no existing behavior changes. tsc --noEmit clean. Verified end-to-end with a disk plugin that now tracks the focused session across tiles. * test(desktop-sdk): contract-test the focused-session host.state atoms Locks the plugin-facing contract: the focused atoms exist as readonly nanostores, mirror the primary session while no tile is focused, project the focused session's usage, and — the behavior this PR exists for — follow the interacted tile while the primary-only $activeSessionId stays put. * fix(desktop-sdk): type focusedUsage as Partial<UsageStats>, fix expect arity ClientSessionState.usage is Partial<UsageStats> (app/types.ts) — the backend streams whichever fields changed — so the computed produces ReadableAtom<Partial<UsageStats> | null>. Annotate the entry honestly instead of claiming full UsageStats, and document the fallback rule for plugin authors. Also collapse the three-argument expect() calls in the contract test (vitest takes one message arg). Addresses triage review on PR #80461. * fix(desktop-sdk): address adversarial review — type honesty, real tile coverage, docs Independent second-pass review found three gaps: - focusedUsage is null | UsageStats, not Partial — ClientSessionState.usage is the full type (app/types.ts) and its only write site seeds the four required fields before merging (gateway-event.ts). The earlier Partial annotation traced the wrong type (SessionRuntimeInfo, an RPC payload). Comment now names the genuinely optional fields instead. - The tile-focus contract test never seeded $sessionTiles/$sessionStates, so it proved focusedStoredSessionId follows a tile but could not distinguish focusedSessionId/focusedUsage working from broken. Seed a bound runtime with distinct usage and assert both readout atoms move. - The two public host.state references (website docs + bundled skill reference) enumerated the old six atoms; plugin authors would never discover the new ones. Both lists updated. tsc/eslint/vitest green (4/4). * chore: map contributor email for focused-session atoms salvage * fix(desktop): exclude process-less descriptors from backend pool LRU cap Remote/cloud registry descriptors (entry.process === null) shared the POOL_MAX_BACKENDS cap with real spawned local backends, so a roster refresh across N registered remote connections could LRU-evict a live local backend idle past the keepalive window. Cap accounting and cap-driven eviction now count only entries with a live child process; descriptors remain subject to the idle reaper. * fix(desktop): tear down renderer secondaries when a registry connection is removed Removing a connection stopped its pooled backends and ssh tunnels but never told the renderer: for remote/cloud sources there is no local process to die, so the removed connection's WebSocket stayed open and kept streaming ghost events into the UI until page reload. If the socket did drop, openSecondary -> getConnectionFor threw 'No connection with id' and scheduleReconnect retried forever (backoff caps at 15s, entry never evicted). - main now broadcasts 'hermes:connections:changed' on removal (and on material edits); preload exposes connections.onChanged. - use-gateway-boot subscribes and calls the new disposeSecondariesForConnection(), which disposes + evicts every secondary scoped to the connection id (redialing on edits). - reconnectSecondary fail-stops: when the Electron main reports the connection no longer exists, the entry is disposed and evicted instead of retrying forever; ordinary transport errors keep the existing backoff behavior. * fix(desktop): recycle live backends and sockets when a connection edit changes its target saveRegistryConnection only rewrote the registry file: editing a connection's URL/token/host left pooled backend descriptors under 'conn:<id>::*' and open renderer sockets pointing at the OLD endpoint — the UI showed the new target while traffic kept flowing to the old one until idle-reap. When a save MATERIALLY changes an existing connection (endpoint / auth / ssh routing fields, via the new connectionDialFieldsChanged helper), main now stops that connection's pooled backends and tunnels (stopRegistryConnectionBackends, same teardown as removal) and broadcasts 'hermes:connections:changed' with reason 'updated' so renderers dispose and re-dial their secondaries at the new target. Label-only renames do not recycle. * fix(cli): restore Kitty keyboard protocol push and complete the extended-key alias table Commit 4c34eeb416 fixed dead Ctrl+C by removing the Kitty protocol push (CSI >1u) from _EXTENDED_ENTER_KEYS_SEQ, keeping only modifyOtherKeys level 2. That regressed kitty-the-terminal completely: kitty removed xterm modifyOtherKeys support (kovidgoyal/kitty#4075) and only speaks its own protocol, so after the removal kitty users lost Shift+Enter and every other extended key — the CSI >4;2m we still pushed is a no-op there (kitty even logs a PARSE ERROR for it). The original reason for removing the push is obsolete: #87511 mapped CSI-u control sequences, so Ctrl+C as ESC[99;5u now parses to Keys.ControlC and fires the existing c-c binding. (The kernel-INTR concern in that commit was moot — prompt_toolkit's raw mode clears ISIG, so Ctrl+C is always handled by the binding, never the kernel.) Restore the dual push (CSI >1u + CSI >4;2m), exactly mirroring the Ink TUI, and complete the alias table for what the kitty disambiguate flag actually emits — #87511 left real gaps, some of which its PR body wrongly claimed were covered: - Esc key: ESC[27u (+ modifiers) — previously leaked '[27u' as text - Ctrl+Backspace -> backward-kill-word (#78285 was closed on the wrong claim that codepoint-127 mapping existed; it did not) - Shift+Space -> space (#86866's second symptom; the Ctrl+Space mapping never covered modifier 2) - Alt+Enter -> newline tuple; Shift+Tab -> BackTab; Ctrl+Tab -> Tab; Alt/Shift+Backspace - Multi-modifier letters (Shift+Alt 4, Ctrl+Shift 6, Ctrl+Alt 7, Ctrl+Alt+Shift 8) normalized onto their Ctrl/Escape-prefix targets, both unshifted (kitty) and shifted (mok emitters) codepoints - Kitty PUA functional keys: keypad -> non-keypad equivalents, F13-F24, and Ignore for lock/media/modifier-event keys so they are consumed instead of leaking (kitty emits these even in legacy mode) Also: clear the VT100 parser's prefix cache after installing (stale answers could misparse), and re-push extended keys after _recover_terminal_input_modes' reset — the recovery previously popped both modes mid-session and never re-enabled them, silently killing Shift+Enter until restart. Refs #87511, #87074, #56684, #56645, #78285, #86866, #87390. * fix(cron): process .pth files for Windows uv-venv script jobs (#86567) _windows_cron_python_invocation bypasses the uv venv launcher (to avoid flashing a console window) and re-attaches the venv via PYTHONPATH — but PYTHONPATH entries are plain sys.path additions and never get .pth processing, so editable installs (pip install -e) were invisible to cron script jobs (ModuleNotFoundError). Bootstrap the script with site.addsitedir() on the venv site-packages, then exec it as __main__ via runpy.run_path, preserving the script directory on sys.path (python script.py semantics). Falls back to a plain invocation when the venv layout is unresolvable. * fix(cron): log and document the .pth bootstrap fallback (#86816 review) - WARN when the venv site-packages layout is unresolvable and the script falls back to plain PYTHONPATH execution, so 'editable installs invisible' failures are diagnosable. - Docstring: note that runpy does not set __package__/__spec__ the way a direct python script.py invocation does. * fix(update): surface config mutations applied silently during version-bump-only updates * fix: honor JSON-array string forms for skills.disabled and agent.disabled_toolsets `hermes config set` and JSON-mode editor saves store lists as quoted strings (e.g. '["skill-a","skill-b"]' or "['memory']"). Both disable filters treated such a string as a single name, so curated disable lists silently filtered nothing with zero diagnostics. Add parse_config_string_list() in agent.skill_utils and use it in _normalize_string_set (skills.disabled / platform_disabled) and at every agent.disabled_toolsets read site: tools_config resolve + reconcile, CLI, gateway agent construction (both sites), cron scheduler, and prompt_size. A scalar string still names a single entry (#13026); malformed JSON falls back to the single-name behavior instead of raising. Fixes #86661 * fix(desktop-update): put --daemonized ahead of ORIGINAL_ARGS in posix.sh re-exec Appending --daemonized after ORIGINAL_ARGS put it past the `--` relaunch-args separator on Linux, so it was absorbed into RELAUNCH_ARGS instead of being parsed as a flag. HANDOFF_DAEMONIZED never got set, so the one-shot self-detach block re-fired on every re-exec -- an unbounded self-exec loop (thousands of iterations/sec, 100%+ CPU, argv growing until execve fails with E2BIG) whenever relaunch args were present, which is the normal invocation shape on Linux. Fixes #86957 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(cli): deliver the Bedrock API key through a named provider The Bedrock API-key flow stored the bearer token in OPENAI_API_KEY and set a bare `provider: custom`. Since #28660 that variable is only honoured for openai.com hosts, so for bedrock-mantle.*.api.aws the token was dropped and requests went out with api_key="no-key-required", a 401 on every call. Write a named `providers.bedrock-mantle` entry with key_env: AWS_BEARER_TOKEN_BEDROCK instead. The named-provider branch in runtime_provider.py resolves key_env; the bare-custom branch cannot. Fixes authentication only. Per-model mantle route selection is separate. * fix(gateway): improve Windows detach diagnostics * refactor(gateway): share breakaway marker constant * fix(tui): settle session close against active turns * fix(tui): stop queued dispatch after session close * fix(cron): reject NUL-bearing script paths before any Path call (#76762 class) _run_job_script wrapped only expanduser() in its ingestion try/except. On Linux an unexpandable NUL-bearing value raises inside that call, so it landed on the clean fail-with-report path; on Windows expanduser() never expands '~user' (and so never raises), and the NUL surfaces later as an uncaught ValueError from resolve()/exists() — crashing the scheduler. Align with cron.lifecycle_guard._expand_candidate_path, which already documents this as the whole-class fix (the per-syscall catching produced #76762, #77703, #77780, #78256): reject '\\x00' eagerly at the ingestion boundary so both platforms fail identically. * test(cron): pin the eager NUL rejection contract for _run_job_script (#86829) * fix(cron): coerce script_path to str in the NUL guard so it can never crash (#86829, review #86832) "\x00" in script_path raises TypeError when a caller passes a non-str (e.g. a pathlib.Path, which is not iterable) — the guard itself would crash the scheduler. All current call sites pass plain str, but the guard must be crash-proof: str() first, then check. Adds a regression test running a real script through _run_job_script with a Path argument, which fails with TypeError on the pre-fix guard. * docs(agents): record multiplex profile-scoped env fail-closed rule (#86905) Lesson from the feishu DM multiplex investigation: under multiplex, os.environ holds the default profile's values, so any profile-level env config (credentials AND authorization) must be read scope-aware, and a scoped miss with a scope installed must fail closed instead of borrowing from os.environ. The _get_scoped_secret wrapper is copy-pasted across ~15 platform adapters — new adapters and edits to existing ones must keep the fail-closed semantics. * fix(auth): resolve provider auto-detection keys through the profile scope (#86917) resolve_provider's auto path read provider API keys with bare os.getenv — under multiplex a secondary profile's keys live only in its secret scope, so auto-detection found nothing and every secondary profile with model.provider: auto failed with 'No LLM provider configured' at agent init (reproduced on a live 7-profile gateway). Route both env-key reads (the OPENAI/OPENROUTER tier and the PROVIDER_REGISTRY loop) through _scoped_key_env, the scope-aware helper auxiliary_client already uses: secret scope wins under multiplex, UnscopedSecretError falls back to os.environ (default-profile/CLI paths unchanged). Same bug class as #86905. Verified in a gateway-accurate simulation (hermes_home_override + profile scope): resolve_provider('auto') now returns the secondary profile's own provider (deepseek) instead of erroring. * test(auth): cover profile-scoped key resolution in resolve_provider (#86917) Three regression tests: scoped DEEPSEEK_API_KEY is visible to auto detection under multiplex (the #86917 failure); unscoped paths keep the os.environ read; explicit config provider still wins. * fix(auth): only fall back to os.getenv on ImportError in resolve_provider (#86918 review) The previous except Exception silently fell back to os.getenv if the _scoped_key_env import ever failed — under multiplex that is exactly the fail-open this PR removes (secondary profiles would regress to 'No LLM provider configured' with zero trace). Catch only ImportError, log a WARNING naming the consequence, and let any other failure propagate. Also replaces the lambda fallback with a named nested function. * test(gitlock): pin the git-process guard in sweep tests (deflake slice 8) The stale-lock removal tests asserted the sweep result while leaving _git_proc_running() live: on CI the parallel per-file runner almost always has a real git subprocess in flight, pgrep -x git hits, and clear_stale_git_locks correctly refuses to sweep — failing the tests for reasons unrelated to the code under test (surfaced on PR #86918, which doesn't touch gitlock at all). Monkeypatch the guard to False in the sweep tests and add an explicit test pinning the guard's block-while-git-running behavior. * fix(gateway): complete /loop ticks after streamed already_sent turns Streamed replies return None so the adapter does not send twice. The /loop hook then saw empty text and never ran, so awaiting_response stayed true and later ticks never fired. Stash the delivered text on the event and use it for the post-turn hooks. /goal uses the same path. Tests: tests/gateway/test_loop_command.py * fix(cli): chat -c fails loudly on stderr and gains --create-if-missing `hermes chat -c "<title>" -q "<text>"` silently no-oped when no session matched the title under quiet/programmatic use: the not-found message was written to stdout (the channel quiet callers parse as the final response), so a background send to a not-yet-existing named session vanished with no error. Surfaces via Hermes-Bot-Mode bot-to-bot handoffs (#86794). - not-found message now goes to stderr (exit 1 unchanged), so programmatic callers always see it even with -Q/--quiet - new --create-if-missing: with `-c <title>` and no matching session, create a fresh session carrying the title and proceed — the deterministic "send to this named thread, making it if needed" primitive plugins asked for - extract the -c resolution block into _resolve_continue_arg for testability Tests: flag parsing, titled-session creation, stderr routing, source guard. * fix(cli): address review feedback on chat -c fail-loudly PR Response to AI review (Enough1122) on #86812: 1. `_create_titled_session`: log the underlying exception before returning None so programmatic callers aren't left with an undebuggable "could not be created" — failures (DB lock, I/O, import) now land in errors.log via logger.exception. 2. Drop the source-reading `TestSourceGuard` — it violated the repo's "never read source code in tests" rule and was a change-detector (passed even if behavior regressed). The stderr routing is already covered by the real-path `test_missing_session_fails_on_stderr`. 3. Bare `-c` + `--create-if-missing` now prints a stderr note explaining the flag needs a session name, instead of silently ignoring it — makes the no-op self-evident to programmatic callers. Tests: 6 targeted + 8 adjacent, all passing. * chore: map contributor email for @yflmq001 * fix(acp): probe CLI for --acp support before spawning subprocess CopilotACPClient unconditionally passes [self._acp_command] + self._acp_args (default ['--acp', '--stdio']) to subprocess.Popen. When the resolved CLI doesn't accept --acp (e.g. Claude Code v2.1.233, where 'claude --acp --stdio' exits 1 with 'error: unknown option') the subprocess dies in ~250ms with the error on stderr, but the parent ACP loop has no fast-fail for this shape and waits the full child_timeout_seconds (default 600s, observed 109s+ before user interruption) for stdout that never arrives. Add _acp_supported() that probes the CLI's --help output for the --acp flag in ~50ms, then call it at the top of _run_prompt before any spawn happens. When the probe fails, raise a RuntimeError that names the unsupported flag, lists the expected fix (install @github/copilot late 2025+, or set HERMES_COPILOT_ACP_*), and returns control to the caller in ~280ms instead of hanging the delegate_task parent for hundreds of seconds. Measured locally against Claude Code v2.1.233: - Before: delegate_task acp_command=claude hangs 109s+ then returns tokens={input:0, output:0}. - After: delegate_task acp_command=claude raises RuntimeError in 280ms with a clear actionable message. This does NOT change behavior for supported CLIs (the new @github/copilot ships with --acp) — the probe returns True and the spawn proceeds unchanged. Refs the bundled claude-review-delegate skill which already documents this class of transport-mismatch pitfall for users who call 'claude -p' directly; this fix closes the same gap for the delegate_task MCP path. * fix(acp): make --acp probe tri-state, cached, and mock-safe Salvage hardening on top of #87308 (thanks @Dudeman456): - Tri-state verdict: inconclusive probes (binary missing, --help failed/timed out) return None and fall through to the normal spawn path, preserving the established 'Could not start Copilot ACP command' error instead of masking it. This also fixes the two test_copilot_acp_client HOME-env regressions that went red on the PR: their mocked-Popen path was intercepted by the new unmocked subprocess.run probe. - Cache definitive verdicts per binary path so CLIs that DO support --acp pay the ~50ms --help cost once per process, not per prompt. - Skip the probe entirely when custom ACP args don't include --acp. - Fix the help-text regex: the old pattern never matched '[--acp]' (leading '[' is neither start-of-string nor whitespace) and \b after 'p' matched '--acpfoo'. - Hermeticity: stub subprocess.run in the two HOME-env tests; add 6 probe-specific tests (fast-fail, fall-through, caching, skip). * fix(cli): bound the Windows process-scan probes so a slow WMI scan cannot wedge hermes update (#87134) subprocess.run(capture_output=True, timeout=N) is not hang-safe on Windows: after the timeout fires, run()'s cleanup kills the direct child and then joins the pipe reader threads with an UNBOUNDED communicate(). A descendant (conhost.exe under wmic/powershell) holding duplicated pipe handles keeps the pipes from EOF and the join never returns. _scan_gateway_pids() runs its wmic / Get-CimInstance Win32_Process scans exactly that way, and on machines where the full process scan genuinely exceeds its 10/15s budget (cold WMI on first boot, ARM VMs, heavy Update/AV activity) hermes update wedged forever inside _pause_windows_gateways_for_update() before printing a single line — observed live on a fresh Windows 11 ARM64 VM with a faulthandler stack pinning the main thread in subprocess._communicate and only a conhost.exe child surviving. The single-flight update lock then blocks retries until the wedged process is killed by hand. This is the same deadlock class bounded_git_probe already fixed for git probes (#68609 / #66037). Generalize that proven pattern into a shared bounded_probe_run() — explicit communicate(timeout), kill_process_tree on failure, bounded 1s drain, then abandon the daemonic readers — and migrate the whole call-site class onto it: - hermes_cli/gateway.py _scan_gateway_pids (the site that hung; reached from hermes update, cron, gateway restart/status, dashboard) - hermes_cli/dashboard_procs.py wmic scan (same shape, reached on update) - hermes_cli/claw.py tasklist + PowerShell probes (same shape; its try/except cannot catch a hang because a hang raises nothing) - bounded_git_probe now delegates to bounded_probe_run (identical contract, one copy of the cleanup logic) Unlike bounded_git_probe, bounded_probe_run returns the CompletedProcess (or None) rather than collapsing to stdout, because the gateway scan branches on returncode to trip its wmic -> powershell fallback. Tests: tests/hermes_cli/test_bounded_probe_run.py covers success, nonzero-exit passthrough, spawn failure, bounded timeout (fails against the old unbounded semantics — verified by sabotage), errors= decoding, DEVNULL stdin, POSIX process-group placement, and the bounded_git_probe delegation contract. Existing test_git_probe_tree_kill.py passes unchanged against the delegated implementation. Closes #87134 * test(cli): retarget the wmic-encoding regression test at bounded_probe_run The Windows-only test asserted encoding/errors kwargs on a mocked subprocess.run, but the scan now routes through bounded_probe_run (#87134), so subprocess.run is never invoked. Assert the probe call's contract instead (errors='ignore', finite timeout), verify the parsed PIDs, and add a fail-open case for probe failure. The test no longer needs a Windows host once the probe is mocked, so the windows_only gate is dropped. * fix(agent): attribute background-review usage and add cost controls Persist fork token usage under session_model_usage task=background_review, emit a per-fork completion log line, and expose enabled/max_iterations/ prompt_file so operators can see and bound the automatic review cost. Address review feedback: load auxiliary.background_review once per spawn, classify completion logs by summarize action prefixes, treat explicit api_call_count=None as the documented default of 1, and WARNING on the fail-open enabled-gate path. * fix(desktop): route registry 'local' entry to the genuinely-local runtime ensureRegistryBackend delegated kind==='local' to ensureBackend(), which follows the v1 connection.json routing table — under a v1 REMOTE global mode (the migration keeps the mandatory 'local' entry AND makes that remote the registry primary) the roster's 'This device' rows enumerated and dialed the REMOTE primary: every profile appeared twice (forcing -slug handles) and clicking a local agent talked to the remote box. resolveRegistryLocalRoute() (pure, colocated with the registry helpers) now decides the local entry's path: delegate to the legacy route only when v1 is itself local (single-source behavior byte-identical); otherwise spawn/reuse a forced-local pool child via spawnPoolBackend's new forceLocal option, pooled under the composite conn:local::<profile> key so it cannot collide with the v1 remote descriptor cached at the bare profile key. * fix(desktop): key fan-out event consumption by (connectionId, profile) Secondary-gateway events were tagged with connectionId (store/gateway fan-out) but no consumer read it: working/attention tracking, the pruneSecondaryGateways keep-set, and the profile-scoped event gates (skin.changed / change-watcher broadcasts / approval-mode reconcile) all keyed by session id + bare profile name. Every registered source exposes a 'default' profile (the roster force-unshifts it), so two connected gateways collided — gateway B's 'default' activity was attributed to gateway A's 'default', keeping the wrong socket alive and applying the wrong source's config/skin/cron changes. Thread connectionId through consumption using the existing composite backendScopeKey helper: - session-states records each registry-tagged event's (connectionId, profile) scope per runtime session; liveSessionScopes() projects the busy/needs-input ones as composite keys for the gateway keep-set. - recomputeKeptGateways (use-gateway-boot) seeds the keep-set with those scopes; pruneSecondaryGateways matches registry-scoped entries ONLY on their composite key, while local entries keep matching bare profile names (single-source path unchanged). - gateway-event's 'from the active profile' gates now compare the event's composite scope against the active gateway's connection via the new activeGatewayConnectionId(); untagged local/primary events behave byte-identically. Display-only surfaces that already use roster handles are untouched. * style(desktop): order @hermes/shared import before nanostores (perfectionist/sort-imports) * fmt(js): `npm run fix` on merge (#87839) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * fmt(js): `npm run fix` on merge (#87844) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * fix(agent): trim background_review to the enabled switch Follow-up to #87400: drop the max_iterations and prompt_file knobs from auxiliary.background_review. The aux model routing (provider/model/ base_url/...) predates #87400 and stays; the enabled switch and the usage telemetry stay. The fork's iteration budget returns to the historical hardcoded 16. * fix(update): reload _subprocess_compat and dashboard_procs after git pull hermes update runs in the PRE-pull Python process. After git pull updates source files on disk, modules already in sys.modules still hold the OLD code. The existing _reload_config_modules() reloaded only config modules, but the post-update dashboard cleanup path (_finish_dashboard_update_cleanup -> _scan_dashboard_processes) imports hermes_cli._subprocess_compat lazily; a new symbol added there (e.g. bounded_probe_run) is invisible to the cached module object, causing ImportError during the cleanup step. Extend the reload list to include hermes_cli._subprocess_compat and hermes_cli.dashboard_procs so the cleanup uses freshly-pulled code. * fix(update): reload process-scan modules at the dashboard-cleanup entry point Widen PR #87757 to cover the ZIP path: _update_via_zip() also calls _finish_dashboard_update_cleanup() but never runs _reload_config_modules, so the Windows git-broken fallback would still crash with the same ImportError (cannot import name 'bounded_probe_run' from the stale cached hermes_cli._subprocess_compat). - new _reload_process_scan_modules() called inside _finish_dashboard_update_cleanup itself, so every current and future call site is covered; reloads dependency-first (_subprocess_compat, then dashboard_procs) - reload failures log at warning (a miss surfaces seconds later as an ImportError in the same process) - regression tests: reload-before-kill ordering, node-failure skip, stale-module symbol restoration (the exact #87134 boundary state), nonfatal reload failure, and the #87757 reload-list contract * chore: release v0.20.2 (2026.8.16) * fix(tui): modified Enter and bare LF insert a newline in the composer across IDE and macOS terminals (#87854) * fix(tui): send atomic CSI u for modified Enter in IDE terminals VS Code/Cursor/Windsurf terminals bound Shift/Ctrl/Cmd+Enter to the legacy \\r\n sequence, which Ink's parse-keypress split into a backslash keypress plus a plain Return — inserting a stray backslash and submitting instead of adding a newline. Emit Kitty CSI u sequences that encode the modifier atomically, and migrate keybindings users already have on disk. Co-authored-by: yatesjalex <yatesjalex@users.noreply.github.com> * fix(tui): treat a bare LF as a newline in macOS composer terminals Terminals that can't send a distinct Shift+Enter collapse a modified Enter / Ctrl+J down to a bare LF. shouldPreserveCtrlJNewline() already handles the env-detectable cases (SSH, Windows Terminal, Ghostty, WSL), but plain macOS terminals (Terminal.app, iTerm2 defaults) do the same and aren't env-detectable, leaving no keyboard-driven newline there. Fold the return-key decision into shouldInsertNewlineOnReturn() and accept a bare LF as a multiline fallback on macOS too, keeping CR as submit everywhere. Co-authored-by: LeonSGP43 <LeonSGP43@users.noreply.github.com> --------- Co-authored-by: yatesjalex <yatesjalex@users.noreply.github.com> Co-authored-by: LeonSGP43 <LeonSGP43@users.noreply.github.com> * fix(state): classify structural DB corruption as its own persistence cause 'database disk image is malformed' contains the word 'disk', so classify_persistence_error bucketed SQLITE_CORRUPT / SQLITE_NOTADB failures as 'disk' and the turn-completion explainer told users to free disk space for a structurally damaged state.db (the #77386-family misdiagnosis, reproduced in the v0.20.0 malformed-DB incident report). - hermes_state: new 'corrupt' bucket in PERSISTENCE_ERROR_CAUSES, matched via _DB_CORRUPTION_MARKERS BEFORE the lo…

* feat(config): wire compression.tail_mode + docs (en/zh) #87326 shipped the lean-compaction capability on the compressor; this adds the config.yaml surface (compression.tail_mode: legacy|lean, default legacy), DEFAULT_CONFIG entry, and docs on both the dev-guide compression page and the user-guide configuration page, with zh-Hans parity. * fix(computer-use): zero-rect AX bounds serialize as unknown, not a position KDE/Qt apps report [0,0,0,0] bounds for elements that are perfectly clickable by index (live QA: all 50 of kcalc's zero-rect elements, including every radio button). Serializing that as a plausible rect invites a model to derive coordinate=[0,0] and click the screen corner. - _element_to_dict: zero rect -> bounds: null - _format_elements: '@ bounds-unknown (click by element index)' instead of the fake rect in the summary line - malformed bounds fail open (unchanged serialization) Live-proven on real kcalc (cua-driver 0.20.0): 50 elements now null, 0 zero-rect leftovers, summary annotated, real rects preserved, and a null-bounds radio button still clicks fine by index. * feat(desktop): drag-resizable panes on the Capabilities Skills tab The Skills tab's three panes are now all drag-resizable: - List/detail column seam: MasterDetail grows an optional resizeId that turns the seam between the rail and the detail pane into a vertical drag sash (same visual language as DetailPane's top-edge sash). The rail width persists in the shared pane store under that id; double-click resets to the default 0.75fr track. Skills and Tools tabs share one id so the split stays consistent across tabs. - Skills Hub section: the embedded hub picker's top edge is now a drag sash — pull the hub pane up to grow it (the skills list above absorbs the change). Height persists through the same pane store, double-click resets, and the cross-origin iframe gets pointer-events:none during the gesture so it can't swallow the drag. Replaces the old native CSS corner-resize handle. - The skill editor bottom pane already resized via DetailPane's sash. MASTER_DETAIL_WIDE_COLS keeps its exported shape (MCP tab reads it) — the --md-split var falls back to the declared track when unset, so grids without a sash render exactly as before. * feat(hooks): pre_tool_call content transformation via `modify` directive Adds a `modify` response type to pre_tool_call hooks so a hook can transform tool arguments before the tool executes, instead of repairing results afterwards via post_tool_call. - hermes_cli/plugins.py: _dispatch_pre_tool_call_hooks() fires hooks once and returns (block_message, modified_args); modify directives shallow-merge into an accumulated dict built from the original args. - agent/shell_hooks.py: _parse_response() accepts both the canonical {"action": "modify", "args": {...}} and Claude Code-compatible {"decision": "modify", "tool_input": {...}} wire formats. - model_tools.py, agent/tool_executor.py, agent/agent_runtime_helpers.py: dispatch sites migrated; modified args applied before execution. - Docs + 10 new tests (merge semantics, precedence, block interplay). Salvaged from PR #28953. Best fix for #18988. * refactor(hooks): share fail-closed approve logic; update sibling tests Follow-up to the #28953 salvage: - Extract _resolve_block_from_details() so resolve_pre_tool_block and _dispatch_pre_tool_call_hooks share ONE fail-closed approval-gate implementation. This also gives the new dispatcher the observability context wrapping around request_tool_approval that the original PR's inlined copy lacked. - Update sibling tests that patched resolve_pre_tool_block at the three migrated dispatch sites to patch _dispatch_pre_tool_call_hooks with the (block_message, modified_args) tuple contract. Verified: 448 targeted tests green; E2E with a real shell hook in an isolated HERMES_HOME rewrote a live write_file call (path + content) through handle_function_call, with block and negative paths intact. * chore: contributor mapping for NikolaRHristov * fix(mcp): handle DCR clients with secrets across all OAuth paths Some MCP OAuth providers (notably Supabase) return a client_secret from dynamic client registration but omit token_endpoint_auth_method. The MCP SDK defaults the missing method to "none", so the token exchange omits client_secret and the server rejects it (HTTP 422 "Required parameter: client_secret"), looping the browser consent page. This resolves the whole class, not just one provider: - Storage layer (HermesTokenStorage): coerce secret-bearing client info with missing/none auth method to client_secret_post on both read and write, persisting the corrected shape. - Both live provider paths (tools/mcp_oauth.py HermesOAuthClientProvider and tools/mcp_oauth_manager.py HermesMCPOAuthProvider): coerce in-memory client info immediately before token exchange and refresh. - Accept the full 2xx range on token and refresh responses (Supabase returns 201 Created), instead of the SDK's exact-200 check. - Redact token response bodies from error messages and logs on malformed responses. The Figma-specific request-time default (apply_oauth_provider_defaults) remains; this generalizes the same bug class for every DCR provider. Fixes #29680. Supersedes #34274 and #35700 (201-only variants). * chore: map contributor email for 5Hyeons * fix(compression): watermark commit — appends flow freely, concurrent tail survives compaction Redesign of the #75316 class (supersedes the approach in PR #87307). Root cause family: the compression lock fenced ORDINARY transcript appends for the whole slow provider-summary call. Turns died as session_persistence_failed whenever a message overlapped a compression (#74568, #77386, #75083), stale dead-PID locks blocked writes for the full TTL, and the busy-wait mitigation (#75264) was an order of magnitude shorter than real summaries. Separately, the commit archived from a pre-call snapshot, so rows appended mid-compression were swept into the archive. Design: the commit transaction is already exclusive — no lock phases needed. 1. Appends never check compression_locks. The lock's only job is stopping two compressions colliding; it keeps that job. The whole stale-lock / busy-wait symptom family dies as a class. 2. Watermark captured in the DB at compression start (get_active_message_watermark = MAX(id) of active rows) — not from in-memory message dicts, which carry no row ids in production. 3. archive_and_compact(watermark=, lock_holder=): one transaction verifies the holder still owns an unexpired lease (a reclaimed lease cannot publish a stale compaction), archives the snapshot, inserts the compacted set, and re-sequences the concurrent tail (id > watermark) via a pure-SQL column clone — every column except id survives byte-exact (api_content, platform_message_id, reasoning sidecars, token counts), FTS triggers index the clones naturally, originals stay archived and recoverable. watermark=None preserves the historical behavior. Removed: the append-side compression fence in _check_transcript_write_guards (with rationale note), making the _COMPRESSION_BUSY_WAIT_S retry lane unreachable from append paths (kept for other callers). Tests: 12 new (watermark contract, column-exact clone, commit fence incl. lease-lost/expired/rollback failure injection, append-vs-commit race); busy-retry suite flipped to pin the new contract; sabotage-verified (5 fail with the watermark disabled, 12 pass restored); E2E through the real compress_context seam with a mid-summary append landing and surviving. * fix(compression): rotation path clones the concurrent tail into the child CI caught the sibling site the in-place fix missed: legacy (non-in-place) compression rotates via publish_compression_child, where a mid-summary append previously stranded in the closed parent. Same watermark + pure-SQL column clone as archive_and_compact, with session_id rewritten to the child. Lineage-guard test flipped to pin the appends-flow-freely contract; rotation watermark tests added (tail follows the child; None = historical behavior). * fix(compression): bound the rotation tail clone below the rotator's own flush CI caught two rotation-path regressions from the unbounded clone: the #47202 pre-publish flush writes the rotator's OWN input transcript to the parent (above the start-watermark), and the clone was duplicating it into the child alongside the handoff. publish_compression_child gains watermark_ceiling — the MAX(id) captured immediately BEFORE that flush — so only rows in (watermark, ceiling] (genuinely foreign concurrent appends) clone across. Ceiling capture failure falls back to no tail preservation (historical behavior) rather than risking duplication. Ceiling-exclusion test added. * fix(terminal): warn when exit_code 0 masks a piped build/test failure `cargo build 2>&1 | tail -20` exits with tail's 0 even when the build failed — bash without pipefail reports the last pipeline command's status, and `cmd || echo failed` swallows the status the same way. The model reads exit_code: 0 as a strong success signal and can conclude a build passed while the visible output says it failed (community report, Windows Rust builds; not platform-specific). Two-part fix, mirroring OpenCode's prompt-side approach plus a result-side backstop they don't have: - Tool description now forbids piping builds/tests through tail/head/cat (output is already auto-truncated + spilled to a file) and warns that pipes/|| fallbacks mask exit codes. - New annotate_masked_success() in tools/terminal_hints.py: when exit_code == 0, the command shape can mask an upstream status (top-level pipe into a passthrough consumer, or || echo/true), AND the output carries strong tool-specific failure shapes (rustc, cargo, pytest, gcc, npm, make, ninja), attach an advisory 'hint' telling the model to treat the run as failed and re-run bare. exit_code itself is never modified. Search/content heads (grep/rg/echo/printf/...) are excluded to avoid false positives on pipelines whose output legitimately contains error text. E2E-verified through the real terminal tool path: hint fires on masked cargo-style failures, silent on bare commands, clean pipes, and grep/printf pipelines. 42 targeted tests pass. * fix(desktop): defer credential-warning onboarding to the first chat attempt Switching to a profile with no provider configured popped the blocking onboarding overlay (Nous Portal / provider picker, "gateway isn't ready") the moment the profile's runtime info arrived — punishing the user for merely looking at an unconfigured bot/profile. The passive credential_warning (session create/activate/resume info, stream heartbeats) is now stashed instead of opening the overlay. The submit path consumes it when the user actually tries to chat and opens onboarding then, before the doomed send; the draft stays in the composer. A warning-free session event clears the stash, so healed or switched-away profiles never fire stale onboarding. Turn-error paths (a real failed send) still open onboarding immediately, unchanged. * fmt(js): `npm run fix` on merge (#87505) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * fix(agent): reject masked verification results * fix(cli): map all Ctrl/Alt/Shift+key combos under modifyOtherKeys level 2 Commit 4c34eeb416 stopped pushing the Kitty keyboard protocol (CSI >1u) because Ctrl+C arrived as ESC[99;5u instead of \x03, breaking SIGINT. But modifyOtherKeys level 2 (CSI >4;2m) was kept so Shift+Enter stays distinguishable from Enter. Under modifyOtherKeys=2, terminals re-encode EVERY Ctrl+key combo as ESC[27;5;<codepoint>~ instead of the raw control byte. prompt_toolkit 3.x only maps ESC[27;5;13~ (Ctrl+Enter = Ctrl+M); all other Ctrl+letter combos are unmapped and leak as literal text or get swallowed — breaking Ctrl+A, Ctrl+C, Ctrl+D, Ctrl+E, Ctrl+K, Ctrl+R, Ctrl+U, Ctrl+W, Ctrl+Z, etc. Shift+letter combos (ESC[27;2;<codepoint>~) have the same problem, causing the 'caps locked sessions' symptom where typed text appears corrupted or stuck. Fix: add install_modify_other_keys_aliases() to pt_input_extras.py that populates prompt_toolkit's ANSI_SEQUENCES dict with 294 mappings covering: - Ctrl+letter (a-z): ESC[27;5;<code>~ and ESC[<code>;5u -> Keys.ControlA..Z - Ctrl+digit (0-9): same formats -> Keys.Control0..9 - Ctrl+symbol ([ \ ] ^ _ @ Space): same formats -> matching Keys.Control* - Alt+letter (a-z, A-Z): both formats -> (Escape, <letter>) tuple - Shift+letter (a-z, A-Z): both formats -> uppercase character Uses setdefault semantics — never clobbers existing mappings from install_shift_enter_alias or install_ctrl_enter_alias. The Ink TUI (Node.js) already handles this via a regex parser; prompt_toolkit 3.x uses dict lookup only, so we populate the dict. Refs #56684, #87711. * refactor: extract _install_paired helper, fix misleading comment, isolate test fixture Apply findings from /simplify-code 3-agent review: 1. Extract _install_paired() inner helper — the Ctrl, Alt, and Shift sections all repeated the same mok+csiu sequence generation pattern (~30 lines of duplication). Now each section builds a dict and delegates to _install_paired(modifier, mapping). 2. Replace 10 hardcoded Ctrl+digit lines with a loop matching the Ctrl+letter pattern above it. 3. Fix misleading comment: claimed 'Ctrl+0 doesn't produce a control byte' but chr(ord('0') & 0x1F) = 0x10 = ControlP. The code was correct (maps directly to Keys.Control0..9); only the comment was wrong. 4. Add comment explaining why Shift+letter maps both lowercase and uppercase codepoints (some terminals send the already-shifted codepoint with modifier=2). 5. Test fixture: snapshot/restore ANSI_SEQUENCES in teardown so 294 mappings don't leak into sibling test files (global mutable state). * chore: map justin@bowes.org to @justinbowes Attribution mapping for the PR #84982 salvage. The commit email is not linked to a public GitHub account, so contributor_audit --strict fails without it; login confirmed from the PR author field. * feat(desktop): unify MCP Servers and Catalog into one coherent list The MCP tab's left column previously split the configured fleet and the Nous-approved catalog behind a Servers/Catalog tab toggle. Installed entries appeared in both views and the install button lived a tab flip away from the list it fed. Now one scrolling column: configured servers (live status, toggles, probes) on top, a Catalog section below offering only entries not yet installed. Installing moves the entry up into the fleet list; the zero-servers empty state keeps the catalog visible beneath it instead of hiding it behind a full-page invitation. Bot Mode's Advanced view embeds this same McpTab via the plugin SDK, so the unification mirrors there automatically. - removed leftView state + TextTab toggle; section headers reuse the existing tabServers/tabCatalog strings (no i18n changes) - availableCatalog memo filters installed/name-clashing entries - catalog memoized to satisfy react-hooks/exhaustive-deps * perf(desktop): make session resume incremental * test(tui): wait for deferred profile DB close * test(desktop): preserve bounded deferred resume * test(tui): isolate deferred hydration worker * docs(tui): document defer_history vs omit_messages precedence Follow-up to the #62799 salvage: Desktop sends both defer_history and omit_messages on a cold resume. Make explicit in the deferred branch that defer_history supersedes omit_messages — the single history read happens in the background hydration worker and the synchronous omit_messages read on the cold-resume default path is skipped entirely, so the transcript is never loaded twice for one resume. * feat(desktop-sdk): host.deleteProfile — teardown-routed profile delete for plugins Plugins deleting profiles via `cli.exec ['profile','delete',…]` bypass the Electron-side DELETE /api/profiles interception (prepareProfileDeleteRequest), so a live pool backend — e.g. one the roster's hover pre-warm just woke — holds the profile dir open and the renderer's reconnect respawns it mid-delete, recreating the directory (#52279). Bot Mode's right-click Delete hits this every time because right-click hovers the row first. Add host.deleteProfile(name) to the plugin SDK: routes through the same teardown-routed REST path core's DeleteProfileDialog uses (backend teardown first, next request routed away), rejects on 'default', and re-homes the app to the default profile when the deleted profile was the live gateway's — mirroring the core dialog's ordering. Reported by @BkashJosi (Bot Mode: deleting a bot errors while its session is awake). * fix(gateway): release loop ticks after empty responses * fix(gateway): isolate post-turn loop failures * fix(install): capture npm output on failure for diagnosable errors (#87340) Both install-blocking npm install call sites (browser tools and TUI) ran with --silent and no output capture, so failures printed only a generic error message with no npm diagnostics. Apply the same pattern used by the camofox install path: redirect npm output to a temp file and replay it on failure, so users can see the actual error (EBADENGINE, ETARGET, network timeout, registry 5xx, etc.). Fixes #87340 * fix(install): validate --commit SHA and fail hard on fetch/checkout errors (#87268) Three problems with install.sh --commit: 1. No validation: non-hex or too-short arguments passed through to git, producing misleading errors. 2. Fetch failure swallowed by || true: abbreviated SHAs are refused by GitHub's server ("couldn't find remote ref"), but the error was silently ignored. 3. Checkout failure not checked: git checkout --detach with a missing object produces a misleading "does not take a path argument" error and the install continues unpinned, exiting 0. Fix: - Validate --commit is a 7-40 hex string up front - Remove || true from fetch; fail with actionable message directing users to full 40-char SHAs - Check git checkout --detach result and fail hard on error Fixes #87268 * fix(webhook): authenticate Linear deliveries via linear-signature HMAC (#87348) * fix: persist computer_use provider selection so Desktop picker survives refresh The `computer_use` toolset (cua-driver) had no persistence branch in _write_provider_config or _is_provider_active. When the Desktop GUI sent PUT /api/tools/toolsets/computer_use/provider, the config write was a no-op and _is_provider_active always returned False -- so the "Use this backend" CTA reappeared on every refresh. Add a computer_use_backend marker to the cua-driver provider entry and handle it in the same pattern as web_backend / browser_backend: - _write_provider_config now sets computer_use.backend = "cua" - _is_provider_active now checks computer_use.backend - _reconfigure_provider (interactive CLI) also persists the key Fixes #86962 * fix(runtime): exempt loopback custom-provider pool credentials from the usable-secret floor Fixes #86864. Legacy custom_providers configs commonly used short/placeholder api_keys ('123', 'm') for local no-auth services like Ollama -- harmless for the endpoint itself, since Ollama accepts any key or no key. A stricter has_usable_secret(value, min_length=4) gate added later now rejects these, but only the credential-POOL resolution path lacked the same "no-key-required" exemption every OTHER resolution path in this file already has for exactly this scenario: - The config-based custom_providers fallback (non-pool path) already ends with `api_key or "no-key-required"`. - The "actual" provider's local-offline path already injects ACTUAL_LOCAL_NOAUTH_PLACEHOLDER before the usable-secret gate for a loopback base_url. - _try_resolve_from_custom_pool() was the one gap: it returned the raw short pool credential unchanged, which then failed the downstream has_usable_secret() gate with a generic "No usable credentials found for custom" error that contradicts setup.status ("configured credentials" vs "runtime failed"), sending users hunting in the wrong direction. Fixed by substituting the same "no-key-required" placeholder when the pool's stored credential fails has_usable_secret() AND the base_url resolves to a loopback hostname (using the existing _loopback_hostname helper, matching the exemption scope the issue itself requested: localhost/127.0.0.1/::1 only, not arbitrary remote endpoints with a genuinely-too-short key). Added 4 regression tests extending the existing test_runtime_provider_resolution.py file, following its established credential-pool mocking pattern: the exact reported 3-char repro ('123'), a 1-char case, a non-loopback sanity check confirming the exemption stays scoped (a short key for a remote endpoint is NOT silently exempted), and a sanity check that a genuinely usable loopback key passes through unmodified. Verified as a genuine regression by reverting the fix and confirming 2 tests fail with the exact raw short key leaking through unchanged. 59/59 pass in the extended test file; 14/14 across two more related custom-provider test files (no regression). * fix(cron): do not treat directories as unsafe lifecycle scripts (#86753) Docker Desktop writes fpath=(~/.docker/completions ...) into .zshrc. The referenced-script walk then opened that directory, saw a non-regular file, and fail-closed — blocking source ~/.zshrc on every terminal command. Directories are not scripts; devices stay fail-closed. * fix(gateway): read routed profile model config * fix(batch_runner): propagate fatal and validation errors as non-zero exit codes Python Fire serializes the return value of a wrapped function but does not use that value as the process exit code. Error paths in main() that used or therefore caused the process to exit 0, swallowing fatal errors and argument-validation failures. Raise SystemExit(1) on every error path so batch_runner returns a non-zero exit code when it cannot run. Success paths (e.g. --list_distributions) are left unchanged. Closes NousResearch/hermes-agent#86524. * fix(gateway): surface actionable message for local model server connection errors * fix(gateway): keep broad connection phrases out of the provider-error gate Fixes #86570 * fix(gateway): catch BaseException in _process_message_background to notify on SystemExit The fire-and-forget handler only caught asyncio.CancelledError and Exception, so a SystemExit/KeyboardInterrupt escaping a turn (e.g. a plugin calling sys.exit() in a tool call or summary-LLM path) skipped the user-facing failure notification and surfaced only as 'Task exception was never retrieved' — radio silence for the user. Catch BaseException instead; send the failure notification first, then re-raise SystemExit/KeyboardInterrupt to preserve shutdown semantics for the loop's own signal handling. Other BaseExceptions stay contained. Closes #86651 * fix(cli): use custom provider default_model when --provider is set hermes chat --provider <name> without -m sent the global model.default to the custom endpoint. Named custom entries already expose default_model via _get_named_custom_provider(); honor that when the user selected the provider and did not pass an explicit model. Fixes #86978 * fix(cli): warn when --provider default_model cannot be resolved A named --provider without -m used to swallow lookup failures and silently keep the global model.default. Log the resolution error so the fallback is visible. * fix(cli): allow persisted contributor tier consent * fix(mcp): prefer server-native tool over generated utility on name collision (#87112) An MCP server exposing a native tool named read_resource (or list_resources/list_prompts/get_prompt) collided with the auto-generated resource/prompt utility of the same name. The registration collision handler flagged the pair as ambiguous and skipped BOTH entries, so the server's own tool became silently unavailable on every gateway boot. Resolve this specific native-vs-utility collision in favour of the native tool: keep it and drop the shadowed utility, which is only convenience sugar for servers that expose no such tool of their own. The conservative skip-everything path still applies to genuinely ambiguous collisions (two or more native tools normalizing to one name), which we cannot disambiguate. Add a regression test covering the native-tool-wins path. Fixes #87112 * fix(desktop): restore mod-chord keybinds while typing in inputs #86586 replaced the combo-based input gate (any Cmd/Ctrl chord fires while typing) with an action allowlist that dropped session.new and every other mod-chord not explicitly listed. ⌘N/⌘T/⌘⇧N and friends became dead keys whenever focus was in the composer. Restore the pre-regression rule: primary-modifier chords stay global even in text fields; the allowlist now gates only bare/Shift/Alt combos, so rebound letter keys can never hijack typing. Text-navigation chords (Ctrl+Arrow/PgUp/PgDn) still stay with the input. * fix(desktop): reject bare modifier combos in the input gate Review NIT: a malformed stored binding of just 'mod'/'ctrl' (never produced by comboFromEvent) could pass the shape-only mod/ctrl check. Reject bare-modifier bases in actionAllowedInInput and pin it in the suite. * fix(agent): preserve local reasoning timeout opt-out * fix(approval): deterministic approvals.single_query_mode for -q sessions hermes chat -q sets HERMES_INTERACTIVE=1 (for interactive sudo prompts) but runs one turn with no user waiting to answer approval prompts. Previously a dangerous command triggered the interactive gate, waited the full 300s timeout, then failed closed — and the agent was effectively forced to work around the block, often silently auto-approving via execute_code (which auto-approves in non-gateway mode). Add approvals.single_query_mode (default deny, mirror of cron_mode): deny — block dangerous commands and execute_code deterministically with a clear 'no user present' message (no 300s wait) approve — auto-approve dangerous commands/execute_code in -q mode cli.py marks the session with HERMES_SINGLE_QUERY_SESSION; the shared gate (_run_approval_gate, check_all_command_guards, check_execute_code_guard) treats -q as a deterministic non-interactive context when that marker is set. execute_code, the -q escape hatch, now honors single_query_mode instead of auto-approving headlessly. Includes tirith parity in the combined guard and docs. Fixes #86878. * fix(gateway): treat Ready scheduled tasks as Windows supervisors After the VBS/cmd launcher exits, Task Scheduler marks Hermes_Gateway_* Ready while the detached gateway keeps running. The orphan reaper only bailed on Running, then fail-opened the parent-chain check and killed the live bot on desktop serve start. Fixes #87001 * fix(gateway): preserve launchd supervisor marker across stderr_timestamp wrapper launchd only stamps XPC_SERVICE_NAME on its direct child. The timestamp wrapper is that child, so the grandchild gateway sees XPC_SERVICE_NAME=0 and the supervised-conflict guard refuses the service's own spawn. Forward HERMES_GATEWAY_EXTERNAL_SUPERVISOR=1 when the wrapper itself is launchd-supervised. Interactive XPC_SERVICE_NAME=0 starts stay unmarked. Fixes #86893 * fix(gateway): put --external-supervisor on launchd gateway argv hermes update decides restart ownership from the live grandchild argv, not from an env marker. Newly generated plists now include the flag. The stderr_timestamp wrapper upgrades only historical Hermes gateway run shapes for stale plists and leaves arbitrary launchd children unmarked. * fix(agent): preserve stalled-provider escalation * fix(agent): cover provider wait teardown paths * fix(sessions): surface open sessions skipped by prune * fix(sessions): address prune skip review notes * fix(sessions): align prune filter derivation * fix(agent+discord): guard truncated-response continuation loops and cap Discord split delivery (#86581) * fix(agent): bound worker finalization when iteration budget exhausted (#87096) Adds a bounded fallback path in turn_finalizer.py that always records a terminal timed_out outcome via _record_task_failure (CAS receipt path) when the iteration budget is exhausted, regardless of whether the normal fallback paths (interrupted/failed/anomalous exit_reason) were eligible. Previously, a kanban worker whose budget was exhausted but whose turn was interrupted, failed, or exited with an anomalous reason would silently leave its task in an ambiguous lifecycle state — the dispatcher would eventually detect it as a crashed or protocol-violation worker, but the failure was not bounded and could take a full tick cycle to reconcile. The CAS invariant in _end_run (WHERE ended_at IS NULL) guarantees idempotence: if another path already closed the run, the call is a no-op. Extracted the inline kanban-budget-exhausted recording into a shared helper function (_record_kanban_budget_exhausted) used by both the existing iteration_limit_fallback path and the new bounded fallback path. Closes #87096 * fix: guard exit watchdog against mid-cleanup overlap * fix(desktop): hard-exit a lock-losing second instance before ready app.quit() does not stop a lock-losing instance from reaching whenReady: the before-quit teardown coordinator defers the quit (event.preventDefault + async backend shutdown), and ready fires in that window. The losing instance then runs the full startup whose reapOrphans() SIGTERMs the running instance's live backend (#87295). The lock-loser holds no state and no backend — requestSingleInstanceLock() has already delivered the argv to the primary by the time it returns false — so there is nothing to clean up. app.exit(0) terminates immediately, before ready, so a second launch routes into the running window and never touches backend machinery. * fix(desktop): keep startHermes inert without the single-instance lock startHermes() is the only entry point that can reap, spawn, claim, and therefore destroy a backend. Belt-and-suspenders on the exact killing line: even if some future path reaches it in a lock-losing process (a refactor, a dev harness, a race), the instance stays inert — no reap, no spawn, no claim — instead of SIGTERMing the running instance's backend (#87295). * fix(desktop): never reap a backend whose parent Electron is alive reapOrphans() treats any recorded backend with a matching process identity as orphan-reapable — including a backend owned by another live instance. The ownership file is shared across instances, so a second launch that reaches reap (even without the lock) SIGTERMs the running instance's backend. Claims now record the spawning Electron (parentPid + parentStartMarker, the same values already passed to the backend as HERMES_PARENT_PID / HERMES_PARENT_START_MARKER), and reapOrphans() skips any entry whose parent is still running. Even a second instance that wins a stale lock can never kill a live instance's backend. Legacy entries without parent data keep the old behaviour. Known tradeoff: a parent-liveness probe failure preserves the record, so a genuinely orphaned backend under a still-running parent is leaked until it dies naturally. That is preferable to killing a live instance's backend. Tests: parent-aware reap in backend-ownership.test.ts (live parent preserved, dead parent still reaped, probe failure preserved, parent identity round-trips through claim/parse). * fix(agent): include timezone and UTC offset in system prompt timestamp The "Conversation started:" line carried a bare date (%A, %B %d, %Y). Tools that accept instants -- nutrition, calendar and similar MCP servers -- reject naive datetimes and require an explicit UTC offset, so the model had to infer EST vs EDT from the date alone. Near a DST boundary that is a coin flip, and a wrong guess does not error: it silently writes the record onto the wrong day. Append the IANA zone (when configured), the zone abbreviation and the UTC offset, e.g.: Conversation started: Saturday, August 15, 2026 (America/New_York, EDT, UTC-04:00) get_timezone() returns None when no timezone is configured; in that case the line falls back to the abbreviation and offset of the server-local (still tz-aware) time, so behaviour is unchanged for users who never set one: Conversation started: Saturday, August 15, 2026 (EDT, UTC-04:00) Daily byte-stability is preserved -- the property the date-only format exists to protect (PR #20451). Zone name, abbreviation and offset are all constant for the whole day; they shift only at a DST transition, where a change is correct. The static-prefix reconstruction guard in _restore_plugin_sections matches on "\n\nConversation started:" and is unaffected by a suffix after the date. test_datetime_is_date_only_not_minute_precision used `re.search(r":\d{2}")` over the whole line as a proxy for "no time-of-day". A UTC offset also matches that pattern, so the check now applies to the date portion (everything before the zone parenthetical) and the invariant is tightened rather than relaxed: - test_datetime_includes_utc_offset asserts the offset is present - test_datetime_line_is_stable_across_rebuilds asserts two rebuilds in the same day produce a byte-identical line Fixes #87403 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(gateway): make managed Node suppress PATH fallback * fix(agent): canonicalize duplicate tool call arguments * fix(agent): harden canonical tool call deduplication * fix(gateway): let an explicit workspace move win for a running session session.workspace.move refused a running live session with 4009 (session busy), but the desktop's Move-to-project flow calls exactly this RPC — so the UI updated its local grouping while state.db kept the old cwd and the agent's tools kept running in the old workspace. Two sources of truth disagreed (#86626). An explicit move now wins: the stored row and the live session re-anchor together. In-flight tool calls keep the cwd they were launched with; the next tool call uses the new workspace. * fix(ui): ignore inherited esbuild binary overrides * fix(ui): scrub esbuild override during builds * fix(codex): clamp xAI max/ultra aliases to the model's reasoning ceiling (#87279) * fix(backup): bound locked database snapshot waits * fix(gemini): raise maxOutputTokens when thinking is enabled Gemini bills thought tokens against maxOutputTokens/max_tokens, so a global 4096 cap can be fully consumed by thinking on the first request, leaving zero content tokens and aborting after 4 continuations. When thinking is enabled, raise the effective output cap to the 65,535 ceiling on both the native and chat-completions paths. Refs #83915 * fix(gateway): don't crash on a foreign XDG_RUNTIME_DIR in user-systemd preflight (#86558) runuser/su/sudo -u from a root shell leaks XDG_RUNTIME_DIR=/run/user/0 into the child. _user_systemd_socket_ready() stat-ed sockets under it with a bare Path.exists(), which only suppresses ENOENT/ENOTDIR/EBADF/ELOOP — EACCES on the 0700 root-owned dir escaped as a raw PermissionError traceback instead of the documented UserSystemdUnavailableError remediation path. - _path_exists_safe(): Path.exists() that treats EACCES as absent; used at both the readiness and DBUS-detection call sites. - _ensure_user_systemd_env(): drop an XDG_RUNTIME_DIR that is unset or owned by another user in favour of our own /run/user/{uid}, so the restart actually succeeds after su/sudo -u instead of only failing cleanly. Regression tests cover the EACCES readiness probe, foreign-dir replacement, and that preflight raises UserSystemdUnavailableError (not PermissionError). * fix(agent): do not let hygiene idle timeouts block in-agent compression Session hygiene persists compression_failure_cooldown_until after a 30s no-progress watchdog so the pre-agent pass can skip. The in-conversation compressor read the same column and then refused to run even though its own budget is sufficient. Ignore hygiene idle-timeout errors on the in-agent path. Real aux-model faults such as rate limits still block. Fixes #86972 * fix(agent): clear in-memory cooldown when hygiene overwrites the shared row A later hygiene idle-timeout write can replace an aux-model cooldown on the shared column. Drop the in-memory timer on that refresh so the in-agent compressor is not still blocked after the DB row is hygiene. * fix(gateway): persist hygiene failure cooldown rung * fix(gateway): offload hygiene streak persistence * fix(skills): resolve skills dir before relative_to so junction installs work (#86971) * fix(telegram): honor group_allowed_chats in early auth under multiplex profiles (#87132) With gateway.multiplex_profiles enabled, the primary Telegram message handler is the closure returned by _make_default_profile_message_handler(), so its __self__ is absent. The early intake filter (_is_user_authorized_from_message) recovered the GatewayRunner via self._message_handler.__self__ and, finding none, fell back to env-only authorization — never evaluating the configured chat allowlist through GatewayRunner._is_user_authorized(). Every non-global sender was then default-denied in an explicitly allowlisted group. Prefer the platform-bound authorization callback registered via set_authorization_check(): it routes through the runner's full auth chain (platform + group allowlists, pairing store, allow-all) and survives the closure wrapping, whereas the bound-handler lookup does not. The bound handler remains the fallback for setups without a registered callback, and the pairing-passthrough guard for unknown DMs is preserved. Fixes #87132 * fix(desktop): close safe preview blockers before update * fix(desktop): identify unsafe update blockers * fix(gateway): keep persisted model routes consistent * fix(desktop): don't cancel the running turn on Esc while an overlay is open The composer's global Esc-to-cancel listener (useComposerEscCancel) fires whenever the turn is busy and the active composer matches — but overlays (Settings, Command Center, agents, cron, …) cover the chat while the composer stays mounted and 'active' beneath them, so pressing Esc on any of those pages interrupted the session the user wasn't even looking at. OverlayView's own escape-layer Esc-to-close fired too, but the stream was already dead. Stand Esc down with composerFocusBlockedBySurface() — the same signal the type-to-focus path uses (BLOCKING_OVERLAY includes OverlayView's [data-overlay-surface] marker). Esc on an overlay now closes the overlay via its escape layer instead of canceling the stream beneath it. Fixes #82618 * fix(caching): engage prompt caching for LiteLLM Claude on the OpenAI wire anthropic_prompt_cache_policy() only granted Anthropic cache_control markers to LiteLLM over the native Anthropic wire (api_mode == "anthropic_messages"). A LiteLLM deployment exposing the OpenAI-compatible surface instead (/v1/chat/completions, /v1/messages -> 404) matched no grant branch and fell through to (False, False): no cache_control injected, the system prompt sent as a plain string, and the provider serving zero cache hits -- the entire prompt re-billed at full price on every turn. Silent: no error, no warning, usage simply shows 100% uncached input forever. Add one branch after the is_anthropic_wire/is_claude case that grants caching to Claude-family models on a LiteLLM endpoint regardless of wire, with the native inner-block layout. Same failure class already documented in-function for Qwen/DashScope. Design: - Gated on the Claude family only (is_claude); a Gemini/GPT/Qwen route through the same proxy must not receive markers (they may reject the cache_control block format -- cf. the DeepSeek/OpenCode exclusion). - Matches on provider string OR base_url host, since provider naming varies per install (litellm, custom:litellm, or a bare custom alias pointed at a LiteLLM host). - prompt_caching.cache_ttl: false still wins (the _cache_disabled early return is untouched). - Generic strict OpenAI-wire custom providers (e.g. Fireworks) remain excluded -- verified by the existing over-reach regression test. Tests: adds TestLiteLLMOpenAIWire covering the grant (several model spellings x provider/host signals), no-over-reach (non-Claude on the same proxy get nothing; operator disable wins), and adjacent behavior (LiteLLM in Anthropic proxy mode still native layout). Full module: 43 passed. Closes #84506. Original diagnosis, patch design, and measurements by @ottosulin. * fix(caching): use the envelope layout for LiteLLM Claude on the OpenAI wire Follow-up to the salvaged LiteLLM cache grant. The grant itself is right; four things about how it was scoped were not. 1. Layout. The branch returned the native inner-block layout (use_native_layout=True) on api_mode == "chat_completions". That layout writes a TOP-LEVEL msg["cache_control"] on role:tool and empty-content messages and depends on the Anthropic adapter to relocate it into the block — but that adapter only runs for api_mode == "anthropic_messages" (agent/transports/anthropic.py registers there), and the chat_completions transport does no relocation. Measured on a 3-tool-turn transcript: 2 of the 4 available breakpoints landed on markers the provider never sees. Worse, when LiteLLM itself relocates a top-level marker for an OpenRouter-backed Claude route (OpenrouterConfig._move_cache_control_to_content), the marker lands on an empty assistant turn and produces a cache_control-marked empty text block — the HTTP 400 "text content blocks must contain" shape already guarded in agent/anthropic_adapter.py (#69512). Switched to the envelope layout, matching every other OpenAI-wire grant in this function: 4 of 4 breakpoints honored, zero empty blocks. 2. Host matching. `"litellm" in base_url_hostname(...)` is the substring false-positive class base_url_hostname's own docstring warns against; it granted Anthropic markers to notlitellm.example.com, foolitellmbar.example and friends. Replaced with a label-token match in a named helper, so "litellm" must be a whole dot- or hyphen-delimited token. All three of the original test hosts still match; a "litellm" path segment on an unrelated host still does not. 3. Transport gate. `not is_anthropic_wire` also swept in codex_responses, bedrock_converse and codex_app_server. Gated on api_mode == "chat_completions" explicitly. 4. Operator override. The grant is inferred from a provider/host name, but the custom-provider capability lookup was gated on is_anthropic_wire, so an explicit `prompt_caching: false` for the route+model was honored on /v1/messages and silently ignored on /v1/chat/completions. The lookup now also runs for a LiteLLM route, and its layout follows the transport rather than the declaration (an explicit `true` must not promote a chat_completions request to the native layout). Tests: 64 passed. Adds the wire-shape contract the original matrix was missing (asserts no breakpoint sits on the message envelope, rather than only checking the returned tuple), plus lookalike-host, other-transport, and both operator-override directions. All five guards mutation-checked — reverting each fix turns the corresponding test red. * fix(caching): match the litellm provider id token-wise too Self-review follow-up. The previous commit fixed substring matching on the HOST but left the provider-id side as a bare substring, so a user-named provider like `custom:notlitellm` or `mylitellmthing` still matched and was handed Anthropic markers — the same bug class, half-fixed. Both signals now match `litellm` as a whole delimited token via a shared helper. Real spellings (`litellm`, `custom:litellm`, `litellm-router`, and the already-lowercased `LiteLLM`) still match; lookalikes no longer do. Tests: 71 passed. Adds lookalike-provider and real-spelling guards; both new guards mutation-checked. Differential matrix over 2688 configs vs origin/main: 60 changes, every one a Claude model on a genuine LiteLLM route getting the envelope layout, zero pre-existing routes altered. * perf(caching): narrow the widened capability lookup to the LiteLLM grant Self-review follow-up, caught by benchmarking the previous commit. Widening the custom-provider capability-lookup gate to `is_anthropic_wire or _is_litellm_route(...)` made EVERY chat_completions route with a litellm-ish provider/host enter the lookup, including non-Claude models that the grant branch below can never match. Measured on a route with no config.yaml (the uncached worst case) that was ~7.5us -> ~1528us per evaluation. Narrowed the gate to the exact condition the LiteLLM branch grants on (chat_completions + Claude + litellm route), computed once into a local and reused by the branch itself so the predicate no longer runs twice. Measured with a realistic config.yaml present (mtime cache warm), vs origin/main: live-agent policy 20.6us -> 61.7us destination planning 219.3us -> 347.7us Sub-millisecond and scoped to the routes that actually opted in. The earlier 1.5ms figures were a tempdir artifact: load_config_readonly's mtime cache cannot engage when no config.yaml exists, which is never true of a real install. Non-LiteLLM and non-Claude routes are unaffected (openrouter Claude measured flat at ~7.9us). Tests: 82 passed across the policy and TTL-propagation modules. * test(caching): pin signal precedence and the openrouter-host opt-out Review follow-up. Three coverage gaps in the LiteLLM matrix: - The operator opt-out on a litellm-named provider pointed at an OpenRouter host. That route previously took the OpenRouter branch and ignored an explicit per-model `prompt_caching: false`; it is the only cell in the differential matrix where the salvage REMOVES caching, so pin it as intended rather than leaving it to be read as a regression. - Signal precedence: an explicitly litellm-named provider grants even on a lookalike host, because the provider id is an independent signal and only the host-derived signal is token-gated. Intentional, now documented. - A hyphen-delimited host label (`my-litellm-gw.internal.example.com`), which the token matcher handles but nothing exercised. Traded the redundant `claude-3-7-sonnet` parametrize cell for the new host case, so the matrix covers more shapes with the same cell count. Tests: 83 passed. All three production fixes re-mutation-checked against the final stack. * fix(web_server): discover root user plugins under profile-scoped processes When the backend is spawned profile-scoped (`--profile <name>` sets HERMES_HOME=<root>/profiles/<name>), _discover_dashboard_plugins() scanned only get_process_hermes_home()/plugins — the profile directory, which has no plugins/ content. Pooled per-profile backends therefore discovered zero user plugins, mounted no plugin API routes, and every plugin REST call fell through to the SPA catch-all 404. Also scan get_default_hermes_root()/plugins (which unwraps <root>/profiles/<name> to <root> and leaves a custom HERMES_HOME untouched when it is itself the root), matching how hermes_cli.plugins resolves install locations. The profile home is scanned first, so a profile-local plugin of the same name stays authoritative via the existing seen_names dedupe. Adds regression tests for root-plugin discovery under a profile-scoped process and for profile-over-root precedence. Fixes #87197 (plugin discovery half — the misleading /api/* catch-all half is addressed separately in #87270). * fix(telegram): keep /loop and synthetic sends in the active DM topic Fixes #87051 * fix(desktop): show failed status for timed-out subagents in fallback stream path Fixes #87200 * fix(desktop): match custom provider aliases in model catalog menu Fixes #87035 * chore(contributors): map emails for P2-sweep salvage wave * fix(desktop): avoid PowerShell parent marker boot gate * fix(desktop): give Windows start-marker PowerShell probe a 30s budget PowerShell 5.1 cold starts take 2.4-8s on affected Windows hosts, so the shared 3s execText timeout hard-failed the parent start-marker probe for any PID that still needs the PowerShell path (e.g. backend children). Make execText's timeout overridable and raise the marker probe to 30s. Fixes #87169 * perf(desktop): hydrate transcripts with a small tail page + on-demand older-page backfill Replace the fixed 500-message REST hydration (getLatestSessionMessages) with a 120-row newest-first tail page. When the page comes back full, a new per-session tail store records "possibly truncated + next offset"; "Show earlier" — once the DOM budget and the in-memory store window are both exhausted — fetches the next older page via the new getOlderSessionMessages helper (order latest + offset, matching the backend's back-from-newest paging semantics) and prepends it to the session store, deduped by durable row id and race-guarded against session switches. Legacy backends without pagination metadata fall back to the one-shot full transcript and retire the action. Tail-page refreshes (background sync, post-turn rehydrate, re-activate, cold-resume prefetch) graft the refreshed tail onto any backfilled prefix instead of clobbering it, preserving reference identity on no-ops. includeCompacted stays on every read — compaction-archived rows remain part of the durable display history. * feat(desktop): MCP fleet cost/usage overlay with schema token estimates and 30-day usage Each configured server row on the MCP Capabilities page now shows what it costs and whether it earns its keep: - ~per-call token estimate of the server's tool schemas, summed over ENABLED tools only (ceil(schema_chars/4) via the existing include/exclude filter) - 30-day usage count from getUsageAnalytics(30), cached per scope profile like the Toolsets tab's toolCallsCache, mapped to servers via the mcp__<server>__<tool> registry-name convention (tools/mcp_tool.py) - a subtle muted "unused" pill on enabled, probed-ok servers with nonzero schema cost and zero 30-day uses — never a dialog Backend: the /api/mcp/servers/{name}/test probe now fills an additive per-tool `schema_chars` (length of the SAME converted registry schema the agent registers). Older backends omit it → renderer shows counts only; older renderers ignore the extra key. Display-only: nothing changes what schemas are sent to models, no config knobs. i18n keys (costTokens/usage30d/unusedPill) added to types/en/zh/zh-hant/ja (ar inherits en via defineLocale overrides). Pure math lives in lib/mcp-cost.ts with unit tests; Python wire shape pinned in tests/hermes_cli/test_web_server_profile_unification.py. * fix(tui): map lineage edit ordinals past compression prefix Desktop/TUI count full displayed lineage after compression, but prompt.submit validated truncate ordinals against tip-only history. Translate via display_history_prefix and recover stale 4018s on Desktop. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(desktop): hoist GatewayMock type into #82462 edit recovery suite CI typecheck failed because GatewayMock lived only in the previous describe. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(desktop): hermes:// deep link to install MCP servers with explicit confirmation Adds hermes://mcp/install?name=NAME&config=B64 (base64url or standard base64 JSON), mirroring Cursor's mcp/install deep link, so vendors and docs can offer an "Add to Hermes" button. - Electron: the existing generic hermes:// handler already forwards {kind, name, params}; only its comment is updated (no new handler). - Renderer: use-desktop-integrations routes kind=mcp/name=install into a pending-install store; a new confirmation dialog shows the server name and the FULL pretty-printed config (attacker-controllable input), with a prominent caution for stdio command entries. Nothing is written until the user confirms; existing names require a rename or cancel. On confirm the server is merged over a fresh fetch of the current map via saveMcpServers, then navigation lands on /skills?tab=mcp&server=… so useDeepLinkHighlight focuses the new row. - Validation: name ^[A-Za-z0-9._-]{1,64}$; config must decode to an object with a string http(s) `url` or a string `command` (never both); payloads over 32KB rejected; failures surface as a toast. - Pure parser in src/lib/mcp-deeplink.ts with unit tests (url shape, command shape, bad base64, non-object, javascript: URL, oversized). - i18n keys in types + en/zh/zh-hant/ja/ar. - Docs: "Add to Hermes link" section in the MCP config reference. * fmt(js): `npm run fix` on merge (#87599) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * feat(desktop): background MCP health checks with re-auth nudges MCP server problems (expired OAuth tokens especially) were only discovered when the user visited the MCP page and a probe ran. Now a renderer-side background checker (store/mcp-health.ts) sweeps the active profile's enabled HTTP/SSE MCP servers on gateway connect and every 30 minutes, and fires an in-app notification with a "Sign in" action ("<name> MCP needs re-authentication") that navigates to the MCP page with ?server=<name> so useDeepLinkHighlight focuses the server and its Authenticate button. Navigation only — OAuth flows are never auto-launched. stdio servers are deliberately excluded: probing a stdio server SPAWNS a local process, so a background timer must never touch them. Only url-shaped servers (where OAuth expiry lives) are swept, sequentially. The tab's probeCache/serverFingerprint/probeKey/NEEDS_AUTH_RE moved to a shared lib/mcp-probe-cache.ts (behavior identical) so the page and the checker share one probe cache and its 5-minute TTL — neither surface re-probes what the other just learned. Notifications fire only on a TRANSITION into needs-auth/error (pure state machine, unit-tested), hard-capped at one per server per app session, keyed per profile. Profile switches drop pending timers and re-arm for the new profile; sweeps never run while the gateway is disconnected. No new config knobs. i18n keys added across en/zh/zh-hant/ja/ar + types. * fmt(js): `npm run fix` on merge (#87607) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * fix(desktop): scope messaging to active remote profile Complete the sidebar profile-scope contract across remote Electron routing, older-backend fallbacks, standalone messaging refreshes, and pagination. Reject stale profile responses and keep the explicit all-profiles view unified. Co-authored-by: 墨綠BG <s5460703@gmail.com> Co-authored-by: liuhao1024 <sunsky.lau@gmail.com> * fix(desktop): retain messaging totals per profile Key resolved platform totals by Desktop profile and source so profile switches neither inherit another profile's count nor discard a count that was already resolved. Keep the full reset for connection configuration changes. Co-authored-by: frendo <frendo.wu@gmail.com> * fix(desktop): ignore stale messaging page responses Sequence per-profile platform pagination so an older overlapping response cannot replace a newer, larger page. * docs(desktop): document profile scope helpers Add JSDoc to the exported helpers introduced by the profile-scoped sidebar change. * fix(desktop): reject stale profile refreshes * fix(desktop): harden profile-scoped refreshes * fix(desktop): resolve sessions from sidebar caches Consult messaging and cron caches before the by-id fallback so opening a sidebar row neither depends on a redundant network lookup nor duplicates it into regular recents. Co-authored-by: protas-box <protas.box@icloud.com> * fix(tools-config): stop reconfigure flow clobbering image_gen.use_gateway on managed FAL rows The Nous Subscription image_gen row carries imagegen_backend="fal", so _reconfigure_provider's post-model-picker step ran img_cfg["use_gateway"] = False unconditionally at two sites, immediately after the managed branch had written use_gateway=True. A user who picked Nous Subscription and then re-entered `hermes tools` to change the model was silently flipped onto their personal FAL_KEY. Same bug class as fe63353cb, which fixed the plugin-provider selector but missed these two legacy-backend sites in the reconfigure flow. Both now write bool(managed_feature), matching the existing correct site in _configure_provider. Adds regression tests driven through the real TOOL_CATEGORIES managed row; sabotage-verified (tests fail with the old behavior restored). * feat(desktop): make the multi-gateway Connections registry discoverable The multi-connection registry (Settings -> Connections) shipped with no entry point outside the settings nav, and the product-owner report was blunt: 'I didn't see any obvious way to hook up multiple gateways.' - Profile rail: a plug pill pinned beside Manage ('Connect another Hermes gateway...') deep-links to /settings?tab=connections. Always visible, including for single-profile first-run users. - Command palette: Settings -> Connections is now a searchable entry (keywords: add gateway, remote, ssh, cloud, instances, registry). - i18n: profiles.connectGateway added to en/types/zh; other locales fall back through defineLocale. - Tests: profile-rail-connect.test.tsx covers the deep link and the single-profile visibility guarantee. * docs: full multi-gateway setup guide for Hermes Desktop Expand user-guide/multi-connection-desktop.md into a complete setup walkthrough: where to find the pane (settings nav, profile-rail plug, command palette), the exact add-connection editor fields (Name, Gateway URL, Authentication: Session token/OAuth, SSH host), Primary / This device pills, Test semantics, agent roster + profile-rail switching and per-profile session/cron/messaging scoping, token storage via Electron safeStorage with the keyring-less Linux plain- text opt-in, and troubleshooting. All quoted labels match the desktop i18n strings. Cross-link the rail entry point from desktop.md. * fix(desktop): never resolve a missing named gateway scope to the primary activeGateway() fell back to the primary gateway when the active key named a registry-agent scope (conn:<id>::<profile>) whose secondaries entry had been evicted — e.g. closeSecondaryGateways() during a soft gateway switch — so sends and session ops silently executed against the WRONG machine. A named scope now resolves to its own socket or null, and every eviction path (closeSecondaryGateways, pruneSecondaryGateways) explicitly restores the primary as active when it evicts the active scope, keeping the 'activeKey always resolves' invariant with the atoms following. * fix(desktop): sync connection atoms and share the switch mutex for agent activation ensureGatewayForAgent (the SDK ensureAgent door) skipped the two invariants the profile path provides: - $connection / $activeGatewayProfile were only updated when a socket was freshly dialed (setConnection inside openSecondary), so activating an ALREADY-OPEN registry agent left both describing the previous backend — /api/fs, /api/media and image.attach routed to the wrong machine (same class as #46651) and newSessionInProfile targeted the stale profile. - Activations bypassed the gatewaySwitch mutex, so a rapid agent/profile interleave could complete out of order with the earlier setActive() landing last. Add profile.ts ensureGatewayAgent: the (connectionId, profile) analogue of ensureGatewayProfile that shares the same gatewaySwitch mutex, moves $activeGatewayProfile on every activation, and resyncs $connection from getConnectionFor (best-effort, like the profile path). The SDK ensureAgent now routes through it; local/null connectionId falls through to the profile path unchanged. * feat(desktop): expose busy turn flags on plugin SDK Plugins can now read host.state.busy and host.state.awaitingResponse for the focused chat. These follow the same session slice the chat pane uses, so a draft falls back to the global flags and a background turn does not leak. * fix(desktop): make plugin SDK turn flags follow the focused chat Follow-up to the salvaged #87558 commit: the PR's docs promised the flags follow "the focused chat", but PRIMARY_SESSION_VIEW is the primary workspace tab only — a focused session TILE would read the wrong chat. Wire host.state.busy / host.state.awaitingResponse through the focused slice ($focusedStoredSessionId / $focusedSessionState), same semantics as the statusbar busy pulse, with the primary view (and its draft fallback) while the workspace holds focus. Adds a tile-focus vitest case and corrects the docs wording. * feat(desktop): paste-anything MCP server import Add a compact Import popover to the MCP Capabilities page that accepts anything a user might copy from an MCP server README and infers the server config: - mcp.json snippets (mcpServers-wrapped, bare name->config maps, single unnamed server objects, Cursor/Claude `type` normalized to `transport`) - bare npx/bunx/uvx/node/docker command lines (name inferred from the package basename, e.g. server-filesystem -> filesystem) - `claude mcp add NAME [--transport http|sse] [-e K=V] [-H ...] [--] CMD ARGS...` and `claude mcp add NAME URL` - bare http(s) URLs (name inferred from the hostname) - Cursor deeplinks (cursor://anysphere.cursor-deeplink/mcp/install with a base64-encoded JSON config payload) The parser is a pure module (src/lib/mcp-import.ts) with unit tests for every format plus garbage input. The popover previews the inferred name + config and, on confirm, merges the entries into the editor draft exactly like addServer's starter entry: unique keys, dirty (unsaved) draft, first new block focused. Placeholder env values (YOUR_KEY, TOKEN_HERE, ...) are kept verbatim for the user to edit in the editor before saving. i18n keys added under settings.mcp for en, zh, zh-hant, ja (ar falls back through defineLocale). * feat(desktop): running is not busy Gate composer submit and plugin host busy on the target session slice, not a leftover foreground busyRef. Staff can keep typing while a worker session is running. Includes the follow-up test that submit uses the target session busy flag. * fix(desktop): lint and map contributor email for running-is-not-busy Drop the redundant Boolean() on selected in $primaryBusy and add the professorpalmer9@gmail.com mapping so attribution CI can resolve the PR. * feat(desktop-sdk): expose focused-session state atoms to plugins Disk plugins read app state exclusively through host.state, which only exposed the primary workspace tab ($activeSessionId). In the multi-tile layout, clicking a tile never touches that atom — and tile focus is a pure renderer concern, invisible to both gateway RPC and the event stream — so a plugin cannot follow the session the user is actually looking at. The core statusbar solves this same problem by reading the focused- session atoms (use-statusbar-items.tsx). Widen the generic plugin surface with the same signals, per the contribution rubric: - host.state.focusedSessionId — runtime id of the focused session (interacted tile, else the primary), the key for session.* RPC - host.state.focusedStoredSessionId — durable id for navigation and session-list matching - host.state.focusedUsage — live streamed UsageStats projection (context_used/max/percent, tokens, cost_usd), no RPC needed Additive only; no existing behavior changes. tsc --noEmit clean. Verified end-to-end with a disk plugin that now tracks the focused session across tiles. * test(desktop-sdk): contract-test the focused-session host.state atoms Locks the plugin-facing contract: the focused atoms exist as readonly nanostores, mirror the primary session while no tile is focused, project the focused session's usage, and — the behavior this PR exists for — follow the interacted tile while the primary-only $activeSessionId stays put. * fix(desktop-sdk): type focusedUsage as Partial<UsageStats>, fix expect arity ClientSessionState.usage is Partial<UsageStats> (app/types.ts) — the backend streams whichever fields changed — so the computed produces ReadableAtom<Partial<UsageStats> | null>. Annotate the entry honestly instead of claiming full UsageStats, and document the fallback rule for plugin authors. Also collapse the three-argument expect() calls in the contract test (vitest takes one message arg). Addresses triage review on PR #80461. * fix(desktop-sdk): address adversarial review — type honesty, real tile coverage, docs Independent second-pass review found three gaps: - focusedUsage is null | UsageStats, not Partial — ClientSessionState.usage is the full type (app/types.ts) and its only write site seeds the four required fields before merging (gateway-event.ts). The earlier Partial annotation traced the wrong type (SessionRuntimeInfo, an RPC payload). Comment now names the genuinely optional fields instead. - The tile-focus contract test never seeded $sessionTiles/$sessionStates, so it proved focusedStoredSessionId…

The 'Conversation started:' line is built date-only and cached per session for prefix-cache stability (NousResearch#20451). A session running past UTC midnight kept yesterday's date forever. Record the stamped date at build time and rebuild the prompt exactly once per rollover at the turn-start hook (NousResearch#86938) — day granularity keeps the cache intact within each day.

fix: date-only timestamp to preserve KV-cache across same-day sessions

a839fad

The %I:%M %p time component changes every session, invalidating KV-cache attention for the system prompt. Removing it means same-day sessions share cache hits on the ~2-3k system prompt tokens.

alt-glitch added type/perf Performance improvement or optimization P2 Medium — degraded but workaround exists comp/agent Core agent runtime: loop, agent_init, prompt builder, context-compression, responses endpoint labels May 5, 2026

alt-glitch mentioned this pull request May 17, 2026

[Bug]: Prompt Cache / KV Cache Invalidation on Follow-Up Messages Due to Dynamic Tool Shuffling #27339

Closed

1 task

teknium1 mentioned this pull request May 18, 2026

perf(prompt-cache): date-only timestamp + loud gateway-DB roundtrip logging #27675

Merged

iamfoz closed this May 18, 2026

This was referenced May 19, 2026

perf(dashboard): gzip static files + long-term cache headers + plugin cache-bust sea-monsters/hermes-agent#1

Merged

perf(dashboard): gzip static files + long-term cache headers + plugin cache-bust #28543

Closed

iamfoz deleted the pr/kv-cache-timestamp-fix branch June 2, 2026 20:58

teknium1 mentioned this pull request Jun 7, 2026

feat(compression): temporal anchoring in compaction summaries #41102

Merged

akb4q mentioned this pull request Jul 8, 2026

Model has no awareness of current time: system prompt uses date-only timestamp with no harness-level time-sync mechanism #60765

Open

k-QRedHacker mentioned this pull request Jul 10, 2026

feat: time awareness subsystem for continuous temporal perception #61738

Closed

OutThisLife mentioned this pull request Aug 3, 2026

Cut per-turn latency: high reasoning effort and serial round-trips, not caching #77291

Open

lijiangsheng1 mentioned this pull request Aug 15, 2026

system_prompt timestamp stale after UTC midnight - model reports wrong date in long sessions #86938

Open

ayushnangia mentioned this pull request Aug 15, 2026

fix(agent): refresh the system-prompt date line when UTC rolls over #86942

Open

mkoistinen mentioned this pull request Aug 16, 2026

fix(agent): include timezone and UTC offset in system prompt timestamp #87404

Merged

1 task

Navigation Menu

Uh oh!

fix: date-only timestamp to preserve KV-cache across same-day sessions - #20451

fix: date-only timestamp to preserve KV-cache across same-day sessions#20451
iamfoz wants to merge 1 commit into
NousResearch:mainfrom
iamfoz:pr/kv-cache-timestamp-fix

iamfoz commented May 5, 2026

Uh oh!

iamfoz commented May 18, 2026

Uh oh!

teknium1 commented May 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants