fix(honcho): self-hosted localhost config and dialectic errors (#36098)

[xxxigm]

What does this PR do?

Fixes five Honcho self-hosted issues that together made multi-profile localhost setups fail silently (#36098):

1. apiKey inheritance — hosts.hermes.<profile> now falls back to hosts.hermes.apiKey, then root, then env.
2. localhost JWT — resolved config.api_key (including top-level) is passed to the SDK on localhost instead of being replaced with "local" unless empty.
3. Default timeout — HTTP default raised from 30s → 60s for dialectic workloads at reasoning_level≥medium.
4. Dialectic errors — failures return [honcho_error: TimeoutError] (etc.) instead of "" (which looked like “no relevant context”).
5. Profile honcho.json — sticky active_profile + ~/.hermes/profiles/<name>/honcho.json is loaded (merged over default) when HERMES_HOME is unset.

Related Issue

Fixes #36098

Type of Change

• Bug fix (non-breaking change that fixes an issue)

Changes Made

• plugins/memory/honcho/client.py — resolve_api_key_from_raw, load_honcho_config_raw, profile config path, _is_local key handling, _DEFAULT_HTTP_TIMEOUT = 60.
• plugins/memory/honcho/cli.py — CLI _resolve_api_key uses shared resolver.
• plugins/memory/honcho/session.py — dialectic_query error marker.
• tests/honcho_plugin/test_client.py, tests/honcho_plugin/test_session.py — regression tests.

How to Test

./scripts/run_tests.sh tests/honcho_plugin/test_client.py tests/honcho_plugin/test_session.py::TestDialecticQueryErrors -v

Manual: honcho.json with apiKey only under hosts.hermes, baseUrl: http://localhost:8000, and a hermes.<profile> host block without apiKey — hermes honcho status / reasoning should authenticate instead of 401 + silent empty context.

[mxnstrexgl]

LGTM — automated review passed. No security, quality, or test coverage issues detected.

[tonydwb]

Code Review Summary

Verdict: Approved ✅

Review

fix(honcho): self-hosted localhost config and dialectic errors (#36098)

Solid multi-part fix for Honcho self-hosted setups. Key observations:

• Coverage: 5 independent fixes in one PR — apiKey inheritance, localhost JWT handling, default timeout increase (30→60s for reasoning), dialectic error surfacing, and profile-specific honcho.json loading. Each fix addresses a distinct bug.
• Organization: Well-structured across 3 source files + 2 test files. The shared resolve_api_key_from_raw helper eliminates duplication between client.py and cli.py.
• Error handling: Dialectic failures now return descriptive error markers instead of empty strings — eliminates the confusing "no relevant context" silent failure mode.
• Tests: 93-line client test additions + 20-line session test additions.

Looks Good

• Each fix has clear motivation and scope
• Shared helpers reduce maintenance burden
• Backward compatible

---

Reviewed by Hermes Agent

[teknium1]

Thanks for the focused reproduction and regression coverage. The current-main premise is real: HonchoClientConfig.from_global_config() lacks the hosts.hermes credential fallback (plugins/memory/honcho/client.py:443-447), loopback handling substitutes "local" without a host-local key (plugins/memory/honcho/client.py:879-887), and dialectic exceptions return empty text (plugins/memory/honcho/session.py:662-664).

Problems

• plugins/memory/honcho/client.py:905 removes the deliberate localhost auth boundary. Current main only sends a key to a loopback server when that host block explicitly opted in, preventing a stored cloud key from breaking an unauthenticated local stack; this was introduced by 827ce602d. The new unconditional resolved-key behavior reverses that safeguard.
• plugins/memory/honcho/session.py:661 makes failures look like successful dialectic text to automatic consumers. plugins/memory/honcho/__init__.py:722-729, :854-861, and :767-768 queue, mark successful, and inject any non-empty result, so [honcho_error: ...] enters prompt context and disables empty-result backoff.

Suggested changes

• Preserve explicit local-auth opt-in; re-scope shared-key inheritance without treating arbitrary root/default keys as local credentials.
• Carry dialectic failures separately, or classify them before prefetch storage/injection; add automatic-prewarm and queued-prefetch error tests.

Automated hermes-sweeper review.

[teknium1]

This removes the explicit local-auth opt-in. Current main intentionally substitutes "local" unless this host block has apiKey, so a stored cloud/default key cannot break an unauthenticated loopback stack (827ce602d; current client.py:879-887). Please preserve that boundary and add an explicit shared-local-JWT mechanism if inheritance is required.

[teknium1]

This non-empty marker is treated as a successful dialectic result by automatic prefetch: it is stored, resets _dialectic_empty_streak, and is appended into injected context (plugins/memory/honcho/__init__.py:722-729, 854-861, 767-768). Classify failures separately or prevent markers from entering those paths.

[teknium1]

Closing after re-verifying each part against current main (post #62290 / #66052) — this PR predates two rewrites of the config-resolution code it touches, and most of it has since been addressed by other routes:

1. Sticky-profile honcho.json resolution — already on main. resolve_config_path() now resolves $HERMES_HOME/honcho.json (profile-local) → default profile's ~/.hermes/honcho.json → global ~/.honcho/config.json. Verified E2E with a real profile layout: a named profile without its own file falls back to the default profile's config, and a profile-local file wins when present.

2. Default timeout bump (30→60s) — superseded by configuration. honcho.timeout in config.yaml now takes effect live even in long-lived processes (fix(honcho): salvage five community recall/config fixes onto current main #66052), so slow local hosts set exactly what they need instead of a new global default.

3. api_key fallback to the default host block — the one piece that's still real. A named profile resolves to its own host key (e.g. hermes_coder), and when that block has no apiKey the config comes back keyless even though the shared file has one on the default hermes host. However, main's resolve_active_host() documents named-profile isolation as deliberate design, so whether profile hosts should inherit the default host's static key is a design decision, not a rebase — tracked separately in a focused issue crediting this report.

Thanks @xxxigm — the #36098 report was accurate on all three fronts when filed; two got fixed by other salvages and the third is now tracked on its own.