chore(desktop): silence Vite chunk-size warning for intentional single bundle by teknium1 · Pull Request #38888 · NousResearch/hermes-agent

teknium1 · 2026-06-04T09:15:04Z

Summary

Builds of the desktop app no longer print the spurious "Some chunks are larger than 500 kB" warning — the single fat bundle is by design, so the warning was pure noise.

The renderer is bundled into one chunk on purpose (codeSplitting: false) because Shiki ships many dynamic chunks that make electron-builder OOM scanning thousands of files. That makes the ~22 MB index-*.js expected, but Vite warned on every build anyway.

Changes

apps/desktop/vite.config.ts: add build.chunkSizeWarningLimit: 25000 (kB), above the current ~22 MB bundle. Comment explains why. codeSplitting: false untouched.

Validation

vite.resolveConfig(..., 'build') against the edited config resolves chunkSizeWarningLimit to 25000 and keeps rolldownOptions.output.codeSplitting === false.
Config-only, additive change — no effect on the bundle itself; still alarms if the bundle ever grows past ~25 MB.

Infographic

…e bundle The desktop renderer is bundled as one chunk on purpose (codeSplitting: false) because Shiki's many dynamic chunks make electron-builder OOM scanning thousands of files. That makes the ~22 MB bundle expected, but Vite still nags with 'Some chunks are larger than 500 kB' on every build. Raise chunkSizeWarningLimit to 25000 kB so the cosmetic warning stays quiet while still firing as a regression alarm if the bundle grows well past today's size. Config-only; codeSplitting:false is untouched.

github-actions · 2026-06-04T09:16:03Z

🔎 Lint report: `hermes/hermes-bb04aed6` vs `origin/main`

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 9788 on HEAD, 9788 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 5081 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.

…e bundle (NousResearch#38888) The desktop renderer is bundled as one chunk on purpose (codeSplitting: false) because Shiki's many dynamic chunks make electron-builder OOM scanning thousands of files. That makes the ~22 MB bundle expected, but Vite still nags with 'Some chunks are larger than 500 kB' on every build. Raise chunkSizeWarningLimit to 25000 kB so the cosmetic warning stays quiet while still firing as a regression alarm if the bundle grows well past today's size. Config-only; codeSplitting:false is untouched.

…e bundle (#38888) The desktop renderer is bundled as one chunk on purpose (codeSplitting: false) because Shiki's many dynamic chunks make electron-builder OOM scanning thousands of files. That makes the ~22 MB bundle expected, but Vite still nags with 'Some chunks are larger than 500 kB' on every build. Raise chunkSizeWarningLimit to 25000 kB so the cosmetic warning stays quiet while still firing as a regression alarm if the bundle grows well past today's size. Config-only; codeSplitting:false is untouched.

…e bundle (NousResearch#38888) The desktop renderer is bundled as one chunk on purpose (codeSplitting: false) because Shiki's many dynamic chunks make electron-builder OOM scanning thousands of files. That makes the ~22 MB bundle expected, but Vite still nags with 'Some chunks are larger than 500 kB' on every build. Raise chunkSizeWarningLimit to 25000 kB so the cosmetic warning stays quiet while still firing as a regression alarm if the bundle grows well past today's size. Config-only; codeSplitting:false is untouched.

…hunk codeSplitting:false inlined every lazy()/dynamic import into the entry, so the whole 28.5 MB bundle — including 19 MB of shiki grammars and 3.1 MB of mermaid that nothing rendered — was parsed and evaluated on every cold start. The original single-chunk rationale (#38888: electron-builder OOMs scanning shiki's thousands of default chunks) doesn't require ONE chunk, just few: rolldown advancedChunks groups keep the file count at ~180. Ordering matters and is the subtle part: shared foundations (react, hast/ mdast utils, lodash-es/d3 commons) must match BEFORE the heavy groups, because rolldown merges an unmatched shared module INTO the heavy chunk that uses it — and then the entry statically imports 19 MB of shiki just to reach react, putting the whole chunk back on the boot path. Statically-reachable boot graph: 26.9 MB -> 7.7 MB.

* chore(contributors): map gercamjr for the #68945 salvage * fix(timeouts): add claude-fable to reasoning stale-timeout floor table claude-fable-5 is a Mythos-class reasoning model (1M context, 128K output, adaptive thinking per anthropic_adapter.py) but was missing from the _REASONING_STALE_TIMEOUT_FLOORS table. Without a floor entry it got the default 180s stale timeout (300s with context scaling), which is too short for fable-5's thinking phase on large contexts. Each stale kill bumped the cross-turn circuit breaker streak; after 5 consecutive kills _check_stale_giveup() fired immediately (elapsed: 0.00s), aborting all calls with "Provider has been unresponsive for 5 consecutive stale attempts." Users with 191K-token contexts hit this reliably. Add ("claude-fable", 600) — deep-reasoning tier alongside o1/deepseek-r1/ nemotron-3-ultra. The claude-fable slug matches claude-fable-5 and future variants via the existing right-anchor regex. * chore: add contributor mapping for reinbeumer@gmail.com Needed for PR #72677 attribution check. * fix(update): refresh runtime modules before lazy backends Refresh update-sensitive modules before lazy backend refresh so an in-place git update does not keep using pre-pull module objects when newly pulled code imports fresh helpers. Constraint: Issue #60242 reports post-update lazy backend refresh importing stale hermes_constants after a large Windows update. Rejected: Only clearing __pycache__ earlier | the update process can still hold old modules in sys.modules. Confidence: high Scope-risk: narrow Directive: Keep update-time lazy refresh guarded against in-process code skew after git pull. Tested: ./.venv/bin/python -m pytest tests/hermes_cli/test_update_autostash.py::test_cmd_update_reloads_runtime_modules_before_lazy_refresh tests/hermes_cli/test_update_autostash.py::test_reload_updated_runtime_modules_restores_new_hermes_constants_symbol -q Tested: ./.venv/bin/python -m pytest tests/hermes_cli/test_update_autostash.py -q Tested: ./.venv/bin/python -m ruff check hermes_cli/main.py tests/hermes_cli/test_update_autostash.py Tested: ./.venv/bin/python -m py_compile hermes_cli/main.py tests/hermes_cli/test_update_autostash.py Tested: git diff --check Not-tested: Windows v0.14.0 to v0.18.0 end-to-end update. * fix(update): close the stale-bytecode class with a launch-time checkout-fingerprint sweep The stale-.pyc bug class (#6207, #60242, live WhatsApp report: gateway ImportError 'cannot import name parse_model_flags_detailed' after /update) has one shared shape: the checkout's .py files change while __pycache__ retains bytecode from the previous revision, and a later process trusts the stale .pyc. Update-time clears can never fully close this class: 'hermes update' always executes the PRE-pull updater code, so hardening added to it takes effect one update late — and a manual 'git pull' never runs the updater at all. Class fix: - Launch-time guard in main(): compare the checkout fingerprint (cheap file reads via _read_git_revision_fingerprint, no git subprocess) against a .bytecode-fingerprint stamp; sweep __pycache__ once when they diverge. Covers manual pulls, old updaters, ZIP restores — every entry point (CLI, gateway service, desktop backend) passes through main(). - Record the stamp at all three update-time clear sites (git path pre- install, git path post-install, ZIP path) so a normal update never triggers a redundant launch sweep. - Sibling site: 'hermes plugins update' + dashboard plugin update now clear __pycache__ under the plugin dir after git pull (plugin trees live outside the repo guard). E2E validated: reproduced the stale-pyc shadowing (same-size same-mtime source swap → old symbol wins in a fresh process), confirmed the launch sweep restores the new symbol, no-ops when the checkout is unchanged, and re-sweeps on the next pull. Sabotage-tested: reverting the sweep fails 4 of the new tests. * docs(delegation,api): document stall detection, timeout metadata, /agents live status, runs-stream subagent lifecycle Catch the docs up to this week's delegation work: - delegation.md: structured timeout metadata fields (timeout_seconds/ timed_out_after_seconds/timeout_phase, #72403); new 'Stall Detection for Background Subagents' section (progress-based monitor, thresholds, grace window, stalled event metadata, root-cause fix note — #72227/ #72300/#72412); /agents per-child live activity on CLI + gateway; all-thread diagnostic dump note. - api-server.md: /v1/runs events stream now documents subagent.start/ subagent.complete forwarding, redaction, child_session_id, and the deliberate exclusion of per-tool child events (#72406). - sidebars.ts: register the subagent-lifecycle-api developer guide page (shipped in #72501 but absent from the sidebar). Docusaurus build verified. * fix(tui-gateway): guard entry signal installs to main thread Importing tui_gateway.entry from a worker thread raised 'ValueError: signal only works in main thread of the main interpreter' because signal.signal() was called unconditionally at import time. On the Desktop/WebSocket path, server._build() runs in a daemon thread and does 'from tui_gateway.entry import ensure_mcp_discovery_started' as the first import of entry (entry.main() is never run there), which crashed and aborted MCP discovery startup — every session then lost its MCP servers (e.g. Dart-mcp) with ClosedResourceError. signal handlers are process-global, so installing them only when the module is first imported in the main thread is sufficient; importing from a worker thread becomes a safe no-op. Fixes #72667 * fix: update signal guard test for _install_signal refactor (#72677) The change-detector test asserted 'hasattr(signal, "SIGPIPE")' in source. PR #72677 replaced inline hasattr+signal.signal with _install_signal() which does the same guard via getattr internally. Update the test to accept either form. * fix(desktop): preserve OAuth sessions in sidebar * fix(desktop): reuse global remote backend across profiles Keep non-primary profiles that inherit the app-global remote on the primary connection descriptor instead of creating processless pool entries that the idle reaper repeatedly removes. Preserve per-profile remote overrides and local pooled backends, and cover the routing policy with behavioral tests. Co-authored-by: Rodrigo Fernandez <rodrigo@nxtlevelsaas.com> * fix(desktop): retire pooled remote backends whose host went away A pooled backend entry pointing at a remote host has no child process, so the 'exit' handler that clears a dead local backend never fires. The renderer's 60s keepalive touch also spares it from the idle reaper. Nothing was left to retire the descriptor, so once the host went away the pool kept serving it and every profile bound to that host stayed broken until restart. Pooled remote descriptors now share the primary's liveness policy: probed on the same revalidate tick, keyed per base URL, and dropped only after the same consecutive-failure limit, so the next ensureBackend() rebuilds. Co-authored-by: Rodrigo Fernandez <rod@nxtlevel.dev> * fix(desktop): record main-process faults in desktop.log Electron pre-installs its own uncaughtException listener and only warns on unhandled rejections, so a main-process fault usually leaves the app running with the reason on stderr — which nothing captures when the app is launched from Finder or the Start menu. The fault never reaches desktop.log, so it is absent from `hermes debug share` and the user can only describe symptoms. Record both to desktop.log and flush synchronously, since a fault that does prove fatal leaves no chance for the batched async flush. Five loadURL calls were also unhandled, each able to leave a blank window with no explanation anywhere the user can send us; they now name the surface that failed. Co-authored-by: Rodrigo Fernandez <rod@nxtlevel.dev> * refactor(desktop): resolve profile backend routing from one table Three helpers each re-derived part of the same decision: which backend serves profile P, and does its REST path need a `?profile=` scope. profileUsesPrimaryBackend answered the first half, pathWithGlobalRemoteProfile answered the second, and ensureBackend re-checked globalRemoteActive() around both. Splitting one table across three predicates is how the global-remote case ended up registering reapable pool entries for a backend it never owned. resolveProfileBackendRoute() states the four routes in one place and returns the backend, the descriptor scope, and whether the path needs a query parameter. The call sites read the answer instead of recomputing it. One behavior change falls out: `hermes:api` now passes the primary profile through, so the primary no longer sends itself a redundant `?profile=<self>` on a global remote that already serves it. * chore: credit the contributors this cluster is built from Co-authored-by: Rodrigo Fernandez <rod-nxtlevel@users.noreply.github.com> Co-authored-by: sealca <sealca@users.noreply.github.com> Co-authored-by: Vitor Cepeda Lopes <TheAngryPit@users.noreply.github.com> Co-authored-by: Gille <4317663+helix4u@users.noreply.github.com> Co-authored-by: nrmjeremy <nrmjeremy@users.noreply.github.com> * fix(session): persist tool activity before projection * fix: follow-ups for salvaged PR #72425 - codex app-server sibling path: surface a WARNING (was silent debug) when the projected-message flush fails — same bug class as the main fix, but codex output has already streamed so fail-closed and agent_persisted=False are both wrong here (#860/#42039 duplicate-write hazard); loud durability gap logging instead. - map session_persistence_failed in _format_turn_completion_explanation so the user sees an actionable reason instead of 'The request failed: unknown error' + explainer test. - contributors/emails mapping for elco@thedaoist.gg (attribution CI). * test: set _incremental_persistence_failed=False on MagicMock agent PR #72425 added getattr(agent, '_incremental_persistence_failed', False) checks at the top of execute_tool_calls_{sequential,concurrent,segmented}. A bare MagicMock auto-creates a truthy value for any attribute access, so the interrupt-skip test's MagicMock agent short-circuited before appending cancelled-tool messages — assert len(messages)==3 got 0. Production is unaffected: run_conversation resets the flag to False explicitly at turn start (conversation_loop.py:~1028). * feat(gateway): session activity watchdog, stall notify, compress timeout (#72424) Three mechanisms to detect and notify when gateway sessions stall silently: 1. Mid-turn activity heartbeats stamped to SessionDB so hermes sessions list and hermes status show progress during long turns without new message rows. 2. Stall watchdog: when a busy session has pending inbound and the shared activity clock is idle past agent.session_stall_timeout (default 300), log a WARNING and notify the user once to try /new. Notify-only; does not kill the turn. 3. Compaction timeout: fenceless compress_context callers get a progress-aware host budget (compression.context_timeout_seconds default 120 idle, compression.context_total_ceiling_seconds default 600 ceiling). On timeout, cancel via commit fence, skip compaction without dropping messages, and continue the turn. Closes #72016 (slices 1-3; slice 4 cumulative SSE stream-retry deadline remains a follow-up). Cherry-picked from PR #72424 by @fangliquanflq. * refactor: reuse existing utilities in salvaged PR #72424 Three code-reuse fixes applied during salvage: 1. Reuse _relative_time from hermes_cli/main.py instead of duplicating the relative-time formatting logic in hermes_cli/status.py. 2. Extract _stamp_hygiene_compression_provenance helper in gateway/run.py to deduplicate the two nearly-identical try/except blocks that stamp compression timeout/abort provenance in the hygiene path. 3. Add ContextCompressor.record_timeout_failure() method and use it from the in-agent compress_context timeout callback instead of re-implementing the (60, 300, 900) cooldown ladder inline. The existing summary-LLM exception handler already has this ladder — now both paths share one method. * chore: add contributor mapping for fangliquanflq (#72424) * fix: propagate logging session context after daemon-pool compress_context compress_context now runs on a daemon pool worker thread (via run_compress_context_with_progress_timeout). The session id rotation updates hermes_logging._session_context (a threading.local) on the WORKER thread, not the caller thread. After the wrapper returns, propagate self.session_id back to the caller's logging context so subsequent log lines carry the rotated id (#34089). Fixes CI failure in test_compression_logging_session_context. * revert: PR #72817 — session activity watchdog, stall notify, compress timeout Reverting #72817 (salvage of #72424) pending further review. All 4 commits reverted: feat, refactor, chore (contributor map), CI fix. * fix(agent): redecorate prompt-cache breakpoints after provider failover try_activate_fallback refreshes the cache policy flags for the new provider, but the retry loop reused the primary's decorated api_messages. Cache-off→cache-on shipped zero breakpoints; cache-on→cache-off left stale markers. Strip and re-render at each retry attempt (same chokepoint as reasoning-echo reapply), peel/rebase MoA guidance so the last marker stays off the turn-varying block, and rebuild the static system prefix when caching becomes active mid-turn (#72626). * test(agent): cover prompt-cache redecoration across failover policy changes Add strip_anthropic_cache_control coverage and policy-change cases (cache-off→on, on→off, native→envelope, MoA guidance outside marker) that TestSyncFailoverPreservesCacheDecoration did not exercise. * fix(agent): restrict strip flatten to decoration-produced shapes strip_anthropic_cache_control flattened ANY pure-text multi-part content list with a separator-less join. Decoration only ever produces a single text part or the 2-part [static, volatile] system split; organic multi-part text (merged user turns, imported transcripts) got word-jammed and parts carrying extra keys (citations) were silently dropped — on the common no-failover path, since redecoration runs on every attempt. Restrict the flatten to the exact decoration-produced shapes and make marker removal copy-on-write on part dicts (the per-call message copy is shallow, so parts alias the persistent history). * refactor(agent): share static-prefix reconstruction, memoize failed rebuilds The static-prefix reconstruction pattern (build_system_prompt_parts -> ['stable'] -> startswith gate -> fail-open) existed in three copies: session restore (conversation_loop), compression keep-prompt path (conversation_compression), and the new failover redecoration helper. Hoist it into agent/system_prompt.reconstruct_static_prefix and call it from all three sites. Also memoize failed rebuilds per stored prompt (_static_rebuild_failed_for): the redecoration chokepoint runs at the top of every retry attempt, and a persistent stable-tier mismatch (restored session whose SOUL.md/skills changed since save) would otherwise re-run the full prompt build — SOUL.md, context files, memory I/O — on every attempt of every API call for the life of the session. A legitimately changed stored prompt retries once. * fix(agent): rebase MoA prepared request even when guidance is empty guidance=None is a real prepared shape (all references failed / silent degraded policy builds prepared_request without attaching guidance), and the MoA facade sends prepared['messages'] — not api_kwargs['messages']. Gating the rebase on 'and guidance' left the stale decoration in the prepared object for the no-guidance MoA sub-path, so #72626 persisted there. rebase_prepared_request already handles falsy guidance (copies messages, skips the attach). * refactor(moa): co-locate guidance peel with attach, add round-trip contract _peel_moa_guidance hand-implemented the inverse of moa_loop's _attach_reference_guidance from a different module — a drifting separator or shape would make the peel silently no-op and put the last cache breakpoint on the turn-varying guidance block (the #72626 bug class). Move the inverse into moa_loop.peel_reference_guidance directly adjacent to the attach, keep a thin wrapper in conversation_loop, and pin the contract with a round-trip test over all three attach shapes. Also fix the empty-list residue: peeling a guidance-only content part now drops the whole message (mirroring the appended-user-message shape) instead of leaving an empty-content user turn behind. * refactor(agent): direct flag access in redecoration, matching call-block site The call-block decoration reads agent._use_prompt_caching / _cache_ttl / _use_native_cache_layout directly; the redecoration helper wrapped each in getattr with divergent defaults (e.g. or-'5m' vs verbatim _cache_ttl). The flags are unconditionally initialized on AIAgent, so the defaults served only test fixtures and would mask a real init bug as silent cache-off. Align with the house style. * fix(desktop): paint the titlebar with the sidebar's surface color The shell titlebar declared no background of its own, so it showed through\nto the wrapper's --ui-bg-chrome and read as a lighter band above the\nsession list. Use --ui-sidebar-surface-background, the token the sidebar\nalready paints with, so the two chrome surfaces meet on the hairline\ninstead of a color change. * fix(gateway): let `@` completion find folders by name The fuzzy branch of `complete.path` ranked basenames from `_list_repo_files`, which lists files only, so a directory was only ever reachable by typing a `/` — `@Desktop` returned nothing at all. Rank each ancestor directory alongside the files, and break same-tier ties toward the folder so `@docs` leads with `docs/` rather than `docs.md`. Outside a git repo the fallback `os.walk` compounded this: it can spend the whole `_FUZZY_CACHE_MAX_FILES` budget inside one deep subtree before reaching a sibling, hiding top-level folders entirely. Seed the scan with a `listdir` of the root so immediate children are always candidates. * fix(desktop): keep the `@` popover open while typing a path `AT_TRIGGER_RE` excluded `/` from the query, so the trigger died on the first separator: `@/desk`, `@./www`, `@~/Desktop` and even `@file:src/foo` all stopped matching the moment a path appeared. The gateway already answered those queries correctly — the composer just never asked. A `/` inside an `@` token is navigation, not a delimiter. The token stays whitespace-bounded, which is what actually ends it. * fix(desktop): sit composer chips on the text baseline `align-middle` centers a pill on the x-height midpoint, which sits above the center of the surrounding text box, so chips rode visibly low against the words they're nestled between. Measured against the rendered surface, `-0.12em` lands the chip's own baseline within 0.08px of the line's (vs 0.79px off before) without growing the line box. Applies to both the directive and slash chip classes — they share a line, so fixing one and not the other just moves the mismatch. * fix(desktop): paint diffs from the theme palette Diff add/remove lines were hardcoded to Tailwind's emerald/rose while the overview ruler beside them — and the rest of the app — used --ui-green / --ui-red, so every diff sat slightly off-brand and stayed put when the semantic palette moved. Derive the tint, gutter, and text from those two colors instead. One renderer feeds the tool card, the file preview, and the review pane, so all three follow. * fix(desktop): don't alert for prompts a reconnect replayed A socket opening replays state that already existed — a session parked on an approval re-emits its request so the UI can draw the prompt. Those arrive as ordinary events, so launching Hermes, switching profiles, or riding out a reconnect fired an OS notification for a prompt the user had known about for an hour. Hold native notifications for a beat after any gateway opens. The sidebar row and the inline approval bar still appear immediately; only the OS notification waits for something that actually just happened. * fix(desktop): time a stream stall from the last activity The tail "Hermes is thinking" indicator resets on every flush, but its timer never did: with no timer key, useElapsedSeconds anchors to mount, and the indicator mounts with the assistant message. A stall two minutes into a turn therefore claimed two minutes of silence instead of the two seconds that had actually passed. Give the hook an explicit epoch and hand it the timestamp of the activity the quiet spell followed. Compaction still counts from the turn's start, which is the span it owns. * feat(desktop): confirm before quitting with a turn in flight Cmd-Q went straight through to teardown, killing the backend mid-tool-call — the turn is gone and whatever the agent was part-way through writing stays part-way written, with nothing on screen to warn about it. Renderers now report which chats are mid-turn; before-quit merges the reports and asks, naming them, defaulting to Keep Running. Update, swap, and uninstall relaunches skip the prompt: those are the app replacing itself, and a modal there would strand the detached script waiting on a PID that never exits. * refactor(desktop): name the overlay z-index ladder DESIGN.md already said app-wide surfaces must not compete through ad-hoc z-index literals, and the code disagreed: three overlapping numbering schemes, and comments narrating the fight ("defaults to z-130, renders UNDER the onboarding overlay (z-1300) ... bump it above with z-[1310]"). Picking a number meant reading someone else's near miss. Name the rungs — modal, over-modal, switcher, and the boot chain — and point the call sites at them. Every rung keeps the exact value it had, so nothing moves; what changes is that the next overlay has a name to reach for instead of a number to guess. Local stacking within a component stays on plain z-10/z-20. * style(desktop): drop the titlebar and statusbar edge rules The window chrome bracketed the workspace with a 1px rule top and bottom. Both bars already paint the sidebar surface, so the rules divided one continuous color rather than separating two. * feat(desktop): mark the active pane tab with a primary underline The active tab was defined by absence: the strip painted a rule and the tab covered it, so inactive tabs stopped a pixel short to let it show. Draw the state instead. The tab carries its own 2px --theme-primary underline and the strip's rule goes away, which lets tabs run full height and removes PANE_TAB_STRIP_LINE along with it. * style(desktop): fade split sashes until hover The seam hairline sat at full strength on every split, so an empty workspace read as a wireframe. Hold it at 0.1 and bring it up with the grab band already on hover. * feat(gateway): group unplaced sessions into a Home bucket in the project tree Sessions with no cwd — or whose folder can't be promoted to a project (the bare home dir, a deleted workspace, HERMES state) — were dropped from the project tree entirely, so the grouped sidebar silently showed fewer chats than flat Recents. Collect them into a synthetic `__no_project__` node at the head of the list. It carries one lane purely to hold the rows, and is omitted when empty so a project-less install stays blank. * i18n(desktop): name the project-less bucket "Home" The sidebar row is a place you enter, not a status line, so it reads as a destination rather than "No project". * feat(desktop): pin Home to the top of the project sidebar Home leads the overview above the active project and outside any drag order, drills in to a flat chat list (it has no repo or worktree structure), and overlays live sessions so a brand-new detached chat appears instantly. Starting a chat from inside Home stays detached instead of picking up the configured default project dir. Rename and delete are hidden — there's no record behind the row. * fmt(js): `npm run fix` on merge (#72902) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * fix(desktop): let automated teardown quit past the active-work prompt Playwright closes the app with a turn still in flight, so the new quit confirmation waited on a click nobody was there to make and the E2E worker died on a 90s teardown timeout. * feat(desktop): Tab into a folder from the `@` popover Tab and Enter shared one branch, so picking a folder always committed a chip and closed the menu — the list could show `apps/` but never open it. Reaching a nested path meant typing every segment by hand. Split the two intents. Tab re-types the token as a bare path so the next completion lists that folder's children; Enter still commits the folder itself as a chip. Files ignore the distinction — there's nowhere deeper to go. Backspace mirrors the descent, dropping one path segment per press instead of one character, so climbing out costs the same as going in. * style(desktop): drop the session counts inside an entered project The sidebar's flat session list lost its `x/<total>` chip in #72336, but the project drill-in kept counting: WorkspaceHeader still rendered a SidebarCount for every repo and every branch/worktree lane. Entering a project put a number next to each label again. Remove the header's count slot and both call sites, along with the now dead repo total. * fix(browser): stop stale cdp_url from stalling every startup by 10+ seconds Tool-schema assembly at CLI/Desktop startup runs the browser-family check_fns (browser, browser_cdp, browser_dialog, browser_vision). Each of those gates called _get_cdp_override(), which resolves the configured endpoint over HTTP (GET /json/version, timeout=10) — so a *stale* browser.cdp_url pointing at a dead debug browser cost ~7 serial blocking socket connects before the banner rendered. Measured on a real Windows install with a dead http://[::1]:9222 config: 15.1s of an 18s launch, with no warning or error — just mystery slowness. The value is easy to leave behind: /browser connect writes a session-scoped env override, but 'hermes config set browser.cdp_url' persists forever while the debug Chrome it pointed at dies on the next browser restart. Split the helper: - _get_cdp_override_raw() — returns the configured value (env var or config.yaml) with zero network I/O. Used by every is-it-configured gate: check_browser_requirements, _browser_cdp_check, _is_local_mode, _is_local_backend, _navigation_session_key, _should_inject_engine (via _is_local_mode), and the hermes doctor chromium-skip check. - _get_cdp_override() — unchanged contract (raw + /json/version resolution), now only called on paths that are about to connect: session creation and the dialog-supervisor attach. This follows the existing rule in check_browser_requirements ('do not execute agent-browser --version here') and the browser.manage status path, which already banned _get_cdp_override for exactly this reason (test_browser_manage_status_does_not_call_get_cdp_override): schema assembly must not perform blocking I/O. A/B on the same machine, same dead endpoint: get_tool_definitions() 15.08s unpatched -> 1.89s patched, with browser_cdp/browser_dialog still advertised (gate now keys off configuration, not reachability — matching the documented lazy-supervisor contract in _browser_dialog_check). Adds a regression test asserting the browser_cdp check_fn never touches the network. * fix(desktop): preserve live model after settings save (#72903) * refactor(desktop): simplify free-text slash mode check (#72815) * feat(desktop): let the status bar be hidden The bar is always-on chrome today. Hiding it is `⌘⇧S`, the ⌘K palette, or the bottom row of its own right-click menu — VS Code's set of doors, minus their unbound default (they ship `toggleStatusbarVisibility` with no keybinding and Hermes has no chord dispatcher for a `⌘K ⌘S` two-stroke). Hidden unmounts the bar rather than hiding it, so the 15s status poll and the per-turn readouts stop with it. Visibility persists per window profile and defaults on. * refactor(desktop): lift the completion-accept decision out of the keydown ladder Which keys accept the highlighted completion was an inline condition in the composer's keydown god-function, untestable without a DOM harness. Move it to a pure helper beside the other slash-query utilities. * fix(desktop): don't let Enter swap a free-text slash argument for a completion `/goal` keeps its completion popover open across arbitrary prose so its subcommands stay reachable. The popover highlights its first row on open, and Enter accepted that highlight unconditionally — so pressing Enter to send `/goal ship the redesign` would replace the sentence with a row the user never chose. Space was already guarded; Enter and Tab were not. Enter now accepts only after the user has arrowed to a row deliberately, so the highlight never lies about what Enter will do. Tab stays an unconditional accept, since it means nothing else in the composer. This is latent rather than reproducible today: `/goal` is absent from `SUBCOMMANDS` (its `args_hint` pipes are spaced, so the extraction regex misses them), so the backend returns no arg completions and the branch never runs. Giving `/goal` the subcommands it already advertises would resurrect the #71963 symptom in a worse form — losing the prose instead of chipping it. * refactor(desktop): put every preview on one rail tab list The right rail held two things at once: a list of file tabs, and a privileged "live preview" slot with a hardcoded `preview` tab id backed by a separate session-keyed registry. The two were written under different session-id rules and reconciled against each other, so an `open_preview` from a session whose stored id hadn't landed yet was set and then immediately cleared — the pane flashed and vanished. Artifacts arrived as a third list with their own pane and renderers. Now everything the rail can show is a `PreviewTarget` in `$previewTabs`, and `openPreview` is the only way in. `$previewTarget` is a computed read of the active tab, the session registry and its reconciler are gone, and artifacts render in the real preview pane through the shared mode switcher and source view instead of a parallel one. Artifact tabs stay memory-only since the registry rebuilds from the transcript. * fix(desktop): scope composer and transcript state to their own session `$activeSessionId` only ever holds the primary chat's session, but surfaces that render once per transcript were reading it as if it meant "the session on screen." A preview produced inside a session tile was recorded under the main chat's key and surfaced in the main chat's composer, which is what prompted this. The tool row now records under its own `SessionView`, and the same fix applies to the other readers of that atom that render per surface: attachment pills and inline preview links resolve relative paths against their session's cwd, composer voice and auto-speak read and subscribe to their own transcript, and the thread's compaction label, prompt-wait gate and turn timer follow the session that mounted them. `ComposerScope` now carries a `$messages` atom rather than a read closure so both the imperative read and the subscription come from one place. * fix(desktop): open a preview without dragging the file tree open The preview pane shares a collapsible column with the file tree, and `revealTreePane` un-collapses a column through that column's bound store — which on the right is `$fileBrowserOpen`, the tree's own ⌘J toggle. So every preview open literally called `setFileBrowserOpen(true)` and the tree came with it. `revealPreview` now un-collapses the column directly and leaves the toggle alone. The tree pane's visibility binding gains `$fileBrowserOpen` to match, since its presence was tracking only the column's collapse — without that it would still render the moment anything opened the column. * style(desktop): sit every pane tab strip on the sidebar surface The strips painted with `--theme-card-seed` — the raw, unmixed seed rather than a surface token — so they read as their own band beside the sidebar and titlebar, which share `--ui-bg-sidebar`. Fixed at the default in `PaneTab` rather than per strip. The right-rail preview strip never set the vars at all, so its inactive tabs fell through to the seed even though its container was already on the sidebar surface; correcting the fallback fixes that one for free and keeps the next strip from regressing. With the default right, the two zone strips no longer need to redeclare the var and paint the token directly. * fix(desktop): keep /resume's free-text search typeable /resume was classified as an options command, but its argument is a free-text query the picker fuzzy-matches against session titles and previews. Its completion list also always ends in a "Browse all sessions…" action row, so Space-to-accept never fell through to an empty list: the first space in a multi-word query emptied the composer and threw the user into the overlay, query and all. Classify it as mixed so spaces type through, matches keep narrowing as you refine, and Tab or arrow-then-Enter still accept a highlighted session. * feat(desktop): summarize a run of tool calls as one line Adds the grammar behind "Edited wiring.tsx, explored 3 files, ran 5 commands": one clause per category of work, a name when the category holds a single thing and a count otherwise, and the present tense for whichever category is still running. The continuity test is the load-bearing part. Tool grouping was reverted once because it reshuffled the moment a turn settled, so this replays the same turn twice — as the gateway event stream the live view builds bubbles from, and as the rows toChatMessages rehydrates on resume — and asserts both produce the same runs. * feat(desktop): collapse a settled tool run to its summary line A run of two or more tool calls now renders behind its summary once it has finished, so a long transcript reads as what the agent did rather than as a wall of rows. The run is keyed by its first tool call instead of its part index: live and rehydrated turns agree on which calls belong together but not on the indices they land at, and keying by index is what made the previous attempt reshuffle on settle. A run holding anything still pending always renders its rows, which is what keeps a clarify question or an approval bar out from behind a chevron. The approval-group tests move to tool-group and grow coverage for both halves of that rule. * feat(desktop): report how long the model thought A settled reasoning block reads "Thought for 5s" instead of staying "Thinking" forever. Nothing in the persisted turn records the duration, so the number is frozen when the block finishes on screen and simply omitted on a rehydrated turn, rather than reporting whatever a timer that never ran would say. * docs(desktop): explain what UNBOUNDABLE_TOOLS now guards The list gates two behaviours since the settled-run summary landed, but the comment still justified it only in terms of the scroll window's height cap. Record the pending-row rule that keeps approvals visible, and why file edits stay off the list. * fix(desktop): settle a tool run whose calls never resolved A run inferred "still working" from a missing result alone, so a call left unresolved — by an interrupted turn, or an agent that moved on — pinned its run as live forever. That stranded the summary in the present tense ("Exploring 2 files" on a finished turn) and, because a live run withholds its toggle so approvals can't hide, left the run permanently expanded with no way to collapse it. Qualify liveness the way ToolEntry already qualifies a row's: a missing result only means pending while the run is the tail of a running message. Liveness is now passed into summarizeToolRun rather than read off the calls, since it isn't a property of the calls. * fix(desktop): say a sub-second reasoning block was brief The elapsed timer counts whole seconds, so reasoning that finished inside one rendered as "Thought for 0s" — accurate and useless, and on a turn with several short blocks it repeats down the transcript. Drop the number below a second and say it was brief instead. * fmt(js): `npm run fix` on merge (#72967) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * refactor(desktop): give live tool runs a one-line ticker A live run was the settled view under a CSS max-height: the real rows, capped at ~6.75rem, with an escape hatch that let an open diff lift the cap entirely. So it was neither a single line nor an honest expanded block, and a run could balloon mid-turn. Split the two presentations instead. Live, a run is its summary plus a one-line reel that slides each finished action up and out, so a turn touching thirty files reads as one line ticking over in place. Settled, the summary is the whole of it until opened. Cards — file edits, clarify, image_generate — leave the run entirely and stay on screen where they happened, since the diff or the question IS the point of the turn. Drops useToolWindow, the bounded-window threshold, the scroll container, the fade mask and the :has([data-tool-open]) escape hatch, all of which existed to make "the real rows, but shorter" work. Also unifies transcript scaffolding on one colour: thinking headers painted --ui-text-secondary and tool summaries --ui-text-tertiary under a shared opacity, which is two greys for one kind of line. Both now render through ScaffoldRow at a token pitched between them. * fix(desktop): measure reasoning per block instead of per turn The timer registry hands every caller of a key the same origin, and every reasoning block in a turn was keyed `reasoning:<messageId>`. So the second and third blocks measured from the first one's start and each reported the running total as its own duration — the "6s, 6s, 16s" down a single turn. Key per block, and move the measurement into `useMeasuredDuration`, which keeps the number beside the origin that produced it. The thread virtualizes, so the component that watched a block finish is usually gone by the time anyone scrolls back to read it; component state forgot the duration on unmount and the row fell back to having none. A block that genuinely was never watched running — history from an earlier app session, or reasoning that arrived already complete — still has no duration to report, and now says "Thought" rather than sitting in the present tense at a turn that ended. Also drops the run summary's aggregate +N/−M: a run can no longer contain a file edit, so it was always zero. Each edit carries its own count on its card. * fix(agent): never replay chain-of-thought in the active-turn redirect checkpoint A /steer redirect during a thinking phase serialized the streamed reasoning into the persisted assistant checkpoint ('Reasoning shown before the interruption: ...'). An assistant turn exposing its own chain-of-thought reads to Anthropic's output classifier as reasoning-injection/prefill jailbreak, so every subsequent call on the session deterministically returned 'Provider returned an empty response' — and because the checkpoint is persisted and replayed, no retry, nudge, or empty-recovery branch could ever escape it. Four sessions were permanently bricked this way in the week of Jul 21-27 (42+ blocked calls; every reasoning-free checkpoint that week was untouched — same mechanism as the prefill.json incident). Class fix: streamed reasoning is now display-only state. The _current_streamed_reasoning_text accumulator is removed entirely (producer in _fire_reasoning_delta, resets, and init), so no future path can serialize CoT into replayable content. The checkpoint keeps only the visible response text; the model regenerates its reasoning on the retried turn. Invariant documented in _apply_active_turn_redirect. Regression tests: CoT never appears in either checkpoint shape, reasoning-only interrupts produce a bare checkpoint, reasoning deltas stay display-only. * fix(desktop): delay Tip hover-open by 200ms so tips stop flashing * refactor(desktop): extract a shared kebab + right-click actions-menu primitive Promote the session row's inline MenuKit device into components/ui/ actions-menu.tsx: one ActionsMenu (kebab) + ActionsContextMenu (right-click) pair driven by a single items(kit) render function, so a row's dropdown and its context menu can't drift. Refactor the session menu onto it and let StatusRow forward ref/onContextMenu so any row can host a context menu. * feat(desktop): mirror every kebab menu to right-click Wire the shared actions-menu into the remaining kebabs so right-clicking a row opens the same actions as its ⋯ button: project rows (appearance moves to a submenu via the new shared ProjectAppearancePicker), worktree lanes, the composer branch bar, and settings credential rows. * fix(desktop): paint the live status line as scaffolding The drafting/stall status row kept its own type and colour — text-sm at muted-foreground/70, with the hint at /55 — so "Editing" while the model drafts a call rendered a full step larger than the "Explored 3 files" line it turns into a moment later, in a different grey. Route it through the scaffold label token so the whole left column reads as one kind of line. The timer keeps its midground tint: that belongs to the live-signal cluster with the dither block, not to the scaffolding. * fix(desktop): give tool rows the scaffold colour they were meant to share TOOL_HEADER_TITLE_CLASS was byte-identical to SCAFFOLD_LABEL_CLASS apart from the colour — secondary (74%) against the scaffold's 64% — so a "Ran wc -l" row sat visibly brighter than the "Thought for 1s" line above it. Same for the trailing duration: tertiary against scaffold meta. The primitive existed but only the thinking header and run summary were routed through it. Point the tool row at it too and delete the duplicates, so there is one place left to change. Search hit titles keep the brighter grey under their own name: they are result content, not scaffolding. * fix(desktop): send a message edit when the arrow is clicked Clicking the edit composer's send arrow did nothing — the edit only went through via revert. On macOS a <button> takes no focus on mousedown, so the arrow-click blurred the contenteditable, the blur's 80ms timer cancelled the edit and tore down the assistant-ui composer core, and the click's send() then threw "Composer is not available" against the dead core. submitEdit had already set submitting=true, so the arrow wedged and only revert worked. Guard focus on the send button with onPointerDown preventDefault, the same way the restore button does, so the click never blurs the editor. Also wrap the send() and the blur-timer cancel() in the #49903 unguarded-core swallow so a raced teardown can never wedge the arrow or leak an uncaught renderer error. * fmt(js): `npm run fix` on merge (#72992) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * fix(state): recover from read-only database files at startup Port from Kilo-Org/kilocode#12508: a stray read-only state.db / -wal / -shm (sudo run, restored backup, copied dotfiles) previously killed SessionDB init with an opaque 'sqlite3.OperationalError: attempt to write a readonly database' raised from deep inside _init_schema — naming no file and no fix — and the obvious wrong 'fix' (deleting the -wal) silently loses committed transactions. New preflight_db_writability() runs before the first connection on both DB open paths (SessionDB.__init__ and hermes_cli.kanban_db.connect): - files inside the Hermes home tree are repaired with chmod u+rw (the safe scope: Hermes owns them, and the OS makes chmod fail on files the user doesn't own, which bounds the repair exactly); - anything else (root-owned files, read-only mounts, custom paths) fails fast with an error naming the exact file and the exact chmod command, plus an explicit 'do NOT delete the -wal' warning; - WAL sidecars are never deleted or truncated — once writable, the normal open path checkpoints committed frames into the DB. Proven live on main first: chmod 444 state.db -> SessionDB() raises the opaque readonly error. With the fix: in-home DBs self-heal; out-of-home DBs get the actionable message. Sabotage run confirms the integration tests fail without the wiring (2 failed / 10 passed). * fix(desktop): zero Tip skipDelayDuration so every tip waits its delay * fix(desktop): retire the drafting label when the model moves on `tool.generating` names the tool whose arguments are streaming, and nothing ever closed that claim: there is no stop-drafting event, and a draft can be abandoned without reaching `tool.start` when a mid-stream retry drops a partial call or a guardrail blocks the tool. Enumerating the ways a draft ends left those holes open, so "Editing" sat under the transcript for the rest of a multi-iteration turn. Invert the rule — the claim only covers what the model is emitting right now, so any other output from that session retires it. Stopping the turn clears it too, and a `tool.generating` that arrives after the stop is ignored on the same condition `mutateStream` already drops late tool rows. * fix(desktop): keep a run live between sequential calls A run counted as live only while one of its calls was unresolved, which is false for the instant between one sequential call finishing and the next arriving — and for a string of commands that instant is most of the run. It settled and re-opened between every call, so the ticker unmounted and came back at the top of its reel instead of scrolling, and the summary flipped to past tense while work was still going. Live is now "the turn is working and nothing follows this run", with the tail bound still settling a run the agent has moved past. The summary takes its present-tense clause from the most recent call when none is pending — the same call the ticker is showing. The stall spinner stays out of the way while a run narrates, rather than stacking a second timer under it. * fix(desktop): one weight and one gap for transcript scaffolding The scaffold rows shared a colour but not a weight: tool summaries and the ticker rendered medium against the reply's normal-weight prose, which read as emphasis on the quietest lines in the column. Spacing had the matching problem. The block-gap rule listed which *pairs* of blocks qualified, so the live status line — neither tool, thinking, nor prose — fell through every branch onto its own half-size margin. And because a streaming turn is sealed into several bubbles as it goes but rehydrates into fewer, two blocks are siblings inside one bubble or split across two depending on when you look; the flex gap between bubbles is half the block gap, so the rhythm tightened and relaxed as a turn settled. Cover every top-level block with one rule, keep prose-to-prose on paragraph rhythm, and top the between-bubble gap up to match. * fmt(js): `npm run fix` on merge (#73004) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * fix(xai): send Hermes-Agent User-Agent on chat/completions Direct tool HTTP calls already identified as Hermes-Agent, but the main OpenAI-SDK chat path still sent OpenAI/Python. Set Hermes-Agent/<ver> for api.x.ai clients (xai + xai-oauth) so normal text traffic is attributed correctly. * chore(xai): drop noisy default_headers comment * fix(desktop): stop the enter animation pinning opacity over the stylesheet Two identical tool rows, one above the other, rendered at two different opacities — and no amount of hovering would even them out. The enter animation fills forwards, so its final keyframe is held in the animation origin of the cascade for as long as the element lives, above the author stylesheet. Naming `opacity: 1` there didn't just end the fade, it permanently overruled the resting opacity of every element the sheet dims. Transcript scaffolding is dimmed exactly that way, so a row kept whichever opacity it happened to mount with: full if it animated in during the turn, faded if it was rehydrated or remounted past its one-shot key. Same for thinking headers, which is why "Thought" never matched the rows near it. Leave the end opacity out of the keyframe. It animates up to whatever CSS asks for and keeps answering to it, hover included. Then close the way the surfaces drifted in the first place: the fade named each one in its own selector, so the live status line — added later, and neither tool nor thinking nor prose — matched none of them and sat a shade brighter than the rows either side. One `data-conversation-scaffold` mark now carries it, and every surface opts in. * fix(desktop): honor layout-aware letter keybinds * fix(desktop): resolve punctuation keybinds through the active layout Letter chords now follow `event.key`, but punctuation was still anchored to the physical QWERTY position, so the shipped punctuation defaults stayed unreachable on a remapped layout. On Dvorak `mod+.` (command center) reads the physical V key, and `mod+,` / `mod+/` land on `w` / `[`. Take `event.key` for unshifted punctuation too. Shift stays excluded because a shifted `event.key` is the shifted glyph ("?" for "/") and combos are anchored to the unshifted token. Digits stay physical: AZERTY types "&" on the unshifted "1" key, so `event.code` is what keeps `mod+1` bound. Glyphs we do not ship as tokens — Option output, dead keys, non-Latin scripts — fail both checks and fall back to the physical code. The punctuation set derives from CODE_TO_KEY so the two cannot drift. * fmt(js): `npm run fix` on merge (#73023) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * perf(desktop): split heavy lazy-only libs out of the renderer entry chunk codeSplitting:false inlined every lazy()/dynamic import into the entry, so the whole 28.5 MB bundle — including 19 MB of shiki grammars and 3.1 MB of mermaid that nothing rendered — was parsed and evaluated on every cold start. The original single-chunk rationale (#38888: electron-builder OOMs scanning shiki's thousands of default chunks) doesn't require ONE chunk, just few: rolldown advancedChunks groups keep the file count at ~180. Ordering matters and is the subtle part: shared foundations (react, hast/ mdast utils, lodash-es/d3 commons) must match BEFORE the heavy groups, because rolldown merges an unmatched shared module INTO the heavy chunk that uses it — and then the entry statically imports 19 MB of shiki just to reach react, putting the whole chunk back on the boot path. Statically-reachable boot graph: 26.9 MB -> 7.7 MB. * perf(desktop): load shiki and @streamdown/code on first use, not at boot The chunk split only helps if nothing on the entry graph statically imports the heavy libs. Three seams did: - react-shiki: now behind one lazy() boundary (shiki-block.tsx is its only static importer; LazyShiki wraps it with a PlainCode fallback). - diff-lines.tsx: useShikiHighlighter hook extracted to a lazily-loaded syntax-diff.tsx (plain DiffBody fallback — same output Shiki's own pre-resolve state showed); codeToTokens becomes a dynamic import that runs only once a highlightable diff is on screen. - @streamdown/code: statically ran createJavaScriptRegexEngine() and built full language registries at module scope on every launch. It now loads via useCodePlugin() on first markdown mount and swaps into the plugin table when it lands; fenced code renders plain until then, identical to the delay fallback users already see during streaming. Interleaved A/B vs main (prod build, warm V8 cache, median of 4, two alternating rounds): FCP 1100->940ms, DOMContentLoaded 618->542ms, nav-to-interactive 1312->1123ms on the quiet round; same direction with larger gaps under load. ~160-190ms off every renderer boot metric. * fix(desktop): let the composer answer past a clarify card Typing a real message instead of picking an option left the agent parked: the clarify blocks inside its tool batch waiting on clarify.respond, so a follow-up routed through steer/queue sat undelivered until the 5-minute clarify timeout. skipClarifyRequest answers the parked question with the same empty answer the card's own Skip button sends, so the tool returns and the turn carries on with the user's words. * fix(desktop): stop a clarify card swallowing keys it doesn't bind The card marked itself as owning every printable key, so the first letter of a typed-out answer vanished and the composer never focused. It now publishes its row count and yields only Enter plus the 1..N+1 / A.. rows it actually renders; everything else reaches the composer, which skips the question on send. * fix(desktop): show a check on the active theme and color mode in ⌘K The theme picker computed `active` per row but nothing rendered it — the `active?: boolean` field and its trailing check were stripped in 8f73d0d94 and the computation was left behind, so the palette offered no way to tell which skin was already applied. That matters more than it sounds: the desktop persists its own skin in localStorage and only seeds (never applies) the backend's `skin:` at connect, so config and window can legitimately disagree. Restore the field and render a trailing check, and mark the root-search theme rows and both color-mode lists the same way so every appearance picker in the palette reports its own current value. * feat(desktop): right-click parity for every panel list row Teach PanelListRow a menuItems prop that renders BOTH the hover kebab and a matching right-click menu from one PanelMenuItem[] (via the shared actions-menu primitive), so a panel row's two menus can't drift. Migrate the cron, webhooks, and profiles panels onto it — right-clicking a row now opens the same edit/delete/enable actions as its kebab. * feat(desktop): right-click actions on the sidebar cron rows The sidebar cron rows exposed only hover trigger/manage buttons and no right-click. Add a context menu — trigger now, pause/resume, manage, and delete — driven against the shared $cronJobs atom so the sidebar and cron overlay stay in sync. * fix(desktop): scroll the tab strip so a new tab and the "+" stay in view Opening a tab in a zone with more tabs than fit appended it past the right edge of the scrolling strip — the new tab and the "+" that created it were both off-screen, so a second new tab meant scrolling back by hand. Activating a tab from a keybind had the same problem in the other direction. The zone header now scrolls its active tab into view on activation, and scrolls all the way to the end when that tab is the last one so the trailing "+" comes with it. * fix(gateway): treat a leading `@/` as a separator, not just an absolute path `@/Desktop` returned nothing while `@Desktop` worked. The leading slash was always read literally, so the lookup went to the absolute `/Desktop` — which doesn't exist — and dead-ended instead of finding the folder one level down. The `@` has already announced "this is a path", so the slash people type next reads as a separator out of habit rather than a filesystem root. Take the absolute meaning only when it resolves: the parent directory has to exist, and a partially-typed segment has to match something in it. Otherwise drop the slash and resolve from the cwd. Real absolute paths are unaffected — `/usr`, `/etc/hos`, `/Users/...` all pass the existence probe and keep their current behaviour. The guard matters: stripping the slash unconditionally would let a repo-local `etc/` shadow the real `/etc`. * chore: trigger CI * fix: prevent session poisoning from empty partial-stream-stub assistant turns A mid-tool-call stream drop with no delivered text produces a partial-stream stub carrying content:'' and tool_calls=None. The conversation loop's truncation path appended it to history as {"role":"assistant","content":""} before the continuation nudge, and strict providers (Moonshot/Kimi via OpenRouter) reject empty assistant content with HTTP 400 ("the message at position N with role 'assistant' must not be empty") on the next replay. Because the message is persisted, every subsequent turn re-failed — the session was unrecoverable. Three layers, smallest blast radius first: 1. conversation_loop (length path): an EMPTY partial-stream stub is no longer appended as an interim assistant message; only the continuation user-message is. Stubs that delivered partial text are still persisted so continuation stitching is unchanged. 2. chat_completion_helpers.build_assistant_message: never serialize a textless assistant turn with content:'' — pad to a single space, the same trick as the reasoning_content pad (#15250, #17400). Tool-call turns are exempt (content:'' alongside tool_calls is accepted everywhere). 3. conversation_loop send boundary: pad a textless assistant turn's empty content to a single space AFTER all content-mutating passes (surrogate sanitize, whitespace normalization, thinking-only drops), before token estimation. This is the durable repair for sessions ALREADY poisoned by older builds: the persisted stub rows are rebuilt to '' on every reload (_rows_to_conversation strips whitespace, so a DB-side pad can't survive) and only a send-time pad repairs them. Verified: 485 tests pass across the four affected files; live replay of a real poisoned session's resumed history against Moonshot via OpenRouter returns HTTP 200 (was HTTP 400). * fix: send-time pad must skip multimodal (list) assistant content The empty-content pad loop called .strip() on am.get("content") without checking the type. Multimodal assistant turns carry content as a list of parts (text/image), so a session with any image-bearing turn crashed during request assembly: AttributeError: 'list' object has no attribute 'strip' Guard with isinstance(content, str) — a multimodal turn is never the empty textless shape the pad repairs. Adds a regression test driving a multimodal history through the loop. * test: adapt multimodal pad-safety test to main's assistant-content flattening Current main flattens multimodal assistant list-content to a plain string before the send boundary, so the original assertion (list survives to the wire) can't hold on this base. The test now asserts the load-bearing contract instead: no crash, and the assistant turn's text is neither dropped nor replaced by the pad. Adds a direct unit-shape check that the pad predicate skips list content (the exact AttributeError shape from the original bug) and pads only textless string turns. * fix: exempt codex_responses from the empty-assistant-content pads Commentary-phase Codex turns persist with content:'' by design (their text is delivered via the interim assistant callback), and the Responses wire has no 'assistant must not be empty' validation — padding them broke test_run_conversation_codex_continues_after_commentary_phase_message in CI. Both the builder pad and the send-time pad now skip api_mode=codex_responses. Keying on the ACTIVE api_mode preserves the repair for codex-written sessions replayed through a strict chat-completions provider. * feat(desktop): resolve a hostname to its Simple Icons brand mark A lookup table of ~170 hosts plus a resolver that walks the hostname's suffixes, so subdomains inherit their parent's mark (gist.github.com) while a more specific entry (docs.google.com) still wins over the general one. * feat(desktop): show brand icons on links to known domains PrettyLink leads with the site's mark, so a GitHub PR link reads as a GitHub link at a glance. The artifacts pane uses the same lookup in place of its generic chain glyph; unknown hosts render as before. * feat(desktop): strip the header chrome off markdown code blocks A fenced block carried a bordered card with a "Code · <lang>" title row and a pinned copy button, which read as an attached artifact next to the reply. Drop the border and the header: the block is now a tinted slab on --ui-bg-editor with syntax highlighting and a copy button that reveals on hover. The streaming glow moves entirely to box-shadow since there is no border left to animate. * fix(desktop): let the expandable fade match its own surface The overflow fade hardcoded --ui-chat-surface-background, so inside a code block it smeared the chat background over the block's own fill. Read an --expandable-fade-from override with the chat surface as the default. * chore(desktop): drop the now-unused assistant.tool.code string The code-block header was its only consumer. * Revert "feat(observability): integrate NeMo Relay runtime and shared metrics" * docs(desktop): tip only when hover teaches something new Drop the blanket "every icon* button needs a Tip" rule — it produced tautological kebab tips like "Actions for <row title>". Menu triggers keep aria-label; tips stay for unlabeled discovery chrome and keybind hints. * fix(desktop): stop tip-wrapping kebab menu triggers Remove the ActionsMenu tooltip prop and Tip wrappers on session, project, workspace, panel, and credential ⋯ menus. aria-label stays for a11y; drop the unused credentialActions string. * test(desktop): assert kebabs are not wrapped in Tip Flip the #67500 structure tests that required tooltip-trigger on menu kebabs; keep coverage that the menus still open on click. * style(desktop): quiet inline links to color-only until hover The resting chip fill and the bold weight both fought the brand mark for attention. Links now sit in the theme's primary color at body weight, and the tint fades in on hover. Weight is overridden on .link-chip itself: `@tailwindcss/typography` sets `prose a { font-weight: 500 }`, which outranks a utility class on the anchor, so the per-call-site classes could never win. * fix(desktop): anchor the inline image download button to the image, not the block The <img> carried max-w-[min(100%,var(--image-preview-max-width))] while its container was w-fit max-w-full. A percentage max-width resolves to none while the container measures its fit-content width, so the container took the full column while the image stayed capped — and the absolutely positioned download button, which anchors to the container, drifted into the margin on any image wider than it is tall. Move the width cap onto the container and leave the image at max-w-full. The container now shrink-wraps the rendered image, so right-2/top-2 lands on the image's own corner at every aspect ratio. * fix(desktop): open a composer image attachment in the lightbox, not the rail Clicking an attached image routed it through normalizeOrLocalPreviewTarget and into the right rail, where it rendered as a small contained <img> inside a pane built for reading and editing files. The bytes were already in hand as a data URL, so the rail's whole read/edit/reload apparatus was doing nothing for a picture the user just wanted to look at. Route images with a resolved thumbnail to ImageLightbox — the same overlay the thread uses — so the attachment previews at full size with the download action, and drop the dataUrl/previewKind graft that only existed to make the rail render bytes it shouldn't have been handed. Non-image attachments, and images whose thumbnail never resolved, still fall through to the rail unchanged. * test(desktop): cover the composer attachment click routing An image attachment opens the lightbox and leaves the preview rail empty; a file attachment still opens a rail tab. The lightbox case fails on main. * fix(desktop): keep slash completion alive after a leading command Typing a second slash command in the composer went dead whenever the message started with one. `/work /cle` offered nothing, while `do /work then /cle` completed fine — which read as an intermittent glitch rather than a rule. Two regexes detect a slash, and the `^`-anchored command shape was tried first. Its argument tail (`(?:\s+\S*)*`) swallows the rest of the line, so a later `/skill` parsed as an argument to the first command; a command that takes no options then suppresses the popover outright, and every slash after the first was unreachable. Only the first slash can be an invocation, so detect the inline shape first. It requires a whitespace-preceded slash sitting at the caret, so it can't take over ordinary argument completion (`/personality alic` has no second slash) — it fires only where completion was already dead. * docs(desktop): ban Close-X tips and click-to chrome lectures Extend the tip rule past kebabs — no tip on dismiss X, and no tips that only paraphrase a visible label or say "click to…". * fix(desktop): strip Close-X tips and statusbar tip lectures Drop tips on dialog/overlay/find-bar/review/master-detail close buttons. Stop tip-wrapping connection/gat…

…e bundle (NousResearch#38888) The desktop renderer is bundled as one chunk on purpose (codeSplitting: false) because Shiki's many dynamic chunks make electron-builder OOM scanning thousands of files. That makes the ~22 MB bundle expected, but Vite still nags with 'Some chunks are larger than 500 kB' on every build. Raise chunkSizeWarningLimit to 25000 kB so the cosmetic warning stays quiet while still firing as a regression alarm if the bundle grows well past today's size. Config-only; codeSplitting:false is untouched.

…hunk codeSplitting:false inlined every lazy()/dynamic import into the entry, so the whole 28.5 MB bundle — including 19 MB of shiki grammars and 3.1 MB of mermaid that nothing rendered — was parsed and evaluated on every cold start. The original single-chunk rationale (NousResearch#38888: electron-builder OOMs scanning shiki's thousands of default chunks) doesn't require ONE chunk, just few: rolldown advancedChunks groups keep the file count at ~180. Ordering matters and is the subtle part: shared foundations (react, hast/ mdast utils, lodash-es/d3 commons) must match BEFORE the heavy groups, because rolldown merges an unmatched shared module INTO the heavy chunk that uses it — and then the entry statically imports 19 MB of shiki just to reach react, putting the whole chunk back on the boot path. Statically-reachable boot graph: 26.9 MB -> 7.7 MB.

teknium1 merged commit 0175be3 into main Jun 4, 2026
19 of 20 checks passed

teknium1 deleted the hermes/hermes-bb04aed6 branch June 4, 2026 09:29

zhenheco mentioned this pull request Jul 21, 2026

codex/security hermes bridge token #68470

Closed

OutThisLife mentioned this pull request Jul 28, 2026

perf(desktop): cut renderer cold start by keeping shiki/mermaid off the boot path #73024

Merged

Navigation Menu

Uh oh!

chore(desktop): silence Vite chunk-size warning for intentional single bundle - #38888

chore(desktop): silence Vite chunk-size warning for intentional single bundle#38888
teknium1 merged 1 commit into
mainfrom
hermes/hermes-bb04aed6

teknium1 commented Jun 4, 2026

Uh oh!

github-actions Bot commented Jun 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

teknium1 commented Jun 4, 2026

Summary

Changes

Validation

Infographic

Uh oh!

github-actions Bot commented Jun 4, 2026

🔎 Lint report: hermes/hermes-bb04aed6 vs origin/main

ruff

ty (type checker)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

🔎 Lint report: `hermes/hermes-bb04aed6` vs `origin/main`