fix(desktop): restore Bot roster route resolution

[fangliquanflq]

Summary

• restore the active Bot route resolver removed during connection-routing reconciliation
• keep profiles.list pinned to the live (connectionId, profile) pair on multi-source desktops
• preserve the active-gateway fallback for older Desktop SDKs
• add regression coverage for routed, missing, and legacy route inventories

Root cause

useRoster() called activeBotRoute() before requesting profiles.list, but the helper definition was absent. The resulting ReferenceError prevented the first roster request on every platform, leaving the roster empty and New Group Chat disabled.

Testing

• node --test src/plugins/hermes-bots/tests/cross-connection-bots.test.mjs
• npm run check:test:plugins (413 passed)
• node --check src/plugins/hermes-bots/plugin.js
• node --check src/plugins/hermes-bots/tests/cross-connection-bots.test.mjs

Related Issue

Closes #92843

[alt-glitch]

This was generated by AI during triage.

Duplicate of #92811. Both restore the same activeBotRoute implementation at the same plugin location; this submission adds test coverage but no distinct repair mechanism.

[aymanajal]

Tested this regression independently on macOS/Apple Silicon with v0.20.5 at b766607b. Restoring activeBotRoute() and rebuilding the packaged Desktop app recovered the existing roster and durable group chat without touching profile/session data.

Validation completed:

• node --test src/plugins/hermes-bots/tests/*.test.mjs: 418 passed, 0 failed
• hermes desktop --build-only: packaged app built successfully
• Desktop UI: Bots spinner cleared, existing roster returned, and the prior group-chat thread/history opened successfully

Full sanitized repair report:
https://gist.github.com/aymanajal/236a6f1b918e007e494a30b88be6702c

Suggested hardening for this PR: wrap host.profileRoutes() in try/catch and return null on a transient inventory failure. That preserves the existing active-gateway fallback and avoids converting a temporary routing read failure into another roster retry loop. A unique targetProfile match can also safely cover Desktop alias projection when no exact logical-profile route is present.

[fangliquanflq]

Thanks for the independent macOS validation and the hardening suggestions. I checked them against the latest upstream main rather than extending this now-stale restoration:

• Your live result confirms the reported root cause: restoring the missing resolver recovered roster/group-chat behavior without profile or session migration.
• main superseded this PR in 2ec229ec5a: active roster profiles.list calls now use the SDK's ambient owner route, so a transient profileRoutes() inventory failure can no longer block roster loading. The remaining alias-index refresh is already feature-detected and wrapped in try/catch, preserving the last good index.
• Alias projection is also handled on main by a connection-qualified alias index. It accepts a unique (connectionId, targetProfile) claim and deliberately fails closed when multiple aliases claim the same backend row, avoiding an ambiguous fallback.

I verified the current behavior at f530cd2b54 with:

node --test apps/desktop/src/plugins/hermes-bots/tests/multi-source-roster.test.mjs apps/desktop/src/plugins/hermes-bots/tests/mention-roster-cache-key.test.mjs apps/desktop/src/plugins/hermes-bots/tests/profile-prewarm.test.mjs apps/desktop/src/plugins/hermes-bots/tests/cloud-alias-identity.test.mjs
# 39 passed, 0 failed

No additional change is appropriate on this branch: the duplicate observation is accurate, and the newer upstream routing/alias implementation already covers both hardening points without reintroducing activeBotRoute().

[teknium1]

Closing as superseded — this was a correct fix when written, and thank you for the fast response during the morning's roster breakage. The activeBotRoute() call site it restores no longer exists on main: #91134's rebase-merge (fixup 2ec229ec5) moved useRoster() onto the SDK ambient owner route, removing the helper's role entirely, and main now carries a source-contract test (multi-source-roster.test.mjs) that explicitly forbids reintroducing the symbol. The crash itself (#92843) is gone on current main.

Related fixes in the same cluster: #92811, #92842, #92793 — same verdict.