fix: harden cloud egress and Hermes worker lifecycle - #96905

Closed

mrkillbob wants to merge 69 commits into

NousResearch:mainfrom

mrkillbob:hermes/live-worktree-upgrade-refreshed-20260827

Commits on Aug 27, 2026

chore: replay Hermes upgrades onto upstream v0.20.6

Mike DeMott
authored and
Mike DeMott
committed
e828efe
fix: route egress-blocked requests to local fallback

Mike DeMott
authored and
Mike DeMott
committed
4bef597
fix(kanban): identify decomposition plans by durable events

Mike DeMott
authored and
Mike DeMott
committed
9e1ca46
fix(kanban): share verified main-checkout environments

Mike DeMott
authored and
Mike DeMott
committed
40e5a16
fix(desktop): remove unresolved gateway conflict marker

Mike DeMott
authored and
Mike DeMott
committed
aabb749
fix(kanban): preserve context and bound worker lifetimes

Mike DeMott
authored and
Mike DeMott
committed
7fd0ebb
fix(kanban): route protected workers locally first

Mike DeMott
authored and
Mike DeMott
committed
eaea339
fix(kanban): honor explicit local model pins

Mike DeMott
authored and
Mike DeMott
committed
17d15f4
fix(kanban): preserve root handoffs during decomposition

Mike DeMott
authored and
Mike DeMott
committed
e3c41f3
fix(pr-feedback): clarify repair identity and billing evidence

Mike DeMott
authored and
Mike DeMott
committed
ce81a14
fix(pr-feedback): clarify repair identity and billing evidence

Mike DeMott
authored and
Mike DeMott
committed
edd5f16
fix(kanban): keep board-record tasks out of false triage

Mike DeMott
authored and
Mike DeMott
committed
7e07eff
fix(kanban): recover re-triaged concrete specs

Mike DeMott
authored and
Mike DeMott
committed
d794043
fix(kanban): keep board-record tasks out of false triage

Mike DeMott
authored and
Mike DeMott
committed
dadb925
fix(kanban): recover re-triaged concrete specs

Mike DeMott
authored and
Mike DeMott
committed
3e3740b
chore: refresh Hermes from upstream main

Mike DeMott
authored and
Mike DeMott
committed
fa008b6
chore: reconcile refreshed Hermes upgrade PR

Mike DeMott
authored and
Mike DeMott
committed
360d49d
fix(egress): chunk oversized protected Kanban lines

Mike DeMott
authored and
Mike DeMott
committed
b90b5ca
test(egress): update decomposer fixture for handoffs

Mike DeMott
authored and
Mike DeMott
committed
04f2fac
fix(egress): redact generated Codex context safely

Mike DeMott
authored and
Mike DeMott
committed
d4148ff
fix(kanban): recover generated cards after profile removal

Mike DeMott
authored and
Mike DeMott
committed
5584547

Commits on Aug 28, 2026

fix(egress): frame protected provider context safely

Mike DeMott
authored and
Mike DeMott
committed
7b2d05e
fix(kanban): honor explicit provider routes

Mike DeMott
authored and
Mike DeMott
committed
83777e7
fix(egress): restore kanban boundary after fallback rebuild

Mike DeMott
authored and
Mike DeMott
committed
ce7a385
fix(kanban): preserve context for provider stall repairs

Mike DeMott
authored and
Mike DeMott
committed
55f605e
fix(kanban): recover clean-exit workers once

Mike DeMott
authored and
Mike DeMott
committed
31a6fe8
fix(goals): defer policy-blocked judge calls

Mike DeMott
authored and
Mike DeMott
committed
e25262d
fix(kanban): cap effective local worker routes

Mike DeMott
authored and
Mike DeMott
committed
f161c88
fix(kanban): require factual terminal receipts

Mike DeMott
authored and
Mike DeMott
committed
c75f2ab
fix(kanban): reject false input blocks on generated leaves

Mike DeMott
authored and
Mike DeMott
committed
1b014a6
fix(kanban): require evidence for capability blocks

Mike DeMott
authored and
Mike DeMott
committed
02f30cc
fix(kanban): reject placeholder child scopes

Mike DeMott
authored and
Mike DeMott
committed
7b8af79
fix(kanban): reject false input blocks from workers

Mike DeMott
authored and
Mike DeMott
committed
efee8cd
fix(pr-feedback): verify immutable base targets

Mike DeMott
authored and
Mike DeMott
committed
62b5a2d
fix(pr-feedback): target current base for conflicts

Mike DeMott
authored and
Mike DeMott
committed
9c6c0b2
Merge upstream main into Hermes upgrades

Mike DeMott
authored and
Mike DeMott
committed
7fb9606
fix(kanban): retry unverified worker exits by default

Mike DeMott
authored and
Mike DeMott
committed
e497109
fix(egress): elide protected Kanban state from Codex turns

Mike DeMott
authored and
Mike DeMott
committed
5e2cd77
fix(egress): elide Kanban output in Codex responses

Mike DeMott
authored and
Mike DeMott
committed
95ff3e7
fix(egress): preserve Kanban boundary across providers

Mike DeMott
authored and
Mike DeMott
committed
beb52d8
fix(egress): redact generated Kanban cloud context

Mike DeMott
authored and
Mike DeMott
committed
2e30f75
fix(egress): redact generated cloud context

Mike DeMott
authored and
Mike DeMott
committed
979fb24
fix(egress): bind canonical Kanban tool call ids

Mike DeMott
authored and
Mike DeMott
committed
66ece3f
fix(egress): allow numeric auxiliary output caps

Mike DeMott
authored and
Mike DeMott
committed
df3c63e
fix(kanban): preserve bounded remote worker context

Mike DeMott
authored and
Mike DeMott
committed
d7a4c21
Merge main into PR #96905: resolve conflict in cli-config.yaml.example
mrkillbob
committed
3109ac9
Merge remote-tracking branch 'origin/main' into hermes/live-worktree-upgrade-refreshed-20260827

Mike DeMott
authored and
Mike DeMott
committed
e151b2d
fix(privacy): scrub private project identifiers from upstream content

Mike DeMott
authored and
Mike DeMott
committed
de6ae4c
fix(cron): keep deleted profiles from returning

helix4u
authored and
Mike DeMott
committed
5df4835
fix(cron): widen deleted-profile protection to all cron mkdir sites

authored and
Mike DeMott
committed
37ebc15
fix(cron): harden _is_named_profile_path against symlinked profile homes

kshitijk4poor
authored and
Mike DeMott
committed
10d7f09
feat(models): qwen3.8-flash now selectable on OpenRouter and Nous portal

teknium1
authored and
Mike DeMott
committed
8bcc7ee
feat(code-execution): remote kernel host — session persistence for docker/ssh/modal backends (closes #96873) (#96991)

teknium1
authored and
Mike DeMott
committed
7876cdd
fix(tests): runtime_provider no longer permanently captures a mocked load_config

teknium1
authored and
Mike DeMott
committed
7297487
chore: replace Anthropic/Claude defaults with OpenAI-Codex equivalents

authored and
Mike DeMott
committed
b9ed174
Merge remote-tracking branch 'origin/main' into hermes/live-worktree-upgrade-refreshed-20260827

Mike DeMott
authored and
Mike DeMott
committed
48595a0
Merge remote-tracking branch 'origin/main' into hermes/live-worktree-upgrade-refreshed-20260827

Mike DeMott
authored and
Mike DeMott
committed
05a4817
fix(kanban): recognize the repeated-API-interrupt stall signature

Mike DeMott
authored and
Mike DeMott
committed
b1836f0
fix(egress): stop flagging common uppercase prose words as base64

Mike DeMott
authored and
Mike DeMott
committed
fac70c2
fix(kanban): count profile-default routes against the per-model cap unconditionally

Mike DeMott
authored and
Mike DeMott
committed
476e90e
Merge remote-tracking branch 'origin/main' into hermes/live-worktree-upgrade-refreshed-20260827

Mike DeMott
authored and
Mike DeMott
committed
d5a01d4
fix(kanban): count profile default routes by what actually runs, not the local_first resolver

authored and
Mike DeMott
committed
468d7f1
feat(kanban): add per-(provider,model) cap override for single-concurrency local servers

authored and
Mike DeMott
committed
6a46a5d

Commits on Aug 29, 2026

fix(egress): resolve base64/secret false positives that broke every remote-provider call

authored and
Mike DeMott
committed
997df8c
Merge branch 'main' of https://github.com/NousResearch/hermes-agent into hermes/live-worktree-upgrade-refreshed-20260827

Mike DeMott
authored and
Mike DeMott
committed
98ad106
fix(egress): admit bounded matched terminal output safely

Mike DeMott
authored and
Mike DeMott
committed
881a688
fix(kanban): preserve worker lifecycle and worktree environments

Mike DeMott
authored and
Mike DeMott
committed
6670e27
fix(pr-feedback): harden receipts and pooled worktree leases

Mike DeMott
authored and
Mike DeMott
committed
7bdfc37
fix(pr-feedback): preserve terminal truth and partial progress

Mike DeMott
authored and
Mike DeMott
committed
7c248ba