chore: merge upstream Hermes-Agent — 658 commits (2026-04-19)

[deestax]

Merges 658 upstream commits from NousResearch/Hermes-Agent into our fork's main. Merge-base 722331a57 → upstream tip 175cf7e6b (tag v2026.4.16).

Upstream highlights

• Ink/TUI gateway — new tui_gateway/ + ui-tui/ terminal UI rendering layer
• Honcho dialectic liveness — stale-thread watchdog, dialectic retry, prewarm, gateway session scoping
• AWS Bedrock adapter — full Bedrock Converse API support
• Browser CDP passthrough — new browser_cdp raw DevTools Protocol tool
• Feishu doc/drive tools
• Cron approval mode — approvals.cron_mode: deny/approve
• Plugin dashboard system — plugins/example-dashboard/
• Gateway pending-drain race fix in gateway/run.py
• Message deduplicator, session store prune
• title_generation now upstream — Myah adopts provider: auto, drops hard-coded openrouter+gemini pin

Conflicts resolved (4 files)

• hermes_cli/config.py — Adopted upstream provider: auto for title_generation and follow_up_generation. Drops hard-coded openrouter+gemini pin that cross-billed users with other providers.
• run_agent.py — Took upstream verbatim. Our OpenRouter fallback was dead code (gateway always passes explicit creds via resolve_runtime_provider()).
• gateway/run.py (×2) — Re-applied Sentry AI monitoring block before upstream's new _bg_review_release queueing; added _native_streaming_used OR-clause to upstream's richer already_sent logic.
• tests/hermes_cli/test_tools_config.py — Concatenated both sides' test classes.

Myah code integrity

• 11/11 block-marker parity across all 15 Myah-marker files
• 26 inline markers all present
• 19/19 Myah-only files intact
• Zero banned patterns (langfuse, render_ui, render_custom)

Test delta

	pass	fail	skip
Baseline (pre-merge)	2969	59	39
Post-merge	3408	29	39

Upstream fixed 30 pre-existing failures — net improvement.

E2E verification

Passed all 10 checks on x-ai/grok-4.20 via OpenRouter from the parent Myah PR (#23):

• /health returns {"status":"ok","platform":"hermes-agent"}
• /myah/api/toolsets returns 22 toolsets (not 404)
• Chat end-to-end: message streams with CoT reasoning visible
• Container spawns with updated image and HERMES_MODEL=x-ai/grok-4.20

Follow-ups (not on this branch)

1. Expose approvals.cron_mode in Myah Agent settings UI (new upstream feature)
2. Fix pre-existing cron webhook payload mismatch (cron/scheduler.py vs processes.py)
3. Upstream PR candidates: reasoning.delta streaming, per-request model on /v1/runs, enriched tool events, generic action confirmation

[github-actions]

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: base64 encoding/decoding detected

Base64 has legitimate uses (images, JWT, etc.) but is also commonly used to obfuscate malicious payloads. Verify the usage is appropriate.

Matches (first 20):

6965:+        payload = base64.b64encode(text.encode("utf-8")).decode("ascii")
17008:+    return base64.b64encode(os.urandom(32)).decode()
17029:+    key = base64.b64decode(key_base64)
17030:+    raw = base64.b64decode(encrypted_base64)
22940:+    image_bytes = base64.b64decode(b64_data, validate=True)
77389:+        expected_aes_key = base64.b64encode(aes_key.hex().encode("ascii")).decode("ascii")
92169:+        b64_png = base64.b64encode(FAKE_PNG).decode()
92205:+        b64_png = base64.b64encode(FAKE_PNG).decode()
96699:+                                "data": base64.b64encode(fake_pcm_bytes).decode(),
96890:+                                    "data": base64.b64encode(fake_pcm_bytes).decode()
104363:+    pcm_bytes = base64.b64decode(audio_b64)
136848:+  const b64 = Buffer.from(text, 'utf8').toString('base64')
153919:+  process.stdout.write(`\x1b]52;c;${Buffer.from(s, 'utf8').toString('base64')}\x07`)

⚠️ WARNING: exec() or eval() usage

Dynamic code execution can hide malicious behavior, especially when combined with base64 or network fetches.

Matches (first 20):

28904:+       across ``exec()``, so pip and git subprocesses also stop dying on
43795:+op('/project1/noise1').par.period.expr = "tdu.remap(op('/project1/spectrum_scale')['chan1'].eval(), 0, 1, 1, 8)"
45241:+`me.inputVal`, `me.chanIndex`, `me.sampleIndex` work ONLY in cook-context. Calling `par.expr0expr.eval()` from outside always raises an error — this is NOT a real operator error. Ignore these in error scans.
57173:+exec(open(os.path.join(os.environ.get("HERMES_HOME", os.path.expanduser("~/.hermes")), "skills/red-teaming/godmode/scripts/parseltongue.py")).read())
57182:+exec(open(os.path.join(os.environ.get("HERMES_HOME", os.path.expanduser("~/.hermes")), "skills/red-teaming/godmode/scripts/godmode_race.py")).read())
57195:+exec(open(os.path.join(os.environ.get("HERMES_HOME", os.path.expanduser("~/.hermes")), "skills/red-teaming/godmode/scripts/godmode_race.py")).read())
57208:+exec(open(os.path.join(os.environ.get("HERMES_HOME", os.path.expanduser("~/.hermes")), "skills/red-teaming/godmode/scripts/godmode_race.py")).read())
57234:+    exec(open(os.path.join(os.environ.get("HERMES_HOME", os.path.expanduser("~/.hermes")), "skills/red-teaming/godmode/scripts/godmode_race.py")).read())
57260:+    exec(open(os.path.join(os.environ.get("HERMES_HOME", os.path.expanduser("~/.hermes")), "skills/red-teaming/godmode/scripts/parseltongue.py")).read())
93122:+time and used that stale value for every subsequent _exec() call.  When
93132:+Fix: _exec() now prefers the LIVE ``env.cwd`` over the init-time
93184:+    """_exec() must use live env.cwd, not the init-time cached cwd."""
93204:+        result = ops._exec("cat target.txt")
93254:+        result = ops._exec("cat target.txt", cwd=str(dir_c))
93272:+        result = ops._exec("cat target.txt")
99543:+        self._sandbox.process.exec(
99549:+            self._sandbox.process.exec(f"rm -f {shlex.quote(remote_tar)}")
100580:+            Every _exec() call prefers the LIVE ``terminal_env.cwd`` over
100587:+            init-time cwd for every _exec() call, which caused relative
117693:+    const matches = ANSI_REGEX.exec(color)

⚠️ WARNING: Outbound network calls (POST/PUT)

Outbound POST/PUT requests in new code could be data exfiltration. Verify the destination URLs are legitimate.

Matches (first 10):

4634:+        with urllib.request.urlopen(request, timeout=timeout) as response:
5476:+        with urllib.request.urlopen(request, timeout=timeout) as response:
5556:+        with urllib.request.urlopen(request, timeout=timeout) as response:
24275:+    with urllib.request.urlopen(req, timeout=30) as resp:
24436:+        resp = requests.post(url, json=payload, timeout=15)
79366:+        with patch("hermes_cli.debug.urllib.request.urlopen",
104222:+    response = requests.post(
104331:+    response = requests.post(
107617:+                    with urllib.request.urlopen(probe, timeout=2.0) as resp:

⚠️ WARNING: Install hook files modified

These files can execute code during package installation or interpreter startup.

Files:

hermes_cli/memory_setup.py
hermes_cli/setup.py
skills/productivity/google-workspace/scripts/setup.py
tests/hermes_cli/test_setup.py
tests/skills/test_google_oauth_setup.py

⚠️ WARNING: CI/CD workflow files modified

Changes to workflow files can alter build pipelines, inject steps, or modify permissions. Verify no unauthorized actions or secrets access were added.

Files:

.github/workflows/deploy-site.yml

⚠️ WARNING: Container build files modified

Changes to Dockerfiles or compose files can alter base images, add build steps, or expose ports. Verify base image pins and build commands.

Files:

Dockerfile

⚠️ WARNING: Dependency manifest files modified

Changes to dependency files can introduce new packages or change version pins. Verify all dependency changes are intentional and from trusted sources.

Files:

pyproject.toml
ui-tui/package.json
ui-tui/packages/hermes-ink/package.json

---

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.