feat(status): show model, context usage, and cumulative label in /status

[WolframRavenwolf]

Summary

Enhances the /status command to display:

• Model: name and provider (e.g., "claude-opus-4-20250514 (anthropic)")
• Context: approximate token usage vs limit with percentage (e.g., "~45,000 / 200,000 (23%)")
• Tokens: now labeled "(cumulative)" for clarity

Motivation

Users had no way to see which model was active or how much context was consumed without checking config files or logs. This information is critical for understanding agent behavior and knowing when context compression might kick in.

Changes

• gateway/run.py: Enhanced _handle_status_command with:
  • Live agent path: reads model, provider, context usage from running agent
  • Idle fallback: resolves from config + session entry + DEFAULT_CONTEXT_LENGTHS lookup
  • Correct sentinel check (agent is not _AGENT_PENDING_SENTINEL)
  • Context line shows even when context_used=0 (e.g., after /new) — checks context_total only, avoiding the Python falsy-zero pitfall

Example Output

📊 Status
  Agent Running: Yes
  Model: claude-opus-4-20250514 (anthropic)
  Session: My Research Session
  Context: ~45,231 / 200,000 (23%)
  Tokens: 125,432 in / 8,921 out (cumulative)
  Tools: 47 calls

Test Plan

• Model line appears when agent is running
• Context line shows "~0 / 200,000 (0%)" after /new
• Graceful degradation when model not in DEFAULT_CONTEXT_LENGTHS
• Backwards compatible — existing status lines unchanged, new lines are additive

Risk Assessment

Low — output-only change to a display command. No side effects, no API changes.

[github-actions]

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: base64 encoding/decoding detected

Base64 has legitimate uses (images, JWT, etc.) but is also commonly used to obfuscate malicious payloads. Verify the usage is appropriate.

Matches (first 20):

14633:+        img_b64 = base64.b64encode(resp.content).decode("utf-8")

⚠️ WARNING: Outbound network calls (POST/PUT)

Outbound POST/PUT requests in new code could be data exfiltration. Verify the destination URLs are legitimate.

Matches (first 10):

409:+        with urllib.request.urlopen(req, timeout=15) as resp:
14321:+    resp = requests.post(
14350:+    resp = requests.post(url, json=body, timeout=timeout)

⚠️ WARNING: Install hook files modified

These files can execute code during package installation or interpreter startup.

Files:

hermes_cli/setup.py
tests/hermes_cli/test_setup.py

---

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.

[github-actions]

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: base64 encoding/decoding detected

Base64 has legitimate uses (images, JWT, etc.) but is also commonly used to obfuscate malicious payloads. Verify the usage is appropriate.

Matches (first 20):

46218:+        img_b64 = base64.b64encode(resp.content).decode("utf-8")

⚠️ WARNING: exec() or eval() usage

Dynamic code execution can hide malicious behavior, especially when combined with base64 or network fetches.

Matches (first 20):

14739:+Persistent memory via the `brv` CLI — hierarchical knowledge tree with tiered retrieval (fuzzy text → LLM-driven search).
14787:+a hierarchical context tree with tiered retrieval (fuzzy text → LLM-driven
47163:+    def _start_modal_exec(self, prepared: PreparedModalExec) -> ModalExecStart:
47212:+    def _poll_modal_exec(self, handle: _ManagedModalExecHandle) -> dict | None:
47239:+    def _cancel_modal_exec(self, handle: _ManagedModalExecHandle) -> None:
47240:+        self._cancel_exec(handle.exec_id)
47339:+    def _cancel_exec(self, exec_id: str) -> None:
47391:+Uses ``Sandbox.create()`` + ``Sandbox.exec()`` instead of the older runtime
47688:+    def _start_modal_exec(self, prepared: PreparedModalExec) -> ModalExecStart:
47754:+    def _poll_modal_exec(self, handle: _DirectModalExecHandle) -> dict | None:
47761:+    def _cancel_modal_exec(self, handle: _DirectModalExecHandle) -> None:
47868:+        prepared = self._prepare_modal_exec(
47876:+            start = self._start_modal_exec(prepared)
47895:+                    self._cancel_modal_exec(start.handle)
47901:+                result = self._poll_modal_exec(start.handle)
47910:+                    self._cancel_modal_exec(start.handle)
47921:+    def _prepare_modal_exec(
47961:+    def _start_modal_exec(self, prepared: PreparedModalExec) -> ModalExecStart:
47965:+    def _poll_modal_exec(self, handle: Any) -> dict | None:
47969:+    def _cancel_modal_exec(self, handle: Any) -> None:

⚠️ WARNING: Outbound network calls (POST/PUT)

Outbound POST/PUT requests in new code could be data exfiltration. Verify the destination URLs are legitimate.

Matches (first 10):

755:+        with urllib.request.urlopen(req, timeout=15) as resp:
19298:+        resp = self._httpx.post(
45898:+    resp = requests.post(
45927:+    resp = requests.post(url, json=body, timeout=timeout)

⚠️ WARNING: Install hook files modified

These files can execute code during package installation or interpreter startup.

Files:

hermes_cli/memory_setup.py
hermes_cli/setup.py
tests/hermes_cli/test_setup.py

---

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.

[WolframRavenwolf]

Merged into main via cherry-pick. Upstream PR submitted as NousResearch#4678.

[WolframRavenwolf]

Merged into main via cherry-pick. Upstream PR submitted as NousResearch#4678.