feat(display): add independent thinking_progress config option

[WolframRavenwolf]

Summary

Adds a new display.thinking_progress config option that relays assistant "thinking" text (the content the model emits between tool calls) as progress notifications to the chat, on all platforms (Telegram, WhatsApp, Discord, CLI, etc.).

Motivation

Without this option, assistant thinking text between tool calls is only visible in the server log (stdout). Users who want to follow the model's reasoning in real time had no way to see it in their chat. This feature fills that gap with a simple boolean toggle.

Changes

New config option

display:
  thinking_progress: true   # default: false

How it works

• Fully independent of tool_progress: The progress queue is created when either tool_progress or thinking_progress is enabled (needs_progress_queue flag), and the consumer task is gated on the same flag — so thinking_progress: true works even with tool_progress: off.
• No duplicate final response: Thinking text is only relayed when the model continues with tool calls. The final response (no tool calls) is delivered through the normal response path, avoiding double delivery.
• When enabled on the main agent, the full thinking text is relayed (no truncation).
• Subagent thinking relay (existing _delegate_depth > 0 behavior) remains unchanged and is independent of this option.

Files changed

• run_agent.py: Added thinking_progress attribute, gated _thinking relay on assistant_message.tool_calls to prevent duplicate final responses, controlled by thinking_progress flag (independent of tool_progress).
• gateway/run.py: Read thinking_progress from config, pass it to the agent, create progress queue and start consumer task when either tool_progress or thinking_progress is enabled.

Test plan

• thinking_progress: true + tool_progress: all → thinking text appears as progress notifications, final response appears only once
• thinking_progress: true + tool_progress: off → thinking text still appears (queue + consumer started via needs_progress_queue), no tool progress noise
• thinking_progress: false (default) → no thinking text relayed (existing behavior preserved)
• Subagent thinking relay still works regardless of thinking_progress setting
• Final response without tool calls does NOT trigger a duplicate _thinking notification

[github-actions]

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: exec() or eval() usage

Dynamic code execution can hide malicious behavior, especially when combined with base64 or network fetches.

Matches (first 20):

7639:+Persistent memory via the `brv` CLI — hierarchical knowledge tree with tiered retrieval (fuzzy text → LLM-driven search).
7687:+a hierarchical context tree with tiered retrieval (fuzzy text → LLM-driven
33539:+    def _start_modal_exec(self, prepared: PreparedModalExec) -> ModalExecStart:
33588:+    def _poll_modal_exec(self, handle: _ManagedModalExecHandle) -> dict | None:
33615:+    def _cancel_modal_exec(self, handle: _ManagedModalExecHandle) -> None:
33616:+        self._cancel_exec(handle.exec_id)
33715:+    def _cancel_exec(self, exec_id: str) -> None:
33767:+Uses ``Sandbox.create()`` + ``Sandbox.exec()`` instead of the older runtime
34064:+    def _start_modal_exec(self, prepared: PreparedModalExec) -> ModalExecStart:
34130:+    def _poll_modal_exec(self, handle: _DirectModalExecHandle) -> dict | None:
34137:+    def _cancel_modal_exec(self, handle: _DirectModalExecHandle) -> None:
34244:+        prepared = self._prepare_modal_exec(
34252:+            start = self._start_modal_exec(prepared)
34271:+                    self._cancel_modal_exec(start.handle)
34277:+                result = self._poll_modal_exec(start.handle)
34286:+                    self._cancel_modal_exec(start.handle)
34297:+    def _prepare_modal_exec(
34337:+    def _start_modal_exec(self, prepared: PreparedModalExec) -> ModalExecStart:
34341:+    def _poll_modal_exec(self, handle: Any) -> dict | None:
34345:+    def _cancel_modal_exec(self, handle: Any) -> None:

⚠️ WARNING: Outbound network calls (POST/PUT)

Outbound POST/PUT requests in new code could be data exfiltration. Verify the destination URLs are legitimate.

Matches (first 10):

12136:+        resp = self._httpx.post(

⚠️ WARNING: Install hook files modified

These files can execute code during package installation or interpreter startup.

Files:

hermes_cli/memory_setup.py
hermes_cli/setup.py
tests/hermes_cli/test_setup.py

---

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.

[github-actions]

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: base64 encoding/decoding detected

Base64 has legitimate uses (images, JWT, etc.) but is also commonly used to obfuscate malicious payloads. Verify the usage is appropriate.

Matches (first 20):

46263:+        img_b64 = base64.b64encode(resp.content).decode("utf-8")

⚠️ WARNING: exec() or eval() usage

Dynamic code execution can hide malicious behavior, especially when combined with base64 or network fetches.

Matches (first 20):

14732:+Persistent memory via the `brv` CLI — hierarchical knowledge tree with tiered retrieval (fuzzy text → LLM-driven search).
14780:+a hierarchical context tree with tiered retrieval (fuzzy text → LLM-driven
47208:+    def _start_modal_exec(self, prepared: PreparedModalExec) -> ModalExecStart:
47257:+    def _poll_modal_exec(self, handle: _ManagedModalExecHandle) -> dict | None:
47284:+    def _cancel_modal_exec(self, handle: _ManagedModalExecHandle) -> None:
47285:+        self._cancel_exec(handle.exec_id)
47384:+    def _cancel_exec(self, exec_id: str) -> None:
47436:+Uses ``Sandbox.create()`` + ``Sandbox.exec()`` instead of the older runtime
47733:+    def _start_modal_exec(self, prepared: PreparedModalExec) -> ModalExecStart:
47799:+    def _poll_modal_exec(self, handle: _DirectModalExecHandle) -> dict | None:
47806:+    def _cancel_modal_exec(self, handle: _DirectModalExecHandle) -> None:
47913:+        prepared = self._prepare_modal_exec(
47921:+            start = self._start_modal_exec(prepared)
47940:+                    self._cancel_modal_exec(start.handle)
47946:+                result = self._poll_modal_exec(start.handle)
47955:+                    self._cancel_modal_exec(start.handle)
47966:+    def _prepare_modal_exec(
48006:+    def _start_modal_exec(self, prepared: PreparedModalExec) -> ModalExecStart:
48010:+    def _poll_modal_exec(self, handle: Any) -> dict | None:
48014:+    def _cancel_modal_exec(self, handle: Any) -> None:

⚠️ WARNING: Outbound network calls (POST/PUT)

Outbound POST/PUT requests in new code could be data exfiltration. Verify the destination URLs are legitimate.

Matches (first 10):

755:+        with urllib.request.urlopen(req, timeout=15) as resp:
19291:+        resp = self._httpx.post(
45943:+    resp = requests.post(
45972:+    resp = requests.post(url, json=body, timeout=timeout)

⚠️ WARNING: Install hook files modified

These files can execute code during package installation or interpreter startup.

Files:

hermes_cli/memory_setup.py
hermes_cli/setup.py
tests/hermes_cli/test_setup.py

---

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.