r34.0: merge upstream v2026.9.24 (Hermes 0.21.5) — fork semantics re-expressed, ledger

.dockerignore

@@ -80,9 +80,8 @@ apps/
 # Test suite — not shipped in production images
 tests/
 
-# Documentation site (Docusaurus) and supplementary docs
+# Documentation site (Docusaurus)
 website/
-docs/
 
 # Assets only used by the GitHub README
 assets/

.env.example

@@ -104,14 +104,6 @@
 # $10/month subscription. Get your key at: https://opencode.ai/auth
 # OPENCODE_GO_API_KEY=
 
-# =============================================================================
-# LLM PROVIDER (OpenCode Free)
-# =============================================================================
-# OpenCode Free provides keyless free models (Ox Alpha / x-preview-f-free,
-# big-pickle, etc.). NO env var and NO account needed — requests are sent
-# anonymously (the free tier rejects any unrecognized Authorization header).
-# Select it with `hermes model` or `/model free`.
-
 # =============================================================================
 # LLM PROVIDER (Hugging Face Inference Providers)
 # =============================================================================

.github/scripts/run-workspace-checks.mjs

@@ -133,7 +133,9 @@ async function main() {
   if (failed.length > 0) {
     for (const r of failed) console.error(`::error::${r.unit.pkg} :: ${r.unit.script} failed`)
     console.error(`::error::${failed.length} of ${results.length} checks failed`)
-    process.exit(1)
+    // Not process.exit(): it drops what stdout still buffers, which is the failing check's output.
+    process.exitCode = 1
+    return
   }
   console.log(`\nall ${results.length} checks passed`)
 }

.github/workflows/ci.yaml

@@ -22,8 +22,6 @@ on:
 permissions:
   contents: read
   pull-requests: write # needed by lint (PR comment) + supply-chain review_status
-  actions: read # needed by osv-scanner (SARIF upload)
-  security-events: write # needed by osv-scanner (SARIF upload)
 
 concurrency:
   group: ci-${{ github.ref }}
@@ -137,6 +135,14 @@ jobs:
     if: false
     uses: ./.github/workflows/e2e-desktop.yml
 
+  e2e-desktop-core:
+    name: Desktop core E2E
+    needs: detect
+    # The deterministic core suite (apps/desktop/e2e/core): transcript
+    # integrity, boot/respawn/orphans, clarify+approval. Required; retries 0.
+    if: ${{ needs.detect.outputs.python_prod == 'true' || needs.detect.outputs.frontend == 'true' }}
+    uses: ./.github/workflows/e2e-desktop-core.yml
+
   docs-site:
     name: Docs Site
     needs: detect
@@ -220,10 +226,6 @@ jobs:
       mcp_catalog: ${{ needs.detect.outputs.mcp_catalog == 'true' }}
       supply_chain: ${{ needs.supply-chain.outputs.critical_findings == 'true' }}
 
-  osv-scanner:
-    name: OSV scan
-    uses: ./.github/workflows/osv-scanner.yml
-
   # ─────────────────────────────────────────────────────────────────────
   # Gate: runs after everything. ``if: always()`` ensures it reports a
   # status even when some deps were skipped. Only actual ``failure``
@@ -246,6 +248,7 @@ jobs:
       - rust-tests
       - e2e-desktop
       - e2e-desktop-managed
+      - e2e-desktop-core
       - docs-site
       - history-check
       - contributor-check
@@ -257,7 +260,10 @@ jobs:
       - profile-artifact-check
       - supply-chain
       - review-labels
-      - osv-scanner
+      # OSV runs weekly against main (osv-scanner.yml schedule), not per PR:
+      # every PR was reporting the same repo-wide baseline of pinned-dep CVEs
+      # in its review comment, and the SARIF upload tripped GitHub's
+      # per-installation API rate limit during merge trains.
       # The image build runs in its own workflow (docker.yml) and reports
       # its own check. It was never required here, because it is too slow
       # to block a merge. A separate run also stops it from holding this

.github/workflows/deploy-site.yml

@@ -58,6 +58,8 @@ jobs:
       url: ${{ steps.deploy.outputs.page_url }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          fetch-depth: 0  # extract-plugins.py derives each catalog entry's added/updated dates from git log
 
       - name: Get GitHub App token
         id: app-token
@@ -139,6 +141,8 @@ jobs:
             echo "Downloading skills-index artifact from run $SKILLS_INDEX_RUN_ID"
             if gh run download "$SKILLS_INDEX_RUN_ID" --name skills-index --dir "$tmpdir"; then
               candidate="$(find "$tmpdir" -name skills-index.json -type f | head -n 1 || true)"
+              stars="$(find "$tmpdir" -name plugin-stars.json -type f | head -n 1 || true)"
+              [ -n "$stars" ] && cp "$stars" website/static/api/plugin-stars.json
               if [ -n "$candidate" ]; then
                 cp "$candidate" "$INDEX_PATH"
                 if validate_index; then
@@ -164,6 +168,13 @@ jobs:
       - name: Extract skill metadata for dashboard
         run: python3 website/scripts/extract-skills.py
 
+      # Star counts drive the catalog ranking. Same rule as the skills index: GitHub is only
+      # probed by the scheduled skills-index run; deploys reuse its artifact (downloaded above
+      # into website/static/api/ when SKILLS_INDEX_RUN_ID is set) or the live site's copy.
+      # Never calls the GitHub API.
+      - name: Reuse plugin GitHub stars (no API calls)
+        run: python3 website/scripts/fetch-plugin-stars.py
+
       - name: Extract plugin catalog for the Plugins page
         run: python3 website/scripts/extract-plugins.py
 

.github/workflows/docker.yml

@@ -74,19 +74,21 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
+        # Two images per arch. `slim` is what :latest has always been; `desktop`
+        # adds the Bot Screen packages and a headed Chromium (+1.4 GB) for the
+        # tier that offers a screen. Both are built on a PR so a change that only
+        # breaks the gated layers cannot reach publish.
+        arch: [amd64, arm64]
+        variant: [slim, desktop]
         include:
           - arch: amd64
             runner: ubuntu-latest-32-core
             platform: linux/amd64
-            cache-from: type=gha,scope=docker-amd64
-            cache-to: type=gha,mode=max,scope=docker-amd64
           # arm64 builds on the native arm64 larger runner. A build of
           # linux/arm64 on an x64 host uses emulation.
           - arch: arm64
             runner: ubuntu-latest-32-arm-core
             platform: linux/arm64
-            cache-from: type=gha,scope=docker-arm64
-            cache-to: type=gha,mode=max,scope=docker-arm64
 
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 45
@@ -124,8 +126,11 @@ jobs:
           tags: ${{ env.IMAGE_NAME }}:test
           build-args: |
             HERMES_GIT_SHA=${{ github.sha }}
-          cache-from: ${{ matrix.cache-from }}
-          cache-to: ${{ (github.event_name != 'pull_request') && matrix.cache-to || '' }}
+            HERMES_BOT_DESKTOP=${{ matrix.variant == 'desktop' && '1' || '0' }}
+          # Slim owns the scope; desktop is slim plus two RUN steps, so it reads
+          # and writes nothing — a 5.5 GB mode=max scope would blow the 10 GB cap.
+          cache-from: type=gha,scope=docker-${{ matrix.arch }}
+          cache-to: ${{ (github.event_name != 'pull_request' && matrix.variant == 'slim') && format('type=gha,mode=max,scope=docker-{0}', matrix.arch) || '' }}
 
 
       # Run the docker-integration test suite against the freshly-built
@@ -191,18 +196,16 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
+        arch: [amd64, arm64]
+        variant: [slim, desktop]
         include:
           - arch: amd64
             runner: ubuntu-latest-32-core
             platform: linux/amd64
-            cache-from: type=gha,scope=docker-amd64
-            cache-to: type=gha,mode=max,scope=docker-amd64
           # Native arm64 for the same reason as the build matrix above.
           - arch: arm64
             runner: ubuntu-latest-32-arm-core
             platform: linux/arm64
-            cache-from: type=gha,scope=docker-arm64
-            cache-to: type=gha,mode=max,scope=docker-arm64
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 30
     steps:
@@ -242,9 +245,10 @@ jobs:
             org.opencontainers.image.revision=${{ github.sha }}
           build-args: |
             HERMES_GIT_SHA=${{ github.sha }}
+            HERMES_BOT_DESKTOP=${{ matrix.variant == 'desktop' && '1' || '0' }}
           outputs: type=image,name=${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true
-          cache-from: ${{ matrix.cache-from }}
-          cache-to: ${{ matrix.cache-to }}
+          cache-from: type=gha,scope=docker-${{ matrix.arch }}
+          cache-to: ${{ matrix.variant == 'slim' && format('type=gha,mode=max,scope=docker-{0}', matrix.arch) || '' }}
 
       - name: Export digest
         run: |
@@ -255,7 +259,7 @@ jobs:
       - name: Upload digest artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
-          name: digest-${{ matrix.arch }}
+          name: digest-${{ matrix.variant }}-${{ matrix.arch }}
           path: /tmp/digests/*
           if-no-files-found: error
           retention-days: 1
@@ -269,17 +273,30 @@ jobs:
   # On releases: tags :<release_tag_name>.
   # ---------------------------------------------------------------------------
   merge:
-    if: github.repository == 'NousResearch/hermes-agent' && (github.event_name == 'push' && github.ref == 'refs/heads/main' || github.event_name == 'release')
+    # `needs` is the whole 4-leg matrix and a failed need skips the job, so a
+    # transient desktop push would take slim's :latest with it. Guard below.
+    if: ${{ !cancelled() && github.repository == 'NousResearch/hermes-agent' && (github.event_name == 'push' && github.ref == 'refs/heads/main' || github.event_name == 'release') }}
     runs-on: ubuntu-latest
     needs: [publish]
     timeout-minutes: 10
     environment: container-publish
+    strategy:
+      fail-fast: false
+      matrix:
+        # One manifest list per variant. `slim` keeps the unsuffixed tags it has
+        # always had, so nothing that pulls :latest today changes; `desktop`
+        # publishes the same digests under a -desktop suffix.
+        include:
+          - variant: slim
+            suffix: ""
+          - variant: desktop
+            suffix: "-desktop"
     steps:
       - name: Download digests
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           path: /tmp/digests
-          pattern: digest-*
+          pattern: digest-${{ matrix.variant }}-*
           merge-multiple: true
 
       # Retry once on transient Docker Hub / buildkit pull failures.
@@ -304,16 +321,25 @@ jobs:
         env:
           IMAGE_NAME: ${{ env.IMAGE_NAME }}
           RELEASE_TAG: ${{ github.event.release.tag_name }}
+          SUFFIX: ${{ matrix.suffix }}
         run: |
           set -euo pipefail
+          # Without nullglob an empty dir yields the literal `*`: one bogus entry.
+          shopt -s nullglob
           args=()
           for digest_file in *; do
             args+=("${IMAGE_NAME}@sha256:${digest_file}")
           done
+          # One per arch in the publish matrix; a short set means a leg failed, and
+          # stitching it would publish a single-arch :latest. Keep in step with it.
+          if [ "${#args[@]}" -ne 2 ]; then
+            echo "::error::variant ${{ matrix.variant }}: want 2 digests, found ${#args[@]} (a publish leg failed)"
+            exit 1
+          fi
           if [ "${{ github.event_name }}" = "release" ]; then
-            tags=(-t "${IMAGE_NAME}:${RELEASE_TAG}")
+            tags=(-t "${IMAGE_NAME}:${RELEASE_TAG}${SUFFIX}")
           else
-            tags=(-t "${IMAGE_NAME}:main" -t "${IMAGE_NAME}:latest")
+            tags=(-t "${IMAGE_NAME}:main${SUFFIX}" -t "${IMAGE_NAME}:latest${SUFFIX}")
           fi
           # Retry: Docker Hub API + just-pushed digest eventual consistency
           # can transiently fail the create; the operation is idempotent.
@@ -333,9 +359,10 @@ jobs:
         env:
           IMAGE_NAME: ${{ env.IMAGE_NAME }}
           RELEASE_TAG: ${{ github.event.release.tag_name }}
+          SUFFIX: ${{ matrix.suffix }}
         run: |
           if [ "${{ github.event_name }}" = "release" ]; then
-            docker buildx imagetools inspect "${IMAGE_NAME}:${RELEASE_TAG}"
+            docker buildx imagetools inspect "${IMAGE_NAME}:${RELEASE_TAG}${SUFFIX}"
           else
-            docker buildx imagetools inspect "${IMAGE_NAME}:main"
+            docker buildx imagetools inspect "${IMAGE_NAME}:main${SUFFIX}"
           fi

.github/workflows/docs-site-checks.yml

@@ -44,6 +44,19 @@ jobs:
       - name: Regenerate per-skill docs pages + catalogs
         run: python3 website/scripts/generate-skill-docs.py
 
+      - name: Committed skill docs match the generator
+        # GitHub renders the committed copies, so a regeneration that changes anything
+        # means the published catalogs/pages are stale. Fix: run the generator and commit.
+        run: |
+          git add -N website/docs website/sidebars.ts
+          if ! git diff --exit-code --stat -- website/docs website/sidebars.ts website/i18n; then
+            echo "::error::website/scripts/generate-skill-docs.py output differs from the committed docs; run it and commit the result"
+            exit 1
+          fi
+
+      - name: Check cross-page links resolve on GitHub and on the site
+        run: python3 website/scripts/check_doc_links.py
+
       - name: Lint docs diagrams
         run: npm run lint:diagrams
         working-directory: website