fix: P1 review findings from the PR-feedback stack merges

.audit-tool-lock.json

@@ -0,0 +1,23 @@
+{
+  "schema_version": 1,
+  "tools": {
+    "zizmor": {
+      "version": "1.30.0",
+      "sha256": "sha256:98c426d9668ba03d7444acdb8a5f0eb44ba187ddffeba15833b605a384d50879"
+    },
+    "import-linter": {
+      "version": "2.14",
+      "sha256": "sha256:a6558ea7f4f0fea70cf21f63eac9d37018882f8ed529bb3313ba28e1a2bf279e",
+      "distribution_sha256": "sha256:de0858c9dc7eeca513b6daa31dec7099939addfb1f089536ec806a0b1611bddb"
+    },
+    "pip-audit": {
+      "version": "2.10.1",
+      "sha256": "sha256:ade9c86ba46074ca0224526121f061c67fadafabf00294c7d52d6436221604de",
+      "distribution_sha256": "sha256:5691c79b88f4c5c5b9f8f7642c9708d12275998fe7e523144b5c132807ac135c"
+    }
+  },
+  "uv": {
+    "version": "0.12.6",
+    "sha256": "sha256:e8929237934c8679686428f5a7736c7ae7a5fe7a33b0504d1b03446cdbc43c94"
+  }
+}

.env.example

@@ -19,7 +19,7 @@
 # Default model is configured in ~/.hermes/config.yaml (model.default).
 # Use 'hermes model' or 'hermes setup' to change it.
 # LLM_MODEL is no longer read from .env — this line is kept for reference only.
-# LLM_MODEL=anthropic/claude-opus-4.6
+# LLM_MODEL=openai-codex/gpt-5.5
 
 # =============================================================================
 # LLM PROVIDER (NovitaAI)

.github/actions/get-app-token/action.yml

@@ -12,7 +12,8 @@ description: >-
 
   Composite actions cannot access contexts directly, so callers pass the
   public vars.APP_CLIENT_ID and protected secrets.APP_PRIVATE_KEY as inputs.
-  When the private key is empty, the fallback fires.
+  When either credential is empty, the fallback fires rather than attempting
+  to mint with a partial credential pair.
 
 inputs:
   client-id:
@@ -31,6 +32,30 @@ inputs:
     description: Comma- or newline-separated repositories to scope within the installation owner.
     required: false
     default: ''
+  permission-actions:
+    description: Actions API permission requested for the token (read or write).
+    required: false
+    default: ''
+  permission-checks:
+    description: Checks API permission requested for the token (read or write).
+    required: false
+    default: ''
+  permission-contents:
+    description: Repository contents permission requested for the token (read or write).
+    required: false
+    default: ''
+  permission-issues:
+    description: Issues permission requested for the token (read or write).
+    required: false
+    default: ''
+  permission-pull-requests:
+    description: Pull request permission requested for the token (read or write).
+    required: false
+    default: ''
+  permission-statuses:
+    description: Commit status permission requested for the token (read or write).
+    required: false
+    default: ''
 
 outputs:
   token:
@@ -45,8 +70,9 @@ runs:
       shell: bash
       env:
         CLIENT_ID: ${{ inputs.client-id }}
+        PRIVATE_KEY: ${{ inputs.private-key }}
       run: |
-        if [ -n "$CLIENT_ID" ]; then
+        if [ -n "$CLIENT_ID" ] && [ -n "$PRIVATE_KEY" ]; then
           echo "has_app=true" >> "$GITHUB_OUTPUT"
         else
           echo "has_app=false" >> "$GITHUB_OUTPUT"
@@ -61,6 +87,12 @@ runs:
         private-key: ${{ inputs.private-key }}
         owner: ${{ inputs.owner }}
         repositories: ${{ inputs.repositories }}
+        permission-actions: ${{ inputs.permission-actions }}
+        permission-checks: ${{ inputs.permission-checks }}
+        permission-contents: ${{ inputs.permission-contents }}
+        permission-issues: ${{ inputs.permission-issues }}
+        permission-pull-requests: ${{ inputs.permission-pull-requests }}
+        permission-statuses: ${{ inputs.permission-statuses }}
 
     - name: Fall back to GITHUB_TOKEN
       id: fallback

.github/workflows/ci.yaml

@@ -18,12 +18,10 @@ on:
   pull_request:
   push:
     branches: [main]
+  workflow_dispatch:
 
 permissions:
   contents: read
-  pull-requests: write # needed by lint (PR comment) + supply-chain review_status
-  actions: read # needed by osv-scanner (SARIF upload)
-  security-events: write # needed by osv-scanner (SARIF upload)
 
 concurrency:
   group: ci-${{ github.ref }}
@@ -197,17 +195,24 @@ jobs:
   supply-chain:
     name: Supply-chain scan
     needs: detect
-    if: needs.detect.outputs.event_name == 'pull_request' && (needs.detect.outputs.scan == 'true' || needs.detect.outputs.deps == 'true')
+    if: needs.detect.outputs.event_name == 'pull_request' && (needs.detect.outputs.scan == 'true' || needs.detect.outputs.deps == 'true' || needs.detect.outputs.npm_lock == 'true')
+    permissions:
+      contents: read
+      pull-requests: read
     uses: ./.github/workflows/supply-chain-audit.yml
     with:
       event_name: ${{ needs.detect.outputs.event_name }}
       scan: ${{ needs.detect.outputs.scan == 'true' }}
       deps: ${{ needs.detect.outputs.deps == 'true' }}
+      npm_lock: ${{ needs.detect.outputs.npm_lock == 'true' }}
 
   review-labels:
     name: Review label gate
     needs: [detect, supply-chain]
     if: always() && needs.detect.outputs.event_name == 'pull_request' && (needs.detect.outputs.ci_review == 'true' || needs.detect.outputs.mcp_catalog == 'true' || needs.supply-chain.outputs.critical_findings == 'true')
+    permissions:
+      contents: read
+      pull-requests: read
     uses: ./.github/workflows/review-labels.yml
     with:
       ci_review: ${{ needs.detect.outputs.ci_review == 'true' }}
@@ -217,6 +222,10 @@ jobs:
 
   osv-scanner:
     name: OSV scan
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
     # PR scans use the artifact/review-status path below. Direct main pushes
     # are scanned by osv-scanner.yml's push trigger so they can publish SARIF.
     if: github.event_name == 'pull_request'

.github/workflows/deploy-site.yml

@@ -24,9 +24,6 @@ on:
 
 permissions:
   contents: read
-  actions: read
-  pages: write
-  id-token: write
 
 concurrency:
   group: pages
@@ -48,6 +45,11 @@ jobs:
 
   deploy-docs:
     if: github.repository == 'NousResearch/hermes-agent'
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+      pages: write
     runs-on: ubuntu-latest
     timeout-minutes: 30
     environment:
@@ -62,6 +64,8 @@ jobs:
         with:
           client-id: ${{ vars.APP_CLIENT_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-actions: read
+          permission-contents: read
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
         with:

.github/workflows/docker.yml

@@ -1,6 +1,8 @@
 name: Docker Build, Test, and Publish
 
 on:
+  push:
+    branches: [main]
   # This workflow owns its own triggers. ci.yml does not call it.
   # A reusable-workflow call eeps the caller run in progress for that full time.
   # GitHub refuses  ``gh run rerun`` on a run that is still in progress.
@@ -10,10 +12,9 @@ on:
   # Trusted main pushes resolve the environment-scoped Docker Hub secrets in
   # this same workflow, never across a workflow boundary.
   pull_request:
-  push:
-    branches: [main]
   release:
     types: [published]
+  workflow_dispatch:
 
 permissions:
   contents: read

.github/workflows/e2e-desktop.yml

@@ -107,8 +107,15 @@ jobs:
       # is always fresh — no separate build step needed.
       - name: Run Playwright E2E tests
         working-directory: apps/desktop
+        env:
+          GITHUB_REF_NAME_SAFE: ${{ github.ref_name }}
+          CI: 'true'
+          # Ensure no real API keys leak into the test env.
+          OPENROUTER_API_KEY: ''
+          OPENAI_API_KEY: ''
+          NOUS_API_KEY: ''
         run: |
-          if [ "${{ github.ref_name }}" = "main" ]; then
+          if [ "$GITHUB_REF_NAME_SAFE" = "main" ]; then
             echo "On main — generating/updating baseline screenshots"
             npm run build && xvfb-run -a --server-args="-screen 0 1280x1024x24" \
               npx playwright test --reporter=list --update-snapshots
@@ -117,12 +124,6 @@ jobs:
             npm run build && xvfb-run -a --server-args="-screen 0 1280x1024x24" \
               npx playwright test --reporter=list
           fi
-        env:
-          CI: 'true'
-          # Ensure no real API keys leak into the test env.
-          OPENROUTER_API_KEY: ''
-          OPENAI_API_KEY: ''
-          NOUS_API_KEY: ''
 
       # ── Save updated baselines to cache (main only) ───────────────────
       - name: Save updated baselines to cache

.github/workflows/js-autofix.yml

@@ -35,16 +35,6 @@ name: auto-fix lint issues & formatting
 #      on the current state.
 
 on:
-  push:
-    branches: [main]
-    paths:
-      - '**/*.js'
-      - '**/*.cjs'
-      - '**/*.mjs'
-      - '**/*.ts'
-      - '**/*.tsx'
-      - 'package.json'
-      - 'package-lock.json'
   workflow_dispatch:
 
 permissions:
@@ -141,8 +131,10 @@ jobs:
     timeout-minutes: 15
     environment: trusted-automation
     permissions:
+      checks: read # gh pr checks reads CheckRun entries
       contents: write # needed to push to bot/js-autofix
       pull-requests: write # needed for PR creation + auto-merge
+      statuses: read # gh pr checks also reads commit StatusContext entries
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
@@ -152,6 +144,10 @@ jobs:
         with:
           client-id: ${{ vars.APP_CLIENT_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-checks: read
+          permission-contents: write
+          permission-pull-requests: write
+          permission-statuses: read
 
       - name: Download patch
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4

.github/workflows/lint.yml

@@ -53,12 +53,15 @@ jobs:
 
       - name: Determine base ref
         id: base
+        env:
+          BASE_BRANCH: ${{ github.base_ref }}
+          EVENT_NAME: ${{ inputs.event_name }}
         run: |
           # For PRs, diff against the merge base with the target branch.
           # For pushes to main, diff against the previous commit on main.
-          if [ "${{ inputs.event_name }}" = "pull_request" ]; then
-            BASE_SHA=$(git merge-base "origin/${{ github.base_ref }}" HEAD)
-            BASE_REF="origin/${{ github.base_ref }}"
+          if [ "$EVENT_NAME" = "pull_request" ]; then
+            BASE_SHA=$(git merge-base "origin/$BASE_BRANCH" HEAD)
+            BASE_REF="origin/$BASE_BRANCH"
           else
             BASE_SHA=$(git rev-parse HEAD~1 2>/dev/null || git rev-parse HEAD)
             BASE_REF="HEAD~1"

.github/workflows/lockfile-diff.yml

@@ -47,12 +47,14 @@ jobs:
 
       - name: Generate semantic lockfile diff
         id: diff
+        env:
+          BASE_BRANCH: ${{ github.base_ref }}
         run: |
           set -euo pipefail
           # Three-dot semantics by hand: diff from the merge base with the
           # target branch to the PR head, so changes that landed on main
           # after the branch point don't show up as this PR's doing.
-          BASE_SHA=$(git merge-base "origin/${{ github.base_ref }}" HEAD)
+          BASE_SHA=$(git merge-base "origin/$BASE_BRANCH" HEAD)
           echo "Merge base: ${BASE_SHA}"
           python3 scripts/ci/lockfile_diff.py \
             --base "$BASE_SHA" \

.github/workflows/nix.yml

@@ -13,7 +13,9 @@ name: Nix flake check
 on:
   pull_request:
   push:
-    branches: [main]
+    branches:
+      - main
+  workflow_dispatch:
 
 permissions:
   contents: read