chore: sync from NousResearch/hermes-agent upstream

[github-actions]

Automated upstream sync from NousResearch/hermes-agent into pai-scaffolde/hermes-agent.

This branch is upstream/main with the PAI patch series rebased on top —
a linear patch stack, no merge commits. Review the diff and let CI run here.

Policy:

• This PR is review-gated. Do not auto-merge blindly.
• Existing CI/checks must pass before landing.
• Land by fast-forwarding main to this branch — do NOT use the green
  "Merge" button (a merge commit reintroduces the dual-history problem).
  From a clean checkout:

  git fetch origin
  git checkout main
  git reset --hard origin/automation/upstream-sync
  git push --force-with-lease origin main
  

• If the workflow used the GITHUB_TOKEN fallback, PR checks may need a
  manual rerun because workflow-created pushes do not always trigger
  downstream workflows.
• If the rebase conflicted, this PR was not updated; resolve locally per the
  failed job log and force-update main directly.

Source:

• upstream: NousResearch/hermes-agent main
• fork base: pai-scaffolde/hermes-agent main (PAI patch stack)

[github-actions]

🔎 Lint report: automation/upstream-sync vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 11223 on HEAD, 0 on base (🆕 +11223)

🆕 New issues (5890):

Rule	Count
unresolved-attribute	1719
unresolved-import	1648
invalid-argument-type	1199
invalid-assignment	532
unsupported-operator	204
not-subscriptable	149
invalid-parameter-default	132
invalid-method-override	103
invalid-return-type	52
no-matching-overload	34
call-non-callable	29
unused-type-ignore-comment	24
invalid-type-form	18
unresolved-reference	18
deprecated	9
+7 more rules

First entries

tests/gateway/test_api_server_runs.py:16: [unresolved-import] unresolved-import: Cannot resolve imported module `aiohttp`
tests/gateway/test_session_hygiene.py:18: [unresolved-import] unresolved-import: Cannot resolve imported module `pytest`
tests/agent/test_save_url_image.py:19: [unresolved-import] unresolved-import: Cannot resolve imported module `pytest`
plugins/platforms/google_chat/adapter.py:2519: [invalid-method-override] invalid-method-override: Invalid override of method `send_document`: Definition is incompatible with `BasePlatformAdapter.send_document`
tests/test_tui_gateway_server.py:3798: [unresolved-attribute] unresolved-attribute: Unresolved attribute `get_model_context_length` on type `ModuleType`
tests/hermes_cli/test_nous_subscription.py:843: [invalid-argument-type] invalid-argument-type: Argument to function `apply_nous_managed_defaults` is incorrect: Expected `dict[str, object]`, found `dict[str, dict[str, str]]`
tests/run_agent/test_compressor_fallback_update.py:66: [unresolved-attribute] unresolved-attribute: Object of type `AIAgent` has no attribute `context_compressor`
tests/cli/test_cli_provider_resolution.py:92: [unresolved-attribute] unresolved-attribute: Unresolved attribute `ANSI` on type `ModuleType`
agent/curator.py:1633: [invalid-argument-type] invalid-argument-type: Argument to function `_build_rename_summary` is incorrect: Expected `set[str]`, found `set[Any | None]`
tests/agent/test_secret_scope.py:2: [unresolved-import] unresolved-import: Cannot resolve imported module `pytest`
gateway/platforms/signal.py:1538: [invalid-parameter-default] invalid-parameter-default: Default value of type `None` is not assignable to annotated parameter type `MessageEvent`
tests/gateway/test_session_split_brain_11016.py:22: [unresolved-import] unresolved-import: Cannot resolve imported module `pytest`
gateway/platforms/wecom_callback.py:134: [unresolved-attribute] unresolved-attribute: Attribute `AsyncClient` is not defined on `None` in union `Unknown | None`
tests/run_agent/test_init_fallback_on_exhausted_pool.py:3: [unresolved-import] unresolved-import: Cannot resolve imported module `pytest`
skills/productivity/google-workspace/scripts/setup.py:427: [unresolved-import] unresolved-import: Cannot resolve imported module `google.auth.transport.requests`
tests/tools/test_managed_browserbase_and_modal.py:192: [invalid-assignment] invalid-assignment: Invalid subscript assignment with key of type `Literal["tools.environments.modal"]` and value of type `SimpleNamespace` on object of type `dict[str, ModuleType]`
tests/tools/test_web_tools_config.py:486: [invalid-argument-type] invalid-argument-type: Method `__getitem__` of type `bound method str.__getitem__(key: SupportsIndex | slice[SupportsIndex | None, SupportsIndex | None, SupportsIndex | None], /) -> str` cannot be called with key of type `Literal["required"]` on object of type `str`
gateway/platforms/api_server.py:3760: [invalid-argument-type] invalid-argument-type: Method `__getitem__` of type `bound method Top[dict[Unknown, Unknown]].__getitem__(key: Never, /) -> object` cannot be called with key of type `Literal["content"]` on object of type `Top[dict[Unknown, Unknown]]`
tests/agent/test_set_runtime_main_custom_provider.py:221: [invalid-argument-type] invalid-argument-type: Argument to function `resolve_provider_client` is incorrect: Expected `str`, found `None`
tests/plugins/platforms/photon/test_reactions.py:38: [invalid-assignment] invalid-assignment: Object of type `def _fake_call(path: str, body: dict[str, Any]) -> CoroutineType[Any, Any, dict[str, Any]]` is not assignable to attribute `_sidecar_call` of type `def _sidecar_call(self, path: str, body: dict[str, Any]) -> CoroutineType[Any, Any, dict[str, Any]]`
tests/gateway/test_tts_media_routing.py:111: [invalid-assignment] invalid-assignment: Object of type `AsyncMock` is not assignable to attribute `send_voice` of type `def send_voice(self, chat_id: str, audio_path: str, caption: str | None = None, reply_to: str | None = None, metadata: dict[str, Any] | None = None, **kwargs) -> CoroutineType[Any, Any, SendResult]`
tests/hermes_cli/test_placeholder_usage.py:7: [unresolved-import] unresolved-import: Cannot resolve imported module `pytest`
run_agent.py:4870: [unresolved-attribute] unresolved-attribute: Object of type `Self@_supports_reasoning_extra_body` has no attribute `model`
tests/agent/test_copilot_acp_client.py:29: [invalid-argument-type] invalid-argument-type: Argument to bound method `CopilotACPClient._handle_server_message` is incorrect: Expected `Popen[str]`, found `_FakeProcess`
cli.py:9378: [invalid-argument-type] invalid-argument-type: Argument to bound method `InsightsEngine.generate` is incorrect: Expected `str`, found `None | str`
... and 5865 more

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.

[github-actions]

⚠️ MCP catalog security review required

This PR changes the bundled MCP catalog or MCP catalog installer code. MCP entries can define local commands that users later install into mcp_servers, so this needs explicit maintainer review before merge.

A maintainer should verify:

• any new/changed optional-mcps/**/manifest.yaml command and args are expected,
• stdio transports do not use shell+egress/exfiltration payloads,
• git install refs are pinned and bootstrap commands are minimal,
• requested env vars/secrets match the upstream MCP's documented needs.

After review, add the mcp-catalog-reviewed label and re-run this check.

[github-actions]

🚨 CRITICAL Supply Chain Risk Detected

This PR contains a pattern that has been used in real supply chain attacks. A maintainer must review the flagged code carefully before merging.

🚨 CRITICAL: Install-hook file added or modified

These files can execute code during package installation or interpreter startup.

Files:

setup.py

---

Scanner only fires on high-signal indicators: .pth files, base64+exec/eval combos, subprocess with encoded commands, or install-hook files. Low-signal warnings were removed intentionally — if you're seeing this comment, the finding is worth inspecting.