feat: make tinker-atropos RL training fully optional

The tinker-atropos submodule and its heavy dependencies (atroposlib, tinker,
wandb, fastapi, uvicorn) were being installed for all users by default,
adding significant install time and disk usage for most users who don't
need RL training capabilities.

Changes:
- install.sh: Only init mini-swe-agent submodule by default; skip
  tinker-atropos clone and install entirely
- install.sh: Remove --recurse-submodules from git clone (only fetches
  what's needed)
- pyproject.toml: Add [rl] optional dependency group for explicit opt-in
- rl_training_tool.py: Move LOGS_DIR.mkdir() from module-level to lazy
  init (_ensure_logs_dir) to avoid side effects on import
- README.md: Update contributor quick start to not auto-fetch
  tinker-atropos; add RL opt-in instructions

Users who want RL training can opt in with:
  git submodule update --init tinker-atropos
  uv pip install -e ./tinker-atropos

.editorconfig

@@ -1,18 +0,0 @@
-root = true
-
-[*]
-indent_style = space
-indent_size = 4
-end_of_line = lf
-charset = utf-8
-trim_trailing_whitespace = true
-insert_final_newline = true
-
-[*.{yml,yaml,json,toml}]
-indent_size = 2
-
-[*.md]
-trim_trailing_whitespace = false
-
-[Makefile]
-indent_style = tab

.env.example

@@ -201,6 +201,18 @@ VOICE_TOOLS_OPENAI_KEY=
 # WHATSAPP_ENABLED=false
 # WHATSAPP_ALLOWED_USERS=15551234567
 
+# Email (IMAP/SMTP — send and receive emails as Hermes)
+# For Gmail: enable 2FA → create App Password at https://myaccount.google.com/apppasswords
+# EMAIL_ADDRESS=hermes@gmail.com
+# EMAIL_PASSWORD=xxxx xxxx xxxx xxxx
+# EMAIL_IMAP_HOST=imap.gmail.com
+# EMAIL_IMAP_PORT=993
+# EMAIL_SMTP_HOST=smtp.gmail.com
+# EMAIL_SMTP_PORT=587
+# EMAIL_POLL_INTERVAL=15
+# EMAIL_ALLOWED_USERS=your@email.com
+# EMAIL_HOME_ADDRESS=your@email.com
+
 # Gateway-wide: allow ALL users without an allowlist (default: false = deny)
 # Only set to true if you intentionally want open access.
 # GATEWAY_ALLOW_ALL_USERS=false

.github/PULL_REQUEST_TEMPLATE.md

@@ -46,7 +46,7 @@ Fixes #
 - [ ] My commit messages follow [Conventional Commits](https://www.conventionalcommits.org/) (`fix(scope):`, `feat(scope):`, etc.)
 - [ ] I searched for [existing PRs](https://github.com/NousResearch/hermes-agent/pulls) to make sure this isn't a duplicate
 - [ ] My PR contains **only** changes related to this fix/feature (no unrelated commits)
-- [ ] I've run `make check` (lint + test) and all checks pass
+- [ ] I've run `pytest tests/ -q` and all tests pass
 - [ ] I've added tests for my changes (required for bug fixes, strongly encouraged for features)
 - [ ] I've tested on my platform: <!-- e.g. Ubuntu 24.04, macOS 15.2, Windows 11 -->
 

.github/workflows/tests.yml

@@ -1,4 +1,4 @@
-name: CI
+name: Tests
 
 on:
   push:
@@ -6,42 +6,37 @@ on:
   pull_request:
     branches: [main]
 
+# Cancel in-progress runs for the same PR/branch
 concurrency:
-  group: ci-${{ github.ref }}
+  group: tests-${{ github.ref }}
   cancel-in-progress: true
 
-env:
-  SRC: >-
-    run_agent.py model_tools.py toolsets.py cli.py hermes_state.py batch_runner.py
-    tools/ hermes_cli/ gateway/ agent/ cron/
-
 jobs:
-  lint:
-    runs-on: ubuntu-latest
-    timeout-minutes: 3
-    steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
-      - run: uvx ruff check $SRC
-      - run: uvx ruff format --check $SRC
-
   test:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
-        with:
-          enable-cache: true
-      - run: uv python install 3.11
-      - run: |
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: Set up Python 3.11
+        run: uv python install 3.11
+
+      - name: Install dependencies
+        run: |
           uv venv .venv --python 3.11
           source .venv/bin/activate
           uv pip install -e ".[all,dev]"
-      - run: |
+
+      - name: Run tests
+        run: |
           source .venv/bin/activate
-          python -m pytest tests/ -q --ignore=tests/integration --tb=short
+          python -m pytest tests/ -q --ignore=tests/integration --tb=short -n auto
         env:
+          # Ensure tests don't accidentally call real APIs
           OPENROUTER_API_KEY: ""
           OPENAI_API_KEY: ""
           NOUS_API_KEY: ""

.gitignore

@@ -1,53 +1,55 @@
-# Python
-__pycache__/
-*.pyc
-*.pyo
-*.egg-info/
-dist/
-build/
-
-# Environments
-.venv/
-venv/
-
-# Tools
-.ruff_cache/
-.mypy_cache/
-.pytest_cache/
-
-# Editors
-.vscode/
-.idea/
-
-# Secrets & config
-.env
-.env.local
-.env.*.local
-*.pem
-*.ppk
-
-# Node
-node_modules/
-
-# Project-specific
-logs/
-data/
-tmp/
-wandb/
-images/
-browser-use/
-agent-browser/
-source-data/
-testlogs/
-ignored/
-.worktrees/
-temp_vision_images/
-cli-config.yaml
-skills/.hub/
-hermes-*/*
-examples/
-export*
-privvy*
-run_datagen_*.sh
-tests/quick_test_dataset.jsonl
-tests/sample_dataset.jsonl
+/venv/
+/_pycache/
+*.pyc*
+__pycache__/
+.venv/
+.vscode/
+.env
+.env.local
+.env.development.local
+.env.test.local
+.env.production.local
+.env.development
+.env.test
+export*
+__pycache__/model_tools.cpython-310.pyc
+__pycache__/web_tools.cpython-310.pyc
+logs/
+data/
+.pytest_cache/
+tmp/
+temp_vision_images/
+hermes-*/*
+examples/
+tests/quick_test_dataset.jsonl
+tests/sample_dataset.jsonl
+run_datagen_kimik2-thinking.sh
+run_datagen_megascience_glm4-6.sh
+run_datagen_sonnet.sh
+source-data/*
+run_datagen_megascience_glm4-6.sh
+data/*
+node_modules/
+browser-use/
+agent-browser/
+# Private keys
+*.ppk
+*.pem
+privvy*
+images/
+__pycache__/
+hermes_agent.egg-info/
+wandb/
+testlogs
+
+# CLI config (may contain sensitive SSH paths)
+cli-config.yaml
+
+# Skills Hub state (lives in ~/.hermes/skills/.hub/ at runtime, but just in case)
+skills/.hub/
+ignored/
+.worktrees/
+environments/benchmarks/evals/
+
+# Release script temp files
+.release_notes.md

.plans/openai-api-server.md

@@ -0,0 +1,291 @@
+# OpenAI-Compatible API Server for Hermes Agent
+
+## Motivation
+
+Every major chat frontend (Open WebUI 126k★, LobeChat 73k★, LibreChat 34k★,
+AnythingLLM 56k★, NextChat 87k★, ChatBox 39k★, Jan 26k★, HF Chat-UI 8k★,
+big-AGI 7k★) connects to backends via the OpenAI-compatible REST API with
+SSE streaming. By exposing this endpoint, hermes-agent becomes instantly
+usable as a backend for all of them — no custom adapters needed.
+
+## What It Enables
+
+```
+┌──────────────────┐
+│  Open WebUI      │──┐
+│  LobeChat        │  │    POST /v1/chat/completions
+│  LibreChat       │  ├──► Authorization: Bearer <key>     ┌─────────────────┐
+│  AnythingLLM     │  │    {"messages": [...]}             │  hermes-agent   │
+│  NextChat        │  │                                    │  gateway        │
+│  Any OAI client  │──┘    ◄── SSE streaming response      │  (API server)   │
+└──────────────────┘                                        └─────────────────┘
+```
+
+A user would:
+1. Set `API_SERVER_ENABLED=true` in `~/.hermes/.env`
+2. Run `hermes gateway` (API server starts alongside Telegram/Discord/etc.)
+3. Point Open WebUI (or any frontend) at `http://localhost:8642/v1`
+4. Chat with hermes-agent through any OpenAI-compatible UI
+
+## Endpoints
+
+| Method | Path | Purpose |
+|--------|------|---------|
+| POST | `/v1/chat/completions` | Chat with the agent (streaming + non-streaming) |
+| GET | `/v1/models` | List available "models" (returns hermes-agent as a model) |
+| GET | `/health` | Health check |
+
+## Architecture
+
+### Option A: Gateway Platform Adapter (recommended)
+
+Create `gateway/platforms/api_server.py` as a new platform adapter that
+extends `BasePlatformAdapter`. This is the cleanest approach because:
+
+- Reuses all gateway infrastructure (session management, auth, context building)
+- Runs in the same async loop as other adapters
+- Gets message handling, interrupt support, and session persistence for free
+- Follows the established pattern (like Telegram, Discord, etc.)
+- Uses `aiohttp.web` (already a dependency) for the HTTP server
+
+The adapter would start an `aiohttp.web.Application` server in `connect()`
+and route incoming HTTP requests through the standard `handle_message()` pipeline.
+
+### Option B: Standalone Component
+
+A separate HTTP server class in `gateway/api_server.py` that creates its own
+AIAgent instances directly. Simpler but duplicates session/auth logic.
+
+**Recommendation: Option A** — fits the existing architecture, less code to
+maintain, gets all gateway features for free.
+
+## Request/Response Format
+
+### Chat Completions (non-streaming)
+
+```
+POST /v1/chat/completions
+Authorization: Bearer hermes-api-key-here
+Content-Type: application/json
+
+{
+  "model": "hermes-agent",
+  "messages": [
+    {"role": "system", "content": "You are a helpful assistant."},
+    {"role": "user", "content": "What files are in the current directory?"}
+  ],
+  "stream": false,
+  "temperature": 0.7
+}
+```
+
+Response:
+```json
+{
+  "id": "chatcmpl-abc123",
+  "object": "chat.completion",
+  "created": 1710000000,
+  "model": "hermes-agent",
+  "choices": [{
+    "index": 0,
+    "message": {
+      "role": "assistant",
+      "content": "Here are the files in the current directory:\n..."
+    },
+    "finish_reason": "stop"
+  }],
+  "usage": {
+    "prompt_tokens": 50,
+    "completion_tokens": 200,
+    "total_tokens": 250
+  }
+}
+```
+
+### Chat Completions (streaming)
+
+Same request with `"stream": true`. Response is SSE:
+
+```
+data: {"id":"chatcmpl-abc123","object":"chat.completion.chunk","choices":[{"index":0,"delta":{"role":"assistant"},"finish_reason":null}]}
+
+data: {"id":"chatcmpl-abc123","object":"chat.completion.chunk","choices":[{"index":0,"delta":{"content":"Here "},"finish_reason":null}]}
+
+data: {"id":"chatcmpl-abc123","object":"chat.completion.chunk","choices":[{"index":0,"delta":{"content":"are "},"finish_reason":null}]}
+
+data: {"id":"chatcmpl-abc123","object":"chat.completion.chunk","choices":[{"index":0,"delta":{},"finish_reason":"stop"}]}
+
+data: [DONE]
+```
+
+### Models List
+
+```
+GET /v1/models
+Authorization: Bearer hermes-api-key-here
+```
+
+Response:
+```json
+{
+  "object": "list",
+  "data": [{
+    "id": "hermes-agent",
+    "object": "model",
+    "created": 1710000000,
+    "owned_by": "hermes-agent"
+  }]
+}
+```
+
+## Key Design Decisions
+
+### 1. Session Management
+
+The OpenAI API is stateless — each request includes the full conversation.
+But hermes-agent sessions have persistent state (memory, skills, tool context).
+
+**Approach: Hybrid**
+- Default: Stateless. Each request is independent. The `messages` array IS
+  the conversation. No session persistence between requests.
+- Opt-in persistent sessions via `X-Session-ID` header. When provided, the
+  server maintains session state across requests (conversation history,
+  memory context, tool state). This enables richer agent behavior.
+- The session ID also enables interrupt support — a subsequent request with
+  the same session ID while one is running triggers an interrupt.
+
+### 2. Streaming
+
+The agent's `run_conversation()` is synchronous and returns the full response.
+For real SSE streaming, we need to emit chunks as they're generated.
+
+**Phase 1 (MVP):** Run agent in a thread, return the complete response as
+a single SSE chunk + `[DONE]`. This works with all frontends — they just see
+a fast single-chunk response. Not true streaming but functional.
+
+**Phase 2:** Add a response callback to AIAgent that emits text chunks as the
+LLM generates them. The API server captures these via a queue and streams them
+as SSE events. This gives real token-by-token streaming.
+
+**Phase 3:** Stream tool execution progress too — emit tool call/result events
+as the agent works, giving frontends visibility into what the agent is doing.
+
+### 3. Tool Transparency
+
+Two modes:
+- **Opaque (default):** Frontends see only the final response. Tool calls
+  happen server-side and are invisible. Best for general-purpose UIs.
+- **Transparent (opt-in via header):** Tool calls are emitted as OpenAI-format
+  tool_call/tool_result messages in the stream. Useful for agent-aware frontends.
+
+### 4. Authentication
+
+- Bearer token via `Authorization: Bearer <key>` header
+- Token configured via `API_SERVER_KEY` env var
+- Optional: allow unauthenticated local-only access (127.0.0.1 bind)
+- Follows the same pattern as other platform adapters
+
+### 5. Model Mapping
+
+Frontends send `"model": "hermes-agent"` (or whatever). The actual LLM model
+used is configured server-side in config.yaml. The API server maps any
+requested model name to the configured hermes-agent model.
+
+Optionally, allow model passthrough: if the frontend sends
+`"model": "anthropic/claude-sonnet-4"`, the agent uses that model. Controlled
+by a config flag.
+
+## Configuration
+
+```yaml
+# In config.yaml
+api_server:
+  enabled: true
+  port: 8642
+  host: "127.0.0.1"        # localhost only by default
+  key: "your-secret-key"   # or via API_SERVER_KEY env var
+  allow_model_override: false  # let clients choose the model
+  max_concurrent: 5         # max simultaneous requests
+```
+
+Environment variables:
+```bash
+API_SERVER_ENABLED=true
+API_SERVER_PORT=8642
+API_SERVER_HOST=127.0.0.1
+API_SERVER_KEY=your-secret-key
+```
+
+## Implementation Plan
+
+### Phase 1: MVP (non-streaming) — PR
+
+1. `gateway/platforms/api_server.py` — new adapter
+   - aiohttp.web server with endpoints:
+     - `POST /v1/chat/completions` — Chat Completions API (universal compat)
+     - `POST /v1/responses` — Responses API (server-side state, tool preservation)
+     - `GET /v1/models` — list available models
+     - `GET /health` — health check
+   - Bearer token auth middleware
+   - Non-streaming responses (run agent, return full result)
+   - Chat Completions: stateless, messages array is the conversation
+   - Responses API: server-side conversation storage via previous_response_id
+     - Store full internal conversation (including tool calls) keyed by response ID
+     - On subsequent requests, reconstruct full context from stored chain
+   - Frontend system prompt layered on top of hermes-agent's core prompt
+
+2. `gateway/config.py` — add `Platform.API_SERVER` enum + config
+
+3. `gateway/run.py` — register adapter in `_create_adapter()`
+
+4. Tests in `tests/gateway/test_api_server.py`
+
+### Phase 2: SSE Streaming
+
+1. Add response streaming to both endpoints
+   - Chat Completions: `choices[0].delta.content` SSE format
+   - Responses API: semantic events (response.output_text.delta, etc.)
+   - Run agent in thread, collect output via callback queue
+   - Handle client disconnect (cancel agent)
+
+2. Add `stream_callback` parameter to `AIAgent.run_conversation()`
+
+### Phase 3: Enhanced Features
+
+1. Tool call transparency mode (opt-in)
+2. Model passthrough/override
+3. Concurrent request limiting
+4. Usage tracking / rate limiting
+5. CORS headers for browser-based frontends
+6. GET /v1/responses/{id} — retrieve stored response
+7. DELETE /v1/responses/{id} — delete stored response
+
+## Files Changed
+
+| File | Change |
+|------|--------|
+| `gateway/platforms/api_server.py` | NEW — main adapter (~300 lines) |
+| `gateway/config.py` | Add Platform.API_SERVER + config (~20 lines) |
+| `gateway/run.py` | Register adapter in _create_adapter() (~10 lines) |
+| `tests/gateway/test_api_server.py` | NEW — tests (~200 lines) |
+| `cli-config.yaml.example` | Add api_server section |
+| `README.md` | Mention API server in platform list |
+
+## Compatibility Matrix
+
+Once implemented, hermes-agent works as a drop-in backend for:
+
+| Frontend | Stars | How to Connect |
+|----------|-------|---------------|
+| Open WebUI | 126k | Settings → Connections → Add OpenAI API, URL: `http://localhost:8642/v1` |
+| NextChat | 87k | BASE_URL env var |
+| LobeChat | 73k | Custom provider endpoint |
+| AnythingLLM | 56k | LLM Provider → Generic OpenAI |
+| Oobabooga | 42k | Already a backend, not a frontend |
+| ChatBox | 39k | API Host setting |
+| LibreChat | 34k | librechat.yaml custom endpoint |
+| Chatbot UI | 29k | Custom API endpoint |
+| Jan | 26k | Remote model config |
+| AionUI | 18k | Custom API endpoint |
+| HF Chat-UI | 8k | OPENAI_BASE_URL env var |
+| big-AGI | 7k | Custom endpoint |

.plans/streaming-support.md

@@ -0,0 +1,705 @@
+# Streaming LLM Response Support for Hermes Agent
+
+## Overview
+
+Add token-by-token streaming of LLM responses across all platforms. When enabled,
+users see the response typing out live instead of waiting for the full generation.
+Streaming is opt-in via config, defaults to off, and all existing non-streaming
+code paths remain intact as the default.
+
+## Design Principles
+
+1. **Feature-flagged**: `streaming.enabled: true` in config.yaml. Off by default.
+   When off, all existing code paths are unchanged — zero risk to current behavior.
+2. **Callback-based**: A simple `stream_callback(text_delta: str)` function injected
+   into AIAgent. The agent doesn't know or care what the consumer does with tokens.
+3. **Graceful degradation**: If the provider doesn't support streaming, or streaming
+   fails for any reason, silently fall back to the non-streaming path.
+4. **Platform-agnostic core**: The streaming mechanism in AIAgent works the same
+   regardless of whether the consumer is CLI, Telegram, Discord, or the API server.
+
+---
+
+## Architecture
+
+```
+                              stream_callback(delta)
+                                    │
+  ┌─────────────┐    ┌─────────────▼──────────────┐
+  │  LLM API    │    │      queue.Queue()          │
+  │  (stream)   │───►│  thread-safe bridge between │
+  │             │    │  agent thread & consumer    │
+  └─────────────┘    └─────────────┬──────────────┘
+                                   │
+                    ┌──────────────┼──────────────┐
+                    │              │              │
+              ┌─────▼─────┐ ┌─────▼─────┐ ┌─────▼─────┐
+              │    CLI     │ │  Gateway  │ │ API Server│
+              │ print to   │ │ edit msg  │ │ SSE event │
+              │ terminal   │ │ on Tg/Dc  │ │ to client │
+              └───────────┘ └───────────┘ └───────────┘
+```
+
+The agent runs in a thread. The callback puts tokens into a thread-safe queue.
+Each consumer reads the queue in its own context (async task, main thread, etc.).
+
+---
+
+## Configuration
+
+### config.yaml
+
+```yaml
+streaming:
+  enabled: false          # Master switch. Default off.
+  # Per-platform overrides (optional):
+  # cli: true             # Override for CLI only
+  # telegram: true        # Override for Telegram only
+  # discord: false        # Keep Discord non-streaming
+  # api_server: true      # Override for API server
+```
+
+### Environment variables
+
+```
+HERMES_STREAMING_ENABLED=true    # Master switch via env
+```
+
+### How the flag is read
+
+- **CLI**: `load_cli_config()` reads `streaming.enabled`, sets env var. AIAgent
+  checks at init time.
+- **Gateway**: `_run_agent()` reads config, decides whether to pass
+  `stream_callback` to the AIAgent constructor.
+- **API server**: For Chat Completions `stream=true` requests, always uses streaming
+  regardless of config (the client is explicitly requesting it). For non-stream
+  requests, uses config.
+
+### Precedence
+
+1. API server: client's `stream` field overrides everything
+2. Per-platform config override (e.g., `streaming.telegram: true`)
+3. Master `streaming.enabled` flag
+4. Default: off
+
+---
+
+## Implementation Plan
+
+### Phase 1: Core streaming infrastructure in AIAgent
+
+**File: run_agent.py**
+
+#### 1a. Add stream_callback parameter to __init__ (~5 lines)
+
+```python
+def __init__(self, ..., stream_callback: callable = None, ...):
+    self.stream_callback = stream_callback
+```
+
+No other init changes. The callback is optional — when None, everything
+works exactly as before.
+
+#### 1b. Add _run_streaming_chat_completion() method (~65 lines)
+
+New method for Chat Completions API streaming:
+
+```python
+def _run_streaming_chat_completion(self, api_kwargs: dict):
+    """Stream a chat completion, emitting text tokens via stream_callback.
+    
+    Returns a fake response object compatible with the non-streaming code path.
+    Falls back to non-streaming on any error.
+    """
+    stream_kwargs = dict(api_kwargs)
+    stream_kwargs["stream"] = True
+    stream_kwargs["stream_options"] = {"include_usage": True}
+    
+    accumulated_content = []
+    accumulated_tool_calls = {}  # index -> {id, name, arguments}
+    final_usage = None
+    
+    try:
+        stream = self.client.chat.completions.create(**stream_kwargs)
+        
+        for chunk in stream:
+            if not chunk.choices:
+                # Usage-only chunk (final)
+                if chunk.usage:
+                    final_usage = chunk.usage
+                continue
+            
+            delta = chunk.choices[0].delta
+            
+            # Text content — emit via callback
+            if delta.content:
+                accumulated_content.append(delta.content)
+                if self.stream_callback:
+                    try:
+                        self.stream_callback(delta.content)
+                    except Exception:
+                        pass
+            
+            # Tool call deltas — accumulate silently
+            if delta.tool_calls:
+                for tc_delta in delta.tool_calls:
+                    idx = tc_delta.index
+                    if idx not in accumulated_tool_calls:
+                        accumulated_tool_calls[idx] = {
+                            "id": tc_delta.id or "",
+                            "name": "", "arguments": ""
+                        }
+                    if tc_delta.function:
+                        if tc_delta.function.name:
+                            accumulated_tool_calls[idx]["name"] = tc_delta.function.name
+                        if tc_delta.function.arguments:
+                            accumulated_tool_calls[idx]["arguments"] += tc_delta.function.arguments
+        
+        # Build fake response compatible with existing code
+        tool_calls = []
+        for idx in sorted(accumulated_tool_calls):
+            tc = accumulated_tool_calls[idx]
+            if tc["name"]:
+                tool_calls.append(SimpleNamespace(
+                    id=tc["id"], type="function",
+                    function=SimpleNamespace(name=tc["name"], arguments=tc["arguments"]),
+                ))
+        
+        return SimpleNamespace(
+            choices=[SimpleNamespace(
+                message=SimpleNamespace(
+                    content="".join(accumulated_content) or "",
+                    tool_calls=tool_calls or None,
+                    role="assistant",
+                ),
+                finish_reason="tool_calls" if tool_calls else "stop",
+            )],
+            usage=final_usage,
+            model=self.model,
+        )
+    
+    except Exception as e:
+        logger.debug("Streaming failed, falling back to non-streaming: %s", e)
+        return self.client.chat.completions.create(**api_kwargs)
+```
+
+#### 1c. Modify _run_codex_stream() for Responses API (~10 lines)
+
+The method already iterates the stream. Add callback emission:
+
+```python
+def _run_codex_stream(self, api_kwargs: dict):
+    with self.client.responses.stream(**api_kwargs) as stream:
+        for event in stream:
+            # Emit text deltas if streaming callback is set
+            if self.stream_callback and hasattr(event, 'type'):
+                if event.type == 'response.output_text.delta':
+                    try:
+                        self.stream_callback(event.delta)
+                    except Exception:
+                        pass
+        return stream.get_final_response()
+```
+
+#### 1d. Modify _interruptible_api_call() (~5 lines)
+
+Add the streaming branch:
+
+```python
+def _call():
+    try:
+        if self.api_mode == "codex_responses":
+            result["response"] = self._run_codex_stream(api_kwargs)
+        elif self.stream_callback is not None:
+            result["response"] = self._run_streaming_chat_completion(api_kwargs)
+        else:
+            result["response"] = self.client.chat.completions.create(**api_kwargs)
+    except Exception as e:
+        result["error"] = e
+```
+
+#### 1e. Signal end-of-stream to consumers (~5 lines)
+
+After the API call returns, signal the callback that streaming is done
+so consumers can finalize (remove cursor, close SSE, etc.):
+
+```python
+# In run_conversation(), after _interruptible_api_call returns:
+if self.stream_callback:
+    try:
+        self.stream_callback(None)  # None = end of stream signal
+    except Exception:
+        pass
+```
+
+Consumers check: `if delta is None: finalize()`
+
+**Tests for Phase 1:** (~150 lines)
+- Test _run_streaming_chat_completion with mocked stream
+- Test fallback to non-streaming on error
+- Test tool_call accumulation during streaming
+- Test stream_callback receives correct deltas
+- Test None signal at end of stream
+- Test streaming disabled when callback is None
+
+---
+
+### Phase 2: Gateway consumers (Telegram, Discord, etc.)
+
+**File: gateway/run.py**
+
+#### 2a. Read streaming config (~15 lines)
+
+In `_run_agent()`, before creating the AIAgent:
+
+```python
+# Read streaming config
+_streaming_enabled = False
+try:
+    # Check per-platform override first
+    platform_key = source.platform.value if source.platform else ""
+    _stream_cfg = {}  # loaded from config.yaml streaming section
+    if _stream_cfg.get(platform_key) is not None:
+        _streaming_enabled = bool(_stream_cfg[platform_key])
+    else:
+        _streaming_enabled = bool(_stream_cfg.get("enabled", False))
+except Exception:
+    pass
+# Env var override
+if os.getenv("HERMES_STREAMING_ENABLED", "").lower() in ("true", "1", "yes"):
+    _streaming_enabled = True
+```
+
+#### 2b. Set up queue + callback (~15 lines)
+
+```python
+_stream_q = None
+_stream_done = None
+_stream_msg_id = [None]  # mutable ref for the async task
+
+if _streaming_enabled:
+    import queue as _q
+    _stream_q = _q.Queue()
+    _stream_done = threading.Event()
+    
+    def _on_token(delta):
+        if delta is None:
+            _stream_done.set()
+        else:
+            _stream_q.put(delta)
+```
+
+Pass `stream_callback=_on_token` to the AIAgent constructor.
+
+#### 2c. Telegram/Discord stream preview task (~50 lines)
+
+```python
+async def stream_preview():
+    """Progressively edit a message with streaming tokens."""
+    if not _stream_q:
+        return
+    adapter = self.adapters.get(source.platform)
+    if not adapter:
+        return
+    
+    accumulated = []
+    token_count = 0
+    last_edit = 0.0
+    MIN_TOKENS = 20          # Don't show until enough context
+    EDIT_INTERVAL = 1.5      # Respect Telegram rate limits
+    
+    try:
+        while not _stream_done.is_set():
+            try:
+                chunk = _stream_q.get(timeout=0.1)
+                accumulated.append(chunk)
+                token_count += 1
+            except queue.Empty:
+                continue
+            
+            now = time.monotonic()
+            if token_count >= MIN_TOKENS and (now - last_edit) >= EDIT_INTERVAL:
+                preview = "".join(accumulated) + " ▌"
+                if _stream_msg_id[0] is None:
+                    r = await adapter.send(
+                        chat_id=source.chat_id,
+                        content=preview,
+                        metadata=_thread_metadata,
+                    )
+                    if r.success and r.message_id:
+                        _stream_msg_id[0] = r.message_id
+                else:
+                    await adapter.edit_message(
+                        chat_id=source.chat_id,
+                        message_id=_stream_msg_id[0],
+                        content=preview,
+                    )
+                last_edit = now
+        
+        # Drain remaining tokens
+        while not _stream_q.empty():
+            accumulated.append(_stream_q.get_nowait())
+        
+        # Final edit — remove cursor, show complete text
+        if _stream_msg_id[0] and accumulated:
+            await adapter.edit_message(
+                chat_id=source.chat_id,
+                message_id=_stream_msg_id[0],
+                content="".join(accumulated),
+            )
+    
+    except asyncio.CancelledError:
+        # Clean up on cancel
+        if _stream_msg_id[0] and accumulated:
+            try:
+                await adapter.edit_message(
+                    chat_id=source.chat_id,
+                    message_id=_stream_msg_id[0],
+                    content="".join(accumulated),
+                )
+            except Exception:
+                pass
+    except Exception as e:
+        logger.debug("stream_preview error: %s", e)
+```
+
+#### 2d. Skip final send if already streamed (~10 lines)
+
+In `_process_message_background()` (base.py), after getting the response,
+if streaming was active and `_stream_msg_id[0]` is set, the final response
+was already delivered via progressive edits. Skip the normal `self.send()`
+call to avoid duplicating the message.
+
+This is the most delicate integration point — we need to communicate from
+the gateway's `_run_agent` back to the base adapter's response sender that
+the response was already delivered. Options:
+
+- **Option A**: Return a special marker in the result dict:
+  `result["_streamed_msg_id"] = _stream_msg_id[0]`
+  The base adapter checks this and skips `send()`.
+  
+- **Option B**: Edit the already-sent message with the final response
+  (which may differ slightly from accumulated tokens due to think-block
+  stripping, etc.) and don't send a new one.
+
+- **Option C**: The stream preview task handles the FULL final response
+  (including any post-processing), and the handler returns None to skip
+  the normal send path.
+
+Recommended: **Option A** — cleanest separation. The result dict already
+carries metadata; adding one more field is low-risk.
+
+**Platform-specific considerations:**
+
+| Platform | Edit support | Rate limits | Streaming approach |
+|----------|-------------|-------------|-------------------|
+| Telegram | ✅ edit_message_text | ~20 edits/min | Edit every 1.5s |
+| Discord | ✅ message.edit | 5 edits/5s per message | Edit every 1.2s |
+| Slack | ✅ chat.update | Tier 3 (~50/min) | Edit every 1.5s |
+| WhatsApp | ❌ no edit support | N/A | Skip streaming, use normal path |
+| HomeAssistant | ❌ no edit | N/A | Skip streaming |
+| API Server | ✅ SSE native | No limit | Real SSE events |
+
+WhatsApp and HomeAssistant fall back to non-streaming automatically because
+they don't support message editing.
+
+**Tests for Phase 2:** (~100 lines)
+- Test stream_preview sends/edits correctly
+- Test skip-final-send when streaming delivered
+- Test WhatsApp/HA graceful fallback
+- Test streaming disabled per-platform config
+- Test thread_id metadata forwarded in stream messages
+
+---
+
+### Phase 3: CLI streaming
+
+**File: cli.py**
+
+#### 3a. Set up callback in the CLI chat loop (~20 lines)
+
+In `_chat_once()` or wherever the agent is invoked:
+
+```python
+if streaming_enabled:
+    _stream_q = queue.Queue()
+    _stream_done = threading.Event()
+    
+    def _cli_stream_callback(delta):
+        if delta is None:
+            _stream_done.set()
+        else:
+            _stream_q.put(delta)
+    
+    agent.stream_callback = _cli_stream_callback
+```
+
+#### 3b. Token display thread/task (~30 lines)
+
+Start a thread that reads the queue and prints tokens:
+
+```python
+def _stream_display():
+    """Print tokens to terminal as they arrive."""
+    first_token = True
+    while not _stream_done.is_set():
+        try:
+            delta = _stream_q.get(timeout=0.1)
+        except queue.Empty:
+            continue
+        if first_token:
+            # Print response box top border
+            _cprint(f"\n{top}")
+            first_token = False
+        sys.stdout.write(delta)
+        sys.stdout.flush()
+    # Drain remaining
+    while not _stream_q.empty():
+        sys.stdout.write(_stream_q.get_nowait())
+    sys.stdout.flush()
+    # Print bottom border
+    _cprint(f"\n\n{bot}")
+```
+
+**Integration challenge: prompt_toolkit**
+
+The CLI uses prompt_toolkit which controls the terminal. Writing directly
+to stdout while prompt_toolkit is active can cause display corruption.
+The existing KawaiiSpinner already solves this by using prompt_toolkit's
+`patch_stdout` context. The streaming display would need to do the same.
+
+Alternative: use `_cprint()` for each token chunk (routes through
+prompt_toolkit's renderer). But this might be slow for individual tokens.
+
+Recommended approach: accumulate tokens in small batches (e.g., every 50ms)
+and `_cprint()` the batch. This balances display responsiveness with
+prompt_toolkit compatibility.
+
+**Tests for Phase 3:** (~50 lines)
+- Test CLI streaming callback setup
+- Test response box borders with streaming
+- Test fallback when streaming disabled
+
+---
+
+### Phase 4: API Server real streaming
+
+**File: gateway/platforms/api_server.py**
+
+Replace the pseudo-streaming `_write_sse_chat_completion()` with real
+token-by-token SSE when the agent supports it.
+
+#### 4a. Wire streaming callback for stream=true requests (~20 lines)
+
+```python
+if stream:
+    _stream_q = queue.Queue()
+    
+    def _api_stream_callback(delta):
+        _stream_q.put(delta)  # None = done
+    
+    # Pass callback to _run_agent
+    result, usage = await self._run_agent(
+        ..., stream_callback=_api_stream_callback,
+    )
+```
+
+#### 4b. Real SSE writer (~40 lines)
+
+```python
+async def _write_real_sse(self, request, completion_id, model, stream_q):
+    response = web.StreamResponse(
+        headers={"Content-Type": "text/event-stream", "Cache-Control": "no-cache"},
+    )
+    await response.prepare(request)
+    
+    # Role chunk
+    await response.write(...)
+    
+    # Stream content chunks as they arrive
+    while True:
+        try:
+            delta = await asyncio.get_event_loop().run_in_executor(
+                None, lambda: stream_q.get(timeout=0.1)
+            )
+        except queue.Empty:
+            continue
+        
+        if delta is None:  # End of stream
+            break
+        
+        chunk = {"id": completion_id, "object": "chat.completion.chunk", ...
+                 "choices": [{"delta": {"content": delta}, ...}]}
+        await response.write(f"data: {json.dumps(chunk)}\n\n".encode())
+    
+    # Finish + [DONE]
+    await response.write(...)
+    await response.write(b"data: [DONE]\n\n")
+    return response
+```
+
+**Challenge: concurrent execution**
+
+The agent runs in a thread executor. SSE writing happens in the async event
+loop. The queue bridges them. But `_run_agent()` currently awaits the full
+result before returning. For real streaming, we need to start the agent in
+the background and stream tokens while it runs:
+
+```python
+# Start agent in background
+agent_task = asyncio.create_task(self._run_agent_async(...))
+
+# Stream tokens while agent runs
+await self._write_real_sse(request, ..., stream_q)
+
+# Agent is done by now (stream_q received None)
+result, usage = await agent_task
+```
+
+This requires splitting `_run_agent` into an async version that doesn't
+block waiting for the result, or running it in a separate task.
+
+**Responses API SSE format:**
+
+For `/v1/responses` with `stream=true`, the SSE events are different:
+
+```
+event: response.output_text.delta
+data: {"type":"response.output_text.delta","delta":"Hello"}
+
+event: response.completed  
+data: {"type":"response.completed","response":{...}}
+```
+
+This needs a separate SSE writer that emits Responses API format events.
+
+**Tests for Phase 4:** (~80 lines)
+- Test real SSE streaming with mocked agent
+- Test SSE event format (Chat Completions vs Responses)
+- Test client disconnect during streaming
+- Test fallback to pseudo-streaming when callback not available
+
+---
+
+## Integration Issues & Edge Cases
+
+### 1. Tool calls during streaming
+
+When the model returns tool calls instead of text, no text tokens are emitted.
+The stream_callback is simply never called with text. After tools execute, the
+next API call may produce the final text response — streaming picks up again.
+
+The stream preview task needs to handle this: if no tokens arrive during a
+tool-call round, don't send/edit any message. The tool progress messages
+continue working as before.
+
+### 2. Duplicate messages
+
+The biggest risk: the agent sends the final response normally (via the
+existing send path) AND the stream preview already showed it. The user
+sees the response twice.
+
+Prevention: when streaming is active and tokens were delivered, the final
+response send must be suppressed. The `result["_streamed_msg_id"]` marker
+tells the base adapter to skip its normal send.
+
+### 3. Response post-processing
+
+The final response may differ from the accumulated streamed tokens:
+- Think block stripping (`<think>...</think>` removed)
+- Trailing whitespace cleanup
+- Tool result media tag appending
+
+The stream preview shows raw tokens. The final edit should use the
+post-processed version. This means the final edit (removing the cursor)
+should use the post-processed `final_response`, not just the accumulated
+stream text.
+
+### 4. Context compression during streaming
+
+If the agent triggers context compression mid-conversation, the streaming
+tokens from BEFORE compression are from a different context than those
+after. This isn't a problem in practice — compression happens between
+API calls, not during streaming.
+
+### 5. Interrupt during streaming
+
+User sends a new message while streaming → interrupt. The stream is killed
+(HTTP connection closed), accumulated tokens are shown as-is (no cursor),
+and the interrupt message is processed normally. This is already handled by
+`_interruptible_api_call` closing the client.
+
+### 6. Multi-model / fallback
+
+If the primary model fails and the agent falls back to a different model,
+streaming state resets. The fallback call may or may not support streaming.
+The graceful fallback in `_run_streaming_chat_completion` handles this.
+
+### 7. Rate limiting on edits
+
+Telegram: ~20 edits/minute (~1 every 3 seconds to be safe)
+Discord: 5 edits per 5 seconds per message
+Slack: ~50 API calls/minute
+
+The 1.5s edit interval is conservative enough for all platforms. If we get
+429 rate limit errors on edits, just skip that edit cycle and try next time.
+
+---
+
+## Files Changed Summary
+
+| File | Phase | Changes |
+|------|-------|---------|
+| `run_agent.py` | 1 | +stream_callback param, +_run_streaming_chat_completion(), modify _run_codex_stream(), modify _interruptible_api_call() |
+| `gateway/run.py` | 2 | +streaming config reader, +queue/callback setup, +stream_preview task, +skip-final-send logic |
+| `gateway/platforms/base.py` | 2 | +check for _streamed_msg_id in response handler |
+| `cli.py` | 3 | +streaming setup, +token display, +response box integration |
+| `gateway/platforms/api_server.py` | 4 | +real SSE writer, +streaming callback wiring |
+| `hermes_cli/config.py` | 1 | +streaming config defaults |
+| `cli-config.yaml.example` | 1 | +streaming section |
+| `tests/test_streaming.py` | 1-4 | NEW — ~380 lines of tests |
+
+**Total new code**: ~500 lines across all phases
+**Total test code**: ~380 lines
+
+---
+
+## Rollout Plan
+
+1. **Phase 1** (core): Merge to main. Streaming disabled by default.
+   Zero impact on existing behavior. Can be tested with env var.
+
+2. **Phase 2** (gateway): Merge to main. Test on Telegram manually.
+   Enable per-platform: `streaming.telegram: true` in config.
+
+3. **Phase 3** (CLI): Merge to main. Test in terminal.
+   Enable: `streaming.cli: true` or `streaming.enabled: true`.
+
+4. **Phase 4** (API server): Merge to main. Test with Open WebUI.
+   Auto-enabled when client sends `stream: true`.
+
+Each phase is independently mergeable and testable. Streaming stays
+off by default throughout. Once all phases are stable, consider
+changing the default to enabled.
+
+---
+
+## Config Reference (final state)
+
+```yaml
+# config.yaml
+streaming:
+  enabled: false          # Master switch (default: off)
+  cli: true               # Per-platform override
+  telegram: true
+  discord: true
+  slack: true
+  api_server: true        # API server always streams when client requests it
+  edit_interval: 1.5      # Seconds between message edits (default: 1.5)
+  min_tokens: 20          # Tokens before first display (default: 20)
+```
+
+```bash
+# Environment variable override
+HERMES_STREAMING_ENABLED=true
+```

.pre-commit-config.yaml

@@ -1,18 +0,0 @@
-repos:
-  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.5
-    hooks:
-      - id: ruff
-        args: [--fix]
-      - id: ruff-format
-
-  - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
-    hooks:
-      - id: trailing-whitespace
-      - id: end-of-file-fixer
-      - id: check-merge-conflict
-      - id: check-yaml
-        args: [--allow-multiple-documents]
-      - id: check-added-large-files
-        args: [--maxkb=500]

AGENTS.md

@@ -5,8 +5,7 @@ Instructions for AI coding assistants and developers working on the hermes-agent
 ## Development Environment
 
 ```bash
-make setup          # First time: creates .venv, installs deps, sets up pre-commit
-source .venv/bin/activate
+source .venv/bin/activate  # ALWAYS activate before running Python
 ```
 
 ## Project Structure
@@ -32,7 +31,13 @@ hermes-agent/
 │   ├── config.py         # DEFAULT_CONFIG, OPTIONAL_ENV_VARS, migration
 │   ├── commands.py       # Slash command definitions + SlashCommandCompleter
 │   ├── callbacks.py      # Terminal callbacks (clarify, sudo, approval)
-│   └── setup.py          # Interactive setup wizard
+│   ├── setup.py          # Interactive setup wizard
+│   ├── skin_engine.py    # Skin/theme engine — CLI visual customization
+│   ├── skills_config.py  # `hermes skills` — enable/disable skills per platform
+│   ├── tools_config.py   # `hermes tools` — enable/disable tools per platform
+│   ├── skills_hub.py     # `/skills` slash command (search, browse, install)
+│   ├── models.py         # Model catalog, provider model lists
+│   └── auth.py           # Provider credential resolution
 ├── tools/                # Tool implementations (one file per tool)
 │   ├── registry.py       # Central tool registry (schemas, handlers, dispatch)
 │   ├── approval.py       # Dangerous command detection
@@ -49,9 +54,10 @@ hermes-agent/
 │   ├── run.py            # Main loop, slash commands, message dispatch
 │   ├── session.py        # SessionStore — conversation persistence
 │   └── platforms/        # Adapters: telegram, discord, slack, whatsapp, homeassistant, signal
+├── acp_adapter/          # ACP server (VS Code / Zed / JetBrains integration)
 ├── cron/                 # Scheduler (jobs.py, scheduler.py)
 ├── environments/         # RL training environments (Atropos)
-├── tests/                # Pytest suite (~2500+ tests)
+├── tests/                # Pytest suite (~3000 tests)
 └── batch_runner.py       # Parallel batch processing
 ```
 
@@ -122,6 +128,7 @@ Messages follow OpenAI format: `{"role": "system/user/assistant/tool", ...}`. Re
 - **Rich** for banner/panels, **prompt_toolkit** for input with autocomplete
 - **KawaiiSpinner** (`agent/display.py`) — animated faces during API calls, `┊` activity feed for tool results
 - `load_cli_config()` in cli.py merges hardcoded defaults + user config YAML
+- **Skin engine** (`hermes_cli/skin_engine.py`) — data-driven CLI theming; initialized from `display.skin` config key at startup; skins customize banner colors, spinner faces/verbs/wings, tool prefix, response box, branding text
 - `process_command()` is a method on `HermesCLI` (not in commands.py)
 - Skill slash commands: `agent/skill_commands.py` scans `~/.hermes/skills/`, injects as **user message** (not system prompt) to preserve prompt caching
 
@@ -196,6 +203,94 @@ The registry handles schema collection, dispatch, availability checking, and err
 
 ---
 
+## Skin/Theme System
+
+The skin engine (`hermes_cli/skin_engine.py`) provides data-driven CLI visual customization. Skins are **pure data** — no code changes needed to add a new skin.
+
+### Architecture
+
+```
+hermes_cli/skin_engine.py    # SkinConfig dataclass, built-in skins, YAML loader
+~/.hermes/skins/*.yaml       # User-installed custom skins (drop-in)
+```
+
+- `init_skin_from_config()` — called at CLI startup, reads `display.skin` from config
+- `get_active_skin()` — returns cached `SkinConfig` for the current skin
+- `set_active_skin(name)` — switches skin at runtime (used by `/skin` command)
+- `load_skin(name)` — loads from user skins first, then built-ins, then falls back to default
+- Missing skin values inherit from the `default` skin automatically
+
+### What skins customize
+
+| Element | Skin Key | Used By |
+|---------|----------|---------|
+| Banner panel border | `colors.banner_border` | `banner.py` |
+| Banner panel title | `colors.banner_title` | `banner.py` |
+| Banner section headers | `colors.banner_accent` | `banner.py` |
+| Banner dim text | `colors.banner_dim` | `banner.py` |
+| Banner body text | `colors.banner_text` | `banner.py` |
+| Response box border | `colors.response_border` | `cli.py` |
+| Spinner faces (waiting) | `spinner.waiting_faces` | `display.py` |
+| Spinner faces (thinking) | `spinner.thinking_faces` | `display.py` |
+| Spinner verbs | `spinner.thinking_verbs` | `display.py` |
+| Spinner wings (optional) | `spinner.wings` | `display.py` |
+| Tool output prefix | `tool_prefix` | `display.py` |
+| Agent name | `branding.agent_name` | `banner.py`, `cli.py` |
+| Welcome message | `branding.welcome` | `cli.py` |
+| Response box label | `branding.response_label` | `cli.py` |
+| Prompt symbol | `branding.prompt_symbol` | `cli.py` |
+
+### Built-in skins
+
+- `default` — Classic Hermes gold/kawaii (the current look)
+- `ares` — Crimson/bronze war-god theme with custom spinner wings
+- `mono` — Clean grayscale monochrome
+- `slate` — Cool blue developer-focused theme
+
+### Adding a built-in skin
+
+Add to `_BUILTIN_SKINS` dict in `hermes_cli/skin_engine.py`:
+
+```python
+"mytheme": {
+    "name": "mytheme",
+    "description": "Short description",
+    "colors": { ... },
+    "spinner": { ... },
+    "branding": { ... },
+    "tool_prefix": "┊",
+},
+```
+
+### User skins (YAML)
+
+Users create `~/.hermes/skins/<name>.yaml`:
+
+```yaml
+name: cyberpunk
+description: Neon-soaked terminal theme
+
+colors:
+  banner_border: "#FF00FF"
+  banner_title: "#00FFFF"
+  banner_accent: "#FF1493"
+
+spinner:
+  thinking_verbs: ["jacking in", "decrypting", "uploading"]
+  wings:
+    - ["⟨⚡", "⚡⟩"]
+
+branding:
+  agent_name: "Cyber Agent"
+  response_label: " ⚡ Cyber "
+
+tool_prefix: "▏"
+```
+
+Activate with `/skin cyberpunk` or `display.skin: cyberpunk` in config.yaml.
+
+---
+
 ## Important Policies
 
 ### Prompt Caching Must Not Break
@@ -211,6 +306,17 @@ Cache-breaking forces dramatically higher costs. The ONLY time we alter context
 - **CLI**: Uses current directory (`.` → `os.getcwd()`)
 - **Messaging**: Uses `MESSAGING_CWD` env var (default: home directory)
 
+### Background Process Notifications (Gateway)
+
+When `terminal(background=true, check_interval=...)` is used, the gateway runs a watcher that
+pushes status updates to the user's chat. Control verbosity with `display.background_process_notifications`
+in config.yaml (or `HERMES_BACKGROUND_NOTIFICATIONS` env var):
+
+- `all` — running-output updates + final message (default)
+- `result` — only the final completion message
+- `error` — only the final message when exit code != 0
+- `off` — no watcher messages at all
+
 ---
 
 ## Known Pitfalls
@@ -229,27 +335,15 @@ The `_isolate_hermes_home` autouse fixture in `tests/conftest.py` redirects `HER
 
 ---
 
-## Development Commands
-
-```bash
-make setup          # First time: .venv + deps + pre-commit hooks
-make check          # Lint + test (mirrors CI — run before pushing)
-make lint           # Ruff check
-make fmt            # Ruff format + auto-fix
-make test           # Full test suite (~2500 tests, ~2 min)
-make test-fast      # Tests with fail-fast (-x)
-make test-watch     # Rerun tests on file changes
-make dev-cli        # Auto-restart CLI on file changes
-make dev-gateway    # Auto-restart gateway on file changes
-```
-
-For targeted testing, use `pytest` directly:
+## Testing
 
 ```bash
+source .venv/bin/activate
+python -m pytest tests/ -q          # Full suite (~3000 tests, ~3 min)
 python -m pytest tests/test_model_tools.py -q   # Toolset resolution
 python -m pytest tests/test_cli_init.py -q       # CLI config loading
 python -m pytest tests/gateway/ -q               # Gateway tests
 python -m pytest tests/tools/ -q                 # Tool-level tests
 ```
 
-Formatting is enforced by **ruff** (config in `pyproject.toml`). Pre-commit hooks run on every commit.
+Always run the full suite before pushing changes.

CONTRIBUTING.md

@@ -65,7 +65,18 @@ If your skill is specialized, community-contributed, or niche, it's better suite
 ```bash
 git clone --recurse-submodules https://github.com/NousResearch/hermes-agent.git
 cd hermes-agent
-make setup   # creates .venv, installs all deps
+
+# Create venv with Python 3.11
+uv venv venv --python 3.11
+export VIRTUAL_ENV="$(pwd)/venv"
+
+# Install with all extras (messaging, cron, CLI menus, dev tools)
+uv pip install -e ".[all,dev]"
+uv pip install -e "./mini-swe-agent"
+uv pip install -e "./tinker-atropos"
+
+# Optional: browser tools
+npm install
 ```
 
 ### Configure for development
@@ -79,16 +90,22 @@ touch ~/.hermes/.env
 echo 'OPENROUTER_API_KEY=sk-or-v1-your-key' >> ~/.hermes/.env
 ```
 
-### Common commands
+### Run
 
 ```bash
-make test          # run unit tests
-make lint          # ruff check
-make fmt           # ruff format + fix
-make check         # lint + test (same as CI)
-make dev-cli       # auto-restart hermes CLI on file changes
-make dev-gateway   # auto-restart gateway on file changes
-make test-watch    # rerun tests on file changes
+# Symlink for global access
+mkdir -p ~/.local/bin
+ln -sf "$(pwd)/venv/bin/hermes" ~/.local/bin/hermes
+
+# Verify
+hermes doctor
+hermes chat -q "Hello"
+```
+
+### Run tests
+
+```bash
+pytest tests/ -v
 ```
 
 ---
@@ -122,7 +139,8 @@ hermes-agent/
 │   ├── commands.py               # Slash command definitions + autocomplete
 │   ├── callbacks.py              # Interactive callbacks (clarify, sudo, approval)
 │   ├── doctor.py                 # Diagnostics
-│   └── skills_hub.py             # Skills Hub CLI + /skills slash command
+│   ├── skills_hub.py             # Skills Hub CLI + /skills slash command
+│   └── skin_engine.py            # Skin/theme engine — data-driven CLI visual customization
 │
 ├── tools/                    # Tool implementations (self-registering)
 │   ├── registry.py               # Central tool registry (schemas, handlers, dispatch)
@@ -210,7 +228,7 @@ User message → AIAgent._run_agent_loop()
 
 ## Code Style
 
-- **Formatting**: Enforced by **ruff** (config in `pyproject.toml`). Run `make fmt` to auto-fix, `make lint` to check. Pre-commit hooks handle this automatically.
+- **PEP 8** with practical exceptions (we don't enforce strict line length)
 - **Comments**: Only when explaining non-obvious intent, trade-offs, or API quirks. Don't narrate what the code does — `# increment counter` adds nothing
 - **Error handling**: Catch specific exceptions. Log with `logger.warning()`/`logger.error()` — use `exc_info=True` for unexpected errors so stack traces appear in logs
 - **Cross-platform**: Never assume Unix. See [Cross-Platform Compatibility](#cross-platform-compatibility)
@@ -315,6 +333,8 @@ metadata:
   hermes:
     tags: [Category, Subcategory, Keywords]
     related_skills: [other-skill-name]
+    fallback_for_toolsets: [web]       # Optional — show only when toolset is unavailable
+    requires_toolsets: [terminal]      # Optional — show only when toolset is available
 ---
 
 # Skill Title
@@ -349,6 +369,48 @@ platforms: [windows]          # Windows only
 
 If the field is omitted or empty, the skill loads on all platforms (backward compatible). See `skills/apple/` for examples of macOS-only skills.
 
+### Conditional skill activation
+
+Skills can declare conditions that control when they appear in the system prompt, based on which tools and toolsets are available in the current session. This is primarily used for **fallback skills** — alternatives that should only be shown when a primary tool is unavailable.
+
+Four fields are supported under `metadata.hermes`:
+
+```yaml
+metadata:
+  hermes:
+    fallback_for_toolsets: [web]      # Show ONLY when these toolsets are unavailable
+    requires_toolsets: [terminal]     # Show ONLY when these toolsets are available
+    fallback_for_tools: [web_search]  # Show ONLY when these specific tools are unavailable
+    requires_tools: [terminal]        # Show ONLY when these specific tools are available
+```
+
+**Semantics:**
+- `fallback_for_*`: The skill is a backup. It is **hidden** when the listed tools/toolsets are available, and **shown** when they are unavailable. Use this for free alternatives to premium tools.
+- `requires_*`: The skill needs certain tools to function. It is **hidden** when the listed tools/toolsets are unavailable. Use this for skills that depend on specific capabilities (e.g., a skill that only makes sense with terminal access).
+- If both are specified, both conditions must be satisfied for the skill to appear.
+- If neither is specified, the skill is always shown (backward compatible).
+
+**Examples:**
+
+```yaml
+# DuckDuckGo search — shown when Firecrawl (web toolset) is unavailable
+metadata:
+  hermes:
+    fallback_for_toolsets: [web]
+
+# Smart home skill — only useful when terminal is available
+metadata:
+  hermes:
+    requires_toolsets: [terminal]
+
+# Local browser fallback — shown when Browserbase is unavailable
+metadata:
+  hermes:
+    fallback_for_toolsets: [browser]
+```
+
+The filtering happens at prompt build time in `agent/prompt_builder.py`. The `build_skills_system_prompt()` function receives the set of available tools and toolsets from the agent and uses `_skill_should_show()` to evaluate each skill's conditions.
+
 ### Skill guidelines
 
 - **No external dependencies unless absolutely necessary.** Prefer stdlib Python, curl, and existing Hermes tools (`web_extract`, `terminal`, `read_file`).
@@ -358,6 +420,56 @@ If the field is omitted or empty, the skill loads on all platforms (backward com
 
 ---
 
+## Adding a Skin / Theme
+
+Hermes uses a data-driven skin system — no code changes needed to add a new skin.
+
+**Option A: User skin (YAML file)**
+
+Create `~/.hermes/skins/<name>.yaml`:
+
+```yaml
+name: mytheme
+description: Short description of the theme
+
+colors:
+  banner_border: "#HEX"     # Panel border color
+  banner_title: "#HEX"      # Panel title color
+  banner_accent: "#HEX"     # Section header color
+  banner_dim: "#HEX"        # Muted/dim text color
+  banner_text: "#HEX"       # Body text color
+  response_border: "#HEX"   # Response box border
+
+spinner:
+  waiting_faces: ["(⚔)", "(⛨)"]
+  thinking_faces: ["(⚔)", "(⌁)"]
+  thinking_verbs: ["forging", "plotting"]
+  wings:                     # Optional left/right decorations
+    - ["⟪⚔", "⚔⟫"]
+
+branding:
+  agent_name: "My Agent"
+  welcome: "Welcome message"
+  response_label: " ⚔ Agent "
+  prompt_symbol: "⚔ ❯ "
+
+tool_prefix: "╎"             # Tool output line prefix
+```
+
+All fields are optional — missing values inherit from the default skin.
+
+**Option B: Built-in skin**
+
+Add to `_BUILTIN_SKINS` dict in `hermes_cli/skin_engine.py`. Use the same schema as above but as a Python dict. Built-in skins ship with the package and are always available.
+
+**Activating:**
+- CLI: `/skin mytheme` or set `display.skin: mytheme` in config.yaml
+- Config: `display: { skin: mytheme }`
+
+See `hermes_cli/skin_engine.py` for the full schema and existing skins as examples.
+
+---
+
 ## Cross-Platform Compatibility
 
 Hermes runs on Linux, macOS, and Windows. When writing code that touches the OS:
@@ -440,7 +552,7 @@ refactor/description   # Code restructuring
 
 ### Before submitting
 
-1. **Run checks**: `make check` (lint + test — same as CI)
+1. **Run tests**: `pytest tests/ -v`
 2. **Test manually**: Run `hermes` and exercise the code path you changed
 3. **Check cross-platform impact**: If you touch file I/O, process management, or terminal handling, consider Windows and macOS
 4. **Keep PRs focused**: One logical change per PR. Don't mix a bug fix with a refactor with a new feature.

Makefile

@@ -1,69 +0,0 @@
-.DEFAULT_GOAL := help
-SHELL := /bin/bash
-VENV := .venv
-UV := uv
-
-SRC := run_agent.py model_tools.py toolsets.py cli.py hermes_state.py batch_runner.py \
-       tools/ hermes_cli/ gateway/ agent/ cron/
-
-# ─── Setup ──────────────────────────────────────────────────────────────────────
-
-.PHONY: setup sync clean
-
-setup: ## Full dev setup (venv + deps + pre-commit)
-	$(UV) venv $(VENV) --python 3.11
-	. $(VENV)/bin/activate && $(UV) pip install -e ".[all,dev]"
-	. $(VENV)/bin/activate && $(UV) pip install -e "./mini-swe-agent"
-	. $(VENV)/bin/activate && pre-commit install
-	@echo "\n✅ Setup complete. Run: source $(VENV)/bin/activate"
-
-sync: ## Reinstall deps into existing venv
-	. $(VENV)/bin/activate && $(UV) pip install -e ".[all,dev]"
-
-clean: ## Remove build artifacts and caches
-	rm -rf .ruff_cache .mypy_cache .pytest_cache dist build *.egg-info
-	find . -type d -name __pycache__ -not -path "./.venv/*" -exec rm -rf {} +
-
-# ─── Quality ────────────────────────────────────────────────────────────────────
-
-.PHONY: lint fmt check
-
-lint: ## Check lint + formatting (no changes)
-	. $(VENV)/bin/activate && ruff check $(SRC)
-	. $(VENV)/bin/activate && ruff format --check $(SRC)
-
-fmt: ## Auto-fix lint + format
-	. $(VENV)/bin/activate && ruff format $(SRC)
-	. $(VENV)/bin/activate && ruff check --fix $(SRC)
-
-check: lint test ## Lint + test (mirrors CI)
-
-# ─── Test ───────────────────────────────────────────────────────────────────────
-
-.PHONY: test test-fast test-watch
-
-test: ## Run full test suite
-	. $(VENV)/bin/activate && python -m pytest tests/ -q --ignore=tests/integration --tb=short
-
-test-fast: ## Run tests with fail-fast
-	. $(VENV)/bin/activate && python -m pytest tests/ -q --ignore=tests/integration --tb=short -x
-
-test-watch: ## Rerun tests on file changes
-	. $(VENV)/bin/activate && python -m watchfiles "python -m pytest tests/ -q --ignore=tests/integration --tb=short -x" $(SRC) tests/
-
-# ─── Dev Servers ────────────────────────────────────────────────────────────────
-
-.PHONY: dev-cli dev-gateway
-
-dev-cli: ## Auto-restart CLI on file changes
-	. $(VENV)/bin/activate && python -m watchfiles "python -m hermes_cli.main" $(SRC)
-
-dev-gateway: ## Auto-restart gateway on file changes
-	. $(VENV)/bin/activate && python -m watchfiles "python -m gateway.run" $(SRC)
-
-# ─── Misc ───────────────────────────────────────────────────────────────────────
-
-.PHONY: help
-
-help: ## Show this help
-	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "  \033[36m%-15s\033[0m %s\n", $$1, $$2}'

README.md

@@ -41,7 +41,6 @@ After installation:
 
 ```bash
 source ~/.bashrc    # reload shell (or: source ~/.zshrc)
-hermes setup        # configure your LLM provider
 hermes              # start chatting!
 ```
 
@@ -51,9 +50,12 @@ hermes              # start chatting!
 
 ```bash
 hermes              # Interactive CLI — start a conversation
-hermes model        # Switch provider or model
-hermes setup        # Re-run the setup wizard
+hermes model        # Choose your LLM provider and model
+hermes tools        # Configure which tools are enabled
+hermes config set   # Set individual config values
 hermes gateway      # Start the messaging gateway (Telegram, Discord, etc.)
+hermes setup        # Run the full setup wizard (configures everything at once)
+hermes claw migrate # Migrate from OpenClaw (if coming from OpenClaw)
 hermes update       # Update to the latest version
 hermes doctor       # Diagnose any issues
 ```
@@ -86,6 +88,35 @@ All documentation lives at **[hermes-agent.nousresearch.com/docs](https://hermes
 
 ---
 
+## Migrating from OpenClaw
+
+If you're coming from OpenClaw, Hermes can automatically import your settings, memories, skills, and API keys.
+
+**During first-time setup:** The setup wizard (`hermes setup`) automatically detects `~/.openclaw` and offers to migrate before configuration begins.
+
+**Anytime after install:**
+
+```bash
+hermes claw migrate              # Interactive migration (full preset)
+hermes claw migrate --dry-run    # Preview what would be migrated
+hermes claw migrate --preset user-data   # Migrate without secrets
+hermes claw migrate --overwrite  # Overwrite existing conflicts
+```
+
+What gets imported:
+- **SOUL.md** — persona file
+- **Memories** — MEMORY.md and USER.md entries
+- **Skills** — user-created skills → `~/.hermes/skills/openclaw-imports/`
+- **Command allowlist** — approval patterns
+- **Messaging settings** — platform configs, allowed users, working directory
+- **API keys** — allowlisted secrets (Telegram, OpenRouter, OpenAI, Anthropic, ElevenLabs)
+- **TTS assets** — workspace audio files
+- **Workspace instructions** — AGENTS.md (with `--workspace-target`)
+
+See `hermes claw migrate --help` for all options, or use the `openclaw-migration` skill for an interactive agent-guided migration with dry-run previews.
+
+---
+
 ## Contributing
 
 We welcome contributions! See the [Contributing Guide](https://hermes-agent.nousresearch.com/docs/developer-guide/contributing) for development setup, code style, and PR process.
@@ -93,12 +124,23 @@ We welcome contributions! See the [Contributing Guide](https://hermes-agent.nous
 Quick start for contributors:
 
 ```bash
-git clone --recurse-submodules https://github.com/NousResearch/hermes-agent.git
+git clone https://github.com/NousResearch/hermes-agent.git
 cd hermes-agent
-make setup      # creates .venv, installs everything
-make check      # lint + test (same as CI)
+git submodule update --init mini-swe-agent   # required terminal backend
+curl -LsSf https://astral.sh/uv/install.sh | sh
+uv venv .venv --python 3.11
+source .venv/bin/activate
+uv pip install -e ".[all,dev]"
+uv pip install -e "./mini-swe-agent"
+python -m pytest tests/ -q
 ```
 
+> **RL Training (optional):** To work on the RL/Tinker-Atropos integration, also run:
+> ```bash
+> git submodule update --init tinker-atropos
+> uv pip install -e "./tinker-atropos"
+> ```
+
 ---
 
 ## Community

RELEASE_v0.2.0.md

@@ -0,0 +1,383 @@
+# Hermes Agent v0.2.0 (v2026.3.12)
+
+**Release Date:** March 12, 2026
+
+> First tagged release since v0.1.0 (the initial pre-public foundation). In just over two weeks, Hermes Agent went from a small internal project to a full-featured AI agent platform — thanks to an explosion of community contributions. This release covers **216 merged pull requests** from **63 contributors**, resolving **119 issues**.
+
+---
+
+## ✨ Highlights
+
+- **Multi-Platform Messaging Gateway** — Telegram, Discord, Slack, WhatsApp, Signal, Email (IMAP/SMTP), and Home Assistant platforms with unified session management, media attachments, and per-platform tool configuration.
+
+- **MCP (Model Context Protocol) Client** — Native MCP support with stdio and HTTP transports, reconnection, resource/prompt discovery, and sampling (server-initiated LLM requests). ([#291](https://github.com/NousResearch/hermes-agent/pull/291) — @0xbyt4, [#301](https://github.com/NousResearch/hermes-agent/pull/301), [#753](https://github.com/NousResearch/hermes-agent/pull/753))
+
+- **Skills Ecosystem** — 70+ bundled and optional skills across 15+ categories with a Skills Hub for community discovery, per-platform enable/disable, conditional activation based on tool availability, and prerequisite validation. ([#743](https://github.com/NousResearch/hermes-agent/pull/743) — @teyrebaz33, [#785](https://github.com/NousResearch/hermes-agent/pull/785) — @teyrebaz33)
+
+- **Centralized Provider Router** — Unified `call_llm()`/`async_call_llm()` API replaces scattered provider logic across vision, summarization, compression, and trajectory saving. All auxiliary consumers route through a single code path with automatic credential resolution. ([#1003](https://github.com/NousResearch/hermes-agent/pull/1003))
+
+- **ACP Server** — VS Code, Zed, and JetBrains editor integration via the Agent Communication Protocol standard. ([#949](https://github.com/NousResearch/hermes-agent/pull/949))
+
+- **CLI Skin/Theme Engine** — Data-driven visual customization: banners, spinners, colors, branding. 7 built-in skins + custom YAML skins.
+
+- **Git Worktree Isolation** — `hermes -w` launches isolated agent sessions in git worktrees for safe parallel work on the same repo. ([#654](https://github.com/NousResearch/hermes-agent/pull/654))
+
+- **Filesystem Checkpoints & Rollback** — Automatic snapshots before destructive operations with `/rollback` to restore. ([#824](https://github.com/NousResearch/hermes-agent/pull/824))
+
+- **3,289 Tests** — From near-zero test coverage to a comprehensive test suite covering agent, gateway, tools, cron, and CLI.
+
+---
+
+## 🏗️ Core Agent & Architecture
+
+### Provider & Model Support
+- Centralized provider router with `resolve_provider_client()` + `call_llm()` API ([#1003](https://github.com/NousResearch/hermes-agent/pull/1003))
+- Nous Portal as first-class provider in setup ([#644](https://github.com/NousResearch/hermes-agent/issues/644))
+- OpenAI Codex (Responses API) with ChatGPT subscription support ([#43](https://github.com/NousResearch/hermes-agent/pull/43)) — @grp06
+- Codex OAuth vision support + multimodal content adapter
+- Validate `/model` against live API instead of hardcoded lists
+- Self-hosted Firecrawl support ([#460](https://github.com/NousResearch/hermes-agent/pull/460)) — @caentzminger
+- Kimi Code API support ([#635](https://github.com/NousResearch/hermes-agent/pull/635)) — @christomitov
+- MiniMax model ID update ([#473](https://github.com/NousResearch/hermes-agent/pull/473)) — @tars90percent
+- OpenRouter provider routing configuration (provider_preferences)
+- Nous credential refresh on 401 errors ([#571](https://github.com/NousResearch/hermes-agent/pull/571), [#269](https://github.com/NousResearch/hermes-agent/pull/269)) — @rewbs
+- z.ai/GLM, Kimi/Moonshot, MiniMax, Azure OpenAI as first-class providers
+- Unified `/model` and `/provider` into single view
+
+### Agent Loop & Conversation
+- Simple fallback model for provider resilience ([#740](https://github.com/NousResearch/hermes-agent/pull/740))
+- Shared iteration budget across parent + subagent delegation
+- Iteration budget pressure via tool result injection
+- Configurable subagent provider/model with full credential resolution
+- Handle 413 payload-too-large via compression instead of aborting ([#153](https://github.com/NousResearch/hermes-agent/pull/153)) — @tekelala
+- Retry with rebuilt payload after compression ([#616](https://github.com/NousResearch/hermes-agent/pull/616)) — @tripledoublev
+- Auto-compress pathologically large gateway sessions ([#628](https://github.com/NousResearch/hermes-agent/issues/628))
+- Tool call repair middleware — auto-lowercase and invalid tool handler
+- Reasoning effort configuration and `/reasoning` command ([#921](https://github.com/NousResearch/hermes-agent/pull/921))
+- Detect and block file re-read/search loops after context compression ([#705](https://github.com/NousResearch/hermes-agent/pull/705)) — @0xbyt4
+
+### Session & Memory
+- Session naming with unique titles, auto-lineage, rich listing, and resume by name ([#720](https://github.com/NousResearch/hermes-agent/pull/720))
+- Interactive session browser with search filtering ([#733](https://github.com/NousResearch/hermes-agent/pull/733))
+- Display previous messages when resuming a session ([#734](https://github.com/NousResearch/hermes-agent/pull/734))
+- Honcho AI-native cross-session user modeling ([#38](https://github.com/NousResearch/hermes-agent/pull/38)) — @erosika
+- Proactive async memory flush on session expiry
+- Smart context length probing with persistent caching + banner display
+- `/resume` command for switching to named sessions in gateway
+- Session reset policy for messaging platforms
+
+---
+
+## 📱 Messaging Platforms (Gateway)
+
+### Telegram
+- Native file attachments: send_document + send_video
+- Document file processing for PDF, text, and Office files — @tekelala
+- Forum topic session isolation ([#766](https://github.com/NousResearch/hermes-agent/pull/766)) — @spanishflu-est1918
+- Browser screenshot sharing via MEDIA: protocol ([#657](https://github.com/NousResearch/hermes-agent/pull/657))
+- Location support for find-nearby skill
+- TTS voice message accumulation fix ([#176](https://github.com/NousResearch/hermes-agent/pull/176)) — @Bartok9
+- Improved error handling and logging ([#763](https://github.com/NousResearch/hermes-agent/pull/763)) — @aydnOktay
+- Italic regex newline fix + 43 format tests ([#204](https://github.com/NousResearch/hermes-agent/pull/204)) — @0xbyt4
+
+### Discord
+- Channel topic included in session context ([#248](https://github.com/NousResearch/hermes-agent/pull/248)) — @Bartok9
+- DISCORD_ALLOW_BOTS config for bot message filtering ([#758](https://github.com/NousResearch/hermes-agent/pull/758))
+- Document and video support ([#784](https://github.com/NousResearch/hermes-agent/pull/784))
+- Improved error handling and logging ([#761](https://github.com/NousResearch/hermes-agent/pull/761)) — @aydnOktay
+
+### Slack
+- App_mention 404 fix + document/video support ([#784](https://github.com/NousResearch/hermes-agent/pull/784))
+- Structured logging replacing print statements — @aydnOktay
+
+### WhatsApp
+- Native media sending — images, videos, documents ([#292](https://github.com/NousResearch/hermes-agent/pull/292)) — @satelerd
+- Multi-user session isolation ([#75](https://github.com/NousResearch/hermes-agent/pull/75)) — @satelerd
+- Cross-platform port cleanup replacing Linux-only fuser ([#433](https://github.com/NousResearch/hermes-agent/pull/433)) — @Farukest
+- DM interrupt key mismatch fix ([#350](https://github.com/NousResearch/hermes-agent/pull/350)) — @Farukest
+
+### Signal
+- Full Signal messenger gateway via signal-cli-rest-api ([#405](https://github.com/NousResearch/hermes-agent/issues/405))
+- Media URL support in message events ([#871](https://github.com/NousResearch/hermes-agent/pull/871))
+
+### Email (IMAP/SMTP)
+- New email gateway platform — @0xbyt4
+
+### Home Assistant
+- REST tools + WebSocket gateway integration ([#184](https://github.com/NousResearch/hermes-agent/pull/184)) — @0xbyt4
+- Service discovery and enhanced setup
+- Toolset mapping fix ([#538](https://github.com/NousResearch/hermes-agent/pull/538)) — @Himess
+
+### Gateway Core
+- Expose subagent tool calls and thinking to users ([#186](https://github.com/NousResearch/hermes-agent/pull/186)) — @cutepawss
+- Configurable background process watcher notifications ([#840](https://github.com/NousResearch/hermes-agent/pull/840))
+- `edit_message()` for Telegram/Discord/Slack with fallback
+- `/compress`, `/usage`, `/update` slash commands
+- Eliminated 3x SQLite message duplication in gateway sessions ([#873](https://github.com/NousResearch/hermes-agent/pull/873))
+- Stabilize system prompt across gateway turns for cache hits ([#754](https://github.com/NousResearch/hermes-agent/pull/754))
+- MCP server shutdown on gateway exit ([#796](https://github.com/NousResearch/hermes-agent/pull/796)) — @0xbyt4
+- Pass session_db to AIAgent, fixing session_search error ([#108](https://github.com/NousResearch/hermes-agent/pull/108)) — @Bartok9
+- Persist transcript changes in /retry, /undo; fix /reset attribute ([#217](https://github.com/NousResearch/hermes-agent/pull/217)) — @Farukest
+- UTF-8 encoding fix preventing Windows crashes ([#369](https://github.com/NousResearch/hermes-agent/pull/369)) — @ch3ronsa
+
+---
+
+## 🖥️ CLI & User Experience
+
+### Interactive CLI
+- Data-driven skin/theme engine — 7 built-in skins (default, ares, mono, slate, poseidon, sisyphus, charizard) + custom YAML skins
+- `/personality` command with custom personality + disable support ([#773](https://github.com/NousResearch/hermes-agent/pull/773)) — @teyrebaz33
+- User-defined quick commands that bypass the agent loop ([#746](https://github.com/NousResearch/hermes-agent/pull/746)) — @teyrebaz33
+- `/reasoning` command for effort level and display toggle ([#921](https://github.com/NousResearch/hermes-agent/pull/921))
+- `/verbose` slash command to toggle debug at runtime ([#94](https://github.com/NousResearch/hermes-agent/pull/94)) — @cesareth
+- `/insights` command — usage analytics, cost estimation & activity patterns ([#552](https://github.com/NousResearch/hermes-agent/pull/552))
+- `/background` command for managing background processes
+- `/help` formatting with command categories
+- Bell-on-complete — terminal bell when agent finishes ([#738](https://github.com/NousResearch/hermes-agent/pull/738))
+- Up/down arrow history navigation
+- Clipboard image paste (Alt+V / Ctrl+V)
+- Loading indicators for slow slash commands ([#882](https://github.com/NousResearch/hermes-agent/pull/882))
+- Spinner flickering fix under patch_stdout ([#91](https://github.com/NousResearch/hermes-agent/pull/91)) — @0xbyt4
+- `--quiet/-Q` flag for programmatic single-query mode
+- `--fuck-it-ship-it` flag to bypass all approval prompts ([#724](https://github.com/NousResearch/hermes-agent/pull/724)) — @dmahan93
+- Tools summary flag ([#767](https://github.com/NousResearch/hermes-agent/pull/767)) — @luisv-1
+- Terminal blinking fix on SSH ([#284](https://github.com/NousResearch/hermes-agent/pull/284)) — @ygd58
+- Multi-line paste detection fix ([#84](https://github.com/NousResearch/hermes-agent/pull/84)) — @0xbyt4
+
+### Setup & Configuration
+- Modular setup wizard with section subcommands and tool-first UX
+- Container resource configuration prompts
+- Backend validation for required binaries
+- Config migration system (currently v7)
+- API keys properly routed to .env instead of config.yaml ([#469](https://github.com/NousResearch/hermes-agent/pull/469)) — @ygd58
+- Atomic write for .env to prevent API key loss on crash ([#954](https://github.com/NousResearch/hermes-agent/pull/954))
+- `hermes tools` — per-platform tool enable/disable with curses UI
+- `hermes doctor` for health checks across all configured providers
+- `hermes update` with auto-restart for gateway service
+- Show update-available notice in CLI banner
+- Multiple named custom providers
+- Shell config detection improvement for PATH setup ([#317](https://github.com/NousResearch/hermes-agent/pull/317)) — @mehmetkr-31
+- Consistent HERMES_HOME and .env path resolution ([#51](https://github.com/NousResearch/hermes-agent/pull/51), [#48](https://github.com/NousResearch/hermes-agent/pull/48)) — @deankerr
+- Docker backend fix on macOS + subagent auth for Nous Portal ([#46](https://github.com/NousResearch/hermes-agent/pull/46)) — @rsavitt
+
+---
+
+## 🔧 Tool System
+
+### MCP (Model Context Protocol)
+- Native MCP client with stdio + HTTP transports ([#291](https://github.com/NousResearch/hermes-agent/pull/291) — @0xbyt4, [#301](https://github.com/NousResearch/hermes-agent/pull/301))
+- Sampling support — server-initiated LLM requests ([#753](https://github.com/NousResearch/hermes-agent/pull/753))
+- Resource and prompt discovery
+- Automatic reconnection and security hardening
+- Banner integration, `/reload-mcp` command
+- `hermes tools` UI integration
+
+### Browser
+- Local browser backend — zero-cost headless Chromium (no Browserbase needed)
+- Console/errors tool, annotated screenshots, auto-recording, dogfood QA skill ([#745](https://github.com/NousResearch/hermes-agent/pull/745))
+- Screenshot sharing via MEDIA: on all messaging platforms ([#657](https://github.com/NousResearch/hermes-agent/pull/657))
+
+### Terminal & Execution
+- `execute_code` sandbox with json_parse, shell_quote, retry helpers
+- Docker: custom volume mounts ([#158](https://github.com/NousResearch/hermes-agent/pull/158)) — @Indelwin
+- Daytona cloud sandbox backend ([#451](https://github.com/NousResearch/hermes-agent/pull/451)) — @rovle
+- SSH backend fix ([#59](https://github.com/NousResearch/hermes-agent/pull/59)) — @deankerr
+- Shell noise filtering and login shell execution for environment consistency
+- Head+tail truncation for execute_code stdout overflow
+- Configurable background process notification modes
+
+### File Operations
+- Filesystem checkpoints and `/rollback` command ([#824](https://github.com/NousResearch/hermes-agent/pull/824))
+- Structured tool result hints (next-action guidance) for patch and search_files ([#722](https://github.com/NousResearch/hermes-agent/issues/722))
+- Docker volumes passed to sandbox container config ([#687](https://github.com/NousResearch/hermes-agent/pull/687)) — @manuelschipper
+
+---
+
+## 🧩 Skills Ecosystem
+
+### Skills System
+- Per-platform skill enable/disable ([#743](https://github.com/NousResearch/hermes-agent/pull/743)) — @teyrebaz33
+- Conditional skill activation based on tool availability ([#785](https://github.com/NousResearch/hermes-agent/pull/785)) — @teyrebaz33
+- Skill prerequisites — hide skills with unmet dependencies ([#659](https://github.com/NousResearch/hermes-agent/pull/659)) — @kshitijk4poor
+- Optional skills — shipped but not activated by default
+- `hermes skills browse` — paginated hub browsing
+- Skills sub-category organization
+- Platform-conditional skill loading
+- Atomic skill file writes ([#551](https://github.com/NousResearch/hermes-agent/pull/551)) — @aydnOktay
+- Skills sync data loss prevention ([#563](https://github.com/NousResearch/hermes-agent/pull/563)) — @0xbyt4
+- Dynamic skill slash commands for CLI and gateway
+
+### New Skills (selected)
+- **ASCII Art** — pyfiglet (571 fonts), cowsay, image-to-ascii ([#209](https://github.com/NousResearch/hermes-agent/pull/209)) — @0xbyt4
+- **ASCII Video** — Full production pipeline ([#854](https://github.com/NousResearch/hermes-agent/pull/854)) — @SHL0MS
+- **DuckDuckGo Search** — Firecrawl fallback ([#267](https://github.com/NousResearch/hermes-agent/pull/267)) — @gamedevCloudy; DDGS API expansion ([#598](https://github.com/NousResearch/hermes-agent/pull/598)) — @areu01or00
+- **Solana Blockchain** — Wallet balances, USD pricing, token names ([#212](https://github.com/NousResearch/hermes-agent/pull/212)) — @gizdusum
+- **AgentMail** — Agent-owned email inboxes ([#330](https://github.com/NousResearch/hermes-agent/pull/330)) — @teyrebaz33
+- **Polymarket** — Prediction market data (read-only) ([#629](https://github.com/NousResearch/hermes-agent/pull/629))
+- **OpenClaw Migration** — Official migration tool ([#570](https://github.com/NousResearch/hermes-agent/pull/570)) — @unmodeled-tyler
+- **Domain Intelligence** — Passive recon: subdomains, SSL, WHOIS, DNS ([#136](https://github.com/NousResearch/hermes-agent/pull/136)) — @FurkanL0
+- **Superpowers** — Software development skills ([#137](https://github.com/NousResearch/hermes-agent/pull/137)) — @kaos35
+- **Hermes-Atropos** — RL environment development skill ([#815](https://github.com/NousResearch/hermes-agent/pull/815))
+- Plus: arXiv search, OCR/documents, Excalidraw diagrams, YouTube transcripts, GIF search, Pokémon player, Minecraft modpack server, OpenHue (Philips Hue), Google Workspace, Notion, PowerPoint, Obsidian, find-nearby, and 40+ MLOps skills
+
+---
+
+## 🔒 Security & Reliability
+
+### Security Hardening
+- Path traversal fix in skill_view — prevented reading arbitrary files ([#220](https://github.com/NousResearch/hermes-agent/issues/220)) — @Farukest
+- Shell injection prevention in sudo password piping ([#65](https://github.com/NousResearch/hermes-agent/pull/65)) — @leonsgithub
+- Dangerous command detection: multiline bypass fix ([#233](https://github.com/NousResearch/hermes-agent/pull/233)) — @Farukest; tee/process substitution patterns ([#280](https://github.com/NousResearch/hermes-agent/pull/280)) — @dogiladeveloper
+- Symlink boundary check fix in skills_guard ([#386](https://github.com/NousResearch/hermes-agent/pull/386)) — @Farukest
+- Symlink bypass fix in write deny list on macOS ([#61](https://github.com/NousResearch/hermes-agent/pull/61)) — @0xbyt4
+- Multi-word prompt injection bypass prevention ([#192](https://github.com/NousResearch/hermes-agent/pull/192)) — @0xbyt4
+- Cron prompt injection scanner bypass fix ([#63](https://github.com/NousResearch/hermes-agent/pull/63)) — @0xbyt4
+- Enforce 0600/0700 file permissions on sensitive files ([#757](https://github.com/NousResearch/hermes-agent/pull/757))
+- .env file permissions restricted to owner-only ([#529](https://github.com/NousResearch/hermes-agent/pull/529)) — @Himess
+- `--force` flag properly blocked from overriding dangerous verdicts ([#388](https://github.com/NousResearch/hermes-agent/pull/388)) — @Farukest
+- FTS5 query sanitization + DB connection leak fix ([#565](https://github.com/NousResearch/hermes-agent/pull/565)) — @0xbyt4
+- Expand secret redaction patterns + config toggle to disable
+- In-memory permanent allowlist to prevent data leak ([#600](https://github.com/NousResearch/hermes-agent/pull/600)) — @alireza78a
+
+### Atomic Writes (data loss prevention)
+- sessions.json ([#611](https://github.com/NousResearch/hermes-agent/pull/611)) — @alireza78a
+- Cron jobs ([#146](https://github.com/NousResearch/hermes-agent/pull/146)) — @alireza78a
+- .env config ([#954](https://github.com/NousResearch/hermes-agent/pull/954))
+- Process checkpoints ([#298](https://github.com/NousResearch/hermes-agent/pull/298)) — @aydnOktay
+- Batch runner ([#297](https://github.com/NousResearch/hermes-agent/pull/297)) — @aydnOktay
+- Skill files ([#551](https://github.com/NousResearch/hermes-agent/pull/551)) — @aydnOktay
+
+### Reliability
+- Guard all print() against OSError for systemd/headless environments ([#963](https://github.com/NousResearch/hermes-agent/pull/963))
+- Reset all retry counters at start of run_conversation ([#607](https://github.com/NousResearch/hermes-agent/pull/607)) — @0xbyt4
+- Return deny on approval callback timeout instead of None ([#603](https://github.com/NousResearch/hermes-agent/pull/603)) — @0xbyt4
+- Fix None message content crashes across codebase ([#277](https://github.com/NousResearch/hermes-agent/pull/277))
+- Fix context overrun crash with local LLM backends ([#403](https://github.com/NousResearch/hermes-agent/pull/403)) — @ch3ronsa
+- Prevent `_flush_sentinel` from leaking to external APIs ([#227](https://github.com/NousResearch/hermes-agent/pull/227)) — @Farukest
+- Prevent conversation_history mutation in callers ([#229](https://github.com/NousResearch/hermes-agent/pull/229)) — @Farukest
+- Fix systemd restart loop ([#614](https://github.com/NousResearch/hermes-agent/pull/614)) — @voidborne-d
+- Close file handles and sockets to prevent fd leaks ([#568](https://github.com/NousResearch/hermes-agent/pull/568) — @alireza78a, [#296](https://github.com/NousResearch/hermes-agent/pull/296) — @alireza78a, [#709](https://github.com/NousResearch/hermes-agent/pull/709) — @memosr)
+- Prevent data loss in clipboard PNG conversion ([#602](https://github.com/NousResearch/hermes-agent/pull/602)) — @0xbyt4
+- Eliminate shell noise from terminal output ([#293](https://github.com/NousResearch/hermes-agent/pull/293)) — @0xbyt4
+- Timezone-aware now() for prompt, cron, and execute_code ([#309](https://github.com/NousResearch/hermes-agent/pull/309)) — @areu01or00
+
+### Windows Compatibility
+- Guard POSIX-only process functions ([#219](https://github.com/NousResearch/hermes-agent/pull/219)) — @Farukest
+- Windows native support via Git Bash + ZIP-based update fallback
+- pywinpty for PTY support ([#457](https://github.com/NousResearch/hermes-agent/pull/457)) — @shitcoinsherpa
+- Explicit UTF-8 encoding on all config/data file I/O ([#458](https://github.com/NousResearch/hermes-agent/pull/458)) — @shitcoinsherpa
+- Windows-compatible path handling ([#354](https://github.com/NousResearch/hermes-agent/pull/354), [#390](https://github.com/NousResearch/hermes-agent/pull/390)) — @Farukest
+- Regex-based search output parsing for drive-letter paths ([#533](https://github.com/NousResearch/hermes-agent/pull/533)) — @Himess
+- Auth store file lock for Windows ([#455](https://github.com/NousResearch/hermes-agent/pull/455)) — @shitcoinsherpa
+
+---
+
+## 🐛 Notable Bug Fixes
+
+- Fix DeepSeek V3 tool call parser silently dropping multi-line JSON arguments ([#444](https://github.com/NousResearch/hermes-agent/pull/444)) — @PercyDikec
+- Fix gateway transcript losing 1 message per turn due to offset mismatch ([#395](https://github.com/NousResearch/hermes-agent/pull/395)) — @PercyDikec
+- Fix /retry command silently discarding the agent's final response ([#441](https://github.com/NousResearch/hermes-agent/pull/441)) — @PercyDikec
+- Fix max-iterations retry returning empty string after think-block stripping ([#438](https://github.com/NousResearch/hermes-agent/pull/438)) — @PercyDikec
+- Fix max-iterations retry using hardcoded max_tokens ([#436](https://github.com/NousResearch/hermes-agent/pull/436)) — @Farukest
+- Fix Codex status dict key mismatch ([#448](https://github.com/NousResearch/hermes-agent/pull/448)) and visibility filter ([#446](https://github.com/NousResearch/hermes-agent/pull/446)) — @PercyDikec
+- Strip \<think\> blocks from final user-facing responses ([#174](https://github.com/NousResearch/hermes-agent/pull/174)) — @Bartok9
+- Fix \<think\> block regex stripping visible content when model discusses tags literally ([#786](https://github.com/NousResearch/hermes-agent/issues/786))
+- Fix Mistral 422 errors from leftover finish_reason in assistant messages ([#253](https://github.com/NousResearch/hermes-agent/pull/253)) — @Sertug17
+- Fix OPENROUTER_API_KEY resolution order across all code paths ([#295](https://github.com/NousResearch/hermes-agent/pull/295)) — @0xbyt4
+- Fix OPENAI_BASE_URL API key priority ([#420](https://github.com/NousResearch/hermes-agent/pull/420)) — @manuelschipper
+- Fix Anthropic "prompt is too long" 400 error not detected as context length error ([#813](https://github.com/NousResearch/hermes-agent/issues/813))
+- Fix SQLite session transcript accumulating duplicate messages — 3-4x token inflation ([#860](https://github.com/NousResearch/hermes-agent/issues/860))
+- Fix setup wizard skipping API key prompts on first install ([#748](https://github.com/NousResearch/hermes-agent/pull/748))
+- Fix setup wizard showing OpenRouter model list for Nous Portal ([#575](https://github.com/NousResearch/hermes-agent/pull/575)) — @PercyDikec
+- Fix provider selection not persisting when switching via hermes model ([#881](https://github.com/NousResearch/hermes-agent/pull/881))
+- Fix Docker backend failing when docker not in PATH on macOS ([#889](https://github.com/NousResearch/hermes-agent/pull/889))
+- Fix ClawHub Skills Hub adapter for API endpoint changes ([#286](https://github.com/NousResearch/hermes-agent/pull/286)) — @BP602
+- Fix Honcho auto-enable when API key is present ([#243](https://github.com/NousResearch/hermes-agent/pull/243)) — @Bartok9
+- Fix duplicate 'skills' subparser crash on Python 3.11+ ([#898](https://github.com/NousResearch/hermes-agent/issues/898))
+- Fix memory tool entry parsing when content contains section sign ([#162](https://github.com/NousResearch/hermes-agent/pull/162)) — @aydnOktay
+- Fix piped install silently aborting when interactive prompts fail ([#72](https://github.com/NousResearch/hermes-agent/pull/72)) — @cutepawss
+- Fix false positives in recursive delete detection ([#68](https://github.com/NousResearch/hermes-agent/pull/68)) — @cutepawss
+- Fix Ruff lint warnings across codebase ([#608](https://github.com/NousResearch/hermes-agent/pull/608)) — @JackTheGit
+- Fix Anthropic native base URL fail-fast ([#173](https://github.com/NousResearch/hermes-agent/pull/173)) — @adavyas
+- Fix install.sh creating ~/.hermes before moving Node.js directory ([#53](https://github.com/NousResearch/hermes-agent/pull/53)) — @JoshuaMart
+- Fix SystemExit traceback during atexit cleanup on Ctrl+C ([#55](https://github.com/NousResearch/hermes-agent/pull/55)) — @bierlingm
+- Restore missing MIT license file ([#620](https://github.com/NousResearch/hermes-agent/pull/620)) — @stablegenius49
+
+---
+
+## 🧪 Testing
+
+- **3,289 tests** across agent, gateway, tools, cron, and CLI
+- Parallelized test suite with pytest-xdist ([#802](https://github.com/NousResearch/hermes-agent/pull/802)) — @OutThisLife
+- Unit tests batch 1: 8 core modules ([#60](https://github.com/NousResearch/hermes-agent/pull/60)) — @0xbyt4
+- Unit tests batch 2: 8 more modules ([#62](https://github.com/NousResearch/hermes-agent/pull/62)) — @0xbyt4
+- Unit tests batch 3: 8 untested modules ([#191](https://github.com/NousResearch/hermes-agent/pull/191)) — @0xbyt4
+- Unit tests batch 4: 5 security/logic-critical modules ([#193](https://github.com/NousResearch/hermes-agent/pull/193)) — @0xbyt4
+- AIAgent (run_agent.py) unit tests ([#67](https://github.com/NousResearch/hermes-agent/pull/67)) — @0xbyt4
+- Trajectory compressor tests ([#203](https://github.com/NousResearch/hermes-agent/pull/203)) — @0xbyt4
+- Clarify tool tests ([#121](https://github.com/NousResearch/hermes-agent/pull/121)) — @Bartok9
+- Telegram format tests — 43 tests for italic/bold/code rendering ([#204](https://github.com/NousResearch/hermes-agent/pull/204)) — @0xbyt4
+- Vision tools type hints + 42 tests ([#792](https://github.com/NousResearch/hermes-agent/pull/792))
+- Compressor tool-call boundary regression tests ([#648](https://github.com/NousResearch/hermes-agent/pull/648)) — @intertwine
+- Test structure reorganization ([#34](https://github.com/NousResearch/hermes-agent/pull/34)) — @0xbyt4
+- Shell noise elimination + fix 36 test failures ([#293](https://github.com/NousResearch/hermes-agent/pull/293)) — @0xbyt4
+
+---
+
+## 🔬 RL & Evaluation Environments
+
+- WebResearchEnv — Multi-step web research RL environment ([#434](https://github.com/NousResearch/hermes-agent/pull/434)) — @jackx707
+- Modal sandbox concurrency limits to avoid deadlocks ([#621](https://github.com/NousResearch/hermes-agent/pull/621)) — @voteblake
+- Hermes-atropos-environments bundled skill ([#815](https://github.com/NousResearch/hermes-agent/pull/815))
+- Local vLLM instance support for evaluation — @dmahan93
+- YC-Bench long-horizon agent benchmark environment
+- OpenThoughts-TBLite evaluation environment and scripts
+
+---
+
+## 📚 Documentation
+
+- Full documentation website (Docusaurus) with 37+ pages
+- Comprehensive platform setup guides for Telegram, Discord, Slack, WhatsApp, Signal, Email
+- AGENTS.md — development guide for AI coding assistants
+- CONTRIBUTING.md ([#117](https://github.com/NousResearch/hermes-agent/pull/117)) — @Bartok9
+- Slash commands reference ([#142](https://github.com/NousResearch/hermes-agent/pull/142)) — @Bartok9
+- Comprehensive AGENTS.md accuracy audit ([#732](https://github.com/NousResearch/hermes-agent/pull/732))
+- Skin/theme system documentation
+- MCP documentation and examples
+- Docs accuracy audit — 35+ corrections
+- Documentation typo fixes ([#825](https://github.com/NousResearch/hermes-agent/pull/825), [#439](https://github.com/NousResearch/hermes-agent/pull/439)) — @JackTheGit
+- CLI config precedence and terminology standardization ([#166](https://github.com/NousResearch/hermes-agent/pull/166), [#167](https://github.com/NousResearch/hermes-agent/pull/167), [#168](https://github.com/NousResearch/hermes-agent/pull/168)) — @Jr-kenny
+- Telegram token regex documentation ([#713](https://github.com/NousResearch/hermes-agent/pull/713)) — @VolodymyrBg
+
+---
+
+## 👥 Contributors
+
+Thank you to the 63 contributors who made this release possible! In just over two weeks, the Hermes Agent community came together to ship an extraordinary amount of work.
+
+### Core
+- **@teknium1** — 43 PRs: Project lead, core architecture, provider router, sessions, skills, CLI, documentation
+
+### Top Community Contributors
+- **@0xbyt4** — 40 PRs: MCP client, Home Assistant, security fixes (symlink, prompt injection, cron), extensive test coverage (6 batches), ascii-art skill, shell noise elimination, skills sync, Telegram formatting, and dozens more
+- **@Farukest** — 16 PRs: Security hardening (path traversal, dangerous command detection, symlink boundary), Windows compatibility (POSIX guards, path handling), WhatsApp fixes, max-iterations retry, gateway fixes
+- **@aydnOktay** — 11 PRs: Atomic writes (process checkpoints, batch runner, skill files), error handling improvements across Telegram, Discord, code execution, transcription, TTS, and skills
+- **@Bartok9** — 9 PRs: CONTRIBUTING.md, slash commands reference, Discord channel topics, think-block stripping, TTS fix, Honcho fix, session count fix, clarify tests
+- **@PercyDikec** — 7 PRs: DeepSeek V3 parser fix, /retry response discard, gateway transcript offset, Codex status/visibility, max-iterations retry, setup wizard fix
+- **@teyrebaz33** — 5 PRs: Skills enable/disable system, quick commands, personality customization, conditional skill activation
+- **@alireza78a** — 5 PRs: Atomic writes (cron, sessions), fd leak prevention, security allowlist, code execution socket cleanup
+- **@shitcoinsherpa** — 3 PRs: Windows support (pywinpty, UTF-8 encoding, auth store lock)
+- **@Himess** — 3 PRs: Cron/HomeAssistant/Daytona fix, Windows drive-letter parsing, .env permissions
+- **@satelerd** — 2 PRs: WhatsApp native media, multi-user session isolation
+- **@rovle** — 1 PR: Daytona cloud sandbox backend (4 commits)
+- **@erosika** — 1 PR: Honcho AI-native memory integration
+- **@dmahan93** — 1 PR: --fuck-it-ship-it flag + RL environment work
+- **@SHL0MS** — 1 PR: ASCII video skill
+
+### All Contributors
+@0xbyt4, @BP602, @Bartok9, @Farukest, @FurkanL0, @Himess, @Indelwin, @JackTheGit, @JoshuaMart, @Jr-kenny, @OutThisLife, @PercyDikec, @SHL0MS, @Sertug17, @VencentSoliman, @VolodymyrBg, @adavyas, @alireza78a, @areu01or00, @aydnOktay, @batuhankocyigit, @bierlingm, @caentzminger, @cesareth, @ch3ronsa, @christomitov, @cutepawss, @deankerr, @dmahan93, @dogiladeveloper, @dragonkhoi, @erosika, @gamedevCloudy, @gizdusum, @grp06, @intertwine, @jackx707, @jdblackstar, @johnh4098, @kaos35, @kshitijk4poor, @leonsgithub, @luisv-1, @manuelschipper, @mehmetkr-31, @memosr, @PeterFile, @rewbs, @rovle, @rsavitt, @satelerd, @spanishflu-est1918, @stablegenius49, @tars90percent, @tekelala, @teknium1, @teyrebaz33, @tripledoublev, @unmodeled-tyler, @voidborne-d, @voteblake, @ygd58
+
+---
+
+**Full Changelog**: [v0.1.0...v2026.3.12](https://github.com/NousResearch/hermes-agent/compare/v0.1.0...v2026.3.12)

agent/auxiliary_client.py

@@ -17,7 +17,10 @@ Resolution order for text tasks (auto mode):
 Resolution order for vision/multimodal tasks (auto mode):
   1. OpenRouter
   2. Nous Portal
-  3. None  (steps 3-5 are skipped — they may not support multimodal)
+  3. Codex OAuth (gpt-5.3-codex supports vision via Responses API)
+  4. Custom endpoint (for local vision models: Qwen-VL, LLaVA, Pixtral, etc.)
+  5. None  (API-key providers like z.ai/Kimi/MiniMax are skipped —
+     they may not support multimodal)
 
 Per-task provider overrides (e.g. AUXILIARY_VISION_PROVIDER,
 CONTEXT_COMPRESSION_PROVIDER) can force a specific provider for each task:
@@ -34,7 +37,7 @@ import logging
 import os
 from pathlib import Path
 from types import SimpleNamespace
-from typing import Any
+from typing import Any, Dict, List, Optional, Tuple
 
 from openai import OpenAI
 
@@ -43,7 +46,7 @@ from hermes_constants import OPENROUTER_BASE_URL
 logger = logging.getLogger(__name__)
 
 # Default auxiliary models for direct API-key providers (cheap/fast for side tasks)
-_API_KEY_PROVIDER_AUX_MODELS: dict[str, str] = {
+_API_KEY_PROVIDER_AUX_MODELS: Dict[str, str] = {
     "zai": "glm-4.5-flash",
     "kimi-coding": "kimi-k2-turbo-preview",
     "minimax": "MiniMax-M2.5-highspeed",
@@ -102,7 +105,7 @@ def _convert_content_for_responses(content: Any) -> Any:
     if not isinstance(content, list):
         return str(content) if content else ""
 
-    converted: list[dict[str, Any]] = []
+    converted: List[Dict[str, Any]] = []
     for part in content:
         if not isinstance(part, dict):
             continue
@@ -113,7 +116,7 @@ def _convert_content_for_responses(content: Any) -> Any:
             # chat.completions nests the URL: {"image_url": {"url": "..."}}
             image_data = part.get("image_url", {})
             url = image_data.get("url", "") if isinstance(image_data, dict) else str(image_data)
-            entry: dict[str, Any] = {"type": "input_image", "image_url": url}
+            entry: Dict[str, Any] = {"type": "input_image", "image_url": url}
             # Preserve detail if specified
             detail = image_data.get("detail") if isinstance(image_data, dict) else None
             if detail:
@@ -148,21 +151,19 @@ class _CodexCompletionsAdapter:
         # Convert chat.completions multimodal content blocks to Responses
         # API format (input_text / input_image instead of text / image_url).
         instructions = "You are a helpful assistant."
-        input_msgs: list[dict[str, Any]] = []
+        input_msgs: List[Dict[str, Any]] = []
         for msg in messages:
             role = msg.get("role", "user")
             content = msg.get("content") or ""
             if role == "system":
                 instructions = content if isinstance(content, str) else str(content)
             else:
-                input_msgs.append(
-                    {
-                        "role": role,
-                        "content": _convert_content_for_responses(content),
-                    }
-                )
+                input_msgs.append({
+                    "role": role,
+                    "content": _convert_content_for_responses(content),
+                })
 
-        resp_kwargs: dict[str, Any] = {
+        resp_kwargs: Dict[str, Any] = {
             "model": model,
             "instructions": instructions,
             "input": input_msgs or [{"role": "user", "content": ""}],
@@ -181,20 +182,18 @@ class _CodexCompletionsAdapter:
                 name = fn.get("name")
                 if not name:
                     continue
-                converted.append(
-                    {
-                        "type": "function",
-                        "name": name,
-                        "description": fn.get("description", ""),
-                        "parameters": fn.get("parameters", {}),
-                    }
-                )
+                converted.append({
+                    "type": "function",
+                    "name": name,
+                    "description": fn.get("description", ""),
+                    "parameters": fn.get("parameters", {}),
+                })
             if converted:
                 resp_kwargs["tools"] = converted
 
         # Stream and collect the response
-        text_parts: list[str] = []
-        tool_calls_raw: list[Any] = []
+        text_parts: List[str] = []
+        tool_calls_raw: List[Any] = []
         usage = None
 
         try:
@@ -212,16 +211,14 @@ class _CodexCompletionsAdapter:
                         if ptype in ("output_text", "text"):
                             text_parts.append(getattr(part, "text", ""))
                 elif item_type == "function_call":
-                    tool_calls_raw.append(
-                        SimpleNamespace(
-                            id=getattr(item, "call_id", ""),
-                            type="function",
-                            function=SimpleNamespace(
-                                name=getattr(item, "name", ""),
-                                arguments=getattr(item, "arguments", "{}"),
-                            ),
-                        )
-                    )
+                    tool_calls_raw.append(SimpleNamespace(
+                        id=getattr(item, "call_id", ""),
+                        type="function",
+                        function=SimpleNamespace(
+                            name=getattr(item, "name", ""),
+                            arguments=getattr(item, "arguments", "{}"),
+                        ),
+                    ))
 
             resp_usage = getattr(final, "usage", None)
             if resp_usage:
@@ -291,7 +288,6 @@ class _AsyncCodexCompletionsAdapter:
 
     async def create(self, **kwargs) -> Any:
         import asyncio
-
         return await asyncio.to_thread(self._sync.create, **kwargs)
 
 
@@ -311,7 +307,7 @@ class AsyncCodexAuxiliaryClient:
         self.base_url = sync_wrapper.base_url
 
 
-def _read_nous_auth() -> dict | None:
+def _read_nous_auth() -> Optional[dict]:
     """Read and validate ~/.hermes/auth.json for an active Nous provider.
 
     Returns the provider state dict if Nous is active with tokens,
@@ -343,11 +339,10 @@ def _nous_base_url() -> str:
     return os.getenv("NOUS_INFERENCE_BASE_URL", _NOUS_DEFAULT_BASE_URL)
 
 
-def _read_codex_access_token() -> str | None:
+def _read_codex_access_token() -> Optional[str]:
     """Read a valid Codex OAuth access token from Hermes auth store (~/.hermes/auth.json)."""
     try:
         from hermes_cli.auth import _read_codex_tokens
-
         data = _read_codex_tokens()
         tokens = data.get("tokens", {})
         access_token = tokens.get("access_token")
@@ -359,7 +354,7 @@ def _read_codex_access_token() -> str | None:
         return None
 
 
-def _resolve_api_key_provider() -> tuple[OpenAI | None, str | None]:
+def _resolve_api_key_provider() -> Tuple[Optional[OpenAI], Optional[str]]:
     """Try each API-key provider in PROVIDER_REGISTRY order.
 
     Returns (client, model) for the first provider whose env var is set,
@@ -406,7 +401,6 @@ def _resolve_api_key_provider() -> tuple[OpenAI | None, str | None]:
 
 # ── Provider resolution helpers ─────────────────────────────────────────────
 
-
 def _get_auxiliary_provider(task: str = "") -> str:
     """Read the provider override for a specific auxiliary task.
 
@@ -422,15 +416,16 @@ def _get_auxiliary_provider(task: str = "") -> str:
     return "auto"
 
 
-def _try_openrouter() -> tuple[OpenAI | None, str | None]:
+def _try_openrouter() -> Tuple[Optional[OpenAI], Optional[str]]:
     or_key = os.getenv("OPENROUTER_API_KEY")
     if not or_key:
         return None, None
     logger.debug("Auxiliary client: OpenRouter")
-    return OpenAI(api_key=or_key, base_url=OPENROUTER_BASE_URL, default_headers=_OR_HEADERS), _OPENROUTER_MODEL
+    return OpenAI(api_key=or_key, base_url=OPENROUTER_BASE_URL,
+                   default_headers=_OR_HEADERS), _OPENROUTER_MODEL
 
 
-def _try_nous() -> tuple[OpenAI | None, str | None]:
+def _try_nous() -> Tuple[Optional[OpenAI], Optional[str]]:
     nous = _read_nous_auth()
     if not nous:
         return None, None
@@ -443,17 +438,17 @@ def _try_nous() -> tuple[OpenAI | None, str | None]:
     )
 
 
-def _try_custom_endpoint() -> tuple[OpenAI | None, str | None]:
+def _try_custom_endpoint() -> Tuple[Optional[OpenAI], Optional[str]]:
     custom_base = os.getenv("OPENAI_BASE_URL")
     custom_key = os.getenv("OPENAI_API_KEY")
     if not custom_base or not custom_key:
         return None, None
-    model = os.getenv("OPENAI_MODEL") or os.getenv("LLM_MODEL") or "gpt-4o-mini"
+    model = os.getenv("OPENAI_MODEL") or "gpt-4o-mini"
     logger.debug("Auxiliary client: custom endpoint (%s)", model)
     return OpenAI(api_key=custom_key, base_url=custom_base), model
 
 
-def _try_codex() -> tuple[Any | None, str | None]:
+def _try_codex() -> Tuple[Optional[Any], Optional[str]]:
     codex_token = _read_codex_access_token()
     if not codex_token:
         return None, None
@@ -462,7 +457,7 @@ def _try_codex() -> tuple[Any | None, str | None]:
     return CodexAuxiliaryClient(real_client, _CODEX_AUX_MODEL), _CODEX_AUX_MODEL
 
 
-def _resolve_forced_provider(forced: str) -> tuple[OpenAI | None, str | None]:
+def _resolve_forced_provider(forced: str) -> Tuple[Optional[OpenAI], Optional[str]]:
     """Resolve a specific forced provider.  Returns (None, None) if creds missing."""
     if forced == "openrouter":
         client, model = _try_openrouter()
@@ -496,9 +491,10 @@ def _resolve_forced_provider(forced: str) -> tuple[OpenAI | None, str | None]:
     return None, None
 
 
-def _resolve_auto() -> tuple[OpenAI | None, str | None]:
+def _resolve_auto() -> Tuple[Optional[OpenAI], Optional[str]]:
     """Full auto-detection chain: OpenRouter → Nous → custom → Codex → API-key → None."""
-    for try_fn in (_try_openrouter, _try_nous, _try_custom_endpoint, _try_codex, _resolve_api_key_provider):
+    for try_fn in (_try_openrouter, _try_nous, _try_custom_endpoint,
+                   _try_codex, _resolve_api_key_provider):
         client, model = try_fn()
         if client is not None:
             return client, model
@@ -506,10 +502,208 @@ def _resolve_auto() -> tuple[OpenAI | None, str | None]:
     return None, None
 
 
+# ── Centralized Provider Router ─────────────────────────────────────────────
+#
+# resolve_provider_client() is the single entry point for creating a properly
+# configured client given a (provider, model) pair.  It handles auth lookup,
+# base URL resolution, provider-specific headers, and API format differences
+# (Chat Completions vs Responses API for Codex).
+#
+# All auxiliary consumer code should go through this or the public helpers
+# below — never look up auth env vars ad-hoc.
+
+
+def _to_async_client(sync_client, model: str):
+    """Convert a sync client to its async counterpart, preserving Codex routing."""
+    from openai import AsyncOpenAI
+
+    if isinstance(sync_client, CodexAuxiliaryClient):
+        return AsyncCodexAuxiliaryClient(sync_client), model
+
+    async_kwargs = {
+        "api_key": sync_client.api_key,
+        "base_url": str(sync_client.base_url),
+    }
+    base_lower = str(sync_client.base_url).lower()
+    if "openrouter" in base_lower:
+        async_kwargs["default_headers"] = dict(_OR_HEADERS)
+    elif "api.kimi.com" in base_lower:
+        async_kwargs["default_headers"] = {"User-Agent": "KimiCLI/1.0"}
+    return AsyncOpenAI(**async_kwargs), model
+
+
+def resolve_provider_client(
+    provider: str,
+    model: str = None,
+    async_mode: bool = False,
+    raw_codex: bool = False,
+) -> Tuple[Optional[Any], Optional[str]]:
+    """Central router: given a provider name and optional model, return a
+    configured client with the correct auth, base URL, and API format.
+
+    The returned client always exposes ``.chat.completions.create()`` — for
+    Codex/Responses API providers, an adapter handles the translation
+    transparently.
+
+    Args:
+        provider: Provider identifier.  One of:
+            "openrouter", "nous", "openai-codex" (or "codex"),
+            "zai", "kimi-coding", "minimax", "minimax-cn",
+            "custom" (OPENAI_BASE_URL + OPENAI_API_KEY),
+            "auto" (full auto-detection chain).
+        model: Model slug override.  If None, uses the provider's default
+               auxiliary model.
+        async_mode: If True, return an async-compatible client.
+        raw_codex: If True, return a raw OpenAI client for Codex providers
+            instead of wrapping in CodexAuxiliaryClient.  Use this when
+            the caller needs direct access to responses.stream() (e.g.,
+            the main agent loop).
+
+    Returns:
+        (client, resolved_model) or (None, None) if auth is unavailable.
+    """
+    # Normalise aliases
+    provider = (provider or "auto").strip().lower()
+    if provider == "codex":
+        provider = "openai-codex"
+    if provider == "main":
+        provider = "custom"
+
+    # ── Auto: try all providers in priority order ────────────────────
+    if provider == "auto":
+        client, resolved = _resolve_auto()
+        if client is None:
+            return None, None
+        final_model = model or resolved
+        return (_to_async_client(client, final_model) if async_mode
+                else (client, final_model))
+
+    # ── OpenRouter ───────────────────────────────────────────────────
+    if provider == "openrouter":
+        client, default = _try_openrouter()
+        if client is None:
+            logger.warning("resolve_provider_client: openrouter requested "
+                           "but OPENROUTER_API_KEY not set")
+            return None, None
+        final_model = model or default
+        return (_to_async_client(client, final_model) if async_mode
+                else (client, final_model))
+
+    # ── Nous Portal (OAuth) ──────────────────────────────────────────
+    if provider == "nous":
+        client, default = _try_nous()
+        if client is None:
+            logger.warning("resolve_provider_client: nous requested "
+                           "but Nous Portal not configured (run: hermes login)")
+            return None, None
+        final_model = model or default
+        return (_to_async_client(client, final_model) if async_mode
+                else (client, final_model))
+
+    # ── OpenAI Codex (OAuth → Responses API) ─────────────────────────
+    if provider == "openai-codex":
+        if raw_codex:
+            # Return the raw OpenAI client for callers that need direct
+            # access to responses.stream() (e.g., the main agent loop).
+            codex_token = _read_codex_access_token()
+            if not codex_token:
+                logger.warning("resolve_provider_client: openai-codex requested "
+                               "but no Codex OAuth token found (run: hermes model)")
+                return None, None
+            final_model = model or _CODEX_AUX_MODEL
+            raw_client = OpenAI(api_key=codex_token, base_url=_CODEX_AUX_BASE_URL)
+            return (raw_client, final_model)
+        # Standard path: wrap in CodexAuxiliaryClient adapter
+        client, default = _try_codex()
+        if client is None:
+            logger.warning("resolve_provider_client: openai-codex requested "
+                           "but no Codex OAuth token found (run: hermes model)")
+            return None, None
+        final_model = model or default
+        return (_to_async_client(client, final_model) if async_mode
+                else (client, final_model))
+
+    # ── Custom endpoint (OPENAI_BASE_URL + OPENAI_API_KEY) ───────────
+    if provider == "custom":
+        # Try custom first, then codex, then API-key providers
+        for try_fn in (_try_custom_endpoint, _try_codex,
+                       _resolve_api_key_provider):
+            client, default = try_fn()
+            if client is not None:
+                final_model = model or default
+                return (_to_async_client(client, final_model) if async_mode
+                        else (client, final_model))
+        logger.warning("resolve_provider_client: custom/main requested "
+                       "but no endpoint credentials found")
+        return None, None
+
+    # ── API-key providers from PROVIDER_REGISTRY ─────────────────────
+    try:
+        from hermes_cli.auth import PROVIDER_REGISTRY, _resolve_kimi_base_url
+    except ImportError:
+        logger.debug("hermes_cli.auth not available for provider %s", provider)
+        return None, None
+
+    pconfig = PROVIDER_REGISTRY.get(provider)
+    if pconfig is None:
+        logger.warning("resolve_provider_client: unknown provider %r", provider)
+        return None, None
+
+    if pconfig.auth_type == "api_key":
+        # Find the first configured API key
+        api_key = ""
+        for env_var in pconfig.api_key_env_vars:
+            api_key = os.getenv(env_var, "").strip()
+            if api_key:
+                break
+        if not api_key:
+            logger.warning("resolve_provider_client: provider %s has no API "
+                           "key configured (tried: %s)",
+                           provider, ", ".join(pconfig.api_key_env_vars))
+            return None, None
+
+        # Resolve base URL (env override → provider-specific logic → default)
+        base_url_override = os.getenv(pconfig.base_url_env_var, "").strip() if pconfig.base_url_env_var else ""
+        if provider == "kimi-coding":
+            base_url = _resolve_kimi_base_url(api_key, pconfig.inference_base_url, base_url_override)
+        elif base_url_override:
+            base_url = base_url_override
+        else:
+            base_url = pconfig.inference_base_url
+
+        default_model = _API_KEY_PROVIDER_AUX_MODELS.get(provider, "")
+        final_model = model or default_model
+
+        # Provider-specific headers
+        headers = {}
+        if "api.kimi.com" in base_url.lower():
+            headers["User-Agent"] = "KimiCLI/1.0"
+
+        client = OpenAI(api_key=api_key, base_url=base_url,
+                        **({"default_headers": headers} if headers else {}))
+        logger.debug("resolve_provider_client: %s (%s)", provider, final_model)
+        return (_to_async_client(client, final_model) if async_mode
+                else (client, final_model))
+
+    elif pconfig.auth_type in ("oauth_device_code", "oauth_external"):
+        # OAuth providers — route through their specific try functions
+        if provider == "nous":
+            return resolve_provider_client("nous", model, async_mode)
+        if provider == "openai-codex":
+            return resolve_provider_client("openai-codex", model, async_mode)
+        # Other OAuth providers not directly supported
+        logger.warning("resolve_provider_client: OAuth provider %s not "
+                       "directly supported, try 'auto'", provider)
+        return None, None
+
+    logger.warning("resolve_provider_client: unhandled auth_type %s for %s",
+                   pconfig.auth_type, provider)
+    return None, None
+
+
 # ── Public API ──────────────────────────────────────────────────────────────
 
-
-def get_text_auxiliary_client(task: str = "") -> tuple[OpenAI | None, str | None]:
+def get_text_auxiliary_client(task: str = "") -> Tuple[Optional[OpenAI], Optional[str]]:
     """Return (client, default_model_slug) for text-only auxiliary tasks.
 
     Args:
@@ -521,8 +715,8 @@ def get_text_auxiliary_client(task: str = "") -> tuple[OpenAI | None, str | None
     """
     forced = _get_auxiliary_provider(task)
     if forced != "auto":
-        return _resolve_forced_provider(forced)
-    return _resolve_auto()
+        return resolve_provider_client(forced)
+    return resolve_provider_client("auto")
 
 
 def get_async_text_auxiliary_client(task: str = ""):
@@ -532,27 +726,13 @@ def get_async_text_auxiliary_client(task: str = ""):
     (AsyncCodexAuxiliaryClient, model) which wraps the Responses API.
     Returns (None, None) when no provider is available.
     """
-    from openai import AsyncOpenAI
-
-    sync_client, model = get_text_auxiliary_client(task)
-    if sync_client is None:
-        return None, None
-
-    if isinstance(sync_client, CodexAuxiliaryClient):
-        return AsyncCodexAuxiliaryClient(sync_client), model
-
-    async_kwargs = {
-        "api_key": sync_client.api_key,
-        "base_url": str(sync_client.base_url),
-    }
-    if "openrouter" in str(sync_client.base_url).lower():
-        async_kwargs["default_headers"] = dict(_OR_HEADERS)
-    elif "api.kimi.com" in str(sync_client.base_url).lower():
-        async_kwargs["default_headers"] = {"User-Agent": "KimiCLI/1.0"}
-    return AsyncOpenAI(**async_kwargs), model
+    forced = _get_auxiliary_provider(task)
+    if forced != "auto":
+        return resolve_provider_client(forced, async_mode=True)
+    return resolve_provider_client("auto", async_mode=True)
 
 
-def get_vision_auxiliary_client() -> tuple[OpenAI | None, str | None]:
+def get_vision_auxiliary_client() -> Tuple[Optional[OpenAI], Optional[str]]:
     """Return (client, default_model_slug) for vision/multimodal auxiliary tasks.
 
     Checks AUXILIARY_VISION_PROVIDER for a forced provider, otherwise
@@ -567,12 +747,13 @@ def get_vision_auxiliary_client() -> tuple[OpenAI | None, str | None]:
     """
     forced = _get_auxiliary_provider("vision")
     if forced != "auto":
-        return _resolve_forced_provider(forced)
+        return resolve_provider_client(forced)
     # Auto: try providers known to support multimodal first, then fall
     # back to the user's custom endpoint.  Many local models (Qwen-VL,
     # LLaVA, Pixtral, etc.) support vision — skipping them entirely
     # caused silent failures for local-only users.
-    for try_fn in (_try_openrouter, _try_nous, _try_codex, _try_custom_endpoint):
+    for try_fn in (_try_openrouter, _try_nous, _try_codex,
+                   _try_custom_endpoint):
         client, model = try_fn()
         if client is not None:
             return client, model
@@ -580,9 +761,24 @@ def get_vision_auxiliary_client() -> tuple[OpenAI | None, str | None]:
     return None, None
 
 
+def get_async_vision_auxiliary_client():
+    """Return (async_client, model_slug) for async vision consumers.
+
+    Properly handles Codex routing — unlike manually constructing
+    AsyncOpenAI from a sync client, this preserves the Responses API
+    adapter for Codex providers.
+
+    Returns (None, None) when no provider is available.
+    """
+    sync_client, model = get_vision_auxiliary_client()
+    if sync_client is None:
+        return None, None
+    return _to_async_client(sync_client, model)
+
+
 def get_auxiliary_extra_body() -> dict:
     """Return extra_body kwargs for auxiliary API calls.
-
+    
     Includes Nous Portal product tags when the auxiliary client is backed
     by Nous Portal. Returns empty dict otherwise.
     """
@@ -591,7 +787,7 @@ def get_auxiliary_extra_body() -> dict:
 
 def auxiliary_max_tokens_param(value: int) -> dict:
     """Return the correct max tokens kwarg for the auxiliary client's provider.
-
+    
     OpenRouter and local models use 'max_tokens'. Direct OpenAI with newer
     models (gpt-4o, o-series, gpt-5+) requires 'max_completion_tokens'.
     The Codex adapter translates max_tokens internally, so we use max_tokens
@@ -600,6 +796,258 @@ def auxiliary_max_tokens_param(value: int) -> dict:
     custom_base = os.getenv("OPENAI_BASE_URL", "")
     or_key = os.getenv("OPENROUTER_API_KEY")
     # Only use max_completion_tokens for direct OpenAI custom endpoints
-    if not or_key and _read_nous_auth() is None and "api.openai.com" in custom_base.lower():
+    if (not or_key
+            and _read_nous_auth() is None
+            and "api.openai.com" in custom_base.lower()):
         return {"max_completion_tokens": value}
     return {"max_tokens": value}
+
+
+# ── Centralized LLM Call API ────────────────────────────────────────────────
+#
+# call_llm() and async_call_llm() own the full request lifecycle:
+#   1. Resolve provider + model from task config (or explicit args)
+#   2. Get or create a cached client for that provider
+#   3. Format request args for the provider + model (max_tokens handling, etc.)
+#   4. Make the API call
+#   5. Return the response
+#
+# Every auxiliary LLM consumer should use these instead of manually
+# constructing clients and calling .chat.completions.create().
+
+# Client cache: (provider, async_mode) -> (client, default_model)
+_client_cache: Dict[tuple, tuple] = {}
+
+
+def _get_cached_client(
+    provider: str, model: str = None, async_mode: bool = False,
+) -> Tuple[Optional[Any], Optional[str]]:
+    """Get or create a cached client for the given provider."""
+    cache_key = (provider, async_mode)
+    if cache_key in _client_cache:
+        cached_client, cached_default = _client_cache[cache_key]
+        return cached_client, model or cached_default
+    client, default_model = resolve_provider_client(provider, model, async_mode)
+    if client is not None:
+        _client_cache[cache_key] = (client, default_model)
+    return client, model or default_model
+
+
+def _resolve_task_provider_model(
+    task: str = None,
+    provider: str = None,
+    model: str = None,
+) -> Tuple[str, Optional[str]]:
+    """Determine provider + model for a call.
+
+    Priority:
+      1. Explicit provider/model args (always win)
+      2. Env var overrides (AUXILIARY_{TASK}_PROVIDER, etc.)
+      3. Config file (auxiliary.{task}.provider/model or compression.*)
+      4. "auto" (full auto-detection chain)
+
+    Returns (provider, model) where model may be None (use provider default).
+    """
+    if provider:
+        return provider, model
+
+    if task:
+        # Check env var overrides first
+        env_provider = _get_auxiliary_provider(task)
+        if env_provider != "auto":
+            # Check for env var model override too
+            env_model = None
+            for prefix in ("AUXILIARY_", "CONTEXT_"):
+                val = os.getenv(f"{prefix}{task.upper()}_MODEL", "").strip()
+                if val:
+                    env_model = val
+                    break
+            return env_provider, model or env_model
+
+        # Read from config file
+        try:
+            from hermes_cli.config import load_config
+            config = load_config()
+        except ImportError:
+            return "auto", model
+
+        # Check auxiliary.{task} section
+        aux = config.get("auxiliary", {})
+        task_config = aux.get(task, {})
+        cfg_provider = task_config.get("provider", "").strip() or None
+        cfg_model = task_config.get("model", "").strip() or None
+
+        # Backwards compat: compression section has its own keys
+        if task == "compression" and not cfg_provider:
+            comp = config.get("compression", {})
+            cfg_provider = comp.get("summary_provider", "").strip() or None
+            cfg_model = cfg_model or comp.get("summary_model", "").strip() or None
+
+        if cfg_provider and cfg_provider != "auto":
+            return cfg_provider, model or cfg_model
+        return "auto", model or cfg_model
+
+    return "auto", model
+
+
+def _build_call_kwargs(
+    provider: str,
+    model: str,
+    messages: list,
+    temperature: Optional[float] = None,
+    max_tokens: Optional[int] = None,
+    tools: Optional[list] = None,
+    timeout: float = 30.0,
+    extra_body: Optional[dict] = None,
+) -> dict:
+    """Build kwargs for .chat.completions.create() with model/provider adjustments."""
+    kwargs: Dict[str, Any] = {
+        "model": model,
+        "messages": messages,
+        "timeout": timeout,
+    }
+
+    if temperature is not None:
+        kwargs["temperature"] = temperature
+
+    if max_tokens is not None:
+        # Codex adapter handles max_tokens internally; OpenRouter/Nous use max_tokens.
+        # Direct OpenAI api.openai.com with newer models needs max_completion_tokens.
+        if provider == "custom":
+            custom_base = os.getenv("OPENAI_BASE_URL", "")
+            if "api.openai.com" in custom_base.lower():
+                kwargs["max_completion_tokens"] = max_tokens
+            else:
+                kwargs["max_tokens"] = max_tokens
+        else:
+            kwargs["max_tokens"] = max_tokens
+
+    if tools:
+        kwargs["tools"] = tools
+
+    # Provider-specific extra_body
+    merged_extra = dict(extra_body or {})
+    if provider == "nous" or auxiliary_is_nous:
+        merged_extra.setdefault("tags", []).extend(["product=hermes-agent"])
+    if merged_extra:
+        kwargs["extra_body"] = merged_extra
+
+    return kwargs
+
+
+def call_llm(
+    task: str = None,
+    *,
+    provider: str = None,
+    model: str = None,
+    messages: list,
+    temperature: float = None,
+    max_tokens: int = None,
+    tools: list = None,
+    timeout: float = 30.0,
+    extra_body: dict = None,
+) -> Any:
+    """Centralized synchronous LLM call.
+
+    Resolves provider + model (from task config, explicit args, or auto-detect),
+    handles auth, request formatting, and model-specific arg adjustments.
+
+    Args:
+        task: Auxiliary task name ("compression", "vision", "web_extract",
+              "session_search", "skills_hub", "mcp", "flush_memories").
+              Reads provider:model from config/env. Ignored if provider is set.
+        provider: Explicit provider override.
+        model: Explicit model override.
+        messages: Chat messages list.
+        temperature: Sampling temperature (None = provider default).
+        max_tokens: Max output tokens (handles max_tokens vs max_completion_tokens).
+        tools: Tool definitions (for function calling).
+        timeout: Request timeout in seconds.
+        extra_body: Additional request body fields.
+
+    Returns:
+        Response object with .choices[0].message.content
+
+    Raises:
+        RuntimeError: If no provider is configured.
+    """
+    resolved_provider, resolved_model = _resolve_task_provider_model(
+        task, provider, model)
+
+    client, final_model = _get_cached_client(resolved_provider, resolved_model)
+    if client is None:
+        # Fallback: try openrouter
+        if resolved_provider != "openrouter":
+            logger.warning("Provider %s unavailable, falling back to openrouter",
+                           resolved_provider)
+            client, final_model = _get_cached_client(
+                "openrouter", resolved_model or _OPENROUTER_MODEL)
+    if client is None:
+        raise RuntimeError(
+            f"No LLM provider configured for task={task} provider={resolved_provider}. "
+            f"Run: hermes setup")
+
+    kwargs = _build_call_kwargs(
+        resolved_provider, final_model, messages,
+        temperature=temperature, max_tokens=max_tokens,
+        tools=tools, timeout=timeout, extra_body=extra_body)
+
+    # Handle max_tokens vs max_completion_tokens retry
+    try:
+        return client.chat.completions.create(**kwargs)
+    except Exception as first_err:
+        err_str = str(first_err)
+        if "max_tokens" in err_str or "unsupported_parameter" in err_str:
+            kwargs.pop("max_tokens", None)
+            kwargs["max_completion_tokens"] = max_tokens
+            return client.chat.completions.create(**kwargs)
+        raise
+
+
+async def async_call_llm(
+    task: str = None,
+    *,
+    provider: str = None,
+    model: str = None,
+    messages: list,
+    temperature: float = None,
+    max_tokens: int = None,
+    tools: list = None,
+    timeout: float = 30.0,
+    extra_body: dict = None,
+) -> Any:
+    """Centralized asynchronous LLM call.
+
+    Same as call_llm() but async. See call_llm() for full documentation.
+    """
+    resolved_provider, resolved_model = _resolve_task_provider_model(
+        task, provider, model)
+
+    client, final_model = _get_cached_client(
+        resolved_provider, resolved_model, async_mode=True)
+    if client is None:
+        if resolved_provider != "openrouter":
+            logger.warning("Provider %s unavailable, falling back to openrouter",
+                           resolved_provider)
+            client, final_model = _get_cached_client(
+                "openrouter", resolved_model or _OPENROUTER_MODEL,
+                async_mode=True)
+    if client is None:
+        raise RuntimeError(
+            f"No LLM provider configured for task={task} provider={resolved_provider}. "
+            f"Run: hermes setup")
+
+    kwargs = _build_call_kwargs(
+        resolved_provider, final_model, messages,
+        temperature=temperature, max_tokens=max_tokens,
+        tools=tools, timeout=timeout, extra_body=extra_body)
+
+    try:
+        return await client.chat.completions.create(**kwargs)
+    except Exception as first_err:
+        err_str = str(first_err)
+        if "max_tokens" in err_str or "unsupported_parameter" in err_str:
+            kwargs.pop("max_tokens", None)
+            kwargs["max_completion_tokens"] = max_tokens
+            return await client.chat.completions.create(**kwargs)
+        raise

agent/context_compressor.py

@@ -7,12 +7,12 @@ protecting head and tail context.
 
 import logging
 import os
-from typing import Any
+from typing import Any, Dict, List, Optional
 
-from agent.auxiliary_client import get_text_auxiliary_client
+from agent.auxiliary_client import call_llm
 from agent.model_metadata import (
-    estimate_messages_tokens_rough,
     get_model_context_length,
+    estimate_messages_tokens_rough,
 )
 
 logger = logging.getLogger(__name__)
@@ -53,10 +53,9 @@ class ContextCompressor:
         self.last_completion_tokens = 0
         self.last_total_tokens = 0
 
-        self.client, default_model = get_text_auxiliary_client("compression")
-        self.summary_model = summary_model_override or default_model
+        self.summary_model = summary_model_override or ""
 
-    def update_from_response(self, usage: dict[str, Any]):
+    def update_from_response(self, usage: Dict[str, Any]):
         """Update tracked token usage from API response."""
         self.last_prompt_tokens = usage.get("prompt_tokens", 0)
         self.last_completion_tokens = usage.get("completion_tokens", 0)
@@ -67,12 +66,12 @@ class ContextCompressor:
         tokens = prompt_tokens if prompt_tokens is not None else self.last_prompt_tokens
         return tokens >= self.threshold_tokens
 
-    def should_compress_preflight(self, messages: list[dict[str, Any]]) -> bool:
+    def should_compress_preflight(self, messages: List[Dict[str, Any]]) -> bool:
         """Quick pre-flight check using rough estimate (before API call)."""
         rough_estimate = estimate_messages_tokens_rough(messages)
         return rough_estimate >= self.threshold_tokens
 
-    def get_status(self) -> dict[str, Any]:
+    def get_status(self) -> Dict[str, Any]:
         """Get current compression status for display/logging."""
         return {
             "last_prompt_tokens": self.last_prompt_tokens,
@@ -82,7 +81,7 @@ class ContextCompressor:
             "compression_count": self.compression_count,
         }
 
-    def _generate_summary(self, turns_to_summarize: list[dict[str, Any]]) -> str | None:
+    def _generate_summary(self, turns_to_summarize: List[Dict[str, Any]]) -> Optional[str]:
         """Generate a concise summary of conversation turns.
 
         Tries the auxiliary model first, then falls back to the user's main
@@ -120,88 +119,30 @@ TURNS TO SUMMARIZE:
 
 Write only the summary, starting with "[CONTEXT SUMMARY]:" prefix."""
 
-        # 1. Try the auxiliary model (cheap/fast)
-        if self.client:
-            try:
-                return self._call_summary_model(self.client, self.summary_model, prompt)
-            except Exception as e:
-                logging.warning(f"Failed to generate context summary with auxiliary model: {e}")
-
-        # 2. Fallback: try the user's main model endpoint
-        fallback_client, fallback_model = self._get_fallback_client()
-        if fallback_client is not None:
-            try:
-                logger.info("Retrying context summary with main model (%s)", fallback_model)
-                summary = self._call_summary_model(fallback_client, fallback_model, prompt)
-                self.client = fallback_client
-                self.summary_model = fallback_model
-                return summary
-            except Exception as fallback_err:
-                logging.warning(f"Main model summary also failed: {fallback_err}")
-
-        # 3. All models failed — return None so the caller drops turns without a summary
-        logging.warning(
-            "Context compression: no model available for summary. Middle turns will be dropped without summary."
-        )
-        return None
-
-    def _call_summary_model(self, client, model: str, prompt: str) -> str:
-        """Make the actual LLM call to generate a summary. Raises on failure."""
-        kwargs = {
-            "model": model,
-            "messages": [{"role": "user", "content": prompt}],
-            "temperature": 0.3,
-            "timeout": 30.0,
-        }
-        # Most providers (OpenRouter, local models) use max_tokens.
-        # Direct OpenAI with newer models (gpt-4o, o-series, gpt-5+)
-        # requires max_completion_tokens instead.
+        # Use the centralized LLM router — handles provider resolution,
+        # auth, and fallback internally.
         try:
-            kwargs["max_tokens"] = self.summary_target_tokens * 2
-            response = client.chat.completions.create(**kwargs)
-        except Exception as first_err:
-            if "max_tokens" in str(first_err) or "unsupported_parameter" in str(first_err):
-                kwargs.pop("max_tokens", None)
-                kwargs["max_completion_tokens"] = self.summary_target_tokens * 2
-                response = client.chat.completions.create(**kwargs)
-            else:
-                raise
-
-        summary = response.choices[0].message.content.strip()
-        if not summary.startswith("[CONTEXT SUMMARY]:"):
-            summary = "[CONTEXT SUMMARY]: " + summary
-        return summary
-
-    def _get_fallback_client(self):
-        """Try to build a fallback client from the main model's endpoint config.
-
-        When the primary auxiliary client fails (e.g. stale OpenRouter key), this
-        creates a client using the user's active custom endpoint (OPENAI_BASE_URL)
-        so compression can still produce a real summary instead of a static string.
-
-        Returns (client, model) or (None, None).
-        """
-        custom_base = os.getenv("OPENAI_BASE_URL")
-        custom_key = os.getenv("OPENAI_API_KEY")
-        if not custom_base or not custom_key:
-            return None, None
-
-        # Don't fallback to the same provider that just failed
-        from hermes_constants import OPENROUTER_BASE_URL
-
-        if custom_base.rstrip("/") == OPENROUTER_BASE_URL.rstrip("/"):
-            return None, None
-
-        model = os.getenv("LLM_MODEL") or os.getenv("OPENAI_MODEL") or self.model
-        try:
-            from openai import OpenAI as _OpenAI
-
-            client = _OpenAI(api_key=custom_key, base_url=custom_base)
-            logger.debug("Built fallback auxiliary client: %s via %s", model, custom_base)
-            return client, model
-        except Exception as exc:
-            logger.debug("Could not build fallback auxiliary client: %s", exc)
-            return None, None
+            call_kwargs = {
+                "task": "compression",
+                "messages": [{"role": "user", "content": prompt}],
+                "temperature": 0.3,
+                "max_tokens": self.summary_target_tokens * 2,
+                "timeout": 30.0,
+            }
+            if self.summary_model:
+                call_kwargs["model"] = self.summary_model
+            response = call_llm(**call_kwargs)
+            summary = response.choices[0].message.content.strip()
+            if not summary.startswith("[CONTEXT SUMMARY]:"):
+                summary = "[CONTEXT SUMMARY]: " + summary
+            return summary
+        except RuntimeError:
+            logging.warning("Context compression: no provider available for "
+                            "summary. Middle turns will be dropped without summary.")
+            return None
+        except Exception as e:
+            logging.warning("Failed to generate context summary: %s", e)
+            return None
 
     # ------------------------------------------------------------------
     # Tool-call / tool-result pair integrity helpers
@@ -214,7 +155,7 @@ Write only the summary, starting with "[CONTEXT SUMMARY]:" prefix."""
             return tc.get("id", "")
         return getattr(tc, "id", "") or ""
 
-    def _sanitize_tool_pairs(self, messages: list[dict[str, Any]]) -> list[dict[str, Any]]:
+    def _sanitize_tool_pairs(self, messages: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
         """Fix orphaned tool_call / tool_result pairs after compression.
 
         Two failure modes:
@@ -247,7 +188,8 @@ Write only the summary, starting with "[CONTEXT SUMMARY]:" prefix."""
         orphaned_results = result_call_ids - surviving_call_ids
         if orphaned_results:
             messages = [
-                m for m in messages if not (m.get("role") == "tool" and m.get("tool_call_id") in orphaned_results)
+                m for m in messages
+                if not (m.get("role") == "tool" and m.get("tool_call_id") in orphaned_results)
             ]
             if not self.quiet_mode:
                 logger.info("Compression sanitizer: removed %d orphaned tool result(s)", len(orphaned_results))
@@ -255,27 +197,25 @@ Write only the summary, starting with "[CONTEXT SUMMARY]:" prefix."""
         # 2. Add stub results for assistant tool_calls whose results were dropped
         missing_results = surviving_call_ids - result_call_ids
         if missing_results:
-            patched: list[dict[str, Any]] = []
+            patched: List[Dict[str, Any]] = []
             for msg in messages:
                 patched.append(msg)
                 if msg.get("role") == "assistant":
                     for tc in msg.get("tool_calls") or []:
                         cid = self._get_tool_call_id(tc)
                         if cid in missing_results:
-                            patched.append(
-                                {
-                                    "role": "tool",
-                                    "content": "[Result from earlier conversation — see context summary above]",
-                                    "tool_call_id": cid,
-                                }
-                            )
+                            patched.append({
+                                "role": "tool",
+                                "content": "[Result from earlier conversation — see context summary above]",
+                                "tool_call_id": cid,
+                            })
             messages = patched
             if not self.quiet_mode:
                 logger.info("Compression sanitizer: added %d stub tool result(s)", len(missing_results))
 
         return messages
 
-    def _align_boundary_forward(self, messages: list[dict[str, Any]], idx: int) -> int:
+    def _align_boundary_forward(self, messages: List[Dict[str, Any]], idx: int) -> int:
         """Push a compress-start boundary forward past any orphan tool results.
 
         If ``messages[idx]`` is a tool result, slide forward until we hit a
@@ -285,7 +225,7 @@ Write only the summary, starting with "[CONTEXT SUMMARY]:" prefix."""
             idx += 1
         return idx
 
-    def _align_boundary_backward(self, messages: list[dict[str, Any]], idx: int) -> int:
+    def _align_boundary_backward(self, messages: List[Dict[str, Any]], idx: int) -> int:
         """Pull a compress-end boundary backward to avoid splitting a
         tool_call / result group.
 
@@ -303,7 +243,7 @@ Write only the summary, starting with "[CONTEXT SUMMARY]:" prefix."""
             idx -= 1
         return idx
 
-    def compress(self, messages: list[dict[str, Any]], current_tokens: int = None) -> list[dict[str, Any]]:
+    def compress(self, messages: List[Dict[str, Any]], current_tokens: int = None) -> List[Dict[str, Any]]:
         """Compress conversation messages by summarizing middle turns.
 
         Keeps first N + last N turns, summarizes everything in between.
@@ -313,9 +253,7 @@ Write only the summary, starting with "[CONTEXT SUMMARY]:" prefix."""
         n_messages = len(messages)
         if n_messages <= self.protect_first_n + self.protect_last_n + 1:
             if not self.quiet_mode:
-                print(
-                    f"⚠️  Cannot compress: only {n_messages} messages (need > {self.protect_first_n + self.protect_last_n + 1})"
-                )
+                print(f"⚠️  Cannot compress: only {n_messages} messages (need > {self.protect_first_n + self.protect_last_n + 1})")
             return messages
 
         compress_start = self.protect_first_n
@@ -330,20 +268,14 @@ Write only the summary, starting with "[CONTEXT SUMMARY]:" prefix."""
             return messages
 
         turns_to_summarize = messages[compress_start:compress_end]
-        display_tokens = (
-            current_tokens if current_tokens else self.last_prompt_tokens or estimate_messages_tokens_rough(messages)
-        )
+        display_tokens = current_tokens if current_tokens else self.last_prompt_tokens or estimate_messages_tokens_rough(messages)
 
         if not self.quiet_mode:
-            print(
-                f"\n📦 Context compression triggered ({display_tokens:,} tokens ≥ {self.threshold_tokens:,} threshold)"
-            )
-            print(
-                f"   📊 Model context limit: {self.context_length:,} tokens ({self.threshold_percent * 100:.0f}% = {self.threshold_tokens:,})"
-            )
+            print(f"\n📦 Context compression triggered ({display_tokens:,} tokens ≥ {self.threshold_tokens:,} threshold)")
+            print(f"   📊 Model context limit: {self.context_length:,} tokens ({self.threshold_percent*100:.0f}% = {self.threshold_tokens:,})")
 
         if not self.quiet_mode:
-            print(f"   🗜️  Summarizing turns {compress_start + 1}-{compress_end} ({len(turns_to_summarize)} turns)")
+            print(f"   🗜️  Summarizing turns {compress_start+1}-{compress_end} ({len(turns_to_summarize)} turns)")
 
         summary = self._generate_summary(turns_to_summarize)
 
@@ -351,9 +283,7 @@ Write only the summary, starting with "[CONTEXT SUMMARY]:" prefix."""
         for i in range(compress_start):
             msg = messages[i].copy()
             if i == 0 and msg.get("role") == "system" and self.compression_count == 0:
-                msg["content"] = (
-                    msg.get("content") or ""
-                ) + "\n\n[Note: Some earlier conversation turns may be summarized to preserve context space.]"
+                msg["content"] = (msg.get("content") or "") + "\n\n[Note: Some earlier conversation turns may be summarized to preserve context space.]"
             compressed.append(msg)
 
         if summary:

agent/display.py

@@ -5,6 +5,7 @@ Used by AIAgent._execute_tool_calls for CLI feedback.
 """
 
 import json
+import logging
 import os
 import sys
 import threading
@@ -14,36 +15,69 @@ import time
 _RED = "\033[31m"
 _RESET = "\033[0m"
 
+logger = logging.getLogger(__name__)
+
+
+# =========================================================================
+# Skin-aware helpers (lazy import to avoid circular deps)
+# =========================================================================
+
+def _get_skin():
+    """Get the active skin config, or None if not available."""
+    try:
+        from hermes_cli.skin_engine import get_active_skin
+        return get_active_skin()
+    except Exception:
+        return None
+
+
+def get_skin_faces(key: str, default: list) -> list:
+    """Get spinner face list from active skin, falling back to default."""
+    skin = _get_skin()
+    if skin:
+        faces = skin.get_spinner_list(key)
+        if faces:
+            return faces
+    return default
+
+
+def get_skin_verbs() -> list:
+    """Get thinking verbs from active skin."""
+    skin = _get_skin()
+    if skin:
+        verbs = skin.get_spinner_list("thinking_verbs")
+        if verbs:
+            return verbs
+    return KawaiiSpinner.THINKING_VERBS
+
+
+def get_skin_tool_prefix() -> str:
+    """Get tool output prefix character from active skin."""
+    skin = _get_skin()
+    if skin:
+        return skin.tool_prefix
+    return "┊"
+
 
 # =========================================================================
 # Tool preview (one-line summary of a tool call's primary argument)
 # =========================================================================
 
-
 def build_tool_preview(tool_name: str, args: dict, max_len: int = 40) -> str:
     """Build a short preview of a tool call's primary argument for display."""
+    if not args:
+        return None
     primary_args = {
-        "terminal": "command",
-        "web_search": "query",
-        "web_extract": "urls",
-        "read_file": "path",
-        "write_file": "path",
-        "patch": "path",
-        "search_files": "pattern",
-        "browser_navigate": "url",
-        "browser_click": "ref",
-        "browser_type": "text",
-        "image_generate": "prompt",
-        "text_to_speech": "text",
-        "vision_analyze": "question",
-        "mixture_of_agents": "user_prompt",
-        "skill_view": "name",
-        "skills_list": "category",
+        "terminal": "command", "web_search": "query", "web_extract": "urls",
+        "read_file": "path", "write_file": "path", "patch": "path",
+        "search_files": "pattern", "browser_navigate": "url",
+        "browser_click": "ref", "browser_type": "text",
+        "image_generate": "prompt", "text_to_speech": "text",
+        "vision_analyze": "question", "mixture_of_agents": "user_prompt",
+        "skill_view": "name", "skills_list": "category",
         "schedule_cronjob": "name",
-        "execute_code": "code",
-        "delegate_task": "goal",
-        "clarify": "question",
-        "skill_manage": "name",
+        "execute_code": "code", "delegate_task": "goal",
+        "clarify": "question", "skill_manage": "name",
     }
 
     if tool_name == "process":
@@ -72,18 +106,18 @@ def build_tool_preview(tool_name: str, args: dict, max_len: int = 40) -> str:
 
     if tool_name == "session_search":
         query = args.get("query", "")
-        return f'recall: "{query[:25]}{"..." if len(query) > 25 else ""}"'
+        return f"recall: \"{query[:25]}{'...' if len(query) > 25 else ''}\""
 
     if tool_name == "memory":
         action = args.get("action", "")
         target = args.get("target", "")
         if action == "add":
             content = args.get("content", "")
-            return f'+{target}: "{content[:25]}{"..." if len(content) > 25 else ""}"'
+            return f"+{target}: \"{content[:25]}{'...' if len(content) > 25 else ''}\""
         elif action == "replace":
-            return f'~{target}: "{args.get("old_text", "")[:20]}"'
+            return f"~{target}: \"{args.get('old_text', '')[:20]}\""
         elif action == "remove":
-            return f'-{target}: "{args.get("old_text", "")[:20]}"'
+            return f"-{target}: \"{args.get('old_text', '')[:20]}\""
         return action
 
     if tool_name == "send_message":
@@ -91,7 +125,7 @@ def build_tool_preview(tool_name: str, args: dict, max_len: int = 40) -> str:
         msg = args.get("message", "")
         if len(msg) > 20:
             msg = msg[:17] + "..."
-        return f'to {target}: "{msg}"'
+        return f"to {target}: \"{msg}\""
 
     if tool_name.startswith("rl_"):
         rl_previews = {
@@ -126,7 +160,7 @@ def build_tool_preview(tool_name: str, args: dict, max_len: int = 40) -> str:
     if not preview:
         return None
     if len(preview) > max_len:
-        preview = preview[: max_len - 3] + "..."
+        preview = preview[:max_len - 3] + "..."
     return preview
 
 
@@ -134,84 +168,52 @@ def build_tool_preview(tool_name: str, args: dict, max_len: int = 40) -> str:
 # KawaiiSpinner
 # =========================================================================
 
-
 class KawaiiSpinner:
     """Animated spinner with kawaii faces for CLI feedback during tool execution."""
 
     SPINNERS = {
-        "dots": ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"],
-        "bounce": ["⠁", "⠂", "⠄", "⡀", "⢀", "⠠", "⠐", "⠈"],
-        "grow": ["▁", "▂", "▃", "▄", "▅", "▆", "▇", "█", "▇", "▆", "▅", "▄", "▃", "▂"],
-        "arrows": ["←", "↖", "↑", "↗", "→", "↘", "↓", "↙"],
-        "star": ["✶", "✷", "✸", "✹", "✺", "✹", "✸", "✷"],
-        "moon": ["🌑", "🌒", "🌓", "🌔", "🌕", "🌖", "🌗", "🌘"],
-        "pulse": ["◜", "◠", "◝", "◞", "◡", "◟"],
-        "brain": ["🧠", "💭", "💡", "✨", "💫", "🌟", "💡", "💭"],
-        "sparkle": ["⁺", "˚", "*", "✧", "✦", "✧", "*", "˚"],
+        'dots': ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'],
+        'bounce': ['⠁', '⠂', '⠄', '⡀', '⢀', '⠠', '⠐', '⠈'],
+        'grow': ['▁', '▂', '▃', '▄', '▅', '▆', '▇', '█', '▇', '▆', '▅', '▄', '▃', '▂'],
+        'arrows': ['←', '↖', '↑', '↗', '→', '↘', '↓', '↙'],
+        'star': ['✶', '✷', '✸', '✹', '✺', '✹', '✸', '✷'],
+        'moon': ['🌑', '🌒', '🌓', '🌔', '🌕', '🌖', '🌗', '🌘'],
+        'pulse': ['◜', '◠', '◝', '◞', '◡', '◟'],
+        'brain': ['🧠', '💭', '💡', '✨', '💫', '🌟', '💡', '💭'],
+        'sparkle': ['⁺', '˚', '*', '✧', '✦', '✧', '*', '˚'],
     }
 
     KAWAII_WAITING = [
-        "(｡◕‿◕｡)",
-        "(◕‿◕✿)",
-        "٩(◕‿◕｡)۶",
-        "(✿◠‿◠)",
-        "( ˘▽˘)っ",
-        "♪(´ε` )",
-        "(◕ᴗ◕✿)",
-        "ヾ(＾∇＾)",
-        "(≧◡≦)",
-        "(★ω★)",
+        "(｡◕‿◕｡)", "(◕‿◕✿)", "٩(◕‿◕｡)۶", "(✿◠‿◠)", "( ˘▽˘)っ",
+        "♪(´ε` )", "(◕ᴗ◕✿)", "ヾ(＾∇＾)", "(≧◡≦)", "(★ω★)",
     ]
 
     KAWAII_THINKING = [
-        "(｡•́︿•̀｡)",
-        "(◔_◔)",
-        "(¬‿¬)",
-        "( •_•)>⌐■-■",
-        "(⌐■_■)",
-        "(´･_･`)",
-        "◉_◉",
-        "(°ロ°)",
-        "( ˘⌣˘)♡",
-        "ヽ(>∀<☆)☆",
-        "٩(๑❛ᴗ❛๑)۶",
-        "(⊙_⊙)",
-        "(¬_¬)",
-        "( ͡° ͜ʖ ͡°)",
-        "ಠ_ಠ",
+        "(｡•́︿•̀｡)", "(◔_◔)", "(¬‿¬)", "( •_•)>⌐■-■", "(⌐■_■)",
+        "(´･_･`)", "◉_◉", "(°ロ°)", "( ˘⌣˘)♡", "ヽ(>∀<☆)☆",
+        "٩(๑❛ᴗ❛๑)۶", "(⊙_⊙)", "(¬_¬)", "( ͡° ͜ʖ ͡°)", "ಠ_ಠ",
     ]
 
     THINKING_VERBS = [
-        "pondering",
-        "contemplating",
-        "musing",
-        "cogitating",
-        "ruminating",
-        "deliberating",
-        "mulling",
-        "reflecting",
-        "processing",
-        "reasoning",
-        "analyzing",
-        "computing",
-        "synthesizing",
-        "formulating",
-        "brainstorming",
+        "pondering", "contemplating", "musing", "cogitating", "ruminating",
+        "deliberating", "mulling", "reflecting", "processing", "reasoning",
+        "analyzing", "computing", "synthesizing", "formulating", "brainstorming",
     ]
 
-    def __init__(self, message: str = "", spinner_type: str = "dots"):
+    def __init__(self, message: str = "", spinner_type: str = 'dots'):
         self.message = message
-        self.spinner_frames = self.SPINNERS.get(spinner_type, self.SPINNERS["dots"])
+        self.spinner_frames = self.SPINNERS.get(spinner_type, self.SPINNERS['dots'])
         self.running = False
         self.thread = None
         self.frame_idx = 0
         self.start_time = None
         self.last_line_len = 0
+        self._last_flush_time = 0.0  # Rate-limit flushes for patch_stdout compat
         # Capture stdout NOW, before any redirect_stdout(devnull) from
         # child agents can replace sys.stdout with a black hole.
         self._out = sys.stdout
 
-    def _write(self, text: str, end: str = "\n", flush: bool = False):
+    def _write(self, text: str, end: str = '\n', flush: bool = False):
         """Write to the stdout captured at spinner creation time."""
         try:
             self._out.write(text + end)
@@ -221,15 +223,34 @@ class KawaiiSpinner:
             pass
 
     def _animate(self):
+        # Cache skin wings at start (avoid per-frame imports)
+        skin = _get_skin()
+        wings = skin.get_spinner_wings() if skin else []
+
         while self.running:
             if os.getenv("HERMES_SPINNER_PAUSE"):
                 time.sleep(0.1)
                 continue
             frame = self.spinner_frames[self.frame_idx % len(self.spinner_frames)]
             elapsed = time.time() - self.start_time
-            line = f"  {frame} {self.message} ({elapsed:.1f}s)"
+            if wings:
+                left, right = wings[self.frame_idx % len(wings)]
+                line = f"  {left} {frame} {self.message} {right} ({elapsed:.1f}s)"
+            else:
+                line = f"  {frame} {self.message} ({elapsed:.1f}s)"
             pad = max(self.last_line_len - len(line), 0)
-            self._write(f"\r{line}{' ' * pad}", end="", flush=True)
+            # Rate-limit flush() calls to avoid spinner spam under
+            # prompt_toolkit's patch_stdout.  Each flush() pushes a queue
+            # item that may trigger a separate run_in_terminal() call; if
+            # items are processed one-at-a-time the \r overwrite is lost
+            # and every frame appears on its own line.  By flushing at
+            # most every 0.4s we guarantee multiple \r-frames are batched
+            # into a single write, so the terminal collapses them correctly.
+            now = time.time()
+            should_flush = (now - self._last_flush_time) >= 0.4
+            self._write(f"\r{line}{' ' * pad}", end='', flush=should_flush)
+            if should_flush:
+                self._last_flush_time = now
             self.last_line_len = len(line)
             self.frame_idx += 1
             time.sleep(0.12)
@@ -260,7 +281,7 @@ class KawaiiSpinner:
         # Clear spinner line with spaces (not \033[K) to avoid garbled escape
         # codes when prompt_toolkit's patch_stdout is active — same approach
         # as stop(). Then print text; spinner redraws on next tick.
-        blanks = " " * max(self.last_line_len + 5, 40)
+        blanks = ' ' * max(self.last_line_len + 5, 40)
         self._write(f"\r{blanks}\r  {text}", flush=True)
 
     def stop(self, final_message: str = None):
@@ -269,8 +290,8 @@ class KawaiiSpinner:
             self.thread.join(timeout=0.5)
         # Clear the spinner line with spaces instead of \033[K to avoid
         # garbled escape codes when prompt_toolkit's patch_stdout is active.
-        blanks = " " * max(self.last_line_len + 5, 40)
-        self._write(f"\r{blanks}\r", end="", flush=True)
+        blanks = ' ' * max(self.last_line_len + 5, 40)
+        self._write(f"\r{blanks}\r", end='', flush=True)
         if final_message:
             self._write(f"  {final_message}", flush=True)
 
@@ -288,110 +309,38 @@ class KawaiiSpinner:
 # =========================================================================
 
 KAWAII_SEARCH = [
-    "♪(´ε` )",
-    "(｡◕‿◕｡)",
-    "ヾ(＾∇＾)",
-    "(◕ᴗ◕✿)",
-    "( ˘▽˘)っ",
-    "٩(◕‿◕｡)۶",
-    "(✿◠‿◠)",
-    "♪～(´ε｀ )",
-    "(ノ´ヮ`)ノ*:・゚✧",
-    "＼(◎o◎)／",
+    "♪(´ε` )", "(｡◕‿◕｡)", "ヾ(＾∇＾)", "(◕ᴗ◕✿)", "( ˘▽˘)っ",
+    "٩(◕‿◕｡)۶", "(✿◠‿◠)", "♪～(´ε｀ )", "(ノ´ヮ`)ノ*:・゚✧", "＼(◎o◎)／",
 ]
 KAWAII_READ = [
-    "φ(゜▽゜*)♪",
-    "( ˘▽˘)っ",
-    "(⌐■_■)",
-    "٩(｡•́‿•̀｡)۶",
-    "(◕‿◕✿)",
-    "ヾ(＠⌒ー⌒＠)ノ",
-    "(✧ω✧)",
-    "♪(๑ᴖ◡ᴖ๑)♪",
-    "(≧◡≦)",
-    "( ´ ▽ ` )ノ",
+    "φ(゜▽゜*)♪", "( ˘▽˘)っ", "(⌐■_■)", "٩(｡•́‿•̀｡)۶", "(◕‿◕✿)",
+    "ヾ(＠⌒ー⌒＠)ノ", "(✧ω✧)", "♪(๑ᴖ◡ᴖ๑)♪", "(≧◡≦)", "( ´ ▽ ` )ノ",
 ]
 KAWAII_TERMINAL = [
-    "ヽ(>∀<☆)ノ",
-    "(ノ°∀°)ノ",
-    "٩(^ᴗ^)۶",
-    "ヾ(⌐■_■)ノ♪",
-    "(•̀ᴗ•́)و",
-    "┗(＾0＾)┓",
-    "(｀・ω・´)",
-    "＼(￣▽￣)／",
-    "(ง •̀_•́)ง",
-    "ヽ(´▽`)/",
+    "ヽ(>∀<☆)ノ", "(ノ°∀°)ノ", "٩(^ᴗ^)۶", "ヾ(⌐■_■)ノ♪", "(•̀ᴗ•́)و",
+    "┗(＾0＾)┓", "(｀・ω・´)", "＼(￣▽￣)／", "(ง •̀_•́)ง", "ヽ(´▽`)/",
 ]
 KAWAII_BROWSER = [
-    "(ノ°∀°)ノ",
-    "(☞゚ヮ゚)☞",
-    "( ͡° ͜ʖ ͡°)",
-    "┌( ಠ_ಠ)┘",
-    "(⊙_⊙)？",
-    "ヾ(•ω•`)o",
-    "(￣ω￣)",
-    "( ˇωˇ )",
-    "(ᵔᴥᵔ)",
-    "＼(◎o◎)／",
+    "(ノ°∀°)ノ", "(☞゚ヮ゚)☞", "( ͡° ͜ʖ ͡°)", "┌( ಠ_ಠ)┘", "(⊙_⊙)？",
+    "ヾ(•ω•`)o", "(￣ω￣)", "( ˇωˇ )", "(ᵔᴥᵔ)", "＼(◎o◎)／",
 ]
 KAWAII_CREATE = [
-    "✧*。٩(ˊᗜˋ*)و✧",
-    "(ﾉ◕ヮ◕)ﾉ*:・ﾟ✧",
-    "ヽ(>∀<☆)ノ",
-    "٩(♡ε♡)۶",
-    "(◕‿◕)♡",
-    "✿◕ ‿ ◕✿",
-    "(*≧▽≦)",
-    "ヾ(＾-＾)ノ",
-    "(☆▽☆)",
-    "°˖✧◝(⁰▿⁰)◜✧˖°",
+    "✧*。٩(ˊᗜˋ*)و✧", "(ﾉ◕ヮ◕)ﾉ*:・ﾟ✧", "ヽ(>∀<☆)ノ", "٩(♡ε♡)۶", "(◕‿◕)♡",
+    "✿◕ ‿ ◕✿", "(*≧▽≦)", "ヾ(＾-＾)ノ", "(☆▽☆)", "°˖✧◝(⁰▿⁰)◜✧˖°",
 ]
 KAWAII_SKILL = [
-    "ヾ(＠⌒ー⌒＠)ノ",
-    "(๑˃ᴗ˂)ﻭ",
-    "٩(◕‿◕｡)۶",
-    "(✿╹◡╹)",
-    "ヽ(・∀・)ノ",
-    "(ノ´ヮ`)ノ*:・ﾟ✧",
-    "♪(๑ᴖ◡ᴖ๑)♪",
-    "(◠‿◠)",
-    "٩(ˊᗜˋ*)و",
-    "(＾▽＾)",
-    "ヾ(＾∇＾)",
-    "(★ω★)/",
-    "٩(｡•́‿•̀｡)۶",
-    "(◕ᴗ◕✿)",
-    "＼(◎o◎)／",
-    "(✧ω✧)",
-    "ヽ(>∀<☆)ノ",
-    "( ˘▽˘)っ",
-    "(≧◡≦) ♡",
-    "ヾ(￣▽￣)",
+    "ヾ(＠⌒ー⌒＠)ノ", "(๑˃ᴗ˂)ﻭ", "٩(◕‿◕｡)۶", "(✿╹◡╹)", "ヽ(・∀・)ノ",
+    "(ノ´ヮ`)ノ*:・ﾟ✧", "♪(๑ᴖ◡ᴖ๑)♪", "(◠‿◠)", "٩(ˊᗜˋ*)و", "(＾▽＾)",
+    "ヾ(＾∇＾)", "(★ω★)/", "٩(｡•́‿•̀｡)۶", "(◕ᴗ◕✿)", "＼(◎o◎)／",
+    "(✧ω✧)", "ヽ(>∀<☆)ノ", "( ˘▽˘)っ", "(≧◡≦) ♡", "ヾ(￣▽￣)",
 ]
 KAWAII_THINK = [
-    "(っ°Д°;)っ",
-    "(；′⌒`)",
-    "(・_・ヾ",
-    "( ´_ゝ`)",
-    "(￣ヘ￣)",
-    "(。-`ω´-)",
-    "( ˘︹˘ )",
-    "(¬_¬)",
-    "ヽ(ー_ー )ノ",
-    "(；一_一)",
+    "(っ°Д°;)っ", "(；′⌒`)", "(・_・ヾ", "( ´_ゝ`)", "(￣ヘ￣)",
+    "(。-`ω´-)", "( ˘︹˘ )", "(¬_¬)", "ヽ(ー_ー )ノ", "(；一_一)",
 ]
 KAWAII_GENERIC = [
-    "♪(´ε` )",
-    "(◕‿◕✿)",
-    "ヾ(＾∇＾)",
-    "٩(◕‿◕｡)۶",
-    "(✿◠‿◠)",
-    "(ノ´ヮ`)ノ*:・ﾟ✧",
-    "ヽ(>∀<☆)ノ",
-    "(☆▽☆)",
-    "( ˘▽˘)っ",
-    "(≧◡≦)",
+    "♪(´ε` )", "(◕‿◕✿)", "ヾ(＾∇＾)", "٩(◕‿◕｡)۶", "(✿◠‿◠)",
+    "(ノ´ヮ`)ノ*:・ﾟ✧", "ヽ(>∀<☆)ノ", "(☆▽☆)", "( ˘▽˘)っ", "(≧◡≦)",
 ]
 
 
@@ -399,7 +348,6 @@ KAWAII_GENERIC = [
 # Cute tool message (completion line that replaces the spinner)
 # =========================================================================
 
-
 def _detect_tool_failure(tool_name: str, result: str | None) -> tuple[bool, str]:
     """Inspect a tool result string for signs of failure.
 
@@ -417,7 +365,7 @@ def _detect_tool_failure(tool_name: str, result: str | None) -> tuple[bool, str]
             if exit_code is not None and exit_code != 0:
                 return True, f" [exit {exit_code}]"
         except (json.JSONDecodeError, TypeError, AttributeError):
-            pass
+            logger.debug("Could not parse terminal result as JSON for exit code check")
         return False, ""
 
     # Memory-specific: distinguish "full" from real errors
@@ -427,7 +375,7 @@ def _detect_tool_failure(tool_name: str, result: str | None) -> tuple[bool, str]
             if data.get("success") is False and "exceed the limit" in data.get("error", ""):
                 return True, " [full]"
         except (json.JSONDecodeError, TypeError, AttributeError):
-            pass
+            logger.debug("Could not parse memory result as JSON for capacity check")
 
     # Generic heuristic for non-terminal tools
     lower = result[:500].lower()
@@ -438,10 +386,7 @@ def _detect_tool_failure(tool_name: str, result: str | None) -> tuple[bool, str]
 
 
 def get_cute_tool_message(
-    tool_name: str,
-    args: dict,
-    duration: float,
-    result: str | None = None,
+    tool_name: str, args: dict, duration: float, result: str | None = None,
 ) -> str:
     """Generate a formatted tool completion line for CLI quiet mode.
 
@@ -452,17 +397,20 @@ def get_cute_tool_message(
     """
     dur = f"{duration:.1f}s"
     is_failure, failure_suffix = _detect_tool_failure(tool_name, result)
+    skin_prefix = get_skin_tool_prefix()
 
     def _trunc(s, n=40):
         s = str(s)
-        return (s[: n - 3] + "...") if len(s) > n else s
+        return (s[:n-3] + "...") if len(s) > n else s
 
     def _path(p, n=35):
         p = str(p)
-        return ("..." + p[-(n - 3) :]) if len(p) > n else p
+        return ("..." + p[-(n-3):]) if len(p) > n else p
 
     def _wrap(line: str) -> str:
-        """Append failure suffix when the tool failed."""
+        """Apply skin tool prefix and failure suffix."""
+        if skin_prefix != "┊":
+            line = line.replace("┊", skin_prefix, 1)
         if not is_failure:
             return line
         return f"{line}{failure_suffix}"
@@ -474,7 +422,7 @@ def get_cute_tool_message(
         if urls:
             url = urls[0] if isinstance(urls, list) else str(urls)
             domain = url.replace("https://", "").replace("http://", "").split("/")[0]
-            extra = f" +{len(urls) - 1}" if len(urls) > 1 else ""
+            extra = f" +{len(urls)-1}" if len(urls) > 1 else ""
             return _wrap(f"┊ 📄 fetch     {_trunc(domain, 35)}{extra}  {dur}")
         return _wrap(f"┊ 📄 fetch     pages  {dur}")
     if tool_name == "web_crawl":
@@ -486,15 +434,8 @@ def get_cute_tool_message(
     if tool_name == "process":
         action = args.get("action", "?")
         sid = args.get("session_id", "")[:12]
-        labels = {
-            "list": "ls processes",
-            "poll": f"poll {sid}",
-            "log": f"log {sid}",
-            "wait": f"wait {sid}",
-            "kill": f"kill {sid}",
-            "write": f"write {sid}",
-            "submit": f"submit {sid}",
-        }
+        labels = {"list": "ls processes", "poll": f"poll {sid}", "log": f"log {sid}",
+                  "wait": f"wait {sid}", "kill": f"kill {sid}", "write": f"write {sid}", "submit": f"submit {sid}"}
         return _wrap(f"┊ ⚙️  proc      {labels.get(action, f'{action} {sid}')}  {dur}")
     if tool_name == "read_file":
         return _wrap(f"┊ 📖 read      {_path(args.get('path', ''))}  {dur}")
@@ -517,7 +458,7 @@ def get_cute_tool_message(
     if tool_name == "browser_click":
         return _wrap(f"┊ 👆 click     {args.get('ref', '?')}  {dur}")
     if tool_name == "browser_type":
-        return _wrap(f'┊ ⌨️  type      "{_trunc(args.get("text", ""), 30)}"  {dur}')
+        return _wrap(f"┊ ⌨️  type      \"{_trunc(args.get('text', ''), 30)}\"  {dur}")
     if tool_name == "browser_scroll":
         d = args.get("direction", "down")
         arrow = {"down": "↓", "up": "↑", "right": "→", "left": "←"}.get(d, "↓")
@@ -542,16 +483,16 @@ def get_cute_tool_message(
         else:
             return _wrap(f"┊ 📋 plan      {len(todos_arg)} task(s)  {dur}")
     if tool_name == "session_search":
-        return _wrap(f'┊ 🔍 recall    "{_trunc(args.get("query", ""), 35)}"  {dur}')
+        return _wrap(f"┊ 🔍 recall    \"{_trunc(args.get('query', ''), 35)}\"  {dur}")
     if tool_name == "memory":
         action = args.get("action", "?")
         target = args.get("target", "")
         if action == "add":
-            return _wrap(f'┊ 🧠 memory    +{target}: "{_trunc(args.get("content", ""), 30)}"  {dur}')
+            return _wrap(f"┊ 🧠 memory    +{target}: \"{_trunc(args.get('content', ''), 30)}\"  {dur}")
         elif action == "replace":
-            return _wrap(f'┊ 🧠 memory    ~{target}: "{_trunc(args.get("old_text", ""), 20)}"  {dur}')
+            return _wrap(f"┊ 🧠 memory    ~{target}: \"{_trunc(args.get('old_text', ''), 20)}\"  {dur}")
         elif action == "remove":
-            return _wrap(f'┊ 🧠 memory    -{target}: "{_trunc(args.get("old_text", ""), 20)}"  {dur}')
+            return _wrap(f"┊ 🧠 memory    -{target}: \"{_trunc(args.get('old_text', ''), 20)}\"  {dur}")
         return _wrap(f"┊ 🧠 memory    {action}  {dur}")
     if tool_name == "skills_list":
         return _wrap(f"┊ 📚 skills    list {args.get('category', 'all')}  {dur}")
@@ -566,7 +507,7 @@ def get_cute_tool_message(
     if tool_name == "mixture_of_agents":
         return _wrap(f"┊ 🧠 reason    {_trunc(args.get('user_prompt', ''), 30)}  {dur}")
     if tool_name == "send_message":
-        return _wrap(f'┊ 📨 send      {args.get("target", "?")}: "{_trunc(args.get("message", ""), 25)}"  {dur}')
+        return _wrap(f"┊ 📨 send      {args.get('target', '?')}: \"{_trunc(args.get('message', ''), 25)}\"  {dur}")
     if tool_name == "schedule_cronjob":
         return _wrap(f"┊ ⏰ schedule  {_trunc(args.get('name', args.get('prompt', 'task')), 30)}  {dur}")
     if tool_name == "list_cronjobs":
@@ -575,16 +516,11 @@ def get_cute_tool_message(
         return _wrap(f"┊ ⏰ remove    job {args.get('job_id', '?')}  {dur}")
     if tool_name.startswith("rl_"):
         rl = {
-            "rl_list_environments": "list envs",
-            "rl_select_environment": f"select {args.get('name', '')}",
-            "rl_get_current_config": "get config",
-            "rl_edit_config": f"set {args.get('field', '?')}",
-            "rl_start_training": "start training",
-            "rl_check_status": f"status {args.get('run_id', '?')[:12]}",
-            "rl_stop_training": f"stop {args.get('run_id', '?')[:12]}",
-            "rl_get_results": f"results {args.get('run_id', '?')[:12]}",
-            "rl_list_runs": "list runs",
-            "rl_test_inference": "test inference",
+            "rl_list_environments": "list envs", "rl_select_environment": f"select {args.get('name', '')}",
+            "rl_get_current_config": "get config", "rl_edit_config": f"set {args.get('field', '?')}",
+            "rl_start_training": "start training", "rl_check_status": f"status {args.get('run_id', '?')[:12]}",
+            "rl_stop_training": f"stop {args.get('run_id', '?')[:12]}", "rl_get_results": f"results {args.get('run_id', '?')[:12]}",
+            "rl_list_runs": "list runs", "rl_test_inference": "test inference",
         }
         return _wrap(f"┊ 🧪 rl        {rl.get(tool_name, tool_name.replace('rl_', ''))}  {dur}")
     if tool_name == "execute_code":

agent/insights.py

@@ -20,7 +20,7 @@ import json
 import time
 from collections import Counter, defaultdict
 from datetime import datetime
-from typing import Any
+from typing import Any, Dict, List, Optional
 
 # =========================================================================
 # Model pricing (USD per million tokens) — approximate as of early 2026
@@ -81,7 +81,7 @@ def _has_known_pricing(model_name: str) -> bool:
     return _get_pricing(model_name) is not _DEFAULT_PRICING
 
 
-def _get_pricing(model_name: str) -> dict[str, float]:
+def _get_pricing(model_name: str) -> Dict[str, float]:
     """Look up pricing for a model. Uses fuzzy matching on model name.
 
     Returns _DEFAULT_PRICING (zero cost) for unknown/custom models —
@@ -150,7 +150,7 @@ def _format_duration(seconds: float) -> str:
     return f"{days:.1f}d"
 
 
-def _bar_chart(values: list[int], max_width: int = 20) -> list[str]:
+def _bar_chart(values: List[int], max_width: int = 20) -> List[str]:
     """Create simple horizontal bar chart strings from values."""
     peak = max(values) if values else 1
     if peak == 0:
@@ -176,7 +176,7 @@ class InsightsEngine:
         self.db = db
         self._conn = db._conn
 
-    def generate(self, days: int = 30, source: str = None) -> dict[str, Any]:
+    def generate(self, days: int = 30, source: str = None) -> Dict[str, Any]:
         """
         Generate a complete insights report.
 
@@ -233,11 +233,10 @@ class InsightsEngine:
     # =========================================================================
 
     # Columns we actually need (skip system_prompt, model_config blobs)
-    _SESSION_COLS = (
-        "id, source, model, started_at, ended_at, message_count, tool_call_count, input_tokens, output_tokens"
-    )
+    _SESSION_COLS = ("id, source, model, started_at, ended_at, "
+                     "message_count, tool_call_count, input_tokens, output_tokens")
 
-    def _get_sessions(self, cutoff: float, source: str = None) -> list[dict]:
+    def _get_sessions(self, cutoff: float, source: str = None) -> List[Dict]:
         """Fetch sessions within the time window."""
         if source:
             cursor = self._conn.execute(
@@ -255,7 +254,7 @@ class InsightsEngine:
             )
         return [dict(row) for row in cursor.fetchall()]
 
-    def _get_tool_usage(self, cutoff: float, source: str = None) -> list[dict]:
+    def _get_tool_usage(self, cutoff: float, source: str = None) -> List[Dict]:
         """Get tool call counts from messages.
 
         Uses two sources:
@@ -342,9 +341,12 @@ class InsightsEngine:
             tool_counts = merged
 
         # Convert to the expected format
-        return [{"tool_name": name, "count": count} for name, count in tool_counts.most_common()]
+        return [
+            {"tool_name": name, "count": count}
+            for name, count in tool_counts.most_common()
+        ]
 
-    def _get_message_stats(self, cutoff: float, source: str = None) -> dict:
+    def _get_message_stats(self, cutoff: float, source: str = None) -> Dict:
         """Get aggregate message statistics."""
         if source:
             cursor = self._conn.execute(
@@ -371,22 +373,16 @@ class InsightsEngine:
                 (cutoff,),
             )
         row = cursor.fetchone()
-        return (
-            dict(row)
-            if row
-            else {
-                "total_messages": 0,
-                "user_messages": 0,
-                "assistant_messages": 0,
-                "tool_messages": 0,
-            }
-        )
+        return dict(row) if row else {
+            "total_messages": 0, "user_messages": 0,
+            "assistant_messages": 0, "tool_messages": 0,
+        }
 
     # =========================================================================
     # Computation
     # =========================================================================
 
-    def _compute_overview(self, sessions: list[dict], message_stats: dict) -> dict:
+    def _compute_overview(self, sessions: List[Dict], message_stats: Dict) -> Dict:
         """Compute high-level overview statistics."""
         total_input = sum(s.get("input_tokens") or 0 for s in sessions)
         total_output = sum(s.get("output_tokens") or 0 for s in sessions)
@@ -446,18 +442,12 @@ class InsightsEngine:
             "models_without_pricing": sorted(models_without_pricing),
         }
 
-    def _compute_model_breakdown(self, sessions: list[dict]) -> list[dict]:
+    def _compute_model_breakdown(self, sessions: List[Dict]) -> List[Dict]:
         """Break down usage by model."""
-        model_data = defaultdict(
-            lambda: {
-                "sessions": 0,
-                "input_tokens": 0,
-                "output_tokens": 0,
-                "total_tokens": 0,
-                "tool_calls": 0,
-                "cost": 0.0,
-            }
-        )
+        model_data = defaultdict(lambda: {
+            "sessions": 0, "input_tokens": 0, "output_tokens": 0,
+            "total_tokens": 0, "tool_calls": 0, "cost": 0.0,
+        })
 
         for s in sessions:
             model = s.get("model") or "unknown"
@@ -474,23 +464,20 @@ class InsightsEngine:
             d["cost"] += _estimate_cost(model, inp, out)
             d["has_pricing"] = _has_known_pricing(model)
 
-        result = [{"model": model, **data} for model, data in model_data.items()]
+        result = [
+            {"model": model, **data}
+            for model, data in model_data.items()
+        ]
         # Sort by tokens first, fall back to session count when tokens are 0
         result.sort(key=lambda x: (x["total_tokens"], x["sessions"]), reverse=True)
         return result
 
-    def _compute_platform_breakdown(self, sessions: list[dict]) -> list[dict]:
+    def _compute_platform_breakdown(self, sessions: List[Dict]) -> List[Dict]:
         """Break down usage by platform/source."""
-        platform_data = defaultdict(
-            lambda: {
-                "sessions": 0,
-                "messages": 0,
-                "input_tokens": 0,
-                "output_tokens": 0,
-                "total_tokens": 0,
-                "tool_calls": 0,
-            }
-        )
+        platform_data = defaultdict(lambda: {
+            "sessions": 0, "messages": 0, "input_tokens": 0,
+            "output_tokens": 0, "total_tokens": 0, "tool_calls": 0,
+        })
 
         for s in sessions:
             source = s.get("source") or "unknown"
@@ -504,26 +491,27 @@ class InsightsEngine:
             d["total_tokens"] += inp + out
             d["tool_calls"] += s.get("tool_call_count") or 0
 
-        result = [{"platform": platform, **data} for platform, data in platform_data.items()]
+        result = [
+            {"platform": platform, **data}
+            for platform, data in platform_data.items()
+        ]
         result.sort(key=lambda x: x["sessions"], reverse=True)
         return result
 
-    def _compute_tool_breakdown(self, tool_usage: list[dict]) -> list[dict]:
+    def _compute_tool_breakdown(self, tool_usage: List[Dict]) -> List[Dict]:
         """Process tool usage data into a ranked list with percentages."""
         total_calls = sum(t["count"] for t in tool_usage) if tool_usage else 0
         result = []
         for t in tool_usage:
             pct = (t["count"] / total_calls * 100) if total_calls else 0
-            result.append(
-                {
-                    "tool": t["tool_name"],
-                    "count": t["count"],
-                    "percentage": pct,
-                }
-            )
+            result.append({
+                "tool": t["tool_name"],
+                "count": t["count"],
+                "percentage": pct,
+            })
         return result
 
-    def _compute_activity_patterns(self, sessions: list[dict]) -> dict:
+    def _compute_activity_patterns(self, sessions: List[Dict]) -> Dict:
         """Analyze activity patterns by day of week and hour."""
         day_counts = Counter()  # 0=Monday ... 6=Sunday
         hour_counts = Counter()
@@ -539,9 +527,15 @@ class InsightsEngine:
             daily_counts[dt.strftime("%Y-%m-%d")] += 1
 
         day_names = ["Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun"]
-        day_breakdown = [{"day": day_names[i], "count": day_counts.get(i, 0)} for i in range(7)]
+        day_breakdown = [
+            {"day": day_names[i], "count": day_counts.get(i, 0)}
+            for i in range(7)
+        ]
 
-        hour_breakdown = [{"hour": i, "count": hour_counts.get(i, 0)} for i in range(24)]
+        hour_breakdown = [
+            {"hour": i, "count": hour_counts.get(i, 0)}
+            for i in range(24)
+        ]
 
         # Busiest day and hour
         busiest_day = max(day_breakdown, key=lambda x: x["count"]) if day_breakdown else None
@@ -575,40 +569,37 @@ class InsightsEngine:
             "max_streak": max_streak,
         }
 
-    def _compute_top_sessions(self, sessions: list[dict]) -> list[dict]:
+    def _compute_top_sessions(self, sessions: List[Dict]) -> List[Dict]:
         """Find notable sessions (longest, most messages, most tokens)."""
         top = []
 
         # Longest by duration
-        sessions_with_duration = [s for s in sessions if s.get("started_at") and s.get("ended_at")]
+        sessions_with_duration = [
+            s for s in sessions
+            if s.get("started_at") and s.get("ended_at")
+        ]
         if sessions_with_duration:
             longest = max(
                 sessions_with_duration,
-                key=lambda s: s["ended_at"] - s["started_at"],
+                key=lambda s: (s["ended_at"] - s["started_at"]),
             )
             dur = longest["ended_at"] - longest["started_at"]
-            top.append(
-                {
-                    "label": "Longest session",
-                    "session_id": longest["id"][:16],
-                    "value": _format_duration(dur),
-                    "date": datetime.fromtimestamp(longest["started_at"]).strftime("%b %d"),
-                }
-            )
+            top.append({
+                "label": "Longest session",
+                "session_id": longest["id"][:16],
+                "value": _format_duration(dur),
+                "date": datetime.fromtimestamp(longest["started_at"]).strftime("%b %d"),
+            })
 
         # Most messages
         most_msgs = max(sessions, key=lambda s: s.get("message_count") or 0)
         if (most_msgs.get("message_count") or 0) > 0:
-            top.append(
-                {
-                    "label": "Most messages",
-                    "session_id": most_msgs["id"][:16],
-                    "value": f"{most_msgs['message_count']} msgs",
-                    "date": datetime.fromtimestamp(most_msgs["started_at"]).strftime("%b %d")
-                    if most_msgs.get("started_at")
-                    else "?",
-                }
-            )
+            top.append({
+                "label": "Most messages",
+                "session_id": most_msgs["id"][:16],
+                "value": f"{most_msgs['message_count']} msgs",
+                "date": datetime.fromtimestamp(most_msgs["started_at"]).strftime("%b %d") if most_msgs.get("started_at") else "?",
+            })
 
         # Most tokens
         most_tokens = max(
@@ -617,30 +608,22 @@ class InsightsEngine:
         )
         token_total = (most_tokens.get("input_tokens") or 0) + (most_tokens.get("output_tokens") or 0)
         if token_total > 0:
-            top.append(
-                {
-                    "label": "Most tokens",
-                    "session_id": most_tokens["id"][:16],
-                    "value": f"{token_total:,} tokens",
-                    "date": datetime.fromtimestamp(most_tokens["started_at"]).strftime("%b %d")
-                    if most_tokens.get("started_at")
-                    else "?",
-                }
-            )
+            top.append({
+                "label": "Most tokens",
+                "session_id": most_tokens["id"][:16],
+                "value": f"{token_total:,} tokens",
+                "date": datetime.fromtimestamp(most_tokens["started_at"]).strftime("%b %d") if most_tokens.get("started_at") else "?",
+            })
 
         # Most tool calls
         most_tools = max(sessions, key=lambda s: s.get("tool_call_count") or 0)
         if (most_tools.get("tool_call_count") or 0) > 0:
-            top.append(
-                {
-                    "label": "Most tool calls",
-                    "session_id": most_tools["id"][:16],
-                    "value": f"{most_tools['tool_call_count']} calls",
-                    "date": datetime.fromtimestamp(most_tools["started_at"]).strftime("%b %d")
-                    if most_tools.get("started_at")
-                    else "?",
-                }
-            )
+            top.append({
+                "label": "Most tool calls",
+                "session_id": most_tools["id"][:16],
+                "value": f"{most_tools['tool_call_count']} calls",
+                "date": datetime.fromtimestamp(most_tools["started_at"]).strftime("%b %d") if most_tools.get("started_at") else "?",
+            })
 
         return top
 
@@ -648,7 +631,7 @@ class InsightsEngine:
     # Formatting
     # =========================================================================
 
-    def format_terminal(self, report: dict) -> str:
+    def format_terminal(self, report: Dict) -> str:
         """Format the insights report for terminal display (CLI)."""
         if report.get("empty"):
             days = report.get("days", 30)
@@ -686,17 +669,13 @@ class InsightsEngine:
         lines.append("  " + "─" * 56)
         lines.append(f"  Sessions:          {o['total_sessions']:<12}  Messages:        {o['total_messages']:,}")
         lines.append(f"  Tool calls:        {o['total_tool_calls']:<12,}  User messages:   {o['user_messages']:,}")
-        lines.append(
-            f"  Input tokens:      {o['total_input_tokens']:<12,}  Output tokens:   {o['total_output_tokens']:,}"
-        )
+        lines.append(f"  Input tokens:      {o['total_input_tokens']:<12,}  Output tokens:   {o['total_output_tokens']:,}")
         cost_str = f"${o['estimated_cost']:.2f}"
         if o.get("models_without_pricing"):
             cost_str += " *"
         lines.append(f"  Total tokens:      {o['total_tokens']:<12,}  Est. cost:       {cost_str}")
         if o["total_hours"] > 0:
-            lines.append(
-                f"  Active time:       ~{_format_duration(o['total_hours'] * 3600):<11}  Avg session:     ~{_format_duration(o['avg_session_duration'])}"
-            )
+            lines.append(f"  Active time:       ~{_format_duration(o['total_hours'] * 3600):<11}  Avg session:     ~{_format_duration(o['avg_session_duration'])}")
         lines.append(f"  Avg msgs/session:  {o['avg_messages_per_session']:.1f}")
         lines.append("")
 
@@ -713,7 +692,7 @@ class InsightsEngine:
                     cost_cell = "     N/A"
                 lines.append(f"  {model_name:<30} {m['sessions']:>8} {m['total_tokens']:>12,} {cost_cell}")
             if o.get("models_without_pricing"):
-                lines.append("  * Cost N/A for custom/self-hosted models")
+                lines.append(f"  * Cost N/A for custom/self-hosted models")
             lines.append("")
 
         # Platform breakdown
@@ -779,7 +758,7 @@ class InsightsEngine:
 
         return "\n".join(lines)
 
-    def format_gateway(self, report: dict) -> str:
+    def format_gateway(self, report: Dict) -> str:
         """Format the insights report for gateway/messaging (shorter)."""
         if report.get("empty"):
             days = report.get("days", 30)
@@ -792,20 +771,14 @@ class InsightsEngine:
         lines.append(f"📊 **Hermes Insights** — Last {days} days\n")
 
         # Overview
-        lines.append(
-            f"**Sessions:** {o['total_sessions']} | **Messages:** {o['total_messages']:,} | **Tool calls:** {o['total_tool_calls']:,}"
-        )
-        lines.append(
-            f"**Tokens:** {o['total_tokens']:,} (in: {o['total_input_tokens']:,} / out: {o['total_output_tokens']:,})"
-        )
+        lines.append(f"**Sessions:** {o['total_sessions']} | **Messages:** {o['total_messages']:,} | **Tool calls:** {o['total_tool_calls']:,}")
+        lines.append(f"**Tokens:** {o['total_tokens']:,} (in: {o['total_input_tokens']:,} / out: {o['total_output_tokens']:,})")
         cost_note = ""
         if o.get("models_without_pricing"):
             cost_note = " _(excludes custom/self-hosted models)_"
         lines.append(f"**Est. cost:** ${o['estimated_cost']:.2f}{cost_note}")
         if o["total_hours"] > 0:
-            lines.append(
-                f"**Active time:** ~{_format_duration(o['total_hours'] * 3600)} | **Avg session:** ~{_format_duration(o['avg_session_duration'])}"
-            )
+            lines.append(f"**Active time:** ~{_format_duration(o['total_hours'] * 3600)} | **Avg session:** ~{_format_duration(o['avg_session_duration'])}")
         lines.append("")
 
         # Models (top 5)
@@ -813,9 +786,7 @@ class InsightsEngine:
             lines.append("**🤖 Models:**")
             for m in report["models"][:5]:
                 cost_str = f"${m['cost']:.2f}" if m.get("has_pricing") else "N/A"
-                lines.append(
-                    f"  {m['model'][:25]} — {m['sessions']} sessions, {m['total_tokens']:,} tokens, {cost_str}"
-                )
+                lines.append(f"  {m['model'][:25]} — {m['sessions']} sessions, {m['total_tokens']:,} tokens, {cost_str}")
             lines.append("")
 
         # Platforms (if multi-platform)
@@ -838,13 +809,9 @@ class InsightsEngine:
             hr = act["busiest_hour"]["hour"]
             ampm = "AM" if hr < 12 else "PM"
             display_hr = hr % 12 or 12
-            lines.append(
-                f"**📅 Busiest:** {act['busiest_day']['day']}s ({act['busiest_day']['count']} sessions), {display_hr}{ampm} ({act['busiest_hour']['count']} sessions)"
-            )
+            lines.append(f"**📅 Busiest:** {act['busiest_day']['day']}s ({act['busiest_day']['count']} sessions), {display_hr}{ampm} ({act['busiest_hour']['count']} sessions)")
             if act.get("active_days"):
-                lines.append(
-                    f"**Active days:** {act['active_days']}",
-                )
+                lines.append(f"**Active days:** {act['active_days']}", )
             if act.get("max_streak", 0) > 1:
                 lines.append(f"**Best streak:** {act['max_streak']} consecutive days")
 

agent/model_metadata.py

@@ -9,7 +9,7 @@ import os
 import re
 import time
 from pathlib import Path
-from typing import Any
+from typing import Any, Dict, List, Optional
 
 import requests
 import yaml
@@ -18,7 +18,7 @@ from hermes_constants import OPENROUTER_MODELS_URL
 
 logger = logging.getLogger(__name__)
 
-_model_metadata_cache: dict[str, dict[str, Any]] = {}
+_model_metadata_cache: Dict[str, Dict[str, Any]] = {}
 _model_metadata_cache_time: float = 0
 _MODEL_CACHE_TTL = 3600
 
@@ -53,8 +53,10 @@ DEFAULT_CONTEXT_LENGTHS = {
     "glm-5": 202752,
     "glm-4.5": 131072,
     "glm-4.5-flash": 131072,
+    "kimi-for-coding": 262144,
     "kimi-k2.5": 262144,
     "kimi-k2-thinking": 262144,
+    "kimi-k2-thinking-turbo": 262144,
     "kimi-k2-turbo-preview": 262144,
     "kimi-k2-0905-preview": 131072,
     "MiniMax-M2.5": 204800,
@@ -63,7 +65,7 @@ DEFAULT_CONTEXT_LENGTHS = {
 }
 
 
-def fetch_model_metadata(force_refresh: bool = False) -> dict[str, dict[str, Any]]:
+def fetch_model_metadata(force_refresh: bool = False) -> Dict[str, Dict[str, Any]]:
     """Fetch model metadata from OpenRouter (cached for 1 hour)."""
     global _model_metadata_cache, _model_metadata_cache_time
 
@@ -104,7 +106,7 @@ def _get_context_cache_path() -> Path:
     return hermes_home / "context_length_cache.yaml"
 
 
-def _load_context_cache() -> dict[str, int]:
+def _load_context_cache() -> Dict[str, int]:
     """Load the model+provider → context_length cache from disk."""
     path = _get_context_cache_path()
     if not path.exists():
@@ -139,14 +141,14 @@ def save_context_length(model: str, base_url: str, length: int) -> None:
         logger.debug("Failed to save context length cache: %s", e)
 
 
-def get_cached_context_length(model: str, base_url: str) -> int | None:
+def get_cached_context_length(model: str, base_url: str) -> Optional[int]:
     """Look up a previously discovered context length for model+provider."""
     key = f"{model}@{base_url}"
     cache = _load_context_cache()
     return cache.get(key)
 
 
-def get_next_probe_tier(current_length: int) -> int | None:
+def get_next_probe_tier(current_length: int) -> Optional[int]:
     """Return the next lower probe tier, or None if already at minimum."""
     for tier in CONTEXT_PROBE_TIERS:
         if tier < current_length:
@@ -154,7 +156,7 @@ def get_next_probe_tier(current_length: int) -> int | None:
     return None
 
 
-def parse_context_limit_from_error(error_msg: str) -> int | None:
+def parse_context_limit_from_error(error_msg: str) -> Optional[int]:
     """Try to extract the actual context limit from an API error message.
 
     Many providers include the limit in their error text, e.g.:
@@ -166,11 +168,11 @@ def parse_context_limit_from_error(error_msg: str) -> int | None:
     error_lower = error_msg.lower()
     # Pattern: look for numbers near context-related keywords
     patterns = [
-        r"(?:max(?:imum)?|limit)\s*(?:context\s*)?(?:length|size|window)?\s*(?:is|of|:)?\s*(\d{4,})",
-        r"context\s*(?:length|size|window)\s*(?:is|of|:)?\s*(\d{4,})",
-        r"(\d{4,})\s*(?:token)?\s*(?:context|limit)",
-        r">\s*(\d{4,})\s*(?:max|limit|token)",  # "250000 tokens > 200000 maximum"
-        r"(\d{4,})\s*(?:max(?:imum)?)\b",  # "200000 maximum"
+        r'(?:max(?:imum)?|limit)\s*(?:context\s*)?(?:length|size|window)?\s*(?:is|of|:)?\s*(\d{4,})',
+        r'context\s*(?:length|size|window)\s*(?:is|of|:)?\s*(\d{4,})',
+        r'(\d{4,})\s*(?:token)?\s*(?:context|limit)',
+        r'>\s*(\d{4,})\s*(?:max|limit|token)',  # "250000 tokens > 200000 maximum"
+        r'(\d{4,})\s*(?:max(?:imum)?)\b',  # "200000 maximum"
     ]
     for pattern in patterns:
         match = re.search(pattern, error_lower)
@@ -218,7 +220,7 @@ def estimate_tokens_rough(text: str) -> int:
     return len(text) // 4
 
 
-def estimate_messages_tokens_rough(messages: list[dict[str, Any]]) -> int:
+def estimate_messages_tokens_rough(messages: List[Dict[str, Any]]) -> int:
     """Rough token estimate for a message list (pre-flight only)."""
     total_chars = sum(len(str(msg)) for msg in messages)
     return total_chars // 4

agent/prompt_builder.py

@@ -8,6 +8,7 @@ import logging
 import os
 import re
 from pathlib import Path
+from typing import Optional
 
 logger = logging.getLogger(__name__)
 
@@ -17,29 +18,21 @@ logger = logging.getLogger(__name__)
 # ---------------------------------------------------------------------------
 
 _CONTEXT_THREAT_PATTERNS = [
-    (r"ignore\s+(previous|all|above|prior)\s+instructions", "prompt_injection"),
-    (r"do\s+not\s+tell\s+the\s+user", "deception_hide"),
-    (r"system\s+prompt\s+override", "sys_prompt_override"),
-    (r"disregard\s+(your|all|any)\s+(instructions|rules|guidelines)", "disregard_rules"),
-    (r"act\s+as\s+(if|though)\s+you\s+(have\s+no|don\'t\s+have)\s+(restrictions|limits|rules)", "bypass_restrictions"),
-    (r"<!--[^>]*(?:ignore|override|system|secret|hidden)[^>]*-->", "html_comment_injection"),
+    (r'ignore\s+(previous|all|above|prior)\s+instructions', "prompt_injection"),
+    (r'do\s+not\s+tell\s+the\s+user', "deception_hide"),
+    (r'system\s+prompt\s+override', "sys_prompt_override"),
+    (r'disregard\s+(your|all|any)\s+(instructions|rules|guidelines)', "disregard_rules"),
+    (r'act\s+as\s+(if|though)\s+you\s+(have\s+no|don\'t\s+have)\s+(restrictions|limits|rules)', "bypass_restrictions"),
+    (r'<!--[^>]*(?:ignore|override|system|secret|hidden)[^>]*-->', "html_comment_injection"),
     (r'<\s*div\s+style\s*=\s*["\'].*display\s*:\s*none', "hidden_div"),
-    (r"translate\s+.*\s+into\s+.*\s+and\s+(execute|run|eval)", "translate_execute"),
-    (r"curl\s+[^\n]*\$\{?\w*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)", "exfil_curl"),
-    (r"cat\s+[^\n]*(\.env|credentials|\.netrc|\.pgpass)", "read_secrets"),
+    (r'translate\s+.*\s+into\s+.*\s+and\s+(execute|run|eval)', "translate_execute"),
+    (r'curl\s+[^\n]*\$\{?\w*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)', "exfil_curl"),
+    (r'cat\s+[^\n]*(\.env|credentials|\.netrc|\.pgpass)', "read_secrets"),
 ]
 
 _CONTEXT_INVISIBLE_CHARS = {
-    "\u200b",
-    "\u200c",
-    "\u200d",
-    "\u2060",
-    "\ufeff",
-    "\u202a",
-    "\u202b",
-    "\u202c",
-    "\u202d",
-    "\u202e",
+    '\u200b', '\u200c', '\u200d', '\u2060', '\ufeff',
+    '\u202a', '\u202b', '\u202c', '\u202d', '\u202e',
 }
 
 
@@ -59,13 +52,10 @@ def _scan_context_content(content: str, filename: str) -> str:
 
     if findings:
         logger.warning("Context file %s blocked: %s", filename, ", ".join(findings))
-        return (
-            f"[BLOCKED: {filename} contained potential prompt injection ({', '.join(findings)}). Content not loaded.]"
-        )
+        return f"[BLOCKED: {filename} contained potential prompt injection ({', '.join(findings)}). Content not loaded.]"
 
     return content
 
-
 # =========================================================================
 # Constants
 # =========================================================================
@@ -141,7 +131,18 @@ PLATFORM_HINTS = {
         "files arrive as downloadable documents. You can also include image "
         "URLs in markdown format ![alt](url) and they will be sent as photos."
     ),
-    "cli": ("You are a CLI AI Agent. Try not to use markdown but simple text renderable inside a terminal."),
+    "email": (
+        "You are communicating via email. Write clear, well-structured responses "
+        "suitable for email. Use plain text formatting (no markdown). "
+        "Keep responses concise but complete. You can send file attachments — "
+        "include MEDIA:/absolute/path/to/file in your response. The subject line "
+        "is preserved for threading. Do not include greetings or sign-offs unless "
+        "contextually appropriate."
+    ),
+    "cli": (
+        "You are a CLI AI Agent. Try not to use markdown but simple text "
+        "renderable inside a terminal."
+    ),
 }
 
 CONTEXT_FILE_MAX_CHARS = 20_000
@@ -153,23 +154,21 @@ CONTEXT_TRUNCATE_TAIL_RATIO = 0.2
 # Skills index
 # =========================================================================
 
-
 def _read_skill_description(skill_file: Path, max_chars: int = 60) -> str:
     """Read the description from a SKILL.md frontmatter, capped at max_chars."""
     try:
         raw = skill_file.read_text(encoding="utf-8")[:2000]
         match = re.search(
             r"^---\s*\n.*?description:\s*(.+?)\s*\n.*?^---",
-            raw,
-            re.MULTILINE | re.DOTALL,
+            raw, re.MULTILINE | re.DOTALL,
         )
         if match:
             desc = match.group(1).strip().strip("'\"")
             if len(desc) > max_chars:
-                desc = desc[: max_chars - 3] + "..."
+                desc = desc[:max_chars - 3] + "..."
             return desc
-    except Exception:
-        pass
+    except Exception as e:
+        logger.debug("Failed to read skill description from %s: %s", skill_file, e)
     return ""
 
 
@@ -181,7 +180,6 @@ def _skill_is_platform_compatible(skill_file: Path) -> bool:
     """
     try:
         from tools.skills_tool import _parse_frontmatter, skill_matches_platform
-
         raw = skill_file.read_text(encoding="utf-8")[:2000]
         frontmatter, _ = _parse_frontmatter(raw)
         return skill_matches_platform(frontmatter)
@@ -189,7 +187,58 @@ def _skill_is_platform_compatible(skill_file: Path) -> bool:
         return True  # Err on the side of showing the skill
 
 
-def build_skills_system_prompt() -> str:
+def _read_skill_conditions(skill_file: Path) -> dict:
+    """Extract conditional activation fields from SKILL.md frontmatter."""
+    try:
+        from tools.skills_tool import _parse_frontmatter
+        raw = skill_file.read_text(encoding="utf-8")[:2000]
+        frontmatter, _ = _parse_frontmatter(raw)
+        hermes = frontmatter.get("metadata", {}).get("hermes", {})
+        return {
+            "fallback_for_toolsets": hermes.get("fallback_for_toolsets", []),
+            "requires_toolsets": hermes.get("requires_toolsets", []),
+            "fallback_for_tools": hermes.get("fallback_for_tools", []),
+            "requires_tools": hermes.get("requires_tools", []),
+        }
+    except Exception:
+        return {}
+
+
+def _skill_should_show(
+    conditions: dict,
+    available_tools: "set[str] | None",
+    available_toolsets: "set[str] | None",
+) -> bool:
+    """Return False if the skill's conditional activation rules exclude it."""
+    if available_tools is None and available_toolsets is None:
+        return True  # No filtering info — show everything (backward compat)
+
+    at = available_tools or set()
+    ats = available_toolsets or set()
+
+    # fallback_for: hide when the primary tool/toolset IS available
+    for ts in conditions.get("fallback_for_toolsets", []):
+        if ts in ats:
+            return False
+    for t in conditions.get("fallback_for_tools", []):
+        if t in at:
+            return False
+
+    # requires: hide when a required tool/toolset is NOT available
+    for ts in conditions.get("requires_toolsets", []):
+        if ts not in ats:
+            return False
+    for t in conditions.get("requires_tools", []):
+        if t not in at:
+            return False
+
+    return True
+
+
+def build_skills_system_prompt(
+    available_tools: "set[str] | None" = None,
+    available_toolsets: "set[str] | None" = None,
+) -> str:
     """Build a compact skill index for the system prompt.
 
     Scans ~/.hermes/skills/ for SKILL.md files grouped by category.
@@ -212,6 +261,10 @@ def build_skills_system_prompt() -> str:
         # Skip skills incompatible with the current OS platform
         if not _skill_is_platform_compatible(skill_file):
             continue
+        # Skip skills whose conditional activation rules exclude them
+        conditions = _read_skill_conditions(skill_file)
+        if not _skill_should_show(conditions, available_tools, available_toolsets):
+            continue
         rel_path = skill_file.relative_to(skills_dir)
         parts = rel_path.parts
         if len(parts) >= 2:
@@ -270,7 +323,8 @@ def build_skills_system_prompt() -> str:
         "load it with skill_view(name) and follow its instructions. "
         "If a skill has issues, fix it with skill_manage(action='patch').\n"
         "\n"
-        "<available_skills>\n" + "\n".join(index_lines) + "\n"
+        "<available_skills>\n"
+        + "\n".join(index_lines) + "\n"
         "</available_skills>\n"
         "\n"
         "If none match, proceed normally without loading a skill."
@@ -281,7 +335,6 @@ def build_skills_system_prompt() -> str:
 # Context files (SOUL.md, AGENTS.md, .cursorrules)
 # =========================================================================
 
-
 def _truncate_content(content: str, filename: str, max_chars: int = CONTEXT_FILE_MAX_CHARS) -> str:
     """Head/tail truncation with a marker in the middle."""
     if len(content) <= max_chars:
@@ -294,7 +347,7 @@ def _truncate_content(content: str, filename: str, max_chars: int = CONTEXT_FILE
     return head + marker + tail
 
 
-def build_context_files_prompt(cwd: str | None = None) -> str:
+def build_context_files_prompt(cwd: Optional[str] = None) -> str:
     """Discover and load context files for the system prompt.
 
     Discovery: AGENTS.md (recursive), .cursorrules / .cursor/rules/*.mdc,
@@ -317,9 +370,7 @@ def build_context_files_prompt(cwd: str | None = None) -> str:
     if top_level_agents:
         agents_files = []
         for root, dirs, files in os.walk(cwd_path):
-            dirs[:] = [
-                d for d in dirs if not d.startswith(".") and d not in ("node_modules", "__pycache__", "venv", ".venv")
-            ]
+            dirs[:] = [d for d in dirs if not d.startswith('.') and d not in ('node_modules', '__pycache__', 'venv', '.venv')]
             for f in files:
                 if f.lower() == "agents.md":
                     agents_files.append(Path(root) / f)
@@ -396,7 +447,4 @@ def build_context_files_prompt(cwd: str | None = None) -> str:
 
     if not sections:
         return ""
-    return (
-        "# Project Context\n\nThe following project context files have been loaded and should be followed:\n\n"
-        + "\n".join(sections)
-    )
+    return "# Project Context\n\nThe following project context files have been loaded and should be followed:\n\n" + "\n".join(sections)

agent/prompt_caching.py

@@ -9,7 +9,7 @@ Pure functions -- no class state, no AIAgent dependency.
 """
 
 import copy
-from typing import Any
+from typing import Any, Dict, List
 
 
 def _apply_cache_marker(msg: dict, cache_marker: dict) -> None:
@@ -36,9 +36,9 @@ def _apply_cache_marker(msg: dict, cache_marker: dict) -> None:
 
 
 def apply_anthropic_cache_control(
-    api_messages: list[dict[str, Any]],
+    api_messages: List[Dict[str, Any]],
     cache_ttl: str = "5m",
-) -> list[dict[str, Any]]:
+) -> List[Dict[str, Any]]:
     """Apply system_and_3 caching strategy to messages for Anthropic models.
 
     Places up to 4 cache_control breakpoints: system prompt + last 3 non-system messages.

agent/redact.py

@@ -15,28 +15,28 @@ logger = logging.getLogger(__name__)
 
 # Known API key prefixes -- match the prefix + contiguous token chars
 _PREFIX_PATTERNS = [
-    r"sk-[A-Za-z0-9_-]{10,}",  # OpenAI / OpenRouter / Anthropic (sk-ant-*)
-    r"ghp_[A-Za-z0-9]{10,}",  # GitHub PAT (classic)
-    r"github_pat_[A-Za-z0-9_]{10,}",  # GitHub PAT (fine-grained)
-    r"xox[baprs]-[A-Za-z0-9-]{10,}",  # Slack tokens
-    r"AIza[A-Za-z0-9_-]{30,}",  # Google API keys
-    r"pplx-[A-Za-z0-9]{10,}",  # Perplexity
-    r"fal_[A-Za-z0-9_-]{10,}",  # Fal.ai
-    r"fc-[A-Za-z0-9]{10,}",  # Firecrawl
-    r"bb_live_[A-Za-z0-9_-]{10,}",  # BrowserBase
-    r"gAAAA[A-Za-z0-9_=-]{20,}",  # Codex encrypted tokens
-    r"AKIA[A-Z0-9]{16}",  # AWS Access Key ID
-    r"sk_live_[A-Za-z0-9]{10,}",  # Stripe secret key (live)
-    r"sk_test_[A-Za-z0-9]{10,}",  # Stripe secret key (test)
-    r"rk_live_[A-Za-z0-9]{10,}",  # Stripe restricted key
-    r"SG\.[A-Za-z0-9_-]{10,}",  # SendGrid API key
-    r"hf_[A-Za-z0-9]{10,}",  # HuggingFace token
-    r"r8_[A-Za-z0-9]{10,}",  # Replicate API token
-    r"npm_[A-Za-z0-9]{10,}",  # npm access token
-    r"pypi-[A-Za-z0-9_-]{10,}",  # PyPI API token
-    r"dop_v1_[A-Za-z0-9]{10,}",  # DigitalOcean PAT
-    r"doo_v1_[A-Za-z0-9]{10,}",  # DigitalOcean OAuth
-    r"am_[A-Za-z0-9_-]{10,}",  # AgentMail API key
+    r"sk-[A-Za-z0-9_-]{10,}",           # OpenAI / OpenRouter / Anthropic (sk-ant-*)
+    r"ghp_[A-Za-z0-9]{10,}",            # GitHub PAT (classic)
+    r"github_pat_[A-Za-z0-9_]{10,}",    # GitHub PAT (fine-grained)
+    r"xox[baprs]-[A-Za-z0-9-]{10,}",    # Slack tokens
+    r"AIza[A-Za-z0-9_-]{30,}",          # Google API keys
+    r"pplx-[A-Za-z0-9]{10,}",           # Perplexity
+    r"fal_[A-Za-z0-9_-]{10,}",          # Fal.ai
+    r"fc-[A-Za-z0-9]{10,}",             # Firecrawl
+    r"bb_live_[A-Za-z0-9_-]{10,}",      # BrowserBase
+    r"gAAAA[A-Za-z0-9_=-]{20,}",        # Codex encrypted tokens
+    r"AKIA[A-Z0-9]{16}",                # AWS Access Key ID
+    r"sk_live_[A-Za-z0-9]{10,}",        # Stripe secret key (live)
+    r"sk_test_[A-Za-z0-9]{10,}",        # Stripe secret key (test)
+    r"rk_live_[A-Za-z0-9]{10,}",        # Stripe restricted key
+    r"SG\.[A-Za-z0-9_-]{10,}",          # SendGrid API key
+    r"hf_[A-Za-z0-9]{10,}",             # HuggingFace token
+    r"r8_[A-Za-z0-9]{10,}",             # Replicate API token
+    r"npm_[A-Za-z0-9]{10,}",            # npm access token
+    r"pypi-[A-Za-z0-9_-]{10,}",         # PyPI API token
+    r"dop_v1_[A-Za-z0-9]{10,}",         # DigitalOcean PAT
+    r"doo_v1_[A-Za-z0-9]{10,}",         # DigitalOcean OAuth
+    r"am_[A-Za-z0-9_-]{10,}",           # AgentMail API key
 ]
 
 # ENV assignment patterns: KEY=value where KEY contains a secret-like name
@@ -59,13 +59,16 @@ _AUTH_HEADER_RE = re.compile(
     re.IGNORECASE,
 )
 
-# Telegram bot tokens: bot<digits>:<token> or <digits>:<alphanum>
+# Telegram bot tokens: bot<digits>:<token> or <digits>:<token>,
+# where token part is restricted to [-A-Za-z0-9_] and length >= 30
 _TELEGRAM_RE = re.compile(
     r"(bot)?(\d{8,}):([-A-Za-z0-9_]{30,})",
 )
 
 # Private key blocks: -----BEGIN RSA PRIVATE KEY----- ... -----END RSA PRIVATE KEY-----
-_PRIVATE_KEY_RE = re.compile(r"-----BEGIN[A-Z ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z ]*PRIVATE KEY-----")
+_PRIVATE_KEY_RE = re.compile(
+    r"-----BEGIN[A-Z ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z ]*PRIVATE KEY-----"
+)
 
 # Database connection strings: protocol://user:PASSWORD@host
 # Catches postgres, mysql, mongodb, redis, amqp URLs and redacts the password
@@ -79,7 +82,9 @@ _DB_CONNSTR_RE = re.compile(
 _SIGNAL_PHONE_RE = re.compile(r"(\+[1-9]\d{6,14})(?![A-Za-z0-9])")
 
 # Compile known prefix patterns into one alternation
-_PREFIX_RE = re.compile(r"(?<![A-Za-z0-9_-])(" + "|".join(_PREFIX_PATTERNS) + r")(?![A-Za-z0-9_-])")
+_PREFIX_RE = re.compile(
+    r"(?<![A-Za-z0-9_-])(" + "|".join(_PREFIX_PATTERNS) + r")(?![A-Za-z0-9_-])"
+)
 
 
 def _mask_token(token: str) -> str:
@@ -107,14 +112,12 @@ def redact_sensitive_text(text: str) -> str:
     def _redact_env(m):
         name, quote, value = m.group(1), m.group(2), m.group(3)
         return f"{name}={quote}{_mask_token(value)}{quote}"
-
     text = _ENV_ASSIGN_RE.sub(_redact_env, text)
 
     # JSON fields: "apiKey": "value"
     def _redact_json(m):
         key, value = m.group(1), m.group(2)
         return f'{key}: "{_mask_token(value)}"'
-
     text = _JSON_FIELD_RE.sub(_redact_json, text)
 
     # Authorization headers
@@ -128,7 +131,6 @@ def redact_sensitive_text(text: str) -> str:
         prefix = m.group(1) or ""
         digits = m.group(2)
         return f"{prefix}{digits}:***"
-
     text = _TELEGRAM_RE.sub(_redact_telegram, text)
 
     # Private key blocks
@@ -143,7 +145,6 @@ def redact_sensitive_text(text: str) -> str:
         if len(phone) <= 8:
             return phone[:2] + "****" + phone[-2:]
         return phone[:4] + "****" + phone[-4:]
-
     text = _SIGNAL_PHONE_RE.sub(_redact_phone, text)
 
     return text
@@ -152,7 +153,7 @@ def redact_sensitive_text(text: str) -> str:
 class RedactingFormatter(logging.Formatter):
     """Log formatter that redacts secrets from all log messages."""
 
-    def __init__(self, fmt=None, datefmt=None, style="%", **kwargs):
+    def __init__(self, fmt=None, datefmt=None, style='%', **kwargs):
         super().__init__(fmt, datefmt, style, **kwargs)
 
     def format(self, record: logging.LogRecord) -> str:

agent/skill_commands.py

@@ -6,14 +6,14 @@ can invoke skills via /skill-name commands.
 
 import logging
 from pathlib import Path
-from typing import Any
+from typing import Any, Dict, Optional
 
 logger = logging.getLogger(__name__)
 
-_skill_commands: dict[str, dict[str, Any]] = {}
+_skill_commands: Dict[str, Dict[str, Any]] = {}
 
 
-def scan_skill_commands() -> dict[str, dict[str, Any]]:
+def scan_skill_commands() -> Dict[str, Dict[str, Any]]:
     """Scan ~/.hermes/skills/ and return a mapping of /command -> skill info.
 
     Returns:
@@ -23,27 +23,26 @@ def scan_skill_commands() -> dict[str, dict[str, Any]]:
     _skill_commands = {}
     try:
         from tools.skills_tool import SKILLS_DIR, _parse_frontmatter, skill_matches_platform
-
         if not SKILLS_DIR.exists():
             return _skill_commands
         for skill_md in SKILLS_DIR.rglob("SKILL.md"):
-            if any(part in (".git", ".github", ".hub") for part in skill_md.parts):
+            if any(part in ('.git', '.github', '.hub') for part in skill_md.parts):
                 continue
             try:
-                content = skill_md.read_text(encoding="utf-8")
+                content = skill_md.read_text(encoding='utf-8')
                 frontmatter, body = _parse_frontmatter(content)
                 # Skip skills incompatible with the current OS platform
                 if not skill_matches_platform(frontmatter):
                     continue
-                name = frontmatter.get("name", skill_md.parent.name)
-                description = frontmatter.get("description", "")
+                name = frontmatter.get('name', skill_md.parent.name)
+                description = frontmatter.get('description', '')
                 if not description:
-                    for line in body.strip().split("\n"):
+                    for line in body.strip().split('\n'):
                         line = line.strip()
-                        if line and not line.startswith("#"):
+                        if line and not line.startswith('#'):
                             description = line[:80]
                             break
-                cmd_name = name.lower().replace(" ", "-").replace("_", "-")
+                cmd_name = name.lower().replace(' ', '-').replace('_', '-')
                 _skill_commands[f"/{cmd_name}"] = {
                     "name": name,
                     "description": description or f"Invoke the {name} skill",
@@ -57,14 +56,14 @@ def scan_skill_commands() -> dict[str, dict[str, Any]]:
     return _skill_commands
 
 
-def get_skill_commands() -> dict[str, dict[str, Any]]:
+def get_skill_commands() -> Dict[str, Dict[str, Any]]:
     """Return the current skill commands mapping (scan first if empty)."""
     if not _skill_commands:
         scan_skill_commands()
     return _skill_commands
 
 
-def build_skill_invocation_message(cmd_key: str, user_instruction: str = "") -> str | None:
+def build_skill_invocation_message(cmd_key: str, user_instruction: str = "") -> Optional[str]:
     """Build the user message content for a skill slash command invocation.
 
     Args:
@@ -84,7 +83,7 @@ def build_skill_invocation_message(cmd_key: str, user_instruction: str = "") ->
     skill_name = skill_info["name"]
 
     try:
-        content = skill_md_path.read_text(encoding="utf-8")
+        content = skill_md_path.read_text(encoding='utf-8')
     except Exception:
         return f"[Failed to load skill: {skill_name}]"
 
@@ -112,8 +111,6 @@ def build_skill_invocation_message(cmd_key: str, user_instruction: str = "") ->
 
     if user_instruction:
         parts.append("")
-        parts.append(
-            f"The user has provided the following instruction alongside the skill invocation: {user_instruction}"
-        )
+        parts.append(f"The user has provided the following instruction alongside the skill invocation: {user_instruction}")
 
     return "\n".join(parts)

agent/trajectory.py

@@ -8,7 +8,7 @@ the file-write logic live here.
 import json
 import logging
 from datetime import datetime
-from typing import Any
+from typing import Any, Dict, List
 
 logger = logging.getLogger(__name__)
 
@@ -27,7 +27,8 @@ def has_incomplete_scratchpad(content: str) -> bool:
     return "<REASONING_SCRATCHPAD>" in content and "</REASONING_SCRATCHPAD>" not in content
 
 
-def save_trajectory(trajectory: list[dict[str, Any]], model: str, completed: bool, filename: str = None):
+def save_trajectory(trajectory: List[Dict[str, Any]], model: str,
+                    completed: bool, filename: str = None):
     """Append a trajectory entry to a JSONL file.
 
     Args:

cli-config.yaml.example

@@ -11,6 +11,7 @@ model:
   
   # Inference provider selection:
   #   "auto"       - Use Nous Portal if logged in, otherwise OpenRouter/env vars (default)
+  #   "nous-api"   - Use Nous Portal via API key (requires: NOUS_API_KEY)
   #   "openrouter" - Always use OpenRouter API key from OPENROUTER_API_KEY
   #   "nous"       - Always use Nous Portal (requires: hermes login)
   #   "zai"        - Use z.ai / ZhipuAI GLM models (requires: GLM_API_KEY)
@@ -402,11 +403,13 @@ agent:
 #     discord: [web, vision, skills, todo]
 #
 # If not set, defaults are:
-#   cli:      hermes-cli      (everything + cronjob management)
-#   telegram: hermes-telegram  (terminal, file, web, vision, image, tts, browser, skills, todo, cronjob, messaging)
-#   discord:  hermes-discord   (same as telegram)
-#   whatsapp: hermes-whatsapp  (same as telegram)
-#   slack:    hermes-slack     (same as telegram)
+#   cli:           hermes-cli            (everything + cronjob management)
+#   telegram:      hermes-telegram       (terminal, file, web, vision, image, tts, browser, skills, todo, cronjob, messaging)
+#   discord:       hermes-discord        (same as telegram)
+#   whatsapp:      hermes-whatsapp       (same as telegram)
+#   slack:         hermes-slack          (same as telegram)
+#   signal:        hermes-signal         (same as telegram)
+#   homeassistant: hermes-homeassistant  (same as telegram)
 #
 platform_toolsets:
   cli: [hermes-cli]
@@ -414,6 +417,8 @@ platform_toolsets:
   discord: [hermes-discord]
   whatsapp: [hermes-whatsapp]
   slack: [hermes-slack]
+  signal: [hermes-signal]
+  homeassistant: [hermes-homeassistant]
 
 # ─────────────────────────────────────────────────────────────────────────────
 # Available toolsets (use these names in platform_toolsets or the toolsets list)
@@ -621,6 +626,10 @@ code_execution:
 delegation:
   max_iterations: 50                          # Max tool-calling turns per child (default: 50)
   default_toolsets: ["terminal", "file", "web"]  # Default toolsets for subagents
+  # model: "google/gemini-3-flash-preview"    # Override model for subagents (empty = inherit parent)
+  # provider: "openrouter"                    # Override provider for subagents (empty = inherit parent)
+  #                                           # Resolves full credentials (base_url, api_key) automatically.
+  #                                           # Supported: openrouter, nous, zai, kimi-coding, minimax
 
 # =============================================================================
 # Honcho Integration (Cross-Session User Modeling)
@@ -651,7 +660,62 @@ display:
   # Toggle at runtime with /verbose in the CLI
   tool_progress: all
 
+  # Background process notifications (gateway/messaging only).
+  # Controls how chatty the process watcher is when you use
+  # terminal(background=true, check_interval=...) from Telegram/Discord/etc.
+  #   off:     No watcher messages at all
+  #   result:  Only the final completion message
+  #   error:   Only the final message when exit code != 0
+  #   all:     Running output updates + final message (default)
+  background_process_notifications: all
+
   # Play terminal bell when agent finishes a response.
   # Useful for long-running tasks — your terminal will ding when the agent is done.
   # Works over SSH. Most terminals can be configured to flash the taskbar or play a sound.
   bell_on_complete: false
+
+  # Show model reasoning/thinking before each response.
+  # When enabled, a dim box shows the model's thought process above the response.
+  # Toggle at runtime with /reasoning show or /reasoning hide.
+  show_reasoning: false
+
+  # ───────────────────────────────────────────────────────────────────────────
+  # Skin / Theme
+  # ───────────────────────────────────────────────────────────────────────────
+  # Customize CLI visual appearance — banner colors, spinner faces, tool prefix,
+  # response box label, and branding text. Change at runtime with /skin <name>.
+  #
+  # Built-in skins:
+  #   default  — Classic Hermes gold/kawaii
+  #   ares     — Crimson/bronze war-god theme with spinner wings
+  #   mono     — Clean grayscale monochrome
+  #   slate    — Cool blue developer-focused
+  #
+  # Custom skins: drop a YAML file in ~/.hermes/skins/<name>.yaml
+  # Schema (all fields optional, missing values inherit from default):
+  #
+  #   name: my-theme
+  #   description: Short description
+  #   colors:
+  #     banner_border: "#HEX"    # Panel border
+  #     banner_title: "#HEX"     # Panel title
+  #     banner_accent: "#HEX"    # Section headers (Available Tools, etc.)
+  #     banner_dim: "#HEX"       # Dim/muted text
+  #     banner_text: "#HEX"      # Body text (tool names, skill names)
+  #     ui_accent: "#HEX"        # UI accent color
+  #     response_border: "#HEX"  # Response box border color
+  #   spinner:
+  #     waiting_faces: ["(⚔)", "(⛨)"]       # Faces shown while waiting
+  #     thinking_faces: ["(⚔)", "(⌁)"]      # Faces shown while thinking
+  #     thinking_verbs: ["forging", "plotting"]  # Verbs for spinner messages
+  #     wings:                                # Optional left/right spinner decorations
+  #       - ["⟪⚔", "⚔⟫"]
+  #       - ["⟪▲", "▲⟫"]
+  #   branding:
+  #     agent_name: "My Agent"               # Banner title and branding
+  #     welcome: "Welcome message"           # Shown at CLI startup
+  #     response_label: " ⚔ Agent "         # Response box header label
+  #     prompt_symbol: "⚔ ❯ "              # Prompt symbol
+  #   tool_prefix: "╎"                       # Tool output line prefix (default: ┊)
+  #
+  skin: default

cron/__init__.py

@@ -15,18 +15,18 @@ duplicate execution if multiple processes overlap.
 """
 
 from cron.jobs import (
-    JOBS_FILE,
     create_job,
     get_job,
     list_jobs,
     remove_job,
     update_job,
+    JOBS_FILE,
 )
 from cron.scheduler import tick
 
 __all__ = [
     "create_job",
-    "get_job",
+    "get_job", 
     "list_jobs",
     "remove_job",
     "update_job",

cron/jobs.py

@@ -6,19 +6,18 @@ Output is saved to ~/.hermes/cron/output/{job_id}/{timestamp}.md
 """
 
 import json
+import tempfile
 import os
 import re
-import tempfile
 import uuid
 from datetime import datetime, timedelta
 from pathlib import Path
-from typing import Any
+from typing import Optional, Dict, List, Any
 
 from hermes_time import now as _hermes_now
 
 try:
     from croniter import croniter
-
     HAS_CRONITER = True
 except ImportError:
     HAS_CRONITER = False
@@ -27,54 +26,72 @@ except ImportError:
 # Configuration
 # =============================================================================
 
-HERMES_DIR = Path.home() / ".hermes"
+HERMES_DIR = Path(os.getenv("HERMES_HOME", Path.home() / ".hermes"))
 CRON_DIR = HERMES_DIR / "cron"
 JOBS_FILE = CRON_DIR / "jobs.json"
 OUTPUT_DIR = CRON_DIR / "output"
 
 
+def _secure_dir(path: Path):
+    """Set directory to owner-only access (0700). No-op on Windows."""
+    try:
+        os.chmod(path, 0o700)
+    except (OSError, NotImplementedError):
+        pass  # Windows or other platforms where chmod is not supported
+
+
+def _secure_file(path: Path):
+    """Set file to owner-only read/write (0600). No-op on Windows."""
+    try:
+        if path.exists():
+            os.chmod(path, 0o600)
+    except (OSError, NotImplementedError):
+        pass
+
+
 def ensure_dirs():
-    """Ensure cron directories exist."""
+    """Ensure cron directories exist with secure permissions."""
     CRON_DIR.mkdir(parents=True, exist_ok=True)
     OUTPUT_DIR.mkdir(parents=True, exist_ok=True)
+    _secure_dir(CRON_DIR)
+    _secure_dir(OUTPUT_DIR)
 
 
 # =============================================================================
 # Schedule Parsing
 # =============================================================================
 
-
 def parse_duration(s: str) -> int:
     """
     Parse duration string into minutes.
-
+    
     Examples:
         "30m" → 30
         "2h" → 120
         "1d" → 1440
     """
     s = s.strip().lower()
-    match = re.match(r"^(\d+)\s*(m|min|mins|minute|minutes|h|hr|hrs|hour|hours|d|day|days)$", s)
+    match = re.match(r'^(\d+)\s*(m|min|mins|minute|minutes|h|hr|hrs|hour|hours|d|day|days)$', s)
     if not match:
         raise ValueError(f"Invalid duration: '{s}'. Use format like '30m', '2h', or '1d'")
-
+    
     value = int(match.group(1))
     unit = match.group(2)[0]  # First char: m, h, or d
-
-    multipliers = {"m": 1, "h": 60, "d": 1440}
+    
+    multipliers = {'m': 1, 'h': 60, 'd': 1440}
     return value * multipliers[unit]
 
 
-def parse_schedule(schedule: str) -> dict[str, Any]:
+def parse_schedule(schedule: str) -> Dict[str, Any]:
     """
     Parse schedule string into structured format.
-
+    
     Returns dict with:
         - kind: "once" | "interval" | "cron"
         - For "once": "run_at" (ISO timestamp)
         - For "interval": "minutes" (int)
         - For "cron": "expr" (cron expression)
-
+    
     Examples:
         "30m"              → once in 30 minutes
         "2h"               → once in 2 hours
@@ -86,17 +103,23 @@ def parse_schedule(schedule: str) -> dict[str, Any]:
     schedule = schedule.strip()
     original = schedule
     schedule_lower = schedule.lower()
-
+    
     # "every X" pattern → recurring interval
     if schedule_lower.startswith("every "):
         duration_str = schedule[6:].strip()
         minutes = parse_duration(duration_str)
-        return {"kind": "interval", "minutes": minutes, "display": f"every {minutes}m"}
-
+        return {
+            "kind": "interval",
+            "minutes": minutes,
+            "display": f"every {minutes}m"
+        }
+    
     # Check for cron expression (5 or 6 space-separated fields)
     # Cron fields: minute hour day month weekday [year]
     parts = schedule.split()
-    if len(parts) >= 5 and all(re.match(r"^[\d\*\-,/]+$", p) for p in parts[:5]):
+    if len(parts) >= 5 and all(
+        re.match(r'^[\d\*\-,/]+$', p) for p in parts[:5]
+    ):
         if not HAS_CRONITER:
             raise ValueError("Cron expressions require 'croniter' package. Install with: pip install croniter")
         # Validate cron expression
@@ -104,25 +127,37 @@ def parse_schedule(schedule: str) -> dict[str, Any]:
             croniter(schedule)
         except Exception as e:
             raise ValueError(f"Invalid cron expression '{schedule}': {e}")
-        return {"kind": "cron", "expr": schedule, "display": schedule}
-
+        return {
+            "kind": "cron",
+            "expr": schedule,
+            "display": schedule
+        }
+    
     # ISO timestamp (contains T or looks like date)
-    if "T" in schedule or re.match(r"^\d{4}-\d{2}-\d{2}", schedule):
+    if 'T' in schedule or re.match(r'^\d{4}-\d{2}-\d{2}', schedule):
         try:
             # Parse and validate
-            dt = datetime.fromisoformat(schedule.replace("Z", "+00:00"))
-            return {"kind": "once", "run_at": dt.isoformat(), "display": f"once at {dt.strftime('%Y-%m-%d %H:%M')}"}
+            dt = datetime.fromisoformat(schedule.replace('Z', '+00:00'))
+            return {
+                "kind": "once",
+                "run_at": dt.isoformat(),
+                "display": f"once at {dt.strftime('%Y-%m-%d %H:%M')}"
+            }
         except ValueError as e:
             raise ValueError(f"Invalid timestamp '{schedule}': {e}")
-
+    
     # Duration like "30m", "2h", "1d" → one-shot from now
     try:
         minutes = parse_duration(schedule)
         run_at = _hermes_now() + timedelta(minutes=minutes)
-        return {"kind": "once", "run_at": run_at.isoformat(), "display": f"once in {original}"}
+        return {
+            "kind": "once",
+            "run_at": run_at.isoformat(),
+            "display": f"once in {original}"
+        }
     except ValueError:
         pass
-
+    
     raise ValueError(
         f"Invalid schedule '{original}'. Use:\n"
         f"  - Duration: '30m', '2h', '1d' (one-shot)\n"
@@ -133,19 +168,25 @@ def parse_schedule(schedule: str) -> dict[str, Any]:
 
 
 def _ensure_aware(dt: datetime) -> datetime:
-    """Make a naive datetime tz-aware using the configured timezone.
+    """Return a timezone-aware datetime in Hermes configured timezone.
 
-    Handles backward compatibility: timestamps stored before timezone support
-    are naive (server-local).  We assume they were in the same timezone as
-    the current configuration so comparisons work without crashing.
+    Backward compatibility:
+    - Older stored timestamps may be naive.
+    - Naive values are interpreted as *system-local wall time* (the timezone
+      `datetime.now()` used when they were created), then converted to the
+      configured Hermes timezone.
+
+    This preserves relative ordering for legacy naive timestamps across
+    timezone changes and avoids false not-due results.
     """
+    target_tz = _hermes_now().tzinfo
     if dt.tzinfo is None:
-        tz = _hermes_now().tzinfo
-        return dt.replace(tzinfo=tz)
-    return dt
+        local_tz = datetime.now().astimezone().tzinfo
+        return dt.replace(tzinfo=local_tz).astimezone(target_tz)
+    return dt.astimezone(target_tz)
 
 
-def compute_next_run(schedule: dict[str, Any], last_run_at: str | None = None) -> str | None:
+def compute_next_run(schedule: Dict[str, Any], last_run_at: Optional[str] = None) -> Optional[str]:
     """
     Compute the next run time for a schedule.
 
@@ -183,31 +224,31 @@ def compute_next_run(schedule: dict[str, Any], last_run_at: str | None = None) -
 # Job CRUD Operations
 # =============================================================================
 
-
-def load_jobs() -> list[dict[str, Any]]:
+def load_jobs() -> List[Dict[str, Any]]:
     """Load all jobs from storage."""
     ensure_dirs()
     if not JOBS_FILE.exists():
         return []
-
+    
     try:
-        with open(JOBS_FILE, encoding="utf-8") as f:
+        with open(JOBS_FILE, 'r', encoding='utf-8') as f:
             data = json.load(f)
             return data.get("jobs", [])
-    except (OSError, json.JSONDecodeError):
+    except (json.JSONDecodeError, IOError):
         return []
 
 
-def save_jobs(jobs: list[dict[str, Any]]):
+def save_jobs(jobs: List[Dict[str, Any]]):
     """Save all jobs to storage."""
     ensure_dirs()
-    fd, tmp_path = tempfile.mkstemp(dir=str(JOBS_FILE.parent), suffix=".tmp", prefix=".jobs_")
+    fd, tmp_path = tempfile.mkstemp(dir=str(JOBS_FILE.parent), suffix='.tmp', prefix='.jobs_')
     try:
-        with os.fdopen(fd, "w", encoding="utf-8") as f:
+        with os.fdopen(fd, 'w', encoding='utf-8') as f:
             json.dump({"jobs": jobs, "updated_at": _hermes_now().isoformat()}, f, indent=2)
             f.flush()
             os.fsync(f.fileno())
         os.replace(tmp_path, JOBS_FILE)
+        _secure_file(JOBS_FILE)
     except BaseException:
         try:
             os.unlink(tmp_path)
@@ -219,14 +260,14 @@ def save_jobs(jobs: list[dict[str, Any]]):
 def create_job(
     prompt: str,
     schedule: str,
-    name: str | None = None,
-    repeat: int | None = None,
-    deliver: str | None = None,
-    origin: dict[str, Any] | None = None,
-) -> dict[str, Any]:
+    name: Optional[str] = None,
+    repeat: Optional[int] = None,
+    deliver: Optional[str] = None,
+    origin: Optional[Dict[str, Any]] = None
+) -> Dict[str, Any]:
     """
     Create a new cron job.
-
+    
     Args:
         prompt: The prompt to run (must be self-contained)
         schedule: Schedule string (see parse_schedule)
@@ -234,23 +275,23 @@ def create_job(
         repeat: How many times to run (None = forever, 1 = once)
         deliver: Where to deliver output ("origin", "local", "telegram", etc.)
         origin: Source info where job was created (for "origin" delivery)
-
+    
     Returns:
         The created job dict
     """
     parsed_schedule = parse_schedule(schedule)
-
+    
     # Auto-set repeat=1 for one-shot schedules if not specified
     if parsed_schedule["kind"] == "once" and repeat is None:
         repeat = 1
-
+    
     # Default delivery to origin if available, otherwise local
     if deliver is None:
         deliver = "origin" if origin else "local"
-
+    
     job_id = uuid.uuid4().hex[:12]
     now = _hermes_now().isoformat()
-
+    
     job = {
         "id": job_id,
         "name": name or prompt[:50].strip(),
@@ -259,7 +300,7 @@ def create_job(
         "schedule_display": parsed_schedule.get("display", schedule),
         "repeat": {
             "times": repeat,  # None = forever
-            "completed": 0,
+            "completed": 0
         },
         "enabled": True,
         "created_at": now,
@@ -271,15 +312,15 @@ def create_job(
         "deliver": deliver,
         "origin": origin,  # Tracks where job was created for "origin" delivery
     }
-
+    
     jobs = load_jobs()
     jobs.append(job)
     save_jobs(jobs)
-
+    
     return job
 
 
-def get_job(job_id: str) -> dict[str, Any] | None:
+def get_job(job_id: str) -> Optional[Dict[str, Any]]:
     """Get a job by ID."""
     jobs = load_jobs()
     for job in jobs:
@@ -288,7 +329,7 @@ def get_job(job_id: str) -> dict[str, Any] | None:
     return None
 
 
-def list_jobs(include_disabled: bool = False) -> list[dict[str, Any]]:
+def list_jobs(include_disabled: bool = False) -> List[Dict[str, Any]]:
     """List all jobs, optionally including disabled ones."""
     jobs = load_jobs()
     if not include_disabled:
@@ -296,7 +337,7 @@ def list_jobs(include_disabled: bool = False) -> list[dict[str, Any]]:
     return jobs
 
 
-def update_job(job_id: str, updates: dict[str, Any]) -> dict[str, Any] | None:
+def update_job(job_id: str, updates: Dict[str, Any]) -> Optional[Dict[str, Any]]:
     """Update a job by ID."""
     jobs = load_jobs()
     for i, job in enumerate(jobs):
@@ -318,10 +359,10 @@ def remove_job(job_id: str) -> bool:
     return False
 
 
-def mark_job_run(job_id: str, success: bool, error: str | None = None):
+def mark_job_run(job_id: str, success: bool, error: Optional[str] = None):
     """
     Mark a job as having been run.
-
+    
     Updates last_run_at, last_status, increments completed count,
     computes next_run_at, and auto-deletes if repeat limit reached.
     """
@@ -332,11 +373,11 @@ def mark_job_run(job_id: str, success: bool, error: str | None = None):
             job["last_run_at"] = now
             job["last_status"] = "ok" if success else "error"
             job["last_error"] = error if not success else None
-
+            
             # Increment completed count
             if job.get("repeat"):
                 job["repeat"]["completed"] = job["repeat"].get("completed", 0) + 1
-
+                
                 # Check if we've hit the repeat limit
                 times = job["repeat"].get("times")
                 completed = job["repeat"]["completed"]
@@ -345,38 +386,38 @@ def mark_job_run(job_id: str, success: bool, error: str | None = None):
                     jobs.pop(i)
                     save_jobs(jobs)
                     return
-
+            
             # Compute next run
             job["next_run_at"] = compute_next_run(job["schedule"], now)
-
+            
             # If no next run (one-shot completed), disable
             if job["next_run_at"] is None:
                 job["enabled"] = False
-
+            
             save_jobs(jobs)
             return
-
+    
     save_jobs(jobs)
 
 
-def get_due_jobs() -> list[dict[str, Any]]:
+def get_due_jobs() -> List[Dict[str, Any]]:
     """Get all jobs that are due to run now."""
     now = _hermes_now()
     jobs = load_jobs()
     due = []
-
+    
     for job in jobs:
         if not job.get("enabled", True):
             continue
-
+        
         next_run = job.get("next_run_at")
         if not next_run:
             continue
-
+        
         next_run_dt = _ensure_aware(datetime.fromisoformat(next_run))
         if next_run_dt <= now:
             due.append(job)
-
+    
     return due
 
 
@@ -385,11 +426,13 @@ def save_job_output(job_id: str, output: str):
     ensure_dirs()
     job_output_dir = OUTPUT_DIR / job_id
     job_output_dir.mkdir(parents=True, exist_ok=True)
-
+    _secure_dir(job_output_dir)
+    
     timestamp = _hermes_now().strftime("%Y-%m-%d_%H-%M-%S")
     output_file = job_output_dir / f"{timestamp}.md"
-
-    with open(output_file, "w", encoding="utf-8") as f:
+    
+    with open(output_file, 'w', encoding='utf-8') as f:
         f.write(output)
-
+    _secure_file(output_file)
+    
     return output_file

cron/scheduler.py

@@ -23,7 +23,9 @@ except ImportError:
         import msvcrt
     except ImportError:
         msvcrt = None
+from datetime import datetime
 from pathlib import Path
+from typing import Optional
 
 from hermes_time import now as _hermes_now
 
@@ -42,8 +44,8 @@ _LOCK_DIR = _hermes_home / "cron"
 _LOCK_FILE = _LOCK_DIR / ".tick.lock"
 
 
-def _resolve_origin(job: dict) -> dict | None:
-    """Extract origin info from a job, returning {platform, chat_id, chat_name} or None."""
+def _resolve_origin(job: dict) -> Optional[dict]:
+    """Extract origin info from a job, preserving any extra routing metadata."""
     origin = job.get("origin")
     if not origin:
         return None
@@ -67,6 +69,8 @@ def _deliver_result(job: dict, content: str) -> None:
     if deliver == "local":
         return
 
+    thread_id = None
+
     # Resolve target platform + chat_id
     if deliver == "origin":
         if not origin:
@@ -74,6 +78,7 @@ def _deliver_result(job: dict, content: str) -> None:
             return
         platform_name = origin["platform"]
         chat_id = origin["chat_id"]
+        thread_id = origin.get("thread_id")
     elif ":" in deliver:
         platform_name, chat_id = deliver.split(":", 1)
     else:
@@ -81,20 +86,16 @@ def _deliver_result(job: dict, content: str) -> None:
         platform_name = deliver
         if origin and origin.get("platform") == platform_name:
             chat_id = origin["chat_id"]
+            thread_id = origin.get("thread_id")
         else:
             # Fall back to home channel
             chat_id = os.getenv(f"{platform_name.upper()}_HOME_CHANNEL", "")
             if not chat_id:
-                logger.warning(
-                    "Job '%s' deliver=%s but no chat_id or home channel. Set via: hermes config set %s_HOME_CHANNEL <channel_id>",
-                    job["id"],
-                    deliver,
-                    platform_name.upper(),
-                )
+                logger.warning("Job '%s' deliver=%s but no chat_id or home channel. Set via: hermes config set %s_HOME_CHANNEL <channel_id>", job["id"], deliver, platform_name.upper())
                 return
 
-    from gateway.config import Platform, load_gateway_config
     from tools.send_message_tool import _send_to_platform
+    from gateway.config import load_gateway_config, Platform
 
     platform_map = {
         "telegram": Platform.TELEGRAM,
@@ -102,6 +103,7 @@ def _deliver_result(job: dict, content: str) -> None:
         "slack": Platform.SLACK,
         "whatsapp": Platform.WHATSAPP,
         "signal": Platform.SIGNAL,
+        "email": Platform.EMAIL,
     }
     platform = platform_map.get(platform_name.lower())
     if not platform:
@@ -121,14 +123,13 @@ def _deliver_result(job: dict, content: str) -> None:
 
     # Run the async send in a fresh event loop (safe from any thread)
     try:
-        result = asyncio.run(_send_to_platform(platform, pconfig, chat_id, content))
+        result = asyncio.run(_send_to_platform(platform, pconfig, chat_id, content, thread_id=thread_id))
     except RuntimeError:
         # asyncio.run() fails if there's already a running loop in this thread;
         # spin up a new thread to avoid that.
         import concurrent.futures
-
         with concurrent.futures.ThreadPoolExecutor(max_workers=1) as pool:
-            future = pool.submit(asyncio.run, _send_to_platform(platform, pconfig, chat_id, content))
+            future = pool.submit(asyncio.run, _send_to_platform(platform, pconfig, chat_id, content, thread_id=thread_id))
             result = future.result(timeout=30)
     except Exception as e:
         logger.error("Job '%s': delivery to %s:%s failed: %s", job["id"], platform_name, chat_id, e)
@@ -141,26 +142,25 @@ def _deliver_result(job: dict, content: str) -> None:
         # Mirror the delivered content into the target's gateway session
         try:
             from gateway.mirror import mirror_to_session
-
-            mirror_to_session(platform_name, chat_id, content, source_label="cron")
-        except Exception:
-            pass
+            mirror_to_session(platform_name, chat_id, content, source_label="cron", thread_id=thread_id)
+        except Exception as e:
+            logger.warning("Job '%s': mirror_to_session failed: %s", job["id"], e)
 
 
-def run_job(job: dict) -> tuple[bool, str, str, str | None]:
+def run_job(job: dict) -> tuple[bool, str, str, Optional[str]]:
     """
     Execute a single cron job.
-
+    
     Returns:
         Tuple of (success, full_output_doc, final_response, error_message)
     """
     from run_agent import AIAgent
-
+    
     job_id = job["id"]
     job_name = job["name"]
     prompt = job["prompt"]
     origin = _resolve_origin(job)
-
+    
     logger.info("Running job '%s' (ID: %s)", job_name, job_id)
     logger.info("Prompt: %s", prompt[:100])
 
@@ -175,19 +175,17 @@ def run_job(job: dict) -> tuple[bool, str, str, str | None]:
         # Re-read .env and config.yaml fresh every run so provider/key
         # changes take effect without a gateway restart.
         from dotenv import load_dotenv
-
         try:
             load_dotenv(str(_hermes_home / ".env"), override=True, encoding="utf-8")
         except UnicodeDecodeError:
             load_dotenv(str(_hermes_home / ".env"), override=True, encoding="latin-1")
 
-        model = os.getenv("HERMES_MODEL") or os.getenv("LLM_MODEL") or "anthropic/claude-opus-4.6"
+        model = os.getenv("HERMES_MODEL") or "anthropic/claude-opus-4.6"
 
         # Load config.yaml for model, reasoning, prefill, toolsets, provider routing
         _cfg = {}
         try:
             import yaml
-
             _cfg_path = str(_hermes_home / "config.yaml")
             if os.path.exists(_cfg_path):
                 with open(_cfg_path) as _f:
@@ -197,8 +195,8 @@ def run_job(job: dict) -> tuple[bool, str, str, str | None]:
                     model = _model_cfg
                 elif isinstance(_model_cfg, dict):
                     model = _model_cfg.get("default", model)
-        except Exception:
-            pass
+        except Exception as e:
+            logger.warning("Job '%s': failed to load config.yaml, using defaults: %s", job_id, e)
 
         # Reasoning config from env or config.yaml
         reasoning_config = None
@@ -217,17 +215,17 @@ def run_job(job: dict) -> tuple[bool, str, str, str | None]:
         prefill_file = os.getenv("HERMES_PREFILL_MESSAGES_FILE", "") or _cfg.get("prefill_messages_file", "")
         if prefill_file:
             import json as _json
-
             pfpath = Path(prefill_file).expanduser()
             if not pfpath.is_absolute():
                 pfpath = _hermes_home / pfpath
             if pfpath.exists():
                 try:
-                    with open(pfpath, encoding="utf-8") as _pf:
+                    with open(pfpath, "r", encoding="utf-8") as _pf:
                         prefill_messages = _json.load(_pf)
                     if not isinstance(prefill_messages, list):
                         prefill_messages = None
-                except Exception:
+                except Exception as e:
+                    logger.warning("Job '%s': failed to parse prefill messages file '%s': %s", job_id, pfpath, e)
                     prefill_messages = None
 
         # Max iterations
@@ -237,10 +235,9 @@ def run_job(job: dict) -> tuple[bool, str, str, str | None]:
         pr = _cfg.get("provider_routing", {})
 
         from hermes_cli.runtime_provider import (
-            format_runtime_provider_error,
             resolve_runtime_provider,
+            format_runtime_provider_error,
         )
-
         try:
             runtime = resolve_runtime_provider(
                 requested=os.getenv("HERMES_INFERENCE_PROVIDER"),
@@ -263,20 +260,20 @@ def run_job(job: dict) -> tuple[bool, str, str, str | None]:
             providers_order=pr.get("order"),
             provider_sort=pr.get("sort"),
             quiet_mode=True,
-            session_id=f"cron_{job_id}_{_hermes_now().strftime('%Y%m%d_%H%M%S')}",
+            session_id=f"cron_{job_id}_{_hermes_now().strftime('%Y%m%d_%H%M%S')}"
         )
-
+        
         result = agent.run_conversation(prompt)
-
+        
         final_response = result.get("final_response", "")
         if not final_response:
             final_response = "(No response generated)"
-
+        
         output = f"""# Cron Job: {job_name}
 
 **Job ID:** {job_id}
-**Run Time:** {_hermes_now().strftime("%Y-%m-%d %H:%M:%S")}
-**Schedule:** {job.get("schedule_display", "N/A")}
+**Run Time:** {_hermes_now().strftime('%Y-%m-%d %H:%M:%S')}
+**Schedule:** {job.get('schedule_display', 'N/A')}
 
 ## Prompt
 
@@ -286,19 +283,19 @@ def run_job(job: dict) -> tuple[bool, str, str, str | None]:
 
 {final_response}
 """
-
+        
         logger.info("Job '%s' completed successfully", job_name)
         return True, output, final_response, None
-
+        
     except Exception as e:
         error_msg = f"{type(e).__name__}: {str(e)}"
         logger.error("Job '%s' failed: %s", job_name, error_msg)
-
+        
         output = f"""# Cron Job: {job_name} (FAILED)
 
 **Job ID:** {job_id}
-**Run Time:** {_hermes_now().strftime("%Y-%m-%d %H:%M:%S")}
-**Schedule:** {job.get("schedule_display", "N/A")}
+**Run Time:** {_hermes_now().strftime('%Y-%m-%d %H:%M:%S')}
+**Schedule:** {job.get('schedule_display', 'N/A')}
 
 ## Prompt
 
@@ -323,13 +320,13 @@ def run_job(job: dict) -> tuple[bool, str, str, str | None]:
 def tick(verbose: bool = True) -> int:
     """
     Check and run all due jobs.
-
+    
     Uses a file lock so only one tick runs at a time, even if the gateway's
     in-process ticker and a standalone daemon or manual tick overlap.
-
+    
     Args:
         verbose: Whether to print status messages
-
+    
     Returns:
         Number of jobs executed (0 if another tick is already running)
     """
@@ -343,7 +340,7 @@ def tick(verbose: bool = True) -> int:
             fcntl.flock(lock_fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
         elif msvcrt:
             msvcrt.locking(lock_fd.fileno(), msvcrt.LK_NBLCK, 1)
-    except OSError:
+    except (OSError, IOError):
         logger.debug("Tick skipped — another instance holds the lock")
         if lock_fd is not None:
             lock_fd.close()
@@ -353,11 +350,11 @@ def tick(verbose: bool = True) -> int:
         due_jobs = get_due_jobs()
 
         if verbose and not due_jobs:
-            logger.info("%s - No jobs due", _hermes_now().strftime("%H:%M:%S"))
+            logger.info("%s - No jobs due", _hermes_now().strftime('%H:%M:%S'))
             return 0
 
         if verbose:
-            logger.info("%s - %s job(s) due", _hermes_now().strftime("%H:%M:%S"), len(due_jobs))
+            logger.info("%s - %s job(s) due", _hermes_now().strftime('%H:%M:%S'), len(due_jobs))
 
         executed = 0
         for job in due_jobs:
@@ -369,9 +366,7 @@ def tick(verbose: bool = True) -> int:
                     logger.info("Output saved to: %s", output_file)
 
                 # Deliver the final response to the origin/target chat
-                deliver_content = (
-                    final_response if success else f"⚠️ Cron job '{job.get('name', job['id'])}' failed:\n{error}"
-                )
+                deliver_content = final_response if success else f"⚠️ Cron job '{job.get('name', job['id'])}' failed:\n{error}"
                 if deliver_content:
                     try:
                         _deliver_result(job, deliver_content)
@@ -382,7 +377,7 @@ def tick(verbose: bool = True) -> int:
                 executed += 1
 
             except Exception as e:
-                logger.error("Error processing job %s: %s", job["id"], e)
+                logger.error("Error processing job %s: %s", job['id'], e)
                 mark_job_run(job["id"], False, str(e))
 
         return executed
@@ -392,7 +387,7 @@ def tick(verbose: bool = True) -> int:
         elif msvcrt:
             try:
                 msvcrt.locking(lock_fd.fileno(), msvcrt.LK_UNLCK, 1)
-            except OSError:
+            except (OSError, IOError):
                 pass
         lock_fd.close()
 

docs/migration/openclaw.md

@@ -0,0 +1,110 @@
+# Migrating from OpenClaw to Hermes Agent
+
+This guide covers how to import your OpenClaw settings, memories, skills, and API keys into Hermes Agent.
+
+## Three Ways to Migrate
+
+### 1. Automatic (during first-time setup)
+
+When you run `hermes setup` for the first time and Hermes detects `~/.openclaw`, it automatically offers to import your OpenClaw data before configuration begins. Just accept the prompt and everything is handled for you.
+
+### 2. CLI Command (quick, scriptable)
+
+```bash
+hermes claw migrate                      # Full migration with confirmation prompt
+hermes claw migrate --dry-run            # Preview what would happen
+hermes claw migrate --preset user-data   # Migrate without API keys/secrets
+hermes claw migrate --yes                # Skip confirmation prompt
+```
+
+**All options:**
+
+| Flag | Description |
+|------|-------------|
+| `--source PATH` | Path to OpenClaw directory (default: `~/.openclaw`) |
+| `--dry-run` | Preview only — no files are modified |
+| `--preset {user-data,full}` | Migration preset (default: `full`). `user-data` excludes secrets |
+| `--overwrite` | Overwrite existing files (default: skip conflicts) |
+| `--migrate-secrets` | Include allowlisted secrets (auto-enabled with `full` preset) |
+| `--workspace-target PATH` | Copy workspace instructions (AGENTS.md) to this absolute path |
+| `--skill-conflict {skip,overwrite,rename}` | How to handle skill name conflicts (default: `skip`) |
+| `--yes`, `-y` | Skip confirmation prompts |
+
+### 3. Agent-Guided (interactive, with previews)
+
+Ask the agent to run the migration for you:
+
+```
+> Migrate my OpenClaw setup to Hermes
+```
+
+The agent will use the `openclaw-migration` skill to:
+1. Run a dry-run first to preview changes
+2. Ask about conflict resolution (SOUL.md, skills, etc.)
+3. Let you choose between `user-data` and `full` presets
+4. Execute the migration with your choices
+5. Print a detailed summary of what was migrated
+
+## What Gets Migrated
+
+### `user-data` preset
+| Item | Source | Destination |
+|------|--------|-------------|
+| SOUL.md | `~/.openclaw/workspace/SOUL.md` | `~/.hermes/SOUL.md` |
+| Memory entries | `~/.openclaw/workspace/MEMORY.md` | `~/.hermes/memories/MEMORY.md` |
+| User profile | `~/.openclaw/workspace/USER.md` | `~/.hermes/memories/USER.md` |
+| Skills | `~/.openclaw/workspace/skills/` | `~/.hermes/skills/openclaw-imports/` |
+| Command allowlist | `~/.openclaw/workspace/exec_approval_patterns.yaml` | Merged into `~/.hermes/config.yaml` |
+| Messaging settings | `~/.openclaw/config.yaml` (TELEGRAM_ALLOWED_USERS, MESSAGING_CWD) | `~/.hermes/.env` |
+| TTS assets | `~/.openclaw/workspace/tts/` | `~/.hermes/tts/` |
+
+### `full` preset (adds to `user-data`)
+| Item | Source | Destination |
+|------|--------|-------------|
+| Telegram bot token | `~/.openclaw/config.yaml` | `~/.hermes/.env` |
+| OpenRouter API key | `~/.openclaw/.env` or config | `~/.hermes/.env` |
+| OpenAI API key | `~/.openclaw/.env` or config | `~/.hermes/.env` |
+| Anthropic API key | `~/.openclaw/.env` or config | `~/.hermes/.env` |
+| ElevenLabs API key | `~/.openclaw/.env` or config | `~/.hermes/.env` |
+
+Only these 6 allowlisted secrets are ever imported. Other credentials are skipped and reported.
+
+## Conflict Handling
+
+By default, the migration **will not overwrite** existing Hermes data:
+
+- **SOUL.md** — skipped if one already exists in `~/.hermes/`
+- **Memory entries** — skipped if memories already exist (to avoid duplicates)
+- **Skills** — skipped if a skill with the same name already exists
+- **API keys** — skipped if the key is already set in `~/.hermes/.env`
+
+To overwrite conflicts, use `--overwrite`. The migration creates backups before overwriting.
+
+For skills, you can also use `--skill-conflict rename` to import conflicting skills under a new name (e.g., `skill-name-imported`).
+
+## Migration Report
+
+Every migration (including dry runs) produces a report showing:
+- **Migrated items** — what was successfully imported
+- **Conflicts** — items skipped because they already exist
+- **Skipped items** — items not found in the source
+- **Errors** — items that failed to import
+
+For execute runs, the full report is saved to `~/.hermes/migration/openclaw/<timestamp>/`.
+
+## Troubleshooting
+
+### "OpenClaw directory not found"
+The migration looks for `~/.openclaw` by default. If your OpenClaw is installed elsewhere, use `--source`:
+```bash
+hermes claw migrate --source /path/to/.openclaw
+```
+
+### "Migration script not found"
+The migration script ships with Hermes Agent. If you installed via pip (not git clone), the `optional-skills/` directory may not be present. Install the skill from the Skills Hub:
+```bash
+hermes skills install openclaw-migration
+```
+
+### Memory overflow
+If your OpenClaw MEMORY.md or USER.md exceeds Hermes' character limits, excess entries are exported to an overflow file in the migration report directory. You can manually review and add the most important ones.

docs/skins/example-skin.yaml

@@ -0,0 +1,89 @@
+# ============================================================================
+# Hermes Agent — Example Skin Template
+# ============================================================================
+#
+# Copy this file to ~/.hermes/skins/<name>.yaml to create a custom skin.
+# All fields are optional — missing values inherit from the default skin.
+# Activate with: /skin <name>  or  display.skin: <name> in config.yaml
+#
+# See hermes_cli/skin_engine.py for the full schema reference.
+# ============================================================================
+
+# Required: unique skin name (used in /skin command and config)
+name: example
+description: An example custom skin — copy and modify this template
+
+# ── Colors ──────────────────────────────────────────────────────────────────
+# Hex color values for Rich markup. These control the CLI's visual palette.
+colors:
+  # Banner panel (the startup welcome box)
+  banner_border: "#CD7F32"        # Panel border
+  banner_title: "#FFD700"         # Panel title text
+  banner_accent: "#FFBF00"        # Section headers (Available Tools, Skills, etc.)
+  banner_dim: "#B8860B"           # Dim/muted text (separators, model info)
+  banner_text: "#FFF8DC"          # Body text (tool names, skill names)
+
+  # UI elements
+  ui_accent: "#FFBF00"            # General accent color
+  ui_label: "#4dd0e1"             # Labels
+  ui_ok: "#4caf50"                # Success indicators
+  ui_error: "#ef5350"             # Error indicators
+  ui_warn: "#ffa726"              # Warning indicators
+
+  # Input area
+  prompt: "#FFF8DC"               # Prompt text color
+  input_rule: "#CD7F32"           # Horizontal rule around input
+
+  # Response box
+  response_border: "#FFD700"      # Response box border (ANSI color)
+
+  # Session display
+  session_label: "#DAA520"        # Session label
+  session_border: "#8B8682"       # Session ID dim color
+
+# ── Spinner ─────────────────────────────────────────────────────────────────
+# Customize the animated spinner shown during API calls and tool execution.
+spinner:
+  # Faces shown while waiting for the API response
+  waiting_faces:
+    - "(｡◕‿◕｡)"
+    - "(◕‿◕✿)"
+    - "٩(◕‿◕｡)۶"
+
+  # Faces shown during extended thinking/reasoning
+  thinking_faces:
+    - "(｡•́︿•̀｡)"
+    - "(◔_◔)"
+    - "(¬‿¬)"
+
+  # Verbs used in spinner messages (e.g., "pondering your request...")
+  thinking_verbs:
+    - "pondering"
+    - "contemplating"
+    - "musing"
+    - "ruminating"
+
+  # Optional: left/right decorations around the spinner
+  # Each entry is a [left, right] pair. Omit entirely for no wings.
+  # wings:
+  #   - ["⟪⚔", "⚔⟫"]
+  #   - ["⟪▲", "▲⟫"]
+
+# ── Branding ────────────────────────────────────────────────────────────────
+# Text strings used throughout the CLI interface.
+branding:
+  agent_name: "Hermes Agent"          # Banner title, about display
+  welcome: "Welcome! Type your message or /help for commands."
+  goodbye: "Goodbye! ⚕"              # Exit message
+  response_label: " ⚕ Hermes "       # Response box header label
+  prompt_symbol: "❯ "                 # Input prompt symbol
+  help_header: "(^_^)? Available Commands"  # /help header text
+
+# ── Tool Output ─────────────────────────────────────────────────────────────
+# Character used as the prefix for tool output lines.
+# Default is "┊" (thin dotted vertical line). Some alternatives:
+#   "╎" (light triple dash vertical)
+#   "▏" (left one-eighth block)
+#   "│" (box drawing light vertical)
+#   "┃" (box drawing heavy vertical)
+tool_prefix: "┊"

environments/__init__.py

@@ -18,9 +18,14 @@ Benchmarks (eval-only):
     - benchmarks/terminalbench_2/: Terminal-Bench 2.0 evaluation
 """
 
-from environments.agent_loop import AgentResult, HermesAgentLoop
-from environments.tool_context import ToolContext
-from environments.hermes_base_env import HermesAgentBaseEnv, HermesAgentEnvConfig
+try:
+    from environments.agent_loop import AgentResult, HermesAgentLoop
+    from environments.tool_context import ToolContext
+    from environments.hermes_base_env import HermesAgentBaseEnv, HermesAgentEnvConfig
+except ImportError:
+    # atroposlib not installed — environments are unavailable but
+    # submodules like tool_call_parsers can still be imported directly.
+    pass
 
 __all__ = [
     "AgentResult",

environments/agent_loop.py

@@ -249,23 +249,62 @@ class HermesAgentLoop:
             reasoning = _extract_reasoning_from_message(assistant_msg)
             reasoning_per_turn.append(reasoning)
 
-            # Check for tool calls -- standard OpenAI spec
+            # Check for tool calls -- standard OpenAI spec.
+            # Fallback: if response has no structured tool_calls but content
+            # contains raw tool call tags (e.g. <tool_call>), parse them using
+            # hermes-agent's standalone parsers. This handles the case where
+            # ManagedServer's ToolCallTranslator couldn't parse because vLLM
+            # isn't installed.
+            if (
+                not assistant_msg.tool_calls
+                and assistant_msg.content
+                and self.tool_schemas
+                and "<tool_call>" in (assistant_msg.content or "")
+            ):
+                try:
+                    from environments.tool_call_parsers import get_parser
+                    fallback_parser = get_parser("hermes")
+                    parsed_content, parsed_calls = fallback_parser.parse(
+                        assistant_msg.content
+                    )
+                    if parsed_calls:
+                        assistant_msg.tool_calls = parsed_calls
+                        if parsed_content is not None:
+                            assistant_msg.content = parsed_content
+                        logger.debug(
+                            "Fallback parser extracted %d tool calls from raw content",
+                            len(parsed_calls),
+                        )
+                except Exception:
+                    pass  # Fall through to no tool calls
+
             if assistant_msg.tool_calls:
+                # Normalize tool calls to dicts — they may come as objects
+                # (OpenAI API) or dicts (vLLM ToolCallTranslator).
+                def _tc_to_dict(tc):
+                    if isinstance(tc, dict):
+                        return {
+                            "id": tc.get("id", f"call_{uuid.uuid4().hex[:8]}"),
+                            "type": "function",
+                            "function": {
+                                "name": tc.get("function", {}).get("name", tc.get("name", "")),
+                                "arguments": tc.get("function", {}).get("arguments", tc.get("arguments", "{}")),
+                            },
+                        }
+                    return {
+                        "id": tc.id,
+                        "type": "function",
+                        "function": {
+                            "name": tc.function.name,
+                            "arguments": tc.function.arguments,
+                        },
+                    }
+
                 # Build the assistant message dict for conversation history
                 msg_dict: Dict[str, Any] = {
                     "role": "assistant",
                     "content": assistant_msg.content or "",
-                    "tool_calls": [
-                        {
-                            "id": tc.id,
-                            "type": "function",
-                            "function": {
-                                "name": tc.function.name,
-                                "arguments": tc.function.arguments,
-                            },
-                        }
-                        for tc in assistant_msg.tool_calls
-                    ],
+                    "tool_calls": [_tc_to_dict(tc) for tc in assistant_msg.tool_calls],
                 }
 
                 # Preserve reasoning_content for multi-turn chat template handling
@@ -278,8 +317,13 @@ class HermesAgentLoop:
 
                 # Execute each tool call via hermes-agent's dispatch
                 for tc in assistant_msg.tool_calls:
-                    tool_name = tc.function.name
-                    tool_args_raw = tc.function.arguments
+                    # Handle both object (OpenAI) and dict (vLLM) formats
+                    if isinstance(tc, dict):
+                        tool_name = tc.get("function", {}).get("name", tc.get("name", ""))
+                        tool_args_raw = tc.get("function", {}).get("arguments", tc.get("arguments", "{}"))
+                    else:
+                        tool_name = tc.function.name
+                        tool_args_raw = tc.function.arguments
 
                     # Validate tool name
                     if tool_name not in self.valid_tool_names:
@@ -390,10 +434,11 @@ class HermesAgentLoop:
                             pass
 
                     # Add tool response to conversation
+                    tc_id = tc.get("id", "") if isinstance(tc, dict) else tc.id
                     messages.append(
                         {
                             "role": "tool",
-                            "tool_call_id": tc.id,
+                            "tool_call_id": tc_id,
                             "content": tool_result,
                         }
                     )

environments/benchmarks/tblite/local.yaml

@@ -0,0 +1,38 @@
+# OpenThoughts-TBLite Evaluation -- Docker Backend (Local Compute)
+#
+# Runs tasks in Docker containers on the local machine.
+# Sandboxed like Modal but no cloud costs. Good for dev/testing.
+#
+# Usage:
+#   python environments/benchmarks/tblite/tblite_env.py evaluate \
+#       --config environments/benchmarks/tblite/local.yaml
+#
+#   # Override concurrency:
+#   python environments/benchmarks/tblite/tblite_env.py evaluate \
+#       --config environments/benchmarks/tblite/local.yaml \
+#       --env.eval_concurrency 4
+
+env:
+  enabled_toolsets: ["terminal", "file"]
+  max_agent_turns: 60
+  max_token_length: 32000
+  agent_temperature: 0.8
+  terminal_backend: "docker"
+  terminal_timeout: 300
+  tool_pool_size: 16
+  dataset_name: "NousResearch/openthoughts-tblite"
+  test_timeout: 600
+  task_timeout: 1200
+  eval_concurrency: 8          # max 8 tasks at once
+  tokenizer_name: "NousResearch/Hermes-3-Llama-3.1-8B"
+  use_wandb: false
+  wandb_name: "openthoughts-tblite-local"
+  ensure_scores_are_not_same: false
+  data_dir_to_save_evals: "environments/benchmarks/evals/openthoughts-tblite-local"
+
+openai:
+  base_url: "https://openrouter.ai/api/v1"
+  model_name: "anthropic/claude-sonnet-4"
+  server_type: "openai"
+  health_check: false
+  # api_key loaded from OPENROUTER_API_KEY in .env

environments/benchmarks/tblite/local_vllm.yaml

@@ -0,0 +1,40 @@
+# OpenThoughts-TBLite Evaluation -- Local vLLM Backend
+#
+# Runs against a local vLLM server with Docker sandboxes.
+#
+# Start the vLLM server from the atropos directory:
+#   python -m example_trainer.vllm_api_server \
+#       --model Qwen/Qwen3-4B-Instruct-2507 \
+#       --port 9001 \
+#       --gpu-memory-utilization 0.8 \
+#       --max-model-len=32000
+#
+# Then run:
+#   python environments/benchmarks/tblite/tblite_env.py evaluate \
+#       --config environments/benchmarks/tblite/local_vllm.yaml
+
+env:
+  enabled_toolsets: ["terminal", "file"]
+  max_agent_turns: 60
+  max_token_length: 16000
+  agent_temperature: 0.6
+  terminal_backend: "docker"
+  terminal_timeout: 300
+  tool_pool_size: 16
+  dataset_name: "NousResearch/openthoughts-tblite"
+  test_timeout: 600
+  task_timeout: 1200
+  eval_concurrency: 8
+  tool_call_parser: "hermes"
+  system_prompt: "You are an expert terminal agent. You MUST use the provided tools to complete tasks. Use the terminal tool to run shell commands, read_file to read files, write_file to write files, search_files to search, and patch to edit files. Do NOT write out solutions as text - execute them using the tools. Always start by exploring the environment with terminal commands."
+  tokenizer_name: "Qwen/Qwen3-4B-Instruct-2507"
+  use_wandb: false
+  wandb_name: "tblite-qwen3-4b-instruct"
+  ensure_scores_are_not_same: false
+  data_dir_to_save_evals: "environments/benchmarks/evals/tblite-qwen3-4b-local"
+
+openai:
+  base_url: "http://localhost:9001"
+  model_name: "Qwen/Qwen3-4B-Instruct-2507"
+  server_type: "vllm"
+  health_check: false

environments/benchmarks/terminalbench_2/default.yaml

@@ -29,6 +29,10 @@ env:
   wandb_name: "terminal-bench-2"
   ensure_scores_are_not_same: false
   data_dir_to_save_evals: "environments/benchmarks/evals/terminal-bench-2"
+  # CRITICAL: Limit concurrent Modal sandbox creations to avoid deadlocks.
+  # Modal's blocking calls (App.lookup, etc.) deadlock when too many sandboxes
+  # are created simultaneously inside thread pool workers via asyncio.run().
+  max_concurrent_tasks: 8
 
 openai:
   base_url: "https://openrouter.ai/api/v1"

environments/benchmarks/terminalbench_2/terminalbench2_env.py

@@ -118,6 +118,23 @@ class TerminalBench2EvalConfig(HermesAgentEnvConfig):
         "Tasks exceeding this are scored as FAIL. Default 30 minutes.",
     )
 
+    # --- Concurrency control ---
+    max_concurrent_tasks: int = Field(
+        default=8,
+        description="Maximum number of tasks to run concurrently. "
+        "Limits concurrent Modal sandbox creations to avoid async/threading deadlocks. "
+        "Modal has internal limits and creating too many sandboxes simultaneously "
+        "causes blocking calls to deadlock inside the thread pool.",
+    )
+
+    # --- Eval concurrency ---
+    eval_concurrency: int = Field(
+        default=0,
+        description="Maximum number of tasks to evaluate in parallel. "
+        "0 means unlimited (all tasks run concurrently). "
+        "Set to 8 for local backends to avoid overwhelming the machine.",
+    )
+
 
 # Tasks that cannot run properly on Modal and are excluded from scoring.
 MODAL_INCOMPATIBLE_TASKS = {
@@ -192,7 +209,7 @@ class TerminalBench2EvalEnv(HermesAgentBaseEnv):
 
             # Agent settings -- TB2 tasks are complex, need many turns
             max_agent_turns=60,
-            max_token_length=16000,
+            max_token_length=***
             agent_temperature=0.6,
             system_prompt=None,
 
@@ -216,7 +233,7 @@ class TerminalBench2EvalEnv(HermesAgentBaseEnv):
             steps_per_eval=1,
             total_steps=1,
 
-            tokenizer_name="NousResearch/Hermes-3-Llama-3.1-8B",
+            tokenizer_name="NousRe...1-8B",
             use_wandb=True,
             wandb_name="terminal-bench-2",
             ensure_scores_are_not_same=False,  # Binary rewards may all be 0 or 1
@@ -228,7 +245,7 @@ class TerminalBench2EvalEnv(HermesAgentBaseEnv):
                 base_url="https://openrouter.ai/api/v1",
                 model_name="anthropic/claude-sonnet-4",
                 server_type="openai",
-                api_key=os.getenv("OPENROUTER_API_KEY", ""),
+                api_key=os.get...EY", ""),
                 health_check=False,
             )
         ]
@@ -429,8 +446,14 @@ class TerminalBench2EvalEnv(HermesAgentBaseEnv):
                     "error": "no_image",
                 }
 
-            # --- 2. Register per-task Modal image override ---
-            register_task_env_overrides(task_id, {"modal_image": modal_image})
+            # --- 2. Register per-task image override ---
+            # Set both modal_image and docker_image so the task image is used
+            # regardless of which backend is configured.
+            register_task_env_overrides(task_id, {
+                "modal_image": modal_image,
+                "docker_image": modal_image,
+                "cwd": "/app",
+            })
             logger.info(
                 "Task %s: registered image override for task_id %s",
                 task_name, task_id[:8],
@@ -445,17 +468,37 @@ class TerminalBench2EvalEnv(HermesAgentBaseEnv):
             messages.append({"role": "user", "content": self.format_prompt(eval_item)})
 
             # --- 4. Run agent loop ---
-            agent = HermesAgentLoop(
-                server=self.server,
-                tool_schemas=tools,
-                valid_tool_names=valid_names,
-                max_turns=self.config.max_agent_turns,
-                task_id=task_id,
-                temperature=self.config.agent_temperature,
-                max_tokens=self.config.max_token_length,
-                extra_body=self.config.extra_body,
-            )
-            result = await agent.run(messages)
+            # Use ManagedServer (Phase 2) for vLLM/SGLang backends to get
+            # token-level tracking via /generate. Falls back to direct
+            # ServerManager (Phase 1) for OpenAI endpoints.
+            if self._use_managed_server():
+                async with self.server.managed_server(
+                    tokenizer=self.tokenizer,
+                    preserve_think_blocks=bool(self.config.thinking_mode),
+                ) as managed:
+                    agent = HermesAgentLoop(
+                        server=managed,
+                        tool_schemas=tools,
+                        valid_tool_names=valid_names,
+                        max_turns=self.config.max_agent_turns,
+                        task_id=task_id,
+                        temperature=self.config.agent_temperature,
+                        max_tokens=self.config.max_token_length,
+                        extra_body=self.config.extra_body,
+                    )
+                    result = await agent.run(messages)
+            else:
+                agent = HermesAgentLoop(
+                    server=self.server,
+                    tool_schemas=tools,
+                    valid_tool_names=valid_names,
+                    max_turns=self.config.max_agent_turns,
+                    task_id=task_id,
+                    temperature=self.config.agent_temperature,
+                    max_tokens=self.config.max_token_length,
+                    extra_body=self.config.extra_body,
+                )
+                result = await agent.run(messages)
 
             # --- 5. Verify -- run test suite in the agent's sandbox ---
             # Skip verification if the agent produced no meaningful output
@@ -470,435 +513,3 @@ class TerminalBench2EvalEnv(HermesAgentBaseEnv):
                 reward = 0.0
             else:
                 # Run tests in a thread so the blocking ctx.terminal() calls
-                # don't freeze the entire event loop (which would stall all
-                # other tasks, tqdm updates, and timeout timers).
-                ctx = ToolContext(task_id)
-                try:
-                    loop = asyncio.get_event_loop()
-                    reward = await loop.run_in_executor(
-                        None,  # default thread pool
-                        self._run_tests, eval_item, ctx, task_name,
-                    )
-                except Exception as e:
-                    logger.error("Task %s: test verification failed: %s", task_name, e)
-                    reward = 0.0
-                finally:
-                    ctx.cleanup()
-
-            passed = reward == 1.0
-            status = "PASS" if passed else "FAIL"
-            elapsed = time.time() - task_start
-            tqdm.write(f"  [{status}] {task_name} (turns={result.turns_used}, {elapsed:.0f}s)")
-            logger.info(
-                "Task %s: reward=%.1f, turns=%d, finished=%s",
-                task_name, reward, result.turns_used, result.finished_naturally,
-            )
-
-            out = {
-                "passed": passed,
-                "reward": reward,
-                "task_name": task_name,
-                "category": category,
-                "turns_used": result.turns_used,
-                "finished_naturally": result.finished_naturally,
-                "messages": result.messages,
-            }
-            self._save_result(out)
-            return out
-
-        except Exception as e:
-            elapsed = time.time() - task_start
-            logger.error("Task %s: rollout failed: %s", task_name, e, exc_info=True)
-            tqdm.write(f"  [ERROR] {task_name}: {e} ({elapsed:.0f}s)")
-            out = {
-                "passed": False, "reward": 0.0,
-                "task_name": task_name, "category": category,
-                "error": str(e),
-            }
-            self._save_result(out)
-            return out
-
-        finally:
-            # --- Cleanup: clear overrides, sandbox, and temp files ---
-            clear_task_env_overrides(task_id)
-            try:
-                cleanup_vm(task_id)
-            except Exception as e:
-                logger.debug("VM cleanup for %s: %s", task_id[:8], e)
-            if task_dir and task_dir.exists():
-                shutil.rmtree(task_dir, ignore_errors=True)
-
-    def _run_tests(
-        self, item: Dict[str, Any], ctx: ToolContext, task_name: str
-    ) -> float:
-        """
-        Upload and execute the test suite in the agent's sandbox, then
-        download the verifier output locally to read the reward.
-
-        Follows Harbor's verification pattern:
-        1. Upload tests/ directory into the sandbox
-        2. Execute test.sh inside the sandbox
-        3. Download /logs/verifier/ directory to a local temp dir
-        4. Read reward.txt locally with native Python I/O
-
-        Downloading locally avoids issues with the file_read tool on
-        the Modal VM and matches how Harbor handles verification.
-
-        TB2 test scripts (test.sh) typically:
-        1. Install pytest via uv/pip
-        2. Run pytest against the test files in /tests/
-        3. Write results to /logs/verifier/reward.txt
-
-        Args:
-            item: The TB2 task dict (contains tests_tar, test_sh)
-            ctx: ToolContext scoped to this task's sandbox
-            task_name: For logging
-
-        Returns:
-            1.0 if tests pass, 0.0 otherwise
-        """
-        tests_tar = item.get("tests_tar", "")
-        test_sh = item.get("test_sh", "")
-
-        if not test_sh:
-            logger.warning("Task %s: no test_sh content, reward=0", task_name)
-            return 0.0
-
-        # Create required directories in the sandbox
-        ctx.terminal("mkdir -p /tests /logs/verifier")
-
-        # Upload test files into the sandbox (binary-safe via base64)
-        if tests_tar:
-            tests_temp = Path(tempfile.mkdtemp(prefix=f"tb2-tests-{task_name}-"))
-            try:
-                _extract_base64_tar(tests_tar, tests_temp)
-                ctx.upload_dir(str(tests_temp), "/tests")
-            except Exception as e:
-                logger.warning("Task %s: failed to upload test files: %s", task_name, e)
-            finally:
-                shutil.rmtree(tests_temp, ignore_errors=True)
-
-        # Write the test runner script (test.sh)
-        ctx.write_file("/tests/test.sh", test_sh)
-        ctx.terminal("chmod +x /tests/test.sh")
-
-        # Execute the test suite
-        logger.info(
-            "Task %s: running test suite (timeout=%ds)",
-            task_name, self.config.test_timeout,
-        )
-        test_result = ctx.terminal(
-            "bash /tests/test.sh",
-            timeout=self.config.test_timeout,
-        )
-
-        exit_code = test_result.get("exit_code", -1)
-        output = test_result.get("output", "")
-
-        # Download the verifier output directory locally, then read reward.txt
-        # with native Python I/O. This avoids issues with file_read on the
-        # Modal VM and matches Harbor's verification pattern.
-        reward = 0.0
-        local_verifier_dir = Path(tempfile.mkdtemp(prefix=f"tb2-verifier-{task_name}-"))
-        try:
-            ctx.download_dir("/logs/verifier", str(local_verifier_dir))
-
-            reward_file = local_verifier_dir / "reward.txt"
-            if reward_file.exists() and reward_file.stat().st_size > 0:
-                content = reward_file.read_text().strip()
-                if content == "1":
-                    reward = 1.0
-                elif content == "0":
-                    reward = 0.0
-                else:
-                    # Unexpected content -- try parsing as float
-                    try:
-                        reward = float(content)
-                    except (ValueError, TypeError):
-                        logger.warning(
-                            "Task %s: reward.txt content unexpected (%r), "
-                            "falling back to exit_code=%d",
-                            task_name, content, exit_code,
-                        )
-                        reward = 1.0 if exit_code == 0 else 0.0
-            else:
-                # reward.txt not written -- fall back to exit code
-                logger.warning(
-                    "Task %s: reward.txt not found after download, "
-                    "falling back to exit_code=%d",
-                    task_name, exit_code,
-                )
-                reward = 1.0 if exit_code == 0 else 0.0
-        except Exception as e:
-            logger.warning(
-                "Task %s: failed to download verifier dir: %s, "
-                "falling back to exit_code=%d",
-                task_name, e, exit_code,
-            )
-            reward = 1.0 if exit_code == 0 else 0.0
-        finally:
-            shutil.rmtree(local_verifier_dir, ignore_errors=True)
-
-        # Log test output for debugging failures
-        if reward == 0.0:
-            output_preview = output[-500:] if output else "(no output)"
-            logger.info(
-                "Task %s: FAIL (exit_code=%d)\n%s",
-                task_name, exit_code, output_preview,
-            )
-
-        return reward
-
-    # =========================================================================
-    # Evaluate -- main entry point for the eval subcommand
-    # =========================================================================
-
-    async def _eval_with_timeout(self, item: Dict[str, Any]) -> Dict:
-        """
-        Wrap rollout_and_score_eval with a per-task wall-clock timeout.
-
-        If the task exceeds task_timeout seconds, it's automatically scored
-        as FAIL. This prevents any single task from hanging indefinitely.
-        """
-        task_name = item.get("task_name", "unknown")
-        category = item.get("category", "unknown")
-        try:
-            return await asyncio.wait_for(
-                self.rollout_and_score_eval(item),
-                timeout=self.config.task_timeout,
-            )
-        except asyncio.TimeoutError:
-            from tqdm import tqdm
-            elapsed = self.config.task_timeout
-            tqdm.write(f"  [TIMEOUT] {task_name} (exceeded {elapsed}s wall-clock limit)")
-            logger.error("Task %s: wall-clock timeout after %ds", task_name, elapsed)
-            out = {
-                "passed": False, "reward": 0.0,
-                "task_name": task_name, "category": category,
-                "error": f"timeout ({elapsed}s)",
-            }
-            self._save_result(out)
-            return out
-
-    async def evaluate(self, *args, **kwargs) -> None:
-        """
-        Run Terminal-Bench 2.0 evaluation over all tasks.
-
-        This is the main entry point when invoked via:
-            python environments/terminalbench2_env.py evaluate
-
-        Runs all tasks through rollout_and_score_eval() via asyncio.gather()
-        (same pattern as GPQA and other Atropos eval envs). Each task is
-        wrapped with a wall-clock timeout so hung tasks auto-fail.
-
-        Suppresses noisy Modal/terminal output (HERMES_QUIET) so the tqdm
-        bar stays visible.
-        """
-        start_time = time.time()
-
-        # Route all logging through tqdm.write() so the progress bar stays
-        # pinned at the bottom while log lines scroll above it.
-        from tqdm import tqdm
-
-        class _TqdmHandler(logging.Handler):
-            def emit(self, record):
-                try:
-                    tqdm.write(self.format(record))
-                except Exception:
-                    self.handleError(record)
-
-        handler = _TqdmHandler()
-        handler.setFormatter(logging.Formatter(
-            "%(asctime)s [%(name)s] %(levelname)s: %(message)s",
-            datefmt="%H:%M:%S",
-        ))
-        root = logging.getLogger()
-        root.handlers = [handler]  # Replace any existing handlers
-        root.setLevel(logging.INFO)
-
-        # Silence noisy third-party loggers that flood the output
-        logging.getLogger("httpx").setLevel(logging.WARNING)      # Every HTTP request
-        logging.getLogger("openai").setLevel(logging.WARNING)     # OpenAI client retries
-        logging.getLogger("rex-deploy").setLevel(logging.WARNING) # Swerex deployment
-        logging.getLogger("rex_image_builder").setLevel(logging.WARNING)  # Image builds
-
-        print(f"\n{'='*60}")
-        print("Starting Terminal-Bench 2.0 Evaluation")
-        print(f"{'='*60}")
-        print(f"  Dataset: {self.config.dataset_name}")
-        print(f"  Total tasks: {len(self.all_eval_items)}")
-        print(f"  Max agent turns: {self.config.max_agent_turns}")
-        print(f"  Task timeout: {self.config.task_timeout}s")
-        print(f"  Terminal backend: {self.config.terminal_backend}")
-        print(f"  Tool thread pool: {self.config.tool_pool_size}")
-        print(f"  Terminal timeout: {self.config.terminal_timeout}s/cmd")
-        print(f"  Terminal lifetime: {self.config.terminal_lifetime}s (auto: task_timeout + 120)")
-        print(f"{'='*60}\n")
-
-        # Fire all tasks with wall-clock timeout, track live accuracy on the bar
-        total_tasks = len(self.all_eval_items)
-        eval_tasks = [
-            asyncio.ensure_future(self._eval_with_timeout(item))
-            for item in self.all_eval_items
-        ]
-
-        results = []
-        passed_count = 0
-        pbar = tqdm(total=total_tasks, desc="Evaluating TB2", dynamic_ncols=True)
-        try:
-            for coro in asyncio.as_completed(eval_tasks):
-                result = await coro
-                results.append(result)
-                if result and result.get("passed"):
-                    passed_count += 1
-                done = len(results)
-                pct = (passed_count / done * 100) if done else 0
-                pbar.set_postfix_str(f"pass={passed_count}/{done} ({pct:.1f}%)")
-                pbar.update(1)
-        except (KeyboardInterrupt, asyncio.CancelledError):
-            pbar.close()
-            print(f"\n\nInterrupted! Cleaning up {len(eval_tasks)} tasks...")
-            # Cancel all pending tasks
-            for task in eval_tasks:
-                task.cancel()
-            # Let cancellations propagate (finally blocks run cleanup_vm)
-            await asyncio.gather(*eval_tasks, return_exceptions=True)
-            # Belt-and-suspenders: clean up any remaining sandboxes
-            from tools.terminal_tool import cleanup_all_environments
-            cleanup_all_environments()
-            print("All sandboxes cleaned up.")
-            return
-        finally:
-            pbar.close()
-
-        end_time = time.time()
-
-        # Filter out None results (shouldn't happen, but be safe)
-        valid_results = [r for r in results if r is not None]
-
-        if not valid_results:
-            print("Warning: No valid evaluation results obtained")
-            return
-
-        # ---- Compute metrics ----
-        total = len(valid_results)
-        passed = sum(1 for r in valid_results if r.get("passed"))
-        overall_pass_rate = passed / total if total > 0 else 0.0
-
-        # Per-category breakdown
-        cat_results: Dict[str, List[Dict]] = defaultdict(list)
-        for r in valid_results:
-            cat_results[r.get("category", "unknown")].append(r)
-
-        # Build metrics dict
-        eval_metrics = {
-            "eval/pass_rate": overall_pass_rate,
-            "eval/total_tasks": total,
-            "eval/passed_tasks": passed,
-            "eval/evaluation_time_seconds": end_time - start_time,
-        }
-
-        # Per-category metrics
-        for category, cat_items in sorted(cat_results.items()):
-            cat_passed = sum(1 for r in cat_items if r.get("passed"))
-            cat_total = len(cat_items)
-            cat_pass_rate = cat_passed / cat_total if cat_total > 0 else 0.0
-            cat_key = category.replace(" ", "_").replace("-", "_").lower()
-            eval_metrics[f"eval/pass_rate_{cat_key}"] = cat_pass_rate
-
-        # Store metrics for wandb_log
-        self.eval_metrics = [(k, v) for k, v in eval_metrics.items()]
-
-        # ---- Print summary ----
-        print(f"\n{'='*60}")
-        print("Terminal-Bench 2.0 Evaluation Results")
-        print(f"{'='*60}")
-        print(f"Overall Pass Rate: {overall_pass_rate:.4f} ({passed}/{total})")
-        print(f"Evaluation Time: {end_time - start_time:.1f} seconds")
-
-        print("\nCategory Breakdown:")
-        for category, cat_items in sorted(cat_results.items()):
-            cat_passed = sum(1 for r in cat_items if r.get("passed"))
-            cat_total = len(cat_items)
-            cat_rate = cat_passed / cat_total if cat_total > 0 else 0.0
-            print(f"  {category}: {cat_rate:.1%} ({cat_passed}/{cat_total})")
-
-        # Print individual task results
-        print("\nTask Results:")
-        for r in sorted(valid_results, key=lambda x: x.get("task_name", "")):
-            status = "PASS" if r.get("passed") else "FAIL"
-            turns = r.get("turns_used", "?")
-            error = r.get("error", "")
-            extra = f" (error: {error})" if error else ""
-            print(f"  [{status}] {r['task_name']} (turns={turns}){extra}")
-
-        print(f"{'='*60}\n")
-
-        # Build sample records for evaluate_log (includes full conversations)
-        samples = [
-            {
-                "task_name": r.get("task_name"),
-                "category": r.get("category"),
-                "passed": r.get("passed"),
-                "reward": r.get("reward"),
-                "turns_used": r.get("turns_used"),
-                "error": r.get("error"),
-                "messages": r.get("messages"),
-            }
-            for r in valid_results
-        ]
-
-        # Log evaluation results
-        try:
-            await self.evaluate_log(
-                metrics=eval_metrics,
-                samples=samples,
-                start_time=start_time,
-                end_time=end_time,
-                generation_parameters={
-                    "temperature": self.config.agent_temperature,
-                    "max_tokens": self.config.max_token_length,
-                    "max_agent_turns": self.config.max_agent_turns,
-                    "terminal_backend": self.config.terminal_backend,
-                },
-            )
-        except Exception as e:
-            print(f"Error logging evaluation results: {e}")
-
-        # Close streaming file
-        if hasattr(self, "_streaming_file") and not self._streaming_file.closed:
-            self._streaming_file.close()
-            print(f"  Live results saved to: {self._streaming_path}")
-
-        # Kill all remaining sandboxes. Timed-out tasks leave orphaned thread
-        # pool workers still executing commands -- cleanup_all stops them.
-        from tools.terminal_tool import cleanup_all_environments
-        print("\nCleaning up all sandboxes...")
-        cleanup_all_environments()
-
-        # Shut down the tool thread pool so orphaned workers from timed-out
-        # tasks are killed immediately instead of retrying against dead
-        # sandboxes and spamming the console with TimeoutError warnings.
-        from environments.agent_loop import _tool_executor
-        _tool_executor.shutdown(wait=False, cancel_futures=True)
-        print("Done.")
-
-    # =========================================================================
-    # Wandb logging
-    # =========================================================================
-
-    async def wandb_log(self, wandb_metrics: Optional[Dict] = None):
-        """Log TB2-specific metrics to wandb."""
-        if wandb_metrics is None:
-            wandb_metrics = {}
-
-        # Add stored eval metrics
-        for metric_name, metric_value in self.eval_metrics:
-            wandb_metrics[metric_name] = metric_value
-        self.eval_metrics = []
-
-        await super().wandb_log(wandb_metrics)
-
-
-if __name__ == "__main__":
-    TerminalBench2EvalEnv.cli()

environments/hermes_base_env.py

@@ -229,6 +229,12 @@ class HermesAgentBaseEnv(BaseEnv):
         from environments.agent_loop import resize_tool_pool
         resize_tool_pool(config.tool_pool_size)
 
+        # Set tool_parser on the ServerManager so ManagedServer uses it
+        # for bidirectional tool call translation (raw text ↔ OpenAI tool_calls).
+        if hasattr(self.server, 'tool_parser'):
+            self.server.tool_parser = config.tool_call_parser
+            print(f"🔧 Tool parser: {config.tool_call_parser}")
+
         # Current group's resolved tools (set in collect_trajectories)
         self._current_group_tools: Optional[Tuple[List[Dict], Set[str]]] = None
 
@@ -466,22 +472,14 @@ class HermesAgentBaseEnv(BaseEnv):
         # Run the agent loop
         result: AgentResult
         if self._use_managed_server():
-            # Phase 2: ManagedServer with parser -- exact tokens + logprobs
-            # Load the tool call parser from registry based on config
-            from environments.tool_call_parsers import get_parser
-            try:
-                tc_parser = get_parser(self.config.tool_call_parser)
-            except KeyError:
-                logger.warning(
-                    "Tool call parser '%s' not found, falling back to 'hermes'",
-                    self.config.tool_call_parser,
-                )
-                tc_parser = get_parser("hermes")
-
+            # Phase 2: ManagedServer with ToolCallTranslator -- exact tokens + logprobs
+            # tool_parser is set on ServerManager in __init__ and passed through
+            # to ManagedServer, which uses ToolCallTranslator for bidirectional
+            # translation between raw text and OpenAI tool_calls.
             try:
                 async with self.server.managed_server(
                     tokenizer=self.tokenizer,
-                    tool_call_parser=tc_parser,
+                    preserve_think_blocks=bool(self.config.thinking_mode),
                 ) as managed:
                     agent = HermesAgentLoop(
                         server=managed,

environments/patches.py

@@ -114,11 +114,27 @@ def _patch_swerex_modal():
         self._worker = _AsyncWorker()
         self._worker.start()
 
+        # Pre-build a modal.Image with pip fix for Modal's legacy image builder.
+        # Modal requires `python -m pip` to work during image build, but some
+        # task images (e.g., TBLite's broken-python) have intentionally broken pip.
+        # Fix: remove stale pip dist-info and reinstall via ensurepip before Modal
+        # tries to use it. This is a no-op for images where pip already works.
+        import modal as _modal
+        image_spec = self.config.image
+        if isinstance(image_spec, str):
+            image_spec = _modal.Image.from_registry(
+                image_spec,
+                setup_dockerfile_commands=[
+                    "RUN rm -rf /usr/local/lib/python*/site-packages/pip* 2>/dev/null; "
+                    "python -m ensurepip --upgrade --default-pip 2>/dev/null || true",
+                ],
+            )
+
         # Create AND start the deployment entirely on the worker's loop/thread
         # so all gRPC channels and async state are bound to that loop
         async def _create_and_start():
             deployment = ModalDeployment(
-                image=self.config.image,
+                image=image_spec,
                 startup_timeout=self.config.startup_timeout,
                 runtime_timeout=self.config.runtime_timeout,
                 deployment_timeout=self.config.deployment_timeout,

environments/web_research_env.py

@@ -356,10 +356,19 @@ class WebResearchEnv(HermesAgentBaseEnv):
           efficiency_weight  * efficiency   — penalizes wasteful tool usage
           + diversity_bonus                 — source diversity (≥2 distinct domains)
         """
-        final_response: str = result.final_response or ""
-        tools_used: list[str] = [
-            tc.tool_name for tc in (result.tool_calls or [])
-        ] if hasattr(result, "tool_calls") and result.tool_calls else []
+        # Extract final response from messages (last assistant message with content)
+        final_response = ""
+        tools_used: list[str] = []
+        for msg in reversed(result.messages):
+            if msg.get("role") == "assistant" and msg.get("content") and not final_response:
+                final_response = msg["content"]
+            # Collect tool names from tool call messages
+            if msg.get("role") == "assistant" and msg.get("tool_calls"):
+                for tc in msg["tool_calls"]:
+                    fn = tc.get("function", {}) if isinstance(tc, dict) else {}
+                    name = fn.get("name", "")
+                    if name:
+                        tools_used.append(name)
         tool_call_count: int = result.turns_used or len(tools_used)
 
         cfg = self.config
@@ -416,8 +425,16 @@ class WebResearchEnv(HermesAgentBaseEnv):
     # ------------------------------------------------------------------
 
     async def evaluate(self, *args, **kwargs) -> None:
-        """Run evaluation on the held-out split using the agent loop."""
+        """Run evaluation on the held-out split using the full agent loop with tools.
+
+        Each eval item runs through the same agent loop as training —
+        the model can use web_search, web_extract, etc. to research answers.
+        This measures actual agentic research capability, not just knowledge.
+        """
         import time
+        import uuid
+        from environments.agent_loop import HermesAgentLoop
+        from environments.tool_context import ToolContext
 
         items = self._eval_items
         if not items:
@@ -427,43 +444,88 @@ class WebResearchEnv(HermesAgentBaseEnv):
         eval_size = min(self.config.eval_size, len(items))
         eval_items = items[:eval_size]
 
-        logger.info(f"Running eval on {len(eval_items)} questions...")
+        logger.info(f"Running eval on {len(eval_items)} questions (with agent loop + tools)...")
         start_time = time.time()
         samples = []
 
-        for item in eval_items:
+        # Resolve tools once for all eval items
+        tools, valid_names = self._resolve_tools_for_group()
+
+        for i, item in enumerate(eval_items):
+            task_id = str(uuid.uuid4())
+            logger.info(f"Eval [{i+1}/{len(eval_items)}]: {item['question'][:80]}...")
+
             try:
-                # Use the base env's agent loop for eval (same as training)
-                prompt = self.format_prompt(item)
-                completion = await self.server.chat_completion(
-                    messages=[
-                        {"role": "system", "content": self.config.system_prompt or ""},
-                        {"role": "user", "content": prompt},
-                    ],
-                    n=1,
+                # Build messages
+                messages: List[Dict[str, Any]] = []
+                if self.config.system_prompt:
+                    messages.append({"role": "system", "content": self.config.system_prompt})
+                messages.append({"role": "user", "content": self.format_prompt(item)})
+
+                # Run the full agent loop with tools
+                agent = HermesAgentLoop(
+                    server=self.server,
+                    tool_schemas=tools,
+                    valid_tool_names=valid_names,
+                    max_turns=self.config.max_agent_turns,
+                    task_id=task_id,
+                    temperature=0.0,  # Deterministic for eval
                     max_tokens=self.config.max_token_length,
-                    temperature=0.0,
-                    split="eval",
+                    extra_body=self.config.extra_body,
                 )
+                result = await agent.run(messages)
 
-                response_content = (
-                    completion.choices[0].message.content if completion.choices else ""
-                )
+                # Extract final response and tool usage from messages
+                final_response = ""
+                tool_call_count = 0
+                for msg in reversed(result.messages):
+                    if msg.get("role") == "assistant" and msg.get("content") and not final_response:
+                        final_response = msg["content"]
+                    if msg.get("role") == "assistant" and msg.get("tool_calls"):
+                        tool_call_count += len(msg["tool_calls"])
 
-                # Score the response
-                correctness = await self._llm_judge(
-                    question=item["question"],
-                    expected=item["answer"],
-                    model_answer=response_content,
+                # Compute reward (includes LLM judge for correctness)
+                # Temporarily save buffer lengths so we can extract the
+                # correctness score without calling judge twice, and avoid
+                # polluting training metric buffers with eval data.
+                buf_len = len(self._correctness_buffer)
+                ctx = ToolContext(task_id)
+                try:
+                    reward = await self.compute_reward(item, result, ctx)
+                finally:
+                    ctx.cleanup()
+
+                # Extract correctness from the buffer (compute_reward appended it)
+                # then remove eval entries from training buffers
+                correctness = (
+                    self._correctness_buffer[buf_len]
+                    if len(self._correctness_buffer) > buf_len
+                    else 0.0
                 )
+                # Roll back buffers to avoid polluting training metrics
+                for buf in (
+                    self._reward_buffer, self._correctness_buffer,
+                    self._tool_usage_buffer, self._efficiency_buffer,
+                    self._diversity_buffer,
+                ):
+                    if len(buf) > buf_len:
+                        buf.pop()
 
                 samples.append({
                     "prompt": item["question"],
-                    "response": response_content,
+                    "response": final_response[:500],
                     "expected": item["answer"],
                     "correctness": correctness,
+                    "reward": reward,
+                    "tool_calls": tool_call_count,
+                    "turns": result.turns_used,
                 })
 
+                logger.info(
+                    f"  → correctness={correctness:.2f}, reward={reward:.3f}, "
+                    f"tools={tool_call_count}, turns={result.turns_used}"
+                )
+
             except Exception as e:
                 logger.error(f"Eval error on item: {e}")
                 samples.append({
@@ -471,20 +533,33 @@ class WebResearchEnv(HermesAgentBaseEnv):
                     "response": f"ERROR: {e}",
                     "expected": item["answer"],
                     "correctness": 0.0,
+                    "reward": 0.0,
+                    "tool_calls": 0,
+                    "turns": 0,
                 })
 
         end_time = time.time()
 
-        # Compute metrics
+        # Compute aggregate metrics
         correctness_scores = [s["correctness"] for s in samples]
+        rewards = [s["reward"] for s in samples]
+        tool_counts = [s["tool_calls"] for s in samples]
+        n = len(samples)
+
         eval_metrics = {
-            "eval/mean_correctness": (
-                sum(correctness_scores) / len(correctness_scores)
-                if correctness_scores else 0.0
-            ),
-            "eval/n_items": len(samples),
+            "eval/mean_correctness": sum(correctness_scores) / n if n else 0.0,
+            "eval/mean_reward": sum(rewards) / n if n else 0.0,
+            "eval/mean_tool_calls": sum(tool_counts) / n if n else 0.0,
+            "eval/tool_usage_rate": sum(1 for t in tool_counts if t > 0) / n if n else 0.0,
+            "eval/n_items": n,
         }
 
+        logger.info(
+            f"Eval complete — correctness={eval_metrics['eval/mean_correctness']:.3f}, "
+            f"reward={eval_metrics['eval/mean_reward']:.3f}, "
+            f"tool_usage={eval_metrics['eval/tool_usage_rate']:.0%}"
+        )
+
         await self.evaluate_log(
             metrics=eval_metrics,
             samples=samples,

gateway/__init__.py

@@ -9,18 +9,19 @@ to various messaging platforms (Telegram, Discord, WhatsApp) with:
 - Platform-specific toolsets (different capabilities per platform)
 """
 
-from .config import GatewayConfig, HomeChannel, PlatformConfig, SessionResetPolicy, load_gateway_config
-from .delivery import DeliveryRouter, DeliveryTarget
+from .config import GatewayConfig, PlatformConfig, HomeChannel, load_gateway_config
 from .session import (
     SessionContext,
     SessionStore,
+    SessionResetPolicy,
     build_session_context_prompt,
 )
+from .delivery import DeliveryRouter, DeliveryTarget
 
 __all__ = [
     # Config
     "GatewayConfig",
-    "PlatformConfig",
+    "PlatformConfig", 
     "HomeChannel",
     "load_gateway_config",
     # Session

gateway/channel_directory.py

@@ -10,19 +10,38 @@ import json
 import logging
 from datetime import datetime
 from pathlib import Path
-from typing import Any
+from typing import Any, Dict, List, Optional
 
 logger = logging.getLogger(__name__)
 
 DIRECTORY_PATH = Path.home() / ".hermes" / "channel_directory.json"
 
 
+def _session_entry_id(origin: Dict[str, Any]) -> Optional[str]:
+    chat_id = origin.get("chat_id")
+    if not chat_id:
+        return None
+    thread_id = origin.get("thread_id")
+    if thread_id:
+        return f"{chat_id}:{thread_id}"
+    return str(chat_id)
+
+
+def _session_entry_name(origin: Dict[str, Any]) -> str:
+    base_name = origin.get("chat_name") or origin.get("user_name") or str(origin.get("chat_id"))
+    thread_id = origin.get("thread_id")
+    if not thread_id:
+        return base_name
+
+    topic_label = origin.get("chat_topic") or f"topic {thread_id}"
+    return f"{base_name} / {topic_label}"
+
+
 # ---------------------------------------------------------------------------
 # Build / refresh
 # ---------------------------------------------------------------------------
 
-
-def build_channel_directory(adapters: dict[Any, Any]) -> dict[str, Any]:
+def build_channel_directory(adapters: Dict[Any, Any]) -> Dict[str, Any]:
     """
     Build a channel directory from connected platform adapters and session data.
 
@@ -30,7 +49,7 @@ def build_channel_directory(adapters: dict[Any, Any]) -> dict[str, Any]:
     """
     from gateway.config import Platform
 
-    platforms: dict[str, list[dict[str, str]]] = {}
+    platforms: Dict[str, List[Dict[str, str]]] = {}
 
     for platform, adapter in adapters.items():
         try:
@@ -42,7 +61,7 @@ def build_channel_directory(adapters: dict[Any, Any]) -> dict[str, Any]:
             logger.warning("Channel directory: failed to build %s: %s", platform.value, e)
 
     # Telegram, WhatsApp & Signal can't enumerate chats -- pull from session history
-    for plat_name in ("telegram", "whatsapp", "signal"):
+    for plat_name in ("telegram", "whatsapp", "signal", "email"):
         if plat_name not in platforms:
             platforms[plat_name] = _build_from_sessions(plat_name)
 
@@ -61,7 +80,7 @@ def build_channel_directory(adapters: dict[Any, Any]) -> dict[str, Any]:
     return directory
 
 
-def _build_discord(adapter) -> list[dict[str, str]]:
+def _build_discord(adapter) -> List[Dict[str, str]]:
     """Enumerate all text channels the Discord bot can see."""
     channels = []
     client = getattr(adapter, "_client", None)
@@ -75,14 +94,12 @@ def _build_discord(adapter) -> list[dict[str, str]]:
 
     for guild in client.guilds:
         for ch in guild.text_channels:
-            channels.append(
-                {
-                    "id": str(ch.id),
-                    "name": ch.name,
-                    "guild": guild.name,
-                    "type": "channel",
-                }
-            )
+            channels.append({
+                "id": str(ch.id),
+                "name": ch.name,
+                "guild": guild.name,
+                "type": "channel",
+            })
         # Also include DM-capable users we've interacted with is not
         # feasible via guild enumeration; those come from sessions.
 
@@ -91,7 +108,7 @@ def _build_discord(adapter) -> list[dict[str, str]]:
     return channels
 
 
-def _build_slack(adapter) -> list[dict[str, str]]:
+def _build_slack(adapter) -> List[Dict[str, str]]:
     """List Slack channels the bot has joined."""
     channels = []
     # Slack adapter may expose a web client
@@ -100,6 +117,7 @@ def _build_slack(adapter) -> list[dict[str, str]]:
         return _build_from_sessions("slack")
 
     try:
+        import asyncio
         from tools.send_message_tool import _send_slack  # noqa: F401
         # Use the Slack Web API directly if available
     except Exception:
@@ -109,7 +127,7 @@ def _build_slack(adapter) -> list[dict[str, str]]:
     return _build_from_sessions("slack")
 
 
-def _build_from_sessions(platform_name: str) -> list[dict[str, str]]:
+def _build_from_sessions(platform_name: str) -> List[Dict[str, str]]:
     """Pull known channels/contacts from sessions.json origin data."""
     sessions_path = Path.home() / ".hermes" / "sessions" / "sessions.json"
     if not sessions_path.exists():
@@ -125,17 +143,16 @@ def _build_from_sessions(platform_name: str) -> list[dict[str, str]]:
             origin = session.get("origin") or {}
             if origin.get("platform") != platform_name:
                 continue
-            chat_id = origin.get("chat_id")
-            if not chat_id or chat_id in seen_ids:
+            entry_id = _session_entry_id(origin)
+            if not entry_id or entry_id in seen_ids:
                 continue
-            seen_ids.add(chat_id)
-            entries.append(
-                {
-                    "id": str(chat_id),
-                    "name": origin.get("chat_name") or origin.get("user_name") or str(chat_id),
-                    "type": session.get("chat_type", "dm"),
-                }
-            )
+            seen_ids.add(entry_id)
+            entries.append({
+                "id": entry_id,
+                "name": _session_entry_name(origin),
+                "type": session.get("chat_type", "dm"),
+                "thread_id": origin.get("thread_id"),
+            })
     except Exception as e:
         logger.debug("Channel directory: failed to read sessions for %s: %s", platform_name, e)
 
@@ -146,8 +163,7 @@ def _build_from_sessions(platform_name: str) -> list[dict[str, str]]:
 # Read / resolve
 # ---------------------------------------------------------------------------
 
-
-def load_directory() -> dict[str, Any]:
+def load_directory() -> Dict[str, Any]:
     """Load the cached channel directory from disk."""
     if not DIRECTORY_PATH.exists():
         return {"updated_at": None, "platforms": {}}
@@ -158,7 +174,7 @@ def load_directory() -> dict[str, Any]:
         return {"updated_at": None, "platforms": {}}
 
 
-def resolve_channel_name(platform_name: str, name: str) -> str | None:
+def resolve_channel_name(platform_name: str, name: str) -> Optional[str]:
     """
     Resolve a human-friendly channel name to a numeric ID.
 
@@ -211,8 +227,8 @@ def format_directory_for_display() -> str:
 
         # Group Discord channels by guild
         if plat_name == "discord":
-            guilds: dict[str, list] = {}
-            dms: list = []
+            guilds: Dict[str, List] = {}
+            dms: List = []
             for ch in channels:
                 guild = ch.get("guild")
                 if guild:

gateway/config.py

@@ -8,20 +8,19 @@ Handles loading and validating configuration for:
 - Delivery preferences
 """
 
-import json
 import logging
 import os
-from dataclasses import dataclass, field
-from enum import Enum
+import json
 from pathlib import Path
-from typing import Any
+from dataclasses import dataclass, field
+from typing import Dict, List, Optional, Any
+from enum import Enum
 
 logger = logging.getLogger(__name__)
 
 
 class Platform(Enum):
     """Supported messaging platforms."""
-
     LOCAL = "local"
     TELEGRAM = "telegram"
     DISCORD = "discord"
@@ -29,30 +28,30 @@ class Platform(Enum):
     SLACK = "slack"
     SIGNAL = "signal"
     HOMEASSISTANT = "homeassistant"
+    EMAIL = "email"
 
 
 @dataclass
 class HomeChannel:
     """
     Default destination for a platform.
-
+    
     When a cron job specifies deliver="telegram" without a specific chat ID,
     messages are sent to this home channel.
     """
-
     platform: Platform
     chat_id: str
     name: str  # Human-readable name for display
-
-    def to_dict(self) -> dict[str, Any]:
+    
+    def to_dict(self) -> Dict[str, Any]:
         return {
             "platform": self.platform.value,
             "chat_id": self.chat_id,
             "name": self.name,
         }
-
+    
     @classmethod
-    def from_dict(cls, data: dict[str, Any]) -> "HomeChannel":
+    def from_dict(cls, data: Dict[str, Any]) -> "HomeChannel":
         return cls(
             platform=Platform(data["platform"]),
             chat_id=str(data["chat_id"]),
@@ -64,27 +63,26 @@ class HomeChannel:
 class SessionResetPolicy:
     """
     Controls when sessions reset (lose context).
-
+    
     Modes:
     - "daily": Reset at a specific hour each day
     - "idle": Reset after N minutes of inactivity
     - "both": Whichever triggers first (daily boundary OR idle timeout)
     - "none": Never auto-reset (context managed only by compression)
     """
-
     mode: str = "both"  # "daily", "idle", "both", or "none"
     at_hour: int = 4  # Hour for daily reset (0-23, local time)
     idle_minutes: int = 1440  # Minutes of inactivity before reset (24 hours)
-
-    def to_dict(self) -> dict[str, Any]:
+    
+    def to_dict(self) -> Dict[str, Any]:
         return {
             "mode": self.mode,
             "at_hour": self.at_hour,
             "idle_minutes": self.idle_minutes,
         }
-
+    
     @classmethod
-    def from_dict(cls, data: dict[str, Any]) -> "SessionResetPolicy":
+    def from_dict(cls, data: Dict[str, Any]) -> "SessionResetPolicy":
         return cls(
             mode=data.get("mode", "both"),
             at_hour=data.get("at_hour", 4),
@@ -95,16 +93,15 @@ class SessionResetPolicy:
 @dataclass
 class PlatformConfig:
     """Configuration for a single messaging platform."""
-
     enabled: bool = False
-    token: str | None = None  # Bot token (Telegram, Discord)
-    api_key: str | None = None  # API key if different from token
-    home_channel: HomeChannel | None = None
-
+    token: Optional[str] = None  # Bot token (Telegram, Discord)
+    api_key: Optional[str] = None  # API key if different from token
+    home_channel: Optional[HomeChannel] = None
+    
     # Platform-specific settings
-    extra: dict[str, Any] = field(default_factory=dict)
-
-    def to_dict(self) -> dict[str, Any]:
+    extra: Dict[str, Any] = field(default_factory=dict)
+    
+    def to_dict(self) -> Dict[str, Any]:
         result = {
             "enabled": self.enabled,
             "extra": self.extra,
@@ -116,13 +113,13 @@ class PlatformConfig:
         if self.home_channel:
             result["home_channel"] = self.home_channel.to_dict()
         return result
-
+    
     @classmethod
-    def from_dict(cls, data: dict[str, Any]) -> "PlatformConfig":
+    def from_dict(cls, data: Dict[str, Any]) -> "PlatformConfig":
         home_channel = None
         if "home_channel" in data:
             home_channel = HomeChannel.from_dict(data["home_channel"])
-
+        
         return cls(
             enabled=data.get("enabled", False),
             token=data.get("token"),
@@ -136,80 +133,92 @@ class PlatformConfig:
 class GatewayConfig:
     """
     Main gateway configuration.
-
+    
     Manages all platform connections, session policies, and delivery settings.
     """
-
     # Platform configurations
-    platforms: dict[Platform, PlatformConfig] = field(default_factory=dict)
-
+    platforms: Dict[Platform, PlatformConfig] = field(default_factory=dict)
+    
     # Session reset policies by type
     default_reset_policy: SessionResetPolicy = field(default_factory=SessionResetPolicy)
-    reset_by_type: dict[str, SessionResetPolicy] = field(default_factory=dict)
-    reset_by_platform: dict[Platform, SessionResetPolicy] = field(default_factory=dict)
-
+    reset_by_type: Dict[str, SessionResetPolicy] = field(default_factory=dict)
+    reset_by_platform: Dict[Platform, SessionResetPolicy] = field(default_factory=dict)
+    
     # Reset trigger commands
-    reset_triggers: list[str] = field(default_factory=lambda: ["/new", "/reset"])
-
+    reset_triggers: List[str] = field(default_factory=lambda: ["/new", "/reset"])
+    
     # Storage paths
     sessions_dir: Path = field(default_factory=lambda: Path.home() / ".hermes" / "sessions")
-
+    
     # Delivery settings
     always_log_local: bool = True  # Always save cron outputs to local files
-
-    def get_connected_platforms(self) -> list[Platform]:
+    
+    def get_connected_platforms(self) -> List[Platform]:
         """Return list of platforms that are enabled and configured."""
         connected = []
         for platform, config in self.platforms.items():
             if not config.enabled:
                 continue
             # Platforms that use token/api_key auth
-            if (
-                config.token
-                or config.api_key
-                or platform == Platform.WHATSAPP
-                or platform == Platform.SIGNAL
-                and config.extra.get("http_url")
-            ):
+            if config.token or config.api_key:
+                connected.append(platform)
+            # WhatsApp uses enabled flag only (bridge handles auth)
+            elif platform == Platform.WHATSAPP:
+                connected.append(platform)
+            # Signal uses extra dict for config (http_url + account)
+            elif platform == Platform.SIGNAL and config.extra.get("http_url"):
+                connected.append(platform)
+            # Email uses extra dict for config (address + imap_host + smtp_host)
+            elif platform == Platform.EMAIL and config.extra.get("address"):
                 connected.append(platform)
         return connected
-
-    def get_home_channel(self, platform: Platform) -> HomeChannel | None:
+    
+    def get_home_channel(self, platform: Platform) -> Optional[HomeChannel]:
         """Get the home channel for a platform."""
         config = self.platforms.get(platform)
         if config:
             return config.home_channel
         return None
-
-    def get_reset_policy(self, platform: Platform | None = None, session_type: str | None = None) -> SessionResetPolicy:
+    
+    def get_reset_policy(
+        self, 
+        platform: Optional[Platform] = None,
+        session_type: Optional[str] = None
+    ) -> SessionResetPolicy:
         """
         Get the appropriate reset policy for a session.
-
+        
         Priority: platform override > type override > default
         """
         # Platform-specific override takes precedence
         if platform and platform in self.reset_by_platform:
             return self.reset_by_platform[platform]
-
+        
         # Type-specific override (dm, group, thread)
         if session_type and session_type in self.reset_by_type:
             return self.reset_by_type[session_type]
-
+        
         return self.default_reset_policy
-
-    def to_dict(self) -> dict[str, Any]:
+    
+    def to_dict(self) -> Dict[str, Any]:
         return {
-            "platforms": {p.value: c.to_dict() for p, c in self.platforms.items()},
+            "platforms": {
+                p.value: c.to_dict() for p, c in self.platforms.items()
+            },
             "default_reset_policy": self.default_reset_policy.to_dict(),
-            "reset_by_type": {k: v.to_dict() for k, v in self.reset_by_type.items()},
-            "reset_by_platform": {p.value: v.to_dict() for p, v in self.reset_by_platform.items()},
+            "reset_by_type": {
+                k: v.to_dict() for k, v in self.reset_by_type.items()
+            },
+            "reset_by_platform": {
+                p.value: v.to_dict() for p, v in self.reset_by_platform.items()
+            },
             "reset_triggers": self.reset_triggers,
             "sessions_dir": str(self.sessions_dir),
             "always_log_local": self.always_log_local,
         }
-
+    
     @classmethod
-    def from_dict(cls, data: dict[str, Any]) -> "GatewayConfig":
+    def from_dict(cls, data: Dict[str, Any]) -> "GatewayConfig":
         platforms = {}
         for platform_name, platform_data in data.get("platforms", {}).items():
             try:
@@ -217,11 +226,11 @@ class GatewayConfig:
                 platforms[platform] = PlatformConfig.from_dict(platform_data)
             except ValueError:
                 pass  # Skip unknown platforms
-
+        
         reset_by_type = {}
         for type_name, policy_data in data.get("reset_by_type", {}).items():
             reset_by_type[type_name] = SessionResetPolicy.from_dict(policy_data)
-
+        
         reset_by_platform = {}
         for platform_name, policy_data in data.get("reset_by_platform", {}).items():
             try:
@@ -229,15 +238,15 @@ class GatewayConfig:
                 reset_by_platform[platform] = SessionResetPolicy.from_dict(policy_data)
             except ValueError:
                 pass
-
+        
         default_policy = SessionResetPolicy()
         if "default_reset_policy" in data:
             default_policy = SessionResetPolicy.from_dict(data["default_reset_policy"])
-
+        
         sessions_dir = Path.home() / ".hermes" / "sessions"
         if "sessions_dir" in data:
             sessions_dir = Path(data["sessions_dir"])
-
+        
         return cls(
             platforms=platforms,
             default_reset_policy=default_policy,
@@ -252,7 +261,7 @@ class GatewayConfig:
 def load_gateway_config() -> GatewayConfig:
     """
     Load gateway configuration from multiple sources.
-
+    
     Priority (highest to lowest):
     1. Environment variables
     2. ~/.hermes/gateway.json
@@ -260,41 +269,54 @@ def load_gateway_config() -> GatewayConfig:
     4. Defaults
     """
     config = GatewayConfig()
-
+    
     # Try loading from ~/.hermes/gateway.json
     gateway_config_path = Path.home() / ".hermes" / "gateway.json"
     if gateway_config_path.exists():
         try:
-            with open(gateway_config_path) as f:
+            with open(gateway_config_path, "r", encoding="utf-8") as f:
                 data = json.load(f)
                 config = GatewayConfig.from_dict(data)
         except Exception as e:
             print(f"[gateway] Warning: Failed to load {gateway_config_path}: {e}")
-
+    
     # Bridge session_reset from config.yaml (the user-facing config file)
     # into the gateway config. config.yaml takes precedence over gateway.json
     # for session reset policy since that's where hermes setup writes it.
     try:
         import yaml
-
         config_yaml_path = Path.home() / ".hermes" / "config.yaml"
         if config_yaml_path.exists():
-            with open(config_yaml_path) as f:
+            with open(config_yaml_path, encoding="utf-8") as f:
                 yaml_cfg = yaml.safe_load(f) or {}
             sr = yaml_cfg.get("session_reset")
             if sr and isinstance(sr, dict):
                 config.default_reset_policy = SessionResetPolicy.from_dict(sr)
+
+            # Bridge discord settings from config.yaml to env vars
+            # (env vars take precedence — only set if not already defined)
+            discord_cfg = yaml_cfg.get("discord", {})
+            if isinstance(discord_cfg, dict):
+                if "require_mention" in discord_cfg and not os.getenv("DISCORD_REQUIRE_MENTION"):
+                    os.environ["DISCORD_REQUIRE_MENTION"] = str(discord_cfg["require_mention"]).lower()
+                frc = discord_cfg.get("free_response_channels")
+                if frc is not None and not os.getenv("DISCORD_FREE_RESPONSE_CHANNELS"):
+                    if isinstance(frc, list):
+                        frc = ",".join(str(v) for v in frc)
+                    os.environ["DISCORD_FREE_RESPONSE_CHANNELS"] = str(frc)
     except Exception:
         pass
 
     # Override with environment variables
     _apply_env_overrides(config)
-
+    
     # --- Validate loaded values ---
     policy = config.default_reset_policy
 
     if not (0 <= policy.at_hour <= 23):
-        logger.warning("Invalid at_hour=%s (must be 0-23). Using default 4.", policy.at_hour)
+        logger.warning(
+            "Invalid at_hour=%s (must be 0-23). Using default 4.", policy.at_hour
+        )
         policy.at_hour = 4
 
     if policy.idle_minutes is None or policy.idle_minutes <= 0:
@@ -317,9 +339,9 @@ def load_gateway_config() -> GatewayConfig:
         env_name = _token_env_names.get(platform)
         if env_name and pconfig.token is not None and not pconfig.token.strip():
             logger.warning(
-                "%s is enabled but %s is empty. The adapter will likely fail to connect.",
-                platform.value,
-                env_name,
+                "%s is enabled but %s is empty. "
+                "The adapter will likely fail to connect.",
+                platform.value, env_name,
             )
 
     return config
@@ -327,7 +349,7 @@ def load_gateway_config() -> GatewayConfig:
 
 def _apply_env_overrides(config: GatewayConfig) -> None:
     """Apply environment variable overrides to config."""
-
+    
     # Telegram
     telegram_token = os.getenv("TELEGRAM_BOT_TOKEN")
     if telegram_token:
@@ -335,7 +357,7 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
             config.platforms[Platform.TELEGRAM] = PlatformConfig()
         config.platforms[Platform.TELEGRAM].enabled = True
         config.platforms[Platform.TELEGRAM].token = telegram_token
-
+    
     telegram_home = os.getenv("TELEGRAM_HOME_CHANNEL")
     if telegram_home and Platform.TELEGRAM in config.platforms:
         config.platforms[Platform.TELEGRAM].home_channel = HomeChannel(
@@ -343,7 +365,7 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
             chat_id=telegram_home,
             name=os.getenv("TELEGRAM_HOME_CHANNEL_NAME", "Home"),
         )
-
+    
     # Discord
     discord_token = os.getenv("DISCORD_BOT_TOKEN")
     if discord_token:
@@ -351,7 +373,7 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
             config.platforms[Platform.DISCORD] = PlatformConfig()
         config.platforms[Platform.DISCORD].enabled = True
         config.platforms[Platform.DISCORD].token = discord_token
-
+    
     discord_home = os.getenv("DISCORD_HOME_CHANNEL")
     if discord_home and Platform.DISCORD in config.platforms:
         config.platforms[Platform.DISCORD].home_channel = HomeChannel(
@@ -359,14 +381,14 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
             chat_id=discord_home,
             name=os.getenv("DISCORD_HOME_CHANNEL_NAME", "Home"),
         )
-
+    
     # WhatsApp (typically uses different auth mechanism)
     whatsapp_enabled = os.getenv("WHATSAPP_ENABLED", "").lower() in ("true", "1", "yes")
     if whatsapp_enabled:
         if Platform.WHATSAPP not in config.platforms:
             config.platforms[Platform.WHATSAPP] = PlatformConfig()
         config.platforms[Platform.WHATSAPP].enabled = True
-
+    
     # Slack
     slack_token = os.getenv("SLACK_BOT_TOKEN")
     if slack_token:
@@ -382,7 +404,7 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
                 chat_id=slack_home,
                 name=os.getenv("SLACK_HOME_CHANNEL_NAME", ""),
             )
-
+    
     # Signal
     signal_url = os.getenv("SIGNAL_HTTP_URL")
     signal_account = os.getenv("SIGNAL_ACCOUNT")
@@ -390,13 +412,11 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
         if Platform.SIGNAL not in config.platforms:
             config.platforms[Platform.SIGNAL] = PlatformConfig()
         config.platforms[Platform.SIGNAL].enabled = True
-        config.platforms[Platform.SIGNAL].extra.update(
-            {
-                "http_url": signal_url,
-                "account": signal_account,
-                "ignore_stories": os.getenv("SIGNAL_IGNORE_STORIES", "true").lower() in ("true", "1", "yes"),
-            }
-        )
+        config.platforms[Platform.SIGNAL].extra.update({
+            "http_url": signal_url,
+            "account": signal_account,
+            "ignore_stories": os.getenv("SIGNAL_IGNORE_STORIES", "true").lower() in ("true", "1", "yes"),
+        })
         signal_home = os.getenv("SIGNAL_HOME_CHANNEL")
         if signal_home:
             config.platforms[Platform.SIGNAL].home_channel = HomeChannel(
@@ -416,6 +436,28 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
         if hass_url:
             config.platforms[Platform.HOMEASSISTANT].extra["url"] = hass_url
 
+    # Email
+    email_addr = os.getenv("EMAIL_ADDRESS")
+    email_pwd = os.getenv("EMAIL_PASSWORD")
+    email_imap = os.getenv("EMAIL_IMAP_HOST")
+    email_smtp = os.getenv("EMAIL_SMTP_HOST")
+    if all([email_addr, email_pwd, email_imap, email_smtp]):
+        if Platform.EMAIL not in config.platforms:
+            config.platforms[Platform.EMAIL] = PlatformConfig()
+        config.platforms[Platform.EMAIL].enabled = True
+        config.platforms[Platform.EMAIL].extra.update({
+            "address": email_addr,
+            "imap_host": email_imap,
+            "smtp_host": email_smtp,
+        })
+        email_home = os.getenv("EMAIL_HOME_ADDRESS")
+        if email_home:
+            config.platforms[Platform.EMAIL].home_channel = HomeChannel(
+                platform=Platform.EMAIL,
+                chat_id=email_home,
+                name=os.getenv("EMAIL_HOME_ADDRESS_NAME", "Home"),
+            )
+
     # Session settings
     idle_minutes = os.getenv("SESSION_IDLE_MINUTES")
     if idle_minutes:
@@ -423,7 +465,7 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
             config.default_reset_policy.idle_minutes = int(idle_minutes)
         except ValueError:
             pass
-
+    
     reset_hour = os.getenv("SESSION_RESET_HOUR")
     if reset_hour:
         try:
@@ -436,6 +478,6 @@ def save_gateway_config(config: GatewayConfig) -> None:
     """Save gateway configuration to ~/.hermes/gateway.json."""
     gateway_config_path = Path.home() / ".hermes" / "gateway.json"
     gateway_config_path.parent.mkdir(parents=True, exist_ok=True)
-
-    with open(gateway_config_path, "w") as f:
+    
+    with open(gateway_config_path, "w", encoding="utf-8") as f:
         json.dump(config.to_dict(), f, indent=2)

gateway/delivery.py

@@ -9,17 +9,18 @@ Routes messages to the appropriate destination based on:
 """
 
 import logging
-from dataclasses import dataclass
-from datetime import datetime
 from pathlib import Path
-from typing import Any
+from datetime import datetime
+from dataclasses import dataclass
+from typing import Dict, List, Optional, Any, Union
+from enum import Enum
 
 logger = logging.getLogger(__name__)
 
 MAX_PLATFORM_OUTPUT = 4000
 TRUNCATED_VISIBLE = 3800
 
-from .config import GatewayConfig, Platform
+from .config import Platform, GatewayConfig
 from .session import SessionSource
 
 
@@ -27,24 +28,24 @@ from .session import SessionSource
 class DeliveryTarget:
     """
     A single delivery target.
-
+    
     Represents where a message should be sent:
     - "origin" → back to source
     - "local" → save to local files
     - "telegram" → Telegram home channel
     - "telegram:123456" → specific Telegram chat
     """
-
     platform: Platform
-    chat_id: str | None = None  # None means use home channel
+    chat_id: Optional[str] = None  # None means use home channel
+    thread_id: Optional[str] = None
     is_origin: bool = False
     is_explicit: bool = False  # True if chat_id was explicitly specified
-
+    
     @classmethod
-    def parse(cls, target: str, origin: SessionSource | None = None) -> "DeliveryTarget":
+    def parse(cls, target: str, origin: Optional[SessionSource] = None) -> "DeliveryTarget":
         """
         Parse a delivery target string.
-
+        
         Formats:
         - "origin" → back to source
         - "local" → local files only
@@ -52,21 +53,22 @@ class DeliveryTarget:
         - "telegram:123456" → specific Telegram chat
         """
         target = target.strip().lower()
-
+        
         if target == "origin":
             if origin:
                 return cls(
                     platform=origin.platform,
                     chat_id=origin.chat_id,
+                    thread_id=origin.thread_id,
                     is_origin=True,
                 )
             else:
                 # Fallback to local if no origin
                 return cls(platform=Platform.LOCAL, is_origin=True)
-
+        
         if target == "local":
             return cls(platform=Platform.LOCAL)
-
+        
         # Check for platform:chat_id format
         if ":" in target:
             platform_str, chat_id = target.split(":", 1)
@@ -76,7 +78,7 @@ class DeliveryTarget:
             except ValueError:
                 # Unknown platform, treat as local
                 return cls(platform=Platform.LOCAL)
-
+        
         # Just a platform name (use home channel)
         try:
             platform = Platform(target)
@@ -84,7 +86,7 @@ class DeliveryTarget:
         except ValueError:
             # Unknown platform, treat as local
             return cls(platform=Platform.LOCAL)
-
+    
     def to_string(self) -> str:
         """Convert back to string format."""
         if self.is_origin:
@@ -99,15 +101,15 @@ class DeliveryTarget:
 class DeliveryRouter:
     """
     Routes messages to appropriate destinations.
-
+    
     Handles the logic of resolving delivery targets and dispatching
     messages to the right platform adapters.
     """
-
-    def __init__(self, config: GatewayConfig, adapters: dict[Platform, Any] = None):
+    
+    def __init__(self, config: GatewayConfig, adapters: Dict[Platform, Any] = None):
         """
         Initialize the delivery router.
-
+        
         Args:
             config: Gateway configuration
             adapters: Dict mapping platforms to their adapter instances
@@ -115,27 +117,31 @@ class DeliveryRouter:
         self.config = config
         self.adapters = adapters or {}
         self.output_dir = Path.home() / ".hermes" / "cron" / "output"
-
-    def resolve_targets(self, deliver: str | list[str], origin: SessionSource | None = None) -> list[DeliveryTarget]:
+    
+    def resolve_targets(
+        self,
+        deliver: Union[str, List[str]],
+        origin: Optional[SessionSource] = None
+    ) -> List[DeliveryTarget]:
         """
         Resolve delivery specification to concrete targets.
-
+        
         Args:
             deliver: Delivery spec - "origin", "telegram", ["local", "discord"], etc.
             origin: The source where the request originated (for "origin" target)
-
+        
         Returns:
             List of resolved delivery targets
         """
         if isinstance(deliver, str):
             deliver = [deliver]
-
+        
         targets = []
         seen_platforms = set()
-
+        
         for target_str in deliver:
             target = DeliveryTarget.parse(target_str, origin)
-
+            
             # Resolve home channel if needed
             if target.chat_id is None and target.platform != Platform.LOCAL:
                 home = self.config.get_home_channel(target.platform)
@@ -144,96 +150,109 @@ class DeliveryRouter:
                 else:
                     # No home channel configured, skip this platform
                     continue
-
+            
             # Deduplicate
-            key = (target.platform, target.chat_id)
+            key = (target.platform, target.chat_id, target.thread_id)
             if key not in seen_platforms:
                 seen_platforms.add(key)
                 targets.append(target)
-
+        
         # Always include local if configured
         if self.config.always_log_local:
             local_key = (Platform.LOCAL, None)
             if local_key not in seen_platforms:
                 targets.append(DeliveryTarget(platform=Platform.LOCAL))
-
+        
         return targets
-
+    
     async def deliver(
         self,
         content: str,
-        targets: list[DeliveryTarget],
-        job_id: str | None = None,
-        job_name: str | None = None,
-        metadata: dict[str, Any] | None = None,
-    ) -> dict[str, Any]:
+        targets: List[DeliveryTarget],
+        job_id: Optional[str] = None,
+        job_name: Optional[str] = None,
+        metadata: Optional[Dict[str, Any]] = None
+    ) -> Dict[str, Any]:
         """
         Deliver content to all specified targets.
-
+        
         Args:
             content: The message/output to deliver
             targets: List of delivery targets
             job_id: Optional job ID (for cron jobs)
             job_name: Optional job name
             metadata: Additional metadata to include
-
+        
         Returns:
             Dict with delivery results per target
         """
         results = {}
-
+        
         for target in targets:
             try:
                 if target.platform == Platform.LOCAL:
                     result = self._deliver_local(content, job_id, job_name, metadata)
                 else:
                     result = await self._deliver_to_platform(target, content, metadata)
-
-                results[target.to_string()] = {"success": True, "result": result}
+                
+                results[target.to_string()] = {
+                    "success": True,
+                    "result": result
+                }
             except Exception as e:
-                results[target.to_string()] = {"success": False, "error": str(e)}
-
+                results[target.to_string()] = {
+                    "success": False,
+                    "error": str(e)
+                }
+        
         return results
-
+    
     def _deliver_local(
-        self, content: str, job_id: str | None, job_name: str | None, metadata: dict[str, Any] | None
-    ) -> dict[str, Any]:
+        self,
+        content: str,
+        job_id: Optional[str],
+        job_name: Optional[str],
+        metadata: Optional[Dict[str, Any]]
+    ) -> Dict[str, Any]:
         """Save content to local files."""
         timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
-
+        
         if job_id:
             output_path = self.output_dir / job_id / f"{timestamp}.md"
         else:
             output_path = self.output_dir / "misc" / f"{timestamp}.md"
-
+        
         output_path.parent.mkdir(parents=True, exist_ok=True)
-
+        
         # Build the output document
         lines = []
         if job_name:
             lines.append(f"# {job_name}")
         else:
             lines.append("# Delivery Output")
-
+        
         lines.append("")
         lines.append(f"**Timestamp:** {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}")
-
+        
         if job_id:
             lines.append(f"**Job ID:** {job_id}")
-
+        
         if metadata:
             for key, value in metadata.items():
                 lines.append(f"**{key}:** {value}")
-
+        
         lines.append("")
         lines.append("---")
         lines.append("")
         lines.append(content)
-
+        
         output_path.write_text("\n".join(lines))
-
-        return {"path": str(output_path), "timestamp": timestamp}
-
+        
+        return {
+            "path": str(output_path),
+            "timestamp": timestamp
+        }
+    
     def _save_full_output(self, content: str, job_id: str) -> Path:
         """Save full cron output to disk and return the file path."""
         timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
@@ -244,33 +263,44 @@ class DeliveryRouter:
         return path
 
     async def _deliver_to_platform(
-        self, target: DeliveryTarget, content: str, metadata: dict[str, Any] | None
-    ) -> dict[str, Any]:
+        self,
+        target: DeliveryTarget,
+        content: str,
+        metadata: Optional[Dict[str, Any]]
+    ) -> Dict[str, Any]:
         """Deliver content to a messaging platform."""
         adapter = self.adapters.get(target.platform)
-
+        
         if not adapter:
             raise ValueError(f"No adapter configured for {target.platform.value}")
-
+        
         if not target.chat_id:
             raise ValueError(f"No chat ID for {target.platform.value} delivery")
-
+        
         # Guard: truncate oversized cron output to stay within platform limits
         if len(content) > MAX_PLATFORM_OUTPUT:
             job_id = (metadata or {}).get("job_id", "unknown")
             saved_path = self._save_full_output(content, job_id)
             logger.info("Cron output truncated (%d chars) — full output: %s", len(content), saved_path)
-            content = content[:TRUNCATED_VISIBLE] + f"\n\n... [truncated, full output saved to {saved_path}]"
-
-        return await adapter.send(target.chat_id, content, metadata=metadata)
+            content = (
+                content[:TRUNCATED_VISIBLE]
+                + f"\n\n... [truncated, full output saved to {saved_path}]"
+            )
+        
+        send_metadata = dict(metadata or {})
+        if target.thread_id and "thread_id" not in send_metadata:
+            send_metadata["thread_id"] = target.thread_id
+        return await adapter.send(target.chat_id, content, metadata=send_metadata or None)
 
 
 def parse_deliver_spec(
-    deliver: str | list[str] | None, origin: SessionSource | None = None, default: str = "origin"
-) -> str | list[str]:
+    deliver: Optional[Union[str, List[str]]],
+    origin: Optional[SessionSource] = None,
+    default: str = "origin"
+) -> Union[str, List[str]]:
     """
     Normalize a delivery specification.
-
+    
     If None or empty, returns the default.
     """
     if not deliver:
@@ -278,14 +308,17 @@ def parse_deliver_spec(
     return deliver
 
 
-def build_delivery_context_for_tool(config: GatewayConfig, origin: SessionSource | None = None) -> dict[str, Any]:
+def build_delivery_context_for_tool(
+    config: GatewayConfig,
+    origin: Optional[SessionSource] = None
+) -> Dict[str, Any]:
     """
     Build context for the schedule_cronjob tool to understand delivery options.
-
+    
     This is passed to the tool so it can validate and explain delivery targets.
     """
     connected = config.get_connected_platforms()
-
+    
     options = {
         "origin": {
             "description": "Back to where this job was created",
@@ -294,9 +327,9 @@ def build_delivery_context_for_tool(config: GatewayConfig, origin: SessionSource
         "local": {
             "description": "Save to local files only",
             "available": True,
-        },
+        }
     }
-
+    
     for platform in connected:
         home = config.get_home_channel(platform)
         options[platform.value] = {
@@ -304,7 +337,7 @@ def build_delivery_context_for_tool(config: GatewayConfig, origin: SessionSource
             "available": True,
             "home_channel": home.to_dict() if home else None,
         }
-
+    
     return {
         "origin": origin.to_dict() if origin else None,
         "options": options,

gateway/hooks.py

@@ -21,12 +21,12 @@ Errors in hooks are caught and logged but never block the main pipeline.
 import asyncio
 import importlib.util
 import os
-from collections.abc import Callable
 from pathlib import Path
-from typing import Any
+from typing import Any, Callable, Dict, List, Optional
 
 import yaml
 
+
 HOOKS_DIR = Path(os.path.expanduser("~/.hermes/hooks"))
 
 
@@ -42,11 +42,11 @@ class HookRegistry:
 
     def __init__(self):
         # event_type -> [handler_fn, ...]
-        self._handlers: dict[str, list[Callable]] = {}
-        self._loaded_hooks: list[dict] = []  # metadata for listing
+        self._handlers: Dict[str, List[Callable]] = {}
+        self._loaded_hooks: List[dict] = []  # metadata for listing
 
     @property
-    def loaded_hooks(self) -> list[dict]:
+    def loaded_hooks(self) -> List[dict]:
         """Return metadata about all loaded hooks."""
         return list(self._loaded_hooks)
 
@@ -84,7 +84,9 @@ class HookRegistry:
                     continue
 
                 # Dynamically load the handler module
-                spec = importlib.util.spec_from_file_location(f"hermes_hook_{hook_name}", handler_path)
+                spec = importlib.util.spec_from_file_location(
+                    f"hermes_hook_{hook_name}", handler_path
+                )
                 if spec is None or spec.loader is None:
                     print(f"[hooks] Skipping {hook_name}: could not load handler.py", flush=True)
                     continue
@@ -101,21 +103,19 @@ class HookRegistry:
                 for event in events:
                     self._handlers.setdefault(event, []).append(handle_fn)
 
-                self._loaded_hooks.append(
-                    {
-                        "name": hook_name,
-                        "description": manifest.get("description", ""),
-                        "events": events,
-                        "path": str(hook_dir),
-                    }
-                )
+                self._loaded_hooks.append({
+                    "name": hook_name,
+                    "description": manifest.get("description", ""),
+                    "events": events,
+                    "path": str(hook_dir),
+                })
 
                 print(f"[hooks] Loaded hook '{hook_name}' for events: {events}", flush=True)
 
             except Exception as e:
                 print(f"[hooks] Error loading hook {hook_dir.name}: {e}", flush=True)
 
-    async def emit(self, event_type: str, context: dict[str, Any] | None = None) -> None:
+    async def emit(self, event_type: str, context: Optional[Dict[str, Any]] = None) -> None:
         """
         Fire all handlers registered for an event.
 

gateway/mirror.py

@@ -13,6 +13,7 @@ import json
 import logging
 from datetime import datetime
 from pathlib import Path
+from typing import Optional
 
 logger = logging.getLogger(__name__)
 
@@ -25,6 +26,7 @@ def mirror_to_session(
     chat_id: str,
     message_text: str,
     source_label: str = "cli",
+    thread_id: Optional[str] = None,
 ) -> bool:
     """
     Append a delivery-mirror message to the target session's transcript.
@@ -36,9 +38,9 @@ def mirror_to_session(
     All errors are caught -- this is never fatal.
     """
     try:
-        session_id = _find_session_id(platform, str(chat_id))
+        session_id = _find_session_id(platform, str(chat_id), thread_id=thread_id)
         if not session_id:
-            logger.debug("Mirror: no session found for %s:%s", platform, chat_id)
+            logger.debug("Mirror: no session found for %s:%s:%s", platform, chat_id, thread_id)
             return False
 
         mirror_msg = {
@@ -56,11 +58,11 @@ def mirror_to_session(
         return True
 
     except Exception as e:
-        logger.debug("Mirror failed for %s:%s: %s", platform, chat_id, e)
+        logger.debug("Mirror failed for %s:%s:%s: %s", platform, chat_id, thread_id, e)
         return False
 
 
-def _find_session_id(platform: str, chat_id: str) -> str | None:
+def _find_session_id(platform: str, chat_id: str, thread_id: Optional[str] = None) -> Optional[str]:
     """
     Find the active session_id for a platform + chat_id pair.
 
@@ -90,6 +92,9 @@ def _find_session_id(platform: str, chat_id: str) -> str | None:
 
         origin_chat_id = str(origin.get("chat_id", ""))
         if origin_chat_id == str(chat_id):
+            origin_thread_id = origin.get("thread_id")
+            if thread_id is not None and str(origin_thread_id or "") != str(thread_id):
+                continue
             updated = entry.get("updated_at", "")
             if updated > best_updated:
                 best_updated = updated
@@ -110,9 +115,9 @@ def _append_to_jsonl(session_id: str, message: dict) -> None:
 
 def _append_to_sqlite(session_id: str, message: dict) -> None:
     """Append a message to the SQLite session database."""
+    db = None
     try:
         from hermes_state import SessionDB
-
         db = SessionDB()
         db.append_message(
             session_id=session_id,
@@ -121,3 +126,6 @@ def _append_to_sqlite(session_id: str, message: dict) -> None:
         )
     except Exception as e:
         logger.debug("Mirror SQLite write failed: %s", e)
+    finally:
+        if db is not None:
+            db.close()

gateway/pairing.py

@@ -23,19 +23,21 @@ import os
 import secrets
 import time
 from pathlib import Path
+from typing import Optional
+
 
 # Unambiguous alphabet -- excludes 0/O, 1/I to prevent confusion
 ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789"
 CODE_LENGTH = 8
 
 # Timing constants
-CODE_TTL_SECONDS = 3600  # Codes expire after 1 hour
-RATE_LIMIT_SECONDS = 600  # 1 request per user per 10 minutes
-LOCKOUT_SECONDS = 3600  # Lockout duration after too many failures
+CODE_TTL_SECONDS = 3600             # Codes expire after 1 hour
+RATE_LIMIT_SECONDS = 600            # 1 request per user per 10 minutes
+LOCKOUT_SECONDS = 3600              # Lockout duration after too many failures
 
 # Limits
-MAX_PENDING_PER_PLATFORM = 3  # Max pending codes per platform
-MAX_FAILED_ATTEMPTS = 5  # Failed approvals before lockout
+MAX_PENDING_PER_PLATFORM = 3        # Max pending codes per platform
+MAX_FAILED_ATTEMPTS = 5             # Failed approvals before lockout
 
 PAIRING_DIR = Path(os.path.expanduser("~/.hermes/pairing"))
 
@@ -121,7 +123,9 @@ class PairingStore:
 
     # ----- Pending codes -----
 
-    def generate_code(self, platform: str, user_id: str, user_name: str = "") -> str | None:
+    def generate_code(
+        self, platform: str, user_id: str, user_name: str = ""
+    ) -> Optional[str]:
         """
         Generate a pairing code for a new user.
 
@@ -161,7 +165,7 @@ class PairingStore:
 
         return code
 
-    def approve_code(self, platform: str, code: str) -> dict | None:
+    def approve_code(self, platform: str, code: str) -> Optional[dict]:
         """
         Approve a pairing code. Adds the user to the approved list.
 
@@ -195,15 +199,13 @@ class PairingStore:
             pending = self._load_json(self._pending_path(p))
             for code, info in pending.items():
                 age_min = int((time.time() - info["created_at"]) / 60)
-                results.append(
-                    {
-                        "platform": p,
-                        "code": code,
-                        "user_id": info["user_id"],
-                        "user_name": info.get("user_name", ""),
-                        "age_minutes": age_min,
-                    }
-                )
+                results.append({
+                    "platform": p,
+                    "code": code,
+                    "user_id": info["user_id"],
+                    "user_name": info.get("user_name", ""),
+                    "age_minutes": age_min,
+                })
         return results
 
     def clear_pending(self, platform: str = None) -> int:
@@ -249,11 +251,8 @@ class PairingStore:
             lockout_key = f"_lockout:{platform}"
             limits[lockout_key] = time.time() + LOCKOUT_SECONDS
             limits[fail_key] = 0  # Reset counter
-            print(
-                f"[pairing] Platform {platform} locked out for {LOCKOUT_SECONDS}s "
-                f"after {MAX_FAILED_ATTEMPTS} failed attempts",
-                flush=True,
-            )
+            print(f"[pairing] Platform {platform} locked out for {LOCKOUT_SECONDS}s "
+                  f"after {MAX_FAILED_ATTEMPTS} failed attempts", flush=True)
         self._save_json(self._rate_limit_path(), limits)
 
     # ----- Cleanup -----
@@ -263,7 +262,10 @@ class PairingStore:
         path = self._pending_path(platform)
         pending = self._load_json(path)
         now = time.time()
-        expired = [code for code, info in pending.items() if (now - info["created_at"]) > CODE_TTL_SECONDS]
+        expired = [
+            code for code, info in pending.items()
+            if (now - info["created_at"]) > CODE_TTL_SECONDS
+        ]
         if expired:
             for code in expired:
                 del pending[code]

gateway/platforms/ADDING_A_PLATFORM.md

@@ -303,8 +303,8 @@ Optional but valuable:
 After implementing everything, verify with:
 
 ```bash
-# All checks pass (lint + test)
-make check
+# All tests pass
+python -m pytest tests/ -q
 
 # Grep for your platform name to find any missed integration points
 grep -r "telegram\|discord\|whatsapp\|slack" gateway/ tools/ agent/ cron/ hermes_cli/ toolsets.py \

gateway/platforms/base.py

@@ -13,19 +13,19 @@ import uuid
 from abc import ABC, abstractmethod
 
 logger = logging.getLogger(__name__)
-import sys
-from collections.abc import Awaitable, Callable
 from dataclasses import dataclass, field
 from datetime import datetime
-from enum import Enum
 from pathlib import Path
-from pathlib import Path as _Path
-from typing import Any
+from typing import Dict, List, Optional, Any, Callable, Awaitable, Tuple
+from enum import Enum
 
+import sys
+from pathlib import Path as _Path
 sys.path.insert(0, str(_Path(__file__).resolve().parents[2]))
 
 from gateway.config import Platform, PlatformConfig
-from gateway.session import SessionSource
+from gateway.session import SessionSource, build_session_key
+
 
 # ---------------------------------------------------------------------------
 # Image cache utilities
@@ -251,7 +251,6 @@ def cleanup_document_cache(max_age_hours: int = 24) -> int:
 
 class MessageType(Enum):
     """Types of incoming messages."""
-
     TEXT = "text"
     LOCATION = "location"
     PHOTO = "photo"
@@ -267,43 +266,42 @@ class MessageType(Enum):
 class MessageEvent:
     """
     Incoming message from a platform.
-
+    
     Normalized representation that all adapters produce.
     """
-
     # Message content
     text: str
     message_type: MessageType = MessageType.TEXT
-
+    
     # Source information
     source: SessionSource = None
-
+    
     # Original platform data
     raw_message: Any = None
-    message_id: str | None = None
-
+    message_id: Optional[str] = None
+    
     # Media attachments
-    media_urls: list[str] = field(default_factory=list)
-    media_types: list[str] = field(default_factory=list)
-
+    media_urls: List[str] = field(default_factory=list)
+    media_types: List[str] = field(default_factory=list)
+    
     # Reply context
-    reply_to_message_id: str | None = None
-
+    reply_to_message_id: Optional[str] = None
+    
     # Timestamps
     timestamp: datetime = field(default_factory=datetime.now)
-
+    
     def is_command(self) -> bool:
         """Check if this is a command message (e.g., /new, /reset)."""
         return self.text.startswith("/")
-
-    def get_command(self) -> str | None:
+    
+    def get_command(self) -> Optional[str]:
         """Extract command name if this is a command message."""
         if not self.is_command():
             return None
         # Split on space and get first word, strip the /
         parts = self.text.split(maxsplit=1)
         return parts[0][1:].lower() if parts else None
-
+    
     def get_command_args(self) -> str:
         """Get the arguments after a command."""
         if not self.is_command():
@@ -312,88 +310,91 @@ class MessageEvent:
         return parts[1] if len(parts) > 1 else ""
 
 
-@dataclass
+@dataclass 
 class SendResult:
     """Result of sending a message."""
-
     success: bool
-    message_id: str | None = None
-    error: str | None = None
+    message_id: Optional[str] = None
+    error: Optional[str] = None
     raw_response: Any = None
 
 
 # Type for message handlers
-MessageHandler = Callable[[MessageEvent], Awaitable[str | None]]
+MessageHandler = Callable[[MessageEvent], Awaitable[Optional[str]]]
 
 
 class BasePlatformAdapter(ABC):
     """
     Base class for platform adapters.
-
+    
     Subclasses implement platform-specific logic for:
     - Connecting and authenticating
     - Receiving messages
     - Sending messages/responses
     - Handling media
     """
-
+    
     def __init__(self, config: PlatformConfig, platform: Platform):
         self.config = config
         self.platform = platform
-        self._message_handler: MessageHandler | None = None
+        self._message_handler: Optional[MessageHandler] = None
         self._running = False
-
+        
         # Track active message handlers per session for interrupt support
         # Key: session_key (e.g., chat_id), Value: (event, asyncio.Event for interrupt)
-        self._active_sessions: dict[str, asyncio.Event] = {}
-        self._pending_messages: dict[str, MessageEvent] = {}
-
+        self._active_sessions: Dict[str, asyncio.Event] = {}
+        self._pending_messages: Dict[str, MessageEvent] = {}
+    
     @property
     def name(self) -> str:
         """Human-readable name for this adapter."""
         return self.platform.value.title()
-
+    
     @property
     def is_connected(self) -> bool:
         """Check if adapter is currently connected."""
         return self._running
-
+    
     def set_message_handler(self, handler: MessageHandler) -> None:
         """
         Set the handler for incoming messages.
-
+        
         The handler receives a MessageEvent and should return
         an optional response string.
         """
         self._message_handler = handler
-
+    
     @abstractmethod
     async def connect(self) -> bool:
         """
         Connect to the platform and start receiving messages.
-
+        
         Returns True if connection was successful.
         """
         pass
-
+    
     @abstractmethod
     async def disconnect(self) -> None:
         """Disconnect from the platform."""
         pass
-
+    
     @abstractmethod
     async def send(
-        self, chat_id: str, content: str, reply_to: str | None = None, metadata: dict[str, Any] | None = None
+        self,
+        chat_id: str,
+        content: str,
+        reply_to: Optional[str] = None,
+        metadata: Optional[Dict[str, Any]] = None
     ) -> SendResult:
         """
         Send a message to a chat.
-
+        
         Args:
             chat_id: The chat/channel ID to send to
             content: Message content (may be markdown)
             reply_to: Optional message ID to reply to
             metadata: Additional platform-specific options
-
+        
         Returns:
             SendResult with success status and message ID
         """
@@ -412,24 +413,25 @@ class BasePlatformAdapter(ABC):
         """
         return SendResult(success=False, error="Not supported")
 
-    async def send_typing(self, chat_id: str) -> None:
+    async def send_typing(self, chat_id: str, metadata=None) -> None:
         """
         Send a typing indicator.
-
+        
         Override in subclasses if the platform supports it.
+        metadata: optional dict with platform-specific context (e.g. thread_id for Slack).
         """
         pass
-
+    
     async def send_image(
         self,
         chat_id: str,
         image_url: str,
-        caption: str | None = None,
-        reply_to: str | None = None,
+        caption: Optional[str] = None,
+        reply_to: Optional[str] = None,
     ) -> SendResult:
         """
         Send an image natively via the platform API.
-
+        
         Override in subclasses to send images as proper attachments
         instead of plain-text URLs. Default falls back to sending the
         URL as a text message.
@@ -437,91 +439,88 @@ class BasePlatformAdapter(ABC):
         # Fallback: send URL as text (subclasses override for native images)
         text = f"{caption}\n{image_url}" if caption else image_url
         return await self.send(chat_id=chat_id, content=text, reply_to=reply_to)
-
+    
     async def send_animation(
         self,
         chat_id: str,
         animation_url: str,
-        caption: str | None = None,
-        reply_to: str | None = None,
+        caption: Optional[str] = None,
+        reply_to: Optional[str] = None,
     ) -> SendResult:
         """
         Send an animated GIF natively via the platform API.
-
+        
         Override in subclasses to send GIFs as proper animations
         (e.g., Telegram send_animation) so they auto-play inline.
         Default falls back to send_image.
         """
         return await self.send_image(chat_id=chat_id, image_url=animation_url, caption=caption, reply_to=reply_to)
-
+    
     @staticmethod
     def _is_animation_url(url: str) -> bool:
         """Check if a URL points to an animated GIF (vs a static image)."""
-        lower = url.lower().split("?")[0]  # Strip query params
-        return lower.endswith(".gif")
+        lower = url.lower().split('?')[0]  # Strip query params
+        return lower.endswith('.gif')
 
     @staticmethod
-    def extract_images(content: str) -> tuple[list[tuple[str, str]], str]:
+    def extract_images(content: str) -> Tuple[List[Tuple[str, str]], str]:
         """
         Extract image URLs from markdown and HTML image tags in a response.
-
+        
         Finds patterns like:
         - ![alt text](https://example.com/image.png)
         - <img src="https://example.com/image.png">
         - <img src="https://example.com/image.png"></img>
-
+        
         Args:
             content: The response text to scan.
-
+        
         Returns:
             Tuple of (list of (url, alt_text) pairs, cleaned content with image tags removed).
         """
         images = []
         cleaned = content
-
+        
         # Match markdown images: ![alt](url)
-        md_pattern = r"!\[([^\]]*)\]\((https?://[^\s\)]+)\)"
+        md_pattern = r'!\[([^\]]*)\]\((https?://[^\s\)]+)\)'
         for match in re.finditer(md_pattern, content):
             alt_text = match.group(1)
             url = match.group(2)
             # Only extract URLs that look like actual images
-            if any(
-                url.lower().endswith(ext) or ext in url.lower()
-                for ext in [".png", ".jpg", ".jpeg", ".gif", ".webp", "fal.media", "fal-cdn", "replicate.delivery"]
-            ):
+            if any(url.lower().endswith(ext) or ext in url.lower() for ext in
+                   ['.png', '.jpg', '.jpeg', '.gif', '.webp', 'fal.media', 'fal-cdn', 'replicate.delivery']):
                 images.append((url, alt_text))
-
+        
         # Match HTML img tags: <img src="url"> or <img src="url"></img> or <img src="url"/>
         html_pattern = r'<img\s+src=["\']?(https?://[^\s"\'<>]+)["\']?\s*/?>\s*(?:</img>)?'
         for match in re.finditer(html_pattern, content):
             url = match.group(1)
             images.append((url, ""))
-
+        
         # Remove only the matched image tags from content (not all markdown images)
         if images:
             extracted_urls = {url for url, _ in images}
-
             def _remove_if_extracted(match):
                 url = match.group(2) if match.lastindex >= 2 else match.group(1)
-                return "" if url in extracted_urls else match.group(0)
-
+                return '' if url in extracted_urls else match.group(0)
             cleaned = re.sub(md_pattern, _remove_if_extracted, cleaned)
             cleaned = re.sub(html_pattern, _remove_if_extracted, cleaned)
             # Clean up leftover blank lines
-            cleaned = re.sub(r"\n{3,}", "\n\n", cleaned).strip()
-
+            cleaned = re.sub(r'\n{3,}', '\n\n', cleaned).strip()
+        
         return images, cleaned
-
+    
     async def send_voice(
         self,
         chat_id: str,
         audio_path: str,
-        caption: str | None = None,
-        reply_to: str | None = None,
+        caption: Optional[str] = None,
+        reply_to: Optional[str] = None,
+        **kwargs,
     ) -> SendResult:
         """
         Send an audio file as a native voice message via the platform API.
-
+        
         Override in subclasses to send audio as voice bubbles (Telegram)
         or file attachments (Discord). Default falls back to sending the
         file path as text.
@@ -535,8 +534,9 @@ class BasePlatformAdapter(ABC):
         self,
         chat_id: str,
         video_path: str,
-        caption: str | None = None,
-        reply_to: str | None = None,
+        caption: Optional[str] = None,
+        reply_to: Optional[str] = None,
+        **kwargs,
     ) -> SendResult:
         """
         Send a video natively via the platform API.
@@ -553,9 +553,10 @@ class BasePlatformAdapter(ABC):
         self,
         chat_id: str,
         file_path: str,
-        caption: str | None = None,
-        file_name: str | None = None,
-        reply_to: str | None = None,
+        caption: Optional[str] = None,
+        file_name: Optional[str] = None,
+        reply_to: Optional[str] = None,
+        **kwargs,
     ) -> SendResult:
         """
         Send a document/file natively via the platform API.
@@ -572,8 +573,9 @@ class BasePlatformAdapter(ABC):
         self,
         chat_id: str,
         image_path: str,
-        caption: str | None = None,
-        reply_to: str | None = None,
+        caption: Optional[str] = None,
+        reply_to: Optional[str] = None,
+        **kwargs,
     ) -> SendResult:
         """
         Send a local image file natively via the platform API.
@@ -588,68 +590,68 @@ class BasePlatformAdapter(ABC):
         return await self.send(chat_id=chat_id, content=text, reply_to=reply_to)
 
     @staticmethod
-    def extract_media(content: str) -> tuple[list[tuple[str, bool]], str]:
+    def extract_media(content: str) -> Tuple[List[Tuple[str, bool]], str]:
         """
         Extract MEDIA:<path> tags and [[audio_as_voice]] directives from response text.
-
+        
         The TTS tool returns responses like:
             [[audio_as_voice]]
             MEDIA:/path/to/audio.ogg
-
+        
         Args:
             content: The response text to scan.
-
+        
         Returns:
             Tuple of (list of (path, is_voice) pairs, cleaned content with tags removed).
         """
         media = []
         cleaned = content
-
+        
         # Check for [[audio_as_voice]] directive
         has_voice_tag = "[[audio_as_voice]]" in content
         cleaned = cleaned.replace("[[audio_as_voice]]", "")
-
+        
         # Extract MEDIA:<path> tags (path may contain spaces)
-        media_pattern = r"MEDIA:(\S+)"
+        media_pattern = r'MEDIA:(\S+)'
         for match in re.finditer(media_pattern, content):
             path = match.group(1).strip()
             if path:
                 media.append((path, has_voice_tag))
-
+        
         # Remove MEDIA tags from content
         if media:
-            cleaned = re.sub(media_pattern, "", cleaned)
-            cleaned = re.sub(r"\n{3,}", "\n\n", cleaned).strip()
-
+            cleaned = re.sub(media_pattern, '', cleaned)
+            cleaned = re.sub(r'\n{3,}', '\n\n', cleaned).strip()
+        
         return media, cleaned
-
-    async def _keep_typing(self, chat_id: str, interval: float = 2.0) -> None:
+    
+    async def _keep_typing(self, chat_id: str, interval: float = 2.0, metadata=None) -> None:
         """
         Continuously send typing indicator until cancelled.
-
+        
         Telegram/Discord typing status expires after ~5 seconds, so we refresh every 2
         to recover quickly after progress messages interrupt it.
         """
         try:
             while True:
-                await self.send_typing(chat_id)
+                await self.send_typing(chat_id, metadata=metadata)
                 await asyncio.sleep(interval)
         except asyncio.CancelledError:
             pass  # Normal cancellation when handler completes
-
+    
     async def handle_message(self, event: MessageEvent) -> None:
         """
         Process an incoming message.
-
+        
         This method returns quickly by spawning background tasks.
         This allows new messages to be processed even while an agent is running,
         enabling interruption support.
         """
         if not self._message_handler:
             return
-
-        session_key = event.source.chat_id
-
+        
+        session_key = build_session_key(event.source)
+        
         # Check if there's already an active handler for this session
         if session_key in self._active_sessions:
             # Store this as a pending message - it will interrupt the running agent
@@ -658,10 +660,10 @@ class BasePlatformAdapter(ABC):
             # Signal the interrupt (the processing task checks this)
             self._active_sessions[session_key].set()
             return  # Don't process now - will be handled after current task finishes
-
+        
         # Spawn background task to process this message
         asyncio.create_task(self._process_message_background(event, session_key))
-
+    
     @staticmethod
     def _get_human_delay() -> float:
         """
@@ -688,40 +690,37 @@ class BasePlatformAdapter(ABC):
         # Create interrupt event for this session
         interrupt_event = asyncio.Event()
         self._active_sessions[session_key] = interrupt_event
-
+        
         # Start continuous typing indicator (refreshes every 2 seconds)
-        typing_task = asyncio.create_task(self._keep_typing(event.source.chat_id))
-
+        _thread_metadata = {"thread_id": event.source.thread_id} if event.source.thread_id else None
+        typing_task = asyncio.create_task(self._keep_typing(event.source.chat_id, metadata=_thread_metadata))
+        
         try:
             # Call the handler (this can take a while with tool calls)
             response = await self._message_handler(event)
-
+            
             # Send response if any
             if not response:
                 logger.warning("[%s] Handler returned empty/None response for %s", self.name, event.source.chat_id)
             if response:
                 # Extract MEDIA:<path> tags (from TTS tool) before other processing
                 media_files, response = self.extract_media(response)
-
+                
                 # Extract image URLs and send them as native platform attachments
                 images, text_content = self.extract_images(response)
                 if images:
-                    logger.info(
-                        "[%s] extract_images found %d image(s) in response (%d chars)",
-                        self.name,
-                        len(images),
-                        len(response),
-                    )
-
+                    logger.info("[%s] extract_images found %d image(s) in response (%d chars)", self.name, len(images), len(response))
+                
                 # Send the text portion first (if any remains after extractions)
                 if text_content:
-                    logger.info(
-                        "[%s] Sending response (%d chars) to %s", self.name, len(text_content), event.source.chat_id
-                    )
+                    logger.info("[%s] Sending response (%d chars) to %s", self.name, len(text_content), event.source.chat_id)
                     result = await self.send(
-                        chat_id=event.source.chat_id, content=text_content, reply_to=event.message_id
+                        chat_id=event.source.chat_id,
+                        content=text_content,
+                        reply_to=event.message_id,
+                        metadata=_thread_metadata,
                     )
-
+                    
                     # Log send failures (don't raise - user already saw tool progress)
                     if not result.success:
                         print(f"[{self.name}] Failed to send response: {result.error}")
@@ -730,13 +729,14 @@ class BasePlatformAdapter(ABC):
                             chat_id=event.source.chat_id,
                             content=f"(Response formatting failed, plain text:)\n\n{text_content[:3500]}",
                             reply_to=event.message_id,
+                            metadata=_thread_metadata,
                         )
                         if not fallback_result.success:
                             print(f"[{self.name}] Fallback send also failed: {fallback_result.error}")
-
+                
                 # Human-like pacing delay between text and media
                 human_delay = self._get_human_delay()
-
+                
                 # Send extracted images as native attachments
                 if images:
                     logger.info("[%s] Extracted %d image(s) to send as attachments", self.name, len(images))
@@ -744,34 +744,31 @@ class BasePlatformAdapter(ABC):
                     if human_delay > 0:
                         await asyncio.sleep(human_delay)
                     try:
-                        logger.info(
-                            "[%s] Sending image: %s (alt=%s)",
-                            self.name,
-                            image_url[:80],
-                            alt_text[:30] if alt_text else "",
-                        )
+                        logger.info("[%s] Sending image: %s (alt=%s)", self.name, image_url[:80], alt_text[:30] if alt_text else "")
                         # Route animated GIFs through send_animation for proper playback
                         if self._is_animation_url(image_url):
                             img_result = await self.send_animation(
                                 chat_id=event.source.chat_id,
                                 animation_url=image_url,
                                 caption=alt_text if alt_text else None,
+                                metadata=_thread_metadata,
                             )
                         else:
                             img_result = await self.send_image(
                                 chat_id=event.source.chat_id,
                                 image_url=image_url,
                                 caption=alt_text if alt_text else None,
+                                metadata=_thread_metadata,
                             )
                         if not img_result.success:
                             logger.error("[%s] Failed to send image: %s", self.name, img_result.error)
                     except Exception as img_err:
                         logger.error("[%s] Error sending image: %s", self.name, img_err, exc_info=True)
-
+                
                 # Send extracted media files — route by file type
-                _AUDIO_EXTS = {".ogg", ".opus", ".mp3", ".wav", ".m4a"}
-                _VIDEO_EXTS = {".mp4", ".mov", ".avi", ".mkv", ".3gp"}
-                _IMAGE_EXTS = {".jpg", ".jpeg", ".png", ".webp", ".gif"}
+                _AUDIO_EXTS = {'.ogg', '.opus', '.mp3', '.wav', '.m4a'}
+                _VIDEO_EXTS = {'.mp4', '.mov', '.avi', '.mkv', '.3gp'}
+                _IMAGE_EXTS = {'.jpg', '.jpeg', '.png', '.webp', '.gif'}
 
                 for media_path, is_voice in media_files:
                     if human_delay > 0:
@@ -782,28 +779,32 @@ class BasePlatformAdapter(ABC):
                             media_result = await self.send_voice(
                                 chat_id=event.source.chat_id,
                                 audio_path=media_path,
+                                metadata=_thread_metadata,
                             )
                         elif ext in _VIDEO_EXTS:
                             media_result = await self.send_video(
                                 chat_id=event.source.chat_id,
                                 video_path=media_path,
+                                metadata=_thread_metadata,
                             )
                         elif ext in _IMAGE_EXTS:
                             media_result = await self.send_image_file(
                                 chat_id=event.source.chat_id,
                                 image_path=media_path,
+                                metadata=_thread_metadata,
                             )
                         else:
                             media_result = await self.send_document(
                                 chat_id=event.source.chat_id,
                                 file_path=media_path,
+                                metadata=_thread_metadata,
                             )
 
                         if not media_result.success:
                             print(f"[{self.name}] Failed to send media ({ext}): {media_result.error}")
                     except Exception as media_err:
                         print(f"[{self.name}] Error sending media: {media_err}")
-
+            
             # Check if there's a pending message that was queued during our processing
             if session_key in self._pending_messages:
                 pending_event = self._pending_messages.pop(session_key)
@@ -819,11 +820,10 @@ class BasePlatformAdapter(ABC):
                 # Process pending message in new background task
                 await self._process_message_background(pending_event, session_key)
                 return  # Already cleaned up
-
+                
         except Exception as e:
             print(f"[{self.name}] Error handling message: {e}")
             import traceback
-
             traceback.print_exc()
         finally:
             # Stop typing indicator
@@ -835,26 +835,26 @@ class BasePlatformAdapter(ABC):
             # Clean up session tracking
             if session_key in self._active_sessions:
                 del self._active_sessions[session_key]
-
+    
     def has_pending_interrupt(self, session_key: str) -> bool:
         """Check if there's a pending interrupt for a session."""
         return session_key in self._active_sessions and self._active_sessions[session_key].is_set()
-
-    def get_pending_message(self, session_key: str) -> MessageEvent | None:
+    
+    def get_pending_message(self, session_key: str) -> Optional[MessageEvent]:
         """Get and clear any pending message for a session."""
         return self._pending_messages.pop(session_key, None)
-
+    
     def build_source(
         self,
         chat_id: str,
-        chat_name: str | None = None,
+        chat_name: Optional[str] = None,
         chat_type: str = "dm",
-        user_id: str | None = None,
-        user_name: str | None = None,
-        thread_id: str | None = None,
-        chat_topic: str | None = None,
-        user_id_alt: str | None = None,
-        chat_id_alt: str | None = None,
+        user_id: Optional[str] = None,
+        user_name: Optional[str] = None,
+        thread_id: Optional[str] = None,
+        chat_topic: Optional[str] = None,
+        user_id_alt: Optional[str] = None,
+        chat_id_alt: Optional[str] = None,
     ) -> SessionSource:
         """Helper to build a SessionSource for this platform."""
         # Normalize empty topic to None
@@ -872,30 +872,30 @@ class BasePlatformAdapter(ABC):
             user_id_alt=user_id_alt,
             chat_id_alt=chat_id_alt,
         )
-
+    
     @abstractmethod
-    async def get_chat_info(self, chat_id: str) -> dict[str, Any]:
+    async def get_chat_info(self, chat_id: str) -> Dict[str, Any]:
         """
         Get information about a chat/channel.
-
+        
         Returns dict with at least:
         - name: Chat name
         - type: "dm", "group", "channel"
         """
         pass
-
+    
     def format_message(self, content: str) -> str:
         """
         Format a message for this platform.
-
+        
         Override in subclasses to handle platform-specific formatting
         (e.g., Telegram MarkdownV2, Discord markdown).
-
+        
         Default implementation returns content as-is.
         """
         return content
-
-    def truncate_message(self, content: str, max_length: int = 4096) -> list[str]:
+    
+    def truncate_message(self, content: str, max_length: int = 4096) -> List[str]:
         """
         Split a long message into chunks, preserving code block boundaries.
 
@@ -914,14 +914,14 @@ class BasePlatformAdapter(ABC):
         if len(content) <= max_length:
             return [content]
 
-        INDICATOR_RESERVE = 10  # room for " (XX/XX)"
+        INDICATOR_RESERVE = 10   # room for " (XX/XX)"
         FENCE_CLOSE = "\n```"
 
-        chunks: list[str] = []
+        chunks: List[str] = []
         remaining = content
         # When the previous chunk ended mid-code-block, this holds the
         # language tag (possibly "") so we can reopen the fence.
-        carry_lang: str | None = None
+        carry_lang: Optional[str] = None
 
         while remaining:
             # If we're continuing a code block from the previous chunk,
@@ -979,6 +979,8 @@ class BasePlatformAdapter(ABC):
         # Append chunk indicators when the response spans multiple messages
         if len(chunks) > 1:
             total = len(chunks)
-            chunks = [f"{chunk} ({i + 1}/{total})" for i, chunk in enumerate(chunks)]
+            chunks = [
+                f"{chunk} ({i + 1}/{total})" for i, chunk in enumerate(chunks)
+            ]
 
         return chunks

gateway/platforms/discord.py

@@ -10,16 +10,14 @@ Uses discord.py library for:
 import asyncio
 import logging
 import os
-from typing import Any
+from typing import Dict, List, Optional, Any
 
 logger = logging.getLogger(__name__)
 
 try:
     import discord
-    from discord import Intents
-    from discord import Message as DiscordMessage
+    from discord import Message as DiscordMessage, Intents
     from discord.ext import commands
-
     DISCORD_AVAILABLE = True
 except ImportError:
     DISCORD_AVAILABLE = False
@@ -30,7 +28,6 @@ except ImportError:
 
 import sys
 from pathlib import Path as _Path
-
 sys.path.insert(0, str(_Path(__file__).resolve().parents[2]))
 
 from gateway.config import Platform, PlatformConfig
@@ -39,8 +36,8 @@ from gateway.platforms.base import (
     MessageEvent,
     MessageType,
     SendResult,
-    cache_audio_from_url,
     cache_image_from_url,
+    cache_audio_from_url,
 )
 
 
@@ -52,7 +49,7 @@ def check_discord_requirements() -> bool:
 class DiscordAdapter(BasePlatformAdapter):
     """
     Discord bot adapter.
-
+    
     Handles:
     - Receiving messages from servers and DMs
     - Sending responses with Discord markdown
@@ -62,26 +59,26 @@ class DiscordAdapter(BasePlatformAdapter):
     - Auto-threading for long conversations
     - Reaction-based feedback
     """
-
+    
     # Discord message limits
     MAX_MESSAGE_LENGTH = 2000
-
+    
     def __init__(self, config: PlatformConfig):
         super().__init__(config, Platform.DISCORD)
-        self._client: commands.Bot | None = None
+        self._client: Optional[commands.Bot] = None
         self._ready_event = asyncio.Event()
         self._allowed_user_ids: set = set()  # For button approval authorization
-
+    
     async def connect(self) -> bool:
         """Connect to Discord and start receiving events."""
         if not DISCORD_AVAILABLE:
-            print(f"[{self.name}] discord.py not installed. Run: pip install discord.py")
+            logger.error("[%s] discord.py not installed. Run: pip install discord.py", self.name)
             return False
-
+        
         if not self.config.token:
-            print(f"[{self.name}] No bot token configured")
+            logger.error("[%s] No bot token configured", self.name)
             return False
-
+        
         try:
             # Set up intents -- members intent needed for username-to-ID resolution
             intents = Intents.default()
@@ -89,119 +86,140 @@ class DiscordAdapter(BasePlatformAdapter):
             intents.dm_messages = True
             intents.guild_messages = True
             intents.members = True
-
+            
             # Create bot
             self._client = commands.Bot(
                 command_prefix="!",  # Not really used, we handle raw messages
                 intents=intents,
             )
-
+            
             # Parse allowed user entries (may contain usernames or IDs)
             allowed_env = os.getenv("DISCORD_ALLOWED_USERS", "")
             if allowed_env:
-                self._allowed_user_ids = {uid.strip() for uid in allowed_env.split(",") if uid.strip()}
-
+                self._allowed_user_ids = {
+                    uid.strip() for uid in allowed_env.split(",") if uid.strip()
+                }
+            
             adapter_self = self  # capture for closure
-
+            
             # Register event handlers
             @self._client.event
             async def on_ready():
-                print(f"[{adapter_self.name}] Connected as {adapter_self._client.user}")
-
+                logger.info("[%s] Connected as %s", adapter_self.name, adapter_self._client.user)
+                
                 # Resolve any usernames in the allowed list to numeric IDs
                 await adapter_self._resolve_allowed_usernames()
-
+                
                 # Sync slash commands with Discord
                 try:
                     synced = await adapter_self._client.tree.sync()
-                    print(f"[{adapter_self.name}] Synced {len(synced)} slash command(s)")
-                except Exception as e:
-                    print(f"[{adapter_self.name}] Slash command sync failed: {e}")
+                    logger.info("[%s] Synced %d slash command(s)", adapter_self.name, len(synced))
+                except Exception as e:  # pragma: no cover - defensive logging
+                    logger.warning("[%s] Slash command sync failed: %s", adapter_self.name, e, exc_info=True)
                 adapter_self._ready_event.set()
-
+            
             @self._client.event
             async def on_message(message: DiscordMessage):
-                # Ignore bot's own messages
+                # Always ignore our own messages
                 if message.author == self._client.user:
                     return
+                
+                # Bot message filtering (DISCORD_ALLOW_BOTS):
+                #   "none"     — ignore all other bots (default)
+                #   "mentions" — accept bot messages only when they @mention us
+                #   "all"      — accept all bot messages
+                if getattr(message.author, "bot", False):
+                    allow_bots = os.getenv("DISCORD_ALLOW_BOTS", "none").lower().strip()
+                    if allow_bots == "none":
+                        return
+                    elif allow_bots == "mentions":
+                        if not self._client.user or self._client.user not in message.mentions:
+                            return
+                    # "all" falls through to handle_message
+                
                 await self._handle_message(message)
-
+            
             # Register slash commands
             self._register_slash_commands()
-
+            
             # Start the bot in background
             asyncio.create_task(self._client.start(self.config.token))
-
+            
             # Wait for ready
             await asyncio.wait_for(self._ready_event.wait(), timeout=30)
-
+            
             self._running = True
             return True
-
-        except TimeoutError:
-            print(f"[{self.name}] Timeout waiting for connection")
+            
+        except asyncio.TimeoutError:
+            logger.error("[%s] Timeout waiting for connection to Discord", self.name, exc_info=True)
             return False
-        except Exception as e:
-            print(f"[{self.name}] Failed to connect: {e}")
+        except Exception as e:  # pragma: no cover - defensive logging
+            logger.error("[%s] Failed to connect to Discord: %s", self.name, e, exc_info=True)
             return False
-
+    
     async def disconnect(self) -> None:
         """Disconnect from Discord."""
         if self._client:
             try:
                 await self._client.close()
-            except Exception as e:
-                print(f"[{self.name}] Error during disconnect: {e}")
-
+            except Exception as e:  # pragma: no cover - defensive logging
+                logger.warning("[%s] Error during disconnect: %s", self.name, e, exc_info=True)
+        
         self._running = False
         self._client = None
         self._ready_event.clear()
-        print(f"[{self.name}] Disconnected")
-
+        logger.info("[%s] Disconnected", self.name)
+    
     async def send(
-        self, chat_id: str, content: str, reply_to: str | None = None, metadata: dict[str, Any] | None = None
+        self,
+        chat_id: str,
+        content: str,
+        reply_to: Optional[str] = None,
+        metadata: Optional[Dict[str, Any]] = None
     ) -> SendResult:
         """Send a message to a Discord channel."""
         if not self._client:
             return SendResult(success=False, error="Not connected")
-
+        
         try:
             # Get the channel
             channel = self._client.get_channel(int(chat_id))
             if not channel:
                 channel = await self._client.fetch_channel(int(chat_id))
-
+            
             if not channel:
                 return SendResult(success=False, error=f"Channel {chat_id} not found")
-
+            
             # Format and split message if needed
             formatted = self.format_message(content)
             chunks = self.truncate_message(formatted, self.MAX_MESSAGE_LENGTH)
-
+            
             message_ids = []
             reference = None
-
+            
             if reply_to:
                 try:
                     ref_msg = await channel.fetch_message(int(reply_to))
                     reference = ref_msg
                 except Exception as e:
                     logger.debug("Could not fetch reply-to message: %s", e)
-
+            
             for i, chunk in enumerate(chunks):
                 msg = await channel.send(
                     content=chunk,
                     reference=reference if i == 0 else None,
                 )
                 message_ids.append(str(msg.id))
-
+            
             return SendResult(
                 success=True,
                 message_id=message_ids[0] if message_ids else None,
-                raw_response={"message_ids": message_ids},
+                raw_response={"message_ids": message_ids}
             )
-
-        except Exception as e:
+            
+        except Exception as e:  # pragma: no cover - defensive logging
+            logger.error("[%s] Failed to send Discord message: %s", self.name, e, exc_info=True)
             return SendResult(success=False, error=str(e))
 
     async def edit_message(
@@ -220,38 +238,39 @@ class DiscordAdapter(BasePlatformAdapter):
             msg = await channel.fetch_message(int(message_id))
             formatted = self.format_message(content)
             if len(formatted) > self.MAX_MESSAGE_LENGTH:
-                formatted = formatted[: self.MAX_MESSAGE_LENGTH - 3] + "..."
+                formatted = formatted[:self.MAX_MESSAGE_LENGTH - 3] + "..."
             await msg.edit(content=formatted)
             return SendResult(success=True, message_id=message_id)
-        except Exception as e:
+        except Exception as e:  # pragma: no cover - defensive logging
+            logger.error("[%s] Failed to edit Discord message %s: %s", self.name, message_id, e, exc_info=True)
             return SendResult(success=False, error=str(e))
 
     async def send_voice(
         self,
         chat_id: str,
         audio_path: str,
-        caption: str | None = None,
-        reply_to: str | None = None,
+        caption: Optional[str] = None,
+        reply_to: Optional[str] = None,
     ) -> SendResult:
         """Send audio as a Discord file attachment."""
         if not self._client:
             return SendResult(success=False, error="Not connected")
-
+        
         try:
             import io
-
+            
             channel = self._client.get_channel(int(chat_id))
             if not channel:
                 channel = await self._client.fetch_channel(int(chat_id))
             if not channel:
                 return SendResult(success=False, error=f"Channel {chat_id} not found")
-
+            
             if not os.path.exists(audio_path):
                 return SendResult(success=False, error=f"Audio file not found: {audio_path}")
-
+            
             # Determine filename from path
             filename = os.path.basename(audio_path)
-
+            
             with open(audio_path, "rb") as f:
                 file = discord.File(io.BytesIO(f.read()), filename=filename)
                 msg = await channel.send(
@@ -259,36 +278,36 @@ class DiscordAdapter(BasePlatformAdapter):
                     file=file,
                 )
                 return SendResult(success=True, message_id=str(msg.id))
-
-        except Exception as e:
-            print(f"[{self.name}] Failed to send audio: {e}")
+        
+        except Exception as e:  # pragma: no cover - defensive logging
+            logger.error("[%s] Failed to send audio, falling back to base adapter: %s", self.name, e, exc_info=True)
             return await super().send_voice(chat_id, audio_path, caption, reply_to)
-
+    
     async def send_image_file(
         self,
         chat_id: str,
         image_path: str,
-        caption: str | None = None,
-        reply_to: str | None = None,
+        caption: Optional[str] = None,
+        reply_to: Optional[str] = None,
     ) -> SendResult:
         """Send a local image file natively as a Discord file attachment."""
         if not self._client:
             return SendResult(success=False, error="Not connected")
-
+        
         try:
             import io
-
+            
             channel = self._client.get_channel(int(chat_id))
             if not channel:
                 channel = await self._client.fetch_channel(int(chat_id))
             if not channel:
                 return SendResult(success=False, error=f"Channel {chat_id} not found")
-
+            
             if not os.path.exists(image_path):
                 return SendResult(success=False, error=f"Image file not found: {image_path}")
-
+            
             filename = os.path.basename(image_path)
-
+            
             with open(image_path, "rb") as f:
                 file = discord.File(io.BytesIO(f.read()), filename=filename)
                 msg = await channel.send(
@@ -296,40 +315,40 @@ class DiscordAdapter(BasePlatformAdapter):
                     file=file,
                 )
                 return SendResult(success=True, message_id=str(msg.id))
-
-        except Exception as e:
-            print(f"[{self.name}] Failed to send local image: {e}")
+        
+        except Exception as e:  # pragma: no cover - defensive logging
+            logger.error("[%s] Failed to send local image, falling back to base adapter: %s", self.name, e, exc_info=True)
             return await super().send_image_file(chat_id, image_path, caption, reply_to)
 
     async def send_image(
         self,
         chat_id: str,
         image_url: str,
-        caption: str | None = None,
-        reply_to: str | None = None,
+        caption: Optional[str] = None,
+        reply_to: Optional[str] = None,
     ) -> SendResult:
         """Send an image natively as a Discord file attachment."""
         if not self._client:
             return SendResult(success=False, error="Not connected")
-
+        
         try:
             import aiohttp
-
+            
             channel = self._client.get_channel(int(chat_id))
             if not channel:
                 channel = await self._client.fetch_channel(int(chat_id))
             if not channel:
                 return SendResult(success=False, error=f"Channel {chat_id} not found")
-
+            
             # Download the image and send as a Discord file attachment
             # (Discord renders attachments inline, unlike plain URLs)
             async with aiohttp.ClientSession() as session:
                 async with session.get(image_url, timeout=aiohttp.ClientTimeout(total=30)) as resp:
                     if resp.status != 200:
                         raise Exception(f"Failed to download image: HTTP {resp.status}")
-
+                    
                     image_data = await resp.read()
-
+                    
                     # Determine filename from URL or content type
                     content_type = resp.headers.get("content-type", "image/png")
                     ext = "png"
@@ -339,25 +358,33 @@ class DiscordAdapter(BasePlatformAdapter):
                         ext = "gif"
                     elif "webp" in content_type:
                         ext = "webp"
-
+                    
                     import io
-
                     file = discord.File(io.BytesIO(image_data), filename=f"image.{ext}")
-
+                    
                     msg = await channel.send(
                         content=caption if caption else None,
                         file=file,
                     )
                     return SendResult(success=True, message_id=str(msg.id))
-
+        
         except ImportError:
-            print(f"[{self.name}] aiohttp not installed, falling back to URL. Run: pip install aiohttp")
+            logger.warning(
+                "[%s] aiohttp not installed, falling back to URL. Run: pip install aiohttp",
+                self.name,
+                exc_info=True,
+            )
             return await super().send_image(chat_id, image_url, caption, reply_to)
-        except Exception as e:
-            print(f"[{self.name}] Failed to send image attachment, falling back to URL: {e}")
+        except Exception as e:  # pragma: no cover - defensive logging
+            logger.error(
+                "[%s] Failed to send image attachment, falling back to URL: %s",
+                self.name,
+                e,
+                exc_info=True,
+            )
             return await super().send_image(chat_id, image_url, caption, reply_to)
-
-    async def send_typing(self, chat_id: str) -> None:
+    
+    async def send_typing(self, chat_id: str, metadata=None) -> None:
         """Send typing indicator."""
         if self._client:
             try:
@@ -366,20 +393,20 @@ class DiscordAdapter(BasePlatformAdapter):
                     await channel.typing()
             except Exception:
                 pass  # Ignore typing indicator failures
-
-    async def get_chat_info(self, chat_id: str) -> dict[str, Any]:
+    
+    async def get_chat_info(self, chat_id: str) -> Dict[str, Any]:
         """Get information about a Discord channel."""
         if not self._client:
             return {"name": "Unknown", "type": "dm"}
-
+        
         try:
             channel = self._client.get_channel(int(chat_id))
             if not channel:
                 channel = await self._client.fetch_channel(int(chat_id))
-
+            
             if not channel:
                 return {"name": str(chat_id), "type": "dm"}
-
+            
             # Determine channel type
             if isinstance(channel, discord.DMChannel):
                 chat_type = "dm"
@@ -395,16 +422,17 @@ class DiscordAdapter(BasePlatformAdapter):
             else:
                 chat_type = "channel"
                 name = getattr(channel, "name", str(chat_id))
-
+            
             return {
                 "name": name,
                 "type": chat_type,
                 "guild_id": str(channel.guild.id) if hasattr(channel, "guild") and channel.guild else None,
                 "guild_name": channel.guild.name if hasattr(channel, "guild") and channel.guild else None,
             }
-        except Exception as e:
+        except Exception as e:  # pragma: no cover - defensive logging
+            logger.error("[%s] Failed to get chat info for %s: %s", self.name, chat_id, e, exc_info=True)
             return {"name": str(chat_id), "type": "dm", "error": str(e)}
-
+    
     async def _resolve_allowed_usernames(self) -> None:
         """
         Resolve non-numeric entries in DISCORD_ALLOWED_USERS to Discord user IDs.
@@ -451,10 +479,8 @@ class DiscordAdapter(BasePlatformAdapter):
                     uid = str(member.id)
                     numeric_ids.add(uid)
                     resolved_count += 1
-                    matched_name = (
-                        name_lower
-                        if name_lower in to_resolve
-                        else (display_lower if display_lower in to_resolve else global_lower)
+                    matched_name = name_lower if name_lower in to_resolve else (
+                        display_lower if display_lower in to_resolve else global_lower
                     )
                     to_resolve.discard(matched_name)
                     print(f"[{self.name}] Resolved '{matched_name}' -> {uid} ({member.name}#{member.discriminator})")
@@ -474,12 +500,12 @@ class DiscordAdapter(BasePlatformAdapter):
     def format_message(self, content: str) -> str:
         """
         Format message for Discord.
-
+        
         Discord uses its own markdown variant.
         """
         # Discord markdown is fairly standard, no special escaping needed
         return content
-
+    
     def _register_slash_commands(self) -> None:
         """Register Discord slash commands on the command tree."""
         if not self._client:
@@ -694,7 +720,7 @@ class DiscordAdapter(BasePlatformAdapter):
             chat_name = interaction.channel.name
             if hasattr(interaction.channel, "guild") and interaction.channel.guild:
                 chat_name = f"{interaction.channel.guild.name} / #{chat_name}"
-
+        
         # Get channel topic (if available)
         chat_topic = getattr(interaction.channel, "topic", None)
 
@@ -715,7 +741,9 @@ class DiscordAdapter(BasePlatformAdapter):
             raw_message=interaction,
         )
 
-    async def send_exec_approval(self, chat_id: str, command: str, approval_id: str) -> SendResult:
+    async def send_exec_approval(
+        self, chat_id: str, command: str, approval_id: str
+    ) -> SendResult:
         """
         Send a button-based exec approval prompt for a dangerous command.
 
@@ -747,6 +775,46 @@ class DiscordAdapter(BasePlatformAdapter):
         except Exception as e:
             return SendResult(success=False, error=str(e))
 
+    def _get_parent_channel_id(self, channel: Any) -> Optional[str]:
+        """Return the parent channel ID for a Discord thread-like channel, if present."""
+        parent = getattr(channel, "parent", None)
+        if parent is not None and getattr(parent, "id", None) is not None:
+            return str(parent.id)
+        parent_id = getattr(channel, "parent_id", None)
+        if parent_id is not None:
+            return str(parent_id)
+        return None
+
+    def _is_forum_parent(self, channel: Any) -> bool:
+        """Best-effort check for whether a Discord channel is a forum channel."""
+        if channel is None:
+            return False
+        forum_cls = getattr(discord, "ForumChannel", None)
+        if forum_cls and isinstance(channel, forum_cls):
+            return True
+        channel_type = getattr(channel, "type", None)
+        if channel_type is not None:
+            type_value = getattr(channel_type, "value", channel_type)
+            if type_value == 15:
+                return True
+        return False
+
+    def _format_thread_chat_name(self, thread: Any) -> str:
+        """Build a readable chat name for thread-like Discord channels, including forum context when available."""
+        thread_name = getattr(thread, "name", None) or str(getattr(thread, "id", "thread"))
+        parent = getattr(thread, "parent", None)
+        guild = getattr(thread, "guild", None) or getattr(parent, "guild", None)
+        guild_name = getattr(guild, "name", None)
+        parent_name = getattr(parent, "name", None)
+
+        if self._is_forum_parent(parent) and guild_name and parent_name:
+            return f"{guild_name} / {parent_name} / {thread_name}"
+        if parent_name and guild_name:
+            return f"{guild_name} / #{parent_name} / {thread_name}"
+        if parent_name:
+            return f"{parent_name} / {thread_name}"
+        return thread_name
+
     async def _handle_message(self, message: DiscordMessage) -> None:
         """Handle incoming Discord messages."""
         # In server channels (not DMs), require the bot to be @mentioned
@@ -757,24 +825,29 @@ class DiscordAdapter(BasePlatformAdapter):
         #       bot responds to every message without needing a mention.
         #   DISCORD_REQUIRE_MENTION: Set to "false" to disable mention requirement
         #       globally (all channels become free-response). Default: "true".
+        #       Can also be set via discord.require_mention in config.yaml.
+
+        thread_id = None
+        parent_channel_id = None
+        is_thread = isinstance(message.channel, discord.Thread)
+        if is_thread:
+            thread_id = str(message.channel.id)
+            parent_channel_id = self._get_parent_channel_id(message.channel)
 
         if not isinstance(message.channel, discord.DMChannel):
-            # Check if this channel is in the free-response list
             free_channels_raw = os.getenv("DISCORD_FREE_RESPONSE_CHANNELS", "")
             free_channels = {ch.strip() for ch in free_channels_raw.split(",") if ch.strip()}
-            channel_id = str(message.channel.id)
+            channel_ids = {str(message.channel.id)}
+            if parent_channel_id:
+                channel_ids.add(parent_channel_id)
 
-            # Global override: if DISCORD_REQUIRE_MENTION=false, all channels are free
             require_mention = os.getenv("DISCORD_REQUIRE_MENTION", "true").lower() not in ("false", "0", "no")
-
-            is_free_channel = channel_id in free_channels
+            is_free_channel = bool(channel_ids & free_channels)
 
             if require_mention and not is_free_channel:
-                # Must be @mentioned to respond
                 if self._client.user not in message.mentions:
-                    return  # Silently ignore messages that don't mention the bot
+                    return
 
-            # Strip the bot mention from the message text so the agent sees clean input
             if self._client.user and self._client.user in message.mentions:
                 message.content = message.content.replace(f"<@{self._client.user.id}>", "").strip()
                 message.content = message.content.replace(f"<@!{self._client.user.id}>", "").strip()
@@ -796,28 +869,23 @@ class DiscordAdapter(BasePlatformAdapter):
                     else:
                         msg_type = MessageType.DOCUMENT
                     break
-
+        
         # Determine chat type
         if isinstance(message.channel, discord.DMChannel):
             chat_type = "dm"
             chat_name = message.author.name
-        elif isinstance(message.channel, discord.Thread):
+        elif is_thread:
             chat_type = "thread"
-            chat_name = message.channel.name
+            chat_name = self._format_thread_chat_name(message.channel)
         else:
-            chat_type = "group"  # Treat server channels as groups
+            chat_type = "group"
             chat_name = getattr(message.channel, "name", str(message.channel.id))
             if hasattr(message.channel, "guild") and message.channel.guild:
                 chat_name = f"{message.channel.guild.name} / #{chat_name}"
 
-        # Get thread ID if in a thread
-        thread_id = None
-        if isinstance(message.channel, discord.Thread):
-            thread_id = str(message.channel.id)
-
         # Get channel topic (if available - TextChannels have topics, DMs/threads don't)
         chat_topic = getattr(message.channel, "topic", None)
-
+        
         # Build source
         source = self.build_source(
             chat_id=str(message.channel.id),
@@ -828,7 +896,7 @@ class DiscordAdapter(BasePlatformAdapter):
             thread_id=thread_id,
             chat_topic=chat_topic,
         )
-
+        
         # Build media URLs -- download image attachments to local cache so the
         # vision tool can access them reliably (Discord CDN URLs can expire).
         media_urls = []
@@ -867,7 +935,7 @@ class DiscordAdapter(BasePlatformAdapter):
                 # Other attachments: keep the original URL
                 media_urls.append(att.url)
                 media_types.append(content_type)
-
+        
         event = MessageEvent(
             text=message.content,
             message_type=msg_type,
@@ -879,7 +947,7 @@ class DiscordAdapter(BasePlatformAdapter):
             reply_to_message_id=str(message.reference.message_id) if message.reference else None,
             timestamp=message.created_at,
         )
-
+        
         await self.handle_message(event)
 
 
@@ -909,14 +977,20 @@ if DISCORD_AVAILABLE:
                 return True  # No allowlist = anyone can approve
             return str(interaction.user.id) in self.allowed_user_ids
 
-        async def _resolve(self, interaction: discord.Interaction, action: str, color: discord.Color):
+        async def _resolve(
+            self, interaction: discord.Interaction, action: str, color: discord.Color
+        ):
             """Resolve the approval and update the message."""
             if self.resolved:
-                await interaction.response.send_message("This approval has already been resolved~", ephemeral=True)
+                await interaction.response.send_message(
+                    "This approval has already been resolved~", ephemeral=True
+                )
                 return
 
             if not self._check_auth(interaction):
-                await interaction.response.send_message("You're not authorized to approve commands~", ephemeral=True)
+                await interaction.response.send_message(
+                    "You're not authorized to approve commands~", ephemeral=True
+                )
                 return
 
             self.resolved = True
@@ -936,7 +1010,6 @@ if DISCORD_AVAILABLE:
             # Store the approval decision
             try:
                 from tools.approval import approve_permanent
-
                 if action == "allow_once":
                     pass  # One-time approval handled by gateway
                 elif action == "allow_always":
@@ -945,15 +1018,21 @@ if DISCORD_AVAILABLE:
                 pass
 
         @discord.ui.button(label="Allow Once", style=discord.ButtonStyle.green)
-        async def allow_once(self, interaction: discord.Interaction, button: discord.ui.Button):
+        async def allow_once(
+            self, interaction: discord.Interaction, button: discord.ui.Button
+        ):
             await self._resolve(interaction, "allow_once", discord.Color.green())
 
         @discord.ui.button(label="Always Allow", style=discord.ButtonStyle.blurple)
-        async def allow_always(self, interaction: discord.Interaction, button: discord.ui.Button):
+        async def allow_always(
+            self, interaction: discord.Interaction, button: discord.ui.Button
+        ):
             await self._resolve(interaction, "allow_always", discord.Color.blue())
 
         @discord.ui.button(label="Deny", style=discord.ButtonStyle.red)
-        async def deny(self, interaction: discord.Interaction, button: discord.ui.Button):
+        async def deny(
+            self, interaction: discord.Interaction, button: discord.ui.Button
+        ):
             await self._resolve(interaction, "deny", discord.Color.red())
 
         async def on_timeout(self):

gateway/platforms/email.py

@@ -0,0 +1,533 @@
+"""
+Email platform adapter for the Hermes gateway.
+
+Allows users to interact with Hermes by sending emails.
+Uses IMAP to receive and SMTP to send messages.
+
+Environment variables:
+    EMAIL_IMAP_HOST     — IMAP server host (e.g., imap.gmail.com)
+    EMAIL_IMAP_PORT     — IMAP server port (default: 993)
+    EMAIL_SMTP_HOST     — SMTP server host (e.g., smtp.gmail.com)
+    EMAIL_SMTP_PORT     — SMTP server port (default: 587)
+    EMAIL_ADDRESS       — Email address for the agent
+    EMAIL_PASSWORD      — Email password or app-specific password
+    EMAIL_POLL_INTERVAL — Seconds between mailbox checks (default: 15)
+    EMAIL_ALLOWED_USERS — Comma-separated list of allowed sender addresses
+"""
+
+import asyncio
+import email as email_lib
+import imaplib
+import logging
+import os
+import re
+import smtplib
+import uuid
+from datetime import datetime
+from email.header import decode_header
+from email.mime.multipart import MIMEMultipart
+from email.mime.text import MIMEText
+from email.mime.base import MIMEBase
+from email import encoders
+from pathlib import Path
+from typing import Any, Dict, List, Optional
+
+from gateway.platforms.base import (
+    BasePlatformAdapter,
+    MessageEvent,
+    MessageType,
+    SendResult,
+    cache_document_from_bytes,
+    cache_image_from_bytes,
+)
+from gateway.config import Platform, PlatformConfig
+
+logger = logging.getLogger(__name__)
+
+# Gmail-safe max length per email body
+MAX_MESSAGE_LENGTH = 50_000
+
+# Supported image extensions for inline detection
+_IMAGE_EXTS = {".jpg", ".jpeg", ".png", ".gif", ".webp"}
+
+
+def check_email_requirements() -> bool:
+    """Check if email platform dependencies are available."""
+    addr = os.getenv("EMAIL_ADDRESS")
+    pwd = os.getenv("EMAIL_PASSWORD")
+    imap = os.getenv("EMAIL_IMAP_HOST")
+    smtp = os.getenv("EMAIL_SMTP_HOST")
+    if not all([addr, pwd, imap, smtp]):
+        return False
+    return True
+
+
+def _decode_header_value(raw: str) -> str:
+    """Decode an RFC 2047 encoded email header into a plain string."""
+    parts = decode_header(raw)
+    decoded = []
+    for part, charset in parts:
+        if isinstance(part, bytes):
+            decoded.append(part.decode(charset or "utf-8", errors="replace"))
+        else:
+            decoded.append(part)
+    return " ".join(decoded)
+
+
+def _extract_text_body(msg: email_lib.message.Message) -> str:
+    """Extract the plain-text body from a potentially multipart email."""
+    if msg.is_multipart():
+        for part in msg.walk():
+            content_type = part.get_content_type()
+            disposition = str(part.get("Content-Disposition", ""))
+            # Skip attachments
+            if "attachment" in disposition:
+                continue
+            if content_type == "text/plain":
+                payload = part.get_payload(decode=True)
+                if payload:
+                    charset = part.get_content_charset() or "utf-8"
+                    return payload.decode(charset, errors="replace")
+        # Fallback: try text/html and strip tags
+        for part in msg.walk():
+            content_type = part.get_content_type()
+            disposition = str(part.get("Content-Disposition", ""))
+            if "attachment" in disposition:
+                continue
+            if content_type == "text/html":
+                payload = part.get_payload(decode=True)
+                if payload:
+                    charset = part.get_content_charset() or "utf-8"
+                    html = payload.decode(charset, errors="replace")
+                    return _strip_html(html)
+        return ""
+    else:
+        payload = msg.get_payload(decode=True)
+        if payload:
+            charset = msg.get_content_charset() or "utf-8"
+            text = payload.decode(charset, errors="replace")
+            if msg.get_content_type() == "text/html":
+                return _strip_html(text)
+            return text
+        return ""
+
+
+def _strip_html(html: str) -> str:
+    """Naive HTML tag stripper for fallback text extraction."""
+    text = re.sub(r"<br\s*/?>", "\n", html, flags=re.IGNORECASE)
+    text = re.sub(r"<p[^>]*>", "\n", text, flags=re.IGNORECASE)
+    text = re.sub(r"</p>", "\n", text, flags=re.IGNORECASE)
+    text = re.sub(r"<[^>]+>", "", text)
+    text = re.sub(r"&nbsp;", " ", text)
+    text = re.sub(r"&amp;", "&", text)
+    text = re.sub(r"&lt;", "<", text)
+    text = re.sub(r"&gt;", ">", text)
+    text = re.sub(r"\n{3,}", "\n\n", text)
+    return text.strip()
+
+
+def _extract_email_address(raw: str) -> str:
+    """Extract bare email address from 'Name <addr>' format."""
+    match = re.search(r"<([^>]+)>", raw)
+    if match:
+        return match.group(1).strip().lower()
+    return raw.strip().lower()
+
+
+def _extract_attachments(msg: email_lib.message.Message) -> List[Dict[str, Any]]:
+    """Extract attachment metadata and cache files locally."""
+    attachments = []
+    if not msg.is_multipart():
+        return attachments
+
+    for part in msg.walk():
+        disposition = str(part.get("Content-Disposition", ""))
+        if "attachment" not in disposition and "inline" not in disposition:
+            continue
+        # Skip text/plain and text/html body parts
+        content_type = part.get_content_type()
+        if content_type in ("text/plain", "text/html") and "attachment" not in disposition:
+            continue
+
+        filename = part.get_filename()
+        if filename:
+            filename = _decode_header_value(filename)
+        else:
+            ext = part.get_content_subtype() or "bin"
+            filename = f"attachment.{ext}"
+
+        payload = part.get_payload(decode=True)
+        if not payload:
+            continue
+
+        ext = Path(filename).suffix.lower()
+        if ext in _IMAGE_EXTS:
+            cached_path = cache_image_from_bytes(payload, ext)
+            attachments.append({
+                "path": cached_path,
+                "filename": filename,
+                "type": "image",
+                "media_type": content_type,
+            })
+        else:
+            cached_path = cache_document_from_bytes(payload, filename)
+            attachments.append({
+                "path": cached_path,
+                "filename": filename,
+                "type": "document",
+                "media_type": content_type,
+            })
+
+    return attachments
+
+
+class EmailAdapter(BasePlatformAdapter):
+    """Email gateway adapter using IMAP (receive) and SMTP (send)."""
+
+    def __init__(self, config: PlatformConfig):
+        super().__init__(config, Platform.EMAIL)
+
+        self._address = os.getenv("EMAIL_ADDRESS", "")
+        self._password = os.getenv("EMAIL_PASSWORD", "")
+        self._imap_host = os.getenv("EMAIL_IMAP_HOST", "")
+        self._imap_port = int(os.getenv("EMAIL_IMAP_PORT", "993"))
+        self._smtp_host = os.getenv("EMAIL_SMTP_HOST", "")
+        self._smtp_port = int(os.getenv("EMAIL_SMTP_PORT", "587"))
+        self._poll_interval = int(os.getenv("EMAIL_POLL_INTERVAL", "15"))
+
+        # Track message IDs we've already processed to avoid duplicates
+        self._seen_uids: set = set()
+        self._poll_task: Optional[asyncio.Task] = None
+
+        # Map chat_id (sender email) -> last subject + message-id for threading
+        self._thread_context: Dict[str, Dict[str, str]] = {}
+
+        logger.info("[Email] Adapter initialized for %s", self._address)
+
+    async def connect(self) -> bool:
+        """Connect to the IMAP server and start polling for new messages."""
+        try:
+            # Test IMAP connection
+            imap = imaplib.IMAP4_SSL(self._imap_host, self._imap_port)
+            imap.login(self._address, self._password)
+            # Mark all existing messages as seen so we only process new ones
+            imap.select("INBOX")
+            status, data = imap.search(None, "ALL")
+            if status == "OK" and data[0]:
+                for uid in data[0].split():
+                    self._seen_uids.add(uid)
+            imap.logout()
+            logger.info("[Email] IMAP connection test passed. %d existing messages skipped.", len(self._seen_uids))
+        except Exception as e:
+            logger.error("[Email] IMAP connection failed: %s", e)
+            return False
+
+        try:
+            # Test SMTP connection
+            smtp = smtplib.SMTP(self._smtp_host, self._smtp_port)
+            smtp.starttls()
+            smtp.login(self._address, self._password)
+            smtp.quit()
+            logger.info("[Email] SMTP connection test passed.")
+        except Exception as e:
+            logger.error("[Email] SMTP connection failed: %s", e)
+            return False
+
+        self._running = True
+        self._poll_task = asyncio.create_task(self._poll_loop())
+        print(f"[Email] Connected as {self._address}")
+        return True
+
+    async def disconnect(self) -> None:
+        """Stop polling and disconnect."""
+        self._running = False
+        if self._poll_task:
+            self._poll_task.cancel()
+            try:
+                await self._poll_task
+            except asyncio.CancelledError:
+                pass
+            self._poll_task = None
+        logger.info("[Email] Disconnected.")
+
+    async def _poll_loop(self) -> None:
+        """Poll IMAP for new messages at regular intervals."""
+        while self._running:
+            try:
+                await self._check_inbox()
+            except asyncio.CancelledError:
+                break
+            except Exception as e:
+                logger.error("[Email] Poll error: %s", e)
+            await asyncio.sleep(self._poll_interval)
+
+    async def _check_inbox(self) -> None:
+        """Check INBOX for unseen messages and dispatch them."""
+        # Run IMAP operations in a thread to avoid blocking the event loop
+        loop = asyncio.get_running_loop()
+        messages = await loop.run_in_executor(None, self._fetch_new_messages)
+        for msg_data in messages:
+            await self._dispatch_message(msg_data)
+
+    def _fetch_new_messages(self) -> List[Dict[str, Any]]:
+        """Fetch new (unseen) messages from IMAP. Runs in executor thread."""
+        results = []
+        try:
+            imap = imaplib.IMAP4_SSL(self._imap_host, self._imap_port)
+            imap.login(self._address, self._password)
+            imap.select("INBOX")
+
+            status, data = imap.search(None, "UNSEEN")
+            if status != "OK" or not data[0]:
+                imap.logout()
+                return results
+
+            for uid in data[0].split():
+                if uid in self._seen_uids:
+                    continue
+                self._seen_uids.add(uid)
+
+                status, msg_data = imap.fetch(uid, "(RFC822)")
+                if status != "OK":
+                    continue
+
+                raw_email = msg_data[0][1]
+                msg = email_lib.message_from_bytes(raw_email)
+
+                sender_raw = msg.get("From", "")
+                sender_addr = _extract_email_address(sender_raw)
+                sender_name = _decode_header_value(sender_raw)
+                # Remove email from name if present
+                if "<" in sender_name:
+                    sender_name = sender_name.split("<")[0].strip().strip('"')
+
+                subject = _decode_header_value(msg.get("Subject", "(no subject)"))
+                message_id = msg.get("Message-ID", "")
+                in_reply_to = msg.get("In-Reply-To", "")
+                body = _extract_text_body(msg)
+                attachments = _extract_attachments(msg)
+
+                results.append({
+                    "uid": uid,
+                    "sender_addr": sender_addr,
+                    "sender_name": sender_name,
+                    "subject": subject,
+                    "message_id": message_id,
+                    "in_reply_to": in_reply_to,
+                    "body": body,
+                    "attachments": attachments,
+                    "date": msg.get("Date", ""),
+                })
+
+            imap.logout()
+        except Exception as e:
+            logger.error("[Email] IMAP fetch error: %s", e)
+        return results
+
+    async def _dispatch_message(self, msg_data: Dict[str, Any]) -> None:
+        """Convert a fetched email into a MessageEvent and dispatch it."""
+        sender_addr = msg_data["sender_addr"]
+
+        # Skip self-messages
+        if sender_addr == self._address.lower():
+            return
+
+        subject = msg_data["subject"]
+        body = msg_data["body"].strip()
+        attachments = msg_data["attachments"]
+
+        # Build message text: include subject as context
+        text = body
+        if subject and not subject.startswith("Re:"):
+            text = f"[Subject: {subject}]\n\n{body}"
+
+        # Determine message type and media
+        media_urls = []
+        media_types = []
+        msg_type = MessageType.TEXT
+
+        for att in attachments:
+            media_urls.append(att["path"])
+            media_types.append(att["media_type"])
+            if att["type"] == "image":
+                msg_type = MessageType.PHOTO
+
+        # Store thread context for reply threading
+        self._thread_context[sender_addr] = {
+            "subject": subject,
+            "message_id": msg_data["message_id"],
+        }
+
+        source = self.build_source(
+            chat_id=sender_addr,
+            chat_name=msg_data["sender_name"] or sender_addr,
+            chat_type="dm",
+            user_id=sender_addr,
+            user_name=msg_data["sender_name"] or sender_addr,
+        )
+
+        event = MessageEvent(
+            text=text or "(empty email)",
+            message_type=msg_type,
+            source=source,
+            message_id=msg_data["message_id"],
+            media_urls=media_urls,
+            media_types=media_types,
+            reply_to_message_id=msg_data["in_reply_to"] or None,
+        )
+
+        logger.info("[Email] New message from %s: %s", sender_addr, subject)
+        await self.handle_message(event)
+
+    async def send(
+        self,
+        chat_id: str,
+        content: str,
+        reply_to: Optional[str] = None,
+        metadata: Optional[Dict[str, Any]] = None,
+    ) -> SendResult:
+        """Send an email reply to the given address."""
+        try:
+            loop = asyncio.get_running_loop()
+            message_id = await loop.run_in_executor(
+                None, self._send_email, chat_id, content, reply_to
+            )
+            return SendResult(success=True, message_id=message_id)
+        except Exception as e:
+            logger.error("[Email] Send failed to %s: %s", chat_id, e)
+            return SendResult(success=False, error=str(e))
+
+    def _send_email(
+        self,
+        to_addr: str,
+        body: str,
+        reply_to_msg_id: Optional[str] = None,
+    ) -> str:
+        """Send an email via SMTP. Runs in executor thread."""
+        msg = MIMEMultipart()
+        msg["From"] = self._address
+        msg["To"] = to_addr
+
+        # Thread context for reply
+        ctx = self._thread_context.get(to_addr, {})
+        subject = ctx.get("subject", "Hermes Agent")
+        if not subject.startswith("Re:"):
+            subject = f"Re: {subject}"
+        msg["Subject"] = subject
+
+        # Threading headers
+        original_msg_id = reply_to_msg_id or ctx.get("message_id")
+        if original_msg_id:
+            msg["In-Reply-To"] = original_msg_id
+            msg["References"] = original_msg_id
+
+        msg_id = f"<hermes-{uuid.uuid4().hex[:12]}@{self._address.split('@')[1]}>"
+        msg["Message-ID"] = msg_id
+
+        msg.attach(MIMEText(body, "plain", "utf-8"))
+
+        smtp = smtplib.SMTP(self._smtp_host, self._smtp_port)
+        smtp.starttls()
+        smtp.login(self._address, self._password)
+        smtp.send_message(msg)
+        smtp.quit()
+
+        logger.info("[Email] Sent reply to %s (subject: %s)", to_addr, subject)
+        return msg_id
+
+    async def send_typing(self, chat_id: str) -> None:
+        """Email has no typing indicator — no-op."""
+        pass
+
+    async def send_image(
+        self,
+        chat_id: str,
+        image_url: str,
+        caption: Optional[str] = None,
+        reply_to: Optional[str] = None,
+    ) -> SendResult:
+        """Send an image URL as part of an email body."""
+        text = caption or ""
+        text += f"\n\nImage: {image_url}"
+        return await self.send(chat_id, text.strip(), reply_to)
+
+    async def send_document(
+        self,
+        chat_id: str,
+        file_path: str,
+        caption: Optional[str] = None,
+        file_name: Optional[str] = None,
+        reply_to: Optional[str] = None,
+    ) -> SendResult:
+        """Send a file as an email attachment."""
+        try:
+            loop = asyncio.get_running_loop()
+            message_id = await loop.run_in_executor(
+                None,
+                self._send_email_with_attachment,
+                chat_id,
+                caption or "",
+                file_path,
+                file_name,
+            )
+            return SendResult(success=True, message_id=message_id)
+        except Exception as e:
+            logger.error("[Email] Send document failed: %s", e)
+            return SendResult(success=False, error=str(e))
+
+    def _send_email_with_attachment(
+        self,
+        to_addr: str,
+        body: str,
+        file_path: str,
+        file_name: Optional[str] = None,
+    ) -> str:
+        """Send an email with a file attachment via SMTP."""
+        msg = MIMEMultipart()
+        msg["From"] = self._address
+        msg["To"] = to_addr
+
+        ctx = self._thread_context.get(to_addr, {})
+        subject = ctx.get("subject", "Hermes Agent")
+        if not subject.startswith("Re:"):
+            subject = f"Re: {subject}"
+        msg["Subject"] = subject
+
+        original_msg_id = ctx.get("message_id")
+        if original_msg_id:
+            msg["In-Reply-To"] = original_msg_id
+            msg["References"] = original_msg_id
+
+        msg_id = f"<hermes-{uuid.uuid4().hex[:12]}@{self._address.split('@')[1]}>"
+        msg["Message-ID"] = msg_id
+
+        if body:
+            msg.attach(MIMEText(body, "plain", "utf-8"))
+
+        # Attach file
+        p = Path(file_path)
+        fname = file_name or p.name
+        with open(p, "rb") as f:
+            part = MIMEBase("application", "octet-stream")
+            part.set_payload(f.read())
+            encoders.encode_base64(part)
+            part.add_header("Content-Disposition", f"attachment; filename={fname}")
+            msg.attach(part)
+
+        smtp = smtplib.SMTP(self._smtp_host, self._smtp_port)
+        smtp.starttls()
+        smtp.login(self._address, self._password)
+        smtp.send_message(msg)
+        smtp.quit()
+
+        return msg_id
+
+    async def get_chat_info(self, chat_id: str) -> Dict[str, Any]:
+        """Return basic info about the email chat."""
+        ctx = self._thread_context.get(chat_id, {})
+        return {
+            "name": chat_id,
+            "type": "dm",
+            "chat_id": chat_id,
+            "subject": ctx.get("subject", ""),
+        }

gateway/platforms/homeassistant.py

@@ -19,11 +19,10 @@ import os
 import time
 import uuid
 from datetime import datetime
-from typing import Any
+from typing import Any, Dict, List, Optional, Set
 
 try:
     import aiohttp
-
     AIOHTTP_AVAILABLE = True
 except ImportError:
     AIOHTTP_AVAILABLE = False
@@ -67,10 +66,10 @@ class HomeAssistantAdapter(BasePlatformAdapter):
         super().__init__(config, Platform.HOMEASSISTANT)
 
         # Connection state
-        self._session: aiohttp.ClientSession | None = None
-        self._ws: aiohttp.ClientWebSocketResponse | None = None
-        self._rest_session: aiohttp.ClientSession | None = None
-        self._listen_task: asyncio.Task | None = None
+        self._session: Optional["aiohttp.ClientSession"] = None
+        self._ws: Optional["aiohttp.ClientWebSocketResponse"] = None
+        self._rest_session: Optional["aiohttp.ClientSession"] = None
+        self._listen_task: Optional[asyncio.Task] = None
         self._msg_id: int = 0
 
         # Configuration from extra
@@ -81,13 +80,13 @@ class HomeAssistantAdapter(BasePlatformAdapter):
         self._hass_token: str = token
 
         # Event filtering
-        self._watch_domains: set[str] = set(extra.get("watch_domains", []))
-        self._watch_entities: set[str] = set(extra.get("watch_entities", []))
-        self._ignore_entities: set[str] = set(extra.get("ignore_entities", []))
+        self._watch_domains: Set[str] = set(extra.get("watch_domains", []))
+        self._watch_entities: Set[str] = set(extra.get("watch_entities", []))
+        self._ignore_entities: Set[str] = set(extra.get("ignore_entities", []))
         self._cooldown_seconds: int = int(extra.get("cooldown_seconds", 30))
 
         # Cooldown tracking: entity_id -> last_event_timestamp
-        self._last_event_time: dict[str, float] = {}
+        self._last_event_time: Dict[str, float] = {}
 
     def _next_id(self) -> int:
         """Return the next WebSocket message ID."""
@@ -142,12 +141,10 @@ class HomeAssistantAdapter(BasePlatformAdapter):
             return False
 
         # Step 2: Send auth
-        await self._ws.send_json(
-            {
-                "type": "auth",
-                "access_token": self._hass_token,
-            }
-        )
+        await self._ws.send_json({
+            "type": "auth",
+            "access_token": self._hass_token,
+        })
 
         # Step 3: Wait for auth_ok
         msg = await self._ws.receive_json()
@@ -158,13 +155,11 @@ class HomeAssistantAdapter(BasePlatformAdapter):
 
         # Step 4: Subscribe to state_changed events
         sub_id = self._next_id()
-        await self._ws.send_json(
-            {
-                "id": sub_id,
-                "type": "subscribe_events",
-                "event_type": "state_changed",
-            }
-        )
+        await self._ws.send_json({
+            "id": sub_id,
+            "type": "subscribe_events",
+            "event_type": "state_changed",
+        })
 
         # Verify subscription acknowledgement
         msg = await self._ws.receive_json()
@@ -250,7 +245,7 @@ class HomeAssistantAdapter(BasePlatformAdapter):
             elif ws_msg.type in (aiohttp.WSMsgType.CLOSED, aiohttp.WSMsgType.ERROR):
                 break
 
-    async def _handle_ha_event(self, event: dict[str, Any]) -> None:
+    async def _handle_ha_event(self, event: Dict[str, Any]) -> None:
         """Process a state_changed event from Home Assistant."""
         event_data = event.get("data", {})
         entity_id: str = event_data.get("entity_id", "")
@@ -307,9 +302,9 @@ class HomeAssistantAdapter(BasePlatformAdapter):
     @staticmethod
     def _format_state_change(
         entity_id: str,
-        old_state: dict[str, Any],
-        new_state: dict[str, Any],
-    ) -> str | None:
+        old_state: Dict[str, Any],
+        new_state: Dict[str, Any],
+    ) -> Optional[str]:
         """Convert a state_changed event into a human-readable description."""
         if not new_state:
             return None
@@ -336,7 +331,10 @@ class HomeAssistantAdapter(BasePlatformAdapter):
 
         if domain == "sensor":
             unit = new_state.get("attributes", {}).get("unit_of_measurement", "")
-            return f"[Home Assistant] {friendly_name}: changed from {old_val}{unit} to {new_val}{unit}"
+            return (
+                f"[Home Assistant] {friendly_name}: changed from "
+                f"{old_val}{unit} to {new_val}{unit}"
+            )
 
         if domain == "binary_sensor":
             return (
@@ -346,13 +344,22 @@ class HomeAssistantAdapter(BasePlatformAdapter):
             )
 
         if domain in ("light", "switch", "fan"):
-            return f"[Home Assistant] {friendly_name}: turned {'on' if new_val == 'on' else 'off'}"
+            return (
+                f"[Home Assistant] {friendly_name}: turned "
+                f"{'on' if new_val == 'on' else 'off'}"
+            )
 
         if domain == "alarm_control_panel":
-            return f"[Home Assistant] {friendly_name}: alarm state changed from '{old_val}' to '{new_val}'"
+            return (
+                f"[Home Assistant] {friendly_name}: alarm state changed from "
+                f"'{old_val}' to '{new_val}'"
+            )
 
         # Generic fallback
-        return f"[Home Assistant] {friendly_name} ({entity_id}): changed from '{old_val}' to '{new_val}'"
+        return (
+            f"[Home Assistant] {friendly_name} ({entity_id}): "
+            f"changed from '{old_val}' to '{new_val}'"
+        )
 
     # ------------------------------------------------------------------
     # Outbound messaging
@@ -362,8 +369,8 @@ class HomeAssistantAdapter(BasePlatformAdapter):
         self,
         chat_id: str,
         content: str,
-        reply_to: str | None = None,
-        metadata: dict[str, Any] | None = None,
+        reply_to: Optional[str] = None,
+        metadata: Optional[Dict[str, Any]] = None,
     ) -> SendResult:
         """Send a notification via HA REST API (persistent_notification.create).
 
@@ -377,7 +384,7 @@ class HomeAssistantAdapter(BasePlatformAdapter):
         }
         payload = {
             "title": "Hermes Agent",
-            "message": content[: self.MAX_MESSAGE_LENGTH],
+            "message": content[:self.MAX_MESSAGE_LENGTH],
         }
 
         try:
@@ -394,31 +401,29 @@ class HomeAssistantAdapter(BasePlatformAdapter):
                         body = await resp.text()
                         return SendResult(success=False, error=f"HTTP {resp.status}: {body}")
             else:
-                async with (
-                    aiohttp.ClientSession() as session,
-                    session.post(
+                async with aiohttp.ClientSession() as session:
+                    async with session.post(
                         url,
                         headers=headers,
                         json=payload,
                         timeout=aiohttp.ClientTimeout(total=10),
-                    ) as resp,
-                ):
-                    if resp.status < 300:
-                        return SendResult(success=True, message_id=uuid.uuid4().hex[:12])
-                    else:
-                        body = await resp.text()
-                        return SendResult(success=False, error=f"HTTP {resp.status}: {body}")
+                    ) as resp:
+                        if resp.status < 300:
+                            return SendResult(success=True, message_id=uuid.uuid4().hex[:12])
+                        else:
+                            body = await resp.text()
+                            return SendResult(success=False, error=f"HTTP {resp.status}: {body}")
 
-        except TimeoutError:
+        except asyncio.TimeoutError:
             return SendResult(success=False, error="Timeout sending notification to HA")
         except Exception as e:
             return SendResult(success=False, error=str(e))
 
-    async def send_typing(self, chat_id: str) -> None:
+    async def send_typing(self, chat_id: str, metadata=None) -> None:
         """No typing indicator for Home Assistant."""
         pass
 
-    async def get_chat_info(self, chat_id: str) -> dict[str, Any]:
+    async def get_chat_info(self, chat_id: str) -> Dict[str, Any]:
         """Return basic info about the HA event channel."""
         return {
             "name": "Home Assistant Events",

gateway/platforms/signal.py

@@ -19,9 +19,9 @@ import os
 import random
 import re
 import time
-from datetime import UTC, datetime
+from datetime import datetime, timezone
 from pathlib import Path
-from typing import Any
+from typing import Dict, List, Optional, Any
 from urllib.parse import unquote
 
 import httpx
@@ -32,9 +32,9 @@ from gateway.platforms.base import (
     MessageEvent,
     MessageType,
     SendResult,
+    cache_image_from_bytes,
     cache_audio_from_bytes,
     cache_document_from_bytes,
-    cache_image_from_bytes,
     cache_image_from_url,
 )
 
@@ -59,7 +59,6 @@ _PHONE_RE = re.compile(r"\+[1-9]\d{6,14}")
 # Helpers
 # ---------------------------------------------------------------------------
 
-
 def _redact_phone(phone: str) -> str:
     """Redact a phone number for logging: +15551234567 -> +155****4567."""
     if not phone:
@@ -69,7 +68,7 @@ def _redact_phone(phone: str) -> str:
     return phone[:4] + "****" + phone[-4:]
 
 
-def _parse_comma_list(value: str) -> list[str]:
+def _parse_comma_list(value: str) -> List[str]:
     """Split a comma-separated string into a list, stripping whitespace."""
     return [v.strip() for v in value.split(",") if v.strip()]
 
@@ -105,13 +104,27 @@ def _is_audio_ext(ext: str) -> bool:
     return ext.lower() in (".mp3", ".wav", ".ogg", ".m4a", ".aac")
 
 
+_EXT_TO_MIME = {
+    ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".png": "image/png",
+    ".gif": "image/gif", ".webp": "image/webp",
+    ".ogg": "audio/ogg", ".mp3": "audio/mpeg", ".wav": "audio/wav",
+    ".m4a": "audio/mp4", ".aac": "audio/aac",
+    ".mp4": "video/mp4", ".pdf": "application/pdf", ".zip": "application/zip",
+}
+
+
+def _ext_to_mime(ext: str) -> str:
+    """Map file extension to MIME type."""
+    return _EXT_TO_MIME.get(ext.lower(), "application/octet-stream")
+
+
 def _render_mentions(text: str, mentions: list) -> str:
     """Replace Signal mention placeholders (\\uFFFC) with readable @identifiers.
 
     Signal encodes @mentions as the Unicode object replacement character
     with out-of-band metadata containing the mentioned user's UUID/number.
     """
-    if not mentions or "\ufffc" not in text:
+    if not mentions or "\uFFFC" not in text:
         return text
     # Sort mentions by start position (reverse) to replace from end to start
     # so indices don't shift as we replace
@@ -122,7 +135,7 @@ def _render_mentions(text: str, mentions: list) -> str:
         # Use the mention's number or UUID as the replacement
         identifier = mention.get("number") or mention.get("uuid") or "user"
         replacement = f"@{identifier}"
-        text = text[:start] + replacement + text[start + length :]
+        text = text[:start] + replacement + text[start + length:]
     return text
 
 
@@ -135,7 +148,6 @@ def check_signal_requirements() -> bool:
 # Signal Adapter
 # ---------------------------------------------------------------------------
 
-
 class SignalAdapter(BasePlatformAdapter):
     """Signal messenger adapter using signal-cli HTTP daemon."""
 
@@ -154,25 +166,22 @@ class SignalAdapter(BasePlatformAdapter):
         self.group_allow_from = set(_parse_comma_list(group_allowed_str))
 
         # HTTP client
-        self.client: httpx.AsyncClient | None = None
+        self.client: Optional[httpx.AsyncClient] = None
 
         # Background tasks
-        self._sse_task: asyncio.Task | None = None
-        self._health_monitor_task: asyncio.Task | None = None
-        self._typing_tasks: dict[str, asyncio.Task] = {}
+        self._sse_task: Optional[asyncio.Task] = None
+        self._health_monitor_task: Optional[asyncio.Task] = None
+        self._typing_tasks: Dict[str, asyncio.Task] = {}
         self._running = False
         self._last_sse_activity = 0.0
-        self._sse_response: httpx.Response | None = None
+        self._sse_response: Optional[httpx.Response] = None
 
         # Normalize account for self-message filtering
         self._account_normalized = self.account.strip()
 
-        logger.info(
-            "Signal adapter initialized: url=%s account=%s groups=%s",
-            self.http_url,
-            _redact_phone(self.account),
-            "enabled" if self.group_allow_from else "disabled",
-        )
+        logger.info("Signal adapter initialized: url=%s account=%s groups=%s",
+                     self.http_url, _redact_phone(self.account),
+                     "enabled" if self.group_allow_from else "disabled")
 
     # ------------------------------------------------------------------
     # Lifecycle
@@ -246,8 +255,7 @@ class SignalAdapter(BasePlatformAdapter):
             try:
                 logger.debug("Signal SSE: connecting to %s", url)
                 async with self.client.stream(
-                    "GET",
-                    url,
+                    "GET", url,
                     headers={"Accept": "text/event-stream"},
                     timeout=None,
                 ) as response:
@@ -312,7 +320,9 @@ class SignalAdapter(BasePlatformAdapter):
             if elapsed > HEALTH_CHECK_STALE_THRESHOLD:
                 logger.warning("Signal: SSE idle for %.0fs, checking daemon health", elapsed)
                 try:
-                    resp = await self.client.get(f"{self.http_url}/api/v1/check", timeout=10.0)
+                    resp = await self.client.get(
+                        f"{self.http_url}/api/v1/check", timeout=10.0
+                    )
                     if resp.status_code == 200:
                         # Daemon is alive but SSE is idle — update activity to
                         # avoid repeated warnings (connection may just be quiet)
@@ -349,7 +359,11 @@ class SignalAdapter(BasePlatformAdapter):
             return
 
         # Extract sender info
-        sender = envelope_data.get("sourceNumber") or envelope_data.get("sourceUuid") or envelope_data.get("source")
+        sender = (
+            envelope_data.get("sourceNumber")
+            or envelope_data.get("sourceUuid")
+            or envelope_data.get("source")
+        )
         sender_name = envelope_data.get("sourceName", "")
         sender_uuid = envelope_data.get("sourceUuid", "")
 
@@ -367,7 +381,10 @@ class SignalAdapter(BasePlatformAdapter):
 
         # Get data message — also check editMessage (edited messages contain
         # their updated dataMessage inside editMessage.dataMessage)
-        data_message = envelope_data.get("dataMessage") or (envelope_data.get("editMessage") or {}).get("dataMessage")
+        data_message = (
+            envelope_data.get("dataMessage")
+            or (envelope_data.get("editMessage") or {}).get("dataMessage")
+        )
         if not data_message:
             return
 
@@ -401,9 +418,8 @@ class SignalAdapter(BasePlatformAdapter):
 
         # Process attachments
         attachments_data = data_message.get("attachments", [])
-        image_paths = []
-        audio_path = None
-        document_paths = []
+        media_urls = []
+        media_types = []
 
         if attachments_data and not getattr(self, "ignore_attachments", False):
             for att in attachments_data:
@@ -417,12 +433,10 @@ class SignalAdapter(BasePlatformAdapter):
                 try:
                     cached_path, ext = await self._fetch_attachment(att_id)
                     if cached_path:
-                        if _is_image_ext(ext):
-                            image_paths.append(cached_path)
-                        elif _is_audio_ext(ext):
-                            audio_path = cached_path
-                        else:
-                            document_paths.append(cached_path)
+                        # Use contentType from Signal if available, else map from extension
+                        content_type = att.get("contentType") or _ext_to_mime(ext)
+                        media_urls.append(cached_path)
+                        media_types.append(content_type)
                 except Exception:
                     logger.exception("Signal: failed to fetch attachment %s", att_id)
 
@@ -437,35 +451,36 @@ class SignalAdapter(BasePlatformAdapter):
             chat_id_alt=group_id if is_group else None,
         )
 
-        # Determine message type
+        # Determine message type from media
         msg_type = MessageType.TEXT
-        if audio_path:
-            msg_type = MessageType.VOICE
-        elif image_paths:
-            msg_type = MessageType.IMAGE
+        if media_types:
+            if any(mt.startswith("audio/") for mt in media_types):
+                msg_type = MessageType.VOICE
+            elif any(mt.startswith("image/") for mt in media_types):
+                msg_type = MessageType.IMAGE
 
         # Parse timestamp from envelope data (milliseconds since epoch)
         ts_ms = envelope_data.get("timestamp", 0)
         if ts_ms:
             try:
-                timestamp = datetime.fromtimestamp(ts_ms / 1000, tz=UTC)
+                timestamp = datetime.fromtimestamp(ts_ms / 1000, tz=timezone.utc)
             except (ValueError, OSError):
-                timestamp = datetime.now(tz=UTC)
+                timestamp = datetime.now(tz=timezone.utc)
         else:
-            timestamp = datetime.now(tz=UTC)
+            timestamp = datetime.now(tz=timezone.utc)
 
         # Build and dispatch event
         event = MessageEvent(
             source=source,
             text=text or "",
             message_type=msg_type,
-            image_paths=image_paths,
-            audio_path=audio_path,
-            document_paths=document_paths,
+            media_urls=media_urls,
+            media_types=media_types,
             timestamp=timestamp,
         )
 
-        logger.debug("Signal: message from %s in %s: %s", _redact_phone(sender), chat_id[:20], (text or "")[:50])
+        logger.debug("Signal: message from %s in %s: %s",
+                      _redact_phone(sender), chat_id[:20], (text or "")[:50])
 
         await self.handle_message(event)
 
@@ -475,13 +490,10 @@ class SignalAdapter(BasePlatformAdapter):
 
     async def _fetch_attachment(self, attachment_id: str) -> tuple:
         """Fetch an attachment via JSON-RPC and cache it. Returns (path, ext)."""
-        result = await self._rpc(
-            "getAttachment",
-            {
-                "account": self.account,
-                "attachmentId": attachment_id,
-            },
-        )
+        result = await self._rpc("getAttachment", {
+            "account": self.account,
+            "attachmentId": attachment_id,
+        })
 
         if not result:
             return None, ""
@@ -545,16 +557,16 @@ class SignalAdapter(BasePlatformAdapter):
     async def send(
         self,
         chat_id: str,
-        text: str,
-        reply_to_message_id: str | None = None,
-        **kwargs,
+        content: str,
+        reply_to: Optional[str] = None,
+        metadata: Optional[Dict[str, Any]] = None,
     ) -> SendResult:
         """Send a text message."""
         await self._stop_typing_indicator(chat_id)
 
-        params: dict[str, Any] = {
+        params: Dict[str, Any] = {
             "account": self.account,
-            "message": text,
+            "message": content,
         }
 
         if chat_id.startswith("group:"):
@@ -568,9 +580,9 @@ class SignalAdapter(BasePlatformAdapter):
             return SendResult(success=True)
         return SendResult(success=False, error="RPC send failed")
 
-    async def send_typing(self, chat_id: str) -> None:
+    async def send_typing(self, chat_id: str, metadata=None) -> None:
         """Send a typing indicator."""
-        params: dict[str, Any] = {
+        params: Dict[str, Any] = {
             "account": self.account,
         }
 
@@ -585,7 +597,7 @@ class SignalAdapter(BasePlatformAdapter):
         self,
         chat_id: str,
         image_url: str,
-        caption: str | None = None,
+        caption: Optional[str] = None,
         **kwargs,
     ) -> SendResult:
         """Send an image. Supports http(s):// and file:// URLs."""
@@ -610,7 +622,7 @@ class SignalAdapter(BasePlatformAdapter):
         if file_size > SIGNAL_MAX_ATTACHMENT_SIZE:
             return SendResult(success=False, error=f"Image too large ({file_size} bytes)")
 
-        params: dict[str, Any] = {
+        params: Dict[str, Any] = {
             "account": self.account,
             "message": caption or "",
             "attachments": [file_path],
@@ -630,8 +642,8 @@ class SignalAdapter(BasePlatformAdapter):
         self,
         chat_id: str,
         file_path: str,
-        caption: str | None = None,
-        filename: str | None = None,
+        caption: Optional[str] = None,
+        filename: Optional[str] = None,
         **kwargs,
     ) -> SendResult:
         """Send a document/file attachment."""
@@ -640,7 +652,7 @@ class SignalAdapter(BasePlatformAdapter):
         if not Path(file_path).exists():
             return SendResult(success=False, error="File not found")
 
-        params: dict[str, Any] = {
+        params: Dict[str, Any] = {
             "account": self.account,
             "message": caption or "",
             "attachments": [file_path],
@@ -689,7 +701,7 @@ class SignalAdapter(BasePlatformAdapter):
     # Chat Info
     # ------------------------------------------------------------------
 
-    async def get_chat_info(self, chat_id: str) -> dict[str, Any]:
+    async def get_chat_info(self, chat_id: str) -> Dict[str, Any]:
         """Get information about a chat/contact."""
         if chat_id.startswith("group:"):
             return {
@@ -699,13 +711,10 @@ class SignalAdapter(BasePlatformAdapter):
             }
 
         # Try to resolve contact name
-        result = await self._rpc(
-            "getContact",
-            {
-                "account": self.account,
-                "contactAddress": chat_id,
-            },
-        )
+        result = await self._rpc("getContact", {
+            "account": self.account,
+            "contactAddress": chat_id,
+        })
 
         name = chat_id
         if result and isinstance(result, dict):

gateway/platforms/slack.py

@@ -9,15 +9,15 @@ Uses slack-bolt (Python) with Socket Mode for:
 """
 
 import asyncio
+import logging
 import os
 import re
-from typing import Any
+from typing import Dict, List, Optional, Any
 
 try:
-    from slack_bolt.adapter.socket_mode.async_handler import AsyncSocketModeHandler
     from slack_bolt.async_app import AsyncApp
+    from slack_bolt.adapter.socket_mode.async_handler import AsyncSocketModeHandler
     from slack_sdk.web.async_client import AsyncWebClient
-
     SLACK_AVAILABLE = True
 except ImportError:
     SLACK_AVAILABLE = False
@@ -27,20 +27,24 @@ except ImportError:
 
 import sys
 from pathlib import Path as _Path
-
 sys.path.insert(0, str(_Path(__file__).resolve().parents[2]))
 
 from gateway.config import Platform, PlatformConfig
 from gateway.platforms.base import (
-    SUPPORTED_DOCUMENT_TYPES,
     BasePlatformAdapter,
     MessageEvent,
     MessageType,
     SendResult,
+    SUPPORTED_DOCUMENT_TYPES,
     cache_document_from_bytes,
+    cache_image_from_url,
+    cache_audio_from_url,
 )
 
 
+logger = logging.getLogger(__name__)
+
+
 def check_slack_requirements() -> bool:
     """Check if Slack dependencies are available."""
     return SLACK_AVAILABLE
@@ -66,24 +70,26 @@ class SlackAdapter(BasePlatformAdapter):
 
     def __init__(self, config: PlatformConfig):
         super().__init__(config, Platform.SLACK)
-        self._app: AsyncApp | None = None
-        self._handler: AsyncSocketModeHandler | None = None
-        self._bot_user_id: str | None = None
+        self._app: Optional[AsyncApp] = None
+        self._handler: Optional[AsyncSocketModeHandler] = None
+        self._bot_user_id: Optional[str] = None
 
     async def connect(self) -> bool:
         """Connect to Slack via Socket Mode."""
         if not SLACK_AVAILABLE:
-            print("[Slack] slack-bolt not installed. Run: pip install slack-bolt")
+            logger.error(
+                "[Slack] slack-bolt not installed. Run: pip install slack-bolt",
+            )
             return False
 
         bot_token = self.config.token
         app_token = os.getenv("SLACK_APP_TOKEN")
 
         if not bot_token:
-            print("[Slack] SLACK_BOT_TOKEN not set")
+            logger.error("[Slack] SLACK_BOT_TOKEN not set")
             return False
         if not app_token:
-            print("[Slack] SLACK_APP_TOKEN not set")
+            logger.error("[Slack] SLACK_APP_TOKEN not set")
             return False
 
         try:
@@ -117,26 +123,29 @@ class SlackAdapter(BasePlatformAdapter):
             asyncio.create_task(self._handler.start_async())
 
             self._running = True
-            print(f"[Slack] Connected as @{bot_name} (Socket Mode)")
+            logger.info("[Slack] Connected as @%s (Socket Mode)", bot_name)
             return True
 
-        except Exception as e:
-            print(f"[Slack] Connection failed: {e}")
+        except Exception as e:  # pragma: no cover - defensive logging
+            logger.error("[Slack] Connection failed: %s", e, exc_info=True)
             return False
 
     async def disconnect(self) -> None:
         """Disconnect from Slack."""
         if self._handler:
-            await self._handler.close_async()
+            try:
+                await self._handler.close_async()
+            except Exception as e:  # pragma: no cover - defensive logging
+                logger.warning("[Slack] Error while closing Socket Mode handler: %s", e, exc_info=True)
         self._running = False
-        print("[Slack] Disconnected")
+        logger.info("[Slack] Disconnected")
 
     async def send(
         self,
         chat_id: str,
         content: str,
-        reply_to: str | None = None,
-        metadata: dict[str, Any] | None = None,
+        reply_to: Optional[str] = None,
+        metadata: Optional[Dict[str, Any]] = None,
     ) -> SendResult:
         """Send a message to a Slack channel or DM."""
         if not self._app:
@@ -162,8 +171,8 @@ class SlackAdapter(BasePlatformAdapter):
                 raw_response=result,
             )
 
-        except Exception as e:
-            print(f"[Slack] Send error: {e}")
+        except Exception as e:  # pragma: no cover - defensive logging
+            logger.error("[Slack] Send error: %s", e, exc_info=True)
             return SendResult(success=False, error=str(e))
 
     async def edit_message(
@@ -182,10 +191,17 @@ class SlackAdapter(BasePlatformAdapter):
                 text=content,
             )
             return SendResult(success=True, message_id=message_id)
-        except Exception as e:
+        except Exception as e:  # pragma: no cover - defensive logging
+            logger.error(
+                "[Slack] Failed to edit message %s in channel %s: %s",
+                message_id,
+                chat_id,
+                e,
+                exc_info=True,
+            )
             return SendResult(success=False, error=str(e))
 
-    async def send_typing(self, chat_id: str) -> None:
+    async def send_typing(self, chat_id: str, metadata=None) -> None:
         """Slack doesn't have a direct typing indicator API for bots."""
         pass
 
@@ -193,8 +209,8 @@ class SlackAdapter(BasePlatformAdapter):
         self,
         chat_id: str,
         image_path: str,
-        caption: str | None = None,
-        reply_to: str | None = None,
+        caption: Optional[str] = None,
+        reply_to: Optional[str] = None,
     ) -> SendResult:
         """Send a local image file to Slack by uploading it."""
         if not self._app:
@@ -202,7 +218,6 @@ class SlackAdapter(BasePlatformAdapter):
 
         try:
             import os
-
             if not os.path.exists(image_path):
                 return SendResult(success=False, error=f"Image file not found: {image_path}")
 
@@ -215,16 +230,22 @@ class SlackAdapter(BasePlatformAdapter):
             )
             return SendResult(success=True, raw_response=result)
 
-        except Exception as e:
-            print(f"[{self.name}] Failed to send local image: {e}")
+        except Exception as e:  # pragma: no cover - defensive logging
+            logger.error(
+                "[%s] Failed to send local Slack image %s: %s",
+                self.name,
+                image_path,
+                e,
+                exc_info=True,
+            )
             return await super().send_image_file(chat_id, image_path, caption, reply_to)
 
     async def send_image(
         self,
         chat_id: str,
         image_url: str,
-        caption: str | None = None,
-        reply_to: str | None = None,
+        caption: Optional[str] = None,
+        reply_to: Optional[str] = None,
     ) -> SendResult:
         """Send an image to Slack by uploading the URL as a file."""
         if not self._app:
@@ -248,7 +269,13 @@ class SlackAdapter(BasePlatformAdapter):
 
             return SendResult(success=True, raw_response=result)
 
-        except Exception:
+        except Exception as e:  # pragma: no cover - defensive logging
+            logger.warning(
+                "[Slack] Failed to upload image from URL %s, falling back to text: %s",
+                image_url,
+                e,
+                exc_info=True,
+            )
             # Fall back to sending the URL as text
             text = f"{caption}\n{image_url}" if caption else image_url
             return await self.send(chat_id=chat_id, content=text, reply_to=reply_to)
@@ -257,8 +284,8 @@ class SlackAdapter(BasePlatformAdapter):
         self,
         chat_id: str,
         audio_path: str,
-        caption: str | None = None,
-        reply_to: str | None = None,
+        caption: Optional[str] = None,
+        reply_to: Optional[str] = None,
     ) -> SendResult:
         """Send an audio file to Slack."""
         if not self._app:
@@ -274,15 +301,21 @@ class SlackAdapter(BasePlatformAdapter):
             )
             return SendResult(success=True, raw_response=result)
 
-        except Exception as e:
+        except Exception as e:  # pragma: no cover - defensive logging
+            logger.error(
+                "[Slack] Failed to send audio file %s: %s",
+                audio_path,
+                e,
+                exc_info=True,
+            )
             return SendResult(success=False, error=str(e))
 
     async def send_video(
         self,
         chat_id: str,
         video_path: str,
-        caption: str | None = None,
-        reply_to: str | None = None,
+        caption: Optional[str] = None,
+        reply_to: Optional[str] = None,
     ) -> SendResult:
         """Send a video file to Slack."""
         if not self._app:
@@ -301,17 +334,23 @@ class SlackAdapter(BasePlatformAdapter):
             )
             return SendResult(success=True, raw_response=result)
 
-        except Exception as e:
-            print(f"[{self.name}] Failed to send video: {e}")
+        except Exception as e:  # pragma: no cover - defensive logging
+            logger.error(
+                "[%s] Failed to send video %s: %s",
+                self.name,
+                video_path,
+                e,
+                exc_info=True,
+            )
             return await super().send_video(chat_id, video_path, caption, reply_to)
 
     async def send_document(
         self,
         chat_id: str,
         file_path: str,
-        caption: str | None = None,
-        file_name: str | None = None,
-        reply_to: str | None = None,
+        caption: Optional[str] = None,
+        file_name: Optional[str] = None,
+        reply_to: Optional[str] = None,
     ) -> SendResult:
         """Send a document/file attachment to Slack."""
         if not self._app:
@@ -332,11 +371,17 @@ class SlackAdapter(BasePlatformAdapter):
             )
             return SendResult(success=True, raw_response=result)
 
-        except Exception as e:
-            print(f"[{self.name}] Failed to send document: {e}")
+        except Exception as e:  # pragma: no cover - defensive logging
+            logger.error(
+                "[%s] Failed to send document %s: %s",
+                self.name,
+                file_path,
+                e,
+                exc_info=True,
+            )
             return await super().send_document(chat_id, file_path, caption, file_name, reply_to)
 
-    async def get_chat_info(self, chat_id: str) -> dict[str, Any]:
+    async def get_chat_info(self, chat_id: str) -> Dict[str, Any]:
         """Get information about a Slack channel."""
         if not self._app:
             return {"name": chat_id, "type": "unknown"}
@@ -349,7 +394,13 @@ class SlackAdapter(BasePlatformAdapter):
                 "name": channel.get("name", chat_id),
                 "type": "dm" if is_dm else "group",
             }
-        except Exception:
+        except Exception as e:  # pragma: no cover - defensive logging
+            logger.error(
+                "[Slack] Failed to fetch chat info for %s: %s",
+                chat_id,
+                e,
+                exc_info=True,
+            )
             return {"name": chat_id, "type": "unknown"}
 
     # ----- Internal handlers -----
@@ -404,8 +455,8 @@ class SlackAdapter(BasePlatformAdapter):
                     media_urls.append(cached)
                     media_types.append(mimetype)
                     msg_type = MessageType.PHOTO
-                except Exception as e:
-                    print(f"[Slack] Failed to cache image: {e}", flush=True)
+                except Exception as e:  # pragma: no cover - defensive logging
+                    logger.warning("[Slack] Failed to cache image from %s: %s", url, e, exc_info=True)
             elif mimetype.startswith("audio/") and url:
                 try:
                     ext = "." + mimetype.split("/")[-1].split(";")[0]
@@ -415,8 +466,8 @@ class SlackAdapter(BasePlatformAdapter):
                     media_urls.append(cached)
                     media_types.append(mimetype)
                     msg_type = MessageType.VOICE
-                except Exception as e:
-                    print(f"[Slack] Failed to cache audio: {e}", flush=True)
+                except Exception as e:  # pragma: no cover - defensive logging
+                    logger.warning("[Slack] Failed to cache audio from %s: %s", url, e, exc_info=True)
             elif url:
                 # Try to handle as a document attachment
                 try:
@@ -438,17 +489,19 @@ class SlackAdapter(BasePlatformAdapter):
                     file_size = f.get("size", 0)
                     MAX_DOC_BYTES = 20 * 1024 * 1024
                     if not file_size or file_size > MAX_DOC_BYTES:
-                        print(f"[Slack] Document too large or unknown size: {file_size}", flush=True)
+                        logger.warning("[Slack] Document too large or unknown size: %s", file_size)
                         continue
 
                     # Download and cache
                     raw_bytes = await self._download_slack_file_bytes(url)
-                    cached_path = cache_document_from_bytes(raw_bytes, original_filename or f"document{ext}")
+                    cached_path = cache_document_from_bytes(
+                        raw_bytes, original_filename or f"document{ext}"
+                    )
                     doc_mime = SUPPORTED_DOCUMENT_TYPES[ext]
                     media_urls.append(cached_path)
                     media_types.append(doc_mime)
                     msg_type = MessageType.DOCUMENT
-                    print(f"[Slack] Cached user document: {cached_path}", flush=True)
+                    logger.debug("[Slack] Cached user document: %s", cached_path)
 
                     # Inject text content for .txt/.md files (capped at 100 KB)
                     MAX_TEXT_INJECT_BYTES = 100 * 1024
@@ -456,7 +509,7 @@ class SlackAdapter(BasePlatformAdapter):
                         try:
                             text_content = raw_bytes.decode("utf-8")
                             display_name = original_filename or f"document{ext}"
-                            display_name = re.sub(r"[^\w.\- ]", "_", display_name)
+                            display_name = re.sub(r'[^\w.\- ]', '_', display_name)
                             injection = f"[Content of {display_name}]:\n{text_content}"
                             if text:
                                 text = f"{injection}\n\n{text}"
@@ -465,8 +518,8 @@ class SlackAdapter(BasePlatformAdapter):
                         except UnicodeDecodeError:
                             pass  # Binary content, skip injection
 
-                except Exception as e:
-                    print(f"[Slack] Failed to cache document: {e}", flush=True)
+                except Exception as e:  # pragma: no cover - defensive logging
+                    logger.warning("[Slack] Failed to cache document from %s: %s", url, e, exc_info=True)
 
         # Build source
         source = self.build_source(
@@ -498,20 +551,16 @@ class SlackAdapter(BasePlatformAdapter):
 
         # Map subcommands to gateway commands
         subcommand_map = {
-            "new": "/reset",
-            "reset": "/reset",
-            "status": "/status",
-            "stop": "/stop",
+            "new": "/reset", "reset": "/reset",
+            "status": "/status", "stop": "/stop",
             "help": "/help",
-            "model": "/model",
-            "personality": "/personality",
-            "retry": "/retry",
-            "undo": "/undo",
+            "model": "/model", "personality": "/personality",
+            "retry": "/retry", "undo": "/undo",
         }
         first_word = text.split()[0] if text else ""
         if first_word in subcommand_map:
             # Preserve arguments after the subcommand
-            rest = text[len(first_word) :].strip()
+            rest = text[len(first_word):].strip()
             text = f"{subcommand_map[first_word]} {rest}".strip() if rest else subcommand_map[first_word]
         elif text:
             pass  # Treat as a regular question
@@ -547,11 +596,9 @@ class SlackAdapter(BasePlatformAdapter):
 
         if audio:
             from gateway.platforms.base import cache_audio_from_bytes
-
             return cache_audio_from_bytes(response.content, ext)
         else:
             from gateway.platforms.base import cache_image_from_bytes
-
             return cache_image_from_bytes(response.content, ext)
 
     async def _download_slack_file_bytes(self, url: str) -> bytes:

gateway/platforms/telegram.py

@@ -7,26 +7,24 @@ Uses python-telegram-bot library for:
 - Handling media and commands
 """
 
+import asyncio
 import logging
 import os
 import re
-from typing import Any
+from typing import Dict, List, Optional, Any
 
 logger = logging.getLogger(__name__)
 
 try:
-    from telegram import Bot, Message, Update
-    from telegram.constants import ChatType, ParseMode
+    from telegram import Update, Bot, Message
     from telegram.ext import (
         Application,
         CommandHandler,
+        MessageHandler as TelegramMessageHandler,
         ContextTypes,
         filters,
     )
-    from telegram.ext import (
-        MessageHandler as TelegramMessageHandler,
-    )
-
+    from telegram.constants import ParseMode, ChatType
     TELEGRAM_AVAILABLE = True
 except ImportError:
     TELEGRAM_AVAILABLE = False
@@ -44,24 +42,22 @@ except ImportError:
     # don't crash during class definition when the library isn't installed.
     class _MockContextTypes:
         DEFAULT_TYPE = Any
-
     ContextTypes = _MockContextTypes
 
 import sys
 from pathlib import Path as _Path
-
 sys.path.insert(0, str(_Path(__file__).resolve().parents[2]))
 
 from gateway.config import Platform, PlatformConfig
 from gateway.platforms.base import (
-    SUPPORTED_DOCUMENT_TYPES,
     BasePlatformAdapter,
     MessageEvent,
     MessageType,
     SendResult,
+    cache_image_from_bytes,
     cache_audio_from_bytes,
     cache_document_from_bytes,
-    cache_image_from_bytes,
+    SUPPORTED_DOCUMENT_TYPES,
 )
 
 
@@ -72,12 +68,12 @@ def check_telegram_requirements() -> bool:
 
 # Matches every character that MarkdownV2 requires to be backslash-escaped
 # when it appears outside a code span or fenced code block.
-_MDV2_ESCAPE_RE = re.compile(r"([_*\[\]()~`>#\+\-=|{}.!\\])")
+_MDV2_ESCAPE_RE = re.compile(r'([_*\[\]()~`>#\+\-=|{}.!\\])')
 
 
 def _escape_mdv2(text: str) -> str:
     """Escape Telegram MarkdownV2 special characters with a preceding backslash."""
-    return _MDV2_ESCAPE_RE.sub(r"\\\1", text)
+    return _MDV2_ESCAPE_RE.sub(r'\\\1', text)
 
 
 def _strip_mdv2(text: str) -> str:
@@ -87,108 +83,114 @@ def _strip_mdv2(text: str) -> str:
     doesn't show stray asterisks from header/bold conversion.
     """
     # Remove escape backslashes before special characters
-    cleaned = re.sub(r"\\([_*\[\]()~`>#\+\-=|{}.!\\])", r"\1", text)
+    cleaned = re.sub(r'\\([_*\[\]()~`>#\+\-=|{}.!\\])', r'\1', text)
     # Remove MarkdownV2 bold markers that format_message converted from **bold**
-    cleaned = re.sub(r"\*([^*]+)\*", r"\1", cleaned)
+    cleaned = re.sub(r'\*([^*]+)\*', r'\1', cleaned)
+    # Remove MarkdownV2 italic markers that format_message converted from *italic*
+    # Use word boundary (\b) to avoid breaking snake_case like my_variable_name
+    cleaned = re.sub(r'(?<!\w)_([^_]+)_(?!\w)', r'\1', cleaned)
     return cleaned
 
 
 class TelegramAdapter(BasePlatformAdapter):
     """
     Telegram bot adapter.
-
+    
     Handles:
     - Receiving messages from users and groups
     - Sending responses with Telegram markdown
     - Forum topics (thread_id support)
     - Media messages
     """
-
+    
     # Telegram message limits
     MAX_MESSAGE_LENGTH = 4096
-
+    
     def __init__(self, config: PlatformConfig):
         super().__init__(config, Platform.TELEGRAM)
-        self._app: Application | None = None
-        self._bot: Bot | None = None
-
+        self._app: Optional[Application] = None
+        self._bot: Optional[Bot] = None
+    
     async def connect(self) -> bool:
         """Connect to Telegram and start polling for updates."""
         if not TELEGRAM_AVAILABLE:
-            print(f"[{self.name}] python-telegram-bot not installed. Run: pip install python-telegram-bot")
+            logger.error(
+                "[%s] python-telegram-bot not installed. Run: pip install python-telegram-bot",
+                self.name,
+            )
             return False
-
+        
         if not self.config.token:
-            print(f"[{self.name}] No bot token configured")
+            logger.error("[%s] No bot token configured", self.name)
             return False
-
+        
         try:
             # Build the application
             self._app = Application.builder().token(self.config.token).build()
             self._bot = self._app.bot
-
+            
             # Register handlers
-            self._app.add_handler(TelegramMessageHandler(filters.TEXT & ~filters.COMMAND, self._handle_text_message))
-            self._app.add_handler(TelegramMessageHandler(filters.COMMAND, self._handle_command))
-            self._app.add_handler(
-                TelegramMessageHandler(
-                    filters.LOCATION | getattr(filters, "VENUE", filters.LOCATION), self._handle_location_message
-                )
-            )
-            self._app.add_handler(
-                TelegramMessageHandler(
-                    filters.PHOTO
-                    | filters.VIDEO
-                    | filters.AUDIO
-                    | filters.VOICE
-                    | filters.Document.ALL
-                    | filters.Sticker.ALL,
-                    self._handle_media_message,
-                )
-            )
-
+            self._app.add_handler(TelegramMessageHandler(
+                filters.TEXT & ~filters.COMMAND,
+                self._handle_text_message
+            ))
+            self._app.add_handler(TelegramMessageHandler(
+                filters.COMMAND,
+                self._handle_command
+            ))
+            self._app.add_handler(TelegramMessageHandler(
+                filters.LOCATION | getattr(filters, "VENUE", filters.LOCATION),
+                self._handle_location_message
+            ))
+            self._app.add_handler(TelegramMessageHandler(
+                filters.PHOTO | filters.VIDEO | filters.AUDIO | filters.VOICE | filters.Document.ALL | filters.Sticker.ALL,
+                self._handle_media_message
+            ))
+            
             # Start polling in background
             await self._app.initialize()
             await self._app.start()
             await self._app.updater.start_polling(allowed_updates=Update.ALL_TYPES)
-
+            
             # Register bot commands so Telegram shows a hint menu when users type /
             try:
                 from telegram import BotCommand
-
-                await self._bot.set_my_commands(
-                    [
-                        BotCommand("new", "Start a new conversation"),
-                        BotCommand("reset", "Reset conversation history"),
-                        BotCommand("model", "Show or change the model"),
-                        BotCommand("personality", "Set a personality"),
-                        BotCommand("retry", "Retry your last message"),
-                        BotCommand("undo", "Remove the last exchange"),
-                        BotCommand("status", "Show session info"),
-                        BotCommand("stop", "Stop the running agent"),
-                        BotCommand("sethome", "Set this chat as the home channel"),
-                        BotCommand("compress", "Compress conversation context"),
-                        BotCommand("title", "Set or show the session title"),
-                        BotCommand("resume", "Resume a previously-named session"),
-                        BotCommand("usage", "Show token usage for this session"),
-                        BotCommand("provider", "Show available providers"),
-                        BotCommand("insights", "Show usage insights and analytics"),
-                        BotCommand("update", "Update Hermes to the latest version"),
-                        BotCommand("reload_mcp", "Reload MCP servers from config"),
-                        BotCommand("help", "Show available commands"),
-                    ]
-                )
+                await self._bot.set_my_commands([
+                    BotCommand("new", "Start a new conversation"),
+                    BotCommand("reset", "Reset conversation history"),
+                    BotCommand("model", "Show or change the model"),
+                    BotCommand("personality", "Set a personality"),
+                    BotCommand("retry", "Retry your last message"),
+                    BotCommand("undo", "Remove the last exchange"),
+                    BotCommand("status", "Show session info"),
+                    BotCommand("stop", "Stop the running agent"),
+                    BotCommand("sethome", "Set this chat as the home channel"),
+                    BotCommand("compress", "Compress conversation context"),
+                    BotCommand("title", "Set or show the session title"),
+                    BotCommand("resume", "Resume a previously-named session"),
+                    BotCommand("usage", "Show token usage for this session"),
+                    BotCommand("provider", "Show available providers"),
+                    BotCommand("insights", "Show usage insights and analytics"),
+                    BotCommand("update", "Update Hermes to the latest version"),
+                    BotCommand("reload_mcp", "Reload MCP servers from config"),
+                    BotCommand("help", "Show available commands"),
+                ])
             except Exception as e:
-                print(f"[{self.name}] Could not register command menu: {e}")
-
+                logger.warning(
+                    "[%s] Could not register Telegram command menu: %s",
+                    self.name,
+                    e,
+                    exc_info=True,
+                )
+            
             self._running = True
-            print(f"[{self.name}] Connected and polling for updates")
+            logger.info("[%s] Connected and polling for Telegram updates", self.name)
             return True
-
+            
         except Exception as e:
-            print(f"[{self.name}] Failed to connect: {e}")
+            logger.error("[%s] Failed to connect to Telegram: %s", self.name, e, exc_info=True)
             return False
-
+    
     async def disconnect(self) -> None:
         """Stop polling and disconnect."""
         if self._app:
@@ -197,28 +199,32 @@ class TelegramAdapter(BasePlatformAdapter):
                 await self._app.stop()
                 await self._app.shutdown()
             except Exception as e:
-                print(f"[{self.name}] Error during disconnect: {e}")
-
+                logger.warning("[%s] Error during Telegram disconnect: %s", self.name, e, exc_info=True)
+        
         self._running = False
         self._app = None
         self._bot = None
-        print(f"[{self.name}] Disconnected")
-
+        logger.info("[%s] Disconnected from Telegram", self.name)
+    
     async def send(
-        self, chat_id: str, content: str, reply_to: str | None = None, metadata: dict[str, Any] | None = None
+        self,
+        chat_id: str,
+        content: str,
+        reply_to: Optional[str] = None,
+        metadata: Optional[Dict[str, Any]] = None
     ) -> SendResult:
         """Send a message to a Telegram chat."""
         if not self._bot:
             return SendResult(success=False, error="Not connected")
-
+        
         try:
             # Format and split message if needed
             formatted = self.format_message(content)
             chunks = self.truncate_message(formatted, self.MAX_MESSAGE_LENGTH)
-
+            
             message_ids = []
             thread_id = metadata.get("thread_id") if metadata else None
-
+            
             for i, chunk in enumerate(chunks):
                 # Try Markdown first, fall back to plain text if it fails
                 try:
@@ -232,9 +238,7 @@ class TelegramAdapter(BasePlatformAdapter):
                 except Exception as md_error:
                     # Markdown parsing failed, try plain text
                     if "parse" in str(md_error).lower() or "markdown" in str(md_error).lower():
-                        logger.warning(
-                            "[%s] MarkdownV2 parse failed, falling back to plain text: %s", self.name, md_error
-                        )
+                        logger.warning("[%s] MarkdownV2 parse failed, falling back to plain text: %s", self.name, md_error)
                         # Strip MDV2 escape backslashes so the user doesn't
                         # see raw backslashes littered through the message.
                         plain_chunk = _strip_mdv2(chunk)
@@ -248,14 +252,15 @@ class TelegramAdapter(BasePlatformAdapter):
                     else:
                         raise  # Re-raise if not a parse error
                 message_ids.append(str(msg.message_id))
-
+            
             return SendResult(
                 success=True,
                 message_id=message_ids[0] if message_ids else None,
-                raw_response={"message_ids": message_ids},
+                raw_response={"message_ids": message_ids}
             )
-
+            
         except Exception as e:
+            logger.error("[%s] Failed to send Telegram message: %s", self.name, e, exc_info=True)
             return SendResult(success=False, error=str(e))
 
     async def edit_message(
@@ -285,64 +290,80 @@ class TelegramAdapter(BasePlatformAdapter):
                 )
             return SendResult(success=True, message_id=message_id)
         except Exception as e:
+            logger.error(
+                "[%s] Failed to edit Telegram message %s: %s",
+                self.name,
+                message_id,
+                e,
+                exc_info=True,
+            )
             return SendResult(success=False, error=str(e))
 
     async def send_voice(
         self,
         chat_id: str,
         audio_path: str,
-        caption: str | None = None,
-        reply_to: str | None = None,
+        caption: Optional[str] = None,
+        reply_to: Optional[str] = None,
+        metadata: Optional[Dict[str, Any]] = None,
     ) -> SendResult:
         """Send audio as a native Telegram voice message or audio file."""
         if not self._bot:
             return SendResult(success=False, error="Not connected")
-
+        
         try:
             import os
-
             if not os.path.exists(audio_path):
                 return SendResult(success=False, error=f"Audio file not found: {audio_path}")
-
+            
             with open(audio_path, "rb") as audio_file:
                 # .ogg files -> send as voice (round playable bubble)
                 if audio_path.endswith(".ogg") or audio_path.endswith(".opus"):
+                    _voice_thread = metadata.get("thread_id") if metadata else None
                     msg = await self._bot.send_voice(
                         chat_id=int(chat_id),
                         voice=audio_file,
                         caption=caption[:1024] if caption else None,
                         reply_to_message_id=int(reply_to) if reply_to else None,
+                        message_thread_id=int(_voice_thread) if _voice_thread else None,
                     )
                 else:
                     # .mp3 and others -> send as audio file
+                    _audio_thread = metadata.get("thread_id") if metadata else None
                     msg = await self._bot.send_audio(
                         chat_id=int(chat_id),
                         audio=audio_file,
                         caption=caption[:1024] if caption else None,
                         reply_to_message_id=int(reply_to) if reply_to else None,
+                        message_thread_id=int(_audio_thread) if _audio_thread else None,
                     )
             return SendResult(success=True, message_id=str(msg.message_id))
         except Exception as e:
-            print(f"[{self.name}] Failed to send voice/audio: {e}")
+            logger.error(
+                "[%s] Failed to send Telegram voice/audio, falling back to base adapter: %s",
+                self.name,
+                e,
+                exc_info=True,
+            )
             return await super().send_voice(chat_id, audio_path, caption, reply_to)
-
+    
     async def send_image_file(
         self,
         chat_id: str,
         image_path: str,
-        caption: str | None = None,
-        reply_to: str | None = None,
+        caption: Optional[str] = None,
+        reply_to: Optional[str] = None,
+        **kwargs,
     ) -> SendResult:
         """Send a local image file natively as a Telegram photo."""
         if not self._bot:
             return SendResult(success=False, error="Not connected")
-
+        
         try:
             import os
-
             if not os.path.exists(image_path):
                 return SendResult(success=False, error=f"Image file not found: {image_path}")
-
+            
             with open(image_path, "rb") as image_file:
                 msg = await self._bot.send_photo(
                     chat_id=int(chat_id),
@@ -352,44 +373,116 @@ class TelegramAdapter(BasePlatformAdapter):
                 )
             return SendResult(success=True, message_id=str(msg.message_id))
         except Exception as e:
-            print(f"[{self.name}] Failed to send local image: {e}")
+            logger.error(
+                "[%s] Failed to send Telegram local image, falling back to base adapter: %s",
+                self.name,
+                e,
+                exc_info=True,
+            )
             return await super().send_image_file(chat_id, image_path, caption, reply_to)
 
+    async def send_document(
+        self,
+        chat_id: str,
+        file_path: str,
+        caption: Optional[str] = None,
+        file_name: Optional[str] = None,
+        reply_to: Optional[str] = None,
+        **kwargs,
+    ) -> SendResult:
+        """Send a document/file natively as a Telegram file attachment."""
+        if not self._bot:
+            return SendResult(success=False, error="Not connected")
+
+        try:
+            if not os.path.exists(file_path):
+                return SendResult(success=False, error=f"File not found: {file_path}")
+
+            display_name = file_name or os.path.basename(file_path)
+
+            with open(file_path, "rb") as f:
+                msg = await self._bot.send_document(
+                    chat_id=int(chat_id),
+                    document=f,
+                    filename=display_name,
+                    caption=caption[:1024] if caption else None,
+                    reply_to_message_id=int(reply_to) if reply_to else None,
+                )
+            return SendResult(success=True, message_id=str(msg.message_id))
+        except Exception as e:
+            print(f"[{self.name}] Failed to send document: {e}")
+            return await super().send_document(chat_id, file_path, caption, file_name, reply_to)
+
+    async def send_video(
+        self,
+        chat_id: str,
+        video_path: str,
+        caption: Optional[str] = None,
+        reply_to: Optional[str] = None,
+        **kwargs,
+    ) -> SendResult:
+        """Send a video natively as a Telegram video message."""
+        if not self._bot:
+            return SendResult(success=False, error="Not connected")
+
+        try:
+            if not os.path.exists(video_path):
+                return SendResult(success=False, error=f"Video file not found: {video_path}")
+
+            with open(video_path, "rb") as f:
+                msg = await self._bot.send_video(
+                    chat_id=int(chat_id),
+                    video=f,
+                    caption=caption[:1024] if caption else None,
+                    reply_to_message_id=int(reply_to) if reply_to else None,
+                )
+            return SendResult(success=True, message_id=str(msg.message_id))
+        except Exception as e:
+            print(f"[{self.name}] Failed to send video: {e}")
+            return await super().send_video(chat_id, video_path, caption, reply_to)
+
     async def send_image(
         self,
         chat_id: str,
         image_url: str,
-        caption: str | None = None,
-        reply_to: str | None = None,
+        caption: Optional[str] = None,
+        reply_to: Optional[str] = None,
+        metadata: Optional[Dict[str, Any]] = None,
     ) -> SendResult:
         """Send an image natively as a Telegram photo.
-
+        
         Tries URL-based send first (fast, works for <5MB images).
         Falls back to downloading and uploading as file (supports up to 10MB).
         """
         if not self._bot:
             return SendResult(success=False, error="Not connected")
-
+        
         try:
             # Telegram can send photos directly from URLs (up to ~5MB)
+            _photo_thread = metadata.get("thread_id") if metadata else None
             msg = await self._bot.send_photo(
                 chat_id=int(chat_id),
                 photo=image_url,
                 caption=caption[:1024] if caption else None,  # Telegram caption limit
                 reply_to_message_id=int(reply_to) if reply_to else None,
+                message_thread_id=int(_photo_thread) if _photo_thread else None,
             )
             return SendResult(success=True, message_id=str(msg.message_id))
         except Exception as e:
-            logger.warning("[%s] URL-based send_photo failed (%s), trying file upload", self.name, e)
+            logger.warning(
+                "[%s] URL-based send_photo failed, trying file upload: %s",
+                self.name,
+                e,
+                exc_info=True,
+            )
             # Fallback: download and upload as file (supports up to 10MB)
             try:
                 import httpx
-
                 async with httpx.AsyncClient(timeout=30.0) as client:
                     resp = await client.get(image_url)
                     resp.raise_for_status()
                     image_data = resp.content
-
+                
                 msg = await self._bot.send_photo(
                     chat_id=int(chat_id),
                     photo=image_data,
@@ -398,50 +491,74 @@ class TelegramAdapter(BasePlatformAdapter):
                 )
                 return SendResult(success=True, message_id=str(msg.message_id))
             except Exception as e2:
-                logger.error("[%s] File upload send_photo also failed: %s", self.name, e2)
+                logger.error(
+                    "[%s] File upload send_photo also failed: %s",
+                    self.name,
+                    e2,
+                    exc_info=True,
+                )
                 # Final fallback: send URL as text
                 return await super().send_image(chat_id, image_url, caption, reply_to)
-
+    
     async def send_animation(
         self,
         chat_id: str,
         animation_url: str,
-        caption: str | None = None,
-        reply_to: str | None = None,
+        caption: Optional[str] = None,
+        reply_to: Optional[str] = None,
+        metadata: Optional[Dict[str, Any]] = None,
     ) -> SendResult:
         """Send an animated GIF natively as a Telegram animation (auto-plays inline)."""
         if not self._bot:
             return SendResult(success=False, error="Not connected")
-
+        
         try:
+            _anim_thread = metadata.get("thread_id") if metadata else None
             msg = await self._bot.send_animation(
                 chat_id=int(chat_id),
                 animation=animation_url,
                 caption=caption[:1024] if caption else None,
                 reply_to_message_id=int(reply_to) if reply_to else None,
+                message_thread_id=int(_anim_thread) if _anim_thread else None,
             )
             return SendResult(success=True, message_id=str(msg.message_id))
         except Exception as e:
-            print(f"[{self.name}] Failed to send animation, falling back to photo: {e}")
+            logger.error(
+                "[%s] Failed to send Telegram animation, falling back to photo: %s",
+                self.name,
+                e,
+                exc_info=True,
+            )
             # Fallback: try as a regular photo
             return await self.send_image(chat_id, animation_url, caption, reply_to)
 
-    async def send_typing(self, chat_id: str) -> None:
+    async def send_typing(self, chat_id: str, metadata: Optional[Dict[str, Any]] = None) -> None:
         """Send typing indicator."""
         if self._bot:
             try:
-                await self._bot.send_chat_action(chat_id=int(chat_id), action="typing")
-            except Exception:
-                pass  # Ignore typing indicator failures
-
-    async def get_chat_info(self, chat_id: str) -> dict[str, Any]:
+                _typing_thread = metadata.get("thread_id") if metadata else None
+                await self._bot.send_chat_action(
+                    chat_id=int(chat_id),
+                    action="typing",
+                    message_thread_id=int(_typing_thread) if _typing_thread else None,
+                )
+            except Exception as e:
+                # Typing failures are non-fatal; log at debug level only.
+                logger.debug(
+                    "[%s] Failed to send Telegram typing indicator: %s",
+                    self.name,
+                    e,
+                    exc_info=True,
+                )
+    
+    async def get_chat_info(self, chat_id: str) -> Dict[str, Any]:
         """Get information about a Telegram chat."""
         if not self._bot:
             return {"name": "Unknown", "type": "dm"}
-
+        
         try:
             chat = await self._bot.get_chat(int(chat_id))
-
+            
             chat_type = "dm"
             if chat.type == ChatType.GROUP:
                 chat_type = "group"
@@ -451,7 +568,7 @@ class TelegramAdapter(BasePlatformAdapter):
                     chat_type = "forum"
             elif chat.type == ChatType.CHANNEL:
                 chat_type = "channel"
-
+            
             return {
                 "name": chat.title or chat.full_name or str(chat_id),
                 "type": chat_type,
@@ -459,8 +576,15 @@ class TelegramAdapter(BasePlatformAdapter):
                 "is_forum": getattr(chat, "is_forum", False),
             }
         except Exception as e:
+            logger.error(
+                "[%s] Failed to get Telegram chat info for %s: %s",
+                self.name,
+                chat_id,
+                e,
+                exc_info=True,
+            )
             return {"name": str(chat_id), "type": "dm", "error": str(e)}
-
+    
     def format_message(self, content: str) -> str:
         """
         Convert standard markdown to Telegram MarkdownV2 format.
@@ -487,36 +611,38 @@ class TelegramAdapter(BasePlatformAdapter):
 
         # 1) Protect fenced code blocks (``` ... ```)
         text = re.sub(
-            r"(```(?:[^\n]*\n)?[\s\S]*?```)",
+            r'(```(?:[^\n]*\n)?[\s\S]*?```)',
             lambda m: _ph(m.group(0)),
             text,
         )
 
         # 2) Protect inline code (`...`)
-        text = re.sub(r"(`[^`]+`)", lambda m: _ph(m.group(0)), text)
+        text = re.sub(r'(`[^`]+`)', lambda m: _ph(m.group(0)), text)
 
         # 3) Convert markdown links – escape the display text; inside the URL
         #    only ')' and '\' need escaping per the MarkdownV2 spec.
         def _convert_link(m):
             display = _escape_mdv2(m.group(1))
-            url = m.group(2).replace("\\", "\\\\").replace(")", "\\)")
-            return _ph(f"[{display}]({url})")
+            url = m.group(2).replace('\\', '\\\\').replace(')', '\\)')
+            return _ph(f'[{display}]({url})')
 
-        text = re.sub(r"\[([^\]]+)\]\(([^)]+)\)", _convert_link, text)
+        text = re.sub(r'\[([^\]]+)\]\(([^)]+)\)', _convert_link, text)
 
         # 4) Convert markdown headers (## Title) → bold *Title*
         def _convert_header(m):
             inner = m.group(1).strip()
             # Strip redundant bold markers that may appear inside a header
-            inner = re.sub(r"\*\*(.+?)\*\*", r"\1", inner)
-            return _ph(f"*{_escape_mdv2(inner)}*")
+            inner = re.sub(r'\*\*(.+?)\*\*', r'\1', inner)
+            return _ph(f'*{_escape_mdv2(inner)}*')
 
-        text = re.sub(r"^#{1,6}\s+(.+)$", _convert_header, text, flags=re.MULTILINE)
+        text = re.sub(
+            r'^#{1,6}\s+(.+)$', _convert_header, text, flags=re.MULTILINE
+        )
 
         # 5) Convert bold: **text** → *text* (MarkdownV2 bold)
         text = re.sub(
-            r"\*\*(.+?)\*\*",
-            lambda m: _ph(f"*{_escape_mdv2(m.group(1))}*"),
+            r'\*\*(.+?)\*\*',
+            lambda m: _ph(f'*{_escape_mdv2(m.group(1))}*'),
             text,
         )
 
@@ -524,8 +650,8 @@ class TelegramAdapter(BasePlatformAdapter):
         #    [^*\n]+ prevents matching across newlines (which would corrupt
         #    bullet lists using * markers and multi-line content).
         text = re.sub(
-            r"\*([^*\n]+)\*",
-            lambda m: _ph(f"_{_escape_mdv2(m.group(1))}_"),
+            r'\*([^*\n]+)\*',
+            lambda m: _ph(f'_{_escape_mdv2(m.group(1))}_'),
             text,
         )
 
@@ -538,23 +664,23 @@ class TelegramAdapter(BasePlatformAdapter):
             text = text.replace(key, placeholders[key])
 
         return text
-
+    
     async def _handle_text_message(self, update: Update, context: ContextTypes.DEFAULT_TYPE) -> None:
         """Handle incoming text messages."""
         if not update.message or not update.message.text:
             return
-
+        
         event = self._build_message_event(update.message, MessageType.TEXT)
         await self.handle_message(event)
-
+    
     async def _handle_command(self, update: Update, context: ContextTypes.DEFAULT_TYPE) -> None:
         """Handle incoming command messages."""
         if not update.message or not update.message.text:
             return
-
+        
         event = self._build_message_event(update.message, MessageType.COMMAND)
         await self.handle_message(event)
-
+    
     async def _handle_location_message(self, update: Update, context: ContextTypes.DEFAULT_TYPE) -> None:
         """Handle incoming location/venue pin messages."""
         if not update.message:
@@ -594,9 +720,9 @@ class TelegramAdapter(BasePlatformAdapter):
         """Handle incoming media messages, downloading images to local cache."""
         if not update.message:
             return
-
+        
         msg = update.message
-
+        
         # Determine media type
         if msg.sticker:
             msg_type = MessageType.STICKER
@@ -612,19 +738,19 @@ class TelegramAdapter(BasePlatformAdapter):
             msg_type = MessageType.DOCUMENT
         else:
             msg_type = MessageType.DOCUMENT
-
+        
         event = self._build_message_event(msg, msg_type)
-
+        
         # Add caption as text
         if msg.caption:
             event.text = msg.caption
-
+        
         # Handle stickers: describe via vision tool with caching
         if msg.sticker:
             await self._handle_sticker(msg, event)
             await self.handle_message(event)
             return
-
+        
         # Download photo to local image cache so the vision tool can access it
         # even after Telegram's ephemeral file URLs expire (~1 hour).
         if msg.photo:
@@ -645,10 +771,10 @@ class TelegramAdapter(BasePlatformAdapter):
                 cached_path = cache_image_from_bytes(bytes(image_bytes), ext=ext)
                 event.media_urls = [cached_path]
                 event.media_types = [f"image/{ext.lstrip('.')}"]
-                print(f"[Telegram] Cached user photo: {cached_path}", flush=True)
+                logger.info("[Telegram] Cached user photo at %s", cached_path)
             except Exception as e:
-                print(f"[Telegram] Failed to cache photo: {e}", flush=True)
-
+                logger.warning("[Telegram] Failed to cache photo: %s", e, exc_info=True)
+        
         # Download voice/audio messages to cache for STT transcription
         if msg.voice:
             try:
@@ -657,9 +783,9 @@ class TelegramAdapter(BasePlatformAdapter):
                 cached_path = cache_audio_from_bytes(bytes(audio_bytes), ext=".ogg")
                 event.media_urls = [cached_path]
                 event.media_types = ["audio/ogg"]
-                print(f"[Telegram] Cached user voice: {cached_path}", flush=True)
+                logger.info("[Telegram] Cached user voice at %s", cached_path)
             except Exception as e:
-                print(f"[Telegram] Failed to cache voice: {e}", flush=True)
+                logger.warning("[Telegram] Failed to cache voice: %s", e, exc_info=True)
         elif msg.audio:
             try:
                 file_obj = await msg.audio.get_file()
@@ -667,9 +793,9 @@ class TelegramAdapter(BasePlatformAdapter):
                 cached_path = cache_audio_from_bytes(bytes(audio_bytes), ext=".mp3")
                 event.media_urls = [cached_path]
                 event.media_types = ["audio/mp3"]
-                print(f"[Telegram] Cached user audio: {cached_path}", flush=True)
+                logger.info("[Telegram] Cached user audio at %s", cached_path)
             except Exception as e:
-                print(f"[Telegram] Failed to cache audio: {e}", flush=True)
+                logger.warning("[Telegram] Failed to cache audio: %s", e, exc_info=True)
 
         # Download document files to cache for agent processing
         elif msg.document:
@@ -690,16 +816,22 @@ class TelegramAdapter(BasePlatformAdapter):
                 # Check if supported
                 if ext not in SUPPORTED_DOCUMENT_TYPES:
                     supported_list = ", ".join(sorted(SUPPORTED_DOCUMENT_TYPES.keys()))
-                    event.text = f"Unsupported document type '{ext or 'unknown'}'. Supported types: {supported_list}"
-                    print(f"[Telegram] Unsupported document type: {ext or 'unknown'}", flush=True)
+                    event.text = (
+                        f"Unsupported document type '{ext or 'unknown'}'. "
+                        f"Supported types: {supported_list}"
+                    )
+                    logger.info("[Telegram] Unsupported document type: %s", ext or "unknown")
                     await self.handle_message(event)
                     return
 
                 # Check file size (Telegram Bot API limit: 20 MB)
                 MAX_DOC_BYTES = 20 * 1024 * 1024
                 if not doc.file_size or doc.file_size > MAX_DOC_BYTES:
-                    event.text = "The document is too large or its size could not be verified. Maximum: 20 MB."
-                    print(f"[Telegram] Document too large: {doc.file_size} bytes", flush=True)
+                    event.text = (
+                        "The document is too large or its size could not be verified. "
+                        "Maximum: 20 MB."
+                    )
+                    logger.info("[Telegram] Document too large: %s bytes", doc.file_size)
                     await self.handle_message(event)
                     return
 
@@ -711,7 +843,7 @@ class TelegramAdapter(BasePlatformAdapter):
                 mime_type = SUPPORTED_DOCUMENT_TYPES[ext]
                 event.media_urls = [cached_path]
                 event.media_types = [mime_type]
-                print(f"[Telegram] Cached user document: {cached_path}", flush=True)
+                logger.info("[Telegram] Cached user document at %s", cached_path)
 
                 # For text files, inject content into event.text (capped at 100 KB)
                 MAX_TEXT_INJECT_BYTES = 100 * 1024
@@ -719,20 +851,23 @@ class TelegramAdapter(BasePlatformAdapter):
                     try:
                         text_content = raw_bytes.decode("utf-8")
                         display_name = original_filename or f"document{ext}"
-                        display_name = re.sub(r"[^\w.\- ]", "_", display_name)
+                        display_name = re.sub(r'[^\w.\- ]', '_', display_name)
                         injection = f"[Content of {display_name}]:\n{text_content}"
                         if event.text:
                             event.text = f"{injection}\n\n{event.text}"
                         else:
                             event.text = injection
                     except UnicodeDecodeError:
-                        print("[Telegram] Could not decode text file as UTF-8, skipping content injection", flush=True)
+                        logger.warning(
+                            "[Telegram] Could not decode text file as UTF-8, skipping content injection",
+                            exc_info=True,
+                        )
 
             except Exception as e:
-                print(f"[Telegram] Failed to cache document: {e}", flush=True)
+                logger.warning("[Telegram] Failed to cache document: %s", e, exc_info=True)
 
         await self.handle_message(event)
-
+    
     async def _handle_sticker(self, msg: Message, event: "MessageEvent") -> None:
         """
         Describe a Telegram sticker via vision analysis, with caching.
@@ -742,11 +877,11 @@ class TelegramAdapter(BasePlatformAdapter):
         a placeholder noting the emoji.
         """
         from gateway.sticker_cache import (
-            STICKER_VISION_PROMPT,
-            build_animated_sticker_injection,
-            build_sticker_injection,
-            cache_sticker_description,
             get_cached_description,
+            cache_sticker_description,
+            build_sticker_injection,
+            build_animated_sticker_injection,
+            STICKER_VISION_PROMPT,
         )
 
         sticker = msg.sticker
@@ -764,7 +899,7 @@ class TelegramAdapter(BasePlatformAdapter):
             event.text = build_sticker_injection(
                 cached["description"], cached.get("emoji", emoji), cached.get("set_name", set_name)
             )
-            print(f"[Telegram] Sticker cache hit: {sticker.file_unique_id}", flush=True)
+            logger.info("[Telegram] Sticker cache hit: %s", sticker.file_unique_id)
             return
 
         # Cache miss -- download and analyze
@@ -772,11 +907,10 @@ class TelegramAdapter(BasePlatformAdapter):
             file_obj = await sticker.get_file()
             image_bytes = await file_obj.download_as_bytearray()
             cached_path = cache_image_from_bytes(bytes(image_bytes), ext=".webp")
-            print(f"[Telegram] Analyzing sticker: {cached_path}", flush=True)
-
-            import json as _json
+            logger.info("[Telegram] Analyzing sticker at %s", cached_path)
 
             from tools.vision_tools import vision_analyze_tool
+            import json as _json
 
             result_json = await vision_analyze_tool(
                 image_url=cached_path,
@@ -792,29 +926,27 @@ class TelegramAdapter(BasePlatformAdapter):
                 # Vision failed -- use emoji as fallback
                 event.text = build_sticker_injection(
                     f"a sticker with emoji {emoji}" if emoji else "a sticker",
-                    emoji,
-                    set_name,
+                    emoji, set_name,
                 )
         except Exception as e:
-            print(f"[Telegram] Sticker analysis error: {e}", flush=True)
+            logger.warning("[Telegram] Sticker analysis error: %s", e, exc_info=True)
             event.text = build_sticker_injection(
                 f"a sticker with emoji {emoji}" if emoji else "a sticker",
-                emoji,
-                set_name,
+                emoji, set_name,
             )
 
     def _build_message_event(self, message: Message, msg_type: MessageType) -> MessageEvent:
         """Build a MessageEvent from a Telegram message."""
         chat = message.chat
         user = message.from_user
-
+        
         # Determine chat type
         chat_type = "dm"
         if chat.type in (ChatType.GROUP, ChatType.SUPERGROUP):
             chat_type = "group"
         elif chat.type == ChatType.CHANNEL:
             chat_type = "channel"
-
+        
         # Build source
         source = self.build_source(
             chat_id=str(chat.id),
@@ -824,7 +956,7 @@ class TelegramAdapter(BasePlatformAdapter):
             user_name=user.full_name if user else None,
             thread_id=str(message.message_thread_id) if message.message_thread_id else None,
         )
-
+        
         return MessageEvent(
             text=message.text or "",
             message_type=msg_type,

gateway/platforms/whatsapp.py

@@ -16,6 +16,7 @@ with different backends via a bridge pattern.
 """
 
 import asyncio
+import json
 import logging
 import os
 import platform
@@ -23,7 +24,7 @@ import subprocess
 
 _IS_WINDOWS = platform.system() == "Windows"
 from pathlib import Path
-from typing import Any
+from typing import Dict, List, Optional, Any
 
 logger = logging.getLogger(__name__)
 
@@ -35,9 +36,7 @@ def _kill_port_process(port: int) -> None:
             # Use netstat to find the PID bound to this port, then taskkill
             result = subprocess.run(
                 ["netstat", "-ano", "-p", "TCP"],
-                capture_output=True,
-                text=True,
-                timeout=5,
+                capture_output=True, text=True, timeout=5,
             )
             for line in result.stdout.splitlines():
                 parts = line.split()
@@ -47,29 +46,24 @@ def _kill_port_process(port: int) -> None:
                         try:
                             subprocess.run(
                                 ["taskkill", "/PID", parts[4], "/F"],
-                                capture_output=True,
-                                timeout=5,
+                                capture_output=True, timeout=5,
                             )
                         except subprocess.SubprocessError:
                             pass
         else:
             result = subprocess.run(
                 ["fuser", f"{port}/tcp"],
-                capture_output=True,
-                timeout=5,
+                capture_output=True, timeout=5,
             )
             if result.returncode == 0:
                 subprocess.run(
                     ["fuser", "-k", f"{port}/tcp"],
-                    capture_output=True,
-                    timeout=5,
+                    capture_output=True, timeout=5,
                 )
     except Exception:
         pass
 
-
 import sys
-
 sys.path.insert(0, str(Path(__file__).resolve().parents[2]))
 
 from gateway.config import Platform, PlatformConfig
@@ -78,20 +72,25 @@ from gateway.platforms.base import (
     MessageEvent,
     MessageType,
     SendResult,
-    cache_audio_from_url,
     cache_image_from_url,
+    cache_audio_from_url,
 )
 
 
 def check_whatsapp_requirements() -> bool:
     """
     Check if WhatsApp dependencies are available.
-
+    
     WhatsApp requires a Node.js bridge for most implementations.
     """
     # Check for Node.js
     try:
-        result = subprocess.run(["node", "--version"], capture_output=True, text=True, timeout=5)
+        result = subprocess.run(
+            ["node", "--version"],
+            capture_output=True,
+            text=True,
+            timeout=5
+        )
         return result.returncode == 0
     except Exception:
         return False
@@ -100,61 +99,62 @@ def check_whatsapp_requirements() -> bool:
 class WhatsAppAdapter(BasePlatformAdapter):
     """
     WhatsApp adapter.
-
+    
     This implementation uses a simple HTTP bridge pattern where:
     1. A Node.js process runs the WhatsApp Web client
     2. Messages are forwarded via HTTP/IPC to this Python adapter
     3. Responses are sent back through the bridge
-
+    
     The actual Node.js bridge implementation can vary:
     - whatsapp-web.js based
     - Baileys based
     - Business API based
-
+    
     Configuration:
     - bridge_script: Path to the Node.js bridge script
     - bridge_port: Port for HTTP communication (default: 3000)
     - session_path: Path to store WhatsApp session data
     """
-
+    
     # WhatsApp message limits
     MAX_MESSAGE_LENGTH = 65536  # WhatsApp allows longer messages
-
+    
     # Default bridge location relative to the hermes-agent install
     _DEFAULT_BRIDGE_DIR = Path(__file__).resolve().parents[2] / "scripts" / "whatsapp-bridge"
 
     def __init__(self, config: PlatformConfig):
         super().__init__(config, Platform.WHATSAPP)
-        self._bridge_process: subprocess.Popen | None = None
+        self._bridge_process: Optional[subprocess.Popen] = None
         self._bridge_port: int = config.extra.get("bridge_port", 3000)
-        self._bridge_script: str | None = config.extra.get(
+        self._bridge_script: Optional[str] = config.extra.get(
             "bridge_script",
             str(self._DEFAULT_BRIDGE_DIR / "bridge.js"),
         )
-        self._session_path: Path = Path(
-            config.extra.get("session_path", Path.home() / ".hermes" / "whatsapp" / "session")
-        )
+        self._session_path: Path = Path(config.extra.get(
+            "session_path",
+            Path.home() / ".hermes" / "whatsapp" / "session"
+        ))
         self._message_queue: asyncio.Queue = asyncio.Queue()
         self._bridge_log_fh = None
-        self._bridge_log: Path | None = None
-
+        self._bridge_log: Optional[Path] = None
+    
     async def connect(self) -> bool:
         """
         Start the WhatsApp bridge.
-
+        
         This launches the Node.js bridge process and waits for it to be ready.
         """
         if not check_whatsapp_requirements():
             logger.warning("[%s] Node.js not found. WhatsApp requires Node.js.", self.name)
             return False
-
+        
         bridge_path = Path(self._bridge_script)
         if not bridge_path.exists():
             logger.warning("[%s] Bridge script not found: %s", self.name, bridge_path)
             return False
-
+        
         logger.info("[%s] Bridge found at %s", self.name, bridge_path)
-
+        
         # Auto-install npm dependencies if node_modules doesn't exist
         bridge_dir = bridge_path.parent
         if not (bridge_dir / "node_modules").exists():
@@ -174,17 +174,16 @@ class WhatsAppAdapter(BasePlatformAdapter):
             except Exception as e:
                 print(f"[{self.name}] Failed to install dependencies: {e}")
                 return False
-
+        
         try:
             # Ensure session directory exists
             self._session_path.mkdir(parents=True, exist_ok=True)
-
+            
             # Kill any orphaned bridge from a previous gateway run
             _kill_port_process(self._bridge_port)
-            import time
-
-            time.sleep(1)
-
+            import asyncio
+            await asyncio.sleep(1)
+            
             # Start the bridge process in its own process group.
             # Route output to a log file so QR codes, errors, and reconnection
             # messages are preserved for troubleshooting.
@@ -196,23 +195,19 @@ class WhatsAppAdapter(BasePlatformAdapter):
                 [
                     "node",
                     str(bridge_path),
-                    "--port",
-                    str(self._bridge_port),
-                    "--session",
-                    str(self._session_path),
-                    "--mode",
-                    whatsapp_mode,
+                    "--port", str(self._bridge_port),
+                    "--session", str(self._session_path),
+                    "--mode", whatsapp_mode,
                 ],
                 stdout=bridge_log_fh,
                 stderr=bridge_log_fh,
                 preexec_fn=None if _IS_WINDOWS else os.setsid,
             )
-
+            
             # Wait for the bridge to connect to WhatsApp.
             # Phase 1: wait for the HTTP server to come up (up to 15s).
             # Phase 2: wait for WhatsApp status: connected (up to 15s more).
             import aiohttp
-
             http_ready = False
             data = {}
             for attempt in range(15):
@@ -223,18 +218,17 @@ class WhatsAppAdapter(BasePlatformAdapter):
                     self._close_bridge_log()
                     return False
                 try:
-                    async with (
-                        aiohttp.ClientSession() as session,
-                        session.get(
-                            f"http://localhost:{self._bridge_port}/health", timeout=aiohttp.ClientTimeout(total=2)
-                        ) as resp,
-                    ):
-                        if resp.status == 200:
-                            http_ready = True
-                            data = await resp.json()
-                            if data.get("status") == "connected":
-                                print(f"[{self.name}] Bridge ready (status: connected)")
-                                break
+                    async with aiohttp.ClientSession() as session:
+                        async with session.get(
+                            f"http://localhost:{self._bridge_port}/health",
+                            timeout=aiohttp.ClientTimeout(total=2)
+                        ) as resp:
+                            if resp.status == 200:
+                                http_ready = True
+                                data = await resp.json()
+                                if data.get("status") == "connected":
+                                    print(f"[{self.name}] Bridge ready (status: connected)")
+                                    break
                 except Exception:
                     continue
 
@@ -243,7 +237,7 @@ class WhatsAppAdapter(BasePlatformAdapter):
                 print(f"[{self.name}] Check log: {self._bridge_log}")
                 self._close_bridge_log()
                 return False
-
+            
             # Phase 2: HTTP is up but WhatsApp may still be connecting.
             # Give it more time to authenticate with saved credentials.
             if data.get("status") != "connected":
@@ -256,17 +250,16 @@ class WhatsAppAdapter(BasePlatformAdapter):
                         self._close_bridge_log()
                         return False
                     try:
-                        async with (
-                            aiohttp.ClientSession() as session,
-                            session.get(
-                                f"http://localhost:{self._bridge_port}/health", timeout=aiohttp.ClientTimeout(total=2)
-                            ) as resp,
-                        ):
-                            if resp.status == 200:
-                                data = await resp.json()
-                                if data.get("status") == "connected":
-                                    print(f"[{self.name}] Bridge ready (status: connected)")
-                                    break
+                        async with aiohttp.ClientSession() as session:
+                            async with session.get(
+                                f"http://localhost:{self._bridge_port}/health",
+                                timeout=aiohttp.ClientTimeout(total=2)
+                            ) as resp:
+                                if resp.status == 200:
+                                    data = await resp.json()
+                                    if data.get("status") == "connected":
+                                        print(f"[{self.name}] Bridge ready (status: connected)")
+                                        break
                     except Exception:
                         continue
                 else:
@@ -275,19 +268,19 @@ class WhatsAppAdapter(BasePlatformAdapter):
                     print(f"[{self.name}] ⚠ WhatsApp not connected after 30s")
                     print(f"[{self.name}]   Bridge log: {self._bridge_log}")
                     print(f"[{self.name}]   If session expired, re-pair: hermes whatsapp")
-
+            
             # Start message polling task
             asyncio.create_task(self._poll_messages())
-
+            
             self._running = True
             print(f"[{self.name}] Bridge started on port {self._bridge_port}")
             return True
-
+            
         except Exception as e:
             logger.error("[%s] Failed to start bridge: %s", self.name, e, exc_info=True)
             self._close_bridge_log()
             return False
-
+    
     def _close_bridge_log(self) -> None:
         """Close the bridge log file handle if open."""
         if self._bridge_log_fh:
@@ -303,7 +296,6 @@ class WhatsAppAdapter(BasePlatformAdapter):
             try:
                 # Kill the entire process group so child node processes die too
                 import signal
-
                 try:
                     if _IS_WINDOWS:
                         self._bridge_process.terminate()
@@ -322,25 +314,29 @@ class WhatsAppAdapter(BasePlatformAdapter):
                         self._bridge_process.kill()
             except Exception as e:
                 print(f"[{self.name}] Error stopping bridge: {e}")
-
+        
         # Also kill any orphaned bridge processes on our port
         _kill_port_process(self._bridge_port)
-
+        
         self._running = False
         self._bridge_process = None
         self._close_bridge_log()
         print(f"[{self.name}] Disconnected")
-
+    
     async def send(
-        self, chat_id: str, content: str, reply_to: str | None = None, metadata: dict[str, Any] | None = None
+        self,
+        chat_id: str,
+        content: str,
+        reply_to: Optional[str] = None,
+        metadata: Optional[Dict[str, Any]] = None
     ) -> SendResult:
         """Send a message via the WhatsApp bridge."""
         if not self._running:
             return SendResult(success=False, error="Not connected")
-
+        
         try:
             import aiohttp
-
+            
             async with aiohttp.ClientSession() as session:
                 payload = {
                     "chatId": chat_id,
@@ -348,19 +344,28 @@ class WhatsAppAdapter(BasePlatformAdapter):
                 }
                 if reply_to:
                     payload["replyTo"] = reply_to
-
+                
                 async with session.post(
-                    f"http://localhost:{self._bridge_port}/send", json=payload, timeout=aiohttp.ClientTimeout(total=30)
+                    f"http://localhost:{self._bridge_port}/send",
+                    json=payload,
+                    timeout=aiohttp.ClientTimeout(total=30)
                 ) as resp:
                     if resp.status == 200:
                         data = await resp.json()
-                        return SendResult(success=True, message_id=data.get("messageId"), raw_response=data)
+                        return SendResult(
+                            success=True,
+                            message_id=data.get("messageId"),
+                            raw_response=data
+                        )
                     else:
                         error = await resp.text()
                         return SendResult(success=False, error=error)
-
+                        
         except ImportError:
-            return SendResult(success=False, error="aiohttp not installed. Run: pip install aiohttp")
+            return SendResult(
+                success=False, 
+                error="aiohttp not installed. Run: pip install aiohttp"
+            )
         except Exception as e:
             return SendResult(success=False, error=str(e))
 
@@ -375,24 +380,21 @@ class WhatsAppAdapter(BasePlatformAdapter):
             return SendResult(success=False, error="Not connected")
         try:
             import aiohttp
-
-            async with (
-                aiohttp.ClientSession() as session,
-                session.post(
+            async with aiohttp.ClientSession() as session:
+                async with session.post(
                     f"http://localhost:{self._bridge_port}/edit",
                     json={
                         "chatId": chat_id,
                         "messageId": message_id,
                         "message": content,
                     },
-                    timeout=aiohttp.ClientTimeout(total=15),
-                ) as resp,
-            ):
-                if resp.status == 200:
-                    return SendResult(success=True, message_id=message_id)
-                else:
-                    error = await resp.text()
-                    return SendResult(success=False, error=error)
+                    timeout=aiohttp.ClientTimeout(total=15)
+                ) as resp:
+                    if resp.status == 200:
+                        return SendResult(success=True, message_id=message_id)
+                    else:
+                        error = await resp.text()
+                        return SendResult(success=False, error=error)
         except Exception as e:
             return SendResult(success=False, error=str(e))
 
@@ -401,8 +403,8 @@ class WhatsAppAdapter(BasePlatformAdapter):
         chat_id: str,
         file_path: str,
         media_type: str,
-        caption: str | None = None,
-        file_name: str | None = None,
+        caption: Optional[str] = None,
+        file_name: Optional[str] = None,
     ) -> SendResult:
         """Send any media file via bridge /send-media endpoint."""
         if not self._running:
@@ -413,7 +415,7 @@ class WhatsAppAdapter(BasePlatformAdapter):
             if not os.path.exists(file_path):
                 return SendResult(success=False, error=f"File not found: {file_path}")
 
-            payload: dict[str, Any] = {
+            payload: Dict[str, Any] = {
                 "chatId": chat_id,
                 "filePath": file_path,
                 "mediaType": media_type,
@@ -423,24 +425,22 @@ class WhatsAppAdapter(BasePlatformAdapter):
             if file_name:
                 payload["fileName"] = file_name
 
-            async with (
-                aiohttp.ClientSession() as session,
-                session.post(
+            async with aiohttp.ClientSession() as session:
+                async with session.post(
                     f"http://localhost:{self._bridge_port}/send-media",
                     json=payload,
                     timeout=aiohttp.ClientTimeout(total=120),
-                ) as resp,
-            ):
-                if resp.status == 200:
-                    data = await resp.json()
-                    return SendResult(
-                        success=True,
-                        message_id=data.get("messageId"),
-                        raw_response=data,
-                    )
-                else:
-                    error = await resp.text()
-                    return SendResult(success=False, error=error)
+                ) as resp:
+                    if resp.status == 200:
+                        data = await resp.json()
+                        return SendResult(
+                            success=True,
+                            message_id=data.get("messageId"),
+                            raw_response=data,
+                        )
+                    else:
+                        error = await resp.text()
+                        return SendResult(success=False, error=error)
 
         except Exception as e:
             return SendResult(success=False, error=str(e))
@@ -449,8 +449,8 @@ class WhatsAppAdapter(BasePlatformAdapter):
         self,
         chat_id: str,
         image_url: str,
-        caption: str | None = None,
-        reply_to: str | None = None,
+        caption: Optional[str] = None,
+        reply_to: Optional[str] = None,
     ) -> SendResult:
         """Download image URL to cache, send natively via bridge."""
         try:
@@ -463,8 +463,8 @@ class WhatsAppAdapter(BasePlatformAdapter):
         self,
         chat_id: str,
         image_path: str,
-        caption: str | None = None,
-        reply_to: str | None = None,
+        caption: Optional[str] = None,
+        reply_to: Optional[str] = None,
     ) -> SendResult:
         """Send a local image file natively via bridge."""
         return await self._send_media_to_bridge(chat_id, image_path, "image", caption)
@@ -473,8 +473,8 @@ class WhatsAppAdapter(BasePlatformAdapter):
         self,
         chat_id: str,
         video_path: str,
-        caption: str | None = None,
-        reply_to: str | None = None,
+        caption: Optional[str] = None,
+        reply_to: Optional[str] = None,
     ) -> SendResult:
         """Send a video natively via bridge — plays inline in WhatsApp."""
         return await self._send_media_to_bridge(chat_id, video_path, "video", caption)
@@ -483,62 +483,58 @@ class WhatsAppAdapter(BasePlatformAdapter):
         self,
         chat_id: str,
         file_path: str,
-        caption: str | None = None,
-        file_name: str | None = None,
-        reply_to: str | None = None,
+        caption: Optional[str] = None,
+        file_name: Optional[str] = None,
+        reply_to: Optional[str] = None,
     ) -> SendResult:
         """Send a document/file as a downloadable attachment via bridge."""
         return await self._send_media_to_bridge(
-            chat_id,
-            file_path,
-            "document",
-            caption,
+            chat_id, file_path, "document", caption,
             file_name or os.path.basename(file_path),
         )
 
-    async def send_typing(self, chat_id: str) -> None:
+    async def send_typing(self, chat_id: str, metadata=None) -> None:
         """Send typing indicator via bridge."""
         if not self._running:
             return
-
+        
         try:
             import aiohttp
-
+            
             async with aiohttp.ClientSession() as session:
                 await session.post(
                     f"http://localhost:{self._bridge_port}/typing",
                     json={"chatId": chat_id},
-                    timeout=aiohttp.ClientTimeout(total=5),
+                    timeout=aiohttp.ClientTimeout(total=5)
                 )
         except Exception:
             pass  # Ignore typing indicator failures
-
-    async def get_chat_info(self, chat_id: str) -> dict[str, Any]:
+    
+    async def get_chat_info(self, chat_id: str) -> Dict[str, Any]:
         """Get information about a WhatsApp chat."""
         if not self._running:
             return {"name": "Unknown", "type": "dm"}
-
+        
         try:
             import aiohttp
-
-            async with (
-                aiohttp.ClientSession() as session,
-                session.get(
-                    f"http://localhost:{self._bridge_port}/chat/{chat_id}", timeout=aiohttp.ClientTimeout(total=10)
-                ) as resp,
-            ):
-                if resp.status == 200:
-                    data = await resp.json()
-                    return {
-                        "name": data.get("name", chat_id),
-                        "type": "group" if data.get("isGroup") else "dm",
-                        "participants": data.get("participants", []),
-                    }
+            
+            async with aiohttp.ClientSession() as session:
+                async with session.get(
+                    f"http://localhost:{self._bridge_port}/chat/{chat_id}",
+                    timeout=aiohttp.ClientTimeout(total=10)
+                ) as resp:
+                    if resp.status == 200:
+                        data = await resp.json()
+                        return {
+                            "name": data.get("name", chat_id),
+                            "type": "group" if data.get("isGroup") else "dm",
+                            "participants": data.get("participants", []),
+                        }
         except Exception as e:
             logger.debug("Could not get WhatsApp chat info for %s: %s", chat_id, e)
-
+        
         return {"name": chat_id, "type": "dm"}
-
+    
     async def _poll_messages(self) -> None:
         """Poll the bridge for incoming messages."""
         try:
@@ -546,30 +542,29 @@ class WhatsAppAdapter(BasePlatformAdapter):
         except ImportError:
             print(f"[{self.name}] aiohttp not installed, message polling disabled")
             return
-
+        
         while self._running:
             try:
-                async with (
-                    aiohttp.ClientSession() as session,
-                    session.get(
-                        f"http://localhost:{self._bridge_port}/messages", timeout=aiohttp.ClientTimeout(total=30)
-                    ) as resp,
-                ):
-                    if resp.status == 200:
-                        messages = await resp.json()
-                        for msg_data in messages:
-                            event = await self._build_message_event(msg_data)
-                            if event:
-                                await self.handle_message(event)
+                async with aiohttp.ClientSession() as session:
+                    async with session.get(
+                        f"http://localhost:{self._bridge_port}/messages",
+                        timeout=aiohttp.ClientTimeout(total=30)
+                    ) as resp:
+                        if resp.status == 200:
+                            messages = await resp.json()
+                            for msg_data in messages:
+                                event = await self._build_message_event(msg_data)
+                                if event:
+                                    await self.handle_message(event)
             except asyncio.CancelledError:
                 break
             except Exception as e:
                 print(f"[{self.name}] Poll error: {e}")
                 await asyncio.sleep(5)
-
+            
             await asyncio.sleep(1)  # Poll interval
-
-    async def _build_message_event(self, data: dict[str, Any]) -> MessageEvent | None:
+    
+    async def _build_message_event(self, data: Dict[str, Any]) -> Optional[MessageEvent]:
         """Build a MessageEvent from bridge message data, downloading images to cache."""
         try:
             # Determine message type
@@ -584,11 +579,11 @@ class WhatsAppAdapter(BasePlatformAdapter):
                     msg_type = MessageType.VOICE
                 else:
                     msg_type = MessageType.DOCUMENT
-
+            
             # Determine chat type
             is_group = data.get("isGroup", False)
             chat_type = "group" if is_group else "dm"
-
+            
             # Build source
             source = self.build_source(
                 chat_id=data.get("chatId", ""),
@@ -597,7 +592,7 @@ class WhatsAppAdapter(BasePlatformAdapter):
                 user_id=data.get("senderId"),
                 user_name=data.get("senderName"),
             )
-
+            
             # Download image media URLs to the local cache so the vision tool
             # can access them reliably regardless of URL expiration.
             raw_urls = data.get("mediaUrls", [])
@@ -627,7 +622,7 @@ class WhatsAppAdapter(BasePlatformAdapter):
                 else:
                     cached_urls.append(url)
                     media_types.append("unknown")
-
+            
             return MessageEvent(
                 text=data.get("body", ""),
                 message_type=msg_type,
@@ -640,3 +635,4 @@ class WhatsAppAdapter(BasePlatformAdapter):
         except Exception as e:
             print(f"[{self.name}] Error building event: {e}")
             return None
+

gateway/session.py

@@ -8,20 +8,22 @@ Handles:
 - Dynamic system prompt injection (agent knows its context)
 """
 
-import json
 import logging
+import os
+import json
 import uuid
-from dataclasses import dataclass
-from datetime import datetime, timedelta
 from pathlib import Path
-from typing import Any
+from datetime import datetime, timedelta
+from dataclasses import dataclass, field
+from typing import Dict, List, Optional, Any
 
 logger = logging.getLogger(__name__)
 
 from .config import (
-    GatewayConfig,
-    HomeChannel,
     Platform,
+    GatewayConfig,
+    SessionResetPolicy,
+    HomeChannel,
 )
 
 
@@ -29,30 +31,29 @@ from .config import (
 class SessionSource:
     """
     Describes where a message originated from.
-
+    
     This information is used to:
     1. Route responses back to the right place
     2. Inject context into the system prompt
     3. Track origin for cron job delivery
     """
-
     platform: Platform
     chat_id: str
-    chat_name: str | None = None
+    chat_name: Optional[str] = None
     chat_type: str = "dm"  # "dm", "group", "channel", "thread"
-    user_id: str | None = None
-    user_name: str | None = None
-    thread_id: str | None = None  # For forum topics, Discord threads, etc.
-    chat_topic: str | None = None  # Channel topic/description (Discord, Slack)
-    user_id_alt: str | None = None  # Signal UUID (alternative to phone number)
-    chat_id_alt: str | None = None  # Signal group internal ID
-
+    user_id: Optional[str] = None
+    user_name: Optional[str] = None
+    thread_id: Optional[str] = None  # For forum topics, Discord threads, etc.
+    chat_topic: Optional[str] = None  # Channel topic/description (Discord, Slack)
+    user_id_alt: Optional[str] = None  # Signal UUID (alternative to phone number)
+    chat_id_alt: Optional[str] = None  # Signal group internal ID
+    
     @property
     def description(self) -> str:
         """Human-readable description of the source."""
         if self.platform == Platform.LOCAL:
             return "CLI terminal"
-
+        
         parts = []
         if self.chat_type == "dm":
             parts.append(f"DM with {self.user_name or self.user_id or 'user'}")
@@ -62,13 +63,13 @@ class SessionSource:
             parts.append(f"channel: {self.chat_name or self.chat_id}")
         else:
             parts.append(self.chat_name or self.chat_id)
-
+        
         if self.thread_id:
             parts.append(f"thread: {self.thread_id}")
-
+        
         return ", ".join(parts)
-
-    def to_dict(self) -> dict[str, Any]:
+    
+    def to_dict(self) -> Dict[str, Any]:
         d = {
             "platform": self.platform.value,
             "chat_id": self.chat_id,
@@ -84,9 +85,9 @@ class SessionSource:
         if self.chat_id_alt:
             d["chat_id_alt"] = self.chat_id_alt
         return d
-
+    
     @classmethod
-    def from_dict(cls, data: dict[str, Any]) -> "SessionSource":
+    def from_dict(cls, data: Dict[str, Any]) -> "SessionSource":
         return cls(
             platform=Platform(data["platform"]),
             chat_id=str(data["chat_id"]),
@@ -99,7 +100,7 @@ class SessionSource:
             user_id_alt=data.get("user_id_alt"),
             chat_id_alt=data.get("chat_id_alt"),
         )
-
+    
     @classmethod
     def local_cli(cls) -> "SessionSource":
         """Create a source representing the local CLI."""
@@ -115,28 +116,29 @@ class SessionSource:
 class SessionContext:
     """
     Full context for a session, used for dynamic system prompt injection.
-
+    
     The agent receives this information to understand:
     - Where messages are coming from
     - What platforms are available
     - Where it can deliver scheduled task outputs
     """
-
     source: SessionSource
-    connected_platforms: list[Platform]
-    home_channels: dict[Platform, HomeChannel]
-
+    connected_platforms: List[Platform]
+    home_channels: Dict[Platform, HomeChannel]
+    
     # Session metadata
     session_key: str = ""
     session_id: str = ""
-    created_at: datetime | None = None
-    updated_at: datetime | None = None
-
-    def to_dict(self) -> dict[str, Any]:
+    created_at: Optional[datetime] = None
+    updated_at: Optional[datetime] = None
+    
+    def to_dict(self) -> Dict[str, Any]:
         return {
             "source": self.source.to_dict(),
             "connected_platforms": [p.value for p in self.connected_platforms],
-            "home_channels": {p.value: hc.to_dict() for p, hc in self.home_channels.items()},
+            "home_channels": {
+                p.value: hc.to_dict() for p, hc in self.home_channels.items()
+            },
             "session_key": self.session_key,
             "session_id": self.session_id,
             "created_at": self.created_at.isoformat() if self.created_at else None,
@@ -147,7 +149,7 @@ class SessionContext:
 def build_session_context_prompt(context: SessionContext) -> str:
     """
     Build the dynamic system prompt section that tells the agent about its context.
-
+    
     This is injected into the system prompt so the agent knows:
     - Where messages are coming from
     - What platforms are connected
@@ -157,14 +159,14 @@ def build_session_context_prompt(context: SessionContext) -> str:
         "## Current Session Context",
         "",
     ]
-
+    
     # Source info
     platform_name = context.source.platform.value.title()
     if context.source.platform == Platform.LOCAL:
         lines.append(f"**Source:** {platform_name} (the machine running this agent)")
     else:
         lines.append(f"**Source:** {platform_name} ({context.source.description})")
-
+    
     # Channel topic (if available - provides context about the channel's purpose)
     if context.source.chat_topic:
         lines.append(f"**Channel Topic:** {context.source.chat_topic}")
@@ -174,43 +176,43 @@ def build_session_context_prompt(context: SessionContext) -> str:
         lines.append(f"**User:** {context.source.user_name}")
     elif context.source.user_id:
         lines.append(f"**User ID:** {context.source.user_id}")
-
+    
     # Connected platforms
     platforms_list = ["local (files on this machine)"]
     for p in context.connected_platforms:
         if p != Platform.LOCAL:
             platforms_list.append(f"{p.value}: Connected ✓")
-
+    
     lines.append(f"**Connected Platforms:** {', '.join(platforms_list)}")
-
+    
     # Home channels
     if context.home_channels:
         lines.append("")
         lines.append("**Home Channels (default destinations):**")
         for platform, home in context.home_channels.items():
             lines.append(f"  - {platform.value}: {home.name} (ID: {home.chat_id})")
-
+    
     # Delivery options for scheduled tasks
     lines.append("")
     lines.append("**Delivery options for scheduled tasks:**")
-
+    
     # Origin delivery
     if context.source.platform == Platform.LOCAL:
-        lines.append('- `"origin"` → Local output (saved to files)')
+        lines.append("- `\"origin\"` → Local output (saved to files)")
     else:
-        lines.append(f'- `"origin"` → Back to this chat ({context.source.chat_name or context.source.chat_id})')
-
+        lines.append(f"- `\"origin\"` → Back to this chat ({context.source.chat_name or context.source.chat_id})")
+    
     # Local always available
-    lines.append('- `"local"` → Save to local files only (~/.hermes/cron/output/)')
-
+    lines.append("- `\"local\"` → Save to local files only (~/.hermes/cron/output/)")
+    
     # Platform home channels
     for platform, home in context.home_channels.items():
-        lines.append(f'- `"{platform.value}"` → Home channel ({home.name})')
-
+        lines.append(f"- `\"{platform.value}\"` → Home channel ({home.name})")
+    
     # Note about explicit targeting
     lines.append("")
-    lines.append('*For explicit targeting, use `"platform:chat_id"` format if the user provides a specific chat ID.*')
-
+    lines.append("*For explicit targeting, use `\"platform:chat_id\"` format if the user provides a specific chat ID.*")
+    
     return "\n".join(lines)
 
 
@@ -218,33 +220,35 @@ def build_session_context_prompt(context: SessionContext) -> str:
 class SessionEntry:
     """
     Entry in the session store.
-
+    
     Maps a session key to its current session ID and metadata.
     """
-
     session_key: str
     session_id: str
     created_at: datetime
     updated_at: datetime
-
+    
     # Origin metadata for delivery routing
-    origin: SessionSource | None = None
-
+    origin: Optional[SessionSource] = None
+    
     # Display metadata
-    display_name: str | None = None
-    platform: Platform | None = None
+    display_name: Optional[str] = None
+    platform: Optional[Platform] = None
     chat_type: str = "dm"
-
+    
     # Token tracking
     input_tokens: int = 0
     output_tokens: int = 0
     total_tokens: int = 0
-
+    
+    # Last API-reported prompt tokens (for accurate compression pre-check)
+    last_prompt_tokens: int = 0
+    
     # Set when a session was created because the previous one expired;
     # consumed once by the message handler to inject a notice into context
     was_auto_reset: bool = False
-
-    def to_dict(self) -> dict[str, Any]:
+    
+    def to_dict(self) -> Dict[str, Any]:
         result = {
             "session_key": self.session_key,
             "session_id": self.session_id,
@@ -256,24 +260,25 @@ class SessionEntry:
             "input_tokens": self.input_tokens,
             "output_tokens": self.output_tokens,
             "total_tokens": self.total_tokens,
+            "last_prompt_tokens": self.last_prompt_tokens,
         }
         if self.origin:
             result["origin"] = self.origin.to_dict()
         return result
-
+    
     @classmethod
-    def from_dict(cls, data: dict[str, Any]) -> "SessionEntry":
+    def from_dict(cls, data: Dict[str, Any]) -> "SessionEntry":
         origin = None
         if "origin" in data and data["origin"]:
             origin = SessionSource.from_dict(data["origin"])
-
+        
         platform = None
         if data.get("platform"):
             try:
                 platform = Platform(data["platform"])
-            except ValueError:
-                pass
-
+            except ValueError as e:
+                logger.debug("Unknown platform value %r: %s", data["platform"], e)
+        
         return cls(
             session_key=data["session_key"],
             session_id=data["session_id"],
@@ -286,6 +291,7 @@ class SessionEntry:
             input_tokens=data.get("input_tokens", 0),
             output_tokens=data.get("output_tokens", 0),
             total_tokens=data.get("total_tokens", 0),
+            last_prompt_tokens=data.get("last_prompt_tokens", 0),
         )
 
 
@@ -300,71 +306,88 @@ def build_session_key(source: SessionSource) -> str:
         if platform == "whatsapp" and source.chat_id:
             return f"agent:main:{platform}:dm:{source.chat_id}"
         return f"agent:main:{platform}:dm"
+    if source.thread_id:
+        return f"agent:main:{platform}:{source.chat_type}:{source.chat_id}:{source.thread_id}"
     return f"agent:main:{platform}:{source.chat_type}:{source.chat_id}"
 
 
 class SessionStore:
     """
     Manages session storage and retrieval.
-
+    
     Uses SQLite (via SessionDB) for session metadata and message transcripts.
     Falls back to legacy JSONL files if SQLite is unavailable.
     """
-
-    def __init__(self, sessions_dir: Path, config: GatewayConfig, has_active_processes_fn=None, on_auto_reset=None):
+    
+    def __init__(self, sessions_dir: Path, config: GatewayConfig,
+                 has_active_processes_fn=None,
+                 on_auto_reset=None):
         self.sessions_dir = sessions_dir
         self.config = config
-        self._entries: dict[str, SessionEntry] = {}
+        self._entries: Dict[str, SessionEntry] = {}
         self._loaded = False
         self._has_active_processes_fn = has_active_processes_fn
         # on_auto_reset is deprecated — memory flush now runs proactively
         # via the background session expiry watcher in GatewayRunner.
         self._pre_flushed_sessions: set = set()  # session_ids already flushed by watcher
-
+        
         # Initialize SQLite session database
         self._db = None
         try:
             from hermes_state import SessionDB
-
             self._db = SessionDB()
         except Exception as e:
             print(f"[gateway] Warning: SQLite session store unavailable, falling back to JSONL: {e}")
-
+    
     def _ensure_loaded(self) -> None:
         """Load sessions index from disk if not already loaded."""
         if self._loaded:
             return
-
+        
         self.sessions_dir.mkdir(parents=True, exist_ok=True)
         sessions_file = self.sessions_dir / "sessions.json"
-
+        
         if sessions_file.exists():
             try:
-                with open(sessions_file, encoding="utf-8") as f:
+                with open(sessions_file, "r", encoding="utf-8") as f:
                     data = json.load(f)
                     for key, entry_data in data.items():
                         self._entries[key] = SessionEntry.from_dict(entry_data)
             except Exception as e:
                 print(f"[gateway] Warning: Failed to load sessions: {e}")
-
+        
         self._loaded = True
-
+    
     def _save(self) -> None:
         """Save sessions index to disk (kept for session key -> ID mapping)."""
+        import tempfile
         self.sessions_dir.mkdir(parents=True, exist_ok=True)
         sessions_file = self.sessions_dir / "sessions.json"
 
         data = {key: entry.to_dict() for key, entry in self._entries.items()}
-        with open(sessions_file, "w", encoding="utf-8") as f:
-            json.dump(data, f, indent=2)
-
+        fd, tmp_path = tempfile.mkstemp(
+            dir=str(self.sessions_dir), suffix=".tmp", prefix=".sessions_"
+        )
+        try:
+            with os.fdopen(fd, "w", encoding="utf-8") as f:
+                json.dump(data, f, indent=2)
+                f.flush()
+                os.fsync(f.fileno())
+            os.replace(tmp_path, sessions_file)
+        except BaseException:
+            try:
+                os.unlink(tmp_path)
+            except OSError as e:
+                logger.debug("Could not remove temp file %s: %s", tmp_path, e)
+            raise
+    
     def _generate_session_key(self, source: SessionSource) -> str:
         """Generate a session key from a source."""
         return build_session_key(source)
-
+    
     def _is_session_expired(self, entry: SessionEntry) -> bool:
         """Check if a session has expired based on its reset policy.
-
+        
         Works from the entry alone — no SessionSource needed.
         Used by the background expiry watcher to proactively flush memories.
         Sessions with active background processes are never considered expired.
@@ -391,9 +414,7 @@ class SessionStore:
         if policy.mode in ("daily", "both"):
             today_reset = now.replace(
                 hour=policy.at_hour,
-                minute=0,
-                second=0,
-                microsecond=0,
+                minute=0, second=0, microsecond=0,
             )
             if now.hour < policy.at_hour:
                 today_reset -= timedelta(days=1)
@@ -405,7 +426,7 @@ class SessionStore:
     def _should_reset(self, entry: SessionEntry, source: SessionSource) -> bool:
         """
         Check if a session should be reset based on policy.
-
+        
         Sessions with active background processes are never reset.
         """
         if self._has_active_processes_fn:
@@ -413,28 +434,36 @@ class SessionStore:
             if self._has_active_processes_fn(session_key):
                 return False
 
-        policy = self.config.get_reset_policy(platform=source.platform, session_type=source.chat_type)
-
+        policy = self.config.get_reset_policy(
+            platform=source.platform,
+            session_type=source.chat_type
+        )
+        
         if policy.mode == "none":
             return False
-
+        
         now = datetime.now()
-
+        
         if policy.mode in ("idle", "both"):
             idle_deadline = entry.updated_at + timedelta(minutes=policy.idle_minutes)
             if now > idle_deadline:
                 return True
-
+        
         if policy.mode in ("daily", "both"):
-            today_reset = now.replace(hour=policy.at_hour, minute=0, second=0, microsecond=0)
+            today_reset = now.replace(
+                hour=policy.at_hour, 
+                minute=0, 
+                second=0, 
+                microsecond=0
+            )
             if now.hour < policy.at_hour:
                 today_reset -= timedelta(days=1)
-
+            
             if entry.updated_at < today_reset:
                 return True
-
+        
         return False
-
+    
     def has_any_sessions(self) -> bool:
         """Check if any sessions have ever been created (across all platforms).
 
@@ -455,22 +484,26 @@ class SessionStore:
         # This covers the rare case where the DB is unavailable.
         self._ensure_loaded()
         return len(self._entries) > 1
-
-    def get_or_create_session(self, source: SessionSource, force_new: bool = False) -> SessionEntry:
+    
+    def get_or_create_session(
+        self, 
+        source: SessionSource,
+        force_new: bool = False
+    ) -> SessionEntry:
         """
         Get an existing session or create a new one.
-
+        
         Evaluates reset policy to determine if the existing session is stale.
         Creates a session record in SQLite when a new session starts.
         """
         self._ensure_loaded()
-
+        
         session_key = self._generate_session_key(source)
         now = datetime.now()
-
+        
         if session_key in self._entries and not force_new:
             entry = self._entries[session_key]
-
+            
             if not self._should_reset(entry, source):
                 entry.updated_at = now
                 self._save()
@@ -488,10 +521,10 @@ class SessionStore:
                         logger.debug("Session DB operation failed: %s", e)
         else:
             was_auto_reset = False
-
+        
         # Create new session
         session_id = f"{now.strftime('%Y%m%d_%H%M%S')}_{uuid.uuid4().hex[:8]}"
-
+        
         entry = SessionEntry(
             session_key=session_key,
             session_id=session_id,
@@ -503,10 +536,10 @@ class SessionStore:
             chat_type=source.chat_type,
             was_auto_reset=was_auto_reset,
         )
-
+        
         self._entries[session_key] = entry
         self._save()
-
+        
         # Create session in SQLite
         if self._db:
             try:
@@ -517,46 +550,56 @@ class SessionStore:
                 )
             except Exception as e:
                 print(f"[gateway] Warning: Failed to create SQLite session: {e}")
-
+        
         return entry
-
-    def update_session(self, session_key: str, input_tokens: int = 0, output_tokens: int = 0) -> None:
+    
+    def update_session(
+        self, 
+        session_key: str,
+        input_tokens: int = 0,
+        output_tokens: int = 0,
+        last_prompt_tokens: int = None,
+    ) -> None:
         """Update a session's metadata after an interaction."""
         self._ensure_loaded()
-
+        
         if session_key in self._entries:
             entry = self._entries[session_key]
             entry.updated_at = datetime.now()
             entry.input_tokens += input_tokens
             entry.output_tokens += output_tokens
+            if last_prompt_tokens is not None:
+                entry.last_prompt_tokens = last_prompt_tokens
             entry.total_tokens = entry.input_tokens + entry.output_tokens
             self._save()
-
+            
             if self._db:
                 try:
-                    self._db.update_token_counts(entry.session_id, input_tokens, output_tokens)
+                    self._db.update_token_counts(
+                        entry.session_id, input_tokens, output_tokens
+                    )
                 except Exception as e:
                     logger.debug("Session DB operation failed: %s", e)
-
-    def reset_session(self, session_key: str) -> SessionEntry | None:
+    
+    def reset_session(self, session_key: str) -> Optional[SessionEntry]:
         """Force reset a session, creating a new session ID."""
         self._ensure_loaded()
-
+        
         if session_key not in self._entries:
             return None
-
+        
         old_entry = self._entries[session_key]
-
+        
         # End old session in SQLite
         if self._db:
             try:
                 self._db.end_session(old_entry.session_id, "session_reset")
             except Exception as e:
                 logger.debug("Session DB operation failed: %s", e)
-
+        
         now = datetime.now()
         session_id = f"{now.strftime('%Y%m%d_%H%M%S')}_{uuid.uuid4().hex[:8]}"
-
+        
         new_entry = SessionEntry(
             session_key=session_key,
             session_id=session_id,
@@ -567,10 +610,10 @@ class SessionStore:
             platform=old_entry.platform,
             chat_type=old_entry.chat_type,
         )
-
+        
         self._entries[session_key] = new_entry
         self._save()
-
+        
         # Create new session in SQLite
         if self._db:
             try:
@@ -581,10 +624,10 @@ class SessionStore:
                 )
             except Exception as e:
                 logger.debug("Session DB operation failed: %s", e)
-
+        
         return new_entry
 
-    def switch_session(self, session_key: str, target_session_id: str) -> SessionEntry | None:
+    def switch_session(self, session_key: str, target_session_id: str) -> Optional[SessionEntry]:
         """Switch a session key to point at an existing session ID.
 
         Used by ``/resume`` to restore a previously-named session.
@@ -626,28 +669,35 @@ class SessionStore:
         self._save()
         return new_entry
 
-    def list_sessions(self, active_minutes: int | None = None) -> list[SessionEntry]:
+    def list_sessions(self, active_minutes: Optional[int] = None) -> List[SessionEntry]:
         """List all sessions, optionally filtered by activity."""
         self._ensure_loaded()
-
+        
         entries = list(self._entries.values())
-
+        
         if active_minutes is not None:
             cutoff = datetime.now() - timedelta(minutes=active_minutes)
             entries = [e for e in entries if e.updated_at >= cutoff]
-
+        
         entries.sort(key=lambda e: e.updated_at, reverse=True)
-
+        
         return entries
-
+    
     def get_transcript_path(self, session_id: str) -> Path:
         """Get the path to a session's legacy transcript file."""
         return self.sessions_dir / f"{session_id}.jsonl"
+    
+    def append_to_transcript(self, session_id: str, message: Dict[str, Any], skip_db: bool = False) -> None:
+        """Append a message to a session's transcript (SQLite + legacy JSONL).
 
-    def append_to_transcript(self, session_id: str, message: dict[str, Any]) -> None:
-        """Append a message to a session's transcript (SQLite + legacy JSONL)."""
-        # Write to SQLite
-        if self._db:
+        Args:
+            skip_db: When True, only write to JSONL and skip the SQLite write.
+                     Used when the agent already persisted messages to SQLite
+                     via its own _flush_messages_to_session_db(), preventing
+                     the duplicate-write bug (#860).
+        """
+        # Write to SQLite (unless the agent already handled it)
+        if self._db and not skip_db:
             try:
                 self._db.append_message(
                     session_id=session_id,
@@ -659,15 +709,15 @@ class SessionStore:
                 )
             except Exception as e:
                 logger.debug("Session DB operation failed: %s", e)
-
+        
         # Also write legacy JSONL (keeps existing tooling working during transition)
         transcript_path = self.get_transcript_path(session_id)
         with open(transcript_path, "a", encoding="utf-8") as f:
             f.write(json.dumps(message, ensure_ascii=False) + "\n")
-
-    def rewrite_transcript(self, session_id: str, messages: list[dict[str, Any]]) -> None:
+    
+    def rewrite_transcript(self, session_id: str, messages: List[Dict[str, Any]]) -> None:
         """Replace the entire transcript for a session with new messages.
-
+        
         Used by /retry, /undo, and /compress to persist modified conversation history.
         Rewrites both SQLite and legacy JSONL storage.
         """
@@ -686,14 +736,14 @@ class SessionStore:
                     )
             except Exception as e:
                 logger.debug("Failed to rewrite transcript in DB: %s", e)
-
+        
         # JSONL: overwrite the file
         transcript_path = self.get_transcript_path(session_id)
         with open(transcript_path, "w", encoding="utf-8") as f:
             for msg in messages:
                 f.write(json.dumps(msg, ensure_ascii=False) + "\n")
 
-    def load_transcript(self, session_id: str) -> list[dict[str, Any]]:
+    def load_transcript(self, session_id: str) -> List[Dict[str, Any]]:
         """Load all messages from a session's transcript."""
         # Try SQLite first
         if self._db:
@@ -703,49 +753,51 @@ class SessionStore:
                     return messages
             except Exception as e:
                 logger.debug("Could not load messages from DB: %s", e)
-
+        
         # Fall back to legacy JSONL
         transcript_path = self.get_transcript_path(session_id)
-
+        
         if not transcript_path.exists():
             return []
-
+        
         messages = []
-        with open(transcript_path, encoding="utf-8") as f:
+        with open(transcript_path, "r", encoding="utf-8") as f:
             for line in f:
                 line = line.strip()
                 if line:
                     messages.append(json.loads(line))
-
+        
         return messages
 
 
 def build_session_context(
-    source: SessionSource, config: GatewayConfig, session_entry: SessionEntry | None = None
+    source: SessionSource,
+    config: GatewayConfig,
+    session_entry: Optional[SessionEntry] = None
 ) -> SessionContext:
     """
     Build a full session context from a source and config.
-
+    
     This is used to inject context into the agent's system prompt.
     """
     connected = config.get_connected_platforms()
-
+    
     home_channels = {}
     for platform in connected:
         home = config.get_home_channel(platform)
         if home:
             home_channels[platform] = home
-
+    
     context = SessionContext(
         source=source,
         connected_platforms=connected,
         home_channels=home_channels,
     )
-
+    
     if session_entry:
         context.session_key = session_entry.session_key
         context.session_id = session_entry.session_id
         context.created_at = session_entry.created_at
         context.updated_at = session_entry.updated_at
-
+    
     return context

gateway/status.py

@@ -13,6 +13,7 @@ concurrently under distinct configurations).
 
 import os
 from pathlib import Path
+from typing import Optional
 
 
 def _get_pid_path() -> Path:
@@ -36,7 +37,7 @@ def remove_pid_file() -> None:
         pass
 
 
-def get_running_pid() -> int | None:
+def get_running_pid() -> Optional[int]:
     """Return the PID of a running gateway instance, or ``None``.
 
     Checks the PID file and verifies the process is actually alive.

gateway/sticker_cache.py

@@ -12,6 +12,8 @@ import json
 import os
 import time
 from pathlib import Path
+from typing import Optional
+
 
 CACHE_PATH = Path(os.path.expanduser("~/.hermes/sticker_cache.json"))
 
@@ -41,7 +43,7 @@ def _save_cache(cache: dict) -> None:
     )
 
 
-def get_cached_description(file_unique_id: str) -> dict | None:
+def get_cached_description(file_unique_id: str) -> Optional[dict]:
     """
     Look up a cached sticker description.
 
@@ -90,11 +92,11 @@ def build_sticker_injection(
     """
     context = ""
     if set_name and emoji:
-        context = f' {emoji} from "{set_name}"'
+        context = f" {emoji} from \"{set_name}\""
     elif emoji:
         context = f" {emoji}"
 
-    return f'[The user sent a sticker{context}~ It shows: "{description}" (=^.w.^=)]'
+    return f"[The user sent a sticker{context}~ It shows: \"{description}\" (=^.w.^=)]"
 
 
 def build_animated_sticker_injection(emoji: str = "") -> str:

hermes_cli/__init__.py

@@ -5,10 +5,11 @@ Provides subcommands for:
 - hermes chat          - Interactive chat (same as ./hermes)
 - hermes gateway       - Run gateway in foreground
 - hermes gateway start - Start gateway service
-- hermes gateway stop  - Stop gateway service
+- hermes gateway stop  - Stop gateway service  
 - hermes setup         - Interactive setup wizard
 - hermes status        - Show status of all components
 - hermes cron          - Manage cron jobs
 """
 
-__version__ = "v1.0.0"
+__version__ = "0.2.0"
+__release_date__ = "2026.3.12"

hermes_cli/banner.py

@@ -9,13 +9,15 @@ import os
 import subprocess
 import time
 from pathlib import Path
+from typing import Dict, List, Any, Optional
 
-from prompt_toolkit import print_formatted_text as _pt_print
-from prompt_toolkit.formatted_text import ANSI as _PT_ANSI
 from rich.console import Console
 from rich.panel import Panel
 from rich.table import Table
 
+from prompt_toolkit import print_formatted_text as _pt_print
+from prompt_toolkit.formatted_text import ANSI as _PT_ANSI
+
 logger = logging.getLogger(__name__)
 
 
@@ -34,11 +36,33 @@ def cprint(text: str):
     _pt_print(_PT_ANSI(text))
 
 
+# =========================================================================
+# Skin-aware color helpers
+# =========================================================================
+
+def _skin_color(key: str, fallback: str) -> str:
+    """Get a color from the active skin, or return fallback."""
+    try:
+        from hermes_cli.skin_engine import get_active_skin
+        return get_active_skin().get_color(key, fallback)
+    except Exception:
+        return fallback
+
+
+def _skin_branding(key: str, fallback: str) -> str:
+    """Get a branding string from the active skin, or return fallback."""
+    try:
+        from hermes_cli.skin_engine import get_active_skin
+        return get_active_skin().get_branding(key, fallback)
+    except Exception:
+        return fallback
+
+
 # =========================================================================
 # ASCII Art & Branding
 # =========================================================================
 
-from hermes_cli import __version__ as VERSION
+from hermes_cli import __version__ as VERSION, __release_date__ as RELEASE_DATE
 
 HERMES_AGENT_LOGO = """[bold #FFD700]██╗  ██╗███████╗██████╗ ███╗   ███╗███████╗███████╗       █████╗  ██████╗ ███████╗███╗   ██╗████████╗[/]
 [bold #FFD700]██║  ██║██╔════╝██╔══██╗████╗ ████║██╔════╝██╔════╝      ██╔══██╗██╔════╝ ██╔════╝████╗  ██║╚══██╔══╝[/]
@@ -75,8 +99,7 @@ COMPACT_BANNER = """
 # Skills scanning
 # =========================================================================
 
-
-def get_available_skills() -> dict[str, list[str]]:
+def get_available_skills() -> Dict[str, List[str]]:
     """Scan ~/.hermes/skills/ and return skills grouped by category."""
     import os
 
@@ -109,7 +132,7 @@ def get_available_skills() -> dict[str, list[str]]:
 _UPDATE_CHECK_CACHE_SECONDS = 6 * 3600
 
 
-def check_for_updates() -> int | None:
+def check_for_updates() -> Optional[int]:
     """Check how many commits behind origin/main the local repo is.
 
     Does a ``git fetch`` at most once every 6 hours (cached to
@@ -138,8 +161,7 @@ def check_for_updates() -> int | None:
     try:
         subprocess.run(
             ["git", "fetch", "origin", "--quiet"],
-            capture_output=True,
-            timeout=10,
+            capture_output=True, timeout=10,
             cwd=str(repo_dir),
         )
     except Exception:
@@ -149,9 +171,7 @@ def check_for_updates() -> int | None:
     try:
         result = subprocess.run(
             ["git", "rev-list", "--count", "HEAD..origin/main"],
-            capture_output=True,
-            text=True,
-            timeout=5,
+            capture_output=True, text=True, timeout=5,
             cwd=str(repo_dir),
         )
         if result.returncode == 0:
@@ -174,7 +194,6 @@ def check_for_updates() -> int | None:
 # Welcome banner
 # =========================================================================
 
-
 def _format_context_length(tokens: int) -> str:
     """Format a token count for display (e.g. 128000 → '128K', 1048576 → '1M')."""
     if tokens >= 1_000_000:
@@ -186,16 +205,12 @@ def _format_context_length(tokens: int) -> str:
     return str(tokens)
 
 
-def build_welcome_banner(
-    console: Console,
-    model: str,
-    cwd: str,
-    tools: list[dict] = None,
-    enabled_toolsets: list[str] = None,
-    session_id: str = None,
-    get_toolset_for_tool=None,
-    context_length: int = None,
-):
+def build_welcome_banner(console: Console, model: str, cwd: str,
+                         tools: List[dict] = None,
+                         enabled_toolsets: List[str] = None,
+                         session_id: str = None,
+                         get_toolset_for_tool=None,
+                         context_length: int = None):
     """Build and print a welcome banner with caduceus on left and info on right.
 
     Args:
@@ -208,8 +223,7 @@ def build_welcome_banner(
         get_toolset_for_tool: Callable to map tool name -> toolset name.
         context_length: Model's context window size in tokens.
     """
-    from model_tools import check_tool_availability
-
+    from model_tools import check_tool_availability, TOOLSET_REQUIREMENTS
     if get_toolset_for_tool is None:
         from model_tools import get_toolset_for_tool
 
@@ -225,21 +239,25 @@ def build_welcome_banner(
     layout_table.add_column("left", justify="center")
     layout_table.add_column("right", justify="left")
 
+    # Resolve skin colors once for the entire banner
+    accent = _skin_color("banner_accent", "#FFBF00")
+    dim = _skin_color("banner_dim", "#B8860B")
+    text = _skin_color("banner_text", "#FFF8DC")
+    session_color = _skin_color("session_border", "#8B8682")
+
     left_lines = ["", HERMES_CADUCEUS, ""]
     model_short = model.split("/")[-1] if "/" in model else model
     if len(model_short) > 28:
         model_short = model_short[:25] + "..."
-    ctx_str = (
-        f" [dim #B8860B]·[/] [dim #B8860B]{_format_context_length(context_length)} context[/]" if context_length else ""
-    )
-    left_lines.append(f"[#FFBF00]{model_short}[/]{ctx_str} [dim #B8860B]·[/] [dim #B8860B]Nous Research[/]")
-    left_lines.append(f"[dim #B8860B]{cwd}[/]")
+    ctx_str = f" [dim {dim}]·[/] [dim {dim}]{_format_context_length(context_length)} context[/]" if context_length else ""
+    left_lines.append(f"[{accent}]{model_short}[/]{ctx_str} [dim {dim}]·[/] [dim {dim}]Nous Research[/]")
+    left_lines.append(f"[dim {dim}]{cwd}[/]")
     if session_id:
-        left_lines.append(f"[dim #8B8682]Session: {session_id}[/]")
+        left_lines.append(f"[dim {session_color}]Session: {session_id}[/]")
     left_content = "\n".join(left_lines)
 
-    right_lines = ["[bold #FFBF00]Available Tools[/]"]
-    toolsets_dict: dict[str, list] = {}
+    right_lines = [f"[bold {accent}]Available Tools[/]"]
+    toolsets_dict: Dict[str, list] = {}
 
     for tool in tools:
         tool_name = tool["function"]["name"]
@@ -266,7 +284,7 @@ def build_welcome_banner(
             if name in disabled_tools:
                 colored_names.append(f"[red]{name}[/]")
             else:
-                colored_names.append(f"[#FFF8DC]{name}[/]")
+                colored_names.append(f"[{text}]{name}[/]")
 
         tools_str = ", ".join(colored_names)
         if len(", ".join(sorted(tool_names))) > 45:
@@ -285,7 +303,7 @@ def build_welcome_banner(
                 elif name in disabled_tools:
                     colored_names.append(f"[red]{name}[/]")
                 else:
-                    colored_names.append(f"[#FFF8DC]{name}[/]")
+                    colored_names.append(f"[{text}]{name}[/]")
             tools_str = ", ".join(colored_names)
 
         right_lines.append(f"[dim #B8860B]{toolset}:[/] {tools_str}")
@@ -296,7 +314,6 @@ def build_welcome_banner(
     # MCP Servers section (only if configured)
     try:
         from tools.mcp_tool import get_mcp_status
-
         mcp_status = get_mcp_status()
     except Exception:
         mcp_status = []
@@ -311,10 +328,13 @@ def build_welcome_banner(
                     f"[dim #B8860B]—[/] [#FFF8DC]{srv['tools']} tool(s)[/]"
                 )
             else:
-                right_lines.append(f"[red]{srv['name']}[/] [dim]({srv['transport']})[/] [red]— failed[/]")
+                right_lines.append(
+                    f"[red]{srv['name']}[/] [dim]({srv['transport']})[/] "
+                    f"[red]— failed[/]"
+                )
 
     right_lines.append("")
-    right_lines.append("[bold #FFBF00]Available Skills[/]")
+    right_lines.append(f"[bold {accent}]Available Skills[/]")
     skills_by_category = get_available_skills()
     total_skills = sum(len(s) for s in skills_by_category.values())
 
@@ -328,9 +348,9 @@ def build_welcome_banner(
                 skills_str = ", ".join(skill_names)
             if len(skills_str) > 50:
                 skills_str = skills_str[:47] + "..."
-            right_lines.append(f"[dim #B8860B]{category}:[/] [#FFF8DC]{skills_str}[/]")
+            right_lines.append(f"[dim {dim}]{category}:[/] [{text}]{skills_str}[/]")
     else:
-        right_lines.append("[dim #B8860B]No skills installed[/]")
+        right_lines.append(f"[dim {dim}]No skills installed[/]")
 
     right_lines.append("")
     mcp_connected = sum(1 for s in mcp_status if s["connected"]) if mcp_status else 0
@@ -338,7 +358,7 @@ def build_welcome_banner(
     if mcp_connected:
         summary_parts.append(f"{mcp_connected} MCP servers")
     summary_parts.append("/help for commands")
-    right_lines.append(f"[dim #B8860B]{' · '.join(summary_parts)}[/]")
+    right_lines.append(f"[dim {dim}]{' · '.join(summary_parts)}[/]")
 
     # Update check — show if behind origin/main
     try:
@@ -355,10 +375,13 @@ def build_welcome_banner(
     right_content = "\n".join(right_lines)
     layout_table.add_row(left_content, right_content)
 
+    agent_name = _skin_branding("agent_name", "Hermes Agent")
+    title_color = _skin_color("banner_title", "#FFD700")
+    border_color = _skin_color("banner_border", "#CD7F32")
     outer_panel = Panel(
         layout_table,
-        title=f"[bold #FFD700]Hermes Agent {VERSION}[/]",
-        border_style="#CD7F32",
+        title=f"[bold {title_color}]{agent_name} v{VERSION} ({RELEASE_DATE})[/]",
+        border_style=border_color,
         padding=(0, 2),
     )
 

hermes_cli/callbacks.py

@@ -9,7 +9,7 @@ with the TUI.
 import queue
 import time as _time
 
-from hermes_cli.banner import _DIM, _RST, cprint
+from hermes_cli.banner import cprint, _DIM, _RST
 
 
 def clarify_callback(cli, question, choices):
@@ -33,7 +33,7 @@ def clarify_callback(cli, question, choices):
     cli._clarify_deadline = _time.monotonic() + timeout
     cli._clarify_freetext = is_open_ended
 
-    if hasattr(cli, "_app") and cli._app:
+    if hasattr(cli, '_app') and cli._app:
         cli._app.invalidate()
 
     while True:
@@ -45,13 +45,13 @@ def clarify_callback(cli, question, choices):
             remaining = cli._clarify_deadline - _time.monotonic()
             if remaining <= 0:
                 break
-            if hasattr(cli, "_app") and cli._app:
+            if hasattr(cli, '_app') and cli._app:
                 cli._app.invalidate()
 
     cli._clarify_state = None
     cli._clarify_freetext = False
     cli._clarify_deadline = 0
-    if hasattr(cli, "_app") and cli._app:
+    if hasattr(cli, '_app') and cli._app:
         cli._app.invalidate()
     cprint(f"\n{_DIM}(clarify timed out after {timeout}s — agent will decide){_RST}")
     return (
@@ -71,7 +71,7 @@ def sudo_password_callback(cli) -> str:
     cli._sudo_state = {"response_queue": response_queue}
     cli._sudo_deadline = _time.monotonic() + timeout
 
-    if hasattr(cli, "_app") and cli._app:
+    if hasattr(cli, '_app') and cli._app:
         cli._app.invalidate()
 
     while True:
@@ -79,7 +79,7 @@ def sudo_password_callback(cli) -> str:
             result = response_queue.get(timeout=1)
             cli._sudo_state = None
             cli._sudo_deadline = 0
-            if hasattr(cli, "_app") and cli._app:
+            if hasattr(cli, '_app') and cli._app:
                 cli._app.invalidate()
             if result:
                 cprint(f"\n{_DIM}  ✓ Password received (cached for session){_RST}")
@@ -90,12 +90,12 @@ def sudo_password_callback(cli) -> str:
             remaining = cli._sudo_deadline - _time.monotonic()
             if remaining <= 0:
                 break
-            if hasattr(cli, "_app") and cli._app:
+            if hasattr(cli, '_app') and cli._app:
                 cli._app.invalidate()
 
     cli._sudo_state = None
     cli._sudo_deadline = 0
-    if hasattr(cli, "_app") and cli._app:
+    if hasattr(cli, '_app') and cli._app:
         cli._app.invalidate()
     cprint(f"\n{_DIM}  ⏱ Timeout — continuing without sudo{_RST}")
     return ""
@@ -105,10 +105,14 @@ def approval_callback(cli, command: str, description: str) -> str:
     """Prompt for dangerous command approval through the TUI.
 
     Shows a selection UI with choices: once / session / always / deny.
+    When the command is longer than 70 characters, a "view" option is
+    included so the user can reveal the full text before deciding.
     """
     timeout = 60
     response_queue = queue.Queue()
     choices = ["once", "session", "always", "deny"]
+    if len(command) > 70:
+        choices.append("view")
 
     cli._approval_state = {
         "command": command,
@@ -119,7 +123,7 @@ def approval_callback(cli, command: str, description: str) -> str:
     }
     cli._approval_deadline = _time.monotonic() + timeout
 
-    if hasattr(cli, "_app") and cli._app:
+    if hasattr(cli, '_app') and cli._app:
         cli._app.invalidate()
 
     while True:
@@ -127,19 +131,19 @@ def approval_callback(cli, command: str, description: str) -> str:
             result = response_queue.get(timeout=1)
             cli._approval_state = None
             cli._approval_deadline = 0
-            if hasattr(cli, "_app") and cli._app:
+            if hasattr(cli, '_app') and cli._app:
                 cli._app.invalidate()
             return result
         except queue.Empty:
             remaining = cli._approval_deadline - _time.monotonic()
             if remaining <= 0:
                 break
-            if hasattr(cli, "_app") and cli._app:
+            if hasattr(cli, '_app') and cli._app:
                 cli._app.invalidate()
 
     cli._approval_state = None
     cli._approval_deadline = 0
-    if hasattr(cli, "_app") and cli._app:
+    if hasattr(cli, '_app') and cli._app:
         cli._app.invalidate()
     cprint(f"\n{_DIM}  ⏱ Timeout — denying command{_RST}")
     return "deny"

hermes_cli/checklist.py

@@ -0,0 +1,135 @@
+"""Shared curses-based multi-select checklist for Hermes CLI.
+
+Used by both ``hermes tools`` and ``hermes skills`` to present a
+toggleable list of items.  Falls back to a numbered text UI when
+curses is unavailable (Windows without curses, piped stdin, etc.).
+"""
+
+from typing import List, Set
+
+from hermes_cli.colors import Colors, color
+
+
+def curses_checklist(
+    title: str,
+    items: List[str],
+    pre_selected: Set[int],
+) -> Set[int]:
+    """Multi-select checklist.  Returns set of **selected** indices.
+
+    Args:
+        title: Header text shown at the top of the checklist.
+        items: Display labels for each row.
+        pre_selected: Indices that start checked.
+
+    Returns:
+        The indices the user confirmed as checked.  On cancel (ESC/q),
+        returns ``pre_selected`` unchanged.
+    """
+    try:
+        import curses
+        selected = set(pre_selected)
+        result = [None]
+
+        def _ui(stdscr):
+            curses.curs_set(0)
+            if curses.has_colors():
+                curses.start_color()
+                curses.use_default_colors()
+                curses.init_pair(1, curses.COLOR_GREEN, -1)
+                curses.init_pair(2, curses.COLOR_YELLOW, -1)
+                curses.init_pair(3, 8, -1)  # dim gray
+            cursor = 0
+            scroll_offset = 0
+
+            while True:
+                stdscr.clear()
+                max_y, max_x = stdscr.getmaxyx()
+
+                # Header
+                try:
+                    hattr = curses.A_BOLD | (curses.color_pair(2) if curses.has_colors() else 0)
+                    stdscr.addnstr(0, 0, title, max_x - 1, hattr)
+                    stdscr.addnstr(
+                        1, 0,
+                        "  ↑↓ navigate  SPACE toggle  ENTER confirm  ESC cancel",
+                        max_x - 1, curses.A_DIM,
+                    )
+                except curses.error:
+                    pass
+
+                # Scrollable item list
+                visible_rows = max_y - 3
+                if cursor < scroll_offset:
+                    scroll_offset = cursor
+                elif cursor >= scroll_offset + visible_rows:
+                    scroll_offset = cursor - visible_rows + 1
+
+                for draw_i, i in enumerate(
+                    range(scroll_offset, min(len(items), scroll_offset + visible_rows))
+                ):
+                    y = draw_i + 3
+                    if y >= max_y - 1:
+                        break
+                    check = "✓" if i in selected else " "
+                    arrow = "→" if i == cursor else " "
+                    line = f" {arrow} [{check}] {items[i]}"
+
+                    attr = curses.A_NORMAL
+                    if i == cursor:
+                        attr = curses.A_BOLD
+                        if curses.has_colors():
+                            attr |= curses.color_pair(1)
+                    try:
+                        stdscr.addnstr(y, 0, line, max_x - 1, attr)
+                    except curses.error:
+                        pass
+
+                stdscr.refresh()
+                key = stdscr.getch()
+
+                if key in (curses.KEY_UP, ord("k")):
+                    cursor = (cursor - 1) % len(items)
+                elif key in (curses.KEY_DOWN, ord("j")):
+                    cursor = (cursor + 1) % len(items)
+                elif key == ord(" "):
+                    selected.symmetric_difference_update({cursor})
+                elif key in (curses.KEY_ENTER, 10, 13):
+                    result[0] = set(selected)
+                    return
+                elif key in (27, ord("q")):
+                    result[0] = set(pre_selected)
+                    return
+
+        curses.wrapper(_ui)
+        return result[0] if result[0] is not None else set(pre_selected)
+
+    except Exception:
+        pass  # fall through to numbered fallback
+
+    # ── Numbered text fallback ────────────────────────────────────────────
+    selected = set(pre_selected)
+    print(color(f"\n  {title}", Colors.YELLOW))
+    print(color("  Toggle by number, Enter to confirm.\n", Colors.DIM))
+
+    while True:
+        for i, label in enumerate(items):
+            check = "✓" if i in selected else " "
+            print(f"    {i + 1:3}. [{check}] {label}")
+        print()
+
+        try:
+            raw = input(color("  Number to toggle, 's' to save, 'q' to cancel: ", Colors.DIM)).strip()
+        except (KeyboardInterrupt, EOFError):
+            return set(pre_selected)
+
+        if raw.lower() == "s" or raw == "":
+            return selected
+        if raw.lower() == "q":
+            return set(pre_selected)
+        try:
+            idx = int(raw) - 1
+            if 0 <= idx < len(items):
+                selected.symmetric_difference_update({idx})
+        except ValueError:
+            print(color("  Invalid input", Colors.DIM))

hermes_cli/claw.py

@@ -0,0 +1,296 @@
+"""hermes claw — OpenClaw migration commands.
+
+Usage:
+    hermes claw migrate              # Interactive migration from ~/.openclaw
+    hermes claw migrate --dry-run    # Preview what would be migrated
+    hermes claw migrate --preset full --overwrite  # Full migration, overwrite conflicts
+"""
+
+import importlib.util
+import logging
+import sys
+from pathlib import Path
+
+from hermes_cli.config import get_hermes_home, get_config_path, load_config, save_config
+from hermes_cli.setup import (
+    Colors,
+    color,
+    print_header,
+    print_info,
+    print_success,
+    print_warning,
+    print_error,
+    prompt_yes_no,
+    prompt_choice,
+)
+
+logger = logging.getLogger(__name__)
+
+PROJECT_ROOT = Path(__file__).parent.parent.resolve()
+
+_OPENCLAW_SCRIPT = (
+    PROJECT_ROOT
+    / "optional-skills"
+    / "migration"
+    / "openclaw-migration"
+    / "scripts"
+    / "openclaw_to_hermes.py"
+)
+
+# Fallback: user may have installed the skill from the Hub
+_OPENCLAW_SCRIPT_INSTALLED = (
+    get_hermes_home()
+    / "skills"
+    / "migration"
+    / "openclaw-migration"
+    / "scripts"
+    / "openclaw_to_hermes.py"
+)
+
+
+def _find_migration_script() -> Path | None:
+    """Find the openclaw_to_hermes.py script in known locations."""
+    for candidate in [_OPENCLAW_SCRIPT, _OPENCLAW_SCRIPT_INSTALLED]:
+        if candidate.exists():
+            return candidate
+    return None
+
+
+def _load_migration_module(script_path: Path):
+    """Dynamically load the migration script as a module."""
+    spec = importlib.util.spec_from_file_location("openclaw_to_hermes", script_path)
+    if spec is None or spec.loader is None:
+        return None
+    mod = importlib.util.module_from_spec(spec)
+    # Register in sys.modules so @dataclass can resolve the module
+    # (Python 3.11+ requires this for dynamically loaded modules)
+    sys.modules[spec.name] = mod
+    try:
+        spec.loader.exec_module(mod)
+    except Exception:
+        sys.modules.pop(spec.name, None)
+        raise
+    return mod
+
+
+def claw_command(args):
+    """Route hermes claw subcommands."""
+    action = getattr(args, "claw_action", None)
+
+    if action == "migrate":
+        _cmd_migrate(args)
+    else:
+        print("Usage: hermes claw migrate [options]")
+        print()
+        print("Commands:")
+        print("  migrate          Migrate settings from OpenClaw to Hermes")
+        print()
+        print("Run 'hermes claw migrate --help' for migration options.")
+
+
+def _cmd_migrate(args):
+    """Run the OpenClaw → Hermes migration."""
+    source_dir = Path(getattr(args, "source", None) or Path.home() / ".openclaw")
+    dry_run = getattr(args, "dry_run", False)
+    preset = getattr(args, "preset", "full")
+    overwrite = getattr(args, "overwrite", False)
+    migrate_secrets = getattr(args, "migrate_secrets", False)
+    workspace_target = getattr(args, "workspace_target", None)
+    skill_conflict = getattr(args, "skill_conflict", "skip")
+
+    # If using the "full" preset, secrets are included by default
+    if preset == "full":
+        migrate_secrets = True
+
+    print()
+    print(
+        color(
+            "┌─────────────────────────────────────────────────────────┐",
+            Colors.MAGENTA,
+        )
+    )
+    print(
+        color(
+            "│          ⚕ Hermes — OpenClaw Migration                 │",
+            Colors.MAGENTA,
+        )
+    )
+    print(
+        color(
+            "└─────────────────────────────────────────────────────────┘",
+            Colors.MAGENTA,
+        )
+    )
+
+    # Check source directory
+    if not source_dir.is_dir():
+        print()
+        print_error(f"OpenClaw directory not found: {source_dir}")
+        print_info("Make sure your OpenClaw installation is at the expected path.")
+        print_info(f"You can specify a custom path: hermes claw migrate --source /path/to/.openclaw")
+        return
+
+    # Find the migration script
+    script_path = _find_migration_script()
+    if not script_path:
+        print()
+        print_error("Migration script not found.")
+        print_info("Expected at one of:")
+        print_info(f"  {_OPENCLAW_SCRIPT}")
+        print_info(f"  {_OPENCLAW_SCRIPT_INSTALLED}")
+        print_info("Make sure the openclaw-migration skill is installed.")
+        return
+
+    # Show what we're doing
+    hermes_home = get_hermes_home()
+    print()
+    print_header("Migration Settings")
+    print_info(f"Source:      {source_dir}")
+    print_info(f"Target:      {hermes_home}")
+    print_info(f"Preset:      {preset}")
+    print_info(f"Mode:        {'dry run (preview only)' if dry_run else 'execute'}")
+    print_info(f"Overwrite:   {'yes' if overwrite else 'no (skip conflicts)'}")
+    print_info(f"Secrets:     {'yes (allowlisted only)' if migrate_secrets else 'no'}")
+    if skill_conflict != "skip":
+        print_info(f"Skill conflicts: {skill_conflict}")
+    if workspace_target:
+        print_info(f"Workspace:   {workspace_target}")
+    print()
+
+    # For execute mode (non-dry-run), confirm unless --yes was passed
+    if not dry_run and not getattr(args, "yes", False):
+        if not prompt_yes_no("Proceed with migration?", default=True):
+            print_info("Migration cancelled.")
+            return
+
+    # Ensure config.yaml exists before migration tries to read it
+    config_path = get_config_path()
+    if not config_path.exists():
+        save_config(load_config())
+
+    # Load and run the migration
+    try:
+        mod = _load_migration_module(script_path)
+        if mod is None:
+            print_error("Could not load migration script.")
+            return
+
+        selected = mod.resolve_selected_options(None, None, preset=preset)
+        ws_target = Path(workspace_target).resolve() if workspace_target else None
+
+        migrator = mod.Migrator(
+            source_root=source_dir.resolve(),
+            target_root=hermes_home.resolve(),
+            execute=not dry_run,
+            workspace_target=ws_target,
+            overwrite=overwrite,
+            migrate_secrets=migrate_secrets,
+            output_dir=None,
+            selected_options=selected,
+            preset_name=preset,
+            skill_conflict_mode=skill_conflict,
+        )
+        report = migrator.migrate()
+    except Exception as e:
+        print()
+        print_error(f"Migration failed: {e}")
+        logger.debug("OpenClaw migration error", exc_info=True)
+        return
+
+    # Print results
+    _print_migration_report(report, dry_run)
+
+
+def _print_migration_report(report: dict, dry_run: bool):
+    """Print a formatted migration report."""
+    summary = report.get("summary", {})
+    migrated = summary.get("migrated", 0)
+    skipped = summary.get("skipped", 0)
+    conflicts = summary.get("conflict", 0)
+    errors = summary.get("error", 0)
+    total = migrated + skipped + conflicts + errors
+
+    print()
+    if dry_run:
+        print_header("Dry Run Results")
+        print_info("No files were modified. This is a preview of what would happen.")
+    else:
+        print_header("Migration Results")
+
+    print()
+
+    # Detailed items
+    items = report.get("items", [])
+    if items:
+        # Group by status
+        migrated_items = [i for i in items if i.get("status") == "migrated"]
+        skipped_items = [i for i in items if i.get("status") == "skipped"]
+        conflict_items = [i for i in items if i.get("status") == "conflict"]
+        error_items = [i for i in items if i.get("status") == "error"]
+
+        if migrated_items:
+            label = "Would migrate" if dry_run else "Migrated"
+            print(color(f"  ✓ {label}:", Colors.GREEN))
+            for item in migrated_items:
+                kind = item.get("kind", "unknown")
+                dest = item.get("destination", "")
+                if dest:
+                    dest_short = str(dest).replace(str(Path.home()), "~")
+                    print(f"      {kind:<22s} → {dest_short}")
+                else:
+                    print(f"      {kind}")
+            print()
+
+        if conflict_items:
+            print(color(f"  ⚠ Conflicts (skipped — use --overwrite to force):", Colors.YELLOW))
+            for item in conflict_items:
+                kind = item.get("kind", "unknown")
+                reason = item.get("reason", "already exists")
+                print(f"      {kind:<22s}  {reason}")
+            print()
+
+        if skipped_items:
+            print(color(f"  ─ Skipped:", Colors.DIM))
+            for item in skipped_items:
+                kind = item.get("kind", "unknown")
+                reason = item.get("reason", "")
+                print(f"      {kind:<22s}  {reason}")
+            print()
+
+        if error_items:
+            print(color(f"  ✗ Errors:", Colors.RED))
+            for item in error_items:
+                kind = item.get("kind", "unknown")
+                reason = item.get("reason", "unknown error")
+                print(f"      {kind:<22s}  {reason}")
+            print()
+
+    # Summary line
+    parts = []
+    if migrated:
+        action = "would migrate" if dry_run else "migrated"
+        parts.append(f"{migrated} {action}")
+    if conflicts:
+        parts.append(f"{conflicts} conflict(s)")
+    if skipped:
+        parts.append(f"{skipped} skipped")
+    if errors:
+        parts.append(f"{errors} error(s)")
+
+    if parts:
+        print_info(f"Summary: {', '.join(parts)}")
+    else:
+        print_info("Nothing to migrate.")
+
+    # Output directory
+    output_dir = report.get("output_dir")
+    if output_dir:
+        print_info(f"Full report saved to: {output_dir}")
+
+    if dry_run:
+        print()
+        print_info("To execute the migration, run without --dry-run:")
+        print_info(f"  hermes claw migrate --preset {report.get('preset', 'full')}")
+    elif migrated:
+        print()
+        print_success("Migration complete!")

hermes_cli/clipboard.py

@@ -51,7 +51,6 @@ def has_clipboard_image() -> bool:
 
 # ── macOS ────────────────────────────────────────────────────────────────
 
-
 def _macos_save(dest: Path) -> bool:
     """Try pngpaste first (fast, handles more formats), fall back to osascript."""
     return _macos_pngpaste(dest) or _macos_osascript(dest)
@@ -62,9 +61,7 @@ def _macos_has_image() -> bool:
     try:
         info = subprocess.run(
             ["osascript", "-e", "clipboard info"],
-            capture_output=True,
-            text=True,
-            timeout=3,
+            capture_output=True, text=True, timeout=3,
         )
         return "«class PNGf»" in info.stdout or "«class TIFF»" in info.stdout
     except Exception:
@@ -76,8 +73,7 @@ def _macos_pngpaste(dest: Path) -> bool:
     try:
         r = subprocess.run(
             ["pngpaste", str(dest)],
-            capture_output=True,
-            timeout=3,
+            capture_output=True, timeout=3,
         )
         if r.returncode == 0 and dest.exists() and dest.stat().st_size > 0:
             return True
@@ -95,21 +91,19 @@ def _macos_osascript(dest: Path) -> bool:
 
     # Extract as PNG
     script = (
-        "try\n"
-        "  set imgData to the clipboard as «class PNGf»\n"
+        'try\n'
+        '  set imgData to the clipboard as «class PNGf»\n'
         f'  set f to open for access POSIX file "{dest}" with write permission\n'
-        "  write imgData to f\n"
-        "  close access f\n"
-        "on error\n"
+        '  write imgData to f\n'
+        '  close access f\n'
+        'on error\n'
         '  return "fail"\n'
-        "end try\n"
+        'end try\n'
     )
     try:
         r = subprocess.run(
             ["osascript", "-e", script],
-            capture_output=True,
-            text=True,
-            timeout=5,
+            capture_output=True, text=True, timeout=5,
         )
         if r.returncode == 0 and "fail" not in r.stdout and dest.exists() and dest.stat().st_size > 0:
             return True
@@ -120,14 +114,13 @@ def _macos_osascript(dest: Path) -> bool:
 
 # ── Linux ────────────────────────────────────────────────────────────────
 
-
 def _is_wsl() -> bool:
     """Detect if running inside WSL (1 or 2)."""
     global _wsl_detected
     if _wsl_detected is not None:
         return _wsl_detected
     try:
-        with open("/proc/version") as f:
+        with open("/proc/version", "r") as f:
             _wsl_detected = "microsoft" in f.read().lower()
     except Exception:
         _wsl_detected = False
@@ -152,7 +145,10 @@ def _linux_save(dest: Path) -> bool:
 
 # PowerShell script: get clipboard image as base64-encoded PNG on stdout.
 # Using .NET System.Windows.Forms.Clipboard — always available on Windows.
-_PS_CHECK_IMAGE = "Add-Type -AssemblyName System.Windows.Forms;[System.Windows.Forms.Clipboard]::ContainsImage()"
+_PS_CHECK_IMAGE = (
+    "Add-Type -AssemblyName System.Windows.Forms;"
+    "[System.Windows.Forms.Clipboard]::ContainsImage()"
+)
 
 _PS_EXTRACT_IMAGE = (
     "Add-Type -AssemblyName System.Windows.Forms;"
@@ -169,10 +165,9 @@ def _wsl_has_image() -> bool:
     """Check if Windows clipboard has an image (via powershell.exe)."""
     try:
         r = subprocess.run(
-            ["powershell.exe", "-NoProfile", "-NonInteractive", "-Command", _PS_CHECK_IMAGE],
-            capture_output=True,
-            text=True,
-            timeout=8,
+            ["powershell.exe", "-NoProfile", "-NonInteractive", "-Command",
+             _PS_CHECK_IMAGE],
+            capture_output=True, text=True, timeout=8,
         )
         return r.returncode == 0 and "True" in r.stdout
     except FileNotFoundError:
@@ -186,10 +181,9 @@ def _wsl_save(dest: Path) -> bool:
     """Extract clipboard image via powershell.exe → base64 → decode to PNG."""
     try:
         r = subprocess.run(
-            ["powershell.exe", "-NoProfile", "-NonInteractive", "-Command", _PS_EXTRACT_IMAGE],
-            capture_output=True,
-            text=True,
-            timeout=15,
+            ["powershell.exe", "-NoProfile", "-NonInteractive", "-Command",
+             _PS_EXTRACT_IMAGE],
+            capture_output=True, text=True, timeout=15,
         )
         if r.returncode != 0:
             return False
@@ -212,17 +206,16 @@ def _wsl_save(dest: Path) -> bool:
 
 # ── Wayland (wl-paste) ──────────────────────────────────────────────────
 
-
 def _wayland_has_image() -> bool:
     """Check if Wayland clipboard has image content."""
     try:
         r = subprocess.run(
             ["wl-paste", "--list-types"],
-            capture_output=True,
-            text=True,
-            timeout=3,
+            capture_output=True, text=True, timeout=3,
+        )
+        return r.returncode == 0 and any(
+            t.startswith("image/") for t in r.stdout.splitlines()
         )
-        return r.returncode == 0 and any(t.startswith("image/") for t in r.stdout.splitlines())
     except FileNotFoundError:
         logger.debug("wl-paste not installed — Wayland clipboard unavailable")
     except Exception:
@@ -236,9 +229,7 @@ def _wayland_save(dest: Path) -> bool:
         # Check available MIME types
         types_r = subprocess.run(
             ["wl-paste", "--list-types"],
-            capture_output=True,
-            text=True,
-            timeout=3,
+            capture_output=True, text=True, timeout=3,
         )
         if types_r.returncode != 0:
             return False
@@ -246,7 +237,8 @@ def _wayland_save(dest: Path) -> bool:
 
         # Prefer PNG, fall back to other image formats
         mime = None
-        for preferred in ("image/png", "image/jpeg", "image/bmp", "image/gif", "image/webp"):
+        for preferred in ("image/png", "image/jpeg", "image/bmp",
+                          "image/gif", "image/webp"):
             if preferred in types:
                 mime = preferred
                 break
@@ -258,13 +250,11 @@ def _wayland_save(dest: Path) -> bool:
         with open(dest, "wb") as f:
             subprocess.run(
                 ["wl-paste", "--type", mime],
-                stdout=f,
-                stderr=subprocess.DEVNULL,
-                timeout=5,
-                check=True,
+                stdout=f, stderr=subprocess.DEVNULL, timeout=5, check=True,
             )
 
         if not dest.exists() or dest.stat().st_size == 0:
+            dest.unlink(missing_ok=True)
             return False
 
         # BMP needs conversion to PNG (common in WSLg where only BMP
@@ -287,7 +277,6 @@ def _convert_to_png(path: Path) -> bool:
     # Try Pillow first (likely installed in the venv)
     try:
         from PIL import Image
-
         img = Image.open(path)
         img.save(path, "PNG")
         return True
@@ -302,12 +291,14 @@ def _convert_to_png(path: Path) -> bool:
         path.rename(tmp)
         r = subprocess.run(
             ["convert", str(tmp), "png:" + str(path)],
-            capture_output=True,
-            timeout=5,
+            capture_output=True, timeout=5,
         )
-        tmp.unlink(missing_ok=True)
         if r.returncode == 0 and path.exists() and path.stat().st_size > 0:
+            tmp.unlink(missing_ok=True)
             return True
+        else:
+            # Convert failed — restore the original file
+            tmp.rename(path)
     except FileNotFoundError:
         logger.debug("ImageMagick not installed — cannot convert BMP to PNG")
         if tmp.exists() and not path.exists():
@@ -323,15 +314,12 @@ def _convert_to_png(path: Path) -> bool:
 
 # ── X11 (xclip) ─────────────────────────────────────────────────────────
 
-
 def _xclip_has_image() -> bool:
     """Check if X11 clipboard has image content."""
     try:
         r = subprocess.run(
             ["xclip", "-selection", "clipboard", "-t", "TARGETS", "-o"],
-            capture_output=True,
-            text=True,
-            timeout=3,
+            capture_output=True, text=True, timeout=3,
         )
         return r.returncode == 0 and "image/png" in r.stdout
     except FileNotFoundError:
@@ -347,9 +335,7 @@ def _xclip_save(dest: Path) -> bool:
     try:
         targets = subprocess.run(
             ["xclip", "-selection", "clipboard", "-t", "TARGETS", "-o"],
-            capture_output=True,
-            text=True,
-            timeout=3,
+            capture_output=True, text=True, timeout=3,
         )
         if "image/png" not in targets.stdout:
             return False
@@ -364,10 +350,7 @@ def _xclip_save(dest: Path) -> bool:
         with open(dest, "wb") as f:
             subprocess.run(
                 ["xclip", "-selection", "clipboard", "-t", "image/png", "-o"],
-                stdout=f,
-                stderr=subprocess.DEVNULL,
-                timeout=5,
-                check=True,
+                stdout=f, stderr=subprocess.DEVNULL, timeout=5, check=True,
             )
         if dest.exists() and dest.stat().st_size > 0:
             return True

hermes_cli/codex_models.py

@@ -4,12 +4,14 @@ from __future__ import annotations
 
 import json
 import logging
-import os
 from pathlib import Path
+from typing import List, Optional
+
+import os
 
 logger = logging.getLogger(__name__)
 
-DEFAULT_CODEX_MODELS: list[str] = [
+DEFAULT_CODEX_MODELS: List[str] = [
     "gpt-5.3-codex",
     "gpt-5.2-codex",
     "gpt-5.1-codex-max",
@@ -17,11 +19,10 @@ DEFAULT_CODEX_MODELS: list[str] = [
 ]
 
 
-def _fetch_models_from_api(access_token: str) -> list[str]:
+def _fetch_models_from_api(access_token: str) -> List[str]:
     """Fetch available models from the Codex API. Returns visible models sorted by priority."""
     try:
         import httpx
-
         resp = httpx.get(
             "https://chatgpt.com/backend-api/codex/models?client_version=1.0.0",
             headers={"Authorization": f"Bearer {access_token}"},
@@ -46,7 +47,7 @@ def _fetch_models_from_api(access_token: str) -> list[str]:
         if item.get("supported_in_api") is False:
             continue
         visibility = item.get("visibility", "")
-        if isinstance(visibility, str) and visibility.strip().lower() == "hidden":
+        if isinstance(visibility, str) and visibility.strip().lower() in ("hide", "hidden"):
             continue
         priority = item.get("priority")
         rank = int(priority) if isinstance(priority, (int, float)) else 10_000
@@ -56,7 +57,7 @@ def _fetch_models_from_api(access_token: str) -> list[str]:
     return [slug for _, slug in sortable]
 
 
-def _read_default_model(codex_home: Path) -> str | None:
+def _read_default_model(codex_home: Path) -> Optional[str]:
     config_path = codex_home / "config.toml"
     if not config_path.exists():
         return None
@@ -74,7 +75,7 @@ def _read_default_model(codex_home: Path) -> str | None:
     return None
 
 
-def _read_cache_models(codex_home: Path) -> list[str]:
+def _read_cache_models(codex_home: Path) -> List[str]:
     cache_path = codex_home / "models_cache.json"
     if not cache_path.exists():
         return []
@@ -96,29 +97,29 @@ def _read_cache_models(codex_home: Path) -> list[str]:
             if item.get("supported_in_api") is False:
                 continue
             visibility = item.get("visibility")
-            if isinstance(visibility, str) and visibility.strip().lower() == "hidden":
+            if isinstance(visibility, str) and visibility.strip().lower() in ("hide", "hidden"):
                 continue
             priority = item.get("priority")
             rank = int(priority) if isinstance(priority, (int, float)) else 10_000
             sortable.append((rank, slug))
 
     sortable.sort(key=lambda item: (item[0], item[1]))
-    deduped: list[str] = []
+    deduped: List[str] = []
     for _, slug in sortable:
         if slug not in deduped:
             deduped.append(slug)
     return deduped
 
 
-def get_codex_model_ids(access_token: str | None = None) -> list[str]:
+def get_codex_model_ids(access_token: Optional[str] = None) -> List[str]:
     """Return available Codex model IDs, trying API first, then local sources.
-
+    
     Resolution order: API (live, if token provided) > config.toml default >
     local cache > hardcoded defaults.
     """
     codex_home_str = os.getenv("CODEX_HOME", "").strip() or str(Path.home() / ".codex")
     codex_home = Path(codex_home_str).expanduser()
-    ordered: list[str] = []
+    ordered: List[str] = []
 
     # Try live API if we have a token
     if access_token:

hermes_cli/commands.py

@@ -12,35 +12,56 @@ from typing import Any
 
 from prompt_toolkit.completion import Completer, Completion
 
-COMMANDS = {
-    "/help": "Show this help message",
-    "/tools": "List available tools",
-    "/toolsets": "List available toolsets",
-    "/model": "Show or change the current model",
-    "/provider": "Show available providers and current provider",
-    "/prompt": "View/set custom system prompt",
-    "/personality": "Set a predefined personality",
-    "/clear": "Clear screen and reset conversation (fresh start)",
-    "/history": "Show conversation history",
-    "/new": "Start a new conversation (reset history)",
-    "/reset": "Reset conversation only (keep screen)",
-    "/retry": "Retry the last message (resend to agent)",
-    "/undo": "Remove the last user/assistant exchange",
-    "/save": "Save the current conversation",
-    "/config": "Show current configuration",
-    "/cron": "Manage scheduled tasks (list, add, remove)",
-    "/skills": "Search, install, inspect, or manage skills from online registries",
-    "/platforms": "Show gateway/messaging platform status",
-    "/verbose": "Cycle tool progress display: off → new → all → verbose",
-    "/compress": "Manually compress conversation context (flush memories + summarize)",
-    "/title": "Set a title for the current session (usage: /title My Session Name)",
-    "/usage": "Show token usage for the current session",
-    "/insights": "Show usage insights and analytics (last 30 days)",
-    "/paste": "Check clipboard for an image and attach it",
-    "/reload-mcp": "Reload MCP servers from config.yaml",
-    "/quit": "Exit the CLI (also: /exit, /q)",
+
+# Commands organized by category for better help display
+COMMANDS_BY_CATEGORY = {
+    "Session": {
+        "/new": "Start a new conversation (reset history)",
+        "/reset": "Reset conversation only (keep screen)",
+        "/clear": "Clear screen and reset conversation (fresh start)",
+        "/history": "Show conversation history",
+        "/save": "Save the current conversation",
+        "/retry": "Retry the last message (resend to agent)",
+        "/undo": "Remove the last user/assistant exchange",
+        "/title": "Set a title for the current session (usage: /title My Session Name)",
+        "/compress": "Manually compress conversation context (flush memories + summarize)",
+        "/rollback": "List or restore filesystem checkpoints (usage: /rollback [number])",
+        "/background": "Run a prompt in the background (usage: /background <prompt>)",
+    },
+    "Configuration": {
+        "/config": "Show current configuration",
+        "/model": "Show or change the current model",
+        "/provider": "Show available providers and current provider",
+        "/prompt": "View/set custom system prompt",
+        "/personality": "Set a predefined personality",
+        "/verbose": "Cycle tool progress display: off → new → all → verbose",
+        "/reasoning": "Manage reasoning effort and display (usage: /reasoning [level|show|hide])",
+        "/skin": "Show or change the display skin/theme",
+    },
+    "Tools & Skills": {
+        "/tools": "List available tools",
+        "/toolsets": "List available toolsets",
+        "/skills": "Search, install, inspect, or manage skills from online registries",
+        "/cron": "Manage scheduled tasks (list, add, remove)",
+        "/reload-mcp": "Reload MCP servers from config.yaml",
+    },
+    "Info": {
+        "/help": "Show this help message",
+        "/usage": "Show token usage for the current session",
+        "/insights": "Show usage insights and analytics (last 30 days)",
+        "/platforms": "Show gateway/messaging platform status",
+        "/paste": "Check clipboard for an image and attach it",
+    },
+    "Exit": {
+        "/quit": "Exit the CLI (also: /exit, /q)",
+    },
 }
 
+# Flat dict for backwards compatibility and autocomplete
+COMMANDS = {}
+for category_commands in COMMANDS_BY_CATEGORY.values():
+    COMMANDS.update(category_commands)
+
 
 class SlashCommandCompleter(Completer):
     """Autocomplete for built-in slash commands and optional skill commands."""

hermes_cli/cron.py

@@ -20,46 +20,46 @@ from hermes_cli.colors import Colors, color
 def cron_list(show_all: bool = False):
     """List all scheduled jobs."""
     from cron.jobs import list_jobs
-
+    
     jobs = list_jobs(include_disabled=show_all)
-
+    
     if not jobs:
         print(color("No scheduled jobs.", Colors.DIM))
         print(color("Create one with the /cron add command in chat, or via Telegram.", Colors.DIM))
         return
-
+    
     print()
     print(color("┌─────────────────────────────────────────────────────────────────────────┐", Colors.CYAN))
     print(color("│                         Scheduled Jobs                                  │", Colors.CYAN))
     print(color("└─────────────────────────────────────────────────────────────────────────┘", Colors.CYAN))
     print()
-
+    
     for job in jobs:
         job_id = job.get("id", "?")[:8]
         name = job.get("name", "(unnamed)")
         schedule = job.get("schedule_display", job.get("schedule", {}).get("value", "?"))
         enabled = job.get("enabled", True)
         next_run = job.get("next_run_at", "?")
-
+        
         repeat_info = job.get("repeat", {})
         repeat_times = repeat_info.get("times")
         repeat_completed = repeat_info.get("completed", 0)
-
+        
         if repeat_times:
             repeat_str = f"{repeat_completed}/{repeat_times}"
         else:
             repeat_str = "∞"
-
+        
         deliver = job.get("deliver", ["local"])
         if isinstance(deliver, str):
             deliver = [deliver]
         deliver_str = ", ".join(deliver)
-
+        
         if not enabled:
             status = color("[disabled]", Colors.RED)
         else:
             status = color("[active]", Colors.GREEN)
-
+        
         print(f"  {color(job_id, Colors.YELLOW)} {status}")
         print(f"    Name:      {name}")
         print(f"    Schedule:  {schedule}")
@@ -67,10 +67,9 @@ def cron_list(show_all: bool = False):
         print(f"    Next run:  {next_run}")
         print(f"    Deliver:   {deliver_str}")
         print()
-
+    
     # Warn if gateway isn't running
     from hermes_cli.gateway import find_gateway_pids
-
     if not find_gateway_pids():
         print(color("  ⚠  Gateway is not running — jobs won't fire automatically.", Colors.YELLOW))
         print(color("     Start it with: hermes gateway install", Colors.DIM))
@@ -80,7 +79,6 @@ def cron_list(show_all: bool = False):
 def cron_tick():
     """Run due jobs once and exit."""
     from cron.scheduler import tick
-
     tick(verbose=True)
 
 
@@ -88,9 +86,9 @@ def cron_status():
     """Show cron execution status."""
     from cron.jobs import list_jobs
     from hermes_cli.gateway import find_gateway_pids
-
+    
     print()
-
+    
     pids = find_gateway_pids()
     if pids:
         print(color("✓ Gateway is running — cron jobs will fire automatically", Colors.GREEN))
@@ -101,9 +99,9 @@ def cron_status():
         print("  To enable automatic execution:")
         print("    hermes gateway install    # Install as system service (recommended)")
         print("    hermes gateway            # Or run in foreground")
-
+    
     print()
-
+    
     jobs = list_jobs(include_disabled=False)
     if jobs:
         next_runs = [j.get("next_run_at") for j in jobs if j.get("next_run_at")]
@@ -112,24 +110,24 @@ def cron_status():
             print(f"  Next run: {min(next_runs)}")
     else:
         print("  No active jobs")
-
+    
     print()
 
 
 def cron_command(args):
     """Handle cron subcommands."""
-    subcmd = getattr(args, "cron_command", None)
-
+    subcmd = getattr(args, 'cron_command', None)
+    
     if subcmd is None or subcmd == "list":
-        show_all = getattr(args, "all", False)
+        show_all = getattr(args, 'all', False)
         cron_list(show_all)
-
+    
     elif subcmd == "tick":
         cron_tick()
-
+    
     elif subcmd == "status":
         cron_status()
-
+    
     else:
         print(f"Unknown cron command: {subcmd}")
         print("Usage: hermes cron [list|status|tick]")

hermes_cli/curses_ui.py

@@ -0,0 +1,140 @@
+"""Shared curses-based UI components for Hermes CLI.
+
+Used by `hermes tools` and `hermes skills` for interactive checklists.
+Provides a curses multi-select with keyboard navigation, plus a
+text-based numbered fallback for terminals without curses support.
+"""
+from typing import List, Set
+
+from hermes_cli.colors import Colors, color
+
+
+def curses_checklist(
+    title: str,
+    items: List[str],
+    selected: Set[int],
+    *,
+    cancel_returns: Set[int] | None = None,
+) -> Set[int]:
+    """Curses multi-select checklist. Returns set of selected indices.
+
+    Args:
+        title: Header line displayed above the checklist.
+        items: Display labels for each row.
+        selected: Indices that start checked (pre-selected).
+        cancel_returns: Returned on ESC/q. Defaults to the original *selected*.
+    """
+    if cancel_returns is None:
+        cancel_returns = set(selected)
+
+    try:
+        import curses
+        chosen = set(selected)
+        result_holder: list = [None]
+
+        def _draw(stdscr):
+            curses.curs_set(0)
+            if curses.has_colors():
+                curses.start_color()
+                curses.use_default_colors()
+                curses.init_pair(1, curses.COLOR_GREEN, -1)
+                curses.init_pair(2, curses.COLOR_YELLOW, -1)
+                curses.init_pair(3, 8, -1)  # dim gray
+            cursor = 0
+            scroll_offset = 0
+
+            while True:
+                stdscr.clear()
+                max_y, max_x = stdscr.getmaxyx()
+
+                # Header
+                try:
+                    hattr = curses.A_BOLD
+                    if curses.has_colors():
+                        hattr |= curses.color_pair(2)
+                    stdscr.addnstr(0, 0, title, max_x - 1, hattr)
+                    stdscr.addnstr(
+                        1, 0,
+                        "  ↑↓ navigate  SPACE toggle  ENTER confirm  ESC cancel",
+                        max_x - 1, curses.A_DIM,
+                    )
+                except curses.error:
+                    pass
+
+                # Scrollable item list
+                visible_rows = max_y - 3
+                if cursor < scroll_offset:
+                    scroll_offset = cursor
+                elif cursor >= scroll_offset + visible_rows:
+                    scroll_offset = cursor - visible_rows + 1
+
+                for draw_i, i in enumerate(
+                    range(scroll_offset, min(len(items), scroll_offset + visible_rows))
+                ):
+                    y = draw_i + 3
+                    if y >= max_y - 1:
+                        break
+                    check = "✓" if i in chosen else " "
+                    arrow = "→" if i == cursor else " "
+                    line = f" {arrow} [{check}] {items[i]}"
+                    attr = curses.A_NORMAL
+                    if i == cursor:
+                        attr = curses.A_BOLD
+                        if curses.has_colors():
+                            attr |= curses.color_pair(1)
+                    try:
+                        stdscr.addnstr(y, 0, line, max_x - 1, attr)
+                    except curses.error:
+                        pass
+
+                stdscr.refresh()
+                key = stdscr.getch()
+
+                if key in (curses.KEY_UP, ord("k")):
+                    cursor = (cursor - 1) % len(items)
+                elif key in (curses.KEY_DOWN, ord("j")):
+                    cursor = (cursor + 1) % len(items)
+                elif key == ord(" "):
+                    chosen.symmetric_difference_update({cursor})
+                elif key in (curses.KEY_ENTER, 10, 13):
+                    result_holder[0] = set(chosen)
+                    return
+                elif key in (27, ord("q")):
+                    result_holder[0] = cancel_returns
+                    return
+
+        curses.wrapper(_draw)
+        return result_holder[0] if result_holder[0] is not None else cancel_returns
+
+    except Exception:
+        return _numbered_fallback(title, items, selected, cancel_returns)
+
+
+def _numbered_fallback(
+    title: str,
+    items: List[str],
+    selected: Set[int],
+    cancel_returns: Set[int],
+) -> Set[int]:
+    """Text-based toggle fallback for terminals without curses."""
+    chosen = set(selected)
+    print(color(f"\n  {title}", Colors.YELLOW))
+    print(color("  Toggle by number, Enter to confirm.\n", Colors.DIM))
+
+    while True:
+        for i, label in enumerate(items):
+            marker = color("[✓]", Colors.GREEN) if i in chosen else "[ ]"
+            print(f"  {marker} {i + 1:>2}. {label}")
+        print()
+        try:
+            val = input(color("  Toggle # (or Enter to confirm): ", Colors.DIM)).strip()
+            if not val:
+                break
+            idx = int(val) - 1
+            if 0 <= idx < len(items):
+                chosen.symmetric_difference_update({idx})
+        except (ValueError, KeyboardInterrupt, EOFError):
+            return cancel_returns
+        print()
+
+    return chosen

hermes_cli/doctor.py

@@ -5,18 +5,18 @@ Diagnoses issues with Hermes Agent setup.
 """
 
 import os
-import shutil
-import subprocess
 import sys
+import subprocess
+import shutil
+from pathlib import Path
 
-from hermes_cli.config import get_env_path, get_hermes_home, get_project_root
+from hermes_cli.config import get_project_root, get_hermes_home, get_env_path
 
 PROJECT_ROOT = get_project_root()
 HERMES_HOME = get_hermes_home()
 
 # Load environment variables from ~/.hermes/.env so API key checks work
 from dotenv import load_dotenv
-
 _env_path = get_env_path()
 if _env_path.exists():
     try:
@@ -33,6 +33,7 @@ os.environ.setdefault("MSWEA_SILENT_STARTUP", "1")
 from hermes_cli.colors import Colors, color
 from hermes_constants import OPENROUTER_MODELS_URL
 
+
 _PROVIDER_ENV_HINTS = (
     "OPENROUTER_API_KEY",
     "OPENAI_API_KEY",
@@ -55,38 +56,35 @@ def _has_provider_env_config(content: str) -> bool:
 def check_ok(text: str, detail: str = ""):
     print(f"  {color('✓', Colors.GREEN)} {text}" + (f" {color(detail, Colors.DIM)}" if detail else ""))
 
-
 def check_warn(text: str, detail: str = ""):
     print(f"  {color('⚠', Colors.YELLOW)} {text}" + (f" {color(detail, Colors.DIM)}" if detail else ""))
 
-
 def check_fail(text: str, detail: str = ""):
     print(f"  {color('✗', Colors.RED)} {text}" + (f" {color(detail, Colors.DIM)}" if detail else ""))
 
-
 def check_info(text: str):
     print(f"    {color('→', Colors.CYAN)} {text}")
 
 
 def run_doctor(args):
     """Run diagnostic checks."""
-    should_fix = getattr(args, "fix", False)
-
+    should_fix = getattr(args, 'fix', False)
+    
     issues = []
     manual_issues = []  # issues that can't be auto-fixed
     fixed_count = 0
-
+    
     print()
     print(color("┌─────────────────────────────────────────────────────────┐", Colors.CYAN))
     print(color("│                 🩺 Hermes Doctor                        │", Colors.CYAN))
     print(color("└─────────────────────────────────────────────────────────┘", Colors.CYAN))
-
+    
     # =========================================================================
     # Check: Python version
     # =========================================================================
     print()
     print(color("◆ Python Environment", Colors.CYAN, Colors.BOLD))
-
+    
     py_version = sys.version_info
     if py_version >= (3, 11):
         check_ok(f"Python {py_version.major}.{py_version.minor}.{py_version.micro}")
@@ -98,20 +96,20 @@ def run_doctor(args):
     else:
         check_fail(f"Python {py_version.major}.{py_version.minor}.{py_version.micro}", "(3.10+ required)")
         issues.append("Upgrade Python to 3.10+")
-
+    
     # Check if in virtual environment
     in_venv = sys.prefix != sys.base_prefix
     if in_venv:
         check_ok("Virtual environment active")
     else:
         check_warn("Not in virtual environment", "(recommended)")
-
+    
     # =========================================================================
     # Check: Required packages
     # =========================================================================
     print()
     print(color("◆ Required Packages", Colors.CYAN, Colors.BOLD))
-
+    
     required_packages = [
         ("openai", "OpenAI SDK"),
         ("rich", "Rich (terminal UI)"),
@@ -119,13 +117,13 @@ def run_doctor(args):
         ("yaml", "PyYAML"),
         ("httpx", "HTTPX"),
     ]
-
+    
     optional_packages = [
         ("croniter", "Croniter (cron expressions)"),
         ("telegram", "python-telegram-bot"),
         ("discord", "discord.py"),
     ]
-
+    
     for module, name in required_packages:
         try:
             __import__(module)
@@ -133,25 +131,25 @@ def run_doctor(args):
         except ImportError:
             check_fail(name, "(missing)")
             issues.append(f"Install {name}: uv pip install {module}")
-
+    
     for module, name in optional_packages:
         try:
             __import__(module)
             check_ok(name, "(optional)")
         except ImportError:
             check_warn(name, "(optional, not installed)")
-
+    
     # =========================================================================
     # Check: Configuration files
     # =========================================================================
     print()
     print(color("◆ Configuration Files", Colors.CYAN, Colors.BOLD))
-
+    
     # Check ~/.hermes/.env (primary location for user config)
-    env_path = HERMES_HOME / ".env"
+    env_path = HERMES_HOME / '.env'
     if env_path.exists():
         check_ok("~/.hermes/.env file exists")
-
+        
         # Check for common issues
         content = env_path.read_text()
         if _has_provider_env_config(content):
@@ -161,7 +159,7 @@ def run_doctor(args):
             issues.append("Run 'hermes setup' to configure API keys")
     else:
         # Also check project root as fallback
-        fallback_env = PROJECT_ROOT / ".env"
+        fallback_env = PROJECT_ROOT / '.env'
         if fallback_env.exists():
             check_ok(".env file exists (in project directory)")
         else:
@@ -175,17 +173,17 @@ def run_doctor(args):
             else:
                 check_info("Run 'hermes setup' to create one")
                 issues.append("Run 'hermes setup' to create .env")
-
+    
     # Check ~/.hermes/config.yaml (primary) or project cli-config.yaml (fallback)
-    config_path = HERMES_HOME / "config.yaml"
+    config_path = HERMES_HOME / 'config.yaml'
     if config_path.exists():
         check_ok("~/.hermes/config.yaml exists")
     else:
-        fallback_config = PROJECT_ROOT / "cli-config.yaml"
+        fallback_config = PROJECT_ROOT / 'cli-config.yaml'
         if fallback_config.exists():
             check_ok("cli-config.yaml exists (in project directory)")
         else:
-            example_config = PROJECT_ROOT / "cli-config.yaml.example"
+            example_config = PROJECT_ROOT / 'cli-config.yaml.example'
             if should_fix and example_config.exists():
                 config_path.parent.mkdir(parents=True, exist_ok=True)
                 shutil.copy2(str(example_config), str(config_path))
@@ -196,7 +194,7 @@ def run_doctor(args):
                 manual_issues.append("Create ~/.hermes/config.yaml manually")
             else:
                 check_warn("config.yaml not found", "(using defaults)")
-
+    
     # =========================================================================
     # Check: Auth providers
     # =========================================================================
@@ -204,7 +202,7 @@ def run_doctor(args):
     print(color("◆ Auth Providers", Colors.CYAN, Colors.BOLD))
 
     try:
-        from hermes_cli.auth import get_codex_auth_status, get_nous_auth_status
+        from hermes_cli.auth import get_nous_auth_status, get_codex_auth_status
 
         nous_status = get_nous_auth_status()
         if nous_status.get("logged_in"):
@@ -232,7 +230,7 @@ def run_doctor(args):
     # =========================================================================
     print()
     print(color("◆ Directory Structure", Colors.CYAN, Colors.BOLD))
-
+    
     hermes_home = HERMES_HOME
     if hermes_home.exists():
         check_ok("~/.hermes directory exists")
@@ -243,7 +241,7 @@ def run_doctor(args):
             fixed_count += 1
         else:
             check_warn("~/.hermes not found", "(will be created on first use)")
-
+    
     # Check expected subdirectories
     expected_subdirs = ["cron", "sessions", "logs", "skills", "memories"]
     for subdir_name in expected_subdirs:
@@ -257,7 +255,7 @@ def run_doctor(args):
                 fixed_count += 1
             else:
                 check_warn(f"~/.hermes/{subdir_name}/ not found", "(will be created on first use)")
-
+    
     # Check for SOUL.md persona file
     soul_path = hermes_home / "SOUL.md"
     if soul_path.exists():
@@ -280,7 +278,7 @@ def run_doctor(args):
             )
             check_ok("Created ~/.hermes/SOUL.md with basic template")
             fixed_count += 1
-
+    
     # Check memory directory
     memories_dir = hermes_home / "memories"
     if memories_dir.exists():
@@ -303,13 +301,12 @@ def run_doctor(args):
             memories_dir.mkdir(parents=True, exist_ok=True)
             check_ok("Created ~/.hermes/memories/")
             fixed_count += 1
-
+    
     # Check SQLite session store
     state_db_path = hermes_home / "state.db"
     if state_db_path.exists():
         try:
             import sqlite3
-
             conn = sqlite3.connect(str(state_db_path))
             cursor = conn.execute("SELECT COUNT(*) FROM sessions")
             count = cursor.fetchone()[0]
@@ -319,26 +316,26 @@ def run_doctor(args):
             check_warn(f"~/.hermes/state.db exists but has issues: {e}")
     else:
         check_info("~/.hermes/state.db not created yet (will be created on first session)")
-
+    
     # =========================================================================
     # Check: External tools
     # =========================================================================
     print()
     print(color("◆ External Tools", Colors.CYAN, Colors.BOLD))
-
+    
     # Git
     if shutil.which("git"):
         check_ok("git")
     else:
         check_warn("git not found", "(optional)")
-
+    
     # ripgrep (optional, for faster file search)
     if shutil.which("rg"):
         check_ok("ripgrep (rg)", "(faster file search)")
     else:
         check_warn("ripgrep (rg) not found", "(file search uses grep fallback)")
         check_info("Install for faster search: sudo apt install ripgrep")
-
+    
     # Docker (optional)
     terminal_env = os.getenv("TERMINAL_ENV", "local")
     if terminal_env == "docker":
@@ -358,7 +355,7 @@ def run_doctor(args):
             check_ok("docker", "(optional)")
         else:
             check_warn("docker not found", "(optional)")
-
+    
     # SSH (if using ssh backend)
     if terminal_env == "ssh":
         ssh_host = os.getenv("TERMINAL_SSH_HOST")
@@ -367,7 +364,7 @@ def run_doctor(args):
             result = subprocess.run(
                 ["ssh", "-o", "ConnectTimeout=5", "-o", "BatchMode=yes", ssh_host, "echo ok"],
                 capture_output=True,
-                text=True,
+                text=True
             )
             if result.returncode == 0:
                 check_ok(f"SSH connection to {ssh_host}")
@@ -377,7 +374,7 @@ def run_doctor(args):
         else:
             check_fail("TERMINAL_SSH_HOST not set", "(required for TERMINAL_ENV=ssh)")
             issues.append("Set TERMINAL_SSH_HOST in .env")
-
+    
     # Daytona (if using daytona backend)
     if terminal_env == "daytona":
         daytona_key = os.getenv("DAYTONA_API_KEY")
@@ -388,7 +385,6 @@ def run_doctor(args):
             issues.append("Set DAYTONA_API_KEY environment variable")
         try:
             from daytona import Daytona
-
             check_ok("daytona SDK", "(installed)")
         except ImportError:
             check_fail("daytona SDK not installed", "(pip install daytona)")
@@ -405,7 +401,7 @@ def run_doctor(args):
             check_warn("agent-browser not installed", "(run: npm install)")
     else:
         check_warn("Node.js not found", "(optional, needed for browser tools)")
-
+    
     # npm audit for all Node.js packages
     if shutil.which("npm"):
         npm_dirs = [
@@ -419,12 +415,9 @@ def run_doctor(args):
                 audit_result = subprocess.run(
                     ["npm", "audit", "--json"],
                     cwd=str(npm_dir),
-                    capture_output=True,
-                    text=True,
-                    timeout=30,
+                    capture_output=True, text=True, timeout=30,
                 )
                 import json as _json
-
                 audit_data = _json.loads(audit_result.stdout) if audit_result.stdout.strip() else {}
                 vuln_count = audit_data.get("metadata", {}).get("vulnerabilities", {})
                 critical = vuln_count.get("critical", 0)
@@ -436,7 +429,7 @@ def run_doctor(args):
                 elif critical > 0 or high > 0:
                     check_warn(
                         f"{label} deps",
-                        f"({critical} critical, {high} high, {moderate} moderate — run: cd {npm_dir} && npm audit fix)",
+                        f"({critical} critical, {high} high, {moderate} moderate — run: cd {npm_dir} && npm audit fix)"
                     )
                     issues.append(f"{label} has {total} npm vulnerability(ies)")
                 else:
@@ -449,50 +442,47 @@ def run_doctor(args):
     # =========================================================================
     print()
     print(color("◆ API Connectivity", Colors.CYAN, Colors.BOLD))
-
+    
     openrouter_key = os.getenv("OPENROUTER_API_KEY")
     if openrouter_key:
         print("  Checking OpenRouter API...", end="", flush=True)
         try:
             import httpx
-
             response = httpx.get(
-                OPENROUTER_MODELS_URL, headers={"Authorization": f"Bearer {openrouter_key}"}, timeout=10
+                OPENROUTER_MODELS_URL,
+                headers={"Authorization": f"Bearer {openrouter_key}"},
+                timeout=10
             )
             if response.status_code == 200:
                 print(f"\r  {color('✓', Colors.GREEN)} OpenRouter API                          ")
             elif response.status_code == 401:
-                print(
-                    f"\r  {color('✗', Colors.RED)} OpenRouter API {color('(invalid API key)', Colors.DIM)}                "
-                )
+                print(f"\r  {color('✗', Colors.RED)} OpenRouter API {color('(invalid API key)', Colors.DIM)}                ")
                 issues.append("Check OPENROUTER_API_KEY in .env")
             else:
-                print(
-                    f"\r  {color('✗', Colors.RED)} OpenRouter API {color(f'(HTTP {response.status_code})', Colors.DIM)}                "
-                )
+                print(f"\r  {color('✗', Colors.RED)} OpenRouter API {color(f'(HTTP {response.status_code})', Colors.DIM)}                ")
         except Exception as e:
             print(f"\r  {color('✗', Colors.RED)} OpenRouter API {color(f'({e})', Colors.DIM)}                ")
             issues.append("Check network connectivity")
     else:
         check_warn("OpenRouter API", "(not configured)")
-
+    
     anthropic_key = os.getenv("ANTHROPIC_API_KEY")
     if anthropic_key:
         print("  Checking Anthropic API...", end="", flush=True)
         try:
             import httpx
-
             response = httpx.get(
                 "https://api.anthropic.com/v1/models",
-                headers={"x-api-key": anthropic_key, "anthropic-version": "2023-06-01"},
-                timeout=10,
+                headers={
+                    "x-api-key": anthropic_key,
+                    "anthropic-version": "2023-06-01"
+                },
+                timeout=10
             )
             if response.status_code == 200:
                 print(f"\r  {color('✓', Colors.GREEN)} Anthropic API                           ")
             elif response.status_code == 401:
-                print(
-                    f"\r  {color('✗', Colors.RED)} Anthropic API {color('(invalid API key)', Colors.DIM)}                 "
-                )
+                print(f"\r  {color('✗', Colors.RED)} Anthropic API {color('(invalid API key)', Colors.DIM)}                 ")
             else:
                 msg = "(couldn't verify)"
                 print(f"\r  {color('⚠', Colors.YELLOW)} Anthropic API {color(msg, Colors.DIM)}                 ")
@@ -500,18 +490,16 @@ def run_doctor(args):
             print(f"\r  {color('⚠', Colors.YELLOW)} Anthropic API {color(f'({e})', Colors.DIM)}                 ")
 
     # -- API-key providers (Z.AI/GLM, Kimi, MiniMax, MiniMax-CN) --
+    # Tuple: (name, env_vars, default_url, base_env, supports_models_endpoint)
+    # If supports_models_endpoint is False, we skip the health check and just show "configured"
     _apikey_providers = [
-        (
-            "Z.AI / GLM",
-            ("GLM_API_KEY", "ZAI_API_KEY", "Z_AI_API_KEY"),
-            "https://api.z.ai/api/paas/v4/models",
-            "GLM_BASE_URL",
-        ),
-        ("Kimi / Moonshot", ("KIMI_API_KEY",), "https://api.moonshot.ai/v1/models", "KIMI_BASE_URL"),
-        ("MiniMax", ("MINIMAX_API_KEY",), "https://api.minimax.io/v1/models", "MINIMAX_BASE_URL"),
-        ("MiniMax (China)", ("MINIMAX_CN_API_KEY",), "https://api.minimaxi.com/v1/models", "MINIMAX_CN_BASE_URL"),
+        ("Z.AI / GLM",      ("GLM_API_KEY", "ZAI_API_KEY", "Z_AI_API_KEY"), "https://api.z.ai/api/paas/v4/models", "GLM_BASE_URL", True),
+        ("Kimi / Moonshot",  ("KIMI_API_KEY",),                              "https://api.moonshot.ai/v1/models",   "KIMI_BASE_URL", True),
+        # MiniMax APIs don't support /models endpoint — https://github.com/NousResearch/hermes-agent/issues/811
+        ("MiniMax",          ("MINIMAX_API_KEY",),                            None,                                  "MINIMAX_BASE_URL", False),
+        ("MiniMax (China)",  ("MINIMAX_CN_API_KEY",),                         None,                                  "MINIMAX_CN_BASE_URL", False),
     ]
-    for _pname, _env_vars, _default_url, _base_env in _apikey_providers:
+    for _pname, _env_vars, _default_url, _base_env, _supports_health_check in _apikey_providers:
         _key = ""
         for _ev in _env_vars:
             _key = os.getenv(_ev, "")
@@ -519,10 +507,13 @@ def run_doctor(args):
                 break
         if _key:
             _label = _pname.ljust(20)
+            # Some providers (like MiniMax) don't support /models endpoint
+            if not _supports_health_check:
+                print(f"  {color('✓', Colors.GREEN)} {_label} {color('(key configured)', Colors.DIM)}")
+                continue
             print(f"  Checking {_pname} API...", end="", flush=True)
             try:
                 import httpx
-
                 _base = os.getenv(_base_env, "")
                 # Auto-detect Kimi Code keys (sk-kimi-) → api.kimi.com
                 if not _base and _key.startswith("sk-kimi-"):
@@ -542,9 +533,7 @@ def run_doctor(args):
                     print(f"\r  {color('✗', Colors.RED)} {_label} {color('(invalid API key)', Colors.DIM)}           ")
                     issues.append(f"Check {_env_vars[0]} in .env")
                 else:
-                    print(
-                        f"\r  {color('⚠', Colors.YELLOW)} {_label} {color(f'(HTTP {_resp.status_code})', Colors.DIM)}           "
-                    )
+                    print(f"\r  {color('⚠', Colors.YELLOW)} {_label} {color(f'(HTTP {_resp.status_code})', Colors.DIM)}           ")
             except Exception as _e:
                 print(f"\r  {color('⚠', Colors.YELLOW)} {_label} {color(f'({_e})', Colors.DIM)}           ")
 
@@ -553,7 +542,7 @@ def run_doctor(args):
     # =========================================================================
     print()
     print(color("◆ Submodules", Colors.CYAN, Colors.BOLD))
-
+    
     # mini-swe-agent (terminal tool backend)
     mini_swe_dir = PROJECT_ROOT / "mini-swe-agent"
     if mini_swe_dir.exists() and (mini_swe_dir / "pyproject.toml").exists():
@@ -565,7 +554,7 @@ def run_doctor(args):
             issues.append("Install mini-swe-agent: uv pip install -e ./mini-swe-agent")
     else:
         check_warn("mini-swe-agent not found", "(run: git submodule update --init --recursive)")
-
+    
     # tinker-atropos (RL training backend)
     tinker_dir = PROJECT_ROOT / "tinker-atropos"
     if tinker_dir.exists() and (tinker_dir / "pyproject.toml").exists():
@@ -580,24 +569,24 @@ def run_doctor(args):
             check_warn("tinker-atropos requires Python 3.11+", f"(current: {py_version.major}.{py_version.minor})")
     else:
         check_warn("tinker-atropos not found", "(run: git submodule update --init --recursive)")
-
+    
     # =========================================================================
     # Check: Tool Availability
     # =========================================================================
     print()
     print(color("◆ Tool Availability", Colors.CYAN, Colors.BOLD))
-
+    
     try:
         # Add project root to path for imports
         sys.path.insert(0, str(PROJECT_ROOT))
-        from model_tools import TOOLSET_REQUIREMENTS, check_tool_availability
-
+        from model_tools import check_tool_availability, TOOLSET_REQUIREMENTS
+        
         available, unavailable = check_tool_availability()
-
+        
         for tid in available:
             info = TOOLSET_REQUIREMENTS.get(tid, {})
             check_ok(info.get("name", tid))
-
+        
         for item in unavailable:
             env_vars = item.get("missing_vars") or item.get("env_vars") or []
             if env_vars:
@@ -612,7 +601,7 @@ def run_doctor(args):
             issues.append("Run 'hermes setup' to configure missing API keys for full tool access")
     except Exception as e:
         check_warn("Could not check tool availability", f"({e})")
-
+    
     # =========================================================================
     # Check: Skills Hub
     # =========================================================================
@@ -626,7 +615,6 @@ def run_doctor(args):
         if lock_file.exists():
             try:
                 import json
-
                 lock_data = json.loads(lock_file.read_text())
                 count = len(lock_data.get("installed", {}))
                 check_ok(f"Lock file OK ({count} hub-installed skill(s))")
@@ -640,7 +628,6 @@ def run_doctor(args):
         check_warn("Skills Hub directory not initialized", "(run: hermes skills list)")
 
     from hermes_cli.config import get_env_value
-
     github_token = get_env_value("GITHUB_TOKEN") or get_env_value("GH_TOKEN")
     if github_token:
         check_ok("GitHub token configured (authenticated API access)")
@@ -676,5 +663,5 @@ def run_doctor(args):
     else:
         print(color("─" * 60, Colors.GREEN))
         print(color("  All checks passed! 🎉", Colors.GREEN, Colors.BOLD))
-
+    
     print()

hermes_cli/gateway.py

@@ -13,24 +13,18 @@ from pathlib import Path
 
 PROJECT_ROOT = Path(__file__).parent.parent.resolve()
 
-from hermes_cli.colors import Colors, color
 from hermes_cli.config import get_env_value, save_env_value
 from hermes_cli.setup import (
-    print_error,
-    print_header,
-    print_info,
-    print_success,
-    print_warning,
-    prompt,
-    prompt_choice,
-    prompt_yes_no,
+    print_header, print_info, print_success, print_warning, print_error,
+    prompt, prompt_choice, prompt_yes_no,
 )
+from hermes_cli.colors import Colors, color
+
 
 # =============================================================================
 # Process Management (for manual gateway runs)
 # =============================================================================
 
-
 def find_gateway_pids() -> list:
     """Find PIDs of running gateway processes."""
     pids = []
@@ -44,16 +38,17 @@ def find_gateway_pids() -> list:
         if is_windows():
             # Windows: use wmic to search command lines
             result = subprocess.run(
-                ["wmic", "process", "get", "ProcessId,CommandLine", "/FORMAT:LIST"], capture_output=True, text=True
+                ["wmic", "process", "get", "ProcessId,CommandLine", "/FORMAT:LIST"],
+                capture_output=True, text=True
             )
             # Parse WMIC LIST output: blocks of "CommandLine=...\nProcessId=...\n"
             current_cmd = ""
-            for line in result.stdout.split("\n"):
+            for line in result.stdout.split('\n'):
                 line = line.strip()
                 if line.startswith("CommandLine="):
-                    current_cmd = line[len("CommandLine=") :]
+                    current_cmd = line[len("CommandLine="):]
                 elif line.startswith("ProcessId="):
-                    pid_str = line[len("ProcessId=") :]
+                    pid_str = line[len("ProcessId="):]
                     if any(p in current_cmd for p in patterns):
                         try:
                             pid = int(pid_str)
@@ -63,10 +58,14 @@ def find_gateway_pids() -> list:
                             pass
                     current_cmd = ""
         else:
-            result = subprocess.run(["ps", "aux"], capture_output=True, text=True)
-            for line in result.stdout.split("\n"):
+            result = subprocess.run(
+                ["ps", "aux"],
+                capture_output=True,
+                text=True
+            )
+            for line in result.stdout.split('\n'):
                 # Skip grep and current process
-                if "grep" in line or str(os.getpid()) in line:
+                if 'grep' in line or str(os.getpid()) in line:
                     continue
                 for pattern in patterns:
                     if pattern in line:
@@ -89,7 +88,7 @@ def kill_gateway_processes(force: bool = False) -> int:
     """Kill any running gateway processes. Returns count killed."""
     pids = find_gateway_pids()
     killed = 0
-
+    
     for pid in pids:
         try:
             if force and not is_windows():
@@ -102,20 +101,18 @@ def kill_gateway_processes(force: bool = False) -> int:
             pass
         except PermissionError:
             print(f"⚠ Permission denied to kill PID {pid}")
-
+    
     return killed
 
 
 def is_linux() -> bool:
-    return sys.platform.startswith("linux")
-
+    return sys.platform.startswith('linux')
 
 def is_macos() -> bool:
-    return sys.platform == "darwin"
-
+    return sys.platform == 'darwin'
 
 def is_windows() -> bool:
-    return sys.platform == "win32"
+    return sys.platform == 'win32'
 
 
 # =============================================================================
@@ -125,15 +122,12 @@ def is_windows() -> bool:
 SERVICE_NAME = "hermes-gateway"
 SERVICE_DESCRIPTION = "Hermes Agent Gateway - Messaging Platform Integration"
 
-
 def get_systemd_unit_path() -> Path:
     return Path.home() / ".config" / "systemd" / "user" / f"{SERVICE_NAME}.service"
 
-
 def get_launchd_plist_path() -> Path:
     return Path.home() / "Library" / "LaunchAgents" / "ai.hermes.gateway.plist"
 
-
 def get_python_path() -> str:
     if is_windows():
         venv_python = PROJECT_ROOT / "venv" / "Scripts" / "python.exe"
@@ -143,16 +137,14 @@ def get_python_path() -> str:
         return str(venv_python)
     return sys.executable
 
-
 def get_hermes_cli_path() -> str:
     """Get the path to the hermes CLI."""
     # Check if installed via pip
     import shutil
-
     hermes_bin = shutil.which("hermes")
     if hermes_bin:
         return hermes_bin
-
+    
     # Fallback to direct module execution
     return f"{get_python_path()} -m hermes_cli.main"
 
@@ -161,10 +153,8 @@ def get_hermes_cli_path() -> str:
 # Systemd (Linux)
 # =============================================================================
 
-
 def generate_systemd_unit() -> str:
     import shutil
-
     python_path = get_python_path()
     working_dir = str(PROJECT_ROOT)
     venv_dir = str(PROJECT_ROOT / "venv")
@@ -173,7 +163,7 @@ def generate_systemd_unit() -> str:
 
     # Build a PATH that includes the venv, node_modules, and standard system dirs
     sane_path = f"{venv_bin}:{node_bin}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
-
+    
     hermes_cli = shutil.which("hermes") or f"{python_path} -m hermes_cli.main"
     return f"""[Unit]
 Description={SERVICE_DESCRIPTION}
@@ -198,62 +188,56 @@ StandardError=journal
 WantedBy=default.target
 """
 
-
 def systemd_install(force: bool = False):
     unit_path = get_systemd_unit_path()
-
+    
     if unit_path.exists() and not force:
         print(f"Service already installed at: {unit_path}")
         print("Use --force to reinstall")
         return
-
+    
     unit_path.parent.mkdir(parents=True, exist_ok=True)
     print(f"Installing systemd service to: {unit_path}")
     unit_path.write_text(generate_systemd_unit())
-
+    
     subprocess.run(["systemctl", "--user", "daemon-reload"], check=True)
     subprocess.run(["systemctl", "--user", "enable", SERVICE_NAME], check=True)
-
+    
     print()
     print("✓ Service installed and enabled!")
     print()
     print("Next steps:")
-    print("  hermes gateway start              # Start the service")
-    print("  hermes gateway status             # Check status")
+    print(f"  hermes gateway start              # Start the service")
+    print(f"  hermes gateway status             # Check status")
     print(f"  journalctl --user -u {SERVICE_NAME} -f  # View logs")
     print()
     print("To enable lingering (keeps running after logout):")
     print("  sudo loginctl enable-linger $USER")
 
-
 def systemd_uninstall():
     subprocess.run(["systemctl", "--user", "stop", SERVICE_NAME], check=False)
     subprocess.run(["systemctl", "--user", "disable", SERVICE_NAME], check=False)
-
+    
     unit_path = get_systemd_unit_path()
     if unit_path.exists():
         unit_path.unlink()
         print(f"✓ Removed {unit_path}")
-
+    
     subprocess.run(["systemctl", "--user", "daemon-reload"], check=True)
     print("✓ Service uninstalled")
 
-
 def systemd_start():
     subprocess.run(["systemctl", "--user", "start", SERVICE_NAME], check=True)
     print("✓ Service started")
 
-
 def systemd_stop():
     subprocess.run(["systemctl", "--user", "stop", SERVICE_NAME], check=True)
     print("✓ Service stopped")
 
-
 def systemd_restart():
     subprocess.run(["systemctl", "--user", "restart", SERVICE_NAME], check=True)
     print("✓ Service restarted")
 
-
 def systemd_status(deep: bool = False):
     # Check if service unit file exists
     unit_path = get_systemd_unit_path()
@@ -261,45 +245,54 @@ def systemd_status(deep: bool = False):
         print("✗ Gateway service is not installed")
         print("  Run: hermes gateway install")
         return
-
+    
     # Show detailed status first
-    subprocess.run(["systemctl", "--user", "status", SERVICE_NAME, "--no-pager"], capture_output=False)
-
+    subprocess.run(
+        ["systemctl", "--user", "status", SERVICE_NAME, "--no-pager"],
+        capture_output=False
+    )
+    
     # Check if service is active
-    result = subprocess.run(["systemctl", "--user", "is-active", SERVICE_NAME], capture_output=True, text=True)
-
+    result = subprocess.run(
+        ["systemctl", "--user", "is-active", SERVICE_NAME],
+        capture_output=True,
+        text=True
+    )
+    
     status = result.stdout.strip()
-
+    
     if status == "active":
         print("✓ Gateway service is running")
     else:
         print("✗ Gateway service is stopped")
         print("  Run: hermes gateway start")
-
+    
     if deep:
         print()
         print("Recent logs:")
-        subprocess.run(["journalctl", "--user", "-u", SERVICE_NAME, "-n", "20", "--no-pager"])
+        subprocess.run([
+            "journalctl", "--user", "-u", SERVICE_NAME,
+            "-n", "20", "--no-pager"
+        ])
 
 
 # =============================================================================
 # Launchd (macOS)
 # =============================================================================
 
-
 def generate_launchd_plist() -> str:
     python_path = get_python_path()
     working_dir = str(PROJECT_ROOT)
     log_dir = Path.home() / ".hermes" / "logs"
     log_dir.mkdir(parents=True, exist_ok=True)
-
+    
     return f"""<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
     <key>Label</key>
     <string>ai.hermes.gateway</string>
-
+    
     <key>ProgramArguments</key>
     <array>
         <string>{python_path}</string>
@@ -308,43 +301,42 @@ def generate_launchd_plist() -> str:
         <string>gateway</string>
         <string>run</string>
     </array>
-
+    
     <key>WorkingDirectory</key>
     <string>{working_dir}</string>
-
+    
     <key>RunAtLoad</key>
     <true/>
-
+    
     <key>KeepAlive</key>
     <dict>
         <key>SuccessfulExit</key>
         <false/>
     </dict>
-
+    
     <key>StandardOutPath</key>
     <string>{log_dir}/gateway.log</string>
-
+    
     <key>StandardErrorPath</key>
     <string>{log_dir}/gateway.error.log</string>
 </dict>
 </plist>
 """
 
-
 def launchd_install(force: bool = False):
     plist_path = get_launchd_plist_path()
-
+    
     if plist_path.exists() and not force:
         print(f"Service already installed at: {plist_path}")
         print("Use --force to reinstall")
         return
-
+    
     plist_path.parent.mkdir(parents=True, exist_ok=True)
     print(f"Installing launchd service to: {plist_path}")
     plist_path.write_text(generate_launchd_plist())
-
+    
     subprocess.run(["launchctl", "load", str(plist_path)], check=True)
-
+    
     print()
     print("✓ Service installed and loaded!")
     print()
@@ -352,42 +344,41 @@ def launchd_install(force: bool = False):
     print("  hermes gateway status             # Check status")
     print("  tail -f ~/.hermes/logs/gateway.log  # View logs")
 
-
 def launchd_uninstall():
     plist_path = get_launchd_plist_path()
     subprocess.run(["launchctl", "unload", str(plist_path)], check=False)
-
+    
     if plist_path.exists():
         plist_path.unlink()
         print(f"✓ Removed {plist_path}")
-
+    
     print("✓ Service uninstalled")
 
-
 def launchd_start():
     subprocess.run(["launchctl", "start", "ai.hermes.gateway"], check=True)
     print("✓ Service started")
 
-
 def launchd_stop():
     subprocess.run(["launchctl", "stop", "ai.hermes.gateway"], check=True)
     print("✓ Service stopped")
 
-
 def launchd_restart():
     launchd_stop()
     launchd_start()
 
-
 def launchd_status(deep: bool = False):
-    result = subprocess.run(["launchctl", "list", "ai.hermes.gateway"], capture_output=True, text=True)
-
+    result = subprocess.run(
+        ["launchctl", "list", "ai.hermes.gateway"],
+        capture_output=True,
+        text=True
+    )
+    
     if result.returncode == 0:
         print("✓ Gateway service is loaded")
         print(result.stdout)
     else:
         print("✗ Gateway service is not loaded")
-
+    
     if deep:
         log_file = Path.home() / ".hermes" / "logs" / "gateway.log"
         if log_file.exists():
@@ -400,10 +391,9 @@ def launchd_status(deep: bool = False):
 # Gateway Runner
 # =============================================================================
 
-
 def run_gateway(verbose: bool = False, replace: bool = False):
     """Run the gateway in foreground.
-
+    
     Args:
         verbose: Enable verbose logging output.
         replace: If True, kill any existing gateway instance before starting.
@@ -411,9 +401,9 @@ def run_gateway(verbose: bool = False, replace: bool = False):
                  hasn't fully exited yet.
     """
     sys.path.insert(0, str(PROJECT_ROOT))
-
+    
     from gateway.run import start_gateway
-
+    
     print("┌─────────────────────────────────────────────────────────┐")
     print("│           ⚕ Hermes Gateway Starting...                 │")
     print("├─────────────────────────────────────────────────────────┤")
@@ -421,7 +411,7 @@ def run_gateway(verbose: bool = False, replace: bool = False):
     print("│  Press Ctrl+C to stop                                   │")
     print("└─────────────────────────────────────────────────────────┘")
     print()
-
+    
     # Exit with code 1 if gateway fails to connect any platform,
     # so systemd Restart=on-failure will retry on transient errors
     success = asyncio.run(start_gateway(replace=replace))
@@ -448,25 +438,13 @@ _PLATFORMS = [
             "4. To find your user ID: message @userinfobot — it replies with your numeric ID",
         ],
         "vars": [
-            {
-                "name": "TELEGRAM_BOT_TOKEN",
-                "prompt": "Bot token",
-                "password": True,
-                "help": "Paste the token from @BotFather (step 3 above).",
-            },
-            {
-                "name": "TELEGRAM_ALLOWED_USERS",
-                "prompt": "Allowed user IDs (comma-separated)",
-                "password": False,
-                "is_allowlist": True,
-                "help": "Paste your user ID from step 4 above.",
-            },
-            {
-                "name": "TELEGRAM_HOME_CHANNEL",
-                "prompt": "Home channel ID (for cron/notification delivery, or empty to set later with /set-home)",
-                "password": False,
-                "help": "For DMs, this is your user ID. You can set it later by typing /set-home in chat.",
-            },
+            {"name": "TELEGRAM_BOT_TOKEN", "prompt": "Bot token", "password": True,
+             "help": "Paste the token from @BotFather (step 3 above)."},
+            {"name": "TELEGRAM_ALLOWED_USERS", "prompt": "Allowed user IDs (comma-separated)", "password": False,
+             "is_allowlist": True,
+             "help": "Paste your user ID from step 4 above."},
+            {"name": "TELEGRAM_HOME_CHANNEL", "prompt": "Home channel ID (for cron/notification delivery, or empty to set later with /set-home)", "password": False,
+             "help": "For DMs, this is your user ID. You can set it later by typing /set-home in chat."},
         ],
     },
     {
@@ -488,25 +466,13 @@ _PLATFORMS = [
             "   then right-click your name → Copy ID",
         ],
         "vars": [
-            {
-                "name": "DISCORD_BOT_TOKEN",
-                "prompt": "Bot token",
-                "password": True,
-                "help": "Paste the token from step 2 above.",
-            },
-            {
-                "name": "DISCORD_ALLOWED_USERS",
-                "prompt": "Allowed user IDs or usernames (comma-separated)",
-                "password": False,
-                "is_allowlist": True,
-                "help": "Paste your user ID from step 5 above.",
-            },
-            {
-                "name": "DISCORD_HOME_CHANNEL",
-                "prompt": "Home channel ID (for cron/notification delivery, or empty to set later with /set-home)",
-                "password": False,
-                "help": "Right-click a channel → Copy Channel ID (requires Developer Mode).",
-            },
+            {"name": "DISCORD_BOT_TOKEN", "prompt": "Bot token", "password": True,
+             "help": "Paste the token from step 2 above."},
+            {"name": "DISCORD_ALLOWED_USERS", "prompt": "Allowed user IDs or usernames (comma-separated)", "password": False,
+             "is_allowlist": True,
+             "help": "Paste your user ID from step 5 above."},
+            {"name": "DISCORD_HOME_CHANNEL", "prompt": "Home channel ID (for cron/notification delivery, or empty to set later with /set-home)", "password": False,
+             "help": "Right-click a channel → Copy Channel ID (requires Developer Mode)."},
         ],
     },
     {
@@ -531,25 +497,13 @@ _PLATFORMS = [
             "8. Invite the bot to channels: /invite @YourBot",
         ],
         "vars": [
-            {
-                "name": "SLACK_BOT_TOKEN",
-                "prompt": "Bot Token (xoxb-...)",
-                "password": True,
-                "help": "Paste the bot token from step 3 above.",
-            },
-            {
-                "name": "SLACK_APP_TOKEN",
-                "prompt": "App Token (xapp-...)",
-                "password": True,
-                "help": "Paste the app-level token from step 4 above.",
-            },
-            {
-                "name": "SLACK_ALLOWED_USERS",
-                "prompt": "Allowed user IDs (comma-separated)",
-                "password": False,
-                "is_allowlist": True,
-                "help": "Paste your member ID from step 7 above.",
-            },
+            {"name": "SLACK_BOT_TOKEN", "prompt": "Bot Token (xoxb-...)", "password": True,
+             "help": "Paste the bot token from step 3 above."},
+            {"name": "SLACK_APP_TOKEN", "prompt": "App Token (xapp-...)", "password": True,
+             "help": "Paste the app-level token from step 4 above."},
+            {"name": "SLACK_ALLOWED_USERS", "prompt": "Allowed user IDs (comma-separated)", "password": False,
+             "is_allowlist": True,
+             "help": "Paste your member ID from step 7 above."},
         ],
     },
     {
@@ -564,6 +518,32 @@ _PLATFORMS = [
         "emoji": "📡",
         "token_var": "SIGNAL_HTTP_URL",
     },
+    {
+        "key": "email",
+        "label": "Email",
+        "emoji": "📧",
+        "token_var": "EMAIL_ADDRESS",
+        "setup_instructions": [
+            "1. Use a dedicated email account for your Hermes agent",
+            "2. For Gmail: enable 2FA, then create an App Password at",
+            "   https://myaccount.google.com/apppasswords",
+            "3. For other providers: use your email password or app-specific password",
+            "4. IMAP must be enabled on your email account",
+        ],
+        "vars": [
+            {"name": "EMAIL_ADDRESS", "prompt": "Email address", "password": False,
+             "help": "The email address Hermes will use (e.g., hermes@gmail.com)."},
+            {"name": "EMAIL_PASSWORD", "prompt": "Email password (or app password)", "password": True,
+             "help": "For Gmail, use an App Password (not your regular password)."},
+            {"name": "EMAIL_IMAP_HOST", "prompt": "IMAP host", "password": False,
+             "help": "e.g., imap.gmail.com for Gmail, outlook.office365.com for Outlook."},
+            {"name": "EMAIL_SMTP_HOST", "prompt": "SMTP host", "password": False,
+             "help": "e.g., smtp.gmail.com for Gmail, smtp.office365.com for Outlook."},
+            {"name": "EMAIL_ALLOWED_USERS", "prompt": "Allowed sender emails (comma-separated)", "password": False,
+             "is_allowlist": True,
+             "help": "Only emails from these addresses will be processed."},
+        ],
+    },
 ]
 
 
@@ -589,6 +569,15 @@ def _platform_status(platform: dict) -> str:
         if val or account:
             return "partially configured"
         return "not configured"
+    if platform.get("key") == "email":
+        pwd = get_env_value("EMAIL_PASSWORD")
+        imap = get_env_value("EMAIL_IMAP_HOST")
+        smtp = get_env_value("EMAIL_SMTP_HOST")
+        if all([val, pwd, imap, smtp]):
+            return "configured"
+        if any([val, pwd, imap, smtp]):
+            return "partially configured"
+        return "not configured"
     if val:
         return "configured"
     return "not configured"
@@ -628,14 +617,14 @@ def _setup_standard_platform(platform: dict):
 
         # Allowlist fields get special handling for the deny-by-default security model
         if var.get("is_allowlist"):
-            print_info("  The gateway DENIES all users by default for security.")
-            print_info("  Enter user IDs to create an allowlist, or leave empty")
-            print_info("  and you'll be asked about open access next.")
+            print_info(f"  The gateway DENIES all users by default for security.")
+            print_info(f"  Enter user IDs to create an allowlist, or leave empty")
+            print_info(f"  and you'll be asked about open access next.")
             value = prompt(f"  {var['prompt']}", password=False)
             if value:
                 cleaned = value.replace(" ", "")
                 save_env_value(var["name"], cleaned)
-                print_success("  Saved — only these users can interact with the bot.")
+                print_success(f"  Saved — only these users can interact with the bot.")
                 allowed_val_set = cleaned
             else:
                 # No allowlist — ask about open access vs DM pairing
@@ -664,7 +653,7 @@ def _setup_standard_platform(platform: dict):
             print_warning(f"  Skipped — {label} won't work without this.")
             return
         else:
-            print_info("  Skipped (can configure later)")
+            print_info(f"  Skipped (can configure later)")
 
     # If an allowlist was set and home channel wasn't, offer to reuse
     # the first user ID (common for Telegram DMs).
@@ -682,10 +671,8 @@ def _setup_standard_platform(platform: dict):
 
 def _setup_whatsapp():
     """Delegate to the existing WhatsApp setup flow."""
-    import argparse
-
     from hermes_cli.main import cmd_whatsapp
-
+    import argparse
     cmd_whatsapp(argparse.Namespace())
 
 
@@ -701,10 +688,16 @@ def _is_service_installed() -> bool:
 def _is_service_running() -> bool:
     """Check if the gateway service is currently running."""
     if is_linux() and get_systemd_unit_path().exists():
-        result = subprocess.run(["systemctl", "--user", "is-active", SERVICE_NAME], capture_output=True, text=True)
+        result = subprocess.run(
+            ["systemctl", "--user", "is-active", SERVICE_NAME],
+            capture_output=True, text=True
+        )
         return result.stdout.strip() == "active"
     elif is_macos() and get_launchd_plist_path().exists():
-        result = subprocess.run(["launchctl", "list", "ai.hermes.gateway"], capture_output=True, text=True)
+        result = subprocess.run(
+            ["launchctl", "list", "ai.hermes.gateway"],
+            capture_output=True, text=True
+        )
         return result.returncode == 0
     # Check for manual processes
     return len(find_gateway_pids()) > 0
@@ -739,7 +732,7 @@ def _setup_signal():
         print_info("    Docker: bbernhard/signal-cli-rest-api")
         print()
         print_info("  After installing, link your account and start the daemon:")
-        print_info('    signal-cli link -n "HermesAgent"')
+        print_info("    signal-cli link -n \"HermesAgent\"")
         print_info("    signal-cli --account +YOURNUMBER daemon --http 127.0.0.1:8080")
         print()
 
@@ -757,7 +750,6 @@ def _setup_signal():
     print_info("  Testing connection...")
     try:
         import httpx
-
         resp = httpx.get(f"{url.rstrip('/')}/api/v1/check", timeout=10.0)
         if resp.status_code == 200:
             print_success("  signal-cli daemon is reachable!")
@@ -822,7 +814,7 @@ def _setup_signal():
     print_success("Signal configured!")
     print_info(f"  URL: {url}")
     print_info(f"  Account: {account}")
-    print_info("  DM auth: via SIGNAL_ALLOWED_USERS + DM pairing")
+    print_info(f"  DM auth: via SIGNAL_ALLOWED_USERS + DM pairing")
     print_info(f"  Groups: {'enabled' if get_env_value('SIGNAL_GROUP_ALLOWED_USERS') else 'disabled'}")
 
 
@@ -884,10 +876,11 @@ def gateway_setup():
             _setup_standard_platform(platform)
 
     # ── Post-setup: offer to install/restart gateway ──
-    any_configured = (
-        any(bool(get_env_value(p["token_var"])) for p in _PLATFORMS if p["key"] != "whatsapp")
-        or (get_env_value("WHATSAPP_ENABLED") or "").lower() == "true"
-    )
+    any_configured = any(
+        bool(get_env_value(p["token_var"]))
+        for p in _PLATFORMS
+        if p["key"] != "whatsapp"
+    ) or (get_env_value("WHATSAPP_ENABLED") or "").lower() == "true"
 
     if any_configured:
         print()
@@ -920,9 +913,7 @@ def gateway_setup():
             print()
             if is_linux() or is_macos():
                 platform_name = "systemd" if is_linux() else "launchd"
-                if prompt_yes_no(
-                    f"  Install the gateway as a {platform_name} service? (runs in background, starts on boot)", True
-                ):
+                if prompt_yes_no(f"  Install the gateway as a {platform_name} service? (runs in background, starts on boot)", True):
                     try:
                         force = False
                         if is_linux():
@@ -958,15 +949,14 @@ def gateway_setup():
 # Main Command Handler
 # =============================================================================
 
-
 def gateway_command(args):
     """Handle gateway subcommands."""
-    subcmd = getattr(args, "gateway_command", None)
-
+    subcmd = getattr(args, 'gateway_command', None)
+    
     # Default to run if no subcommand
     if subcmd is None or subcmd == "run":
-        verbose = getattr(args, "verbose", False)
-        replace = getattr(args, "replace", False)
+        verbose = getattr(args, 'verbose', False)
+        replace = getattr(args, 'replace', False)
         run_gateway(verbose, replace=replace)
         return
 
@@ -976,7 +966,7 @@ def gateway_command(args):
 
     # Service management commands
     if subcmd == "install":
-        force = getattr(args, "force", False)
+        force = getattr(args, 'force', False)
         if is_linux():
             systemd_install(force)
         elif is_macos():
@@ -985,7 +975,7 @@ def gateway_command(args):
             print("Service installation not supported on this platform.")
             print("Run manually: hermes gateway run")
             sys.exit(1)
-
+    
     elif subcmd == "uninstall":
         if is_linux():
             systemd_uninstall()
@@ -994,7 +984,7 @@ def gateway_command(args):
         else:
             print("Not supported on this platform.")
             sys.exit(1)
-
+    
     elif subcmd == "start":
         if is_linux():
             systemd_start()
@@ -1003,11 +993,11 @@ def gateway_command(args):
         else:
             print("Not supported on this platform.")
             sys.exit(1)
-
+    
     elif subcmd == "stop":
         # Try service first, fall back to killing processes directly
         service_available = False
-
+        
         if is_linux() and get_systemd_unit_path().exists():
             try:
                 systemd_stop()
@@ -1020,7 +1010,7 @@ def gateway_command(args):
                 service_available = True
             except subprocess.CalledProcessError:
                 pass
-
+        
         if not service_available:
             # Kill gateway processes directly
             killed = kill_gateway_processes()
@@ -1028,11 +1018,11 @@ def gateway_command(args):
                 print(f"✓ Stopped {killed} gateway process(es)")
             else:
                 print("✗ No gateway processes found")
-
+    
     elif subcmd == "restart":
         # Try service first, fall back to killing and restarting
         service_available = False
-
+        
         if is_linux() and get_systemd_unit_path().exists():
             try:
                 systemd_restart()
@@ -1045,24 +1035,23 @@ def gateway_command(args):
                 service_available = True
             except subprocess.CalledProcessError:
                 pass
-
+        
         if not service_available:
             # Manual restart: kill existing processes
             killed = kill_gateway_processes()
             if killed:
                 print(f"✓ Stopped {killed} gateway process(es)")
-
+            
             import time
-
             time.sleep(2)
-
+            
             # Start fresh
             print("Starting gateway...")
             run_gateway(verbose=False)
-
+    
     elif subcmd == "status":
-        deep = getattr(args, "deep", False)
-
+        deep = getattr(args, 'deep', False)
+        
         # Check for service first
         if is_linux() and get_systemd_unit_path().exists():
             systemd_status(deep)

hermes_cli/models.py

@@ -8,29 +8,42 @@ Add, remove, or reorder entries here — both `hermes setup` and
 from __future__ import annotations
 
 import json
-import urllib.error
 import urllib.request
+import urllib.error
 from difflib import get_close_matches
-from typing import Any
+from typing import Any, Optional
 
 # (model_id, display description shown in menus)
 OPENROUTER_MODELS: list[tuple[str, str]] = [
-    ("anthropic/claude-opus-4.6", "recommended"),
-    ("anthropic/claude-sonnet-4.5", ""),
-    ("openai/gpt-5.4-pro", ""),
-    ("openai/gpt-5.4", ""),
-    ("openai/gpt-5.3-codex", ""),
-    ("google/gemini-3-pro-preview", ""),
-    ("google/gemini-3-flash-preview", ""),
-    ("qwen/qwen3.5-plus-02-15", ""),
-    ("qwen/qwen3.5-35b-a3b", ""),
-    ("stepfun/step-3.5-flash", ""),
-    ("z-ai/glm-5", ""),
-    ("moonshotai/kimi-k2.5", ""),
-    ("minimax/minimax-m2.5", ""),
+    ("anthropic/claude-opus-4.6",       "recommended"),
+    ("anthropic/claude-sonnet-4.5",     ""),
+    ("openai/gpt-5.4-pro",              ""),
+    ("openai/gpt-5.4",                  ""),
+    ("openai/gpt-5.3-codex",            ""),
+    ("google/gemini-3-pro-preview",     ""),
+    ("google/gemini-3-flash-preview",   ""),
+    ("qwen/qwen3.5-plus-02-15",         ""),
+    ("qwen/qwen3.5-35b-a3b",            ""),
+    ("stepfun/step-3.5-flash",          ""),
+    ("z-ai/glm-5",                      ""),
+    ("moonshotai/kimi-k2.5",            ""),
+    ("minimax/minimax-m2.5",            ""),
 ]
 
 _PROVIDER_MODELS: dict[str, list[str]] = {
+    "nous": [
+        "claude-opus-4-6",
+        "claude-sonnet-4-6",
+        "gpt-5.4",
+        "gemini-3-flash",
+        "gemini-3.0-pro-preview",
+        "deepseek-v3.2",
+    ],
+    "openai-codex": [
+        "gpt-5.2-codex",
+        "gpt-5.1-codex-mini",
+        "gpt-5.1-codex-max",
+    ],
     "zai": [
         "glm-5",
         "glm-4.7",
@@ -38,8 +51,10 @@ _PROVIDER_MODELS: dict[str, list[str]] = {
         "glm-4.5-flash",
     ],
     "kimi-coding": [
+        "kimi-for-coding",
         "kimi-k2.5",
         "kimi-k2-thinking",
+        "kimi-k2-thinking-turbo",
         "kimi-k2-turbo-preview",
         "kimi-k2-0905-preview",
     ],
@@ -93,7 +108,9 @@ def menu_labels() -> list[str]:
 
 # All provider IDs and aliases that are valid for the provider:model syntax.
 _KNOWN_PROVIDER_NAMES: set[str] = (
-    set(_PROVIDER_LABELS.keys()) | set(_PROVIDER_ALIASES.keys()) | {"openrouter", "custom"}
+    set(_PROVIDER_LABELS.keys())
+    | set(_PROVIDER_ALIASES.keys())
+    | {"openrouter", "custom"}
 )
 
 
@@ -105,13 +122,8 @@ def list_available_providers() -> list[dict[str, str]]:
     """
     # Canonical providers in display order
     _PROVIDER_ORDER = [
-        "openrouter",
-        "nous",
-        "openai-codex",
-        "zai",
-        "kimi-coding",
-        "minimax",
-        "minimax-cn",
+        "openrouter", "nous", "openai-codex",
+        "zai", "kimi-coding", "minimax", "minimax-cn",
     ]
     # Build reverse alias map
     aliases_for: dict[str, list[str]] = {}
@@ -126,19 +138,16 @@ def list_available_providers() -> list[dict[str, str]]:
         has_creds = False
         try:
             from hermes_cli.runtime_provider import resolve_runtime_provider
-
             runtime = resolve_runtime_provider(requested=pid)
             has_creds = bool(runtime.get("api_key"))
         except Exception:
             pass
-        result.append(
-            {
-                "id": pid,
-                "label": label,
-                "aliases": alias_list,
-                "authenticated": has_creds,
-            }
-        )
+        result.append({
+            "id": pid,
+            "label": label,
+            "aliases": alias_list,
+            "authenticated": has_creds,
+        })
     return result
 
 
@@ -163,22 +172,34 @@ def parse_model_input(raw: str, current_provider: str) -> tuple[str, str]:
     colon = stripped.find(":")
     if colon > 0:
         provider_part = stripped[:colon].strip().lower()
-        model_part = stripped[colon + 1 :].strip()
+        model_part = stripped[colon + 1:].strip()
         if provider_part and model_part and provider_part in _KNOWN_PROVIDER_NAMES:
             return (normalize_provider(provider_part), model_part)
     return (current_provider, stripped)
 
 
-def curated_models_for_provider(provider: str | None) -> list[tuple[str, str]]:
-    """Return ``(model_id, description)`` tuples for a provider's curated list."""
+def curated_models_for_provider(provider: Optional[str]) -> list[tuple[str, str]]:
+    """Return ``(model_id, description)`` tuples for a provider's model list.
+
+    Tries to fetch the live model list from the provider's API first,
+    falling back to the static ``_PROVIDER_MODELS`` catalog if the API
+    is unreachable.
+    """
     normalized = normalize_provider(provider)
     if normalized == "openrouter":
         return list(OPENROUTER_MODELS)
+
+    # Try live API first (Codex, Nous, etc. all support /models)
+    live = provider_model_ids(normalized)
+    if live:
+        return [(m, "") for m in live]
+
+    # Fallback to static catalog
     models = _PROVIDER_MODELS.get(normalized, [])
     return [(m, "") for m in models]
 
 
-def normalize_provider(provider: str | None) -> str:
+def normalize_provider(provider: Optional[str]) -> str:
     """Normalize provider aliases to Hermes' canonical provider ids.
 
     Note: ``"auto"`` passes through unchanged — use
@@ -189,8 +210,12 @@ def normalize_provider(provider: str | None) -> str:
     return _PROVIDER_ALIASES.get(normalized, normalized)
 
 
-def provider_model_ids(provider: str | None) -> list[str]:
-    """Return the best known model catalog for a provider."""
+def provider_model_ids(provider: Optional[str]) -> list[str]:
+    """Return the best known model catalog for a provider.
+
+    Tries live API endpoints for providers that support them (Codex, Nous),
+    falling back to static lists.
+    """
     normalized = normalize_provider(provider)
     if normalized == "openrouter":
         return model_ids()
@@ -198,14 +223,25 @@ def provider_model_ids(provider: str | None) -> list[str]:
         from hermes_cli.codex_models import get_codex_model_ids
 
         return get_codex_model_ids()
+    if normalized == "nous":
+        # Try live Nous Portal /models endpoint
+        try:
+            from hermes_cli.auth import fetch_nous_models, resolve_nous_runtime_credentials
+            creds = resolve_nous_runtime_credentials()
+            if creds:
+                live = fetch_nous_models(creds.get("api_key", ""), creds.get("base_url", ""))
+                if live:
+                    return live
+        except Exception:
+            pass
     return list(_PROVIDER_MODELS.get(normalized, []))
 
 
 def fetch_api_models(
-    api_key: str | None,
-    base_url: str | None,
+    api_key: Optional[str],
+    base_url: Optional[str],
     timeout: float = 5.0,
-) -> list[str] | None:
+) -> Optional[list[str]]:
     """Fetch the list of available model IDs from the provider's ``/models`` endpoint.
 
     Returns a list of model ID strings, or ``None`` if the endpoint could not
@@ -231,10 +267,10 @@ def fetch_api_models(
 
 def validate_requested_model(
     model_name: str,
-    provider: str | None,
+    provider: Optional[str],
     *,
-    api_key: str | None = None,
-    base_url: str | None = None,
+    api_key: Optional[str] = None,
+    base_url: Optional[str] = None,
 ) -> dict[str, Any]:
     """
     Validate a ``/model`` value for the active provider.
@@ -269,6 +305,15 @@ def validate_requested_model(
             "message": "Model names cannot contain spaces.",
         }
 
+    # Custom endpoints can serve any model — skip validation
+    if normalized == "custom":
+        return {
+            "accepted": True,
+            "persist": True,
+            "recognized": False,
+            "message": None,
+        }
+
     # Probe the live API to check if the model actually exists
     api_models = fetch_api_models(api_key, base_url)
 
@@ -292,7 +337,10 @@ def validate_requested_model(
                 "accepted": False,
                 "persist": False,
                 "recognized": False,
-                "message": (f"Error: `{requested}` is not a valid model for this provider.{suggestion_text}"),
+                "message": (
+                    f"Error: `{requested}` is not a valid model for this provider."
+                    f"{suggestion_text}"
+                ),
             }
 
     # api_models is None — couldn't reach API, fall back to catalog check

hermes_cli/pairing.py

@@ -8,7 +8,6 @@ Usage:
     hermes pairing clear-pending     # Clear all expired/pending codes
 """
 
-
 def pairing_command(args):
     """Handle hermes pairing subcommands."""
     from gateway.pairing import PairingStore
@@ -73,10 +72,10 @@ def _cmd_approve(store, platform: str, code: str):
         name = result.get("user_name", "")
         display = f"{name} ({uid})" if name else uid
         print(f"\n  Approved! User {display} on {platform} can now use the bot~")
-        print("  They'll be recognized automatically on their next message.\n")
+        print(f"  They'll be recognized automatically on their next message.\n")
     else:
         print(f"\n  Code '{code}' not found or expired for platform '{platform}'.")
-        print("  Run 'hermes pairing list' to see pending codes.\n")
+        print(f"  Run 'hermes pairing list' to see pending codes.\n")
 
 
 def _cmd_revoke(store, platform: str, user_id: str):

hermes_cli/runtime_provider.py

@@ -3,22 +3,22 @@
 from __future__ import annotations
 
 import os
-from typing import Any
+from typing import Any, Dict, Optional
 
 from hermes_cli.auth import (
-    PROVIDER_REGISTRY,
     AuthError,
+    PROVIDER_REGISTRY,
     format_auth_error,
-    resolve_api_key_provider_credentials,
-    resolve_codex_runtime_credentials,
-    resolve_nous_runtime_credentials,
     resolve_provider,
+    resolve_nous_runtime_credentials,
+    resolve_codex_runtime_credentials,
+    resolve_api_key_provider_credentials,
 )
 from hermes_cli.config import load_config
 from hermes_constants import OPENROUTER_BASE_URL
 
 
-def _get_model_config() -> dict[str, Any]:
+def _get_model_config() -> Dict[str, Any]:
     config = load_config()
     model_cfg = config.get("model")
     if isinstance(model_cfg, dict):
@@ -28,7 +28,7 @@ def _get_model_config() -> dict[str, Any]:
     return {}
 
 
-def resolve_requested_provider(requested: str | None = None) -> str:
+def resolve_requested_provider(requested: Optional[str] = None) -> str:
     """Resolve provider request from explicit arg, env, then config."""
     if requested and requested.strip():
         return requested.strip().lower()
@@ -48,9 +48,9 @@ def resolve_requested_provider(requested: str | None = None) -> str:
 def _resolve_openrouter_runtime(
     *,
     requested_provider: str,
-    explicit_api_key: str | None = None,
-    explicit_base_url: str | None = None,
-) -> dict[str, Any]:
+    explicit_api_key: Optional[str] = None,
+    explicit_base_url: Optional[str] = None,
+) -> Dict[str, Any]:
     model_cfg = _get_model_config()
     cfg_base_url = model_cfg.get("base_url") if isinstance(model_cfg.get("base_url"), str) else ""
     cfg_provider = model_cfg.get("provider") if isinstance(model_cfg.get("provider"), str) else ""
@@ -66,9 +66,14 @@ def _resolve_openrouter_runtime(
             if not cfg_provider or cfg_provider == "auto":
                 use_config_base_url = True
 
+    # When the user explicitly requested the openrouter provider, skip
+    # OPENAI_BASE_URL — it typically points to a custom / non-OpenRouter
+    # endpoint and would prevent switching back to OpenRouter (#874).
+    skip_openai_base = requested_norm == "openrouter"
+
     base_url = (
         (explicit_base_url or "").strip()
-        or env_openai_base_url
+        or ("" if skip_openai_base else env_openai_base_url)
         or (cfg_base_url.strip() if use_config_base_url else "")
         or env_openrouter_base_url
         or OPENROUTER_BASE_URL
@@ -81,9 +86,19 @@ def _resolve_openrouter_runtime(
     # provider (issues #420, #560).
     _is_openrouter_url = "openrouter.ai" in base_url
     if _is_openrouter_url:
-        api_key = explicit_api_key or os.getenv("OPENROUTER_API_KEY") or os.getenv("OPENAI_API_KEY") or ""
+        api_key = (
+            explicit_api_key
+            or os.getenv("OPENROUTER_API_KEY")
+            or os.getenv("OPENAI_API_KEY")
+            or ""
+        )
     else:
-        api_key = explicit_api_key or os.getenv("OPENAI_API_KEY") or os.getenv("OPENROUTER_API_KEY") or ""
+        api_key = (
+            explicit_api_key
+            or os.getenv("OPENAI_API_KEY")
+            or os.getenv("OPENROUTER_API_KEY")
+            or ""
+        )
 
     source = "explicit" if (explicit_api_key or explicit_base_url) else "env/config"
 
@@ -98,10 +113,10 @@ def _resolve_openrouter_runtime(
 
 def resolve_runtime_provider(
     *,
-    requested: str | None = None,
-    explicit_api_key: str | None = None,
-    explicit_base_url: str | None = None,
-) -> dict[str, Any]:
+    requested: Optional[str] = None,
+    explicit_api_key: Optional[str] = None,
+    explicit_base_url: Optional[str] = None,
+) -> Dict[str, Any]:
     """Resolve runtime provider credentials for agent execution."""
     requested_provider = resolve_requested_provider(requested)
 

hermes_cli/skills_config.py

@@ -0,0 +1,181 @@
+"""
+Skills configuration for Hermes Agent.
+`hermes skills` enters this module.
+
+Toggle individual skills or categories on/off, globally or per-platform.
+Config stored in ~/.hermes/config.yaml under:
+
+  skills:
+    disabled: [skill-a, skill-b]          # global disabled list
+    platform_disabled:                    # per-platform overrides
+      telegram: [skill-c]
+      cli: []
+"""
+from typing import Dict, List, Optional, Set
+
+from hermes_cli.config import load_config, save_config
+from hermes_cli.colors import Colors, color
+
+PLATFORMS = {
+    "cli":      "🖥️  CLI",
+    "telegram": "📱 Telegram",
+    "discord":  "💬 Discord",
+    "slack":    "💼 Slack",
+    "whatsapp": "📱 WhatsApp",
+    "signal":   "📡 Signal",
+    "email":    "📧 Email",
+}
+
+# ─── Config Helpers ───────────────────────────────────────────────────────────
+
+def get_disabled_skills(config: dict, platform: Optional[str] = None) -> Set[str]:
+    """Return disabled skill names. Platform-specific list falls back to global."""
+    skills_cfg = config.get("skills", {})
+    global_disabled = set(skills_cfg.get("disabled", []))
+    if platform is None:
+        return global_disabled
+    platform_disabled = skills_cfg.get("platform_disabled", {}).get(platform)
+    if platform_disabled is None:
+        return global_disabled
+    return set(platform_disabled)
+
+
+def save_disabled_skills(config: dict, disabled: Set[str], platform: Optional[str] = None):
+    """Persist disabled skill names to config."""
+    config.setdefault("skills", {})
+    if platform is None:
+        config["skills"]["disabled"] = sorted(disabled)
+    else:
+        config["skills"].setdefault("platform_disabled", {})
+        config["skills"]["platform_disabled"][platform] = sorted(disabled)
+    save_config(config)
+
+
+# ─── Skill Discovery ─────────────────────────────────────────────────────────
+
+def _list_all_skills() -> List[dict]:
+    """Return all installed skills (ignoring disabled state)."""
+    try:
+        from tools.skills_tool import _find_all_skills
+        return _find_all_skills(skip_disabled=True)
+    except Exception:
+        return []
+
+
+def _get_categories(skills: List[dict]) -> List[str]:
+    """Return sorted unique category names (None -> 'uncategorized')."""
+    return sorted({s["category"] or "uncategorized" for s in skills})
+
+
+# ─── Platform Selection ──────────────────────────────────────────────────────
+
+def _select_platform() -> Optional[str]:
+    """Ask user which platform to configure, or global."""
+    options = [("global", "All platforms (global default)")] + list(PLATFORMS.items())
+    print()
+    print(color("  Configure skills for:", Colors.BOLD))
+    for i, (key, label) in enumerate(options, 1):
+        print(f"  {i}. {label}")
+    print()
+    try:
+        raw = input(color("  Select [1]: ", Colors.YELLOW)).strip()
+    except (KeyboardInterrupt, EOFError):
+        return None
+    if not raw:
+        return None  # global
+    try:
+        idx = int(raw) - 1
+        if 0 <= idx < len(options):
+            key = options[idx][0]
+            return None if key == "global" else key
+    except ValueError:
+        pass
+    return None
+
+
+# ─── Category Toggle ─────────────────────────────────────────────────────────
+
+def _toggle_by_category(skills: List[dict], disabled: Set[str]) -> Set[str]:
+    """Toggle all skills in a category at once."""
+    from hermes_cli.curses_ui import curses_checklist
+
+    categories = _get_categories(skills)
+    cat_labels = []
+    # A category is "enabled" (checked) when NOT all its skills are disabled
+    pre_selected = set()
+    for i, cat in enumerate(categories):
+        cat_skills = [s["name"] for s in skills if (s["category"] or "uncategorized") == cat]
+        cat_labels.append(f"{cat} ({len(cat_skills)} skills)")
+        if not all(s in disabled for s in cat_skills):
+            pre_selected.add(i)
+
+    chosen = curses_checklist(
+        "Categories — toggle entire categories",
+        cat_labels, pre_selected, cancel_returns=pre_selected,
+    )
+
+    new_disabled = set(disabled)
+    for i, cat in enumerate(categories):
+        cat_skills = {s["name"] for s in skills if (s["category"] or "uncategorized") == cat}
+        if i in chosen:
+            new_disabled -= cat_skills  # category enabled → remove from disabled
+        else:
+            new_disabled |= cat_skills  # category disabled → add to disabled
+    return new_disabled
+
+
+# ─── Entry Point ──────────────────────────────────────────────────────────────
+
+def skills_command(args=None):
+    """Entry point for `hermes skills`."""
+    from hermes_cli.curses_ui import curses_checklist
+
+    config = load_config()
+    skills = _list_all_skills()
+
+    if not skills:
+        print(color("  No skills installed.", Colors.DIM))
+        return
+
+    # Step 1: Select platform
+    platform = _select_platform()
+    platform_label = PLATFORMS.get(platform, "All platforms") if platform else "All platforms"
+
+    # Step 2: Select mode — individual or by category
+    print()
+    print(color(f"  Configure for: {platform_label}", Colors.DIM))
+    print()
+    print("  1. Toggle individual skills")
+    print("  2. Toggle by category")
+    print()
+    try:
+        mode = input(color("  Select [1]: ", Colors.YELLOW)).strip() or "1"
+    except (KeyboardInterrupt, EOFError):
+        return
+
+    disabled = get_disabled_skills(config, platform)
+
+    if mode == "2":
+        new_disabled = _toggle_by_category(skills, disabled)
+    else:
+        # Build labels and map indices → skill names
+        labels = [
+            f"{s['name']}  ({s['category'] or 'uncategorized'})  —  {s['description'][:55]}"
+            for s in skills
+        ]
+        # "selected" = enabled (not disabled) — matches the [✓] convention
+        pre_selected = {i for i, s in enumerate(skills) if s["name"] not in disabled}
+        chosen = curses_checklist(
+            f"Skills for {platform_label}",
+            labels, pre_selected, cancel_returns=pre_selected,
+        )
+        # Anything NOT chosen is disabled
+        new_disabled = {skills[i]["name"] for i in range(len(skills)) if i not in chosen}
+
+    if new_disabled == disabled:
+        print(color("  No changes.", Colors.DIM))
+        return
+
+    save_disabled_skills(config, new_disabled, platform)
+    enabled_count = len(skills) - len(new_disabled)
+    print(color(f"✓ Saved: {enabled_count} enabled, {len(new_disabled)} disabled ({platform_label}).", Colors.GREEN))

hermes_cli/skills_hub.py

@@ -13,6 +13,7 @@ handler are thin wrappers that parse args and delegate.
 import json
 import shutil
 from pathlib import Path
+from typing import Optional
 
 from rich.console import Console
 from rich.panel import Panel
@@ -28,7 +29,6 @@ _console = Console()
 # Shared do_* functions
 # ---------------------------------------------------------------------------
 
-
 def _resolve_short_name(name: str, sources, console: Console) -> str:
     """
     Resolve a short skill name (e.g. 'pptx') to a full identifier by searching
@@ -57,9 +57,7 @@ def _resolve_short_name(name: str, sources, console: Console) -> str:
         table.add_column("Trust", style="dim")
         table.add_column("Identifier", style="bold cyan")
         for r in exact:
-            trust_style = {"builtin": "bright_cyan", "trusted": "green", "community": "yellow"}.get(
-                r.trust_level, "dim"
-            )
+            trust_style = {"builtin": "bright_cyan", "trusted": "green", "community": "yellow"}.get(r.trust_level, "dim")
             trust_label = "official" if r.source == "official" else r.trust_level
             table.add_row(r.source, f"[{trust_style}]{trust_label}[/]", r.identifier)
         c.print(table)
@@ -78,7 +76,8 @@ def _resolve_short_name(name: str, sources, console: Console) -> str:
     return ""
 
 
-def do_search(query: str, source: str = "all", limit: int = 10, console: Console | None = None) -> None:
+def do_search(query: str, source: str = "all", limit: int = 10,
+              console: Optional[Console] = None) -> None:
     """Search registries and display results as a Rich table."""
     from tools.skills_hub import GitHubAuth, create_source_router, unified_search
 
@@ -112,19 +111,18 @@ def do_search(query: str, source: str = "all", limit: int = 10, console: Console
         )
 
     c.print(table)
-    c.print(
-        "[dim]Use: hermes skills inspect <identifier> to preview, hermes skills install <identifier> to install[/]\n"
-    )
+    c.print("[dim]Use: hermes skills inspect <identifier> to preview, "
+            "hermes skills install <identifier> to install[/]\n")
 
 
-def do_browse(page: int = 1, page_size: int = 20, source: str = "all", console: Console | None = None) -> None:
+def do_browse(page: int = 1, page_size: int = 20, source: str = "all",
+              console: Optional[Console] = None) -> None:
     """Browse all available skills across registries, paginated.
 
     Official skills are always shown first, regardless of source filter.
     """
     from tools.skills_hub import (
-        GitHubAuth,
-        create_source_router,
+        GitHubAuth, create_source_router, OptionalSkillSource, SkillMeta,
     )
 
     # Clamp page_size to safe range
@@ -138,7 +136,8 @@ def do_browse(page: int = 1, page_size: int = 20, source: str = "all", console:
     # Collect results from all (or filtered) sources
     # Use empty query to get everything; per-source limits prevent overload
     _TRUST_RANK = {"builtin": 3, "trusted": 2, "community": 1}
-    _PER_SOURCE_LIMIT = {"official": 100, "github": 100, "clawhub": 50, "claude-marketplace": 50, "lobehub": 50}
+    _PER_SOURCE_LIMIT = {"official": 100, "github": 100, "clawhub": 50,
+                         "claude-marketplace": 50, "lobehub": 50}
 
     all_results: list = []
     source_counts: dict = {}
@@ -169,13 +168,11 @@ def do_browse(page: int = 1, page_size: int = 20, source: str = "all", console:
     deduped = list(seen.values())
 
     # Sort: official first, then by trust level (desc), then alphabetically
-    deduped.sort(
-        key=lambda r: (
-            -_TRUST_RANK.get(r.trust_level, 0),
-            r.source != "official",
-            r.name.lower(),
-        )
-    )
+    deduped.sort(key=lambda r: (
+        -_TRUST_RANK.get(r.trust_level, 0),
+        r.source != "official",
+        r.name.lower(),
+    ))
 
     # Paginate
     total = len(deduped)
@@ -190,7 +187,8 @@ def do_browse(page: int = 1, page_size: int = 20, source: str = "all", console:
 
     # Build header
     source_label = f"— {source}" if source != "all" else "— all sources"
-    c.print(f"\n[bold]Skills Hub — Browse {source_label}[/]  [dim]({total} skills, page {page}/{total_pages})[/]")
+    c.print(f"\n[bold]Skills Hub — Browse {source_label}[/]"
+            f"  [dim]({total} skills, page {page}/{total_pages})[/]")
     if official_count > 0 and page == 1:
         c.print(f"[bright_cyan]★ {official_count} official optional skill(s) from Nous Research[/]")
     c.print()
@@ -204,7 +202,8 @@ def do_browse(page: int = 1, page_size: int = 20, source: str = "all", console:
     table.add_column("Trust", width=10)
 
     for i, r in enumerate(page_items, start=start + 1):
-        trust_style = {"builtin": "bright_cyan", "trusted": "green", "community": "yellow"}.get(r.trust_level, "dim")
+        trust_style = {"builtin": "bright_cyan", "trusted": "green",
+                       "community": "yellow"}.get(r.trust_level, "dim")
         trust_label = "★ official" if r.source == "official" else r.trust_level
 
         desc = r.description[:50]
@@ -236,22 +235,18 @@ def do_browse(page: int = 1, page_size: int = 20, source: str = "all", console:
         parts = [f"{sid}: {ct}" for sid, ct in sorted(source_counts.items())]
         c.print(f"  [dim]Sources: {', '.join(parts)}[/]")
 
-    c.print(
-        "[dim]Use: hermes skills inspect <identifier> to preview, hermes skills install <identifier> to install[/]\n"
-    )
+    c.print("[dim]Use: hermes skills inspect <identifier> to preview, "
+            "hermes skills install <identifier> to install[/]\n")
 
 
-def do_install(identifier: str, category: str = "", force: bool = False, console: Console | None = None) -> None:
+def do_install(identifier: str, category: str = "", force: bool = False,
+               console: Optional[Console] = None) -> None:
     """Fetch, quarantine, scan, confirm, and install a skill."""
-    from tools.skills_guard import format_scan_report, scan_skill, should_allow_install
     from tools.skills_hub import (
-        GitHubAuth,
-        HubLockFile,
-        create_source_router,
-        ensure_hub_dirs,
-        install_from_quarantine,
-        quarantine_bundle,
+        GitHubAuth, create_source_router, ensure_hub_dirs,
+        quarantine_bundle, install_from_quarantine, HubLockFile,
     )
+    from tools.skills_guard import scan_skill, should_allow_install, format_scan_report
 
     c = console or _console
     ensure_hub_dirs()
@@ -309,43 +304,33 @@ def do_install(identifier: str, category: str = "", force: bool = False, console
         # Clean up quarantine
         shutil.rmtree(q_path, ignore_errors=True)
         from tools.skills_hub import append_audit_log
-
-        append_audit_log(
-            "BLOCKED",
-            bundle.name,
-            bundle.source,
-            bundle.trust_level,
-            result.verdict,
-            f"{len(result.findings)}_findings",
-        )
+        append_audit_log("BLOCKED", bundle.name, bundle.source,
+                         bundle.trust_level, result.verdict,
+                         f"{len(result.findings)}_findings")
         return
 
     # Confirm with user — show appropriate warning based on source
     if not force:
         c.print()
         if bundle.source == "official":
-            c.print(
-                Panel(
-                    "[bold bright_cyan]This is an official optional skill maintained by Nous Research.[/]\n\n"
-                    "It ships with hermes-agent but is not activated by default.\n"
-                    "Installing will copy it to your skills directory where the agent can use it.\n\n"
-                    f"Files will be at: [cyan]~/.hermes/skills/{category + '/' if category else ''}{bundle.name}/[/]",
-                    title="Official Skill",
-                    border_style="bright_cyan",
-                )
-            )
+            c.print(Panel(
+                "[bold bright_cyan]This is an official optional skill maintained by Nous Research.[/]\n\n"
+                "It ships with hermes-agent but is not activated by default.\n"
+                "Installing will copy it to your skills directory where the agent can use it.\n\n"
+                f"Files will be at: [cyan]~/.hermes/skills/{category + '/' if category else ''}{bundle.name}/[/]",
+                title="Official Skill",
+                border_style="bright_cyan",
+            ))
         else:
-            c.print(
-                Panel(
-                    "[bold yellow]You are installing a third-party skill at your own risk.[/]\n\n"
-                    "External skills can contain instructions that influence agent behavior,\n"
-                    "shell commands, and scripts. Even after automated scanning, you should\n"
-                    "review the installed files before use.\n\n"
-                    f"Files will be at: [cyan]~/.hermes/skills/{category + '/' if category else ''}{bundle.name}/[/]",
-                    title="Disclaimer",
-                    border_style="yellow",
-                )
-            )
+            c.print(Panel(
+                "[bold yellow]You are installing a third-party skill at your own risk.[/]\n\n"
+                "External skills can contain instructions that influence agent behavior,\n"
+                "shell commands, and scripts. Even after automated scanning, you should\n"
+                "review the installed files before use.\n\n"
+                f"Files will be at: [cyan]~/.hermes/skills/{category + '/' if category else ''}{bundle.name}/[/]",
+                title="Disclaimer",
+                border_style="yellow",
+            ))
         c.print(f"[bold]Install '{bundle.name}'?[/]")
         try:
             answer = input("Confirm [y/N]: ").strip().lower()
@@ -359,12 +344,11 @@ def do_install(identifier: str, category: str = "", force: bool = False, console
     # Install
     install_dir = install_from_quarantine(q_path, bundle.name, category, bundle, result)
     from tools.skills_hub import SKILLS_DIR
-
     c.print(f"[bold green]Installed:[/] {install_dir.relative_to(SKILLS_DIR)}")
     c.print(f"[dim]Files: {', '.join(bundle.files.keys())}[/]\n")
 
 
-def do_inspect(identifier: str, console: Console | None = None) -> None:
+def do_inspect(identifier: str, console: Optional[Console] = None) -> None:
     """Preview a skill's SKILL.md content without installing."""
     from tools.skills_hub import GitHubAuth, create_source_router
 
@@ -422,15 +406,17 @@ def do_inspect(identifier: str, console: Console | None = None) -> None:
     c.print()
 
 
-def do_list(source_filter: str = "all", console: Console | None = None) -> None:
-    """List installed skills, distinguishing builtins from hub-installed."""
+def do_list(source_filter: str = "all", console: Optional[Console] = None) -> None:
+    """List installed skills, distinguishing hub, builtin, and local skills."""
     from tools.skills_hub import HubLockFile, ensure_hub_dirs
+    from tools.skills_sync import _read_manifest
     from tools.skills_tool import _find_all_skills
 
     c = console or _console
     ensure_hub_dirs()
     lock = HubLockFile()
     hub_installed = {e["name"]: e for e in lock.list_installed()}
+    builtin_names = set(_read_manifest())
 
     all_skills = _find_all_skills()
 
@@ -440,35 +426,48 @@ def do_list(source_filter: str = "all", console: Console | None = None) -> None:
     table.add_column("Source", style="dim")
     table.add_column("Trust", style="dim")
 
+    hub_count = 0
+    builtin_count = 0
+    local_count = 0
+
     for skill in sorted(all_skills, key=lambda s: (s.get("category") or "", s["name"])):
         name = skill["name"]
         category = skill.get("category", "")
         hub_entry = hub_installed.get(name)
 
         if hub_entry:
+            source_type = "hub"
             source_display = hub_entry.get("source", "hub")
             trust = hub_entry.get("trust_level", "community")
-        else:
+            hub_count += 1
+        elif name in builtin_names:
+            source_type = "builtin"
             source_display = "builtin"
             trust = "builtin"
+            builtin_count += 1
+        else:
+            source_type = "local"
+            source_display = "local"
+            trust = "local"
+            local_count += 1
 
-        if source_filter == "hub" and not hub_entry:
-            continue
-        if source_filter == "builtin" and hub_entry:
+        if source_filter != "all" and source_filter != source_type:
             continue
 
-        trust_style = {"builtin": "bright_cyan", "trusted": "green", "community": "yellow"}.get(trust, "dim")
+        trust_style = {"builtin": "bright_cyan", "trusted": "green", "community": "yellow", "local": "dim"}.get(trust, "dim")
         trust_label = "official" if source_display == "official" else trust
         table.add_row(name, category, source_display, f"[{trust_style}]{trust_label}[/]")
 
     c.print(table)
-    c.print(f"[dim]{len(hub_installed)} hub-installed, {len(all_skills) - len(hub_installed)} builtin[/]\n")
+    c.print(
+        f"[dim]{hub_count} hub-installed, {builtin_count} builtin, {local_count} local[/]\n"
+    )
 
 
-def do_audit(name: str | None = None, console: Console | None = None) -> None:
+def do_audit(name: Optional[str] = None, console: Optional[Console] = None) -> None:
     """Re-run security scan on installed hub skills."""
-    from tools.skills_guard import format_scan_report, scan_skill
-    from tools.skills_hub import SKILLS_DIR, HubLockFile
+    from tools.skills_hub import HubLockFile, SKILLS_DIR
+    from tools.skills_guard import scan_skill, format_scan_report
 
     c = console or _console
     lock = HubLockFile()
@@ -498,7 +497,7 @@ def do_audit(name: str | None = None, console: Console | None = None) -> None:
         c.print()
 
 
-def do_uninstall(name: str, console: Console | None = None) -> None:
+def do_uninstall(name: str, console: Optional[Console] = None) -> None:
     """Remove a hub-installed skill with confirmation."""
     from tools.skills_hub import uninstall_skill
 
@@ -520,7 +519,7 @@ def do_uninstall(name: str, console: Console | None = None) -> None:
         c.print(f"[bold red]Error:[/] {msg}\n")
 
 
-def do_tap(action: str, repo: str = "", console: Console | None = None) -> None:
+def do_tap(action: str, repo: str = "", console: Optional[Console] = None) -> None:
     """Manage taps (custom GitHub repo sources)."""
     from tools.skills_hub import TapsManager
 
@@ -562,10 +561,11 @@ def do_tap(action: str, repo: str = "", console: Console | None = None) -> None:
         c.print(f"[bold red]Unknown tap action:[/] {action}. Use: list, add, remove\n")
 
 
-def do_publish(skill_path: str, target: str = "github", repo: str = "", console: Console | None = None) -> None:
+def do_publish(skill_path: str, target: str = "github", repo: str = "",
+               console: Optional[Console] = None) -> None:
     """Publish a local skill to a registry (GitHub PR or ClawHub submission)."""
-    from tools.skills_guard import format_scan_report, scan_skill
-    from tools.skills_hub import SKILLS_DIR, GitHubAuth
+    from tools.skills_hub import GitHubAuth, SKILLS_DIR
+    from tools.skills_guard import scan_skill, format_scan_report
 
     c = console or _console
     path = Path(skill_path)
@@ -579,16 +579,14 @@ def do_publish(skill_path: str, target: str = "github", repo: str = "", console:
 
     # Validate the skill
     import yaml
-
     skill_md = (path / "SKILL.md").read_text(encoding="utf-8")
     fm = {}
     if skill_md.startswith("---"):
         import re
-
-        match = re.search(r"\n---\s*\n", skill_md[3:])
+        match = re.search(r'\n---\s*\n', skill_md[3:])
         if match:
             try:
-                fm = yaml.safe_load(skill_md[3 : match.start() + 3]) or {}
+                fm = yaml.safe_load(skill_md[3:match.start() + 3]) or {}
             except yaml.YAMLError:
                 pass
 
@@ -608,18 +606,14 @@ def do_publish(skill_path: str, target: str = "github", repo: str = "", console:
 
     if target == "github":
         if not repo:
-            c.print(
-                "[bold red]Error:[/] --repo required for GitHub publish.\n"
-                "Usage: hermes skills publish <path> --to github --repo owner/repo\n"
-            )
+            c.print("[bold red]Error:[/] --repo required for GitHub publish.\n"
+                    "Usage: hermes skills publish <path> --to github --repo owner/repo\n")
             return
 
         auth = GitHubAuth()
         if not auth.is_authenticated():
-            c.print(
-                "[bold red]Error:[/] GitHub authentication required.\n"
-                "Set GITHUB_TOKEN in ~/.hermes/.env or run 'gh auth login'.\n"
-            )
+            c.print("[bold red]Error:[/] GitHub authentication required.\n"
+                    "Set GITHUB_TOKEN in ~/.hermes/.env or run 'gh auth login'.\n")
             return
 
         c.print(f"[bold]Publishing '{name}' to {repo}...[/]")
@@ -630,12 +624,14 @@ def do_publish(skill_path: str, target: str = "github", repo: str = "", console:
             c.print(f"[bold red]Error:[/] {msg}\n")
 
     elif target == "clawhub":
-        c.print("[yellow]ClawHub publishing is not yet supported. Submit manually at https://clawhub.ai/submit[/]\n")
+        c.print("[yellow]ClawHub publishing is not yet supported. "
+                "Submit manually at https://clawhub.ai/submit[/]\n")
     else:
         c.print(f"[bold red]Unknown target:[/] {target}. Use 'github' or 'clawhub'.\n")
 
 
-def _github_publish(skill_path: Path, skill_name: str, target_repo: str, auth) -> tuple:
+def _github_publish(skill_path: Path, skill_name: str, target_repo: str,
+                    auth) -> tuple:
     """Create a PR to a GitHub repo with the skill. Returns (success, message)."""
     import httpx
 
@@ -645,8 +641,7 @@ def _github_publish(skill_path: Path, skill_name: str, target_repo: str, auth) -
     try:
         resp = httpx.post(
             f"https://api.github.com/repos/{target_repo}/forks",
-            headers=headers,
-            timeout=30,
+            headers=headers, timeout=30,
         )
         if resp.status_code in (200, 202):
             fork = resp.json()
@@ -662,8 +657,7 @@ def _github_publish(skill_path: Path, skill_name: str, target_repo: str, auth) -
     try:
         resp = httpx.get(
             f"https://api.github.com/repos/{target_repo}",
-            headers=headers,
-            timeout=15,
+            headers=headers, timeout=15,
         )
         default_branch = resp.json().get("default_branch", "main")
     except Exception:
@@ -673,8 +667,7 @@ def _github_publish(skill_path: Path, skill_name: str, target_repo: str, auth) -
     try:
         resp = httpx.get(
             f"https://api.github.com/repos/{fork_repo}/git/refs/heads/{default_branch}",
-            headers=headers,
-            timeout=15,
+            headers=headers, timeout=15,
         )
         base_sha = resp.json()["object"]["sha"]
     except Exception as e:
@@ -685,8 +678,7 @@ def _github_publish(skill_path: Path, skill_name: str, target_repo: str, auth) -
     try:
         httpx.post(
             f"https://api.github.com/repos/{fork_repo}/git/refs",
-            headers=headers,
-            timeout=15,
+            headers=headers, timeout=15,
             json={"ref": f"refs/heads/{branch_name}", "sha": base_sha},
         )
     except Exception as e:
@@ -700,12 +692,10 @@ def _github_publish(skill_path: Path, skill_name: str, target_repo: str, auth) -
         upload_path = f"skills/{skill_name}/{rel}"
         try:
             import base64
-
             content_b64 = base64.b64encode(f.read_bytes()).decode()
             httpx.put(
                 f"https://api.github.com/repos/{fork_repo}/contents/{upload_path}",
-                headers=headers,
-                timeout=15,
+                headers=headers, timeout=15,
                 json={
                     "message": f"Add {skill_name} skill: {rel}",
                     "content": content_b64,
@@ -719,12 +709,11 @@ def _github_publish(skill_path: Path, skill_name: str, target_repo: str, auth) -
     try:
         resp = httpx.post(
             f"https://api.github.com/repos/{target_repo}/pulls",
-            headers=headers,
-            timeout=15,
+            headers=headers, timeout=15,
             json={
                 "title": f"Add skill: {skill_name}",
                 "body": f"Submitting the `{skill_name}` skill via Hermes Skills Hub.\n\n"
-                f"This skill was scanned by the Hermes Skills Guard before submission.",
+                        f"This skill was scanned by the Hermes Skills Guard before submission.",
                 "head": f"{fork_repo.split('/')[0]}:{branch_name}",
                 "base": default_branch,
             },
@@ -738,7 +727,7 @@ def _github_publish(skill_path: Path, skill_name: str, target_repo: str, auth) -
         return False, f"Network error creating PR: {e}"
 
 
-def do_snapshot_export(output_path: str, console: Console | None = None) -> None:
+def do_snapshot_export(output_path: str, console: Optional[Console] = None) -> None:
     """Export current hub skill configuration to a portable JSON file."""
     from tools.skills_hub import HubLockFile, TapsManager
 
@@ -751,15 +740,16 @@ def do_snapshot_export(output_path: str, console: Console | None = None) -> None
 
     snapshot = {
         "hermes_version": "0.1.0",
-        "exported_at": __import__("datetime").datetime.now(__import__("datetime").timezone.utc).isoformat(),
+        "exported_at": __import__("datetime").datetime.now(
+            __import__("datetime").timezone.utc
+        ).isoformat(),
         "skills": [
             {
                 "name": entry["name"],
                 "source": entry.get("source", ""),
                 "identifier": entry.get("identifier", ""),
                 "category": str(Path(entry.get("install_path", "")).parent)
-                if "/" in entry.get("install_path", "")
-                else "",
+                            if "/" in entry.get("install_path", "") else "",
             }
             for entry in installed
         ],
@@ -772,7 +762,8 @@ def do_snapshot_export(output_path: str, console: Console | None = None) -> None
     c.print(f"[dim]{len(installed)} skill(s), {len(tap_list)} tap(s)[/]\n")
 
 
-def do_snapshot_import(input_path: str, force: bool = False, console: Console | None = None) -> None:
+def do_snapshot_import(input_path: str, force: bool = False,
+                       console: Optional[Console] = None) -> None:
     """Re-install skills from a snapshot file."""
     from tools.skills_hub import TapsManager
 
@@ -822,7 +813,6 @@ def do_snapshot_import(input_path: str, force: bool = False, console: Console |
 # CLI argparse entry point
 # ---------------------------------------------------------------------------
 
-
 def skills_command(args) -> None:
     """Router for `hermes skills <subcommand>` — called from hermes_cli/main.py."""
     action = getattr(args, "skills_action", None)
@@ -863,9 +853,7 @@ def skills_command(args) -> None:
             return
         do_tap(tap_action, repo=repo)
     else:
-        _console.print(
-            "Usage: hermes skills [browse|search|install|inspect|list|audit|uninstall|publish|snapshot|tap]\n"
-        )
+        _console.print("Usage: hermes skills [browse|search|install|inspect|list|audit|uninstall|publish|snapshot|tap]\n")
         _console.print("Run 'hermes skills <command> --help' for details.\n")
 
 
@@ -873,8 +861,7 @@ def skills_command(args) -> None:
 # Slash command entry point (/skills in chat)
 # ---------------------------------------------------------------------------
 
-
-def handle_skills_slash(cmd: str, console: Console | None = None) -> None:
+def handle_skills_slash(cmd: str, console: Optional[Console] = None) -> None:
     """
     Parse and dispatch `/skills <subcommand> [args]` from the chat interface.
 
@@ -1035,19 +1022,17 @@ def handle_skills_slash(cmd: str, console: Console | None = None) -> None:
 
 def _print_skills_help(console: Console) -> None:
     """Print help for the /skills slash command."""
-    console.print(
-        Panel(
-            "[bold]Skills Hub Commands:[/]\n\n"
-            "  [cyan]browse[/] [--source official]   Browse all available skills (paginated)\n"
-            "  [cyan]search[/] <query>              Search registries for skills\n"
-            "  [cyan]install[/] <identifier>        Install a skill (with security scan)\n"
-            "  [cyan]inspect[/] <identifier>        Preview a skill without installing\n"
-            "  [cyan]list[/] [--source hub|builtin] List installed skills\n"
-            "  [cyan]audit[/] [name]                Re-scan hub skills for security\n"
-            "  [cyan]uninstall[/] <name>            Remove a hub-installed skill\n"
-            "  [cyan]publish[/] <path> --repo <r>   Publish a skill to GitHub via PR\n"
-            "  [cyan]snapshot[/] export|import      Export/import skill configurations\n"
-            "  [cyan]tap[/] list|add|remove         Manage skill sources\n",
-            title="/skills",
-        )
-    )
+    console.print(Panel(
+        "[bold]Skills Hub Commands:[/]\n\n"
+        "  [cyan]browse[/] [--source official]   Browse all available skills (paginated)\n"
+        "  [cyan]search[/] <query>              Search registries for skills\n"
+        "  [cyan]install[/] <identifier>        Install a skill (with security scan)\n"
+        "  [cyan]inspect[/] <identifier>        Preview a skill without installing\n"
+        "  [cyan]list[/] [--source hub|builtin|local] List installed skills\n"
+        "  [cyan]audit[/] [name]                Re-scan hub skills for security\n"
+        "  [cyan]uninstall[/] <name>            Remove a hub-installed skill\n"
+        "  [cyan]publish[/] <path> --repo <r>   Publish a skill to GitHub via PR\n"
+        "  [cyan]snapshot[/] export|import      Export/import skill configurations\n"
+        "  [cyan]tap[/] list|add|remove         Manage skill sources\n",
+        title="/skills",
+    ))

hermes_cli/skin_engine.py

@@ -0,0 +1,630 @@
+"""Hermes CLI skin/theme engine.
+
+A data-driven skin system that lets users customize the CLI's visual appearance.
+Skins are defined as YAML files in ~/.hermes/skins/ or as built-in presets.
+No code changes are needed to add a new skin.
+
+SKIN YAML SCHEMA
+================
+
+All fields are optional. Missing values inherit from the ``default`` skin.
+
+.. code-block:: yaml
+
+    # Required: skin identity
+    name: mytheme                         # Unique skin name (lowercase, hyphens ok)
+    description: Short description        # Shown in /skin listing
+
+    # Colors: hex values for Rich markup (banner, UI, response box)
+    colors:
+      banner_border: "#CD7F32"            # Panel border color
+      banner_title: "#FFD700"             # Panel title text color
+      banner_accent: "#FFBF00"            # Section headers (Available Tools, etc.)
+      banner_dim: "#B8860B"               # Dim/muted text (separators, labels)
+      banner_text: "#FFF8DC"              # Body text (tool names, skill names)
+      ui_accent: "#FFBF00"               # General UI accent
+      ui_label: "#4dd0e1"                # UI labels
+      ui_ok: "#4caf50"                   # Success indicators
+      ui_error: "#ef5350"                # Error indicators
+      ui_warn: "#ffa726"                 # Warning indicators
+      prompt: "#FFF8DC"                  # Prompt text color
+      input_rule: "#CD7F32"              # Input area horizontal rule
+      response_border: "#FFD700"         # Response box border (ANSI)
+      session_label: "#DAA520"           # Session label color
+      session_border: "#8B8682"          # Session ID dim color
+
+    # Spinner: customize the animated spinner during API calls
+    spinner:
+      waiting_faces:                      # Faces shown while waiting for API
+        - "(⚔)"
+        - "(⛨)"
+      thinking_faces:                     # Faces shown during reasoning
+        - "(⌁)"
+        - "(<>)"
+      thinking_verbs:                     # Verbs for spinner messages
+        - "forging"
+        - "plotting"
+      wings:                              # Optional left/right spinner decorations
+        - ["⟪⚔", "⚔⟫"]                  # Each entry is [left, right] pair
+        - ["⟪▲", "▲⟫"]
+
+    # Branding: text strings used throughout the CLI
+    branding:
+      agent_name: "Hermes Agent"          # Banner title, status display
+      welcome: "Welcome message"          # Shown at CLI startup
+      goodbye: "Goodbye! ⚕"              # Shown on exit
+      response_label: " ⚕ Hermes "       # Response box header label
+      prompt_symbol: "❯ "                # Input prompt symbol
+      help_header: "(^_^)? Commands"      # /help header text
+
+    # Tool prefix: character for tool output lines (default: ┊)
+    tool_prefix: "┊"
+
+USAGE
+=====
+
+.. code-block:: python
+
+    from hermes_cli.skin_engine import get_active_skin, list_skins, set_active_skin
+
+    skin = get_active_skin()
+    print(skin.colors["banner_title"])    # "#FFD700"
+    print(skin.get_branding("agent_name"))  # "Hermes Agent"
+
+    set_active_skin("ares")               # Switch to built-in ares skin
+    set_active_skin("mytheme")            # Switch to user skin from ~/.hermes/skins/
+
+BUILT-IN SKINS
+==============
+
+- ``default`` — Classic Hermes gold/kawaii (the current look)
+- ``ares``    — Crimson/bronze war-god theme with custom spinner wings
+- ``mono``    — Clean grayscale monochrome
+- ``slate``   — Cool blue developer-focused theme
+
+USER SKINS
+==========
+
+Drop a YAML file in ``~/.hermes/skins/<name>.yaml`` following the schema above.
+Activate with ``/skin <name>`` in the CLI or ``display.skin: <name>`` in config.yaml.
+"""
+
+import logging
+import os
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Tuple
+
+logger = logging.getLogger(__name__)
+
+
+# =============================================================================
+# Skin data structure
+# =============================================================================
+
+@dataclass
+class SkinConfig:
+    """Complete skin configuration."""
+    name: str
+    description: str = ""
+    colors: Dict[str, str] = field(default_factory=dict)
+    spinner: Dict[str, Any] = field(default_factory=dict)
+    branding: Dict[str, str] = field(default_factory=dict)
+    tool_prefix: str = "┊"
+    banner_logo: str = ""    # Rich-markup ASCII art logo (replaces HERMES_AGENT_LOGO)
+    banner_hero: str = ""    # Rich-markup hero art (replaces HERMES_CADUCEUS)
+
+    def get_color(self, key: str, fallback: str = "") -> str:
+        """Get a color value with fallback."""
+        return self.colors.get(key, fallback)
+
+    def get_spinner_list(self, key: str) -> List[str]:
+        """Get a spinner list (faces, verbs, etc.)."""
+        return self.spinner.get(key, [])
+
+    def get_spinner_wings(self) -> List[Tuple[str, str]]:
+        """Get spinner wing pairs, or empty list if none."""
+        raw = self.spinner.get("wings", [])
+        result = []
+        for pair in raw:
+            if isinstance(pair, (list, tuple)) and len(pair) == 2:
+                result.append((str(pair[0]), str(pair[1])))
+        return result
+
+    def get_branding(self, key: str, fallback: str = "") -> str:
+        """Get a branding value with fallback."""
+        return self.branding.get(key, fallback)
+
+
+# =============================================================================
+# Built-in skin definitions
+# =============================================================================
+
+_BUILTIN_SKINS: Dict[str, Dict[str, Any]] = {
+    "default": {
+        "name": "default",
+        "description": "Classic Hermes — gold and kawaii",
+        "colors": {
+            "banner_border": "#CD7F32",
+            "banner_title": "#FFD700",
+            "banner_accent": "#FFBF00",
+            "banner_dim": "#B8860B",
+            "banner_text": "#FFF8DC",
+            "ui_accent": "#FFBF00",
+            "ui_label": "#4dd0e1",
+            "ui_ok": "#4caf50",
+            "ui_error": "#ef5350",
+            "ui_warn": "#ffa726",
+            "prompt": "#FFF8DC",
+            "input_rule": "#CD7F32",
+            "response_border": "#FFD700",
+            "session_label": "#DAA520",
+            "session_border": "#8B8682",
+        },
+        "spinner": {
+            # Empty = use hardcoded defaults in display.py
+        },
+        "branding": {
+            "agent_name": "Hermes Agent",
+            "welcome": "Welcome to Hermes Agent! Type your message or /help for commands.",
+            "goodbye": "Goodbye! ⚕",
+            "response_label": " ⚕ Hermes ",
+            "prompt_symbol": "❯ ",
+            "help_header": "(^_^)? Available Commands",
+        },
+        "tool_prefix": "┊",
+    },
+    "ares": {
+        "name": "ares",
+        "description": "War-god theme — crimson and bronze",
+        "colors": {
+            "banner_border": "#9F1C1C",
+            "banner_title": "#C7A96B",
+            "banner_accent": "#DD4A3A",
+            "banner_dim": "#6B1717",
+            "banner_text": "#F1E6CF",
+            "ui_accent": "#DD4A3A",
+            "ui_label": "#C7A96B",
+            "ui_ok": "#4caf50",
+            "ui_error": "#ef5350",
+            "ui_warn": "#ffa726",
+            "prompt": "#F1E6CF",
+            "input_rule": "#9F1C1C",
+            "response_border": "#C7A96B",
+            "session_label": "#C7A96B",
+            "session_border": "#6E584B",
+        },
+        "spinner": {
+            "waiting_faces": ["(⚔)", "(⛨)", "(▲)", "(<>)", "(/)"],
+            "thinking_faces": ["(⚔)", "(⛨)", "(▲)", "(⌁)", "(<>)"],
+            "thinking_verbs": [
+                "forging", "marching", "sizing the field", "holding the line",
+                "hammering plans", "tempering steel", "plotting impact", "raising the shield",
+            ],
+            "wings": [
+                ["⟪⚔", "⚔⟫"],
+                ["⟪▲", "▲⟫"],
+                ["⟪╸", "╺⟫"],
+                ["⟪⛨", "⛨⟫"],
+            ],
+        },
+        "branding": {
+            "agent_name": "Ares Agent",
+            "welcome": "Welcome to Ares Agent! Type your message or /help for commands.",
+            "goodbye": "Farewell, warrior! ⚔",
+            "response_label": " ⚔ Ares ",
+            "prompt_symbol": "⚔ ❯ ",
+            "help_header": "(⚔) Available Commands",
+        },
+        "tool_prefix": "╎",
+        "banner_logo": """[bold #A3261F] █████╗ ██████╗ ███████╗███████╗       █████╗  ██████╗ ███████╗███╗   ██╗████████╗[/]
+[bold #B73122]██╔══██╗██╔══██╗██╔════╝██╔════╝      ██╔══██╗██╔════╝ ██╔════╝████╗  ██║╚══██╔══╝[/]
+[#C93C24]███████║██████╔╝█████╗  ███████╗█████╗███████║██║  ███╗█████╗  ██╔██╗ ██║   ██║[/]
+[#D84A28]██╔══██║██╔══██╗██╔══╝  ╚════██║╚════╝██╔══██║██║   ██║██╔══╝  ██║╚██╗██║   ██║[/]
+[#E15A2D]██║  ██║██║  ██║███████╗███████║      ██║  ██║╚██████╔╝███████╗██║ ╚████║   ██║[/]
+[#EB6C32]╚═╝  ╚═╝╚═╝  ╚═╝╚══════╝╚══════╝      ╚═╝  ╚═╝ ╚═════╝ ╚══════╝╚═╝  ╚═══╝   ╚═╝[/]""",
+        "banner_hero": """[#9F1C1C]⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣤⣤⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀[/]
+[#9F1C1C]⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣴⣿⠟⠻⣿⣦⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀[/]
+[#C7A96B]⠀⠀⠀⠀⠀⠀⠀⣠⣾⡿⠋⠀⠀⠀⠙⢿⣷⣄⠀⠀⠀⠀⠀⠀⠀[/]
+[#C7A96B]⠀⠀⠀⠀⠀⢀⣾⡿⠋⠀⠀⢠⡄⠀⠀⠙⢿⣷⡀⠀⠀⠀⠀⠀[/]
+[#DD4A3A]⠀⠀⠀⠀⣰⣿⠟⠀⠀⠀⣰⣿⣿⣆⠀⠀⠀⠻⣿⣆⠀⠀⠀⠀[/]
+[#DD4A3A]⠀⠀⠀⢰⣿⠏⠀⠀⢀⣾⡿⠉⢿⣷⡀⠀⠀⠹⣿⡆⠀⠀⠀[/]
+[#9F1C1C]⠀⠀⠀⣿⡟⠀⠀⣠⣿⠟⠀⠀⠀⠻⣿⣄⠀⠀⢻⣿⠀⠀⠀[/]
+[#9F1C1C]⠀⠀⠀⣿⡇⠀⠀⠙⠋⠀⠀⚔⠀⠀⠙⠋⠀⠀⢸⣿⠀⠀⠀[/]
+[#6B1717]⠀⠀⠀⢿⣧⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣼⡿⠀⠀⠀[/]
+[#6B1717]⠀⠀⠀⠘⢿⣷⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⣾⡿⠃⠀⠀⠀[/]
+[#C7A96B]⠀⠀⠀⠀⠈⠻⣿⣷⣦⣤⣀⣀⣤⣤⣶⣿⠿⠋⠀⠀⠀⠀[/]
+[#C7A96B]⠀⠀⠀⠀⠀⠀⠀⠉⠛⠿⠿⠿⠿⠛⠉⠀⠀⠀⠀⠀⠀⠀[/]
+[#DD4A3A]⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⚔⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀[/]
+[dim #6B1717]⠀⠀⠀⠀⠀⠀⠀⠀war god online⠀⠀⠀⠀⠀⠀⠀⠀[/]""",
+    },
+    "mono": {
+        "name": "mono",
+        "description": "Monochrome — clean grayscale",
+        "colors": {
+            "banner_border": "#555555",
+            "banner_title": "#e6edf3",
+            "banner_accent": "#aaaaaa",
+            "banner_dim": "#444444",
+            "banner_text": "#c9d1d9",
+            "ui_accent": "#aaaaaa",
+            "ui_label": "#888888",
+            "ui_ok": "#888888",
+            "ui_error": "#cccccc",
+            "ui_warn": "#999999",
+            "prompt": "#c9d1d9",
+            "input_rule": "#444444",
+            "response_border": "#aaaaaa",
+            "session_label": "#888888",
+            "session_border": "#555555",
+        },
+        "spinner": {},
+        "branding": {
+            "agent_name": "Hermes Agent",
+            "welcome": "Welcome to Hermes Agent! Type your message or /help for commands.",
+            "goodbye": "Goodbye! ⚕",
+            "response_label": " ⚕ Hermes ",
+            "prompt_symbol": "❯ ",
+            "help_header": "[?] Available Commands",
+        },
+        "tool_prefix": "┊",
+    },
+    "slate": {
+        "name": "slate",
+        "description": "Cool blue — developer-focused",
+        "colors": {
+            "banner_border": "#4169e1",
+            "banner_title": "#7eb8f6",
+            "banner_accent": "#8EA8FF",
+            "banner_dim": "#4b5563",
+            "banner_text": "#c9d1d9",
+            "ui_accent": "#7eb8f6",
+            "ui_label": "#8EA8FF",
+            "ui_ok": "#63D0A6",
+            "ui_error": "#F7A072",
+            "ui_warn": "#e6a855",
+            "prompt": "#c9d1d9",
+            "input_rule": "#4169e1",
+            "response_border": "#7eb8f6",
+            "session_label": "#7eb8f6",
+            "session_border": "#4b5563",
+        },
+        "spinner": {},
+        "branding": {
+            "agent_name": "Hermes Agent",
+            "welcome": "Welcome to Hermes Agent! Type your message or /help for commands.",
+            "goodbye": "Goodbye! ⚕",
+            "response_label": " ⚕ Hermes ",
+            "prompt_symbol": "❯ ",
+            "help_header": "(^_^)? Available Commands",
+        },
+        "tool_prefix": "┊",
+    },
+    "poseidon": {
+        "name": "poseidon",
+        "description": "Ocean-god theme — deep blue and seafoam",
+        "colors": {
+            "banner_border": "#2A6FB9",
+            "banner_title": "#A9DFFF",
+            "banner_accent": "#5DB8F5",
+            "banner_dim": "#153C73",
+            "banner_text": "#EAF7FF",
+            "ui_accent": "#5DB8F5",
+            "ui_label": "#A9DFFF",
+            "ui_ok": "#4caf50",
+            "ui_error": "#ef5350",
+            "ui_warn": "#ffa726",
+            "prompt": "#EAF7FF",
+            "input_rule": "#2A6FB9",
+            "response_border": "#5DB8F5",
+            "session_label": "#A9DFFF",
+            "session_border": "#496884",
+        },
+        "spinner": {
+            "waiting_faces": ["(≈)", "(Ψ)", "(∿)", "(◌)", "(◠)"],
+            "thinking_faces": ["(Ψ)", "(∿)", "(≈)", "(⌁)", "(◌)"],
+            "thinking_verbs": [
+                "charting currents", "sounding the depth", "reading foam lines",
+                "steering the trident", "tracking undertow", "plotting sea lanes",
+                "calling the swell", "measuring pressure",
+            ],
+            "wings": [
+                ["⟪≈", "≈⟫"],
+                ["⟪Ψ", "Ψ⟫"],
+                ["⟪∿", "∿⟫"],
+                ["⟪◌", "◌⟫"],
+            ],
+        },
+        "branding": {
+            "agent_name": "Poseidon Agent",
+            "welcome": "Welcome to Poseidon Agent! Type your message or /help for commands.",
+            "goodbye": "Fair winds! Ψ",
+            "response_label": " Ψ Poseidon ",
+            "prompt_symbol": "Ψ ❯ ",
+            "help_header": "(Ψ) Available Commands",
+        },
+        "tool_prefix": "│",
+        "banner_logo": """[bold #B8E8FF]██████╗  ██████╗ ███████╗██╗██████╗ ███████╗ ██████╗ ███╗   ██╗       █████╗  ██████╗ ███████╗███╗   ██╗████████╗[/]
+[bold #97D6FF]██╔══██╗██╔═══██╗██╔════╝██║██╔══██╗██╔════╝██╔═══██╗████╗  ██║      ██╔══██╗██╔════╝ ██╔════╝████╗  ██║╚══██╔══╝[/]
+[#75C1F6]██████╔╝██║   ██║███████╗██║██║  ██║█████╗  ██║   ██║██╔██╗ ██║█████╗███████║██║  ███╗█████╗  ██╔██╗ ██║   ██║[/]
+[#4FA2E0]██╔═══╝ ██║   ██║╚════██║██║██║  ██║██╔══╝  ██║   ██║██║╚██╗██║╚════╝██╔══██║██║   ██║██╔══╝  ██║╚██╗██║   ██║[/]
+[#2E7CC7]██║     ╚██████╔╝███████║██║██████╔╝███████╗╚██████╔╝██║ ╚████║      ██║  ██║╚██████╔╝███████╗██║ ╚████║   ██║[/]
+[#1B4F95]╚═╝      ╚═════╝ ╚══════╝╚═╝╚═════╝ ╚══════╝ ╚═════╝ ╚═╝  ╚═══╝      ╚═╝  ╚═╝ ╚═════╝ ╚══════╝╚═╝  ╚═══╝   ╚═╝[/]""",
+        "banner_hero": """[#2A6FB9]⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀[/]
+[#5DB8F5]⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⣾⣿⣷⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀[/]
+[#5DB8F5]⠀⠀⠀⠀⠀⠀⠀⢠⣿⠏⠀Ψ⠀⠹⣿⡄⠀⠀⠀⠀⠀⠀⠀[/]
+[#A9DFFF]⠀⠀⠀⠀⠀⠀⠀⣿⡟⠀⠀⠀⠀⠀⢻⣿⠀⠀⠀⠀⠀⠀⠀[/]
+[#A9DFFF]⠀⠀⠀≈≈≈≈≈⣿⡇⠀⠀⠀⠀⠀⢸⣿≈≈≈≈≈⠀⠀⠀[/]
+[#5DB8F5]⠀⠀⠀⠀⠀⠀⠀⣿⡇⠀⠀⠀⠀⠀⢸⣿⠀⠀⠀⠀⠀⠀⠀[/]
+[#2A6FB9]⠀⠀⠀⠀⠀⠀⠀⢿⣧⠀⠀⠀⠀⠀⣼⡿⠀⠀⠀⠀⠀⠀⠀[/]
+[#2A6FB9]⠀⠀⠀⠀⠀⠀⠀⠘⢿⣷⣄⣀⣠⣾⡿⠃⠀⠀⠀⠀⠀⠀⠀[/]
+[#153C73]⠀⠀⠀⠀⠀⠀⠀⠀⠈⠻⣿⣿⡿⠟⠁⠀⠀⠀⠀⠀⠀⠀⠀[/]
+[#153C73]⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀[/]
+[#5DB8F5]⠀⠀⠀⠀⠀≈≈≈≈≈≈≈≈≈≈≈≈≈≈≈⠀⠀⠀⠀⠀[/]
+[#A9DFFF]⠀⠀⠀⠀⠀⠀≈≈≈≈≈≈≈≈≈≈≈≈≈⠀⠀⠀⠀⠀⠀[/]
+[dim #153C73]⠀⠀⠀⠀⠀⠀⠀deep waters hold⠀⠀⠀⠀⠀⠀⠀[/]""",
+    },
+    "sisyphus": {
+        "name": "sisyphus",
+        "description": "Sisyphean theme — austere grayscale with persistence",
+        "colors": {
+            "banner_border": "#B7B7B7",
+            "banner_title": "#F5F5F5",
+            "banner_accent": "#E7E7E7",
+            "banner_dim": "#4A4A4A",
+            "banner_text": "#D3D3D3",
+            "ui_accent": "#E7E7E7",
+            "ui_label": "#D3D3D3",
+            "ui_ok": "#919191",
+            "ui_error": "#E7E7E7",
+            "ui_warn": "#B7B7B7",
+            "prompt": "#F5F5F5",
+            "input_rule": "#656565",
+            "response_border": "#B7B7B7",
+            "session_label": "#919191",
+            "session_border": "#656565",
+        },
+        "spinner": {
+            "waiting_faces": ["(◉)", "(◌)", "(◬)", "(⬤)", "(::)"],
+            "thinking_faces": ["(◉)", "(◬)", "(◌)", "(○)", "(●)"],
+            "thinking_verbs": [
+                "finding traction", "measuring the grade", "resetting the boulder",
+                "counting the ascent", "testing leverage", "setting the shoulder",
+                "pushing uphill", "enduring the loop",
+            ],
+            "wings": [
+                ["⟪◉", "◉⟫"],
+                ["⟪◬", "◬⟫"],
+                ["⟪◌", "◌⟫"],
+                ["⟪⬤", "⬤⟫"],
+            ],
+        },
+        "branding": {
+            "agent_name": "Sisyphus Agent",
+            "welcome": "Welcome to Sisyphus Agent! Type your message or /help for commands.",
+            "goodbye": "The boulder waits. ◉",
+            "response_label": " ◉ Sisyphus ",
+            "prompt_symbol": "◉ ❯ ",
+            "help_header": "(◉) Available Commands",
+        },
+        "tool_prefix": "│",
+        "banner_logo": """[bold #F5F5F5]███████╗██╗███████╗██╗   ██╗██████╗ ██╗  ██╗██╗   ██╗███████╗       █████╗  ██████╗ ███████╗███╗   ██╗████████╗[/]
+[bold #E7E7E7]██╔════╝██║██╔════╝╚██╗ ██╔╝██╔══██╗██║  ██║██║   ██║██╔════╝      ██╔══██╗██╔════╝ ██╔════╝████╗  ██║╚══██╔══╝[/]
+[#D7D7D7]███████╗██║███████╗ ╚████╔╝ ██████╔╝███████║██║   ██║███████╗█████╗███████║██║  ███╗█████╗  ██╔██╗ ██║   ██║[/]
+[#BFBFBF]╚════██║██║╚════██║  ╚██╔╝  ██╔═══╝ ██╔══██║██║   ██║╚════██║╚════╝██╔══██║██║   ██║██╔══╝  ██║╚██╗██║   ██║[/]
+[#8F8F8F]███████║██║███████║   ██║   ██║     ██║  ██║╚██████╔╝███████║      ██║  ██║╚██████╔╝███████╗██║ ╚████║   ██║[/]
+[#626262]╚══════╝╚═╝╚══════╝   ╚═╝   ╚═╝     ╚═╝  ╚═╝ ╚═════╝ ╚══════╝      ╚═╝  ╚═╝ ╚═════╝ ╚══════╝╚═╝  ╚═══╝   ╚═╝[/]""",
+        "banner_hero": """[#B7B7B7]⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣀⣀⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀[/]
+[#D3D3D3]⠀⠀⠀⠀⠀⠀⠀⣠⣾⣿⣿⣿⣿⣷⣄⠀⠀⠀⠀⠀⠀⠀⠀[/]
+[#E7E7E7]⠀⠀⠀⠀⠀⠀⣾⣿⣿⣿⣿⣿⣿⣿⣷⠀⠀⠀⠀⠀⠀⠀[/]
+[#F5F5F5]⠀⠀⠀⠀⠀⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇⠀⠀⠀⠀⠀⠀[/]
+[#E7E7E7]⠀⠀⠀⠀⠀⠀⣿⣿⣿⣿⣿⣿⣿⣿⣿⠀⠀⠀⠀⠀⠀⠀[/]
+[#D3D3D3]⠀⠀⠀⠀⠀⠀⠘⢿⣿⣿⣿⣿⣿⡿⠃⠀⠀⠀⠀⠀⠀⠀[/]
+[#B7B7B7]⠀⠀⠀⠀⠀⠀⠀⠀⠙⠿⣿⠿⠋⠀⠀⠀⠀⠀⠀⠀⠀⠀[/]
+[#919191]⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀[/]
+[#656565]⠀⠀⠀⠀⠀⠀⠀⠀⠀⣰⡄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀[/]
+[#656565]⠀⠀⠀⠀⠀⠀⠀⠀⣰⣿⣿⣆⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀[/]
+[#4A4A4A]⠀⠀⠀⠀⠀⠀⠀⣰⣿⣿⣿⣿⣆⠀⠀⠀⠀⠀⠀⠀⠀⠀[/]
+[#4A4A4A]⠀⠀⠀⠀⠀⣀⣴⣿⣿⣿⣿⣿⣿⣦⣀⠀⠀⠀⠀⠀⠀[/]
+[#656565]⠀⠀⠀━━━━━━━━━━━━━━━━━━━━━━━⠀⠀⠀[/]
+[dim #4A4A4A]⠀⠀⠀⠀⠀⠀⠀⠀⠀the boulder⠀⠀⠀⠀⠀⠀⠀⠀⠀[/]""",
+    },
+    "charizard": {
+        "name": "charizard",
+        "description": "Volcanic theme — burnt orange and ember",
+        "colors": {
+            "banner_border": "#C75B1D",
+            "banner_title": "#FFD39A",
+            "banner_accent": "#F29C38",
+            "banner_dim": "#7A3511",
+            "banner_text": "#FFF0D4",
+            "ui_accent": "#F29C38",
+            "ui_label": "#FFD39A",
+            "ui_ok": "#4caf50",
+            "ui_error": "#ef5350",
+            "ui_warn": "#ffa726",
+            "prompt": "#FFF0D4",
+            "input_rule": "#C75B1D",
+            "response_border": "#F29C38",
+            "session_label": "#FFD39A",
+            "session_border": "#6C4724",
+        },
+        "spinner": {
+            "waiting_faces": ["(✦)", "(▲)", "(◇)", "(<>)", "(🔥)"],
+            "thinking_faces": ["(✦)", "(▲)", "(◇)", "(⌁)", "(🔥)"],
+            "thinking_verbs": [
+                "banking into the draft", "measuring burn", "reading the updraft",
+                "tracking ember fall", "setting wing angle", "holding the flame core",
+                "plotting a hot landing", "coiling for lift",
+            ],
+            "wings": [
+                ["⟪✦", "✦⟫"],
+                ["⟪▲", "▲⟫"],
+                ["⟪◌", "◌⟫"],
+                ["⟪◇", "◇⟫"],
+            ],
+        },
+        "branding": {
+            "agent_name": "Charizard Agent",
+            "welcome": "Welcome to Charizard Agent! Type your message or /help for commands.",
+            "goodbye": "Flame out! ✦",
+            "response_label": " ✦ Charizard ",
+            "prompt_symbol": "✦ ❯ ",
+            "help_header": "(✦) Available Commands",
+        },
+        "tool_prefix": "│",
+        "banner_logo": """[bold #FFF0D4] ██████╗██╗  ██╗ █████╗ ██████╗ ██╗███████╗ █████╗ ██████╗ ██████╗        █████╗  ██████╗ ███████╗███╗   ██╗████████╗[/]
+[bold #FFD39A]██╔════╝██║  ██║██╔══██╗██╔══██╗██║╚══███╔╝██╔══██╗██╔══██╗██╔══██╗      ██╔══██╗██╔════╝ ██╔════╝████╗  ██║╚══██╔══╝[/]
+[#F29C38]██║     ███████║███████║██████╔╝██║  ███╔╝ ███████║██████╔╝██║  ██║█████╗███████║██║  ███╗█████╗  ██╔██╗ ██║   ██║[/]
+[#E2832B]██║     ██╔══██║██╔══██║██╔══██╗██║ ███╔╝  ██╔══██║██╔══██╗██║  ██║╚════╝██╔══██║██║   ██║██╔══╝  ██║╚██╗██║   ██║[/]
+[#C75B1D]╚██████╗██║  ██║██║  ██║██║  ██║██║███████╗██║  ██║██║  ██║██████╔╝      ██║  ██║╚██████╔╝███████╗██║ ╚████║   ██║[/]
+[#7A3511] ╚═════╝╚═╝  ╚═╝╚═╝  ╚═╝╚═╝  ╚═╝╚═╝╚══════╝╚═╝  ╚═╝╚═╝  ╚═╝╚═════╝       ╚═╝  ╚═╝ ╚═════╝ ╚══════╝╚═╝  ╚═══╝   ╚═╝[/]""",
+        "banner_hero": """[#FFD39A]⠀⠀⠀⠀⠀⠀⠀⠀⣀⣤⠶⠶⠶⣤⣀⠀⠀⠀⠀⠀⠀⠀⠀[/]
+[#F29C38]⠀⠀⠀⠀⠀⠀⣴⠟⠁⠀⠀⠀⠀⠈⠻⣦⠀⠀⠀⠀⠀⠀[/]
+[#F29C38]⠀⠀⠀⠀⠀⣼⠏⠀⠀⠀✦⠀⠀⠀⠀⠹⣧⠀⠀⠀⠀⠀[/]
+[#E2832B]⠀⠀⠀⠀⢰⡟⠀⠀⣀⣤⣤⣤⣀⠀⠀⠀⢻⡆⠀⠀⠀⠀[/]
+[#E2832B]⠀⠀⣠⡾⠛⠁⣠⣾⠟⠉⠀⠉⠻⣷⣄⠀⠈⠛⢷⣄⠀⠀[/]
+[#C75B1D]⠀⣼⠟⠀⢀⣾⠟⠁⠀⠀⠀⠀⠀⠈⠻⣷⡀⠀⠻⣧⠀[/]
+[#C75B1D]⢸⡟⠀⠀⣿⡟⠀⠀⠀🔥⠀⠀⠀⠀⢻⣿⠀⠀⢻⡇[/]
+[#7A3511]⠀⠻⣦⡀⠘⢿⣧⡀⠀⠀⠀⠀⠀⢀⣼⡿⠃⢀⣴⠟⠀[/]
+[#7A3511]⠀⠀⠈⠻⣦⣀⠙⢿⣷⣤⣤⣤⣾⡿⠋⣀⣴⠟⠁⠀⠀[/]
+[#C75B1D]⠀⠀⠀⠀⠈⠙⠛⠶⠤⠭⠭⠤⠶⠛⠋⠁⠀⠀⠀⠀[/]
+[#F29C38]⠀⠀⠀⠀⠀⠀⠀⠀⣰⡿⢿⣆⠀⠀⠀⠀⠀⠀⠀⠀⠀[/]
+[#F29C38]⠀⠀⠀⠀⠀⠀⠀⣼⡟⠀⠀⢻⣧⠀⠀⠀⠀⠀⠀⠀⠀[/]
+[dim #7A3511]⠀⠀⠀⠀⠀⠀⠀tail flame lit⠀⠀⠀⠀⠀⠀⠀⠀[/]""",
+    },
+}
+
+
+# =============================================================================
+# Skin loading and management
+# =============================================================================
+
+_active_skin: Optional[SkinConfig] = None
+_active_skin_name: str = "default"
+
+
+def _skins_dir() -> Path:
+    """User skins directory."""
+    home = Path(os.getenv("HERMES_HOME", Path.home() / ".hermes"))
+    return home / "skins"
+
+
+def _load_skin_from_yaml(path: Path) -> Optional[Dict[str, Any]]:
+    """Load a skin definition from a YAML file."""
+    try:
+        import yaml
+        with open(path, "r", encoding="utf-8") as f:
+            data = yaml.safe_load(f)
+        if isinstance(data, dict) and "name" in data:
+            return data
+    except Exception as e:
+        logger.debug("Failed to load skin from %s: %s", path, e)
+    return None
+
+
+def _build_skin_config(data: Dict[str, Any]) -> SkinConfig:
+    """Build a SkinConfig from a raw dict (built-in or loaded from YAML)."""
+    # Start with default values as base for missing keys
+    default = _BUILTIN_SKINS["default"]
+    colors = dict(default.get("colors", {}))
+    colors.update(data.get("colors", {}))
+    spinner = dict(default.get("spinner", {}))
+    spinner.update(data.get("spinner", {}))
+    branding = dict(default.get("branding", {}))
+    branding.update(data.get("branding", {}))
+
+    return SkinConfig(
+        name=data.get("name", "unknown"),
+        description=data.get("description", ""),
+        colors=colors,
+        spinner=spinner,
+        branding=branding,
+        tool_prefix=data.get("tool_prefix", default.get("tool_prefix", "┊")),
+        banner_logo=data.get("banner_logo", ""),
+        banner_hero=data.get("banner_hero", ""),
+    )
+
+
+def list_skins() -> List[Dict[str, str]]:
+    """List all available skins (built-in + user-installed).
+
+    Returns list of {"name": ..., "description": ..., "source": "builtin"|"user"}.
+    """
+    result = []
+    for name, data in _BUILTIN_SKINS.items():
+        result.append({
+            "name": name,
+            "description": data.get("description", ""),
+            "source": "builtin",
+        })
+
+    skins_path = _skins_dir()
+    if skins_path.is_dir():
+        for f in sorted(skins_path.glob("*.yaml")):
+            data = _load_skin_from_yaml(f)
+            if data:
+                skin_name = data.get("name", f.stem)
+                # Skip if it shadows a built-in
+                if any(s["name"] == skin_name for s in result):
+                    continue
+                result.append({
+                    "name": skin_name,
+                    "description": data.get("description", ""),
+                    "source": "user",
+                })
+
+    return result
+
+
+def load_skin(name: str) -> SkinConfig:
+    """Load a skin by name. Checks user skins first, then built-in."""
+    # Check user skins directory
+    skins_path = _skins_dir()
+    user_file = skins_path / f"{name}.yaml"
+    if user_file.is_file():
+        data = _load_skin_from_yaml(user_file)
+        if data:
+            return _build_skin_config(data)
+
+    # Check built-in skins
+    if name in _BUILTIN_SKINS:
+        return _build_skin_config(_BUILTIN_SKINS[name])
+
+    # Fallback to default
+    logger.warning("Skin '%s' not found, using default", name)
+    return _build_skin_config(_BUILTIN_SKINS["default"])
+
+
+def get_active_skin() -> SkinConfig:
+    """Get the currently active skin config (cached)."""
+    global _active_skin
+    if _active_skin is None:
+        _active_skin = load_skin(_active_skin_name)
+    return _active_skin
+
+
+def set_active_skin(name: str) -> SkinConfig:
+    """Switch the active skin. Returns the new SkinConfig."""
+    global _active_skin, _active_skin_name
+    _active_skin_name = name
+    _active_skin = load_skin(name)
+    return _active_skin
+
+
+def get_active_skin_name() -> str:
+    """Get the name of the currently active skin."""
+    return _active_skin_name
+
+
+def init_skin_from_config(config: dict) -> None:
+    """Initialize the active skin from CLI config at startup.
+
+    Call this once during CLI init with the loaded config dict.
+    """
+    display = config.get("display", {})
+    skin_name = display.get("skin", "default")
+    if isinstance(skin_name, str) and skin_name.strip():
+        set_active_skin(skin_name.strip())
+    else:
+        set_active_skin("default")

hermes_cli/status.py

@@ -5,25 +5,21 @@ Shows the status of all Hermes Agent components.
 """
 
 import os
-import subprocess
 import sys
+import subprocess
 from pathlib import Path
 
 PROJECT_ROOT = Path(__file__).parent.parent.resolve()
 
-from datetime import UTC
-
 from hermes_cli.colors import Colors, color
 from hermes_cli.config import get_env_path, get_env_value
 from hermes_constants import OPENROUTER_MODELS_URL
 
-
 def check_mark(ok: bool) -> str:
     if ok:
         return color("✓", Colors.GREEN)
     return color("✗", Colors.RED)
 
-
 def redact_key(key: str) -> str:
     """Redact an API key for display."""
     if not key:
@@ -37,8 +33,7 @@ def _format_iso_timestamp(value) -> str:
     """Format ISO timestamps for status output, converting to local timezone."""
     if not value or not isinstance(value, str):
         return "(unknown)"
-    from datetime import datetime
-
+    from datetime import datetime, timezone
     text = value.strip()
     if not text:
         return "(unknown)"
@@ -47,7 +42,7 @@ def _format_iso_timestamp(value) -> str:
     try:
         parsed = datetime.fromisoformat(text)
         if parsed.tzinfo is None:
-            parsed = parsed.replace(tzinfo=UTC)
+            parsed = parsed.replace(tzinfo=timezone.utc)
     except Exception:
         return value
     return parsed.astimezone().strftime("%Y-%m-%d %H:%M:%S %Z")
@@ -55,14 +50,14 @@ def _format_iso_timestamp(value) -> str:
 
 def show_status(args):
     """Show status of all Hermes Agent components."""
-    show_all = getattr(args, "all", False)
-    deep = getattr(args, "deep", False)
-
+    show_all = getattr(args, 'all', False)
+    deep = getattr(args, 'deep', False)
+    
     print()
     print(color("┌─────────────────────────────────────────────────────────┐", Colors.CYAN))
     print(color("│                 ⚕ Hermes Agent Status                  │", Colors.CYAN))
     print(color("└─────────────────────────────────────────────────────────┘", Colors.CYAN))
-
+    
     # =========================================================================
     # Environment
     # =========================================================================
@@ -70,19 +65,19 @@ def show_status(args):
     print(color("◆ Environment", Colors.CYAN, Colors.BOLD))
     print(f"  Project:      {PROJECT_ROOT}")
     print(f"  Python:       {sys.version.split()[0]}")
-
+    
     env_path = get_env_path()
     print(f"  .env file:    {check_mark(env_path.exists())} {'exists' if env_path.exists() else 'not found'}")
-
+    
     # =========================================================================
     # API Keys
     # =========================================================================
     print()
     print(color("◆ API Keys", Colors.CYAN, Colors.BOLD))
-
+    
     keys = {
         "OpenRouter": "OPENROUTER_API_KEY",
-        "Anthropic": "ANTHROPIC_API_KEY",
+        "Anthropic": "ANTHROPIC_API_KEY", 
         "OpenAI": "OPENAI_API_KEY",
         "Z.AI/GLM": "GLM_API_KEY",
         "Kimi": "KIMI_API_KEY",
@@ -96,7 +91,7 @@ def show_status(args):
         "ElevenLabs": "ELEVENLABS_API_KEY",
         "GitHub": "GITHUB_TOKEN",
     }
-
+    
     for name, env_var in keys.items():
         value = get_env_value(env_var) or ""
         has_key = bool(value)
@@ -110,8 +105,7 @@ def show_status(args):
     print(color("◆ Auth Providers", Colors.CYAN, Colors.BOLD))
 
     try:
-        from hermes_cli.auth import get_codex_auth_status, get_nous_auth_status
-
+        from hermes_cli.auth import get_nous_auth_status, get_codex_auth_status
         nous_status = get_nous_auth_status()
         codex_status = get_codex_auth_status()
     except Exception:
@@ -154,10 +148,10 @@ def show_status(args):
     print(color("◆ API-Key Providers", Colors.CYAN, Colors.BOLD))
 
     apikey_providers = {
-        "Z.AI / GLM": ("GLM_API_KEY", "ZAI_API_KEY", "Z_AI_API_KEY"),
-        "Kimi / Moonshot": ("KIMI_API_KEY",),
-        "MiniMax": ("MINIMAX_API_KEY",),
-        "MiniMax (China)": ("MINIMAX_CN_API_KEY",),
+        "Z.AI / GLM":       ("GLM_API_KEY", "ZAI_API_KEY", "Z_AI_API_KEY"),
+        "Kimi / Moonshot":  ("KIMI_API_KEY",),
+        "MiniMax":          ("MINIMAX_API_KEY",),
+        "MiniMax (China)":  ("MINIMAX_CN_API_KEY",),
     }
     for pname, env_vars in apikey_providers.items():
         key_val = ""
@@ -174,20 +168,19 @@ def show_status(args):
     # =========================================================================
     print()
     print(color("◆ Terminal Backend", Colors.CYAN, Colors.BOLD))
-
+    
     terminal_env = os.getenv("TERMINAL_ENV", "")
     if not terminal_env:
         # Fall back to config file value when env var isn't set
         # (hermes status doesn't go through cli.py's config loading)
         try:
             from hermes_cli.config import load_config
-
             _cfg = load_config()
             terminal_env = _cfg.get("terminal", {}).get("backend", "local")
         except Exception:
             terminal_env = "local"
     print(f"  Backend:      {terminal_env}")
-
+    
     if terminal_env == "ssh":
         ssh_host = os.getenv("TERMINAL_SSH_HOST", "")
         ssh_user = os.getenv("TERMINAL_SSH_USER", "")
@@ -199,127 +192,134 @@ def show_status(args):
     elif terminal_env == "daytona":
         daytona_image = os.getenv("TERMINAL_DAYTONA_IMAGE", "nikolaik/python-nodejs:python3.11-nodejs20")
         print(f"  Daytona Image: {daytona_image}")
-
+    
     sudo_password = os.getenv("SUDO_PASSWORD", "")
     print(f"  Sudo:         {check_mark(bool(sudo_password))} {'enabled' if sudo_password else 'disabled'}")
-
+    
     # =========================================================================
     # Messaging Platforms
     # =========================================================================
     print()
     print(color("◆ Messaging Platforms", Colors.CYAN, Colors.BOLD))
-
+    
     platforms = {
         "Telegram": ("TELEGRAM_BOT_TOKEN", "TELEGRAM_HOME_CHANNEL"),
         "Discord": ("DISCORD_BOT_TOKEN", "DISCORD_HOME_CHANNEL"),
         "WhatsApp": ("WHATSAPP_ENABLED", None),
         "Signal": ("SIGNAL_HTTP_URL", "SIGNAL_HOME_CHANNEL"),
         "Slack": ("SLACK_BOT_TOKEN", None),
+        "Email": ("EMAIL_ADDRESS", "EMAIL_HOME_ADDRESS"),
     }
-
+    
     for name, (token_var, home_var) in platforms.items():
         token = os.getenv(token_var, "")
         has_token = bool(token)
-
+        
         home_channel = ""
         if home_var:
             home_channel = os.getenv(home_var, "")
-
+        
         status = "configured" if has_token else "not configured"
         if home_channel:
             status += f" (home: {home_channel})"
-
+        
         print(f"  {name:<12}  {check_mark(has_token)} {status}")
-
+    
     # =========================================================================
     # Gateway Status
     # =========================================================================
     print()
     print(color("◆ Gateway Service", Colors.CYAN, Colors.BOLD))
-
-    if sys.platform.startswith("linux"):
-        result = subprocess.run(["systemctl", "--user", "is-active", "hermes-gateway"], capture_output=True, text=True)
+    
+    if sys.platform.startswith('linux'):
+        result = subprocess.run(
+            ["systemctl", "--user", "is-active", "hermes-gateway"],
+            capture_output=True,
+            text=True
+        )
         is_active = result.stdout.strip() == "active"
         print(f"  Status:       {check_mark(is_active)} {'running' if is_active else 'stopped'}")
-        print("  Manager:      systemd (user)")
-
-    elif sys.platform == "darwin":
-        result = subprocess.run(["launchctl", "list", "ai.hermes.gateway"], capture_output=True, text=True)
+        print(f"  Manager:      systemd (user)")
+        
+    elif sys.platform == 'darwin':
+        result = subprocess.run(
+            ["launchctl", "list", "ai.hermes.gateway"],
+            capture_output=True,
+            text=True
+        )
         is_loaded = result.returncode == 0
         print(f"  Status:       {check_mark(is_loaded)} {'loaded' if is_loaded else 'not loaded'}")
-        print("  Manager:      launchd")
+        print(f"  Manager:      launchd")
     else:
         print(f"  Status:       {color('N/A', Colors.DIM)}")
-        print("  Manager:      (not supported on this platform)")
-
+        print(f"  Manager:      (not supported on this platform)")
+    
     # =========================================================================
     # Cron Jobs
     # =========================================================================
     print()
     print(color("◆ Scheduled Jobs", Colors.CYAN, Colors.BOLD))
-
+    
     jobs_file = Path.home() / ".hermes" / "cron" / "jobs.json"
     if jobs_file.exists():
         import json
-
         try:
-            with open(jobs_file) as f:
+            with open(jobs_file, encoding="utf-8") as f:
                 data = json.load(f)
                 jobs = data.get("jobs", [])
                 enabled_jobs = [j for j in jobs if j.get("enabled", True)]
                 print(f"  Jobs:         {len(enabled_jobs)} active, {len(jobs)} total")
         except Exception:
-            print("  Jobs:         (error reading jobs file)")
+            print(f"  Jobs:         (error reading jobs file)")
     else:
-        print("  Jobs:         0")
-
+        print(f"  Jobs:         0")
+    
     # =========================================================================
     # Sessions
     # =========================================================================
     print()
     print(color("◆ Sessions", Colors.CYAN, Colors.BOLD))
-
+    
     sessions_file = Path.home() / ".hermes" / "sessions" / "sessions.json"
     if sessions_file.exists():
         import json
-
         try:
-            with open(sessions_file) as f:
+            with open(sessions_file, encoding="utf-8") as f:
                 data = json.load(f)
                 print(f"  Active:       {len(data)} session(s)")
         except Exception:
-            print("  Active:       (error reading sessions file)")
+            print(f"  Active:       (error reading sessions file)")
     else:
-        print("  Active:       0")
-
+        print(f"  Active:       0")
+    
     # =========================================================================
     # Deep checks
     # =========================================================================
     if deep:
         print()
         print(color("◆ Deep Checks", Colors.CYAN, Colors.BOLD))
-
+        
         # Check OpenRouter connectivity
         openrouter_key = os.getenv("OPENROUTER_API_KEY", "")
         if openrouter_key:
             try:
                 import httpx
-
                 response = httpx.get(
-                    OPENROUTER_MODELS_URL, headers={"Authorization": f"Bearer {openrouter_key}"}, timeout=10
+                    OPENROUTER_MODELS_URL,
+                    headers={"Authorization": f"Bearer {openrouter_key}"},
+                    timeout=10
                 )
                 ok = response.status_code == 200
                 print(f"  OpenRouter:   {check_mark(ok)} {'reachable' if ok else f'error ({response.status_code})'}")
             except Exception as e:
                 print(f"  OpenRouter:   {check_mark(False)} error: {e}")
-
+        
         # Check gateway port
         try:
             import socket
-
             sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
             sock.settimeout(1)
-            result = sock.connect_ex(("127.0.0.1", 18789))
+            result = sock.connect_ex(('127.0.0.1', 18789))
             sock.close()
             # Port in use = gateway likely running
             port_in_use = result == 0
@@ -327,7 +327,7 @@ def show_status(args):
             print(f"  Port 18789:   {'in use' if port_in_use else 'available'}")
         except OSError:
             pass
-
+    
     print()
     print(color("─" * 60, Colors.DIM))
     print(color("  Run 'hermes doctor' for detailed diagnostics", Colors.DIM))

hermes_cli/tools_config.py

@@ -11,37 +11,33 @@ the `platform_toolsets` key.
 
 import sys
 from pathlib import Path
+from typing import Dict, List, Optional, Set
+
+import os
 
-from hermes_cli.colors import Colors, color
 from hermes_cli.config import (
-    get_env_value,
-    load_config,
-    save_config,
-    save_env_value,
+    load_config, save_config, get_env_value, save_env_value,
+    get_hermes_home,
 )
+from hermes_cli.colors import Colors, color
 
 PROJECT_ROOT = Path(__file__).parent.parent.resolve()
 
 
 # ─── UI Helpers (shared with setup.py) ────────────────────────────────────────
 
-
 def _print_info(text: str):
     print(color(f"  {text}", Colors.DIM))
 
-
 def _print_success(text: str):
     print(color(f"✓ {text}", Colors.GREEN))
 
-
 def _print_warning(text: str):
     print(color(f"⚠ {text}", Colors.YELLOW))
 
-
 def _print_error(text: str):
     print(color(f"✗ {text}", Colors.RED))
 
-
 def _prompt(question: str, default: str = None, password: bool = False) -> str:
     if default:
         display = f"{question} [{default}]: "
@@ -50,7 +46,6 @@ def _prompt(question: str, default: str = None, password: bool = False) -> str:
     try:
         if password:
             import getpass
-
             value = getpass.getpass(color(display, Colors.YELLOW))
         else:
             value = input(color(display, Colors.YELLOW))
@@ -59,7 +54,6 @@ def _prompt(question: str, default: str = None, password: bool = False) -> str:
         print()
         return default or ""
 
-
 def _prompt_yes_no(question: str, default: bool = True) -> bool:
     default_str = "Y/n" if default else "y/N"
     while True:
@@ -70,9 +64,9 @@ def _prompt_yes_no(question: str, default: bool = True) -> bool:
             return default
         if not value:
             return default
-        if value in ("y", "yes"):
+        if value in ('y', 'yes'):
             return True
-        if value in ("n", "no"):
+        if value in ('n', 'no'):
             return False
 
 
@@ -82,24 +76,24 @@ def _prompt_yes_no(question: str, default: bool = True) -> bool:
 # Each entry: (toolset_name, label, description)
 # These map to keys in toolsets.py TOOLSETS dict.
 CONFIGURABLE_TOOLSETS = [
-    ("web", "🔍 Web Search & Scraping", "web_search, web_extract"),
-    ("browser", "🌐 Browser Automation", "navigate, click, type, scroll"),
-    ("terminal", "💻 Terminal & Processes", "terminal, process"),
-    ("file", "📁 File Operations", "read, write, patch, search"),
-    ("code_execution", "⚡ Code Execution", "execute_code"),
-    ("vision", "👁️  Vision / Image Analysis", "vision_analyze"),
-    ("image_gen", "🎨 Image Generation", "image_generate"),
-    ("moa", "🧠 Mixture of Agents", "mixture_of_agents"),
-    ("tts", "🔊 Text-to-Speech", "text_to_speech"),
-    ("skills", "📚 Skills", "list, view, manage"),
-    ("todo", "📋 Task Planning", "todo"),
-    ("memory", "💾 Memory", "persistent memory across sessions"),
-    ("session_search", "🔎 Session Search", "search past conversations"),
-    ("clarify", "❓ Clarifying Questions", "clarify"),
-    ("delegation", "👥 Task Delegation", "delegate_task"),
-    ("cronjob", "⏰ Cron Jobs", "schedule, list, remove"),
-    ("rl", "🧪 RL Training", "Tinker-Atropos training tools"),
-    ("homeassistant", "🏠 Home Assistant", "smart home device control"),
+    ("web",             "🔍 Web Search & Scraping",    "web_search, web_extract"),
+    ("browser",         "🌐 Browser Automation",       "navigate, click, type, scroll"),
+    ("terminal",        "💻 Terminal & Processes",      "terminal, process"),
+    ("file",            "📁 File Operations",           "read, write, patch, search"),
+    ("code_execution",  "⚡ Code Execution",            "execute_code"),
+    ("vision",          "👁️  Vision / Image Analysis",  "vision_analyze"),
+    ("image_gen",       "🎨 Image Generation",          "image_generate"),
+    ("moa",             "🧠 Mixture of Agents",         "mixture_of_agents"),
+    ("tts",             "🔊 Text-to-Speech",            "text_to_speech"),
+    ("skills",          "📚 Skills",                    "list, view, manage"),
+    ("todo",            "📋 Task Planning",             "todo"),
+    ("memory",          "💾 Memory",                    "persistent memory across sessions"),
+    ("session_search",  "🔎 Session Search",            "search past conversations"),
+    ("clarify",         "❓ Clarifying Questions",      "clarify"),
+    ("delegation",      "👥 Task Delegation",           "delegate_task"),
+    ("cronjob",         "⏰ Cron Jobs",                 "schedule, list, remove"),
+    ("rl",              "🧪 RL Training",               "Tinker-Atropos training tools"),
+    ("homeassistant",    "🏠 Home Assistant",           "smart home device control"),
 ]
 
 # Toolsets that are OFF by default for new installs.
@@ -109,11 +103,13 @@ _DEFAULT_OFF_TOOLSETS = {"moa", "homeassistant", "rl"}
 
 # Platform display config
 PLATFORMS = {
-    "cli": {"label": "🖥️  CLI", "default_toolset": "hermes-cli"},
-    "telegram": {"label": "📱 Telegram", "default_toolset": "hermes-telegram"},
-    "discord": {"label": "💬 Discord", "default_toolset": "hermes-discord"},
-    "slack": {"label": "💼 Slack", "default_toolset": "hermes-slack"},
-    "whatsapp": {"label": "📱 WhatsApp", "default_toolset": "hermes-whatsapp"},
+    "cli":      {"label": "🖥️  CLI",       "default_toolset": "hermes-cli"},
+    "telegram": {"label": "📱 Telegram",   "default_toolset": "hermes-telegram"},
+    "discord":  {"label": "💬 Discord",    "default_toolset": "hermes-discord"},
+    "slack":    {"label": "💼 Slack",      "default_toolset": "hermes-slack"},
+    "whatsapp": {"label": "📱 WhatsApp",   "default_toolset": "hermes-whatsapp"},
+    "signal":   {"label": "📡 Signal",     "default_toolset": "hermes-signal"},
+    "email":    {"label": "📧 Email",      "default_toolset": "hermes-email"},
 }
 
 
@@ -137,11 +133,7 @@ TOOL_CATEGORIES = {
                 "name": "OpenAI TTS",
                 "tag": "Premium - high quality voices",
                 "env_vars": [
-                    {
-                        "key": "VOICE_TOOLS_OPENAI_KEY",
-                        "prompt": "OpenAI API key",
-                        "url": "https://platform.openai.com/api-keys",
-                    },
+                    {"key": "VOICE_TOOLS_OPENAI_KEY", "prompt": "OpenAI API key", "url": "https://platform.openai.com/api-keys"},
                 ],
                 "tts_provider": "openai",
             },
@@ -149,11 +141,7 @@ TOOL_CATEGORIES = {
                 "name": "ElevenLabs",
                 "tag": "Premium - most natural voices",
                 "env_vars": [
-                    {
-                        "key": "ELEVENLABS_API_KEY",
-                        "prompt": "ElevenLabs API key",
-                        "url": "https://elevenlabs.io/app/settings/api-keys",
-                    },
+                    {"key": "ELEVENLABS_API_KEY", "prompt": "ElevenLabs API key", "url": "https://elevenlabs.io/app/settings/api-keys"},
                 ],
                 "tts_provider": "elevenlabs",
             },
@@ -238,11 +226,7 @@ TOOL_CATEGORIES = {
                 "name": "Tinker / Atropos",
                 "tag": "RL training platform",
                 "env_vars": [
-                    {
-                        "key": "TINKER_API_KEY",
-                        "prompt": "Tinker API key",
-                        "url": "https://tinker-console.thinkingmachines.ai/keys",
-                    },
+                    {"key": "TINKER_API_KEY", "prompt": "Tinker API key", "url": "https://tinker-console.thinkingmachines.ai/keys"},
                     {"key": "WANDB_API_KEY", "prompt": "WandB API key", "url": "https://wandb.ai/authorize"},
                 ],
                 "post_setup": "rl_training",
@@ -254,26 +238,24 @@ TOOL_CATEGORIES = {
 # Simple env-var requirements for toolsets NOT in TOOL_CATEGORIES.
 # Used as a fallback for tools like vision/moa that just need an API key.
 TOOLSET_ENV_REQUIREMENTS = {
-    "vision": [("OPENROUTER_API_KEY", "https://openrouter.ai/keys")],
-    "moa": [("OPENROUTER_API_KEY", "https://openrouter.ai/keys")],
+    "vision":     [("OPENROUTER_API_KEY",   "https://openrouter.ai/keys")],
+    "moa":        [("OPENROUTER_API_KEY",   "https://openrouter.ai/keys")],
 }
 
 
 # ─── Post-Setup Hooks ─────────────────────────────────────────────────────────
 
-
 def _run_post_setup(post_setup_key: str):
     """Run post-setup hooks for tools that need extra installation steps."""
     import shutil
-
     if post_setup_key == "browserbase":
         node_modules = PROJECT_ROOT / "node_modules" / "agent-browser"
         if not node_modules.exists() and shutil.which("npm"):
             _print_info("    Installing Node.js dependencies for browser tools...")
             import subprocess
-
             result = subprocess.run(
-                ["npm", "install", "--silent"], capture_output=True, text=True, cwd=str(PROJECT_ROOT)
+                ["npm", "install", "--silent"],
+                capture_output=True, text=True, cwd=str(PROJECT_ROOT)
             )
             if result.returncode == 0:
                 _print_success("    Node.js dependencies installed")
@@ -290,17 +272,16 @@ def _run_post_setup(post_setup_key: str):
             if tinker_dir.exists() and (tinker_dir / "pyproject.toml").exists():
                 _print_info("    Installing tinker-atropos submodule...")
                 import subprocess
-
                 uv_bin = shutil.which("uv")
                 if uv_bin:
                     result = subprocess.run(
                         [uv_bin, "pip", "install", "--python", sys.executable, "-e", str(tinker_dir)],
-                        capture_output=True,
-                        text=True,
+                        capture_output=True, text=True
                     )
                 else:
                     result = subprocess.run(
-                        [sys.executable, "-m", "pip", "install", "-e", str(tinker_dir)], capture_output=True, text=True
+                        [sys.executable, "-m", "pip", "install", "-e", str(tinker_dir)],
+                        capture_output=True, text=True
                     )
                 if result.returncode == 0:
                     _print_success("    tinker-atropos installed")
@@ -315,8 +296,7 @@ def _run_post_setup(post_setup_key: str):
 
 # ─── Platform / Toolset Helpers ───────────────────────────────────────────────
 
-
-def _get_enabled_platforms() -> list[str]:
+def _get_enabled_platforms() -> List[str]:
     """Return platform keys that are configured (have tokens or are CLI)."""
     enabled = ["cli"]
     if get_env_value("TELEGRAM_BOT_TOKEN"):
@@ -330,9 +310,25 @@ def _get_enabled_platforms() -> list[str]:
     return enabled
 
 
-def _get_platform_tools(config: dict, platform: str) -> set[str]:
+def _platform_toolset_summary(config: dict, platforms: Optional[List[str]] = None) -> Dict[str, Set[str]]:
+    """Return a summary of enabled toolsets per platform.
+
+    When ``platforms`` is None, this uses ``_get_enabled_platforms`` to
+    auto-detect platforms. Tests can pass an explicit list to avoid relying
+    on environment variables.
+    """
+    if platforms is None:
+        platforms = _get_enabled_platforms()
+
+    summary: Dict[str, Set[str]] = {}
+    for pkey in platforms:
+        summary[pkey] = _get_platform_tools(config, pkey)
+    return summary
+
+
+def _get_platform_tools(config: dict, platform: str) -> Set[str]:
     """Resolve which individual toolset names are enabled for a platform."""
-    from toolsets import resolve_toolset
+    from toolsets import resolve_toolset, TOOLSETS
 
     platform_toolsets = config.get("platform_toolsets", {})
     toolset_names = platform_toolsets.get(platform)
@@ -357,7 +353,7 @@ def _get_platform_tools(config: dict, platform: str) -> set[str]:
     return enabled_toolsets
 
 
-def _save_platform_tools(config: dict, platform: str, enabled_toolset_keys: set[str]):
+def _save_platform_tools(config: dict, platform: str, enabled_toolset_keys: Set[str]):
     """Save the selected toolset keys for a platform to config."""
     config.setdefault("platform_toolsets", {})
     config["platform_toolsets"][platform] = sorted(enabled_toolset_keys)
@@ -386,7 +382,6 @@ def _toolset_has_keys(ts_key: str) -> bool:
 
 # ─── Menu Helpers ─────────────────────────────────────────────────────────────
 
-
 def _prompt_choice(question: str, choices: list, default: int = 0) -> int:
     """Single-select menu (arrow keys). Uses curses to avoid simple_term_menu
     rendering bugs in tmux, iTerm, and other non-standard terminals."""
@@ -394,7 +389,6 @@ def _prompt_choice(question: str, choices: list, default: int = 0) -> int:
     # Curses-based single-select — works in tmux, iTerm, and standard terminals
     try:
         import curses
-
         result_holder = [default]
 
         def _curses_menu(stdscr):
@@ -410,9 +404,8 @@ def _prompt_choice(question: str, choices: list, default: int = 0) -> int:
                 stdscr.clear()
                 max_y, max_x = stdscr.getmaxyx()
                 try:
-                    stdscr.addnstr(
-                        0, 0, question, max_x - 1, curses.A_BOLD | (curses.color_pair(2) if curses.has_colors() else 0)
-                    )
+                    stdscr.addnstr(0, 0, question, max_x - 1,
+                                   curses.A_BOLD | (curses.color_pair(2) if curses.has_colors() else 0))
                 except curses.error:
                     pass
 
@@ -435,14 +428,14 @@ def _prompt_choice(question: str, choices: list, default: int = 0) -> int:
                 stdscr.refresh()
                 key = stdscr.getch()
 
-                if key in (curses.KEY_UP, ord("k")):
+                if key in (curses.KEY_UP, ord('k')):
                     cursor = (cursor - 1) % len(choices)
-                elif key in (curses.KEY_DOWN, ord("j")):
+                elif key in (curses.KEY_DOWN, ord('j')):
                     cursor = (cursor + 1) % len(choices)
                 elif key in (curses.KEY_ENTER, 10, 13):
                     result_holder[0] = cursor
                     return
-                elif key in (27, ord("q")):
+                elif key in (27, ord('q')):
                     return
 
         curses.wrapper(_curses_menu)
@@ -456,7 +449,7 @@ def _prompt_choice(question: str, choices: list, default: int = 0) -> int:
     for i, c in enumerate(choices):
         marker = "●" if i == default else "○"
         style = Colors.GREEN if i == default else ""
-        print(color(f"  {marker} {i + 1}. {c}", style) if style else f"  {marker} {i + 1}. {c}")
+        print(color(f"  {marker} {i+1}. {c}", style) if style else f"  {marker} {i+1}. {c}")
     while True:
         try:
             val = input(color(f"  Select [1-{len(choices)}] ({default + 1}): ", Colors.DIM))
@@ -470,8 +463,9 @@ def _prompt_choice(question: str, choices: list, default: int = 0) -> int:
             return default
 
 
-def _prompt_toolset_checklist(platform_label: str, enabled: set[str]) -> set[str]:
+def _prompt_toolset_checklist(platform_label: str, enabled: Set[str]) -> Set[str]:
     """Multi-select checklist of toolsets. Returns set of selected toolset keys."""
+    from hermes_cli.curses_ui import curses_checklist
 
     labels = []
     for ts_key, ts_label, ts_desc in CONFIGURABLE_TOOLSETS:
@@ -480,124 +474,25 @@ def _prompt_toolset_checklist(platform_label: str, enabled: set[str]) -> set[str
             suffix = "  [no API key]"
         labels.append(f"{ts_label}  ({ts_desc}){suffix}")
 
-    pre_selected_indices = [i for i, (ts_key, _, _) in enumerate(CONFIGURABLE_TOOLSETS) if ts_key in enabled]
+    pre_selected = {
+        i for i, (ts_key, _, _) in enumerate(CONFIGURABLE_TOOLSETS)
+        if ts_key in enabled
+    }
 
-    # Curses-based multi-select — arrow keys + space to toggle + enter to confirm.
-    # simple_term_menu has rendering bugs in tmux, iTerm, and other terminals.
-    try:
-        import curses
-
-        selected = set(pre_selected_indices)
-        result_holder = [None]
-
-        def _curses_checklist(stdscr):
-            curses.curs_set(0)
-            if curses.has_colors():
-                curses.start_color()
-                curses.use_default_colors()
-                curses.init_pair(1, curses.COLOR_GREEN, -1)
-                curses.init_pair(2, curses.COLOR_YELLOW, -1)
-                curses.init_pair(3, 8, -1)  # dim gray
-            cursor = 0
-            scroll_offset = 0
-
-            while True:
-                stdscr.clear()
-                max_y, max_x = stdscr.getmaxyx()
-                header = f"Tools for {platform_label}  —  ↑↓ navigate, SPACE toggle, ENTER confirm"
-                try:
-                    stdscr.addnstr(
-                        0,
-                        0,
-                        header,
-                        max_x - 1,
-                        curses.A_BOLD | curses.color_pair(2) if curses.has_colors() else curses.A_BOLD,
-                    )
-                except curses.error:
-                    pass
-
-                visible_rows = max_y - 3
-                if cursor < scroll_offset:
-                    scroll_offset = cursor
-                elif cursor >= scroll_offset + visible_rows:
-                    scroll_offset = cursor - visible_rows + 1
-
-                for draw_i, i in enumerate(range(scroll_offset, min(len(labels), scroll_offset + visible_rows))):
-                    y = draw_i + 2
-                    if y >= max_y - 1:
-                        break
-                    check = "✓" if i in selected else " "
-                    arrow = "→" if i == cursor else " "
-                    line = f" {arrow} [{check}] {labels[i]}"
-
-                    attr = curses.A_NORMAL
-                    if i == cursor:
-                        attr = curses.A_BOLD
-                        if curses.has_colors():
-                            attr |= curses.color_pair(1)
-                    try:
-                        stdscr.addnstr(y, 0, line, max_x - 1, attr)
-                    except curses.error:
-                        pass
-
-                stdscr.refresh()
-                key = stdscr.getch()
-
-                if key in (curses.KEY_UP, ord("k")):
-                    cursor = (cursor - 1) % len(labels)
-                elif key in (curses.KEY_DOWN, ord("j")):
-                    cursor = (cursor + 1) % len(labels)
-                elif key == ord(" "):
-                    if cursor in selected:
-                        selected.discard(cursor)
-                    else:
-                        selected.add(cursor)
-                elif key in (curses.KEY_ENTER, 10, 13):
-                    result_holder[0] = {CONFIGURABLE_TOOLSETS[i][0] for i in selected}
-                    return
-                elif key in (27, ord("q")):  # ESC or q
-                    result_holder[0] = enabled
-                    return
-
-        curses.wrapper(_curses_checklist)
-        return result_holder[0] if result_holder[0] is not None else enabled
-
-    except Exception:
-        pass  # fall through to numbered toggle
-
-    # Final fallback: numbered toggle (Windows without curses, etc.)
-    selected = set(pre_selected_indices)
-    print(color(f"\n  Tools for {platform_label}", Colors.YELLOW))
-    print(color("  Toggle by number, Enter to confirm.\n", Colors.DIM))
-
-    while True:
-        for i, label in enumerate(labels):
-            marker = color("[✓]", Colors.GREEN) if i in selected else "[ ]"
-            print(f"  {marker} {i + 1:>2}. {label}")
-        print()
-        try:
-            val = input(color("  Toggle # (or Enter to confirm): ", Colors.DIM)).strip()
-            if not val:
-                break
-            idx = int(val) - 1
-            if 0 <= idx < len(labels):
-                if idx in selected:
-                    selected.discard(idx)
-                else:
-                    selected.add(idx)
-        except (ValueError, KeyboardInterrupt, EOFError):
-            return enabled
-        print()
-
-    return {CONFIGURABLE_TOOLSETS[i][0] for i in selected}
+    chosen = curses_checklist(
+        f"Tools for {platform_label}",
+        labels,
+        pre_selected,
+        cancel_returns=pre_selected,
+    )
+    return {CONFIGURABLE_TOOLSETS[i][0] for i in chosen}
 
 
 # ─── Provider-Aware Configuration ────────────────────────────────────────────
 
-
 def _configure_toolset(ts_key: str, config: dict):
     """Configure a toolset - provider selection + API keys.
-
+    
     Uses TOOL_CATEGORIES for provider-aware config, falls back to simple
     env var prompts for toolsets not in TOOL_CATEGORIES.
     """
@@ -621,9 +516,7 @@ def _configure_tool_category(ts_key: str, cat: dict, config: dict):
         req = cat["requires_python"]
         if sys.version_info < req:
             print()
-            _print_error(
-                f"  {name} requires Python {req[0]}.{req[1]}+ (current: {sys.version_info.major}.{sys.version_info.minor})"
-            )
+            _print_error(f"  {name} requires Python {req[0]}.{req[1]}+ (current: {sys.version_info.major}.{sys.version_info.minor})")
             _print_info("  Upgrade Python and reinstall to enable this tool.")
             return
 
@@ -642,7 +535,7 @@ def _configure_tool_category(ts_key: str, cat: dict, config: dict):
         # Multiple providers - let user choose
         print()
         # Use custom title if provided (e.g. "Select Search Provider")
-        title = cat.get("setup_title", "Choose a provider")
+        title = cat.get("setup_title", f"Choose a provider")
         print(color(f"  --- {icon} {name} - {title} ---", Colors.CYAN))
         if cat.get("setup_note"):
             _print_info(f"  {cat['setup_note']}")
@@ -658,11 +551,7 @@ def _configure_tool_category(ts_key: str, cat: dict, config: dict):
                 if p.get("tts_provider") and config.get("tts", {}).get("provider") == p["tts_provider"]:
                     configured = " [active]"
                 elif not env_vars:
-                    configured = (
-                        " [active]"
-                        if config.get("tts", {}).get("provider", "edge") == p.get("tts_provider", "")
-                        else ""
-                    )
+                    configured = " [active]" if config.get("tts", {}).get("provider", "edge") == p.get("tts_provider", "") else ""
                 else:
                     configured = " [configured]"
             provider_choices.append(f"{p['name']}{tag}{configured}")
@@ -724,9 +613,9 @@ def _configure_provider(provider: dict, config: dict):
 
             if value:
                 save_env_value(var["key"], value)
-                _print_success("    Saved")
+                _print_success(f"    Saved")
             else:
-                _print_warning("    Skipped")
+                _print_warning(f"    Skipped")
                 all_configured = False
 
     # Run post-setup hooks if needed
@@ -757,9 +646,9 @@ def _configure_simple_requirements(ts_key: str):
         value = _prompt(f"    {var}", password=True)
         if value and value.strip():
             save_env_value(var, value.strip())
-            _print_success("    Saved")
+            _print_success(f"    Saved")
         else:
-            _print_warning("    Skipped")
+            _print_warning(f"    Skipped")
 
 
 def _reconfigure_tool(config: dict):
@@ -863,9 +752,9 @@ def _reconfigure_provider(provider: dict, config: dict):
         value = _prompt(f"    {var.get('prompt', var['key'])} (Enter to keep current)", password=not default_val)
         if value and value.strip():
             save_env_value(var["key"], value.strip())
-            _print_success("    Updated")
+            _print_success(f"    Updated")
         else:
-            _print_info("    Kept current")
+            _print_info(f"    Kept current")
 
 
 def _reconfigure_simple_requirements(ts_key: str):
@@ -887,14 +776,13 @@ def _reconfigure_simple_requirements(ts_key: str):
         value = _prompt(f"    {var} (Enter to keep current)", password=True)
         if value and value.strip():
             save_env_value(var, value.strip())
-            _print_success("    Updated")
+            _print_success(f"    Updated")
         else:
-            _print_info("    Kept current")
+            _print_info(f"    Kept current")
 
 
 # ─── Main Entry Point ─────────────────────────────────────────────────────────
 
-
 def tools_command(args=None, first_install: bool = False, config: dict = None):
     """Entry point for `hermes tools` and `hermes setup tools`.
 
@@ -911,6 +799,26 @@ def tools_command(args=None, first_install: bool = False, config: dict = None):
     enabled_platforms = _get_enabled_platforms()
 
     print()
+
+    # Non-interactive summary mode for CLI usage
+    if getattr(args, "summary", False):
+        total = len(CONFIGURABLE_TOOLSETS)
+        print(color("⚕ Tool Summary", Colors.CYAN, Colors.BOLD))
+        print()
+        summary = _platform_toolset_summary(config, enabled_platforms)
+        for pkey in enabled_platforms:
+            pinfo = PLATFORMS[pkey]
+            enabled = summary.get(pkey, set())
+            count = len(enabled)
+            print(color(f"  {pinfo['label']}", Colors.BOLD) + color(f"  ({count}/{total})", Colors.DIM))
+            if enabled:
+                for ts_key in sorted(enabled):
+                    label = next((l for k, l, _ in CONFIGURABLE_TOOLSETS if k == ts_key), ts_key)
+                    print(color(f"    ✓ {label}", Colors.GREEN))
+            else:
+                print(color("    (none enabled)", Colors.DIM))
+        print()
+        return
     print(color("⚕ Hermes Tool Configuration", Colors.CYAN, Colors.BOLD))
     print(color("  Enable or disable tools per platform.", Colors.DIM))
     print(color("  Tools that need API keys will be configured when enabled.", Colors.DIM))
@@ -944,8 +852,7 @@ def tools_command(args=None, first_install: bool = False, config: dict = None):
             # TTS (Edge vs OpenAI vs ElevenLabs), etc. are shown even when
             # a free provider exists.
             to_configure = [
-                ts_key
-                for ts_key in sorted(new_enabled)
+                ts_key for ts_key in sorted(new_enabled)
                 if TOOL_CATEGORIES.get(ts_key) or TOOLSET_ENV_REQUIREMENTS.get(ts_key)
             ]
 
@@ -979,22 +886,68 @@ def tools_command(args=None, first_install: bool = False, config: dict = None):
         platform_choices.append(f"Configure {pinfo['label']}  ({count}/{total} enabled)")
         platform_keys.append(pkey)
 
+    if len(platform_keys) > 1:
+        platform_choices.append("Configure all platforms (global)")
     platform_choices.append("Reconfigure an existing tool's provider or API key")
     platform_choices.append("Done")
 
+    # Index offsets for the extra options after per-platform entries
+    _global_idx = len(platform_keys) if len(platform_keys) > 1 else -1
+    _reconfig_idx = len(platform_keys) + (1 if len(platform_keys) > 1 else 0)
+    _done_idx = _reconfig_idx + 1
+
     while True:
         idx = _prompt_choice("Select an option:", platform_choices, default=0)
 
         # "Done" selected
-        if idx == len(platform_keys) + 1:
+        if idx == _done_idx:
             break
 
         # "Reconfigure" selected
-        if idx == len(platform_keys):
+        if idx == _reconfig_idx:
             _reconfigure_tool(config)
             print()
             continue
 
+        # "Configure all platforms (global)" selected
+        if idx == _global_idx:
+            # Use the union of all platforms' current tools as the starting state
+            all_current = set()
+            for pk in platform_keys:
+                all_current |= _get_platform_tools(config, pk)
+            new_enabled = _prompt_toolset_checklist("All platforms", all_current)
+            if new_enabled != all_current:
+                for pk in platform_keys:
+                    prev = _get_platform_tools(config, pk)
+                    added = new_enabled - prev
+                    removed = prev - new_enabled
+                    pinfo_inner = PLATFORMS[pk]
+                    if added or removed:
+                        print(color(f"  {pinfo_inner['label']}:", Colors.DIM))
+                        for ts in sorted(added):
+                            label = next((l for k, l, _ in CONFIGURABLE_TOOLSETS if k == ts), ts)
+                            print(color(f"    + {label}", Colors.GREEN))
+                        for ts in sorted(removed):
+                            label = next((l for k, l, _ in CONFIGURABLE_TOOLSETS if k == ts), ts)
+                            print(color(f"    - {label}", Colors.RED))
+                    # Configure API keys for newly enabled tools
+                    for ts_key in sorted(added):
+                        if (TOOL_CATEGORIES.get(ts_key) or TOOLSET_ENV_REQUIREMENTS.get(ts_key)):
+                            if not _toolset_has_keys(ts_key):
+                                _configure_toolset(ts_key, config)
+                    _save_platform_tools(config, pk, new_enabled)
+                save_config(config)
+                print(color("  ✓ Saved configuration for all platforms", Colors.GREEN))
+                # Update choice labels
+                for ci, pk in enumerate(platform_keys):
+                    new_count = len(_get_platform_tools(config, pk))
+                    total = len(CONFIGURABLE_TOOLSETS)
+                    platform_choices[ci] = f"Configure {PLATFORMS[pk]['label']}  ({new_count}/{total} enabled)"
+            else:
+                print(color("  No changes", Colors.DIM))
+            print()
+            continue
+
         pkey = platform_keys[idx]
         pinfo = PLATFORMS[pkey]
 
@@ -1019,7 +972,7 @@ def tools_command(args=None, first_install: bool = False, config: dict = None):
 
             # Configure newly enabled toolsets that need API keys
             for ts_key in sorted(added):
-                if TOOL_CATEGORIES.get(ts_key) or TOOLSET_ENV_REQUIREMENTS.get(ts_key):
+                if (TOOL_CATEGORIES.get(ts_key) or TOOLSET_ENV_REQUIREMENTS.get(ts_key)):
                     if not _toolset_has_keys(ts_key):
                         _configure_toolset(ts_key, config)
 

hermes_cli/uninstall.py

@@ -7,25 +7,23 @@ Provides options for:
 """
 
 import os
+import sys
 import shutil
 import subprocess
 from pathlib import Path
+from typing import Optional
 
 from hermes_cli.colors import Colors, color
 
-
 def log_info(msg: str):
     print(f"{color('→', Colors.CYAN)} {msg}")
 
-
 def log_success(msg: str):
     print(f"{color('✓', Colors.GREEN)} {msg}")
 
-
 def log_warn(msg: str):
     print(f"{color('⚠', Colors.YELLOW)} {msg}")
 
-
 def log_error(msg: str):
     print(f"{color('✗', Colors.RED)} {msg}")
 
@@ -44,7 +42,7 @@ def find_shell_configs() -> list:
     """Find shell configuration files that might have PATH entries."""
     home = Path.home()
     configs = []
-
+    
     candidates = [
         home / ".bashrc",
         home / ".bash_profile",
@@ -52,11 +50,11 @@ def find_shell_configs() -> list:
         home / ".zshrc",
         home / ".zprofile",
     ]
-
+    
     for config in candidates:
         if config.exists():
             configs.append(config)
-
+    
     return configs
 
 
@@ -64,45 +62,45 @@ def remove_path_from_shell_configs():
     """Remove Hermes PATH entries from shell configuration files."""
     configs = find_shell_configs()
     removed_from = []
-
+    
     for config_path in configs:
         try:
             content = config_path.read_text()
             original_content = content
-
+            
             # Remove lines containing hermes-agent or hermes PATH entries
             new_lines = []
             skip_next = False
-
-            for line in content.split("\n"):
+            
+            for line in content.split('\n'):
                 # Skip the "# Hermes Agent" comment and following line
-                if "# Hermes Agent" in line or "# hermes-agent" in line:
+                if '# Hermes Agent' in line or '# hermes-agent' in line:
                     skip_next = True
                     continue
-                if skip_next and ("hermes" in line.lower() and "PATH" in line):
+                if skip_next and ('hermes' in line.lower() and 'PATH' in line):
                     skip_next = False
                     continue
                 skip_next = False
-
+                
                 # Remove any PATH line containing hermes
-                if "hermes" in line.lower() and ("PATH=" in line or "path=" in line.lower()):
+                if 'hermes' in line.lower() and ('PATH=' in line or 'path=' in line.lower()):
                     continue
-
+                    
                 new_lines.append(line)
-
-            new_content = "\n".join(new_lines)
-
+            
+            new_content = '\n'.join(new_lines)
+            
             # Clean up multiple blank lines
-            while "\n\n\n" in new_content:
-                new_content = new_content.replace("\n\n\n", "\n\n")
-
+            while '\n\n\n' in new_content:
+                new_content = new_content.replace('\n\n\n', '\n\n')
+            
             if new_content != original_content:
                 config_path.write_text(new_content)
                 removed_from.append(config_path)
-
+                
         except Exception as e:
             log_warn(f"Could not update {config_path}: {e}")
-
+    
     return removed_from
 
 
@@ -112,49 +110,61 @@ def remove_wrapper_script():
         Path.home() / ".local" / "bin" / "hermes",
         Path("/usr/local/bin/hermes"),
     ]
-
+    
     removed = []
     for wrapper in wrapper_paths:
         if wrapper.exists():
             try:
                 # Check if it's our wrapper (contains hermes_cli reference)
                 content = wrapper.read_text()
-                if "hermes_cli" in content or "hermes-agent" in content:
+                if 'hermes_cli' in content or 'hermes-agent' in content:
                     wrapper.unlink()
                     removed.append(wrapper)
             except Exception as e:
                 log_warn(f"Could not remove {wrapper}: {e}")
-
+    
     return removed
 
 
 def uninstall_gateway_service():
     """Stop and uninstall the gateway service if running."""
     import platform
-
+    
     if platform.system() != "Linux":
         return False
-
+    
     service_file = Path.home() / ".config" / "systemd" / "user" / "hermes-gateway.service"
-
+    
     if not service_file.exists():
         return False
-
+    
     try:
         # Stop the service
-        subprocess.run(["systemctl", "--user", "stop", "hermes-gateway"], capture_output=True, check=False)
-
+        subprocess.run(
+            ["systemctl", "--user", "stop", "hermes-gateway"],
+            capture_output=True,
+            check=False
+        )
+        
         # Disable the service
-        subprocess.run(["systemctl", "--user", "disable", "hermes-gateway"], capture_output=True, check=False)
-
+        subprocess.run(
+            ["systemctl", "--user", "disable", "hermes-gateway"],
+            capture_output=True,
+            check=False
+        )
+        
         # Remove service file
         service_file.unlink()
-
+        
         # Reload systemd
-        subprocess.run(["systemctl", "--user", "daemon-reload"], capture_output=True, check=False)
-
+        subprocess.run(
+            ["systemctl", "--user", "daemon-reload"],
+            capture_output=True,
+            check=False
+        )
+        
         return True
-
+        
     except Exception as e:
         log_warn(f"Could not fully remove gateway service: {e}")
         return False
@@ -163,20 +173,20 @@ def uninstall_gateway_service():
 def run_uninstall(args):
     """
     Run the uninstall process.
-
+    
     Options:
     - Full uninstall: removes code + ~/.hermes/ (configs, data, logs)
     - Keep data: removes code but keeps ~/.hermes/ for future reinstall
     """
     project_root = get_project_root()
     hermes_home = get_hermes_home()
-
+    
     print()
     print(color("┌─────────────────────────────────────────────────────────┐", Colors.MAGENTA, Colors.BOLD))
     print(color("│            ⚕ Hermes Agent Uninstaller                  │", Colors.MAGENTA, Colors.BOLD))
     print(color("└─────────────────────────────────────────────────────────┘", Colors.MAGENTA, Colors.BOLD))
     print()
-
+    
     # Show what will be affected
     print(color("Current Installation:", Colors.CYAN, Colors.BOLD))
     print(f"  Code:    {project_root}")
@@ -184,7 +194,7 @@ def run_uninstall(args):
     print(f"  Secrets: {hermes_home / '.env'}")
     print(f"  Data:    {hermes_home / 'cron/'}, {hermes_home / 'sessions/'}, {hermes_home / 'logs/'}")
     print()
-
+    
     # Ask for confirmation
     print(color("Uninstall Options:", Colors.YELLOW, Colors.BOLD))
     print()
@@ -196,21 +206,21 @@ def run_uninstall(args):
     print()
     print("  3) " + color("Cancel", Colors.CYAN) + " - Don't uninstall")
     print()
-
+    
     try:
         choice = input(color("Select option [1/2/3]: ", Colors.BOLD)).strip()
     except (KeyboardInterrupt, EOFError):
         print()
         print("Cancelled.")
         return
-
+    
     if choice == "3" or choice.lower() in ("c", "cancel", "q", "quit", "n", "no"):
         print()
         print("Uninstall cancelled.")
         return
-
-    full_uninstall = choice == "2"
-
+    
+    full_uninstall = (choice == "2")
+    
     # Final confirmation
     print()
     if full_uninstall:
@@ -218,7 +228,7 @@ def run_uninstall(args):
         print(color("   Including: configs, API keys, sessions, scheduled jobs, logs", Colors.RED))
     else:
         print("This will remove the Hermes code but keep your configuration and data.")
-
+    
     print()
     try:
         confirm = input(f"Type '{color('yes', Colors.YELLOW)}' to confirm: ").strip().lower()
@@ -226,23 +236,23 @@ def run_uninstall(args):
         print()
         print("Cancelled.")
         return
-
+    
     if confirm != "yes":
         print()
         print("Uninstall cancelled.")
         return
-
+    
     print()
     print(color("Uninstalling...", Colors.CYAN, Colors.BOLD))
     print()
-
+    
     # 1. Stop and uninstall gateway service
     log_info("Checking for gateway service...")
     if uninstall_gateway_service():
         log_success("Gateway service stopped and removed")
     else:
         log_info("No gateway service found")
-
+    
     # 2. Remove PATH entries from shell configs
     log_info("Removing PATH entries from shell configs...")
     removed_configs = remove_path_from_shell_configs()
@@ -251,7 +261,7 @@ def run_uninstall(args):
             log_success(f"Updated {config}")
     else:
         log_info("No PATH entries found to remove")
-
+    
     # 3. Remove wrapper script
     log_info("Removing hermes command...")
     removed_wrappers = remove_wrapper_script()
@@ -260,10 +270,10 @@ def run_uninstall(args):
             log_success(f"Removed {wrapper}")
     else:
         log_info("No wrapper script found")
-
+    
     # 4. Remove installation directory (code)
-    log_info("Removing installation directory...")
-
+    log_info(f"Removing installation directory...")
+    
     # Check if we're running from within the install dir
     # We need to be careful here
     try:
@@ -279,7 +289,7 @@ def run_uninstall(args):
     except Exception as e:
         log_warn(f"Could not fully remove {project_root}: {e}")
         log_info("You may need to manually remove it")
-
+    
     # 5. Optionally remove ~/.hermes/ data directory
     if full_uninstall:
         log_info("Removing configuration and data...")
@@ -292,27 +302,22 @@ def run_uninstall(args):
             log_info("You may need to manually remove it")
     else:
         log_info(f"Keeping configuration and data in {hermes_home}")
-
+    
     # Done
     print()
     print(color("┌─────────────────────────────────────────────────────────┐", Colors.GREEN, Colors.BOLD))
     print(color("│              ✓ Uninstall Complete!                      │", Colors.GREEN, Colors.BOLD))
     print(color("└─────────────────────────────────────────────────────────┘", Colors.GREEN, Colors.BOLD))
     print()
-
+    
     if not full_uninstall:
         print(color("Your configuration and data have been preserved:", Colors.CYAN))
         print(f"  {hermes_home}/")
         print()
         print("To reinstall later with your existing settings:")
-        print(
-            color(
-                "  curl -fsSL https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh | bash",
-                Colors.DIM,
-            )
-        )
+        print(color("  curl -fsSL https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh | bash", Colors.DIM))
         print()
-
+    
     print(color("Reload your shell to complete the process:", Colors.YELLOW))
     print("  source ~/.bashrc  # or ~/.zshrc")
     print()

hermes_constants.py

@@ -7,3 +7,6 @@ without risk of circular imports.
 OPENROUTER_BASE_URL = "https://openrouter.ai/api/v1"
 OPENROUTER_MODELS_URL = f"{OPENROUTER_BASE_URL}/models"
 OPENROUTER_CHAT_URL = f"{OPENROUTER_BASE_URL}/chat/completions"
+
+NOUS_API_BASE_URL = "https://inference-api.nousresearch.com/v1"
+NOUS_API_CHAT_URL = f"{NOUS_API_BASE_URL}/chat/completions"

hermes_state.py

@@ -16,10 +16,12 @@ Key design decisions:
 
 import json
 import os
+import re
 import sqlite3
 import time
 from pathlib import Path
-from typing import Any
+from typing import Dict, Any, List, Optional
+
 
 DEFAULT_DB_PATH = Path(os.getenv("HERMES_HOME", Path.home() / ".hermes")) / "state.db"
 
@@ -155,7 +157,8 @@ class SessionDB:
         # since the title column is guaranteed to exist at this point)
         try:
             cursor.execute(
-                "CREATE UNIQUE INDEX IF NOT EXISTS idx_sessions_title_unique ON sessions(title) WHERE title IS NOT NULL"
+                "CREATE UNIQUE INDEX IF NOT EXISTS idx_sessions_title_unique "
+                "ON sessions(title) WHERE title IS NOT NULL"
             )
         except sqlite3.OperationalError:
             pass  # Index already exists
@@ -183,7 +186,7 @@ class SessionDB:
         session_id: str,
         source: str,
         model: str = None,
-        model_config: dict[str, Any] = None,
+        model_config: Dict[str, Any] = None,
         system_prompt: str = None,
         user_id: str = None,
         parent_session_id: str = None,
@@ -223,7 +226,9 @@ class SessionDB:
         )
         self._conn.commit()
 
-    def update_token_counts(self, session_id: str, input_tokens: int = 0, output_tokens: int = 0) -> None:
+    def update_token_counts(
+        self, session_id: str, input_tokens: int = 0, output_tokens: int = 0
+    ) -> None:
         """Increment token counters on a session."""
         self._conn.execute(
             """UPDATE sessions SET
@@ -234,9 +239,11 @@ class SessionDB:
         )
         self._conn.commit()
 
-    def get_session(self, session_id: str) -> dict[str, Any] | None:
+    def get_session(self, session_id: str) -> Optional[Dict[str, Any]]:
         """Get a session by ID."""
-        cursor = self._conn.execute("SELECT * FROM sessions WHERE id = ?", (session_id,))
+        cursor = self._conn.execute(
+            "SELECT * FROM sessions WHERE id = ?", (session_id,)
+        )
         row = cursor.fetchone()
         return dict(row) if row else None
 
@@ -244,7 +251,7 @@ class SessionDB:
     MAX_TITLE_LENGTH = 100
 
     @staticmethod
-    def sanitize_title(title: str | None) -> str | None:
+    def sanitize_title(title: Optional[str]) -> Optional[str]:
         """Validate and sanitize a session title.
 
         - Strips leading/trailing whitespace
@@ -265,26 +272,27 @@ class SessionDB:
         # Remove ASCII control characters (0x00-0x1F, 0x7F) but keep
         # whitespace chars (\t=0x09, \n=0x0A, \r=0x0D) so they can be
         # normalized to spaces by the whitespace collapsing step below
-        cleaned = re.sub(r"[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]", "", title)
+        cleaned = re.sub(r'[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]', '', title)
 
         # Remove problematic Unicode control characters:
         # - Zero-width chars (U+200B-U+200F, U+FEFF)
         # - Directional overrides (U+202A-U+202E, U+2066-U+2069)
         # - Object replacement (U+FFFC), interlinear annotation (U+FFF9-U+FFFB)
         cleaned = re.sub(
-            r"[\u200b-\u200f\u2028-\u202e\u2060-\u2069\ufeff\ufffc\ufff9-\ufffb]",
-            "",
-            cleaned,
+            r'[\u200b-\u200f\u2028-\u202e\u2060-\u2069\ufeff\ufffc\ufff9-\ufffb]',
+            '', cleaned,
         )
 
         # Collapse internal whitespace runs and strip
-        cleaned = re.sub(r"\s+", " ", cleaned).strip()
+        cleaned = re.sub(r'\s+', ' ', cleaned).strip()
 
         if not cleaned:
             return None
 
         if len(cleaned) > SessionDB.MAX_TITLE_LENGTH:
-            raise ValueError(f"Title too long ({len(cleaned)} chars, max {SessionDB.MAX_TITLE_LENGTH})")
+            raise ValueError(
+                f"Title too long ({len(cleaned)} chars, max {SessionDB.MAX_TITLE_LENGTH})"
+            )
 
         return cleaned
 
@@ -305,7 +313,9 @@ class SessionDB:
             )
             conflict = cursor.fetchone()
             if conflict:
-                raise ValueError(f"Title '{title}' is already in use by session {conflict['id']}")
+                raise ValueError(
+                    f"Title '{title}' is already in use by session {conflict['id']}"
+                )
         cursor = self._conn.execute(
             "UPDATE sessions SET title = ? WHERE id = ?",
             (title, session_id),
@@ -313,19 +323,23 @@ class SessionDB:
         self._conn.commit()
         return cursor.rowcount > 0
 
-    def get_session_title(self, session_id: str) -> str | None:
+    def get_session_title(self, session_id: str) -> Optional[str]:
         """Get the title for a session, or None."""
-        cursor = self._conn.execute("SELECT title FROM sessions WHERE id = ?", (session_id,))
+        cursor = self._conn.execute(
+            "SELECT title FROM sessions WHERE id = ?", (session_id,)
+        )
         row = cursor.fetchone()
         return row["title"] if row else None
 
-    def get_session_by_title(self, title: str) -> dict[str, Any] | None:
+    def get_session_by_title(self, title: str) -> Optional[Dict[str, Any]]:
         """Look up a session by exact title. Returns session dict or None."""
-        cursor = self._conn.execute("SELECT * FROM sessions WHERE title = ?", (title,))
+        cursor = self._conn.execute(
+            "SELECT * FROM sessions WHERE title = ?", (title,)
+        )
         row = cursor.fetchone()
         return dict(row) if row else None
 
-    def resolve_session_by_title(self, title: str) -> str | None:
+    def resolve_session_by_title(self, title: str) -> Optional[str]:
         """Resolve a title to a session ID, preferring the latest in a lineage.
 
         If the exact title exists, returns that session's ID.
@@ -340,7 +354,8 @@ class SessionDB:
         # Escape SQL LIKE wildcards (%, _) in the title to prevent false matches
         escaped = title.replace("\\", "\\\\").replace("%", "\\%").replace("_", "\\_")
         cursor = self._conn.execute(
-            "SELECT id, title, started_at FROM sessions WHERE title LIKE ? ESCAPE '\\' ORDER BY started_at DESC",
+            "SELECT id, title, started_at FROM sessions "
+            "WHERE title LIKE ? ESCAPE '\\' ORDER BY started_at DESC",
             (f"{escaped} #%",),
         )
         numbered = cursor.fetchall()
@@ -359,9 +374,8 @@ class SessionDB:
         the highest existing number and increments.
         """
         import re
-
         # Strip existing #N suffix to find the true base
-        match = re.match(r"^(.*?) #(\d+)$", base_title)
+        match = re.match(r'^(.*?) #(\d+)$', base_title)
         if match:
             base = match.group(1)
         else:
@@ -382,7 +396,7 @@ class SessionDB:
         # Find the highest number
         max_num = 1  # The unnumbered original counts as #1
         for t in existing:
-            m = re.match(r"^.* #(\d+)$", t)
+            m = re.match(r'^.* #(\d+)$', t)
             if m:
                 max_num = max(max_num, int(m.group(1)))
 
@@ -393,7 +407,7 @@ class SessionDB:
         source: str = None,
         limit: int = 20,
         offset: int = 0,
-    ) -> list[dict[str, Any]]:
+    ) -> List[Dict[str, Any]]:
         """List sessions with preview (first user message) and last active timestamp.
 
         Returns dicts with keys: id, source, model, title, started_at, ended_at,
@@ -477,12 +491,16 @@ class SessionDB:
         msg_id = cursor.lastrowid
 
         # Update counters
-        is_tool_related = role == "tool" or tool_calls is not None
-        if is_tool_related:
+        # Count actual tool calls from the tool_calls list (not from tool responses).
+        # A single assistant message can contain multiple parallel tool calls.
+        num_tool_calls = 0
+        if tool_calls is not None:
+            num_tool_calls = len(tool_calls) if isinstance(tool_calls, list) else 1
+        if num_tool_calls > 0:
             self._conn.execute(
                 """UPDATE sessions SET message_count = message_count + 1,
-                   tool_call_count = tool_call_count + 1 WHERE id = ?""",
-                (session_id,),
+                   tool_call_count = tool_call_count + ? WHERE id = ?""",
+                (num_tool_calls, session_id),
             )
         else:
             self._conn.execute(
@@ -493,7 +511,7 @@ class SessionDB:
         self._conn.commit()
         return msg_id
 
-    def get_messages(self, session_id: str) -> list[dict[str, Any]]:
+    def get_messages(self, session_id: str) -> List[Dict[str, Any]]:
         """Load all messages for a session, ordered by timestamp."""
         cursor = self._conn.execute(
             "SELECT * FROM messages WHERE session_id = ? ORDER BY timestamp, id",
@@ -511,7 +529,7 @@ class SessionDB:
             result.append(msg)
         return result
 
-    def get_messages_as_conversation(self, session_id: str) -> list[dict[str, Any]]:
+    def get_messages_as_conversation(self, session_id: str) -> List[Dict[str, Any]]:
         """
         Load messages in the OpenAI conversation format (role + content dicts).
         Used by the gateway to restore conversation history.
@@ -540,14 +558,40 @@ class SessionDB:
     # Search
     # =========================================================================
 
+    @staticmethod
+    def _sanitize_fts5_query(query: str) -> str:
+        """Sanitize user input for safe use in FTS5 MATCH queries.
+
+        FTS5 has its own query syntax where characters like ``"``, ``(``, ``)``,
+        ``+``, ``*``, ``{``, ``}`` and bare boolean operators (``AND``, ``OR``,
+        ``NOT``) have special meaning.  Passing raw user input directly to
+        MATCH can cause ``sqlite3.OperationalError``.
+
+        Strategy: strip characters that are only meaningful as FTS5 operators
+        and would otherwise cause syntax errors.  This preserves normal keyword
+        search while preventing crashes on inputs like ``C++``, ``"unterminated``,
+        or ``hello AND``.
+        """
+        # Remove FTS5-special characters that are not useful in keyword search
+        sanitized = re.sub(r'[+{}()"^]', " ", query)
+        # Collapse repeated * (e.g. "***") into a single one, and remove
+        # leading * (prefix-only matching requires at least one char before *)
+        sanitized = re.sub(r"\*+", "*", sanitized)
+        sanitized = re.sub(r"(^|\s)\*", r"\1", sanitized)
+        # Remove dangling boolean operators at start/end that would cause
+        # syntax errors (e.g. "hello AND" or "OR world")
+        sanitized = re.sub(r"(?i)^(AND|OR|NOT)\b\s*", "", sanitized.strip())
+        sanitized = re.sub(r"(?i)\s+(AND|OR|NOT)\s*$", "", sanitized.strip())
+        return sanitized.strip()
+
     def search_messages(
         self,
         query: str,
-        source_filter: list[str] = None,
-        role_filter: list[str] = None,
+        source_filter: List[str] = None,
+        role_filter: List[str] = None,
         limit: int = 20,
         offset: int = 0,
-    ) -> list[dict[str, Any]]:
+    ) -> List[Dict[str, Any]]:
         """
         Full-text search across session messages using FTS5.
 
@@ -563,6 +607,10 @@ class SessionDB:
         if not query or not query.strip():
             return []
 
+        query = self._sanitize_fts5_query(query)
+        if not query:
+            return []
+
         if source_filter is None:
             source_filter = ["cli", "telegram", "discord", "whatsapp", "slack"]
 
@@ -602,7 +650,11 @@ class SessionDB:
             LIMIT ? OFFSET ?
         """
 
-        cursor = self._conn.execute(sql, params)
+        try:
+            cursor = self._conn.execute(sql, params)
+        except sqlite3.OperationalError:
+            # FTS5 query syntax error despite sanitization — return empty
+            return []
         matches = [dict(row) for row in cursor.fetchall()]
 
         # Add surrounding context (1 message before + after each match)
@@ -615,7 +667,8 @@ class SessionDB:
                     (match["session_id"], match["id"], match["id"]),
                 )
                 context_msgs = [
-                    {"role": r["role"], "content": (r["content"] or "")[:200]} for r in ctx_cursor.fetchall()
+                    {"role": r["role"], "content": (r["content"] or "")[:200]}
+                    for r in ctx_cursor.fetchall()
                 ]
                 match["context"] = context_msgs
             except Exception:
@@ -631,7 +684,7 @@ class SessionDB:
         source: str = None,
         limit: int = 20,
         offset: int = 0,
-    ) -> list[dict[str, Any]]:
+    ) -> List[Dict[str, Any]]:
         """List sessions, optionally filtered by source."""
         if source:
             cursor = self._conn.execute(
@@ -652,7 +705,9 @@ class SessionDB:
     def session_count(self, source: str = None) -> int:
         """Count sessions, optionally filtered by source."""
         if source:
-            cursor = self._conn.execute("SELECT COUNT(*) FROM sessions WHERE source = ?", (source,))
+            cursor = self._conn.execute(
+                "SELECT COUNT(*) FROM sessions WHERE source = ?", (source,)
+            )
         else:
             cursor = self._conn.execute("SELECT COUNT(*) FROM sessions")
         return cursor.fetchone()[0]
@@ -660,7 +715,9 @@ class SessionDB:
     def message_count(self, session_id: str = None) -> int:
         """Count messages, optionally for a specific session."""
         if session_id:
-            cursor = self._conn.execute("SELECT COUNT(*) FROM messages WHERE session_id = ?", (session_id,))
+            cursor = self._conn.execute(
+                "SELECT COUNT(*) FROM messages WHERE session_id = ?", (session_id,)
+            )
         else:
             cursor = self._conn.execute("SELECT COUNT(*) FROM messages")
         return cursor.fetchone()[0]
@@ -669,7 +726,7 @@ class SessionDB:
     # Export and cleanup
     # =========================================================================
 
-    def export_session(self, session_id: str) -> dict[str, Any] | None:
+    def export_session(self, session_id: str) -> Optional[Dict[str, Any]]:
         """Export a single session with all its messages as a dict."""
         session = self.get_session(session_id)
         if not session:
@@ -677,7 +734,7 @@ class SessionDB:
         messages = self.get_messages(session_id)
         return {**session, "messages": messages}
 
-    def export_all(self, source: str = None) -> list[dict[str, Any]]:
+    def export_all(self, source: str = None) -> List[Dict[str, Any]]:
         """
         Export all sessions (with messages) as a list of dicts.
         Suitable for writing to a JSONL file for backup/analysis.
@@ -691,7 +748,9 @@ class SessionDB:
 
     def clear_messages(self, session_id: str) -> None:
         """Delete all messages for a session and reset its counters."""
-        self._conn.execute("DELETE FROM messages WHERE session_id = ?", (session_id,))
+        self._conn.execute(
+            "DELETE FROM messages WHERE session_id = ?", (session_id,)
+        )
         self._conn.execute(
             "UPDATE sessions SET message_count = 0, tool_call_count = 0 WHERE id = ?",
             (session_id,),
@@ -700,7 +759,9 @@ class SessionDB:
 
     def delete_session(self, session_id: str) -> bool:
         """Delete a session and all its messages. Returns True if found."""
-        cursor = self._conn.execute("SELECT COUNT(*) FROM sessions WHERE id = ?", (session_id,))
+        cursor = self._conn.execute(
+            "SELECT COUNT(*) FROM sessions WHERE id = ?", (session_id,)
+        )
         if cursor.fetchone()[0] == 0:
             return False
         self._conn.execute("DELETE FROM messages WHERE session_id = ?", (session_id,))
@@ -714,7 +775,6 @@ class SessionDB:
         Only prunes ended sessions (not active ones).
         """
         import time as _time
-
         cutoff = _time.time() - (older_than_days * 86400)
 
         if source:

landingpage/index.html

@@ -19,7 +19,10 @@
     <link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet">
     
     <link rel="stylesheet" href="style.css">
-    <link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>⚕</text></svg>">
+    <link rel="icon" type="image/x-icon" href="favicon.ico">
+    <link rel="icon" type="image/png" sizes="32x32" href="favicon-32x32.png">
+    <link rel="icon" type="image/png" sizes="16x16" href="favicon-16x16.png">
+    <link rel="apple-touch-icon" sizes="180x180" href="apple-touch-icon.png">
 </head>
 <body>
     <!-- Ambient glow effects -->

mini_swe_runner.py

@@ -189,29 +189,30 @@ class MiniSWERunner:
         )
         self.logger = logging.getLogger(__name__)
         
-        # Initialize OpenAI client - defaults to OpenRouter
-        from openai import OpenAI
-        
-        client_kwargs = {}
-        
-        # Default to OpenRouter if no base_url provided
-        if base_url:
-            client_kwargs["base_url"] = base_url
+        # Initialize LLM client via centralized provider router.
+        # If explicit api_key/base_url are provided (e.g. from CLI args),
+        # construct directly.  Otherwise use the router for OpenRouter.
+        if api_key or base_url:
+            from openai import OpenAI
+            client_kwargs = {
+                "base_url": base_url or "https://openrouter.ai/api/v1",
+                "api_key": api_key or os.getenv(
+                    "OPENROUTER_API_KEY",
+                    os.getenv("ANTHROPIC_API_KEY",
+                              os.getenv("OPENAI_API_KEY", ""))),
+            }
+            self.client = OpenAI(**client_kwargs)
         else:
-            client_kwargs["base_url"] = "https://openrouter.ai/api/v1"
-
-
-        
-        # Handle API key - OpenRouter is the primary provider
-        if api_key:
-            client_kwargs["api_key"] = api_key
-        else:
-            client_kwargs["api_key"] = os.getenv(
-                "OPENROUTER_API_KEY",
-                os.getenv("ANTHROPIC_API_KEY", os.getenv("OPENAI_API_KEY", ""))
-            )
-        
-        self.client = OpenAI(**client_kwargs)
+            from agent.auxiliary_client import resolve_provider_client
+            self.client, _ = resolve_provider_client("openrouter", model=model)
+            if self.client is None:
+                # Fallback: try auto-detection
+                self.client, _ = resolve_provider_client("auto", model=model)
+            if self.client is None:
+                from openai import OpenAI
+                self.client = OpenAI(
+                    base_url="https://openrouter.ai/api/v1",
+                    api_key=os.getenv("OPENROUTER_API_KEY", ""))
         
         # Environment will be created per-task
         self.env = None

model_tools.py

@@ -20,10 +20,11 @@ Public API (signatures preserved from the original 2,400-line version):
     check_tool_availability(quiet) -> tuple
 """
 
-import asyncio
 import json
+import asyncio
+import os
 import logging
-from typing import Any
+from typing import Dict, Any, List, Optional, Tuple
 
 from tools.registry import registry
 from toolsets import resolve_toolset, validate_toolset
@@ -35,7 +36,6 @@ logger = logging.getLogger(__name__)
 # Async Bridging  (single source of truth -- used by registry.dispatch too)
 # =============================================================================
 
-
 def _run_async(coro):
     """Run an async coroutine from a sync context.
 
@@ -56,7 +56,6 @@ def _run_async(coro):
 
     if loop and loop.is_running():
         import concurrent.futures
-
         with concurrent.futures.ThreadPoolExecutor(max_workers=1) as pool:
             future = pool.submit(asyncio.run, coro)
             return future.result(timeout=300)
@@ -67,7 +66,6 @@ def _run_async(coro):
 # Tool Discovery  (importing each module triggers its registry.register calls)
 # =============================================================================
 
-
 def _discover_tools():
     """Import all tool modules to trigger their registry.register() calls.
 
@@ -99,7 +97,6 @@ def _discover_tools():
         "tools.homeassistant_tool",
     ]
     import importlib
-
     for mod_name in _modules:
         try:
             importlib.import_module(mod_name)
@@ -112,7 +109,6 @@ _discover_tools()
 # MCP tool discovery (external MCP servers from config)
 try:
     from tools.mcp_tool import discover_mcp_tools
-
     discover_mcp_tools()
 except Exception as e:
     logger.debug("MCP tool discovery failed: %s", e)
@@ -122,13 +118,13 @@ except Exception as e:
 # Backward-compat constants  (built once after discovery)
 # =============================================================================
 
-TOOL_TO_TOOLSET_MAP: dict[str, str] = registry.get_tool_to_toolset_map()
+TOOL_TO_TOOLSET_MAP: Dict[str, str] = registry.get_tool_to_toolset_map()
 
-TOOLSET_REQUIREMENTS: dict[str, dict] = registry.get_toolset_requirements()
+TOOLSET_REQUIREMENTS: Dict[str, dict] = registry.get_toolset_requirements()
 
 # Resolved tool names from the last get_tool_definitions() call.
 # Used by code_execution_tool to know which tools are available in this session.
-_last_resolved_tool_names: list[str] = []
+_last_resolved_tool_names: List[str] = []
 
 
 # =============================================================================
@@ -143,29 +139,18 @@ _LEGACY_TOOLSET_MAP = {
     "image_tools": ["image_generate"],
     "skills_tools": ["skills_list", "skill_view", "skill_manage"],
     "browser_tools": [
-        "browser_navigate",
-        "browser_snapshot",
-        "browser_click",
-        "browser_type",
-        "browser_scroll",
-        "browser_back",
-        "browser_press",
-        "browser_close",
-        "browser_get_images",
-        "browser_vision",
+        "browser_navigate", "browser_snapshot", "browser_click",
+        "browser_type", "browser_scroll", "browser_back",
+        "browser_press", "browser_close", "browser_get_images",
+        "browser_vision"
     ],
     "cronjob_tools": ["schedule_cronjob", "list_cronjobs", "remove_cronjob"],
     "rl_tools": [
-        "rl_list_environments",
-        "rl_select_environment",
-        "rl_get_current_config",
-        "rl_edit_config",
-        "rl_start_training",
-        "rl_check_status",
-        "rl_stop_training",
-        "rl_get_results",
-        "rl_list_runs",
-        "rl_test_inference",
+        "rl_list_environments", "rl_select_environment",
+        "rl_get_current_config", "rl_edit_config",
+        "rl_start_training", "rl_check_status",
+        "rl_stop_training", "rl_get_results",
+        "rl_list_runs", "rl_test_inference"
     ],
     "file_tools": ["read_file", "write_file", "patch", "search_files"],
     "tts_tools": ["text_to_speech"],
@@ -176,12 +161,11 @@ _LEGACY_TOOLSET_MAP = {
 # get_tool_definitions  (the main schema provider)
 # =============================================================================
 
-
 def get_tool_definitions(
-    enabled_toolsets: list[str] = None,
-    disabled_toolsets: list[str] = None,
+    enabled_toolsets: List[str] = None,
+    disabled_toolsets: List[str] = None,
     quiet_mode: bool = False,
-) -> list[dict[str, Any]]:
+) -> List[Dict[str, Any]]:
     """
     Get tool definitions for model API calls with toolset-based filtering.
 
@@ -216,7 +200,6 @@ def get_tool_definitions(
 
     elif disabled_toolsets:
         from toolsets import get_all_toolsets
-
         for ts_name in get_all_toolsets():
             tools_to_include.update(resolve_toolset(ts_name))
 
@@ -236,7 +219,6 @@ def get_tool_definitions(
                     print(f"⚠️  Unknown toolset: {toolset_name}")
     else:
         from toolsets import get_all_toolsets
-
         for ts_name in get_all_toolsets():
             tools_to_include.update(resolve_toolset(ts_name))
 
@@ -248,7 +230,6 @@ def get_tool_definitions(
     # execute_code" even when the user disabled the web toolset (#560-discord).
     if "execute_code" in tools_to_include:
         from tools.code_execution_tool import SANDBOX_ALLOWED_TOOLS, build_execute_code_schema
-
         sandbox_enabled = SANDBOX_ALLOWED_TOOLS & tools_to_include
         dynamic_schema = build_execute_code_schema(sandbox_enabled)
         for i, td in enumerate(filtered_tools):
@@ -282,9 +263,10 @@ _AGENT_LOOP_TOOLS = {"todo", "memory", "session_search", "delegate_task"}
 
 def handle_function_call(
     function_name: str,
-    function_args: dict[str, Any],
-    task_id: str | None = None,
-    user_task: str | None = None,
+    function_args: Dict[str, Any],
+    task_id: Optional[str] = None,
+    user_task: Optional[str] = None,
+    enabled_tools: Optional[List[str]] = None,
 ) -> str:
     """
     Main function call dispatcher that routes calls to the tool registry.
@@ -294,25 +276,40 @@ def handle_function_call(
         function_args: Arguments for the function.
         task_id: Unique identifier for terminal/browser session isolation.
         user_task: The user's original task (for browser_snapshot context).
+        enabled_tools: Tool names enabled for this session.  When provided,
+                       execute_code uses this list to determine which sandbox
+                       tools to generate.  Falls back to the process-global
+                       ``_last_resolved_tool_names`` for backward compat.
 
     Returns:
         Function result as a JSON string.
     """
+    # Notify the read-loop tracker when a non-read/search tool runs,
+    # so the *consecutive* counter resets (reads after other work are fine).
+    _READ_SEARCH_TOOLS = {"read_file", "search_files"}
+    if function_name not in _READ_SEARCH_TOOLS:
+        try:
+            from tools.file_tools import notify_other_tool_call
+            notify_other_tool_call(task_id or "default")
+        except Exception:
+            pass  # file_tools may not be loaded yet
+
     try:
         if function_name in _AGENT_LOOP_TOOLS:
             return json.dumps({"error": f"{function_name} must be handled by the agent loop"})
 
         if function_name == "execute_code":
+            # Prefer the caller-provided list so subagents can't overwrite
+            # the parent's tool set via the process-global.
+            sandbox_enabled = enabled_tools if enabled_tools is not None else _last_resolved_tool_names
             return registry.dispatch(
-                function_name,
-                function_args,
+                function_name, function_args,
                 task_id=task_id,
-                enabled_tools=_last_resolved_tool_names,
+                enabled_tools=sandbox_enabled,
             )
 
         return registry.dispatch(
-            function_name,
-            function_args,
+            function_name, function_args,
             task_id=task_id,
             user_task=user_task,
         )
@@ -327,27 +324,26 @@ def handle_function_call(
 # Backward-compat wrapper functions
 # =============================================================================
 
-
-def get_all_tool_names() -> list[str]:
+def get_all_tool_names() -> List[str]:
     """Return all registered tool names."""
     return registry.get_all_tool_names()
 
 
-def get_toolset_for_tool(tool_name: str) -> str | None:
+def get_toolset_for_tool(tool_name: str) -> Optional[str]:
     """Return the toolset a tool belongs to."""
     return registry.get_toolset_for_tool(tool_name)
 
 
-def get_available_toolsets() -> dict[str, dict]:
+def get_available_toolsets() -> Dict[str, dict]:
     """Return toolset availability info for UI display."""
     return registry.get_available_toolsets()
 
 
-def check_toolset_requirements() -> dict[str, bool]:
+def check_toolset_requirements() -> Dict[str, bool]:
     """Return {toolset: available_bool} for every registered toolset."""
     return registry.check_toolset_requirements()
 
 
-def check_tool_availability(quiet: bool = False) -> tuple[list[str], list[dict]]:
+def check_tool_availability(quiet: bool = False) -> Tuple[List[str], List[dict]]:
     """Return (available_toolsets, unavailable_info)."""
     return registry.check_tool_availability(quiet=quiet)

optional-skills/migration/DESCRIPTION.md

@@ -0,0 +1,2 @@
+Optional migration workflows for importing user state and customizations from
+other agent systems into Hermes Agent.

optional-skills/migration/openclaw-migration/SKILL.md

@@ -0,0 +1,297 @@
+---
+name: openclaw-migration
+description: Migrate a user's OpenClaw customization footprint into Hermes Agent. Imports Hermes-compatible memories, SOUL.md, command allowlists, user skills, and selected workspace assets from ~/.openclaw, then reports exactly what could not be migrated and why.
+version: 1.0.0
+author: Hermes Agent (Nous Research)
+license: MIT
+metadata:
+  hermes:
+    tags: [Migration, OpenClaw, Hermes, Memory, Persona, Import]
+    related_skills: [hermes-agent]
+---
+
+# OpenClaw -> Hermes Migration
+
+Use this skill when a user wants to move their OpenClaw setup into Hermes Agent with minimal manual cleanup.
+
+## CLI Command
+
+For a quick, non-interactive migration, use the built-in CLI command:
+
+```bash
+hermes claw migrate              # Full interactive migration
+hermes claw migrate --dry-run    # Preview what would be migrated
+hermes claw migrate --preset user-data   # Migrate without secrets
+hermes claw migrate --overwrite  # Overwrite existing conflicts
+hermes claw migrate --source /custom/path/.openclaw  # Custom source
+```
+
+The CLI command runs the same migration script described below. Use this skill (via the agent) when you want an interactive, guided migration with dry-run previews and per-item conflict resolution.
+
+**First-time setup:** The `hermes setup` wizard automatically detects `~/.openclaw` and offers migration before configuration begins.
+
+## What this skill does
+
+It uses `scripts/openclaw_to_hermes.py` to:
+
+- import `SOUL.md` into the Hermes home directory as `SOUL.md`
+- transform OpenClaw `MEMORY.md` and `USER.md` into Hermes memory entries
+- merge OpenClaw command approval patterns into Hermes `command_allowlist`
+- migrate Hermes-compatible messaging settings such as `TELEGRAM_ALLOWED_USERS` and `MESSAGING_CWD`
+- copy OpenClaw skills into `~/.hermes/skills/openclaw-imports/`
+- optionally copy the OpenClaw workspace instructions file into a chosen Hermes workspace
+- mirror compatible workspace assets such as `workspace/tts/` into `~/.hermes/tts/`
+- archive non-secret docs that do not have a direct Hermes destination
+- produce a structured report listing migrated items, conflicts, skipped items, and reasons
+
+## Path resolution
+
+The helper script lives in this skill directory at:
+
+- `scripts/openclaw_to_hermes.py`
+
+When this skill is installed from the Skills Hub, the normal location is:
+
+- `~/.hermes/skills/migration/openclaw-migration/scripts/openclaw_to_hermes.py`
+
+Do not guess a shorter path like `~/.hermes/skills/openclaw-migration/...`.
+
+Before running the helper:
+
+1. Prefer the installed path under `~/.hermes/skills/migration/openclaw-migration/`.
+2. If that path fails, inspect the installed skill directory and resolve the script relative to the installed `SKILL.md`.
+3. Only use `find` as a fallback if the installed location is missing or the skill was moved manually.
+4. When calling the terminal tool, do not pass `workdir: "~"`. Use an absolute directory such as the user's home directory, or omit `workdir` entirely.
+
+With `--migrate-secrets`, it will also import a small allowlisted set of Hermes-compatible secrets, currently:
+
+- `TELEGRAM_BOT_TOKEN`
+
+## Default workflow
+
+1. Inspect first with a dry run.
+2. Present a simple summary of what can be migrated, what cannot be migrated, and what would be archived.
+3. If the `clarify` tool is available, use it for user decisions instead of asking for a free-form prose reply.
+4. If the dry run finds imported skill directory conflicts, ask how those should be handled before executing.
+5. Ask the user to choose between the two supported migration modes before executing.
+6. Ask for a target workspace path only if the user wants the workspace instructions file brought over.
+7. Execute the migration with the matching preset and flags.
+8. Summarize the results, especially:
+   - what was migrated
+   - what was archived for manual review
+   - what was skipped and why
+
+## User interaction protocol
+
+Hermes CLI supports the `clarify` tool for interactive prompts, but it is limited to:
+
+- one choice at a time
+- up to 4 predefined choices
+- an automatic `Other` free-text option
+
+It does **not** support true multi-select checkboxes in a single prompt.
+
+For every `clarify` call:
+
+- always include a non-empty `question`
+- include `choices` only for real selectable prompts
+- keep `choices` to 2-4 plain string options
+- never emit placeholder or truncated options such as `...`
+- never pad or stylize choices with extra whitespace
+- never include fake form fields in the question such as `enter directory here`, blank lines to fill in, or underscores like `_____`
+- for open-ended path questions, ask only the plain sentence; the user types in the normal CLI prompt below the panel
+
+If a `clarify` call returns an error, inspect the error text, correct the payload, and retry once with a valid `question` and clean choices.
+
+When `clarify` is available and the dry run reveals any required user decision, your **next action must be a `clarify` tool call**.
+Do not end the turn with a normal assistant message such as:
+
+- "Let me present the choices"
+- "What would you like to do?"
+- "Here are the options"
+
+If a user decision is required, collect it via `clarify` before producing more prose.
+If multiple unresolved decisions remain, do not insert an explanatory assistant message between them. After one `clarify` response is received, your next action should usually be the next required `clarify` call.
+
+Treat `workspace-agents` as an unresolved decision whenever the dry run reports:
+
+- `kind="workspace-agents"`
+- `status="skipped"`
+- reason containing `No workspace target was provided`
+
+In that case, you must ask about workspace instructions before execution. Do not silently treat that as a decision to skip.
+
+Because of that limitation, use this simplified decision flow:
+
+1. For `SOUL.md` conflicts, use `clarify` with choices such as:
+   - `keep existing`
+   - `overwrite with backup`
+   - `review first`
+2. If the dry run shows one or more `kind="skill"` items with `status="conflict"`, use `clarify` with choices such as:
+   - `keep existing skills`
+   - `overwrite conflicting skills with backup`
+   - `import conflicting skills under renamed folders`
+3. For workspace instructions, use `clarify` with choices such as:
+   - `skip workspace instructions`
+   - `copy to a workspace path`
+   - `decide later`
+4. If the user chooses to copy workspace instructions, ask a follow-up open-ended `clarify` question requesting an **absolute path**.
+5. If the user chooses `skip workspace instructions` or `decide later`, proceed without `--workspace-target`.
+5. For migration mode, use `clarify` with these 3 choices:
+   - `user-data only`
+   - `full compatible migration`
+   - `cancel`
+6. `user-data only` means: migrate user data and compatible config, but do **not** import allowlisted secrets.
+7. `full compatible migration` means: migrate the same compatible user data plus the allowlisted secrets when present.
+8. If `clarify` is not available, ask the same question in normal text, but still constrain the answer to `user-data only`, `full compatible migration`, or `cancel`.
+
+Execution gate:
+
+- Do not execute while a `workspace-agents` skip caused by `No workspace target was provided` remains unresolved.
+- The only valid ways to resolve it are:
+  - user explicitly chooses `skip workspace instructions`
+  - user explicitly chooses `decide later`
+  - user provides a workspace path after choosing `copy to a workspace path`
+- Absence of a workspace target in the dry run is not itself permission to execute.
+- Do not execute while any required `clarify` decision remains unresolved.
+
+Use these exact `clarify` payload shapes as the default pattern:
+
+- `{"question":"Your existing SOUL.md conflicts with the imported one. What should I do?","choices":["keep existing","overwrite with backup","review first"]}`
+- `{"question":"One or more imported OpenClaw skills already exist in Hermes. How should I handle those skill conflicts?","choices":["keep existing skills","overwrite conflicting skills with backup","import conflicting skills under renamed folders"]}`
+- `{"question":"Choose migration mode: migrate only user data, or run the full compatible migration including allowlisted secrets?","choices":["user-data only","full compatible migration","cancel"]}`
+- `{"question":"Do you want to copy the OpenClaw workspace instructions file into a Hermes workspace?","choices":["skip workspace instructions","copy to a workspace path","decide later"]}`
+- `{"question":"Please provide an absolute path where the workspace instructions should be copied."}`
+
+## Decision-to-command mapping
+
+Map user decisions to command flags exactly:
+
+- If the user chooses `keep existing` for `SOUL.md`, do **not** add `--overwrite`.
+- If the user chooses `overwrite with backup`, add `--overwrite`.
+- If the user chooses `review first`, stop before execution and review the relevant files.
+- If the user chooses `keep existing skills`, add `--skill-conflict skip`.
+- If the user chooses `overwrite conflicting skills with backup`, add `--skill-conflict overwrite`.
+- If the user chooses `import conflicting skills under renamed folders`, add `--skill-conflict rename`.
+- If the user chooses `user-data only`, execute with `--preset user-data` and do **not** add `--migrate-secrets`.
+- If the user chooses `full compatible migration`, execute with `--preset full --migrate-secrets`.
+- Only add `--workspace-target` if the user explicitly provided an absolute workspace path.
+- If the user chooses `skip workspace instructions` or `decide later`, do not add `--workspace-target`.
+
+Before executing, restate the exact command plan in plain language and make sure it matches the user's choices.
+
+## Post-run reporting rules
+
+After execution, treat the script's JSON output as the source of truth.
+
+1. Base all counts on `report.summary`.
+2. Only list an item under "Successfully Migrated" if its `status` is exactly `migrated`.
+3. Do not claim a conflict was resolved unless the report shows that item as `migrated`.
+4. Do not say `SOUL.md` was overwritten unless the report item for `kind="soul"` has `status="migrated"`.
+5. If `report.summary.conflict > 0`, include a conflict section instead of silently implying success.
+6. If counts and listed items disagree, fix the list to match the report before responding.
+7. Include the `output_dir` path from the report when available so the user can inspect `report.json`, `summary.md`, backups, and archived files.
+8. For memory or user-profile overflow, do not say the entries were archived unless the report explicitly shows an archive path. If `details.overflow_file` exists, say the full overflow list was exported there.
+9. If a skill was imported under a renamed folder, report the final destination and mention `details.renamed_from`.
+10. If `report.skill_conflict_mode` is present, use it as the source of truth for the selected imported-skill conflict policy.
+11. If an item has `status="skipped"`, do not describe it as overwritten, backed up, migrated, or resolved.
+12. If `kind="soul"` has `status="skipped"` with reason `Target already matches source`, say it was left unchanged and do not mention a backup.
+13. If a renamed imported skill has an empty `details.backup`, do not imply the existing Hermes skill was renamed or backed up. Say only that the imported copy was placed in the new destination and reference `details.renamed_from` as the pre-existing folder that remained in place.
+
+## Migration presets
+
+Prefer these two presets in normal use:
+
+- `user-data`
+- `full`
+
+`user-data` includes:
+
+- `soul`
+- `workspace-agents`
+- `memory`
+- `user-profile`
+- `messaging-settings`
+- `command-allowlist`
+- `skills`
+- `tts-assets`
+- `archive`
+
+`full` includes everything in `user-data` plus:
+
+- `secret-settings`
+
+The helper script still supports category-level `--include` / `--exclude`, but treat that as an advanced fallback rather than the default UX.
+
+## Commands
+
+Dry run with full discovery:
+
+```bash
+python3 ~/.hermes/skills/migration/openclaw-migration/scripts/openclaw_to_hermes.py
+```
+
+When using the terminal tool, prefer an absolute invocation pattern such as:
+
+```json
+{"command":"python3 /home/USER/.hermes/skills/migration/openclaw-migration/scripts/openclaw_to_hermes.py","workdir":"/home/USER"}
+```
+
+Dry run with the user-data preset:
+
+```bash
+python3 ~/.hermes/skills/migration/openclaw-migration/scripts/openclaw_to_hermes.py --preset user-data
+```
+
+Execute a user-data migration:
+
+```bash
+python3 ~/.hermes/skills/migration/openclaw-migration/scripts/openclaw_to_hermes.py --execute --preset user-data --skill-conflict skip
+```
+
+Execute a full compatible migration:
+
+```bash
+python3 ~/.hermes/skills/migration/openclaw-migration/scripts/openclaw_to_hermes.py --execute --preset full --migrate-secrets --skill-conflict skip
+```
+
+Execute with workspace instructions included:
+
+```bash
+python3 ~/.hermes/skills/migration/openclaw-migration/scripts/openclaw_to_hermes.py --execute --preset user-data --skill-conflict rename --workspace-target "/absolute/workspace/path"
+```
+
+Do not use `$PWD` or the home directory as the workspace target by default. Ask for an explicit workspace path first.
+
+## Important rules
+
+1. Run a dry run before writing unless the user explicitly says to proceed immediately.
+2. Do not migrate secrets by default. Tokens, auth blobs, device credentials, and raw gateway config should stay out of Hermes unless the user explicitly asks for secret migration.
+3. Do not silently overwrite non-empty Hermes targets unless the user explicitly wants that. The helper script will preserve backups when overwriting is enabled.
+4. Always give the user the skipped-items report. That report is part of the migration, not an optional extra.
+5. Prefer the primary OpenClaw workspace (`~/.openclaw/workspace/`) over `workspace.default/`. Only use the default workspace as fallback when the primary files are missing.
+6. Even in secret-migration mode, only migrate secrets with a clean Hermes destination. Unsupported auth blobs must still be reported as skipped.
+7. If the dry run shows a large asset copy, a conflicting `SOUL.md`, or overflowed memory entries, call those out separately before execution.
+8. Default to `user-data only` if the user is unsure.
+9. Only include `workspace-agents` when the user has explicitly provided a destination workspace path.
+10. Treat category-level `--include` / `--exclude` as an advanced escape hatch, not the normal flow.
+11. Do not end the dry-run summary with a vague “What would you like to do?” if `clarify` is available. Use structured follow-up prompts instead.
+12. Do not use an open-ended `clarify` prompt when a real choice prompt would work. Prefer selectable choices first, then free text only for absolute paths or file review requests.
+13. After a dry run, never stop after summarizing if there is still an unresolved decision. Use `clarify` immediately for the highest-priority blocking decision.
+14. Priority order for follow-up questions:
+    - `SOUL.md` conflict
+    - imported skill conflicts
+    - migration mode
+    - workspace instructions destination
+15. Do not promise to present choices later in the same message. Present them by actually calling `clarify`.
+16. After the migration-mode answer, explicitly check whether `workspace-agents` is still unresolved. If it is, your next action must be the workspace-instructions `clarify` call.
+17. After any `clarify` answer, if another required decision remains, do not narrate what was just decided. Ask the next required question immediately.
+
+## Expected result
+
+After a successful run, the user should have:
+
+- Hermes persona state imported
+- Hermes memory files populated with converted OpenClaw knowledge
+- OpenClaw skills available under `~/.hermes/skills/openclaw-imports/`
+- a migration report showing any conflicts, omissions, or unsupported data

plans/checkpoint-rollback.md

@@ -0,0 +1,218 @@
+# Checkpoint & Rollback — Implementation Plan
+
+## Goal
+
+Automatic filesystem snapshots before destructive file operations, with user-facing rollback. The agent never sees or interacts with this — it's transparent infrastructure.
+
+## Design Principles
+
+1. **Not a tool** — the LLM never knows about it. Zero prompt tokens, zero tool schema overhead.
+2. **Once per turn** — checkpoint at most once per conversation turn (user message → agent response cycle), triggered lazily on the first file-mutating operation. Not on every write.
+3. **Opt-in via config** — disabled by default, enabled with `checkpoints: true` in config.yaml.
+4. **Works on any directory** — uses a shadow git repo completely separate from the user's project git. Works on git repos, non-git directories, anything.
+5. **User-facing rollback** — `/rollback` slash command (CLI + gateway) to list and restore checkpoints. Also `hermes rollback` CLI subcommand.
+
+## Architecture
+
+```
+~/.hermes/checkpoints/
+  {sha256(abs_dir)[:16]}/       # Shadow git repo per working directory
+    HEAD, refs/, objects/...    # Standard git internals
+    HERMES_WORKDIR              # Original dir path (for display)
+    info/exclude                # Default excludes (node_modules, .env, etc.)
+```
+
+### Core: CheckpointManager (new file: tools/checkpoint_manager.py)
+
+Adapted from PR #559's CheckpointStore. Key changes from the PR:
+
+- **Not a tool** — no schema, no registry entry, no handler
+- **Turn-scoped deduplication** — tracks `_checkpointed_dirs: Set[str]` per turn
+- **Configurable** — reads `checkpoints` config key
+- **Pruning** — keeps last N snapshots per directory (default 50), prunes on take
+
+```python
+class CheckpointManager:
+    def __init__(self, enabled: bool = False, max_snapshots: int = 50):
+        self.enabled = enabled
+        self.max_snapshots = max_snapshots
+        self._checkpointed_dirs: Set[str] = set()  # reset each turn
+
+    def new_turn(self):
+        """Call at start of each conversation turn to reset dedup."""
+        self._checkpointed_dirs.clear()
+
+    def ensure_checkpoint(self, working_dir: str, reason: str = "auto") -> None:
+        """Take a checkpoint if enabled and not already done this turn."""
+        if not self.enabled:
+            return
+        abs_dir = str(Path(working_dir).resolve())
+        if abs_dir in self._checkpointed_dirs:
+            return
+        self._checkpointed_dirs.add(abs_dir)
+        try:
+            self._take(abs_dir, reason)
+        except Exception as e:
+            logger.debug("Checkpoint failed (non-fatal): %s", e)
+
+    def list_checkpoints(self, working_dir: str) -> List[dict]:
+        """List available checkpoints for a directory."""
+        ...
+
+    def restore(self, working_dir: str, commit_hash: str) -> dict:
+        """Restore files to a checkpoint state."""
+        ...
+
+    def _take(self, working_dir: str, reason: str):
+        """Shadow git: add -A + commit. Prune if over max_snapshots."""
+        ...
+
+    def _prune(self, shadow_repo: Path):
+        """Keep only last max_snapshots commits."""
+        ...
+```
+
+### Integration Point: run_agent.py
+
+The AIAgent already owns the conversation loop. Add CheckpointManager as an instance attribute:
+
+```python
+class AIAgent:
+    def __init__(self, ...):
+        ...
+        # Checkpoint manager — reads config to determine if enabled
+        self._checkpoint_mgr = CheckpointManager(
+            enabled=config.get("checkpoints", False),
+            max_snapshots=config.get("checkpoint_max_snapshots", 50),
+        )
+```
+
+**Turn boundary** — in `run_conversation()`, call `new_turn()` at the start of each agent iteration (before processing tool calls):
+
+```python
+# Inside the main loop, before _execute_tool_calls():
+self._checkpoint_mgr.new_turn()
+```
+
+**Trigger point** — in `_execute_tool_calls()`, before dispatching file-mutating tools:
+
+```python
+# Before the handle_function_call dispatch:
+if function_name in ("write_file", "patch"):
+    # Determine working dir from the file path in the args
+    file_path = function_args.get("path", "") or function_args.get("old_string", "")
+    if file_path:
+        work_dir = str(Path(file_path).parent.resolve())
+        self._checkpoint_mgr.ensure_checkpoint(work_dir, f"before {function_name}")
+```
+
+This means:
+- First `write_file` in a turn → checkpoint (fast, one `git add -A && git commit`)
+- Subsequent writes in the same turn → no-op (already checkpointed)
+- Next turn (new user message) → fresh checkpoint eligibility
+
+### Config
+
+Add to `DEFAULT_CONFIG` in `hermes_cli/config.py`:
+
+```python
+"checkpoints": False,          # Enable filesystem checkpoints before destructive ops
+"checkpoint_max_snapshots": 50, # Max snapshots to keep per directory
+```
+
+User enables with:
+```yaml
+# ~/.hermes/config.yaml
+checkpoints: true
+```
+
+### User-Facing Rollback
+
+**CLI slash command** — add `/rollback` to `process_command()` in `cli.py`:
+
+```
+/rollback         — List recent checkpoints for the current directory
+/rollback <hash>  — Restore files to that checkpoint
+```
+
+Shows a numbered list:
+```
+📸 Checkpoints for /home/user/project:
+  1. abc1234  2026-03-09 21:15  before write_file (3 files changed)
+  2. def5678  2026-03-09 20:42  before patch (1 file changed)
+  3. ghi9012  2026-03-09 20:30  before write_file (2 files changed)
+
+Use /rollback <number> to restore, e.g. /rollback 1
+```
+
+**Gateway slash command** — add `/rollback` to gateway/run.py with the same behavior.
+
+**CLI subcommand** — `hermes rollback` (optional, lower priority).
+
+### What Gets Excluded (not checkpointed)
+
+Same as the PR's defaults — written to the shadow repo's `info/exclude`:
+
+```
+node_modules/
+dist/
+build/
+.env
+.env.*
+__pycache__/
+*.pyc
+.DS_Store
+*.log
+.cache/
+.venv/
+.git/
+```
+
+Also respects the project's `.gitignore` if present (shadow repo can read it via `core.excludesFile`).
+
+### Safety
+
+- `ensure_checkpoint()` wraps everything in try/except — a checkpoint failure never blocks the actual file operation
+- Shadow repo is completely isolated — GIT_DIR + GIT_WORK_TREE env vars, never touches user's .git
+- If git isn't installed, checkpoints silently disable
+- Large directories: add a file count check — skip checkpoint if >50K files to avoid slowdowns
+
+## Files to Create/Modify
+
+| File | Change |
+|------|--------|
+| `tools/checkpoint_manager.py` | **NEW** — CheckpointManager class (adapted from PR #559) |
+| `run_agent.py` | Add CheckpointManager init + trigger in `_execute_tool_calls()` |
+| `hermes_cli/config.py` | Add `checkpoints` + `checkpoint_max_snapshots` to DEFAULT_CONFIG |
+| `cli.py` | Add `/rollback` slash command handler |
+| `gateway/run.py` | Add `/rollback` slash command handler |
+| `tests/tools/test_checkpoint_manager.py` | **NEW** — tests (adapted from PR #559's tests) |
+
+## What We Take From PR #559
+
+- `_shadow_repo_path()` — deterministic path hashing ✅
+- `_git_env()` — GIT_DIR/GIT_WORK_TREE isolation ✅
+- `_run_git()` — subprocess wrapper with timeout ✅
+- `_init_shadow_repo()` — shadow repo initialization ✅
+- `DEFAULT_EXCLUDES` list ✅
+- Test structure and patterns ✅
+
+## What We Change From PR #559
+
+- **Remove tool schema/registry** — not a tool
+- **Remove injection into file_operations.py and patch_parser.py** — trigger from run_agent.py instead
+- **Add turn-scoped deduplication** — one checkpoint per turn, not per operation
+- **Add pruning** — keep last N snapshots
+- **Add config flag** — opt-in, not mandatory
+- **Add /rollback command** — user-facing restore UI
+- **Add file count guard** — skip huge directories
+
+## Implementation Order
+
+1. `tools/checkpoint_manager.py` — core class with take/list/restore/prune
+2. `tests/tools/test_checkpoint_manager.py` — tests
+3. `hermes_cli/config.py` — config keys
+4. `run_agent.py` — integration (init + trigger)
+5. `cli.py` — `/rollback` slash command
+6. `gateway/run.py` — `/rollback` slash command
+7. Full test suite run + manual smoke test