feat: support ignoring unauthorized gateway DMs

Add unauthorized_dm_behavior config (pair|ignore) with global default
and per-platform override. WhatsApp can silently drop unknown DMs
instead of sending pairing codes.

Adapted config bridging to work with gw_data dict (pre-construction)
rather than config object. Dropped implementation plan document.

.envrc

@@ -1 +0,0 @@
-use flake

.github/workflows/nix.yml

@@ -1,40 +0,0 @@
-name: Nix
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    paths:
-      - 'flake.nix'
-      - 'flake.lock'
-      - 'nix/**'
-      - 'pyproject.toml'
-      - 'uv.lock'
-      - 'hermes_cli/**'
-      - 'run_agent.py'
-      - 'acp_adapter/**'
-
-concurrency:
-  group: nix-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  nix:
-    strategy:
-      matrix:
-        os: [ubuntu-latest, macos-latest]
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v4
-      - uses: DeterminateSystems/nix-installer-action@main
-      - uses: DeterminateSystems/magic-nix-cache-action@main
-      - name: Check flake
-        if: runner.os == 'Linux'
-        run: nix flake check --print-build-logs
-      - name: Build package
-        if: runner.os == 'Linux'
-        run: nix build --print-build-logs
-      - name: Evaluate flake (macOS)
-        if: runner.os == 'macOS'
-        run: nix flake show --json > /dev/null

.github/workflows/supply-chain-audit.yml

@@ -1,192 +0,0 @@
-name: Supply Chain Audit
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened]
-
-permissions:
-  pull-requests: write
-  contents: read
-
-jobs:
-  scan:
-    name: Scan PR for supply chain risks
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Scan diff for suspicious patterns
-        id: scan
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-
-          BASE="${{ github.event.pull_request.base.sha }}"
-          HEAD="${{ github.event.pull_request.head.sha }}"
-
-          # Get the full diff (added lines only)
-          DIFF=$(git diff "$BASE".."$HEAD" -- . ':!uv.lock' ':!*.lock' ':!package-lock.json' ':!yarn.lock' || true)
-
-          FINDINGS=""
-          CRITICAL=false
-
-          # --- .pth files (auto-execute on Python startup) ---
-          PTH_FILES=$(git diff --name-only "$BASE".."$HEAD" | grep '\.pth$' || true)
-          if [ -n "$PTH_FILES" ]; then
-            CRITICAL=true
-            FINDINGS="${FINDINGS}
-          ### 🚨 CRITICAL: .pth file added or modified
-          Python \`.pth\` files in \`site-packages/\` execute automatically when the interpreter starts — no import required. This is the exact mechanism used in the [litellm supply chain attack](https://github.com/BerriAI/litellm/issues/24512).
-
-          **Files:**
-          \`\`\`
-          ${PTH_FILES}
-          \`\`\`
-          "
-          fi
-
-          # --- base64 + exec/eval combo (the litellm attack pattern) ---
-          B64_EXEC_HITS=$(echo "$DIFF" | grep -n '^\+' | grep -iE 'base64\.(b64decode|decodebytes|urlsafe_b64decode)' | grep -iE 'exec\(|eval\(' | head -10 || true)
-          if [ -n "$B64_EXEC_HITS" ]; then
-            CRITICAL=true
-            FINDINGS="${FINDINGS}
-          ### 🚨 CRITICAL: base64 decode + exec/eval combo
-          This is the exact pattern used in the [litellm supply chain attack](https://github.com/BerriAI/litellm/issues/24512) — base64-decoded strings passed to exec/eval to hide credential-stealing payloads.
-
-          **Matches:**
-          \`\`\`
-          ${B64_EXEC_HITS}
-          \`\`\`
-          "
-          fi
-
-          # --- base64 decode/encode (alone — legitimate uses exist) ---
-          B64_HITS=$(echo "$DIFF" | grep -n '^\+' | grep -iE 'base64\.(b64decode|b64encode|decodebytes|encodebytes|urlsafe_b64decode)|atob\(|btoa\(|Buffer\.from\(.*base64' | head -20 || true)
-          if [ -n "$B64_HITS" ]; then
-            FINDINGS="${FINDINGS}
-          ### ⚠️ WARNING: base64 encoding/decoding detected
-          Base64 has legitimate uses (images, JWT, etc.) but is also commonly used to obfuscate malicious payloads. Verify the usage is appropriate.
-
-          **Matches (first 20):**
-          \`\`\`
-          ${B64_HITS}
-          \`\`\`
-          "
-          fi
-
-          # --- exec/eval with string arguments ---
-          EXEC_HITS=$(echo "$DIFF" | grep -n '^\+' | grep -E '(exec|eval)\s*\(' | grep -v '^\+\s*#' | grep -v 'test_\|mock\|assert\|# ' | head -20 || true)
-          if [ -n "$EXEC_HITS" ]; then
-            FINDINGS="${FINDINGS}
-          ### ⚠️ WARNING: exec() or eval() usage
-          Dynamic code execution can hide malicious behavior, especially when combined with base64 or network fetches.
-
-          **Matches (first 20):**
-          \`\`\`
-          ${EXEC_HITS}
-          \`\`\`
-          "
-          fi
-
-          # --- subprocess with encoded/obfuscated commands ---
-          PROC_HITS=$(echo "$DIFF" | grep -n '^\+' | grep -E 'subprocess\.(Popen|call|run)\s*\(' | grep -iE 'base64|decode|encode|\\x|chr\(' | head -10 || true)
-          if [ -n "$PROC_HITS" ]; then
-            CRITICAL=true
-            FINDINGS="${FINDINGS}
-          ### 🚨 CRITICAL: subprocess with encoded/obfuscated command
-          Subprocess calls with encoded arguments are a strong indicator of payload execution.
-
-          **Matches:**
-          \`\`\`
-          ${PROC_HITS}
-          \`\`\`
-          "
-          fi
-
-          # --- Network calls to non-standard domains ---
-          EXFIL_HITS=$(echo "$DIFF" | grep -n '^\+' | grep -iE 'requests\.(post|put)\(|httpx\.(post|put)\(|urllib\.request\.urlopen' | grep -v '^\+\s*#' | grep -v 'test_\|mock\|assert' | head -10 || true)
-          if [ -n "$EXFIL_HITS" ]; then
-            FINDINGS="${FINDINGS}
-          ### ⚠️ WARNING: Outbound network calls (POST/PUT)
-          Outbound POST/PUT requests in new code could be data exfiltration. Verify the destination URLs are legitimate.
-
-          **Matches (first 10):**
-          \`\`\`
-          ${EXFIL_HITS}
-          \`\`\`
-          "
-          fi
-
-          # --- setup.py / setup.cfg install hooks ---
-          SETUP_HITS=$(git diff --name-only "$BASE".."$HEAD" | grep -E '(setup\.py|setup\.cfg|__init__\.pth|sitecustomize\.py|usercustomize\.py)$' || true)
-          if [ -n "$SETUP_HITS" ]; then
-            FINDINGS="${FINDINGS}
-          ### ⚠️ WARNING: Install hook files modified
-          These files can execute code during package installation or interpreter startup.
-
-          **Files:**
-          \`\`\`
-          ${SETUP_HITS}
-          \`\`\`
-          "
-          fi
-
-          # --- Compile/marshal/pickle (code object injection) ---
-          MARSHAL_HITS=$(echo "$DIFF" | grep -n '^\+' | grep -iE 'marshal\.loads|pickle\.loads|compile\(' | grep -v '^\+\s*#' | grep -v 'test_\|re\.compile\|ast\.compile' | head -10 || true)
-          if [ -n "$MARSHAL_HITS" ]; then
-            FINDINGS="${FINDINGS}
-          ### ⚠️ WARNING: marshal/pickle/compile usage
-          These can deserialize or construct executable code objects.
-
-          **Matches:**
-          \`\`\`
-          ${MARSHAL_HITS}
-          \`\`\`
-          "
-          fi
-
-          # --- Output results ---
-          if [ -n "$FINDINGS" ]; then
-            echo "found=true" >> "$GITHUB_OUTPUT"
-            if [ "$CRITICAL" = true ]; then
-              echo "critical=true" >> "$GITHUB_OUTPUT"
-            else
-              echo "critical=false" >> "$GITHUB_OUTPUT"
-            fi
-            # Write findings to a file (multiline env vars are fragile)
-            echo "$FINDINGS" > /tmp/findings.md
-          else
-            echo "found=false" >> "$GITHUB_OUTPUT"
-            echo "critical=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Post warning comment
-        if: steps.scan.outputs.found == 'true'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          SEVERITY="⚠️ Supply Chain Risk Detected"
-          if [ "${{ steps.scan.outputs.critical }}" = "true" ]; then
-            SEVERITY="🚨 CRITICAL Supply Chain Risk Detected"
-          fi
-
-          BODY="## ${SEVERITY}
-
-          This PR contains patterns commonly associated with supply chain attacks. This does **not** mean the PR is malicious — but these patterns require careful human review before merging.
-
-          $(cat /tmp/findings.md)
-
-          ---
-          *Automated scan triggered by [supply-chain-audit](/.github/workflows/supply-chain-audit.yml). If this is a false positive, a maintainer can approve after manual review.*"
-
-          gh pr comment "${{ github.event.pull_request.number }}" --body "$BODY"
-
-      - name: Fail on critical findings
-        if: steps.scan.outputs.critical == 'true'
-        run: |
-          echo "::error::CRITICAL supply chain risk patterns detected in this PR. See the PR comment for details."
-          exit 1

.gitignore

@@ -53,8 +53,3 @@ environments/benchmarks/evals/
 
 # Release script temp files
 .release_notes.md
-mini-swe-agent/
-
-# Nix
-.direnv/
-result

.gitmodules

@@ -1,3 +1,6 @@
+[submodule "mini-swe-agent"]
+	path = mini-swe-agent
+	url = https://github.com/SWE-agent/mini-swe-agent
 [submodule "tinker-atropos"]
 	path = tinker-atropos
 	url = https://github.com/nousresearch/tinker-atropos

AGENTS.md

@@ -5,7 +5,7 @@ Instructions for AI coding assistants and developers working on the hermes-agent
 ## Development Environment
 
 ```bash
-source venv/bin/activate  # ALWAYS activate before running Python
+source .venv/bin/activate  # ALWAYS activate before running Python
 ```
 
 ## Project Structure
@@ -23,7 +23,6 @@ hermes-agent/
 │   ├── prompt_caching.py     # Anthropic prompt caching
 │   ├── auxiliary_client.py   # Auxiliary LLM client (vision, summarization)
 │   ├── model_metadata.py     # Model context lengths, token estimation
-│   ├── models_dev.py         # models.dev registry integration (provider-aware context)
 │   ├── display.py            # KawaiiSpinner, tool preview formatting
 │   ├── skill_commands.py     # Skill slash commands (shared CLI/gateway)
 │   └── trajectory.py         # Trajectory saving helpers
@@ -38,7 +37,6 @@ hermes-agent/
 │   ├── tools_config.py   # `hermes tools` — enable/disable tools per platform
 │   ├── skills_hub.py     # `/skills` slash command (search, browse, install)
 │   ├── models.py         # Model catalog, provider model lists
-│   ├── model_switch.py   # Shared /model switch pipeline (CLI + gateway)
 │   └── auth.py           # Provider credential resolution
 ├── tools/                # Tool implementations (one file per tool)
 │   ├── registry.py       # Central tool registry (schemas, handlers, dispatch)
@@ -368,9 +366,6 @@ Leaks as literal `?[K` text under `prompt_toolkit`'s `patch_stdout`. Use space-p
 ### `_last_resolved_tool_names` is a process-global in `model_tools.py`
 `_run_single_child()` in `delegate_tool.py` saves and restores this global around subagent execution. If you add new code that reads this global, be aware it may be temporarily stale during child agent runs.
 
-### DO NOT hardcode cross-tool references in schema descriptions
-Tool schema descriptions must not mention tools from other toolsets by name (e.g., `browser_navigate` saying "prefer web_search"). Those tools may be unavailable (missing API keys, disabled toolset), causing the model to hallucinate calls to non-existent tools. If a cross-reference is needed, add it dynamically in `get_tool_definitions()` in `model_tools.py` — see the `browser_navigate` / `execute_code` post-processing blocks for the pattern.
-
 ### Tests must not write to `~/.hermes/`
 The `_isolate_hermes_home` autouse fixture in `tests/conftest.py` redirects `HERMES_HOME` to a temp dir. Never hardcode `~/.hermes/` paths in tests.
 
@@ -379,7 +374,7 @@ The `_isolate_hermes_home` autouse fixture in `tests/conftest.py` redirects `HER
 ## Testing
 
 ```bash
-source venv/bin/activate
+source .venv/bin/activate
 python -m pytest tests/ -q          # Full suite (~3000 tests, ~3 min)
 python -m pytest tests/test_model_tools.py -q   # Toolset resolution
 python -m pytest tests/test_cli_init.py -q       # CLI config loading

CONTRIBUTING.md

@@ -72,9 +72,8 @@ export VIRTUAL_ENV="$(pwd)/venv"
 
 # Install with all extras (messaging, cron, CLI menus, dev tools)
 uv pip install -e ".[all,dev]"
-
-# Optional: RL training submodule
-# git submodule update --init tinker-atropos && uv pip install -e "./tinker-atropos"
+uv pip install -e "./mini-swe-agent"
+uv pip install -e "./tinker-atropos"
 
 # Optional: browser tools
 npm install

README.md

@@ -144,14 +144,16 @@ Quick start for contributors:
 ```bash
 git clone https://github.com/NousResearch/hermes-agent.git
 cd hermes-agent
+git submodule update --init mini-swe-agent   # required terminal backend
 curl -LsSf https://astral.sh/uv/install.sh | sh
-uv venv venv --python 3.11
-source venv/bin/activate
+uv venv .venv --python 3.11
+source .venv/bin/activate
 uv pip install -e ".[all,dev]"
+uv pip install -e "./mini-swe-agent"
 python -m pytest tests/ -q
 ```
 
-> **RL Training (optional):** To work on the RL/Tinker-Atropos integration:
+> **RL Training (optional):** To work on the RL/Tinker-Atropos integration, also run:
 > ```bash
 > git submodule update --init tinker-atropos
 > uv pip install -e "./tinker-atropos"

RELEASE_v0.4.0.md

@@ -1,400 +0,0 @@
-# Hermes Agent v0.4.0 (v2026.3.23)
-
-**Release Date:** March 23, 2026
-
-> The platform expansion release — OpenAI-compatible API server, 6 new messaging adapters, 4 new inference providers, MCP server management with OAuth 2.1, @ context references, gateway prompt caching, streaming enabled by default, and a sweeping reliability pass with 200+ bug fixes.
-
----
-
-## ✨ Highlights
-
-- **OpenAI-compatible API server** — Expose Hermes as an `/v1/chat/completions` endpoint with a new `/api/jobs` REST API for cron job management, hardened with input limits, field whitelists, SQLite-backed response persistence, and CORS origin protection ([#1756](https://github.com/NousResearch/hermes-agent/pull/1756), [#2450](https://github.com/NousResearch/hermes-agent/pull/2450), [#2456](https://github.com/NousResearch/hermes-agent/pull/2456), [#2451](https://github.com/NousResearch/hermes-agent/pull/2451), [#2472](https://github.com/NousResearch/hermes-agent/pull/2472))
-
-- **6 new messaging platform adapters** — Signal, DingTalk, SMS (Twilio), Mattermost, Matrix, and Webhook adapters join Telegram, Discord, and WhatsApp. Gateway auto-reconnects failed platforms with exponential backoff ([#2206](https://github.com/NousResearch/hermes-agent/pull/2206), [#1685](https://github.com/NousResearch/hermes-agent/pull/1685), [#1688](https://github.com/NousResearch/hermes-agent/pull/1688), [#1683](https://github.com/NousResearch/hermes-agent/pull/1683), [#2166](https://github.com/NousResearch/hermes-agent/pull/2166), [#2584](https://github.com/NousResearch/hermes-agent/pull/2584))
-
-- **@ context references** — Claude Code-style `@file` and `@url` context injection with tab completions in the CLI ([#2343](https://github.com/NousResearch/hermes-agent/pull/2343), [#2482](https://github.com/NousResearch/hermes-agent/pull/2482))
-
-- **4 new inference providers** — GitHub Copilot (OAuth + token validation), Alibaba Cloud / DashScope, Kilo Code, and OpenCode Zen/Go ([#1924](https://github.com/NousResearch/hermes-agent/pull/1924), [#1879](https://github.com/NousResearch/hermes-agent/pull/1879) by @mchzimm, [#1673](https://github.com/NousResearch/hermes-agent/pull/1673), [#1666](https://github.com/NousResearch/hermes-agent/pull/1666), [#1650](https://github.com/NousResearch/hermes-agent/pull/1650))
-
-- **MCP server management CLI** — `hermes mcp` commands for installing, configuring, and authenticating MCP servers with full OAuth 2.1 PKCE flow ([#2465](https://github.com/NousResearch/hermes-agent/pull/2465))
-
-- **Gateway prompt caching** — Cache AIAgent instances per session, preserving Anthropic prompt cache across turns for dramatic cost reduction on long conversations ([#2282](https://github.com/NousResearch/hermes-agent/pull/2282), [#2284](https://github.com/NousResearch/hermes-agent/pull/2284), [#2361](https://github.com/NousResearch/hermes-agent/pull/2361))
-
-- **Context compression overhaul** — Structured summaries with iterative updates, token-budget tail protection, configurable summary endpoint, and fallback model support ([#2323](https://github.com/NousResearch/hermes-agent/pull/2323), [#1727](https://github.com/NousResearch/hermes-agent/pull/1727), [#2224](https://github.com/NousResearch/hermes-agent/pull/2224))
-
-- **Streaming enabled by default** — CLI streaming on by default with proper spinner/tool progress display during streaming mode, plus extensive linebreak and concatenation fixes ([#2340](https://github.com/NousResearch/hermes-agent/pull/2340), [#2161](https://github.com/NousResearch/hermes-agent/pull/2161), [#2258](https://github.com/NousResearch/hermes-agent/pull/2258))
-
----
-
-## 🖥️ CLI & User Experience
-
-### New Commands & Interactions
-- **@ context completions** — Tab-completable `@file`/`@url` references that inject file content or web pages into the conversation ([#2482](https://github.com/NousResearch/hermes-agent/pull/2482), [#2343](https://github.com/NousResearch/hermes-agent/pull/2343))
-- **`/statusbar`** — Toggle a persistent config bar showing model + provider info in the prompt ([#2240](https://github.com/NousResearch/hermes-agent/pull/2240), [#1917](https://github.com/NousResearch/hermes-agent/pull/1917))
-- **`/queue`** — Queue prompts for the agent without interrupting the current run ([#2191](https://github.com/NousResearch/hermes-agent/pull/2191), [#2469](https://github.com/NousResearch/hermes-agent/pull/2469))
-- **`/permission`** — Switch approval mode dynamically during a session ([#2207](https://github.com/NousResearch/hermes-agent/pull/2207))
-- **`/browser`** — Interactive browser sessions from the CLI ([#2273](https://github.com/NousResearch/hermes-agent/pull/2273), [#1814](https://github.com/NousResearch/hermes-agent/pull/1814))
-- **`/cost`** — Live pricing and usage tracking in gateway mode ([#2180](https://github.com/NousResearch/hermes-agent/pull/2180))
-- **`/approve` and `/deny`** — Replaced bare text approval in gateway with explicit commands ([#2002](https://github.com/NousResearch/hermes-agent/pull/2002))
-
-### Streaming & Display
-- Streaming enabled by default in CLI ([#2340](https://github.com/NousResearch/hermes-agent/pull/2340))
-- Show spinners and tool progress during streaming mode ([#2161](https://github.com/NousResearch/hermes-agent/pull/2161))
-- Show reasoning/thinking blocks when `show_reasoning` enabled ([#2118](https://github.com/NousResearch/hermes-agent/pull/2118))
-- Context pressure warnings for CLI and gateway ([#2159](https://github.com/NousResearch/hermes-agent/pull/2159))
-- Fix: streaming chunks concatenated without whitespace ([#2258](https://github.com/NousResearch/hermes-agent/pull/2258))
-- Fix: iteration boundary linebreak prevents stream concatenation ([#2413](https://github.com/NousResearch/hermes-agent/pull/2413))
-- Fix: defer streaming linebreak to prevent blank line stacking ([#2473](https://github.com/NousResearch/hermes-agent/pull/2473))
-- Fix: suppress spinner animation in non-TTY environments ([#2216](https://github.com/NousResearch/hermes-agent/pull/2216))
-- Fix: display provider and endpoint in API error messages ([#2266](https://github.com/NousResearch/hermes-agent/pull/2266))
-- Fix: resolve garbled ANSI escape codes in status printouts ([#2448](https://github.com/NousResearch/hermes-agent/pull/2448))
-- Fix: update gold ANSI color to true-color format ([#2246](https://github.com/NousResearch/hermes-agent/pull/2246))
-- Fix: normalize toolset labels and use skin colors in banner ([#1912](https://github.com/NousResearch/hermes-agent/pull/1912))
-
-### CLI Polish
-- Fix: prevent 'Press ENTER to continue...' on exit ([#2555](https://github.com/NousResearch/hermes-agent/pull/2555))
-- Fix: flush stdout during agent loop to prevent macOS display freeze ([#1654](https://github.com/NousResearch/hermes-agent/pull/1654))
-- Fix: show human-readable error when `hermes setup` hits permissions error ([#2196](https://github.com/NousResearch/hermes-agent/pull/2196))
-- Fix: `/stop` command crash + UnboundLocalError in streaming media delivery ([#2463](https://github.com/NousResearch/hermes-agent/pull/2463))
-- Fix: allow custom/local endpoints without API key ([#2556](https://github.com/NousResearch/hermes-agent/pull/2556))
-- Fix: Kitty keyboard protocol Shift+Enter for Ghostty/WezTerm (attempted + reverted due to prompt_toolkit crash) ([#2345](https://github.com/NousResearch/hermes-agent/pull/2345), [#2349](https://github.com/NousResearch/hermes-agent/pull/2349))
-
-### Configuration
-- **`${ENV_VAR}` substitution** in config.yaml ([#2684](https://github.com/NousResearch/hermes-agent/pull/2684))
-- **Real-time config reload** — config.yaml changes apply without restart ([#2210](https://github.com/NousResearch/hermes-agent/pull/2210))
-- **`custom_models.yaml`** for user-managed model additions ([#2214](https://github.com/NousResearch/hermes-agent/pull/2214))
-- **Priority-based context file selection** + CLAUDE.md support ([#2301](https://github.com/NousResearch/hermes-agent/pull/2301))
-- **Merge nested YAML sections** instead of replacing on config update ([#2213](https://github.com/NousResearch/hermes-agent/pull/2213))
-- Fix: config.yaml provider key overrides env var silently ([#2272](https://github.com/NousResearch/hermes-agent/pull/2272))
-- Fix: log warning instead of silently swallowing config.yaml errors ([#2683](https://github.com/NousResearch/hermes-agent/pull/2683))
-- Fix: disabled toolsets re-enable themselves after `hermes tools` ([#2268](https://github.com/NousResearch/hermes-agent/pull/2268))
-- Fix: platform default toolsets silently override tool deselection ([#2624](https://github.com/NousResearch/hermes-agent/pull/2624))
-- Fix: honor bare YAML `approvals.mode: off` ([#2620](https://github.com/NousResearch/hermes-agent/pull/2620))
-- Fix: `hermes update` use `.[all]` extras with fallback ([#1728](https://github.com/NousResearch/hermes-agent/pull/1728))
-- Fix: `hermes update` prompt before resetting working tree on stash conflicts ([#2390](https://github.com/NousResearch/hermes-agent/pull/2390))
-- Fix: use git pull --rebase in update/install to avoid divergent branch error ([#2274](https://github.com/NousResearch/hermes-agent/pull/2274))
-- Fix: add zprofile fallback and create zshrc on fresh macOS installs ([#2320](https://github.com/NousResearch/hermes-agent/pull/2320))
-- Fix: remove `ANTHROPIC_BASE_URL` env var to avoid collisions ([#1675](https://github.com/NousResearch/hermes-agent/pull/1675))
-- Fix: don't ask IMAP password if already in keyring or env ([#2212](https://github.com/NousResearch/hermes-agent/pull/2212))
-- Fix: OpenCode Zen/Go show OpenRouter models instead of their own ([#2277](https://github.com/NousResearch/hermes-agent/pull/2277))
-
----
-
-## 🏗️ Core Agent & Architecture
-
-### New Providers
-- **GitHub Copilot** — Full OAuth auth, API routing, token validation, and 400k context. ([#1924](https://github.com/NousResearch/hermes-agent/pull/1924), [#1896](https://github.com/NousResearch/hermes-agent/pull/1896), [#1879](https://github.com/NousResearch/hermes-agent/pull/1879) by @mchzimm, [#2507](https://github.com/NousResearch/hermes-agent/pull/2507))
-- **Alibaba Cloud / DashScope** — Full integration with DashScope v1 runtime, model dot preservation, and 401 auth fixes ([#1673](https://github.com/NousResearch/hermes-agent/pull/1673), [#2332](https://github.com/NousResearch/hermes-agent/pull/2332), [#2459](https://github.com/NousResearch/hermes-agent/pull/2459))
-- **Kilo Code** — First-class inference provider ([#1666](https://github.com/NousResearch/hermes-agent/pull/1666))
-- **OpenCode Zen and OpenCode Go** — New provider backends ([#1650](https://github.com/NousResearch/hermes-agent/pull/1650), [#2393](https://github.com/NousResearch/hermes-agent/pull/2393) by @0xbyt4)
-- **NeuTTS** — Local TTS provider backend with built-in setup flow, replacing the old optional skill ([#1657](https://github.com/NousResearch/hermes-agent/pull/1657), [#1664](https://github.com/NousResearch/hermes-agent/pull/1664))
-
-### Provider Improvements
-- **Eager fallback** to backup model on rate-limit errors ([#1730](https://github.com/NousResearch/hermes-agent/pull/1730))
-- **Endpoint metadata** for custom model context and pricing; query local servers for actual context window size ([#1906](https://github.com/NousResearch/hermes-agent/pull/1906), [#2091](https://github.com/NousResearch/hermes-agent/pull/2091) by @dusterbloom)
-- **Context length detection overhaul** — models.dev integration, provider-aware resolution, fuzzy matching for custom endpoints, `/v1/props` for llama.cpp ([#2158](https://github.com/NousResearch/hermes-agent/pull/2158), [#2051](https://github.com/NousResearch/hermes-agent/pull/2051), [#2403](https://github.com/NousResearch/hermes-agent/pull/2403))
-- **Model catalog updates** — gpt-5.4-mini, gpt-5.4-nano, healer-alpha, haiku-4.5, minimax-m2.7, claude 4.6 at 1M context ([#1913](https://github.com/NousResearch/hermes-agent/pull/1913), [#1915](https://github.com/NousResearch/hermes-agent/pull/1915), [#1900](https://github.com/NousResearch/hermes-agent/pull/1900), [#2155](https://github.com/NousResearch/hermes-agent/pull/2155), [#2474](https://github.com/NousResearch/hermes-agent/pull/2474))
-- **Custom endpoint improvements** — `model.base_url` in config.yaml, `api_mode` override for responses API, allow endpoints without API key, fail fast on missing keys ([#2330](https://github.com/NousResearch/hermes-agent/pull/2330), [#1651](https://github.com/NousResearch/hermes-agent/pull/1651), [#2556](https://github.com/NousResearch/hermes-agent/pull/2556), [#2445](https://github.com/NousResearch/hermes-agent/pull/2445), [#1994](https://github.com/NousResearch/hermes-agent/pull/1994), [#1998](https://github.com/NousResearch/hermes-agent/pull/1998))
-- Inject model and provider into system prompt ([#1929](https://github.com/NousResearch/hermes-agent/pull/1929))
-- Tie `api_mode` to provider config instead of env var ([#1656](https://github.com/NousResearch/hermes-agent/pull/1656))
-- Fix: prevent Anthropic token leaking to third-party `anthropic_messages` providers ([#2389](https://github.com/NousResearch/hermes-agent/pull/2389))
-- Fix: prevent Anthropic fallback from inheriting non-Anthropic `base_url` ([#2388](https://github.com/NousResearch/hermes-agent/pull/2388))
-- Fix: `auxiliary_is_nous` flag never resets — leaked Nous tags to other providers ([#1713](https://github.com/NousResearch/hermes-agent/pull/1713))
-- Fix: Anthropic `tool_choice 'none'` still allowed tool calls ([#1714](https://github.com/NousResearch/hermes-agent/pull/1714))
-- Fix: Mistral parser nested JSON fallback extraction ([#2335](https://github.com/NousResearch/hermes-agent/pull/2335))
-- Fix: MiniMax 401 auth resolved by defaulting to `anthropic_messages` ([#2103](https://github.com/NousResearch/hermes-agent/pull/2103))
-- Fix: case-insensitive model family matching ([#2350](https://github.com/NousResearch/hermes-agent/pull/2350))
-- Fix: ignore placeholder provider keys in activation checks ([#2358](https://github.com/NousResearch/hermes-agent/pull/2358))
-- Fix: Preserve Ollama model:tag colons in context length detection ([#2149](https://github.com/NousResearch/hermes-agent/pull/2149))
-- Fix: recognize Claude Code OAuth credentials in startup gate ([#1663](https://github.com/NousResearch/hermes-agent/pull/1663))
-- Fix: detect Claude Code version dynamically for OAuth user-agent ([#1670](https://github.com/NousResearch/hermes-agent/pull/1670))
-- Fix: OAuth flag stale after refresh/fallback ([#1890](https://github.com/NousResearch/hermes-agent/pull/1890))
-- Fix: auxiliary client skips expired Codex JWT ([#2397](https://github.com/NousResearch/hermes-agent/pull/2397))
-
-### Agent Loop
-- **Gateway prompt caching** — Cache AIAgent per session, keep assistant turns, fix session restore ([#2282](https://github.com/NousResearch/hermes-agent/pull/2282), [#2284](https://github.com/NousResearch/hermes-agent/pull/2284), [#2361](https://github.com/NousResearch/hermes-agent/pull/2361))
-- **Context compression overhaul** — Structured summaries, iterative updates, token-budget tail protection, configurable `summary_base_url` ([#2323](https://github.com/NousResearch/hermes-agent/pull/2323), [#1727](https://github.com/NousResearch/hermes-agent/pull/1727), [#2224](https://github.com/NousResearch/hermes-agent/pull/2224))
-- **Pre-call sanitization and post-call tool guardrails** ([#1732](https://github.com/NousResearch/hermes-agent/pull/1732))
-- **Auto-recover** from provider-rejected `tool_choice` by retrying without ([#2174](https://github.com/NousResearch/hermes-agent/pull/2174))
-- **Background memory/skill review** replaces inline nudges ([#2235](https://github.com/NousResearch/hermes-agent/pull/2235))
-- **SOUL.md as primary agent identity** instead of hardcoded default ([#1922](https://github.com/NousResearch/hermes-agent/pull/1922))
-- Fix: prevent silent tool result loss during context compression ([#1993](https://github.com/NousResearch/hermes-agent/pull/1993))
-- Fix: handle empty/null function arguments in tool call recovery ([#2163](https://github.com/NousResearch/hermes-agent/pull/2163))
-- Fix: handle API refusal responses gracefully instead of crashing ([#2156](https://github.com/NousResearch/hermes-agent/pull/2156))
-- Fix: prevent stuck agent loop on malformed tool calls ([#2114](https://github.com/NousResearch/hermes-agent/pull/2114))
-- Fix: return JSON parse error to model instead of dispatching with empty args ([#2342](https://github.com/NousResearch/hermes-agent/pull/2342))
-- Fix: consecutive assistant message merge drops content on mixed types ([#1703](https://github.com/NousResearch/hermes-agent/pull/1703))
-- Fix: message role alternation violations in JSON recovery and error handler ([#1722](https://github.com/NousResearch/hermes-agent/pull/1722))
-- Fix: `compression_attempts` resets each iteration — allowed unlimited compressions ([#1723](https://github.com/NousResearch/hermes-agent/pull/1723))
-- Fix: `length_continue_retries` never resets — later truncations got fewer retries ([#1717](https://github.com/NousResearch/hermes-agent/pull/1717))
-- Fix: compressor summary role violated consecutive-role constraint ([#1720](https://github.com/NousResearch/hermes-agent/pull/1720), [#1743](https://github.com/NousResearch/hermes-agent/pull/1743))
-- Fix: remove hardcoded `gemini-3-flash-preview` as default summary model ([#2464](https://github.com/NousResearch/hermes-agent/pull/2464))
-- Fix: correctly handle empty tool results ([#2201](https://github.com/NousResearch/hermes-agent/pull/2201))
-- Fix: crash on None entry in `tool_calls` list ([#2209](https://github.com/NousResearch/hermes-agent/pull/2209) by @0xbyt4, [#2316](https://github.com/NousResearch/hermes-agent/pull/2316))
-- Fix: per-thread persistent event loops in worker threads ([#2214](https://github.com/NousResearch/hermes-agent/pull/2214) by @jquesnelle)
-- Fix: prevent 'event loop already running' when async tools run in parallel ([#2207](https://github.com/NousResearch/hermes-agent/pull/2207))
-- Fix: strip ANSI at the source — clean terminal output before it reaches the model ([#2115](https://github.com/NousResearch/hermes-agent/pull/2115))
-- Fix: skip top-level `cache_control` on role:tool for OpenRouter ([#2391](https://github.com/NousResearch/hermes-agent/pull/2391))
-- Fix: delegate tool — save parent tool names before child construction mutates global ([#2083](https://github.com/NousResearch/hermes-agent/pull/2083) by @ygd58, [#1894](https://github.com/NousResearch/hermes-agent/pull/1894))
-- Fix: only strip last assistant message if empty string ([#2326](https://github.com/NousResearch/hermes-agent/pull/2326))
-
-### Session & Memory
-- **Session search** and management slash commands ([#2198](https://github.com/NousResearch/hermes-agent/pull/2198))
-- **Auto session titles** and `.hermes.md` project config ([#1712](https://github.com/NousResearch/hermes-agent/pull/1712))
-- Fix: concurrent memory writes silently drop entries — added file locking ([#1726](https://github.com/NousResearch/hermes-agent/pull/1726))
-- Fix: search all sources by default in `session_search` ([#1892](https://github.com/NousResearch/hermes-agent/pull/1892))
-- Fix: handle hyphenated FTS5 queries and preserve quoted literals ([#1776](https://github.com/NousResearch/hermes-agent/pull/1776))
-- Fix: skip corrupt lines in `load_transcript` instead of crashing ([#1744](https://github.com/NousResearch/hermes-agent/pull/1744))
-- Fix: normalize session keys to prevent case-sensitive duplicates ([#2157](https://github.com/NousResearch/hermes-agent/pull/2157))
-- Fix: prevent `session_search` crash when no sessions exist ([#2194](https://github.com/NousResearch/hermes-agent/pull/2194))
-- Fix: reset token counters on new session for accurate usage display ([#2101](https://github.com/NousResearch/hermes-agent/pull/2101) by @InB4DevOps)
-- Fix: prevent stale memory overwrites by flush agent ([#2687](https://github.com/NousResearch/hermes-agent/pull/2687))
-- Fix: remove synthetic error message injection, fix session resume after repeated failures ([#2303](https://github.com/NousResearch/hermes-agent/pull/2303))
-- Fix: quiet mode with `--resume` now passes conversation_history ([#2357](https://github.com/NousResearch/hermes-agent/pull/2357))
-- Fix: unify resume logic in batch mode ([#2331](https://github.com/NousResearch/hermes-agent/pull/2331))
-
-### Honcho Memory
-- Honcho config fixes and @ context reference integration ([#2343](https://github.com/NousResearch/hermes-agent/pull/2343))
-- Self-hosted / Docker configuration documentation ([#2475](https://github.com/NousResearch/hermes-agent/pull/2475))
-
----
-
-## 📱 Messaging Platforms (Gateway)
-
-### New Platform Adapters
-- **Signal Messenger** — Full adapter with attachment handling, group message filtering, and Note to Self echo-back protection ([#2206](https://github.com/NousResearch/hermes-agent/pull/2206), [#2400](https://github.com/NousResearch/hermes-agent/pull/2400), [#2297](https://github.com/NousResearch/hermes-agent/pull/2297), [#2156](https://github.com/NousResearch/hermes-agent/pull/2156))
-- **DingTalk** — Adapter with gateway wiring and setup docs ([#1685](https://github.com/NousResearch/hermes-agent/pull/1685), [#1690](https://github.com/NousResearch/hermes-agent/pull/1690), [#1692](https://github.com/NousResearch/hermes-agent/pull/1692))
-- **SMS (Twilio)** ([#1688](https://github.com/NousResearch/hermes-agent/pull/1688))
-- **Mattermost** — With @-mention-only channel filter ([#1683](https://github.com/NousResearch/hermes-agent/pull/1683), [#2443](https://github.com/NousResearch/hermes-agent/pull/2443))
-- **Matrix** — With vision support and image caching ([#1683](https://github.com/NousResearch/hermes-agent/pull/1683), [#2520](https://github.com/NousResearch/hermes-agent/pull/2520))
-- **Webhook** — Platform adapter for external event triggers ([#2166](https://github.com/NousResearch/hermes-agent/pull/2166))
-- **OpenAI-compatible API server** — `/v1/chat/completions` endpoint with `/api/jobs` cron management ([#1756](https://github.com/NousResearch/hermes-agent/pull/1756), [#2450](https://github.com/NousResearch/hermes-agent/pull/2450), [#2456](https://github.com/NousResearch/hermes-agent/pull/2456))
-
-### Telegram Improvements
-- MarkdownV2 support — strikethrough, spoiler, blockquotes, escape parentheses/braces/backslashes/backticks ([#2199](https://github.com/NousResearch/hermes-agent/pull/2199), [#2200](https://github.com/NousResearch/hermes-agent/pull/2200) by @llbn, [#2386](https://github.com/NousResearch/hermes-agent/pull/2386))
-- Auto-detect HTML tags and use `parse_mode=HTML` ([#1709](https://github.com/NousResearch/hermes-agent/pull/1709))
-- Telegram group vision support + thread-based sessions ([#2153](https://github.com/NousResearch/hermes-agent/pull/2153))
-- Auto-reconnect polling after network interruption ([#2517](https://github.com/NousResearch/hermes-agent/pull/2517))
-- Aggregate split text messages before dispatching ([#1674](https://github.com/NousResearch/hermes-agent/pull/1674))
-- Fix: streaming config bridge, not-modified, flood control ([#1782](https://github.com/NousResearch/hermes-agent/pull/1782), [#1783](https://github.com/NousResearch/hermes-agent/pull/1783))
-- Fix: edited_message event crashes ([#2074](https://github.com/NousResearch/hermes-agent/pull/2074))
-- Fix: retry 409 polling conflicts before giving up ([#2312](https://github.com/NousResearch/hermes-agent/pull/2312))
-- Fix: topic delivery via `platform:chat_id:thread_id` format ([#2455](https://github.com/NousResearch/hermes-agent/pull/2455))
-
-### Discord Improvements
-- Document caching and text-file injection ([#2503](https://github.com/NousResearch/hermes-agent/pull/2503))
-- Persistent typing indicator for DMs ([#2468](https://github.com/NousResearch/hermes-agent/pull/2468))
-- Discord DM vision — inline images + attachment analysis ([#2186](https://github.com/NousResearch/hermes-agent/pull/2186))
-- Persist thread participation across gateway restarts ([#1661](https://github.com/NousResearch/hermes-agent/pull/1661))
-- Fix: gateway crash on non-ASCII guild names ([#2302](https://github.com/NousResearch/hermes-agent/pull/2302))
-- Fix: thread permission errors ([#2073](https://github.com/NousResearch/hermes-agent/pull/2073))
-- Fix: slash event routing in threads ([#2460](https://github.com/NousResearch/hermes-agent/pull/2460))
-- Fix: remove bugged followup messages + `/ask` command ([#1836](https://github.com/NousResearch/hermes-agent/pull/1836))
-- Fix: graceful WebSocket reconnection ([#2127](https://github.com/NousResearch/hermes-agent/pull/2127))
-- Fix: voice channel TTS when streaming enabled ([#2322](https://github.com/NousResearch/hermes-agent/pull/2322))
-
-### WhatsApp & Other Adapters
-- WhatsApp: outbound `send_message` routing ([#1769](https://github.com/NousResearch/hermes-agent/pull/1769) by @sai-samarth), LID format self-chat ([#1667](https://github.com/NousResearch/hermes-agent/pull/1667)), `reply_prefix` config fix ([#1923](https://github.com/NousResearch/hermes-agent/pull/1923)), restart on bridge child exit ([#2334](https://github.com/NousResearch/hermes-agent/pull/2334)), image/bridge improvements ([#2181](https://github.com/NousResearch/hermes-agent/pull/2181))
-- Matrix: correct `reply_to_message_id` parameter ([#1895](https://github.com/NousResearch/hermes-agent/pull/1895)), bare media types fix ([#1736](https://github.com/NousResearch/hermes-agent/pull/1736))
-- Mattermost: MIME types for media attachments ([#2329](https://github.com/NousResearch/hermes-agent/pull/2329))
-
-### Gateway Core
-- **Auto-reconnect** failed platforms with exponential backoff ([#2584](https://github.com/NousResearch/hermes-agent/pull/2584))
-- **Notify users when session auto-resets** ([#2519](https://github.com/NousResearch/hermes-agent/pull/2519))
-- **Reply-to message context** for out-of-session replies ([#1662](https://github.com/NousResearch/hermes-agent/pull/1662))
-- **Ignore unauthorized DMs** config option ([#1919](https://github.com/NousResearch/hermes-agent/pull/1919))
-- Fix: `/reset` in thread-mode resets global session instead of thread ([#2254](https://github.com/NousResearch/hermes-agent/pull/2254))
-- Fix: deliver MEDIA: files after streaming responses ([#2382](https://github.com/NousResearch/hermes-agent/pull/2382))
-- Fix: cap interrupt recursion depth to prevent resource exhaustion ([#1659](https://github.com/NousResearch/hermes-agent/pull/1659))
-- Fix: detect stopped processes and release stale locks on `--replace` ([#2406](https://github.com/NousResearch/hermes-agent/pull/2406), [#1908](https://github.com/NousResearch/hermes-agent/pull/1908))
-- Fix: PID-based wait with force-kill for gateway restart ([#1902](https://github.com/NousResearch/hermes-agent/pull/1902))
-- Fix: prevent `--replace` mode from killing the caller process ([#2185](https://github.com/NousResearch/hermes-agent/pull/2185))
-- Fix: `/model` shows active fallback model instead of config default ([#1660](https://github.com/NousResearch/hermes-agent/pull/1660))
-- Fix: `/title` command fails when session doesn't exist in SQLite yet ([#2379](https://github.com/NousResearch/hermes-agent/pull/2379) by @ten-jampa)
-- Fix: process `/queue`'d messages after agent completion ([#2469](https://github.com/NousResearch/hermes-agent/pull/2469))
-- Fix: strip orphaned `tool_results` + let `/reset` bypass running agent ([#2180](https://github.com/NousResearch/hermes-agent/pull/2180))
-- Fix: prevent agents from starting gateway outside systemd management ([#2617](https://github.com/NousResearch/hermes-agent/pull/2617))
-- Fix: prevent systemd restart storm on gateway connection failure ([#2327](https://github.com/NousResearch/hermes-agent/pull/2327))
-- Fix: include resolved node path in systemd unit ([#1767](https://github.com/NousResearch/hermes-agent/pull/1767) by @sai-samarth)
-- Fix: send error details to user in gateway outer exception handler ([#1966](https://github.com/NousResearch/hermes-agent/pull/1966))
-- Fix: improve error handling for 429 usage limits and 500 context overflow ([#1839](https://github.com/NousResearch/hermes-agent/pull/1839))
-- Fix: add all missing platform allowlist env vars to startup warning check ([#2628](https://github.com/NousResearch/hermes-agent/pull/2628))
-- Fix: media delivery fails for file paths containing spaces ([#2621](https://github.com/NousResearch/hermes-agent/pull/2621))
-- Fix: duplicate session-key collision in multi-platform gateway ([#2171](https://github.com/NousResearch/hermes-agent/pull/2171))
-- Fix: Matrix and Mattermost never report as connected ([#1711](https://github.com/NousResearch/hermes-agent/pull/1711))
-- Fix: PII redaction config never read — missing yaml import ([#1701](https://github.com/NousResearch/hermes-agent/pull/1701))
-- Fix: NameError on skill slash commands ([#1697](https://github.com/NousResearch/hermes-agent/pull/1697))
-- Fix: persist watcher metadata in checkpoint for crash recovery ([#1706](https://github.com/NousResearch/hermes-agent/pull/1706))
-- Fix: pass `message_thread_id` in send_image_file, send_document, send_video ([#2339](https://github.com/NousResearch/hermes-agent/pull/2339))
-- Fix: media-group aggregation on rapid successive photo messages ([#2160](https://github.com/NousResearch/hermes-agent/pull/2160))
-
----
-
-## 🔧 Tool System
-
-### MCP Enhancements
-- **MCP server management CLI** + OAuth 2.1 PKCE auth ([#2465](https://github.com/NousResearch/hermes-agent/pull/2465))
-- **Expose MCP servers as standalone toolsets** ([#1907](https://github.com/NousResearch/hermes-agent/pull/1907))
-- **Interactive MCP tool configuration** in `hermes tools` ([#1694](https://github.com/NousResearch/hermes-agent/pull/1694))
-- Fix: MCP-OAuth port mismatch, path traversal, and shared handler state ([#2552](https://github.com/NousResearch/hermes-agent/pull/2552))
-- Fix: preserve MCP tool registrations across session resets ([#2124](https://github.com/NousResearch/hermes-agent/pull/2124))
-- Fix: concurrent file access crash + duplicate MCP registration ([#2154](https://github.com/NousResearch/hermes-agent/pull/2154))
-- Fix: normalise MCP schemas + expand session list columns ([#2102](https://github.com/NousResearch/hermes-agent/pull/2102))
-- Fix: `tool_choice` `mcp_` prefix handling ([#1775](https://github.com/NousResearch/hermes-agent/pull/1775))
-
-### Web Tool Backends
-- **Tavily** as web search/extract/crawl backend ([#1731](https://github.com/NousResearch/hermes-agent/pull/1731))
-- **Parallel** as alternative web search/extract backend ([#1696](https://github.com/NousResearch/hermes-agent/pull/1696))
-- **Configurable web backend** — Firecrawl/BeautifulSoup/Playwright selection ([#2256](https://github.com/NousResearch/hermes-agent/pull/2256))
-- Fix: whitespace-only env vars bypass web backend detection ([#2341](https://github.com/NousResearch/hermes-agent/pull/2341))
-
-### New Tools
-- **IMAP email** reading and sending ([#2173](https://github.com/NousResearch/hermes-agent/pull/2173))
-- **STT (speech-to-text)** tool using Whisper API ([#2072](https://github.com/NousResearch/hermes-agent/pull/2072))
-- **Route-aware pricing estimates** ([#1695](https://github.com/NousResearch/hermes-agent/pull/1695))
-
-### Tool Improvements
-- TTS: `base_url` support for OpenAI TTS provider ([#2064](https://github.com/NousResearch/hermes-agent/pull/2064) by @hanai)
-- Vision: configurable timeout, tilde expansion in file paths, DM vision with multi-image and base64 fallback ([#2480](https://github.com/NousResearch/hermes-agent/pull/2480), [#2585](https://github.com/NousResearch/hermes-agent/pull/2585), [#2211](https://github.com/NousResearch/hermes-agent/pull/2211))
-- Browser: race condition fix in session creation ([#1721](https://github.com/NousResearch/hermes-agent/pull/1721)), TypeError on unexpected LLM params ([#1735](https://github.com/NousResearch/hermes-agent/pull/1735))
-- File tools: strip ANSI escape codes from write_file and patch content ([#2532](https://github.com/NousResearch/hermes-agent/pull/2532)), include pagination args in repeated search key ([#1824](https://github.com/NousResearch/hermes-agent/pull/1824) by @cutepawss), improve fuzzy matching accuracy + position calculation refactor ([#2096](https://github.com/NousResearch/hermes-agent/pull/2096), [#1681](https://github.com/NousResearch/hermes-agent/pull/1681))
-- Code execution: resource leak and double socket close fix ([#2381](https://github.com/NousResearch/hermes-agent/pull/2381))
-- Delegate: thread safety for concurrent subagent delegation ([#1672](https://github.com/NousResearch/hermes-agent/pull/1672)), preserve parent agent's tool list after delegation ([#1778](https://github.com/NousResearch/hermes-agent/pull/1778))
-- Fix: make concurrent tool batching path-aware for file mutations ([#1914](https://github.com/NousResearch/hermes-agent/pull/1914))
-- Fix: chunk long messages in `send_message_tool` before platform dispatch ([#1646](https://github.com/NousResearch/hermes-agent/pull/1646))
-- Fix: add missing 'messaging' toolset ([#1718](https://github.com/NousResearch/hermes-agent/pull/1718))
-- Fix: prevent unavailable tool names from leaking into model schemas ([#2072](https://github.com/NousResearch/hermes-agent/pull/2072))
-- Fix: pass visited set by reference to prevent diamond dependency duplication ([#2311](https://github.com/NousResearch/hermes-agent/pull/2311))
-- Fix: Daytona sandbox lookup migrated from `find_one` to `get/list` ([#2063](https://github.com/NousResearch/hermes-agent/pull/2063) by @rovle)
-
----
-
-## 🧩 Skills Ecosystem
-
-### Skills System Improvements
-- **Agent-created skills** — Caution-level findings allowed, dangerous skills ask instead of block ([#1840](https://github.com/NousResearch/hermes-agent/pull/1840), [#2446](https://github.com/NousResearch/hermes-agent/pull/2446))
-- **`--yes` flag** to bypass confirmation in `/skills install` and uninstall ([#1647](https://github.com/NousResearch/hermes-agent/pull/1647))
-- **Disabled skills respected** across banner, system prompt, and slash commands ([#1897](https://github.com/NousResearch/hermes-agent/pull/1897))
-- Fix: skills custom_tools import crash + sandbox file_tools integration ([#2239](https://github.com/NousResearch/hermes-agent/pull/2239))
-- Fix: agent-created skills with pip requirements crash on install ([#2145](https://github.com/NousResearch/hermes-agent/pull/2145))
-- Fix: race condition in `Skills.__init__` when `hub.yaml` missing ([#2242](https://github.com/NousResearch/hermes-agent/pull/2242))
-- Fix: validate skill metadata before install and block duplicates ([#2241](https://github.com/NousResearch/hermes-agent/pull/2241))
-- Fix: skills hub inspect/resolve — 4 bugs in inspect, redirects, discovery, tap list ([#2447](https://github.com/NousResearch/hermes-agent/pull/2447))
-- Fix: agent-created skills keep working after session reset ([#2121](https://github.com/NousResearch/hermes-agent/pull/2121))
-
-### New Skills
-- **OCR-and-documents** — PDF/DOCX/XLS/PPTX/image OCR with optional GPU ([#2236](https://github.com/NousResearch/hermes-agent/pull/2236), [#2461](https://github.com/NousResearch/hermes-agent/pull/2461))
-- **Huggingface-hub** bundled skill ([#1921](https://github.com/NousResearch/hermes-agent/pull/1921))
-- **Sherlock OSINT** username search ([#1671](https://github.com/NousResearch/hermes-agent/pull/1671))
-- **Meme-generation** — Image generator with Pillow ([#2344](https://github.com/NousResearch/hermes-agent/pull/2344))
-- **Bioinformatics** gateway skill — index to 400+ bio skills ([#2387](https://github.com/NousResearch/hermes-agent/pull/2387))
-- **Inference.sh** skill (terminal-based) ([#1686](https://github.com/NousResearch/hermes-agent/pull/1686))
-- **Base blockchain** optional skill ([#1643](https://github.com/NousResearch/hermes-agent/pull/1643))
-- **3D-model-viewer** optional skill ([#2226](https://github.com/NousResearch/hermes-agent/pull/2226))
-- **FastMCP** optional skill ([#2113](https://github.com/NousResearch/hermes-agent/pull/2113))
-- **Hermes-agent-setup** skill ([#1905](https://github.com/NousResearch/hermes-agent/pull/1905))
-
----
-
-## 🔌 Plugin System Enhancements
-
-- **TUI extension hooks** — Build custom CLIs on top of Hermes ([#2333](https://github.com/NousResearch/hermes-agent/pull/2333))
-- **`hermes plugins install/remove/list`** commands ([#2337](https://github.com/NousResearch/hermes-agent/pull/2337))
-- **Slash command registration** for plugins ([#2359](https://github.com/NousResearch/hermes-agent/pull/2359))
-- **`session:end` lifecycle event** hook ([#1725](https://github.com/NousResearch/hermes-agent/pull/1725))
-- Fix: require opt-in for project plugin discovery ([#2215](https://github.com/NousResearch/hermes-agent/pull/2215))
-
----
-
-## 🔒 Security & Reliability
-
-### Security
-- **SSRF protection** for vision_tools and web_tools ([#2679](https://github.com/NousResearch/hermes-agent/pull/2679))
-- **Shell injection prevention** in `_expand_path` via `~user` path suffix ([#2685](https://github.com/NousResearch/hermes-agent/pull/2685))
-- **Block untrusted browser-origin** API server access ([#2451](https://github.com/NousResearch/hermes-agent/pull/2451))
-- **Block sandbox backend creds** from subprocess env ([#1658](https://github.com/NousResearch/hermes-agent/pull/1658))
-- **Block @ references** from reading secrets outside workspace ([#2601](https://github.com/NousResearch/hermes-agent/pull/2601) by @Gutslabs)
-- **Malicious code pattern pre-exec scanner** for terminal_tool ([#2245](https://github.com/NousResearch/hermes-agent/pull/2245))
-- **Harden terminal safety** and sandbox file writes ([#1653](https://github.com/NousResearch/hermes-agent/pull/1653))
-- **PKCE verifier leak** fix + OAuth refresh Content-Type ([#1775](https://github.com/NousResearch/hermes-agent/pull/1775))
-- **Eliminate SQL string formatting** in `execute()` calls ([#2061](https://github.com/NousResearch/hermes-agent/pull/2061) by @dusterbloom)
-- **Harden jobs API** — input limits, field whitelist, startup check ([#2456](https://github.com/NousResearch/hermes-agent/pull/2456))
-
-### Reliability
-- Thread locks on 4 SessionDB methods ([#1704](https://github.com/NousResearch/hermes-agent/pull/1704))
-- File locking for concurrent memory writes ([#1726](https://github.com/NousResearch/hermes-agent/pull/1726))
-- Handle OpenRouter errors gracefully ([#2112](https://github.com/NousResearch/hermes-agent/pull/2112))
-- Guard print() calls against OSError ([#1668](https://github.com/NousResearch/hermes-agent/pull/1668))
-- Safely handle non-string inputs in redacting formatter ([#2392](https://github.com/NousResearch/hermes-agent/pull/2392), [#1700](https://github.com/NousResearch/hermes-agent/pull/1700))
-- ACP: preserve session provider on model switch, persist sessions to disk ([#2380](https://github.com/NousResearch/hermes-agent/pull/2380), [#2071](https://github.com/NousResearch/hermes-agent/pull/2071))
-- API server: persist ResponseStore to SQLite across restarts ([#2472](https://github.com/NousResearch/hermes-agent/pull/2472))
-- Fix: `fetch_nous_models` always TypeError from positional args ([#1699](https://github.com/NousResearch/hermes-agent/pull/1699))
-- Fix: resolve merge conflict markers in cli.py breaking startup ([#2347](https://github.com/NousResearch/hermes-agent/pull/2347))
-- Fix: `minisweagent_path.py` missing from wheel ([#2098](https://github.com/NousResearch/hermes-agent/pull/2098) by @JiwaniZakir)
-
-### Cron System
-- **`[SILENT]` response** — cron agents can suppress delivery ([#1833](https://github.com/NousResearch/hermes-agent/pull/1833))
-- **Scale missed-job grace window** with schedule frequency ([#2449](https://github.com/NousResearch/hermes-agent/pull/2449))
-- **Recover recent one-shot jobs** ([#1918](https://github.com/NousResearch/hermes-agent/pull/1918))
-- Fix: normalize `repeat<=0` to None — jobs deleted after first run when LLM passes -1 ([#2612](https://github.com/NousResearch/hermes-agent/pull/2612) by @Mibayy)
-- Fix: Matrix added to scheduler delivery platform_map ([#2167](https://github.com/NousResearch/hermes-agent/pull/2167) by @buntingszn)
-- Fix: naive ISO timestamps without timezone — jobs fire at wrong time ([#1729](https://github.com/NousResearch/hermes-agent/pull/1729))
-- Fix: `get_due_jobs` reads `jobs.json` twice — race condition ([#1716](https://github.com/NousResearch/hermes-agent/pull/1716))
-- Fix: silent jobs return empty response for delivery skip ([#2442](https://github.com/NousResearch/hermes-agent/pull/2442))
-- Fix: stop injecting cron outputs into gateway session history ([#2313](https://github.com/NousResearch/hermes-agent/pull/2313))
-- Fix: close abandoned coroutine when `asyncio.run()` raises RuntimeError ([#2317](https://github.com/NousResearch/hermes-agent/pull/2317))
-
----
-
-## 🧪 Testing
-
-- Resolve all consistently failing tests ([#2488](https://github.com/NousResearch/hermes-agent/pull/2488))
-- Replace `FakePath` with `monkeypatch` for Python 3.12 compat ([#2444](https://github.com/NousResearch/hermes-agent/pull/2444))
-- Align Hermes setup and full-suite expectations ([#1710](https://github.com/NousResearch/hermes-agent/pull/1710))
-
----
-
-## 📚 Documentation
-
-- Comprehensive docs update for recent features ([#1693](https://github.com/NousResearch/hermes-agent/pull/1693), [#2183](https://github.com/NousResearch/hermes-agent/pull/2183))
-- Alibaba Cloud and DingTalk setup guides ([#1687](https://github.com/NousResearch/hermes-agent/pull/1687), [#1692](https://github.com/NousResearch/hermes-agent/pull/1692))
-- Detailed skills documentation ([#2244](https://github.com/NousResearch/hermes-agent/pull/2244))
-- Honcho self-hosted / Docker configuration ([#2475](https://github.com/NousResearch/hermes-agent/pull/2475))
-- Context length detection FAQ and quickstart references ([#2179](https://github.com/NousResearch/hermes-agent/pull/2179))
-- Fix docs inconsistencies across reference and user guides ([#1995](https://github.com/NousResearch/hermes-agent/pull/1995))
-- Fix MCP install commands — use uv, not bare pip ([#1909](https://github.com/NousResearch/hermes-agent/pull/1909))
-- Replace ASCII diagrams with Mermaid/lists ([#2402](https://github.com/NousResearch/hermes-agent/pull/2402))
-- Gemini OAuth provider implementation plan ([#2467](https://github.com/NousResearch/hermes-agent/pull/2467))
-- Discord Server Members Intent marked as required ([#2330](https://github.com/NousResearch/hermes-agent/pull/2330))
-- Fix MDX build error in api-server.md ([#1787](https://github.com/NousResearch/hermes-agent/pull/1787))
-- Align venv path to match installer ([#2114](https://github.com/NousResearch/hermes-agent/pull/2114))
-- New skills added to hub index ([#2281](https://github.com/NousResearch/hermes-agent/pull/2281))
-
----
-
-## 👥 Contributors
-
-### Core
-- **@teknium1** (Teknium) — 280 PRs
-
-### Community Contributors
-- **@mchzimm** (to_the_max) — GitHub Copilot provider integration ([#1879](https://github.com/NousResearch/hermes-agent/pull/1879))
-- **@jquesnelle** (Jeffrey Quesnelle) — Per-thread persistent event loops fix ([#2214](https://github.com/NousResearch/hermes-agent/pull/2214))
-- **@llbn** (lbn) — Telegram MarkdownV2 strikethrough, spoiler, blockquotes, and escape fixes ([#2199](https://github.com/NousResearch/hermes-agent/pull/2199), [#2200](https://github.com/NousResearch/hermes-agent/pull/2200))
-- **@dusterbloom** — SQL injection prevention + local server context window querying ([#2061](https://github.com/NousResearch/hermes-agent/pull/2061), [#2091](https://github.com/NousResearch/hermes-agent/pull/2091))
-- **@0xbyt4** — Anthropic tool_calls None guard + OpenCode-Go provider config fix ([#2209](https://github.com/NousResearch/hermes-agent/pull/2209), [#2393](https://github.com/NousResearch/hermes-agent/pull/2393))
-- **@sai-samarth** (Saisamarth) — WhatsApp send_message routing + systemd node path ([#1769](https://github.com/NousResearch/hermes-agent/pull/1769), [#1767](https://github.com/NousResearch/hermes-agent/pull/1767))
-- **@Gutslabs** (Guts) — Block @ references from reading secrets ([#2601](https://github.com/NousResearch/hermes-agent/pull/2601))
-- **@Mibayy** (Mibay) — Cron job repeat normalization ([#2612](https://github.com/NousResearch/hermes-agent/pull/2612))
-- **@ten-jampa** (Tenzin Jampa) — Gateway /title command fix ([#2379](https://github.com/NousResearch/hermes-agent/pull/2379))
-- **@cutepawss** (lila) — File tools search pagination fix ([#1824](https://github.com/NousResearch/hermes-agent/pull/1824))
-- **@hanai** (Hanai) — OpenAI TTS base_url support ([#2064](https://github.com/NousResearch/hermes-agent/pull/2064))
-- **@rovle** (Lovre Pešut) — Daytona sandbox API migration ([#2063](https://github.com/NousResearch/hermes-agent/pull/2063))
-- **@buntingszn** (bunting szn) — Matrix cron delivery support ([#2167](https://github.com/NousResearch/hermes-agent/pull/2167))
-- **@InB4DevOps** — Token counter reset on new session ([#2101](https://github.com/NousResearch/hermes-agent/pull/2101))
-- **@JiwaniZakir** (Zakir Jiwani) — Missing file in wheel fix ([#2098](https://github.com/NousResearch/hermes-agent/pull/2098))
-- **@ygd58** (buray) — Delegate tool parent tool names fix ([#2083](https://github.com/NousResearch/hermes-agent/pull/2083))
-
----
-
-**Full Changelog**: [v2026.3.17...v2026.3.23](https://github.com/NousResearch/hermes-agent/compare/v2026.3.17...v2026.3.23)

acp_adapter/server.py

@@ -304,8 +304,6 @@ class HermesACPAgent(acp.Agent):
 
         if result.get("messages"):
             state.history = result["messages"]
-            # Persist updated history so sessions survive process restarts.
-            self.session_manager.save_session(session_id)
 
         final_response = result.get("final_response", "")
         if final_response and conn:
@@ -383,11 +381,11 @@ class HermesACPAgent(acp.Agent):
 
         new_model = args.strip()
         target_provider = None
-        current_provider = getattr(state.agent, "provider", None) or "openrouter"
 
         # Auto-detect provider for the requested model
         try:
             from hermes_cli.models import parse_model_input, detect_provider_for_model
+            current_provider = getattr(state.agent, "provider", None) or "openrouter"
             target_provider, new_model = parse_model_input(new_model, current_provider)
             if target_provider == current_provider:
                 detected = detect_provider_for_model(new_model, current_provider)
@@ -401,10 +399,8 @@ class HermesACPAgent(acp.Agent):
             session_id=state.session_id,
             cwd=state.cwd,
             model=new_model,
-            requested_provider=target_provider or current_provider,
         )
-        self.session_manager.save_session(state.session_id)
-        provider_label = getattr(state.agent, "provider", None) or target_provider or current_provider
+        provider_label = target_provider or getattr(state.agent, "provider", "auto")
         logger.info("Session %s: model switched to %s", state.session_id, new_model)
         return f"Model switched to: {new_model}\nProvider: {provider_label}"
 
@@ -448,7 +444,6 @@ class HermesACPAgent(acp.Agent):
 
     def _cmd_reset(self, args: str, state: SessionState) -> str:
         state.history.clear()
-        self.session_manager.save_session(state.session_id)
         return "Conversation history cleared."
 
     def _cmd_compact(self, args: str, state: SessionState) -> str:
@@ -458,7 +453,6 @@ class HermesACPAgent(acp.Agent):
             agent = state.agent
             if hasattr(agent, "compress_context"):
                 agent.compress_context(state.history)
-                self.session_manager.save_session(state.session_id)
                 return f"Context compressed. Messages: {len(state.history)}"
             return "Context compression not available for this agent."
         except Exception as e:
@@ -476,17 +470,10 @@ class HermesACPAgent(acp.Agent):
         state = self.session_manager.get_session(session_id)
         if state:
             state.model = model_id
-            current_provider = getattr(state.agent, "provider", None)
-            current_base_url = getattr(state.agent, "base_url", None)
-            current_api_mode = getattr(state.agent, "api_mode", None)
             state.agent = self.session_manager._make_agent(
                 session_id=session_id,
                 cwd=state.cwd,
                 model=model_id,
-                requested_provider=current_provider,
-                base_url=current_base_url,
-                api_mode=current_api_mode,
             )
-            self.session_manager.save_session(session_id)
             logger.info("Session %s: model switched to %s", session_id, model_id)
         return None

acp_adapter/session.py

@@ -1,15 +1,7 @@
-"""ACP session manager — maps ACP sessions to Hermes AIAgent instances.
-
-Sessions are persisted to the shared SessionDB (``~/.hermes/state.db``) so they
-survive process restarts and appear in ``session_search``.  When the editor
-reconnects after idle/restart, the ``load_session`` / ``resume_session`` calls
-find the persisted session in the database and restore the full conversation
-history.
-"""
+"""ACP session manager — maps ACP sessions to Hermes AIAgent instances."""
 from __future__ import annotations
 
 import copy
-import json
 import logging
 import uuid
 from dataclasses import dataclass, field
@@ -54,26 +46,18 @@ class SessionState:
 
 
 class SessionManager:
-    """Thread-safe manager for ACP sessions backed by Hermes AIAgent instances.
+    """Thread-safe manager for ACP sessions backed by Hermes AIAgent instances."""
 
-    Sessions are held in-memory for fast access **and** persisted to the
-    shared SessionDB so they survive process restarts and are searchable
-    via ``session_search``.
-    """
-
-    def __init__(self, agent_factory=None, db=None):
+    def __init__(self, agent_factory=None):
         """
         Args:
             agent_factory: Optional callable that creates an AIAgent-like object.
                            Used by tests. When omitted, a real AIAgent is created
                            using the current Hermes runtime provider configuration.
-            db:            Optional SessionDB instance. When omitted, the default
-                           SessionDB (``~/.hermes/state.db``) is lazily created.
         """
         self._sessions: Dict[str, SessionState] = {}
         self._lock = Lock()
         self._agent_factory = agent_factory
-        self._db_instance = db  # None → lazy-init on first use
 
     # ---- public API ---------------------------------------------------------
 
@@ -93,67 +77,54 @@ class SessionManager:
         with self._lock:
             self._sessions[session_id] = state
         _register_task_cwd(session_id, cwd)
-        self._persist(state)
         logger.info("Created ACP session %s (cwd=%s)", session_id, cwd)
         return state
 
     def get_session(self, session_id: str) -> Optional[SessionState]:
-        """Return the session for *session_id*, or ``None``.
-
-        If the session is not in memory but exists in the database (e.g. after
-        a process restart), it is transparently restored.
-        """
+        """Return the session for *session_id*, or ``None``."""
         with self._lock:
-            state = self._sessions.get(session_id)
-        if state is not None:
-            return state
-        # Attempt to restore from database.
-        return self._restore(session_id)
+            return self._sessions.get(session_id)
 
     def remove_session(self, session_id: str) -> bool:
-        """Remove a session from memory and database. Returns True if it existed."""
+        """Remove a session. Returns True if it existed."""
         with self._lock:
             existed = self._sessions.pop(session_id, None) is not None
-        db_existed = self._delete_persisted(session_id)
-        if existed or db_existed:
+        if existed:
             _clear_task_cwd(session_id)
-        return existed or db_existed
+        return existed
 
     def fork_session(self, session_id: str, cwd: str = ".") -> Optional[SessionState]:
         """Deep-copy a session's history into a new session."""
         import threading
 
-        original = self.get_session(session_id)  # checks DB too
-        if original is None:
-            return None
-
-        new_id = str(uuid.uuid4())
-        agent = self._make_agent(
-            session_id=new_id,
-            cwd=cwd,
-            model=original.model or None,
-        )
-        state = SessionState(
-            session_id=new_id,
-            agent=agent,
-            cwd=cwd,
-            model=getattr(agent, "model", original.model) or original.model,
-            history=copy.deepcopy(original.history),
-            cancel_event=threading.Event(),
-        )
         with self._lock:
+            original = self._sessions.get(session_id)
+            if original is None:
+                return None
+
+            new_id = str(uuid.uuid4())
+            agent = self._make_agent(
+                session_id=new_id,
+                cwd=cwd,
+                model=original.model or None,
+            )
+            state = SessionState(
+                session_id=new_id,
+                agent=agent,
+                cwd=cwd,
+                model=getattr(agent, "model", original.model) or original.model,
+                history=copy.deepcopy(original.history),
+                cancel_event=threading.Event(),
+            )
             self._sessions[new_id] = state
         _register_task_cwd(new_id, cwd)
-        self._persist(state)
         logger.info("Forked ACP session %s -> %s", session_id, new_id)
         return state
 
     def list_sessions(self) -> List[Dict[str, Any]]:
-        """Return lightweight info dicts for all sessions (memory + database)."""
-        # Collect in-memory sessions first.
+        """Return lightweight info dicts for all sessions."""
         with self._lock:
-            seen_ids = set(self._sessions.keys())
-            results = [
+            return [
                 {
                     "session_id": s.session_id,
                     "cwd": s.cwd,
@@ -163,245 +134,23 @@ class SessionManager:
                 for s in self._sessions.values()
             ]
 
-        # Merge any persisted sessions not currently in memory.
-        db = self._get_db()
-        if db is not None:
-            try:
-                rows = db.search_sessions(source="acp", limit=1000)
-                for row in rows:
-                    sid = row["id"]
-                    if sid in seen_ids:
-                        continue
-                    # Extract cwd from model_config JSON.
-                    cwd = "."
-                    mc = row.get("model_config")
-                    if mc:
-                        try:
-                            cwd = json.loads(mc).get("cwd", ".")
-                        except (json.JSONDecodeError, TypeError):
-                            pass
-                    results.append({
-                        "session_id": sid,
-                        "cwd": cwd,
-                        "model": row.get("model") or "",
-                        "history_len": row.get("message_count") or 0,
-                    })
-            except Exception:
-                logger.debug("Failed to list ACP sessions from DB", exc_info=True)
-
-        return results
-
     def update_cwd(self, session_id: str, cwd: str) -> Optional[SessionState]:
         """Update the working directory for a session and its tool overrides."""
-        state = self.get_session(session_id)  # checks DB too
-        if state is None:
-            return None
-        state.cwd = cwd
+        with self._lock:
+            state = self._sessions.get(session_id)
+            if state is None:
+                return None
+            state.cwd = cwd
         _register_task_cwd(session_id, cwd)
-        self._persist(state)
         return state
 
     def cleanup(self) -> None:
-        """Remove all sessions (memory and database) and clear task-specific cwd overrides."""
+        """Remove all sessions and clear task-specific cwd overrides."""
         with self._lock:
             session_ids = list(self._sessions.keys())
             self._sessions.clear()
         for session_id in session_ids:
             _clear_task_cwd(session_id)
-            self._delete_persisted(session_id)
-        # Also remove any DB-only ACP sessions not currently in memory.
-        db = self._get_db()
-        if db is not None:
-            try:
-                rows = db.search_sessions(source="acp", limit=10000)
-                for row in rows:
-                    sid = row["id"]
-                    _clear_task_cwd(sid)
-                    db.delete_session(sid)
-            except Exception:
-                logger.debug("Failed to cleanup ACP sessions from DB", exc_info=True)
-
-    def save_session(self, session_id: str) -> None:
-        """Persist the current state of a session to the database.
-
-        Called by the server after prompt completion, slash commands that
-        mutate history, and model switches.
-        """
-        with self._lock:
-            state = self._sessions.get(session_id)
-        if state is not None:
-            self._persist(state)
-
-    # ---- persistence via SessionDB ------------------------------------------
-
-    def _get_db(self):
-        """Lazily initialise and return the SessionDB instance.
-
-        Returns ``None`` if the DB is unavailable (e.g. import error in a
-        minimal test environment).
-
-        Note: we resolve ``HERMES_HOME`` dynamically rather than relying on
-        the module-level ``DEFAULT_DB_PATH`` constant, because that constant
-        is evaluated at import time and won't reflect env-var changes made
-        later (e.g. by the test fixture ``_isolate_hermes_home``).
-        """
-        if self._db_instance is not None:
-            return self._db_instance
-        try:
-            import os
-            from pathlib import Path
-            from hermes_state import SessionDB
-            hermes_home = Path(os.getenv("HERMES_HOME", Path.home() / ".hermes"))
-            self._db_instance = SessionDB(db_path=hermes_home / "state.db")
-            return self._db_instance
-        except Exception:
-            logger.debug("SessionDB unavailable for ACP persistence", exc_info=True)
-            return None
-
-    def _persist(self, state: SessionState) -> None:
-        """Write session state to the database.
-
-        Creates the session record if it doesn't exist, then replaces all
-        stored messages with the current in-memory history.
-        """
-        db = self._get_db()
-        if db is None:
-            return
-
-        # Ensure model is a plain string (not a MagicMock or other proxy).
-        model_str = str(state.model) if state.model else None
-        session_meta = {"cwd": state.cwd}
-        provider = getattr(state.agent, "provider", None)
-        base_url = getattr(state.agent, "base_url", None)
-        api_mode = getattr(state.agent, "api_mode", None)
-        if isinstance(provider, str) and provider.strip():
-            session_meta["provider"] = provider.strip()
-        if isinstance(base_url, str) and base_url.strip():
-            session_meta["base_url"] = base_url.strip()
-        if isinstance(api_mode, str) and api_mode.strip():
-            session_meta["api_mode"] = api_mode.strip()
-        cwd_json = json.dumps(session_meta)
-
-        try:
-            # Ensure the session record exists.
-            existing = db.get_session(state.session_id)
-            if existing is None:
-                db.create_session(
-                    session_id=state.session_id,
-                    source="acp",
-                    model=model_str,
-                    model_config={"cwd": state.cwd},
-                )
-            else:
-                # Update model_config (contains cwd) if changed.
-                try:
-                    with db._lock:
-                        db._conn.execute(
-                            "UPDATE sessions SET model_config = ?, model = COALESCE(?, model) WHERE id = ?",
-                            (cwd_json, model_str, state.session_id),
-                        )
-                        db._conn.commit()
-                except Exception:
-                    logger.debug("Failed to update ACP session metadata", exc_info=True)
-
-            # Replace stored messages with current history.
-            db.clear_messages(state.session_id)
-            for msg in state.history:
-                db.append_message(
-                    session_id=state.session_id,
-                    role=msg.get("role", "user"),
-                    content=msg.get("content"),
-                    tool_name=msg.get("tool_name") or msg.get("name"),
-                    tool_calls=msg.get("tool_calls"),
-                    tool_call_id=msg.get("tool_call_id"),
-                )
-        except Exception:
-            logger.warning("Failed to persist ACP session %s", state.session_id, exc_info=True)
-
-    def _restore(self, session_id: str) -> Optional[SessionState]:
-        """Load a session from the database into memory, recreating the AIAgent."""
-        import threading
-
-        db = self._get_db()
-        if db is None:
-            return None
-
-        try:
-            row = db.get_session(session_id)
-        except Exception:
-            logger.debug("Failed to query DB for ACP session %s", session_id, exc_info=True)
-            return None
-
-        if row is None:
-            return None
-
-        # Only restore ACP sessions.
-        if row.get("source") != "acp":
-            return None
-
-        # Extract cwd from model_config.
-        cwd = "."
-        requested_provider = row.get("billing_provider")
-        restored_base_url = row.get("billing_base_url")
-        restored_api_mode = None
-        mc = row.get("model_config")
-        if mc:
-            try:
-                meta = json.loads(mc)
-                if isinstance(meta, dict):
-                    cwd = meta.get("cwd", ".")
-                    requested_provider = meta.get("provider") or requested_provider
-                    restored_base_url = meta.get("base_url") or restored_base_url
-                    restored_api_mode = meta.get("api_mode") or restored_api_mode
-            except (json.JSONDecodeError, TypeError):
-                pass
-
-        model = row.get("model") or None
-
-        # Load conversation history.
-        try:
-            history = db.get_messages_as_conversation(session_id)
-        except Exception:
-            logger.warning("Failed to load messages for ACP session %s", session_id, exc_info=True)
-            history = []
-
-        try:
-            agent = self._make_agent(
-                session_id=session_id,
-                cwd=cwd,
-                model=model,
-                requested_provider=requested_provider,
-                base_url=restored_base_url,
-                api_mode=restored_api_mode,
-            )
-        except Exception:
-            logger.warning("Failed to recreate agent for ACP session %s", session_id, exc_info=True)
-            return None
-
-        state = SessionState(
-            session_id=session_id,
-            agent=agent,
-            cwd=cwd,
-            model=model or getattr(agent, "model", "") or "",
-            history=history,
-            cancel_event=threading.Event(),
-        )
-        with self._lock:
-            self._sessions[session_id] = state
-        _register_task_cwd(session_id, cwd)
-        logger.info("Restored ACP session %s from DB (%d messages)", session_id, len(history))
-        return state
-
-    def _delete_persisted(self, session_id: str) -> bool:
-        """Delete a session from the database. Returns True if it existed."""
-        db = self._get_db()
-        if db is None:
-            return False
-        try:
-            return db.delete_session(session_id)
-        except Exception:
-            logger.debug("Failed to delete ACP session %s from DB", session_id, exc_info=True)
-            return False
 
     # ---- internal -----------------------------------------------------------
 
@@ -411,9 +160,6 @@ class SessionManager:
         session_id: str,
         cwd: str,
         model: str | None = None,
-        requested_provider: str | None = None,
-        base_url: str | None = None,
-        api_mode: str | None = None,
     ):
         if self._agent_factory is not None:
             return self._agent_factory()
@@ -425,10 +171,10 @@ class SessionManager:
         config = load_config()
         model_cfg = config.get("model")
         default_model = "anthropic/claude-opus-4.6"
-        config_provider = None
+        requested_provider = None
         if isinstance(model_cfg, dict):
             default_model = str(model_cfg.get("default") or default_model)
-            config_provider = model_cfg.get("provider")
+            requested_provider = model_cfg.get("provider")
         elif isinstance(model_cfg, str) and model_cfg.strip():
             default_model = model_cfg.strip()
 
@@ -441,15 +187,13 @@ class SessionManager:
         }
 
         try:
-            runtime = resolve_runtime_provider(requested=requested_provider or config_provider)
+            runtime = resolve_runtime_provider(requested=requested_provider)
             kwargs.update(
                 {
                     "provider": runtime.get("provider"),
-                    "api_mode": api_mode or runtime.get("api_mode"),
-                    "base_url": base_url or runtime.get("base_url"),
+                    "api_mode": runtime.get("api_mode"),
+                    "base_url": runtime.get("base_url"),
                     "api_key": runtime.get("api_key"),
-                    "command": runtime.get("command"),
-                    "args": list(runtime.get("args") or []),
                 }
             )
         except Exception:

agent/anthropic_adapter.py

@@ -656,21 +656,19 @@ def refresh_hermes_oauth_token() -> Optional[str]:
 # ---------------------------------------------------------------------------
 
 
-def normalize_model_name(model: str, preserve_dots: bool = False) -> str:
+def normalize_model_name(model: str) -> str:
     """Normalize a model name for the Anthropic API.
 
     - Strips 'anthropic/' prefix (OpenRouter format, case-insensitive)
     - Converts dots to hyphens in version numbers (OpenRouter uses dots,
-      Anthropic uses hyphens: claude-opus-4.6 → claude-opus-4-6), unless
-      preserve_dots is True (e.g. for Alibaba/DashScope: qwen3.5-plus).
+      Anthropic uses hyphens: claude-opus-4.6 → claude-opus-4-6)
     """
     lower = model.lower()
     if lower.startswith("anthropic/"):
         model = model[len("anthropic/"):]
-    if not preserve_dots:
-        # OpenRouter uses dots for version separators (claude-opus-4.6),
-        # Anthropic uses hyphens (claude-opus-4-6). Convert dots to hyphens.
-        model = model.replace(".", "-")
+    # OpenRouter uses dots for version separators (claude-opus-4.6),
+    # Anthropic uses hyphens (claude-opus-4-6). Convert dots to hyphens.
+    model = model.replace(".", "-")
     return model
 
 
@@ -866,8 +864,6 @@ def convert_messages_to_anthropic(
                 else:
                     blocks.append({"type": "text", "text": str(content)})
             for tc in m.get("tool_calls", []):
-                if not tc or not isinstance(tc, dict):
-                    continue
                 fn = tc.get("function", {})
                 args = fn.get("arguments", "{}")
                 try:
@@ -939,26 +935,6 @@ def convert_messages_to_anthropic(
             if not m["content"]:
                 m["content"] = [{"type": "text", "text": "(tool call removed)"}]
 
-    # Strip orphaned tool_result blocks (no matching tool_use precedes them).
-    # This is the mirror of the above: context compression or session truncation
-    # can remove an assistant message containing a tool_use while leaving the
-    # subsequent tool_result intact.  Anthropic rejects these with a 400.
-    tool_use_ids = set()
-    for m in result:
-        if m["role"] == "assistant" and isinstance(m["content"], list):
-            for block in m["content"]:
-                if block.get("type") == "tool_use":
-                    tool_use_ids.add(block.get("id"))
-    for m in result:
-        if m["role"] == "user" and isinstance(m["content"], list):
-            m["content"] = [
-                b
-                for b in m["content"]
-                if b.get("type") != "tool_result" or b.get("tool_use_id") in tool_use_ids
-            ]
-            if not m["content"]:
-                m["content"] = [{"type": "text", "text": "(tool result removed)"}]
-
     # Enforce strict role alternation (Anthropic rejects consecutive same-role messages)
     fixed = []
     for m in result:
@@ -1008,20 +984,16 @@ def build_anthropic_kwargs(
     reasoning_config: Optional[Dict[str, Any]],
     tool_choice: Optional[str] = None,
     is_oauth: bool = False,
-    preserve_dots: bool = False,
 ) -> Dict[str, Any]:
     """Build kwargs for anthropic.messages.create().
 
     When *is_oauth* is True, applies Claude Code compatibility transforms:
     system prompt prefix, tool name prefixing, and prompt sanitization.
-
-    When *preserve_dots* is True, model name dots are not converted to hyphens
-    (for Alibaba/DashScope anthropic-compatible endpoints: qwen3.5-plus).
     """
     system, anthropic_messages = convert_messages_to_anthropic(messages)
     anthropic_tools = convert_tools_to_anthropic(tools) if tools else []
 
-    model = normalize_model_name(model, preserve_dots=preserve_dots)
+    model = normalize_model_name(model)
     effective_max_tokens = max_tokens or 16384
 
     # ── OAuth: Claude Code identity ──────────────────────────────────

agent/auxiliary_client.py

@@ -40,7 +40,6 @@ import json
 import logging
 import os
 import threading
-import time
 from pathlib import Path
 from types import SimpleNamespace
 from typing import Any, Dict, List, Optional, Tuple
@@ -326,10 +325,9 @@ class AsyncCodexAuxiliaryClient:
 class _AnthropicCompletionsAdapter:
     """OpenAI-client-compatible adapter for Anthropic Messages API."""
 
-    def __init__(self, real_client: Any, model: str, is_oauth: bool = False):
+    def __init__(self, real_client: Any, model: str):
         self._client = real_client
         self._model = model
-        self._is_oauth = is_oauth
 
     def create(self, **kwargs) -> Any:
         from agent.anthropic_adapter import build_anthropic_kwargs, normalize_anthropic_response
@@ -358,7 +356,6 @@ class _AnthropicCompletionsAdapter:
             max_tokens=max_tokens,
             reasoning_config=None,
             tool_choice=normalized_tool_choice,
-            is_oauth=self._is_oauth,
         )
         if temperature is not None:
             anthropic_kwargs["temperature"] = temperature
@@ -397,9 +394,9 @@ class _AnthropicChatShim:
 class AnthropicAuxiliaryClient:
     """OpenAI-client-compatible wrapper over a native Anthropic client."""
 
-    def __init__(self, real_client: Any, model: str, api_key: str, base_url: str, is_oauth: bool = False):
+    def __init__(self, real_client: Any, model: str, api_key: str, base_url: str):
         self._real_client = real_client
-        adapter = _AnthropicCompletionsAdapter(real_client, model, is_oauth=is_oauth)
+        adapter = _AnthropicCompletionsAdapter(real_client, model)
         self.chat = _AnthropicChatShim(adapter)
         self.api_key = api_key
         self.base_url = base_url
@@ -466,30 +463,15 @@ def _nous_base_url() -> str:
 
 
 def _read_codex_access_token() -> Optional[str]:
-    """Read a valid, non-expired Codex OAuth access token from Hermes auth store."""
+    """Read a valid Codex OAuth access token from Hermes auth store (~/.hermes/auth.json)."""
     try:
         from hermes_cli.auth import _read_codex_tokens
         data = _read_codex_tokens()
         tokens = data.get("tokens", {})
         access_token = tokens.get("access_token")
-        if not isinstance(access_token, str) or not access_token.strip():
-            return None
-
-        # Check JWT expiry — expired tokens block the auto chain and
-        # prevent fallback to working providers (e.g. Anthropic).
-        try:
-            import base64
-            payload = access_token.split(".")[1]
-            payload += "=" * (-len(payload) % 4)
-            claims = json.loads(base64.urlsafe_b64decode(payload))
-            exp = claims.get("exp", 0)
-            if exp and time.time() > exp:
-                logger.debug("Codex access token expired (exp=%s), skipping", exp)
-                return None
-        except Exception:
-            pass  # Non-JWT token or decode error — use as-is
-
-        return access_token.strip()
+        if isinstance(access_token, str) and access_token.strip():
+            return access_token.strip()
+        return None
     except Exception as exc:
         logger.debug("Could not read Codex auth for auxiliary client: %s", exc)
         return None
@@ -498,11 +480,11 @@ def _read_codex_access_token() -> Optional[str]:
 def _resolve_api_key_provider() -> Tuple[Optional[OpenAI], Optional[str]]:
     """Try each API-key provider in PROVIDER_REGISTRY order.
 
-    Returns (client, model) for the first provider with usable runtime
-    credentials, or (None, None) if none are configured.
+    Returns (client, model) for the first provider whose env var is set,
+    or (None, None) if none are configured.
     """
     try:
-        from hermes_cli.auth import PROVIDER_REGISTRY, resolve_api_key_provider_credentials
+        from hermes_cli.auth import PROVIDER_REGISTRY
     except ImportError:
         logger.debug("Could not import PROVIDER_REGISTRY for API-key fallback")
         return None, None
@@ -510,24 +492,34 @@ def _resolve_api_key_provider() -> Tuple[Optional[OpenAI], Optional[str]]:
     for provider_id, pconfig in PROVIDER_REGISTRY.items():
         if pconfig.auth_type != "api_key":
             continue
+        # Check if any of the provider's env vars are set
+        api_key = ""
+        for env_var in pconfig.api_key_env_vars:
+            val = os.getenv(env_var, "").strip()
+            if val:
+                api_key = val
+                break
+        if not api_key:
+            continue
         if provider_id == "anthropic":
             return _try_anthropic()
 
-        creds = resolve_api_key_provider_credentials(provider_id)
-        api_key = str(creds.get("api_key", "")).strip()
-        if not api_key:
-            continue
-
-        base_url = str(creds.get("base_url", "")).strip().rstrip("/") or pconfig.inference_base_url
+        # Resolve base URL (with optional env-var override)
+        # Kimi Code keys (sk-kimi-) need api.kimi.com/coding/v1
+        env_url = ""
+        if pconfig.base_url_env_var:
+            env_url = os.getenv(pconfig.base_url_env_var, "").strip()
+        if env_url:
+            base_url = env_url.rstrip("/")
+        elif provider_id == "kimi-coding" and api_key.startswith("sk-kimi-"):
+            base_url = "https://api.kimi.com/coding/v1"
+        else:
+            base_url = pconfig.inference_base_url
         model = _API_KEY_PROVIDER_AUX_MODELS.get(provider_id, "default")
         logger.debug("Auxiliary text client: %s (%s)", pconfig.name, model)
         extra = {}
         if "api.kimi.com" in base_url.lower():
             extra["default_headers"] = {"User-Agent": "KimiCLI/1.0"}
-        elif "api.githubcopilot.com" in base_url.lower():
-            from hermes_cli.models import copilot_default_headers
-
-            extra["default_headers"] = copilot_default_headers()
         return OpenAI(api_key=api_key, base_url=base_url, **extra), model
 
     return None, None
@@ -672,29 +664,10 @@ def _try_anthropic() -> Tuple[Optional[Any], Optional[str]]:
     if not token:
         return None, None
 
-    # Allow base URL override from config.yaml model.base_url, but only
-    # when the configured provider is anthropic — otherwise a non-Anthropic
-    # base_url (e.g. Codex endpoint) would leak into Anthropic requests.
-    base_url = _ANTHROPIC_DEFAULT_BASE_URL
-    try:
-        from hermes_cli.config import load_config
-        cfg = load_config()
-        model_cfg = cfg.get("model")
-        if isinstance(model_cfg, dict):
-            cfg_provider = str(model_cfg.get("provider") or "").strip().lower()
-            if cfg_provider == "anthropic":
-                cfg_base_url = (model_cfg.get("base_url") or "").strip().rstrip("/")
-                if cfg_base_url:
-                    base_url = cfg_base_url
-    except Exception:
-        pass
-
-    from agent.anthropic_adapter import _is_oauth_token
-    is_oauth = _is_oauth_token(token)
     model = _API_KEY_PROVIDER_AUX_MODELS.get("anthropic", "claude-haiku-4-5-20251001")
-    logger.debug("Auxiliary client: Anthropic native (%s) at %s (oauth=%s)", model, base_url, is_oauth)
-    real_client = build_anthropic_client(token, base_url)
-    return AnthropicAuxiliaryClient(real_client, model, token, base_url, is_oauth=is_oauth), model
+    logger.debug("Auxiliary client: Anthropic native (%s)", model)
+    real_client = build_anthropic_client(token, _ANTHROPIC_DEFAULT_BASE_URL)
+    return AnthropicAuxiliaryClient(real_client, model, token, _ANTHROPIC_DEFAULT_BASE_URL), model
 
 
 def _resolve_forced_provider(forced: str) -> Tuple[Optional[OpenAI], Optional[str]]:
@@ -771,10 +744,6 @@ def _to_async_client(sync_client, model: str):
     base_lower = str(sync_client.base_url).lower()
     if "openrouter" in base_lower:
         async_kwargs["default_headers"] = dict(_OR_HEADERS)
-    elif "api.githubcopilot.com" in base_lower:
-        from hermes_cli.models import copilot_default_headers
-
-        async_kwargs["default_headers"] = copilot_default_headers()
     elif "api.kimi.com" in base_lower:
         async_kwargs["default_headers"] = {"User-Agent": "KimiCLI/1.0"}
     return AsyncOpenAI(**async_kwargs), model
@@ -916,7 +885,7 @@ def resolve_provider_client(
 
     # ── API-key providers from PROVIDER_REGISTRY ─────────────────────
     try:
-        from hermes_cli.auth import PROVIDER_REGISTRY, resolve_api_key_provider_credentials
+        from hermes_cli.auth import PROVIDER_REGISTRY, _resolve_kimi_base_url
     except ImportError:
         logger.debug("hermes_cli.auth not available for provider %s", provider)
         return None, None
@@ -935,18 +904,26 @@ def resolve_provider_client(
             final_model = model or default_model
             return (_to_async_client(client, final_model) if async_mode else (client, final_model))
 
-        creds = resolve_api_key_provider_credentials(provider)
-        api_key = str(creds.get("api_key", "")).strip()
+        # Find the first configured API key
+        api_key = ""
+        for env_var in pconfig.api_key_env_vars:
+            api_key = os.getenv(env_var, "").strip()
+            if api_key:
+                break
         if not api_key:
-            tried_sources = list(pconfig.api_key_env_vars)
-            if provider == "copilot":
-                tried_sources.append("gh auth token")
             logger.warning("resolve_provider_client: provider %s has no API "
                            "key configured (tried: %s)",
-                           provider, ", ".join(tried_sources))
+                           provider, ", ".join(pconfig.api_key_env_vars))
             return None, None
 
-        base_url = str(creds.get("base_url", "")).strip().rstrip("/") or pconfig.inference_base_url
+        # Resolve base URL (env override → provider-specific logic → default)
+        base_url_override = os.getenv(pconfig.base_url_env_var, "").strip() if pconfig.base_url_env_var else ""
+        if provider == "kimi-coding":
+            base_url = _resolve_kimi_base_url(api_key, pconfig.inference_base_url, base_url_override)
+        elif base_url_override:
+            base_url = base_url_override
+        else:
+            base_url = pconfig.inference_base_url
 
         default_model = _API_KEY_PROVIDER_AUX_MODELS.get(provider, "")
         final_model = model or default_model
@@ -955,10 +932,6 @@ def resolve_provider_client(
         headers = {}
         if "api.kimi.com" in base_url.lower():
             headers["User-Agent"] = "KimiCLI/1.0"
-        elif "api.githubcopilot.com" in base_url.lower():
-            from hermes_cli.models import copilot_default_headers
-
-            headers.update(copilot_default_headers())
 
         client = OpenAI(api_key=api_key, base_url=base_url,
                         **({"default_headers": headers} if headers else {}))
@@ -1204,53 +1177,6 @@ _client_cache: Dict[tuple, tuple] = {}
 _client_cache_lock = threading.Lock()
 
 
-def _force_close_async_httpx(client: Any) -> None:
-    """Mark the httpx AsyncClient inside an AsyncOpenAI client as closed.
-
-    This prevents ``AsyncHttpxClientWrapper.__del__`` from scheduling
-    ``aclose()`` on a (potentially closed) event loop, which causes
-    ``RuntimeError: Event loop is closed`` → prompt_toolkit's
-    "Press ENTER to continue..." handler.
-
-    We intentionally do NOT run the full async close path — the
-    connections will be dropped by the OS when the process exits.
-    """
-    try:
-        from httpx._client import ClientState
-        inner = getattr(client, "_client", None)
-        if inner is not None and not getattr(inner, "is_closed", True):
-            inner._state = ClientState.CLOSED
-    except Exception:
-        pass
-
-
-def shutdown_cached_clients() -> None:
-    """Close all cached clients (sync and async) to prevent event-loop errors.
-
-    Call this during CLI shutdown, *before* the event loop is closed, to
-    avoid ``AsyncHttpxClientWrapper.__del__`` raising on a dead loop.
-    """
-    import inspect
-
-    with _client_cache_lock:
-        for key, entry in list(_client_cache.items()):
-            client = entry[0]
-            if client is None:
-                continue
-            # Mark any async httpx transport as closed first (prevents __del__
-            # from scheduling aclose() on a dead event loop).
-            _force_close_async_httpx(client)
-            # Sync clients: close the httpx connection pool cleanly.
-            # Async clients: skip — we already neutered __del__ above.
-            try:
-                close_fn = getattr(client, "close", None)
-                if close_fn and not inspect.iscoroutinefunction(close_fn):
-                    close_fn()
-            except Exception:
-                pass
-        _client_cache.clear()
-
-
 def _get_cached_client(
     provider: str,
     model: str = None,
@@ -1262,19 +1188,8 @@ def _get_cached_client(
     cache_key = (provider, async_mode, base_url or "", api_key or "")
     with _client_cache_lock:
         if cache_key in _client_cache:
-            cached_client, cached_default, cached_loop = _client_cache[cache_key]
-            if async_mode:
-                # Async clients are bound to the event loop that created them.
-                # A cached async client whose loop has been closed will raise
-                # "Event loop is closed" when httpx tries to clean up its
-                # transport.  Discard the stale client and create a fresh one.
-                if cached_loop is not None and cached_loop.is_closed():
-                    _force_close_async_httpx(cached_client)
-                    del _client_cache[cache_key]
-                else:
-                    return cached_client, model or cached_default
-            else:
-                return cached_client, model or cached_default
+            cached_client, cached_default = _client_cache[cache_key]
+            return cached_client, model or cached_default
     # Build outside the lock
     client, default_model = resolve_provider_client(
         provider,
@@ -1284,20 +1199,11 @@ def _get_cached_client(
         explicit_api_key=api_key,
     )
     if client is not None:
-        # For async clients, remember which loop they were created on so we
-        # can detect stale entries later.
-        bound_loop = None
-        if async_mode:
-            try:
-                import asyncio as _aio
-                bound_loop = _aio.get_event_loop()
-            except RuntimeError:
-                pass
         with _client_cache_lock:
             if cache_key not in _client_cache:
-                _client_cache[cache_key] = (client, default_model, bound_loop)
+                _client_cache[cache_key] = (client, default_model)
             else:
-                client, default_model, _ = _client_cache[cache_key]
+                client, default_model = _client_cache[cache_key]
     return client, model or default_model
 
 
@@ -1499,18 +1405,8 @@ def call_llm(
             api_key=resolved_api_key,
         )
         if client is None:
-            # When the user explicitly chose a non-OpenRouter provider but no
-            # credentials were found, fail fast instead of silently routing
-            # through OpenRouter (which causes confusing 404s).
-            _explicit = (resolved_provider or "").strip().lower()
-            if _explicit and _explicit not in ("auto", "openrouter", "custom"):
-                raise RuntimeError(
-                    f"Provider '{_explicit}' is set in config.yaml but no API key "
-                    f"was found. Set the {_explicit.upper()}_API_KEY environment "
-                    f"variable, or switch to a different provider with `hermes model`."
-                )
-            # For auto/custom, fall back to OpenRouter
-            if not resolved_base_url:
+            # Fallback: try openrouter
+            if resolved_provider != "openrouter" and not resolved_base_url:
                 logger.warning("Provider %s unavailable, falling back to openrouter",
                                resolved_provider)
                 client, final_model = _get_cached_client(
@@ -1592,14 +1488,7 @@ async def async_call_llm(
             api_key=resolved_api_key,
         )
         if client is None:
-            _explicit = (resolved_provider or "").strip().lower()
-            if _explicit and _explicit not in ("auto", "openrouter", "custom"):
-                raise RuntimeError(
-                    f"Provider '{_explicit}' is set in config.yaml but no API key "
-                    f"was found. Set the {_explicit.upper()}_API_KEY environment "
-                    f"variable, or switch to a different provider with `hermes model`."
-                )
-            if not resolved_base_url:
+            if resolved_provider != "openrouter" and not resolved_base_url:
                 logger.warning("Provider %s unavailable, falling back to openrouter",
                                resolved_provider)
                 client, final_model = _get_cached_client(

agent/context_compressor.py

@@ -1,16 +1,8 @@
 """Automatic context window compression for long conversations.
 
 Self-contained class with its own OpenAI client for summarization.
-Uses auxiliary model (cheap/fast) to summarize middle turns while
+Uses Gemini Flash (cheap/fast) to summarize middle turns while
 protecting head and tail context.
-
-Improvements over v1:
-  - Structured summary template (Goal, Progress, Decisions, Files, Next Steps)
-  - Iterative summary updates (preserves info across multiple compactions)
-  - Token-budget tail protection instead of fixed message count
-  - Tool output pruning before LLM summarization (cheap pre-pass)
-  - Scaled summary budget (proportional to compressed content)
-  - Richer tool call/result detail in summarizer input
 """
 
 import logging
@@ -35,29 +27,12 @@ SUMMARY_PREFIX = (
 )
 LEGACY_SUMMARY_PREFIX = "[CONTEXT SUMMARY]:"
 
-# Minimum tokens for the summary output
-_MIN_SUMMARY_TOKENS = 2000
-# Proportion of compressed content to allocate for summary
-_SUMMARY_RATIO = 0.20
-# Absolute ceiling for summary tokens (even on very large context windows)
-_SUMMARY_TOKENS_CEILING = 12_000
-
-# Placeholder used when pruning old tool results
-_PRUNED_TOOL_PLACEHOLDER = "[Old tool output cleared to save context space]"
-
-# Chars per token rough estimate
-_CHARS_PER_TOKEN = 4
-
 
 class ContextCompressor:
     """Compresses conversation context when approaching the model's context limit.
 
-    Algorithm:
-      1. Prune old tool results (cheap, no LLM call)
-      2. Protect head messages (system prompt + first exchange)
-      3. Protect tail messages by token budget (most recent ~20K tokens)
-      4. Summarize middle turns with structured LLM prompt
-      5. On subsequent compactions, iteratively update the previous summary
+    Algorithm: protect first N + last N turns, summarize everything in between.
+    Token tracking uses actual counts from API responses for accuracy.
     """
 
     def __init__(
@@ -65,50 +40,25 @@ class ContextCompressor:
         model: str,
         threshold_percent: float = 0.50,
         protect_first_n: int = 3,
-        protect_last_n: int = 20,
-        summary_target_ratio: float = 0.20,
+        protect_last_n: int = 4,
+        summary_target_tokens: int = 2500,
         quiet_mode: bool = False,
         summary_model_override: str = None,
         base_url: str = "",
         api_key: str = "",
-        config_context_length: int | None = None,
-        provider: str = "",
     ):
         self.model = model
         self.base_url = base_url
         self.api_key = api_key
-        self.provider = provider
         self.threshold_percent = threshold_percent
         self.protect_first_n = protect_first_n
         self.protect_last_n = protect_last_n
-        self.summary_target_ratio = max(0.10, min(summary_target_ratio, 0.80))
+        self.summary_target_tokens = summary_target_tokens
         self.quiet_mode = quiet_mode
 
-        self.context_length = get_model_context_length(
-            model, base_url=base_url, api_key=api_key,
-            config_context_length=config_context_length,
-            provider=provider,
-        )
+        self.context_length = get_model_context_length(model, base_url=base_url, api_key=api_key)
         self.threshold_tokens = int(self.context_length * threshold_percent)
         self.compression_count = 0
-
-        # Derive token budgets: ratio is relative to the threshold, not total context
-        target_tokens = int(self.threshold_tokens * self.summary_target_ratio)
-        self.tail_token_budget = target_tokens
-        self.max_summary_tokens = min(
-            int(self.context_length * 0.05), _SUMMARY_TOKENS_CEILING,
-        )
-
-        if not quiet_mode:
-            logger.info(
-                "Context compressor initialized: model=%s context_length=%d "
-                "threshold=%d (%.0f%%) target_ratio=%.0f%% tail_budget=%d "
-                "provider=%s base_url=%s",
-                model, self.context_length, self.threshold_tokens,
-                threshold_percent * 100, self.summary_target_ratio * 100,
-                self.tail_token_budget,
-                provider or "none", base_url or "none",
-            )
         self._context_probed = False  # True after a step-down from context error
 
         self.last_prompt_tokens = 0
@@ -117,9 +67,6 @@ class ContextCompressor:
 
         self.summary_model = summary_model_override or ""
 
-        # Stores the previous compaction summary for iterative updates
-        self._previous_summary: Optional[str] = None
-
     def update_from_response(self, usage: Dict[str, Any]):
         """Update tracked token usage from API response."""
         self.last_prompt_tokens = usage.get("prompt_tokens", 0)
@@ -146,209 +93,53 @@ class ContextCompressor:
             "compression_count": self.compression_count,
         }
 
-    # ------------------------------------------------------------------
-    # Tool output pruning (cheap pre-pass, no LLM call)
-    # ------------------------------------------------------------------
-
-    def _prune_old_tool_results(
-        self, messages: List[Dict[str, Any]], protect_tail_count: int,
-    ) -> tuple[List[Dict[str, Any]], int]:
-        """Replace old tool result contents with a short placeholder.
-
-        Walks backward from the end, protecting the most recent
-        ``protect_tail_count`` messages. Older tool results get their
-        content replaced with a placeholder string.
-
-        Returns (pruned_messages, pruned_count).
-        """
-        if not messages:
-            return messages, 0
-
-        result = [m.copy() for m in messages]
-        pruned = 0
-        prune_boundary = len(result) - protect_tail_count
-
-        for i in range(prune_boundary):
-            msg = result[i]
-            if msg.get("role") != "tool":
-                continue
-            content = msg.get("content", "")
-            if not content or content == _PRUNED_TOOL_PLACEHOLDER:
-                continue
-            # Only prune if the content is substantial (>200 chars)
-            if len(content) > 200:
-                result[i] = {**msg, "content": _PRUNED_TOOL_PLACEHOLDER}
-                pruned += 1
-
-        return result, pruned
-
-    # ------------------------------------------------------------------
-    # Summarization
-    # ------------------------------------------------------------------
-
-    def _compute_summary_budget(self, turns_to_summarize: List[Dict[str, Any]]) -> int:
-        """Scale summary token budget with the amount of content being compressed.
-
-        The maximum scales with the model's context window (5% of context,
-        capped at ``_SUMMARY_TOKENS_CEILING``) so large-context models get
-        richer summaries instead of being hard-capped at 8K tokens.
-        """
-        content_tokens = estimate_messages_tokens_rough(turns_to_summarize)
-        budget = int(content_tokens * _SUMMARY_RATIO)
-        return max(_MIN_SUMMARY_TOKENS, min(budget, self.max_summary_tokens))
-
-    def _serialize_for_summary(self, turns: List[Dict[str, Any]]) -> str:
-        """Serialize conversation turns into labeled text for the summarizer.
-
-        Includes tool call arguments and result content (up to 3000 chars
-        per message) so the summarizer can preserve specific details like
-        file paths, commands, and outputs.
-        """
-        parts = []
-        for msg in turns:
-            role = msg.get("role", "unknown")
-            content = msg.get("content") or ""
-
-            # Tool results: keep more content than before (3000 chars)
-            if role == "tool":
-                tool_id = msg.get("tool_call_id", "")
-                if len(content) > 3000:
-                    content = content[:2000] + "\n...[truncated]...\n" + content[-800:]
-                parts.append(f"[TOOL RESULT {tool_id}]: {content}")
-                continue
-
-            # Assistant messages: include tool call names AND arguments
-            if role == "assistant":
-                if len(content) > 3000:
-                    content = content[:2000] + "\n...[truncated]...\n" + content[-800:]
-                tool_calls = msg.get("tool_calls", [])
-                if tool_calls:
-                    tc_parts = []
-                    for tc in tool_calls:
-                        if isinstance(tc, dict):
-                            fn = tc.get("function", {})
-                            name = fn.get("name", "?")
-                            args = fn.get("arguments", "")
-                            # Truncate long arguments but keep enough for context
-                            if len(args) > 500:
-                                args = args[:400] + "..."
-                            tc_parts.append(f"  {name}({args})")
-                        else:
-                            fn = getattr(tc, "function", None)
-                            name = getattr(fn, "name", "?") if fn else "?"
-                            tc_parts.append(f"  {name}(...)")
-                    content += "\n[Tool calls:\n" + "\n".join(tc_parts) + "\n]"
-                parts.append(f"[ASSISTANT]: {content}")
-                continue
-
-            # User and other roles
-            if len(content) > 3000:
-                content = content[:2000] + "\n...[truncated]...\n" + content[-800:]
-            parts.append(f"[{role.upper()}]: {content}")
-
-        return "\n\n".join(parts)
-
     def _generate_summary(self, turns_to_summarize: List[Dict[str, Any]]) -> Optional[str]:
-        """Generate a structured summary of conversation turns.
+        """Generate a concise summary of conversation turns.
 
-        Uses a structured template (Goal, Progress, Decisions, Files, Next Steps)
-        inspired by Pi-mono and OpenCode. When a previous summary exists,
-        generates an iterative update instead of summarizing from scratch.
-
-        Returns None if all attempts fail — the caller should drop
+        Tries the auxiliary model first, then falls back to the user's main
+        model.  Returns None if all attempts fail — the caller should drop
         the middle turns without a summary rather than inject a useless
         placeholder.
         """
-        summary_budget = self._compute_summary_budget(turns_to_summarize)
-        content_to_summarize = self._serialize_for_summary(turns_to_summarize)
+        parts = []
+        for msg in turns_to_summarize:
+            role = msg.get("role", "unknown")
+            content = msg.get("content") or ""
+            if len(content) > 2000:
+                content = content[:1000] + "\n...[truncated]...\n" + content[-500:]
+            tool_calls = msg.get("tool_calls", [])
+            if tool_calls:
+                tool_names = [tc.get("function", {}).get("name", "?") for tc in tool_calls if isinstance(tc, dict)]
+                content += f"\n[Tool calls: {', '.join(tool_names)}]"
+            parts.append(f"[{role.upper()}]: {content}")
 
-        if self._previous_summary:
-            # Iterative update: preserve existing info, add new progress
-            prompt = f"""You are updating a context compaction summary. A previous compaction produced the summary below. New conversation turns have occurred since then and need to be incorporated.
+        content_to_summarize = "\n\n".join(parts)
+        prompt = f"""Create a concise handoff summary for a later assistant that will continue this conversation after earlier turns are compacted.
 
-PREVIOUS SUMMARY:
-{self._previous_summary}
+Describe:
+1. What actions were taken (tool calls, searches, file operations)
+2. Key information or results obtained
+3. Important decisions, constraints, or user preferences
+4. Relevant data, file names, outputs, or next steps needed to continue
 
-NEW TURNS TO INCORPORATE:
-{content_to_summarize}
-
-Update the summary using this exact structure. PRESERVE all existing information that is still relevant. ADD new progress. Move items from "In Progress" to "Done" when completed. Remove information only if it is clearly obsolete.
-
-## Goal
-[What the user is trying to accomplish — preserve from previous summary, update if goal evolved]
-
-## Constraints & Preferences
-[User preferences, coding style, constraints, important decisions — accumulate across compactions]
-
-## Progress
-### Done
-[Completed work — include specific file paths, commands run, results obtained]
-### In Progress
-[Work currently underway]
-### Blocked
-[Any blockers or issues encountered]
-
-## Key Decisions
-[Important technical decisions and why they were made]
-
-## Relevant Files
-[Files read, modified, or created — with brief note on each. Accumulate across compactions.]
-
-## Next Steps
-[What needs to happen next to continue the work]
-
-## Critical Context
-[Any specific values, error messages, configuration details, or data that would be lost without explicit preservation]
-
-Target ~{summary_budget} tokens. Be specific — include file paths, command outputs, error messages, and concrete values rather than vague descriptions.
-
-Write only the summary body. Do not include any preamble or prefix."""
-        else:
-            # First compaction: summarize from scratch
-            prompt = f"""Create a structured handoff summary for a later assistant that will continue this conversation after earlier turns are compacted.
+Keep it factual, concise, and focused on helping the next assistant resume without repeating work. Target ~{self.summary_target_tokens} tokens.
 
+---
 TURNS TO SUMMARIZE:
 {content_to_summarize}
+---
 
-Use this exact structure:
-
-## Goal
-[What the user is trying to accomplish]
-
-## Constraints & Preferences
-[User preferences, coding style, constraints, important decisions]
-
-## Progress
-### Done
-[Completed work — include specific file paths, commands run, results obtained]
-### In Progress
-[Work currently underway]
-### Blocked
-[Any blockers or issues encountered]
-
-## Key Decisions
-[Important technical decisions and why they were made]
-
-## Relevant Files
-[Files read, modified, or created — with brief note on each]
-
-## Next Steps
-[What needs to happen next to continue the work]
-
-## Critical Context
-[Any specific values, error messages, configuration details, or data that would be lost without explicit preservation]
-
-Target ~{summary_budget} tokens. Be specific — include file paths, command outputs, error messages, and concrete values rather than vague descriptions. The goal is to prevent the next assistant from repeating work or losing important details.
-
-Write only the summary body. Do not include any preamble or prefix."""
+Write only the summary body. Do not include any preamble or prefix; the system will add the handoff wrapper."""
 
+        # Use the centralized LLM router — handles provider resolution,
+        # auth, and fallback internally.
         try:
             call_kwargs = {
                 "task": "compression",
                 "messages": [{"role": "user", "content": prompt}],
                 "temperature": 0.3,
-                "max_tokens": summary_budget * 2,
-                "timeout": 45.0,
+                "max_tokens": self.summary_target_tokens * 2,
+                "timeout": 30.0,
             }
             if self.summary_model:
                 call_kwargs["model"] = self.summary_model
@@ -358,8 +149,6 @@ Write only the summary body. Do not include any preamble or prefix."""
             if not isinstance(content, str):
                 content = str(content) if content else ""
             summary = content.strip()
-            # Store for iterative updates on next compaction
-            self._previous_summary = summary
             return self._with_summary_prefix(summary)
         except RuntimeError:
             logging.warning("Context compression: no provider available for "
@@ -464,95 +253,24 @@ Write only the summary body. Do not include any preamble or prefix."""
         """Pull a compress-end boundary backward to avoid splitting a
         tool_call / result group.
 
-        If the boundary falls in the middle of a tool-result group (i.e.
-        there are consecutive tool messages before ``idx``), walk backward
-        past all of them to find the parent assistant message.  If found,
-        move the boundary before the assistant so the entire
-        assistant + tool_results group is included in the summarised region
-        rather than being split (which causes silent data loss when
-        ``_sanitize_tool_pairs`` removes the orphaned tail results).
+        If the message just before ``idx`` is an assistant message with
+        tool_calls, those tool results will start at ``idx`` and would be
+        separated from their parent.  Move backwards to include the whole
+        group in the summarised region.
         """
         if idx <= 0 or idx >= len(messages):
             return idx
-        # Walk backward past consecutive tool results
-        check = idx - 1
-        while check >= 0 and messages[check].get("role") == "tool":
-            check -= 1
-        # If we landed on the parent assistant with tool_calls, pull the
-        # boundary before it so the whole group gets summarised together.
-        if check >= 0 and messages[check].get("role") == "assistant" and messages[check].get("tool_calls"):
-            idx = check
+        prev = messages[idx - 1]
+        if prev.get("role") == "assistant" and prev.get("tool_calls"):
+            # The results for this assistant turn sit at idx..idx+k.
+            # Include the assistant message in the summarised region too.
+            idx -= 1
         return idx
 
-    # ------------------------------------------------------------------
-    # Tail protection by token budget
-    # ------------------------------------------------------------------
-
-    def _find_tail_cut_by_tokens(
-        self, messages: List[Dict[str, Any]], head_end: int,
-        token_budget: int | None = None,
-    ) -> int:
-        """Walk backward from the end of messages, accumulating tokens until
-        the budget is reached. Returns the index where the tail starts.
-
-        ``token_budget`` defaults to ``self.tail_token_budget`` which is
-        derived from ``summary_target_ratio * context_length``, so it
-        scales automatically with the model's context window.
-
-        Never cuts inside a tool_call/result group. Falls back to the old
-        ``protect_last_n`` if the budget would protect fewer messages.
-        """
-        if token_budget is None:
-            token_budget = self.tail_token_budget
-        n = len(messages)
-        min_tail = self.protect_last_n
-        accumulated = 0
-        cut_idx = n  # start from beyond the end
-
-        for i in range(n - 1, head_end - 1, -1):
-            msg = messages[i]
-            content = msg.get("content") or ""
-            msg_tokens = len(content) // _CHARS_PER_TOKEN + 10  # +10 for role/metadata
-            # Include tool call arguments in estimate
-            for tc in msg.get("tool_calls") or []:
-                if isinstance(tc, dict):
-                    args = tc.get("function", {}).get("arguments", "")
-                    msg_tokens += len(args) // _CHARS_PER_TOKEN
-            if accumulated + msg_tokens > token_budget and (n - i) >= min_tail:
-                break
-            accumulated += msg_tokens
-            cut_idx = i
-
-        # Ensure we protect at least protect_last_n messages
-        fallback_cut = n - min_tail
-        if cut_idx > fallback_cut:
-            cut_idx = fallback_cut
-
-        # If the token budget would protect everything (small conversations),
-        # fall back to the fixed protect_last_n approach so compression can
-        # still remove middle turns.
-        if cut_idx <= head_end:
-            cut_idx = fallback_cut
-
-        # Align to avoid splitting tool groups
-        cut_idx = self._align_boundary_backward(messages, cut_idx)
-
-        return max(cut_idx, head_end + 1)
-
-    # ------------------------------------------------------------------
-    # Main compression entry point
-    # ------------------------------------------------------------------
-
     def compress(self, messages: List[Dict[str, Any]], current_tokens: int = None) -> List[Dict[str, Any]]:
         """Compress conversation messages by summarizing middle turns.
 
-        Algorithm:
-          1. Prune old tool results (cheap pre-pass, no LLM call)
-          2. Protect head messages (system prompt + first exchange)
-          3. Find tail boundary by token budget (~20K tokens of recent context)
-          4. Summarize middle turns with structured LLM prompt
-          5. On re-compression, iteratively update the previous summary
-
+        Keeps first N + last N turns, summarizes everything in between.
         After compression, orphaned tool_call / tool_result pairs are cleaned
         up so the API never receives mismatched IDs.
         """
@@ -566,26 +284,19 @@ Write only the summary body. Do not include any preamble or prefix."""
                 )
             return messages
 
-        display_tokens = current_tokens if current_tokens else self.last_prompt_tokens or estimate_messages_tokens_rough(messages)
-
-        # Phase 1: Prune old tool results (cheap, no LLM call)
-        messages, pruned_count = self._prune_old_tool_results(
-            messages, protect_tail_count=self.protect_last_n * 3,
-        )
-        if pruned_count and not self.quiet_mode:
-            logger.info("Pre-compression: pruned %d old tool result(s)", pruned_count)
-
-        # Phase 2: Determine boundaries
         compress_start = self.protect_first_n
+        compress_end = n_messages - self.protect_last_n
+        if compress_start >= compress_end:
+            return messages
+
+        # Adjust boundaries to avoid splitting tool_call/result groups.
         compress_start = self._align_boundary_forward(messages, compress_start)
-
-        # Use token-budget tail protection instead of fixed message count
-        compress_end = self._find_tail_cut_by_tokens(messages, compress_start)
-
+        compress_end = self._align_boundary_backward(messages, compress_end)
         if compress_start >= compress_end:
             return messages
 
         turns_to_summarize = messages[compress_start:compress_end]
+        display_tokens = current_tokens if current_tokens else self.last_prompt_tokens or estimate_messages_tokens_rough(messages)
 
         if not self.quiet_mode:
             logger.info(
@@ -599,20 +310,15 @@ Write only the summary body. Do not include any preamble or prefix."""
                 self.threshold_percent * 100,
                 self.threshold_tokens,
             )
-            tail_msgs = n_messages - compress_end
             logger.info(
-                "Summarizing turns %d-%d (%d turns), protecting %d head + %d tail messages",
+                "Summarizing turns %d-%d (%d turns)",
                 compress_start + 1,
                 compress_end,
                 len(turns_to_summarize),
-                compress_start,
-                tail_msgs,
             )
 
-        # Phase 3: Generate structured summary
         summary = self._generate_summary(turns_to_summarize)
 
-        # Phase 4: Assemble compressed message list
         compressed = []
         for i in range(compress_start):
             msg = messages[i].copy()

agent/context_references.py

@@ -1,485 +0,0 @@
-from __future__ import annotations
-
-import asyncio
-import inspect
-import json
-import mimetypes
-import os
-import re
-import subprocess
-from dataclasses import dataclass, field
-from pathlib import Path
-from typing import Awaitable, Callable
-
-from agent.model_metadata import estimate_tokens_rough
-
-REFERENCE_PATTERN = re.compile(
-    r"(?<![\w/])@(?:(?P<simple>diff|staged)\b|(?P<kind>file|folder|git|url):(?P<value>\S+))"
-)
-TRAILING_PUNCTUATION = ",.;!?"
-_SENSITIVE_HOME_DIRS = (".ssh", ".aws", ".gnupg", ".kube")
-_SENSITIVE_HERMES_DIRS = (Path("skills") / ".hub",)
-_SENSITIVE_HOME_FILES = (
-    Path(".ssh") / "authorized_keys",
-    Path(".ssh") / "id_rsa",
-    Path(".ssh") / "id_ed25519",
-    Path(".ssh") / "config",
-    Path(".bashrc"),
-    Path(".zshrc"),
-    Path(".profile"),
-    Path(".bash_profile"),
-    Path(".zprofile"),
-    Path(".netrc"),
-    Path(".pgpass"),
-    Path(".npmrc"),
-    Path(".pypirc"),
-)
-
-
-@dataclass(frozen=True)
-class ContextReference:
-    raw: str
-    kind: str
-    target: str
-    start: int
-    end: int
-    line_start: int | None = None
-    line_end: int | None = None
-
-
-@dataclass
-class ContextReferenceResult:
-    message: str
-    original_message: str
-    references: list[ContextReference] = field(default_factory=list)
-    warnings: list[str] = field(default_factory=list)
-    injected_tokens: int = 0
-    expanded: bool = False
-    blocked: bool = False
-
-
-def parse_context_references(message: str) -> list[ContextReference]:
-    refs: list[ContextReference] = []
-    if not message:
-        return refs
-
-    for match in REFERENCE_PATTERN.finditer(message):
-        simple = match.group("simple")
-        if simple:
-            refs.append(
-                ContextReference(
-                    raw=match.group(0),
-                    kind=simple,
-                    target="",
-                    start=match.start(),
-                    end=match.end(),
-                )
-            )
-            continue
-
-        kind = match.group("kind")
-        value = _strip_trailing_punctuation(match.group("value") or "")
-        line_start = None
-        line_end = None
-        target = value
-
-        if kind == "file":
-            range_match = re.match(r"^(?P<path>.+?):(?P<start>\d+)(?:-(?P<end>\d+))?$", value)
-            if range_match:
-                target = range_match.group("path")
-                line_start = int(range_match.group("start"))
-                line_end = int(range_match.group("end") or range_match.group("start"))
-
-        refs.append(
-            ContextReference(
-                raw=match.group(0),
-                kind=kind,
-                target=target,
-                start=match.start(),
-                end=match.end(),
-                line_start=line_start,
-                line_end=line_end,
-            )
-        )
-
-    return refs
-
-
-def preprocess_context_references(
-    message: str,
-    *,
-    cwd: str | Path,
-    context_length: int,
-    url_fetcher: Callable[[str], str | Awaitable[str]] | None = None,
-    allowed_root: str | Path | None = None,
-) -> ContextReferenceResult:
-    coro = preprocess_context_references_async(
-        message,
-        cwd=cwd,
-        context_length=context_length,
-        url_fetcher=url_fetcher,
-        allowed_root=allowed_root,
-    )
-    # Safe for both CLI (no loop) and gateway (loop already running).
-    try:
-        loop = asyncio.get_running_loop()
-    except RuntimeError:
-        loop = None
-    if loop and loop.is_running():
-        import concurrent.futures
-        with concurrent.futures.ThreadPoolExecutor(max_workers=1) as pool:
-            return pool.submit(asyncio.run, coro).result()
-    return asyncio.run(coro)
-
-
-async def preprocess_context_references_async(
-    message: str,
-    *,
-    cwd: str | Path,
-    context_length: int,
-    url_fetcher: Callable[[str], str | Awaitable[str]] | None = None,
-    allowed_root: str | Path | None = None,
-) -> ContextReferenceResult:
-    refs = parse_context_references(message)
-    if not refs:
-        return ContextReferenceResult(message=message, original_message=message)
-
-    cwd_path = Path(cwd).expanduser().resolve()
-    # Default to the current working directory so @ references cannot escape
-    # the active workspace unless a caller explicitly widens the root.
-    allowed_root_path = (
-        Path(allowed_root).expanduser().resolve() if allowed_root is not None else cwd_path
-    )
-    warnings: list[str] = []
-    blocks: list[str] = []
-    injected_tokens = 0
-
-    for ref in refs:
-        warning, block = await _expand_reference(
-            ref,
-            cwd_path,
-            url_fetcher=url_fetcher,
-            allowed_root=allowed_root_path,
-        )
-        if warning:
-            warnings.append(warning)
-        if block:
-            blocks.append(block)
-            injected_tokens += estimate_tokens_rough(block)
-
-    hard_limit = max(1, int(context_length * 0.50))
-    soft_limit = max(1, int(context_length * 0.25))
-    if injected_tokens > hard_limit:
-        warnings.append(
-            f"@ context injection refused: {injected_tokens} tokens exceeds the 50% hard limit ({hard_limit})."
-        )
-        return ContextReferenceResult(
-            message=message,
-            original_message=message,
-            references=refs,
-            warnings=warnings,
-            injected_tokens=injected_tokens,
-            expanded=False,
-            blocked=True,
-        )
-
-    if injected_tokens > soft_limit:
-        warnings.append(
-            f"@ context injection warning: {injected_tokens} tokens exceeds the 25% soft limit ({soft_limit})."
-        )
-
-    stripped = _remove_reference_tokens(message, refs)
-    final = stripped
-    if warnings:
-        final = f"{final}\n\n--- Context Warnings ---\n" + "\n".join(f"- {warning}" for warning in warnings)
-    if blocks:
-        final = f"{final}\n\n--- Attached Context ---\n\n" + "\n\n".join(blocks)
-
-    return ContextReferenceResult(
-        message=final.strip(),
-        original_message=message,
-        references=refs,
-        warnings=warnings,
-        injected_tokens=injected_tokens,
-        expanded=bool(blocks or warnings),
-        blocked=False,
-    )
-
-
-async def _expand_reference(
-    ref: ContextReference,
-    cwd: Path,
-    *,
-    url_fetcher: Callable[[str], str | Awaitable[str]] | None = None,
-    allowed_root: Path | None = None,
-) -> tuple[str | None, str | None]:
-    try:
-        if ref.kind == "file":
-            return _expand_file_reference(ref, cwd, allowed_root=allowed_root)
-        if ref.kind == "folder":
-            return _expand_folder_reference(ref, cwd, allowed_root=allowed_root)
-        if ref.kind == "diff":
-            return _expand_git_reference(ref, cwd, ["diff"], "git diff")
-        if ref.kind == "staged":
-            return _expand_git_reference(ref, cwd, ["diff", "--staged"], "git diff --staged")
-        if ref.kind == "git":
-            count = max(1, min(int(ref.target or "1"), 10))
-            return _expand_git_reference(ref, cwd, ["log", f"-{count}", "-p"], f"git log -{count} -p")
-        if ref.kind == "url":
-            content = await _fetch_url_content(ref.target, url_fetcher=url_fetcher)
-            if not content:
-                return f"{ref.raw}: no content extracted", None
-            return None, f"🌐 {ref.raw} ({estimate_tokens_rough(content)} tokens)\n{content}"
-    except Exception as exc:
-        return f"{ref.raw}: {exc}", None
-
-    return f"{ref.raw}: unsupported reference type", None
-
-
-def _expand_file_reference(
-    ref: ContextReference,
-    cwd: Path,
-    *,
-    allowed_root: Path | None = None,
-) -> tuple[str | None, str | None]:
-    path = _resolve_path(cwd, ref.target, allowed_root=allowed_root)
-    _ensure_reference_path_allowed(path)
-    if not path.exists():
-        return f"{ref.raw}: file not found", None
-    if not path.is_file():
-        return f"{ref.raw}: path is not a file", None
-    if _is_binary_file(path):
-        return f"{ref.raw}: binary files are not supported", None
-
-    text = path.read_text(encoding="utf-8")
-    if ref.line_start is not None:
-        lines = text.splitlines()
-        start_idx = max(ref.line_start - 1, 0)
-        end_idx = min(ref.line_end or ref.line_start, len(lines))
-        text = "\n".join(lines[start_idx:end_idx])
-
-    lang = _code_fence_language(path)
-    label = ref.raw
-    return None, f"📄 {label} ({estimate_tokens_rough(text)} tokens)\n```{lang}\n{text}\n```"
-
-
-def _expand_folder_reference(
-    ref: ContextReference,
-    cwd: Path,
-    *,
-    allowed_root: Path | None = None,
-) -> tuple[str | None, str | None]:
-    path = _resolve_path(cwd, ref.target, allowed_root=allowed_root)
-    _ensure_reference_path_allowed(path)
-    if not path.exists():
-        return f"{ref.raw}: folder not found", None
-    if not path.is_dir():
-        return f"{ref.raw}: path is not a folder", None
-
-    listing = _build_folder_listing(path, cwd)
-    return None, f"📁 {ref.raw} ({estimate_tokens_rough(listing)} tokens)\n{listing}"
-
-
-def _expand_git_reference(
-    ref: ContextReference,
-    cwd: Path,
-    args: list[str],
-    label: str,
-) -> tuple[str | None, str | None]:
-    result = subprocess.run(
-        ["git", *args],
-        cwd=cwd,
-        capture_output=True,
-        text=True,
-    )
-    if result.returncode != 0:
-        stderr = (result.stderr or "").strip() or "git command failed"
-        return f"{ref.raw}: {stderr}", None
-    content = result.stdout.strip()
-    if not content:
-        content = "(no output)"
-    return None, f"🧾 {label} ({estimate_tokens_rough(content)} tokens)\n```diff\n{content}\n```"
-
-
-async def _fetch_url_content(
-    url: str,
-    *,
-    url_fetcher: Callable[[str], str | Awaitable[str]] | None = None,
-) -> str:
-    fetcher = url_fetcher or _default_url_fetcher
-    content = fetcher(url)
-    if inspect.isawaitable(content):
-        content = await content
-    return str(content or "").strip()
-
-
-async def _default_url_fetcher(url: str) -> str:
-    from tools.web_tools import web_extract_tool
-
-    raw = await web_extract_tool([url], format="markdown", use_llm_processing=True)
-    payload = json.loads(raw)
-    docs = payload.get("data", {}).get("documents", [])
-    if not docs:
-        return ""
-    doc = docs[0]
-    return str(doc.get("content") or doc.get("raw_content") or "").strip()
-
-
-def _resolve_path(cwd: Path, target: str, *, allowed_root: Path | None = None) -> Path:
-    path = Path(os.path.expanduser(target))
-    if not path.is_absolute():
-        path = cwd / path
-    resolved = path.resolve()
-    if allowed_root is not None:
-        try:
-            resolved.relative_to(allowed_root)
-        except ValueError as exc:
-            raise ValueError("path is outside the allowed workspace") from exc
-    return resolved
-
-
-def _ensure_reference_path_allowed(path: Path) -> None:
-    home = Path(os.path.expanduser("~")).resolve()
-    hermes_home = Path(
-        os.getenv("HERMES_HOME", str(home / ".hermes"))
-    ).expanduser().resolve()
-
-    blocked_exact = {home / rel for rel in _SENSITIVE_HOME_FILES}
-    blocked_exact.add(hermes_home / ".env")
-    blocked_dirs = [home / rel for rel in _SENSITIVE_HOME_DIRS]
-    blocked_dirs.extend(hermes_home / rel for rel in _SENSITIVE_HERMES_DIRS)
-
-    if path in blocked_exact:
-        raise ValueError("path is a sensitive credential file and cannot be attached")
-
-    for blocked_dir in blocked_dirs:
-        try:
-            path.relative_to(blocked_dir)
-        except ValueError:
-            continue
-        raise ValueError("path is a sensitive credential or internal Hermes path and cannot be attached")
-
-
-def _strip_trailing_punctuation(value: str) -> str:
-    stripped = value.rstrip(TRAILING_PUNCTUATION)
-    while stripped.endswith((")", "]", "}")):
-        closer = stripped[-1]
-        opener = {")": "(", "]": "[", "}": "{"}[closer]
-        if stripped.count(closer) > stripped.count(opener):
-            stripped = stripped[:-1]
-            continue
-        break
-    return stripped
-
-
-def _remove_reference_tokens(message: str, refs: list[ContextReference]) -> str:
-    pieces: list[str] = []
-    cursor = 0
-    for ref in refs:
-        pieces.append(message[cursor:ref.start])
-        cursor = ref.end
-    pieces.append(message[cursor:])
-    text = "".join(pieces)
-    text = re.sub(r"\s{2,}", " ", text)
-    text = re.sub(r"\s+([,.;:!?])", r"\1", text)
-    return text.strip()
-
-
-def _is_binary_file(path: Path) -> bool:
-    mime, _ = mimetypes.guess_type(path.name)
-    if mime and not mime.startswith("text/") and not any(
-        path.name.endswith(ext) for ext in (".py", ".md", ".txt", ".json", ".yaml", ".yml", ".toml", ".js", ".ts")
-    ):
-        return True
-    chunk = path.read_bytes()[:4096]
-    return b"\x00" in chunk
-
-
-def _build_folder_listing(path: Path, cwd: Path, limit: int = 200) -> str:
-    lines = [f"{path.relative_to(cwd)}/"]
-    entries = _iter_visible_entries(path, cwd, limit=limit)
-    for entry in entries:
-        rel = entry.relative_to(cwd)
-        indent = "  " * max(len(rel.parts) - len(path.relative_to(cwd).parts) - 1, 0)
-        if entry.is_dir():
-            lines.append(f"{indent}- {entry.name}/")
-        else:
-            meta = _file_metadata(entry)
-            lines.append(f"{indent}- {entry.name} ({meta})")
-    if len(entries) >= limit:
-        lines.append("- ...")
-    return "\n".join(lines)
-
-
-def _iter_visible_entries(path: Path, cwd: Path, limit: int) -> list[Path]:
-    rg_entries = _rg_files(path, cwd, limit=limit)
-    if rg_entries is not None:
-        output: list[Path] = []
-        seen_dirs: set[Path] = set()
-        for rel in rg_entries:
-            full = cwd / rel
-            for parent in full.parents:
-                if parent == cwd or parent in seen_dirs or path not in {parent, *parent.parents}:
-                    continue
-                seen_dirs.add(parent)
-                output.append(parent)
-            output.append(full)
-        return sorted({p for p in output if p.exists()}, key=lambda p: (not p.is_dir(), str(p)))
-
-    output = []
-    for root, dirs, files in os.walk(path):
-        dirs[:] = sorted(d for d in dirs if not d.startswith(".") and d != "__pycache__")
-        files = sorted(f for f in files if not f.startswith("."))
-        root_path = Path(root)
-        for d in dirs:
-            output.append(root_path / d)
-            if len(output) >= limit:
-                return output
-        for f in files:
-            output.append(root_path / f)
-            if len(output) >= limit:
-                return output
-    return output
-
-
-def _rg_files(path: Path, cwd: Path, limit: int) -> list[Path] | None:
-    try:
-        result = subprocess.run(
-            ["rg", "--files", str(path.relative_to(cwd))],
-            cwd=cwd,
-            capture_output=True,
-            text=True,
-        )
-    except FileNotFoundError:
-        return None
-    if result.returncode != 0:
-        return None
-    files = [Path(line.strip()) for line in result.stdout.splitlines() if line.strip()]
-    return files[:limit]
-
-
-def _file_metadata(path: Path) -> str:
-    if _is_binary_file(path):
-        return f"{path.stat().st_size} bytes"
-    try:
-        line_count = path.read_text(encoding="utf-8").count("\n") + 1
-    except Exception:
-        return f"{path.stat().st_size} bytes"
-    return f"{line_count} lines"
-
-
-def _code_fence_language(path: Path) -> str:
-    mapping = {
-        ".py": "python",
-        ".js": "javascript",
-        ".ts": "typescript",
-        ".tsx": "tsx",
-        ".jsx": "jsx",
-        ".json": "json",
-        ".md": "markdown",
-        ".sh": "bash",
-        ".yml": "yaml",
-        ".yaml": "yaml",
-        ".toml": "toml",
-    }
-    return mapping.get(path.suffix.lower(), "")

agent/copilot_acp_client.py

@@ -1,447 +0,0 @@
-"""OpenAI-compatible shim that forwards Hermes requests to `copilot --acp`.
-
-This adapter lets Hermes treat the GitHub Copilot ACP server as a chat-style
-backend. Each request starts a short-lived ACP session, sends the formatted
-conversation as a single prompt, collects text chunks, and converts the result
-back into the minimal shape Hermes expects from an OpenAI client.
-"""
-
-from __future__ import annotations
-
-import json
-import os
-import queue
-import shlex
-import subprocess
-import threading
-import time
-from collections import deque
-from pathlib import Path
-from types import SimpleNamespace
-from typing import Any
-
-ACP_MARKER_BASE_URL = "acp://copilot"
-_DEFAULT_TIMEOUT_SECONDS = 900.0
-
-
-def _resolve_command() -> str:
-    return (
-        os.getenv("HERMES_COPILOT_ACP_COMMAND", "").strip()
-        or os.getenv("COPILOT_CLI_PATH", "").strip()
-        or "copilot"
-    )
-
-
-def _resolve_args() -> list[str]:
-    raw = os.getenv("HERMES_COPILOT_ACP_ARGS", "").strip()
-    if not raw:
-        return ["--acp", "--stdio"]
-    return shlex.split(raw)
-
-
-def _jsonrpc_error(message_id: Any, code: int, message: str) -> dict[str, Any]:
-    return {
-        "jsonrpc": "2.0",
-        "id": message_id,
-        "error": {
-            "code": code,
-            "message": message,
-        },
-    }
-
-
-def _format_messages_as_prompt(messages: list[dict[str, Any]], model: str | None = None) -> str:
-    sections: list[str] = [
-        "You are being used as the active ACP agent backend for Hermes.",
-        "Use your own ACP capabilities and respond directly in natural language.",
-        "Do not emit OpenAI tool-call JSON.",
-    ]
-    if model:
-        sections.append(f"Hermes requested model hint: {model}")
-
-    transcript: list[str] = []
-    for message in messages:
-        if not isinstance(message, dict):
-            continue
-        role = str(message.get("role") or "unknown").strip().lower()
-        if role == "tool":
-            role = "tool"
-        elif role not in {"system", "user", "assistant"}:
-            role = "context"
-
-        content = message.get("content")
-        rendered = _render_message_content(content)
-        if not rendered:
-            continue
-
-        label = {
-            "system": "System",
-            "user": "User",
-            "assistant": "Assistant",
-            "tool": "Tool",
-            "context": "Context",
-        }.get(role, role.title())
-        transcript.append(f"{label}:\n{rendered}")
-
-    if transcript:
-        sections.append("Conversation transcript:\n\n" + "\n\n".join(transcript))
-
-    sections.append("Continue the conversation from the latest user request.")
-    return "\n\n".join(section.strip() for section in sections if section and section.strip())
-
-
-def _render_message_content(content: Any) -> str:
-    if content is None:
-        return ""
-    if isinstance(content, str):
-        return content.strip()
-    if isinstance(content, dict):
-        if "text" in content:
-            return str(content.get("text") or "").strip()
-        if "content" in content and isinstance(content.get("content"), str):
-            return str(content.get("content") or "").strip()
-        return json.dumps(content, ensure_ascii=True)
-    if isinstance(content, list):
-        parts: list[str] = []
-        for item in content:
-            if isinstance(item, str):
-                parts.append(item)
-            elif isinstance(item, dict):
-                text = item.get("text")
-                if isinstance(text, str) and text.strip():
-                    parts.append(text.strip())
-        return "\n".join(parts).strip()
-    return str(content).strip()
-
-
-def _ensure_path_within_cwd(path_text: str, cwd: str) -> Path:
-    candidate = Path(path_text)
-    if not candidate.is_absolute():
-        raise PermissionError("ACP file-system paths must be absolute.")
-    resolved = candidate.resolve()
-    root = Path(cwd).resolve()
-    try:
-        resolved.relative_to(root)
-    except ValueError as exc:
-        raise PermissionError(f"Path '{resolved}' is outside the session cwd '{root}'.") from exc
-    return resolved
-
-
-class _ACPChatCompletions:
-    def __init__(self, client: "CopilotACPClient"):
-        self._client = client
-
-    def create(self, **kwargs: Any) -> Any:
-        return self._client._create_chat_completion(**kwargs)
-
-
-class _ACPChatNamespace:
-    def __init__(self, client: "CopilotACPClient"):
-        self.completions = _ACPChatCompletions(client)
-
-
-class CopilotACPClient:
-    """Minimal OpenAI-client-compatible facade for Copilot ACP."""
-
-    def __init__(
-        self,
-        *,
-        api_key: str | None = None,
-        base_url: str | None = None,
-        default_headers: dict[str, str] | None = None,
-        acp_command: str | None = None,
-        acp_args: list[str] | None = None,
-        acp_cwd: str | None = None,
-        command: str | None = None,
-        args: list[str] | None = None,
-        **_: Any,
-    ):
-        self.api_key = api_key or "copilot-acp"
-        self.base_url = base_url or ACP_MARKER_BASE_URL
-        self._default_headers = dict(default_headers or {})
-        self._acp_command = acp_command or command or _resolve_command()
-        self._acp_args = list(acp_args or args or _resolve_args())
-        self._acp_cwd = str(Path(acp_cwd or os.getcwd()).resolve())
-        self.chat = _ACPChatNamespace(self)
-        self.is_closed = False
-        self._active_process: subprocess.Popen[str] | None = None
-        self._active_process_lock = threading.Lock()
-
-    def close(self) -> None:
-        proc: subprocess.Popen[str] | None
-        with self._active_process_lock:
-            proc = self._active_process
-            self._active_process = None
-        self.is_closed = True
-        if proc is None:
-            return
-        try:
-            proc.terminate()
-            proc.wait(timeout=2)
-        except Exception:
-            try:
-                proc.kill()
-            except Exception:
-                pass
-
-    def _create_chat_completion(
-        self,
-        *,
-        model: str | None = None,
-        messages: list[dict[str, Any]] | None = None,
-        timeout: float | None = None,
-        **_: Any,
-    ) -> Any:
-        prompt_text = _format_messages_as_prompt(messages or [], model=model)
-        response_text, reasoning_text = self._run_prompt(
-            prompt_text,
-            timeout_seconds=float(timeout or _DEFAULT_TIMEOUT_SECONDS),
-        )
-
-        usage = SimpleNamespace(
-            prompt_tokens=0,
-            completion_tokens=0,
-            total_tokens=0,
-            prompt_tokens_details=SimpleNamespace(cached_tokens=0),
-        )
-        assistant_message = SimpleNamespace(
-            content=response_text,
-            tool_calls=[],
-            reasoning=reasoning_text or None,
-            reasoning_content=reasoning_text or None,
-            reasoning_details=None,
-        )
-        choice = SimpleNamespace(message=assistant_message, finish_reason="stop")
-        return SimpleNamespace(
-            choices=[choice],
-            usage=usage,
-            model=model or "copilot-acp",
-        )
-
-    def _run_prompt(self, prompt_text: str, *, timeout_seconds: float) -> tuple[str, str]:
-        try:
-            proc = subprocess.Popen(
-                [self._acp_command] + self._acp_args,
-                stdin=subprocess.PIPE,
-                stdout=subprocess.PIPE,
-                stderr=subprocess.PIPE,
-                text=True,
-                bufsize=1,
-                cwd=self._acp_cwd,
-            )
-        except FileNotFoundError as exc:
-            raise RuntimeError(
-                f"Could not start Copilot ACP command '{self._acp_command}'. "
-                "Install GitHub Copilot CLI or set HERMES_COPILOT_ACP_COMMAND/COPILOT_CLI_PATH."
-            ) from exc
-
-        if proc.stdin is None or proc.stdout is None:
-            proc.kill()
-            raise RuntimeError("Copilot ACP process did not expose stdin/stdout pipes.")
-
-        self.is_closed = False
-        with self._active_process_lock:
-            self._active_process = proc
-
-        inbox: queue.Queue[dict[str, Any]] = queue.Queue()
-        stderr_tail: deque[str] = deque(maxlen=40)
-
-        def _stdout_reader() -> None:
-            for line in proc.stdout:
-                try:
-                    inbox.put(json.loads(line))
-                except Exception:
-                    inbox.put({"raw": line.rstrip("\n")})
-
-        def _stderr_reader() -> None:
-            if proc.stderr is None:
-                return
-            for line in proc.stderr:
-                stderr_tail.append(line.rstrip("\n"))
-
-        out_thread = threading.Thread(target=_stdout_reader, daemon=True)
-        err_thread = threading.Thread(target=_stderr_reader, daemon=True)
-        out_thread.start()
-        err_thread.start()
-
-        next_id = 0
-
-        def _request(method: str, params: dict[str, Any], *, text_parts: list[str] | None = None, reasoning_parts: list[str] | None = None) -> Any:
-            nonlocal next_id
-            next_id += 1
-            request_id = next_id
-            payload = {
-                "jsonrpc": "2.0",
-                "id": request_id,
-                "method": method,
-                "params": params,
-            }
-            proc.stdin.write(json.dumps(payload) + "\n")
-            proc.stdin.flush()
-
-            deadline = time.time() + timeout_seconds
-            while time.time() < deadline:
-                if proc.poll() is not None:
-                    break
-                try:
-                    msg = inbox.get(timeout=0.1)
-                except queue.Empty:
-                    continue
-
-                if self._handle_server_message(
-                    msg,
-                    process=proc,
-                    cwd=self._acp_cwd,
-                    text_parts=text_parts,
-                    reasoning_parts=reasoning_parts,
-                ):
-                    continue
-
-                if msg.get("id") != request_id:
-                    continue
-                if "error" in msg:
-                    err = msg.get("error") or {}
-                    raise RuntimeError(
-                        f"Copilot ACP {method} failed: {err.get('message') or err}"
-                    )
-                return msg.get("result")
-
-            stderr_text = "\n".join(stderr_tail).strip()
-            if proc.poll() is not None and stderr_text:
-                raise RuntimeError(f"Copilot ACP process exited early: {stderr_text}")
-            raise TimeoutError(f"Timed out waiting for Copilot ACP response to {method}.")
-
-        try:
-            _request(
-                "initialize",
-                {
-                    "protocolVersion": 1,
-                    "clientCapabilities": {
-                        "fs": {
-                            "readTextFile": True,
-                            "writeTextFile": True,
-                        }
-                    },
-                    "clientInfo": {
-                        "name": "hermes-agent",
-                        "title": "Hermes Agent",
-                        "version": "0.0.0",
-                    },
-                },
-            )
-            session = _request(
-                "session/new",
-                {
-                    "cwd": self._acp_cwd,
-                    "mcpServers": [],
-                },
-            ) or {}
-            session_id = str(session.get("sessionId") or "").strip()
-            if not session_id:
-                raise RuntimeError("Copilot ACP did not return a sessionId.")
-
-            text_parts: list[str] = []
-            reasoning_parts: list[str] = []
-            _request(
-                "session/prompt",
-                {
-                    "sessionId": session_id,
-                    "prompt": [
-                        {
-                            "type": "text",
-                            "text": prompt_text,
-                        }
-                    ],
-                },
-                text_parts=text_parts,
-                reasoning_parts=reasoning_parts,
-            )
-            return "".join(text_parts), "".join(reasoning_parts)
-        finally:
-            self.close()
-
-    def _handle_server_message(
-        self,
-        msg: dict[str, Any],
-        *,
-        process: subprocess.Popen[str],
-        cwd: str,
-        text_parts: list[str] | None,
-        reasoning_parts: list[str] | None,
-    ) -> bool:
-        method = msg.get("method")
-        if not isinstance(method, str):
-            return False
-
-        if method == "session/update":
-            params = msg.get("params") or {}
-            update = params.get("update") or {}
-            kind = str(update.get("sessionUpdate") or "").strip()
-            content = update.get("content") or {}
-            chunk_text = ""
-            if isinstance(content, dict):
-                chunk_text = str(content.get("text") or "")
-            if kind == "agent_message_chunk" and chunk_text and text_parts is not None:
-                text_parts.append(chunk_text)
-            elif kind == "agent_thought_chunk" and chunk_text and reasoning_parts is not None:
-                reasoning_parts.append(chunk_text)
-            return True
-
-        if process.stdin is None:
-            return True
-
-        message_id = msg.get("id")
-        params = msg.get("params") or {}
-
-        if method == "session/request_permission":
-            response = {
-                "jsonrpc": "2.0",
-                "id": message_id,
-                "result": {
-                    "outcome": {
-                        "outcome": "allow_once",
-                    }
-                },
-            }
-        elif method == "fs/read_text_file":
-            try:
-                path = _ensure_path_within_cwd(str(params.get("path") or ""), cwd)
-                content = path.read_text() if path.exists() else ""
-                line = params.get("line")
-                limit = params.get("limit")
-                if isinstance(line, int) and line > 1:
-                    lines = content.splitlines(keepends=True)
-                    start = line - 1
-                    end = start + limit if isinstance(limit, int) and limit > 0 else None
-                    content = "".join(lines[start:end])
-                response = {
-                    "jsonrpc": "2.0",
-                    "id": message_id,
-                    "result": {
-                        "content": content,
-                    },
-                }
-            except Exception as exc:
-                response = _jsonrpc_error(message_id, -32602, str(exc))
-        elif method == "fs/write_text_file":
-            try:
-                path = _ensure_path_within_cwd(str(params.get("path") or ""), cwd)
-                path.parent.mkdir(parents=True, exist_ok=True)
-                path.write_text(str(params.get("content") or ""))
-                response = {
-                    "jsonrpc": "2.0",
-                    "id": message_id,
-                    "result": None,
-                }
-            except Exception as exc:
-                response = _jsonrpc_error(message_id, -32602, str(exc))
-        else:
-            response = _jsonrpc_error(
-                message_id,
-                -32601,
-                f"ACP client method '{method}' is not supported by Hermes yet.",
-            )
-
-        process.stdin.write(json.dumps(response) + "\n")
-        process.stdin.flush()
-        return True

agent/display.py

@@ -254,15 +254,6 @@ class KawaiiSpinner:
             pass
 
     def _animate(self):
-        # When stdout is not a real terminal (e.g. Docker, systemd, pipe),
-        # skip the animation entirely — it creates massive log bloat.
-        # Just log the start once and let stop() log the completion.
-        if not hasattr(self._out, 'isatty') or not self._out.isatty():
-            self._write(f"  [tool] {self.message}", flush=True)
-            while self.running:
-                time.sleep(0.5)
-            return
-
         # Cache skin wings at start (avoid per-frame imports)
         skin = _get_skin()
         wings = skin.get_spinner_wings() if skin else []
@@ -328,19 +319,12 @@ class KawaiiSpinner:
         self.running = False
         if self.thread:
             self.thread.join(timeout=0.5)
-
-        is_tty = hasattr(self._out, 'isatty') and self._out.isatty()
-        if is_tty:
-            # Clear the spinner line with spaces instead of \033[K to avoid
-            # garbled escape codes when prompt_toolkit's patch_stdout is active.
-            blanks = ' ' * max(self.last_line_len + 5, 40)
-            self._write(f"\r{blanks}\r", end='', flush=True)
+        # Clear the spinner line with spaces instead of \033[K to avoid
+        # garbled escape codes when prompt_toolkit's patch_stdout is active.
+        blanks = ' ' * max(self.last_line_len + 5, 40)
+        self._write(f"\r{blanks}\r", end='', flush=True)
         if final_message:
-            elapsed = f" ({time.time() - self.start_time:.1f}s)" if self.start_time else ""
-            if is_tty:
-                self._write(f"  {final_message}", flush=True)
-            else:
-                self._write(f"  [done] {final_message}{elapsed}", flush=True)
+            self._write(f"  {final_message}", flush=True)
 
     def __enter__(self):
         self.start()
@@ -628,81 +612,3 @@ def write_tty(text: str) -> None:
     except OSError:
         sys.stdout.write(text)
         sys.stdout.flush()
-
-
-# =========================================================================
-# Context pressure display (CLI user-facing warnings)
-# =========================================================================
-
-# ANSI color codes for context pressure tiers
-_CYAN = "\033[36m"
-_YELLOW = "\033[33m"
-_BOLD = "\033[1m"
-_DIM_ANSI = "\033[2m"
-
-# Bar characters
-_BAR_FILLED = "▰"
-_BAR_EMPTY = "▱"
-_BAR_WIDTH = 20
-
-
-def format_context_pressure(
-    compaction_progress: float,
-    threshold_tokens: int,
-    threshold_percent: float,
-    compression_enabled: bool = True,
-) -> str:
-    """Build a formatted context pressure line for CLI display.
-
-    The bar and percentage show progress toward the compaction threshold,
-    NOT the raw context window.  100% = compaction fires.
-
-    Args:
-        compaction_progress: How close to compaction (0.0–1.0, 1.0 = fires).
-        threshold_tokens: Compaction threshold in tokens.
-        threshold_percent: Compaction threshold as a fraction of context window.
-        compression_enabled: Whether auto-compression is active.
-    """
-    pct_int = int(compaction_progress * 100)
-    filled = min(int(compaction_progress * _BAR_WIDTH), _BAR_WIDTH)
-    bar = _BAR_FILLED * filled + _BAR_EMPTY * (_BAR_WIDTH - filled)
-
-    threshold_k = f"{threshold_tokens // 1000}k" if threshold_tokens >= 1000 else str(threshold_tokens)
-    threshold_pct_int = int(threshold_percent * 100)
-
-    color = f"{_BOLD}{_YELLOW}"
-    icon = "⚠"
-    if compression_enabled:
-        hint = "compaction approaching"
-    else:
-        hint = "no auto-compaction"
-
-    return (
-        f"  {color}{icon} context {bar} {pct_int}% to compaction{_ANSI_RESET}"
-        f"  {_DIM_ANSI}{threshold_k} threshold ({threshold_pct_int}%) · {hint}{_ANSI_RESET}"
-    )
-
-
-def format_context_pressure_gateway(
-    compaction_progress: float,
-    threshold_percent: float,
-    compression_enabled: bool = True,
-) -> str:
-    """Build a plain-text context pressure notification for messaging platforms.
-
-    No ANSI — just Unicode and plain text suitable for Telegram/Discord/etc.
-    The percentage shows progress toward the compaction threshold.
-    """
-    pct_int = int(compaction_progress * 100)
-    filled = min(int(compaction_progress * _BAR_WIDTH), _BAR_WIDTH)
-    bar = _BAR_FILLED * filled + _BAR_EMPTY * (_BAR_WIDTH - filled)
-
-    threshold_pct_int = int(threshold_percent * 100)
-
-    icon = "⚠️"
-    if compression_enabled:
-        hint = f"Context compaction approaching (threshold: {threshold_pct_int}% of window)."
-    else:
-        hint = "Auto-compaction is disabled — context may be truncated."
-
-    return f"{icon} Context: {bar} {pct_int}% to compaction\n{hint}"

agent/insights.py

@@ -181,25 +181,22 @@ class InsightsEngine:
                      "billing_base_url, billing_mode, estimated_cost_usd, "
                      "actual_cost_usd, cost_status, cost_source")
 
-    # Pre-computed query strings — f-string evaluated once at class definition,
-    # not at runtime, so no user-controlled value can alter the query structure.
-    _GET_SESSIONS_WITH_SOURCE = (
-        f"SELECT {_SESSION_COLS} FROM sessions"
-        " WHERE started_at >= ? AND source = ?"
-        " ORDER BY started_at DESC"
-    )
-    _GET_SESSIONS_ALL = (
-        f"SELECT {_SESSION_COLS} FROM sessions"
-        " WHERE started_at >= ?"
-        " ORDER BY started_at DESC"
-    )
-
     def _get_sessions(self, cutoff: float, source: str = None) -> List[Dict]:
         """Fetch sessions within the time window."""
         if source:
-            cursor = self._conn.execute(self._GET_SESSIONS_WITH_SOURCE, (cutoff, source))
+            cursor = self._conn.execute(
+                f"""SELECT {self._SESSION_COLS} FROM sessions
+                    WHERE started_at >= ? AND source = ?
+                    ORDER BY started_at DESC""",
+                (cutoff, source),
+            )
         else:
-            cursor = self._conn.execute(self._GET_SESSIONS_ALL, (cutoff,))
+            cursor = self._conn.execute(
+                f"""SELECT {self._SESSION_COLS} FROM sessions
+                    WHERE started_at >= ?
+                    ORDER BY started_at DESC""",
+                (cutoff,),
+            )
         return [dict(row) for row in cursor.fetchall()]
 
     def _get_tool_usage(self, cutoff: float, source: str = None) -> List[Dict]:

agent/model_metadata.py

@@ -19,46 +19,6 @@ from hermes_constants import OPENROUTER_MODELS_URL
 
 logger = logging.getLogger(__name__)
 
-# Provider names that can appear as a "provider:" prefix before a model ID.
-# Only these are stripped — Ollama-style "model:tag" colons (e.g. "qwen3.5:27b")
-# are preserved so the full model name reaches cache lookups and server queries.
-_PROVIDER_PREFIXES: frozenset[str] = frozenset({
-    "openrouter", "nous", "openai-codex", "copilot", "copilot-acp",
-    "zai", "kimi-coding", "minimax", "minimax-cn", "anthropic", "deepseek",
-    "opencode-zen", "opencode-go", "ai-gateway", "kilocode", "alibaba",
-    "custom", "local",
-    # Common aliases
-    "glm", "z-ai", "z.ai", "zhipu", "github", "github-copilot",
-    "github-models", "kimi", "moonshot", "claude", "deep-seek",
-    "opencode", "zen", "go", "vercel", "kilo", "dashscope", "aliyun", "qwen",
-})
-
-
-_OLLAMA_TAG_PATTERN = re.compile(
-    r"^(\d+\.?\d*b|latest|stable|q\d|fp?\d|instruct|chat|coder|vision|text)",
-    re.IGNORECASE,
-)
-
-
-def _strip_provider_prefix(model: str) -> str:
-    """Strip a recognised provider prefix from a model string.
-
-    ``"local:my-model"`` → ``"my-model"``
-    ``"qwen3.5:27b"``   → ``"qwen3.5:27b"``  (unchanged — not a provider prefix)
-    ``"qwen:0.5b"``     → ``"qwen:0.5b"``    (unchanged — Ollama model:tag)
-    ``"deepseek:latest"``→ ``"deepseek:latest"``(unchanged — Ollama model:tag)
-    """
-    if ":" not in model or model.startswith("http"):
-        return model
-    prefix, suffix = model.split(":", 1)
-    prefix_lower = prefix.strip().lower()
-    if prefix_lower in _PROVIDER_PREFIXES:
-        # Don't strip if suffix looks like an Ollama tag (e.g. "7b", "latest", "q4_0")
-        if _OLLAMA_TAG_PATTERN.match(suffix.strip()):
-            return model
-        return suffix
-    return model
-
 _model_metadata_cache: Dict[str, Dict[str, Any]] = {}
 _model_metadata_cache_time: float = 0
 _MODEL_CACHE_TTL = 3600
@@ -67,52 +27,104 @@ _endpoint_model_metadata_cache_time: Dict[str, float] = {}
 _ENDPOINT_MODEL_CACHE_TTL = 300
 
 # Descending tiers for context length probing when the model is unknown.
-# We start at 128K (a safe default for most modern models) and step down
-# on context-length errors until one works.
+# We start high and step down on context-length errors until one works.
 CONTEXT_PROBE_TIERS = [
+    2_000_000,
+    1_000_000,
+    512_000,
+    200_000,
     128_000,
     64_000,
     32_000,
-    16_000,
-    8_000,
 ]
 
-# Default context length when no detection method succeeds.
-DEFAULT_FALLBACK_CONTEXT = CONTEXT_PROBE_TIERS[0]
-
-# Thin fallback defaults — only broad model family patterns.
-# These fire only when provider is unknown AND models.dev/OpenRouter/Anthropic
-# all miss. Replaced the previous 80+ entry dict.
-# For provider-specific context lengths, models.dev is the primary source.
 DEFAULT_CONTEXT_LENGTHS = {
-    # Anthropic Claude 4.6 (1M context) — bare IDs only to avoid
-    # fuzzy-match collisions (e.g. "anthropic/claude-sonnet-4" is a
-    # substring of "anthropic/claude-sonnet-4.6").
-    # OpenRouter-prefixed models resolve via OpenRouter live API or models.dev.
-    "claude-opus-4-6": 1000000,
-    "claude-sonnet-4-6": 1000000,
-    "claude-opus-4.6": 1000000,
-    "claude-sonnet-4.6": 1000000,
-    # Catch-all for older Claude models (must sort after specific entries)
-    "claude": 200000,
-    # OpenAI
-    "gpt-4.1": 1047576,
+    "anthropic/claude-opus-4": 200000,
+    "anthropic/claude-opus-4.5": 200000,
+    "anthropic/claude-opus-4.6": 200000,
+    "anthropic/claude-sonnet-4": 200000,
+    "anthropic/claude-sonnet-4-20250514": 200000,
+    "anthropic/claude-sonnet-4.5": 200000,
+    "anthropic/claude-sonnet-4.6": 200000,
+    "anthropic/claude-haiku-4.5": 200000,
+    # Bare Anthropic model IDs (for native API provider)
+    "claude-opus-4-6": 200000,
+    "claude-sonnet-4-6": 200000,
+    "claude-opus-4-5-20251101": 200000,
+    "claude-sonnet-4-5-20250929": 200000,
+    "claude-opus-4-1-20250805": 200000,
+    "claude-opus-4-20250514": 200000,
+    "claude-sonnet-4-20250514": 200000,
+    "claude-haiku-4-5-20251001": 200000,
+    "openai/gpt-5": 128000,
+    "openai/gpt-4.1": 1047576,
+    "openai/gpt-4.1-mini": 1047576,
+    "openai/gpt-4o": 128000,
+    "openai/gpt-4-turbo": 128000,
+    "openai/gpt-4o-mini": 128000,
+    "google/gemini-3-pro-preview": 1048576,
+    "google/gemini-3-flash": 1048576,
+    "google/gemini-2.5-flash": 1048576,
+    "google/gemini-2.0-flash": 1048576,
+    "google/gemini-2.5-pro": 1048576,
+    "deepseek/deepseek-v3.2": 65536,
+    "meta-llama/llama-3.3-70b-instruct": 131072,
+    "deepseek/deepseek-chat-v3": 65536,
+    "qwen/qwen-2.5-72b-instruct": 32768,
+    "glm-4.7": 202752,
+    "glm-5": 202752,
+    "glm-4.5": 131072,
+    "glm-4.5-flash": 131072,
+    "kimi-for-coding": 262144,
+    "kimi-k2.5": 262144,
+    "kimi-k2-thinking": 262144,
+    "kimi-k2-thinking-turbo": 262144,
+    "kimi-k2-turbo-preview": 262144,
+    "kimi-k2-0905-preview": 131072,
+    "MiniMax-M2.7": 204800,
+    "MiniMax-M2.7-highspeed": 204800,
+    "MiniMax-M2.5": 204800,
+    "MiniMax-M2.5-highspeed": 204800,
+    "MiniMax-M2.1": 204800,
+    # OpenCode Zen models
+    "gpt-5.4-pro": 128000,
+    "gpt-5.4": 128000,
+    "gpt-5.3-codex": 128000,
+    "gpt-5.3-codex-spark": 128000,
+    "gpt-5.2": 128000,
+    "gpt-5.2-codex": 128000,
+    "gpt-5.1": 128000,
+    "gpt-5.1-codex": 128000,
+    "gpt-5.1-codex-max": 128000,
+    "gpt-5.1-codex-mini": 128000,
     "gpt-5": 128000,
-    "gpt-4": 128000,
-    # Google
-    "gemini": 1048576,
-    # DeepSeek
-    "deepseek": 128000,
-    # Meta
-    "llama": 131072,
-    # Qwen
-    "qwen": 131072,
-    # MiniMax
-    "minimax": 204800,
-    # GLM
-    "glm": 202752,
-    # Kimi
-    "kimi": 262144,
+    "gpt-5-codex": 128000,
+    "gpt-5-nano": 128000,
+    # Bare model IDs without provider prefix (avoid duplicates with entries above)
+    "claude-opus-4-5": 200000,
+    "claude-opus-4-1": 200000,
+    "claude-sonnet-4-5": 200000,
+    "claude-sonnet-4": 200000,
+    "claude-haiku-4-5": 200000,
+    "claude-3-5-haiku": 200000,
+    "gemini-3.1-pro": 1048576,
+    "gemini-3-pro": 1048576,
+    "gemini-3-flash": 1048576,
+    "minimax-m2.5": 204800,
+    "minimax-m2.5-free": 204800,
+    "minimax-m2.1": 204800,
+    "glm-4.6": 202752,
+    "kimi-k2": 262144,
+    "qwen3-coder": 32768,
+    "big-pickle": 128000,
+    # Alibaba Cloud / DashScope Qwen models
+    "qwen3.5-plus": 131072,
+    "qwen3-max": 131072,
+    "qwen3-coder-plus": 131072,
+    "qwen3-coder-next": 131072,
+    "qwen-plus-latest": 131072,
+    "qwen3.5-flash": 131072,
+    "qwen-vl-max": 32768,
 }
 
 _CONTEXT_LENGTH_KEYS = (
@@ -124,8 +136,6 @@ _CONTEXT_LENGTH_KEYS = (
     "max_input_tokens",
     "max_sequence_length",
     "max_seq_len",
-    "n_ctx_train",
-    "n_ctx",
 )
 
 _MAX_COMPLETION_KEYS = (
@@ -134,9 +144,6 @@ _MAX_COMPLETION_KEYS = (
     "max_tokens",
 )
 
-# Local server hostnames / address patterns
-_LOCAL_HOSTS = ("localhost", "127.0.0.1", "::1", "0.0.0.0")
-
 
 def _normalize_base_url(base_url: str) -> str:
     return (base_url or "").strip().rstrip("/")
@@ -151,139 +158,22 @@ def _is_custom_endpoint(base_url: str) -> bool:
     return bool(normalized) and not _is_openrouter_base_url(normalized)
 
 
-_URL_TO_PROVIDER: Dict[str, str] = {
-    "api.openai.com": "openai",
-    "chatgpt.com": "openai",
-    "api.anthropic.com": "anthropic",
-    "api.z.ai": "zai",
-    "api.moonshot.ai": "kimi-coding",
-    "api.kimi.com": "kimi-coding",
-    "api.minimax": "minimax",
-    "dashscope.aliyuncs.com": "alibaba",
-    "dashscope-intl.aliyuncs.com": "alibaba",
-    "openrouter.ai": "openrouter",
-    "inference-api.nousresearch.com": "nous",
-    "api.deepseek.com": "deepseek",
-    "api.githubcopilot.com": "copilot",
-    "models.github.ai": "copilot",
-}
-
-
-def _infer_provider_from_url(base_url: str) -> Optional[str]:
-    """Infer the models.dev provider name from a base URL.
-
-    This allows context length resolution via models.dev for custom endpoints
-    like DashScope (Alibaba), Z.AI, Kimi, etc. without requiring the user to
-    explicitly set the provider name in config.
-    """
+def _is_known_provider_base_url(base_url: str) -> bool:
     normalized = _normalize_base_url(base_url)
     if not normalized:
-        return None
+        return False
     parsed = urlparse(normalized if "://" in normalized else f"https://{normalized}")
     host = parsed.netloc.lower() or parsed.path.lower()
-    for url_part, provider in _URL_TO_PROVIDER.items():
-        if url_part in host:
-            return provider
-    return None
-
-
-def _is_known_provider_base_url(base_url: str) -> bool:
-    return _infer_provider_from_url(base_url) is not None
-
-
-def is_local_endpoint(base_url: str) -> bool:
-    """Return True if base_url points to a local machine (localhost / RFC-1918 / WSL)."""
-    normalized = _normalize_base_url(base_url)
-    if not normalized:
-        return False
-    url = normalized if "://" in normalized else f"http://{normalized}"
-    try:
-        parsed = urlparse(url)
-        host = parsed.hostname or ""
-    except Exception:
-        return False
-    if host in _LOCAL_HOSTS:
-        return True
-    # RFC-1918 private ranges and link-local
-    import ipaddress
-    try:
-        addr = ipaddress.ip_address(host)
-        return addr.is_private or addr.is_loopback or addr.is_link_local
-    except ValueError:
-        pass
-    # Bare IP that looks like a private range (e.g. 172.26.x.x for WSL)
-    parts = host.split(".")
-    if len(parts) == 4:
-        try:
-            first, second = int(parts[0]), int(parts[1])
-            if first == 10:
-                return True
-            if first == 172 and 16 <= second <= 31:
-                return True
-            if first == 192 and second == 168:
-                return True
-        except ValueError:
-            pass
-    return False
-
-
-def detect_local_server_type(base_url: str) -> Optional[str]:
-    """Detect which local server is running at base_url by probing known endpoints.
-
-    Returns one of: "ollama", "lm-studio", "vllm", "llamacpp", or None.
-    """
-    import httpx
-
-    normalized = _normalize_base_url(base_url)
-    server_url = normalized
-    if server_url.endswith("/v1"):
-        server_url = server_url[:-3]
-
-    try:
-        with httpx.Client(timeout=2.0) as client:
-            # LM Studio exposes /api/v1/models — check first (most specific)
-            try:
-                r = client.get(f"{server_url}/api/v1/models")
-                if r.status_code == 200:
-                    return "lm-studio"
-            except Exception:
-                pass
-            # Ollama exposes /api/tags and responds with {"models": [...]}
-            # LM Studio returns {"error": "Unexpected endpoint"} with status 200
-            # on this path, so we must verify the response contains "models".
-            try:
-                r = client.get(f"{server_url}/api/tags")
-                if r.status_code == 200:
-                    try:
-                        data = r.json()
-                        if "models" in data:
-                            return "ollama"
-                    except Exception:
-                        pass
-            except Exception:
-                pass
-            # llama.cpp exposes /v1/props (older builds used /props without the /v1 prefix)
-            try:
-                r = client.get(f"{server_url}/v1/props")
-                if r.status_code != 200:
-                    r = client.get(f"{server_url}/props")  # fallback for older builds
-                if r.status_code == 200 and "default_generation_settings" in r.text:
-                    return "llamacpp"
-            except Exception:
-                pass
-            # vLLM: /version
-            try:
-                r = client.get(f"{server_url}/version")
-                if r.status_code == 200:
-                    data = r.json()
-                    if "version" in data:
-                        return "vllm"
-            except Exception:
-                pass
-    except Exception:
-        pass
-
-    return None
+    known_hosts = (
+        "api.openai.com",
+        "chatgpt.com",
+        "api.anthropic.com",
+        "api.z.ai",
+        "api.moonshot.ai",
+        "api.kimi.com",
+        "api.minimax",
+    )
+    return any(known_host in host for known_host in known_hosts)
 
 
 def _iter_nested_dicts(value: Any):
@@ -452,28 +342,6 @@ def fetch_endpoint_model_metadata(
                     entry["pricing"] = pricing
                 _add_model_aliases(cache, model_id, entry)
 
-            # If this is a llama.cpp server, query /props for actual allocated context
-            is_llamacpp = any(
-                m.get("owned_by") == "llamacpp"
-                for m in payload.get("data", []) if isinstance(m, dict)
-            )
-            if is_llamacpp:
-                try:
-                    # Try /v1/props first (current llama.cpp); fall back to /props for older builds
-                    base = candidate.rstrip("/").replace("/v1", "")
-                    props_resp = requests.get(base + "/v1/props", headers=headers, timeout=5)
-                    if not props_resp.ok:
-                        props_resp = requests.get(base + "/props", headers=headers, timeout=5)
-                    if props_resp.ok:
-                        props = props_resp.json()
-                        gen_settings = props.get("default_generation_settings", {})
-                        n_ctx = gen_settings.get("n_ctx")
-                        model_alias = props.get("model_alias", "")
-                        if n_ctx and model_alias and model_alias in cache:
-                            cache[model_alias]["context_length"] = n_ctx
-                except Exception:
-                    pass
-
             _endpoint_model_metadata_cache[normalized] = cache
             _endpoint_model_metadata_cache_time[normalized] = time.time()
             return cache
@@ -494,7 +362,7 @@ def _get_context_cache_path() -> Path:
 
 
 def _load_context_cache() -> Dict[str, int]:
-    """Load the model+provider -> context_length cache from disk."""
+    """Load the model+provider → context_length cache from disk."""
     path = _get_context_cache_path()
     if not path.exists():
         return {}
@@ -523,7 +391,7 @@ def save_context_length(model: str, base_url: str, length: int) -> None:
         path.parent.mkdir(parents=True, exist_ok=True)
         with open(path, "w") as f:
             yaml.dump({"context_lengths": cache}, f, default_flow_style=False)
-        logger.info("Cached context length %s -> %s tokens", key, f"{length:,}")
+        logger.info("Cached context length %s → %s tokens", key, f"{length:,}")
     except Exception as e:
         logger.debug("Failed to save context length cache: %s", e)
 
@@ -571,317 +439,48 @@ def parse_context_limit_from_error(error_msg: str) -> Optional[int]:
     return None
 
 
-def _model_id_matches(candidate_id: str, lookup_model: str) -> bool:
-    """Return True if *candidate_id* (from server) matches *lookup_model* (configured).
-
-    Supports two forms:
-    - Exact match:  "nvidia-nemotron-super-49b-v1" == "nvidia-nemotron-super-49b-v1"
-    - Slug match:   "nvidia/nvidia-nemotron-super-49b-v1" matches "nvidia-nemotron-super-49b-v1"
-                    (the part after the last "/" equals lookup_model)
-
-    This covers LM Studio's native API which stores models as "publisher/slug"
-    while users typically configure only the slug after the "local:" prefix.
-    """
-    if candidate_id == lookup_model:
-        return True
-    # Slug match: basename of candidate equals the lookup name
-    if "/" in candidate_id and candidate_id.rsplit("/", 1)[1] == lookup_model:
-        return True
-    return False
-
-
-def _query_local_context_length(model: str, base_url: str) -> Optional[int]:
-    """Query a local server for the model's context length."""
-    import httpx
-
-    # Strip recognised provider prefix (e.g., "local:model-name" → "model-name").
-    # Ollama "model:tag" colons (e.g. "qwen3.5:27b") are intentionally preserved.
-    model = _strip_provider_prefix(model)
-
-    # Strip /v1 suffix to get the server root
-    server_url = base_url.rstrip("/")
-    if server_url.endswith("/v1"):
-        server_url = server_url[:-3]
-
-    try:
-        server_type = detect_local_server_type(base_url)
-    except Exception:
-        server_type = None
-
-    try:
-        with httpx.Client(timeout=3.0) as client:
-            # Ollama: /api/show returns model details with context info
-            if server_type == "ollama":
-                resp = client.post(f"{server_url}/api/show", json={"name": model})
-                if resp.status_code == 200:
-                    data = resp.json()
-                    # Check model_info for context length
-                    model_info = data.get("model_info", {})
-                    for key, value in model_info.items():
-                        if "context_length" in key and isinstance(value, (int, float)):
-                            return int(value)
-                    # Check parameters string for num_ctx
-                    params = data.get("parameters", "")
-                    if "num_ctx" in params:
-                        for line in params.split("\n"):
-                            if "num_ctx" in line:
-                                parts = line.strip().split()
-                                if len(parts) >= 2:
-                                    try:
-                                        return int(parts[-1])
-                                    except ValueError:
-                                        pass
-
-            # LM Studio native API: /api/v1/models returns max_context_length.
-            # This is more reliable than the OpenAI-compat /v1/models which
-            # doesn't include context window information for LM Studio servers.
-            # Use _model_id_matches for fuzzy matching: LM Studio stores models as
-            # "publisher/slug" but users configure only "slug" after "local:" prefix.
-            if server_type == "lm-studio":
-                resp = client.get(f"{server_url}/api/v1/models")
-                if resp.status_code == 200:
-                    data = resp.json()
-                    for m in data.get("models", []):
-                        if _model_id_matches(m.get("key", ""), model) or _model_id_matches(m.get("id", ""), model):
-                            # Prefer loaded instance context (actual runtime value)
-                            for inst in m.get("loaded_instances", []):
-                                cfg = inst.get("config", {})
-                                ctx = cfg.get("context_length")
-                                if ctx and isinstance(ctx, (int, float)):
-                                    return int(ctx)
-                            # Fall back to max_context_length (theoretical model max)
-                            ctx = m.get("max_context_length") or m.get("context_length")
-                            if ctx and isinstance(ctx, (int, float)):
-                                return int(ctx)
-
-            # LM Studio / vLLM / llama.cpp: try /v1/models/{model}
-            resp = client.get(f"{server_url}/v1/models/{model}")
-            if resp.status_code == 200:
-                data = resp.json()
-                # vLLM returns max_model_len
-                ctx = data.get("max_model_len") or data.get("context_length") or data.get("max_tokens")
-                if ctx and isinstance(ctx, (int, float)):
-                    return int(ctx)
-
-            # Try /v1/models and find the model in the list.
-            # Use _model_id_matches to handle "publisher/slug" vs bare "slug".
-            resp = client.get(f"{server_url}/v1/models")
-            if resp.status_code == 200:
-                data = resp.json()
-                models_list = data.get("data", [])
-                for m in models_list:
-                    if _model_id_matches(m.get("id", ""), model):
-                        ctx = m.get("max_model_len") or m.get("context_length") or m.get("max_tokens")
-                        if ctx and isinstance(ctx, (int, float)):
-                            return int(ctx)
-    except Exception:
-        pass
-
-    return None
-
-
-def _normalize_model_version(model: str) -> str:
-    """Normalize version separators for matching.
-
-    Nous uses dashes: claude-opus-4-6, claude-sonnet-4-5
-    OpenRouter uses dots: claude-opus-4.6, claude-sonnet-4.5
-    Normalize both to dashes for comparison.
-    """
-    return model.replace(".", "-")
-
-
-def _query_anthropic_context_length(model: str, base_url: str, api_key: str) -> Optional[int]:
-    """Query Anthropic's /v1/models endpoint for context length.
-
-    Only works with regular ANTHROPIC_API_KEY (sk-ant-api*).
-    OAuth tokens (sk-ant-oat*) from Claude Code return 401.
-    """
-    if not api_key or api_key.startswith("sk-ant-oat"):
-        return None  # OAuth tokens can't access /v1/models
-    try:
-        base = base_url.rstrip("/")
-        if base.endswith("/v1"):
-            base = base[:-3]
-        url = f"{base}/v1/models?limit=1000"
-        headers = {
-            "x-api-key": api_key,
-            "anthropic-version": "2023-06-01",
-        }
-        resp = requests.get(url, headers=headers, timeout=10)
-        if resp.status_code != 200:
-            return None
-        data = resp.json()
-        for m in data.get("data", []):
-            if m.get("id") == model:
-                ctx = m.get("max_input_tokens")
-                if isinstance(ctx, int) and ctx > 0:
-                    return ctx
-    except Exception as e:
-        logger.debug("Anthropic /v1/models query failed: %s", e)
-    return None
-
-
-def _resolve_nous_context_length(model: str) -> Optional[int]:
-    """Resolve Nous Portal model context length via OpenRouter metadata.
-
-    Nous model IDs are bare (e.g. 'claude-opus-4-6') while OpenRouter uses
-    prefixed IDs (e.g. 'anthropic/claude-opus-4.6'). Try suffix matching
-    with version normalization (dot↔dash).
-    """
-    metadata = fetch_model_metadata()  # OpenRouter cache
-    # Exact match first
-    if model in metadata:
-        return metadata[model].get("context_length")
-
-    normalized = _normalize_model_version(model).lower()
-
-    for or_id, entry in metadata.items():
-        bare = or_id.split("/", 1)[1] if "/" in or_id else or_id
-        if bare.lower() == model.lower() or _normalize_model_version(bare).lower() == normalized:
-            return entry.get("context_length")
-
-    # Partial prefix match for cases like gemini-3-flash → gemini-3-flash-preview
-    # Require match to be at a word boundary (followed by -, :, or end of string)
-    model_lower = model.lower()
-    for or_id, entry in metadata.items():
-        bare = or_id.split("/", 1)[1] if "/" in or_id else or_id
-        for candidate, query in [(bare.lower(), model_lower), (_normalize_model_version(bare).lower(), normalized)]:
-            if candidate.startswith(query) and (
-                len(candidate) == len(query) or candidate[len(query)] in "-:."
-            ):
-                return entry.get("context_length")
-
-    return None
-
-
-def get_model_context_length(
-    model: str,
-    base_url: str = "",
-    api_key: str = "",
-    config_context_length: int | None = None,
-    provider: str = "",
-) -> int:
+def get_model_context_length(model: str, base_url: str = "", api_key: str = "") -> int:
     """Get the context length for a model.
 
     Resolution order:
-    0. Explicit config override (model.context_length or custom_providers per-model)
     1. Persistent cache (previously discovered via probing)
     2. Active endpoint metadata (/models for explicit custom endpoints)
-    3. Local server query (for local endpoints)
-    4. Anthropic /v1/models API (API-key users only, not OAuth)
-    5. OpenRouter live API metadata
-    6. Nous suffix-match via OpenRouter cache
-    7. models.dev registry lookup (provider-aware)
-    8. Thin hardcoded defaults (broad family patterns)
-    9. Default fallback (128K)
+    3. OpenRouter API metadata
+    4. Hardcoded DEFAULT_CONTEXT_LENGTHS (fuzzy match for hosted routes only)
+    5. First probe tier (2M) — will be narrowed on first context error
     """
-    # 0. Explicit config override — user knows best
-    if config_context_length is not None and isinstance(config_context_length, int) and config_context_length > 0:
-        return config_context_length
-
-    # Normalise provider-prefixed model names (e.g. "local:model-name" →
-    # "model-name") so cache lookups and server queries use the bare ID that
-    # local servers actually know about.  Ollama "model:tag" colons are preserved.
-    model = _strip_provider_prefix(model)
-
     # 1. Check persistent cache (model+provider)
     if base_url:
         cached = get_cached_context_length(model, base_url)
         if cached is not None:
             return cached
 
-    # 2. Active endpoint metadata for truly custom/unknown endpoints.
-    # Known providers (Copilot, OpenAI, Anthropic, etc.) skip this — their
-    # /models endpoint may report a provider-imposed limit (e.g. Copilot
-    # returns 128k) instead of the model's full context (400k).  models.dev
-    # has the correct per-provider values and is checked at step 5+.
-    if _is_custom_endpoint(base_url) and not _is_known_provider_base_url(base_url):
+    # 2. Active endpoint metadata for explicit custom routes
+    if _is_custom_endpoint(base_url):
         endpoint_metadata = fetch_endpoint_model_metadata(base_url, api_key=api_key)
-        matched = endpoint_metadata.get(model)
-        if not matched:
-            # Single-model servers: if only one model is loaded, use it
-            if len(endpoint_metadata) == 1:
-                matched = next(iter(endpoint_metadata.values()))
-            else:
-                # Fuzzy match: substring in either direction
-                for key, entry in endpoint_metadata.items():
-                    if model in key or key in model:
-                        matched = entry
-                        break
-        if matched:
-            context_length = matched.get("context_length")
+        if model in endpoint_metadata:
+            context_length = endpoint_metadata[model].get("context_length")
             if isinstance(context_length, int):
                 return context_length
         if not _is_known_provider_base_url(base_url):
-            # 3. Try querying local server directly
-            if is_local_endpoint(base_url):
-                local_ctx = _query_local_context_length(model, base_url)
-                if local_ctx and local_ctx > 0:
-                    save_context_length(model, base_url, local_ctx)
-                    return local_ctx
-            logger.info(
-                "Could not detect context length for model %r at %s — "
-                "defaulting to %s tokens (probe-down). Set model.context_length "
-                "in config.yaml to override.",
-                model, base_url, f"{DEFAULT_FALLBACK_CONTEXT:,}",
-            )
-            return DEFAULT_FALLBACK_CONTEXT
+            # Explicit third-party endpoints should not borrow fuzzy global
+            # defaults from unrelated providers with similarly named models.
+            return CONTEXT_PROBE_TIERS[0]
 
-    # 4. Anthropic /v1/models API (only for regular API keys, not OAuth)
-    if provider == "anthropic" or (
-        base_url and "api.anthropic.com" in base_url
-    ):
-        ctx = _query_anthropic_context_length(model, base_url or "https://api.anthropic.com", api_key)
-        if ctx:
-            return ctx
-
-    # 5. Provider-aware lookups (before generic OpenRouter cache)
-    # These are provider-specific and take priority over the generic OR cache,
-    # since the same model can have different context limits per provider
-    # (e.g. claude-opus-4.6 is 1M on Anthropic but 128K on GitHub Copilot).
-    # If provider is generic (openrouter/custom/empty), try to infer from URL.
-    effective_provider = provider
-    if not effective_provider or effective_provider in ("openrouter", "custom"):
-        if base_url:
-            inferred = _infer_provider_from_url(base_url)
-            if inferred:
-                effective_provider = inferred
-
-    if effective_provider == "nous":
-        ctx = _resolve_nous_context_length(model)
-        if ctx:
-            return ctx
-    if effective_provider:
-        from agent.models_dev import lookup_models_dev_context
-        ctx = lookup_models_dev_context(effective_provider, model)
-        if ctx:
-            return ctx
-
-    # 6. OpenRouter live API metadata (provider-unaware fallback)
+    # 3. OpenRouter API metadata
     metadata = fetch_model_metadata()
     if model in metadata:
         return metadata[model].get("context_length", 128000)
 
-    # 8. Hardcoded defaults (fuzzy match — longest key first for specificity)
-    # Only check `default_model in model` (is the key a substring of the input).
-    # The reverse (`model in default_model`) causes shorter names like
-    # "claude-sonnet-4" to incorrectly match "claude-sonnet-4-6" and return 1M.
-    model_lower = model.lower()
+    # 4. Hardcoded defaults (fuzzy match — longest key first for specificity)
     for default_model, length in sorted(
         DEFAULT_CONTEXT_LENGTHS.items(), key=lambda x: len(x[0]), reverse=True
     ):
-        if default_model in model_lower:
+        if default_model in model or model in default_model:
             return length
 
-    # 9. Query local server as last resort
-    if base_url and is_local_endpoint(base_url):
-        local_ctx = _query_local_context_length(model, base_url)
-        if local_ctx and local_ctx > 0:
-            save_context_length(model, base_url, local_ctx)
-            return local_ctx
-
-    # 10. Default fallback — 128K
-    return DEFAULT_FALLBACK_CONTEXT
+    # 5. Unknown model — start at highest probe tier
+    return CONTEXT_PROBE_TIERS[0]
 
 
 def estimate_tokens_rough(text: str) -> int:

agent/models_dev.py

@@ -1,171 +0,0 @@
-"""Models.dev registry integration for provider-aware context length detection.
-
-Fetches model metadata from https://models.dev/api.json — a community-maintained
-database of 3800+ models across 100+ providers, including per-provider context
-windows, pricing, and capabilities.
-
-Data is cached in memory (1hr TTL) and on disk (~/.hermes/models_dev_cache.json)
-to avoid cold-start network latency.
-"""
-
-import json
-import logging
-import os
-import time
-from pathlib import Path
-from typing import Any, Dict, Optional
-
-import requests
-
-logger = logging.getLogger(__name__)
-
-MODELS_DEV_URL = "https://models.dev/api.json"
-_MODELS_DEV_CACHE_TTL = 3600  # 1 hour in-memory
-
-# In-memory cache
-_models_dev_cache: Dict[str, Any] = {}
-_models_dev_cache_time: float = 0
-
-# Provider ID mapping: Hermes provider names → models.dev provider IDs
-PROVIDER_TO_MODELS_DEV: Dict[str, str] = {
-    "openrouter": "openrouter",
-    "anthropic": "anthropic",
-    "zai": "zai",
-    "kimi-coding": "kimi-for-coding",
-    "minimax": "minimax",
-    "minimax-cn": "minimax-cn",
-    "deepseek": "deepseek",
-    "alibaba": "alibaba",
-    "copilot": "github-copilot",
-    "ai-gateway": "vercel",
-    "opencode-zen": "opencode",
-    "opencode-go": "opencode-go",
-    "kilocode": "kilo",
-}
-
-
-def _get_cache_path() -> Path:
-    """Return path to disk cache file."""
-    env_val = os.environ.get("HERMES_HOME", "")
-    hermes_home = Path(env_val) if env_val else Path.home() / ".hermes"
-    return hermes_home / "models_dev_cache.json"
-
-
-def _load_disk_cache() -> Dict[str, Any]:
-    """Load models.dev data from disk cache."""
-    try:
-        cache_path = _get_cache_path()
-        if cache_path.exists():
-            with open(cache_path, encoding="utf-8") as f:
-                return json.load(f)
-    except Exception as e:
-        logger.debug("Failed to load models.dev disk cache: %s", e)
-    return {}
-
-
-def _save_disk_cache(data: Dict[str, Any]) -> None:
-    """Save models.dev data to disk cache."""
-    try:
-        cache_path = _get_cache_path()
-        cache_path.parent.mkdir(parents=True, exist_ok=True)
-        with open(cache_path, "w", encoding="utf-8") as f:
-            json.dump(data, f, separators=(",", ":"))
-    except Exception as e:
-        logger.debug("Failed to save models.dev disk cache: %s", e)
-
-
-def fetch_models_dev(force_refresh: bool = False) -> Dict[str, Any]:
-    """Fetch models.dev registry. In-memory cache (1hr) + disk fallback.
-
-    Returns the full registry dict keyed by provider ID, or empty dict on failure.
-    """
-    global _models_dev_cache, _models_dev_cache_time
-
-    # Check in-memory cache
-    if (
-        not force_refresh
-        and _models_dev_cache
-        and (time.time() - _models_dev_cache_time) < _MODELS_DEV_CACHE_TTL
-    ):
-        return _models_dev_cache
-
-    # Try network fetch
-    try:
-        response = requests.get(MODELS_DEV_URL, timeout=15)
-        response.raise_for_status()
-        data = response.json()
-        if isinstance(data, dict) and len(data) > 0:
-            _models_dev_cache = data
-            _models_dev_cache_time = time.time()
-            _save_disk_cache(data)
-            logger.debug(
-                "Fetched models.dev registry: %d providers, %d total models",
-                len(data),
-                sum(len(p.get("models", {})) for p in data.values() if isinstance(p, dict)),
-            )
-            return data
-    except Exception as e:
-        logger.debug("Failed to fetch models.dev: %s", e)
-
-    # Fall back to disk cache — use a short TTL (5 min) so we retry
-    # the network fetch soon instead of serving stale data for a full hour.
-    if not _models_dev_cache:
-        _models_dev_cache = _load_disk_cache()
-        if _models_dev_cache:
-            _models_dev_cache_time = time.time() - _MODELS_DEV_CACHE_TTL + 300
-            logger.debug("Loaded models.dev from disk cache (%d providers)", len(_models_dev_cache))
-
-    return _models_dev_cache
-
-
-def lookup_models_dev_context(provider: str, model: str) -> Optional[int]:
-    """Look up context_length for a provider+model combo in models.dev.
-
-    Returns the context window in tokens, or None if not found.
-    Handles case-insensitive matching and filters out context=0 entries.
-    """
-    mdev_provider_id = PROVIDER_TO_MODELS_DEV.get(provider)
-    if not mdev_provider_id:
-        return None
-
-    data = fetch_models_dev()
-    provider_data = data.get(mdev_provider_id)
-    if not isinstance(provider_data, dict):
-        return None
-
-    models = provider_data.get("models", {})
-    if not isinstance(models, dict):
-        return None
-
-    # Exact match
-    entry = models.get(model)
-    if entry:
-        ctx = _extract_context(entry)
-        if ctx:
-            return ctx
-
-    # Case-insensitive match
-    model_lower = model.lower()
-    for mid, mdata in models.items():
-        if mid.lower() == model_lower:
-            ctx = _extract_context(mdata)
-            if ctx:
-                return ctx
-
-    return None
-
-
-def _extract_context(entry: Dict[str, Any]) -> Optional[int]:
-    """Extract context_length from a models.dev model entry.
-
-    Returns None for invalid/zero values (some audio/image models have context=0).
-    """
-    if not isinstance(entry, dict):
-        return None
-    limit = entry.get("limit")
-    if not isinstance(limit, dict):
-        return None
-    ctx = limit.get("context")
-    if isinstance(ctx, (int, float)) and ctx > 0:
-        return int(ctx)
-    return None

agent/prompt_builder.py

@@ -206,11 +206,11 @@ PLATFORM_HINTS = {
         "contextually appropriate."
     ),
     "cron": (
-        "You are running as a scheduled cron job. There is no user present — you "
-        "cannot ask questions, request clarification, or wait for follow-up. Execute "
-        "the task fully and autonomously, making reasonable decisions where needed. "
-        "Your final response is automatically delivered to the job's configured "
-        "destination — put the primary content directly in your response."
+        "You are running as a scheduled cron job. Your final response is automatically "
+        "delivered to the job's configured destination, so do not use send_message to "
+        "send to that same target again. If you want the user to receive something in "
+        "the scheduled destination, put it directly in your final response. Use "
+        "send_message only for additional or different targets."
     ),
     "cli": (
         "You are a CLI AI Agent. Try not to use markdown but simple text "
@@ -429,59 +429,19 @@ def _truncate_content(content: str, filename: str, max_chars: int = CONTEXT_FILE
     return head + marker + tail
 
 
-def load_soul_md() -> Optional[str]:
-    """Load SOUL.md from HERMES_HOME and return its content, or None.
+def build_context_files_prompt(cwd: Optional[str] = None) -> str:
+    """Discover and load context files for the system prompt.
 
-    Used as the agent identity (slot #1 in the system prompt).  When this
-    returns content, ``build_context_files_prompt`` should be called with
-    ``skip_soul=True`` so SOUL.md isn't injected twice.
+    Discovery: AGENTS.md (recursive), .cursorrules / .cursor/rules/*.mdc,
+    and SOUL.md from HERMES_HOME only. Each capped at 20,000 chars.
     """
-    try:
-        from hermes_cli.config import ensure_hermes_home
-        ensure_hermes_home()
-    except Exception as e:
-        logger.debug("Could not ensure HERMES_HOME before loading SOUL.md: %s", e)
+    if cwd is None:
+        cwd = os.getcwd()
 
-    soul_path = Path(os.getenv("HERMES_HOME", Path.home() / ".hermes")) / "SOUL.md"
-    if not soul_path.exists():
-        return None
-    try:
-        content = soul_path.read_text(encoding="utf-8").strip()
-        if not content:
-            return None
-        content = _scan_context_content(content, "SOUL.md")
-        content = _truncate_content(content, "SOUL.md")
-        return content
-    except Exception as e:
-        logger.debug("Could not read SOUL.md from %s: %s", soul_path, e)
-        return None
+    cwd_path = Path(cwd).resolve()
+    sections = []
 
-
-def _load_hermes_md(cwd_path: Path) -> str:
-    """.hermes.md / HERMES.md — walk to git root."""
-    hermes_md_path = _find_hermes_md(cwd_path)
-    if not hermes_md_path:
-        return ""
-    try:
-        content = hermes_md_path.read_text(encoding="utf-8").strip()
-        if not content:
-            return ""
-        content = _strip_yaml_frontmatter(content)
-        rel = hermes_md_path.name
-        try:
-            rel = str(hermes_md_path.relative_to(cwd_path))
-        except ValueError:
-            pass
-        content = _scan_context_content(content, rel)
-        result = f"## {rel}\n\n{content}"
-        return _truncate_content(result, ".hermes.md")
-    except Exception as e:
-        logger.debug("Could not read %s: %s", hermes_md_path, e)
-        return ""
-
-
-def _load_agents_md(cwd_path: Path) -> str:
-    """AGENTS.md — hierarchical, recursive directory walk."""
+    # AGENTS.md (hierarchical, recursive)
     top_level_agents = None
     for name in ["AGENTS.md", "agents.md"]:
         candidate = cwd_path / name
@@ -489,51 +449,31 @@ def _load_agents_md(cwd_path: Path) -> str:
             top_level_agents = candidate
             break
 
-    if not top_level_agents:
-        return ""
+    if top_level_agents:
+        agents_files = []
+        for root, dirs, files in os.walk(cwd_path):
+            dirs[:] = [d for d in dirs if not d.startswith('.') and d not in ('node_modules', '__pycache__', 'venv', '.venv')]
+            for f in files:
+                if f.lower() == "agents.md":
+                    agents_files.append(Path(root) / f)
+        agents_files.sort(key=lambda p: len(p.parts))
 
-    agents_files = []
-    for root, dirs, files in os.walk(cwd_path):
-        dirs[:] = [d for d in dirs if not d.startswith('.') and d not in ('node_modules', '__pycache__', 'venv', '.venv')]
-        for f in files:
-            if f.lower() == "agents.md":
-                agents_files.append(Path(root) / f)
-    agents_files.sort(key=lambda p: len(p.parts))
-
-    total_content = ""
-    for agents_path in agents_files:
-        try:
-            content = agents_path.read_text(encoding="utf-8").strip()
-            if content:
-                rel_path = agents_path.relative_to(cwd_path)
-                content = _scan_context_content(content, str(rel_path))
-                total_content += f"## {rel_path}\n\n{content}\n\n"
-        except Exception as e:
-            logger.debug("Could not read %s: %s", agents_path, e)
-
-    if not total_content:
-        return ""
-    return _truncate_content(total_content, "AGENTS.md")
-
-
-def _load_claude_md(cwd_path: Path) -> str:
-    """CLAUDE.md / claude.md — cwd only."""
-    for name in ["CLAUDE.md", "claude.md"]:
-        candidate = cwd_path / name
-        if candidate.exists():
+        total_agents_content = ""
+        for agents_path in agents_files:
             try:
-                content = candidate.read_text(encoding="utf-8").strip()
+                content = agents_path.read_text(encoding="utf-8").strip()
                 if content:
-                    content = _scan_context_content(content, name)
-                    result = f"## {name}\n\n{content}"
-                    return _truncate_content(result, "CLAUDE.md")
+                    rel_path = agents_path.relative_to(cwd_path)
+                    content = _scan_context_content(content, str(rel_path))
+                    total_agents_content += f"## {rel_path}\n\n{content}\n\n"
             except Exception as e:
-                logger.debug("Could not read %s: %s", candidate, e)
-    return ""
+                logger.debug("Could not read %s: %s", agents_path, e)
 
+        if total_agents_content:
+            total_agents_content = _truncate_content(total_agents_content, "AGENTS.md")
+            sections.append(total_agents_content)
 
-def _load_cursorrules(cwd_path: Path) -> str:
-    """.cursorrules + .cursor/rules/*.mdc — cwd only."""
+    # .cursorrules
     cursorrules_content = ""
     cursorrules_file = cwd_path / ".cursorrules"
     if cursorrules_file.exists():
@@ -557,47 +497,49 @@ def _load_cursorrules(cwd_path: Path) -> str:
             except Exception as e:
                 logger.debug("Could not read %s: %s", mdc_file, e)
 
-    if not cursorrules_content:
-        return ""
-    return _truncate_content(cursorrules_content, ".cursorrules")
+    if cursorrules_content:
+        cursorrules_content = _truncate_content(cursorrules_content, ".cursorrules")
+        sections.append(cursorrules_content)
 
+    # .hermes.md / HERMES.md — per-project agent config (walk to git root)
+    hermes_md_content = ""
+    hermes_md_path = _find_hermes_md(cwd_path)
+    if hermes_md_path:
+        try:
+            content = hermes_md_path.read_text(encoding="utf-8").strip()
+            if content:
+                content = _strip_yaml_frontmatter(content)
+                rel = hermes_md_path.name
+                try:
+                    rel = str(hermes_md_path.relative_to(cwd_path))
+                except ValueError:
+                    pass
+                content = _scan_context_content(content, rel)
+                hermes_md_content = f"## {rel}\n\n{content}"
+        except Exception as e:
+            logger.debug("Could not read %s: %s", hermes_md_path, e)
 
-def build_context_files_prompt(cwd: Optional[str] = None, skip_soul: bool = False) -> str:
-    """Discover and load context files for the system prompt.
+    if hermes_md_content:
+        hermes_md_content = _truncate_content(hermes_md_content, ".hermes.md")
+        sections.append(hermes_md_content)
 
-    Priority (first found wins — only ONE project context type is loaded):
-      1. .hermes.md / HERMES.md  (walk to git root)
-      2. AGENTS.md / agents.md   (recursive directory walk)
-      3. CLAUDE.md / claude.md   (cwd only)
-      4. .cursorrules / .cursor/rules/*.mdc  (cwd only)
+    # SOUL.md from HERMES_HOME only
+    try:
+        from hermes_cli.config import ensure_hermes_home
+        ensure_hermes_home()
+    except Exception as e:
+        logger.debug("Could not ensure HERMES_HOME before loading SOUL.md: %s", e)
 
-    SOUL.md from HERMES_HOME is independent and always included when present.
-    Each context source is capped at 20,000 chars.
-
-    When *skip_soul* is True, SOUL.md is not included here (it was already
-    loaded via ``load_soul_md()`` for the identity slot).
-    """
-    if cwd is None:
-        cwd = os.getcwd()
-
-    cwd_path = Path(cwd).resolve()
-    sections = []
-
-    # Priority-based project context: first match wins
-    project_context = (
-        _load_hermes_md(cwd_path)
-        or _load_agents_md(cwd_path)
-        or _load_claude_md(cwd_path)
-        or _load_cursorrules(cwd_path)
-    )
-    if project_context:
-        sections.append(project_context)
-
-    # SOUL.md from HERMES_HOME only — skip when already loaded as identity
-    if not skip_soul:
-        soul_content = load_soul_md()
-        if soul_content:
-            sections.append(soul_content)
+    soul_path = Path(os.getenv("HERMES_HOME", Path.home() / ".hermes")) / "SOUL.md"
+    if soul_path.exists():
+        try:
+            content = soul_path.read_text(encoding="utf-8").strip()
+            if content:
+                content = _scan_context_content(content, "SOUL.md")
+                content = _truncate_content(content, "SOUL.md")
+                sections.append(content)
+        except Exception as e:
+            logger.debug("Could not read SOUL.md from %s: %s", soul_path, e)
 
     if not sections:
         return ""

agent/prompt_caching.py

@@ -12,14 +12,13 @@ import copy
 from typing import Any, Dict, List
 
 
-def _apply_cache_marker(msg: dict, cache_marker: dict, native_anthropic: bool = False) -> None:
+def _apply_cache_marker(msg: dict, cache_marker: dict) -> None:
     """Add cache_control to a single message, handling all format variations."""
     role = msg.get("role", "")
     content = msg.get("content")
 
     if role == "tool":
-        if native_anthropic:
-            msg["cache_control"] = cache_marker
+        msg["cache_control"] = cache_marker
         return
 
     if content is None or content == "":
@@ -41,7 +40,6 @@ def _apply_cache_marker(msg: dict, cache_marker: dict, native_anthropic: bool =
 def apply_anthropic_cache_control(
     api_messages: List[Dict[str, Any]],
     cache_ttl: str = "5m",
-    native_anthropic: bool = False,
 ) -> List[Dict[str, Any]]:
     """Apply system_and_3 caching strategy to messages for Anthropic models.
 
@@ -61,12 +59,12 @@ def apply_anthropic_cache_control(
     breakpoints_used = 0
 
     if messages[0].get("role") == "system":
-        _apply_cache_marker(messages[0], marker, native_anthropic=native_anthropic)
+        _apply_cache_marker(messages[0], marker)
         breakpoints_used += 1
 
     remaining = 4 - breakpoints_used
     non_sys = [i for i in range(len(messages)) if messages[i].get("role") != "system"]
     for idx in non_sys[-remaining:]:
-        _apply_cache_marker(messages[idx], marker, native_anthropic=native_anthropic)
+        _apply_cache_marker(messages[idx], marker)
 
     return messages

agent/redact.py

@@ -100,10 +100,6 @@ def redact_sensitive_text(text: str) -> str:
     Safe to call on any string -- non-matching text passes through unchanged.
     Disabled when security.redact_secrets is false in config.yaml.
     """
-    if text is None:
-        return None
-    if not isinstance(text, str):
-        text = str(text)
     if not text:
         return text
     if os.getenv("HERMES_REDACT_SECRETS", "").lower() in ("0", "false", "no", "off"):

agent/smart_model_routing.py

@@ -125,8 +125,6 @@ def resolve_turn_route(user_message: str, routing_config: Optional[Dict[str, Any
                 "base_url": primary.get("base_url"),
                 "provider": primary.get("provider"),
                 "api_mode": primary.get("api_mode"),
-                "command": primary.get("command"),
-                "args": list(primary.get("args") or []),
             },
             "label": None,
             "signature": (
@@ -134,8 +132,6 @@ def resolve_turn_route(user_message: str, routing_config: Optional[Dict[str, Any
                 primary.get("provider"),
                 primary.get("base_url"),
                 primary.get("api_mode"),
-                primary.get("command"),
-                tuple(primary.get("args") or ()),
             ),
         }
 
@@ -160,8 +156,6 @@ def resolve_turn_route(user_message: str, routing_config: Optional[Dict[str, Any
                 "base_url": primary.get("base_url"),
                 "provider": primary.get("provider"),
                 "api_mode": primary.get("api_mode"),
-                "command": primary.get("command"),
-                "args": list(primary.get("args") or []),
             },
             "label": None,
             "signature": (
@@ -169,8 +163,6 @@ def resolve_turn_route(user_message: str, routing_config: Optional[Dict[str, Any
                 primary.get("provider"),
                 primary.get("base_url"),
                 primary.get("api_mode"),
-                primary.get("command"),
-                tuple(primary.get("args") or ()),
             ),
         }
 
@@ -181,8 +173,6 @@ def resolve_turn_route(user_message: str, routing_config: Optional[Dict[str, Any
             "base_url": runtime.get("base_url"),
             "provider": runtime.get("provider"),
             "api_mode": runtime.get("api_mode"),
-            "command": runtime.get("command"),
-            "args": list(runtime.get("args") or []),
         },
         "label": f"smart route → {route.get('model')} ({runtime.get('provider')})",
         "signature": (
@@ -190,7 +180,5 @@ def resolve_turn_route(user_message: str, routing_config: Optional[Dict[str, Any
             runtime.get("provider"),
             runtime.get("base_url"),
             runtime.get("api_mode"),
-            runtime.get("command"),
-            tuple(runtime.get("args") or ()),
         ),
     }

batch_runner.py

@@ -128,7 +128,6 @@ def _extract_tool_stats(messages: List[Dict[str, Any]]) -> Dict[str, Dict[str, i
         # Track tool calls from assistant messages
         if msg["role"] == "assistant" and "tool_calls" in msg and msg["tool_calls"]:
             for tool_call in msg["tool_calls"]:
-                if not tool_call or not isinstance(tool_call, dict): continue
                 tool_name = tool_call["function"]["name"]
                 tool_call_id = tool_call["id"]
                 

cli-config.yaml.example

@@ -232,34 +232,19 @@ browser:
 # 1. Tracks actual token usage from API responses (not estimates)
 # 2. When prompt_tokens >= threshold% of model's context_length, triggers compression
 # 3. Protects first 3 turns (system prompt, initial request, first response)
-# 4. Protects last N turns (default 20 messages = ~10 full turns of recent context)
+# 4. Protects last 4 turns (recent context is most relevant)
 # 5. Summarizes middle turns using a fast/cheap model
 # 6. Inserts summary as a user message, continues conversation seamlessly
 #
-# Post-compression tail budget is target_ratio × threshold × context_length:
-#   200K context, threshold 0.50, ratio 0.20 → 20K tokens of recent tail preserved
-#   1M   context, threshold 0.50, ratio 0.20 → 100K tokens of recent tail preserved
-#
 compression:
   # Enable automatic context compression (default: true)
   # Set to false if you prefer to manage context manually or want errors on overflow
   enabled: true
   
-  # Trigger compression at this % of model's context limit (default: 0.50 = 50%)
+  # Trigger compression at this % of model's context limit (default: 0.85 = 85%)
   # Lower values = more aggressive compression, higher values = compress later
-  threshold: 0.50
+  threshold: 0.85
   
-  # Fraction of the threshold to preserve as recent tail (default: 0.20 = 20%)
-  # e.g. 20% of 50% threshold = 10% of total context kept as recent messages.
-  # Summary output is separately capped at 12K tokens (Gemini output limit).
-  # Range: 0.10 - 0.80
-  target_ratio: 0.20
-
-  # Number of most-recent messages to always preserve (default: 20 ≈ 10 full turns)
-  # Higher values keep more recent conversation intact at the cost of more aggressive
-  # compression of older turns.
-  protect_last_n: 20
-
   # Model to use for generating summaries (fast/cheap recommended)
   # This model compresses the middle turns into a concise summary.
   # IMPORTANT: it receives the full middle section of the conversation, so it
@@ -439,7 +424,7 @@ agent:
 # Toolsets
 # =============================================================================
 # Control which tools the agent has access to.
-# Use `hermes tools` to interactively enable/disable tools per platform.
+# Use "all" to enable everything, or specify individual toolsets.
 
 # =============================================================================
 # Platform Toolsets (per-platform tool configuration)
@@ -548,11 +533,53 @@ platform_toolsets:
 #   debugging    - terminal + web + file (for troubleshooting)
 #   safe         - web + vision + moa (no terminal access)
 
-# NOTE: The top-level "toolsets" key is deprecated and ignored.
-# Tool configuration is managed per-platform via platform_toolsets above.
-# Use `hermes tools` to configure interactively, or edit platform_toolsets directly.
-#
-# CLI override: hermes chat --toolsets terminal,web,file
+# -----------------------------------------------------------------------------
+# OPTION 1: Enable all tools (default)
+# -----------------------------------------------------------------------------
+toolsets:
+  - all
+
+# -----------------------------------------------------------------------------
+# OPTION 2: Minimal - just web search and terminal
+# Great for: Simple coding tasks, quick lookups
+# -----------------------------------------------------------------------------
+# toolsets:
+#   - web
+#   - terminal
+
+# -----------------------------------------------------------------------------
+# OPTION 3: Research mode - no execution capabilities
+# Great for: Safe information gathering, research tasks
+# -----------------------------------------------------------------------------
+# toolsets:
+#   - web
+#   - vision
+#   - skills
+
+# -----------------------------------------------------------------------------
+# OPTION 4: Full automation - browser + terminal
+# Great for: Web scraping, automation tasks, testing
+# -----------------------------------------------------------------------------
+# toolsets:
+#   - terminal
+#   - browser
+#   - web
+
+# -----------------------------------------------------------------------------
+# OPTION 5: Creative mode - vision + image generation
+# Great for: Design work, image analysis, creative tasks
+# -----------------------------------------------------------------------------
+# toolsets:
+#   - vision
+#   - image_gen
+#   - web
+
+# -----------------------------------------------------------------------------
+# OPTION 6: Safe mode - no terminal or browser
+# Great for: Restricted environments, untrusted queries
+# -----------------------------------------------------------------------------
+# toolsets:
+#   - safe
 
 # =============================================================================
 # MCP (Model Context Protocol) Servers
@@ -711,8 +738,8 @@ display:
   # Stream tokens to the terminal as they arrive instead of waiting for the
   # full response. The response box opens on first token and text appears
   # line-by-line. Tool calls are still captured silently.
-  # Stream tokens to the terminal in real-time. Disable to wait for full responses.
-  streaming: true
+  # Disabled by default — enable to try the streaming UX.
+  streaming: false
 
   # ───────────────────────────────────────────────────────────────────────────
   # Skin / Theme

cron/jobs.py

@@ -34,7 +34,6 @@ HERMES_DIR = Path(os.getenv("HERMES_HOME", Path.home() / ".hermes"))
 CRON_DIR = HERMES_DIR / "cron"
 JOBS_FILE = CRON_DIR / "jobs.json"
 OUTPUT_DIR = CRON_DIR / "output"
-ONESHOT_GRACE_SECONDS = 120
 
 
 def _normalize_skill_list(skill: Optional[str] = None, skills: Optional[Any] = None) -> List[str]:
@@ -221,65 +220,6 @@ def _ensure_aware(dt: datetime) -> datetime:
     return dt.astimezone(target_tz)
 
 
-def _recoverable_oneshot_run_at(
-    schedule: Dict[str, Any],
-    now: datetime,
-    *,
-    last_run_at: Optional[str] = None,
-) -> Optional[str]:
-    """Return a one-shot run time if it is still eligible to fire.
-
-    One-shot jobs get a small grace window so jobs created a few seconds after
-    their requested minute still run on the next tick. Once a one-shot has
-    already run, it is never eligible again.
-    """
-    if schedule.get("kind") != "once":
-        return None
-    if last_run_at:
-        return None
-
-    run_at = schedule.get("run_at")
-    if not run_at:
-        return None
-
-    run_at_dt = _ensure_aware(datetime.fromisoformat(run_at))
-    if run_at_dt >= now - timedelta(seconds=ONESHOT_GRACE_SECONDS):
-        return run_at
-    return None
-
-
-def _compute_grace_seconds(schedule: dict) -> int:
-    """Compute how late a job can be and still catch up instead of fast-forwarding.
-
-    Uses half the schedule period, clamped between 120 seconds and 2 hours.
-    This ensures daily jobs can catch up if missed by up to 2 hours,
-    while frequent jobs (every 5-10 min) still fast-forward quickly.
-    """
-    MIN_GRACE = 120
-    MAX_GRACE = 7200  # 2 hours
-
-    kind = schedule.get("kind")
-
-    if kind == "interval":
-        period_seconds = schedule.get("minutes", 1) * 60
-        grace = period_seconds // 2
-        return max(MIN_GRACE, min(grace, MAX_GRACE))
-
-    if kind == "cron" and HAS_CRONITER:
-        try:
-            now = _hermes_now()
-            cron = croniter(schedule["expr"], now)
-            first = cron.get_next(datetime)
-            second = cron.get_next(datetime)
-            period_seconds = int((second - first).total_seconds())
-            grace = period_seconds // 2
-            return max(MIN_GRACE, min(grace, MAX_GRACE))
-        except Exception:
-            pass
-
-    return MIN_GRACE
-
-
 def compute_next_run(schedule: Dict[str, Any], last_run_at: Optional[str] = None) -> Optional[str]:
     """
     Compute the next run time for a schedule.
@@ -289,7 +229,9 @@ def compute_next_run(schedule: Dict[str, Any], last_run_at: Optional[str] = None
     now = _hermes_now()
 
     if schedule["kind"] == "once":
-        return _recoverable_oneshot_run_at(schedule, now, last_run_at=last_run_at)
+        run_at = _ensure_aware(datetime.fromisoformat(schedule["run_at"]))
+        # If in the future, return it; if in the past, no more runs
+        return schedule["run_at"] if run_at > now else None
 
     elif schedule["kind"] == "interval":
         minutes = schedule["minutes"]
@@ -383,10 +325,6 @@ def create_job(
     """
     parsed_schedule = parse_schedule(schedule)
 
-    # Normalize repeat: treat 0 or negative values as None (infinite)
-    if repeat is not None and repeat <= 0:
-        repeat = None
-
     # Auto-set repeat=1 for one-shot schedules if not specified
     if parsed_schedule["kind"] == "once" and repeat is None:
         repeat = 1
@@ -575,7 +513,7 @@ def mark_job_run(job_id: str, success: bool, error: Optional[str] = None):
                 # Check if we've hit the repeat limit
                 times = job["repeat"].get("times")
                 completed = job["repeat"]["completed"]
-                if times is not None and times > 0 and completed >= times:
+                if times is not None and completed >= times:
                     # Remove the job (limit reached)
                     jobs.pop(i)
                     save_jobs(jobs)
@@ -617,26 +555,7 @@ def get_due_jobs() -> List[Dict[str, Any]]:
 
         next_run = job.get("next_run_at")
         if not next_run:
-            recovered_next = _recoverable_oneshot_run_at(
-                job.get("schedule", {}),
-                now,
-                last_run_at=job.get("last_run_at"),
-            )
-            if not recovered_next:
-                continue
-
-            job["next_run_at"] = recovered_next
-            next_run = recovered_next
-            logger.info(
-                "Job '%s' had no next_run_at; recovering one-shot run at %s",
-                job.get("name", job["id"]),
-                recovered_next,
-            )
-            for rj in raw_jobs:
-                if rj["id"] == job["id"]:
-                    rj["next_run_at"] = recovered_next
-                    needs_save = True
-                    break
+            continue
 
         next_run_dt = _ensure_aware(datetime.fromisoformat(next_run))
         if next_run_dt <= now:
@@ -646,18 +565,16 @@ def get_due_jobs() -> List[Dict[str, Any]]:
             # For recurring jobs, check if the scheduled time is stale
             # (gateway was down and missed the window). Fast-forward to
             # the next future occurrence instead of firing a stale run.
-            grace = _compute_grace_seconds(schedule)
-            if kind in ("cron", "interval") and (now - next_run_dt).total_seconds() > grace:
-                # Job is past its catch-up grace window — this is a stale missed run.
-                # Grace scales with schedule period: daily=2h, hourly=30m, 10min=5m.
+            if kind in ("cron", "interval") and (now - next_run_dt).total_seconds() > 120:
+                # More than 2 minutes late — this is a missed run, not a current one.
+                # Recompute next_run_at to the next future occurrence.
                 new_next = compute_next_run(schedule, now.isoformat())
                 if new_next:
                     logger.info(
-                        "Job '%s' missed its scheduled time (%s, grace=%ds). "
+                        "Job '%s' missed its scheduled time (%s). "
                         "Fast-forwarding to next run: %s",
                         job.get("name", job["id"]),
                         next_run,
-                        grace,
                         new_next,
                     )
                     # Update the job in storage

cron/scheduler.py

@@ -80,16 +80,11 @@ def _resolve_delivery_target(job: dict) -> Optional[dict]:
         }
 
     if ":" in deliver:
-        platform_name, rest = deliver.split(":", 1)
-        # Check for thread_id suffix (e.g. "telegram:-1003724596514:17")
-        if ":" in rest:
-            chat_id, thread_id = rest.split(":", 1)
-        else:
-            chat_id, thread_id = rest, None
+        platform_name, chat_id = deliver.split(":", 1)
         return {
             "platform": platform_name,
             "chat_id": chat_id,
-            "thread_id": thread_id,
+            "thread_id": None,
         }
 
     platform_name = deliver
@@ -141,10 +136,6 @@ def _deliver_result(job: dict, content: str) -> None:
         "slack": Platform.SLACK,
         "whatsapp": Platform.WHATSAPP,
         "signal": Platform.SIGNAL,
-        "matrix": Platform.MATRIX,
-        "mattermost": Platform.MATTERMOST,
-        "homeassistant": Platform.HOMEASSISTANT,
-        "dingtalk": Platform.DINGTALK,
         "email": Platform.EMAIL,
         "sms": Platform.SMS,
     }
@@ -164,29 +155,15 @@ def _deliver_result(job: dict, content: str) -> None:
         logger.warning("Job '%s': platform '%s' not configured/enabled", job["id"], platform_name)
         return
 
-    # Wrap the content so the user knows this is a cron delivery and that
-    # the interactive agent has no visibility into it.
-    task_name = job.get("name", job["id"])
-    wrapped = (
-        f"Cronjob Response: {task_name}\n"
-        f"-------------\n\n"
-        f"{content}\n\n"
-        f"Note: The agent cannot see this message, and therefore cannot respond to it."
-    )
-
     # Run the async send in a fresh event loop (safe from any thread)
-    coro = _send_to_platform(platform, pconfig, chat_id, wrapped, thread_id=thread_id)
     try:
-        result = asyncio.run(coro)
+        result = asyncio.run(_send_to_platform(platform, pconfig, chat_id, content, thread_id=thread_id))
     except RuntimeError:
-        # asyncio.run() checks for a running loop before awaiting the coroutine;
-        # when it raises, the original coro was never started — close it to
-        # prevent "coroutine was never awaited" RuntimeWarning, then retry in a
-        # fresh thread that has no running loop.
-        coro.close()
+        # asyncio.run() fails if there's already a running loop in this thread;
+        # spin up a new thread to avoid that.
         import concurrent.futures
         with concurrent.futures.ThreadPoolExecutor(max_workers=1) as pool:
-            future = pool.submit(asyncio.run, _send_to_platform(platform, pconfig, chat_id, wrapped, thread_id=thread_id))
+            future = pool.submit(asyncio.run, _send_to_platform(platform, pconfig, chat_id, content, thread_id=thread_id))
             result = future.result(timeout=30)
     except Exception as e:
         logger.error("Job '%s': delivery to %s:%s failed: %s", job["id"], platform_name, chat_id, e)
@@ -196,6 +173,12 @@ def _deliver_result(job: dict, content: str) -> None:
         logger.error("Job '%s': delivery error: %s", job["id"], result["error"])
     else:
         logger.info("Job '%s': delivered to %s:%s", job["id"], platform_name, chat_id)
+        # Mirror the delivered content into the target's gateway session
+        try:
+            from gateway.mirror import mirror_to_session
+            mirror_to_session(platform_name, chat_id, content, source_label="cron", thread_id=thread_id)
+        except Exception as e:
+            logger.warning("Job '%s': mirror_to_session failed: %s", job["id"], e)
 
 
 def _build_job_prompt(job: dict) -> str:
@@ -224,14 +207,11 @@ def _build_job_prompt(job: dict) -> str:
     from tools.skills_tool import skill_view
 
     parts = []
-    skipped: list[str] = []
     for skill_name in skill_names:
         loaded = json.loads(skill_view(skill_name))
         if not loaded.get("success"):
             error = loaded.get("error") or f"Failed to load skill '{skill_name}'"
-            logger.warning("Cron job '%s': skill not found, skipping — %s", job.get("name", job.get("id")), error)
-            skipped.append(skill_name)
-            continue
+            raise RuntimeError(error)
 
         content = str(loaded.get("content") or "").strip()
         if parts:
@@ -244,15 +224,6 @@ def _build_job_prompt(job: dict) -> str:
             ]
         )
 
-    if skipped:
-        notice = (
-            f"[SYSTEM: The following skill(s) were listed for this job but could not be found "
-            f"and were skipped: {', '.join(skipped)}. "
-            f"Start your response with a brief notice so the user is aware, e.g.: "
-            f"'⚠️ Skill(s) not found and skipped: {', '.join(skipped)}']"
-        )
-        parts.insert(0, notice)
-
     if prompt:
         parts.extend(["", f"The user has provided the following instruction alongside the skill invocation: {prompt}"])
     return "\n".join(parts)
@@ -388,8 +359,6 @@ def run_job(job: dict) -> tuple[bool, str, str, Optional[str]]:
                 "base_url": runtime.get("base_url"),
                 "provider": runtime.get("provider"),
                 "api_mode": runtime.get("api_mode"),
-                "command": runtime.get("command"),
-                "args": list(runtime.get("args") or []),
             },
         )
 
@@ -399,8 +368,6 @@ def run_job(job: dict) -> tuple[bool, str, str, Optional[str]]:
             base_url=turn_route["runtime"].get("base_url"),
             provider=turn_route["runtime"].get("provider"),
             api_mode=turn_route["runtime"].get("api_mode"),
-            acp_command=turn_route["runtime"].get("command"),
-            acp_args=turn_route["runtime"].get("args"),
             max_iterations=max_iterations,
             reasoning_config=reasoning_config,
             prefill_messages=prefill_messages,
@@ -408,7 +375,7 @@ def run_job(job: dict) -> tuple[bool, str, str, Optional[str]]:
             providers_ignored=pr.get("ignore"),
             providers_order=pr.get("order"),
             provider_sort=pr.get("sort"),
-            disabled_toolsets=["cronjob", "messaging", "clarify"],
+            disabled_toolsets=["cronjob"],
             quiet_mode=True,
             platform="cron",
             session_id=f"cron_{job_id}_{_hermes_now().strftime('%Y%m%d_%H%M%S')}",
@@ -417,10 +384,9 @@ def run_job(job: dict) -> tuple[bool, str, str, Optional[str]]:
         
         result = agent.run_conversation(prompt)
         
-        final_response = result.get("final_response", "") or ""
-        # Use a separate variable for log display; keep final_response clean
-        # for delivery logic (empty response = no delivery).
-        logged_response = final_response if final_response else "(No response generated)"
+        final_response = result.get("final_response", "")
+        if not final_response:
+            final_response = "(No response generated)"
         
         output = f"""# Cron Job: {job_name}
 
@@ -434,7 +400,7 @@ def run_job(job: dict) -> tuple[bool, str, str, Optional[str]]:
 
 ## Response
 
-{logged_response}
+{final_response}
 """
         
         logger.info("Job '%s' completed successfully", job_name)

environments/README.md

@@ -101,7 +101,7 @@ Available methods:
 
 ### Patches (`patches.py`)
 
-**Problem**: Some hermes-agent tools use `asyncio.run()` internally (e.g., the Modal backend via SWE-ReX). This crashes when called from inside Atropos's event loop because `asyncio.run()` cannot be nested.
+**Problem**: Some hermes-agent tools use `asyncio.run()` internally (e.g., mini-swe-agent's Modal backend via SWE-ReX). This crashes when called from inside Atropos's event loop because `asyncio.run()` cannot be nested.
 
 **Solution**: `patches.py` monkey-patches `SwerexModalEnvironment` to use a dedicated background thread (`_AsyncWorker`) with its own event loop. The calling code sees the same sync interface, but internally the async work happens on a separate thread that doesn't conflict with Atropos's loop.
 

environments/agent_loop.py

@@ -23,7 +23,7 @@ from typing import Any, Dict, List, Optional, Set
 from model_tools import handle_function_call
 
 # Thread pool for running sync tool calls that internally use asyncio.run()
-# (e.g., the Modal/Docker/Daytona terminal backends). Running them in a separate
+# (e.g., mini-swe-agent's modal/docker/daytona backends). Running them in a separate
 # thread gives them a clean event loop so they don't deadlock inside Atropos's loop.
 # Size must be large enough for concurrent eval tasks (e.g., 89 TB2 tasks all
 # making tool calls). Too small = thread pool starvation, tasks queue for minutes.
@@ -346,89 +346,78 @@ class HermesAgentLoop:
                             tool_name, turn + 1,
                         )
                     else:
-                        # Parse arguments
+                        # Parse arguments and dispatch
                         try:
                             args = json.loads(tool_args_raw)
-                        except json.JSONDecodeError as e:
-                            args = None
-                            tool_result = json.dumps(
-                                {"error": f"Invalid JSON in tool arguments: {e}. Please retry with valid JSON."}
-                            )
-                            tool_errors.append(ToolError(
-                                turn=turn + 1, tool_name=tool_name,
-                                arguments=tool_args_raw[:200],
-                                error=f"Invalid JSON: {e}",
-                                tool_result=tool_result,
-                            ))
+                        except json.JSONDecodeError:
+                            args = {}
                             logger.warning(
                                 "Invalid JSON in tool call arguments for '%s': %s",
                                 tool_name, tool_args_raw[:200],
                             )
 
-                        # Dispatch tool only if arguments parsed successfully
-                        if args is not None:
-                            try:
-                                if tool_name == "terminal":
-                                    backend = os.getenv("TERMINAL_ENV", "local")
-                                    cmd_preview = args.get("command", "")[:80]
-                                    logger.info(
-                                        "[%s] $ %s", self.task_id[:8], cmd_preview,
-                                    )
-
-                                tool_submit_time = _time.monotonic()
-
-                                # Todo tool -- handle locally (needs per-loop TodoStore)
-                                if tool_name == "todo":
-                                    tool_result = _todo_tool(
-                                        todos=args.get("todos"),
-                                        merge=args.get("merge", False),
-                                        store=_todo_store,
-                                    )
-                                    tool_elapsed = _time.monotonic() - tool_submit_time
-                                elif tool_name == "memory":
-                                    tool_result = json.dumps({"error": "Memory is not available in RL environments."})
-                                    tool_elapsed = _time.monotonic() - tool_submit_time
-                                elif tool_name == "session_search":
-                                    tool_result = json.dumps({"error": "Session search is not available in RL environments."})
-                                    tool_elapsed = _time.monotonic() - tool_submit_time
-                                else:
-                                    # Run tool calls in a thread pool so backends that
-                                    # use asyncio.run() internally (modal, docker, daytona) get
-                                    # a clean event loop instead of deadlocking.
-                                    loop = asyncio.get_event_loop()
-                                    # Capture current tool_name/args for the lambda
-                                    _tn, _ta, _tid = tool_name, args, self.task_id
-                                    tool_result = await loop.run_in_executor(
-                                        _tool_executor,
-                                        lambda: handle_function_call(
-                                            _tn, _ta, task_id=_tid,
-                                            user_task=_user_task,
-                                        ),
-                                    )
-                                    tool_elapsed = _time.monotonic() - tool_submit_time
-
-                                # Log slow tools and thread pool stats for debugging
-                                pool_active = _tool_executor._work_queue.qsize()
-                                if tool_elapsed > 30:
-                                    logger.warning(
-                                        "[%s] turn %d: %s took %.1fs (pool queue=%d)",
-                                        self.task_id[:8], turn + 1, tool_name,
-                                        tool_elapsed, pool_active,
-                                    )
-                            except Exception as e:
-                                tool_result = json.dumps(
-                                    {"error": f"Tool execution failed: {type(e).__name__}: {str(e)}"}
+                        try:
+                            if tool_name == "terminal":
+                                backend = os.getenv("TERMINAL_ENV", "local")
+                                cmd_preview = args.get("command", "")[:80]
+                                logger.info(
+                                    "[%s] $ %s", self.task_id[:8], cmd_preview,
                                 )
-                                tool_errors.append(ToolError(
-                                    turn=turn + 1, tool_name=tool_name,
-                                    arguments=tool_args_raw[:200],
-                                    error=f"{type(e).__name__}: {str(e)}",
-                                    tool_result=tool_result,
-                                ))
-                                logger.error(
-                                    "Tool '%s' execution failed on turn %d: %s",
-                                    tool_name, turn + 1, e,
+
+                            tool_submit_time = _time.monotonic()
+
+                            # Todo tool -- handle locally (needs per-loop TodoStore)
+                            if tool_name == "todo":
+                                tool_result = _todo_tool(
+                                    todos=args.get("todos"),
+                                    merge=args.get("merge", False),
+                                    store=_todo_store,
                                 )
+                                tool_elapsed = _time.monotonic() - tool_submit_time
+                            elif tool_name == "memory":
+                                tool_result = json.dumps({"error": "Memory is not available in RL environments."})
+                                tool_elapsed = _time.monotonic() - tool_submit_time
+                            elif tool_name == "session_search":
+                                tool_result = json.dumps({"error": "Session search is not available in RL environments."})
+                                tool_elapsed = _time.monotonic() - tool_submit_time
+                            else:
+                                # Run tool calls in a thread pool so backends that
+                                # use asyncio.run() internally (modal, docker, daytona) get
+                                # a clean event loop instead of deadlocking.
+                                loop = asyncio.get_event_loop()
+                                # Capture current tool_name/args for the lambda
+                                _tn, _ta, _tid = tool_name, args, self.task_id
+                                tool_result = await loop.run_in_executor(
+                                    _tool_executor,
+                                    lambda: handle_function_call(
+                                        _tn, _ta, task_id=_tid,
+                                        user_task=_user_task,
+                                    ),
+                                )
+                                tool_elapsed = _time.monotonic() - tool_submit_time
+
+                            # Log slow tools and thread pool stats for debugging
+                            pool_active = _tool_executor._work_queue.qsize()
+                            if tool_elapsed > 30:
+                                logger.warning(
+                                    "[%s] turn %d: %s took %.1fs (pool queue=%d)",
+                                    self.task_id[:8], turn + 1, tool_name,
+                                    tool_elapsed, pool_active,
+                                )
+                        except Exception as e:
+                            tool_result = json.dumps(
+                                {"error": f"Tool execution failed: {type(e).__name__}: {str(e)}"}
+                            )
+                            tool_errors.append(ToolError(
+                                turn=turn + 1, tool_name=tool_name,
+                                arguments=tool_args_raw[:200],
+                                error=f"{type(e).__name__}: {str(e)}",
+                                tool_result=tool_result,
+                            ))
+                            logger.error(
+                                "Tool '%s' execution failed on turn %d: %s",
+                                tool_name, turn + 1, e,
+                            )
 
                         # Also check if the tool returned an error in its JSON result
                         try:

environments/patches.py

@@ -2,41 +2,203 @@
 Monkey patches for making hermes-agent tools work inside async frameworks (Atropos).
 
 Problem:
-    Some tools use asyncio.run() internally (e.g., Modal backend via SWE-ReX,
+    Some tools use asyncio.run() internally (e.g., mini-swe-agent's Modal backend,
     web_extract). This crashes when called from inside Atropos's event loop because
     asyncio.run() can't be nested.
 
 Solution:
-    The Modal environment (tools/environments/modal.py) now uses a dedicated
-    _AsyncWorker thread internally, making it safe for both CLI and Atropos use.
-    No monkey-patching is required.
+    Replace the problematic methods with versions that use a dedicated background
+    thread with its own event loop. The calling code sees the same sync interface --
+    call a function, get a result -- but internally the async work happens on a
+    separate thread that doesn't conflict with Atropos's loop.
 
-    This module is kept for backward compatibility — apply_patches() is now a no-op.
+    These patches are safe for normal CLI use too: when there's no running event
+    loop, the behavior is identical (the background thread approach works regardless).
+
+What gets patched:
+    - SwerexModalEnvironment.__init__ -- creates Modal deployment on a background thread
+    - SwerexModalEnvironment.execute -- runs commands on the same background thread
+    - SwerexModalEnvironment.stop -- stops deployment on the background thread
 
 Usage:
     Call apply_patches() once at import time (done automatically by hermes_base_env.py).
-    This is idempotent — calling it multiple times is safe.
+    This is idempotent -- calling it multiple times is safe.
 """
 
+import asyncio
 import logging
+import threading
+from typing import Any
 
 logger = logging.getLogger(__name__)
 
 _patches_applied = False
 
 
-def apply_patches():
-    """Apply all monkey patches needed for Atropos compatibility.
+class _AsyncWorker:
+    """
+    A dedicated background thread with its own event loop.
 
-    Now a no-op — Modal async safety is built directly into ModalEnvironment.
-    Safe to call multiple times.
+    Allows sync code to submit async coroutines and block for results,
+    even when called from inside another running event loop. Used to
+    bridge sync tool interfaces with async backends (Modal, SWE-ReX).
+    """
+
+    def __init__(self):
+        self._loop: asyncio.AbstractEventLoop = None
+        self._thread: threading.Thread = None
+        self._started = threading.Event()
+
+    def start(self):
+        """Start the background event loop thread."""
+        self._thread = threading.Thread(target=self._run_loop, daemon=True)
+        self._thread.start()
+        self._started.wait(timeout=30)
+
+    def _run_loop(self):
+        """Background thread entry point -- runs the event loop forever."""
+        self._loop = asyncio.new_event_loop()
+        asyncio.set_event_loop(self._loop)
+        self._started.set()
+        self._loop.run_forever()
+
+    def run_coroutine(self, coro, timeout=600):
+        """
+        Submit a coroutine to the background loop and block until it completes.
+
+        Safe to call from any thread, including threads that already have
+        a running event loop.
+        """
+        if self._loop is None or self._loop.is_closed():
+            raise RuntimeError("AsyncWorker loop is not running")
+        future = asyncio.run_coroutine_threadsafe(coro, self._loop)
+        return future.result(timeout=timeout)
+
+    def stop(self):
+        """Stop the background event loop and join the thread."""
+        if self._loop and self._loop.is_running():
+            self._loop.call_soon_threadsafe(self._loop.stop)
+        if self._thread:
+            self._thread.join(timeout=10)
+
+
+def _patch_swerex_modal():
+    """
+    Monkey patch SwerexModalEnvironment to use a background thread event loop
+    instead of asyncio.run(). This makes it safe to call from inside Atropos's
+    async event loop.
+
+    The patched methods have the exact same interface and behavior -- the only
+    difference is HOW the async work is executed internally.
+    """
+    try:
+        from minisweagent.environments.extra.swerex_modal import (
+            SwerexModalEnvironment,
+            SwerexModalEnvironmentConfig,
+        )
+        from swerex.deployment.modal import ModalDeployment
+        from swerex.runtime.abstract import Command as RexCommand
+    except ImportError:
+        # mini-swe-agent or swe-rex not installed -- nothing to patch
+        logger.debug("mini-swe-agent Modal backend not available, skipping patch")
+        return
+
+    # Save original methods so we can refer to config handling
+    _original_init = SwerexModalEnvironment.__init__
+
+    def _patched_init(self, **kwargs):
+        """Patched __init__: creates Modal deployment on a background thread."""
+        self.config = SwerexModalEnvironmentConfig(**kwargs)
+
+        # Start a dedicated event loop thread for all Modal async operations
+        self._worker = _AsyncWorker()
+        self._worker.start()
+
+        # Pre-build a modal.Image with pip fix for Modal's legacy image builder.
+        # Modal requires `python -m pip` to work during image build, but some
+        # task images (e.g., TBLite's broken-python) have intentionally broken pip.
+        # Fix: remove stale pip dist-info and reinstall via ensurepip before Modal
+        # tries to use it. This is a no-op for images where pip already works.
+        import modal as _modal
+        image_spec = self.config.image
+        if isinstance(image_spec, str):
+            image_spec = _modal.Image.from_registry(
+                image_spec,
+                setup_dockerfile_commands=[
+                    "RUN rm -rf /usr/local/lib/python*/site-packages/pip* 2>/dev/null; "
+                    "python -m ensurepip --upgrade --default-pip 2>/dev/null || true",
+                ],
+            )
+
+        # Create AND start the deployment entirely on the worker's loop/thread
+        # so all gRPC channels and async state are bound to that loop
+        async def _create_and_start():
+            deployment = ModalDeployment(
+                image=image_spec,
+                startup_timeout=self.config.startup_timeout,
+                runtime_timeout=self.config.runtime_timeout,
+                deployment_timeout=self.config.deployment_timeout,
+                install_pipx=self.config.install_pipx,
+                modal_sandbox_kwargs=self.config.modal_sandbox_kwargs,
+            )
+            await deployment.start()
+            return deployment
+
+        self.deployment = self._worker.run_coroutine(_create_and_start())
+
+    def _patched_execute(self, command: str, cwd: str = "", *, timeout: int | None = None) -> dict[str, Any]:
+        """Patched execute: runs commands on the background thread's loop."""
+        async def _do_execute():
+            return await self.deployment.runtime.execute(
+                RexCommand(
+                    command=command,
+                    shell=True,
+                    check=False,
+                    cwd=cwd or self.config.cwd,
+                    timeout=timeout or self.config.timeout,
+                    merge_output_streams=True,
+                    env=self.config.env if self.config.env else None,
+                )
+            )
+
+        output = self._worker.run_coroutine(_do_execute())
+        return {
+            "output": output.stdout,
+            "returncode": output.exit_code,
+        }
+
+    def _patched_stop(self):
+        """Patched stop: stops deployment on the background thread, then stops the thread."""
+        try:
+            self._worker.run_coroutine(
+                asyncio.wait_for(self.deployment.stop(), timeout=10),
+                timeout=15,
+            )
+        except Exception:
+            pass
+        finally:
+            self._worker.stop()
+
+    # Apply the patches
+    SwerexModalEnvironment.__init__ = _patched_init
+    SwerexModalEnvironment.execute = _patched_execute
+    SwerexModalEnvironment.stop = _patched_stop
+
+    logger.debug("Patched SwerexModalEnvironment for async-safe operation")
+
+
+def apply_patches():
+    """
+    Apply all monkey patches needed for Atropos compatibility.
+
+    Safe to call multiple times -- patches are only applied once.
+    Safe for normal CLI use -- patched code works identically when
+    there is no running event loop.
     """
     global _patches_applied
     if _patches_applied:
         return
 
-    # Modal async-safety is now built into tools/environments/modal.py
-    # via the _AsyncWorker class. No monkey-patching needed.
-    logger.debug("apply_patches() called — no patches needed (async safety is built-in)")
+    _patch_swerex_modal()
 
     _patches_applied = True

environments/tool_call_parsers/mistral_parser.py

@@ -10,6 +10,7 @@ The [TOOL_CALLS] token is the bot_token used by Mistral models.
 """
 
 import json
+import re
 import uuid
 from typing import List, Optional
 
@@ -41,6 +42,9 @@ class MistralToolCallParser(ToolCallParser):
     # The [TOOL_CALLS] token -- may appear as different strings depending on tokenizer
     BOT_TOKEN = "[TOOL_CALLS]"
 
+    # Fallback regex for pre-v11 format when JSON parsing fails
+    TOOL_CALL_REGEX = re.compile(r"\[?\s*(\{.*?\})\s*\]?", re.DOTALL)
+
     def parse(self, text: str) -> ParseResult:
         if self.BOT_TOKEN not in text:
             return text, None
@@ -67,13 +71,6 @@ class MistralToolCallParser(ToolCallParser):
                     tool_name = raw[:brace_idx].strip()
                     args_str = raw[brace_idx:]
 
-                    # Validate and clean the JSON arguments
-                    try:
-                        parsed_args = json.loads(args_str)
-                        args_str = json.dumps(parsed_args, ensure_ascii=False)
-                    except json.JSONDecodeError:
-                        pass  # Keep raw if parsing fails
-
                     tool_calls.append(
                         ChatCompletionMessageToolCall(
                             id=_generate_mistral_id(),
@@ -103,14 +100,13 @@ class MistralToolCallParser(ToolCallParser):
                             )
                         )
                 except json.JSONDecodeError:
-                    # Fallback: extract JSON objects using raw_decode
-                    decoder = json.JSONDecoder()
-                    idx = 0
-                    while idx < len(first_raw):
-                        try:
-                            obj, end_idx = decoder.raw_decode(first_raw, idx)
-                            if isinstance(obj, dict) and "name" in obj:
-                                args = obj.get("arguments", {})
+                    # Fallback regex extraction
+                    match = self.TOOL_CALL_REGEX.findall(first_raw)
+                    if match:
+                        for raw_json in match:
+                            try:
+                                tc = json.loads(raw_json)
+                                args = tc.get("arguments", {})
                                 if isinstance(args, dict):
                                     args = json.dumps(args, ensure_ascii=False)
                                 tool_calls.append(
@@ -118,13 +114,12 @@ class MistralToolCallParser(ToolCallParser):
                                         id=_generate_mistral_id(),
                                         type="function",
                                         function=Function(
-                                            name=obj["name"], arguments=args
+                                            name=tc["name"], arguments=args
                                         ),
                                     )
                                 )
-                            idx = end_idx
-                        except json.JSONDecodeError:
-                            idx += 1
+                            except (json.JSONDecodeError, KeyError):
+                                continue
 
             if not tool_calls:
                 return text, None

flake.lock

@@ -1,181 +0,0 @@
-{
-  "nodes": {
-    "flake-parts": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1772408722,
-        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1751274312,
-        "narHash": "sha256-/bVBlRpECLVzjV19t5KMdMFWSwKLtb5RyXdjz3LJT+g=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "50ab793786d9de88ee30ec4e4c24fb4236fc2674",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-24.11",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "pyproject-build-systems": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "pyproject-nix": "pyproject-nix",
-        "uv2nix": "uv2nix"
-      },
-      "locked": {
-        "lastModified": 1772555609,
-        "narHash": "sha256-3BA3HnUvJSbHJAlJj6XSy0Jmu7RyP2gyB/0fL7XuEDo=",
-        "owner": "pyproject-nix",
-        "repo": "build-system-pkgs",
-        "rev": "c37f66a953535c394244888598947679af231863",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pyproject-nix",
-        "repo": "build-system-pkgs",
-        "type": "github"
-      }
-    },
-    "pyproject-nix": {
-      "inputs": {
-        "nixpkgs": [
-          "pyproject-build-systems",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1769936401,
-        "narHash": "sha256-kwCOegKLZJM9v/e/7cqwg1p/YjjTAukKPqmxKnAZRgA=",
-        "owner": "nix-community",
-        "repo": "pyproject.nix",
-        "rev": "b0d513eeeebed6d45b4f2e874f9afba2021f7812",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "pyproject.nix",
-        "type": "github"
-      }
-    },
-    "pyproject-nix_2": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1772865871,
-        "narHash": "sha256-/ZTSg97aouL0SlPHaokA4r3iuH9QzHVuWPACD2CUCFY=",
-        "owner": "pyproject-nix",
-        "repo": "pyproject.nix",
-        "rev": "e537db02e72d553cea470976b9733581bcf5b3ed",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pyproject-nix",
-        "repo": "pyproject.nix",
-        "type": "github"
-      }
-    },
-    "pyproject-nix_3": {
-      "inputs": {
-        "nixpkgs": [
-          "uv2nix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1771518446,
-        "narHash": "sha256-nFJSfD89vWTu92KyuJWDoTQJuoDuddkJV3TlOl1cOic=",
-        "owner": "pyproject-nix",
-        "repo": "pyproject.nix",
-        "rev": "eb204c6b3335698dec6c7fc1da0ebc3c6df05937",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pyproject-nix",
-        "repo": "pyproject.nix",
-        "type": "github"
-      }
-    },
-    "root": {
-      "inputs": {
-        "flake-parts": "flake-parts",
-        "nixpkgs": "nixpkgs",
-        "pyproject-build-systems": "pyproject-build-systems",
-        "pyproject-nix": "pyproject-nix_2",
-        "uv2nix": "uv2nix_2"
-      }
-    },
-    "uv2nix": {
-      "inputs": {
-        "nixpkgs": [
-          "pyproject-build-systems",
-          "nixpkgs"
-        ],
-        "pyproject-nix": [
-          "pyproject-build-systems",
-          "pyproject-nix"
-        ]
-      },
-      "locked": {
-        "lastModified": 1770770348,
-        "narHash": "sha256-A2GzkmzdYvdgmMEu5yxW+xhossP+txrYb7RuzRaqhlg=",
-        "owner": "pyproject-nix",
-        "repo": "uv2nix",
-        "rev": "5d1b2cb4fe3158043fbafbbe2e46238abbc954b0",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pyproject-nix",
-        "repo": "uv2nix",
-        "type": "github"
-      }
-    },
-    "uv2nix_2": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "pyproject-nix": "pyproject-nix_3"
-      },
-      "locked": {
-        "lastModified": 1773039484,
-        "narHash": "sha256-+boo33KYkJDw9KItpeEXXv8+65f7hHv/earxpcyzQ0I=",
-        "owner": "pyproject-nix",
-        "repo": "uv2nix",
-        "rev": "b68be7cfeacbed9a3fa38a2b5adc0cfb81d9bb1f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pyproject-nix",
-        "repo": "uv2nix",
-        "type": "github"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}

flake.nix

@@ -1,35 +0,0 @@
-{
-  description = "Hermes Agent - AI agent framework by Nous Research";
-
-  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
-    flake-parts = {
-      url = "github:hercules-ci/flake-parts";
-      inputs.nixpkgs-lib.follows = "nixpkgs";
-    };
-    pyproject-nix = {
-      url = "github:pyproject-nix/pyproject.nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    uv2nix = {
-      url = "github:pyproject-nix/uv2nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    pyproject-build-systems = {
-      url = "github:pyproject-nix/build-system-pkgs";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-  };
-
-  outputs = inputs:
-    inputs.flake-parts.lib.mkFlake { inherit inputs; } {
-      systems = [ "x86_64-linux" "aarch64-linux" "aarch64-darwin" ];
-
-      imports = [
-        ./nix/packages.nix
-        ./nix/nixosModules.nix
-        ./nix/checks.nix
-        ./nix/devShell.nix
-      ];
-    };
-}

gateway/config.py

@@ -56,7 +56,6 @@ class Platform(Enum):
     SMS = "sms"
     DINGTALK = "dingtalk"
     API_SERVER = "api_server"
-    WEBHOOK = "webhook"
 
 
 @dataclass
@@ -101,16 +100,12 @@ class SessionResetPolicy:
     mode: str = "both"  # "daily", "idle", "both", or "none"
     at_hour: int = 4  # Hour for daily reset (0-23, local time)
     idle_minutes: int = 1440  # Minutes of inactivity before reset (24 hours)
-    notify: bool = True  # Send a notification to the user when auto-reset occurs
-    notify_exclude_platforms: tuple = ("api_server", "webhook")  # Platforms that don't get reset notifications
     
     def to_dict(self) -> Dict[str, Any]:
         return {
             "mode": self.mode,
             "at_hour": self.at_hour,
             "idle_minutes": self.idle_minutes,
-            "notify": self.notify,
-            "notify_exclude_platforms": list(self.notify_exclude_platforms),
         }
     
     @classmethod
@@ -119,14 +114,10 @@ class SessionResetPolicy:
         mode = data.get("mode")
         at_hour = data.get("at_hour")
         idle_minutes = data.get("idle_minutes")
-        notify = data.get("notify")
-        exclude = data.get("notify_exclude_platforms")
         return cls(
             mode=mode if mode is not None else "both",
             at_hour=at_hour if at_hour is not None else 4,
             idle_minutes=idle_minutes if idle_minutes is not None else 1440,
-            notify=notify if notify is not None else True,
-            notify_exclude_platforms=tuple(exclude) if exclude is not None else ("api_server", "webhook"),
         )
 
 
@@ -138,12 +129,6 @@ class PlatformConfig:
     api_key: Optional[str] = None  # API key if different from token
     home_channel: Optional[HomeChannel] = None
     
-    # Reply threading mode (Telegram/Slack)
-    # - "off": Never thread replies to original message
-    # - "first": Only first chunk threads to user's message (default)
-    # - "all": All chunks in multi-part replies thread to user's message
-    reply_to_mode: str = "first"
-    
     # Platform-specific settings
     extra: Dict[str, Any] = field(default_factory=dict)
     
@@ -151,7 +136,6 @@ class PlatformConfig:
         result = {
             "enabled": self.enabled,
             "extra": self.extra,
-            "reply_to_mode": self.reply_to_mode,
         }
         if self.token:
             result["token"] = self.token
@@ -172,7 +156,6 @@ class PlatformConfig:
             token=data.get("token"),
             api_key=data.get("api_key"),
             home_channel=home_channel,
-            reply_to_mode=data.get("reply_to_mode", "first"),
             extra=data.get("extra", {}),
         )
 
@@ -271,9 +254,6 @@ class GatewayConfig:
             # API Server uses enabled flag only (no token needed)
             elif platform == Platform.API_SERVER:
                 connected.append(platform)
-            # Webhook uses enabled flag only (secrets are per-route)
-            elif platform == Platform.WEBHOOK:
-                connected.append(platform)
         return connected
     
     def get_home_channel(self, platform: Platform) -> Optional[HomeChannel]:
@@ -471,43 +451,18 @@ def load_gateway_config() -> GatewayConfig:
                     "pair",
                 )
 
-            # Merge platforms section from config.yaml into gw_data so that
-            # nested keys like platforms.webhook.extra.routes are loaded.
-            yaml_platforms = yaml_cfg.get("platforms")
+            # Bridge per-platform unauthorized_dm_behavior from config.yaml
             platforms_data = gw_data.setdefault("platforms", {})
             if not isinstance(platforms_data, dict):
                 platforms_data = {}
                 gw_data["platforms"] = platforms_data
-            if isinstance(yaml_platforms, dict):
-                for plat_name, plat_block in yaml_platforms.items():
-                    if not isinstance(plat_block, dict):
-                        continue
-                    existing = platforms_data.get(plat_name, {})
-                    if not isinstance(existing, dict):
-                        existing = {}
-                    # Deep-merge extra dicts so gateway.json defaults survive
-                    merged_extra = {**existing.get("extra", {}), **plat_block.get("extra", {})}
-                    merged = {**existing, **plat_block}
-                    if merged_extra:
-                        merged["extra"] = merged_extra
-                    platforms_data[plat_name] = merged
-                gw_data["platforms"] = platforms_data
             for plat in Platform:
                 if plat == Platform.LOCAL:
                     continue
                 platform_cfg = yaml_cfg.get(plat.value)
                 if not isinstance(platform_cfg, dict):
                     continue
-                # Collect bridgeable keys from this platform section
-                bridged = {}
-                if "unauthorized_dm_behavior" in platform_cfg:
-                    bridged["unauthorized_dm_behavior"] = _normalize_unauthorized_dm_behavior(
-                        platform_cfg.get("unauthorized_dm_behavior"),
-                        gw_data.get("unauthorized_dm_behavior", "pair"),
-                    )
-                if "reply_prefix" in platform_cfg:
-                    bridged["reply_prefix"] = platform_cfg["reply_prefix"]
-                if not bridged:
+                if "unauthorized_dm_behavior" not in platform_cfg:
                     continue
                 plat_data = platforms_data.setdefault(plat.value, {})
                 if not isinstance(plat_data, dict):
@@ -517,7 +472,10 @@ def load_gateway_config() -> GatewayConfig:
                 if not isinstance(extra, dict):
                     extra = {}
                     plat_data["extra"] = extra
-                extra.update(bridged)
+                extra["unauthorized_dm_behavior"] = _normalize_unauthorized_dm_behavior(
+                    platform_cfg.get("unauthorized_dm_behavior"),
+                    gw_data.get("unauthorized_dm_behavior", "pair"),
+                )
 
             # Discord settings → env vars (env vars take precedence)
             discord_cfg = yaml_cfg.get("discord", {})
@@ -531,13 +489,15 @@ def load_gateway_config() -> GatewayConfig:
                     os.environ["DISCORD_FREE_RESPONSE_CHANNELS"] = str(frc)
                 if "auto_thread" in discord_cfg and not os.getenv("DISCORD_AUTO_THREAD"):
                     os.environ["DISCORD_AUTO_THREAD"] = str(discord_cfg["auto_thread"]).lower()
-    except Exception as e:
-        logger.warning(
-            "Failed to process config.yaml — falling back to .env / gateway.json values. "
-            "Check %s for syntax errors. Error: %s",
-            _home / "config.yaml",
-            e,
-        )
+
+            # Bridge whatsapp settings from config.yaml into platform config
+            whatsapp_cfg = yaml_cfg.get("whatsapp", {})
+            if isinstance(whatsapp_cfg, dict) and "reply_prefix" in whatsapp_cfg:
+                if Platform.WHATSAPP not in config.platforms:
+                    config.platforms[Platform.WHATSAPP] = PlatformConfig()
+                config.platforms[Platform.WHATSAPP].extra["reply_prefix"] = whatsapp_cfg["reply_prefix"]
+    except Exception:
+        pass
 
     config = GatewayConfig.from_dict(gw_data)
 
@@ -594,13 +554,6 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
         config.platforms[Platform.TELEGRAM].enabled = True
         config.platforms[Platform.TELEGRAM].token = telegram_token
     
-    # Reply threading mode for Telegram (off/first/all)
-    telegram_reply_mode = os.getenv("TELEGRAM_REPLY_TO_MODE", "").lower()
-    if telegram_reply_mode in ("off", "first", "all"):
-        if Platform.TELEGRAM not in config.platforms:
-            config.platforms[Platform.TELEGRAM] = PlatformConfig()
-        config.platforms[Platform.TELEGRAM].reply_to_mode = telegram_reply_mode
-    
     telegram_home = os.getenv("TELEGRAM_HOME_CHANNEL")
     if telegram_home and Platform.TELEGRAM in config.platforms:
         config.platforms[Platform.TELEGRAM].home_channel = HomeChannel(
@@ -766,7 +719,6 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
     # API Server
     api_server_enabled = os.getenv("API_SERVER_ENABLED", "").lower() in ("true", "1", "yes")
     api_server_key = os.getenv("API_SERVER_KEY", "")
-    api_server_cors_origins = os.getenv("API_SERVER_CORS_ORIGINS", "")
     api_server_port = os.getenv("API_SERVER_PORT")
     api_server_host = os.getenv("API_SERVER_HOST")
     if api_server_enabled or api_server_key:
@@ -775,10 +727,6 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
         config.platforms[Platform.API_SERVER].enabled = True
         if api_server_key:
             config.platforms[Platform.API_SERVER].extra["key"] = api_server_key
-        if api_server_cors_origins:
-            origins = [origin.strip() for origin in api_server_cors_origins.split(",") if origin.strip()]
-            if origins:
-                config.platforms[Platform.API_SERVER].extra["cors_origins"] = origins
         if api_server_port:
             try:
                 config.platforms[Platform.API_SERVER].extra["port"] = int(api_server_port)
@@ -787,22 +735,6 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
         if api_server_host:
             config.platforms[Platform.API_SERVER].extra["host"] = api_server_host
 
-    # Webhook platform
-    webhook_enabled = os.getenv("WEBHOOK_ENABLED", "").lower() in ("true", "1", "yes")
-    webhook_port = os.getenv("WEBHOOK_PORT")
-    webhook_secret = os.getenv("WEBHOOK_SECRET", "")
-    if webhook_enabled:
-        if Platform.WEBHOOK not in config.platforms:
-            config.platforms[Platform.WEBHOOK] = PlatformConfig()
-        config.platforms[Platform.WEBHOOK].enabled = True
-        if webhook_port:
-            try:
-                config.platforms[Platform.WEBHOOK].extra["port"] = int(webhook_port)
-            except ValueError:
-                pass
-        if webhook_secret:
-            config.platforms[Platform.WEBHOOK].extra["secret"] = webhook_secret
-
     # Session settings
     idle_minutes = os.getenv("SESSION_IDLE_MINUTES")
     if idle_minutes:
@@ -819,3 +751,4 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
             pass
 
 
+

gateway/platforms/api_server.py

@@ -18,10 +18,10 @@ Requires:
 """
 
 import asyncio
+import collections
 import json
 import logging
 import os
-import sqlite3
 import time
 import uuid
 from typing import Any, Dict, List, Optional
@@ -45,7 +45,6 @@ logger = logging.getLogger(__name__)
 DEFAULT_HOST = "127.0.0.1"
 DEFAULT_PORT = 8642
 MAX_STORED_RESPONSES = 100
-MAX_REQUEST_BYTES = 1_000_000  # 1 MB default limit for POST bodies
 
 
 def check_api_server_requirements() -> bool:
@@ -55,109 +54,41 @@ def check_api_server_requirements() -> bool:
 
 class ResponseStore:
     """
-    SQLite-backed LRU store for Responses API state.
+    In-memory LRU store for Responses API state.
 
     Each stored response includes the full internal conversation history
     (with tool calls and results) so it can be reconstructed on subsequent
     requests via previous_response_id.
-
-    Persists across gateway restarts.  Falls back to in-memory SQLite
-    if the on-disk path is unavailable.
     """
 
-    def __init__(self, max_size: int = MAX_STORED_RESPONSES, db_path: str = None):
+    def __init__(self, max_size: int = MAX_STORED_RESPONSES):
+        self._store: collections.OrderedDict[str, Dict[str, Any]] = collections.OrderedDict()
         self._max_size = max_size
-        if db_path is None:
-            try:
-                from hermes_cli.config import get_hermes_home
-                db_path = str(get_hermes_home() / "response_store.db")
-            except Exception:
-                db_path = ":memory:"
-        try:
-            self._conn = sqlite3.connect(db_path, check_same_thread=False)
-        except Exception:
-            self._conn = sqlite3.connect(":memory:", check_same_thread=False)
-        self._conn.execute("PRAGMA journal_mode=WAL")
-        self._conn.execute(
-            """CREATE TABLE IF NOT EXISTS responses (
-                response_id TEXT PRIMARY KEY,
-                data TEXT NOT NULL,
-                accessed_at REAL NOT NULL
-            )"""
-        )
-        self._conn.execute(
-            """CREATE TABLE IF NOT EXISTS conversations (
-                name TEXT PRIMARY KEY,
-                response_id TEXT NOT NULL
-            )"""
-        )
-        self._conn.commit()
 
     def get(self, response_id: str) -> Optional[Dict[str, Any]]:
-        """Retrieve a stored response by ID (updates access time for LRU)."""
-        row = self._conn.execute(
-            "SELECT data FROM responses WHERE response_id = ?", (response_id,)
-        ).fetchone()
-        if row is None:
-            return None
-        import time
-        self._conn.execute(
-            "UPDATE responses SET accessed_at = ? WHERE response_id = ?",
-            (time.time(), response_id),
-        )
-        self._conn.commit()
-        return json.loads(row[0])
+        """Retrieve a stored response by ID (moves to end for LRU)."""
+        if response_id in self._store:
+            self._store.move_to_end(response_id)
+            return self._store[response_id]
+        return None
 
     def put(self, response_id: str, data: Dict[str, Any]) -> None:
         """Store a response, evicting the oldest if at capacity."""
-        import time
-        self._conn.execute(
-            "INSERT OR REPLACE INTO responses (response_id, data, accessed_at) VALUES (?, ?, ?)",
-            (response_id, json.dumps(data, default=str), time.time()),
-        )
-        # Evict oldest entries beyond max_size
-        count = self._conn.execute("SELECT COUNT(*) FROM responses").fetchone()[0]
-        if count > self._max_size:
-            self._conn.execute(
-                "DELETE FROM responses WHERE response_id IN "
-                "(SELECT response_id FROM responses ORDER BY accessed_at ASC LIMIT ?)",
-                (count - self._max_size,),
-            )
-        self._conn.commit()
+        if response_id in self._store:
+            self._store.move_to_end(response_id)
+        self._store[response_id] = data
+        while len(self._store) > self._max_size:
+            self._store.popitem(last=False)
 
     def delete(self, response_id: str) -> bool:
         """Remove a response from the store. Returns True if found and deleted."""
-        cursor = self._conn.execute(
-            "DELETE FROM responses WHERE response_id = ?", (response_id,)
-        )
-        self._conn.commit()
-        return cursor.rowcount > 0
-
-    def get_conversation(self, name: str) -> Optional[str]:
-        """Get the latest response_id for a conversation name."""
-        row = self._conn.execute(
-            "SELECT response_id FROM conversations WHERE name = ?", (name,)
-        ).fetchone()
-        return row[0] if row else None
-
-    def set_conversation(self, name: str, response_id: str) -> None:
-        """Map a conversation name to its latest response_id."""
-        self._conn.execute(
-            "INSERT OR REPLACE INTO conversations (name, response_id) VALUES (?, ?)",
-            (name, response_id),
-        )
-        self._conn.commit()
-
-    def close(self) -> None:
-        """Close the database connection."""
-        try:
-            self._conn.close()
-        except Exception:
-            pass
+        if response_id in self._store:
+            del self._store[response_id]
+            return True
+        return False
 
     def __len__(self) -> int:
-        row = self._conn.execute("SELECT COUNT(*) FROM responses").fetchone()
-        return row[0] if row else 0
+        return len(self._store)
 
 
 # ---------------------------------------------------------------------------
@@ -165,6 +96,7 @@ class ResponseStore:
 # ---------------------------------------------------------------------------
 
 _CORS_HEADERS = {
+    "Access-Control-Allow-Origin": "*",
     "Access-Control-Allow-Methods": "GET, POST, DELETE, OPTIONS",
     "Access-Control-Allow-Headers": "Authorization, Content-Type",
 }
@@ -173,95 +105,16 @@ _CORS_HEADERS = {
 if AIOHTTP_AVAILABLE:
     @web.middleware
     async def cors_middleware(request, handler):
-        """Add CORS headers for explicitly allowed origins; handle OPTIONS preflight."""
-        adapter = request.app.get("api_server_adapter")
-        origin = request.headers.get("Origin", "")
-        cors_headers = None
-        if adapter is not None:
-            if not adapter._origin_allowed(origin):
-                return web.Response(status=403)
-            cors_headers = adapter._cors_headers_for_origin(origin)
-
+        """Add CORS headers to every response; handle OPTIONS preflight."""
         if request.method == "OPTIONS":
-            if cors_headers is None:
-                return web.Response(status=403)
-            return web.Response(status=200, headers=cors_headers)
-
+            return web.Response(status=200, headers=_CORS_HEADERS)
         response = await handler(request)
-        if cors_headers is not None:
-            response.headers.update(cors_headers)
+        response.headers.update(_CORS_HEADERS)
         return response
 else:
     cors_middleware = None  # type: ignore[assignment]
 
 
-def _openai_error(message: str, err_type: str = "invalid_request_error", param: str = None, code: str = None) -> Dict[str, Any]:
-    """OpenAI-style error envelope."""
-    return {
-        "error": {
-            "message": message,
-            "type": err_type,
-            "param": param,
-            "code": code,
-        }
-    }
-
-
-if AIOHTTP_AVAILABLE:
-    @web.middleware
-    async def body_limit_middleware(request, handler):
-        """Reject overly large request bodies early based on Content-Length."""
-        if request.method in ("POST", "PUT", "PATCH"):
-            cl = request.headers.get("Content-Length")
-            if cl is not None:
-                try:
-                    if int(cl) > MAX_REQUEST_BYTES:
-                        return web.json_response(_openai_error("Request body too large.", code="body_too_large"), status=413)
-                except ValueError:
-                    return web.json_response(_openai_error("Invalid Content-Length header.", code="invalid_content_length"), status=400)
-        return await handler(request)
-else:
-    body_limit_middleware = None  # type: ignore[assignment]
-
-
-class _IdempotencyCache:
-    """In-memory idempotency cache with TTL and basic LRU semantics."""
-    def __init__(self, max_items: int = 1000, ttl_seconds: int = 300):
-        from collections import OrderedDict
-        self._store = OrderedDict()
-        self._ttl = ttl_seconds
-        self._max = max_items
-
-    def _purge(self):
-        import time as _t
-        now = _t.time()
-        expired = [k for k, v in self._store.items() if now - v["ts"] > self._ttl]
-        for k in expired:
-            self._store.pop(k, None)
-        while len(self._store) > self._max:
-            self._store.popitem(last=False)
-
-    async def get_or_set(self, key: str, fingerprint: str, compute_coro):
-        self._purge()
-        item = self._store.get(key)
-        if item and item["fp"] == fingerprint:
-            return item["resp"]
-        resp = await compute_coro()
-        import time as _t
-        self._store[key] = {"resp": resp, "fp": fingerprint, "ts": _t.time()}
-        self._purge()
-        return resp
-
-
-_idem_cache = _IdempotencyCache()
-
-
-def _make_request_fingerprint(body: Dict[str, Any], keys: List[str]) -> str:
-    from hashlib import sha256
-    subset = {k: body.get(k) for k in keys}
-    return sha256(repr(subset).encode("utf-8")).hexdigest()
-
-
 class APIServerAdapter(BasePlatformAdapter):
     """
     OpenAI-compatible HTTP API server adapter.
@@ -276,56 +129,12 @@ class APIServerAdapter(BasePlatformAdapter):
         self._host: str = extra.get("host", os.getenv("API_SERVER_HOST", DEFAULT_HOST))
         self._port: int = int(extra.get("port", os.getenv("API_SERVER_PORT", str(DEFAULT_PORT))))
         self._api_key: str = extra.get("key", os.getenv("API_SERVER_KEY", ""))
-        self._cors_origins: tuple[str, ...] = self._parse_cors_origins(
-            extra.get("cors_origins", os.getenv("API_SERVER_CORS_ORIGINS", "")),
-        )
         self._app: Optional["web.Application"] = None
         self._runner: Optional["web.AppRunner"] = None
         self._site: Optional["web.TCPSite"] = None
         self._response_store = ResponseStore()
-
-    @staticmethod
-    def _parse_cors_origins(value: Any) -> tuple[str, ...]:
-        """Normalize configured CORS origins into a stable tuple."""
-        if not value:
-            return ()
-
-        if isinstance(value, str):
-            items = value.split(",")
-        elif isinstance(value, (list, tuple, set)):
-            items = value
-        else:
-            items = [str(value)]
-
-        return tuple(str(item).strip() for item in items if str(item).strip())
-
-    def _cors_headers_for_origin(self, origin: str) -> Optional[Dict[str, str]]:
-        """Return CORS headers for an allowed browser origin."""
-        if not origin or not self._cors_origins:
-            return None
-
-        if "*" in self._cors_origins:
-            headers = dict(_CORS_HEADERS)
-            headers["Access-Control-Allow-Origin"] = "*"
-            return headers
-
-        if origin not in self._cors_origins:
-            return None
-
-        headers = dict(_CORS_HEADERS)
-        headers["Access-Control-Allow-Origin"] = origin
-        headers["Vary"] = "Origin"
-        return headers
-
-    def _origin_allowed(self, origin: str) -> bool:
-        """Allow non-browser clients and explicitly configured browser origins."""
-        if not origin:
-            return True
-
-        if not self._cors_origins:
-            return False
-
-        return "*" in self._cors_origins or origin in self._cors_origins
+        # Conversation name → latest response_id mapping
+        self._conversations: Dict[str, str] = {}
 
     # ------------------------------------------------------------------
     # Auth helper
@@ -428,7 +237,10 @@ class APIServerAdapter(BasePlatformAdapter):
         try:
             body = await request.json()
         except (json.JSONDecodeError, Exception):
-            return web.json_response(_openai_error("Invalid JSON in request body"), status=400)
+            return web.json_response(
+                {"error": {"message": "Invalid JSON in request body", "type": "invalid_request_error"}},
+                status=400,
+            )
 
         messages = body.get("messages")
         if not messages or not isinstance(messages, list):
@@ -493,35 +305,20 @@ class APIServerAdapter(BasePlatformAdapter):
                 request, completion_id, model_name, created, _stream_q, agent_task
             )
 
-        # Non-streaming: run the agent (with optional Idempotency-Key)
-        async def _compute_completion():
-            return await self._run_agent(
+        # Non-streaming: run the agent and return full response
+        try:
+            result, usage = await self._run_agent(
                 user_message=user_message,
                 conversation_history=history,
                 ephemeral_system_prompt=system_prompt,
                 session_id=session_id,
             )
-
-        idempotency_key = request.headers.get("Idempotency-Key")
-        if idempotency_key:
-            fp = _make_request_fingerprint(body, keys=["model", "messages", "tools", "tool_choice", "stream"])
-            try:
-                result, usage = await _idem_cache.get_or_set(idempotency_key, fp, _compute_completion)
-            except Exception as e:
-                logger.error("Error running agent for chat completions: %s", e, exc_info=True)
-                return web.json_response(
-                    _openai_error(f"Internal server error: {e}", err_type="server_error"),
-                    status=500,
-                )
-        else:
-            try:
-                result, usage = await _compute_completion()
-            except Exception as e:
-                logger.error("Error running agent for chat completions: %s", e, exc_info=True)
-                return web.json_response(
-                    _openai_error(f"Internal server error: {e}", err_type="server_error"),
-                    status=500,
-                )
+        except Exception as e:
+            logger.error("Error running agent for chat completions: %s", e, exc_info=True)
+            return web.json_response(
+                {"error": {"message": f"Internal server error: {e}", "type": "server_error"}},
+                status=500,
+            )
 
         final_response = result.get("final_response", "")
         if not final_response:
@@ -647,7 +444,10 @@ class APIServerAdapter(BasePlatformAdapter):
 
         raw_input = body.get("input")
         if raw_input is None:
-            return web.json_response(_openai_error("Missing 'input' field"), status=400)
+            return web.json_response(
+                {"error": {"message": "Missing 'input' field", "type": "invalid_request_error"}},
+                status=400,
+            )
 
         instructions = body.get("instructions")
         previous_response_id = body.get("previous_response_id")
@@ -656,11 +456,14 @@ class APIServerAdapter(BasePlatformAdapter):
 
         # conversation and previous_response_id are mutually exclusive
         if conversation and previous_response_id:
-            return web.json_response(_openai_error("Cannot use both 'conversation' and 'previous_response_id'"), status=400)
+            return web.json_response(
+                {"error": {"message": "Cannot use both 'conversation' and 'previous_response_id'", "type": "invalid_request_error"}},
+                status=400,
+            )
 
         # Resolve conversation name to latest response_id
         if conversation:
-            previous_response_id = self._response_store.get_conversation(conversation)
+            previous_response_id = self._conversations.get(conversation)
             # No error if conversation doesn't exist yet — it's a new conversation
 
         # Normalize input to message list
@@ -687,14 +490,20 @@ class APIServerAdapter(BasePlatformAdapter):
                         content = "\n".join(text_parts)
                     input_messages.append({"role": role, "content": content})
         else:
-            return web.json_response(_openai_error("'input' must be a string or array"), status=400)
+            return web.json_response(
+                {"error": {"message": "'input' must be a string or array", "type": "invalid_request_error"}},
+                status=400,
+            )
 
         # Reconstruct conversation history from previous_response_id
         conversation_history: List[Dict[str, str]] = []
         if previous_response_id:
             stored = self._response_store.get(previous_response_id)
             if stored is None:
-                return web.json_response(_openai_error(f"Previous response not found: {previous_response_id}"), status=404)
+                return web.json_response(
+                    {"error": {"message": f"Previous response not found: {previous_response_id}", "type": "invalid_request_error"}},
+                    status=404,
+                )
             conversation_history = list(stored.get("conversation_history", []))
             # If no instructions provided, carry forward from previous
             if instructions is None:
@@ -707,46 +516,30 @@ class APIServerAdapter(BasePlatformAdapter):
         # Last input message is the user_message
         user_message = input_messages[-1].get("content", "") if input_messages else ""
         if not user_message:
-            return web.json_response(_openai_error("No user message found in input"), status=400)
+            return web.json_response(
+                {"error": {"message": "No user message found in input", "type": "invalid_request_error"}},
+                status=400,
+            )
 
         # Truncation support
         if body.get("truncation") == "auto" and len(conversation_history) > 100:
             conversation_history = conversation_history[-100:]
 
-        # Run the agent (with Idempotency-Key support)
+        # Run the agent
         session_id = str(uuid.uuid4())
-
-        async def _compute_response():
-            return await self._run_agent(
+        try:
+            result, usage = await self._run_agent(
                 user_message=user_message,
                 conversation_history=conversation_history,
                 ephemeral_system_prompt=instructions,
                 session_id=session_id,
             )
-
-        idempotency_key = request.headers.get("Idempotency-Key")
-        if idempotency_key:
-            fp = _make_request_fingerprint(
-                body,
-                keys=["input", "instructions", "previous_response_id", "conversation", "model", "tools"],
+        except Exception as e:
+            logger.error("Error running agent for responses: %s", e, exc_info=True)
+            return web.json_response(
+                {"error": {"message": f"Internal server error: {e}", "type": "server_error"}},
+                status=500,
             )
-            try:
-                result, usage = await _idem_cache.get_or_set(idempotency_key, fp, _compute_response)
-            except Exception as e:
-                logger.error("Error running agent for responses: %s", e, exc_info=True)
-                return web.json_response(
-                    _openai_error(f"Internal server error: {e}", err_type="server_error"),
-                    status=500,
-                )
-        else:
-            try:
-                result, usage = await _compute_response()
-            except Exception as e:
-                logger.error("Error running agent for responses: %s", e, exc_info=True)
-                return web.json_response(
-                    _openai_error(f"Internal server error: {e}", err_type="server_error"),
-                    status=500,
-                )
 
         final_response = result.get("final_response", "")
         if not final_response:
@@ -793,7 +586,7 @@ class APIServerAdapter(BasePlatformAdapter):
             # Update conversation mapping so the next request with the same
             # conversation name automatically chains to this response
             if conversation:
-                self._response_store.set_conversation(conversation, response_id)
+                self._conversations[conversation] = response_id
 
         return web.json_response(response_data)
 
@@ -810,7 +603,10 @@ class APIServerAdapter(BasePlatformAdapter):
         response_id = request.match_info["response_id"]
         stored = self._response_store.get(response_id)
         if stored is None:
-            return web.json_response(_openai_error(f"Response not found: {response_id}"), status=404)
+            return web.json_response(
+                {"error": {"message": f"Response not found: {response_id}", "type": "invalid_request_error"}},
+                status=404,
+            )
 
         return web.json_response(stored["response"])
 
@@ -823,7 +619,10 @@ class APIServerAdapter(BasePlatformAdapter):
         response_id = request.match_info["response_id"]
         deleted = self._response_store.delete(response_id)
         if not deleted:
-            return web.json_response(_openai_error(f"Response not found: {response_id}"), status=404)
+            return web.json_response(
+                {"error": {"message": f"Response not found: {response_id}", "type": "invalid_request_error"}},
+                status=404,
+            )
 
         return web.json_response({
             "id": response_id,
@@ -831,241 +630,6 @@ class APIServerAdapter(BasePlatformAdapter):
             "deleted": True,
         })
 
-    # ------------------------------------------------------------------
-    # Cron jobs API
-    # ------------------------------------------------------------------
-
-    # Check cron module availability once (not per-request)
-    _CRON_AVAILABLE = False
-    try:
-        from cron.jobs import (
-            list_jobs as _cron_list,
-            get_job as _cron_get,
-            create_job as _cron_create,
-            update_job as _cron_update,
-            remove_job as _cron_remove,
-            pause_job as _cron_pause,
-            resume_job as _cron_resume,
-            trigger_job as _cron_trigger,
-        )
-        _CRON_AVAILABLE = True
-    except ImportError:
-        pass
-
-    _JOB_ID_RE = __import__("re").compile(r"[a-f0-9]{12}")
-    # Allowed fields for update — prevents clients injecting arbitrary keys
-    _UPDATE_ALLOWED_FIELDS = {"name", "schedule", "prompt", "deliver", "skills", "skill", "repeat", "enabled"}
-    _MAX_NAME_LENGTH = 200
-    _MAX_PROMPT_LENGTH = 5000
-
-    def _check_jobs_available(self) -> Optional["web.Response"]:
-        """Return error response if cron module isn't available."""
-        if not self._CRON_AVAILABLE:
-            return web.json_response(
-                {"error": "Cron module not available"}, status=501,
-            )
-        return None
-
-    def _check_job_id(self, request: "web.Request") -> tuple:
-        """Validate and extract job_id. Returns (job_id, error_response)."""
-        job_id = request.match_info["job_id"]
-        if not self._JOB_ID_RE.fullmatch(job_id):
-            return job_id, web.json_response(
-                {"error": "Invalid job ID format"}, status=400,
-            )
-        return job_id, None
-
-    async def _handle_list_jobs(self, request: "web.Request") -> "web.Response":
-        """GET /api/jobs — list all cron jobs."""
-        auth_err = self._check_auth(request)
-        if auth_err:
-            return auth_err
-        cron_err = self._check_jobs_available()
-        if cron_err:
-            return cron_err
-        try:
-            include_disabled = request.query.get("include_disabled", "").lower() in ("true", "1")
-            jobs = self._cron_list(include_disabled=include_disabled)
-            return web.json_response({"jobs": jobs})
-        except Exception as e:
-            return web.json_response({"error": str(e)}, status=500)
-
-    async def _handle_create_job(self, request: "web.Request") -> "web.Response":
-        """POST /api/jobs — create a new cron job."""
-        auth_err = self._check_auth(request)
-        if auth_err:
-            return auth_err
-        cron_err = self._check_jobs_available()
-        if cron_err:
-            return cron_err
-        try:
-            body = await request.json()
-            name = (body.get("name") or "").strip()
-            schedule = (body.get("schedule") or "").strip()
-            prompt = body.get("prompt", "")
-            deliver = body.get("deliver", "local")
-            skills = body.get("skills")
-            repeat = body.get("repeat")
-
-            if not name:
-                return web.json_response({"error": "Name is required"}, status=400)
-            if len(name) > self._MAX_NAME_LENGTH:
-                return web.json_response(
-                    {"error": f"Name must be ≤ {self._MAX_NAME_LENGTH} characters"}, status=400,
-                )
-            if not schedule:
-                return web.json_response({"error": "Schedule is required"}, status=400)
-            if len(prompt) > self._MAX_PROMPT_LENGTH:
-                return web.json_response(
-                    {"error": f"Prompt must be ≤ {self._MAX_PROMPT_LENGTH} characters"}, status=400,
-                )
-            if repeat is not None and (not isinstance(repeat, int) or repeat < 1):
-                return web.json_response({"error": "Repeat must be a positive integer"}, status=400)
-
-            kwargs = {
-                "prompt": prompt,
-                "schedule": schedule,
-                "name": name,
-                "deliver": deliver,
-            }
-            if skills:
-                kwargs["skills"] = skills
-            if repeat is not None:
-                kwargs["repeat"] = repeat
-
-            job = self._cron_create(**kwargs)
-            return web.json_response({"job": job})
-        except Exception as e:
-            return web.json_response({"error": str(e)}, status=500)
-
-    async def _handle_get_job(self, request: "web.Request") -> "web.Response":
-        """GET /api/jobs/{job_id} — get a single cron job."""
-        auth_err = self._check_auth(request)
-        if auth_err:
-            return auth_err
-        cron_err = self._check_jobs_available()
-        if cron_err:
-            return cron_err
-        job_id, id_err = self._check_job_id(request)
-        if id_err:
-            return id_err
-        try:
-            job = self._cron_get(job_id)
-            if not job:
-                return web.json_response({"error": "Job not found"}, status=404)
-            return web.json_response({"job": job})
-        except Exception as e:
-            return web.json_response({"error": str(e)}, status=500)
-
-    async def _handle_update_job(self, request: "web.Request") -> "web.Response":
-        """PATCH /api/jobs/{job_id} — update a cron job."""
-        auth_err = self._check_auth(request)
-        if auth_err:
-            return auth_err
-        cron_err = self._check_jobs_available()
-        if cron_err:
-            return cron_err
-        job_id, id_err = self._check_job_id(request)
-        if id_err:
-            return id_err
-        try:
-            body = await request.json()
-            # Whitelist allowed fields to prevent arbitrary key injection
-            sanitized = {k: v for k, v in body.items() if k in self._UPDATE_ALLOWED_FIELDS}
-            if not sanitized:
-                return web.json_response({"error": "No valid fields to update"}, status=400)
-            # Validate lengths if present
-            if "name" in sanitized and len(sanitized["name"]) > self._MAX_NAME_LENGTH:
-                return web.json_response(
-                    {"error": f"Name must be ≤ {self._MAX_NAME_LENGTH} characters"}, status=400,
-                )
-            if "prompt" in sanitized and len(sanitized["prompt"]) > self._MAX_PROMPT_LENGTH:
-                return web.json_response(
-                    {"error": f"Prompt must be ≤ {self._MAX_PROMPT_LENGTH} characters"}, status=400,
-                )
-            job = self._cron_update(job_id, sanitized)
-            if not job:
-                return web.json_response({"error": "Job not found"}, status=404)
-            return web.json_response({"job": job})
-        except Exception as e:
-            return web.json_response({"error": str(e)}, status=500)
-
-    async def _handle_delete_job(self, request: "web.Request") -> "web.Response":
-        """DELETE /api/jobs/{job_id} — delete a cron job."""
-        auth_err = self._check_auth(request)
-        if auth_err:
-            return auth_err
-        cron_err = self._check_jobs_available()
-        if cron_err:
-            return cron_err
-        job_id, id_err = self._check_job_id(request)
-        if id_err:
-            return id_err
-        try:
-            success = self._cron_remove(job_id)
-            if not success:
-                return web.json_response({"error": "Job not found"}, status=404)
-            return web.json_response({"ok": True})
-        except Exception as e:
-            return web.json_response({"error": str(e)}, status=500)
-
-    async def _handle_pause_job(self, request: "web.Request") -> "web.Response":
-        """POST /api/jobs/{job_id}/pause — pause a cron job."""
-        auth_err = self._check_auth(request)
-        if auth_err:
-            return auth_err
-        cron_err = self._check_jobs_available()
-        if cron_err:
-            return cron_err
-        job_id, id_err = self._check_job_id(request)
-        if id_err:
-            return id_err
-        try:
-            job = self._cron_pause(job_id)
-            if not job:
-                return web.json_response({"error": "Job not found"}, status=404)
-            return web.json_response({"job": job})
-        except Exception as e:
-            return web.json_response({"error": str(e)}, status=500)
-
-    async def _handle_resume_job(self, request: "web.Request") -> "web.Response":
-        """POST /api/jobs/{job_id}/resume — resume a paused cron job."""
-        auth_err = self._check_auth(request)
-        if auth_err:
-            return auth_err
-        cron_err = self._check_jobs_available()
-        if cron_err:
-            return cron_err
-        job_id, id_err = self._check_job_id(request)
-        if id_err:
-            return id_err
-        try:
-            job = self._cron_resume(job_id)
-            if not job:
-                return web.json_response({"error": "Job not found"}, status=404)
-            return web.json_response({"job": job})
-        except Exception as e:
-            return web.json_response({"error": str(e)}, status=500)
-
-    async def _handle_run_job(self, request: "web.Request") -> "web.Response":
-        """POST /api/jobs/{job_id}/run — trigger immediate execution."""
-        auth_err = self._check_auth(request)
-        if auth_err:
-            return auth_err
-        cron_err = self._check_jobs_available()
-        if cron_err:
-            return cron_err
-        job_id, id_err = self._check_job_id(request)
-        if id_err:
-            return id_err
-        try:
-            job = self._cron_trigger(job_id)
-            if not job:
-                return web.json_response({"error": "Job not found"}, status=404)
-            return web.json_response({"job": job})
-        except Exception as e:
-            return web.json_response({"error": str(e)}, status=500)
-
     # ------------------------------------------------------------------
     # Output extraction helper
     # ------------------------------------------------------------------
@@ -1168,24 +732,13 @@ class APIServerAdapter(BasePlatformAdapter):
             return False
 
         try:
-            mws = [mw for mw in (cors_middleware, body_limit_middleware) if mw is not None]
-            self._app = web.Application(middlewares=mws)
-            self._app["api_server_adapter"] = self
+            self._app = web.Application(middlewares=[cors_middleware])
             self._app.router.add_get("/health", self._handle_health)
             self._app.router.add_get("/v1/models", self._handle_models)
             self._app.router.add_post("/v1/chat/completions", self._handle_chat_completions)
             self._app.router.add_post("/v1/responses", self._handle_responses)
             self._app.router.add_get("/v1/responses/{response_id}", self._handle_get_response)
             self._app.router.add_delete("/v1/responses/{response_id}", self._handle_delete_response)
-            # Cron jobs management API
-            self._app.router.add_get("/api/jobs", self._handle_list_jobs)
-            self._app.router.add_post("/api/jobs", self._handle_create_job)
-            self._app.router.add_get("/api/jobs/{job_id}", self._handle_get_job)
-            self._app.router.add_patch("/api/jobs/{job_id}", self._handle_update_job)
-            self._app.router.add_delete("/api/jobs/{job_id}", self._handle_delete_job)
-            self._app.router.add_post("/api/jobs/{job_id}/pause", self._handle_pause_job)
-            self._app.router.add_post("/api/jobs/{job_id}/resume", self._handle_resume_job)
-            self._app.router.add_post("/api/jobs/{job_id}/run", self._handle_run_job)
 
             self._runner = web.AppRunner(self._app)
             await self._runner.setup()

gateway/platforms/base.py

@@ -504,14 +504,6 @@ class BasePlatformAdapter(ABC):
         metadata: optional dict with platform-specific context (e.g. thread_id for Slack).
         """
         pass
-
-    async def stop_typing(self, chat_id: str) -> None:
-        """Stop a persistent typing indicator (if the platform uses one).
-
-        Override in subclasses that start background typing loops.
-        Default is a no-op for platforms with one-shot typing indicators.
-        """
-        pass
     
     async def send_image(
         self,
@@ -721,7 +713,7 @@ class BasePlatformAdapter(ABC):
         # Extract MEDIA:<path> tags, allowing optional whitespace after the colon
         # and quoted/backticked paths for LLM-formatted outputs.
         media_pattern = re.compile(
-            r'''[`"']?MEDIA:\s*(?P<path>`[^`\n]+`|"[^"\n]+"|'[^'\n]+'|(?:~/|/)\S+(?:[^\S\n]+\S+)*?\.(?:png|jpe?g|gif|webp|mp4|mov|avi|mkv|webm|ogg|opus|mp3|wav|m4a)(?=[\s`"',;:)\]}]|$)|\S+)[`"']?'''
+            r'''[`"']?MEDIA:\s*(?P<path>`[^`\n]+`|"[^"\n]+"|'[^'\n]+'|\S+)[`"']?'''
         )
         for match in media_pattern.finditer(content):
             path = match.group("path").strip()
@@ -1107,22 +1099,6 @@ class BasePlatformAdapter(ABC):
             print(f"[{self.name}] Error handling message: {e}")
             import traceback
             traceback.print_exc()
-            # Send the error to the user so they aren't left with radio silence
-            try:
-                error_type = type(e).__name__
-                error_detail = str(e)[:300] if str(e) else "no details available"
-                _thread_metadata = {"thread_id": event.source.thread_id} if event.source.thread_id else None
-                await self.send(
-                    chat_id=event.source.chat_id,
-                    content=(
-                        f"Sorry, I encountered an error ({error_type}).\n"
-                        f"{error_detail}\n"
-                        "Try again or use /reset to start a fresh session."
-                    ),
-                    metadata=_thread_metadata,
-                )
-            except Exception:
-                pass  # Last resort — don't let error reporting crash the handler
         finally:
             # Stop typing indicator
             typing_task.cancel()

gateway/platforms/discord.py

@@ -43,8 +43,6 @@ from pathlib import Path as _Path
 sys.path.insert(0, str(_Path(__file__).resolve().parents[2]))
 
 from gateway.config import Platform, PlatformConfig
-import re
-
 from gateway.platforms.base import (
     BasePlatformAdapter,
     MessageEvent,
@@ -52,8 +50,6 @@ from gateway.platforms.base import (
     SendResult,
     cache_image_from_url,
     cache_audio_from_url,
-    cache_document_from_bytes,
-    SUPPORTED_DOCUMENT_TYPES,
 )
 
 
@@ -443,9 +439,6 @@ class DiscordAdapter(BasePlatformAdapter):
         # in those threads don't require @mention.  Persisted to disk so the
         # set survives gateway restarts.
         self._bot_participated_threads: set = self._load_participated_threads()
-        # Persistent typing indicator loops per channel (DMs don't reliably
-        # show the standard typing gateway event for bots)
-        self._typing_tasks: Dict[str, asyncio.Task] = {}
         # Cap to prevent unbounded growth (Discord threads get archived).
         self._MAX_TRACKED_THREADS = 500
     
@@ -531,11 +524,6 @@ class DiscordAdapter(BasePlatformAdapter):
                 if message.author == self._client.user:
                     return
                 
-                # Ignore Discord system messages (thread renames, pins, member joins, etc.)
-                # Allow both default and reply types — replies have a distinct MessageType.
-                if message.type not in (discord.MessageType.default, discord.MessageType.reply):
-                    return
-                
                 # Bot message filtering (DISCORD_ALLOW_BOTS):
                 #   "none"     — ignore all other bots (default)
                 #   "mentions" — accept bot messages only when they @mention us
@@ -1251,48 +1239,14 @@ class DiscordAdapter(BasePlatformAdapter):
             return await super().send_document(chat_id, file_path, caption, file_name, reply_to, metadata=metadata)
     
     async def send_typing(self, chat_id: str, metadata=None) -> None:
-        """Start a persistent typing indicator for a channel.
-
-        Discord's TYPING_START gateway event is unreliable in DMs for bots.
-        Instead, start a background loop that hits the typing endpoint every
-        8 seconds (typing indicator lasts ~10s).  The loop is cancelled when
-        stop_typing() is called (after the response is sent).
-        """
-        if not self._client:
-            return
-        # Don't start a duplicate loop
-        if chat_id in self._typing_tasks:
-            return
-
-        async def _typing_loop() -> None:
+        """Send typing indicator."""
+        if self._client:
             try:
-                while True:
-                    try:
-                        route = discord.http.Route(
-                            "POST", "/channels/{channel_id}/typing",
-                            channel_id=chat_id,
-                        )
-                        await self._client.http.request(route)
-                    except asyncio.CancelledError:
-                        return
-                    except Exception as e:
-                        logger.debug("Discord typing indicator failed for %s: %s", chat_id, e)
-                        return
-                    await asyncio.sleep(8)
-            except asyncio.CancelledError:
-                pass
-
-        self._typing_tasks[chat_id] = asyncio.create_task(_typing_loop())
-
-    async def stop_typing(self, chat_id: str) -> None:
-        """Stop the persistent typing indicator for a channel."""
-        task = self._typing_tasks.pop(chat_id, None)
-        if task:
-            task.cancel()
-            try:
-                await task
-            except (asyncio.CancelledError, Exception):
-                pass
+                channel = self._client.get_channel(int(chat_id))
+                if channel:
+                    await channel.typing()
+            except Exception:
+                pass  # Ignore typing indicator failures
     
     async def get_chat_info(self, chat_id: str) -> Dict[str, Any]:
         """Get information about a Discord channel."""
@@ -1546,17 +1500,7 @@ class DiscordAdapter(BasePlatformAdapter):
     def _build_slash_event(self, interaction: discord.Interaction, text: str) -> MessageEvent:
         """Build a MessageEvent from a Discord slash command interaction."""
         is_dm = isinstance(interaction.channel, discord.DMChannel)
-        is_thread = isinstance(interaction.channel, discord.Thread)
-        thread_id = None
-
-        if is_dm:
-            chat_type = "dm"
-        elif is_thread:
-            chat_type = "thread"
-            thread_id = str(interaction.channel_id)
-        else:
-            chat_type = "group"
-
+        chat_type = "dm" if is_dm else "group"
         chat_name = ""
         if not is_dm and hasattr(interaction.channel, "name"):
             chat_name = interaction.channel.name
@@ -1572,7 +1516,6 @@ class DiscordAdapter(BasePlatformAdapter):
             chat_type=chat_type,
             user_id=str(interaction.user.id),
             user_name=interaction.user.display_name,
-            thread_id=thread_id,
             chat_topic=chat_topic,
         )
 
@@ -1959,12 +1902,7 @@ class DiscordAdapter(BasePlatformAdapter):
                     elif att.content_type.startswith("audio/"):
                         msg_type = MessageType.AUDIO
                     else:
-                        doc_ext = ""
-                        if att.filename:
-                            _, doc_ext = os.path.splitext(att.filename)
-                            doc_ext = doc_ext.lower()
-                        if doc_ext in SUPPORTED_DOCUMENT_TYPES:
-                            msg_type = MessageType.DOCUMENT
+                        msg_type = MessageType.DOCUMENT
                     break
         
         # When auto-threading kicked in, route responses to the new thread
@@ -2001,7 +1939,6 @@ class DiscordAdapter(BasePlatformAdapter):
         # vision tool can access them reliably (Discord CDN URLs can expire).
         media_urls = []
         media_types = []
-        pending_text_injection: Optional[str] = None
         for att in message.attachments:
             content_type = att.content_type or "unknown"
             if content_type.startswith("image/"):
@@ -2033,70 +1970,12 @@ class DiscordAdapter(BasePlatformAdapter):
                     media_urls.append(att.url)
                     media_types.append(content_type)
             else:
-                # Document attachments: download, cache, and optionally inject text
-                ext = ""
-                if att.filename:
-                    _, ext = os.path.splitext(att.filename)
-                    ext = ext.lower()
-                if not ext and content_type:
-                    mime_to_ext = {v: k for k, v in SUPPORTED_DOCUMENT_TYPES.items()}
-                    ext = mime_to_ext.get(content_type, "")
-                if ext not in SUPPORTED_DOCUMENT_TYPES:
-                    logger.warning(
-                        "[Discord] Unsupported document type '%s' (%s), skipping",
-                        ext or "unknown", content_type,
-                    )
-                else:
-                    MAX_DOC_BYTES = 20 * 1024 * 1024
-                    if att.size and att.size > MAX_DOC_BYTES:
-                        logger.warning(
-                            "[Discord] Document too large (%s bytes), skipping: %s",
-                            att.size, att.filename,
-                        )
-                    else:
-                        try:
-                            import aiohttp
-                            async with aiohttp.ClientSession() as session:
-                                async with session.get(
-                                    att.url,
-                                    timeout=aiohttp.ClientTimeout(total=30),
-                                ) as resp:
-                                    if resp.status != 200:
-                                        raise Exception(f"HTTP {resp.status}")
-                                    raw_bytes = await resp.read()
-                            cached_path = cache_document_from_bytes(
-                                raw_bytes, att.filename or f"document{ext}"
-                            )
-                            doc_mime = SUPPORTED_DOCUMENT_TYPES[ext]
-                            media_urls.append(cached_path)
-                            media_types.append(doc_mime)
-                            logger.info("[Discord] Cached user document: %s", cached_path)
-                            # Inject text content for .txt/.md files (capped at 100 KB)
-                            MAX_TEXT_INJECT_BYTES = 100 * 1024
-                            if ext in (".md", ".txt") and len(raw_bytes) <= MAX_TEXT_INJECT_BYTES:
-                                try:
-                                    text_content = raw_bytes.decode("utf-8")
-                                    display_name = att.filename or f"document{ext}"
-                                    display_name = re.sub(r'[^\w.\- ]', '_', display_name)
-                                    injection = f"[Content of {display_name}]:\n{text_content}"
-                                    if pending_text_injection:
-                                        pending_text_injection = f"{pending_text_injection}\n\n{injection}"
-                                    else:
-                                        pending_text_injection = injection
-                                except UnicodeDecodeError:
-                                    pass
-                        except Exception as e:
-                            logger.warning(
-                                "[Discord] Failed to cache document %s: %s",
-                                att.filename, e, exc_info=True,
-                            )
+                # Other attachments: keep the original URL
+                media_urls.append(att.url)
+                media_types.append(content_type)
         
-        event_text = message.content
-        if pending_text_injection:
-            event_text = f"{pending_text_injection}\n\n{event_text}" if event_text else pending_text_injection
-
         event = MessageEvent(
-            text=event_text,
+            text=message.content,
             message_type=msg_type,
             source=source,
             raw_message=message,

gateway/platforms/email.py

@@ -230,7 +230,7 @@ class EmailAdapter(BasePlatformAdapter):
             # Mark all existing messages as seen so we only process new ones
             imap.select("INBOX")
             status, data = imap.uid("search", None, "ALL")
-            if status == "OK" and data and data[0]:
+            if status == "OK" and data[0]:
                 for uid in data[0].split():
                     self._seen_uids.add(uid)
             imap.logout()
@@ -295,7 +295,7 @@ class EmailAdapter(BasePlatformAdapter):
             imap.select("INBOX")
 
             status, data = imap.uid("search", None, "UNSEEN")
-            if status != "OK" or not data or not data[0]:
+            if status != "OK" or not data[0]:
                 imap.logout()
                 return results
 

gateway/platforms/matrix.py

@@ -103,23 +103,6 @@ class MatrixAdapter(BasePlatformAdapter):
         self._dm_rooms: Dict[str, bool] = {}
         # Set of room IDs we've joined
         self._joined_rooms: Set[str] = set()
-        # Event deduplication (bounded deque keeps newest entries)
-        from collections import deque
-        self._processed_events: deque = deque(maxlen=1000)
-        self._processed_events_set: set = set()
-
-    def _is_duplicate_event(self, event_id) -> bool:
-        """Return True if this event was already processed. Tracks the ID otherwise."""
-        if not event_id:
-            return False
-        if event_id in self._processed_events_set:
-            return True
-        if len(self._processed_events) == self._processed_events.maxlen:
-            evicted = self._processed_events[0]
-            self._processed_events_set.discard(evicted)
-        self._processed_events.append(event_id)
-        self._processed_events_set.add(event_id)
-        return False
 
     # ------------------------------------------------------------------
     # Required overrides
@@ -205,6 +188,7 @@ class MatrixAdapter(BasePlatformAdapter):
 
         # Register event callbacks.
         client.add_event_callback(self._on_room_message, nio.RoomMessageText)
+        client.add_event_callback(self._on_room_message_media, nio.RoomMessageMedia)
         client.add_event_callback(self._on_room_message_media, nio.RoomMessageImage)
         client.add_event_callback(self._on_room_message_media, nio.RoomMessageAudio)
         client.add_event_callback(self._on_room_message_media, nio.RoomMessageVideo)
@@ -575,10 +559,6 @@ class MatrixAdapter(BasePlatformAdapter):
         if event.sender == self._user_id:
             return
 
-        # Deduplicate by event ID (nio can fire the same event more than once).
-        if self._is_duplicate_event(getattr(event, "event_id", None)):
-            return
-
         # Startup grace: ignore old messages from initial sync.
         event_ts = getattr(event, "server_timestamp", 0) / 1000.0
         if event_ts and event_ts < self._startup_ts - _STARTUP_GRACE_SECONDS:
@@ -668,10 +648,6 @@ class MatrixAdapter(BasePlatformAdapter):
         if event.sender == self._user_id:
             return
 
-        # Deduplicate by event ID.
-        if self._is_duplicate_event(getattr(event, "event_id", None)):
-            return
-
         # Startup grace.
         event_ts = getattr(event, "server_timestamp", 0) / 1000.0
         if event_ts and event_ts < self._startup_ts - _STARTUP_GRACE_SECONDS:
@@ -705,24 +681,6 @@ class MatrixAdapter(BasePlatformAdapter):
         elif event_mimetype:
             media_type = event_mimetype
 
-        # For images, download and cache locally so vision tools can access them.
-        # Matrix MXC URLs require authentication, so direct URL access fails.
-        cached_path = None
-        if msg_type == MessageType.PHOTO and url:
-            try:
-                ext_map = {
-                    "image/jpeg": ".jpg", "image/png": ".png",
-                    "image/gif": ".gif", "image/webp": ".webp",
-                }
-                ext = ext_map.get(event_mimetype, ".jpg")
-                download_resp = await self._client.download(url)
-                if isinstance(download_resp, nio.DownloadResponse):
-                    from gateway.platforms.base import cache_image_from_bytes
-                    cached_path = cache_image_from_bytes(download_resp.body, ext=ext)
-                    logger.info("[Matrix] Cached user image at %s", cached_path)
-            except Exception as e:
-                logger.warning("[Matrix] Failed to cache image: %s", e)
-
         is_dm = self._dm_rooms.get(room.room_id, False)
         if not is_dm and room.member_count == 2:
             is_dm = True
@@ -743,18 +701,14 @@ class MatrixAdapter(BasePlatformAdapter):
             thread_id=thread_id,
         )
 
-        # Use cached local path for images, HTTP URL for other media types
-        media_urls = [cached_path] if cached_path else ([http_url] if http_url else None)
-        media_types = [media_type] if media_urls else None
-
         msg_event = MessageEvent(
             text=body,
             message_type=msg_type,
             source=source,
             raw_message=getattr(event, "source", {}),
             message_id=event.event_id,
-            media_urls=media_urls,
-            media_types=media_types,
+            media_urls=[http_url] if http_url else None,
+            media_types=[media_type] if http_url else None,
         )
 
         await self.handle_message(msg_event)

gateway/platforms/mattermost.py

@@ -580,24 +580,6 @@ class MattermostAdapter(BasePlatformAdapter):
         # For DMs, user_id is sufficient.  For channels, check for @mention.
         message_text = post.get("message", "")
 
-        # Mention-only mode: skip channel messages that don't @mention the bot.
-        # DMs (type "D") are always processed.
-        if channel_type_raw != "D":
-            mention_patterns = [
-                f"@{self._bot_username}",
-                f"@{self._bot_user_id}",
-            ]
-            has_mention = any(
-                pattern.lower() in message_text.lower()
-                for pattern in mention_patterns
-            )
-            if not has_mention:
-                logger.debug(
-                    "Mattermost: skipping non-DM message without @mention (channel=%s)",
-                    channel_id,
-                )
-                return
-
         # Resolve sender info.
         sender_id = post.get("user_id", "")
         sender_name = data.get("sender_name", "").lstrip("@") or sender_id
@@ -635,16 +617,16 @@ class MattermostAdapter(BasePlatformAdapter):
                         if mime.startswith("image/"):
                             local_path = cache_image_from_bytes(file_data, ext or ".png")
                             media_urls.append(local_path)
-                            media_types.append(mime)
+                            media_types.append("image")
                         elif mime.startswith("audio/"):
                             from gateway.platforms.base import cache_audio_from_bytes
                             local_path = cache_audio_from_bytes(file_data, ext or ".ogg")
                             media_urls.append(local_path)
-                            media_types.append(mime)
+                            media_types.append("audio")
                         else:
                             local_path = cache_document_from_bytes(file_data, fname)
                             media_urls.append(local_path)
-                            media_types.append(mime)
+                            media_types.append("document")
                     else:
                         logger.warning("Mattermost: failed to download file %s: HTTP %s", fid, resp.status)
             except Exception as exc:

gateway/platforms/signal.py

@@ -179,11 +179,6 @@ class SignalAdapter(BasePlatformAdapter):
         # Normalize account for self-message filtering
         self._account_normalized = self.account.strip()
 
-        # Track recently sent message timestamps to prevent echo-back loops
-        # in Note to Self / self-chat mode (mirrors WhatsApp recentlySentIds)
-        self._recent_sent_timestamps: set = set()
-        self._max_recent_timestamps = 50
-
         logger.info("Signal adapter initialized: url=%s account=%s groups=%s",
                      self.http_url, _redact_phone(self.account),
                      "enabled" if self.group_allow_from else "disabled")
@@ -358,26 +353,10 @@ class SignalAdapter(BasePlatformAdapter):
         # Unwrap nested envelope if present
         envelope_data = envelope.get("envelope", envelope)
 
-        # Handle syncMessage: extract "Note to Self" messages (sent to own account)
-        # while still filtering other sync events (read receipts, typing, etc.)
-        is_note_to_self = False
+        # Filter syncMessage envelopes (sent transcripts, read receipts, etc.)
+        # signal-cli may set syncMessage to null vs omitting it, so check key existence
         if "syncMessage" in envelope_data:
-            sync_msg = envelope_data.get("syncMessage")
-            if sync_msg and isinstance(sync_msg, dict):
-                sent_msg = sync_msg.get("sentMessage")
-                if sent_msg and isinstance(sent_msg, dict):
-                    dest = sent_msg.get("destinationNumber") or sent_msg.get("destination")
-                    sent_ts = sent_msg.get("timestamp")
-                    if dest == self._account_normalized:
-                        # Check if this is an echo of our own outbound reply
-                        if sent_ts and sent_ts in self._recent_sent_timestamps:
-                            self._recent_sent_timestamps.discard(sent_ts)
-                            return
-                        # Genuine user Note to Self — promote to dataMessage
-                        is_note_to_self = True
-                        envelope_data = {**envelope_data, "dataMessage": sent_msg}
-            if not is_note_to_self:
-                return
+            return
 
         # Extract sender info
         sender = (
@@ -392,8 +371,8 @@ class SignalAdapter(BasePlatformAdapter):
             logger.debug("Signal: ignoring envelope with no sender")
             return
 
-        # Self-message filtering — prevent reply loops (but allow Note to Self)
-        if self._account_normalized and sender == self._account_normalized and not is_note_to_self:
+        # Self-message filtering — prevent reply loops
+        if self._account_normalized and sender == self._account_normalized:
             return
 
         # Filter stories
@@ -478,7 +457,7 @@ class SignalAdapter(BasePlatformAdapter):
             if any(mt.startswith("audio/") for mt in media_types):
                 msg_type = MessageType.VOICE
             elif any(mt.startswith("image/") for mt in media_types):
-                msg_type = MessageType.PHOTO
+                msg_type = MessageType.IMAGE
 
         # Parse timestamp from envelope data (milliseconds since epoch)
         ts_ms = envelope_data.get("timestamp", 0)
@@ -519,13 +498,6 @@ class SignalAdapter(BasePlatformAdapter):
         if not result:
             return None, ""
 
-        # Handle dict response (signal-cli returns {"data": "base64..."})
-        if isinstance(result, dict):
-            result = result.get("data")
-            if not result:
-                logger.warning("Signal: attachment response missing 'data' key")
-                return None, ""
-
         # Result is base64-encoded file content
         raw_data = base64.b64decode(result)
         ext = _guess_extension(raw_data)
@@ -605,18 +577,9 @@ class SignalAdapter(BasePlatformAdapter):
         result = await self._rpc("send", params)
 
         if result is not None:
-            self._track_sent_timestamp(result)
             return SendResult(success=True)
         return SendResult(success=False, error="RPC send failed")
 
-    def _track_sent_timestamp(self, rpc_result) -> None:
-        """Record outbound message timestamp for echo-back filtering."""
-        ts = rpc_result.get("timestamp") if isinstance(rpc_result, dict) else None
-        if ts:
-            self._recent_sent_timestamps.add(ts)
-            if len(self._recent_sent_timestamps) > self._max_recent_timestamps:
-                self._recent_sent_timestamps.pop()
-
     async def send_typing(self, chat_id: str, metadata=None) -> None:
         """Send a typing indicator."""
         params: Dict[str, Any] = {
@@ -672,7 +635,6 @@ class SignalAdapter(BasePlatformAdapter):
 
         result = await self._rpc("send", params)
         if result is not None:
-            self._track_sent_timestamp(result)
             return SendResult(success=True)
         return SendResult(success=False, error="RPC send with attachment failed")
 
@@ -703,7 +665,6 @@ class SignalAdapter(BasePlatformAdapter):
 
         result = await self._rpc("send", params)
         if result is not None:
-            self._track_sent_timestamp(result)
             return SendResult(success=True)
         return SendResult(success=False, error="RPC send document failed")
 

gateway/platforms/telegram.py

@@ -79,8 +79,8 @@ def _escape_mdv2(text: str) -> str:
 def _strip_mdv2(text: str) -> str:
     """Strip MarkdownV2 escape backslashes to produce clean plain text.
 
-    Also removes MarkdownV2 formatting markers so the fallback
-    doesn't show stray syntax characters from format_message conversion.
+    Also removes MarkdownV2 bold markers (*text* -> text) so the fallback
+    doesn't show stray asterisks from header/bold conversion.
     """
     # Remove escape backslashes before special characters
     cleaned = re.sub(r'\\([_*\[\]()~`>#\+\-=|{}.!\\])', r'\1', text)
@@ -89,10 +89,6 @@ def _strip_mdv2(text: str) -> str:
     # Remove MarkdownV2 italic markers that format_message converted from *italic*
     # Use word boundary (\b) to avoid breaking snake_case like my_variable_name
     cleaned = re.sub(r'(?<!\w)_([^_]+)_(?!\w)', r'\1', cleaned)
-    # Remove MarkdownV2 strikethrough markers (~text~ → text)
-    cleaned = re.sub(r'~([^~]+)~', r'\1', cleaned)
-    # Remove MarkdownV2 spoiler markers (||text|| → text)
-    cleaned = re.sub(r'\|\|([^|]+)\|\|', r'\1', cleaned)
     return cleaned
 
 
@@ -115,7 +111,6 @@ class TelegramAdapter(BasePlatformAdapter):
         super().__init__(config, Platform.TELEGRAM)
         self._app: Optional[Application] = None
         self._bot: Optional[Bot] = None
-        self._reply_to_mode: str = getattr(config, 'reply_to_mode', 'first') or 'first'
         # Buffer rapid/album photo updates so Telegram image bursts are handled
         # as a single MessageEvent instead of self-interrupting multiple turns.
         self._media_batch_delay_seconds = float(os.getenv("HERMES_TELEGRAM_MEDIA_BATCH_DELAY_SECONDS", "0.8"))
@@ -130,9 +125,6 @@ class TelegramAdapter(BasePlatformAdapter):
         self._pending_text_batch_tasks: Dict[str, asyncio.Task] = {}
         self._token_lock_identity: Optional[str] = None
         self._polling_error_task: Optional[asyncio.Task] = None
-        self._polling_conflict_count: int = 0
-        self._polling_network_error_count: int = 0
-        self._polling_error_callback_ref = None
 
     @staticmethod
     def _looks_like_polling_conflict(error: Exception) -> bool:
@@ -143,126 +135,13 @@ class TelegramAdapter(BasePlatformAdapter):
             or "another bot instance is running" in text
         )
 
-    @staticmethod
-    def _looks_like_network_error(error: Exception) -> bool:
-        """Return True for transient network errors that warrant a reconnect attempt."""
-        name = error.__class__.__name__.lower()
-        if name in ("networkerror", "timedout", "connectionerror"):
-            return True
-        try:
-            from telegram.error import NetworkError, TimedOut
-            if isinstance(error, (NetworkError, TimedOut)):
-                return True
-        except ImportError:
-            pass
-        return isinstance(error, OSError)
-
-    async def _handle_polling_network_error(self, error: Exception) -> None:
-        """Reconnect polling after a transient network interruption.
-
-        Triggered by NetworkError/TimedOut in the polling error callback, which
-        happen when the host loses connectivity (Mac sleep, WiFi switch, VPN
-        reconnect, etc.).  The gateway process stays alive but the long-poll
-        connection silently dies; without this handler the bot never recovers.
-
-        Strategy: exponential back-off (5s, 10s, 20s, 40s, 60s cap) up to
-        MAX_NETWORK_RETRIES attempts, then mark the adapter retryable-fatal so
-        the supervisor restarts the gateway process.
-        """
-        if self.has_fatal_error:
-            return
-
-        MAX_NETWORK_RETRIES = 10
-        BASE_DELAY = 5
-        MAX_DELAY = 60
-
-        self._polling_network_error_count += 1
-        attempt = self._polling_network_error_count
-
-        if attempt > MAX_NETWORK_RETRIES:
-            message = (
-                "Telegram polling could not reconnect after %d network error retries. "
-                "Restarting gateway." % MAX_NETWORK_RETRIES
-            )
-            logger.error("[%s] %s Last error: %s", self.name, message, error)
-            self._set_fatal_error("telegram_network_error", message, retryable=True)
-            await self._notify_fatal_error()
-            return
-
-        delay = min(BASE_DELAY * (2 ** (attempt - 1)), MAX_DELAY)
-        logger.warning(
-            "[%s] Telegram network error (attempt %d/%d), reconnecting in %ds. Error: %s",
-            self.name, attempt, MAX_NETWORK_RETRIES, delay, error,
-        )
-        await asyncio.sleep(delay)
-
-        try:
-            if self._app and self._app.updater and self._app.updater.running:
-                await self._app.updater.stop()
-        except Exception:
-            pass
-
-        try:
-            await self._app.updater.start_polling(
-                allowed_updates=Update.ALL_TYPES,
-                drop_pending_updates=False,
-                error_callback=self._polling_error_callback_ref,
-            )
-            logger.info(
-                "[%s] Telegram polling resumed after network error (attempt %d)",
-                self.name, attempt,
-            )
-            self._polling_network_error_count = 0
-        except Exception as retry_err:
-            logger.warning("[%s] Telegram polling reconnect failed: %s", self.name, retry_err)
-            # The next network error will trigger another attempt.
-
     async def _handle_polling_conflict(self, error: Exception) -> None:
         if self.has_fatal_error and self.fatal_error_code == "telegram_polling_conflict":
             return
-        # Track consecutive conflicts — transient 409s can occur when a
-        # previous gateway instance hasn't fully released its long-poll
-        # session on Telegram's server (e.g. during --replace handoffs or
-        # systemd Restart=on-failure respawns).  Retry a few times before
-        # giving up, so the old session has time to expire.
-        self._polling_conflict_count += 1
-
-        MAX_CONFLICT_RETRIES = 3
-        RETRY_DELAY = 10  # seconds
-
-        if self._polling_conflict_count <= MAX_CONFLICT_RETRIES:
-            logger.warning(
-                "[%s] Telegram polling conflict (%d/%d), will retry in %ds. Error: %s",
-                self.name, self._polling_conflict_count, MAX_CONFLICT_RETRIES,
-                RETRY_DELAY, error,
-            )
-            try:
-                if self._app and self._app.updater and self._app.updater.running:
-                    await self._app.updater.stop()
-            except Exception:
-                pass
-            await asyncio.sleep(RETRY_DELAY)
-            try:
-                await self._app.updater.start_polling(
-                    allowed_updates=Update.ALL_TYPES,
-                    drop_pending_updates=False,
-                    error_callback=self._polling_error_callback_ref,
-                )
-                logger.info("[%s] Telegram polling resumed after conflict retry %d", self.name, self._polling_conflict_count)
-                self._polling_conflict_count = 0  # reset on success
-                return
-            except Exception as retry_err:
-                logger.warning("[%s] Telegram polling retry failed: %s", self.name, retry_err)
-                # Don't fall through to fatal yet — wait for the next conflict
-                # to trigger another retry attempt (up to MAX_CONFLICT_RETRIES).
-                return
-
-        # Exhausted retries — fatal
         message = (
             "Another Telegram bot poller is already using this token. "
-            "Hermes stopped Telegram polling after %d retries. "
+            "Hermes stopped Telegram polling to avoid endless retry spam. "
             "Make sure only one gateway instance is running for this bot token."
-            % MAX_CONFLICT_RETRIES
         )
         logger.error("[%s] %s Original error: %s", self.name, message, error)
         self._set_fatal_error("telegram_polling_conflict", message, retryable=False)
@@ -352,18 +231,12 @@ class TelegramAdapter(BasePlatformAdapter):
             loop = asyncio.get_running_loop()
 
             def _polling_error_callback(error: Exception) -> None:
+                if not self._looks_like_polling_conflict(error):
+                    logger.error("[%s] Telegram polling error: %s", self.name, error, exc_info=True)
+                    return
                 if self._polling_error_task and not self._polling_error_task.done():
                     return
-                if self._looks_like_polling_conflict(error):
-                    self._polling_error_task = loop.create_task(self._handle_polling_conflict(error))
-                elif self._looks_like_network_error(error):
-                    logger.warning("[%s] Telegram network error, scheduling reconnect: %s", self.name, error)
-                    self._polling_error_task = loop.create_task(self._handle_polling_network_error(error))
-                else:
-                    logger.error("[%s] Telegram polling error: %s", self.name, error, exc_info=True)
-
-            # Store reference for retry use in _handle_polling_conflict
-            self._polling_error_callback_ref = _polling_error_callback
+                self._polling_error_task = loop.create_task(self._handle_polling_conflict(error))
 
             await self._app.updater.start_polling(
                 allowed_updates=Update.ALL_TYPES,
@@ -443,26 +316,6 @@ class TelegramAdapter(BasePlatformAdapter):
         self._token_lock_identity = None
         logger.info("[%s] Disconnected from Telegram", self.name)
 
-    def _should_thread_reply(self, reply_to: Optional[str], chunk_index: int) -> bool:
-        """Determine if this message chunk should thread to the original message.
-
-        Args:
-            reply_to: The original message ID to reply to
-            chunk_index: Index of this chunk (0 = first chunk)
-
-        Returns:
-            True if this chunk should be threaded to the original message
-        """
-        if not reply_to:
-            return False
-        mode = self._reply_to_mode
-        if mode == "off":
-            return False
-        elif mode == "all":
-            return True
-        else:  # "first" (default)
-            return chunk_index == 0
-
     async def send(
         self,
         chat_id: str,
@@ -496,9 +349,6 @@ class TelegramAdapter(BasePlatformAdapter):
                 _NetErr = OSError  # type: ignore[misc,assignment]
 
             for i, chunk in enumerate(chunks):
-                should_thread = self._should_thread_reply(reply_to, i)
-                reply_to_id = int(reply_to) if should_thread else None
-
                 msg = None
                 for _send_attempt in range(3):
                     try:
@@ -508,7 +358,7 @@ class TelegramAdapter(BasePlatformAdapter):
                                 chat_id=int(chat_id),
                                 text=chunk,
                                 parse_mode=ParseMode.MARKDOWN_V2,
-                                reply_to_message_id=reply_to_id,
+                                reply_to_message_id=int(reply_to) if reply_to and i == 0 else None,
                                 message_thread_id=int(thread_id) if thread_id else None,
                             )
                         except Exception as md_error:
@@ -520,7 +370,7 @@ class TelegramAdapter(BasePlatformAdapter):
                                     chat_id=int(chat_id),
                                     text=plain_chunk,
                                     parse_mode=None,
-                                    reply_to_message_id=reply_to_id,
+                                    reply_to_message_id=int(reply_to) if reply_to and i == 0 else None,
                                     message_thread_id=int(thread_id) if thread_id else None,
                                 )
                             else:
@@ -680,26 +530,23 @@ class TelegramAdapter(BasePlatformAdapter):
         image_path: str,
         caption: Optional[str] = None,
         reply_to: Optional[str] = None,
-        metadata: Optional[Dict[str, Any]] = None,
         **kwargs,
     ) -> SendResult:
         """Send a local image file natively as a Telegram photo."""
         if not self._bot:
             return SendResult(success=False, error="Not connected")
-
+        
         try:
             import os
             if not os.path.exists(image_path):
                 return SendResult(success=False, error=f"Image file not found: {image_path}")
-
-            _thread = metadata.get("thread_id") if metadata else None
+            
             with open(image_path, "rb") as image_file:
                 msg = await self._bot.send_photo(
                     chat_id=int(chat_id),
                     photo=image_file,
                     caption=caption[:1024] if caption else None,
                     reply_to_message_id=int(reply_to) if reply_to else None,
-                    message_thread_id=int(_thread) if _thread else None,
                 )
             return SendResult(success=True, message_id=str(msg.message_id))
         except Exception as e:
@@ -718,7 +565,6 @@ class TelegramAdapter(BasePlatformAdapter):
         caption: Optional[str] = None,
         file_name: Optional[str] = None,
         reply_to: Optional[str] = None,
-        metadata: Optional[Dict[str, Any]] = None,
         **kwargs,
     ) -> SendResult:
         """Send a document/file natively as a Telegram file attachment."""
@@ -730,7 +576,6 @@ class TelegramAdapter(BasePlatformAdapter):
                 return SendResult(success=False, error=f"File not found: {file_path}")
 
             display_name = file_name or os.path.basename(file_path)
-            _thread = metadata.get("thread_id") if metadata else None
 
             with open(file_path, "rb") as f:
                 msg = await self._bot.send_document(
@@ -739,7 +584,6 @@ class TelegramAdapter(BasePlatformAdapter):
                     filename=display_name,
                     caption=caption[:1024] if caption else None,
                     reply_to_message_id=int(reply_to) if reply_to else None,
-                    message_thread_id=int(_thread) if _thread else None,
                 )
             return SendResult(success=True, message_id=str(msg.message_id))
         except Exception as e:
@@ -752,7 +596,6 @@ class TelegramAdapter(BasePlatformAdapter):
         video_path: str,
         caption: Optional[str] = None,
         reply_to: Optional[str] = None,
-        metadata: Optional[Dict[str, Any]] = None,
         **kwargs,
     ) -> SendResult:
         """Send a video natively as a Telegram video message."""
@@ -763,14 +606,12 @@ class TelegramAdapter(BasePlatformAdapter):
             if not os.path.exists(video_path):
                 return SendResult(success=False, error=f"Video file not found: {video_path}")
 
-            _thread = metadata.get("thread_id") if metadata else None
             with open(video_path, "rb") as f:
                 msg = await self._bot.send_video(
                     chat_id=int(chat_id),
                     video=f,
                     caption=caption[:1024] if caption else None,
                     reply_to_message_id=int(reply_to) if reply_to else None,
-                    message_thread_id=int(_thread) if _thread else None,
                 )
             return SendResult(success=True, message_id=str(msg.message_id))
         except Exception as e:
@@ -946,30 +787,14 @@ class TelegramAdapter(BasePlatformAdapter):
         text = content
 
         # 1) Protect fenced code blocks (``` ... ```)
-        #    Per MarkdownV2 spec, \ and ` inside pre/code must be escaped.
-        def _protect_fenced(m):
-            raw = m.group(0)
-            # Split off opening ``` (with optional language) and closing ```
-            open_end = raw.index('\n') + 1 if '\n' in raw[3:] else 3
-            opening = raw[:open_end]
-            body_and_close = raw[open_end:]
-            body = body_and_close[:-3]
-            body = body.replace('\\', '\\\\').replace('`', '\\`')
-            return _ph(opening + body + '```')
-
         text = re.sub(
             r'(```(?:[^\n]*\n)?[\s\S]*?```)',
-            _protect_fenced,
+            lambda m: _ph(m.group(0)),
             text,
         )
 
         # 2) Protect inline code (`...`)
-        #    Escape \ inside inline code per MarkdownV2 spec.
-        text = re.sub(
-            r'(`[^`]+`)',
-            lambda m: _ph(m.group(0).replace('\\', '\\\\')),
-            text,
-        )
+        text = re.sub(r'(`[^`]+`)', lambda m: _ph(m.group(0)), text)
 
         # 3) Convert markdown links – escape the display text; inside the URL
         #    only ')' and '\' need escaping per the MarkdownV2 spec.
@@ -1007,75 +832,14 @@ class TelegramAdapter(BasePlatformAdapter):
             text,
         )
 
-        # 7) Convert strikethrough: ~~text~~ → ~text~ (MarkdownV2)
-        text = re.sub(
-            r'~~(.+?)~~',
-            lambda m: _ph(f'~{_escape_mdv2(m.group(1))}~'),
-            text,
-        )
-
-        # 8) Convert spoiler: ||text|| → ||text|| (protect from | escaping)
-        text = re.sub(
-            r'\|\|(.+?)\|\|',
-            lambda m: _ph(f'||{_escape_mdv2(m.group(1))}||'),
-            text,
-        )
-
-        # 9) Convert blockquotes: > at line start → protect > from escaping
-        text = re.sub(
-            r'^(>{1,3}) (.+)$',
-            lambda m: _ph(m.group(1) + ' ' + _escape_mdv2(m.group(2))),
-            text,
-            flags=re.MULTILINE,
-        )
-
-        # 10) Escape remaining special characters in plain text
+        # 7) Escape remaining special characters in plain text
         text = _escape_mdv2(text)
 
-        # 11) Restore placeholders in reverse insertion order so that
+        # 8) Restore placeholders in reverse insertion order so that
         #    nested references (a placeholder inside another) resolve correctly.
         for key in reversed(list(placeholders.keys())):
             text = text.replace(key, placeholders[key])
 
-        # 12) Safety net: escape unescaped ( ) { } that slipped through
-        #     placeholder processing.  Split the text into code/non-code
-        #     segments so we never touch content inside ``` or ` spans.
-        _code_split = re.split(r'(```[\s\S]*?```|`[^`]+`)', text)
-        _safe_parts = []
-        for _idx, _seg in enumerate(_code_split):
-            if _idx % 2 == 1:
-                # Inside code span/block — leave untouched
-                _safe_parts.append(_seg)
-            else:
-                # Outside code — escape bare ( ) { }
-                def _esc_bare(m, _seg=_seg):
-                    s = m.start()
-                    ch = m.group(0)
-                    # Already escaped
-                    if s > 0 and _seg[s - 1] == '\\':
-                        return ch
-                    # ( that opens a MarkdownV2 link [text](url)
-                    if ch == '(' and s > 0 and _seg[s - 1] == ']':
-                        return ch
-                    # ) that closes a link URL
-                    if ch == ')':
-                        before = _seg[:s]
-                        if '](http' in before or '](' in before:
-                            # Check depth
-                            depth = 0
-                            for j in range(s - 1, max(s - 2000, -1), -1):
-                                if _seg[j] == '(':
-                                    depth -= 1
-                                    if depth < 0:
-                                        if j > 0 and _seg[j - 1] == ']':
-                                            return ch
-                                        break
-                                elif _seg[j] == ')':
-                                    depth += 1
-                    return '\\' + ch
-                _safe_parts.append(re.sub(r'[(){}]', _esc_bare, _seg))
-        text = ''.join(_safe_parts)
-
         return text
     
     async def _handle_text_message(self, update: Update, context: ContextTypes.DEFAULT_TYPE) -> None:

gateway/platforms/webhook.py

@@ -1,557 +0,0 @@
-"""Generic webhook platform adapter.
-
-Runs an aiohttp HTTP server that receives webhook POSTs from external
-services (GitHub, GitLab, JIRA, Stripe, etc.), validates HMAC signatures,
-transforms payloads into agent prompts, and routes responses back to the
-source or to another configured platform.
-
-Configuration lives in config.yaml under platforms.webhook.extra.routes.
-Each route defines:
-  - events: which event types to accept (header-based filtering)
-  - secret: HMAC secret for signature validation (REQUIRED)
-  - prompt: template string formatted with the webhook payload
-  - skills: optional list of skills to load for the agent
-  - deliver: where to send the response (github_comment, telegram, etc.)
-  - deliver_extra: additional delivery config (repo, pr_number, chat_id)
-
-Security:
-  - HMAC secret is required per route (validated at startup)
-  - Rate limiting per route (fixed-window, configurable)
-  - Idempotency cache prevents duplicate agent runs on webhook retries
-  - Body size limits checked before reading payload
-  - Set secret to "INSECURE_NO_AUTH" to skip validation (testing only)
-"""
-
-import asyncio
-import hashlib
-import hmac
-import json
-import logging
-import re
-import subprocess
-import time
-from typing import Any, Dict, List, Optional
-
-try:
-    from aiohttp import web
-
-    AIOHTTP_AVAILABLE = True
-except ImportError:
-    AIOHTTP_AVAILABLE = False
-    web = None  # type: ignore[assignment]
-
-from gateway.config import Platform, PlatformConfig
-from gateway.platforms.base import (
-    BasePlatformAdapter,
-    MessageEvent,
-    MessageType,
-    SendResult,
-)
-
-logger = logging.getLogger(__name__)
-
-DEFAULT_HOST = "0.0.0.0"
-DEFAULT_PORT = 8644
-_INSECURE_NO_AUTH = "INSECURE_NO_AUTH"
-
-
-def check_webhook_requirements() -> bool:
-    """Check if webhook adapter dependencies are available."""
-    return AIOHTTP_AVAILABLE
-
-
-class WebhookAdapter(BasePlatformAdapter):
-    """Generic webhook receiver that triggers agent runs from HTTP POSTs."""
-
-    def __init__(self, config: PlatformConfig):
-        super().__init__(config, Platform.WEBHOOK)
-        self._host: str = config.extra.get("host", DEFAULT_HOST)
-        self._port: int = int(config.extra.get("port", DEFAULT_PORT))
-        self._global_secret: str = config.extra.get("secret", "")
-        self._routes: Dict[str, dict] = config.extra.get("routes", {})
-        self._runner = None
-
-        # Delivery info keyed by session chat_id — consumed by send()
-        self._delivery_info: Dict[str, dict] = {}
-
-        # Reference to gateway runner for cross-platform delivery (set externally)
-        self.gateway_runner = None
-
-        # Idempotency: TTL cache of recently processed delivery IDs.
-        # Prevents duplicate agent runs when webhook providers retry.
-        self._seen_deliveries: Dict[str, float] = {}
-        self._idempotency_ttl: int = 3600  # 1 hour
-
-        # Rate limiting: per-route timestamps in a fixed window.
-        self._rate_counts: Dict[str, List[float]] = {}
-        self._rate_limit: int = int(config.extra.get("rate_limit", 30))  # per minute
-
-        # Body size limit (auth-before-body pattern)
-        self._max_body_bytes: int = int(
-            config.extra.get("max_body_bytes", 1_048_576)
-        )  # 1MB
-
-    # ------------------------------------------------------------------
-    # Lifecycle
-    # ------------------------------------------------------------------
-
-    async def connect(self) -> bool:
-        # Validate routes at startup — secret is required per route
-        for name, route in self._routes.items():
-            secret = route.get("secret", self._global_secret)
-            if not secret:
-                raise ValueError(
-                    f"[webhook] Route '{name}' has no HMAC secret. "
-                    f"Set 'secret' on the route or globally. "
-                    f"For testing without auth, set secret to '{_INSECURE_NO_AUTH}'."
-                )
-
-        app = web.Application()
-        app.router.add_get("/health", self._handle_health)
-        app.router.add_post("/webhooks/{route_name}", self._handle_webhook)
-
-        self._runner = web.AppRunner(app)
-        await self._runner.setup()
-        site = web.TCPSite(self._runner, self._host, self._port)
-        await site.start()
-        self._mark_connected()
-
-        route_names = ", ".join(self._routes.keys()) or "(none configured)"
-        logger.info(
-            "[webhook] Listening on %s:%d — routes: %s",
-            self._host,
-            self._port,
-            route_names,
-        )
-        return True
-
-    async def disconnect(self) -> None:
-        if self._runner:
-            await self._runner.cleanup()
-            self._runner = None
-        self._mark_disconnected()
-        logger.info("[webhook] Disconnected")
-
-    async def send(
-        self,
-        chat_id: str,
-        content: str,
-        reply_to: Optional[str] = None,
-        metadata: Optional[Dict[str, Any]] = None,
-    ) -> SendResult:
-        """Deliver the agent's response to the configured destination.
-
-        chat_id is ``webhook:{route}:{delivery_id}`` — we pop the delivery
-        info stored during webhook receipt so it doesn't leak memory.
-        """
-        delivery = self._delivery_info.pop(chat_id, {})
-        deliver_type = delivery.get("deliver", "log")
-
-        if deliver_type == "log":
-            logger.info("[webhook] Response for %s: %s", chat_id, content[:200])
-            return SendResult(success=True)
-
-        if deliver_type == "github_comment":
-            return await self._deliver_github_comment(content, delivery)
-
-        # Cross-platform delivery (telegram, discord, etc.)
-        if self.gateway_runner and deliver_type in (
-            "telegram",
-            "discord",
-            "slack",
-            "signal",
-            "sms",
-        ):
-            return await self._deliver_cross_platform(
-                deliver_type, content, delivery
-            )
-
-        logger.warning("[webhook] Unknown deliver type: %s", deliver_type)
-        return SendResult(
-            success=False, error=f"Unknown deliver type: {deliver_type}"
-        )
-
-    async def get_chat_info(self, chat_id: str) -> Dict[str, Any]:
-        return {"name": chat_id, "type": "webhook"}
-
-    # ------------------------------------------------------------------
-    # HTTP handlers
-    # ------------------------------------------------------------------
-
-    async def _handle_health(self, request: "web.Request") -> "web.Response":
-        """GET /health — simple health check."""
-        return web.json_response({"status": "ok", "platform": "webhook"})
-
-    async def _handle_webhook(self, request: "web.Request") -> "web.Response":
-        """POST /webhooks/{route_name} — receive and process a webhook event."""
-        route_name = request.match_info.get("route_name", "")
-        route_config = self._routes.get(route_name)
-
-        if not route_config:
-            return web.json_response(
-                {"error": f"Unknown route: {route_name}"}, status=404
-            )
-
-        # ── Auth-before-body ─────────────────────────────────────
-        # Check Content-Length before reading the full payload.
-        content_length = request.content_length or 0
-        if content_length > self._max_body_bytes:
-            return web.json_response(
-                {"error": "Payload too large"}, status=413
-            )
-
-        # ── Rate limiting ────────────────────────────────────────
-        now = time.time()
-        window = self._rate_counts.setdefault(route_name, [])
-        window[:] = [t for t in window if now - t < 60]
-        if len(window) >= self._rate_limit:
-            return web.json_response(
-                {"error": "Rate limit exceeded"}, status=429
-            )
-        window.append(now)
-
-        # Read body
-        try:
-            raw_body = await request.read()
-        except Exception as e:
-            logger.error("[webhook] Failed to read body: %s", e)
-            return web.json_response({"error": "Bad request"}, status=400)
-
-        # Validate HMAC signature (skip for INSECURE_NO_AUTH testing mode)
-        secret = route_config.get("secret", self._global_secret)
-        if secret and secret != _INSECURE_NO_AUTH:
-            if not self._validate_signature(request, raw_body, secret):
-                logger.warning(
-                    "[webhook] Invalid signature for route %s", route_name
-                )
-                return web.json_response(
-                    {"error": "Invalid signature"}, status=401
-                )
-
-        # Parse payload
-        try:
-            payload = json.loads(raw_body)
-        except json.JSONDecodeError:
-            # Try form-encoded as fallback
-            try:
-                import urllib.parse
-
-                payload = dict(
-                    urllib.parse.parse_qsl(raw_body.decode("utf-8"))
-                )
-            except Exception:
-                return web.json_response(
-                    {"error": "Cannot parse body"}, status=400
-                )
-
-        # Check event type filter
-        event_type = (
-            request.headers.get("X-GitHub-Event", "")
-            or request.headers.get("X-GitLab-Event", "")
-            or payload.get("event_type", "")
-            or "unknown"
-        )
-        allowed_events = route_config.get("events", [])
-        if allowed_events and event_type not in allowed_events:
-            logger.debug(
-                "[webhook] Ignoring event %s for route %s (allowed: %s)",
-                event_type,
-                route_name,
-                allowed_events,
-            )
-            return web.json_response(
-                {"status": "ignored", "event": event_type}
-            )
-
-        # Format prompt from template
-        prompt_template = route_config.get("prompt", "")
-        prompt = self._render_prompt(
-            prompt_template, payload, event_type, route_name
-        )
-
-        # Inject skill content if configured.
-        # We call build_skill_invocation_message() directly rather than
-        # using /skill-name slash commands — the gateway's command parser
-        # would intercept those and break the flow.
-        skills = route_config.get("skills", [])
-        if skills:
-            try:
-                from agent.skill_commands import (
-                    build_skill_invocation_message,
-                    get_skill_commands,
-                )
-
-                skill_cmds = get_skill_commands()
-                for skill_name in skills:
-                    cmd_key = f"/{skill_name}"
-                    if cmd_key in skill_cmds:
-                        skill_content = build_skill_invocation_message(
-                            cmd_key, user_instruction=prompt
-                        )
-                        if skill_content:
-                            prompt = skill_content
-                            break  # Load the first matching skill
-                    else:
-                        logger.warning(
-                            "[webhook] Skill '%s' not found", skill_name
-                        )
-            except Exception as e:
-                logger.warning("[webhook] Skill loading failed: %s", e)
-
-        # Build a unique delivery ID
-        delivery_id = request.headers.get(
-            "X-GitHub-Delivery",
-            request.headers.get("X-Request-ID", str(int(time.time() * 1000))),
-        )
-
-        # ── Idempotency ─────────────────────────────────────────
-        # Skip duplicate deliveries (webhook retries).
-        now = time.time()
-        # Prune expired entries
-        self._seen_deliveries = {
-            k: v
-            for k, v in self._seen_deliveries.items()
-            if now - v < self._idempotency_ttl
-        }
-        if delivery_id in self._seen_deliveries:
-            logger.info(
-                "[webhook] Skipping duplicate delivery %s", delivery_id
-            )
-            return web.json_response(
-                {"status": "duplicate", "delivery_id": delivery_id},
-                status=200,
-            )
-        self._seen_deliveries[delivery_id] = now
-
-        # Use delivery_id in session key so concurrent webhooks on the
-        # same route get independent agent runs (not queued/interrupted).
-        session_chat_id = f"webhook:{route_name}:{delivery_id}"
-
-        # Store delivery info for send() — consumed (popped) on delivery
-        deliver_config = {
-            "deliver": route_config.get("deliver", "log"),
-            "deliver_extra": self._render_delivery_extra(
-                route_config.get("deliver_extra", {}), payload
-            ),
-            "payload": payload,
-        }
-        self._delivery_info[session_chat_id] = deliver_config
-
-        # Build source and event
-        source = self.build_source(
-            chat_id=session_chat_id,
-            chat_name=f"webhook/{route_name}",
-            chat_type="webhook",
-            user_id=f"webhook:{route_name}",
-            user_name=route_name,
-        )
-        event = MessageEvent(
-            text=prompt,
-            message_type=MessageType.TEXT,
-            source=source,
-            raw_message=payload,
-            message_id=delivery_id,
-        )
-
-        logger.info(
-            "[webhook] %s event=%s route=%s prompt_len=%d delivery=%s",
-            request.method,
-            event_type,
-            route_name,
-            len(prompt),
-            delivery_id,
-        )
-
-        # Non-blocking — return 202 Accepted immediately
-        asyncio.create_task(self.handle_message(event))
-
-        return web.json_response(
-            {
-                "status": "accepted",
-                "route": route_name,
-                "event": event_type,
-                "delivery_id": delivery_id,
-            },
-            status=202,
-        )
-
-    # ------------------------------------------------------------------
-    # Signature validation
-    # ------------------------------------------------------------------
-
-    def _validate_signature(
-        self, request: "web.Request", body: bytes, secret: str
-    ) -> bool:
-        """Validate webhook signature (GitHub, GitLab, generic HMAC-SHA256)."""
-        # GitHub: X-Hub-Signature-256 = sha256=<hex>
-        gh_sig = request.headers.get("X-Hub-Signature-256", "")
-        if gh_sig:
-            expected = "sha256=" + hmac.new(
-                secret.encode(), body, hashlib.sha256
-            ).hexdigest()
-            return hmac.compare_digest(gh_sig, expected)
-
-        # GitLab: X-Gitlab-Token = <plain secret>
-        gl_token = request.headers.get("X-Gitlab-Token", "")
-        if gl_token:
-            return hmac.compare_digest(gl_token, secret)
-
-        # Generic: X-Webhook-Signature = <hex HMAC-SHA256>
-        generic_sig = request.headers.get("X-Webhook-Signature", "")
-        if generic_sig:
-            expected = hmac.new(
-                secret.encode(), body, hashlib.sha256
-            ).hexdigest()
-            return hmac.compare_digest(generic_sig, expected)
-
-        # No recognised signature header but secret is configured → reject
-        logger.debug(
-            "[webhook] Secret configured but no signature header found"
-        )
-        return False
-
-    # ------------------------------------------------------------------
-    # Prompt rendering
-    # ------------------------------------------------------------------
-
-    def _render_prompt(
-        self,
-        template: str,
-        payload: dict,
-        event_type: str,
-        route_name: str,
-    ) -> str:
-        """Render a prompt template with the webhook payload.
-
-        Supports dot-notation access into nested dicts:
-        ``{pull_request.title}`` → ``payload["pull_request"]["title"]``
-        """
-        if not template:
-            truncated = json.dumps(payload, indent=2)[:4000]
-            return (
-                f"Webhook event '{event_type}' on route "
-                f"'{route_name}':\n\n```json\n{truncated}\n```"
-            )
-
-        def _resolve(match: re.Match) -> str:
-            key = match.group(1)
-            value: Any = payload
-            for part in key.split("."):
-                if isinstance(value, dict):
-                    value = value.get(part, f"{{{key}}}")
-                else:
-                    return f"{{{key}}}"
-            if isinstance(value, (dict, list)):
-                return json.dumps(value, indent=2)[:2000]
-            return str(value)
-
-        return re.sub(r"\{([a-zA-Z0-9_.]+)\}", _resolve, template)
-
-    def _render_delivery_extra(
-        self, extra: dict, payload: dict
-    ) -> dict:
-        """Render delivery_extra template values with payload data."""
-        rendered: Dict[str, Any] = {}
-        for key, value in extra.items():
-            if isinstance(value, str):
-                rendered[key] = self._render_prompt(value, payload, "", "")
-            else:
-                rendered[key] = value
-        return rendered
-
-    # ------------------------------------------------------------------
-    # Response delivery
-    # ------------------------------------------------------------------
-
-    async def _deliver_github_comment(
-        self, content: str, delivery: dict
-    ) -> SendResult:
-        """Post agent response as a GitHub PR/issue comment via ``gh`` CLI."""
-        extra = delivery.get("deliver_extra", {})
-        repo = extra.get("repo", "")
-        pr_number = extra.get("pr_number", "")
-
-        if not repo or not pr_number:
-            logger.error(
-                "[webhook] github_comment delivery missing repo or pr_number"
-            )
-            return SendResult(
-                success=False, error="Missing repo or pr_number"
-            )
-
-        try:
-            result = subprocess.run(
-                [
-                    "gh",
-                    "pr",
-                    "comment",
-                    str(pr_number),
-                    "--repo",
-                    repo,
-                    "--body",
-                    content,
-                ],
-                capture_output=True,
-                text=True,
-                timeout=30,
-            )
-            if result.returncode == 0:
-                logger.info(
-                    "[webhook] Posted comment on %s#%s", repo, pr_number
-                )
-                return SendResult(success=True)
-            else:
-                logger.error(
-                    "[webhook] gh pr comment failed: %s", result.stderr
-                )
-                return SendResult(success=False, error=result.stderr)
-        except FileNotFoundError:
-            logger.error(
-                "[webhook] 'gh' CLI not found — install GitHub CLI for "
-                "github_comment delivery"
-            )
-            return SendResult(
-                success=False, error="gh CLI not installed"
-            )
-        except Exception as e:
-            logger.error("[webhook] github_comment delivery error: %s", e)
-            return SendResult(success=False, error=str(e))
-
-    async def _deliver_cross_platform(
-        self, platform_name: str, content: str, delivery: dict
-    ) -> SendResult:
-        """Route response to another platform (telegram, discord, etc.)."""
-        if not self.gateway_runner:
-            return SendResult(
-                success=False,
-                error="No gateway runner for cross-platform delivery",
-            )
-
-        try:
-            target_platform = Platform(platform_name)
-        except ValueError:
-            return SendResult(
-                success=False, error=f"Unknown platform: {platform_name}"
-            )
-
-        adapter = self.gateway_runner.adapters.get(target_platform)
-        if not adapter:
-            return SendResult(
-                success=False,
-                error=f"Platform {platform_name} not connected",
-            )
-
-        # Use home channel if no specific chat_id in deliver_extra
-        extra = delivery.get("deliver_extra", {})
-        chat_id = extra.get("chat_id", "")
-        if not chat_id:
-            home = self.gateway_runner.config.get_home_channel(target_platform)
-            if home:
-                chat_id = home.chat_id
-            else:
-                return SendResult(
-                    success=False,
-                    error=f"No chat_id or home channel for {platform_name}",
-                )
-
-        return await adapter.send(chat_id, content)

gateway/platforms/whatsapp.py

@@ -182,31 +182,9 @@ class WhatsAppAdapter(BasePlatformAdapter):
             # Ensure session directory exists
             self._session_path.mkdir(parents=True, exist_ok=True)
             
-            # Check if bridge is already running and connected
-            import aiohttp
-            import asyncio
-            try:
-                async with aiohttp.ClientSession() as session:
-                    async with session.get(
-                        f"http://127.0.0.1:{self._bridge_port}/health",
-                        timeout=aiohttp.ClientTimeout(total=2)
-                    ) as resp:
-                        if resp.status == 200:
-                            data = await resp.json()
-                            bridge_status = data.get("status", "unknown")
-                            if bridge_status == "connected":
-                                print(f"[{self.name}] Using existing bridge (status: {bridge_status})")
-                                self._mark_connected()
-                                self._bridge_process = None  # Not managed by us
-                                asyncio.create_task(self._poll_messages())
-                                return True
-                            else:
-                                print(f"[{self.name}] Bridge found but not connected (status: {bridge_status}), restarting")
-            except Exception:
-                pass  # Bridge not running, start a new one
-            
             # Kill any orphaned bridge from a previous gateway run
             _kill_port_process(self._bridge_port)
+            import asyncio
             await asyncio.sleep(1)
             
             # Start the bridge process in its own process group.
@@ -254,7 +232,7 @@ class WhatsAppAdapter(BasePlatformAdapter):
                 try:
                     async with aiohttp.ClientSession() as session:
                         async with session.get(
-                            f"http://127.0.0.1:{self._bridge_port}/health",
+                            f"http://localhost:{self._bridge_port}/health",
                             timeout=aiohttp.ClientTimeout(total=2)
                         ) as resp:
                             if resp.status == 200:
@@ -286,7 +264,7 @@ class WhatsAppAdapter(BasePlatformAdapter):
                     try:
                         async with aiohttp.ClientSession() as session:
                             async with session.get(
-                                f"http://127.0.0.1:{self._bridge_port}/health",
+                                f"http://localhost:{self._bridge_port}/health",
                                 timeout=aiohttp.ClientTimeout(total=2)
                             ) as resp:
                                 if resp.status == 200:
@@ -306,7 +284,7 @@ class WhatsAppAdapter(BasePlatformAdapter):
             # Start message polling task
             asyncio.create_task(self._poll_messages())
             
-            self._mark_connected()
+            self._running = True
             print(f"[{self.name}] Bridge started on port {self._bridge_port}")
             return True
             
@@ -324,23 +302,6 @@ class WhatsAppAdapter(BasePlatformAdapter):
                 pass
             self._bridge_log_fh = None
 
-    async def _check_managed_bridge_exit(self) -> Optional[str]:
-        """Return a fatal error message if the managed bridge child exited."""
-        if self._bridge_process is None:
-            return None
-
-        returncode = self._bridge_process.poll()
-        if returncode is None:
-            return None
-
-        message = f"WhatsApp bridge process exited unexpectedly (code {returncode})."
-        if not self.has_fatal_error:
-            logger.error("[%s] %s", self.name, message)
-            self._set_fatal_error("whatsapp_bridge_exited", message, retryable=True)
-            self._close_bridge_log()
-            await self._notify_fatal_error()
-        return self.fatal_error_message or message
-
     async def disconnect(self) -> None:
         """Stop the WhatsApp bridge and clean up any orphaned processes."""
         if self._bridge_process:
@@ -365,11 +326,11 @@ class WhatsAppAdapter(BasePlatformAdapter):
                         self._bridge_process.kill()
             except Exception as e:
                 print(f"[{self.name}] Error stopping bridge: {e}")
-        else:
-            # Bridge was not started by us, don't kill it
-            print(f"[{self.name}] Disconnecting (external bridge left running)")
         
-        self._mark_disconnected()
+        # Also kill any orphaned bridge processes on our port
+        _kill_port_process(self._bridge_port)
+        
+        self._running = False
         self._bridge_process = None
         self._close_bridge_log()
         print(f"[{self.name}] Disconnected")
@@ -384,9 +345,6 @@ class WhatsAppAdapter(BasePlatformAdapter):
         """Send a message via the WhatsApp bridge."""
         if not self._running:
             return SendResult(success=False, error="Not connected")
-        bridge_exit = await self._check_managed_bridge_exit()
-        if bridge_exit:
-            return SendResult(success=False, error=bridge_exit)
         
         try:
             import aiohttp
@@ -400,7 +358,7 @@ class WhatsAppAdapter(BasePlatformAdapter):
                     payload["replyTo"] = reply_to
                 
                 async with session.post(
-                    f"http://127.0.0.1:{self._bridge_port}/send",
+                    f"http://localhost:{self._bridge_port}/send",
                     json=payload,
                     timeout=aiohttp.ClientTimeout(total=30)
                 ) as resp:
@@ -432,14 +390,11 @@ class WhatsAppAdapter(BasePlatformAdapter):
         """Edit a previously sent message via the WhatsApp bridge."""
         if not self._running:
             return SendResult(success=False, error="Not connected")
-        bridge_exit = await self._check_managed_bridge_exit()
-        if bridge_exit:
-            return SendResult(success=False, error=bridge_exit)
         try:
             import aiohttp
             async with aiohttp.ClientSession() as session:
                 async with session.post(
-                    f"http://127.0.0.1:{self._bridge_port}/edit",
+                    f"http://localhost:{self._bridge_port}/edit",
                     json={
                         "chatId": chat_id,
                         "messageId": message_id,
@@ -466,9 +421,6 @@ class WhatsAppAdapter(BasePlatformAdapter):
         """Send any media file via bridge /send-media endpoint."""
         if not self._running:
             return SendResult(success=False, error="Not connected")
-        bridge_exit = await self._check_managed_bridge_exit()
-        if bridge_exit:
-            return SendResult(success=False, error=bridge_exit)
         try:
             import aiohttp
 
@@ -487,7 +439,7 @@ class WhatsAppAdapter(BasePlatformAdapter):
 
             async with aiohttp.ClientSession() as session:
                 async with session.post(
-                    f"http://127.0.0.1:{self._bridge_port}/send-media",
+                    f"http://localhost:{self._bridge_port}/send-media",
                     json=payload,
                     timeout=aiohttp.ClientTimeout(total=120),
                 ) as resp:
@@ -557,15 +509,13 @@ class WhatsAppAdapter(BasePlatformAdapter):
         """Send typing indicator via bridge."""
         if not self._running:
             return
-        if await self._check_managed_bridge_exit():
-            return
         
         try:
             import aiohttp
             
             async with aiohttp.ClientSession() as session:
                 await session.post(
-                    f"http://127.0.0.1:{self._bridge_port}/typing",
+                    f"http://localhost:{self._bridge_port}/typing",
                     json={"chatId": chat_id},
                     timeout=aiohttp.ClientTimeout(total=5)
                 )
@@ -576,15 +526,13 @@ class WhatsAppAdapter(BasePlatformAdapter):
         """Get information about a WhatsApp chat."""
         if not self._running:
             return {"name": "Unknown", "type": "dm"}
-        if await self._check_managed_bridge_exit():
-            return {"name": chat_id, "type": "dm"}
         
         try:
             import aiohttp
             
             async with aiohttp.ClientSession() as session:
                 async with session.get(
-                    f"http://127.0.0.1:{self._bridge_port}/chat/{chat_id}",
+                    f"http://localhost:{self._bridge_port}/chat/{chat_id}",
                     timeout=aiohttp.ClientTimeout(total=10)
                 ) as resp:
                     if resp.status == 200:
@@ -608,14 +556,10 @@ class WhatsAppAdapter(BasePlatformAdapter):
             return
         
         while self._running:
-            bridge_exit = await self._check_managed_bridge_exit()
-            if bridge_exit:
-                print(f"[{self.name}] {bridge_exit}")
-                break
             try:
                 async with aiohttp.ClientSession() as session:
                     async with session.get(
-                        f"http://127.0.0.1:{self._bridge_port}/messages",
+                        f"http://localhost:{self._bridge_port}/messages",
                         timeout=aiohttp.ClientTimeout(total=30)
                     ) as resp:
                         if resp.status == 200:
@@ -627,10 +571,6 @@ class WhatsAppAdapter(BasePlatformAdapter):
             except asyncio.CancelledError:
                 break
             except Exception as e:
-                bridge_exit = await self._check_managed_bridge_exit()
-                if bridge_exit:
-                    print(f"[{self.name}] {bridge_exit}")
-                    break
                 print(f"[{self.name}] Poll error: {e}")
                 await asyncio.sleep(5)
             
@@ -681,11 +621,6 @@ class WhatsAppAdapter(BasePlatformAdapter):
                         print(f"[{self.name}] Failed to cache image: {e}", flush=True)
                         cached_urls.append(url)
                         media_types.append("image/jpeg")
-                elif msg_type == MessageType.PHOTO and os.path.isabs(url):
-                    # Local file path — bridge already downloaded the image
-                    cached_urls.append(url)
-                    media_types.append("image/jpeg")
-                    print(f"[{self.name}] Using bridge-cached image: {url}", flush=True)
                 elif msg_type == MessageType.VOICE and url.startswith(("http://", "https://")):
                     try:
                         cached_path = await cache_audio_from_url(url, ext=".ogg")
@@ -712,3 +647,4 @@ class WhatsAppAdapter(BasePlatformAdapter):
         except Exception as e:
             print(f"[{self.name}] Error building event: {e}")
             return None
+

gateway/session.py

@@ -355,8 +355,6 @@ class SessionEntry:
     # Set when a session was created because the previous one expired;
     # consumed once by the message handler to inject a notice into context
     was_auto_reset: bool = False
-    auto_reset_reason: Optional[str] = None  # "idle" or "daily"
-    reset_had_activity: bool = False  # whether the expired session had any messages
     
     def to_dict(self) -> Dict[str, Any]:
         result = {
@@ -575,19 +573,16 @@ class SessionStore:
 
         return False
 
-    def _should_reset(self, entry: SessionEntry, source: SessionSource) -> Optional[str]:
+    def _should_reset(self, entry: SessionEntry, source: SessionSource) -> bool:
         """
         Check if a session should be reset based on policy.
         
-        Returns the reset reason ("idle" or "daily") if a reset is needed,
-        or None if the session is still valid.
-        
         Sessions with active background processes are never reset.
         """
         if self._has_active_processes_fn:
             session_key = self._generate_session_key(source)
             if self._has_active_processes_fn(session_key):
-                return None
+                return False
 
         policy = self.config.get_reset_policy(
             platform=source.platform,
@@ -595,14 +590,14 @@ class SessionStore:
         )
         
         if policy.mode == "none":
-            return None
+            return False
         
         now = datetime.now()
         
         if policy.mode in ("idle", "both"):
             idle_deadline = entry.updated_at + timedelta(minutes=policy.idle_minutes)
             if now > idle_deadline:
-                return "idle"
+                return True
         
         if policy.mode in ("daily", "both"):
             today_reset = now.replace(
@@ -615,9 +610,9 @@ class SessionStore:
                 today_reset -= timedelta(days=1)
             
             if entry.updated_at < today_reset:
-                return "daily"
+                return True
         
-        return None
+        return False
     
     def has_any_sessions(self) -> bool:
         """Check if any sessions have ever been created (across all platforms).
@@ -659,8 +654,7 @@ class SessionStore:
         if session_key in self._entries and not force_new:
             entry = self._entries[session_key]
             
-            reset_reason = self._should_reset(entry, source)
-            if not reset_reason:
+            if not self._should_reset(entry, source):
                 entry.updated_at = now
                 self._save()
                 return entry
@@ -669,9 +663,6 @@ class SessionStore:
                 # should have already flushed memories proactively; discard
                 # the marker so it doesn't accumulate.
                 was_auto_reset = True
-                auto_reset_reason = reset_reason
-                # Track whether the expired session had any real conversation
-                reset_had_activity = entry.total_tokens > 0
                 self._pre_flushed_sessions.discard(entry.session_id)
                 if self._db:
                     try:
@@ -680,8 +671,6 @@ class SessionStore:
                         logger.debug("Session DB operation failed: %s", e)
         else:
             was_auto_reset = False
-            auto_reset_reason = None
-            reset_had_activity = False
         
         # Create new session
         session_id = f"{now.strftime('%Y%m%d_%H%M%S')}_{uuid.uuid4().hex[:8]}"
@@ -696,8 +685,6 @@ class SessionStore:
             platform=source.platform,
             chat_type=source.chat_type,
             was_auto_reset=was_auto_reset,
-            auto_reset_reason=auto_reset_reason,
-            reset_had_activity=reset_had_activity,
         )
         
         self._entries[session_key] = entry

gateway/status.py

@@ -274,21 +274,6 @@ def acquire_scoped_lock(scope: str, identity: str, metadata: Optional[dict[str,
                     and current_start != existing.get("start_time")
                 ):
                     stale = True
-                # Check if process is stopped (Ctrl+Z / SIGTSTP) — stopped
-                # processes still respond to os.kill(pid, 0) but are not
-                # actually running. Treat them as stale so --replace works.
-                if not stale:
-                    try:
-                        _proc_status = Path(f"/proc/{existing_pid}/status")
-                        if _proc_status.exists():
-                            for _line in _proc_status.read_text().splitlines():
-                                if _line.startswith("State:"):
-                                    _state = _line.split()[1]
-                                    if _state in ("T", "t"):  # stopped or tracing stop
-                                        stale = True
-                                    break
-                    except (OSError, PermissionError):
-                        pass
         if stale:
             try:
                 lock_path.unlink(missing_ok=True)
@@ -329,25 +314,6 @@ def release_scoped_lock(scope: str, identity: str) -> None:
         pass
 
 
-def release_all_scoped_locks() -> int:
-    """Remove all scoped lock files in the lock directory.
-
-    Called during --replace to clean up stale locks left by stopped/killed
-    gateway processes that did not release their locks gracefully.
-    Returns the number of lock files removed.
-    """
-    lock_dir = _get_lock_dir()
-    removed = 0
-    if lock_dir.exists():
-        for lock_file in lock_dir.glob("*.lock"):
-            try:
-                lock_file.unlink(missing_ok=True)
-                removed += 1
-            except OSError:
-                pass
-    return removed
-
-
 def get_running_pid() -> Optional[int]:
     """Return the PID of a running gateway instance, or ``None``.
 

hermes_cli/__init__.py

@@ -11,5 +11,5 @@ Provides subcommands for:
 - hermes cron          - Manage cron jobs
 """
 
-__version__ = "0.4.0"
-__release_date__ = "2026.3.23"
+__version__ = "0.3.0"
+__release_date__ = "2026.3.17"

hermes_cli/auth.py

@@ -19,7 +19,6 @@ import json
 import logging
 import os
 import shutil
-import shlex
 import stat
 import base64
 import hashlib
@@ -67,8 +66,6 @@ DEFAULT_AGENT_KEY_MIN_TTL_SECONDS = 30 * 60  # 30 minutes
 ACCESS_TOKEN_REFRESH_SKEW_SECONDS = 120       # refresh 2 min before expiry
 DEVICE_AUTH_POLL_INTERVAL_CAP_SECONDS = 1     # poll at most every 1s
 DEFAULT_CODEX_BASE_URL = "https://chatgpt.com/backend-api/codex"
-DEFAULT_GITHUB_MODELS_BASE_URL = "https://api.githubcopilot.com"
-DEFAULT_COPILOT_ACP_BASE_URL = "acp://copilot"
 CODEX_OAUTH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann"
 CODEX_OAUTH_TOKEN_URL = "https://auth.openai.com/oauth/token"
 CODEX_ACCESS_TOKEN_REFRESH_SKEW_SECONDS = 120
@@ -111,20 +108,6 @@ PROVIDER_REGISTRY: Dict[str, ProviderConfig] = {
         auth_type="oauth_external",
         inference_base_url=DEFAULT_CODEX_BASE_URL,
     ),
-    "copilot": ProviderConfig(
-        id="copilot",
-        name="GitHub Copilot",
-        auth_type="api_key",
-        inference_base_url=DEFAULT_GITHUB_MODELS_BASE_URL,
-        api_key_env_vars=("COPILOT_GITHUB_TOKEN", "GH_TOKEN", "GITHUB_TOKEN"),
-    ),
-    "copilot-acp": ProviderConfig(
-        id="copilot-acp",
-        name="GitHub Copilot ACP",
-        auth_type="external_process",
-        inference_base_url=DEFAULT_COPILOT_ACP_BASE_URL,
-        base_url_env_var="COPILOT_ACP_BASE_URL",
-    ),
     "zai": ProviderConfig(
         id="zai",
         name="Z.AI / GLM",
@@ -145,7 +128,7 @@ PROVIDER_REGISTRY: Dict[str, ProviderConfig] = {
         id="minimax",
         name="MiniMax",
         auth_type="api_key",
-        inference_base_url="https://api.minimax.io/anthropic",
+        inference_base_url="https://api.minimax.io/v1",
         api_key_env_vars=("MINIMAX_API_KEY",),
         base_url_env_var="MINIMAX_BASE_URL",
     ),
@@ -168,7 +151,7 @@ PROVIDER_REGISTRY: Dict[str, ProviderConfig] = {
         id="minimax-cn",
         name="MiniMax (China)",
         auth_type="api_key",
-        inference_base_url="https://api.minimaxi.com/anthropic",
+        inference_base_url="https://api.minimaxi.com/v1",
         api_key_env_vars=("MINIMAX_CN_API_KEY",),
         base_url_env_var="MINIMAX_CN_BASE_URL",
     ),
@@ -199,9 +182,9 @@ PROVIDER_REGISTRY: Dict[str, ProviderConfig] = {
     "opencode-go": ProviderConfig(
         id="opencode-go",
         name="OpenCode Go",
-        auth_type="api_key",
+        auth_type="***",
         inference_base_url="https://opencode.ai/zen/go/v1",
-        api_key_env_vars=("OPENCODE_GO_API_KEY",),
+        api_key_env_vars=("OPEN...",),
         base_url_env_var="OPENCODE_GO_BASE_URL",
     ),
     "kilocode": ProviderConfig(
@@ -239,97 +222,6 @@ def _resolve_kimi_base_url(api_key: str, default_url: str, env_override: str) ->
     return default_url
 
 
-def _gh_cli_candidates() -> list[str]:
-    """Return candidate ``gh`` binary paths, including common Homebrew installs."""
-    candidates: list[str] = []
-
-    resolved = shutil.which("gh")
-    if resolved:
-        candidates.append(resolved)
-
-    for candidate in (
-        "/opt/homebrew/bin/gh",
-        "/usr/local/bin/gh",
-        str(Path.home() / ".local" / "bin" / "gh"),
-    ):
-        if candidate in candidates:
-            continue
-        if os.path.isfile(candidate) and os.access(candidate, os.X_OK):
-            candidates.append(candidate)
-
-    return candidates
-
-
-def _try_gh_cli_token() -> Optional[str]:
-    """Return a token from ``gh auth token`` when the GitHub CLI is available."""
-    for gh_path in _gh_cli_candidates():
-        try:
-            result = subprocess.run(
-                [gh_path, "auth", "token"],
-                capture_output=True,
-                text=True,
-                timeout=5,
-            )
-        except (FileNotFoundError, subprocess.TimeoutExpired) as exc:
-            logger.debug("gh CLI token lookup failed (%s): %s", gh_path, exc)
-            continue
-        if result.returncode == 0 and result.stdout.strip():
-            return result.stdout.strip()
-    return None
-
-
-_PLACEHOLDER_SECRET_VALUES = {
-    "*",
-    "**",
-    "***",
-    "changeme",
-    "your_api_key",
-    "your-api-key",
-    "placeholder",
-    "example",
-    "dummy",
-    "null",
-    "none",
-}
-
-
-def has_usable_secret(value: Any, *, min_length: int = 4) -> bool:
-    """Return True when a configured secret looks usable, not empty/placeholder."""
-    if not isinstance(value, str):
-        return False
-    cleaned = value.strip()
-    if len(cleaned) < min_length:
-        return False
-    if cleaned.lower() in _PLACEHOLDER_SECRET_VALUES:
-        return False
-    return True
-
-
-def _resolve_api_key_provider_secret(
-    provider_id: str, pconfig: ProviderConfig
-) -> tuple[str, str]:
-    """Resolve an API-key provider's token and indicate where it came from."""
-    if provider_id == "copilot":
-        # Use the dedicated copilot auth module for proper token validation
-        try:
-            from hermes_cli.copilot_auth import resolve_copilot_token
-            token, source = resolve_copilot_token()
-            if token:
-                return token, source
-        except ValueError as exc:
-            logger.warning("Copilot token validation failed: %s", exc)
-        except Exception:
-            pass
-        return "", ""
-
-    for env_var in pconfig.api_key_env_vars:
-        val = os.getenv(env_var, "").strip()
-        if has_usable_secret(val):
-            return val, env_var
-
-    return "", ""
-
-
 # =============================================================================
 # Z.AI Endpoint Detection
 # =============================================================================
@@ -680,9 +572,6 @@ def resolve_provider(
         "kimi": "kimi-coding", "moonshot": "kimi-coding",
         "minimax-china": "minimax-cn", "minimax_cn": "minimax-cn",
         "claude": "anthropic", "claude-code": "anthropic",
-        "github": "copilot", "github-copilot": "copilot",
-        "github-models": "copilot", "github-model": "copilot",
-        "github-copilot-acp": "copilot-acp", "copilot-acp-agent": "copilot-acp",
         "aigateway": "ai-gateway", "vercel": "ai-gateway", "vercel-ai-gateway": "ai-gateway",
         "opencode": "opencode-zen", "zen": "opencode-zen",
         "go": "opencode-go", "opencode-go-sub": "opencode-go",
@@ -690,10 +579,8 @@ def resolve_provider(
     }
     normalized = _PROVIDER_ALIASES.get(normalized, normalized)
 
-    if normalized == "openrouter":
+    if normalized in {"openrouter", "custom"}:
         return "openrouter"
-    if normalized == "custom":
-        return "custom"
     if normalized in PROVIDER_REGISTRY:
         return normalized
     if normalized != "auto":
@@ -717,20 +604,15 @@ def resolve_provider(
     except Exception as e:
         logger.debug("Could not detect active auth provider: %s", e)
 
-    if has_usable_secret(os.getenv("OPENAI_API_KEY")) or has_usable_secret(os.getenv("OPENROUTER_API_KEY")):
+    if os.getenv("OPENAI_API_KEY") or os.getenv("OPENROUTER_API_KEY"):
         return "openrouter"
 
     # Auto-detect API-key providers by checking their env vars
     for pid, pconfig in PROVIDER_REGISTRY.items():
         if pconfig.auth_type != "api_key":
             continue
-        # GitHub tokens are commonly present for repo/tool access but should not
-        # hijack inference auto-selection unless the user explicitly chooses
-        # Copilot/GitHub Models as the provider.
-        if pid == "copilot":
-            continue
         for env_var in pconfig.api_key_env_vars:
-            if has_usable_secret(os.getenv(env_var, "")):
+            if os.getenv(env_var, "").strip():
                 return pid
 
     return "openrouter"
@@ -1597,7 +1479,12 @@ def get_api_key_provider_status(provider_id: str) -> Dict[str, Any]:
 
     api_key = ""
     key_source = ""
-    api_key, key_source = _resolve_api_key_provider_secret(provider_id, pconfig)
+    for env_var in pconfig.api_key_env_vars:
+        val = os.getenv(env_var, "").strip()
+        if val:
+            api_key = val
+            key_source = env_var
+            break
 
     env_url = ""
     if pconfig.base_url_env_var:
@@ -1620,36 +1507,6 @@ def get_api_key_provider_status(provider_id: str) -> Dict[str, Any]:
     }
 
 
-def get_external_process_provider_status(provider_id: str) -> Dict[str, Any]:
-    """Status snapshot for providers that run a local subprocess."""
-    pconfig = PROVIDER_REGISTRY.get(provider_id)
-    if not pconfig or pconfig.auth_type != "external_process":
-        return {"configured": False}
-
-    command = (
-        os.getenv("HERMES_COPILOT_ACP_COMMAND", "").strip()
-        or os.getenv("COPILOT_CLI_PATH", "").strip()
-        or "copilot"
-    )
-    raw_args = os.getenv("HERMES_COPILOT_ACP_ARGS", "").strip()
-    args = shlex.split(raw_args) if raw_args else ["--acp", "--stdio"]
-    base_url = os.getenv(pconfig.base_url_env_var, "").strip() if pconfig.base_url_env_var else ""
-    if not base_url:
-        base_url = pconfig.inference_base_url
-
-    resolved_command = shutil.which(command) if command else None
-    return {
-        "configured": bool(resolved_command or base_url.startswith("acp+tcp://")),
-        "provider": provider_id,
-        "name": pconfig.name,
-        "command": command,
-        "args": args,
-        "resolved_command": resolved_command,
-        "base_url": base_url,
-        "logged_in": bool(resolved_command or base_url.startswith("acp+tcp://")),
-    }
-
-
 def get_auth_status(provider_id: Optional[str] = None) -> Dict[str, Any]:
     """Generic auth status dispatcher."""
     target = provider_id or get_active_provider()
@@ -1657,8 +1514,6 @@ def get_auth_status(provider_id: Optional[str] = None) -> Dict[str, Any]:
         return get_nous_auth_status()
     if target == "openai-codex":
         return get_codex_auth_status()
-    if target == "copilot-acp":
-        return get_external_process_provider_status(target)
     # API-key providers
     pconfig = PROVIDER_REGISTRY.get(target)
     if pconfig and pconfig.auth_type == "api_key":
@@ -1681,7 +1536,12 @@ def resolve_api_key_provider_credentials(provider_id: str) -> Dict[str, Any]:
 
     api_key = ""
     key_source = ""
-    api_key, key_source = _resolve_api_key_provider_secret(provider_id, pconfig)
+    for env_var in pconfig.api_key_env_vars:
+        val = os.getenv(env_var, "").strip()
+        if val:
+            api_key = val
+            key_source = env_var
+            break
 
     env_url = ""
     if pconfig.base_url_env_var:
@@ -1702,46 +1562,6 @@ def resolve_api_key_provider_credentials(provider_id: str) -> Dict[str, Any]:
     }
 
 
-def resolve_external_process_provider_credentials(provider_id: str) -> Dict[str, Any]:
-    """Resolve runtime details for local subprocess-backed providers."""
-    pconfig = PROVIDER_REGISTRY.get(provider_id)
-    if not pconfig or pconfig.auth_type != "external_process":
-        raise AuthError(
-            f"Provider '{provider_id}' is not an external-process provider.",
-            provider=provider_id,
-            code="invalid_provider",
-        )
-
-    base_url = os.getenv(pconfig.base_url_env_var, "").strip() if pconfig.base_url_env_var else ""
-    if not base_url:
-        base_url = pconfig.inference_base_url
-
-    command = (
-        os.getenv("HERMES_COPILOT_ACP_COMMAND", "").strip()
-        or os.getenv("COPILOT_CLI_PATH", "").strip()
-        or "copilot"
-    )
-    raw_args = os.getenv("HERMES_COPILOT_ACP_ARGS", "").strip()
-    args = shlex.split(raw_args) if raw_args else ["--acp", "--stdio"]
-    resolved_command = shutil.which(command) if command else None
-    if not resolved_command and not base_url.startswith("acp+tcp://"):
-        raise AuthError(
-            f"Could not find the Copilot CLI command '{command}'. "
-            "Install GitHub Copilot CLI or set HERMES_COPILOT_ACP_COMMAND/COPILOT_CLI_PATH.",
-            provider=provider_id,
-            code="missing_copilot_cli",
-        )
-
-    return {
-        "provider": provider_id,
-        "api_key": "copilot-acp",
-        "base_url": base_url.rstrip("/"),
-        "command": resolved_command or command,
-        "args": args,
-        "source": "process",
-    }
-
-
 # =============================================================================
 # External credential detection
 # =============================================================================

hermes_cli/banner.py

@@ -27,7 +27,7 @@ logger = logging.getLogger(__name__)
 # ANSI building blocks for conversation display
 # =========================================================================
 
-_GOLD = "\033[1;38;2;255;215;0m"  # True-color #FFD700 bold
+_GOLD = "\033[1;33m"
 _BOLD = "\033[1m"
 _DIM = "\033[2m"
 _RST = "\033[0m"
@@ -289,8 +289,6 @@ def build_welcome_banner(console: Console, model: str, cwd: str,
         _hero = HERMES_CADUCEUS
     left_lines = ["", _hero, ""]
     model_short = model.split("/")[-1] if "/" in model else model
-    if model_short.endswith(".gguf"):
-        model_short = model_short[:-5]
     if len(model_short) > 28:
         model_short = model_short[:25] + "..."
     ctx_str = f" [dim {dim}]·[/] [dim {dim}]{_format_context_length(context_length)} context[/]" if context_length else ""

hermes_cli/commands.py

@@ -61,14 +61,8 @@ COMMAND_REGISTRY: list[CommandDef] = [
     CommandDef("rollback", "List or restore filesystem checkpoints", "Session",
                args_hint="[number]"),
     CommandDef("stop", "Kill all running background processes", "Session"),
-    CommandDef("approve", "Approve a pending dangerous command", "Session",
-               gateway_only=True, args_hint="[session|always]"),
-    CommandDef("deny", "Deny a pending dangerous command", "Session",
-               gateway_only=True),
     CommandDef("background", "Run a prompt in the background", "Session",
                aliases=("bg",), args_hint="<prompt>"),
-    CommandDef("queue", "Queue a prompt for the next turn (doesn't interrupt)", "Session",
-               aliases=("q",), args_hint="<prompt>"),
     CommandDef("status", "Show session info", "Session",
                gateway_only=True),
     CommandDef("sethome", "Set this chat as the home channel", "Session",
@@ -137,7 +131,7 @@ COMMAND_REGISTRY: list[CommandDef] = [
 
 
 # ---------------------------------------------------------------------------
-# Derived lookups -- rebuilt once at import time, refreshed by rebuild_lookups()
+# Derived lookups -- rebuilt once at import time
 # ---------------------------------------------------------------------------
 
 def _build_command_lookup() -> dict[str, CommandDef]:
@@ -161,58 +155,6 @@ def resolve_command(name: str) -> CommandDef | None:
     return _COMMAND_LOOKUP.get(name.lower().lstrip("/"))
 
 
-def register_plugin_command(cmd: CommandDef) -> None:
-    """Append a plugin-defined command to the registry and refresh lookups."""
-    COMMAND_REGISTRY.append(cmd)
-    rebuild_lookups()
-
-
-def rebuild_lookups() -> None:
-    """Rebuild all derived lookup dicts from the current COMMAND_REGISTRY.
-
-    Called after plugin commands are registered so they appear in help,
-    autocomplete, gateway dispatch, Telegram menu, and Slack mapping.
-    """
-    global GATEWAY_KNOWN_COMMANDS
-
-    _COMMAND_LOOKUP.clear()
-    _COMMAND_LOOKUP.update(_build_command_lookup())
-
-    COMMANDS.clear()
-    for cmd in COMMAND_REGISTRY:
-        if not cmd.gateway_only:
-            COMMANDS[f"/{cmd.name}"] = _build_description(cmd)
-            for alias in cmd.aliases:
-                COMMANDS[f"/{alias}"] = f"{cmd.description} (alias for /{cmd.name})"
-
-    COMMANDS_BY_CATEGORY.clear()
-    for cmd in COMMAND_REGISTRY:
-        if not cmd.gateway_only:
-            cat = COMMANDS_BY_CATEGORY.setdefault(cmd.category, {})
-            cat[f"/{cmd.name}"] = COMMANDS[f"/{cmd.name}"]
-            for alias in cmd.aliases:
-                cat[f"/{alias}"] = COMMANDS[f"/{alias}"]
-
-    SUBCOMMANDS.clear()
-    for cmd in COMMAND_REGISTRY:
-        if cmd.subcommands:
-            SUBCOMMANDS[f"/{cmd.name}"] = list(cmd.subcommands)
-    for cmd in COMMAND_REGISTRY:
-        key = f"/{cmd.name}"
-        if key in SUBCOMMANDS or not cmd.args_hint:
-            continue
-        m = _PIPE_SUBS_RE.search(cmd.args_hint)
-        if m:
-            SUBCOMMANDS[key] = m.group(0).split("|")
-
-    GATEWAY_KNOWN_COMMANDS = frozenset(
-        name
-        for cmd in COMMAND_REGISTRY
-        if not cmd.cli_only
-        for name in (cmd.name, *cmd.aliases)
-    )
-
-
 def _build_description(cmd: CommandDef) -> str:
     """Build a CLI-facing description string including usage hint."""
     if cmd.args_hint:
@@ -449,136 +391,9 @@ class SlashCommandCompleter(Completer):
             )
             count += 1
 
-    @staticmethod
-    def _extract_context_word(text: str) -> str | None:
-        """Extract a bare ``@`` token for context reference completions."""
-        if not text:
-            return None
-        # Walk backwards to find the start of the current word
-        i = len(text) - 1
-        while i >= 0 and text[i] != " ":
-            i -= 1
-        word = text[i + 1:]
-        if not word.startswith("@"):
-            return None
-        return word
-
-    @staticmethod
-    def _context_completions(word: str, limit: int = 30):
-        """Yield Claude Code-style @ context completions.
-
-        Bare ``@`` or ``@partial`` shows static references and matching
-        files/folders.  ``@file:path`` and ``@folder:path`` are handled
-        by the existing path completion path.
-        """
-        lowered = word.lower()
-
-        # Static context references
-        _STATIC_REFS = (
-            ("@diff", "Git working tree diff"),
-            ("@staged", "Git staged diff"),
-            ("@file:", "Attach a file"),
-            ("@folder:", "Attach a folder"),
-            ("@git:", "Git log with diffs (e.g. @git:5)"),
-            ("@url:", "Fetch web content"),
-        )
-        for candidate, meta in _STATIC_REFS:
-            if candidate.lower().startswith(lowered) and candidate.lower() != lowered:
-                yield Completion(
-                    candidate,
-                    start_position=-len(word),
-                    display=candidate,
-                    display_meta=meta,
-                )
-
-        # If the user typed @file: or @folder:, delegate to path completions
-        for prefix in ("@file:", "@folder:"):
-            if word.startswith(prefix):
-                path_part = word[len(prefix):] or "."
-                expanded = os.path.expanduser(path_part)
-                if expanded.endswith("/"):
-                    search_dir, match_prefix = expanded, ""
-                else:
-                    search_dir = os.path.dirname(expanded) or "."
-                    match_prefix = os.path.basename(expanded)
-
-                try:
-                    entries = os.listdir(search_dir)
-                except OSError:
-                    return
-
-                count = 0
-                prefix_lower = match_prefix.lower()
-                for entry in sorted(entries):
-                    if match_prefix and not entry.lower().startswith(prefix_lower):
-                        continue
-                    if count >= limit:
-                        break
-                    full_path = os.path.join(search_dir, entry)
-                    is_dir = os.path.isdir(full_path)
-                    display_path = os.path.relpath(full_path)
-                    suffix = "/" if is_dir else ""
-                    kind = "folder" if is_dir else "file"
-                    meta = "dir" if is_dir else _file_size_label(full_path)
-                    completion = f"@{kind}:{display_path}{suffix}"
-                    yield Completion(
-                        completion,
-                        start_position=-len(word),
-                        display=entry + suffix,
-                        display_meta=meta,
-                    )
-                    count += 1
-                return
-
-        # Bare @ or @partial — show matching files/folders from cwd
-        query = word[1:]  # strip the @
-        if not query:
-            search_dir, match_prefix = ".", ""
-        else:
-            expanded = os.path.expanduser(query)
-            if expanded.endswith("/"):
-                search_dir, match_prefix = expanded, ""
-            else:
-                search_dir = os.path.dirname(expanded) or "."
-                match_prefix = os.path.basename(expanded)
-
-        try:
-            entries = os.listdir(search_dir)
-        except OSError:
-            return
-
-        count = 0
-        prefix_lower = match_prefix.lower()
-        for entry in sorted(entries):
-            if match_prefix and not entry.lower().startswith(prefix_lower):
-                continue
-            if entry.startswith("."):
-                continue  # skip hidden files in bare @ mode
-            if count >= limit:
-                break
-            full_path = os.path.join(search_dir, entry)
-            is_dir = os.path.isdir(full_path)
-            display_path = os.path.relpath(full_path)
-            suffix = "/" if is_dir else ""
-            kind = "folder" if is_dir else "file"
-            meta = "dir" if is_dir else _file_size_label(full_path)
-            completion = f"@{kind}:{display_path}{suffix}"
-            yield Completion(
-                completion,
-                start_position=-len(word),
-                display=entry + suffix,
-                display_meta=meta,
-            )
-            count += 1
-
     def get_completions(self, document, complete_event):
         text = document.text_before_cursor
         if not text.startswith("/"):
-            # Try @ context completion (Claude Code-style)
-            ctx_word = self._extract_context_word(text)
-            if ctx_word is not None:
-                yield from self._context_completions(ctx_word)
-                return
             # Try file path completion for non-slash input
             path_word = self._extract_path_word(text)
             if path_word is not None:

hermes_cli/config.py

@@ -46,32 +46,6 @@ from hermes_cli.colors import Colors, color
 from hermes_cli.default_soul import DEFAULT_SOUL_MD
 
 
-# =============================================================================
-# Managed mode (NixOS declarative config)
-# =============================================================================
-
-def is_managed() -> bool:
-    """Check if hermes is running in Nix-managed mode.
-
-    Two signals: the HERMES_MANAGED env var (set by the systemd service),
-    or a .managed marker file in HERMES_HOME (set by the NixOS activation
-    script, so interactive shells also see it).
-    """
-    if os.getenv("HERMES_MANAGED", "").lower() in ("true", "1", "yes"):
-        return True
-    managed_marker = Path(os.getenv("HERMES_HOME", str(Path.home() / ".hermes"))) / ".managed"
-    return managed_marker.exists()
-
-def managed_error(action: str = "modify configuration"):
-    """Print user-friendly error for managed mode."""
-    print(
-        f"Cannot {action}: configuration is managed by NixOS (HERMES_MANAGED=true).\n"
-        "Edit services.hermes-agent.settings in your configuration.nix and run:\n"
-        "  sudo nixos-rebuild switch",
-        file=sys.stderr,
-    )
-
-
 # =============================================================================
 # Config paths
 # =============================================================================
@@ -145,10 +119,6 @@ DEFAULT_CONFIG = {
         "backend": "local",
         "cwd": ".",  # Use current directory
         "timeout": 180,
-        # Environment variables to pass through to sandboxed execution
-        # (terminal and execute_code).  Skill-declared required_environment_variables
-        # are passed through automatically; this list is for non-skill use cases.
-        "env_passthrough": [],
         "docker_image": "nikolaik/python-nodejs:python3.11-nodejs20",
         "docker_forward_env": [],
         "singularity_image": "docker://nikolaik/python-nodejs:python3.11-nodejs20",
@@ -175,7 +145,6 @@ DEFAULT_CONFIG = {
     
     "browser": {
         "inactivity_timeout": 120,
-        "command_timeout": 30,  # Timeout for browser commands in seconds (screenshot, navigate, etc.)
         "record_sessions": False,  # Auto-record browser sessions as WebM videos
     },
 
@@ -189,10 +158,8 @@ DEFAULT_CONFIG = {
     
     "compression": {
         "enabled": True,
-        "threshold": 0.50,            # compress when context usage exceeds this ratio
-        "target_ratio": 0.20,         # fraction of threshold to preserve as recent tail
-        "protect_last_n": 20,         # minimum recent messages to keep uncompressed
-        "summary_model": "",          # empty = use main configured model
+        "threshold": 0.50,
+        "summary_model": "google/gemini-3-flash-preview",
         "summary_provider": "auto",
         "summary_base_url": None,
     },
@@ -215,7 +182,6 @@ DEFAULT_CONFIG = {
             "model": "",           # e.g. "google/gemini-2.5-flash", "gpt-4o"
             "base_url": "",        # direct OpenAI-compatible endpoint (takes precedence over provider)
             "api_key": "",         # API key for base_url (falls back to OPENAI_API_KEY)
-            "timeout": 30,         # seconds — increase for slow local vision models
         },
         "web_extract": {
             "provider": "auto",
@@ -704,11 +670,6 @@ OPTIONAL_ENV_VARS = {
         "password": True,
         "category": "tool",
     },
-    "HONCHO_BASE_URL": {
-        "description": "Base URL for self-hosted Honcho instances (no API key needed)",
-        "prompt": "Honcho base URL (e.g. http://localhost:8000)",
-        "category": "tool",
-    },
 
     # ── Messaging platforms ──
     "TELEGRAM_BOT_TOKEN": {
@@ -846,27 +807,6 @@ OPTIONAL_ENV_VARS = {
         "category": "messaging",
         "advanced": True,
     },
-    "WEBHOOK_ENABLED": {
-        "description": "Enable the webhook platform adapter for receiving events from GitHub, GitLab, etc.",
-        "prompt": "Enable webhooks (true/false)",
-        "url": None,
-        "password": False,
-        "category": "messaging",
-    },
-    "WEBHOOK_PORT": {
-        "description": "Port for the webhook HTTP server (default: 8644).",
-        "prompt": "Webhook port",
-        "url": None,
-        "password": False,
-        "category": "messaging",
-    },
-    "WEBHOOK_SECRET": {
-        "description": "Global HMAC secret for webhook signature validation (overridable per route in config.yaml).",
-        "prompt": "Webhook secret",
-        "url": None,
-        "password": True,
-        "category": "messaging",
-    },
 
     # ── Agent settings ──
     "MESSAGING_CWD": {
@@ -1205,26 +1145,6 @@ def _deep_merge(base: dict, override: dict) -> dict:
     return result
 
 
-def _expand_env_vars(obj):
-    """Recursively expand ``${VAR}`` references in config values.
-
-    Only string values are processed; dict keys, numbers, booleans, and
-    None are left untouched.  Unresolved references (variable not in
-    ``os.environ``) are kept verbatim so callers can detect them.
-    """
-    if isinstance(obj, str):
-        return re.sub(
-            r"\${([^}]+)}",
-            lambda m: os.environ.get(m.group(1), m.group(0)),
-            obj,
-        )
-    if isinstance(obj, dict):
-        return {k: _expand_env_vars(v) for k, v in obj.items()}
-    if isinstance(obj, list):
-        return [_expand_env_vars(item) for item in obj]
-    return obj
-
-
 def _normalize_max_turns_config(config: Dict[str, Any]) -> Dict[str, Any]:
     """Normalize legacy root-level max_turns into agent.max_turns."""
     config = dict(config)
@@ -1266,7 +1186,7 @@ def load_config() -> Dict[str, Any]:
         except Exception as e:
             print(f"Warning: Failed to load config: {e}")
     
-    return _expand_env_vars(_normalize_max_turns_config(config))
+    return _normalize_max_turns_config(config)
 
 
 _SECURITY_COMMENT = """
@@ -1366,9 +1286,6 @@ _COMMENTED_SECTIONS = """
 
 def save_config(config: Dict[str, Any]):
     """Save configuration to ~/.hermes/config.yaml."""
-    if is_managed():
-        managed_error("save configuration")
-        return
     from utils import atomic_yaml_write
 
     ensure_hermes_home()
@@ -1510,9 +1427,6 @@ def sanitize_env_file() -> int:
 
 def save_env_value(key: str, value: str):
     """Save or update a value in ~/.hermes/.env."""
-    if is_managed():
-        managed_error(f"set {key}")
-        return
     if not _ENV_VAR_NAME_RE.match(key):
         raise ValueError(f"Invalid environment variable name: {key!r}")
     value = value.replace("\n", "").replace("\r", "")
@@ -1667,6 +1581,7 @@ def show_config():
     print(color("◆ Model", Colors.CYAN, Colors.BOLD))
     print(f"  Model:        {config.get('model', 'not set')}")
     print(f"  Max turns:    {config.get('agent', {}).get('max_turns', DEFAULT_CONFIG['agent']['max_turns'])}")
+    print(f"  Toolsets:     {', '.join(config.get('toolsets', ['all']))}")
     
     # Display
     print()
@@ -1685,11 +1600,11 @@ def show_config():
     print(f"  Timeout:      {terminal.get('timeout', 60)}s")
     
     if terminal.get('backend') == 'docker':
-        print(f"  Docker image: {terminal.get('docker_image', 'nikolaik/python-nodejs:python3.11-nodejs20')}")
+        print(f"  Docker image: {terminal.get('docker_image', 'python:3.11-slim')}")
     elif terminal.get('backend') == 'singularity':
-        print(f"  Image:        {terminal.get('singularity_image', 'docker://nikolaik/python-nodejs:python3.11-nodejs20')}")
+        print(f"  Image:        {terminal.get('singularity_image', 'docker://python:3.11')}")
     elif terminal.get('backend') == 'modal':
-        print(f"  Modal image:  {terminal.get('modal_image', 'nikolaik/python-nodejs:python3.11-nodejs20')}")
+        print(f"  Modal image:  {terminal.get('modal_image', 'python:3.11')}")
         modal_token = get_env_value('MODAL_TOKEN_ID')
         print(f"  Modal token:  {'configured' if modal_token else '(not set)'}")
     elif terminal.get('backend') == 'daytona':
@@ -1719,10 +1634,7 @@ def show_config():
     print(f"  Enabled:      {'yes' if enabled else 'no'}")
     if enabled:
         print(f"  Threshold:    {compression.get('threshold', 0.50) * 100:.0f}%")
-        print(f"  Target ratio: {compression.get('target_ratio', 0.20) * 100:.0f}% of threshold preserved")
-        print(f"  Protect last: {compression.get('protect_last_n', 20)} messages")
-        _sm = compression.get('summary_model', '') or '(main model)'
-        print(f"  Model:        {_sm}")
+        print(f"  Model:        {compression.get('summary_model', 'google/gemini-3-flash-preview')}")
         comp_provider = compression.get('summary_provider', 'auto')
         if comp_provider != 'auto':
             print(f"  Provider:     {comp_provider}")
@@ -1769,9 +1681,6 @@ def show_config():
 
 def edit_config():
     """Open config file in user's editor."""
-    if is_managed():
-        managed_error("edit configuration")
-        return
     config_path = get_config_path()
     
     # Ensure config exists
@@ -1801,9 +1710,6 @@ def edit_config():
 
 def set_config_value(key: str, value: str):
     """Set a configuration value."""
-    if is_managed():
-        managed_error("set configuration values")
-        return
     # Check if it's an API key (goes to .env)
     api_keys = [
         'OPENROUTER_API_KEY', 'OPENAI_API_KEY', 'ANTHROPIC_API_KEY', 'VOICE_TOOLS_OPENAI_KEY',

hermes_cli/copilot_auth.py

@@ -1,295 +0,0 @@
-"""GitHub Copilot authentication utilities.
-
-Implements the OAuth device code flow used by the Copilot CLI and handles
-token validation/exchange for the Copilot API.
-
-Token type support (per GitHub docs):
-  gho_          OAuth token           ✓  (default via copilot login)
-  github_pat_   Fine-grained PAT      ✓  (needs Copilot Requests permission)
-  ghu_          GitHub App token      ✓  (via environment variable)
-  ghp_          Classic PAT           ✗  NOT SUPPORTED
-
-Credential search order (matching Copilot CLI behaviour):
-  1. COPILOT_GITHUB_TOKEN env var
-  2. GH_TOKEN env var
-  3. GITHUB_TOKEN env var
-  4. gh auth token  CLI fallback
-"""
-
-from __future__ import annotations
-
-import json
-import logging
-import os
-import re
-import shutil
-import subprocess
-import time
-from pathlib import Path
-from typing import Any, Optional
-
-logger = logging.getLogger(__name__)
-
-# OAuth device code flow constants (same client ID as opencode/Copilot CLI)
-COPILOT_OAUTH_CLIENT_ID = "Ov23li8tweQw6odWQebz"
-COPILOT_DEVICE_CODE_URL = "https://github.com/login/device/code"
-COPILOT_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token"
-
-# Copilot API constants
-COPILOT_TOKEN_EXCHANGE_URL = "https://api.github.com/copilot_internal/v2/token"
-COPILOT_API_BASE_URL = "https://api.githubcopilot.com"
-
-# Token type prefixes
-_CLASSIC_PAT_PREFIX = "ghp_"
-_SUPPORTED_PREFIXES = ("gho_", "github_pat_", "ghu_")
-
-# Env var search order (matches Copilot CLI)
-COPILOT_ENV_VARS = ("COPILOT_GITHUB_TOKEN", "GH_TOKEN", "GITHUB_TOKEN")
-
-# Polling constants
-_DEVICE_CODE_POLL_INTERVAL = 5  # seconds
-_DEVICE_CODE_POLL_SAFETY_MARGIN = 3  # seconds
-
-
-def is_classic_pat(token: str) -> bool:
-    """Check if a token is a classic PAT (ghp_*), which Copilot doesn't support."""
-    return token.strip().startswith(_CLASSIC_PAT_PREFIX)
-
-
-def validate_copilot_token(token: str) -> tuple[bool, str]:
-    """Validate that a token is usable with the Copilot API.
-
-    Returns (valid, message).
-    """
-    token = token.strip()
-    if not token:
-        return False, "Empty token"
-
-    if token.startswith(_CLASSIC_PAT_PREFIX):
-        return False, (
-            "Classic Personal Access Tokens (ghp_*) are not supported by the "
-            "Copilot API. Use one of:\n"
-            "  → `copilot login` or `hermes model` to authenticate via OAuth\n"
-            "  → A fine-grained PAT (github_pat_*) with Copilot Requests permission\n"
-            "  → `gh auth login` with the default device code flow (produces gho_* tokens)"
-        )
-
-    return True, "OK"
-
-
-def resolve_copilot_token() -> tuple[str, str]:
-    """Resolve a GitHub token suitable for Copilot API use.
-
-    Returns (token, source) where source describes where the token came from.
-    Raises ValueError if only a classic PAT is available.
-    """
-    # 1. Check env vars in priority order
-    for env_var in COPILOT_ENV_VARS:
-        val = os.getenv(env_var, "").strip()
-        if val:
-            valid, msg = validate_copilot_token(val)
-            if not valid:
-                logger.warning(
-                    "Token from %s is not supported: %s", env_var, msg
-                )
-                continue
-            return val, env_var
-
-    # 2. Fall back to gh auth token
-    token = _try_gh_cli_token()
-    if token:
-        valid, msg = validate_copilot_token(token)
-        if not valid:
-            raise ValueError(
-                f"Token from `gh auth token` is a classic PAT (ghp_*). {msg}"
-            )
-        return token, "gh auth token"
-
-    return "", ""
-
-
-def _gh_cli_candidates() -> list[str]:
-    """Return candidate ``gh`` binary paths, including common Homebrew installs."""
-    candidates: list[str] = []
-
-    resolved = shutil.which("gh")
-    if resolved:
-        candidates.append(resolved)
-
-    for candidate in (
-        "/opt/homebrew/bin/gh",
-        "/usr/local/bin/gh",
-        str(Path.home() / ".local" / "bin" / "gh"),
-    ):
-        if candidate in candidates:
-            continue
-        if os.path.isfile(candidate) and os.access(candidate, os.X_OK):
-            candidates.append(candidate)
-
-    return candidates
-
-
-def _try_gh_cli_token() -> Optional[str]:
-    """Return a token from ``gh auth token`` when the GitHub CLI is available."""
-    for gh_path in _gh_cli_candidates():
-        try:
-            result = subprocess.run(
-                [gh_path, "auth", "token"],
-                capture_output=True,
-                text=True,
-                timeout=5,
-            )
-        except (FileNotFoundError, subprocess.TimeoutExpired) as exc:
-            logger.debug("gh CLI token lookup failed (%s): %s", gh_path, exc)
-            continue
-        if result.returncode == 0 and result.stdout.strip():
-            return result.stdout.strip()
-    return None
-
-
-# ─── OAuth Device Code Flow ────────────────────────────────────────────────
-
-def copilot_device_code_login(
-    *,
-    host: str = "github.com",
-    timeout_seconds: float = 300,
-) -> Optional[str]:
-    """Run the GitHub OAuth device code flow for Copilot.
-
-    Prints instructions for the user, polls for completion, and returns
-    the OAuth access token on success, or None on failure/cancellation.
-
-    This replicates the flow used by opencode and the Copilot CLI.
-    """
-    import urllib.request
-    import urllib.parse
-
-    domain = host.rstrip("/")
-    device_code_url = f"https://{domain}/login/device/code"
-    access_token_url = f"https://{domain}/login/oauth/access_token"
-
-    # Step 1: Request device code
-    data = urllib.parse.urlencode({
-        "client_id": COPILOT_OAUTH_CLIENT_ID,
-        "scope": "read:user",
-    }).encode()
-
-    req = urllib.request.Request(
-        device_code_url,
-        data=data,
-        headers={
-            "Accept": "application/json",
-            "Content-Type": "application/x-www-form-urlencoded",
-            "User-Agent": "HermesAgent/1.0",
-        },
-    )
-
-    try:
-        with urllib.request.urlopen(req, timeout=15) as resp:
-            device_data = json.loads(resp.read().decode())
-    except Exception as exc:
-        logger.error("Failed to initiate device authorization: %s", exc)
-        print(f"  ✗ Failed to start device authorization: {exc}")
-        return None
-
-    verification_uri = device_data.get("verification_uri", "https://github.com/login/device")
-    user_code = device_data.get("user_code", "")
-    device_code = device_data.get("device_code", "")
-    interval = max(device_data.get("interval", _DEVICE_CODE_POLL_INTERVAL), 1)
-
-    if not device_code or not user_code:
-        print("  ✗ GitHub did not return a device code.")
-        return None
-
-    # Step 2: Show instructions
-    print()
-    print(f"  Open this URL in your browser: {verification_uri}")
-    print(f"  Enter this code: {user_code}")
-    print()
-    print("  Waiting for authorization...", end="", flush=True)
-
-    # Step 3: Poll for completion
-    deadline = time.time() + timeout_seconds
-
-    while time.time() < deadline:
-        time.sleep(interval + _DEVICE_CODE_POLL_SAFETY_MARGIN)
-
-        poll_data = urllib.parse.urlencode({
-            "client_id": COPILOT_OAUTH_CLIENT_ID,
-            "device_code": device_code,
-            "grant_type": "urn:ietf:params:oauth:grant-type:device_code",
-        }).encode()
-
-        poll_req = urllib.request.Request(
-            access_token_url,
-            data=poll_data,
-            headers={
-                "Accept": "application/json",
-                "Content-Type": "application/x-www-form-urlencoded",
-                "User-Agent": "HermesAgent/1.0",
-            },
-        )
-
-        try:
-            with urllib.request.urlopen(poll_req, timeout=10) as resp:
-                result = json.loads(resp.read().decode())
-        except Exception:
-            print(".", end="", flush=True)
-            continue
-
-        if result.get("access_token"):
-            print(" ✓")
-            return result["access_token"]
-
-        error = result.get("error", "")
-        if error == "authorization_pending":
-            print(".", end="", flush=True)
-            continue
-        elif error == "slow_down":
-            # RFC 8628: add 5 seconds to polling interval
-            server_interval = result.get("interval")
-            if isinstance(server_interval, (int, float)) and server_interval > 0:
-                interval = int(server_interval)
-            else:
-                interval += 5
-            print(".", end="", flush=True)
-            continue
-        elif error == "expired_token":
-            print()
-            print("  ✗ Device code expired. Please try again.")
-            return None
-        elif error == "access_denied":
-            print()
-            print("  ✗ Authorization was denied.")
-            return None
-        elif error:
-            print()
-            print(f"  ✗ Authorization failed: {error}")
-            return None
-
-    print()
-    print("  ✗ Timed out waiting for authorization.")
-    return None
-
-
-# ─── Copilot API Headers ───────────────────────────────────────────────────
-
-def copilot_request_headers(
-    *,
-    is_agent_turn: bool = True,
-    is_vision: bool = False,
-) -> dict[str, str]:
-    """Build the standard headers for Copilot API requests.
-
-    Replicates the header set used by opencode and the Copilot CLI.
-    """
-    headers: dict[str, str] = {
-        "Editor-Version": "vscode/1.104.1",
-        "User-Agent": "HermesAgent/1.0",
-        "Openai-Intent": "conversation-edits",
-        "x-initiator": "agent" if is_agent_turn else "user",
-    }
-    if is_vision:
-        headers["Copilot-Vision-Request"] = "true"
-
-    return headers

hermes_cli/doctor.py

@@ -26,6 +26,10 @@ if _env_path.exists():
 # Also try project .env as dev fallback
 load_dotenv(PROJECT_ROOT / ".env", override=False, encoding="utf-8")
 
+# Point mini-swe-agent at ~/.hermes/ so it shares our config
+os.environ.setdefault("MSWEA_GLOBAL_CONFIG_DIR", str(HERMES_HOME))
+os.environ.setdefault("MSWEA_SILENT_STARTUP", "1")
+
 from hermes_cli.colors import Colors, color
 from hermes_constants import OPENROUTER_MODELS_URL
 
@@ -614,6 +618,18 @@ def run_doctor(args):
     print()
     print(color("◆ Submodules", Colors.CYAN, Colors.BOLD))
     
+    # mini-swe-agent (terminal tool backend)
+    mini_swe_dir = PROJECT_ROOT / "mini-swe-agent"
+    if mini_swe_dir.exists() and (mini_swe_dir / "pyproject.toml").exists():
+        try:
+            __import__("minisweagent")
+            check_ok("mini-swe-agent", "(terminal backend)")
+        except ImportError:
+            check_warn("mini-swe-agent found but not installed", "(run: uv pip install -e ./mini-swe-agent)")
+            issues.append("Install mini-swe-agent: uv pip install -e ./mini-swe-agent")
+    else:
+        check_warn("mini-swe-agent not found", "(run: git submodule update --init --recursive)")
+    
     # tinker-atropos (RL training backend)
     tinker_dir = PROJECT_ROOT / "tinker-atropos"
     if tinker_dir.exists() and (tinker_dir / "pyproject.toml").exists():
@@ -701,14 +717,13 @@ def run_doctor(args):
     print(color("◆ Honcho Memory", Colors.CYAN, Colors.BOLD))
 
     try:
-        from honcho_integration.client import HonchoClientConfig, resolve_config_path
+        from honcho_integration.client import HonchoClientConfig, GLOBAL_CONFIG_PATH
         hcfg = HonchoClientConfig.from_global_config()
-        _honcho_cfg_path = resolve_config_path()
 
-        if not _honcho_cfg_path.exists():
+        if not GLOBAL_CONFIG_PATH.exists():
             check_warn("Honcho config not found", f"run: hermes honcho setup")
         elif not hcfg.enabled:
-            check_info(f"Honcho disabled (set enabled: true in {_honcho_cfg_path} to activate)")
+            check_info("Honcho disabled (set enabled: true in ~/.honcho/config.json to activate)")
         elif not hcfg.api_key:
             check_fail("Honcho API key not set", "run: hermes honcho setup")
             issues.append("No Honcho API key — run 'hermes honcho setup'")

hermes_cli/gateway.py

@@ -14,7 +14,7 @@ from pathlib import Path
 
 PROJECT_ROOT = Path(__file__).parent.parent.resolve()
 
-from hermes_cli.config import get_env_value, get_hermes_home, save_env_value, is_managed, managed_error
+from hermes_cli.config import get_env_value, get_hermes_home, save_env_value
 from hermes_cli.setup import (
     print_header, print_info, print_success, print_warning, print_error,
     prompt, prompt_choice, prompt_yes_no,
@@ -371,37 +371,13 @@ def print_systemd_linger_guidance() -> None:
 def get_launchd_plist_path() -> Path:
     return Path.home() / "Library" / "LaunchAgents" / "ai.hermes.gateway.plist"
 
-def _detect_venv_dir() -> Path | None:
-    """Detect the active virtualenv directory.
-
-    Checks ``sys.prefix`` first (works regardless of the directory name),
-    then falls back to probing common directory names under PROJECT_ROOT.
-    Returns ``None`` when no virtualenv can be found.
-    """
-    # If we're running inside a virtualenv, sys.prefix points to it.
-    if sys.prefix != sys.base_prefix:
-        venv = Path(sys.prefix)
-        if venv.is_dir():
-            return venv
-
-    # Fallback: check common virtualenv directory names under the project root.
-    for candidate in (".venv", "venv"):
-        venv = PROJECT_ROOT / candidate
-        if venv.is_dir():
-            return venv
-
-    return None
-
-
 def get_python_path() -> str:
-    venv = _detect_venv_dir()
-    if venv is not None:
-        if is_windows():
-            venv_python = venv / "Scripts" / "python.exe"
-        else:
-            venv_python = venv / "bin" / "python"
-        if venv_python.exists():
-            return str(venv_python)
+    if is_windows():
+        venv_python = PROJECT_ROOT / "venv" / "Scripts" / "python.exe"
+    else:
+        venv_python = PROJECT_ROOT / "venv" / "bin" / "python"
+    if venv_python.exists():
+        return str(venv_python)
     return sys.executable
 
 def get_hermes_cli_path() -> str:
@@ -423,9 +399,8 @@ def get_hermes_cli_path() -> str:
 def generate_systemd_unit(system: bool = False, run_as_user: str | None = None) -> str:
     python_path = get_python_path()
     working_dir = str(PROJECT_ROOT)
-    detected_venv = _detect_venv_dir()
-    venv_dir = str(detected_venv) if detected_venv else str(PROJECT_ROOT / "venv")
-    venv_bin = str(detected_venv / "bin") if detected_venv else str(PROJECT_ROOT / "venv" / "bin")
+    venv_dir = str(PROJECT_ROOT / "venv")
+    venv_bin = str(PROJECT_ROOT / "venv" / "bin")
     node_bin = str(PROJECT_ROOT / "node_modules" / ".bin")
 
     path_entries = [venv_bin, node_bin]
@@ -445,8 +420,6 @@ def generate_systemd_unit(system: bool = False, run_as_user: str | None = None)
 Description={SERVICE_DESCRIPTION}
 After=network-online.target
 Wants=network-online.target
-StartLimitIntervalSec=600
-StartLimitBurst=5
 
 [Service]
 Type=simple
@@ -461,7 +434,7 @@ Environment="PATH={sane_path}"
 Environment="VIRTUAL_ENV={venv_dir}"
 Environment="HERMES_HOME={hermes_home}"
 Restart=on-failure
-RestartSec=30
+RestartSec=10
 KillMode=mixed
 KillSignal=SIGTERM
 TimeoutStopSec=60
@@ -475,8 +448,6 @@ WantedBy=multi-user.target
     return f"""[Unit]
 Description={SERVICE_DESCRIPTION}
 After=network.target
-StartLimitIntervalSec=600
-StartLimitBurst=5
 
 [Service]
 Type=simple
@@ -486,7 +457,7 @@ Environment="PATH={sane_path}"
 Environment="VIRTUAL_ENV={venv_dir}"
 Environment="HERMES_HOME={hermes_home}"
 Restart=on-failure
-RestartSec=30
+RestartSec=10
 KillMode=mixed
 KillSignal=SIGTERM
 TimeoutStopSec=60
@@ -1562,9 +1533,6 @@ def _setup_signal():
 
 def gateway_setup():
     """Interactive setup for messaging platforms + gateway service."""
-    if is_managed():
-        managed_error("run gateway setup")
-        return
 
     print()
     print(color("┌─────────────────────────────────────────────────────────┐", Colors.MAGENTA))
@@ -1719,9 +1687,6 @@ def gateway_command(args):
 
     # Service management commands
     if subcmd == "install":
-        if is_managed():
-            managed_error("install gateway service (managed by NixOS)")
-            return
         force = getattr(args, 'force', False)
         system = getattr(args, 'system', False)
         run_as_user = getattr(args, 'run_as_user', None)
@@ -1735,9 +1700,6 @@ def gateway_command(args):
             sys.exit(1)
     
     elif subcmd == "uninstall":
-        if is_managed():
-            managed_error("uninstall gateway service (managed by NixOS)")
-            return
         system = getattr(args, 'system', False)
         if is_linux():
             systemd_uninstall(system=system)

hermes_cli/main.py

@@ -60,6 +60,9 @@ from hermes_cli.config import get_hermes_home
 from hermes_cli.env_loader import load_hermes_dotenv
 load_hermes_dotenv(project_env=PROJECT_ROOT / '.env')
 
+# Point mini-swe-agent at ~/.hermes/ so it shares our config
+os.environ.setdefault("MSWEA_GLOBAL_CONFIG_DIR", str(get_hermes_home()))
+os.environ.setdefault("MSWEA_SILENT_STARTUP", "1")
 
 import logging
 import time as _time
@@ -122,17 +125,6 @@ def _has_any_provider_configured() -> bool:
         except Exception:
             pass
 
-    # Check provider-specific auth fallbacks (for example, Copilot via gh auth).
-    try:
-        for provider_id, pconfig in PROVIDER_REGISTRY.items():
-            if pconfig.auth_type != "api_key":
-                continue
-            status = get_auth_status(provider_id)
-            if status.get("logged_in"):
-                return True
-    except Exception:
-        pass
-
     # Check for Nous Portal OAuth credentials
     auth_file = get_hermes_home() / "auth.json"
     if auth_file.exists():
@@ -783,8 +775,6 @@ def cmd_model(args):
         "openrouter": "OpenRouter",
         "nous": "Nous Portal",
         "openai-codex": "OpenAI Codex",
-        "copilot-acp": "GitHub Copilot ACP",
-        "copilot": "GitHub Copilot",
         "anthropic": "Anthropic",
         "zai": "Z.AI / GLM",
         "kimi-coding": "Kimi / Moonshot",
@@ -809,8 +799,6 @@ def cmd_model(args):
         ("openrouter", "OpenRouter (100+ models, pay-per-use)"),
         ("nous", "Nous Portal (Nous Research subscription)"),
         ("openai-codex", "OpenAI Codex"),
-        ("copilot-acp", "GitHub Copilot ACP (spawns `copilot --acp --stdio`)"),
-        ("copilot", "GitHub Copilot (uses GITHUB_TOKEN or gh auth token)"),
         ("anthropic", "Anthropic (Claude models — API key or Claude Code)"),
         ("zai", "Z.AI / GLM (Zhipu AI direct API)"),
         ("kimi-coding", "Kimi / Moonshot (Moonshot AI direct API)"),
@@ -879,10 +867,6 @@ def cmd_model(args):
         _model_flow_nous(config, current_model)
     elif selected_provider == "openai-codex":
         _model_flow_openai_codex(config, current_model)
-    elif selected_provider == "copilot-acp":
-        _model_flow_copilot_acp(config, current_model)
-    elif selected_provider == "copilot":
-        _model_flow_copilot(config, current_model)
     elif selected_provider == "custom":
         _model_flow_custom(config)
     elif selected_provider.startswith("custom:") and selected_provider in _custom_provider_map:
@@ -1134,21 +1118,10 @@ def _model_flow_custom(config):
         base_url = input(f"API base URL [{current_url or 'e.g. https://api.example.com/v1'}]: ").strip()
         api_key = input(f"API key [{current_key[:8] + '...' if current_key else 'optional'}]: ").strip()
         model_name = input("Model name (e.g. gpt-4, llama-3-70b): ").strip()
-        context_length_str = input("Context length in tokens [leave blank for auto-detect]: ").strip()
     except (KeyboardInterrupt, EOFError):
         print("\nCancelled.")
         return
 
-    context_length = None
-    if context_length_str:
-        try:
-            context_length = int(context_length_str.replace(",", "").replace("k", "000").replace("K", "000"))
-            if context_length <= 0:
-                context_length = None
-        except ValueError:
-            print(f"Invalid context length: {context_length_str} — will auto-detect.")
-            context_length = None
-
     if not base_url and not current_url:
         print("No URL provided. Cancelled.")
         return
@@ -1211,14 +1184,14 @@ def _model_flow_custom(config):
         print("Endpoint saved. Use `/model` in chat or `hermes model` to set a model.")
 
     # Auto-save to custom_providers so it appears in the menu next time
-    _save_custom_provider(effective_url, effective_key, model_name or "", context_length=context_length)
+    _save_custom_provider(effective_url, effective_key, model_name or "")
 
 
-def _save_custom_provider(base_url, api_key="", model="", context_length=None):
+def _save_custom_provider(base_url, api_key="", model=""):
     """Save a custom endpoint to custom_providers in config.yaml.
 
     Deduplicates by base_url — if the URL already exists, updates the
-    model name and context_length but doesn't add a duplicate entry.
+    model name but doesn't add a duplicate entry.
     Auto-generates a display name from the URL hostname.
     """
     from hermes_cli.config import load_config, save_config
@@ -1228,24 +1201,14 @@ def _save_custom_provider(base_url, api_key="", model="", context_length=None):
     if not isinstance(providers, list):
         providers = []
 
-    # Check if this URL is already saved — update model/context_length if so
+    # Check if this URL is already saved — update model if so
     for entry in providers:
         if isinstance(entry, dict) and entry.get("base_url", "").rstrip("/") == base_url.rstrip("/"):
-            changed = False
             if model and entry.get("model") != model:
                 entry["model"] = model
-                changed = True
-            if model and context_length:
-                models_cfg = entry.get("models", {})
-                if not isinstance(models_cfg, dict):
-                    models_cfg = {}
-                models_cfg[model] = {"context_length": context_length}
-                entry["models"] = models_cfg
-                changed = True
-            if changed:
                 cfg["custom_providers"] = providers
                 save_config(cfg)
-            return  # already saved, updated if needed
+            return  # already saved, updated model if needed
 
     # Auto-generate a name from the URL
     import re
@@ -1267,8 +1230,6 @@ def _save_custom_provider(base_url, api_key="", model="", context_length=None):
         entry["api_key"] = api_key
     if model:
         entry["model"] = model
-    if model and context_length:
-        entry["models"] = {model: {"context_length": context_length}}
 
     providers.append(entry)
     cfg["custom_providers"] = providers
@@ -1446,25 +1407,6 @@ def _model_flow_named_custom(config, provider_info):
 
 # Curated model lists for direct API-key providers
 _PROVIDER_MODELS = {
-    "copilot-acp": [
-        "copilot-acp",
-    ],
-    "copilot": [
-        "gpt-5.4",
-        "gpt-5.4-mini",
-        "gpt-5-mini",
-        "gpt-5.3-codex",
-        "gpt-5.2-codex",
-        "gpt-4.1",
-        "gpt-4o",
-        "gpt-4o-mini",
-        "claude-opus-4.6",
-        "claude-sonnet-4.6",
-        "claude-sonnet-4.5",
-        "claude-haiku-4.5",
-        "gemini-2.5-pro",
-        "grok-code-fast-1",
-    ],
     "zai": [
         "glm-5",
         "glm-4.7",
@@ -1505,376 +1447,6 @@ _PROVIDER_MODELS = {
 }
 
 
-def _current_reasoning_effort(config) -> str:
-    agent_cfg = config.get("agent")
-    if isinstance(agent_cfg, dict):
-        return str(agent_cfg.get("reasoning_effort") or "").strip().lower()
-    return ""
-
-
-def _set_reasoning_effort(config, effort: str) -> None:
-    agent_cfg = config.get("agent")
-    if not isinstance(agent_cfg, dict):
-        agent_cfg = {}
-        config["agent"] = agent_cfg
-    agent_cfg["reasoning_effort"] = effort
-
-
-def _prompt_reasoning_effort_selection(efforts, current_effort=""):
-    """Prompt for a reasoning effort. Returns effort, 'none', or None to keep current."""
-    ordered = list(dict.fromkeys(str(effort).strip().lower() for effort in efforts if str(effort).strip()))
-    if not ordered:
-        return None
-
-    def _label(effort):
-        if effort == current_effort:
-            return f"{effort}  ← currently in use"
-        return effort
-
-    disable_label = "Disable reasoning"
-    skip_label = "Skip (keep current)"
-
-    if current_effort == "none":
-        default_idx = len(ordered)
-    elif current_effort in ordered:
-        default_idx = ordered.index(current_effort)
-    elif "medium" in ordered:
-        default_idx = ordered.index("medium")
-    else:
-        default_idx = 0
-
-    try:
-        from simple_term_menu import TerminalMenu
-
-        choices = [f"  {_label(effort)}" for effort in ordered]
-        choices.append(f"  {disable_label}")
-        choices.append(f"  {skip_label}")
-        menu = TerminalMenu(
-            choices,
-            cursor_index=default_idx,
-            menu_cursor="-> ",
-            menu_cursor_style=("fg_green", "bold"),
-            menu_highlight_style=("fg_green",),
-            cycle_cursor=True,
-            clear_screen=False,
-            title="Select reasoning effort:",
-        )
-        idx = menu.show()
-        if idx is None:
-            return None
-        print()
-        if idx < len(ordered):
-            return ordered[idx]
-        if idx == len(ordered):
-            return "none"
-        return None
-    except (ImportError, NotImplementedError):
-        pass
-
-    print("Select reasoning effort:")
-    for i, effort in enumerate(ordered, 1):
-        print(f"  {i}. {_label(effort)}")
-    n = len(ordered)
-    print(f"  {n + 1}. {disable_label}")
-    print(f"  {n + 2}. {skip_label}")
-    print()
-
-    while True:
-        try:
-            choice = input(f"Choice [1-{n + 2}] (default: keep current): ").strip()
-            if not choice:
-                return None
-            idx = int(choice)
-            if 1 <= idx <= n:
-                return ordered[idx - 1]
-            if idx == n + 1:
-                return "none"
-            if idx == n + 2:
-                return None
-            print(f"Please enter 1-{n + 2}")
-        except ValueError:
-            print("Please enter a number")
-        except (KeyboardInterrupt, EOFError):
-            return None
-
-
-def _model_flow_copilot(config, current_model=""):
-    """GitHub Copilot flow using env vars, gh CLI, or OAuth device code."""
-    from hermes_cli.auth import (
-        PROVIDER_REGISTRY,
-        _prompt_model_selection,
-        _save_model_choice,
-        deactivate_provider,
-        resolve_api_key_provider_credentials,
-    )
-    from hermes_cli.config import get_env_value, save_env_value, load_config, save_config
-    from hermes_cli.models import (
-        fetch_api_models,
-        fetch_github_model_catalog,
-        github_model_reasoning_efforts,
-        copilot_model_api_mode,
-        normalize_copilot_model_id,
-    )
-
-    provider_id = "copilot"
-    pconfig = PROVIDER_REGISTRY[provider_id]
-
-    creds = resolve_api_key_provider_credentials(provider_id)
-    api_key = creds.get("api_key", "")
-    source = creds.get("source", "")
-
-    if not api_key:
-        print("No GitHub token configured for GitHub Copilot.")
-        print()
-        print("  Supported token types:")
-        print("    → OAuth token (gho_*)          via `copilot login` or device code flow")
-        print("    → Fine-grained PAT (github_pat_*)  with Copilot Requests permission")
-        print("    → GitHub App token (ghu_*)     via environment variable")
-        print("    ✗ Classic PAT (ghp_*)          NOT supported by Copilot API")
-        print()
-        print("  Options:")
-        print("    1. Login with GitHub (OAuth device code flow)")
-        print("    2. Enter a token manually")
-        print("    3. Cancel")
-        print()
-        try:
-            choice = input("  Choice [1-3]: ").strip()
-        except (KeyboardInterrupt, EOFError):
-            print()
-            return
-
-        if choice == "1":
-            try:
-                from hermes_cli.copilot_auth import copilot_device_code_login
-                token = copilot_device_code_login()
-                if token:
-                    save_env_value("COPILOT_GITHUB_TOKEN", token)
-                    print("  Copilot token saved.")
-                    print()
-                else:
-                    print("  Login cancelled or failed.")
-                    return
-            except Exception as exc:
-                print(f"  Login failed: {exc}")
-                return
-        elif choice == "2":
-            try:
-                new_key = input("  Token (COPILOT_GITHUB_TOKEN): ").strip()
-            except (KeyboardInterrupt, EOFError):
-                print()
-                return
-            if not new_key:
-                print("  Cancelled.")
-                return
-            # Validate token type
-            try:
-                from hermes_cli.copilot_auth import validate_copilot_token
-                valid, msg = validate_copilot_token(new_key)
-                if not valid:
-                    print(f"  ✗ {msg}")
-                    return
-            except ImportError:
-                pass
-            save_env_value("COPILOT_GITHUB_TOKEN", new_key)
-            print("  Token saved.")
-            print()
-        else:
-            print("  Cancelled.")
-            return
-
-        creds = resolve_api_key_provider_credentials(provider_id)
-        api_key = creds.get("api_key", "")
-        source = creds.get("source", "")
-    else:
-        if source in ("GITHUB_TOKEN", "GH_TOKEN"):
-            print(f"  GitHub token: {api_key[:8]}... ✓ ({source})")
-        elif source == "gh auth token":
-            print("  GitHub token: ✓ (from `gh auth token`)")
-        else:
-            print("  GitHub token: ✓")
-        print()
-
-    effective_base = pconfig.inference_base_url
-
-    catalog = fetch_github_model_catalog(api_key)
-    live_models = [item.get("id", "") for item in catalog if item.get("id")] if catalog else fetch_api_models(api_key, effective_base)
-    normalized_current_model = normalize_copilot_model_id(
-        current_model,
-        catalog=catalog,
-        api_key=api_key,
-    ) or current_model
-    if live_models:
-        model_list = [model_id for model_id in live_models if model_id]
-        print(f"  Found {len(model_list)} model(s) from GitHub Copilot")
-    else:
-        model_list = _PROVIDER_MODELS.get(provider_id, [])
-        if model_list:
-            print("  ⚠ Could not auto-detect models from GitHub Copilot — showing defaults.")
-            print('    Use "Enter custom model name" if you do not see your model.')
-
-    if model_list:
-        selected = _prompt_model_selection(model_list, current_model=normalized_current_model)
-    else:
-        try:
-            selected = input("Model name: ").strip()
-        except (KeyboardInterrupt, EOFError):
-            selected = None
-
-    if selected:
-        selected = normalize_copilot_model_id(
-            selected,
-            catalog=catalog,
-            api_key=api_key,
-        ) or selected
-        # Clear stale custom-endpoint overrides so the Copilot provider wins cleanly.
-        if get_env_value("OPENAI_BASE_URL"):
-            save_env_value("OPENAI_BASE_URL", "")
-            save_env_value("OPENAI_API_KEY", "")
-
-        initial_cfg = load_config()
-        current_effort = _current_reasoning_effort(initial_cfg)
-        reasoning_efforts = github_model_reasoning_efforts(
-            selected,
-            catalog=catalog,
-            api_key=api_key,
-        )
-        selected_effort = None
-        if reasoning_efforts:
-            print(f"  {selected} supports reasoning controls.")
-            selected_effort = _prompt_reasoning_effort_selection(
-                reasoning_efforts, current_effort=current_effort
-            )
-
-        _save_model_choice(selected)
-
-        cfg = load_config()
-        model = cfg.get("model")
-        if not isinstance(model, dict):
-            model = {"default": model} if model else {}
-            cfg["model"] = model
-        model["provider"] = provider_id
-        model["base_url"] = effective_base
-        model["api_mode"] = copilot_model_api_mode(
-            selected,
-            catalog=catalog,
-            api_key=api_key,
-        )
-        if selected_effort is not None:
-            _set_reasoning_effort(cfg, selected_effort)
-        save_config(cfg)
-        deactivate_provider()
-
-        print(f"Default model set to: {selected} (via {pconfig.name})")
-        if reasoning_efforts:
-            if selected_effort == "none":
-                print("Reasoning disabled for this model.")
-            elif selected_effort:
-                print(f"Reasoning effort set to: {selected_effort}")
-    else:
-        print("No change.")
-
-
-def _model_flow_copilot_acp(config, current_model=""):
-    """GitHub Copilot ACP flow using the local Copilot CLI."""
-    from hermes_cli.auth import (
-        PROVIDER_REGISTRY,
-        _prompt_model_selection,
-        _save_model_choice,
-        deactivate_provider,
-        get_external_process_provider_status,
-        resolve_api_key_provider_credentials,
-        resolve_external_process_provider_credentials,
-    )
-    from hermes_cli.models import (
-        fetch_github_model_catalog,
-        normalize_copilot_model_id,
-    )
-    from hermes_cli.config import load_config, save_config
-
-    del config
-
-    provider_id = "copilot-acp"
-    pconfig = PROVIDER_REGISTRY[provider_id]
-
-    status = get_external_process_provider_status(provider_id)
-    resolved_command = status.get("resolved_command") or status.get("command") or "copilot"
-    effective_base = status.get("base_url") or pconfig.inference_base_url
-
-    print("  GitHub Copilot ACP delegates Hermes turns to `copilot --acp`.")
-    print("  Hermes currently starts its own ACP subprocess for each request.")
-    print("  Hermes uses your selected model as a hint for the Copilot ACP session.")
-    print(f"  Command: {resolved_command}")
-    print(f"  Backend marker: {effective_base}")
-    print()
-
-    try:
-        creds = resolve_external_process_provider_credentials(provider_id)
-    except Exception as exc:
-        print(f"  ⚠ {exc}")
-        print("  Set HERMES_COPILOT_ACP_COMMAND or COPILOT_CLI_PATH if Copilot CLI is installed elsewhere.")
-        return
-
-    effective_base = creds.get("base_url") or effective_base
-
-    catalog_api_key = ""
-    try:
-        catalog_creds = resolve_api_key_provider_credentials("copilot")
-        catalog_api_key = catalog_creds.get("api_key", "")
-    except Exception:
-        pass
-
-    catalog = fetch_github_model_catalog(catalog_api_key)
-    normalized_current_model = normalize_copilot_model_id(
-        current_model,
-        catalog=catalog,
-        api_key=catalog_api_key,
-    ) or current_model
-
-    if catalog:
-        model_list = [item.get("id", "") for item in catalog if item.get("id")]
-        print(f"  Found {len(model_list)} model(s) from GitHub Copilot")
-    else:
-        model_list = _PROVIDER_MODELS.get("copilot", [])
-        if model_list:
-            print("  ⚠ Could not auto-detect models from GitHub Copilot — showing defaults.")
-            print('    Use "Enter custom model name" if you do not see your model.')
-
-    if model_list:
-        selected = _prompt_model_selection(
-            model_list,
-            current_model=normalized_current_model,
-        )
-    else:
-        try:
-            selected = input("Model name: ").strip()
-        except (KeyboardInterrupt, EOFError):
-            selected = None
-
-    if not selected:
-        print("No change.")
-        return
-
-    selected = normalize_copilot_model_id(
-        selected,
-        catalog=catalog,
-        api_key=catalog_api_key,
-    ) or selected
-    _save_model_choice(selected)
-
-    cfg = load_config()
-    model = cfg.get("model")
-    if not isinstance(model, dict):
-        model = {"default": model} if model else {}
-        cfg["model"] = model
-    model["provider"] = provider_id
-    model["base_url"] = effective_base
-    model["api_mode"] = "chat_completions"
-    save_config(cfg)
-    deactivate_provider()
-
-    print(f"Default model set to: {selected} (via {pconfig.name})")
-
-
 def _model_flow_kimi(config, current_model=""):
     """Kimi / Moonshot model selection with automatic endpoint routing.
 
@@ -2556,55 +2128,14 @@ def _restore_stashed_changes(
         capture_output=True,
         text=True,
     )
-
-    # Check for unmerged (conflicted) files — can happen even when returncode is 0
-    unmerged = subprocess.run(
-        git_cmd + ["diff", "--name-only", "--diff-filter=U"],
-        cwd=cwd,
-        capture_output=True,
-        text=True,
-    )
-    has_conflicts = bool(unmerged.stdout.strip())
-
-    if restore.returncode != 0 or has_conflicts:
-        print("✗ Update pulled new code, but restoring local changes hit conflicts.")
+    if restore.returncode != 0:
+        print("✗ Update pulled new code, but restoring local changes failed.")
         if restore.stdout.strip():
             print(restore.stdout.strip())
         if restore.stderr.strip():
             print(restore.stderr.strip())
-
-        # Show which files conflicted
-        conflicted_files = unmerged.stdout.strip()
-        if conflicted_files:
-            print("\nConflicted files:")
-            for f in conflicted_files.splitlines():
-                print(f"  • {f}")
-
-        print("\nYour stashed changes are preserved — nothing is lost.")
-        print(f"  Stash ref: {stash_ref}")
-
-        # Ask before resetting (if interactive)
-        do_reset = True
-        if prompt_user:
-            print("\nReset working tree to clean state so Hermes can run?")
-            print("  (You can re-apply your changes later with: git stash apply)")
-            print("[Y/n] ", end="", flush=True)
-            response = input().strip().lower()
-            if response not in ("", "y", "yes"):
-                do_reset = False
-
-        if do_reset:
-            subprocess.run(
-                git_cmd + ["reset", "--hard", "HEAD"],
-                cwd=cwd,
-                capture_output=True,
-            )
-            print("Working tree reset to clean state.")
-        else:
-            print("Working tree left as-is (may have conflict markers).")
-            print("Resolve conflicts manually, then run: git stash drop")
-
-        print(f"Restore your changes with: git stash apply {stash_ref}")
+        print("Your changes are still preserved in git stash.")
+        print(f"Resolve manually with: git stash apply {stash_ref}")
         sys.exit(1)
 
     stash_selector = _resolve_stash_selector(git_cmd, cwd, stash_ref)
@@ -2726,7 +2257,7 @@ def cmd_update(args):
 
         print("→ Pulling updates...")
         try:
-            subprocess.run(git_cmd + ["pull", "--ff-only", "origin", branch], cwd=PROJECT_ROOT, check=True)
+            subprocess.run(git_cmd + ["pull", "origin", branch], cwd=PROJECT_ROOT, check=True)
         finally:
             if auto_stash_ref is not None:
                 _restore_stashed_changes(
@@ -2979,7 +2510,7 @@ def _coalesce_session_name_args(argv: list) -> list:
     _SUBCOMMANDS = {
         "chat", "model", "gateway", "setup", "whatsapp", "login", "logout",
         "status", "cron", "doctor", "config", "pairing", "skills", "tools",
-        "mcp", "sessions", "insights", "version", "update", "uninstall",
+        "sessions", "insights", "version", "update", "uninstall",
     }
     _SESSION_FLAGS = {"-c", "--continue", "-r", "--resume"}
 
@@ -3111,7 +2642,7 @@ For more help on a command:
     )
     chat_parser.add_argument(
         "--provider",
-        choices=["auto", "openrouter", "nous", "openai-codex", "copilot-acp", "copilot", "anthropic", "zai", "kimi-coding", "minimax", "minimax-cn", "kilocode"],
+        choices=["auto", "openrouter", "nous", "openai-codex", "anthropic", "zai", "kimi-coding", "minimax", "minimax-cn", "kilocode"],
         default=None,
         help="Inference provider (default: auto)"
     )
@@ -3567,46 +3098,6 @@ For more help on a command:
 
     skills_parser.set_defaults(func=cmd_skills)
 
-    # =========================================================================
-    # plugins command
-    # =========================================================================
-    plugins_parser = subparsers.add_parser(
-        "plugins",
-        help="Manage plugins — install, update, remove, list",
-        description="Install plugins from Git repositories, update, remove, or list them.",
-    )
-    plugins_subparsers = plugins_parser.add_subparsers(dest="plugins_action")
-
-    plugins_install = plugins_subparsers.add_parser(
-        "install", help="Install a plugin from a Git URL or owner/repo"
-    )
-    plugins_install.add_argument(
-        "identifier",
-        help="Git URL or owner/repo shorthand (e.g. anpicasso/hermes-plugin-chrome-profiles)",
-    )
-    plugins_install.add_argument(
-        "--force", "-f", action="store_true",
-        help="Remove existing plugin and reinstall",
-    )
-
-    plugins_update = plugins_subparsers.add_parser(
-        "update", help="Pull latest changes for an installed plugin"
-    )
-    plugins_update.add_argument("name", help="Plugin name to update")
-
-    plugins_remove = plugins_subparsers.add_parser(
-        "remove", aliases=["rm", "uninstall"], help="Remove an installed plugin"
-    )
-    plugins_remove.add_argument("name", help="Plugin directory name to remove")
-
-    plugins_subparsers.add_parser("list", aliases=["ls"], help="List installed plugins")
-
-    def cmd_plugins(args):
-        from hermes_cli.plugins_cmd import plugins_command
-        plugins_command(args)
-
-    plugins_parser.set_defaults(func=cmd_plugins)
-
     # =========================================================================
     # honcho command
     # =========================================================================
@@ -3763,45 +3254,6 @@ For more help on a command:
             tools_command(args)
 
     tools_parser.set_defaults(func=cmd_tools)
-    # =========================================================================
-    # mcp command — manage MCP server connections
-    # =========================================================================
-    mcp_parser = subparsers.add_parser(
-        "mcp",
-        help="Manage MCP server connections",
-        description=(
-            "Add, remove, list, test, and configure MCP server connections.\n\n"
-            "MCP servers provide additional tools via the Model Context Protocol.\n"
-            "Use 'hermes mcp add' to connect to a new server with interactive\n"
-            "tool discovery. Run 'hermes mcp' with no subcommand to list servers."
-        ),
-    )
-    mcp_sub = mcp_parser.add_subparsers(dest="mcp_action")
-
-    mcp_add_p = mcp_sub.add_parser("add", help="Add an MCP server (discovery-first install)")
-    mcp_add_p.add_argument("name", help="Server name (used as config key)")
-    mcp_add_p.add_argument("--url", help="HTTP/SSE endpoint URL")
-    mcp_add_p.add_argument("--command", help="Stdio command (e.g. npx)")
-    mcp_add_p.add_argument("--args", nargs="*", default=[], help="Arguments for stdio command")
-    mcp_add_p.add_argument("--auth", choices=["oauth", "header"], help="Auth method")
-
-    mcp_rm_p = mcp_sub.add_parser("remove", aliases=["rm"], help="Remove an MCP server")
-    mcp_rm_p.add_argument("name", help="Server name to remove")
-
-    mcp_sub.add_parser("list", aliases=["ls"], help="List configured MCP servers")
-
-    mcp_test_p = mcp_sub.add_parser("test", help="Test MCP server connection")
-    mcp_test_p.add_argument("name", help="Server name to test")
-
-    mcp_cfg_p = mcp_sub.add_parser("configure", aliases=["config"], help="Toggle tool selection")
-    mcp_cfg_p.add_argument("name", help="Server name to configure")
-
-    def cmd_mcp(args):
-        from hermes_cli.mcp_config import mcp_command
-        mcp_command(args)
-
-    mcp_parser.set_defaults(func=cmd_mcp)
-
     # =========================================================================
     # sessions command
     # =========================================================================
@@ -3861,20 +3313,20 @@ For more help on a command:
                 return
             has_titles = any(s.get("title") for s in sessions)
             if has_titles:
-                print(f"{'Title':<32} {'Preview':<40} {'Last Active':<13} {'ID'}")
-                print("─" * 110)
+                print(f"{'Title':<22} {'Preview':<40} {'Last Active':<13} {'ID'}")
+                print("─" * 100)
             else:
                 print(f"{'Preview':<50} {'Last Active':<13} {'Src':<6} {'ID'}")
-                print("─" * 95)
+                print("─" * 90)
             for s in sessions:
                 last_active = _relative_time(s.get("last_active"))
                 preview = s.get("preview", "")[:38] if has_titles else s.get("preview", "")[:48]
                 if has_titles:
-                    title = (s.get("title") or "—")[:30]
-                    sid = s["id"]
-                    print(f"{title:<32} {preview:<40} {last_active:<13} {sid}")
+                    title = (s.get("title") or "—")[:20]
+                    sid = s["id"][:20]
+                    print(f"{title:<22} {preview:<40} {last_active:<13} {sid}")
                 else:
-                    sid = s["id"]
+                    sid = s["id"][:20]
                     print(f"{preview:<50} {last_active:<13} {s['source']:<6} {sid}")
 
         elif action == "export":

hermes_cli/mcp_config.py

@@ -1,635 +0,0 @@
-"""
-MCP Server Management CLI — ``hermes mcp`` subcommand.
-
-Implements ``hermes mcp add/remove/list/test/configure`` for interactive
-MCP server lifecycle management (issue #690 Phase 2).
-
-Relies on tools/mcp_tool.py for connection/discovery and keeps
-configuration in ~/.hermes/config.yaml under the ``mcp_servers`` key.
-"""
-
-import asyncio
-import getpass
-import logging
-import os
-import re
-import time
-from pathlib import Path
-from typing import Any, Dict, List, Optional, Set, Tuple
-
-from hermes_cli.config import (
-    load_config,
-    save_config,
-    get_env_value,
-    save_env_value,
-    get_hermes_home,
-)
-from hermes_cli.colors import Colors, color
-
-logger = logging.getLogger(__name__)
-
-
-# ─── UI Helpers ───────────────────────────────────────────────────────────────
-
-def _info(text: str):
-    print(color(f"  {text}", Colors.DIM))
-
-def _success(text: str):
-    print(color(f"  ✓ {text}", Colors.GREEN))
-
-def _warning(text: str):
-    print(color(f"  ⚠ {text}", Colors.YELLOW))
-
-def _error(text: str):
-    print(color(f"  ✗ {text}", Colors.RED))
-
-
-def _confirm(question: str, default: bool = True) -> bool:
-    default_str = "Y/n" if default else "y/N"
-    try:
-        val = input(color(f"  {question} [{default_str}]: ", Colors.YELLOW)).strip().lower()
-    except (KeyboardInterrupt, EOFError):
-        print()
-        return default
-    if not val:
-        return default
-    return val in ("y", "yes")
-
-
-def _prompt(question: str, *, password: bool = False, default: str = "") -> str:
-    display = f"  {question}"
-    if default:
-        display += f" [{default}]"
-    display += ": "
-    try:
-        if password:
-            value = getpass.getpass(color(display, Colors.YELLOW))
-        else:
-            value = input(color(display, Colors.YELLOW))
-        return value.strip() or default
-    except (KeyboardInterrupt, EOFError):
-        print()
-        return default
-
-
-# ─── Config Helpers ───────────────────────────────────────────────────────────
-
-def _get_mcp_servers(config: Optional[dict] = None) -> Dict[str, dict]:
-    """Return the ``mcp_servers`` dict from config, or empty dict."""
-    if config is None:
-        config = load_config()
-    servers = config.get("mcp_servers")
-    if not servers or not isinstance(servers, dict):
-        return {}
-    return servers
-
-
-def _save_mcp_server(name: str, server_config: dict):
-    """Add or update a server entry in config.yaml."""
-    config = load_config()
-    config.setdefault("mcp_servers", {})[name] = server_config
-    save_config(config)
-
-
-def _remove_mcp_server(name: str) -> bool:
-    """Remove a server from config.yaml.  Returns True if it existed."""
-    config = load_config()
-    servers = config.get("mcp_servers", {})
-    if name not in servers:
-        return False
-    del servers[name]
-    if not servers:
-        config.pop("mcp_servers", None)
-    save_config(config)
-    return True
-
-
-def _env_key_for_server(name: str) -> str:
-    """Convert server name to an env-var key like ``MCP_MYSERVER_API_KEY``."""
-    return f"MCP_{name.upper().replace('-', '_')}_API_KEY"
-
-
-# ─── Discovery (temporary connect) ───────────────────────────────────────────
-
-def _probe_single_server(
-    name: str, config: dict, connect_timeout: float = 30
-) -> List[Tuple[str, str]]:
-    """Temporarily connect to one MCP server, list its tools, disconnect.
-
-    Returns list of ``(tool_name, description)`` tuples.
-    Raises on connection failure.
-    """
-    from tools.mcp_tool import (
-        _ensure_mcp_loop,
-        _run_on_mcp_loop,
-        _connect_server,
-        _stop_mcp_loop,
-    )
-
-    _ensure_mcp_loop()
-
-    tools_found: List[Tuple[str, str]] = []
-
-    async def _probe():
-        server = await asyncio.wait_for(
-            _connect_server(name, config), timeout=connect_timeout
-        )
-        for t in server._tools:
-            desc = getattr(t, "description", "") or ""
-            # Truncate long descriptions for display
-            if len(desc) > 80:
-                desc = desc[:77] + "..."
-            tools_found.append((t.name, desc))
-        await server.shutdown()
-
-    try:
-        _run_on_mcp_loop(_probe(), timeout=connect_timeout + 10)
-    except BaseException as exc:
-        raise _unwrap_exception_group(exc) from None
-    finally:
-        _stop_mcp_loop()
-
-    return tools_found
-
-
-def _unwrap_exception_group(exc: BaseException) -> Exception:
-    """Extract the root-cause exception from anyio TaskGroup wrappers.
-
-    The MCP SDK uses anyio task groups, which wrap errors in
-    ``BaseExceptionGroup`` / ``ExceptionGroup``.  This makes error
-    messages opaque ("unhandled errors in a TaskGroup").  We unwrap
-    to surface the real cause (e.g. "401 Unauthorized").
-    """
-    while isinstance(exc, BaseExceptionGroup) and exc.exceptions:
-        exc = exc.exceptions[0]
-    # Return a plain Exception so callers can catch normally
-    if isinstance(exc, Exception):
-        return exc
-    return RuntimeError(str(exc))
-
-
-# ─── hermes mcp add ──────────────────────────────────────────────────────────
-
-def cmd_mcp_add(args):
-    """Add a new MCP server with discovery-first tool selection."""
-    name = args.name
-    url = getattr(args, "url", None)
-    command = getattr(args, "command", None)
-    cmd_args = getattr(args, "args", None) or []
-    auth_type = getattr(args, "auth", None)
-
-    # Validate transport
-    if not url and not command:
-        _error("Must specify --url <endpoint> or --command <cmd>")
-        _info("Examples:")
-        _info('  hermes mcp add ink --url "https://mcp.ml.ink/mcp"')
-        _info('  hermes mcp add github --command npx --args @modelcontextprotocol/server-github')
-        return
-
-    # Check if server already exists
-    existing = _get_mcp_servers()
-    if name in existing:
-        if not _confirm(f"Server '{name}' already exists. Overwrite?", default=False):
-            _info("Cancelled.")
-            return
-
-    # Build initial config
-    server_config: Dict[str, Any] = {}
-    if url:
-        server_config["url"] = url
-    else:
-        server_config["command"] = command
-        if cmd_args:
-            server_config["args"] = cmd_args
-
-    # ── Authentication ────────────────────────────────────────────────
-
-    if url and auth_type == "oauth":
-        print()
-        _info(f"Starting OAuth flow for '{name}'...")
-        oauth_ok = False
-        try:
-            from tools.mcp_oauth import build_oauth_auth
-            oauth_auth = build_oauth_auth(name, url)
-            if oauth_auth:
-                server_config["auth"] = "oauth"
-                _success("OAuth configured (tokens will be acquired on first connection)")
-                oauth_ok=True
-            else:
-                _warning("OAuth setup failed — MCP SDK auth module not available")
-        except Exception as exc:
-            _warning(f"OAuth error: {exc}")
-
-        if not oauth_ok:
-            _info("This server may not support OAuth.")
-            if _confirm("Continue without authentication?", default=True):
-                # Don't store auth: oauth — server doesn't support it
-                pass
-            else:
-                _info("Cancelled.")
-                return
-
-    elif url:
-        # Prompt for API key / Bearer token for HTTP servers
-        print()
-        _info(f"Connecting to {url}")
-        needs_auth = _confirm("Does this server require authentication?", default=True)
-        if needs_auth:
-            if auth_type == "header" or not auth_type:
-                env_key = _env_key_for_server(name)
-                existing_key = get_env_value(env_key)
-                if existing_key:
-                    _success(f"{env_key}: already configured")
-                    api_key = existing_key
-                else:
-                    api_key = _prompt("API key / Bearer token", password=True)
-                    if api_key:
-                        save_env_value(env_key, api_key)
-                        _success(f"Saved to ~/.hermes/.env as {env_key}")
-
-                # Set header with env var interpolation
-                if api_key or existing_key:
-                    server_config["headers"] = {
-                        "Authorization": f"Bearer ${{{env_key}}}"
-                    }
-
-    # ── Discovery: connect and list tools ─────────────────────────────
-
-    print()
-    print(color(f"  Connecting to '{name}'...", Colors.CYAN))
-
-    try:
-        tools = _probe_single_server(name, server_config)
-    except Exception as exc:
-        _error(f"Failed to connect: {exc}")
-        if _confirm("Save config anyway (you can test later)?", default=False):
-            server_config["enabled"] = False
-            _save_mcp_server(name, server_config)
-            _success(f"Saved '{name}' to config (disabled)")
-            _info("Fix the issue, then: hermes mcp test " + name)
-        return
-
-    if not tools:
-        _warning("Server connected but reported no tools.")
-        if _confirm("Save config anyway?", default=True):
-            _save_mcp_server(name, server_config)
-            _success(f"Saved '{name}' to config")
-        return
-
-    # ── Tool selection ────────────────────────────────────────────────
-
-    print()
-    _success(f"Connected! Found {len(tools)} tool(s) from '{name}':")
-    print()
-    for tool_name, desc in tools:
-        short = desc[:60] + "..." if len(desc) > 60 else desc
-        print(f"    {color(tool_name, Colors.GREEN):40s} {short}")
-    print()
-
-    # Ask: enable all, select, or cancel
-    try:
-        choice = input(
-            color(f"  Enable all {len(tools)} tools? [Y/n/select]: ", Colors.YELLOW)
-        ).strip().lower()
-    except (KeyboardInterrupt, EOFError):
-        print()
-        _info("Cancelled.")
-        return
-
-    if choice in ("n", "no"):
-        _info("Cancelled — server not saved.")
-        return
-
-    if choice in ("s", "select"):
-        # Interactive tool selection
-        from hermes_cli.curses_ui import curses_checklist
-
-        labels = [f"{t[0]}  —  {t[1]}" for t in tools]
-        pre_selected = set(range(len(tools)))
-
-        chosen = curses_checklist(
-            f"Select tools for '{name}'",
-            labels,
-            pre_selected,
-        )
-
-        if not chosen:
-            _info("No tools selected — server not saved.")
-            return
-
-        chosen_names = [tools[i][0] for i in sorted(chosen)]
-        server_config.setdefault("tools", {})["include"] = chosen_names
-
-        tool_count = len(chosen_names)
-        total = len(tools)
-    else:
-        # Enable all (no filter needed — default behaviour)
-        tool_count = len(tools)
-        total = len(tools)
-
-    # ── Save ──────────────────────────────────────────────────────────
-
-    server_config["enabled"] = True
-    _save_mcp_server(name, server_config)
-
-    print()
-    _success(f"Saved '{name}' to ~/.hermes/config.yaml ({tool_count}/{total} tools enabled)")
-    _info("Start a new session to use these tools.")
-
-
-# ─── hermes mcp remove ───────────────────────────────────────────────────────
-
-def cmd_mcp_remove(args):
-    """Remove an MCP server from config."""
-    name = args.name
-    existing = _get_mcp_servers()
-
-    if name not in existing:
-        _error(f"Server '{name}' not found in config.")
-        servers = list(existing.keys())
-        if servers:
-            _info(f"Available servers: {', '.join(servers)}")
-        return
-
-    if not _confirm(f"Remove server '{name}'?", default=True):
-        _info("Cancelled.")
-        return
-
-    _remove_mcp_server(name)
-    _success(f"Removed '{name}' from config")
-
-    # Clean up OAuth tokens if they exist
-    try:
-        from tools.mcp_oauth import remove_oauth_tokens
-        remove_oauth_tokens(name)
-        _success("Cleaned up OAuth tokens")
-    except Exception:
-        pass
-
-
-# ─── hermes mcp list ──────────────────────────────────────────────────────────
-
-def cmd_mcp_list(args=None):
-    """List all configured MCP servers."""
-    servers = _get_mcp_servers()
-
-    if not servers:
-        print()
-        _info("No MCP servers configured.")
-        print()
-        _info("Add one with:")
-        _info('  hermes mcp add <name> --url <endpoint>')
-        _info('  hermes mcp add <name> --command <cmd> --args <args...>')
-        print()
-        return
-
-    print()
-    print(color("  MCP Servers:", Colors.CYAN + Colors.BOLD))
-    print()
-
-    # Table header
-    print(f"  {'Name':<16} {'Transport':<30} {'Tools':<12} {'Status':<10}")
-    print(f"  {'─' * 16} {'─' * 30} {'─' * 12} {'─' * 10}")
-
-    for name, cfg in servers.items():
-        # Transport info
-        if "url" in cfg:
-            url = cfg["url"]
-            # Truncate long URLs
-            if len(url) > 28:
-                url = url[:25] + "..."
-            transport = url
-        elif "command" in cfg:
-            cmd = cfg["command"]
-            cmd_args = cfg.get("args", [])
-            if isinstance(cmd_args, list) and cmd_args:
-                transport = f"{cmd} {' '.join(str(a) for a in cmd_args[:2])}"
-            else:
-                transport = cmd
-            if len(transport) > 28:
-                transport = transport[:25] + "..."
-        else:
-            transport = "?"
-
-        # Tool count
-        tools_cfg = cfg.get("tools", {})
-        if isinstance(tools_cfg, dict):
-            include = tools_cfg.get("include")
-            exclude = tools_cfg.get("exclude")
-            if include and isinstance(include, list):
-                tools_str = f"{len(include)} selected"
-            elif exclude and isinstance(exclude, list):
-                tools_str = f"-{len(exclude)} excluded"
-            else:
-                tools_str = "all"
-        else:
-            tools_str = "all"
-
-        # Enabled status
-        enabled = cfg.get("enabled", True)
-        if isinstance(enabled, str):
-            enabled = enabled.lower() in ("true", "1", "yes")
-        status = color("✓ enabled", Colors.GREEN) if enabled else color("✗ disabled", Colors.DIM)
-
-        print(f"  {name:<16} {transport:<30} {tools_str:<12} {status}")
-
-    print()
-
-
-# ─── hermes mcp test ──────────────────────────────────────────────────────────
-
-def cmd_mcp_test(args):
-    """Test connection to an MCP server."""
-    name = args.name
-    servers = _get_mcp_servers()
-
-    if name not in servers:
-        _error(f"Server '{name}' not found in config.")
-        available = list(servers.keys())
-        if available:
-            _info(f"Available: {', '.join(available)}")
-        return
-
-    cfg = servers[name]
-    print()
-    print(color(f"  Testing '{name}'...", Colors.CYAN))
-
-    # Show transport info
-    if "url" in cfg:
-        _info(f"Transport: HTTP → {cfg['url']}")
-    else:
-        cmd = cfg.get("command", "?")
-        _info(f"Transport: stdio → {cmd}")
-
-    # Show auth info (masked)
-    auth_type = cfg.get("auth", "")
-    headers = cfg.get("headers", {})
-    if auth_type == "oauth":
-        _info("Auth: OAuth 2.1 PKCE")
-    elif headers:
-        for k, v in headers.items():
-            if isinstance(v, str) and ("key" in k.lower() or "auth" in k.lower()):
-                # Mask the value
-                resolved = _interpolate_value(v)
-                if len(resolved) > 8:
-                    masked = resolved[:4] + "***" + resolved[-4:]
-                else:
-                    masked = "***"
-                print(f"    {k}: {masked}")
-    else:
-        _info("Auth: none")
-
-    # Attempt connection
-    start = time.monotonic()
-    try:
-        tools = _probe_single_server(name, cfg)
-        elapsed_ms = (time.monotonic() - start) * 1000
-    except Exception as exc:
-        elapsed_ms = (time.monotonic() - start) * 1000
-        _error(f"Connection failed ({elapsed_ms:.0f}ms): {exc}")
-        return
-
-    _success(f"Connected ({elapsed_ms:.0f}ms)")
-    _success(f"Tools discovered: {len(tools)}")
-
-    if tools:
-        print()
-        for tool_name, desc in tools:
-            short = desc[:55] + "..." if len(desc) > 55 else desc
-            print(f"    {color(tool_name, Colors.GREEN):36s} {short}")
-    print()
-
-
-def _interpolate_value(value: str) -> str:
-    """Resolve ``${ENV_VAR}`` references in a string."""
-    def _replace(m):
-        return os.getenv(m.group(1), "")
-    return re.sub(r"\$\{(\w+)\}", _replace, value)
-
-
-# ─── hermes mcp configure ────────────────────────────────────────────────────
-
-def cmd_mcp_configure(args):
-    """Reconfigure which tools are enabled for an existing MCP server."""
-    name = args.name
-    servers = _get_mcp_servers()
-
-    if name not in servers:
-        _error(f"Server '{name}' not found in config.")
-        available = list(servers.keys())
-        if available:
-            _info(f"Available: {', '.join(available)}")
-        return
-
-    cfg = servers[name]
-
-    # Discover all available tools
-    print()
-    print(color(f"  Connecting to '{name}' to discover tools...", Colors.CYAN))
-
-    try:
-        all_tools = _probe_single_server(name, cfg)
-    except Exception as exc:
-        _error(f"Failed to connect: {exc}")
-        return
-
-    if not all_tools:
-        _warning("Server reports no tools.")
-        return
-
-    # Determine which are currently enabled
-    tools_cfg = cfg.get("tools", {})
-    if isinstance(tools_cfg, dict):
-        include = tools_cfg.get("include")
-        exclude = tools_cfg.get("exclude")
-    else:
-        include = None
-        exclude = None
-
-    tool_names = [t[0] for t in all_tools]
-
-    if include and isinstance(include, list):
-        include_set = set(include)
-        pre_selected = {
-            i for i, tn in enumerate(tool_names) if tn in include_set
-        }
-    elif exclude and isinstance(exclude, list):
-        exclude_set = set(exclude)
-        pre_selected = {
-            i for i, tn in enumerate(tool_names) if tn not in exclude_set
-        }
-    else:
-        pre_selected = set(range(len(all_tools)))
-
-    currently = len(pre_selected)
-    total = len(all_tools)
-    _info(f"Currently {currently}/{total} tools enabled for '{name}'.")
-    print()
-
-    # Interactive checklist
-    from hermes_cli.curses_ui import curses_checklist
-
-    labels = [f"{t[0]}  —  {t[1]}" for t in all_tools]
-
-    chosen = curses_checklist(
-        f"Select tools for '{name}'",
-        labels,
-        pre_selected,
-    )
-
-    if chosen == pre_selected:
-        _info("No changes made.")
-        return
-
-    # Update config
-    config = load_config()
-    server_entry = config.get("mcp_servers", {}).get(name, {})
-
-    if len(chosen) == total:
-        # All selected → remove include/exclude (register all)
-        server_entry.pop("tools", None)
-    else:
-        chosen_names = [tool_names[i] for i in sorted(chosen)]
-        server_entry.setdefault("tools", {})
-        server_entry["tools"]["include"] = chosen_names
-        server_entry["tools"].pop("exclude", None)
-
-    config.setdefault("mcp_servers", {})[name] = server_entry
-    save_config(config)
-
-    new_count = len(chosen)
-    _success(f"Updated config: {new_count}/{total} tools enabled")
-    _info("Start a new session for changes to take effect.")
-
-
-# ─── Dispatcher ───────────────────────────────────────────────────────────────
-
-def mcp_command(args):
-    """Main dispatcher for ``hermes mcp`` subcommands."""
-    action = getattr(args, "mcp_action", None)
-
-    handlers = {
-        "add": cmd_mcp_add,
-        "remove": cmd_mcp_remove,
-        "rm": cmd_mcp_remove,
-        "list": cmd_mcp_list,
-        "ls": cmd_mcp_list,
-        "test": cmd_mcp_test,
-        "configure": cmd_mcp_configure,
-        "config": cmd_mcp_configure,
-    }
-
-    handler = handlers.get(action)
-    if handler:
-        handler(args)
-    else:
-        # No subcommand — show list
-        cmd_mcp_list()
-        print(color("  Commands:", Colors.CYAN))
-        _info("hermes mcp add <name> --url <endpoint>        Add an MCP server")
-        _info("hermes mcp add <name> --command <cmd>         Add a stdio server")
-        _info("hermes mcp remove <name>                      Remove a server")
-        _info("hermes mcp list                               List servers")
-        _info("hermes mcp test <name>                        Test connection")
-        _info("hermes mcp configure <name>                   Toggle tools")
-        print()

hermes_cli/model_switch.py

@@ -1,234 +0,0 @@
-"""Shared model-switching logic for CLI and gateway /model commands.
-
-Both the CLI (cli.py) and gateway (gateway/run.py) /model handlers
-share the same core pipeline:
-
-  parse_model_input → is_custom detection → auto-detect provider
-  → credential resolution → validate model → return result
-
-This module extracts that shared pipeline into pure functions that
-return result objects. The callers handle all platform-specific
-concerns: state mutation, config persistence, output formatting.
-"""
-
-from __future__ import annotations
-
-import os
-from dataclasses import dataclass, field
-from typing import Optional
-
-
-@dataclass
-class ModelSwitchResult:
-    """Result of a model switch attempt."""
-
-    success: bool
-    new_model: str = ""
-    target_provider: str = ""
-    provider_changed: bool = False
-    api_key: str = ""
-    base_url: str = ""
-    persist: bool = False
-    error_message: str = ""
-    warning_message: str = ""
-    is_custom_target: bool = False
-    provider_label: str = ""
-
-
-@dataclass
-class CustomAutoResult:
-    """Result of switching to bare 'custom' provider with auto-detect."""
-
-    success: bool
-    model: str = ""
-    base_url: str = ""
-    api_key: str = ""
-    error_message: str = ""
-
-
-def switch_model(
-    raw_input: str,
-    current_provider: str,
-    current_base_url: str = "",
-    current_api_key: str = "",
-) -> ModelSwitchResult:
-    """Core model-switching pipeline shared between CLI and gateway.
-
-    Handles parsing, provider detection, credential resolution, and
-    model validation.  Does NOT handle config persistence, state
-    mutation, or output formatting — those are caller responsibilities.
-
-    Args:
-        raw_input: The user's model input (e.g. "claude-sonnet-4",
-            "zai:glm-5", "custom:local:qwen").
-        current_provider: The currently active provider.
-        current_base_url: The currently active base URL (used for
-            is_custom detection).
-        current_api_key: The currently active API key.
-
-    Returns:
-        ModelSwitchResult with all information the caller needs to
-        apply the switch and format output.
-    """
-    from hermes_cli.models import (
-        parse_model_input,
-        detect_provider_for_model,
-        validate_requested_model,
-        _PROVIDER_LABELS,
-    )
-    from hermes_cli.runtime_provider import resolve_runtime_provider
-
-    # Step 1: Parse provider:model syntax
-    target_provider, new_model = parse_model_input(raw_input, current_provider)
-
-    # Step 2: Detect if we're currently on a custom endpoint
-    _base = current_base_url or ""
-    is_custom = current_provider == "custom" or (
-        "localhost" in _base or "127.0.0.1" in _base
-    )
-
-    # Step 3: Auto-detect provider when no explicit provider:model syntax
-    # was used.  Skip for custom providers — the model name might
-    # coincidentally match a known provider's catalog.
-    if target_provider == current_provider and not is_custom:
-        detected = detect_provider_for_model(new_model, current_provider)
-        if detected:
-            target_provider, new_model = detected
-
-    provider_changed = target_provider != current_provider
-
-    # Step 4: Resolve credentials for target provider
-    api_key = current_api_key
-    base_url = current_base_url
-    if provider_changed:
-        try:
-            runtime = resolve_runtime_provider(requested=target_provider)
-            api_key = runtime.get("api_key", "")
-            base_url = runtime.get("base_url", "")
-        except Exception as e:
-            provider_label = _PROVIDER_LABELS.get(target_provider, target_provider)
-            if target_provider == "custom":
-                return ModelSwitchResult(
-                    success=False,
-                    target_provider=target_provider,
-                    error_message=(
-                        "No custom endpoint configured. Set model.base_url "
-                        "in config.yaml, or set OPENAI_BASE_URL in .env, "
-                        "or run: hermes setup → Custom OpenAI-compatible endpoint"
-                    ),
-                )
-            return ModelSwitchResult(
-                success=False,
-                target_provider=target_provider,
-                error_message=(
-                    f"Could not resolve credentials for provider "
-                    f"'{provider_label}': {e}"
-                ),
-            )
-    else:
-        # Gateway also resolves for unchanged provider to get accurate
-        # base_url for validation probing.
-        try:
-            runtime = resolve_runtime_provider(requested=current_provider)
-            api_key = runtime.get("api_key", "")
-            base_url = runtime.get("base_url", "")
-        except Exception:
-            pass
-
-    # Step 5: Validate the model
-    try:
-        validation = validate_requested_model(
-            new_model,
-            target_provider,
-            api_key=api_key,
-            base_url=base_url,
-        )
-    except Exception:
-        validation = {
-            "accepted": True,
-            "persist": True,
-            "recognized": False,
-            "message": None,
-        }
-
-    if not validation.get("accepted"):
-        msg = validation.get("message", "Invalid model")
-        return ModelSwitchResult(
-            success=False,
-            new_model=new_model,
-            target_provider=target_provider,
-            error_message=msg,
-        )
-
-    # Step 6: Build result
-    provider_label = _PROVIDER_LABELS.get(target_provider, target_provider)
-    is_custom_target = target_provider == "custom" or (
-        base_url
-        and "openrouter.ai" not in (base_url or "")
-        and ("localhost" in (base_url or "") or "127.0.0.1" in (base_url or ""))
-    )
-
-    return ModelSwitchResult(
-        success=True,
-        new_model=new_model,
-        target_provider=target_provider,
-        provider_changed=provider_changed,
-        api_key=api_key,
-        base_url=base_url,
-        persist=bool(validation.get("persist")),
-        warning_message=validation.get("message") or "",
-        is_custom_target=is_custom_target,
-        provider_label=provider_label,
-    )
-
-
-def switch_to_custom_provider() -> CustomAutoResult:
-    """Handle bare '/model custom' — resolve endpoint and auto-detect model.
-
-    Returns a result object; the caller handles persistence and output.
-    """
-    from hermes_cli.runtime_provider import (
-        resolve_runtime_provider,
-        _auto_detect_local_model,
-    )
-
-    try:
-        runtime = resolve_runtime_provider(requested="custom")
-    except Exception as e:
-        return CustomAutoResult(
-            success=False,
-            error_message=f"Could not resolve custom endpoint: {e}",
-        )
-
-    cust_base = runtime.get("base_url", "")
-    cust_key = runtime.get("api_key", "")
-
-    if not cust_base or "openrouter.ai" in cust_base:
-        return CustomAutoResult(
-            success=False,
-            error_message=(
-                "No custom endpoint configured. "
-                "Set model.base_url in config.yaml, or set OPENAI_BASE_URL "
-                "in .env, or run: hermes setup → Custom OpenAI-compatible endpoint"
-            ),
-        )
-
-    detected_model = _auto_detect_local_model(cust_base)
-    if not detected_model:
-        return CustomAutoResult(
-            success=False,
-            base_url=cust_base,
-            api_key=cust_key,
-            error_message=(
-                f"Custom endpoint at {cust_base} is reachable but no single "
-                f"model was auto-detected. Specify the model explicitly: "
-                f"/model custom:<model-name>"
-            ),
-        )
-
-    return CustomAutoResult(
-        success=True,
-        model=detected_model,
-        base_url=cust_base,
-        api_key=cust_key,
-    )

hermes_cli/models.py

@@ -14,16 +14,6 @@ import urllib.error
 from difflib import get_close_matches
 from typing import Any, Optional
 
-COPILOT_BASE_URL = "https://api.githubcopilot.com"
-COPILOT_MODELS_URL = f"{COPILOT_BASE_URL}/models"
-COPILOT_EDITOR_VERSION = "vscode/1.104.1"
-COPILOT_REASONING_EFFORTS_GPT5 = ["minimal", "low", "medium", "high"]
-COPILOT_REASONING_EFFORTS_O_SERIES = ["low", "medium", "high"]
-
-# Backward-compatible aliases for the earlier GitHub Models-backed Copilot work.
-GITHUB_MODELS_BASE_URL = COPILOT_BASE_URL
-GITHUB_MODELS_CATALOG_URL = COPILOT_MODELS_URL
-
 # (model_id, display description shown in menus)
 OPENROUTER_MODELS: list[tuple[str, str]] = [
     ("anthropic/claude-opus-4.6",       "recommended"),
@@ -31,20 +21,19 @@ OPENROUTER_MODELS: list[tuple[str, str]] = [
     ("anthropic/claude-haiku-4.5",      ""),
     ("openai/gpt-5.4",                  ""),
     ("openai/gpt-5.4-mini",             ""),
-    ("xiaomi/mimo-v2-pro",               ""),
+    ("openrouter/hunter-alpha",          "free"),
+    ("openrouter/healer-alpha",          "free"),
     ("openai/gpt-5.3-codex",            ""),
     ("google/gemini-3-pro-preview",     ""),
     ("google/gemini-3-flash-preview",   ""),
     ("qwen/qwen3.5-plus-02-15",         ""),
     ("qwen/qwen3.5-35b-a3b",            ""),
     ("stepfun/step-3.5-flash",          ""),
-    ("minimax/minimax-m2.7",            ""),
     ("minimax/minimax-m2.5",            ""),
     ("z-ai/glm-5",                      ""),
     ("z-ai/glm-5-turbo",                ""),
     ("moonshotai/kimi-k2.5",            ""),
     ("x-ai/grok-4.20-beta",             ""),
-    ("nvidia/nemotron-3-super-120b-a12b",      ""),
     ("nvidia/nemotron-3-super-120b-a12b:free", "free"),
     ("arcee-ai/trinity-large-preview:free", "free"),
     ("openai/gpt-5.4-pro",              ""),
@@ -66,25 +55,6 @@ _PROVIDER_MODELS: dict[str, list[str]] = {
         "gpt-5.1-codex-mini",
         "gpt-5.1-codex-max",
     ],
-    "copilot-acp": [
-        "copilot-acp",
-    ],
-    "copilot": [
-        "gpt-5.4",
-        "gpt-5.4-mini",
-        "gpt-5-mini",
-        "gpt-5.3-codex",
-        "gpt-5.2-codex",
-        "gpt-4.1",
-        "gpt-4o",
-        "gpt-4o-mini",
-        "claude-opus-4.6",
-        "claude-sonnet-4.6",
-        "claude-sonnet-4.5",
-        "claude-haiku-4.5",
-        "gemini-2.5-pro",
-        "grok-code-fast-1",
-    ],
     "zai": [
         "glm-5",
         "glm-4.7",
@@ -151,7 +121,6 @@ _PROVIDER_MODELS: dict[str, list[str]] = {
         "gemini-3.1-pro",
         "gemini-3-pro",
         "gemini-3-flash",
-        "minimax-m2.7",
         "minimax-m2.5",
         "minimax-m2.5-free",
         "minimax-m2.1",
@@ -204,9 +173,7 @@ _PROVIDER_MODELS: dict[str, list[str]] = {
 _PROVIDER_LABELS = {
     "openrouter": "OpenRouter",
     "openai-codex": "OpenAI Codex",
-    "copilot-acp": "GitHub Copilot ACP",
     "nous": "Nous Portal",
-    "copilot": "GitHub Copilot",
     "zai": "Z.AI / GLM",
     "kimi-coding": "Kimi / Moonshot",
     "minimax": "MiniMax",
@@ -226,12 +193,6 @@ _PROVIDER_ALIASES = {
     "z-ai": "zai",
     "z.ai": "zai",
     "zhipu": "zai",
-    "github": "copilot",
-    "github-copilot": "copilot",
-    "github-models": "copilot",
-    "github-model": "copilot",
-    "github-copilot-acp": "copilot-acp",
-    "copilot-acp-agent": "copilot-acp",
     "kimi": "kimi-coding",
     "moonshot": "kimi-coding",
     "minimax-china": "minimax-cn",
@@ -285,7 +246,7 @@ def list_available_providers() -> list[dict[str, str]]:
     """
     # Canonical providers in display order
     _PROVIDER_ORDER = [
-        "openrouter", "nous", "openai-codex", "copilot", "copilot-acp",
+        "openrouter", "nous", "openai-codex",
         "zai", "kimi-coding", "minimax", "minimax-cn", "kilocode", "anthropic", "alibaba",
         "opencode-zen", "opencode-go",
         "ai-gateway", "deepseek", "custom",
@@ -302,15 +263,12 @@ def list_available_providers() -> list[dict[str, str]]:
         # Check if this provider has credentials available
         has_creds = False
         try:
-            from hermes_cli.auth import get_auth_status, has_usable_secret
             if pid == "custom":
-                custom_base_url = _get_custom_base_url() or os.getenv("OPENAI_BASE_URL", "")
-                has_creds = bool(custom_base_url.strip())
-            elif pid == "openrouter":
-                has_creds = has_usable_secret(os.getenv("OPENROUTER_API_KEY", ""))
+                has_creds = bool(_get_custom_base_url())
             else:
-                status = get_auth_status(pid)
-                has_creds = bool(status.get("logged_in") or status.get("configured"))
+                from hermes_cli.runtime_provider import resolve_runtime_provider
+                runtime = resolve_runtime_provider(requested=pid)
+                has_creds = bool(runtime.get("api_key"))
         except Exception:
             pass
         result.append({
@@ -345,15 +303,6 @@ def parse_model_input(raw: str, current_provider: str) -> tuple[str, str]:
         provider_part = stripped[:colon].strip().lower()
         model_part = stripped[colon + 1:].strip()
         if provider_part and model_part and provider_part in _KNOWN_PROVIDER_NAMES:
-            # Support custom:name:model triple syntax for named custom
-            # providers.  ``custom:local:qwen`` → ("custom:local", "qwen").
-            # Single colon ``custom:qwen`` → ("custom", "qwen") as before.
-            if provider_part == "custom" and ":" in model_part:
-                second_colon = model_part.find(":")
-                custom_name = model_part[:second_colon].strip()
-                actual_model = model_part[second_colon + 1:].strip()
-                if custom_name and actual_model:
-                    return (f"custom:{custom_name}", actual_model)
             return (normalize_provider(provider_part), model_part)
     return (current_provider, stripped)
 
@@ -403,7 +352,6 @@ def detect_provider_for_model(
     Returns ``None`` when no confident match is found.
 
     Priority:
-    0. Bare provider name → switch to that provider's default model
     1. Direct provider with credentials (highest)
     2. Direct provider without credentials → remap to OpenRouter slug
     3. OpenRouter catalog match
@@ -414,21 +362,6 @@ def detect_provider_for_model(
 
     name_lower = name.lower()
 
-    # --- Step 0: bare provider name typed as model ---
-    # If someone types `/model nous` or `/model anthropic`, treat it as a
-    # provider switch and pick the first model from that provider's catalog.
-    # Skip "custom" and "openrouter" — custom has no model catalog, and
-    # openrouter requires an explicit model name to be useful.
-    resolved_provider = _PROVIDER_ALIASES.get(name_lower, name_lower)
-    if resolved_provider not in {"custom", "openrouter"}:
-        default_models = _PROVIDER_MODELS.get(resolved_provider, [])
-        if (
-            resolved_provider in _PROVIDER_LABELS
-            and default_models
-            and resolved_provider != normalize_provider(current_provider)
-        ):
-            return (resolved_provider, default_models[0])
-
     # Aggregators list other providers' models — never auto-switch TO them
     _AGGREGATORS = {"nous", "openrouter"}
 
@@ -534,17 +467,6 @@ def provider_label(provider: Optional[str]) -> str:
     return _PROVIDER_LABELS.get(normalized, original or "OpenRouter")
 
 
-def _resolve_copilot_catalog_api_key() -> str:
-    """Best-effort GitHub token for fetching the Copilot model catalog."""
-    try:
-        from hermes_cli.auth import resolve_api_key_provider_credentials
-
-        creds = resolve_api_key_provider_credentials("copilot")
-        return str(creds.get("api_key") or "").strip()
-    except Exception:
-        return ""
-
-
 def provider_model_ids(provider: Optional[str]) -> list[str]:
     """Return the best known model catalog for a provider.
 
@@ -558,15 +480,6 @@ def provider_model_ids(provider: Optional[str]) -> list[str]:
         from hermes_cli.codex_models import get_codex_model_ids
 
         return get_codex_model_ids()
-    if normalized in {"copilot", "copilot-acp"}:
-        try:
-            live = _fetch_github_models(_resolve_copilot_catalog_api_key())
-            if live:
-                return live
-        except Exception:
-            pass
-        if normalized == "copilot-acp":
-            return list(_PROVIDER_MODELS.get("copilot", []))
     if normalized == "nous":
         # Try live Nous Portal /models endpoint
         try:
@@ -645,306 +558,6 @@ def _fetch_anthropic_models(timeout: float = 5.0) -> Optional[list[str]]:
         return None
 
 
-def _payload_items(payload: Any) -> list[dict[str, Any]]:
-    if isinstance(payload, list):
-        return [item for item in payload if isinstance(item, dict)]
-    if isinstance(payload, dict):
-        data = payload.get("data", [])
-        if isinstance(data, list):
-            return [item for item in data if isinstance(item, dict)]
-    return []
-
-
-def _extract_model_ids(payload: Any) -> list[str]:
-    return [item.get("id", "") for item in _payload_items(payload) if item.get("id")]
-
-
-def copilot_default_headers() -> dict[str, str]:
-    """Standard headers for Copilot API requests.
-
-    Includes Openai-Intent and x-initiator headers that opencode and the
-    Copilot CLI send on every request.
-    """
-    try:
-        from hermes_cli.copilot_auth import copilot_request_headers
-        return copilot_request_headers(is_agent_turn=True)
-    except ImportError:
-        return {
-            "Editor-Version": COPILOT_EDITOR_VERSION,
-            "User-Agent": "HermesAgent/1.0",
-            "Openai-Intent": "conversation-edits",
-            "x-initiator": "agent",
-        }
-
-
-def _copilot_catalog_item_is_text_model(item: dict[str, Any]) -> bool:
-    model_id = str(item.get("id") or "").strip()
-    if not model_id:
-        return False
-
-    if item.get("model_picker_enabled") is False:
-        return False
-
-    capabilities = item.get("capabilities")
-    if isinstance(capabilities, dict):
-        model_type = str(capabilities.get("type") or "").strip().lower()
-        if model_type and model_type != "chat":
-            return False
-
-    supported_endpoints = item.get("supported_endpoints")
-    if isinstance(supported_endpoints, list):
-        normalized_endpoints = {
-            str(endpoint).strip()
-            for endpoint in supported_endpoints
-            if str(endpoint).strip()
-        }
-        if normalized_endpoints and not normalized_endpoints.intersection(
-            {"/chat/completions", "/responses", "/v1/messages"}
-        ):
-            return False
-
-    return True
-
-
-def fetch_github_model_catalog(
-    api_key: Optional[str] = None, timeout: float = 5.0
-) -> Optional[list[dict[str, Any]]]:
-    """Fetch the live GitHub Copilot model catalog for this account."""
-    attempts: list[dict[str, str]] = []
-    if api_key:
-        attempts.append({
-            **copilot_default_headers(),
-            "Authorization": f"Bearer {api_key}",
-        })
-    attempts.append(copilot_default_headers())
-
-    for headers in attempts:
-        req = urllib.request.Request(COPILOT_MODELS_URL, headers=headers)
-        try:
-            with urllib.request.urlopen(req, timeout=timeout) as resp:
-                data = json.loads(resp.read().decode())
-                items = _payload_items(data)
-                models: list[dict[str, Any]] = []
-                seen_ids: set[str] = set()
-                for item in items:
-                    if not _copilot_catalog_item_is_text_model(item):
-                        continue
-                    model_id = str(item.get("id") or "").strip()
-                    if not model_id or model_id in seen_ids:
-                        continue
-                    seen_ids.add(model_id)
-                    models.append(item)
-                if models:
-                    return models
-        except Exception:
-            continue
-    return None
-
-
-def _is_github_models_base_url(base_url: Optional[str]) -> bool:
-    normalized = (base_url or "").strip().rstrip("/").lower()
-    return (
-        normalized.startswith(COPILOT_BASE_URL)
-        or normalized.startswith("https://models.github.ai/inference")
-    )
-
-
-def _fetch_github_models(api_key: Optional[str] = None, timeout: float = 5.0) -> Optional[list[str]]:
-    catalog = fetch_github_model_catalog(api_key=api_key, timeout=timeout)
-    if not catalog:
-        return None
-    return [item.get("id", "") for item in catalog if item.get("id")]
-
-
-_COPILOT_MODEL_ALIASES = {
-    "openai/gpt-5": "gpt-5-mini",
-    "openai/gpt-5-chat": "gpt-5-mini",
-    "openai/gpt-5-mini": "gpt-5-mini",
-    "openai/gpt-5-nano": "gpt-5-mini",
-    "openai/gpt-4.1": "gpt-4.1",
-    "openai/gpt-4.1-mini": "gpt-4.1",
-    "openai/gpt-4.1-nano": "gpt-4.1",
-    "openai/gpt-4o": "gpt-4o",
-    "openai/gpt-4o-mini": "gpt-4o-mini",
-    "openai/o1": "gpt-5.2",
-    "openai/o1-mini": "gpt-5-mini",
-    "openai/o1-preview": "gpt-5.2",
-    "openai/o3": "gpt-5.3-codex",
-    "openai/o3-mini": "gpt-5-mini",
-    "openai/o4-mini": "gpt-5-mini",
-    "anthropic/claude-opus-4.6": "claude-opus-4.6",
-    "anthropic/claude-sonnet-4.6": "claude-sonnet-4.6",
-    "anthropic/claude-sonnet-4.5": "claude-sonnet-4.5",
-    "anthropic/claude-haiku-4.5": "claude-haiku-4.5",
-}
-
-
-def _copilot_catalog_ids(
-    catalog: Optional[list[dict[str, Any]]] = None,
-    api_key: Optional[str] = None,
-) -> set[str]:
-    if catalog is None and api_key:
-        catalog = fetch_github_model_catalog(api_key=api_key)
-    if not catalog:
-        return set()
-    return {
-        str(item.get("id") or "").strip()
-        for item in catalog
-        if str(item.get("id") or "").strip()
-    }
-
-
-def normalize_copilot_model_id(
-    model_id: Optional[str],
-    *,
-    catalog: Optional[list[dict[str, Any]]] = None,
-    api_key: Optional[str] = None,
-) -> str:
-    raw = str(model_id or "").strip()
-    if not raw:
-        return ""
-
-    catalog_ids = _copilot_catalog_ids(catalog=catalog, api_key=api_key)
-    alias = _COPILOT_MODEL_ALIASES.get(raw)
-    if alias:
-        return alias
-
-    candidates = [raw]
-    if "/" in raw:
-        candidates.append(raw.split("/", 1)[1].strip())
-
-    if raw.endswith("-mini"):
-        candidates.append(raw[:-5])
-    if raw.endswith("-nano"):
-        candidates.append(raw[:-5])
-    if raw.endswith("-chat"):
-        candidates.append(raw[:-5])
-
-    seen: set[str] = set()
-    for candidate in candidates:
-        if not candidate or candidate in seen:
-            continue
-        seen.add(candidate)
-        if candidate in _COPILOT_MODEL_ALIASES:
-            return _COPILOT_MODEL_ALIASES[candidate]
-        if candidate in catalog_ids:
-            return candidate
-
-    if "/" in raw:
-        return raw.split("/", 1)[1].strip()
-    return raw
-
-
-def _github_reasoning_efforts_for_model_id(model_id: str) -> list[str]:
-    raw = (model_id or "").strip().lower()
-    if raw.startswith(("openai/o1", "openai/o3", "openai/o4", "o1", "o3", "o4")):
-        return list(COPILOT_REASONING_EFFORTS_O_SERIES)
-    normalized = normalize_copilot_model_id(model_id).lower()
-    if normalized.startswith("gpt-5"):
-        return list(COPILOT_REASONING_EFFORTS_GPT5)
-    return []
-
-
-def _should_use_copilot_responses_api(model_id: str) -> bool:
-    """Decide whether a Copilot model should use the Responses API.
-
-    Replicates opencode's ``shouldUseCopilotResponsesApi`` logic:
-    GPT-5+ models use Responses API, except ``gpt-5-mini`` which uses
-    Chat Completions.  All non-GPT models (Claude, Gemini, etc.) use
-    Chat Completions.
-    """
-    import re
-
-    match = re.match(r"^gpt-(\d+)", model_id)
-    if not match:
-        return False
-    major = int(match.group(1))
-    return major >= 5 and not model_id.startswith("gpt-5-mini")
-
-
-def copilot_model_api_mode(
-    model_id: Optional[str],
-    *,
-    catalog: Optional[list[dict[str, Any]]] = None,
-    api_key: Optional[str] = None,
-) -> str:
-    """Determine the API mode for a Copilot model.
-
-    Uses the model ID pattern (matching opencode's approach) as the
-    primary signal.  Falls back to the catalog's ``supported_endpoints``
-    only for models not covered by the pattern check.
-    """
-    normalized = normalize_copilot_model_id(model_id, catalog=catalog, api_key=api_key)
-    if not normalized:
-        return "chat_completions"
-
-    # Primary: model ID pattern (matches opencode's shouldUseCopilotResponsesApi)
-    if _should_use_copilot_responses_api(normalized):
-        return "codex_responses"
-
-    # Secondary: check catalog for non-GPT-5 models (Claude via /v1/messages, etc.)
-    if catalog is None and api_key:
-        catalog = fetch_github_model_catalog(api_key=api_key)
-
-    if catalog:
-        catalog_entry = next((item for item in catalog if item.get("id") == normalized), None)
-        if isinstance(catalog_entry, dict):
-            supported_endpoints = {
-                str(endpoint).strip()
-                for endpoint in (catalog_entry.get("supported_endpoints") or [])
-                if str(endpoint).strip()
-            }
-            # For non-GPT-5 models, check if they only support messages API
-            if "/v1/messages" in supported_endpoints and "/chat/completions" not in supported_endpoints:
-                return "anthropic_messages"
-
-    return "chat_completions"
-
-
-def github_model_reasoning_efforts(
-    model_id: Optional[str],
-    *,
-    catalog: Optional[list[dict[str, Any]]] = None,
-    api_key: Optional[str] = None,
-) -> list[str]:
-    """Return supported reasoning-effort levels for a Copilot-visible model."""
-    normalized = normalize_copilot_model_id(model_id, catalog=catalog, api_key=api_key)
-    if not normalized:
-        return []
-
-    catalog_entry = None
-    if catalog is not None:
-        catalog_entry = next((item for item in catalog if item.get("id") == normalized), None)
-    elif api_key:
-        fetched_catalog = fetch_github_model_catalog(api_key=api_key)
-        if fetched_catalog:
-            catalog_entry = next((item for item in fetched_catalog if item.get("id") == normalized), None)
-
-    if catalog_entry is not None:
-        capabilities = catalog_entry.get("capabilities")
-        if isinstance(capabilities, dict):
-            supports = capabilities.get("supports")
-            if isinstance(supports, dict):
-                efforts = supports.get("reasoning_effort")
-                if isinstance(efforts, list):
-                    normalized_efforts = [
-                        str(effort).strip().lower()
-                        for effort in efforts
-                        if str(effort).strip()
-                    ]
-                    return list(dict.fromkeys(normalized_efforts))
-            return []
-        legacy_capabilities = {
-            str(capability).strip().lower()
-            for capability in catalog_entry.get("capabilities", [])
-            if str(capability).strip()
-        }
-        if "reasoning" not in legacy_capabilities:
-            return []
-
-    return _github_reasoning_efforts_for_model_id(str(model_id or normalized))
-
-
 def probe_api_models(
     api_key: Optional[str],
     base_url: Optional[str],
@@ -961,16 +574,6 @@ def probe_api_models(
             "used_fallback": False,
         }
 
-    if _is_github_models_base_url(normalized):
-        models = _fetch_github_models(api_key=api_key, timeout=timeout)
-        return {
-            "models": models,
-            "probed_url": COPILOT_MODELS_URL,
-            "resolved_base_url": COPILOT_BASE_URL,
-            "suggested_base_url": None,
-            "used_fallback": False,
-        }
-
     if normalized.endswith("/v1"):
         alternate_base = normalized[:-3].rstrip("/")
     else:
@@ -984,8 +587,6 @@ def probe_api_models(
     headers: dict[str, str] = {}
     if api_key:
         headers["Authorization"] = f"Bearer {api_key}"
-    if normalized.startswith(COPILOT_BASE_URL):
-        headers.update(copilot_default_headers())
 
     for candidate_base, is_fallback in candidates:
         url = candidate_base.rstrip("/") + "/models"
@@ -1076,12 +677,6 @@ def validate_requested_model(
     normalized = normalize_provider(provider)
     if normalized == "openrouter" and base_url and "openrouter.ai" not in base_url:
         normalized = "custom"
-    requested_for_lookup = requested
-    if normalized == "copilot":
-        requested_for_lookup = normalize_copilot_model_id(
-            requested,
-            api_key=api_key,
-        ) or requested
 
     if not requested:
         return {
@@ -1103,7 +698,7 @@ def validate_requested_model(
         probe = probe_api_models(api_key, base_url)
         api_models = probe.get("models")
         if api_models is not None:
-            if requested_for_lookup in set(api_models):
+            if requested in set(api_models):
                 return {
                     "accepted": True,
                     "persist": True,
@@ -1152,7 +747,7 @@ def validate_requested_model(
     api_models = fetch_api_models(api_key, base_url)
 
     if api_models is not None:
-        if requested_for_lookup in set(api_models):
+        if requested in set(api_models):
             # API confirmed the model exists
             return {
                 "accepted": True,

hermes_cli/plugins.py

@@ -5,8 +5,7 @@ Hermes Plugin System
 Discovers, loads, and manages plugins from three sources:
 
 1. **User plugins**   – ``~/.hermes/plugins/<name>/``
-2. **Project plugins** – ``./.hermes/plugins/<name>/`` (opt-in via
-   ``HERMES_ENABLE_PROJECT_PLUGINS``)
+2. **Project plugins** – ``./.hermes/plugins/<name>/``
 3. **Pip plugins**     – packages that expose the ``hermes_agent.plugins``
    entry-point group.
 
@@ -63,11 +62,6 @@ ENTRY_POINTS_GROUP = "hermes_agent.plugins"
 _NS_PARENT = "hermes_plugins"
 
 
-def _env_enabled(name: str) -> bool:
-    """Return True when an env var is set to a truthy opt-in value."""
-    return os.getenv(name, "").strip().lower() in {"1", "true", "yes", "on"}
-
-
 # ---------------------------------------------------------------------------
 # Data classes
 # ---------------------------------------------------------------------------
@@ -192,9 +186,8 @@ class PluginManager:
         manifests.extend(self._scan_directory(user_dir, source="user"))
 
         # 2. Project plugins (./.hermes/plugins/)
-        if _env_enabled("HERMES_ENABLE_PROJECT_PLUGINS"):
-            project_dir = Path.cwd() / ".hermes" / "plugins"
-            manifests.extend(self._scan_directory(project_dir, source="project"))
+        project_dir = Path.cwd() / ".hermes" / "plugins"
+        manifests.extend(self._scan_directory(project_dir, source="project"))
 
         # 3. Pip / entry-point plugins
         manifests.extend(self._scan_entry_points())
@@ -454,48 +447,3 @@ def invoke_hook(hook_name: str, **kwargs: Any) -> None:
 def get_plugin_tool_names() -> Set[str]:
     """Return the set of tool names registered by plugins."""
     return get_plugin_manager()._plugin_tool_names
-
-
-def get_plugin_toolsets() -> List[tuple]:
-    """Return plugin toolsets as ``(key, label, description)`` tuples.
-
-    Used by the ``hermes tools`` TUI so plugin-provided toolsets appear
-    alongside the built-in ones and can be toggled on/off per platform.
-    """
-    manager = get_plugin_manager()
-    if not manager._plugin_tool_names:
-        return []
-
-    try:
-        from tools.registry import registry
-    except Exception:
-        return []
-
-    # Group plugin tool names by their toolset
-    toolset_tools: Dict[str, List[str]] = {}
-    toolset_plugin: Dict[str, LoadedPlugin] = {}
-    for tool_name in manager._plugin_tool_names:
-        entry = registry._tools.get(tool_name)
-        if not entry:
-            continue
-        ts = entry.toolset
-        toolset_tools.setdefault(ts, []).append(entry.name)
-
-    # Map toolsets back to the plugin that registered them
-    for _name, loaded in manager._plugins.items():
-        for tool_name in loaded.tools_registered:
-            entry = registry._tools.get(tool_name)
-            if entry and entry.toolset in toolset_tools:
-                toolset_plugin.setdefault(entry.toolset, loaded)
-
-    result = []
-    for ts_key in sorted(toolset_tools):
-        plugin = toolset_plugin.get(ts_key)
-        label = f"🔌 {ts_key.replace('_', ' ').title()}"
-        if plugin and plugin.manifest.description:
-            desc = plugin.manifest.description
-        else:
-            desc = ", ".join(sorted(toolset_tools[ts_key]))
-        result.append((ts_key, label, desc))
-
-    return result

hermes_cli/plugins_cmd.py

@@ -1,446 +0,0 @@
-"""``hermes plugins`` CLI subcommand — install, update, remove, and list plugins.
-
-Plugins are installed from Git repositories into ``~/.hermes/plugins/``.
-Supports full URLs and ``owner/repo`` shorthand (resolves to GitHub).
-
-After install, if the plugin ships an ``after-install.md`` file it is
-rendered with Rich Markdown.  Otherwise a default confirmation is shown.
-"""
-
-from __future__ import annotations
-
-import logging
-import os
-import shutil
-import subprocess
-import sys
-from pathlib import Path
-
-logger = logging.getLogger(__name__)
-
-# Minimum manifest version this installer understands.
-# Plugins may declare ``manifest_version: 1`` in plugin.yaml;
-# future breaking changes to the manifest schema bump this.
-_SUPPORTED_MANIFEST_VERSION = 1
-
-
-def _plugins_dir() -> Path:
-    """Return the user plugins directory, creating it if needed."""
-    hermes_home = os.environ.get("HERMES_HOME", os.path.expanduser("~/.hermes"))
-    plugins = Path(hermes_home) / "plugins"
-    plugins.mkdir(parents=True, exist_ok=True)
-    return plugins
-
-
-def _sanitize_plugin_name(name: str, plugins_dir: Path) -> Path:
-    """Validate a plugin name and return the safe target path inside *plugins_dir*.
-
-    Raises ``ValueError`` if the name contains path-traversal sequences or would
-    resolve outside the plugins directory.
-    """
-    if not name:
-        raise ValueError("Plugin name must not be empty.")
-
-    # Reject obvious traversal characters
-    for bad in ("/", "\\", ".."):
-        if bad in name:
-            raise ValueError(f"Invalid plugin name '{name}': must not contain '{bad}'.")
-
-    target = (plugins_dir / name).resolve()
-    plugins_resolved = plugins_dir.resolve()
-
-    if (
-        not str(target).startswith(str(plugins_resolved) + os.sep)
-        and target != plugins_resolved
-    ):
-        raise ValueError(
-            f"Invalid plugin name '{name}': resolves outside the plugins directory."
-        )
-
-    return target
-
-
-def _resolve_git_url(identifier: str) -> str:
-    """Turn an identifier into a cloneable Git URL.
-
-    Accepted formats:
-    - Full URL: https://github.com/owner/repo.git
-    - Full URL: git@github.com:owner/repo.git
-    - Full URL: ssh://git@github.com/owner/repo.git
-    - Shorthand: owner/repo  →  https://github.com/owner/repo.git
-
-    NOTE: ``http://`` and ``file://`` schemes are accepted but will trigger a
-    security warning at install time.
-    """
-    # Already a URL
-    if identifier.startswith(("https://", "http://", "git@", "ssh://", "file://")):
-        return identifier
-
-    # owner/repo shorthand
-    parts = identifier.strip("/").split("/")
-    if len(parts) == 2:
-        owner, repo = parts
-        return f"https://github.com/{owner}/{repo}.git"
-
-    raise ValueError(
-        f"Invalid plugin identifier: '{identifier}'. "
-        "Use a Git URL or owner/repo shorthand."
-    )
-
-
-def _repo_name_from_url(url: str) -> str:
-    """Extract the repo name from a Git URL for the plugin directory name."""
-    # Strip trailing .git and slashes
-    name = url.rstrip("/")
-    if name.endswith(".git"):
-        name = name[:-4]
-    # Get last path component
-    name = name.rsplit("/", 1)[-1]
-    # Handle ssh-style urls: git@github.com:owner/repo
-    if ":" in name:
-        name = name.rsplit(":", 1)[-1].rsplit("/", 1)[-1]
-    return name
-
-
-def _read_manifest(plugin_dir: Path) -> dict:
-    """Read plugin.yaml and return the parsed dict, or empty dict."""
-    manifest_file = plugin_dir / "plugin.yaml"
-    if not manifest_file.exists():
-        return {}
-    try:
-        import yaml
-
-        with open(manifest_file) as f:
-            return yaml.safe_load(f) or {}
-    except Exception as e:
-        logger.warning("Failed to read plugin.yaml in %s: %s", plugin_dir, e)
-        return {}
-
-
-def _copy_example_files(plugin_dir: Path, console) -> None:
-    """Copy any .example files to their real names if they don't already exist.
-
-    For example, ``config.yaml.example`` becomes ``config.yaml``.
-    Skips files that already exist to avoid overwriting user config on reinstall.
-    """
-    for example_file in plugin_dir.glob("*.example"):
-        real_name = example_file.stem  # e.g. "config.yaml" from "config.yaml.example"
-        real_path = plugin_dir / real_name
-        if not real_path.exists():
-            try:
-                shutil.copy2(example_file, real_path)
-                console.print(
-                    f"[dim]  Created {real_name} from {example_file.name}[/dim]"
-                )
-            except OSError as e:
-                console.print(
-                    f"[yellow]Warning:[/yellow] Failed to copy {example_file.name}: {e}"
-                )
-
-
-def _display_after_install(plugin_dir: Path, identifier: str) -> None:
-    """Show after-install.md if it exists, otherwise a default message."""
-    from rich.console import Console
-    from rich.markdown import Markdown
-    from rich.panel import Panel
-
-    console = Console()
-    after_install = plugin_dir / "after-install.md"
-
-    if after_install.exists():
-        content = after_install.read_text(encoding="utf-8")
-        md = Markdown(content)
-        console.print()
-        console.print(Panel(md, border_style="green", expand=False))
-        console.print()
-    else:
-        console.print()
-        console.print(
-            Panel(
-                f"[green bold]Plugin installed:[/] {identifier}\n"
-                f"[dim]Location:[/] {plugin_dir}",
-                border_style="green",
-                title="✓ Installed",
-                expand=False,
-            )
-        )
-        console.print()
-
-
-def _display_removed(name: str, plugins_dir: Path) -> None:
-    """Show confirmation after removing a plugin."""
-    from rich.console import Console
-
-    console = Console()
-    console.print()
-    console.print(f"[red]✗[/red] Plugin [bold]{name}[/bold] removed from {plugins_dir}")
-    console.print()
-
-
-def _require_installed_plugin(name: str, plugins_dir: Path, console) -> Path:
-    """Return the plugin path if it exists, or exit with an error listing installed plugins."""
-    target = _sanitize_plugin_name(name, plugins_dir)
-    if not target.exists():
-        installed = ", ".join(d.name for d in plugins_dir.iterdir() if d.is_dir()) or "(none)"
-        console.print(
-            f"[red]Error:[/red] Plugin '{name}' not found in {plugins_dir}.\n"
-            f"Installed plugins: {installed}"
-        )
-        sys.exit(1)
-    return target
-
-
-# ---------------------------------------------------------------------------
-# Commands
-# ---------------------------------------------------------------------------
-
-
-def cmd_install(identifier: str, force: bool = False) -> None:
-    """Install a plugin from a Git URL or owner/repo shorthand."""
-    import tempfile
-    from rich.console import Console
-
-    console = Console()
-
-    try:
-        git_url = _resolve_git_url(identifier)
-    except ValueError as e:
-        console.print(f"[red]Error:[/red] {e}")
-        sys.exit(1)
-
-    # Warn about insecure / local URL schemes
-    if git_url.startswith("http://") or git_url.startswith("file://"):
-        console.print(
-            "[yellow]Warning:[/yellow] Using insecure/local URL scheme. "
-            "Consider using https:// or git@ for production installs."
-        )
-
-    plugins_dir = _plugins_dir()
-
-    # Clone into a temp directory first so we can read plugin.yaml for the name
-    with tempfile.TemporaryDirectory() as tmp:
-        tmp_target = Path(tmp) / "plugin"
-        console.print(f"[dim]Cloning {git_url}...[/dim]")
-
-        try:
-            result = subprocess.run(
-                ["git", "clone", "--depth", "1", git_url, str(tmp_target)],
-                capture_output=True,
-                text=True,
-                timeout=60,
-            )
-        except FileNotFoundError:
-            console.print("[red]Error:[/red] git is not installed or not in PATH.")
-            sys.exit(1)
-        except subprocess.TimeoutExpired:
-            console.print("[red]Error:[/red] Git clone timed out after 60 seconds.")
-            sys.exit(1)
-
-        if result.returncode != 0:
-            console.print(
-                f"[red]Error:[/red] Git clone failed:\n{result.stderr.strip()}"
-            )
-            sys.exit(1)
-
-        # Read manifest
-        manifest = _read_manifest(tmp_target)
-        plugin_name = manifest.get("name") or _repo_name_from_url(git_url)
-
-        # Sanitize plugin name against path traversal
-        try:
-            target = _sanitize_plugin_name(plugin_name, plugins_dir)
-        except ValueError as e:
-            console.print(f"[red]Error:[/red] {e}")
-            sys.exit(1)
-
-        # Check manifest_version compatibility
-        mv = manifest.get("manifest_version")
-        if mv is not None:
-            try:
-                mv_int = int(mv)
-            except (ValueError, TypeError):
-                console.print(
-                    f"[red]Error:[/red] Plugin '{plugin_name}' has invalid "
-                    f"manifest_version '{mv}' (expected an integer)."
-                )
-                sys.exit(1)
-            if mv_int > _SUPPORTED_MANIFEST_VERSION:
-                console.print(
-                    f"[red]Error:[/red] Plugin '{plugin_name}' requires manifest_version "
-                    f"{mv}, but this installer only supports up to {_SUPPORTED_MANIFEST_VERSION}.\n"
-                    f"Run [bold]hermes update[/bold] to get a newer installer."
-                )
-                sys.exit(1)
-
-        if target.exists():
-            if not force:
-                console.print(
-                    f"[red]Error:[/red] Plugin '{plugin_name}' already exists at {target}.\n"
-                    f"Use [bold]--force[/bold] to remove and reinstall, or "
-                    f"[bold]hermes plugins update {plugin_name}[/bold] to pull latest."
-                )
-                sys.exit(1)
-            console.print(f"[dim]  Removing existing {plugin_name}...[/dim]")
-            shutil.rmtree(target)
-
-        # Move from temp to final location
-        shutil.move(str(tmp_target), str(target))
-
-    # Validate it looks like a plugin
-    if not (target / "plugin.yaml").exists() and not (target / "__init__.py").exists():
-        console.print(
-            f"[yellow]Warning:[/yellow] {plugin_name} doesn't contain plugin.yaml "
-            f"or __init__.py. It may not be a valid Hermes plugin."
-        )
-
-    # Copy .example files to their real names (e.g. config.yaml.example → config.yaml)
-    _copy_example_files(target, console)
-
-    _display_after_install(target, identifier)
-
-    console.print("[dim]Restart the gateway for the plugin to take effect:[/dim]")
-    console.print("[dim]  hermes gateway restart[/dim]")
-    console.print()
-
-
-def cmd_update(name: str) -> None:
-    """Update an installed plugin by pulling latest from its git remote."""
-    from rich.console import Console
-
-    console = Console()
-    plugins_dir = _plugins_dir()
-
-    try:
-        target = _require_installed_plugin(name, plugins_dir, console)
-    except ValueError as e:
-        console.print(f"[red]Error:[/red] {e}")
-        sys.exit(1)
-
-    if not (target / ".git").exists():
-        console.print(
-            f"[red]Error:[/red] Plugin '{name}' was not installed from git "
-            f"(no .git directory). Cannot update."
-        )
-        sys.exit(1)
-
-    console.print(f"[dim]Updating {name}...[/dim]")
-
-    try:
-        result = subprocess.run(
-            ["git", "pull", "--ff-only"],
-            capture_output=True,
-            text=True,
-            timeout=60,
-            cwd=str(target),
-        )
-    except FileNotFoundError:
-        console.print("[red]Error:[/red] git is not installed or not in PATH.")
-        sys.exit(1)
-    except subprocess.TimeoutExpired:
-        console.print("[red]Error:[/red] Git pull timed out after 60 seconds.")
-        sys.exit(1)
-
-    if result.returncode != 0:
-        console.print(f"[red]Error:[/red] Git pull failed:\n{result.stderr.strip()}")
-        sys.exit(1)
-
-    # Copy any new .example files
-    _copy_example_files(target, console)
-
-    output = result.stdout.strip()
-    if "Already up to date" in output:
-        console.print(
-            f"[green]✓[/green] Plugin [bold]{name}[/bold] is already up to date."
-        )
-    else:
-        console.print(f"[green]✓[/green] Plugin [bold]{name}[/bold] updated.")
-        console.print(f"[dim]{output}[/dim]")
-
-
-def cmd_remove(name: str) -> None:
-    """Remove an installed plugin by name."""
-    from rich.console import Console
-
-    console = Console()
-    plugins_dir = _plugins_dir()
-
-    try:
-        target = _require_installed_plugin(name, plugins_dir, console)
-    except ValueError as e:
-        console.print(f"[red]Error:[/red] {e}")
-        sys.exit(1)
-
-    shutil.rmtree(target)
-    _display_removed(name, plugins_dir)
-
-
-def cmd_list() -> None:
-    """List installed plugins."""
-    from rich.console import Console
-    from rich.table import Table
-
-    try:
-        import yaml
-    except ImportError:
-        yaml = None
-
-    console = Console()
-    plugins_dir = _plugins_dir()
-
-    dirs = sorted(d for d in plugins_dir.iterdir() if d.is_dir())
-    if not dirs:
-        console.print("[dim]No plugins installed.[/dim]")
-        console.print(f"[dim]Install with:[/dim] hermes plugins install owner/repo")
-        return
-
-    table = Table(title="Installed Plugins", show_lines=False)
-    table.add_column("Name", style="bold")
-    table.add_column("Version", style="dim")
-    table.add_column("Description")
-    table.add_column("Source", style="dim")
-
-    for d in dirs:
-        manifest_file = d / "plugin.yaml"
-        name = d.name
-        version = ""
-        description = ""
-        source = "local"
-
-        if manifest_file.exists() and yaml:
-            try:
-                with open(manifest_file) as f:
-                    manifest = yaml.safe_load(f) or {}
-                name = manifest.get("name", d.name)
-                version = manifest.get("version", "")
-                description = manifest.get("description", "")
-            except Exception:
-                pass
-
-        # Check if it's a git repo (installed via hermes plugins install)
-        if (d / ".git").exists():
-            source = "git"
-
-        table.add_row(name, str(version), description, source)
-
-    console.print()
-    console.print(table)
-    console.print()
-
-
-def plugins_command(args) -> None:
-    """Dispatch hermes plugins subcommands."""
-    action = getattr(args, "plugins_action", None)
-
-    if action == "install":
-        cmd_install(args.identifier, force=getattr(args, "force", False))
-    elif action == "update":
-        cmd_update(args.name)
-    elif action in ("remove", "rm", "uninstall"):
-        cmd_remove(args.name)
-    elif action in ("list", "ls") or action is None:
-        cmd_list()
-    else:
-        from rich.console import Console
-
-        Console().print(f"[red]Unknown plugins action: {action}[/red]")
-        sys.exit(1)

hermes_cli/runtime_provider.py

@@ -14,8 +14,6 @@ from hermes_cli.auth import (
     resolve_nous_runtime_credentials,
     resolve_codex_runtime_credentials,
     resolve_api_key_provider_credentials,
-    resolve_external_process_provider_credentials,
-    has_usable_secret,
 )
 from hermes_cli.config import load_config
 from hermes_constants import OPENROUTER_BASE_URL
@@ -25,76 +23,17 @@ def _normalize_custom_provider_name(value: str) -> str:
     return value.strip().lower().replace(" ", "-")
 
 
-def _detect_api_mode_for_url(base_url: str) -> Optional[str]:
-    """Auto-detect api_mode from the resolved base URL.
-
-    Direct api.openai.com endpoints need the Responses API for GPT-5.x
-    tool calls with reasoning (chat/completions returns 400).
-    """
-    normalized = (base_url or "").strip().lower().rstrip("/")
-    if "api.openai.com" in normalized and "openrouter" not in normalized:
-        return "codex_responses"
-    return None
-
-
-def _auto_detect_local_model(base_url: str) -> str:
-    """Query a local server for its model name when only one model is loaded."""
-    if not base_url:
-        return ""
-    try:
-        import requests
-        url = base_url.rstrip("/")
-        if not url.endswith("/v1"):
-            url += "/v1"
-        resp = requests.get(url + "/models", timeout=5)
-        if resp.ok:
-            models = resp.json().get("data", [])
-            if len(models) == 1:
-                model_id = models[0].get("id", "")
-                if model_id:
-                    return model_id
-    except Exception:
-        pass
-    return ""
-
-
 def _get_model_config() -> Dict[str, Any]:
     config = load_config()
     model_cfg = config.get("model")
     if isinstance(model_cfg, dict):
-        cfg = dict(model_cfg)
-        default = cfg.get("default", "").strip()
-        base_url = cfg.get("base_url", "").strip()
-        is_local = "localhost" in base_url or "127.0.0.1" in base_url
-        is_fallback = not default or default == "anthropic/claude-opus-4.6"
-        if is_local and is_fallback and base_url:
-            detected = _auto_detect_local_model(base_url)
-            if detected:
-                cfg["default"] = detected
-        return cfg
+        return dict(model_cfg)
     if isinstance(model_cfg, str) and model_cfg.strip():
         return {"default": model_cfg.strip()}
     return {}
 
 
-def _copilot_runtime_api_mode(model_cfg: Dict[str, Any], api_key: str) -> str:
-    configured_mode = _parse_api_mode(model_cfg.get("api_mode"))
-    if configured_mode:
-        return configured_mode
-
-    model_name = str(model_cfg.get("default") or "").strip()
-    if not model_name:
-        return "chat_completions"
-
-    try:
-        from hermes_cli.models import copilot_model_api_mode
-
-        return copilot_model_api_mode(model_name, api_key=api_key)
-    except Exception:
-        return "chat_completions"
-
-
-_VALID_API_MODES = {"chat_completions", "codex_responses", "anthropic_messages"}
+_VALID_API_MODES = {"chat_completions", "codex_responses"}
 
 
 def _parse_api_mode(raw: Any) -> Optional[str]:
@@ -189,19 +128,16 @@ def _resolve_named_custom_runtime(
     if not base_url:
         return None
 
-    api_key_candidates = [
-        (explicit_api_key or "").strip(),
-        str(custom_provider.get("api_key", "") or "").strip(),
-        os.getenv("OPENAI_API_KEY", "").strip(),
-        os.getenv("OPENROUTER_API_KEY", "").strip(),
-    ]
-    api_key = next((candidate for candidate in api_key_candidates if has_usable_secret(candidate)), "")
+    api_key = (
+        (explicit_api_key or "").strip()
+        or custom_provider.get("api_key", "")
+        or os.getenv("OPENAI_API_KEY", "").strip()
+        or os.getenv("OPENROUTER_API_KEY", "").strip()
+    )
 
     return {
-        "provider": "custom",
-        "api_mode": custom_provider.get("api_mode")
-        or _detect_api_mode_for_url(base_url)
-        or "chat_completions",
+        "provider": "openrouter",
+        "api_mode": custom_provider.get("api_mode", "chat_completions"),
         "base_url": base_url,
         "api_key": api_key,
         "source": f"custom_provider:{custom_provider.get('name', requested_provider)}",
@@ -217,12 +153,6 @@ def _resolve_openrouter_runtime(
     model_cfg = _get_model_config()
     cfg_base_url = model_cfg.get("base_url") if isinstance(model_cfg.get("base_url"), str) else ""
     cfg_provider = model_cfg.get("provider") if isinstance(model_cfg.get("provider"), str) else ""
-    cfg_api_key = ""
-    for k in ("api_key", "api"):
-        v = model_cfg.get(k)
-        if isinstance(v, str) and v.strip():
-            cfg_api_key = v.strip()
-            break
     requested_norm = (requested_provider or "").strip().lower()
     cfg_provider = cfg_provider.strip().lower()
 
@@ -230,24 +160,26 @@ def _resolve_openrouter_runtime(
     env_openrouter_base_url = os.getenv("OPENROUTER_BASE_URL", "").strip()
 
     use_config_base_url = False
-    if cfg_base_url.strip() and not explicit_base_url:
+    if cfg_base_url.strip() and not explicit_base_url and not env_openai_base_url:
         if requested_norm == "auto":
-            if (not cfg_provider or cfg_provider == "auto") and not env_openai_base_url:
+            if not cfg_provider or cfg_provider == "auto":
+                use_config_base_url = True
+        elif requested_norm == "custom":
+            # Persisted custom endpoints store their base URL in config.yaml.
+            # If OPENAI_BASE_URL is not currently set in the environment, keep
+            # honoring that saved endpoint instead of falling back to OpenRouter.
+            if cfg_provider == "custom":
                 use_config_base_url = True
-        elif requested_norm == "custom" and cfg_provider == "custom":
-            # provider: custom — use base_url from config (Fixes #1760).
-            use_config_base_url = True
 
     # When the user explicitly requested the openrouter provider, skip
     # OPENAI_BASE_URL — it typically points to a custom / non-OpenRouter
     # endpoint and would prevent switching back to OpenRouter (#874).
     skip_openai_base = requested_norm == "openrouter"
 
-    # For custom, prefer config base_url over env so config.yaml is honored (#1760).
     base_url = (
         (explicit_base_url or "").strip()
-        or (cfg_base_url.strip() if use_config_base_url else "")
         or ("" if skip_openai_base else env_openai_base_url)
+        or (cfg_base_url.strip() if use_config_base_url else "")
         or env_openrouter_base_url
         or OPENROUTER_BASE_URL
     ).rstrip("/")
@@ -259,39 +191,25 @@ def _resolve_openrouter_runtime(
     # provider (issues #420, #560).
     _is_openrouter_url = "openrouter.ai" in base_url
     if _is_openrouter_url:
-        api_key_candidates = [
-            explicit_api_key,
-            os.getenv("OPENROUTER_API_KEY"),
-            os.getenv("OPENAI_API_KEY"),
-        ]
+        api_key = (
+            explicit_api_key
+            or os.getenv("OPENROUTER_API_KEY")
+            or os.getenv("OPENAI_API_KEY")
+            or ""
+        )
     else:
-        # Custom endpoint: use api_key from config when using config base_url (#1760).
-        api_key_candidates = [
-            explicit_api_key,
-            (cfg_api_key if use_config_base_url else ""),
-            os.getenv("OPENAI_API_KEY"),
-            os.getenv("OPENROUTER_API_KEY"),
-        ]
-    api_key = next(
-        (str(candidate or "").strip() for candidate in api_key_candidates if has_usable_secret(candidate)),
-        "",
-    )
+        api_key = (
+            explicit_api_key
+            or os.getenv("OPENAI_API_KEY")
+            or os.getenv("OPENROUTER_API_KEY")
+            or ""
+        )
 
     source = "explicit" if (explicit_api_key or explicit_base_url) else "env/config"
 
-    # When "custom" was explicitly requested, preserve that as the provider
-    # name instead of silently relabeling to "openrouter" (#2562).
-    # Also provide a placeholder API key for local servers that don't require
-    # authentication — the OpenAI SDK requires a non-empty api_key string.
-    effective_provider = "custom" if requested_norm == "custom" else "openrouter"
-    if effective_provider == "custom" and not api_key and not _is_openrouter_url:
-        api_key = "no-key-required"
-
     return {
-        "provider": effective_provider,
-        "api_mode": _parse_api_mode(model_cfg.get("api_mode"))
-        or _detect_api_mode_for_url(base_url)
-        or "chat_completions",
+        "provider": "openrouter",
+        "api_mode": _parse_api_mode(model_cfg.get("api_mode")) or "chat_completions",
         "base_url": base_url,
         "api_key": api_key,
         "source": source,
@@ -349,19 +267,6 @@ def resolve_runtime_provider(
             "requested_provider": requested_provider,
         }
 
-    if provider == "copilot-acp":
-        creds = resolve_external_process_provider_credentials(provider)
-        return {
-            "provider": "copilot-acp",
-            "api_mode": "chat_completions",
-            "base_url": creds.get("base_url", "").rstrip("/"),
-            "api_key": creds.get("api_key", ""),
-            "command": creds.get("command", ""),
-            "args": list(creds.get("args") or []),
-            "source": creds.get("source", "process"),
-            "requested_provider": requested_provider,
-        }
-
     # Anthropic (native Messages API)
     if provider == "anthropic":
         from agent.anthropic_adapter import resolve_anthropic_token
@@ -371,52 +276,36 @@ def resolve_runtime_provider(
                 "No Anthropic credentials found. Set ANTHROPIC_TOKEN or ANTHROPIC_API_KEY, "
                 "run 'claude setup-token', or authenticate with 'claude /login'."
             )
-        # Allow base URL override from config.yaml model.base_url, but only
-        # when the configured provider is anthropic — otherwise a non-Anthropic
-        # base_url (e.g. Codex endpoint) would leak into Anthropic requests.
-        model_cfg = _get_model_config()
-        cfg_provider = str(model_cfg.get("provider") or "").strip().lower()
-        cfg_base_url = ""
-        if cfg_provider == "anthropic":
-            cfg_base_url = (model_cfg.get("base_url") or "").strip().rstrip("/")
-        base_url = cfg_base_url or "https://api.anthropic.com"
         return {
             "provider": "anthropic",
             "api_mode": "anthropic_messages",
-            "base_url": base_url,
+            "base_url": "https://api.anthropic.com",
             "api_key": token,
             "source": "env",
             "requested_provider": requested_provider,
         }
 
+    # Alibaba Cloud / DashScope (Anthropic-compatible endpoint)
+    if provider == "alibaba":
+        creds = resolve_api_key_provider_credentials(provider)
+        base_url = creds.get("base_url", "").rstrip("/") or "https://dashscope-intl.aliyuncs.com/apps/anthropic"
+        return {
+            "provider": "alibaba",
+            "api_mode": "anthropic_messages",
+            "base_url": base_url,
+            "api_key": creds.get("api_key", ""),
+            "source": creds.get("source", "env"),
+            "requested_provider": requested_provider,
+        }
+
     # API-key providers (z.ai/GLM, Kimi, MiniMax, MiniMax-CN)
     pconfig = PROVIDER_REGISTRY.get(provider)
     if pconfig and pconfig.auth_type == "api_key":
         creds = resolve_api_key_provider_credentials(provider)
-        model_cfg = _get_model_config()
-        base_url = creds.get("base_url", "").rstrip("/")
-        api_mode = "chat_completions"
-        if provider == "copilot":
-            api_mode = _copilot_runtime_api_mode(model_cfg, creds.get("api_key", ""))
-        else:
-            # Check explicit api_mode from model config first
-            configured_mode = _parse_api_mode(model_cfg.get("api_mode"))
-            if configured_mode:
-                api_mode = configured_mode
-            # Auto-detect Anthropic-compatible endpoints by URL convention
-            # (e.g. https://api.minimax.io/anthropic, https://dashscope.../anthropic)
-            elif base_url.rstrip("/").endswith("/anthropic"):
-                api_mode = "anthropic_messages"
-            # MiniMax providers always use Anthropic Messages API.
-            # Auto-correct stale /v1 URLs (from old .env or config) to /anthropic.
-            elif provider in ("minimax", "minimax-cn"):
-                api_mode = "anthropic_messages"
-                if base_url.rstrip("/").endswith("/v1"):
-                    base_url = base_url.rstrip("/")[:-3] + "/anthropic"
         return {
             "provider": provider,
-            "api_mode": api_mode,
-            "base_url": base_url,
+            "api_mode": "chat_completions",
+            "base_url": creds.get("base_url", "").rstrip("/"),
             "api_key": creds.get("api_key", ""),
             "source": creds.get("source", "env"),
             "requested_provider": requested_provider,

hermes_cli/setup.py

@@ -4,9 +4,9 @@ Interactive setup wizard for Hermes Agent.
 Modular wizard with independently-runnable sections:
   1. Model & Provider — choose your AI provider and model
   2. Terminal Backend — where your agent runs commands
-  3. Agent Settings — iterations, compression, session reset
-  4. Messaging Platforms — connect Telegram, Discord, etc.
-  5. Tools — configure TTS, web search, image generation, etc.
+  3. Messaging Platforms — connect Telegram, Discord, etc.
+  4. Tools — configure TTS, web search, image generation, etc.
+  5. Agent Settings — iterations, compression, session reset
 
 Config files are stored in ~/.hermes/ for easy access.
 """
@@ -55,25 +55,6 @@ def _set_default_model(config: Dict[str, Any], model_name: str) -> None:
 # Default model lists per provider — used as fallback when the live
 # /models endpoint can't be reached.
 _DEFAULT_PROVIDER_MODELS = {
-    "copilot-acp": [
-        "copilot-acp",
-    ],
-    "copilot": [
-        "gpt-5.4",
-        "gpt-5.4-mini",
-        "gpt-5-mini",
-        "gpt-5.3-codex",
-        "gpt-5.2-codex",
-        "gpt-4.1",
-        "gpt-4o",
-        "gpt-4o-mini",
-        "claude-opus-4.6",
-        "claude-sonnet-4.6",
-        "claude-sonnet-4.5",
-        "claude-haiku-4.5",
-        "gemini-2.5-pro",
-        "grok-code-fast-1",
-    ],
     "zai": ["glm-5", "glm-4.7", "glm-4.5", "glm-4.5-flash"],
     "kimi-coding": ["kimi-k2.5", "kimi-k2-thinking", "kimi-k2-turbo-preview"],
     "minimax": ["MiniMax-M2.7", "MiniMax-M2.7-highspeed", "MiniMax-M2.5", "MiniMax-M2.5-highspeed", "MiniMax-M2.1"],
@@ -83,59 +64,6 @@ _DEFAULT_PROVIDER_MODELS = {
 }
 
 
-def _current_reasoning_effort(config: Dict[str, Any]) -> str:
-    agent_cfg = config.get("agent")
-    if isinstance(agent_cfg, dict):
-        return str(agent_cfg.get("reasoning_effort") or "").strip().lower()
-    return ""
-
-
-def _set_reasoning_effort(config: Dict[str, Any], effort: str) -> None:
-    agent_cfg = config.get("agent")
-    if not isinstance(agent_cfg, dict):
-        agent_cfg = {}
-        config["agent"] = agent_cfg
-    agent_cfg["reasoning_effort"] = effort
-
-
-def _setup_copilot_reasoning_selection(
-    config: Dict[str, Any],
-    model_id: str,
-    prompt_choice,
-    *,
-    catalog: Optional[list[dict[str, Any]]] = None,
-    api_key: str = "",
-) -> None:
-    from hermes_cli.models import github_model_reasoning_efforts, normalize_copilot_model_id
-
-    normalized_model = normalize_copilot_model_id(
-        model_id,
-        catalog=catalog,
-        api_key=api_key,
-    ) or model_id
-    efforts = github_model_reasoning_efforts(normalized_model, catalog=catalog, api_key=api_key)
-    if not efforts:
-        return
-
-    current_effort = _current_reasoning_effort(config)
-    choices = list(efforts) + ["Disable reasoning", f"Keep current ({current_effort or 'default'})"]
-
-    if current_effort == "none":
-        default_idx = len(efforts)
-    elif current_effort in efforts:
-        default_idx = efforts.index(current_effort)
-    elif "medium" in efforts:
-        default_idx = efforts.index("medium")
-    else:
-        default_idx = len(choices) - 1
-
-    effort_idx = prompt_choice("Select reasoning effort:", choices, default_idx)
-    if effort_idx < len(efforts):
-        _set_reasoning_effort(config, efforts[effort_idx])
-    elif effort_idx == len(efforts):
-        _set_reasoning_effort(config, "none")
-
-
 def _setup_provider_model_selection(config, provider_id, current_model, prompt_choice, prompt_fn):
     """Model selection for API-key providers with live /models detection.
 
@@ -143,60 +71,29 @@ def _setup_provider_model_selection(config, provider_id, current_model, prompt_c
     hardcoded default list with a warning if the endpoint is unreachable.
     Always offers a 'Custom model' escape hatch.
     """
-    from hermes_cli.auth import PROVIDER_REGISTRY, resolve_api_key_provider_credentials
+    from hermes_cli.auth import PROVIDER_REGISTRY
     from hermes_cli.config import get_env_value
-    from hermes_cli.models import (
-        copilot_model_api_mode,
-        fetch_api_models,
-        fetch_github_model_catalog,
-        normalize_copilot_model_id,
-    )
+    from hermes_cli.models import fetch_api_models
 
     pconfig = PROVIDER_REGISTRY[provider_id]
-    is_copilot_catalog_provider = provider_id in {"copilot", "copilot-acp"}
 
     # Resolve API key and base URL for the probe
-    if is_copilot_catalog_provider:
-        api_key = ""
-        if provider_id == "copilot":
-            creds = resolve_api_key_provider_credentials(provider_id)
-            api_key = creds.get("api_key", "")
-            base_url = creds.get("base_url", "") or pconfig.inference_base_url
-        else:
-            try:
-                creds = resolve_api_key_provider_credentials("copilot")
-                api_key = creds.get("api_key", "")
-            except Exception:
-                pass
-            base_url = pconfig.inference_base_url
-        catalog = fetch_github_model_catalog(api_key)
-        current_model = normalize_copilot_model_id(
-            current_model,
-            catalog=catalog,
-            api_key=api_key,
-        ) or current_model
-    else:
-        api_key = ""
-        for ev in pconfig.api_key_env_vars:
-            api_key = get_env_value(ev) or os.getenv(ev, "")
-            if api_key:
-                break
-        base_url_env = pconfig.base_url_env_var or ""
-        base_url = (get_env_value(base_url_env) if base_url_env else "") or pconfig.inference_base_url
-        catalog = None
+    api_key = ""
+    for ev in pconfig.api_key_env_vars:
+        api_key = get_env_value(ev) or os.getenv(ev, "")
+        if api_key:
+            break
+    base_url_env = pconfig.base_url_env_var or ""
+    base_url = (get_env_value(base_url_env) if base_url_env else "") or pconfig.inference_base_url
 
     # Try live /models endpoint
-    if is_copilot_catalog_provider and catalog:
-        live_models = [item.get("id", "") for item in catalog if item.get("id")]
-    else:
-        live_models = fetch_api_models(api_key, base_url)
+    live_models = fetch_api_models(api_key, base_url)
 
     if live_models:
         provider_models = live_models
         print_info(f"Found {len(live_models)} model(s) from {pconfig.name} API")
     else:
-        fallback_provider_id = "copilot" if provider_id == "copilot-acp" else provider_id
-        provider_models = _DEFAULT_PROVIDER_MODELS.get(fallback_provider_id, [])
+        provider_models = _DEFAULT_PROVIDER_MODELS.get(provider_id, [])
         if provider_models:
             print_warning(
                 f"Could not auto-detect models from {pconfig.name} API — showing defaults.\n"
@@ -210,29 +107,12 @@ def _setup_provider_model_selection(config, provider_id, current_model, prompt_c
     keep_idx = len(model_choices) - 1
     model_idx = prompt_choice("Select default model:", model_choices, keep_idx)
 
-    selected_model = current_model
-
     if model_idx < len(provider_models):
-        selected_model = provider_models[model_idx]
-        if is_copilot_catalog_provider:
-            selected_model = normalize_copilot_model_id(
-                selected_model,
-                catalog=catalog,
-                api_key=api_key,
-            ) or selected_model
-        _set_default_model(config, selected_model)
+        _set_default_model(config, provider_models[model_idx])
     elif model_idx == len(provider_models):
         custom = prompt_fn("Enter model name")
         if custom:
-            if is_copilot_catalog_provider:
-                selected_model = normalize_copilot_model_id(
-                    custom,
-                    catalog=catalog,
-                    api_key=api_key,
-                ) or custom
-            else:
-                selected_model = custom
-            _set_default_model(config, selected_model)
+            _set_default_model(config, custom)
     else:
         # "Keep current" selected — validate it's compatible with the new
         # provider.  OpenRouter-formatted names (containing "/") won't work
@@ -243,25 +123,8 @@ def _setup_provider_model_selection(config, provider_id, current_model, prompt_c
                 f"and won't work with {pconfig.name}. "
                 f"Switching to {provider_models[0]}."
             )
-            selected_model = provider_models[0]
             _set_default_model(config, provider_models[0])
 
-    if provider_id == "copilot" and selected_model:
-        model_cfg = _model_config_dict(config)
-        model_cfg["api_mode"] = copilot_model_api_mode(
-            selected_model,
-            catalog=catalog,
-            api_key=api_key,
-        )
-        config["model"] = model_cfg
-        _setup_copilot_reasoning_selection(
-            config,
-            selected_model,
-            prompt_choice,
-            catalog=catalog,
-            api_key=api_key,
-        )
-
 
 def _sync_model_from_disk(config: Dict[str, Any]) -> None:
     disk_model = load_config().get("model")
@@ -810,8 +673,6 @@ def setup_model_provider(config: dict):
         resolve_codex_runtime_credentials,
         DEFAULT_CODEX_BASE_URL,
         detect_external_credentials,
-        get_auth_status,
-        resolve_api_key_provider_credentials,
     )
 
     print_header("Inference Provider")
@@ -821,8 +682,6 @@ def setup_model_provider(config: dict):
     existing_or = get_env_value("OPENROUTER_API_KEY")
     active_oauth = get_active_provider()
     existing_custom = get_env_value("OPENAI_BASE_URL")
-    copilot_status = get_auth_status("copilot")
-    copilot_acp_status = get_auth_status("copilot-acp")
 
     model_cfg = config.get("model") if isinstance(config.get("model"), dict) else {}
     current_config_provider = str(model_cfg.get("provider") or "").strip().lower() or None
@@ -843,12 +702,7 @@ def setup_model_provider(config: dict):
 
     # Detect if any provider is already configured
     has_any_provider = bool(
-        current_config_provider
-        or active_oauth
-        or existing_custom
-        or existing_or
-        or copilot_status.get("logged_in")
-        or copilot_acp_status.get("logged_in")
+        current_config_provider or active_oauth or existing_custom or existing_or
     )
 
     # Build "keep current" label
@@ -873,9 +727,9 @@ def setup_model_provider(config: dict):
         keep_label = None  # No provider configured — don't show "Keep current"
 
     provider_choices = [
-        "OpenRouter API key (100+ models, pay-per-use)",
         "Login with Nous Portal (Nous Research subscription — OAuth)",
         "Login with OpenAI Codex",
+        "OpenRouter API key (100+ models, pay-per-use)",
         "Custom OpenAI-compatible endpoint (self-hosted / VLLM / etc.)",
         "Z.AI / GLM (Zhipu AI models)",
         "Kimi / Moonshot (Kimi coding models)",
@@ -887,14 +741,12 @@ def setup_model_provider(config: dict):
         "Alibaba Cloud / DashScope (Qwen models via Anthropic-compatible API)",
         "OpenCode Zen (35+ curated models, pay-as-you-go)",
         "OpenCode Go (open models, $10/month subscription)",
-        "GitHub Copilot (uses GITHUB_TOKEN or gh auth token)",
-        "GitHub Copilot ACP (spawns `copilot --acp --stdio`)",
     ]
     if keep_label:
         provider_choices.append(keep_label)
 
     # Default to "Keep current" if a provider exists, otherwise OpenRouter (most common)
-    default_provider = len(provider_choices) - 1 if has_any_provider else 0
+    default_provider = len(provider_choices) - 1 if has_any_provider else 2
 
     if not has_any_provider:
         print_warning("An inference provider is required for Hermes to work.")
@@ -911,7 +763,81 @@ def setup_model_provider(config: dict):
     selected_base_url = None  # deferred until after model selection
     nous_models = []  # populated if Nous login succeeds
 
-    if provider_idx == 0:  # OpenRouter
+    if provider_idx == 0:  # Nous Portal (OAuth)
+        selected_provider = "nous"
+        print()
+        print_header("Nous Portal Login")
+        print_info("This will open your browser to authenticate with Nous Portal.")
+        print_info("You'll need a Nous Research account with an active subscription.")
+        print()
+
+        try:
+            from hermes_cli.auth import _login_nous, ProviderConfig
+            import argparse
+
+            mock_args = argparse.Namespace(
+                portal_url=None,
+                inference_url=None,
+                client_id=None,
+                scope=None,
+                no_browser=False,
+                timeout=15.0,
+                ca_bundle=None,
+                insecure=False,
+            )
+            pconfig = PROVIDER_REGISTRY["nous"]
+            _login_nous(mock_args, pconfig)
+            _sync_model_from_disk(config)
+
+            # Fetch models for the selection step
+            try:
+                creds = resolve_nous_runtime_credentials(
+                    min_key_ttl_seconds=5 * 60,
+                    timeout_seconds=15.0,
+                )
+                nous_models = fetch_nous_models(
+                    inference_base_url=creds.get("base_url", ""),
+                    api_key=creds.get("api_key", ""),
+                )
+            except Exception as e:
+                logger.debug("Could not fetch Nous models after login: %s", e)
+
+        except SystemExit:
+            print_warning("Nous Portal login was cancelled or failed.")
+            print_info("You can try again later with: hermes model")
+            selected_provider = None
+        except Exception as e:
+            print_error(f"Login failed: {e}")
+            print_info("You can try again later with: hermes model")
+            selected_provider = None
+
+    elif provider_idx == 1:  # OpenAI Codex
+        selected_provider = "openai-codex"
+        print()
+        print_header("OpenAI Codex Login")
+        print()
+
+        try:
+            import argparse
+
+            mock_args = argparse.Namespace()
+            _login_openai_codex(mock_args, PROVIDER_REGISTRY["openai-codex"])
+            # Clear custom endpoint vars that would override provider routing.
+            if existing_custom:
+                save_env_value("OPENAI_BASE_URL", "")
+                save_env_value("OPENAI_API_KEY", "")
+            _update_config_for_provider("openai-codex", DEFAULT_CODEX_BASE_URL)
+            _set_model_provider(config, "openai-codex", DEFAULT_CODEX_BASE_URL)
+        except SystemExit:
+            print_warning("OpenAI Codex login was cancelled or failed.")
+            print_info("You can try again later with: hermes model")
+            selected_provider = None
+        except Exception as e:
+            print_error(f"Login failed: {e}")
+            print_info("You can try again later with: hermes model")
+            selected_provider = None
+
+    elif provider_idx == 2:  # OpenRouter
         selected_provider = "openrouter"
         print()
         print_header("OpenRouter API Key")
@@ -966,96 +892,98 @@ def setup_model_provider(config: dict):
         except Exception as e:
             logger.debug("Could not save provider to config.yaml: %s", e)
 
-    elif provider_idx == 1:  # Nous Portal (OAuth)
-        selected_provider = "nous"
-        print()
-        print_header("Nous Portal Login")
-        print_info("This will open your browser to authenticate with Nous Portal.")
-        print_info("You'll need a Nous Research account with an active subscription.")
-        print()
-
-        try:
-            from hermes_cli.auth import _login_nous, ProviderConfig
-            import argparse
-
-            mock_args = argparse.Namespace(
-                portal_url=None,
-                inference_url=None,
-                client_id=None,
-                scope=None,
-                no_browser=False,
-                timeout=15.0,
-                ca_bundle=None,
-                insecure=False,
-            )
-            pconfig = PROVIDER_REGISTRY["nous"]
-            _login_nous(mock_args, pconfig)
-            _sync_model_from_disk(config)
-
-            # Fetch models for the selection step
-            try:
-                creds = resolve_nous_runtime_credentials(
-                    min_key_ttl_seconds=5 * 60,
-                    timeout_seconds=15.0,
-                )
-                nous_models = fetch_nous_models(
-                    inference_base_url=creds.get("base_url", ""),
-                    api_key=creds.get("api_key", ""),
-                )
-            except Exception as e:
-                logger.debug("Could not fetch Nous models after login: %s", e)
-
-        except SystemExit:
-            print_warning("Nous Portal login was cancelled or failed.")
-            print_info("You can try again later with: hermes model")
-            selected_provider = None
-        except Exception as e:
-            print_error(f"Login failed: {e}")
-            print_info("You can try again later with: hermes model")
-            selected_provider = None
-
-    elif provider_idx == 2:  # OpenAI Codex
-        selected_provider = "openai-codex"
-        print()
-        print_header("OpenAI Codex Login")
-        print()
-
-        try:
-            import argparse
-
-            mock_args = argparse.Namespace()
-            _login_openai_codex(mock_args, PROVIDER_REGISTRY["openai-codex"])
-            # Clear custom endpoint vars that would override provider routing.
-            if existing_custom:
-                save_env_value("OPENAI_BASE_URL", "")
-                save_env_value("OPENAI_API_KEY", "")
-            _update_config_for_provider("openai-codex", DEFAULT_CODEX_BASE_URL)
-            _set_model_provider(config, "openai-codex", DEFAULT_CODEX_BASE_URL)
-        except SystemExit:
-            print_warning("OpenAI Codex login was cancelled or failed.")
-            print_info("You can try again later with: hermes model")
-            selected_provider = None
-        except Exception as e:
-            print_error(f"Login failed: {e}")
-            print_info("You can try again later with: hermes model")
-            selected_provider = None
-
     elif provider_idx == 3:  # Custom endpoint
         selected_provider = "custom"
         print()
         print_header("Custom OpenAI-Compatible Endpoint")
         print_info("Works with any API that follows OpenAI's chat completions spec")
-        print()
 
-        # Reuse the shared custom endpoint flow from `hermes model`.
-        # This handles: URL/key/model/context-length prompts, endpoint probing,
-        # env saving, config.yaml updates, and custom_providers persistence.
-        from hermes_cli.main import _model_flow_custom
-        _model_flow_custom(config)
-        # _model_flow_custom handles model selection, config, env vars,
-        # and custom_providers. Keep selected_provider = "custom" so
-        # the model selection step below is skipped (line 1631 check)
-        # but vision and TTS setup still run.
+        current_url = get_env_value("OPENAI_BASE_URL") or ""
+        current_key = get_env_value("OPENAI_API_KEY")
+        _raw_model = config.get("model", "")
+        current_model = (
+            _raw_model.get("default", "")
+            if isinstance(_raw_model, dict)
+            else (_raw_model or "")
+        )
+
+        if current_url:
+            print_info(f"  Current URL: {current_url}")
+        if current_key:
+            print_info(f"  Current key: {current_key[:8]}... (configured)")
+
+        base_url = prompt(
+            "  API base URL (e.g., https://api.example.com/v1)", current_url
+        ).strip()
+        api_key = prompt("  API key", password=True)
+        model_name = prompt("  Model name (e.g., gpt-4, claude-3-opus)", current_model)
+
+        if base_url:
+            from hermes_cli.models import probe_api_models
+
+            probe = probe_api_models(api_key, base_url)
+            if probe.get("used_fallback") and probe.get("resolved_base_url"):
+                print_warning(
+                    f"Endpoint verification worked at {probe['resolved_base_url']}/models, "
+                    f"not the exact URL you entered. Saving the working base URL instead."
+                )
+                base_url = probe["resolved_base_url"]
+            elif probe.get("models") is not None:
+                print_success(
+                    f"Verified endpoint via {probe.get('probed_url')} "
+                    f"({len(probe.get('models') or [])} model(s) visible)"
+                )
+            else:
+                print_warning(
+                    f"Could not verify this endpoint via {probe.get('probed_url')}. "
+                    f"Hermes will still save it."
+                )
+                if probe.get("suggested_base_url"):
+                    print_info(
+                        f"  If this server expects /v1, try base URL: {probe['suggested_base_url']}"
+                    )
+
+            save_env_value("OPENAI_BASE_URL", base_url)
+        if api_key:
+            save_env_value("OPENAI_API_KEY", api_key)
+        if model_name:
+            _set_default_model(config, model_name)
+
+        try:
+            from hermes_cli.auth import deactivate_provider
+
+            deactivate_provider()
+        except Exception:
+            pass
+
+        # Save provider and base_url to config.yaml so the gateway and CLI
+        # both resolve the correct provider without relying on env-var heuristics.
+        if base_url:
+            import yaml
+
+            config_path = (
+                Path(os.environ.get("HERMES_HOME", Path.home() / ".hermes"))
+                / "config.yaml"
+            )
+            try:
+                disk_cfg = {}
+                if config_path.exists():
+                    disk_cfg = yaml.safe_load(config_path.read_text()) or {}
+                model_section = disk_cfg.get("model", {})
+                if isinstance(model_section, str):
+                    model_section = {"default": model_section}
+                model_section["provider"] = "custom"
+                model_section["base_url"] = base_url.rstrip("/")
+                if model_name:
+                    model_section["default"] = model_name
+                disk_cfg["model"] = model_section
+                config_path.write_text(yaml.safe_dump(disk_cfg, sort_keys=False))
+            except Exception as e:
+                logger.debug("Could not save provider to config.yaml: %s", e)
+
+            _set_model_provider(config, "custom", base_url)
+
+        print_success("Custom endpoint configured")
 
     elif provider_idx == 4:  # Z.AI / GLM
         selected_provider = "zai"
@@ -1484,56 +1412,7 @@ def setup_model_provider(config: dict):
         _set_model_provider(config, "opencode-go", pconfig.inference_base_url)
         selected_base_url = pconfig.inference_base_url
 
-    elif provider_idx == 14:  # GitHub Copilot
-        selected_provider = "copilot"
-        print()
-        print_header("GitHub Copilot")
-        pconfig = PROVIDER_REGISTRY["copilot"]
-        print_info("Hermes can use GITHUB_TOKEN, GH_TOKEN, or your gh CLI login.")
-        print_info(f"Base URL: {pconfig.inference_base_url}")
-        print()
-
-        copilot_creds = resolve_api_key_provider_credentials("copilot")
-        source = copilot_creds.get("source", "")
-        token = copilot_creds.get("api_key", "")
-        if token:
-            if source in ("GITHUB_TOKEN", "GH_TOKEN"):
-                print_info(f"Current: {token[:8]}... ({source})")
-            elif source == "gh auth token":
-                print_info("Current: authenticated via `gh auth token`")
-            else:
-                print_info("Current: GitHub token configured")
-        else:
-            api_key = prompt("  GitHub token", password=True)
-            if api_key:
-                save_env_value("GITHUB_TOKEN", api_key)
-                print_success("GitHub token saved")
-            else:
-                print_warning("Skipped - agent won't work without a GitHub token or gh auth login")
-
-        if existing_custom:
-            save_env_value("OPENAI_BASE_URL", "")
-            save_env_value("OPENAI_API_KEY", "")
-        _set_model_provider(config, "copilot", pconfig.inference_base_url)
-        selected_base_url = pconfig.inference_base_url
-
-    elif provider_idx == 15:  # GitHub Copilot ACP
-        selected_provider = "copilot-acp"
-        print()
-        print_header("GitHub Copilot ACP")
-        pconfig = PROVIDER_REGISTRY["copilot-acp"]
-        print_info("Hermes will start `copilot --acp --stdio` for each request.")
-        print_info("Use HERMES_COPILOT_ACP_COMMAND or COPILOT_CLI_PATH to override the command.")
-        print_info(f"Base marker: {pconfig.inference_base_url}")
-        print()
-
-        if existing_custom:
-            save_env_value("OPENAI_BASE_URL", "")
-            save_env_value("OPENAI_API_KEY", "")
-        _set_model_provider(config, "copilot-acp", pconfig.inference_base_url)
-        selected_base_url = pconfig.inference_base_url
-
-    # else: provider_idx == 16 (Keep current) — only shown when a provider already exists
+    # else: provider_idx == 14 (Keep current) — only shown when a provider already exists
     # Normalize "keep current" to an explicit provider so downstream logic
     # doesn't fall back to the generic OpenRouter/static-model path.
     if selected_provider is None:
@@ -1565,8 +1444,6 @@ def setup_model_provider(config: dict):
     if _vision_needs_setup:
         _prov_names = {
             "nous-api": "Nous Portal API key",
-            "copilot": "GitHub Copilot",
-            "copilot-acp": "GitHub Copilot ACP",
             "zai": "Z.AI / GLM",
             "kimi-coding": "Kimi / Moonshot",
             "minimax": "MiniMax",
@@ -1706,15 +1583,7 @@ def setup_model_provider(config: dict):
                     _set_default_model(config, custom)
             _update_config_for_provider("openai-codex", DEFAULT_CODEX_BASE_URL)
             _set_model_provider(config, "openai-codex", DEFAULT_CODEX_BASE_URL)
-        elif selected_provider == "copilot-acp":
-            _setup_provider_model_selection(
-                config, selected_provider, current_model,
-                prompt_choice, prompt,
-            )
-            model_cfg = _model_config_dict(config)
-            model_cfg["api_mode"] = "chat_completions"
-            config["model"] = model_cfg
-        elif selected_provider in ("copilot", "zai", "kimi-coding", "minimax", "minimax-cn", "kilocode", "ai-gateway", "opencode-zen", "opencode-go", "alibaba"):
+        elif selected_provider in ("zai", "kimi-coding", "minimax", "minimax-cn", "kilocode", "ai-gateway"):
             _setup_provider_model_selection(
                 config, selected_provider, current_model,
                 prompt_choice, prompt,
@@ -1775,7 +1644,7 @@ def setup_model_provider(config: dict):
     # Write provider+base_url to config.yaml only after model selection is complete.
     # This prevents a race condition where the gateway picks up a new provider
     # before the model name has been updated to match.
-    if selected_provider in ("copilot-acp", "copilot", "zai", "kimi-coding", "minimax", "minimax-cn", "kilocode", "anthropic") and selected_base_url is not None:
+    if selected_provider in ("zai", "kimi-coding", "minimax", "minimax-cn", "kilocode", "anthropic") and selected_base_url is not None:
         _update_config_for_provider(selected_provider, selected_base_url)
 
     save_config(config)
@@ -2037,7 +1906,7 @@ def setup_terminal_backend(config: dict):
 
         # Docker image
         current_image = config.get("terminal", {}).get(
-            "docker_image", "nikolaik/python-nodejs:python3.11-nodejs20"
+            "docker_image", "python:3.11-slim"
         )
         image = prompt("  Docker image", current_image)
         config["terminal"]["docker_image"] = image
@@ -2059,7 +1928,7 @@ def setup_terminal_backend(config: dict):
             print_info(f"Found: {sing_bin}")
 
         current_image = config.get("terminal", {}).get(
-            "singularity_image", "docker://nikolaik/python-nodejs:python3.11-nodejs20"
+            "singularity_image", "docker://python:3.11-slim"
         )
         image = prompt("  Container image", current_image)
         config["terminal"]["singularity_image"] = image
@@ -2261,7 +2130,7 @@ def setup_agent_settings(config: dict):
     )
     print_info("Maximum tool-calling iterations per conversation.")
     print_info("Higher = more complex tasks, but costs more tokens.")
-    print_info("Default is 90, which works for most tasks. Use 150+ for open exploration.")
+    print_info("Recommended: 30-60 for most tasks, 100+ for open exploration.")
 
     max_iter_str = prompt("Max iterations", current_max)
     try:
@@ -2303,7 +2172,7 @@ def setup_agent_settings(config: dict):
 
     config.setdefault("compression", {})["enabled"] = True
 
-    current_threshold = config.get("compression", {}).get("threshold", 0.50)
+    current_threshold = config.get("compression", {}).get("threshold", 0.85)
     threshold_str = prompt("Compression threshold (0.5-0.95)", str(current_threshold))
     try:
         threshold = float(threshold_str)
@@ -2313,7 +2182,7 @@ def setup_agent_settings(config: dict):
         pass
 
     print_success(
-        f"Context compression threshold set to {config['compression'].get('threshold', 0.50)}"
+        f"Context compression threshold set to {config['compression'].get('threshold', 0.85)}"
     )
 
     # ── Session Reset Policy ──
@@ -2775,61 +2644,6 @@ def setup_gateway(config: dict):
             print_info("Run 'hermes whatsapp' to choose your mode (separate bot number")
             print_info("or personal self-chat) and pair via QR code.")
 
-    # ── Webhooks ──
-    existing_webhook = get_env_value("WEBHOOK_ENABLED")
-    if existing_webhook:
-        print_info("Webhooks: already configured")
-        if prompt_yes_no("Reconfigure webhooks?", False):
-            existing_webhook = None
-
-    if not existing_webhook and prompt_yes_no("Set up webhooks? (GitHub, GitLab, etc.)", False):
-        print()
-        print_warning(
-            "⚠  Webhook and SMS platforms require exposing gateway ports to the"
-        )
-        print_warning(
-            "   internet. For security, run the gateway in a sandboxed environment"
-        )
-        print_warning(
-            "   (Docker, VM, etc.) to limit blast radius from prompt injection."
-        )
-        print()
-        print_info(
-            "   Full guide: https://hermes-agent.nousresearch.com/docs/user-guide/messaging/webhooks/"
-        )
-        print()
-
-        port = prompt("Webhook port (default 8644)")
-        if port:
-            try:
-                save_env_value("WEBHOOK_PORT", str(int(port)))
-                print_success(f"Webhook port set to {port}")
-            except ValueError:
-                print_warning("Invalid port number, using default 8644")
-
-        secret = prompt("Global HMAC secret (shared across all routes)", password=True)
-        if secret:
-            save_env_value("WEBHOOK_SECRET", secret)
-            print_success("Webhook secret saved")
-        else:
-            print_warning("No secret set — you must configure per-route secrets in config.yaml")
-
-        save_env_value("WEBHOOK_ENABLED", "true")
-        print()
-        print_success("Webhooks enabled! Next steps:")
-        print_info("   1. Define webhook routes in ~/.hermes/config.yaml")
-        print_info("   2. Point your service (GitHub, GitLab, etc.) at:")
-        print_info("      http://your-server:8644/webhooks/<route-name>")
-        print()
-        print_info(
-            "   Route configuration guide:"
-        )
-        print_info(
-            "   https://hermes-agent.nousresearch.com/docs/user-guide/messaging/webhooks/#configuring-routes"
-        )
-        print()
-        print_info("   Open config in your editor:  hermes config edit")
-
     # ── Gateway Service Setup ──
     any_messaging = (
         get_env_value("TELEGRAM_BOT_TOKEN")
@@ -2839,7 +2653,6 @@ def setup_gateway(config: dict):
         or get_env_value("MATRIX_ACCESS_TOKEN")
         or get_env_value("MATRIX_PASSWORD")
         or get_env_value("WHATSAPP_ENABLED")
-        or get_env_value("WEBHOOK_ENABLED")
     )
     if any_messaging:
         print()
@@ -3106,10 +2919,6 @@ def run_setup_wizard(args):
       hermes setup tools     — just tool configuration
       hermes setup agent     — just agent settings
     """
-    from hermes_cli.config import is_managed, managed_error
-    if is_managed():
-        managed_error("run setup wizard")
-        return
     ensure_hermes_home()
 
     config = load_config()
@@ -3252,9 +3061,9 @@ def run_setup_wizard(args):
         print_info("We'll walk you through:")
         print_info("  1. Model & Provider — choose your AI provider and model")
         print_info("  2. Terminal Backend — where your agent runs commands")
-        print_info("  3. Agent Settings — iterations, compression, session reset")
-        print_info("  4. Messaging Platforms — connect Telegram, Discord, etc.")
-        print_info("  5. Tools — configure TTS, web search, image generation, etc.")
+        print_info("  3. Messaging Platforms — connect Telegram, Discord, etc.")
+        print_info("  4. Tools — configure TTS, web search, image generation, etc.")
+        print_info("  5. Agent Settings — iterations, compression, session reset")
         print()
         print_info("Press Enter to begin, or Ctrl+C to exit.")
         try:

hermes_cli/skills_hub.py

@@ -455,8 +455,6 @@ def do_inspect(identifier: str, console: Optional[Console] = None) -> None:
 
     if bundle and "SKILL.md" in bundle.files:
         content = bundle.files["SKILL.md"]
-        if isinstance(content, bytes):
-            content = content.decode("utf-8", errors="replace")
         # Show first 50 lines as preview
         lines = content.split("\n")
         preview = "\n".join(lines[:50])
@@ -642,8 +640,7 @@ def do_tap(action: str, repo: str = "", console: Optional[Console] = None) -> No
         table.add_column("Repo", style="bold cyan")
         table.add_column("Path", style="dim")
         for t in taps:
-            label = t.get("repo") or t.get("name") or t.get("path", "unknown")
-            table.add_row(label, t.get("path", "skills/"))
+            table.add_row(t["repo"], t.get("path", "skills/"))
         c.print(table)
         c.print()
 

hermes_cli/tools_config.py

@@ -101,30 +101,6 @@ CONFIGURABLE_TOOLSETS = [
 # but the setup checklist won't pre-select them for first-time users.
 _DEFAULT_OFF_TOOLSETS = {"moa", "homeassistant", "rl"}
 
-
-def _get_effective_configurable_toolsets():
-    """Return CONFIGURABLE_TOOLSETS + any plugin-provided toolsets.
-
-    Plugin toolsets are appended at the end so they appear after the
-    built-in toolsets in the TUI checklist.
-    """
-    result = list(CONFIGURABLE_TOOLSETS)
-    try:
-        from hermes_cli.plugins import get_plugin_toolsets
-        result.extend(get_plugin_toolsets())
-    except Exception:
-        pass
-    return result
-
-
-def _get_plugin_toolset_keys() -> set:
-    """Return the set of toolset keys provided by plugins."""
-    try:
-        from hermes_cli.plugins import get_plugin_toolsets
-        return {ts_key for ts_key, _, _ in get_plugin_toolsets()}
-    except Exception:
-        return set()
-
 # Platform display config
 PLATFORMS = {
     "cli":      {"label": "🖥️  CLI",       "default_toolset": "hermes-cli"},
@@ -391,46 +367,18 @@ def _get_platform_tools(config: dict, platform: str) -> Set[str]:
         default_ts = PLATFORMS[platform]["default_toolset"]
         toolset_names = [default_ts]
 
-    configurable_keys = {ts_key for ts_key, _, _ in CONFIGURABLE_TOOLSETS}
+    # Resolve to individual tool names, then map back to which
+    # configurable toolsets are covered
+    all_tool_names = set()
+    for ts_name in toolset_names:
+        all_tool_names.update(resolve_toolset(ts_name))
 
-    # If the saved list contains any configurable keys directly, the user
-    # has explicitly configured this platform — use direct membership.
-    # This avoids the subset-inference bug where composite toolsets like
-    # "hermes-cli" (which include all _HERMES_CORE_TOOLS) cause disabled
-    # toolsets to re-appear as enabled.
-    has_explicit_config = any(ts in configurable_keys for ts in toolset_names)
-
-    if has_explicit_config:
-        enabled_toolsets = {ts for ts in toolset_names if ts in configurable_keys}
-    else:
-        # No explicit config — fall back to resolving composite toolset names
-        # (e.g. "hermes-cli") to individual tool names and reverse-mapping.
-        all_tool_names = set()
-        for ts_name in toolset_names:
-            all_tool_names.update(resolve_toolset(ts_name))
-
-        enabled_toolsets = set()
-        for ts_key, _, _ in CONFIGURABLE_TOOLSETS:
-            ts_tools = set(resolve_toolset(ts_key))
-            if ts_tools and ts_tools.issubset(all_tool_names):
-                enabled_toolsets.add(ts_key)
-
-    # Plugin toolsets: enabled by default unless explicitly disabled.
-    # A plugin toolset is "known" for a platform once `hermes tools`
-    # has been saved for that platform (tracked via known_plugin_toolsets).
-    # Unknown plugins default to enabled; known-but-absent = disabled.
-    plugin_ts_keys = _get_plugin_toolset_keys()
-    if plugin_ts_keys:
-        known_map = config.get("known_plugin_toolsets", {})
-        known_for_platform = set(known_map.get(platform, []))
-        for pts in plugin_ts_keys:
-            if pts in toolset_names:
-                # Explicitly listed in config — enabled
-                enabled_toolsets.add(pts)
-            elif pts not in known_for_platform:
-                # New plugin not yet seen by hermes tools — default enabled
-                enabled_toolsets.add(pts)
-            # else: known but not in config = user disabled it
+    # Map individual tool names back to configurable toolset keys
+    enabled_toolsets = set()
+    for ts_key, _, _ in CONFIGURABLE_TOOLSETS:
+        ts_tools = set(resolve_toolset(ts_key))
+        if ts_tools and ts_tools.issubset(all_tool_names):
+            enabled_toolsets.add(ts_key)
 
     return enabled_toolsets
 
@@ -443,37 +391,22 @@ def _save_platform_tools(config: dict, platform: str, enabled_toolset_keys: Set[
     """
     config.setdefault("platform_toolsets", {})
 
-    # Get the set of all configurable toolset keys (built-in + plugin)
+    # Get the set of all configurable toolset keys
     configurable_keys = {ts_key for ts_key, _, _ in CONFIGURABLE_TOOLSETS}
-    plugin_keys = _get_plugin_toolset_keys()
-    configurable_keys |= plugin_keys
-
-    # Also exclude platform default toolsets (hermes-cli, hermes-telegram, etc.)
-    # These are "super" toolsets that resolve to ALL tools, so preserving them
-    # would silently override the user's unchecked selections on the next read.
-    platform_default_keys = {p["default_toolset"] for p in PLATFORMS.values()}
 
     # Get existing toolsets for this platform
     existing_toolsets = config.get("platform_toolsets", {}).get(platform, [])
     if not isinstance(existing_toolsets, list):
         existing_toolsets = []
 
-    # Preserve any entries that are NOT configurable toolsets and NOT platform
-    # defaults (i.e. only MCP server names should be preserved)
+    # Preserve any entries that are NOT configurable toolsets (i.e. MCP server names)
     preserved_entries = {
         entry for entry in existing_toolsets
-        if entry not in configurable_keys and entry not in platform_default_keys
+        if entry not in configurable_keys
     }
 
     # Merge preserved entries with new enabled toolsets
     config["platform_toolsets"][platform] = sorted(enabled_toolset_keys | preserved_entries)
-
-    # Track which plugin toolsets are "known" for this platform so we can
-    # distinguish "new plugin, default enabled" from "user disabled it".
-    if plugin_keys:
-        config.setdefault("known_plugin_toolsets", {})
-        config["known_plugin_toolsets"][platform] = sorted(plugin_keys)
-
     save_config(config)
 
 
@@ -591,17 +524,15 @@ def _prompt_toolset_checklist(platform_label: str, enabled: Set[str]) -> Set[str
     """Multi-select checklist of toolsets. Returns set of selected toolset keys."""
     from hermes_cli.curses_ui import curses_checklist
 
-    effective = _get_effective_configurable_toolsets()
-
     labels = []
-    for ts_key, ts_label, ts_desc in effective:
+    for ts_key, ts_label, ts_desc in CONFIGURABLE_TOOLSETS:
         suffix = ""
         if not _toolset_has_keys(ts_key) and (TOOL_CATEGORIES.get(ts_key) or TOOLSET_ENV_REQUIREMENTS.get(ts_key)):
             suffix = "  [no API key]"
         labels.append(f"{ts_label}  ({ts_desc}){suffix}")
 
     pre_selected = {
-        i for i, (ts_key, _, _) in enumerate(effective)
+        i for i, (ts_key, _, _) in enumerate(CONFIGURABLE_TOOLSETS)
         if ts_key in enabled
     }
 
@@ -611,7 +542,7 @@ def _prompt_toolset_checklist(platform_label: str, enabled: Set[str]) -> Set[str
         pre_selected,
         cancel_returns=pre_selected,
     )
-    return {effective[i][0] for i in chosen}
+    return {CONFIGURABLE_TOOLSETS[i][0] for i in chosen}
 
 
 # ─── Provider-Aware Configuration ────────────────────────────────────────────
@@ -826,7 +757,7 @@ def _configure_simple_requirements(ts_key: str):
     if not missing:
         return
 
-    ts_label = next((l for k, l, _ in _get_effective_configurable_toolsets() if k == ts_key), ts_key)
+    ts_label = next((l for k, l, _ in CONFIGURABLE_TOOLSETS if k == ts_key), ts_key)
     print()
     print(color(f"  {ts_label} requires configuration:", Colors.YELLOW))
 
@@ -845,7 +776,7 @@ def _reconfigure_tool(config: dict):
     """Let user reconfigure an existing tool's provider or API key."""
     # Build list of configurable tools that are currently set up
     configurable = []
-    for ts_key, ts_label, _ in _get_effective_configurable_toolsets():
+    for ts_key, ts_label, _ in CONFIGURABLE_TOOLSETS:
         cat = TOOL_CATEGORIES.get(ts_key)
         reqs = TOOLSET_ENV_REQUIREMENTS.get(ts_key)
         if cat or reqs:
@@ -959,7 +890,7 @@ def _reconfigure_simple_requirements(ts_key: str):
     if not requirements:
         return
 
-    ts_label = next((l for k, l, _ in _get_effective_configurable_toolsets() if k == ts_key), ts_key)
+    ts_label = next((l for k, l, _ in CONFIGURABLE_TOOLSETS if k == ts_key), ts_key)
     print()
     print(color(f"  {ts_label}:", Colors.CYAN))
 
@@ -998,7 +929,7 @@ def tools_command(args=None, first_install: bool = False, config: dict = None):
 
     # Non-interactive summary mode for CLI usage
     if getattr(args, "summary", False):
-        total = len(_get_effective_configurable_toolsets())
+        total = len(CONFIGURABLE_TOOLSETS)
         print(color("⚕ Tool Summary", Colors.CYAN, Colors.BOLD))
         print()
         summary = _platform_toolset_summary(config, enabled_platforms)
@@ -1009,7 +940,7 @@ def tools_command(args=None, first_install: bool = False, config: dict = None):
             print(color(f"  {pinfo['label']}", Colors.BOLD) + color(f"  ({count}/{total})", Colors.DIM))
             if enabled:
                 for ts_key in sorted(enabled):
-                    label = next((l for k, l, _ in _get_effective_configurable_toolsets() if k == ts_key), ts_key)
+                    label = next((l for k, l, _ in CONFIGURABLE_TOOLSETS if k == ts_key), ts_key)
                     print(color(f"    ✓ {label}", Colors.GREEN))
             else:
                 print(color("    (none enabled)", Colors.DIM))
@@ -1036,11 +967,11 @@ def tools_command(args=None, first_install: bool = False, config: dict = None):
             removed = current_enabled - new_enabled
             if added:
                 for ts in sorted(added):
-                    label = next((l for k, l, _ in _get_effective_configurable_toolsets() if k == ts), ts)
+                    label = next((l for k, l, _ in CONFIGURABLE_TOOLSETS if k == ts), ts)
                     print(color(f"  + {label}", Colors.GREEN))
             if removed:
                 for ts in sorted(removed):
-                    label = next((l for k, l, _ in _get_effective_configurable_toolsets() if k == ts), ts)
+                    label = next((l for k, l, _ in CONFIGURABLE_TOOLSETS if k == ts), ts)
                     print(color(f"  - {label}", Colors.RED))
 
             # Walk through ALL selected tools that have provider options or
@@ -1056,7 +987,7 @@ def tools_command(args=None, first_install: bool = False, config: dict = None):
                 print()
                 print(color(f"  Configuring {len(to_configure)} tool(s):", Colors.YELLOW))
                 for ts_key in to_configure:
-                    label = next((l for k, l, _ in _get_effective_configurable_toolsets() if k == ts_key), ts_key)
+                    label = next((l for k, l, _ in CONFIGURABLE_TOOLSETS if k == ts_key), ts_key)
                     print(color(f"    • {label}", Colors.DIM))
                 print(color("  You can skip any tool you don't need right now.", Colors.DIM))
                 print()
@@ -1078,7 +1009,7 @@ def tools_command(args=None, first_install: bool = False, config: dict = None):
         pinfo = PLATFORMS[pkey]
         current = _get_platform_tools(config, pkey)
         count = len(current)
-        total = len(_get_effective_configurable_toolsets())
+        total = len(CONFIGURABLE_TOOLSETS)
         platform_choices.append(f"Configure {pinfo['label']}  ({count}/{total} enabled)")
         platform_keys.append(pkey)
 
@@ -1134,10 +1065,10 @@ def tools_command(args=None, first_install: bool = False, config: dict = None):
                     if added or removed:
                         print(color(f"  {pinfo_inner['label']}:", Colors.DIM))
                         for ts in sorted(added):
-                            label = next((l for k, l, _ in _get_effective_configurable_toolsets() if k == ts), ts)
+                            label = next((l for k, l, _ in CONFIGURABLE_TOOLSETS if k == ts), ts)
                             print(color(f"    + {label}", Colors.GREEN))
                         for ts in sorted(removed):
-                            label = next((l for k, l, _ in _get_effective_configurable_toolsets() if k == ts), ts)
+                            label = next((l for k, l, _ in CONFIGURABLE_TOOLSETS if k == ts), ts)
                             print(color(f"    - {label}", Colors.RED))
                     # Configure API keys for newly enabled tools
                     for ts_key in sorted(added):
@@ -1150,7 +1081,7 @@ def tools_command(args=None, first_install: bool = False, config: dict = None):
                 # Update choice labels
                 for ci, pk in enumerate(platform_keys):
                     new_count = len(_get_platform_tools(config, pk))
-                    total = len(_get_effective_configurable_toolsets())
+                    total = len(CONFIGURABLE_TOOLSETS)
                     platform_choices[ci] = f"Configure {PLATFORMS[pk]['label']}  ({new_count}/{total} enabled)"
             else:
                 print(color("  No changes", Colors.DIM))
@@ -1172,11 +1103,11 @@ def tools_command(args=None, first_install: bool = False, config: dict = None):
 
             if added:
                 for ts in sorted(added):
-                    label = next((l for k, l, _ in _get_effective_configurable_toolsets() if k == ts), ts)
+                    label = next((l for k, l, _ in CONFIGURABLE_TOOLSETS if k == ts), ts)
                     print(color(f"  + {label}", Colors.GREEN))
             if removed:
                 for ts in sorted(removed):
-                    label = next((l for k, l, _ in _get_effective_configurable_toolsets() if k == ts), ts)
+                    label = next((l for k, l, _ in CONFIGURABLE_TOOLSETS if k == ts), ts)
                     print(color(f"  - {label}", Colors.RED))
 
             # Configure newly enabled toolsets that need API keys
@@ -1195,7 +1126,7 @@ def tools_command(args=None, first_install: bool = False, config: dict = None):
 
         # Update the choice label with new count
         new_count = len(_get_platform_tools(config, pkey))
-        total = len(_get_effective_configurable_toolsets())
+        total = len(CONFIGURABLE_TOOLSETS)
         platform_choices[idx] = f"Configure {pinfo['label']}  ({new_count}/{total} enabled)"
 
     print()
@@ -1375,27 +1306,12 @@ def _apply_mcp_change(config: dict, targets: List[str], action: str) -> Set[str]
 
 def _print_tools_list(enabled_toolsets: set, mcp_servers: dict, platform: str = "cli"):
     """Print a summary of enabled/disabled toolsets and MCP tool filters."""
-    effective = _get_effective_configurable_toolsets()
-    builtin_keys = {ts_key for ts_key, _, _ in CONFIGURABLE_TOOLSETS}
-
     print(f"Built-in toolsets ({platform}):")
-    for ts_key, label, _ in effective:
-        if ts_key not in builtin_keys:
-            continue
+    for ts_key, label, _ in CONFIGURABLE_TOOLSETS:
         status = (color("✓ enabled", Colors.GREEN) if ts_key in enabled_toolsets
                   else color("✗ disabled", Colors.RED))
         print(f"  {status}  {ts_key}  {color(label, Colors.DIM)}")
 
-    # Plugin toolsets
-    plugin_entries = [(k, l) for k, l, _ in effective if k not in builtin_keys]
-    if plugin_entries:
-        print()
-        print(f"Plugin toolsets ({platform}):")
-        for ts_key, label in plugin_entries:
-            status = (color("✓ enabled", Colors.GREEN) if ts_key in enabled_toolsets
-                      else color("✗ disabled", Colors.RED))
-            print(f"  {status}  {ts_key}  {color(label, Colors.DIM)}")
-
     if mcp_servers:
         print()
         print("MCP servers:")
@@ -1434,7 +1350,7 @@ def tools_disable_enable_command(args):
     toolset_targets = [t for t in targets if ":" not in t]
     mcp_targets = [t for t in targets if ":" in t]
 
-    valid_toolsets = {ts_key for ts_key, _, _ in CONFIGURABLE_TOOLSETS} | _get_plugin_toolset_keys()
+    valid_toolsets = {ts_key for ts_key, _, _ in CONFIGURABLE_TOOLSETS}
     unknown_toolsets = [t for t in toolset_targets if t not in valid_toolsets]
     if unknown_toolsets:
         for name in unknown_toolsets:

hermes_state.py

@@ -181,11 +181,7 @@ class SessionDB:
                 ]
                 for name, column_type in new_columns:
                     try:
-                        # name and column_type come from the hardcoded tuple above,
-                        # not user input. Double-quote identifier escaping is applied
-                        # as defense-in-depth; SQLite DDL cannot be parameterized.
-                        safe_name = name.replace('"', '""')
-                        cursor.execute(f'ALTER TABLE sessions ADD COLUMN "{safe_name}" {column_type}')
+                        cursor.execute(f"ALTER TABLE sessions ADD COLUMN {name} {column_type}")
                     except sqlite3.OperationalError:
                         pass
                 cursor.execute("UPDATE schema_version SET version = 5")
@@ -855,25 +851,23 @@ class SessionDB:
 
     def session_count(self, source: str = None) -> int:
         """Count sessions, optionally filtered by source."""
-        with self._lock:
-            if source:
-                cursor = self._conn.execute(
-                    "SELECT COUNT(*) FROM sessions WHERE source = ?", (source,)
-                )
-            else:
-                cursor = self._conn.execute("SELECT COUNT(*) FROM sessions")
-            return cursor.fetchone()[0]
+        if source:
+            cursor = self._conn.execute(
+                "SELECT COUNT(*) FROM sessions WHERE source = ?", (source,)
+            )
+        else:
+            cursor = self._conn.execute("SELECT COUNT(*) FROM sessions")
+        return cursor.fetchone()[0]
 
     def message_count(self, session_id: str = None) -> int:
         """Count messages, optionally for a specific session."""
-        with self._lock:
-            if session_id:
-                cursor = self._conn.execute(
-                    "SELECT COUNT(*) FROM messages WHERE session_id = ?", (session_id,)
-                )
-            else:
-                cursor = self._conn.execute("SELECT COUNT(*) FROM messages")
-            return cursor.fetchone()[0]
+        if session_id:
+            cursor = self._conn.execute(
+                "SELECT COUNT(*) FROM messages WHERE session_id = ?", (session_id,)
+            )
+        else:
+            cursor = self._conn.execute("SELECT COUNT(*) FROM messages")
+        return cursor.fetchone()[0]
 
     # =========================================================================
     # Export and cleanup

honcho_integration/cli.py

@@ -10,30 +10,22 @@ import os
 import sys
 from pathlib import Path
 
-from honcho_integration.client import resolve_config_path, GLOBAL_CONFIG_PATH
-
+GLOBAL_CONFIG_PATH = Path.home() / ".honcho" / "config.json"
 HOST = "hermes"
 
 
-def _config_path() -> Path:
-    """Return the active Honcho config path (instance-local or global)."""
-    return resolve_config_path()
-
-
 def _read_config() -> dict:
-    path = _config_path()
-    if path.exists():
+    if GLOBAL_CONFIG_PATH.exists():
         try:
-            return json.loads(path.read_text(encoding="utf-8"))
+            return json.loads(GLOBAL_CONFIG_PATH.read_text(encoding="utf-8"))
         except Exception:
             pass
     return {}
 
 
-def _write_config(cfg: dict, path: Path | None = None) -> None:
-    path = path or _config_path()
-    path.parent.mkdir(parents=True, exist_ok=True)
-    path.write_text(
+def _write_config(cfg: dict) -> None:
+    GLOBAL_CONFIG_PATH.parent.mkdir(parents=True, exist_ok=True)
+    GLOBAL_CONFIG_PATH.write_text(
         json.dumps(cfg, indent=2, ensure_ascii=False) + "\n",
         encoding="utf-8",
     )
@@ -95,14 +87,9 @@ def cmd_setup(args) -> None:
     """Interactive Honcho setup wizard."""
     cfg = _read_config()
 
-    active_path = _config_path()
     print("\nHoncho memory setup\n" + "─" * 40)
     print("  Honcho gives Hermes persistent cross-session memory.")
-    if active_path != GLOBAL_CONFIG_PATH:
-        print(f"  Instance config: {active_path}")
-    else:
-        print("  Config is shared with other hosts at ~/.honcho/config.json")
-    print()
+    print("  Config is shared with other hosts at ~/.honcho/config.json\n")
 
     if not _ensure_sdk_installed():
         return
@@ -175,10 +162,10 @@ def cmd_setup(args) -> None:
         hermes_host["recallMode"] = new_recall
 
     # Session strategy
-    current_strat = hermes_host.get("sessionStrategy") or cfg.get("sessionStrategy", "per-directory")
+    current_strat = hermes_host.get("sessionStrategy") or cfg.get("sessionStrategy", "per-session")
     print(f"\n  Session strategy options:")
-    print("    per-directory — one session per working directory (default)")
-    print("    per-session   — new Honcho session each run, named by Hermes session ID")
+    print("    per-session   — new Honcho session each run, named by Hermes session ID (default)")
+    print("    per-directory — one session per working directory")
     print("    per-repo      — one session per git repository (uses repo root name)")
     print("    global        — single session across all directories")
     new_strat = _prompt("Session strategy", default=current_strat)
@@ -189,7 +176,7 @@ def cmd_setup(args) -> None:
     hermes_host.setdefault("saveMessages", True)
 
     _write_config(cfg)
-    print(f"\n  Config written to {active_path}")
+    print(f"\n  Config written to {GLOBAL_CONFIG_PATH}")
 
     # Test connection
     print("  Testing connection... ", end="", flush=True)
@@ -236,10 +223,8 @@ def cmd_status(args) -> None:
 
     cfg = _read_config()
 
-    active_path = _config_path()
-
     if not cfg:
-        print(f"  No Honcho config found at {active_path}")
+        print("  No Honcho config found at ~/.honcho/config.json")
         print("  Run 'hermes honcho setup' to configure.\n")
         return
 
@@ -258,7 +243,7 @@ def cmd_status(args) -> None:
     print(f"  API key:        {masked}")
     print(f"  Workspace:      {hcfg.workspace_id}")
     print(f"  Host:           {hcfg.host}")
-    print(f"  Config path:    {active_path}")
+    print(f"  Config path:    {GLOBAL_CONFIG_PATH}")
     print(f"  AI peer:        {hcfg.ai_peer}")
     print(f"  User peer:      {hcfg.peer_name or 'not set'}")
     print(f"  Session key:    {hcfg.resolve_session_name()}")
@@ -290,7 +275,7 @@ def cmd_sessions(args) -> None:
     if not sessions:
         print("  No session mappings configured.\n")
         print("  Add one with: hermes honcho map <session-name>")
-        print(f"  Or edit {_config_path()} directly.\n")
+        print("  Or edit ~/.honcho/config.json directly.\n")
         return
 
     cwd = os.getcwd()
@@ -376,7 +361,7 @@ def cmd_peer(args) -> None:
 
     if changed:
         _write_config(cfg)
-        print(f"  Saved to {_config_path()}\n")
+        print(f"  Saved to {GLOBAL_CONFIG_PATH}\n")
 
 
 def cmd_mode(args) -> None:
@@ -449,7 +434,7 @@ def cmd_tokens(args) -> None:
 
     if changed:
         _write_config(cfg)
-        print(f"  Saved to {_config_path()}\n")
+        print(f"  Saved to {GLOBAL_CONFIG_PATH}\n")
 
 
 def cmd_identity(args) -> None:

honcho_integration/client.py

@@ -1,9 +1,7 @@
 """Honcho client initialization and configuration.
 
-Resolution order for config file:
-  1. $HERMES_HOME/honcho.json  (instance-local, enables isolated Hermes instances)
-  2. ~/.honcho/config.json     (global, shared across all Honcho-enabled apps)
-  3. Environment variables     (HONCHO_API_KEY, HONCHO_ENVIRONMENT)
+Reads the global ~/.honcho/config.json when available, falling back
+to environment variables.
 
 Resolution order for host-specific settings:
   1. Explicit host block fields (always win)
@@ -29,24 +27,6 @@ GLOBAL_CONFIG_PATH = Path.home() / ".honcho" / "config.json"
 HOST = "hermes"
 
 
-def _get_hermes_home() -> Path:
-    """Get HERMES_HOME without importing hermes_cli (avoids circular deps)."""
-    return Path(os.getenv("HERMES_HOME", Path.home() / ".hermes"))
-
-
-def resolve_config_path() -> Path:
-    """Return the active Honcho config path.
-
-    Checks $HERMES_HOME/honcho.json first (instance-local), then falls back
-    to ~/.honcho/config.json (global).  Returns the global path if neither
-    exists (for first-time setup writes).
-    """
-    local_path = _get_hermes_home() / "honcho.json"
-    if local_path.exists():
-        return local_path
-    return GLOBAL_CONFIG_PATH
-
-
 _RECALL_MODE_ALIASES = {"auto": "hybrid"}
 _VALID_RECALL_MODES = {"hybrid", "context", "tools"}
 
@@ -127,27 +107,21 @@ class HonchoClientConfig:
     # "tools"   — Honcho tools only, no auto-injected context
     recall_mode: str = "hybrid"
     # Session resolution
-    session_strategy: str = "per-directory"
+    session_strategy: str = "per-session"
     session_peer_prefix: bool = False
     sessions: dict[str, str] = field(default_factory=dict)
     # Raw global config for anything else consumers need
     raw: dict[str, Any] = field(default_factory=dict)
-    # True when Honcho was explicitly configured for this host (hosts.hermes
-    # block exists or enabled was set explicitly), vs auto-enabled from a
-    # stray HONCHO_API_KEY env var.
-    explicitly_configured: bool = False
 
     @classmethod
     def from_env(cls, workspace_id: str = "hermes") -> HonchoClientConfig:
         """Create config from environment variables (fallback)."""
         api_key = os.environ.get("HONCHO_API_KEY")
-        base_url = os.environ.get("HONCHO_BASE_URL", "").strip() or None
         return cls(
             workspace_id=workspace_id,
             api_key=api_key,
             environment=os.environ.get("HONCHO_ENVIRONMENT", "production"),
-            base_url=base_url,
-            enabled=bool(api_key or base_url),
+            enabled=bool(api_key),
         )
 
     @classmethod
@@ -156,11 +130,11 @@ class HonchoClientConfig:
         host: str = HOST,
         config_path: Path | None = None,
     ) -> HonchoClientConfig:
-        """Create config from the resolved Honcho config path.
+        """Create config from ~/.honcho/config.json.
 
-        Resolution: $HERMES_HOME/honcho.json -> ~/.honcho/config.json -> env vars.
+        Falls back to environment variables if the file doesn't exist.
         """
-        path = config_path or resolve_config_path()
+        path = config_path or GLOBAL_CONFIG_PATH
         if not path.exists():
             logger.debug("No global Honcho config at %s, falling back to env", path)
             return cls.from_env()
@@ -172,9 +146,6 @@ class HonchoClientConfig:
             return cls.from_env()
 
         host_block = (raw.get("hosts") or {}).get(host, {})
-        # A hosts.hermes block or explicit enabled flag means the user
-        # intentionally configured Honcho for this host.
-        _explicitly_configured = bool(host_block) or raw.get("enabled") is True
 
         # Explicit host block fields win, then flat/global, then defaults
         workspace = (
@@ -200,14 +171,8 @@ class HonchoClientConfig:
             or raw.get("environment", "production")
         )
 
-        base_url = (
-            raw.get("baseUrl")
-            or os.environ.get("HONCHO_BASE_URL", "").strip()
-            or None
-        )
-
-        # Auto-enable when API key or base_url is present (unless explicitly disabled)
-        # Host-level enabled wins, then root-level, then auto-enable if key/url exists.
+        # Auto-enable when API key is present (unless explicitly disabled)
+        # Host-level enabled wins, then root-level, then auto-enable if key exists.
         host_enabled = host_block.get("enabled")
         root_enabled = raw.get("enabled")
         if host_enabled is not None:
@@ -215,8 +180,8 @@ class HonchoClientConfig:
         elif root_enabled is not None:
             enabled = root_enabled
         else:
-            # Not explicitly set anywhere -> auto-enable if API key or base_url exists
-            enabled = bool(api_key or base_url)
+            # Not explicitly set anywhere -> auto-enable if API key exists
+            enabled = bool(api_key)
 
         # write_frequency: accept int or string
         raw_wf = (
@@ -236,7 +201,7 @@ class HonchoClientConfig:
         # sessionStrategy / sessionPeerPrefix: host first, root fallback
         session_strategy = (
             host_block.get("sessionStrategy")
-            or raw.get("sessionStrategy", "per-directory")
+            or raw.get("sessionStrategy", "per-session")
         )
         host_prefix = host_block.get("sessionPeerPrefix")
         session_peer_prefix = (
@@ -249,7 +214,6 @@ class HonchoClientConfig:
             workspace_id=workspace,
             api_key=api_key,
             environment=environment,
-            base_url=base_url,
             peer_name=host_block.get("peerName") or raw.get("peerName"),
             ai_peer=ai_peer,
             linked_hosts=linked_hosts,
@@ -280,7 +244,6 @@ class HonchoClientConfig:
             session_peer_prefix=session_peer_prefix,
             sessions=raw.get("sessions", {}),
             raw=raw,
-            explicitly_configured=_explicitly_configured,
         )
 
     @staticmethod
@@ -346,7 +309,7 @@ class HonchoClientConfig:
                 return f"{self.peer_name}-{base}"
             return base
 
-        # per-directory: one Honcho session per working directory (default)
+        # per-directory: one Honcho session per working directory
         if self.session_strategy in ("per-directory", "per-session"):
             base = Path(cwd).name
             if self.session_peer_prefix and self.peer_name:
@@ -385,12 +348,11 @@ def get_honcho_client(config: HonchoClientConfig | None = None) -> Honcho:
     if config is None:
         config = HonchoClientConfig.from_global_config()
 
-    if not config.api_key and not config.base_url:
+    if not config.api_key:
         raise ValueError(
             "Honcho API key not found. "
             "Get your API key at https://app.honcho.dev, "
-            "then run 'hermes honcho setup' or set HONCHO_API_KEY. "
-            "For local instances, set HONCHO_BASE_URL instead."
+            "then run 'hermes honcho setup' or set HONCHO_API_KEY."
         )
 
     try:

mini_swe_runner.py

@@ -1,13 +1,13 @@
 #!/usr/bin/env python3
 """
-SWE Runner with Hermes Trajectory Format
+Mini-SWE-Agent Runner with Hermes Trajectory Format
 
-A runner that uses Hermes-Agent's built-in execution environments
-(local, docker, modal) and outputs trajectories in the Hermes-Agent format
+This module provides a runner that uses mini-swe-agent's execution environments
+(local, docker, modal) but outputs trajectories in the Hermes-Agent format
 compatible with batch_runner.py and trajectory_compressor.py.
 
 Features:
-- Uses Hermes-Agent's Docker, Modal, or Local environments for command execution
+- Uses mini-swe-agent's Docker, Modal, or Local environments for command execution
 - Outputs trajectories in Hermes format (from/value pairs with <tool_call>/<tool_response> XML)
 - Compatible with the trajectory compression pipeline
 - Supports batch processing from JSONL prompt files
@@ -42,7 +42,11 @@ from dotenv import load_dotenv
 # Load environment variables
 load_dotenv()
 
+# Add mini-swe-agent to path if not installed. In git worktrees the populated
+# submodule may live in the main checkout rather than the worktree itself.
+from minisweagent_path import ensure_minisweagent_on_path
 
+ensure_minisweagent_on_path(Path(__file__).resolve().parent)
 
 
 # ============================================================================
@@ -106,7 +110,7 @@ def create_environment(
     **kwargs
 ):
     """
-    Create an execution environment using Hermes-Agent's built-in backends.
+    Create an execution environment from mini-swe-agent.
     
     Args:
         env_type: One of "local", "docker", "modal"
@@ -116,19 +120,19 @@ def create_environment(
         **kwargs: Additional environment-specific options
         
     Returns:
-        Environment instance with execute() and cleanup() methods
+        Environment instance with execute() method
     """
     if env_type == "local":
-        from tools.environments.local import LocalEnvironment
+        from minisweagent.environments.local import LocalEnvironment
         return LocalEnvironment(cwd=cwd, timeout=timeout)
     
     elif env_type == "docker":
-        from tools.environments.docker import DockerEnvironment
+        from minisweagent.environments.docker import DockerEnvironment
         return DockerEnvironment(image=image, cwd=cwd, timeout=timeout, **kwargs)
     
     elif env_type == "modal":
-        from tools.environments.modal import ModalEnvironment
-        return ModalEnvironment(image=image, cwd=cwd, timeout=timeout, **kwargs)
+        from minisweagent.environments.extra.swerex_modal import SwerexModalEnvironment
+        return SwerexModalEnvironment(image=image, cwd=cwd, timeout=timeout, **kwargs)
     
     else:
         raise ValueError(f"Unknown environment type: {env_type}. Use 'local', 'docker', or 'modal'")
@@ -140,8 +144,8 @@ def create_environment(
 
 class MiniSWERunner:
     """
-    Agent runner that uses Hermes-Agent's built-in execution environments
-    and outputs trajectories in Hermes-Agent format.
+    Agent runner that uses mini-swe-agent environments but outputs
+    trajectories in Hermes-Agent format.
     """
     
     def __init__(
@@ -335,7 +339,6 @@ class MiniSWERunner:
                     
                     # Add tool calls in XML format
                     for tool_call in msg["tool_calls"]:
-                        if not tool_call or not isinstance(tool_call, dict): continue
                         try:
                             arguments = json.loads(tool_call["function"]["arguments"]) \
                                 if isinstance(tool_call["function"]["arguments"], str) \
@@ -614,7 +617,7 @@ Complete the user's task step by step."""
 def main(
     task: str = None,
     prompts_file: str = None,
-    output_file: str = "swe-runner-test1.jsonl",
+    output_file: str = "mini-swe-agent-test1.jsonl",
     model: str = "claude-sonnet-4-20250514",
     base_url: str = None,
     api_key: str = None,
@@ -626,7 +629,7 @@ def main(
     verbose: bool = False,
 ):
     """
-    Run SWE tasks with Hermes trajectory format output.
+    Run mini-swe-agent tasks with Hermes trajectory format output.
     
     Args:
         task: Single task to run (use this OR prompts_file)

minisweagent_path.py

@@ -0,0 +1,92 @@
+"""Helpers for locating the mini-swe-agent source tree.
+
+Hermes often runs from git worktrees. In that layout the worktree root may have
+an empty ``mini-swe-agent/`` placeholder while the real populated submodule
+lives under the main checkout that owns the shared ``.git`` directory.
+
+These helpers locate a usable ``mini-swe-agent/src`` directory and optionally
+prepend it to ``sys.path`` so imports like ``import minisweagent`` work from
+both normal checkouts and worktrees.
+"""
+
+from __future__ import annotations
+
+import importlib.util
+import sys
+from pathlib import Path
+from typing import Optional
+
+
+def _read_gitdir(repo_root: Path) -> Optional[Path]:
+    """Resolve the gitdir referenced by ``repo_root/.git`` when it is a file."""
+    git_marker = repo_root / ".git"
+    if not git_marker.is_file():
+        return None
+
+    try:
+        raw = git_marker.read_text(encoding="utf-8").strip()
+    except OSError:
+        return None
+
+    prefix = "gitdir:"
+    if not raw.lower().startswith(prefix):
+        return None
+
+    target = raw[len(prefix):].strip()
+    gitdir = Path(target)
+    if not gitdir.is_absolute():
+        gitdir = (repo_root / gitdir).resolve()
+    else:
+        gitdir = gitdir.resolve()
+    return gitdir
+
+
+def discover_minisweagent_src(repo_root: Optional[Path] = None) -> Optional[Path]:
+    """Return the best available ``mini-swe-agent/src`` path, if any.
+
+    Search order:
+    1. Current checkout/worktree root
+    2. Main checkout that owns the shared ``.git`` directory (for worktrees)
+    """
+    repo_root = (repo_root or Path(__file__).resolve().parent).resolve()
+
+    candidates: list[Path] = [repo_root / "mini-swe-agent" / "src"]
+
+    gitdir = _read_gitdir(repo_root)
+    if gitdir is not None:
+        # Worktree layout: <main>/.git/worktrees/<name>
+        if len(gitdir.parents) >= 3 and gitdir.parent.name == "worktrees":
+            candidates.append(gitdir.parents[2] / "mini-swe-agent" / "src")
+        # Direct checkout with .git file pointing elsewhere
+        elif gitdir.name == ".git":
+            candidates.append(gitdir.parent / "mini-swe-agent" / "src")
+
+    seen = set()
+    for candidate in candidates:
+        candidate = candidate.resolve()
+        if candidate in seen:
+            continue
+        seen.add(candidate)
+        if candidate.exists() and candidate.is_dir():
+            return candidate
+
+    return None
+
+
+def ensure_minisweagent_on_path(repo_root: Optional[Path] = None) -> Optional[Path]:
+    """Ensure ``minisweagent`` is importable by prepending its src dir to sys.path.
+
+    Returns the inserted/discovered path, or ``None`` if the package is already
+    importable or no local source tree could be found.
+    """
+    if importlib.util.find_spec("minisweagent") is not None:
+        return None
+
+    src = discover_minisweagent_src(repo_root)
+    if src is None:
+        return None
+
+    src_str = str(src)
+    if src_str not in sys.path:
+        sys.path.insert(0, src_str)
+    return src

model_tools.py

@@ -22,8 +22,8 @@ Public API (signatures preserved from the original 2,400-line version):
 
 import json
 import asyncio
+import os
 import logging
-import threading
 from typing import Dict, Any, List, Optional, Tuple
 
 from tools.registry import registry
@@ -36,48 +36,6 @@ logger = logging.getLogger(__name__)
 # Async Bridging  (single source of truth -- used by registry.dispatch too)
 # =============================================================================
 
-_tool_loop = None          # persistent loop for the main (CLI) thread
-_tool_loop_lock = threading.Lock()
-_worker_thread_local = threading.local()  # per-worker-thread persistent loops
-
-
-def _get_tool_loop():
-    """Return a long-lived event loop for running async tool handlers.
-
-    Using a persistent loop (instead of asyncio.run() which creates and
-    *closes* a fresh loop every time) prevents "Event loop is closed"
-    errors that occur when cached httpx/AsyncOpenAI clients attempt to
-    close their transport on a dead loop during garbage collection.
-    """
-    global _tool_loop
-    with _tool_loop_lock:
-        if _tool_loop is None or _tool_loop.is_closed():
-            _tool_loop = asyncio.new_event_loop()
-        return _tool_loop
-
-
-def _get_worker_loop():
-    """Return a persistent event loop for the current worker thread.
-
-    Each worker thread (e.g., delegate_task's ThreadPoolExecutor threads)
-    gets its own long-lived loop stored in thread-local storage.  This
-    prevents the "Event loop is closed" errors that occurred when
-    asyncio.run() was used per-call: asyncio.run() creates a loop, runs
-    the coroutine, then *closes* the loop — but cached httpx/AsyncOpenAI
-    clients remain bound to that now-dead loop and raise RuntimeError
-    during garbage collection or subsequent use.
-
-    By keeping the loop alive for the thread's lifetime, cached clients
-    stay valid and their cleanup runs on a live loop.
-    """
-    loop = getattr(_worker_thread_local, 'loop', None)
-    if loop is None or loop.is_closed():
-        loop = asyncio.new_event_loop()
-        asyncio.set_event_loop(loop)
-        _worker_thread_local.loop = loop
-    return loop
-
-
 def _run_async(coro):
     """Run an async coroutine from a sync context.
 
@@ -86,15 +44,6 @@ def _run_async(coro):
     disposable thread so asyncio.run() can create its own loop without
     conflicting.
 
-    For the common CLI path (no running loop), we use a persistent event
-    loop so that cached async clients (httpx / AsyncOpenAI) remain bound
-    to a live loop and don't trigger "Event loop is closed" on GC.
-
-    When called from a worker thread (parallel tool execution), we use a
-    per-thread persistent loop to avoid both contention with the main
-    thread's shared loop AND the "Event loop is closed" errors caused by
-    asyncio.run()'s create-and-destroy lifecycle.
-
     This is the single source of truth for sync->async bridging in tool
     handlers. The RL paths (agent_loop.py, tool_context.py) also provide
     outer thread-pool wrapping as defense-in-depth, but each handler is
@@ -106,23 +55,11 @@ def _run_async(coro):
         loop = None
 
     if loop and loop.is_running():
-        # Inside an async context (gateway, RL env) — run in a fresh thread.
         import concurrent.futures
         with concurrent.futures.ThreadPoolExecutor(max_workers=1) as pool:
             future = pool.submit(asyncio.run, coro)
             return future.result(timeout=300)
-
-    # If we're on a worker thread (e.g., parallel tool execution in
-    # delegate_task), use a per-thread persistent loop.  This avoids
-    # contention with the main thread's shared loop while keeping cached
-    # httpx/AsyncOpenAI clients bound to a live loop for the thread's
-    # lifetime — preventing "Event loop is closed" on GC cleanup.
-    if threading.current_thread() is not threading.main_thread():
-        worker_loop = _get_worker_loop()
-        return worker_loop.run_until_complete(coro)
-
-    tool_loop = _get_tool_loop()
-    return tool_loop.run_until_complete(coro)
+    return asyncio.run(coro)
 
 
 # =============================================================================
@@ -292,54 +229,31 @@ def get_tool_definitions(
         for ts_name in get_all_toolsets():
             tools_to_include.update(resolve_toolset(ts_name))
 
-    # Plugin-registered tools are now resolved through the normal toolset
-    # path — validate_toolset() / resolve_toolset() / get_all_toolsets()
-    # all check the tool registry for plugin-provided toolsets.  No bypass
-    # needed; plugins respect enabled_toolsets / disabled_toolsets like any
-    # other toolset.
+    # Always include plugin-registered tools — they bypass the toolset filter
+    # because their toolsets are dynamic (created at plugin load time).
+    try:
+        from hermes_cli.plugins import get_plugin_tool_names
+        plugin_tools = get_plugin_tool_names()
+        if plugin_tools:
+            tools_to_include.update(plugin_tools)
+    except Exception:
+        pass
 
     # Ask the registry for schemas (only returns tools whose check_fn passes)
     filtered_tools = registry.get_definitions(tools_to_include, quiet=quiet_mode)
 
-    # The set of tool names that actually passed check_fn filtering.
-    # Use this (not tools_to_include) for any downstream schema that references
-    # other tools by name — otherwise the model sees tools mentioned in
-    # descriptions that don't actually exist, and hallucinates calls to them.
-    available_tool_names = {t["function"]["name"] for t in filtered_tools}
-
     # Rebuild execute_code schema to only list sandbox tools that are actually
-    # available.  Without this, the model sees "web_search is available in
-    # execute_code" even when the API key isn't configured or the toolset is
-    # disabled (#560-discord).
-    if "execute_code" in available_tool_names:
+    # enabled.  Without this, the model sees "web_search is available in
+    # execute_code" even when the user disabled the web toolset (#560-discord).
+    if "execute_code" in tools_to_include:
         from tools.code_execution_tool import SANDBOX_ALLOWED_TOOLS, build_execute_code_schema
-        sandbox_enabled = SANDBOX_ALLOWED_TOOLS & available_tool_names
+        sandbox_enabled = SANDBOX_ALLOWED_TOOLS & tools_to_include
         dynamic_schema = build_execute_code_schema(sandbox_enabled)
         for i, td in enumerate(filtered_tools):
             if td.get("function", {}).get("name") == "execute_code":
                 filtered_tools[i] = {"type": "function", "function": dynamic_schema}
                 break
 
-    # Strip web tool cross-references from browser_navigate description when
-    # web_search / web_extract are not available.  The static schema says
-    # "prefer web_search or web_extract" which causes the model to hallucinate
-    # those tools when they're missing.
-    if "browser_navigate" in available_tool_names:
-        web_tools_available = {"web_search", "web_extract"} & available_tool_names
-        if not web_tools_available:
-            for i, td in enumerate(filtered_tools):
-                if td.get("function", {}).get("name") == "browser_navigate":
-                    desc = td["function"].get("description", "")
-                    desc = desc.replace(
-                        " For simple information retrieval, prefer web_search or web_extract (faster, cheaper).",
-                        "",
-                    )
-                    filtered_tools[i] = {
-                        "type": "function",
-                        "function": {**td["function"], "description": desc},
-                    }
-                    break
-
     if not quiet_mode:
         if filtered_tools:
             tool_names = [t["function"]["name"] for t in filtered_tools]

nix/checks.nix

@@ -1,376 +0,0 @@
-# nix/checks.nix — Build-time verification tests
-#
-# Checks are Linux-only: the full Python venv (via uv2nix) includes
-# transitive deps like onnxruntime that lack compatible wheels on
-# aarch64-darwin. The package and devShell still work on macOS.
-{ inputs, ... }: {
-  perSystem = { pkgs, system, lib, ... }:
-    let
-      hermes-agent = inputs.self.packages.${system}.default;
-      hermesVenv = pkgs.callPackage ./python.nix {
-        inherit (inputs) uv2nix pyproject-nix pyproject-build-systems;
-      };
-
-      configMergeScript = pkgs.callPackage ./configMergeScript.nix { };
-    in {
-      checks = lib.optionalAttrs pkgs.stdenv.hostPlatform.isLinux {
-        # Verify binaries exist and are executable
-        package-contents = pkgs.runCommand "hermes-package-contents" { } ''
-          set -e
-          echo "=== Checking binaries ==="
-          test -x ${hermes-agent}/bin/hermes || (echo "FAIL: hermes binary missing"; exit 1)
-          test -x ${hermes-agent}/bin/hermes-agent || (echo "FAIL: hermes-agent binary missing"; exit 1)
-          echo "PASS: All binaries present"
-
-          echo "=== Checking version ==="
-          ${hermes-agent}/bin/hermes version 2>&1 | grep -qi "hermes" || (echo "FAIL: version check"; exit 1)
-          echo "PASS: Version check"
-
-          echo "=== All checks passed ==="
-          mkdir -p $out
-          echo "ok" > $out/result
-        '';
-
-        # Verify every pyproject.toml [project.scripts] entry has a wrapped binary
-        entry-points-sync = pkgs.runCommand "hermes-entry-points-sync" { } ''
-          set -e
-          echo "=== Checking entry points match pyproject.toml [project.scripts] ==="
-          for bin in hermes hermes-agent hermes-acp; do
-            test -x ${hermes-agent}/bin/$bin || (echo "FAIL: $bin binary missing from Nix package"; exit 1)
-            echo "PASS: $bin present"
-          done
-
-          mkdir -p $out
-          echo "ok" > $out/result
-        '';
-
-        # Verify CLI subcommands are accessible
-        cli-commands = pkgs.runCommand "hermes-cli-commands" { } ''
-          set -e
-          export HOME=$(mktemp -d)
-
-          echo "=== Checking hermes --help ==="
-          ${hermes-agent}/bin/hermes --help 2>&1 | grep -q "gateway" || (echo "FAIL: gateway subcommand missing"; exit 1)
-          ${hermes-agent}/bin/hermes --help 2>&1 | grep -q "config" || (echo "FAIL: config subcommand missing"; exit 1)
-          echo "PASS: All subcommands accessible"
-
-          echo "=== All CLI checks passed ==="
-          mkdir -p $out
-          echo "ok" > $out/result
-        '';
-
-        # Verify bundled skills are present in the package
-        bundled-skills = pkgs.runCommand "hermes-bundled-skills" { } ''
-          set -e
-          echo "=== Checking bundled skills ==="
-          test -d ${hermes-agent}/share/hermes-agent/skills || (echo "FAIL: skills directory missing"; exit 1)
-          echo "PASS: skills directory exists"
-
-          SKILL_COUNT=$(find ${hermes-agent}/share/hermes-agent/skills -name "SKILL.md" | wc -l)
-          test "$SKILL_COUNT" -gt 0 || (echo "FAIL: no SKILL.md files found in skills directory"; exit 1)
-          echo "PASS: $SKILL_COUNT bundled skills found"
-
-          grep -q "HERMES_BUNDLED_SKILLS" ${hermes-agent}/bin/hermes || \
-            (echo "FAIL: HERMES_BUNDLED_SKILLS not in wrapper"; exit 1)
-          echo "PASS: HERMES_BUNDLED_SKILLS set in wrapper"
-
-          echo "=== All bundled skills checks passed ==="
-          mkdir -p $out
-          echo "ok" > $out/result
-        '';
-
-        # Verify HERMES_MANAGED guard works on all mutation commands
-        managed-guard = pkgs.runCommand "hermes-managed-guard" { } ''
-          set -e
-          export HOME=$(mktemp -d)
-
-          check_blocked() {
-            local label="$1"
-            shift
-            OUTPUT=$(HERMES_MANAGED=true "$@" 2>&1 || true)
-            echo "$OUTPUT" | grep -q "managed by NixOS" || (echo "FAIL: $label not guarded"; echo "$OUTPUT"; exit 1)
-            echo "PASS: $label blocked in managed mode"
-          }
-
-          echo "=== Checking HERMES_MANAGED guards ==="
-          check_blocked "config set" ${hermes-agent}/bin/hermes config set model foo
-          check_blocked "config edit" ${hermes-agent}/bin/hermes config edit
-
-          echo "=== All guard checks passed ==="
-          mkdir -p $out
-          echo "ok" > $out/result
-        '';
-
-        # ── Config drift detection ────────────────────────────────────────
-        # Extracts leaf key paths from Python's DEFAULT_CONFIG and compares
-        # against the committed reference in nix/config-keys.json.
-        config-drift = pkgs.runCommand "hermes-config-drift" {
-          nativeBuildInputs = [ pkgs.jq ];
-          referenceKeys = ./config-keys.json;
-        } ''
-          set -e
-          export HOME=$(mktemp -d)
-
-          echo "=== Extracting DEFAULT_CONFIG leaf keys from Python ==="
-          ${hermesVenv}/bin/python3 -c '
-import json, sys
-from hermes_cli.config import DEFAULT_CONFIG
-
-def leaf_paths(d, prefix=""):
-    paths = []
-    for k, v in sorted(d.items()):
-        path = f"{prefix}.{k}" if prefix else k
-        if isinstance(v, dict) and v:
-            paths.extend(leaf_paths(v, path))
-        else:
-            paths.append(path)
-    return paths
-
-json.dump(sorted(leaf_paths(DEFAULT_CONFIG)), sys.stdout)
-' > /tmp/actual-keys.json
-
-          echo "=== Comparing against reference ==="
-          jq -r '.[]' $referenceKeys | sort > /tmp/reference.txt
-          jq -r '.[]' /tmp/actual-keys.json | sort > /tmp/actual.txt
-
-          ADDED=$(comm -23 /tmp/actual.txt /tmp/reference.txt || true)
-          REMOVED=$(comm -13 /tmp/actual.txt /tmp/reference.txt || true)
-          FAILED=false
-
-          if [ -n "$ADDED" ]; then
-            echo "FAIL: New keys in DEFAULT_CONFIG not in nix/config-keys.json:"
-            echo "$ADDED" | sed 's/^/  + /'
-            FAILED=true
-          fi
-          if [ -n "$REMOVED" ]; then
-            echo "FAIL: Keys in nix/config-keys.json missing from DEFAULT_CONFIG:"
-            echo "$REMOVED" | sed 's/^/  - /'
-            FAILED=true
-          fi
-
-          if [ "$FAILED" = "true" ]; then
-            exit 1
-          fi
-
-          ACTUAL_COUNT=$(wc -l < /tmp/actual.txt)
-          echo "PASS: All $ACTUAL_COUNT config keys match reference"
-          mkdir -p $out
-          echo "ok" > $out/result
-        '';
-
-        # ── Config merge + round-trip test ────────────────────────────────
-        # Tests the merge script (Nix activation behavior) across 7
-        # scenarios, then verifies Python's load_config() reads correctly.
-        config-roundtrip = let
-          # Nix settings used across scenarios
-          nixSettings = pkgs.writeText "nix-settings.json" (builtins.toJSON {
-            model = "test/nix-model";
-            toolsets = ["nix-toolset"];
-            terminal = { backend = "docker"; timeout = 999; };
-            mcp_servers = {
-              nix-server = { command = "echo"; args = ["nix"]; };
-            };
-          });
-
-          # Pre-built YAML fixtures for each scenario
-          fixtureB = pkgs.writeText "fixture-b.yaml" ''
-            model: "old-model"
-            mcp_servers:
-              old-server:
-                url: "http://old"
-          '';
-          fixtureC = pkgs.writeText "fixture-c.yaml" ''
-            skills:
-              disabled:
-                - skill-a
-                - skill-b
-            session_reset:
-              mode: idle
-              idle_minutes: 30
-            streaming:
-              enabled: true
-            fallback_model:
-              provider: openrouter
-              model: test-fallback
-          '';
-          fixtureD = pkgs.writeText "fixture-d.yaml" ''
-            model: "user-model"
-            skills:
-              disabled:
-                - skill-x
-            streaming:
-              enabled: true
-              transport: edit
-          '';
-          fixtureE = pkgs.writeText "fixture-e.yaml" ''
-            mcp_servers:
-              user-server:
-                url: "http://user-mcp"
-              nix-server:
-                command: "old-cmd"
-                args: ["old"]
-          '';
-          fixtureF = pkgs.writeText "fixture-f.yaml" ''
-            terminal:
-              cwd: "/user/path"
-              custom_key: "preserved"
-              env_passthrough:
-                - USER_VAR
-          '';
-
-        in pkgs.runCommand "hermes-config-roundtrip" {
-          nativeBuildInputs = [ pkgs.jq ];
-        } ''
-          set -e
-          export HOME=$(mktemp -d)
-          ERRORS=""
-
-          fail() { ERRORS="$ERRORS\nFAIL: $1"; }
-
-          # Helper: run merge then load with Python, output merged JSON
-          merge_and_load() {
-            local hermes_home="$1"
-            export HERMES_HOME="$hermes_home"
-            ${configMergeScript} ${nixSettings} "$hermes_home/config.yaml"
-            ${hermesVenv}/bin/python3 -c '
-import json, sys
-from hermes_cli.config import load_config
-json.dump(load_config(), sys.stdout, default=str)
-'
-          }
-
-          # ═══════════════════════════════════════════════════════════════
-          # Scenario A: Fresh install — no existing config.yaml
-          # ═══════════════════════════════════════════════════════════════
-          echo "=== Scenario A: Fresh install ==="
-          A_HOME=$(mktemp -d)
-          A_CONFIG=$(merge_and_load "$A_HOME")
-
-          echo "$A_CONFIG" | jq -e '.model == "test/nix-model"' > /dev/null \
-            || fail "A: model not set from Nix"
-          echo "$A_CONFIG" | jq -e '.mcp_servers."nix-server".command == "echo"' > /dev/null \
-            || fail "A: MCP nix-server missing"
-          echo "PASS: Scenario A"
-
-          # ═══════════════════════════════════════════════════════════════
-          # Scenario B: Nix keys override existing values
-          # ═══════════════════════════════════════════════════════════════
-          echo "=== Scenario B: Nix overrides ==="
-          B_HOME=$(mktemp -d)
-          install -m 0644 ${fixtureB} "$B_HOME/config.yaml"
-          B_CONFIG=$(merge_and_load "$B_HOME")
-
-          echo "$B_CONFIG" | jq -e '.model == "test/nix-model"' > /dev/null \
-            || fail "B: Nix model did not override"
-          echo "PASS: Scenario B"
-
-          # ═══════════════════════════════════════════════════════════════
-          # Scenario C: User-only keys preserved
-          # ═══════════════════════════════════════════════════════════════
-          echo "=== Scenario C: User keys preserved ==="
-          C_HOME=$(mktemp -d)
-          install -m 0644 ${fixtureC} "$C_HOME/config.yaml"
-          C_CONFIG=$(merge_and_load "$C_HOME")
-
-          echo "$C_CONFIG" | jq -e '.skills.disabled == ["skill-a", "skill-b"]' > /dev/null \
-            || fail "C: skills.disabled not preserved"
-          echo "$C_CONFIG" | jq -e '.session_reset.mode == "idle"' > /dev/null \
-            || fail "C: session_reset.mode not preserved"
-          echo "$C_CONFIG" | jq -e '.session_reset.idle_minutes == 30' > /dev/null \
-            || fail "C: session_reset.idle_minutes not preserved"
-          echo "$C_CONFIG" | jq -e '.streaming.enabled == true' > /dev/null \
-            || fail "C: streaming.enabled not preserved"
-          echo "$C_CONFIG" | jq -e '.fallback_model.provider == "openrouter"' > /dev/null \
-            || fail "C: fallback_model not preserved"
-          echo "PASS: Scenario C"
-
-          # ═══════════════════════════════════════════════════════════════
-          # Scenario D: Mixed — Nix wins for its keys, user keys preserved
-          # ═══════════════════════════════════════════════════════════════
-          echo "=== Scenario D: Mixed merge ==="
-          D_HOME=$(mktemp -d)
-          install -m 0644 ${fixtureD} "$D_HOME/config.yaml"
-          D_CONFIG=$(merge_and_load "$D_HOME")
-
-          echo "$D_CONFIG" | jq -e '.model == "test/nix-model"' > /dev/null \
-            || fail "D: Nix model did not override user model"
-          echo "$D_CONFIG" | jq -e '.skills.disabled == ["skill-x"]' > /dev/null \
-            || fail "D: user skills not preserved"
-          echo "$D_CONFIG" | jq -e '.streaming.enabled == true' > /dev/null \
-            || fail "D: user streaming not preserved"
-          echo "PASS: Scenario D"
-
-          # ═══════════════════════════════════════════════════════════════
-          # Scenario E: MCP additive merge
-          # ═══════════════════════════════════════════════════════════════
-          echo "=== Scenario E: MCP additive merge ==="
-          E_HOME=$(mktemp -d)
-          install -m 0644 ${fixtureE} "$E_HOME/config.yaml"
-          E_CONFIG=$(merge_and_load "$E_HOME")
-
-          echo "$E_CONFIG" | jq -e '.mcp_servers."user-server".url == "http://user-mcp"' > /dev/null \
-            || fail "E: user MCP server not preserved"
-          echo "$E_CONFIG" | jq -e '.mcp_servers."nix-server".command == "echo"' > /dev/null \
-            || fail "E: Nix MCP server did not override same-name user server"
-          echo "$E_CONFIG" | jq -e '.mcp_servers."nix-server".args == ["nix"]' > /dev/null \
-            || fail "E: Nix MCP server args wrong"
-          echo "PASS: Scenario E"
-
-          # ═══════════════════════════════════════════════════════════════
-          # Scenario F: Nested deep merge
-          # ═══════════════════════════════════════════════════════════════
-          echo "=== Scenario F: Nested deep merge ==="
-          F_HOME=$(mktemp -d)
-          install -m 0644 ${fixtureF} "$F_HOME/config.yaml"
-          F_CONFIG=$(merge_and_load "$F_HOME")
-
-          echo "$F_CONFIG" | jq -e '.terminal.backend == "docker"' > /dev/null \
-            || fail "F: Nix terminal.backend did not override"
-          echo "$F_CONFIG" | jq -e '.terminal.timeout == 999' > /dev/null \
-            || fail "F: Nix terminal.timeout did not override"
-          echo "$F_CONFIG" | jq -e '.terminal.custom_key == "preserved"' > /dev/null \
-            || fail "F: terminal.custom_key not preserved"
-          echo "$F_CONFIG" | jq -e '.terminal.cwd == "/user/path"' > /dev/null \
-            || fail "F: user terminal.cwd not preserved when Nix does not set it"
-          echo "$F_CONFIG" | jq -e '.terminal.env_passthrough == ["USER_VAR"]' > /dev/null \
-            || fail "F: user terminal.env_passthrough not preserved"
-          echo "PASS: Scenario F"
-
-          # ═══════════════════════════════════════════════════════════════
-          # Scenario G: Idempotency — merging twice yields the same result
-          # ═══════════════════════════════════════════════════════════════
-          echo "=== Scenario G: Idempotency ==="
-          G_HOME=$(mktemp -d)
-          install -m 0644 ${fixtureD} "$G_HOME/config.yaml"
-          ${configMergeScript} ${nixSettings} "$G_HOME/config.yaml"
-          FIRST=$(cat "$G_HOME/config.yaml")
-          ${configMergeScript} ${nixSettings} "$G_HOME/config.yaml"
-          SECOND=$(cat "$G_HOME/config.yaml")
-
-          if [ "$FIRST" != "$SECOND" ]; then
-            fail "G: second merge produced different output"
-            echo "--- first ---"
-            echo "$FIRST"
-            echo "--- second ---"
-            echo "$SECOND"
-          fi
-          echo "PASS: Scenario G"
-
-          # ═══════════════════════════════════════════════════════════════
-          # Report
-          # ═══════════════════════════════════════════════════════════════
-          if [ -n "$ERRORS" ]; then
-            echo ""
-            echo "FAILURES:"
-            echo -e "$ERRORS"
-            exit 1
-          fi
-
-          echo ""
-          echo "=== All 7 merge scenarios passed ==="
-          mkdir -p $out
-          echo "ok" > $out/result
-        '';
-      };
-    };
-}

nix/config-keys.json

@@ -1,129 +0,0 @@
-[
-  "_config_version",
-  "agent.max_turns",
-  "approvals.mode",
-  "auxiliary.approval.api_key",
-  "auxiliary.approval.base_url",
-  "auxiliary.approval.model",
-  "auxiliary.approval.provider",
-  "auxiliary.compression.api_key",
-  "auxiliary.compression.base_url",
-  "auxiliary.compression.model",
-  "auxiliary.compression.provider",
-  "auxiliary.flush_memories.api_key",
-  "auxiliary.flush_memories.base_url",
-  "auxiliary.flush_memories.model",
-  "auxiliary.flush_memories.provider",
-  "auxiliary.mcp.api_key",
-  "auxiliary.mcp.base_url",
-  "auxiliary.mcp.model",
-  "auxiliary.mcp.provider",
-  "auxiliary.session_search.api_key",
-  "auxiliary.session_search.base_url",
-  "auxiliary.session_search.model",
-  "auxiliary.session_search.provider",
-  "auxiliary.skills_hub.api_key",
-  "auxiliary.skills_hub.base_url",
-  "auxiliary.skills_hub.model",
-  "auxiliary.skills_hub.provider",
-  "auxiliary.vision.api_key",
-  "auxiliary.vision.base_url",
-  "auxiliary.vision.model",
-  "auxiliary.vision.provider",
-  "auxiliary.vision.timeout",
-  "auxiliary.web_extract.api_key",
-  "auxiliary.web_extract.base_url",
-  "auxiliary.web_extract.model",
-  "auxiliary.web_extract.provider",
-  "browser.command_timeout",
-  "browser.inactivity_timeout",
-  "browser.record_sessions",
-  "checkpoints.enabled",
-  "checkpoints.max_snapshots",
-  "command_allowlist",
-  "compression.enabled",
-  "compression.protect_last_n",
-  "compression.summary_base_url",
-  "compression.summary_model",
-  "compression.summary_provider",
-  "compression.target_ratio",
-  "compression.threshold",
-  "delegation.api_key",
-  "delegation.base_url",
-  "delegation.model",
-  "delegation.provider",
-  "discord.auto_thread",
-  "discord.free_response_channels",
-  "discord.require_mention",
-  "display.bell_on_complete",
-  "display.compact",
-  "display.personality",
-  "display.resume_display",
-  "display.show_cost",
-  "display.show_reasoning",
-  "display.skin",
-  "display.streaming",
-  "honcho",
-  "human_delay.max_ms",
-  "human_delay.min_ms",
-  "human_delay.mode",
-  "memory.memory_char_limit",
-  "memory.memory_enabled",
-  "memory.user_char_limit",
-  "memory.user_profile_enabled",
-  "model",
-  "personalities",
-  "prefill_messages_file",
-  "privacy.redact_pii",
-  "quick_commands",
-  "security.redact_secrets",
-  "security.tirith_enabled",
-  "security.tirith_fail_open",
-  "security.tirith_path",
-  "security.tirith_timeout",
-  "security.website_blocklist.domains",
-  "security.website_blocklist.enabled",
-  "security.website_blocklist.shared_files",
-  "smart_model_routing.cheap_model",
-  "smart_model_routing.enabled",
-  "smart_model_routing.max_simple_chars",
-  "smart_model_routing.max_simple_words",
-  "stt.enabled",
-  "stt.local.model",
-  "stt.openai.model",
-  "stt.provider",
-  "terminal.backend",
-  "terminal.container_cpu",
-  "terminal.container_disk",
-  "terminal.container_memory",
-  "terminal.container_persistent",
-  "terminal.cwd",
-  "terminal.daytona_image",
-  "terminal.docker_forward_env",
-  "terminal.docker_image",
-  "terminal.docker_mount_cwd_to_workspace",
-  "terminal.docker_volumes",
-  "terminal.env_passthrough",
-  "terminal.modal_image",
-  "terminal.persistent_shell",
-  "terminal.singularity_image",
-  "terminal.timeout",
-  "timezone",
-  "toolsets",
-  "tts.edge.voice",
-  "tts.elevenlabs.model_id",
-  "tts.elevenlabs.voice_id",
-  "tts.neutts.device",
-  "tts.neutts.model",
-  "tts.neutts.ref_audio",
-  "tts.neutts.ref_text",
-  "tts.openai.model",
-  "tts.openai.voice",
-  "tts.provider",
-  "voice.auto_tts",
-  "voice.max_recording_seconds",
-  "voice.record_key",
-  "voice.silence_duration",
-  "voice.silence_threshold",
-  "whatsapp"
-]

nix/configMergeScript.nix

@@ -1,33 +0,0 @@
-# nix/configMergeScript.nix — Deep-merge Nix settings into existing config.yaml
-#
-# Used by the NixOS module activation script and by checks.nix tests.
-# Nix keys override; user-added keys (skills, streaming, etc.) are preserved.
-{ pkgs }:
-pkgs.writeScript "hermes-config-merge" ''
-  #!${pkgs.python3.withPackages (ps: [ ps.pyyaml ])}/bin/python3
-  import json, yaml, sys
-  from pathlib import Path
-
-  nix_json, config_path = sys.argv[1], Path(sys.argv[2])
-
-  with open(nix_json) as f:
-      nix = json.load(f)
-
-  existing = {}
-  if config_path.exists():
-      with open(config_path) as f:
-          existing = yaml.safe_load(f) or {}
-
-  def deep_merge(base, override):
-      result = dict(base)
-      for k, v in override.items():
-          if k in result and isinstance(result[k], dict) and isinstance(v, dict):
-              result[k] = deep_merge(result[k], v)
-          else:
-              result[k] = v
-      return result
-
-  merged = deep_merge(existing, nix)
-  with open(config_path, "w") as f:
-      yaml.dump(merged, f, default_flow_style=False, sort_keys=False)
-''

nix/devShell.nix

@@ -1,51 +0,0 @@
-# nix/devShell.nix — Fast dev shell with stamp-file optimization
-{ inputs, ... }: {
-  perSystem = { pkgs, ... }:
-    let
-      python = pkgs.python311;
-    in {
-      devShells.default = pkgs.mkShell {
-        packages = with pkgs; [
-          python uv nodejs_20 ripgrep git openssh ffmpeg
-        ];
-
-        shellHook = ''
-          echo "Hermes Agent dev shell"
-
-          # Composite stamp: changes when nix python or uv change
-          STAMP_VALUE="${python}:${pkgs.uv}"
-          STAMP_FILE=".venv/.nix-stamp"
-
-          # Create venv if missing
-          if [ ! -d .venv ]; then
-            echo "Creating Python 3.11 venv..."
-            uv venv .venv --python ${python}/bin/python3
-          fi
-
-          source .venv/bin/activate
-
-          # Only install if stamp is stale or missing
-          if [ ! -f "$STAMP_FILE" ] || [ "$(cat "$STAMP_FILE")" != "$STAMP_VALUE" ]; then
-            echo "Installing Python dependencies..."
-            uv pip install -e ".[all]"
-            if [ -d mini-swe-agent ]; then
-              uv pip install -e ./mini-swe-agent 2>/dev/null || true
-            fi
-            if [ -d tinker-atropos ]; then
-              uv pip install -e ./tinker-atropos 2>/dev/null || true
-            fi
-
-            # Install npm deps
-            if [ -f package.json ] && [ ! -d node_modules ]; then
-              echo "Installing npm dependencies..."
-              npm install
-            fi
-
-            echo "$STAMP_VALUE" > "$STAMP_FILE"
-          fi
-
-          echo "Ready. Run 'hermes' to start."
-        '';
-      };
-    };
-}

nix/nixosModules.nix

@@ -1,716 +0,0 @@
-# nix/nixosModules.nix — NixOS module for hermes-agent
-#
-# Two modes:
-#   container.enable = false (default) → native systemd service
-#   container.enable = true            → OCI container (persistent writable layer)
-#
-# Container mode: hermes runs from /nix/store bind-mounted read-only into a
-# plain Ubuntu container. The writable layer (apt/pip/npm installs) persists
-# across restarts and agent updates. Only image/volume/options changes trigger
-# container recreation. Environment variables are written to $HERMES_HOME/.env
-# and read by hermes at startup — no container recreation needed for env changes.
-#
-# Usage:
-#   services.hermes-agent = {
-#     enable = true;
-#     settings.model = "anthropic/claude-sonnet-4";
-#     environmentFiles = [ config.sops.secrets."hermes/env".path ];
-#   };
-#
-{ inputs, ... }: {
-  flake.nixosModules.default = { config, lib, pkgs, ... }:
-
-  let
-    cfg = config.services.hermes-agent;
-    hermes-agent = inputs.self.packages.${pkgs.system}.default;
-
-    # Deep-merge config type (from 0xrsydn/nix-hermes-agent)
-    deepConfigType = lib.types.mkOptionType {
-      name = "hermes-config-attrs";
-      description = "Hermes YAML config (attrset), merged deeply via lib.recursiveUpdate.";
-      check = builtins.isAttrs;
-      merge = _loc: defs: lib.foldl' lib.recursiveUpdate { } (map (d: d.value) defs);
-    };
-
-    # Generate config.yaml from Nix attrset (YAML is a superset of JSON)
-    configJson = builtins.toJSON cfg.settings;
-    generatedConfigFile = pkgs.writeText "hermes-config.yaml" configJson;
-    configFile = if cfg.configFile != null then cfg.configFile else generatedConfigFile;
-
-    configMergeScript = pkgs.callPackage ./configMergeScript.nix { };
-
-    # Generate .env from non-secret environment attrset
-    envFileContent = lib.concatStringsSep "\n" (
-      lib.mapAttrsToList (k: v: "${k}=${v}") cfg.environment
-    );
-    # Build documents derivation (from 0xrsydn)
-    documentDerivation = pkgs.runCommand "hermes-documents" { } (
-      ''
-        mkdir -p $out
-      '' + lib.concatStringsSep "\n" (
-        lib.mapAttrsToList (name: value:
-          if builtins.isPath value || lib.isStorePath value
-          then "cp ${value} $out/${name}"
-          else "cat > $out/${name} <<'HERMES_DOC_EOF'\n${value}\nHERMES_DOC_EOF"
-        ) cfg.documents
-      )
-    );
-
-    containerName = "hermes-agent";
-    containerDataDir = "/data";     # stateDir mount point inside container
-    containerHomeDir = "/home/hermes";
-
-    # ── Container mode helpers ──────────────────────────────────────────
-    containerBin = if cfg.container.backend == "docker"
-      then "${pkgs.docker}/bin/docker"
-      else "${pkgs.podman}/bin/podman";
-
-    # Runs as root inside the container on every start. Provisions the
-    # hermes user + sudo on first boot (writable layer persists), then
-    # drops privileges. Supports arbitrary base images (Debian, Alpine, etc).
-    containerEntrypoint = pkgs.writeShellScript "hermes-container-entrypoint" ''
-      set -eu
-
-      HERMES_UID="''${HERMES_UID:?HERMES_UID must be set}"
-      HERMES_GID="''${HERMES_GID:?HERMES_GID must be set}"
-
-      # ── Group: ensure a group with GID=$HERMES_GID exists ──
-      # Check by GID (not name) to avoid collisions with pre-existing groups
-      # (e.g. GID 100 = "users" on Ubuntu)
-      EXISTING_GROUP=$(getent group "$HERMES_GID" 2>/dev/null | cut -d: -f1 || true)
-      if [ -n "$EXISTING_GROUP" ]; then
-        GROUP_NAME="$EXISTING_GROUP"
-      else
-        GROUP_NAME="hermes"
-        if command -v groupadd >/dev/null 2>&1; then
-          groupadd -g "$HERMES_GID" "$GROUP_NAME"
-        elif command -v addgroup >/dev/null 2>&1; then
-          addgroup -g "$HERMES_GID" "$GROUP_NAME" 2>/dev/null || true
-        fi
-      fi
-
-      # ── User: ensure a user with UID=$HERMES_UID exists ──
-      PASSWD_ENTRY=$(getent passwd "$HERMES_UID" 2>/dev/null || true)
-      if [ -n "$PASSWD_ENTRY" ]; then
-        TARGET_USER=$(echo "$PASSWD_ENTRY" | cut -d: -f1)
-        TARGET_HOME=$(echo "$PASSWD_ENTRY" | cut -d: -f6)
-      else
-        TARGET_USER="hermes"
-        TARGET_HOME="/home/hermes"
-        if command -v useradd >/dev/null 2>&1; then
-          useradd -u "$HERMES_UID" -g "$HERMES_GID" -m -d "$TARGET_HOME" -s /bin/bash "$TARGET_USER"
-        elif command -v adduser >/dev/null 2>&1; then
-          adduser -u "$HERMES_UID" -D -h "$TARGET_HOME" -s /bin/sh -G "$GROUP_NAME" "$TARGET_USER" 2>/dev/null || true
-        fi
-      fi
-      mkdir -p "$TARGET_HOME"
-      chown "$HERMES_UID:$HERMES_GID" "$TARGET_HOME"
-
-      # Ensure HERMES_HOME is owned by the target user
-      if [ -n "''${HERMES_HOME:-}" ] && [ -d "$HERMES_HOME" ]; then
-        chown -R "$HERMES_UID:$HERMES_GID" "$HERMES_HOME"
-      fi
-
-      # Install sudo on Debian/Ubuntu if missing (first boot only, cached in writable layer)
-      if command -v apt-get >/dev/null 2>&1 && ! command -v sudo >/dev/null 2>&1; then
-        apt-get update -qq >/dev/null 2>&1 && apt-get install -y -qq sudo >/dev/null 2>&1 || true
-      fi
-      if command -v sudo >/dev/null 2>&1 && [ ! -f /etc/sudoers.d/hermes ]; then
-        mkdir -p /etc/sudoers.d
-        echo "$TARGET_USER ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/hermes
-        chmod 0440 /etc/sudoers.d/hermes
-      fi
-
-      if command -v setpriv >/dev/null 2>&1; then
-        exec setpriv --reuid="$HERMES_UID" --regid="$HERMES_GID" --init-groups "$@"
-      elif command -v su >/dev/null 2>&1; then
-        exec su -s /bin/sh "$TARGET_USER" -c 'exec "$0" "$@"' -- "$@"
-      else
-        echo "WARNING: no privilege-drop tool (setpriv/su), running as root" >&2
-        exec "$@"
-      fi
-    '';
-
-    # Identity hash — only recreate container when structural config changes.
-    # Package and entrypoint use stable symlinks (current-package, current-entrypoint)
-    # so they can update without recreation. Env vars go through $HERMES_HOME/.env.
-    containerIdentity = builtins.hashString "sha256" (builtins.toJSON {
-      schema = 3; # bump when identity inputs change
-      image = cfg.container.image;
-      extraVolumes = cfg.container.extraVolumes;
-      extraOptions = cfg.container.extraOptions;
-    });
-
-    identityFile = "${cfg.stateDir}/.container-identity";
-
-    # Default: /var/lib/hermes/workspace → /data/workspace.
-    # Custom paths outside stateDir pass through unchanged (user must add extraVolumes).
-    containerWorkDir =
-      if lib.hasPrefix "${cfg.stateDir}/" cfg.workingDirectory
-      then "${containerDataDir}/${lib.removePrefix "${cfg.stateDir}/" cfg.workingDirectory}"
-      else cfg.workingDirectory;
-
-  in {
-    options.services.hermes-agent = with lib; {
-      enable = mkEnableOption "Hermes Agent gateway service";
-
-      # ── Package ──────────────────────────────────────────────────────────
-      package = mkOption {
-        type = types.package;
-        default = hermes-agent;
-        description = "The hermes-agent package to use.";
-      };
-
-      # ── Service identity ─────────────────────────────────────────────────
-      user = mkOption {
-        type = types.str;
-        default = "hermes";
-        description = "System user running the gateway.";
-      };
-
-      group = mkOption {
-        type = types.str;
-        default = "hermes";
-        description = "System group running the gateway.";
-      };
-
-      createUser = mkOption {
-        type = types.bool;
-        default = true;
-        description = "Create the user/group automatically.";
-      };
-
-      # ── Directories ──────────────────────────────────────────────────────
-      stateDir = mkOption {
-        type = types.str;
-        default = "/var/lib/hermes";
-        description = "State directory. Contains .hermes/ subdir (HERMES_HOME).";
-      };
-
-      workingDirectory = mkOption {
-        type = types.str;
-        default = "${cfg.stateDir}/workspace";
-        defaultText = literalExpression ''"''${cfg.stateDir}/workspace"'';
-        description = "Working directory for the agent (MESSAGING_CWD).";
-      };
-
-      # ── Declarative config ───────────────────────────────────────────────
-      configFile = mkOption {
-        type = types.nullOr types.path;
-        default = null;
-        description = ''
-          Path to an existing config.yaml. If set, takes precedence over
-          the declarative `settings` option.
-        '';
-      };
-
-      settings = mkOption {
-        type = deepConfigType;
-        default = { };
-        description = ''
-          Declarative Hermes config (attrset). Deep-merged across module
-          definitions and rendered as config.yaml.
-        '';
-        example = literalExpression ''
-          {
-            model = "anthropic/claude-sonnet-4";
-            terminal.backend = "local";
-            compression = { enabled = true; threshold = 0.85; };
-            toolsets = [ "all" ];
-          }
-        '';
-      };
-
-      # ── Secrets / environment ────────────────────────────────────────────
-      environmentFiles = mkOption {
-        type = types.listOf types.str;
-        default = [ ];
-        description = ''
-          Paths to environment files containing secrets (API keys, tokens).
-          Contents are merged into $HERMES_HOME/.env at activation time.
-          Hermes reads this file on every startup via load_hermes_dotenv().
-        '';
-      };
-
-      environment = mkOption {
-        type = types.attrsOf types.str;
-        default = { };
-        description = ''
-          Non-secret environment variables. Merged into $HERMES_HOME/.env
-          at activation time. Do NOT put secrets here — use environmentFiles.
-        '';
-      };
-
-      authFile = mkOption {
-        type = types.nullOr types.path;
-        default = null;
-        description = ''
-          Path to an auth.json seed file (OAuth credentials).
-          Only copied on first deploy — existing auth.json is preserved.
-        '';
-      };
-
-      authFileForceOverwrite = mkOption {
-        type = types.bool;
-        default = false;
-        description = "Always overwrite auth.json from authFile on activation.";
-      };
-
-      # ── Documents ────────────────────────────────────────────────────────
-      documents = mkOption {
-        type = types.attrsOf (types.either types.str types.path);
-        default = { };
-        description = ''
-          Workspace files (SOUL.md, USER.md, etc.). Keys are filenames,
-          values are inline strings or paths. Installed into workingDirectory.
-        '';
-        example = literalExpression ''
-          {
-            "SOUL.md" = "You are a helpful AI assistant.";
-            "USER.md" = ./documents/USER.md;
-          }
-        '';
-      };
-
-      # ── MCP Servers ──────────────────────────────────────────────────────
-      mcpServers = mkOption {
-        type = types.attrsOf (types.submodule {
-          options = {
-            # Stdio transport
-            command = mkOption {
-              type = types.nullOr types.str;
-              default = null;
-              description = "MCP server command (stdio transport).";
-            };
-            args = mkOption {
-              type = types.listOf types.str;
-              default = [ ];
-              description = "Command-line arguments (stdio transport).";
-            };
-            env = mkOption {
-              type = types.attrsOf types.str;
-              default = { };
-              description = "Environment variables for the server process (stdio transport).";
-            };
-
-            # HTTP/StreamableHTTP transport
-            url = mkOption {
-              type = types.nullOr types.str;
-              default = null;
-              description = "MCP server endpoint URL (HTTP/StreamableHTTP transport).";
-            };
-            headers = mkOption {
-              type = types.attrsOf types.str;
-              default = { };
-              description = "HTTP headers, e.g. for authentication (HTTP transport).";
-            };
-
-            # Authentication
-            auth = mkOption {
-              type = types.nullOr (types.enum [ "oauth" ]);
-              default = null;
-              description = ''
-                Authentication method. Set to "oauth" for OAuth 2.1 PKCE flow
-                (remote MCP servers). Tokens are stored in $HERMES_HOME/mcp-tokens/.
-              '';
-            };
-
-            # Enable/disable
-            enabled = mkOption {
-              type = types.bool;
-              default = true;
-              description = "Enable or disable this MCP server.";
-            };
-
-            # Common options
-            timeout = mkOption {
-              type = types.nullOr types.int;
-              default = null;
-              description = "Tool call timeout in seconds (default: 120).";
-            };
-            connect_timeout = mkOption {
-              type = types.nullOr types.int;
-              default = null;
-              description = "Initial connection timeout in seconds (default: 60).";
-            };
-
-            # Tool filtering
-            tools = mkOption {
-              type = types.nullOr (types.submodule {
-                options = {
-                  include = mkOption {
-                    type = types.listOf types.str;
-                    default = [ ];
-                    description = "Tool allowlist — only these tools are registered.";
-                  };
-                  exclude = mkOption {
-                    type = types.listOf types.str;
-                    default = [ ];
-                    description = "Tool blocklist — these tools are hidden.";
-                  };
-                };
-              });
-              default = null;
-              description = "Filter which tools are exposed by this server.";
-            };
-
-            # Sampling (server-initiated LLM requests)
-            sampling = mkOption {
-              type = types.nullOr (types.submodule {
-                options = {
-                  enabled = mkOption { type = types.bool; default = true; description = "Enable sampling."; };
-                  model = mkOption { type = types.nullOr types.str; default = null; description = "Override model for sampling requests."; };
-                  max_tokens_cap = mkOption { type = types.nullOr types.int; default = null; description = "Max tokens per request."; };
-                  timeout = mkOption { type = types.nullOr types.int; default = null; description = "LLM call timeout in seconds."; };
-                  max_rpm = mkOption { type = types.nullOr types.int; default = null; description = "Max requests per minute."; };
-                  max_tool_rounds = mkOption { type = types.nullOr types.int; default = null; description = "Max tool-use rounds per sampling request."; };
-                  allowed_models = mkOption { type = types.listOf types.str; default = [ ]; description = "Models the server is allowed to request."; };
-                  log_level = mkOption {
-                    type = types.nullOr (types.enum [ "debug" "info" "warning" ]);
-                    default = null;
-                    description = "Audit log level for sampling requests.";
-                  };
-                };
-              });
-              default = null;
-              description = "Sampling configuration for server-initiated LLM requests.";
-            };
-          };
-        });
-        default = { };
-        description = ''
-          MCP server configurations (merged into settings.mcp_servers).
-          Each server uses either stdio (command/args) or HTTP (url) transport.
-        '';
-        example = literalExpression ''
-          {
-            filesystem = {
-              command = "npx";
-              args = [ "-y" "@modelcontextprotocol/server-filesystem" "/home/user" ];
-            };
-            remote-api = {
-              url = "http://my-server:8080/v0/mcp";
-              headers = { Authorization = "Bearer ..."; };
-            };
-            remote-oauth = {
-              url = "https://mcp.example.com/mcp";
-              auth = "oauth";
-            };
-          }
-        '';
-      };
-
-      # ── Service behavior ─────────────────────────────────────────────────
-      extraArgs = mkOption {
-        type = types.listOf types.str;
-        default = [ ];
-        description = "Extra command-line arguments for `hermes gateway`.";
-      };
-
-      extraPackages = mkOption {
-        type = types.listOf types.package;
-        default = [ ];
-        description = "Extra packages available on PATH.";
-      };
-
-      restart = mkOption {
-        type = types.str;
-        default = "always";
-        description = "systemd Restart= policy.";
-      };
-
-      restartSec = mkOption {
-        type = types.int;
-        default = 5;
-        description = "systemd RestartSec= value.";
-      };
-
-      addToSystemPackages = mkOption {
-        type = types.bool;
-        default = false;
-        description = "Add hermes CLI to environment.systemPackages.";
-      };
-
-      # ── OCI Container (opt-in) ──────────────────────────────────────────
-      container = {
-        enable = mkEnableOption "OCI container mode (Ubuntu base, full self-modification support)";
-
-        backend = mkOption {
-          type = types.enum [ "docker" "podman" ];
-          default = "docker";
-          description = "Container runtime.";
-        };
-
-        extraVolumes = mkOption {
-          type = types.listOf types.str;
-          default = [ ];
-          description = "Extra volume mounts (host:container:mode format).";
-          example = [ "/home/user/projects:/projects:rw" ];
-        };
-
-        extraOptions = mkOption {
-          type = types.listOf types.str;
-          default = [ ];
-          description = "Extra arguments passed to docker/podman run.";
-        };
-
-        image = mkOption {
-          type = types.str;
-          default = "ubuntu:24.04";
-          description = "OCI container image. The container pulls this at runtime via Docker/Podman.";
-        };
-      };
-    };
-
-    config = lib.mkIf cfg.enable (lib.mkMerge [
-
-      # ── Merge MCP servers into settings ────────────────────────────────
-      (lib.mkIf (cfg.mcpServers != { }) {
-        services.hermes-agent.settings.mcp_servers = lib.mapAttrs (_name: srv:
-          # Stdio transport
-          lib.optionalAttrs (srv.command != null) { inherit (srv) command args; }
-          // lib.optionalAttrs (srv.env != { }) { inherit (srv) env; }
-          # HTTP transport
-          // lib.optionalAttrs (srv.url != null) { inherit (srv) url; }
-          // lib.optionalAttrs (srv.headers != { }) { inherit (srv) headers; }
-          # Auth
-          // lib.optionalAttrs (srv.auth != null) { inherit (srv) auth; }
-          # Enable/disable
-          // { inherit (srv) enabled; }
-          # Common options
-          // lib.optionalAttrs (srv.timeout != null) { inherit (srv) timeout; }
-          // lib.optionalAttrs (srv.connect_timeout != null) { inherit (srv) connect_timeout; }
-          # Tool filtering
-          // lib.optionalAttrs (srv.tools != null) {
-            tools = lib.filterAttrs (_: v: v != [ ]) {
-              inherit (srv.tools) include exclude;
-            };
-          }
-          # Sampling
-          // lib.optionalAttrs (srv.sampling != null) {
-            sampling = lib.filterAttrs (_: v: v != null && v != [ ]) {
-              inherit (srv.sampling) enabled model max_tokens_cap timeout max_rpm
-                max_tool_rounds allowed_models log_level;
-            };
-          }
-        ) cfg.mcpServers;
-      })
-
-      # ── User / group ──────────────────────────────────────────────────
-      (lib.mkIf cfg.createUser {
-        users.groups.${cfg.group} = { };
-        users.users.${cfg.user} = {
-          isSystemUser = true;
-          group = cfg.group;
-          home = cfg.stateDir;
-          createHome = true;
-          shell = pkgs.bashInteractive;
-        };
-      })
-
-      # ── Host CLI ──────────────────────────────────────────────────────
-      (lib.mkIf cfg.addToSystemPackages {
-        environment.systemPackages = [ cfg.package ];
-      })
-
-      # ── Directories ───────────────────────────────────────────────────
-      {
-        systemd.tmpfiles.rules = [
-          "d ${cfg.stateDir}                0755 ${cfg.user} ${cfg.group} - -"
-          "d ${cfg.stateDir}/.hermes        0755 ${cfg.user} ${cfg.group} - -"
-          "d ${cfg.stateDir}/home           0750 ${cfg.user} ${cfg.group} - -"
-          "d ${cfg.workingDirectory}         0750 ${cfg.user} ${cfg.group} - -"
-        ];
-      }
-
-      # ── Activation: link config + auth + documents ────────────────────
-      {
-        system.activationScripts."hermes-agent-setup" = lib.stringAfter [ "users" ] ''
-          # Ensure directories exist (activation runs before tmpfiles)
-          mkdir -p ${cfg.stateDir}/.hermes
-          mkdir -p ${cfg.stateDir}/home
-          mkdir -p ${cfg.workingDirectory}
-          chown ${cfg.user}:${cfg.group} ${cfg.stateDir} ${cfg.stateDir}/.hermes ${cfg.stateDir}/home ${cfg.workingDirectory}
-
-          # Merge Nix settings into existing config.yaml.
-          # Preserves user-added keys (skills, streaming, etc.); Nix keys win.
-          # If configFile is user-provided (not generated), overwrite instead of merge.
-          ${if cfg.configFile != null then ''
-            install -o ${cfg.user} -g ${cfg.group} -m 0644 -D ${configFile} ${cfg.stateDir}/.hermes/config.yaml
-          '' else ''
-            ${configMergeScript} ${generatedConfigFile} ${cfg.stateDir}/.hermes/config.yaml
-            chown ${cfg.user}:${cfg.group} ${cfg.stateDir}/.hermes/config.yaml
-            chmod 0644 ${cfg.stateDir}/.hermes/config.yaml
-          ''}
-
-          # Managed mode marker (so interactive shells also detect NixOS management)
-          touch ${cfg.stateDir}/.hermes/.managed
-          chown ${cfg.user}:${cfg.group} ${cfg.stateDir}/.hermes/.managed
-
-          # Seed auth file if provided
-          ${lib.optionalString (cfg.authFile != null) ''
-            ${if cfg.authFileForceOverwrite then ''
-              install -o ${cfg.user} -g ${cfg.group} -m 0600 ${cfg.authFile} ${cfg.stateDir}/.hermes/auth.json
-            '' else ''
-              if [ ! -f ${cfg.stateDir}/.hermes/auth.json ]; then
-                install -o ${cfg.user} -g ${cfg.group} -m 0600 ${cfg.authFile} ${cfg.stateDir}/.hermes/auth.json
-              fi
-            ''}
-          ''}
-
-          # Seed .env from Nix-declared environment + environmentFiles.
-          # Hermes reads $HERMES_HOME/.env at startup via load_hermes_dotenv(),
-          # so this is the single source of truth for both native and container mode.
-          ${lib.optionalString (cfg.environment != {} || cfg.environmentFiles != []) ''
-            ENV_FILE="${cfg.stateDir}/.hermes/.env"
-            install -o ${cfg.user} -g ${cfg.group} -m 0600 /dev/null "$ENV_FILE"
-            cat > "$ENV_FILE" <<'HERMES_NIX_ENV_EOF'
-${envFileContent}
-HERMES_NIX_ENV_EOF
-            ${lib.concatStringsSep "\n" (map (f: ''
-              if [ -f "${f}" ]; then
-                echo "" >> "$ENV_FILE"
-                cat "${f}" >> "$ENV_FILE"
-              fi
-            '') cfg.environmentFiles)}
-          ''}
-
-          # Link documents into workspace
-          ${lib.concatStringsSep "\n" (lib.mapAttrsToList (name: _value: ''
-            install -o ${cfg.user} -g ${cfg.group} -m 0644 ${documentDerivation}/${name} ${cfg.workingDirectory}/${name}
-          '') cfg.documents)}
-        '';
-      }
-
-      # ══════════════════════════════════════════════════════════════════
-      # MODE A: Native systemd service (default)
-      # ══════════════════════════════════════════════════════════════════
-      (lib.mkIf (!cfg.container.enable) {
-        systemd.services.hermes-agent = {
-          description = "Hermes Agent Gateway";
-          wantedBy = [ "multi-user.target" ];
-          after = [ "network-online.target" ];
-          wants = [ "network-online.target" ];
-
-          environment = {
-            HOME = cfg.stateDir;
-            HERMES_HOME = "${cfg.stateDir}/.hermes";
-            HERMES_MANAGED = "true";
-            MESSAGING_CWD = cfg.workingDirectory;
-          };
-
-          serviceConfig = {
-            User = cfg.user;
-            Group = cfg.group;
-            WorkingDirectory = cfg.workingDirectory;
-
-            # cfg.environment and cfg.environmentFiles are written to
-            # $HERMES_HOME/.env by the activation script. load_hermes_dotenv()
-            # reads them at Python startup — no systemd EnvironmentFile needed.
-
-            ExecStart = lib.concatStringsSep " " ([
-              "${cfg.package}/bin/hermes"
-              "gateway"
-            ] ++ cfg.extraArgs);
-
-            Restart = cfg.restart;
-            RestartSec = cfg.restartSec;
-
-            # Hardening
-            NoNewPrivileges = true;
-            ProtectSystem = "strict";
-            ProtectHome = false;
-            ReadWritePaths = [ cfg.stateDir ];
-            PrivateTmp = true;
-          };
-
-          path = [
-            cfg.package
-            pkgs.bash
-            pkgs.coreutils
-            pkgs.git
-          ] ++ cfg.extraPackages;
-        };
-      })
-
-      # ══════════════════════════════════════════════════════════════════
-      # MODE B: OCI container (persistent writable layer)
-      # ══════════════════════════════════════════════════════════════════
-      (lib.mkIf cfg.container.enable {
-        # Ensure the container runtime is available
-        virtualisation.docker.enable = lib.mkDefault (cfg.container.backend == "docker");
-
-        systemd.services.hermes-agent = {
-          description = "Hermes Agent Gateway (container)";
-          wantedBy = [ "multi-user.target" ];
-          after = [ "network-online.target" ]
-            ++ lib.optional (cfg.container.backend == "docker") "docker.service";
-          wants = [ "network-online.target" ];
-          requires = lib.optional (cfg.container.backend == "docker") "docker.service";
-
-          preStart = ''
-            # Stable symlinks — container references these, not store paths directly
-            ln -sfn ${cfg.package} ${cfg.stateDir}/current-package
-            ln -sfn ${containerEntrypoint} ${cfg.stateDir}/current-entrypoint
-
-            # GC roots so nix-collect-garbage doesn't remove store paths in use
-            ${pkgs.nix}/bin/nix-store --add-root ${cfg.stateDir}/.gc-root --indirect -r ${cfg.package} 2>/dev/null || true
-            ${pkgs.nix}/bin/nix-store --add-root ${cfg.stateDir}/.gc-root-entrypoint --indirect -r ${containerEntrypoint} 2>/dev/null || true
-
-            # Check if container needs (re)creation
-            NEED_CREATE=false
-            if ! ${containerBin} inspect ${containerName} &>/dev/null; then
-              NEED_CREATE=true
-            elif [ ! -f ${identityFile} ] || [ "$(cat ${identityFile})" != "${containerIdentity}" ]; then
-              echo "Container config changed, recreating..."
-              ${containerBin} rm -f ${containerName} || true
-              NEED_CREATE=true
-            fi
-
-            if [ "$NEED_CREATE" = "true" ]; then
-              # Resolve numeric UID/GID — passed to entrypoint for in-container user setup
-              HERMES_UID=$(${pkgs.coreutils}/bin/id -u ${cfg.user})
-              HERMES_GID=$(${pkgs.coreutils}/bin/id -g ${cfg.user})
-
-              echo "Creating container..."
-              ${containerBin} create \
-                --name ${containerName} \
-                --network=host \
-                --entrypoint ${containerDataDir}/current-entrypoint \
-                --volume /nix/store:/nix/store:ro \
-                --volume ${cfg.stateDir}:${containerDataDir} \
-                --volume ${cfg.stateDir}/home:${containerHomeDir} \
-                ${lib.concatStringsSep " " (map (v: "--volume ${v}") cfg.container.extraVolumes)} \
-                --env HERMES_UID="$HERMES_UID" \
-                --env HERMES_GID="$HERMES_GID" \
-                --env HERMES_HOME=${containerDataDir}/.hermes \
-                --env HERMES_MANAGED=true \
-                --env HOME=${containerHomeDir} \
-                --env MESSAGING_CWD=${containerWorkDir} \
-                ${lib.concatStringsSep " " cfg.container.extraOptions} \
-                ${cfg.container.image} \
-                ${containerDataDir}/current-package/bin/hermes gateway run --replace ${lib.concatStringsSep " " cfg.extraArgs}
-
-              echo "${containerIdentity}" > ${identityFile}
-            fi
-          '';
-
-          script = ''
-            exec ${containerBin} start -a ${containerName}
-          '';
-
-          preStop = ''
-            ${containerBin} stop -t 10 ${containerName} || true
-          '';
-
-          serviceConfig = {
-            Type = "simple";
-            Restart = cfg.restart;
-            RestartSec = cfg.restartSec;
-            TimeoutStopSec = 30;
-          };
-        };
-      })
-    ]);
-  };
-}

nix/packages.nix

@@ -1,54 +0,0 @@
-# nix/packages.nix — Hermes Agent package built with uv2nix
-{ inputs, ... }: {
-  perSystem = { pkgs, system, ... }:
-    let
-      hermesVenv = pkgs.callPackage ./python.nix {
-        inherit (inputs) uv2nix pyproject-nix pyproject-build-systems;
-      };
-
-      # Import bundled skills, excluding runtime caches
-      bundledSkills = pkgs.lib.cleanSourceWith {
-        src = ../skills;
-        filter = path: _type:
-          !(pkgs.lib.hasInfix "/index-cache/" path);
-      };
-
-      runtimeDeps = with pkgs; [
-        nodejs_20 ripgrep git openssh ffmpeg
-      ];
-
-      runtimePath = pkgs.lib.makeBinPath runtimeDeps;
-    in {
-      packages.default = pkgs.stdenv.mkDerivation {
-        pname = "hermes-agent";
-        version = "0.1.0";
-
-        dontUnpack = true;
-        dontBuild = true;
-        nativeBuildInputs = [ pkgs.makeWrapper ];
-
-        installPhase = ''
-          runHook preInstall
-
-          mkdir -p $out/share/hermes-agent $out/bin
-          cp -r ${bundledSkills} $out/share/hermes-agent/skills
-
-          ${pkgs.lib.concatMapStringsSep "\n" (name: ''
-            makeWrapper ${hermesVenv}/bin/${name} $out/bin/${name} \
-              --prefix PATH : "${runtimePath}" \
-              --set HERMES_BUNDLED_SKILLS $out/share/hermes-agent/skills
-          '') [ "hermes" "hermes-agent" "hermes-acp" ]}
-
-          runHook postInstall
-        '';
-
-        meta = with pkgs.lib; {
-          description = "AI agent with advanced tool-calling capabilities";
-          homepage = "https://github.com/NousResearch/hermes-agent";
-          mainProgram = "hermes";
-          license = licenses.mit;
-          platforms = platforms.unix;
-        };
-      };
-    };
-}

nix/python.nix

@@ -1,28 +0,0 @@
-# nix/python.nix — uv2nix virtual environment builder
-{
-  python311,
-  lib,
-  callPackage,
-  uv2nix,
-  pyproject-nix,
-  pyproject-build-systems,
-}:
-let
-  workspace = uv2nix.lib.workspace.loadWorkspace { workspaceRoot = ./..; };
-
-  overlay = workspace.mkPyprojectOverlay {
-    sourcePreference = "wheel";
-  };
-
-  pythonSet =
-    (callPackage pyproject-nix.build.packages {
-      python = python311;
-    }).overrideScope
-      (lib.composeManyExtensions [
-        pyproject-build-systems.overlays.default
-        overlay
-      ]);
-in
-pythonSet.mkVirtualEnv "hermes-agent-env" {
-  hermes-agent = [ "all" ];
-}

optional-skills/creative/meme-generation/EXAMPLES.md

@@ -1,46 +0,0 @@
-# Meme Generation Examples
-
-## Example 1: Debugging at 2 AM
-
-**Topic:** debugging production at 2 AM
-**Template:** this-is-fine
-
-```bash
-python generate_meme.py this-is-fine /tmp/meme.png "PRODUCTION IS DOWN" "This is fine"
-```
-
-## Example 2: Developer Priorities
-
-**Topic:** choosing between writing tests and shipping features
-**Template:** drake
-
-```bash
-python generate_meme.py drake /tmp/meme.png "Writing unit tests" "Shipping straight to prod"
-```
-
-## Example 3: Exam Stress
-
-**Topic:** final exam preparation
-**Template:** two-buttons
-
-```bash
-python generate_meme.py two-buttons /tmp/meme.png "Study everything" "Sleep" "Me at midnight"
-```
-
-## Example 4: Escalating Solutions
-
-**Topic:** fixing a CSS bug
-**Template:** expanding-brain
-
-```bash
-python generate_meme.py expanding-brain /tmp/meme.png "Reading the docs" "Stack Overflow" "!important on everything" "Deleting the stylesheet"
-```
-
-## Example 5: Hot Take
-
-**Topic:** tabs vs spaces
-**Template:** change-my-mind
-
-```bash
-python generate_meme.py change-my-mind /tmp/meme.png "Tabs are just thicc spaces"
-```

optional-skills/creative/meme-generation/SKILL.md

@@ -1,129 +0,0 @@
----
-name: meme-generation
-description: Generate real meme images by picking a template and overlaying text with Pillow. Produces actual .png meme files.
-version: 2.0.0
-author: adanaleycio
-license: MIT
-metadata:
-  hermes:
-    tags: [creative, memes, humor, images]
-    related_skills: [ascii-art, generative-widgets]
-    category: creative
----
-
-# Meme Generation
-
-Generate actual meme images from a topic. Picks a template, writes captions, and renders a real .png file with text overlay.
-
-## When to Use
-
-- User asks you to make or generate a meme
-- User wants a meme about a specific topic, situation, or frustration
-- User says "meme this" or similar
-
-## Available Templates
-
-The script supports **any of the ~100 popular imgflip templates** by name or ID, plus 10 curated templates with hand-tuned text positioning.
-
-### Curated Templates (custom text placement)
-
-| ID | Name | Fields | Best for |
-|----|------|--------|----------|
-| `this-is-fine` | This is Fine | top, bottom | chaos, denial |
-| `drake` | Drake Hotline Bling | reject, approve | rejecting/preferring |
-| `distracted-boyfriend` | Distracted Boyfriend | distraction, current, person | temptation, shifting priorities |
-| `two-buttons` | Two Buttons | left, right, person | impossible choice |
-| `expanding-brain` | Expanding Brain | 4 levels | escalating irony |
-| `change-my-mind` | Change My Mind | statement | hot takes |
-| `woman-yelling-at-cat` | Woman Yelling at Cat | woman, cat | arguments |
-| `one-does-not-simply` | One Does Not Simply | top, bottom | deceptively hard things |
-| `grus-plan` | Gru's Plan | step1-3, realization | plans that backfire |
-| `batman-slapping-robin` | Batman Slapping Robin | robin, batman | shutting down bad ideas |
-
-### Dynamic Templates (from imgflip API)
-
-Any template not in the curated list can be used by name or imgflip ID. These get smart default text positioning (top/bottom for 2-field, evenly spaced for 3+). Search with:
-```bash
-python "$SKILL_DIR/scripts/generate_meme.py" --search "disaster"
-```
-
-## Procedure
-
-### Mode 1: Classic Template (default)
-
-1. Read the user's topic and identify the core dynamic (chaos, dilemma, preference, irony, etc.)
-2. Pick the template that best matches. Use the "Best for" column, or search with `--search`.
-3. Write short captions for each field (8-12 words max per field, shorter is better).
-4. Find the skill's script directory:
-   ```
-   SKILL_DIR=$(dirname "$(find ~/.hermes/skills -path '*/meme-generation/SKILL.md' 2>/dev/null | head -1)")
-   ```
-5. Run the generator:
-   ```bash
-   python "$SKILL_DIR/scripts/generate_meme.py" <template_id> /tmp/meme.png "caption 1" "caption 2" ...
-   ```
-6. Return the image with `MEDIA:/tmp/meme.png`
-
-### Mode 2: Custom AI Image (when image_generate is available)
-
-Use this when no classic template fits, or when the user wants something original.
-
-1. Write the captions first.
-2. Use `image_generate` to create a scene that matches the meme concept. Do NOT include any text in the image prompt — text will be added by the script. Describe only the visual scene.
-3. Find the generated image path from the image_generate result URL. Download it to a local path if needed.
-4. Run the script with `--image` to overlay text, choosing a mode:
-   - **Overlay** (text directly on image, white with black outline):
-     ```bash
-     python "$SKILL_DIR/scripts/generate_meme.py" --image /path/to/scene.png /tmp/meme.png "top text" "bottom text"
-     ```
-   - **Bars** (black bars above/below with white text — cleaner, always readable):
-     ```bash
-     python "$SKILL_DIR/scripts/generate_meme.py" --image /path/to/scene.png --bars /tmp/meme.png "top text" "bottom text"
-     ```
-   Use `--bars` when the image is busy/detailed and text would be hard to read on top of it.
-5. **Verify with vision** (if `vision_analyze` is available): Check the result looks good:
-   ```
-   vision_analyze(image_url="/tmp/meme.png", question="Is the text legible and well-positioned? Does the meme work visually?")
-   ```
-   If the vision model flags issues (text hard to read, bad placement, etc.), try the other mode (switch between overlay and bars) or regenerate the scene.
-6. Return the image with `MEDIA:/tmp/meme.png`
-
-## Examples
-
-**"debugging production at 2 AM":**
-```bash
-python generate_meme.py this-is-fine /tmp/meme.png "SERVERS ARE ON FIRE" "This is fine"
-```
-
-**"choosing between sleep and one more episode":**
-```bash
-python generate_meme.py drake /tmp/meme.png "Getting 8 hours of sleep" "One more episode at 3 AM"
-```
-
-**"the stages of a Monday morning":**
-```bash
-python generate_meme.py expanding-brain /tmp/meme.png "Setting an alarm" "Setting 5 alarms" "Sleeping through all alarms" "Working from bed"
-```
-
-## Listing Templates
-
-To see all available templates:
-```bash
-python generate_meme.py --list
-```
-
-## Pitfalls
-
-- Keep captions SHORT. Memes with long text look terrible.
-- Match the number of text arguments to the template's field count.
-- Pick the template that fits the joke structure, not just the topic.
-- Do not generate hateful, abusive, or personally targeted content.
-- The script caches template images in `scripts/.cache/` after first download.
-
-## Verification
-
-The output is correct if:
-- A .png file was created at the output path
-- Text is legible (white with black outline) on the template
-- The joke lands — caption matches the template's intended structure
-- File can be delivered via MEDIA: path

optional-skills/creative/meme-generation/scripts/.gitignore

@@ -1 +0,0 @@
-.cache/

optional-skills/creative/meme-generation/scripts/generate_meme.py

@@ -1,471 +0,0 @@
-#!/usr/bin/env python3
-"""Generate a meme image by overlaying text on a template.
-
-Usage:
-    python generate_meme.py <template_id_or_name> <output_path> <text1> [text2] [text3] [text4]
-
-Example:
-    python generate_meme.py drake /tmp/meme.png "Writing tests" "Shipping to prod and hoping"
-    python generate_meme.py "Disaster Girl" /tmp/meme.png "Top text" "Bottom text"
-    python generate_meme.py --list                    # show curated templates
-    python generate_meme.py --search "distracted"     # search all imgflip templates
-
-Templates with custom text positioning are in templates.json (10 curated).
-Any of the ~100 popular imgflip templates can also be used by name or ID —
-unknown templates get smart default text positioning based on their box_count.
-"""
-
-import json
-import os
-import sys
-import textwrap
-from io import BytesIO
-from pathlib import Path
-
-try:
-    import requests as _requests
-except ImportError:
-    _requests = None
-
-from PIL import Image, ImageDraw, ImageFont
-
-SCRIPT_DIR = Path(__file__).parent
-TEMPLATES_FILE = SCRIPT_DIR / "templates.json"
-CACHE_DIR = SCRIPT_DIR / ".cache"
-IMGFLIP_API = "https://api.imgflip.com/get_memes"
-IMGFLIP_CACHE_FILE = CACHE_DIR / "imgflip_memes.json"
-IMGFLIP_CACHE_MAX_AGE = 86400  # 24 hours
-
-
-def _fetch_url(url: str, timeout: int = 15) -> bytes:
-    """Fetch URL content, using requests if available, else urllib."""
-    if _requests is not None:
-        resp = _requests.get(url, timeout=timeout)
-        resp.raise_for_status()
-        return resp.content
-    import urllib.request
-    return urllib.request.urlopen(url, timeout=timeout).read()
-
-
-def load_curated_templates() -> dict:
-    """Load templates with hand-tuned text field positions."""
-    with open(TEMPLATES_FILE) as f:
-        return json.load(f)
-
-
-def _default_fields(box_count: int) -> list:
-    """Generate sensible default text field positions for unknown templates."""
-    if box_count <= 0:
-        box_count = 2
-    if box_count == 1:
-        return [{"name": "text", "x_pct": 0.5, "y_pct": 0.5, "w_pct": 0.90, "align": "center"}]
-    if box_count == 2:
-        return [
-            {"name": "top", "x_pct": 0.5, "y_pct": 0.08, "w_pct": 0.95, "align": "center"},
-            {"name": "bottom", "x_pct": 0.5, "y_pct": 0.92, "w_pct": 0.95, "align": "center"},
-        ]
-    # 3+: evenly space vertically
-    fields = []
-    for i in range(box_count):
-        y = 0.08 + (0.84 * i / (box_count - 1)) if box_count > 1 else 0.5
-        fields.append({
-            "name": f"text{i+1}",
-            "x_pct": 0.5,
-            "y_pct": round(y, 2),
-            "w_pct": 0.90,
-            "align": "center",
-        })
-    return fields
-
-
-def fetch_imgflip_templates() -> list:
-    """Fetch popular meme templates from imgflip API. Cached for 24h."""
-    import time
-
-    CACHE_DIR.mkdir(exist_ok=True)
-    # Check cache
-    if IMGFLIP_CACHE_FILE.exists():
-        age = time.time() - IMGFLIP_CACHE_FILE.stat().st_mtime
-        if age < IMGFLIP_CACHE_MAX_AGE:
-            with open(IMGFLIP_CACHE_FILE) as f:
-                return json.load(f)
-
-    try:
-        data = json.loads(_fetch_url(IMGFLIP_API))
-        memes = data.get("data", {}).get("memes", [])
-        with open(IMGFLIP_CACHE_FILE, "w") as f:
-            json.dump(memes, f)
-        return memes
-    except Exception as e:
-        # If fetch fails and we have stale cache, use it
-        if IMGFLIP_CACHE_FILE.exists():
-            with open(IMGFLIP_CACHE_FILE) as f:
-                return json.load(f)
-        print(f"Warning: could not fetch imgflip templates: {e}", file=sys.stderr)
-        return []
-
-
-def _slugify(name: str) -> str:
-    """Convert a template name to a slug for matching."""
-    return name.lower().replace(" ", "-").replace("'", "").replace("\"", "")
-
-
-def resolve_template(identifier: str) -> dict:
-    """Resolve a template by curated ID, imgflip name, or imgflip ID.
-
-    Returns dict with: name, url, fields, source.
-    """
-    curated = load_curated_templates()
-
-    # 1. Exact curated ID match
-    if identifier in curated:
-        tmpl = curated[identifier]
-        return {**tmpl, "source": "curated"}
-
-    # 2. Slugified curated match
-    slug = _slugify(identifier)
-    for tid, tmpl in curated.items():
-        if _slugify(tmpl["name"]) == slug or tid == slug:
-            return {**tmpl, "source": "curated"}
-
-    # 3. Search imgflip templates
-    imgflip_memes = fetch_imgflip_templates()
-    slug_lower = slug.lower()
-    id_lower = identifier.strip()
-
-    for meme in imgflip_memes:
-        meme_slug = _slugify(meme["name"])
-        # Check curated first for this imgflip template (custom positioning)
-        for tid, ctmpl in curated.items():
-            if _slugify(ctmpl["name"]) == meme_slug:
-                if meme_slug == slug_lower or meme["id"] == id_lower:
-                    return {**ctmpl, "source": "curated"}
-
-        if meme_slug == slug_lower or meme["id"] == id_lower or slug_lower in meme_slug:
-            return {
-                "name": meme["name"],
-                "url": meme["url"],
-                "fields": _default_fields(meme.get("box_count", 2)),
-                "source": "imgflip",
-            }
-
-    return None
-
-
-def get_template_image(url: str) -> Image.Image:
-    """Download a template image, caching it locally."""
-    CACHE_DIR.mkdir(exist_ok=True)
-    # Use URL hash as cache key
-    cache_name = url.split("/")[-1]
-    cache_path = CACHE_DIR / cache_name
-
-    # Always cache as PNG to avoid JPEG/RGBA conflicts
-    cache_path = cache_path.with_suffix(".png")
-
-    if cache_path.exists():
-        return Image.open(cache_path).convert("RGBA")
-
-    data = _fetch_url(url)
-    img = Image.open(BytesIO(data)).convert("RGBA")
-    img.save(cache_path, "PNG")
-    return img
-
-
-def find_font(size: int) -> ImageFont.FreeTypeFont:
-    """Find a bold font for meme text. Tries Impact, then falls back."""
-    candidates = [
-        "/usr/share/fonts/truetype/msttcorefonts/Impact.ttf",
-        "/usr/share/fonts/truetype/liberation/LiberationSans-Bold.ttf",
-        "/usr/share/fonts/liberation-sans/LiberationSans-Bold.ttf",
-        "/usr/share/fonts/truetype/dejavu/DejaVuSans-Bold.ttf",
-        "/usr/share/fonts/dejavu-sans/DejaVuSans-Bold.ttf",
-        "/System/Library/Fonts/Helvetica.ttc",
-        "/System/Library/Fonts/SFCompact.ttf",
-    ]
-    for path in candidates:
-        if os.path.exists(path):
-            try:
-                return ImageFont.truetype(path, size)
-            except (OSError, IOError):
-                continue
-    # Last resort: Pillow default
-    try:
-        return ImageFont.truetype("DejaVuSans-Bold", size)
-    except (OSError, IOError):
-        return ImageFont.load_default()
-
-
-def _wrap_text(text: str, font: ImageFont.FreeTypeFont, max_width: int) -> str:
-    """Word-wrap text to fit within max_width pixels. Never breaks mid-word."""
-    words = text.split()
-    if not words:
-        return text
-    lines = []
-    current_line = words[0]
-    for word in words[1:]:
-        test_line = current_line + " " + word
-        if font.getlength(test_line) <= max_width:
-            current_line = test_line
-        else:
-            lines.append(current_line)
-            current_line = word
-    lines.append(current_line)
-    return "\n".join(lines)
-
-
-def draw_outlined_text(
-    draw: ImageDraw.ImageDraw,
-    text: str,
-    x: int,
-    y: int,
-    font_size: int,
-    max_width: int,
-    align: str = "center",
-):
-    """Draw white text with black outline, auto-scaled to fit max_width."""
-    # Auto-scale: reduce font size until text fits reasonably
-    size = font_size
-    while size > 12:
-        font = find_font(size)
-        wrapped = _wrap_text(text, font, max_width)
-        bbox = draw.multiline_textbbox((0, 0), wrapped, font=font, align=align)
-        text_w = bbox[2] - bbox[0]
-        line_count = wrapped.count("\n") + 1
-        # Accept if width fits and not too many lines
-        if text_w <= max_width * 1.05 and line_count <= 4:
-            break
-        size -= 2
-    else:
-        font = find_font(size)
-        wrapped = _wrap_text(text, font, max_width)
-
-    # Measure total text block
-    bbox = draw.multiline_textbbox((0, 0), wrapped, font=font, align=align)
-    text_w = bbox[2] - bbox[0]
-    text_h = bbox[3] - bbox[1]
-
-    # Center horizontally at x, vertically at y
-    tx = x - text_w // 2
-    ty = y - text_h // 2
-
-    # Draw outline (black border)
-    outline_range = max(2, font.size // 18)
-    for dx in range(-outline_range, outline_range + 1):
-        for dy in range(-outline_range, outline_range + 1):
-            if dx == 0 and dy == 0:
-                continue
-            draw.multiline_text(
-                (tx + dx, ty + dy), wrapped, font=font, fill="black", align=align
-            )
-    # Draw main text (white)
-    draw.multiline_text((tx, ty), wrapped, font=font, fill="white", align=align)
-
-
-def _overlay_on_image(img: Image.Image, texts: list, fields: list) -> Image.Image:
-    """Overlay meme text directly on an image using field positions."""
-    draw = ImageDraw.Draw(img)
-    w, h = img.size
-    base_font_size = max(16, min(w, h) // 12)
-
-    for i, field in enumerate(fields):
-        if i >= len(texts):
-            break
-        text = texts[i].strip()
-        if not text:
-            continue
-        fx = int(field["x_pct"] * w)
-        fy = int(field["y_pct"] * h)
-        fw = int(field["w_pct"] * w)
-        draw_outlined_text(draw, text, fx, fy, base_font_size, fw, field.get("align", "center"))
-    return img
-
-
-def _add_bars(img: Image.Image, texts: list) -> Image.Image:
-    """Add black bars with white text above/below the image.
-
-    Distributes texts across bars: first text on top bar, last text on
-    bottom bar, any middle texts overlaid on the image center.
-    """
-    w, h = img.size
-    bar_font_size = max(20, w // 16)
-    font = find_font(bar_font_size)
-    padding = bar_font_size // 2
-
-    top_text = texts[0].strip() if texts else ""
-    bottom_text = texts[-1].strip() if len(texts) > 1 else ""
-    middle_texts = [t.strip() for t in texts[1:-1]] if len(texts) > 2 else []
-
-    def _measure_bar(text: str) -> int:
-        if not text:
-            return 0
-        wrapped = _wrap_text(text, font, int(w * 0.92))
-        bbox = ImageDraw.Draw(Image.new("RGB", (1, 1))).multiline_textbbox(
-            (0, 0), wrapped, font=font, align="center"
-        )
-        return (bbox[3] - bbox[1]) + padding * 2
-
-    top_h = _measure_bar(top_text)
-    bottom_h = _measure_bar(bottom_text)
-    new_h = h + top_h + bottom_h
-
-    canvas = Image.new("RGB", (w, new_h), (0, 0, 0))
-    canvas.paste(img.convert("RGB"), (0, top_h))
-    draw = ImageDraw.Draw(canvas)
-
-    if top_text:
-        wrapped = _wrap_text(top_text, font, int(w * 0.92))
-        bbox = draw.multiline_textbbox((0, 0), wrapped, font=font, align="center")
-        tw = bbox[2] - bbox[0]
-        th = bbox[3] - bbox[1]
-        tx = (w - tw) // 2
-        ty = (top_h - th) // 2
-        draw.multiline_text((tx, ty), wrapped, font=font, fill="white", align="center")
-
-    if bottom_text:
-        wrapped = _wrap_text(bottom_text, font, int(w * 0.92))
-        bbox = draw.multiline_textbbox((0, 0), wrapped, font=font, align="center")
-        tw = bbox[2] - bbox[0]
-        th = bbox[3] - bbox[1]
-        tx = (w - tw) // 2
-        ty = top_h + h + (bottom_h - th) // 2
-        draw.multiline_text((tx, ty), wrapped, font=font, fill="white", align="center")
-
-    # Overlay any middle texts centered on the image
-    if middle_texts:
-        mid_fields = _default_fields(len(middle_texts))
-        # Shift y positions to account for top bar offset
-        for field in mid_fields:
-            field["y_pct"] = (top_h + field["y_pct"] * h) / new_h
-            field["w_pct"] = 0.90
-        _overlay_on_image(canvas, middle_texts, mid_fields)
-
-    return canvas
-
-
-def generate_meme(template_id: str, texts: list[str], output_path: str) -> str:
-    """Generate a meme from a template and save it. Returns the path."""
-    tmpl = resolve_template(template_id)
-
-    if tmpl is None:
-        print(f"Unknown template: {template_id}", file=sys.stderr)
-        print("Use --list to see curated templates or --search to find imgflip templates.", file=sys.stderr)
-        sys.exit(1)
-
-    fields = tmpl["fields"]
-    print(f"Using template: {tmpl['name']} ({tmpl['source']}, {len(fields)} fields)", file=sys.stderr)
-
-    img = get_template_image(tmpl["url"])
-    img = _overlay_on_image(img, texts, fields)
-
-    output = Path(output_path)
-    if output.suffix.lower() in (".jpg", ".jpeg"):
-        img = img.convert("RGB")
-    img.save(str(output), quality=95)
-    return str(output)
-
-
-def generate_from_image(
-    image_path: str, texts: list[str], output_path: str, use_bars: bool = False
-) -> str:
-    """Generate a meme from a custom image (e.g. AI-generated). Returns the path."""
-    img = Image.open(image_path).convert("RGBA")
-    print(f"Custom image: {img.size[0]}x{img.size[1]}, {len(texts)} text(s), mode={'bars' if use_bars else 'overlay'}", file=sys.stderr)
-
-    if use_bars:
-        result = _add_bars(img, texts)
-    else:
-        fields = _default_fields(len(texts))
-        result = _overlay_on_image(img, texts, fields)
-
-    output = Path(output_path)
-    if output.suffix.lower() in (".jpg", ".jpeg"):
-        result = result.convert("RGB")
-    result.save(str(output), quality=95)
-    return str(output)
-
-
-def list_templates():
-    """Print curated templates with custom positioning."""
-    templates = load_curated_templates()
-    print(f"{'ID':<25} {'Name':<30} {'Fields':<8} Best for")
-    print("-" * 90)
-    for tid, tmpl in sorted(templates.items()):
-        fields = len(tmpl["fields"])
-        print(f"{tid:<25} {tmpl['name']:<30} {fields:<8} {tmpl['best_for']}")
-    print(f"\n{len(templates)} curated templates with custom text positioning.")
-    print("Use --search to find any of the ~100 popular imgflip templates.")
-
-
-def search_templates(query: str):
-    """Search imgflip templates by name."""
-    imgflip_memes = fetch_imgflip_templates()
-    curated = load_curated_templates()
-    curated_slugs = {_slugify(t["name"]) for t in curated.values()}
-    query_lower = query.lower()
-
-    matches = []
-    for meme in imgflip_memes:
-        if query_lower in meme["name"].lower():
-            slug = _slugify(meme["name"])
-            has_custom = "curated" if slug in curated_slugs else "default"
-            matches.append((meme["name"], meme["id"], meme.get("box_count", 2), has_custom))
-
-    if not matches:
-        print(f"No templates found matching '{query}'")
-        return
-
-    print(f"{'Name':<40} {'ID':<12} {'Fields':<8} Positioning")
-    print("-" * 75)
-    for name, mid, boxes, positioning in matches:
-        print(f"{name:<40} {mid:<12} {boxes:<8} {positioning}")
-    print(f"\n{len(matches)} template(s) found. Use the name or ID as the first argument.")
-
-
-if __name__ == "__main__":
-    if len(sys.argv) < 2:
-        print("Usage: generate_meme.py <template_id_or_name> <output_path> <text1> [text2] ...")
-        print("       generate_meme.py --image <path> [--bars] <output_path> <text1> [text2] ...")
-        print("       generate_meme.py --list              # curated templates")
-        print("       generate_meme.py --search <query>    # search all imgflip templates")
-        sys.exit(1)
-
-    if sys.argv[1] == "--list":
-        list_templates()
-        sys.exit(0)
-
-    if sys.argv[1] == "--search":
-        if len(sys.argv) < 3:
-            print("Usage: generate_meme.py --search <query>")
-            sys.exit(1)
-        search_templates(sys.argv[2])
-        sys.exit(0)
-
-    if sys.argv[1] == "--image":
-        # Custom image mode: --image <path> [--bars] <output> <text1> ...
-        args = sys.argv[2:]
-        if len(args) < 3:
-            print("Usage: generate_meme.py --image <image_path> [--bars] <output_path> <text1> ...")
-            sys.exit(1)
-        image_path = args.pop(0)
-        use_bars = False
-        if args and args[0] == "--bars":
-            use_bars = True
-            args.pop(0)
-        if len(args) < 2:
-            print("Need at least: output_path and one text argument")
-            sys.exit(1)
-        output_path = args.pop(0)
-        result = generate_from_image(image_path, args, output_path, use_bars=use_bars)
-        print(f"Meme saved to: {result}")
-        sys.exit(0)
-
-    if len(sys.argv) < 4:
-        print("Need at least: template_id_or_name, output_path, and one text argument")
-        sys.exit(1)
-
-    template_id = sys.argv[1]
-    output_path = sys.argv[2]
-    texts = sys.argv[3:]
-
-    result = generate_meme(template_id, texts, output_path)
-    print(f"Meme saved to: {result}")

optional-skills/creative/meme-generation/scripts/templates.json

@@ -1,97 +0,0 @@
-{
-  "this-is-fine": {
-    "name": "This is Fine",
-    "url": "https://i.imgflip.com/wxica.jpg",
-    "best_for": "chaos, denial, pretending things are okay",
-    "fields": [
-      {"name": "top", "x_pct": 0.5, "y_pct": 0.08, "w_pct": 0.95, "align": "center"},
-      {"name": "bottom", "x_pct": 0.5, "y_pct": 0.92, "w_pct": 0.95, "align": "center"}
-    ]
-  },
-  "drake": {
-    "name": "Drake Hotline Bling",
-    "url": "https://i.imgflip.com/30b1gx.jpg",
-    "best_for": "rejecting one thing, preferring another",
-    "fields": [
-      {"name": "reject", "x_pct": 0.73, "y_pct": 0.25, "w_pct": 0.45, "align": "center"},
-      {"name": "approve", "x_pct": 0.73, "y_pct": 0.75, "w_pct": 0.45, "align": "center"}
-    ]
-  },
-  "distracted-boyfriend": {
-    "name": "Distracted Boyfriend",
-    "url": "https://i.imgflip.com/1ur9b0.jpg",
-    "best_for": "distraction, shifting priorities, temptation",
-    "fields": [
-      {"name": "distraction", "x_pct": 0.18, "y_pct": 0.90, "w_pct": 0.30, "align": "center"},
-      {"name": "current", "x_pct": 0.55, "y_pct": 0.90, "w_pct": 0.30, "align": "center"},
-      {"name": "person", "x_pct": 0.82, "y_pct": 0.90, "w_pct": 0.30, "align": "center"}
-    ]
-  },
-  "two-buttons": {
-    "name": "Two Buttons",
-    "url": "https://i.imgflip.com/1g8my4.jpg",
-    "best_for": "impossible choice, dilemma between two options",
-    "fields": [
-      {"name": "left_button", "x_pct": 0.30, "y_pct": 0.20, "w_pct": 0.28, "align": "center"},
-      {"name": "right_button", "x_pct": 0.62, "y_pct": 0.12, "w_pct": 0.28, "align": "center"},
-      {"name": "person", "x_pct": 0.5, "y_pct": 0.85, "w_pct": 0.90, "align": "center"}
-    ]
-  },
-  "expanding-brain": {
-    "name": "Expanding Brain",
-    "url": "https://i.imgflip.com/1jwhww.jpg",
-    "best_for": "escalating irony, increasingly absurd ideas",
-    "fields": [
-      {"name": "level1", "x_pct": 0.25, "y_pct": 0.12, "w_pct": 0.45, "align": "center"},
-      {"name": "level2", "x_pct": 0.25, "y_pct": 0.38, "w_pct": 0.45, "align": "center"},
-      {"name": "level3", "x_pct": 0.25, "y_pct": 0.63, "w_pct": 0.45, "align": "center"},
-      {"name": "level4", "x_pct": 0.25, "y_pct": 0.88, "w_pct": 0.45, "align": "center"}
-    ]
-  },
-  "change-my-mind": {
-    "name": "Change My Mind",
-    "url": "https://i.imgflip.com/24y43o.jpg",
-    "best_for": "strong or ironic opinion, controversial take",
-    "fields": [
-      {"name": "statement", "x_pct": 0.58, "y_pct": 0.78, "w_pct": 0.35, "align": "center"}
-    ]
-  },
-  "woman-yelling-at-cat": {
-    "name": "Woman Yelling at Cat",
-    "url": "https://i.imgflip.com/345v97.jpg",
-    "best_for": "argument, blame, misunderstanding",
-    "fields": [
-      {"name": "woman", "x_pct": 0.27, "y_pct": 0.10, "w_pct": 0.50, "align": "center"},
-      {"name": "cat", "x_pct": 0.76, "y_pct": 0.10, "w_pct": 0.44, "align": "center"}
-    ]
-  },
-  "one-does-not-simply": {
-    "name": "One Does Not Simply",
-    "url": "https://i.imgflip.com/1bij.jpg",
-    "best_for": "something that sounds easy but is actually hard",
-    "fields": [
-      {"name": "top", "x_pct": 0.5, "y_pct": 0.08, "w_pct": 0.95, "align": "center"},
-      {"name": "bottom", "x_pct": 0.5, "y_pct": 0.92, "w_pct": 0.95, "align": "center"}
-    ]
-  },
-  "grus-plan": {
-    "name": "Gru's Plan",
-    "url": "https://i.imgflip.com/26jxvs.jpg",
-    "best_for": "a plan that backfires, unexpected consequence",
-    "fields": [
-      {"name": "step1", "x_pct": 0.5, "y_pct": 0.05, "w_pct": 0.45, "align": "center"},
-      {"name": "step2", "x_pct": 0.5, "y_pct": 0.30, "w_pct": 0.45, "align": "center"},
-      {"name": "step3", "x_pct": 0.5, "y_pct": 0.55, "w_pct": 0.45, "align": "center"},
-      {"name": "realization", "x_pct": 0.5, "y_pct": 0.80, "w_pct": 0.45, "align": "center"}
-    ]
-  },
-  "batman-slapping-robin": {
-    "name": "Batman Slapping Robin",
-    "url": "https://i.imgflip.com/9ehk.jpg",
-    "best_for": "shutting down a bad idea, correcting someone",
-    "fields": [
-      {"name": "robin", "x_pct": 0.28, "y_pct": 0.08, "w_pct": 0.50, "align": "center"},
-      {"name": "batman", "x_pct": 0.72, "y_pct": 0.08, "w_pct": 0.50, "align": "center"}
-    ]
-  }
-}

optional-skills/mcp/DESCRIPTION.md

@@ -1,3 +0,0 @@
-# MCP
-
-Skills for building, testing, and deploying MCP (Model Context Protocol) servers.

optional-skills/mcp/fastmcp/SKILL.md

@@ -1,299 +0,0 @@
----
-name: fastmcp
-description: Build, test, inspect, install, and deploy MCP servers with FastMCP in Python. Use when creating a new MCP server, wrapping an API or database as MCP tools, exposing resources or prompts, or preparing a FastMCP server for Claude Code, Cursor, or HTTP deployment.
-version: 1.0.0
-author: Hermes Agent
-license: MIT
-metadata:
-  hermes:
-    tags: [MCP, FastMCP, Python, Tools, Resources, Prompts, Deployment]
-    homepage: https://gofastmcp.com
-    related_skills: [native-mcp, mcporter]
-prerequisites:
-  commands: [python3]
----
-
-# FastMCP
-
-Build MCP servers in Python with FastMCP, validate them locally, install them into MCP clients, and deploy them as HTTP endpoints.
-
-## When to Use
-
-Use this skill when the task is to:
-
-- create a new MCP server in Python
-- wrap an API, database, CLI, or file-processing workflow as MCP tools
-- expose resources or prompts in addition to tools
-- smoke-test a server with the FastMCP CLI before wiring it into Hermes or another client
-- install a server into Claude Code, Claude Desktop, Cursor, or a similar MCP client
-- prepare a FastMCP server repo for HTTP deployment
-
-Use `native-mcp` when the server already exists and only needs to be connected to Hermes. Use `mcporter` when the goal is ad-hoc CLI access to an existing MCP server instead of building one.
-
-## Prerequisites
-
-Install FastMCP in the working environment first:
-
-```bash
-pip install fastmcp
-fastmcp version
-```
-
-For the API template, install `httpx` if it is not already present:
-
-```bash
-pip install httpx
-```
-
-## Included Files
-
-### Templates
-
-- `templates/api_wrapper.py` - REST API wrapper with auth header support
-- `templates/database_server.py` - read-only SQLite query server
-- `templates/file_processor.py` - text-file inspection and search server
-
-### Scripts
-
-- `scripts/scaffold_fastmcp.py` - copy a starter template and replace the server name placeholder
-
-### References
-
-- `references/fastmcp-cli.md` - FastMCP CLI workflow, installation targets, and deployment checks
-
-## Workflow
-
-### 1. Pick the Smallest Viable Server Shape
-
-Choose the narrowest useful surface area first:
-
-- API wrapper: start with 1-3 high-value endpoints, not the whole API
-- database server: expose read-only introspection and a constrained query path
-- file processor: expose deterministic operations with explicit path arguments
-- prompts/resources: add only when the client needs reusable prompt templates or discoverable documents
-
-Prefer a thin server with good names, docstrings, and schemas over a large server with vague tools.
-
-### 2. Scaffold from a Template
-
-Copy a template directly or use the scaffold helper:
-
-```bash
-python ~/.hermes/skills/mcp/fastmcp/scripts/scaffold_fastmcp.py \
-  --template api_wrapper \
-  --name "Acme API" \
-  --output ./acme_server.py
-```
-
-Available templates:
-
-```bash
-python ~/.hermes/skills/mcp/fastmcp/scripts/scaffold_fastmcp.py --list
-```
-
-If copying manually, replace `__SERVER_NAME__` with a real server name.
-
-### 3. Implement Tools First
-
-Start with `@mcp.tool` functions before adding resources or prompts.
-
-Rules for tool design:
-
-- Give every tool a concrete verb-based name
-- Write docstrings as user-facing tool descriptions
-- Keep parameters explicit and typed
-- Return structured JSON-safe data where possible
-- Validate unsafe inputs early
-- Prefer read-only behavior by default for first versions
-
-Good tool examples:
-
-- `get_customer`
-- `search_tickets`
-- `describe_table`
-- `summarize_text_file`
-
-Weak tool examples:
-
-- `run`
-- `process`
-- `do_thing`
-
-### 4. Add Resources and Prompts Only When They Help
-
-Add `@mcp.resource` when the client benefits from fetching stable read-only content such as schemas, policy docs, or generated reports.
-
-Add `@mcp.prompt` when the server should provide a reusable prompt template for a known workflow.
-
-Do not turn every document into a prompt. Prefer:
-
-- tools for actions
-- resources for data/document retrieval
-- prompts for reusable LLM instructions
-
-### 5. Test the Server Before Integrating It Anywhere
-
-Use the FastMCP CLI for local validation:
-
-```bash
-fastmcp inspect acme_server.py:mcp
-fastmcp list acme_server.py --json
-fastmcp call acme_server.py search_resources query=router limit=5 --json
-```
-
-For fast iterative debugging, run the server locally:
-
-```bash
-fastmcp run acme_server.py:mcp
-```
-
-To test HTTP transport locally:
-
-```bash
-fastmcp run acme_server.py:mcp --transport http --host 127.0.0.1 --port 8000
-fastmcp list http://127.0.0.1:8000/mcp --json
-fastmcp call http://127.0.0.1:8000/mcp search_resources query=router --json
-```
-
-Always run at least one real `fastmcp call` against each new tool before claiming the server works.
-
-### 6. Install into a Client When Local Validation Passes
-
-FastMCP can register the server with supported MCP clients:
-
-```bash
-fastmcp install claude-code acme_server.py
-fastmcp install claude-desktop acme_server.py
-fastmcp install cursor acme_server.py -e .
-```
-
-Use `fastmcp discover` to inspect named MCP servers already configured on the machine.
-
-When the goal is Hermes integration, either:
-
-- configure the server in `~/.hermes/config.yaml` using the `native-mcp` skill, or
-- keep using FastMCP CLI commands during development until the interface stabilizes
-
-### 7. Deploy After the Local Contract Is Stable
-
-For managed hosting, Prefect Horizon is the path FastMCP documents most directly. Before deployment:
-
-```bash
-fastmcp inspect acme_server.py:mcp
-```
-
-Make sure the repo contains:
-
-- a Python file with the FastMCP server object
-- `requirements.txt` or `pyproject.toml`
-- any environment-variable documentation needed for deployment
-
-For generic HTTP hosting, validate the HTTP transport locally first, then deploy on any Python-compatible platform that can expose the server port.
-
-## Common Patterns
-
-### API Wrapper Pattern
-
-Use when exposing a REST or HTTP API as MCP tools.
-
-Recommended first slice:
-
-- one read path
-- one list/search path
-- optional health check
-
-Implementation notes:
-
-- keep auth in environment variables, not hardcoded
-- centralize request logic in one helper
-- surface API errors with concise context
-- normalize inconsistent upstream payloads before returning them
-
-Start from `templates/api_wrapper.py`.
-
-### Database Pattern
-
-Use when exposing safe query and inspection capabilities.
-
-Recommended first slice:
-
-- `list_tables`
-- `describe_table`
-- one constrained read query tool
-
-Implementation notes:
-
-- default to read-only DB access
-- reject non-`SELECT` SQL in early versions
-- limit row counts
-- return rows plus column names
-
-Start from `templates/database_server.py`.
-
-### File Processor Pattern
-
-Use when the server needs to inspect or transform files on demand.
-
-Recommended first slice:
-
-- summarize file contents
-- search within files
-- extract deterministic metadata
-
-Implementation notes:
-
-- accept explicit file paths
-- check for missing files and encoding failures
-- cap previews and result counts
-- avoid shelling out unless a specific external tool is required
-
-Start from `templates/file_processor.py`.
-
-## Quality Bar
-
-Before handing off a FastMCP server, verify all of the following:
-
-- server imports cleanly
-- `fastmcp inspect <file.py:mcp>` succeeds
-- `fastmcp list <server spec> --json` succeeds
-- every new tool has at least one real `fastmcp call`
-- environment variables are documented
-- the tool surface is small enough to understand without guesswork
-
-## Troubleshooting
-
-### FastMCP command missing
-
-Install the package in the active environment:
-
-```bash
-pip install fastmcp
-fastmcp version
-```
-
-### `fastmcp inspect` fails
-
-Check that:
-
-- the file imports without side effects that crash
-- the FastMCP instance is named correctly in `<file.py:object>`
-- optional dependencies from the template are installed
-
-### Tool works in Python but not through CLI
-
-Run:
-
-```bash
-fastmcp list server.py --json
-fastmcp call server.py your_tool_name --json
-```
-
-This usually exposes naming mismatches, missing required arguments, or non-serializable return values.
-
-### Hermes cannot see the deployed server
-
-The server-building part may be correct while the Hermes config is not. Load the `native-mcp` skill and configure the server in `~/.hermes/config.yaml`, then restart Hermes.
-
-## References
-
-For CLI details, install targets, and deployment checks, read `references/fastmcp-cli.md`.

optional-skills/mcp/fastmcp/references/fastmcp-cli.md

@@ -1,110 +0,0 @@
-# FastMCP CLI Reference
-
-Use this file when the task needs exact FastMCP CLI workflows rather than the higher-level guidance in `SKILL.md`.
-
-## Install and Verify
-
-```bash
-pip install fastmcp
-fastmcp version
-```
-
-FastMCP documents `pip install fastmcp` and `fastmcp version` as the baseline installation and verification path.
-
-## Run a Server
-
-Run a server object from a Python file:
-
-```bash
-fastmcp run server.py:mcp
-```
-
-Run the same server over HTTP:
-
-```bash
-fastmcp run server.py:mcp --transport http --host 127.0.0.1 --port 8000
-```
-
-## Inspect a Server
-
-Inspect what FastMCP will expose:
-
-```bash
-fastmcp inspect server.py:mcp
-```
-
-This is also the check FastMCP recommends before deploying to Prefect Horizon.
-
-## List and Call Tools
-
-List tools from a Python file:
-
-```bash
-fastmcp list server.py --json
-```
-
-List tools from an HTTP endpoint:
-
-```bash
-fastmcp list http://127.0.0.1:8000/mcp --json
-```
-
-Call a tool with key-value arguments:
-
-```bash
-fastmcp call server.py search_resources query=router limit=5 --json
-```
-
-Call a tool with a full JSON input payload:
-
-```bash
-fastmcp call server.py create_item '{"name": "Widget", "tags": ["sale"]}' --json
-```
-
-## Discover Named MCP Servers
-
-Find named servers already configured in local MCP-aware tools:
-
-```bash
-fastmcp discover
-```
-
-FastMCP documents name-based resolution for Claude Desktop, Claude Code, Cursor, Gemini, Goose, and `./mcp.json`.
-
-## Install into MCP Clients
-
-Register a server with common clients:
-
-```bash
-fastmcp install claude-code server.py
-fastmcp install claude-desktop server.py
-fastmcp install cursor server.py -e .
-```
-
-FastMCP notes that client installs run in isolated environments, so declare dependencies explicitly when needed with flags such as `--with`, `--env-file`, or editable installs.
-
-## Deployment Checks
-
-### Prefect Horizon
-
-Before pushing to Horizon:
-
-```bash
-fastmcp inspect server.py:mcp
-```
-
-FastMCP’s Horizon docs expect:
-
-- a GitHub repo
-- a Python file containing the FastMCP server object
-- dependencies declared in `requirements.txt` or `pyproject.toml`
-- an entrypoint like `main.py:mcp`
-
-### Generic HTTP Hosting
-
-Before shipping to any other host:
-
-1. Start the server locally with HTTP transport.
-2. Verify `fastmcp list` against the local `/mcp` URL.
-3. Verify at least one `fastmcp call`.
-4. Document required environment variables.

optional-skills/mcp/fastmcp/scripts/scaffold_fastmcp.py

@@ -1,56 +0,0 @@
-#!/usr/bin/env python3
-"""Copy a FastMCP starter template into a working file."""
-
-from __future__ import annotations
-
-import argparse
-from pathlib import Path
-
-
-SCRIPT_DIR = Path(__file__).resolve().parent
-SKILL_DIR = SCRIPT_DIR.parent
-TEMPLATE_DIR = SKILL_DIR / "templates"
-PLACEHOLDER = "__SERVER_NAME__"
-
-
-def list_templates() -> list[str]:
-    return sorted(path.stem for path in TEMPLATE_DIR.glob("*.py"))
-
-
-def render_template(template_name: str, server_name: str) -> str:
-    template_path = TEMPLATE_DIR / f"{template_name}.py"
-    if not template_path.exists():
-        available = ", ".join(list_templates())
-        raise SystemExit(f"Unknown template '{template_name}'. Available: {available}")
-    return template_path.read_text(encoding="utf-8").replace(PLACEHOLDER, server_name)
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("--template", help="Template name without .py suffix")
-    parser.add_argument("--name", help="FastMCP server display name")
-    parser.add_argument("--output", help="Destination Python file path")
-    parser.add_argument("--force", action="store_true", help="Overwrite an existing output file")
-    parser.add_argument("--list", action="store_true", help="List available templates and exit")
-    args = parser.parse_args()
-
-    if args.list:
-        for name in list_templates():
-            print(name)
-        return 0
-
-    if not args.template or not args.name or not args.output:
-        parser.error("--template, --name, and --output are required unless --list is used")
-
-    output_path = Path(args.output).expanduser()
-    if output_path.exists() and not args.force:
-        raise SystemExit(f"Refusing to overwrite existing file: {output_path}")
-
-    output_path.parent.mkdir(parents=True, exist_ok=True)
-    output_path.write_text(render_template(args.template, args.name), encoding="utf-8")
-    print(f"Wrote {output_path}")
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())

optional-skills/mcp/fastmcp/templates/api_wrapper.py

@@ -1,54 +0,0 @@
-from __future__ import annotations
-
-import os
-from typing import Any
-
-import httpx
-from fastmcp import FastMCP
-
-
-mcp = FastMCP("__SERVER_NAME__")
-
-API_BASE_URL = os.getenv("API_BASE_URL", "https://api.example.com")
-API_TOKEN = os.getenv("API_TOKEN")
-REQUEST_TIMEOUT = float(os.getenv("API_TIMEOUT_SECONDS", "20"))
-
-
-def _headers() -> dict[str, str]:
-    headers = {"Accept": "application/json"}
-    if API_TOKEN:
-        headers["Authorization"] = f"Bearer {API_TOKEN}"
-    return headers
-
-
-def _request(method: str, path: str, *, params: dict[str, Any] | None = None) -> Any:
-    url = f"{API_BASE_URL.rstrip('/')}/{path.lstrip('/')}"
-    with httpx.Client(timeout=REQUEST_TIMEOUT, headers=_headers()) as client:
-        response = client.request(method, url, params=params)
-        response.raise_for_status()
-        return response.json()
-
-
-@mcp.tool
-def health_check() -> dict[str, Any]:
-    """Check whether the upstream API is reachable."""
-    payload = _request("GET", "/health")
-    return {"base_url": API_BASE_URL, "result": payload}
-
-
-@mcp.tool
-def get_resource(resource_id: str) -> dict[str, Any]:
-    """Fetch one resource by ID from the upstream API."""
-    payload = _request("GET", f"/resources/{resource_id}")
-    return {"resource_id": resource_id, "data": payload}
-
-
-@mcp.tool
-def search_resources(query: str, limit: int = 10) -> dict[str, Any]:
-    """Search upstream resources by query string."""
-    payload = _request("GET", "/resources", params={"q": query, "limit": limit})
-    return {"query": query, "limit": limit, "results": payload}
-
-
-if __name__ == "__main__":
-    mcp.run()

optional-skills/mcp/fastmcp/templates/database_server.py

@@ -1,77 +0,0 @@
-from __future__ import annotations
-
-import os
-import re
-import sqlite3
-from typing import Any
-
-from fastmcp import FastMCP
-
-
-mcp = FastMCP("__SERVER_NAME__")
-
-DATABASE_PATH = os.getenv("SQLITE_PATH", "./app.db")
-MAX_ROWS = int(os.getenv("SQLITE_MAX_ROWS", "200"))
-TABLE_NAME_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
-
-
-def _connect() -> sqlite3.Connection:
-    return sqlite3.connect(f"file:{DATABASE_PATH}?mode=ro", uri=True)
-
-
-def _reject_mutation(sql: str) -> None:
-    normalized = sql.strip().lower()
-    if not normalized.startswith("select"):
-        raise ValueError("Only SELECT queries are allowed")
-
-
-def _validate_table_name(table_name: str) -> str:
-    if not TABLE_NAME_RE.fullmatch(table_name):
-        raise ValueError("Invalid table name")
-    return table_name
-
-
-@mcp.tool
-def list_tables() -> list[str]:
-    """List user-defined SQLite tables."""
-    with _connect() as conn:
-        rows = conn.execute(
-            "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' ORDER BY name"
-        ).fetchall()
-    return [row[0] for row in rows]
-
-
-@mcp.tool
-def describe_table(table_name: str) -> list[dict[str, Any]]:
-    """Describe columns for a SQLite table."""
-    safe_table_name = _validate_table_name(table_name)
-    with _connect() as conn:
-        rows = conn.execute(f"PRAGMA table_info({safe_table_name})").fetchall()
-    return [
-        {
-            "cid": row[0],
-            "name": row[1],
-            "type": row[2],
-            "notnull": bool(row[3]),
-            "default": row[4],
-            "pk": bool(row[5]),
-        }
-        for row in rows
-    ]
-
-
-@mcp.tool
-def query(sql: str, limit: int = 50) -> dict[str, Any]:
-    """Run a read-only SELECT query and return rows plus column names."""
-    _reject_mutation(sql)
-    safe_limit = max(0, min(limit, MAX_ROWS))
-    wrapped_sql = f"SELECT * FROM ({sql.strip().rstrip(';')}) LIMIT {safe_limit}"
-    with _connect() as conn:
-        cursor = conn.execute(wrapped_sql)
-        columns = [column[0] for column in cursor.description or []]
-        rows = [dict(zip(columns, row)) for row in cursor.fetchall()]
-    return {"limit": safe_limit, "columns": columns, "rows": rows}
-
-
-if __name__ == "__main__":
-    mcp.run()

optional-skills/mcp/fastmcp/templates/file_processor.py

@@ -1,55 +0,0 @@
-from __future__ import annotations
-
-from pathlib import Path
-from typing import Any
-
-from fastmcp import FastMCP
-
-
-mcp = FastMCP("__SERVER_NAME__")
-
-
-def _read_text(path: str) -> str:
-    file_path = Path(path).expanduser()
-    try:
-        return file_path.read_text(encoding="utf-8")
-    except FileNotFoundError as exc:
-        raise ValueError(f"File not found: {file_path}") from exc
-    except UnicodeDecodeError as exc:
-        raise ValueError(f"File is not valid UTF-8 text: {file_path}") from exc
-
-
-@mcp.tool
-def summarize_text_file(path: str, preview_chars: int = 1200) -> dict[str, int | str]:
-    """Return basic metadata and a preview for a UTF-8 text file."""
-    file_path = Path(path).expanduser()
-    text = _read_text(path)
-    return {
-        "path": str(file_path),
-        "characters": len(text),
-        "lines": len(text.splitlines()),
-        "preview": text[:preview_chars],
-    }
-
-
-@mcp.tool
-def search_text_file(path: str, needle: str, max_matches: int = 20) -> dict[str, Any]:
-    """Find matching lines in a UTF-8 text file."""
-    file_path = Path(path).expanduser()
-    matches: list[dict[str, Any]] = []
-    for line_number, line in enumerate(_read_text(path).splitlines(), start=1):
-        if needle.lower() in line.lower():
-            matches.append({"line_number": line_number, "line": line})
-            if len(matches) >= max_matches:
-                break
-    return {"path": str(file_path), "needle": needle, "matches": matches}
-
-
-@mcp.resource("file://{path}")
-def read_file_resource(path: str) -> str:
-    """Expose a text file as a resource."""
-    return _read_text(path)
-
-
-if __name__ == "__main__":
-    mcp.run()

optional-skills/migration/openclaw-migration/scripts/openclaw_to_hermes.py

@@ -119,70 +119,6 @@ MIGRATION_OPTION_METADATA: Dict[str, Dict[str, str]] = {
         "label": "Archive unmapped docs",
         "description": "Archive compatible-but-unmapped docs for later manual review.",
     },
-    "mcp-servers": {
-        "label": "MCP servers",
-        "description": "Import MCP server definitions from OpenClaw into Hermes config.yaml.",
-    },
-    "plugins-config": {
-        "label": "Plugins configuration",
-        "description": "Archive OpenClaw plugin configuration and installed extensions for manual review.",
-    },
-    "cron-jobs": {
-        "label": "Cron / scheduled tasks",
-        "description": "Import cron job definitions. Archive for manual recreation via 'hermes cron'.",
-    },
-    "hooks-config": {
-        "label": "Hooks and webhooks",
-        "description": "Archive OpenClaw hook configuration (internal hooks, webhooks, Gmail integration).",
-    },
-    "agent-config": {
-        "label": "Agent defaults and multi-agent setup",
-        "description": "Import agent defaults (compaction, context, thinking) into Hermes config. Archive multi-agent list.",
-    },
-    "gateway-config": {
-        "label": "Gateway configuration",
-        "description": "Import gateway port and auth settings. Archive full gateway config for manual setup.",
-    },
-    "session-config": {
-        "label": "Session configuration",
-        "description": "Import session reset policies (daily/idle) into Hermes session_reset config.",
-    },
-    "full-providers": {
-        "label": "Full model provider definitions",
-        "description": "Import custom model providers (baseUrl, apiType, headers) into Hermes custom_providers.",
-    },
-    "deep-channels": {
-        "label": "Deep channel configuration",
-        "description": "Import extended channel settings (Matrix, Mattermost, IRC, group configs). Archive complex settings.",
-    },
-    "browser-config": {
-        "label": "Browser configuration",
-        "description": "Import browser automation settings into Hermes config.yaml.",
-    },
-    "tools-config": {
-        "label": "Tools configuration",
-        "description": "Import tool settings (exec timeout, sandbox, web search) into Hermes config.yaml.",
-    },
-    "approvals-config": {
-        "label": "Approval rules",
-        "description": "Import approval mode and rules into Hermes config.yaml approvals section.",
-    },
-    "memory-backend": {
-        "label": "Memory backend configuration",
-        "description": "Archive OpenClaw memory backend settings (QMD, vector search, citations) for manual review.",
-    },
-    "skills-config": {
-        "label": "Skills registry configuration",
-        "description": "Archive per-skill enabled/config/env settings from OpenClaw skills.entries.",
-    },
-    "ui-identity": {
-        "label": "UI and identity settings",
-        "description": "Archive OpenClaw UI theme, assistant identity, and display preferences.",
-    },
-    "logging-config": {
-        "label": "Logging and diagnostics",
-        "description": "Archive OpenClaw logging and diagnostics configuration.",
-    },
 }
 MIGRATION_PRESETS: Dict[str, set[str]] = {
     "user-data": {
@@ -203,22 +139,6 @@ MIGRATION_PRESETS: Dict[str, set[str]] = {
         "shared-skills",
         "daily-memory",
         "archive",
-        "mcp-servers",
-        "agent-config",
-        "session-config",
-        "browser-config",
-        "tools-config",
-        "approvals-config",
-        "deep-channels",
-        "full-providers",
-        "plugins-config",
-        "cron-jobs",
-        "hooks-config",
-        "memory-backend",
-        "skills-config",
-        "ui-identity",
-        "logging-config",
-        "gateway-config",
     },
     "full": set(MIGRATION_OPTION_METADATA),
 }
@@ -658,28 +578,6 @@ class Migrator:
             ),
         )
         self.run_if_selected("archive", self.archive_docs)
-
-        # ── v2 migration modules ──────────────────────────────
-        self.run_if_selected("mcp-servers", lambda: self.migrate_mcp_servers(config))
-        self.run_if_selected("plugins-config", lambda: self.migrate_plugins_config(config))
-        self.run_if_selected("cron-jobs", lambda: self.migrate_cron_jobs(config))
-        self.run_if_selected("hooks-config", lambda: self.migrate_hooks_config(config))
-        self.run_if_selected("agent-config", lambda: self.migrate_agent_config(config))
-        self.run_if_selected("gateway-config", lambda: self.migrate_gateway_config(config))
-        self.run_if_selected("session-config", lambda: self.migrate_session_config(config))
-        self.run_if_selected("full-providers", lambda: self.migrate_full_providers(config))
-        self.run_if_selected("deep-channels", lambda: self.migrate_deep_channels(config))
-        self.run_if_selected("browser-config", lambda: self.migrate_browser_config(config))
-        self.run_if_selected("tools-config", lambda: self.migrate_tools_config(config))
-        self.run_if_selected("approvals-config", lambda: self.migrate_approvals_config(config))
-        self.run_if_selected("memory-backend", lambda: self.migrate_memory_backend(config))
-        self.run_if_selected("skills-config", lambda: self.migrate_skills_config(config))
-        self.run_if_selected("ui-identity", lambda: self.migrate_ui_identity(config))
-        self.run_if_selected("logging-config", lambda: self.migrate_logging_config(config))
-
-        # Generate migration notes
-        self.generate_migration_notes()
-
         return self.build_report()
 
     def run_if_selected(self, option_id: str, func) -> None:
@@ -1561,776 +1459,6 @@ class Migrator:
         else:
             self.record("archive", source, destination, "archived", reason)
 
-    # ── MCP servers ─────────────────────────────────────────────
-    def migrate_mcp_servers(self, config: Optional[Dict[str, Any]] = None) -> None:
-        config = config or self.load_openclaw_config()
-        mcp_raw = (config.get("mcp") or {}).get("servers") or {}
-        if not mcp_raw:
-            self.record("mcp-servers", None, None, "skipped", "No MCP servers found in OpenClaw config")
-            return
-
-        hermes_cfg_path = self.target_root / "config.yaml"
-        hermes_cfg = load_yaml_file(hermes_cfg_path)
-        existing_mcp = hermes_cfg.get("mcp_servers") or {}
-        added = 0
-
-        for name, srv in mcp_raw.items():
-            if not isinstance(srv, dict):
-                continue
-            if name in existing_mcp and not self.overwrite:
-                self.record("mcp-servers", f"mcp.servers.{name}", f"mcp_servers.{name}", "conflict",
-                            "MCP server already exists in Hermes config")
-                continue
-
-            hermes_srv: Dict[str, Any] = {}
-            # STDIO transport
-            if srv.get("command"):
-                hermes_srv["command"] = srv["command"]
-                if srv.get("args"):
-                    hermes_srv["args"] = srv["args"]
-                if srv.get("env"):
-                    hermes_srv["env"] = srv["env"]
-                if srv.get("cwd"):
-                    hermes_srv["cwd"] = srv["cwd"]
-            # HTTP/SSE transport
-            if srv.get("url"):
-                hermes_srv["url"] = srv["url"]
-                if srv.get("headers"):
-                    hermes_srv["headers"] = srv["headers"]
-                if srv.get("auth"):
-                    hermes_srv["auth"] = srv["auth"]
-            # Common fields
-            if srv.get("enabled") is False:
-                hermes_srv["enabled"] = False
-            if srv.get("timeout"):
-                hermes_srv["timeout"] = srv["timeout"]
-            if srv.get("connectTimeout"):
-                hermes_srv["connect_timeout"] = srv["connectTimeout"]
-            # Tool filtering
-            tools_cfg = srv.get("tools") or {}
-            if tools_cfg.get("include") or tools_cfg.get("exclude"):
-                hermes_srv["tools"] = {}
-                if tools_cfg.get("include"):
-                    hermes_srv["tools"]["include"] = tools_cfg["include"]
-                if tools_cfg.get("exclude"):
-                    hermes_srv["tools"]["exclude"] = tools_cfg["exclude"]
-            # Sampling
-            sampling = srv.get("sampling")
-            if sampling and isinstance(sampling, dict):
-                hermes_srv["sampling"] = {
-                    k: v for k, v in {
-                        "enabled": sampling.get("enabled"),
-                        "model": sampling.get("model"),
-                        "max_tokens_cap": sampling.get("maxTokensCap") or sampling.get("max_tokens_cap"),
-                        "timeout": sampling.get("timeout"),
-                        "max_rpm": sampling.get("maxRpm") or sampling.get("max_rpm"),
-                    }.items() if v is not None
-                }
-
-            existing_mcp[name] = hermes_srv
-            added += 1
-            self.record("mcp-servers", f"mcp.servers.{name}", f"config.yaml mcp_servers.{name}",
-                        "migrated", servers_added=added)
-
-        if added > 0 and self.execute:
-            self.maybe_backup(hermes_cfg_path)
-            hermes_cfg["mcp_servers"] = existing_mcp
-            dump_yaml_file(hermes_cfg_path, hermes_cfg)
-
-    # ── Plugins ───────────────────────────────────────────────
-    def migrate_plugins_config(self, config: Optional[Dict[str, Any]] = None) -> None:
-        config = config or self.load_openclaw_config()
-        plugins = config.get("plugins") or {}
-        if not plugins:
-            self.record("plugins-config", None, None, "skipped", "No plugins configuration found")
-            return
-
-        # Archive the full plugins config
-        if self.archive_dir and self.execute:
-            self.archive_dir.mkdir(parents=True, exist_ok=True)
-            dest = self.archive_dir / "plugins-config.json"
-            dest.write_text(json.dumps(plugins, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
-            self.record("plugins-config", "openclaw.json plugins.*", str(dest), "archived",
-                        "Plugins config archived for manual review")
-        else:
-            self.record("plugins-config", "openclaw.json plugins.*", "archive/plugins-config.json",
-                        "archived" if not self.execute else "migrated", "Would archive plugins config")
-
-        # Copy extensions directory if it exists
-        ext_dir = self.source_root / "extensions"
-        if ext_dir.is_dir() and self.archive_dir:
-            dest_ext = self.archive_dir / "extensions"
-            if self.execute:
-                shutil.copytree(ext_dir, dest_ext, dirs_exist_ok=True)
-            self.record("plugins-config", str(ext_dir), str(dest_ext), "archived",
-                        "Extensions directory archived")
-
-        # Extract any plugin env vars
-        entries = plugins.get("entries") or {}
-        for plugin_name, plugin_cfg in entries.items():
-            if isinstance(plugin_cfg, dict):
-                env_vars = plugin_cfg.get("env") or {}
-                api_key = plugin_cfg.get("apiKey")
-                if api_key and self.migrate_secrets:
-                    env_key = f"PLUGIN_{plugin_name.upper().replace('-', '_')}_API_KEY"
-                    self._set_env_var(env_key, api_key, f"plugins.entries.{plugin_name}.apiKey")
-
-    # ── Cron jobs ─────────────────────────────────────────────
-    def migrate_cron_jobs(self, config: Optional[Dict[str, Any]] = None) -> None:
-        config = config or self.load_openclaw_config()
-        cron = config.get("cron") or {}
-        if not cron:
-            self.record("cron-jobs", None, None, "skipped", "No cron configuration found")
-            return
-
-        # Archive the full cron config
-        if self.archive_dir and self.execute:
-            self.archive_dir.mkdir(parents=True, exist_ok=True)
-            dest = self.archive_dir / "cron-config.json"
-            dest.write_text(json.dumps(cron, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
-            self.record("cron-jobs", "openclaw.json cron.*", str(dest), "archived",
-                        "Cron config archived. Use 'hermes cron' to recreate jobs manually.")
-        else:
-            self.record("cron-jobs", "openclaw.json cron.*", "archive/cron-config.json",
-                        "archived", "Would archive cron config")
-
-        # Also check for cron store files
-        cron_store = self.source_root / "cron"
-        if cron_store.is_dir() and self.archive_dir:
-            dest_cron = self.archive_dir / "cron-store"
-            if self.execute:
-                shutil.copytree(cron_store, dest_cron, dirs_exist_ok=True)
-            self.record("cron-jobs", str(cron_store), str(dest_cron), "archived",
-                        "Cron job store archived")
-
-    # ── Hooks ─────────────────────────────────────────────────
-    def migrate_hooks_config(self, config: Optional[Dict[str, Any]] = None) -> None:
-        config = config or self.load_openclaw_config()
-        hooks = config.get("hooks") or {}
-        if not hooks:
-            self.record("hooks-config", None, None, "skipped", "No hooks configuration found")
-            return
-
-        # Archive the full hooks config
-        if self.archive_dir and self.execute:
-            self.archive_dir.mkdir(parents=True, exist_ok=True)
-            dest = self.archive_dir / "hooks-config.json"
-            dest.write_text(json.dumps(hooks, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
-            self.record("hooks-config", "openclaw.json hooks.*", str(dest), "archived",
-                        "Hooks config archived for manual review")
-        else:
-            self.record("hooks-config", "openclaw.json hooks.*", "archive/hooks-config.json",
-                        "archived", "Would archive hooks config")
-
-        # Copy workspace hooks directory
-        for ws_name in ("workspace", "workspace.default"):
-            hooks_dir = self.source_root / ws_name / "hooks"
-            if hooks_dir.is_dir() and self.archive_dir:
-                dest_hooks = self.archive_dir / "workspace-hooks"
-                if self.execute:
-                    shutil.copytree(hooks_dir, dest_hooks, dirs_exist_ok=True)
-                self.record("hooks-config", str(hooks_dir), str(dest_hooks), "archived",
-                            "Workspace hooks directory archived")
-                break
-
-    # ── Agent config ──────────────────────────────────────────
-    def migrate_agent_config(self, config: Optional[Dict[str, Any]] = None) -> None:
-        config = config or self.load_openclaw_config()
-        agents = config.get("agents") or {}
-        defaults = agents.get("defaults") or {}
-        agent_list = agents.get("list") or []
-
-        if not defaults and not agent_list:
-            self.record("agent-config", None, None, "skipped", "No agent configuration found")
-            return
-
-        hermes_cfg_path = self.target_root / "config.yaml"
-        hermes_cfg = load_yaml_file(hermes_cfg_path)
-        changes = False
-
-        # Map agent defaults
-        agent_cfg = hermes_cfg.get("agent") or {}
-        if defaults.get("contextTokens"):
-            # No direct mapping but useful context
-            pass
-        if defaults.get("timeoutSeconds"):
-            agent_cfg["max_turns"] = min(defaults["timeoutSeconds"] // 10, 200)
-            changes = True
-        if defaults.get("verboseDefault"):
-            agent_cfg["verbose"] = defaults["verboseDefault"]
-            changes = True
-        if defaults.get("thinkingDefault"):
-            # Map OpenClaw thinking -> Hermes reasoning_effort
-            thinking = defaults["thinkingDefault"]
-            if thinking in ("always", "high"):
-                agent_cfg["reasoning_effort"] = "high"
-            elif thinking in ("auto", "medium"):
-                agent_cfg["reasoning_effort"] = "medium"
-            elif thinking in ("off", "low", "none"):
-                agent_cfg["reasoning_effort"] = "low"
-            changes = True
-
-        # Map compaction -> compression
-        compaction = defaults.get("compaction") or {}
-        if compaction:
-            compression = hermes_cfg.get("compression") or {}
-            if compaction.get("mode") == "off":
-                compression["enabled"] = False
-            else:
-                compression["enabled"] = True
-            if compaction.get("timeout"):
-                pass  # No direct mapping
-            if compaction.get("model"):
-                compression["summary_model"] = compaction["model"]
-            hermes_cfg["compression"] = compression
-            changes = True
-
-        # Map humanDelay
-        human_delay = defaults.get("humanDelay") or {}
-        if human_delay:
-            hd = hermes_cfg.get("human_delay") or {}
-            if human_delay.get("enabled"):
-                hd["mode"] = "natural"
-            if human_delay.get("minMs"):
-                hd["min_ms"] = human_delay["minMs"]
-            if human_delay.get("maxMs"):
-                hd["max_ms"] = human_delay["maxMs"]
-            hermes_cfg["human_delay"] = hd
-            changes = True
-
-        # Map userTimezone
-        if defaults.get("userTimezone"):
-            hermes_cfg["timezone"] = defaults["userTimezone"]
-            changes = True
-
-        # Map terminal/exec settings
-        exec_cfg = defaults.get("exec") or (config.get("tools") or {}).get("exec") or {}
-        if exec_cfg:
-            terminal_cfg = hermes_cfg.get("terminal") or {}
-            if exec_cfg.get("timeout"):
-                terminal_cfg["timeout"] = exec_cfg["timeout"]
-                changes = True
-            hermes_cfg["terminal"] = terminal_cfg
-
-        # Map sandbox -> terminal docker settings
-        sandbox = defaults.get("sandbox") or {}
-        if sandbox and sandbox.get("backend") == "docker":
-            terminal_cfg = hermes_cfg.get("terminal") or {}
-            terminal_cfg["backend"] = "docker"
-            if sandbox.get("docker", {}).get("image"):
-                terminal_cfg["docker_image"] = sandbox["docker"]["image"]
-            hermes_cfg["terminal"] = terminal_cfg
-            changes = True
-
-        if changes:
-            hermes_cfg["agent"] = agent_cfg
-            if self.execute:
-                self.maybe_backup(hermes_cfg_path)
-                dump_yaml_file(hermes_cfg_path, hermes_cfg)
-            self.record("agent-config", "openclaw.json agents.defaults", "config.yaml agent/compression/terminal",
-                        "migrated", "Agent defaults mapped to Hermes config")
-
-        # Archive multi-agent list
-        if agent_list:
-            if self.archive_dir and self.execute:
-                self.archive_dir.mkdir(parents=True, exist_ok=True)
-                dest = self.archive_dir / "agents-list.json"
-                dest.write_text(json.dumps(agent_list, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
-            self.record("agent-config", "openclaw.json agents.list", "archive/agents-list.json",
-                        "archived", f"Multi-agent setup ({len(agent_list)} agents) archived for manual recreation")
-
-        # Archive bindings
-        bindings = config.get("bindings") or []
-        if bindings:
-            if self.archive_dir and self.execute:
-                self.archive_dir.mkdir(parents=True, exist_ok=True)
-                dest = self.archive_dir / "bindings.json"
-                dest.write_text(json.dumps(bindings, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
-            self.record("agent-config", "openclaw.json bindings", "archive/bindings.json",
-                        "archived", f"Agent routing bindings ({len(bindings)} rules) archived")
-
-    # ── Gateway config ────────────────────────────────────────
-    def migrate_gateway_config(self, config: Optional[Dict[str, Any]] = None) -> None:
-        config = config or self.load_openclaw_config()
-        gateway = config.get("gateway") or {}
-        if not gateway:
-            self.record("gateway-config", None, None, "skipped", "No gateway configuration found")
-            return
-
-        # Archive the full gateway config (complex, many settings)
-        if self.archive_dir and self.execute:
-            self.archive_dir.mkdir(parents=True, exist_ok=True)
-            dest = self.archive_dir / "gateway-config.json"
-            dest.write_text(json.dumps(gateway, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
-        self.record("gateway-config", "openclaw.json gateway.*", "archive/gateway-config.json",
-                    "archived", "Gateway config archived. Use 'hermes gateway' to configure.")
-
-        # Extract gateway auth token to .env if present
-        auth = gateway.get("auth") or {}
-        if auth.get("token") and self.migrate_secrets:
-            self._set_env_var("HERMES_GATEWAY_TOKEN", auth["token"], "gateway.auth.token")
-
-    # ── Session config ────────────────────────────────────────
-    def migrate_session_config(self, config: Optional[Dict[str, Any]] = None) -> None:
-        config = config or self.load_openclaw_config()
-        session = config.get("session") or {}
-        if not session:
-            self.record("session-config", None, None, "skipped", "No session configuration found")
-            return
-
-        hermes_cfg_path = self.target_root / "config.yaml"
-        hermes_cfg = load_yaml_file(hermes_cfg_path)
-        sr = hermes_cfg.get("session_reset") or {}
-        changes = False
-
-        reset_triggers = session.get("resetTriggers") or session.get("reset_triggers") or {}
-        if reset_triggers:
-            daily = reset_triggers.get("daily") or {}
-            idle = reset_triggers.get("idle") or {}
-
-            if daily.get("enabled") and idle.get("enabled"):
-                sr["mode"] = "both"
-            elif daily.get("enabled"):
-                sr["mode"] = "daily"
-            elif idle.get("enabled"):
-                sr["mode"] = "idle"
-            else:
-                sr["mode"] = "none"
-
-            if daily.get("hour") is not None:
-                sr["at_hour"] = daily["hour"]
-            if idle.get("minutes") or idle.get("timeoutMinutes"):
-                sr["idle_minutes"] = idle.get("minutes") or idle.get("timeoutMinutes")
-            changes = True
-
-        if changes:
-            hermes_cfg["session_reset"] = sr
-            if self.execute:
-                self.maybe_backup(hermes_cfg_path)
-                dump_yaml_file(hermes_cfg_path, hermes_cfg)
-            self.record("session-config", "openclaw.json session.resetTriggers",
-                        "config.yaml session_reset", "migrated")
-
-        # Archive full session config (identity links, thread bindings, etc.)
-        complex_keys = {"identityLinks", "threadBindings", "maintenance", "scope", "sendPolicy"}
-        complex_session = {k: v for k, v in session.items() if k in complex_keys and v}
-        if complex_session and self.archive_dir:
-            if self.execute:
-                self.archive_dir.mkdir(parents=True, exist_ok=True)
-                dest = self.archive_dir / "session-config.json"
-                dest.write_text(json.dumps(complex_session, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
-            self.record("session-config", "openclaw.json session (advanced)",
-                        "archive/session-config.json", "archived",
-                        "Advanced session settings archived (identity links, thread bindings, etc.)")
-
-    # ── Full model providers ──────────────────────────────────
-    def migrate_full_providers(self, config: Optional[Dict[str, Any]] = None) -> None:
-        config = config or self.load_openclaw_config()
-        models = config.get("models") or {}
-        providers = models.get("providers") or {}
-        if not providers:
-            self.record("full-providers", None, None, "skipped", "No model providers found")
-            return
-
-        hermes_cfg_path = self.target_root / "config.yaml"
-        hermes_cfg = load_yaml_file(hermes_cfg_path)
-        custom_providers = hermes_cfg.get("custom_providers") or []
-        added = 0
-
-        # Well-known providers: just extract API keys
-        WELL_KNOWN = {"openrouter", "openai", "anthropic", "deepseek", "google", "groq"}
-
-        for prov_name, prov_cfg in providers.items():
-            if not isinstance(prov_cfg, dict):
-                continue
-
-            # Extract API key to .env
-            api_key = prov_cfg.get("apiKey") or prov_cfg.get("api_key")
-            if api_key and self.migrate_secrets:
-                env_key = f"{prov_name.upper().replace('-', '_')}_API_KEY"
-                self._set_env_var(env_key, api_key, f"models.providers.{prov_name}.apiKey")
-
-            # For non-well-known providers, create custom_providers entry
-            if prov_name.lower() not in WELL_KNOWN and prov_cfg.get("baseUrl"):
-                # Check if already exists
-                existing_names = {p.get("name", "").lower() for p in custom_providers}
-                if prov_name.lower() in existing_names and not self.overwrite:
-                    self.record("full-providers", f"models.providers.{prov_name}",
-                                "config.yaml custom_providers", "conflict",
-                                f"Provider '{prov_name}' already exists")
-                    continue
-
-                api_type = prov_cfg.get("apiType") or prov_cfg.get("type") or "openai"
-                api_mode_map = {
-                    "openai": "chat_completions",
-                    "anthropic": "anthropic_messages",
-                    "cohere": "chat_completions",
-                }
-                entry = {
-                    "name": prov_name,
-                    "base_url": prov_cfg["baseUrl"],
-                    "api_key": "",  # referenced from .env
-                    "api_mode": api_mode_map.get(api_type, "chat_completions"),
-                }
-                custom_providers.append(entry)
-                added += 1
-                self.record("full-providers", f"models.providers.{prov_name}",
-                            f"config.yaml custom_providers[{prov_name}]", "migrated")
-
-        if added > 0 and self.execute:
-            self.maybe_backup(hermes_cfg_path)
-            hermes_cfg["custom_providers"] = custom_providers
-            dump_yaml_file(hermes_cfg_path, hermes_cfg)
-
-        # Archive model aliases/catalog
-        agent_defaults = (config.get("agents") or {}).get("defaults") or {}
-        model_aliases = agent_defaults.get("models") or {}
-        if model_aliases:
-            if self.archive_dir and self.execute:
-                self.archive_dir.mkdir(parents=True, exist_ok=True)
-                dest = self.archive_dir / "model-aliases.json"
-                dest.write_text(json.dumps(model_aliases, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
-            self.record("full-providers", "agents.defaults.models", "archive/model-aliases.json",
-                        "archived", f"Model aliases/catalog ({len(model_aliases)} entries) archived")
-
-    # ── Deep channel config ───────────────────────────────────
-    def migrate_deep_channels(self, config: Optional[Dict[str, Any]] = None) -> None:
-        config = config or self.load_openclaw_config()
-        channels = config.get("channels") or {}
-        if not channels:
-            self.record("deep-channels", None, None, "skipped", "No channel configuration found")
-            return
-
-        # Extended channel token/allowlist mapping
-        CHANNEL_ENV_MAP = {
-            "matrix": {"token": "MATRIX_ACCESS_TOKEN", "allowFrom": "MATRIX_ALLOWED_USERS",
-                        "extras": {"homeserverUrl": "MATRIX_HOMESERVER_URL", "userId": "MATRIX_USER_ID"}},
-            "mattermost": {"token": "MATTERMOST_BOT_TOKEN", "allowFrom": "MATTERMOST_ALLOWED_USERS",
-                           "extras": {"url": "MATTERMOST_URL", "teamId": "MATTERMOST_TEAM_ID"}},
-            "irc": {"extras": {"server": "IRC_SERVER", "nick": "IRC_NICK", "channels": "IRC_CHANNELS"}},
-            "googlechat": {"extras": {"serviceAccountKeyPath": "GOOGLE_CHAT_SA_KEY_PATH"}},
-            "imessage": {},
-            "bluebubbles": {"extras": {"server": "BLUEBUBBLES_SERVER", "password": "BLUEBUBBLES_PASSWORD"}},
-            "msteams": {"token": "MSTEAMS_BOT_TOKEN", "allowFrom": "MSTEAMS_ALLOWED_USERS"},
-            "nostr": {"extras": {"nsec": "NOSTR_NSEC", "relays": "NOSTR_RELAYS"}},
-            "twitch": {"token": "TWITCH_BOT_TOKEN", "extras": {"channels": "TWITCH_CHANNELS"}},
-        }
-
-        for ch_name, ch_mapping in CHANNEL_ENV_MAP.items():
-            ch_cfg = channels.get(ch_name) or {}
-            if not ch_cfg:
-                continue
-
-            # Extract tokens
-            if ch_mapping.get("token") and ch_cfg.get("botToken") and self.migrate_secrets:
-                self._set_env_var(ch_mapping["token"], ch_cfg["botToken"],
-                                  f"channels.{ch_name}.botToken")
-            if ch_mapping.get("allowFrom") and ch_cfg.get("allowFrom"):
-                allow_val = ch_cfg["allowFrom"]
-                if isinstance(allow_val, list):
-                    allow_val = ",".join(str(x) for x in allow_val)
-                self._set_env_var(ch_mapping["allowFrom"], str(allow_val),
-                                  f"channels.{ch_name}.allowFrom")
-            # Extra fields
-            for oc_key, env_key in (ch_mapping.get("extras") or {}).items():
-                val = ch_cfg.get(oc_key)
-                if val:
-                    if isinstance(val, list):
-                        val = ",".join(str(x) for x in val)
-                    is_secret = "password" in oc_key.lower() or "token" in oc_key.lower() or "nsec" in oc_key.lower()
-                    if is_secret and not self.migrate_secrets:
-                        continue
-                    self._set_env_var(env_key, str(val), f"channels.{ch_name}.{oc_key}")
-
-        # Map Discord-specific settings to Hermes config
-        discord_cfg = channels.get("discord") or {}
-        if discord_cfg:
-            hermes_cfg_path = self.target_root / "config.yaml"
-            hermes_cfg = load_yaml_file(hermes_cfg_path)
-            discord_hermes = hermes_cfg.get("discord") or {}
-            changed = False
-            if "requireMention" in discord_cfg:
-                discord_hermes["require_mention"] = discord_cfg["requireMention"]
-                changed = True
-            if discord_cfg.get("autoThread") is not None:
-                discord_hermes["auto_thread"] = discord_cfg["autoThread"]
-                changed = True
-            if changed and self.execute:
-                hermes_cfg["discord"] = discord_hermes
-                dump_yaml_file(hermes_cfg_path, hermes_cfg)
-
-        # Archive complex channel configs (group settings, thread bindings, etc.)
-        complex_archive = {}
-        for ch_name, ch_cfg in channels.items():
-            if not isinstance(ch_cfg, dict):
-                continue
-            complex_keys = {k: v for k, v in ch_cfg.items()
-                          if k not in ("botToken", "appToken", "allowFrom", "enabled")
-                          and v and k not in ("requireMention", "autoThread")}
-            if complex_keys:
-                complex_archive[ch_name] = complex_keys
-
-        if complex_archive and self.archive_dir:
-            if self.execute:
-                self.archive_dir.mkdir(parents=True, exist_ok=True)
-                dest = self.archive_dir / "channels-deep-config.json"
-                dest.write_text(json.dumps(complex_archive, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
-            self.record("deep-channels", "openclaw.json channels (advanced settings)",
-                        "archive/channels-deep-config.json", "archived",
-                        f"Deep channel config for {len(complex_archive)} channels archived")
-
-    # ── Browser config ────────────────────────────────────────
-    def migrate_browser_config(self, config: Optional[Dict[str, Any]] = None) -> None:
-        config = config or self.load_openclaw_config()
-        browser = config.get("browser") or {}
-        if not browser:
-            self.record("browser-config", None, None, "skipped", "No browser configuration found")
-            return
-
-        hermes_cfg_path = self.target_root / "config.yaml"
-        hermes_cfg = load_yaml_file(hermes_cfg_path)
-        browser_hermes = hermes_cfg.get("browser") or {}
-        changed = False
-
-        if browser.get("inactivityTimeoutMs"):
-            browser_hermes["inactivity_timeout"] = browser["inactivityTimeoutMs"] // 1000
-            changed = True
-        if browser.get("commandTimeoutMs"):
-            browser_hermes["command_timeout"] = browser["commandTimeoutMs"] // 1000
-            changed = True
-
-        if changed:
-            hermes_cfg["browser"] = browser_hermes
-            if self.execute:
-                self.maybe_backup(hermes_cfg_path)
-                dump_yaml_file(hermes_cfg_path, hermes_cfg)
-            self.record("browser-config", "openclaw.json browser.*", "config.yaml browser",
-                        "migrated")
-
-        # Archive advanced browser settings
-        advanced = {k: v for k, v in browser.items()
-                   if k not in ("inactivityTimeoutMs", "commandTimeoutMs") and v}
-        if advanced and self.archive_dir:
-            if self.execute:
-                self.archive_dir.mkdir(parents=True, exist_ok=True)
-                dest = self.archive_dir / "browser-config.json"
-                dest.write_text(json.dumps(advanced, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
-            self.record("browser-config", "openclaw.json browser (advanced)",
-                        "archive/browser-config.json", "archived")
-
-    # ── Tools config ──────────────────────────────────────────
-    def migrate_tools_config(self, config: Optional[Dict[str, Any]] = None) -> None:
-        config = config or self.load_openclaw_config()
-        tools = config.get("tools") or {}
-        if not tools:
-            self.record("tools-config", None, None, "skipped", "No tools configuration found")
-            return
-
-        hermes_cfg_path = self.target_root / "config.yaml"
-        hermes_cfg = load_yaml_file(hermes_cfg_path)
-        changed = False
-
-        # Map exec timeout -> terminal timeout
-        exec_cfg = tools.get("exec") or {}
-        if exec_cfg.get("timeout"):
-            terminal_cfg = hermes_cfg.get("terminal") or {}
-            terminal_cfg["timeout"] = exec_cfg["timeout"]
-            hermes_cfg["terminal"] = terminal_cfg
-            changed = True
-
-        # Map web search API key
-        web_cfg = tools.get("webSearch") or tools.get("web") or {}
-        if web_cfg.get("braveApiKey") and self.migrate_secrets:
-            self._set_env_var("BRAVE_API_KEY", web_cfg["braveApiKey"], "tools.webSearch.braveApiKey")
-
-        if changed and self.execute:
-            self.maybe_backup(hermes_cfg_path)
-            dump_yaml_file(hermes_cfg_path, hermes_cfg)
-            self.record("tools-config", "openclaw.json tools.*", "config.yaml terminal",
-                        "migrated")
-
-        # Archive full tools config
-        if self.archive_dir:
-            if self.execute:
-                self.archive_dir.mkdir(parents=True, exist_ok=True)
-                dest = self.archive_dir / "tools-config.json"
-                dest.write_text(json.dumps(tools, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
-            self.record("tools-config", "openclaw.json tools (full)", "archive/tools-config.json",
-                        "archived", "Full tools config archived for reference")
-
-    # ── Approvals config ──────────────────────────────────────
-    def migrate_approvals_config(self, config: Optional[Dict[str, Any]] = None) -> None:
-        config = config or self.load_openclaw_config()
-        approvals = config.get("approvals") or {}
-        if not approvals:
-            self.record("approvals-config", None, None, "skipped", "No approvals configuration found")
-            return
-
-        hermes_cfg_path = self.target_root / "config.yaml"
-        hermes_cfg = load_yaml_file(hermes_cfg_path)
-
-        # Map approval mode
-        mode = approvals.get("mode") or approvals.get("defaultMode")
-        if mode:
-            mode_map = {"auto": "off", "always": "manual", "smart": "smart", "manual": "manual"}
-            hermes_mode = mode_map.get(mode, "manual")
-            hermes_cfg.setdefault("approvals", {})["mode"] = hermes_mode
-            if self.execute:
-                self.maybe_backup(hermes_cfg_path)
-                dump_yaml_file(hermes_cfg_path, hermes_cfg)
-            self.record("approvals-config", "openclaw.json approvals.mode",
-                        "config.yaml approvals.mode", "migrated", f"Mapped '{mode}' -> '{hermes_mode}'")
-
-        # Archive full approvals config
-        if len(approvals) > 1 and self.archive_dir:
-            if self.execute:
-                self.archive_dir.mkdir(parents=True, exist_ok=True)
-                dest = self.archive_dir / "approvals-config.json"
-                dest.write_text(json.dumps(approvals, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
-            self.record("approvals-config", "openclaw.json approvals (rules)",
-                        "archive/approvals-config.json", "archived")
-
-    # ── Memory backend ────────────────────────────────────────
-    def migrate_memory_backend(self, config: Optional[Dict[str, Any]] = None) -> None:
-        config = config or self.load_openclaw_config()
-        memory = config.get("memory") or {}
-        if not memory:
-            self.record("memory-backend", None, None, "skipped", "No memory backend configuration found")
-            return
-
-        if self.archive_dir and self.execute:
-            self.archive_dir.mkdir(parents=True, exist_ok=True)
-            dest = self.archive_dir / "memory-backend-config.json"
-            dest.write_text(json.dumps(memory, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
-        self.record("memory-backend", "openclaw.json memory.*", "archive/memory-backend-config.json",
-                    "archived", "Memory backend config (QMD, vector search, citations) archived for manual review")
-
-    # ── Skills config ─────────────────────────────────────────
-    def migrate_skills_config(self, config: Optional[Dict[str, Any]] = None) -> None:
-        config = config or self.load_openclaw_config()
-        skills = config.get("skills") or {}
-        entries = skills.get("entries") or {}
-        if not entries and not skills:
-            self.record("skills-config", None, None, "skipped", "No skills registry configuration found")
-            return
-
-        if self.archive_dir and self.execute:
-            self.archive_dir.mkdir(parents=True, exist_ok=True)
-            dest = self.archive_dir / "skills-registry-config.json"
-            dest.write_text(json.dumps(skills, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
-        self.record("skills-config", "openclaw.json skills.*", "archive/skills-registry-config.json",
-                    "archived", f"Skills registry config ({len(entries)} entries) archived")
-
-    # ── UI / Identity ─────────────────────────────────────────
-    def migrate_ui_identity(self, config: Optional[Dict[str, Any]] = None) -> None:
-        config = config or self.load_openclaw_config()
-        ui = config.get("ui") or {}
-        if not ui:
-            self.record("ui-identity", None, None, "skipped", "No UI/identity configuration found")
-            return
-
-        if self.archive_dir and self.execute:
-            self.archive_dir.mkdir(parents=True, exist_ok=True)
-            dest = self.archive_dir / "ui-identity-config.json"
-            dest.write_text(json.dumps(ui, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
-        self.record("ui-identity", "openclaw.json ui.*", "archive/ui-identity-config.json",
-                    "archived", "UI theme and identity settings archived")
-
-    # ── Logging / Diagnostics ─────────────────────────────────
-    def migrate_logging_config(self, config: Optional[Dict[str, Any]] = None) -> None:
-        config = config or self.load_openclaw_config()
-        logging_cfg = config.get("logging") or {}
-        diagnostics = config.get("diagnostics") or {}
-        combined = {}
-        if logging_cfg:
-            combined["logging"] = logging_cfg
-        if diagnostics:
-            combined["diagnostics"] = diagnostics
-        if not combined:
-            self.record("logging-config", None, None, "skipped", "No logging/diagnostics configuration found")
-            return
-
-        if self.archive_dir and self.execute:
-            self.archive_dir.mkdir(parents=True, exist_ok=True)
-            dest = self.archive_dir / "logging-diagnostics-config.json"
-            dest.write_text(json.dumps(combined, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
-        self.record("logging-config", "openclaw.json logging/diagnostics",
-                    "archive/logging-diagnostics-config.json", "archived")
-
-    # ── Helper: set env var ───────────────────────────────────
-    def _set_env_var(self, key: str, value: str, source_label: str) -> None:
-        env_path = self.target_root / ".env"
-        if self.execute:
-            env_data = parse_env_file(env_path)
-            if key in env_data and not self.overwrite:
-                self.record("env-var", source_label, f".env {key}", "conflict",
-                            f"Env var {key} already set")
-                return
-            env_data[key] = value
-            save_env_file(env_path, env_data)
-        self.record("env-var", source_label, f".env {key}", "migrated")
-
-    # ── Generate migration notes ──────────────────────────────
-    def generate_migration_notes(self) -> None:
-        if not self.output_dir:
-            return
-        notes = [
-            "# OpenClaw -> Hermes Migration Notes",
-            "",
-            "This document lists items that require manual attention after migration.",
-            "",
-            "## PM2 / External Processes",
-            "",
-            "Your PM2 processes (Discord bots, Telegram bots, etc.) are NOT affected",
-            "by this migration. They run independently and will continue working.",
-            "No action needed for PM2-managed processes.",
-            "",
-        ]
-
-        archived = [i for i in self.items if i.status == "archived"]
-        if archived:
-            notes.extend([
-                "## Archived Items (Manual Review Needed)",
-                "",
-                "These OpenClaw configurations were archived because they don't have a",
-                "direct 1:1 mapping in Hermes. Review each file and recreate manually:",
-                "",
-            ])
-            for item in archived:
-                notes.append(f"- **{item.kind}**: `{item.destination}` -- {item.reason}")
-            notes.append("")
-
-        conflicts = [i for i in self.items if i.status == "conflict"]
-        if conflicts:
-            notes.extend([
-                "## Conflicts (Existing Hermes Config Not Overwritten)",
-                "",
-                "These items already existed in your Hermes config. Re-run with",
-                "`--overwrite` to force, or merge manually:",
-                "",
-            ])
-            for item in conflicts:
-                notes.append(f"- **{item.kind}**: {item.reason}")
-            notes.append("")
-
-        notes.extend([
-            "## Hermes-Specific Setup",
-            "",
-            "After migration, you may want to:",
-            "- Run `hermes setup` to configure any remaining settings",
-            "- Run `hermes mcp list` to verify MCP servers were imported correctly",
-            "- Run `hermes cron` to recreate scheduled tasks (see archive/cron-config.json)",
-            "- Run `hermes gateway install` if you need the gateway service",
-            "- Review `~/.hermes/config.yaml` for any adjustments",
-            "",
-        ])
-
-        if self.execute:
-            self.output_dir.mkdir(parents=True, exist_ok=True)
-            (self.output_dir / "MIGRATION_NOTES.md").write_text(
-                "\n".join(notes) + "\n", encoding="utf-8"
-            )
-
 
 def parse_args() -> argparse.Namespace:
     parser = argparse.ArgumentParser(description="Migrate OpenClaw user state into Hermes Agent.")
@@ -2396,101 +1524,8 @@ def main() -> int:
         skill_conflict_mode=args.skill_conflict,
     )
     report = migrator.migrate()
-
-    # ── Human-readable terminal recap ─────────────────────────
-    s = report["summary"]
-    items = report["items"]
-    mode_label = "DRY RUN" if not args.execute else "EXECUTED"
-    total = sum(s.values())
-
-    print()
-    print(f"  ╔══════════════════════════════════════════════════════╗")
-    print(f"  ║   OpenClaw -> Hermes Migration   [{mode_label:>8s}]   ║")
-    print(f"  ╠══════════════════════════════════════════════════════╣")
-    print(f"  ║  Source:  {str(report['source_root'])[:42]:<42s}  ║")
-    print(f"  ║  Target:  {str(report['target_root'])[:42]:<42s}  ║")
-    print(f"  ╠══════════════════════════════════════════════════════╣")
-    print(f"  ║  ✔ Migrated:  {s.get('migrated', 0):>3d}    ◆ Archived:  {s.get('archived', 0):>3d}        ║")
-    print(f"  ║  ⊘ Skipped:   {s.get('skipped', 0):>3d}    ⚠ Conflicts: {s.get('conflict', 0):>3d}        ║")
-    print(f"  ║  ✖ Errors:    {s.get('error', 0):>3d}    Total:       {total:>3d}        ║")
-    print(f"  ╚══════════════════════════════════════════════════════╝")
-
-    # Show what was migrated
-    migrated = [i for i in items if i["status"] == "migrated"]
-    if migrated:
-        print()
-        print("  Migrated:")
-        seen_kinds = set()
-        for item in migrated:
-            label = item["kind"]
-            if label in seen_kinds:
-                continue
-            seen_kinds.add(label)
-            dest = item.get("destination") or ""
-            if dest.startswith(str(report["target_root"])):
-                dest = "~/.hermes/" + dest[len(str(report["target_root"])) + 1:]
-            meta = MIGRATION_OPTION_METADATA.get(label, {})
-            display = meta.get("label", label)
-            print(f"    ✔ {display:<35s} -> {dest}")
-
-    # Show what was archived
-    archived = [i for i in items if i["status"] == "archived"]
-    if archived:
-        print()
-        print("  Archived (manual review needed):")
-        seen_kinds = set()
-        for item in archived:
-            label = item["kind"]
-            if label in seen_kinds:
-                continue
-            seen_kinds.add(label)
-            reason = item.get("reason", "")
-            meta = MIGRATION_OPTION_METADATA.get(label, {})
-            display = meta.get("label", label)
-            short_reason = reason[:50] + "..." if len(reason) > 50 else reason
-            print(f"    ◆ {display:<35s}  {short_reason}")
-
-    # Show conflicts
-    conflicts = [i for i in items if i["status"] == "conflict"]
-    if conflicts:
-        print()
-        print("  Conflicts (use --overwrite to force):")
-        for item in conflicts:
-            print(f"    ⚠ {item['kind']}: {item.get('reason', '')}")
-
-    # Show errors
-    errors = [i for i in items if i["status"] == "error"]
-    if errors:
-        print()
-        print("  Errors:")
-        for item in errors:
-            print(f"    ✖ {item['kind']}: {item.get('reason', '')}")
-
-    # PM2 reassurance
-    print()
-    print("  ℹ PM2 processes (Discord/Telegram bots) are NOT affected.")
-
-    # Next steps
-    if args.execute:
-        print()
-        print("  Next steps:")
-        print("    1. Review ~/.hermes/config.yaml")
-        print("    2. Run: hermes mcp list")
-        if any(i["kind"] == "cron-jobs" and i["status"] == "archived" for i in items):
-            print("    3. Recreate cron jobs: hermes cron")
-        if report.get("output_dir"):
-            print(f"    → Full report: {report['output_dir']}/MIGRATION_NOTES.md")
-    elif not args.execute:
-        print()
-        print("  This was a dry run. Add --execute to apply changes.")
-
-    print()
-
-    # Also dump JSON for programmatic use
-    if os.environ.get("MIGRATION_JSON_OUTPUT"):
-        print(json.dumps(report, indent=2, ensure_ascii=False))
-
-    return 0 if s.get("error", 0) == 0 else 1
+    print(json.dumps(report, indent=2, ensure_ascii=False))
+    return 0 if report["summary"].get("error", 0) == 0 else 1
 
 
 if __name__ == "__main__":

optional-skills/research/bioinformatics/SKILL.md

@@ -1,235 +0,0 @@
----
-name: bioinformatics
-description: Gateway to 400+ bioinformatics skills from bioSkills and ClawBio. Covers genomics, transcriptomics, single-cell, variant calling, pharmacogenomics, metagenomics, structural biology, and more. Fetches domain-specific reference material on demand.
-version: 1.0.0
-platforms: [linux, macos]
-metadata:
-  hermes:
-    tags: [bioinformatics, genomics, sequencing, biology, research, science]
-    category: research
----
-
-# Bioinformatics Skills Gateway
-
-Use when asked about bioinformatics, genomics, sequencing, variant calling, gene expression, single-cell analysis, protein structure, pharmacogenomics, metagenomics, phylogenetics, or any computational biology task.
-
-This skill is a gateway to two open-source bioinformatics skill libraries. Instead of bundling hundreds of domain-specific skills, it indexes them and fetches what you need on demand.
-
-## Sources
-
-◆ **bioSkills** — 385 reference skills (code patterns, parameter guides, decision trees)
-  Repo: https://github.com/GPTomics/bioSkills
-  Format: SKILL.md per topic with code examples. Python/R/CLI.
-
-◆ **ClawBio** — 33 runnable pipeline skills (executable scripts, reproducibility bundles)
-  Repo: https://github.com/ClawBio/ClawBio
-  Format: Python scripts with demos. Each analysis exports report.md + commands.sh + environment.yml.
-
-## How to fetch and use a skill
-
-1. Identify the domain and skill name from the index below.
-2. Clone the relevant repo (shallow clone to save time):
-   ```bash
-   # bioSkills (reference material)
-   git clone --depth 1 https://github.com/GPTomics/bioSkills.git /tmp/bioSkills
-
-   # ClawBio (runnable pipelines)
-   git clone --depth 1 https://github.com/ClawBio/ClawBio.git /tmp/ClawBio
-   ```
-3. Read the specific skill:
-   ```bash
-   # bioSkills — each skill is at: <category>/<skill-name>/SKILL.md
-   cat /tmp/bioSkills/variant-calling/gatk-variant-calling/SKILL.md
-
-   # ClawBio — each skill is at: skills/<skill-name>/
-   cat /tmp/ClawBio/skills/pharmgx-reporter/README.md
-   ```
-4. Follow the fetched skill as reference material. These are NOT Hermes-format skills — treat them as expert domain guides. They contain correct parameters, proper tool flags, and validated pipelines.
-
-## Skill Index by Domain
-
-### Sequence Fundamentals
-bioSkills:
-  sequence-io/ — read-sequences, write-sequences, format-conversion, batch-processing, compressed-files, fastq-quality, filter-sequences, paired-end-fastq, sequence-statistics
-  sequence-manipulation/ — seq-objects, reverse-complement, transcription-translation, motif-search, codon-usage, sequence-properties, sequence-slicing
-ClawBio:
-  seq-wrangler — Sequence QC, alignment, and BAM processing (wraps FastQC, BWA, SAMtools)
-
-### Read QC & Alignment
-bioSkills:
-  read-qc/ — quality-reports, fastp-workflow, adapter-trimming, quality-filtering, umi-processing, contamination-screening, rnaseq-qc
-  read-alignment/ — bwa-alignment, star-alignment, hisat2-alignment, bowtie2-alignment
-  alignment-files/ — sam-bam-basics, alignment-sorting, alignment-filtering, bam-statistics, duplicate-handling, pileup-generation
-
-### Variant Calling & Annotation
-bioSkills:
-  variant-calling/ — gatk-variant-calling, deepvariant, variant-calling (bcftools), joint-calling, structural-variant-calling, filtering-best-practices, variant-annotation, variant-normalization, vcf-basics, vcf-manipulation, vcf-statistics, consensus-sequences, clinical-interpretation
-ClawBio:
-  vcf-annotator — VEP + ClinVar + gnomAD annotation with ancestry-aware context
-  variant-annotation — Variant annotation pipeline
-
-### Differential Expression (Bulk RNA-seq)
-bioSkills:
-  differential-expression/ — deseq2-basics, edger-basics, batch-correction, de-results, de-visualization, timeseries-de
-  rna-quantification/ — alignment-free-quant (Salmon/kallisto), featurecounts-counting, tximport-workflow, count-matrix-qc
-  expression-matrix/ — counts-ingest, gene-id-mapping, metadata-joins, sparse-handling
-ClawBio:
-  rnaseq-de — Full DE pipeline with QC, normalization, and visualization
-  diff-visualizer — Rich visualization and reporting for DE results
-
-### Single-Cell RNA-seq
-bioSkills:
-  single-cell/ — preprocessing, clustering, batch-integration, cell-annotation, cell-communication, doublet-detection, markers-annotation, trajectory-inference, multimodal-integration, perturb-seq, scatac-analysis, lineage-tracing, metabolite-communication, data-io
-ClawBio:
-  scrna-orchestrator — Full Scanpy pipeline (QC, clustering, markers, annotation)
-  scrna-embedding — scVI-based latent embedding and batch integration
-
-### Spatial Transcriptomics
-bioSkills:
-  spatial-transcriptomics/ — spatial-data-io, spatial-preprocessing, spatial-domains, spatial-deconvolution, spatial-communication, spatial-neighbors, spatial-statistics, spatial-visualization, spatial-multiomics, spatial-proteomics, image-analysis
-
-### Epigenomics
-bioSkills:
-  chip-seq/ — peak-calling, differential-binding, motif-analysis, peak-annotation, chipseq-qc, chipseq-visualization, super-enhancers
-  atac-seq/ — atac-peak-calling, atac-qc, differential-accessibility, footprinting, motif-deviation, nucleosome-positioning
-  methylation-analysis/ — bismark-alignment, methylation-calling, dmr-detection, methylkit-analysis
-  hi-c-analysis/ — hic-data-io, tad-detection, loop-calling, compartment-analysis, contact-pairs, matrix-operations, hic-visualization, hic-differential
-ClawBio:
-  methylation-clock — Epigenetic age estimation
-
-### Pharmacogenomics & Clinical
-bioSkills:
-  clinical-databases/ — clinvar-lookup, gnomad-frequencies, dbsnp-queries, pharmacogenomics, polygenic-risk, hla-typing, variant-prioritization, somatic-signatures, tumor-mutational-burden, myvariant-queries
-ClawBio:
-  pharmgx-reporter — PGx report from 23andMe/AncestryDNA (12 genes, 31 SNPs, 51 drugs)
-  drug-photo — Photo of medication → personalized PGx dosage card (via vision)
-  clinpgx — ClinPGx API for gene-drug data and CPIC guidelines
-  gwas-lookup — Federated variant lookup across 9 genomic databases
-  gwas-prs — Polygenic risk scores from consumer genetic data
-  nutrigx_advisor — Personalized nutrition from consumer genetic data
-
-### Population Genetics & GWAS
-bioSkills:
-  population-genetics/ — association-testing (PLINK GWAS), plink-basics, population-structure, linkage-disequilibrium, scikit-allel-analysis, selection-statistics
-  causal-genomics/ — mendelian-randomization, fine-mapping, colocalization-analysis, mediation-analysis, pleiotropy-detection
-  phasing-imputation/ — haplotype-phasing, genotype-imputation, imputation-qc, reference-panels
-ClawBio:
-  claw-ancestry-pca — Ancestry PCA against SGDP reference panel
-
-### Metagenomics & Microbiome
-bioSkills:
-  metagenomics/ — kraken-classification, metaphlan-profiling, abundance-estimation, functional-profiling, amr-detection, strain-tracking, metagenome-visualization
-  microbiome/ — amplicon-processing, diversity-analysis, differential-abundance, taxonomy-assignment, functional-prediction, qiime2-workflow
-ClawBio:
-  claw-metagenomics — Shotgun metagenomics profiling (taxonomy, resistome, functional pathways)
-
-### Genome Assembly & Annotation
-bioSkills:
-  genome-assembly/ — hifi-assembly, long-read-assembly, short-read-assembly, metagenome-assembly, assembly-polishing, assembly-qc, scaffolding, contamination-detection
-  genome-annotation/ — eukaryotic-gene-prediction, prokaryotic-annotation, functional-annotation, ncrna-annotation, repeat-annotation, annotation-transfer
-  long-read-sequencing/ — basecalling, long-read-alignment, long-read-qc, clair3-variants, structural-variants, medaka-polishing, nanopore-methylation, isoseq-analysis
-
-### Structural Biology & Chemoinformatics
-bioSkills:
-  structural-biology/ — alphafold-predictions, modern-structure-prediction, structure-io, structure-navigation, structure-modification, geometric-analysis
-  chemoinformatics/ — molecular-io, molecular-descriptors, similarity-searching, substructure-search, virtual-screening, admet-prediction, reaction-enumeration
-ClawBio:
-  struct-predictor — Local AlphaFold/Boltz/Chai structure prediction with comparison
-
-### Proteomics
-bioSkills:
-  proteomics/ — data-import, peptide-identification, protein-inference, quantification, differential-abundance, dia-analysis, ptm-analysis, proteomics-qc, spectral-libraries
-ClawBio:
-  proteomics-de — Proteomics differential expression
-
-### Pathway Analysis & Gene Networks
-bioSkills:
-  pathway-analysis/ — go-enrichment, gsea, kegg-pathways, reactome-pathways, wikipathways, enrichment-visualization
-  gene-regulatory-networks/ — scenic-regulons, coexpression-networks, differential-networks, multiomics-grn, perturbation-simulation
-
-### Immunoinformatics
-bioSkills:
-  immunoinformatics/ — mhc-binding-prediction, epitope-prediction, neoantigen-prediction, immunogenicity-scoring, tcr-epitope-binding
-  tcr-bcr-analysis/ — mixcr-analysis, scirpy-analysis, immcantation-analysis, repertoire-visualization, vdjtools-analysis
-
-### CRISPR & Genome Engineering
-bioSkills:
-  crispr-screens/ — mageck-analysis, jacks-analysis, hit-calling, screen-qc, library-design, crispresso-editing, base-editing-analysis, batch-correction
-  genome-engineering/ — grna-design, off-target-prediction, hdr-template-design, base-editing-design, prime-editing-design
-
-### Workflow Management
-bioSkills:
-  workflow-management/ — snakemake-workflows, nextflow-pipelines, cwl-workflows, wdl-workflows
-ClawBio:
-  repro-enforcer — Export any analysis as reproducibility bundle (Conda env + Singularity + checksums)
-  galaxy-bridge — Access 8,000+ Galaxy tools from usegalaxy.org
-
-### Specialized Domains
-bioSkills:
-  alternative-splicing/ — splicing-quantification, differential-splicing, isoform-switching, sashimi-plots, single-cell-splicing, splicing-qc
-  ecological-genomics/ — edna-metabarcoding, landscape-genomics, conservation-genetics, biodiversity-metrics, community-ecology, species-delimitation
-  epidemiological-genomics/ — pathogen-typing, variant-surveillance, phylodynamics, transmission-inference, amr-surveillance
-  liquid-biopsy/ — cfdna-preprocessing, ctdna-mutation-detection, fragment-analysis, tumor-fraction-estimation, methylation-based-detection, longitudinal-monitoring
-  epitranscriptomics/ — m6a-peak-calling, m6a-differential, m6anet-analysis, merip-preprocessing, modification-visualization
-  metabolomics/ — xcms-preprocessing, metabolite-annotation, normalization-qc, statistical-analysis, pathway-mapping, lipidomics, targeted-analysis, msdial-preprocessing
-  flow-cytometry/ — fcs-handling, gating-analysis, compensation-transformation, clustering-phenotyping, differential-analysis, cytometry-qc, doublet-detection, bead-normalization
-  systems-biology/ — flux-balance-analysis, metabolic-reconstruction, gene-essentiality, context-specific-models, model-curation
-  rna-structure/ — secondary-structure-prediction, ncrna-search, structure-probing
-
-### Data Visualization & Reporting
-bioSkills:
-  data-visualization/ — ggplot2-fundamentals, heatmaps-clustering, volcano-customization, circos-plots, genome-browser-tracks, interactive-visualization, multipanel-figures, network-visualization, upset-plots, color-palettes, specialized-omics-plots, genome-tracks
-  reporting/ — rmarkdown-reports, quarto-reports, jupyter-reports, automated-qc-reports, figure-export
-ClawBio:
-  profile-report — Analysis profile reporting
-  data-extractor — Extract numerical data from scientific figure images (via vision)
-  lit-synthesizer — PubMed/bioRxiv search, summarization, citation graphs
-  pubmed-summariser — Gene/disease PubMed search with structured briefing
-
-### Database Access
-bioSkills:
-  database-access/ — entrez-search, entrez-fetch, entrez-link, blast-searches, local-blast, sra-data, geo-data, uniprot-access, batch-downloads, interaction-databases, sequence-similarity
-ClawBio:
-  ukb-navigator — Semantic search across 12,000+ UK Biobank fields
-  clinical-trial-finder — Clinical trial discovery
-
-### Experimental Design
-bioSkills:
-  experimental-design/ — power-analysis, sample-size, batch-design, multiple-testing
-
-### Machine Learning for Omics
-bioSkills:
-  machine-learning/ — omics-classifiers, biomarker-discovery, survival-analysis, model-validation, prediction-explanation, atlas-mapping
-ClawBio:
-  claw-semantic-sim — Semantic similarity index for disease literature (PubMedBERT)
-  omics-target-evidence-mapper — Aggregate target-level evidence across omics sources
-
-## Environment Setup
-
-These skills assume a bioinformatics workstation. Common dependencies:
-
-```bash
-# Python
-pip install biopython pysam cyvcf2 pybedtools pyBigWig scikit-allel anndata scanpy mygene
-
-# R/Bioconductor
-Rscript -e 'BiocManager::install(c("DESeq2","edgeR","Seurat","clusterProfiler","methylKit"))'
-
-# CLI tools (Ubuntu/Debian)
-sudo apt install samtools bcftools ncbi-blast+ minimap2 bedtools
-
-# CLI tools (macOS)
-brew install samtools bcftools blast minimap2 bedtools
-
-# Or via Conda (recommended for reproducibility)
-conda install -c bioconda samtools bcftools blast minimap2 bedtools fastp kraken2
-```
-
-## Pitfalls
-
-- The fetched skills are NOT in Hermes SKILL.md format. They use their own structure (bioSkills: code pattern cookbooks; ClawBio: README + Python scripts). Read them as expert reference material.
-- bioSkills are reference guides — they show correct parameters and code patterns but aren't executable pipelines.
-- ClawBio skills are executable — many have `--demo` flags and can be run directly.
-- Both repos assume bioinformatics tools are installed. Check prerequisites before running pipelines.
-- For ClawBio, run `pip install -r requirements.txt` in the cloned repo first.
-- Genomic data files can be very large. Be mindful of disk space when downloading reference genomes, SRA datasets, or building indices.

plans/gemini-oauth-provider.md

@@ -1,80 +0,0 @@
-# Gemini OAuth Provider — Implementation Plan
-
-## Goal
-Add a first-class `gemini` provider that authenticates via Google OAuth, using the standard Gemini API (not Cloud Code Assist). Users who have a Google AI subscription or Gemini API access can authenticate through the browser without needing to manually copy API keys.
-
-## Architecture Decision
-- **Path A (chosen):** Standard Gemini API at `generativelanguage.googleapis.com/v1beta/openai/`
-- **NOT Path B:** Cloud Code Assist (`cloudcode-pa.googleapis.com`) — rate-limited free tier, internal API, account ban risk
-- Standard `chat_completions` api_mode via OpenAI SDK — no new api_mode needed
-- Our own OAuth credentials — NOT sharing tokens with Gemini CLI
-
-## OAuth Flow
-- **Type:** Authorization Code + PKCE (S256) — same pattern as clawdbot/pi-mono
-- **Auth URL:** `https://accounts.google.com/o/oauth2/v2/auth`
-- **Token URL:** `https://oauth2.googleapis.com/token`
-- **Redirect:** `http://localhost:8085/oauth2callback` (localhost callback server)
-- **Fallback:** Manual URL paste for remote/WSL/headless environments
-- **Scopes:** `https://www.googleapis.com/auth/cloud-platform`, `https://www.googleapis.com/auth/userinfo.email`
-- **PKCE:** S256 code challenge, 32-byte random verifier
-
-## Client ID
-- Need to register a "Desktop app" OAuth client on a Nous Research GCP project
-- Ship client_id + client_secret in code (Google considers installed app secrets non-confidential)
-- Alternatively: accept user-provided client_id via env vars as override
-
-## Token Lifecycle
-- Store at `~/.hermes/gemini_oauth.json` (NOT sharing with `~/.gemini/oauth_creds.json`)
-- Fields: `client_id`, `client_secret`, `refresh_token`, `access_token`, `expires_at`, `email`
-- File permissions: 0o600
-- Before each API call: check expiry, refresh if within 5 min of expiration
-- Refresh: POST to token URL with `grant_type=refresh_token`
-- File locking for concurrent access (multiple agent sessions)
-
-## API Integration
-- Base URL: `https://generativelanguage.googleapis.com/v1beta/openai/`
-- Auth: `Authorization: Bearer <access_token>` (passed as `api_key` to OpenAI SDK)
-- api_mode: `chat_completions` (standard)
-- Models: gemini-2.5-pro, gemini-2.5-flash, gemini-2.0-flash, etc.
-
-## Files to Create/Modify
-
-### New files
-1. `agent/google_oauth.py` — OAuth flow (PKCE, localhost server, token exchange, refresh)
-   - `start_oauth_flow()` — opens browser, starts callback server
-   - `exchange_code()` — code → tokens
-   - `refresh_access_token()` — refresh flow
-   - `load_credentials()` / `save_credentials()` — file I/O with locking
-   - `get_valid_access_token()` — check expiry, refresh if needed
-   - ~200 lines
-
-### Existing files to modify
-2. `hermes_cli/auth.py` — Add ProviderConfig for "gemini" with auth_type="oauth_google"
-3. `hermes_cli/models.py` — Add Gemini model catalog
-4. `hermes_cli/runtime_provider.py` — Add gemini branch (read OAuth token, build OpenAI client)
-5. `hermes_cli/main.py` — Add `_model_flow_gemini()`, add to provider choices
-6. `hermes_cli/setup.py` — Add gemini auth flow (trigger browser OAuth)
-7. `run_agent.py` — Token refresh before API calls (like Copilot pattern)
-8. `agent/auxiliary_client.py` — Add gemini to aux resolution chain
-9. `agent/model_metadata.py` — Add Gemini model context lengths
-
-### Tests
-10. `tests/agent/test_google_oauth.py` — OAuth flow unit tests
-11. `tests/test_api_key_providers.py` — Add gemini provider test
-
-### Docs
-12. `website/docs/getting-started/quickstart.md` — Add gemini to provider table
-13. `website/docs/user-guide/configuration.md` — Gemini setup section
-14. `website/docs/reference/environment-variables.md` — New env vars
-
-## Estimated scope
-~400 lines new code, ~150 lines modifications, ~100 lines tests, ~50 lines docs = ~700 lines total
-
-## Prerequisites
-- Nous Research GCP project with Desktop OAuth client registered
-- OR: accept user-provided client_id via HERMES_GEMINI_CLIENT_ID env var
-
-## Reference implementations
-- clawdbot: `extensions/google/oauth.flow.ts` (PKCE + localhost server)
-- pi-mono: `packages/ai/src/utils/oauth/google-gemini-cli.ts` (same flow)
-- hermes-agent Copilot OAuth: `hermes_cli/main.py` `_copilot_device_flow()` (different flow type but same lifecycle pattern)

pyproject.toml

@@ -4,67 +4,70 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "hermes-agent"
-version = "0.4.0"
+version = "0.3.0"
 description = "The self-improving AI agent — creates skills from experience, improves them during use, and runs anywhere"
 readme = "README.md"
 requires-python = ">=3.11"
 authors = [{ name = "Nous Research" }]
 license = { text = "MIT" }
 dependencies = [
-  # Core — pinned to known-good ranges to limit supply chain attack surface
-  "openai>=2.21.0,<3",
-  "anthropic>=0.39.0,<1",
-  "python-dotenv>=1.2.1,<2",
-  "fire>=0.7.1,<1",
-  "httpx>=0.28.1,<1",
-  "rich>=14.3.3,<15",
-  "tenacity>=9.1.4,<10",
-  "pyyaml>=6.0.2,<7",
-  "requests>=2.32.3,<3",
-  "jinja2>=3.1.5,<4",
-  "pydantic>=2.12.5,<3",
+  # Core
+  "openai",
+  "anthropic>=0.39.0",
+  "python-dotenv",
+  "fire",
+  "httpx",
+  "rich",
+  "tenacity",
+  "pyyaml",
+  "requests",
+  "jinja2",
+  "pydantic>=2.0",
   # Interactive CLI (prompt_toolkit is used directly by cli.py)
-  "prompt_toolkit>=3.0.52,<4",
+  "prompt_toolkit",
   # Tools
-  "firecrawl-py>=4.16.0,<5",
-  "parallel-web>=0.4.2,<1",
-  "fal-client>=0.13.1,<1",
+  "firecrawl-py",
+  "parallel-web>=0.4.2",
+  "fal-client",
   # Text-to-speech (Edge TTS is free, no API key needed)
-  "edge-tts>=7.2.7,<8",
-  "faster-whisper>=1.0.0,<2",
+  "edge-tts",
+  "faster-whisper>=1.0.0",
+  # mini-swe-agent deps (terminal tool)
+  "litellm>=1.75.5",
+  "typer",
+  "platformdirs",
   # Skills Hub (GitHub App JWT auth — optional, only needed for bot identity)
-  "PyJWT[crypto]>=2.10.1,<3",
+  "PyJWT[crypto]",
 ]
 
 [project.optional-dependencies]
-modal = ["swe-rex[modal]>=1.4.0,<2"]
-daytona = ["daytona>=0.148.0,<1"]
-dev = ["pytest>=9.0.2,<10", "pytest-asyncio>=1.3.0,<2", "pytest-xdist>=3.0,<4", "mcp>=1.2.0,<2"]
-messaging = ["python-telegram-bot>=22.6,<23", "discord.py[voice]>=2.7.1,<3", "aiohttp>=3.13.3,<4", "slack-bolt>=1.18.0,<2", "slack-sdk>=3.27.0,<4"]
-cron = ["croniter>=6.0.0,<7"]
-slack = ["slack-bolt>=1.18.0,<2", "slack-sdk>=3.27.0,<4"]
-matrix = ["matrix-nio[e2e]>=0.24.0,<1"]
-cli = ["simple-term-menu>=1.0,<2"]
-tts-premium = ["elevenlabs>=1.0,<2"]
-voice = ["sounddevice>=0.4.6,<1", "numpy>=1.24.0,<3"]
+modal = ["swe-rex[modal]>=1.4.0"]
+daytona = ["daytona>=0.148.0"]
+dev = ["pytest", "pytest-asyncio", "pytest-xdist", "mcp>=1.2.0"]
+messaging = ["python-telegram-bot>=20.0", "discord.py[voice]>=2.0", "aiohttp>=3.9.0", "slack-bolt>=1.18.0", "slack-sdk>=3.27.0"]
+cron = ["croniter"]
+slack = ["slack-bolt>=1.18.0", "slack-sdk>=3.27.0"]
+matrix = ["matrix-nio[e2e]>=0.24.0"]
+cli = ["simple-term-menu"]
+tts-premium = ["elevenlabs"]
+voice = ["sounddevice>=0.4.6", "numpy>=1.24.0"]
 pty = [
-  "ptyprocess>=0.7.0,<1; sys_platform != 'win32'",
-  "pywinpty>=2.0.0,<3; sys_platform == 'win32'",
+  "ptyprocess>=0.7.0; sys_platform != 'win32'",
+  "pywinpty>=2.0.0; sys_platform == 'win32'",
 ]
-honcho = ["honcho-ai>=2.0.1,<3"]
-mcp = ["mcp>=1.2.0,<2"]
-homeassistant = ["aiohttp>=3.9.0,<4"]
-sms = ["aiohttp>=3.9.0,<4"]
+honcho = ["honcho-ai>=2.0.1"]
+mcp = ["mcp>=1.2.0"]
+homeassistant = ["aiohttp>=3.9.0"]
+sms = ["aiohttp>=3.9.0"]
 acp = ["agent-client-protocol>=0.8.1,<1.0"]
-dingtalk = ["dingtalk-stream>=0.1.0,<1"]
 rl = [
   "atroposlib @ git+https://github.com/NousResearch/atropos.git",
   "tinker @ git+https://github.com/thinking-machines-lab/tinker.git",
-  "fastapi>=0.104.0,<1",
-  "uvicorn[standard]>=0.24.0,<1",
-  "wandb>=0.15.0,<1",
+  "fastapi>=0.104.0",
+  "uvicorn[standard]>=0.24.0",
+  "wandb>=0.15.0",
 ]
-yc-bench = ["yc-bench @ git+https://github.com/collinear-ai/yc-bench.git ; python_version >= '3.12'"]
+yc-bench = ["yc-bench @ git+https://github.com/collinear-ai/yc-bench.git"]
 all = [
   "hermes-agent[modal]",
   "hermes-agent[daytona]",
@@ -81,7 +84,6 @@ all = [
   "hermes-agent[sms]",
   "hermes-agent[acp]",
   "hermes-agent[voice]",
-  "hermes-agent[dingtalk]",
 ]
 
 [project.scripts]
@@ -90,7 +92,7 @@ hermes-agent = "run_agent:main"
 hermes-acp = "acp_adapter.entry:main"
 
 [tool.setuptools]
-py-modules = ["run_agent", "model_tools", "toolsets", "batch_runner", "trajectory_compressor", "toolset_distributions", "cli", "hermes_constants", "hermes_state", "hermes_time", "rl_cli", "utils"]
+py-modules = ["run_agent", "model_tools", "toolsets", "batch_runner", "trajectory_compressor", "toolset_distributions", "cli", "hermes_constants", "hermes_state", "hermes_time", "mini_swe_runner", "rl_cli", "utils"]
 
 [tool.setuptools.packages.find]
 include = ["agent", "tools", "tools.*", "hermes_cli", "gateway", "gateway.*", "cron", "honcho_integration", "acp_adapter"]

requirements.txt

@@ -23,6 +23,12 @@ parallel-web>=0.4.2
 # Image generation
 fal-client
 
+# mini-swe-agent dependencies (for terminal tool)
+# Note: Install mini-swe-agent itself with: pip install -e ./mini-swe-agent
+litellm>=1.75.5
+typer
+platformdirs
+
 # Text-to-speech (Edge TTS is free, no API key needed)
 edge-tts
 

scripts/hermes-gateway

@@ -82,15 +82,13 @@ def generate_systemd_unit() -> str:
     return f"""[Unit]
 Description={SERVICE_DESCRIPTION}
 After=network.target
-StartLimitIntervalSec=600
-StartLimitBurst=5
 
 [Service]
 Type=simple
 ExecStart={python_path} {script_path} run
 WorkingDirectory={working_dir}
 Restart=on-failure
-RestartSec=30
+RestartSec=10
 StandardOutput=journal
 StandardError=journal