refactor(desktop): extract app-version IPC from main.cjs into version-ipc.cjs

Ninth main.cjs cluster peel. The hermes:version handler moves verbatim into electron/version-ipc.cjs behind a registerVersionIpc({ ipcMain, resolveHermesVersion, resolveUpdateRoot }) registrar. The version + root resolvers stay in the main process (shared with the About menu) and are injected. Channel name unchanged → preload + renderer untouched. Adds electron/version-ipc.test.cjs (surface + payload behavior).
refactor(desktop): extract uninstall IPC from main.cjs into uninstall-ipc.cjs
2026-06-30 14:12:39 -05:00 · 2026-06-30 14:11:50 -05:00 · 2026-06-30 13:34:12 -05:00 · 2026-06-30 13:32:22 -05:00 · 2026-06-30 13:30:48 -05:00 · 2026-06-30 13:29:38 -05:00
2356 changed files with 40156 additions and 290551 deletions
@@ -1,13 +1,6 @@
 # Hermes Agent Environment Configuration
 # Copy this file to .env and fill in your API keys

-# =============================================================================
-# LLM PROVIDER (Fireworks AI)
-# =============================================================================
-# Get your key at: https://app.fireworks.ai/settings/users/api-keys
-# Address models directly by catalog ID, e.g.
-#   accounts/fireworks/models/kimi-k2p6, accounts/fireworks/models/glm-5p2
-# FIREWORKS_API_KEY=
 # =============================================================================
 # LLM PROVIDER (OpenRouter)
 # =============================================================================
@@ -115,10 +108,6 @@
 # HF_BASE_URL=https://router.huggingface.co/v1  # Override default base URL
 # OPENCODE_GO_BASE_URL=https://opencode.ai/zen/go/v1  # Override default base URL

-# DeepInfra — 100+ top open models, pay-per-use.
-# Get your key at: https://deepinfra.com/dash/api_keys
-# DEEPINFRA_API_KEY=
-
 # =============================================================================
 # LLM PROVIDER (Qwen OAuth)
 # =============================================================================
@@ -136,15 +125,6 @@
 # Optional base URL override:
 # XIAOMI_BASE_URL=https://api.xiaomimimo.com/v1

-# =============================================================================
-# LLM PROVIDER (Upstage Solar)
-# =============================================================================
-# Upstage provides access to Upstage Solar models.
-# Get your key at: https://console.upstage.ai/api-keys
-# UPSTAGE_API_KEY=your_key_here
-# Optional base URL override:
-# UPSTAGE_BASE_URL=https://api.upstage.ai/v1
-
 # =============================================================================
 # TOOL API KEYS
 # =============================================================================
@@ -1,4 +1,4 @@
-watch_file pyproject.toml uv.lock hermes
+watch_file pyproject.toml uv.lock
 watch_file package-lock.json package.json web/package.json ui-tui/package.json website/package.json apps/shared/package.json apps/desktop/package.json ui-tui/packages/hermes-ink/package.json
 watch_file flake.nix flake.lock nix/devShell.nix nix/tui.nix nix/package.nix nix/python.nix nix/hermes-agent.nix nix/desktop.nix

@@ -10,7 +10,7 @@ outputs:
    description: Run Python tests / ruff / ty / windows-footguns.
    value: ${{ steps.classify.outputs.python }}
  frontend:
-    description: Run the TypeScript testing matrix + desktop build.
+    description: Run the TypeScript typecheck matrix + desktop build.
    value: ${{ steps.classify.outputs.frontend }}
  docker_meta:
    description: Docker setup and meta files have changed.
@@ -24,15 +24,9 @@ outputs:
  deps:
    description: Check pyproject.toml dependency upper bounds.
    value: ${{ steps.classify.outputs.deps }}
-  npm_lock:
-    description: Post/update the semantic package-lock.json diff PR comment.
-    value: ${{ steps.classify.outputs.npm_lock }}
  mcp_catalog:
    description: Require MCP catalog security review label.
    value: ${{ steps.classify.outputs.mcp_catalog }}
-  ci_review:
-    description: Require CI-sensitive file review label.
-    value: ${{ steps.classify.outputs.ci_review }}

 runs:
  using: composite
@@ -41,10 +41,8 @@ jobs:
      site: ${{ steps.classify.outputs.site }}
      scan: ${{ steps.classify.outputs.scan }}
      deps: ${{ steps.classify.outputs.deps }}
-      npm_lock: ${{ steps.classify.outputs.npm_lock }}
      docker_meta: ${{ steps.classify.outputs.docker_meta }}
      mcp_catalog: ${{ steps.classify.outputs.mcp_catalog }}
-      ci_review: ${{ steps.classify.outputs.ci_review }}
      event_name: ${{ github.event_name }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -67,17 +65,16 @@ jobs:
  lint:
    name: Python lints
    needs: detect
-    if: needs.detect.outputs.python == 'true' || needs.detect.outputs.ci_review == 'true'
+    if: needs.detect.outputs.python == 'true'
    uses: ./.github/workflows/lint.yml
    with:
      event_name: ${{ needs.detect.outputs.event_name }}
-      ci_review: ${{ needs.detect.outputs.ci_review == 'true' }}

-  js-tests:
-    name: JS & TS checks
+  typecheck:
+    name: TypeScript
    needs: detect
    if: needs.detect.outputs.frontend == 'true'
-    uses: ./.github/workflows/js-tests.yml
+    uses: ./.github/workflows/typecheck.yml

  docs-site:
    name: Docs Site
@@ -102,12 +99,6 @@ jobs:
    needs: detect
    uses: ./.github/workflows/uv-lockfile-check.yml

-  lockfile-diff:
-    name: package-lock.json diff
-    needs: detect
-    if: needs.detect.outputs.event_name == 'pull_request' && needs.detect.outputs.npm_lock == 'true'
-    uses: ./.github/workflows/lockfile-diff.yml
-
  docker-lint:
    name: Lint Docker scripts
    needs: detect
@@ -148,12 +139,11 @@ jobs:
    needs:
      - tests
      - lint
-      - js-tests
+      - typecheck
      - docs-site
      - history-check
      - contributor-check
      - uv-lockfile
-      - lockfile-diff
      - docker-lint
      - supply-chain
      - osv-scanner
@@ -164,18 +154,14 @@ jobs:
    steps:
      - name: Evaluate job results
        env:
-          NEEDS: ${{ toJSON(needs) }}
+          RESULTS: ${{ toJSON(needs.*.result) }}
        run: |
-          echo "$NEEDS" | python3 -c "
+          echo "$RESULTS" | python3 -c "
          import json, sys
-          needs = json.load(sys.stdin)
-          failed = [name for name, info in needs.items() if info['result'] == 'failure']
-          for name, info in sorted(needs.items()):
-              result = info['result']
-              icon = '✅' if result in ('success', 'skipped') else '❌'
-              print(f'{icon} {name}: {result}')
+          results = json.load(sys.stdin)
+          failed = [r for r in results if r == 'failure']
          if failed:
-              print(f'::error::{len(failed)} job(s) failed: {\", \".join(failed)}')
+              print(f'::error::{len(failed)} job(s) failed')
              sys.exit(1)
          print('All checks passed (or were skipped)')
          "
@@ -235,17 +221,10 @@ jobs:

      - name: Save baseline cache (main only)
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        run: |
-          # Degraded runs (API rate-limited) produce no ci-timings.json —
-          # skip rather than fail, and never cache an empty baseline.
-          if [ -f ci-timings.json ]; then
-            cp ci-timings.json ci-timings-baseline.json
-          else
-            echo "No timings JSON this run — skipping baseline update"
-          fi
+        run: cp ci-timings.json ci-timings-baseline.json

      - name: Upload baseline to cache (main only)
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main' && hashFiles('ci-timings-baseline.json') != ''
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: ci-timings-baseline.json
@@ -178,9 +178,6 @@ jobs:

      - name: Create manifest list and push
        working-directory: /tmp/digests
-        env:
-          IMAGE_NAME: ${{ env.IMAGE_NAME }}
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          set -euo pipefail
          args=()
@@ -188,8 +185,9 @@ jobs:
            args+=("${IMAGE_NAME}@sha256:${digest_file}")
          done
          if [ "${{ github.event_name }}" = "release" ]; then
+            TAG="${{ github.event.release.tag_name }}"
            docker buildx imagetools create \
-              -t "${IMAGE_NAME}:${RELEASE_TAG}" \
+              -t "${IMAGE_NAME}:${TAG}" \
              "${args[@]}"
          else
            docker buildx imagetools create \
@@ -197,14 +195,15 @@ jobs:
              -t "${IMAGE_NAME}:latest" \
              "${args[@]}"
          fi
-
-      - name: Inspect image
        env:
          IMAGE_NAME: ${{ env.IMAGE_NAME }}
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
+
+      - name: Inspect image
        run: |
          if [ "${{ github.event_name }}" = "release" ]; then
-            docker buildx imagetools inspect "${IMAGE_NAME}:${RELEASE_TAG}"
+            docker buildx imagetools inspect "${IMAGE_NAME}:${{ github.event.release.tag_name }}"
          else
            docker buildx imagetools inspect "${IMAGE_NAME}:main"
          fi
+        env:
+          IMAGE_NAME: ${{ env.IMAGE_NAME }}
@@ -1,251 +0,0 @@
-name: auto-fix lint issues & formatting
-
-# On push to main (or manual trigger), run `npm run fix` on each workspace
-# package and apply any changes via a PR.
-#
-# Fixable lint issues (import sorting, unused imports, curly braces, etc.) are
-# auto-corrected on merge so PRs aren't blocked by them. The PR-time eslint
-# check in typecheck.yml fails only when un-fixable errors remain.
-#
-# NOTE: AUTOFIX_BOT_PAT pushes DO trigger further workflow runs (unlike
-# secrets.GITHUB_TOKEN). The concurrency group (ts-autofix-${{ github.ref }})
-# with cancel-in-progress: true prevents an infinite loop — a re-triggered
-# run cancels the in-flight one, and since the second run finds no new fixes
-# (the first run already applied them), it exits with an empty patch.
-#
-# ── Security model: two-job split ───────────────────────────────────────────
-#
-# The eslint process executes repo code (eslint.config.mjs, package.json
-# scripts, installed plugins). To prevent a malicious PR from getting arbitrary
-# code execution on a runner with push access, the work is split:
-#
-#   1. generate-patch (unprivileged, contents: read only)
-#      Checks out, installs deps, runs eslint --fix, produces a .patch artifact.
-#      Worst case: malicious code runs here on an ephemeral runner with zero
-#      push permissions.
-#
-#   2. apply-patch (privileged, contents: write + pull-requests: write)
-#      Checks out, downloads the patch artifact, applies it, pushes to the
-#      bot/js-autofix branch, creates/updates a PR, and enables auto-merge.
-#      This job never runs npm, never installs anything, never executes any
-#      repo code. The only input it trusts is the patch artifact.
-#      Skipped entirely when generate-patch reports no fixes (has-fixes != true).
-#      The PR auto-merges (squash) once CI passes. If CI fails or main moves,
-#      the PR is auto-closed and the branch deleted — the next run re-applies
-#      on the current state.
-
-on:
-  push:
-    branches: [main]
-    paths:
-      - '**/*.js'
-      - '**/*.cjs'
-      - '**/*.mjs'
-      - '**/*.ts'
-      - '**/*.tsx'
-      - 'package.json'
-      - 'package-lock.json'
-  workflow_dispatch:
-
-permissions:
-  contents: read # default; apply-patch job overrides to write
-
-concurrency:
-  group: ts-autofix-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  generate-patch:
-    name: Generate eslint --fix patch
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    outputs:
-      has-fixes: ${{ steps.produce-patch.outputs.has-fixes }}
-    # No permissions override → inherits workflow-level contents: read.
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-          cache: npm
-
-      # --ignore-scripts: eslint only needs TS sources + eslint packages.
-      - uses: ./.github/actions/retry
-        with:
-          command: npm ci --ignore-scripts
-
-      - name: npm run fix in all workspaces
-        # continue-on-error: if un-fixable errors exist on main, we still want
-        # to commit whatever fixes were applied. The PR-time check in
-        # typecheck.yml is what blocks un-fixable errors from landing.
-        continue-on-error: true
-        run: npm run fix
-
-      - name: Produce patch
-        id: produce-patch
-        run: |
-          if git diff --quiet; then
-            echo "No fixes needed."
-            echo "has-fixes=false" >> "$GITHUB_OUTPUT"
-            # Empty patch signals "nothing to do" to apply-patch.
-            : > js-fix.patch
-          else
-            git diff > js-fix.patch
-            echo "has-fixes=true" >> "$GITHUB_OUTPUT"
-            echo "Patch size: $(wc -c < js-fix.patch) bytes"
-
-            # Reject patches that touch anything outside JS/TS/JSON sources.
-            # `npm run fix` should only ever modify those; anything else means
-            # eslint/prettier or a plugin went rogue and we refuse to ship it.
-            BAD=$(git diff --name-only | grep -vE '\.(js|cjs|mjs|ts|tsx|json)$' || true)
-            if [ -n "$BAD" ]; then
-              echo "::error::Refusing to upload patch — touches disallowed files:"
-              echo "$BAD"
-              exit 1
-            fi
-          fi
-
-      - name: Upload patch artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: js-fix-patch
-          path: js-fix.patch
-          retention-days: 1
-          include-hidden-files: true
-
-  apply-patch:
-    name: Apply patch
-    needs: generate-patch
-    # Skip entirely when generate-patch found no fixes — saves a runner,
-    # avoids a redundant checkout/download, and keeps the job graph honest.
-    if: needs.generate-patch.outputs.has-fixes == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    permissions:
-      contents: write # needed to push to bot/js-autofix
-      pull-requests: write # needed for PR creation + auto-merge
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Download patch
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
-        with:
-          name: js-fix-patch
-          # ${{ runner.temp }} expands in with: params (shell-style $VAR does not).
-          # download-artifact's path is a *directory* — the artifact's js-fix.patch
-          # file lands inside it, so $RUNNER_TEMP/js-fix.patch resolves correctly
-          # in the run step below.
-          path: ${{ runner.temp }}
-
-      - name: Apply patch and push to bot branch
-        env:
-          BOT_BRANCH: bot/js-autofix
-        run: |
-          set -euo pipefail
-
-          # Empty patch = nothing to do.
-          if [ ! -s "$RUNNER_TEMP/js-fix.patch" ]; then
-            echo "Patch is empty. No fixes to apply."
-            exit 0
-          fi
-
-          # Apply the patch produced by the unprivileged job.
-          git apply --check "$RUNNER_TEMP/js-fix.patch" || {
-            echo "::error::Patch does not apply cleanly. Branch may have moved."
-            exit 1
-          }
-          git apply "$RUNNER_TEMP/js-fix.patch"
-
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add -A
-          git commit -m "fmt(js): \`npm run fix\` on merge"
-
-          # Push to the dedicated bot branch. Force-push is safe here:
-          # bot/js-autofix is a bot-only branch that gets rewritten each run.
-          # If the branch was deleted after a previous PR merge, this
-          # recreates it.
-          git push --force origin HEAD:"$BOT_BRANCH"
-
-      - name: Create/update PR and enable auto-merge
-        env:
-          GH_TOKEN: ${{ secrets.AUTOFIX_BOT_PAT }}
-          BOT_BRANCH: bot/js-autofix
-        run: |
-          set -euo pipefail
-
-          # Create PR if one doesn't exist. If it already exists, the
-          # force-push above already updated it with the latest fixes.
-          PR_NUM=$(gh pr list --head "$BOT_BRANCH" --state open --json number --jq '.[0].number' 2>/dev/null || true)
-          if [ -z "$PR_NUM" ]; then
-            # gh pr create prints the PR URL. Extract the number from it
-            # (https://github.com/<org>/<repo>/pull/<number>).
-            PR_URL=$(gh pr create \
-              --head "$BOT_BRANCH" --base main \
-              --title 'fmt(js): `npm run fix` auto-fix' \
-              --body 'Auto-generated by the `auto-fix lint issues & formatting` workflow. Auto-merges (squash) once CI passes. If CI fails or `main` moves, the PR is auto-closed and the branch deleted — the next run re-applies on the current state.')
-            PR_NUM=$(echo "$PR_URL" | grep -oE '[0-9]+$')
-          fi
-
-          # Enable auto-merge (squash). If already enabled, this is a no-op.
-          gh pr merge "$PR_NUM" --auto --squash || true
-
-      - name: Wait for merge, auto-close on failure or stale
-        env:
-          GH_TOKEN: ${{ secrets.AUTOFIX_BOT_PAT }}
-          START_SHA: ${{ github.sha }}
-        run: |
-          set -euo pipefail
-
-          PR_NUM=$(gh pr list --head bot/js-autofix --state open --json number --jq '.[0].number' 2>/dev/null || true)
-          if [ -z "$PR_NUM" ]; then
-            echo "No open PR. Nothing to wait for."
-            exit 0
-          fi
-
-          echo "Waiting for PR #$PR_NUM to merge..."
-
-          # Poll every 15s for up to ~10 minutes. Auto-merge will handle the
-          # PR even if this job times out — the polling is for cleanup only
-          # (auto-close on CI failure, conflicts, or main moving).
-          for i in $(seq 1 40); do
-            sleep 15
-
-            STATE=$(gh pr view "$PR_NUM" --json state --jq '.state')
-            if [ "$STATE" = "MERGED" ] || [ "$STATE" = "CLOSED" ]; then
-              echo "PR #$PR_NUM is $STATE."
-              exit 0
-            fi
-
-            # If main moved, the PR may have already merged (which moves
-            # main) or another commit landed. Re-check state first.
-            CURRENT_SHA=$(gh api "repos/${{ github.repository }}/branches/main" --jq '.commit.sha')
-            if [ "$CURRENT_SHA" != "$START_SHA" ]; then
-              STATE=$(gh pr view "$PR_NUM" --json state --jq '.state')
-              if [ "$STATE" = "MERGED" ]; then
-                echo "PR #$PR_NUM merged (main moved to $CURRENT_SHA)."
-                exit 0
-              fi
-              echo "Main moved ($START_SHA → $CURRENT_SHA). Closing stale PR."
-              gh pr close "$PR_NUM" --delete-branch || true
-              exit 0
-            fi
-
-            # If CI checks failed, close + delete the branch.
-            if gh pr checks "$PR_NUM" 2>/dev/null | grep -qi "fail"; then
-              echo "CI failed on PR #$PR_NUM. Closing + deleting branch."
-              gh pr close "$PR_NUM" --delete-branch
-              exit 0
-            fi
-
-            # If PR is conflicted, close + delete the branch.
-            MERGEABLE=$(gh pr view "$PR_NUM" --json mergeable --jq '.mergeable')
-            if [ "$MERGEABLE" = "CONFLICTING" ]; then
-              echo "PR #$PR_NUM is conflicted. Closing + deleting branch."
-              gh pr close "$PR_NUM" --delete-branch
-              exit 0
-            fi
-          done
-
-          echo "Timeout reached. Auto-merge will handle PR #$PR_NUM if CI passes."
@@ -1,49 +0,0 @@
-# .github/workflows/js-tests.yml
-name: JS Tests
-
-on:
-  workflow_call:
-
-jobs:
-  workspaces:
-    name: List npm workspaces
-    runs-on: ubuntu-latest
-    outputs:
-      packages: ${{ steps.set-matrix.outputs.packages }}
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-          cache: npm
-      - uses: ./.github/actions/retry
-        with:
-          command: npm ci --ignore-scripts
-      - id: set-matrix
-        run: |
-          PACKAGES=$(npm query .workspace | jq -c '[.[].location]')
-          if [ "$PACKAGES" = "[]" ] || [ -z "$PACKAGES" ]; then
-            echo "::error::Workspace discovery produced an empty package list — refusing to emit a zero-length matrix (would skip all JS/TS checks silently)."
-            exit 1
-          fi
-          echo "packages=$PACKAGES" >> "$GITHUB_OUTPUT"
-
-  check:
-    name: Typecheck & Test
-    needs: workspaces
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        package: ${{ fromJson(needs.workspaces.outputs.packages) }}
-      fail-fast: false # report all failures, not just the first one
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-          cache: npm
-      - uses: ./.github/actions/retry
-        with:
-          command: npm ci
-      - run: npm run --prefix ${{ matrix.package }} check
-      - run: npm run --prefix ${{ matrix.package }} fix
@@ -15,10 +15,6 @@ on:
        description: The event name from the calling orchestrator (pull_request or push).
        type: string
        required: true
-      ci_review:
-        description: Whether CI-sensitive files (eslint config, workflows, actions) changed and require a review label.
-        type: boolean
-        default: false

 permissions:
  contents: read
@@ -102,8 +98,6 @@ jobs:
          echo "base ty:   $(wc -c < .lint-reports/base/ty.json) bytes"

      - name: Generate diff summary
-        env:
-          HEAD_REF: ${{ inputs.event_name == 'pull_request' && github.head_ref || github.ref_name }}
        run: |
          python scripts/lint_diff.py \
            --base-ruff .lint-reports/base/ruff.json \
@@ -111,7 +105,7 @@ jobs:
            --base-ty   .lint-reports/base/ty.json \
            --head-ty   .lint-reports/head/ty.json \
            --base-ref  "${{ steps.base.outputs.ref }}" \
-            --head-ref  "$HEAD_REF" \
+            --head-ref  "${{ inputs.event_name == 'pull_request' && github.head_ref || github.ref_name }}" \
            --output    .lint-reports/summary.md
          cat .lint-reports/summary.md >> "$GITHUB_STEP_SUMMARY"

@@ -162,111 +156,3 @@ jobs:

      - name: Run footgun checker
        run: python scripts/check-windows-footguns.py --all
-
-  ci-review:
-    # Require explicit maintainer review when CI-sensitive files change:
-    # eslint config, workflow YAMLs, or composite actions. These files
-    # influence what code the js-autofix job executes and pushes to
-    # main, so a malicious PR could inject arbitrary code via a custom eslint
-    # rule's `fix` function. The label gate ensures a human reviews before
-    # merge. Mirrors the mcp-catalog-reviewed pattern in supply-chain-audit.yml.
-    name: CI-sensitive file review
-    if: inputs.event_name == 'pull_request' && inputs.ci_review
-    runs-on: ubuntu-latest
-    timeout-minutes: 2
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Require ci-reviewed label
-        id: label-check
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          PR="${{ github.event.pull_request.number }}"
-          LABELS=$(gh pr view "$PR" --json labels --jq '.labels[].name' || true)
-          if echo "$LABELS" | grep -Fxq 'ci-reviewed'; then
-            echo "reviewed=true" >> "$GITHUB_OUTPUT"
-            echo "ci-reviewed label present."
-            exit 0
-          fi
-          echo "reviewed=false" >> "$GITHUB_OUTPUT"
-
-      # On failure: find the bot's previous comment and edit it, or create
-      # a new one if none exists. Using an HTML comment marker so we can
-      # locate it reliably across runs without parsing the body text.
-      # Skipped on fork PRs — GITHUB_TOKEN is read-only there, so the API
-      # call would fail. The label gate still holds via the step below.
-      - name: Post or update review warning
-        if: steps.label-check.outputs.reviewed != 'true' && github.event.pull_request.head.repo.fork != true
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          PR="${{ github.event.pull_request.number }}"
-          MARKER="<!-- ci-review-bot -->"
-          BODY="${MARKER}
-          ## ⚠️ CI-sensitive file review required
-
-          This PR changes CI-sensitive files (eslint config, workflow YAMLs,
-          or composite actions). These files influence what code the
-          js-autofix job executes and pushes to main.
-
-          A maintainer should verify:
-          - no new eslint rules with custom \`fix\` functions that write outside linted paths,
-          - no workflow changes that widen permissions or remove guards,
-          - no composite action changes that alter what gets executed.
-
-          After review, add the \`ci-reviewed\` label and re-run this check."
-
-          # Find an existing comment with our marker.
-          COMMENT_ID=$(gh api \
-            "repos/${{ github.repository }}/issues/${PR}/comments" \
-            --paginate --jq ".[] | select(.body | contains(\"${MARKER}\")) | .id" \
-            | head -1 || true)
-
-          if [ -n "$COMMENT_ID" ]; then
-            gh api --method PATCH \
-              "repos/${{ github.repository }}/issues/comments/${COMMENT_ID}" \
-              -f body="$BODY"
-          else
-            gh pr comment "$PR" --body "$BODY"
-          fi
-
-      # Fail the job when the label is missing — always runs (including
-      # fork PRs) so the security gate holds even when the comment step
-      # was skipped above.
-      - name: Fail on missing label
-        if: steps.label-check.outputs.reviewed != 'true'
-        run: |
-          echo "::error::CI-sensitive changes require the ci-reviewed label."
-          exit 1
-
-      # On success: if a previous warning comment exists, edit it to show
-      # the review passed so the PR doesn't have a stale ⚠️ sitting around.
-      # Skipped on fork PRs — no comment was ever posted to update.
-      - name: Update previous warning to passed
-        if: steps.label-check.outputs.reviewed == 'true' && github.event.pull_request.head.repo.fork != true
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          PR="${{ github.event.pull_request.number }}"
-          MARKER="<!-- ci-review-bot -->"
-
-          # Find an existing comment with our marker.
-          COMMENT_ID=$(gh api \
-            "repos/${{ github.repository }}/issues/${PR}/comments" \
-            --paginate --jq ".[] | select(.body | contains(\"${MARKER}\")) | .id" \
-            | head -1 || true)
-
-          if [ -n "$COMMENT_ID" ]; then
-            BODY="${MARKER}
-          ## ✅ CI-sensitive file review passed
-
-          The \`ci-reviewed\` label is present on this PR."
-
-            gh api --method PATCH \
-              "repos/${{ github.repository }}/issues/comments/${COMMENT_ID}" \
-              -f body="$BODY"
-          fi
@@ -1,98 +0,0 @@
-name: Lockfile diff
-
-# Advisory PR comment showing the *semantic* diff of package-lock.json
-# changes — which packages were added/removed/updated and their versions.
-# The raw textual diff of a lockfile is unreadable (npm reorders entries
-# and rewrites integrity hashes), so scripts/ci/lockfile_diff.py parses
-# the ``packages`` map at the merge base and at HEAD and set-diffs the
-# {install path: version} maps instead.
-#
-# The comment is upserted: the script embeds a hidden HTML marker and the
-# workflow PATCHes the existing comment when one is found, so a PR gets
-# exactly one lockfile-diff comment that tracks the latest push instead
-# of a stack of stale ones. When a later push reverts all lockfile
-# changes, the comment is updated to say so (deleting it would be more
-# surprising than telling the reviewer it's resolved).
-#
-# Never blocking — this is review signal, not enforcement. Exit is 0 even
-# when commenting fails (fork PRs get a read-only GITHUB_TOKEN).
-
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-  pull-requests: write # post/update the diff comment
-
-concurrency:
-  group: lockfile-diff-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  diff:
-    name: package-lock.json semantic diff
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0 # need history for the merge base
-
-      - name: Generate semantic lockfile diff
-        id: diff
-        run: |
-          set -euo pipefail
-          # Three-dot semantics by hand: diff from the merge base with the
-          # target branch to the PR head, so changes that landed on main
-          # after the branch point don't show up as this PR's doing.
-          BASE_SHA=$(git merge-base "origin/${{ github.base_ref }}" HEAD)
-          echo "Merge base: ${BASE_SHA}"
-          python3 scripts/ci/lockfile_diff.py \
-            --base "$BASE_SHA" \
-            --head HEAD \
-            --output /tmp/lockfile-diff.md
-          if [ -s /tmp/lockfile-diff.md ]; then
-            echo "changed=true" >> "$GITHUB_OUTPUT"
-            cat /tmp/lockfile-diff.md >> "$GITHUB_STEP_SUMMARY"
-          else
-            echo "changed=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Post or update PR comment
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REPO: ${{ github.repository }}
-          PR: ${{ github.event.pull_request.number }}
-          CHANGED: ${{ steps.diff.outputs.changed }}
-        run: |
-          set -euo pipefail
-          MARKER='<!-- hermes-lockfile-diff -->'
-
-          # Find our previous comment (paginated — busy PRs exceed one page).
-          EXISTING=$(gh api --paginate "repos/${REPO}/issues/${PR}/comments" \
-            --jq ".[] | select(.body | startswith(\"$MARKER\")) | .id" \
-            | head -1 || true)
-
-          if [ "$CHANGED" != "true" ]; then
-            if [ -n "$EXISTING" ]; then
-              # A previous push changed the lockfile but the latest one
-              # doesn't — update the comment rather than leave stale info.
-              printf '%s\n✅ package-lock.json changes from an earlier push have been reverted — locked versions now match the target branch.\n' "$MARKER" > /tmp/lockfile-diff.md
-            else
-              echo "No lockfile changes and no existing comment — nothing to do."
-              exit 0
-            fi
-          fi
-
-          if [ -n "$EXISTING" ]; then
-            echo "Updating existing comment ${EXISTING}"
-            gh api --method PATCH "repos/${REPO}/issues/comments/${EXISTING}" \
-              -F body=@/tmp/lockfile-diff.md > /dev/null \
-              || echo "::warning::Could not update PR comment (expected for fork PRs — GITHUB_TOKEN is read-only)"
-          else
-            echo "Creating new comment"
-            gh api "repos/${REPO}/issues/${PR}/comments" \
-              -F body=@/tmp/lockfile-diff.md > /dev/null \
-              || echo "::warning::Could not post PR comment (expected for fork PRs — GITHUB_TOKEN is read-only)"
-          fi
@@ -14,11 +14,7 @@ name: OSV-Scanner
 # code patterns in PR diffs) by covering the orthogonal "currently-pinned
 # dep became known-vulnerable" case.
 #
-# Steps below are inlined from Google's officially-recommended reusable
-# workflow (google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml),
-# rather than called via `uses:` so we can set a `timeout-minutes` in the
-# degenerate case where this job hangs.
-
+# Uses Google's officially-recommended reusable workflow, pinned by SHA.
 # Findings land in the repo's Security tab (Code Scanning > OSV-Scanner).
 # fail-on-vuln is disabled so the job does not block merges on pre-existing
 # vulnerabilities in pinned deps that we may need to patch deliberately.
@@ -28,11 +24,11 @@ on:
  schedule:
    # Weekly scan against main — catches CVEs published after merge for
    # deps that haven't changed since.
-    - cron: '0 9 * * 1'
+    - cron: "0 9 * * 1"
  workflow_dispatch:

 permissions:
-  # Required to upload SARIF file to CodeQL. See: https://github.com/github/codeql-action/issues/2117
+  # Required by the reusable workflow to upload SARIF to the Security tab.
  actions: read
  contents: read
  security-events: write
@@ -40,62 +36,12 @@ permissions:
 jobs:
  scan:
    name: Scan lockfiles
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: 'Run scanner'
-        uses: google/osv-scanner-action/osv-scanner-action@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8
-        with:
-          # Scan explicit lockfiles rather than recursing, so we only look at
-          # the three sources of truth and skip vendored / test / worktree dirs.
-          scan-args: |-
-            --output=results.json
-            --format=json
-            --lockfile=uv.lock
-            --lockfile=package-lock.json
-            --lockfile=website/package-lock.json
-        continue-on-error: true
-
-      - name: 'Run osv-scanner-reporter'
-        uses: google/osv-scanner-action/osv-reporter-action@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8
-        with:
-          scan-args: |-
-            --output=results.sarif
-            --new=results.json
-            --gh-annotations=false
-            --fail-on-vuln=false
-
-      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
-      # format to the repository Actions tab.
-      - name: 'Upload artifact'
-        id: 'upload_artifact'
-        if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: OSV Scanner SARIF file
-          path: results.sarif
-          retention-days: 5
-
-      # Upload the results to GitHub's code scanning dashboard.
-      - name: 'Upload to code-scanning'
-        if: ${{ !cancelled() }}
-        uses: github/codeql-action/upload-sarif@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v4.31.10
-        with:
-          sarif_file: results.sarif
-
-      - name: 'Print Code Scanning URL'
-        if: ${{ !cancelled() }}
-        run: |
-          echo "View the OSV-Scanner results in the 'Security' tab, using the following link:"
-          echo "${{ github.server_url }}/${{ github.repository }}/security/code-scanning?query=is%3Aopen+branch%3A${GITHUB_REF_NAME}+tool%3Aosv-scanner"
-        env:
-          GITHUB_REF_NAME: ${{ github.ref_name }}
-
-      - name: 'Error troubleshooter'
-        if: ${{ always() && steps.upload_artifact.outcome == 'failure' }}
-        run: |
-          echo "::error::Artifact upload failed. This is most likely caused by a error during scanning earlier in the workflow."
-          exit 1
+    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8
+    with:
+      # Scan explicit lockfiles rather than recursing, so we only look at
+      # the three sources of truth and skip vendored / test / worktree dirs.
+      scan-args: |-
+        --lockfile=uv.lock
+        --lockfile=package-lock.json
+        --lockfile=website/package-lock.json
+      fail-on-vuln: false
@@ -0,0 +1,51 @@
+# .github/workflows/typecheck.yml
+name: Typecheck
+
+on:
+  workflow_call:
+
+jobs:
+  typecheck:
+    name: Check TypeScript
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        package:
+          [ui-tui, web, apps/bootstrap-installer, apps/desktop, apps/shared]
+      fail-fast: false # report all failures, not just the first one
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22
+          cache: npm
+      # --ignore-scripts: typecheck only needs the TS sources + type defs, not
+      # native builds. Skipping install scripts drops node-pty's node-gyp
+      # header fetch — the transient flake that killed this job pre-`tsc` — and
+      # is faster. retry covers the remaining registry blips.
+      - uses: ./.github/actions/retry
+        with:
+          command: npm ci --ignore-scripts
+      - run: npm run --prefix ${{ matrix.package }} typecheck
+
+  # Production build of the desktop renderer. `typecheck` runs `tsc` only,
+  # which does NOT exercise Vite/Rolldown module resolution — so an
+  # unresolvable package export (e.g. a transitive @assistant-ui/tap that no
+  # longer exports "./react-shim") slips past typecheck and only explodes when
+  # users build apps/desktop from source on install/update. Run the real
+  # `vite build` here so that class of break fails in CI instead.
+  desktop-build:
+    name: Build desktop app
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22
+          cache: npm
+      # Keep install scripts here: the production build may need node-pty's
+      # native binary. retry handles the transient install-time fetch flakes.
+      - uses: ./.github/actions/retry
+        with:
+          command: npm ci
+      - run: npm run --prefix apps/desktop build
@@ -8,7 +8,6 @@ __pycache__/
 .venv
 .vscode/
 .env
-.op.env
 .env.local
 .env.development.local
 .env.test.local
@@ -68,19 +67,8 @@ environments/benchmarks/evals/
 hermes_cli/web_dist/
 apps/desktop/build/
 apps/desktop/dist/
-
-# tsc-emitted artifacts (a stray `tsc -b` compiles into src/, and vite then
-# resolves the stale .js OVER the .tsx — never track these)
-apps/desktop/src/**/*.js
-apps/desktop/src/**/*.js.map
-apps/desktop/src/**/*.d.ts
-!apps/desktop/src/global.d.ts
-!apps/desktop/src/vite-env.d.ts
-apps/shared/src/**/*.js
-apps/shared/src/**/*.js.map
-apps/shared/src/**/*.d.ts
 apps/desktop/release/
-*.tsbuildinfo
+apps/desktop/*.tsbuildinfo

 # Web UI assets — synced from @nous-research/ui at build time via
 # `npm run sync-assets` (see web/package.json).
@@ -130,9 +118,6 @@ docs/superpowers/*
 # treat it as a local edit and autostash it on every run (#38529).
 .hermes-bootstrap-complete

-# Persistent dev sandbox dir (scripts/dev-sandbox.sh --persistent)
-.hermes-sandbox/
-
 # Interrupted-update breadcrumb + recovery lock written next to the shared venv
 # by `hermes update` / launch-time self-heal. Runtime state, never a code change
 # — ignore so `git status` stays clean and update's autostash skips them.
@@ -1,4 +0,0 @@
-# Lockfiles must never be reformatted — main has a repo rule requiring
-# team approval when lockfiles change, so an autofix PR touching one
-# would hang waiting for review.
-package-lock.json
@@ -491,18 +491,18 @@ The dashboard embeds the real `hermes --tui` — **not** a rewrite.  See `hermes

 ### Electron Desktop Chat App (`apps/desktop/`)

-A **separate** chat surface from both the classic CLI and the dashboard's embedded TUI. It is an Electron + React + nanostore renderer (`@assistant-ui/react`) that talks to a `tui_gateway` backend over JSON-RPC (`requestGateway(method, params)`). The WebSocket/JSON-RPC transport lives in the framework-agnostic `apps/shared` package (`@hermes/shared` — `JsonRpcGatewayClient` + WS URL helpers), which the web dashboard (`web/`) also consumes; **desktop has no build/runtime dependency on the dashboard frontend** — it spawns a headless `hermes serve` backend server (the same gateway `dashboard` serves, minus the browser UI entirely: `serve` sets `headless_backend=True`, so `cmd_dashboard` skips `_build_web_ui` AND exports `HERMES_SERVE_HEADLESS=1` so `mount_spa()` disables the SPA even if a stray `web_dist/` exists — only the JSON-RPC/WS/API surface is reachable). `dashboard` and `serve` share `cmd_dashboard`/`start_server` but are independent surfaces — neither launches the other. The one exception is a backward-compat *fallback*: `serve` is newer, so the desktop spawn (`electron/backend-command.ts` + `backendSupportsServe()` in `electron/main.ts`) detects whether the resolved runtime registers `serve` and, only when it does not (an older managed install / PATH `hermes` the app hasn't updated yet), rewrites the argv to the legacy `dashboard --no-open`. Without that, a new app against an un-upgraded runtime would crash on an unknown subcommand and brick every mid-upgrade user. It does NOT embed `hermes --tui` — it has its own composer, transcript, and slash-command pipeline. For scoped Desktop architecture, state, resolver, transport, and testing rules, read `apps/desktop/AGENTS.md`.
+A **separate** chat surface from both the classic CLI and the dashboard's embedded TUI. It is an Electron + React + nanostore renderer (`@assistant-ui/react`) that talks to a `tui_gateway` backend over JSON-RPC (`requestGateway(method, params)`). The WebSocket/JSON-RPC transport lives in the framework-agnostic `apps/shared` package (`@hermes/shared` — `JsonRpcGatewayClient` + WS URL helpers), which the web dashboard (`web/`) also consumes; **desktop has no build/runtime dependency on the dashboard frontend** — it spawns a headless `hermes serve` backend server (the same gateway `dashboard` serves, minus the browser UI). `dashboard` and `serve` share `cmd_dashboard`/`start_server` but are independent surfaces — neither launches the other. The one exception is a backward-compat *fallback*: `serve` is newer, so the desktop spawn (`electron/backend-command.cjs` + `backendSupportsServe()` in `main.cjs`) detects whether the resolved runtime registers `serve` and, only when it does not (an older managed install / PATH `hermes` the app hasn't updated yet), rewrites the argv to the legacy `dashboard --no-open`. Without that, a new app against an un-upgraded runtime would crash on an unknown subcommand and brick every mid-upgrade user. It does NOT embed `hermes --tui` — it has its own composer, transcript, and slash-command pipeline. Route desktop bugs to the `hermes-desktop-app-work` skill, not `hermes-dashboard-work`.

 **Slash commands in the desktop app are curated client-side, then dispatched to the backend.** The pipeline:

 - **Backend already provides everything.** `tui_gateway/server.py` `commands.catalog` (empty-query list) and `complete.slash` (typed-query completions) both include built-in commands, user `quick_commands`, AND skill-derived commands (`scan_skill_commands()` / `get_skill_commands()`). The desktop app does not need a new RPC to see skills.
- **The renderer curates via `apps/desktop/src/lib/desktop-slash-commands.ts`.** This is the load-bearing file. It holds `DESKTOP_COMMAND_SPECS` (the built-ins and their Desktop surfaces) plus `NO_DESKTOP_SURFACE` block-lists for terminal-only / messaging-only / picker-owned / settings-owned / advanced commands that should NOT clutter the desktop popover.
+- **The renderer curates via `apps/desktop/src/lib/desktop-slash-commands.ts`.** This is the load-bearing file. It holds `DESKTOP_COMMANDS` (the ~19 built-ins shown in the palette) plus block-lists for terminal-only / messaging-only / picker-owned / settings-owned / advanced commands that should NOT clutter the desktop popover.
  - `isDesktopSlashCommand(name)` — gates **execution**. Returns true for built-ins AND for any non-built-in (skill / quick command), so typed extension commands run.
  - `isDesktopSlashSuggestion(name)` — gates **discovery/completion**. Used by BOTH completion paths in `app/chat/composer/hooks/use-slash-completions.ts` (empty-query catalog filter + typed-query `complete.slash` filter) and by `filterDesktopCommandsCatalog`.
  - `isDesktopSlashExtensionCommand(name)` — true when the command is NOT a known Hermes built-in (i.e. a skill or user quick command). Both suggestion and catalog-filter paths allow extensions through so skill commands surface in the palette. (Added when fixing "skill commands missing from the desktop slash palette" — the curated allow-list was silently dropping every skill/quick command from completions even though they executed fine when typed.)
- **Dispatch** lives in `app/session/hooks/use-prompt-actions/slash.ts` (`runSlash`): built-ins that the desktop owns (`/skin`, `/help`, `/new`, …) are handled locally or via `commands.catalog`; everything else goes to `slash.exec`, falling back to `command.dispatch` (which the gateway resolves into skill / alias / exec directives). A skill command resolves to `{type: "skill", message}` and is submitted as a normal prompt.
+- **Dispatch** lives in `app/session/hooks/use-prompt-actions.ts` (`runSlash`): built-ins that the desktop owns (`/skin`, `/help`, `/new`, …) are handled locally or via `commands.catalog`; everything else goes to `slash.exec`, falling back to `command.dispatch` (which the gateway resolves into skill / alias / exec directives). A skill command resolves to `{type: "skill", message}` and is submitted as a normal prompt.

-**Rule:** the desktop slash palette's curation is about hiding noise (terminal-only / messaging-only built-ins), NOT about hiding user-activated extensions. Skill commands and `quick_commands` are extensions the backend surfaces — they belong in completions. If you tighten `desktop-slash-commands.ts`, keep `isDesktopSlashExtensionCommand` flowing into both the suggestion and catalog-filter paths. Tests: from `apps/desktop`, run `npx vitest run src/lib/desktop-slash-commands.test.ts` (workspace dependencies are installed at the repo root).
+**Rule:** the desktop slash palette's curation is about hiding noise (terminal-only / messaging-only built-ins), NOT about hiding user-activated extensions. Skill commands and `quick_commands` are extensions the backend surfaces — they belong in completions. If you tighten `desktop-slash-commands.ts`, keep `isDesktopSlashExtensionCommand` flowing into both the suggestion and catalog-filter paths. Tests: `apps/desktop/src/lib/desktop-slash-commands.test.ts` (run via the repo-root `vitest`, since `apps/desktop` resolves deps from the root workspace install).

 ---

@@ -1094,16 +1094,14 @@ kanban task.

 - **CLI:** `hermes_cli/kanban.py` wires `hermes kanban` with verbs
  `init`, `create`, `list` (alias `ls`), `show`, `assign`, `link`,
-  `unlink`, `comment`, `attach`, `attachments`, `attach-rm`, `complete`,
-  `block`, `unblock`, `archive`, `tail`, plus less-commonly-used `watch`,
-  `stats`, `runs`, `log`, `assignees`, `heartbeat`, `notify-*`,
-  `dispatch`, `daemon`, `gc`.
+  `unlink`, `comment`, `complete`, `block`, `unblock`, `archive`,
+  `tail`, plus less-commonly-used `watch`, `stats`, `runs`, `log`,
+  `assignees`, `heartbeat`, `notify-*`, `dispatch`, `daemon`, `gc`.
 - **Worker/orchestrator toolset:** `tools/kanban_tools.py` exposes
  `kanban_show`, `kanban_complete`, `kanban_block`, `kanban_heartbeat`,
-  `kanban_comment`, `kanban_create`, `kanban_link`, `kanban_attach`,
-  `kanban_attach_url`, `kanban_attachments`; profiles that explicitly
-  enable the `kanban` toolset outside a dispatcher-spawned task also get
-  `kanban_list` and `kanban_unblock` for board routing.
+  `kanban_comment`, `kanban_create`, `kanban_link`; profiles that
+  explicitly enable the `kanban` toolset outside a dispatcher-spawned
+  task also get `kanban_list` and `kanban_unblock` for board routing.
 - **Dispatcher:** long-lived loop that (default every 60s) reclaims
  stale claims, promotes ready tasks, atomically claims, and spawns
  assigned profiles. Runs **inside the gateway** by default via
@@ -1280,7 +1278,6 @@ def profile_env(tmp_path, monkeypatch):

 ## Testing

-### Python
 **ALWAYS use `scripts/run_tests.sh`** — do not call `pytest` directly. The script enforces
 hermetic environment parity with CI (unset credential vars, TZ=UTC, LANG=C.UTF-8,
 `-n auto` xdist workers, in-tree subprocess-isolation plugin). Direct `pytest`
@@ -1294,12 +1291,12 @@ scripts/run_tests.sh tests/agent/test_foo.py::test_x  # one test
 scripts/run_tests.sh -v --tb=long                     # pass-through pytest flags
 ```

-#### Subprocess-per-test-file isolation
+### Subprocess-per-test-file isolation

 Every test file runs in a freshly-spawned Python subprocess via `run_tests_parallel.py`. This means module-level dicts/sets and
 ContextVars from one test file cannot leak into the next.

-#### Why the wrapper
+### Why the wrapper

 |                     | Without wrapper                             | With wrapper                              |
 | ------------------- | ------------------------------------------- | ----------------------------------------- |
@@ -1308,17 +1305,6 @@ ContextVars from one test file cannot leak into the next.
 | Timezone            | Local TZ (PDT etc.)                         | UTC                                       |
 | Locale              | Whatever is set                             | C.UTF-8                                   |

-### Where to place what tests
-
-The CI change classifier (`scripts/ci/classify_changes.py`) runs specific jobs based on what files changed. A Python test that asserts
-about the contents of `package.json`, `package-lock.json`, `.ts`/`.tsx`
-source, or any other JS-side artifact will not run on a PR that only touches
-those files. This means a regression can go green on a PR and red on `main` (where the
-classifier fails open and runs everything).
-
-Any test that reads or asserts about `package.json`,
-`package-lock.json`, `tsconfig.json`, `.ts`/`.tsx`/`.js`/`.mjs`/`.cjs`
-source files configuration belongs in the JS (vitest) test suite, not in `tests/*.py`.

 ### Don't write change-detector tests

@@ -1368,58 +1354,3 @@ not the specific names.

 Reviewers should reject new change-detector tests; authors should convert
 them into invariants before re-requesting review.
-
-### Never read source code in tests
-
-A test that reads a source file's text is testing *the shape of the
-source code*, not its behavior. This is a hard antipattern, banned outright.
-Any test that reads a .py, .ts, .tsx, etc., file is suspect.
-
-**Why it's actively harmful, not just weak:**
-
- It passes when the implementation is subtly broken (the regex matches a
-  call site that exists but is wired wrong) and fails when a correct
-  refactor changes formatting, variable names, or control flow with
-  identical runtime behavior. Both directions of failure are wrong.
- It can't be run against a built/bundled/minified artifact, so it silently
-  stops testing anything the moment code moves, gets renamed, or a
-  dependency reformats it.
- It actively blocks refactors: reviewers see "keeps a pattern intact" tests
-  fail during pure structural cleanup with no behavior change, and either
-  hand-wave the failure (dangerous) or waste time updating regexes that add
-  nothing (waste).
- It gives false confidence. a green suite full of source-regex tests
-  looks like coverage but has never once executed the code path it claims
-  to guard.
-
-**Do not write:**
-
-```ts
-const source = fs.readFileSync(path.join(__dirname, 'main.ts'), 'utf8')
-
-test('backend spawn hides the Windows console', () => {
-  assert.match(source, /spawn\(\s*backend\.command,\s*backend\.args[\s\S]{0,300}hiddenWindowsChildOptions/)
-})
-```
-
-**Do write — extract the logic into a small pure/DI-testable function and
-call it for real:**
-
-```ts
-// backend-spawn.ts
-export function hiddenWindowsChildOptions(options: SpawnOptionsLike = {}, isWindows = process.platform === 'win32') {
-  if (!isWindows || 'windowsHide' in options) return options
-  return { ...options, windowsHide: true }
-}
-
-// backend-spawn.test.ts
-test('windowsHide defaults to true on Windows, is left alone elsewhere', () => {
-  assert.equal(hiddenWindowsChildOptions({}, true).windowsHide, true)
-  assert.equal(hiddenWindowsChildOptions({}, false).windowsHide, undefined)
-  assert.equal(hiddenWindowsChildOptions({ windowsHide: false }, true).windowsHide, false)
-})
-```
-
-If the logic lives inline in a god-file (`main.ts`, `cli.py`,
-`gateway/run.py`) and extracting it feels disruptive: that's the actual
-signal to do the extraction, not to regex around it.
@@ -74,7 +74,7 @@ Esto no es una barra de calidad — es una decisión de acoplamiento y mantenimi
 | Requisito | Notas |
 |-----------|-------|
 | **Git** | Con la extensión `git-lfs` instalada |
-| **Python 3.11–3.13** | uv lo instalará si falta |
+| **Python 3.11+** | uv lo instalará si falta |
 | **uv** | Gestor de paquetes Python rápido ([instalar](https://docs.astral.sh/uv/)) |
 | **Node.js 20+** | Opcional — necesario para herramientas de navegador y puente WhatsApp (coincide con los engines de `package.json` raíz) |

@@ -109,7 +109,7 @@ A well-built third-party-product plugin can clear automated review and still be
 | Requirement | Notes |
 |-------------|-------|
 | **Git** | With the `git-lfs` extension installed |
-| **Python 3.11–3.13** | uv will install it if missing |
+| **Python 3.11+** | uv will install it if missing |
 | **uv** | Fast Python package manager ([install](https://docs.astral.sh/uv/)) |
 | **Node.js 20+** | Optional — needed for browser tools and WhatsApp bridge (matches root `package.json` engines) |

@@ -7,7 +7,5 @@ graft locales
 # built from the sdist (e.g. Homebrew, downstream packagers). package-data
 # below covers the wheel; this covers the sdist. See #34034 / #28149.
 recursive-include plugins plugin.yaml plugin.yml
-# Gateway assets include images plus YAML catalogs such as status_phrases.yaml.
-recursive-include gateway/assets *
 global-exclude __pycache__
 global-exclude *.py[cod]
@@ -109,7 +109,6 @@ hermes              # Interactive CLI — start a conversation
 hermes model        # Choose your LLM provider and model
 hermes tools        # Configure which tools are enabled
 hermes config set   # Set individual config values
-hermes config get   # Print individual config values
 hermes gateway      # Start the messaging gateway (Telegram, Discord, etc.)
 hermes setup        # Run the full setup wizard (configures everything at once)
 hermes claw migrate # Migrate from OpenClaw (if coming from OpenClaw)
@@ -10,7 +10,6 @@ from __future__ import annotations
 import asyncio
 import json
 import logging
-import re
 import tempfile
 from concurrent.futures import TimeoutError as FutureTimeout
 from contextvars import ContextVar, Token
@@ -128,64 +127,13 @@ def _proposal_for_patch_replace(arguments: dict[str, Any]) -> EditProposal:
    )


-def _extract_v4a_patch_paths(patch_body: str) -> list[str]:
-    paths: list[str] = []
-    for match in re.finditer(
-        r'^\*\*\*\s+(?:Update|Add|Delete)\s+File:\s*(.+)$',
-        patch_body,
-        re.MULTILINE,
-    ):
-        path = match.group(1).strip()
-        if path:
-            paths.append(path)
-    for match in re.finditer(
-        r'^\*\*\*\s+Move\s+File:\s*(.+?)\s*->\s*(.+)$',
-        patch_body,
-        re.MULTILINE,
-    ):
-        src = match.group(1).strip()
-        dst = match.group(2).strip()
-        if src:
-            paths.append(src)
-        if dst:
-            paths.append(dst)
-    return paths
-
-
-def _proposal_for_patch_v4a(arguments: dict[str, Any]) -> EditProposal:
-    patch_body = arguments.get("patch")
-    if not isinstance(patch_body, str) or not patch_body:
-        raise ValueError("patch content required")
-
-    paths = _extract_v4a_patch_paths(patch_body)
-    if not paths:
-        raise ValueError("no file paths found in V4A patch")
-
-    proposal_path = paths[0] if len(paths) == 1 else ", ".join(paths)
-    old_text = _read_text_if_exists(paths[0]) if len(paths) == 1 else None
-    return EditProposal(
-        tool_name="patch",
-        path=proposal_path,
-        old_text=old_text,
-        # ACP only supports a single diff payload here.  Surface the exact V4A
-        # patch content before execution so patch-mode calls are permissioned
-        # and denied patches cannot mutate.
-        new_text=patch_body,
-        arguments=dict(arguments),
-    )
-
-
 def build_edit_proposal(tool_name: str, arguments: dict[str, Any]) -> EditProposal | None:
    """Return an edit proposal for supported file mutation calls."""

    if tool_name == "write_file":
        return _proposal_for_write_file(arguments)
-    if tool_name == "patch":
-        mode = arguments.get("mode", "replace")
-        if mode == "replace":
-            return _proposal_for_patch_replace(arguments)
-        if mode == "patch":
-            return _proposal_for_patch_v4a(arguments)
+    if tool_name == "patch" and arguments.get("mode", "replace") == "replace":
+        return _proposal_for_patch_replace(arguments)
    return None


@@ -38,22 +38,19 @@ def _permission_option_supports_kind(kind: str) -> bool:
    return True


-def _build_permission_options(
-    *, allow_permanent: bool, smart_denied: bool = False,
-) -> list[PermissionOption]:
+def _build_permission_options(*, allow_permanent: bool) -> list[PermissionOption]:
    """Return ACP options that match Hermes approval semantics."""
-    options = [PermissionOption(
-        option_id="allow_once", kind="allow_once", name="Allow once",
-    )]
-    if not smart_denied:
-        options.append(PermissionOption(
+    options = [
+        PermissionOption(option_id="allow_once", kind="allow_once", name="Allow once"),
+        PermissionOption(
            option_id="allow_session",
            # ACP has no session-scoped kind, so use the closest persistent
            # hint while keeping Hermes semantics in the option id.
            kind="allow_always",
            name="Allow for session",
-        ))
-    if allow_permanent and not smart_denied:
+        ),
+    ]
+    if allow_permanent:
        options.append(
            PermissionOption(
                option_id="allow_always",
@@ -62,7 +59,7 @@ def _build_permission_options(
            ),
        )
    options.append(PermissionOption(option_id="deny", kind="reject_once", name="Deny"))
-    if not smart_denied and _permission_option_supports_kind("reject_always"):
+    if _permission_option_supports_kind("reject_always"):
        options.append(
            PermissionOption(
                option_id="deny_always",
@@ -132,15 +129,11 @@ def make_approval_callback(
        description: str,
        *,
        allow_permanent: bool = True,
-        smart_denied: bool = False,
        **_: object,
    ) -> str:
        from agent.async_utils import safe_schedule_threadsafe

-        options = _build_permission_options(
-            allow_permanent=allow_permanent,
-            smart_denied=smart_denied,
-        )
+        options = _build_permission_options(allow_permanent=allow_permanent)

        tool_call = _build_permission_tool_call(command, description)
        coro = request_permission_fn(
@@ -74,10 +74,6 @@ from acp_adapter.permissions import make_approval_callback
 from acp_adapter.provenance import session_provenance_meta
 from acp_adapter.session import SessionManager, SessionState, _expand_acp_enabled_toolsets
 from acp_adapter.tools import build_tool_complete, build_tool_start
-from tools.approval import (
-    reset_hermes_interactive_context,
-    set_hermes_interactive_context,
-)

 logger = logging.getLogger(__name__)

@@ -1450,23 +1446,20 @@ class HermesACPAgent(acp.Agent):
        # Approval callback is per-thread (thread-local, GHSA-qg5c-hvr5-hjgr).
        # Set it INSIDE _run_agent so the TLS write happens in the executor
        # thread — setting it here would write to the event-loop thread's TLS,
-        # not the executor's. Interactive routing uses a contextvar in
-        # tools.approval (set_hermes_interactive_context) rather than
-        # os.environ["HERMES_INTERACTIVE"], so concurrent executor workers can't
-        # race on a process-global flag — one session's restore can't drop
-        # another onto the non-interactive auto-approve path mid-run
-        # (GHSA-96vc-wcxf-jjff). The contextvar write is isolated by the
-        # contextvars.copy_context() wrapper around the executor call below.
+        # not the executor's. Also set HERMES_INTERACTIVE so approval.py
+        # takes the CLI-interactive path (which calls the registered
+        # callback via prompt_dangerous_approval) instead of the
+        # non-interactive auto-approve branch (GHSA-96vc-wcxf-jjff).
        # ACP's conn.request_permission maps cleanly to the interactive
        # callback shape — not the gateway-queue HERMES_EXEC_ASK path,
        # which requires a notify_cb registered in _gateway_notify_cbs.
        previous_approval_cb = None
-        interactive_token = None
+        previous_interactive = None
        edit_approval_token = None
        previous_session_id = None

        def _run_agent() -> dict:
-            nonlocal previous_approval_cb, interactive_token, edit_approval_token, previous_session_id
+            nonlocal previous_approval_cb, previous_interactive, edit_approval_token, previous_session_id
            # Bind HERMES_SESSION_KEY for this session so per-session caches
            # (e.g. the interactive sudo password cache in tools.terminal_tool)
            # scope to the ACP session rather than leaking across sessions
@@ -1498,10 +1491,9 @@ class HermesACPAgent(acp.Agent):
                except Exception:
                    logger.debug("Could not set ACP edit approval requester", exc_info=True)
            # Signal to tools.approval that we have an interactive callback
-            # and the non-interactive auto-approve path must not fire. Uses a
-            # contextvar (not os.environ) so concurrent executor workers don't
-            # race on the flag (GHSA-96vc-wcxf-jjff).
-            interactive_token = set_hermes_interactive_context(True)
+            # and the non-interactive auto-approve path must not fire.
+            previous_interactive = os.environ.get("HERMES_INTERACTIVE")
+            os.environ["HERMES_INTERACTIVE"] = "1"
            # Propagate the originating ACP session id to tools that want to
            # tag side-effects with it (e.g. ``kanban_create`` stamps it on
            # the new task so clients can render a per-session board). Save
@@ -1521,9 +1513,11 @@ class HermesACPAgent(acp.Agent):
                logger.exception("Agent error in session %s", session_id)
                return {"final_response": f"Error: {e}", "messages": state.history}
            finally:
-                # Restore the interactive contextvar for this context.
-                if interactive_token is not None:
-                    reset_hermes_interactive_context(interactive_token)
+                # Restore HERMES_INTERACTIVE.
+                if previous_interactive is None:
+                    os.environ.pop("HERMES_INTERACTIVE", None)
+                else:
+                    os.environ["HERMES_INTERACTIVE"] = previous_interactive
                # Restore HERMES_SESSION_ID symmetrically.
                if previous_session_id is None:
                    os.environ.pop("HERMES_SESSION_ID", None)
@@ -1617,28 +1611,12 @@ class HermesACPAgent(acp.Agent):
                            self._send_session_info_update(session_id),
                        )

-                # Snapshot the runtime identity; the validator lets the
-                # background titler skip its LLM call if the session's model
-                # changed before it fires (#19027).
-                _title_model = getattr(state.agent, "model", None)
-                _title_provider = getattr(state.agent, "provider", None)
                maybe_auto_title(
                    self.session_manager._get_db(),
                    session_id,
                    user_text,
                    final_response,
                    state.history,
-                    main_runtime={
-                        "model": getattr(state.agent, "model", None),
-                        "provider": getattr(state.agent, "provider", None),
-                        "base_url": getattr(state.agent, "base_url", None),
-                        "api_key": getattr(state.agent, "api_key", None),
-                        "api_mode": getattr(state.agent, "api_mode", None),
-                    },
-                    runtime_validator=lambda: (
-                        getattr(state.agent, "model", None) == _title_model
-                        and getattr(state.agent, "provider", None) == _title_provider
-                    ),
                    title_callback=_notify_title_update,
                )
            except Exception:
@@ -1919,18 +1897,7 @@ class HermesACPAgent(acp.Agent):

    def _cmd_reset(self, args: str, state: SessionState) -> str:
        state.history.clear()
-        reset_failed = False
-        try:
-            reset_session_state = getattr(state.agent, "reset_session_state", None)
-            if callable(reset_session_state):
-                reset_session_state()
-        except Exception:
-            reset_failed = True
-            logger.warning("ACP session state reset failed for %s", state.session_id, exc_info=True)
-        finally:
-            self.session_manager.save_session(state.session_id)
-        if reset_failed:
-            return "Conversation history cleared. Agent session state reset failed; see logs."
+        self.session_manager.save_session(state.session_id)
        return "Conversation history cleared."

    def _cmd_compact(self, args: str, state: SessionState) -> str:
@@ -26,18 +26,31 @@ from typing import Any, Dict, List, Optional
 logger = logging.getLogger(__name__)


+def _win_path_to_wsl(path: str) -> str | None:
+    """Convert a Windows drive path to its WSL /mnt/<drive>/... equivalent."""
+    match = re.match(r"^([A-Za-z]):[\\/](.*)$", path)
+    if not match:
+        return None
+    drive = match.group(1).lower()
+    tail = match.group(2).replace("\\", "/")
+    return f"/mnt/{drive}/{tail}"
+
+
 def _translate_acp_cwd(cwd: str) -> str:
    """Translate Windows ACP cwd values when Hermes itself is running in WSL.

    Windows ACP clients can launch ``hermes acp`` inside WSL while still sending
-    editor workspaces as Windows drive paths (``E:\\Projects``) or
-    ``\\\\wsl.localhost\\`` UNC paths. Store and execute against the POSIX form so
-    agents, tools, and persisted ACP sessions all agree on the usable workspace.
-    Native Linux/macOS keeps the original cwd unchanged.
+    editor workspaces as Windows drive paths such as ``E:\\Projects``. Store
+    and execute against the WSL mount path so agents, tools, and persisted ACP
+    sessions all agree on the usable workspace. Native Linux/macOS keeps the
+    original cwd unchanged.
    """
-    from hermes_constants import translate_cwd_for_wsl_backend
+    from hermes_constants import is_wsl

-    return translate_cwd_for_wsl_backend(str(cwd))
+    if not is_wsl():
+        return cwd
+    translated = _win_path_to_wsl(str(cwd))
+    return translated if translated is not None else cwd


 def _normalize_cwd_for_compare(cwd: str | None) -> str:
@@ -48,9 +61,7 @@ def _normalize_cwd_for_compare(cwd: str | None) -> str:

    # Normalize Windows drive paths into the equivalent WSL mount form so
    # ACP history filters match the same workspace across Windows and WSL.
-    from hermes_constants import windows_path_to_wsl
-
-    translated = windows_path_to_wsl(expanded)
+    translated = _win_path_to_wsl(expanded)
    if translated is not None:
        expanded = translated
    elif re.match(r"^/mnt/[A-Za-z]/", expanded):
@@ -450,47 +461,10 @@ class SessionManager:
                except Exception:
                    logger.debug("Failed to update ACP session metadata", exc_info=True)

-            # When the agent owns persistence to this same SessionDB it has
-            # already flushed the live transcript incrementally during
-            # run_conversation (append_message), and it preserves pre-compaction
-            # turns non-destructively via archive_and_compact() — keeping them on
-            # disk as searchable active=0/compacted=1 rows. Calling
-            # replace_messages() here would then be a redundant double-write that
-            # DELETEs exactly those archived rows (and, after a compression-driven
-            # id rotation where agent.session_id no longer equals
-            # state.session_id, clobbers the ended parent transcript) — silent
-            # data loss for any ACP conversation long enough to compress.
-            #
-            # Only fall back to the destructive atomic replace when the agent is
-            # NOT persisting itself to this DB (e.g. a test agent factory, or a
-            # fresh create/fork whose copied history the agent has not flushed
-            # yet). That path still rolls back on a mid-rewrite failure so the
-            # previously persisted conversation survives (salvaged from #13675).
-            agent = state.agent
-            agent_db = getattr(agent, "_session_db", None)
-            agent_owns_persistence = (
-                agent_db is not None
-                and agent_db is db
-                and bool(getattr(agent, "_session_db_created", False))
-            )
-            if not agent_owns_persistence:
-                # Even when the current agent doesn't "own" persistence, the
-                # session on disk may already carry compaction-archived rows —
-                # e.g. after a model switch or a /restore, both of which mint a
-                # fresh agent with _session_db_created=False (so the check above
-                # is False) yet leave the durable archived transcript in place.
-                # A full-history replace would DELETE those archived rows just
-                # like the owned-agent case. Guard against it: when archived
-                # rows exist, replace ONLY the live (active=1) set and leave the
-                # archived turns untouched; otherwise the destructive replace is
-                # safe (fresh create/fork with no archived history to lose).
-                try:
-                    has_archived = db.has_archived_messages(state.session_id)
-                except Exception:
-                    has_archived = False
-                db.replace_messages(
-                    state.session_id, state.history, active_only=has_archived
-                )
+            # Replace stored messages with current history atomically so a
+            # mid-rewrite failure rolls back and the previously persisted
+            # conversation is preserved (salvaged from #13675).
+            db.replace_messages(state.session_id, state.history)
        except Exception:
            logger.warning("Failed to persist ACP session %s", state.session_id, exc_info=True)

@@ -534,15 +508,9 @@ class SessionManager:

        model = row.get("model") or None

-        # Load conversation history. repair_alternation: this restore feeds
-        # LIVE REPLAY — the loaded list becomes the resumed agent's working
-        # conversation. A durable ``user;user`` violation left in state.db would
-        # otherwise re-fire the pre-request defensive repair on every request
-        # for the rest of the session (see hermes_state.get_messages_as_conversation).
+        # Load conversation history.
        try:
-            history = db.get_messages_as_conversation(
-                session_id, repair_alternation=True
-            )
+            history = db.get_messages_as_conversation(session_id)
        except Exception:
            logger.warning("Failed to load messages for ACP session %s", session_id, exc_info=True)
            history = []
@@ -3,7 +3,6 @@
 from __future__ import annotations

 import json
-import logging
 import uuid
 from typing import Any, Dict, List, Optional

@@ -15,8 +14,6 @@ from acp.schema import (
    ToolKind,
 )

-logger = logging.getLogger(__name__)
-
 # ---------------------------------------------------------------------------
 # Map hermes tool names -> ACP ToolKind
 # ---------------------------------------------------------------------------
@@ -113,12 +110,7 @@ def build_tool_title(tool_name: str, args: Dict[str, Any]) -> str:
    if tool_name == "web_extract":
        urls = args.get("urls", [])
        if urls:
-            first = urls[0]
-            if isinstance(first, dict):
-                first = first.get("url") or first.get("href") or "?"
-            elif not isinstance(first, str):
-                first = "?"
-            return f"extract: {first}" + (f" (+{len(urls)-1})" if len(urls) > 1 else "")
+            return f"extract: {urls[0]}" + (f" (+{len(urls)-1})" if len(urls) > 1 else "")
        return "web extract"
    if tool_name == "process":
        action = str(args.get("action") or "").strip() or "manage"
@@ -387,24 +379,6 @@ def _format_execute_code_result(result: Optional[str]) -> Optional[str]:
    error = str(data.get("error") or "")
    exit_code = data.get("exit_code")
    parts = [f"Exit code: {exit_code}" if exit_code is not None else "Execution complete"]
-    if data.get("stdout_truncated"):
-        total = data.get("stdout_bytes_total")
-        captured = data.get("stdout_bytes_captured")
-        omitted = data.get("stdout_bytes_omitted")
-        if all(isinstance(v, int) for v in (captured, total, omitted)):
-            parts.extend([
-                "",
-                (
-                    "Output truncated: "
-                    f"captured {captured:,} of {total:,} bytes "
-                    f"({omitted:,} omitted)."
-                ),
-            ])
-        else:
-            parts.extend(["", "Output truncated."])
-    warning = str(data.get("warning") or "").strip()
-    if warning:
-        parts.extend(["", "Warning:", warning])
    if output:
        parts.extend(["", "Output:", output])
    if error:
@@ -643,7 +617,7 @@ def _format_session_search_result(result: Optional[str]) -> Optional[str]:
        return None
    mode = data.get("mode") or "search"
    query = data.get("query")
-    lines = ["Recent sessions" if mode == "recent" else "Session search results" + (f" for `{query}`" if query else "")]
+    lines = ["Recent sessions" if mode == "recent" else f"Session search results" + (f" for `{query}`" if query else "")]
    if not results:
        lines.append(str(data.get("message") or "No matching sessions found."))
        return "\n".join(lines)
@@ -1047,37 +1021,7 @@ def build_tool_start(
    *,
    edit_diff: Any = None,
 ) -> ToolCallStart:
-    """Create a ToolCallStart event for the given hermes tool invocation.
-
-    A malformed tool argument (e.g. a non-string ``command``/``path`` from a
-    model that ignores the schema) must never abort the ACP tool-call render —
-    ``build_tool_start`` runs on the live tool-progress callback and during
-    session history replay. On any failure in the title/content/location
-    builders, fall back to a minimal, valid start event. Mirrors
-    ``get_cute_tool_message`` in ``agent/display.py``, wrapped for the same
-    reason on the CLI side.
-    """
-    try:
-        return _build_tool_start(
-            tool_call_id, tool_name, arguments, edit_diff=edit_diff
-        )
-    except Exception as exc:  # noqa: BLE001 — a tool-call render must never abort the turn
-        logger.debug("ACP tool-start render failed for %r: %s", tool_name, exc)
-        safe_name = tool_name if isinstance(tool_name, str) and tool_name else "tool"
-        return acp.start_tool_call(
-            tool_call_id, safe_name, kind=get_tool_kind(safe_name),
-            content=None, locations=[], raw_input=None,
-        )
-
-
-def _build_tool_start(
-    tool_call_id: str,
-    tool_name: str,
-    arguments: Dict[str, Any],
-    *,
-    edit_diff: Any = None,
-) -> ToolCallStart:
-    """Build the ToolCallStart event (unguarded; see ``build_tool_start``)."""
+    """Create a ToolCallStart event for the given hermes tool invocation."""
    kind = get_tool_kind(tool_name)
    title = build_tool_title(tool_name, arguments)
    locations = extract_locations(arguments)
@@ -1,7 +1,7 @@
 {
  "id": "hermes-agent",
  "name": "Hermes Agent",
-  "version": "0.18.2",
+  "version": "0.17.0",
  "description": "Self-improving open-source AI agent by Nous Research with ACP editor integration, persistent memory, skills, and rich tool support.",
  "repository": "https://github.com/NousResearch/hermes-agent",
  "website": "https://hermes-agent.nousresearch.com/docs/user-guide/features/acp",
@@ -9,7 +9,7 @@
  "license": "MIT",
  "distribution": {
    "uvx": {
-      "package": "hermes-agent[acp]==0.18.2",
+      "package": "hermes-agent[acp]==0.17.0",
      "args": ["hermes-acp"]
    }
  }
@@ -9,7 +9,7 @@ from typing import TYPE_CHECKING, Any, Optional
 import httpx

 from agent.anthropic_adapter import _is_oauth_token, resolve_anthropic_token
-from hermes_cli.auth import AuthError, _read_codex_tokens, resolve_codex_runtime_credentials
+from hermes_cli.auth import _read_codex_tokens, resolve_codex_runtime_credentials
 from hermes_cli.runtime_provider import resolve_runtime_provider

 if TYPE_CHECKING:
@@ -425,102 +425,31 @@ def build_credits_view(*, markdown: bool = False, timeout: float = 10.0) -> Cred
    )


-def _codex_backend_urls(base_url: str) -> tuple[str, str, str]:
-    """Resolve the Codex backend endpoints (usage, reset-credits list, consume).
-
-    Mirrors the Codex CLI's PathStyle split (codex-rs backend-client): base URLs
-    containing ``/backend-api`` use the ChatGPT ``/wham/...`` paths; everything
-    else uses ``/api/codex/...``.
-    """
+def _resolve_codex_usage_url(base_url: str) -> str:
    normalized = (base_url or "").strip().rstrip("/")
    if not normalized:
        normalized = "https://chatgpt.com/backend-api/codex"
    if normalized.endswith("/codex"):
        normalized = normalized[: -len("/codex")]
-    prefix = normalized + ("/wham" if "/backend-api" in normalized else "/api/codex")
-    return (
-        prefix + "/usage",
-        prefix + "/rate-limit-reset-credits",
-        prefix + "/rate-limit-reset-credits/consume",
-    )
+    if "/backend-api" in normalized:
+        return normalized + "/wham/usage"
+    return normalized + "/api/codex/usage"


-def _resolve_codex_usage_url(base_url: str) -> str:
-    return _codex_backend_urls(base_url)[0]
-
-
-def _resolve_codex_usage_credentials(
-    base_url: Optional[str],
-    api_key: Optional[str],
-) -> tuple[str, str, Optional[str]]:
-    """Resolve Codex quota credentials from the native runtime path.
-
-    Prefer explicit live-agent credentials, then the legacy singleton OAuth
-    state, then the credential pool.  Hermes's native OAuth setup now stores
-    device-code logins in the pool, so quota diagnostics must not depend only
-    on the older singleton store.
-    """
-    explicit_key = str(api_key or "").strip()
-    if explicit_key:
-        return explicit_key, str(base_url or "").strip(), None
-
-    # Tier 2: the native runtime resolver. It ALREADY falls back to the
-    # credential pool when the singleton is empty (see
-    # ``resolve_codex_runtime_credentials`` — issue #32992), so in a pool-only
-    # setup this returns a usable ``source="credential_pool"`` token.
-    #
-    # Only ``AuthError`` ("no creds" / rate-limited) is caught so tier 3 can
-    # run: a broad ``except Exception`` would (a) mask a transient refresh /
-    # network failure and silently hand back a DIFFERENT pool account's usage,
-    # and (b) hide genuine programming errors. A refresh/network error must
-    # propagate — the outer ``fetch_account_usage`` guard fails open (shows
-    # nothing this turn) rather than reporting the wrong account.
-    #
-    # The ``account_id`` (for the ``ChatGPT-Account-Id`` header) is read
-    # best-effort: a partial/missing singleton token store must not sink an
-    # otherwise-usable resolver credential and force a header-less pool fallback.
-    try:
-        creds = resolve_codex_runtime_credentials(refresh_if_expiring=True)
-        account_id: Optional[str] = None
-        try:
-            token_data = _read_codex_tokens()
-            tokens = token_data.get("tokens") or {}
-            account_id = str(tokens.get("account_id", "") or "").strip() or None
-        except AuthError:
-            # Pool-only creds carry no singleton account_id; header is optional.
-            logger.debug("codex ▸ /usage account_id read failed (best-effort)", exc_info=True)
-        return creds["api_key"], str(creds.get("base_url", "") or "").strip(), account_id
-    except AuthError:
-        logger.debug("codex ▸ /usage runtime resolver returned no creds; trying pool", exc_info=True)
-
-    # Tier 3: direct pool select. Reached only when the resolver itself raises
-    # AuthError (e.g. singleton missing AND its own pool read found nothing at
-    # resolve time, but a pool entry is usable now). Pool credentials have no
-    # account_id concept, so the ChatGPT-Account-Id header is intentionally
-    # omitted here.
-    from agent.credential_pool import load_pool
-
-    pool = load_pool("openai-codex")
-    entry = pool.select()
-    if entry is None:
-        raise RuntimeError("No available openai-codex credential in credential pool")
-    return entry.runtime_api_key, str(entry.runtime_base_url or base_url or "").strip(), None
-
-
-def _fetch_codex_account_usage(
-    base_url: Optional[str] = None,
-    api_key: Optional[str] = None,
-) -> Optional[AccountUsageSnapshot]:
-    token, resolved_base_url, account_id = _resolve_codex_usage_credentials(base_url, api_key)
+def _fetch_codex_account_usage() -> Optional[AccountUsageSnapshot]:
+    creds = resolve_codex_runtime_credentials(refresh_if_expiring=True)
+    token_data = _read_codex_tokens()
+    tokens = token_data.get("tokens") or {}
+    account_id = str(tokens.get("account_id", "") or "").strip() or None
    headers = {
-        "Authorization": f"Bearer {token}",
+        "Authorization": f"Bearer {creds['api_key']}",
        "Accept": "application/json",
        "User-Agent": "codex-cli",
    }
    if account_id:
        headers["ChatGPT-Account-Id"] = account_id
    with httpx.Client(timeout=15.0) as client:
-        response = client.get(_resolve_codex_usage_url(resolved_base_url), headers=headers)
+        response = client.get(_resolve_codex_usage_url(creds.get("base_url", "")), headers=headers)
        response.raise_for_status()
    payload = response.json() or {}
    rate_limit = payload.get("rate_limit") or {}
@@ -538,14 +467,6 @@ def _fetch_codex_account_usage(
            )
        )
    details: list[str] = []
-    reset_credits = payload.get("rate_limit_reset_credits") or {}
-    banked = reset_credits.get("available_count")
-    if isinstance(banked, (int, float)) and int(banked) > 0:
-        count = int(banked)
-        plural = "s" if count != 1 else ""
-        details.append(
-            f"You have {count} reset{plural} banked - use /usage reset to activate"
-        )
    credits = payload.get("credits") or {}
    if credits.get("has_credits"):
        balance = credits.get("balance")
@@ -563,179 +484,6 @@ def _fetch_codex_account_usage(
    )


-@dataclass(frozen=True)
-class CodexResetRedeemResult:
-    """Outcome of a `/usage reset` attempt against the Codex backend."""
-
-    status: str  # reset | nothing_to_reset | no_credit | already_redeemed |
-    #              not_exhausted | no_credits_banked | unavailable
-    message: str
-    available_count: int = 0
-    windows_reset: int = 0
-
-    @property
-    def redeemed(self) -> bool:
-        return self.status == "reset"
-
-
-# Client-side guard threshold: a rate-limit window only counts as exhausted
-# when it is fully used. Below this, redeeming a banked reset wastes most of
-# its value, so we block and point at --force instead.
-_CODEX_WINDOW_EXHAUSTED_PERCENT = 100.0
-
-
-def redeem_codex_reset_credit(
-    *,
-    base_url: Optional[str] = None,
-    api_key: Optional[str] = None,
-    force: bool = False,
-) -> CodexResetRedeemResult:
-    """Redeem one banked Codex rate-limit reset credit (`/usage reset`).
-
-    Flow (mirrors the Codex CLI's reset-credits picker, codex-rs
-    ``backend-client``):
-
-    1. ``GET .../usage`` — read the current windows + banked credit count.
-    2. Guard: zero banked credits → refuse. No window fully used and not
-       ``force`` → refuse with a warning (a banked reset restores the WHOLE
-       5h + weekly allowance; burning it early wastes it). The backend has
-       the same protection (``nothing_to_reset`` doesn't consume the
-       credit), but failing fast client-side gives a clearer message.
-    3. ``POST .../rate-limit-reset-credits/consume`` with a fresh UUID
-       idempotency key (``redeem_request_id``). No ``credit_id`` — the
-       backend picks the next available credit, exactly like the CLI's
-       default "Full reset" option.
-
-    Never raises: every failure mode returns a ``CodexResetRedeemResult``
-    with a user-renderable message.
-    """
-    import uuid
-
-    try:
-        token, resolved_base_url, account_id = _resolve_codex_usage_credentials(base_url, api_key)
-    except Exception:
-        return CodexResetRedeemResult(
-            status="unavailable",
-            message="No Codex credentials available. Run `hermes auth` to sign in with your ChatGPT account.",
-        )
-    usage_url, _credits_url, consume_url = _codex_backend_urls(resolved_base_url)
-    headers = {
-        "Authorization": f"Bearer {token}",
-        "Accept": "application/json",
-        "User-Agent": "codex-cli",
-    }
-    if account_id:
-        headers["ChatGPT-Account-Id"] = account_id
-
-    try:
-        with httpx.Client(timeout=15.0) as client:
-            usage_resp = client.get(usage_url, headers=headers)
-            usage_resp.raise_for_status()
-            payload = usage_resp.json() or {}
-
-            reset_credits = payload.get("rate_limit_reset_credits") or {}
-            raw_count = reset_credits.get("available_count")
-            available = int(raw_count) if isinstance(raw_count, (int, float)) else 0
-            if available <= 0:
-                return CodexResetRedeemResult(
-                    status="no_credits_banked",
-                    message="No banked reset credits on this account — nothing to redeem.",
-                )
-
-            rate_limit = payload.get("rate_limit") or {}
-            worst_used: Optional[float] = None
-            for key in ("primary_window", "secondary_window"):
-                used = (rate_limit.get(key) or {}).get("used_percent")
-                if isinstance(used, (int, float)):
-                    worst_used = max(worst_used or 0.0, float(used))
-            exhausted = worst_used is not None and worst_used >= _CODEX_WINDOW_EXHAUSTED_PERCENT
-            if not exhausted and not force:
-                usage_note = (
-                    f"your busiest window is only {worst_used:.0f}% used"
-                    if worst_used is not None
-                    else "your current usage could not be confirmed as exhausted"
-                )
-                plural = "s" if available != 1 else ""
-                return CodexResetRedeemResult(
-                    status="not_exhausted",
-                    message=(
-                        f"⚠️ Not redeeming: {usage_note}. A banked reset restores your FULL "
-                        f"5h + weekly limits, so spending it now would waste most of it. "
-                        f"You have {available} reset{plural} banked. "
-                        f"Use `/usage reset --force` to redeem anyway."
-                    ),
-                    available_count=available,
-                )
-
-            consume_resp = client.post(
-                consume_url,
-                headers={**headers, "Content-Type": "application/json"},
-                json={"redeem_request_id": str(uuid.uuid4())},
-            )
-            consume_resp.raise_for_status()
-            body = consume_resp.json() or {}
-    except httpx.HTTPStatusError as exc:
-        code = exc.response.status_code
-        if code in (401, 403):
-            return CodexResetRedeemResult(
-                status="unavailable",
-                message=(
-                    "Codex backend rejected the request (HTTP "
-                    f"{code}). Reset credits require ChatGPT-account (OAuth) auth — "
-                    "run `hermes auth` and sign in with your ChatGPT account."
-                ),
-            )
-        return CodexResetRedeemResult(
-            status="unavailable",
-            message=f"Codex backend error (HTTP {code}) — try again shortly.",
-        )
-    except Exception as exc:
-        return CodexResetRedeemResult(
-            status="unavailable",
-            message=f"Could not reach the Codex backend: {exc}",
-        )
-
-    code = str(body.get("code", "") or "").strip().lower()
-    windows_reset = body.get("windows_reset")
-    windows_reset = int(windows_reset) if isinstance(windows_reset, (int, float)) else 0
-    remaining = max(0, available - 1)
-    plural = "s" if remaining != 1 else ""
-    if code == "reset":
-        return CodexResetRedeemResult(
-            status="reset",
-            message=(
-                f"✅ Reset redeemed — your usage limits have been reset. "
-                f"{remaining} banked reset{plural} remaining."
-            ),
-            available_count=remaining,
-            windows_reset=windows_reset,
-        )
-    if code == "nothing_to_reset":
-        return CodexResetRedeemResult(
-            status="nothing_to_reset",
-            message=(
-                "Backend reports nothing to reset — your limits aren't exhausted. "
-                "The credit was NOT spent."
-            ),
-            available_count=available,
-        )
-    if code == "no_credit":
-        return CodexResetRedeemResult(
-            status="no_credit",
-            message="Backend reports no available reset credit on this account.",
-        )
-    if code == "already_redeemed":
-        return CodexResetRedeemResult(
-            status="already_redeemed",
-            message="This redemption was already processed — no additional credit was spent.",
-            available_count=remaining,
-        )
-    return CodexResetRedeemResult(
-        status="unavailable",
-        message=f"Unexpected response from the Codex backend: {body!r}",
-    )
-
-
 def _fetch_anthropic_account_usage() -> Optional[AccountUsageSnapshot]:
    token = (resolve_anthropic_token() or "").strip()
    if not token:
@@ -880,7 +628,7 @@ def fetch_account_usage(
        return None
    try:
        if normalized == "openai-codex":
-            return _fetch_codex_account_usage(base_url=base_url, api_key=api_key)
+            return _fetch_codex_account_usage()
        if normalized == "anthropic":
            return _fetch_anthropic_account_usage()
        if normalized == "openrouter":
@@ -68,118 +68,24 @@ def _ra():
    return run_agent


-def _build_codex_gpt5_autoraise_notice(autoraise: Dict[str, Any]) -> str:
-    """Build the one-time notice shown when Codex gpt-5.x raises compaction.
+def _build_codex_gpt55_autoraise_notice(autoraise: Dict[str, float]) -> str:
+    """Build the one-time notice shown when Codex gpt-5.5 raises compaction.

-    ``autoraise`` is ``{"model": <slug>, "from": <old_ratio>, "to": <new_ratio>}``.
-    The same text is printed inline for CLI users and replayed via
-    ``status_callback`` for gateway users, so it must be self-contained and
-    include the exact opt-back-out command.
+    ``autoraise`` is ``{"from": <old_ratio>, "to": <new_ratio>}``. The same
+    text is printed inline for CLI users and replayed via ``status_callback``
+    for gateway users, so it must be self-contained and include the exact
+    opt-back-out command.
    """
-    model = str(autoraise.get("model") or "gpt-5.4/5.5").strip().lower().rsplit("/", 1)[-1]
-    # gpt-5.3-codex-spark has a native 128K window; the gpt-5.4/5.5/5.6 family
-    # is capped at 272K by the Codex OAuth backend.
-    cap = "128K" if model.startswith("gpt-5.3-codex-spark") else "272K"
    from_pct = int(round(autoraise["from"] * 100))
    to_pct = int(round(autoraise["to"] * 100))
    return (
-        f"ℹ Codex {model} caps context at {cap}, so auto-compaction was raised "
+        f"ℹ Codex gpt-5.5 caps context at 272K, so auto-compaction was raised "
        f"to {to_pct}% (from {from_pct}%) to use more of the window before "
        f"summarizing.\n"
        f"  Opt back out: hermes config set compression.codex_gpt55_autoraise false"
    )


-def _resolve_compression_threshold(
-    global_threshold: float,
-    model_cthresh: Optional[float],
-    *,
-    model: Optional[str] = None,
-    is_codex_autoraise: bool,
-) -> tuple[float, Optional[Dict[str, Any]]]:
-    """Combine the user's global compaction threshold with a per-model override.
-
-    Returns ``(effective_threshold, autoraise_notice)``. ``autoraise_notice`` is
-    ``{"model": <slug>, "from": <old>, "to": <new>}`` only when a Codex
-    autoraise (gpt-5.4/5.5 272K family or gpt-5.3-codex-spark) actually raises
-    the threshold, otherwise ``None``.
-
-    The Codex overrides are *autoraises*: they must never LOWER a higher
-    user-configured threshold. A user who already set ``compression.threshold``
-    above the raised value deliberately keeps more raw context, and silently
-    dropping them would both waste usable window and contradict the feature's
-    purpose (use more of the window). Other overrides (e.g. Arcee Trinity)
-    keep their existing unconditional behaviour.
-    """
-    if model_cthresh is None:
-        return global_threshold, None
-    if is_codex_autoraise:
-        if model_cthresh <= global_threshold + 1e-9:
-            # Autoraise never lowers; keep the user's higher/equal threshold.
-            return global_threshold, None
-        return model_cthresh, {
-            "model": model,
-            "from": global_threshold,
-            "to": model_cthresh,
-        }
-    return model_cthresh, None
-
-
-def _codex_gpt55_autoraise_notice_marker():
-    """Path to the per-profile marker recording that the autoraise notice ran.
-
-    Lives under ``$HERMES_HOME`` (which is profile-scoped) alongside the other
-    internal markers like ``.container-mode`` — so it is not a user-facing config
-    key, and every profile tracks its own notice state independently.
-    """
-    return get_hermes_home() / ".codex_gpt55_autoraise_notice"
-
-
-def _codex_gpt55_autoraise_notice_state(autoraise: Dict[str, Any]) -> str:
-    """Stable identity for one autoraise notice, keyed on what it displays.
-
-    Uses the model slug plus the same from→to percentages the notice text
-    shows, so an unchanged threshold stays silent across restarts while a
-    later change (the user edits their global ``threshold``, or switches to a
-    different autoraised Codex model) re-notifies once.
-    """
-    model = str(autoraise.get("model") or "").strip().lower().rsplit("/", 1)[-1]
-    from_pct = int(round(float(autoraise["from"]) * 100))
-    to_pct = int(round(float(autoraise["to"]) * 100))
-    return f"{model}:{from_pct}:{to_pct}"
-
-
-def _codex_gpt55_autoraise_notice_seen(autoraise: Dict[str, Any]) -> bool:
-    """True if this exact autoraise notice was already shown for this profile.
-
-    A missing/unreadable marker (or one recording a different threshold) reads
-    as unseen, so the notice shows.
-    """
-    try:
-        current = _codex_gpt55_autoraise_notice_state(autoraise)
-        return _codex_gpt55_autoraise_notice_marker().read_text(
-            encoding="utf-8"
-        ).strip() == current
-    except (OSError, KeyError, TypeError, ValueError):
-        return False
-
-
-def _record_codex_gpt55_autoraise_notice(autoraise: Dict[str, Any]) -> None:
-    """Persist that the autoraise notice was shown for this profile/config state.
-
-    Best-effort: a read-only or missing ``$HERMES_HOME`` just means the notice
-    may show again next init, which is preferable to breaking agent init.
-    """
-    try:
-        marker = _codex_gpt55_autoraise_notice_marker()
-        marker.parent.mkdir(parents=True, exist_ok=True)
-        marker.write_text(
-            _codex_gpt55_autoraise_notice_state(autoraise), encoding="utf-8"
-        )
-    except (OSError, KeyError, TypeError, ValueError):
-        pass
-
-
 def _normalized_custom_base_url(value: Any) -> str:
    if not isinstance(value, str):
        return ""
@@ -187,26 +93,10 @@ def _normalized_custom_base_url(value: Any) -> str:


 def _custom_provider_model_matches(agent_model: str, entry: Dict[str, Any]) -> bool:
-    agent_model_norm = str(agent_model or "").strip().lower()
-    # Multi-model entries (v12+ `providers.<name>.models` mapping / legacy
-    # `models:` list): the agent's model matching ANY catalog entry counts.
-    # Without this, a provider whose `model`/`default_model` differs from the
-    # session model silently fails to match and per-provider request settings
-    # (extra_body, e.g. OpenAI service_tier) are dropped — billing the whole
-    # session at the wrong tier (July 2026 sweeper incident: flex config
-    # ignored, ~2.3x overbilling).
-    models = entry.get("models")
-    catalog: List[str] = []
-    if isinstance(models, dict):
-        catalog = [str(k).strip().lower() for k in models.keys()]
-    elif isinstance(models, (list, tuple)):
-        catalog = [str(m).strip().lower() for m in models]
-    if catalog and agent_model_norm in catalog:
-        return True
    provider_model = str(entry.get("model", "") or "").strip().lower()
-    if not provider_model and not catalog:
+    if not provider_model:
        return True
-    return provider_model == agent_model_norm
+    return provider_model == str(agent_model or "").strip().lower()


 def _custom_provider_extra_body_for_agent(
@@ -275,71 +165,70 @@ def _merge_custom_provider_extra_body(agent, custom_providers: List[Dict[str, An

 def init_agent(
    agent,
-    base_url: str | None = None,
-    api_key: str | None = None,
-    provider: str | None = None,
-    api_mode: str | None = None,
-    acp_command: str | None = None,
+    base_url: str = None,
+    api_key: str = None,
+    provider: str = None,
+    api_mode: str = None,
+    acp_command: str = None,
    acp_args: list[str] | None = None,
-    command: str | None = None,
+    command: str = None,
    args: list[str] | None = None,
    model: str = "",
    max_iterations: int = 90,  # Default tool-calling iterations (shared with subagents)
    tool_delay: float = 1.0,
-    enabled_toolsets: List[str] | None = None,
-    disabled_toolsets: List[str] | None = None,
+    enabled_toolsets: List[str] = None,
+    disabled_toolsets: List[str] = None,
    save_trajectories: bool = False,
    verbose_logging: bool = False,
    quiet_mode: bool = False,
    tool_progress_mode: str = "all",
-    ephemeral_system_prompt: str | None = None,
+    ephemeral_system_prompt: str = None,
    log_prefix_chars: int = 100,
    log_prefix: str = "",
-    providers_allowed: List[str] | None = None,
-    providers_ignored: List[str] | None = None,
-    providers_order: List[str] | None = None,
-    provider_sort: str | None = None,
+    providers_allowed: List[str] = None,
+    providers_ignored: List[str] = None,
+    providers_order: List[str] = None,
+    provider_sort: str = None,
    provider_require_parameters: bool = False,
-    provider_data_collection: str | None = None,
+    provider_data_collection: str = None,
    openrouter_min_coding_score: Optional[float] = None,
-    session_id: str | None = None,
-    tool_progress_callback: Callable | None = None,
-    tool_start_callback: Callable | None = None,
-    tool_complete_callback: Callable | None = None,
-    thinking_callback: Callable | None = None,
-    reasoning_callback: Callable | None = None,
-    clarify_callback: Callable | None = None,
-    read_terminal_callback: Callable | None = None,
-    step_callback: Callable | None = None,
-    stream_delta_callback: Callable | None = None,
-    interim_assistant_callback: Callable | None = None,
-    tool_gen_callback: Callable | None = None,
-    status_callback: Callable | None = None,
-    notice_callback: Callable | None = None,
-    notice_clear_callback: Callable | None = None,
+    session_id: str = None,
+    tool_progress_callback: callable = None,
+    tool_start_callback: callable = None,
+    tool_complete_callback: callable = None,
+    thinking_callback: callable = None,
+    reasoning_callback: callable = None,
+    clarify_callback: callable = None,
+    read_terminal_callback: callable = None,
+    step_callback: callable = None,
+    stream_delta_callback: callable = None,
+    interim_assistant_callback: callable = None,
+    tool_gen_callback: callable = None,
+    status_callback: callable = None,
+    notice_callback: callable = None,
+    notice_clear_callback: callable = None,
    event_callback: Optional[Callable[[str, dict], None]] = None,
-    reaction_callback: Optional[Callable[[str], None]] = None,
-    max_tokens: int | None = None,
-    reasoning_config: Dict[str, Any] | None = None,
-    service_tier: str | None = None,
-    request_overrides: Dict[str, Any] | None = None,
-    prefill_messages: List[Dict[str, Any]] | None = None,
-    platform: str | None = None,
-    user_id: str | None = None,
-    user_id_alt: str | None = None,
-    user_name: str | None = None,
-    chat_id: str | None = None,
-    chat_name: str | None = None,
-    chat_type: str | None = None,
-    thread_id: str | None = None,
-    gateway_session_key: str | None = None,
+    max_tokens: int = None,
+    reasoning_config: Dict[str, Any] = None,
+    service_tier: str = None,
+    request_overrides: Dict[str, Any] = None,
+    prefill_messages: List[Dict[str, Any]] = None,
+    platform: str = None,
+    user_id: str = None,
+    user_id_alt: str = None,
+    user_name: str = None,
+    chat_id: str = None,
+    chat_name: str = None,
+    chat_type: str = None,
+    thread_id: str = None,
+    gateway_session_key: str = None,
    skip_context_files: bool = False,
    load_soul_identity: bool = False,
    skip_memory: bool = False,
    session_db=None,
-    parent_session_id: str | None = None,
-    iteration_budget: Optional["IterationBudget"] = None,
-    fallback_model: Dict[str, Any] | None = None,
+    parent_session_id: str = None,
+    iteration_budget: "IterationBudget" = None,
+    fallback_model: Dict[str, Any] = None,
    credential_pool=None,
    checkpoints_enabled: bool = False,
    checkpoint_max_snapshots: int = 20,
@@ -428,13 +317,13 @@ def init_agent(
    agent.skip_context_files = skip_context_files
    agent.load_soul_identity = load_soul_identity
    agent.pass_session_id = pass_session_id
+    agent._credential_pool = credential_pool
    agent.log_prefix_chars = log_prefix_chars
    agent.log_prefix = f"{log_prefix} " if log_prefix else ""
    # Store effective base URL for feature detection (prompt caching, reasoning, etc.)
    agent.base_url = base_url or ""
    provider_name = provider.strip().lower() if isinstance(provider, str) and provider.strip() else None
    agent.provider = provider_name or ""
-    agent._credential_pool = credential_pool
    agent.acp_command = acp_command or command
    agent.acp_args = list(acp_args or args or [])
    if api_mode in {"chat_completions", "codex_responses", "anthropic_messages", "bedrock_converse", "codex_app_server"}:
@@ -470,24 +359,6 @@ def init_agent(
    else:
        agent.api_mode = "chat_completions"

-    # Credential-pool validation runs AFTER provider auto-detection so
-    # a pool scoped to e.g. "anthropic" is not rejected when the agent
-    # was constructed with provider=None and an anthropic.com URL.
-    # Regression from #63048 which placed this check before the
-    # URL-based auto-detection block above (fixed #63425).
-    if credential_pool is not None:
-        try:
-            from agent.credential_pool import credential_pool_matches_provider
-
-            if not credential_pool_matches_provider(
-                credential_pool,
-                agent.provider,
-                base_url=agent.base_url,
-            ):
-                agent._credential_pool = None
-        except Exception:
-            agent._credential_pool = None
-
    # Eagerly warm the transport cache so import errors surface at init,
    # not mid-conversation.  Also validates the api_mode is registered.
    try:
@@ -570,7 +441,6 @@ def init_agent(
    agent.notice_callback = notice_callback
    agent.notice_clear_callback = notice_clear_callback
    agent.event_callback = event_callback
-    agent.reaction_callback = reaction_callback
    agent.tool_gen_callback = tool_gen_callback

    
@@ -743,25 +613,6 @@ def init_agent(
    # commentary when the provider later returns it as a completed interim
    # assistant message.
    agent._current_streamed_assistant_text = ""
-    # Completed interim messages delivered during the current user turn.
-    # Unlike token-stream tracking, this spans Codex continuation/tool calls so
-    # repeated commentary is not re-sent before normalization can deduplicate it.
-    agent._delivered_interim_texts: set[str] = set()
-
-    # Single-writer guard for the streaming delta sink (#65991). A stale/
-    # superseded stream (e.g. one the stale-stream detector reconnected past,
-    # whose socket abort raced and never actually stopped the old worker) must
-    # NOT keep writing tokens into the turn alongside the retry's stream —
-    # otherwise two coherent responses interleave token-by-token into one
-    # transcript. Every streaming attempt claims a monotonic writer token; the
-    # delta sink drops chunks whose calling thread holds a stale token. The
-    # threading.local means threads that never claimed (non-streaming callers)
-    # are never fenced, so the guard can only ever drop a superseded stream,
-    # never the single legitimate writer.
-    agent._stream_writer_lock = threading.Lock()
-    agent._stream_writer_token = 0
-    agent._stream_writer_tls = threading.local()
-    agent._stream_writer_dropped = 0

    # Optional current-turn user-message override used when the API-facing
    # user message intentionally differs from the persisted transcript
@@ -977,7 +828,7 @@ def init_agent(
                client_kwargs["default_headers"] = build_nvidia_nim_headers(effective_base)
            elif base_url_host_matches(effective_base, "api.routermint.com"):
                client_kwargs["default_headers"] = _ra()._routermint_headers()
-            elif base_url_host_matches(effective_base, "githubcopilot.com"):
+            elif base_url_host_matches(effective_base, "api.githubcopilot.com"):
                from hermes_cli.models import copilot_default_headers

                client_kwargs["default_headers"] = copilot_default_headers()
@@ -1123,34 +974,6 @@ def init_agent(
        # this mutation is reflected in the client built just below.
        agent._apply_user_default_headers()

-        try:
-            from hermes_cli.config import (
-                apply_custom_provider_extra_headers_to_client_kwargs,
-                apply_custom_provider_tls_to_client_kwargs,
-                get_compatible_custom_providers,
-                load_config,
-            )
-
-            _cp_config = load_config()
-            _cp_entries = get_compatible_custom_providers(_cp_config)
-            _cp_base_url = str(client_kwargs.get("base_url") or agent.base_url or "")
-            apply_custom_provider_tls_to_client_kwargs(
-                client_kwargs,
-                _cp_base_url,
-                _cp_entries,
-            )
-            # Per-provider extra HTTP headers (providers.<name>.extra_headers /
-            # custom_providers[].extra_headers) — proxies, gateways, custom
-            # auth. Applied last so the most specific config level wins.
-            # SECURITY: values may carry credentials — never log them.
-            apply_custom_provider_extra_headers_to_client_kwargs(
-                client_kwargs,
-                _cp_base_url,
-                _cp_entries,
-            )
-        except Exception:
-            logger.debug("custom-provider TLS resolution skipped", exc_info=True)
-
        agent.api_key = client_kwargs.get("api_key", "")
        agent.base_url = client_kwargs.get("base_url", agent.base_url)
        try:
@@ -1336,14 +1159,6 @@ def init_agent(
    # SQLite session store (optional -- provided by CLI or gateway)
    agent._session_db = session_db
    agent._parent_session_id = parent_session_id
-    # A close flush and the worker's turn-start flush can overlap. The durable
-    # marker is attached to each in-memory message dict, so its test-and-append
-    # sequence must be serialized per agent rather than relying on SQLite alone.
-    agent._session_persist_lock = threading.RLock()
-    # CLI retains its just-accepted user dict until turn setup can reuse it.
-    # This preserves the message-local durable marker if close persistence wins
-    # the race before the agent's normal early turn flush.
-    agent._pending_cli_user_message = None
    agent._last_flushed_db_idx = 0  # tracks DB-write cursor to prevent duplicate writes
    agent._session_db_created = False  # DB row deferred to run_conversation()
    # Most agents own their session row and should finalize it on close().
@@ -1352,11 +1167,6 @@ def init_agent(
    # continuation row that must remain open after the helper is torn down;
    # those callers explicitly set this flag to False.
    agent._end_session_on_close = True
-    # When True, this agent NEVER persists to the canonical session store
-    # (state.db) or the JSON snapshot, regardless of session_id. Set on the
-    # background skill/memory review fork so its harness turn can't leak into
-    # the user's real session and hijack the next live turn. Default False.
-    agent._persist_disabled = False
    agent._session_init_model_config = {
        "max_iterations": agent.max_iterations,
        "reasoning_config": reasoning_config,
@@ -1373,40 +1183,6 @@ def init_agent(
        _agent_cfg = _load_agent_config()
    except Exception:
        _agent_cfg = {}
-
-    # Codex commentary visibility (display.show_commentary, default true).
-    # When true, completed Codex phase=commentary messages are delivered as
-    # visible mid-turn updates through the interim message path. When false,
-    # commentary falls back to the reasoning channel (visible only with
-    # show_reasoning enabled).
-    agent.show_commentary = True
-    try:
-        _display_section = _agent_cfg.get("display", {})
-        if isinstance(_display_section, dict):
-            agent.show_commentary = bool(_display_section.get("show_commentary", True))
-    except Exception:
-        agent.show_commentary = True
-
-    # LM Studio can either be explicitly preloaded through LM Studio's
-    # management API (the historical Hermes behavior) or left to LM Studio's
-    # just-in-time / Auto-Evict chat-completions path.  Keep the default
-    # explicit for backward compatibility; users with LM Studio Auto-Evict can
-    # opt into JIT via ``model.lmstudio_load_mode: jit``.
-    agent.lmstudio_load_mode = "explicit"
-    try:
-        _model_section = _agent_cfg.get("model", {})
-        if isinstance(_model_section, dict):
-            _load_mode = str(_model_section.get("lmstudio_load_mode", "explicit") or "explicit").strip().lower()
-            if _load_mode in {"explicit", "jit"}:
-                agent.lmstudio_load_mode = _load_mode
-            else:
-                logger.warning(
-                    "Invalid model.lmstudio_load_mode=%r; expected 'explicit' or 'jit'. Using explicit.",
-                    _model_section.get("lmstudio_load_mode"),
-                )
-    except Exception:
-        agent.lmstudio_load_mode = "explicit"
-
    try:
        agent._tool_guardrails = ToolCallGuardrailController(
            ToolCallGuardrailConfig.from_mapping(
@@ -1554,17 +1330,6 @@ def init_agent(
    # line).  Useful for users on exotic setups where the probe heuristics
    # are noisy.
    agent._environment_probe = bool(_agent_section.get("environment_probe", True))
-    # Warm the probe off-thread: it shells out to python3/pip (~0.5s of
-    # subprocess round-trips) and its result lands in the FIRST system
-    # prompt build, which sits on the time-to-first-token critical path.
-    # The warm runs during agent init (network/credential setup dominates),
-    # so by the time the first prompt is built the line is already cached.
-    if agent._environment_probe:
-        try:
-            from tools.env_probe import warm_environment_probe_async
-            warm_environment_probe_async()
-        except Exception:
-            pass

    # Per-platform prompt-hint overrides (config.yaml → platform_hints).
    # Lets an enterprise admin append to or replace Hermes' built-in
@@ -1600,48 +1365,41 @@ def init_agent(
    if not isinstance(_compression_cfg, dict):
        _compression_cfg = {}
    compression_threshold = float(_compression_cfg.get("threshold", 0.50))
-    # Per-model/route compaction-threshold override. Codex gpt-5.4 / gpt-5.5
-    # raise to 85% (the Codex backend caps both families at 272K, so the
-    # default 50% would compact at ~136K — half the usable context). Gated by
-    # an opt-out config flag so the user can fall back to the global threshold;
-    # when the override fires we stash a one-time notification (replayed on the
-    # first turn) that tells the user what changed and how to revert. The
-    # notice has its own display gate so users can keep the threshold
-    # autoraise without getting the banner on gateway turns.
+    # Per-model/route compaction-threshold override. Codex gpt-5.5 raises to
+    # 85% (the Codex backend caps the window at 272K, so the default 50% would
+    # compact at ~136K — half the usable context). Gated by an opt-out config
+    # flag so the user can fall back to the global threshold; when the override
+    # fires we stash a one-time notification (replayed on the first turn) that
+    # tells the user what changed and how to revert.
    _codex_gpt55_autoraise = str(
        _compression_cfg.get("codex_gpt55_autoraise", True)
    ).lower() in {"true", "1", "yes"}
-    _codex_gpt55_autoraise_notice = str(
-        _compression_cfg.get("codex_gpt55_autoraise_notice", True)
-    ).lower() in {"true", "1", "yes"}
    agent._compression_threshold_autoraised = None
    try:
        from agent.auxiliary_client import (
            _compression_threshold_for_model as _cthresh_fn,
-            _is_codex_gpt54_or_gpt55 as _is_codex_gpt54_or_gpt55_fn,
-            _is_codex_spark as _is_codex_spark_fn,
+            _is_codex_gpt55 as _is_codex_gpt55_fn,
        )
        _model_cthresh = _cthresh_fn(
            agent.model,
            agent.provider,
            allow_codex_gpt55_autoraise=_codex_gpt55_autoraise,
        )
-        # The Codex autoraises (gpt-5.4/5.5 272K family and gpt-5.3-codex-spark)
-        # apply only when they RAISE (never lower a user's higher global
-        # threshold). The notice is populated only when it actually fires, and
-        # carries the model slug so the banner names the right family. Arcee
-        # Trinity keeps its long-standing unconditional behaviour.
-        compression_threshold, agent._compression_threshold_autoraised = (
-            _resolve_compression_threshold(
-                compression_threshold,
-                _model_cthresh,
-                model=agent.model,
-                is_codex_autoraise=(
-                    _is_codex_gpt54_or_gpt55_fn(agent.model, agent.provider)
-                    or _is_codex_spark_fn(agent.model, agent.provider)
-                ),
-            )
-        )
+        if _model_cthresh is not None:
+            _prev_threshold = compression_threshold
+            compression_threshold = _model_cthresh
+            # Notify only for the Codex gpt-5.5 autoraise (the Arcee Trinity
+            # override is a long-standing silent default). Skip the notice when
+            # the user's global threshold already meets/exceeds the raised
+            # value, since nothing actually changed for them.
+            if (
+                _is_codex_gpt55_fn(agent.model, agent.provider)
+                and _model_cthresh > _prev_threshold + 1e-9
+            ):
+                agent._compression_threshold_autoraised = {
+                    "from": _prev_threshold,
+                    "to": _model_cthresh,
+                }
    except Exception:
        pass
    compression_enabled = str(_compression_cfg.get("enabled", True)).lower() in {"true", "1", "yes"}
@@ -1667,16 +1425,6 @@ def init_agent(
    compression_in_place = is_truthy_value(
        _compression_cfg.get("in_place"), default=False
    )
-    codex_app_server_auto_compaction = str(
-        _compression_cfg.get("codex_app_server_auto", "native") or "native"
-    ).lower()
-    if codex_app_server_auto_compaction not in {"native", "hermes", "off"}:
-        _ra().logger.warning(
-            "Invalid compression.codex_app_server_auto=%r; using 'native'. "
-            "Valid values are: native, hermes, off.",
-            codex_app_server_auto_compaction,
-        )
-        codex_app_server_auto_compaction = "native"

    # Read optional explicit context_length override for the auxiliary
    # compression model. Custom endpoints often cannot report this via
@@ -1880,12 +1628,6 @@ def init_agent(

    if _selected_engine is not None:
        agent.context_compressor = _selected_engine
-        # External engines own compaction policy: the host compression
-        # threshold (including the Codex gpt-5.5 autoraise above) only
-        # configures the built-in ContextCompressor and never reaches the
-        # plugin, so the autoraise notice would announce a change that does
-        # not apply. Drop it. (#44439)
-        agent._compression_threshold_autoraised = None
        # Resolve context_length for plugin engines — mirrors switch_model() path
        from agent.model_metadata import get_model_context_length
        _plugin_ctx_len = get_model_context_length(
@@ -1923,15 +1665,8 @@ def init_agent(
            abort_on_summary_failure=compression_abort_on_summary_failure,
            max_tokens=agent.max_tokens,
        )
-    _bind_session_state = getattr(agent.context_compressor, "bind_session_state", None)
-    if callable(_bind_session_state):
-        try:
-            _bind_session_state(session_db=session_db, session_id=agent.session_id)
-        except Exception:
-            pass
    agent.compression_enabled = compression_enabled
    agent.compression_in_place = compression_in_place
-    agent.codex_app_server_auto_compaction = codex_app_server_auto_compaction

    # Reject models whose context window is below the minimum required
    # for reliable tool-calling workflows (64K tokens).
@@ -1947,33 +1682,6 @@ def init_agent(
            f"(this must be at least {MINIMUM_CONTEXT_LENGTH // 1000}K)."
        )

-    # Nous Hermes 3/4 are chat models, not tool-call-tuned. The interactive
-    # CLI already warns via cli.py show_banner() (richer output + /model hint),
-    # so skip platform=="cli" here to avoid emitting the warning twice per
-    # startup. (Gateway/TUI/cron construct with quiet_mode=True and are already
-    # gated off by the `not agent.quiet_mode` check above; this guard's active
-    # job is the CLI dedup, and it leaves the door open for any non-quiet
-    # non-CLI surface to still surface the warning.)
-    if not agent.quiet_mode and (agent.platform or "cli") != "cli":
-        try:
-            from hermes_cli.model_switch import _check_hermes_model_warning
-
-            _hermes_warn = _check_hermes_model_warning(agent.model or "")
-            if _hermes_warn:
-                _user_msg = (
-                    "⚠ Nous Research Hermes 3 & 4 models are NOT agentic — they "
-                    "lack reliable tool-calling for agent workflows (delegation, "
-                    "cron, proactive tools). Consider an agentic model instead "
-                    "(Claude, GPT, Gemini, Qwen-Coder, etc.)."
-                )
-                if hasattr(agent, "_emit_warning"):
-                    agent._emit_warning(_user_msg)
-                else:
-                    print(f"\n{_user_msg}\n", file=sys.stderr)
-                _ra().logger.warning(_hermes_warn)
-        except Exception:
-            pass
-
    # Inject context engine tool schemas (e.g. lcm_grep, lcm_describe, lcm_expand).
    # Skip names that are already present — the _ra().get_tool_definitions()
    # quiet_mode cache returned a shared list pre-#17335, so a stray
@@ -2043,8 +1751,6 @@ def init_agent(
        working_dir=os.getenv("TERMINAL_CWD") or None,
    )
    agent._user_turn_count = 0
-    # Copilot x-initiator flag: first API call of a user turn sends "user" (#3040).
-    agent._is_user_initiated_turn = False

    # Cumulative token usage for the session
    agent.session_prompt_tokens = 0
@@ -2109,53 +1815,29 @@ def init_agent(
            agent._ollama_num_ctx,
        )

-    # Codex gpt-5.x autoraise notice: show at most once per profile/config
-    # state. Without the persisted marker the notice re-fires on every agent
-    # init — and the gateway rebuilds the agent per inbound message, so Discord
-    # etc. saw it repeatedly (#54432). A change in the raised threshold (or the
-    # autoraised model) updates the marker state and re-notifies once. The
-    # config display gate (compression.codex_gpt55_autoraise_notice) still
-    # suppresses the banner entirely without disabling the threshold autoraise.
-    _autoraise = getattr(agent, "_compression_threshold_autoraised", None)
-    _show_autoraise_notice = (
-        bool(_autoraise)
-        and compression_enabled
-        and _codex_gpt55_autoraise_notice
-        and not _codex_gpt55_autoraise_notice_seen(_autoraise)
-    )
-
    if not agent.quiet_mode:
        if compression_enabled:
-            # Report the active engine's own threshold — for a plugin engine
-            # the host compression_threshold is not in effect, and mixing the
-            # two printed a percent that contradicted the token count. (#44439)
-            _active_threshold_pct = getattr(
-                agent.context_compressor, "threshold_percent", compression_threshold
-            )
-            print(f"📊 Context limit: {agent.context_compressor.context_length:,} tokens (compress at {int(_active_threshold_pct*100)}% = {agent.context_compressor.threshold_tokens:,})")
+            print(f"📊 Context limit: {agent.context_compressor.context_length:,} tokens (compress at {int(compression_threshold*100)}% = {agent.context_compressor.threshold_tokens:,})")
        else:
            print(f"📊 Context limit: {agent.context_compressor.context_length:,} tokens (auto-compression disabled)")
-        # Notice with the exact opt-back-out command. Printed inline at startup
-        # for CLI users; gateway users get the same text replayed via
-        # _compression_warning on turn 1 (set below).
-        if _show_autoraise_notice:
-            print(_build_codex_gpt5_autoraise_notice(_autoraise))
+        # One-time notice when the Codex gpt-5.5 autoraise kicked in, with the
+        # exact opt-back-out command. Printed inline at startup for CLI users;
+        # gateway users get the same text replayed via _compression_warning on
+        # turn 1 (set below, after the warning slot is initialized).
+        _autoraise = getattr(agent, "_compression_threshold_autoraised", None)
+        if _autoraise and compression_enabled:
+            print(_build_codex_gpt55_autoraise_notice(_autoraise))

    # Check immediately so CLI users see the warning at startup.
    # Gateway status_callback is not yet wired, so any warning is stored
    # in _compression_warning and replayed in the first run_conversation().
    agent._compression_warning = None
-    # Gateway parity for the Codex gpt-5.x autoraise notice: the startup print
+    # Gateway parity for the Codex gpt-5.5 autoraise notice: the startup print
    # above only reaches the CLI, so stash the same text here to be replayed
    # through status_callback on the first turn (Telegram/Discord/Slack/etc.).
-    if _show_autoraise_notice:
-        agent._compression_warning = _build_codex_gpt5_autoraise_notice(_autoraise)
-
-    # Mark shown so repeated inits in this profile (e.g. every gateway message)
-    # stay silent. Recorded once, whether the notice went to the CLI print or
-    # the gateway replay slot.
-    if _show_autoraise_notice:
-        _record_codex_gpt55_autoraise_notice(_autoraise)
+    _autoraise = getattr(agent, "_compression_threshold_autoraised", None)
+    if _autoraise and compression_enabled:
+        agent._compression_warning = _build_codex_gpt55_autoraise_notice(_autoraise)
    # Lazy feasibility check: deferred to the first turn that approaches the
    # compression threshold. Running it eagerly here costs ~400ms cold (network
    # probe of the auxiliary provider chain + /models lookup) on every agent
@@ -246,7 +246,7 @@ def sanitize_tool_call_arguments(
    messages: list,
    *,
    logger=None,
-    session_id: str | None = None,
+    session_id: str = None,
 ) -> int:
    """Repair corrupted assistant tool-call argument JSON in-place."""
    log = logger or logging.getLogger(__name__)
@@ -306,13 +306,7 @@ def sanitize_tool_call_arguments(
            try:
                json.loads(arguments)
            except json.JSONDecodeError:
-                # Use the canonical ``call_id || id`` precedence so both the
-                # scan for an existing tool result and any inserted stub key
-                # on the same id the rest of the pipeline uses. Keying on bare
-                # ``id`` here would fail to find a result built with ``call_id``
-                # (Codex Responses format) and insert a duplicate stub that
-                # itself becomes an orphan (#58168).
-                tool_call_id = _ra().AIAgent._get_tool_call_id_static(tool_call) or None
+                tool_call_id = tool_call.get("id")
                function_name = function.get("name", "?")
                preview = arguments[:80]
                log.warning(
@@ -357,48 +351,6 @@ def sanitize_tool_call_arguments(
    return repaired


-def note_turn_start(agent, turn_id: str):
-    """Tripwire: detect a turn starting while the previous turn of the SAME
-    agent/session has not completed its turn-end persist.
-
-    Two turns interleaving on one session corrupt the durable transcript:
-    their flushes race (user rows can persist out of arrival order), a row
-    can be swallowed by the identity-marker dedup over shared history dicts,
-    and the second turn runs on a history base that never saw the first
-    turn's exchange. This helper does NOT prevent any of that — it names the
-    occurrence, with both turn ids, so the dispatch route that let the
-    second turn through the busy guard can be identified from logs.
-
-    Returns the previous in-flight turn_id when an overlap is detected,
-    else None. Takes ownership of the in-flight slot either way, so a turn
-    that crashed before its persist produces at most one warning."""
-    prev = getattr(agent, "_inflight_turn_id", None)
-    prev_started = getattr(agent, "_inflight_turn_started", 0.0)
-    agent._inflight_turn_id = turn_id
-    agent._inflight_turn_started = time.time()
-    if prev and prev != turn_id:
-        logger.warning(
-            "turn %s starting while turn %s (started %.0fs ago) has not "
-            "completed its turn-end persist (session=%s) — concurrent turns "
-            "on one session; transcript writes may interleave",
-            turn_id,
-            prev,
-            time.time() - prev_started if prev_started else -1.0,
-            getattr(agent, "session_id", None) or "-",
-        )
-        return prev
-    return None
-
-
-def note_turn_persisted(agent):
-    """Clear the in-flight marker at turn-end persist (see note_turn_start).
-
-    Called from the single persist funnel; unconditional by design — when two
-    turns genuinely overlap, the first persist clears the second turn's slot
-    and the tripwire under-reports instead of double-reporting. A diagnostic
-    must never be noisier than the defect it hunts."""
-    agent._inflight_turn_id = None
-

 def repair_message_sequence(agent, messages: List[Dict]) -> int:
    """Collapse malformed role-alternation left in the live history.
@@ -416,18 +368,6 @@ def repair_message_sequence(agent, messages: List[Dict]) -> int:
    host code) can feed in already-broken histories.

    Repairs applied:
-      0. Consecutive ``assistant`` messages with no intervening
-         ``tool``/``user`` turn — merged into a single assistant turn
-         (union of ``tool_calls``, concatenated ``content``). Strict
-         OpenAI-compatible providers (DeepSeek v4, Moonshot/Kimi) reject
-         a history where an ``assistant`` message carrying ``tool_calls``
-         is immediately followed by another ``assistant`` message instead
-         of its ``tool`` results — HTTP 400 "An assistant message with
-         'tool_calls' must be followed by tool messages…". The split
-         shape is produced by recovery/continuation paths that append an
-         interim assistant turn (thinking-prefill, codex
-         incomplete-continuation) or by host-fed / legacy-persisted /
-         resumed histories. Refs #29148, #49147.
      1. Stray ``tool`` messages whose ``tool_call_id`` doesn't match
         any preceding assistant tool_call — dropped.
      2. Consecutive ``user`` messages — merged with newline separator
@@ -447,89 +387,12 @@ def repair_message_sequence(agent, messages: List[Dict]) -> int:

    repairs = 0

-    # Pass 0: merge consecutive assistant messages. Runs BEFORE Pass 1 so
-    # the merged turn's union of tool_call ids is known when Pass 1
-    # validates which tool-result messages are orphans. Two assistant
-    # messages are only adjacent here when nothing (no tool result, no
-    # user turn) separates them — an intervening ``tool`` message means
-    # two distinct, valid tool-call rounds that must NOT be merged.
-    #
-    # Codex Responses interim turns are exempt: the codex_responses
-    # api_mode legitimately keeps multiple consecutive incomplete
-    # assistant turns in history, each carrying its own encrypted
-    # continuation state (codex_reasoning_items / codex_message_items)
-    # that must be replayed verbatim. Collapsing them corrupts the
-    # Responses replay chain (the duplicate-detection logic at
-    # conversation_loop.py already de-dups identical codex interims).
-    def _is_codex_interim(m: Dict) -> bool:
-        return bool(
-            m.get("codex_reasoning_items")
-            or m.get("codex_message_items")
-            or m.get("finish_reason") == "incomplete"
-        )
-
-    collapsed: List[Dict] = []
-    for msg in messages:
-        if (
-            collapsed
-            and isinstance(msg, dict)
-            and msg.get("role") == "assistant"
-            and isinstance(collapsed[-1], dict)
-            and collapsed[-1].get("role") == "assistant"
-            and not _is_codex_interim(msg)
-            and not _is_codex_interim(collapsed[-1])
-        ):
-            prev = collapsed[-1]
-            # Union tool_calls (preserve order, both may carry them).
-            prev_calls = list(prev.get("tool_calls") or [])
-            new_calls = list(msg.get("tool_calls") or [])
-            if new_calls:
-                prev["tool_calls"] = prev_calls + new_calls
-            elif prev_calls:
-                prev["tool_calls"] = prev_calls
-            # Concatenate plain-text content; leave multimodal (list)
-            # content on either side alone to avoid mangling attachment
-            # blocks — fall back to keeping the existing content.
-            prev_content = prev.get("content")
-            new_content = msg.get("content")
-            if isinstance(prev_content, str) and isinstance(new_content, str):
-                joined = "\n".join(
-                    p for p in (prev_content.strip(), new_content.strip()) if p
-                )
-                prev["content"] = joined
-            elif not prev_content and new_content is not None:
-                prev["content"] = new_content
-            # Carry reasoning_content from the later turn only if the
-            # earlier turn lacks it (strict thinking providers require a
-            # reasoning_content on the merged tool-call turn; the first
-            # non-empty one suffices).
-            if not prev.get("reasoning_content") and msg.get("reasoning_content"):
-                prev["reasoning_content"] = msg["reasoning_content"]
-            repairs += 1
-            continue
-        collapsed.append(msg)
-
    # Pass 1: drop stray tool messages that don't follow a known
    # assistant tool_call_id. Uses a rolling set of known ids refreshed
    # on each assistant message.
-    #
-    # Both ``id`` AND ``call_id`` are registered for every assistant
-    # tool_call. In the Codex Responses API format the two differ
-    # (``id`` = ``fc_...`` response-item id, ``call_id`` = ``call_...``
-    # the function-call id), and a tool result's ``tool_call_id`` may be
-    # matched against *either* depending on which code path built it
-    # (the OpenAI-compatible path stores ``tc.id``; codex paths store
-    # ``call_id``). Registering only ``id`` — as this pass did before —
-    # made a valid tool result look orphaned whenever the assistant
-    # tool_call carried a distinct ``call_id`` (or only ``call_id``); the
-    # pass then dropped it, leaving the assistant tool_call unanswered and
-    # producing an HTTP 400 on strict providers (DeepSeek, Kimi). Matching
-    # on the *superset* of both keys achieves the same tolerance as
-    # ``_get_tool_call_id_static``'s ``call_id || id`` — a match set must
-    # accept every legitimate reference, not just the canonical one (#58168).
    known_tool_ids: set = set()
    filtered: List[Dict] = []
-    for msg in collapsed:
+    for msg in messages:
        if not isinstance(msg, dict):
            filtered.append(msg)
            continue
@@ -537,23 +400,14 @@ def repair_message_sequence(agent, messages: List[Dict]) -> int:
        if role == "assistant":
            known_tool_ids = set()
            for tc in (msg.get("tool_calls") or []):
-                if not isinstance(tc, dict):
-                    continue
-                for key in ("id", "call_id"):
-                    tc_id = tc.get(key)
-                    if tc_id:
-                        known_tool_ids.add(tc_id)
+                tc_id = tc.get("id") if isinstance(tc, dict) else None
+                if tc_id:
+                    known_tool_ids.add(tc_id)
            filtered.append(msg)
        elif role == "tool":
            tc_id = msg.get("tool_call_id")
            if tc_id and tc_id in known_tool_ids:
                filtered.append(msg)
-                # Consume the id so a SECOND tool result carrying the same
-                # tool_call_id (duplicate from a retry/crash/session-resume
-                # glitch) falls into the drop branch below instead of being
-                # replayed — strict providers (DeepSeek) reject a duplicate
-                # tool_call_id with HTTP 400 (#58327). Credit: #55436.
-                known_tool_ids.discard(tc_id)
            else:
                repairs += 1
        else:
@@ -771,14 +625,7 @@ def recover_with_credential_pool(
    # that seeded the pool.
    current_provider = (getattr(agent, "provider", "") or "").strip().lower()
    pool_provider = (getattr(pool, "provider", "") or "").strip().lower()
-    # Guard: skip credential pool recovery when the pool is scoped to a
-    # different provider than the agent.  Only guard when the pool has a
-    # known provider — an empty pool provider means "unscoped" (applies to
-    # any provider).  An empty agent provider is treated as a mismatch
-    # because swapping the pool's credentials would set base_url/api_key
-    # without fixing the empty provider field, leaving the agent in a
-    # corrupted state (provider="" model="").
-    if pool_provider and current_provider != pool_provider:
+    if current_provider and pool_provider and current_provider != pool_provider:
        # Custom endpoints use two naming conventions for the SAME provider:
        # the agent carries the generic ``custom`` label while the pool is
        # keyed ``custom:<name>`` (see CUSTOM_POOL_PREFIX). A literal string
@@ -816,35 +663,9 @@ def recover_with_credential_pool(
        elif status_code in {401, 403}:
            effective_reason = FailoverReason.auth

-    if effective_reason == FailoverReason.upstream_rate_limit:
-        # An upstream provider (e.g. DeepSeek behind OpenRouter) is
-        # rate-limiting the aggregator's traffic — the user's credential is
-        # healthy. Do NOT rotate or mark exhausted; let the caller's fallback
-        # path switch to a different model entirely.
-        upstream = (error_context or {}).get("upstream_provider") if error_context else None
-        if upstream:
-            _ra().logger.info(
-                "Upstream provider %s rate-limited via aggregator — skipping "
-                "credential rotation, deferring to fallback chain",
-                upstream,
-            )
-        else:
-            _ra().logger.info(
-                "Upstream aggregator 429 (provider unknown) — skipping "
-                "credential rotation, deferring to fallback chain"
-            )
-        return False, has_retried_429
-
    if effective_reason == FailoverReason.billing:
        rotate_status = status_code if status_code is not None else 402
-        next_entry = pool.mark_exhausted_and_rotate(
-            status_code=rotate_status,
-            error_context=error_context,
-            # Runtime credentials can be resolved by a separate pool instance,
-            # leaving this recovery pool without ``current_id``. Match the key
-            # that actually failed instead of quarantining a different account.
-            api_key_hint=getattr(agent, "api_key", None),
-        )
+        next_entry = pool.mark_exhausted_and_rotate(status_code=rotate_status, error_context=error_context)
        if next_entry is not None:
            _ra().logger.info(
                "Credential %s (billing) — rotated to pool entry %s",
@@ -1257,42 +1078,7 @@ def restore_primary_runtime(agent) -> bool:
            api_mode=rt.get("compressor_api_mode", ""),
        )

-        # ── Rebind and re-select the primary credential pool ──
-        # A cross-provider fallback attaches the fallback provider's pool. The
-        # runtime fields above restore the primary, but leaving that pool in
-        # place makes the next primary 401/429 hit the provider-mismatch guard
-        # and disables credential rotation. Reload the primary pool first; if
-        # auth storage is temporarily unreadable, clear the mismatched pool.
-        primary_provider = str(rt.get("provider") or "").strip().lower()
-        pool = getattr(agent, "_credential_pool", None)
-        pool_provider = str(getattr(pool, "provider", "") or "").strip().lower()
-        pool_matches_primary = pool_provider == primary_provider
-        if (
-            primary_provider == "custom"
-            and pool_provider.startswith("custom:")
-        ):
-            try:
-                from agent.credential_pool import get_custom_provider_pool_key
-
-                primary_key = (
-                    get_custom_provider_pool_key(str(rt.get("base_url") or "")) or ""
-                ).strip().lower()
-                pool_matches_primary = bool(primary_key) and primary_key == pool_provider
-            except Exception:
-                pool_matches_primary = False
-        if pool is not None and pool_provider and not pool_matches_primary:
-            agent._credential_pool = None
-            try:
-                from agent.credential_pool import load_pool
-
-                agent._credential_pool = load_pool(primary_provider)
-            except Exception as exc:
-                logger.warning(
-                    "Restore could not reload primary credential pool for %s: %s",
-                    primary_provider,
-                    exc,
-                )
-
+        # ── Re-select from the credential pool if one is available ──
        # The snapshot's api_key was captured at construction time.  Across
        # turns the pool may have rotated (token revocation, billing/rate-limit
        # exhaustion, cooldown), leaving the snapshot key stale.  Restoring it
@@ -1305,37 +1091,11 @@ def restore_primary_runtime(agent) -> bool:
        if pool is not None and pool.has_available():
            entry = pool.select()
            if entry is not None:
-                entry_provider = str(getattr(entry, "provider", "") or "").strip().lower()
-                entry_matches_primary = entry_provider == primary_provider
-                # Custom endpoints all carry the generic ``custom`` provider on
-                # the agent while the pool entry is keyed ``custom:<name>`` (see
-                # CUSTOM_POOL_PREFIX). Resolve the primary's base_url to its
-                # ``custom:<name>`` key via the canonical helper and compare
-                # against the entry's key — this mirrors the sibling guard in
-                # ``recover_with_credential_pool`` (see above) and correctly
-                # disambiguates multiple custom providers that share one gateway
-                # base_url. Fixes #56885.
-                from agent.credential_pool import CUSTOM_POOL_PREFIX
-                if (
-                    primary_provider == "custom"
-                    and entry_provider.startswith(CUSTOM_POOL_PREFIX)
-                ):
-                    entry_matches_primary = False
-                    try:
-                        from agent.credential_pool import get_custom_provider_pool_key
-                        primary_base_url = str(rt.get("base_url") or "").strip()
-                        primary_key = (
-                            get_custom_provider_pool_key(primary_base_url) or ""
-                        ).strip().lower()
-                        entry_matches_primary = bool(primary_key) and primary_key == entry_provider
-                    except Exception:
-                        entry_matches_primary = False
-
                entry_key = (
                    getattr(entry, "runtime_api_key", None)
                    or getattr(entry, "access_token", "")
                )
-                if entry_key and entry_matches_primary:
+                if entry_key:
                    # ``_swap_credential`` rebuilds the OpenAI/Anthropic client,
                    # reapplies base-url-scoped headers, and carries the
                    # accumulated base_url / OAuth-detection fixes (#33163).
@@ -1345,32 +1105,11 @@ def restore_primary_runtime(agent) -> bool:
                        getattr(entry, "id", "?"),
                        getattr(entry, "label", "?"),
                    )
-                elif entry_key:
-                    logger.info(
-                        "Restore skipped pool entry %s (%s): provider %s does not match primary provider %s",
-                        getattr(entry, "id", "?"),
-                        getattr(entry, "label", "?"),
-                        entry_provider or "?",
-                        primary_provider or "?",
-                    )
-
-        # ── Restore reasoning_config if it was saved ──
-        # switch_model saves reasoning_config in _primary_runtime. If the
-        # snapshot predates that (older sessions), keep the current value.
-        saved_reasoning = rt.get("reasoning_config")
-        if saved_reasoning is not None:
-            agent.reasoning_config = dict(saved_reasoning)

        # ── Reset fallback chain for the new turn ──
        agent._fallback_activated = False
        agent._fallback_index = 0

-        # Reset the stale-call circuit breaker (#58962): the streak measured
-        # the FALLBACK provider we're leaving; the restored primary deserves
-        # a fresh stream attempt before the breaker can trip again.
-        from agent.chat_completion_helpers import _reset_stale_streak
-        _reset_stale_streak(agent)
-
        # Undo the fallback's identity rewrite so the prompt is
        # byte-identical to the stored copy again (prefix cache match).
        from agent.chat_completion_helpers import rewrite_prompt_model_identity
@@ -1611,60 +1350,9 @@ def anthropic_prompt_cache_policy(
    eff_api_mode = api_mode if api_mode is not None else (agent.api_mode or "")
    eff_model = (model if model is not None else agent.model) or ""

-    # MoA virtual provider: the agent's model/provider are the preset name and
-    # "moa" — neither matches any caching branch, so the ACTING AGGREGATOR
-    # (often Claude on OpenRouter) silently lost prompt caching entirely
-    # (measured: 85% cache share solo vs 2% on the identical model via MoA —
-    # tens of millions of re-billed input tokens per benchmark run). Resolve
-    # the policy from the preset's real aggregator slot instead.
-    if eff_provider.strip().lower() == "moa":
-        try:
-            from hermes_cli.config import load_config as _load_moa_cfg
-            from hermes_cli.moa_config import resolve_moa_preset
-            from hermes_cli.runtime_provider import resolve_runtime_provider
-
-            _preset = resolve_moa_preset(
-                _load_moa_cfg().get("moa") or {}, eff_model or None
-            )
-            _agg = _preset.get("aggregator") or {}
-            _agg_provider = str(_agg.get("provider") or "").strip()
-            _agg_model = str(_agg.get("model") or "").strip()
-            if _agg_provider and _agg_model:
-                _agg_base_url = ""
-                _agg_api_mode = ""
-                try:
-                    _rt = resolve_runtime_provider(
-                        requested=_agg_provider, target_model=_agg_model
-                    )
-                    _agg_base_url = _rt.get("base_url") or ""
-                    _agg_api_mode = _rt.get("api_mode") or ""
-                except Exception:
-                    pass
-                return anthropic_prompt_cache_policy(
-                    agent,
-                    provider=_agg_provider,
-                    base_url=_agg_base_url,
-                    api_mode=_agg_api_mode,
-                    model=_agg_model,
-                )
-        except Exception as _moa_exc:  # pragma: no cover - defensive
-            logger.debug("MoA aggregator cache-policy resolution failed: %s", _moa_exc)
-        return False, False
-
    model_lower = eff_model.lower()
    provider_lower = eff_provider.lower()
    is_claude = "claude" in model_lower
-    # Kimi / Moonshot family via OpenRouter: same cache_control wire format
-    # as Claude on OpenRouter (envelope layout).  Without this branch
-    # moonshotai/kimi-k2.6 falls through to (False, False), serving ~1%
-    # cache hits on 64K-token prompts and re-billing the full prompt on
-    # every turn.  Observed within-turn progression with cache enabled:
-    # 1% → 67% → 84% → 97% (#25970).  Reuses the canonical family matcher
-    # (covers bare k1./k2./k25 release slugs the substring check missed).
-    from agent.anthropic_adapter import _model_name_is_kimi_family
-    is_kimi = (
-        _model_name_is_kimi_family(eff_model) or "moonshot" in model_lower
-    )
    is_openrouter = base_url_host_matches(eff_base_url, "openrouter.ai")
    # Nous Portal proxies to OpenRouter behind the scenes — identical
    # OpenAI-wire envelope cache_control semantics. Treat it as an
@@ -1678,7 +1366,7 @@ def anthropic_prompt_cache_policy(

    if is_native_anthropic:
        return True, True
-    if (is_openrouter or is_nous_portal) and (is_claude or is_kimi):
+    if (is_openrouter or is_nous_portal) and is_claude:
        return True, False
    # Nous Portal Qwen (e.g. qwen3.6-plus) takes the same envelope-layout
    # cache_control path as Portal Claude. Portal proxies to OpenRouter
@@ -1732,7 +1420,6 @@ def anthropic_prompt_cache_policy(

 def create_openai_client(agent, client_kwargs: dict, *, reason: str, shared: bool) -> Any:
    from agent.auxiliary_client import _validate_base_url, _validate_proxy_env_urls
-    from agent.ssl_verify import resolve_httpx_verify
    # Treat client_kwargs as read-only. Callers pass agent._client_kwargs (or shallow
    # copies of it) in; any in-place mutation leaks back into the stored dict and is
    # reused on subsequent requests. #10933 hit this by injecting an httpx.Client
@@ -1742,9 +1429,6 @@ def create_openai_client(agent, client_kwargs: dict, *, reason: str, shared: boo
    # copy locks the contract so future transport/keepalive work can't reintroduce
    # the same class of bug.
    client_kwargs = dict(client_kwargs)
-    ssl_ca_cert = client_kwargs.pop("ssl_ca_cert", None)
-    ssl_verify_cfg = client_kwargs.pop("ssl_verify", None)
-    httpx_verify = resolve_httpx_verify(ca_bundle=ssl_ca_cert, ssl_verify=ssl_verify_cfg)
    _validate_proxy_env_urls()
    _validate_base_url(client_kwargs.get("base_url"))
    if agent.provider == "copilot-acp" or str(client_kwargs.get("base_url", "")).startswith("acp://copilot"):
@@ -1768,9 +1452,7 @@ def create_openai_client(agent, client_kwargs: dict, *, reason: str, shared: boo
                if k in {"api_key", "base_url", "default_headers", "timeout", "http_client"}
            }
            if "http_client" not in safe_kwargs:
-                keepalive_http = agent._build_keepalive_http_client(
-                    base_url, verify=httpx_verify,
-                )
+                keepalive_http = agent._build_keepalive_http_client(base_url)
                if keepalive_http is not None:
                    safe_kwargs["http_client"] = keepalive_http
            client = GeminiNativeClient(**safe_kwargs)
@@ -1799,9 +1481,7 @@ def create_openai_client(agent, client_kwargs: dict, *, reason: str, shared: boo
    # Tests in ``tests/run_agent/test_create_openai_client_reuse.py`` and
    # ``tests/run_agent/test_sequential_chats_live.py`` pin this invariant.
    if "http_client" not in client_kwargs:
-        keepalive_http = agent._build_keepalive_http_client(
-            client_kwargs.get("base_url", ""), verify=httpx_verify,
-        )
+        keepalive_http = agent._build_keepalive_http_client(client_kwargs.get("base_url", ""))
        if keepalive_http is not None:
            client_kwargs["http_client"] = keepalive_http
    # Delegate all rate-limit / 5xx retry to hermes's outer conversation loop,
@@ -1906,30 +1586,13 @@ def switch_model(agent, new_model, new_provider, api_key='', base_url='', api_mo
        # ── Swap core runtime fields ──
        agent.model = new_model
        agent.provider = new_provider
-        # Use the new base_url when provided. When it's empty AND the
-        # provider is actually changing, do NOT fall back to the current
-        # (old provider's) URL — that silently pairs the new provider label
-        # with the previous provider's endpoint (e.g. new_provider=minimax
-        # paired with the leftover api.githubcopilot.com URL), and every
-        # request after the switch 400s at the wrong host. This mismatched
-        # pair also gets snapshotted into _primary_runtime below, so it
-        # keeps re-applying on every subsequent turn until a full restart.
-        # Fail loud instead: the caller (model_switch.switch_model())
-        # already resolves base_url for every real provider, so an empty
-        # value here means resolution failed upstream, not that the
-        # provider genuinely has none. Re-selecting the SAME provider with
-        # an empty base_url (e.g. a credential-only refresh) is still fine
-        # to keep the current URL. See #47828.
-        old_norm_provider = (old_provider or "").strip().lower()
-        new_norm_provider = (new_provider or "").strip().lower()
+        # Use new base_url when provided; only fall back to current when the
+        # new provider genuinely has no endpoint (e.g. native SDK providers).
+        # Without this guard the old provider's URL (e.g. Ollama's localhost
+        # address) would persist silently after switching to a cloud provider
+        # that returns an empty base_url string.
        if base_url:
            agent.base_url = base_url
-        elif old_norm_provider != new_norm_provider:
-            raise ValueError(
-                f"switch_model: no base_url resolved for provider "
-                f"'{new_provider}' (switching from '{old_provider}'); "
-                "refusing to keep the previous provider's endpoint"
-            )
        agent.api_mode = api_mode
        # Invalidate transport cache — new api_mode may need a different transport
        if hasattr(agent, "_transport_cache"):
@@ -1948,9 +1611,6 @@ def switch_model(agent, new_model, new_provider, api_key='', base_url='', api_mo
        old_norm = (old_provider or "").strip().lower()
        new_norm = (new_provider or "").strip().lower()
        if old_norm != new_norm or getattr(agent, "_credential_pool", None) is None:
-            # A pool bound to the old provider is worse than no pool: the
-            # recovery guard rejects it and every later 401/429 skips rotation.
-            agent._credential_pool = None
            try:
                from agent.credential_pool import load_pool
                agent._credential_pool = load_pool(new_provider)
@@ -1965,18 +1625,6 @@ def switch_model(agent, new_model, new_provider, api_key='', base_url='', api_mo
        if (new_provider or "").strip().lower() == "moa":
            from agent.moa_loop import MoAClient

-            # The MoA virtual provider speaks only chat.completions via the
-            # MoAClient facade — the aggregator's real transport
-            # (codex_responses / anthropic_messages) is resolved and applied
-            # *inside* the reference/aggregator fan-out, never on the outer
-            # primary call. determine_api_mode("moa", ...) above may have left
-            # api_mode set to the aggregator's transport; if the conversation
-            # loop sees that, it dispatches client.responses.create (which the
-            # facade has no .responses for) and the call falls through to the
-            # moa://local placeholder → HTTP 404 → fallback to a reference
-            # model. Pin chat_completions here so the primary call always goes
-            # through MoAClient.chat.completions, matching agent_init.py.
-            agent.api_mode = "chat_completions"
            agent.api_key = api_key or "moa-virtual-provider"
            agent.base_url = "moa://local"
            agent._client_kwargs = {}
@@ -2025,32 +1673,9 @@ def switch_model(agent, new_model, new_provider, api_key='', base_url='', api_mo
                "api_key": effective_key,
                "base_url": effective_base,
            }
-            try:
-                from hermes_cli.config import (
-                    apply_custom_provider_tls_to_client_kwargs,
-                    get_compatible_custom_providers,
-                    load_config_readonly,
-                )
-
-                # Read custom_providers from live config (not the init-time
-                # snapshot on ``agent._custom_providers``) so ssl_ca_cert /
-                # ssl_verify edits are honored when switching mid-session,
-                # matching the context-length reload below (#15779).
-                apply_custom_provider_tls_to_client_kwargs(
-                    agent._client_kwargs,
-                    str(effective_base or ""),
-                    get_compatible_custom_providers(load_config_readonly()),
-                )
-            except Exception:
-                logger.debug("custom-provider TLS resolution skipped on switch_model", exc_info=True)
            _sm_timeout = get_provider_request_timeout(agent.provider, agent.model)
            if _sm_timeout is not None:
                agent._client_kwargs["timeout"] = _sm_timeout
-            # Reapply provider-specific headers (e.g. OpenRouter HTTP-Referer,
-            # X-Title) that were lost when _client_kwargs was rebuilt from
-            # scratch.  Without this, model switches clear attribution headers
-            # and OpenRouter logs show "Unknown" for subsequent requests.
-            agent._apply_client_headers_for_base_url(effective_base)
            agent.client = agent._create_openai_client(
                dict(agent._client_kwargs),
                reason="switch_model",
@@ -2121,35 +1746,9 @@ def switch_model(agent, new_model, new_provider, api_key='', base_url='', api_mo
            api_mode=agent.api_mode,
        )

-    # ── Re-resolve reasoning_config from per-model override ──
-    # The new model may have a different reasoning_effort override. Re-read
-    # config so the override takes effect immediately on /model switch —
-    # resolved through the shared chokepoint (per-model > global; YAML
-    # boolean False = disabled).
-    try:
-        from hermes_constants import resolve_reasoning_config
-        from hermes_cli.config import load_config as _sm_load_config
-
-        _reasoning_cfg = _sm_load_config() or {}
-        agent.reasoning_config = resolve_reasoning_config(_reasoning_cfg, agent.model)
-        logger.info(
-            "switch_model: reasoning_config resolved for %s: %s",
-            agent.model, agent.reasoning_config,
-        )
-    except Exception as _reasoning_err:
-        logger.debug("switch_model: could not re-resolve reasoning_config: %s", _reasoning_err)
-
    # ── Invalidate cached system prompt so it rebuilds next turn ──
    agent._cached_system_prompt = None

-    # ── Reset the cross-turn stale-call circuit breaker (#58962) ──
-    # The breaker's error text tells the user to "switch models ... then
-    # retry"; without this reset the streak stays latched and the freshly
-    # selected (healthy) provider would keep short-circuiting before any
-    # stream is even attempted.
-    from agent.chat_completion_helpers import _reset_stale_streak
-    _reset_stale_streak(agent)
-
    # ── Update _primary_runtime so the change persists across turns ──
    _cc = agent.context_compressor if hasattr(agent, "context_compressor") and agent.context_compressor else None
    agent._primary_runtime = {
@@ -2161,7 +1760,6 @@ def switch_model(agent, new_model, new_provider, api_key='', base_url='', api_mo
        "client_kwargs": dict(agent._client_kwargs),
        "use_prompt_caching": agent._use_prompt_caching,
        "use_native_cache_layout": agent._use_native_cache_layout,
-        "reasoning_config": dict(agent.reasoning_config) if getattr(agent, "reasoning_config", None) else None,
        "compressor_model": getattr(_cc, "model", agent.model) if _cc else agent.model,
        "compressor_base_url": getattr(_cc, "base_url", agent.base_url) if _cc else agent.base_url,
        "compressor_api_key": getattr(_cc, "api_key", "") if _cc else "",
@@ -2260,12 +1858,12 @@ def invoke_tool(agent, function_name: str, function_args: dict, effective_task_i
    except Exception as _mw_err:
        logger.debug("tool_request middleware error: %s", _mw_err)

-    # Check plugin hooks for a block or approval directive before executing.
+    # Check plugin hooks for a block directive before executing anything.
    block_message: Optional[str] = None
    if not pre_tool_block_checked:
        try:
-            from hermes_cli.plugins import resolve_pre_tool_block
-            block_message = resolve_pre_tool_block(
+            from hermes_cli.plugins import get_pre_tool_call_block_message
+            block_message = get_pre_tool_call_block_message(
                function_name,
                function_args,
                task_id=effective_task_id or "",
@@ -2276,7 +1874,7 @@ def invoke_tool(agent, function_name: str, function_args: dict, effective_task_i
                middleware_trace=list(_tool_middleware_trace),
            )
        except Exception:
-            block_message = None
+            pass
    if block_message is not None:
        result = json.dumps({"error": block_message}, ensure_ascii=False)
        try:
@@ -2554,89 +2152,6 @@ def sanitize_api_messages(messages: List[Dict[str, Any]]) -> List[Dict[str, Any]
        filtered.append(msg)
    messages = filtered

-    # --- Drop empty / malformed tool_calls arrays on assistant messages ---
-    # An assistant message carrying ``tool_calls: []`` (an empty array) — or a
-    # non-list value under the key — is semantically identical to an assistant
-    # message with no tool calls, but strict OpenAI-compatible providers reject
-    # the empty array outright: DeepSeek v4 returns HTTP 400 "Invalid
-    # 'messages[N].tool_calls': empty array. Expected an array with minimum
-    # length 1, but got an empty array instead." (#58755, follow-up to #56980).
-    # Empty arrays reach here from session resume, host-fed histories, or the
-    # consecutive-assistant merge in ``repair_message_sequence`` (which
-    # preserves a pre-existing ``[]`` on the surviving turn). This is the final
-    # pre-API chokepoint, so normalize defensively — and, per the #56980
-    # review, do it HERE on the per-call copy rather than in
-    # ``repair_message_sequence``, which would destructively rewrite the
-    # persisted trajectory. Shallow-copy the message before dropping the key so
-    # stored history (and prompt caching) stays byte-stable.
-    normalized: List[Dict[str, Any]] = []
-    dropped_empty_tool_calls = 0
-    for msg in messages:
-        if (
-            isinstance(msg, dict)
-            and msg.get("role") == "assistant"
-            and "tool_calls" in msg
-            and not (isinstance(msg["tool_calls"], list) and msg["tool_calls"])
-        ):
-            msg = {k: v for k, v in msg.items() if k != "tool_calls"}
-            dropped_empty_tool_calls += 1
-        normalized.append(msg)
-    if dropped_empty_tool_calls:
-        messages = normalized
-        _ra().logger.debug(
-            "Pre-call sanitizer: dropped empty/invalid tool_calls on %d "
-            "assistant message(s)",
-            dropped_empty_tool_calls,
-        )
-
-    # --- Repair tool_calls whose function.name is empty/missing ---
-    # Some providers (and partially-streamed responses) emit a tool_call with
-    # id="call_xxx" but function.name="". Downstream Responses-API adapters
-    # silently DROP such function_call items while still emitting the matching
-    # function_call_output, producing the gateway's HTTP 400
-    # "No tool call found for function call output with call_id ...".
-    #
-    # We do NOT drop the call: hermes' own dispatch loop intentionally keeps an
-    # empty-name call paired with a synthesized anti-priming tool result
-    # ("tool name was empty", see #47967) so weak models self-correct instead of
-    # being fed the full tool catalog. Dropping the call here would (a) orphan
-    # that result and strip the anti-priming signal, and (b) still leave any
-    # provider-side orphan. Instead, rename the blank name to a non-empty
-    # sentinel so the call and its result stay PAIRED — the adapter no longer
-    # drops the function_call, so there is no orphaned output and no 400, while
-    # the result content the model needs is preserved.
-    _EMPTY_NAME_SENTINEL = "invalid_tool_call"
-    for msg in messages:
-        if msg.get("role") != "assistant":
-            continue
-        tcs = msg.get("tool_calls") or []
-        if not tcs:
-            continue
-        for tc in tcs:
-            if isinstance(tc, dict):
-                fn = tc.get("function")
-                name = fn.get("name") if isinstance(fn, dict) else getattr(fn, "name", None)
-            else:
-                fn = getattr(tc, "function", None)
-                name = getattr(fn, "name", None) if fn else None
-            if isinstance(name, str) and name.strip():
-                continue
-            _ra().logger.warning(
-                "Pre-call sanitizer: repairing tool_call with empty "
-                "function.name -> %r (id=%s)",
-                _EMPTY_NAME_SENTINEL,
-                _ra().AIAgent._get_tool_call_id_static(tc),
-            )
-            if isinstance(fn, dict):
-                fn["name"] = _EMPTY_NAME_SENTINEL
-            elif fn is not None and hasattr(fn, "name"):
-                try:
-                    fn.name = _EMPTY_NAME_SENTINEL
-                except Exception:
-                    pass
-            elif isinstance(tc, dict):
-                tc["function"] = {"name": _EMPTY_NAME_SENTINEL, "arguments": "{}"}
-
    surviving_call_ids: set = set()
    for msg in messages:
        if msg.get("role") == "assistant":
@@ -2648,7 +2163,7 @@ def sanitize_api_messages(messages: List[Dict[str, Any]]) -> List[Dict[str, Any]
    result_call_ids: set = set()
    for msg in messages:
        if msg.get("role") == "tool":
-            cid = (msg.get("tool_call_id") or "").strip()
+            cid = msg.get("tool_call_id")
            if cid:
                result_call_ids.add(cid)

@@ -2657,7 +2172,7 @@ def sanitize_api_messages(messages: List[Dict[str, Any]]) -> List[Dict[str, Any]
    if orphaned_results:
        messages = [
            m for m in messages
-            if not (m.get("role") == "tool" and (m.get("tool_call_id") or "").strip() in orphaned_results)
+            if not (m.get("role") == "tool" and m.get("tool_call_id") in orphaned_results)
        ]
        _ra().logger.debug(
            "Pre-call sanitizer: removed %d orphaned tool result(s)",
@@ -2685,57 +2200,13 @@ def sanitize_api_messages(messages: List[Dict[str, Any]]) -> List[Dict[str, Any]
            "Pre-call sanitizer: added %d stub tool result(s)",
            len(missing_results),
        )
-
-    # 3. Deduplicate tool_call_ids. Strict providers (DeepSeek) reject a
-    # payload where the same tool_call_id appears more than once with HTTP 400
-    # "Duplicate value for 'tool_call_id'" (#58327). Duplicates can arise from
-    # retries, crash/resume glitches, or a compression window that re-emits a
-    # tool result. This is the final pre-API chokepoint, so dedup defensively
-    # here even though repair_message_sequence also consumes matched ids.
-    #   (a) collapse duplicate tool_calls WITHIN an assistant message
-    #   (b) drop later tool result messages reusing an already-seen id
-    seen_assistant_call_ids: set = set()
-    seen_result_call_ids: set = set()
-    deduped: List[Dict[str, Any]] = []
-    removed_dupes = 0
-    for msg in messages:
-        role = msg.get("role")
-        if role == "assistant" and msg.get("tool_calls"):
-            kept_tcs = []
-            for tc in msg.get("tool_calls") or []:
-                cid = _ra().AIAgent._get_tool_call_id_static(tc)
-                if cid and cid in seen_assistant_call_ids:
-                    removed_dupes += 1
-                    continue
-                if cid:
-                    seen_assistant_call_ids.add(cid)
-                kept_tcs.append(tc)
-            if len(kept_tcs) != len(msg.get("tool_calls") or []):
-                msg = {**msg, "tool_calls": kept_tcs}
-            deduped.append(msg)
-        elif role == "tool":
-            cid = (msg.get("tool_call_id") or "").strip()
-            if cid and cid in seen_result_call_ids:
-                removed_dupes += 1
-                continue
-            if cid:
-                seen_result_call_ids.add(cid)
-            deduped.append(msg)
-        else:
-            deduped.append(msg)
-    if removed_dupes:
-        messages = deduped
-        _ra().logger.debug(
-            "Pre-call sanitizer: removed %d duplicate tool_call_id reference(s)",
-            removed_dupes,
-        )
    return messages



 def looks_like_codex_intermediate_ack(
    agent,
-    user_message: Any,
+    user_message: str,
    assistant_content: str,
    messages: List[Dict[str, Any]],
    require_workspace: bool = True,
@@ -2815,14 +2286,7 @@ def looks_like_codex_intermediate_ack(
    if not require_workspace:
        return True

-    # ``user_message`` is typed ``str`` but can arrive as an OpenAI-style
-    # multi-part content list (``[{type:"text",...}, {type:"image_url",...}]``)
-    # for vision requests routed through the OpenAI-compat API server. A
-    # truthy list survives ``(user_message or "")`` and then ``.strip()``
-    # raises ``AttributeError`` — flatten to text first.
-    from agent.codex_responses_adapter import _summarize_user_message_for_log
-
-    user_text = _summarize_user_message_for_log(user_message).strip().lower()
+    user_text = (user_message or "").strip().lower()
    user_targets_workspace = (
        any(marker in user_text for marker in workspace_markers)
        or "~/" in user_text
@@ -3141,10 +2605,6 @@ def extract_api_error_context(error: Exception) -> Dict[str, Any]:
        if isinstance(reason, str) and reason.strip():
            context["reason"] = reason.strip()
        message = payload.get("message") or payload.get("error_description")
-        if not message and isinstance(payload.get("error"), str):
-            # xAI uses a top-level string ``error`` beside a structured
-            # ``code`` (for example personal-team-blocked:spending-limit).
-            message = payload.get("error")
        if isinstance(message, str) and message.strip():
            context["message"] = message.strip()
        for key in ("resets_at", "reset_at"):
@@ -65,7 +65,6 @@ THINKING_BUDGET = {"xhigh": 32000, "high": 16000, "medium": 8000, "low": 4000}
 # maps to low on every model.  See:
 # https://platform.claude.com/docs/en/about-claude/models/migration-guide
 ADAPTIVE_EFFORT_MAP = {
-    "ultra":   "max",
    "max":     "max",
    "xhigh":   "xhigh",
    "high":    "high",
@@ -534,9 +533,8 @@ def _requires_bearer_auth(base_url: str | None) -> bool:

    Some third-party /anthropic endpoints implement Anthropic's Messages API but
    require Authorization: Bearer instead of Anthropic's native x-api-key header.
-    MiniMax's global and China Anthropic-compatible endpoints, Azure AI
-    Foundry's Anthropic-style endpoint, and Palantir Foundry's LLM proxy
-    follow this pattern.
+    MiniMax's global and China Anthropic-compatible endpoints, and Azure AI
+    Foundry's Anthropic-style endpoint follow this pattern.
    """
    normalized = _normalize_base_url_text(base_url)
    if not normalized:
@@ -545,11 +543,6 @@ def _requires_bearer_auth(base_url: str | None) -> bool:
    return (
        normalized.startswith(("https://api.minimax.io/anthropic", "https://api.minimaxi.com/anthropic"))
        or "azure.com" in normalized
-        # Palantir Foundry LLM proxy (<org>.palantirfoundry.com/api/v2/llm/proxy/anthropic)
-        # rejects x-api-key with 401 and requires Authorization: Bearer.
-        # Hostname match (not substring) so e.g. evil.com/palantirfoundry
-        # paths don't trigger Bearer auth.
-        or base_url_host_matches(normalized, "palantirfoundry.com")
    )


@@ -633,8 +626,8 @@ def _common_betas_for_base_url(

 def _build_anthropic_client_with_bearer_hook(
    token_provider,
-    base_url: str | None = None,
-    timeout: float | None = None,
+    base_url: str = None,
+    timeout: float = None,
    *,
    drop_context_1m_beta: bool = False,
 ):
@@ -709,8 +702,8 @@ def _build_anthropic_client_with_bearer_hook(

 def build_anthropic_client(
    api_key,
-    base_url: str | None = None,
-    timeout: float | None = None,
+    base_url: str = None,
+    timeout: float = None,
    *,
    drop_context_1m_beta: bool = False,
 ):
@@ -824,7 +817,7 @@ def build_anthropic_client(
        kwargs["auth_token"] = api_key
        kwargs["default_headers"] = {
            "anthropic-beta": ",".join(all_betas),
-            "user-agent": f"claude-code/{_get_claude_code_version()} (external, cli)",
+            "user-agent": f"claude-cli/{_get_claude_code_version()} (external, cli)",
            "x-app": "cli",
        }
    else:
@@ -1052,7 +1045,7 @@ def refresh_anthropic_oauth_pure(refresh_token: str, *, use_json: bool = False)
            data=data,
            headers={
                "Content-Type": content_type,
-                "User-Agent": _OAUTH_TOKEN_USER_AGENT,
+                "User-Agent": f"claude-cli/{_get_claude_code_version()} (external, cli)",
            },
            method="POST",
        )
@@ -1385,20 +1378,9 @@ _OAUTH_TOKEN_URLS = [
    "https://console.anthropic.com/v1/oauth/token",
 ]
 _OAUTH_TOKEN_URL = _OAUTH_TOKEN_URLS[0]
-# User-Agent sent on the OAuth *token endpoint* (login exchange + refresh).
-# Anthropic rate-limits (HTTP 429) any token-endpoint request whose UA starts
-# with ``claude-code/`` — verified empirically against platform.claude.com:
-# ``claude-code/2.1.200`` and ``Mozilla/5.0`` -> 429; ``axios/*``, ``node``,
-# and SDK-style UAs -> 400 (reached code validation). The real Claude Code CLI
-# exchanges the auth code with a bare axios client (``axios/<ver>``), NOT its
-# ``claude-code/`` inference UA. We mirror that here. NOTE: the *inference* path
-# (build_anthropic_kwargs) still uses the ``claude-code/`` UA + ``x-app: cli`` —
-# that fingerprint is required there and is NOT throttled on the messages API.
-_OAUTH_TOKEN_USER_AGENT = "axios/1.7.9"
 _OAUTH_REDIRECT_URI = "https://console.anthropic.com/oauth/code/callback"
 _OAUTH_SCOPES = "org:create_api_key user:profile user:inference"
-def _get_hermes_oauth_file() -> Path:
-    return get_hermes_home() / ".anthropic_oauth.json"
+_HERMES_OAUTH_FILE = get_hermes_home() / ".anthropic_oauth.json"


 def _generate_pkce() -> tuple:
@@ -1496,9 +1478,6 @@ def run_hermes_oauth_login_pure() -> Optional[Dict[str, Any]]:
        # Anthropic migrated the OAuth token endpoint to platform.claude.com;
        # console.anthropic.com now 404s. Try the new host first, then fall
        # back to console for older deployments (mirrors the refresh path).
-        # UA is _OAUTH_TOKEN_USER_AGENT (a non-claude-code UA) — see the
-        # constant's definition for why the token endpoint must not send
-        # claude-code/ (429 UA-prefix block).
        result = None
        last_error = None
        for endpoint in _OAUTH_TOKEN_URLS:
@@ -1507,7 +1486,7 @@ def run_hermes_oauth_login_pure() -> Optional[Dict[str, Any]]:
                data=exchange_data,
                headers={
                    "Content-Type": "application/json",
-                    "User-Agent": _OAUTH_TOKEN_USER_AGENT,
+                    "User-Agent": f"claude-cli/{_get_claude_code_version()} (external, cli)",
                },
                method="POST",
            )
@@ -1546,10 +1525,9 @@ def run_hermes_oauth_login_pure() -> Optional[Dict[str, Any]]:

 def read_hermes_oauth_credentials() -> Optional[Dict[str, Any]]:
    """Read Hermes-managed OAuth credentials from ~/.hermes/.anthropic_oauth.json."""
-    oauth_file = _get_hermes_oauth_file()
-    if oauth_file.exists():
+    if _HERMES_OAUTH_FILE.exists():
        try:
-            data = json.loads(oauth_file.read_text(encoding="utf-8"))
+            data = json.loads(_HERMES_OAUTH_FILE.read_text(encoding="utf-8"))
            if data.get("accessToken"):
                return data
        except (json.JSONDecodeError, OSError, IOError) as e:
@@ -1913,18 +1891,6 @@ def _sanitize_replay_block(b: Dict[str, Any]) -> Optional[Dict[str, Any]]:
    return None


-def _apply_assistant_cache_control_to_last_cacheable_block(
-    blocks: List[Dict[str, Any]],
-    cache_control: Any,
-) -> None:
-    if not isinstance(cache_control, dict):
-        return
-    for block in reversed(blocks):
-        if isinstance(block, dict) and block.get("type") in {"text", "tool_use"}:
-            block.setdefault("cache_control", dict(cache_control))
-            break
-
-
 def _convert_assistant_message(m: Dict[str, Any]) -> Dict[str, Any]:
    """Convert an assistant message to Anthropic content blocks.

@@ -1979,9 +1945,6 @@ def _convert_assistant_message(m: Dict[str, Any]) -> Dict[str, Any]:
                    clean["input"] = redacted
            replayed.append(clean)
        if replayed:
-            _apply_assistant_cache_control_to_last_cacheable_block(
-                replayed, m.get("cache_control")
-            )
            return {"role": "assistant", "content": replayed}

    blocks = _extract_preserved_thinking_blocks(m)
@@ -2007,9 +1970,6 @@ def _convert_assistant_message(m: Dict[str, Any]) -> Dict[str, Any]:
            "name": fn.get("name", ""),
            "input": parsed_args,
        })
-    _apply_assistant_cache_control_to_last_cacheable_block(
-        blocks, m.get("cache_control")
-    )
    # Kimi's /coding endpoint (Anthropic protocol) requires assistant
    # tool-call messages to carry reasoning_content when thinking is
    # enabled server-side.  Preserve it as a thinking block so Kimi
@@ -2109,7 +2069,7 @@ def _convert_user_message(content: Any) -> Dict[str, Any]:
    if isinstance(content, list):
        converted_blocks = _convert_content_to_anthropic(content)
        if not converted_blocks or all(
-            (b.get("text") or "").strip() == ""
+            b.get("text", "").strip() == ""
            for b in converted_blocks
            if isinstance(b, dict) and b.get("type") == "text"
        ):
@@ -2125,81 +2085,57 @@ def _strip_orphaned_tool_blocks(result: List[Dict[str, Any]]) -> None:
    """Strip tool_use blocks with no matching tool_result, and vice versa.

    Context compression or session truncation can remove either side of a
-    tool-call pair, or insert messages between a tool_use and its result.
-    Anthropic requires each tool_use to have a matching tool_result in the
-    IMMEDIATELY FOLLOWING user message — a global ID match is not enough.
+    tool-call pair.  Anthropic rejects both orphans with HTTP 400.
+
    Mutates ``result`` in place.
    """
-    # Pass 1: For each assistant message with tool_use blocks, check that
-    # EACH tool_use ID has a matching tool_result in the immediately following
-    # user message.  Strip tool_use blocks that lack an adjacent result —
-    # Anthropic rejects non-adjacent pairs with HTTP 400 even when the IDs
-    # match somewhere later in the conversation.
-    for i, m in enumerate(result):
-        if m.get("role") != "assistant" or not isinstance(m.get("content"), list):
-            continue
-        tool_use_ids_in_turn = {
-            b.get("id")
-            for b in m["content"]
-            if isinstance(b, dict) and b.get("type") == "tool_use"
-        }
-        if not tool_use_ids_in_turn:
-            continue
-
-        # Collect result IDs from the immediately following user message only.
-        adjacent_result_ids: set = set()
-        if i + 1 < len(result):
-            nxt = result[i + 1]
-            if nxt.get("role") == "user" and isinstance(nxt.get("content"), list):
-                for block in nxt["content"]:
-                    if isinstance(block, dict) and block.get("type") == "tool_result":
-                        adjacent_result_ids.add(block.get("tool_use_id"))
-
-        orphaned = tool_use_ids_in_turn - adjacent_result_ids
-        if not orphaned:
-            continue
-
-        kept = [
-            b
-            for b in m["content"]
-            if not (isinstance(b, dict) and b.get("type") == "tool_use" and b.get("id") in orphaned)
-        ]
-        # If stripping an orphaned tool_use mutated a turn that also carries a
-        # signed thinking block, that block's Anthropic signature was computed
-        # against the ORIGINAL (un-stripped) turn content and is now invalid.
-        # Anthropic rejects the replayed turn with HTTP 400 "thinking blocks in
-        # the latest assistant message cannot be modified".  Flag the turn so
-        # _manage_thinking_signatures can demote the dead signature instead of
-        # replaying it verbatim.  See hermes-agent: extended-thinking + parallel
-        # tool batch interrupted mid-flight → non-retryable 400 crash-loop.
-        if len(kept) != len(m["content"]) and any(
-            isinstance(b, dict) and b.get("type") in {"thinking", "redacted_thinking"}
-            for b in m["content"]
-        ):
-            m["_thinking_signature_invalidated"] = True
-        m["content"] = kept if kept else [{"type": "text", "text": "(tool call removed)"}]
-
-    # Pass 2: Rebuild the set of tool_use IDs that survived pass 1, then
-    # strip tool_result blocks that no longer have any matching tool_use
-    # anywhere in the conversation.
-    surviving_tool_use_ids: set = set()
+    # Strip orphaned tool_use blocks (no matching tool_result follows)
+    tool_result_ids = set()
    for m in result:
-        if m.get("role") == "assistant" and isinstance(m.get("content"), list):
+        if m["role"] == "user" and isinstance(m["content"], list):
            for block in m["content"]:
-                if isinstance(block, dict) and block.get("type") == "tool_use":
-                    surviving_tool_use_ids.add(block.get("id"))
-
+                if block.get("type") == "tool_result":
+                    tool_result_ids.add(block.get("tool_use_id"))
    for m in result:
-        if m.get("role") != "user" or not isinstance(m.get("content"), list):
-            continue
-        new_content = [
-            b
-            for b in m["content"]
-            if not (isinstance(b, dict) and b.get("type") == "tool_result")
-            or b.get("tool_use_id") in surviving_tool_use_ids
-        ]
-        if len(new_content) != len(m["content"]):
-            m["content"] = new_content if new_content else [{"type": "text", "text": "(tool result removed)"}]
+        if m["role"] == "assistant" and isinstance(m["content"], list):
+            kept = [
+                b
+                for b in m["content"]
+                if b.get("type") != "tool_use" or b.get("id") in tool_result_ids
+            ]
+            # If stripping an orphaned tool_use mutated a turn that also carries a
+            # signed thinking block, that block's Anthropic signature was computed
+            # against the ORIGINAL (un-stripped) turn content and is now invalid.
+            # Anthropic rejects the replayed turn with HTTP 400 "thinking blocks in
+            # the latest assistant message cannot be modified".  Flag the turn so
+            # _manage_thinking_signatures can demote the dead signature instead of
+            # replaying it verbatim.  See hermes-agent: extended-thinking + parallel
+            # tool batch interrupted mid-flight → non-retryable 400 crash-loop.
+            if len(kept) != len(m["content"]) and any(
+                isinstance(b, dict) and b.get("type") in {"thinking", "redacted_thinking"}
+                for b in m["content"]
+            ):
+                m["_thinking_signature_invalidated"] = True
+            m["content"] = kept
+            if not m["content"]:
+                m["content"] = [{"type": "text", "text": "(tool call removed)"}]
+
+    # Strip orphaned tool_result blocks (no matching tool_use precedes them)
+    tool_use_ids = set()
+    for m in result:
+        if m["role"] == "assistant" and isinstance(m["content"], list):
+            for block in m["content"]:
+                if block.get("type") == "tool_use":
+                    tool_use_ids.add(block.get("id"))
+    for m in result:
+        if m["role"] == "user" and isinstance(m["content"], list):
+            m["content"] = [
+                b
+                for b in m["content"]
+                if b.get("type") != "tool_result" or b.get("tool_use_id") in tool_use_ids
+            ]
+            if not m["content"]:
+                m["content"] = [{"type": "text", "text": "(tool result removed)"}]


 def _merge_consecutive_roles(result: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
@@ -1,138 +0,0 @@
-"""Ambient session-accounting context for auxiliary LLM calls.
-
-Auxiliary calls (vision, compression, title generation, web_extract,
-session_search, ...) funnel through ``agent.auxiliary_client`` which has no
-session handle — so their token usage was historically discarded, leaving
-dashboard analytics blind to aux model spend (issue #23270).
-
-Instead of threading ``session_db``/``session_id`` parameters through every
-aux call site, the agent loop publishes them here (mirroring the Nous Portal
-conversation context in ``agent.portal_tags``) and the auxiliary client
-records usage at its single response-validation chokepoint.
-
-ContextVar semantics give us the right isolation for free:
-
-* concurrent agents in one process (gateway sessions, delegate subagents)
-  never see each other's accounting context;
-* worker threads spawned via ``tools.thread_context.propagate_context_to_thread``
-  (MoA fan-out, background review) inherit the parent turn's context;
-* asyncio tasks inherit the context of the code that created them.
-
-MoA reference/aggregator slots are explicitly EXCLUDED from recording:
-``agent/conversation_loop.py`` already folds MoA advisor usage and cost into
-the main loop's ``update_token_counts`` delta, so recording them here would
-double-count (see ``_EXCLUDED_TASKS``).
-"""
-
-from __future__ import annotations
-
-import logging
-from contextvars import ContextVar
-from typing import Any, Optional
-
-logger = logging.getLogger(__name__)
-
-# (session_db, session_id) for the active agent turn, or None outside one.
-_accounting: ContextVar[Optional[tuple]] = ContextVar(
-    "aux_accounting_context", default=None
-)
-
-# Aux tasks whose usage is already accounted by the main loop — recording
-# them here would double-count. MoA advisor/aggregator usage is folded into
-# conversation_loop's update_token_counts delta (tokens AND cost).
-_EXCLUDED_TASKS = frozenset({"moa_reference", "moa_aggregator"})
-
-
-def set_accounting_context(session_db: Any, session_id: Optional[str]):
-    """Publish the active session's accounting handles for aux usage recording.
-
-    Called by the agent loop at turn entry. Returns the ContextVar token so
-    callers can ``reset_accounting_context(token)`` on turn exit. Publishing
-    ``None`` handles (no DB / no session id) clears the context.
-    """
-    if session_db is None or not session_id:
-        return _accounting.set(None)
-    return _accounting.set((session_db, session_id))
-
-
-def reset_accounting_context(token) -> None:
-    """Restore the previous accounting context (pair with ``set_...``)."""
-    try:
-        _accounting.reset(token)
-    except Exception:
-        _accounting.set(None)
-
-
-def get_accounting_context() -> Optional[tuple]:
-    """Return ``(session_db, session_id)`` for the active turn, or ``None``."""
-    return _accounting.get()
-
-
-def record_aux_usage(
-    response: Any,
-    task: Optional[str],
-    *,
-    provider: Optional[str] = None,
-    base_url: Optional[str] = None,
-) -> None:
-    """Record an auxiliary response's token usage against the ambient session.
-
-    Called from the auxiliary client's response-validation chokepoint. Strictly
-    best-effort: any failure is swallowed (accounting must never break an aux
-    call). No-ops when:
-
-    * no accounting context is published (call is outside any agent turn),
-    * the task is main-loop-accounted (MoA slots — see ``_EXCLUDED_TASKS``),
-    * the response carries no usage object.
-
-    The model is read from ``response.model`` (accurate even after the aux
-    client's provider-fallback chains); *provider*/*base_url* reflect the
-    originally-resolved route and are best-effort.
-    """
-    try:
-        if not task or task in _EXCLUDED_TASKS:
-            return
-        ctx = _accounting.get()
-        if ctx is None:
-            return
-        session_db, session_id = ctx
-        raw_usage = getattr(response, "usage", None)
-        if raw_usage is None:
-            return
-
-        from agent.usage_pricing import estimate_usage_cost, normalize_usage
-
-        usage = normalize_usage(raw_usage, provider=provider)
-        if not (
-            usage.input_tokens or usage.output_tokens
-            or usage.cache_read_tokens or usage.cache_write_tokens
-            or usage.reasoning_tokens
-        ):
-            return
-
-        model = str(getattr(response, "model", "") or "") or "unknown"
-        estimated_cost = None
-        try:
-            cost = estimate_usage_cost(
-                model, usage, provider=provider, base_url=base_url
-            )
-            if cost.amount_usd is not None:
-                estimated_cost = float(cost.amount_usd)
-        except Exception:
-            logger.debug("Aux usage cost estimation failed", exc_info=True)
-
-        session_db.record_auxiliary_usage(
-            session_id,
-            task,
-            model=model,
-            billing_provider=provider,
-            billing_base_url=base_url,
-            input_tokens=usage.input_tokens,
-            output_tokens=usage.output_tokens,
-            cache_read_tokens=usage.cache_read_tokens,
-            cache_write_tokens=usage.cache_write_tokens,
-            reasoning_tokens=usage.reasoning_tokens,
-            estimated_cost_usd=estimated_cost,
-        )
-    except Exception:
-        logger.debug("Aux usage recording failed (non-fatal)", exc_info=True)
@@ -18,13 +18,12 @@ for invariants and PR review criteria.

 from __future__ import annotations

+import contextlib
 import json
 import logging
 import os
 from typing import Any, Dict, List, Optional

-from agent.thread_scoped_output import thread_scoped_silence
-
 logger = logging.getLogger(__name__)


@@ -62,11 +61,6 @@ def _resolve_review_runtime(agent: Any) -> Dict[str, Any]:
        "api_key": parent_runtime.get("api_key") or None,
        "base_url": parent_runtime.get("base_url") or None,
        "api_mode": parent_api_mode,
-        "credential_pool": getattr(agent, "_credential_pool", None),
-        "request_overrides": dict(getattr(agent, "request_overrides", {}) or {}),
-        "max_tokens": getattr(agent, "max_tokens", None),
-        "command": getattr(agent, "acp_command", None),
-        "args": list(getattr(agent, "acp_args", []) or []),
        "routed": False,
    }
    try:
@@ -94,15 +88,10 @@ def _resolve_review_runtime(agent: Any) -> Dict[str, Any]:
        )
        return {
            "provider": rp.get("provider") or task_provider,
-            "model": rp.get("model") or task_model,
+            "model": task_model,
            "api_key": rp.get("api_key"),
            "base_url": rp.get("base_url"),
            "api_mode": rp.get("api_mode"),
-            "credential_pool": rp.get("credential_pool"),
-            "request_overrides": dict(rp.get("request_overrides") or {}),
-            "max_tokens": rp.get("max_output_tokens"),
-            "command": rp.get("command"),
-            "args": list(rp.get("args") or []),
            "routed": True,
        }
    except Exception as e:
@@ -459,21 +448,10 @@ def summarize_background_review_actions(
            data = json.loads(msg.get("content", "{}"))
        except (json.JSONDecodeError, TypeError):
            continue
-        # ``data`` may not be a dict — some memory/skill tool responses in
-        # older codepaths or wrapper MCP servers return a top-level JSON
-        # list (e.g. ``[{"success": true, ...}]``) or a scalar.  The original
-        # isinstance check below silently skips non-dict payloads, which
-        # is correct, but ``data.get("_change")`` further down can still
-        # hand back a list and break ``change.get("description", "")``.
-        # Defensively normalize everything through a dict-typed alias so
-        # the rest of the function can stay terse without per-call
-        # ``isinstance`` guards (#59437).
        if not isinstance(data, dict) or not data.get("success"):
            continue
        message = data.get("message", "")
-        detail = call_details.get(tcid) or {}
-        if not isinstance(detail, dict):
-            detail = {}
+        detail = call_details.get(tcid, {})
        target = data.get("target", "") or detail.get("target", "")
        is_skill = detail.get("tool") == "skill_manage"

@@ -501,30 +479,12 @@ def summarize_background_review_actions(
            content = detail.get("content", "")
            old_text = detail.get("old_text", "")
            skill_name = detail.get("name", "")
-            # ``operations`` may be anything callable put into the JSON
-            # arguments.  Anything non-iterable that isn't a list[str]
-            # of dicts becomes unusable here, so coerce defensively.
-            ops_raw = detail.get("operations")
-            operations: list = (
-                ops_raw if isinstance(ops_raw, list) else []
-            )
+            operations = detail.get("operations") or []
            max_preview = 120
            if is_skill:
-                # ``_change`` is a free-form dict the skill tool leaves in
-                # the response.  Older / wrapper MCP backends return it
-                # as a list, an int, or a JSON-shaped scalar — normalize
-                # to a dict so the .get() calls downstream don't
-                # AttributeError (#59437).
-                change_raw = data.get("_change")
-                change: dict = (
-                    change_raw if isinstance(change_raw, dict) else {}
-                )
-                old_string = (
-                    change.get("old", "") or detail.get("old_string", "")
-                )
-                new_string = (
-                    change.get("new", "") or detail.get("new_string", "")
-                )
+                change = data.get("_change", {})
+                old_string = change.get("old", "") or detail.get("old_string", "")
+                new_string = change.get("new", "") or detail.get("new_string", "")
                description = change.get("description", "")
                if action == "patch" and (old_string or new_string):
                    old_preview = old_string[:80].replace("\n", " ") + (
@@ -545,13 +505,7 @@ def summarize_background_review_actions(
                    actions.append(f"📝 {message}" if message else f"Skill {action}")
            elif operations:
                for op in operations:
-                    # Each element must be a dict-of-fields; some
-                    # legacy codepaths serialize the entry as a bare
-                    # string and the message dict doesn't exist.  Skip
-                    # non-dict items defensively — they have no
-                    # actionable fields anyway (#59437).
-                    if not isinstance(op, dict):
-                        continue
+                    op = op or {}
                    op_act = op.get("action", "")
                    op_content = (op.get("content") or "")
                    op_old = (op.get("old_text") or "")
@@ -648,15 +602,9 @@ def _run_review_in_thread(
    review_agent = None
    review_messages: List[Dict] = []
    try:
-        # Silence stdout/stderr for THIS worker thread only.  A process-global
-        # ``contextlib.redirect_stdout(devnull)`` here would also blank
-        # ``sys.stdout``/``sys.stderr`` for every other thread — including a
-        # gateway event-loop thread driving a Telegram long-poll — for the full
-        # duration of the review (tens of seconds), swallowing their console
-        # output (#55769 / #55925).  ``thread_scoped_silence`` routes only this
-        # thread's writes to devnull and leaves all other threads on the real
-        # streams.
-        with thread_scoped_silence():
+        with open(os.devnull, "w", encoding="utf-8") as _devnull, \
+             contextlib.redirect_stdout(_devnull), \
+             contextlib.redirect_stderr(_devnull):
            # Inherit the parent agent's live runtime (provider, model,
            # base_url, api_key, api_mode) so the fork uses the exact
            # same credentials the main turn is using.  Without this,
@@ -690,25 +638,6 @@ def _run_review_in_thread(
            # Match parent's toolset config so ``tools[]`` is byte-identical
            # in the request body — Anthropic's cache key includes it.
            # (The runtime whitelist below still restricts dispatch.)
-            _fork_kwargs: Dict[str, Any] = {}
-            if isinstance(_rt.get("max_tokens"), int):
-                _fork_kwargs["max_tokens"] = _rt["max_tokens"]
-            if isinstance(_rt.get("command"), str) and _rt["command"]:
-                _fork_kwargs["acp_command"] = _rt["command"]
-                _fork_kwargs["acp_args"] = _rt.get("args") or []
-            # Match parent's reasoning config so the fork's ``thinking`` /
-            # ``output_config`` are byte-identical in the request body —
-            # Anthropic's cache key is namespaced by ``thinking`` presence.
-            # Same-model path only: when routed to a different aux model the
-            # cache is cold regardless (parity buys nothing) and the parent's
-            # effort vocabulary may not be valid for the routed model/provider
-            # (e.g. OpenRouter ``extra_body.reasoning.effort`` is forwarded
-            # unclamped; codex_responses passes ``max``/``ultra`` through
-            # unmapped except on gpt-5.6/xAI). Let the routed fork use
-            # provider defaults — matching the ``not _routed`` gate on
-            # _cached_system_prompt below.
-            if not _routed:
-                _fork_kwargs["reasoning_config"] = getattr(agent, "reasoning_config", None)
            review_agent = AIAgent(
                model=_rt.get("model") or agent.model,
                max_iterations=16,
@@ -718,13 +647,11 @@ def _run_review_in_thread(
                api_mode=_rt.get("api_mode"),
                base_url=_rt.get("base_url") or None,
                api_key=_rt.get("api_key") or None,
-                credential_pool=_rt.get("credential_pool"),
-                request_overrides=_rt.get("request_overrides") or {},
+                credential_pool=getattr(agent, "_credential_pool", None),
                parent_session_id=agent.session_id,
                enabled_toolsets=getattr(agent, "enabled_toolsets", None),
                disabled_toolsets=getattr(agent, "disabled_toolsets", None),
                skip_memory=True,
-                **_fork_kwargs,
            )
            review_agent._memory_write_origin = "background_review"
            review_agent._memory_write_context = "background_review"
@@ -740,20 +667,6 @@ def _run_review_in_thread(
            review_agent._user_profile_enabled = agent._user_profile_enabled
            review_agent._memory_nudge_interval = 0
            review_agent._skill_nudge_interval = 0
-            # PERSISTENCE ISOLATION (the curator-takeover root cause): the fork
-            # shares the parent's session_id (set below, for prompt-cache
-            # warmth), so without this it would write its harness turn ("Review
-            # the conversation above and update the skill library…") + its own
-            # response straight into the user's REAL session in state.db. On the
-            # user's next live turn the agent re-reads that injected user message
-            # as a standing instruction and "becomes" the curator, refusing the
-            # actual task. _persist_disabled hard-stops every DB write/lazy-open
-            # path (_flush_messages_to_session_db, _ensure_db_session,
-            # _get_session_db_for_recall); the review writes only to the skill
-            # and memory stores via its tools, which is all it needs.
-            review_agent._persist_disabled = True
-            review_agent._session_db = None
-            review_agent._session_json_enabled = False
            # Suppress all status/warning emits from the fork so the
            # user only sees the final successful-action summary.
            # Without this, mid-review "Iteration budget exhausted",
@@ -812,17 +725,10 @@ def _run_review_in_thread(
                clear_thread_tool_whitelist,
            )

-            # Gate the built-in memory tool on the profile's memory_enabled flag.
-            # Hardcoding ["memory", "skills"] granted the review LLM the MEMORY.md
-            # read/write tool even when a profile set memory_enabled: false,
-            # contaminating a memory-disabled profile (#54937 layer 2).
-            review_toolsets = ["skills"]
-            if review_agent._memory_enabled or review_agent._user_profile_enabled:
-                review_toolsets.insert(0, "memory")
            review_whitelist = {
                t["function"]["name"]
                for t in get_tool_definitions(
-                    enabled_toolsets=review_toolsets,
+                    enabled_toolsets=["memory", "skills"],
                    quiet_mode=True,
                )
            }
@@ -833,13 +739,6 @@ def _run_review_in_thread(
                    "{tool_name}. Only memory/skill tools are allowed."
                ),
            )
-            try:
-                from tools.skill_manager_tool import _reset_background_review_read_marks
-
-                _reset_background_review_read_marks()
-            except Exception:
-                pass
-
            try:
                # Routed to a different model -> replay a digest (cache is cold
                # on that model anyway, so minimise cold-written tokens). Same
@@ -885,29 +784,11 @@ def _run_review_in_thread(
        # the review agent inherits that history and would otherwise
        # re-surface stale "created"/"updated" messages from the prior
        # conversation as if they just happened (issue #14944).
-        #
-        # Wrapped in try/except: a buggy/legacy tool response shape
-        # (e.g. ``_change`` returned as a list instead of a dict, #59437)
-        # must NOT take down the whole review with an AttributeError,
-        # since the caller's outer except logs only "Background
-        # memory/skill review failed" and discards every successful
-        # action the fork DID complete before the crash. Coerce an
-        # exception into an empty actions list so the partial valid
-        # actions from earlier in the messages are returned instead.
-        try:
-            actions = summarize_background_review_actions(
-                review_messages,
-                messages_snapshot,
-                notification_mode=getattr(agent, "memory_notifications", "on"),
-            )
-        except Exception as e:
-            logger.warning(
-                "summarize_background_review_actions returned partial results "
-                "after exception (treating as empty); suppressing AttributeError "
-                "that previously aborted the entire review (#59437): %s",
-                e,
-            )
-            actions = []
+        actions = summarize_background_review_actions(
+            review_messages,
+            messages_snapshot,
+            notification_mode=getattr(agent, "memory_notifications", "on"),
+        )

        if actions:
            summary = " · ".join(dict.fromkeys(actions))
@@ -927,14 +808,16 @@ def _run_review_in_thread(
        logger.warning("Background memory/skill review failed: %s", e)
        agent._emit_auxiliary_failure("background review", e)
    finally:
-        # Safety-net cleanup for the exception path.  Normal completion already
-        # shut down inside the thread-scoped silence above.  Re-enter the
-        # thread-scoped silence here so teardown output (Honcho flush, Hindsight
-        # sync, background thread joins) stays quiet even on the exception path,
-        # without blanking other threads' streams.
+        # Safety-net cleanup for the exception path.  Normal
+        # completion already shut down inside redirect_stdout above.
+        # Re-open devnull here so any teardown output (Honcho flush,
+        # Hindsight sync, background thread joins) stays silent even
+        # on the exception path where redirect_stdout already exited.
        if review_agent is not None:
            try:
-                with thread_scoped_silence():
+                with open(os.devnull, "w", encoding="utf-8") as _fn, \
+                     contextlib.redirect_stdout(_fn), \
+                     contextlib.redirect_stderr(_fn):
                    try:
                        review_agent.shutdown_memory_provider()
                    except Exception:
@@ -528,19 +528,10 @@ def _convert_content_to_converse(content) -> List[Dict]:
                        mime_part = header[5:].split(";")[0]
                        if mime_part:
                            media_type = mime_part
-                    # Decode base64 to raw bytes — boto3 re-encodes at the
-                    # wire layer, so passing the base64 string directly
-                    # results in double-encoding and Bedrock rejects it with
-                    # "Failed to sanitize image".  Ref: #33317.
-                    import base64
-                    try:
-                        raw_bytes = base64.b64decode(data)
-                    except Exception:
-                        raw_bytes = data.encode("utf-8")
                    blocks.append({
                        "image": {
                            "format": media_type.split("/")[-1] if "/" in media_type else "jpeg",
-                            "source": {"bytes": raw_bytes},
+                            "source": {"bytes": data},
                        }
                    })
                else:
@@ -1,148 +0,0 @@
-"""Bounded reads of HTTP error response bodies.
-
-When a provider returns a non-OK status on a *streaming* request, Hermes reads
-the response body to build a useful diagnostic error. A bare ``response.read()``
-on a streaming httpx response is unbounded in two dangerous ways:
-
-1. A server can declare (or stream) an arbitrarily large body, so the read can
-   balloon memory.
-2. A server can open the body and then stall forever (no ``Content-Length``,
-   no further bytes), so the read hangs the agent indefinitely.
-
-Both are realistic against a misbehaving proxy, a hijacked endpoint, or a
-provider having a bad day. The diagnostic body is only ever shown to the user
-truncated to a few hundred characters, so reading megabytes — or blocking
-forever — buys nothing.
-
-``read_streaming_error_body`` bounds the read to a byte cap and enforces a
-hard wall-clock deadline, returning the decoded text snippet. Callers pass the
-returned text into their existing error builders instead of touching
-``response.text`` (which would be unbounded / would raise after a partial
-stream read).
-
-A subtlety the implementation must respect: ``httpx``'s ``iter_bytes()`` blocks
-*inside* the C/socket read while waiting for the next chunk. A wall-clock check
-placed only between yielded chunks cannot interrupt a server that opens the
-body and then stalls mid-chunk — control never returns to Python until httpx's
-own (often 30s+) read timeout fires. To guarantee a bounded stop regardless of
-socket behavior, the read runs on a daemon worker thread and the caller waits
-on it with a hard deadline; on timeout we close the response (which unblocks /
-cancels the read) and return whatever partial bytes were collected.
-
-Ported and adapted from openclaw/openclaw#95108 ("bound Anthropic error
-streams"), generalized to cover Hermes's three streaming error-body sites
-(native Gemini, Gemini Cloud Code, Antigravity Cloud Code).
-"""
-
-from __future__ import annotations
-
-import logging
-import threading
-from typing import List, Optional
-
-import httpx
-
-logger = logging.getLogger(__name__)
-
-# Defaults chosen to comfortably hold any real provider error envelope (Google
-# RPC error JSON, Anthropic error JSON) while rejecting pathological bodies.
-DEFAULT_ERROR_BODY_MAX_BYTES = 64 * 1024
-# Hard wall-clock deadline for the whole bounded read. A streaming error body
-# that does not finish within this window is abandoned and the connection is
-# closed; we keep whatever partial bytes arrived.
-DEFAULT_ERROR_BODY_TIMEOUT_S = 10.0
-
-
-def read_streaming_error_body(
-    response: httpx.Response,
-    *,
-    max_bytes: int = DEFAULT_ERROR_BODY_MAX_BYTES,
-    timeout_s: float = DEFAULT_ERROR_BODY_TIMEOUT_S,
-) -> str:
-    """Read a non-OK streaming response body with a byte cap and a hard deadline.
-
-    Returns the decoded body text (UTF-8, errors replaced), truncated to
-    ``max_bytes``. Never raises: any transport error, stall, or oversize
-    condition is swallowed and the best-effort partial text (or an empty
-    string) is returned, because this runs on the error path and must not
-    mask the original HTTP failure with a read error.
-
-    The byte cap protects against huge bodies; the wall-clock deadline (enforced
-    via a worker thread so it can interrupt a socket read that stalls mid-chunk)
-    protects against bodies that open and then hang.
-    """
-    chunks: List[bytes] = []
-    state = {"truncated": False}
-    done = threading.Event()
-
-    def _drain() -> None:
-        total = 0
-        try:
-            for chunk in response.iter_bytes():
-                if not chunk:
-                    continue
-                remaining = max_bytes - total
-                if remaining <= 0:
-                    state["truncated"] = True
-                    break
-                if len(chunk) > remaining:
-                    chunks.append(chunk[:remaining])
-                    total += remaining
-                    state["truncated"] = True
-                    break
-                chunks.append(chunk)
-                total += len(chunk)
-        except Exception as exc:  # noqa: BLE001 - error path must not raise
-            logger.debug("bounded error-body read failed: %s", exc)
-        finally:
-            done.set()
-
-    worker = threading.Thread(
-        target=_drain, name="bounded-error-body-read", daemon=True
-    )
-    worker.start()
-    finished = done.wait(timeout=timeout_s)
-
-    if not finished:
-        logger.debug(
-            "bounded error-body read: hard timeout after %.1fs (%d bytes so far)",
-            timeout_s,
-            sum(len(c) for c in chunks),
-        )
-        # Closing the response cancels the in-flight socket read, letting the
-        # worker thread unwind. We do not join (it is a daemon and may be
-        # blocked in C); the partial `chunks` collected so far are returned.
-        _safe_close(response)
-    else:
-        _safe_close(response)
-
-    if state["truncated"]:
-        logger.debug(
-            "bounded error-body read: capped at %d bytes (max=%d)",
-            sum(len(c) for c in chunks),
-            max_bytes,
-        )
-    return b"".join(chunks).decode("utf-8", errors="replace")
-
-
-def _safe_close(response: httpx.Response) -> None:
-    try:
-        response.close()
-    except Exception:  # noqa: BLE001
-        pass
-
-
-def read_error_body_or_default(
-    response: httpx.Response,
-    *,
-    max_bytes: int = DEFAULT_ERROR_BODY_MAX_BYTES,
-    timeout_s: float = DEFAULT_ERROR_BODY_TIMEOUT_S,
-) -> Optional[str]:
-    """Like ``read_streaming_error_body`` but returns ``None`` on empty body.
-
-    Convenience for callers that distinguish "no body" from "empty string".
-    """
-    text = read_streaming_error_body(
-        response, max_bytes=max_bytes, timeout_s=timeout_s
-    )
-    return text or None
@@ -288,13 +288,6 @@ _RESPONSES_BUILTIN_TOOL_TYPES = {

 _RESPONSE_MESSAGE_STATUSES = {"completed", "incomplete", "in_progress"}

-# The Responses API rejects input[].id longer than this with a non-retryable
-# HTTP 400 ("string too long"). Codex-issued assistant message ids are
-# server-assigned base64 blobs that can run 400+ chars, while Hermes-minted
-# ids (msg_...) stay well under this cap and are worth keeping for
-# prefix-cache hits. Drop only the oversized ones on replay.
-_MAX_RESPONSES_ITEM_ID_LENGTH = 64
-

 def _normalize_responses_message_status(value: Any, *, default: str = "completed") -> str:
    """Normalize a Responses assistant message status for replay.
@@ -314,7 +307,6 @@ def _chat_messages_to_responses_input(
    messages: List[Dict[str, Any]],
    *,
    is_xai_responses: bool = False,
-    is_github_responses: bool = False,
    replay_encrypted_reasoning: bool = True,
    current_issuer_kind: Optional[str] = None,
 ) -> List[Dict[str, Any]]:
@@ -339,16 +331,6 @@ def _chat_messages_to_responses_input(
    items from the conversation history and threads ``replay_enabled=False``
    through this converter so subsequent turns send no reasoning items.

-    ``is_github_responses`` drops the ``id`` field from replayed
-    ``codex_message_items`` regardless of length. The Copilot backend
-    (api.githubcopilot.com/responses) binds these ids to a specific
-    backend "connection" — credential-pool rotation, a gateway restart,
-    or routine load-balancer churn between turns all invalidate it — and
-    rejects a stale id with HTTP 401 "input item ID does not belong to
-    this connection" even for short ids (see #32716). ``phase``/
-    ``status``/``content`` are still replayed; only ``id`` is unsafe to
-    reuse across a Copilot connection.
-
    ``current_issuer_kind`` enables a per-item cross-issuer guard. The
    Responses API's ``encrypted_content`` blob is decryptable only by the
    endpoint that minted it — replaying a Codex-issued blob against xAI
@@ -481,14 +463,8 @@ def _chat_messages_to_responses_input(
                            "content": normalized_content_parts,
                        }
                        item_id = raw_item.get("id")
-                        if (
-                            not is_github_responses
-                            and isinstance(item_id, str)
-                            and item_id.strip()
-                        ):
-                            stripped_id = item_id.strip()
-                            if len(stripped_id) <= _MAX_RESPONSES_ITEM_ID_LENGTH:
-                                replay_item["id"] = stripped_id
+                        if isinstance(item_id, str) and item_id.strip():
+                            replay_item["id"] = item_id.strip()
                        phase = raw_item.get("phase")
                        if isinstance(phase, str) and phase.strip():
                            replay_item["phase"] = phase.strip()
@@ -600,11 +576,7 @@ def _chat_messages_to_responses_input(
 # Input preflight / validation
 # ---------------------------------------------------------------------------

-def _preflight_codex_input_items(
-    raw_items: Any,
-    *,
-    is_github_responses: bool = False,
-) -> List[Dict[str, Any]]:
+def _preflight_codex_input_items(raw_items: Any) -> List[Dict[str, Any]]:
    if not isinstance(raw_items, list):
        raise ValueError("Codex Responses input must be a list of input items.")

@@ -745,14 +717,8 @@ def _preflight_codex_input_items(
                "content": normalized_content,
            }
            item_id = item.get("id")
-            if (
-                not is_github_responses
-                and isinstance(item_id, str)
-                and item_id.strip()
-            ):
-                stripped_id = item_id.strip()
-                if len(stripped_id) <= _MAX_RESPONSES_ITEM_ID_LENGTH:
-                    normalized_item["id"] = stripped_id
+            if isinstance(item_id, str) and item_id.strip():
+                normalized_item["id"] = item_id.strip()
            phase = item.get("phase")
            if isinstance(phase, str) and phase.strip():
                normalized_item["phase"] = phase.strip()
@@ -824,7 +790,6 @@ def _preflight_codex_api_kwargs(
    api_kwargs: Any,
    *,
    allow_stream: bool = False,
-    is_github_responses: bool = False,
 ) -> Dict[str, Any]:
    if not isinstance(api_kwargs, dict):
        raise ValueError("Codex Responses request must be a dict.")
@@ -846,10 +811,7 @@ def _preflight_codex_api_kwargs(
        instructions = str(instructions)
    instructions = instructions.strip() or DEFAULT_AGENT_IDENTITY

-    normalized_input = _preflight_codex_input_items(
-        api_kwargs.get("input"),
-        is_github_responses=is_github_responses,
-    )
+    normalized_input = _preflight_codex_input_items(api_kwargs.get("input"))

    tools = api_kwargs.get("tools")
    normalized_tools = None
@@ -1118,22 +1080,6 @@ def _normalize_codex_response(
    differs from the one that minted the encrypted_content blob and drop
    the item instead of triggering HTTP 400 invalid_encrypted_content.
    """
-    response_status = getattr(response, "status", None)
-    if isinstance(response_status, str):
-        response_status = response_status.strip().lower()
-    else:
-        response_status = None
-
-    incomplete_details = getattr(response, "incomplete_details", None)
-    incomplete_reason = ""
-    if isinstance(incomplete_details, dict):
-        incomplete_reason = str(incomplete_details.get("reason") or "").strip().lower()
-    elif incomplete_details is not None:
-        incomplete_reason = str(getattr(incomplete_details, "reason", "") or "").strip().lower()
-    response_incomplete_content_filter = (
-        response_status == "incomplete" and incomplete_reason == "content_filter"
-    )
-
    output = getattr(response, "output", None)
    if not isinstance(output, list) or not output:
        # The Codex backend can return empty output when the answer was
@@ -1150,18 +1096,15 @@ def _normalize_codex_response(
                content=[SimpleNamespace(type="output_text", text=out_text.strip())],
            )]
            response.output = output
-        elif response_incomplete_content_filter:
-            # This is a deterministic provider safety block, not a partial
-            # answer. Synthesize an empty message so finish_reason below becomes
-            # content_filter and the conversation loop can fallback/surface it
-            # instead of burning three continuation attempts.
-            output = [SimpleNamespace(
-                type="message", role="assistant", status="completed", content=[]
-            )]
-            response.output = output
        else:
            raise RuntimeError("Responses API returned no output items")

+    response_status = getattr(response, "status", None)
+    if isinstance(response_status, str):
+        response_status = response_status.strip().lower()
+    else:
+        response_status = None
+
    if response_status in {"failed", "cancelled"}:
        error_obj = getattr(response, "error", None)
        error_msg = _format_responses_error(error_obj, response_status)
@@ -1223,28 +1166,15 @@ def _normalize_codex_response(
        if item_type == "message":
            item_phase = getattr(item, "phase", None)
            normalized_phase = None
-            is_commentary_phase = False
            if isinstance(item_phase, str):
                normalized_phase = item_phase.strip().lower()
                if normalized_phase in {"commentary", "analysis"}:
                    saw_commentary_phase = True
-                    is_commentary_phase = True
                elif normalized_phase in {"final_answer", "final"}:
                    saw_final_answer_phase = True
            message_text = _extract_responses_message_text(item)
            if message_text:
-                # Responses ``commentary``/``analysis`` phase text is mid-turn
-                # preamble/progress narration, never the turn's final answer
-                # (Codex CLI excludes it from last-message extraction; issues
-                # #24933 / #41293).  Keep it out of assistant content so it
-                # can't be concatenated into — or leak as — the final response,
-                # but surface it through the reasoning channel so the CLI/
-                # gateway display it like thinking text.  The exact message
-                # item is still preserved below for replay/cache continuity.
-                if is_commentary_phase:
-                    reasoning_parts.append(message_text)
-                else:
-                    content_parts.append(message_text)
+                content_parts.append(message_text)
                raw_message_item: Dict[str, Any] = {
                    "type": "message",
                    "role": "assistant",
@@ -1339,11 +1269,7 @@ def _normalize_codex_response(
            ))

    final_text = "\n".join([p for p in content_parts if p]).strip()
-    if (
-        not final_text
-        and hasattr(response, "output_text")
-        and not (saw_commentary_phase and not saw_final_answer_phase)
-    ):
+    if not final_text and hasattr(response, "output_text"):
        out_text = getattr(response, "output_text", "")
        if isinstance(out_text, str):
            final_text = out_text.strip()
@@ -1379,45 +1305,6 @@ def _normalize_codex_response(
        # so the model keeps its chain-of-thought on the retry.
        final_text = ""

-    # ── Reasoning-channel answer salvage (xAI grok) ──────────────
-    # grok-4.x on the xAI /v1/responses surface sometimes emits its final
-    # answer inside the reasoning item instead of as a ``message`` output
-    # item, marking where the answer starts with grok's internal
-    # ``<response>`` delimiter.  Without salvage, the reasoning-only rule
-    # below classifies the turn ``incomplete`` — and because reasoning
-    # items on this surface carry no ``encrypted_content``, the interim
-    # message replays as nothing, so every continuation request is
-    # byte-identical to the one that just failed.  The turn burns its 3
-    # retries and dies with "Codex response remained incomplete after 3
-    # continuation attempts" even though the answer was produced on the
-    # first attempt.  Observed live with grok-4.20 on xai-oauth
-    # (2026-07-13).  Promote the delimited tail to assistant content and
-    # keep the untagged prefix as thinking text.
-    if (
-        issuer_kind == "xai_responses"
-        and not final_text
-        and not tool_calls
-        and reasoning_parts
-    ):
-        joined_reasoning = "\n\n".join(reasoning_parts)
-        marker = joined_reasoning.rfind("<response>")
-        if marker != -1:
-            salvaged = joined_reasoning[marker + len("<response>"):]
-            closing = salvaged.find("</response>")
-            if closing != -1:
-                salvaged = salvaged[:closing]
-            salvaged = salvaged.strip()
-            if salvaged:
-                logger.warning(
-                    "xAI response delivered its final answer inside the "
-                    "reasoning channel (<response> delimiter); promoting "
-                    "%d chars to assistant content.",
-                    len(salvaged),
-                )
-                final_text = salvaged
-                reasoning_prefix = joined_reasoning[:marker].strip()
-                reasoning_parts = [reasoning_prefix] if reasoning_prefix else []
-
    assistant_message = SimpleNamespace(
        content=final_text,
        tool_calls=tool_calls,
@@ -1430,8 +1317,6 @@ def _normalize_codex_response(

    if tool_calls:
        finish_reason = "tool_calls"
-    elif response_incomplete_content_filter:
-        finish_reason = "content_filter"
    elif leaked_tool_call_text:
        finish_reason = "incomplete"
    elif saw_streaming_or_item_incomplete:
@@ -1440,28 +1325,12 @@ def _normalize_codex_response(
        finish_reason = "incomplete"
    elif (reasoning_items_raw or reasoning_parts or saw_reasoning_item) and not final_text:
        # Response contains only reasoning (encrypted thinking state and/or
-        # human-readable summary) with no visible content or tool calls.
-        #
-        # For the specially-handled backends (Codex, xAI, GitHub/Copilot),
-        # reasoning-only with status="completed" means "the model is still
-        # thinking and needs another turn" — treat it as incomplete so the
-        # Codex continuation path retries instead of falling into the
-        # empty-content retry loop.
-        #
-        # For all other backends (other:<base_url>, etc.), trust the provider's
-        # own response.status signal. When status == "completed" and no items
-        # are queued/in_progress/incomplete, reasoning alone is a valid final
-        # state — forcing "incomplete" causes multi-minute stalls as the
-        # continuation path re-issues calls (3 retries × up to 240s each).
-        # See https://github.com/NousResearch/hermes-agent/issues/64434
-        if response_status == "completed" and issuer_kind not in (
-            "codex_backend",
-            "xai_responses",
-            "github_responses",
-        ):
-            finish_reason = "stop"
-        else:
-            finish_reason = "incomplete"
+        # human-readable summary) with no visible content or tool calls. The
+        # model is still thinking and needs another turn to produce the actual
+        # answer. Marking this as "stop" would send it into the empty-content
+        # retry loop which burns retries then fails — treat it as incomplete so
+        # the Codex continuation path handles it correctly.
+        finish_reason = "incomplete"
    else:
        finish_reason = "stop"
    return assistant_message, finish_reason
@@ -16,16 +16,70 @@ compatibility.

 from __future__ import annotations

-import json
 import logging
 import os
 import time
 from types import SimpleNamespace
-from typing import Any, Callable, Dict, List
+from typing import Any, Dict, List

 logger = logging.getLogger(__name__)


+def _codex_note_to_tool_progress(note: dict) -> tuple[str, str, dict] | None:
+    """Map a Codex app-server ``item/started`` notification to a Hermes
+    tool-progress event ``(tool_name, preview, args)``.
+
+    The Codex app-server runtime processes ``item/started`` notifications for
+    command execution, file changes, and MCP/dynamic tool calls, but never
+    surfaced them as Hermes tool-progress events — so gateways (Telegram, etc.)
+    showed no verbose "running X" breadcrumbs on this route while every other
+    provider did (#38835). Returns None for items that aren't tool-shaped.
+    """
+    if not isinstance(note, dict) or note.get("method") != "item/started":
+        return None
+    params = note.get("params") or {}
+    item = params.get("item") or {}
+    if not isinstance(item, dict):
+        return None
+
+    item_type = item.get("type") or ""
+    if item_type == "commandExecution":
+        command = item.get("command") or ""
+        return "exec_command", command, {"command": command, "cwd": item.get("cwd") or ""}
+
+    if item_type == "fileChange":
+        changes = item.get("changes") or []
+        preview = "file changes"
+        if isinstance(changes, list) and changes:
+            paths = [
+                str(change.get("path"))
+                for change in changes
+                if isinstance(change, dict) and change.get("path")
+            ]
+            if paths:
+                preview = ", ".join(paths[:3])
+                if len(paths) > 3:
+                    preview += f", +{len(paths) - 3} more"
+        return "apply_patch", preview, {"changes": changes}
+
+    if item_type == "mcpToolCall":
+        server = item.get("server") or "mcp"
+        tool = item.get("tool") or "unknown"
+        args = item.get("arguments") or {}
+        if not isinstance(args, dict):
+            args = {"arguments": args}
+        return f"mcp.{server}.{tool}", tool, args
+
+    if item_type == "dynamicToolCall":
+        tool = item.get("tool") or "unknown"
+        args = item.get("arguments") or {}
+        if not isinstance(args, dict):
+            args = {"arguments": args}
+        return tool, tool, args
+
+    return None
+
+
 def _coerce_usage_int(value: Any) -> int:
    if isinstance(value, bool):
        return 0
@@ -59,15 +113,6 @@ def _record_codex_app_server_usage(agent, turn) -> dict[str, Any]:

    usage = getattr(turn, "token_usage_last", None)
    if not isinstance(usage, dict) or not usage:
-        compressor = getattr(agent, "context_compressor", None)
-        if (
-            compressor is not None
-            and getattr(compressor, "awaiting_real_usage_after_compression", False)
-        ):
-            # No usage means this turn cannot adjudicate the pending compaction.
-            # Consume the marker so a later unrelated reading is not charged to
-            # it and preflight deferral cannot stay latched indefinitely.
-            compressor.update_from_response({})
        if agent._session_db and agent.session_id:
            try:
                if not agent._session_db_created:
@@ -75,9 +120,6 @@ def _record_codex_app_server_usage(agent, turn) -> dict[str, Any]:
                agent._session_db.update_token_counts(
                    agent.session_id,
                    model=agent.model,
-                    billing_provider=agent.provider,
-                    billing_base_url=agent.base_url,
-                    billing_mode="subscription_included",
                    api_call_count=1,
                )
            except Exception as exc:
@@ -186,390 +228,6 @@ def _record_codex_app_server_usage(agent, turn) -> dict[str, Any]:
    }


-def _record_codex_app_server_compaction(
-    agent,
-    turn,
-    *,
-    approx_tokens: int | None = None,
-    force: bool = False,
-) -> bool:
-    """Record a Codex-native context compaction boundary in Hermes state.
-
-    The app-server owns the compacted thread context, so Hermes should not
-    rewrite local transcript rows here; state.db records the boundary via the
-    session event/usage counters while preserving the visible transcript.
-    """
-    if not force and not getattr(turn, "compacted", False):
-        return False
-
-    thread_id = getattr(turn, "thread_id", None) or ""
-    turn_id = getattr(turn, "turn_id", None) or ""
-    logger.info(
-        "codex app-server compaction observed: session=%s thread=%s turn=%s force=%s",
-        getattr(agent, "session_id", None) or "none",
-        thread_id,
-        turn_id,
-        force,
-    )
-    if not force:
-        try:
-            from agent.conversation_compression import COMPACTION_STATUS
-
-            agent._emit_status(COMPACTION_STATUS)
-        except Exception:
-            pass
-
-    compressor = getattr(agent, "context_compressor", None)
-    if compressor is not None:
-        compressor.compression_count = getattr(
-            compressor, "compression_count", 0
-        ) + 1
-        compressor.last_compression_rough_tokens = approx_tokens or 0
-        # The app server has already completed a real compaction boundary. Its
-        # usage update (when supplied) is therefore the same real-vs-real
-        # effectiveness verdict used by the normal compression path.
-        record_boundary = getattr(
-            type(compressor), "record_completed_compaction", None
-        )
-        if callable(record_boundary):
-            # Codex owns this summary. A prior Hermes deterministic-fallback
-            # flag must not leak into the native boundary's quality verdict.
-            record_boundary(compressor, used_fallback=False)
-        elif hasattr(compressor, "_verify_compaction_cleared_threshold"):
-            compressor._verify_compaction_cleared_threshold = True
-        if not getattr(turn, "token_usage_last", None):
-            compressor.last_prompt_tokens = -1
-            compressor.last_completion_tokens = 0
-            compressor.awaiting_real_usage_after_compression = True
-
-    agent._last_compaction_in_place = False
-    try:
-        if getattr(agent, "event_callback", None):
-            agent.event_callback(
-                "session:compress",
-                {
-                    "platform": getattr(agent, "platform", None) or "",
-                    "session_id": getattr(agent, "session_id", None) or "",
-                    "old_session_id": "",
-                    "in_place": False,
-                    "compression_count": getattr(
-                        compressor, "compression_count", 0
-                    )
-                    if compressor is not None
-                    else 0,
-                    "runtime": "codex_app_server",
-                    "thread_id": thread_id,
-                    "turn_id": turn_id,
-                },
-            )
-    except Exception:
-        logger.debug("event_callback error on codex session:compress", exc_info=True)
-
-    return True
-
-
-# ---------------------------------------------------------------------------
-# Codex app-server → Hermes UI bridge (#33200)
-#
-# The codex_app_server runtime hands the entire turn to a subprocess and
-# bypasses the normal Hermes tool loop. Without this bridge gateway
-# adapters (Discord, Telegram, TUI) never see live tool-progress bubbles
-# or interim assistant commentary while codex is working — the user just
-# stares at a quiet channel until the final answer lands. The bridge
-# translates raw codex JSON-RPC notifications into the same three agent
-# callbacks the standard runtime fires:
-#   - tool_progress_callback("tool.started"|"tool.completed", name, ...)
-#   - _fire_stream_delta(text) for streaming agentMessage chunks
-#   - _emit_interim_assistant_message({...}) for completed agentMessages
-# ---------------------------------------------------------------------------
-
-# Codex item types that map to a Hermes tool_call in the projector (and
-# therefore deserve a tool_progress bubble pair). The projector lives in
-# agent/transports/codex_event_projector.py — keep these in sync so the
-# tool name shown in the UI matches the name recorded in messages.
-# webSearch is codex's built-in web search tool — it has no projector
-# entry (codex handles it internally) but still deserves a bubble.
-_CODEX_TOOL_ITEM_TYPES = frozenset(
-    {"commandExecution", "fileChange", "mcpToolCall", "dynamicToolCall", "webSearch"}
-)
-
-# Internal MCP server that wraps Hermes' native tools for codex. When
-# codex calls back through it, the inner dispatch runs in a SEPARATE
-# hermes-tools-mcp-server subprocess that has no access to the parent
-# agent's tool_progress_callback — so the inner call can never surface
-# its own native progress event. The codex-level mcpToolCall event IS
-# the display event for those calls; we strip the mcp.hermes-tools.*
-# namespacing and emit the bare tool name (web_search, browser_navigate,
-# vision_analyze, ...) since the user thinks of these as Hermes tools,
-# not as MCP calls.
-_INTERNAL_MCP_SERVER = "hermes-tools"
-
-
-def _codex_item_to_tool_name(item: dict) -> str:
-    """Synthetic Hermes tool name for a codex item. Mirrors
-    CodexEventProjector so the progress bubble and the projected
-    tool_calls entry use the same identifier."""
-    item_type = item.get("type") or ""
-    if item_type == "commandExecution":
-        return "exec_command"
-    if item_type == "fileChange":
-        return "apply_patch"
-    if item_type == "mcpToolCall":
-        server = item.get("server") or "mcp"
-        tool = item.get("tool") or "unknown"
-        if server == _INTERNAL_MCP_SERVER:
-            return tool
-        return f"mcp.{server}.{tool}"
-    if item_type == "dynamicToolCall":
-        return item.get("tool") or "dynamic"
-    if item_type == "webSearch":
-        return "web_search"
-    return item_type or "unknown"
-
-
-def _codex_item_to_args(item: dict) -> dict:
-    """Args dict surfaced to tool_progress_callback("tool.started", ...).
-    Mirrors the projector's _project_command / _project_file_change /
-    _project_mcp_tool_call / _project_dynamic_tool_call shapes."""
-    item_type = item.get("type") or ""
-    if item_type == "commandExecution":
-        return {"command": item.get("command") or "",
-                "cwd": item.get("cwd") or ""}
-    if item_type == "fileChange":
-        return {"changes": [
-            {"kind": (c.get("kind") or {}).get("type") or "update",
-             "path": c.get("path") or ""}
-            for c in (item.get("changes") or []) if isinstance(c, dict)
-        ]}
-    if item_type in {"mcpToolCall", "dynamicToolCall"}:
-        args = item.get("arguments") or {}
-        return args if isinstance(args, dict) else {"arguments": args}
-    if item_type == "webSearch":
-        return {"query": item.get("query") or ""}
-    return {}
-
-
-def _codex_item_to_preview(item: dict) -> Any:
-    """Short human-readable preview for the tool.started bubble. Returns
-    None when no useful preview is available (Hermes' UI tolerates None)."""
-    item_type = item.get("type") or ""
-    if item_type == "commandExecution":
-        cmd = item.get("command") or ""
-        return cmd[:120] if cmd else None
-    if item_type == "fileChange":
-        paths = [c.get("path") for c in (item.get("changes") or [])
-                 if isinstance(c, dict) and c.get("path")]
-        if not paths:
-            return None
-        preview = ", ".join(paths[:3])
-        if len(paths) > 3:
-            preview += f", +{len(paths) - 3} more"
-        return preview
-    if item_type in {"mcpToolCall", "dynamicToolCall"}:
-        args = item.get("arguments") or {}
-        if not isinstance(args, dict) or not args:
-            return None
-        try:
-            return json.dumps(args, ensure_ascii=False)[:120]
-        except (TypeError, ValueError):
-            return None
-    if item_type == "webSearch":
-        query = item.get("query") or ""
-        return query[:120] if query else None
-    return None
-
-
-def _codex_item_completion_payload(item: dict) -> tuple[str, bool]:
-    """Return (result_text, is_error) for a completed codex tool item.
-    Mirrors the projector's tool-result content so the bubble shows the
-    same outcome string that ends up in the messages list."""
-    item_type = item.get("type") or ""
-    if item_type == "commandExecution":
-        out = item.get("aggregatedOutput") or ""
-        exit_code = item.get("exitCode")
-        is_error = bool(exit_code is not None and exit_code != 0)
-        if is_error:
-            out = f"[exit {exit_code}]\n{out}"
-        return out, is_error
-    if item_type == "fileChange":
-        status = item.get("status") or "unknown"
-        n = len(item.get("changes") or [])
-        return (
-            f"apply_patch status={status}, {n} change(s)",
-            status not in {"completed", "applied", "success"},
-        )
-    if item_type == "mcpToolCall":
-        error = item.get("error")
-        if error:
-            return (
-                f"[error] {json.dumps(error, ensure_ascii=False)[:1000]}",
-                True,
-            )
-        result = item.get("result")
-        return (
-            json.dumps(result, ensure_ascii=False)[:4000]
-            if result is not None else "",
-            False,
-        )
-    if item_type == "dynamicToolCall":
-        content_items = item.get("contentItems") or []
-        if isinstance(content_items, list) and content_items:
-            return (
-                json.dumps(content_items, ensure_ascii=False)[:4000],
-                not bool(item.get("success", True)),
-            )
-        success = item.get("success", True)
-        return f"success={success}", not bool(success)
-    return "", False
-
-
-def make_codex_app_server_event_bridge(agent) -> Callable[[dict], None]:
-    """Build an ``on_event`` callback that wires codex app-server JSON-RPC
-    notifications into Hermes' gateway UI callbacks.
-
-    Returns a single-argument callable suitable for
-    ``CodexAppServerSession(on_event=...)``.
-
-    Translation map:
-      * ``item/started`` for tool-shaped items → ``tool_progress_callback(
-        "tool.started", name, preview, args)``
-      * ``item/completed`` for tool-shaped items → ``tool_progress_callback(
-        "tool.completed", name, None, None, duration=..., is_error=...,
-        result=...)``
-      * ``item/agentMessage/delta`` → ``_fire_stream_delta(text)`` so chat
-        adapters can render the assistant's reply as it streams.
-      * ``item/reasoning/delta`` → ``_fire_reasoning_delta(text)``
-      * ``item/completed`` for ``agentMessage`` →
-        ``_emit_interim_assistant_message({"role": "assistant",
-        "content": text})``. The gateway's ``already_streamed`` check
-        dedupes against any text the stream-delta callback already
-        rendered for the same message.
-
-    All callback invocations are guarded — a buggy display callback must
-    not tear down the codex turn loop. Errors are logged at DEBUG so the
-    notification stream keeps flowing regardless.
-    """
-    # item_id -> (tool_name, args, started_wall_time). Populated on
-    # item/started and consumed on item/completed so duration is correct
-    # even when codex doesn't report durationMs.
-    started: dict[str, tuple[str, dict, float]] = {}
-
-    def _fire_tool_started(item: dict) -> None:
-        item_id = item.get("id") or ""
-        name = _codex_item_to_tool_name(item)
-        args = _codex_item_to_args(item)
-        if item_id:
-            started[item_id] = (name, args, time.monotonic())
-        cb = getattr(agent, "tool_progress_callback", None)
-        if cb is None:
-            return
-        try:
-            cb("tool.started", name, _codex_item_to_preview(item), args)
-        except Exception:
-            logger.debug(
-                "tool_progress_callback raised on tool.started for %s",
-                name, exc_info=True,
-            )
-
-    def _fire_tool_completed(item: dict) -> None:
-        item_id = item.get("id") or ""
-        name = _codex_item_to_tool_name(item)
-        prior = started.pop(item_id, None)
-        # Prefer codex's own durationMs when present so the bubble shows
-        # exact tool wall-time; fall back to our started timestamp; fall
-        # back to None if we never saw an item/started (some codex
-        # versions only emit completed for fast items).
-        duration: Any = None
-        codex_ms = item.get("durationMs")
-        if isinstance(codex_ms, (int, float)) and codex_ms >= 0:
-            duration = codex_ms / 1000.0
-        elif prior is not None:
-            duration = time.monotonic() - prior[2]
-        result, is_error = _codex_item_completion_payload(item)
-        cb = getattr(agent, "tool_progress_callback", None)
-        if cb is None:
-            return
-        try:
-            cb("tool.completed", name, None, None,
-               duration=duration, is_error=is_error, result=result)
-        except Exception:
-            logger.debug(
-                "tool_progress_callback raised on tool.completed for %s",
-                name, exc_info=True,
-            )
-
-    def _fire_text_delta(params: dict) -> None:
-        text = params.get("delta") or params.get("text") or ""
-        if not isinstance(text, str) or not text:
-            return
-        fn = getattr(agent, "_fire_stream_delta", None)
-        if fn is None:
-            return
-        try:
-            fn(text)
-        except Exception:
-            logger.debug("_fire_stream_delta raised", exc_info=True)
-
-    def _fire_reasoning_delta(params: dict) -> None:
-        text = params.get("delta") or params.get("text") or ""
-        if not isinstance(text, str) or not text:
-            return
-        fn = getattr(agent, "_fire_reasoning_delta", None)
-        if fn is None:
-            return
-        try:
-            fn(text)
-        except Exception:
-            logger.debug("_fire_reasoning_delta raised", exc_info=True)
-
-    def _fire_agent_message_completed(item: dict) -> None:
-        text = item.get("text") or ""
-        if not isinstance(text, str) or not text.strip():
-            return
-        # display.show_commentary=false — mid-turn narration stays off the
-        # visible interim path on this runtime too (same contract as the
-        # codex_responses commentary channel).
-        if not getattr(agent, "show_commentary", True):
-            return
-        emit = getattr(agent, "_emit_interim_assistant_message", None)
-        if emit is None:
-            return
-        try:
-            emit({"role": "assistant", "content": text})
-        except Exception:
-            logger.debug(
-                "_emit_interim_assistant_message raised", exc_info=True,
-            )
-
-    def on_event(note: dict) -> None:
-        if not isinstance(note, dict):
-            return
-        method = note.get("method") or ""
-        params = note.get("params") or {}
-        if not isinstance(params, dict):
-            params = {}
-        if method == "item/agentMessage/delta":
-            _fire_text_delta(params)
-            return
-        if method == "item/reasoning/delta":
-            _fire_reasoning_delta(params)
-            return
-        item = params.get("item")
-        if not isinstance(item, dict):
-            return
-        item_type = item.get("type") or ""
-        if method == "item/started" and item_type in _CODEX_TOOL_ITEM_TYPES:
-            _fire_tool_started(item)
-            return
-        if method == "item/completed":
-            if item_type in _CODEX_TOOL_ITEM_TYPES:
-                _fire_tool_completed(item)
-            elif item_type == "agentMessage":
-                _fire_agent_message_completed(item)
-
-    return on_event
-
-
 def run_codex_app_server_turn(
    agent,
    *,
@@ -586,10 +244,7 @@ def run_codex_app_server_turn(
    Called from run_conversation() when agent.api_mode == "codex_app_server".
    Returns the same dict shape as the chat_completions path.
    """
-    from agent.transports.codex_app_server_session import (
-        CodexAppServerSession,
-        _ServerRequestRouting,
-    )
+    from agent.transports.codex_app_server_session import CodexAppServerSession

    # Lazy session: one CodexAppServerSession per AIAgent instance.
    # Spawned on first turn, reused across turns, closed at AIAgent
@@ -607,42 +262,26 @@ def run_codex_app_server_turn(
        except Exception:
            approval_callback = None

-        # Gateway / cron contexts have no UI to surface codex's approval
-        # requests through, so codex app-server exec / apply_patch requests
-        # fail closed (silently decline) by default. When the user has
-        # explicitly opted out of Hermes approvals — via `approvals.mode: off`
-        # in config, the /yolo session toggle, or --yolo / HERMES_YOLO_MODE —
-        # honor that and let codex's own sandbox permission profile
-        # (~/.codex/config.toml) be the policy gate instead of double-gating
-        # with a missing Hermes UI. Defaults (manual/smart/unset) preserve the
-        # current fail-closed behavior — this is a no-op for those users.
-        auto_approve_requests = False
-        try:
-            from tools.approval import is_approval_bypass_active
+        def _on_codex_event(note: dict) -> None:
+            # Bridge Codex app-server item/started notifications to Hermes
+            # tool-progress so gateways show verbose "running X" breadcrumbs
+            # on this route too (#38835).
+            progress_callback = getattr(agent, "tool_progress_callback", None)
+            if progress_callback is None:
+                return
+            mapped = _codex_note_to_tool_progress(note)
+            if mapped is None:
+                return
+            tool_name, preview, args = mapped
+            try:
+                progress_callback("tool.started", tool_name, preview, args)
+            except Exception:
+                logger.debug("codex tool-progress callback raised", exc_info=True)

-            auto_approve_requests = is_approval_bypass_active()
-        except Exception:
-            logger.debug(
-                "codex app-server: approval-bypass lookup failed; "
-                "keeping fail-closed default",
-                exc_info=True,
-            )
-
-        # Bridge codex JSON-RPC notifications (item/started, item/completed,
-        # item/agentMessage/delta, ...) into Hermes' gateway UI callbacks
-        # (tool_progress_callback, _fire_stream_delta,
-        # _emit_interim_assistant_message). Without this, Discord/Telegram
-        # users see no live tool-progress or interim commentary while
-        # codex_app_server is running — only the final answer (#33200).
-        # Supersedes the narrower item/started-only bridge from #38835.
        agent._codex_session = CodexAppServerSession(
            cwd=cwd,
            approval_callback=approval_callback,
-            request_routing=_ServerRequestRouting(
-                auto_approve_exec=auto_approve_requests,
-                auto_approve_apply_patch=auto_approve_requests,
-            ),
-            on_event=make_codex_app_server_event_bridge(agent),
+            on_event=_on_codex_event,
        )

    # NOTE: the user message is ALREADY appended to messages by the
@@ -694,28 +333,6 @@ def run_codex_app_server_turn(
    if turn.projected_messages:
        messages.extend(turn.projected_messages)

-        # Persist the newly-projected assistant/tool messages ourselves.
-        # This path is an early return that bypasses conversation_loop, whose
-        # normal per-step _persist_session() calls would otherwise flush them.
-        # The inbound user turn was already flushed at turn start
-        # (turn_context.py _persist_session), and _flush_messages_to_session_db
-        # is idempotent via the intrinsic _DB_PERSISTED_MARKER — so this writes
-        # ONLY the new codex projected rows and does NOT re-write the user turn.
-        # Keeping the agent as the sole persister lets us return
-        # agent_persisted=True below, so the gateway skips its own DB write and
-        # we avoid the #860/#42039 duplicate user-message write (append_message
-        # is a raw INSERT with no dedup, so a gateway re-write would duplicate
-        # the already-flushed user turn). See gateway/run.py agent_persisted.
-        if getattr(agent, "_session_db", None) is not None:
-            try:
-                agent._flush_messages_to_session_db(messages)
-            except Exception:
-                logger.debug(
-                    "codex app-server projected-message flush failed",
-                    exc_info=True,
-                )
-
-
    # Counter ticks for the agent-improvement loop.
    # _turns_since_memory and _user_turn_count are ALREADY incremented
    # in the run_conversation() pre-loop block (lines ~11793-11817) so we
@@ -726,7 +343,6 @@ def run_codex_app_server_turn(
    agent._iters_since_skill = (
        getattr(agent, "_iters_since_skill", 0) + turn.tool_iterations
    )
-    _record_codex_app_server_compaction(agent, turn)
    usage_result = _record_codex_app_server_usage(agent, turn)
    api_calls = 1

@@ -778,18 +394,6 @@ def run_codex_app_server_turn(
        "completed": not turn.interrupted and turn.error is None,
        "partial": turn.interrupted or turn.error is not None,
        "error": turn.error,
-        # The codex app-server runtime IS an early-return path that bypasses
-        # conversation_loop, but we flush the projected assistant/tool messages
-        # ourselves above (see the _flush_messages_to_session_db call after
-        # messages.extend). The inbound user turn was already flushed at turn
-        # start (turn_context._persist_session) and the flush dedups via
-        # _DB_PERSISTED_MARKER, so state.db ends up with each real message
-        # exactly once and session_search / conversation-distill see the full
-        # gateway conversation. Report agent_persisted=True so the gateway
-        # skips its own append_to_transcript DB write — writing again there
-        # would re-INSERT the already-flushed user turn (append_message has no
-        # dedup), reintroducing the #860 / #42039 duplicate-write bug.
-        "agent_persisted": True,
        "codex_thread_id": turn.thread_id,
        "codex_turn_id": turn.turn_id,
        **usage_result,
@@ -834,48 +438,18 @@ def _event_field(event: Any, name: str, default: Any = None) -> Any:
    return value if value is not None else default


-def _item_field(item: Any, name: str, default: Any = None) -> Any:
-    """Field access for nested Response items (attr-style SDK object or dict)."""
-    value = getattr(item, name, None)
-    if value is None and isinstance(item, dict):
-        value = item.get(name, default)
-    return value if value is not None else default
-
-
 def _raise_stream_error(event: Any) -> None:
    """Raise a ``_StreamErrorEvent`` from a ``type=error`` SSE frame.

-    The Responses spec puts the failure details at the top level of the
-    frame (``{"type": "error", "code": ..., "message": ..., "param": ...}``),
-    but the official OpenAI SDK and several OpenAI-compatible proxies wrap
-    them in an HTTP-style nested envelope instead
-    (``{"type": "error", "error": {"code": ..., "message": ..., "param": ...}}``).
-    Read the top-level fields first, then fall back to the nested envelope so
-    the error classifier sees the provider's real code/message (rate-limit vs
-    context-overflow vs entitlement) rather than the generic placeholder.
-    Port of anomalyco/opencode#36130.
-
    Imported lazily so this module stays importable from places that don't
    pull in ``run_agent`` (e.g. plugin code, doc tools).
    """
    from run_agent import _StreamErrorEvent
-
-    nested = _event_field(event, "error")
-
-    def _error_field(name: str) -> Any:
-        value = _event_field(event, name)
-        if value is None and nested is not None:
-            value = _item_field(nested, name)
-        return value
-
-    raw_message = _error_field("message")
-    if raw_message is not None and not isinstance(raw_message, str):
-        raw_message = str(raw_message)
-    message = (raw_message or "stream emitted error event").strip() or "stream emitted error event"
+    message = (_event_field(event, "message", "") or "stream emitted error event").strip()
    raise _StreamErrorEvent(
        message,
-        code=_error_field("code"),
-        param=_error_field("param"),
+        code=_event_field(event, "code"),
+        param=_event_field(event, "param"),
    )


@@ -885,7 +459,6 @@ def _consume_codex_event_stream(
    model: str,
    on_text_delta=None,
    on_reasoning_delta=None,
-    on_commentary_message=None,
    on_first_delta=None,
    on_event=None,
    interrupt_check=None,
@@ -917,11 +490,7 @@ def _consume_codex_event_stream(
    * ``on_text_delta(str)`` — fires per ``response.output_text.delta``, suppressed
      once a function_call event is seen (so tool-call turns don't bleed text
      into the chat).
-    * ``on_reasoning_delta(str)`` — fires per ``response.reasoning.*.delta`` and
-      ``phase=analysis`` message deltas. When no dedicated commentary callback
-      is supplied, commentary also uses this legacy fallback.
-    * ``on_commentary_message(str)`` — fires once per completed
-      ``phase=commentary`` message, before any following tool item executes.
+    * ``on_reasoning_delta(str)`` — fires per ``response.reasoning.*.delta``.
    * ``on_first_delta()`` — one-shot, fires on the first text delta only.
    * ``on_event(event)`` — fires for every event before any other processing.
      Used for watchdog activity, debug logging, anything wire-shape-agnostic.
@@ -931,8 +500,6 @@ def _consume_codex_event_stream(
    collected_text_deltas: List[str] = []
    has_tool_calls = False
    first_delta_fired = False
-    active_message_phase: str | None = None
-    commentary_text_deltas: List[str] = []
    terminal_status: str = "completed"
    terminal_usage: Any = None
    terminal_response_id: str = None
@@ -966,43 +533,9 @@ def _consume_codex_event_stream(
        if event_type == "error":
            _raise_stream_error(event)

-        # Track the phase of the active streamed message item.  Codex/Harmony
-        # ``commentary``/``analysis`` text is mid-turn preamble/progress
-        # narration, never the final answer.  We still collect completed output
-        # items for replay, but route those deltas to the reasoning callback so
-        # they display like thinking text instead of assistant content.
-        if event_type == "response.output_item.added":
-            item = _event_field(event, "item")
-            item_type = _item_field(item, "type", "")
-            if item_type == "message":
-                phase = _item_field(item, "phase", None)
-                active_message_phase = phase.strip().lower() if isinstance(phase, str) else None
-                if active_message_phase == "commentary":
-                    commentary_text_deltas = []
-            else:
-                active_message_phase = None
-            if "function_call" in str(item_type):
-                has_tool_calls = True
-            continue
-
        if "output_text.delta" in event_type or event_type == "response.output_text.delta":
            delta_text = _event_field(event, "delta", "")
-            if delta_text and active_message_phase == "commentary":
-                commentary_text_deltas.append(delta_text)
-                # Preserve CLI/backward compatibility when no first-class
-                # commentary consumer is installed.
-                if on_commentary_message is None and on_reasoning_delta is not None:
-                    try:
-                        on_reasoning_delta(delta_text)
-                    except Exception:
-                        logger.debug("Codex stream on_reasoning_delta raised", exc_info=True)
-            elif delta_text and active_message_phase == "analysis":
-                if on_reasoning_delta is not None:
-                    try:
-                        on_reasoning_delta(delta_text)
-                    except Exception:
-                        logger.debug("Codex stream on_reasoning_delta raised", exc_info=True)
-            elif delta_text:
+            if delta_text:
                collected_text_deltas.append(delta_text)
                if not has_tool_calls:
                    if not first_delta_fired:
@@ -1036,27 +569,6 @@ def _consume_codex_event_stream(
            done_item = _event_field(event, "item")
            if done_item is not None:
                collected_output_items.append(done_item)
-                done_phase = _item_field(done_item, "phase", None)
-                done_phase = done_phase.strip().lower() if isinstance(done_phase, str) else None
-                if done_phase == "commentary" and on_commentary_message is not None:
-                    commentary_text = "".join(commentary_text_deltas).strip()
-                    if not commentary_text:
-                        content_parts = _item_field(done_item, "content", [])
-                        if isinstance(content_parts, list):
-                            commentary_text = "".join(
-                                str(_item_field(part, "text", "") or "")
-                                for part in content_parts
-                                if _item_field(part, "type", "") == "output_text"
-                            ).strip()
-                    if commentary_text:
-                        try:
-                            on_commentary_message(commentary_text)
-                        except Exception:
-                            logger.debug(
-                                "Codex stream on_commentary_message raised",
-                                exc_info=True,
-                            )
-                    commentary_text_deltas = []
            continue

        if event_type in _TERMINAL_EVENT_TYPES:
@@ -1157,14 +669,14 @@ def run_codex_stream(agent, api_kwargs: dict, client: Any = None, on_first_delta
    def _on_reasoning_delta(text: str) -> None:
        agent._fire_reasoning_delta(text)

-    def _on_commentary_message(text: str) -> None:
-        agent._fire_streamed_codex_commentary(text)
-
    def _on_event(event: Any) -> None:
        # TTFB watchdog and activity touch — runs once per SSE event.
        agent._codex_stream_last_event_ts = time.time()
        agent._touch_activity("receiving stream response")

+    def _interrupt_check() -> bool:
+        return bool(agent._interrupt_requested)
+
    for attempt in range(max_stream_retries + 1):
        if agent._interrupt_requested:
            raise InterruptedError("Agent interrupted before Codex stream retry")
@@ -1184,27 +696,6 @@ def run_codex_stream(agent, api_kwargs: dict, client: Any = None, on_first_delta
                continue
            raise

-        # Claim the delta sink for THIS attempt (#65991) — parity with the
-        # chat_completions/anthropic/bedrock paths. If a prior attempt's
-        # stream is somehow still alive, this claim supersedes it so its
-        # late deltas are fenced out of the turn; conversely, a newer
-        # attempt supersedes us and the interrupt_check below stops our
-        # consumption immediately.
-        _writer_token = agent._claim_stream_writer()
-
-        def _interrupt_or_superseded(_tok=_writer_token) -> bool:
-            if agent._interrupt_requested:
-                return True
-            if not agent._stream_writer_is_current(_tok):
-                logger.warning(
-                    "Codex streaming attempt superseded by a newer stream; "
-                    "stopping consumption to preserve the single-writer "
-                    "invariant (model=%s).",
-                    api_kwargs.get("model", "unknown"),
-                )
-                return True
-            return False
-
        try:
            # Compatibility: some mocks/providers return a concrete response
            # instead of an iterable.  Pass it straight through.
@@ -1217,17 +708,9 @@ def run_codex_stream(agent, api_kwargs: dict, client: Any = None, on_first_delta
                    model=api_kwargs.get("model"),
                    on_text_delta=_on_text_delta,
                    on_reasoning_delta=_on_reasoning_delta,
-                    on_commentary_message=(
-                        _on_commentary_message
-                        if (
-                            getattr(agent, "interim_assistant_callback", None) is not None
-                            and getattr(agent, "show_commentary", True)
-                        )
-                        else None
-                    ),
                    on_first_delta=on_first_delta,
                    on_event=_on_event,
-                    interrupt_check=_interrupt_or_superseded,
+                    interrupt_check=_interrupt_check,
                )
            except (_httpx.RemoteProtocolError, _httpx.ReadTimeout, _httpx.ConnectError, ConnectionError) as exc:
                if attempt < max_stream_retries:
@@ -1276,5 +759,4 @@ __all__ = [
    "run_codex_stream",
    "run_codex_create_stream_fallback",
    "_consume_codex_event_stream",
-    "make_codex_app_server_event_bridge",
 ]
@@ -56,7 +56,6 @@ import logging
 import os
 import re
 import subprocess
-import tempfile
 from dataclasses import dataclass
 from pathlib import Path
 from typing import Any, Optional
@@ -413,18 +412,10 @@ def _marker_root(cwd: Path) -> Optional[Path]:
    """
    current = cwd.resolve()
    home = _home()
-    # Shared world-writable temp roots are never project roots: a stray
-    # manifest in /tmp (left by any process) must not flip every session
-    # whose cwd lives under the temp dir into the coding posture. Same
-    # reasoning as the $HOME skip below.
-    try:
-        temp_root = Path(tempfile.gettempdir()).resolve()
-    except Exception:
-        temp_root = None
    for depth, parent in enumerate([current, *current.parents]):
        if depth > 6:
            break
-        if parent == home or (temp_root is not None and parent == temp_root):
+        if parent == home:
            continue
        for marker in _PROJECT_MARKERS:
            if (parent / marker).exists():
@@ -194,17 +194,12 @@ class ContextEngine(ABC):

        Default returns the standard fields run_agent.py expects.
        """
-        # Clamp the -1 "compression just ran, awaiting real usage" sentinel
-        # (set by conversation_compression) to 0 so status readers don't see a
-        # raw -1 or a negative usage_percent on the transitional turn. Mirrors
-        # the CLI/gateway status-bar paths (cli.py, tui_gateway/server.py).
-        last_prompt = self.last_prompt_tokens if self.last_prompt_tokens > 0 else 0
        return {
-            "last_prompt_tokens": last_prompt,
+            "last_prompt_tokens": self.last_prompt_tokens,
            "threshold_tokens": self.threshold_tokens,
            "context_length": self.context_length,
            "usage_percent": (
-                min(100, last_prompt / self.context_length * 100)
+                min(100, self.last_prompt_tokens / self.context_length * 100)
                if self.context_length else 0
            ),
            "compression_count": self.compression_count,
@@ -152,24 +152,13 @@ async def preprocess_context_references_async(
    blocks: list[str] = []
    injected_tokens = 0

-    # Expand all references concurrently. Each _expand_reference is independent
-    # (no shared state during expansion) — a message with several @url: refs
-    # would otherwise pay one full web_extract round-trip per ref in series.
-    # gather preserves positional order, so we reassemble warnings/blocks in the
-    # original ref order exactly as the prior serial loop did; the token-budget
-    # check below is unchanged (it runs once, after all refs are expanded).
-    expanded = await asyncio.gather(
-        *(
-            _expand_reference(
-                ref,
-                cwd_path,
-                url_fetcher=url_fetcher,
-                allowed_root=allowed_root_path,
-            )
-            for ref in refs
+    for ref in refs:
+        warning, block = await _expand_reference(
+            ref,
+            cwd_path,
+            url_fetcher=url_fetcher,
+            allowed_root=allowed_root_path,
        )
-    )
-    for warning, block in expanded:
        if warning:
            warnings.append(warning)
        if block:
@@ -381,37 +370,6 @@ def _ensure_reference_path_allowed(path: Path) -> None:
            continue
        raise ValueError("path is a sensitive credential or internal Hermes path and cannot be attached")

-    # Anchor to the canonical read deny-list (agent/file_safety.get_read_block_error),
-    # the single source of truth used by the file/terminal read path. The narrow
-    # list above predates that guard and never caught the real credential stores:
-    # provider keys (auth.json), Anthropic OAuth tokens (.anthropic_oauth.json),
-    # MCP OAuth material (mcp-tokens/), webhook HMAC secrets, and project-local
-    # .env files. That gap matters because the gateway feeds UNTRUSTED remote
-    # message text into reference expansion, so `@file:~/.hermes/auth.json` from a
-    # chat peer would otherwise read the operator's keys straight into context.
-    # Routing through the canonical guard closes the gap today and keeps this path
-    # protected automatically whenever that deny-list grows.
-    try:
-        from agent.file_safety import get_read_block_error
-
-        if get_read_block_error(str(path)) is not None:
-            raise ValueError(
-                "path is a sensitive credential or internal Hermes path and cannot be attached"
-            )
-    except ValueError:
-        raise
-    except Exception:
-        # Fail CLOSED on the security path. This guard exists specifically to
-        # cover credential stores the narrow list above misses (auth.json,
-        # .anthropic_oauth.json, mcp-tokens/, ...). If the canonical lookup
-        # ever fails, silently falling through would re-open that exact hole —
-        # the gateway feeds untrusted remote text here, so a probe could then
-        # attach the operator's keys. Refuse instead: a spurious block on a
-        # legitimate file is a recoverable annoyance; a leaked credential is not.
-        raise ValueError(
-            "path could not be verified against the credential deny-list and cannot be attached"
-        )
-

 def _strip_trailing_punctuation(value: str) -> str:
    stripped = value.rstrip(TRAILING_PUNCTUATION)
@@ -26,7 +26,7 @@ from openai.types.chat.chat_completion_message_tool_call import (
    Function,
 )

-from agent.file_safety import get_read_block_error, get_write_denied_error
+from agent.file_safety import get_read_block_error, is_write_denied
 from agent.redact import redact_sensitive_text
 from tools.environments.local import hermes_subprocess_env

@@ -727,9 +727,10 @@ class CopilotACPClient:
        elif method == "fs/write_text_file":
            try:
                path = _ensure_path_within_cwd(str(params.get("path") or ""), cwd)
-                denied = get_write_denied_error(str(path))
-                if denied:
-                    raise PermissionError(denied)
+                if is_write_denied(str(path)):
+                    raise PermissionError(
+                        f"Write denied: '{path}' is a protected system/credential file."
+                    )
                path.parent.mkdir(parents=True, exist_ok=True)
                path.write_text(str(params.get("content") or ""))
                response = {
@@ -22,7 +22,7 @@ _PERSISTABLE_PROVIDER_SOURCES = frozenset({
    ("minimax-oauth", "oauth"),
    ("nous", "device_code"),
    ("openai-codex", "device_code"),
-    ("xai-oauth", "device_code"),
+    ("xai-oauth", "loopback_pkce"),
 })

 _SAFE_SECRETISH_METADATA_KEYS = frozenset({
@@ -82,7 +82,7 @@ _TERMINAL_AUTH_REASONS = frozenset({
 # without losing recoverability — the user always has the option to re-add
 # via ``hermes auth add``.
 #
-# Singleton-seeded entries (``device_code``, ``claude_code``)
+# Singleton-seeded entries (``device_code``, ``loopback_pkce``, ``claude_code``)
 # are NOT pruned because ``_seed_from_singletons`` would just re-create them
 # on the next ``load_pool()`` with the same stale singleton tokens, defeating
 # the cleanup.  They remain in the pool marked DEAD until an explicit re-auth
@@ -114,20 +114,6 @@ EXHAUSTED_TTL_401_SECONDS = 5 * 60           # 5 minutes
 EXHAUSTED_TTL_429_SECONDS = 60 * 60          # 1 hour
 EXHAUSTED_TTL_DEFAULT_SECONDS = 60 * 60      # 1 hour

-# Throttle window for the "no available entries" INFO line. Credential
-# selection runs on a hot path (every model call, plus auxiliary tasks like
-# compression/moa/titles), so when a pool is empty or fully exhausted the
-# un-throttled log fires on *every* selection. On Windows several Hermes
-# processes share one rotating log guarded by concurrent-log-handler's
-# cross-process lock; that per-selection volume storms the lock
-# (``RuntimeError: Cannot acquire lock after 20 attempts``), pegs a core, and
-# stalls the asyncio event loop long enough to fail the Desktop backend
-# readiness handshake ("Timed out connecting to Hermes backend after
-# 15000ms"). Logging the condition at most once per window preserves the
-# signal while removing the storm — same class of fix as the warn-once
-# dedup in #58265.
-NO_AVAILABLE_ENTRIES_LOG_THROTTLE_SECONDS = 60.0
-
 # Pool key prefix for custom OpenAI-compatible endpoints.
 # Custom endpoints all share provider='custom' but are keyed by their
 # custom_providers name: 'custom:<normalized_name>'.
@@ -142,17 +128,6 @@ _EXTRA_KEYS = frozenset({
 })


-def _normalize_pool_auth_type(provider: str, token: Any, auth_type: Any) -> str:
-    """Infer pool auth metadata for token formats with one unambiguous meaning."""
-    if (
-        provider == "anthropic"
-        and isinstance(token, str)
-        and token.startswith("sk-ant-oat")
-    ):
-        return AUTH_TYPE_OAUTH
-    return str(auth_type or AUTH_TYPE_API_KEY)
-
-
@dataclass
 class PooledCredential:
    provider: str
@@ -182,11 +157,6 @@ class PooledCredential:
    def __post_init__(self):
        if self.extra is None:
            self.extra = {}
-        self.auth_type = _normalize_pool_auth_type(
-            self.provider,
-            self.access_token,
-            self.auth_type,
-        )

    def __getattr__(self, name: str):
        if name in _EXTRA_KEYS:
@@ -475,44 +445,6 @@ def get_pool_strategy(provider: str) -> str:
    return STRATEGY_FILL_FIRST


-def credential_pool_matches_provider(
-    pool_or_provider: Any,
-    provider: Optional[str],
-    *,
-    base_url: Optional[str] = None,
-) -> bool:
-    """Return whether a pool belongs to the requested runtime provider.
-
-    Named custom endpoints intentionally use two identities: the live agent is
-    ``custom`` while its pool is keyed ``custom:<name>``. Accept that pair only
-    when the runtime base URL resolves to the exact same custom pool key.
-    Empty string identities fail closed. Legacy pool adapters without a
-    ``provider`` attribute remain compatible; production pools are scoped.
-    """
-    raw_pool_provider = getattr(pool_or_provider, "provider", None)
-    if raw_pool_provider is None:
-        if isinstance(pool_or_provider, str):
-            raw_pool_provider = pool_or_provider
-        else:
-            # Backward compatibility for lightweight/unscoped pool adapters.
-            # Production CredentialPool instances always carry ``provider``;
-            # old plugins and tests may expose only select()/has_credentials().
-            return True
-    pool_provider = str(raw_pool_provider or "").strip().lower()
-    provider_norm = str(provider or "").strip().lower()
-    if not pool_provider or not provider_norm:
-        return False
-    if pool_provider == provider_norm:
-        return True
-    if provider_norm != "custom" or not pool_provider.startswith(CUSTOM_POOL_PREFIX):
-        return False
-    try:
-        matched_pool = get_custom_provider_pool_key(base_url or "")
-    except Exception:
-        return False
-    return str(matched_pool or "").strip().lower() == pool_provider
-
-
 DEFAULT_MAX_CONCURRENT_PER_CREDENTIAL = 1


@@ -557,12 +489,14 @@ def _write_through_provider_state_to_global_root(
            except Exception:
                return
    try:
-        auth_mod._persist_provider_state_to_store(
-            provider_id,
-            state,
-            global_path,
-            set_active=False,
-        )
+        if global_path.exists():
+            global_store = _load_auth_store(global_path)
+        else:
+            global_store = {}
+        if not isinstance(global_store, dict):
+            return
+        _store_provider_state(global_store, provider_id, dict(state), set_active=False)
+        auth_mod._save_auth_store(global_store, global_path)
    except Exception as exc:  # pragma: no cover - best effort
        logger.debug(
            "%s pool refresh: write-through to global root failed: %s",
@@ -580,12 +514,6 @@ class CredentialPool:
        self._lock = threading.Lock()
        self._active_leases: Dict[str, int] = {}
        self._max_concurrent = DEFAULT_MAX_CONCURRENT_PER_CREDENTIAL
-        # Monotonic timestamp of the last "no available entries" log, used to
-        # throttle that message so an empty/exhausted pool cannot storm the
-        # shared rotating log (see NO_AVAILABLE_ENTRIES_LOG_THROTTLE_SECONDS).
-        # Re-armed to None on every successful selection so a recover→re-exhaust
-        # transition logs promptly instead of being swallowed by a stale window.
-        self._last_no_entries_log_at: Optional[float] = None

    def has_credentials(self) -> bool:
        return bool(self._entries)
@@ -688,32 +616,17 @@ class CredentialPool:
            file_refresh = creds.get("refreshToken", "")
            file_access = creds.get("accessToken", "")
            file_expires = creds.get("expiresAt", 0)
-            # Sync when either token changed.  Access tokens can be re-issued
-            # without a new refresh token (silent re-issue path), so checking
-            # only refresh_token misses that case and leaves a stale
-            # access_token in the pool → 401 on every request until the pool
-            # entry's exhausted TTL expires.
-            entry_access = entry.access_token or ""
-            entry_refresh = entry.refresh_token or ""
-            if (file_access or file_refresh) and (
-                (file_access and file_access != entry_access)
-                or (file_refresh and file_refresh != entry_refresh)
-            ):
-                logger.debug(
-                    "Pool entry %s: syncing tokens from credentials file (tokens changed)",
-                    entry.id,
-                )
+            # If the credentials file has a different token pair, sync it
+            if file_refresh and file_refresh != entry.refresh_token:
+                logger.debug("Pool entry %s: syncing tokens from credentials file (refresh token changed)", entry.id)
                updated = replace(
                    entry,
-                    access_token=file_access or entry.access_token,
-                    refresh_token=file_refresh or entry.refresh_token,
-                    expires_at_ms=file_expires or entry.expires_at_ms,
+                    access_token=file_access,
+                    refresh_token=file_refresh,
+                    expires_at_ms=file_expires,
                    last_status=None,
                    last_status_at=None,
                    last_error_code=None,
-                    last_error_reason=None,
-                    last_error_message=None,
-                    last_error_reset_at=None,
                )
                self._replace_entry(entry, updated)
                self._persist()
@@ -796,11 +709,11 @@ class CredentialPool:
        keeps the consumed refresh_token and the next ``_refresh_entry`` call
        would replay it and get a ``refresh_token_reused``-style 4xx.

-        Only applies to entries seeded from the singleton (``device_code``);
-        manually added entries are independent credentials with their own
-        refresh-token lifecycle.
+        Only applies to entries seeded from the singleton (``loopback_pkce``);
+        manually added entries (``manual:xai_pkce``) are independent
+        credentials with their own refresh-token lifecycle.
        """
-        if self.provider != "xai-oauth" or entry.source != "device_code":
+        if self.provider != "xai-oauth" or entry.source != "loopback_pkce":
            return entry
        try:
            with _auth_store_lock():
@@ -844,45 +757,6 @@ class CredentialPool:
            logger.debug("Failed to sync xAI OAuth entry from auth.json: %s", exc)
        return entry

-    def _sync_xai_oauth_entry_from_pool_store(
-        self, entry: PooledCredential
-    ) -> PooledCredential:
-        """Adopt a token pair rotated by another pool instance.
-
-        Direct xAI integrations load a fresh ``CredentialPool`` for each
-        request. Their in-memory locks therefore cannot protect xAI's
-        single-use refresh token across concurrent requests or processes.
-        This helper is called while the shared auth-store lock is held and
-        re-reads the exact persisted row before a refresh POST is attempted.
-        """
-        if self.provider != "xai-oauth":
-            return entry
-        try:
-            persisted = next(
-                (
-                    payload
-                    for payload in read_credential_pool(self.provider)
-                    if isinstance(payload, dict) and payload.get("id") == entry.id
-                ),
-                None,
-            )
-            if not isinstance(persisted, dict):
-                return entry
-            stored = PooledCredential.from_dict(self.provider, persisted)
-            if (
-                stored.access_token != entry.access_token
-                or stored.refresh_token != entry.refresh_token
-            ):
-                logger.debug(
-                    "Pool entry %s: adopting xAI OAuth tokens rotated by another pool instance",
-                    entry.id,
-                )
-                self._replace_entry(entry, stored)
-                return stored
-        except Exception as exc:
-            logger.debug("Failed to sync xAI OAuth entry from credential pool: %s", exc)
-        return entry
-
    def _sync_nous_entry_from_auth_store(self, entry: PooledCredential) -> PooledCredential:
        """Sync a Nous pool entry from auth.json if tokens differ.

@@ -979,9 +853,8 @@ class CredentialPool:
        """
        # Only sync entries that were seeded *from* a singleton.  Manually
        # added pool entries (source="manual:*") are independent credentials
-        # and must not write back to the singleton.  All singleton-seeded
-        # device-code sources (nous, openai-codex, xAI) use ``device_code``.
-        if entry.source != "device_code":
+        # and must not write back to the singleton.
+        if entry.source not in {"device_code", "loopback_pkce"}:
            return
        try:
            with _auth_store_lock():
@@ -1076,61 +949,6 @@ class CredentialPool:
                self._mark_exhausted(entry, None)
            return None

-        # Codex and xAI OAuth refresh tokens are single-use.  The
-        # sync→POST→write-back sequence below must run atomically across Hermes
-        # processes: otherwise two processes can both adopt the same on-disk
-        # token, both POST it, and the loser gets ``refresh_token_reused``.
-        # Serialize the whole sequence through the shared cross-process
-        # auth-store flock (the same lock and extended-timeout pattern used by
-        # resolve_codex_runtime_credentials()).  When a waiter finally acquires
-        # the lock, the in-lock re-sync below picks up the rotated token the
-        # winner persisted and skips the POST.
-        if self.provider in ("openai-codex", "xai-oauth"):
-            sync_entry = (
-                self._sync_codex_entry_from_auth_store
-                if self.provider == "openai-codex"
-                else self._sync_xai_oauth_entry_from_pool_store
-            )
-            with _auth_store_lock(
-                timeout_seconds=self._single_use_refresh_lock_timeout()
-            ):
-                synced = sync_entry(entry)
-                if self.provider == "openai-codex":
-                    if synced is not entry:
-                        entry = synced
-                        if not force and not self._entry_needs_refresh(entry):
-                            return entry
-                    return self._refresh_entry_impl(entry, force=force)
-                if (
-                    synced.access_token != entry.access_token
-                    or synced.refresh_token != entry.refresh_token
-                ):
-                    return synced
-                return self._refresh_entry_impl(synced, force=force)
-        return self._refresh_entry_impl(entry, force=force)
-
-    def _single_use_refresh_lock_timeout(self) -> float:
-        """Lock timeout for single-use-refresh-token providers.
-
-        Covers the configured refresh POST timeout plus a margin so a slow
-        token endpoint cannot make the flock give up before the refresh
-        resolves.  Reads the provider's ``HERMES_*_REFRESH_TIMEOUT_SECONDS``
-        override.
-        """
-        env_var = (
-            "HERMES_CODEX_REFRESH_TIMEOUT_SECONDS"
-            if self.provider == "openai-codex"
-            else "HERMES_XAI_REFRESH_TIMEOUT_SECONDS"
-        )
-        refresh_timeout_seconds = auth_mod.env_float(env_var, 20)
-        return max(
-            float(auth_mod.AUTH_LOCK_TIMEOUT_SECONDS),
-            float(refresh_timeout_seconds) + 5.0,
-        )
-
-    def _refresh_entry_impl(
-        self, entry: PooledCredential, *, force: bool
-    ) -> Optional[PooledCredential]:
        try:
            if self.provider == "anthropic":
                from agent.anthropic_adapter import refresh_anthropic_oauth_pure
@@ -1251,8 +1069,8 @@ class CredentialPool:
            # consumed the refresh token between our proactive sync and the
            # HTTP call.  Re-check auth.json and adopt the fresh tokens if
            # they have rotated since.  Only meaningful for singleton-seeded
-            # (device_code) entries; manual entries don't share
-            # state with the singleton.
+            # (loopback_pkce) entries; manual entries don't share state with
+            # the singleton.
            if self.provider == "xai-oauth":
                synced = self._sync_xai_oauth_entry_from_auth_store(entry)
                if synced.refresh_token != entry.refresh_token:
@@ -1274,8 +1092,8 @@ class CredentialPool:
                # Terminal error: auth.json has no newer tokens — the stored
                # refresh_token is dead.  Clear it from auth.json so the next
                # session does not re-seed the same revoked credentials, and
-                # remove all singleton-seeded xAI entries from the in-memory
-                # pool. Mirrors the Nous quarantine path above.
+                # remove all singleton-seeded (loopback_pkce) entries from the
+                # in-memory pool.  Mirrors the Nous quarantine path above.
                if auth_mod._is_terminal_xai_oauth_refresh_error(exc):
                    logger.debug(
                        "xAI OAuth refresh token is terminally invalid; clearing local token state"
@@ -1309,11 +1127,11 @@ class CredentialPool:
                        )
                    removed_ids = [
                        item.id for item in self._entries
-                        if item.source == "device_code"
+                        if item.source == "loopback_pkce"
                    ]
                    self._entries = [
                        item for item in self._entries
-                        if item.source != "device_code"
+                        if item.source != "loopback_pkce"
                    ]
                    if self._current_id == entry.id:
                        self._current_id = None
@@ -1491,7 +1309,7 @@ class CredentialPool:
        if self.provider == "xai-oauth":
            return auth_mod._xai_access_token_is_expiring(
                entry.access_token,
-                auth_mod._xai_proactive_refresh_skew_seconds(entry.access_token),
+                auth_mod.XAI_ACCESS_TOKEN_REFRESH_SKEW_SECONDS,
            )
        if self.provider == "nous":
            # Nous refresh can require network access and should happen when
@@ -1516,11 +1334,6 @@ class CredentialPool:
        entries_to_prune: List[str] = []
        available: List[PooledCredential] = []
        for entry in self._entries:
-            # Borrowed credentials persist as metadata-only references and are
-            # hydrated from their live source on load.  A stale duplicate row
-            # can remain unhydrated; never lease or select it as an empty key.
-            if entry.auth_type == AUTH_TYPE_API_KEY and not entry.runtime_api_key:
-                continue
            # For anthropic claude_code entries, sync from the credentials file
            # before any status/refresh checks. This picks up tokens refreshed
            # by other processes (Claude Code CLI, other Hermes profiles).
@@ -1558,7 +1371,7 @@ class CredentialPool:
            # tokens that another process (or a fresh `hermes model` ->
            # xAI Grok OAuth login) has since rotated in auth.json.
            if (self.provider == "xai-oauth"
-                    and entry.source == "device_code"
+                    and entry.source == "loopback_pkce"
                    and entry.last_status in {STATUS_EXHAUSTED, STATUS_DEAD}):
                synced = self._sync_xai_oauth_entry_from_auth_store(entry)
                if synced is not entry:
@@ -1624,32 +1437,13 @@ class CredentialPool:
            self._persist(removed_ids=entries_to_prune)
        return available

-    def _log_no_available_entries(self) -> None:
-        """Emit the empty-pool INFO line at most once per throttle window.
-
-        Called on every selection while the pool is empty/exhausted. Without
-        throttling this storms the Windows cross-process log lock and stalls the
-        event loop (see NO_AVAILABLE_ENTRIES_LOG_THROTTLE_SECONDS).
-        """
-        now = time.monotonic()
-        last = self._last_no_entries_log_at
-        if last is not None and (now - last) < NO_AVAILABLE_ENTRIES_LOG_THROTTLE_SECONDS:
-            return
-        self._last_no_entries_log_at = now
-        logger.info("credential pool: no available entries (all exhausted or empty)")
-
-    def _select_unlocked(self, *, refresh: bool = True) -> Optional[PooledCredential]:
-        available = self._available_entries(clear_expired=True, refresh=refresh)
+    def _select_unlocked(self) -> Optional[PooledCredential]:
+        available = self._available_entries(clear_expired=True, refresh=True)
        if not available:
            self._current_id = None
-            self._log_no_available_entries()
+            logger.info("credential pool: no available entries (all exhausted or empty)")
            return None

-        # A successful selection means the pool recovered; re-arm the throttle
-        # so a later re-exhaustion logs immediately rather than being silenced
-        # by a window opened during the previous empty stretch.
-        self._last_no_entries_log_at = None
-
        if self._strategy == STRATEGY_RANDOM:
            entry = random.choice(available)
            self._current_id = entry.id
@@ -1773,35 +1567,6 @@ class CredentialPool:
        with self._lock:
            return self._try_refresh_current_unlocked()

-    def try_refresh_matching(
-        self, api_key_hint: Optional[str] = None
-    ) -> Optional[PooledCredential]:
-        """Force-refresh the entry that supplied ``api_key_hint``.
-
-        Direct provider integrations may reload the pool after a request has
-        already failed, so they cannot rely on ``current_id`` identifying the
-        issuing credential. With no hint, select an entry without first doing
-        the normal proactive refresh; the forced refresh below must consume a
-        rotating refresh token exactly once.
-        """
-        with self._lock:
-            entry = None
-            if api_key_hint:
-                entry = next(
-                    (
-                        candidate
-                        for candidate in self._entries
-                        if candidate.runtime_api_key == api_key_hint
-                    ),
-                    None,
-                )
-            else:
-                entry = self.current() or self._select_unlocked(refresh=False)
-            if entry is None:
-                return None
-            self._current_id = entry.id
-            return self._try_refresh_current_unlocked()
-
    def _try_refresh_current_unlocked(self) -> Optional[PooledCredential]:
        entry = self.current()
        if entry is None:
@@ -1885,15 +1650,11 @@ class CredentialPool:


 def _upsert_entry(entries: List[PooledCredential], provider: str, source: str, payload: Dict[str, Any]) -> bool:
-    matching_indices = []
+    existing_idx = None
    for idx, entry in enumerate(entries):
        if entry.source == source:
-            matching_indices.append(idx)
-
-    existing_idx = matching_indices[0] if matching_indices else None
-    duplicate_indices = set(matching_indices[1:])
-    if duplicate_indices:
-        entries[:] = [entry for idx, entry in enumerate(entries) if idx not in duplicate_indices]
+            existing_idx = idx
+            break

    if existing_idx is None:
        payload.setdefault("id", uuid.uuid4().hex[:6])
@@ -1925,8 +1686,8 @@ def _upsert_entry(entries: List[PooledCredential], provider: str, source: str, p
        # Runtime-only borrowed secret updates should refresh the in-memory
        # entry without forcing auth.json churn when the disk-safe payload is
        # unchanged (for example env keys with the same fingerprint).
-        return bool(duplicate_indices) or existing.to_dict() != updated.to_dict()
-    return bool(duplicate_indices)
+        return existing.to_dict() != updated.to_dict()
+    return False


 def _normalize_pool_priorities(provider: str, entries: List[PooledCredential]) -> bool:
@@ -2123,16 +1884,11 @@ def _seed_from_singletons(provider: str, entries: List[PooledCredential]) -> Tup
            from hermes_cli.copilot_auth import resolve_copilot_token, get_copilot_api_token
            token, source = resolve_copilot_token()
            if token:
-                api_token, enterprise_base_url = get_copilot_api_token(token)
+                api_token = get_copilot_api_token(token)
                source_name = "gh_cli" if "gh" in source.lower() else f"env:{source}"
                if not _is_suppressed(provider, source_name):
                    active_sources.add(source_name)
                    pconfig = PROVIDER_REGISTRY.get(provider)
-                    # Use enterprise base URL from token exchange if available,
-                    # otherwise fall back to the provider's default.
-                    effective_base_url = enterprise_base_url or (
-                        pconfig.inference_base_url if pconfig else ""
-                    )
                    changed |= _upsert_entry(
                        entries,
                        provider,
@@ -2141,7 +1897,7 @@ def _seed_from_singletons(provider: str, entries: List[PooledCredential]) -> Tup
                            "source": source_name,
                            "auth_type": AUTH_TYPE_API_KEY,
                            "access_token": api_token,
-                            "base_url": effective_base_url,
+                            "base_url": pconfig.inference_base_url if pconfig else "",
                            "label": source,
                        },
                    )
@@ -2260,30 +2016,28 @@ def _seed_from_singletons(provider: str, entries: List[PooledCredential]) -> Tup
        # (``providers["xai-oauth"]``).  Surface them in the pool too so
        # ``hermes auth list`` reflects the logged-in state and so the pool
        # is the single source of truth for refresh during runtime resolution.
+        if _is_suppressed(provider, "loopback_pkce"):
+            return changed, active_sources
+
        state = _load_provider_state(auth_store, "xai-oauth")
        tokens = state.get("tokens") if isinstance(state, dict) else None
        if isinstance(tokens, dict) and tokens.get("access_token"):
-            # Device code is the only supported xAI OAuth flow; the singleton is
-            # always surfaced as ``device_code`` (consistent with nous/codex).
-            source = "device_code"
-            if _is_suppressed(provider, source):
-                return changed, active_sources
-            active_sources.add(source)
+            active_sources.add("loopback_pkce")
            from hermes_cli.auth import DEFAULT_XAI_OAUTH_BASE_URL

            base_url = DEFAULT_XAI_OAUTH_BASE_URL
            changed |= _upsert_entry(
                entries,
                provider,
-                source,
+                "loopback_pkce",
                {
-                    "source": source,
+                    "source": "loopback_pkce",
                    "auth_type": AUTH_TYPE_OAUTH,
                    "access_token": tokens.get("access_token", ""),
                    "refresh_token": tokens.get("refresh_token"),
                    "base_url": base_url,
                    "last_refresh": state.get("last_refresh"),
-                    "label": label_from_token(tokens.get("access_token", ""), source),
+                    "label": label_from_token(tokens.get("access_token", ""), "loopback_pkce"),
                },
            )

@@ -2300,20 +2054,8 @@ def _seed_from_env(provider: str, entries: List[PooledCredential]) -> Tuple[bool
    # changes to the .env file.
    def _get_env_prefer_dotenv(key: str) -> str:
        env_file = load_env()
-        raw = env_file.get(key, "").strip()
-        env_val = os.environ.get(key, "").strip()
-        # If .env contains an unresolved op:// reference, prefer the
-        # already-resolved value from os.environ (set by
-        # load_hermes_dotenv() -> apply_onepassword_secrets()).  The raw
-        # "op://Vault/Item/field" string would otherwise win and every
-        # provider auth attempt would receive a URL instead of a key.  This
-        # happens during a partial migration, or when the user wrote op://
-        # references straight into .env rather than the secrets.onepassword
-        # config block.  For every non-op:// value the original
-        # .env-takes-precedence behaviour is preserved unchanged.
-        if raw.startswith("op://") and env_val:
-            return env_val
-        return raw or _get_secret(key, "") or env_val
+        val = env_file.get(key) or _get_secret(key, "") or ""
+        return val.strip()

    # Honour user suppression — `hermes auth remove <provider> <N>` for an
    # env-seeded credential marks the env:<VAR> source as suppressed so it
@@ -2400,6 +2142,7 @@ def _seed_from_env(provider: str, entries: List[PooledCredential]) -> Tuple[bool
        if _is_source_suppressed(provider, source):
            continue
        active_sources.add(source)
+        auth_type = AUTH_TYPE_OAUTH if provider == "anthropic" and not token.startswith("sk-ant-api") else AUTH_TYPE_API_KEY
        base_url = env_url or pconfig.inference_base_url
        if provider == "kimi-coding":
            base_url = _resolve_kimi_base_url(token, pconfig.inference_base_url, env_url)
@@ -2414,6 +2157,7 @@ def _seed_from_env(provider: str, entries: List[PooledCredential]) -> Tuple[bool
                env_var=env_var,
                token=token,
                base_url=base_url,
+                auth_type=auth_type,
            ),
        )
    return changed, active_sources
@@ -2541,37 +2285,16 @@ def load_pool(provider: str) -> CredentialPool:
        for payload in raw_entries
    )
    entries = [PooledCredential.from_dict(provider, payload) for payload in raw_entries]
-    raw_needs_auth_normalization = any(
-        isinstance(payload, dict)
-        and _normalize_pool_auth_type(
-            provider,
-            payload.get("access_token"),
-            payload.get("auth_type", AUTH_TYPE_API_KEY),
-        ) != payload.get("auth_type", AUTH_TYPE_API_KEY)
-        for payload in raw_entries
-    )
-    if raw_needs_auth_normalization:
-        # A profile may be reading this provider from the global-root fallback.
-        # Keep that fallback read-only: only the store that owns these rows may
-        # rewrite them. Loading the default/root profile will heal global rows.
-        active_pool = _load_auth_store().get("credential_pool")
-        active_entries = active_pool.get(provider) if isinstance(active_pool, dict) else None
-        raw_needs_auth_normalization = bool(active_entries)

    if provider.startswith(CUSTOM_POOL_PREFIX):
        # Custom endpoint pool — seed from custom_providers config and model config
        custom_changed, custom_sources = _seed_custom_pool(provider, entries)
-        changed = raw_needs_sanitization or raw_needs_auth_normalization or custom_changed
+        changed = raw_needs_sanitization or custom_changed
        changed |= _prune_stale_seeded_entries(entries, custom_sources)
    else:
        singleton_changed, singleton_sources = _seed_from_singletons(provider, entries)
        env_changed, env_sources = _seed_from_env(provider, entries)
-        changed = (
-            raw_needs_sanitization
-            or raw_needs_auth_normalization
-            or singleton_changed
-            or env_changed
-        )
+        changed = raw_needs_sanitization or singleton_changed or env_changed
        # ``load_pool()`` is a non-destructive read for env-seeded entries: a
        # process missing a provider env var must not delete the persisted
        # pool entry for every other process (#9331). File-backed singletons
@@ -265,7 +265,7 @@ def _remove_minimax_oauth(provider: str, removed) -> RemovalResult:
    return result


-def _remove_xai_oauth_device_code(provider: str, removed) -> RemovalResult:
+def _remove_xai_oauth_loopback_pkce(provider: str, removed) -> RemovalResult:
    """xAI OAuth tokens live in auth.json providers.xai-oauth — clear them.

    Without this step, ``hermes auth remove xai-oauth <N>`` silently undoes
@@ -275,6 +275,11 @@ def _remove_xai_oauth_device_code(provider: str, removed) -> RemovalResult:
    entry from the still-present singleton — credentials reappear with no
    user feedback. Clearing the singleton in step with the suppression set
    by the central dispatcher makes the removal stick.
+
+    Belt-and-braces against the manual entry path: ``hermes auth add
+    xai-oauth`` produces a ``manual:xai_pkce`` entry whose removal step
+    falls through to "unregistered → nothing to clean up" (correct —
+    manual entries are pool-only).
    """
    result = RemovalResult()
    if _clear_auth_store_provider(provider):
@@ -418,8 +423,8 @@ def _register_all_sources() -> None:
        description="auth.json providers.openai-codex + ~/.codex/auth.json",
    ))
    register(RemovalStep(
-        provider="xai-oauth", source_id="device_code",
-        remove_fn=_remove_xai_oauth_device_code,
+        provider="xai-oauth", source_id="loopback_pkce",
+        remove_fn=_remove_xai_oauth_loopback_pkce,
        description="auth.json providers.xai-oauth",
    ))
    register(RemovalStep(
@@ -45,26 +45,12 @@ def _strip_aux_credential(value: Any) -> Optional[str]:


 class _ReviewRuntimeBinding(NamedTuple):
-    """Provider/model for the curator review fork plus per-slot overrides."""
+    """Provider/model for the curator review fork plus optional per-slot overrides."""

    provider: str
    model: str
    explicit_api_key: Optional[str]
    explicit_base_url: Optional[str]
-    request_overrides: Dict[str, Any]
-
-
-def _merge_request_overrides(
-    runtime_overrides: Any,
-    slot_extra_body: Any,
-) -> Dict[str, Any]:
-    """Merge resolver metadata with task-local request body fields."""
-    merged = dict(runtime_overrides or {})
-    if isinstance(slot_extra_body, dict) and slot_extra_body:
-        extra_body = dict(merged.get("extra_body") or {})
-        extra_body.update(slot_extra_body)
-        merged["extra_body"] = extra_body
-    return merged


 DEFAULT_INTERVAL_HOURS = 24 * 7  # 7 days
@@ -1778,7 +1764,6 @@ def _resolve_review_runtime(cfg: Dict[str, Any]) -> _ReviewRuntimeBinding:
            _task_model,
            _strip_aux_credential(_cur_task.get("api_key")),
            _strip_aux_credential(_cur_task.get("base_url")),
-            _merge_request_overrides({}, _cur_task.get("extra_body")),
        )

    # 2. Legacy curator.auxiliary.{provider,model} (deprecated, pre-unification)
@@ -1796,11 +1781,10 @@ def _resolve_review_runtime(cfg: Dict[str, Any]) -> _ReviewRuntimeBinding:
            str(_legacy_model),
            _strip_aux_credential(_legacy.get("api_key")),
            _strip_aux_credential(_legacy.get("base_url")),
-            _merge_request_overrides({}, _legacy.get("extra_body")),
        )

    # 3. Fall through to the main chat model
-    return _ReviewRuntimeBinding(_main_provider, _main_model, None, None, {})
+    return _ReviewRuntimeBinding(_main_provider, _main_model, None, None)


 def _resolve_review_model(cfg: Dict[str, Any]) -> tuple[str, str]:
@@ -1866,11 +1850,6 @@ def _run_llm_review(prompt: str) -> Dict[str, Any]:
    _base_url = None
    _api_mode = None
    _resolved_provider = None
-    _credential_pool = None
-    _request_overrides: Dict[str, Any] = {}
-    _max_tokens = None
-    _acp_command = None
-    _acp_args = None
    _model_name = ""
    try:
        from hermes_cli.config import load_config
@@ -1888,16 +1867,6 @@ def _run_llm_review(prompt: str) -> Dict[str, Any]:
        _base_url = _rp.get("base_url")
        _api_mode = _rp.get("api_mode")
        _resolved_provider = _rp.get("provider") or _provider
-        _credential_pool = _rp.get("credential_pool")
-        _request_overrides = _merge_request_overrides(
-            _rp.get("request_overrides"),
-            _binding.request_overrides.get("extra_body"),
-        )
-        _max_tokens = _rp.get("max_output_tokens")
-        _acp_command = _rp.get("command")
-        _acp_args = list(_rp.get("args") or [])
-        if isinstance(_rp.get("model"), str) and _rp["model"].strip():
-            _model_name = _rp["model"].strip()
    except Exception as e:
        logger.debug("Curator provider resolution failed: %s", e, exc_info=True)

@@ -1906,21 +1875,12 @@ def _run_llm_review(prompt: str) -> Dict[str, Any]:

    review_agent = None
    try:
-        _agent_kwargs: Dict[str, Any] = {}
-        if isinstance(_max_tokens, int):
-            _agent_kwargs["max_tokens"] = _max_tokens
-        if isinstance(_acp_command, str) and _acp_command:
-            _agent_kwargs["acp_command"] = _acp_command
-            _agent_kwargs["acp_args"] = _acp_args or []
        review_agent = AIAgent(
            model=_model_name,
            provider=_resolved_provider,
            api_key=_api_key,
            base_url=_base_url,
            api_mode=_api_mode,
-            credential_pool=_credential_pool,
-            request_overrides=_request_overrides,
-            **_agent_kwargs,
            # Umbrella-building over a large skill collection is worth a
            # high iteration ceiling — the pass typically takes 50-100
            # API calls against hundreds of candidate skills. The
@@ -556,7 +556,7 @@ def rollback(backup_id: Optional[str] = None) -> Tuple[bool, str, Optional[Path]
    if target is None:
        return (
            False,
-            "no matching backup found"
+            f"no matching backup found"
            + (f" for id '{backup_id}'" if backup_id else "")
            + " (use `hermes curator rollback --list` to see available snapshots)",
            None,
@@ -27,14 +27,6 @@ logger = logging.getLogger(__name__)

 _ANSI_RESET = "\033[0m"

-
-def _display_url(value: Any) -> str:
-    """Extract a display-only URL without assuming model argument types."""
-    if isinstance(value, dict):
-        value = value.get("url") or value.get("href")
-    return value.strip() if isinstance(value, str) else ""
-
-
 # Diff colors — resolved lazily from the skin engine so they adapt
 # to light/dark themes.  Falls back to sensible defaults on import
 # failure.  We cache after first resolution for performance.
@@ -462,14 +454,13 @@ def build_tool_preview(tool_name: str, args: dict, max_len: int | None = None) -
        sid = args.get("session_id", "")
        data = args.get("data", "")
        timeout_val = args.get("timeout")
-        parts = [str(action) if action else ""]
+        parts = [action]
        if sid:
-            parts.append(str(sid)[:16])
+            parts.append(sid[:16])
        if data:
-            parts.append(f'"{_oneline(str(data)[:20])}"')
+            parts.append(f'"{_oneline(data[:20])}"')
        if timeout_val and action == "wait":
            parts.append(f"{timeout_val}s")
-        parts = [p for p in parts if p]
        return " ".join(parts) if parts else None

    if tool_name == "todo":
@@ -524,16 +515,6 @@ def build_tool_preview(tool_name: str, args: dict, max_len: int | None = None) -
            msg = msg[:17] + "..."
        return f"to {target}: \"{msg}\""

-    if tool_name == "skill_view":
-        name = _oneline(str(args.get("name") or ""))
-        file_path = args.get("file_path")
-        if file_path:
-            file_path = _oneline(str(file_path))
-            preview = f"{name} → {file_path}" if name else file_path
-        else:
-            preview = name
-        return _truncate_preview(preview, max_len) if preview else None
-
    key = primary_args.get(tool_name)
    if not key:
        for fallback_key in ("query", "text", "command", "path", "name", "prompt", "code", "goal"):
@@ -1268,7 +1249,7 @@ def _detect_tool_failure(tool_name: str, result: str | None) -> tuple[bool, str]
    return False, ""


-def _get_cute_tool_message(
+def get_cute_tool_message(
    tool_name: str, args: dict, duration: float, result: str | None = None,
 ) -> str:
    """Generate a formatted tool completion line for CLI quiet mode.
@@ -1310,11 +1291,9 @@ def _get_cute_tool_message(
    if tool_name == "web_extract":
        urls = args.get("urls", [])
        if urls:
-            url = _display_url(urls[0] if isinstance(urls, list) else urls)
-            if not url:
-                return _wrap(f"┊ 📄 fetch     pages  {dur}")
+            url = urls[0] if isinstance(urls, list) else str(urls)
            domain = url.replace("https://", "").replace("http://", "").split("/")[0]
-            extra = f" +{len(urls)-1}" if isinstance(urls, list) and len(urls) > 1 else ""
+            extra = f" +{len(urls)-1}" if len(urls) > 1 else ""
            return _wrap(f"┊ 📄 fetch     {_trunc(domain, 35)}{extra}  {dur}")
        return _wrap(f"┊ 📄 fetch     pages  {dur}")
    if tool_name == "terminal":
@@ -1405,11 +1384,7 @@ def _get_cute_tool_message(
    if tool_name == "skills_list":
        return _wrap(f"┊ 📚 skills    list {args.get('category', 'all')}  {dur}")
    if tool_name == "skill_view":
-        label = args.get("name", "")
-        file_path = args.get("file_path")
-        if file_path:
-            label = f"{label} → {file_path}" if label else str(file_path)
-        return _wrap(f"┊ 📚 skill     {_trunc(label, 44)}  {dur}")
+        return _wrap(f"┊ 📚 skill     {_trunc(args.get('name', ''), 30)}  {dur}")
    if tool_name == "image_generate":
        return _wrap(f"┊ 🎨 create    {_trunc(args.get('prompt', ''), 35)}  {dur}")
    if tool_name == "text_to_speech":
@@ -1444,19 +1419,6 @@ def _get_cute_tool_message(
    return _wrap(f"┊ ⚡ {tool_name[:9]:9} {_trunc(preview, 35)}  {dur}")


-def get_cute_tool_message(
-    tool_name: str, args: dict, duration: float, result: str | None = None,
-) -> str:
-    """Render a completion label without letting cosmetic failures escape."""
-    try:
-        return _get_cute_tool_message(tool_name, args, duration, result=result)
-    except Exception as exc:  # noqa: BLE001 — display must never abort a turn
-        logger.debug("Tool completion label failed for %s: %s", tool_name, exc)
-        safe_name = tool_name[:9] if isinstance(tool_name, str) and tool_name else "tool"
-        safe_duration = f"{duration:.1f}s" if isinstance(duration, (int, float)) else "done"
-        return f"┊ ⚡ {safe_name:9} completed  {safe_duration}"
-
-
 # =========================================================================
 # Honcho session line (one-liner with clickable OSC 8 hyperlink)
 # =========================================================================
@@ -31,9 +31,6 @@ class FailoverReason(enum.Enum):
    # Billing / quota
    billing = "billing"                  # 402 or confirmed credit exhaustion — rotate immediately
    rate_limit = "rate_limit"            # 429 or quota-based throttling — backoff then rotate
-    # Upstream model rate-limited (aggregator 429) — fallback to a different
-    # model, NOT credential rotation. The user's key is healthy.
-    upstream_rate_limit = "upstream_rate_limit"

    # Server-side
    overloaded = "overloaded"            # 503/529 — provider overloaded, backoff
@@ -41,11 +38,6 @@ class FailoverReason(enum.Enum):

    # Transport
    timeout = "timeout"                  # Connection/read timeout — rebuild client + retry
-    # TLS certificate verification failure — deterministic for the host
-    # (TLS-inspecting proxy, missing/expired CA bundle, self-signed cert).
-    # Retrying reproduces the identical handshake failure, so fail fast
-    # with actionable guidance instead of burning retries.
-    ssl_cert_verification = "ssl_cert_verification"

    # Context / payload
    context_overflow = "context_overflow"  # Context too large — compress, not failover
@@ -115,7 +107,6 @@ _BILLING_PATTERNS = [
    "exceeded your current quota",
    "account is deactivated",
    "plan does not include",
-    "out of extra usage",  # Anthropic OAuth Pro/Max overage bucket depleted (HTTP 400)
    "out of funds",
    "run out of funds",
    "balance_depleted",
@@ -123,25 +114,6 @@ _BILLING_PATTERNS = [
    "not available on the free tier",
 ]

-# xAI's explicit Grok credit-exhaustion code. Keep the HTTP 403 special case
-# provider-scoped: other providers' generic billing codes historically remain
-# auth failures when they arrive as 403.
-_XAI_SPENDING_LIMIT_ERROR_CODE = "personal-team-blocked:spending-limit"
-
-# Structured provider codes that mean the account cannot serve paid traffic
-# until credits/subscription capacity is restored. xAI returns its explicit
-# Grok spending-limit signal as HTTP 403 rather than 402.
-_BILLING_ERROR_CODES = frozenset({
-    "insufficient_quota",
-    "billing_not_active",
-    "payment_required",
-    "insufficient_credits",
-    "no_usable_credits",
-    "balance_depleted",
-    "model_not_supported_on_free_tier",
-    _XAI_SPENDING_LIMIT_ERROR_CODE,
-})
-
 # Patterns that indicate rate limiting (transient, will resolve)
 _RATE_LIMIT_PATTERNS = [
    "rate limit",
@@ -286,8 +258,6 @@ _CONTEXT_OVERFLOW_PATTERNS = [
    # Chinese error messages (some providers return these)
    "超过最大长度",
    "上下文长度",
-    # Z.AI / Zhipu GLM pattern (English form; error code 1210)
-    "tokens in request more than max tokens allowed",
    # AWS Bedrock Converse API error patterns
    "input is too long",
    "max input token",
@@ -305,15 +275,6 @@ _MODEL_NOT_FOUND_PATTERNS = [
    "no such model",
    "unknown model",
    "unsupported model",
-    # OpenRouter returns 404 with this message when none of the candidate
-    # endpoints for the selected model support tool/function calling.
-    # Classifying this as model_not_found triggers fallback to a different
-    # model or provider that does support tools.  Without this entry the
-    # pattern falls through to ``unknown`` with ``retryable=True``, the
-    # retry loop burns all attempts on the same deterministic rejection,
-    # and the error surfaces as a confusing "model not found" message
-    # instead of automatically failing over.  See PR #58446.
-    "no endpoints found that support tool use",
 ]

 # Request-validation patterns — the request is malformed and will fail
@@ -473,29 +434,6 @@ _SERVER_DISCONNECT_PATTERNS = [
    "incomplete chunked read",
 ]

-# SSL certificate verification failures — deterministic, NOT transient.
-#
-# A failed certificate chain (TLS-inspecting corporate proxy, missing
-# custom CA in the trust store, expired certificate, self-signed cert)
-# fails identically on every retry. Burning the retry budget before
-# surfacing the error hides the actionable fix from the user for minutes.
-# Inspired by Claude Code v2.1.199 (July 2026), which made SSL certificate
-# errors fail immediately with a fix hint instead of retrying.
-#
-# Must be checked BEFORE _SSL_TRANSIENT_PATTERNS — "certificate verify
-# failed" messages usually also contain "[SSL:" which would otherwise
-# match the transient list and retry forever.
-_SSL_CERT_VERIFY_PATTERNS = [
-    "certificate verify failed",       # Python ssl module canonical text
-    "certificate_verify_failed",       # OpenSSL error token
-    "unable to get local issuer certificate",
-    "self-signed certificate",
-    "self signed certificate",
-    "certificate has expired",
-    "hostname mismatch, certificate is not valid",
-    "unable to verify the first certificate",  # Node/undici phrasing (MCP bridges)
-]
-
 # SSL/TLS transient failure patterns — intentionally distinct from
 # _SERVER_DISCONNECT_PATTERNS above.
 #
@@ -793,22 +731,7 @@ def classify_api_error(
    if classified is not None:
        return classified

-    # ── 5. SSL certificate verification failures → fail fast ────────
-    # A broken certificate chain (TLS-inspecting proxy, missing custom CA,
-    # expired/self-signed cert) is deterministic for the host — every retry
-    # reproduces the identical handshake failure. Fail immediately with
-    # actionable guidance instead of burning the retry budget first.
-    # Checked BEFORE the transient-SSL patterns: cert-verify messages also
-    # contain "[ssl:" which would otherwise match the transient list.
-    # Inspired by Claude Code v2.1.199 (July 2026).
-    if any(p in error_msg for p in _SSL_CERT_VERIFY_PATTERNS):
-        return _result(
-            FailoverReason.ssl_cert_verification,
-            retryable=False,
-            should_fallback=False,
-        )
-
-    # ── 5b. SSL/TLS transient errors → retry as timeout (not compression) ──
+    # ── 5. SSL/TLS transient errors → retry as timeout (not compression) ──
    # SSL alerts mid-stream are transport hiccups, not server-side context
    # overflow signals.  Classify before the disconnect check so a large
    # session doesn't incorrectly trigger context compression when the real
@@ -861,34 +784,12 @@ def classify_api_error(
            )
        return _result(FailoverReason.timeout, retryable=True)

-    # ── 7b. Stale-call circuit breaker → failover immediately ──────
-    # _check_stale_giveup() in agent/chat_completion_helpers.py raises a
-    # RuntimeError when the provider has been unresponsive for N
-    # consecutive stale attempts (default 5).  The error is NOT a transport
-    # timeout — the circuit breaker fires *before* any network call to avoid
-    # an indefinite stall.  Without this classification the RuntimeError
-    # falls through to FailoverReason.unknown (retryable=True), which burns
-    # all max_retries against the same dead provider (each retry hitting the
-    # circuit breaker instantly with zero network overhead) before fallback
-    # is attempted.  Classify as non-retryable + should_fallback so the
-    # retry loop activates the next fallback provider on the first hit.
-    if (
-        error_type == "RuntimeError"
-        and "consecutive stale attempts" in error_msg
-        and "aborting this call" in error_msg
-    ):
-        return _result(
-            FailoverReason.timeout,
-            retryable=False,
-            should_fallback=True,
-        )
-
-    # ── 8. Transport / timeout heuristics ───────────────────────────
+    # ── 7. Transport / timeout heuristics ───────────────────────────

    if error_type in _TRANSPORT_ERROR_TYPES or isinstance(error, (TimeoutError, ConnectionError, OSError)):
        return _result(FailoverReason.timeout, retryable=True)

-    # ── 9. Fallback: unknown ────────────────────────────────────────
+    # ── 8. Fallback: unknown ────────────────────────────────────────

    return _result(FailoverReason.unknown, retryable=True)

@@ -927,11 +828,7 @@ def _classify_by_status(
        # OpenRouter 403 "key limit exceeded" is actually billing. Other
        # providers also use 403 for account-plan or credit exhaustion.
        if (
-            (
-                provider == "xai-oauth"
-                and error_code.lower() == _XAI_SPENDING_LIMIT_ERROR_CODE
-            )
-            or "key limit exceeded" in error_msg
+            "key limit exceeded" in error_msg
            or "spending limit" in error_msg
            or any(p in error_msg for p in _BILLING_PATTERNS)
        ):
@@ -1012,22 +909,6 @@ def _classify_by_status(
                FailoverReason.overloaded,
                retryable=True,
            )
-        # Distinguish an OpenRouter-aggregator upstream 429 (an upstream model
-        # like DeepSeek rate-limited OpenRouter's aggregate traffic) from an
-        # account-level 429 (the user's key is actually throttled). OpenRouter
-        # wraps upstream errors with the outer message "Provider returned
-        # error" — the user's key is healthy, so marking it exhausted / rotating
-        # is wrong and burns the key for ~24min. Fall back to a different model.
-        if _is_openrouter_upstream_error(body, provider):
-            upstream_provider = _extract_upstream_provider_name(body)
-            ctx = {"upstream_provider": upstream_provider} if upstream_provider else {}
-            return result_fn(
-                FailoverReason.upstream_rate_limit,
-                retryable=True,
-                should_rotate_credential=False,
-                should_fallback=True,
-                error_context=ctx,
-            )
        return result_fn(
            FailoverReason.rate_limit,
            retryable=True,
@@ -1063,44 +944,11 @@ def _classify_by_status(
                retryable=False,
                should_fallback=True,
            )
-        # Some local inference servers (notably llama.cpp / llama-server)
-        # report context overflow with an HTTP 500 instead of the standard
-        # 400/413. The request-validation guard above already ran, so any
-        # remaining explicit context-overflow signal routes into the
-        # compression-and-retry path (mirroring _classify_400) instead of
-        # blind server_error retries that exhaust and drop the turn.
-        if any(p in error_msg for p in _CONTEXT_OVERFLOW_PATTERNS):
-            return result_fn(
-                FailoverReason.context_overflow,
-                retryable=True,
-                should_compress=True,
-            )
        return result_fn(FailoverReason.server_error, retryable=True)

    if status_code in {503, 529}:
-        # Same overflow-as-5xx variant (server busy / model-load OOM, or a
-        # Cloudflare/Tailscale hop relabeling the status). Route explicit
-        # overflow bodies into compression; otherwise treat as transient
-        # overload and retry.
-        if any(p in error_msg for p in _CONTEXT_OVERFLOW_PATTERNS):
-            return result_fn(
-                FailoverReason.context_overflow,
-                retryable=True,
-                should_compress=True,
-            )
        return result_fn(FailoverReason.overloaded, retryable=True)

-    # 408 Request Timeout — a transient timing failure the server itself flags
-    # as safe to retry (RFC 9110 §15.5.9), not a malformed request. Commonly
-    # emitted by reverse proxies sitting in front of self-hosted backends
-    # (llama.cpp / Ollama / vLLM) when a long generation outruns the proxy's
-    # request-read window. Route to the dedicated ``timeout`` reason (rebuild
-    # client + retry) instead of falling through to the generic 4xx bucket
-    # below, which would abort the turn on a retry-safe error the same way it
-    # aborts a 400 Bad Request.
-    if status_code == 408:
-        return result_fn(FailoverReason.timeout, retryable=True)
-
    # Other 4xx — non-retryable
    if 400 <= status_code < 500:
        return result_fn(
@@ -1194,7 +1042,6 @@ def _classify_400(
            "encrypted content for item" in error_msg
            and "could not be verified" in error_msg
        )
-        or "could not decrypt the provided encrypted_content" in error_msg
    ):
        return result_fn(
            FailoverReason.invalid_encrypted_content,
@@ -1317,7 +1164,15 @@ def _classify_by_error_code(
            should_rotate_credential=True,
        )

-    if code_lower in _BILLING_ERROR_CODES:
+    if code_lower in {
+        "insufficient_quota",
+        "billing_not_active",
+        "payment_required",
+        "insufficient_credits",
+        "no_usable_credits",
+        "balance_depleted",
+        "model_not_supported_on_free_tier",
+    }:
        return result_fn(
            FailoverReason.billing,
            retryable=False,
@@ -1590,49 +1445,3 @@ def _extract_message(error: Exception, body: dict) -> str:
            return msg.strip()[:500]
    # Fallback to str(error)
    return str(error)[:500]
-
-
-def _is_openrouter_upstream_error(body: Any, provider: str) -> bool:
-    """Detect OpenRouter's aggregator-wrapped upstream provider errors.
-
-    OpenRouter returns errors from upstream model providers (DeepSeek,
-    Anthropic, etc.) wrapped with the outer message "Provider returned error"
-    and the real error nested in ``metadata.raw``. This signal means the
-    user's OpenRouter key is healthy — the upstream provider is the one that
-    failed — so credential rotation is the wrong recovery.
-    """
-    if not isinstance(body, dict):
-        return False
-    provider_lower = (provider or "").strip().lower()
-    err = body.get("error")
-    if not isinstance(err, dict):
-        return False
-    outer_msg = str(err.get("message") or "").strip().lower()
-    if outer_msg != "provider returned error":
-        return False
-    # Require either the explicit OpenRouter provider OR the metadata shape
-    # that only OpenRouter produces (metadata.raw / metadata.provider_name).
-    if provider_lower == "openrouter":
-        return True
-    metadata = err.get("metadata")
-    if isinstance(metadata, dict) and (
-        "raw" in metadata or "provider_name" in metadata
-    ):
-        return True
-    return False
-
-
-def _extract_upstream_provider_name(body: Any) -> Optional[str]:
-    """Pull the upstream provider name out of OpenRouter's error metadata."""
-    if not isinstance(body, dict):
-        return None
-    err = body.get("error")
-    if not isinstance(err, dict):
-        return None
-    metadata = err.get("metadata")
-    if not isinstance(metadata, dict):
-        return None
-    name = metadata.get("provider_name")
-    if isinstance(name, str) and name.strip():
-        return name.strip()
-    return None
@@ -1,9 +1,3 @@
 class SSLConfigurationError(Exception):
    """Raised when SSL/TLS certificate bundle configuration fails."""
    pass
-
-
-class EmptyStreamError(RuntimeError):
-    """Raised when a provider closes a stream without yielding a response."""
-
-    pass
@@ -95,16 +95,16 @@ def get_safe_write_roots() -> set[str]:
    return roots


-def _classify_write_denial(path: str) -> Optional[str]:
-    """Return ``'credential'``, ``'safe_root'``, or ``None`` if writes are allowed."""
+def is_write_denied(path: str) -> bool:
+    """Return True if path is blocked by the write denylist or safe root."""
    home = os.path.realpath(os.path.expanduser("~"))
    resolved = os.path.realpath(os.path.expanduser(str(path)))

    if resolved in build_write_denied_paths(home):
-        return "credential"
+        return True
    for prefix in build_write_denied_prefixes(home):
        if resolved.startswith(prefix):
-            return "credential"
+            return True

    mcp_tokens_dir_name = "mcp-tokens"

@@ -118,27 +118,16 @@ def _classify_write_denial(path: str) -> Optional[str]:
            continue

    for base_real in hermes_dirs:
-        # Session transcripts are application-owned state.  Letting the agent's
-        # generic file tools rewrite state.db or legacy JSON snapshots can
-        # falsify conversation history and invalidate resume/compression state.
-        try:
-            if resolved == os.path.realpath(os.path.join(base_real, "state.db")):
-                return True
-            sessions_real = os.path.realpath(os.path.join(base_real, "sessions"))
-            if resolved == sessions_real or resolved.startswith(sessions_real + os.sep):
-                return True
-        except Exception:
-            pass
        try:
            mcp_real = os.path.realpath(os.path.join(base_real, mcp_tokens_dir_name))
            if resolved == mcp_real or resolved.startswith(mcp_real + os.sep):
-                return "credential"
+                return True
        except Exception:
            pass
        try:
            pairing_real = os.path.realpath(os.path.join(base_real, "pairing"))
            if resolved == pairing_real or resolved.startswith(pairing_real + os.sep):
-                return "credential"
+                return True
        except Exception:
            pass

@@ -150,28 +139,9 @@ def _classify_write_denial(path: str) -> Optional[str]:
                allowed = True
                break
        if not allowed:
-            return "safe_root"
+            return True

-    return None
-
-
-def is_write_denied(path: str) -> bool:
-    """Return True if path is blocked by the write denylist or safe root."""
-    return _classify_write_denial(path) is not None
-
-
-def get_write_denied_error(path: str, *, verb: str = "Write") -> Optional[str]:
-    """Return a user/model-facing error when writes to ``path`` are blocked."""
-    denial = _classify_write_denial(path)
-    if denial is None:
-        return None
-    if denial == "safe_root":
-        roots_display = os.pathsep.join(sorted(get_safe_write_roots()))
-        return (
-            f"{verb} denied: '{path}' is outside HERMES_WRITE_SAFE_ROOT "
-            f"({roots_display}). Unset the variable or add this path's directory prefix."
-        )
-    return f"{verb} denied: '{path}' is a protected system/credential file."
+    return False


 # Common secret-bearing project-local environment file basenames.
@@ -323,7 +293,7 @@ def get_read_block_error(path: str) -> Optional[str]:
    # .env contents — .env.example is the documented-shape substitute. The
    # terminal tool can still ``cat .env``; this is defense-in-depth, not a
    # boundary (see module docstring).
-    if resolved.name.lower() in _BLOCKED_PROJECT_ENV_BASENAMES:
+    if resolved.name in _BLOCKED_PROJECT_ENV_BASENAMES:
        return (
            f"Access denied: {path} is a secret-bearing environment file "
            "and cannot be read to prevent credential leakage. "
@@ -334,30 +304,6 @@ def get_read_block_error(path: str) -> Optional[str]:
    return None


-def raise_if_read_blocked(path: str) -> None:
-    """Raise ``ValueError`` if ``path`` is a denied Hermes read (see
-    :func:`get_read_block_error`), else return.
-
-    Shared chokepoint for provider input-loading sites that read a local
-    file the model/tool supplied (e.g. image-gen ``image_url`` /
-    ``reference_image_urls`` paths). Centralizes the guard so every provider
-    enforces the same read boundary with identical semantics instead of each
-    open-coding the try/except block (#57698).
-
-    Best-effort by design: if ``agent.file_safety`` machinery is somehow
-    unavailable at the call site the guard no-ops rather than breaking local
-    image loading — consistent with the defense-in-depth (not security
-    boundary) framing of the denylist itself. The blocking ``ValueError`` from
-    a real hit still propagates; only unexpected internal errors are swallowed.
-    """
-    try:
-        blocked = get_read_block_error(path)
-    except Exception:  # noqa: BLE001 - guard must never break local-file loading
-        return
-    if blocked:
-        raise ValueError(blocked)
-
-
 # ---------------------------------------------------------------------------
 # Cross-profile write guard (#TBD)
 #
@@ -27,18 +27,10 @@ from typing import Any, Dict, Iterator, List, Optional

 import httpx

-from agent.bounded_response import read_streaming_error_body
 from agent.gemini_schema import sanitize_gemini_tool_parameters

 logger = logging.getLogger(__name__)

-try:
-    import hermes_cli as _hermes_cli
-
-    _HERMES_VERSION = str(_hermes_cli.__version__)
-except Exception:
-    _HERMES_VERSION = "0.0.0"
-
 DEFAULT_GEMINI_BASE_URL = "https://generativelanguage.googleapis.com/v1beta"

 # Published max output-token ceiling shared by every current Gemini text model
@@ -106,10 +98,7 @@ def probe_gemini_tier(
                url,
                params={"key": key},
                json=payload,
-                headers={
-                    "Content-Type": "application/json",
-                    "X-Goog-Api-Client": f"hermes-agent/{_HERMES_VERSION}",
-                },
+                headers={"Content-Type": "application/json"},
            )
    except Exception as exc:
        logger.debug("probe_gemini_tier: network error: %s", exc)
@@ -348,22 +337,6 @@ def _build_gemini_contents(messages: List[Dict[str, Any]]) -> tuple[List[Dict[st
        if parts:
            contents.append({"role": gemini_role, "parts": parts})

-    # Gemini's generateContent requires strict user/model alternation;
-    # consecutive same-role contents are rejected with HTTP 400 "Please ensure
-    # that multiturn requests alternate between user and model". The loop above
-    # emits one content per source message, so parallel tool calls (N tool
-    # results become N user functionResponse contents), back-to-back user turns,
-    # or merged assistant turns would each violate that. Merge adjacent
-    # same-role contents by concatenating their parts. For parallel calls this
-    # also produces the grouped multi-functionResponse turn Gemini expects.
-    merged_contents: List[Dict[str, Any]] = []
-    for content in contents:
-        if merged_contents and merged_contents[-1]["role"] == content["role"]:
-            merged_contents[-1]["parts"].extend(content["parts"])
-        else:
-            merged_contents.append(content)
-    contents = merged_contents
-
    system_instruction = None
    joined_system = "\n".join(part for part in system_text_parts if part).strip()
    if joined_system:
@@ -753,17 +726,14 @@ def translate_stream_event(event: Dict[str, Any], model: str, tool_call_indices:
    return chunks


-def gemini_http_error(
-    response: httpx.Response, *, body_text: Optional[str] = None
-) -> GeminiAPIError:
+def gemini_http_error(response: httpx.Response) -> GeminiAPIError:
    status = response.status_code
+    body_text = ""
    body_json: Dict[str, Any] = {}
-    if body_text is None:
-        try:
-            body_text = response.text
-        except Exception:
-            body_text = ""
-    body_text = body_text or ""
+    try:
+        body_text = response.text
+    except Exception:
+        body_text = ""
    if body_text:
        try:
            parsed = json.loads(body_text)
@@ -911,11 +881,7 @@ class GeminiNativeClient:
            "Content-Type": "application/json",
            "Accept": "application/json",
            "x-goog-api-key": self.api_key,
-            # Include Hermes client context following Gemini's partner
-            # integration guidance.
-            # See https://ai.google.dev/gemini-api/docs/partner-integration
-            "User-Agent": f"hermes-agent/{_HERMES_VERSION} (gemini-native)",
-            "X-Goog-Api-Client": f"hermes-agent/{_HERMES_VERSION}",
+            "User-Agent": "hermes-agent (gemini-native)",
        }
        headers.update(self._default_headers)
        return headers
@@ -986,8 +952,8 @@ class GeminiNativeClient:
            try:
                with self._http.stream("POST", url, json=request, headers=stream_headers, timeout=timeout) as response:
                    if response.status_code != 200:
-                        body_text = read_streaming_error_body(response)
-                        raise gemini_http_error(response, body_text=body_text)
+                        response.read()
+                        raise gemini_http_error(response)
                    tool_call_indices: Dict[str, Dict[str, Any]] = {}
                    for event in _iter_sse_events(response):
                        for chunk in translate_stream_event(event, model, tool_call_indices):
@@ -87,30 +87,6 @@ def sanitize_gemini_schema(schema: Any) -> Dict[str, Any]:
        if any(not isinstance(item, str) for item in enum_val):
            cleaned.pop("enum", None)

-    # Gemini validates ``required`` strictly against the same node's
-    # ``properties`` — GenerateContentRequest fails with HTTP 400
-    # "...items.required[0]: property is not defined" when a required name
-    # has no matching property in that node.  MCP servers routinely emit
-    # this shape (e.g. the GitHub remote MCP's array item schemas carry
-    # ``required`` without ``properties``), and one bad tool schema fails
-    # the ENTIRE request before any model output.  Filter ``required`` to
-    # names that exist in this node's ``properties`` and drop it when
-    # nothing valid remains.  The tool handler still validates required
-    # fields at execution time, so this only removes what Gemini couldn't
-    # accept anyway.  (Port of Kilo-Org/kilocode#11955.)
-    required_val = cleaned.get("required")
-    if isinstance(required_val, list):
-        props_val = cleaned.get("properties")
-        prop_names = set(props_val.keys()) if isinstance(props_val, dict) else set()
-        valid_required = [
-            name for name in required_val
-            if isinstance(name, str) and name in prop_names
-        ]
-        if not valid_required:
-            cleaned.pop("required", None)
-        elif len(valid_required) != len(required_val):
-            cleaned["required"] = valid_required
-
    return cleaned


@@ -17,17 +17,13 @@ It reads ``agent.image_input_mode`` from config.yaml (``auto`` | ``native``
 | ``text``, default ``auto``) and the active model's capability metadata.

 In ``auto`` mode:
-  - If the active model reports ``supports_vision=True`` (via config
-    override or models.dev metadata), we attach natively — vision-capable
-    main models should always see the original pixels, even when an
-    auxiliary vision backend is configured. That auxiliary backend then
-    acts as a *fallback* for sessions whose main model can't take images.
-  - Otherwise, if the user has explicitly configured ``auxiliary.vision``
-    (provider/model/base_url not ``auto``/empty), we route through the
-    text pipeline so the auxiliary vision backend can describe the image
-    for the text-only main model.
-  - Otherwise (non-vision model, no explicit override), we fall back to
-    text via the default vision_analyze flow.
+  - If the user has explicitly configured ``auxiliary.vision.provider``
+    (i.e. not ``auto`` and not empty), we assume they want the text pipeline
+    regardless of the main model — they've opted in to a specific vision
+    backend for a reason (cost, quality, local-only, etc.).
+  - Otherwise, if the active model reports ``supports_vision=True`` in its
+    models.dev metadata, we attach natively.
+  - Otherwise (non-vision model, no explicit override), we fall back to text.

 This keeps ``vision_analyze`` surfaced as a tool in every session — skills
 and agent flows that chain it (browser screenshots, deeper inspection of
@@ -189,8 +185,7 @@ def _supports_vision_override(
      2. ``providers.<provider>.models.<model>.supports_vision``
         (named custom providers — ``provider`` may be the runtime-resolved
         value ``"custom"`` and/or the user-declared name under
-         ``model.provider``; both are tried. For ``custom:<name>`` syntax,
-         the stripped ``<name>`` is also tried as a provider key.)
+         ``model.provider``; both are tried)

    Returns None when no override is set, so the caller falls through to
    models.dev. Returns False explicitly only when the user wrote a
@@ -210,16 +205,11 @@ def _supports_vision_override(
    # get rewritten to provider="custom" at runtime
    # (hermes_cli/runtime_provider.py:_resolve_named_custom_runtime), so the
    # config still holds the user-declared name under model.provider. Try
-    # both as candidate provider keys, plus the stripped suffix from
-    # "custom:<name>" (where <name> is the key under providers:).
+    # both as candidate provider keys.
    config_provider = str(model_cfg.get("provider") or "").strip()
-    # Extract the stripped name from "custom:<name>" if present
-    stripped_suffix = ""
-    if config_provider.startswith("custom:"):
-        stripped_suffix = config_provider[len("custom:"):]
    providers_raw = cfg.get("providers")
    providers_cfg: Dict[str, Any] = providers_raw if isinstance(providers_raw, dict) else {}
-    for p in dict.fromkeys(filter(None, (provider, config_provider, stripped_suffix))):
+    for p in dict.fromkeys(filter(None, (provider, config_provider))):
        entry_raw = providers_cfg.get(p)
        entry: Dict[str, Any] = entry_raw if isinstance(entry_raw, dict) else {}
        models_raw = entry.get("models")
@@ -267,12 +257,10 @@ def _resolve_inference_base_url(
 ) -> str:
    """Best-effort base URL for the active inference provider."""
    try:
-        from agent.auxiliary_client import _runtime_main_value
+        from agent.auxiliary_client import _RUNTIME_MAIN_BASE_URL

-        runtime = str(_runtime_main_value("base_url") or "").strip()
-        runtime_provider = str(_runtime_main_value("provider") or "").strip().lower()
-        requested_provider = str(provider or "").strip().lower()
-        if runtime and (not requested_provider or requested_provider == runtime_provider):
+        runtime = str(_RUNTIME_MAIN_BASE_URL or "").strip()
+        if runtime:
            return runtime
    except Exception:
        pass
@@ -348,10 +336,8 @@ def _coerce_mode(raw: Any) -> str:
 def _explicit_aux_vision_override(cfg: Optional[Dict[str, Any]]) -> bool:
    """True when the user configured a specific auxiliary vision backend.

-    An explicit override means the user has a dedicated vision backend
-    available; it's used as a *fallback* when the main model can't take
-    images natively. In ``auto`` mode, native vision on a vision-capable
-    main model still wins over this fallback — see issue #29135.
+    An explicit override means the user *wants* the text pipeline (they're
+    paying for a dedicated vision model), so we don't silently bypass it.
    """
    if not isinstance(cfg, dict):
        return False
@@ -440,15 +426,13 @@ def decide_image_input_mode(
    if mode_cfg == "text":
        return "text"

-    # auto: prefer native vision when the main model supports it. An
-    # explicit auxiliary.vision config acts as a *fallback* for text-only
-    # main models — it should not preempt native vision on a model that
-    # can natively inspect the pixels (issue #29135).
+    # auto
+    if _explicit_aux_vision_override(cfg):
+        return "text"
+
    supports = _lookup_supports_vision(provider, model, cfg)
    if supports is True:
        return "native"
-    if _explicit_aux_vision_override(cfg):
-        return "text"
    return "text"


@@ -634,17 +618,6 @@ def _file_to_data_url(path: Path) -> Optional[str]:
    caller reports those paths in ``skipped`` and the rest of the turn
    proceeds.
    """
-    try:
-        from agent.file_safety import raise_if_read_blocked
-
-        raise_if_read_blocked(str(path))
-    except ValueError as exc:
-        logger.warning("image_routing: blocked local image attachment %s -- %s", path, exc)
-        return None
-    except Exception:
-        # Keep attachment routing best-effort if the guard itself is unavailable.
-        pass
-
    try:
        raw = path.read_bytes()
    except Exception as exc:
@@ -17,7 +17,6 @@ Usage:
 """

 import json
-import sqlite3
 import time
 from collections import Counter, defaultdict
 from datetime import datetime
@@ -142,8 +141,8 @@ class InsightsEngine:
            }

        # Compute insights
-        models = self._compute_model_breakdown(sessions, cutoff, source)
-        overview = self._compute_overview(sessions, message_stats, models)
+        overview = self._compute_overview(sessions, message_stats)
+        models = self._compute_model_breakdown(sessions)
        platforms = self._compute_platform_breakdown(sessions)
        tools = self._compute_tool_breakdown(tool_usage)
        skills = self._compute_skill_breakdown(skill_usage)
@@ -173,7 +172,7 @@ class InsightsEngine:
                     "message_count, tool_call_count, input_tokens, output_tokens, "
                     "cache_read_tokens, cache_write_tokens, billing_provider, "
                     "billing_base_url, billing_mode, estimated_cost_usd, "
-                     "actual_cost_usd, cost_status, cost_source, api_call_count")
+                     "actual_cost_usd, cost_status, cost_source")

    # Pre-computed query strings — f-string evaluated once at class definition,
    # not at runtime, so no user-controlled value can alter the query structure.
@@ -400,12 +399,7 @@ class InsightsEngine:
    # Computation
    # =========================================================================

-    def _compute_overview(
-        self,
-        sessions: List[Dict],
-        message_stats: Dict,
-        models: Optional[List[Dict]] = None,
-    ) -> Dict:
+    def _compute_overview(self, sessions: List[Dict], message_stats: Dict) -> Dict:
        """Compute high-level overview statistics."""
        total_input = sum(s.get("input_tokens") or 0 for s in sessions)
        total_output = sum(s.get("output_tokens") or 0 for s in sessions)
@@ -437,21 +431,6 @@ class InsightsEngine:
            else:
                models_without_pricing.add(display)

-        if models:
-            total_cost = sum(float(m.get("cost") or 0.0) for m in models)
-            # Token totals likewise: the per-model breakdown includes
-            # auxiliary usage rows (vision/compression/titles — task
-            # dimension in session_model_usage, #23270) plus reconciled
-            # residuals, while the sessions counters carry main-loop usage
-            # only. Summing the breakdown keeps overview totals consistent
-            # with the per-model table and stops `hermes insights`
-            # undercounting aux spend (#58592, #9979).
-            total_input = sum(int(m.get("input_tokens") or 0) for m in models)
-            total_output = sum(int(m.get("output_tokens") or 0) for m in models)
-            total_cache_read = sum(int(m.get("cache_read_tokens") or 0) for m in models)
-            total_cache_write = sum(int(m.get("cache_write_tokens") or 0) for m in models)
-            total_tokens = total_input + total_output + total_cache_read + total_cache_write
-
        # Session duration stats (guard against negative durations from clock drift)
        durations = []
        for s in sessions:
@@ -494,189 +473,39 @@ class InsightsEngine:
            "included_cost_sessions": included_cost_sessions,
        }

-    _GET_MODEL_USAGE_WITH_SOURCE = (
-        "SELECT u.session_id, u.model, u.billing_provider, u.billing_base_url,"
-        " u.api_call_count, u.input_tokens, u.output_tokens,"
-        " u.cache_read_tokens, u.cache_write_tokens, u.reasoning_tokens,"
-        " u.estimated_cost_usd, u.actual_cost_usd, u.cost_status,"
-        " u.cost_source, u.billing_mode"
-        " FROM session_model_usage u"
-        " JOIN sessions s ON s.id = u.session_id"
-        " WHERE s.started_at >= ? AND s.source = ?"
-    )
-    _GET_MODEL_USAGE_ALL = (
-        "SELECT u.session_id, u.model, u.billing_provider, u.billing_base_url,"
-        " u.api_call_count, u.input_tokens, u.output_tokens,"
-        " u.cache_read_tokens, u.cache_write_tokens, u.reasoning_tokens,"
-        " u.estimated_cost_usd, u.actual_cost_usd, u.cost_status,"
-        " u.cost_source, u.billing_mode"
-        " FROM session_model_usage u"
-        " JOIN sessions s ON s.id = u.session_id"
-        " WHERE s.started_at >= ?"
-    )
-
-    def _get_model_usage(self, cutoff: float, source: str = None) -> List[Dict]:
-        """Fetch per-model usage rows within the window (issue #51607).
-
-        Returns an empty list when the table is missing (e.g. a DB opened by
-        older code that never created it) so the caller can fall back to the
-        per-session aggregate.
-        """
-        try:
-            if source:
-                cursor = self._conn.execute(
-                    self._GET_MODEL_USAGE_WITH_SOURCE, (cutoff, source)
-                )
-            else:
-                cursor = self._conn.execute(self._GET_MODEL_USAGE_ALL, (cutoff,))
-            return [dict(row) for row in cursor.fetchall()]
-        except sqlite3.OperationalError:
-            return []
-
-    def _compute_model_breakdown(
-        self, sessions: List[Dict], cutoff: float, source: str = None
-    ) -> List[Dict]:
-        """Break down token usage and cost by model.
-
-        Tokens and cost are attributed per model from session_model_usage, so a
-        session that switched models mid-flight (via ``/model``) splits across
-        every model it used instead of dumping everything on the initial model
-        (issue #51607). Sessions without per-model rows — e.g. data written
-        before this table existed and not yet backfilled — fall back to their
-        single recorded (model, billing_provider) aggregate so nothing is lost.
-
-        Tool calls aren't tied to a specific API invocation, so they stay
-        attributed to the session's recorded model.
-        """
+    def _compute_model_breakdown(self, sessions: List[Dict]) -> List[Dict]:
+        """Break down usage by model."""
        model_data = defaultdict(lambda: {
-            "sessions": set(), "input_tokens": 0, "output_tokens": 0,
+            "sessions": 0, "input_tokens": 0, "output_tokens": 0,
            "cache_read_tokens": 0, "cache_write_tokens": 0,
-            "reasoning_tokens": 0, "total_tokens": 0, "api_calls": 0,
-            "tool_calls": 0, "cost": 0.0, "actual_cost": 0.0,
+            "total_tokens": 0, "tool_calls": 0, "cost": 0.0,
        })

-        def _accumulate(model, provider, base_url, session_id, inp, out,
-                        cache_read, cache_write, reasoning, *,
-                        stored_cost=None, actual_cost=None, cost_status=None):
-            model = model or "unknown"
+        for s in sessions:
+            model = s.get("model") or "unknown"
            # Normalize: strip provider prefix for display
            display_model = model.split("/")[-1] if "/" in model else model
-            d: Dict[str, Any] = model_data[display_model]
-            d["sessions"].add(session_id)
+            d = model_data[display_model]
+            d["sessions"] += 1
+            inp = s.get("input_tokens") or 0
+            out = s.get("output_tokens") or 0
+            cache_read = s.get("cache_read_tokens") or 0
+            cache_write = s.get("cache_write_tokens") or 0
            d["input_tokens"] += inp
            d["output_tokens"] += out
            d["cache_read_tokens"] += cache_read
            d["cache_write_tokens"] += cache_write
-            d["reasoning_tokens"] += reasoning
            d["total_tokens"] += inp + out + cache_read + cache_write
-            if stored_cost is None:
-                estimate, status = _estimate_cost(
-                    model, inp, out,
-                    cache_read_tokens=cache_read, cache_write_tokens=cache_write,
-                    provider=provider or None, base_url=base_url,
-                )
-            else:
-                estimate = float(stored_cost or 0.0)
-                status = cost_status or "unknown"
+            d["tool_calls"] += s.get("tool_call_count") or 0
+            estimate, status = _estimate_cost(s)
            d["cost"] += estimate
-            d["actual_cost"] += float(actual_cost or 0.0)
+            d["has_pricing"] = has_known_pricing(model, s.get("billing_provider"), s.get("billing_base_url"))
            d["cost_status"] = status
-            if has_known_pricing(model, provider or None, base_url):
-                d["has_pricing"] = True
-            else:
-                d.setdefault("has_pricing", False)
-            return display_model

-        usage_rows = self._get_model_usage(cutoff, source)
-        usage_totals = defaultdict(lambda: {
-            "input_tokens": 0, "output_tokens": 0, "cache_read_tokens": 0,
-            "cache_write_tokens": 0, "reasoning_tokens": 0,
-            "api_call_count": 0, "estimated_cost_usd": 0.0,
-            "actual_cost_usd": 0.0,
-        })
-        for r in usage_rows:
-            totals: Dict[str, Any] = usage_totals[r["session_id"]]
-            for key in (
-                "input_tokens", "output_tokens", "cache_read_tokens",
-                "cache_write_tokens", "reasoning_tokens", "api_call_count",
-            ):
-                totals[key] += r[key] or 0
-            totals["estimated_cost_usd"] += r["estimated_cost_usd"] or 0.0
-            totals["actual_cost_usd"] += r["actual_cost_usd"] or 0.0
-            d = _accumulate(
-                r["model"], r["billing_provider"], r.get("billing_base_url"),
-                r["session_id"], r["input_tokens"] or 0, r["output_tokens"] or 0,
-                r["cache_read_tokens"] or 0, r["cache_write_tokens"] or 0,
-                r["reasoning_tokens"] or 0,
-                stored_cost=(
-                    r["estimated_cost_usd"]
-                    if r.get("cost_status") or r.get("cost_source")
-                    else None
-                ),
-                actual_cost=r["actual_cost_usd"],
-                cost_status=r.get("cost_status"),
-            )
-            model_data[d]["api_calls"] += r["api_call_count"] or 0
-
-        # Reconcile against the aggregate row. This covers legacy sessions,
-        # interrupted migrations, and absolute cumulative updates without
-        # double-counting already-attributed route deltas.
-        for s in sessions:
-            totals = usage_totals[s["id"]]
-            inp = max(0, (s.get("input_tokens") or 0) - totals["input_tokens"])
-            out = max(0, (s.get("output_tokens") or 0) - totals["output_tokens"])
-            cache_read = max(
-                0, (s.get("cache_read_tokens") or 0) - totals["cache_read_tokens"]
-            )
-            cache_write = max(
-                0, (s.get("cache_write_tokens") or 0) - totals["cache_write_tokens"]
-            )
-            residual_cost = max(
-                0.0, float(s.get("estimated_cost_usd") or 0.0)
-                - totals["estimated_cost_usd"],
-            )
-            residual_actual = max(
-                0.0, float(s.get("actual_cost_usd") or 0.0)
-                - totals["actual_cost_usd"],
-            )
-            residual_calls = max(
-                0, (s.get("api_call_count") or 0) - totals["api_call_count"]
-            )
-            if not (
-                inp or out or cache_read or cache_write or residual_cost
-                or residual_actual or residual_calls
-            ):
-                continue
-            d = _accumulate(
-                s.get("model"), s.get("billing_provider"),
-                s.get("billing_base_url"), s["id"],
-                inp, out, cache_read, cache_write, 0,
-                stored_cost=residual_cost,
-                actual_cost=residual_actual,
-                cost_status=s.get("cost_status"),
-            )
-            residual_bucket: Dict[str, Any] = model_data[d]
-            residual_bucket["api_calls"] += residual_calls
-
-        # Tool calls are attributed by the session's recorded model.
-        for s in sessions:
-            tool_calls = s.get("tool_call_count") or 0
-            if not tool_calls:
-                continue
-            model = s.get("model") or "unknown"
-            display_model = model.split("/")[-1] if "/" in model else model
-            model_data[display_model]["tool_calls"] += tool_calls
-
-        result = []
-        for model, data in model_data.items():
-            entry = {"model": model, **data}
-            entry["sessions"] = len(data["sessions"])
-            # Models that surfaced only via tool-call attribution (no token
-            # rows) won't have these set by _accumulate — default them so the
-            # output shape is uniform for downstream/JSON consumers.
-            entry.setdefault("has_pricing", False)
-            entry.setdefault("cost_status", "unknown")
-            result.append(entry)
+        result = [
+            {"model": model, **data}
+            for model, data in model_data.items()
+        ]
        # Sort by tokens first, fall back to session count when tokens are 0
        result.sort(key=lambda x: (x["total_tokens"], x["sessions"]), reverse=True)
        return result
@@ -1,108 +0,0 @@
-"""Turn-end guard for kanban workers.
-
-Kanban workers must end with ``kanban_complete`` or ``kanban_block``. Models
-(especially GLM / Qwen families) sometimes narrate the next step
-("Let me write the report now") and stop with ``finish_reason=stop`` and no
-tool calls. Hermes treats that as a clean exit → ``rc=0`` → dispatcher
-``protocol_violation``.
-
-This module is policy-only: when a kanban worker tries to finish without a
-terminal board tool, return a bounded synthetic nudge so the conversation
-loop continues instead of exiting.
-"""
-
-from __future__ import annotations
-
-import os
-from typing import Any, Iterable, Optional
-
-
-_TERMINAL_KANBAN_TOOLS = frozenset({"kanban_complete", "kanban_block"})
-
-_DEFAULT_MAX_ATTEMPTS = 2
-
-
-def kanban_stop_nudge_enabled() -> bool:
-    """Return whether the kanban stop-guard is active for this process.
-
-    On when ``HERMES_KANBAN_TASK`` is set (dispatcher-spawned worker), unless
-    ``HERMES_KANBAN_STOP_NUDGE`` explicitly disables it.
-    """
-    env = os.environ.get("HERMES_KANBAN_STOP_NUDGE")
-    if env is not None and env.strip().lower() in {"0", "false", "no", "off"}:
-        return False
-    task = (os.environ.get("HERMES_KANBAN_TASK") or "").strip()
-    return bool(task)
-
-
-def _tool_call_name(tc: Any) -> str:
-    if isinstance(tc, dict):
-        fn = tc.get("function")
-        if isinstance(fn, dict):
-            return str(fn.get("name") or "")
-        return str(tc.get("name") or "")
-    fn = getattr(tc, "function", None)
-    if fn is not None:
-        return str(getattr(fn, "name", "") or "")
-    return str(getattr(tc, "name", "") or "")
-
-
-def session_called_kanban_terminal(messages: Iterable[dict] | None) -> bool:
-    """True if this conversation already invoked a terminal kanban tool."""
-    if not messages:
-        return False
-    for msg in messages:
-        if not isinstance(msg, dict):
-            continue
-        role = msg.get("role")
-        if role == "assistant":
-            for tc in msg.get("tool_calls") or []:
-                if _tool_call_name(tc) in _TERMINAL_KANBAN_TOOLS:
-                    return True
-        elif role == "tool":
-            name = str(msg.get("name") or "")
-            if name in _TERMINAL_KANBAN_TOOLS:
-                return True
-    return False
-
-
-def build_kanban_stop_nudge(
-    *,
-    messages: Iterable[dict] | None = None,
-    attempts: int = 0,
-    max_attempts: int = _DEFAULT_MAX_ATTEMPTS,
-    task_id: Optional[str] = None,
-) -> Optional[str]:
-    """Return a synthetic follow-up when a kanban worker exits without a terminal tool.
-
-    Returns ``None`` when the guard should not fire (not a kanban worker,
-    already completed/blocked, or nudge budget exhausted).
-    """
-    if not kanban_stop_nudge_enabled():
-        return None
-    if attempts >= max_attempts:
-        return None
-    if session_called_kanban_terminal(messages):
-        return None
-
-    tid = (task_id or os.environ.get("HERMES_KANBAN_TASK") or "").strip() or "this task"
-    return (
-        "[System: You are a Hermes kanban worker. A plain-text reply is NOT a "
-        "terminal state for the board.\n\n"
-        f"Task `{tid}` is still `running`. Ending now without a board tool "
-        "causes a protocol violation (clean exit with no "
-        "`kanban_complete` / `kanban_block`).\n\n"
-        "Do this immediately in your next response — do not narrate intent:\n"
-        "1. Finish any remaining deliverable (write the required file(s) now).\n"
-        "2. Call `kanban_complete(summary=..., artifacts=[...])` if the work "
-        "is done, OR `kanban_block(reason=...)` if you are blocked.\n\n"
-        "Never end a turn with only a promise of future action. Repeated "
-        "protocol violations will block this task and require manual intervention.]"
-    )
-
-
-__all__ = [
-    "build_kanban_stop_nudge",
-    "kanban_stop_nudge_enabled",
-    "session_called_kanban_terminal",
-]
@@ -117,29 +117,15 @@ def build_learn_prompt(user_request: str) -> str:

    return (
        "[/learn] The user wants you to learn a reusable skill from the "
-        "request below, and save it.\n\n"
-        f"THE REQUEST:\n{req}\n\n"
-        "The request is open-ended and may mix two kinds of content, in any "
-        "order: SOURCES to gather (directories, file paths, URLs, \"what we "
-        "just did\", pasted notes) AND REQUIREMENTS that shape the skill "
-        "(what to focus on, what to leave out, scope, naming, the angle to "
-        "take). Treat EVERY part of the request as load-bearing. In "
-        "particular, prose that comes after a path or link is NOT incidental "
-        "— it is the user telling you what they want from that source. A "
-        "request like `<url> focus on the auth flow, skip the deprecated "
-        "endpoints` means: gather the URL AND honor \"focus on auth, skip "
-        "deprecated\" as authoring requirements. Never fetch the first source "
-        "and ignore the rest.\n\n"
+        "source(s) they described below, and save it.\n\n"
+        f"WHAT TO LEARN FROM:\n{req}\n\n"
        "Do this:\n"
-        "1. Gather every source the user named, using the tools you already "
-        "have — `read_file`/`search_files` for local files or directories, "
-        "`web_extract` for URLs, the current conversation history if they "
-        "referred to something you just did, and the text they pasted as-is. "
-        "If the request is ambiguous about scope, make a reasonable choice "
-        "and note it; do not stall.\n"
-        "1b. Apply every requirement, focus, and constraint in the request to "
-        "the skill you author — these govern what the SKILL.md covers and "
-        "emphasizes, not just which sources you read.\n"
+        "1. Gather the material. Resolve whatever the user named using the "
+        "tools you already have — `read_file`/`search_files` for local files "
+        "or directories, `web_extract` for URLs, the current conversation "
+        "history if they referred to something you just did, and the text "
+        "they pasted as-is. If the request is ambiguous about scope, make a "
+        "reasonable choice and note it; do not stall.\n"
        "2. Author ONE SKILL.md and save it with the `skill_manage` tool "
        "(action=\"create\"). Pick a sensible category. If the procedure needs "
        "a non-trivial script, add it under the skill's `scripts/` with "
@@ -1,328 +0,0 @@
-"""Assemble the "learning made visible" graph for desktop.
-
-This graph is intentionally scoped to what a user actually learns over time:
- non-base, learned/profile skills (agent-created or used),
- memory chunks from ``MEMORY.md`` / ``USER.md`` as first-class nodes.
-
-Skill links come from declared ``related_skills``. Memory-to-skill links are
-derived from lexical overlap so the graph can answer "which learned skills are
-connected to the things I remember?".
-
-Run as a module to print edge-density stats against real data:
-
-    python -m agent.learning_graph
-"""
-
-from __future__ import annotations
-
-import json
-import re
-from dataclasses import dataclass, field
-from datetime import datetime, timezone
-from pathlib import Path
-from typing import Any, Optional
-
-from hermes_constants import get_hermes_home
-
-
-@dataclass
-class SkillNode:
-    name: str
-    category: str
-    source: str = "profile"
-    timestamp: Optional[int] = None
-    use_count: int = 0
-    state: str = "active"
-    created_by: Optional[str] = None
-    pinned: bool = False
-    related: list[str] = field(default_factory=list)
-
-
-def _frontmatter(text: str) -> dict[str, Any]:
-    try:
-        from agent.skill_utils import parse_frontmatter
-
-        fm, _ = parse_frontmatter(text)
-        return fm or {}
-    except Exception:
-        return {}
-
-
-def _hermes_meta(fm: dict[str, Any]) -> dict[str, Any]:
-    """``metadata.hermes`` as a dict, tolerant of the string-valued frontmatter
-    that ``parse_frontmatter``'s malformed-YAML fallback produces."""
-    meta = fm.get("metadata")
-    hermes = meta.get("hermes") if isinstance(meta, dict) else None
-    return hermes if isinstance(hermes, dict) else {}
-
-
-def _related(fm: dict[str, Any]) -> list[str]:
-    raw = fm.get("related_skills") or _hermes_meta(fm).get("related_skills")
-    if isinstance(raw, list):
-        return [str(r).strip() for r in raw if str(r).strip()]
-    if isinstance(raw, str):
-        return [r.strip() for r in raw.strip("[]").split(",") if r.strip()]
-    return []
-
-
-def _category(fm: dict[str, Any], skill_md: Path) -> str:
-    cat = fm.get("category") or _hermes_meta(fm).get("category")
-    if cat:
-        return str(cat)
-    # …/skills/<category>/<skill>/SKILL.md
-    parts = skill_md.parts
-    return parts[-3] if len(parts) >= 3 else "general"
-
-
-def _iter_skill_files(roots: list[tuple[str, Path]]):
-    for source, root in roots:
-        if root.exists():
-            for path in root.rglob("SKILL.md"):
-                yield source, path
-
-
-def _load_usage() -> dict[str, dict[str, Any]]:
-    try:
-        from tools.skill_usage import load_usage
-
-        return load_usage()
-    except Exception:
-        path = get_hermes_home() / "skills" / ".usage.json"
-        try:
-            return json.loads(path.read_text(encoding="utf-8"))
-        except Exception:
-            return {}
-
-
-def _to_int_ts(value: Any) -> Optional[int]:
-    try:
-        if value is None:
-            return None
-        if isinstance(value, (int, float)):
-            return int(value)
-        s = str(value).strip()
-        if not s:
-            return None
-        try:
-            return int(float(s))
-        except ValueError:
-            parsed = datetime.fromisoformat(s.replace("Z", "+00:00"))
-            if parsed.tzinfo is None:
-                parsed = parsed.replace(tzinfo=timezone.utc)
-            return int(parsed.timestamp())
-    except Exception:
-        return None
-
-
-def _usage_timestamp(rec: dict[str, Any]) -> Optional[int]:
-    for key in ("last_activity_at", "last_used_at", "last_viewed_at", "last_patched_at", "created_at"):
-        ts = _to_int_ts(rec.get(key))
-        if ts is not None:
-            return ts
-    return None
-
-
-def build_skill_nodes(skill_roots: list[tuple[str, Path]]) -> dict[str, SkillNode]:
-    usage = _load_usage()
-    nodes: dict[str, SkillNode] = {}
-
-    for source, skill_md in _iter_skill_files(skill_roots):
-        if any(p in {".archive", ".hub", "node_modules", ".git"} for p in skill_md.parts):
-            continue
-        try:
-            fm = _frontmatter(skill_md.read_text(encoding="utf-8")[:4000])
-        except OSError:
-            continue
-        name = str(fm.get("name") or skill_md.parent.name).strip()
-        if not name or name in nodes:
-            continue
-        rec = usage.get(name, {})
-        last_activity = _usage_timestamp(rec)
-        file_ts = _to_int_ts(skill_md.stat().st_mtime)
-        nodes[name] = SkillNode(
-            name=name,
-            category=_category(fm, skill_md),
-            source=source,
-            timestamp=last_activity or file_ts,
-            use_count=int(rec.get("use_count", 0) or 0),
-            state=str(rec.get("state", "active") or "active"),
-            created_by=rec.get("created_by"),
-            pinned=bool(rec.get("pinned", False)),
-            related=_related(fm),
-        )
-    return nodes
-
-
-def build_edges(nodes: dict[str, SkillNode]) -> list[tuple[str, str]]:
-    """Undirected related_skills edges where BOTH endpoints exist (deduped)."""
-    seen: set[tuple[str, str]] = set()
-    edges: list[tuple[str, str]] = []
-    for node in nodes.values():
-        for target in node.related:
-            if target in nodes and target != node.name:
-                a, b = sorted((node.name, target))
-                key = (a, b)
-                if key not in seen:
-                    seen.add(key)
-                    edges.append(key)
-    return edges
-
-
-def density_stats(nodes: dict[str, SkillNode], edges: list[tuple[str, str]]) -> dict[str, Any]:
-    linked: set[str] = set()
-    for a, b in edges:
-        linked.add(a)
-        linked.add(b)
-    cats: dict[str, int] = {}
-    for n in nodes.values():
-        cats[n.category] = cats.get(n.category, 0) + 1
-    n = len(nodes) or 1
-    return {
-        "nodes": len(nodes),
-        "related_edges": len(edges),
-        "edges_per_node": round(len(edges) / n, 3),
-        "linked_nodes": len(linked),
-        "isolated_pct": round(100 * (n - len(linked)) / n, 1),
-        "categories": len(cats),
-        "agent_created": sum(1 for x in nodes.values() if x.created_by == "agent"),
-        "used": sum(1 for x in nodes.values() if x.use_count > 0),
-        "top_categories": sorted(cats.items(), key=lambda kv: -kv[1])[:8],
-    }
-
-
-def _memory_cards() -> list[dict[str, Any]]:
-    """Freeform memory as readable cards.
-
-    ``MEMORY.md`` / ``USER.md`` are prose split on bare ``§`` separators; each
-    chunk becomes one card. Every chunk is surfaced — the graph shows everything.
-    """
-    base = get_hermes_home() / "memories"
-    cards: list[dict[str, Any]] = []
-    for fname, source in (("MEMORY.md", "memory"), ("USER.md", "profile")):
-        path = base / fname
-        try:
-            text = path.read_text(encoding="utf-8").strip()
-            file_ts = _to_int_ts(path.stat().st_mtime)
-        except OSError:
-            continue
-        for chunk_idx, chunk in enumerate(c.strip() for c in text.split("\n§\n")):
-            if not chunk:
-                continue
-            first = chunk.splitlines()[0].strip().lstrip("# ").strip()
-            cards.append(
-                {
-                    "source": source,
-                    "timestamp": file_ts + chunk_idx if file_ts is not None else None,
-                    "title": (first[:80] + "…") if len(first) > 80 else first,
-                    "body": chunk[:1200],
-                }
-            )
-    return cards
-
-
-def _tokenize(text: str) -> set[str]:
-    return {t for t in re.split(r"[^a-z0-9]+", text.lower()) if len(t) >= 3}
-
-
-def _memory_skill_edges(memory_cards: list[dict[str, Any]], skills: list[SkillNode]) -> list[tuple[str, str]]:
-    edges: list[tuple[str, str]] = []
-    skill_meta = [(s, _tokenize(s.name), s.name.lower()) for s in skills]
-    for idx, card in enumerate(memory_cards):
-        mem_id = f"memory:{card['source']}:{idx}"
-        text = f"{card.get('title', '')}\n{card.get('body', '')}".lower()
-        text_tokens = _tokenize(text)
-        scored: list[tuple[int, str]] = []
-        for skill, tokens, skill_name_lower in skill_meta:
-            score = 0
-            if skill_name_lower in text:
-                score += 6
-            score += len(tokens & text_tokens)
-            if score > 0:
-                scored.append((score, skill.name))
-        scored.sort(key=lambda x: (-x[0], x[1]))
-        for _, skill_name in scored[:4]:
-            edges.append((mem_id, skill_name))
-    return edges
-
-
-def _skill_roots() -> list[tuple[str, Path]]:
-    repo = Path(__file__).resolve().parent.parent
-    home_skills = get_hermes_home() / "skills"
-    return [("base", repo / "skills"), ("profile", home_skills)]
-
-
-def build_learning_graph() -> dict[str, Any]:
-    """Full payload for the desktop learning panel.
-
-    Focus on what is profile-learned and actionable:
-    - skills that are NOT base-installed and show real learning signal
-      (agent-created or used),
-    - memory chunks as first-class graph nodes connected to those learned skills.
-    """
-    all_skills = build_skill_nodes(_skill_roots())
-    learned_skills = {
-        name: node
-        for name, node in all_skills.items()
-        if node.source != "base" and (node.created_by == "agent" or node.use_count > 0)
-    }
-    skill_edges = build_edges(learned_skills)
-    memory_cards = _memory_cards()
-    memory_edges = _memory_skill_edges(memory_cards, list(learned_skills.values()))
-
-    edges = skill_edges + memory_edges
-    clusters: dict[str, int] = {}
-    for node in learned_skills.values():
-        clusters[node.category] = clusters.get(node.category, 0) + 1
-    if memory_cards:
-        clusters["memory"] = len(memory_cards)
-
-    graph_nodes = [
-        {
-            "id": n.name,
-            "label": n.name,
-            "kind": "skill",
-            "timestamp": n.timestamp,
-            "category": n.category,
-            "useCount": n.use_count,
-            "state": n.state,
-            "createdBy": n.created_by,
-            "pinned": n.pinned,
-        }
-        for n in learned_skills.values()
-    ]
-    for i, card in enumerate(memory_cards):
-        graph_nodes.append(
-            {
-                "id": f"memory:{card['source']}:{i}",
-                "label": card["title"],
-                "kind": "memory",
-                "memorySource": card["source"],
-                "timestamp": card.get("timestamp"),
-                "category": "memory",
-                "useCount": 0,
-                "state": "active",
-                "createdBy": "memory",
-                "pinned": False,
-            }
-        )
-
-    return {
-        "nodes": graph_nodes,
-        "edges": [{"source": a, "target": b} for a, b in edges],
-        "clusters": [
-            {"category": c, "count": n}
-            for c, n in sorted(clusters.items(), key=lambda kv: -kv[1])
-        ],
-        "memory": memory_cards,
-        "stats": {
-            **density_stats(learned_skills, skill_edges),
-            "memory_nodes": len(memory_cards),
-            "memory_skill_edges": len(memory_edges),
-            "learned_skills": len(learned_skills),
-        },
-    }
-
-
-if __name__ == "__main__":
-    nodes = build_skill_nodes(_skill_roots())
-    print(json.dumps(density_stats(nodes, build_edges(nodes)), indent=2))
@@ -1,659 +0,0 @@
-"""Terminal renderer for the learning timeline (learned skills + memories).
-
-The desktop app (``apps/desktop/src/app/starmap``) paints a GPU radial
-constellation; a terminal can't, so this is a *rendition* of the same data as a
-timeline bar chart — date rows, proportional skill/memory bars colored by the
-day's dominant category, and a cumulative trajectory sparkline — plus per-slice
-bucket metadata the TUI walks as a tree. The age gradient and complementary
-memory ink are ported from the desktop source, not guessed.
-
-Grids are emitted as style runs — ``[text, style, alpha, hex?]`` — so each
-consumer maps the semantic style + brightness onto its own palette; the
-optional 4th element overrides the base color (category heatmap). Pure,
-stdlib-only.
-"""
-
-from __future__ import annotations
-
-import math
-from datetime import datetime, timezone
-from typing import Any, Iterable, Optional
-
-# time-axis.ts LEAD_IN: the oldest node sits just off recency 0.
-LEAD_IN = 0.06
-
-# constants.ts AGE_GRADIENT — old quiet, recent bright.
-AGE_OLD_INK = 0.42
-AGE_MID_INK = 0.74
-AGE_NEW_INK = 0.95
-AGE_MID = 0.52
-
-# Style keys consumers map to base colors (brightness = the run alpha).
-STYLE_BG = "bg"
-STYLE_SKILL = "skill"
-STYLE_MEMORY = "memory"
-STYLE_LABEL = "label"
-STYLE_DIM = "dim"
-
-# Legend glyphs mirror NODE_SHAPE (skill = circle, memory = diamond).
-SKILL_GLYPH = "●"
-MEMORY_GLYPH = "◆"
-_LABEL_KEYS = tuple("123456789abc")
-
-Run = list  # [text, style, alpha, hex?]
-Row = list  # list[Run]
-Grid = list  # list[Row]
-
-
-def _to_ts(value: Any) -> Optional[float]:
-    try:
-        return None if value is None else float(value)
-    except (TypeError, ValueError):
-        return None
-
-
-def _clamp(v: float, lo: float, hi: float) -> float:
-    return lo if v < lo else hi if v > hi else v
-
-
-def _smoothstep(p: float) -> float:
-    p = _clamp(p, 0.0, 1.0)
-    return p * p * (3 - 2 * p)
-
-
-def recency_ink(rec: float) -> float:
-    """Port of geometry.ts ``recencyInk`` — smoothstep age → ink alpha."""
-    t = _clamp(rec, 0.0, 1.0)
-    if t <= AGE_MID:
-        return AGE_OLD_INK + (AGE_MID_INK - AGE_OLD_INK) * _smoothstep(t / AGE_MID)
-    return AGE_MID_INK + (AGE_NEW_INK - AGE_MID_INK) * _smoothstep((t - AGE_MID) / (1 - AGE_MID))
-
-
-def format_date(ts: Optional[float]) -> str:
-    if not ts:
-        return "unknown"
-    try:
-        dt = datetime.fromtimestamp(float(ts), tz=timezone.utc)
-        return f"{dt.day} {dt.strftime('%b %Y')}"
-    except (ValueError, OSError, OverflowError):
-        return "unknown"
-
-
-def compute_recency(nodes: list[dict[str, Any]]) -> dict[str, Any]:
-    """Port of time-axis.ts ``computeRecency`` (id → recency ratio, timed flag)."""
-    known = [t for t in (_to_ts(n.get("timestamp")) for n in nodes) if t is not None]
-    min_ts = min(known) if known else None
-    max_ts = max(known) if known else None
-    timed = min_ts is not None and max_ts is not None and max_ts > min_ts
-
-    ordered = sorted(
-        nodes,
-        key=lambda n: (
-            _to_ts(n.get("timestamp")) if _to_ts(n.get("timestamp")) is not None else math.inf,
-            str(n.get("id", "")),
-        ),
-    )
-    last = max(len(ordered) - 1, 1)
-    ord_ratio = {str(n.get("id", "")): (i / last if len(ordered) > 1 else 0.0) for i, n in enumerate(ordered)}
-
-    rec: dict[str, float] = {}
-    for n in nodes:
-        nid = str(n.get("id", ""))
-        ts = _to_ts(n.get("timestamp"))
-        if timed and ts is not None and min_ts is not None and max_ts is not None:
-            ratio = (ts - min_ts) / (max_ts - min_ts)
-        else:
-            ratio = ord_ratio.get(nid, 0.0)
-        rec[nid] = LEAD_IN + (1 - LEAD_IN) * _clamp(ratio, 0.0, 1.0)
-
-    return {"rec": rec, "timed": timed, "minTs": min_ts, "maxTs": max_ts}
-
-
-def _date_at(rec: dict[str, Any], reveal: float) -> Optional[float]:
-    if not rec.get("timed"):
-        return None
-    lo, hi = rec.get("minTs"), rec.get("maxTs")
-    if lo is None or hi is None:
-        return None
-    return round(lo + _clamp(reveal, 0, 1) * (hi - lo))
-
-
-# ── Color: ported from color.ts so memory ink + age fade match the desktop ──
-
-
-def hex_to_rgb(s: str) -> tuple[int, int, int]:
-    s = s.strip().lstrip("#")
-    if len(s) == 3:
-        s = "".join(c * 2 for c in s)
-    try:
-        return int(s[0:2], 16), int(s[2:4], 16), int(s[4:6], 16)
-    except (ValueError, IndexError):
-        return 255, 215, 0
-
-
-def rgb_to_hex(c: tuple) -> str:
-    return "#{:02X}{:02X}{:02X}".format(*(int(_clamp(v, 0, 255)) for v in c))
-
-
-def mix_rgb(a: tuple, b: tuple, t: float) -> tuple[int, int, int]:
-    p = _clamp(t, 0.0, 1.0)
-    return tuple(round(a[i] + (b[i] - a[i]) * p) for i in range(3))  # type: ignore[return-value]
-
-
-def _rgb_to_hsl(c: tuple) -> tuple[float, float, float]:
-    r, g, b = (x / 255 for x in c)
-    mx, mn = max(r, g, b), min(r, g, b)
-    light = (mx + mn) / 2
-    d = mx - mn
-    if not d:
-        return 0.0, 0.0, light
-    s = d / (2 - mx - mn) if light > 0.5 else d / (mx + mn)
-    if mx == r:
-        h = (g - b) / d + (6 if g < b else 0)
-    elif mx == g:
-        h = (b - r) / d + 2
-    else:
-        h = (r - g) / d + 4
-    return h * 60, s, light
-
-
-def _hsl_to_rgb(h: float, s: float, light: float) -> tuple[int, int, int]:
-    hue = ((h % 360) + 360) % 360
-    c = (1 - abs(2 * light - 1)) * s
-    x = c * (1 - abs(((hue / 60) % 2) - 1))
-    m = light - c / 2
-    if hue < 60:
-        r, g, b = c, x, 0.0
-    elif hue < 120:
-        r, g, b = x, c, 0.0
-    elif hue < 180:
-        r, g, b = 0.0, c, x
-    elif hue < 240:
-        r, g, b = 0.0, x, c
-    elif hue < 300:
-        r, g, b = x, 0.0, c
-    else:
-        r, g, b = c, 0.0, x
-    return round((r + m) * 255), round((g + m) * 255), round((b + m) * 255)
-
-
-def _complementary_ink(c: tuple) -> tuple[int, int, int]:
-    h, s, light = _rgb_to_hsl(c)
-    return _hsl_to_rgb(h + 165, max(s, 0.5), _clamp(light, 0.5, 0.7))
-
-
-def derive_palette(primary_hex: str, *, dark: bool = True) -> dict[str, str]:
-    """Port of color.ts ``computePalette`` (the bits a terminal needs)."""
-    primary = hex_to_rgb(primary_hex)
-    base = (255, 255, 255) if dark else (0, 0, 0)
-    bg = (8, 8, 12) if dark else (250, 250, 250)
-    return {
-        "primary": primary_hex,
-        # Memories are drillable → primary "clickable" ink; skills are dead-ends
-        # → muted complement.
-        "memory": rgb_to_hex(mix_rgb(primary, base, 0.12 if dark else 0.18)),
-        "skill": rgb_to_hex(mix_rgb(_complementary_ink(primary), bg, 0.45)),
-        "label": rgb_to_hex(mix_rgb(base, bg, 0.35)),
-        "dim": rgb_to_hex(mix_rgb(base, bg, 0.7)),
-        "bg": rgb_to_hex(bg),
-    }
-
-
-def _node_score(node: dict[str, Any], rec: float) -> float:
-    """Pick which visible objects deserve map markers + label rows."""
-    if node.get("kind") == "memory":
-        return 3.5 + rec
-    use = float(node.get("useCount", 0) or 0)
-    return rec * 2 + math.sqrt(max(0.0, use)) + (2.0 if node.get("pinned") else 0.0)
-
-
-def _node_label(node: dict[str, Any]) -> str:
-    text = str(node.get("label") or node.get("id") or "unknown").strip()
-    return text if len(text) <= 26 else text[:23].rstrip() + "…"
-
-
-def _node_meta(node: dict[str, Any]) -> str:
-    if node.get("kind") == "memory":
-        source = "profile memory" if node.get("memorySource") == "profile" else "memory"
-        return f"{source} · {format_date(_to_ts(node.get('timestamp')))}"
-    bits = [str(node.get("category") or "skill"), format_date(_to_ts(node.get("timestamp")))]
-    count = int(node.get("useCount", 0) or 0)
-    if count:
-        bits.append(f"x{count}")
-    if node.get("pinned"):
-        bits.append("pinned")
-    return " · ".join(bits)
-
-
-# ── Timeline chart frame ─────────────────────────────────────────────────────
-
-
-class _ChartBucket:
-    __slots__ = ("label", "ts", "skills", "memories", "nodes", "rec")
-
-    def __init__(self, label: str, ts: float):
-        self.label = label
-        self.ts = ts
-        self.skills = 0
-        self.memories = 0
-        self.nodes: list[dict[str, Any]] = []
-        self.rec = 1.0
-
-    @property
-    def total(self) -> int:
-        return self.skills + self.memories
-
-
-def _period_key(ts: float, granularity: str) -> tuple[int, ...]:
-    dt = datetime.fromtimestamp(ts, tz=timezone.utc)
-    if granularity == "day":
-        return (dt.year, dt.month, dt.day)
-    if granularity == "month":
-        return (dt.year, dt.month)
-    return (dt.year,)
-
-
-def _period_label(ts: float, granularity: str) -> str:
-    dt = datetime.fromtimestamp(ts, tz=timezone.utc)
-    if granularity == "day":
-        return f"{dt.day} {dt.strftime('%b')}"
-    if granularity == "month":
-        return dt.strftime("%b %Y")
-    return dt.strftime("%Y")
-
-
-def _build_chart_buckets(nodes: list[dict[str, Any]], rec: dict[str, Any], max_rows: int) -> list[_ChartBucket]:
-    """Timeline rows: finest date granularity that fits, oldest → newest."""
-    if not nodes:
-        return []
-    if not rec["timed"]:
-        ordered = sorted(nodes, key=lambda n: rec["rec"].get(str(n.get("id", "")), 0.0))
-        n_bins = min(max_rows, max(1, len(ordered)))
-        buckets = [_ChartBucket(f"#{i + 1}", float(i)) for i in range(n_bins)]
-        for node in ordered:
-            idx = int(_clamp(math.floor(rec["rec"].get(str(node.get("id", "")), 0.0) * n_bins), 0, n_bins - 1))
-            b = buckets[idx]
-            b.nodes.append(node)
-            if node.get("kind") == "memory":
-                b.memories += 1
-            else:
-                b.skills += 1
-        return buckets
-
-    chosen: Optional[list[_ChartBucket]] = None
-    for granularity in ("day", "month", "year"):
-        groups: dict[tuple[int, ...], _ChartBucket] = {}
-        for node in nodes:
-            ts = _to_ts(node.get("timestamp"))
-            if ts is None:
-                continue
-            key = _period_key(ts, granularity)
-            bucket = groups.get(key)
-            if bucket is None:
-                bucket = _ChartBucket(_period_label(ts, granularity), ts)
-                groups[key] = bucket
-            bucket.nodes.append(node)
-            if node.get("kind") == "memory":
-                bucket.memories += 1
-            else:
-                bucket.skills += 1
-        # For short spans, keep the useful day-by-day graph even when the caller
-        # asked for fewer rows; terminal scrollback is better than collapsing a
-        # month of activity into one unreadable bar.
-        if len(groups) <= max_rows or (granularity == "day" and len(groups) <= 32):
-            chosen = [groups[key] for key in sorted(groups)]
-            break
-
-    if chosen is None:
-        # If even yearly buckets overflow, fall back to even time bins.
-        min_ts, max_ts = rec.get("minTs"), rec.get("maxTs")
-        n_bins = max(1, max_rows)
-        chosen = []
-        for i in range(n_bins):
-            ts = min_ts + (i / max(1, n_bins - 1)) * (max_ts - min_ts) if min_ts and max_ts else float(i)
-            chosen.append(_ChartBucket(format_date(ts), ts))
-        for node in nodes:
-            r = rec["rec"].get(str(node.get("id", "")), 0.0)
-            idx = int(_clamp(math.floor(r * n_bins), 0, n_bins - 1))
-            b = chosen[idx]
-            b.nodes.append(node)
-            if node.get("kind") == "memory":
-                b.memories += 1
-            else:
-                b.skills += 1
-
-    min_ts, max_ts = rec.get("minTs"), rec.get("maxTs")
-    span = (max_ts - min_ts) if min_ts is not None and max_ts is not None and max_ts > min_ts else 0
-    for bucket in chosen:
-        bucket.rec = LEAD_IN + (1 - LEAD_IN) * ((bucket.ts - min_ts) / span) if span else 1.0
-    return chosen
-
-
-def _bucket_label_node(bucket: _ChartBucket) -> Optional[dict[str, Any]]:
-    if not bucket.nodes:
-        return None
-    return max(bucket.nodes, key=lambda node: _node_score(node, _to_ts(node.get("timestamp")) or bucket.ts))
-
-
-def _bucket_nodes(bucket: _ChartBucket, memory_lookup: Optional[dict[str, dict[str, Any]]] = None) -> list[dict[str, Any]]:
-    out: list[dict[str, Any]] = []
-    # Chronological within the slice so the TUI tree reads oldest → newest.
-    ordered = sorted(bucket.nodes, key=lambda n: _to_ts(n.get("timestamp")) or bucket.ts)
-    for node in ordered:
-        style = STYLE_MEMORY if node.get("kind") == "memory" else STYLE_SKILL
-        raw_label = str(node.get("label") or node.get("id") or "unknown").strip()
-        memory = (memory_lookup or {}).get(str(node.get("id", "")))
-        out.append(
-            {
-                "id": str(node.get("id", "")),
-                "glyph": MEMORY_GLYPH if node.get("kind") == "memory" else SKILL_GLYPH,
-                "label": _node_label(node),
-                "fullLabel": raw_label,
-                "meta": _node_meta(node),
-                "body": str(memory.get("body", "")) if memory else "",
-                "style": style,
-            }
-        )
-    return out
-
-
-def _bucket_rows(buckets: list[_ChartBucket], payload: dict[str, Any]) -> list[dict[str, Any]]:
-    cmap = category_color_map(payload)
-    memory_lookup = {
-        f"memory:{card.get('source')}:{idx}": card
-        for idx, card in enumerate(payload.get("memory", []) or [])
-        if isinstance(card, dict)
-    }
-    rows: list[dict[str, Any]] = []
-    for idx, bucket in enumerate(buckets):
-        cat = _bucket_category(bucket)
-        rows.append(
-            {
-                "index": idx,
-                "label": bucket.label,
-                "date": format_date(bucket.ts),
-                "skills": bucket.skills,
-                "memories": bucket.memories,
-                "total": bucket.total,
-                "category": cat,
-                "color": cmap.get(cat) if cat else None,
-                "nodes": _bucket_nodes(bucket, memory_lookup),
-            }
-        )
-    return rows
-
-
-def _category_counts(payload: dict[str, Any]) -> list[tuple[str, int]]:
-    clusters = [
-        (str(c.get("category")), int(c.get("count", 0)))
-        for c in payload.get("clusters", []) or []
-        if c.get("category") and c.get("category") != "memory"
-    ]
-    if clusters:
-        return clusters
-    counts: dict[str, int] = {}
-    for node in payload.get("nodes", []):
-        if node.get("kind") == "memory":
-            continue
-        cat = str(node.get("category") or "skill")
-        counts[cat] = counts.get(cat, 0) + 1
-    return sorted(counts.items(), key=lambda kv: (-kv[1], kv[0]))
-
-
-def category_color_map(payload: dict[str, Any]) -> dict[str, str]:
-    """Deterministic, evenly-spread hue per skill category (theme-independent)."""
-    clusters = _category_counts(payload)
-    n = max(1, len(clusters))
-    # Golden-angle hue spacing so adjacent categories never collide in color.
-    return {cat: rgb_to_hex(_hsl_to_rgb((i * 137.508) % 360, 0.55, 0.62)) for i, (cat, _c) in enumerate(clusters)}
-
-
-def category_legend(payload: dict[str, Any], limit: int = 4) -> list[dict[str, Any]]:
-    cmap = category_color_map(payload)
-    cats = _category_counts(payload)
-    shown = cats[:limit]
-    hidden = max(0, len(cats) - len(shown))
-    return [
-        {"glyph": "●", "color": cmap.get(cat, ""), "label": f"{cat} ({count})"}
-        for cat, count in shown
-    ] + ([{"glyph": "·", "color": "", "label": f"+{hidden}"}] if hidden else [])
-
-
-def _bucket_category(bucket: _ChartBucket) -> Optional[str]:
-    counts: dict[str, int] = {}
-    for node in bucket.nodes:
-        if node.get("kind") == "memory":
-            continue
-        cat = str(node.get("category") or "skill")
-        counts[cat] = counts.get(cat, 0) + 1
-    return max(counts, key=lambda k: counts[k]) if counts else None
-
-
-def _trajectory_row(buckets: list[_ChartBucket], width: int, reveal: float) -> Row:
-    """Cumulative learning curve as a compact star-path sparkline."""
-    if not buckets:
-        return []
-    total = sum(b.total for b in buckets) or 1
-    visible = int(_clamp(math.ceil(reveal * len(buckets)), 0, len(buckets)))
-    acc = 0
-    points: list[int] = []
-    for b in buckets[:visible]:
-        acc += b.total
-        points.append(round((acc / total) * (width - 1)))
-    cells = [" "] * width
-    last = 0
-    for p in points:
-        for x in range(min(last, p), max(last, p) + 1):
-            if 0 <= x < width and cells[x] == " ":
-                cells[x] = "·"
-        if 0 <= p < width:
-            cells[p] = "✦"
-        last = p
-    return [["trajectory ", STYLE_LABEL, 0.55], ["".join(cells), STYLE_SKILL, 0.48]]
-
-
-def render_graph(payload: dict[str, Any], *, cols: int = 80, rows: int = 16, reveal: float = 1.0) -> dict[str, Any]:
-    """Render one timeline frame at ``reveal`` (0→1).
-
-    Date rows with proportional skill/memory bars colored by the day's dominant
-    category, numbered markers tied to label rows, and a cumulative trajectory
-    sparkline underneath.
-    """
-    reveal = _clamp(reveal, 0.0, 1.0)
-    cols = max(44, cols)
-    rows = max(14, rows)
-    nodes = list(payload.get("nodes", []))
-    if not nodes:
-        placeholder = [["no learning yet — keep using Hermes and it maps out here", STYLE_DIM, 0.7]]
-        return {"grid": [placeholder], "date": "", "reveal": reveal, "visible": 0}
-
-    rec = compute_recency(nodes)
-    cmap = category_color_map(payload)
-    buckets = _build_chart_buckets(nodes, rec, max_rows=max(4, rows - 3))
-    n_buckets = len(buckets)
-    visible_bucket_count = int(_clamp(math.ceil(reveal * n_buckets), 0, n_buckets))
-    max_total = max((b.total for b in buckets), default=1) or 1
-    label_w = min(9, max(len(b.label) for b in buckets))
-    bar_w = max(14, cols - label_w - 16)
-
-    grid: Grid = []
-    labels: list[dict[str, Any]] = []
-    visible = 0
-    for i, bucket in enumerate(buckets):
-        if i >= visible_bucket_count:
-            grid.append([])
-            continue
-        visible += bucket.total
-        ink = recency_ink(bucket.rec)
-        bar_len = max(1, round((bucket.total / max_total) * bar_w)) if bucket.total else 0
-        skill_len = round((bucket.skills / bucket.total) * bar_len) if bucket.total else 0
-        if bucket.skills and skill_len == 0:
-            skill_len = 1
-        memory_len = bar_len - skill_len
-        if bucket.memories and memory_len == 0 and bar_len > 1:
-            memory_len = 1
-            skill_len = bar_len - 1
-
-        node = _bucket_label_node(bucket)
-        marker = ""
-        if node and len(labels) < 6:
-            marker = _LABEL_KEYS[len(labels)]
-            style = STYLE_MEMORY if node.get("kind") == "memory" else STYLE_SKILL
-            labels.append(
-                {
-                    "key": marker,
-                    "glyph": MEMORY_GLYPH if node.get("kind") == "memory" else SKILL_GLYPH,
-                    "label": _node_label(node),
-                    "meta": _node_meta(node),
-                    "style": style,
-                    "alpha": round(ink, 3),
-                }
-            )
-
-        cat = _bucket_category(bucket)
-        cat_hex = cmap.get(cat) if cat else None
-
-        row: Row = [[f"{bucket.label:>{label_w}} ", STYLE_LABEL, ink], ["│ ", STYLE_DIM, 0.55]]
-        if marker:
-            row.append([marker, STYLE_LABEL, 0.95])
-        elif bucket.total:
-            head_hex = cat_hex if bucket.skills else None
-            row.append(["✦" if bucket.skills else "◆", STYLE_SKILL if bucket.skills else STYLE_MEMORY, ink, head_hex])
-        if skill_len:
-            # Bar colored by the day's dominant category — a learning heatmap.
-            row.append(["━" * skill_len, STYLE_SKILL, ink, cat_hex])
-        if memory_len:
-            if memory_len == 1:
-                mem_trail = "◆"
-            else:
-                mem_trail = "◆" + ("━" * (memory_len - 2)) + "◆"
-            row.append([mem_trail, STYLE_MEMORY, max(0.65, ink)])
-        if bar_len < bar_w:
-            # Empty space keeps counts aligned; starmap texture lives in the
-            # trajectory row below, where it reads as signal rather than noise.
-            row.append([" " * (bar_w - bar_len), STYLE_BG, 1.0])
-        row.append(["  ", STYLE_BG, 1.0])
-        row.append([str(bucket.skills), STYLE_SKILL, max(0.72, ink)])
-        if bucket.memories:
-            row.append(["+", STYLE_DIM, 0.6])
-            row.append([str(bucket.memories), STYLE_MEMORY, max(0.72, ink)])
-        if i == visible_bucket_count - 1:
-            row.append(["  ◀ now", STYLE_LABEL, 0.9])
-        elif bucket.total == max_total and max_total > 1:
-            row.append(["  ☄ peak", STYLE_LABEL, 0.75])
-        grid.append(row)
-
-    # Cumulative learning trajectory underneath the rows.
-    grid.append([[(" " * (label_w + 2)), STYLE_BG, 1.0], *_trajectory_row(buckets, max(12, cols - label_w - 13), reveal)])
-
-    return {
-        "grid": grid,
-        "date": format_date(_date_at(rec, reveal)),
-        "reveal": reveal,
-        "visible": visible,
-        "labels": labels,
-    }
-
-
-# ── Trimmings ──────────────────────────────────────────────────────────────
-
-
-def build_legend(payload: dict[str, Any]) -> list[dict[str, Any]]:
-    nodes = payload.get("nodes", [])
-    skills = sum(1 for n in nodes if n.get("kind") != "memory")
-    memories = sum(1 for n in nodes if n.get("kind") == "memory")
-    return [
-        {"glyph": SKILL_GLYPH, "style": STYLE_SKILL, "label": f"skills ({skills})"},
-        {"glyph": MEMORY_GLYPH, "style": STYLE_MEMORY, "label": f"memories ({memories})"},
-    ]
-
-
-def axis_labels(payload: dict[str, Any]) -> dict[str, str]:
-    rec = compute_recency(list(payload.get("nodes", [])))
-    if not rec["timed"]:
-        return {"start": "oldest", "end": "now"}
-    return {"start": format_date(rec.get("minTs")), "end": format_date(rec.get("maxTs"))}
-
-
-def _peak_day(payload: dict[str, Any]) -> Optional[str]:
-    counts: dict[tuple[int, ...], int] = {}
-    reps: dict[tuple[int, ...], float] = {}
-    for node in payload.get("nodes", []):
-        ts = _to_ts(node.get("timestamp"))
-        if ts is None:
-            continue
-        key = _period_key(ts, "day")
-        counts[key] = counts.get(key, 0) + 1
-        reps[key] = ts
-    if not counts:
-        return None
-    best = max(counts, key=lambda k: counts[k])
-    return f"busiest day {_period_label(reps[best], 'day')} · {counts[best]} learned"
-
-
-def build_summary(payload: dict[str, Any]) -> list[str]:
-    stats = payload.get("stats", {}) or {}
-    lines: list[str] = []
-    learned = stats.get("learned_skills", stats.get("nodes", 0))
-    mem = stats.get("memory_nodes", 0)
-    edges = stats.get("related_edges", 0)
-    lines.append(f"{learned} learned skills · {mem} memories · {edges} skill links")
-    extra = []
-    if stats.get("memory_skill_edges"):
-        extra.append(f"{stats['memory_skill_edges']} memory↔skill links")
-    peak = _peak_day(payload)
-    if peak:
-        extra.append(peak)
-    if extra:
-        lines.append(" · ".join(extra))
-    return lines
-
-
-def _merge_runs(cells: Iterable[Run]) -> Row:
-    out: Row = []
-    for run in cells:
-        text, style, alpha = run[0], run[1], (run[2] if len(run) > 2 else 1.0)
-        hex_override = run[3] if len(run) > 3 else None
-        prev_hex = out[-1][3] if out and len(out[-1]) > 3 else None
-        if out and out[-1][1] == style and abs(out[-1][2] - alpha) < 1e-6 and prev_hex == hex_override:
-            out[-1][0] += text
-        else:
-            merged: Run = [text, style, alpha]
-            if hex_override:
-                merged.append(hex_override)
-            out.append(merged)
-    return out
-
-
-def render_frames(payload: dict[str, Any], *, cols: int = 80, rows: int = 16, frames: int = 48) -> dict[str, Any]:
-    """Pre-render a full play-through (reveal 0→1) plus static legend/summary."""
-    frames = max(2, min(frames, 240))
-    nodes = list(payload.get("nodes", []))
-    rec = compute_recency(nodes)
-    # Mirror render_graph's bucketing so the interactive row list lines up with
-    # what the user sees.
-    buckets = _build_chart_buckets(nodes, rec, max_rows=max(4, rows - 3)) if nodes else []
-    out_frames = []
-    for i in range(frames):
-        reveal = i / (frames - 1)
-        frame = render_graph(payload, cols=cols, rows=rows, reveal=reveal)
-        out_frames.append(
-            {
-                "reveal": frame["reveal"],
-                "date": frame["date"],
-                "visible": frame["visible"],
-                "grid": frame["grid"],
-                "labels": frame.get("labels", []),
-            }
-        )
-    return {
-        "frames": out_frames,
-        "legend": build_legend(payload),
-        "categories": category_legend(payload),
-        "buckets": _bucket_rows(buckets, payload),
-        "summary": build_summary(payload),
-        "axis": axis_labels(payload),
-        "count": len(payload.get("nodes", [])),
-        "cols": cols,
-        "rows": rows,
-    }
@@ -1,206 +0,0 @@
-"""User-initiated edit/delete for journey nodes (learned skills + memories).
-
-The journey graph (``agent.learning_graph``) gives every node a stable id:
-
- **skills** → the skill name (e.g. ``"debugging-hermes-desktop"``)
- **memories** → ``memory:<source>:<index>`` where ``source`` is ``memory``
-  (``MEMORY.md``) or ``profile`` (``USER.md``) and ``index`` is the node's
-  position in the combined card list (``MEMORY.md`` cards first, then
-  ``USER.md``).
-
-This module maps a node id back to its on-disk home and performs the mutation,
-shared by the CLI (``hermes journey delete|edit``), the TUI ``/journey`` overlay
-(gateway RPCs), and the desktop GUI (REST). Deleting a skill *archives* it
-(recoverable via ``hermes curator restore``); deleting a memory rewrites its
-file. Pure stdlib + existing skill/memory helpers.
-"""
-
-from __future__ import annotations
-
-from pathlib import Path
-from typing import Any
-
-_MEMORY_FILES = {"memory": "MEMORY.md", "profile": "USER.md"}
-
-
-def parse_node_kind(node_id: str) -> str:
-    return "memory" if node_id.startswith("memory:") else "skill"
-
-
-def _memories_dir() -> Path:
-    from hermes_constants import get_hermes_home
-
-    return get_hermes_home() / "memories"
-
-
-def _parse_memory_id(node_id: str) -> tuple[str, int]:
-    """``memory:<source>:<index>`` → (source, global_index)."""
-    parts = node_id.split(":", 2)
-    if len(parts) != 3 or parts[0] != "memory" or parts[1] not in _MEMORY_FILES:
-        raise ValueError(f"bad memory node id: {node_id!r}")
-    try:
-        return parts[1], int(parts[2])
-    except ValueError as exc:
-        raise ValueError(f"bad memory node id: {node_id!r}") from exc
-
-
-def _memory_local_index(source: str, global_index: int) -> int:
-    """Global card index → position within the source's own file.
-
-    ``_memory_cards`` emits all ``MEMORY.md`` cards before ``USER.md`` cards, so
-    a profile card's local index is its global index minus the memory count.
-    """
-    from agent.learning_graph import _memory_cards
-
-    cards = _memory_cards()
-    if not 0 <= global_index < len(cards):
-        raise IndexError(f"memory index {global_index} out of range")
-    if cards[global_index].get("source") != source:
-        raise ValueError("memory node id is stale — refresh the graph")
-    if source == "memory":
-        return global_index
-    return global_index - sum(1 for c in cards if c.get("source") == "memory")
-
-
-def _locate_memory(source: str, gidx: int) -> tuple[Path, list[str], int]:
-    """Resolve a memory card to its file, all §-delimited entries, and local index.
-
-    Entries come from ``MemoryStore._read_file`` — the same parser the memory
-    tool uses — so journey indices stay aligned with what the graph renders.
-    """
-    from tools.memory_tool import MemoryStore
-
-    path = _memories_dir() / _MEMORY_FILES[source]
-    if not path.exists():
-        raise ValueError(f"{path.name} not found")
-    chunks = MemoryStore._read_file(path)
-    local = _memory_local_index(source, gidx)
-    if not 0 <= local < len(chunks):
-        raise ValueError("memory node id is stale — refresh the graph")
-    return path, chunks, local
-
-
-# ── Inspect (edit prefill) ──────────────────────────────────────────────────
-
-
-def node_detail(node_id: str) -> dict[str, Any]:
-    """Current content for an edit prefill. ``content`` is the full SKILL.md
-    (skills) or the raw memory chunk (memories)."""
-    try:
-        return _node_detail(node_id)
-    except (ValueError, IndexError) as exc:
-        return {"ok": False, "message": str(exc)}
-
-
-def _node_detail(node_id: str) -> dict[str, Any]:
-    if parse_node_kind(node_id) == "memory":
-        source, gidx = _parse_memory_id(node_id)
-        _, chunks, local = _locate_memory(source, gidx)
-        body = chunks[local].strip()
-
-        return {"ok": True, "kind": "memory", "id": node_id, "label": body.splitlines()[0][:80], "content": body}
-
-    from tools.skill_manager_tool import _find_skill
-
-    found = _find_skill(node_id)
-    if not found:
-        return {"ok": False, "message": f"skill '{node_id}' not found"}
-    skill_md = Path(found["path"]) / "SKILL.md"
-    if not skill_md.exists():
-        return {"ok": False, "message": f"SKILL.md missing for '{node_id}'"}
-
-    return {
-        "ok": True,
-        "kind": "skill",
-        "id": node_id,
-        "label": node_id,
-        "content": skill_md.read_text(encoding="utf-8"),
-    }
-
-
-# ── Delete ──────────────────────────────────────────────────────────────────
-
-
-def delete_node(node_id: str) -> dict[str, Any]:
-    try:
-        return _delete_memory(node_id) if parse_node_kind(node_id) == "memory" else _delete_skill(node_id)
-    except (ValueError, IndexError) as exc:
-        return {"ok": False, "message": str(exc)}
-
-
-def _delete_skill(name: str) -> dict[str, Any]:
-    from tools import skill_usage
-
-    if skill_usage.get_record(name).get("pinned"):
-        return {"ok": False, "message": f"'{name}' is pinned — unpin it first (hermes curator unpin {name})"}
-
-    ok, message = skill_usage.archive_skill(name)
-    if ok:
-        _clear_skill_cache()
-
-    return {"ok": ok, "message": f"archived '{name}' — restore with: hermes curator restore {name}" if ok else message}
-
-
-def _delete_memory(node_id: str) -> dict[str, Any]:
-    source, gidx = _parse_memory_id(node_id)
-    path, chunks, local = _locate_memory(source, gidx)
-
-    del chunks[local]
-    _write_memory(path, chunks)
-
-    return {"ok": True, "message": f"deleted memory from {path.name}"}
-
-
-# ── Edit ────────────────────────────────────────────────────────────────────
-
-
-def edit_node(node_id: str, content: str) -> dict[str, Any]:
-    try:
-        return _edit_memory(node_id, content) if parse_node_kind(node_id) == "memory" else _edit_skill(node_id, content)
-    except (ValueError, IndexError) as exc:
-        return {"ok": False, "message": str(exc)}
-
-
-def _edit_skill(name: str, content: str) -> dict[str, Any]:
-    from tools.skill_manager_tool import _edit_skill as _do_edit
-
-    result = _do_edit(name, content)
-    if result.get("success"):
-        _clear_skill_cache()
-
-        return {"ok": True, "message": f"updated '{name}'"}
-
-    return {"ok": False, "message": result.get("error", "edit failed")}
-
-
-def _edit_memory(node_id: str, content: str) -> dict[str, Any]:
-    source, gidx = _parse_memory_id(node_id)
-    body = content.strip()
-    if not body:
-        return {"ok": False, "message": "empty memory — use delete to remove it"}
-    path, chunks, local = _locate_memory(source, gidx)
-
-    chunks[local] = body
-    _write_memory(path, chunks)
-
-    return {"ok": True, "message": f"updated memory in {path.name}"}
-
-
-# ── Helpers ─────────────────────────────────────────────────────────────────
-
-
-def _write_memory(path: Path, chunks: list[str]) -> None:
-    """Atomic temp-file + rename via the memory tool, so a concurrent reader
-    never sees a half-written file (and the §-join stays single-sourced)."""
-    from tools.memory_tool import MemoryStore
-
-    MemoryStore._write_file(path, [c.strip() for c in chunks if c.strip()])
-
-
-def _clear_skill_cache() -> None:
-    try:
-        from agent.prompt_builder import clear_skills_system_prompt_cache
-
-        clear_skills_system_prompt_cache(clear_snapshot=True)
-    except Exception:
-        pass
@@ -20,17 +20,6 @@ _LM_VALID_EFFORTS = {"none", "minimal", "low", "medium", "high", "xhigh"}
 # Map them onto the OpenAI-compatible request vocabulary.
 _LM_EFFORT_ALIASES = {"off": "none", "on": "medium"}

-# Hermes' generic effort ladder grew past LM Studio's vocabulary ("max",
-# "ultra"). Clamp the stronger generic levels onto LM Studio's ceiling: left
-# alone they miss _LM_VALID_EFFORTS, keep the initialized "medium" default and
-# are thereby conflated with unparseable input, so asking for more reasoning
-# yields less than "xhigh". Mirrors the ceiling clamp every other provider
-# applies (see agent/transports/codex.py).
-#
-# Deliberately separate from _LM_EFFORT_ALIASES: that mapping is also applied
-# to the model's published allowed_options, which must not be rewritten.
-_LM_EFFORT_CLAMP = {"max": "xhigh", "ultra": "xhigh"}
-

 def resolve_lmstudio_effort(
    reasoning_config: Optional[dict],
@@ -50,7 +39,6 @@ def resolve_lmstudio_effort(
        else:
            raw = (reasoning_config.get("effort") or "").strip().lower()
            raw = _LM_EFFORT_ALIASES.get(raw, raw)
-            raw = _LM_EFFORT_CLAMP.get(raw, raw)
            if raw in _LM_VALID_EFFORTS:
                effort = raw
    if allowed_options:
@@ -263,13 +263,6 @@ class LSPClient:
            cmd = self._win_wrap_cmd(cmd)

        try:
-            # start_new_session=True detaches the LSP server into its own
-            # process group / session. Without this, the LSP server inherits
-            # the gateway's pgid (= TUI parent PID). When mcp_tool's
-            # _kill_orphaned_mcp_children races with LSP spawn and sweeps the
-            # gateway's child set, it captures the LSP PID, records the
-            # inherited pgid, and killpg() then kills the TUI parent itself.
-            # See tui_gateway_crash.log "killpg → SIGTERM received" stacks.
            self._proc = await asyncio.create_subprocess_exec(
                cmd[0],
                *cmd[1:],
@@ -278,7 +271,6 @@ class LSPClient:
                stderr=asyncio.subprocess.PIPE,
                env=env,
                cwd=self._cwd,
-                start_new_session=True,
            )
        except FileNotFoundError as e:
            raise LSPProtocolError(
@@ -102,11 +102,6 @@ INSTALL_RECIPES: Dict[str, Dict[str, Any]] = {
    # Lua — manual (LuaLS is platform-specific binaries from GitHub
    # releases; complex enough that we punt to the user)
    "lua-language-server": {"strategy": "manual", "pkg": "", "bin": "lua-language-server"},
-    # PowerShell — PowerShellEditorServices ships as a GitHub release
-    # zip driven by a pwsh bootstrap script, not a single binary.  We
-    # require a manual bundle install and probe for the pwsh host so
-    # `hermes lsp status` reports the host's presence.
-    "powershell": {"strategy": "manual", "pkg": "", "bin": "pwsh"},
 }


@@ -348,15 +343,17 @@ def _install_pip(pkg: str, bin_name: str) -> Optional[str]:
    pip_target.mkdir(parents=True, exist_ok=True)
    try:
        logger.info("[install] pip install --target %s %s", pip_target, pkg)
-        from hermes_cli.tools_config import _pip_install
-
-        proc = _pip_install(
-            ["--target", str(pip_target), "--quiet", pkg],
+        proc = subprocess.run(
+            [sys.executable, "-m", "pip", "install", "--target", str(pip_target), "--quiet", pkg],
+            check=False,
+            capture_output=True,
+            text=True,
            timeout=300,
+            stdin=subprocess.DEVNULL,
        )
        if proc.returncode != 0:
            logger.warning(
-                "[install] pip install failed for %s: %s", pkg, (proc.stderr or "").strip()[:500]
+                "[install] pip install failed for %s: %s", pkg, proc.stderr.strip()[:500]
            )
            return None
    except (subprocess.TimeoutExpired, OSError) as e:
@@ -91,7 +91,7 @@ async def read_message(reader: asyncio.StreamReader) -> Optional[dict]:
        header_bytes += len(line)
        if header_bytes > 8192:
            raise LSPProtocolError(
-                "LSP header block exceeded 8 KiB without terminator"
+                f"LSP header block exceeded 8 KiB without terminator"
            )
        line = line[:-2]  # strip CRLF
        if not line:
@@ -8,7 +8,6 @@ OpenCode's ``lsp/diagnostic.ts`` and Claude Code's
 """
 from __future__ import annotations

-import html
 from typing import Any, Dict, List

 # Severity-1 only by default — warnings/info/hints would flood the
@@ -19,65 +18,18 @@ DEFAULT_SEVERITIES = frozenset({1})  # ERROR only
 MAX_PER_FILE = 20
 MAX_TOTAL_CHARS = 4000

-# Per-field caps for diagnostic content sourced from the language server.
-# These bound the length of any single attacker-controlled identifier that
-# can ride into the model's tool output via an LSP diagnostic message.
-MAX_MESSAGE_CHARS = 300
-MAX_CODE_CHARS = 80
-MAX_SOURCE_CHARS = 80
-
-
-def _sanitize_field(value: Any, *, limit: int) -> str:
-    """Make a language-server field safe to embed in a tool-result block.
-
-    Diagnostic ``message``, ``code``, and ``source`` originate from a
-    language server that has just parsed user-controlled source code, so
-    they're untrusted from the agent's point of view. A hostile repo can
-    place instruction-shaped text inside identifier names, type aliases,
-    or import paths so the resulting diagnostic echoes that text back
-    into the ``<diagnostics>`` block the model reads.
-
-    This helper:
-
-    * Collapses CR/LF so a raw newline can't synthesize a new line in the
-      formatted block.
-    * Drops non-printable ASCII control characters that have no business
-      in a single-line summary.
-    * Caps length per-field so a long identifier can't push past the
-      block boundary.
-    * HTML-escapes ``< > &`` so the result can't close ``<diagnostics>``
-      early or open a new tag.
-
-    Returns ``""`` for ``None`` / empty so the surrounding format string
-    naturally omits the part (mirrors the prior ``if code not in {None,
-    ""}`` check at call sites).
-    """
-    if value is None:
-        return ""
-    raw = str(value)
-    # Collapse newlines so identifier text with raw \n can't fake new lines.
-    raw = raw.replace("\r", " ").replace("\n", " ")
-    # Drop ASCII control chars; keep regular spaces.
-    raw = "".join(ch for ch in raw if ch == " " or ch.isprintable())
-    raw = raw.strip()[:limit]
-    return html.escape(raw, quote=False)
-

 def format_diagnostic(d: Dict[str, Any]) -> str:
-    """One-line representation of a single diagnostic.
-
-    ``message``, ``code``, and ``source`` are sanitized before
-    interpolation — see ``_sanitize_field``.
-    """
+    """One-line representation of a single diagnostic."""
    sev = SEVERITY_NAMES.get(d.get("severity") or 1, "ERROR")
    rng = d.get("range") or {}
    start = rng.get("start") or {}
    line = int(start.get("line", 0)) + 1
    col = int(start.get("character", 0)) + 1
-    msg = _sanitize_field(d.get("message"), limit=MAX_MESSAGE_CHARS)
-    code = _sanitize_field(d.get("code"), limit=MAX_CODE_CHARS)
-    code_part = f" [{code}]" if code else ""
-    source = _sanitize_field(d.get("source"), limit=MAX_SOURCE_CHARS)
+    msg = str(d.get("message") or "").rstrip()
+    code = d.get("code")
+    code_part = f" [{code}]" if code not in {None, ""} else ""
+    source = d.get("source")
    source_part = f" ({source})" if source else ""
    return f"{sev} [{line}:{col}] {msg}{code_part}{source_part}"

@@ -105,11 +57,7 @@ def report_for_file(
    body = "\n".join(lines)
    if extra > 0:
        body += f"\n... and {extra} more"
-    # quote=True escapes both ``"`` and ``&`` so a crafted file name like
-    # ``foo"><script`` can't break out of the ``file="..."`` attribute and
-    # synthesize new tags inside the tool output.
-    safe_path = html.escape(file_path, quote=True)
-    return f"<diagnostics file=\"{safe_path}\">\n{body}\n</diagnostics>"
+    return f"<diagnostics file=\"{file_path}\">\n{body}\n</diagnostics>"


 def truncate(s: str, *, limit: int = MAX_TOTAL_CHARS) -> str:
@@ -102,9 +102,6 @@ LANGUAGE_BY_EXT: Dict[str, str] = {
    ".zig": "zig",
    ".zon": "zig",
    ".dockerfile": "dockerfile",
-    ".ps1": "powershell",
-    ".psm1": "powershell",
-    ".psd1": "powershell",
 }


@@ -679,131 +676,6 @@ def _spawn_astro(root: str, ctx: ServerContext) -> Optional[SpawnSpec]:
    )


-_PSES_BUNDLE_WARNED = False
-
-
-def _find_pses_bundle(ctx: ServerContext) -> Optional[str]:
-    """Locate the PowerShellEditorServices module bundle directory.
-
-    PSES ships as a GitHub release zip (not an npm/go/pip package), so
-    there's no auto-install recipe — the user downloads it and points us
-    at the extracted bundle.  Resolution order:
-
-    1. ``command`` override in config (``lsp.servers.powershell.command``) —
-       the FIRST element is treated as the bundle path when it's a
-       directory.  This is the documented config knob.
-    2. ``init_overrides["powershell"]["bundlePath"]``.
-    3. ``PSES_BUNDLE_PATH`` env var.
-    4. ``<HERMES_HOME>/lsp/PowerShellEditorServices`` staging dir (where a
-       user-run unzip would naturally land).
-
-    Returns the bundle directory containing ``PowerShellEditorServices/``,
-    or ``None`` when it can't be found.
-    """
-    candidates: List[str] = []
-    override = ctx.binary_overrides.get("powershell")
-    if override and override[0]:
-        candidates.append(override[0])
-    init = ctx.init_overrides.get("powershell", {})
-    if isinstance(init, dict) and init.get("bundlePath"):
-        candidates.append(str(init["bundlePath"]))
-    env_path = os.environ.get("PSES_BUNDLE_PATH")
-    if env_path:
-        candidates.append(env_path)
-    home = os.environ.get("HERMES_HOME") or os.path.join(
-        os.path.expanduser("~"), ".hermes"
-    )
-    candidates.append(os.path.join(home, "lsp", "PowerShellEditorServices"))
-
-    for cand in candidates:
-        if not cand:
-            continue
-        # Accept either the bundle root or the inner module dir.
-        start_script = os.path.join(
-            cand, "PowerShellEditorServices", "Start-EditorServices.ps1"
-        )
-        if os.path.isfile(start_script):
-            return cand
-        inner = os.path.join(cand, "Start-EditorServices.ps1")
-        if os.path.isfile(inner):
-            return os.path.dirname(cand)
-    return None
-
-
-def _spawn_powershell_es(root: str, ctx: ServerContext) -> Optional[SpawnSpec]:
-    """Spawn PowerShellEditorServices over stdio.
-
-    Unlike the single-binary servers, PSES is a PowerShell module driven
-    by a bootstrap script.  We need both a PowerShell host (``pwsh`` for
-    PowerShell 7+, or Windows ``powershell``) and the PSES module bundle.
-    The bundle is manual-install (release zip) — see ``_find_pses_bundle``.
-    """
-    pwsh = _which("pwsh", "powershell")
-    if pwsh is None:
-        return None
-    bundle = _find_pses_bundle(ctx)
-    if bundle is None:
-        global _PSES_BUNDLE_WARNED
-        if not _PSES_BUNDLE_WARNED:
-            _PSES_BUNDLE_WARNED = True
-            logger.warning(
-                "powershell: pwsh found but the PowerShellEditorServices "
-                "bundle is missing. Download the release zip from "
-                "https://github.com/PowerShell/PowerShellEditorServices/releases, "
-                "extract it, and either set lsp.servers.powershell.command "
-                "to the bundle path or unzip it to "
-                "<HERMES_HOME>/lsp/PowerShellEditorServices."
-            )
-        return None
-    start_script = os.path.join(
-        bundle, "PowerShellEditorServices", "Start-EditorServices.ps1"
-    )
-    # Session details file: PSES writes connection info here on startup.
-    session_path = os.path.join(
-        hermes_lsp_session_dir(), f"pses-session-{os.getpid()}.json"
-    )
-    log_path = os.path.join(hermes_lsp_session_dir(), "pses.log")
-    inner = (
-        f"& '{start_script}' "
-        f"-BundledModulesPath '{bundle}' "
-        f"-LogPath '{log_path}' "
-        f"-SessionDetailsPath '{session_path}' "
-        f"-FeatureFlags @() -AdditionalModules @() "
-        f"-HostName Hermes -HostProfileId hermes -HostVersion 1.0.0 "
-        f"-Stdio -LogLevel Normal"
-    )
-    return SpawnSpec(
-        command=[
-            pwsh,
-            "-NoLogo",
-            "-NoProfile",
-            "-NonInteractive",
-            "-ExecutionPolicy",
-            "Bypass",
-            "-Command",
-            inner,
-        ],
-        workspace_root=root,
-        cwd=root,
-        env=ctx.env_overrides.get("powershell", {}),
-        initialization_options={
-            k: v
-            for k, v in ctx.init_overrides.get("powershell", {}).items()
-            if k != "bundlePath"
-        },
-    )
-
-
-def hermes_lsp_session_dir() -> str:
-    """Return (and create) the dir for PSES session/log scratch files."""
-    home = os.environ.get("HERMES_HOME") or os.path.join(
-        os.path.expanduser("~"), ".hermes"
-    )
-    d = os.path.join(home, "lsp", "pses")
-    os.makedirs(d, exist_ok=True)
-    return d
-
-
 def _resolve_override(ctx: ServerContext, server_id: str) -> Optional[str]:
    """User can pin a binary path in config."""
    override = ctx.binary_overrides.get(server_id)
@@ -951,18 +823,6 @@ def _root_java(file_path: str, workspace: str) -> Optional[str]:
    )


-def _root_powershell(file_path: str, workspace: str) -> Optional[str]:
-    # PowerShell projects rarely have a universal root marker. Use the
-    # PSScriptAnalyzer settings file when present, otherwise fall back to
-    # the git workspace root (nearest_root does exact-name matching only,
-    # so no globs here).
-    return _root_or_workspace(
-        file_path,
-        workspace,
-        ["PSScriptAnalyzerSettings.psd1"],
-    )
-
-
 # ---------------------------------------------------------------------------
 # the registry
 # ---------------------------------------------------------------------------
@@ -1152,13 +1012,6 @@ SERVERS: List[ServerDef] = [
        build_spawn=_spawn_jdtls,
        description="Java — Eclipse JDT Language Server",
    ),
-    ServerDef(
-        server_id="powershell",
-        extensions=(".ps1", ".psm1", ".psd1"),
-        resolve_root=_root_powershell,
-        build_spawn=_spawn_powershell_es,
-        description="PowerShell — PowerShellEditorServices (manual bundle)",
-    ),
 ]


@@ -4,86 +4,45 @@ from __future__ import annotations

 from typing import Any, Sequence

-from agent.redact import redact_sensitive_text
-

 def summarize_manual_compression(
    before_messages: Sequence[dict[str, Any]],
    after_messages: Sequence[dict[str, Any]],
    before_tokens: int,
    after_tokens: int,
-    *,
-    compression_state: Any = None,
 ) -> dict[str, Any]:
    """Return consistent user-facing feedback for manual compression."""
    before_count = len(before_messages)
    after_count = len(after_messages)
    noop = list(after_messages) == list(before_messages)
-    aborted = (
-        compression_state is not None
-        and getattr(compression_state, "_last_compress_aborted", False) is True
-    )
-    fallback_used = (
-        compression_state is not None
-        and getattr(compression_state, "_last_summary_fallback_used", False) is True
-    )
-    failure_reason = (
-        getattr(compression_state, "_last_summary_error", None)
-        if compression_state is not None
-        else None
-    )
-    if not isinstance(failure_reason, str) or not failure_reason.strip():
-        failure_reason = None

-    if aborted:
-        headline = f"Compression aborted: {before_count} messages preserved"
-    elif fallback_used:
-        headline = (
-            f"Compressed with fallback: {before_count} → {after_count} messages"
-        )
-    elif noop:
+    if noop:
        headline = f"No changes from compression: {before_count} messages"
+        if after_tokens == before_tokens:
+            token_line = (
+                f"Approx request size: ~{before_tokens:,} tokens (unchanged)"
+            )
+        else:
+            token_line = (
+                f"Approx request size: ~{before_tokens:,} → "
+                f"~{after_tokens:,} tokens"
+            )
    else:
        headline = f"Compressed: {before_count} → {after_count} messages"
-
-    if noop and after_tokens == before_tokens:
-        token_line = f"Approx request size: ~{before_tokens:,} tokens (unchanged)"
-    else:
        token_line = (
            f"Approx request size: ~{before_tokens:,} → "
            f"~{after_tokens:,} tokens"
        )

    note = None
-    if aborted:
-        note = "Summary generation failed; no messages were removed."
-    elif fallback_used:
-        dropped_count = getattr(
-            compression_state, "_last_summary_dropped_count", None
-        )
-        if not isinstance(dropped_count, int) or isinstance(dropped_count, bool):
-            dropped_count = max(before_count - after_count, 0)
-        note = (
-            "Summary generation failed; Hermes used limited fallback context "
-            f"and removed {dropped_count} message(s)."
-        )
-    elif not noop and after_count < before_count and after_tokens > before_tokens:
+    if not noop and after_count < before_count and after_tokens > before_tokens:
        note = (
            "Note: fewer messages can still raise this estimate when "
            "compression rewrites the transcript into denser summaries."
        )

-    if failure_reason and (aborted or fallback_used):
-        # This text crosses a user-facing UI boundary.  Never let a disabled
-        # global redaction preference expose credentials embedded in provider
-        # exception text.
-        safe_reason = redact_sensitive_text(failure_reason.strip(), force=True)
-        note = f"{note} Reason: {safe_reason}"
-
    return {
        "noop": noop,
-        "aborted": aborted,
-        "fallback_used": fallback_used,
        "headline": headline,
        "token_line": token_line,
        "note": note,
@@ -30,7 +30,7 @@ import logging
 import re
 import inspect
 import threading
-from concurrent.futures import Future, ThreadPoolExecutor, wait
+from concurrent.futures import ThreadPoolExecutor
 from typing import Any, Callable, Dict, List, Optional

 from agent.memory_provider import MemoryProvider
@@ -44,7 +44,6 @@ logger = logging.getLogger(__name__)
 # teardown indefinitely — the worker threads are daemon, so anything still
 # running past this window dies with the interpreter.
 _SYNC_DRAIN_TIMEOUT_S = 5.0
-_EXTERNAL_PREFETCH_TIMEOUT_S = 8.0


 def normalize_tool_schema(schema: Any) -> Optional[Dict[str, Any]]:
@@ -358,19 +357,10 @@ class MemoryManager:
    provider is allowed.  Failures in one provider never block the other.
    """

-    def __init__(self, *, external_prefetch_timeout: Optional[float] = None) -> None:
+    def __init__(self) -> None:
        self._providers: List[MemoryProvider] = []
        self._tool_to_provider: Dict[str, MemoryProvider] = {}
        self._has_external: bool = False  # True once a non-builtin provider is added
-        self._external_prefetch_timeout = (
-            _EXTERNAL_PREFETCH_TIMEOUT_S
-            if external_prefetch_timeout is None
-            else float(external_prefetch_timeout)
-        )
-        if self._external_prefetch_timeout <= 0:
-            raise ValueError("external_prefetch_timeout must be positive")
-        self._external_prefetch_threads: Dict[str, threading.Thread] = {}
-        self._external_prefetch_lock = threading.Lock()
        # Background executor for end-of-turn sync/prefetch. Lazily created on
        # first use so the common builtin-only path spawns no extra threads.
        # A single worker serializes a provider's writes (turn N must land
@@ -378,16 +368,6 @@ class MemoryManager:
        # _submit_background() and the sync_all/queue_prefetch_all rationale.
        self._sync_executor: Optional[ThreadPoolExecutor] = None
        self._sync_executor_lock = threading.Lock()
-        # Futures are tracked by durability class so shutdown can give writes
-        # a bounded FIFO drain, then explicitly report anything abandoned.
-        self._background_futures: Dict[Future, str] = {}
-        self._shutting_down = False
-        self._shutdown_drain_state: Dict[str, Any] = {
-            "status": "not_started",
-            "abandoned_writes": 0,
-            "abandoned_prefetches": 0,
-            "active_tasks": 0,
-        }

    # -- Registration --------------------------------------------------------

@@ -524,7 +504,7 @@ class MemoryManager:
        parts = []
        for provider in self._providers:
            try:
-                result = self._prefetch_provider(provider, clean_query, session_id=session_id)
+                result = provider.prefetch(clean_query, session_id=session_id)
                if result and result.strip():
                    parts.append(result)
            except Exception as e:
@@ -534,56 +514,6 @@ class MemoryManager:
                )
        return "\n\n".join(parts)

-    def _prefetch_provider(
-        self, provider: MemoryProvider, query: str, *, session_id: str = ""
-    ) -> str:
-        if provider.name == "builtin":
-            return provider.prefetch(query, session_id=session_id)
-
-        result_box: Dict[str, str] = {}
-        error_box: Dict[str, Exception] = {}
-
-        def _run() -> None:
-            try:
-                result_box["value"] = provider.prefetch(query, session_id=session_id) or ""
-            except Exception as exc:  # pragma: no cover - re-raised by caller
-                error_box["value"] = exc
-
-        thread = threading.Thread(
-            target=_run,
-            daemon=True,
-            name=f"memory-prefetch-{provider.name}",
-        )
-        with self._external_prefetch_lock:
-            existing = self._external_prefetch_threads.get(provider.name)
-            if existing is not None:
-                if existing.is_alive():
-                    logger.debug(
-                        "Memory provider '%s' prefetch is still running; skipping this turn",
-                        provider.name,
-                    )
-                    return ""
-                self._external_prefetch_threads.pop(provider.name, None)
-            self._external_prefetch_threads[provider.name] = thread
-            thread.start()
-
-        thread.join(self._external_prefetch_timeout)
-        if thread.is_alive():
-            logger.warning(
-                "Memory provider '%s' prefetch timed out after %.1fs; skipping it until "
-                "the stuck call returns",
-                provider.name,
-                self._external_prefetch_timeout,
-            )
-            return ""
-
-        with self._external_prefetch_lock:
-            if self._external_prefetch_threads.get(provider.name) is thread:
-                self._external_prefetch_threads.pop(provider.name, None)
-        if error_box:
-            raise error_box["value"]
-        return result_box.get("value", "")
-
    def queue_prefetch_all(self, query: str, *, session_id: str = "") -> None:
        """Queue background prefetch on all providers for the next turn.

@@ -609,7 +539,7 @@ class MemoryManager:
                        provider.name, e,
                    )

-        self._submit_background(_run, kind="prefetch")
+        self._submit_background(_run)

    # -- Sync ----------------------------------------------------------------

@@ -685,59 +615,43 @@ class MemoryManager:

    # -- Background dispatch -------------------------------------------------

-    def _submit_background(self, fn, *, kind: str = "write") -> None:
-        """Queue ``fn`` on the serialized worker and track its durability class."""
+    def _submit_background(self, fn) -> None:
+        """Run ``fn`` on the manager's background worker.
+
+        The executor is created lazily and shared across calls. If the
+        executor can't be created or has already been shut down, ``fn``
+        runs inline as a last-resort fallback — losing the async benefit
+        but never losing the write itself. ``fn`` must do its own
+        per-provider error handling; this wrapper only guards executor
+        plumbing.
+        """
        executor = self._get_sync_executor()
        if executor is None:
-            if self._shutting_down:
-                logger.warning("Memory manager is shutting down; rejecting late %s task", kind)
-                return
-            # Creation failure outside shutdown: preserve the historical
-            # fail-safe behavior and run the operation inline.
+            # Executor unavailable (shut down / creation failed) — run
+            # inline rather than drop the work. Slow, but correct.
            try:
                fn()
            except Exception as e:  # pragma: no cover - fn guards internally
                logger.debug("Inline memory background task failed: %s", e)
            return
        try:
-            # Make submit+tracking atomic with the shutdown snapshot. The
-            # callback is attached after releasing the lock because an already
-            # completed future invokes callbacks synchronously.
-            with self._sync_executor_lock:
-                if self._shutting_down:
-                    logger.warning("Memory manager is shutting down; rejecting late %s task", kind)
-                    return
-                future = executor.submit(fn)
-                self._background_futures[future] = kind
-            future.add_done_callback(self._forget_background_future)
+            executor.submit(fn)
        except RuntimeError:
-            if self._shutting_down:
-                logger.warning("Memory manager shut down during %s submission; task rejected", kind)
-                return
+            # Executor was shut down between the get and the submit
+            # (teardown race). Fall back to inline.
            try:
                fn()
            except Exception as e:  # pragma: no cover - fn guards internally
                logger.debug("Inline memory background task failed: %s", e)

-    def _forget_background_future(self, future: Future) -> None:
-        with self._sync_executor_lock:
-            self._background_futures.pop(future, None)
-
    def _get_sync_executor(self) -> Optional[ThreadPoolExecutor]:
        """Lazily create the single-worker background executor."""
-        if self._shutting_down:
-            return None
        if self._sync_executor is not None:
            return self._sync_executor
        with self._sync_executor_lock:
-            if self._shutting_down:
-                return None
            if self._sync_executor is None:
                try:
-                    # Daemon workers (see tools.daemon_pool): a provider wedged
-                    # on a network call must never block interpreter exit.
-                    from tools.daemon_pool import DaemonThreadPoolExecutor
-                    self._sync_executor = DaemonThreadPoolExecutor(
+                    self._sync_executor = ThreadPoolExecutor(
                        max_workers=1,
                        thread_name_prefix="mem-sync",
                    )
@@ -864,55 +778,6 @@ class MemoryManager:
                    exc_info=True,
                )

-    def commit_session_boundary_async(
-        self,
-        messages: List[Dict[str, Any]],
-        *,
-        new_session_id: str,
-        parent_session_id: str = "",
-        reason: str = "new_session",
-    ) -> None:
-        """Queue old-session extraction + provider rebinding as ONE serialized task.
-
-        Session rotation (/new) must deliver ``on_session_end`` (end-of-session
-        extraction — an LLM-bound call that can take seconds) strictly BEFORE
-        ``on_session_switch`` (which rebinds provider-internal ``_session_id`` /
-        turn buffers to the new session). Running extraction inline blocked the
-        /new command for the whole LLM round-trip (#16454); running it on an
-        ad-hoc thread raced the inline switch — providers key off internal
-        state, so a late ``on_session_end`` ran against post-switch bindings
-        (transcript misattributed to the new session id, double-ingest of the
-        old turn buffer, new-session buffers cleared).
-
-        Submitting BOTH hooks as one task on the manager's single background
-        worker gives both properties at a single chokepoint: the caller returns
-        immediately, and the worker's FIFO order serializes end→switch against
-        every other provider write (per-turn ``sync_all``, prefetches), which
-        already share the same worker. If the executor is unavailable,
-        ``_submit_background`` degrades to inline execution — the pre-#16454
-        synchronous behavior, slow but correct.
-        """
-        if not self._providers:
-            return
-        snapshot = list(messages or [])
-
-        def _run() -> None:
-            try:
-                self.on_session_end(snapshot)
-            except Exception as e:  # pragma: no cover - on_session_end guards per-provider
-                logger.warning("Session-boundary extraction failed: %s", e)
-            try:
-                self.on_session_switch(
-                    new_session_id,
-                    parent_session_id=parent_session_id,
-                    reset=True,
-                    reason=reason,
-                )
-            except Exception as e:  # pragma: no cover - on_session_switch guards per-provider
-                logger.warning("Session-boundary switch failed: %s", e)
-
-        self._submit_background(_run)
-
    def on_session_switch(
        self,
        new_session_id: str,
@@ -1150,66 +1015,51 @@ class MemoryManager:
                    provider.name, e,
                )

-    @property
-    def shutdown_drain_state(self) -> Dict[str, Any]:
-        """Snapshot of the most recent bounded shutdown drain outcome."""
-        with self._sync_executor_lock:
-            return dict(self._shutdown_drain_state)
-
    def _drain_sync_executor(self) -> None:
-        """Give queued FIFO work a bounded chance, then abandon explicitly."""
+        """Shut down the background executor, waiting briefly for drain.
+
+        Bounded by ``_SYNC_DRAIN_TIMEOUT_S``: a wedged provider must never
+        hang process/session teardown. We stop accepting new work and
+        cancel anything still queued, then wait at most the drain timeout
+        for the currently-running task on a watcher thread. The worker is
+        daemon, so an over-running task dies with the interpreter.
+        """
        with self._sync_executor_lock:
-            self._shutting_down = True
            executor = self._sync_executor
            self._sync_executor = None
-            tracked = dict(self._background_futures)
-            self._shutdown_drain_state = {
-                "status": "draining" if executor is not None else "drained",
-                "abandoned_writes": 0,
-                "abandoned_prefetches": 0,
-                "active_tasks": sum(not future.done() for future in tracked),
-            }
        if executor is None:
            return
-
-        # shutdown(wait=False) closes submission without touching the FIFO.
-        # Waiting on the tracked futures lets the real single-worker executor
-        # run every queued write/boundary task in order up to the deadline.
-        executor.shutdown(wait=False, cancel_futures=False)
-        _, pending = wait(tuple(tracked), timeout=_SYNC_DRAIN_TIMEOUT_S)
-        if not pending:
-            with self._sync_executor_lock:
-                self._shutdown_drain_state.update(status="drained", active_tasks=0)
+        try:
+            # Stop accepting new work and drop anything still queued, but
+            # do NOT block here — cancel_futures cancels not-yet-started
+            # tasks; the in-flight one keeps running on its daemon thread.
+            executor.shutdown(wait=False, cancel_futures=True)
+        except TypeError:
+            # Older Python without cancel_futures kwarg.
+            try:
+                executor.shutdown(wait=False)
+            except Exception as e:  # pragma: no cover
+                logger.debug("Memory sync executor shutdown failed: %s", e)
            return
-
-        abandoned_writes = 0
-        abandoned_prefetches = 0
-        active_tasks = 0
-        for future in pending:
-            kind = tracked[future]
-            if future.cancel():
-                if kind == "prefetch":
-                    abandoned_prefetches += 1
-                else:
-                    abandoned_writes += 1
-            else:
-                active_tasks += 1
-
-        with self._sync_executor_lock:
-            self._shutdown_drain_state.update(
-                status="timed_out",
-                abandoned_writes=abandoned_writes,
-                abandoned_prefetches=abandoned_prefetches,
-                active_tasks=active_tasks,
-            )
-        logger.warning(
-            "Memory shutdown drain timed out after %.2fs; abandoning %d queued "
-            "memory write(s) and %d queued prefetch(es); %d active task(s) remain detached",
-            _SYNC_DRAIN_TIMEOUT_S,
-            abandoned_writes,
-            abandoned_prefetches,
-            active_tasks,
+        except Exception as e:  # pragma: no cover
+            logger.debug("Memory sync executor shutdown failed: %s", e)
+            return
+        # Give an in-flight sync a bounded chance to finish on a watcher
+        # thread so we don't block the caller past the drain timeout.
+        drainer = threading.Thread(
+            target=lambda: self._bounded_executor_wait(executor),
+            daemon=True,
+            name="mem-sync-drain",
        )
+        drainer.start()
+        drainer.join(timeout=_SYNC_DRAIN_TIMEOUT_S)
+
+    @staticmethod
+    def _bounded_executor_wait(executor: ThreadPoolExecutor) -> None:
+        try:
+            executor.shutdown(wait=True)
+        except Exception as e:  # pragma: no cover
+            logger.debug("Memory sync executor drain wait failed: %s", e)

    def initialize_all(self, session_id: str, **kwargs) -> None:
        """Initialize all providers.
@@ -14,7 +14,6 @@ from concurrent.futures import ThreadPoolExecutor
 from typing import Any

 from agent.auxiliary_client import call_llm
-from agent.message_content import flatten_message_text
 from agent.transports import get_transport

 logger = logging.getLogger(__name__)
@@ -27,60 +26,6 @@ logger = logging.getLogger(__name__)
 # opening dozens of sockets at once.
 _MAX_REFERENCE_WORKERS = 8

-
-class _RefAccounting:
-    """Per-reference token usage + estimated cost + full trace, carried as the
-    third slot of a reference-output tuple.
-
-    Kept as a tiny object (not a bare CanonicalUsage) because an advisor may
-    run on a different model/provider than the aggregator, so its cost MUST be
-    priced at its OWN model's rate — folding advisor tokens into the
-    aggregator's usage and pricing the sum at the aggregator's rate would
-    misprice every advisor. ``usage`` feeds accurate token counts;
-    ``cost_usd`` feeds accurate cost.
-
-    ``messages`` / ``output`` / ``model`` / ``provider`` / ``temperature``
-    carry the FULL reference input and output for trace persistence (the
-    display ``text`` is a truncated preview and is not enough to audit what an
-    advisor actually saw). They are only populated when tracing is on; they add
-    negligible cost otherwise.
-    """
-
-    __slots__ = (
-        "usage",
-        "cost_usd",
-        "cost_status",
-        "cost_source",
-        "messages",
-        "output",
-        "model",
-        "provider",
-        "temperature",
-    )
-
-    def __init__(
-        self,
-        usage: Any,
-        cost_usd: Any = None,
-        cost_status: str | None = None,
-        cost_source: str | None = None,
-        *,
-        messages: Any = None,
-        output: str | None = None,
-        model: str | None = None,
-        provider: str | None = None,
-        temperature: Any = None,
-    ):
-        self.usage = usage
-        self.cost_usd = cost_usd
-        self.cost_status = cost_status
-        self.cost_source = cost_source
-        self.messages = messages
-        self.output = output
-        self.model = model
-        self.provider = provider
-        self.temperature = temperature
-
 # Per-tool-result character budget for the advisory reference view. Tool
 # results can be huge (a full diff, a 5000-line file dump); replaying them
 # verbatim per reference per tool-loop step would blow the reference model's
@@ -120,54 +65,11 @@ _REFERENCE_SYSTEM_PROMPT = (



-def _slot_label(slot: dict[str, Any]) -> str:
-    label = f"{(slot.get('provider') or '').strip()}:{(slot.get('model') or '').strip()}"
-    effort = str(slot.get("reasoning_effort") or "").strip()
-    return f"{label}[reasoning={effort}]" if effort else label
+def _slot_label(slot: dict[str, str]) -> str:
+    return f"{slot.get('provider', '').strip()}:{slot.get('model', '').strip()}"


-def _slot_reasoning_config(slot: dict[str, Any]) -> dict[str, Any] | None:
-    """Translate optional per-MoA-slot reasoning_effort into runtime config."""
-    effort = slot.get("reasoning_effort")
-    try:
-        from hermes_constants import parse_reasoning_effort
-
-        return parse_reasoning_effort(effort)
-    except Exception:  # pragma: no cover - defensive; bad config must not break MoA
-        return None
-
-
-def _aggregator_reasoning_config(aggregator: dict[str, Any]) -> dict[str, Any] | None:
-    """Resolve the aggregator's reasoning config: slot > per-model > global.
-
-    The aggregator is MoA's ACTING model, so when its slot doesn't pin a
-    reasoning_effort it must resolve exactly like any other acting model:
-    through the shared chokepoint (``resolve_reasoning_config``), which
-    applies ``agent.reasoning_overrides`` for the slot's model first, then
-    the global ``agent.reasoning_effort``. Without this the main loop's
-    reasoning gates (keyed to the virtual ``moa://local`` identity) never
-    fire, so the aggregator silently ran at the backend default (#64187).
-
-    Reference advisors intentionally do NOT get this fallback: they are side
-    calls (like auxiliary tasks), and inheriting a global ``xhigh`` into every
-    advisor fan-out would silently multiply cost. Their depth is slot-or-
-    provider-default only.
-    """
-    cfg = _slot_reasoning_config(aggregator)
-    if cfg is not None:
-        return cfg
-    try:
-        from hermes_cli.config import load_config
-        from hermes_constants import resolve_reasoning_config
-
-        return resolve_reasoning_config(
-            load_config() or {}, str(aggregator.get("model") or "")
-        )
-    except Exception:  # pragma: no cover - defensive; bad config must not break MoA
-        return None
-
-
-def _slot_runtime(slot: dict[str, Any]) -> dict[str, Any]:
+def _slot_runtime(slot: dict[str, str]) -> dict[str, Any]:
    """Resolve a reference/aggregator slot to real runtime call kwargs.

    A MoA slot is just a model selection — it must be called the same way any
@@ -191,84 +93,35 @@ def _slot_runtime(slot: dict[str, Any]) -> dict[str, Any]:
        from hermes_cli.runtime_provider import resolve_runtime_provider

        rt = resolve_runtime_provider(requested=provider, target_model=model)
-        # Forward the resolved endpoint through to call_llm unconditionally.
-        # call_llm's _resolve_task_provider_model() is the single chokepoint that
-        # decides whether an explicit base_url collapses a call to the generic
-        # ``custom`` route or keeps the provider's real identity: it preserves
-        # identity for any first-class provider (via
-        # _preserve_provider_with_base_url, a provider-catalog capability check),
-        # so provider branches that add auth refresh / request metadata /
-        # request-shape adapters — anthropic OAuth (Bearer + anthropic-beta),
-        # openai-codex Responses wrapping + Cloudflare headers, xai-oauth,
-        # bedrock SigV4 signing, nous Portal tags — still fire. Those branches
-        # re-resolve their own credentials by name and ignore a forwarded
-        # base_url/api_key, so forwarding is safe even for a placeholder key
-        # (bedrock's "aws-sdk"). We used to maintain a name-preservation set here
-        # too; that duplicated the chokepoint and drifted out of sync, so the
-        # single source of truth now lives in call_llm.
+        resolved_provider = str(rt.get("provider") or provider).strip().lower()
+        # call_llm treats an explicit base_url as a custom endpoint. That is
+        # correct for ordinary OpenAI-compatible targets, but wrong for OAuth /
+        # provider-backed targets whose provider branch adds auth refresh,
+        # request metadata, or request-shape adapters. Keep those providers
+        # identified by name.
+        if resolved_provider in {"nous", "openai-codex", "xai-oauth"}:
+            return out
+        # Pass the resolved endpoint through so call_llm builds the request for
+        # the provider's actual API surface instead of auto-detecting. base_url
+        # routes call_llm to the right adapter (incl. anthropic_messages mode);
+        # api_key is the resolved credential for that provider.
        if rt.get("base_url"):
            out["base_url"] = rt["base_url"]
        if rt.get("api_key"):
            out["api_key"] = rt["api_key"]
-        if rt.get("api_mode"):
-            out["api_mode"] = rt["api_mode"]
    except Exception as exc:  # pragma: no cover - defensive
        logger.debug("MoA slot runtime resolution failed for %s: %s", _slot_label(slot), exc)
    return out


-def _maybe_apply_moa_cache_control(
-    messages: list[dict[str, Any]],
-    runtime: dict[str, Any],
-) -> list[dict[str, Any]]:
-    """Decorate an advisor or aggregator request with cache_control when its
-    route honors it.
-
-    Reuses the SAME policy function as the main agent loop
-    (``anthropic_prompt_cache_policy``) resolved against the slot's own
-    provider/base_url/api_mode/model, and the SAME breakpoint layout
-    (``apply_anthropic_cache_control``, system_and_3). This keeps advisor and
-    aggregator calls decorated exactly like an acting agent on that provider
-    would be — no MoA-specific caching logic to drift.
-
-    Returns the messages unchanged on any resolution error or when the
-    policy says the route doesn't honor markers.
-    """
-    try:
-        from types import SimpleNamespace
-
-        from agent.agent_runtime_helpers import anthropic_prompt_cache_policy
-        from agent.prompt_caching import apply_anthropic_cache_control
-
-        # The policy function reads agent.* only as fallbacks for kwargs we
-        # don't pass; provide a stub so the slot is judged purely on its own
-        # resolved runtime.
-        stub = SimpleNamespace(provider="", base_url="", api_mode="", model="")
-        should_cache, native_layout = anthropic_prompt_cache_policy(
-            stub,
-            provider=runtime.get("provider") or "",
-            base_url=runtime.get("base_url") or "",
-            api_mode=runtime.get("api_mode") or "",
-            model=runtime.get("model") or "",
-        )
-        if not should_cache:
-            return messages
-        return apply_anthropic_cache_control(
-            messages, native_anthropic=native_layout
-        )
-    except Exception as exc:  # pragma: no cover - decoration must never break a call
-        logger.debug("MoA cache_control decoration skipped: %s", exc)
-        return messages
-
-
 def _run_reference(
    slot: dict[str, str],
    ref_messages: list[dict[str, Any]],
    *,
    temperature: float | None = None,
    max_tokens: int | None = None,
-) -> tuple[str, str, Any]:
-    """Call one reference model and return ``(label, text, usage)``.
+) -> tuple[str, str]:
+    """Call one reference model and return ``(label, text)``.

    The slot is resolved to its provider's real runtime (via ``_slot_runtime``)
    and called through the same ``call_llm`` request-building path any model
@@ -279,103 +132,29 @@ def _run_reference(
    real maximum); ``temperature`` is only the user's configured preset value,
    which call_llm may still override per model.

-    The reference's token usage is normalized with the slot's OWN resolved
-    provider/api_mode (advisors may run on a different provider than the
-    aggregator, with different usage wire shapes) and returned as a
-    ``CanonicalUsage`` so the caller can fold advisor spend into session
-    accounting. Without this, the entire reference fan-out — often the bulk of
-    a MoA turn's token spend — is invisible to cost tracking, which only ever
-    saw the aggregator's usage.
-
    Never raises: a failed reference becomes a labelled note so the aggregator
    can still act with partial context. Designed to run inside a thread pool —
    ``call_llm`` is synchronous/blocking, so threads (not asyncio) are the right
    concurrency primitive, mirroring ``delegate_task``'s batch fan-out.
    """
-    from agent.usage_pricing import CanonicalUsage, estimate_usage_cost, normalize_usage
-
    label = _slot_label(slot)
-    runtime = _slot_runtime(slot)
    try:
        # Prepend the advisory-role system prompt so the reference understands
        # it is analyzing state for an aggregator, not acting on the task. The
        # trimmed view (_reference_messages) already strips the agent's own
        # system prompt, so this is the only system message the reference sees.
        messages = [{"role": "system", "content": _REFERENCE_SYSTEM_PROMPT}, *ref_messages]
-        # Apply the same Anthropic-style prompt-caching decoration the main
-        # agent loop applies (system_and_3 breakpoints). The advisory view is
-        # append-only across iterations (new turns append before the trailing
-        # synthetic marker), so on cache-honoring routes (Claude via
-        # OpenRouter/native, MiniMax, Qwen/DashScope) iteration N+1's prefix
-        # replays iteration N's cached prefix. Without this, Claude advisors
-        # served ZERO cache reads across an entire benchmark run (measured:
-        # 0/1227 calls, 11.5M re-billed input tokens) because Anthropic
-        # caching is opt-in per request. OpenAI-family advisors are untouched
-        # (their caching is automatic; markers are ignored harmlessly, but we
-        # only decorate when the policy says the route honors them).
-        messages = _maybe_apply_moa_cache_control(messages, runtime)
        response = call_llm(
            task="moa_reference",
            messages=messages,
            temperature=temperature,
            max_tokens=max_tokens,
-            reasoning_config=_slot_reasoning_config(slot),
-            **runtime,
+            **_slot_runtime(slot),
        )
-        usage = CanonicalUsage()
-        raw_usage = getattr(response, "usage", None)
-        if raw_usage:
-            try:
-                usage = normalize_usage(
-                    raw_usage,
-                    provider=runtime.get("provider"),
-                    api_mode=runtime.get("api_mode"),
-                )
-            except Exception:  # pragma: no cover - defensive
-                usage = CanonicalUsage()
-        # Price this advisor at ITS OWN model/provider rate (with correct
-        # cache-read/cache-write split), not the aggregator's. This is why
-        # advisor cost is summed as dollars rather than by folding tokens into
-        # the aggregator's usage.
-        cost_usd = None
-        cost_status = None
-        cost_source = None
-        try:
-            cost = estimate_usage_cost(
-                slot.get("model") or "",
-                usage,
-                provider=runtime.get("provider"),
-                base_url=runtime.get("base_url"),
-                api_key=runtime.get("api_key"),
-            )
-            cost_usd = cost.amount_usd
-            cost_status = cost.status
-            cost_source = cost.source
-        except Exception:  # pragma: no cover - defensive
-            pass
-        _output_text = _extract_text(response) or "(empty response)"
-        acct = _RefAccounting(
-            usage,
-            cost_usd,
-            cost_status,
-            cost_source,
-            messages=messages,
-            output=_output_text,
-            model=slot.get("model"),
-            provider=runtime.get("provider") or slot.get("provider"),
-            temperature=temperature,
-        )
-        return label, _output_text, acct
+        return label, _extract_text(response) or "(empty response)"
    except Exception as exc:
        logger.warning("MoA reference model %s failed: %s", label, exc)
-        return label, f"[failed: {exc}]", _RefAccounting(
-            CanonicalUsage(),
-            messages=[{"role": "system", "content": _REFERENCE_SYSTEM_PROMPT}, *ref_messages],
-            output=f"[failed: {exc}]",
-            model=slot.get("model"),
-            provider=runtime.get("provider") or slot.get("provider"),
-            temperature=temperature,
-        )
+        return label, f"[failed: {exc}]"


 def _run_references_parallel(
@@ -384,7 +163,7 @@ def _run_references_parallel(
    *,
    temperature: float | None = None,
    max_tokens: int | None = None,
-) -> list[tuple[str, str, Any]]:
+) -> list[tuple[str, str]]:
    """Fan out all reference models in parallel, returning outputs in order.

    Like ``delegate_task``'s batch mode, every reference is dispatched at once
@@ -392,36 +171,24 @@ def _run_references_parallel(
    the aggregator. Output order matches ``reference_models`` so the
    ``Reference {idx}`` labelling stays stable. MoA presets that reference
    another MoA preset are skipped here (recursion guard) with a labelled note.
-
-    Each element is ``(label, text, usage)`` where usage is a
-    ``CanonicalUsage`` (zeroed for skipped/failed references).
    """
-    from agent.usage_pricing import CanonicalUsage
-
    if not reference_models:
        return []

-    results: list[tuple[str, str, Any] | None] = [None] * len(reference_models)
+    results: list[tuple[str, str] | None] = [None] * len(reference_models)
    futures = {}
    workers = min(_MAX_REFERENCE_WORKERS, len(reference_models))
-    # Reference slots run on bare executor threads, which start with an empty
-    # contextvars.Context — propagate the parent turn's context (approval
-    # callbacks + the Nous Portal conversation tag) into each worker so
-    # advisor calls attribute to the same conversation as the acting turn.
-    from tools.thread_context import propagate_context_to_thread
-
    with ThreadPoolExecutor(max_workers=workers) as executor:
        for idx, slot in enumerate(reference_models):
            if slot.get("provider") == "moa":
                results[idx] = (
                    _slot_label(slot),
                    "[skipped: MoA presets cannot recursively reference MoA]",
-                    _RefAccounting(CanonicalUsage()),
                )
                continue
            futures[
                executor.submit(
-                    propagate_context_to_thread(_run_reference),
+                    _run_reference,
                    slot,
                    ref_messages,
                    temperature=temperature,
@@ -477,14 +244,6 @@ def _render_tool_calls(tool_calls: Any) -> str:
    return "\n".join(lines)


-_ADVISORY_INSTRUCTION = (
-    "[The conversation above is the current state of the task. Give your "
-    "most intelligent judgement: what is going on, what should happen next, "
-    "what risks or mistakes you see, and how the acting agent should "
-    "proceed.]"
-)
-
-
 def _reference_messages(messages: list[dict[str, Any]]) -> list[dict[str, Any]]:
    """Build an advisory view of the conversation for reference models.

@@ -516,57 +275,25 @@ def _reference_messages(messages: list[dict[str, Any]]) -> list[dict[str, Any]]:
    The acting aggregator always receives the full, untrimmed transcript; this
    function only shapes the disposable advisory copy.
    """
+    advisory_instruction = (
+        "[The conversation above is the current state of the task. Give your "
+        "most intelligent judgement: what is going on, what should happen next, "
+        "what risks or mistakes you see, and how the acting agent should "
+        "proceed.]"
+    )
+
    rendered: list[dict[str, Any]] = []
    last_user_content: str | None = None
    for msg in messages:
        role = msg.get("role")
        content = msg.get("content")
-        # Flatten structured content (lists of parts) to visible text. Content
-        # arrives as a list — not a string — in two common cases:
-        #   1. Anthropic prompt-cache decoration: conversation_loop runs
-        #      apply_anthropic_cache_control BEFORE the MoA facade, converting
-        #      string content to [{"type": "text", "text": ..., "cache_control":
-        #      ...}]. A str-only read here flattened the user's ENTIRE prompt to
-        #      "" — Claude references then 400'd ("messages: at least one
-        #      message is required") while tolerant models answered "no user
-        #      request is present".
-        #   2. Multimodal turns (pasted image → text + image_url parts) and
-        #      multimodal tool results (screenshots).
-        # flatten_message_text extracts the text parts and skips image parts,
-        # and returns strings unchanged — so a decorated and an undecorated
-        # transcript produce a byte-identical advisory view (which keeps the
-        # advisory prefix stable across iterations for advisor prompt caching).
-        text = flatten_message_text(content)
+        text = content if isinstance(content, str) else ""

        if role == "system":
            continue
        if role == "user":
-            if not text.strip() and isinstance(content, list) and content:
-                # Structured content with no extractable text (e.g. an
-                # image-only turn). Emitting an empty user message would be
-                # dropped/rejected by strict providers (Anthropic 400s on
-                # empty text blocks — the original "closed" preset failure
-                # mode), and silently skipping the turn would break
-                # user/assistant alternation in the advisory view. Substitute
-                # a placeholder so the reference knows a non-text turn
-                # happened. Only structured content qualifies — an empty or
-                # whitespace-only STRING turn carries nothing and is dropped
-                # below instead.
-                text = "[user sent non-text content (e.g. an image attachment)]"
-            if not text.strip():
-                # Genuinely empty user turn (content="" / None). It carries
-                # nothing advisory, and strict providers (Kimi/Moonshot, ZAI,
-                # and others that enforce non-empty user content) reject it
-                # with 400 "message ... with role 'user' must not be empty" —
-                # the same way the assistant branch below drops turns with no
-                # parts. Lenient providers (DeepSeek) accept the empty turn,
-                # which is why a MoA fan-out would fail on one reference and
-                # pass on another for the identical rendered view. The
-                # advisory view is already not strictly alternating (adjacent
-                # assistant turns occur in every tool loop), so dropping a
-                # contentless turn is safe.
-                continue
-            last_user_content = text
+            if text.strip():
+                last_user_content = text
            rendered.append({"role": "user", "content": text})
        elif role == "assistant":
            parts: list[str] = []
@@ -596,7 +323,7 @@ def _reference_messages(messages: list[dict[str, Any]]) -> list[dict[str, Any]]:
    # deleting the agent's latest assistant context. This satisfies Anthropic's
    # no-trailing-assistant-prefill rule while preserving full state.
    if rendered and rendered[-1].get("role") == "assistant":
-        rendered.append({"role": "user", "content": _ADVISORY_INSTRUCTION})
+        rendered.append({"role": "user", "content": advisory_instruction})
    elif rendered and rendered[-1].get("role") == "user":
        # Already ends on a user turn (fresh user prompt, no agent action yet).
        # Leave it — the reference answers that prompt directly.
@@ -607,10 +334,8 @@ def _reference_messages(messages: list[dict[str, Any]]) -> list[dict[str, Any]]:
        if last_user_content is not None:
            return [{"role": "user", "content": last_user_content}]
        for msg in reversed(messages):
-            if msg.get("role") == "user":
-                fallback_text = flatten_message_text(msg.get("content"))
-                if fallback_text.strip():
-                    return [{"role": "user", "content": fallback_text}]
+            if msg.get("role") == "user" and isinstance(msg.get("content"), str):
+                return [{"role": "user", "content": msg["content"]}]
    return rendered


@@ -627,47 +352,20 @@ def _extract_text(response: Any) -> str:
    except Exception:
        pass
    try:
-        message = response.choices[0].message
-        if isinstance(message, dict):
-            content = message.get("content")
-        else:
-            content = getattr(message, "content", message)
-        if not isinstance(content, str):
-            content = str(content) if content else ""
-        return content.strip()
+        content = response.choices[0].message.content
+        return (content or "").strip()
    except Exception:
        return ""


-def _preset_temperature(preset: dict[str, Any], key: str) -> float | None:
-    """Read an optional temperature from a preset.
-
-    Returns None when the key is absent, empty, or explicitly null — meaning
-    "don't send temperature; let the provider default apply", exactly like a
-    single-model Hermes agent (which never sends temperature unless
-    configured). The old coercion ``float(preset.get(key, 0.6) or 0.6)``
-    made unset impossible: absent, null, and even 0 all collapsed to the
-    hardcoded default, so MoA advisors/aggregator always ran at 0.6/0.4
-    while the same model running solo used the provider default.
-    """
-    value = preset.get(key)
-    if value is None or (isinstance(value, str) and not value.strip()):
-        return None
-    try:
-        return float(value)
-    except (TypeError, ValueError):
-        logger.warning("ignoring non-numeric %s=%r in MoA preset", key, value)
-        return None
-
-
 def aggregate_moa_context(
    *,
    user_prompt: str,
    api_messages: list[dict[str, Any]],
    reference_models: list[dict[str, str]],
    aggregator: dict[str, str],
-    temperature: float | None = None,
-    aggregator_temperature: float | None = None,
+    temperature: float = 0.6,
+    aggregator_temperature: float = 0.4,
    max_tokens: int | None = None,
 ) -> str:
    """Run configured reference models and synthesize their advice.
@@ -680,13 +378,8 @@ def aggregate_moa_context(
    the parameter entirely when it is ``None`` (see its docstring), which also
    sidesteps providers that reject ``max_tokens`` outright. A hardcoded cap
    here previously truncated long aggregator syntheses.
-
-    ``temperature`` / ``aggregator_temperature`` are ``None`` by default:
-    like max_tokens, ``call_llm`` omits temperature when None so the
-    provider default applies — matching single-model agent behavior. Presets
-    may still pin explicit values.
    """
-    reference_outputs: list[tuple[str, str, Any]] = []
+    reference_outputs: list[tuple[str, str]] = []
    ref_messages = _reference_messages(api_messages)
    reference_outputs = _run_references_parallel(
        reference_models,
@@ -697,7 +390,7 @@ def aggregate_moa_context(

    joined = "\n\n".join(
        f"Reference {idx} — {label}:\n{text}"
-        for idx, (label, text, _usage) in enumerate(reference_outputs, start=1)
+        for idx, (label, text) in enumerate(reference_outputs, start=1)
    )
    synth_prompt = (
        "You are the aggregator in a Mixture of Agents process. Synthesize the "
@@ -710,28 +403,13 @@ def aggregate_moa_context(
    )

    agg_label = _slot_label(aggregator)
-    agg_runtime = _slot_runtime(aggregator)
    try:
-        # Same cache_control decoration as _run_reference's advisor calls
-        # (see _maybe_apply_moa_cache_control) — this synthesis call is a
-        # third, independent MoA call path that 22c5048d9 did not cover (it
-        # only restored caching for the acting-aggregator turn in the
-        # persistent `provider: moa` model and for advisor fan-out). Without
-        # it, the one-shot `/moa <prompt>` command's synthesis call re-bills
-        # its full input (system-less prompt containing every joined
-        # reference output) on every invocation with zero cache_control
-        # breakpoints, even when the resolved aggregator slot is a
-        # cache-honoring route (e.g. Claude on OpenRouter/native Anthropic).
-        agg_messages = _maybe_apply_moa_cache_control(
-            [{"role": "user", "content": synth_prompt}], agg_runtime
-        )
        response = call_llm(
            task="moa_aggregator",
-            messages=agg_messages,
+            messages=[{"role": "user", "content": synth_prompt}],
            temperature=aggregator_temperature,
            max_tokens=max_tokens,
-            reasoning_config=_aggregator_reasoning_config(aggregator),
-            **agg_runtime,
+            **_slot_runtime(aggregator),
        )
        synthesis = _extract_text(response)
    except Exception as exc:
@@ -751,43 +429,6 @@ def aggregate_moa_context(
    )


-def _attach_reference_guidance(agg_messages: list[dict[str, Any]], guidance: str) -> None:
-    """Attach the per-turn reference block at the END of the aggregator prompt.
-
-    The reference text differs on every tool-loop iteration. In an agentic loop
-    the most recent ``user`` message is the *original task* sitting near the TOP
-    of the context (everything after it is assistant/tool turns), so merging the
-    turn-varying reference block into it diverges the prompt prefix early — the
-    server's KV cache cannot be reused and the entire conversation re-prefills on
-    every step (full prefill each tool call, dominating latency on long contexts).
-
-    Appending at the very end keeps the ``[system][task][tool-history]`` prefix
-    stable and cache-reusable (only the new block re-prefills), and gives the
-    aggregator the references with recency. Merge into the last message only when
-    it is already a trailing ``user`` turn (plain chat — still at the end).
-
-    A trailing user turn's content may be a STRING or a LIST of content parts —
-    Anthropic prompt-cache decoration (which runs before the MoA facade)
-    converts string content to ``[{"type": "text", ..., "cache_control": ...}]``,
-    and multimodal turns are lists natively. Both shapes are merged in place:
-    appending a new text part AFTER the cache_control-marked part keeps the
-    cached prefix byte-stable (the marker still terminates it) while the
-    turn-varying guidance rides outside the cached span. Appending a SEPARATE
-    user message here instead would produce two consecutive user turns —
-    strict providers reject that.
-    """
-    last = agg_messages[-1] if agg_messages else None
-    if last is not None and last.get("role") == "user":
-        last_content = last.get("content")
-        if isinstance(last_content, str):
-            last["content"] = last_content + "\n\n" + guidance
-            return
-        if isinstance(last_content, list):
-            last["content"] = [*last_content, {"type": "text", "text": "\n\n" + guidance}]
-            return
-    agg_messages.append({"role": "user", "content": guidance})
-
-
 class MoAChatCompletions:
    """OpenAI-chat-compatible facade where the aggregator is the acting model."""

@@ -813,88 +454,7 @@ class MoAChatCompletions:
        # re-run, no re-emit). This gives "fire on every user/tool response"
        # for free, without re-firing on a pure no-op re-call.
        self._ref_cache_key: tuple | None = None
-        self._ref_cache_outputs: list[tuple[str, str, Any]] = []
-        # Token usage + estimated cost of the reference fan-out from the most
-        # recent cache-MISS create() call, awaiting consumption by session
-        # accounting. Set on every create() (zeroed on a cache HIT so per-turn
-        # advisor spend is counted exactly once). Consumed via
-        # ``consume_reference_usage``.
-        from agent.usage_pricing import CanonicalUsage
-
-        self._pending_reference_usage: Any = CanonicalUsage()
-        self._pending_reference_cost: Any = None
-        # Resolved aggregator slot ({provider, model, ...}) from the most recent
-        # create(); read by session cost accounting to price the aggregator's
-        # acting turn at its real model instead of the virtual preset name.
-        self.last_aggregator_slot: Any = None
-        # Full-turn trace parts stashed on a cache-MISS create(), awaiting the
-        # caller to stitch in the live session_id + resolved aggregator output
-        # and flush to the trace file (only when moa.save_traces is on).
-        self._pending_trace: Any = None
-
-    def consume_reference_usage(self) -> tuple[Any, Any]:
-        """Pop pending reference-fan-out usage + cost, resetting both to empty.
-
-        Returns ``(CanonicalUsage, cost_usd_or_None)`` for the most recent
-        ``create()`` and clears the pending values, so a subsequent read (e.g.
-        a streaming retry re-entering accounting) cannot double-count. Usage is
-        always a ``CanonicalUsage`` (zeroed if none); cost is a summed-dollars
-        float or ``None`` when no advisor could be priced.
-        """
-        from agent.usage_pricing import CanonicalUsage
-
-        usage = self._pending_reference_usage or CanonicalUsage()
-        cost = self._pending_reference_cost
-        self._pending_reference_usage = CanonicalUsage()
-        self._pending_reference_cost = None
-        return usage, cost
-
-    def consume_and_save_trace(
-        self, session_id: Any = None, aggregator_output_fallback: Any = None
-    ) -> None:
-        """Flush the pending full-turn trace to disk, if one is pending.
-
-        No-op when tracing is off (``save_moa_turn`` checks the config), when
-        there is no pending trace (a cache-HIT iteration ran no references), or
-        when the aggregator input was never recorded. Clears the pending trace
-        so a repeat consume cannot double-write. Best-effort — never raises.
-
-        ``aggregator_output_fallback`` is the aggregator's resolved acting text
-        as the caller already holds it in memory (the streamed assistant text).
-        On the streaming path the aggregator's output could not be captured
-        inline at ``create()`` time (the raw token stream was handed to the live
-        consumer), so ``pending["aggregator_output"]`` is None; we fold the
-        caller's resolved text in here so the trace is self-contained in BOTH
-        streaming and non-streaming modes. Non-streaming already has the inline
-        output and ignores the fallback.
-        """
-        pending = self._pending_trace
-        self._pending_trace = None
-        if not pending or "aggregator_input_messages" not in pending:
-            return
-        try:
-            from agent.moa_trace import save_moa_turn
-
-            agg_slot = pending.get("aggregator_slot") or {}
-            # Prefer the inline capture (non-streaming); fall back to the
-            # caller's resolved streamed text when streaming left it None.
-            agg_output = pending.get("aggregator_output")
-            if agg_output is None and aggregator_output_fallback:
-                agg_output = aggregator_output_fallback
-            save_moa_turn(
-                session_id=session_id,
-                preset_name=pending.get("preset", ""),
-                reference_outputs=pending.get("reference_outputs", []),
-                aggregator_label=pending.get("aggregator_label", ""),
-                aggregator_model=agg_slot.get("model"),
-                aggregator_provider=agg_slot.get("provider"),
-                aggregator_temperature=pending.get("aggregator_temperature"),
-                aggregator_input_messages=pending.get("aggregator_input_messages"),
-                aggregator_output=agg_output,
-                aggregator_streamed=bool(pending.get("aggregator_streamed")),
-            )
-        except Exception as exc:  # pragma: no cover - tracing must never break a turn
-            logger.debug("MoA trace flush failed: %s", exc)
+        self._ref_cache_outputs: list[tuple[str, str]] = []

    def _emit(self, event: str, **kwargs: Any) -> None:
        cb = self.reference_callback
@@ -913,33 +473,12 @@ class MoAChatCompletions:
        messages = list(api_kwargs.get("messages") or [])
        reference_models = preset.get("reference_models") or []
        aggregator = preset.get("aggregator") or {}
-        # Expose the resolved aggregator slot so session cost accounting can
-        # price the aggregator's acting turn at its REAL model/provider. The
-        # agent's model/provider on the MoA path are the virtual preset name
-        # ("closed") and "moa", which have no pricing entry — without this the
-        # aggregator's spend (often the bulk of the turn) is silently dropped
-        # and the session cost reflects advisor fan-out only.
-        self.last_aggregator_slot = dict(aggregator) if aggregator else None
-        # By default MoA does not cap reference or aggregator output: each model
-        # uses its own maximum (max_tokens=None → call_llm omits the parameter,
-        # so a long aggregator synthesis is never truncated and providers that
-        # reject max_tokens don't 400). A preset MAY set reference_max_tokens to
-        # cap ADVISOR output only — advisor generation is the dominant MoA
-        # latency (turn latency correlates ~0.88 with output tokens), and the
-        # aggregator only needs the gist of each advisor's judgement, so a cap
-        # (e.g. 600) measurably cuts per-turn wall time (~44% on a sample task).
-        # The acting aggregator is never capped here (its output is the
-        # user-visible answer).
-        reference_max_tokens = preset.get("reference_max_tokens")
-        # None (the default) = don't send temperature; provider default
-        # applies, matching single-model agent behavior. Presets may pin
-        # explicit values. See _preset_temperature.
-        temperature = _preset_temperature(preset, "reference_temperature")
-        aggregator_temperature = _preset_temperature(preset, "aggregator_temperature")
-        if aggregator_temperature is None and api_kwargs.get("temperature") is not None:
-            # The acting agent's own configured temperature (if any) still
-            # applies to the aggregator, which IS the acting model.
-            aggregator_temperature = api_kwargs.get("temperature")
+        # MoA does not cap reference or aggregator output: each model uses its
+        # own maximum. Passing max_tokens=None makes call_llm omit the parameter
+        # (it never caps by default), so a long aggregator synthesis is never
+        # truncated and providers that reject max_tokens don't 400.
+        temperature = float(preset.get("reference_temperature", 0.6) or 0.6)
+        aggregator_temperature = float(preset.get("aggregator_temperature", api_kwargs.get("temperature") or 0.4) or 0.4)

        # When the preset is disabled, skip the reference fan-out and let the
        # configured aggregator act alone — it is the preset's acting model, so
@@ -947,46 +486,16 @@ class MoAChatCompletions:
        if not preset.get("enabled", True):
            reference_models = []

-        from agent.usage_pricing import CanonicalUsage
-
-        reference_outputs: list[tuple[str, str, Any]] = []
+        reference_outputs: list[tuple[str, str]] = []
        ref_messages = _reference_messages(messages)

-        # Fan-out cadence. "per_iteration" (default): advisors re-run whenever
-        # the advisory view changes — i.e. every tool iteration, since the
-        # view grows with each tool result. "user_turn": advisors run ONCE per
-        # user turn; subsequent tool iterations reuse that turn's advice and
-        # the aggregator acts alone (the original MoA shape: synthesize at the
-        # start, then let the acting model work). Implemented by hashing only
-        # the prefix up to the LAST USER message so mid-turn growth doesn't
-        # change the signature — iteration 2+ becomes a cache HIT.
-        fanout_mode = str(preset.get("fanout") or "per_iteration").strip().lower()
-        sig_messages = ref_messages
-        if fanout_mode == "user_turn":
-            # Find the last REAL user message. The advisory view appends a
-            # synthetic user marker (_ADVISORY_INSTRUCTION) when it ends on an
-            # assistant turn — i.e. on every tool iteration after the first —
-            # so that marker must not count as a user turn or the prefix
-            # would include the grown mid-turn context and the signature
-            # would change every iteration (defeating the once-per-turn
-            # cadence entirely).
-            last_user_idx = None
-            for _i in range(len(ref_messages) - 1, -1, -1):
-                _m = ref_messages[_i]
-                if _m.get("role") == "user" and _m.get("content") != _ADVISORY_INSTRUCTION:
-                    last_user_idx = _i
-                    break
-            if last_user_idx is not None:
-                sig_messages = ref_messages[: last_user_idx + 1]
-
        # Turn-scoped cache: only run + display references when the advisory
        # view changed (i.e. a new user turn). Within one turn the agent loop
-        # calls create() once per tool iteration; in user_turn mode the
-        # signature is stable across those iterations (prefix hash above), so
-        # the fan-out runs once per user turn and iterations reuse the advice.
+        # calls create() once per tool iteration with the same advisory view;
+        # reuse the cached outputs and skip both the re-run and the re-emit.
        _sig = hashlib.sha256(
            "\u0000".join(
-                f"{m.get('role')}:{m.get('content')}" for m in sig_messages
+                f"{m.get('role')}:{m.get('content')}" for m in ref_messages
            ).encode("utf-8", "replace")
        ).hexdigest()
        _cache_key = (self.preset_name, _sig, tuple(_slot_label(s) for s in reference_models))
@@ -994,54 +503,15 @@ class MoAChatCompletions:

        if _refs_from_cache:
            reference_outputs = list(self._ref_cache_outputs)
-            # References already ran (and were accounted) earlier this turn;
-            # this create() is a repeat tool-iteration reusing the cached
-            # advice. Charging their tokens/cost again here would multiply
-            # advisor spend by the tool-iteration count, so pending is zero.
-            self._pending_reference_usage = CanonicalUsage()
-            self._pending_reference_cost = None
-            # Likewise no trace on a cache HIT — the full turn was already
-            # traced on the MISS that ran the references. A repeat iteration is
-            # not a new MoA turn.
-            self._pending_trace = None
        else:
            reference_outputs = _run_references_parallel(
                reference_models,
                ref_messages,
                temperature=temperature,
-                max_tokens=reference_max_tokens,
+                max_tokens=None,
            )
            self._ref_cache_key = _cache_key
            self._ref_cache_outputs = list(reference_outputs)
-            # Sum the advisor fan-out's token usage AND cost so the caller can
-            # fold advisor spend into session accounting exactly once per turn.
-            # Only the freshly run references (cache MISS) contribute; a cache
-            # HIT above zeroes this. Token counts sum directly (each already
-            # normalized per-advisor provider/api_mode); cost sums in dollars
-            # because each advisor was priced at its OWN model rate — advisors
-            # may be cheaper/pricier than the aggregator, so their tokens must
-            # NOT be repriced at the aggregator's rate.
-            _ref_usage = CanonicalUsage()
-            _ref_cost: Any = None
-            for _lbl, _txt, _acct in reference_outputs:
-                if isinstance(_acct, _RefAccounting):
-                    if isinstance(_acct.usage, CanonicalUsage):
-                        _ref_usage = _ref_usage + _acct.usage
-                    if _acct.cost_usd is not None:
-                        _ref_cost = (_ref_cost or 0) + _acct.cost_usd
-            self._pending_reference_usage = _ref_usage
-            self._pending_reference_cost = _ref_cost
-            # Stash the full reference fan-out for trace persistence. The
-            # aggregator input/label are filled in below once agg_messages is
-            # built; the aggregator OUTPUT is stitched in by the caller
-            # (consume_and_save_trace) once the response resolves — the caller
-            # holds the live session_id and the resolved aggregator response.
-            self._pending_trace = {
-                "preset": self.preset_name,
-                "reference_outputs": list(reference_outputs),
-                "aggregator_slot": aggregator,
-                "aggregator_temperature": aggregator_temperature,
-            }

            # Surface each reference model's answer to the display BEFORE the
            # aggregator acts — once per turn (only on the iteration that
@@ -1050,7 +520,7 @@ class MoAChatCompletions:
            # visible rather than a silent pause. Best-effort: never blocks the
            # turn.
            _ref_count = len(reference_outputs)
-            for _idx, (_label, _text, _usage) in enumerate(reference_outputs, start=1):
+            for _idx, (_label, _text) in enumerate(reference_outputs, start=1):
                self._emit(
                    "moa.reference",
                    index=_idx,
@@ -1069,29 +539,28 @@ class MoAChatCompletions:
        if reference_outputs:
            joined = "\n\n".join(
                f"Reference {idx} — {label}:\n{text}"
-                for idx, (label, text, _usage) in enumerate(reference_outputs, start=1)
+                for idx, (label, text) in enumerate(reference_outputs, start=1)
            )
            guidance = (
                "[Mixture of Agents reference context]\n"
                f"Preset: {self.preset_name}\n"
                f"Aggregator/acting model: {_slot_label(aggregator)}\n"
-                f"References: {', '.join(label for label, _, _ in reference_outputs)}\n\n"
+                f"References: {', '.join(label for label, _ in reference_outputs)}\n\n"
                "Use the reference responses below as private context. You are the aggregator and acting model: "
                "answer the user directly or call tools as needed.\n\n"
                f"{joined}"
            )
-            _attach_reference_guidance(agg_messages, guidance)
+            for msg in reversed(agg_messages):
+                if msg.get("role") == "user" and isinstance(msg.get("content"), str):
+                    msg["content"] = msg["content"] + "\n\n" + guidance
+                    break
+            else:
+                agg_messages.append({"role": "user", "content": guidance})

        if aggregator.get("provider") == "moa":
            raise RuntimeError("MoA aggregator cannot be another MoA preset")
        agg_kwargs = dict(api_kwargs)
        agg_kwargs["messages"] = agg_messages
-        # Record the exact aggregator INPUT (incl. the injected reference
-        # context) into the pending trace so a trace captures what the
-        # aggregator actually saw, not a reconstruction.
-        if self._pending_trace is not None:
-            self._pending_trace["aggregator_input_messages"] = agg_messages
-            self._pending_trace["aggregator_label"] = _slot_label(aggregator)
        # The aggregator is the acting model. Resolve its slot to the provider's
        # real runtime (base_url/api_key/api_mode) and call it through the same
        # request-building path any model uses — so per-model wire-format
@@ -1100,83 +569,18 @@ class MoAChatCompletions:
        # max_tokens is passed through from the caller (normally None → omitted
        # → the model's real maximum). The preset's old hardcoded 4096 default
        # is gone — it truncated long syntheses.
-        # When the agent's streaming consumer calls us with stream=True, run the
-        # references first (above) and then return the aggregator's RAW token
-        # stream so the acting model's output reaches the user live. The consumer
-        # reassembles chunks + tool_calls, runs stale-stream detection, and falls
-        # back to a non-streaming retry on error. The non-streaming path
-        # (stream=False) is unchanged — no stream/stream_options/timeout are
-        # forwarded, so its behavior is byte-for-byte identical to before.
-        stream = bool(api_kwargs.get("stream"))
-        stream_kwargs: dict[str, Any] = {}
-        if stream:
-            stream_kwargs["stream"] = True
-            stream_kwargs["stream_options"] = (
-                api_kwargs.get("stream_options") or {"include_usage": True}
-            )
-            # Forward the consumer's per-request (stream read) timeout so it
-            # actually governs the aggregator stream, not just call_llm's default.
-            if api_kwargs.get("timeout") is not None:
-                stream_kwargs["timeout"] = api_kwargs["timeout"]
-        _agg_response = call_llm(
+        return call_llm(
            task="moa_aggregator",
            messages=agg_messages,
            temperature=aggregator_temperature,
            max_tokens=agg_kwargs.get("max_tokens"),
            tools=agg_kwargs.get("tools"),
            extra_body=agg_kwargs.get("extra_body"),
-            reasoning_config=_aggregator_reasoning_config(aggregator),
-            **stream_kwargs,
            **_slot_runtime(aggregator),
        )
-        # Non-streaming path (quiet mode / eval / subagents): the aggregator
-        # output is available inline, so capture it into the pending trace now.
-        # Streaming path: the aggregator's raw token stream is returned to the
-        # consumer live and its acting output lands as the turn's assistant
-        # message; the trace marks it streamed and points there.
-        if self._pending_trace is not None:
-            if stream:
-                self._pending_trace["aggregator_streamed"] = True
-                self._pending_trace["aggregator_output"] = None
-            else:
-                self._pending_trace["aggregator_streamed"] = False
-                try:
-                    self._pending_trace["aggregator_output"] = _extract_text(_agg_response)
-                except Exception:  # pragma: no cover - defensive
-                    self._pending_trace["aggregator_output"] = None
-        return _agg_response


 class MoAClient:
    def __init__(self, preset_name: str, reference_callback: Any = None):
        self.chat = type("_MoAChat", (), {})()
        self.chat.completions = MoAChatCompletions(preset_name, reference_callback=reference_callback)
-
-    def consume_reference_usage(self) -> Any:
-        """Pop the pending reference-fan-out usage from the completions facade.
-
-        Lets session accounting fold the MoA advisor tokens into the turn's
-        usage without reaching into ``.chat.completions`` internals.
-        """
-        return self.chat.completions.consume_reference_usage()
-
-    @property
-    def last_aggregator_slot(self) -> Any:
-        """Resolved aggregator slot ({provider, model, ...}) from the most
-        recent create(), or None. Read by session cost accounting to price the
-        aggregator's acting turn at its real model instead of the virtual
-        preset name."""
-        return getattr(self.chat.completions, "last_aggregator_slot", None)
-
-    def consume_and_save_trace(
-        self, session_id: Any = None, aggregator_output_fallback: Any = None
-    ) -> None:
-        """Flush the pending full-turn MoA trace via the completions facade.
-
-        No-op unless ``moa.save_traces`` is enabled and a turn is pending.
-        ``aggregator_output_fallback`` supplies the resolved acting text so the
-        streaming path's trace is self-contained (see the facade docstring).
-        """
-        return self.chat.completions.consume_and_save_trace(
-            session_id, aggregator_output_fallback=aggregator_output_fallback
-        )
@@ -1,167 +0,0 @@
-"""Full MoA turn trace persistence (opt-in via config ``moa.save_traces``).
-
-When enabled, every Mixture-of-Agents turn that actually runs the reference
-fan-out (a cache MISS in ``MoAChatCompletions.create``) appends one JSON line
-to ``<hermes_home>/moa-traces/<session_id>.jsonl``. The record is the TRUE
-FULL turn — the exact messages array each reference model received (system
-prompt + advisory view, not the truncated display preview), each reference's
-full output, and the exact messages array the aggregator received (including
-the injected reference-context guidance block) plus its output when available
-— so a run can be audited end-to-end offline: what every model saw, what every
-model said, and what it cost.
-
-This is a side-channel trace. It is NOT the conversation ``messages`` table and
-never enters message history or replay — MoA references are advisory side-calls
-with their own system prompt, not conversation turns, so persisting them as
-message rows would corrupt role alternation / replay. Traces live in their own
-files, keyed by session id, and are safe to delete.
-
-Cost model note: gated OFF by default. When off, the only overhead is the
-``_traces_enabled()`` config read (cheap) — no file I/O, no serialization.
-"""
-
-from __future__ import annotations
-
-import json
-import logging
-import os
-import time
-from pathlib import Path
-from typing import Any, Optional
-
-from hermes_constants import get_hermes_home
-
-logger = logging.getLogger(__name__)
-
-
-def _traces_enabled_and_dir() -> Optional[Path]:
-    """Return the trace directory if ``moa.save_traces`` is on, else None.
-
-    Reads config lazily per call (config is cheap to load and this only runs on
-    a cache-MISS MoA turn, i.e. once per user turn, not per tool iteration).
-    ``moa.trace_dir`` overrides the default ``<hermes_home>/moa-traces/``.
-    """
-    try:
-        from hermes_cli.config import load_config
-
-        moa_cfg = (load_config() or {}).get("moa") or {}
-    except Exception:  # pragma: no cover - defensive: never break a turn over tracing
-        return None
-    if not moa_cfg.get("save_traces"):
-        return None
-    override = moa_cfg.get("trace_dir")
-    if override:
-        base = Path(os.path.expandvars(os.path.expanduser(str(override))))
-    else:
-        base = get_hermes_home() / "moa-traces"
-    return base
-
-
-def _sanitize_session_id(session_id: Optional[str]) -> str:
-    """Make a session id safe as a filename component."""
-    if not session_id:
-        return "unknown-session"
-    return "".join(c if (c.isalnum() or c in "-_.") else "_" for c in str(session_id))
-
-
-def _slot_trace(acct: Any, label: str) -> dict[str, Any]:
-    """Render one reference's _RefAccounting into a full trace dict.
-
-    Includes the FULL input messages the reference received and its FULL
-    output — not the truncated display preview.
-    """
-    usage = getattr(acct, "usage", None)
-    usage_dict: dict[str, Any] = {}
-    if usage is not None:
-        usage_dict = {
-            "input_tokens": getattr(usage, "input_tokens", 0),
-            "output_tokens": getattr(usage, "output_tokens", 0),
-            "cache_read_tokens": getattr(usage, "cache_read_tokens", 0),
-            "cache_write_tokens": getattr(usage, "cache_write_tokens", 0),
-            "reasoning_tokens": getattr(usage, "reasoning_tokens", 0),
-        }
-    return {
-        "label": label,
-        "model": getattr(acct, "model", None),
-        "provider": getattr(acct, "provider", None),
-        "temperature": getattr(acct, "temperature", None),
-        "input_messages": getattr(acct, "messages", None),
-        "output": getattr(acct, "output", None),
-        "usage": usage_dict,
-        "cost_usd": getattr(acct, "cost_usd", None),
-        "cost_status": getattr(acct, "cost_status", None),
-        "cost_source": getattr(acct, "cost_source", None),
-    }
-
-
-def save_moa_turn(
-    *,
-    session_id: Optional[str],
-    preset_name: str,
-    reference_outputs: list[tuple[str, str, Any]],
-    aggregator_label: str,
-    aggregator_model: Optional[str],
-    aggregator_provider: Optional[str],
-    aggregator_temperature: Any,
-    aggregator_input_messages: Any,
-    aggregator_output: Optional[str],
-    aggregator_streamed: bool,
-) -> None:
-    """Append one full MoA turn record to the session's trace JSONL, if enabled.
-
-    Best-effort: any failure is logged at debug and swallowed — tracing must
-    never break a live turn. Called once per turn on a reference cache MISS.
-
-    ``aggregator_output`` is the aggregator's synthesized text. On the
-    non-streaming path (eval / quiet-mode / subagents) it was captured inline
-    at call time. On the streaming path it is captured after the fact from the
-    caller's resolved assistant text (``aggregator_output_fallback`` in
-    ``consume_and_save_trace``) so the trace is self-contained either way; if
-    that resolved text was unavailable, it falls back to None and the record
-    points at the session store via ``output_location``.
-    """
-    base = _traces_enabled_and_dir()
-    if base is None:
-        return
-    try:
-        base.mkdir(parents=True, exist_ok=True)
-        path = base / f"{_sanitize_session_id(session_id)}.jsonl"
-        # output_location tells an offline reader where the acting text lives:
-        # embedded here when we have it (both non-streaming inline capture and
-        # streaming after-the-fact capture), else the session-db assistant row.
-        _have_output = bool(aggregator_output)
-        if not aggregator_streamed:
-            _output_location = "inline"
-        elif _have_output:
-            _output_location = "inline_from_stream"
-        else:
-            _output_location = "assistant_message_in_session_db"
-        record = {
-            "ts": time.time(),
-            "session_id": session_id,
-            "preset": preset_name,
-            "references": [
-                _slot_trace(acct, label)
-                for label, _text, acct in reference_outputs
-            ],
-            "aggregator": {
-                "label": aggregator_label,
-                "model": aggregator_model,
-                "provider": aggregator_provider,
-                "temperature": aggregator_temperature,
-                "input_messages": aggregator_input_messages,
-                "output": aggregator_output,
-                "streamed": aggregator_streamed,
-                # Where the aggregator's acting output lives for this record.
-                # "inline"             — non-streaming inline capture
-                # "inline_from_stream" — streamed, then captured from the
-                #                        caller's resolved assistant text
-                # "assistant_message_in_session_db" — streamed and the resolved
-                #                        text was unavailable at flush time
-                "output_location": _output_location,
-            },
-        }
-        with path.open("a", encoding="utf-8") as f:
-            f.write(json.dumps(record, ensure_ascii=False, default=str) + "\n")
-    except Exception as exc:  # pragma: no cover - tracing must never break a turn
-        logger.debug("MoA trace write failed (session=%s): %s", session_id, exc)
@@ -209,7 +209,7 @@ def mark_seen(config_path: Path, flag: str) -> bool:
    """
    try:
        import yaml
-        from hermes_cli.config import atomic_config_write
+        from utils import atomic_yaml_write
    except Exception as e:  # pragma: no cover — dependency issue
        logger.debug("onboarding: failed to import yaml/utils: %s", e)
        return False
@@ -228,7 +228,7 @@ def mark_seen(config_path: Path, flag: str) -> bool:
        if seen.get(flag) is True:
            return True  # already marked — nothing to do
        seen[flag] = True
-        atomic_config_write(config_path, cfg)
+        atomic_yaml_write(config_path, cfg)
        return True
    except Exception as e:
        logger.debug("onboarding: failed to mark flag %s: %s", flag, e)
@@ -230,68 +230,6 @@ def _png_bytes(frame) -> bytes:
    return buf.getvalue()


-def _union_alpha_bbox(frames) -> tuple[int, int, int, int] | None:
-    """Union opaque-pixel bbox across *frames* (a stable trim for animation)."""
-    left = top = right = bottom = None
-    for frame in frames:
-        try:
-            bbox = frame.getchannel("A").getbbox()
-        except Exception:  # noqa: BLE001 - cosmetic; fail open
-            bbox = None
-        if not bbox:
-            continue
-        l, t, r, b = bbox
-        left = l if left is None else min(left, l)
-        top = t if top is None else min(top, t)
-        right = r if right is None else max(right, r)
-        bottom = b if bottom is None else max(bottom, b)
-    if left is None or top is None or right is None or bottom is None:
-        return None
-    return (left, top, right, bottom)
-
-
-def _crop_frames_to_alpha_union(frames):
-    """Crop every frame to the union opaque bbox so the sprite hugs its box.
-
-    kitty paints the whole transmitted rectangle, transparent margins included,
-    which makes the visible pet look small and adrift inside a larger cell box.
-    Trimming to the visible bounds keeps the pet tight in its corner.
-    """
-    bbox = _union_alpha_bbox(frames)
-    if not bbox:
-        return frames
-    return [f.crop(bbox) for f in frames]
-
-
-# Nominal terminal cell size in pixels. kitty fits an image to its cell
-# rectangle preserving aspect, so a frame whose pixel size isn't a whole
-# multiple of the cell rounds up — which makes the terminal clip the bottom row
-# (the "clipped feet") and letterbox a blank row. Snapping each frame to an
-# exact cell multiple avoids that. (See ratatui-image #57: "render in multiples
-# of the font-size, to avoid stale character artifacts.")
-_CELL_W = 8
-_CELL_H = 16
-
-
-def _snap_frames_to_cell_grid(frames):
-    """Resize frames so width/height are exact multiples of the cell box.
-
-    Removes the sub-cell remainder kitty would otherwise round up + clip. All
-    frames share the union-cropped size, so they snap to the same cell grid.
-    """
-    if not frames:
-        return frames
-    from PIL import Image
-
-    w, h = frames[0].size
-    cols = max(1, round(w / _CELL_W))
-    rows = max(1, round(h / _CELL_H))
-    target = (cols * _CELL_W, rows * _CELL_H)
-    if (w, h) == target:
-        return frames
-    return [f.resize(target, Image.LANCZOS) for f in frames]
-
-
 def _kitty_apc(ctrl: str, data: str) -> str:
    """Emit a kitty APC escape for *data*, chunked into ≤4096-byte ``m`` pieces."""
    chunk = 4096
@@ -423,7 +361,7 @@ def _encode_iterm(frame, *, cell_cols: int | None = None, cell_rows: int | None
    """Encode one frame as an iTerm2 inline image (OSC 1337 File)."""
    payload = base64.standard_b64encode(_png_bytes(frame)).decode("ascii")
    size = len(payload)
-    args = ["inline=1", f"size={size}", "preserveAspectRatio=1"]
+    args = [f"inline=1", f"size={size}", "preserveAspectRatio=1"]
    if cell_cols:
        args.append(f"width={cell_cols}")
    if cell_rows:
@@ -625,8 +563,6 @@ class PetRenderer:
        frames = self._frames(state)
        if not frames:
            return None
-        frames = _crop_frames_to_alpha_union(frames)
-        frames = _snap_frames_to_cell_grid(frames)
        cols, rows = self._cell_box(frames[0])
        return {
            "cols": cols,
@@ -31,55 +31,7 @@ version can change at runtime (editable installs, hot-reload tooling), and

 from __future__ import annotations

-from contextvars import ContextVar
-from typing import List, Optional
-
-# ── Ambient conversation context ─────────────────────────────────────────────
-#
-# The main agent loop knows its ``session_id``; the dozens of auxiliary call
-# sites (compression, title generation, vision, web_extract, session_search,
-# MoA reference/aggregator slots, curator, kanban helpers, ...) do not — they
-# funnel through ``agent.auxiliary_client.call_llm`` which has no session
-# handle. Rather than threading a ``session_id`` parameter through every one
-# of those call sites (and every future one), the agent loop publishes the
-# active conversation id here and ``nous_portal_tags()`` picks it up as a
-# fallback whenever no explicit ``session_id`` is passed.
-#
-# ContextVar (not a module global) so concurrent agents in one process —
-# gateway sessions, delegate_task subagents, batch runners — never see each
-# other's conversation id. Worker threads spawned via
-# ``tools.thread_context.propagate_context_to_thread`` (background review,
-# MoA fan-out, tool executor) inherit it through the copied Context; bare
-# threads (title generator) capture it explicitly at spawn time.
-_conversation_id: ContextVar[Optional[str]] = ContextVar(
-    "nous_portal_conversation_id", default=None
-)
-
-
-def set_conversation_context(conversation_id: Optional[str]):
-    """Publish the active conversation id for ambient Portal tagging.
-
-    Called by the agent loop at turn entry with the conversation's stable
-    id (the session-lineage ROOT id, so the tag survives context-compression
-    session rotation). Pass ``None`` to clear. Returns the ContextVar token
-    so callers can ``reset_conversation_context(token)`` on turn exit.
-    """
-    return _conversation_id.set(conversation_id or None)
-
-
-def reset_conversation_context(token) -> None:
-    """Restore the previous conversation context (pair with ``set_...``)."""
-    try:
-        _conversation_id.reset(token)
-    except Exception:
-        # Token from another Context (e.g. reset on a different thread) —
-        # fall back to clearing rather than raising in cleanup paths.
-        _conversation_id.set(None)
-
-
-def get_conversation_context() -> Optional[str]:
-    """Return the ambient conversation id, or ``None`` when unset."""
-    return _conversation_id.get()
+from typing import List


 def _hermes_version() -> str:
@@ -103,42 +55,10 @@ def hermes_client_tag() -> str:
    return f"client=hermes-client-v{_hermes_version()}"


-def conversation_tag(session_id: str) -> str:
-    """Return the ``conversation=...`` tag for a Hermes session/conversation.
-
-    Format: ``conversation=<session_id>``. ``session_id`` is the canonical
-    Hermes conversation identifier (``AIAgent.session_id``) — the same value
-    used for ``~/.hermes/sessions/`` storage, session logs, and lineage.
-
-    Unlike the product/client tags this is high-cardinality (one value per
-    conversation), so it is only appended when a session id is actually
-    available — never as part of the always-on base tag set.
-    """
-    return f"conversation={session_id}"
-
-
-def nous_portal_tags(session_id: str | None = None) -> List[str]:
+def nous_portal_tags() -> List[str]:
    """Return the canonical list of Nous Portal product tags.

    Always returns a fresh list so callers can mutate it freely
    (e.g. ``merged_extra.setdefault("tags", []).extend(nous_portal_tags())``).
-
-    When ``session_id`` is provided, a ``conversation=<session_id>`` tag is
-    appended so Portal usage can be attributed to a specific Hermes
-    conversation. When it is omitted, the ambient conversation context
-    (``set_conversation_context``, published by the agent loop at turn
-    entry) is used instead — this is how auxiliary calls (compression,
-    titles, vision, MoA slots, ...) inherit the conversation tag without
-    per-call-site plumbing. Callers outside any conversation (e.g. the
-    auxiliary client's import-time base tags) get the canonical two-tag set.
    """
-    tags = ["product=hermes-agent", hermes_client_tag()]
-    # Ambient context first: the agent loop publishes the lineage ROOT id
-    # (stable across context-compression rotation and delegate subagent
-    # trees), which is the better conversation key than a per-segment
-    # session_id passed explicitly. The explicit argument remains as a
-    # fallback for callers running outside any agent turn.
-    effective = get_conversation_context() or session_id
-    if effective:
-        tags.append(conversation_tag(effective))
-    return tags
+    return ["product=hermes-agent", hermes_client_tag()]
@@ -146,56 +146,37 @@ def build_keepalive_http_client(
    base_url: str = "",
    *,
    async_mode: bool = False,
-    verify: Any = True,
 ) -> Optional[Any]:
    """Build an httpx client for OpenAI SDK calls with env-only proxy policy.

    Uses explicit ``HTTPS_PROXY`` / ``NO_PROXY`` env vars via
-    ``_get_proxy_for_base_url``. Plain no-proxy mounts disable httpx's default
-    ``trust_env`` proxy path, so macOS system proxy settings from
+    ``_get_proxy_for_base_url``. A custom transport disables httpx's default
+    ``trust_env`` path, so macOS system proxy settings from
    ``urllib.request.getproxies()`` (which omit the ExceptionsList) are not
    applied. Mirrors ``AIAgent._build_keepalive_http_client``.
-
-    Connection lifecycle is managed at the HTTP pool layer
-    (``keepalive_expiry=20.0`` reaps idle connections before reverse proxies'
-    typical 30-60 s timeouts) instead of the former custom
-    ``socket_options`` transport, which broke streaming behind reverse
-    proxies (#54049, #12952) and stalled TLS handshakes by stripping
-    ``TCP_NODELAY``.
-
-    ``verify`` is forwarded to httpx so auxiliary-client calls (compression,
-    vision, web_extract, title generation, etc.) honor the same per-provider
-    ``ssl_ca_cert`` / ``ssl_verify`` and ``HERMES_CA_BUNDLE`` settings the main
-    client uses. It is passed on the client AND on the plain no-proxy mounts
-    (a mounted transport owns the SSL context for its scheme).
    """
    try:
        import httpx
+        import socket
+
+        if "api.githubcopilot.com" in str(base_url or "").lower():
+            client_cls = httpx.AsyncClient if async_mode else httpx.Client
+            return client_cls()
+
+        sock_opts = [(socket.SOL_SOCKET, socket.SO_KEEPALIVE, 1)]
+        if hasattr(socket, "TCP_KEEPIDLE"):
+            sock_opts.append((socket.IPPROTO_TCP, socket.TCP_KEEPIDLE, 30))
+            sock_opts.append((socket.IPPROTO_TCP, socket.TCP_KEEPINTVL, 10))
+            sock_opts.append((socket.IPPROTO_TCP, socket.TCP_KEEPCNT, 3))
+        elif hasattr(socket, "TCP_KEEPALIVE"):
+            sock_opts.append((socket.IPPROTO_TCP, socket.TCP_KEEPALIVE, 30))

        proxy = _get_proxy_for_base_url(base_url)
-
-        limits = httpx.Limits(
-            max_keepalive_connections=20,
-            max_connections=100,
-            keepalive_expiry=20.0,
-        )
-        # Generous read=None for SSE streaming endpoints.
-        timeout = httpx.Timeout(connect=15.0, read=None, write=15.0, pool=10.0)
-
        transport_cls = httpx.AsyncHTTPTransport if async_mode else httpx.HTTPTransport
        client_cls = httpx.AsyncClient if async_mode else httpx.Client
-        mounts = {}
-        if proxy is None:
-            mounts = {
-                "http://": transport_cls(verify=verify),
-                "https://": transport_cls(verify=verify),
-            }
        return client_cls(
-            limits=limits,
-            timeout=timeout,
+            transport=transport_cls(socket_options=sock_opts),
            proxy=proxy,
-            mounts=mounts or None,
-            verify=verify,
        )
    except Exception:
        return None
@@ -7,7 +7,6 @@ assemble pieces, then combines them with memory and ephemeral prompts.
 import json
 import logging
 import os
-import sys
 import threading
 import contextvars
 from collections import OrderedDict
@@ -18,8 +17,6 @@ from typing import Optional

 from agent.runtime_cwd import resolve_agent_cwd
 from agent.skill_utils import (
-    EXCLUDED_SKILL_DIRS,
-    SKILL_SUPPORT_DIRS,
    extract_skill_conditions,
    extract_skill_description,
    get_all_skills_dirs,
@@ -28,7 +25,6 @@ from agent.skill_utils import (
    parse_frontmatter,
    skill_matches_environment,
    skill_matches_platform,
-    skill_matches_platform_list,
 )
 from utils import atomic_json_write

@@ -114,7 +110,6 @@ def _strip_yaml_frontmatter(content: str) -> str:
    strip it so only the human-readable markdown body is injected into the
    system prompt.
    """
-    content = content.lstrip("\ufeff")  # tolerate UTF-8 BOM (Windows editors)
    if content.startswith("---"):
        end = content.find("\n---", 3)
        if end != -1:
@@ -258,10 +253,6 @@ KANBAN_GUIDANCE = (
    "- **Deliverables.** Files a human wants go in "
    "`kanban_complete(artifacts=[<absolute paths>])` (top-level param; paths in "
    "`metadata` are NOT uploaded). Files must exist at completion.\n"
-    "- **Attachments.** Attach real downloadable artifacts instead of pasting "
-    "links in comments: `kanban_attach` (base64) or `kanban_attach_url` "
-    "(server-side public http(s) fetch); 25 MB cap, `kanban_attachments` "
-    "lists them. Workers may only attach to their own task.\n"
    "- **Created cards.** List ids in `kanban_complete(created_cards=[...])` "
    "ONLY when captured from a successful `kanban_create` return — never invent "
    "or paste ids; the kernel rejects the completion on any phantom id.\n"
@@ -664,7 +655,19 @@ PLATFORM_HINTS = {
        "Standard Markdown is automatically converted to Telegram formatting. "
        "Supported: **bold**, *italic*, ~~strikethrough~~, ||spoiler||, "
        "`inline code`, ```code blocks```, [links](url), and ## headers. "
-        "Prefer bullet lists and labeled key:value pairs for structured data. "
+        "Telegram now supports rich Markdown, so lean into it: whenever it "
+        "makes the answer clearer or easier to scan, actively reach for real "
+        "Markdown tables (pipe `| col | col |` syntax), bullet and numbered "
+        "lists, task lists (`- [ ]` / `- [x]`), headings, nested blockquotes, "
+        "collapsible details, footnotes/references, math/formulas (`$...$`, "
+        "`$$...$$`), underline, subscript/superscript, marked (highlighted) "
+        "text, and anchors. Default to structured formatting over dense "
+        "paragraphs for any comparison, set of steps, key/value summary, or "
+        "tabular data. Prefer real Markdown tables and task lists over "
+        "hand-built bullet substitutes when presenting structured data; these "
+        "degrade gracefully (tables become readable bullet groups) when rich "
+        "rendering is unavailable, but advanced constructs like math and "
+        "collapsible details may render as plain source text in that case. "
        "You can send media files natively: to deliver a file to the user, "
        "include MEDIA:/absolute/path/to/file in your response. Images "
        "(.png, .jpg, .webp) appear as photos, audio (.ogg) sends as voice "
@@ -740,17 +743,6 @@ PLATFORM_HINTS = {
        "or 'all'). Do not promise the user that a deliver='origin' or "
        "default-deliver cron job will message them in this session."
    ),
-    "desktop": (
-        "You are chatting inside the Hermes desktop app — a graphical chat "
-        "surface, not a terminal. Use markdown freely: it renders with full "
-        "GitHub flavor (tables, code blocks with syntax highlighting, math "
-        "via $...$, task lists, blockquote callouts). "
-        "You can deliver files natively — include MEDIA:/absolute/path/to/file "
-        "in your response. Images (.png, .jpg, .webp) appear inline, audio and "
-        "video play inline, and other files arrive as download links. You can "
-        "also include image URLs in markdown format ![alt](url) and they "
-        "render inline as photos."
-    ),
    "sms": (
        "You are communicating via SMS. Keep responses concise and use plain text "
        "only — no markdown, no formatting. SMS messages are limited to ~1600 "
@@ -858,27 +850,6 @@ PLATFORM_HINTS = {
    ),
 }

-# Telegram rich-messages extension — only injected when the user has opted in
-# to ``platforms.telegram.extra.rich_messages: true``.  The base
-# PLATFORM_HINTS["telegram"] covers MarkdownV2-compatible constructs; this
-# extension adds the Bot API 10.1 rich-Markdown guidance (tables, task lists,
-# collapsible details, math, etc.).
-TELEGRAM_RICH_MESSAGES_HINT = (
-    "Telegram now supports rich Markdown, so lean into it: whenever it "
-    "makes the answer clearer or easier to scan, actively reach for real "
-    "Markdown tables (pipe `| col | col |` syntax), bullet and numbered "
-    "lists, task lists (`- [ ]` / `- [x]`), headings, nested blockquotes, "
-    "collapsible details, footnotes/references, math/formulas (`$...$`, "
-    "`$$...$$`), underline, subscript/superscript, marked (highlighted) "
-    "text, and anchors. Default to structured formatting over dense "
-    "paragraphs for any comparison, set of steps, key/value summary, or "
-    "tabular data. Prefer real Markdown tables and task lists over "
-    "hand-built bullet substitutes when presenting structured data; these "
-    "degrade gracefully (tables become readable bullet groups) when rich "
-    "rendering is unavailable, but advanced constructs like math and "
-    "collapsible details may render as plain source text in that case. "
-)
-
 # ---------------------------------------------------------------------------
 # Environment hints — execution-environment awareness for the agent.
 # Unlike PLATFORM_HINTS (which describe the messaging channel), these describe
@@ -1156,6 +1127,22 @@ def build_environment_hints() -> str:
                f"`uname -a && whoami && pwd`."
            )

+    # Hermes desktop GUI — any agent running under the desktop app should know
+    # it. HERMES_DESKTOP marks the backend powering the chat; HERMES_DESKTOP_TERMINAL
+    # marks a hermes launched in the embedded terminal pane. Both set by main.cjs.
+    _truthy = ("1", "true", "yes")
+    _in_desktop = (os.getenv("HERMES_DESKTOP") or "").strip().lower() in _truthy
+    _in_desktop_term = (os.getenv("HERMES_DESKTOP_TERMINAL") or "").strip().lower() in _truthy
+    if _in_desktop or _in_desktop_term:
+        _desktop_hint = "Runtime surface: you're running inside the Hermes desktop GUI app."
+        if _in_desktop_term:
+            _desktop_hint += (
+                " You're in its embedded terminal pane, beside the GUI chat — the user can "
+                "select your output (⌥-drag on macOS, Shift-drag elsewhere) and press "
+                "⌘/Ctrl+L to send it to the chat composer."
+            )
+        hints.append(_desktop_hint)
+
    if is_wsl():
        hints.append(WSL_ENVIRONMENT_HINT)

@@ -1289,26 +1276,13 @@ def clear_skills_system_prompt_cache(*, clear_snapshot: bool = False) -> None:
 def _build_skills_manifest(skills_dir: Path) -> dict[str, list[int]]:
    """Build an mtime/size manifest of all SKILL.md and DESCRIPTION.md files."""
    manifest: dict[str, list[int]] = {}
-    skills_dir_str = str(skills_dir)
-    base = os.path.join(skills_dir_str, "")
-    prefix_len = len(base)
-    for root, dirs, files in os.walk(skills_dir_str, followlinks=True):
-        has_skill_md = "SKILL.md" in files
-        dirs[:] = [
-            d
-            for d in dirs
-            if d not in EXCLUDED_SKILL_DIRS
-            and not (has_skill_md and d in SKILL_SUPPORT_DIRS)
-        ]
-        for filename in ("SKILL.md", "DESCRIPTION.md"):
-            if filename not in files:
-                continue
-            path = os.path.join(root, filename)
+    for filename in ("SKILL.md", "DESCRIPTION.md"):
+        for path in iter_skill_index_files(skills_dir, filename):
            try:
-                st = os.stat(path)
+                st = path.stat()
            except OSError:
                continue
-            manifest[path[prefix_len:]] = [st.st_mtime_ns, st.st_size]
+            manifest[str(path.relative_to(skills_dir))] = [st.st_mtime_ns, st.st_size]
    return manifest


@@ -1440,22 +1414,6 @@ def _skill_should_show(
    return True


-def _current_session_platform_hint() -> str:
-    """Return the active platform without importing the gateway package on CLI startup."""
-    platform = os.environ.get("HERMES_PLATFORM") or os.environ.get("HERMES_SESSION_PLATFORM")
-    if platform:
-        return platform
-
-    session_context = sys.modules.get("gateway.session_context")
-    get_session_env = getattr(session_context, "get_session_env", None) if session_context else None
-    if get_session_env is None:
-        return ""
-    try:
-        return get_session_env("HERMES_SESSION_PLATFORM") or ""
-    except Exception:
-        return ""
-
-
 def build_skills_system_prompt(
    available_tools: "set[str] | None" = None,
    available_toolsets: "set[str] | None" = None,
@@ -1490,10 +1448,15 @@ def build_skills_system_prompt(
    # ── Layer 1: in-process LRU cache ─────────────────────────────────
    # Include the resolved platform so per-platform disabled-skill lists
    # produce distinct cache entries (gateway serves multiple platforms).
-    _platform_hint = _current_session_platform_hint()
+    from gateway.session_context import get_session_env
+    _platform_hint = (
+        os.environ.get("HERMES_PLATFORM")
+        or get_session_env("HERMES_SESSION_PLATFORM")
+        or ""
+    )
    disabled = get_disabled_skill_names(_platform_hint or None)
    cache_key = (
-        str(skills_dir),
+        str(skills_dir.resolve()),
        tuple(str(d) for d in external_dirs),
        tuple(sorted(str(t) for t in (available_tools or set()))),
        tuple(sorted(str(ts) for ts in (available_toolsets or set()))),
@@ -1522,7 +1485,7 @@ def build_skills_system_prompt(
            category = entry.get("category") or "general"
            frontmatter_name = entry.get("frontmatter_name") or skill_name
            platforms = entry.get("platforms") or []
-            if not skill_matches_platform_list(platforms):
+            if not skill_matches_platform({"platforms": platforms}):
                continue
            if frontmatter_name in disabled or skill_name in disabled:
                continue
@@ -1962,7 +1925,6 @@ def build_context_files_prompt(
    cwd: Optional[str] = None,
    skip_soul: bool = False,
    context_length: Optional[int] = None,
-    allow_install_tree_fallback: bool = False,
 ) -> str:
    """Discover and load context files for the system prompt.

@@ -1984,43 +1946,17 @@ def build_context_files_prompt(
    """
    if cwd is None:
        cwd = os.getcwd()
-        cwd_is_fallback = True
-    else:
-        cwd_is_fallback = False

    cwd_path = Path(cwd).resolve()
    sections = []

-    # Never let a FALLBACK-picked directory inside the Hermes install/source
-    # tree gain system-prompt authority. A backend that self-spawns into that
-    # tree (the desktop app default) would otherwise load this repo's
-    # contributor AGENTS.md as authoritative project context (#64590). An
-    # explicitly configured cwd is honored verbatim — the Hermes tree is a
-    # legitimate workspace when the user deliberately points a session at it —
-    # and CLI-style surfaces pass allow_install_tree_fallback=True because
-    # their launch dir IS the user's shell cwd (developing Hermes in-tree).
-    from agent.runtime_cwd import _is_install_tree
-
-    if (
-        cwd_is_fallback
-        and not allow_install_tree_fallback
-        and _is_install_tree(cwd_path)
-    ):
-        logger.warning(
-            "skipping project-context discovery: working-directory resolution "
-            "fell back to the Hermes install tree (%s) — set terminal.cwd to "
-            "your project directory",
-            cwd_path,
-        )
-        project_context = ""
-    else:
-        # Priority-based project context: first match wins
-        project_context = (
-            _load_hermes_md(cwd_path, context_length)
-            or _load_agents_md(cwd_path, context_length)
-            or _load_claude_md(cwd_path, context_length)
-            or _load_cursorrules(cwd_path, context_length)
-        )
+    # Priority-based project context: first match wins
+    project_context = (
+        _load_hermes_md(cwd_path, context_length)
+        or _load_agents_md(cwd_path, context_length)
+        or _load_claude_md(cwd_path, context_length)
+        or _load_cursorrules(cwd_path, context_length)
+    )
    if project_context:
        sections.append(project_context)

@@ -17,23 +17,12 @@ def _apply_cache_marker(msg: dict, cache_marker: dict, native_anthropic: bool =
    role = msg.get("role", "")
    content = msg.get("content")

-    if role == "tool" and native_anthropic:
-        # Native Anthropic layout: top-level marker; the adapter moves it
-        # inside the tool_result block.
-        msg["cache_control"] = cache_marker
+    if role == "tool":
+        if native_anthropic:
+            msg["cache_control"] = cache_marker
        return

    if content is None or content == "":
-        if role == "tool" and not native_anthropic:
-            # OpenRouter rejects top-level cache_control on role:tool (silent
-            # hang) and an empty message has no content part to carry the
-            # marker — skip. Non-empty tool content falls through below and
-            # gets the marker on a content part, which OpenRouter honors.
-            return
-        if role == "assistant" and not native_anthropic:
-            # Empty assistant turns are pure tool_calls. A top-level marker
-            # here is ignored on the envelope layout, so skip.
-            return
        msg["cache_control"] = cache_marker
        return

@@ -49,30 +38,6 @@ def _apply_cache_marker(msg: dict, cache_marker: dict, native_anthropic: bool =
            last["cache_control"] = cache_marker


-def _can_carry_marker(msg: dict, native_anthropic: bool) -> bool:
-    """True if a marker on this message is actually honored by the provider.
-
-    On the native Anthropic layout every message works (top-level markers are
-    relocated by the adapter). On the envelope layout (OpenRouter et al.) only
-    markers inside content parts are honored: empty-content messages (e.g.
-    assistant turns that are pure tool_calls) and empty tool messages would
-    receive a top-level marker the provider ignores — wasting one of the four
-    breakpoints. Skip those so the breakpoints land on messages that count.
-    """
-    if native_anthropic:
-        return True
-    content = msg.get("content")
-    if content is None or content == "":
-        return False
-    if isinstance(content, list):
-        # _apply_cache_marker only marks the LAST content part, so the carrier
-        # predicate must agree: a list whose last element isn't a dict cannot
-        # actually receive a marker and would waste a breakpoint. Mirror the
-        # `content` truthiness + last-element-dict check in _apply_cache_marker.
-        return bool(content) and isinstance(content[-1], dict)
-    return isinstance(content, str)
-
-
 def _build_marker(ttl: str) -> Dict[str, str]:
    """Build a cache_control marker dict for the given TTL ('5m' or '1h')."""
    marker: Dict[str, str] = {"type": "ephemeral"}
@@ -107,12 +72,7 @@ def apply_anthropic_cache_control(
        breakpoints_used += 1

    remaining = 4 - breakpoints_used
-    non_sys = [
-        i
-        for i in range(len(messages))
-        if messages[i].get("role") != "system"
-        and _can_carry_marker(messages[i], native_anthropic=native_anthropic)
-    ]
+    non_sys = [i for i in range(len(messages)) if messages[i].get("role") != "system"]
    for idx in non_sys[-remaining:]:
        _apply_cache_marker(messages[idx], marker, native_anthropic=native_anthropic)

@@ -1,56 +0,0 @@
-"""Token-free detection of user *reactions* to the agent.
-
-Currently the only reaction is ``vibe`` — an expression of affection or
-gratitude toward the agent (``ily``, ``<3``, ``love you``, ``good bot``, a heart
-emoji, …). Detection is a curated regex/lexicon: **no model call, no tokens**.
-
-This is the single source of truth shared by every surface — the CLI pet, the
-TUI heart, and the desktop floating hearts all react off the same signal,
-delivered via ``AIAgent.reaction_callback`` (wired per interactive host).
-
-Generalized on purpose: :func:`detect_reaction` returns a reaction *kind*
-string, so new kinds (other emoji reactions, etc.) can be added here without
-touching any caller. We match affection specifically — not general positive
-sentiment — so "this is great" does NOT fire, but "good bot" / "❤️" do.
-"""
-
-from __future__ import annotations
-
-import re
-
-#: The affection/gratitude reaction — the only kind today.
-VIBE = "vibe"
-
-# Curated affection lexicon. Kept deliberately narrow: gratitude + love aimed at
-# the agent, heart emoji, and ``<3`` (but not the broken heart ``</3``).
-_VIBE_RE = re.compile(
-    "|".join(
-        (
-            r"\bgood\s*bot\b",
-            r"\bi\s*(?:love|luv)\s*(?:you|u|ya)\b",
-            r"\b(?:love|luv)\s*(?:you|u|ya)\b",
-            r"\bily(?:sm)?\b",
-            r"\bthank\s*(?:you|u)\b",
-            r"\b(?:thanks|thx|tysm|ty)\b",
-            r"<3+",  # <3, <33 … but not </3
-            # Hearts + affection faces (❤ ♥ 🥰 😍 😘 💕 💖 💗 💞 💛 💜 💚 💙 💓 💘 💝 🩷).
-            r"[\u2764\u2665"
-            r"\U0001F970\U0001F60D\U0001F618"
-            r"\U0001F495\U0001F496\U0001F497\U0001F49E"
-            r"\U0001F49B\U0001F49C\U0001F49A\U0001F499"
-            r"\U0001F493\U0001F498\U0001F49D\U0001FA77]",
-        )
-    ),
-    re.IGNORECASE,
-)
-
-
-def detect_reaction(text: str | None) -> str | None:
-    """Return the reaction kind for *text* (currently :data:`VIBE`), or ``None``.
-
-    Pure, token-free, and safe to call on every user turn.
-    """
-    if not text:
-        return None
-
-    return VIBE if _VIBE_RE.search(text) else None
@@ -66,13 +66,9 @@ _REASONING_STALE_TIMEOUT_FLOORS: tuple[tuple[str, int], ...] = (
    ("nemotron-3-ultra", 600),
    ("nemotron-3-super", 600),
    ("nemotron-3-nano",  300),
-    # DeepSeek — R1 and V4 reasoning models on hosted NIM / DeepSeek direct.
-    # V4 series emits reasoning_content in a separate delta field before
-    # final content, requiring the same extended stale timeout floor.
+    # DeepSeek — R1 reasoning model on hosted NIM / DeepSeek direct.
    ("deepseek-r1", 600),
    ("deepseek-reasoner", 600),
-    ("deepseek-v4-flash", 600),
-    ("deepseek-v4-pro", 600),
    # Qwen — QwQ reasoning + Qwen3 thinking variants.  QwQ-32B
    # preview is the stable slug; ``qwen3`` covers the family of
    # thinking-mode Qwen3 models (qwen3-235b-a22b, qwen3-32b, etc.)
@@ -194,10 +190,6 @@ def get_reasoning_stale_timeout_floor(model: object) -> Optional[float]:
    300.0
    >>> get_reasoning_stale_timeout_floor("deepseek/deepseek-r1")
    600.0
-    >>> get_reasoning_stale_timeout_floor("deepseek/deepseek-v4-flash")
-    600.0
-    >>> get_reasoning_stale_timeout_floor("deepseek/deepseek-v4-pro")
-    600.0
    >>> get_reasoning_stale_timeout_floor("qwen/qwen3-235b-a22b-thinking")
    180.0
    >>> get_reasoning_stale_timeout_floor("x-ai/grok-4-fast-reasoning")
@@ -76,8 +76,7 @@ _PREFIX_PATTERNS = [
    r"ghu_[A-Za-z0-9]{10,}",            # GitHub user-to-server token
    r"ghs_[A-Za-z0-9]{10,}",            # GitHub server-to-server token
    r"ghr_[A-Za-z0-9]{10,}",            # GitHub refresh token
-    r"xapp-\d+-[A-Za-z0-9-]{10,}",      # Slack app-Level token
-    r"xox[baprs]-[A-Za-z0-9-]{10,}",    # Slack bot/app/user tokens
+    r"xox[baprs]-[A-Za-z0-9-]{10,}",    # Slack tokens
    r"AIza[A-Za-z0-9_-]{30,}",          # Google API keys
    r"pplx-[A-Za-z0-9]{10,}",           # Perplexity
    r"fal_[A-Za-z0-9_-]{10,}",          # Fal.ai
@@ -107,9 +106,6 @@ _PREFIX_PATTERNS = [
    r"brv_[A-Za-z0-9]{10,}",            # ByteRover API key
    r"xai-[A-Za-z0-9]{30,}",            # xAI (Grok) API key
    r"ntn_[A-Za-z0-9]{10,}",            # Notion internal integration token
-    r"fw-[A-Za-z0-9]{30,}",             # Fireworks AI API key
-    r"fw_[A-Za-z0-9]{30,}",             # Fireworks AI API key
-    r"fpk_[A-Za-z0-9]{30,}",            # Fireworks AI project key
 ]

 # ENV assignment patterns: KEY=value where KEY contains a secret-like name.
@@ -139,14 +135,6 @@ _ENV_ASSIGN_RE = re.compile(
 # The colon-form URL guard (skip when ``://`` present) lives at the call site.
 _SECRET_CFG_NAMES = r"(?:api[ _.\-]?key|token|secret|passwd|password|credential|auth)"
 _CFG_VALUE = r"(['\"]?)([^\s&]+?)\2(?=[\s&]|$)"
-
-# Programmatic env lookups (``os.getenv(...)``, ``os.environ[...]``,
-# ``os.environ.get(...)``, ``process.env.X``, ``$ENV{X}``) reference variable
-# *names*, not secret values. When one appears as the VALUE of a KEY=... match
-# it's a code snippet, not a leaked secret — skip redaction (issue #2852).
-_ENV_LOOKUP_VALUE_RE = re.compile(
-    r"^(?:os\.(?:getenv|environ)|process\.env|\$ENV\{)"
-)
 # Namespaced (dotted) key: the secret word may sit anywhere in a dotted path.
 _CFG_DOTTED_RE = re.compile(
    rf"((?:[A-Za-z0-9_\-]+\.)+[A-Za-z0-9_.\-]*{_SECRET_CFG_NAMES}[A-Za-z0-9_.\-]*"
@@ -411,31 +399,6 @@ def _redact_url_userinfo(text: str) -> str:
    )


-def redact_cdp_url(value: object) -> str:
-    """Mask secrets in a CDP/browser endpoint URL before it is logged.
-
-    The global ``redact_sensitive_text`` deliberately passes web-URL query
-    params and ``user:pass@`` userinfo through unmasked (OAuth callbacks,
-    magic-link / pre-signed URLs the agent is meant to follow -- see the
-    web-URL note above). CDP discovery endpoints are NOT such a workflow:
-    their query-string tokens and userinfo passwords are pure credentials
-    that must never reach the logs. So for CDP URLs we opt INTO the two URL
-    redactors that the global pass leaves off.
-
-    This is the single source of truth for redacting a CDP URL that is passed
-    *directly* to a log or error message. Callers that instead need to redact an
-    exception whose text embeds the URL (e.g. a ``websockets`` connect error)
-    should route that through their own error-text helper, which delegates here
-    -- see ``tools.browser_supervisor._redact_cdp_error_text``.
-    """
-    text = redact_sensitive_text("" if value is None else str(value))
-    if not text:
-        return text
-    text = _redact_url_query_params(text)
-    text = _redact_url_userinfo(text)
-    return text
-
-
 def _redact_http_request_target_query_params(text: str) -> str:
    """Redact sensitive query params in HTTP access-log request targets."""
    def _sub(m: re.Match) -> str:
@@ -551,11 +514,6 @@ def redact_sensitive_text(
        if "=" in text:
            def _redact_env(m):
                name, quote, value = m.group(1), m.group(2), m.group(3)
-                # Programmatic env lookups reference variable *names*, not
-                # secret values — masking them corrupts code snippets in
-                # prose/log contexts (issue #2852): ``KEY=os.getenv('X')``.
-                if _ENV_LOOKUP_VALUE_RE.match(value):
-                    return m.group(0)
                return f"{name}={quote}{_mask_token(value)}{quote}"
            text = _ENV_ASSIGN_RE.sub(_redact_env, text)
            # Lowercase/dotted config keys (issue #16413). Skip URLs entirely —
@@ -570,11 +528,6 @@ def redact_sensitive_text(
        if ":" in text and '"' in text:
            def _redact_json(m):
                key, value = m.group(1), m.group(2)
-                # Same programmatic-env-lookup exception as _redact_env above
-                # (issue #2852): "apiKey": "os.getenv('X')" is a code snippet,
-                # not a leaked secret value.
-                if _ENV_LOOKUP_VALUE_RE.match(value):
-                    return m.group(0)
                return f'{key}: "{_mask_token(value)}"'
            text = _JSON_FIELD_RE.sub(_redact_json, text)

@@ -584,11 +537,6 @@ def redact_sensitive_text(
        if ":" in text and "://" not in text:
            def _redact_yaml(m):
                key, sep, value = m.group(1), m.group(2), m.group(3)
-                # Same programmatic-env-lookup exception as _redact_env above
-                # (issue #2852): api_key: os.getenv('X') is a code snippet,
-                # not a leaked secret value.
-                if _ENV_LOOKUP_VALUE_RE.match(value):
-                    return m.group(0)
                return f"{key}{sep}{_mask_token(value)}"
            text = _YAML_ASSIGN_RE.sub(_redact_yaml, text)

@@ -20,9 +20,6 @@ from __future__ import annotations
 import logging
 from typing import Any, Dict, List

-from agent.tool_dispatch_helpers import make_tool_result_message
-from agent.tool_result_classification import tool_may_have_side_effect
-
 logger = logging.getLogger(__name__)


@@ -67,40 +64,8 @@ def strip_interrupted_tool_tails(
                is_interrupted_tool_result(m.get("content", ""))
                for m in tool_results
            ):
-                calls = msg.get("tool_calls") or []
-                if any(
-                    tool_may_have_side_effect(
-                        str((call.get("function") or {}).get("name") or "")
-                    )
-                    for call in calls
-                ):
-                    call_names = {
-                        str(call.get("id") or call.get("call_id") or ""): str(
-                            (call.get("function") or {}).get("name") or ""
-                        )
-                        for call in calls
-                    }
-                    cleaned.append(msg)
-                    for tool_result in tool_results:
-                        if not is_interrupted_tool_result(tool_result.get("content", "")):
-                            cleaned.append(tool_result)
-                            continue
-                        recovered = dict(tool_result)
-                        name = call_names.get(str(tool_result.get("tool_call_id") or ""), "")
-                        recovered["effect_disposition"] = (
-                            "unknown" if tool_may_have_side_effect(name) else "none"
-                        )
-                        recovered["content"] = (
-                            "[Orphan recovery: interrupted side-effecting tool may have "
-                            "executed; its effect is UNKNOWN. Inspect state before retrying.]"
-                            if recovered["effect_disposition"] == "unknown"
-                            else "[Orphan recovery: interrupted read-only tool did not complete.]"
-                        )
-                        cleaned.append(recovered)
-                    i = j
-                    continue
                logger.debug(
-                    "Stripping interrupted read-only assistant→tool replay block "
+                    "Stripping interrupted assistant→tool replay block "
                    "(indices %d–%d, tool_results=%d)",
                    i, j - 1, len(tool_results),
                )
@@ -151,36 +116,11 @@ def strip_dangling_tool_call_tail(
    ):
        return agent_history

-    tool_calls = last.get("tool_calls") or []
-    if any(
-        tool_may_have_side_effect(
-            str((call.get("function") or {}).get("name") or "")
-        )
-        for call in tool_calls
-    ):
-        recovered = list(agent_history)
-        for call in tool_calls:
-            function = call.get("function") or {}
-            name = str(function.get("name") or "unknown")
-            call_id = str(call.get("id") or call.get("call_id") or "")
-            disposition = "unknown" if tool_may_have_side_effect(name) else "none"
-            content = (
-                "[Orphan recovery: this tool may have executed before Hermes stopped; "
-                "its effect is UNKNOWN. Inspect current state before retrying.]"
-                if disposition == "unknown"
-                else "[Orphan recovery: this read-only tool did not complete and had no effect.]"
-            )
-            recovered.append(make_tool_result_message(
-                name, content, call_id, effect_disposition=disposition,
-            ))
-        logger.warning(
-            "Recovered dangling side-effecting tool call(s) as UNKNOWN instead of erasing them"
-        )
-        return recovered
-
    logger.debug(
-        "Stripping dangling unanswered read-only assistant(tool_calls) tail (%d call(s))",
-        len(tool_calls),
+        "Stripping dangling unanswered assistant(tool_calls) tail "
+        "(%d call(s)) — process likely killed mid-tool-call by a "
+        "restart/shutdown command (#49201)",
+        len(last.get("tool_calls") or []),
    )
    return agent_history[:-1]

@@ -198,120 +138,3 @@ def sanitize_replay_history(
    if not agent_history:
        return agent_history
    return strip_dangling_tool_call_tail(strip_interrupted_tool_tails(agent_history))
-
-
-# ──────────────────────────────────────────────────────────────────────
-# Stale dangerous-confirmation text expiry (#59607)
-# ──────────────────────────────────────────────────────────────────────
-
-# How long a high-risk confirmation phrase remains valid.
-# Short on purpose: dangerous side effects should not survive any restart
-# or session resumption gap. The user can always re-confirm if needed.
-_DANGEROUS_CONFIRMATION_EXPIRY_SECONDS = 60.0
-
-# Confirmation phrases that unlock destructive host actions.
-# Substring match (case-insensitive) so that user variants (e.g. trailing
-# punctuation, additional context) still match. Add new patterns here when
-# new high-risk actions are introduced.
-_DANGEROUS_CONFIRMATION_PATTERNS: tuple = (
-    "confirm forced restart",
-    "confirm forced reboot",
-    "confirm shutdown",
-    "confirm reboot",
-    "confirm power off",
-    "yes, delete everything",
-    "confirm wipe",
-    "confirm factory reset",
-    # i18n variants observed in the original incident
-    "確認強制重開機",
-    "確認強制重開",
-    "確認重啟",
-)
-
-# Replacement text for an expired confirmation. Redacting in place (rather
-# than deleting the message) preserves strict user/assistant role
-# alternation in the replayed history.
-_EXPIRED_CONFIRMATION_SENTINEL = (
-    "[A high-risk confirmation previously given here has EXPIRED and must "
-    "not be acted on. Ask the user to re-confirm explicitly before "
-    "performing any destructive action.]"
-)
-
-
-def is_dangerous_confirmation(content: Any) -> bool:
-    """Return True if a user-message text matches a known dangerous confirmation.
-
-    Used by ``strip_stale_dangerous_confirmations`` to decide which
-    transcript rows to expire. Substring + case-insensitive so that
-    ``"Please confirm forced restart, the host is critical"`` still matches.
-    """
-    if not isinstance(content, str):
-        return False
-    text = content.strip().lower()
-    return any(pattern in text for pattern in _DANGEROUS_CONFIRMATION_PATTERNS)
-
-
-def strip_stale_dangerous_confirmations(
-    agent_history: List[Dict[str, Any]],
-    *,
-    now: float,
-    expiry_seconds: float = _DANGEROUS_CONFIRMATION_EXPIRY_SECONDS,
-) -> List[Dict[str, Any]]:
-    """Expire stale dangerous-confirmation text in user messages (#59607).
-
-    When a high-risk side effect (e.g. host restart via ``shutdown.exe``)
-    runs, the user's plain-text confirmation phrase is persisted in the
-    conversation transcript.  If the host restart killed the gateway
-    process before the assistant's tool result was written, the
-    transcript tail ends on the assistant's text response — and the
-    dangerous confirmation text remains in the user role.
-
-    On the next inbound message — possibly a casual "are you there?" from
-    the user minutes later — the LLM sees the stale confirmation and may
-    interpret the new turn as a fresh re-confirmation, re-executing the
-    destructive action.  This is the failure mode reported in #59607.
-
-    Expired confirmations are REDACTED IN PLACE, not removed: deleting a
-    user message from the incident tail (``user(confirm) →
-    assistant("OK, restarting")``) would leave two consecutive assistant
-    messages, violating the strict role-alternation invariant providers
-    enforce.  The message survives with its role intact; only the trigger
-    text is replaced by a sentinel that tells the model the confirmation
-    has expired.
-
-    Messages without a timestamp are left untouched (backward
-    compatibility: legacy transcripts and in-memory test scaffolding have
-    no timestamps).  User messages that contain dangerous confirmation
-    text but are within the expiry window are also left untouched — they
-    represent a fresh confirmation that has not yet been acted on.
-
-    Complements 75ed07ace (which strips the *assistant* side of the
-    broken tail) by handling the *user* side: a stale plain-text
-    confirmation that the assistant has not yet responded to in a way
-    the resume logic recognises.
-    """
-    if not agent_history:
-        return agent_history
-
-    cleaned: List[Dict[str, Any]] = []
-    for msg in agent_history:
-        if (
-            isinstance(msg, dict)
-            and msg.get("role") == "user"
-            and is_dangerous_confirmation(msg.get("content", ""))
-        ):
-            ts = msg.get("timestamp")
-            if ts is not None and (now - float(ts)) > expiry_seconds:
-                logger.debug(
-                    "Redacting stale dangerous-confirmation text in user "
-                    "message (age=%.1fs, expiry=%.1fs): %r",
-                    now - float(ts),
-                    expiry_seconds,
-                    (msg.get("content") or "")[:80],
-                )
-                redacted = dict(msg)
-                redacted["content"] = _EXPIRED_CONFIRMATION_SENTINEL
-                cleaned.append(redacted)
-                continue
-        cleaned.append(msg)
-    return cleaned
@@ -24,14 +24,6 @@ _jitter_lock = threading.Lock()
 # not sit silent for 20+ minutes.
 _ZAI_CODING_OVERLOAD_LONG_BACKOFF = (30.0, 60.0, 90.0, 120.0)

-# Number of initial short retries before the adaptive long-backoff tier kicks
-# in. Shared by ``adaptive_rate_limit_backoff`` (which walks the long table
-# starting at attempt ``short_attempts + 1``) and
-# ``zai_coding_overload_retry_ceiling`` (which sizes the retry loop so every
-# long-tier entry is reachable). Keeping it a single module constant prevents
-# the two from silently desyncing if the short-retry count is ever tuned.
-_ZAI_CODING_OVERLOAD_SHORT_ATTEMPTS = 3
-

 def jittered_backoff(
    attempt: int,
@@ -112,7 +104,7 @@ def adaptive_rate_limit_backoff(
    model: str | None,
    error: Any,
    default_wait: float,
-    short_attempts: int = _ZAI_CODING_OVERLOAD_SHORT_ATTEMPTS,
+    short_attempts: int = 3,
 ) -> tuple[float, str | None]:
    """Provider-aware rate-limit backoff.

@@ -135,20 +127,3 @@ def adaptive_rate_limit_backoff(
    # A smaller jitter ratio keeps long waits readable while still avoiding
    # synchronized retry storms across concurrent Hermes sessions.
    return jittered_backoff(1, base_delay=base_delay, max_delay=base_delay, jitter_ratio=0.2), "zai_coding_overload_long"
-
-
-def zai_coding_overload_retry_ceiling(short_attempts: int = _ZAI_CODING_OVERLOAD_SHORT_ATTEMPTS) -> int:
-    """Retry-loop ceiling needed for the full Z.AI overload backoff schedule.
-
-    The adaptive policy runs ``short_attempts`` short retries, then walks the
-    long-backoff table one entry per subsequent attempt. The retry loop gives
-    up as soon as ``retry_count >= ceiling`` — and that check runs *before* the
-    attempt's backoff is computed — so the ceiling must sit one past the final
-    long-backoff entry for every long tier to actually execute.
-
-    With the default ``api_max_retries`` (3) equal to ``short_attempts`` (3),
-    the loop always gave up before reaching the long tier, leaving the whole
-    long-backoff schedule as dead code. Callers extend the ceiling to this
-    value for Z.AI Coding overload 429s so the 30/60/90/120s waits run.
-    """
-    return short_attempts + len(_ZAI_CODING_OVERLOAD_LONG_BACKOFF) + 1
@@ -10,36 +10,15 @@ Multi-session gateways can pin a logical cwd via the `_SESSION_CWD`
 contextvar; CLI/cron fall through to `TERMINAL_CWD`/launch cwd.
 """

-import logging
 import os
 from contextvars import ContextVar, Token
 from pathlib import Path
 from typing import Any

-logger = logging.getLogger(__name__)
-
 _UNSET: Any = object()

 _SESSION_CWD: ContextVar = ContextVar("HERMES_SESSION_CWD", default=_UNSET)

-# The Python package/source root (this file lives at <root>/agent/runtime_cwd.py).
-# When a backend is launched from, or self-spawns into, this tree (the desktop
-# app default), an os.getcwd() fallback would inject this repo's contributor
-# AGENTS.md as authoritative project context. Context discovery must never
-# resolve here.
-_PACKAGE_ROOT = Path(__file__).resolve().parent.parent
-
-
-def _is_install_tree(p: Path) -> bool:
-    # True only when p IS the package root or sits inside it. Ancestors of the
-    # package root (a user home that happens to contain the checkout, a --user
-    # site-packages parent) are legitimate workspaces and must not be blocked.
-    try:
-        p = p.resolve()
-    except Exception:
-        return False
-    return p == _PACKAGE_ROOT or _PACKAGE_ROOT in p.parents
-

 def set_session_cwd(cwd: str | None) -> Token:
    """Pin the logical cwd for the current context."""
@@ -63,38 +42,21 @@ def resolve_agent_cwd() -> Path:
        p = Path(override).expanduser()
        if p.is_dir():
            return p
-        logger.warning("configured working directory does not exist: %s", override)
    raw = os.environ.get("TERMINAL_CWD", "").strip()
    if raw:
        p = Path(raw).expanduser()
        if p.is_dir():
            return p
-        logger.warning("TERMINAL_CWD does not exist: %s", raw)
    return Path(os.getcwd())


 def resolve_context_cwd() -> Path | None:
    # None means "no configured cwd": build_context_files_prompt then falls back
-    # to the launch dir (os.getcwd()), correct for a local CLI launched inside a
-    # real project. A configured path is validated here (previously it was passed
-    # through unchecked, diverging from resolve_agent_cwd). An explicitly
-    # configured path is otherwise honored verbatim — including the Hermes
-    # source tree itself, which is a legitimate workspace when the user is
-    # developing Hermes (per-surface policy for fallback-picked directories
-    # lives in build_context_files_prompt; see #64590).
+    # to the launch dir (os.getcwd()) — correct for the local CLI. The gateway
+    # avoids slurping its install dir by setting TERMINAL_CWD (see system_prompt.py)
+    # or, per session, the _SESSION_CWD contextvar above.
    override = _session_cwd_override()
    if override:
-        p = Path(override).expanduser()
-        if not p.is_dir():
-            logger.warning("configured working directory does not exist: %s", override)
-        else:
-            return p
-        return None
+        return Path(override).expanduser()
    raw = os.environ.get("TERMINAL_CWD", "").strip()
-    if raw:
-        p = Path(raw).expanduser()
-        if not p.is_dir():
-            logger.warning("TERMINAL_CWD does not exist: %s", raw)
-        else:
-            return p
-    return None
+    return Path(raw).expanduser() if raw else None
@@ -1,41 +1,13 @@
 """External secret source integrations.

 A secret source is anything that can supply environment-variable-shaped
-credentials at process startup, _after_ ~/.hermes/.env has loaded.
+credentials at process startup, _after_ ~/.hermes/.env has loaded.  By
+default sources are non-destructive: they only set values for env vars
+that aren't already present, so .env and shell exports continue to win.

-The contract every source implements is
-:class:`agent.secret_sources.base.SecretSource`; the orchestrator that
-runs the enabled sources (ordering, mapped-beats-bulk precedence,
-first-claim-wins conflicts, ``override_existing`` semantics, provenance)
-is :func:`agent.secret_sources.registry.apply_all`.  Multiple sources
-can be enabled at once — see the registry module docstring for the
-precedence ladder.  The atomic-write / 0600 / TTL disk-cache substrate
-is shared across backends in ``agent.secret_sources._cache`` so the
-security-sensitive bits live in exactly one place.
-
-Currently bundled:
+Currently shipped:

  - ``bitwarden`` — Bitwarden Secrets Manager (`bws` CLI).  See
    ``agent.secret_sources.bitwarden`` for the integration and
    ``hermes_cli.secrets_cli`` for the user-facing setup wizard.
-  - ``onepassword`` — 1Password ``op://`` secret references (`op` CLI).
-    See ``agent.secret_sources.onepassword`` for the integration and
-    ``hermes_cli.onepassword_secrets_cli`` for the user-facing commands.
-
-The bundled set is deliberately closed (policy mirrors memory
-providers): new third-party secret managers ship as standalone plugin
-repos that subclass ``SecretSource`` and register through
-``PluginContext.register_secret_source()`` — they are NOT added to this
-package.  A generic ``command`` source is a possible future exception;
-OS keystores (Keychain/DPAPI/libsecret) are under discussion.
 """
-
-from agent.secret_sources.base import (  # noqa: F401
-    SECRET_SOURCE_API_VERSION,
-    ErrorKind,
-    FetchResult,
-    SecretSource,
-    is_valid_env_name,
-    run_secret_cli,
-    scrub_ansi,
-)
@@ -1,213 +0,0 @@
-"""Shared substrate for external secret-source backends.
-
-Every backend (Bitwarden, 1Password, …) needs the same handful of
-security-sensitive primitives:
-
-  * a uniform result object (:class:`FetchResult`),
-  * environment-variable name validation (:func:`is_valid_env_name`),
-  * a two-layer fetch cache whose disk half writes atomically with ``0600``
-    permissions and honours a TTL (:class:`DiskCache`, :class:`CachedFetch`).
-
-These used to live inline inside ``bitwarden.py``.  Pulling them here means
-the atomic-write / ``0600`` / TTL logic is audited and fixed in exactly one
-place instead of drifting across copy-pasted per-backend modules — each
-backend supplies only its own cache-key shape and a serializer for it.
-
-Nothing in this module ever raises out to the caller's hot path: the disk
-layer is strictly best-effort (a miss just triggers a refetch), because a
-cache problem must never block Hermes startup.
-"""
-
-from __future__ import annotations
-
-import json
-import os
-import tempfile
-import time
-from dataclasses import dataclass
-from pathlib import Path
-from typing import Callable, Dict, Generic, Optional, TypeVar
-
-__all__ = [
-    "FetchResult",
-    "CachedFetch",
-    "DiskCache",
-    "is_valid_env_name",
-    "resolve_cache_home",
-]
-
-
-# ---------------------------------------------------------------------------
-# Result object + env-name validation — canonical definitions live in
-# ``agent.secret_sources.base`` (the SecretSource contract module); re-exported
-# here so backends that import from ``_cache`` keep working.
-# ---------------------------------------------------------------------------
-
-from agent.secret_sources.base import (  # noqa: E402
-    FetchResult,
-    is_valid_env_name,
-)
-
-
-# ---------------------------------------------------------------------------
-# Cache entry
-# ---------------------------------------------------------------------------
-
-
-@dataclass
-class CachedFetch:
-    """A set of fetched secret values plus when they were fetched."""
-
-    secrets: Dict[str, str]
-    fetched_at: float
-
-    def is_fresh(self, ttl_seconds: float) -> bool:
-        if ttl_seconds <= 0:
-            return False
-        return (time.time() - self.fetched_at) < ttl_seconds
-
-
-
-
-# ---------------------------------------------------------------------------
-# Disk cache
-# ---------------------------------------------------------------------------
-
-
-def resolve_cache_home(home_path: Optional[Path] = None) -> Path:
-    """Resolve the Hermes home used for cache paths.
-
-    ``home_path`` is whatever ``load_hermes_dotenv()`` already resolved;
-    falling back to ``$HERMES_HOME`` / ``~/.hermes`` keeps direct callers
-    (and tests that don't thread a home through) working.
-    """
-    if home_path is None:
-        home_path = Path(os.getenv("HERMES_HOME", Path.home() / ".hermes"))
-    return home_path
-
-
-K = TypeVar("K")
-
-
-class DiskCache(Generic[K]):
-    """Best-effort, profile-aware on-disk cache for fetched secret values.
-
-    One JSON object per backend lives at ``<hermes_home>/cache/<basename>``::
-
-        {"key": "<serialized cache key>", "secrets": {...}, "fetched_at": 1.0}
-
-    The file holds only secret *values* keyed by the serialized cache key —
-    never raw auth material.  Backends are responsible for fingerprinting
-    tokens/sessions *before* they reach ``key_serializer`` so the token can't
-    land in the key.
-
-    Writes are atomic (``mkstemp`` → ``chmod 0600`` → ``os.replace``) and the
-    containing ``cache/`` directory is forced to ``0700`` — ``mkdir``'s mode is
-    umask-subject, so the chmod is the reliable form.  Both ``read`` and
-    ``write`` short-circuit when ``ttl_seconds <= 0``, so setting the TTL to
-    zero disables *both* cache layers symmetrically: a user opting out never
-    gets secret values written to disk at all.
-    """
-
-    def __init__(self, basename: str, *, key_serializer: Callable[[K], str]) -> None:
-        self._basename = basename
-        self._key_serializer = key_serializer
-        # Temp-file prefix derived from the basename so concurrent writers for
-        # different backends in the same dir don't collide on the staging name.
-        stem = basename.split(".", 1)[0]
-        self._tmp_prefix = f".{stem}_"
-
-    def path(self, home_path: Optional[Path] = None) -> Path:
-        return resolve_cache_home(home_path) / "cache" / self._basename
-
-    def read(
-        self,
-        key: K,
-        ttl_seconds: float,
-        home_path: Optional[Path] = None,
-    ) -> Optional[CachedFetch]:
-        """Return a fresh cached entry for ``key``, or None.
-
-        Best-effort: any I/O or parse error, a key mismatch, or a stale entry
-        all return None so the caller re-fetches.
-        """
-        if ttl_seconds <= 0:
-            return None
-        path = self.path(home_path)
-        try:
-            with open(path, "r", encoding="utf-8") as f:
-                payload = json.load(f)
-        except (OSError, json.JSONDecodeError):
-            return None
-        if not isinstance(payload, dict):
-            return None
-        if payload.get("key") != self._key_serializer(key):
-            return None
-        secrets = payload.get("secrets")
-        fetched_at = payload.get("fetched_at")
-        if not isinstance(secrets, dict) or not isinstance(fetched_at, (int, float)):
-            return None
-        # JSON permits non-string values; env vars need strings, so coerce by
-        # dropping anything that isn't a str→str pair.
-        typed: Dict[str, str] = {
-            k: v for k, v in secrets.items() if isinstance(k, str) and isinstance(v, str)
-        }
-        entry = CachedFetch(secrets=typed, fetched_at=float(fetched_at))
-        if not entry.is_fresh(ttl_seconds):
-            return None
-        return entry
-
-    def write(
-        self,
-        key: K,
-        entry: CachedFetch,
-        ttl_seconds: float,
-        home_path: Optional[Path] = None,
-    ) -> None:
-        """Persist ``entry`` for ``key`` atomically at mode ``0600``.
-
-        No-op when ``ttl_seconds <= 0`` (so caching is genuinely off) or on any
-        I/O error — the next invocation just re-fetches.
-        """
-        if ttl_seconds <= 0:
-            return
-        path = self.path(home_path)
-        try:
-            cache_dir = path.parent
-            cache_dir.mkdir(parents=True, exist_ok=True)
-            # mkdir's mode is umask-subject; chmod the dir to 0700 so cache
-            # metadata isn't exposed if HERMES_HOME is ever made traversable.
-            try:
-                os.chmod(cache_dir, 0o700)
-            except OSError:
-                pass
-            payload = {
-                "key": self._key_serializer(key),
-                "secrets": entry.secrets,
-                "fetched_at": entry.fetched_at,
-            }
-            # Write to a sibling temp file and atomic-rename.  tempfile honours
-            # os.umask, so we explicitly chmod 0600 before the rename.
-            fd, tmp = tempfile.mkstemp(
-                prefix=self._tmp_prefix, suffix=".tmp", dir=str(cache_dir)
-            )
-            try:
-                with os.fdopen(fd, "w", encoding="utf-8") as f:
-                    json.dump(payload, f)
-                os.chmod(tmp, 0o600)
-                os.replace(tmp, path)
-            except BaseException:
-                try:
-                    os.unlink(tmp)
-                except OSError:
-                    pass
-                raise
-        except OSError:
-            pass  # best-effort — a disk-cache miss next invocation is fine
-
-    def clear(self, home_path: Optional[Path] = None) -> None:
-        """Delete the on-disk cache file if present (idempotent)."""
-        try:
-            self.path(home_path).unlink()
-        except (FileNotFoundError, OSError):
-            pass
@@ -1,274 +0,0 @@
-"""Secret-source contract: the ABC every secret backend implements.
-
-A *secret source* resolves credentials from an external secret manager
-(Bitwarden Secrets Manager, 1Password, an OS keystore, a user script, ...)
-into environment-variable-shaped values at process startup, AFTER
-``~/.hermes/.env`` has loaded and BEFORE the rest of Hermes reads
-``os.environ``.
-
-Scope of the contract (deliberate, please do not widen):
-
-* **Read-only.**  Sources resolve refs → values.  There is no write-back
-  ("save this key to your vault"), no arbitrary secret objects, and no
-  mid-session secret API.  If a future need for rotation/refresh appears
-  it will arrive as a versioned optional hook — do not bolt it on.
-* **Startup-time, synchronous.**  ``fetch()`` is called once per process
-  (per HERMES_HOME) by the orchestrator in
-  :mod:`agent.secret_sources.registry`, which enforces a wall-clock
-  timeout around it.  Sources must not spawn background refreshers.
-* **Never raises, never prompts.**  ``fetch()`` returns a
-  :class:`FetchResult` — errors go in ``result.error`` with a
-  machine-readable :class:`ErrorKind`.  Interactive auth belongs in the
-  source's CLI ``setup`` flow, never on the startup path (non-TTY
-  gateway/cron startup must never block on stdin).
-* **Sources fetch; the orchestrator applies.**  A source returns the
-  name→value mapping it *would* contribute.  Precedence (mapped-beats-bulk,
-  first-wins, ``override_existing``, protected vars), conflict warnings,
-  provenance tracking, and the actual ``os.environ`` writes are owned by
-  the orchestrator so no backend can get them wrong.
-
-Versioning: ``SECRET_SOURCE_API_VERSION`` gates plugin compatibility.
-New *optional* hooks with default implementations do not bump it;
-required-signature changes do, and the registry skips (with a warning)
-sources built against a different major version instead of crashing
-startup.
-"""
-
-from __future__ import annotations
-
-import os
-import re
-import subprocess
-from abc import ABC, abstractmethod
-from dataclasses import dataclass, field
-from enum import Enum
-from pathlib import Path
-from typing import Dict, FrozenSet, List, Optional, Sequence
-
-# Bump ONLY for breaking changes to the required contract surface
-# (abstract-method signatures, FetchResult required fields).  Additive
-# optional hooks must ship with defaults and must NOT bump this.
-SECRET_SOURCE_API_VERSION = 1
-
-# Timeout the orchestrator enforces around fetch() when the source's
-# config section doesn't override it.  Generous because a first run may
-# include a one-time CLI binary auto-install (e.g. bws download+verify).
-DEFAULT_FETCH_TIMEOUT_SECONDS = 120.0
-
-# Default timeout for run_secret_cli() subprocess invocations.
-DEFAULT_CLI_TIMEOUT_SECONDS = 30.0
-
-
-class ErrorKind(str, Enum):
-    """Machine-readable failure taxonomy for :class:`FetchResult.error`.
-
-    A fixed vocabulary keeps startup warnings and ``hermes secrets status``
-    uniform across backends, and lets the orchestrator implement
-    kind-dependent policy (e.g. a future stale-cache fallback on
-    ``NETWORK``/``TIMEOUT`` but not on ``AUTH_FAILED``) exactly once.
-    """
-
-    NOT_CONFIGURED = "not_configured"    # enabled but missing token/project/map
-    BINARY_MISSING = "binary_missing"    # helper CLI not found / not installed
-    AUTH_FAILED = "auth_failed"          # bad credentials
-    AUTH_EXPIRED = "auth_expired"        # credentials were valid, aren't now
-    REF_INVALID = "ref_invalid"          # a secret reference failed validation
-    NETWORK = "network"                  # transport-level failure
-    EMPTY_VALUE = "empty_value"          # backend returned nothing for a ref
-    TIMEOUT = "timeout"                  # fetch exceeded its wall-clock budget
-    INTERNAL = "internal"                # anything else (bug, unexpected shape)
-
-
-@dataclass
-class FetchResult:
-    """Outcome of one source's fetch.
-
-    ``secrets`` holds what the source *would* contribute; whether each
-    var is actually applied is the orchestrator's decision.  ``applied``
-    and ``skipped`` exist for backward compatibility with the original
-    Bitwarden fetch-and-apply entry point and are left empty by
-    conforming ``fetch()`` implementations.
-    """
-
-    secrets: Dict[str, str] = field(default_factory=dict)
-    applied: List[str] = field(default_factory=list)
-    skipped: List[str] = field(default_factory=list)
-    warnings: List[str] = field(default_factory=list)
-    error: Optional[str] = None
-    error_kind: Optional[ErrorKind] = None
-    # Path of the helper binary used, when the source is CLI-driven.
-    # Surfaced by status commands; None for SDK/API-driven sources.
-    binary_path: Optional[Path] = None
-
-    @property
-    def ok(self) -> bool:
-        return self.error is None
-
-
-class SecretSource(ABC):
-    """One external secret backend.
-
-    Subclasses set the class attributes and implement :meth:`fetch`.
-    Everything else has a sensible default.
-
-    Attributes:
-        name: Config-section key under ``secrets:`` in config.yaml.
-            Lowercase ``[a-z0-9_]+``.  Also the provenance label stored
-            for every var this source supplies.
-        label: Human-readable name used in startup messages and
-            ``hermes secrets status`` (e.g. ``"Bitwarden Secrets Manager"``).
-        shape: ``"mapped"`` when the user explicitly binds env-var names
-            to refs (1Password ``env:`` map, command source) or
-            ``"bulk"`` when the backend injects whole projects/folders
-            of secrets implicitly (Bitwarden BSM).  The orchestrator
-            gives mapped sources precedence over bulk sources: an
-            explicit binding is stronger intent than a project dump.
-        scheme: Optional URI scheme this source owns for secret
-            references (``"op"`` for ``op://...``).  Must be unique
-            across registered sources — refs may eventually appear
-            outside the ``secrets:`` block (e.g. credential-pool
-            ``api_key`` fields), so scheme collisions are rejected at
-            registration time to keep that future possible.
-        api_version: Contract version this source was built against.
-    """
-
-    api_version: int = SECRET_SOURCE_API_VERSION
-    name: str = ""
-    label: str = ""
-    shape: str = "mapped"  # "mapped" | "bulk"
-    scheme: Optional[str] = None
-
-    # -- required ----------------------------------------------------------
-
-    @abstractmethod
-    def fetch(self, cfg: dict, home_path: Path) -> FetchResult:
-        """Resolve this source's secrets. MUST NOT raise or prompt.
-
-        ``cfg`` is the source's raw config section (``secrets.<name>``)
-        from config.yaml — treat every field defensively, the section
-        may be malformed.  ``home_path`` is the resolved HERMES_HOME.
-        """
-
-    # -- optional hooks (defaults are correct for most sources) ------------
-
-    def is_enabled(self, cfg: dict) -> bool:
-        """Whether the user turned this source on."""
-        return bool(isinstance(cfg, dict) and cfg.get("enabled"))
-
-    def override_existing(self, cfg: dict) -> bool:
-        """May this source overwrite vars that .env / the shell already set?
-
-        This NEVER extends to vars claimed by another secret source in the
-        same startup pass — cross-source overrides are a config error the
-        orchestrator warns about, not a knob.
-        """
-        return bool(isinstance(cfg, dict) and cfg.get("override_existing", False))
-
-    def protected_env_vars(self, cfg: dict) -> FrozenSet[str]:
-        """Env vars the orchestrator must never let ANY source overwrite.
-
-        Typically the source's own bootstrap-auth var (e.g.
-        ``BWS_ACCESS_TOKEN``) so a vault that contains its own access
-        token can't clobber the credential used to reach it.
-        """
-        return frozenset()
-
-    def fetch_timeout_seconds(self, cfg: dict) -> float:
-        """Wall-clock budget the orchestrator enforces around fetch()."""
-        try:
-            val = float((cfg or {}).get("timeout_seconds", DEFAULT_FETCH_TIMEOUT_SECONDS))
-        except (TypeError, ValueError):
-            return DEFAULT_FETCH_TIMEOUT_SECONDS
-        return val if val > 0 else DEFAULT_FETCH_TIMEOUT_SECONDS
-
-    def config_schema(self) -> dict:
-        """Optional description of this source's config keys.
-
-        Shape: ``{key: {"description": str, "default": Any}}``.  Used by
-        setup surfaces to render config without hardcoding per-source
-        knowledge.  Purely informational.
-        """
-        return {}
-
-
-# ---------------------------------------------------------------------------
-# Shared helpers — use these instead of hand-rolling per backend
-# ---------------------------------------------------------------------------
-
-
-_ENV_NAME_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
-
-# ANSI CSI/OSC escape sequences — helper-CLI stderr often carries color
-# codes that must not reach Hermes' own startup output.
-_ANSI_RE = re.compile(r"\x1b(?:\[[0-9;?]*[ -/]*[@-~]|\][^\x07\x1b]*(?:\x07|\x1b\\)?)")
-
-
-def is_valid_env_name(name: str) -> bool:
-    """True when ``name`` is a legal environment-variable name."""
-    return bool(name) and bool(_ENV_NAME_RE.match(name))
-
-
-def scrub_ansi(text: str) -> str:
-    """Strip ANSI escape sequences (whole CSI/OSC sequences, not just ESC)."""
-    return _ANSI_RE.sub("", text or "")
-
-
-def run_secret_cli(
-    argv: Sequence[str],
-    *,
-    allow_env: Sequence[str] = (),
-    extra_env: Optional[Dict[str, str]] = None,
-    timeout: float = DEFAULT_CLI_TIMEOUT_SECONDS,
-) -> subprocess.CompletedProcess:
-    """Run a secret-manager helper CLI with a minimal, allowlisted env.
-
-    Security posture shared by every subprocess-driven backend:
-
-    * argv list only — never ``shell=True``.  Callers pass user-supplied
-      reference strings AFTER a ``--`` option terminator in their argv.
-    * The child gets ``PATH``/``HOME``/locale basics plus only the env
-      vars named in ``allow_env`` (auth/session vars) and ``extra_env``
-      — never a copy of the full post-dotenv ``os.environ``, which by
-      this point holds every credential Hermes knows about.
-    * ``NO_COLOR=1`` is set and stderr/stdout are ANSI-scrubbed so
-      helper diagnostics can't smuggle escape sequences into Hermes
-      output.
-    * stdin is ``/dev/null`` so a helper that decides to prompt fails
-      fast instead of hanging startup.
-
-    Raises ``RuntimeError`` on spawn failure or timeout (message safe to
-    surface); returns the completed process otherwise — callers own
-    returncode interpretation.
-    """
-    base_keep = ("PATH", "HOME", "USERPROFILE", "SYSTEMROOT", "TMPDIR", "TEMP",
-                 "LANG", "LC_ALL", "XDG_CONFIG_HOME", "XDG_DATA_HOME")
-    env: Dict[str, str] = {}
-    for key in (*base_keep, *allow_env):
-        val = os.environ.get(key)
-        if val is not None:
-            env[key] = val
-    if extra_env:
-        env.update(extra_env)
-    env.setdefault("NO_COLOR", "1")
-
-    try:
-        proc = subprocess.run(  # noqa: S603 — argv list, no shell
-            list(argv),
-            env=env,
-            capture_output=True,
-            text=True,
-            timeout=timeout,
-            stdin=subprocess.DEVNULL,
-        )
-    except subprocess.TimeoutExpired as exc:
-        raise RuntimeError(
-            f"{Path(str(argv[0])).name} timed out after {timeout:.0f}s"
-        ) from exc
-    except OSError as exc:
-        raise RuntimeError(
-            f"failed to invoke {Path(str(argv[0])).name}: {exc}"
-        ) from exc
-
-    proc.stdout = proc.stdout or ""
-    proc.stderr = scrub_ansi(proc.stderr or "")
-    return proc
@@ -42,17 +42,10 @@ import time
 import urllib.error
 import urllib.request
 import zipfile
+from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Dict, List, Optional, Tuple

-from agent.secret_sources._cache import (
-    CachedFetch as _CachedFetch,
-    DiskCache,
-    FetchResult,
-    is_valid_env_name as _is_valid_env_name,
-)
-from agent.secret_sources.base import ErrorKind, SecretSource
-
 logger = logging.getLogger(__name__)


@@ -77,7 +70,7 @@ _BWS_RUN_TIMEOUT = 30
 # In-process cache so repeated load_hermes_dotenv() calls (CLI startup,
 # gateway hot-reload, test suites) don't re-fetch from BSM.
 _CacheKey = Tuple[str, str, str]  # (access_token_fingerprint, project_id, server_url)
-_CACHE: Dict[_CacheKey, _CachedFetch] = {}
+_CACHE: Dict[_CacheKey, "_CachedFetch"] = {}

 # Disk-persisted cache so back-to-back CLI invocations (e.g. `hermes chat -q ...`
 # called from scripts, cron, the gateway forking new agents) don't each pay the
@@ -88,29 +81,124 @@ _CACHE: Dict[_CacheKey, _CachedFetch] = {}
 # <hermes_home>/cache/bws_cache.json. The file holds only the secret VALUES,
 # never the access token. It's plaintext-equivalent to ~/.hermes/.env (which
 # we already accept) but kept out of the .env file so users editing it won't
-# accidentally commit BSM-sourced secrets. The atomic-write/0600/TTL mechanics
-# live in agent.secret_sources._cache.DiskCache, shared with the other backends.
+# accidentally commit BSM-sourced secrets.
 _DISK_CACHE_BASENAME = "bws_cache.json"


+def _disk_cache_path(home_path: Optional[Path] = None) -> Path:
+    """Return the disk cache path under hermes_home/cache/.
+
+    `home_path` is what `load_hermes_dotenv()` already resolved; falling back
+    to `$HERMES_HOME` / `~/.hermes` keeps direct callers working too.
+    """
+    if home_path is None:
+        home_path = Path(os.getenv("HERMES_HOME", Path.home() / ".hermes"))
+    return home_path / "cache" / _DISK_CACHE_BASENAME
+
+
 def _cache_key_str(cache_key: _CacheKey) -> str:
    """Serialize a cache key to a stable string for JSON storage."""
    token_fp, project_id, server_url = cache_key
    return f"{token_fp}|{project_id}|{server_url}"


-_DISK_CACHE: DiskCache = DiskCache(
-    _DISK_CACHE_BASENAME, key_serializer=_cache_key_str
-)
+def _read_disk_cache(cache_key: _CacheKey, ttl_seconds: float,
+                     home_path: Optional[Path] = None) -> Optional["_CachedFetch"]:
+    """Return a cached entry from disk if fresh, else None.

-
-def _disk_cache_path(home_path: Optional[Path] = None) -> Path:
-    """Return the disk cache path under hermes_home/cache/.
-
-    Thin wrapper over the shared DiskCache, kept for tests and any direct
-    callers; falls back to `$HERMES_HOME` / `~/.hermes` when home is None.
+    Best-effort: any I/O or parse error returns None and we re-fetch.
    """
-    return _DISK_CACHE.path(home_path)
+    if ttl_seconds <= 0:
+        return None
+    path = _disk_cache_path(home_path)
+    try:
+        with open(path, "r", encoding="utf-8") as f:
+            payload = json.load(f)
+    except (OSError, json.JSONDecodeError):
+        return None
+    if not isinstance(payload, dict):
+        return None
+    if payload.get("key") != _cache_key_str(cache_key):
+        return None
+    secrets = payload.get("secrets")
+    fetched_at = payload.get("fetched_at")
+    if not isinstance(secrets, dict) or not isinstance(fetched_at, (int, float)):
+        return None
+    # Coerce all values to strings — JSON allows numbers but env vars need strings
+    typed_secrets: Dict[str, str] = {
+        k: v for k, v in secrets.items() if isinstance(k, str) and isinstance(v, str)
+    }
+    entry = _CachedFetch(secrets=typed_secrets, fetched_at=float(fetched_at))
+    if not entry.is_fresh(ttl_seconds):
+        return None
+    return entry
+
+
+def _write_disk_cache(cache_key: _CacheKey, entry: "_CachedFetch",
+                      home_path: Optional[Path] = None) -> None:
+    """Persist a cache entry to disk atomically with mode 0600.
+
+    Best-effort: any I/O error is swallowed (the next invocation will just
+    re-fetch). We never want disk cache failures to break startup.
+    """
+    path = _disk_cache_path(home_path)
+    try:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        payload = {
+            "key": _cache_key_str(cache_key),
+            "secrets": entry.secrets,
+            "fetched_at": entry.fetched_at,
+        }
+        # Write to a temp file in the same directory and atomic-rename.
+        # tempfile honors os.umask, so we explicitly chmod 0600 before rename.
+        fd, tmp = tempfile.mkstemp(
+            prefix=".bws_cache_", suffix=".tmp", dir=str(path.parent)
+        )
+        try:
+            with os.fdopen(fd, "w", encoding="utf-8") as f:
+                json.dump(payload, f)
+            os.chmod(tmp, 0o600)
+            os.replace(tmp, path)
+        except BaseException:
+            try:
+                os.unlink(tmp)
+            except OSError:
+                pass
+            raise
+    except OSError:
+        pass  # best-effort — disk cache miss on next invocation is fine
+
+
+@dataclass
+class _CachedFetch:
+    secrets: Dict[str, str]
+    fetched_at: float
+
+    def is_fresh(self, ttl_seconds: float) -> bool:
+        if ttl_seconds <= 0:
+            return False
+        return (time.time() - self.fetched_at) < ttl_seconds
+
+
+# ---------------------------------------------------------------------------
+# Public dataclasses
+# ---------------------------------------------------------------------------
+
+
+@dataclass
+class FetchResult:
+    """Outcome of a single BSM pull."""
+
+    secrets: Dict[str, str] = field(default_factory=dict)
+    applied: List[str] = field(default_factory=list)   # set into os.environ
+    skipped: List[str] = field(default_factory=list)   # already set, not overridden
+    warnings: List[str] = field(default_factory=list)  # non-fatal issues
+    error: Optional[str] = None                        # fatal: nothing was fetched
+    binary_path: Optional[Path] = None
+
+    @property
+    def ok(self) -> bool:
+        return self.error is None


 # ---------------------------------------------------------------------------
@@ -391,7 +479,7 @@ def fetch_bitwarden_secrets(
        if cached and cached.is_fresh(cache_ttl_seconds):
            return cached.secrets, []
        # L2: disk cache. ~5ms on cache hit vs ~380ms for `bws secret list`.
-        disk_cached = _DISK_CACHE.read(cache_key, cache_ttl_seconds, home_path)
+        disk_cached = _read_disk_cache(cache_key, cache_ttl_seconds, home_path)
        if disk_cached is not None:
            # Promote into in-process cache so subsequent fetches in the
            # same process skip the disk read too.
@@ -411,7 +499,7 @@ def fetch_bitwarden_secrets(
    entry = _CachedFetch(secrets=secrets, fetched_at=time.time())
    _CACHE[cache_key] = entry
    if use_cache:
-        _DISK_CACHE.write(cache_key, entry, cache_ttl_seconds, home_path)
+        _write_disk_cache(cache_key, entry, home_path)
    return secrets, warnings


@@ -487,6 +575,14 @@ def _run_bws_list(
    return secrets, warnings


+def _is_valid_env_name(name: str) -> bool:
+    if not name:
+        return False
+    if not (name[0].isalpha() or name[0] == "_"):
+        return False
+    return all(c.isalnum() or c == "_" for c in name)
+
+
 # ---------------------------------------------------------------------------
 # Public entry point — called from hermes_cli.env_loader
 # ---------------------------------------------------------------------------
@@ -577,142 +673,6 @@ def apply_bitwarden_secrets(
    return result


-# ---------------------------------------------------------------------------
-# SecretSource adapter — the registry-facing wrapper around this module.
-# ---------------------------------------------------------------------------
-
-
-class BitwardenSource(SecretSource):
-    """Bitwarden Secrets Manager as a registered secret source.
-
-    Thin adapter over the module's fetch machinery.  ``fetch()`` only
-    *fetches* — precedence, override semantics, conflict warnings, and
-    the ``os.environ`` writes are the orchestrator's job
-    (see ``agent.secret_sources.registry.apply_all``).
-
-    Bitwarden is a **bulk** source: it injects every secret in the
-    configured BSM project, so explicit per-var bindings from mapped
-    sources (e.g. the 1Password ``env:`` map) outrank it.
-    """
-
-    name = "bitwarden"
-    label = "Bitwarden Secrets Manager"
-    shape = "bulk"
-    scheme = "bws"
-
-    def override_existing(self, cfg: dict) -> bool:
-        # Default True (matches DEFAULT_CONFIG): the point of BSM is
-        # centralized rotation — if .env had the final say, rotating a
-        # key in Bitwarden wouldn't take effect until the stale .env
-        # line was also deleted.
-        return bool(isinstance(cfg, dict) and cfg.get("override_existing", True))
-
-    def protected_env_vars(self, cfg: dict):
-        token_env = "BWS_ACCESS_TOKEN"
-        if isinstance(cfg, dict):
-            token_env = str(cfg.get("access_token_env") or token_env)
-        return frozenset({token_env})
-
-    def config_schema(self) -> dict:
-        return {
-            "enabled": {"description": "Master switch", "default": False},
-            "access_token_env": {
-                "description": "Env var holding the machine-account access token",
-                "default": "BWS_ACCESS_TOKEN",
-            },
-            "project_id": {"description": "BSM project UUID", "default": ""},
-            "cache_ttl_seconds": {
-                "description": "Disk+memory cache TTL; 0 disables",
-                "default": 300,
-            },
-            "override_existing": {
-                "description": "BSM values overwrite .env/shell values",
-                "default": True,
-            },
-            "auto_install": {
-                "description": "Auto-download the pinned bws binary",
-                "default": True,
-            },
-            "server_url": {
-                "description": "Region / self-hosted endpoint (empty = US Cloud)",
-                "default": "",
-            },
-        }
-
-    def fetch(self, cfg: dict, home_path: Path) -> FetchResult:
-        cfg = cfg if isinstance(cfg, dict) else {}
-        result = FetchResult()
-
-        access_token_env = str(cfg.get("access_token_env") or "BWS_ACCESS_TOKEN")
-        access_token = os.environ.get(access_token_env, "").strip()
-        if not access_token:
-            result.error = (
-                f"secrets.bitwarden.enabled is true but {access_token_env} is "
-                "not set.  Run `hermes secrets bitwarden setup`."
-            )
-            result.error_kind = ErrorKind.NOT_CONFIGURED
-            return result
-
-        project_id = str(cfg.get("project_id") or "")
-        if not project_id:
-            result.error = (
-                "secrets.bitwarden.project_id is empty.  "
-                "Run `hermes secrets bitwarden setup`."
-            )
-            result.error_kind = ErrorKind.NOT_CONFIGURED
-            return result
-
-        auto_install = bool(cfg.get("auto_install", True))
-        binary = find_bws(install_if_missing=auto_install)
-        result.binary_path = binary
-        if binary is None:
-            result.error = (
-                "bws binary not available and auto-install is disabled.  "
-                "Run `hermes secrets bitwarden setup` to install."
-            )
-            result.error_kind = ErrorKind.BINARY_MISSING
-            return result
-
-        try:
-            ttl = float(cfg.get("cache_ttl_seconds", 300))
-        except (TypeError, ValueError):
-            ttl = 300.0
-
-        try:
-            secrets, warnings = fetch_bitwarden_secrets(
-                access_token=access_token,
-                project_id=project_id,
-                binary=binary,
-                cache_ttl_seconds=ttl,
-                server_url=str(cfg.get("server_url", "") or "").strip(),
-                home_path=home_path,
-            )
-        except RuntimeError as exc:
-            result.error = str(exc)
-            result.error_kind = _classify_bws_error(str(exc))
-            return result
-
-        result.secrets = secrets
-        result.warnings.extend(warnings)
-        return result
-
-
-def _classify_bws_error(message: str) -> ErrorKind:
-    """Best-effort mapping of bws failure text onto the shared taxonomy."""
-    lowered = message.lower()
-    if "timed out" in lowered:
-        return ErrorKind.TIMEOUT
-    if "binary not available" in lowered or "failed to invoke" in lowered:
-        return ErrorKind.BINARY_MISSING
-    if any(tok in lowered for tok in ("unauthorized", "invalid token",
-                                      "access token", "401", "403")):
-        return ErrorKind.AUTH_FAILED
-    if any(tok in lowered for tok in ("network", "connection", "resolve",
-                                      "download", "dns")):
-        return ErrorKind.NETWORK
-    return ErrorKind.INTERNAL
-
-
 # ---------------------------------------------------------------------------
 # Test hook — used by hermetic tests to flush the cache between cases.
 # ---------------------------------------------------------------------------
@@ -726,4 +686,7 @@ def _reset_cache_for_tests(home_path: Optional[Path] = None) -> None:
    writer itself.
    """
    _CACHE.clear()
-    _DISK_CACHE.clear(home_path)
+    try:
+        _disk_cache_path(home_path).unlink()
+    except (FileNotFoundError, OSError):
+        pass
@@ -1,643 +0,0 @@
-"""1Password (`op` CLI) secret source.
-
-Resolve provider credentials from 1Password ``op://vault/item/field``
-references at process startup so they don't have to live in plaintext in
-``~/.hermes/.env``.
-
-Design summary
--------------
-
-* Users map environment-variable names to official 1Password secret
-  references in ``secrets.onepassword.env``::
-
-      secrets:
-        onepassword:
-          enabled: true
-          env:
-            OPENAI_API_KEY: "op://Private/OpenAI/api key"
-            ANTHROPIC_API_KEY: "op://Private/Anthropic/credential"
-
-* After ``.env`` loads, each reference is resolved with a single
-  ``op read -- <reference>`` call and injected into ``os.environ`` (the
-  same point in startup as the Bitwarden source).
-* Authentication is whatever the user's ``op`` CLI already uses — a
-  service-account token (``OP_SERVICE_ACCOUNT_TOKEN``) for headless boxes,
-  or a desktop/interactive session (``OP_SESSION_*``).  Hermes never
-  authenticates on the user's behalf; it shells out to an already-trusted,
-  already-authenticated CLI.
-* Failures NEVER block startup.  A missing ``op`` binary, expired auth, a
-  bad reference, or a permission error each surface a one-line warning and
-  Hermes continues with whatever credentials ``.env`` already had.
-
-The atomic-write / ``0600`` / TTL cache mechanics are shared with the other
-backends via :mod:`agent.secret_sources._cache` — successful, complete pulls
-are cached in-process and on disk under ``<hermes_home>/cache/op_cache.json``
-so back-to-back short-lived ``hermes`` invocations don't re-shell ``op`` for
-every reference.  The disk file holds only resolved secret *values*; auth
-material is fingerprinted, never stored.
-"""
-
-from __future__ import annotations
-
-import hashlib
-import logging
-import os
-import re
-import shutil
-import subprocess
-import time
-from pathlib import Path
-from typing import Dict, List, Optional, Tuple
-
-from agent.secret_sources._cache import (
-    CachedFetch,
-    DiskCache,
-    FetchResult,
-    is_valid_env_name,
-)
-from agent.secret_sources.base import ErrorKind, SecretSource
-
-logger = logging.getLogger(__name__)
-
-
-# ---------------------------------------------------------------------------
-# Configuration constants
-# ---------------------------------------------------------------------------
-
-# How long to wait for a single `op read`, in seconds.
-_OP_RUN_TIMEOUT = 30
-
-# Default env var the official `op` CLI reads for service-account auth.  Users
-# can point `service_account_token_env` at a different name; we always export
-# the value to the child as OP_SERVICE_ACCOUNT_TOKEN, which is what `op` itself
-# looks for.
-_DEFAULT_TOKEN_ENV = "OP_SERVICE_ACCOUNT_TOKEN"
-
-# Strip whole ANSI CSI sequences (colour, cursor moves, line erases) from any
-# `op` diagnostic we surface — not just the lone ESC byte — so a control
-# sequence can't reposition the cursor or hide text after a redaction marker.
-_ANSI_CSI_RE = re.compile(r"\x1b\[[0-?]*[ -/]*[@-~]")
-
-# Env vars the `op` child actually needs.  We build a minimal allowlisted env
-# rather than copying all of os.environ (which, post-dotenv, holds every
-# provider credential) into the child — tighter blast radius if `op` or
-# anything it execs ever misbehaves.  OP_SESSION_* and the token are added
-# dynamically in _op_child_env().
-_OP_ENV_ALLOWLIST = (
-    "PATH",
-    "HOME",
-    "USERPROFILE",
-    "APPDATA",
-    "LOCALAPPDATA",
-    "SystemRoot",
-    "TMPDIR",
-    "TMP",
-    "TEMP",
-    "XDG_CONFIG_HOME",
-    "XDG_RUNTIME_DIR",
-    "OP_ACCOUNT",
-    "OP_CONNECT_HOST",
-    "OP_CONNECT_TOKEN",
-)
-
-
-# ---------------------------------------------------------------------------
-# Cache
-# ---------------------------------------------------------------------------
-
-# In-process cache.  The key folds in str(home_path) so a HERMES_HOME switch
-# inside one long-lived process (e.g. the gateway) can't return another
-# profile's secrets from L1.  The disk layer omits home from its serialized
-# key because the file already lives under the home dir (see _disk_key_str).
-_CacheKey = Tuple[str, str, str, str]  # (auth_fp, account, home, refs_fp)
-_CACHE: Dict[_CacheKey, CachedFetch] = {}
-
-_DISK_CACHE_BASENAME = "op_cache.json"
-
-
-def _disk_key_str(cache_key: _CacheKey) -> str:
-    """Serialize a cache key for on-disk storage, omitting home_path.
-
-    The disk file is already partitioned by home (it lives under
-    ``<home>/cache/``), so the path provides the home dimension; folding it
-    into the key string too would be redundant.
-    """
-    auth_fp, account, _home, refs_fp = cache_key
-    return f"{auth_fp}|{account}|{refs_fp}"
-
-
-_DISK_CACHE: DiskCache = DiskCache(
-    _DISK_CACHE_BASENAME, key_serializer=_disk_key_str
-)
-
-
-def _disk_cache_path(home_path: Optional[Path] = None) -> Path:
-    """Path to the on-disk cache (exposed for tests and direct callers)."""
-    return _DISK_CACHE.path(home_path)
-
-
-# ---------------------------------------------------------------------------
-# Reference validation + fingerprinting
-# ---------------------------------------------------------------------------
-
-
-def _validate_references(
-    references: Optional[Dict[str, str]],
-) -> Tuple[Dict[str, str], List[str]]:
-    """Return ``(valid_refs, warnings)`` from an ``env`` mapping.
-
-    A reference is kept only if its target env-var name is a valid POSIX
-    name and the value is a stripped ``op://…`` reference string.  Everything
-    else produces a warning and is dropped (never fatal).
-    """
-    valid: Dict[str, str] = {}
-    warnings: List[str] = []
-    for name, ref in (references or {}).items():
-        if not is_valid_env_name(name):
-            warnings.append(f"Skipping {name!r}: not a valid env-var name")
-            continue
-        if not isinstance(ref, str):
-            warnings.append(f"Skipping {name!r}: reference is not a string")
-            continue
-        cleaned = ref.strip()
-        if not cleaned.startswith("op://"):
-            warnings.append(
-                f"Skipping {name!r}: {ref!r} is not an op:// secret reference"
-            )
-            continue
-        valid[name] = cleaned
-    return valid, warnings
-
-
-def _auth_fingerprint(token_env: str) -> str:
-    """SHA-256 prefix over the auth material `op` would use.
-
-    Folds in the service-account token, ``OP_ACCOUNT``, and *all*
-    ``OP_SESSION_*`` vars (the names `op` actually exports for interactive
-    sessions — ``OP_SESSION_<account_shorthand>``).  Signing out and into a
-    different identity therefore changes the cache key, so a value cached under
-    a previous identity is never served under a new one.  Never logged or
-    displayed; the raw token never leaves this hash.
-    """
-    parts: List[str] = [
-        f"token={os.environ.get(token_env, '')}",
-        f"account={os.environ.get('OP_ACCOUNT', '')}",
-    ]
-    for key in sorted(os.environ):
-        if key.startswith("OP_SESSION_"):
-            parts.append(f"{key}={os.environ[key]}")
-    material = "\n".join(parts)
-    return hashlib.sha256(material.encode("utf-8")).hexdigest()[:16]
-
-
-def _refs_fingerprint(references: Dict[str, str]) -> str:
-    """SHA-256 prefix over the configured name→reference mapping."""
-    material = "\n".join(f"{name}={references[name]}" for name in sorted(references))
-    return hashlib.sha256(material.encode("utf-8")).hexdigest()[:16]
-
-
-# ---------------------------------------------------------------------------
-# Binary discovery
-# ---------------------------------------------------------------------------
-
-
-def find_op(binary_path: str = "") -> Optional[Path]:
-    """Resolve a usable ``op`` binary, or None.
-
-    When ``binary_path`` is set it is used verbatim and PATH is NOT consulted
-    — pinning an absolute path is a way to avoid trusting whatever ``op`` shows
-    up first on ``PATH``.  A pinned-but-missing path returns None (the caller
-    surfaces a clear error) rather than silently falling back.
-    """
-    if binary_path:
-        pinned = Path(binary_path)
-        if pinned.exists() and os.access(pinned, os.X_OK):
-            return pinned
-        return None
-    found = shutil.which("op")
-    return Path(found) if found else None
-
-
-# ---------------------------------------------------------------------------
-# `op read` invocation
-# ---------------------------------------------------------------------------
-
-
-def _scrub(text: str) -> str:
-    """Remove ANSI control sequences and trim, for safe message surfacing."""
-    return _ANSI_CSI_RE.sub("", text).replace("\x1b", "").strip()
-
-
-def _op_child_env(token_value: str) -> Dict[str, str]:
-    """Build a minimal allowlisted environment for the ``op`` child process."""
-    env: Dict[str, str] = {}
-    for key in _OP_ENV_ALLOWLIST:
-        val = os.environ.get(key)
-        if val is not None:
-            env[key] = val
-    # Desktop / interactive session credentials.
-    for key, val in os.environ.items():
-        if key.startswith("OP_SESSION_"):
-            env[key] = val
-    # `op` reads OP_SERVICE_ACCOUNT_TOKEN regardless of which env var the user
-    # configured Hermes to source it from, so normalize to that name here.
-    if token_value:
-        env["OP_SERVICE_ACCOUNT_TOKEN"] = token_value
-    env["NO_COLOR"] = "1"
-    return env
-
-
-def _run_op_read(
-    op: Path,
-    reference: str,
-    *,
-    account: str = "",
-    token_value: str = "",
-) -> str:
-    """Resolve a single ``op://`` reference to its value.
-
-    Raises :class:`RuntimeError` on any failure — including a ``returncode 0``
-    with empty output, which would otherwise silently clobber a good
-    ``.env``/shell credential with ``""``.
-    """
-    cmd: List[str] = [str(op), "read"]
-    if account:
-        cmd += ["--account", account]
-    # `--` terminates option parsing so a reference can never be mis-parsed as
-    # an `op` flag even if validation is ever loosened.
-    cmd += ["--", reference]
-
-    try:
-        proc = subprocess.run(  # noqa: S603 — op path is user-trusted, argv list
-            cmd,
-            env=_op_child_env(token_value),
-            capture_output=True,
-            text=True,
-            encoding="utf-8",
-            errors="replace",
-            timeout=_OP_RUN_TIMEOUT,
-        )
-    except subprocess.TimeoutExpired as exc:
-        raise RuntimeError(
-            f"op read timed out after {_OP_RUN_TIMEOUT}s for {reference!r}"
-        ) from exc
-    except OSError as exc:
-        raise RuntimeError(f"failed to invoke op: {exc}") from exc
-
-    if proc.returncode != 0:
-        err = _scrub(proc.stderr or "")[:200]
-        if err:
-            raise RuntimeError(f"op read failed for {reference!r}: {err}")
-        raise RuntimeError(
-            f"op read exited {proc.returncode} for {reference!r}"
-        )
-
-    # `op` appends a trailing newline; strip only that so a value with
-    # intentional internal/edge spaces survives.  But a value that is empty or
-    # whitespace-only is treated as empty: applying it would silently clobber a
-    # good .env/shell credential with effectively nothing.
-    value = (proc.stdout or "").rstrip("\r\n")
-    if not value.strip():
-        raise RuntimeError(f"op read returned an empty value for {reference!r}")
-    return value
-
-
-# ---------------------------------------------------------------------------
-# Fetch
-# ---------------------------------------------------------------------------
-
-
-def fetch_onepassword_secrets(
-    *,
-    references: Dict[str, str],
-    account: str = "",
-    token_env: str = _DEFAULT_TOKEN_ENV,
-    binary: Optional[Path] = None,
-    binary_path: str = "",
-    use_cache: bool = True,
-    cache_ttl_seconds: float = 300,
-    home_path: Optional[Path] = None,
-) -> Tuple[Dict[str, str], List[str]]:
-    """Resolve ``references`` (name → ``op://…``) to ``(secrets, warnings)``.
-
-    Raises :class:`RuntimeError` only when no ``op`` binary is available — a
-    fatal "can't fetch anything" condition.  Per-reference failures (expired
-    auth, bad reference, empty value) are collected as warnings and the
-    reference is dropped, so one bad entry never sinks the rest.
-
-    Only a complete, error-free pull is cached, so a transient auth failure
-    isn't frozen in for the whole TTL window.
-    """
-    valid, warnings = _validate_references(references)
-    if not valid:
-        return {}, warnings
-
-    token_value = os.environ.get(token_env, "").strip()
-    cache_key: _CacheKey = (
-        _auth_fingerprint(token_env),
-        account or "",
-        str(home_path) if home_path is not None else "",
-        _refs_fingerprint(valid),
-    )
-
-    if use_cache:
-        cached = _CACHE.get(cache_key)
-        if cached and cached.is_fresh(cache_ttl_seconds):
-            return dict(cached.secrets), warnings
-        disk_cached = _DISK_CACHE.read(cache_key, cache_ttl_seconds, home_path)
-        if disk_cached is not None:
-            # Promote into L1 so later fetches in this process skip the disk read.
-            _CACHE[cache_key] = disk_cached
-            return dict(disk_cached.secrets), warnings
-
-    op = binary or find_op(binary_path)
-    if op is None:
-        raise RuntimeError(
-            "op CLI not found.  Install the 1Password CLI "
-            "(https://developer.1password.com/docs/cli/get-started/) or set "
-            "secrets.onepassword.binary_path to its absolute location."
-        )
-
-    secrets: Dict[str, str] = {}
-    read_errors = 0
-    for name in sorted(valid):
-        try:
-            secrets[name] = _run_op_read(
-                op, valid[name], account=account, token_value=token_value
-            )
-        except RuntimeError as exc:
-            warnings.append(str(exc))
-            read_errors += 1
-
-    if use_cache and not read_errors and secrets:
-        entry = CachedFetch(secrets=dict(secrets), fetched_at=time.time())
-        _CACHE[cache_key] = entry
-        _DISK_CACHE.write(cache_key, entry, cache_ttl_seconds, home_path)
-
-    return secrets, warnings
-
-
-# ---------------------------------------------------------------------------
-# Public entry point — called from hermes_cli.env_loader
-# ---------------------------------------------------------------------------
-
-
-def apply_onepassword_secrets(
-    *,
-    enabled: bool,
-    env: Optional[Dict[str, str]] = None,
-    account: str = "",
-    service_account_token_env: str = _DEFAULT_TOKEN_ENV,
-    binary_path: str = "",
-    override_existing: bool = True,
-    cache_ttl_seconds: float = 300,
-    home_path: Optional[Path] = None,
-) -> FetchResult:
-    """Resolve configured ``op://`` references and set them on ``os.environ``.
-
-    Called by ``load_hermes_dotenv()`` after the .env files have loaded.
-    Intentionally defensive — any failure returns a :class:`FetchResult` with
-    ``error`` set (or surfaces warnings); it never raises.
-
-    Parameters mirror the ``secrets.onepassword.*`` config keys so the caller
-    can splat the dict in.  References that are already satisfied by the
-    current environment (when ``override_existing`` is false) are skipped
-    *before* fetching, so ``op`` is never invoked for a value that would be
-    discarded.
-    """
-    result = FetchResult()
-
-    if not enabled:
-        return result
-
-    valid, warnings = _validate_references(env)
-    result.warnings.extend(warnings)
-
-    # Skip-before-fetch: never resolve a reference we'd only throw away.
-    refs_to_fetch: Dict[str, str] = {}
-    for name, ref in valid.items():
-        if name == service_account_token_env:
-            # Never let a resolved secret clobber the very token used to auth.
-            result.skipped.append(name)
-            continue
-        if not override_existing and os.environ.get(name):
-            result.skipped.append(name)
-            continue
-        refs_to_fetch[name] = ref
-
-    if not refs_to_fetch:
-        return result
-
-    binary = find_op(binary_path)
-    result.binary_path = binary
-    if binary is None:
-        if binary_path:
-            result.error = (
-                f"secrets.onepassword.binary_path ({binary_path!r}) is not an "
-                "executable op binary."
-            )
-        else:
-            result.error = (
-                "secrets.onepassword.enabled is true but the op CLI was not "
-                "found on PATH.  Install it "
-                "(https://developer.1password.com/docs/cli/get-started/) or set "
-                "secrets.onepassword.binary_path."
-            )
-        return result
-
-    try:
-        secrets, fetch_warnings = fetch_onepassword_secrets(
-            references=refs_to_fetch,
-            account=account,
-            token_env=service_account_token_env,
-            binary=binary,
-            cache_ttl_seconds=cache_ttl_seconds,
-            home_path=home_path,
-        )
-    except RuntimeError as exc:
-        result.error = str(exc)
-        return result
-
-    result.secrets = secrets
-    result.warnings.extend(fetch_warnings)
-
-    for name, value in secrets.items():
-        # The token-var and override guards already filtered refs_to_fetch, but
-        # re-check defensively in case the fetch layer ever returns extras.
-        if name == service_account_token_env:
-            if name not in result.skipped:
-                result.skipped.append(name)
-            continue
-        if not override_existing and os.environ.get(name):
-            if name not in result.skipped:
-                result.skipped.append(name)
-            continue
-        os.environ[name] = value
-        result.applied.append(name)
-
-    return result
-
-
-# ---------------------------------------------------------------------------
-# SecretSource adapter — the registry-facing wrapper around this module.
-# ---------------------------------------------------------------------------
-
-
-class OnePasswordSource(SecretSource):
-    """1Password as a registered secret source.
-
-    Thin adapter over the module's fetch machinery.  ``fetch()`` only
-    *fetches* — precedence, override semantics, conflict warnings, and
-    the ``os.environ`` writes are the orchestrator's job
-    (see ``agent.secret_sources.registry.apply_all``).
-
-    1Password is a **mapped** source: the user explicitly binds each env
-    var to an ``op://`` reference under ``secrets.onepassword.env``, so
-    its claims outrank bulk sources (e.g. a Bitwarden project dump) on
-    contested vars.
-    """
-
-    name = "onepassword"
-    label = "1Password"
-    shape = "mapped"
-    scheme = "op"
-
-    def override_existing(self, cfg: dict) -> bool:
-        # Default True: an explicit VAR→op:// binding is the strongest
-        # user intent there is — leaving a stale .env line in place
-        # should not silently defeat it (same rotation rationale as
-        # Bitwarden).
-        return bool(isinstance(cfg, dict) and cfg.get("override_existing", True))
-
-    def protected_env_vars(self, cfg: dict):
-        token_env = _DEFAULT_TOKEN_ENV
-        if isinstance(cfg, dict):
-            token_env = str(cfg.get("service_account_token_env") or token_env)
-        return frozenset({token_env})
-
-    def config_schema(self) -> dict:
-        return {
-            "enabled": {"description": "Master switch", "default": False},
-            "env": {
-                "description": "Map of ENV_VAR -> op://vault/item/field reference",
-                "default": {},
-            },
-            "account": {
-                "description": "op --account shorthand (empty = default account)",
-                "default": "",
-            },
-            "service_account_token_env": {
-                "description": "Env var holding the service-account token "
-                               "(unset = desktop/interactive session)",
-                "default": _DEFAULT_TOKEN_ENV,
-            },
-            "binary_path": {
-                "description": "Pin the op binary (empty = resolve via PATH)",
-                "default": "",
-            },
-            "cache_ttl_seconds": {
-                "description": "Disk+memory cache TTL; 0 disables",
-                "default": 300,
-            },
-            "override_existing": {
-                "description": "Resolved values overwrite .env/shell values",
-                "default": True,
-            },
-        }
-
-    def fetch(self, cfg: dict, home_path: Path) -> FetchResult:
-        cfg = cfg if isinstance(cfg, dict) else {}
-        result = FetchResult()
-
-        env_map = cfg.get("env")
-        valid, warnings = _validate_references(
-            env_map if isinstance(env_map, dict) else None
-        )
-        result.warnings.extend(warnings)
-        if not valid:
-            if not warnings:
-                result.error = (
-                    "secrets.onepassword.enabled is true but the env: map is "
-                    "empty.  Add ENV_VAR: op://vault/item/field entries."
-                )
-                result.error_kind = ErrorKind.NOT_CONFIGURED
-            return result
-
-        binary_path = str(cfg.get("binary_path") or "")
-        binary = find_op(binary_path)
-        result.binary_path = binary
-        if binary is None:
-            if binary_path:
-                result.error = (
-                    f"secrets.onepassword.binary_path ({binary_path!r}) is "
-                    "not an executable op binary."
-                )
-            else:
-                result.error = (
-                    "secrets.onepassword.enabled is true but the op CLI was "
-                    "not found on PATH.  Install it "
-                    "(https://developer.1password.com/docs/cli/get-started/) "
-                    "or set secrets.onepassword.binary_path."
-                )
-            result.error_kind = ErrorKind.BINARY_MISSING
-            return result
-
-        try:
-            ttl = float(cfg.get("cache_ttl_seconds", 300))
-        except (TypeError, ValueError):
-            ttl = 300.0
-
-        try:
-            secrets, fetch_warnings = fetch_onepassword_secrets(
-                references=valid,
-                account=str(cfg.get("account") or ""),
-                token_env=str(
-                    cfg.get("service_account_token_env") or _DEFAULT_TOKEN_ENV
-                ),
-                binary=binary,
-                cache_ttl_seconds=ttl,
-                home_path=home_path,
-            )
-        except RuntimeError as exc:
-            result.error = str(exc)
-            result.error_kind = _classify_op_error(str(exc))
-            return result
-
-        result.secrets = secrets
-        result.warnings.extend(fetch_warnings)
-        return result
-
-
-def _classify_op_error(message: str) -> ErrorKind:
-    """Best-effort mapping of op failure text onto the shared taxonomy."""
-    lowered = message.lower()
-    if "timed out" in lowered:
-        return ErrorKind.TIMEOUT
-    if "not found on path" in lowered or "not an executable" in lowered \
-            or "failed to invoke" in lowered:
-        return ErrorKind.BINARY_MISSING
-    if any(tok in lowered for tok in ("unauthorized", "not signed in",
-                                      "session expired", "authentication",
-                                      "401", "403")):
-        return ErrorKind.AUTH_FAILED
-    if "empty value" in lowered:
-        return ErrorKind.EMPTY_VALUE
-    if any(tok in lowered for tok in ("network", "connection", "resolve host",
-                                      "dns")):
-        return ErrorKind.NETWORK
-    return ErrorKind.INTERNAL
-
-
-# ---------------------------------------------------------------------------
-# Test hook — used by hermetic tests to flush the cache between cases.
-# ---------------------------------------------------------------------------
-
-
-def _reset_cache_for_tests(home_path: Optional[Path] = None) -> None:
-    """Clear in-process AND disk caches.
-
-    Tests can pass ``home_path`` to scope the disk cleanup to a tmpdir.
-    Without it we fall back to the same default resolution as the writer.
-    """
-    _CACHE.clear()
-    _DISK_CACHE.clear(home_path)
@@ -1,370 +0,0 @@
-"""Secret-source registry + apply orchestrator.
-
-This module owns everything that must be uniform across secret backends
-so no individual source can get it wrong:
-
-* registration (name/scheme uniqueness, API-version gating)
-* per-source wall-clock timeout enforcement around ``fetch()``
-* precedence: mapped sources beat bulk sources; within a shape,
-  ``secrets.sources`` order (or registration order) decides; first
-  claim wins — later sources never silently clobber an earlier one
-* ``override_existing`` semantics (may beat .env/shell, never another
-  secret source, never a protected var)
-* cross-source conflict warnings (shadowed claims are always surfaced)
-* provenance: which source supplied every applied var
-
-The single entry point for startup is :func:`apply_all`, called from
-``hermes_cli.env_loader._apply_external_secret_sources()``.
-
-Plugins register additional sources via
-``PluginContext.register_secret_source()`` which lands in
-:func:`register_source`.  In-tree sources are registered lazily by
-:func:`_ensure_builtin_sources` — the set of bundled sources is
-deliberately closed (Bitwarden, and 1Password once it lands); new
-third-party backends ship as standalone plugin repos implementing
-:class:`agent.secret_sources.base.SecretSource`.
-"""
-
-from __future__ import annotations
-
-import concurrent.futures
-import logging
-from dataclasses import dataclass, field
-from pathlib import Path
-from typing import Dict, List, Optional
-
-from agent.secret_sources.base import (
-    SECRET_SOURCE_API_VERSION,
-    ErrorKind,
-    FetchResult,
-    SecretSource,
-    is_valid_env_name,
-)
-
-logger = logging.getLogger(__name__)
-
-# Ordered registry: name → source instance.  Python dicts preserve
-# insertion order, which doubles as the default apply order.
-_SOURCES: Dict[str, SecretSource] = {}
-_BUILTINS_LOADED = False
-
-
-@dataclass
-class AppliedVar:
-    """Provenance record for one env var the orchestrator set."""
-
-    name: str
-    source: str          # SecretSource.name
-    shape: str           # "mapped" | "bulk"
-    overrode_env: bool   # replaced a pre-existing .env/shell value
-
-
-@dataclass
-class SourceReport:
-    """One source's outcome within an :class:`ApplyReport`."""
-
-    name: str
-    label: str
-    result: FetchResult
-    applied: List[str] = field(default_factory=list)
-    skipped_existing: List[str] = field(default_factory=list)   # .env/shell won
-    skipped_claimed: List[str] = field(default_factory=list)    # earlier source won
-    skipped_protected: List[str] = field(default_factory=list)  # bootstrap-auth guard
-    skipped_invalid: List[str] = field(default_factory=list)    # bad env-var name
-
-
-@dataclass
-class ApplyReport:
-    """Merged outcome of one orchestrated apply pass."""
-
-    sources: List[SourceReport] = field(default_factory=list)
-    provenance: Dict[str, AppliedVar] = field(default_factory=dict)
-    conflicts: List[str] = field(default_factory=list)  # human-readable warnings
-
-    @property
-    def applied_any(self) -> bool:
-        return bool(self.provenance)
-
-
-# ---------------------------------------------------------------------------
-# Registration
-# ---------------------------------------------------------------------------
-
-
-def register_source(source: SecretSource, *, replace: bool = False) -> bool:
-    """Register a secret source.  Returns True on success.
-
-    Rejections are logged, never raised — a bad plugin must not take
-    down startup.  ``replace`` allows tests / user plugins to override
-    a bundled source of the same name (last-writer-wins like model
-    providers), but scheme collisions across *different* names are
-    always rejected.
-    """
-    if not isinstance(source, SecretSource):
-        logger.warning(
-            "Ignoring secret source %r: does not inherit from SecretSource",
-            source,
-        )
-        return False
-    name = getattr(source, "name", "") or ""
-    if not name or not name.replace("_", "").isalnum() or name != name.lower():
-        logger.warning("Ignoring secret source with invalid name %r", name)
-        return False
-    if getattr(source, "api_version", None) != SECRET_SOURCE_API_VERSION:
-        logger.warning(
-            "Ignoring secret source '%s': built against secret-source API v%s, "
-            "this Hermes speaks v%s",
-            name, getattr(source, "api_version", "?"), SECRET_SOURCE_API_VERSION,
-        )
-        return False
-    if getattr(source, "shape", None) not in ("mapped", "bulk"):
-        logger.warning(
-            "Ignoring secret source '%s': shape must be 'mapped' or 'bulk', got %r",
-            name, getattr(source, "shape", None),
-        )
-        return False
-    if name in _SOURCES and not replace:
-        logger.warning("Secret source '%s' already registered; ignoring duplicate", name)
-        return False
-    scheme = getattr(source, "scheme", None)
-    if scheme:
-        for other_name, other in _SOURCES.items():
-            if other_name != name and getattr(other, "scheme", None) == scheme:
-                logger.warning(
-                    "Ignoring secret source '%s': scheme '%s://' is already "
-                    "owned by source '%s'",
-                    name, scheme, other_name,
-                )
-                return False
-    _SOURCES[name] = source
-    return True
-
-
-def get_source(name: str) -> Optional[SecretSource]:
-    _ensure_builtin_sources()
-    return _SOURCES.get(name)
-
-
-def list_sources() -> List[SecretSource]:
-    _ensure_builtin_sources()
-    return list(_SOURCES.values())
-
-
-def _ensure_builtin_sources() -> None:
-    """Idempotently register the bundled sources.
-
-    Lazy so importing this module stays cheap and so a broken bundled
-    source can never break registration of the others.
-    """
-    global _BUILTINS_LOADED
-    if _BUILTINS_LOADED:
-        return
-    _BUILTINS_LOADED = True
-    try:
-        from agent.secret_sources.bitwarden import BitwardenSource
-
-        register_source(BitwardenSource())
-    except Exception:  # noqa: BLE001 — never block startup
-        logger.warning("Failed to register bundled Bitwarden secret source",
-                       exc_info=True)
-    try:
-        from agent.secret_sources.onepassword import OnePasswordSource
-
-        register_source(OnePasswordSource())
-    except Exception:  # noqa: BLE001 — never block startup
-        logger.warning("Failed to register bundled 1Password secret source",
-                       exc_info=True)
-
-
-def _reset_registry_for_tests() -> None:
-    global _BUILTINS_LOADED
-    _SOURCES.clear()
-    _BUILTINS_LOADED = False
-
-
-# ---------------------------------------------------------------------------
-# Orchestrated apply
-# ---------------------------------------------------------------------------
-
-
-def _fetch_with_timeout(
-    source: SecretSource, cfg: dict, home_path: Path
-) -> FetchResult:
-    """Run source.fetch() under a wall-clock budget; never raises.
-
-    The budget is enforced with a daemon worker thread: a source that
-    blows its budget is reported as ``TIMEOUT`` and its (eventual)
-    result is discarded.  The thread itself may linger until process
-    exit — acceptable for a startup-only path, and strictly better than
-    an unbounded hang on every ``hermes`` invocation.
-    """
-    timeout = source.fetch_timeout_seconds(cfg)
-    executor = concurrent.futures.ThreadPoolExecutor(
-        max_workers=1, thread_name_prefix=f"secret-src-{source.name}"
-    )
-    try:
-        future = executor.submit(source.fetch, cfg, home_path)
-        try:
-            result = future.result(timeout=timeout)
-        except concurrent.futures.TimeoutError:
-            future.cancel()
-            res = FetchResult()
-            res.error = (
-                f"fetch exceeded {timeout:.0f}s budget — startup continued "
-                "without this source (raise secrets."
-                f"{source.name}.timeout_seconds if the backend is just slow)"
-            )
-            res.error_kind = ErrorKind.TIMEOUT
-            return res
-        except Exception as exc:  # noqa: BLE001 — contract violation, contain it
-            res = FetchResult()
-            res.error = f"fetch raised {type(exc).__name__}: {exc}"
-            res.error_kind = ErrorKind.INTERNAL
-            return res
-    finally:
-        executor.shutdown(wait=False)
-
-    if not isinstance(result, FetchResult):
-        res = FetchResult()
-        res.error = (
-            f"fetch returned {type(result).__name__} instead of FetchResult"
-        )
-        res.error_kind = ErrorKind.INTERNAL
-        return res
-    return result
-
-
-def _ordered_enabled_sources(secrets_cfg: dict) -> List[SecretSource]:
-    """Resolve which sources run, in which order.
-
-    Order: the optional ``secrets.sources`` list wins; sources not named
-    there follow in registration order.  Enabled = the source's own
-    ``is_enabled`` says so for its config section.  Mapped-vs-bulk
-    precedence is applied on top of this order by :func:`apply_all`.
-    """
-    _ensure_builtin_sources()
-
-    explicit = secrets_cfg.get("sources")
-    order: List[str] = []
-    if isinstance(explicit, list):
-        for entry in explicit:
-            if isinstance(entry, str) and entry in _SOURCES and entry not in order:
-                order.append(entry)
-        unknown = [e for e in explicit
-                   if isinstance(e, str) and e not in _SOURCES]
-        if unknown:
-            logger.warning(
-                "secrets.sources names unknown source(s): %s (known: %s)",
-                ", ".join(unknown), ", ".join(_SOURCES) or "none",
-            )
-    for name in _SOURCES:
-        if name not in order:
-            order.append(name)
-
-    enabled: List[SecretSource] = []
-    for name in order:
-        source = _SOURCES[name]
-        cfg = secrets_cfg.get(name)
-        cfg = cfg if isinstance(cfg, dict) else {}
-        try:
-            if source.is_enabled(cfg):
-                enabled.append(source)
-        except Exception:  # noqa: BLE001
-            logger.warning("Secret source '%s' is_enabled() raised; skipping",
-                           name, exc_info=True)
-    return enabled
-
-
-def apply_all(secrets_cfg: dict, home_path: Path,
-              environ: Optional[Dict[str, str]] = None) -> ApplyReport:
-    """Fetch from every enabled source and apply the merged result to env.
-
-    ``environ`` defaults to ``os.environ``; injectable for tests.
-
-    Precedence per env var (most-specific intent wins):
-
-    1. Pre-existing env (.env / shell) — unless the winning source has
-       ``override_existing: true``.
-    2. Mapped sources, in configured order.
-    3. Bulk sources, in configured order.
-
-    First claim wins.  A later source that also carries the var gets a
-    ``skipped_claimed`` entry and a conflict warning — never a silent
-    clobber, and ``override_existing`` never applies across sources.
-    """
-    import os as _os
-
-    env = environ if environ is not None else _os.environ
-    report = ApplyReport()
-
-    secrets_cfg = secrets_cfg if isinstance(secrets_cfg, dict) else {}
-    enabled = _ordered_enabled_sources(secrets_cfg)
-    if not enabled:
-        return report
-
-    # Mapped sources outrank bulk sources regardless of list order:
-    # an explicit VAR→ref binding is stronger intent than a project dump.
-    ordered = ([s for s in enabled if s.shape == "mapped"]
-               + [s for s in enabled if s.shape == "bulk"])
-
-    # Fetch phase.
-    fetches: List[tuple[SecretSource, dict, FetchResult]] = []
-    protected: Dict[str, str] = {}  # var → source that protects it
-    for source in ordered:
-        cfg = secrets_cfg.get(source.name)
-        cfg = cfg if isinstance(cfg, dict) else {}
-        result = _fetch_with_timeout(source, cfg, home_path)
-        fetches.append((source, cfg, result))
-        try:
-            for var in source.protected_env_vars(cfg):
-                protected.setdefault(var, source.name)
-        except Exception:  # noqa: BLE001
-            pass
-
-    # Apply phase — sequential, first-wins, fully attributed.
-    claimed: Dict[str, str] = {}  # var → source name that won it
-    for source, cfg, result in fetches:
-        sr = SourceReport(name=source.name,
-                          label=source.label or source.name,
-                          result=result)
-        report.sources.append(sr)
-        if not result.ok:
-            continue
-
-        try:
-            override = source.override_existing(cfg)
-        except Exception:  # noqa: BLE001
-            override = False
-
-        for var, value in result.secrets.items():
-            if not isinstance(var, str) or not isinstance(value, str):
-                continue
-            if not is_valid_env_name(var):
-                sr.skipped_invalid.append(var)
-                continue
-            if var in protected:
-                sr.skipped_protected.append(var)
-                continue
-            if var in claimed:
-                sr.skipped_claimed.append(var)
-                report.conflicts.append(
-                    f"{var}: kept value from {claimed[var]}; "
-                    f"{source.name} also supplies it (first source wins — "
-                    "remove one binding or reorder secrets.sources)"
-                )
-                continue
-            existed = bool(env.get(var))
-            if existed and not override:
-                sr.skipped_existing.append(var)
-                continue
-            env[var] = value
-            claimed[var] = source.name
-            sr.applied.append(var)
-            report.provenance[var] = AppliedVar(
-                name=var,
-                source=source.name,
-                shape=source.shape,
-                overrode_env=existed,
-            )
-
-    return report
@@ -224,15 +224,6 @@ def register_from_config(
    if not isinstance(cfg, dict):
        return []

-    # Safe mode (--safe-mode / HERMES_SAFE_MODE=1): shell hooks are user
-    # customizations too — skip registration entirely so a troubleshooting
-    # run fires zero user-configured code (plugins, MCP, AND hooks).
-    from utils import env_var_enabled
-
-    if env_var_enabled("HERMES_SAFE_MODE"):
-        logger.info("HERMES_SAFE_MODE=1 — shell-hook registration skipped")
-        return []
-
    effective_accept = _resolve_effective_accept(cfg, accept_hooks)

    specs = _parse_hooks_block(cfg.get("hooks"))
@@ -316,11 +307,6 @@ def _parse_hooks_block(hooks_cfg: Any) -> List[ShellHookSpec]:
    specs: List[ShellHookSpec] = []

    for event_name, entries in hooks_cfg.items():
-        # Reserved sub-keys that aren't event names — skip silently. These
-        # are config sub-sections nested under `hooks:` for related
-        # functionality (e.g. output-spill budgets).
-        if event_name in ("output_spill",):
-            continue
        if event_name not in VALID_HOOKS:
            suggestion = difflib.get_close_matches(
                str(event_name), VALID_HOOKS, n=1, cutoff=0.6,
@@ -254,7 +254,6 @@ def build_bundle_invocation_message(
    cmd_key: str,
    user_instruction: str = "",
    task_id: str | None = None,
-    platform: str | None = None,
 ) -> Optional[Tuple[str, List[str], List[str]]]:
    """Build the user message content for a bundle slash command invocation.

@@ -265,16 +264,6 @@ def build_bundle_invocation_message(
    loads — the agent gets a note about which ones were skipped. This is
    the same forgiving stance ``build_preloaded_skills_prompt`` uses for
    ``-s`` CLI preloading.
-
-    Disabled skills are also skipped: bundles load members via
-    ``_load_skill_payload`` directly, bypassing the scan-time disabled
-    filter in ``get_skill_commands()``, so the disabled list must be
-    re-applied here.  ``platform`` scopes the check to a specific
-    platform's ``skills.platform_disabled`` config (gateway dispatch
-    passes it explicitly because the gateway handles multiple platforms
-    in one process); when *None*, the platform resolves from session env
-    vars and the global disabled list still applies.  Mirrors the
-    stacked-skill gate in gateway dispatch (#58888).
    """
    bundles = get_skill_bundles()
    info = bundles.get(cmd_key)
@@ -285,15 +274,8 @@ def build_bundle_invocation_message(
    # keep skill_bundles cheap to import in test environments.
    from agent.skill_commands import _load_skill_payload, _build_skill_message

-    try:
-        from agent.skill_utils import get_disabled_skill_names
-        disabled_names = get_disabled_skill_names(platform=platform)
-    except Exception:
-        disabled_names = set()
-
    loaded_names: List[str] = []
    missing: List[str] = []
-    disabled: List[str] = []
    skill_blocks: List[str] = []
    seen: set[str] = set()

@@ -313,12 +295,6 @@ def build_bundle_invocation_message(
            continue
        loaded_skill, skill_dir, skill_name = loaded

-        # Per-platform / global disabled gate. Checked against the loaded
-        # skill's canonical name (identifiers may be paths or aliases).
-        if skill_name in disabled_names or identifier in disabled_names:
-            disabled.append(skill_name or identifier)
-            continue
-
        try:
            from tools.skill_usage import bump_use
            bump_use(skill_name)
@@ -353,10 +329,6 @@ def build_bundle_invocation_message(
    ]
    if missing:
        header_lines.append(f"Skills missing (skipped): {', '.join(missing)}")
-    if disabled:
-        header_lines.append(
-            f"Skills disabled for this platform (skipped): {', '.join(disabled)}"
-        )
    if extra_instruction:
        header_lines.extend(["", f"Bundle instruction: {extra_instruction}"])
    if user_instruction:
@@ -143,9 +143,37 @@ def _load_skill_payload(skill_identifier: str, task_id: str | None = None) -> tu

    try:
        from tools.skills_tool import SKILLS_DIR, skill_view
-        from agent.skill_utils import normalize_skill_lookup_name
+        from agent.skill_utils import get_external_skills_dirs

-        normalized = normalize_skill_lookup_name(raw_identifier)
+        identifier_path = Path(raw_identifier).expanduser()
+        if identifier_path.is_absolute():
+            normalized = None
+            trusted_roots = [SKILLS_DIR]
+            try:
+                trusted_roots.extend(get_external_skills_dirs())
+            except Exception:
+                pass
+
+            # Prefer the lexical path under a trusted skill root before
+            # resolving symlinks.  Slash-command discovery can legitimately
+            # find a skill via ~/.hermes/skills/<name> where <name> is a
+            # symlink to a checked-out skill elsewhere.  Resolving first turns
+            # that trusted visible path into an arbitrary absolute path that
+            # skill_view() refuses to load.
+            for root in trusted_roots:
+                try:
+                    normalized = str(identifier_path.relative_to(root))
+                    break
+                except ValueError:
+                    continue
+
+            if normalized is None:
+                try:
+                    normalized = str(identifier_path.resolve().relative_to(SKILLS_DIR.resolve()))
+                except Exception:
+                    normalized = raw_identifier
+        else:
+            normalized = raw_identifier.lstrip("/")

        loaded_skill = json.loads(
            skill_view(normalized, task_id=task_id, preprocess=False)
@@ -329,7 +357,6 @@ def scan_skill_commands() -> Dict[str, Dict[str, Any]]:
    try:
        from tools.skills_tool import SKILLS_DIR, _parse_frontmatter, skill_matches_platform, skill_matches_environment, _get_disabled_skill_names
        from agent.skill_utils import get_external_skills_dirs, iter_skill_index_files
-        from hermes_cli.commands import resolve_command
        disabled = _get_disabled_skill_names()
        seen_names: set = set()

@@ -375,32 +402,7 @@ def scan_skill_commands() -> Dict[str, Dict[str, Any]]:
                    cmd_name = _SKILL_MULTI_HYPHEN.sub('-', cmd_name).strip('-')
                    if not cmd_name:
                        continue
-                    # Skip if this skill's auto-generated /command collides
-                    # with a core Hermes slash command (name or alias). The
-                    # skill remains fully loadable via /skill <name>.
-                    # Uses resolve_command() so aliases and case variants are
-                    # covered without maintaining a separate cache.
-                    if resolve_command(cmd_name) is not None:
-                        logger.warning(
-                            "Skill %r generates slash command '/%s' which "
-                            "collides with a core Hermes command; skipping "
-                            "auto-registration. Use '/skill %s' instead.",
-                            name, cmd_name, name,
-                        )
-                        continue
-                    # Dedup on the resolved slug, not just the raw name: two
-                    # distinct frontmatter names can normalize to the same
-                    # slug (e.g. "git_helper" vs "git-helper"). First-wins
-                    # preserves local-before-external precedence.
-                    cmd_key = f"/{cmd_name}"
-                    if cmd_key in _skill_commands:
-                        logger.warning(
-                            "Skill %r maps to slash command %s already claimed "
-                            "by %r; keeping the first and skipping this one.",
-                            name, cmd_key, _skill_commands[cmd_key]["name"],
-                        )
-                        continue
-                    _skill_commands[cmd_key] = {
+                    _skill_commands[f"/{cmd_name}"] = {
                        "name": name,
                        "description": description or f"Invoke the {name} skill",
                        "skill_md_path": str(skill_md),
@@ -559,162 +561,18 @@ def build_skill_invocation_message(
    )


-# ---------------------------------------------------------------------------
-# Stacked slash-skill invocations — `/skill-a /skill-b do XYZ` loads every
-# leading skill (up to _MAX_STACKED_SKILLS), not just the first.
-#
-# Inspired by Claude Code v2.1.199 (July 2, 2026): "Stacked slash-skill
-# invocations like /skill-a /skill-b do XYZ now load all leading skills
-# (up to 5), not just the first."
-#
-# The generated message deliberately reuses the BUNDLE scaffolding markers
-# ("skill bundle," header + "[Loaded as part of the " block prefix) so
-# extract_user_instruction_from_skill_message() recovers the user's
-# instruction without any new marker plumbing — memory providers keep
-# storing what the user actually asked, not N skill bodies.
-# ---------------------------------------------------------------------------
-_MAX_STACKED_SKILLS = 5
-
-
-def split_stacked_skill_commands(rest: str) -> tuple[list[str], str]:
-    """Consume additional leading ``/skill`` tokens from *rest*.
-
-    *rest* is the text that follows the FIRST matched skill command (the
-    caller has already resolved that one). Leading whitespace-delimited
-    tokens that start with ``/`` and resolve to installed skill commands are
-    consumed, up to ``_MAX_STACKED_SKILLS`` total leading skills (i.e. at
-    most ``_MAX_STACKED_SKILLS - 1`` extra keys here). Parsing stops at the
-    first token that is not a resolvable skill command — that token and
-    everything after it become the user instruction.
-
-    Returns:
-        ``(extra_cmd_keys, remaining_instruction)`` where ``extra_cmd_keys``
-        are canonical ``/slug`` keys from :func:`get_skill_commands`.
-    """
-    keys: list[str] = []
-    remaining = rest or ""
-    while len(keys) < _MAX_STACKED_SKILLS - 1:
-        stripped = remaining.lstrip()
-        if not stripped.startswith("/"):
-            break
-        parts = stripped.split(None, 1)
-        token = parts[0]
-        tail = parts[1] if len(parts) > 1 else ""
-        cmd_key = resolve_skill_command_key(token.lstrip("/"))
-        if cmd_key is None or cmd_key in keys:
-            break
-        keys.append(cmd_key)
-        remaining = tail
-    return keys, remaining.strip()
-
-
-def build_stacked_skill_invocation_message(
-    cmd_keys: list[str],
-    user_instruction: str = "",
-    task_id: str | None = None,
-) -> Optional[tuple[str, list[str], list[str]]]:
-    """Build the user message for a stacked multi-skill slash invocation.
-
-    Args:
-        cmd_keys: Canonical ``/slug`` keys, in the order the user typed them.
-        user_instruction: Text remaining after the leading skill commands.
-
-    Returns:
-        ``(message, loaded_skill_names, missing_skill_names)`` or ``None``
-        when no skill could be loaded at all.
-    """
-    commands = get_skill_commands()
-
-    loaded_names: list[str] = []
-    missing: list[str] = []
-    skill_blocks: list[str] = []
-    seen: set[str] = set()
-
-    for cmd_key in cmd_keys:
-        if not cmd_key or cmd_key in seen:
-            continue
-        seen.add(cmd_key)
-
-        skill_info = commands.get(cmd_key)
-        if not skill_info:
-            missing.append(cmd_key.lstrip("/"))
-            continue
-
-        loaded = _load_skill_payload(skill_info["skill_dir"], task_id=task_id)
-        if not loaded:
-            missing.append(cmd_key.lstrip("/"))
-            continue
-        loaded_skill, skill_dir, skill_name = loaded
-
-        # Track active usage for Curator lifecycle management (#17782)
-        try:
-            from tools.skill_usage import bump_use
-            bump_use(skill_name)
-        except Exception:
-            pass  # Non-critical
-
-        # NOTE: must start with "[Loaded as part of the " — that prefix is
-        # the bundle block marker the memory-scaffolding extractor cuts on.
-        activation_note = (
-            f'[Loaded as part of the stacked skill invocation "{skill_name}".]'
-        )
-        skill_blocks.append(
-            _build_skill_message(
-                loaded_skill,
-                skill_dir,
-                activation_note,
-                session_id=task_id,
-            )
-        )
-        loaded_names.append(skill_name)
-
-    if not skill_blocks:
-        return None
-
-    # Header — must contain " skill bundle," so the bundle-format extractor
-    # in extract_user_instruction_from_skill_message() applies unchanged.
-    typed = " ".join(k for k in cmd_keys if k)
-    header_lines = [
-        f'[IMPORTANT: The user has invoked the "{typed}" stacked skill bundle, '
-        f"loading {len(loaded_names)} skills together. Treat every skill below "
-        "as active guidance for this turn.]",
-        "",
-        f"Skills loaded: {', '.join(loaded_names)}",
-    ]
-    if missing:
-        header_lines.append(f"Skills missing (skipped): {', '.join(missing)}")
-    if user_instruction:
-        header_lines.extend(["", f"User instruction: {user_instruction}"])
-
-    header = "\n".join(header_lines)
-    return ("\n\n".join([header, *skill_blocks]), loaded_names, missing)
-
-
 def build_preloaded_skills_prompt(
    skill_identifiers: list[str],
    task_id: str | None = None,
 ) -> tuple[str, list[str], list[str]]:
-    """Load one or more skills for session-wide CLI/TUI preloading.
+    """Load one or more skills for session-wide CLI preloading.

    Returns (prompt_text, loaded_skill_names, missing_identifiers).
-
-    Disabled skills are treated the same as missing ones: this loads via a
-    raw identifier straight into ``_load_skill_payload``, bypassing
-    ``get_skill_commands()``'s scan-time disabled filter — mirrors the
-    bundle-invocation gate (#59156). Without this, ``hermes -s <skill>`` or
-    a deployment's ``HERMES_TUI_SKILLS`` env var could force-load a skill an
-    operator disabled via ``skills.disabled``/``skills.platform_disabled``.
    """
    prompt_parts: list[str] = []
    loaded_names: list[str] = []
    missing: list[str] = []

-    try:
-        from agent.skill_utils import get_disabled_skill_names
-        disabled_names = get_disabled_skill_names()
-    except Exception:
-        disabled_names = set()
-
    seen: set[str] = set()
    for raw_identifier in skill_identifiers:
        identifier = (raw_identifier or "").strip()
@@ -729,10 +587,6 @@ def build_preloaded_skills_prompt(

        loaded_skill, skill_dir, skill_name = loaded

-        if skill_name in disabled_names or identifier in disabled_names:
-            missing.append(identifier)
-            continue
-
        # Track active usage for Curator lifecycle management (#17782)
        try:
            from tools.skill_usage import bump_use
@@ -126,22 +126,10 @@ def parse_frontmatter(content: str) -> Tuple[Dict[str, Any], str]:
    Uses yaml with CSafeLoader for full YAML support (nested metadata, lists)
    with a fallback to simple key:value splitting for robustness.

-    A single leading UTF-8 BOM (U+FEFF) is stripped before parsing. Windows
-    GUI editors (Notepad, PowerShell ``>``) prepend one when saving a SKILL.md
-    as UTF-8, and ``read_text(encoding="utf-8")`` preserves it (only
-    ``utf-8-sig`` strips it). Left in place, the BOM defeats the ``---`` fence
-    check below and the whole frontmatter is silently discarded — name,
-    description, ``platforms`` gating, env-var setup, and conditional
-    activation all vanish. See CONTRIBUTING.md "File encoding".
-
    Returns:
        (frontmatter_dict, remaining_body)
    """
    frontmatter: Dict[str, Any] = {}
-
-    # Strip only a leading BOM; a BOM mid-content is data, not a marker.
-    if content.startswith("\ufeff"):
-        content = content[1:]
    body = content

    if not content.startswith("---"):
@@ -172,8 +160,27 @@ def parse_frontmatter(content: str) -> Tuple[Dict[str, Any], str]:
 # ── Platform matching ─────────────────────────────────────────────────────


-def skill_matches_platform_list(platforms: Any) -> bool:
-    """Return True when *platforms* is compatible with the current OS."""
+def skill_matches_platform(frontmatter: Dict[str, Any]) -> bool:
+    """Return True when the skill is compatible with the current OS.
+
+    Skills declare platform requirements via a top-level ``platforms`` list
+    in their YAML frontmatter::
+
+        platforms: [macos]          # macOS only
+        platforms: [macos, linux]   # macOS and Linux
+
+    If the field is absent or empty the skill is compatible with **all**
+    platforms (backward-compatible default).
+
+    Termux note: on Termux/Android, ``sys.platform`` is ``"linux"`` on
+    older Pythons but became ``"android"`` on Python 3.13+. Termux is a
+    Linux userland riding on the Android kernel, so skills tagged
+    ``linux`` are treated as compatible in Termux regardless of which
+    ``sys.platform`` value Python reports. Individual Linux commands
+    inside a skill may still misbehave (no systemd, BusyBox utils, no
+    apt/dnf, etc.) but that is on the skill, not on platform gating.
+    """
+    platforms = frontmatter.get("platforms")
    if not platforms:
        return True
    if not isinstance(platforms, list):
@@ -197,29 +204,6 @@ def skill_matches_platform_list(platforms: Any) -> bool:
    return False


-def skill_matches_platform(frontmatter: Dict[str, Any]) -> bool:
-    """Return True when the skill is compatible with the current OS.
-
-    Skills declare platform requirements via a top-level ``platforms`` list
-    in their YAML frontmatter::
-
-        platforms: [macos]          # macOS only
-        platforms: [macos, linux]   # macOS and Linux
-
-    If the field is absent or empty the skill is compatible with **all**
-    platforms (backward-compatible default).
-
-    Termux note: on Termux/Android, ``sys.platform`` is ``"linux"`` on
-    older Pythons but became ``"android"`` on Python 3.13+. Termux is a
-    Linux userland riding on the Android kernel, so skills tagged
-    ``linux`` are treated as compatible in Termux regardless of which
-    ``sys.platform`` value Python reports. Individual Linux commands
-    inside a skill may still misbehave (no systemd, BusyBox utils, no
-    apt/dnf, etc.) but that is on the skill, not on platform gating.
-    """
-    return skill_matches_platform_list(frontmatter.get("platforms"))
-
-
 # ── Environment matching ──────────────────────────────────────────────────

 # Recognized environment tags and how each is detected. An environment tag is
@@ -523,63 +507,6 @@ def get_all_skills_dirs() -> List[Path]:
    return dirs


-def normalize_skill_lookup_name(identifier: str) -> str:
-    """Normalize a skill identifier to a ``skill_view()``-safe relative path.
-
-    Slash commands and cron jobs may store absolute paths to skills that live
-    under ``~/.hermes/skills/`` (including via symlinks) or configured
-    ``skills.external_dirs``. ``skill_view()`` rejects absolute names for
-    security, so callers must translate trusted absolute paths to their
-    relative form first.
-    """
-    raw_identifier = (identifier or "").strip()
-    if not raw_identifier:
-        return raw_identifier
-
-    identifier_path = Path(raw_identifier).expanduser()
-    if not identifier_path.is_absolute():
-        return raw_identifier.lstrip("/")
-
-    # Look the primary skills root up on tools.skills_tool at CALL time
-    # (not via get_skills_dir()): callers and tests patch
-    # ``tools.skills_tool.SKILLS_DIR`` and skill_view() itself resolves
-    # against that module attribute, so normalization must agree with the
-    # exact root skill_view() will enforce.  Import deferred to avoid a
-    # module cycle (tools.skills_tool imports agent.skill_utils).
-    try:
-        from tools import skills_tool as _skills_tool
-        primary_root = Path(_skills_tool.SKILLS_DIR)
-    except Exception:
-        primary_root = get_skills_dir()
-
-    trusted_roots = [primary_root]
-    try:
-        trusted_roots.extend(get_external_skills_dirs())
-    except Exception:
-        pass
-
-    # Prefer the lexical path under a trusted skill root before resolving
-    # symlinks. Slash-command discovery can legitimately find a skill via
-    # ~/.hermes/skills/<name> where <name> is a symlink to a checked-out
-    # skill elsewhere. Resolving first turns that trusted visible path into
-    # an arbitrary absolute path that skill_view() refuses to load.
-    for root in trusted_roots:
-        try:
-            return str(identifier_path.relative_to(root))
-        except ValueError:
-            continue
-
-    try:
-        return str(identifier_path.resolve().relative_to(primary_root.resolve()))
-    except Exception:
-        logger.debug(
-            "Skill identifier %r is an absolute path outside trusted skills "
-            "roots — passing through unchanged (skill_view will reject it)",
-            raw_identifier,
-        )
-        return raw_identifier
-
-
 def _resolve_for_skill_ownership(path) -> Path:
    path_obj = path if isinstance(path, Path) else Path(str(path))
    try:
@@ -803,9 +730,8 @@ def iter_skill_index_files(skills_dir: Path, filename: str):
    ``SKILL.md`` files, but they are progressive-disclosure data loaded through
    ``skill_view(..., file_path=...)`` rather than active skill roots.
    """
-    skills_dir_str = str(skills_dir)
-    matches: list[str] = []
-    for root, dirs, files in os.walk(skills_dir_str, followlinks=True):
+    matches = []
+    for root, dirs, files in os.walk(skills_dir, followlinks=True):
        has_skill_md = "SKILL.md" in files
        dirs[:] = [
            d
@@ -814,9 +740,9 @@ def iter_skill_index_files(skills_dir: Path, filename: str):
            and not (has_skill_md and d in SKILL_SUPPORT_DIRS)
        ]
        if filename in files:
-            matches.append(os.path.join(root, filename))
-    for path in sorted(matches):
-        yield Path(path)
+            matches.append(Path(root) / filename)
+    for path in sorted(matches, key=lambda p: str(p.relative_to(skills_dir))):
+        yield path


 # ── Namespace helpers for plugin-provided skills ───────────────────────────
@@ -1,63 +0,0 @@
-"""TLS verify resolution for httpx/OpenAI provider clients."""
-
-from __future__ import annotations
-
-import logging
-import os
-import ssl
-from pathlib import Path
-from typing import Any, Optional
-
-logger = logging.getLogger(__name__)
-
-
-def _coerce_insecure(ssl_verify: Any) -> bool:
-    if ssl_verify is False:
-        return True
-    if isinstance(ssl_verify, str) and ssl_verify.strip().lower() in {"false", "0", "no", "off"}:
-        return True
-    return False
-
-
-def resolve_httpx_verify(
-    *,
-    ca_bundle: Optional[str] = None,
-    ssl_verify: Any = None,
-    base_url: str = "",
-) -> bool | ssl.SSLContext:
-    """Resolve httpx ``verify`` for provider HTTP clients.
-
-    Priority:
-    1. ``ssl_verify: false`` — disable verification (local dev only)
-    2. explicit ``ca_bundle`` (per-provider ``ssl_ca_cert`` config field)
-    3. ``HERMES_CA_BUNDLE``, ``SSL_CERT_FILE``, ``REQUESTS_CA_BUNDLE``,
-       ``CURL_CA_BUNDLE`` env vars
-    4. ``True`` (httpx/certifi default)
-
-    ``base_url`` is used only for the insecure-mode warning message.
-    """
-    if _coerce_insecure(ssl_verify):
-        logger.warning(
-            "TLS certificate verification DISABLED (ssl_verify: false) for %s — "
-            "this is intended for local development only and is unsafe on any "
-            "network you do not fully control.",
-            base_url or "a custom provider endpoint",
-        )
-        return False
-
-    effective_ca = (
-        (ca_bundle or "").strip()
-        or os.getenv("HERMES_CA_BUNDLE", "").strip()
-        or os.getenv("SSL_CERT_FILE", "").strip()
-        or os.getenv("REQUESTS_CA_BUNDLE", "").strip()
-        or os.getenv("CURL_CA_BUNDLE", "").strip()
-    )
-    if effective_ca:
-        ca_path = str(Path(effective_ca).expanduser())
-        if os.path.isfile(ca_path):
-            return ssl.create_default_context(cafile=ca_path)
-        logger.warning(
-            "CA bundle path does not exist: %s — falling back to default certificates",
-            effective_ca,
-        )
-    return True
@@ -144,7 +144,7 @@ class SubdirectoryHintTracker:
                if parent == p:
                    break  # filesystem root
                p = parent
-        except (OSError, ValueError, RuntimeError):
+        except (OSError, ValueError):
            pass

    def _extract_paths_from_command(self, cmd: str, candidates: Set[Path]):
@@ -241,11 +241,11 @@ class SubdirectoryHintTracker:
                rel_path = str(hint_path)
                try:
                    rel_path = str(hint_path.relative_to(self.working_dir))
-                except (ValueError, RuntimeError):
+                except ValueError:
                    try:
                        rel_path = str(hint_path.relative_to(Path.home()))
                        rel_path = "~/" + rel_path
-                    except (ValueError, RuntimeError):
+                    except ValueError:
                        pass  # keep absolute
                found_hints.append((rel_path, content))
                # First match wins per directory (like startup loading)
@@ -24,7 +24,6 @@ Pure helpers that read the agent's state.  AIAgent keeps thin forwarders.
 from __future__ import annotations

 import json
-import os
 from typing import Any, Dict, List, Optional

 from agent.prompt_builder import (
@@ -40,13 +39,11 @@ from agent.prompt_builder import (
    SKILLS_GUIDANCE,
    STEER_CHANNEL_NOTE,
    TASK_COMPLETION_GUIDANCE,
-    TELEGRAM_RICH_MESSAGES_HINT,
    TOOL_USE_ENFORCEMENT_GUIDANCE,
    TOOL_USE_ENFORCEMENT_MODELS,
    drain_truncation_warnings,
 )
 from agent.runtime_cwd import resolve_context_cwd
-from utils import is_truthy_value


 def _ra():
@@ -113,36 +110,6 @@ def _resolve_platform_hint(agent: Any, platform_key: str, default_hint: str) ->
    return base


-_TUI_EMBEDDED_PANE_CLARIFIER = (
-    " You're in its embedded terminal pane, beside the GUI chat — the user can "
-    "select your output (Option-drag on macOS, Shift-drag elsewhere) and press "
-    "Cmd/Ctrl+L to send it to the chat composer."
-)
-
-
-def _tui_embedded_pane_clarifier(hint: str) -> str:
-    """Append the desktop-embedded-terminal-pane clarifier to a tui hint.
-
-    Triggered by ``HERMES_DESKTOP_TERMINAL=1`` (set by ``main.cjs`` only on the
-    shell env of the desktop's embedded TUI PTY — never on the chat backend).
-    This is a runtime-surface qualifier, not a config override, so it lives at
-    the resolution site rather than inside ``_resolve_platform_hint`` (which
-    is purely the config-platform_hints override applier). Byte-stable for the
-    cache: called once per session build, deterministically from env state.
-
-    Idempotent and empty-safe: re-applying on an already-augmented hint is a
-    no-op, and an empty input returns empty (we never synthesize the
-    clarifier without its tui framing).
-    """
-    if not hint:
-        return hint
-    if _TUI_EMBEDDED_PANE_CLARIFIER in hint:
-        return hint
-    if not is_truthy_value(os.getenv("HERMES_DESKTOP_TERMINAL")):
-        return hint
-    return hint + _TUI_EMBEDDED_PANE_CLARIFIER
-
-
 def build_system_prompt_parts(agent: Any, system_message: Optional[str] = None) -> Dict[str, str]:
    """Assemble the system prompt as three ordered parts.

@@ -430,23 +397,7 @@ def build_system_prompt_parts(agent: Any, system_message: Optional[str] = None)
        except Exception:
            pass

-    # For Telegram: append the rich-messages extension only when the user has
-    # opted in to ``platforms.telegram.extra.rich_messages: true``.  The base
-    # hint covers MarkdownV2-compatible constructs; the extension adds Bot API
-    # 10.1 guidance (tables, task lists, math, collapsible details, etc.).
-    if platform_key == "telegram" and _default_hint:
-        try:
-            from hermes_cli.config import load_config_readonly
-            _cfg = load_config_readonly()
-            _tg_extra = ((_cfg.get("platforms") or {}).get("telegram") or {}).get("extra") or {}
-            if _tg_extra.get("rich_messages"):
-                _default_hint = _default_hint.rstrip() + " " + TELEGRAM_RICH_MESSAGES_HINT
-        except Exception:
-            pass  # Config read failure — fall back to base hint only
-
    _effective_hint = _resolve_platform_hint(agent, platform_key, _default_hint)
-    if platform_key == "tui" and _effective_hint:
-        _effective_hint = _tui_embedded_pane_clarifier(_effective_hint)
    if _effective_hint:
        stable_parts.append(_effective_hint)

@@ -463,16 +414,9 @@ def build_system_prompt_parts(agent: Any, system_message: Optional[str] = None)
        # CLI), None lets build_context_files_prompt fall back to the launch
        # dir — the user's real cwd there, but the install dir for the gateway
        # daemon, which is why the gateway sets TERMINAL_CWD.
-        #
-        # allow_install_tree_fallback: for cli/tui the launch dir IS the
-        # user's shell cwd, so an in-tree fallback is a deliberate choice
-        # (developing Hermes). Every other surface (desktop chat panel,
-        # gateway daemons) self-spawns into the install tree, where the
-        # fallback would inject this repo's contributor AGENTS.md (#64590).
        context_files_prompt = _r.build_context_files_prompt(
            cwd=resolve_context_cwd(), skip_soul=_soul_loaded,
-            context_length=_ctx_len,
-            allow_install_tree_fallback=agent.platform in ("cli", "tui"))
+            context_length=_ctx_len)
        if context_files_prompt:
            context_parts.append(context_files_prompt)

@@ -208,29 +208,19 @@ class StreamingThinkScrubber:
        discarded — leaking partial reasoning is worse than a
        truncated answer.  Otherwise the held-back partial-tag tail is
        emitted verbatim (it turned out not to be a real tag prefix).
-
-        Always treats the next ``feed()`` as a fresh stream boundary.
-        Intra-turn retries (thinking-only prefill, empty-response
-        retry) flush then stream again without calling ``reset()``;
-        leaving ``_last_emitted_ended_newline`` False made a new
-        stream's opening ``<think>`` look mid-line and leak into the
-        visible reply.
        """
        if self._in_block:
            self._buf = ""
            self._in_block = False
-            # Next feed() is a new stream — start-of-stream is a boundary.
-            self._last_emitted_ended_newline = True
            return ""
        tail = self._buf
        self._buf = ""
-        # Same for the non-block path: do NOT derive the boundary flag
-        # from the flushed tail (e.g. a held-back '<').  End-of-stream
-        # means the next feed() starts a new model response.
-        self._last_emitted_ended_newline = True
        if not tail:
            return ""
-        return self._strip_orphan_close_tags(tail)
+        tail = self._strip_orphan_close_tags(tail)
+        if tail:
+            self._last_emitted_ended_newline = tail.endswith("\n")
+        return tail

    # ── internal helpers ───────────────────────────────────────────────

@@ -1,147 +0,0 @@
-"""Thread-scoped stdout/stderr silencing for background worker threads.
-
-``contextlib.redirect_stdout``/``redirect_stderr`` reassign the *process-global*
-``sys.stdout``/``sys.stderr``.  When a daemon worker thread (e.g. the background
-memory/skill review) wraps its whole body in those context managers, every other
-thread in the process — including a gateway's asyncio event-loop thread driving a
-Telegram long-poll — sees ``sys.stdout``/``sys.stderr`` pointing at ``devnull``
-for the full duration.  Any bare ``print`` / ``sys.stderr.write`` from those other
-threads is silently lost during that window (see issue #55769 / #55925).
-
-This module installs a thin proxy as ``sys.stdout``/``sys.stderr`` that routes
-writes per-thread: threads registered as "silenced" go to a sink; every other
-thread passes through to the *original* stream.  The proxy is installed once,
-idempotently, and is never uninstalled (uninstalling would race other threads
-mid-write), so the only observable effect for unregistered threads is one extra
-attribute lookup per write.
-"""
-
-from __future__ import annotations
-
-import contextlib
-import os
-import sys
-import threading
-from typing import Iterator, TextIO
-
-__all__ = ["thread_scoped_silence"]
-
-_install_lock = threading.Lock()
-# Maps the proxy we installed for a given attribute ("stdout"/"stderr") so we
-# never double-wrap and so we can recover the original stream.
-_installed: dict[str, "_ThreadRoutingStream"] = {}
-
-
-class _ThreadRoutingStream:
-    """A ``sys.stdout``/``sys.stderr`` stand-in that routes writes per-thread.
-
-    Threads whose ident is in ``_silenced`` write to ``_sink``; all other
-    threads write to ``_passthrough`` (the original stream captured at install
-    time).  Attribute access for anything other than the methods we override
-    is delegated to the *current* target so things like ``.encoding`` /
-    ``.fileno()`` behave like the underlying stream for the calling thread.
-    """
-
-    def __init__(self, passthrough: TextIO, sink: TextIO) -> None:
-        self._passthrough = passthrough
-        self._sink = sink
-        # ident -> nesting depth.  A thread is silenced while depth > 0, so
-        # nested ``thread_scoped_silence()`` on the same thread composes
-        # correctly (the inner exit decrements rather than fully clearing).
-        self._silenced: dict[int, int] = {}
-        self._lock = threading.Lock()
-
-    def _target(self) -> TextIO:
-        if self._silenced.get(threading.get_ident(), 0) > 0:
-            return self._sink
-        return self._passthrough
-
-    # --- registration -----------------------------------------------------
-    def silence(self, ident: int) -> None:
-        with self._lock:
-            self._silenced[ident] = self._silenced.get(ident, 0) + 1
-
-    def unsilence(self, ident: int) -> None:
-        with self._lock:
-            depth = self._silenced.get(ident, 0) - 1
-            if depth > 0:
-                self._silenced[ident] = depth
-            else:
-                self._silenced.pop(ident, None)
-
-    # --- file-like surface ------------------------------------------------
-    def write(self, data):  # type: ignore[no-untyped-def]
-        try:
-            return self._target().write(data)
-        except Exception:
-            return len(data) if isinstance(data, str) else 0
-
-    def flush(self):  # type: ignore[no-untyped-def]
-        try:
-            return self._target().flush()
-        except Exception:
-            return None
-
-    def writelines(self, lines):  # type: ignore[no-untyped-def]
-        target = self._target()
-        try:
-            return target.writelines(lines)
-        except Exception:
-            return None
-
-    def isatty(self) -> bool:
-        try:
-            return bool(self._target().isatty())
-        except Exception:
-            return False
-
-    def fileno(self):  # type: ignore[no-untyped-def]
-        return self._target().fileno()
-
-    def __getattr__(self, name):  # type: ignore[no-untyped-def]
-        # Delegate everything we don't override (encoding, buffer, mode, ...)
-        # to the calling thread's current target.
-        return getattr(self._target(), name)
-
-
-def _ensure_installed(attr: str, sink: TextIO) -> "_ThreadRoutingStream":
-    """Install (idempotently) a routing proxy as ``sys.<attr>`` and return it."""
-    with _install_lock:
-        proxy = _installed.get(attr)
-        current = getattr(sys, attr, None)
-        if proxy is not None and current is proxy:
-            return proxy
-        # Capture whatever is currently bound as the passthrough.  If a prior
-        # global redirect_stdout is active we deliberately route non-silenced
-        # threads to *that* (matching prior behaviour) rather than guessing at
-        # the "real" stream.
-        passthrough = current if current is not None else sink
-        proxy = _ThreadRoutingStream(passthrough, sink)
-        setattr(sys, attr, proxy)
-        _installed[attr] = proxy
-        return proxy
-
-
-@contextlib.contextmanager
-def thread_scoped_silence() -> Iterator[None]:
-    """Silence ``stdout``/``stderr`` for the *current thread only*.
-
-    Other threads keep writing to the real streams.  Use this around a worker
-    thread's body instead of ``contextlib.redirect_stdout(devnull)`` when the
-    process is multi-threaded and another thread must keep its console output.
-    """
-    sink = open(os.devnull, "w", encoding="utf-8")
-    ident = threading.get_ident()
-    out_proxy = _ensure_installed("stdout", sink)
-    err_proxy = _ensure_installed("stderr", sink)
-    out_proxy.silence(ident)
-    err_proxy.silence(ident)
-    try:
-        yield
-    finally:
-        out_proxy.unsilence(ident)
-        err_proxy.unsilence(ident)
-        try:
-            sink.close()
-        except Exception:
-            pass
@@ -19,12 +19,6 @@ logger = logging.getLogger(__name__)
 FailureCallback = Callable[[str, BaseException], None]
 TitleCallback = Callable[[str], None]

-# Validation callback: () -> bool. Called right before the LLM request in
-# generate_title(). Return False to skip — e.g. the user switched models
-# after this background thread captured its runtime snapshot, and sending
-# the request would reload a model the runtime already evicted (#19027).
-RuntimeValidator = Callable[[], bool]
-
 _TITLE_PROMPT = (
    "Generate a short, descriptive title (3-7 words) for a conversation that starts with the "
    "following exchange. The title should capture the main topic or intent. "
@@ -54,30 +48,12 @@ def _title_language() -> str:
        return ""


-def _auto_title_enabled() -> bool:
-    """Return whether automatic session title generation is enabled."""
-    try:
-        # Lazy imports, matching _title_language(): title_generator is imported
-        # from agent code paths where a module-level hermes_cli import risks
-        # circularity, and the read-only loader avoids config-migration writes.
-        from hermes_cli.config import load_config_readonly
-        from utils import is_truthy_value
-
-        config = load_config_readonly()
-        title_config = (config.get("auxiliary") or {}).get("title_generation") or {}
-        return is_truthy_value(title_config.get("enabled"), default=True)
-    except Exception:
-        logger.debug("Failed to read title_generation.enabled", exc_info=True)
-        return True
-
-
 def generate_title(
    user_message: str,
    assistant_response: str,
-    timeout: Optional[float] = None,
+    timeout: float = 30.0,
    failure_callback: Optional[FailureCallback] = None,
    main_runtime: dict = None,
-    runtime_validator: Optional[RuntimeValidator] = None,
 ) -> Optional[str]:
    """Generate a session title from the first exchange.

@@ -89,26 +65,7 @@ def generate_title(
    auxiliary call raises — the caller typically wires this to
    ``AIAgent._emit_auxiliary_failure`` so the user sees a warning instead
    of silently accumulating untitled sessions.
-
-    ``runtime_validator`` is called right before the LLM request. If it
-    returns False (e.g. the user's model was switched since the background
-    thread captured its runtime snapshot), the call is skipped silently —
-    no request is sent, so a stale title request can't reload a model the
-    runtime already unloaded (#19027).
    """
-    if not _auto_title_enabled():
-        logger.debug("Auto-title skipped: auxiliary.title_generation.enabled=false")
-        return None
-
-    if runtime_validator is not None:
-        try:
-            if not runtime_validator():
-                logger.debug("Title generation skipped: runtime validator returned False")
-                return None
-        except Exception:
-            # Fail open: a broken validator must not disable titling.
-            logger.debug("Title runtime validator raised; proceeding", exc_info=True)
-
    # Truncate long messages to keep the request small
    user_snippet = user_message[:500] if user_message else ""
    assistant_snippet = assistant_response[:500] if assistant_response else ""
@@ -130,15 +87,7 @@ def generate_title(
            timeout=timeout,
            main_runtime=main_runtime,
        )
-        content = response.choices[0].message.content or ""
-        # Strip thinking/reasoning blocks that think-enabled models
-        # (MiniMax M2.7, DeepSeek, etc.) emit even for simple prompts like
-        # title generation. Without this the raw <think>...</think> XML
-        # leaks into session titles. Reuses the canonical scrubber so all
-        # tag variants (unterminated blocks, orphan closes, mixed case)
-        # are handled, not just a single literal <think> pair.
-        from agent.agent_runtime_helpers import strip_think_blocks
-        title = strip_think_blocks(None, content).strip()
+        title = (response.choices[0].message.content or "").strip()
        # Clean up: remove quotes, trailing punctuation, prefixes like "Title: "
        title = title.strip('"\'')
        if title.lower().startswith("title:"):
@@ -160,53 +109,6 @@ def generate_title(
        return None


-def _persist_session_title(session_db, session_id, title):
-    """Persist a generated title, recovering from duplicate-title collisions.
-
-    The write goes through ``set_auto_title_if_empty`` (predicate + write in
-    one transaction) so a manual ``/title`` set while LLM generation was in
-    flight is never overwritten — a plain ``set_session_title`` fallback keeps
-    older stores working. ``set_session_title`` raises ValueError when the
-    title would collide with another session (the unique-title index). Rather
-    than swallow it and leave the session untitled (#50537), append a #N
-    suffix via get_next_title_in_lineage() when the store supports lineage
-    dedup; otherwise re-raise so the caller can decide.
-
-    Returns the title actually persisted, or None when a concurrent manual
-    title won the race (nothing was written).
-    """
-    atomic_fn = getattr(session_db, "set_auto_title_if_empty", None)
-
-    def _set(t):
-        if atomic_fn is not None:
-            if not atomic_fn(session_id, t):
-                # Predicate failed: a title appeared while generation was in
-                # flight (manual /title wins), or the session vanished.
-                logger.debug(
-                    "Skipping auto-generated session title because a title "
-                    "was set while generation was in flight"
-                )
-                return None
-            return t
-        ok = session_db.set_session_title(session_id, t)
-        if ok is False:
-            raise RuntimeError(
-                f"session {session_id} not found when storing title"
-            )
-        return t
-
-    try:
-        return _set(title)
-    except ValueError:
-        next_title_fn = getattr(session_db, "get_next_title_in_lineage", None)
-        if next_title_fn is None:
-            raise
-        deduped = next_title_fn(title)
-        if not deduped or deduped == title:
-            raise
-        return _set(deduped)
-
-
 def auto_title_session(
    session_db,
    session_id: str,
@@ -215,7 +117,6 @@ def auto_title_session(
    failure_callback: Optional[FailureCallback] = None,
    main_runtime: dict = None,
    title_callback: Optional[TitleCallback] = None,
-    runtime_validator: Optional[RuntimeValidator] = None,
 ) -> None:
    """Generate and set a session title if one doesn't already exist.

@@ -224,55 +125,7 @@ def auto_title_session(
    - session_db is None
    - session already has a title (user-set or previously auto-generated)
    - title generation fails
-    - runtime_validator returns False (model was switched)
-
-    Never lets an exception escape: this is a daemon-thread target, and an
-    escaping exception would spray a raw traceback into the user's terminal
-    via the default threading excepthook. The canonical trigger is the
-    post-``hermes update`` stale-module window, where this function's lazy
-    imports read NEW source from disk while already-cached modules
-    (``agent.portal_tags`` etc.) are still the OLD version — the resulting
-    ImportError repeats on every auto-title attempt until the long-running
-    process restarts.
    """
-    try:
-        _auto_title_session(
-            session_db,
-            session_id,
-            user_message,
-            assistant_response,
-            failure_callback=failure_callback,
-            main_runtime=main_runtime,
-            title_callback=title_callback,
-            runtime_validator=runtime_validator,
-        )
-    except Exception as e:
-        # WARNING (not debug) so operators see it in agent.log; the message
-        # names the likely cause so "restart the process" is discoverable.
-        logger.warning(
-            "Auto-title failed (harmless; if this started after an update, "
-            "restart the running Hermes process): %s",
-            e,
-        )
-        logger.debug("Auto-title traceback", exc_info=True)
-        if failure_callback is not None:
-            try:
-                failure_callback("title generation", e)
-            except Exception:
-                logger.debug("Auto-title failure_callback raised", exc_info=True)
-
-
-def _auto_title_session(
-    session_db,
-    session_id: str,
-    user_message: str,
-    assistant_response: str,
-    failure_callback: Optional[FailureCallback] = None,
-    main_runtime: dict = None,
-    title_callback: Optional[TitleCallback] = None,
-    runtime_validator: Optional[RuntimeValidator] = None,
-) -> None:
-    """Body of :func:`auto_title_session` — see its docstring."""
    if not session_db or not session_id:
        return

@@ -284,43 +137,18 @@ def _auto_title_session(
    except Exception:
        return

-    # This runs on a bare daemon thread spawned AFTER the turn's ambient
-    # conversation context was reset, so publish it here from the session id
-    # we already hold — the title-generation LLM call then carries the same
-    # ``conversation=`` Portal tag as the turn it titles. Root-of-lineage for
-    # consistency with the agent loop (a no-op on first exchange, where
-    # titling happens, but correct if this ever runs on a continuation).
-    from agent.aux_accounting import set_accounting_context
-    from agent.portal_tags import set_conversation_context
-
-    conversation_id = session_id
-    try:
-        conversation_id = session_db.get_conversation_root(session_id) or session_id
-    except Exception:
-        pass
-    set_conversation_context(conversation_id)
-    # Same for the accounting context, so the title call's token usage is
-    # recorded against this session (task='title_generation', #23270).
-    set_accounting_context(session_db, session_id)
-
    title = generate_title(
-        user_message,
-        assistant_response,
-        failure_callback=failure_callback,
-        main_runtime=main_runtime,
-        runtime_validator=runtime_validator,
+        user_message, assistant_response, failure_callback=failure_callback, main_runtime=main_runtime
    )
    if not title:
        return

    try:
-        persisted = _persist_session_title(session_db, session_id, title)
-        if persisted is None:
-            return
-        logger.debug("Auto-generated session title: %s", persisted)
+        session_db.set_session_title(session_id, title)
+        logger.debug("Auto-generated session title: %s", title)
        if title_callback is not None:
            try:
-                title_callback(persisted)
+                title_callback(title)
            except Exception:
                logger.debug("Auto-title callback failed", exc_info=True)
    except Exception as e:
@@ -336,7 +164,6 @@ def maybe_auto_title(
    failure_callback: Optional[FailureCallback] = None,
    main_runtime: dict = None,
    title_callback: Optional[TitleCallback] = None,
-    runtime_validator: Optional[RuntimeValidator] = None,
 ) -> None:
    """Fire-and-forget title generation after the first exchange.

@@ -355,12 +182,6 @@ def maybe_auto_title(
    if user_msg_count > 2:
        return

-    # Config read comes after the cheap first-exchange guard so the file
-    # isn't touched on every subsequent turn of a long session.
-    if not _auto_title_enabled():
-        logger.debug("Auto-title skipped: auxiliary.title_generation.enabled=false")
-        return
-
    thread = threading.Thread(
        target=auto_title_session,
        args=(session_db, session_id, user_message, assistant_response),
@@ -368,7 +189,6 @@ def maybe_auto_title(
            "failure_callback": failure_callback,
            "main_runtime": main_runtime,
            "title_callback": title_callback,
-            "runtime_validator": runtime_validator,
        },
        daemon=True,
        name="auto-title",
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Brooklyn Nicholson	9d19cfbb78	refactor(desktop): extract app-version IPC from main.cjs into version-ipc.cjs Ninth main.cjs cluster peel. The hermes:version handler moves verbatim into electron/version-ipc.cjs behind a registerVersionIpc({ ipcMain, resolveHermesVersion, resolveUpdateRoot }) registrar. The version + root resolvers stay in the main process (shared with the About menu) and are injected. Channel name unchanged → preload + renderer untouched. Adds electron/version-ipc.test.cjs (surface + payload behavior).	2026-06-30 14:12:39 -05:00
Brooklyn Nicholson	150e023fe2	refactor(desktop): extract uninstall IPC from main.cjs into uninstall-ipc.cjs Eighth main.cjs cluster peel. The two hermes:uninstall:* handlers (summary, run) move verbatim into electron/uninstall-ipc.cjs behind a registerUninstallIpc({ ipcMain, getUninstallSummary, runDesktopUninstall }) registrar. The uninstall engine stays in the main process and is injected. Channel names unchanged → preload + renderer untouched. Adds electron/uninstall-ipc.test.cjs (surface invariant + run mode normalization).	2026-06-30 14:11:50 -05:00
Brooklyn Nicholson	8a48d54193	refactor(desktop): extract VS Code Marketplace theme IPC from main.cjs into vscode-theme-ipc.cjs Seventh main.cjs cluster peel. The two hermes:vscode-theme:* handlers (fetch, search) move verbatim into electron/vscode-theme-ipc.cjs behind a registerVscodeThemeIpc({ ipcMain }) registrar. Both delegate to the vscode-marketplace sibling module, which the new module requires directly — so the now-dead require in main.cjs is removed. Channel names unchanged → preload + renderer untouched. Adds electron/vscode-theme-ipc.test.cjs (surface invariant).	2026-06-30 13:34:12 -05:00
Brooklyn Nicholson	e167ed7bb1	refactor(desktop): extract project-dir + workspace settings IPC from main.cjs into project-dir-ipc.cjs Sixth main.cjs cluster peel. The hermes:setting:defaultProjectDir:get/set/pick handlers + hermes:workspace:sanitize move verbatim into electron/project-dir-ipc.cjs behind a registerProjectDirIpc({ ipcMain, readDefaultProjectDir, writeDefaultProjectDir, resolveHermesCwd, sanitizeWorkspaceCwd }) registrar. The config readers/writers + cwd resolvers stay in the main process and are injected. Channel names unchanged → preload + renderer untouched. Adds electron/project-dir-ipc.test.cjs (surface + set/sanitize behavior; get/pick touch Electron app/dialog and are exercised in-app only).	2026-06-30 13:32:22 -05:00
Brooklyn Nicholson	0ed0c2d39f	refactor(desktop): extract desktop-log IPC handlers from main.cjs into logs-ipc.cjs Fifth main.cjs cluster peel. The two hermes:logs:* handlers (reveal, recent) move verbatim into electron/logs-ipc.cjs behind a registerLogsIpc({ ipcMain, DESKTOP_LOG_PATH, hermesLog, fileExists }) registrar. The log path and the in-memory ring buffer live in the main process and are injected. Channel names unchanged → preload + renderer untouched. Adds electron/logs-ipc.test.cjs (surface invariant + recent-tail behavior).	2026-06-30 13:30:48 -05:00
Brooklyn Nicholson	c147270a1c	refactor(desktop): extract auto-update IPC handlers from main.cjs into updates-ipc.cjs Fourth main.cjs cluster peel. The four hermes:updates:* handlers (check, apply, branch:get, branch:set) move verbatim into electron/updates-ipc.cjs behind a registerUpdatesIpc({ ipcMain, checkUpdates, applyUpdates, readDesktopUpdateConfig, writeDesktopUpdateConfig, DEFAULT_UPDATE_BRANCH }) registrar. The update engine and on-disk update config stay in the main process and are injected. Channel names unchanged → preload + renderer untouched. The interleaved resolveHermesVersion/showAboutPanelFresh helpers + hermes:version handler are shared with the menu and intentionally left in place. Adds electron/updates-ipc.test.cjs (surface invariant + branch default fallback + check-failure payload).	2026-06-30 13:29:38 -05:00
Brooklyn Nicholson	880f5837a1	refactor(desktop): extract terminal (PTY) IPC handlers from main.cjs into terminal-ipc.cjs Third main.cjs cluster peel. The four hermes:terminal:* handlers (start, write, resize, dispose) move verbatim into electron/terminal-ipc.cjs behind a registerTerminalIpc({ ipcMain, nodePty, terminalSessions, ... }) registrar. The PTY runtime, the shared session registry (also used by app-quit cleanup), and the shell-spec/env/cwd helpers (deep Windows-PATH + app-path coupling) stay in the main process and are injected, so the module owns only the request wiring. Channel names unchanged → preload + renderer untouched. Adds electron/terminal-ipc.test.cjs (surface invariant + unknown-session no-throw + PTY-unavailable error).	2026-06-30 13:28:44 -05:00
Brooklyn Nicholson	f3ce17bf9e	refactor(desktop): extract filesystem IPC handlers from main.cjs into fs-ipc.cjs Second main.cjs cluster peel (after git-ipc). The six hermes:fs:* handlers (readDir, gitRoot, reveal, rename, writeText, trash) move verbatim into electron/fs-ipc.cjs behind a registerFsIpc({ ipcMain, directoryExists, expandUserPath }) registrar — same injection pattern as registerGitIpc. Path hardening / read-dir / git-root come from their sibling modules directly; the two main-process path helpers are injected so the module stays side-effect free. Channel names are unchanged, so preload + renderer are untouched. main.cjs drops ~85 lines; the now-dead fs-read-dir / git-root requires in main.cjs are removed. Adds electron/fs-ipc.test.cjs asserting the hermes:fs:* surface by invariant.	2026-06-30 13:26:53 -05:00
Brooklyn Nicholson	b29bb6ef9d	refactor(desktop): assert git-ipc surface by invariant, drop channel snapshot	2026-06-30 02:05:07 -05:00
Brooklyn Nicholson	025c8f0604	refactor(desktop): extract git IPC handlers from main.cjs into git-ipc.cjs electron/main.cjs is the worst god file in the desktop app (~7.6k lines, 93 IPC handlers across unrelated domains). Begin peeling cohesive handler clusters into sibling modules — the established main.cjs pattern. First cluster: the 19 git/worktree/review IPC handlers (all thin delegators to the existing git-*-ops modules) move into a new electron/git-ipc.cjs exposing registerGitIpc({ ipcMain, resolveGitBinary, resolveGhBinary }). The git/gh binary resolvers stay in main.cjs (Windows PATH discovery) and are injected, so the new module is pure. Channel names are unchanged, so preload/renderer are unaffected. Adds electron/git-ipc.test.cjs (wired into test:desktop:platforms) asserting the full channel surface and resolver delegation. main.cjs: 7,617 -> 7,530.	2026-06-30 01:42:33 -05:00