fix(types): fix ty python env resolution + triage discord adapter

The .venv directory (created by uv run) contained Python 3.13 with no
deps installed. ty auto-discovers .venv for module resolution, so it
could not find discord.py, aiohttp, etc., producing ~1000 false
"Module has no member" errors.

Removing the stray .venv makes ty fall back to the nix env (Python 3.12
with all deps installed). Also set python-version = "3.12" in
[tool.ty.environment] with a comment explaining why.

ty diagnostics: 4,422 -> 3,385 (-1,037)
Tests: 496 passed, 0 failed

fix(nix): use python311 in dev shell (matches requires-python floor)

Production venv still uses python312 (nixos-unstable default). The dev
editable venv now uses python311 — the requires-python floor (>=3.11) —
so ty type checking and local dev catch 3.12+-only syntax that wouldnt

.dockerignore

@@ -97,6 +97,9 @@ packaging/
 plans/
 .plans/
 
+# ACP registry manifest (icon + agent.json) — not consumed at runtime
+acp_registry/
+
 # Repo-level dotfiles that are git-only or dev-tooling config
 .env.example
 .envrc

.github/actions/detect-changes/action.yml

@@ -5,12 +5,6 @@ description: >-
   the sub-workflows a PR can affect. Outputs are always "true" on push/dispatch
   events and fail open (everything "true") when the diff cannot be computed.
 
-inputs:
-  github-token:
-    description: Token for the GitHub API (gh CLI). Pass steps.app-token.outputs.token from the calling workflow.
-    required: false
-    default: ${{ github.token }}
-
 outputs:
   python:
     description: Run Python tests / ruff / ty / windows-footguns.
@@ -39,9 +33,6 @@ outputs:
   ci_review:
     description: Require CI-sensitive file review label.
     value: ${{ steps.classify.outputs.ci_review }}
-  ci_review_files:
-    description: JSON list of CI-sensitive files changed by the pull request.
-    value: ${{ steps.classify.outputs.ci_review_files }}
 
 runs:
   using: composite
@@ -50,12 +41,7 @@ runs:
       id: classify
       shell: bash
       env:
-        # Fall back to the built-in read-only token when the caller passes an
-        # empty value. Fork PRs get no repo secrets, so AUTOFIX_BOT_PAT is ""
-        # there, and an input `default:` only applies when the input is omitted,
-        # not when it's passed empty. Without this fallback the compare API
-        # fails on forks and the classifier fails open (every lane forced on).
-        GH_TOKEN: ${{ inputs.github-token || github.token }}
+        GH_TOKEN: ${{ github.token }}
         REPO: ${{ github.repository }}
         EVENT_NAME: ${{ github.event_name }}
         BASE_SHA: ${{ github.event.pull_request.base.sha }}
@@ -71,33 +57,10 @@ runs:
           # event payload instead of the "current PR files" endpoint. The SHAs
           # are frozen at trigger time, so the file list is deterministic even
           # if the PR receives a new push between trigger and detect.
-          #
-          # Retried: a rate-limit blip or eventual-consistency 404 on a
-          # freshly-pushed HEAD would otherwise silently fall open (all lanes
-          # run — safe, but wasteful and it masks the API failure).
-          #
-          # `.files[]?` (null-safe): with --paginate, a PR more than 100
-          # commits ahead of its merge-base paginates the compare, and pages
-          # after the first carry `files: null` — bare `.files[]` makes jq
-          # die with "cannot iterate over: null", which fails every retry
-          # and forces the fail-open path (seen on stacked PRs). The full
-          # file list (up to the API's 300-file cap) is on page one.
-          CHANGED=""
-          for i in 1 2 3; do
-            if CHANGED="$(gh api \
-              --paginate \
-              "repos/${REPO}/compare/${BASE_SHA}...${HEAD_SHA}" \
-              --jq '.files[]?.filename')"; then
-              break
-            fi
-            if [ "$i" = 3 ]; then
-              echo "::warning::compare API failed after 3 attempts — failing open (all lanes run)"
-              CHANGED=""
-              break
-            fi
-            echo "::warning::compare API failed (attempt $i); retrying in 10s"
-            sleep 10
-          done
+          CHANGED="$(gh api \
+            --paginate \
+            "repos/${REPO}/compare/${BASE_SHA}...${HEAD_SHA}" \
+            --jq '.files[].filename' || true)"
         fi
 
         echo "Changed files:"

.github/actions/get-app-token/action.yml

@@ -1,69 +0,0 @@
-name: Get GitHub App Token
-description: >-
-  Mint a short-lived (1-hour) installation access token from the repo's
-  GitHub App, replacing the long-lived AUTOFIX_BOT_PAT. App tokens get
-  5,000 req/hr per installation (vs 1,000 for the default GITHUB_TOKEN)
-  and are scoped to the App's installation permissions, not a user account.
-
-  Callers must source App credentials from a protected, main-only environment.
-  Never pass an App private key to a pull_request job, a local action, or a
-  reusable workflow resolved from an untrusted PR ref. The fallback keeps a
-  trusted caller functional when its protected environment is misconfigured.
-
-  Composite actions cannot access contexts directly, so callers pass the
-  public vars.APP_CLIENT_ID and protected secrets.APP_PRIVATE_KEY as inputs.
-  When the private key is empty, the fallback fires.
-
-inputs:
-  client-id:
-    description: GitHub App Client ID. Pass vars.APP_CLIENT_ID from the calling workflow.
-    required: false
-    default: ''
-  private-key:
-    description: GitHub App private key PEM. Pass secrets.APP_PRIVATE_KEY from the calling workflow.
-    required: false
-    default: ''
-  owner:
-    description: GitHub App installation owner. Empty scopes the token to the current repository.
-    required: false
-    default: ''
-  repositories:
-    description: Comma- or newline-separated repositories to scope within the installation owner.
-    required: false
-    default: ''
-
-outputs:
-  token:
-    description: A GitHub App installation access token (1-hour TTL), or GITHUB_TOKEN on forks.
-    value: ${{ steps.app-token.outputs.token || steps.fallback.outputs.token }}
-
-runs:
-  using: composite
-  steps:
-    - name: Check if App credentials exist
-      id: check
-      shell: bash
-      env:
-        CLIENT_ID: ${{ inputs.client-id }}
-      run: |
-        if [ -n "$CLIENT_ID" ]; then
-          echo "has_app=true" >> "$GITHUB_OUTPUT"
-        else
-          echo "has_app=false" >> "$GITHUB_OUTPUT"
-        fi
-
-    - name: Create GitHub App token
-      id: app-token
-      if: steps.check.outputs.has_app == 'true'
-      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-      with:
-        client-id: ${{ inputs.client-id }}
-        private-key: ${{ inputs.private-key }}
-        owner: ${{ inputs.owner }}
-        repositories: ${{ inputs.repositories }}
-
-    - name: Fall back to GITHUB_TOKEN
-      id: fallback
-      if: steps.check.outputs.has_app != 'true'
-      shell: bash
-      run: echo "token=${{ github.token }}" >> "$GITHUB_OUTPUT"

.github/actions/retry/action.yml

@@ -3,8 +3,7 @@ description: >-
   Run a shell command, retrying on non-zero exit. For dependency installs
   (npm ci, uv sync) whose only failures are transient network/toolchain
   flakes — a node-gyp header fetch, a registry blip — so CI self-heals
-  instead of needing a manual re-run. Can also capture stdout as a step
-  output for commands whose result must be consumed by later steps.
+  instead of needing a manual re-run.
 
 inputs:
   command:
@@ -20,16 +19,10 @@ inputs:
     description: Directory to run in.
     default: "."
 
-outputs:
-  stdout:
-    description: Captured stdout from the successful attempt (empty if not needed).
-    value: ${{ steps.retry.outputs.stdout }}
-
 runs:
   using: composite
   steps:
-    - id: retry
-      shell: bash
+    - shell: bash
       working-directory: ${{ inputs.working-directory }}
       # command goes through env, never interpolated into the script body, so
       # a command with quotes/specials can't break or inject into the runner.
@@ -39,25 +32,12 @@ runs:
         _DELAY: ${{ inputs.delay }}
       run: |
         set -uo pipefail
-        _OUTFILE="$(mktemp)"
-        trap 'rm -f "$_OUTFILE"' EXIT
         n=0
         while :; do
           n=$((n + 1))
           echo "::group::attempt $n/$_ATTEMPTS: $_CMD"
-          # Run the command, capturing stdout to a temp file while still
-          # streaming to the log. We redirect first, then tee the file to
-          # stdout — this avoids pipefail + tee exit-code interactions that
-          # can cause the if-branch to be skipped under set -e.
-          if bash -c "$_CMD" > "$_OUTFILE"; then
-            cat "$_OUTFILE"
+          if bash -c "$_CMD"; then
             echo "::endgroup::"
-            # Preserve newlines in the output via heredoc delimiter.
-            {
-              echo 'stdout<<__RETRY_STDOUT_EOF__'
-              cat "$_OUTFILE"
-              echo '__RETRY_STDOUT_EOF__'
-            } >> "$GITHUB_OUTPUT"
             exit 0
           fi
           echo "::endgroup::"

.github/workflows/ci.yml

@@ -9,10 +9,6 @@ name: CI
 # definitions, matrices, and concurrency settings. They no longer have
 # ``push:`` / ``pull_request:`` triggers of their own — everything flows
 # through this file.
-#
-# SECURITY: this workflow runs PR-controlled actions, workflows, and code.
-# Do not add ``secrets: inherit`` or GitHub App credentials here. Trusted
-# main-only automation uses protected environments in its own workflows.
 
 on:
   pull_request:
@@ -21,7 +17,7 @@ on:
 
 permissions:
   contents: read
-  pull-requests: write # needed by lint (PR comment) + supply-chain review_status
+  pull-requests: write # needed by lint (PR comment) + supply-chain (PR comment)
   actions: read # needed by osv-scanner (SARIF upload)
   security-events: write # needed by osv-scanner (SARIF upload)
   packages: write # needed by docker build
@@ -39,7 +35,6 @@ jobs:
   detect:
     name: Detect affected areas
     runs-on: ubuntu-latest
-    timeout-minutes: 10
     outputs:
       python: ${{ steps.classify.outputs.python }}
       frontend: ${{ steps.classify.outputs.frontend }}
@@ -50,15 +45,12 @@ jobs:
       docker_meta: ${{ steps.classify.outputs.docker_meta }}
       mcp_catalog: ${{ steps.classify.outputs.mcp_catalog }}
       ci_review: ${{ steps.classify.outputs.ci_review }}
-      ci_review_files: ${{ steps.classify.outputs.ci_review_files }}
       event_name: ${{ github.event_name }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Detect affected areas
         id: classify
         uses: ./.github/actions/detect-changes
-        with:
-          github-token: ${{ github.token }}
 
   # ─────────────────────────────────────────────────────────────────────
   # Lane-gated sub-workflows. Each runs in parallel after detect finishes.
@@ -75,10 +67,11 @@ jobs:
   lint:
     name: Python lints
     needs: detect
-    if: needs.detect.outputs.python == 'true'
+    if: needs.detect.outputs.python == 'true' || needs.detect.outputs.ci_review == 'true'
     uses: ./.github/workflows/lint.yml
     with:
       event_name: ${{ needs.detect.outputs.event_name }}
+      ci_review: ${{ needs.detect.outputs.ci_review == 'true' }}
 
   js-tests:
     name: JS & TS checks
@@ -86,12 +79,6 @@ jobs:
     if: needs.detect.outputs.frontend == 'true'
     uses: ./.github/workflows/js-tests.yml
 
-  e2e-desktop:
-    name: Desktop E2E
-    needs: detect
-    if: needs.detect.outputs.python == 'true' || needs.detect.outputs.frontend == 'true'
-    uses: ./.github/workflows/e2e-desktop.yml
-
   docs-site:
     name: Docs Site
     needs: detect
@@ -130,132 +117,38 @@ jobs:
   docker:
     name: Build&Test Docker image
     needs: detect
-    # Trusted main pushes run docker.yml directly so its container-publish
-    # environment secrets never cross this reusable-workflow call. PR runs
-    # remain build/test-only and secret-free.
-    if: needs.detect.outputs.event_name == 'pull_request' && (needs.detect.outputs.python == 'true' || needs.detect.outputs.frontend == 'true' || needs.detect.outputs.docker_meta == 'true')
+    if: needs.detect.outputs.python == 'true' || needs.detect.outputs.frontend == 'true' || needs.detect.outputs.docker_meta == 'true'
     uses: ./.github/workflows/docker.yml
+    secrets: inherit
 
   supply-chain:
     name: Supply-chain scan
     needs: detect
-    if: needs.detect.outputs.event_name == 'pull_request' && (needs.detect.outputs.scan == 'true' || needs.detect.outputs.deps == 'true')
+    if: needs.detect.outputs.event_name == 'pull_request' && (needs.detect.outputs.scan == 'true' || needs.detect.outputs.deps == 'true' || needs.detect.outputs.mcp_catalog == 'true')
     uses: ./.github/workflows/supply-chain-audit.yml
     with:
       event_name: ${{ needs.detect.outputs.event_name }}
       scan: ${{ needs.detect.outputs.scan == 'true' }}
       deps: ${{ needs.detect.outputs.deps == 'true' }}
-
-  review-labels:
-    name: Review label gate
-    needs: [detect, supply-chain]
-    if: always() && needs.detect.outputs.event_name == 'pull_request' && (needs.detect.outputs.ci_review == 'true' || needs.detect.outputs.mcp_catalog == 'true' || needs.supply-chain.outputs.critical_findings == 'true')
-    uses: ./.github/workflows/review-labels.yml
-    with:
-      ci_review: ${{ needs.detect.outputs.ci_review == 'true' }}
-      ci_review_files: ${{ needs.detect.outputs.ci_review_files }}
       mcp_catalog: ${{ needs.detect.outputs.mcp_catalog == 'true' }}
-      supply_chain: ${{ needs.supply-chain.outputs.critical_findings == 'true' }}
 
   osv-scanner:
     name: OSV scan
     uses: ./.github/workflows/osv-scanner.yml
 
-  # ─────────────────────────────────────────────────────────────────────
-  # Live-updating PR review comment.
-  #
-  # A single ``comment-live`` job polls the GitHub Actions API every 15s
-  # for job statuses in this run, re-assembles the review comment from
-  # whatever results are available, and upserts it via the
-  # ``<!-- hermes-ci-review-bot -->`` marker.
-  #
-  # When the visible job set goes quiet, the poller waits 10 seconds and polls
-  # once more so downstream jobs created by an aggregate gate get included.
-  # ─────────────────────────────────────────────────────────────────────
-  comment-live:
-    name: CI review comment (live)
-    needs: [detect, review-labels, lockfile-diff, supply-chain, osv-scanner, uv-lockfile, history-check, contributor-check, e2e-desktop]
-    if: always() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork != true
-    runs-on: ubuntu-latest
-    timeout-minutes: 40
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ github.event.repository.default_branch }}
-          persist-credentials: false
-
-      - name: Run live comment poller
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITHUB_REPOSITORY: ${{ github.repository }}
-          GITHUB_RUN_ID: ${{ github.run_id }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-          # Commit info for the review comment header.
-          COMMIT_SHA: ${{ github.event.pull_request.head.sha }}
-          COMMIT_MESSAGE: ${{ github.event.pull_request.head.commit.message }}
-          COMMIT_URL: ${{ github.server_url }}/${{ github.repository }}/pull/${{ github.event.pull_request.number }}/commits/${{ github.event.pull_request.head.sha }}
-          # Structured review statuses from workflow_call jobs.
-          # Each job outputs a JSON array of {source, results: [...]} objects
-          # that the assembler renders directly — no hardcoded job-name
-          # matching. We merge all available outputs into one array.
-          REVIEW_STATUSES: ${{ toJSON(needs.*.outputs.review_status) }}
-        run: |
-          set -uo pipefail
-
-          # REVIEW_STATUSES is a JSON array of strings (some may be empty
-          # when a job was skipped). Parse each string and merge into one
-          # flat array for the assembler.
-          python3 - <<'PYEOF'
-          import json, os, sys
-
-          raw = os.environ.get("REVIEW_STATUSES", "")
-          merged = []
-          if raw:
-              try:
-                  arr = json.loads(raw)
-              except (json.JSONDecodeError, TypeError):
-                  arr = []
-              for item in arr:
-                  if not item:
-                      continue
-                  try:
-                      statuses = json.loads(item)
-                  except (json.JSONDecodeError, TypeError):
-                      continue
-                  if isinstance(statuses, list):
-                      merged.extend(statuses)
-
-          # Write merged array to a temp file the poller reads.
-          with open("/tmp/review_statuses.json", "w") as f:
-              json.dump(merged, f)
-          print(f"Merged {len(merged)} review status entries")
-          PYEOF
-
-          python3 scripts/ci/live_comment.py \
-            --interval 15 \
-            --timeout 2100 \
-            --review-statuses-file /tmp/review_statuses.json
-
   # ─────────────────────────────────────────────────────────────────────
   # Gate: runs after everything. ``if: always()`` ensures it reports a
   # status even when some deps were skipped. Only actual ``failure``
   # results cause it to fail; ``skipped`` is treated as success.
   #
   # Branch protection should require ONLY this check.
-  #
-  # Outputs ``needs-json`` — a compact ``{job_name: result}`` dict — so
-  # the live comment poller can list failed jobs in the PR comment.
   # ─────────────────────────────────────────────────────────────────────
   all-checks-pass:
     name: All required checks pass
     needs:
-      - detect
       - tests
       - lint
       - js-tests
-      - e2e-desktop
       - docs-site
       - history-check
       - contributor-check
@@ -263,30 +156,19 @@ jobs:
       - lockfile-diff
       - docker-lint
       - supply-chain
-      - review-labels
       - osv-scanner
-      # comment-live is a polling job — it doesn't block the gate.
       # we don't require docker to pass rn because it's so slow lol
       # - docker
     if: always()
     runs-on: ubuntu-latest
-    timeout-minutes: 10
-    outputs:
-      needs-json: ${{ steps.evaluate.outputs.needs-json }}
     steps:
       - name: Evaluate job results
-        id: evaluate
         env:
           NEEDS: ${{ toJSON(needs) }}
         run: |
           echo "$NEEDS" | python3 -c "
           import json, sys
           needs = json.load(sys.stdin)
-          # Emit compact {job_name: result} for the comment assembler.
-          compact = {name: info['result'] for name, info in needs.items()}
-          print(f'needs-json={json.dumps(compact)}')
-          with open('$GITHUB_OUTPUT', 'a') as f:
-              f.write(f'needs-json={json.dumps(compact)}\n')
           failed = [name for name, info in needs.items() if info['result'] == 'failure']
           for name, info in sorted(needs.items()):
               result = info['result']
@@ -303,16 +185,12 @@ jobs:
   # cache them on main (as a baseline), and on PRs generate an HTML diff
   # report with a gantt chart + per-step breakdown. The report is uploaded
   # as an artifact and a markdown summary is written to $GITHUB_STEP_SUMMARY.
-  #
-  # The live comment poller can read the standalone review-status artifact
-  # after the HTML report is uploaded, so its link points straight at that report.
   # ─────────────────────────────────────────────────────────────────────
   ci-timings:
     name: CI timing report
     needs: [all-checks-pass, docker]
     if: always()
     runs-on: ubuntu-latest
-    timeout-minutes: 10
     steps:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -330,7 +208,7 @@ jobs:
 
       - name: Collect timings and generate report
         env:
-          GITHUB_TOKEN: ${{ github.token }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           python3 scripts/ci/timings_report.py \
             --baseline ci-timings-baseline.json \
@@ -339,43 +217,20 @@ jobs:
             --summary-out ci-timings-summary.md
 
       - name: Upload HTML report
-        # Advisory report — artifact-service blips must not fail the job.
-        continue-on-error: true
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        id: ci-timings-html
+        id: ci-timings-artifact
         with:
           name: ci-timings-report
           path: ci-timings-report.html
           retention-days: 14
-
-      - name: Build linked review status
-        if: hashFiles('ci-timings.json') != ''
-        env:
-          CI_TIMINGS_REPORT_URL: ${{ steps.ci-timings-html.outputs.artifact-url }}
-        run: |
-          python3 scripts/ci/timings_report.py \
-            --from-json ci-timings.json \
-            --baseline ci-timings-baseline.json \
-            --review-status-out review-status.json \
-            --review-status-only
-
-      - name: Upload review status
-        if: hashFiles('review-status.json') != ''
-        continue-on-error: true
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: ci-timings-review-status
-          path: review-status.json
-          retention-days: 14
+          archive: false
 
       - name: Output summary
         env:
-          REPORT_URL: ${{ steps.ci-timings-html.outputs.artifact-url}}
+          REPORT_URL: ${{ steps.ci-timings-artifact.outputs.artifact-url}}
         run: |
-          {
-            echo "# CI Timing report"
-            echo "[View the full interactive report]($REPORT_URL)"
-          } >> "$GITHUB_STEP_SUMMARY"
+          echo "# CI Timing report" >> "$GITHUB_STEP_SUMMARY"
+          echo "[View the full interactive report]($REPORT_URL)" >> "$GITHUB_STEP_SUMMARY"
           cat ci-timings-summary.md >> "$GITHUB_STEP_SUMMARY"
 
       - name: Save baseline cache (main only)

.github/workflows/contributor-check.yml

@@ -2,10 +2,6 @@ name: Contributor Attribution Check
 
 on:
   workflow_call:
-    outputs:
-      review_status:
-        description: "JSON array of review status objects"
-        value: ${{ jobs.check-attribution.outputs.review_status }}
 
 permissions:
   contents: read
@@ -13,16 +9,12 @@ permissions:
 jobs:
   check-attribution:
     runs-on: ubuntu-latest
-    timeout-minutes: 10
-    outputs:
-      review_status: ${{ steps.check-emails.outputs.review_status }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           fetch-depth: 0  # Full history needed for git log
 
       - name: Check for unmapped contributor emails
-        id: check-emails
         run: |
           # Get the merge base between this PR and main
           MERGE_BASE=$(git merge-base origin/main HEAD)
@@ -32,13 +24,10 @@ jobs:
 
           if [ -z "$NEW_EMAILS" ]; then
             echo "No new commits to check."
-            echo "review_status=[]" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
-          # An email is mapped if it has a file in contributors/emails/
-          # (one file per email — conflict-free) or an entry in the frozen
-          # legacy AUTHOR_MAP in scripts/release.py.
+          # Check each email against AUTHOR_MAP in release.py
           MISSING=""
           while IFS= read -r email; do
             # Skip teknium and bot emails
@@ -47,12 +36,9 @@ jobs:
                 continue ;;
             esac
 
+            # Check if email is in AUTHOR_MAP (either as a key or matches noreply pattern)
             if echo "$email" | grep -qP '\+.*@users\.noreply\.github\.com'; then
-              continue  # GitHub id+login noreply emails auto-resolve
-            fi
-
-            if [ -f "contributors/emails/${email}" ]; then
-              continue  # mapped via the contributors directory
+              continue  # GitHub noreply emails auto-resolve
             fi
 
             if ! grep -qF "\"${email}\"" scripts/release.py 2>/dev/null; then
@@ -63,29 +49,19 @@ jobs:
 
           if [ -n "$MISSING" ]; then
             echo ""
-            echo "⚠️  New contributor email(s) without a mapping:"
+            echo "⚠️  New contributor email(s) not in AUTHOR_MAP:"
             echo -e "$MISSING"
             echo ""
-            echo "Add a mapping file (do NOT edit AUTHOR_MAP in release.py):"
+            echo "Please add mappings to scripts/release.py AUTHOR_MAP:"
             echo -e "$MISSING" | while read -r line; do
               email=$(echo "$line" | sed 's/^ *//' | cut -d' ' -f1)
               [ -z "$email" ] && continue
-              echo "    python3 scripts/add_contributor.py ${email} <github-username>"
+              echo "    \"${email}\": \"<github-username>\","
             done
             echo ""
             echo "To find the GitHub username for an email:"
             echo "  gh api 'search/users?q=EMAIL+in:email' --jq '.items[0].login'"
-
-            # Emit review_status for unmapped emails
-            DETAIL=$(echo -e "$MISSING" | sed '/^$/d; s/^  //')
-            HOW_TO_FIX=$'Add mappings to scripts/release.py AUTHOR_MAP:\n```\n"<email>": "<github-username>",\n```\nTo find the GitHub username for an email:\n```\ngh api \'search/users?q=EMAIL+in:email\' --jq \'.items[0].login\'\n```\n'
-            REVIEW_STATUS=$(jq -nc \
-              --arg detail "$DETAIL" \
-              --arg how_to_fix "$HOW_TO_FIX" \
-              '[{"source":"contributor attribution","results":[{"kind":"action_required","title":"Unmapped contributor email(s)","summary":"New contributor email(s) are not in AUTHOR_MAP.","detail":$detail,"how_to_fix":$how_to_fix}]}]')
-            echo "review_status=$REVIEW_STATUS" >> "$GITHUB_OUTPUT"
-
             exit 1
           else
-            echo "✅ All contributor emails are mapped."
+            echo "✅ All contributor emails are mapped in AUTHOR_MAP."
           fi

.github/workflows/deploy-site.yml

@@ -41,28 +41,19 @@ jobs:
     # doesn't auto-deploy via the deploy-docs path.
     if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
-    timeout-minutes: 30
     steps:
       - name: Trigger Vercel Deploy
-        run: curl -fsS --retry 3 --retry-delay 10 -X POST "${{ secrets.VERCEL_DEPLOY_HOOK }}"
+        run: curl -X POST "${{ secrets.VERCEL_DEPLOY_HOOK }}"
 
   deploy-docs:
     if: github.repository == 'NousResearch/hermes-agent'
     runs-on: ubuntu-latest
-    timeout-minutes: 30
     environment:
       name: github-pages
       url: ${{ steps.deploy.outputs.page_url }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
-      - name: Get GitHub App token
-        id: app-token
-        uses: ./.github/actions/get-app-token
-        with:
-          client-id: ${{ vars.APP_CLIENT_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
-
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
         with:
           node-version: 22
@@ -74,14 +65,12 @@ jobs:
           python-version: '3.11'
 
       - name: Install PyYAML for skill extraction
-        uses: ./.github/actions/retry
-        with:
-          command: pip install pyyaml==6.0.2 httpx==0.28.1
+        run: pip install pyyaml==6.0.2 httpx==0.28.1
 
       - name: Prepare skills index (unified multi-source catalog)
         env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
+          GH_TOKEN: ${{ github.token }}
+          GITHUB_TOKEN: ${{ github.token }}
           SKILLS_INDEX_RUN_ID: ${{ github.event.inputs.skills_index_run_id || '' }}
           REBUILD_SKILLS_INDEX: ${{ github.event.inputs.rebuild_skills_index || 'false' }}
         run: |
@@ -161,10 +150,8 @@ jobs:
         run: python3 website/scripts/generate-skill-docs.py
 
       - name: Install dependencies
-        uses: ./.github/actions/retry
-        with:
-          command: npm ci
-          working-directory: website
+        run: npm ci
+        working-directory: website
 
       - name: Build Docusaurus
         run: npm run build

.github/workflows/docker.yml

@@ -1,15 +1,8 @@
 name: Docker Build, Test, and Publish
 
 on:
-  # Trusted main pushes run this workflow directly so environment-scoped
-  # Docker Hub secrets are resolved by the top-level workflow, never across
-  # a reusable-workflow boundary.
-  push:
-    branches: [main]
   release:
     types: [published]
-  # CI calls this only for untrusted PR build/test coverage. Those runs never
-  # reach the protected publish or merge jobs below.
   workflow_call:
 
 permissions:
@@ -27,9 +20,7 @@ env:
   IMAGE_NAME: nousresearch/hermes-agent
 
 jobs:
-  # Build and test the image for each architecture. This job runs PR code,
-  # so it must remain secret-free. Publishing happens in the separate,
-  # protected publish job after these tests pass.
+  # Build, test, and optionally push the image for each architecture.
   build:
     if: github.repository == 'NousResearch/hermes-agent'
     strategy:
@@ -71,6 +62,49 @@ jobs:
           cache-from: ${{ matrix.cache-from }}
           cache-to: ${{ (github.event_name != 'pull_request') && matrix.cache-to || '' }}
 
+      - name: Log in to Docker Hub
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main' || github.event_name == 'release'
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      # Push by digest only (no tag).  The merge job assembles the
+      # tagged manifest list.  `push-by-digest=true` is docker's recommended
+      # pattern for multi-runner multi-platform builds.
+      - name: Push ${{ matrix.arch }} by digest
+        id: push
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main' || github.event_name == 'release'
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        with:
+          context: .
+          file: Dockerfile
+          platforms: ${{ matrix.platform }}
+          labels: |
+            org.opencontainers.image.revision=${{ github.sha }}
+          build-args: |
+            HERMES_GIT_SHA=${{ github.sha }}
+          outputs: type=image,name=${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true
+          cache-from: ${{ matrix.cache-from }}
+          cache-to: ${{ matrix.cache-to }}
+
+      # Write the digest to a file and upload it as an artifact so the
+      # merge job can stitch both per-arch digests into a manifest list.
+      - name: Export digest
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main' || github.event_name == 'release'
+        run: |
+          mkdir -p /tmp/digests
+          digest="${{ steps.push.outputs.digest }}"
+          touch "/tmp/digests/${digest#sha256:}"
+
+      - name: Upload digest artifact
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main' || github.event_name == 'release'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: digest-${{ matrix.arch }}
+          path: /tmp/digests/*
+          if-no-files-found: error
+          retention-days: 1
 
       # Run the docker-integration test suite against the freshly-built
       # image already loaded into the local daemon (`:test`).
@@ -93,13 +127,12 @@ jobs:
         run: uv python install 3.11
 
       - name: Install Python dependencies (for docker tests)
-        # ``dev`` extra pulls in pytest, pytest-asyncio —
-        # everything tests/docker/ needs.  We deliberately avoid ``all``
-        # here because the docker tests only drive the container via
-        # subprocess and don't import hermes_agent's optional deps.
-        uses: ./.github/actions/retry
-        with:
-          command: uv sync --locked --python 3.11 --extra dev
+        run: |
+          # ``dev`` extra pulls in pytest, pytest-asyncio —
+          # everything tests/docker/ needs.  We deliberately avoid ``all``
+          # here because the docker tests only drive the container via
+          # subprocess and don't import hermes_agent's optional deps.
+          uv sync --locked --python 3.11 --extra dev
 
       - name: Run docker integration tests
         env:
@@ -113,74 +146,6 @@ jobs:
         run: |
           scripts/run_tests.sh tests/docker/ --file-timeout 600
 
-  # ---------------------------------------------------------------------------
-  # Rebuild and push each architecture only after the unprivileged build/test
-  # matrix passes. This job is the sole Docker Hub credential boundary.
-  # ---------------------------------------------------------------------------
-  publish:
-    if: github.repository == 'NousResearch/hermes-agent' && (github.event_name == 'push' && github.ref == 'refs/heads/main' || github.event_name == 'release')
-    needs: [build]
-    environment: container-publish
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - arch: amd64
-            runner: ubuntu-latest
-            platform: linux/amd64
-            cache-from: type=gha,scope=docker-amd64
-            cache-to: type=gha,mode=max,scope=docker-amd64
-          - arch: arm64
-            runner: ubuntu-24.04-arm
-            platform: linux/arm64
-            cache-from: type=gha,scope=docker-arm64
-            cache-to: type=gha,mode=max,scope=docker-arm64
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 30
-    steps:
-      - name: Checkout trusted source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
-
-      - name: Log in to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      # Push by digest only (no tag). The merge job assembles the tagged
-      # manifest list after both architecture publishers complete.
-      - name: Push ${{ matrix.arch }} by digest
-        id: push
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
-        with:
-          context: .
-          file: Dockerfile
-          platforms: ${{ matrix.platform }}
-          labels: |
-            org.opencontainers.image.revision=${{ github.sha }}
-          build-args: |
-            HERMES_GIT_SHA=${{ github.sha }}
-          outputs: type=image,name=${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true
-          cache-from: ${{ matrix.cache-from }}
-          cache-to: ${{ matrix.cache-to }}
-
-      - name: Export digest
-        run: |
-          mkdir -p /tmp/digests
-          digest="${{ steps.push.outputs.digest }}"
-          touch "/tmp/digests/${digest#sha256:}"
-
-      - name: Upload digest artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: digest-${{ matrix.arch }}
-          path: /tmp/digests/*
-          if-no-files-found: error
-          retention-days: 1
-
   # ---------------------------------------------------------------------------
   # Stitch both per-arch digests into a single tagged multi-arch manifest.
   # This is a registry-side operation — no building, no layer re-push —
@@ -192,9 +157,8 @@ jobs:
   merge:
     if: github.repository == 'NousResearch/hermes-agent' && (github.event_name == 'push' && github.ref == 'refs/heads/main' || github.event_name == 'release')
     runs-on: ubuntu-latest
-    needs: [publish]
+    needs: [build]
     timeout-minutes: 10
-    environment: container-publish
     steps:
       - name: Download digests
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
@@ -224,23 +188,15 @@ jobs:
             args+=("${IMAGE_NAME}@sha256:${digest_file}")
           done
           if [ "${{ github.event_name }}" = "release" ]; then
-            tags=(-t "${IMAGE_NAME}:${RELEASE_TAG}")
+            docker buildx imagetools create \
+              -t "${IMAGE_NAME}:${RELEASE_TAG}" \
+              "${args[@]}"
           else
-            tags=(-t "${IMAGE_NAME}:main" -t "${IMAGE_NAME}:latest")
+            docker buildx imagetools create \
+              -t "${IMAGE_NAME}:main" \
+              -t "${IMAGE_NAME}:latest" \
+              "${args[@]}"
           fi
-          # Retry: Docker Hub API + just-pushed digest eventual consistency
-          # can transiently fail the create; the operation is idempotent.
-          for i in 1 2 3; do
-            if docker buildx imagetools create "${tags[@]}" "${args[@]}"; then
-              break
-            fi
-            if [ "$i" = 3 ]; then
-              echo "::error::imagetools create failed after 3 attempts"
-              exit 1
-            fi
-            echo "::warning::imagetools create failed (attempt $i); retrying in 20s"
-            sleep 20
-          done
 
       - name: Inspect image
         env:

.github/workflows/docs-site-checks.yml

@@ -9,7 +9,6 @@ permissions:
 jobs:
   docs-site-checks:
     runs-on: ubuntu-latest
-    timeout-minutes: 20
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 

.github/workflows/e2e-desktop.yml

@@ -1,255 +0,0 @@
-name: E2E Desktop
-
-on:
-  workflow_call:
-    outputs:
-      review_status:
-        description: Screenshot and visual-diff status for the CI review comment.
-        value: ${{ jobs.e2e.outputs.review_status }}
-
-permissions:
-  contents: read
-
-concurrency:
-  group: e2e-desktop-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  e2e:
-    name: Playwright E2E (Linux)
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    outputs:
-      review_status: ${{ steps.review-status.outputs.review_status }}
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      # ── System deps for Electron on headless Ubuntu ───────────────────
-      # Electron needs GTK, NSS,atk, etc. even under xvfb. Playwright's
-      # install-deps covers browsers; for Electron we install the apt
-      # packages directly.
-      - name: Install system dependencies for Electron
-        run: |
-          sudo apt-get update -qq
-          sudo apt-get install -y -qq \
-            xvfb \
-            libgtk-3-0 libnotify4 libnss3 libxss1 libxtst6 \
-            xdg-utils libatspi2.0-0 libdrm2 libgbm1 libasound2t64
-
-      # ── Node ───────────────────────────────────────────────────────────
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22
-          cache: npm
-      # Full npm ci (not --ignore-scripts): electron's postinstall
-      # downloads the binary we launch, and node-pty's native build is
-      # needed for the terminal pane.
-      - uses: ./.github/actions/retry
-        with:
-          command: npm ci
-
-      # ── Python (for the hermes serve backend) ──────────────────────────
-      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # 8.2.0
-        with:
-          enable-cache: true
-          cache-dependency-glob: |
-            pyproject.toml
-            uv.lock
-      - name: Set up Python 3.11
-        run: uv python install 3.11
-      - name: Install Python dependencies
-        uses: ./.github/actions/retry
-        with:
-          command: uv sync --locked --python 3.11 --extra all --extra dev
-
-      # ── Build desktop app ─────────────────────────────────────────────
-      # The Playwright step below runs `npm run build` before testing so
-      # dist/ is always fresh — no separate build step needed here.
-
-      # ── Restore visual baseline screenshots from main ──────────────────
-      # Baselines are generated on main (via --update-snapshots) and cached.
-      # On PRs, we restore them so toHaveScreenshot has something to compare
-      # against.  The cache key is keyed on the desktop source files so a
-      # UI change naturally invalidates it — but we fall back to the main
-      # cache to avoid cold starts on unrelated PRs.
-      - name: Restore visual baseline screenshots
-        id: restore-baselines
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
-        with:
-          path: apps/desktop/e2e/*-snapshots
-          key: visual-baselines-${{ github.ref_name }}
-          restore-keys: |
-            visual-baselines-main
-
-      # ── Run Playwright E2E under xvfb ─────────────────────────────────
-      # xvfb runs at a fixed 1280x1024 screen so the 1220x800 Electron
-      # window always has a consistent viewport for screenshot comparison.
-      # On main, we run with --update-snapshots to generate baselines.
-      # `npm run test:e2e` builds dist/ as a pretest hook so the renderer
-      # is always fresh — no separate build step needed.
-      - name: Run Playwright E2E tests
-        working-directory: apps/desktop
-        run: |
-          if [ "${{ github.ref_name }}" = "main" ]; then
-            echo "On main — generating/updating baseline screenshots"
-            npm run build && xvfb-run -a --server-args="-screen 0 1280x1024x24" \
-              npx playwright test --reporter=list --update-snapshots
-          else
-            echo "On PR — comparing against cached baselines"
-            npm run build && xvfb-run -a --server-args="-screen 0 1280x1024x24" \
-              npx playwright test --reporter=list
-          fi
-        env:
-          CI: "true"
-          # Ensure no real API keys leak into the test env.
-          OPENROUTER_API_KEY: ""
-          OPENAI_API_KEY: ""
-          NOUS_API_KEY: ""
-
-      # ── Save updated baselines to cache (main only) ───────────────────
-      - name: Save updated baselines to cache
-        if: github.ref_name == 'main' && always()
-        uses: actions/cache/save@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
-        with:
-          path: apps/desktop/e2e/*-snapshots
-          key: visual-baselines-main
-
-      # ── Upload Playwright report (HTML + traces) ──────────────────────
-      - name: Upload Playwright report
-        id: upload-report
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: playwright-report-${{ github.sha }}
-          path: apps/desktop/playwright-report
-          retention-days: 14
-          overwrite: true
-
-      # ── Upload test results (screenshots, traces, diffs) ───────────────
-      - name: Upload test results
-        id: upload-results
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: playwright-test-results-${{ github.sha }}
-          path: apps/desktop/test-results
-          retention-days: 14
-          overwrite: true
-
-      # ── Upload just the visual diffs (small, fast to review) ──────────
-      - name: Upload visual diffs
-        id: upload-diffs
-        if: always() && github.ref_name != 'main'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: visual-diffs-${{ github.sha }}
-          path: |
-            apps/desktop/test-results/**/*-diff.png
-            apps/desktop/test-results/**/*-actual.png
-            apps/desktop/test-results/**/*-expected.png
-          retention-days: 14
-          overwrite: true
-          if-no-files-found: ignore
-
-      - name: Build screenshot review status
-        id: review-status
-        if: always()
-        working-directory: apps/desktop
-        env:
-          RESULTS_URL: ${{ steps.upload-results.outputs.artifact-url }}
-        run: |
-          python3 ../../scripts/ci/e2e_screenshot_status.py \
-            --results-dir test-results \
-            --manifest-output /tmp/e2e-screenshot-manifest.json \
-            --evidence-dir /tmp/e2e-evidence \
-            --artifact-url "$RESULTS_URL" \
-            --output /tmp/e2e-review-status.json
-          {
-            echo 'review_status<<__E2E_REVIEW_STATUS__'
-            cat /tmp/e2e-review-status.json
-            echo '__E2E_REVIEW_STATUS__'
-          } >> "$GITHUB_OUTPUT"
-
-      # The trusted workflow_run publisher consumes only this flat, bounded
-      # artifact. It turns selected images into GitHub attachment URLs; it
-      # never checks out or runs this PR's code.
-      - name: Upload inline E2E evidence
-        if: always() && github.ref_name != 'main'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: e2e-evidence-${{ github.sha }}
-          path: /tmp/e2e-evidence
-          retention-days: 14
-          overwrite: true
-          if-no-files-found: error
-
-      # ── Generate step summary with visual diff info ───────────────────
-      # Parse the JSON report + scan for diff images, then post a summary
-      # to the GitHub Actions step output so reviewers can see what changed
-      # without downloading artifacts.  Runs AFTER uploads so it can link
-      # the artifact download URLs from their step outputs.
-      - name: Generate visual diff summary
-        if: always()
-        working-directory: apps/desktop
-        env:
-          REPORT_URL: ${{ steps.upload-report.outputs.artifact-url }}
-          RESULTS_URL: ${{ steps.upload-results.outputs.artifact-url }}
-          DIFFS_URL: ${{ steps.upload-diffs.outputs.artifact-url }}
-        run: |
-          {
-          echo "## Desktop E2E — Visual Diff Report"
-          echo ""
-
-          # Count diff images (playwright writes *-diff.png on mismatch)
-          DIFF_COUNT=$(find test-results -name '*-diff.png' 2>/dev/null | wc -l)
-          ACTUAL_COUNT=$(find test-results -name '*-actual.png' 2>/dev/null | wc -l)
-
-          if [ "$DIFF_COUNT" -eq 0 ]; then
-            echo "✅ All $ACTUAL_COUNT screenshot(s) matched their baselines (or no baselines existed yet)."
-          else
-            echo "📸 **$DIFF_COUNT of $ACTUAL_COUNT screenshot(s) differ from baseline:**"
-            echo ""
-            echo "| Test | Diff | Actual | Expected |"
-            echo "|------|------|--------|----------|"
-
-            # List each diff image with a link to the artifact
-            for diff in $(find test-results -name '*-diff.png' 2>/dev/null | sort); do
-              base=${diff%-diff.png}
-              test_name=$(basename "$base")
-              echo "| $test_name | [diff]($diff) | [actual](${base}-actual.png) | [expected](${base}-expected.png) |"
-            done
-          fi
-
-          echo ""
-          echo "📥 **Artifacts:**"
-          echo ""
-          if [ -n "$RESULTS_URL" ]; then
-            echo "- [playwright-test-results]($RESULTS_URL) — all screenshots (actual + expected + diff) + traces"
-          fi
-          if [ -n "$REPORT_URL" ]; then
-            echo "- [playwright-report]($REPORT_URL) — interactive HTML report"
-          fi
-          if [ -n "$DIFFS_URL" ]; then
-            echo "- [visual-diffs]($DIFFS_URL) — just the diffed screenshots (small, fast to review)"
-          fi
-          echo ""
-          echo "**To update baselines:** merge to main (baselines auto-update on main runs) or run \`npx playwright test --update-snapshots\` locally."
-
-          # Also parse the JSON report for pass/fail counts
-          if [ -f playwright-report/results.json ]; then
-            echo ""
-            echo "### Test Results"
-            echo ""
-            node -e "
-              const r = require('./playwright-report/results.json');
-              const stats = r.stats || {};
-              console.log('| Status | Count |');
-              console.log('|--------|-------|');
-              console.log('| ✅ Passed | ' + (stats.expected || 0) + ' |');
-              console.log('| ❌ Failed | ' + (stats.unexpected || 0) + ' |');
-              console.log('| ⏭️ Skipped | ' + (stats.skipped || 0) + ' |');
-              console.log('| 🔄 Flaky | ' + (stats.flaky || 0) + ' |');
-            " 2>/dev/null || true
-          fi
-          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/history-check.yml

@@ -15,10 +15,6 @@ name: History Check
 
 on:
   workflow_call:
-    outputs:
-      review_status:
-        description: "JSON array of review_status objects for the synthesizer."
-        value: ${{ jobs.check-common-ancestor.outputs.review_status }}
 
 permissions:
   contents: read
@@ -26,24 +22,18 @@ permissions:
 jobs:
   check-common-ancestor:
     runs-on: ubuntu-latest
-    timeout-minutes: 10
-    outputs:
-      review_status: ${{ steps.merge-base-check.outputs.review_status }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0 # full history both sides for merge-base
 
-      - id: merge-base-check
-        name: Reject PRs with no common ancestor on main
+      - name: Reject PRs with no common ancestor on main
         run: |
           # `git merge-base` exits non-zero AND prints nothing when the two
           # commits share no ancestor.  We check both conditions explicitly
           # so the failure message is clear regardless of which signal fires
           # first.
           if ! BASE=$(git merge-base origin/main HEAD 2>/dev/null) || [ -z "$BASE" ]; then
-            STATUS='[{"source":"unrelated histories","results":[{"kind":"action_required","title":"Unrelated histories","summary":"This PR has no common ancestor with main.","detail":"","how_to_fix":"Rebase your changes onto current main:\n```\ngit fetch origin main\ngit checkout -b fix-branch origin/main\n# re-apply your changes (cherry-pick, copy files, etc.)\ngit push -f origin fix-branch\n```\n"}]}]'
-            echo "review_status=${STATUS}" >> "$GITHUB_OUTPUT"
             echo ""
             echo "::error::This PR has no common ancestor with main."
             echo ""
@@ -65,4 +55,3 @@ jobs:
             exit 1
           fi
           echo "::notice::Common ancestor with main: $BASE"
-          echo "review_status=[]" >> "$GITHUB_OUTPUT"

.github/workflows/js-autofix.yml

@@ -7,7 +7,7 @@ name: auto-fix lint issues & formatting
 # auto-corrected on merge so PRs aren't blocked by them. The PR-time eslint
 # check in typecheck.yml fails only when un-fixable errors remain.
 #
-# NOTE: App token pushes DO trigger further workflow runs (unlike
+# NOTE: AUTOFIX_BOT_PAT pushes DO trigger further workflow runs (unlike
 # secrets.GITHUB_TOKEN). The concurrency group (ts-autofix-${{ github.ref }})
 # with cancel-in-progress: true prevents an infinite loop — a re-triggered
 # run cancels the in-flight one, and since the second run finds no new fixes
@@ -122,20 +122,12 @@ jobs:
     if: needs.generate-patch.outputs.has-fixes == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    environment: trusted-automation
     permissions:
       contents: write # needed to push to bot/js-autofix
       pull-requests: write # needed for PR creation + auto-merge
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Get GitHub App token
-        id: app-token
-        uses: ./.github/actions/get-app-token
-        with:
-          client-id: ${{ vars.APP_CLIENT_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
-
       - name: Download patch
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
@@ -178,7 +170,7 @@ jobs:
 
       - name: Create/update PR and enable auto-merge
         env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.AUTOFIX_BOT_PAT }}
           BOT_BRANCH: bot/js-autofix
         run: |
           set -euo pipefail
@@ -201,7 +193,7 @@ jobs:
 
       - name: Wait for merge, auto-close on failure or stale
         env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.AUTOFIX_BOT_PAT }}
           START_SHA: ${{ github.sha }}
         run: |
           set -euo pipefail

.github/workflows/js-tests.yml

@@ -8,9 +8,8 @@ jobs:
   workspaces:
     name: List npm workspaces
     runs-on: ubuntu-latest
-    timeout-minutes: 20
     outputs:
-      checks: ${{ steps.set-matrix.outputs.checks }}
+      packages: ${{ steps.set-matrix.outputs.packages }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
@@ -22,40 +21,20 @@ jobs:
           command: npm ci --ignore-scripts
       - id: set-matrix
         run: |
-          node -e '
-          const { execSync } = require("child_process");
-          const pkgs = JSON.parse(execSync("npm query .workspace", { encoding: "utf-8" }));
-          if (pkgs.length === 0) {
-            console.error("::error::Workspace discovery produced an empty package list — refusing to emit a zero-length matrix (would skip all JS/TS checks silently).");
-            process.exit(1);
-          }
-          const checks = [];
-          for (const pkg of pkgs) {
-            const scripts = pkg.scripts || {};
-            const subs = Object.keys(scripts).filter(s => /^check:.+$/.test(s));
-            if (subs.length > 0) {
-              for (const script of subs) {
-                checks.push({ package: pkg.location, script });
-              }
-            } else if (scripts.check) {
-              checks.push({ package: pkg.location, script: "check" });
-            }
-          }
-          if (checks.length === 0) {
-            console.error("::error::No check scripts found in any workspace package.");
-            process.exit(1);
-          }
-          process.stdout.write("checks=" + JSON.stringify(checks) + "\n");
-          ' >> "$GITHUB_OUTPUT"
+          PACKAGES=$(npm query .workspace | jq -c '[.[].location]')
+          if [ "$PACKAGES" = "[]" ] || [ -z "$PACKAGES" ]; then
+            echo "::error::Workspace discovery produced an empty package list — refusing to emit a zero-length matrix (would skip all JS/TS checks silently)."
+            exit 1
+          fi
+          echo "packages=$PACKAGES" >> "$GITHUB_OUTPUT"
 
   check:
-    name: ${{ matrix.package }} / ${{ matrix.script }}
+    name: Typecheck & Test
     needs: workspaces
     runs-on: ubuntu-latest
-    timeout-minutes: 20
     strategy:
       matrix:
-        include: ${{ fromJson(needs.workspaces.outputs.checks) }}
+        package: ${{ fromJson(needs.workspaces.outputs.packages) }}
       fail-fast: false # report all failures, not just the first one
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -66,4 +45,5 @@ jobs:
       - uses: ./.github/actions/retry
         with:
           command: npm ci
-      - run: npm run --prefix ${{ matrix.package }} ${{ matrix.script }}
+      - run: npm run --prefix ${{ matrix.package }} check
+      - run: npm run --prefix ${{ matrix.package }} fix

.github/workflows/label-rerun.yml

@@ -1,81 +0,0 @@
-name: Label rerun
-
-# When the ``ci-reviewed`` label is added to a PR, rerun all failed jobs in
-# the latest CI run. This re-evaluates ``review-labels`` (which now sees the
-# label) and GitHub automatically reruns dependent jobs (``comment-live``,
-# ``all-checks-pass``) — so the review comment gets updated too.
-#
-# If the CI run is still in progress when the label is added, we wait for it
-# to finish before rerunning (``gh run rerun`` only works on completed runs).
-# The wait can be long (20+ min for a full CI run), but it's better than
-# silently failing and leaving the reviewer stuck.
-
-on:
-  pull_request:
-    types: [labeled]
-
-permissions:
-  actions: write
-  pull-requests: read
-
-concurrency:
-  group: label-rerun-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  rerun-review-labels:
-    name: Rerun review-labels job
-    if: github.event.label.name == 'ci-reviewed'
-    runs-on: ubuntu-latest
-    timeout-minutes: 40
-    steps:
-      - name: Wait for CI run to finish, then rerun failed jobs
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REPO: ${{ github.repository }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          set -uo pipefail
-
-          # Find the latest CI run for this PR's head SHA.
-          RUN_ID=$(gh run list \
-            --repo "$REPO" \
-            --commit "$HEAD_SHA" \
-            --workflow ci.yml \
-            --limit 1 \
-            --json databaseId,status \
-            --jq '.[0] | "\(.databaseId) \(.status)"' 2>/dev/null || true)
-
-          if [ -z "$RUN_ID" ]; then
-            echo "No CI run found for this PR — nothing to rerun."
-            exit 0
-          fi
-
-          # Split "RUN_ID STATUS" into two vars.
-          RUN_ID="${RUN_ID%% *}"
-          STATUS="${RUN_ID##* }"
-
-          echo "Latest CI run: $RUN_ID (status: $STATUS)"
-
-          # If the run is still in progress, wait for it to finish.
-          # gh run rerun only works on completed runs — if we try while it's
-          # running, GitHub rejects with "cannot be rerun; This workflow is
-          # already running".
-          if [ "$STATUS" != "completed" ]; then
-            echo "Run is $STATUS — waiting for completion (this may take a while)..."
-            # gh run watch --exit-status exits non-zero if the run fails,
-            # which is expected (the label gate fails). Don't let that kill
-            # the workflow — we WANT to rerun failed jobs.
-            timeout 2100 gh run watch "$RUN_ID" --repo "$REPO" --interval 15 || true
-
-            # Verify it's actually completed now.
-            STATUS=$(gh run view "$RUN_ID" --repo "$REPO" --json status --jq '.status' 2>/dev/null || echo "unknown")
-            if [ "$STATUS" != "completed" ]; then
-              echo "Run is still $STATUS after wait — giving up."
-              exit 0
-            fi
-          fi
-
-          echo "Run completed. Rerunning all failed jobs..."
-          gh run rerun "$RUN_ID" --repo "$REPO" --failed || true
-          echo "Done. GitHub will rerun review-labels and all dependent jobs."

.github/workflows/lint.yml

@@ -2,14 +2,11 @@ name: Lint (ruff + ty)
 
 # Two things here:
 #   1. Advisory diff — ruff + ty diagnostics as a diff vs the target branch.
-#      Writes a Markdown summary to the run page. Exit zero always.
+#      Posts a Markdown summary and a PR comment. Exit zero always.
 #   2. Blocking ``ruff check .`` — enforces the explicit rules in
 #      ``[tool.ruff.lint.select]`` (currently PLW1514). Failure blocks merge.
-#      Separate job so the advisory diff still runs even when enforcement
-#      fails.
-#
-# CI-sensitive file review was previously here as a ``ci-review`` job but
-# has moved to ``review-labels.yml`` so it can be rerun independently.
+#      Separate job so the advisory diff still runs and posts even when
+#      enforcement fails.
 
 on:
   workflow_call:
@@ -18,9 +15,14 @@ on:
         description: The event name from the calling orchestrator (pull_request or push).
         type: string
         required: true
+      ci_review:
+        description: Whether CI-sensitive files (eslint config, workflows, actions) changed and require a review label.
+        type: boolean
+        default: false
 
 permissions:
   contents: read
+  pull-requests: write # needed to post/update PR comments
 
 concurrency:
   group: lint-${{ github.ref }}
@@ -160,3 +162,111 @@ jobs:
 
       - name: Run footgun checker
         run: python scripts/check-windows-footguns.py --all
+
+  ci-review:
+    # Require explicit maintainer review when CI-sensitive files change:
+    # eslint config, workflow YAMLs, or composite actions. These files
+    # influence what code the js-autofix job executes and pushes to
+    # main, so a malicious PR could inject arbitrary code via a custom eslint
+    # rule's `fix` function. The label gate ensures a human reviews before
+    # merge. Mirrors the mcp-catalog-reviewed pattern in supply-chain-audit.yml.
+    name: CI-sensitive file review
+    if: inputs.event_name == 'pull_request' && inputs.ci_review
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Require ci-reviewed label
+        id: label-check
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          PR="${{ github.event.pull_request.number }}"
+          LABELS=$(gh pr view "$PR" --json labels --jq '.labels[].name' || true)
+          if echo "$LABELS" | grep -Fxq 'ci-reviewed'; then
+            echo "reviewed=true" >> "$GITHUB_OUTPUT"
+            echo "ci-reviewed label present."
+            exit 0
+          fi
+          echo "reviewed=false" >> "$GITHUB_OUTPUT"
+
+      # On failure: find the bot's previous comment and edit it, or create
+      # a new one if none exists. Using an HTML comment marker so we can
+      # locate it reliably across runs without parsing the body text.
+      # Skipped on fork PRs — GITHUB_TOKEN is read-only there, so the API
+      # call would fail. The label gate still holds via the step below.
+      - name: Post or update review warning
+        if: steps.label-check.outputs.reviewed != 'true' && github.event.pull_request.head.repo.fork != true
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          PR="${{ github.event.pull_request.number }}"
+          MARKER="<!-- ci-review-bot -->"
+          BODY="${MARKER}
+          ## ⚠️ CI-sensitive file review required
+
+          This PR changes CI-sensitive files (eslint config, workflow YAMLs,
+          or composite actions). These files influence what code the
+          js-autofix job executes and pushes to main.
+
+          A maintainer should verify:
+          - no new eslint rules with custom \`fix\` functions that write outside linted paths,
+          - no workflow changes that widen permissions or remove guards,
+          - no composite action changes that alter what gets executed.
+
+          After review, add the \`ci-reviewed\` label and re-run this check."
+
+          # Find an existing comment with our marker.
+          COMMENT_ID=$(gh api \
+            "repos/${{ github.repository }}/issues/${PR}/comments" \
+            --paginate --jq ".[] | select(.body | contains(\"${MARKER}\")) | .id" \
+            | head -1 || true)
+
+          if [ -n "$COMMENT_ID" ]; then
+            gh api --method PATCH \
+              "repos/${{ github.repository }}/issues/comments/${COMMENT_ID}" \
+              -f body="$BODY"
+          else
+            gh pr comment "$PR" --body "$BODY"
+          fi
+
+      # Fail the job when the label is missing — always runs (including
+      # fork PRs) so the security gate holds even when the comment step
+      # was skipped above.
+      - name: Fail on missing label
+        if: steps.label-check.outputs.reviewed != 'true'
+        run: |
+          echo "::error::CI-sensitive changes require the ci-reviewed label."
+          exit 1
+
+      # On success: if a previous warning comment exists, edit it to show
+      # the review passed so the PR doesn't have a stale ⚠️ sitting around.
+      # Skipped on fork PRs — no comment was ever posted to update.
+      - name: Update previous warning to passed
+        if: steps.label-check.outputs.reviewed == 'true' && github.event.pull_request.head.repo.fork != true
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          PR="${{ github.event.pull_request.number }}"
+          MARKER="<!-- ci-review-bot -->"
+
+          # Find an existing comment with our marker.
+          COMMENT_ID=$(gh api \
+            "repos/${{ github.repository }}/issues/${PR}/comments" \
+            --paginate --jq ".[] | select(.body | contains(\"${MARKER}\")) | .id" \
+            | head -1 || true)
+
+          if [ -n "$COMMENT_ID" ]; then
+            BODY="${MARKER}
+          ## ✅ CI-sensitive file review passed
+
+          The \`ci-reviewed\` label is present on this PR."
+
+            gh api --method PATCH \
+              "repos/${{ github.repository }}/issues/comments/${COMMENT_ID}" \
+              -f body="$BODY"
+          fi

.github/workflows/lockfile-diff.yml

@@ -7,25 +7,22 @@ name: Lockfile diff
 # the ``packages`` map at the merge base and at HEAD and set-diffs the
 # {install path: version} maps instead.
 #
-# The semantic diff is exposed as a workflow_call output ``review_status``
-# (a JSON array in the unified status format) and an artifact
-# (``lockfile-diff`` containing the markdown fragment) for the step
-# summary.
+# The comment is upserted: the script embeds a hidden HTML marker and the
+# workflow PATCHes the existing comment when one is found, so a PR gets
+# exactly one lockfile-diff comment that tracks the latest push instead
+# of a stack of stale ones. When a later push reverts all lockfile
+# changes, the comment is updated to say so (deleting it would be more
+# surprising than telling the reviewer it's resolved).
 #
-# Never blocking — this is review signal, not enforcement.
+# Never blocking — this is review signal, not enforcement. Exit is 0 even
+# when commenting fails (fork PRs get a read-only GITHUB_TOKEN).
 
 on:
   workflow_call:
-    outputs:
-      changed:
-        description: Whether package-lock.json changed relative to the target branch.
-        value: ${{ jobs.diff.outputs.changed }}
-      review_status:
-        description: JSON array of review status objects for the unified PR comment.
-        value: ${{ jobs.diff.outputs.review_status }}
 
 permissions:
   contents: read
+  pull-requests: write # post/update the diff comment
 
 concurrency:
   group: lockfile-diff-${{ github.event.pull_request.number || github.ref }}
@@ -36,9 +33,6 @@ jobs:
     name: package-lock.json semantic diff
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    outputs:
-      changed: ${{ steps.diff.outputs.changed }}
-      review_status: ${{ steps.emit-status.outputs.review_status }}
     steps:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -60,36 +54,45 @@ jobs:
             --output /tmp/lockfile-diff.md
           if [ -s /tmp/lockfile-diff.md ]; then
             echo "changed=true" >> "$GITHUB_OUTPUT"
-            {
-              echo "## package-lock.json semantic diff"
-              echo ""
-              cat /tmp/lockfile-diff.md
-            } >> "$GITHUB_STEP_SUMMARY"
+            cat /tmp/lockfile-diff.md >> "$GITHUB_STEP_SUMMARY"
           else
             echo "changed=false" >> "$GITHUB_OUTPUT"
-            : > /tmp/lockfile-diff.md
           fi
 
-      - name: Emit review_status
-        id: emit-status
+      - name: Post or update PR comment
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO: ${{ github.repository }}
+          PR: ${{ github.event.pull_request.number }}
+          CHANGED: ${{ steps.diff.outputs.changed }}
         run: |
           set -euo pipefail
-          CHANGED="${{ steps.diff.outputs.changed }}"
-          STATUS="[]"
+          MARKER='<!-- hermes-lockfile-diff -->'
 
-          if [ "$CHANGED" = "true" ]; then
-            CONTENT=$(cat /tmp/lockfile-diff.md | python3 -c "import sys,json; print(json.dumps(sys.stdin.read()))")
-            STATUS="[{\"source\":\"lockfile-diff\",\"results\":[{\"kind\":\"action_required\",\"title\":\"package-lock.json\",\"summary\":\"Locked npm dependency versions changed.\",\"detail\":${CONTENT},\"how_to_fix\":\"Add the \`ci-reviewed\` label after verifying the version changes are expected.\"}]}"
-          else
-            STATUS="[]"
+          # Find our previous comment (paginated — busy PRs exceed one page).
+          EXISTING=$(gh api --paginate "repos/${REPO}/issues/${PR}/comments" \
+            --jq ".[] | select(.body | startswith(\"$MARKER\")) | .id" \
+            | head -1 || true)
+
+          if [ "$CHANGED" != "true" ]; then
+            if [ -n "$EXISTING" ]; then
+              # A previous push changed the lockfile but the latest one
+              # doesn't — update the comment rather than leave stale info.
+              printf '%s\n✅ package-lock.json changes from an earlier push have been reverted — locked versions now match the target branch.\n' "$MARKER" > /tmp/lockfile-diff.md
+            else
+              echo "No lockfile changes and no existing comment — nothing to do."
+              exit 0
+            fi
           fi
 
-          echo "review_status=${STATUS}" >> "$GITHUB_OUTPUT"
-
-      - name: Upload diff artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: lockfile-diff
-          path: /tmp/lockfile-diff.md
-          retention-days: 1
-          overwrite: true
+          if [ -n "$EXISTING" ]; then
+            echo "Updating existing comment ${EXISTING}"
+            gh api --method PATCH "repos/${REPO}/issues/comments/${EXISTING}" \
+              -F body=@/tmp/lockfile-diff.md > /dev/null \
+              || echo "::warning::Could not update PR comment (expected for fork PRs — GITHUB_TOKEN is read-only)"
+          else
+            echo "Creating new comment"
+            gh api "repos/${REPO}/issues/${PR}/comments" \
+              -F body=@/tmp/lockfile-diff.md > /dev/null \
+              || echo "::warning::Could not post PR comment (expected for fork PRs — GITHUB_TOKEN is read-only)"
+          fi

.github/workflows/osv-scanner.yml

@@ -14,14 +14,14 @@ name: OSV-Scanner
 # code patterns in PR diffs) by covering the orthogonal "currently-pinned
 # dep became known-vulnerable" case.
 #
-# Uses Google's officially-recommended reusable workflow, pinned by SHA.
+# Steps below are inlined from Google's officially-recommended reusable
+# workflow (google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml),
+# rather than called via `uses:` so we can set a `timeout-minutes` in the
+# degenerate case where this job hangs.
+
 # Findings land in the repo's Security tab (Code Scanning > OSV-Scanner).
 # fail-on-vuln is disabled so the job does not block merges on pre-existing
 # vulnerabilities in pinned deps that we may need to patch deliberately.
-#
-# The reusable workflow can't emit custom outputs, so a wrapper job
-# downloads the SARIF result and summarizes the vulnerability count into
-# a review_status for the unified PR comment.
 
 on:
   workflow_call:
@@ -40,88 +40,62 @@ permissions:
 jobs:
   scan:
     name: Scan lockfiles
-    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8
-    with:
-      # Scan explicit lockfiles rather than recursing, so we only look at
-      # the three sources of truth and skip vendored / test / worktree dirs.
-      scan-args: |-
-        --lockfile=uv.lock
-        --lockfile=package-lock.json
-        --lockfile=website/package-lock.json
-      # The upstream reusable workflow uploads this exact file under its
-      # fixed artifact name, which the wrapper downloads below.
-      results-file-name: osv-results.sarif
-      fail-on-vuln: false
-
-  emit-status:
-    name: Emit review status
     runs-on: ubuntu-latest
-    needs: scan
-    if: always()
-    outputs:
-      review_status: ${{ steps.emit.outputs.review_status }}
     steps:
-      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Download SARIF result
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          name: OSV Scanner SARIF file
-          path: /tmp/osv-results
+          persist-credentials: false
+
+      - name: 'Run scanner'
+        uses: google/osv-scanner-action/osv-scanner-action@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8
+        with:
+          # Scan explicit lockfiles rather than recursing, so we only look at
+          # the three sources of truth and skip vendored / test / worktree dirs.
+          scan-args: |-
+            --output=results.json
+            --format=json
+            --lockfile=uv.lock
+            --lockfile=package-lock.json
+            --lockfile=website/package-lock.json
         continue-on-error: true
 
-      - name: Emit review_status
-        id: emit
+      - name: 'Run osv-scanner-reporter'
+        uses: google/osv-scanner-action/osv-reporter-action@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8
+        with:
+          scan-args: |-
+            --output=results.sarif
+            --new=results.json
+            --gh-annotations=false
+            --fail-on-vuln=false
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: 'Upload artifact'
+        id: 'upload_artifact'
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: OSV Scanner SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: 'Upload to code-scanning'
+        if: ${{ !cancelled() }}
+        uses: github/codeql-action/upload-sarif@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v4.31.10
+        with:
+          sarif_file: results.sarif
+
+      - name: 'Print Code Scanning URL'
+        if: ${{ !cancelled() }}
         run: |
-          set -euo pipefail
-          STATUS="[]"
+          echo "View the OSV-Scanner results in the 'Security' tab, using the following link:"
+          echo "${{ github.server_url }}/${{ github.repository }}/security/code-scanning?query=is%3Aopen+branch%3A${GITHUB_REF_NAME}+tool%3Aosv-scanner"
+        env:
+          GITHUB_REF_NAME: ${{ github.ref_name }}
 
-          if [ -f /tmp/osv-results/osv-results.sarif ]; then
-            # Count vulnerabilities from the SARIF file
-            VULN_COUNT=$(python3 -c "
-          import json, sys
-          try:
-              with open('/tmp/osv-results/osv-results.sarif') as f:
-                  data = json.load(f)
-              count = 0
-              vulns = []
-              for run in data.get('runs', []):
-                  for result in run.get('results', []):
-                      count += 1
-                      rule_id = result.get('ruleId', 'unknown')
-                      message = result.get('message', {}).get('text', '')
-                      loc = result.get('locations', [{}])[0].get('physicalLocation', {}).get('artifactLocation', {}).get('uri', '')
-                      vulns.append(f'- {rule_id} in {loc}: {message}')
-              print(count)
-              if vulns:
-                  print('\n'.join(vulns[:20]), file=sys.stderr)
-          except Exception:
-              print(0)
-          ")
-
-            VULN_DETAIL=""
-            if [ "$VULN_COUNT" -gt 0 ] 2>/dev/null; then
-              VULN_PLURAL=$([ "$VULN_COUNT" -eq 1 ] && echo "y" || echo "ies")
-              VULN_DETAIL=$(python3 -c "
-          import json, sys
-          try:
-              with open('/tmp/osv-results/osv-results.sarif') as f:
-                  data = json.load(f)
-              vulns = []
-              for run in data.get('runs', []):
-                  for result in run.get('results', []):
-                      rule_id = result.get('ruleId', 'unknown')
-                      loc = result.get('locations', [{}])[0].get('physicalLocation', {}).get('artifactLocation', {}).get('uri', '')
-                      vulns.append(f'- {rule_id} in {loc}')
-              print(json.dumps('\n'.join(vulns[:20])))
-          except Exception:
-              print(json.dumps(''))
-          ")
-              STATUS="[{\"source\":\"osv scan\",\"results\":[{\"kind\":\"warning\",\"title\":\"OSV vulnerability scan\",\"summary\":\"${VULN_COUNT} known vulnerabilit${VULN_PLURAL} found in pinned dependencies.\",\"detail\":${VULN_DETAIL},\"how_to_fix\":\"Review the findings in the [Security tab](../../security/code-scanning). Update the affected dependencies if a patched version is available.\"}]}]"
-            else
-              STATUS="[]"
-            fi
-          fi
-
-          echo "review_status=${STATUS}" >> "$GITHUB_OUTPUT"
+      - name: 'Error troubleshooter'
+        if: ${{ always() && steps.upload_artifact.outcome == 'failure' }}
+        run: |
+          echo "::error::Artifact upload failed. This is most likely caused by a error during scanning earlier in the workflow."
+          exit 1

.github/workflows/publish-e2e-evidence.yml

@@ -1,71 +0,0 @@
-name: Publish E2E evidence
-
-# This runs only from the default branch after CI completes. It intentionally
-# checks out main, never the PR ref, and treats the downloaded artifact as
-# untrusted input before uploading validated GitHub attachments.
-on:
-  workflow_run:
-    workflows: [CI]
-    types: [completed]
-
-permissions:
-  actions: read
-  contents: read
-  pull-requests: write
-
-concurrency:
-  group: publish-e2e-evidence-${{ github.event.workflow_run.id }}
-  cancel-in-progress: false
-
-jobs:
-  publish:
-    name: Publish inline E2E evidence
-    if: github.event.workflow_run.event == 'pull_request'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    environment: gh-image
-    steps:
-      - name: Check out trusted publisher
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ github.event.repository.default_branch }}
-          persist-credentials: false
-
-      # v1.2.0 resolves to 44f4b93ecbbe22de6c45fa2f62f519aee564ca8c.
-      - name: Install gh-image
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: gh extension install drogers0/gh-image --pin v1.2.0
-
-      - name: Download and attach evidence
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GITHUB_TOKEN: ${{ github.token }}
-          GH_SESSION_TOKEN: ${{ secrets.GH_IMAGE_SESSION_TOKEN }}
-          SOURCE_REPO: ${{ github.repository }}
-          SOURCE_RUN_ID: ${{ github.event.workflow_run.id }}
-        run: |
-          set -euo pipefail
-
-          PR_NUMBER=$(gh api "repos/$SOURCE_REPO/actions/runs/$SOURCE_RUN_ID" --jq '.pull_requests[0].number // empty')
-          if [ -z "$PR_NUMBER" ]; then
-            echo "No pull request is associated with CI run $SOURCE_RUN_ID."
-            exit 0
-          fi
-
-          ARTIFACT_NAME=$(gh api "repos/$SOURCE_REPO/actions/runs/$SOURCE_RUN_ID/artifacts" \
-            --jq '.artifacts[] | select(.expired == false and (.name | startswith("e2e-evidence-"))) | .name' \
-            | python3 -c 'import sys; print(next(iter(sys.stdin), "").strip())')
-          if [ -z "$ARTIFACT_NAME" ]; then
-            echo "No E2E evidence artifact was produced for CI run $SOURCE_RUN_ID."
-            exit 0
-          fi
-
-          EVIDENCE_DIR="$RUNNER_TEMP/e2e-evidence"
-          mkdir -p "$EVIDENCE_DIR"
-          gh run download "$SOURCE_RUN_ID" --repo "$SOURCE_REPO" --name "$ARTIFACT_NAME" --dir "$EVIDENCE_DIR"
-
-          python3 scripts/ci/publish_e2e_evidence.py \
-            --evidence-dir "$EVIDENCE_DIR" \
-            --source-repo "$SOURCE_REPO" \
-            --pr-number "$PR_NUMBER"

.github/workflows/review-labels.yml

@@ -1,109 +0,0 @@
-name: Review labels
-
-# Require explicit maintainer review when CI-sensitive files or the MCP
-# catalog change. Previously this was split across two jobs in two
-# workflows: ``ci-review`` in lint.yml (gated on ``ci_review``) and
-# ``mcp-catalog-review`` in supply-chain-audit.yml (gated on
-# ``mcp_catalog``). Both checked for their own label.
-#
-# Now consolidated: a single ``ci-reviewed`` label covers both. The
-# comment sections tell the reviewer exactly what to verify per area,
-# so one label is enough — the human reads the comment, not the label
-# name.
-#
-# Outputs:
-#   ci_reviewed    — "true" / "false" / "" (empty when neither lane ran)
-#   review_status  — JSON array of status objects consumed by the review
-#                    comment assembler. See scripts/ci/emit_review_status.py.
-
-on:
-  workflow_call:
-    inputs:
-      ci_review:
-        description: Whether CI-sensitive files (eslint config, workflows, actions) changed.
-        type: boolean
-        default: false
-      ci_review_files:
-        description: JSON list of CI-sensitive files changed by the pull request.
-        type: string
-        default: '[]'
-      mcp_catalog:
-        description: Whether the MCP catalog / installer changed.
-        type: boolean
-        default: false
-      supply_chain:
-        description: Whether the critical supply-chain scan found a risk requiring review.
-        type: boolean
-        default: false
-    outputs:
-      ci_reviewed:
-        description: Whether the ci-reviewed label is present. Empty when neither input was true.
-        value: ${{ jobs.check.outputs.ci_reviewed }}
-      review_status:
-        description: JSON array of status objects for the review comment assembler.
-        value: ${{ jobs.check.outputs.review_status }}
-
-permissions:
-  contents: read
-  pull-requests: read # read PR labels
-
-jobs:
-  check:
-    name: Review label gate
-    if: inputs.ci_review || inputs.mcp_catalog || inputs.supply_chain
-    runs-on: ubuntu-latest
-    timeout-minutes: 2
-    outputs:
-      ci_reviewed: ${{ steps.label-check.outputs.ci_reviewed }}
-      review_status: ${{ steps.build-status.outputs.review_status }}
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Check ci-reviewed label
-        id: label-check
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REPO: ${{ github.repository }}
-        run: |
-          set -euo pipefail
-          PR="${{ github.event.pull_request.number }}"
-          LABELS=$(gh pr view "$PR" --repo "$REPO" --json labels --jq '.labels[].name' || true)
-
-          if echo "$LABELS" | grep -Fxq 'ci-reviewed'; then
-            echo "ci-reviewed label present."
-            echo "ci_reviewed=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "ci-reviewed label missing."
-            echo "ci_reviewed=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Build review_status JSON
-        id: build-status
-        env:
-          CI_REVIEW: ${{ inputs.ci_review }}
-          CI_REVIEW_FILES: ${{ inputs.ci_review_files }}
-          MCP_CATALOG: ${{ inputs.mcp_catalog }}
-          SUPPLY_CHAIN: ${{ inputs.supply_chain }}
-          LABEL_PRESENT: ${{ steps.label-check.outputs.ci_reviewed }}
-          REPO_URL: ${{ github.server_url }}/${{ github.repository }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          set -euo pipefail
-          args=()
-          if [ "$CI_REVIEW" = "true" ]; then args+=(--ci-review); fi
-          args+=(--ci-review-files "$CI_REVIEW_FILES")
-          if [ "$MCP_CATALOG" = "true" ]; then args+=(--mcp-catalog); fi
-          if [ "$SUPPLY_CHAIN" = "true" ]; then args+=(--supply-chain); fi
-          if [ "$LABEL_PRESENT" = "true" ]; then args+=(--label-present); fi
-
-          python3 scripts/ci/emit_review_status.py "${args[@]}" \
-            --repo-url "$REPO_URL" --base-sha "$BASE_SHA" --head-sha "$HEAD_SHA" \
-            --output "$GITHUB_OUTPUT"
-
-      - name: Fail on missing label
-        if: steps.label-check.outputs.ci_reviewed != 'true'
-        run: |
-          echo "::error::CI-sensitive changes require the ci-reviewed label. Add the label and re-run this check."
-          exit 1

.github/workflows/skills-index-freshness.yml

@@ -20,8 +20,6 @@ jobs:
   check-freshness:
     if: github.repository == 'NousResearch/hermes-agent'
     runs-on: ubuntu-latest
-    timeout-minutes: 10
-    environment: trusted-automation
     steps:
       - name: Probe live index
         id: probe
@@ -30,7 +28,7 @@ jobs:
           URL="https://hermes-agent.nousresearch.com/docs/api/skills-index.json"
           echo "Probing $URL"
           # -L follows redirects; -f fails on HTTP errors; -s suppresses progress
-          if ! curl -fsSL --retry 3 --retry-delay 10 -o /tmp/skills-index.json "$URL"; then
+          if ! curl -fsSL -o /tmp/skills-index.json "$URL"; then
             echo "status=fetch-failed" >> "$GITHUB_OUTPUT"
             echo "detail=Could not download $URL" >> "$GITHUB_OUTPUT"
             exit 0
@@ -109,18 +107,10 @@ jobs:
             echo "Summary:      ${{ steps.probe.outputs.summary }}"
           fi
 
-      - name: Get GitHub App token
-        if: steps.probe.outputs.status != 'ok'
-        id: app-token
-        uses: ./.github/actions/get-app-token
-        with:
-          client-id: ${{ vars.APP_CLIENT_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
-
       - name: Open issue on degraded / failed probe
         if: steps.probe.outputs.status != 'ok'
         env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           STATUS: ${{ steps.probe.outputs.status }}
           DETAIL: ${{ steps.probe.outputs.detail }}
         run: |

.github/workflows/skills-index.yml

@@ -20,30 +20,19 @@ jobs:
     # Only run on the upstream repository, not on forks
     if: github.repository == 'NousResearch/hermes-agent'
     runs-on: ubuntu-latest
-    timeout-minutes: 15
-    environment: trusted-automation
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Get GitHub App token
-        id: app-token
-        uses: ./.github/actions/get-app-token
-        with:
-          client-id: ${{ vars.APP_CLIENT_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
-
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.11"
 
       - name: Install dependencies
-        uses: ./.github/actions/retry
-        with:
-          command: pip install httpx==0.28.1 pyyaml==6.0.2
+        run: pip install httpx==0.28.1 pyyaml==6.0.2
 
       - name: Build skills index
         env:
-          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: python scripts/build_skills_index.py
 
       - name: Upload index artifact
@@ -60,16 +49,8 @@ jobs:
     needs: build-index
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
-    timeout-minutes: 15
-    environment: trusted-automation
     steps:
-      - name: Get GitHub App token
-        id: app-token
-        uses: ./.github/actions/get-app-token
-        with:
-          client-id: ${{ vars.APP_CLIENT_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
       - name: Trigger Deploy Site workflow
         env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: gh workflow run deploy-site.yml --repo ${{ github.repository }} -f skills_index_run_id=${{ github.run_id }}

.github/workflows/supply-chain-audit.yml

@@ -10,18 +10,9 @@ name: Supply Chain Audit
 # advisory-only workflow instead.
 #
 # Path-gating is handled centrally by the ``ci.yml`` orchestrator's
-# ``detect`` job. The orchestrator passes ``scan`` / ``deps`` booleans as
-# inputs; this workflow's jobs gate on those inputs instead of re-computing
-# the diff. MCP catalog review was previously here but has moved to
-# ``review-labels.yml`` so it can be rerun independently.
-#
-# Outputs:
-#   review_status      — JSON array of status objects consumed by the review
-#                         comment assembler (scripts/ci/assemble_review_comment.py).
-#   critical_findings  — "true" when the narrow critical-pattern scan found
-#                         something. The review-label gate consumes this and
-#                         owns the action-required result, so adding
-#                         ``ci-reviewed`` can heal the run on rerun.
+# ``detect`` job. The orchestrator passes ``scan`` / ``deps`` /
+# ``mcp_catalog`` booleans as inputs; this workflow's jobs gate on those
+# inputs instead of re-computing the diff.
 
 on:
   workflow_call:
@@ -38,13 +29,10 @@ on:
         description: Whether pyproject.toml changed.
         type: boolean
         required: true
-    outputs:
-      review_status:
-        description: JSON array of review status objects for the review comment assembler.
-        value: ${{ jobs.aggregate.outputs.review_status }}
-      critical_findings:
-        description: Whether the critical-pattern scan found a risk requiring maintainer review.
-        value: ${{ jobs.aggregate.outputs.critical_findings }}
+      mcp_catalog:
+        description: Whether the MCP catalog / installer changed.
+        type: boolean
+        required: true
 
 permissions:
   pull-requests: write
@@ -55,10 +43,6 @@ jobs:
     name: Scan PR for critical supply chain risks
     if: inputs.scan
     runs-on: ubuntu-latest
-    timeout-minutes: 15
-    outputs:
-      review_status: ${{ steps.emit-status.outputs.review_status }}
-      critical_findings: ${{ steps.scan.outputs.found }}
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -68,8 +52,7 @@ jobs:
       - name: Scan diff for critical patterns
         id: scan
         env:
-          GH_TOKEN: ${{ github.token }}
-          CI_REVIEWED: ${{ contains(github.event.pull_request.labels.*.name, 'ci-reviewed') }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
 
@@ -77,7 +60,7 @@ jobs:
           HEAD="${{ github.event.pull_request.head.sha }}"
 
           # Added lines only, excluding lockfiles.
-          # Three-point diff (base...head) diffs from the merge base to HEAD,
+          # Three-dot diff (base...head) diffs from the merge base to HEAD,
           # so only changes introduced by this PR are included — not changes
           # that landed on main after the PR branched off.
           DIFF=$(git diff "$BASE"..."$HEAD" -- . ':!uv.lock' ':!*.lock' ':!package-lock.json' ':!yarn.lock' || true)
@@ -87,7 +70,7 @@ jobs:
           # --- .pth files (auto-execute on Python startup) ---
           # The exact mechanism used in the litellm supply chain attack:
           # https://github.com/BerriAI/litellm/issues/24512
-          PTH_FILES=$(git diff --diff-filter=d --name-only "$BASE"..."$HEAD" | grep '\.pth$' || true)
+          PTH_FILES=$(git diff --name-only "$BASE"..."$HEAD" | grep '\.pth$' || true)
           if [ -n "$PTH_FILES" ]; then
             FINDINGS="${FINDINGS}
           ### 🚨 CRITICAL: .pth file added or modified
@@ -135,11 +118,8 @@ jobs:
           # auto-loaded by the interpreter via site.py. Any nested file with the
           # same name (e.g. hermes_cli/setup.py — the CLI setup wizard) is unrelated
           # and produced false positives that trained reviewers to ignore the scanner.
-          SETUP_HITS=$(git diff --diff-filter=d --name-only "$BASE"..."$HEAD" | grep -E '^(setup\.py|setup\.cfg|sitecustomize\.py|usercustomize\.py|__init__\.pth)$' || true)
-          # A maintainer-applied ci-reviewed label records the manual review
-          # required for intentional changes to an install hook. The scanner
-          # still blocks every unreviewed addition or modification.
-          if [ -n "$SETUP_HITS" ] && [ "$CI_REVIEWED" != "true" ]; then
+          SETUP_HITS=$(git diff --name-only "$BASE"..."$HEAD" | grep -E '^(setup\.py|setup\.cfg|sitecustomize\.py|usercustomize\.py|__init__\.pth)$' || true)
+          if [ -n "$SETUP_HITS" ]; then
             FINDINGS="${FINDINGS}
           ### 🚨 CRITICAL: Install-hook file added or modified
           These files can execute code during package installation or interpreter startup.
@@ -158,32 +138,32 @@ jobs:
             echo "found=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Emit review_status
-        id: emit-status
-        if: always()
+      - name: Post critical finding comment
+        if: steps.scan.outputs.found == 'true'
         env:
-          FOUND: ${{ steps.scan.outputs.found }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          python3 - <<'PYEOF'
-          import json, os
+          BODY="## 🚨 CRITICAL Supply Chain Risk Detected
 
-          # The review-label gate renders and blocks critical findings. Keep
-          # this scan a fact-finder so adding ci-reviewed can rerun the gate
-          # without requiring the scanner itself to fail again.
-          status = []
+          This PR contains a pattern that has been used in real supply chain attacks. A maintainer must review the flagged code carefully before merging.
 
-          with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as f:
-              f.write(f"review_status={json.dumps(status)}\n")
-          PYEOF
+          $(cat /tmp/findings.md)
 
+          ---
+          *Scanner only fires on high-signal indicators: .pth files, base64+exec/eval combos, subprocess with encoded commands, or install-hook files. Low-signal warnings were removed intentionally — if you're seeing this comment, the finding is worth inspecting.*"
+
+          gh pr comment "${{ github.event.pull_request.number }}" --body "$BODY" || echo "::warning::Could not post PR comment (expected for fork PRs — GITHUB_TOKEN is read-only)"
+
+      - name: Fail on critical findings
+        if: steps.scan.outputs.found == 'true'
+        run: |
+          echo "::error::CRITICAL supply chain risk patterns detected in this PR. See the PR comment for details."
+          exit 1
 
   dep-bounds:
     name: Check PyPI dependency upper bounds
     if: inputs.deps
     runs-on: ubuntu-latest
-    timeout-minutes: 15
-    outputs:
-      review_status: ${{ steps.emit-status.outputs.review_status }}
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -206,7 +186,7 @@ jobs:
             exit 0
           fi
 
-          # Match PyPI dep specs that have >= and no < ceiling.
+          # Match PyPI dep specs that have >= but no < ceiling.
           # Pattern: "package>=version" without a following ",<" bound.
           # Excludes git+ URLs (which use commit SHAs) and comments.
           UNBOUNDED=$(echo "$ADDED" | grep -oE '"[a-zA-Z0-9_-]+(\[[^\]]*\])?>=[ 0-9.]+"' | grep -v ',<' || true)
@@ -218,36 +198,26 @@ jobs:
             echo "found=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Emit review_status
-        id: emit-status
-        if: always()
+      - name: Post unbounded dep warning
+        if: steps.bounds.outputs.found == 'true'
         env:
-          FOUND: ${{ steps.bounds.outputs.found }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          python3 - <<'PYEOF'
-          import json, os
+          BODY="## ⚠️ Unbounded PyPI Dependency Detected
 
-          found = os.environ.get("FOUND", "") == "true"
+          This PR adds PyPI dependencies without a \`<next_major\` upper bound. Per our [supply chain policy](../blob/main/CONTRIBUTING.md#dependency-pinning-policy-supply-chain-hardening), all PyPI deps must be pinned as \`>=floor,<next_major\`.
 
-          if found:
-              with open("/tmp/unbounded.txt", encoding="utf-8") as f:
-                  detail = f.read()
-              status = [{
-                  "source": "supply chain",
-                  "results": [{
-                      "kind": "action_required",
-                      "title": "Unbounded PyPI dependencies",
-                      "summary": "This PR adds PyPI dependencies without upper bounds.",
-                      "detail": detail,
-                      "how_to_fix": 'Add a `<next_major` upper bound, e.g. `"package>=1.2.0,<2"`. See CONTRIBUTING.md dependency pinning policy.'
-                  }]
-              }]
-          else:
-              status = []
+          **Unbounded specs found:**
+          \`\`\`
+          $(cat /tmp/unbounded.txt)
+          \`\`\`
 
-          with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as f:
-              f.write(f"review_status={json.dumps(status)}\n")
-          PYEOF
+          **Fix:** Add an upper bound, e.g. \`"package>=1.2.0,<2"\`
+
+          ---
+          *See PR #2810 and CONTRIBUTING.md for the full policy rationale.*"
+
+          gh pr comment "${{ github.event.pull_request.number }}" --body "$BODY" || echo "::warning::Could not post PR comment (expected for fork PRs)"
 
       - name: Fail on unbounded deps
         if: steps.bounds.outputs.found == 'true'
@@ -255,39 +225,40 @@ jobs:
           echo "::error::PyPI dependencies without upper bounds detected. Add <next_major ceiling per CONTRIBUTING.md policy."
           exit 1
 
-  aggregate:
-    name: Aggregate review statuses
-    needs: [scan, dep-bounds]
-    if: always()
+  mcp-catalog-review:
+    name: MCP catalog security review
+    if: inputs.mcp_catalog
     runs-on: ubuntu-latest
-    timeout-minutes: 15
-    outputs:
-      review_status: ${{ steps.merge.outputs.review_status }}
-      critical_findings: ${{ steps.merge.outputs.critical_findings }}
     steps:
-      - name: Merge review statuses
-        id: merge
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - name: Require explicit MCP catalog review label
         env:
-          SCAN_STATUS: ${{ needs.scan.outputs.review_status }}
-          DEP_STATUS: ${{ needs.dep-bounds.outputs.review_status }}
-          CRITICAL_FINDINGS: ${{ needs.scan.outputs.critical_findings }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          python3 - <<'PYEOF'
-          import json, os
+          set -euo pipefail
+          PR="${{ github.event.pull_request.number }}"
+          LABELS=$(gh pr view "$PR" --json labels --jq '.labels[].name' || true)
+          if echo "$LABELS" | grep -Fxq 'mcp-catalog-reviewed'; then
+            echo "MCP catalog review label present."
+            exit 0
+          fi
 
-          merged = []
-          for key in ("SCAN_STATUS", "DEP_STATUS"):
-              raw = os.environ.get(key, "")
-              if not raw:
-                  continue
-              try:
-                  data = json.loads(raw)
-              except (json.JSONDecodeError, TypeError):
-                  continue
-              if isinstance(data, list):
-                  merged.extend(data)
+          BODY="## ⚠️ MCP catalog security review required
 
-          with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as f:
-              f.write(f"review_status={json.dumps(merged)}\n")
-              f.write("critical_findings=" + os.environ.get("CRITICAL_FINDINGS", "false") + "\n")
-          PYEOF
+          This PR changes the bundled MCP catalog or MCP catalog installer code. MCP entries can define local commands that users later install into \`mcp_servers\`, so this needs explicit maintainer review before merge.
+
+          A maintainer should verify:
+          - any new/changed \`optional-mcps/**/manifest.yaml\` command and args are expected,
+          - stdio transports do not use shell+egress/exfiltration payloads,
+          - git install refs are pinned and bootstrap commands are minimal,
+          - requested env vars/secrets match the upstream MCP's documented needs.
+
+          After review, add the \`mcp-catalog-reviewed\` label and re-run this check."
+
+          gh pr comment "$PR" --body "$BODY" || echo "::warning::Could not post PR comment (expected for fork PRs)"
+          echo "::error::MCP catalog changes require the mcp-catalog-reviewed label."
+          exit 1

.github/workflows/tests.yml

@@ -20,7 +20,6 @@ jobs:
   generate:
     name: "Generate slices"
     runs-on: ubuntu-latest
-    timeout-minutes: 10
     outputs:
       matrix: ${{ steps.matrix.outputs.matrix }}
     steps:
@@ -32,12 +31,6 @@ jobs:
         with:
           path: test_durations.json
           key: test-durations
-          # Saves use test-durations-${run_id}, so the exact key above never
-          # matches — without this prefix fallback the cache ALWAYS missed,
-          # LPT slicing ran on no data, and unbalanced slices pushed heavy
-          # files toward the per-file timeout under load.
-          restore-keys: |
-            test-durations-
 
       - name: Generate test slices
         id: matrix
@@ -121,9 +114,6 @@ jobs:
           NOUS_API_KEY: ""
 
       - name: Upload per-slice durations
-        # Advisory artifact (feeds slice balancing) — a transient artifact-
-        # service blip must not fail an otherwise-green test slice.
-        continue-on-error: true
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: test-durations-slice-${{ matrix.slice.index }}
@@ -136,7 +126,6 @@ jobs:
     needs: test
     if: needs.test.result == 'success' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
-    timeout-minutes: 10
     steps:
       - name: Download all slice durations
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -215,6 +204,11 @@ jobs:
         # re-download, keeping the persisted cache small and fast to restore.
         run: uv cache prune --ci
 
+      - name: Packaged-wheel i18n smoke test
+        run: |
+          source .venv/bin/activate
+          python -m pytest -m integration tests/test_wheel_locales_e2e.py -v
+
       - name: Run e2e tests
         run: |
           source .venv/bin/activate

.github/workflows/upload_to_pypi.yml

@@ -0,0 +1,164 @@
+name: Publish to PyPI
+
+# Triggered by CalVer tag pushes from scripts/release.py (e.g. v2026.5.15)
+# Can also be triggered manually from the Actions tab as an escape hatch.
+on:
+  push:
+    tags:
+      - "v20*" # CalVer tags: v2026.5.15, v2026.5.15.2, etc.
+  workflow_dispatch:
+    inputs:
+      confirm_tag:
+        description: "Tag to publish (e.g. v2026.5.15). Must already exist."
+        required: true
+        type: string
+
+# Restrict default token to read-only; each job escalates as needed.
+permissions:
+  contents: read
+
+# Prevent overlapping publishes (e.g. two same-day tags pushed quickly).
+concurrency:
+  group: pypi-publish
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Build distribution 📦
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          # On workflow_dispatch, check out the confirmed tag.
+          ref: ${{ inputs.confirm_tag || github.ref }}
+          fetch-tags: true
+
+      - name: Validate tag exists
+        if: github.event_name == 'workflow_dispatch'
+        run: |
+          if ! git tag -l "${{ inputs.confirm_tag }}" | grep -q .; then
+            echo "::error::Tag '${{ inputs.confirm_tag }}' does not exist in the repo"
+            exit 1
+          fi
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.13"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # 8.2.0
+
+      - name: Set up Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: "22"
+
+      - name: Build web dashboard
+        run: cd web && npm ci && npm run build
+
+      - name: Build TUI bundle
+        run: cd ui-tui && npm ci && npm run build
+
+      - name: Bundle TUI into hermes_cli
+        run: |
+          mkdir -p hermes_cli/tui_dist
+          cp ui-tui/dist/entry.js hermes_cli/tui_dist/entry.js
+
+      - name: Verify frontend assets exist
+        run: |
+          test -f hermes_cli/web_dist/index.html || { echo "ERROR: web_dist not built"; exit 1; }
+          test -f hermes_cli/tui_dist/entry.js || { echo "ERROR: tui_dist not built"; exit 1; }
+
+      - name: Bundle install scripts into wheel
+        run: |
+          mkdir -p hermes_cli/scripts
+          cp scripts/install.sh hermes_cli/scripts/install.sh
+          cp scripts/install.ps1 hermes_cli/scripts/install.ps1
+
+      - name: Build wheel and sdist
+        run: uv build --sdist --wheel
+
+      - name: Upload distribution artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: python-package-distributions
+          path: dist/
+
+  publish:
+    name: Publish to PyPI
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/hermes-agent
+    permissions:
+      id-token: write # OIDC trusted publishing
+
+    steps:
+      - name: Download distribution artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: python-package-distributions
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        with:
+          skip-existing: true
+
+  sign:
+    name: Sign and attach to GitHub Release
+    # Only runs on tag pushes — release.py creates the GitHub Release,
+    # and workflow_dispatch won't have a matching release to attach to.
+    if: startsWith(github.ref, 'refs/tags/')
+    needs: publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # attach assets to the existing release
+      id-token: write # sigstore signing
+
+    steps:
+      - name: Download distribution artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: python-package-distributions
+          path: dist/
+
+      - name: Wait for GitHub Release to exist
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        # release.py creates the GitHub Release after pushing the tag,
+        # but this workflow starts from the tag push — wait for it.
+        run: |
+          for i in $(seq 1 30); do
+            if gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+              echo "Release $GITHUB_REF_NAME found"
+              exit 0
+            fi
+            echo "Waiting for release... ($i/30)"
+            sleep 10
+          done
+          echo "::warning::Release $GITHUB_REF_NAME not found after 5 minutes — skipping signature upload"
+          echo "skip_sign=true" >> "$GITHUB_ENV"
+
+      - name: Sign with Sigstore
+        if: env.skip_sign != 'true'
+        uses: sigstore/gh-action-sigstore-python@04cffa1d795717b140764e8b640de88853c92acc # v3.3.0
+        with:
+          inputs: >-
+            ./dist/*.tar.gz
+            ./dist/*.whl
+
+      - name: Attach signed artifacts to GitHub Release
+        if: env.skip_sign != 'true'
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        # release.py already created the GitHub Release — just upload
+        # the Sigstore signatures alongside the existing assets.
+        run: >-
+          gh release upload
+          "$GITHUB_REF_NAME" dist/*.sigstore.json
+          --repo "$GITHUB_REPOSITORY"
+          --clobber

.github/workflows/uv-lockfile-check.yml

@@ -45,10 +45,6 @@ name: uv.lock check
 
 on:
   workflow_call:
-    outputs:
-      review_status:
-        description: "JSON review status for the review-status aggregator"
-        value: ${{ jobs.check.outputs.review_status }}
 
 permissions:
   contents: read
@@ -62,8 +58,6 @@ jobs:
     name: uv lock --check
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    outputs:
-      review_status: ${{ steps.verify.outputs.review_status }}
     steps:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -79,22 +73,8 @@ jobs:
       # of this file) — failures often mean "your branch is behind main,
       # rebase and regenerate uv.lock."
       - name: Verify uv.lock is up-to-date
-        id: verify
         run: |
-          # uv lock --check re-resolves against PyPI (network). Retry so a
-          # registry blip doesn't read as "lockfile stale". A genuinely stale
-          # lockfile fails all attempts (deterministic), costing only seconds.
-          ok=false
-          for i in 1 2 3; do
-            if uv lock --check; then
-              ok=true
-              break
-            fi
-            [ "$i" = 3 ] && break
-            echo "::warning::uv lock --check failed (attempt $i); retrying in 10s"
-            sleep 10
-          done
-          if [ "$ok" != true ]; then
+          if ! uv lock --check; then
             cat <<'EOF' >> "$GITHUB_STEP_SUMMARY"
           ## ❌ uv.lock is out of sync with pyproject.toml
 
@@ -124,9 +104,5 @@ jobs:
           on `main` post-merge.
           EOF
             echo "::error title=uv.lock out of sync::Run \`uv lock\` locally and commit the result. If on a PR, sync with main first."
-            review_status='[{"source":"uv.lock check","results":[{"kind":"action_required","title":"uv.lock out of sync","summary":"uv.lock is out of sync with pyproject.toml.","how_to_fix":"Run `uv lock` locally and commit the result. If on a PR, sync with main first:\n```\ngit fetch origin main\ngit rebase origin/main\nuv lock\ngit add uv.lock\ngit commit -m \"chore: refresh uv.lock\"\n```\n"}]}]'
-            echo "review_status=${review_status}" >> "$GITHUB_OUTPUT"
             exit 1
           fi
-          review_status='[]'
-          echo "review_status=${review_status}" >> "$GITHUB_OUTPUT"

.gitignore

@@ -1,13 +1,9 @@
 .DS_Store
 /venv/
 /venv.old/
-/venv.stale.runtime-*/
-/.hermes-runtime/
 /_pycache/
 *.pyc*
 __pycache__/
-act/
-.act-sandbox-agent.*
 .venv/
 .venv
 .vscode/
@@ -46,10 +42,7 @@ run_datagen_sonnet.sh
 source-data/*
 run_datagen_megascience_glm4-6.sh
 data/*
-# No trailing slash: also matches node_modules SYMLINKS (worktrees often
-# symlink node_modules to the main checkout; the dir-only pattern let one
-# slip into a commit and break `npm ci` on CI with ENOTDIR).
-node_modules
+node_modules/
 browser-use/
 agent-browser/
 # Private keys
@@ -61,10 +54,6 @@ __pycache__/
 hermes_agent.egg-info/
 wandb/
 testlogs
-playwright-report/
-test-results/
-# Playwright visual regression baselines — cached from main in CI, not committed
-*-snapshots/
 
 # CLI config (may contain sensitive SSH paths)
 cli-config.yaml
@@ -77,8 +66,6 @@ environments/benchmarks/evals/
 
 # Web UI build output
 hermes_cli/web_dist/
-# Cross-process web UI build lock (flock target, always empty)
-.web_ui_build.lock
 apps/desktop/build/
 apps/desktop/dist/
 
@@ -152,11 +139,6 @@ docs/superpowers/*
 .update-incomplete
 .update-incomplete.lock
 
-# Installer-written method stamp in the managed checkout root (scripts/install.sh).
-# Runtime metadata only — never a code change. Ignore so `git status` stays clean
-# and `hermes update`'s untracked autostash does not treat it as a local edit (#66189 / #54855).
-/.install_method
-
 # Tool Search live-test harness output — non-deterministic model transcripts,
 # regenerated by scripts/tool_search_livetest.py. Never an artifact of the repo.
 scripts/out/
@@ -176,4 +158,3 @@ apps/desktop/demo/
 # PR body is the archive. See the hermes-agent-dev skill's
 # pr-infographic-workflow reference (storage rule + lapse #8 / #COMMIT-1).
 infographic/
-native/fts5_cjk/*.so

AGENTS.md

@@ -998,8 +998,7 @@ Two shapes:
 Roles:
 
 - `role="leaf"` (default) — focused worker. Cannot call `delegate_task`,
-  `clarify`, `memory`, `send_message`, `cronjob`. Retains `execute_code`
-  (programmatic tool calling).
+  `clarify`, `memory`, `send_message`, `execute_code`.
 - `role="orchestrator"` — retains `delegate_task` so it can spawn its
   own workers. Gated by `delegation.orchestrator_enabled` (default true)
   and bounded by `delegation.max_spawn_depth` (default 2).
@@ -1295,14 +1294,6 @@ scripts/run_tests.sh tests/agent/test_foo.py::test_x  # one test
 scripts/run_tests.sh -v --tb=long                     # pass-through pytest flags
 ```
 
-**Flake policy:** the runner auto-retries a failing test FILE once in a fresh
-subprocess (`--file-retries`, default 1; `HERMES_TEST_FILE_RETRIES=0` to
-disable). Pass-on-retry counts as green but is printed in a `⚠ FLAKY` summary
-section with both attempts' output. A FLAKY report is a bug to fix, not noise
-to ignore — timing-sensitive tests must not assume a quiet runner (loose
-wall-clock bounds ≥ 2s, event-based sync, no `assert not _wait_until(...)`
-negative-timing races).
-
 #### Subprocess-per-test-file isolation
 
 Every test file runs in a freshly-spawned Python subprocess via `run_tests_parallel.py`. This means module-level dicts/sets and

Dockerfile

@@ -26,8 +26,8 @@ ENV PLAYWRIGHT_BROWSERS_PATH=/opt/hermes/.playwright
 # replaces tini with s6-overlay's /init (PID 1 = s6-svscan), which reaps
 # zombies non-blockingly on SIGCHLD and additionally supervises the main
 # hermes process, the dashboard, and per-profile gateways.
-RUN apt-get -o Acquire::Retries=3 update && \
-    apt-get -o Acquire::Retries=3 install -y --no-install-recommends \
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
     ca-certificates curl iputils-ping python3 python-is-python3 ripgrep ffmpeg gcc g++ make cmake python3-dev python3-venv libffi-dev libolm-dev procps git openssh-client docker-cli xz-utils && \
     rm -rf /var/lib/apt/lists/*
 
@@ -40,30 +40,33 @@ RUN apt-get -o Acquire::Retries=3 update && \
 # we map between them inline. The noarch + symlinks tarballs are
 # architecture-independent and reused as-is.
 #
-# We use `curl` instead of `ADD` for ALL three tarballs: `ADD` evaluates its
-# URL at parse time (no ARG / TARGETARCH substitution) and — critically for
-# CI reliability — cannot retry, so a single GitHub-release CDN blip fails
-# the whole 15-45 min build. curl -fsSL --retry 3 self-heals those blips,
-# and every tarball is still checksum-verified below before extraction.
+# We use `curl` instead of `ADD` for the per-arch tarball because `ADD`
+# evaluates its URL at parse time, before any ARG / TARGETARCH substitution
+# — splitting one URL per arch into two ADDs would download both on every
+# build and leave dead bytes in the cache. A single curl + arch-keyed URL
+# is simpler and cache-friendlier.
+#
+# Supply-chain integrity: every tarball is checksum-verified against the
+# upstream-published SHA256. To bump S6_OVERLAY_VERSION, fetch the four
+# `.sha256` files from the corresponding release and update the ARGs. The
+# checksum lookup happens during build, so a compromised release artifact
+# fails the build loudly instead of silently producing a tampered image.
 ARG TARGETARCH
 ARG S6_OVERLAY_VERSION=3.2.3.0
 ARG S6_OVERLAY_NOARCH_SHA256=b720f9d9340efc8bb07528b9743813c836e4b02f8693d90241f047998b4c53cf
 ARG S6_OVERLAY_X86_64_SHA256=a93f02882c6ed46b21e7adb5c0add86154f01236c93cd82c7d682722e8840563
 ARG S6_OVERLAY_AARCH64_SHA256=0952056ff913482163cc30e35b2e944b507ba1025d78f5becbb89367bf344581
 ARG S6_OVERLAY_SYMLINKS_SHA256=a60dc5235de3ecbcf874b9c1f18d73263ab99b289b9329aa950e8729c4789f0e
+ADD https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-noarch.tar.xz /tmp/
+ADD https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-symlinks-noarch.tar.xz /tmp/
 RUN set -eu; \
     case "${TARGETARCH:-amd64}" in \
         amd64) s6_arch="x86_64"; s6_arch_sha="${S6_OVERLAY_X86_64_SHA256}" ;; \
         arm64) s6_arch="aarch64"; s6_arch_sha="${S6_OVERLAY_AARCH64_SHA256}" ;; \
         *) echo "Unsupported TARGETARCH=${TARGETARCH} for s6-overlay" >&2; exit 1 ;; \
     esac; \
-    base="https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}"; \
-    curl -fsSL --retry 3 -o /tmp/s6-overlay-noarch.tar.xz \
-        "${base}/s6-overlay-noarch.tar.xz"; \
-    curl -fsSL --retry 3 -o /tmp/s6-overlay-symlinks-noarch.tar.xz \
-        "${base}/s6-overlay-symlinks-noarch.tar.xz"; \
     curl -fsSL --retry 3 -o /tmp/s6-overlay-arch.tar.xz \
-        "${base}/s6-overlay-${s6_arch}.tar.xz"; \
+        "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-${s6_arch}.tar.xz"; \
     { \
         printf '%s  %s\n' "${S6_OVERLAY_NOARCH_SHA256}" /tmp/s6-overlay-noarch.tar.xz; \
         printf '%s  %s\n' "${s6_arch_sha}" /tmp/s6-overlay-arch.tar.xz; \
@@ -73,19 +76,17 @@ RUN set -eu; \
     tar -C / -Jxpf /tmp/s6-overlay-noarch.tar.xz; \
     tar -C / -Jxpf /tmp/s6-overlay-arch.tar.xz; \
     tar -C / -Jxpf /tmp/s6-overlay-symlinks-noarch.tar.xz; \
-    rm /tmp/s6-overlay-*.tar.xz /tmp/s6-overlay.sha256
-
-# #34192 / #66679: backward-compat shim for orchestration templates that
-# still reference the legacy /usr/bin/tini entrypoint (Hostinger's
-# 'Hermes WebUI' catalog, NAS compose projects that preserve an old
-# entrypoint on image update, etc.). A plain symlink to /init made the
-# path exist, but forwarded tini flags like `-g` into s6-overlay's
-# rc.init as the container CMD (`rc.init: 91: -g: not found`) and
-# boot-looped any `restart: unless-stopped` deploy. The shim strips the
-# tini CLI surface, then exec's /init + main-wrapper — see
-# docker/tini-shim.sh. Safe to drop once the affected catalogs are
-# updated.
-COPY --chmod=0755 docker/tini-shim.sh /usr/bin/tini
+    rm /tmp/s6-overlay-*.tar.xz /tmp/s6-overlay.sha256; \
+    # #34192: backward-compat shim for orchestration templates that still\
+    # reference the legacy /usr/bin/tini entrypoint (e.g. Hostinger's\
+    # 'Hermes WebUI' catalog). The image has moved to s6-overlay /init\
+    # as PID 1 (see ENTRYPOINT below + the migration comment at the top\
+    # of this file), but external wrappers pinned to /usr/bin/tini will\
+    # crash with 'tini: No such file or directory' on startup. The shim\
+    # symlinks /usr/bin/tini -> /init so legacy wrappers exec the right\
+    # PID-1 reaper without behavior change for users on the current\
+    # ENTRYPOINT. Safe to drop once the affected catalogs are updated.\
+    ln -sf /init /usr/bin/tini
 
 # Non-root user for runtime; UID can be overridden via HERMES_UID at runtime
 RUN useradd -u 10000 -m -d /opt/data hermes
@@ -134,11 +135,8 @@ COPY apps/shared/ apps/shared/
 # guards against a future regression if the source npm version changes.
 ENV npm_config_install_links=false
 
-RUN npm install --prefer-offline --no-audit --fetch-retries=5 && \
-    for i in 1 2 3; do \
-        npx playwright install --with-deps chromium --only-shell && break || \
-        { [ "$i" = 3 ] && exit 1; echo "playwright install failed (attempt $i); retrying in 10s"; sleep 10; }; \
-    done && \
+RUN npm install --prefer-offline --no-audit && \
+    npx playwright install --with-deps chromium --only-shell && \
     npm cache clean --force
 
 # ---------- Layer-cached Python dependency install ----------

MANIFEST.in

@@ -0,0 +1,13 @@
+graft skills
+graft optional-skills
+graft optional-mcps
+graft locales
+# Bundled plugin manifests (plugin.yaml / plugin.yml). Without these the
+# PluginManager scan (hermes_cli/plugins.py) finds zero plugins on installs
+# built from the sdist (e.g. Homebrew, downstream packagers). package-data
+# below covers the wheel; this covers the sdist. See #34034 / #28149.
+recursive-include plugins plugin.yaml plugin.yml
+# Gateway assets include images plus YAML catalogs such as status_phrases.yaml.
+recursive-include gateway/assets *
+global-exclude __pycache__
+global-exclude *.py[cod]

acp_adapter/entry.py

@@ -32,7 +32,6 @@ else:
 import argparse
 import asyncio
 import logging
-import os
 import sys
 from pathlib import Path
 from hermes_constants import get_hermes_home
@@ -191,7 +190,7 @@ def _run_setup_browser(assume_yes: bool = False) -> int:
     """Bootstrap agent-browser + Chromium.
 
     Routes through dep_ensure -> install.{sh,ps1} --ensure, sharing code
-    with the runtime lazy installer.
+    with ``hermes postinstall`` and the runtime lazy installer.
 
     Returns 0 on success, 1 on failure.
     """
@@ -252,13 +251,11 @@ def main(argv: list[str] | None = None) -> None:
     # MCP servers dynamically via asyncio.to_thread inside the event
     # loop; that path is unaffected.)  Moved from model_tools.py module
     # scope to avoid freezing the gateway's loop on lazy import (#16856).
-    # Metadata-only hosts can opt out of unrelated global MCP startup.
-    if os.environ.get("HERMES_ACP_SKIP_CONFIGURED_MCP", "").strip() != "1":
-        try:
-            from tools.mcp_tool import discover_mcp_tools
-            discover_mcp_tools()
-        except Exception:
-            logger.debug("MCP tool discovery failed at ACP startup", exc_info=True)
+    try:
+        from tools.mcp_tool import discover_mcp_tools
+        discover_mcp_tools()
+    except Exception:
+        logger.debug("MCP tool discovery failed at ACP startup", exc_info=True)
 
     agent = HermesACPAgent()
     try:

acp_adapter/server.py

@@ -74,10 +74,6 @@ from acp_adapter.permissions import make_approval_callback
 from acp_adapter.provenance import session_provenance_meta
 from acp_adapter.session import SessionManager, SessionState, _expand_acp_enabled_toolsets
 from acp_adapter.tools import build_tool_complete, build_tool_start
-from agent.context_compressor import (
-    COMPRESSED_SUMMARY_METADATA_KEY,
-    ContextCompressor,
-)
 from tools.approval import (
     reset_hermes_interactive_context,
     set_hermes_interactive_context,
@@ -85,110 +81,6 @@ from tools.approval import (
 
 logger = logging.getLogger(__name__)
 
-
-def _named_custom_provider_catalogs() -> list[tuple[str, str, list[tuple[str, str]]]]:
-    """Return ``(slug, label, [(model_id, description), ...])`` for named endpoints.
-
-    Covers both the v12 ``providers:`` mapping and the legacy
-    ``custom_providers:`` list.  These endpoints never appear in canonical
-    provider enumeration, so without this the ACP model selector hides every
-    named endpoint that the TUI ``/model`` picker already renders (#47039
-    implemented named-endpoint rows for the TUI surface only).
-
-    Model lists come from the entry's declared models (``default_model`` +
-    ``models``), refreshed from the endpoint's live ``/models`` listing when a
-    credential is available and ``discover_models`` is not disabled.  Declared
-    models are kept even when live discovery fails — some OpenAI-compatible
-    endpoints (e.g. Bedrock Mantle Responses) expose no ``/models`` route at
-    all yet serve the declared models fine.
-
-    Slugs use the ``custom:<name>`` shape that ``parse_model_input`` and
-    ``resolve_runtime_provider`` already resolve, so encoded choice ids
-    (``custom:<name>:<model>``) round-trip through ``set_session_model``
-    unchanged.
-    """
-    try:
-        from hermes_cli.config import (
-            get_compatible_custom_providers,
-            is_provider_enabled,
-            load_config,
-        )
-        from hermes_cli.models import fetch_api_models
-    except ImportError:
-        return []
-
-    try:
-        cfg = load_config()
-        entries = get_compatible_custom_providers(cfg)
-    except Exception:
-        logger.debug("Could not load named custom providers", exc_info=True)
-        return []
-
-    # ``get_compatible_custom_providers`` drops the ``enabled`` flag during
-    # normalization, so collect explicitly disabled provider keys from the
-    # raw config and skip their entries below.
-    disabled_keys: set[str] = set()
-    raw_providers = cfg.get("providers") if isinstance(cfg, dict) else None
-    if isinstance(raw_providers, dict):
-        for raw_key, raw_entry in raw_providers.items():
-            if isinstance(raw_entry, dict) and not is_provider_enabled(raw_entry):
-                disabled_keys.add(str(raw_key).strip().lower())
-
-    catalogs: list[tuple[str, str, list[tuple[str, str]]]] = []
-    for entry in entries:
-        if not isinstance(entry, dict):
-            continue
-        provider_key = str(entry.get("provider_key", "") or "").strip()
-        if provider_key.lower() in disabled_keys:
-            continue
-        name = str(entry.get("name", "") or "").strip()
-        base_url = str(entry.get("base_url", "") or "").strip()
-        if not name or not base_url:
-            continue
-        slug_source = provider_key or name
-        slug = "custom:" + slug_source.strip().lower().replace(" ", "-")
-
-        api_key = str(entry.get("api_key", "") or "").strip()
-        if not api_key:
-            key_env = str(entry.get("key_env", "") or "").strip()
-            api_key = os.environ.get(key_env, "").strip() if key_env else ""
-
-        declared: list[str] = []
-        default_model = str(entry.get("model", "") or "").strip()
-        if default_model:
-            declared.append(default_model)
-        models_cfg = entry.get("models")
-        if isinstance(models_cfg, dict):
-            for mid in models_cfg:
-                mid = str(mid or "").strip()
-                if mid and mid not in declared:
-                    declared.append(mid)
-
-        if not api_key and not declared:
-            # No credential to discover with and nothing declared:
-            # not addressable from the selector.
-            continue
-
-        model_ids = list(declared)
-        discover = entry.get("discover_models", True)
-        if isinstance(discover, str):
-            discover = discover.lower() not in {"false", "no", "0"}
-        if discover and api_key:
-            try:
-                live = fetch_api_models(
-                    api_key, base_url, api_mode=entry.get("api_mode")
-                )
-            except Exception:
-                live = None
-            if live:
-                model_ids = declared + [m for m in live if m not in declared]
-
-        if not model_ids:
-            continue
-        catalogs.append((slug, name, [(mid, "") for mid in model_ids]))
-
-    return catalogs
-
 try:
     from hermes_cli import __version__ as HERMES_VERSION
 except Exception:
@@ -201,13 +93,6 @@ _executor = ThreadPoolExecutor(max_workers=4, thread_name_prefix="acp-agent")
 # does not expose a client-side limit, so this is a fixed cap that clients
 # paginate against using `cursor` / `next_cursor`.
 _LIST_SESSIONS_PAGE_SIZE = 50
-# Per-provider cap for the ACP model selector. ACP clients (Zed, Buzz) render
-# the whole `availableModels` array in one dropdown, so an unbounded
-# cross-provider catalog degrades the picker. Mirrors the cap the MoA picker
-# already uses (`hermes_cli/moa_cmd.py`). This bounds each provider's row, not
-# the total; aggregator providers stay intentionally uncapped inside the shared
-# inventory, and the current model is always kept via the fallback insert below.
-ACP_MAX_MODELS_PER_PROVIDER = 200
 _MAX_ACP_RESOURCE_BYTES = 512 * 1024
 _TEXT_RESOURCE_MIME_PREFIXES = ("text/",)
 _TEXT_RESOURCE_MIME_TYPES = {
@@ -571,7 +456,7 @@ class HermesACPAgent(acp.Agent):
         "tools": "List available tools",
         "context": "Show conversation context info",
         "reset": "Clear conversation history",
-        "compress": "Compress conversation context",
+        "compact": "Compress conversation context",
         "steer": "Inject guidance into the currently running agent turn",
         "queue": "Queue a prompt to run after the current turn finishes",
         "version": "Show Hermes version",
@@ -600,7 +485,7 @@ class HermesACPAgent(acp.Agent):
             "description": "Clear conversation history",
         },
         {
-            "name": "compress",
+            "name": "compact",
             "description": "Compress conversation context",
         },
         {
@@ -696,108 +581,46 @@ class HermesACPAgent(acp.Agent):
         return f"{raw_provider}:{raw_model}"
 
     def _build_model_state(self, state: SessionState) -> SessionModelState | None:
-        """Return authenticated providers and their models for ACP clients.
-
-        The shared Hermes inventory is also used by ``hermes model``, the TUI,
-        and the dashboard. Keeping ACP on that substrate prevents its selector
-        from silently collapsing to the current provider's curated list.
-        """
+        """Return the ACP model selector payload for editors like Zed."""
         model = str(state.model or getattr(state.agent, "model", "") or "").strip()
         provider = getattr(state.agent, "provider", None) or detect_provider() or "openrouter"
 
         try:
-            from hermes_cli.inventory import build_models_payload, load_picker_context
-            from hermes_cli.models import normalize_provider, provider_label
+            from hermes_cli.models import curated_models_for_provider, normalize_provider, provider_label
 
             normalized_provider = normalize_provider(provider)
-            context = load_picker_context().with_overrides(
-                current_provider=normalized_provider,
-                current_model=model,
-                current_base_url=str(getattr(state.agent, "base_url", "") or ""),
-            )
-            payload = build_models_payload(
-                context,
-                explicit_only=True,
-                include_unconfigured=False,
-                picker_hints=False,
-                canonical_order=True,
-                pricing=False,
-                capabilities=False,
-                refresh=False,
-                probe_custom_providers=False,
-                probe_current_custom_provider=False,
-                max_models=ACP_MAX_MODELS_PER_PROVIDER,
-            )
-
+            provider_name = provider_label(normalized_provider)
             available_models: list[ModelInfo] = []
             seen_ids: set[str] = set()
-            for row in payload.get("providers") or []:
-                row_provider = normalize_provider(str(row.get("slug") or "").strip())
-                if not row_provider:
-                    continue
-                provider_name = str(row.get("name") or "").strip() or provider_label(
-                    row_provider
-                )
-                for model_entry in row.get("models") or []:
-                    if isinstance(model_entry, dict):
-                        rendered_model = str(
-                            model_entry.get("id")
-                            or model_entry.get("model")
-                            or model_entry.get("name")
-                            or ""
-                        ).strip()
-                    else:
-                        rendered_model = str(model_entry or "").strip()
-                    if not rendered_model:
-                        continue
-                    choice_id = self._encode_model_choice(row_provider, rendered_model)
-                    if choice_id in seen_ids:
-                        continue
-                    is_current = (
-                        row_provider == normalized_provider and rendered_model == model
-                    )
-                    description = f"Provider: {provider_name}"
-                    if is_current:
-                        description += " • current"
-                    available_models.append(
-                        ModelInfo(
-                            model_id=choice_id,
-                            name=f"{provider_name} · {rendered_model}",
-                            description=description,
-                        )
-                    )
-                    seen_ids.add(choice_id)
 
-            # Named user-defined endpoints (providers: / custom_providers:)
-            # are invisible to canonical provider enumeration — append them
-            # so editor clients can select them like the TUI /model picker.
-            for named_slug, named_label, named_catalog in _named_custom_provider_catalogs():
-                for named_model, named_desc in named_catalog:
-                    named_choice = self._encode_model_choice(named_slug, named_model)
-                    if not named_choice or named_choice in seen_ids:
-                        continue
-                    named_parts = [f"Provider: {named_label}"]
-                    if named_desc:
-                        named_parts.append(str(named_desc).strip())
-                    if named_slug == normalized_provider and named_model == model:
-                        named_parts.append("current")
-                    available_models.append(
-                        ModelInfo(
-                            model_id=named_choice,
-                            name=named_model,
-                            description=" • ".join(part for part in named_parts if part),
-                        )
+            for model_id, description in curated_models_for_provider(normalized_provider):
+                rendered_model = str(model_id or "").strip()
+                if not rendered_model:
+                    continue
+                choice_id = self._encode_model_choice(normalized_provider, rendered_model)
+                if choice_id in seen_ids:
+                    continue
+                desc_parts = [f"Provider: {provider_name}"]
+                if description:
+                    desc_parts.append(str(description).strip())
+                if rendered_model == model:
+                    desc_parts.append("current")
+                available_models.append(
+                    ModelInfo(
+                        model_id=choice_id,
+                        name=rendered_model,
+                        description=" • ".join(part for part in desc_parts if part),
                     )
-                    seen_ids.add(named_choice)
+                )
+                seen_ids.add(choice_id)
 
             current_model_id = self._encode_model_choice(normalized_provider, model)
             if current_model_id and current_model_id not in seen_ids:
-                provider_name = provider_label(normalized_provider)
                 available_models.insert(
                     0,
                     ModelInfo(
                         model_id=current_model_id,
-                        name=f"{provider_name} · {model}",
+                        name=model,
                         description=f"Provider: {provider_name} • current",
                     ),
                 )
@@ -1146,49 +969,11 @@ class HermesACPAgent(acp.Agent):
                 return text
         return ""
 
-    @staticmethod
-    def _history_summary_meta(message: dict[str, Any], text: str) -> dict[str, Any] | None:
-        """Build the ``_meta`` payload for a replayed compaction summary.
-
-        Compaction summaries are persisted as ordinary history messages —
-        standalone handoffs under ``role="user"`` OR ``role="assistant"``
-        (the compressor picks whichever role keeps alternation valid), and
-        merge-into-tail messages where the summary is appended after the
-        first preserved tail message's real content. Without a wire flag,
-        ACP frontends render all of these as ordinary turns.
-
-        Two distinct keys under ``_meta.hermes`` (ACP's extensibility
-        channel), so clients cannot accidentally hide real content:
-
-        * ``compactionSummary: true`` — the entire chunk is the handoff
-          summary. Safe to restyle or collapse wholesale.
-        * ``containsCompactionSummary: true`` — a merged-tail message: real
-          preserved turn content followed by the summary. Clients may style
-          it, but collapsing the whole chunk would hide the preserved
-          content, hence the separate key.
-
-        Detection honors the in-process ``_compressed_summary`` flag and
-        falls back to content classification, so it also works for a
-        DB-reloaded session that lost the in-memory flag.
-        """
-        kind = ContextCompressor.classify_summary_content(text)
-        if kind is None and message.get(COMPRESSED_SUMMARY_METADATA_KEY):
-            # Flagged in-process but content didn't classify (e.g. future
-            # prefix drift): treat as a standalone summary — the flag is only
-            # ever set on summary-bearing messages.
-            kind = "standalone"
-        if kind == "standalone":
-            return {"hermes": {"compactionSummary": True}}
-        if kind == "merged":
-            return {"hermes": {"containsCompactionSummary": True}}
-        return None
-
     @staticmethod
     def _history_message_update(
         *,
         role: str,
         text: str,
-        field_meta: dict[str, Any] | None = None,
     ) -> UserMessageChunk | AgentMessageChunk | None:
         """Build an ACP history replay update for a user/assistant message."""
         block = TextContentBlock(type="text", text=text)
@@ -1196,13 +981,11 @@ class HermesACPAgent(acp.Agent):
             return UserMessageChunk(
                 session_update="user_message_chunk",
                 content=block,
-                field_meta=field_meta,
             )
         if role == "assistant":
             return AgentMessageChunk(
                 session_update="agent_message_chunk",
                 content=block,
-                field_meta=field_meta,
             )
         return None
 
@@ -1273,11 +1056,7 @@ class HermesACPAgent(acp.Agent):
             if role == "user":
                 text = self._history_message_text(message)
                 if text:
-                    update = self._history_message_update(
-                        role=role,
-                        text=text,
-                        field_meta=self._history_summary_meta(message, text),
-                    )
+                    update = self._history_message_update(role=role, text=text)
                     if update is not None and not await _send(update):
                         return
                 continue
@@ -1289,11 +1068,7 @@ class HermesACPAgent(acp.Agent):
 
                 text = self._history_message_text(message)
                 if text:
-                    update = self._history_message_update(
-                        role=role,
-                        text=text,
-                        field_meta=self._history_summary_meta(message, text),
-                    )
+                    update = self._history_message_update(role=role, text=text)
                     if update is not None and not await _send(update):
                         return
 
@@ -1443,19 +1218,12 @@ class HermesACPAgent(acp.Agent):
             with state.runtime_lock:
                 if state.is_running and state.current_prompt_text:
                     state.interrupted_prompt_text = state.current_prompt_text
-                # Publish cancellation and hard-stop the agent before another
-                # prompt can acquire this lock and mistake the turn for
-                # redirectable work.
-                state.cancel_event.set()
-                try:
-                    if getattr(state, "agent", None) and hasattr(state.agent, "interrupt"):
-                        state.agent.interrupt()
-                except Exception:
-                    logger.debug(
-                        "Failed to interrupt ACP session %s",
-                        session_id,
-                        exc_info=True,
-                    )
+            state.cancel_event.set()
+            try:
+                if getattr(state, "agent", None) and hasattr(state.agent, "interrupt"):
+                    state.agent.interrupt()
+            except Exception:
+                logger.debug("Failed to interrupt ACP session %s", session_id, exc_info=True)
             logger.info("Cancelled session %s", session_id)
 
     async def fork_session(
@@ -1584,26 +1352,6 @@ class HermesACPAgent(acp.Agent):
             elif rewrite_idle:
                 user_text = steer_text
                 user_content = steer_text
-        elif (
-            text_only_prompt
-            and isinstance(user_content, str)
-            and not user_text.startswith("/")
-        ):
-            # Some ACP clients implement "stop and send" as two protocol calls:
-            # cancel the active prompt, then submit plain correction text. Keep
-            # the cancelled request attached so deictic follow-ups ("not that
-            # file") still have an explicit target.
-            interrupted_prompt = ""
-            with state.runtime_lock:
-                if not state.is_running and state.interrupted_prompt_text:
-                    interrupted_prompt = state.interrupted_prompt_text
-                    state.interrupted_prompt_text = ""
-            if interrupted_prompt:
-                user_text = (
-                    f"{interrupted_prompt}\n\n"
-                    f"User correction/guidance after interrupt: {user_text}"
-                )
-                user_content = user_text
 
         # Intercept slash commands — handle locally without calling the LLM.
         # Slash commands are text-only; if the client included images/resources,
@@ -1618,54 +1366,23 @@ class HermesACPAgent(acp.Agent):
                     await self._send_usage_update(state)
                 return PromptResponse(stop_reason="end_turn")
 
-        # If the client sends another regular text prompt while this ACP session
-        # is running, route it through the core active-turn redirect. Rich media
-        # and older runtimes retain the proven next-turn queue fallback.
-        redirected = False
-        queued_depth: int | None = None
+        # If Zed sends another regular prompt while the same ACP session is
+        # still running, queue it instead of racing two AIAgent loops against
+        # the same state.history. /steer and /queue are handled above and can
+        # land immediately.
         with state.runtime_lock:
             if state.is_running:
-                if (
-                    text_only_prompt
-                    and isinstance(user_content, str)
-                    and getattr(
-                        state.agent,
-                        "_supports_active_turn_redirect",
-                        False,
+                queued_text = user_text or "[Image attachment]"
+                state.queued_prompts.append(queued_text)
+                depth = len(state.queued_prompts)
+                if self._conn:
+                    update = acp.update_agent_message_text(
+                        f"Queued for the next turn. ({depth} queued)"
                     )
-                    is True
-                    and hasattr(state.agent, "redirect")
-                ):
-                    try:
-                        redirected = bool(state.agent.redirect(user_content))
-                    except Exception:
-                        logger.debug(
-                            "ACP active-turn redirect failed for %s",
-                            session_id,
-                            exc_info=True,
-                        )
-                if not redirected:
-                    queued_text = user_text or "[Image attachment]"
-                    state.queued_prompts.append(queued_text)
-                    queued_depth = len(state.queued_prompts)
-            else:
-                state.is_running = True
-                state.current_prompt_text = user_text or "[Image attachment]"
-
-        if redirected:
-            if self._conn:
-                update = acp.update_agent_message_text(
-                    "Redirected the active turn with your correction."
-                )
-                await self._conn.session_update(session_id, update)
-            return PromptResponse(stop_reason="end_turn")
-        if queued_depth is not None:
-            if self._conn:
-                update = acp.update_agent_message_text(
-                    f"Queued for the next turn. ({queued_depth} queued)"
-                )
-                await self._conn.session_update(session_id, update)
-            return PromptResponse(stop_reason="end_turn")
+                    await self._conn.session_update(session_id, update)
+                return PromptResponse(stop_reason="end_turn")
+            state.is_running = True
+            state.current_prompt_text = user_text or "[Image attachment]"
 
         logger.info("Prompt on session %s: %s", session_id, user_text[:100])
 
@@ -2039,7 +1756,7 @@ class HermesACPAgent(acp.Agent):
             "tools": self._cmd_tools,
             "context": self._cmd_context,
             "reset": self._cmd_reset,
-            "compress": self._cmd_compress,
+            "compact": self._cmd_compact,
             "steer": self._cmd_steer,
             "queue": self._cmd_queue,
             "version": self._cmd_version,
@@ -2109,8 +1826,8 @@ class HermesACPAgent(acp.Agent):
                 return "No tools available."
             lines = [f"Available tools ({len(tools)}):"]
             for t in tools:
-                name = (t.get("function") or {}).get("name", "?")
-                desc = (t.get("function") or {}).get("description", "")
+                name = t.get("function", {}).get("name", "?")
+                desc = t.get("function", {}).get("description", "")
                 # Truncate long descriptions
                 if len(desc) > 80:
                     desc = desc[:77] + "..."
@@ -2181,7 +1898,7 @@ class HermesACPAgent(acp.Agent):
                     lines.append(
                         f"Compression: due now (threshold ~{threshold_tokens:,}"
                         + (f", {threshold_pct:.0f}%" if threshold_pct else "")
-                        + "). Run /compress."
+                        + "). Run /compact."
                     )
                 else:
                     lines.append(
@@ -2194,12 +1911,9 @@ class HermesACPAgent(acp.Agent):
                 lines.append(f"Compression threshold: ~{threshold_tokens:,} tokens")
 
         if getattr(agent, "compression_enabled", True) is False:
-            lines.append(
-                "Auto-compaction is disabled (compression.enabled: false); "
-                "/compress still compresses manually."
-            )
+            lines.append("Compression is disabled for this agent.")
         else:
-            lines.append("Tip: run /compress to compress manually before the threshold.")
+            lines.append("Tip: run /compact to compress manually before the threshold.")
 
         return "\n".join(lines)
 
@@ -2219,14 +1933,13 @@ class HermesACPAgent(acp.Agent):
             return "Conversation history cleared. Agent session state reset failed; see logs."
         return "Conversation history cleared."
 
-    def _cmd_compress(self, args: str, state: SessionState) -> str:
+    def _cmd_compact(self, args: str, state: SessionState) -> str:
         if not state.history:
             return "Nothing to compress — conversation is empty."
         try:
             agent = state.agent
-            # No compression_enabled gate: the flag disables *automatic*
-            # compaction only; manual /compress must keep working (matches
-            # the CLI /compress and gateway handlers).
+            if not getattr(agent, "compression_enabled", True):
+                return "Context compression is disabled for this agent."
             if not hasattr(agent, "_compress_context"):
                 return "Context compression not available for this agent."
 
@@ -2251,7 +1964,6 @@ class HermesACPAgent(acp.Agent):
                     getattr(agent, "_cached_system_prompt", "") or "",
                     approx_tokens=approx_tokens,
                     task_id=state.session_id,
-                    force=True,
                 )
             finally:
                 agent._session_db = original_session_db

acp_registry/agent.json

@@ -0,0 +1,16 @@
+{
+  "id": "hermes-agent",
+  "name": "Hermes Agent",
+  "version": "0.18.2",
+  "description": "Self-improving open-source AI agent by Nous Research with ACP editor integration, persistent memory, skills, and rich tool support.",
+  "repository": "https://github.com/NousResearch/hermes-agent",
+  "website": "https://hermes-agent.nousresearch.com/docs/user-guide/features/acp",
+  "authors": ["Nous Research"],
+  "license": "MIT",
+  "distribution": {
+    "uvx": {
+      "package": "hermes-agent[acp]==0.18.2",
+      "args": ["hermes-acp"]
+    }
+  }
+}

acp_registry/icon.svg

@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" width="16" height="16" fill="none">
+  <path d="M8 1.5v13" stroke="currentColor" stroke-width="1.5" stroke-linecap="round"/>
+  <path d="M8 3.25c-2.35-1.4-4.7-.95-6.25.35 1.85-.2 3.8.2 5.55 1.55" stroke="currentColor" stroke-width="1.1" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M8 3.25c2.35-1.4 4.7-.95 6.25.35-1.85-.2-3.8.2-5.55 1.55" stroke="currentColor" stroke-width="1.1" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M8 13.25c-2.3-1-3.05-2.65-1.35-4.15-2 .8-2.35 2.95-.35 4" stroke="currentColor" stroke-width="1.1" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M8 13.25c2.3-1 3.05-2.65 1.35-4.15 2 .8 2.35 2.95.35 4" stroke="currentColor" stroke-width="1.1" stroke-linecap="round" stroke-linejoin="round"/>
+  <circle cx="8" cy="1.8" r="1.1" fill="currentColor"/>
+</svg>

agent/account_usage.py

@@ -214,7 +214,7 @@ def build_nous_credits_snapshot(account_info) -> Optional[AccountUsageSnapshot]:
             return None
 
         details.append(f"Top up: {nous_portal_topup_url(account_info)}")
-        details.append("(or run /topup)")
+        details.append("(or run /credits)")
 
         plan = getattr(sub, "plan", None) if sub is not None else None
         return AccountUsageSnapshot(
@@ -340,7 +340,7 @@ def _snapshot_from_credits_state(state) -> Optional[AccountUsageSnapshot]:
 
 @dataclass(frozen=True)
 class CreditsView:
-    """Surface-agnostic data for the ``/topup`` balance view.
+    """Surface-agnostic data for the ``/credits`` command.
 
     One portal fetch, one parse — consumed identically by the CLI panel, the
     gateway button, and any other money surface. Fail-open: when not logged in
@@ -356,11 +356,11 @@ class CreditsView:
 
 
 def build_credits_view(*, markdown: bool = False, timeout: float = 10.0) -> CreditsView:
-    """Build the /topup balance view: balance block + identity line + top-up URL.
+    """Build the /credits view: balance block + identity line + top-up URL.
 
     Reuses the same account fetch + snapshot + URL builder as the /usage credits
     block, so the numbers always match. The balance block is the rendered
-    snapshot MINUS its trailing top-up/command-hint lines (the /topup surface
+    snapshot MINUS its trailing top-up/command-hint lines (the /credits surface
     supplies its own affordance). Fail-open → ``CreditsView(logged_in=False)``.
     """
     not_logged_in = CreditsView(logged_in=False)
@@ -386,7 +386,7 @@ def build_credits_view(*, markdown: bool = False, timeout: float = 10.0) -> Cred
                 timeout=timeout
             )
     except Exception:
-        logger.debug("credits ▸ /topup portal fetch failed (fail-open)", exc_info=True)
+        logger.debug("credits ▸ /credits portal fetch failed (fail-open)", exc_info=True)
         return not_logged_in
 
     if account is None or not getattr(account, "logged_in", False):
@@ -394,8 +394,8 @@ def build_credits_view(*, markdown: bool = False, timeout: float = 10.0) -> Cred
 
     snapshot = build_nous_credits_snapshot(account)
     # Balance lines = the snapshot block minus the two trailing affordance lines
-    # ("Top up: <url>" + "(or run /topup)") that build_nous_credits_snapshot
-    # appends for the /usage surface. /topup renders its own button/panel.
+    # ("Top up: <url>" + "(or run /credits)") that build_nous_credits_snapshot
+    # appends for the /usage surface. /credits renders its own button/panel.
     balance_lines: list[str] = []
     if snapshot is not None:
         rendered = render_account_usage_lines(snapshot, markdown=markdown)
@@ -701,18 +701,6 @@ def redeem_codex_reset_credit(
     remaining = max(0, available - 1)
     plural = "s" if remaining != 1 else ""
     if code == "reset":
-        # The redeemed reset restores the account's quota upstream — lift any
-        # persisted pool cooldowns so Hermes doesn't keep the credential
-        # frozen behind the now-stale ``last_error_reset_at`` (issue #43747).
-        try:
-            from hermes_cli.auth import clear_codex_pool_quota_cooldowns
-
-            clear_codex_pool_quota_cooldowns()
-        except Exception:
-            logger.debug(
-                "Failed to clear Codex pool cooldowns after reset redemption",
-                exc_info=True,
-            )
         return CodexResetRedeemResult(
             status="reset",
             message=(

agent/agent_init.py

@@ -28,7 +28,7 @@ import time
 import uuid
 from datetime import datetime
 from typing import Any, Callable, Dict, List, Optional
-from urllib.parse import parse_qs, urlparse, urlunparse
+from urllib.parse import urlparse, parse_qs, urlunparse
 
 from agent.context_compressor import ContextCompressor
 from agent.iteration_budget import IterationBudget
@@ -48,7 +48,6 @@ from agent.tool_guardrails import (
     ToolGuardrailDecision,
 )
 from hermes_cli.config import cfg_get
-from hermes_cli.route_identity import normalize_route_base_url
 from hermes_cli.timeouts import get_provider_request_timeout
 from hermes_constants import get_hermes_home
 from utils import base_url_host_matches, is_truthy_value
@@ -69,188 +68,18 @@ def _ra():
     return run_agent
 
 
-def _moa_reference_output_allowed(agent: Any) -> bool:
-    """Keep MoA display events off only the machine-readable ``-Q`` surface."""
-    return not (
-        getattr(agent, "platform", None) == "cli"
-        and getattr(agent, "tool_progress_mode", "all") == "off"
-    )
-
-
-def _relay_moa_reference_event(agent: Any, event: str, **kwargs: Any) -> None:
-    """Relay MoA display events while preserving the ``-Q`` stdout contract."""
-    if not _moa_reference_output_allowed(agent):
-        return
-    cb = getattr(agent, "tool_progress_callback", None)
-    if cb is None:
-        return
-    try:
-        if event == "moa.reference":
-            cb(
-                "moa.reference",
-                str(kwargs.get("label") or ""),
-                str(kwargs.get("text") or ""),
-                None,
-                moa_index=kwargs.get("index"),
-                moa_count=kwargs.get("count"),
-            )
-        elif event == "moa.aggregating":
-            cb(
-                "moa.aggregating",
-                str(kwargs.get("aggregator") or ""),
-                None,
-                None,
-                moa_ref_count=kwargs.get("ref_count"),
-            )
-    except Exception:
-        pass
-
-
-def _normalize_route_base_url(base_url: Any) -> str:
-    """Canonicalize an endpoint URL for model-route identity comparisons."""
-    return normalize_route_base_url(base_url)
-
-
-def _provider_default_routes(provider: str) -> set[str]:
-    """Return known exact default routes for a canonical provider id."""
-    routes: set[str] = set()
-    try:
-        from hermes_cli.providers import HERMES_OVERLAYS, get_provider
-
-        overlay = HERMES_OVERLAYS.get(provider)
-        provider_def = get_provider(provider)
-        for value in (
-            getattr(overlay, "base_url_override", ""),
-            getattr(provider_def, "base_url", ""),
-        ):
-            route = _normalize_route_base_url(value)
-            if route:
-                routes.add(route)
-    except Exception:
-        pass
-
-    try:
-        from providers import get_provider_profile
-
-        profile = get_provider_profile(provider)
-        route = _normalize_route_base_url(
-            getattr(profile, "base_url", "")
-        )
-        if route:
-            routes.add(route)
-    except Exception:
-        pass
-
-    try:
-        from hermes_cli.auth import PROVIDER_REGISTRY
-        from hermes_cli.models import normalize_provider as normalize_model_provider
-        from hermes_cli.providers import normalize_provider as normalize_registry_provider
-
-        for provider_id, config in PROVIDER_REGISTRY.items():
-            canonical_id = normalize_registry_provider(
-                normalize_model_provider(provider_id)
-            )
-            if canonical_id != provider:
-                continue
-            route = _normalize_route_base_url(
-                getattr(config, "inference_base_url", "")
-            )
-            if route:
-                routes.add(route)
-    except Exception:
-        pass
-
-    if provider == "gemini":
-        routes.update(
-            f"{route.rstrip('/')}/openai"
-            for route in list(routes)
-        )
-    return routes
-
-
-def _context_route_mismatch(
-    configured_base_url: Any,
-    active_base_url: Any,
-    configured_provider: Any,
-    active_provider: Any,
-    *,
-    already_normalized: bool = False,
-) -> bool:
-    """Return whether a context pin's configured route differs from runtime."""
-    if already_normalized:
-        configured_route = str(configured_base_url or "")
-        active_route = str(active_base_url or "")
-    else:
-        configured_route = _normalize_route_base_url(configured_base_url)
-        active_route = _normalize_route_base_url(active_base_url)
-    if configured_route:
-        return configured_route != active_route
-
-    configured_provider = str(configured_provider or "").strip()
-    active_provider = str(active_provider or "").strip()
-    if not configured_provider:
-        return False
-    try:
-        from hermes_cli.models import normalize_provider as normalize_model_provider
-
-        configured_provider = normalize_model_provider(configured_provider)
-        active_provider = normalize_model_provider(active_provider)
-    except Exception:
-        configured_provider = configured_provider.lower()
-        active_provider = active_provider.lower()
-    try:
-        from hermes_cli.providers import normalize_provider as normalize_registry_provider
-
-        configured_provider = normalize_registry_provider(configured_provider)
-        active_provider = normalize_registry_provider(active_provider)
-    except Exception:
-        pass
-
-    if active_route:
-        configured_routes = _provider_default_routes(configured_provider)
-        return not configured_routes or active_route not in configured_routes
-    return bool(
-        configured_provider
-        and active_provider
-        and configured_provider != active_provider
-    )
-
-
-def _normalize_custom_provider_name(value: Any) -> str:
-    """Mirror runtime normalization for a requested custom-provider identity."""
-    return str(value or "").strip().lower().replace(" ", "-")
-
-
-def _custom_provider_runtime_ids(value: Any) -> set[str]:
-    """Return raw/menu identities that runtime accepts for a configured name."""
-    normalized = _normalize_custom_provider_name(value)
-    if not normalized:
-        return set()
-    return {normalized, f"custom:{normalized}"}
-
-
-def _build_codex_gpt5_autoraise_notice(
-    autoraise: Dict[str, Any], context_length: Optional[int] = None
-) -> str:
+def _build_codex_gpt5_autoraise_notice(autoraise: Dict[str, Any]) -> str:
     """Build the one-time notice shown when Codex gpt-5.x raises compaction.
 
     ``autoraise`` is ``{"model": <slug>, "from": <old_ratio>, "to": <new_ratio>}``.
-    ``context_length`` is the live-resolved window from the context compressor
-    (Codex's /models catalog is authoritative and can change server-side, e.g.
-    the gpt-5.6 family's 272K → 372K → 272K shifts in July 2026), so the banner
-    reports what this session actually got rather than a hardcoded cap. The
-    same text is printed inline for CLI users and replayed via
+    The same text is printed inline for CLI users and replayed via
     ``status_callback`` for gateway users, so it must be self-contained and
     include the exact opt-back-out command.
     """
     model = str(autoraise.get("model") or "gpt-5.4/5.5").strip().lower().rsplit("/", 1)[-1]
-    if isinstance(context_length, int) and context_length > 0:
-        cap = f"{round(context_length / 1000)}K"
-    else:
-        # Static fallback when the resolved window isn't available:
-        # gpt-5.3-codex-spark has a native 128K window; the gpt-5.4/5.5/5.6
-        # family is capped at 272K by the Codex OAuth backend.
-        cap = "128K" if model.startswith("gpt-5.3-codex-spark") else "272K"
+    # gpt-5.3-codex-spark has a native 128K window; the gpt-5.4/5.5/5.6 family
+    # is capped at 272K by the Codex OAuth backend.
+    cap = "128K" if model.startswith("gpt-5.3-codex-spark") else "272K"
     from_pct = int(round(autoraise["from"] * 100))
     to_pct = int(round(autoraise["to"] * 100))
     return (
@@ -446,78 +275,77 @@ def _merge_custom_provider_extra_body(agent, custom_providers: List[Dict[str, An
 
 def init_agent(
     agent,
-    base_url: str = None,
-    api_key: str = None,
-    provider: str = None,
-    api_mode: str = None,
-    acp_command: str = None,
+    base_url: str | None = None,
+    api_key: str | None = None,
+    provider: str | None = None,
+    api_mode: str | None = None,
+    acp_command: str | None = None,
     acp_args: list[str] | None = None,
-    command: str = None,
+    command: str | None = None,
     args: list[str] | None = None,
     model: str = "",
     max_iterations: int = 90,  # Default tool-calling iterations (shared with subagents)
     tool_delay: float = 1.0,
-    enabled_toolsets: List[str] = None,
-    disabled_toolsets: List[str] = None,
+    enabled_toolsets: List[str] | None = None,
+    disabled_toolsets: List[str] | None = None,
     save_trajectories: bool = False,
     verbose_logging: bool = False,
     quiet_mode: bool = False,
     tool_progress_mode: str = "all",
-    ephemeral_system_prompt: str = None,
+    ephemeral_system_prompt: str | None = None,
     log_prefix_chars: int = 100,
     log_prefix: str = "",
-    providers_allowed: List[str] = None,
-    providers_ignored: List[str] = None,
-    providers_order: List[str] = None,
-    provider_sort: str = None,
+    providers_allowed: List[str] | None = None,
+    providers_ignored: List[str] | None = None,
+    providers_order: List[str] | None = None,
+    provider_sort: str | None = None,
     provider_require_parameters: bool = False,
-    provider_data_collection: str = None,
+    provider_data_collection: str | None = None,
     openrouter_min_coding_score: Optional[float] = None,
-    session_id: str = None,
-    tool_progress_callback: callable = None,
-    tool_start_callback: callable = None,
-    tool_complete_callback: callable = None,
-    thinking_callback: callable = None,
-    reasoning_callback: callable = None,
-    clarify_callback: callable = None,
-    read_terminal_callback: callable = None,
-    step_callback: callable = None,
-    stream_delta_callback: callable = None,
-    interim_assistant_callback: callable = None,
-    tool_gen_callback: callable = None,
-    status_callback: callable = None,
-    notice_callback: callable = None,
-    notice_clear_callback: callable = None,
+    session_id: str | None = None,
+    tool_progress_callback: Callable | None = None,
+    tool_start_callback: Callable | None = None,
+    tool_complete_callback: Callable | None = None,
+    thinking_callback: Callable | None = None,
+    reasoning_callback: Callable | None = None,
+    clarify_callback: Callable | None = None,
+    read_terminal_callback: Callable | None = None,
+    step_callback: Callable | None = None,
+    stream_delta_callback: Callable | None = None,
+    interim_assistant_callback: Callable | None = None,
+    tool_gen_callback: Callable | None = None,
+    status_callback: Callable | None = None,
+    notice_callback: Callable | None = None,
+    notice_clear_callback: Callable | None = None,
     event_callback: Optional[Callable[[str, dict], None]] = None,
     reaction_callback: Optional[Callable[[str], None]] = None,
-    max_tokens: int = None,
-    reasoning_config: Dict[str, Any] = None,
-    service_tier: str = None,
-    request_overrides: Dict[str, Any] = None,
-    prefill_messages: List[Dict[str, Any]] = None,
-    platform: str = None,
-    user_id: str = None,
-    user_id_alt: str = None,
-    user_name: str = None,
-    chat_id: str = None,
-    chat_name: str = None,
-    chat_type: str = None,
-    thread_id: str = None,
-    gateway_session_key: str = None,
+    max_tokens: int | None = None,
+    reasoning_config: Dict[str, Any] | None = None,
+    service_tier: str | None = None,
+    request_overrides: Dict[str, Any] | None = None,
+    prefill_messages: List[Dict[str, Any]] | None = None,
+    platform: str | None = None,
+    user_id: str | None = None,
+    user_id_alt: str | None = None,
+    user_name: str | None = None,
+    chat_id: str | None = None,
+    chat_name: str | None = None,
+    chat_type: str | None = None,
+    thread_id: str | None = None,
+    gateway_session_key: str | None = None,
     skip_context_files: bool = False,
     load_soul_identity: bool = False,
     skip_memory: bool = False,
     session_db=None,
-    parent_session_id: str = None,
-    iteration_budget: "IterationBudget" = None,
-    fallback_model: Dict[str, Any] = None,
+    parent_session_id: str | None = None,
+    iteration_budget: Optional["IterationBudget"] = None,
+    fallback_model: Dict[str, Any] | None = None,
     credential_pool=None,
     checkpoints_enabled: bool = False,
     checkpoint_max_snapshots: int = 20,
     checkpoint_max_total_size_mb: int = 500,
     checkpoint_max_file_size_mb: int = 10,
     pass_session_id: bool = False,
-    requested_provider: str = None,
 ):
     """
     Initialize the AI Agent.
@@ -526,7 +354,6 @@ def init_agent(
         base_url (str): Base URL for the model API (optional)
         api_key (str): API key for authentication (optional, uses env var if not provided)
         provider (str): Provider identifier (optional; used for telemetry/routing hints)
-        requested_provider (str): Original provider identity before runtime canonicalization
         api_mode (str): API mode override: "chat_completions" or "codex_responses"
         model (str): Model name to use (default: "anthropic/claude-opus-4.6")
         max_iterations (int): Maximum number of tool calling iterations (default: 90)
@@ -607,11 +434,6 @@ def init_agent(
     agent.base_url = base_url or ""
     provider_name = provider.strip().lower() if isinstance(provider, str) and provider.strip() else None
     agent.provider = provider_name or ""
-    agent.requested_provider = (
-        requested_provider.strip().lower()
-        if isinstance(requested_provider, str) and requested_provider.strip()
-        else agent.provider
-    )
     agent._credential_pool = credential_pool
     agent.acp_command = acp_command or command
     agent.acp_args = list(acp_args or args or [])
@@ -764,8 +586,6 @@ def init_agent(
     agent._execution_thread_id: int | None = None  # Set at run_conversation() start
     agent._interrupt_thread_signal_pending = False
     agent._client_lock = threading.RLock()
-    agent._model_request_active = threading.Event()
-    agent._supports_active_turn_redirect = True
 
     # /steer mechanism — inject a user note into the next tool result
     # without interrupting the agent. Unlike interrupt(), steer() does
@@ -777,13 +597,6 @@ def init_agent(
     agent._pending_steer: Optional[str] = None
     agent._pending_steer_lock = threading.Lock()
 
-    # Active-turn redirect mechanism. A regular follow-up sent while the model
-    # is generating is different from a hard /stop: preserve the valid turn
-    # prefix, cancel only the in-flight model request, and rebuild its tail with
-    # the correction. The loop drains this slot at a role-safe boundary.
-    agent._pending_redirect: Optional[str] = None
-    agent._pending_redirect_lock = threading.Lock()
-
     # Concurrent-tool worker thread tracking.  `_execute_tool_calls_concurrent`
     # runs each tool on its own ThreadPoolExecutor worker — those worker
     # threads have tids distinct from `_execution_thread_id`, so
@@ -823,10 +636,9 @@ def init_agent(
     # Anthropic prompt caching: auto-enabled for Claude models on native
     # Anthropic, OpenRouter, and third-party gateways that speak the
     # Anthropic protocol (``api_mode == 'anthropic_messages'``). Reduces
-    # input costs by ~75% on multi-turn conversations. Uses four breakpoints:
-    # the static system prefix, full system prompt, and last two messages
-    # (falling back to system-and-3 when no static prefix is available). See
-    # ``_anthropic_prompt_cache_policy`` for the layout-vs-transport decision.
+    # input costs by ~75% on multi-turn conversations. Uses system_and_3
+    # strategy (4 breakpoints). See ``_anthropic_prompt_cache_policy``
+    # for the layout-vs-transport decision.
     agent._use_prompt_caching, agent._use_native_cache_layout = (
         agent._anthropic_prompt_cache_policy()
     )
@@ -951,12 +763,6 @@ def init_agent(
     agent._stream_writer_tls = threading.local()
     agent._stream_writer_dropped = 0
 
-    # Displayed reasoning text streamed during the current model response,
-    # captured only when a surface consumed it via a reasoning callback. Used
-    # by active-turn redirect to checkpoint what the user actually saw without
-    # ever persisting hidden provider reasoning.
-    agent._current_streamed_reasoning_text = ""
-
     # Optional current-turn user-message override used when the API-facing
     # user message intentionally differs from the persisted transcript
     # (e.g. CLI voice mode adds a temporary prefix for the live call only).
@@ -1063,20 +869,49 @@ def init_agent(
                 elif isinstance(effective_key, str) and len(effective_key) > 12:
                     print(f"🔑 Using token: {effective_key[:8]}...{effective_key[-4:]}")
     elif agent.provider == "moa":
-        from agent.moa_loop import build_moa_facade
+        from agent.moa_loop import MoAClient
         agent.api_mode = "chat_completions"
 
-        # build_moa_facade wires the reference relay that routes
-        # reference-model outputs to the agent's tool_progress_callback so
+        # Route reference-model outputs to the agent's tool_progress_callback so
         # every surface that already consumes it (CLI spinner/scrollback, TUI,
-        # desktop, gateway) can show each reference's answer as a labelled
-        # block before the aggregator acts. The facade emits "moa.reference",
-        # "moa.progress", "moa.phase", and "moa.aggregating" events, forwarded
-        # through the same callback the tool lifecycle uses. Best-effort and
-        # cache-safe — display-only events, they never touch the message
-        # history. The factory is shared with the fallback-restore/recovery
-        # paths so a restored facade keeps emitting these events (#53802).
-        agent.client = build_moa_facade(agent, agent.model)
+        # desktop, gateway) can show each reference's answer as a labelled block
+        # before the aggregator acts. The facade emits "moa.reference" and
+        # "moa.aggregating" events; we forward them through the same callback
+        # the tool lifecycle uses. Best-effort and cache-safe — these are
+        # display-only events, they never touch the message history.
+        def _moa_reference_relay(event: str, **kwargs: Any) -> None:
+            cb = getattr(agent, "tool_progress_callback", None)
+            if cb is None:
+                return
+            try:
+                if event == "moa.reference":
+                    label = str(kwargs.get("label") or "")
+                    text = str(kwargs.get("text") or "")
+                    idx = kwargs.get("index")
+                    count = kwargs.get("count")
+                    cb(
+                        "moa.reference",
+                        label,
+                        text,
+                        None,
+                        moa_index=idx,
+                        moa_count=count,
+                    )
+                elif event == "moa.aggregating":
+                    cb(
+                        "moa.aggregating",
+                        str(kwargs.get("aggregator") or ""),
+                        None,
+                        None,
+                        moa_ref_count=kwargs.get("ref_count"),
+                    )
+            except Exception:
+                pass
+
+        agent.client = MoAClient(
+            agent.model or "default",
+            reference_callback=_moa_reference_relay,
+        )
         agent._client_kwargs = {}
         agent.api_key = api_key or "moa-virtual-provider"
         agent.base_url = "moa://local"
@@ -1342,13 +1177,6 @@ def init_agent(
                     print("⚠️  Warning: API key appears invalid or missing")
         except Exception as e:
             raise RuntimeError(f"Failed to initialize OpenAI client: {e}")
-
-    # Keep a stable identity for the pool entry that supplied this runtime.
-    # OAuth refreshes can replace the runtime token before a failed request is
-    # recovered, so the mutable API-key value alone cannot reliably attribute
-    # the failure to its source entry.
-    from agent.agent_runtime_helpers import sync_credential_pool_entry_id
-    sync_credential_pool_entry_id(agent)
     
     # Provider fallback chain — ordered list of backup providers tried
     # when the primary is exhausted (rate-limit, overload, connection
@@ -1495,9 +1323,6 @@ def init_agent(
     
     # Cached system prompt -- built once per session, only rebuilt on compression
     agent._cached_system_prompt: Optional[str] = None
-    # Cross-session-stable prefix of the cached prompt. It remains separate
-    # from the persisted string and is used only to place an early cache marker.
-    agent._cached_system_prompt_static: Optional[str] = None
     
     # Filesystem checkpoint manager (transparent — not a tool)
     from tools.checkpoint_manager import CheckpointManager
@@ -1602,14 +1427,7 @@ def init_agent(
     agent._memory_nudge_interval = 10
     agent._turns_since_memory = 0
     agent._iters_since_skill = 0
-    # A flush/background agent may pass skip_memory=True to avoid spinning up an
-    # external memory *provider*, but if the caller also explicitly enables the
-    # "memory" toolset it still needs the built-in file-backed store — otherwise
-    # the memory tool dispatches with store=None and every call fails (#65429).
-    # So the built-in store is created unless memory is globally disabled, while
-    # the external-provider block below stays gated on skip_memory.
-    _memory_toolset_requested = "memory" in (agent.enabled_toolsets or [])
-    if not skip_memory or _memory_toolset_requested:
+    if not skip_memory:
         try:
             mem_config = _agent_cfg.get("memory", {})
             agent._memory_enabled = mem_config.get("memory_enabled", False)
@@ -1829,89 +1647,6 @@ def init_agent(
     compression_enabled = str(_compression_cfg.get("enabled", True)).lower() in {"true", "1", "yes"}
     compression_target_ratio = float(_compression_cfg.get("target_ratio", 0.20))
     compression_protect_last = int(_compression_cfg.get("protect_last_n", 20))
-    # Minimum REAL (actionable) user messages guaranteed to survive in the
-    # uncompressed tail (compression.min_tail_user_messages).  Default 1
-    # preserves current behavior exactly — the existing single-user tail
-    # anchor.  Values > 1 extend the guarantee to the last N actionable
-    # user turns.  Booleans rejected (bool subclasses int), non-int-like
-    # values fall back to 1, floor at 1.
-    _raw_min_tail_users = _compression_cfg.get("min_tail_user_messages", 1)
-    if isinstance(_raw_min_tail_users, bool):
-        compression_min_tail_users = 1
-    elif isinstance(_raw_min_tail_users, int):
-        compression_min_tail_users = _raw_min_tail_users
-    elif isinstance(_raw_min_tail_users, float):
-        compression_min_tail_users = (
-            int(_raw_min_tail_users) if _raw_min_tail_users.is_integer() else 1
-        )
-    else:
-        try:
-            compression_min_tail_users = int(str(_raw_min_tail_users).strip())
-        except (TypeError, ValueError):
-            compression_min_tail_users = 1
-    if compression_min_tail_users < 1:
-        compression_min_tail_users = 1
-    # Cap on compression retry rounds before a turn gives up with "max
-    # compression attempts reached" (compression.max_attempts).  Hardcoding 3
-    # strands sessions that legitimately need more rounds — e.g. a restart
-    # history reload whose incompressible tool schemas keep the request
-    # estimate above the threshold even though the messages compress fine
-    # (the #62605 failure class).  Default 3 preserves current behavior, so
-    # an unset key is behavior-neutral; validated >= 1, hard-capped at 10,
-    # and any non-int-like value falls back to 3.  Booleans are rejected
-    # (bool subclasses int, so int(True) would silently become 1) and
-    # fractional floats are rejected rather than truncated — "4.7 attempts"
-    # is a config mistake, not a request for 4.
-    _raw_max_attempts = _compression_cfg.get("max_attempts", 3)
-    if isinstance(_raw_max_attempts, bool):
-        compression_max_attempts = 3
-    elif isinstance(_raw_max_attempts, int):
-        compression_max_attempts = _raw_max_attempts
-    elif isinstance(_raw_max_attempts, float):
-        compression_max_attempts = (
-            int(_raw_max_attempts) if _raw_max_attempts.is_integer() else 3
-        )
-    else:
-        try:
-            compression_max_attempts = int(str(_raw_max_attempts).strip())
-        except (TypeError, ValueError):
-            compression_max_attempts = 3
-    if compression_max_attempts < 1:
-        compression_max_attempts = 3
-    compression_max_attempts = min(compression_max_attempts, 10)
-
-    def _parse_prune_int(raw, default):
-        # Same parser semantics as compression.max_attempts above: reject
-        # booleans (bool subclasses int — YAML `true` would coerce to 1),
-        # reject fractional floats rather than truncating them, accept
-        # integral floats and numeric strings, fall back to the default on
-        # anything else.
-        if isinstance(raw, bool):
-            return default
-        if isinstance(raw, int):
-            return raw
-        if isinstance(raw, float):
-            return int(raw) if raw.is_integer() else default
-        try:
-            return int(str(raw).strip())
-        except (TypeError, ValueError):
-            return default
-
-    # Opt-in proactive tool-result prune trigger (0 = disabled — the
-    # default, so an unset key is behavior-neutral).  Negative values are
-    # treated as disabled rather than erroring.
-    compression_proactive_prune_tokens = max(
-        0, _parse_prune_int(_compression_cfg.get("proactive_prune_tokens", 0), 0)
-    )
-    compression_proactive_prune_min_chars = _parse_prune_int(
-        _compression_cfg.get("proactive_prune_min_result_chars", 8000), 8000
-    )
-    compression_proactive_prune_min_reclaim = max(
-        0,
-        _parse_prune_int(
-            _compression_cfg.get("proactive_prune_min_reclaim_tokens", 4096), 4096
-        ),
-    )
     # protect_first_n is the number of non-system messages to protect at
     # the head, in addition to the system prompt (which is always
     # implicitly protected by the compressor).  Floor at 0 — a value of
@@ -1924,29 +1659,6 @@ def init_agent(
     compression_abort_on_summary_failure = str(
         _compression_cfg.get("abort_on_summary_failure", False)
     ).lower() in {"true", "1", "yes"}
-    # Per-model threshold overrides: keys are substring-matched against the
-    # model name (longest match wins). Empty dict = use the global threshold
-    # for all models (backward compatible).
-    _raw_model_thresholds = _compression_cfg.get("model_thresholds", {})
-    if isinstance(_raw_model_thresholds, dict):
-        compression_model_thresholds = {
-            str(k): float(v) for k, v in _raw_model_thresholds.items()
-            if isinstance(v, (int, float)) and not isinstance(v, bool)
-        }
-    else:
-        compression_model_thresholds = {}
-    # Absolute token cap: when set, compression triggers at the lower of
-    # the ratio-based threshold and this absolute count. Clamped to the
-    # model's context length at apply-time so a cap above the window is
-    # a no-op (ratio-based threshold wins).
-    compression_threshold_tokens = _compression_cfg.get("threshold_tokens")
-    if compression_threshold_tokens is not None:
-        try:
-            compression_threshold_tokens = int(compression_threshold_tokens)
-            if compression_threshold_tokens <= 0:
-                compression_threshold_tokens = None
-        except (TypeError, ValueError):
-            compression_threshold_tokens = None
     # In-place compaction: when True, compress_context() rewrites the message
     # list + rebuilds the system prompt WITHOUT rotating the session id (no
     # parent_session_id chain, no `name #N` renumber). See #38763 and
@@ -1965,12 +1677,6 @@ def init_agent(
             codex_app_server_auto_compaction,
         )
         codex_app_server_auto_compaction = "native"
-    # Opt-in idle compaction: compact a session up front when it resumes after
-    # this many seconds of inactivity (0 = disabled). Time-based, so it
-    # complements the size-based threshold above. Consumed by build_turn_context().
-    compression_idle_compact_after_seconds = max(
-        0, int(_compression_cfg.get("idle_compact_after_seconds", 0))
-    )
 
     # Read optional explicit context_length override for the auxiliary
     # compression model. Custom endpoints often cannot report this via
@@ -2041,9 +1747,8 @@ def init_agent(
             )
             _config_context_length = None
 
-    # Resolve custom_providers once before route-scoping a global context pin:
-    # a named custom provider may keep its base URL only in this list rather
-    # than repeating it under ``model``.
+    # Resolve custom_providers list once for reuse below (startup
+    # context-length override and plugin context-engine init).
     try:
         from hermes_cli.config import get_compatible_custom_providers
         _custom_providers = get_compatible_custom_providers(_agent_cfg)
@@ -2052,163 +1757,6 @@ def init_agent(
         if not isinstance(_custom_providers, list):
             _custom_providers = []
 
-    # ``model.context_length`` describes the configured default model. A
-    # process launched directly with ``--model`` / ``-m`` has already replaced
-    # ``agent.model`` before this initializer loads config, so carrying the
-    # default model's explicit window into that different runtime is stale. The
-    # live switch/fallback paths already clear this override; keep direct-start
-    # overrides consistent with them and let provider metadata resolve the
-    # active model's window instead.
-    if _config_context_length is not None and isinstance(_model_cfg, dict):
-        _configured_default_model = str(_model_cfg.get("default") or "").strip()
-        _configured_default_runtime_model = _configured_default_model
-        _active_runtime_model = agent.model
-        if _configured_default_model:
-            try:
-                from hermes_cli.model_normalize import normalize_model_for_provider
-
-                _configured_default_runtime_model = normalize_model_for_provider(
-                    _configured_default_model, agent.provider
-                )
-                _active_runtime_model = normalize_model_for_provider(
-                    agent.model, agent.provider
-                )
-            except Exception:
-                pass
-        _configured_provider = str(_model_cfg.get("provider") or "").strip()
-        _configured_base_url = _normalize_route_base_url(
-            _model_cfg.get("base_url")
-        )
-        _configured_provider_norm = _normalize_custom_provider_name(
-            _configured_provider
-        )
-        _custom_provider_candidate = bool(_configured_provider_norm)
-        _runtime_first_provider_ids = {
-            "auto",
-            "moa",
-            "vertex",
-            "google-vertex",
-            "vertex-ai",
-            "gcp-vertex",
-            "vertexai",
-        }
-        if _configured_provider_norm in _runtime_first_provider_ids:
-            _custom_provider_candidate = False
-        elif (
-            _custom_provider_candidate
-            and _configured_provider_norm != "custom"
-            and not _configured_provider_norm.startswith("custom:")
-        ):
-            try:
-                from hermes_cli.auth import resolve_provider as resolve_auth_provider
-
-                _resolved_auth_provider = resolve_auth_provider(
-                    _configured_provider_norm
-                )
-                _custom_provider_candidate = (
-                    str(_resolved_auth_provider or "").strip().lower()
-                    != _configured_provider_norm
-                )
-            except Exception:
-                pass
-        if not _configured_base_url and _custom_provider_candidate:
-            _configured_custom_provider = _normalize_custom_provider_name(
-                _configured_provider
-            )
-            _user_providers = _agent_cfg.get("providers")
-            _disabled_custom_provider_ids: set[str] = set()
-            if isinstance(_user_providers, dict):
-                from hermes_cli.config import is_provider_enabled
-
-                for _provider_key, _provider_entry in _user_providers.items():
-                    if not isinstance(_provider_entry, dict):
-                        continue
-                    _entry_name = str(
-                        _provider_entry.get("name") or ""
-                    ).strip()
-                    _entry_provider_ids = _custom_provider_runtime_ids(
-                        _provider_key
-                    ) | _custom_provider_runtime_ids(_entry_name)
-                    if not is_provider_enabled(_provider_entry):
-                        _disabled_custom_provider_ids.update(
-                            provider_id
-                            for provider_id in _entry_provider_ids
-                            if provider_id
-                        )
-                        continue
-                    if _configured_custom_provider not in _entry_provider_ids:
-                        continue
-                    _configured_base_url = _normalize_route_base_url(
-                        _provider_entry.get("api")
-                        or _provider_entry.get("url")
-                        or _provider_entry.get("base_url")
-                    )
-                    if _configured_base_url:
-                        break
-            if not _configured_base_url:
-                for _provider_entry in _custom_providers:
-                    if not isinstance(_provider_entry, dict):
-                        continue
-                    _entry_name = str(
-                        _provider_entry.get("name") or ""
-                    ).strip()
-                    _entry_provider_key = str(
-                        _provider_entry.get("provider_key") or ""
-                    ).strip().lower()
-                    _entry_provider_ids = _custom_provider_runtime_ids(
-                        _entry_name
-                    ) | _custom_provider_runtime_ids(_entry_provider_key)
-                    if (
-                        _entry_provider_key
-                        and _custom_provider_runtime_ids(_entry_provider_key)
-                        & _disabled_custom_provider_ids
-                    ):
-                        continue
-                    if _configured_custom_provider not in _entry_provider_ids:
-                        continue
-                    _configured_base_url = _normalize_route_base_url(
-                        _provider_entry.get("base_url")
-                    )
-                    if _configured_base_url:
-                        break
-        _active_route_url = str(agent.base_url or "")
-        _requested_route_url = str(base_url or "")
-        if "?" in _requested_route_url.split("#", 1)[0]:
-            try:
-                _requested_parts = urlparse(_requested_route_url)
-                _requested_without_query = urlunparse(
-                    _requested_parts._replace(query="")
-                )
-                if _normalize_route_base_url(
-                    _requested_without_query
-                ) == _normalize_route_base_url(_active_route_url):
-                    _active_route_url = _requested_route_url
-            except (TypeError, ValueError):
-                pass
-        _active_base_url = _normalize_route_base_url(_active_route_url)
-        _route_mismatch = _context_route_mismatch(
-            _configured_base_url,
-            _active_base_url,
-            _configured_provider,
-            agent.provider,
-            already_normalized=True,
-        )
-        _model_mismatch = bool(
-            _configured_default_runtime_model
-            and _configured_default_runtime_model != _active_runtime_model
-        )
-        if _model_mismatch or _route_mismatch:
-            _ra().logger.debug(
-                "Ignoring model.context_length=%s for startup runtime %s at %s "
-                "(configured default is %s at %s)",
-                _config_context_length,
-                agent.model,
-                _active_base_url or agent.provider,
-                _configured_default_model,
-                _configured_base_url or _model_cfg.get("provider"),
-            )
-            _config_context_length = None
-
     # Store for reuse by _check_compression_model_feasibility (auxiliary
     # compression model context-length detection needs the same list).
     agent._custom_providers = _custom_providers
@@ -2231,11 +1779,11 @@ def init_agent(
         # Surface a clear warning if the user set a context_length but it
         # wasn't a valid positive int — the helper silently skips those.
         if _config_context_length is None:
-            _target = _normalize_route_base_url(agent.base_url)
+            _target = agent.base_url.rstrip("/") if agent.base_url else ""
             for _cp_entry in _custom_providers:
                 if not isinstance(_cp_entry, dict):
                     continue
-                _cp_url = _normalize_route_base_url(_cp_entry.get("base_url"))
+                _cp_url = (_cp_entry.get("base_url") or "").rstrip("/")
                 if _target and _cp_url == _target:
                     _cp_models = _cp_entry.get("models", {})
                     if isinstance(_cp_models, dict):
@@ -2348,16 +1896,6 @@ def init_agent(
             provider=agent.provider,
             custom_providers=_custom_providers,
         )
-        # Per-model threshold overrides are part of the explicit
-        # context-engine contract: assign them BEFORE the initial
-        # update_model() call so the first resolution (which derives
-        # threshold_percent/threshold_tokens for the initial model) already
-        # sees the overrides. Assigning after update_model() left the initial
-        # model on the engine's global threshold until the first /model
-        # switch. Engines that override update_model() own their own policy
-        # and may ignore the attribute.
-        if compression_model_thresholds:
-            agent.context_compressor.model_thresholds = compression_model_thresholds
         agent.context_compressor.update_model(
             model=agent.model,
             context_length=_plugin_ctx_len,
@@ -2384,12 +1922,6 @@ def init_agent(
             api_mode=agent.api_mode,
             abort_on_summary_failure=compression_abort_on_summary_failure,
             max_tokens=agent.max_tokens,
-            model_thresholds=compression_model_thresholds,
-            threshold_tokens_cap=compression_threshold_tokens,
-            proactive_prune_tokens=compression_proactive_prune_tokens,
-            proactive_prune_min_result_chars=compression_proactive_prune_min_chars,
-            proactive_prune_min_reclaim_tokens=compression_proactive_prune_min_reclaim,
-            min_tail_user_messages=compression_min_tail_users,
         )
     _bind_session_state = getattr(agent.context_compressor, "bind_session_state", None)
     if callable(_bind_session_state):
@@ -2400,10 +1932,6 @@ def init_agent(
     agent.compression_enabled = compression_enabled
     agent.compression_in_place = compression_in_place
     agent.codex_app_server_auto_compaction = codex_app_server_auto_compaction
-    agent.max_compression_attempts = compression_max_attempts
-    agent.compression_idle_compact_after_seconds = (
-        compression_idle_compact_after_seconds
-    )
 
     # Reject models whose context window is below the minimum required
     # for reliable tool-calling workflows (64K tokens).
@@ -2588,7 +2116,7 @@ def init_agent(
     # autoraised model) updates the marker state and re-notifies once. The
     # config display gate (compression.codex_gpt55_autoraise_notice) still
     # suppresses the banner entirely without disabling the threshold autoraise.
-    _autoraise = getattr(agent, "_compression_threshold_autoraised", None) or {}
+    _autoraise = getattr(agent, "_compression_threshold_autoraised", None)
     _show_autoraise_notice = (
         bool(_autoraise)
         and compression_enabled
@@ -2604,21 +2132,14 @@ def init_agent(
             _active_threshold_pct = getattr(
                 agent.context_compressor, "threshold_percent", compression_threshold
             )
-            _cap_note = ""
-            _cap = getattr(agent.context_compressor, "threshold_tokens_cap", None)
-            if _cap and _cap > 0:
-                _cap_note = f" (capped at {_cap:,} tokens)"
-            print(f"📊 Context limit: {agent.context_compressor.context_length:,} tokens (compress at {int(_active_threshold_pct*100)}% = {agent.context_compressor.threshold_tokens:,}{_cap_note})")
+            print(f"📊 Context limit: {agent.context_compressor.context_length:,} tokens (compress at {int(_active_threshold_pct*100)}% = {agent.context_compressor.threshold_tokens:,})")
         else:
             print(f"📊 Context limit: {agent.context_compressor.context_length:,} tokens (auto-compression disabled)")
         # Notice with the exact opt-back-out command. Printed inline at startup
         # for CLI users; gateway users get the same text replayed via
         # _compression_warning on turn 1 (set below).
         if _show_autoraise_notice:
-            print(_build_codex_gpt5_autoraise_notice(
-                _autoraise,
-                context_length=getattr(agent.context_compressor, "context_length", None),
-            ))
+            print(_build_codex_gpt5_autoraise_notice(_autoraise))
 
     # Check immediately so CLI users see the warning at startup.
     # Gateway status_callback is not yet wired, so any warning is stored
@@ -2628,10 +2149,7 @@ def init_agent(
     # above only reaches the CLI, so stash the same text here to be replayed
     # through status_callback on the first turn (Telegram/Discord/Slack/etc.).
     if _show_autoraise_notice:
-        agent._compression_warning = _build_codex_gpt5_autoraise_notice(
-            _autoraise,
-            context_length=getattr(agent.context_compressor, "context_length", None),
-        )
+        agent._compression_warning = _build_codex_gpt5_autoraise_notice(_autoraise)
 
     # Mark shown so repeated inits in this profile (e.g. every gateway message)
     # stay silent. Recorded once, whether the notice went to the CLI print or
@@ -2654,7 +2172,6 @@ def init_agent(
     agent._primary_runtime = {
         "model": agent.model,
         "provider": agent.provider,
-        "requested_provider": agent.requested_provider,
         "base_url": agent.base_url,
         "api_mode": agent.api_mode,
         "api_key": getattr(agent, "api_key", ""),

agent/agent_runtime_helpers.py

@@ -26,11 +26,10 @@ import copy
 import json
 import logging
 import re
-import threading
 import time
 from datetime import datetime
 from pathlib import Path
-from typing import Any, Dict, List, Optional, Tuple
+from typing import Any, Dict, List, Optional
 
 from hermes_cli.timeouts import get_provider_request_timeout
 from agent.prompt_builder import format_steer_marker
@@ -38,7 +37,6 @@ from agent.tool_dispatch_helpers import _trajectory_normalize_msg, make_tool_res
 from agent.trajectory import convert_scratchpad_to_think
 from agent.credential_pool import STATUS_EXHAUSTED
 from agent.error_classifier import FailoverReason
-from agent.turn_context import drop_stale_api_content
 from utils import base_url_host_matches, base_url_hostname, env_var_enabled, atomic_json_write
 
 logger = logging.getLogger(__name__)
@@ -248,7 +246,7 @@ def sanitize_tool_call_arguments(
     messages: list,
     *,
     logger=None,
-    session_id: str = None,
+    session_id: str | None = None,
 ) -> int:
     """Repair corrupted assistant tool-call argument JSON in-place."""
     log = logger or logging.getLogger(__name__)
@@ -359,25 +357,9 @@ def sanitize_tool_call_arguments(
     return repaired
 
 
-# Session-scoped in-flight registry backing note_turn_start's cross-agent
-# check.  The per-agent marker catches a second turn on the SAME AIAgent
-# object, but the gateway caches agents per *routing key* (``_agent_cache``
-# in gateway/run.py) while the durable transcript is keyed by *session_id* —
-# and the key→id mapping is many-to-one (``switch_session``: /resume from a
-# second chat/topic, CLI-continuity rebinding, async-delegation pinning,
-# topic-binding tip-walks).  Two routing keys mapped to one session_id run
-# concurrent turns on two different agent objects, which per-agent state can
-# never see (#64934).  Keyed by session_id so that route produces the same
-# named warning.  Process-local by design — same visibility scope as the
-# per-agent marker it extends.
-_INFLIGHT_TURNS_BY_SESSION: Dict[str, Tuple[str, float]] = {}
-_INFLIGHT_TURNS_LOCK = threading.Lock()
-
-
 def note_turn_start(agent, turn_id: str):
-    """Tripwire: detect a turn starting while a previous turn of the same
-    agent — or of the same underlying *session* on a different agent object —
-    has not completed its turn-end persist.
+    """Tripwire: detect a turn starting while the previous turn of the SAME
+    agent/session has not completed its turn-end persist.
 
     Two turns interleaving on one session corrupt the durable transcript:
     their flushes race (user rows can persist out of arrival order), a row
@@ -394,7 +376,6 @@ def note_turn_start(agent, turn_id: str):
     prev_started = getattr(agent, "_inflight_turn_started", 0.0)
     agent._inflight_turn_id = turn_id
     agent._inflight_turn_started = time.time()
-    overlap = None
     if prev and prev != turn_id:
         logger.warning(
             "turn %s starting while turn %s (started %.0fs ago) has not "
@@ -405,39 +386,8 @@ def note_turn_start(agent, turn_id: str):
             time.time() - prev_started if prev_started else -1.0,
             getattr(agent, "session_id", None) or "-",
         )
-        overlap = prev
-
-    # Cross-agent leg: same session_id in flight under a different agent
-    # object means two routing keys resolve to one durable session — the
-    # busy guard (keyed by routing key) cannot see this overlap at all.
-    # Persist-disabled agents (background-review forks) deliberately share
-    # the live parent's session_id for prompt-cache warmth but can never
-    # write to the transcript — they must not register here (would warn a
-    # false overlap against the parent's real turn) nor pop the parent's
-    # slot at their persist (note_turn_persisted skips them symmetrically).
-    session_id = getattr(agent, "session_id", None)
-    if session_id and not getattr(agent, "_persist_disabled", False):
-        now = time.time()
-        with _INFLIGHT_TURNS_LOCK:
-            entry = _INFLIGHT_TURNS_BY_SESSION.get(session_id)
-            _INFLIGHT_TURNS_BY_SESSION[session_id] = (turn_id, now)
-        # Stamp the session id this turn registered under: compression can
-        # rotate agent.session_id mid-turn, and the persist-time clear must
-        # pop the slot the turn actually holds, not the rotated id.
-        agent._inflight_turn_session_id = session_id
-        if entry and entry[0] not in (turn_id, prev):
-            logger.warning(
-                "turn %s starting while turn %s (started %.0fs ago) is still "
-                "in flight on session %s under a different agent object — "
-                "two routing keys are mapped to one session_id; concurrent "
-                "turns on one session; transcript writes may interleave",
-                turn_id,
-                entry[0],
-                now - entry[1] if entry[1] else -1.0,
-                session_id,
-            )
-            overlap = overlap or entry[0]
-    return overlap
+        return prev
+    return None
 
 
 def note_turn_persisted(agent):
@@ -448,18 +398,6 @@ def note_turn_persisted(agent):
     and the tripwire under-reports instead of double-reporting. A diagnostic
     must never be noisier than the defect it hunts."""
     agent._inflight_turn_id = None
-    # Symmetric with note_turn_start's cross-agent leg: persist-disabled
-    # forks never registered a session slot, and their persist funnel still
-    # runs — popping here would steal the live parent turn's slot and make
-    # the tripwire under-report the real overlap it exists to catch.
-    if not getattr(agent, "_persist_disabled", False):
-        session_id = getattr(agent, "_inflight_turn_session_id", None) or getattr(
-            agent, "session_id", None
-        )
-        if session_id:
-            with _INFLIGHT_TURNS_LOCK:
-                _INFLIGHT_TURNS_BY_SESSION.pop(session_id, None)
-    agent._inflight_turn_session_id = None
 
 
 def repair_message_sequence(agent, messages: List[Dict]) -> int:
@@ -530,12 +468,6 @@ def repair_message_sequence(agent, messages: List[Dict]) -> int:
             or m.get("finish_reason") == "incomplete"
         )
 
-    def _is_verification_candidate(m: Dict) -> bool:
-        return m.get("finish_reason") in {
-            "verification_required",
-            "verify_hook_continue",
-        }
-
     collapsed: List[Dict] = []
     for msg in messages:
         if (
@@ -548,16 +480,6 @@ def repair_message_sequence(agent, messages: List[Dict]) -> int:
             and not _is_codex_interim(collapsed[-1])
         ):
             prev = collapsed[-1]
-            # Verification candidate collapsing: when the earlier assistant
-            # message is a provisional candidate (finish_reason =
-            # verification_required / verify_hook_continue), the later
-            # response supersedes it for model replay — replace rather than
-            # union. Both remain durable in state.db; this only affects the
-            # in-memory sequence sent to the model. (#65919 §7)
-            if _is_verification_candidate(prev):
-                collapsed[-1] = msg
-                repairs += 1
-                continue
             # Union tool_calls (preserve order, both may carry them).
             prev_calls = list(prev.get("tool_calls") or [])
             new_calls = list(msg.get("tool_calls") or [])
@@ -665,10 +587,6 @@ def repair_message_sequence(agent, messages: List[Dict]) -> int:
                     if prev_content and new_content
                     else (prev_content or new_content)
                 )
-                # Merged content invalidates the api_content sidecar (exact
-                # bytes previously sent for the pre-merge message) — drop it
-                # so replay can't substitute stale bytes.
-                drop_stale_api_content(prev)
                 repairs += 1
                 continue
         merged.append(msg)
@@ -725,16 +643,16 @@ def strip_think_blocks(agent, content: str) -> str:
     """Remove reasoning/thinking blocks from content, returning only visible text.
 
     Handles four cases:
-      1. Closed tag pairs (`` <think>… ``) — the common path when
+      1. Closed tag pairs (``<think>…</think>``) — the common path when
          the provider emits complete reasoning blocks.
       2. Unterminated open tag at a block boundary (start of text or
          after a newline) — e.g. MiniMax M2.7 / NIM endpoints where the
          closing tag is dropped.  Everything from the open tag to end
          of string is stripped.  The block-boundary check mirrors
          ``gateway/stream_consumer.py``'s filter so models that mention
-         `` <think>`` in prose aren't over-stripped.
+         ``<think>`` in prose aren't over-stripped.
       3. Stray orphan open/close tags that slip through.
-      4. Tag variants: `` <think>``, ``<thinking>``, ``<reasoning>``,
+      4. Tag variants: ``<think>``, ``<thinking>``, ``<reasoning>``,
          ``<REASONING_SCRATCHPAD>``, ``<thought>`` (Gemma 4), all
          case-insensitive.
 
@@ -754,39 +672,6 @@ def strip_think_blocks(agent, content: str) -> str:
     """
     if not content:
         return ""
-    # Coerce non-string content to text before any regex runs.  Providers
-    # that return assistant ``content`` as a list of blocks (Anthropic via
-    # OpenRouter emits ``[{"type":"text",...}, {"type":"thinking",...}]``) or
-    # as a dict flow into this shared helper from several callers — most
-    # notably ``_interim_assistant_visible_text`` reading a *stored* history
-    # message whose content was persisted as a list.  A raw list/dict reaching
-    # ``re.sub`` below raises ``TypeError: expected string or bytes-like
-    # object, got 'list'``, which the outer conversation loop swallows and
-    # retries forever (observed as an infinite "preparing terminal…" loop on
-    # Anthropic models via OpenRouter).  Flatten here so every caller is safe.
-    if not isinstance(content, str):
-        if isinstance(content, list):
-            _parts: list[str] = []
-            for _part in content:
-                if isinstance(_part, str):
-                    _parts.append(_part)
-                elif isinstance(_part, dict):
-                    _ptype = str(_part.get("type") or "").strip().lower()
-                    # Drop reasoning/thinking blocks outright — this function's
-                    # whole job is to strip them, and their text lives under
-                    # different keys ("thinking", "reasoning") per provider.
-                    if _ptype in {"thinking", "reasoning", "redacted_thinking"}:
-                        continue
-                    _text = _part.get("text")
-                    if isinstance(_text, str) and _text:
-                        _parts.append(_text)
-            content = "".join(_parts)
-        elif isinstance(content, dict):
-            content = str(content.get("text") or content.get("content") or "")
-        else:
-            content = str(content)
-        if not content:
-            return ""
     # 1. Closed tag pairs — case-insensitive for all variants so
     #    mixed-case tags (<THINK>, <Thinking>) don't slip through to
     #    the unterminated-tag pass and take trailing content with them.
@@ -850,25 +735,6 @@ def strip_think_blocks(agent, content: str) -> str:
 
 
 
-def sync_credential_pool_entry_id(agent) -> None:
-    """Rebind ``agent._credential_pool_entry_id`` from the current pool + key.
-
-    OAuth refreshes can replace the runtime token before a failed request is
-    recovered, so the mutable API-key value alone cannot reliably attribute
-    the failure to its source entry.  This resolves the stable pool-entry ID
-    for the agent's current ``api_key`` and clears it when no pool is bound.
-    """
-    pool = getattr(agent, "_credential_pool", None)
-    try:
-        agent._credential_pool_entry_id = (
-            pool.entry_id_for_api_key(getattr(agent, "api_key", None))
-            if pool is not None
-            else None
-        )
-    except Exception:
-        agent._credential_pool_entry_id = None
-
-
 def recover_with_credential_pool(
     agent,
     *,
@@ -941,43 +807,6 @@ def recover_with_credential_pool(
             )
             return False, has_retried_429
 
-    # Attribute the failure to the API key the agent actually dispatched the
-    # request with, not to pool.current(). The current() pointer is shared,
-    # mutable state — round-robin select() advances it on every call, and
-    # concurrent turns or a second process (gateway/dashboard) reloading the
-    # pool reset it to None — so by the time recovery runs it routinely points
-    # at a DIFFERENT, healthy entry. Marking that entry exhausted copies this
-    # request's error/reset time onto it and can take the whole pool offline
-    # from a single rate-limited key (#43747). ``_swap_credential`` keeps
-    # ``agent.api_key`` in sync with the entry in use, so it identifies the
-    # failing entry exactly; fall back to current()'s key only when the agent
-    # carries no key at all.
-    _api_key_hint = getattr(agent, "api_key", None) or None
-    _raw_credential_id = getattr(agent, "_credential_pool_entry_id", None)
-    _credential_id = (
-        _raw_credential_id
-        if isinstance(_raw_credential_id, str) and _raw_credential_id
-        else None
-    )
-    if not _api_key_hint:
-        _cur = pool.current()
-        if _cur:
-            _api_key_hint = getattr(_cur, "runtime_api_key", None)
-            if not _credential_id:
-                _current_id = getattr(_cur, "id", None)
-                if isinstance(_current_id, str) and _current_id:
-                    _credential_id = _current_id
-
-    def _rotate_failed_credential(rotate_status: int):
-        kwargs = {
-            "status_code": rotate_status,
-            "error_context": error_context,
-            "api_key_hint": _api_key_hint,
-        }
-        if _credential_id:
-            kwargs["credential_id"] = _credential_id
-        return pool.mark_exhausted_and_rotate(**kwargs)
-
     effective_reason = classified_reason
     if effective_reason is None:
         if status_code == 402:
@@ -1008,10 +837,14 @@ def recover_with_credential_pool(
 
     if effective_reason == FailoverReason.billing:
         rotate_status = status_code if status_code is not None else 402
-        # Runtime credentials can be resolved by a separate pool instance,
-        # leaving this recovery pool without ``current_id``. Match the key
-        # that actually failed instead of quarantining a different account.
-        next_entry = _rotate_failed_credential(rotate_status)
+        next_entry = pool.mark_exhausted_and_rotate(
+            status_code=rotate_status,
+            error_context=error_context,
+            # Runtime credentials can be resolved by a separate pool instance,
+            # leaving this recovery pool without ``current_id``. Match the key
+            # that actually failed instead of quarantining a different account.
+            api_key_hint=getattr(agent, "api_key", None),
+        )
         if next_entry is not None:
             _ra().logger.info(
                 "Credential %s (billing) — rotated to pool entry %s",
@@ -1027,21 +860,7 @@ def recover_with_credential_pool(
         # rotate immediately. This prevents the "cancel-between-429s" trap
         # where has_retried_429 (a local var) gets reset on each new prompt,
         # causing the pool to retry the same exhausted credential forever.
-        # Prefer the entry matching the failing key over the shared current()
-        # pointer, for the same attribution reason as above.
-        current_entry = None
-        if _credential_id:
-            current_entry = next(
-                (e for e in pool.entries() if e.id == _credential_id),
-                None,
-            )
-        if _api_key_hint:
-            current_entry = current_entry or next(
-                (e for e in pool.entries() if e.runtime_api_key == _api_key_hint),
-                None,
-            )
-        if current_entry is None:
-            current_entry = pool.current()
+        current_entry = pool.current()
         current_last_status = getattr(current_entry, "last_status", None) if current_entry else None
         if current_last_status == STATUS_EXHAUSTED:
             _ra().logger.info(
@@ -1049,7 +868,7 @@ def recover_with_credential_pool(
                 current_last_status,
             )
             rotate_status = status_code if status_code is not None else 429
-            next_entry = _rotate_failed_credential(rotate_status)
+            next_entry = pool.mark_exhausted_and_rotate(status_code=rotate_status, error_context=error_context)
             if next_entry is not None:
                 _ra().logger.info(
                     "Credential %s (rate limit, pre-exhausted) — rotated to pool entry %s",
@@ -1073,7 +892,7 @@ def recover_with_credential_pool(
         if not has_retried_429 and not usage_limit_reached:
             return False, True
         rotate_status = status_code if status_code is not None else 429
-        next_entry = _rotate_failed_credential(rotate_status)
+        next_entry = pool.mark_exhausted_and_rotate(status_code=rotate_status, error_context=error_context)
         if next_entry is not None:
             _ra().logger.info(
                 "Credential %s (rate limit) — rotated to pool entry %s",
@@ -1088,7 +907,7 @@ def recover_with_credential_pool(
         # Subscription/entitlement 403s look like auth failures on the wire
         # but refresh cannot fix them — the OAuth token is already valid,
         # the account simply lacks the entitlement.  Without this guard,
-        # the refresh path keeps minting fresh tokens against the
+        # ``try_refresh_current()`` keeps minting fresh tokens against the
         # same unsubscribed account and the main agent loop spins re-issuing
         # the same 403 until the user Ctrl+C's.
         #
@@ -1141,16 +960,9 @@ def recover_with_credential_pool(
                 agent.provider or "provider",
             )
             return False, has_retried_429
-        # Refresh the entry that supplied the failing key, not current():
-        # the shared pointer can reference a different, healthy entry, and
-        # refreshing it would consume that entry's single-use refresh token
-        # (or mark it exhausted on failure) for a failure it never had.
-        refresh_kwargs = {"api_key_hint": _api_key_hint}
-        if _credential_id:
-            refresh_kwargs["credential_id"] = _credential_id
-        refreshed = pool.try_refresh_matching(**refresh_kwargs)
+        refreshed = pool.try_refresh_current()
         if refreshed is not None:
-            # ``try_refresh_matching()`` re-mints a fresh OAuth token and reports
+            # ``try_refresh_current()`` re-mints a fresh OAuth token and reports
             # success even when the upstream keeps rejecting it — a single-entry
             # pool (common for OAuth/Max subscribers) has nothing to rotate to,
             # so a bare "refreshed → retry" loop spins forever on the same dead
@@ -1178,9 +990,9 @@ def recover_with_credential_pool(
             agent._swap_credential(refreshed)
             return True, has_retried_429
         # Refresh failed — rotate to next credential instead of giving up.
-        # The failed entry is already marked exhausted by the refresh attempt.
+        # The failed entry is already marked exhausted by try_refresh_current().
         rotate_status = status_code if status_code is not None else 401
-        next_entry = _rotate_failed_credential(rotate_status)
+        next_entry = pool.mark_exhausted_and_rotate(status_code=rotate_status, error_context=error_context)
         if next_entry is not None:
             _ra().logger.info(
                 "Credential %s (auth refresh failed) — rotated to pool entry %s",
@@ -1225,17 +1037,11 @@ def try_recover_primary_transport(
         return False
 
     try:
-        # Retire the existing client to release stale connections. #70773:
-        # never hard-close the shared client here — this runs on the
-        # conversation-loop thread while workers from stale-killed streaming
-        # attempts may still be unwinding their SSL BIOs on the old pool.
-        # ``_retire_shared_openai_client`` shuts the sockets down (FD-safe
-        # from any thread) and defers the FD release to GC, which cannot
-        # complete until every borrowing thread has unwound.
+        # Close existing client to release stale connections
         if getattr(agent, "client", None) is not None:
             try:
-                agent._retire_shared_openai_client(
-                    agent.client, reason="primary_recovery",
+                agent._close_openai_client(
+                    agent.client, reason="primary_recovery", shared=True,
                 )
             except Exception:
                 pass
@@ -1245,7 +1051,6 @@ def try_recover_primary_transport(
         agent._client_kwargs = dict(rt["client_kwargs"])
         agent.model = rt["model"]
         agent.provider = rt["provider"]
-        agent.requested_provider = rt.get("requested_provider", agent.provider)
         agent.base_url = rt["base_url"]
         agent.api_mode = rt["api_mode"]
         if hasattr(agent, "_transport_cache"):
@@ -1262,14 +1067,6 @@ def try_recover_primary_transport(
             )
             agent._is_anthropic_oauth = rt["is_anthropic_oauth"]
             agent.client = None
-        elif (agent.provider or "").strip().lower() == "moa":
-            # MoA is a virtual provider with empty client_kwargs — rebuilding
-            # via _create_openai_client would raise "api_key client option
-            # must be set". Recreate the facade through the shared factory so
-            # the reference_callback relay survives recovery (#53802).
-            from agent.moa_loop import build_moa_facade
-
-            agent.client = build_moa_facade(agent, agent.model)
         else:
             agent.client = agent._create_openai_client(
                 dict(rt["client_kwargs"]),
@@ -1417,7 +1214,6 @@ def restore_primary_runtime(agent) -> bool:
         # ── Core runtime state ──
         agent.model = rt["model"]
         agent.provider = rt["provider"]
-        agent.requested_provider = rt.get("requested_provider", agent.provider)
         agent.base_url = rt["base_url"]           # setter updates _base_url_lower
         agent.api_mode = rt["api_mode"]
         if hasattr(agent, "_transport_cache"):
@@ -1433,18 +1229,7 @@ def restore_primary_runtime(agent) -> bool:
         )
 
         # ── Rebuild client for the primary provider ──
-        if agent.provider == "moa":
-            # MoA is a virtual chat-completions provider.  It never has real
-            # OpenAI client kwargs; restoring it after a fallback must recreate
-            # the facade, not call OpenAI() with an empty api_key.  Use the
-            # shared factory so the restored facade keeps the reference_callback
-            # relay wired at init — a bare MoAClient() would silently stop
-            # emitting moa.reference/moa.aggregating display events (#53802).
-            from agent.moa_loop import build_moa_facade
-
-            agent.client = build_moa_facade(agent, agent.model)
-            agent._anthropic_client = None
-        elif agent.api_mode == "anthropic_messages":
+        if agent.api_mode == "anthropic_messages":
             from agent.anthropic_adapter import build_anthropic_client
             agent._anthropic_api_key = rt["anthropic_api_key"]
             agent._anthropic_base_url = rt["anthropic_base_url"]
@@ -1497,7 +1282,6 @@ def restore_primary_runtime(agent) -> bool:
                 pool_matches_primary = False
         if pool is not None and pool_provider and not pool_matches_primary:
             agent._credential_pool = None
-            agent._credential_pool_entry_id = None
             try:
                 from agent.credential_pool import load_pool
 
@@ -1517,7 +1301,6 @@ def restore_primary_runtime(agent) -> bool:
         # the pool for its current best entry and swap the live credential in.
         # When the pool is absent, empty, or the entry has no usable key, we
         # keep the snapshot key (the existing behavior).  Fixes #25205.
-        agent._credential_pool_entry_id = None
         pool = getattr(agent, "_credential_pool", None)
         if pool is not None and pool.has_available():
             entry = pool.select()
@@ -2095,7 +1878,6 @@ def switch_model(agent, new_model, new_provider, api_key='', base_url='', api_mo
         for name in (
             "model",
             "provider",
-            "requested_provider",
             "base_url",
             "api_mode",
             "api_key",
@@ -2114,9 +1896,6 @@ def switch_model(agent, new_model, new_provider, api_key='', base_url='', api_mo
     # restore the original pool (issue #52727: pool reload is part of this
     # switch and must be reversible on rollback).
     _snapshot["_credential_pool"] = getattr(agent, "_credential_pool", _MISSING)
-    _snapshot["_credential_pool_entry_id"] = getattr(
-        agent, "_credential_pool_entry_id", _MISSING
-    )
 
     try:
         # Clear the per-config context_length override so the new model's
@@ -2127,7 +1906,6 @@ def switch_model(agent, new_model, new_provider, api_key='', base_url='', api_mo
         # ── Swap core runtime fields ──
         agent.model = new_model
         agent.provider = new_provider
-        agent.requested_provider = new_provider
         # Use the new base_url when provided. When it's empty AND the
         # provider is actually changing, do NOT fall back to the current
         # (old provider's) URL — that silently pairs the new provider label
@@ -2173,7 +1951,6 @@ def switch_model(agent, new_model, new_provider, api_key='', base_url='', api_mo
             # A pool bound to the old provider is worse than no pool: the
             # recovery guard rejects it and every later 401/429 skips rotation.
             agent._credential_pool = None
-            agent._credential_pool_entry_id = None
             try:
                 from agent.credential_pool import load_pool
                 agent._credential_pool = load_pool(new_provider)
@@ -2183,9 +1960,10 @@ def switch_model(agent, new_model, new_provider, api_key='', base_url='', api_mo
                     "continuing without pool rotation this turn",
                     new_provider, _pool_exc,
                 )
+
         # ── Build new client ──
         if (new_provider or "").strip().lower() == "moa":
-            from agent.moa_loop import build_moa_facade
+            from agent.moa_loop import MoAClient
 
             # The MoA virtual provider speaks only chat.completions via the
             # MoAClient facade — the aggregator's real transport
@@ -2202,7 +1980,7 @@ def switch_model(agent, new_model, new_provider, api_key='', base_url='', api_mo
             agent.api_key = api_key or "moa-virtual-provider"
             agent.base_url = "moa://local"
             agent._client_kwargs = {}
-            agent.client = build_moa_facade(agent, agent.model)
+            agent.client = MoAClient(agent.model or "default")
         elif api_mode == "anthropic_messages":
             from agent.anthropic_adapter import (
                 build_anthropic_client,
@@ -2278,8 +2056,6 @@ def switch_model(agent, new_model, new_provider, api_key='', base_url='', api_mo
                 reason="switch_model",
                 shared=True,
             )
-
-        sync_credential_pool_entry_id(agent)
     except Exception:
         # Rollback every mutated field to the pre-swap snapshot so the agent
         # is left consistent (old model + old provider + old client) and the
@@ -2379,7 +2155,6 @@ def switch_model(agent, new_model, new_provider, api_key='', base_url='', api_mo
     agent._primary_runtime = {
         "model": agent.model,
         "provider": agent.provider,
-        "requested_provider": agent.requested_provider,
         "base_url": agent.base_url,
         "api_mode": agent.api_mode,
         "api_key": getattr(agent, "api_key", ""),

agent/anthropic_adapter.py

@@ -127,8 +127,6 @@ _FAST_MODE_SUPPORTED_SUBSTRINGS = ("opus-4-6", "opus-4.6")
 _ANTHROPIC_OUTPUT_LIMITS = {
     # Mythos-class named models (claude-fable-5, …) — 1M context, reasoning
     "claude-fable":      128_000,
-    # Claude Sonnet 5
-    "claude-sonnet-5":   128_000,
     # Claude 4.8
     "claude-opus-4-8":   128_000,
     # Claude 4.7
@@ -249,13 +247,7 @@ def _supports_adaptive_thinking(model: str) -> bool:
     only returns False for the explicit legacy list of older Claude families
     that require manual budget-based thinking. Non-Claude Anthropic-Messages
     models (minimax, qwen3, …) return False so they keep the manual path.
-
-    Kimi / Moonshot models are the exception: their Anthropic-compatible
-    endpoints implement the adaptive contract (``thinking.type="adaptive"``
-    + ``output_config.effort``, including ``xhigh`` and ``display``).
     """
-    if _model_name_is_kimi_family(model):
-        return True
     if not _is_claude_model(model):
         return False
     m = model.lower()
@@ -368,7 +360,7 @@ def _detect_claude_code_version() -> str:
         try:
             result = _sp.run(
                 [cmd, "--version"],
-                capture_output=True, text=True, encoding='utf-8', errors='replace', timeout=5,
+                capture_output=True, text=True, timeout=5,
             )
             if result.returncode == 0 and result.stdout.strip():
                 # Output is like "2.1.74 (Claude Code)" or just "2.1.74"
@@ -457,8 +449,7 @@ def _is_kimi_coding_endpoint(base_url: str | None) -> bool:
 
 # Model-name prefixes that identify the Kimi / Moonshot family.  Covers
 # - official slugs: ``kimi-k2.5``, ``kimi_thinking``, ``moonshot-v1-8k``
-# - common release lines: ``k1.5-...``, ``k2-thinking``, ``k25-...``, ``k2.5-...``,
-#   and the bare Coding Plan slug ``k3`` (plus ``k3.x``/``k3-...`` variants)
+# - common release lines: ``k1.5-...``, ``k2-thinking``, ``k25-...``, ``k2.5-...``
 # Matched case-insensitively against the post-``normalize_model_name`` form,
 # so a caller's ``provider/vendor/model`` slug is handled the same as a
 # bare name.
@@ -468,14 +459,8 @@ _KIMI_FAMILY_MODEL_PREFIXES = (
     "k1.", "k1-",
     "k2.", "k2-",
     "k25", "k2.5",
-    "k3.", "k3-",
 )
 
-# Bare release slugs with no separator suffix (Kimi Coding Plan serves K3
-# as the exact slug ``k3``). Kept exact-match so unrelated model names that
-# merely start with the same characters don't get misclassified.
-_KIMI_FAMILY_EXACT_SLUGS = frozenset({"k3"})
-
 
 def _model_name_is_kimi_family(model: str | None) -> bool:
     if not isinstance(model, str):
@@ -486,8 +471,6 @@ def _model_name_is_kimi_family(model: str | None) -> bool:
     # Strip vendor prefix (e.g. ``moonshotai/kimi-k2.5`` → ``kimi-k2.5``)
     if "/" in m:
         m = m.rsplit("/", 1)[-1]
-    if m in _KIMI_FAMILY_EXACT_SLUGS:
-        return True
     return m.startswith(_KIMI_FAMILY_MODEL_PREFIXES)
 
 
@@ -650,8 +633,8 @@ def _common_betas_for_base_url(
 
 def _build_anthropic_client_with_bearer_hook(
     token_provider,
-    base_url: str = None,
-    timeout: float = None,
+    base_url: str | None = None,
+    timeout: float | None = None,
     *,
     drop_context_1m_beta: bool = False,
 ):
@@ -726,8 +709,8 @@ def _build_anthropic_client_with_bearer_hook(
 
 def build_anthropic_client(
     api_key,
-    base_url: str = None,
-    timeout: float = None,
+    base_url: str | None = None,
+    timeout: float | None = None,
     *,
     drop_context_1m_beta: bool = False,
 ):
@@ -914,7 +897,7 @@ def _read_claude_code_credentials_from_keychain() -> Optional[Dict[str, Any]]:
              "-s", "Claude Code-credentials",
              "-w"],
             capture_output=True,
-            text=True, encoding='utf-8', errors='replace',
+            text=True,
             timeout=5,
             stdin=subprocess.DEVNULL,
         )
@@ -1591,10 +1574,7 @@ def _is_bedrock_model_id(model: str) -> bool:
     """
     lower = model.lower()
     # Regional inference-profile prefixes
-    if any(lower.startswith(p) for p in (
-        "global.", "us.", "eu.", "apac.", "ap.", "au.", "jp.",
-        "ca.", "sa.", "me.", "af.",
-    )):
+    if any(lower.startswith(p) for p in ("global.", "us.", "eu.", "ap.", "jp.")):
         return True
     # Bare Bedrock model IDs: provider.model-family
     if lower.startswith("anthropic."):
@@ -1881,28 +1861,6 @@ def _content_parts_to_anthropic_blocks(parts: Any) -> List[Dict[str, Any]]:
     return out
 
 
-_EMPTY_TEXT_PLACEHOLDER = "(empty)"
-
-
-def _safe_text(text: Any) -> str:
-    """Return ``text`` if it's non-whitespace, else a non-whitespace placeholder.
-
-    The Anthropic Messages API rejects requests where a text content block is
-    empty or whitespace-only (HTTP 400 "text content blocks must contain
-    non-whitespace text"). When such a block gets stored in session history —
-    e.g. produced by context compression — it is replayed verbatim on every
-    subsequent turn, permanently wedging the session. Coercing to a
-    non-whitespace placeholder is self-healing: the next API call recovers.
-
-    Mirrors ``bedrock_adapter._safe_text`` (#9486); ref #69512.
-    """
-    if text is None:
-        return _EMPTY_TEXT_PLACEHOLDER
-    if not isinstance(text, str):
-        text = str(text)
-    return text if text.strip() else _EMPTY_TEXT_PLACEHOLDER
-
-
 def _sanitize_replay_block(b: Dict[str, Any]) -> Optional[Dict[str, Any]]:
     """Strip output-only fields from a stored Anthropic content block so it is
     valid as REQUEST input on replay.
@@ -1920,18 +1878,7 @@ def _sanitize_replay_block(b: Dict[str, Any]) -> Optional[Dict[str, Any]]:
         return None
     btype = b.get("type")
     if btype == "text":
-        text_val = b.get("text", "")
-        # Bedrock and strict Anthropic-compatible endpoints reject text
-        # blocks where "text" is empty or whitespace-only (#69512). Drop the
-        # blank block (the caller relocates any cache_control it carried and
-        # falls back to a non-whitespace placeholder when nothing survives)
-        # rather than coercing in place — a coerced "(empty)" block would be
-        # model-visible noise next to surviving thinking/tool_use blocks.
-        # Type-safe: captured blocks can carry text=None from an invalid
-        # upstream payload, which a bare .strip() would crash on.
-        if not isinstance(text_val, str) or not text_val.strip():
-            return None
-        out: Dict[str, Any] = {"type": "text", "text": text_val}
+        out: Dict[str, Any] = {"type": "text", "text": b.get("text", "")}
         # citations is input-valid ONLY when it's a non-empty list; the SDK
         # emits citations=None on responses, which the input schema rejects.
         cits = b.get("citations")
@@ -2019,17 +1966,9 @@ def _convert_assistant_message(m: Dict[str, Any]) -> Dict[str, Any]:
                 parsed_args = {}
             redacted_input_by_id[_sanitize_tool_id(tc.get("id", ""))] = parsed_args
         replayed: List[Dict[str, Any]] = []
-        _relocated_replay_cache_control = None
-        _dropped_blank_text = False
         for b in ordered_blocks:
             clean = _sanitize_replay_block(b)
             if clean is None:
-                if isinstance(b, dict) and b.get("type") == "text":
-                    _dropped_blank_text = True
-                if isinstance(b, dict) and isinstance(b.get("cache_control"), dict):
-                    # A dropped blank text block can still carry the cache
-                    # breakpoint marker -- relocate it rather than losing it.
-                    _relocated_replay_cache_control = b["cache_control"]
                 continue
             if clean.get("type") == "tool_use":
                 # Override raw (un-redacted) input with the redacted copy when
@@ -2039,68 +1978,20 @@ def _convert_assistant_message(m: Dict[str, Any]) -> Dict[str, Any]:
                 if redacted is not None:
                     clean["input"] = redacted
             replayed.append(clean)
-        # When every text block was blank and nothing cacheable survived
-        # (e.g. signed thinking + a blank text block, or a SOLE blank
-        # cache-marked block), emit the non-whitespace placeholder so the
-        # replayed message stays schema-valid (#69512) and a relocated cache
-        # marker still has a carrier instead of being silently lost.
-        _has_cacheable_replay = any(
-            isinstance(b, dict) and b.get("type") in {"text", "tool_use"}
-            for b in replayed
-        )
-        if not _has_cacheable_replay and (
-            _dropped_blank_text or _relocated_replay_cache_control is not None
-        ):
-            replayed.append({"type": "text", "text": _EMPTY_TEXT_PLACEHOLDER})
         if replayed:
-            if _relocated_replay_cache_control is not None:
-                _apply_assistant_cache_control_to_last_cacheable_block(
-                    replayed, _relocated_replay_cache_control
-                )
             _apply_assistant_cache_control_to_last_cacheable_block(
                 replayed, m.get("cache_control")
             )
             return {"role": "assistant", "content": replayed}
 
     blocks = _extract_preserved_thinking_blocks(m)
-    # Cache markers dropped along with a blank block are relocated onto the
-    # last surviving cacheable block below (via
-    # _apply_assistant_cache_control_to_last_cacheable_block), rather than
-    # lost -- prompt_caching.py's _apply_cache_marker() sets cache_control
-    # directly on content[-1] for list content, so if that last part happens
-    # to be blank text, dropping it silently would lose the breakpoint.
-    _relocated_cache_control = None
     if content:
         if isinstance(content, list):
             converted_content = _convert_content_to_anthropic(content)
             if isinstance(converted_content, list):
-                # Bedrock and strict Anthropic-compatible endpoints reject
-                # text blocks where "text" is empty or whitespace-only. The
-                # ordered-replay path enforces the same invariant via
-                # _sanitize_replay_block(). Type-safe against ANY invalid
-                # "text" value from an upstream payload -- None, or a
-                # truthy non-string like an int -- not just None: checking
-                # isinstance() first (rather than `blk.get("text") or ""`)
-                # means a non-string value is treated as blank/invalid
-                # instead of reaching .strip() and raising AttributeError.
-                for blk in converted_content:
-                    _blk_text = blk.get("text") if isinstance(blk, dict) else None
-                    if (
-                        isinstance(blk, dict)
-                        and blk.get("type") == "text"
-                        and (not isinstance(_blk_text, str) or not _blk_text.strip())
-                    ):
-                        if isinstance(blk.get("cache_control"), dict):
-                            _relocated_cache_control = blk["cache_control"]
-                        continue
-                    blocks.append(blk)
+                blocks.extend(converted_content)
         else:
-            # Scalar (non-list) content: a whitespace-only string is the
-            # same invalid-payload case as an empty list block -- drop it
-            # rather than emitting a blank text block.
-            text_str = str(content)
-            if text_str.strip():
-                blocks.append({"type": "text", "text": text_str})
+            blocks.append({"type": "text", "text": str(content)})
     for tc in m.get("tool_calls", []):
         if not tc or not isinstance(tc, dict):
             continue
@@ -2116,6 +2007,9 @@ def _convert_assistant_message(m: Dict[str, Any]) -> Dict[str, Any]:
             "name": fn.get("name", ""),
             "input": parsed_args,
         })
+    _apply_assistant_cache_control_to_last_cacheable_block(
+        blocks, m.get("cache_control")
+    )
     # Kimi's /coding endpoint (Anthropic protocol) requires assistant
     # tool-call messages to carry reasoning_content when thinking is
     # enabled server-side.  Preserve it as a thinking block so Kimi
@@ -2141,26 +2035,10 @@ def _convert_assistant_message(m: Dict[str, Any]) -> Dict[str, Any]:
     )
     if isinstance(reasoning_content, str) and not _already_has_thinking:
         blocks.insert(0, {"type": "thinking", "thinking": reasoning_content})
-    # Anthropic rejects empty assistant content. IMPORTANT: fall back only
-    # to the placeholder, never to the raw `content` variable -- `content`
-    # is the UNFILTERED original message content, and can itself be exactly
-    # the blank/whitespace-only payload the filtering above just removed
-    # (a sole blank text block, or scalar whitespace with no tool_calls).
-    # `blocks or content` there would silently restore the invalid provider
-    # payload this function exists to prevent (#69512).
-    effective = blocks if blocks else [{"type": "text", "text": _EMPTY_TEXT_PLACEHOLDER}]
-    # Applied here (after the empty-fallback resolution) rather than
-    # earlier against `blocks` directly, so a cache_control relocated from
-    # a dropped blank block that was the ONLY block still lands on the
-    # (empty) placeholder instead of being silently lost when blocks was
-    # empty at the point the marker would otherwise have been applied.
-    if _relocated_cache_control is not None:
-        _apply_assistant_cache_control_to_last_cacheable_block(
-            effective, _relocated_cache_control
-        )
-    _apply_assistant_cache_control_to_last_cacheable_block(
-        effective, m.get("cache_control")
-    )
+    # Anthropic rejects empty assistant content
+    effective = blocks or content
+    if not effective or effective == "":
+        effective = [{"type": "text", "text": "(empty)"}]
     return {"role": "assistant", "content": effective}
 
 
@@ -2398,6 +2276,13 @@ def _manage_thinking_signatures(
     """
     _THINKING_TYPES = frozenset(("thinking", "redacted_thinking"))
     _is_third_party = _is_third_party_anthropic_endpoint(base_url)
+    # Kimi / DeepSeek share a contract: strip signed Anthropic blocks
+    # (neither upstream can validate Anthropic signatures), preserve unsigned
+    # ones synthesised from reasoning_content.  See #13848, #16748.
+    _preserve_unsigned_thinking = (
+        _is_kimi_family_endpoint(base_url, model)
+        or _is_deepseek_anthropic_endpoint(base_url)
+    )
 
     last_assistant_idx = None
     for i in range(len(result) - 1, -1, -1):
@@ -2409,12 +2294,8 @@ def _manage_thinking_signatures(
         if m.get("role") != "assistant" or not isinstance(m.get("content"), list):
             continue
 
-        if _is_kimi_family_endpoint(base_url, model):
-            # Kimi does not enforce thinking signatures — replay as-is
-            # (shared cleanup below still strips cache markers + the internal flag).
-            pass
-        elif _is_deepseek_anthropic_endpoint(base_url):
-            # DeepSeek: strip signed, preserve unsigned.
+        if _preserve_unsigned_thinking:
+            # Kimi / DeepSeek: strip signed, preserve unsigned.
             new_content = []
             for b in m["content"]:
                 if not isinstance(b, dict) or b.get("type") not in _THINKING_TYPES:
@@ -2514,24 +2395,6 @@ def _evict_old_screenshots(result: List[Dict[str, Any]]) -> None:
                 ]
 
 
-def _ensure_leading_user_turn(result: List[Dict[str, Any]]) -> None:
-    """Anthropic requires messages[0] to have role=user.
-
-    After a second context compaction on the auto path the summary can be
-    emitted as role=assistant with nothing in front of it (the system prompt
-    lives outside messages[] or is extracted into the separate ``system``
-    param), so messages[0] ends up assistant and the Messages API rejects
-    the request with HTTP 400 — often masked by a misleading
-    "tool_use ids were found without tool_result blocks" error (#52160).
-
-    Mirror the Bedrock Converse adapter, which unconditionally prepends a
-    minimal user turn when the first message is not user
-    (convert_messages_to_converse).
-    """
-    if result and result[0].get("role") != "user":
-        result.insert(0, {"role": "user", "content": [{"type": "text", "text": " "}]})
-
-
 def convert_messages_to_anthropic(
     messages: List[Dict],
     base_url: str | None = None,
@@ -2590,7 +2453,6 @@ def convert_messages_to_anthropic(
 
     _strip_orphaned_tool_blocks(result)
     result = _merge_consecutive_roles(result)
-    _ensure_leading_user_turn(result)
     _manage_thinking_signatures(result, base_url, model)
     _evict_old_screenshots(result)
 
@@ -2765,19 +2627,25 @@ def build_anthropic_kwargs(
     # MiniMax Anthropic-compat endpoints support thinking (manual mode only,
     # not adaptive).  Haiku does NOT support extended thinking — skip entirely.
     #
-    # Kimi / Moonshot models also use adaptive thinking: their
-    # Anthropic-compatible endpoints (api.moonshot.cn/anthropic,
-    # api.kimi.com/coding) accept ``thinking.type="adaptive"`` +
-    # ``output_config.effort``, and the replay-validation 400s that
-    # originally motivated dropping the parameter (#13848) no longer
-    # occur.  (Kimi on chat_completions enables thinking via extra_body
-    # in the ChatCompletionsTransport — see #13503.)
+    # Kimi's /coding endpoint speaks the Anthropic Messages protocol but has
+    # its own thinking semantics: when ``thinking.enabled`` is sent, Kimi
+    # validates the message history and requires every prior assistant
+    # tool-call message to carry OpenAI-style ``reasoning_content``.  The
+    # Anthropic path never populates that field, and
+    # ``convert_messages_to_anthropic`` strips all Anthropic thinking blocks
+    # on third-party endpoints — so the request fails with HTTP 400
+    # "thinking is enabled but reasoning_content is missing in assistant
+    # tool call message at index N".  Kimi's reasoning is driven server-side
+    # on the /coding route, so skip Anthropic's thinking parameter entirely
+    # for that host.  (Kimi on chat_completions enables thinking via
+    # extra_body in the ChatCompletionsTransport — see #13503.)
     #
     # On 4.7+ the `thinking.display` field defaults to "omitted", which
     # silently hides reasoning text that Hermes surfaces in its CLI. We
     # request "summarized" so the reasoning blocks stay populated — matching
     # 4.6 behavior and preserving the activity-feed UX during long tool runs.
-    if reasoning_config and isinstance(reasoning_config, dict):
+    _is_kimi_coding = _is_kimi_family_endpoint(base_url, model)
+    if reasoning_config and isinstance(reasoning_config, dict) and not _is_kimi_coding:
         if reasoning_config.get("enabled") is not False and "haiku" not in model.lower():
             effort = str(reasoning_config.get("effort", "medium")).lower()
             budget = THINKING_BUDGET.get(effort, 8000)

agent/async_utils.py

@@ -66,19 +66,3 @@ def safe_schedule_threadsafe(
             coro.close()
         log.log(log_level, "%s: %s", log_message, exc)
         return None
-
-
-def consume_detached_task_result(task: "asyncio.Future[Any]") -> None:
-    """Retrieve a detached task's result without surfacing cancellation.
-
-    Used as an ``add_done_callback`` on tasks that were cancelled and
-    detached (e.g. an adapter close path that swallows ``CancelledError``
-    past its teardown deadline). Observing ``task.exception()`` prevents
-    "exception was never retrieved" noise on the event loop; cancellation
-    and any terminal error are deliberately swallowed — the task's owner
-    already gave up on it.
-    """
-    try:
-        task.exception()
-    except (asyncio.CancelledError, Exception):
-        pass

agent/auxiliary_client.py

@@ -1058,29 +1058,16 @@ class _CodexCompletionsAdapter:
         # key in extra_body (not top-level) and GitHub/Copilot Responses opts
         # out of cache-key routing entirely — for those hosts, skip it here.
         try:
-            from agent.transports.codex import (
-                _content_cache_key,
-                _default_prompt_cache_retention_for_request,
-            )
+            from agent.transports.codex import _content_cache_key
             from utils import base_url_host_matches
 
             _host_src = str(getattr(self._client, "base_url", "") or "")
             _is_xai = base_url_host_matches(_host_src, "x.ai") or base_url_host_matches(_host_src, "api.x.ai")
-            _is_github = (
-                base_url_host_matches(_host_src, "githubcopilot.com")
-                or base_url_host_matches(_host_src, "models.github.ai")
-            )
+            _is_github = base_url_host_matches(_host_src, "githubcopilot.com")
             if not _is_xai and not _is_github and "prompt_cache_key" not in resp_kwargs:
                 _cache_key = _content_cache_key(instructions, resp_kwargs.get("tools"))
                 if _cache_key:
                     resp_kwargs["prompt_cache_key"] = _cache_key
-            if "prompt_cache_retention" not in resp_kwargs:
-                _cache_retention = _default_prompt_cache_retention_for_request(
-                    model,
-                    _host_src,
-                )
-                if _cache_retention:
-                    resp_kwargs["prompt_cache_retention"] = _cache_retention
         except Exception:
             logger.debug(
                 "Codex auxiliary: prompt_cache_key derivation skipped", exc_info=True
@@ -1716,7 +1703,7 @@ def _read_nous_auth() -> Optional[dict]:
     try:
         if not _AUTH_JSON_PATH.is_file():
             return None
-        data = json.loads(_AUTH_JSON_PATH.read_text(encoding="utf-8"))
+        data = json.loads(_AUTH_JSON_PATH.read_text())
         if data.get("active_provider") != "nous":
             return None
         provider = data.get("providers", {}).get("nous", {})
@@ -2316,62 +2303,6 @@ def _read_main_base_url() -> str:
     return ""
 
 
-def _resolve_moa_aggregator(preset_name: Optional[str]) -> Tuple[Optional[str], Optional[str]]:
-    """Resolve a MoA preset to its aggregator (provider, model) pair.
-
-    "moa" is a virtual provider — the acting model of a preset is its
-    aggregator slot, and there is no real "moa" HTTP endpoint. Auxiliary
-    tasks (title generation, compression, vision, commit messages, …) don't
-    need the reference fan-out, so every aux resolution layer maps
-    provider="moa"/model=<preset> to the aggregator's real provider+model
-    through this single helper (shared by ``_resolve_auto``,
-    ``_resolve_task_provider_model``, and ``resolve_provider_client`` so the
-    preset lookup and validation cannot drift between paths).
-
-    Args:
-        preset_name: The MoA preset name (usually carried in the "model"
-            field), or None/"" to resolve the user's default preset.
-
-    Returns:
-        (aggregator_provider, aggregator_model), or (None, None) when the
-        preset cannot be resolved (missing config, renamed/deleted preset,
-        or a malformed aggregator slot).
-    """
-    try:
-        from hermes_cli.config import load_config
-        from hermes_cli.moa_config import resolve_moa_preset
-
-        preset = resolve_moa_preset(load_config().get("moa") or {}, preset_name or None)
-        agg = preset.get("aggregator") or {}
-        agg_provider = str(agg.get("provider") or "").strip()
-        agg_model = str(agg.get("model") or "").strip()
-        if agg_provider and agg_model and agg_provider.lower() != "moa":
-            return agg_provider, agg_model
-    except Exception:
-        logger.debug(
-            "MoA aggregator resolution failed for preset %r", preset_name, exc_info=True
-        )
-    return None, None
-
-
-def _read_main_model_for_aux() -> str:
-    """Main model with MoA presets unwrapped to the aggregator's model.
-
-    When the main provider is ``moa``, ``_read_main_model()`` returns a MoA
-    *preset name* (e.g. "opus-gpt") — never a valid wire model id on any
-    provider. Auxiliary fallback chains that pre-fill a missing model from
-    the main model must use this reader instead, so unset aux models default
-    to the preset's acting (aggregator) model. Returns "" when the main
-    provider is moa but the preset cannot be resolved — sending nothing is
-    strictly better than sending a preset name that 400s.
-    """
-    model = _read_main_model()
-    if (_read_main_provider() or "").strip().lower() == "moa":
-        _, agg_model = _resolve_moa_aggregator(model)
-        return agg_model or ""
-    return model
-
-
 def _read_main_api_key_if_same_host(aux_base_url: str) -> str:
     """Return the main api_key only when *aux_base_url* points at the same
     host as the main model's base_url.
@@ -2447,7 +2378,6 @@ def set_runtime_main(
     provider: str,
     model: str,
     *,
-    requested_provider: str = "",
     base_url: str = "",
     api_key: Any = "",
     api_mode: str = "",
@@ -2463,7 +2393,6 @@ def set_runtime_main(
     global _RUNTIME_MAIN_AUTH_MODE, _RUNTIME_MAIN_COMPAT_SNAPSHOT
     runtime = {
         "provider": (provider or "").strip().lower(),
-        "requested_provider": (requested_provider or "").strip().lower(),
         "model": (model or "").strip(),
         "base_url": (base_url or "").strip(),
         "api_key": (
@@ -2644,7 +2573,7 @@ def _try_custom_endpoint() -> Tuple[Optional[Any], Optional[str]]:
         return None, None
     if custom_base.lower().startswith(_CODEX_AUX_BASE_URL.lower()):
         return None, None
-    model = _read_main_model_for_aux() or "gpt-4o-mini"
+    model = _read_main_model() or "gpt-4o-mini"
     logger.debug("Auxiliary client: custom endpoint (%s, api_mode=%s)", model, custom_mode or "chat_completions")
     _clean_base, _dq = _extract_url_query_params(custom_base)
     _extra = {"default_query": _dq} if _dq else {}
@@ -2936,7 +2865,6 @@ _AUTO_PROVIDER_LABELS = {
 }
 
 _MAIN_RUNTIME_FIELDS = ("provider", "model", "base_url", "api_key", "api_mode", "auth_mode")
-_MAIN_RUNTIME_CONTEXT_FIELDS = _MAIN_RUNTIME_FIELDS + ("requested_provider",)
 
 
 def _normalize_main_runtime(main_runtime: Optional[Dict[str, Any]]) -> Dict[str, Any]:
@@ -2959,7 +2887,7 @@ def _normalize_main_runtime(main_runtime: Optional[Dict[str, Any]]) -> Dict[str,
     if not isinstance(main_runtime, dict):
         return {}
     normalized: Dict[str, Any] = {}
-    for field in _MAIN_RUNTIME_CONTEXT_FIELDS:
+    for field in _MAIN_RUNTIME_FIELDS:
         value = main_runtime.get(field)
         # Preserve a callable api_key (Entra ID bearer provider) unchanged.
         if field == "api_key" and callable(value) and not isinstance(value, str):
@@ -2967,10 +2895,9 @@ def _normalize_main_runtime(main_runtime: Optional[Dict[str, Any]]) -> Dict[str,
             continue
         if isinstance(value, str) and value.strip():
             normalized[field] = value.strip()
-    for identity_field in ("provider", "requested_provider"):
-        identity = normalized.get(identity_field)
-        if isinstance(identity, str):
-            normalized[identity_field] = identity.lower()
+    provider = normalized.get("provider")
+    if isinstance(provider, str):
+        normalized["provider"] = provider.lower()
     return normalized
 
 
@@ -3661,7 +3588,6 @@ def _retry_same_provider_sync(
     effective_timeout: float,
     effective_extra_body: dict,
     reasoning_config: Optional[dict],
-    extra_headers: Optional[Dict[str, str]] = None,
 ) -> Any:
     if task == "vision":
         _, retry_client, retry_model = resolve_vision_provider_client(
@@ -3697,13 +3623,7 @@ def _retry_same_provider_sync(
         extra_body=effective_extra_body,
         reasoning_config=reasoning_config,
         base_url=retry_base or resolved_base_url,
-        task=task,
     )
-    # Preserve per-request attribution headers (e.g. Copilot's
-    # ``x-initiator: user``) across the rebuilt-client retry — dropping them
-    # here would let a recovery retry silently lose capability gating (#60293).
-    if extra_headers:
-        retry_kwargs["extra_headers"] = dict(extra_headers)
     if _is_anthropic_compat_endpoint(resolved_provider, retry_base):
         retry_kwargs["messages"] = _convert_openai_images_to_anthropic(retry_kwargs["messages"])
     return _validate_llm_response(
@@ -3727,7 +3647,6 @@ async def _retry_same_provider_async(
     effective_timeout: float,
     effective_extra_body: dict,
     reasoning_config: Optional[dict],
-    extra_headers: Optional[Dict[str, str]] = None,
 ) -> Any:
     if task == "vision":
         _, retry_client, retry_model = resolve_vision_provider_client(
@@ -3763,12 +3682,7 @@ async def _retry_same_provider_async(
         extra_body=effective_extra_body,
         reasoning_config=reasoning_config,
         base_url=retry_base or resolved_base_url,
-        task=task,
     )
-    # Preserve per-request attribution headers across the rebuilt-client
-    # retry — see the sync variant above (#60293).
-    if extra_headers:
-        retry_kwargs["extra_headers"] = dict(extra_headers)
     if _is_anthropic_compat_endpoint(resolved_provider, retry_base):
         retry_kwargs["messages"] = _convert_openai_images_to_anthropic(retry_kwargs["messages"])
     return _validate_llm_response(
@@ -3843,24 +3757,6 @@ def _refresh_provider_credentials(provider: str) -> bool:
                 return False
             _evict_cached_clients(normalized)
             return True
-        if normalized == "vertex":
-            # Mirrors run_agent.py's _try_refresh_vertex_client_credentials
-            # for the main conversation loop. Without this branch, an
-            # auxiliary Vertex client (vision, title generation, reflection,
-            # context compression, ...) that 401s on its ~1h token expiry
-            # falls through to the final `return False` below: the stale
-            # client is never evicted from _client_cache (whose cache key
-            # ignores the rotating bearer token), so every subsequent
-            # auxiliary Vertex call keeps 401ing until process restart.
-            from agent.vertex_adapter import get_vertex_config
-
-            token, base_url = get_vertex_config()
-            if not isinstance(token, str) or not token.strip():
-                return False
-            if not isinstance(base_url, str) or not base_url.strip():
-                return False
-            _evict_cached_clients(normalized)
-            return True
     except Exception as exc:
         logger.debug("Auxiliary provider credential refresh failed for %s: %s", normalized, exc)
         return False
@@ -3974,7 +3870,7 @@ def _call_fallback_candidate_sync(
         temperature=temperature, max_tokens=max_tokens,
         tools=tools, timeout=effective_timeout,
         extra_body=effective_extra_body, reasoning_config=reasoning_config,
-        base_url=fb_base, task=task)
+        base_url=fb_base)
     try:
         return _validate_llm_response(
             fb_client.chat.completions.create(**fb_kwargs), task)
@@ -3991,7 +3887,7 @@ def _call_fallback_candidate_sync(
                     tools=tools, timeout=effective_timeout,
                     extra_body=effective_extra_body,
                     reasoning_config=reasoning_config,
-                    base_url=str(getattr(retry_client, "base_url", "") or fb_base), task=task)
+                    base_url=str(getattr(retry_client, "base_url", "") or fb_base))
                 try:
                     return _validate_llm_response(
                         retry_client.chat.completions.create(**retry_kwargs), task)
@@ -4040,7 +3936,7 @@ async def _call_fallback_candidate_async(
         temperature=temperature, max_tokens=max_tokens,
         tools=tools, timeout=effective_timeout,
         extra_body=effective_extra_body, reasoning_config=reasoning_config,
-        base_url=fb_base, task=task)
+        base_url=fb_base)
     try:
         return _validate_llm_response(
             await fb_client.chat.completions.create(**fb_kwargs), task)
@@ -4058,7 +3954,7 @@ async def _call_fallback_candidate_async(
                     tools=tools, timeout=effective_timeout,
                     extra_body=effective_extra_body,
                     reasoning_config=reasoning_config,
-                    base_url=str(getattr(retry_client, "base_url", "") or fb_base), task=task)
+                    base_url=str(getattr(retry_client, "base_url", "") or fb_base))
                 try:
                     return _validate_llm_response(
                         await retry_client.chat.completions.create(**retry_kwargs), task)
@@ -4076,7 +3972,7 @@ async def _call_fallback_candidate_async(
 
 def _try_payment_fallback(
     failed_provider: str,
-    task: str = None,
+    task: str | None = None,
     reason: str = "payment error",
 ) -> Tuple[Optional[Any], Optional[str], str]:
     """Try alternative providers after a payment/credit or connection error.
@@ -4127,7 +4023,7 @@ def _try_payment_fallback(
 
 def _try_main_agent_model_fallback(
     failed_provider: str,
-    task: str = None,
+    task: str | None = None,
     reason: str = "error",
 ) -> Tuple[Optional[Any], Optional[str], str]:
     """Last-resort fallback to the user's main agent provider + model.
@@ -4145,13 +4041,6 @@ def _try_main_agent_model_fallback(
     """
     main_provider = (_read_main_provider() or "").strip()
     main_model = (_read_main_model() or "").strip()
-    if main_provider.lower() == "moa":
-        # MoA virtual provider: fall back to the preset's aggregator — the
-        # acting model — instead of the unreachable "moa"/<preset-name> pair.
-        _agg_provider, _agg_model = _resolve_moa_aggregator(main_model)
-        if not _agg_provider or not _agg_model:
-            return None, None, ""
-        main_provider, main_model = _agg_provider, _agg_model
     if not main_provider or not main_model or main_provider.lower() in {"auto", ""}:
         return None, None, ""
 
@@ -4552,17 +4441,26 @@ def _resolve_auto(
     # model. Resolve the MoA preset to its aggregator slot and continue Step 1
     # with that real provider+model. Mirrors the MoA context-length resolution.
     if main_provider == "moa":
-        _agg_provider, _agg_model = _resolve_moa_aggregator(main_model)
-        if _agg_provider and _agg_model:
-            main_provider = _agg_provider
-            main_model = _agg_model
-            # The MoA virtual runtime carries a non-HTTP base_url
-            # ("moa://local") and a placeholder api_key; they belong to the
-            # facade, not the aggregator's real provider. Drop them so the
-            # aggregator resolves through its own provider credentials.
-            runtime_base_url = ""
-            runtime_api_key = ""
-            runtime_api_mode = ""
+        try:
+            from hermes_cli.config import load_config
+            from hermes_cli.moa_config import resolve_moa_preset
+
+            _preset = resolve_moa_preset(load_config().get("moa") or {}, main_model)
+            _agg = _preset.get("aggregator") or {}
+            _agg_provider = str(_agg.get("provider") or "").strip()
+            _agg_model = str(_agg.get("model") or "").strip()
+            if _agg_provider and _agg_model and _agg_provider.lower() != "moa":
+                main_provider = _agg_provider
+                main_model = _agg_model
+                # The MoA virtual runtime carries a non-HTTP base_url
+                # ("moa://local") and a placeholder api_key; they belong to the
+                # facade, not the aggregator's real provider. Drop them so the
+                # aggregator resolves through its own provider credentials.
+                runtime_base_url = ""
+                runtime_api_key = ""
+                runtime_api_mode = ""
+        except Exception:
+            logger.debug("MoA aux resolution to aggregator failed", exc_info=True)
 
     if (main_provider and main_model
             and main_provider not in {"auto", ""}):
@@ -4767,12 +4665,12 @@ def _normalize_resolved_model(model_name: Optional[str], provider: str) -> Optio
 
 def resolve_provider_client(
     provider: str,
-    model: str = None,
+    model: str | None = None,
     async_mode: bool = False,
     raw_codex: bool = False,
-    explicit_base_url: str = None,
-    explicit_api_key: str = None,
-    api_mode: str = None,
+    explicit_base_url: str | None = None,
+    explicit_api_key: str | None = None,
+    api_mode: str | None = None,
     main_runtime: Optional[Dict[str, Any]] = None,
     is_vision: bool = False,
     task: Optional[str] = None,
@@ -4817,27 +4715,6 @@ def resolve_provider_client(
     # Normalise aliases
     provider = _normalize_aux_provider(provider)
 
-    # MoA virtual provider chokepoint: "moa" is not a real HTTP provider —
-    # its acting model is the preset's aggregator slot. The two resolver
-    # layers above (_resolve_auto, _resolve_task_provider_model) already
-    # unwrap their own paths, but callers that route here directly (vision
-    # auto-detect, _try_main_agent_model_fallback, get_available_vision_backends,
-    # plugin code) would otherwise dead-end in the unknown-provider branch.
-    # ``model`` carries the preset name for moa calls; when the preset can't
-    # be resolved we leave the call untouched and let the normal
-    # missing-provider handling produce its diagnostic.
-    if provider == "moa":
-        _agg_provider, _agg_model = _resolve_moa_aggregator(model)
-        if _agg_provider and _agg_model:
-            original_provider = _agg_provider.strip().lower()
-            provider = _normalize_aux_provider(_agg_provider)
-            model = _agg_model
-            # The moa:// facade endpoint and placeholder key belong to the
-            # virtual runtime, not the aggregator's real provider.
-            if explicit_base_url and str(explicit_base_url).lower().startswith("moa://"):
-                explicit_base_url = None
-                explicit_api_key = None
-
     # Universal model-resolution fallback for concrete providers. ``auto`` is
     # intentionally excluded: `_resolve_auto(main_runtime=...)` returns the
     # model paired with the provider it actually selected. Pre-filling an auto
@@ -4858,10 +4735,6 @@ def resolve_provider_client(
     #      the load-bearing step for OAuth providers: an xai-oauth user
     #      with grok-4.3 configured gets grok-4.3 for title generation
     #      instead of silently dropping to whatever Step-2 fallback (#31845).
-    #      When the main provider is MoA, ``_read_main_model_for_aux()``
-    #      substitutes the preset's aggregator model — the preset NAME is
-    #      never a valid wire model id, so unset aux models default to the
-    #      preset's acting model instead.
     #
     # Each provider branch below sees a non-empty ``model`` whenever the
     # user has *anything* configured — no provider-specific empty-model
@@ -4878,7 +4751,7 @@ def resolve_provider_client(
     # return the actual current runtime model when the caller did not explicitly
     # request one. (# compression-current-model)
     if not model and provider != "auto":
-        model = _get_aux_model_for_provider(provider) or _read_main_model_for_aux() or model
+        model = _get_aux_model_for_provider(provider) or _read_main_model() or model
 
     def _needs_codex_wrap(client_obj, base_url_str: str, model_str: str) -> bool:
         """Decide if a plain OpenAI client should be wrapped for Responses API.
@@ -5152,7 +5025,7 @@ def resolve_provider_client(
                     model
                     or custom_entry.get("model")
                     or (main_runtime.get("model") if main_runtime else None)
-                    or _read_main_model_for_aux()
+                    or _read_main_model()
                     or "gpt-4o-mini",
                     provider,
                 )
@@ -5387,7 +5260,7 @@ def resolve_provider_client(
         final_model = _normalize_resolved_model(
             model
             or (main_runtime.get("model") if main_runtime else None)
-            or _read_main_model_for_aux(),
+            or _read_main_model(),
             provider,
         )
         if provider == "copilot-acp":
@@ -5755,24 +5628,7 @@ def resolve_vision_provider_client(
         #   5. Stop
         main_provider = str(runtime.get("provider") or _read_main_provider())
         main_model = str(runtime.get("model") or _read_main_model())
-        if main_provider.strip().lower() == "moa":
-            # MoA virtual provider: main_model is a preset NAME, and every
-            # capability probe below (_PROVIDERS_WITHOUT_VISION,
-            # _main_model_supports_vision, _resolve_provider_vision_default)
-            # would run against a provider/model pair that doesn't exist on
-            # any wire. Unwrap to the preset's aggregator slot first so the
-            # checks and the eventual client target the real acting model.
-            _agg_provider, _agg_model = _resolve_moa_aggregator(main_model)
-            if _agg_provider and _agg_model:
-                main_provider, main_model = _agg_provider, _agg_model
-                # Drop the moa:// facade endpoint from the runtime view used
-                # below — it belongs to the virtual provider, not the
-                # aggregator's real provider.
-                runtime = dict(runtime)
-                runtime["base_url"] = ""
-                runtime["api_key"] = ""
-                runtime["api_mode"] = ""
-        if main_provider and main_provider not in {"auto", "", "moa"}:
+        if main_provider and main_provider not in {"auto", ""}:
             # A provider-specific vision default wins over the user's chat model:
             # static overrides (xiaomi/zai) and catalog-backed discovery (the
             # DeepInfra profile hook) both yield a *known* vision-capable model,
@@ -6230,11 +6086,11 @@ def _compat_model(client: Any, model: Optional[str], cached_default: Optional[st
 
 def _get_cached_client(
     provider: str,
-    model: str = None,
+    model: str | None = None,
     async_mode: bool = False,
-    base_url: str = None,
-    api_key: str = None,
-    api_mode: str = None,
+    base_url: str | None = None,
+    api_key: str | None = None,
+    api_mode: str | None = None,
     main_runtime: Optional[Dict[str, Any]] = None,
     is_vision: bool = False,
     task: Optional[str] = None,
@@ -6366,11 +6222,11 @@ _AUX_DIRECT_API_BASE_URLS: Dict[str, str] = {
 
 
 def _resolve_task_provider_model(
-    task: str = None,
-    provider: str = None,
-    model: str = None,
-    base_url: Optional[str] = None,
-    api_key: Optional[str] = None,
+    task: str | None = None,
+    provider: str | None = None,
+    model: str | None = None,
+    base_url: str | None = None,
+    api_key: str | None = None,
 ) -> Tuple[str, Optional[str], Optional[str], Optional[str], Optional[str]]:
     """Determine provider + model for a call.
 
@@ -6397,13 +6253,6 @@ def _resolve_task_provider_model(
         cfg_model = str(task_config.get("model", "")).strip() or None
         cfg_base_url = str(task_config.get("base_url", "")).strip() or None
         cfg_api_key = str(task_config.get("api_key", "")).strip() or None
-        # Resolve key_env → env var when api_key is not set directly
-        if not cfg_api_key:
-            cfg_key_env = str(
-                task_config.get("key_env") or task_config.get("api_key_env") or ""
-            ).strip()
-            if cfg_key_env:
-                cfg_api_key = os.getenv(cfg_key_env, "").strip() or None
         cfg_api_mode = str(task_config.get("api_mode", "")).strip() or None
 
     # 'auto' is a sentinel meaning "inherit from main runtime / auto-detect", not
@@ -6413,57 +6262,12 @@ def _resolve_task_provider_model(
     # which downstream consumers like ContextCompressor accept as the task output.
     # The provider-side 'auto' is handled in _resolve_auto() via main_runtime
     # fallback, so dropping cfg_model to None here lets that path do its job.
-    #
-    # The explicit `model` kwarg needs the identical normalization: MoA slots
-    # (agent/moa_loop.py's _slot_runtime) forward a preset's `model:` field as
-    # this explicit argument rather than through auxiliary.<task> config, so a
-    # user-configured `model: auto` on a MoA reference/aggregator slot reaches
-    # this function here, not as cfg_model. Only normalizing cfg_model let that
-    # literal "auto" slip through via `model or cfg_model` below.
-    if model and model.lower() == "auto":
-        model = None
     if cfg_model and cfg_model.lower() == "auto":
         cfg_model = None
 
     resolved_model = model or cfg_model
     resolved_api_mode = cfg_api_mode
 
-    # MoA virtual provider: an *explicit* `provider: moa` override (either the
-    # caller-passed `provider` arg or `auxiliary.<task>.provider` in
-    # config.yaml) reaches this function directly — it never goes through
-    # _resolve_auto(), which only unwraps the *implicit* "main provider is
-    # moa" case (#53827). Left as-is, "moa" is returned verbatim and
-    # resolve_provider_client() looks it up in PROVIDER_REGISTRY (which has
-    # no "moa" entry — it's not a real HTTP provider), falls to the
-    # unknown-provider dead end, and call_llm surfaces a nonsensical
-    # "MOA_API_KEY environment variable" error for a provider that was never
-    # meant to be reached over the wire. Auxiliary tasks don't need the
-    # reference fan-out — resolve to the preset's aggregator slot instead,
-    # exactly like the implicit path does (shared helper: _resolve_moa_aggregator).
-    def _unwrap_moa_provider(prov: str, mdl: Optional[str]) -> Tuple[str, Optional[str]]:
-        if prov.strip().lower() != "moa":
-            return prov, mdl
-        agg_provider, agg_model = _resolve_moa_aggregator(mdl)
-        if agg_provider and agg_model:
-            return agg_provider, agg_model
-        return prov, mdl
-
-    if provider and str(provider).strip().lower() == "moa":
-        provider, resolved_model = _unwrap_moa_provider(provider, resolved_model)
-        # The moa:// virtual endpoint (if any explicit base_url/api_key was
-        # passed alongside provider="moa") belongs to the facade, not the
-        # aggregator's real provider — drop it so the aggregator resolves
-        # through its own provider credentials, mirroring _resolve_auto().
-        if provider and provider.lower() != "moa":
-            base_url = None
-            api_key = None
-    elif cfg_provider and str(cfg_provider).strip().lower() == "moa":
-        cfg_provider, cfg_model = _unwrap_moa_provider(cfg_provider, resolved_model)
-        if cfg_provider and cfg_provider.lower() != "moa":
-            resolved_model = cfg_model
-            cfg_base_url = None
-            cfg_api_key = None
-
     # Convenience aliases for direct API-key endpoints that aren't first-class
     # providers (e.g. ``provider: openai`` → custom + api.openai.com/v1).
     # Applied to both explicit args and config-derived values. When the user
@@ -6820,7 +6624,6 @@ def _build_call_kwargs(
     extra_body: Optional[dict] = None,
     reasoning_config: Optional[dict] = None,
     base_url: Optional[str] = None,
-    task: Optional[str] = None,
 ) -> dict:
     """Build kwargs for .chat.completions.create() with model/provider adjustments."""
     kwargs: Dict[str, Any] = {
@@ -6875,32 +6678,11 @@ def _build_call_kwargs(
             _provider_norm in {"nvidia", "nvidia-nim", "nim", "build-nvidia", "nemotron"}
             or base_url_host_matches(_effective_base, "integrate.api.nvidia.com")
         )
-        _is_moa = bool(task) and str(task) == "moa_reference"
-        # Gemini's native generateContent maps max_tokens → maxOutputTokens and,
-        # when it is omitted, applies a fixed 65,535-token ceiling rather than
-        # "the model's full budget" (see gemini_native_adapter.build_gemini_request).
-        # So an explicit cap is both safe and the ONLY way to honor it here —
-        # dropping max_tokens silently makes MoA's reference_max_tokens a no-op
-        # for gemini advisors (they run effectively uncapped).
-        _is_gemini_native = _provider_norm in {
-            "gemini", "google", "google-gemini", "google-ai-studio",
-        }
-        if not _is_gemini_native and _effective_base:
-            try:
-                from agent.gemini_native_adapter import is_native_gemini_base_url
-                _is_gemini_native = is_native_gemini_base_url(_effective_base)
-            except Exception:
-                pass
         if (
             _is_anthropic_compat_endpoint(provider, _effective_base)
             or _is_nvidia_nim
-            or _is_moa
-            or _is_gemini_native
         ):
-            # Use auxiliary_max_tokens_param() so models that require
-            # max_completion_tokens (GPT-5 family, Copilot) get the right
-            # parameter name instead of a hardcoded max_tokens that 400s.
-            kwargs.update(auxiliary_max_tokens_param(max_tokens, model=model))
+            kwargs["max_tokens"] = max_tokens
 
     if tools:
         # Defensive dedup: providers like Google Vertex, Azure, and Bedrock
@@ -7118,24 +6900,23 @@ def _obj_get(obj: Any, key: str, default: Any = None) -> Any:
 
 
 def call_llm(
-    task: str = None,
+    task: str | None = None,
     *,
-    provider: str = None,
-    model: str = None,
-    base_url: str = None,
-    api_key: str = None,
+    provider: str | None = None,
+    model: str | None = None,
+    base_url: str | None = None,
+    api_key: str | None = None,
     main_runtime: Optional[Dict[str, Any]] = None,
     messages: list,
     temperature: Optional[float] = None,
-    max_tokens: int = None,
-    tools: list = None,
-    timeout: float = None,
-    extra_body: dict = None,
+    max_tokens: int | None = None,
+    tools: list | None = None,
+    timeout: float | None = None,
+    extra_body: dict | None = None,
     reasoning_config: Optional[dict] = None,
-    extra_headers: Optional[Dict[str, str]] = None,
-    api_mode: str = None,
+    api_mode: str | None = None,
     stream: bool = False,
-    stream_options: dict = None,
+    stream_options: dict | None = None,
 ) -> Any:
     """Centralized synchronous LLM call.
 
@@ -7158,9 +6939,6 @@ def call_llm(
         extra_body: Additional request body fields.
         reasoning_config: Optional Hermes reasoning config for direct model calls
               such as MoA reference/aggregator slots.
-        extra_headers: Additional per-request HTTP headers. These override
-            client-level defaults for providers that gate capabilities on
-            request attribution (for example Copilot's ``x-initiator``).
         stream: When True, return the raw SDK streaming iterator instead of a
             validated complete response. The caller is responsible for consuming
             chunks (and for any fallback). Used by the MoA aggregator so its
@@ -7273,9 +7051,7 @@ def call_llm(
         temperature=temperature, max_tokens=max_tokens,
         tools=tools, timeout=effective_timeout, extra_body=effective_extra_body,
         reasoning_config=reasoning_config,
-        base_url=_base_info or resolved_base_url, task=task)
-    if extra_headers:
-        kwargs["extra_headers"] = dict(extra_headers)
+        base_url=_base_info or resolved_base_url)
 
     # Convert image blocks for Anthropic-compatible endpoints (e.g. MiniMax)
     _client_base = str(getattr(client, "base_url", "") or "")
@@ -7529,7 +7305,6 @@ def call_llm(
                     effective_timeout=effective_timeout,
                     effective_extra_body=effective_extra_body,
                     reasoning_config=reasoning_config,
-                    extra_headers=extra_headers,
                 )
 
         # ── Same-provider credential-pool recovery ─────────────────────
@@ -7573,7 +7348,6 @@ def call_llm(
                         effective_timeout=effective_timeout,
                         effective_extra_body=effective_extra_body,
                         reasoning_config=reasoning_config,
-                        extra_headers=extra_headers,
                     )
                 except Exception as retry2_err:
                     # The rotated key also hit a quota/auth wall.  Mark it
@@ -7793,19 +7567,19 @@ def extract_content_or_reasoning(response) -> str:
 
 
 async def async_call_llm(
-    task: str = None,
+    task: str | None = None,
     *,
-    provider: str = None,
-    model: str = None,
-    base_url: str = None,
-    api_key: str = None,
+    provider: str | None = None,
+    model: str | None = None,
+    base_url: str | None = None,
+    api_key: str | None = None,
     main_runtime: Optional[Dict[str, Any]] = None,
     messages: list,
     temperature: Optional[float] = None,
-    max_tokens: int = None,
-    tools: list = None,
-    timeout: float = None,
-    extra_body: dict = None,
+    max_tokens: int | None = None,
+    tools: list | None = None,
+    timeout: float | None = None,
+    extra_body: dict | None = None,
     reasoning_config: Optional[dict] = None,
 ) -> Any:
     """Centralized asynchronous LLM call.
@@ -7893,7 +7667,7 @@ async def async_call_llm(
         temperature=temperature, max_tokens=max_tokens,
         tools=tools, timeout=effective_timeout, extra_body=effective_extra_body,
         reasoning_config=reasoning_config,
-        base_url=_client_base or resolved_base_url, task=task)
+        base_url=_client_base or resolved_base_url)
 
     # Convert image blocks for Anthropic-compatible endpoints (e.g. MiniMax)
     if _is_anthropic_compat_endpoint(resolved_provider, _client_base):

agent/battery.py

@@ -1,131 +0,0 @@
-"""System-battery read-out for the CLI/TUI status bar.
-
-Reads the host battery through ``psutil`` (already a Hermes dependency) and
-exposes a compact, colour-coded label.  Everything degrades to "unavailable"
-when there is no battery (desktops, servers, VMs) or when the read fails, so
-callers can render the result unconditionally and simply show nothing.
-
-The status bar repaints often (every keystroke and on a ~1s idle refresh), so
-:func:`read_battery` memoises the last reading for a few seconds instead of
-hitting ``psutil`` on every frame.
-"""
-
-from __future__ import annotations
-
-import time
-from dataclasses import dataclass
-from typing import Optional
-
-
-@dataclass(frozen=True)
-class BatteryStatus:
-    """A single battery reading.
-
-    ``available`` is False on machines without a battery (or when the read
-    failed).  ``percent`` is clamped to 0-100.  ``plugged`` is True when on AC
-    power, False on battery, and None when the platform can't tell.
-    """
-
-    available: bool
-    percent: Optional[int] = None
-    plugged: Optional[bool] = None
-
-    @property
-    def charging(self) -> bool:
-        return bool(self.plugged)
-
-
-UNAVAILABLE = BatteryStatus(available=False)
-
-# Colour buckets, mirroring the status-bar context styles but inverted (a full
-# battery is "good", an empty one is "critical").
-CATEGORY_GOOD = "good"
-CATEGORY_WARN = "warn"
-CATEGORY_BAD = "bad"
-CATEGORY_CRITICAL = "critical"
-CATEGORY_DIM = "dim"
-
-_CACHE_TTL_SECONDS = 8.0
-_cache: Optional[tuple[float, BatteryStatus]] = None
-
-
-def _read_battery_uncached() -> BatteryStatus:
-    try:
-        import psutil
-    except Exception:
-        return UNAVAILABLE
-
-    # ``sensors_battery`` is missing on some platforms/builds of psutil.
-    reader = getattr(psutil, "sensors_battery", None)
-    if reader is None:
-        return UNAVAILABLE
-
-    try:
-        batt = reader()
-    except Exception:
-        return UNAVAILABLE
-
-    if batt is None:
-        return UNAVAILABLE
-
-    percent: Optional[int] = None
-    raw_percent = getattr(batt, "percent", None)
-    if raw_percent is not None:
-        try:
-            percent = max(0, min(100, int(round(float(raw_percent)))))
-        except (TypeError, ValueError):
-            percent = None
-
-    plugged = getattr(batt, "power_plugged", None)
-    if plugged is not None:
-        plugged = bool(plugged)
-
-    return BatteryStatus(available=True, percent=percent, plugged=plugged)
-
-
-def read_battery(use_cache: bool = True) -> BatteryStatus:
-    """Return the current battery status (cached for a few seconds)."""
-    global _cache
-    if use_cache and _cache is not None:
-        ts, cached = _cache
-        if time.monotonic() - ts < _CACHE_TTL_SECONDS:
-            return cached
-
-    status = _read_battery_uncached()
-    _cache = (time.monotonic(), status)
-    return status
-
-
-def clear_cache() -> None:
-    """Drop the memoised reading (used by tests)."""
-    global _cache
-    _cache = None
-
-
-def battery_category(status: BatteryStatus) -> str:
-    """Bucket a reading into a colour category: good/warn/bad/critical/dim."""
-    if not status.available or status.percent is None:
-        return CATEGORY_DIM
-    # On AC power the level isn't a concern — always read as healthy.
-    if status.charging:
-        return CATEGORY_GOOD
-    pct = status.percent
-    if pct <= 10:
-        return CATEGORY_CRITICAL
-    if pct <= 20:
-        return CATEGORY_BAD
-    if pct <= 50:
-        return CATEGORY_WARN
-    return CATEGORY_GOOD
-
-
-def battery_glyph(status: BatteryStatus) -> str:
-    """Return the leading glyph: a bolt while charging, else a battery."""
-    return "\u26a1" if status.charging else "\U0001f50b"  # ⚡ / 🔋
-
-
-def format_battery(status: BatteryStatus) -> str:
-    """Return a compact label like ``🔋 82%`` / ``⚡ 82%`` (empty if N/A)."""
-    if not status.available or status.percent is None:
-        return ""
-    return f"{battery_glyph(status)} {status.percent}%"

agent/bedrock_adapter.py

@@ -433,29 +433,6 @@ def _model_supports_tool_use(model_id: str) -> bool:
     return not any(pattern in model_lower for pattern in _NON_TOOL_CALLING_PATTERNS)
 
 
-# ---------------------------------------------------------------------------
-# Prompt-cache capability detection (Converse API cachePoint)
-# ---------------------------------------------------------------------------
-# Claude on Bedrock already gets prompt caching through the AnthropicBedrock
-# SDK path (see is_anthropic_bedrock_model / runtime_provider.py's dual-path
-# routing) — it never reaches build_converse_kwargs unless bearer-token auth
-# forces the Converse path (#28156). This allowlist covers the Converse API
-# itself: sending an unsupported model a cachePoint block raises a
-# ValidationException, so — like _model_supports_tool_use but inverted —
-# unknown models default to NOT receiving cache markers until confirmed.
-# Ref: https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-caching.html
-_CACHE_POINT_PATTERNS = [
-    "anthropic.claude",  # bearer-token fallback path
-    "amazon.nova",
-]
-
-
-def _model_supports_prompt_cache(model_id: str) -> bool:
-    """Return True if the model accepts a Converse API cachePoint block."""
-    model_lower = model_id.lower()
-    return any(pattern in model_lower for pattern in _CACHE_POINT_PATTERNS)
-
-
 def is_anthropic_bedrock_model(model_id: str) -> bool:
     """Return True if the model is an Anthropic Claude model on Bedrock.
 
@@ -471,10 +448,7 @@ def is_anthropic_bedrock_model(model_id: str) -> bool:
     """
     model_lower = model_id.lower()
     # Strip regional prefix if present
-    for prefix in (
-        "global.", "us.", "eu.", "apac.", "ap.", "au.", "jp.",
-        "ca.", "sa.", "me.", "af.",
-    ):
+    for prefix in ("us.", "global.", "eu.", "ap.", "jp."):
         if model_lower.startswith(prefix):
             model_lower = model_lower[len(prefix):]
             break
@@ -516,26 +490,6 @@ def convert_tools_to_converse(tools: List[Dict]) -> List[Dict]:
     return result
 
 
-# Bedrock's Converse API rejects any text content block whose text is empty
-# OR whitespace-only (ValidationException: "text content blocks must contain
-# non-whitespace text"). A lone space is whitespace and is rejected too — the
-# placeholder MUST itself be non-whitespace. Ref: issue #9486.
-_EMPTY_TEXT_PLACEHOLDER = "(empty)"
-
-
-def _safe_text(text) -> str:
-    """Return ``text`` if it's non-whitespace, else a non-whitespace placeholder.
-
-    Handles None, empty string, and whitespace-only string (spaces, tabs,
-    newlines) — all of which Bedrock's Converse API rejects as text content.
-    """
-    if text is None:
-        return _EMPTY_TEXT_PLACEHOLDER
-    if not isinstance(text, str):
-        text = str(text)
-    return text if text.strip() else _EMPTY_TEXT_PLACEHOLDER
-
-
 def _convert_content_to_converse(content) -> List[Dict]:
     """Convert OpenAI message content (string or list) to Converse content blocks.
 
@@ -543,27 +497,26 @@ def _convert_content_to_converse(content) -> List[Dict]:
       - Plain text strings → [{"text": "..."}]
       - Content arrays with text/image_url parts → mixed text/image blocks
 
-    Replaces empty/whitespace-only text blocks with a non-whitespace
-    placeholder — Bedrock's Converse API rejects messages where a text
-    content block is empty or whitespace-only (ValidationException:
-    "text content blocks must contain non-whitespace text"). Ref: issue #9486.
+    Filters out empty text blocks — Bedrock's Converse API rejects messages
+    where a text content block has an empty ``text`` field (ValidationException:
+    "text content blocks must be non-empty"). Ref: issue #9486.
     """
     if content is None:
-        return [{"text": _safe_text(content)}]
+        return [{"text": " "}]
     if isinstance(content, str):
-        return [{"text": _safe_text(content)}]
+        return [{"text": content}] if content.strip() else [{"text": " "}]
     if isinstance(content, list):
         blocks = []
         for part in content:
             if isinstance(part, str):
-                blocks.append({"text": _safe_text(part)})
+                blocks.append({"text": part})
                 continue
             if not isinstance(part, dict):
                 continue
             part_type = part.get("type", "")
             if part_type == "text":
                 text = part.get("text", "")
-                blocks.append({"text": _safe_text(text)})
+                blocks.append({"text": text if text else " "})
             elif part_type == "image_url":
                 image_url = part.get("image_url", {})
                 url = image_url.get("url", "") if isinstance(image_url, dict) else ""
@@ -594,8 +547,8 @@ def _convert_content_to_converse(content) -> List[Dict]:
                     # Remote URL — Converse doesn't support URLs directly,
                     # include as text reference for the model.
                     blocks.append({"text": f"[Image: {url}]"})
-        return blocks if blocks else [{"text": _EMPTY_TEXT_PLACEHOLDER}]
-    return [{"text": _safe_text(content)}]
+        return blocks if blocks else [{"text": " "}]
+    return [{"text": str(content)}]
 
 
 def convert_messages_to_converse(
@@ -625,18 +578,14 @@ def convert_messages_to_converse(
         content = msg.get("content")
 
         if role == "system":
-            # System messages become the system prompt. Blank/whitespace-only
-            # parts are dropped entirely (not placeholder-filled) since a
-            # system prompt made up of only placeholder text is meaningless.
+            # System messages become the system prompt
             if isinstance(content, str) and content.strip():
                 system_blocks.append({"text": content})
             elif isinstance(content, list):
                 for part in content:
                     if isinstance(part, dict) and part.get("type") == "text":
-                        text = part.get("text", "")
-                        if isinstance(text, str) and text.strip():
-                            system_blocks.append({"text": text})
-                    elif isinstance(part, str) and part.strip():
+                        system_blocks.append({"text": part.get("text", "")})
+                    elif isinstance(part, str):
                         system_blocks.append({"text": part})
             continue
 
@@ -647,7 +596,7 @@ def convert_messages_to_converse(
             tool_result_block = {
                 "toolResult": {
                     "toolUseId": tool_call_id,
-                    "content": [{"text": _safe_text(result_content)}],
+                    "content": [{"text": result_content}],
                 }
             }
             # In Converse, tool results go in a "user" role message
@@ -686,7 +635,7 @@ def convert_messages_to_converse(
                 })
 
             if not content_blocks:
-                content_blocks = [{"text": _EMPTY_TEXT_PLACEHOLDER}]
+                content_blocks = [{"text": " "}]
 
             # Merge with previous assistant message if needed (strict alternation)
             if converse_msgs and converse_msgs[-1]["role"] == "assistant":
@@ -712,11 +661,11 @@ def convert_messages_to_converse(
 
     # Converse requires the first message to be from the user
     if converse_msgs and converse_msgs[0]["role"] != "user":
-        converse_msgs.insert(0, {"role": "user", "content": [{"text": _EMPTY_TEXT_PLACEHOLDER}]})
+        converse_msgs.insert(0, {"role": "user", "content": [{"text": " "}]})
 
     # Converse requires the last message to be from the user
     if converse_msgs and converse_msgs[-1]["role"] != "user":
-        converse_msgs.append({"role": "user", "content": [{"text": _EMPTY_TEXT_PLACEHOLDER}]})
+        converse_msgs.append({"role": "user", "content": [{"text": " "}]})
 
     return (system_blocks if system_blocks else None, converse_msgs)
 
@@ -787,22 +736,14 @@ def normalize_converse_response(response: Dict) -> SimpleNamespace:
         reasoning_content="\n\n".join(reasoning_parts) if reasoning_parts else None,
     )
 
-    # Build usage stats. Converse's inputTokens excludes cache read/write
-    # tokens (unlike OpenAI's prompt_tokens, which includes them) — restore
-    # the OpenAI-style "total includes cache" convention here so downstream
-    # normalize_usage() can subtract them back out consistently, and surface
-    # the Anthropic-named fields it already falls back to for cache reads.
+    # Build usage stats
     usage_data = response.get("usage", {})
-    input_tokens = usage_data.get("inputTokens", 0)
-    cache_read_tokens = usage_data.get("cacheReadInputTokens", 0)
-    cache_write_tokens = usage_data.get("cacheWriteInputTokens", 0)
-    output_tokens = usage_data.get("outputTokens", 0)
     usage = SimpleNamespace(
-        prompt_tokens=input_tokens + cache_read_tokens + cache_write_tokens,
-        completion_tokens=output_tokens,
-        total_tokens=input_tokens + cache_read_tokens + cache_write_tokens + output_tokens,
-        cache_read_input_tokens=cache_read_tokens,
-        cache_creation_input_tokens=cache_write_tokens,
+        prompt_tokens=usage_data.get("inputTokens", 0),
+        completion_tokens=usage_data.get("outputTokens", 0),
+        total_tokens=(
+            usage_data.get("inputTokens", 0) + usage_data.get("outputTokens", 0)
+        ),
     )
 
     finish_reason = _converse_stop_reason_to_openai(stop_reason)
@@ -848,7 +789,6 @@ def stream_converse_with_callbacks(
     on_tool_start=None,
     on_reasoning_delta=None,
     on_interrupt_check=None,
-    on_event=None,
 ) -> SimpleNamespace:
     """Process a Bedrock ConverseStream event stream with real-time callbacks.
 
@@ -868,12 +808,6 @@ def stream_converse_with_callbacks(
             on supported models (Claude 4.6+).
         on_interrupt_check: Called on each event. Should return True if the
             agent has been interrupted and streaming should stop.
-        on_event: Called once at the top of the loop body for EVERY yielded
-            Bedrock event (text/tool-input/reasoning/metadata deltas alike),
-            before any branching. Provides a wire-level liveness signal so an
-            external watchdog can distinguish "still receiving events" from
-            "stream wedged with no data". Errors raised by the callback are
-            swallowed so a liveness hook can never abort the stream.
 
     Returns:
         An OpenAI-compatible SimpleNamespace response, identical in shape to
@@ -889,15 +823,6 @@ def stream_converse_with_callbacks(
     usage_data: Dict[str, int] = {}
 
     for event in event_stream.get("stream", []):
-        # Wire-level liveness signal: fire on EVERY yielded event (text, tool
-        # input, reasoning, metadata) before branching so an external watchdog
-        # can tell a still-flowing stream from a wedged one. Best-effort — a
-        # liveness callback must never be able to abort the stream.
-        if on_event is not None:
-            try:
-                on_event()
-            except Exception:
-                pass
         # Check for interrupt
         if on_interrupt_check and on_interrupt_check():
             break
@@ -967,8 +892,6 @@ def stream_converse_with_callbacks(
             usage_data = {
                 "inputTokens": meta_usage.get("inputTokens", 0),
                 "outputTokens": meta_usage.get("outputTokens", 0),
-                "cacheReadInputTokens": meta_usage.get("cacheReadInputTokens", 0),
-                "cacheWriteInputTokens": meta_usage.get("cacheWriteInputTokens", 0),
             }
 
     # Flush remaining text
@@ -982,16 +905,12 @@ def stream_converse_with_callbacks(
         reasoning_content="\n\n".join(reasoning_parts) if reasoning_parts else None,
     )
 
-    input_tokens = usage_data.get("inputTokens", 0)
-    cache_read_tokens = usage_data.get("cacheReadInputTokens", 0)
-    cache_write_tokens = usage_data.get("cacheWriteInputTokens", 0)
-    output_tokens = usage_data.get("outputTokens", 0)
     usage = SimpleNamespace(
-        prompt_tokens=input_tokens + cache_read_tokens + cache_write_tokens,
-        completion_tokens=output_tokens,
-        total_tokens=input_tokens + cache_read_tokens + cache_write_tokens + output_tokens,
-        cache_read_input_tokens=cache_read_tokens,
-        cache_creation_input_tokens=cache_write_tokens,
+        prompt_tokens=usage_data.get("inputTokens", 0),
+        completion_tokens=usage_data.get("outputTokens", 0),
+        total_tokens=(
+            usage_data.get("inputTokens", 0) + usage_data.get("outputTokens", 0)
+        ),
     )
 
     finish_reason = _converse_stop_reason_to_openai(stop_reason)
@@ -1030,7 +949,6 @@ def build_converse_kwargs(
     Converts OpenAI-format inputs to Converse API parameters.
     """
     system_prompt, converse_messages = convert_messages_to_converse(messages)
-    cache_enabled = _model_supports_prompt_cache(model)
 
     kwargs: Dict[str, Any] = {
         "modelId": model,
@@ -1041,8 +959,6 @@ def build_converse_kwargs(
     }
 
     if system_prompt:
-        if cache_enabled:
-            system_prompt = system_prompt + [{"cachePoint": {"type": "default"}}]
         kwargs["system"] = system_prompt
 
     from agent.anthropic_adapter import _forbids_sampling_params
@@ -1066,8 +982,6 @@ def build_converse_kwargs(
             # Strip tools for known non-tool-calling models and warn the user.
             # Ref: PR #7920 feedback from @ptlally, pattern from PR #4346.
             if _model_supports_tool_use(model):
-                if cache_enabled:
-                    converse_tools = converse_tools + [{"cachePoint": {"type": "default"}}]
                 kwargs["toolConfig"] = {"tools": converse_tools}
             else:
                 logger.warning(
@@ -1075,14 +989,6 @@ def build_converse_kwargs(
                     "The agent will operate in text-only mode.", model
                 )
 
-    if cache_enabled and len(converse_messages) >= 2:
-        # Checkpoint everything up to (not including) the newest turn, so the
-        # marker survives unchanged across requests as only the tail grows —
-        # mirroring the Anthropic system_and_3 strategy in prompt_caching.py.
-        content = converse_messages[-2].get("content")
-        if isinstance(content, list) and content:
-            content.append({"cachePoint": {"type": "default"}})
-
     if guardrail_config:
         kwargs["guardrailConfig"] = guardrail_config
 
@@ -1399,24 +1305,9 @@ def classify_bedrock_error(error_message: str) -> str:
 # detection is unavailable.
 
 BEDROCK_CONTEXT_LENGTHS: Dict[str, int] = {
-    # Anthropic Claude models on Bedrock.
-    # Context windows per Anthropic's official models comparison
-    # (https://platform.claude.com/docs/en/about-claude/models/overview).
-    # Fable / Sonnet 5 / Opus 4.8 / 4.7 / 4.6 / Sonnet 4.6 have 1M generally
-    # available (no beta header required as of April 2026). Sonnet 4.5 and
-    # Sonnet 4 had their `context-1m-2025-08-07` beta retired on
-    # April 30, 2026, so they are standard 200K; Haiku 4.5 is 200K.
-    # These 1M entries must match agent/model_metadata.py
-    # DEFAULT_CONTEXT_LENGTHS or the agent compresses context prematurely.
-    # Keys are matched by longest-substring, so the versioned 4-6/4-7/4-8
-    # entries win over the generic "anthropic.claude-opus-4" fallback.
-    "anthropic.claude-fable-5":      1_000_000,
-    "anthropic.claude-fable":        1_000_000,
-    "anthropic.claude-sonnet-5":     1_000_000,
-    "anthropic.claude-opus-4-8":     1_000_000,
-    "anthropic.claude-opus-4-7":     1_000_000,
-    "anthropic.claude-opus-4-6":     1_000_000,
-    "anthropic.claude-sonnet-4-6":   1_000_000,
+    # Anthropic Claude models on Bedrock
+    "anthropic.claude-opus-4-6":     200_000,
+    "anthropic.claude-sonnet-4-6":   200_000,
     "anthropic.claude-sonnet-4-5":   200_000,
     "anthropic.claude-haiku-4-5":    200_000,
     "anthropic.claude-opus-4":       200_000,
@@ -1443,22 +1334,9 @@ BEDROCK_CONTEXT_LENGTHS: Dict[str, int] = {
 # Default for unknown Bedrock models
 BEDROCK_DEFAULT_CONTEXT_LENGTH = 128_000
 
-# Probe tiers (in tokens).  We send a request padded just past each tier and
-# read the real window from Bedrock's length-validation error.  Two reasons
-# this is tiered rather than one giant request:
-#   1. A wildly oversized payload (e.g. 5M tokens) makes Bedrock return an
-#      opaque InternalServerException after retries instead of a clean
-#      ValidationException — so we must stay within a sane overage.
-#   2. Stepping up lets us discover larger windows (2M+) without over-padding
-#      smaller ones.
-# Each tier value is the *padding target*; the error reports the true maximum,
-# which is what we actually return.
-_BEDROCK_PROBE_TIERS = (1_300_000, 2_200_000)
-_WORDS_PER_TOKEN = 0.9  # conservative: ensures the padded prompt clears the tier
 
-
-def _static_bedrock_context_length(model_id: str) -> int:
-    """Longest-substring-match lookup against the static fallback table.
+def get_bedrock_context_length(model_id: str) -> int:
+    """Look up the context window size for a Bedrock model.
 
     Uses substring matching so versioned IDs like
     ``anthropic.claude-sonnet-4-6-20250514-v1:0`` resolve correctly.
@@ -1471,103 +1349,3 @@ def _static_bedrock_context_length(model_id: str) -> int:
             best_key = key
             best_val = val
     return best_val
-
-
-def probe_bedrock_context_length(model_id: str, region: str) -> Optional[int]:
-    """Discover a Bedrock model's real context window by provoking a length error.
-
-    Bedrock does not expose the context window via any metadata API
-    (``get-foundation-model`` omits it, ``Converse`` metrics omit it,
-    ``CountTokens`` is unsupported on several models).  The only authoritative
-    source is the ``ValidationException`` raised when a prompt exceeds the
-    window:
-
-        "The model returned the following errors: prompt is too long:
-         1300032 tokens > 1000000 maximum"
-
-    Length validation happens *before* inference, so an oversized request is
-    rejected immediately and cheaply — no tokens are generated and no input is
-    actually processed.  We pad a request just past each tier in
-    ``_BEDROCK_PROBE_TIERS`` and parse the reported ``maximum``.  Tiers exist
-    because (a) a *wildly* oversized payload makes Bedrock fail with an opaque
-    InternalServerException instead of a clean length error, and (b) stepping
-    up discovers larger windows without over-padding smaller ones.
-
-    Returns the detected window, or ``None`` if the probe could not run
-    (missing credentials, network error, or no parseable limit) so the caller
-    can fall back to the static table.
-    """
-    try:
-        from agent.model_metadata import parse_context_limit_from_error
-    except ImportError:  # pragma: no cover — same package
-        return None
-
-    try:
-        client = _get_bedrock_runtime_client(region)
-    except Exception as exc:  # boto3 missing / credential resolution failure
-        logger.debug("Bedrock context probe skipped for %s: %s", model_id, exc)
-        return None
-
-    last_error = ""
-    for tier_tokens in _BEDROCK_PROBE_TIERS:
-        pad_words = int(tier_tokens / _WORDS_PER_TOKEN)
-        oversized = "data " * pad_words
-        try:
-            client.converse(
-                modelId=model_id,
-                messages=[{"role": "user", "content": [{"text": oversized}]}],
-                inferenceConfig={"maxTokens": 8},
-            )
-            # Accepted a prompt this large → the window is at least this tier.
-            # Returning the tier as a lower bound is safe and avoids inventing
-            # a number we can't confirm.
-            logger.debug(
-                "Bedrock context probe for %s accepted ~%s-token prompt; "
-                "window is at least that", model_id, f"{tier_tokens:,}",
-            )
-            return tier_tokens
-        except Exception as exc:
-            msg = str(exc)
-            last_error = msg
-            limit = parse_context_limit_from_error(msg)
-            if limit and limit >= 1024:
-                logger.info(
-                    "Probed Bedrock context window for %s: %s tokens",
-                    model_id, f"{limit:,}",
-                )
-                return limit
-            # No parseable limit at this tier (opaque server error, auth,
-            # throttle).  Try the next, smaller-overage strategy is N/A here —
-            # tiers ascend — so just continue; if all fail we return None.
-            continue
-
-    logger.debug(
-        "Bedrock context probe for %s returned no parseable limit: %s",
-        model_id, last_error[:200],
-    )
-    return None
-
-
-def get_bedrock_context_length(model_id: str, region: str = "", probe: bool = True) -> int:
-    """Resolve the context window for a Bedrock model.
-
-    Resolution order:
-      1. Live probe against Bedrock (authoritative; cached by the caller).
-      2. Static fallback table (longest-substring match).
-      3. Conservative default.
-
-    The static table is intentionally a *fallback*, not the primary source:
-    AWS ships new model versions (opus-4-7, opus-4-8, ...) faster than the
-    table can track, and a stale entry silently caps the window (e.g. a
-    1M-token Opus pinned to 200K via an ``opus-4`` substring match).  The
-    probe asks Bedrock directly so every model — current or future — gets its
-    real window with no table maintenance.
-
-    ``probe=False`` (or an empty ``region``) skips the network call and uses
-    the static table only — used by pure-offline/display code paths.
-    """
-    if probe and region:
-        probed = probe_bedrock_context_length(model_id, region)
-        if probed:
-            return probed
-    return _static_bedrock_context_length(model_id)

agent/billing_links.py

@@ -1,124 +0,0 @@
-"""Provider-agnostic billing/credit recovery links.
-
-Maps a billing-classified failure onto a recovery link + label. *Detection*
-is not done here — that is :mod:`agent.error_classifier`
-(``FailoverReason.billing``), the single source of truth for "credit wall vs.
-rate limit / auth / transport". The resulting :class:`BillingBlock` rides the
-turn result and the gateway ``message.complete`` event so every surface (CLI,
-TUI, desktop) renders one structured signal instead of re-parsing error text.
-"""
-
-from __future__ import annotations
-
-from dataclasses import asdict, dataclass
-from typing import Optional
-
-from utils import base_url_host_matches
-
-
-@dataclass
-class BillingBlock:
-    """Structured billing-wall descriptor shared across every surface.
-
-    ``is_nous`` is the routing bit: Nous has a first-class in-app billing surface
-    (desktop Settings → Billing, TUI/CLI ``/topup``), so surfaces prefer that over
-    ``billing_url``; third-party providers have no in-app flow, so ``billing_url``
-    is the deep link the user actually needs.
-    """
-
-    provider: str
-    provider_label: str
-    model: str
-    billing_url: Optional[str]
-    is_nous: bool
-    message: str
-
-    def to_dict(self) -> dict:
-        return asdict(self)
-
-
-@dataclass(frozen=True)
-class _Provider:
-    label: str
-    url: str
-    slugs: tuple[str, ...]
-    hosts: tuple[str, ...] = ()
-
-
-# Single source of truth: internal slug(s) + base_url host(s) → billing page.
-# Curated "add credits / manage billing" landing pages, not marketing homes.
-# Hosts back the OpenAI-compatible fallback where the slug is a generic bucket
-# (e.g. "openai_compatible") but base_url reveals the real upstream. An unknown
-# provider degrades to a readable label with no invented URL.
-_PROVIDERS: tuple[_Provider, ...] = (
-    _Provider("OpenAI", "https://platform.openai.com/settings/organization/billing", ("openai",), ("api.openai.com",)),
-    _Provider("Anthropic", "https://console.anthropic.com/settings/billing", ("anthropic",), ("api.anthropic.com",)),
-    _Provider("OpenRouter", "https://openrouter.ai/settings/credits", ("openrouter",), ("openrouter.ai",)),
-    _Provider("xAI", "https://console.x.ai/team/default/billing", ("xai", "xai-oauth"), ("api.x.ai",)),
-    _Provider("DeepSeek", "https://platform.deepseek.com/top_up", ("deepseek",), ("api.deepseek.com",)),
-    _Provider("Groq", "https://console.groq.com/settings/billing", ("groq",), ("api.groq.com",)),
-    _Provider("Mistral", "https://console.mistral.ai/billing", ("mistral",), ("api.mistral.ai",)),
-    _Provider("Together AI", "https://api.together.ai/settings/billing", ("together",), ("api.together.ai", "api.together.xyz")),
-    _Provider("Fireworks AI", "https://fireworks.ai/account/billing", ("fireworks",), ("fireworks.ai",)),
-    _Provider("Perplexity", "https://www.perplexity.ai/settings/api", ("perplexity",), ("perplexity.ai",)),
-    _Provider("Google AI", "https://aistudio.google.com/app/billing", ("google", "gemini"), ("generativelanguage.googleapis.com",)),
-    _Provider("Cohere", "https://dashboard.cohere.com/billing", ("cohere",)),
-    _Provider("Moonshot AI", "https://platform.moonshot.ai/console/pay", ("moonshot",)),
-    _Provider("NVIDIA", "https://build.nvidia.com/settings/billing", ("nvidia",)),
-)
-
-_BY_SLUG: dict[str, _Provider] = {slug: p for p in _PROVIDERS for slug in p.slugs}
-
-
-def is_nous_inference_route(provider: str, base_url: str) -> bool:
-    """True when the failing route is the Nous-managed inference gateway."""
-    if (provider or "").strip().lower() == "nous":
-        return True
-    return base_url_host_matches(str(base_url or ""), "inference-api.nousresearch.com")
-
-
-def _nous_billing_url() -> Optional[str]:
-    """Best-effort Nous portal billing URL (text-surface fallback; Nous prefers the in-app flow)."""
-    try:
-        from hermes_cli.nous_account import nous_portal_billing_url
-
-        return nous_portal_billing_url(None)
-    except Exception:
-        return "https://portal.nousresearch.com/billing"
-
-
-def _resolve_provider_link(slug: str, base_url: str) -> tuple[str, Optional[str]]:
-    """Resolve ``(label, url)``: exact slug → base_url host → readable-label fallback."""
-    hit = _BY_SLUG.get(slug)
-    if hit:
-        return hit.label, hit.url
-
-    base = str(base_url or "")
-    for p in _PROVIDERS:
-        if any(base_url_host_matches(base, host) for host in p.hosts):
-            return p.label, p.url
-
-    return slug.replace("_", " ").replace("-", " ").strip().title() or "your provider", None
-
-
-def build_billing_block(
-    *,
-    provider: str,
-    base_url: str,
-    model: str,
-    message: str = "",
-) -> BillingBlock:
-    """Build the billing descriptor for a billing-classified failure.
-
-    ``message`` is the guidance already assembled by the agent loop
-    (:func:`agent.conversation_loop._billing_or_entitlement_message`), carried
-    through unchanged so every surface shows identical copy.
-    """
-    slug = (provider or "").strip().lower()
-    model = (model or "").strip()
-
-    if is_nous_inference_route(slug, base_url):
-        return BillingBlock(slug or "nous", "Nous Portal", model, _nous_billing_url(), True, message or "")
-
-    label, url = _resolve_provider_link(slug, base_url)
-    return BillingBlock(slug, label, model, url, False, message or "")

agent/billing_usage.py

@@ -1,323 +0,0 @@
-"""Shared dollar-denominated usage model for the billing/subscription surfaces.
-
-The single source of truth behind the ``/usage`` and ``/subscription`` usage
-bars (TUI + CLI). User feedback (Jun 2026): the terminal surfaces show
-**dollars**, never "credits", and every usage bar must make the monthly
-subscription allowance and separately-purchased top-up dollars distinctly
-visible.
-
-Data source: the NAS account-info fetch (``NousPortalAccountInfo``), whose
-``paid_service_access_info`` carries the three dollar magnitudes we render
-(despite the legacy ``*_credits`` field names, these are USD floats):
-
-  - ``subscription_credits_remaining``  -> plan dollars left this month
-  - ``purchased_credits_remaining``     -> top-up dollars left (rolls over)
-  - ``total_usable_credits``            -> total spendable
-
-plus ``subscription.monthly_credits`` (the plan's monthly $ allowance, the
-denominator for the "% used" plan bar) and ``current_period_end`` (renewal).
-
-Design: two SEPARATE bars (decided with the user) rather than one crammed
-three-segment bar — at terminal widths three same-glyph density segments are
-unreadable. The plan bar is "spent vs allowance this month" (carries % used);
-the top-up bar is "money you bought, doesn't expire". Each gets full
-resolution and a single fill glyph, so the bar is never ambiguous and never
-relies on color.
-
-Fail-open everywhere: any missing/non-finite field degrades to fewer bars or a
-magnitudes-only view; a logged-out / unreachable portal yields
-``available=False`` and the surface shows nothing.
-"""
-
-from __future__ import annotations
-
-import logging
-import math
-import os
-from dataclasses import dataclass, field
-from typing import Any, Optional
-
-logger = logging.getLogger(__name__)
-
-# Below this TOTAL spendable ($), a paid account is flagged "low" — the alert
-# state that nudges top-up/upgrade before a mid-run cutoff. Product threshold
-# (user feedback): "any amount below $5 should be an alert status."
-LOW_BALANCE_THRESHOLD_USD = 5.0
-
-
-def _finite(value: Any) -> Optional[float]:
-    """Return value as a float iff it's a real finite number (not bool/NaN/Inf)."""
-    if isinstance(value, bool) or not isinstance(value, (int, float)):
-        return None
-    f = float(value)
-    return f if math.isfinite(f) else None
-
-
-def _fmt_usd(value: Optional[float]) -> str:
-    """``$X.YY`` for display. ``None`` -> ``$0.00`` (callers gate on presence)."""
-    return f"${(value or 0.0):,.2f}"
-
-
-def format_renews(value: Optional[str]) -> Optional[str]:
-    """Format an ISO date/timestamp as a human date, e.g. ``Jul 24, 2026``.
-
-    Accepts ``2026-07-24``, ``2026-07-24T11:05:01.000Z``, etc. Returns the raw
-    string unchanged if it can't be parsed (never raises), and ``None`` for
-    empty input.
-    """
-    if not value:
-        return None
-    from datetime import datetime
-
-    text = str(value).strip()
-    if not text:
-        return None
-    iso = text[:-1] + "+00:00" if text.endswith("Z") else text
-    try:
-        dt = datetime.fromisoformat(iso)
-    except ValueError:
-        # Fall back to a bare date prefix (YYYY-MM-DD) if present.
-        try:
-            dt = datetime.strptime(text[:10], "%Y-%m-%d")
-        except ValueError:
-            return text
-    # %-d isn't portable to Windows; build the day without a leading zero.
-    return f"{dt.strftime('%b')} {dt.day}, {dt.year}"
-
-
-@dataclass(frozen=True)
-class UsageBar:
-    """One full-resolution bar: ``spent`` of ``total``, plus a remaining figure.
-
-    ``kind`` is ``"plan"`` (monthly allowance, shows % used) or ``"topup"``
-    (purchased dollars, no denominator — ``spent`` is 0 and ``total`` ==
-    ``remaining`` so it renders as a full bar of available balance).
-    """
-
-    kind: str  # "plan" | "topup"
-    remaining_usd: float
-    total_usd: float
-    spent_usd: float = 0.0
-
-    @property
-    def pct_used(self) -> Optional[int]:
-        if self.kind != "plan" or self.total_usd <= 0:
-            return None
-        return max(0, min(100, round(self.spent_usd / self.total_usd * 100)))
-
-    @property
-    def fill_fraction(self) -> float:
-        """Fraction of the bar that should read as 'remaining' (filled)."""
-        if self.total_usd <= 0:
-            return 0.0
-        return max(0.0, min(1.0, self.remaining_usd / self.total_usd))
-
-
-@dataclass(frozen=True)
-class UsageModel:
-    """Surface-agnostic dollar usage model shared by /usage and /subscription.
-
-    ``status`` classifies the account for copy selection:
-      - ``"free"``     : no paid access / no subscription (free models only)
-      - ``"low"``      : paid, but total spendable < $5 (ALERT)
-      - ``"healthy"``  : paid, total spendable >= $5
-      - ``"depleted"`` : paid access lost (balance exhausted)
-    """
-
-    available: bool
-    status: str = "free"
-    plan_name: Optional[str] = None
-    renews_at: Optional[str] = None
-    renews_display: Optional[str] = None
-    subscription_remaining_usd: Optional[float] = None
-    topup_remaining_usd: Optional[float] = None
-    total_spendable_usd: Optional[float] = None
-    plan_bar: Optional[UsageBar] = None
-    topup_bar: Optional[UsageBar] = None
-
-    @property
-    def has_topup(self) -> bool:
-        return bool(self.topup_remaining_usd and self.topup_remaining_usd > 0)
-
-
-def usage_model_from_account(account_info: Any) -> UsageModel:
-    """Build a :class:`UsageModel` from a ``NousPortalAccountInfo``. Fail-open.
-
-    Returns ``UsageModel(available=False)`` when there's no usable account info
-    (logged out, no entitlement block). Never raises.
-    """
-    try:
-        if account_info is None or not getattr(account_info, "logged_in", False):
-            return UsageModel(available=False)
-
-        access = getattr(account_info, "paid_service_access_info", None)
-        sub = getattr(account_info, "subscription", None)
-        paid = getattr(account_info, "paid_service_access", None)
-
-        sub_remaining = _finite(getattr(access, "subscription_credits_remaining", None)) if access else None
-        topup_remaining = _finite(getattr(access, "purchased_credits_remaining", None)) if access else None
-        total_usable = _finite(getattr(access, "total_usable_credits", None)) if access else None
-
-        plan_name = getattr(sub, "plan", None) if sub is not None else None
-        renews_at = getattr(sub, "current_period_end", None) if sub is not None else None
-        monthly = _finite(getattr(sub, "monthly_credits", None)) if sub is not None else None
-
-        has_subscription = bool(plan_name) or (monthly is not None and monthly > 0)
-
-        # Total spendable: prefer the server's total; else sum the parts we have.
-        if total_usable is not None:
-            total_spendable = total_usable
-        else:
-            parts = [v for v in (sub_remaining, topup_remaining) if v is not None]
-            total_spendable = sum(parts) if parts else None
-
-        # Status classification.
-        if paid is False:
-            status = "depleted"
-        elif not has_subscription and not (topup_remaining and topup_remaining > 0):
-            # No plan and no purchased balance -> free-models-only.
-            status = "free"
-        elif total_spendable is not None and total_spendable < LOW_BALANCE_THRESHOLD_USD:
-            status = "low"
-        else:
-            status = "healthy"
-
-        # Plan bar — only with a positive monthly allowance AND a remaining we
-        # can place on it. spent = cap - remaining, clamped (a debt/over-cap
-        # balance reads as fully spent rather than a nonsensical negative).
-        plan_bar: Optional[UsageBar] = None
-        if monthly is not None and monthly > 0 and sub_remaining is not None:
-            remaining = max(0.0, min(monthly, sub_remaining))
-            plan_bar = UsageBar(
-                kind="plan",
-                remaining_usd=remaining,
-                total_usd=monthly,
-                spent_usd=max(0.0, monthly - sub_remaining),
-            )
-
-        # Top-up bar — only when there are purchased dollars to show. No
-        # denominator (top-up has no monthly cap), so it renders full = balance.
-        topup_bar: Optional[UsageBar] = None
-        if topup_remaining is not None and topup_remaining > 0:
-            topup_bar = UsageBar(
-                kind="topup",
-                remaining_usd=topup_remaining,
-                total_usd=topup_remaining,
-                spent_usd=0.0,
-            )
-
-        return UsageModel(
-            available=True,
-            status=status,
-            plan_name=plan_name,
-            renews_at=renews_at,
-            renews_display=format_renews(renews_at),
-            subscription_remaining_usd=sub_remaining,
-            topup_remaining_usd=topup_remaining,
-            total_spendable_usd=total_spendable,
-            plan_bar=plan_bar,
-            topup_bar=topup_bar,
-        )
-    except Exception:
-        logger.debug("usage ▸ model build failed (fail-open)", exc_info=True)
-        return UsageModel(available=False)
-
-
-def build_usage_model(*, timeout: float = 10.0) -> UsageModel:
-    """Fetch account-info and build the shared usage model. Fail-open.
-
-    Dev override: ``HERMES_DEV_CREDITS_FIXTURE`` short-circuits to a fixture so
-    every usage state is testable without a live account (mirrors the existing
-    ``/usage`` credits-block fixture path).
-    """
-    fixture = _dev_fixture_usage_model()
-    if fixture is not None:
-        return fixture
-
-    try:
-        from hermes_cli.auth import get_provider_auth_state
-
-        tok = (get_provider_auth_state("nous") or {}).get("access_token")
-        if not (isinstance(tok, str) and tok.strip()):
-            return UsageModel(available=False)
-    except Exception:
-        return UsageModel(available=False)
-
-    try:
-        import concurrent.futures
-
-        from hermes_cli.nous_account import get_nous_portal_account_info
-
-        with concurrent.futures.ThreadPoolExecutor(max_workers=1) as pool:
-            account = pool.submit(get_nous_portal_account_info, force_fresh=True).result(timeout=timeout)
-        return usage_model_from_account(account)
-    except Exception:
-        logger.debug("usage ▸ portal fetch failed (fail-open)", exc_info=True)
-        return UsageModel(available=False)
-
-
-# =============================================================================
-# Dev fixtures (throwaway scaffolding — env-var driven, no live portal)
-# =============================================================================
-
-
-def _dev_fixture_usage_model() -> Optional[UsageModel]:
-    """Map ``HERMES_DEV_CREDITS_FIXTURE`` to a usage model for offline UX work.
-
-    Recognized names: ``free | healthy | low | topup | depleted``. Returns
-    ``None`` when the env var is unset (real portal path runs).
-    """
-    name = (os.getenv("HERMES_DEV_CREDITS_FIXTURE") or "").strip().lower()
-    if not name:
-        return None
-
-    if name == "free":
-        return UsageModel(available=True, status="free", plan_name=None)
-
-    if name in ("healthy", "mid"):
-        return UsageModel(
-            available=True,
-            status="healthy",
-            plan_name="Plus",
-            renews_at="2026-07-01",
-            subscription_remaining_usd=14.0,
-            total_spendable_usd=14.0,
-            plan_bar=UsageBar(kind="plan", remaining_usd=14.0, total_usd=20.0, spent_usd=6.0),
-        )
-
-    if name in ("topup", "top-up"):
-        return UsageModel(
-            available=True,
-            status="healthy",
-            plan_name="Plus",
-            renews_at="2026-07-01",
-            subscription_remaining_usd=14.0,
-            topup_remaining_usd=12.0,
-            total_spendable_usd=26.0,
-            plan_bar=UsageBar(kind="plan", remaining_usd=14.0, total_usd=20.0, spent_usd=6.0),
-            topup_bar=UsageBar(kind="topup", remaining_usd=12.0, total_usd=12.0, spent_usd=0.0),
-        )
-
-    if name == "low":
-        return UsageModel(
-            available=True,
-            status="low",
-            plan_name="Plus",
-            renews_at="2026-07-01",
-            subscription_remaining_usd=3.4,
-            total_spendable_usd=3.4,
-            plan_bar=UsageBar(kind="plan", remaining_usd=3.4, total_usd=20.0, spent_usd=16.6),
-        )
-
-    if name == "depleted":
-        return UsageModel(
-            available=True,
-            status="depleted",
-            plan_name="Plus",
-            renews_at="2026-07-01",
-            subscription_remaining_usd=0.0,
-            total_spendable_usd=0.0,
-            plan_bar=UsageBar(kind="plan", remaining_usd=0.0, total_usd=20.0, spent_usd=20.0),
-        )
-
-    return None

agent/billing_view.py

@@ -1,4 +1,4 @@
-"""Surface-agnostic core for the Phase 2b Remote Spending screens.
+"""Surface-agnostic core for the Phase 2b terminal-billing screens.
 
 One fetch/parse per concern, consumed identically by the CLI handler
 (``cli.py::_show_billing``), the TUI JSON-RPC methods
@@ -15,7 +15,6 @@ We keep them as :class:`decimal.Decimal` end-to-end and only format for display.
 from __future__ import annotations
 
 import logging
-import os
 import uuid
 from dataclasses import dataclass, field
 from decimal import Decimal, InvalidOperation
@@ -65,47 +64,15 @@ def format_money(value: Optional[Decimal]) -> str:
 # =============================================================================
 
 
-# resolvedVia → the human answer to "why THIS card?". Keys are the server's card
-# resolution rungs (NAS card-on-file ladder); absent/unknown rungs render no label
-# so the display degrades cleanly on servers that don't send resolvedVia yet.
-_CARD_PROVENANCE_LABELS = {
-    "subPin": "the card on your subscription",
-    "customerDefault": "your default card saved on the portal",
-    "autoRefill": "your auto-reload card",
-}
-
-
 @dataclass(frozen=True)
 class CardInfo:
     brand: str
     last4: str
-    # NAS card-on-file field (post card-resolver): which ladder rung found the
-    # card. Defaults off so pre-resolver payloads parse unchanged.
-    resolved_via: Optional[str] = None
 
     @property
     def masked(self) -> str:
-        # A Link payment method has no card number (last4 = "") — render the
-        # brand alone, not "Link ····".
-        if not self.last4:
-            return self.brand
         return f"{self.brand} ····{self.last4}"
 
-    @property
-    def provenance(self) -> Optional[str]:
-        """Human label for why this card was picked, or None (unknown rung /
-        server too old to say)."""
-        if self.resolved_via is None:
-            return None
-        return _CARD_PROVENANCE_LABELS.get(self.resolved_via)
-
-    @property
-    def display(self) -> str:
-        """The one-line card display: ``Visa ····4242 — the card on your
-        subscription`` (or just the masked card when provenance is unknown)."""
-        label = self.provenance
-        return f"{self.masked} — {label}" if label else self.masked
-
 
 @dataclass(frozen=True)
 class MonthlyCap:
@@ -114,20 +81,11 @@ class MonthlyCap:
     is_default_ceiling: bool = False
 
 
-@dataclass(frozen=True)
-class AutoReloadCard:
-    kind: str  # "canonical" | "distinct" | "none"
-    payment_method_id: Optional[str] = None
-    brand: Optional[str] = None
-    last4: Optional[str] = None
-
-
 @dataclass(frozen=True)
 class AutoReload:
     enabled: bool = False
     threshold_usd: Optional[Decimal] = None
     reload_to_usd: Optional[Decimal] = None
-    card: Optional[AutoReloadCard] = None
 
 
 @dataclass(frozen=True)
@@ -142,8 +100,7 @@ class BillingState:
     org_id: Optional[str] = None
     org_slug: Optional[str] = None
     org_name: Optional[str] = None
-    role: Optional[str] = None  # "OWNER" | "ADMIN" | "FINANCE_ADMIN" | "SECURITY_ADMIN" | "MEMBER"
-    can_change_plan_raw: Optional[bool] = None
+    role: Optional[str] = None  # "OWNER" | "ADMIN" | "MEMBER"
     balance_usd: Optional[Decimal] = None
     cli_billing_enabled: bool = False
     charge_presets: tuple[Decimal, ...] = ()
@@ -158,33 +115,17 @@ class BillingState:
 
     @property
     def is_admin(self) -> bool:
-        """Deprecated/display only — a legacy OWNER/ADMIN check.
-
-        NOT a capability check; use :attr:`can_change_plan` for gating billing
-        plan-change actions.
-        """
+        """True for OWNER/ADMIN — the roles that can manage billing."""
         return (self.role or "").upper() in ("OWNER", "ADMIN")
 
-    @property
-    def can_change_plan(self) -> bool:
-        """Server capability when supplied; otherwise the legacy role fallback."""
-        if self.can_change_plan_raw is not None:
-            return self.can_change_plan_raw
-        return self.is_admin
-
     @property
     def can_charge(self) -> bool:
         """True when the UI should offer charge/auto-reload actions.
 
-        Uses the server-granted plan-change capability (``can_change_plan``,
-        which itself falls back to the legacy OWNER/ADMIN role check when the
-        server omits ``canChangePlan``) AND the per-org kill-switch. This lets
-        the server grant charge capability to non-OWNER/ADMIN roles (e.g.
-        FINANCE_ADMIN) via ``canChangePlan``, instead of hard-coding the
-        deprecated 3-role admin check. (The server still enforces; this is
-        just for graying out actions the user can't take.)
+        Admin role AND the per-org kill-switch on. (The server still enforces;
+        this is just for graying out actions the user can't take.)
         """
-        return self.can_change_plan and self.cli_billing_enabled
+        return self.is_admin and self.cli_billing_enabled
 
 
 def _parse_card(raw: Any) -> Optional[CardInfo]:
@@ -192,13 +133,9 @@ def _parse_card(raw: Any) -> Optional[CardInfo]:
         return None
     brand = raw.get("brand")
     last4 = raw.get("last4")
-    if not (isinstance(brand, str) and isinstance(last4, str)):
-        return None
-    # Post-resolver fields — all optional so both payload generations parse.
-    resolved_via = raw.get("resolvedVia")
-    if not isinstance(resolved_via, str):
-        resolved_via = None
-    return CardInfo(brand=brand, last4=last4, resolved_via=resolved_via)
+    if isinstance(brand, str) and isinstance(last4, str):
+        return CardInfo(brand=brand, last4=last4)
+    return None
 
 
 def _parse_monthly_cap(raw: Any) -> Optional[MonthlyCap]:
@@ -218,27 +155,6 @@ def _parse_auto_reload(raw: Any) -> Optional[AutoReload]:
         enabled=bool(raw.get("enabled")),
         threshold_usd=parse_money(raw.get("thresholdUsd")),
         reload_to_usd=parse_money(raw.get("reloadToUsd")),
-        card=_parse_auto_reload_card(raw.get("card")),
-    )
-
-
-def _parse_auto_reload_card(raw: Any) -> Optional[AutoReloadCard]:
-    if not isinstance(raw, dict):
-        return None
-    kind = raw.get("kind")
-    if kind not in ("canonical", "distinct", "none"):
-        return None
-    if kind in ("canonical", "none"):
-        return AutoReloadCard(kind=kind)
-
-    payment_method_id = raw.get("paymentMethodId")
-    brand = raw.get("brand")
-    last4 = raw.get("last4")
-    return AutoReloadCard(
-        kind=kind,
-        payment_method_id=payment_method_id if isinstance(payment_method_id, str) else None,
-        brand=brand if isinstance(brand, str) else None,
-        last4=last4 if isinstance(last4, str) else None,
     )
 
 
@@ -263,11 +179,6 @@ def billing_state_from_payload(
         org_slug=org.get("slug"),
         org_name=org.get("name"),
         role=org.get("role"),
-        can_change_plan_raw=(
-            payload.get("canChangePlan")
-            if isinstance(payload.get("canChangePlan"), bool)
-            else None
-        ),
         balance_usd=parse_money(payload.get("balanceUsd")),
         cli_billing_enabled=bool(payload.get("cliBillingEnabled")),
         charge_presets=tuple(presets),
@@ -291,15 +202,7 @@ def build_billing_state(*, timeout: float = 15.0) -> BillingState:
     Returns ``BillingState(logged_in=False)`` when not logged in. On a portal/HTTP
     failure, returns ``logged_in=False`` with ``error`` set so the surface can show
     a clear message rather than crashing.
-
-    Dev override: ``HERMES_DEV_BILLING_FIXTURE`` short-circuits to a fixture so the
-    card-on-file / admin / scope states are testable offline (mirrors
-    ``HERMES_DEV_CREDITS_FIXTURE`` for the usage model).
     """
-    fixture = _dev_fixture_billing_state()
-    if fixture is not None:
-        return fixture
-
     try:
         from hermes_cli.nous_billing import (
             BillingAuthError,
@@ -340,72 +243,6 @@ def _fallback_portal_url(base: str) -> str:
     return f"{base.rstrip('/')}/billing?topup=open"
 
 
-# =============================================================================
-# Dev fixtures (throwaway scaffolding — env-var driven, no live portal)
-# =============================================================================
-
-
-def _dev_fixture_billing_state() -> Optional[BillingState]:
-    """Map ``HERMES_DEV_BILLING_FIXTURE`` to a :class:`BillingState` for offline UX.
-
-    Recognized names::
-
-        nocard           logged in · billing on · admin · NO card on file
-        card             card on file · auto-reload off
-        card-autoreload  card on file · auto-reload on
-        notadmin         logged in · MEMBER role (billing actions disabled)
-        billing-off      logged in · admin · per-org kill-switch OFF
-        logged-out       not logged in
-
-    Returns ``None`` when the env var is unset (the real portal path runs).
-    Mirrors ``HERMES_DEV_CREDITS_FIXTURE``; the usage *bar* still comes from
-    ``HERMES_DEV_CREDITS_FIXTURE`` (set both to pair a bar with a billing state).
-    """
-    name = (os.getenv("HERMES_DEV_BILLING_FIXTURE") or "").strip().lower()
-    if not name:
-        return None
-
-    # Shared fixture portal host (matches subscription_view._DEV_FIXTURE_PORTAL —
-    # prod host, not staging; the ?topup=open suffix is the /topup deep-link).
-    portal = "https://portal.nousresearch.com/billing?topup=open"
-    common: dict[str, Any] = dict(
-        org_id="org_acme",
-        org_slug="acme",
-        org_name="Acme Inc",
-        role="OWNER",
-        balance_usd=Decimal("3.40"),
-        cli_billing_enabled=True,
-        charge_presets=(Decimal("10"), Decimal("25"), Decimal("50")),
-        min_usd=Decimal("5"),
-        max_usd=Decimal("500"),
-        portal_url=portal,
-    )
-    card = CardInfo(brand="Visa", last4="4242")
-    autoreload_on = AutoReload(enabled=True, threshold_usd=Decimal("5"), reload_to_usd=Decimal("25"))
-
-    if name in ("logged-out", "logged_out", "loggedout"):
-        return BillingState(logged_in=False)
-    if name == "nocard":
-        return BillingState(logged_in=True, card=None, **common)
-    if name == "card":
-        return BillingState(logged_in=True, card=card, **common)
-    if name in ("card-sub", "card_sub"):
-        # Post-resolver: the card came from the subscription (provenance label).
-        _sub_card = CardInfo(brand="Visa", last4="4242", resolved_via="subPin")
-        return BillingState(logged_in=True, card=_sub_card, **common)
-    if name in ("card-autoreload", "card_autoreload", "autoreload"):
-        return BillingState(logged_in=True, card=card, auto_reload=autoreload_on, **common)
-    if name in ("notadmin", "not-admin", "member"):
-        opts = {**common, "role": "MEMBER"}
-        return BillingState(logged_in=True, card=card, **opts)
-    if name in ("billing-off", "billing_off", "off"):
-        opts = {**common, "cli_billing_enabled": False}
-        return BillingState(logged_in=True, card=None, **opts)
-
-    # Unknown name → logged-out so the misconfiguration is visible.
-    return BillingState(logged_in=False, error=f"unknown HERMES_DEV_BILLING_FIXTURE: {name}")
-
-
 # =============================================================================
 # Idempotency
 # =============================================================================

agent/codex_responses_adapter.py

@@ -912,8 +912,7 @@ def _preflight_codex_api_kwargs(
     allowed_keys = {
         "model", "instructions", "input", "tools", "store",
         "reasoning", "include", "max_output_tokens", "temperature",
-        "tool_choice", "parallel_tool_calls", "prompt_cache_key",
-        "prompt_cache_retention", "service_tier",
+        "tool_choice", "parallel_tool_calls", "prompt_cache_key", "service_tier",
         "extra_headers", "extra_body", "timeout",
     }
     normalized: Dict[str, Any] = {
@@ -951,13 +950,8 @@ def _preflight_codex_api_kwargs(
     if isinstance(temperature, (int, float)):
         normalized["temperature"] = float(temperature)
 
-    # Pass through cache routing/retention and tool-dispatch hints.
-    for passthrough_key in (
-        "tool_choice",
-        "parallel_tool_calls",
-        "prompt_cache_key",
-        "prompt_cache_retention",
-    ):
+    # Pass through tool_choice, parallel_tool_calls, prompt_cache_key
+    for passthrough_key in ("tool_choice", "parallel_tool_calls", "prompt_cache_key"):
         val = api_kwargs.get(passthrough_key)
         if val is not None:
             normalized[passthrough_key] = val

agent/codex_runtime.py

@@ -23,8 +23,6 @@ import time
 from types import SimpleNamespace
 from typing import Any, Callable, Dict, List
 
-from agent.stream_single_writer import claim_stream_writer, stream_writer_is_current
-
 logger = logging.getLogger(__name__)
 
 
@@ -456,27 +454,6 @@ def make_codex_app_server_event_bridge(agent) -> Callable[[dict], None]:
     # even when codex doesn't report durationMs.
     started: dict[str, tuple[str, dict, float]] = {}
 
-    def _stable_call_id(item: dict, name: str) -> str:
-        """Deterministic tool_call id mirroring CodexEventProjector, so a
-        live TUI tool card correlates with the same tool call after the
-        session is resumed and history is projected."""
-        from agent.transports.codex_event_projector import _deterministic_call_id
-
-        item_id = item.get("id") or ""
-        item_type = item.get("type") or ""
-        if item_type == "commandExecution":
-            return _deterministic_call_id("exec", item_id)
-        if item_type == "fileChange":
-            return _deterministic_call_id("apply_patch", item_id)
-        if item_type == "mcpToolCall":
-            server = item.get("server") or "mcp"
-            tool = item.get("tool") or "unknown"
-            return _deterministic_call_id(f"mcp__{server}__{tool}", item_id)
-        if item_type == "dynamicToolCall":
-            tool = item.get("tool") or "unknown"
-            return _deterministic_call_id(f"dyn_{tool}", item_id)
-        return _deterministic_call_id(name, item_id)
-
     def _fire_tool_started(item: dict) -> None:
         item_id = item.get("id") or ""
         name = _codex_item_to_tool_name(item)
@@ -484,26 +461,15 @@ def make_codex_app_server_event_bridge(agent) -> Callable[[dict], None]:
         if item_id:
             started[item_id] = (name, args, time.monotonic())
         cb = getattr(agent, "tool_progress_callback", None)
-        if cb is not None:
-            try:
-                cb("tool.started", name, _codex_item_to_preview(item), args)
-            except Exception:
-                logger.debug(
-                    "tool_progress_callback raised on tool.started for %s",
-                    name, exc_info=True,
-                )
-        # Authoritative stable-ID tool card (TUI / desktop). Fires
-        # alongside tool_progress so surfaces that render structured tool
-        # cards (not just progress bubbles) stay correlated with the
-        # projected history entry after a resume.
-        start_cb = getattr(agent, "tool_start_callback", None)
-        if start_cb is not None:
-            try:
-                start_cb(_stable_call_id(item, name), name, args)
-            except Exception:
-                logger.debug(
-                    "tool_start_callback raised for %s", name, exc_info=True,
-                )
+        if cb is None:
+            return
+        try:
+            cb("tool.started", name, _codex_item_to_preview(item), args)
+        except Exception:
+            logger.debug(
+                "tool_progress_callback raised on tool.started for %s",
+                name, exc_info=True,
+            )
 
     def _fire_tool_completed(item: dict) -> None:
         item_id = item.get("id") or ""
@@ -521,24 +487,16 @@ def make_codex_app_server_event_bridge(agent) -> Callable[[dict], None]:
             duration = time.monotonic() - prior[2]
         result, is_error = _codex_item_completion_payload(item)
         cb = getattr(agent, "tool_progress_callback", None)
-        if cb is not None:
-            try:
-                cb("tool.completed", name, None, None,
-                   duration=duration, is_error=is_error, result=result)
-            except Exception:
-                logger.debug(
-                    "tool_progress_callback raised on tool.completed for %s",
-                    name, exc_info=True,
-                )
-        complete_cb = getattr(agent, "tool_complete_callback", None)
-        if complete_cb is not None:
-            args = prior[1] if prior is not None else _codex_item_to_args(item)
-            try:
-                complete_cb(_stable_call_id(item, name), name, args, result)
-            except Exception:
-                logger.debug(
-                    "tool_complete_callback raised for %s", name, exc_info=True,
-                )
+        if cb is None:
+            return
+        try:
+            cb("tool.completed", name, None, None,
+               duration=duration, is_error=is_error, result=result)
+        except Exception:
+            logger.debug(
+                "tool_progress_callback raised on tool.completed for %s",
+                name, exc_info=True,
+            )
 
     def _fire_text_delta(params: dict) -> None:
         text = params.get("delta") or params.get("text") or ""
@@ -593,7 +551,7 @@ def make_codex_app_server_event_bridge(agent) -> Callable[[dict], None]:
         if method == "item/agentMessage/delta":
             _fire_text_delta(params)
             return
-        if method in {"item/reasoning/delta", "item/reasoning/summaryDelta"}:
+        if method == "item/reasoning/delta":
             _fire_reasoning_delta(params)
             return
         item = params.get("item")
@@ -702,16 +660,6 @@ def run_codex_app_server_turn(
         except Exception:
             pass
         agent._codex_session = None
-        _user_interrupted = bool(
-            getattr(agent, "_interrupt_requested", False)
-        )
-        _interrupt_message = (
-            getattr(agent, "_interrupt_message", None)
-            if _user_interrupted
-            else None
-        )
-        if _user_interrupted:
-            agent.clear_interrupt()
         return {
             "final_response": (
                 f"Codex app-server turn failed: {exc}. "
@@ -721,27 +669,9 @@ def run_codex_app_server_turn(
             "api_calls": 0,
             "completed": False,
             "partial": True,
-            "interrupted": _user_interrupted,
-            **(
-                {"interrupt_message": _interrupt_message}
-                if _interrupt_message
-                else {}
-            ),
             "error": str(exc),
         }
 
-    # This runtime bypasses the normal conversation-loop finalizer. Mirror its
-    # interrupt handoff/cleanup so a hard stop cannot poison the next turn and a
-    # message-bearing compatibility interrupt can still be replayed by callers.
-    _user_interrupted = bool(
-        turn.interrupted and getattr(agent, "_interrupt_requested", False)
-    )
-    _interrupt_message = (
-        getattr(agent, "_interrupt_message", None) if _user_interrupted else None
-    )
-    if _user_interrupted:
-        agent.clear_interrupt()
-
     # If the turn signalled the underlying client is wedged (deadline
     # blown, post-tool watchdog tripped, OAuth refresh died, subprocess
     # exited), retire the session so the next turn respawns codex
@@ -847,12 +777,6 @@ def run_codex_app_server_turn(
         "api_calls": api_calls,
         "completed": not turn.interrupted and turn.error is None,
         "partial": turn.interrupted or turn.error is not None,
-        "interrupted": _user_interrupted,
-        **(
-            {"interrupt_message": _interrupt_message}
-            if _interrupt_message
-            else {}
-        ),
         "error": turn.error,
         # The codex app-server runtime IS an early-return path that bypasses
         # conversation_loop, but we flush the projected assistant/tool messages
@@ -1266,12 +1190,12 @@ def run_codex_stream(agent, api_kwargs: dict, client: Any = None, on_first_delta
         # late deltas are fenced out of the turn; conversely, a newer
         # attempt supersedes us and the interrupt_check below stops our
         # consumption immediately.
-        _writer_token = claim_stream_writer(agent)
+        _writer_token = agent._claim_stream_writer()
 
         def _interrupt_or_superseded(_tok=_writer_token) -> bool:
             if agent._interrupt_requested:
                 return True
-            if not stream_writer_is_current(agent, _tok):
+            if not agent._stream_writer_is_current(_tok):
                 logger.warning(
                     "Codex streaming attempt superseded by a newer stream; "
                     "stopping consumption to preserve the single-writer "

agent/coding_context.py

@@ -55,12 +55,13 @@ import json
 import logging
 import os
 import re
+import subprocess
 import tempfile
 from dataclasses import dataclass
 from pathlib import Path
 from typing import Any, Optional
 
-from hermes_cli._subprocess_compat import bounded_git_probe
+from hermes_cli._subprocess_compat import IS_WINDOWS, windows_hide_flags
 
 logger = logging.getLogger("hermes.coding_context")
 
@@ -520,46 +521,30 @@ class RuntimeMode:
             return None
         return [self.profile.toolset, *_enabled_mcp_servers(config)]
 
-    def system_prompt_parts(self) -> tuple[list[str], list[str], list[str]]:
-        """Return prefix, workspace, and trailing posture blocks separately.
+    def system_blocks(self) -> list[str]:
+        """Stable system-prompt blocks for this posture (brief + workspace).
 
         The operating brief carries a model-family edit-format nudge appended
         to it (one cached string, not a separate block) so the model is steered
         toward the `patch` mode it handles best — see ``_edit_format_line``.
-
-        The three lists preserve the historical flat prompt order: the brief,
-        the live workspace snapshot, then configured operator instructions.
-        Prompt assembly can therefore put a cache boundary before the snapshot
-        without changing the persisted system-prompt bytes.
         """
         if not self.is_coding:
-            return [], [], []
-        prefix: list[str] = []
-        workspace_parts: list[str] = []
-        trailing: list[str] = []
+            return []
+        blocks: list[str] = []
         if self.profile.guidance:
             brief = self.profile.guidance
             edit_line = _edit_format_line(self.model)
             if edit_line:
                 brief = f"{brief}\n{edit_line}"
-            prefix.append(brief)
+            blocks.append(brief)
         workspace = build_coding_workspace_block(self.cwd)
         if workspace:
-            workspace_parts.append(workspace)
+            blocks.append(workspace)
         # Operator instructions ride their own block so the brief (block 0) stays
         # byte-stable and cache-keyed independently of user config.
         if self.instructions:
-            trailing.append(f"Operator instructions (from config):\n{self.instructions}")
-        return prefix, workspace_parts, trailing
-
-    def system_blocks(self) -> list[str]:
-        """Return posture blocks in their historical display order.
-
-        ``system_prompt_parts`` is the cache-aware API. This compatibility
-        helper retains the public flat list for callers outside prompt assembly.
-        """
-        prefix, workspace, trailing = self.system_prompt_parts()
-        return [*prefix, *workspace, *trailing]
+            blocks.append(f"Operator instructions (from config):\n{self.instructions}")
+        return blocks
 
     def compact_skill_categories(self) -> frozenset[str]:
         """Skill categories to demote to names-only in the prompt's skill index.
@@ -660,19 +645,6 @@ def coding_system_blocks(
     ).system_blocks()
 
 
-def coding_system_prompt_parts(
-    *,
-    platform: Optional[str] = None,
-    cwd: Optional[str | Path] = None,
-    config: Optional[dict[str, Any]] = None,
-    model: Optional[str] = None,
-) -> tuple[list[str], list[str], list[str]]:
-    """Return coding prefix, workspace snapshot, and trailing guidance."""
-    return resolve_runtime_mode(
-        platform=platform, cwd=cwd, config=config, model=model
-    ).system_prompt_parts()
-
-
 def coding_compact_skill_categories(
     *,
     platform: Optional[str] = None,
@@ -717,14 +689,18 @@ def _enabled_mcp_servers(config: Optional[dict[str, Any]]) -> list[str]:
 
 
 def _git(cwd: Path, *args: str) -> str:
-    """``git -C <cwd> <args>`` → stripped stdout, or ``""`` on any failure.
-
-    Uses the shared :func:`bounded_git_probe` so the post-kill cleanup is bounded
-    on Windows — a plain ``subprocess.run(timeout=...)`` here deadlocked the agent
-    turn inside ``build_coding_workspace_block`` when a killed git left a suspended
-    descendant holding the pipe handles (issue #66037).
-    """
-    return bounded_git_probe(["git", "-C", str(cwd), *args], timeout=_GIT_TIMEOUT)
+    _popen_kwargs = {"creationflags": windows_hide_flags()} if IS_WINDOWS else {}
+    try:
+        out = subprocess.run(
+            ["git", "-C", str(cwd), *args],
+            capture_output=True,
+            text=True,
+            timeout=_GIT_TIMEOUT,
+            **_popen_kwargs,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return ""
+    return out.stdout.strip() if out.returncode == 0 else ""
 
 
 def _parse_status(porcelain: str) -> tuple[dict[str, str], dict[str, int]]:

agent/context_engine.py

@@ -26,64 +26,7 @@ Lifecycle:
 """
 
 from abc import ABC, abstractmethod
-from typing import Any, Dict, List, Optional
-
-from agent.redact import redact_sensitive_text
-
-
-MEMORY_CONTEXT_MAX_CHARS = 6_000
-_MEMORY_CONTEXT_HEAD_CHARS = 4_000
-_MEMORY_CONTEXT_TAIL_CHARS = 1_500
-_MEMORY_CONTEXT_TRUNCATION_MARKER = "\n...[memory provider context truncated]...\n"
-
-
-def sanitize_memory_context(memory_context: str) -> str:
-    """Prepare provider context for a context-engine/LLM egress boundary."""
-    sanitized = redact_sensitive_text(
-        memory_context.strip(),
-        force=True,
-        redact_url_credentials=True,
-    )
-    if len(sanitized) <= MEMORY_CONTEXT_MAX_CHARS:
-        return sanitized
-    return (
-        sanitized[:_MEMORY_CONTEXT_HEAD_CHARS]
-        + _MEMORY_CONTEXT_TRUNCATION_MARKER
-        + sanitized[-_MEMORY_CONTEXT_TAIL_CHARS:]
-    )
-
-
-def automatic_compaction_status_message(
-    engine: Any,
-    *,
-    phase: str,
-    default_message: str,
-    **context: Any,
-) -> str | None:
-    """Resolve host-visible status for an automatic compaction event.
-
-    Engines can suppress routine automatic status with
-    ``emit_automatic_compaction_status = False`` or customize it by defining
-    ``get_automatic_compaction_status_message(...)``. Empty strings and
-    ``None`` mean "do not emit a lifecycle status".
-    """
-    if not getattr(engine, "emit_automatic_compaction_status", True):
-        return None
-
-    formatter = getattr(engine, "get_automatic_compaction_status_message", None)
-    if callable(formatter):
-        message = formatter(
-            phase=phase,
-            default_message=default_message,
-            **context,
-        )
-    else:
-        message = default_message
-
-    if message is None:
-        return None
-    message = str(message).strip()
-    return message or None
+from typing import Any, Dict, List
 
 
 class ContextEngine(ABC):
@@ -122,12 +65,6 @@ class ContextEngine(ABC):
     protect_first_n: int = 3
     protect_last_n: int = 6
 
-    # User-visible lifecycle status for automatic host-triggered compaction.
-    # Alternative engines that treat compaction as routine background
-    # maintenance can set this false to keep successful automatic passes silent;
-    # warnings, errors, and explicit manual commands should still surface.
-    emit_automatic_compaction_status: bool = True
-
     # -- Core interface ----------------------------------------------------
 
     @abstractmethod
@@ -146,27 +83,12 @@ class ContextEngine(ABC):
     def should_compress(self, prompt_tokens: int = None) -> bool:
         """Return True if compaction should fire this turn."""
 
-    def should_compress_info(self, prompt_tokens: int = None) -> "tuple[bool, str | None]":
-        """Return ``(should_compress, reason)``.
-
-        The base implementation is backward-compatible: engines that only
-        implement ``should_compress`` get ``(should_compress(prompt_tokens),
-        None)``. Concrete engines with richer block reasons (e.g. a
-        summary-LLM cooldown or an anti-thrashing guard) override this to
-        surface a human-readable reason so callers can warn the user instead
-        of silently skipping compression. Added for the silent-overflow
-        warning fix (#62625) so plugin engines don't raise AttributeError.
-        """
-        return self.should_compress(prompt_tokens), None
-
     @abstractmethod
     def compress(
         self,
         messages: List[Dict[str, Any]],
-        current_tokens: Optional[int] = None,
-        focus_topic: Optional[str] = None,
-        force: bool = False,
-        memory_context: str = "",
+        current_tokens: int = None,
+        focus_topic: str = None,
     ) -> List[Dict[str, Any]]:
         """Compact the message list and return the new message list.
 
@@ -181,152 +103,8 @@ class ContextEngine(ABC):
                 Engines that support guided compression should prioritise
                 preserving information related to this topic.  Engines that
                 don't support it may simply ignore this argument.
-            force: Whether a user-requested compression should bypass an
-                engine-owned cooldown. Engines without cooldowns may ignore it.
-            memory_context: Text returned by memory providers immediately before
-                compaction. Summarizing engines should include non-empty text in
-                their handoff prompt. Older engines may omit this parameter; the
-                host filters unsupported optional arguments by signature.
         """
 
-    # -- Optional: proactive tool-result prune -----------------------------
-
-    def prune_tool_results_only(
-        self,
-        messages: List[Dict[str, Any]],
-        current_tokens: int | None = None,
-    ) -> tuple[List[Dict[str, Any]], int]:
-        """Deterministically trim old tool-result payloads without an LLM call.
-
-        Runs on a low, cost-oriented trigger independent of ``should_compress``
-        so large-window engines can reclaim re-sent tool output long before full
-        compaction would fire. Returns ``(messages, n_pruned)``.
-
-        Default is a safe no-op: the list is returned unchanged with ``0``
-        pruned. Engines that don't implement a cheap prune — and any engine that
-        predates this hook — inherit this default, so the agent loop's
-        post-tool-call prune path never raises ``AttributeError`` on them. The
-        built-in ContextCompressor overrides this with the real implementation.
-        """
-        return messages, 0
-
-    # -- Optional: per-turn context selection (distinct from compression) --
-
-    def select_context(
-        self,
-        request_messages: List[Dict[str, Any]],
-        *,
-        conversation_messages: List[Dict[str, Any]] = None,
-        incoming_message: Dict[str, Any] = None,
-        budget_tokens: int = 0,
-    ) -> List[Dict[str, Any]]:
-        """Optionally choose/replace the context for THIS request, pre-generation.
-
-        Called every turn after the request message list is assembled and
-        before it is dispatched to the provider — independent of
-        ``should_compress()``. This lets an engine *select* which context
-        enters the prompt (retrieval, topic routing, role/branch switching)
-        rather than *shrink* context that is already there. The two verbs are
-        orthogonal:
-
-          - ``compress()``      : context is too long  -> make it shorter.
-          - ``select_context()``: this turn belongs to a different context
-                                  -> use that one instead.
-
-        Without this hook, engines that need per-turn access to the message
-        list have to force ``should_compress()`` to return ``True`` so that
-        ``compress()`` is invoked every turn purely as a callback — which
-        conflates selection with compression and degrades behaviour when the
-        engine's backend is unavailable. ``select_context()`` removes the need
-        for that workaround.
-
-        The returned list is request-only: it replaces the messages sent to
-        the provider for this single call and MUST NOT be treated as persisted
-        transcript state. The conversation history in the session DB is left
-        untouched, so nothing leaks across turns. Return ``None`` to leave the
-        request unchanged.
-
-        Unlike the ``pre_llm_call`` plugin hook (which appends to the user
-        message and intentionally never rewrites the list, to preserve the
-        cache prefix), ``select_context()`` may *replace* the message list.
-
-        Ordering / cache contract: the host runs this hook **before** prompt
-        cache-control and **before** every request sanitizer (orphaned-tool
-        cleanup, thinking-only/role normalization, whitespace/JSON
-        normalization). So (a) whatever the hook returns still passes through
-        the same validation as any request — a malformed replacement cannot
-        reach the provider — and (b) prompt-cache stability (an AGENTS.md
-        invariant) is preserved: the default no-op leaves the request
-        byte-identical, so cache behaviour is unchanged for the built-in
-        compressor and any non-implementing engine. An engine that *does*
-        replace the list changes its own cache prefix by definition; that is
-        the engine's concern, and cache-control breakpoints are re-derived on
-        the selected list. The hook is evaluated per provider request (so it
-        re-runs on retries within a turn), consistent with "select the context
-        for THIS request".
-
-        Args:
-            request_messages: The assembled request message list (system
-                prompt + history + any ephemeral prefill), in OpenAI format.
-            conversation_messages: The unmodified persisted conversation
-                history, for reference only (do not mutate).
-            incoming_message: The current turn's user message, if available.
-            budget_tokens: The active model's context length, or 0 if unknown.
-
-        Default returns ``None`` (no-op) — zero impact on the built-in
-        compressor or any existing engine.
-        """
-        return None
-
-    def on_turn_complete(
-        self,
-        messages: List[Dict[str, Any]],
-        usage: Dict[str, Any] = None,
-        **kwargs: Any,
-    ) -> None:
-        """Observe a finished user turn (post-turn ingestion / observation).
-
-        Called from the standard turn-finalization path once the assistant/tool
-        loop completes, with the finalized in-memory transcript snapshot. This
-        is the complement to ``select_context()``: selection happens *before*
-        the request, while observation happens *after* the turn. It lets an
-        engine ingest, index, summarize, or update routing / topic / session
-        state from what actually happened — so the next ``select_context()``
-        can act on it.
-
-        Coverage: this fires from the normal finalization seam. Some abnormal
-        early-return paths in the loop (e.g. a content-policy block or a
-        provider terminal failure) persist and return without routing through
-        finalization, and therefore do not currently emit this hook. Treat it
-        as a best-effort post-turn observation for completed turns, not a
-        guaranteed callback for every possible early exit; unifying all
-        terminal paths behind one finalization seam is a separate follow-up.
-
-        Together the two hooks remove the need to abuse ``should_compress()`` /
-        ``compress()`` as a generic per-turn callback just to observe history,
-        and they cover the case where a turn finishes and there may be no next
-        request from which to infer the previous turn.
-
-        ``messages`` is a shallow copy and should be treated as read-only:
-        return values are ignored and this hook must not rely on transcript
-        mutation for persistence. ``kwargs`` may include ``turn_id``,
-        ``task_id``, ``api_call_count``, ``interrupted``, ``failed``, and
-        ``turn_exit_reason``.
-
-        ``usage`` carries the completed turn's canonical token usage (the same
-        dict shape passed to ``update_from_response`` — ``prompt_tokens`` /
-        ``completion_tokens`` / ``total_tokens`` plus the canonical
-        ``input_tokens`` / ``output_tokens`` / ``cache_read_tokens`` /
-        ``cache_write_tokens`` / ``reasoning_tokens`` buckets) so an engine can
-        weigh how large/expensive the selected context actually was when
-        deciding the next ``select_context()``. It is ``None`` on finalized
-        turns that never reached a provider response (e.g. interrupt); engines
-        must treat it as optional.
-
-        Default is a no-op.
-        """
-        return None
-
     # -- Optional: pre-flight check ----------------------------------------
 
     def should_compress_preflight(self, messages: List[Dict[str, Any]]) -> bool:
@@ -346,27 +124,6 @@ class ContextEngine(ABC):
         """
         return False
 
-    def get_automatic_compaction_status_message(
-        self,
-        *,
-        phase: str,
-        default_message: str,
-        **context: Any,
-    ) -> str | None:
-        """Return user-visible status for automatic host-triggered compaction.
-
-        Return ``None`` to suppress successful automatic lifecycle status for
-        this compaction event. ``phase`` identifies the host call site (for
-        example ``"preflight"`` or ``"compress"``). ``context`` contains
-        best-effort fields such as ``approx_tokens`` and ``threshold_tokens``.
-
-        This hook does not control warning/error messages or explicit manual
-        commands such as ``/compress``.
-        """
-        if not self.emit_automatic_compaction_status:
-            return None
-        return default_message
-
     # -- Optional: manual /compress preflight ------------------------------
 
     def has_content_to_compress(self, messages: List[Dict[str, Any]]) -> bool:
@@ -471,19 +228,4 @@ class ContextEngine(ABC):
         (e.g. recalculate DAG budgets, switch summary models).
         """
         self.context_length = context_length
-        # Apply per-model threshold overrides if set (longest substring match).
-        # Falls back to _config_threshold_percent (the raw config value) when
-        # no override matches. Plugin engines that override update_model() can
-        # call resolve_model_threshold() for the same logic.
-        from agent.context_compressor import resolve_model_threshold
-        if not hasattr(self, "_config_threshold_percent"):
-            # Snapshot the pre-override percent ONCE so repeated model
-            # switches fall back to the engine's configured value, not the
-            # previous model's override.
-            self._config_threshold_percent = self.threshold_percent
-        self._base_threshold_percent = resolve_model_threshold(
-            model, getattr(self, "model_thresholds", {}),
-            self._config_threshold_percent,
-        )
-        self.threshold_percent = self._base_threshold_percent
         self.threshold_tokens = int(context_length * self.threshold_percent)

agent/context_references.py

@@ -308,7 +308,7 @@ def _expand_git_reference(
             ["git", *args],
             cwd=cwd,
             capture_output=True,
-            text=True, encoding='utf-8', errors='replace',
+            text=True,
             timeout=30,
             stdin=subprocess.DEVNULL,
             **_popen_kwargs,
@@ -534,7 +534,7 @@ def _rg_files(path: Path, cwd: Path, limit: int) -> list[Path] | None:
             ["rg", "--files", str(path.relative_to(cwd))],
             cwd=cwd,
             capture_output=True,
-            text=True, encoding='utf-8', errors='replace',
+            text=True,
             timeout=10,
             stdin=subprocess.DEVNULL,
             **_popen_kwargs,

agent/copilot_acp_client.py

@@ -503,20 +503,15 @@ class CopilotACPClient:
 
     def _run_prompt(self, prompt_text: str, *, timeout_seconds: float) -> tuple[str, str]:
         try:
-            # Hide the console the CLI child would otherwise flash on Windows
-            # (#56747). Hide-only — stdio pipes stay intact for the ACP wire.
-            from hermes_cli._subprocess_compat import windows_hide_flags
-
             proc = subprocess.Popen(
                 [self._acp_command] + self._acp_args,
                 stdin=subprocess.PIPE,
                 stdout=subprocess.PIPE,
                 stderr=subprocess.PIPE,
-                text=True, encoding='utf-8', errors='replace',
+                text=True,
                 bufsize=1,
                 cwd=self._acp_cwd,
                 env=_build_subprocess_env(),
-                creationflags=windows_hide_flags(),
             )
         except FileNotFoundError as exc:
             raise RuntimeError(
@@ -708,7 +703,7 @@ class CopilotACPClient:
                 if block_error:
                     raise PermissionError(block_error)
                 try:
-                    content = path.read_text(encoding="utf-8")
+                    content = path.read_text()
                 except FileNotFoundError:
                     content = ""
                 line = params.get("line")
@@ -736,7 +731,7 @@ class CopilotACPClient:
                 if denied:
                     raise PermissionError(denied)
                 path.parent.mkdir(parents=True, exist_ok=True)
-                path.write_text(str(params.get("content") or ""), encoding="utf-8")
+                path.write_text(str(params.get("content") or ""))
                 response = {
                     "jsonrpc": "2.0",
                     "id": message_id,

agent/credential_pool.py

@@ -43,19 +43,11 @@ logger = logging.getLogger(__name__)
 
 
 def _load_config_safe() -> Optional[dict]:
-    """Load config.yaml read-only, returning None on any error.
-
-    Uses ``load_config_readonly()``: every consumer in this module only reads
-    (``get_pool_strategy``, ``_iter_custom_providers``, the model-config seed),
-    and the deepcopy that ``load_config()`` pays per call is what made
-    credential-pool checks the dominant cost of ``model.options`` — the picker
-    calls ``load_pool()`` once per provider row, each of which loaded (and
-    deep-copied) the full config again.
-    """
+    """Load config.yaml, returning None on any error."""
     try:
-        from hermes_cli.config import load_config_readonly
+        from hermes_cli.config import load_config
 
-        return load_config_readonly()
+        return load_config()
     except Exception:
         return None
 
@@ -594,64 +586,22 @@ class CredentialPool:
         # Re-armed to None on every successful selection so a recover→re-exhaust
         # transition logs promptly instead of being swallowed by a stale window.
         self._last_no_entries_log_at: Optional[float] = None
-        # #70401: consecutive mark_exhausted_and_rotate() calls whose supplied
-        # credential identity matched no pool entry (OAuth wrappers whose
-        # runtime key rotates, entries pruned by another process, ...).  These
-        # rotations mark nothing exhausted, so without a cap the pool can
-        # never converge to "no available entries" and the caller's 401 retry
-        # loop runs unbounded and non-interruptible.  Reset whenever a real
-        # entry is identified or an escape path returns None.
-        self._unmatched_rotation_streak: int = 0
 
     def has_credentials(self) -> bool:
-        with self._lock:
-            return bool(self._entries)
+        return bool(self._entries)
 
     def has_available(self) -> bool:
         """True if at least one entry is not currently in exhaustion cooldown."""
-        # ``_available_entries`` is not read-only: it prunes aged-out DEAD
-        # manual entries (rebinding ``self._entries``) and persists.  It must
-        # run under ``self._lock`` like every other caller (``select`` etc.),
-        # otherwise a status probe here can race a concurrent ``select`` /
-        # rotation and tear ``self._entries`` or double-write auth.json.
-        with self._lock:
-            return bool(self._available_entries())
+        return bool(self._available_entries())
 
     def entries(self) -> List[PooledCredential]:
-        with self._lock:
-            return list(self._entries)
+        return list(self._entries)
 
-    def _current_unlocked(self) -> Optional[PooledCredential]:
+    def current(self) -> Optional[PooledCredential]:
         if not self._current_id:
             return None
         return next((entry for entry in self._entries if entry.id == self._current_id), None)
 
-    def current(self) -> Optional[PooledCredential]:
-        with self._lock:
-            return self._current_unlocked()
-
-    def entry_id_for_api_key(self, api_key_hint: Any = None) -> Optional[str]:
-        """Return the stable id for the runtime credential in use.
-
-        Prefer the current selection when it still supplies ``api_key_hint``.
-        If the cursor was cleared, fall back to an unambiguous key match.
-        """
-        with self._lock:
-            current = self._current_unlocked()
-            if current is not None and (
-                api_key_hint is None
-                or current.runtime_api_key == api_key_hint
-            ):
-                return current.id
-            if api_key_hint is None:
-                return None
-            matches = [
-                entry
-                for entry in self._entries
-                if entry.runtime_api_key == api_key_hint
-            ]
-            return matches[0].id if len(matches) == 1 else None
-
     def _replace_entry(self, old: PooledCredential, new: PooledCredential) -> None:
         """Swap an entry in-place by id, preserving sort order."""
         for idx, entry in enumerate(self._entries):
@@ -694,8 +644,6 @@ class CredentialPool:
         entry: PooledCredential,
         status_code: Optional[int],
         error_context: Optional[Dict[str, Any]] = None,
-        *,
-        persist: bool = True,
     ) -> PooledCredential:
         normalized_error = _normalize_error_context(error_context)
         # Permanent OAuth failures (token_invalidated, token_revoked, etc.)
@@ -719,8 +667,7 @@ class CredentialPool:
             last_error_reset_at=normalized_error.get("reset_at"),
         )
         self._replace_entry(entry, updated)
-        if persist:
-            self._persist()
+        self._persist()
         return updated
 
     def _sync_anthropic_entry_from_credentials_file(self, entry: PooledCredential) -> PooledCredential:
@@ -1529,43 +1476,6 @@ class CredentialPool:
         self._sync_device_code_entry_to_auth_store(updated)
         return updated
 
-    def _codex_quota_restored_upstream(self, entry: PooledCredential) -> bool:
-        """Live-check whether an exhausted Codex entry's quota reset early.
-
-        A Codex 429 persists a ``last_error_reset_at`` that can be days in
-        the future (weekly windows), but the upstream window can reopen
-        before then — the user redeems a banked rate-limit reset via the
-        Codex CLI / ChatGPT UI, upgrades their plan, or OpenAI resets the
-        window.  Without this check the pool keeps the credential frozen
-        until the stale timestamp elapses even though the account is
-        usable (issue #43747).
-
-        Only fires for openai-codex entries frozen by a 429/quota-shaped
-        error.  The underlying probe is throttled per token (5 min) so this
-        is safe on the hot selection path.
-        """
-        if self.provider != "openai-codex" or entry.last_status != STATUS_EXHAUSTED:
-            return False
-        if not auth_mod._is_codex_rate_limit_shaped(
-            entry.last_error_code,
-            entry.last_error_reason,
-            entry.last_error_message,
-        ):
-            return False
-        token = entry.access_token or ""
-        if not token:
-            return False
-        try:
-            return bool(
-                auth_mod._probe_codex_quota_restored(
-                    token,
-                    base_url=entry.base_url,
-                )
-            )
-        except Exception:
-            logger.debug("Codex quota-restored probe failed", exc_info=True)
-            return False
-
     def _entry_needs_refresh(self, entry: PooledCredential) -> bool:
         if entry.auth_type != AUTH_TYPE_OAUTH:
             return False
@@ -1592,13 +1502,7 @@ class CredentialPool:
 
     def select(self) -> Optional[PooledCredential]:
         with self._lock:
-            entry = self._select_unlocked()
-            if entry is not None:
-                # A normal (non-recovery) selection starts a fresh episode —
-                # don't let a leftover unmatched-rotation streak from an old
-                # failure trip the #70401 bound early next time.
-                self._unmatched_rotation_streak = 0
-            return entry
+            return self._select_unlocked()
 
     def _available_entries(self, *, clear_expired: bool = False, refresh: bool = False) -> List[PooledCredential]:
         """Return entries not currently in exhaustion cooldown.
@@ -1693,18 +1597,7 @@ class CredentialPool:
             if entry.last_status == STATUS_EXHAUSTED:
                 exhausted_until = _exhausted_until(entry)
                 if exhausted_until is not None and now < exhausted_until:
-                    # Codex quota windows can reopen EARLY: the user redeems a
-                    # banked rate-limit reset (Codex CLI / ChatGPT UI), upgrades
-                    # their plan, or OpenAI resets the window.  The persisted
-                    # ``last_error_reset_at`` can then be days in the future
-                    # while the account is already usable again — a throttled
-                    # live probe of the Codex usage endpoint detects that and
-                    # lifts the stale cooldown (issue #43747).
-                    if not (
-                        clear_expired
-                        and self._codex_quota_restored_upstream(entry)
-                    ):
-                        continue
+                    continue
                 if clear_expired:
                     cleared = replace(
                         entry,
@@ -1777,21 +1670,18 @@ class CredentialPool:
             self._entries = [replace(candidate, priority=idx) for idx, candidate in enumerate(rotated)]
             self._persist()
             self._current_id = entry.id
-            return self._current_unlocked() or entry
+            return self.current() or entry
 
         entry = available[0]
         self._current_id = entry.id
         return entry
 
     def peek(self) -> Optional[PooledCredential]:
-        # Single lock acquisition for the whole read; call the unlocked
-        # helpers so we don't re-enter the non-reentrant ``self._lock``.
-        with self._lock:
-            current = self._current_unlocked()
-            if current is not None:
-                return current
-            available = self._available_entries()
-            return available[0] if available else None
+        current = self.current()
+        if current is not None:
+            return current
+        available = self._available_entries()
+        return available[0] if available else None
 
     def mark_exhausted_and_rotate(
         self,
@@ -1799,17 +1689,10 @@ class CredentialPool:
         status_code: Optional[int],
         error_context: Optional[Dict[str, Any]] = None,
         api_key_hint: Optional[str] = None,
-        credential_id: Optional[str] = None,
     ) -> Optional[PooledCredential]:
         with self._lock:
             entry = None
-            identity_supplied = bool(credential_id or api_key_hint)
-            if credential_id:
-                entry = next(
-                    (e for e in self._entries if e.id == credential_id),
-                    None,
-                )
-            if entry is None and api_key_hint:
+            if api_key_hint:
                 # Prefer the specific entry whose API key matches the one that
                 # actually failed.  When this pool was freshly loaded from disk
                 # (another process already rotated), current() is None and
@@ -1818,89 +1701,12 @@ class CredentialPool:
                     (e for e in self._entries if e.runtime_api_key == api_key_hint),
                     None,
                 )
-            if entry is None and identity_supplied:
-                # The failed credential is identifiable but matches no entry
-                # (rotated away, or a wrapper whose runtime key differs).
-                # Falling through to current()/_select_unlocked() would mark an
-                # innocent healthy key exhausted for the full cooldown TTL.
-                #
-                # #70401: this branch must still be BOUNDED. With OAuth-token
-                # auth the upstream 401's key hint never matches any entry's
-                # ``runtime_api_key``, so every retry lands here, nothing is
-                # ever marked exhausted, and the pool can never reach the
-                # "no available entries" state — the caller retries the same
-                # dead token forever (~6/sec, starving the event loop so chat
-                # interrupts are never processed). The single-entry case
-                # below already escapes; multi-entry pools could still
-                # ping-pong A→B→A indefinitely without marking anything.
-                # Cap consecutive no-mark rotations at one full lap of the
-                # available entries: past that, every candidate has been
-                # handed back at least once without recovery, so stop
-                # guessing and surface the error (no cooldown is written for
-                # anybody — healthy keys stay available for the next turn).
-                self._unmatched_rotation_streak += 1
-                available_count = len(self._available_entries())
-                if self._unmatched_rotation_streak > max(available_count, 1):
-                    logger.warning(
-                        "credential pool: failed credential identity matched no "
-                        "%s entry for %d consecutive rotations (pool size %d) — "
-                        "surfacing the error instead of rotating again",
-                        self.provider,
-                        self._unmatched_rotation_streak,
-                        available_count,
-                    )
-                    self._unmatched_rotation_streak = 0
-                    self._current_id = None
-                    return None
-                logger.info(
-                    "credential pool: failed credential identity matched no %s "
-                    "entry; rotating without marking any credential exhausted",
-                    self.provider,
-                )
-                self._current_id = None
-                next_entry = self._select_unlocked()
-                if next_entry is not None and len(self._available_entries()) == 1:
-                    # A single-entry pool cannot rotate. Returning its only
-                    # entry reports a successful recovery without changing
-                    # the credential, so the caller retries the same 401
-                    # indefinitely. Let fallback/error propagation proceed.
-                    self._unmatched_rotation_streak = 0
-                    self._current_id = None
-                    return None
-                return next_entry
-            # A real entry was identified — any prior unmatched-rotation
-            # streak is stale (this mark WILL advance pool state).
-            self._unmatched_rotation_streak = 0
             if entry is None:
-                entry = self._current_unlocked() or self._select_unlocked()
+                entry = self.current() or self._select_unlocked()
             if entry is None:
                 return None
             _label = entry.label or entry.id[:8]
             self._mark_exhausted(entry, status_code, error_context)
-            # A 402/429/401 is an API-key–level failure: the account is out of
-            # balance, rate-limited, or its key is rejected.  The same key can
-            # back more than one pool entry (e.g. an explicit pool entry plus a
-            # ``model_config`` entry auto-seeded from ``model.api_key`` — both
-            # carry the identical ``runtime_api_key``).  Marking only the first
-            # match leaves the sibling entries OK, so ``_select_unlocked()``
-            # keeps handing back the same depleted key and rotation never
-            # converges — the caller ``continue``s forever until the client
-            # disconnects (a ~2.5min hang with no error surfaced to the user).
-            # Mark every entry sharing the failed key so the pool can reach the
-            # "no available entries" state and let the error propagate.
-            failed_runtime_key = getattr(entry, "runtime_api_key", None)
-            if identity_supplied and failed_runtime_key:
-                siblings_marked = False
-                for sibling in self._entries:
-                    if sibling.id == entry.id:
-                        continue
-                    if sibling.runtime_api_key == failed_runtime_key:
-                        self._mark_exhausted(
-                            sibling, status_code, error_context, persist=False
-                        )
-                        siblings_marked = True
-                if siblings_marked:
-                    self._persist()
             # Re-read the updated entry to log the correct terminal state.
             updated_entry = next(
                 (e for e in self._entries if e.id == entry.id), entry,
@@ -1968,11 +1774,9 @@ class CredentialPool:
             return self._try_refresh_current_unlocked()
 
     def try_refresh_matching(
-        self,
-        api_key_hint: Optional[str] = None,
-        credential_id: Optional[str] = None,
+        self, api_key_hint: Optional[str] = None
     ) -> Optional[PooledCredential]:
-        """Force-refresh the entry that supplied the failed request.
+        """Force-refresh the entry that supplied ``api_key_hint``.
 
         Direct provider integrations may reload the pool after a request has
         already failed, so they cannot rely on ``current_id`` identifying the
@@ -1982,36 +1786,24 @@ class CredentialPool:
         """
         with self._lock:
             entry = None
-            if credential_id:
+            if api_key_hint:
                 entry = next(
                     (
                         candidate
                         for candidate in self._entries
-                        if candidate.id == credential_id
+                        if candidate.runtime_api_key == api_key_hint
                     ),
                     None,
                 )
-            if entry is None:
-                if api_key_hint:
-                    entry = next(
-                        (
-                            candidate
-                            for candidate in self._entries
-                            if candidate.runtime_api_key == api_key_hint
-                        ),
-                        None,
-                    )
-                else:
-                    entry = self._current_unlocked() or self._select_unlocked(
-                        refresh=False
-                    )
+            else:
+                entry = self.current() or self._select_unlocked(refresh=False)
             if entry is None:
                 return None
             self._current_id = entry.id
             return self._try_refresh_current_unlocked()
 
     def _try_refresh_current_unlocked(self) -> Optional[PooledCredential]:
-        entry = self._current_unlocked()
+        entry = self.current()
         if entry is None:
             return None
         refreshed = self._refresh_entry(entry, force=True)
@@ -2020,80 +1812,76 @@ class CredentialPool:
         return refreshed
 
     def reset_statuses(self) -> int:
-        with self._lock:
-            count = 0
-            new_entries = []
-            for entry in self._entries:
-                if entry.last_status or entry.last_status_at or entry.last_error_code:
-                    new_entries.append(
-                        replace(
-                            entry,
-                            last_status=None,
-                            last_status_at=None,
-                            last_error_code=None,
-                            last_error_reason=None,
-                            last_error_message=None,
-                            last_error_reset_at=None,
-                        )
+        count = 0
+        new_entries = []
+        for entry in self._entries:
+            if entry.last_status or entry.last_status_at or entry.last_error_code:
+                new_entries.append(
+                    replace(
+                        entry,
+                        last_status=None,
+                        last_status_at=None,
+                        last_error_code=None,
+                        last_error_reason=None,
+                        last_error_message=None,
+                        last_error_reset_at=None,
                     )
-                    count += 1
-                else:
-                    new_entries.append(entry)
-            if count:
-                self._entries = new_entries
-                self._persist()
-            return count
+                )
+                count += 1
+            else:
+                new_entries.append(entry)
+        if count:
+            self._entries = new_entries
+            self._persist()
+        return count
 
     def remove_index(self, index: int) -> Optional[PooledCredential]:
-        with self._lock:
-            if index < 1 or index > len(self._entries):
-                return None
-            removed = self._entries.pop(index - 1)
-            self._entries = [
-                replace(entry, priority=new_priority)
-                for new_priority, entry in enumerate(self._entries)
-            ]
-            write_credential_pool(
-                self.provider,
-                [entry.to_dict() for entry in self._entries],
-                removed_ids=[removed.id],
-            )
-            if self._current_id == removed.id:
-                self._current_id = None
-            return removed
+        if index < 1 or index > len(self._entries):
+            return None
+        removed = self._entries.pop(index - 1)
+        self._entries = [
+            replace(entry, priority=new_priority)
+            for new_priority, entry in enumerate(self._entries)
+        ]
+        write_credential_pool(
+            self.provider,
+            [entry.to_dict() for entry in self._entries],
+            removed_ids=[removed.id],
+        )
+        if self._current_id == removed.id:
+            self._current_id = None
+        return removed
 
     def resolve_target(self, target: Any) -> Tuple[Optional[int], Optional[PooledCredential], Optional[str]]:
         raw = str(target or "").strip()
         if not raw:
             return None, None, "No credential target provided."
 
-        with self._lock:
-            for idx, entry in enumerate(self._entries, start=1):
-                if entry.id == raw:
-                    return idx, entry, None
+        for idx, entry in enumerate(self._entries, start=1):
+            if entry.id == raw:
+                return idx, entry, None
 
-            label_matches = [
-                (idx, entry)
-                for idx, entry in enumerate(self._entries, start=1)
-                if entry.label.strip().lower() == raw.lower()
-            ]
-            if len(label_matches) == 1:
-                return label_matches[0][0], label_matches[0][1], None
-            if len(label_matches) > 1:
-                return None, None, f'Ambiguous credential label "{raw}". Use the numeric index or entry id instead.'
-            if raw.isdigit():
-                index = int(raw)
-                if 1 <= index <= len(self._entries):
-                    return index, self._entries[index - 1], None
-                return None, None, f"No credential #{index}."
-            return None, None, f'No credential matching "{raw}".'
+        label_matches = [
+            (idx, entry)
+            for idx, entry in enumerate(self._entries, start=1)
+            if entry.label.strip().lower() == raw.lower()
+        ]
+        if len(label_matches) == 1:
+            return label_matches[0][0], label_matches[0][1], None
+        if len(label_matches) > 1:
+            return None, None, f'Ambiguous credential label "{raw}". Use the numeric index or entry id instead.'
+        if raw.isdigit():
+            index = int(raw)
+            if 1 <= index <= len(self._entries):
+                return index, self._entries[index - 1], None
+            return None, None, f"No credential #{index}."
+        return None, None, f'No credential matching "{raw}".'
 
     def add_entry(self, entry: PooledCredential) -> PooledCredential:
-        with self._lock:
-            entry = replace(entry, priority=_next_priority(self._entries))
-            self._entries.append(entry)
-            self._persist()
-            return entry
+        entry = replace(entry, priority=_next_priority(self._entries))
+        self._entries.append(entry)
+        self._persist()
+        return entry
 
 
 def _upsert_entry(entries: List[PooledCredential], provider: str, source: str, payload: Dict[str, Any]) -> bool:
@@ -2513,10 +2301,9 @@ def _seed_from_env(provider: str, entries: List[PooledCredential]) -> Tuple[bool
     def _get_env_prefer_dotenv(key: str) -> str:
         env_file = load_env()
         raw = env_file.get(key, "").strip()
-        scoped_value = (_get_secret(key, "") or "").strip()
+        env_val = os.environ.get(key, "").strip()
         # If .env contains an unresolved op:// reference, prefer the
-        # already-resolved value supplied by the active secret scope (or by
-        # os.environ in legacy single-profile mode), set by
+        # already-resolved value from os.environ (set by
         # load_hermes_dotenv() -> apply_onepassword_secrets()).  The raw
         # "op://Vault/Item/field" string would otherwise win and every
         # provider auth attempt would receive a URL instead of a key.  This
@@ -2524,9 +2311,9 @@ def _seed_from_env(provider: str, entries: List[PooledCredential]) -> Tuple[bool
         # references straight into .env rather than the secrets.onepassword
         # config block.  For every non-op:// value the original
         # .env-takes-precedence behaviour is preserved unchanged.
-        if raw.startswith("op://") and scoped_value:
-            return scoped_value
-        return raw or scoped_value
+        if raw.startswith("op://") and env_val:
+            return env_val
+        return raw or _get_secret(key, "") or env_val
 
     # Honour user suppression — `hermes auth remove <provider> <N>` for an
     # env-seeded credential marks the env:<VAR> source as suppressed so it

agent/credential_sources.py

@@ -164,7 +164,7 @@ def _remove_env_source(provider: str, removed) -> RemovalResult:
         if env_path.exists():
             env_in_dotenv = any(
                 line.strip().startswith(f"{env_var}=")
-                for line in env_path.read_text(errors="replace", encoding="utf-8").splitlines()
+                for line in env_path.read_text(errors="replace").splitlines()
             )
     except OSError:
         pass

agent/credits_tracker.py

@@ -316,21 +316,12 @@ def evaluate_credits_notices(
             active.discard(CREDITS_USAGE_KEY)
         if target_band is not None:
             # Belt-and-suspenders: a producer could set subscription_limit_micros
-            # without subscription_limit_usd. Render "$?" rather than "$None".
+            # without subscription_limit_usd. Render "$? cap" rather than "$None cap".
             _cap_usd = state.subscription_limit_usd or "?"
             _level = current_band[1]  # type: ignore[index]  (current_band set when target_band set)
-            # Report absolute dollars used, not a bare "N% used": the percentage is
-            # only meaningful against a Nous subscription cap (no cap → never fires),
-            # so dollars are clearer and don't imply a universal %. Used = cap −
-            # remaining (micros, money-safe), clamped to [0, cap]. Re-emits on band
-            # change (50 → 75 → 90), not every turn — a snapshot, not a live ticker.
-            _lim = state.subscription_limit_micros or 0
-            _used_micros = max(0, min(_lim, _lim - state.subscription_micros))
-            _used_usd = f"{_used_micros / 1_000_000:.2f}" if _lim else "?"
-            _glyph = "⚠" if _level == "warn" else "•"
             to_show.append(
                 AgentNotice(
-                    text=f"{_glyph} You've used ${_used_usd} of your ${_cap_usd} cap",
+                    text=f"{'⚠' if _level == 'warn' else '•'} Credits {target_band}% used · ${_cap_usd} cap",
                     level=_level,
                     kind=CREDITS_NOTICE_KIND,
                     key=CREDITS_USAGE_KEY,
@@ -364,7 +355,7 @@ def evaluate_credits_notices(
     if show_depleted and "credits.depleted" not in active:
         to_show.append(
             AgentNotice(
-                text="✕ Credit access paused · run /topup to top up",
+                text="✕ Credit access paused · run /credits to top up",
                 level="error",
                 kind=CREDITS_NOTICE_KIND,
                 key="credits.depleted",

agent/curator.py

@@ -422,9 +422,7 @@ CURATOR_REVIEW_PROMPT = (
     "INSTRUCTIONS AND EXPERIENTIAL KNOWLEDGE. A collection of hundreds of "
     "narrow skills where each one captures one session's specific bug is "
     "a FAILURE of the library — not a feature. An agent searching skills "
-    "matches on descriptions, not on exact names (note: long descriptions "
-    "are truncated to 57 chars in the system prompt skill index — keep the "
-    "trigger class in that window). One broad umbrella "
+    "matches on descriptions, not on exact names; one broad umbrella "
     "skill with labeled subsections beats five narrow siblings for "
     "discoverability, not the other way around.\n\n"
     "The right target shape is CLASS-LEVEL skills with rich SKILL.md "

agent/curator_backup.py

@@ -98,12 +98,7 @@ def _backup_cron_jobs_into(dest: Path) -> Dict[str, Any]:
         info["reason"] = "no cron/jobs.json present"
         return info
     try:
-        # utf-8-sig: same dialect as cron/jobs.load_jobs — a UTF-8 BOM left
-        # by Windows editors otherwise survives decoding as U+FEFF, breaks
-        # json.loads below, and misreports jobs_count as 0 with a spurious
-        # parse warning. The BOM-less text is also what gets written to the
-        # backup, so a later rollback restores a loadable file.
-        raw = src.read_text(encoding="utf-8-sig")
+        raw = src.read_text(encoding="utf-8")
     except OSError as e:
         logger.debug("Failed to read cron/jobs.json for backup: %s", e)
         info["reason"] = f"read error: {e}"

agent/delegation_context.py

@@ -1,85 +0,0 @@
-"""Context-local state for delegate_task child execution.
-
-The parent Hermes process may itself be a Kanban dispatcher worker with
-HERMES_KANBAN_* variables in process env. delegate_task children run inside the
-same Python process, but they are not dispatcher-owned Kanban workers. This
-module lets code paths that resolve tool schemas or spawn subprocesses fail
-closed for delegated children without mutating global os.environ for the parent.
-"""
-from __future__ import annotations
-
-from contextlib import contextmanager
-from contextvars import ContextVar
-from typing import Iterator, Mapping, MutableMapping
-
-_DELEGATED_CHILD_CONTEXT: ContextVar[bool] = ContextVar(
-    "hermes_delegated_child_context",
-    default=False,
-)
-
-DELEGATED_CHILD_ENV_MARKER = "HERMES_DELEGATED_CHILD_CONTEXT"
-
-KANBAN_ENV_KEYS: tuple[str, ...] = (
-    "HERMES_KANBAN_TASK",
-    "HERMES_KANBAN_RUN_ID",
-    "HERMES_KANBAN_WORKSPACE",
-    "HERMES_KANBAN_WORKSPACES_ROOT",
-    "HERMES_KANBAN_CLAIM_LOCK",
-    "HERMES_KANBAN_BOARD",
-    "HERMES_KANBAN_DB",
-)
-
-
-@contextmanager
-def delegated_child_context() -> Iterator[None]:
-    """Mark the current execution context as a delegate_task child."""
-    token = _DELEGATED_CHILD_CONTEXT.set(True)
-    try:
-        yield
-    finally:
-        _DELEGATED_CHILD_CONTEXT.reset(token)
-
-
-def is_delegated_child_context() -> bool:
-    """Return True while code is running for a delegate_task child."""
-    return bool(_DELEGATED_CHILD_CONTEXT.get())
-
-
-def is_delegated_child_process_context() -> bool:
-    """Return True in this process or a subprocess spawned by a child."""
-    import os
-
-    return bool(_DELEGATED_CHILD_CONTEXT.get()) or bool(
-        os.environ.get(DELEGATED_CHILD_ENV_MARKER)
-    )
-
-
-def scrub_kanban_env(env: Mapping[str, str] | MutableMapping[str, str]) -> dict[str, str]:
-    """Return *env* with dispatcher-only Kanban variables removed."""
-    cleaned = dict(env)
-    for key in KANBAN_ENV_KEYS:
-        cleaned.pop(key, None)
-    cleaned[DELEGATED_CHILD_ENV_MARKER] = "1"
-    return cleaned
-
-
-def delegated_child_subprocess_env(
-    env: Mapping[str, str] | MutableMapping[str, str] | None = None,
-) -> dict[str, str] | None:
-    """Return an env override only when delegated-child lineage must cross fork.
-
-    Most subprocess call sites historically used ``env=None`` to inherit the
-    process environment.  In a ``delegate_task`` child, inheriting as-is leaks
-    parent dispatcher ``HERMES_KANBAN_*`` vars while losing the ContextVar in
-    the new process.  This helper preserves normal ``env=None`` semantics for
-    non-delegated calls, and only materializes a scrubbed env when the lineage
-    marker must be propagated across a child-process boundary.
-    """
-    if not is_delegated_child_process_context():
-        return None if env is None else dict(env)
-
-    if env is None:
-        import os
-
-        env = os.environ
-    return scrub_kanban_env(env)

agent/display.py

@@ -645,52 +645,6 @@ def verb_drops_preview(tool_name: str) -> bool:
     return tool_name in _TOOL_VERBS_NO_PREVIEW
 
 
-def build_status_phrase(tool_name: str, args: dict | None, max_len: int = 49) -> str | None:
-    """Build a short present-tense status phrase for platform status surfaces.
-
-    Used by text-rendering "typing" indicators (Slack's
-    ``assistant.threads.setStatus`` line) to show what the agent is doing
-    right now: ``is running scripts/run_tests.sh…`` instead of a static
-    ``is thinking...``.  The phrase is phrased to follow the bot's display
-    name ("Hermes is running …"), so it starts lowercase with "is".
-
-    Pass ``args=None`` for a verb-only phrase (``is running…``) — used when
-    ``display.live_status`` is ``verb`` to keep argument previews out of
-    shared channels.
-
-    Returns None for the ``_thinking`` pseudo-tool and when friendly labels
-    are disabled (callers fall back to their static default).  ``max_len``
-    caps the total phrase length; Slack truncates its status line around 50
-    characters, so the default stays just under that.
-    """
-    if not tool_name or tool_name == "_thinking":
-        return None
-    if not _friendly_tool_labels:
-        return None
-
-    verb = _TOOL_VERBS.get(tool_name)
-    if verb:
-        head = f"is {verb[0].lower()}{verb[1:]}"
-    else:
-        # Custom / plugin / MCP tools: generic but still informative.
-        head = f"is using {tool_name}"
-
-    phrase = head
-    if args and verb and tool_name not in _TOOL_VERBS_NO_PREVIEW:
-        preview = build_tool_preview(tool_name, args, max_len=None)
-        if preview:
-            # Previews can contain newlines (terminal commands); keep the
-            # status to the first line.
-            preview = preview.splitlines()[0].strip()
-            phrase = f"{head}{tool_verb_connector(tool_name)}{preview}"
-
-    if len(phrase) > max_len - 1:
-        phrase = phrase[: max_len - 2].rstrip() + "…"
-    else:
-        phrase = phrase + "…"
-    return phrase
-
-
 def build_tool_label(tool_name: str, args: dict, max_len: int | None = None) -> str | None:
     """Build a human-phrased status label for a tool call.
 

agent/error_classifier.py

@@ -269,11 +269,6 @@ _CONTEXT_OVERFLOW_PATTERNS = [
     "context window",
     "prompt is too long",
     "prompt exceeds max length",
-    # NOTE: bare "max_tokens" is load-bearing — the output-cap-retry path keys
-    # off it (e.g. "max_tokens: 65536 > context_window: 200000 ..."). Do NOT
-    # remove it. Provider empty-response advisories also contain "very low
-    # max_tokens", but those are intercepted by _EMPTY_PROVIDER_RESPONSE_PATTERNS
-    # BEFORE this list is consulted, so they never mis-route into compression.
     "max_tokens",
     "maximum number of tokens",
     # vLLM / local inference server patterns
@@ -413,7 +408,6 @@ _CONTENT_POLICY_BLOCKED_PATTERNS = [
 _AUTH_PATTERNS = [
     "invalid api key",
     "invalid_api_key",
-    "gateway_auth_failed",
     "authentication",
     "unauthorized",
     "forbidden",
@@ -432,19 +426,6 @@ _THINKING_SIG_PATTERNS = [
 # the exception type is generic (e.g. RuntimeError from a local shim that
 # wraps a subprocess timeout).  Checked before the type-based transport
 # heuristics so custom-provider "timed out" errors don't fall through to
-# Provider empty-response advisories (OpenRouter / nano-gpt / similar).
-# Checked before context-overflow matching because the advisory text often
-# mentions "max_tokens" as a possible cause, which historically sat in
-# _CONTEXT_OVERFLOW_PATTERNS and sent healthy sessions into a compression
-# death spiral ending in "Cannot compress further".
-_EMPTY_PROVIDER_RESPONSE_PATTERNS = [
-    "returned an empty response",
-    "empty response despite retries",
-    "provider returned an empty response",
-    "model returning empty responses",
-    "empty response stream",
-]
-
 # the unknown bucket and get misreported as empty responses.
 _TIMEOUT_MESSAGE_PATTERNS = [
     "timed out",
@@ -794,14 +775,6 @@ def classify_api_error(
         if classified is not None:
             return classified
 
-    # Local MoA config drift is deterministic: a persisted session can retain
-    # a preset name that was later renamed/deleted. Retrying the same lookup
-    # cannot recover and makes a clear config error look like an API outage.
-    from agent.errors import MoAPresetNotFoundError
-
-    if isinstance(error, MoAPresetNotFoundError):
-        return _result(FailoverReason.model_not_found, retryable=False)
-
     # ── 3. Error code classification ────────────────────────────────
 
     if error_code:
@@ -1096,14 +1069,6 @@ def _classify_by_status(
         # remaining explicit context-overflow signal routes into the
         # compression-and-retry path (mirroring _classify_400) instead of
         # blind server_error retries that exhaust and drop the turn.
-        # Empty-response advisories that mention "max_tokens" must not enter
-        # that compression path.
-        if any(p in error_msg for p in _EMPTY_PROVIDER_RESPONSE_PATTERNS):
-            return result_fn(
-                FailoverReason.server_error,
-                retryable=True,
-                should_compress=False,
-            )
         if any(p in error_msg for p in _CONTEXT_OVERFLOW_PATTERNS):
             return result_fn(
                 FailoverReason.context_overflow,
@@ -1117,12 +1082,6 @@ def _classify_by_status(
         # Cloudflare/Tailscale hop relabeling the status). Route explicit
         # overflow bodies into compression; otherwise treat as transient
         # overload and retry.
-        if any(p in error_msg for p in _EMPTY_PROVIDER_RESPONSE_PATTERNS):
-            return result_fn(
-                FailoverReason.server_error,
-                retryable=True,
-                should_compress=False,
-            )
         if any(p in error_msg for p in _CONTEXT_OVERFLOW_PATTERNS):
             return result_fn(
                 FailoverReason.context_overflow,
@@ -1248,8 +1207,8 @@ def _classify_400(
     # returns:
     #   "Unsupported parameter: 'max_tokens' is not supported with this model.
     #    Use 'max_completion_tokens' instead."
-    # That string contains the literal substring "max_tokens", which historically
-    # sat in _CONTEXT_OVERFLOW_PATTERNS — so without this guard the 400 is
+    # That string contains the literal substring "max_tokens", which is one of
+    # the _CONTEXT_OVERFLOW_PATTERNS — so without this guard the 400 is
     # misclassified as context_overflow, routed into the compression loop,
     # re-sent with the same bad parameter, and ends in "Cannot compress
     # further".  These errors are deterministic (every retry gets the identical
@@ -1271,17 +1230,6 @@ def _classify_400(
             should_fallback=True,
         )
 
-    # Empty-provider-response advisories must not enter compression. They
-    # often mention "max_tokens" as a possible cause and used to match the
-    # bare overflow pattern, then thrash compress until "Cannot compress
-    # further" on an otherwise healthy session (custom endpoints / nano-gpt).
-    if any(p in error_msg for p in _EMPTY_PROVIDER_RESPONSE_PATTERNS):
-        return result_fn(
-            FailoverReason.server_error,
-            retryable=True,
-            should_compress=False,
-        )
-
     # Context overflow from 400
     if any(p in error_msg for p in _CONTEXT_OVERFLOW_PATTERNS):
         return result_fn(
@@ -1485,15 +1433,6 @@ def _classify_by_message(
             should_fallback=True,
         )
 
-    # Empty-provider-response advisories (often mention "max_tokens") must
-    # retry without compression — see the matching 400-path guard above.
-    if any(p in error_msg for p in _EMPTY_PROVIDER_RESPONSE_PATTERNS):
-        return result_fn(
-            FailoverReason.server_error,
-            retryable=True,
-            should_compress=False,
-        )
-
     # Context overflow patterns
     if any(p in error_msg for p in _CONTEXT_OVERFLOW_PATTERNS):
         return result_fn(

agent/errors.py

@@ -7,7 +7,3 @@ class EmptyStreamError(RuntimeError):
     """Raised when a provider closes a stream without yielding a response."""
 
     pass
-
-
-class MoAPresetNotFoundError(ValueError):
-    """Raised when a persisted MoA preset no longer exists in config."""

agent/file_safety.py

@@ -46,9 +46,6 @@ def build_write_denied_paths(home: str) -> set[str]:
             # Top-level Anthropic PKCE credential store remains sensitive even
             # when a profile is active; default/non-profile sessions still read it.
             str(hermes_root / ".anthropic_oauth.json"),
-            # Bitwarden Secrets Manager encrypted disk cache.
-            str(hermes_home / "cache" / "bws_cache.enc.json"),
-            str(hermes_root / "cache" / "bws_cache.enc.json"),
             os.path.join(home, ".netrc"),
             os.path.join(home, ".pgpass"),
             os.path.join(home, ".npmrc"),

agent/gemini_native_adapter.py

@@ -270,12 +270,8 @@ def _translate_tool_call_to_gemini(tool_call: Dict[str, Any]) -> Dict[str, Any]:
         }
     }
     thought_signature = _tool_call_extra_signature(tool_call)
-    # Fallback sentinel for cross-provider tool_calls (e.g. fallback from
-    # xAI/Anthropic to Gemini, where the original tool_call carries no
-    # Gemini thoughtSignature). Mirrors gemini_cloudcode_adapter.py:106.
-    # Without this, Gemini 3 thinking models reject replayed history with
-    # 400 INVALID_ARGUMENT on the missing thoughtSignature.
-    part["thoughtSignature"] = thought_signature or "skip_thought_signature_validator"
+    if thought_signature:
+        part["thoughtSignature"] = thought_signature
     return part
 
 

agent/i18n.py

@@ -25,14 +25,14 @@ Language resolution order:
     3. ``display.language`` from config.yaml
     4. ``"en"`` (baseline)
 
-Supported languages: en, zh, zh-hant, ja, de, es, fr, tr, uk, af, ko, it, ga,
-pt, ru, hu, ar.  Unknown values fall back to en.
+Supported languages: en, zh, ja, de, es, fr, tr, uk.  Unknown values fall back to en.
 """
 
 from __future__ import annotations
 
 import logging
 import os
+import sysconfig
 import threading
 from functools import lru_cache
 from pathlib import Path
@@ -42,7 +42,7 @@ logger = logging.getLogger(__name__)
 
 SUPPORTED_LANGUAGES: tuple[str, ...] = (
     "en", "zh", "zh-hant", "ja", "de", "es", "fr", "tr", "uk",
-    "af", "ko", "it", "ga", "pt", "ru", "hu", "ar",
+    "af", "ko", "it", "ga", "pt", "ru", "hu",
 )
 DEFAULT_LANGUAGE = "en"
 
@@ -79,9 +79,6 @@ _LANGUAGE_ALIASES: dict[str, str] = {
     "russian": "ru", "русский": "ru", "ru-ru": "ru",
     # Hungarian
     "hungarian": "hu", "magyar": "hu", "hu-hu": "hu",
-    # Arabic — bare "arabic"/endonym plus the common regional BCP-47 tags.
-    "arabic": "ar", "العربية": "ar",
-    "ar-sa": "ar", "ar-eg": "ar", "ar-ae": "ar", "ar-ma": "ar", "ar-dz": "ar",
 }
 
 _catalog_cache: dict[str, dict[str, str]] = {}
@@ -95,8 +92,12 @@ def _locales_dir() -> Path:
 
     1. ``HERMES_BUNDLED_LOCALES`` env var -- set by the Nix wrapper (or any
        sealed-packaging system) to point at the installed catalog directory.
-    2. ``<repo-root>/locales`` -- source checkouts and editable installs,
+    2. ``<repo-root>/locales`` -- source checkouts and ``pip install -e .``,
        where the working tree sits next to ``agent/``.
+    3. ``<sysconfig data|purelib|platlib>/locales`` -- pip wheel installs.
+       setuptools ``data-files`` extracts ``locales/*.yaml`` under the
+       interpreter's ``data`` scheme; the other schemes are checked as a
+       safety net for nonstandard layouts.
 
     Falling through to the source-style path (even when missing) keeps
     ``_load_catalog`` error messages informative -- it logs the path it
@@ -115,6 +116,25 @@ def _locales_dir() -> Path:
 
     # agent/i18n.py -> agent/ -> repo root (source checkout, editable install)
     source_dir = Path(__file__).resolve().parent.parent / "locales"
+    if source_dir.is_dir():
+        return source_dir
+
+    # pip wheel install: data-files lands under the interpreter data scheme.
+    # ``data`` (== sys.prefix in a venv) is where setuptools data-files extract
+    # and is checked first. ``purelib``/``platlib`` (site-packages) are a safety
+    # net for nonstandard layouts. NOTE: this does NOT cover ``pip install
+    # --user`` (user scheme, ~/.local/locales) or ``pip install --target`` --
+    # both are out of scope; see the plan header.
+    for scheme in ("data", "purelib", "platlib"):
+        raw = sysconfig.get_path(scheme)
+        if not raw:
+            continue
+        candidate = Path(raw) / "locales"
+        if candidate.is_dir():
+            return candidate
+
+    # Last resort: return the source-style path so _load_catalog's catalog-missing
+    # log (logger.debug "i18n catalog missing for %s at %s") stays informative.
     return source_dir
 
 

agent/image_routing.py

@@ -181,8 +181,6 @@ def _supports_vision_override(
     cfg: Optional[Dict[str, Any]],
     provider: str,
     model: str,
-    *,
-    requested_provider: str = "",
 ) -> Optional[bool]:
     """Resolve user-declared vision capability from config.yaml.
 
@@ -190,14 +188,9 @@ def _supports_vision_override(
       1. ``model.supports_vision`` (top-level shortcut for the active model)
       2. ``providers.<provider>.models.<model>.supports_vision``
          (named custom providers — ``provider`` may be the runtime-resolved
-         value ``"custom"``, the runtime's originally requested provider,
-         and/or the user-declared name under ``model.provider``; all are
-         tried. For ``custom:<name>`` syntax, the stripped ``<name>`` is also
-         tried as a provider key.)
-      2b. ``custom_providers`` (legacy list form) ``.models.<model>``
-
-    Under (2) and (2b), the per-model capability key may be written as
-    either ``supports_vision`` or the shorter ``vision`` alias; both work.
+         value ``"custom"`` and/or the user-declared name under
+         ``model.provider``; both are tried. For ``custom:<name>`` syntax,
+         the stripped ``<name>`` is also tried as a provider key.)
 
     Returns None when no override is set, so the caller falls through to
     models.dev. Returns False explicitly only when the user wrote a
@@ -217,30 +210,23 @@ def _supports_vision_override(
     # get rewritten to provider="custom" at runtime
     # (hermes_cli/runtime_provider.py:_resolve_named_custom_runtime), so the
     # config still holds the user-declared name under model.provider. Try
-    # both as candidate provider keys. Either identity may use the
-    # "custom:<name>" form while providers: is keyed by bare <name>.
+    # both as candidate provider keys, plus the stripped suffix from
+    # "custom:<name>" (where <name> is the key under providers:).
     config_provider = str(model_cfg.get("provider") or "").strip()
-    provider_candidates: List[str] = []
-    for candidate in (requested_provider, provider, config_provider):
-        if not candidate:
-            continue
-        provider_candidates.append(candidate)
-        if candidate.startswith("custom:"):
-            stripped_candidate = candidate[len("custom:"):]
-            if stripped_candidate:
-                provider_candidates.append(stripped_candidate)
+    # Extract the stripped name from "custom:<name>" if present
+    stripped_suffix = ""
+    if config_provider.startswith("custom:"):
+        stripped_suffix = config_provider[len("custom:"):]
     providers_raw = cfg.get("providers")
     providers_cfg: Dict[str, Any] = providers_raw if isinstance(providers_raw, dict) else {}
-    for p in dict.fromkeys(provider_candidates):
+    for p in dict.fromkeys(filter(None, (provider, config_provider, stripped_suffix))):
         entry_raw = providers_cfg.get(p)
         entry: Dict[str, Any] = entry_raw if isinstance(entry_raw, dict) else {}
         models_raw = entry.get("models")
         models_cfg: Dict[str, Any] = models_raw if isinstance(models_raw, dict) else {}
         per_model_raw = models_cfg.get(model)
         per_model: Dict[str, Any] = per_model_raw if isinstance(per_model_raw, dict) else {}
-        coerced = _coerce_capability_bool(
-            per_model.get("supports_vision", per_model.get("vision"))
-        )
+        coerced = _coerce_capability_bool(per_model.get("supports_vision"))
         if coerced is not None:
             return coerced
 
@@ -249,26 +235,28 @@ def _supports_vision_override(
     # may appear as the raw name or "custom:<name>" at runtime).
     custom_providers = cfg.get("custom_providers")
     if isinstance(custom_providers, list):
-        # Candidate priority matters when the CLI-selected provider differs
-        # from model.provider. Walk identities first, then config entries, so
-        # list order cannot let the persisted default shadow the live route.
-        for candidate in dict.fromkeys(provider_candidates):
-            candidate_name = candidate.strip().lower()
-            for entry_raw in custom_providers:
-                if not isinstance(entry_raw, dict):
-                    continue
-                entry_name = str(entry_raw.get("name") or "").strip().lower()
-                if entry_name != candidate_name:
-                    continue
-                models_raw = entry_raw.get("models")
-                models_cfg = models_raw if isinstance(models_raw, dict) else {}
-                per_model_raw = models_cfg.get(model)
-                per_model = per_model_raw if isinstance(per_model_raw, dict) else {}
-                coerced = _coerce_capability_bool(
-                    per_model.get("supports_vision", per_model.get("vision"))
-                )
-                if coerced is not None:
-                    return coerced
+        # Build candidate names: the provider value and the config provider
+        # value, both raw and with "custom:" prefix stripped/added.
+        candidate_names: set = set()
+        for p in filter(None, (provider, config_provider)):
+            candidate_names.add(p)
+            if p.startswith("custom:"):
+                candidate_names.add(p[len("custom:"):])
+            else:
+                candidate_names.add(f"custom:{p}")
+        for entry_raw in custom_providers:
+            if not isinstance(entry_raw, dict):
+                continue
+            entry_name = str(entry_raw.get("name") or "").strip()
+            if entry_name not in candidate_names:
+                continue
+            models_raw = entry_raw.get("models")
+            models_cfg = models_raw if isinstance(models_raw, dict) else {}
+            per_model_raw = models_cfg.get(model)
+            per_model = per_model_raw if isinstance(per_model_raw, dict) else {}
+            coerced = _coerce_capability_bool(per_model.get("supports_vision"))
+            if coerced is not None:
+                return coerced
 
     return None
 
@@ -388,8 +376,6 @@ def _lookup_supports_vision(
     provider: str,
     model: str,
     cfg: Optional[Dict[str, Any]] = None,
-    *,
-    requested_provider: str = "",
 ) -> Optional[bool]:
     """Return True/False if we can resolve caps, None if unknown.
 
@@ -397,34 +383,7 @@ def _lookup_supports_vision(
     (so custom/local models declared as vision-capable don't fall through to
     text routing in ``auto`` mode), then falls back to models.dev.
     """
-    # Named custom providers are canonicalized to ``provider="custom"`` by
-    # runtime resolution.  The original CLI/config name is carried in the
-    # context-local main runtime so capability lookup can still select the
-    # exact custom_providers entry.  Require an exact provider+model match:
-    # background/auxiliary lookups must never borrow another turn's identity.
-    if not requested_provider:
-        try:
-            from agent.auxiliary_client import _runtime_main_value
-
-            runtime_provider = str(
-                _runtime_main_value("provider") or ""
-            ).strip().lower()
-            runtime_model = str(_runtime_main_value("model") or "").strip()
-            lookup_provider = str(provider or "").strip().lower()
-            lookup_model = str(model or "").strip()
-            if runtime_provider == lookup_provider and runtime_model == lookup_model:
-                requested_provider = str(
-                    _runtime_main_value("requested_provider") or ""
-                ).strip()
-        except Exception:
-            pass
-
-    override = _supports_vision_override(
-        cfg,
-        provider,
-        model,
-        requested_provider=requested_provider,
-    )
+    override = _supports_vision_override(cfg, provider, model)
     if override is not None:
         return override
     if not provider or not model:
@@ -462,8 +421,6 @@ def decide_image_input_mode(
     provider: str,
     model: str,
     cfg: Optional[Dict[str, Any]],
-    *,
-    requested_provider: str = "",
 ) -> str:
     """Return ``"native"`` or ``"text"`` for the given turn.
 
@@ -471,7 +428,6 @@ def decide_image_input_mode(
       provider: active inference provider ID (e.g. ``"anthropic"``, ``"openrouter"``).
       model:    active model slug as it would be sent to the provider.
       cfg:      loaded config.yaml dict, or None. When None, behaves as auto.
-      requested_provider: provider identity before runtime canonicalization.
     """
     mode_cfg = "auto"
     if isinstance(cfg, dict):
@@ -488,17 +444,7 @@ def decide_image_input_mode(
     # explicit auxiliary.vision config acts as a *fallback* for text-only
     # main models — it should not preempt native vision on a model that
     # can natively inspect the pixels (issue #29135).
-    if requested_provider:
-        supports = _lookup_supports_vision(
-            provider,
-            model,
-            cfg,
-            requested_provider=requested_provider,
-        )
-    else:
-        # Keep the long-standing three-argument call contract for callers and
-        # tests that replace the capability lookup hook.
-        supports = _lookup_supports_vision(provider, model, cfg)
+    supports = _lookup_supports_vision(provider, model, cfg)
     if supports is True:
         return "native"
     if _explicit_aux_vision_override(cfg):

agent/lsp/client.py

@@ -18,15 +18,9 @@ into it via :func:`agent.lsp.manager.LSPService.touch_file`.
 
 Implementation notes:
 
-- All per-document state lives in one :class:`_DocState` keyed by
-  absolute path.  Freshness is tracked with **document versions**,
-  not timestamps: every didChange bumps ``version``, and each stored
-  push/pull result is tagged with the version it describes.  A
-  result is fresh iff its tag >= the version being waited on, so a
-  didChange implicitly invalidates everything older — no clearing,
-  no clock comparisons, no race windows.  This is what prevents
-  "ghost diagnostics": a slow server's leftovers from the previous
-  edit can never masquerade as a verdict on the current content.
+- Push diagnostics are stored per-URI in :attr:`_push_diagnostics` from
+  ``textDocument/publishDiagnostics`` notifications.  Pull diagnostics
+  go in :attr:`_pull_diagnostics`.  The merged view dedupes by content.
 
 - Whole-document sync.  Even when the server advertises incremental
   sync, we send a single ``contentChanges`` entry replacing the
@@ -51,13 +45,10 @@ import asyncio
 import logging
 import os
 import sys
-from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any, Awaitable, Callable, Dict, List, Optional, Set
 from urllib.parse import quote, unquote
 
-from hermes_cli._subprocess_compat import windows_hide_flags
-
 from agent.lsp.protocol import (
     ERROR_CONTENT_MODIFIED,
     ERROR_METHOD_NOT_FOUND,
@@ -133,40 +124,6 @@ def _end_position(text: str) -> Dict[str, int]:
     return {"line": last_line, "character": last_col}
 
 
-@dataclass
-class _DocState:
-    """Everything the client tracks for one open document.
-
-    ``version`` is the LSP document version we last sent (didOpen=0,
-    each didChange +1).  It doubles as the freshness token: stored
-    push/pull results are tagged with the version they describe
-    (``push_version`` / ``pull_version``), and a result is *fresh*
-    iff its tag has caught up to ``version``.  Bumping the version on
-    didChange therefore invalidates all older results implicitly —
-    no store-clearing, no timestamps.
-
-    ``push_version``/``pull_version`` start at -1 = "no data yet".
-    Servers that echo a document version in publishDiagnostics get
-    exact tagging; those that don't are credited with the current
-    version at receipt time (a push observed after we sent the
-    change describes the changed content or newer).
-    """
-
-    version: int = 0
-    text: str = ""
-    push: List[Dict[str, Any]] = field(default_factory=list)
-    pull: List[Dict[str, Any]] = field(default_factory=list)
-    push_version: int = -1
-    pull_version: int = -1
-    seed_seen: bool = False
-
-    def fresh_push(self, version: Optional[int] = None) -> bool:
-        return self.push_version >= (self.version if version is None else version)
-
-    def fresh_pull(self, version: Optional[int] = None) -> bool:
-        return self.pull_version >= (self.version if version is None else version)
-
-
 class LSPClient:
     """Async LSP client tied to one server process and one workspace root.
 
@@ -229,10 +186,18 @@ class LSPClient:
             # is silently dropped by default.
         }
 
-        # Per-document state (version, text, diagnostic stores, and
-        # their freshness tags), keyed by absolute file path (NOT URI).
-        # See _DocState for the version-based freshness model.
-        self._docs: Dict[str, _DocState] = {}
+        # Tracked file state — required for didChange version bumps.
+        self._files: Dict[str, Dict[str, Any]] = {}
+        # Diagnostic stores, keyed by file path (NOT URI).
+        self._push_diagnostics: Dict[str, List[Dict[str, Any]]] = {}
+        self._pull_diagnostics: Dict[str, List[Dict[str, Any]]] = {}
+        # Per-path "last published" time so wait-for-fresh logic works.
+        self._published: Dict[str, float] = {}
+        # Per-path version of the latest push (matches our didChange
+        # version when the server respects it).
+        self._published_version: Dict[str, int] = {}
+        # First-push seen flag, for typescript-style seed-on-first-push.
+        self._first_push_seen: Set[str] = set()
         # Capability registrations — only diagnostic ones are tracked.
         self._diagnostic_registrations: Dict[str, Dict[str, Any]] = {}
 
@@ -296,12 +261,6 @@ class LSPClient:
         cmd = self._command
         if sys.platform == "win32":
             cmd = self._win_wrap_cmd(cmd)
-        # Suppress the cmd.exe console window that would otherwise flash
-        # every time we launch a ``.cmd``-wrapped language server
-        # (e.g. pyright-langserver.CMD) from a console-less host such as
-        # a VS Code/Zed extension running the ACP adapter.
-        # windows_hide_flags() is CREATE_NO_WINDOW on Windows, 0 on POSIX.
-        creationflags = windows_hide_flags()
 
         try:
             # start_new_session=True detaches the LSP server into its own
@@ -320,7 +279,6 @@ class LSPClient:
                 env=env,
                 cwd=self._cwd,
                 start_new_session=True,
-                creationflags=creationflags,
             )
         except FileNotFoundError as e:
             raise LSPProtocolError(
@@ -689,25 +647,25 @@ class LSPClient:
         if not isinstance(diagnostics, list):
             diagnostics = []
         version = params.get("version")
+        loop_time = asyncio.get_event_loop().time()
 
-        doc = self._docs.setdefault(path, _DocState(version=-1))
-        if self._seed_first_push and not doc.seed_seen:
-            # First push: seed the store WITHOUT a freshness tag.  It
-            # arrives before the user-triggered didChange could've
-            # produced fresh diagnostics, so it must never satisfy a
-            # waiter — it's baseline data only.
-            doc.seed_seen = True
-            doc.push = diagnostics
+        if self._seed_first_push and path not in self._first_push_seen:
+            # First push: seed without firing the event so a waiter
+            # doesn't resolve on the very first push (which arrives
+            # before the user-triggered didChange could've produced
+            # fresh diagnostics).
+            self._first_push_seen.add(path)
+            self._push_diagnostics[path] = diagnostics
+            self._published[path] = loop_time
+            if isinstance(version, int):
+                self._published_version[path] = version
             return
 
-        doc.seed_seen = True
-        doc.push = diagnostics
-        # Tag with the echoed document version when the server provides
-        # one; otherwise credit the current version — a push observed
-        # after we sent the change describes the changed content (or
-        # newer).  Note doc.version is -1 for never-opened paths
-        # (e.g. relatedDocuments spillover), keeping them unfresh.
-        doc.push_version = version if isinstance(version, int) else doc.version
+        self._push_diagnostics[path] = diagnostics
+        self._published[path] = loop_time
+        if isinstance(version, int):
+            self._published_version[path] = version
+        self._first_push_seen.add(path)
         # Bump the monotonic push counter and wake every waiter.  We
         # keep the Event sticky-set so any wait already in progress
         # resolves; waiters re-check their predicate after waking and
@@ -736,16 +694,16 @@ class LSPClient:
             raise LSPProtocolError(f"cannot read {abs_path}: {e}") from e
 
         uri = file_uri(abs_path)
-        doc = self._docs.get(abs_path)
+        existing = self._files.get(abs_path)
 
-        if doc is not None and doc.version >= 0:
+        if existing is not None:
             # Re-open: bump version, fire didChangeWatchedFiles + didChange.
             await self._send_notification(
                 "workspace/didChangeWatchedFiles",
                 {"changes": [{"uri": uri, "type": 2}]},  # 2 = CHANGED
             )
-            new_version = doc.version + 1
-            old_text = doc.text
+            new_version = existing["version"] + 1
+            old_text = existing["text"]
             content_changes: List[Dict[str, Any]]
             if self._sync_kind == 2:
                 content_changes = [
@@ -766,11 +724,7 @@ class LSPClient:
                     "contentChanges": content_changes,
                 },
             )
-            # Bumping the version is the whole invalidation story:
-            # every stored result tagged with an older version is now
-            # stale by definition (see _DocState).
-            doc.version = new_version
-            doc.text = text
+            self._files[abs_path] = {"version": new_version, "text": text}
             return new_version
 
         # First open: didChangeWatchedFiles CREATED + didOpen.
@@ -778,9 +732,12 @@ class LSPClient:
             "workspace/didChangeWatchedFiles",
             {"changes": [{"uri": uri, "type": 1}]},  # 1 = CREATED
         )
-        # Fresh doc state — anything stashed under this path by a
-        # pre-open push (relatedDocuments spillover etc.) is discarded.
-        self._docs[abs_path] = _DocState(version=0, text=text)
+        # Clear any stale push/pull entries — fresh open should start
+        # from scratch.
+        self._push_diagnostics.pop(abs_path, None)
+        self._pull_diagnostics.pop(abs_path, None)
+        self._published.pop(abs_path, None)
+        self._published_version.pop(abs_path, None)
         await self._send_notification(
             "textDocument/didOpen",
             {
@@ -792,6 +749,7 @@ class LSPClient:
                 }
             },
         )
+        self._files[abs_path] = {"version": 0, "text": text}
         return 0
 
     async def save_file(self, path: str) -> None:
@@ -811,19 +769,12 @@ class LSPClient:
     async def _pull_document_diagnostics(self, path: str) -> None:
         """Send ``textDocument/diagnostic`` for one file.
 
-        Stores results into the doc's pull store, tagged with the
-        document version captured at request send time.  If a didChange
-        races past the in-flight request, the version bump makes the
-        stored result stale automatically — no explicit invalidation.
-        Silently no-ops on errors (server may not support the pull
-        endpoint).
+        Stores results into :attr:`_pull_diagnostics`.  Silently
+        no-ops on errors (server may not support the pull endpoint).
         """
-        abs_path = os.path.abspath(path)
-        doc = self._docs.get(abs_path)
-        sent_version = doc.version if doc else -1
         try:
             params: Dict[str, Any] = {
-                "textDocument": {"uri": file_uri(abs_path)}
+                "textDocument": {"uri": file_uri(os.path.abspath(path))}
             }
             result = await self._send_request_with_retry(
                 "textDocument/diagnostic",
@@ -837,9 +788,7 @@ class LSPClient:
             return
         items = result.get("items")
         if isinstance(items, list):
-            doc = self._docs.setdefault(abs_path, _DocState(version=-1))
-            doc.pull = items
-            doc.pull_version = sent_version
+            self._pull_diagnostics[os.path.abspath(path)] = items
         related = result.get("relatedDocuments")
         if isinstance(related, dict):
             for uri, sub in related.items():
@@ -847,11 +796,7 @@ class LSPClient:
                     continue
                 sub_items = sub.get("items")
                 if isinstance(sub_items, list):
-                    rel = self._docs.setdefault(uri_to_path(uri), _DocState(version=-1))
-                    rel.pull = sub_items
-                    # Same send-anchored tagging: fresh only if that
-                    # doc hasn't changed since the request went out.
-                    rel.pull_version = rel.version
+                    self._pull_diagnostics[uri_to_path(uri)] = sub_items
 
     async def wait_for_diagnostics(
         self,
@@ -859,36 +804,22 @@ class LSPClient:
         version: int,
         *,
         mode: str = "document",
-        timeout: Optional[float] = None,
-    ) -> bool:
+    ) -> None:
         """Wait for the server to publish diagnostics for ``path`` at ``version``.
 
         ``mode`` is ``"document"`` (5s budget, document pulls) or
-        ``"full"`` (10s budget, also workspace pulls).  ``timeout``
-        overrides the mode's default budget when provided — this is
-        how the user's ``lsp.wait_timeout`` config reaches the wait
-        loop (slow servers like tsserver on big projects need more
-        than the 5s default).
-
-        Returns ``True`` when *fresh* diagnostics arrived (a push at
-        or after our didChange, or a pull answered after it) and
-        ``False`` on timeout.  Callers must treat ``False`` as "no
-        data", NOT as "no errors" — the diagnostic stores may still
-        hold stale entries from the previous edit at that point.
-        Best-effort — never throws if the server doesn't support pull
-        diagnostics; we still get the push side.
+        ``"full"`` (10s budget, also workspace pulls).  Best-effort —
+        returns silently on timeout.  Does NOT throw if the server
+        doesn't support pull diagnostics; we still get the push side.
         """
-        if timeout is not None and timeout > 0:
-            budget = timeout
-        else:
-            budget = DIAGNOSTICS_FULL_WAIT if mode == "full" else DIAGNOSTICS_DOCUMENT_WAIT
+        budget = DIAGNOSTICS_FULL_WAIT if mode == "full" else DIAGNOSTICS_DOCUMENT_WAIT
         deadline = asyncio.get_event_loop().time() + budget
         abs_path = os.path.abspath(path)
 
         while True:
             remaining = deadline - asyncio.get_event_loop().time()
             if remaining <= 0:
-                return False
+                return
 
             # Concurrent: document pull + push wait.
             pull_task = asyncio.create_task(self._pull_document_diagnostics(abs_path))
@@ -907,24 +838,26 @@ class LSPClient:
                     pass
 
             # If we got a fresh push for our version, we're done.
-            doc = self._docs.get(abs_path)
-            if doc and doc.fresh_push(version):
-                return True
+            current_v = self._published_version.get(abs_path)
+            if abs_path in self._published and (
+                current_v is None or current_v >= version
+            ):
+                return
 
-            # Pull may have answered for the current version — that's
-            # also success.
-            if doc and doc.fresh_pull(version):
-                return True
+            # Pull may have populated _pull_diagnostics — that's also
+            # success.
+            if abs_path in self._pull_diagnostics:
+                return
 
             # Loop until budget runs out.
 
     async def _wait_for_fresh_push(self, path: str, version: int, timeout: float) -> None:
-        """Wait until a fresh publishDiagnostics arrives for ``path`` at ``version``+."""
+        """Wait until a publishDiagnostics arrives for ``path`` at ``version``+."""
         deadline = asyncio.get_event_loop().time() + timeout
         baseline = self._push_counter
         while True:
-            doc = self._docs.get(path)
-            if doc and doc.fresh_push(version):
+            current_v = self._published_version.get(path)
+            if path in self._published and (current_v is None or current_v >= version):
                 # Debounce — wait a tick in case more diagnostics arrive
                 # immediately after.  TS often emits in pairs.  We
                 # snapshot the counter so we wake on a *new* push, not
@@ -955,28 +888,17 @@ class LSPClient:
             except asyncio.TimeoutError:
                 continue
 
-    def diagnostics_for(self, path: str, *, fresh_only: bool = False) -> List[Dict[str, Any]]:
+    def diagnostics_for(self, path: str) -> List[Dict[str, Any]]:
         """Return current merged + deduped diagnostics for one file.
 
         Diagnostics from push and pull stores are concatenated and
         deduplicated by ``(severity, code, message, range)`` content
         key.  Empty list if the server hasn't published anything.
-
-        With ``fresh_only=True``, a store only contributes when its
-        version tag has caught up to the document's current version —
-        stale leftovers from the previous edit cycle are excluded.
-        This is what report paths should use: after an edit, "stale
-        errors" and "no errors" must not be conflated.
         """
-        doc = self._docs.get(os.path.abspath(path))
-        if doc is None:
-            return []
-        if fresh_only:
-            return _dedupe(
-                doc.push if doc.fresh_push() else [],
-                doc.pull if doc.fresh_pull() else [],
-            )
-        return _dedupe(doc.push, doc.pull)
+        abs_path = os.path.abspath(path)
+        push = self._push_diagnostics.get(abs_path) or []
+        pull = self._pull_diagnostics.get(abs_path) or []
+        return _dedupe(push, pull)
 
 
 def _dedupe(*lists: List[Dict[str, Any]]) -> List[Dict[str, Any]]:

agent/lsp/install.py

@@ -35,8 +35,6 @@ import threading
 from pathlib import Path
 from typing import Any, Dict, Optional
 
-from hermes_cli._subprocess_compat import windows_hide_flags
-
 logger = logging.getLogger("agent.lsp.install")
 
 # Package-name → install-strategy hint registry.  Each entry is a
@@ -267,10 +265,9 @@ def _install_npm(
             [npm, "install", "--prefix", str(staging), "--silent", "--no-fund", "--no-audit", *install_targets],
             check=False,
             capture_output=True,
-            text=True, encoding="utf-8", errors="replace",
+            text=True,
             timeout=300,
             stdin=subprocess.DEVNULL,
-            creationflags=windows_hide_flags(),
         )
         if proc.returncode != 0:
             logger.warning(
@@ -316,11 +313,10 @@ def _install_go(pkg: str, bin_name: str) -> Optional[str]:
             [go, "install", pkg],
             check=False,
             capture_output=True,
-            text=True, encoding="utf-8", errors="replace",
+            text=True,
             timeout=600,
             env=env,
             stdin=subprocess.DEVNULL,
-            creationflags=windows_hide_flags(),
         )
         if proc.returncode != 0:
             logger.warning(

agent/lsp/manager.py

@@ -292,10 +292,7 @@ class LSPService:
         if not self.enabled_for(file_path):
             return
         try:
-            # Outer join budget must exceed the inner wait budget or a
-            # slow-but-alive server gets falsely marked broken.
-            t = max(8.0, self._wait_timeout + 3.0)
-            diags = self._loop.run(self._snapshot_async(file_path), timeout=t)
+            diags = self._loop.run(self._snapshot_async(file_path), timeout=8.0)
             self._delta_baseline[os.path.abspath(file_path)] = diags or []
         except Exception as e:  # noqa: BLE001
             logger.debug("baseline snapshot failed for %s: %s", file_path, e)
@@ -344,7 +341,7 @@ class LSPService:
 
         try:
             t = timeout if timeout is not None else self._wait_timeout + 2.0
-            diags = self._loop.run(self._open_and_wait_async(file_path), timeout=t)
+            diags = self._loop.run(self._open_and_wait_async(file_path), timeout=t) or []
         except asyncio.TimeoutError as e:
             eventlog.log_timeout(server_id, file_path)
             logger.debug("LSP diagnostics timeout for %s: %s", file_path, e)
@@ -356,17 +353,6 @@ class LSPService:
             self._mark_broken_for_file(file_path, e)
             return []
 
-        if diags is None:
-            # The server is alive but never produced diagnostics for the
-            # post-edit content within the wait budget (common for
-            # tsserver on large projects).  Report "no data" rather than
-            # whatever stale state is in the stores — surfacing the
-            # previous edit's errors as if they were current is the
-            # ghost-diagnostics bug.  The server is NOT marked broken:
-            # slow is not dead, and the next edit may well succeed.
-            eventlog.log_timeout(server_id, file_path, kind="fresh diagnostics")
-            return []
-
         abs_path = os.path.abspath(file_path)
         if delta:
             baseline = self._delta_baseline.get(abs_path) or []
@@ -466,43 +452,26 @@ class LSPService:
             return []
         try:
             version = await client.open_file(file_path, language_id=language_id_for(file_path))
-            fresh = await client.wait_for_diagnostics(file_path, version, mode=self._wait_mode)
+            await client.wait_for_diagnostics(file_path, version, mode=self._wait_mode)
         except Exception as e:  # noqa: BLE001
             logger.debug("snapshot open/wait failed: %s", e)
             return []
         self._last_used[(client.server_id, client.workspace_root)] = time.time()
-        if not fresh:
-            # No fresh data for the pre-edit content — an empty baseline
-            # is safe: worst case the delta filter removes less, never
-            # more.  Never seed the baseline from stale stores.
-            return []
-        return list(client.diagnostics_for(file_path, fresh_only=True))
+        return list(client.diagnostics_for(file_path))
 
-    async def _open_and_wait_async(self, file_path: str) -> Optional[List[Dict[str, Any]]]:
-        """Open + wait for FRESH diagnostics.
-
-        Returns the fresh diagnostic list, or ``None`` when the server
-        never produced post-change data within the wait budget.  The
-        distinction matters: ``[]`` means "server checked the new
-        content, it's clean", ``None`` means "no verdict" — the caller
-        must not substitute stale data for either.
-        """
+    async def _open_and_wait_async(self, file_path: str) -> List[Dict[str, Any]]:
         client = await self._get_or_spawn(file_path)
         if client is None:
-            return None
+            return []
         try:
             version = await client.open_file(file_path, language_id=language_id_for(file_path))
             await client.save_file(file_path)
-            fresh = await client.wait_for_diagnostics(
-                file_path, version, mode=self._wait_mode, timeout=self._wait_timeout
-            )
+            await client.wait_for_diagnostics(file_path, version, mode=self._wait_mode)
         except Exception as e:  # noqa: BLE001
             logger.debug("open/wait failed for %s: %s", file_path, e)
-            return None
+            return []
         self._last_used[(client.server_id, client.workspace_root)] = time.time()
-        if not fresh:
-            return None
-        return list(client.diagnostics_for(file_path, fresh_only=True))
+        return list(client.diagnostics_for(file_path))
 
     async def _current_diags_async(self, file_path: str) -> List[Dict[str, Any]]:
         ws, gated = resolve_workspace_for_file(file_path)
@@ -513,7 +482,7 @@ class LSPService:
             client = self._clients.get((srv.server_id, ws))
         if client is None:
             return []
-        return list(client.diagnostics_for(file_path, fresh_only=True))
+        return list(client.diagnostics_for(file_path))
 
     async def _get_or_spawn(self, file_path: str) -> Optional[LSPClient]:
         srv = find_server_for_file(file_path)

agent/manual_compression_feedback.py

@@ -7,36 +7,6 @@ from typing import Any, Sequence
 from agent.redact import redact_sensitive_text
 
 
-def describe_compression_lock_skip(lock_signal: Any) -> str:
-    """User-facing text for a manual /compress skipped by the compression lock.
-
-    ``lock_signal`` is ``agent._compression_skipped_due_to_lock`` (or the
-    ``holder`` carried by the TUI's ``CompressionLockHeld``): a descriptive
-    holder string when another compressor CONFIRMED holds the lock, or
-    ``True``/``None`` when acquisition failed without a confirmed holder
-    (``hermes_state.try_acquire_compression_lock`` catches ``sqlite3.Error``
-    internally and returns ``False``, so a failed acquire is NOT proof that
-    another compression is running). The two cases must be worded
-    differently: claiming "already in progress" on an unconfirmed failure
-    misdirects the user when the real problem is a broken lock subsystem.
-    """
-    holder = (
-        lock_signal
-        if isinstance(lock_signal, str) and lock_signal.strip()
-        else None
-    )
-    if holder:
-        return (
-            f"⏳ Compression already in progress for this session "
-            f"(holder: {holder}). Please wait for it to finish."
-        )
-    return (
-        "⏳ Compression skipped: could not acquire this session's "
-        "compression lock. Another compression may still be running, or "
-        "the lock check failed — try again shortly."
-    )
-
-
 def summarize_manual_compression(
     before_messages: Sequence[dict[str, Any]],
     after_messages: Sequence[dict[str, Any]],

agent/memory_manager.py

@@ -80,17 +80,8 @@ def normalize_tool_schema(schema: Any) -> Optional[Dict[str, Any]]:
     return schema
 
 
-def memory_provider_tools_enabled(
-    enabled_toolsets: Optional[List[str]],
-    disabled_toolsets: Optional[List[str]] = None,
-    *,
-    memory_tool_present: bool = False,
-) -> bool:
+def memory_provider_tools_enabled(enabled_toolsets: Optional[List[str]]) -> bool:
     """Return whether external memory-provider tools should be exposed."""
-    if disabled_toolsets and "memory" in disabled_toolsets:
-        return False
-    if memory_tool_present:
-        return True
     if enabled_toolsets is None:
         return True
     if not enabled_toolsets:
@@ -119,10 +110,9 @@ def inject_memory_provider_tools(agent: Any) -> int:
         for tool in tools
         if isinstance(tool, dict)
     }
-    if not memory_provider_tools_enabled(
-        getattr(agent, "enabled_toolsets", None),
-        getattr(agent, "disabled_toolsets", None),
-        memory_tool_present="memory" in existing_tool_names,
+    if (
+        "memory" not in existing_tool_names
+        and not memory_provider_tools_enabled(getattr(agent, "enabled_toolsets", None))
     ):
         return 0
 

agent/model_metadata.py

@@ -4,8 +4,6 @@ Pure utility functions with no AIAgent dependency. Used by ContextCompressor
 and run_agent.py for pre-flight context checks.
 """
 
-import base64
-import hashlib
 import ipaddress
 import json
 import logging
@@ -215,8 +213,6 @@ DEFAULT_CONTEXT_LENGTHS = {
     # OpenRouter-prefixed models resolve via OpenRouter live API or models.dev.
     "claude-fable-5": 1000000,
     "claude-fable": 1000000,
-    "claude-opus-5": 1000000,
-    "claude-sonnet-5": 1000000,
     "claude-opus-4-8": 1000000,
     "claude-opus-4.8": 1000000,
     "claude-opus-4-7": 1000000,
@@ -279,10 +275,8 @@ DEFAULT_CONTEXT_LENGTHS = {
     # Qwen — specific model families before the catch-all.
     # Official docs: https://help.aliyun.com/zh/model-studio/developer-reference/
     "qwen3.6-plus": 1048576,      # 1M context (DashScope/Alibaba & OpenRouter)
-    "qwen3.7-plus": 1048576,      # 1M context (DashScope/Alibaba)
     "qwen3-coder-plus": 1000000,  # 1M context
     "qwen3-coder": 262144,        # 256K context
-    "qwen3-max": 262144,          # 256K context (qwen3-max-2026-01-23 snapshot, Coding Plan)
     "qwen": 131072,
     # MiniMax — M3 is 1M context (max output 512K); M2.x series is 204,800.
     # Keys use substring matching (longest-first), so "minimax-m3" wins over
@@ -322,12 +316,7 @@ DEFAULT_CONTEXT_LENGTHS = {
     "grok-3": 131072,           # grok-3, grok-3-mini, grok-3-fast, grok-3-mini-fast
     "grok-2": 131072,           # grok-2, grok-2-1212, grok-2-latest
     "grok": 131072,             # catch-all (grok-beta, unknown grok-*)
-    # Kimi — K3 ships with a 1 Mi context window (1,048,576; verified against
-    # models.dev and OpenRouter live metadata, matching the endpoint-scoped
-    # override in _endpoint_scoped_context_length). Longest-key-first substring
-    # matching ensures "kimi-k3" resolves to 1M while older/unknown Kimi models
-    # still hit the generic 256K fallback.
-    "kimi-k3": 1_048_576,
+    # Kimi
     "kimi": 262144,
     # Upstage Solar — api.upstage.ai/v1/models does not return context_length,
     # so these fallbacks keep token budgeting / compression from probing down
@@ -551,13 +540,7 @@ def _is_known_provider_base_url(base_url: str) -> bool:
 
 
 def _endpoint_scoped_context_length(model: str, base_url: str) -> Optional[int]:
-    """Return metadata confirmed only for the Kimi Coding endpoint.
-
-    Kimi Coding serves K3 under the bare slug ``k3``, but users may also
-    configure or select the public-facing aliases ``kimi-k3`` and
-    ``kimi-k3-cot``. Only canonical ``https://api.kimi.com/coding`` endpoints
-    (legacy Moonshot keys do not serve K3) get the 1 Mi context window.
-    """
+    """Return metadata confirmed only for one provider endpoint."""
     normalized = _normalize_base_url(base_url)
     try:
         parsed = urlparse(normalized)
@@ -573,7 +556,7 @@ def _endpoint_scoped_context_length(model: str, base_url: str) -> Optional[int]:
         and parsed.path.rstrip("/") in {"/coding", "/coding/v1"}
         and not parsed.query
         and not parsed.fragment
-        and model.strip().lower() in {"k3", "kimi-k3", "kimi-k3-cot"}
+        and model.strip().lower() == "k3"
     ):
         return 1_048_576
     return None
@@ -584,13 +567,8 @@ def _skip_persistent_context_cache(base_url: str, provider: str) -> bool:
 
     LM Studio excludes caching because loaded context is transient — the user
     can reload the model with a different context_length at any time.
-
-    Codex OAuth excludes caching because its context window is account- and
-    entitlement-specific metadata supplied by the authenticated /models
-    endpoint. A fallback value written after a transient probe failure must
-    not prevent a later live probe from observing an updated allocation.
-    """
-    return (provider or "").strip().lower() in {"lmstudio", "openai-codex"}
+   """
+    return provider == "lmstudio"
 
 
 def _maybe_cache_local_context_length(
@@ -1926,72 +1904,32 @@ _CODEX_OAUTH_CONTEXT_FALLBACK: Dict[str, int] = {
 }
 
 
-_codex_oauth_context_cache: Dict[str, Tuple[Dict[str, int], float]] = {}
+_codex_oauth_context_cache: Dict[str, int] = {}
+_codex_oauth_context_cache_time: float = 0.0
 _CODEX_OAUTH_CONTEXT_CACHE_TTL = 3600  # 1 hour
 
 
-def _codex_oauth_token_fingerprint(access_token: str) -> str:
-    """Return a non-secret cache key for a Codex OAuth access token."""
-    return hashlib.sha256(access_token.encode("utf-8")).hexdigest()[:16]
+def _fetch_codex_oauth_context_lengths(access_token: str) -> Dict[str, int]:
+    """Probe the ChatGPT Codex /models endpoint for per-slug context windows.
 
+    Codex OAuth imposes its own context limits that differ from the direct
+    OpenAI API (e.g. gpt-5.5 is 1.05M on the API, 272K on Codex). The
+    `context_window` field in each model entry is the authoritative source.
 
-def _extract_chatgpt_account_id(access_token: str) -> Optional[str]:
-    """Extract ``chatgpt_account_id`` from the Codex OAuth JWT.
-
-    The Codex ``/backend-api/codex/models`` endpoint returns the per-account
-    catalog only when the ``ChatGPT-Account-Id`` header is present; without
-    it, the endpoint returns ``{"models":[]}`` (HTTP 200) and the context
-    probe falls back to the hardcoded defaults — which can be stale or
-    wrong for the active account's plan. Mirrors the same extraction done
-    in ``auxiliary_client.py`` for the request path.
-
-    Returns ``None`` on any parse error rather than raising, so a bad
-    token still surfaces as a normal probe failure instead of crashing
-    the metadata resolver.
+    Returns a ``{slug: context_window}`` dict. Empty on failure.
     """
-    try:
-        parts = access_token.split(".")
-        if len(parts) < 2:
-            return None
-        payload_b64 = parts[1] + "=" * (-len(parts[1]) % 4)
-        claims = json.loads(base64.urlsafe_b64decode(payload_b64))
-        if not isinstance(claims, dict):
-            return None
-        acct_id = claims.get("https://api.openai.com/auth", {}).get("chatgpt_account_id")
-        return acct_id if isinstance(acct_id, str) and acct_id else None
-    except Exception:
-        return None
-
-
-def _fetch_codex_oauth_context_lengths_with_source(
-    access_token: str,
-) -> Tuple[Dict[str, int], bool]:
-    """Fetch Codex catalogue data and report whether it came from HTTP.
-
-    The in-process cache is scoped by token fingerprint because Codex model
-    availability and context windows can vary by account entitlement. The raw
-    token is never retained in the cache key. The boolean is false for a
-    same-token in-process hit, which must not be treated as a fresh provider
-    confirmation when deciding whether to update persistent state.
-    """
-    global _codex_oauth_context_cache
+    global _codex_oauth_context_cache, _codex_oauth_context_cache_time
     now = time.time()
-    cache_key = _codex_oauth_token_fingerprint(access_token)
-    cached = _codex_oauth_context_cache.get(cache_key)
-    if cached is not None:
-        cached_models, cached_at = cached
-        if now - cached_at < _CODEX_OAUTH_CONTEXT_CACHE_TTL:
-            return cached_models, False
-
-    headers = {"Authorization": f"Bearer {access_token}"}
-    acct_id = _extract_chatgpt_account_id(access_token)
-    if acct_id:
-        headers["ChatGPT-Account-Id"] = acct_id
+    if (
+        _codex_oauth_context_cache
+        and now - _codex_oauth_context_cache_time < _CODEX_OAUTH_CONTEXT_CACHE_TTL
+    ):
+        return _codex_oauth_context_cache
 
     try:
         resp = requests.get(
             "https://chatgpt.com/backend-api/codex/models?client_version=1.0.0",
-            headers=headers,
+            headers={"Authorization": f"Bearer {access_token}"},
             timeout=(5, 10),
             verify=_resolve_requests_verify(),
         )
@@ -2000,11 +1938,11 @@ def _fetch_codex_oauth_context_lengths_with_source(
                 "Codex /models probe returned HTTP %s; falling back to hardcoded defaults",
                 resp.status_code,
             )
-            return {}, False
+            return {}
         data = resp.json()
     except Exception as exc:
         logger.debug("Codex /models probe failed: %s", exc)
-        return {}, False
+        return {}
 
     entries = data.get("models", []) if isinstance(data, dict) else []
     result: Dict[str, int] = {}
@@ -2017,50 +1955,32 @@ def _fetch_codex_oauth_context_lengths_with_source(
             result[slug.strip()] = ctx
 
     if result:
-        _codex_oauth_context_cache[cache_key] = (result, now)
-    return result, True
-
-
-def _fetch_codex_oauth_context_lengths(access_token: str) -> Dict[str, int]:
-    """Probe the ChatGPT Codex /models endpoint for per-slug context windows.
-
-    Codex OAuth imposes its own context limits that differ from the direct
-    OpenAI API (e.g. gpt-5.5 is 1.05M on the API, 272K on Codex). The
-    `context_window` field in each model entry is the authoritative source.
-
-    Returns a ``{slug: context_window}`` dict. Empty on failure.
-    """
-    result, _fresh = _fetch_codex_oauth_context_lengths_with_source(access_token)
+        _codex_oauth_context_cache = result
+        _codex_oauth_context_cache_time = now
     return result
 
 
-def _resolve_codex_oauth_context_length_with_source(
+def _resolve_codex_oauth_context_length(
     model: str, access_token: str = ""
-) -> Tuple[Optional[int], str]:
+) -> Optional[int]:
     """Resolve a Codex OAuth model's real context window.
 
     Prefers a live probe of chatgpt.com/backend-api/codex/models (when we
     have a bearer token), then falls back to ``_CODEX_OAUTH_CONTEXT_FALLBACK``.
-
-    Returns ``(context_length, source)`` where source is ``"live"`` for a
-    value returned by a fresh authenticated endpoint probe, ``"memory"`` for
-    a same-token in-process catalogue hit, or ``"fallback"`` for the static
-    conservative table. Only ``"live"`` is eligible for persistent writes.
     """
     model_bare = _strip_provider_prefix(model).strip()
     if not model_bare:
-        return None, ""
+        return None
 
     if access_token:
-        live, fresh_probe = _fetch_codex_oauth_context_lengths_with_source(access_token)
-        live_source = "live" if fresh_probe else "memory"
+        live = _fetch_codex_oauth_context_lengths(access_token)
         if model_bare in live:
-            return live[model_bare], live_source
+            return live[model_bare]
         # Case-insensitive match in case casing drifts
         model_lower = model_bare.lower()
         for slug, ctx in live.items():
             if slug.lower() == model_lower:
-                return ctx, live_source
+                return ctx
 
     # Fallback: longest-key-first substring match over hardcoded defaults.
     model_lower = model_bare.lower()
@@ -2068,19 +1988,9 @@ def _resolve_codex_oauth_context_length_with_source(
         _CODEX_OAUTH_CONTEXT_FALLBACK.items(), key=lambda x: len(x[0]), reverse=True
     ):
         if slug in model_lower:
-            return ctx, "fallback"
+            return ctx
 
-    return None, ""
-
-
-def _resolve_codex_oauth_context_length(
-    model: str, access_token: str = ""
-) -> Optional[int]:
-    """Resolve a Codex OAuth model's context length (compatibility wrapper)."""
-    context_length, _source = _resolve_codex_oauth_context_length_with_source(
-        model, access_token=access_token,
-    )
-    return context_length
+    return None
 
 
 def _resolve_nous_context_length(
@@ -2170,9 +2080,9 @@ def get_model_context_length(
     Resolution order:
     0. Explicit config override (model.context_length or custom_providers per-model)
     0c. Endpoint-scoped metadata for models validated on one multiplexed endpoint
-    1. Persistent cache (previously discovered via probing).  Nous URLs,
-       LM Studio, and Codex OAuth bypass the cache here so their provider
-       metadata can be reconciled against the authoritative live source.
+    1. Persistent cache (previously discovered via probing).  Nous URLs
+       bypass the cache here so step 5b can always reconcile against
+       the authoritative portal /v1/models response.
     1b. AWS Bedrock static table (must precede custom-endpoint probe)
     2. Active endpoint metadata (/models for explicit custom endpoints)
     3. Local server query (for local endpoints)
@@ -2202,18 +2112,11 @@ def get_model_context_length(
     # acting context, so they're ignored here.
     if (provider or "").strip().lower() == "moa":
         try:
-            from hermes_cli.config import (
-                get_compatible_custom_providers,
-                load_config,
-            )
+            from hermes_cli.config import load_config
             from hermes_cli.moa_config import resolve_moa_preset
             from hermes_cli.runtime_provider import resolve_runtime_provider
 
-            config = load_config()
-            effective_custom_providers = custom_providers
-            if effective_custom_providers is None:
-                effective_custom_providers = get_compatible_custom_providers(config)
-            preset = resolve_moa_preset(config.get("moa") or {}, model)
+            preset = resolve_moa_preset(load_config().get("moa") or {}, model)
             agg = preset.get("aggregator") or {}
             agg_provider = str(agg.get("provider") or "").strip()
             agg_model = str(agg.get("model") or "").strip()
@@ -2223,8 +2126,7 @@ def get_model_context_length(
                     agg_model,
                     base_url=rt.get("base_url", "") or "",
                     api_key=rt.get("api_key", "") or "",
-                    provider=rt.get("provider") or agg_provider,
-                    custom_providers=effective_custom_providers,
+                    provider=agg_provider,
                 )
         except Exception:
             logger.debug("MoA aggregator context-length resolution failed", exc_info=True)
@@ -2270,23 +2172,28 @@ def get_model_context_length(
     if endpoint_context is not None:
         return endpoint_context
 
-    is_bedrock_context = provider == "bedrock" or (
-        base_url
-        and base_url_hostname(base_url).startswith("bedrock-runtime.")
-        and base_url_host_matches(base_url, "amazonaws.com")
-    )
-
     # 1. Check persistent cache (model+provider)
     # LM Studio is excluded — its loaded context length is transient (the
     # user can reload the model with a different context_length at any time
     # via /api/v1/models/load), so a stale cached value would mask reloads.
-    # Codex OAuth is excluded because the authenticated /models catalogue is
-    # account-specific and a fallback must never suppress later revalidation.
     if base_url and not _skip_persistent_context_cache(base_url, provider):
         cached = get_cached_context_length(model, base_url)
         if cached is not None:
+            # Invalidate stale Codex OAuth cache entries: pre-PR #14935 builds
+            # resolved gpt-5.x to the direct-API value (e.g. 1.05M) via
+            # models.dev and persisted it. Codex OAuth caps at 272K for every
+            # slug, so any cached Codex entry at or above 400K is a leftover
+            # from the old resolution path. Drop it and fall through to the
+            # live /models probe in step 5 below.
+            if provider == "openai-codex" and cached >= 400_000:
+                logger.info(
+                    "Dropping stale Codex cache entry %s@%s -> %s (pre-fix value); "
+                    "re-resolving via live /models probe",
+                    model, base_url, f"{cached:,}",
+                )
+                _invalidate_cached_context_length(model, base_url)
             # Invalidate stale 32k cache entries for Kimi-family models.
-            if cached <= 32768 and _model_name_suggests_kimi(model):
+            elif cached <= 32768 and _model_name_suggests_kimi(model):
                 logger.info(
                     "Dropping stale Kimi cache entry %s@%s -> %s (OpenRouter underreport); "
                     "re-resolving via hardcoded defaults",
@@ -2333,30 +2240,6 @@ def get_model_context_length(
                     model, base_url,
                 )
                 # Fall through; step 5b reconciles and overwrites if portal responds.
-            # Invalidate stale Bedrock entries seeded before the Claude 4.6+
-            # long-context table was corrected to 1M. The static table is a
-            # FLOOR, not an override: probe-derived cache entries (step 1b)
-            # may legitimately exceed the table (real window read from
-            # Bedrock's length-validation error), so only under-reporting
-            # entries are dropped — never a cached value above the table.
-            elif is_bedrock_context:
-                try:
-                    from agent.bedrock_adapter import get_bedrock_context_length
-                    bedrock_ctx = get_bedrock_context_length(model)
-                    if cached < bedrock_ctx:
-                        logger.info(
-                            "Dropping stale Bedrock cache entry %s@%s -> %s; "
-                            "using static Bedrock table value %s",
-                            model,
-                            base_url,
-                            f"{cached:,}",
-                            f"{bedrock_ctx:,}",
-                        )
-                        _invalidate_cached_context_length(model, base_url)
-                        return bedrock_ctx
-                except ImportError:
-                    pass
-                return cached
             else:
                 if is_local_endpoint(base_url):
                     return _reconcile_local_cached_context_length(
@@ -2367,50 +2250,22 @@ def get_model_context_length(
     # 1b. AWS Bedrock — use static context length table.
     # Bedrock's ListFoundationModels API doesn't expose context window sizes,
     # so we maintain a curated table in bedrock_adapter.py that reflects
-    # Bedrock-hosted model limits (e.g. older Claude 4 at 200K; Claude
-    # Opus/Sonnet 4.6+ at 1M).  This must run BEFORE the custom-endpoint probe at
+    # AWS-imposed limits (e.g. 200K for Claude models vs 1M on the native
+    # Anthropic API).  This must run BEFORE the custom-endpoint probe at
     # step 2 — bedrock-runtime.<region>.amazonaws.com is not in
     # _URL_TO_PROVIDER, so it would otherwise be treated as a custom endpoint,
     # fail the /models probe (Bedrock doesn't expose that shape), and fall
     # back to the 128K default before reaching the original step 4b branch.
-    if is_bedrock_context:
+    if provider == "bedrock" or (
+        base_url
+        and base_url_hostname(base_url).startswith("bedrock-runtime.")
+        and base_url_host_matches(base_url, "amazonaws.com")
+    ):
         try:
-            from agent.bedrock_adapter import (
-                get_bedrock_context_length,
-                resolve_bedrock_region,
-            )
+            from agent.bedrock_adapter import get_bedrock_context_length
+            return get_bedrock_context_length(model)
         except ImportError:
             pass  # boto3 not installed — fall through to generic resolution
-        else:
-            # Bedrock does not expose the context window via any metadata API,
-            # so get_bedrock_context_length() probes the live endpoint (one
-            # fast, pre-inference length rejection) to read the real window.
-            # Cache the probe result per model so we pay that cost once, not
-            # every turn — keyed by base_url when present, else a synthetic
-            # bedrock:// key so display/offline paths share the entry.
-            cache_key_url = base_url or "bedrock://"
-            cached = get_cached_context_length(model, cache_key_url)
-            if cached is not None:
-                return cached
-            # Resolve region from the base_url host first, then the standard
-            # AWS region chain.  An empty region disables probing (table only).
-            region = ""
-            if base_url:
-                _m = re.search(r"bedrock-runtime\.([a-z0-9-]+)\.", base_url)
-                if _m:
-                    region = _m.group(1)
-            if not region:
-                try:
-                    region = resolve_bedrock_region()
-                except Exception:
-                    region = ""
-            ctx = get_bedrock_context_length(model, region=region, probe=bool(region))
-            if ctx and region:
-                # Only persist probe-derived values (region present); a pure
-                # table fallback shouldn't poison the cache against a later
-                # successful probe.
-                save_context_length(model, cache_key_url, ctx)
-            return ctx
 
     if provider == "novita" or (base_url and base_url_host_matches(base_url, "api.novita.ai")):
         ctx = _resolve_endpoint_context_length(model, base_url or "https://api.novita.ai/openai/v1", api_key=api_key)
@@ -2525,14 +2380,9 @@ def get_model_context_length(
         # Codex OAuth enforces lower context limits than the direct OpenAI
         # API for the same slug (e.g. gpt-5.5 is 1.05M on the API but 272K
         # on Codex). Authoritative source is Codex's own /models endpoint.
-        codex_ctx, codex_source = _resolve_codex_oauth_context_length_with_source(
-            model, access_token=api_key or "",
-        )
+        codex_ctx = _resolve_codex_oauth_context_length(model, access_token=api_key or "")
         if codex_ctx:
-            # Only a successful authenticated catalogue response is safe to
-            # persist. The static fallback is deliberately runtime-only so a
-            # transient OAuth/network failure cannot poison future probes.
-            if base_url and codex_source == "live":
+            if base_url:
                 save_context_length(model, base_url, codex_ctx)
             return codex_ctx
     if effective_provider == "gmi" and base_url:
@@ -2675,61 +2525,16 @@ async def get_model_context_length_async(
     )
 
 
-def _is_cjk_token_dense_char(ch: str) -> bool:
-    code = ord(ch)
-    return (
-        0x1100 <= code <= 0x11FF  # Hangul Jamo
-        or 0x2E80 <= code <= 0x9FFF  # CJK radicals/ideographs
-        or 0xA960 <= code <= 0xA97F  # Hangul Jamo Extended-A
-        or 0xAC00 <= code <= 0xD7AF  # Hangul Syllables
-        or 0xF900 <= code <= 0xFAFF  # CJK compatibility ideographs
-        or 0xFF00 <= code <= 0xFFEF  # Fullwidth forms / halfwidth kana
-    )
-
-
-# Same codepoint ranges as _is_cjk_token_dense_char, as a compiled character
-# class so dense-char counting runs in C (``len(text) - len(re.sub(...))``)
-# instead of a per-char Python loop.  MUST stay in sync with
-# _is_cjk_token_dense_char.
-_CJK_DENSE_RE = re.compile(
-    "[\u1100-\u11ff"  # Hangul Jamo
-    "\u2e80-\u9fff"  # CJK radicals/ideographs
-    "\ua960-\ua97f"  # Hangul Jamo Extended-A
-    "\uac00-\ud7af"  # Hangul Syllables
-    "\uf900-\ufaff"  # CJK compatibility ideographs
-    "\uff00-\uffef]"  # Fullwidth forms / halfwidth kana
-)
-
-
 def estimate_tokens_rough(text: str) -> int:
-    """Rough token estimate for pre-flight checks.
+    """Rough token estimate (~4 chars/token) for pre-flight checks.
 
     Uses ceiling division so short texts (1-3 chars) never estimate as
     0 tokens, which would cause the compressor and pre-flight checks to
     systematically undercount when many short tool results are present.
-    CJK/Hangul/Kana text is much denser than English under common LLM
-    tokenizers, so count those codepoints as roughly one token each instead
-    of applying the English-centric ~4 chars/token rule.
-
-    Perf: this runs on every message in every preflight/compaction walk,
-    including MB-scale tool outputs, so the common all-ASCII case must stay
-    O(1).  ``str.isascii()`` is a flag check on CPython's compact unicode
-    representation (no scan), and the CJK counting itself is a single
-    C-level ``re.findall`` rather than a per-character Python loop.
     """
     if not text:
         return 0
-    text = str(text)
-    if text.isascii():
-        # O(1) fast path — ASCII text cannot contain token-dense CJK chars.
-        return (len(text) + 3) // 4
-    dense = len(text) - len(_CJK_DENSE_RE.sub("", text))
-    if not dense:
-        # Non-ASCII but no CJK (accents, Cyrillic, emoji, ...): keep the
-        # classic ~4 chars/token rule.
-        return (len(text) + 3) // 4
-    sparse = len(text) - dense
-    return dense + ((sparse + 3) // 4)
+    return (len(text) + 3) // 4
 
 
 def estimate_messages_tokens_rough(messages: List[Dict[str, Any]]) -> int:
@@ -2741,12 +2546,12 @@ def estimate_messages_tokens_rough(messages: List[Dict[str, Any]]) -> int:
     estimated at ~250K tokens and trigger premature context compression.
     """
     _IMAGE_TOKEN_COST = 1500
-    text_tokens = 0
+    total_chars = 0
     image_tokens = 0
     for msg in messages:
-        text_tokens += _estimate_message_tokens_without_images(msg)
+        total_chars += _estimate_message_chars(msg)
         image_tokens += _count_image_tokens(msg, _IMAGE_TOKEN_COST)
-    return text_tokens + image_tokens
+    return ((total_chars + 3) // 4) + image_tokens
 
 
 def _count_image_tokens(msg: Dict[str, Any], cost_per_image: int) -> int:
@@ -2808,35 +2613,6 @@ def _estimate_message_chars(msg: Dict[str, Any]) -> int:
     return len(str(shadow))
 
 
-def _estimate_message_tokens_without_images(msg: Dict[str, Any]) -> int:
-    """Token estimate for a message shadow with image payloads stripped."""
-    if not isinstance(msg, dict):
-        return estimate_tokens_rough(str(msg))
-    shadow: Dict[str, Any] = {}
-    for k, v in msg.items():
-        if k == "_anthropic_content_blocks":
-            continue
-        if k == "content":
-            if isinstance(v, list):
-                cleaned = []
-                for part in v:
-                    if isinstance(part, dict):
-                        if part.get("type") in {"image", "image_url", "input_image"}:
-                            cleaned.append({"type": part.get("type"), "image": "[stripped]"})
-                        else:
-                            cleaned.append(part)
-                    else:
-                        cleaned.append(part)
-                shadow[k] = cleaned
-            elif isinstance(v, dict) and v.get("_multimodal"):
-                shadow[k] = v.get("text_summary", "")
-            else:
-                shadow[k] = v
-        else:
-            shadow[k] = v
-    return estimate_tokens_rough(str(shadow))
-
-
 def estimate_request_tokens_rough(
     messages: List[Dict[str, Any]],
     *,
@@ -2853,7 +2629,7 @@ def estimate_request_tokens_rough(
     """
     total = 0
     if system_prompt:
-        total += estimate_tokens_rough(system_prompt)
+        total += (len(system_prompt) + 3) // 4
     if messages:
         total += estimate_messages_tokens_rough(messages)
     if tools:

agent/moonshot_schema.py

@@ -15,9 +15,6 @@ and MoonshotAI/kimi-cli#1595:
 2. When ``anyOf`` is used, ``type`` must be on the ``anyOf`` children, not
    the parent.  Presence of both causes "type should be defined in anyOf
    items instead of the parent schema".
-3. Every object schema must carry a ``required`` array, even an empty one.
-   Standard JSON Schema allows omitting it; Moonshot 400s with
-   "required must be an array".
 
 The ``#/definitions/...`` → ``#/$defs/...`` rewrite for draft-07 refs is
 handled separately in ``tools/mcp_tool._normalize_mcp_input_schema`` so it
@@ -133,32 +130,9 @@ def _repair_schema(node: Any, is_schema: bool = True) -> Any:
             else:
                 repaired.pop("enum")
 
-    # Rule 4: object schemas must carry a `required` array, even when empty.
-    if repaired.get("type") == "object":
-        repaired = _ensure_required_array(repaired)
-
     return repaired
 
 
-def _ensure_required_array(node: Dict[str, Any]) -> Dict[str, Any]:
-    """Guarantee an object schema carries a ``required`` array (Moonshot rule).
-
-    Standard JSON Schema lets you omit ``required`` when nothing is required;
-    Moonshot 400s on that ("required must be an array").  Ensure the key is a
-    list.  When ``properties`` is known, prune ``required`` entries that don't
-    name a real property — defensive against dangling names, which Moonshot
-    also rejects.  Mutates and returns ``node``.
-    """
-    props = node.get("properties")
-    req = node.get("required")
-    if isinstance(req, list):
-        if isinstance(props, dict):
-            node["required"] = [r for r in req if r in props]
-    else:
-        node["required"] = []
-    return node
-
-
 def _fill_missing_type(node: Dict[str, Any]) -> Dict[str, Any]:
     """Infer a reasonable ``type`` if this schema node has none."""
     node_type = node.get("type")
@@ -200,18 +174,17 @@ def sanitize_moonshot_tool_parameters(parameters: Any) -> Dict[str, Any]:
     applied.  Input is not mutated.
     """
     if not isinstance(parameters, dict):
-        return {"type": "object", "properties": {}, "required": []}
+        return {"type": "object", "properties": {}}
 
     repaired = _repair_schema(copy.deepcopy(parameters), is_schema=True)
     if not isinstance(repaired, dict):
-        return {"type": "object", "properties": {}, "required": []}
+        return {"type": "object", "properties": {}}
 
     # Top-level must be an object schema
     if repaired.get("type") != "object":
         repaired["type"] = "object"
     if "properties" not in repaired:
         repaired["properties"] = {}
-    _ensure_required_array(repaired)
 
     return repaired
 
@@ -259,10 +232,6 @@ def is_moonshot_model(model: str | None) -> bool:
     tail = bare.rsplit("/", 1)[-1]
     if tail.startswith("kimi-") or tail == "kimi":
         return True
-    # Kimi Coding Plan serves K3 under the bare slug ``k3`` (plus dated /
-    # suffixed variants like ``k3.1`` or ``k3-turbo``).
-    if tail == "k3" or tail.startswith(("k3.", "k3-")):
-        return True
     # Vendor-prefixed forms commonly used on aggregators
     if "moonshot" in bare or "/kimi" in bare or bare.startswith("kimi"):
         return True

agent/nous_rate_guard.py

@@ -117,7 +117,7 @@ def record_nous_rate_limit(
         # Atomic write: write to temp file + rename
         fd, tmp_path = tempfile.mkstemp(dir=state_dir, suffix=".tmp")
         try:
-            with os.fdopen(fd, "w", encoding="utf-8") as f:
+            with os.fdopen(fd, "w") as f:
                 json.dump(state, f)
             atomic_replace(tmp_path, path)
         except Exception:

agent/onboarding.py

@@ -52,13 +52,6 @@ def busy_input_hint_gateway(mode: str) -> str:
             "Send `/busy interrupt` or `/busy queue` to change this, or "
             "`/busy status` to check. This notice won't appear again."
         )
-    if mode == "redirect":
-        return (
-            "💡 First-time tip — I redirected the current run using your message. "
-            "Completed work stays in context, and `/stop` still cancels the task. "
-            "Send `/busy queue` to wait for a separate turn, or `/busy status` "
-            "to check. This notice won't appear again."
-        )
     return (
         "💡 First-time tip — I just interrupted my current task to answer you. "
         "Send `/busy queue` to queue follow-ups for after the current task instead, "
@@ -81,12 +74,6 @@ def busy_input_hint_cli(mode: str) -> str:
             "after the next tool call. Use /busy interrupt or /busy queue to "
             "change this. This tip only shows once."
         )
-    if mode == "redirect":
-        return (
-            "(tip) Your correction redirected the current run without discarding "
-            "completed work. Use /stop to cancel or /busy queue to wait for a "
-            "separate turn. This tip only shows once."
-        )
     return (
         "(tip) Your message interrupted the current run. "
         "Use /busy queue to queue messages for the next turn instead, "

agent/prompt_builder.py

@@ -58,14 +58,6 @@ def _scan_context_content(content: str, filename: str) -> str:
     BLOCKED at this layer because the file would otherwise enter the
     system prompt verbatim and the user has no chance to intervene.
     """
-    # Editors (Windows Notepad, PowerShell Out-File without -Encoding
-    # utf8NoBOM, some VS Code profiles) prefix a UTF-8 BOM as an encoding
-    # artifact, not a prompt injection. Strip a leading U+FEFF silently so a
-    # context file (SOUL.md, AGENTS.md, ...) is not blocked wholesale; BOMs
-    # elsewhere in the content remain subject to the threat scan below.
-    if content.startswith("\ufeff"):
-        content = content[1:]
-
     findings = _scan_for_threats(content, scope="context")
     if findings:
         logger.warning("Context file %s blocked: %s", filename, ", ".join(findings))
@@ -192,13 +184,7 @@ SKILLS_GUIDANCE = (
     "skill with skill_manage so you can reuse it next time.\n"
     "When using a skill and finding it outdated, incomplete, or wrong, "
     "patch it immediately with skill_manage(action='patch') — don't wait to be asked. "
-    "Skills that aren't maintained become liabilities.\n"
-    "\n"
-    "## Skill Safety Rule\n"
-    "1. **UNAVAILABLE** — If a skill placeholder contains `[SKILL_PRUNED]`, the skill content was lost in compression and is inaccessible.\n"
-    "2. **RELOAD** — Before performing any action that depends on a skill, re-check its content with `skill_view(name='...')` if it shows `[SKILL_PRUNED]`.\n"
-    "3. **WAIT** — If a skill is loading or was just pruned, wait for the reload confirmation before proceeding.\n"
-    "4. **DEDUP** — After reloading a pruned skill, **ignore any remaining `[SKILL_PRUNED]` markers for that same skill** — they are historical artifacts from previous compactions and do not need further action."
+    "Skills that aren't maintained become liabilities."
 )
 
 KANBAN_GUIDANCE = (
@@ -563,29 +549,6 @@ def computer_use_guidance(platform_name: Optional[str] = None) -> str:
         "4. After any state-changing action, re-capture to verify. You can "
         "pass `capture_after=true` to get the follow-up screenshot in one "
         "round-trip.\n\n"
-        "## Verify → escalate ladder (background-first, NOT background-only)\n"
-        "Background delivery is the DEFAULT and the co-work path, but it is "
-        "the first rung, not the only one. Read each action's structured "
-        "result and climb only when the driver tells you to:\n"
-        "- `effect: 'confirmed'` + `verified: true` — the driver read the "
-        "result back. Done.\n"
-        "- `effect: 'unverifiable'` — the input was delivered but the driver "
-        "can't confirm it. Re-capture and check the screenshot/tree yourself "
-        "before deciding it worked.\n"
-        "- `effect: 'suspected_noop'`, `code: 'background_unavailable'`, or an "
-        "`escalation.recommended` field — the action did NOT land. Follow "
-        "`escalation.recommended`:\n"
-        "  - `'px'` → re-issue addressing the target by `coordinate=[x,y]` "
-        "read off the screenshot instead of `element`.\n"
-        "  - `'foreground'` (or a pixel click still didn't land) → re-issue "
-        "the SAME action with `delivery_mode='foreground'`. This briefly "
-        "raises the window; it needs its own approval and is only appropriate "
-        "when the user isn't actively working. Common for Electron/Chromium "
-        "consent dialogs, DirectInput games, and raw-input canvases.\n"
-        "- Escalate to foreground as a REACTION to a returned signal, never "
-        "as a prediction from the app being Electron/Chromium/GTK. Do not "
-        "silently retry the same rung expecting a different result, and do "
-        "not conclude 'cua-driver can't drive this app' — climb the ladder.\n\n"
         "## Background mode rules\n"
         "- Do NOT use `raise_window=true` on `focus_app` unless the user "
         "explicitly asked you to bring a window to front. Input routing to "
@@ -811,19 +774,8 @@ PLATFORM_HINTS = {
     ),
     "matrix": (
         "You are in a Matrix room communicating with your user. "
-        "The adapter converts your Markdown to HTML for rich display — bold, "
-        "italic, inline code, fenced code blocks, headings, bullet and "
-        "numbered lists, blockquotes, and links all render.\n\n"
-        "Do NOT use Markdown tables: many popular Matrix clients (Element X, "
-        "Beeper, most mobile apps) do not render HTML tables, so the cells "
-        "collapse into one continuous run of text. Present tabular data as "
-        "labeled '**Label:** value' lines or bullet lists instead.\n\n"
-        "Avoid ||spoiler|| tags, ~~strikethrough~~, and checkboxes "
-        "(- [ ] / - [x]) — they are not converted and appear as literal "
-        "characters.\n\n"
-        "LINKS: prefer [descriptive link text](url) over bare URLs. When "
-        "referencing something with an associated URL (events, sources, "
-        "people), make the name a clickable link.\n\n"
+        "Matrix renders Markdown — bold, italic, code blocks, and links work; "
+        "the adapter converts your Markdown to HTML for rich display. "
         "You can send media files natively: include MEDIA:/absolute/path/to/file "
         "in your response. Images (.jpg, .png, .webp) are sent as inline photos, "
         "audio (.ogg, .mp3) as voice/audio messages, video (.mp4) inline, "
@@ -890,14 +842,7 @@ PLATFORM_HINTS = {
         "You're responding through an API server. The rendering layer is unknown — "
         "assume plain text. No markdown formatting (no asterisks, bullets, headers, "
         "code fences). Treat this like a conversation, not a document. Keep responses "
-        "brief and natural. "
-        "File/media delivery: images referenced as MEDIA:/absolute/path tags "
-        "(.png/.jpg/.jpeg/.gif/.webp/.bmp, up to 5MB) are inlined as base64 data "
-        "URLs in responses on the chat, completions, and responses endpoints. "
-        "Non-image files are NOT intercepted anywhere, and the runs endpoint "
-        "intercepts nothing — a MEDIA: tag there renders as literal text exposing "
-        "a raw host filesystem path. For those cases, state the plain file path "
-        "in your response text instead of a MEDIA: tag."
+        "brief and natural."
     ),
     "webui": (
         "You are in the Hermes WebUI, a browser-based chat interface. "

agent/prompt_caching.py

@@ -1,11 +1,9 @@
 """Anthropic prompt caching strategy.
 
-The default layout uses 4 cache_control breakpoints: the static system
-prefix, the end of the system prompt, and the last 2 non-system messages.
-When a static system prefix is unavailable, it falls back to one system
-breakpoint plus the last 3 messages. All markers use the same TTL (5m or 1h).
-This preserves intra-session caching while allowing new sessions to reuse the
-stable system-prompt prefix.
+Single layout: ``system_and_3``. 4 cache_control breakpoints — system
+prompt + last 3 non-system messages, all at the same TTL (5m or 1h).
+Reduces input token costs by ~75% on multi-turn conversations within a
+single session.
 
 Pure functions -- no class state, no AIAgent dependency.
 """
@@ -83,55 +81,15 @@ def _build_marker(ttl: str) -> Dict[str, str]:
     return marker
 
 
-def _apply_system_cache_markers(
-    message: dict,
-    cache_marker: dict,
-    static_system_prefix: str | None,
-    *,
-    native_anthropic: bool,
-) -> int:
-    """Mark the static system prefix and full prompt when they can be split.
-
-    The system prompt remains one stored string. Splitting it only in the
-    outgoing request keeps session persistence and non-Anthropic transports
-    unchanged while making the stable prefix independently cacheable.
-    """
-    content = message.get("content")
-    if (
-        isinstance(static_system_prefix, str)
-        and static_system_prefix
-        and isinstance(content, str)
-        and content.startswith(static_system_prefix)
-    ):
-        suffix = content[len(static_system_prefix):]
-        if suffix:
-            message["content"] = [
-                {
-                    "type": "text",
-                    "text": static_system_prefix,
-                    "cache_control": cache_marker,
-                },
-                {"type": "text", "text": suffix, "cache_control": cache_marker},
-            ]
-            return 2
-
-    _apply_cache_marker(message, cache_marker, native_anthropic=native_anthropic)
-    return 1
-
-
 def apply_anthropic_cache_control(
     api_messages: List[Dict[str, Any]],
     cache_ttl: str = "5m",
     native_anthropic: bool = False,
-    static_system_prefix: str | None = None,
 ) -> List[Dict[str, Any]]:
-    """Apply Anthropic cache-control markers to API messages.
+    """Apply system_and_3 caching strategy to messages for Anthropic models.
 
-    When ``static_system_prefix`` exactly matches the beginning of a string
-    system prompt, it receives an early marker and the full system prompt gets
-    a trailing marker. The remaining two markers target the latest cacheable
-    non-system messages. Without that prefix, the legacy system-and-3 layout
-    is retained.
+    Places up to 4 cache_control breakpoints: system prompt + last 3 non-system
+    messages, all at the same TTL.
 
     Returns:
         Deep copy of messages with cache_control breakpoints injected.
@@ -145,12 +103,8 @@ def apply_anthropic_cache_control(
     breakpoints_used = 0
 
     if messages[0].get("role") == "system":
-        breakpoints_used = _apply_system_cache_markers(
-            messages[0],
-            marker,
-            static_system_prefix,
-            native_anthropic=native_anthropic,
-        )
+        _apply_cache_marker(messages[0], marker, native_anthropic=native_anthropic)
+        breakpoints_used += 1
 
     remaining = 4 - breakpoints_used
     non_sys = [

agent/proxy_sources/__init__.py

@@ -1,8 +0,0 @@
-"""Egress proxy integrations.
-
-Currently ships an iron-proxy (ironsh/iron-proxy) wrapper that intercepts
-outbound traffic from remote terminal sandboxes and swaps proxy tokens
-for real upstream credentials at the network edge.
-
-Design notes live in :mod:`agent.proxy_sources.iron_proxy`.
-"""

agent/reasoning_timeouts.py

@@ -102,8 +102,6 @@ _REASONING_STALE_TIMEOUT_FLOORS: tuple[tuple[str, int], ...] = (
     # ``claude-opus-4`` so non-thinking Claude 3.x or future
     # non-reasoning Claude variants don't match.
     ("claude-opus-4", 240),
-    ("claude-opus-5", 240),
-    ("claude-sonnet-5", 180),
     ("claude-sonnet-4.5", 180),
     ("claude-sonnet-4.6", 180),
     # xAI Grok reasoning variants.  Explicit reasoning-only keys
@@ -113,7 +111,6 @@ _REASONING_STALE_TIMEOUT_FLOORS: tuple[tuple[str, int], ...] = (
     # non-reasoning pairs.
     ("grok-4-fast-reasoning", 300),
     ("grok-4.20-reasoning", 300),
-    ("grok-4.5", 300),
     ("grok-4-fast-non-reasoning", 180),
 )
 

agent/redact.py

@@ -11,7 +11,6 @@ import logging
 import os
 import re
 import shlex
-from urllib.parse import unquote_plus
 
 logger = logging.getLogger(__name__)
 
@@ -286,22 +285,6 @@ _URL_USERINFO_RE = re.compile(
     r"(https?|wss?|ftp)://([^/\s:@]+):([^/\s@]+)@",
 )
 
-# Strict provider-egress URL redaction accepts more URL-reference forms than
-# the display/log helpers above. Parameter delimiters stay in capture groups so
-# redaction preserves the original query/fragment layout byte-for-byte, while
-# the key is decoded separately for classification. Values stop at query or
-# fragment pair separators; both ``&`` and ``;`` are valid in deployed URLs.
-_STRICT_URL_PARAM_RE = re.compile(
-    r"([?#&;])([A-Za-z0-9_.~+%\-]+)=([^#&;\s\"'<>]*)"
-)
-
-# Match userinfo in both absolute (``scheme://user:pass@host``) and
-# network-path (``//user:pass@host``) references. The authority boundary stops
-# at path/query/fragment delimiters so an ``@`` elsewhere in a URL is ignored.
-_STRICT_URL_USERINFO_RE = re.compile(
-    r"((?:[A-Za-z][A-Za-z0-9+.-]*:)?//)([^/\s?#@]+)@"
-)
-
 # HTTP access logs often use a relative request target rather than a full URL:
 # `"POST /webhook?password=... HTTP/1.1"`. The full-URL redactor above only
 # sees strings containing `://`, so handle request-target query strings too.
@@ -428,41 +411,6 @@ def _redact_url_userinfo(text: str) -> str:
     )
 
 
-def _canonical_url_param_name(name: str) -> str:
-    """Decode a URL parameter name for bounded, case-insensitive matching."""
-    decoded = name
-    for _ in range(3):
-        next_value = unquote_plus(decoded)
-        if next_value == decoded:
-            break
-        decoded = next_value
-    return decoded.casefold().replace("-", "_")
-
-
-def _redact_strict_url_credentials(text: str) -> str:
-    """Redact credentials from absolute, relative, and network URL references.
-
-    This is intentionally stricter than display/log redaction and is used only
-    at explicit secret-egress boundaries. It preserves original keys,
-    separators, public parameters, hosts, and paths while masking sensitive
-    values and URL userinfo.
-    """
-    def _redact_param(match: re.Match) -> str:
-        if _canonical_url_param_name(match.group(2)) not in _SENSITIVE_QUERY_PARAMS:
-            return match.group(0)
-        return f"{match.group(1)}{match.group(2)}=***"
-
-    def _redact_userinfo(match: re.Match) -> str:
-        userinfo = match.group(2)
-        if ":" in userinfo:
-            username, _, _password = userinfo.partition(":")
-            return f"{match.group(1)}{username}:***@"
-        return f"{match.group(1)}***@"
-
-    text = _STRICT_URL_PARAM_RE.sub(_redact_param, text)
-    return _STRICT_URL_USERINFO_RE.sub(_redact_userinfo, text)
-
-
 def redact_cdp_url(value: object) -> str:
     """Mask secrets in a CDP/browser endpoint URL before it is logged.
 
@@ -546,7 +494,6 @@ def redact_sensitive_text(
     force: bool = False,
     code_file: bool = False,
     file_read: bool = False,
-    redact_url_credentials: bool = False,
 ) -> str:
     """Apply all redaction patterns to a block of text.
 
@@ -555,11 +502,6 @@ def redact_sensitive_text(
     Set force=True for safety boundaries that must never return raw secrets
     regardless of the user's global logging redaction preference.
 
-    Set redact_url_credentials=True at non-navigation egress boundaries to
-    additionally redact credential-named query parameters and ``user:pass@``
-    URL userinfo. The default remains False because actionable OAuth callback,
-    magic-link, and pre-signed URLs must survive ordinary tool flows unchanged.
-
     Set code_file=True to skip the ENV-assignment and JSON-field regex
     patterns when the text is known to be source code (e.g. MAX_TOKENS=***
     constants, "apiKey": "test" fixtures). Prefix patterns, auth headers,
@@ -724,9 +666,6 @@ def redact_sensitive_text(
     # string), so masking it can't break a skill. The ``user:pass@`` form is
     # left to pass through per #34029.
 
-    if redact_url_credentials:
-        text = _redact_strict_url_credentials(text)
-
     # Form-urlencoded bodies (only triggers on clean k=v&k=v inputs).
     if "&" in text and "=" in text:
         text = _redact_form_body(text)

agent/replay_cleanup.py

@@ -22,7 +22,6 @@ from typing import Any, Dict, List
 
 from agent.tool_dispatch_helpers import make_tool_result_message
 from agent.tool_result_classification import tool_may_have_side_effect
-from agent.turn_context import drop_stale_api_content
 
 logger = logging.getLogger(__name__)
 
@@ -312,11 +311,6 @@ def strip_stale_dangerous_confirmations(
                 )
                 redacted = dict(msg)
                 redacted["content"] = _EXPIRED_CONFIRMATION_SENTINEL
-                # Drop the api_content sidecar: it carries the exact bytes
-                # previously sent — i.e. the dangerous confirmation this
-                # redaction exists to expire. Replaying it verbatim would
-                # undo the redaction on the wire.
-                drop_stale_api_content(redacted)
                 cleaned.append(redacted)
                 continue
         cleaned.append(msg)

agent/secret_scope.py

@@ -127,16 +127,10 @@ def get_secret(name: str, default: Optional[str] = None) -> Optional[str]:
 
     1. Genuinely-global vars (``_is_global_env``) always read ``os.environ`` —
        they are deployment settings, not profile secrets.
-    2. When a secret scope is installed (multiplexed turn), read from it. Under
-       multiplexing the scope is authoritative — an absent key returns
-       ``default`` and we do NOT fall through to ``os.environ``, because in a
-       multiplexer ``os.environ`` may hold another profile's value. When
-       multiplexing is OFF, a scope miss falls through to ``os.environ``:
-       single-profile deployments legitimately provide credentials via the
-       process environment (systemd ``Environment=``, secret-manager wrappers
-       like ``pass-cli run`` / ``op run``, plain shell exports) rather than
-       ``<home>/.env``, and the scope — installed unconditionally around e.g.
-       every cron job — must stay a ``.env`` overlay, not a blindfold.
+    2. When a secret scope is installed (multiplexed turn), read from it; an
+       absent key returns ``default``. The scope is authoritative — we do NOT
+       fall through to ``os.environ``, because in a multiplexer ``os.environ``
+       may hold another profile's value.
     3. No scope installed:
        - multiplex INACTIVE (default deployment): read ``os.environ`` —
          identical to the legacy ``os.getenv`` behavior every caller had before.
@@ -150,17 +144,6 @@ def get_secret(name: str, default: Optional[str] = None) -> Optional[str]:
     scope = _SECRET_SCOPE.get()
     if scope is not None:
         val = scope.get(name)
-        if val is not None:
-            return val
-        if _MULTIPLEX_ACTIVE:
-            return default
-        # Multiplex off: the scope is an overlay over the process environment,
-        # not an isolation boundary — there is no other profile to leak from.
-        # Without this fallthrough, credentials injected only into the process
-        # environment vanish inside any set_secret_scope(...) block (the cron
-        # scheduler installs one around every job), so cron jobs send a
-        # placeholder API key and 401 while interactive turns keep working.
-        val = os.environ.get(name)
         return val if val is not None else default
 
     if _MULTIPLEX_ACTIVE:
@@ -218,18 +201,5 @@ def build_profile_secret_scope(hermes_home: Path) -> Dict[str, str]:
     global vars are intentionally NOT copied in — ``get_secret`` reads those
     from ``os.environ`` directly, so the scope holds only profile secrets.
     """
-    home = Path(hermes_home)
-    secrets = load_env_file(home / ".env")
+    return load_env_file(Path(hermes_home) / ".env")
 
-    try:
-        from hermes_cli.env_loader import get_secret_source_values
-        external_secrets = get_secret_source_values(home)
-    except Exception:
-        external_secrets = {}
-
-    for key, value in external_secrets.items():
-        if _is_global_env(key):
-            continue
-        secrets[key] = value
-
-    return secrets

agent/secret_sources/base.py

@@ -190,45 +190,6 @@ class SecretSource(ABC):
         """
         return {}
 
-    def remediation(self, kind: Optional["ErrorKind"], cfg: dict) -> str:
-        """One-line, actionable next step for a failed fetch.
-
-        Called by the startup status printer (and ``hermes secrets ...
-        status``) right after a fetch error is surfaced, so the user sees
-        *what to run* next to fix it — not just what broke.  Sources
-        should override this to point at their own CLI verbs (e.g.
-        ``hermes secrets bitwarden token`` for AUTH_FAILED).  Return an
-        empty string to suppress the hint.
-
-        Must never raise and must not perform I/O — it's a pure
-        kind→string mapping on the startup path.
-        """
-        generic = {
-            ErrorKind.NOT_CONFIGURED: (
-                f"Run `hermes secrets {self.name} setup` to finish configuration."
-            ),
-            ErrorKind.BINARY_MISSING: (
-                f"Run `hermes secrets {self.name} setup` to install the helper CLI."
-            ),
-            ErrorKind.AUTH_FAILED: (
-                f"Credentials rejected — run `hermes secrets {self.name} setup` "
-                "to re-authenticate."
-            ),
-            ErrorKind.AUTH_EXPIRED: (
-                f"Credentials expired — run `hermes secrets {self.name} setup` "
-                "to re-authenticate."
-            ),
-            ErrorKind.NETWORK: (
-                "Network problem reaching the secrets backend — check "
-                "connectivity and retry."
-            ),
-            ErrorKind.TIMEOUT: (
-                f"Backend was slow — raise secrets.{self.name}.timeout_seconds "
-                "if this recurs."
-            ),
-        }
-        return generic.get(kind, "") if kind is not None else ""
-
 
 # ---------------------------------------------------------------------------
 # Shared helpers — use these instead of hand-rolling per backend
@@ -295,7 +256,7 @@ def run_secret_cli(
             list(argv),
             env=env,
             capture_output=True,
-            text=True, encoding="utf-8", errors="replace",
+            text=True,
             timeout=timeout,
             stdin=subprocess.DEVNULL,
         )

agent/secret_sources/bitwarden.py

@@ -29,13 +29,11 @@ is easier to lazy-install than a wheels-with-Rust-extension dependency.
 
 from __future__ import annotations
 
-import base64
 import hashlib
 import json
 import logging
 import os
 import platform
-import re
 import shutil
 import stat
 import subprocess
@@ -47,10 +45,6 @@ import zipfile
 from pathlib import Path
 from typing import Dict, List, Optional, Tuple
 
-from cryptography.hazmat.primitives import hashes
-from cryptography.hazmat.primitives.ciphers.aead import AESGCM
-from cryptography.hazmat.primitives.kdf.hkdf import HKDF
-
 from agent.secret_sources._cache import (
     CachedFetch as _CachedFetch,
     DiskCache,
@@ -97,9 +91,6 @@ _CACHE: Dict[_CacheKey, _CachedFetch] = {}
 # accidentally commit BSM-sourced secrets. The atomic-write/0600/TTL mechanics
 # live in agent.secret_sources._cache.DiskCache, shared with the other backends.
 _DISK_CACHE_BASENAME = "bws_cache.json"
-_ENCRYPTED_CACHE_BASENAME = "bws_cache.enc.json"
-_ENCRYPTED_CACHE_VERSION = 1
-_ENCRYPTED_CACHE_INFO = b"hermes-bws-encrypted-cache-v1"
 
 
 def _cache_key_str(cache_key: _CacheKey) -> str:
@@ -122,13 +113,6 @@ def _disk_cache_path(home_path: Optional[Path] = None) -> Path:
     return _DISK_CACHE.path(home_path)
 
 
-def _encrypted_disk_cache_path(home_path: Optional[Path] = None) -> Path:
-    """Return the encrypted disk cache path under hermes_home/cache/."""
-    from agent.secret_sources._cache import resolve_cache_home
-
-    return resolve_cache_home(home_path) / "cache" / _ENCRYPTED_CACHE_BASENAME
-
-
 # ---------------------------------------------------------------------------
 # Binary discovery + lazy install
 # ---------------------------------------------------------------------------
@@ -200,7 +184,7 @@ def _platform_asset_name() -> str:
             res = subprocess.run(
                 ["ldd", "--version"],
                 capture_output=True,
-                text=True, encoding='utf-8', errors='replace',
+                text=True,
                 timeout=2,
                 stdin=subprocess.DEVNULL,
             )
@@ -364,134 +348,6 @@ def _token_fingerprint(token: str) -> str:
     return hashlib.sha256(token.encode("utf-8")).hexdigest()[:16]
 
 
-def _b64e(raw: bytes) -> str:
-    return base64.b64encode(raw).decode("ascii")
-
-
-def _b64d(text: str) -> bytes:
-    return base64.b64decode(text.encode("ascii"), validate=True)
-
-
-def _derive_encrypted_cache_key(access_token: str, salt: bytes) -> bytes:
-    """Derive the local cache encryption key from the bootstrap BWS token."""
-    return HKDF(
-        algorithm=hashes.SHA256(),
-        length=32,
-        salt=salt,
-        info=_ENCRYPTED_CACHE_INFO,
-    ).derive(access_token.encode("utf-8"))
-
-
-def _write_encrypted_disk_cache(
-    *,
-    cache_key: _CacheKey,
-    access_token: str,
-    entry: _CachedFetch,
-    home_path: Optional[Path] = None,
-) -> None:
-    """Persist an encrypted last-good cache entry atomically.
-
-    Best-effort by design: cache write failure must never block a fresh BWS
-    fetch.  The raw BWS access token is not stored; it only derives the AES key.
-    """
-    path = _encrypted_disk_cache_path(home_path)
-    try:
-        cache_dir = path.parent
-        cache_dir.mkdir(parents=True, exist_ok=True)
-        try:
-            os.chmod(cache_dir, 0o700)
-        except OSError:
-            pass
-        salt = os.urandom(16)
-        nonce = os.urandom(12)
-        serialized_key = _cache_key_str(cache_key)
-        key = _derive_encrypted_cache_key(access_token, salt)
-        plaintext = json.dumps(
-            {"secrets": entry.secrets, "fetched_at": entry.fetched_at},
-            separators=(",", ":"),
-        ).encode("utf-8")
-        ciphertext = AESGCM(key).encrypt(
-            nonce, plaintext, serialized_key.encode("utf-8")
-        )
-        payload = {
-            "version": _ENCRYPTED_CACHE_VERSION,
-            "key": serialized_key,
-            "salt": _b64e(salt),
-            "nonce": _b64e(nonce),
-            "ciphertext": _b64e(ciphertext),
-        }
-        fd, tmp = tempfile.mkstemp(
-            prefix=".bws_cache_enc_", suffix=".tmp", dir=str(cache_dir)
-        )
-        try:
-            with os.fdopen(fd, "w", encoding="utf-8") as f:
-                json.dump(payload, f)
-            os.chmod(tmp, 0o600)
-            os.replace(tmp, path)
-            # A successful encrypted write completes migration; remove the
-            # legacy plaintext cache so stale secrets cannot remain on disk.
-            try:
-                _disk_cache_path(home_path).unlink()
-            except FileNotFoundError:
-                pass
-            except OSError:
-                pass
-        except BaseException:
-            try:
-                os.unlink(tmp)
-            except OSError:
-                pass
-            raise
-    except Exception:  # noqa: BLE001 — best-effort cache only
-        return
-
-
-def _read_encrypted_disk_cache(
-    *,
-    cache_key: _CacheKey,
-    access_token: str,
-    max_age_seconds: float,
-    home_path: Optional[Path] = None,
-) -> Optional[_CachedFetch]:
-    """Return a decrypted encrypted-cache entry if it matches and is in-window."""
-    if max_age_seconds <= 0:
-        return None
-    path = _encrypted_disk_cache_path(home_path)
-    try:
-        payload = json.loads(path.read_text(encoding="utf-8"))
-        if not isinstance(payload, dict):
-            return None
-        serialized_key = _cache_key_str(cache_key)
-        if payload.get("version") != _ENCRYPTED_CACHE_VERSION:
-            return None
-        if payload.get("key") != serialized_key:
-            return None
-        salt = _b64d(str(payload.get("salt", "")))
-        nonce = _b64d(str(payload.get("nonce", "")))
-        ciphertext = _b64d(str(payload.get("ciphertext", "")))
-        key = _derive_encrypted_cache_key(access_token, salt)
-        raw = AESGCM(key).decrypt(
-            nonce, ciphertext, serialized_key.encode("utf-8")
-        )
-        inner = json.loads(raw.decode("utf-8"))
-        if not isinstance(inner, dict):
-            return None
-        secrets = inner.get("secrets")
-        inner_fetched_at = inner.get("fetched_at")
-        if not isinstance(secrets, dict) or not isinstance(inner_fetched_at, (int, float)):
-            return None
-        entry_age = time.time() - float(inner_fetched_at)
-        if entry_age < 0 or entry_age > max_age_seconds:
-            return None
-        typed = {
-            k: v for k, v in secrets.items()
-            if isinstance(k, str) and isinstance(v, str)
-        }
-        return _CachedFetch(secrets=typed, fetched_at=float(inner_fetched_at))
-    except Exception:  # noqa: BLE001 — cache miss on parse/decrypt/I/O errors
-        return None
-
-
 def fetch_bitwarden_secrets(
     *,
     access_token: str,
@@ -501,8 +357,6 @@ def fetch_bitwarden_secrets(
     use_cache: bool = True,
     server_url: str = "",
     home_path: Optional[Path] = None,
-    encrypted_cache_enabled: bool = False,
-    encrypted_cache_max_stale_seconds: float = 0,
 ) -> Tuple[Dict[str, str], List[str]]:
     """Pull the secrets for ``project_id`` from Bitwarden Secrets Manager.
 
@@ -514,13 +368,12 @@ def fetch_bitwarden_secrets(
     (``https://vault.bitwarden.com``, US Cloud).  This is plumbed into
     the subprocess as ``BWS_SERVER_URL``.
 
-    ``cache_ttl_seconds`` controls the normal fresh cache.  When
-    ``encrypted_cache_enabled`` is true, fresh cache entries are written as
-    AES-GCM encrypted JSON instead of plaintext, and a last-good encrypted
-    entry may be used after NETWORK/TIMEOUT failures for up to
-    ``encrypted_cache_max_stale_seconds``.  This stale fallback is separate
-    from the fresh-cache TTL so operators can set ``cache_ttl_seconds: 0``
-    while still keeping an encrypted break-glass cache for offline startup.
+    Caching is a two-layer LRU: an in-process dict (for hot-reload paths
+    inside one process) and a disk-persisted JSON file under
+    ``<hermes_home>/cache/bws_cache.json`` (for back-to-back CLI invocations).
+    Both share the same TTL.  Pass ``home_path`` so disk cache lookups find
+    the right directory in tests / non-standard installs; otherwise we fall
+    back to ``$HERMES_HOME`` / ``~/.hermes``.
 
     Raises :class:`RuntimeError` for fatal conditions (missing binary,
     auth failure, unparseable output).  Callers in the env_loader path
@@ -533,20 +386,12 @@ def fetch_bitwarden_secrets(
         raise RuntimeError("Bitwarden project_id is empty")
 
     cache_key = (_token_fingerprint(access_token), project_id, server_url or "")
-    if use_cache and cache_ttl_seconds > 0:
+    if use_cache:
         cached = _CACHE.get(cache_key)
         if cached and cached.is_fresh(cache_ttl_seconds):
             return cached.secrets, []
         # L2: disk cache. ~5ms on cache hit vs ~380ms for `bws secret list`.
-        if encrypted_cache_enabled:
-            disk_cached = _read_encrypted_disk_cache(
-                cache_key=cache_key,
-                access_token=access_token,
-                max_age_seconds=cache_ttl_seconds,
-                home_path=home_path,
-            )
-        else:
-            disk_cached = _DISK_CACHE.read(cache_key, cache_ttl_seconds, home_path)
+        disk_cached = _DISK_CACHE.read(cache_key, cache_ttl_seconds, home_path)
         if disk_cached is not None:
             # Promote into in-process cache so subsequent fetches in the
             # same process skip the disk read too.
@@ -562,107 +407,14 @@ def fetch_bitwarden_secrets(
             "`hermes secrets bitwarden setup`."
         )
 
-    try:
-        secrets, warnings = _run_bws_list(bws, access_token, project_id, server_url)
-    except RuntimeError as exc:
-        # Live fetch failed. Fall back to a stale disk cache ONLY for
-        # transport-level failures (network down, DNS error, transient BWS
-        # outage / timeout) — never for AUTH_FAILED or a malformed-output
-        # INTERNAL error, where serving old secrets would mask a real
-        # config/credential problem the caller needs to see.  Without this
-        # fallback a fleet of bots sharing one BWS project all stop working
-        # on a single network blip.
-        #
-        # Two fallback tiers share the transport-only gate:
-        # * encrypted cache (opt-in) — AES-GCM payload keyed off the
-        #   bootstrap token, with its own max_stale_seconds window.  When
-        #   enabled it is the ONLY fallback consulted: the whole point is
-        #   that the at-rest payload is never plaintext, so we don't
-        #   quietly serve the plaintext file alongside it.
-        # * plaintext disk cache (default) — the ordinary DiskCache file.
-        #   `cache_ttl_seconds <= 0` means the caller opted out of caching
-        #   entirely (DiskCache.read/write both short-circuit on it) —
-        #   honor that on the fallback path too.  `ttl_seconds=inf` on the
-        #   read bypasses freshness (we explicitly want a stale hit); the
-        #   caller's real TTL gates whether we even attempt the read.
-        kind = _classify_bws_error(str(exc))
-        if use_cache and kind in (ErrorKind.NETWORK, ErrorKind.TIMEOUT):
-            if encrypted_cache_enabled:
-                stale = _read_encrypted_disk_cache(
-                    cache_key=cache_key,
-                    access_token=access_token,
-                    max_age_seconds=encrypted_cache_max_stale_seconds,
-                    home_path=home_path,
-                )
-                if stale is not None:
-                    age = max(0.0, time.time() - stale.fetched_at)
-                    _CACHE[cache_key] = stale
-                    return stale.secrets, [
-                        f"bws live fetch failed ({exc}); falling back to "
-                        f"stale ENCRYPTED disk cache ({int(age)}s old)"
-                    ]
-            elif cache_ttl_seconds > 0:
-                stale = _DISK_CACHE.read(cache_key, float("inf"), home_path)
-                if stale is not None:
-                    age = max(0.0, time.time() - stale.fetched_at)
-                    _CACHE[cache_key] = stale
-                    return stale.secrets, [
-                        f"bws live fetch failed ({exc}); "
-                        f"falling back to stale disk cache ({int(age)}s old)"
-                    ]
-        raise
+    secrets, warnings = _run_bws_list(bws, access_token, project_id, server_url)
     entry = _CachedFetch(secrets=secrets, fetched_at=time.time())
+    _CACHE[cache_key] = entry
     if use_cache:
-        if cache_ttl_seconds > 0:
-            _CACHE[cache_key] = entry
-        if encrypted_cache_enabled:
-            # Encryption is the storage policy; max_stale_seconds only controls
-            # whether an outage may consume the last-good entry.  Never fall
-            # back to the plaintext cache just because stale fallback is off.
-            _write_encrypted_disk_cache(
-                cache_key=cache_key,
-                access_token=access_token,
-                entry=entry,
-                home_path=home_path,
-            )
-        elif cache_ttl_seconds > 0:
-            _DISK_CACHE.write(cache_key, entry, cache_ttl_seconds, home_path)
+        _DISK_CACHE.write(cache_key, entry, cache_ttl_seconds, home_path)
     return secrets, warnings
 
 
-def _summarize_bws_stderr(raw: str) -> str:
-    """Reduce a bws (Rust color-eyre) error dump to its cause line(s).
-
-    bws failures look like::
-
-        Error:
-           0: Received error message from server: [400 Bad Request] {"error":"invalid_client"}
-
-        Location:
-           crates/bws/src/main.rs:108
-        ...
-
-    Everything from ``Location:`` on is diagnostic noise for a Hermes
-    user.  Keep the numbered cause lines (joined), drop the rest, and
-    fall back to the stripped raw text when the shape is unrecognized.
-    """
-    text = raw.replace("\x1b", "").strip()
-    if not text:
-        return text
-    causes: List[str] = []
-    for line in text.splitlines():
-        stripped = line.strip()
-        if stripped.startswith(("Location:", "Backtrace omitted", "Run with ")):
-            break
-        if stripped in ("", "Error:"):
-            continue
-        # Cause lines are numbered "0: ...", "1: ..." — strip the index.
-        stripped = re.sub(r"^\d+:\s*", "", stripped)
-        if stripped:
-            causes.append(stripped)
-    return "; ".join(causes) if causes else text
-
-
 def _run_bws_list(
     bws: Path, access_token: str, project_id: str, server_url: str = ""
 ) -> Tuple[Dict[str, str], List[str]]:
@@ -684,7 +436,7 @@ def _run_bws_list(
             cmd,
             env=env,
             capture_output=True,
-            text=True, encoding='utf-8', errors='replace',
+            text=True,
             timeout=_BWS_RUN_TIMEOUT,
             stdin=subprocess.DEVNULL,
         )
@@ -696,11 +448,9 @@ def _run_bws_list(
         raise RuntimeError(f"failed to invoke bws: {exc}") from exc
 
     if proc.returncode != 0:
-        # bws writes auth/network errors to stderr as a Rust error-report
-        # dump (color-eyre): an "Error:" header, indented cause lines, then
-        # "Location:" / "Backtrace omitted" noise.  Strip ANSI and boil it
-        # down to the meaningful cause line(s) before surfacing.
-        err = _summarize_bws_stderr(proc.stderr or proc.stdout or "")
+        # bws writes auth/network errors to stderr in plain English.
+        # Strip ANSI just in case and surface the first 200 chars.
+        err = (proc.stderr or proc.stdout or "").strip().replace("\x1b", "")
         raise RuntimeError(
             f"bws exited {proc.returncode}: {err[:200]}"
         )
@@ -752,8 +502,6 @@ def apply_bitwarden_secrets(
     auto_install: bool = True,
     server_url: str = "",
     home_path: Optional[Path] = None,
-    encrypted_cache_enabled: bool = False,
-    encrypted_cache_max_stale_seconds: float = 0,
 ) -> FetchResult:
     """Pull secrets from BSM and set them on ``os.environ``.
 
@@ -805,8 +553,6 @@ def apply_bitwarden_secrets(
             cache_ttl_seconds=cache_ttl_seconds,
             server_url=server_url,
             home_path=home_path,
-            encrypted_cache_enabled=encrypted_cache_enabled,
-            encrypted_cache_max_stale_seconds=encrypted_cache_max_stale_seconds,
         )
     except RuntimeError as exc:
         result.error = str(exc)
@@ -876,16 +622,9 @@ class BitwardenSource(SecretSource):
             },
             "project_id": {"description": "BSM project UUID", "default": ""},
             "cache_ttl_seconds": {
-                "description": "Fresh disk+memory cache TTL; 0 disables fresh-cache reuse",
+                "description": "Disk+memory cache TTL; 0 disables",
                 "default": 300,
             },
-            "encrypted_cache": {
-                "description": "Encrypted last-good cache for network/timeout fallback",
-                "default": {
-                    "enabled": False,
-                    "max_stale_seconds": 0,
-                },
-            },
             "override_existing": {
                 "description": "BSM values overwrite .env/shell values",
                 "default": True,
@@ -939,14 +678,6 @@ class BitwardenSource(SecretSource):
         except (TypeError, ValueError):
             ttl = 300.0
 
-        encrypted_cfg = cfg.get("encrypted_cache")
-        encrypted_cfg = encrypted_cfg if isinstance(encrypted_cfg, dict) else {}
-        encrypted_enabled = bool(encrypted_cfg.get("enabled", False))
-        try:
-            encrypted_max_stale = float(encrypted_cfg.get("max_stale_seconds", 0))
-        except (TypeError, ValueError):
-            encrypted_max_stale = 0.0
-
         try:
             secrets, warnings = fetch_bitwarden_secrets(
                 access_token=access_token,
@@ -955,36 +686,16 @@ class BitwardenSource(SecretSource):
                 cache_ttl_seconds=ttl,
                 server_url=str(cfg.get("server_url", "") or "").strip(),
                 home_path=home_path,
-                encrypted_cache_enabled=encrypted_enabled,
-                encrypted_cache_max_stale_seconds=encrypted_max_stale,
             )
         except RuntimeError as exc:
             result.error = str(exc)
             result.error_kind = _classify_bws_error(str(exc))
-            if result.error_kind == ErrorKind.AUTH_FAILED:
-                # Translate the raw OAuth reject into what it actually means
-                # for the user before the mechanics.
-                result.error = (
-                    "Bitwarden rejected the machine-account access token "
-                    f"({access_token_env}) — it was likely revoked, expired, "
-                    f"or belongs to another region.  ({result.error})"
-                )
             return result
 
         result.secrets = secrets
         result.warnings.extend(warnings)
         return result
 
-    def remediation(self, kind, cfg: dict) -> str:
-        if kind in (ErrorKind.AUTH_FAILED, ErrorKind.AUTH_EXPIRED):
-            return (
-                "Run `hermes secrets bitwarden token` to paste a fresh access "
-                "token (create one in the Bitwarden web app: Secrets Manager → "
-                "Machine accounts → Access tokens).  Wrong region?  Re-run "
-                "`hermes secrets bitwarden setup` and pick EU/self-hosted."
-            )
-        return super().remediation(kind, cfg)
-
 
 def _classify_bws_error(message: str) -> ErrorKind:
     """Best-effort mapping of bws failure text onto the shared taxonomy."""
@@ -994,13 +705,7 @@ def _classify_bws_error(message: str) -> ErrorKind:
     if "binary not available" in lowered or "failed to invoke" in lowered:
         return ErrorKind.BINARY_MISSING
     if any(tok in lowered for tok in ("unauthorized", "invalid token",
-                                      "access token", "401", "403",
-                                      # The BSM identity endpoint rejects a
-                                      # revoked/expired/deleted machine-account
-                                      # token with an OAuth-style
-                                      # `[400 Bad Request] {"error":"invalid_client"}`.
-                                      "invalid_client", "invalid_grant",
-                                      "400 bad request")):
+                                      "access token", "401", "403")):
         return ErrorKind.AUTH_FAILED
     if any(tok in lowered for tok in ("network", "connection", "resolve",
                                       "download", "dns")):
@@ -1013,22 +718,6 @@ def _classify_bws_error(message: str) -> ErrorKind:
 # ---------------------------------------------------------------------------
 
 
-def clear_caches(home_path: Optional[Path] = None) -> None:
-    """Drop in-process AND disk caches (plaintext and encrypted).
-
-    Used after a token rotation (`hermes secrets bitwarden token`) so the
-    next startup fetches fresh with the new credential instead of serving
-    a pull cached under the old token's fingerprint.  The encrypted cache
-    is keyed off the old token too, so it must go as well.
-    """
-    _CACHE.clear()
-    _DISK_CACHE.clear(home_path)
-    try:
-        _encrypted_disk_cache_path(home_path).unlink()
-    except (FileNotFoundError, OSError):
-        pass
-
-
 def _reset_cache_for_tests(home_path: Optional[Path] = None) -> None:
     """Clear in-process AND disk caches.
 
@@ -1036,4 +725,5 @@ def _reset_cache_for_tests(home_path: Optional[Path] = None) -> None:
     Without it we fall back to the same default resolution as the cache
     writer itself.
     """
-    clear_caches(home_path)
+    _CACHE.clear()
+    _DISK_CACHE.clear(home_path)

agent/secret_sources/command.py

@@ -1,488 +0,0 @@
-"""``command`` secret source — resolve secrets via a user-configured helper.
-
-Ports the security semantics of the desktop app's TypeScript
-``CommandSecretsProvider`` (hermes-desktop ``src/main/secrets/commandProvider.ts``)
-to the Python agent.  The helper command (e.g. ``keepassxc-cli``,
-``secret-tool``, or a script that cats a tmpfs env file) comes from
-``secrets.command`` in ``config.yaml`` — NEVER from ``.env``, which holds
-only secret values.
-
-Security model (mirrors the TS provider line-for-line where it matters):
-
-* The command string is the USER'S OWN configuration (same trust level as
-  the ``.env`` file they control), so it is run via ``/bin/sh -c <command>``.
-* The requested key is passed to the child ONLY via the ``HERMES_SECRET_KEY``
-  environment variable — it is NEVER interpolated into the shell string, so
-  a hostile key name (e.g. ``"; rm -rf ~``) is inert data, not code.
-* Hard timeout (default 3s) + output cap (default 1 MiB); any failure
-  (non-zero exit, timeout, spawn failure, oversized output) degrades to
-  "no value" rather than raising.
-* Failures log ONLY structured fields (exit code / signal / errno) to
-  stderr — never the command string, the helper's stderr, or any secret
-  value.  The helper's stderr is captured via a pipe and DISCARDED so its
-  diagnostics (which can carry secret material) never reach our stderr.
-* The startup/apply path runs the helper exactly ONCE (with an empty
-  ``HERMES_SECRET_KEY``) — it is never called per-key in a loop, so a
-  helper that blocks (e.g. on a vault unlock prompt) can't be spawned
-  dozens of times.
-* PLATFORM: the provider is POSIX-only (needs ``/bin/sh``).  On Windows it
-  degrades to an empty result with a warning; Windows users stay on the
-  default ``env`` provider.
-"""
-
-from __future__ import annotations
-
-import os
-import platform
-import re
-import signal as _signal
-import subprocess
-import sys
-from pathlib import Path
-from typing import Dict, Optional
-
-# Reuse the exact result shape the bitwarden source returns so
-# hermes_cli.env_loader can consume both providers identically.
-from agent.secret_sources.base import ErrorKind, SecretSource
-from agent.secret_sources.bitwarden import FetchResult
-
-__all__ = [
-    "FetchResult",
-    "apply_command_secrets",
-    "get_command_secret",
-    "list_command_secrets",
-    "parse_secret_output",
-    "unquote_dotenv_value",
-]
-
-# Hard cap so a hung helper can never wedge startup.  Kept deliberately
-# TIGHT (3s) — a configured helper MUST be fast and NON-INTERACTIVE
-# (e.g. `keepassxc-cli` against an already-unlocked DB, `secret-tool
-# lookup`, or `cat`-ing a tmpfs env file), NOT something that prompts
-# for a touch/PIN.
-_COMMAND_TIMEOUT_SECONDS = 3.0
-# Defensive cap on helper output (1 MiB) — a misbehaving command can't OOM us.
-_MAX_OUTPUT_BYTES = 1024 * 1024
-
-# A line is treated as a KEY=VALUE pair only when it matches an env-key
-# shape before the '='.  Anchored; `.` does not cross newlines, so a
-# multi-line blob never matches as a single "env-shaped" value.
-_ENV_LINE = re.compile(r"^([A-Za-z_][A-Za-z0-9_]*)=(.*)$")
-
-
-def _is_windows() -> bool:
-    return os.name == "nt" or platform.system() == "Windows"
-
-
-def unquote_dotenv_value(raw: str) -> str:
-    """Strip a single layer of matching surrounding quotes from a dotenv value.
-
-    Requires length >= 2 so a lone quote (``"``) is left intact rather than
-    collapsing to empty, and ``""``/``''`` correctly yield an empty string.
-    Shared by the single-key parser and the list path so both unquote
-    identically.
-    """
-    t = raw.strip()
-    if len(t) >= 2 and (
-        (t.startswith('"') and t.endswith('"'))
-        or (t.startswith("'") and t.endswith("'"))
-    ):
-        return t[1:-1]
-    return t
-
-
-def parse_secret_output(stdout: str, wanted_key: str) -> Optional[str]:
-    """Parse a secret-fetch helper's stdout.  Supports BOTH shapes:
-
-    * a bare value (single secret): the whole trimmed stdout is the value.
-    * a dotenv blob (KEY=VALUE lines): parse them and return the entry for
-      ``wanted_key``.
-
-    Mirrors the TS ``parseSecretOutput`` exactly, including the cross-key
-    misroute guard and the base64-padding disambiguation.
-    """
-    text = stdout.replace("\r\n", "\n")
-    lines = text.split("\n")
-
-    # 1. Exact dotenv match wins: scan for a `wanted_key=...` line.  This
-    #    is deterministic and never returns another key's value.
-    dotenv_lines = [
-        line
-        for line in (raw.strip() for raw in lines)
-        if line and not line.startswith("#") and _ENV_LINE.match(line)
-    ]
-    for line in dotenv_lines:
-        m = _ENV_LINE.match(line)
-        assert m is not None  # filtered above
-        if m.group(1) == wanted_key:
-            value = unquote_dotenv_value(m.group(2))
-            # Whitespace-only (e.g. a quoted `K="  "` placeholder) is "no
-            # value": it would otherwise flow into an Authorization header
-            # → guaranteed 401.
-            return value if value.strip() != "" else None
-
-    # 2. The output is a multi-key dotenv dump that does NOT contain the
-    #    wanted key → None, rather than mis-returning an unrelated line as
-    #    a bare value.  Only >=2 env-shaped lines count as a dump: a SINGLE
-    #    non-matching env-shaped line falls through to the bare-value
-    #    branch, because a bare secret can itself match the KEY=VALUE shape
-    #    (e.g. base64 with '=' padding, "dGVzdA==") and must not be
-    #    misclassified as a dump.
-    if len(dotenv_lines) > 1:
-        return None
-
-    # 3. Otherwise treat the whole output as a single bare value (a per-key
-    #    helper that printed just the secret).  Trim first so whitespace-only
-    #    output (a ' '/'\t' placeholder entry) resolves to None, never a "key".
-    value = text.strip()
-    if value == "":
-        return None
-
-    # SECURITY (S2): a single env-shaped line for a DIFFERENT key must not
-    # be returned as the wanted secret.  A sloppy helper (e.g. `head -1
-    # env-file`, or a grep that matched the wrong line) emitting
-    # `OTHER_KEY=realvalue` would otherwise flow — key name, '=' and the
-    # OTHER key's value — into an Authorization header sent to the WANTED
-    # key's endpoint: cross-provider credential leakage, not just a 401.
-    # Disambiguation from a bare base64 secret: base64 padding only ever
-    # produces an env-shaped line whose "value" part is empty or all '='
-    # (`dGVzdA==` → key `dGVzdA`, value `=`), so a non-trivial value part
-    # after a non-matching key means a misrouted dotenv entry → None.
-    env_shaped = _ENV_LINE.match(value)
-    if (
-        env_shaped
-        and env_shaped.group(1) != wanted_key
-        and re.fullmatch(r"=*", env_shaped.group(2).strip()) is None
-    ):
-        return None
-    return value
-
-
-def _run_helper(
-    command: str,
-    secret_key: str,
-    timeout_seconds: float,
-    max_output_bytes: int,
-) -> Optional[str]:
-    """Run the helper via ``/bin/sh -c`` and return its stdout, or None.
-
-    The key is passed as DATA via ``HERMES_SECRET_KEY`` — never interpolated
-    into the command string.  Both stdout and stderr are captured via pipes
-    (never inherited); stderr is discarded.  Any failure logs structured
-    fields only and returns None — never raises.
-    """
-    if _is_windows():
-        print(
-            "[secrets:command] the 'command' provider is POSIX-only "
-            "(needs /bin/sh); resolving no value on Windows",
-            file=sys.stderr,
-        )
-        return None
-
-    env = os.environ.copy()
-    env["HERMES_SECRET_KEY"] = secret_key
-
-    try:
-        proc = subprocess.Popen(  # noqa: S602 — command is the user's own config
-            ["/bin/sh", "-c", command],
-            env=env,
-            stdin=subprocess.DEVNULL,
-            stdout=subprocess.PIPE,
-            stderr=subprocess.PIPE,  # captured and DISCARDED — never inherited
-            start_new_session=True,  # so the hard timeout can kill the whole group
-        )
-    except OSError as exc:
-        print(
-            f"[secrets:command] helper failed to spawn; resolving no value: "
-            f"errno={exc.errno}",
-            file=sys.stderr,
-        )
-        return None
-
-    try:
-        stdout_bytes, _stderr_discarded = proc.communicate(timeout=timeout_seconds)
-    except subprocess.TimeoutExpired:
-        # Hard timeout: kill the whole process group (a helper script may
-        # have forked children that would otherwise keep the pipe open).
-        # POSIX-only by construction: _run_helper early-returns on Windows
-        # before ever spawning, so this line can't execute there.
-        try:
-            os.killpg(os.getpgid(proc.pid), _signal.SIGKILL)  # windows-footgun: ok
-        except (ProcessLookupError, PermissionError, OSError):
-            proc.kill()
-        try:
-            proc.communicate(timeout=1.0)
-        except (subprocess.TimeoutExpired, ValueError, OSError):
-            pass
-        print(
-            f"[secrets:command] helper timed out after {timeout_seconds:g}s; "
-            f"resolving no value",
-            file=sys.stderr,
-        )
-        return None
-
-    if proc.returncode != 0:
-        # Structured fields ONLY — never the command string or the helper's
-        # stderr (either can carry secret material).
-        if proc.returncode < 0:
-            try:
-                sig = _signal.Signals(-proc.returncode).name
-            except ValueError:
-                sig = str(-proc.returncode)
-            code, signame = "?", sig
-        else:
-            code, signame = str(proc.returncode), "none"
-        print(
-            f"[secrets:command] helper failed; resolving no value: "
-            f"code={code} signal={signame}",
-            file=sys.stderr,
-        )
-        return None
-
-    if len(stdout_bytes) > max_output_bytes:
-        print(
-            f"[secrets:command] helper output exceeded the "
-            f"{max_output_bytes}-byte cap; resolving no value",
-            file=sys.stderr,
-        )
-        return None
-
-    return stdout_bytes.decode("utf-8", errors="replace")
-
-
-def _parse_dotenv_map(stdout: str) -> Dict[str, str]:
-    """Parse a KEY=VALUE blob into a map (the list/enumerate path).
-
-    Mirrors the TS ``list()``: only env-shaped lines contribute; comments
-    and non-matching lines are skipped.  A bare-value helper yields ``{}``
-    — per-key resolution via :func:`get_command_secret` still works.
-    """
-    out: Dict[str, str] = {}
-    for raw in stdout.replace("\r\n", "\n").split("\n"):
-        line = raw.strip()
-        if not line or line.startswith("#"):
-            continue
-        m = _ENV_LINE.match(line)
-        if not m:
-            continue
-        out[m.group(1)] = unquote_dotenv_value(m.group(2))
-    return out
-
-
-def get_command_secret(
-    *,
-    command: str,
-    key: str,
-    timeout_seconds: float = _COMMAND_TIMEOUT_SECONDS,
-    max_output_bytes: int = _MAX_OUTPUT_BYTES,
-) -> Optional[str]:
-    """Resolve a single secret by running the helper with the key in
-    ``HERMES_SECRET_KEY``.  Returns None on any failure — never raises."""
-    command = (command or "").strip()
-    if not command:
-        return None
-    stdout = _run_helper(command, key, timeout_seconds, max_output_bytes)
-    if stdout is None:
-        return None
-    return parse_secret_output(stdout, key)
-
-
-def list_command_secrets(
-    *,
-    command: str,
-    timeout_seconds: float = _COMMAND_TIMEOUT_SECONDS,
-    max_output_bytes: int = _MAX_OUTPUT_BYTES,
-) -> Dict[str, str]:
-    """Enumerate secrets by running the helper ONCE with an empty key.
-
-    Returns the dotenv map ONLY when the helper emits a KEY=VALUE blob;
-    a bare-value helper returns ``{}``.  Never raises.
-    """
-    command = (command or "").strip()
-    if not command:
-        return {}
-    stdout = _run_helper(command, "", timeout_seconds, max_output_bytes)
-    if stdout is None:
-        return {}
-    return _parse_dotenv_map(stdout)
-
-
-# ---------------------------------------------------------------------------
-# Public entry point — called from hermes_cli.env_loader
-# ---------------------------------------------------------------------------
-
-
-def apply_command_secrets(
-    *,
-    command: str,
-    override_existing: bool = False,
-    timeout_seconds: float = _COMMAND_TIMEOUT_SECONDS,
-    max_output_bytes: int = _MAX_OUTPUT_BYTES,
-    home_path: Optional[Path] = None,
-) -> FetchResult:
-    """Run the helper once at startup and set its KEY=VALUE output on
-    ``os.environ``.
-
-    LEGACY shim retained for API symmetry with ``apply_bitwarden_secrets``;
-    the startup path goes through :class:`CommandSource` + the registry
-    orchestrator instead (which owns precedence and the environ writes).
-    """
-    result = FetchResult()
-
-    command = (command or "").strip()
-    if not command:
-        result.error = (
-            "secrets.command.enabled is true but secrets.command.command is "
-            "empty.  Set the helper command in config.yaml."
-        )
-        return result
-
-    if _is_windows():
-        result.warnings.append(
-            "the 'command' secret source is POSIX-only (needs /bin/sh); "
-            "skipping on Windows"
-        )
-        return result
-
-    # The list/enumerate path: run the helper exactly ONCE with an empty
-    # HERMES_SECRET_KEY and parse its stdout as a dotenv blob.
-    stdout = _run_helper(command, "", timeout_seconds, max_output_bytes)
-    if stdout is None:
-        # _run_helper already logged structured fields to stderr.
-        result.warnings.append(
-            "helper command failed at startup; no secrets applied "
-            "(process env / .env values remain in effect)"
-        )
-        return result
-
-    secrets = _parse_dotenv_map(stdout)
-    result.secrets = secrets
-    if not secrets:
-        result.warnings.append(
-            "helper output was not a KEY=VALUE map; nothing applied at "
-            "startup (a bare-value helper still resolves single keys on demand)"
-        )
-        return result
-
-    for key, value in secrets.items():
-        if value.strip() == "":
-            # Whitespace-only placeholder entries are "no value" — applying
-            # them would flow into an Authorization header → guaranteed 401.
-            result.skipped.append(key)
-            continue
-        if not override_existing and os.environ.get(key):
-            # Process env / .env win — same precedence as bitwarden.
-            result.skipped.append(key)
-            continue
-        os.environ[key] = value
-        result.applied.append(key)
-
-    return result
-
-
-# ---------------------------------------------------------------------------
-# SecretSource adapter — the registry-facing wrapper around this module.
-# ---------------------------------------------------------------------------
-
-
-class CommandSource(SecretSource):
-    """User-configured helper command as a registered secret source.
-
-    Composes with the other sources (Bitwarden, 1Password, plugins) through
-    the ``apply_all()`` orchestrator — enable any combination simultaneously;
-    there is deliberately NO single-provider selector.  ``fetch()`` only
-    fetches: precedence, ``override_existing`` semantics, conflict warnings,
-    and the ``os.environ`` writes are the orchestrator's job.
-
-    Bulk shape: the helper enumerates a KEY=VALUE blob in one run.  Config::
-
-        secrets:
-          command:
-            enabled: true
-            command: "cat /run/user/1000/hermes-secrets.env"
-            # or per-vault CLIs: keepassxc-cli / secret-tool / pass / gpg —
-            # anything fast and NON-interactive.
-    """
-
-    name = "command"
-    label = "Command helper"
-    shape = "bulk"
-
-    def config_schema(self) -> dict:
-        return {
-            "enabled": {"description": "Master switch", "default": False},
-            "command": {
-                "description": "Helper run via /bin/sh -c; must print a "
-                               "KEY=VALUE blob on stdout",
-                "default": "",
-            },
-            "helper_timeout_seconds": {
-                "description": "Hard timeout for one helper run",
-                "default": _COMMAND_TIMEOUT_SECONDS,
-            },
-            "override_existing": {
-                "description": "Helper values overwrite .env/shell values",
-                "default": False,
-            },
-        }
-
-    def fetch(self, cfg: dict, home_path: Path) -> FetchResult:
-        cfg = cfg if isinstance(cfg, dict) else {}
-        result = FetchResult()
-
-        command = str(cfg.get("command") or "").strip()
-        if not command:
-            result.error = (
-                "secrets.command.enabled is true but secrets.command.command "
-                "is empty.  Set the helper command in config.yaml."
-            )
-            result.error_kind = ErrorKind.NOT_CONFIGURED
-            return result
-
-        if _is_windows():
-            result.error = (
-                "the 'command' secret source is POSIX-only (needs /bin/sh); "
-                "skipping on Windows"
-            )
-            result.error_kind = ErrorKind.NOT_CONFIGURED
-            return result
-
-        try:
-            timeout = float(cfg.get("helper_timeout_seconds",
-                                    _COMMAND_TIMEOUT_SECONDS))
-        except (TypeError, ValueError):
-            timeout = _COMMAND_TIMEOUT_SECONDS
-
-        stdout = _run_helper(command, "", timeout, _MAX_OUTPUT_BYTES)
-        if stdout is None:
-            # _run_helper already logged structured fields to stderr.
-            result.error = (
-                "helper command failed (see structured fields above); "
-                "no secrets applied"
-            )
-            result.error_kind = ErrorKind.INTERNAL
-            return result
-
-        secrets = _parse_dotenv_map(stdout)
-        if not secrets:
-            result.warnings.append(
-                "helper output was not a KEY=VALUE map; nothing to apply"
-            )
-            return result
-
-        result.secrets = secrets
-        return result
-
-    def remediation(self, kind, cfg: dict) -> str:
-        if kind == ErrorKind.NOT_CONFIGURED:
-            return (
-                "Set secrets.command.command in config.yaml to a fast, "
-                "non-interactive helper that prints KEY=VALUE lines."
-            )
-        if kind == ErrorKind.INTERNAL:
-            return (
-                "Run the helper manually in a shell to see its real error — "
-                "Hermes discards helper stderr so diagnostics can't leak "
-                "secret material."
-            )
-        return super().remediation(kind, cfg)

agent/secret_sources/onepassword.py

@@ -98,9 +98,6 @@ _OP_ENV_ALLOWLIST = (
     "OP_ACCOUNT",
     "OP_CONNECT_HOST",
     "OP_CONNECT_TOKEN",
-    # Lets a user skip op's desktop-app integration probe (which can hang with
-    # no timeout on a wedged desktop container) and go straight to token auth.
-    "OP_LOAD_DESKTOP_APP_SETTINGS",
 )
 
 
@@ -175,19 +172,16 @@ def _validate_references(
 def _auth_fingerprint(token_env: str) -> str:
     """SHA-256 prefix over the auth material `op` would use.
 
-    Folds in the service-account token, ``OP_ACCOUNT``, the 1Password Connect
-    ``OP_CONNECT_HOST``/``OP_CONNECT_TOKEN``, and *all* ``OP_SESSION_*`` vars
-    (the names `op` actually exports for interactive sessions —
-    ``OP_SESSION_<account_shorthand>``).  Signing out and into a different
-    identity therefore changes the cache key, so a value cached under a
-    previous identity is never served under a new one.  Never logged or
+    Folds in the service-account token, ``OP_ACCOUNT``, and *all*
+    ``OP_SESSION_*`` vars (the names `op` actually exports for interactive
+    sessions — ``OP_SESSION_<account_shorthand>``).  Signing out and into a
+    different identity therefore changes the cache key, so a value cached under
+    a previous identity is never served under a new one.  Never logged or
     displayed; the raw token never leaves this hash.
     """
     parts: List[str] = [
         f"token={os.environ.get(token_env, '')}",
         f"account={os.environ.get('OP_ACCOUNT', '')}",
-        f"connect_host={os.environ.get('OP_CONNECT_HOST', '')}",
-        f"connect_token={os.environ.get('OP_CONNECT_TOKEN', '')}",
     ]
     for key in sorted(os.environ):
         if key.startswith("OP_SESSION_"):
@@ -613,24 +607,6 @@ class OnePasswordSource(SecretSource):
         result.warnings.extend(fetch_warnings)
         return result
 
-    def remediation(self, kind, cfg: dict) -> str:
-        if kind in (ErrorKind.AUTH_FAILED, ErrorKind.AUTH_EXPIRED):
-            token_env = _DEFAULT_TOKEN_ENV
-            if isinstance(cfg, dict):
-                token_env = str(cfg.get("service_account_token_env") or token_env)
-            return (
-                "Run `hermes secrets onepassword token` to paste a fresh "
-                f"service-account token ({token_env}), or `op signin` for an "
-                "interactive session."
-            )
-        if kind == ErrorKind.BINARY_MISSING:
-            return (
-                "Install the 1Password CLI "
-                "(https://developer.1password.com/docs/cli/get-started/) or "
-                "set secrets.onepassword.binary_path."
-            )
-        return super().remediation(kind, cfg)
-
 
 def _classify_op_error(message: str) -> ErrorKind:
     """Best-effort mapping of op failure text onto the shared taxonomy."""
@@ -657,21 +633,11 @@ def _classify_op_error(message: str) -> ErrorKind:
 # ---------------------------------------------------------------------------
 
 
-def clear_caches(home_path: Optional[Path] = None) -> None:
-    """Drop in-process AND disk caches.
-
-    Used after a token rotation (`hermes secrets onepassword token`) so
-    the next startup resolves fresh with the new credential instead of
-    serving values cached under the old token's fingerprint.
-    """
-    _CACHE.clear()
-    _DISK_CACHE.clear(home_path)
-
-
 def _reset_cache_for_tests(home_path: Optional[Path] = None) -> None:
     """Clear in-process AND disk caches.
 
     Tests can pass ``home_path`` to scope the disk cleanup to a tmpdir.
     Without it we fall back to the same default resolution as the writer.
     """
-    clear_caches(home_path)
+    _CACHE.clear()
+    _DISK_CACHE.clear(home_path)

agent/secret_sources/registry.py

@@ -29,7 +29,6 @@ from __future__ import annotations
 
 import concurrent.futures
 import logging
-import os
 from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Dict, List, Optional
@@ -175,13 +174,6 @@ def _ensure_builtin_sources() -> None:
     except Exception:  # noqa: BLE001 — never block startup
         logger.warning("Failed to register bundled 1Password secret source",
                        exc_info=True)
-    try:
-        from agent.secret_sources.command import CommandSource
-
-        register_source(CommandSource())
-    except Exception:  # noqa: BLE001 — never block startup
-        logger.warning("Failed to register bundled command secret source",
-                       exc_info=True)
 
 
 def _reset_registry_for_tests() -> None:
@@ -283,43 +275,6 @@ def _ordered_enabled_sources(secrets_cfg: dict) -> List[SecretSource]:
     return enabled
 
 
-def _active_profile_name(home_path: Optional[Path]) -> str:
-    """Best-effort active profile name for profile-scoped secret aliases.
-
-    A named profile's HERMES_HOME is ``~/.hermes/profiles/<name>``; the
-    default profile (``~/.hermes``) returns "".
-    """
-    if home_path is not None:
-        resolved = Path(home_path)
-        if resolved.parent.name == "profiles" and resolved.name:
-            return resolved.name
-    for env_name in ("HERMES_PROFILE_NAME", "HERMES_PROFILE"):
-        value = os.environ.get(env_name, "").strip()
-        if value and value != "default":
-            return value
-    return ""
-
-
-# Only credential-shaped names get auto-aliased — a random profile-suffixed
-# var should not silently hydrate an unsuffixed name.
-_ALIAS_SUFFIXES = ("_API_KEY", "_TOKEN", "_SECRET", "_KEY", "_PASSWORD")
-
-
-def _profile_alias_target(var: str, profile: str) -> Optional[str]:
-    """Map ``FOO_<PROFILE>`` to ``FOO`` for the active profile when safe."""
-    if not profile:
-        return None
-    suffix = "_" + profile.replace("-", "_").upper()
-    if not var.endswith(suffix):
-        return None
-    alias = var[: -len(suffix)]
-    if not alias or not is_valid_env_name(alias):
-        return None
-    if not any(alias.endswith(s) for s in _ALIAS_SUFFIXES):
-        return None
-    return alias
-
-
 def apply_all(secrets_cfg: dict, home_path: Path,
               environ: Optional[Dict[str, str]] = None) -> ApplyReport:
     """Fetch from every enabled source and apply the merged result to env.
@@ -328,24 +283,14 @@ def apply_all(secrets_cfg: dict, home_path: Path,
 
     Precedence per env var (most-specific intent wins):
 
-    1. ``secrets.preserve_existing`` names — a pre-existing env value always
-       wins for these, even against a source with ``override_existing: true``
-       (escape hatch for profile-local platform secrets, #58073).
-    2. Pre-existing env (.env / shell) — unless the winning source has
+    1. Pre-existing env (.env / shell) — unless the winning source has
        ``override_existing: true``.
-    3. Mapped sources, in configured order.
-    4. Bulk sources, in configured order.
+    2. Mapped sources, in configured order.
+    3. Bulk sources, in configured order.
 
     First claim wins.  A later source that also carries the var gets a
     ``skipped_claimed`` entry and a conflict warning — never a silent
     clobber, and ``override_existing`` never applies across sources.
-
-    Profile aliasing (#51447): when running under a named profile, an applied
-    var ``FOO_<PROFILE>`` (credential-shaped suffixes only) also hydrates the
-    canonical ``FOO`` so platform adapters and plugins that read fixed env
-    names see the profile's value.  The alias obeys the same protected /
-    preserve / claimed / override guards and is disabled with
-    ``secrets.profile_alias: false``.
     """
     import os as _os
 
@@ -357,14 +302,6 @@ def apply_all(secrets_cfg: dict, home_path: Path,
     if not enabled:
         return report
 
-    preserve_raw = secrets_cfg.get("preserve_existing")
-    preserve: frozenset = frozenset(
-        n.strip() for n in preserve_raw if isinstance(n, str) and n.strip()
-    ) if isinstance(preserve_raw, list) else frozenset()
-
-    alias_enabled = bool(secrets_cfg.get("profile_alias", True))
-    profile = _active_profile_name(home_path) if alias_enabled else ""
-
     # Mapped sources outrank bulk sources regardless of list order:
     # an explicit VAR→ref binding is stronger intent than a project dump.
     ordered = ([s for s in enabled if s.shape == "mapped"]
@@ -384,15 +321,6 @@ def apply_all(secrets_cfg: dict, home_path: Path,
         except Exception:  # noqa: BLE001
             pass
 
-    # Every var any source supplies directly — an alias never shadows a
-    # var that some source will (or tried to) claim by its real name.
-    supplied_directly: set = set()
-    for _, _, result in fetches:
-        if result.ok:
-            supplied_directly.update(
-                v for v in result.secrets if isinstance(v, str)
-            )
-
     # Apply phase — sequential, first-wins, fully attributed.
     claimed: Dict[str, str] = {}  # var → source name that won it
     for source, cfg, result in fetches:
@@ -408,14 +336,15 @@ def apply_all(secrets_cfg: dict, home_path: Path,
         except Exception:  # noqa: BLE001
             override = False
 
-        def _try_apply(var: str, value: str, *, is_alias: bool = False) -> bool:
-            """Apply one var through the shared guard chain. True = applied."""
+        for var, value in result.secrets.items():
+            if not isinstance(var, str) or not isinstance(value, str):
+                continue
             if not is_valid_env_name(var):
                 sr.skipped_invalid.append(var)
-                return False
+                continue
             if var in protected:
                 sr.skipped_protected.append(var)
-                return False
+                continue
             if var in claimed:
                 sr.skipped_claimed.append(var)
                 report.conflicts.append(
@@ -423,14 +352,11 @@ def apply_all(secrets_cfg: dict, home_path: Path,
                     f"{source.name} also supplies it (first source wins — "
                     "remove one binding or reorder secrets.sources)"
                 )
-                return False
+                continue
             existed = bool(env.get(var))
-            if existed and var in preserve:
-                sr.skipped_existing.append(var)
-                return False
             if existed and not override:
                 sr.skipped_existing.append(var)
-                return False
+                continue
             env[var] = value
             claimed[var] = source.name
             sr.applied.append(var)
@@ -440,21 +366,5 @@ def apply_all(secrets_cfg: dict, home_path: Path,
                 shape=source.shape,
                 overrode_env=existed,
             )
-            return True
-
-        for var, value in result.secrets.items():
-            if not isinstance(var, str) or not isinstance(value, str):
-                continue
-            applied = _try_apply(var, value)
-
-            if not applied or not profile:
-                continue
-            alias = _profile_alias_target(var, profile)
-            if alias and alias not in supplied_directly and alias not in claimed:
-                if _try_apply(alias, value, is_alias=True):
-                    result.warnings.append(
-                        f"applied profile-scoped {var} as {alias} "
-                        f"(active profile {profile!r})"
-                    )
 
     return report

agent/shell_hooks.py

@@ -464,7 +464,7 @@ def _spawn(spec: ShellHookSpec, stdin_json: str) -> Dict[str, Any]:
             input=stdin_json,
             capture_output=True,
             timeout=spec.timeout,
-            text=True, encoding='utf-8', errors='replace',
+            text=True,
             shell=False,
             **_popen_kwargs,
         )
@@ -632,7 +632,7 @@ def allowlist_path() -> Path:
 def load_allowlist() -> Dict[str, Any]:
     """Return the parsed allowlist, or an empty skeleton if absent."""
     try:
-        raw = json.loads(allowlist_path().read_text(encoding="utf-8"))
+        raw = json.loads(allowlist_path().read_text())
     except (FileNotFoundError, json.JSONDecodeError, OSError):
         return {"approvals": []}
     if not isinstance(raw, dict):

agent/skill_commands.py

@@ -453,8 +453,8 @@ def reload_skills() -> Dict[str, Any]:
             }
 
         ``description`` is the skill's full SKILL.md frontmatter
-        ``description:`` field. Note: the system prompt skill index
-        truncates this to the first 57 chars; see ``extract_skill_description``.
+        ``description:`` field — the same string the system prompt renders
+        as ``    - name: description`` for pre-existing skills.
     """
     # Snapshot pre-reload state (name -> description) from the current
     # slash-command cache. Using dicts lets the post-rescan diff carry

agent/skill_preprocessing.py

@@ -74,7 +74,7 @@ def run_inline_shell(command: str, cwd: Path | None, timeout: int) -> str:
             ["bash", "-c", command],
             cwd=str(cwd) if cwd else None,
             capture_output=True,
-            text=True, encoding='utf-8', errors='replace',
+            text=True,
             timeout=max(1, int(timeout)),
             check=False,
             stdin=subprocess.DEVNULL,

agent/skill_utils.py

@@ -779,31 +779,18 @@ def resolve_skill_config_values(
 
 # ── Description extraction ────────────────────────────────────────────────
 
-SKILL_PROMPT_DESC_LIMIT = 60
-
-
-def _normalize_skill_description(frontmatter: Dict[str, Any]) -> str:
-    """Normalize a skill's description field for comparison/truncation."""
-    raw_desc = frontmatter.get("description", "")
-    return str(raw_desc).strip().strip("'\"") if raw_desc else ""
-
 
 def extract_skill_description(frontmatter: Dict[str, Any]) -> str:
-    """Extract a system-prompt-length description from parsed frontmatter."""
-    desc = _normalize_skill_description(frontmatter)
-    if not desc:
+    """Extract a truncated description from parsed frontmatter."""
+    raw_desc = frontmatter.get("description", "")
+    if not raw_desc:
         return ""
-    if len(desc) > SKILL_PROMPT_DESC_LIMIT:
-        return desc[:SKILL_PROMPT_DESC_LIMIT - 3] + "..."
+    desc = str(raw_desc).strip().strip("'\"")
+    if len(desc) > 60:
+        return desc[:57] + "..."
     return desc
 
 
-def is_skill_description_truncated_for_prompt(frontmatter: Dict[str, Any]) -> bool:
-    """True when the description will be truncated in the system prompt skill index."""
-    desc = _normalize_skill_description(frontmatter)
-    return len(desc) > SKILL_PROMPT_DESC_LIMIT
-
-
 # ── File iteration ────────────────────────────────────────────────────────
 
 

agent/ssl_guard.py

@@ -31,8 +31,7 @@ def _skip_ssl_guard_enabled() -> bool:
 
 def _repair_hint() -> str:
     return (
-        "Repair: run `hermes doctor --fix` (auto-reinstalls certifi), or "
-        "manually: python -m pip install --force-reinstall certifi openai httpx\n"
+        "Repair: python -m pip install --force-reinstall certifi openai httpx\n"
         "If you configured a custom corporate CA bundle, fix or unset the "
         "broken CA bundle environment variable."
     )

agent/stream_single_writer.py

@@ -1,70 +0,0 @@
-"""Best-effort accessors for the single-writer stream fence (#65991).
-
-The fence itself lives on ``AIAgent`` (``_claim_stream_writer`` /
-``_stream_writer_is_current`` in ``run_agent.py``), but the streaming code paths
-that use it live in *other* modules — ``chat_completion_helpers`` (chat /
-anthropic / bedrock) and ``codex_runtime`` (codex responses). Calling the fence
-directly as ``agent._claim_stream_writer()`` from those modules makes them
-hard-depend on the method being present on whatever object is passed in as
-``agent``.
-
-That coupling is a latent crash: a partially-updated checkout (the streaming
-helper module newer than ``run_agent``), a hot-reloaded gateway, a duck-typed
-agent, or a test double without the method turns an *additive* safety net into a
-fatal ``AttributeError`` that aborts the whole turn. A cron job died exactly
-this way with ``'AIAgent' object has no attribute '_claim_stream_writer'``.
-
-The fence is only ever allowed to drop a *provably* superseded stream — never
-the sole legitimate writer. So when the guard is unavailable (or raises), the
-correct degradation is "no fence": keep streaming. These helpers make the
-claim/check best-effort to guarantee that.
-"""
-
-from __future__ import annotations
-
-import logging
-from typing import Any
-
-logger = logging.getLogger(__name__)
-
-
-def claim_stream_writer(agent: Any) -> int:
-    """Claim the delta sink for the calling stream attempt, best-effort.
-
-    Returns the agent's monotonic writer token when the fence is available, or
-    ``0`` when the agent doesn't expose it (or the claim raised). A ``0`` token
-    pairs with :func:`stream_writer_is_current` always returning ``True``, so a
-    guard-less agent is simply never fenced instead of crashing the turn.
-    """
-    claim = getattr(agent, "_claim_stream_writer", None)
-    if callable(claim):
-        try:
-            return int(claim())
-        except Exception:
-            logger.debug(
-                "stream single-writer: claim failed; proceeding unfenced",
-                exc_info=True,
-            )
-    return 0
-
-
-def stream_writer_is_current(agent: Any, token: int) -> bool:
-    """True when ``token`` is still the active writer, best-effort.
-
-    A falsy token (from a claim that no-oped) or an agent without the fence
-    means we cannot prove supersession, so the stream is treated as current and
-    never fenced. This preserves the single-writer invariant's one-way promise:
-    only a demonstrably stale writer is ever stopped.
-    """
-    if not token:
-        return True
-    is_current = getattr(agent, "_stream_writer_is_current", None)
-    if callable(is_current):
-        try:
-            return bool(is_current(token))
-        except Exception:
-            logger.debug(
-                "stream single-writer: is_current check failed; treating as current",
-                exc_info=True,
-            )
-    return True

agent/subscription_view.py

@@ -1,507 +0,0 @@
-"""Surface-agnostic core for the ``/subscription`` TUI screen.
-
-Companion to :mod:`agent.billing_view` — same fail-open philosophy: when not
-logged in or the portal is unreachable, return a struct with ``logged_in=False``
-and let the surface degrade gracefully (never crash). Money is decimal end-to-end
-(server emits decimal strings); we only format for display.
-
-The TUI ``SubscriptionOverlay`` drives the plan change in-terminal (V3): it
-previews the effect, then schedules a downgrade / cancellation / resume
-(chargeless) or applies an upgrade (charges the card on the subscription). The
-portal deep-link (built locally from ``portal_url`` + ``org_id``) remains the
-fallback for an upgrade that needs 3DS / was declined.
-
-WS1 dependency: ``GET /api/billing/subscription`` is a NAS endpoint (WS1 Phase A).
-Until it ships, the fail-open contract handles 404s — the builder returns
-``logged_in=False`` and the surface degrades gracefully.
-"""
-
-from __future__ import annotations
-
-import logging
-import os
-from dataclasses import dataclass
-from decimal import Decimal
-from typing import Any, Optional
-
-from agent.billing_view import parse_money
-
-logger = logging.getLogger(__name__)
-
-
-# =============================================================================
-# Parsed sub-structures
-# =============================================================================
-
-
-@dataclass(frozen=True)
-class CurrentSubscription:
-    """The user's active subscription. ``None`` (not this object) = no plan.
-
-    When present, ``tier_id`` / ``tier_name`` / ``monthly_credits`` /
-    ``cycle_ends_at`` are always set (NAS guarantees a present ``current`` is a
-    fully-populated plan). Only ``credits_remaining`` and the cancel/downgrade
-    fields are optional.
-    """
-
-    tier_id: Optional[str] = None
-    tier_name: Optional[str] = None
-    monthly_credits: Optional[Decimal] = None
-    credits_remaining: Optional[Decimal] = None
-    cycle_ends_at: Optional[str] = None  # ISO
-    pending_downgrade_tier_name: Optional[str] = None
-    pending_downgrade_at: Optional[str] = None  # ISO
-    cancel_at_period_end: bool = False
-    cancellation_effective_at: Optional[str] = None  # ISO
-
-
-@dataclass(frozen=True)
-class SubscriptionTier:
-    """A selectable plan in the catalog — one row of the in-terminal tier picker.
-
-    Mirrors NAS's ``SubscriptionTierOption``. ``is_current`` marks the active plan
-    (shown but not selectable); ``is_enabled=False`` is a grandfathered tier the
-    user is on but that can no longer be selected. ``tier_order`` sorts the picker
-    and drives the upgrade-vs-downgrade direction hint.
-    """
-
-    tier_id: str
-    name: str
-    tier_order: int = 0
-    dollars_per_month: Optional[Decimal] = None
-    monthly_credits: Optional[Decimal] = None
-    is_current: bool = False
-    is_enabled: bool = True
-
-
-@dataclass(frozen=True)
-class SubscriptionChangePreview:
-    """Parsed ``POST /api/billing/subscription/preview`` — what a change would do.
-
-    ``effect`` is the disposition the commit would take:
-      - ``charge_now`` → an upgrade; ``amount_due_now_cents`` is the prorated charge.
-      - ``scheduled``  → a downgrade / same-price change at ``effective_at`` (period end).
-      - ``no_op``      → already on the target tier.
-      - ``blocked``    → the commit would be refused; ``reason`` says why.
-    """
-
-    effect: str
-    reason: Optional[str] = None
-    current_tier_id: Optional[str] = None
-    current_tier_name: Optional[str] = None
-    target_tier_id: Optional[str] = None
-    target_tier_name: Optional[str] = None
-    monthly_credits_delta: Optional[Decimal] = None
-    amount_due_now_cents: Optional[int] = None
-    effective_at: Optional[str] = None  # ISO
-
-
-@dataclass(frozen=True)
-class SubscriptionState:
-    """Parsed ``GET /api/billing/subscription`` — the overview screen's data.
-
-    Fail-open: ``logged_in=False`` (and empty fields) when not logged in or the
-    portal is unreachable.
-    """
-
-    logged_in: bool
-    org_name: Optional[str] = None
-    org_id: Optional[str] = None  # org.id from the NAS response
-    role: Optional[str] = None  # "OWNER" | "ADMIN" | "FINANCE_ADMIN" | "SECURITY_ADMIN" | "MEMBER"
-    can_change_plan_raw: Optional[bool] = None
-    context: str = "personal"  # "personal" | "team"
-    current: Optional[CurrentSubscription] = None
-    tiers: tuple[SubscriptionTier, ...] = ()  # selectable catalog (picker)
-    portal_url: Optional[str] = None
-    # When the fetch failed (vs cleanly not-logged-in), the message for the surface.
-    error: Optional[str] = None
-
-    @property
-    def is_admin(self) -> bool:
-        """Deprecated/display only — a legacy OWNER/ADMIN check.
-
-        NOT a capability check; use :attr:`can_change_plan` for gating billing
-        plan-change actions.
-        """
-        return (self.role or "").upper() in ("OWNER", "ADMIN")
-
-    @property
-    def can_change_plan(self) -> bool:
-        """Server capability when supplied; otherwise the legacy role fallback."""
-        if self.can_change_plan_raw is not None:
-            return self.can_change_plan_raw
-        return self.is_admin
-
-
-# =============================================================================
-# Payload parsing
-# =============================================================================
-
-
-def _parse_current(raw: Any) -> Optional[CurrentSubscription]:
-    # "No plan" is wire-represented as current:null (free personal OR team) —
-    # the old all-null-object shape is gone. A present current is a real plan,
-    # so guard on a real tier id and return None otherwise.
-    if not isinstance(raw, dict):
-        return None
-    tier_id = raw.get("tierId") or raw.get("id")
-    if not tier_id:
-        return None
-    return CurrentSubscription(
-        tier_id=tier_id,
-        tier_name=raw.get("tierName") or raw.get("name"),
-        monthly_credits=parse_money(raw.get("monthlyCredits")),
-        credits_remaining=parse_money(raw.get("creditsRemaining")),
-        cycle_ends_at=raw.get("cycleEndsAt"),
-        pending_downgrade_tier_name=raw.get("pendingDowngradeTierName"),
-        pending_downgrade_at=raw.get("pendingDowngradeAt"),
-        cancel_at_period_end=bool(raw.get("cancelAtPeriodEnd")),
-        cancellation_effective_at=raw.get("cancellationEffectiveAt") or None,
-    )
-
-
-def _coalesce(*vals: Any) -> Any:
-    """First non-``None`` value (preserves a legit ``0``/``0.0``, unlike ``or``).
-
-    NAS sends ``0`` for the free tier's ``tierOrder`` / ``dollarsPerMonth``; a plain
-    ``x or default`` would drop those, so coalesce on ``None`` specifically.
-    """
-    for v in vals:
-        if v is not None:
-            return v
-    return None
-
-
-def _parse_tier(raw: Any) -> Optional[SubscriptionTier]:
-    """Map one NAS ``SubscriptionTierOption`` dict into a :class:`SubscriptionTier`."""
-    if not isinstance(raw, dict):
-        return None
-    tier_id = raw.get("tierId") or raw.get("id")
-    if not tier_id:
-        return None
-    return SubscriptionTier(
-        tier_id=tier_id,
-        name=raw.get("name") or "",
-        tier_order=int(_coalesce(raw.get("tierOrder"), 0)),
-        dollars_per_month=parse_money(raw.get("dollarsPerMonthDisplay")),
-        monthly_credits=parse_money(raw.get("monthlyCredits")),
-        is_current=bool(raw.get("isCurrent")),
-        is_enabled=bool(_coalesce(raw.get("isEnabled"), True)),
-    )
-
-
-def subscription_change_preview_from_payload(
-    payload: dict[str, Any],
-) -> SubscriptionChangePreview:
-    """Map a raw ``/subscription/preview`` JSON dict into :class:`SubscriptionChangePreview`."""
-    effect = payload.get("effect")
-    cents = payload.get("amountDueNowCents")
-    return SubscriptionChangePreview(
-        # An unrecognized/missing effect is treated as ``blocked`` — fail safe, never
-        # charge on a malformed quote.
-        effect=effect if isinstance(effect, str) else "blocked",
-        reason=payload.get("reason") or None,
-        current_tier_id=payload.get("currentTierId"),
-        current_tier_name=payload.get("currentTierName"),
-        target_tier_id=payload.get("targetTierId"),
-        target_tier_name=payload.get("targetTierName"),
-        monthly_credits_delta=parse_money(payload.get("monthlyCreditsDelta")),
-        amount_due_now_cents=int(cents) if isinstance(cents, (int, float)) else None,
-        effective_at=payload.get("effectiveAt") or None,
-    )
-
-
-def subscription_state_from_payload(
-    payload: dict[str, Any], *, portal_url: Optional[str] = None
-) -> SubscriptionState:
-    """Map a raw ``/api/billing/subscription`` JSON dict into :class:`SubscriptionState`."""
-    raw_org = payload.get("org")
-    org: dict[str, Any] = raw_org if isinstance(raw_org, dict) else {}
-
-    raw_context = payload.get("context")
-    context = raw_context if raw_context in ("personal", "team") else "personal"
-
-    raw_tiers = payload.get("tiers")
-    tiers = (
-        tuple(t for t in (_parse_tier(x) for x in raw_tiers) if t is not None)
-        if isinstance(raw_tiers, list)
-        else ()
-    )
-
-    return SubscriptionState(
-        logged_in=True,
-        org_name=org.get("name"),
-        org_id=org.get("id") or None,
-        role=org.get("role"),
-        can_change_plan_raw=(
-            payload.get("canChangePlan")
-            if isinstance(payload.get("canChangePlan"), bool)
-            else None
-        ),
-        context=context,
-        current=_parse_current(payload.get("current")),
-        tiers=tiers,
-        portal_url=portal_url,
-    )
-
-
-# =============================================================================
-# Fail-open builders (the surface front doors)
-# =============================================================================
-
-
-def build_subscription_state(*, timeout: float = 15.0) -> SubscriptionState:
-    """Fetch + parse ``GET /api/billing/subscription``. Fail-open.
-
-    Returns ``SubscriptionState(logged_in=False)`` when not logged in. On a
-    portal/HTTP failure, returns ``logged_in=False`` with ``error`` set so the
-    surface can show a clear message rather than crashing.
-
-    Dev override: when ``HERMES_DEV_SUBSCRIPTION_FIXTURE`` names a fixture state,
-    ``/subscription`` renders from that fixture instead of the real portal — so
-    every plan/cancel/downgrade/team/not-admin state is testable on both
-    the CLI and TUI without a live account. Throwaway scaffolding; see
-    :func:`dev_fixture_subscription_state`.
-    """
-    fixture = dev_fixture_subscription_state()
-    if fixture is not None:
-        return fixture
-
-    try:
-        from hermes_cli.nous_billing import (
-            BillingAuthError,
-            BillingError,
-            _absolutize_portal_url,
-            get_subscription_state,
-            resolve_portal_base_url,
-        )
-    except Exception:
-        return SubscriptionState(logged_in=False, error="billing client unavailable")
-
-    try:
-        payload = get_subscription_state(timeout=timeout)
-    except BillingAuthError:
-        return SubscriptionState(logged_in=False)
-    except BillingError as exc:
-        logger.debug("subscription ▸ /state fetch failed (fail-open)", exc_info=True)
-        return SubscriptionState(logged_in=False, error=str(exc))
-    except Exception:
-        logger.debug("subscription ▸ /state unexpected error (fail-open)", exc_info=True)
-        return SubscriptionState(logged_in=False, error="could not load subscription state")
-
-    raw_portal = payload.get("portalUrl") if isinstance(payload, dict) else None
-    portal_url = _absolutize_portal_url(raw_portal) if raw_portal else None
-    if not portal_url:
-        try:
-            portal_url = resolve_portal_base_url()
-        except Exception:
-            portal_url = None
-
-    return subscription_state_from_payload(payload, portal_url=portal_url)
-
-
-def subscription_manage_url(
-    state: SubscriptionState, tier_id: Optional[str] = None
-) -> Optional[str]:
-    """Build ``{portal_origin}/manage-subscription?org_id=<id>[&plan=<tier_id>]``.
-
-    Mirrors the TUI's ``buildManageUrl`` (``subscription.ts``): the deep-link
-    target is NAS's OWN ``/manage-subscription`` page (NOT the Stripe Billing
-    Portal — decided Jun 23), which routes upgrade→Checkout / downgrade→scheduled
-    internally. ``org_id`` pins the page to the right account in multi-org
-    situations. Returns ``None`` when no portal URL is resolvable.
-
-    ``tier_id`` (the stable ``tiers[]`` id, never a name/slug) is appended as
-    ``plan=`` so the portal preselects the picked plan — only for a NEW
-    subscription / upgrade the user chose. The portal validates it and simply
-    ignores an unknown tier, so the CLI appends unconditionally when a tier was
-    picked (parity with the TUI's ``?plan=``).
-    """
-    from urllib.parse import urlencode, urlsplit, urlunsplit
-
-    if not state.portal_url:
-        return None
-
-    try:
-        parts = urlsplit(state.portal_url)
-    except Exception:
-        return None
-
-    if parts.scheme not in ("http", "https") or not parts.netloc:
-        return None
-
-    from urllib.parse import parse_qsl
-
-    # Preserve unrelated portal query params; org_id / plan are contract-owned
-    # (org_id before plan — insertion order is the emitted query order).
-    params = dict(parse_qsl(parts.query, keep_blank_values=True))
-    params.pop("org_id", None)
-    params.pop("plan", None)
-    if state.org_id:
-        params["org_id"] = state.org_id
-    if tier_id:
-        params["plan"] = tier_id
-    query = urlencode(params)
-    return urlunsplit((parts.scheme, parts.netloc, "/manage-subscription", query, ""))
-
-
-# =============================================================================
-# Shared plan-catalog helpers (consumed by the CLI Free catalog + paid picker)
-# =============================================================================
-
-
-def _format_dollars_grouped(value: Optional[Decimal]) -> str:
-    """``$1,000`` / ``$1,234.50`` — the whole-vs-fractional rule of
-    ``billing_view.format_money`` but thousands-grouped, matching the TUI's
-    ``toLocaleString('en-US')``.
-
-    The shared ``format_money`` is intentionally ungrouped (and asserted so across
-    other surfaces), so plan-catalog rows group locally to mirror the TUI.
-    """
-    if value is None:
-        return "—"
-    if value == value.to_integral_value():
-        return f"${format(value.to_integral_value(), ',f')}"
-    return f"${format(value.quantize(Decimal('0.01')), ',f')}"
-
-
-def selectable_tiers(state: SubscriptionState) -> list[SubscriptionTier]:
-    """Enabled paid tiers other than the current plan, cheapest first.
-
-    One derivation shared by the CLI Free catalog and the paid change picker:
-    ``is_enabled and not is_current and tier_order > 0`` (free / no-sub excluded —
-    dropping to free is a cancellation), sorted by ``tier_order``.
-    """
-    return sorted(
-        (
-            t
-            for t in (state.tiers or ())
-            if t.is_enabled and not t.is_current and (t.tier_order or 0) > 0
-        ),
-        key=lambda t: t.tier_order or 0,
-    )
-
-
-def format_tier_row(tier: SubscriptionTier) -> str:
-    """``name · $X/mo[ · $Y credits/mo]`` — the shared plan-catalog row.
-
-    Mirrors the TUI Free rows (``subscriptionOverlay.tsx``): thousands-grouped
-    money, and the ``$Y credits/mo`` suffix ONLY when monthly credits are present
-    and > 0 (a ``None`` / zero-credits tier hides it — never ``· — credits/mo`` or
-    ``· $0 credits/mo``).
-    """
-    row = f"{tier.name} · {_format_dollars_grouped(tier.dollars_per_month)}/mo"
-    mc = tier.monthly_credits
-    if mc is not None and mc > 0:
-        row += f" · {_format_dollars_grouped(mc)} credits/mo"
-    return row
-
-
-def is_upgrade(state: SubscriptionState, tier_id: str) -> bool:
-    """True when ``tier_id`` ranks above the current plan by ``tier_order``.
-
-    Prefers the active subscription's tier; falls back to the ``tiers[]``
-    ``is_current`` marker (what the picker derives from), else 0 (free).
-    """
-    orders = {t.tier_id: (t.tier_order or 0) for t in (state.tiers or ())}
-    cur_id = state.current.tier_id if state.current else None
-    if cur_id is not None and cur_id in orders:
-        cur_order = orders[cur_id]
-    else:
-        cur_order = next((t.tier_order or 0 for t in (state.tiers or ()) if t.is_current), 0)
-    return orders.get(tier_id, 0) > cur_order
-
-
-# =============================================================================
-# Dev fixtures (throwaway scaffolding — env-var driven, no live portal)
-# =============================================================================
-
-_DEV_FIXTURE_PORTAL = "https://portal.nousresearch.com/billing"
-
-
-def _dev_current(**over: Any) -> CurrentSubscription:
-    base: dict[str, Any] = dict(
-        tier_id="plus",
-        tier_name="Plus",
-        monthly_credits=Decimal("1000"),
-        credits_remaining=Decimal("420"),
-        cycle_ends_at="2026-07-01",
-    )
-    base.update(over)
-    return CurrentSubscription(**base)
-
-
-def _dev_tiers(current_id: Optional[str]) -> tuple[SubscriptionTier, ...]:
-    """A sample plan catalog for fixtures (marks ``current_id`` as the active tier)."""
-    specs = (
-        ("free", "Free", 0, "0", "0"),
-        ("plus", "Plus", 1, "20", "1000"),
-        ("super", "Super", 2, "40", "3000"),
-        ("ultra", "Ultra", 3, "80", "7000"),
-    )
-    return tuple(
-        SubscriptionTier(
-            tier_id=tid,
-            name=name,
-            tier_order=order,
-            dollars_per_month=parse_money(dpm),
-            monthly_credits=parse_money(mc),
-            is_current=(tid == current_id),
-            is_enabled=True,
-        )
-        for tid, name, order, dpm, mc in specs
-    )
-
-
-def dev_fixture_subscription_state() -> Optional[SubscriptionState]:
-    """Return a fixture :class:`SubscriptionState` for ``HERMES_DEV_SUBSCRIPTION_FIXTURE``.
-
-    Lets every CLI/TUI subscription state be exercised without a live portal:
-
-        free | mid | top | not-admin | downgrade | cancel | team |
-        logged-out
-
-    Returns ``None`` when the env var is unset/empty (the real portal path runs).
-    Throwaway scaffolding — mirrors ``HERMES_DEV_CREDITS_FIXTURE``.
-    """
-    name = (os.getenv("HERMES_DEV_SUBSCRIPTION_FIXTURE") or "").strip().lower()
-    if not name:
-        return None
-
-    common = dict(org_name="Acme Inc", org_id="org_acme", role="OWNER", portal_url=_DEV_FIXTURE_PORTAL)
-
-    if name in ("logged-out", "logged_out", "loggedout"):
-        return SubscriptionState(logged_in=False)
-    if name == "free":
-        return SubscriptionState(logged_in=True, current=None, tiers=_dev_tiers(None), **common)
-    if name in ("mid", "mid-tier"):
-        return SubscriptionState(logged_in=True, current=_dev_current(), tiers=_dev_tiers("plus"), **common)
-    if name in ("top", "top-tier"):
-        return SubscriptionState(
-            logged_in=True,
-            current=_dev_current(tier_id="ultra", tier_name="Ultra", monthly_credits=Decimal("7000"), credits_remaining=Decimal("5000")),
-            tiers=_dev_tiers("ultra"),
-            **common,
-        )
-    if name in ("not-admin", "member"):
-        return SubscriptionState(logged_in=True, current=_dev_current(), tiers=_dev_tiers("plus"), **{**common, "role": "MEMBER"})
-    if name == "downgrade":
-        return SubscriptionState(
-            logged_in=True,
-            current=_dev_current(tier_id="super", tier_name="Super", monthly_credits=Decimal("3000"), credits_remaining=Decimal("1500"), pending_downgrade_tier_name="Plus", pending_downgrade_at="2026-07-15"),
-            tiers=_dev_tiers("super"),
-            **common,
-        )
-    if name == "cancel":
-        return SubscriptionState(
-            logged_in=True,
-            current=_dev_current(cancel_at_period_end=True, cancellation_effective_at="2026-07-01"),
-            tiers=_dev_tiers("plus"),
-            **common,
-        )
-    if name == "team":
-        return SubscriptionState(logged_in=True, context="team", current=None, org_name="Acme Engineering", org_id="org_eng", role="OWNER", portal_url=_DEV_FIXTURE_PORTAL)
-
-    # Unknown name → behave as logged-out so the misconfiguration is visible.
-    return SubscriptionState(logged_in=False, error=f"unknown HERMES_DEV_SUBSCRIPTION_FIXTURE: {name}")
-

agent/system_prompt.py

@@ -12,11 +12,9 @@ Three tiers are joined with ``\\n\\n``:
 * ``stable``   — identity (SOUL.md or DEFAULT_AGENT_IDENTITY), tool
   guidance, computer-use guidance, nous subscription block, tool-use
   enforcement guidance + per-model operational guidance, skills prompt,
-  alibaba model-name workaround, environment hints, coding guidance,
-  platform hints.
+  alibaba model-name workaround, environment hints, platform hints.
 * ``context``  — caller-supplied ``system_message`` plus context files
-  (AGENTS.md / .cursorrules / etc.) discovered under ``TERMINAL_CWD``,
-  plus the session's coding-workspace snapshot.
+  (AGENTS.md / .cursorrules / etc.) discovered under ``TERMINAL_CWD``.
 * ``volatile`` — memory snapshot, USER.md profile, external memory
   provider block, timestamp/session/model/provider line.
 
@@ -48,7 +46,6 @@ from agent.prompt_builder import (
     drain_truncation_warnings,
 )
 from agent.runtime_cwd import resolve_context_cwd
-from hermes_constants import get_hermes_home
 from utils import is_truthy_value
 
 
@@ -147,14 +144,14 @@ def _tui_embedded_pane_clarifier(hint: str) -> str:
 
 
 def build_system_prompt_parts(agent: Any, system_message: Optional[str] = None) -> Dict[str, str]:
-    """Assemble the system prompt as three ordered cache tiers.
+    """Assemble the system prompt as three ordered parts.
 
     Returns a dict with three keys:
-      * ``stable``   — the cross-session-stable prefix, through the coding
-        operating brief when a workspace snapshot follows.
-      * ``context``  — the workspace snapshot followed by the remaining
-        session-stable guidance, context files, and caller-supplied
-        system_message.
+      * ``stable``   — identity, tool guidance, skills prompt,
+        environment hints, platform hints, model-family operational
+        guidance.
+      * ``context``  — context files (AGENTS.md, .cursorrules, etc.)
+        and caller-supplied system_message.
       * ``volatile`` — memory snapshot, user profile, external
         memory provider block, timestamp line.
 
@@ -347,35 +344,25 @@ def build_system_prompt_parts(agent: Any, system_message: Optional[str] = None)
         stable_parts.append(_env_hints)
 
     # Coding posture (base Hermes, any interactive coding surface in a code
-    # workspace — see agent/coding_context.py). Keep the operating brief in
-    # the cross-session-stable prefix, while placing the live git/workspace
-    # snapshot behind its own cache boundary. The post-snapshot blocks must
-    # stay in their historical position after the workspace snapshot.
-    coding_workspace_parts: List[str] = []
-    coding_trailing_parts: List[str] = []
+    # workspace — see agent/coding_context.py). The operating brief + the live
+    # git/workspace snapshot are built once here and cached for the session;
+    # the snapshot is never re-probed per turn (that would break the prompt
+    # cache), so the brief tells the model to re-check git before relying on it.
     if agent.valid_tool_names:
         try:
-            from agent.coding_context import coding_system_prompt_parts
+            from agent.coding_context import coding_system_blocks
 
-            coding_prefix_parts, coding_workspace_parts, coding_trailing_parts = coding_system_prompt_parts(
-                platform=agent.platform,
-                cwd=resolve_context_cwd(),
-                model=agent.model,
+            stable_parts.extend(
+                coding_system_blocks(
+                    platform=agent.platform,
+                    cwd=resolve_context_cwd(),
+                    model=agent.model,
+                )
             )
-            stable_parts.extend(coding_prefix_parts)
         except Exception:
             # Coding-context probing must never block prompt build.
             pass
 
-    # Guidance assembled after the coding posture historically followed the
-    # workspace snapshot. With no snapshot, the coding tail instead remains
-    # directly after the coding prefix in the cacheable prefix.
-    if coding_workspace_parts:
-        post_workspace_parts: List[str] = []
-    else:
-        stable_parts.extend(coding_trailing_parts)
-        post_workspace_parts = stable_parts
-
     # Local Python toolchain probe — names python/pip/uv/PEP-668 state when
     # something is non-default so the model can pick the right install
     # strategy without discovering by failure.  Emits a single line; emits
@@ -388,7 +375,7 @@ def build_system_prompt_parts(agent: Any, system_message: Optional[str] = None)
             from tools.env_probe import get_environment_probe_line
             _probe_line = get_environment_probe_line()
             if _probe_line:
-                post_workspace_parts.append(_probe_line)
+                stable_parts.append(_probe_line)
         except Exception:
             # Probe failure must never block prompt build.
             pass
@@ -406,20 +393,20 @@ def build_system_prompt_parts(agent: Any, system_message: Optional[str] = None)
     except Exception:
         active_profile = "default"
     if active_profile == "default":
-        post_workspace_parts.append(
+        stable_parts.append(
             "Active Hermes profile: default. Other profiles (if any) live "
-            "under " + str(get_hermes_home()) + "/profiles/<name>/. Each profile has its own "
+            "under ~/.hermes/profiles/<name>/. Each profile has its own "
             "skills/, plugins/, cron/, and memories/ that affect a different "
             "session than this one. Do not modify another profile's "
             "skills/plugins/cron/memories unless the user explicitly directs "
             "you to."
         )
     else:
-        post_workspace_parts.append(
+        stable_parts.append(
             f"Active Hermes profile: {active_profile}. This session reads "
-            f"and writes {get_hermes_home()}/profiles/{active_profile}/. The default "
-            f"profile's data lives at {get_hermes_home()}/skills/, {get_hermes_home()}/plugins/, "
-            f"{get_hermes_home()}/cron/, {get_hermes_home()}/memories/ — those belong to a "
+            f"and writes ~/.hermes/profiles/{active_profile}/. The default "
+            f"profile's data lives at ~/.hermes/skills/, ~/.hermes/plugins/, "
+            f"~/.hermes/cron/, ~/.hermes/memories/ — those belong to a "
             f"different session run from a different shell. Do NOT modify "
             f"another profile's skills/plugins/cron/memories unless the user "
             f"explicitly directs you to. The cross-profile write guard will "
@@ -461,16 +448,11 @@ def build_system_prompt_parts(agent: Any, system_message: Optional[str] = None)
     if platform_key == "tui" and _effective_hint:
         _effective_hint = _tui_embedded_pane_clarifier(_effective_hint)
     if _effective_hint:
-        post_workspace_parts.append(_effective_hint)
+        stable_parts.append(_effective_hint)
 
     # ── Context tier (cwd-dependent, may change between sessions) ─
     context_parts: List[str] = []
 
-    if coding_workspace_parts:
-        context_parts.extend(coding_workspace_parts)
-        context_parts.extend(coding_trailing_parts)
-        context_parts.extend(post_workspace_parts)
-
     # Note: ephemeral_system_prompt is NOT included here. It's injected at
     # API-call time only so it stays out of the cached/stored system prompt.
     if system_message is not None:
@@ -558,7 +540,6 @@ def build_system_prompt(agent: Any, system_message: Optional[str] = None) -> str
     """
     parts = build_system_prompt_parts(agent, system_message=system_message)
     joined = "\n\n".join(p for p in (parts["stable"], parts["context"], parts["volatile"]) if p)
-    agent._cached_system_prompt_static = parts["stable"]
 
     # Surface context-file truncation warnings through the normal agent status
     # channel so gateway/CLI users see them in chat instead of only in logs.
@@ -575,7 +556,6 @@ def invalidate_system_prompt(agent: Any) -> None:
     so the rebuilt prompt captures any writes from this session.
     """
     agent._cached_system_prompt = None
-    agent._cached_system_prompt_static = None
     if agent._memory_store:
         agent._memory_store.load_from_disk()
 

agent/tool_executor.py

@@ -53,28 +53,6 @@ from tools.budget_config import BudgetConfig, DEFAULT_BUDGET, budget_for_context
 logger = logging.getLogger(__name__)
 
 
-def _ensure_file_checkpoint(
-    agent,
-    function_name: str,
-    function_args: dict,
-    effective_task_id: str,
-) -> None:
-    """Checkpoint the same workspace path that the file tool will mutate."""
-    file_path = function_args.get("path", "")
-    if not file_path:
-        return
-
-    # File tools resolve relative paths against the task's live/session cwd,
-    # which can differ from the Hermes process cwd (notably in Docker).  Resolve
-    # through that same path pipeline before asking the checkpoint manager to
-    # discover the project root.
-    from tools.file_tools import _resolve_path_for_task
-
-    resolved_path = _resolve_path_for_task(file_path, effective_task_id or "default")
-    work_dir = agent._checkpoint_mgr.get_working_dir_for_path(str(resolved_path))
-    agent._checkpoint_mgr.ensure_checkpoint(work_dir, f"before {function_name}")
-
-
 def _budget_for_agent(agent) -> BudgetConfig:
     """Resolve a tool-result BudgetConfig scaled to the agent's context window.
 
@@ -524,12 +502,10 @@ def execute_tool_calls_concurrent(agent, assistant_message, messages: list, effe
             # Checkpoint for file-mutating tools
             if function_name in {"write_file", "patch"} and agent._checkpoint_mgr.enabled:
                 try:
-                    _ensure_file_checkpoint(
-                        agent,
-                        function_name,
-                        function_args,
-                        effective_task_id,
-                    )
+                    file_path = function_args.get("path", "")
+                    if file_path:
+                        work_dir = agent._checkpoint_mgr.get_working_dir_for_path(file_path)
+                        agent._checkpoint_mgr.ensure_checkpoint(work_dir, f"before {function_name}")
                 except Exception:
                     pass
 
@@ -964,8 +940,7 @@ def execute_tool_calls_concurrent(agent, assistant_message, messages: list, effe
                 print(f"  ✅ Tool {i+1} completed in {tool_duration:.2f}s - {response_preview}")
 
         agent._current_tool = None
-        _status_suffix = " (error)" if is_error else ""
-        agent._touch_activity(f"tool completed: {name} ({tool_duration:.1f}s){_status_suffix}")
+        agent._touch_activity(f"tool completed: {name} ({tool_duration:.1f}s)")
 
         if not blocked and agent.tool_complete_callback:
             try:
@@ -1213,12 +1188,12 @@ def execute_tool_calls_sequential(agent, assistant_message, messages: list, effe
         # Checkpoint: snapshot working dir before file-mutating tools
         if not _execution_blocked and function_name in {"write_file", "patch"} and agent._checkpoint_mgr.enabled:
             try:
-                _ensure_file_checkpoint(
-                    agent,
-                    function_name,
-                    function_args,
-                    effective_task_id,
-                )
+                file_path = function_args.get("path", "")
+                if file_path:
+                    work_dir = agent._checkpoint_mgr.get_working_dir_for_path(file_path)
+                    agent._checkpoint_mgr.ensure_checkpoint(
+                        work_dir, f"before {function_name}"
+                    )
             except Exception:
                 pass  # never block tool execution
 
@@ -1656,8 +1631,7 @@ def execute_tool_calls_sequential(agent, assistant_message, messages: list, effe
                 logging.debug(f"Tool progress callback error: {cb_err}")
 
         agent._current_tool = None
-        _status_suffix = " (error)" if _is_error_result else ""
-        agent._touch_activity(f"tool completed: {function_name} ({tool_duration:.1f}s){_status_suffix}")
+        agent._touch_activity(f"tool completed: {function_name} ({tool_duration:.1f}s)")
 
         if agent.verbose_logging:
             logging.debug(f"Tool {function_name} completed in {tool_duration:.2f}s")

agent/tool_guardrails.py

@@ -472,8 +472,4 @@ def _positive_int(value: Any, default: int) -> int:
 
 
 def _sha256(value: str) -> str:
-    # surrogatepass: tool results scraped from the web can carry unpaired
-    # UTF-16 surrogates (e.g. half of a mathematical-bold pair); a strict
-    # encode raises and takes down the whole conversation loop. The hash only
-    # needs deterministic bytes, not valid UTF-8.
-    return hashlib.sha256(value.encode("utf-8", "surrogatepass")).hexdigest()
+    return hashlib.sha256(value.encode("utf-8")).hexdigest()