test(cron): cover cron_list/status/tick/create CLI helpers

Salvaged from #40430; re-verified on main, tightened, tested.

Co-authored-by: xuezhaolan <xuezhaolan@users.noreply.github.com>

.dockerignore

@@ -63,45 +63,3 @@ data/
 # Compose/profile runtime state (bind-mounted; avoid ownership/secret issues)
 hermes-config/
 runtime/
-
-# ---------- Not needed inside the Docker image ----------
-
-# Desktop app source (Tauri/Electron); never installed in the container
-apps/
-
-# Test suite — not shipped in production images
-tests/
-
-# Documentation site (Docusaurus) and supplementary docs
-website/
-docs/
-
-# Assets only used by the GitHub README
-assets/
-infographic/
-
-# Plugin-level docs (hermes-achievements ships docs/ but the runtime doesn't read them)
-plugins/hermes-achievements/docs/
-
-# Nix / Homebrew / AUR packaging metadata — irrelevant to Docker
-nix/
-flake.nix
-flake.lock
-packaging/
-
-# Design and planning documents
-plans/
-.plans/
-
-# ACP registry manifest (icon + agent.json) — not consumed at runtime
-acp_registry/
-
-# Repo-level dotfiles that are git-only or dev-tooling config
-.env.example
-.envrc
-.gitattributes
-.hadolint.yaml
-.mailmap
-
-# Top-level LICENSE (not matched by *.md); not needed inside the container
-LICENSE

.github/workflows/deploy-site.yml

@@ -59,22 +59,12 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          # Rebuild the unified catalog. The file is gitignored, so a fresh
-          # checkout starts without it and we want the freshest crawl in
-          # every deploy.
-          #
-          # This MUST be fatal. build_skills_index.py runs a health check and
-          # exits non-zero WITHOUT writing the output file when a source
-          # collapses (e.g. a GitHub API rate limit zeroes the github /
-          # claude-marketplace / well-known taps all at once). Letting the
-          # deploy continue would either (a) ship a degenerate index missing
-          # whole hubs — the June 2026 regression where OpenAI/Anthropic/
-          # HuggingFace/NVIDIA tabs vanished — or (b) fall through to a
-          # local-only catalog. Failing here keeps the last good deployment
-          # live (GitHub Pages serves the previous build) instead of
-          # publishing a broken catalog. Re-run the workflow once the
-          # transient rate limit clears.
-          python3 scripts/build_skills_index.py
+          # Always rebuild — the file isn't committed (gitignored), so a
+          # fresh checkout starts without it and we want the freshest crawl
+          # in every deploy. Failure is non-fatal: extract-skills.py will
+          # fall back to the legacy snapshot cache and the Skills Hub page
+          # still renders, just without the latest community catalog.
+          python3 scripts/build_skills_index.py || echo "Skills index build failed (non-fatal)"
 
       - name: Extract skill metadata for dashboard
         run: python3 website/scripts/extract-skills.py

.github/workflows/nix-lockfile-fix.yml

@@ -75,10 +75,9 @@ jobs:
         run: |
           set -euo pipefail
 
-          # Ensure only nix/lib.nix (home of the single npmDepsHash) was
-          # modified — prevents accidental self-triggering if fix-lockfiles
-          # ever touches package files.
-          unexpected="$(git diff --name-only | grep -Ev '^nix/lib\.nix$' || true)"
+          # Ensure only nix files were modified — prevents accidental
+          # self-triggering if fix-lockfiles ever touches package files.
+          unexpected="$(git diff --name-only | grep -Ev '^nix/(tui|web)\.nix$' || true)"
           if [ -n "$unexpected" ]; then
             echo "::error::Unexpected modified files: $unexpected"
             exit 1
@@ -90,7 +89,7 @@ jobs:
 
           git config user.name 'github-actions[bot]'
           git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
-          git add nix/lib.nix
+          git add nix/tui.nix nix/web.nix
           git commit -m "fix(nix): auto-refresh npm lockfile hashes" \
             -m "Source: $GITHUB_SHA" \
             -m "Run: $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"
@@ -217,7 +216,7 @@ jobs:
           set -euo pipefail
           git config user.name 'github-actions[bot]'
           git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
-          git add nix/lib.nix
+          git add nix/tui.nix nix/web.nix
           git commit -m "fix(nix): refresh npm lockfile hashes"
           git push
 

.github/workflows/tests.yml

@@ -55,31 +55,15 @@ jobs:
 
       - name: Install uv
         uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86  # v5
-        with:
-          # Persist uv's download/wheel cache (~/.cache/uv) across runs.
-          # Keyed on the dependency manifests, so the cache is reused until
-          # pyproject.toml or uv.lock changes. `uv sync` still runs every
-          # time, but resolves from the warm cache instead of re-downloading
-          # and re-building wheels.
-          enable-cache: true
-          cache-dependency-glob: |
-            pyproject.toml
-            uv.lock
 
       - name: Set up Python 3.11
         run: uv python install 3.11
 
       - name: Install dependencies
-        # `uv sync --locked` installs the exact pinned set from uv.lock (and
-        # fails if the lock is out of sync with pyproject.toml), giving a
-        # reproducible env. It also creates .venv itself, so no separate
-        # `uv venv` step is needed.
-        run: uv sync --locked --python 3.11 --extra all --extra dev
-
-      - name: Minimize uv cache
-        # Optimized for CI: prunes pre-built wheels that are cheap to
-        # re-download, keeping the persisted cache small and fast to restore.
-        run: uv cache prune --ci
+        run: |
+          uv venv .venv --python 3.11
+          source .venv/bin/activate
+          uv pip install -e ".[all,dev]"
 
       - name: Run tests (slice ${{ matrix.slice }}/6)
         # Per-file isolation via scripts/run_tests_parallel.py: discovers
@@ -177,31 +161,15 @@ jobs:
 
       - name: Install uv
         uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86  # v5
-        with:
-          # Persist uv's download/wheel cache (~/.cache/uv) across runs.
-          # Keyed on the dependency manifests, so the cache is reused until
-          # pyproject.toml or uv.lock changes. `uv sync` still runs every
-          # time, but resolves from the warm cache instead of re-downloading
-          # and re-building wheels.
-          enable-cache: true
-          cache-dependency-glob: |
-            pyproject.toml
-            uv.lock
 
       - name: Set up Python 3.11
         run: uv python install 3.11
 
       - name: Install dependencies
-        # `uv sync --locked` installs the exact pinned set from uv.lock (and
-        # fails if the lock is out of sync with pyproject.toml), giving a
-        # reproducible env. It also creates .venv itself, so no separate
-        # `uv venv` step is needed.
-        run: uv sync --locked --python 3.11 --extra all --extra dev
-
-      - name: Minimize uv cache
-        # Optimized for CI: prunes pre-built wheels that are cheap to
-        # re-download, keeping the persisted cache small and fast to restore.
-        run: uv cache prune --ci
+        run: |
+          uv venv .venv --python 3.11
+          source .venv/bin/activate
+          uv pip install -e ".[all,dev]"
 
       - name: Packaged-wheel i18n smoke test
         run: |

.gitignore

@@ -114,12 +114,6 @@ docs/superpowers/*
 # treat it as a local edit and autostash it on every run (#38529).
 .hermes-bootstrap-complete
 
-# Interrupted-update breadcrumb + recovery lock written next to the shared venv
-# by `hermes update` / launch-time self-heal. Runtime state, never a code change
-# — ignore so `git status` stays clean and update's autostash skips them.
-.update-incomplete
-.update-incomplete.lock
-
 # Tool Search live-test harness output — non-deterministic model transcripts,
 # regenerated by scripts/tool_search_livetest.py. Never an artifact of the repo.
 scripts/out/

AGENTS.md

@@ -4,201 +4,6 @@ Instructions for AI coding assistants and developers working on the hermes-agent
 
 **Never give up on the right solution.**
 
-## What Hermes Is
-
-Hermes is a personal AI agent that runs the same agent core across a CLI, a
-messaging gateway (Telegram, Discord, Slack, and ~20 other platforms), a TUI,
-and an Electron desktop app. It learns across sessions (memory + skills),
-delegates to subagents, runs scheduled jobs, and drives a real terminal and
-browser. It is extended primarily through **plugins and skills**, not by
-growing the core.
-
-Two properties shape almost every design decision and are the lens for
-reviewing any change:
-
-- **Per-conversation prompt caching is sacred.** A long-lived conversation
-  reuses a cached prefix every turn. Anything that mutates past context,
-  swaps toolsets, or rebuilds the system prompt mid-conversation invalidates
-  that cache and multiplies the user's cost. We do not do it (the one
-  exception is context compression).
-- **The core is a narrow waist; capability lives at the edges.** Every model
-  tool we add is sent on every API call, so the bar for a new *core* tool is
-  high. Most new capability should arrive as a CLI command + skill, a
-  service-gated tool, or a plugin — not as core surface.
-
-## Contribution Rubric — What We Want / What We Don't
-
-This is the project's intent layer. Use it two ways:
-
-1. **For humans and for your own work** — what gets merged and what gets
-   rejected, so a contribution aims at the target.
-2. **For automated review (the triage sweeper)** — guidance on when a PR is
-   safe to close on the three allowed reasons (`implemented_on_main`,
-   `cannot_reproduce`, `incoherent`) and, just as important, **when NOT to
-   close** one. Taste-based "we don't want this / out of scope" closes are NOT
-   an automated decision — those stay with a human maintainer. The sweeper's
-   job here is to recognize design intent and *avoid wrongly closing a
-   legitimate contribution*, not to make the won't-implement call itself.
-
-Read the balance right: Hermes ships a **lot** — most merges are bug fixes to
-real reported behavior, and the product surface (platforms, channels,
-providers, models, desktop/TUI features) expands aggressively and on purpose.
-The restraint below is aimed squarely at the **core agent + the model tool
-schema**, the one place where every addition is paid for on every API call.
-"Smallest footprint" governs *how a capability is wired into the core*, NOT
-whether the product is allowed to grow. We are expansive at the edges and
-conservative at the waist.
-
-### What we want
-
-- **Fix real bugs, well.** The bulk of what lands is `fix(...)` against an
-  actual reported symptom. A good fix reproduces the symptom on current
-  `main`, points to the exact line where it manifests, and fixes the whole bug
-  class — sibling call paths included — not just the one site the reporter hit.
-- **Expand reach at the edges.** New platform adapters, channels, providers,
-  models, and desktop/TUI/dashboard features are welcome and land routinely,
-  including large ones (a new messaging channel, a session-cap feature, a
-  Windows PTY bridge). Breadth in the product is a goal, not a footprint
-  concern — as long as it integrates with the existing setup/config UX
-  (`hermes tools`, `hermes setup`, auto-install) rather than bolting on a raw
-  env var.
-- **Refactor god-files into clean modules.** Extracting a multi-thousand-line
-  cluster out of `cli.py` / `run_agent.py` / `gateway/run.py` into a focused
-  mixin or module is wanted work, even when the diff is huge and mechanical
-  (large `+N/-N` refactors merge regularly). The "every line traces to the
-  request" test applies to *feature* PRs; a declared refactor's request IS the
-  extraction.
-- **Keep the core narrow.** New *model tools* are the expensive exception —
-  every tool ships on every API call. Prefer, in order: extend existing code →
-  CLI command + skill → service-gated tool (`check_fn`) → plugin → MCP server
-  in the catalog → new core tool (last resort). See "The Footprint Ladder."
-- **Extend, don't duplicate.** Before adding a module/manager/hook, check
-  whether existing infrastructure already covers the use case. When several PRs
-  integrate the same *category*, design one shared interface instead of merging
-  them one at a time (see the ABC + orchestrator note under the Footprint
-  Ladder).
-- **Behavior contracts over snapshots.** Tests should assert how two pieces of
-  data must relate (invariants), not freeze a current value (model lists,
-  config version literals, enumeration counts). See "Don't write
-  change-detector tests."
-- **E2E validation, not just green unit mocks.** For anything touching
-  resolution chains, config propagation, security boundaries, remote
-  backends, or file/network I/O, exercise the real path with real imports
-  against a temp `HERMES_HOME`. Mocks hide integration bugs.
-- **Cache-, alternation-, and invariant-safe.** Preserve prompt caching, strict
-  message role alternation (never two same-role messages in a row; never a
-  synthetic user message injected mid-loop), and a system prompt that is
-  byte-stable for the life of a conversation.
-- **Contributor credit preserved.** Salvage external work by cherry-picking
-  (rebase-merge) so authorship survives in git history; don't reimplement from
-  scratch when you can build on top.
-
-### What we don't want (rejected even when well-built)
-
-- **Speculative infrastructure.** Hooks, callbacks, or extension points with no
-  concrete consumer. Adding a hook is easy; removing one after plugins depend
-  on it is hard. A hook is NOT speculative if a contributor has a real, stated
-  use case — even if the consumer ships separately.
-- **New `HERMES_*` env vars for non-secret config.** `.env` is for secrets
-  only (API keys, tokens, passwords). All behavioral settings — timeouts,
-  thresholds, feature flags, display prefs — go in `config.yaml`. Bridge to an
-  internal env var if the mechanism needs one, but user-facing docs point to
-  `config.yaml`. Reject PRs that tell users to "set X in your .env" unless X
-  is a credential.
-- **A new core tool when terminal + file already do the job, or when a skill
-  would.** If the only barrier is file visibility on a remote backend, fix the
-  mount, not the toolset.
-- **Lazy-reading escape hatches on instructional tools.** No `offset`/`limit`
-  pagination on tools that load content the agent must read fully (skills,
-  prompts, playbooks). Models will read page 1 and skip the rest.
-- **"Fixes" that destroy the feature they secure.** A mitigation that kills the
-  feature's purpose is the wrong mitigation. Read the original commit's intent
-  (`git log -p -S`) before restricting behavior; find a fix that preserves the
-  feature.
-- **Outbound telemetry / usage attribution without opt-in gating.** No new
-  analytics, third-party identifier tagging, or attribution tags until a
-  generic user-facing opt-in (config gate + setup prompt + `hermes tools`
-  toggle) exists. Park behind a label, do not merge.
-- **Change-detector tests, cache-breaking mid-conversation, dead code wired in
-  without E2E proof, and plugins that touch core files.** Plugins live in their
-  own directory and work within the ABCs/hooks we provide; if a plugin needs
-  more, widen the generic plugin surface, don't special-case it in core.
-
-### Before you call it a bug — verify the premise (and when NOT to close)
-
-The most common reason a well-written PR gets closed is not code quality — it
-is that the change is built on a **wrong premise**, or it treats an
-**intentional design as a gap**. These patterns cut both ways: they tell a
-human reviewer what to scrutinize, and they tell the automated sweeper when a
-PR is NOT safe to close as `implemented_on_main` / `cannot_reproduce` (when in
-doubt, leave it open for a human). They are distilled from real closes.
-
-- **"Intentional design, not a gap."** A limitation that looks like an
-  oversight is often deliberate. Before "fixing" a missing link or a
-  restriction, ask whether the isolation IS the design. Example: profiles are
-  independent islands on purpose — a PR adding live config inheritance from the
-  default profile was closed because coupling profiles together is exactly what
-  the design prevents (the copy-at-creation `--clone` path already covers the
-  legitimate "start from my default" case). Read the original commit's intent
-  (`git log -p -S "<symbol>"`) before assuming something is unfinished.
-- **"The premise doesn't hold against how X actually works."** A PR's
-  justification frequently rests on a wrong mental model of an existing
-  mechanism. Trace the real code/runtime before accepting the rationale. Two
-  real closes: a rate-limit "re-probe during cooldown" PR (the breaker only
-  trips on a *confirmed-empty* account bucket, so re-probing just hammers a
-  bucket we've already proven empty); a usage-accumulation fix whose new branch
-  **never executes at runtime** because an earlier guard already popped the
-  state it depended on. If you can't point to the exact line where the bug
-  manifests AND show the fix changes that line's behavior, you haven't verified
-  the premise.
-- **"This fix was wrong — the absence/omission was deliberate."** Adding the
-  obvious-looking missing piece can break things the omission was protecting.
-  Example: restoring "missing" `__init__.py` files made a test tree importable
-  as a dotted package that shadowed the real plugin, deleting its `register()`
-  at import time. The absence was load-bearing.
-- **"Overreached / resurrected an approach we'd moved past."** Scope creep that
-  supersedes an agreed-on base, or revives a direction the maintainers
-  deliberately closed, gets rejected even when the code works. Keep the change
-  to the narrow piece that was actually agreed; offer the rest as a focused
-  follow-up.
-
-The throughline: **verify the claim AND the intent against the codebase before
-writing or merging a fix.** A confirmed reproduction on current `main` plus a
-line-level account of where the fix acts beats a plausible-sounding rationale
-every time. When in doubt about intent, it is cheaper to ask than to ship a
-fix that fights the design.
-
-### The Footprint Ladder (new capability decision)
-
-Each rung adds more permanent surface than the one above. Choose the highest
-(least-footprint) rung that correctly solves the problem:
-
-1. **Extend existing code** — the capability is a variation of something that
-   already exists. Zero new surface.
-2. **CLI command + skill** — manages config/state/infra expressible as shell
-   commands. The agent runs `hermes <subcommand>` guided by a skill. Zero
-   model-tool footprint. Default choice for subscriptions, scheduled tasks,
-   service setup. Examples: `hermes webhook`, `hermes cron`, `hermes tools`.
-3. **Service-gated tool (`check_fn`)** — needs structured params/returns AND
-   only appears when a prerequisite is configured. Zero footprint otherwise.
-   Examples: Home Assistant tools (gated on token), memory-provider tools.
-4. **Plugin** — third-party/niche/user-specific capability that doesn't ship in
-   core. Lives in `~/.hermes/plugins/` or a pip package, discovered at runtime.
-5. **MCP server (in the catalog)** — if the capability genuinely needs to be a
-   tool (structured I/O the agent invokes) but isn't core-fundamental, prefer
-   building it as an MCP server and adding it to the MCP catalog over growing
-   the core toolset. The agent connects to it through the built-in MCP client;
-   zero permanent core-schema footprint, and it's reusable by any MCP host.
-6. **New core tool** — only when the capability is fundamental, broadly useful
-   to nearly every user, and unreachable via terminal + file (or an MCP server).
-   Examples of correct core tools: terminal, read_file, web_search,
-   browser_navigate.
-
-When 3+ open PRs try to integrate the same *category* of thing (memory
-backends, providers, notifiers), don't merge them one at a time — design an
-ABC + orchestrator, wrap the existing built-in as the first provider, and turn
-the competing PRs into plugins against that interface.
-
 ## Development Environment
 
 ```bash
@@ -497,11 +302,9 @@ A **separate** chat surface from both the classic CLI and the dashboard's embedd
 
 ## Adding New Tools
 
-Before adding any tool, settle the footprint question first (see "The
-Footprint Ladder" in the Contribution Rubric): most capabilities should NOT
-be core tools. For custom or local-only tools, do **not** edit Hermes core.
-Use the plugin route instead: create `~/.hermes/plugins/<name>/plugin.yaml`
-and `~/.hermes/plugins/<name>/__init__.py`, then register tools with
+For most custom or local-only tools, do **not** edit Hermes core. Use the plugin
+route instead: create `~/.hermes/plugins/<name>/plugin.yaml` and
+`~/.hermes/plugins/<name>/__init__.py`, then register tools with
 `ctx.register_tool(...)`. Plugin toolsets are discovered automatically and can be
 enabled or disabled without touching `tools/` or `toolsets.py`.
 

Dockerfile

@@ -25,7 +25,7 @@ ENV PLAYWRIGHT_BROWSERS_PATH=/opt/hermes/.playwright
 # hermes process, the dashboard, and per-profile gateways.
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
-    ca-certificates curl iputils-ping python3 python-is-python3 ripgrep ffmpeg gcc g++ make cmake python3-dev python3-venv libffi-dev libolm-dev procps git openssh-client docker-cli xz-utils && \
+    ca-certificates curl iputils-ping python3 python-is-python3 ripgrep ffmpeg gcc python3-dev python3-venv libffi-dev libolm-dev procps git openssh-client docker-cli xz-utils && \
     rm -rf /var/lib/apt/lists/*
 
 # ---------- s6-overlay install ----------
@@ -146,9 +146,9 @@ RUN npm install --prefer-offline --no-audit && \
 #
 # `uv sync --frozen --no-install-project --extra all --extra messaging`
 # installs the deps reachable through the composite `[all]` extra
-# (handpicked set intended for the production image — excludes `[dev]`),
-# plus gateway messaging adapters that should work in the published image
-# without a first-boot lazy install.  We do NOT use `--all-extras`:
+# (handpicked set intended for the production image), plus gateway
+# messaging adapters that should work in the published image without a
+# first-boot lazy install.  We do NOT use `--all-extras`:
 # that would pull in `[rl]` (atroposlib + tinker + torch + wandb from
 # git), `[yc-bench]` (another git dep), and `[termux-all]` (Android
 # redundancy), none of which belong in the published container.
@@ -164,30 +164,19 @@ RUN npm install --prefer-offline --no-audit && \
 # image update and recall/retain then fails with
 # `ModuleNotFoundError: No module named 'hindsight_client'` (#38128).
 #
-# The Matrix gateway's deps ([matrix] extra) are baked in because
-# python-olm (transitive via mautrix[encryption]) builds from source on
-# Python/image combinations without usable wheels.  The Docker image is
-# Linux-only, so keeping the native libolm/build-toolchain packages here
-# avoids the cross-platform failures that kept [matrix] out of [all]
-# while still making Matrix work in the published container. Fixes #30399.
-#
 # The editable link is created after the source copy below.
 COPY pyproject.toml uv.lock ./
 RUN touch ./README.md
-RUN uv sync --frozen --no-install-project --extra all --extra messaging --extra anthropic --extra bedrock --extra azure-identity --extra hindsight --extra matrix
-
-# ---------- Frontend build (cached independently from Python source) ----------
-# Copy only the frontend source trees first so that Python-only changes don't
-# invalidate the (relatively slow) web + ui-tui build layer.
-COPY web/ web/
-COPY ui-tui/ ui-tui/
-RUN cd web && npm run build && \
-    cd ../ui-tui && npm run build
+RUN uv sync --frozen --no-install-project --extra all --extra messaging --extra anthropic --extra bedrock --extra azure-identity --extra hindsight
 
 # ---------- Source code ----------
 # .dockerignore excludes node_modules, so the installs above survive.
 COPY --chown=hermes:hermes . .
 
+# Build browser dashboard and terminal UI assets.
+RUN cd web && npm run build && \
+    cd ../ui-tui && npm run build
+
 # ---------- Permissions ----------
 # Make install dir world-readable so any HERMES_UID can read it at runtime.
 # The venv needs to be traversable too.

MANIFEST.in

@@ -1,6 +1,5 @@
 graft skills
 graft optional-skills
-graft optional-mcps
 graft locales
 # Bundled plugin manifests (plugin.yaml / plugin.yml). Without these the
 # PluginManager scan (hermes_cli/plugins.py) finds zero plugins on installs

README.md

@@ -3,16 +3,13 @@
 </p>
 
 # Hermes Agent ☤
-<p align="center">
-  <a href="https://hermes-agent.nousresearch.com/">Hermes Agent</a> | <a href="https://hermes-agent.nousresearch.com/">Hermes Desktop</a>
-</p>
+
 <p align="center">
   <a href="https://hermes-agent.nousresearch.com/docs/"><img src="https://img.shields.io/badge/Docs-hermes--agent.nousresearch.com-FFD700?style=for-the-badge" alt="Documentation"></a>
   <a href="https://discord.gg/NousResearch"><img src="https://img.shields.io/badge/Discord-5865F2?style=for-the-badge&logo=discord&logoColor=white" alt="Discord"></a>
   <a href="https://github.com/NousResearch/hermes-agent/blob/main/LICENSE"><img src="https://img.shields.io/badge/License-MIT-green?style=for-the-badge" alt="License: MIT"></a>
   <a href="https://nousresearch.com"><img src="https://img.shields.io/badge/Built%20by-Nous%20Research-blueviolet?style=for-the-badge" alt="Built by Nous Research"></a>
   <a href="README.zh-CN.md"><img src="https://img.shields.io/badge/Lang-中文-red?style=for-the-badge" alt="中文"></a>
-  <a href="README.ur-pk.md"><img src="https://img.shields.io/badge/Lang-اردو-green?style=for-the-badge" alt="اردو"></a>
 </p>
 
 **The self-improving AI agent built by [Nous Research](https://nousresearch.com).** It's the only agent with a built-in learning loop — it creates skills from experience, improves them during use, nudges itself to persist knowledge, searches its own past conversations, and builds a deepening model of who you are across sessions. Run it on a $5 VPS, a GPU cluster, or serverless infrastructure that costs nearly nothing when idle. It's not tied to your laptop — talk to it from Telegram while it works on a cloud VM.
@@ -55,7 +52,7 @@ If you already have Git installed, the installer detects it and uses that instea
 
 > **Android / Termux:** The tested manual path is documented in the [Termux guide](https://hermes-agent.nousresearch.com/docs/getting-started/termux). On Termux, Hermes installs a curated `.[termux]` extra because the full `.[all]` extra currently pulls Android-incompatible voice dependencies.
 >
-> **Windows:** Native Windows is fully supported — the PowerShell one-liner above installs everything. If you'd rather use WSL2, the Linux command works there too. Native Windows install lives under `%LOCALAPPDATA%\hermes`; WSL2 installs under `~/.hermes` as on Linux.
+> **Windows:** Native Windows is fully supported — the PowerShell one-liner above installs everything. If you'd rather use WSL2, the Linux command works there too. Native Windows install lives under `%LOCALAPPDATA%\hermes`; WSL2 installs under `~/.hermes` as on Linux. The only Hermes feature that currently needs WSL2 specifically is the browser-based dashboard chat pane (it uses a POSIX PTY — classic CLI and gateway both run natively).
 
 After installation:
 

README.ur-pk.md

@@ -1,261 +0,0 @@
-<div dir="rtl">
-
-<p align="center">
-  <img src="assets/banner.png" alt="Hermes Agent" width="100%">
-</p>
-
-# ہرمیس ایجنٹ ☤ (Hermes Agent)
-
-<p align="center">
-  <a href="https://hermes-agent.nousresearch.com/docs/"><img src="https://img.shields.io/badge/Docs-hermes--agent.nousresearch.com-FFD700?style=for-the-badge" alt="Documentation"></a>
-  <a href="https://discord.gg/NousResearch"><img src="https://img.shields.io/badge/Discord-5865F2?style=for-the-badge&logo=discord&logoColor=white" alt="Discord"></a>
-  <a href="https://github.com/NousResearch/hermes-agent/blob/main/LICENSE"><img src="https://img.shields.io/badge/License-MIT-green?style=for-the-badge" alt="License: MIT"></a>
-  <a href="https://nousresearch.com"><img src="https://img.shields.io/badge/Built%20by-Nous%20Research-blueviolet?style=for-the-badge" alt="Built by Nous Research"></a>
-  <a href="README.md"><img src="https://img.shields.io/badge/Lang-English-lightgrey?style=for-the-badge" alt="English"></a>
-  <a href="README.zh-CN.md"><img src="https://img.shields.io/badge/Lang-中文-red?style=for-the-badge" alt="中文"></a>
-</p>
-
-**[نوس ریسرچ (Nous Research)](https://nousresearch.com) کا تیار کردہ خود کو بہتر بنانے والا اے آئی (AI) ایجنٹ۔** یہ واحد ایجنٹ ہے جس میں سیکھنے کا عمل (learning loop) پہلے سے موجود ہے — یہ اپنے تجربات سے نئی مہارتیں (skills) بناتا ہے، استعمال کے دوران ان کو بہتر کرتا ہے، معلومات کو محفوظ رکھنے کے لیے خود کو یاد دہانی کرواتا ہے، اپنی پرانی بات چیت کو تلاش کر سکتا ہے، اور مختلف سیشنز کے دوران آپ کے بارے میں ایک گہری سمجھ پیدا کرتا ہے۔ اسے $5 والے VPS پر چلائیں، GPU کلسٹر پر، یا سرور لیس (serverless) انفراسٹرکچر پر جس کی قیمت استعمال نہ ہونے پر تقریباً صفر ہے۔ یہ آپ کے لیپ ٹاپ تک محدود نہیں ہے — آپ ٹیلی گرام (Telegram) سے اس کے ساتھ بات چیت کر سکتے ہیں جبکہ یہ کلاؤڈ VM پر کام کر رہا ہو۔
-
-آپ اپنی مرضی کا کوئی بھی ماڈل استعمال کر سکتے ہیں — [Nous Portal](https://portal.nousresearch.com)، [OpenRouter](https://openrouter.ai) (200 سے زائد ماڈلز)، [NovitaAI](https://novita.ai) (ماڈل API، ایجنٹ سینڈ باکس، اور GPU کلاؤڈ کے لیے اے آئی مقامی کلاؤڈ)، [NVIDIA NIM](https://build.nvidia.com) (Nemotron)، [Xiaomi MiMo](https://platform.xiaomimimo.com)، [z.ai/GLM](https://z.ai)، [Kimi/Moonshot](https://platform.moonshot.ai)، [MiniMax](https://www.minimax.io)، [Hugging Face](https://huggingface.co)، OpenAI، یا اپنا حسب ضرورت اینڈ پوائنٹ (endpoint) استعمال کریں۔ ماڈل تبدیل کرنے کے لیے صرف `hermes model` استعمال کریں — کسی کوڈ کو تبدیل کرنے کی ضرورت نہیں، کوئی پابندی نہیں۔
-
-<table>
-<tr><td><b>حقیقی ٹرمینل انٹرفیس</b></td><td>مکمل TUI جس میں ملٹی لائن ایڈیٹنگ، سلیش-کمانڈ آٹو کمپلیٹ، بات چیت کی ہسٹری، انٹرپٹ اور ری ڈائریکٹ، اور سٹریمنگ ٹول آؤٹ پٹ شامل ہے۔</td></tr>
-<tr><td><b>یہ وہاں موجود ہے جہاں آپ ہیں</b></td><td>ٹیلی گرام، ڈسکارڈ (Discord)، سلیک (Slack)، واٹس ایپ (WhatsApp)، سگنل (Signal)، اور CLI — سب ایک ہی گیٹ وے پروسیس سے کام کرتے ہیں۔ وائس میمو (Voice memo) ٹرانسکرپشن، کراس پلیٹ فارم بات چیت کا تسلسل۔</td></tr>
-<tr><td><b>سیکھنے کا ایک مکمل عمل</b></td><td>ایجنٹ کی اپنی ترتیب دی گئی میموری، جس میں وہ خود کو وقتاً فوقتاً یاد دہانی کرواتا ہے۔ پیچیدہ کاموں کے بعد خود کار طریقے سے مہارت (skill) کی تخلیق۔ استعمال کے دوران مہارتوں میں بہتری۔ LLM سمرائزیشن کے ساتھ FTS5 سیشن سرچ تاکہ پرانے سیشنز کی یاددہانی کی جا سکے۔ <a href="https://github.com/plastic-labs/honcho">Honcho</a> کے ذریعے صارف کی ماڈلنگ۔ <a href="https://agentskills.io">agentskills.io</a> اوپن سٹینڈرڈ کے ساتھ مکمل مطابقت۔</td></tr>
-<tr><td><b>شیڈول کی گئی خودکار کارروائیاں</b></td><td>بلٹ ان (Built-in) کرون (cron) شیڈیولر جو کسی بھی پلیٹ فارم پر ڈیلیوری کے لیے استعمال ہو سکتا ہے۔ روزانہ کی رپورٹس، رات کے بیک اپس، ہفتہ وار آڈٹس — یہ سب کچھ قدرتی زبان (natural language) میں اور بغیر کسی نگرانی کے کام کرتا ہے۔</td></tr>
-<tr><td><b>کام کی تقسیم اور متوازی عمل</b></td><td>متوازی (parallel) کاموں کے لیے الگ سے ذیلی ایجنٹس (subagents) بنائیں۔ پائتھون (Python) سکرپٹس لکھیں جو RPC کے ذریعے ٹولز کو استعمال کریں، تاکہ کئی مراحل پر مشتمل کاموں کو بغیر کسی سیاق و سباق (context) کے خرچ کے، ایک ہی باری میں انجام دیا جا سکے۔</td></tr>
-<tr><td><b>کہیں بھی چلائیں، صرف اپنے لیپ ٹاپ پر نہیں</b></td><td>چھ (Six) ٹرمینل بیک اینڈز — لوکل، Docker، SSH، Singularity، Modal، اور Daytona۔ ڈیٹونا (Daytona) اور موڈل (Modal) سرور لیس (serverless) فعالیت پیش کرتے ہیں — جب آپ کا ایجنٹ فارغ ہوتا ہے تو اس کا ماحول سلیپ (hibernate) ہو جاتا ہے اور ضرورت پڑنے پر خود بخود جاگ جاتا ہے، جس کی وجہ سے سیشنز کے درمیان لاگت تقریباً صفر رہتی ہے۔ اسے $5 والے VPS یا GPU کلسٹر پر چلائیں۔</td></tr>
-<tr><td><b>تحقیق کے لیے تیار</b></td><td>بیچ (Batch) ٹریجیکٹری (trajectory) جنریشن، اگلی نسل کے ٹول کالنگ ماڈلز کی تربیت کے لیے ٹریجیکٹری کمپریشن۔</td></tr>
-</table>
-
----
-
-## فوری انسٹالیشن (Quick Install)
-
-### لینکس (Linux)، میک او ایس (macOS)، ڈبلیو ایس ایل ٹو (WSL2)، ٹرمکس (Termux)
-
-<div dir="ltr">
-
-```bash
-curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash
-```
-
-</div>
-
-### ونڈوز (نیٹو، پاور شیل)
-
-> **توجہ فرمائیں:** مقامی ونڈوز (Native Windows) پر ہرمیس بغیر WSL کے چلتا ہے — CLI، گیٹ وے، TUI، اور ٹولز سب مقامی طور پر کام کرتے ہیں۔ اگر آپ WSL2 استعمال کرنا پسند کرتے ہیں، تو اوپر دی گئی لینکس/میک او ایس کی کمانڈ وہاں بھی کام کرے گی۔ کوئی مسئلہ نظر آیا؟ براہ کرم [مسائل (issues) درج کریں](https://github.com/NousResearch/hermes-agent/issues)۔
-
-اسے پاور شیل (PowerShell) میں چلائیں:
-
-<div dir="ltr">
-
-```powershell
-iex (irm https://hermes-agent.nousresearch.com/install.ps1)
-```
-
-</div>
-
-انسٹالر سب کچھ خود سنبھالتا ہے: uv، Python 3.11، Node.js، ripgrep، ffmpeg، **اور ایک پورٹ ایبل (portable) گٹ بیش (Git Bash)** (یعنی MinGit، جو `%LOCALAPPDATA%\hermes\git` میں ان پیک ہوتا ہے — اس کے لیے ایڈمن کی اجازت درکار نہیں، اور یہ سسٹم کے کسی بھی گٹ انسٹال سے بالکل الگ ہے)۔ ہرمیس اس بنڈل شدہ گٹ بیش کو شیل کمانڈز چلانے کے لیے استعمال کرتا ہے۔
-
-اگر آپ کے پاس پہلے سے گٹ (Git) انسٹال ہے، تو انسٹالر اسے شناخت کر لیتا ہے اور اسے ہی استعمال کرتا ہے۔ بصورت دیگر آپ کو صرف ~45MB کے MinGit ڈاؤنلوڈ کی ضرورت ہوگی — یہ آپ کے سسٹم کے گٹ پر کوئی اثر نہیں ڈالے گا۔
-
-> **اینڈرائیڈ (Android) / ٹرمکس (Termux):** ٹیسٹ کیا گیا مینوئل طریقہ [Termux گائیڈ](https://hermes-agent.nousresearch.com/docs/getting-started/termux) میں موجود ہے۔ ٹرمکس پر ہرمیس ایک مخصوص `.[termux]` ایکسٹرا انسٹال کرتا ہے کیونکہ مکمل `.[all]` ایکسٹرا میں ایسی وائس ڈیپینڈینسیز شامل ہیں جو اینڈرائیڈ کے ساتھ مطابقت نہیں رکھتیں۔
->
-> **ونڈوز (Windows):** مقامی ونڈوز کی مکمل سپورٹ موجود ہے — اوپر دی گئی پاور شیل کی کمانڈ سب کچھ انسٹال کر دیتی ہے۔ اگر آپ WSL2 استعمال کرنا چاہتے ہیں، تو لینکس کی کمانڈ وہاں کام کرتی ہے۔ مقامی ونڈوز میں انسٹالیشن `%LOCALAPPDATA%\hermes` میں ہوتی ہے؛ جبکہ WSL2 میں لینکس کی طرح `~/.hermes` میں ہوتی ہے۔ ہرمیس کا وہ واحد فیچر جسے فی الحال خاص طور پر WSL2 کی ضرورت ہے وہ براؤزر پر مبنی ڈیش بورڈ چیٹ پین ہے (یہ POSIX PTY استعمال کرتا ہے — کلاسک CLI اور گیٹ وے دونوں مقامی طور پر چلتے ہیں)۔
-
-انسٹالیشن کے بعد:
-
-<div dir="ltr">
-
-```bash
-source ~/.bashrc    # شیل کو ری لوڈ کریں (یا: source ~/.zshrc)
-hermes              # بات چیت شروع کریں!
-```
-
-</div>
-
----
-
-## آغاز کریں (Getting Started)
-
-<div dir="ltr">
-
-```bash
-hermes              # انٹرایکٹو CLI — بات چیت شروع کریں
-hermes model        # اپنا LLM پرووائیڈر اور ماڈل منتخب کریں
-hermes tools        # کنفیگر کریں کہ کون سے ٹولز ایکٹو ہیں
-hermes config set   # انفرادی کنفگ (config) ویلیوز سیٹ کریں
-hermes gateway      # میسجنگ گیٹ وے شروع کریں (ٹیلی گرام، ڈسکارڈ، وغیرہ)
-hermes setup        # مکمل سیٹ اپ وزرڈ چلائیں (یہ سب کچھ ایک ساتھ کنفیگر کر دے گا)
-hermes claw migrate # OpenClaw سے مائیگریٹ کریں (اگر آپ OpenClaw سے آ رہے ہیں)
-hermes update       # لیٹسٹ ورژن پر اپ ڈیٹ کریں
-hermes doctor       # کسی بھی مسئلے کی تشخیص کریں
-```
-
-</div>
-
-📖 **[مکمل دستاویزات →](https://hermes-agent.nousresearch.com/docs/)**
-
----
-
-## API-کیز اکٹھی کرنے سے بچیں — Nous Portal
-
-ہرمیس آپ کے پسندیدہ پرووائیڈر کے ساتھ کام کرتا ہے — یہ چیز تبدیل نہیں ہو رہی۔ لیکن اگر آپ ماڈل، ویب سرچ، امیج جنریشن، TTS، اور کلاؤڈ براؤزر کے لیے پانچ الگ الگ API کیز جمع نہیں کرنا چاہتے، تو **[Nous Portal](https://portal.nousresearch.com)** ان سب کو ایک ہی سبسکرپشن کے تحت کور کرتا ہے:
-
-- **300+ ماڈلز** — ان میں سے کوئی بھی ماڈل `/model <name>` کے ذریعے منتخب کریں
-- **ٹول گیٹ وے (Tool Gateway)** — ویب سرچ (Firecrawl)، امیج جنریشن (FAL)، ٹیکسٹ ٹو سپیچ (OpenAI)، کلاؤڈ براؤزر (Browser Use)، یہ سب آپ کی سبسکرپشن کے ذریعے چلتے ہیں۔ کسی اضافی اکاؤنٹ کی ضرورت نہیں۔
-
-نئی انسٹالیشن کے بعد بس ایک کمانڈ کی ضرورت ہے:
-
-<div dir="ltr">
-
-```bash
-hermes setup --portal
-```
-
-</div>
-
-یہ آپ کو OAuth کے ذریعے لاگ ان کرواتا ہے، Nous کو آپ کا پرووائیڈر مقرر کرتا ہے، اور ٹول گیٹ وے کو آن کر دیتا ہے۔ `hermes portal info` کمانڈ استعمال کر کے آپ کسی بھی وقت چیک کر سکتے ہیں کہ کون کون سی سروسز منسلک ہیں۔ مکمل تفصیلات [Tool Gateway دستاویزات کے صفحے](https://hermes-agent.nousresearch.com/docs/user-guide/features/tool-gateway) پر موجود ہیں۔
-
-آپ اب بھی کسی بھی ٹول کے لیے اپنی مرضی کی API کیز استعمال کر سکتے ہیں — گیٹ وے ہر سروس کے لیے الگ الگ کام کرتا ہے، ایسا نہیں کہ یا تو سب کچھ استعمال کریں یا کچھ بھی نہیں۔
-
----
-
-## CLI بمقابلہ میسجنگ فوری حوالہ
-
-ہرمیس کے دو بنیادی انٹر فیس ہیں: آپ ٹرمینل UI کو `hermes` کے ساتھ شروع کریں، یا گیٹ وے چلا کر اس کے ساتھ ٹیلی گرام، ڈسکارڈ، سلیک، واٹس ایپ، سگنل، یا ای میل کے ذریعے بات کریں۔ جب آپ کسی بات چیت میں ہوتے ہیں، تو بہت سی سلیش (slash) کمانڈز دونوں انٹرفیسز میں ایک جیسی ہوتی ہیں۔
-
-<div dir="ltr">
-
-| کارروائی (Action)                         | سی ایل آئی (CLI)                              | میسجنگ پلیٹ فارمز (Messaging platforms)                                          |
-| --------------------------------------- | --------------------------------------------- | -------------------------------------------------------------------------------- |
-| بات چیت شروع کریں                       | `hermes`                                      | `hermes gateway setup` اور `hermes gateway start` چلائیں، پھر بوٹ کو میسج بھیجیں |
-| نئی بات چیت شروع کریں                   | `/new` یا `/reset`                            | `/new` یا `/reset`                                                               |
-| ماڈل تبدیل کریں                         | `/model [provider:model]`                     | `/model [provider:model]`                                                        |
-| پرسنلٹی (Personality) سیٹ کریں           | `/personality [name]`                         | `/personality [name]`                                                            |
-| پچھلی باری کو دوبارہ یا منسوخ (undo) کریں | `/retry`، `/undo`                             | `/retry`، `/undo`                                                                |
-| کانٹیکسٹ (context) کمپریس کریں / استعمال چیک کریں | `/compress`، `/usage`، `/insights [--days N]` | `/compress`، `/usage`، `/insights [days]`                                        |
-| مہارتیں (Skills) براؤز کریں             | `/skills` یا `/<skill-name>`                  | `/<skill-name>`                                                                  |
-| موجودہ کام کو روکیں                     | `Ctrl+C` دبائیں یا نیا میسج بھیجیں            | `/stop` یا نیا میسج بھیجیں                                                       |
-| پلیٹ فارم کے لحاظ سے سٹیٹس              | `/platforms`                                  | `/status`، `/sethome`                                                            |
-
-</div>
-
-مکمل کمانڈ لسٹ کے لیے، [CLI گائیڈ](https://hermes-agent.nousresearch.com/docs/user-guide/cli) اور [میسجنگ گیٹ وے گائیڈ](https://hermes-agent.nousresearch.com/docs/user-guide/messaging) دیکھیں۔
-
----
-
-## دستاویزات (Documentation)
-
-تمام دستاویزات **[hermes-agent.nousresearch.com/docs](https://hermes-agent.nousresearch.com/docs/)** پر موجود ہیں:
-
-<div dir="ltr">
-
-| سیکشن (Section)                                                                                     | تفصیل (What's Covered)                                     |
-| --------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- |
-| [فوری آغاز (Quickstart)](https://hermes-agent.nousresearch.com/docs/getting-started/quickstart)     | انسٹالیشن → سیٹ اپ → 2 منٹ میں پہلی بات چیت شروع کریں       |
-| [CLI کا استعمال](https://hermes-agent.nousresearch.com/docs/user-guide/cli)                         | کمانڈز، کی بائنڈنگز (keybindings)، پرسنلٹیز (personalities)، سیشنز |
-| [کنفیگریشن (Configuration)](https://hermes-agent.nousresearch.com/docs/user-guide/configuration)    | کنفگ فائل، پرووائیڈرز، ماڈلز، اور تمام آپشنز               |
-| [میسجنگ گیٹ وے](https://hermes-agent.nousresearch.com/docs/user-guide/messaging)                    | ٹیلی گرام، ڈسکارڈ، سلیک، واٹس ایپ، سگنل، ہوم اسسٹنٹ         |
-| [سیکیورٹی (Security)](https://hermes-agent.nousresearch.com/docs/user-guide/security)              | کمانڈ کی منظوری، DM پیئرنگ (pairing)، کنٹینر آئسولیشن       |
-| [ٹولز اور ٹول سیٹس](https://hermes-agent.nousresearch.com/docs/user-guide/features/tools)          | 40 سے زائد ٹولز، ٹول سیٹ سسٹم، ٹرمینل بیک اینڈز             |
-| [مہارتوں کا سسٹم (Skills System)](https://hermes-agent.nousresearch.com/docs/user-guide/features/skills)| پروسیجرل (Procedural) میموری، سکلز ہب، نئی مہارتیں بنانا    |
-| [میموری (Memory)](https://hermes-agent.nousresearch.com/docs/user-guide/features/memory)            | مستقل میموری، یوزر پروفائلز، بہترین طریقہ کار              |
-| [MCP انضمام (Integration)](https://hermes-agent.nousresearch.com/docs/user-guide/features/mcp)      | صلاحیتوں کو بڑھانے کے لیے کسی بھی MCP سرور کو جوڑیں        |
-| [کرون (Cron) شیڈیولنگ](https://hermes-agent.nousresearch.com/docs/user-guide/features/cron)         | پلیٹ فارم ڈیلیوری کے ساتھ شیڈول کیے گئے کام                 |
-| [کانٹیکسٹ (Context) فائلز](https://hermes-agent.nousresearch.com/docs/user-guide/features/context-files)| پروجیکٹ کا سیاق و سباق (context) جو ہر بات چیت پر اثر انداز ہوتا ہے |
-| [آرکیٹیکچر (Architecture)](https://hermes-agent.nousresearch.com/docs/developer-guide/architecture) | پروجیکٹ کا ڈھانچہ، ایجنٹ لوپ، اہم کلاسز                    |
-| [تعاون (Contributing)](https://hermes-agent.nousresearch.com/docs/developer-guide/contributing)     | ڈیویلپمنٹ سیٹ اپ، PR کا طریقہ کار، کوڈنگ کا انداز          |
-| [CLI حوالہ جات (Reference)](https://hermes-agent.nousresearch.com/docs/reference/cli-commands)      | تمام کمانڈز اور فلیگز (flags)                              |
-| [انوائرمنٹ ویری ایبلز](https://hermes-agent.nousresearch.com/docs/reference/environment-variables)  | مکمل انوائرمنٹ ویری ایبل حوالہ جات                         |
-
-</div>
-
----
-
-## OpenClaw سے منتقلی
-
-اگر آپ OpenClaw سے منتقل ہو رہے ہیں، تو ہرمیس آپ کی سیٹنگز، یادیں (memories)، مہارتیں (skills)، اور API کیز کو خود بخود امپورٹ کر سکتا ہے۔
-
-**پہلی بار سیٹ اپ کے دوران:** سیٹ اپ وزرڈ (`hermes setup`) خود بخود `~/.openclaw` کو پہچان لیتا ہے اور کنفیگریشن شروع ہونے سے پہلے مائیگریٹ (migrate) کرنے کا آپشن دیتا ہے۔
-
-**انسٹالیشن کے بعد کسی بھی وقت:**
-
-<div dir="ltr">
-
-```bash
-hermes claw migrate              # انٹرایکٹو مائیگریشن (مکمل پری سیٹ)
-hermes claw migrate --dry-run    # جائزہ لیں کہ کیا کیا مائیگریٹ ہوگا
-hermes claw migrate --preset user-data   # حساس معلومات (secrets) کے بغیر مائیگریٹ کریں
-hermes claw migrate --overwrite  # موجودہ متصادم فائلوں کو اوور رائٹ کریں
-```
-
-</div>
-
-جو چیزیں امپورٹ ہوتی ہیں:
-
-- **SOUL.md** — پرسونا (persona) فائل
-- **میموریز (Memories)** — MEMORY.md اور USER.md کی اندراجات
-- **مہارتیں (Skills)** — صارف کی بنائی گئی مہارتیں → `~/.hermes/skills/openclaw-imports/`
-- **کمانڈ الاؤ لسٹ (allowlist)** — منظوری کے پیٹرنز (approval patterns)
-- **میسجنگ سیٹنگز** — پلیٹ فارم کنفیگریشنز، اجازت یافتہ صارفین، ورکنگ ڈائریکٹری
-- **API کیز** — الاؤ لسٹ شدہ حساس معلومات (ٹیلی گرام، OpenRouter، OpenAI، Anthropic، ElevenLabs)
-- **TTS اثاثے** — ورک اسپیس کی آڈیو فائلیں
-- **ورک اسپیس کی ہدایات** — AGENTS.md (`--workspace-target` کے ساتھ)
-
-تمام آپشنز دیکھنے کے لیے `hermes claw migrate --help` استعمال کریں، یا انٹرایکٹو ایجنٹ کی مدد سے مائیگریٹ کرنے کے لیے `openclaw-migration` سکل کا استعمال کریں (جس میں ڈرائی رن (dry-run) پریویوز شامل ہیں)۔
-
----
-
-## تعاون کریں (Contributing)
-
-ہم آپ کے تعاون کا خیرمقدم کرتے ہیں! ڈیویلپمنٹ سیٹ اپ، کوڈ کے انداز اور PR کے طریقہ کار کے لیے براہ کرم ہماری [Contributing گائیڈ](https://hermes-agent.nousresearch.com/docs/developer-guide/contributing) دیکھیں۔
-
-معاونین (contributors) کے لیے فوری آغاز — کلون (clone) کریں اور `setup-hermes.sh` چلائیں:
-
-<div dir="ltr">
-
-```bash
-git clone https://github.com/NousResearch/hermes-agent.git
-cd hermes-agent
-./setup-hermes.sh     # uv کو انسٹال کرتا ہے، venv بناتا ہے، .[all] کو انسٹال کرتا ہے، اور ~/.local/bin/hermes کا سیم لنک (symlink) بناتا ہے
-./hermes              # خود بخود venv کی شناخت کرتا ہے، پہلے `source` کرنے کی ضرورت نہیں
-```
-
-</div>
-
-مینوئل طریقہ (اوپر والے طریقے کے مساوی):
-
-<div dir="ltr">
-
-```bash
-curl -LsSf https://astral.sh/uv/install.sh | sh
-uv venv .venv --python 3.11
-source .venv/bin/activate
-uv pip install -e ".[all,dev]"
-scripts/run_tests.sh
-```
-
-</div>
-
----
-
-## کمیونٹی (Community)
-
-- 💬 [ڈسکارڈ (Discord)](https://discord.gg/NousResearch)
-- 📚 [سکلز ہب (Skills Hub)](https://agentskills.io)
-- 🐛 [مسائل (Issues)](https://github.com/NousResearch/hermes-agent/issues)
-- 🔌 [computer-use-linux](https://github.com/avifenesh/computer-use-linux) — ہرمیس اور دیگر MCP ہوسٹس کے لیے لینکس (Linux) ڈیسک ٹاپ کنٹرول MCP سرور، جس میں AT-SPI ایکسیسیبلٹی ٹریز، Wayland/X11 ان پٹ، سکرین شاٹس، اور کمپوزیٹر ونڈو ٹارگیٹنگ شامل ہے۔
-- 🔌 [HermesClaw](https://github.com/AaronWong1999/hermesclaw) — کمیونٹی وی چیٹ (WeChat) برج: ہرمیس ایجنٹ اور OpenClaw کو ایک ہی وی چیٹ اکاؤنٹ پر چلائیں۔
-
----
-
-## لائسنس (License)
-
-MIT — تفصیلات کے لیے [LICENSE](LICENSE) دیکھیں۔
-
-[نوس ریسرچ (Nous Research)](https://nousresearch.com) کی جانب سے تیار کردہ۔
-
-</div>

README.zh-CN.md

@@ -10,7 +10,6 @@
   <a href="https://github.com/NousResearch/hermes-agent/blob/main/LICENSE"><img src="https://img.shields.io/badge/License-MIT-green?style=for-the-badge" alt="License: MIT"></a>
   <a href="https://nousresearch.com"><img src="https://img.shields.io/badge/Built%20by-Nous%20Research-blueviolet?style=for-the-badge" alt="Built by Nous Research"></a>
   <a href="README.md"><img src="https://img.shields.io/badge/Lang-English-lightgrey?style=for-the-badge" alt="English"></a>
-  <a href="README.ur-pk.md"><img src="https://img.shields.io/badge/Lang-اردو-green?style=for-the-badge" alt="اردو"></a>
 </p>
 
 **由 [Nous Research](https://nousresearch.com) 构建的自进化 AI 代理。** 它是唯一内置学习闭环的智能代理——从经验中创建技能，在使用中改进技能，主动持久化知识，搜索过往对话，并在跨会话中逐步构建对你的深度理解。可以在 $5 的 VPS 上运行，也可以在 GPU 集群上运行，或者使用几乎零成本的 Serverless 基础设施。它不绑定你的笔记本——你可以在 Telegram 上与它对话，而它在云端 VM 上工作。

acp_adapter/provenance.py

@@ -1,127 +0,0 @@
-"""Derive ACP session-provenance metadata from the existing compression chain.
-
-This is an additive Hermes extension surfaced under ACP ``_meta.hermes`` so
-existing ACP clients ignore it. It carries no new persisted state: everything
-is derived on demand from the ``sessions`` table (``parent_session_id`` /
-``end_reason``), which already models compression-continuation chains.
-
-The ACP/editor ``session_id`` stays the stable public handle. When context
-compression rotates the internal Hermes head, ``build_session_provenance`` lets
-a client see the previous/current internal ids and the lineage root without
-parsing status text, guessing from token drops, or reading ``state.db``.
-"""
-
-from __future__ import annotations
-
-from typing import Any, Dict, Optional
-
-# Bound defensive walks; compression chains this deep are pathological.
-_MAX_WALK = 100
-
-
-def build_session_provenance(
-    db: Any,
-    acp_session_id: str,
-    current_hermes_session_id: str,
-    *,
-    previous_hermes_session_id: Optional[str] = None,
-) -> Optional[Dict[str, Any]]:
-    """Build ``_meta.hermes.sessionProvenance`` for an ACP session.
-
-    Args:
-        db: A ``SessionDB`` (must expose ``get_session``).
-        acp_session_id: The stable ACP/editor-facing session handle.
-        current_hermes_session_id: The live internal Hermes DB session id
-            (``state.agent.session_id``).
-        previous_hermes_session_id: The internal id from before the most recent
-            turn, when known. Supplied by ``prompt()`` to flag a rotation.
-
-    Returns:
-        A dict suitable for ``{"hermes": {"sessionProvenance": <dict>}}`` under
-        ACP ``_meta``, or ``None`` if the session can't be read.
-    """
-    try:
-        row = db.get_session(current_hermes_session_id)
-    except Exception:
-        return None
-    if not row:
-        return None
-
-    parent_id = row.get("parent_session_id")
-    end_reason = row.get("end_reason")
-
-    # Walk parents to the lineage root and count compression depth. Only
-    # compression-split parents (parent.end_reason == 'compression') count
-    # toward depth — delegate/branch children share the parent_session_id
-    # column but are not compaction boundaries.
-    root_id = current_hermes_session_id
-    compression_depth = 0
-    cursor_parent = parent_id
-    seen = {current_hermes_session_id}
-    for _ in range(_MAX_WALK):
-        if not cursor_parent or cursor_parent in seen:
-            break
-        seen.add(cursor_parent)
-        try:
-            prow = db.get_session(cursor_parent)
-        except Exception:
-            prow = None
-        if not prow:
-            break
-        root_id = cursor_parent
-        if prow.get("end_reason") == "compression":
-            compression_depth += 1
-        cursor_parent = prow.get("parent_session_id")
-
-    # A session is a compression continuation when its parent was ended with
-    # end_reason='compression'. Determine that from the immediate parent.
-    is_continuation = False
-    if parent_id:
-        try:
-            immediate_parent = db.get_session(parent_id)
-        except Exception:
-            immediate_parent = None
-        if immediate_parent and immediate_parent.get("end_reason") == "compression":
-            is_continuation = True
-
-    rotated = bool(
-        previous_hermes_session_id
-        and previous_hermes_session_id != current_hermes_session_id
-    )
-
-    provenance: Dict[str, Any] = {
-        "acpSessionId": acp_session_id,
-        "currentHermesSessionId": current_hermes_session_id,
-        "rootHermesSessionId": root_id,
-        "parentHermesSessionId": parent_id,
-        "sessionKind": "continuation" if is_continuation else "root",
-        "compressionDepth": compression_depth,
-    }
-    if previous_hermes_session_id:
-        provenance["previousHermesSessionId"] = previous_hermes_session_id
-    if rotated:
-        # The head moved during the last turn. The only mechanism that rotates
-        # the internal id mid-turn is compression-driven session splitting.
-        provenance["reason"] = "compression"
-        provenance["creatorKind"] = "compression"
-
-    return provenance
-
-
-def session_provenance_meta(
-    db: Any,
-    acp_session_id: str,
-    current_hermes_session_id: str,
-    *,
-    previous_hermes_session_id: Optional[str] = None,
-) -> Optional[Dict[str, Any]]:
-    """Return a ready ``_meta`` payload: ``{"hermes": {"sessionProvenance": ...}}``."""
-    prov = build_session_provenance(
-        db,
-        acp_session_id,
-        current_hermes_session_id,
-        previous_hermes_session_id=previous_hermes_session_id,
-    )
-    if prov is None:
-        return None
-    return {"hermes": {"sessionProvenance": prov}}

acp_adapter/server.py

@@ -71,7 +71,6 @@ from acp_adapter.events import (
     make_tool_progress_cb,
 )
 from acp_adapter.permissions import make_approval_callback
-from acp_adapter.provenance import session_provenance_meta
 from acp_adapter.session import SessionManager, SessionState, _expand_acp_enabled_toolsets
 from acp_adapter.tools import build_tool_complete, build_tool_start
 
@@ -710,39 +709,8 @@ class HermesACPAgent(acp.Agent):
                 exc_info=True,
             )
 
-    def _provenance_meta(
-        self,
-        acp_session_id: str,
-        current_hermes_session_id: str,
-        previous_hermes_session_id: Optional[str] = None,
-    ) -> Optional[dict]:
-        """Best-effort ``_meta.hermes.sessionProvenance`` for an ACP session."""
-        try:
-            return session_provenance_meta(
-                self.session_manager._get_db(),
-                acp_session_id,
-                current_hermes_session_id,
-                previous_hermes_session_id=previous_hermes_session_id,
-            )
-        except Exception:
-            logger.debug(
-                "Could not build ACP session provenance for %s", acp_session_id, exc_info=True
-            )
-            return None
-
-    async def _send_session_info_update(
-        self,
-        session_id: str,
-        *,
-        current_hermes_session_id: Optional[str] = None,
-        previous_hermes_session_id: Optional[str] = None,
-    ) -> None:
-        """Send ACP native session metadata after Hermes changes it.
-
-        When the internal Hermes head rotated (e.g. compression-driven session
-        split during a turn), pass ``previous_hermes_session_id`` so the
-        attached ``_meta.hermes.sessionProvenance`` flags the rotation reason.
-        """
+    async def _send_session_info_update(self, session_id: str) -> None:
+        """Send ACP native session metadata after Hermes changes it."""
         if not self._conn:
             return
         try:
@@ -759,16 +727,10 @@ class HermesACPAgent(acp.Agent):
         # the updated_at since we're emitting this notification precisely
         # because the title was just refreshed.
         updated_at = datetime.now(timezone.utc).isoformat()
-        meta = self._provenance_meta(
-            session_id,
-            current_hermes_session_id or session_id,
-            previous_hermes_session_id,
-        )
         update = SessionInfoUpdate(
             session_update="session_info_update",
             title=title if isinstance(title, str) and title.strip() else None,
             updated_at=updated_at,
-            field_meta=meta,
         )
         try:
             await self._conn.session_update(
@@ -1119,9 +1081,6 @@ class HermesACPAgent(acp.Agent):
             session_id=state.session_id,
             models=self._build_model_state(state),
             modes=self._session_modes(state),
-            field_meta=self._provenance_meta(
-                state.session_id, getattr(state.agent, "session_id", state.session_id)
-            ),
         )
 
     async def load_session(
@@ -1166,9 +1125,6 @@ class HermesACPAgent(acp.Agent):
         return LoadSessionResponse(
             models=self._build_model_state(state),
             modes=self._session_modes(state),
-            field_meta=self._provenance_meta(
-                session_id, getattr(state.agent, "session_id", session_id)
-            ),
         )
 
     async def resume_session(
@@ -1201,9 +1157,6 @@ class HermesACPAgent(acp.Agent):
         return ResumeSessionResponse(
             models=self._build_model_state(state),
             modes=self._session_modes(state),
-            field_meta=self._provenance_meta(
-                state.session_id, getattr(state.agent, "session_id", state.session_id)
-            ),
         )
 
     async def cancel(self, session_id: str, **kwargs: Any) -> None:
@@ -1541,11 +1494,6 @@ class HermesACPAgent(acp.Agent):
                         logger.debug("Could not clear ACP session context", exc_info=True)
 
         try:
-            # Snapshot the internal Hermes DB session id before the turn so we
-            # can detect a compression-driven session rotation afterwards. The
-            # ACP `session_id` stays the stable client handle; agent.session_id
-            # is the live internal head that compression may rotate.
-            pre_turn_hermes_id = getattr(state.agent, "session_id", None)
             # Wrap the executor call in a fresh copy of the current context so
             # concurrent ACP sessions on the shared ThreadPoolExecutor don't
             # stomp on each other's ContextVar writes (HERMES_SESSION_KEY in
@@ -1564,41 +1512,8 @@ class HermesACPAgent(acp.Agent):
             # Persist updated history so sessions survive process restarts.
             self.session_manager.save_session(session_id)
 
-        # Detect a compression-driven internal session rotation. If the agent's
-        # DB head moved during the turn, emit a session_info_update carrying
-        # _meta.hermes.sessionProvenance so ACP clients can render the boundary
-        # and keep old/new ids in lineage. The ACP session_id is unchanged.
-        post_turn_hermes_id = getattr(state.agent, "session_id", None)
-        if (
-            conn
-            and post_turn_hermes_id
-            and pre_turn_hermes_id
-            and post_turn_hermes_id != pre_turn_hermes_id
-        ):
-            try:
-                await self._send_session_info_update(
-                    session_id,
-                    current_hermes_session_id=post_turn_hermes_id,
-                    previous_hermes_session_id=pre_turn_hermes_id,
-                )
-            except Exception:
-                logger.debug(
-                    "Could not emit ACP provenance update after rotation for %s",
-                    session_id,
-                    exc_info=True,
-                )
-
         final_response = result.get("final_response", "")
-        cancelled = bool(state.cancel_event and state.cancel_event.is_set())
-        interrupted = bool(result.get("interrupted")) or cancelled
-        # Hermes' local "waiting for model response" interrupt status is metadata,
-        # not assistant prose — clients get cancellation from stop_reason instead.
-        from agent.conversation_loop import INTERRUPT_WAITING_FOR_MODEL_PREFIX
-
-        suppress_interrupt_response = interrupted and final_response.startswith(
-            INTERRUPT_WAITING_FOR_MODEL_PREFIX
-        )
-        if final_response and not suppress_interrupt_response:
+        if final_response:
             try:
                 from agent.title_generator import maybe_auto_title
 
@@ -1619,12 +1534,7 @@ class HermesACPAgent(acp.Agent):
                 )
             except Exception:
                 logger.debug("Failed to auto-title ACP session %s", session_id, exc_info=True)
-        if (
-            final_response
-            and conn
-            and not suppress_interrupt_response
-            and (not streamed_message or result.get("response_transformed"))
-        ):
+        if final_response and conn and (not streamed_message or result.get("response_transformed")):
             # Deliver the final response when streaming did not already send it,
             # or when a plugin hook transformed the response after streaming
             # finished (e.g. transform_llm_output) — otherwise the appended /
@@ -1666,7 +1576,7 @@ class HermesACPAgent(acp.Agent):
 
         await self._send_usage_update(state)
 
-        stop_reason = "cancelled" if cancelled else "end_turn"
+        stop_reason = "cancelled" if state.cancel_event and state.cancel_event.is_set() else "end_turn"
         return PromptResponse(stop_reason=stop_reason, usage=usage)
 
     # ---- Slash commands (headless) -------------------------------------------

agent/agent_init.py

@@ -68,24 +68,6 @@ def _ra():
     return run_agent
 
 
-def _build_codex_gpt55_autoraise_notice(autoraise: Dict[str, float]) -> str:
-    """Build the one-time notice shown when Codex gpt-5.5 raises compaction.
-
-    ``autoraise`` is ``{"from": <old_ratio>, "to": <new_ratio>}``. The same
-    text is printed inline for CLI users and replayed via ``status_callback``
-    for gateway users, so it must be self-contained and include the exact
-    opt-back-out command.
-    """
-    from_pct = int(round(autoraise["from"] * 100))
-    to_pct = int(round(autoraise["to"] * 100))
-    return (
-        f"ℹ Codex gpt-5.5 caps context at 272K, so auto-compaction was raised "
-        f"to {to_pct}% (from {from_pct}%) to use more of the window before "
-        f"summarizing.\n"
-        f"  Opt back out: hermes config set compression.codex_gpt55_autoraise false"
-    )
-
-
 def _normalized_custom_base_url(value: Any) -> str:
     if not isinstance(value, str):
         return ""
@@ -169,7 +151,6 @@ def init_agent(
     save_trajectories: bool = False,
     verbose_logging: bool = False,
     quiet_mode: bool = False,
-    tool_progress_mode: str = "all",
     ephemeral_system_prompt: str = None,
     log_prefix_chars: int = 100,
     log_prefix: str = "",
@@ -187,7 +168,6 @@ def init_agent(
     thinking_callback: callable = None,
     reasoning_callback: callable = None,
     clarify_callback: callable = None,
-    read_terminal_callback: callable = None,
     step_callback: callable = None,
     stream_delta_callback: callable = None,
     interim_assistant_callback: callable = None,
@@ -282,7 +262,6 @@ def init_agent(
     agent.save_trajectories = save_trajectories
     agent.verbose_logging = verbose_logging
     agent.quiet_mode = quiet_mode
-    agent.tool_progress_mode = tool_progress_mode
     agent.ephemeral_system_prompt = ephemeral_system_prompt
     agent.platform = platform  # "cli", "telegram", "discord", "whatsapp", etc.
     agent._user_id = user_id  # Platform user identifier (gateway sessions)
@@ -418,7 +397,6 @@ def init_agent(
     agent.thinking_callback = thinking_callback
     agent.reasoning_callback = reasoning_callback
     agent.clarify_callback = clarify_callback
-    agent.read_terminal_callback = read_terminal_callback
     agent.step_callback = step_callback
     agent.stream_delta_callback = stream_delta_callback
     agent.interim_assistant_callback = interim_assistant_callback
@@ -889,14 +867,6 @@ def init_agent(
                     headers["x-anthropic-beta"] = _FINE_GRAINED
                 client_kwargs["default_headers"] = headers
 
-        # User-configured request headers (model.default_headers in
-        # config.yaml) override provider/SDK defaults. Lets custom
-        # OpenAI-compatible endpoints behind a gateway/WAF that rejects the
-        # OpenAI SDK's identifying headers swap in a plain User-Agent. (#40033)
-        # client_kwargs is the same dict object as agent._client_kwargs, so
-        # this mutation is reflected in the client built just below.
-        agent._apply_user_default_headers()
-
         agent.api_key = client_kwargs.get("api_key", "")
         agent.base_url = client_kwargs.get("base_url", agent.base_url)
         try:
@@ -1270,41 +1240,11 @@ def init_agent(
     if not isinstance(_compression_cfg, dict):
         _compression_cfg = {}
     compression_threshold = float(_compression_cfg.get("threshold", 0.50))
-    # Per-model/route compaction-threshold override. Codex gpt-5.5 raises to
-    # 85% (the Codex backend caps the window at 272K, so the default 50% would
-    # compact at ~136K — half the usable context). Gated by an opt-out config
-    # flag so the user can fall back to the global threshold; when the override
-    # fires we stash a one-time notification (replayed on the first turn) that
-    # tells the user what changed and how to revert.
-    _codex_gpt55_autoraise = str(
-        _compression_cfg.get("codex_gpt55_autoraise", True)
-    ).lower() in {"true", "1", "yes"}
-    agent._compression_threshold_autoraised = None
     try:
-        from agent.auxiliary_client import (
-            _compression_threshold_for_model as _cthresh_fn,
-            _is_codex_gpt55 as _is_codex_gpt55_fn,
-        )
-        _model_cthresh = _cthresh_fn(
-            agent.model,
-            agent.provider,
-            allow_codex_gpt55_autoraise=_codex_gpt55_autoraise,
-        )
+        from agent.auxiliary_client import _compression_threshold_for_model as _cthresh_fn
+        _model_cthresh = _cthresh_fn(agent.model)
         if _model_cthresh is not None:
-            _prev_threshold = compression_threshold
             compression_threshold = _model_cthresh
-            # Notify only for the Codex gpt-5.5 autoraise (the Arcee Trinity
-            # override is a long-standing silent default). Skip the notice when
-            # the user's global threshold already meets/exceeds the raised
-            # value, since nothing actually changed for them.
-            if (
-                _is_codex_gpt55_fn(agent.model, agent.provider)
-                and _model_cthresh > _prev_threshold + 1e-9
-            ):
-                agent._compression_threshold_autoraised = {
-                    "from": _prev_threshold,
-                    "to": _model_cthresh,
-                }
     except Exception:
         pass
     compression_enabled = str(_compression_cfg.get("enabled", True)).lower() in {"true", "1", "yes"}
@@ -1681,24 +1621,11 @@ def init_agent(
             print(f"📊 Context limit: {agent.context_compressor.context_length:,} tokens (compress at {int(compression_threshold*100)}% = {agent.context_compressor.threshold_tokens:,})")
         else:
             print(f"📊 Context limit: {agent.context_compressor.context_length:,} tokens (auto-compression disabled)")
-        # One-time notice when the Codex gpt-5.5 autoraise kicked in, with the
-        # exact opt-back-out command. Printed inline at startup for CLI users;
-        # gateway users get the same text replayed via _compression_warning on
-        # turn 1 (set below, after the warning slot is initialized).
-        _autoraise = getattr(agent, "_compression_threshold_autoraised", None)
-        if _autoraise and compression_enabled:
-            print(_build_codex_gpt55_autoraise_notice(_autoraise))
 
     # Check immediately so CLI users see the warning at startup.
     # Gateway status_callback is not yet wired, so any warning is stored
     # in _compression_warning and replayed in the first run_conversation().
     agent._compression_warning = None
-    # Gateway parity for the Codex gpt-5.5 autoraise notice: the startup print
-    # above only reaches the CLI, so stash the same text here to be replayed
-    # through status_callback on the first turn (Telegram/Discord/Slack/etc.).
-    _autoraise = getattr(agent, "_compression_threshold_autoraised", None)
-    if _autoraise and compression_enabled:
-        agent._compression_warning = _build_codex_gpt55_autoraise_notice(_autoraise)
     # Lazy feasibility check: deferred to the first turn that approaches the
     # compression threshold. Running it eagerly here costs ~400ms cold (network
     # probe of the auxiliary provider chain + /models lookup) on every agent

agent/agent_runtime_helpers.py

@@ -49,7 +49,7 @@ def _ra():
 
 
 AGENT_RUNTIME_POST_HOOK_TOOL_NAMES = frozenset(
-    {"todo", "session_search", "memory", "clarify", "read_terminal", "delegate_task"}
+    {"todo", "session_search", "memory", "clarify", "delegate_task"}
 )
 
 
@@ -1620,37 +1620,13 @@ def switch_model(agent, new_model, new_provider, api_key='', base_url='', api_mo
 
 def invoke_tool(agent, function_name: str, function_args: dict, effective_task_id: str,
                  tool_call_id: Optional[str] = None, messages: list = None,
-                 pre_tool_block_checked: bool = False,
-                 skip_tool_request_middleware: bool = False,
-                 tool_request_middleware_trace: Optional[List[Dict[str, Any]]] = None) -> str:
+                 pre_tool_block_checked: bool = False) -> str:
     """Invoke a single tool and return the result string. No display logic.
 
     Handles both agent-level tools (todo, memory, etc.) and registry-dispatched
     tools. Used by the concurrent execution path; the sequential path retains
     its own inline invocation for backward-compatible display handling.
     """
-    if not isinstance(function_args, dict):
-        function_args = {}
-
-    _tool_middleware_trace = list(tool_request_middleware_trace or [])
-    try:
-        from hermes_cli.middleware import apply_tool_request_middleware
-
-        if not skip_tool_request_middleware:
-            _tool_request_mw = apply_tool_request_middleware(
-                function_name,
-                function_args,
-                task_id=effective_task_id or "",
-                session_id=getattr(agent, "session_id", "") or "",
-                tool_call_id=tool_call_id or "",
-                turn_id=getattr(agent, "_current_turn_id", "") or "",
-                api_request_id=getattr(agent, "_current_api_request_id", "") or "",
-            )
-            function_args = _tool_request_mw.payload
-            _tool_middleware_trace = _tool_request_mw.trace
-    except Exception as _mw_err:
-        logger.debug("tool_request middleware error: %s", _mw_err)
-
     # Check plugin hooks for a block directive before executing anything.
     block_message: Optional[str] = None
     if not pre_tool_block_checked:
@@ -1664,7 +1640,6 @@ def invoke_tool(agent, function_name: str, function_args: dict, effective_task_i
                 tool_call_id=tool_call_id or "",
                 turn_id=getattr(agent, "_current_turn_id", "") or "",
                 api_request_id=getattr(agent, "_current_api_request_id", "") or "",
-                middleware_trace=list(_tool_middleware_trace),
             )
         except Exception:
             pass
@@ -1684,7 +1659,6 @@ def invoke_tool(agent, function_name: str, function_args: dict, effective_task_i
                 status="blocked",
                 error_type="plugin_block",
                 error_message=block_message,
-                middleware_trace=list(_tool_middleware_trace),
             )
         except Exception:
             pass
@@ -1692,13 +1666,12 @@ def invoke_tool(agent, function_name: str, function_args: dict, effective_task_i
 
     tool_start_time = time.monotonic()
 
-    def _finish_agent_tool(result: Any, observed_args: Optional[dict] = None) -> Any:
-        hook_args = observed_args if isinstance(observed_args, dict) else function_args
+    def _finish_agent_tool(result: Any) -> Any:
         try:
             from model_tools import _emit_post_tool_call_hook
             _emit_post_tool_call_hook(
                 function_name=function_name,
-                function_args=hook_args,
+                function_args=function_args,
                 result=result,
                 task_id=effective_task_id or "",
                 session_id=getattr(agent, "session_id", "") or "",
@@ -1706,127 +1679,89 @@ def invoke_tool(agent, function_name: str, function_args: dict, effective_task_i
                 turn_id=getattr(agent, "_current_turn_id", "") or "",
                 api_request_id=getattr(agent, "_current_api_request_id", "") or "",
                 duration_ms=int((time.monotonic() - tool_start_time) * 1000),
-                middleware_trace=list(_tool_middleware_trace),
             )
         except Exception:
             pass
         return result
 
     if function_name == "todo":
-        def _execute(next_args: dict) -> Any:
-            from tools.todo_tool import todo_tool as _todo_tool
-            return _finish_agent_tool(
-                _todo_tool(
-                    todos=next_args.get("todos"),
-                    merge=next_args.get("merge", False),
-                    store=agent._todo_store,
-                ),
-                next_args,
+        from tools.todo_tool import todo_tool as _todo_tool
+        return _finish_agent_tool(
+            _todo_tool(
+                todos=function_args.get("todos"),
+                merge=function_args.get("merge", False),
+                store=agent._todo_store,
             )
+        )
     elif function_name == "session_search":
-        def _execute(next_args: dict) -> Any:
-            session_db = agent._get_session_db_for_recall()
-            if not session_db:
-                from hermes_state import format_session_db_unavailable
-                return _finish_agent_tool(json.dumps({"success": False, "error": format_session_db_unavailable()}), next_args)
-            from tools.session_search_tool import session_search as _session_search
-            return _finish_agent_tool(
-                _session_search(
-                    query=next_args.get("query", ""),
-                    role_filter=next_args.get("role_filter"),
-                    limit=next_args.get("limit", 3),
-                    session_id=next_args.get("session_id"),
-                    around_message_id=next_args.get("around_message_id"),
-                    window=next_args.get("window", 5),
-                    sort=next_args.get("sort"),
-                    db=session_db,
-                    current_session_id=agent.session_id,
-                ),
-                next_args,
+        session_db = agent._get_session_db_for_recall()
+        if not session_db:
+            from hermes_state import format_session_db_unavailable
+            return _finish_agent_tool(json.dumps({"success": False, "error": format_session_db_unavailable()}))
+        from tools.session_search_tool import session_search as _session_search
+        return _finish_agent_tool(
+            _session_search(
+                query=function_args.get("query", ""),
+                role_filter=function_args.get("role_filter"),
+                limit=function_args.get("limit", 3),
+                session_id=function_args.get("session_id"),
+                around_message_id=function_args.get("around_message_id"),
+                window=function_args.get("window", 5),
+                sort=function_args.get("sort"),
+                db=session_db,
+                current_session_id=agent.session_id,
             )
+        )
     elif function_name == "memory":
-        def _execute(next_args: dict) -> Any:
-            target = next_args.get("target", "memory")
-            from tools.memory_tool import memory_tool as _memory_tool
-            result = _memory_tool(
-                action=next_args.get("action"),
-                target=target,
-                content=next_args.get("content"),
-                old_text=next_args.get("old_text"),
-                store=agent._memory_store,
-            )
-            # Bridge: notify external memory provider of built-in memory writes
-            if agent._memory_manager and next_args.get("action") in {"add", "replace"}:
-                try:
-                    agent._memory_manager.on_memory_write(
-                        next_args.get("action", ""),
-                        target,
-                        next_args.get("content", ""),
-                        metadata=agent._build_memory_write_metadata(
-                            task_id=effective_task_id,
-                            tool_call_id=tool_call_id,
-                        ),
-                    )
-                except Exception:
-                    pass
-            return _finish_agent_tool(result, next_args)
+        target = function_args.get("target", "memory")
+        from tools.memory_tool import memory_tool as _memory_tool
+        result = _memory_tool(
+            action=function_args.get("action"),
+            target=target,
+            content=function_args.get("content"),
+            old_text=function_args.get("old_text"),
+            store=agent._memory_store,
+        )
+        # Bridge: notify external memory provider of built-in memory writes
+        if agent._memory_manager and function_args.get("action") in {"add", "replace"}:
+            try:
+                agent._memory_manager.on_memory_write(
+                    function_args.get("action", ""),
+                    target,
+                    function_args.get("content", ""),
+                    metadata=agent._build_memory_write_metadata(
+                        task_id=effective_task_id,
+                        tool_call_id=tool_call_id,
+                    ),
+                )
+            except Exception:
+                pass
+        return _finish_agent_tool(result)
     elif agent._memory_manager and agent._memory_manager.has_tool(function_name):
-        def _execute(next_args: dict) -> Any:
-            return _finish_agent_tool(agent._memory_manager.handle_tool_call(function_name, next_args), next_args)
+        return _finish_agent_tool(agent._memory_manager.handle_tool_call(function_name, function_args))
     elif function_name == "clarify":
-        def _execute(next_args: dict) -> Any:
-            from tools.clarify_tool import clarify_tool as _clarify_tool
-            return _finish_agent_tool(
-                _clarify_tool(
-                    question=next_args.get("question", ""),
-                    choices=next_args.get("choices"),
-                    callback=agent.clarify_callback,
-                ),
-                next_args,
-            )
-    elif function_name == "read_terminal":
-        def _execute(next_args: dict) -> Any:
-            from tools.read_terminal_tool import read_terminal_tool as _read_terminal_tool
-            return _finish_agent_tool(
-                _read_terminal_tool(
-                    start_line=next_args.get("start_line"),
-                    count=next_args.get("count"),
-                    callback=getattr(agent, "read_terminal_callback", None),
-                ),
-                next_args,
+        from tools.clarify_tool import clarify_tool as _clarify_tool
+        return _finish_agent_tool(
+            _clarify_tool(
+                question=function_args.get("question", ""),
+                choices=function_args.get("choices"),
+                callback=agent.clarify_callback,
             )
+        )
     elif function_name == "delegate_task":
-        def _execute(next_args: dict) -> Any:
-            return _finish_agent_tool(agent._dispatch_delegate_task(next_args), next_args)
+        return _finish_agent_tool(agent._dispatch_delegate_task(function_args))
     else:
-        def _execute(next_args: dict) -> Any:
-            return _ra().handle_function_call(
-                function_name, next_args, effective_task_id,
-                tool_call_id=tool_call_id,
-                session_id=agent.session_id or "",
-                turn_id=getattr(agent, "_current_turn_id", "") or "",
-                api_request_id=getattr(agent, "_current_api_request_id", "") or "",
-                enabled_tools=list(agent.valid_tool_names) if agent.valid_tool_names else None,
-                skip_pre_tool_call_hook=True,
-                skip_tool_request_middleware=True,
-                enabled_toolsets=getattr(agent, "enabled_toolsets", None),
-                disabled_toolsets=getattr(agent, "disabled_toolsets", None),
-                tool_request_middleware_trace=list(_tool_middleware_trace),
-            )
-
-    from hermes_cli.middleware import run_tool_execution_middleware
-
-    return run_tool_execution_middleware(
-        function_name,
-        function_args,
-        lambda next_args: _execute(next_args if isinstance(next_args, dict) else function_args),
-        original_args=function_args,
-        task_id=effective_task_id or "",
-        session_id=getattr(agent, "session_id", "") or "",
-        tool_call_id=tool_call_id or "",
-        turn_id=getattr(agent, "_current_turn_id", "") or "",
-        api_request_id=getattr(agent, "_current_api_request_id", "") or "",
-    )
+        return _ra().handle_function_call(
+            function_name, function_args, effective_task_id,
+            tool_call_id=tool_call_id,
+            session_id=agent.session_id or "",
+            turn_id=getattr(agent, "_current_turn_id", "") or "",
+            api_request_id=getattr(agent, "_current_api_request_id", "") or "",
+            enabled_tools=list(agent.valid_tool_names) if agent.valid_tool_names else None,
+            skip_pre_tool_call_hook=True,
+            enabled_toolsets=getattr(agent, "enabled_toolsets", None),
+            disabled_toolsets=getattr(agent, "disabled_toolsets", None),
+        )
 
 
 
@@ -1857,27 +1792,6 @@ def repair_tool_call(agent, tool_name: str) -> str | None:
     if not tool_name:
         return None
 
-    # VolcEngine api/plan workaround (issue #33007): the endpoint's
-    # protocol-translation layer occasionally leaks raw XML attribute
-    # fragments into tool_use.name, e.g.
-    #   `terminal" parameter="command" string="true`
-    #   `execute_code" parameter="code" string="true`
-    #   `session_search" parameter="session_id" string="true`
-    # We trim at the first unambiguous XML/quote character so the rest
-    # of the repair pipeline (lowercase / snake_case / fuzzy match)
-    # can resolve the cleaned name to a real tool.
-    #
-    # Crucially we DO NOT split on whitespace: legitimate inputs like
-    # "write file" must keep flowing through ``_norm`` -> ``write_file``
-    # (covered by test_space_to_underscore in
-    # tests/run_agent/test_repair_tool_call_name.py).
-    for _xml_sep in ('"', "'", "<", ">"):
-        _idx = tool_name.find(_xml_sep)
-        if _idx > 0:
-            tool_name = tool_name[:_idx]
-    if not tool_name:
-        return None
-
     def _norm(s: str) -> str:
         return s.lower().replace("-", "_").replace(" ", "_")
 

agent/anthropic_adapter.py

@@ -73,50 +73,20 @@ ADAPTIVE_EFFORT_MAP = {
     "minimal": "low",
 }
 
-# ── Anthropic thinking-mode classification ────────────────────────────
-# Claude 4.6 replaced budget-based extended thinking with *adaptive* thinking,
-# and 4.7 additionally forbids the manual ``thinking`` block entirely and drops
-# temperature/top_p/top_k.  Newer Claude releases (4.8, and named models like
-# claude-fable-5) follow the same modern contract — but they share no common
-# version substring, so an allowlist of version numbers ("4.6", "4.7", …) goes
-# stale the moment a model ships without a recognized number and silently
-# routes it down the legacy manual-thinking path.
-#
-# Instead we DEFAULT unknown Claude models to the modern contract and keep an
-# explicit *legacy* list of the older Claude families that still require manual
-# thinking.  This mirrors _get_anthropic_max_output's "default to newest" design
-# (future models are unlikely to regress to the older contract), so each new
-# Claude release works without a code change.
-#
-# Non-Claude Anthropic-Messages models (minimax, qwen3, GLM, …) are NOT Claude,
-# so they fall through to the legacy path automatically — exactly what those
-# manual-thinking endpoints need.
-
-# Older Claude families that DON'T support adaptive thinking (manual thinking
-# with budget_tokens only). Substring-matched against the model name.
-_LEGACY_MANUAL_THINKING_CLAUDE_SUBSTRINGS = (
-    "claude-3",          # 3, 3.5, 3.7
-    "claude-opus-4-0", "claude-opus-4.0", "claude-opus-4-1", "claude-opus-4.1",
-    "claude-sonnet-4-0", "claude-sonnet-4.0",
-    "claude-opus-4-2025", "claude-sonnet-4-2025",  # date-stamped 4.0 IDs
-    "claude-opus-4-5", "claude-opus-4.5",
-    "claude-sonnet-4-5", "claude-sonnet-4.5",
-    "claude-haiku-4-5", "claude-haiku-4.5",
-)
-
-# Older Claude families that DON'T accept the "xhigh" effort level (4.6 only
-# supports low/medium/high/max). xhigh arrived with Opus 4.7. Adaptive models
-# not in this list (4.7, 4.8, fable, future) accept xhigh.
-_NO_XHIGH_CLAUDE_SUBSTRINGS = (
-    "claude-opus-4-6", "claude-opus-4.6",
-    "claude-sonnet-4-6", "claude-sonnet-4.6",
-)
-
-
-def _is_claude_model(model: str | None) -> bool:
-    return "claude" in (model or "").lower()
+# Models that accept the "xhigh" output_config.effort level.  Opus 4.7 added
+# xhigh as a distinct level between high and max; older adaptive-thinking
+# models (4.6) reject it with a 400.  Keep this substring list in sync with
+# the Anthropic migration guide as new model families ship.
+_XHIGH_EFFORT_SUBSTRINGS = ("4-7", "4.7", "4-8", "4.8")
 
+# Models where extended thinking is deprecated/removed (4.6+ behavior: adaptive
+# is the only supported mode; 4.7 additionally forbids manual thinking entirely
+# and drops temperature/top_p/top_k).
+_ADAPTIVE_THINKING_SUBSTRINGS = ("4-6", "4.6", "4-7", "4.7", "4-8", "4.8")
 
+# Models where temperature/top_p/top_k return 400 if set to non-default values.
+# This is the Opus 4.7 contract; future 4.x+ models are expected to follow it.
+_NO_SAMPLING_PARAMS_SUBSTRINGS = ("4-7", "4.7", "4-8", "4.8")
 _FAST_MODE_SUPPORTED_SUBSTRINGS = ("opus-4-6", "opus-4.6")
 
 # ── Max output token limits per Anthropic model ───────────────────────
@@ -124,8 +94,6 @@ _FAST_MODE_SUPPORTED_SUBSTRINGS = ("opus-4-6", "opus-4.6")
 # max_tokens as a mandatory field.  Previously we hardcoded 16384, which
 # starves thinking-enabled models (thinking tokens count toward the limit).
 _ANTHROPIC_OUTPUT_LIMITS = {
-    # Mythos-class named models (claude-fable-5, …) — 1M context, reasoning
-    "claude-fable":      128_000,
     # Claude 4.8
     "claude-opus-4-8":   128_000,
     # Claude 4.7
@@ -240,17 +208,8 @@ def _resolve_anthropic_messages_max_tokens(
 
 
 def _supports_adaptive_thinking(model: str) -> bool:
-    """Return True for Claude models that use adaptive thinking (4.6+).
-
-    Defaults *unknown* Claude models to adaptive (the modern contract) and
-    only returns False for the explicit legacy list of older Claude families
-    that require manual budget-based thinking. Non-Claude Anthropic-Messages
-    models (minimax, qwen3, …) return False so they keep the manual path.
-    """
-    if not _is_claude_model(model):
-        return False
-    m = model.lower()
-    return not any(v in m for v in _LEGACY_MANUAL_THINKING_CLAUDE_SUBSTRINGS)
+    """Return True for Claude 4.6+ models that support adaptive thinking."""
+    return any(v in model for v in _ADAPTIVE_THINKING_SUBSTRINGS)
 
 
 def _supports_xhigh_effort(model: str) -> bool:
@@ -260,33 +219,18 @@ def _supports_xhigh_effort(model: str) -> bool:
     Pre-4.7 adaptive models (Opus/Sonnet 4.6) only accept low/medium/high/max
     and reject xhigh with an HTTP 400. Callers should downgrade xhigh→max
     when this returns False.
-
-    Defaults unknown adaptive Claude models to accepting xhigh (4.7+ contract);
-    only the 4.6 family and legacy manual-thinking models are excluded.
     """
-    if not _supports_adaptive_thinking(model):
-        return False
-    m = model.lower()
-    return not any(v in m for v in _NO_XHIGH_CLAUDE_SUBSTRINGS)
+    return any(v in model for v in _XHIGH_EFFORT_SUBSTRINGS)
 
 
 def _forbids_sampling_params(model: str) -> bool:
     """Return True for models that 400 on any non-default temperature/top_p/top_k.
 
-    Opus 4.7 introduced this restriction; later Claude releases follow it.
-    Defaults unknown Claude models to forbidding sampling params (the modern
-    contract). The 4.6 family still accepts them, and the legacy manual-thinking
-    families (4.5 and older) accept them too, so both are excluded. Non-Claude
-    models are unaffected. Callers should omit these fields entirely rather than
-    passing zero/default values (the API rejects anything non-null).
+    Opus 4.7 explicitly rejects sampling parameters; later Claude releases are
+    expected to follow suit.  Callers should omit these fields entirely rather
+    than passing zero/default values (the API rejects anything non-null).
     """
-    if not _is_claude_model(model):
-        return False
-    m = model.lower()
-    # 4.6 family is adaptive but still accepts sampling params.
-    if any(v in m for v in _NO_XHIGH_CLAUDE_SUBSTRINGS):
-        return False
-    return not any(v in m for v in _LEGACY_MANUAL_THINKING_CLAUDE_SUBSTRINGS)
+    return any(v in model for v in _NO_SAMPLING_PARAMS_SUBSTRINGS)
 
 
 def _supports_fast_mode(model: str) -> bool:
@@ -877,7 +821,6 @@ def _read_claude_code_credentials_from_keychain() -> Optional[Dict[str, Any]]:
             capture_output=True,
             text=True,
             timeout=5,
-            stdin=subprocess.DEVNULL,
         )
     except (OSError, subprocess.TimeoutExpired):
         logger.debug("Keychain: security command not available or timed out")
@@ -1220,10 +1163,7 @@ def run_oauth_setup_token() -> Optional[str]:
             "Install it with: npm install -g @anthropic-ai/claude-code"
         )
 
-    # Run interactively — stdin/stdout/stderr inherited so the user can
-    # complete the OAuth login prompt. Must keep inherited stdin; the TUI-EOF
-    # concern does not apply to an interactive login the user explicitly
-    # invokes.  noqa: subprocess-stdin
+    # Run interactively — stdin/stdout/stderr inherited so user can interact
     try:
         subprocess.run([claude_path, "setup-token"])
     except (KeyboardInterrupt, EOFError):
@@ -2361,43 +2301,3 @@ def build_anthropic_kwargs(
         kwargs["extra_headers"] = {"anthropic-beta": ",".join(betas)}
 
     return kwargs
-
-
-# Keys that belong exclusively to the OpenAI Responses / Codex API shape.
-# The Anthropic Messages SDK (``messages.create()`` / ``messages.stream()``)
-# raises ``TypeError: ... got an unexpected keyword argument`` on any of them.
-_RESPONSES_ONLY_KWARGS = frozenset(
-    {"instructions", "input", "store", "parallel_tool_calls"}
-)
-
-
-def sanitize_anthropic_kwargs(api_kwargs: Any, *, log_prefix: str = "") -> Any:
-    """Drop Responses-API-only keys before an Anthropic Messages SDK call.
-
-    Defensive boundary guard for #31673: under rare api_mode-flip races
-    (e.g. a concurrent auxiliary call mutating a shared agent between the
-    kwargs build and the stream dispatch), a Responses-shaped payload
-    carrying ``instructions=`` can reach ``messages.stream()`` /
-    ``messages.create()``. The Anthropic SDK rejects it with a
-    non-retryable ``TypeError`` that nukes the whole turn and propagates
-    the entire fallback chain.
-
-    Mutates ``api_kwargs`` in place and returns it. When a foreign key is
-    present we log a WARNING so the underlying race stays visible in the
-    wild instead of being silently papered over.
-    """
-    if not isinstance(api_kwargs, dict):
-        return api_kwargs
-    leaked = _RESPONSES_ONLY_KWARGS.intersection(api_kwargs)
-    if leaked:
-        for _key in leaked:
-            api_kwargs.pop(_key, None)
-        logger.warning(
-            "%sStripped Responses-only kwarg(s) %s from an Anthropic Messages "
-            "call (api_mode flip race — see #31673). The call will proceed; "
-            "this breadcrumb means a kwargs build ran under a Responses "
-            "api_mode while dispatch ran under anthropic_messages.",
-            log_prefix,
-            sorted(leaked),
-        )
-    return api_kwargs

agent/auxiliary_client.py

@@ -102,7 +102,7 @@ OpenAI = _OpenAIProxy()  # module-level name, resolves lazily on call/isinstance
 from agent.credential_pool import load_pool
 from hermes_cli.config import get_hermes_home
 from hermes_constants import OPENROUTER_BASE_URL
-from utils import base_url_host_matches, base_url_hostname, model_forces_max_completion_tokens, normalize_proxy_env_vars
+from utils import base_url_host_matches, base_url_hostname, normalize_proxy_env_vars
 
 logger = logging.getLogger(__name__)
 
@@ -202,35 +202,6 @@ def _is_arcee_trinity_thinking(model: Optional[str]) -> bool:
     return bare == "trinity-large-thinking"
 
 
-# Context window enforced by ChatGPT's Codex OAuth backend for gpt-5.5.
-# The raw OpenAI API and OpenRouter expose 1.05M for the same slug, but the
-# Codex backend hard-caps at 272K (verified live: a ~330K-token request to
-# chatgpt.com/backend-api/codex/responses is rejected with
-# ``context_length_exceeded`` while ~250K succeeds). With a 272K ceiling the
-# default 50% compaction trigger fires at ~136K — wasteful, since the model
-# can hold far more raw context before summarization actually buys anything.
-# We raise the trigger to 85% (~231K) on this exact route so Codex gpt-5.5
-# sessions use the window they actually have.
-_CODEX_GPT55_COMPACTION_THRESHOLD = 0.85
-
-
-def _is_codex_gpt55(model: Optional[str], provider: Optional[str] = None) -> bool:
-    """True for gpt-5.5 accessed through the ChatGPT Codex OAuth backend.
-
-    Matches only the Codex OAuth route (provider ``openai-codex``), not the
-    direct OpenAI API, OpenRouter, or GitHub Copilot paths — those expose a
-    larger context window for the same slug and must keep the user's default
-    compaction threshold. ``gpt-5.5-pro`` and dated snapshots
-    (``gpt-5.5-2026-04-23``) are matched via prefix so the override tracks the
-    family without re-listing every variant.
-    """
-    prov = (provider or "").strip().lower()
-    if prov != "openai-codex":
-        return False
-    bare = (model or "").strip().lower().rsplit("/", 1)[-1]
-    return bare == "gpt-5.5" or bare.startswith("gpt-5.5-") or bare.startswith("gpt-5.5.")
-
-
 def _fixed_temperature_for_model(
     model: Optional[str],
     base_url: Optional[str] = None,
@@ -253,32 +224,18 @@ def _fixed_temperature_for_model(
     return None
 
 
-def _compression_threshold_for_model(
-    model: Optional[str],
-    provider: Optional[str] = None,
-    *,
-    allow_codex_gpt55_autoraise: bool = True,
-) -> Optional[float]:
+def _compression_threshold_for_model(model: Optional[str]) -> Optional[float]:
     """Return a context-compression threshold override for specific models.
 
     The threshold is the fraction of the model's context window that must be
     consumed before Hermes triggers summarization.  Higher values delay
     compression and preserve more raw context.
 
-    Per-model/route overrides:
-      - Arcee Trinity Large Thinking → 0.75 (preserve reasoning context).
-      - gpt-5.5 on the Codex OAuth route → 0.85, because Codex caps the window
-        at 272K and the default 50% trigger would compact at ~136K. Gated by
-        ``allow_codex_gpt55_autoraise`` so the user can opt back down to the
-        global default (the caller passes the config flag through here).
-
     Returns a float in (0, 1] to override the global ``compression.threshold``
     config value, or ``None`` to leave the user's config value unchanged.
     """
     if _is_arcee_trinity_thinking(model):
         return 0.75
-    if allow_codex_gpt55_autoraise and _is_codex_gpt55(model, provider):
-        return _CODEX_GPT55_COMPACTION_THRESHOLD
     return None
 
 # Default auxiliary models for direct API-key providers (cheap/fast for side tasks)
@@ -357,35 +314,6 @@ _OR_HEADERS_BASE = {
 _TRUTHY_ENV_VALUES = frozenset({"1", "true", "yes", "on"})
 
 
-def _apply_user_default_headers(headers: dict | None) -> dict | None:
-    """Merge user-configured ``model.default_headers`` onto resolved headers.
-
-    User values take precedence over provider/SDK defaults, mirroring the main
-    agent client (``AIAgent._apply_user_default_headers``). This lets a
-    ``custom`` OpenAI-compatible endpoint behind a gateway/WAF that rejects the
-    OpenAI SDK's identifying headers (``User-Agent: OpenAI/Python ...``,
-    ``X-Stainless-*``) override them for auxiliary calls too — otherwise the
-    main turn would succeed but title/compression/vision calls to the same
-    endpoint would still fail. (#40033)
-
-    Returns the merged dict, or the original ``headers`` (possibly ``None``)
-    when nothing is configured. No allocation when there are no overrides.
-    """
-    try:
-        from hermes_cli.config import cfg_get, load_config
-        user_headers = cfg_get(load_config(), "model", "default_headers")
-    except Exception:
-        return headers
-    if not isinstance(user_headers, dict) or not user_headers:
-        return headers
-    merged = dict(headers or {})
-    for key, value in user_headers.items():
-        if value is None:
-            continue
-        merged[str(key)] = str(value)
-    return merged or headers
-
-
 def build_or_headers(or_config: dict | None = None) -> dict:
     """Build OpenRouter headers, optionally including response-cache headers.
 
@@ -637,6 +565,54 @@ def _pool_runtime_base_url(entry: Any, fallback: str = "") -> str:
 # calls to the Codex Responses API so callers don't need any changes.
 
 
+def _convert_content_for_responses(content: Any) -> Any:
+    """Convert chat.completions content to Responses API format.
+
+    chat.completions uses:
+      {"type": "text", "text": "..."}
+      {"type": "image_url", "image_url": {"url": "data:image/png;base64,..."}}
+
+    Responses API uses:
+      {"type": "input_text", "text": "..."}
+      {"type": "input_image", "image_url": "data:image/png;base64,..."}
+
+    If content is a plain string, it's returned as-is (the Responses API
+    accepts strings directly for text-only messages).
+    """
+    if isinstance(content, str):
+        return content
+    if not isinstance(content, list):
+        return str(content) if content else ""
+
+    converted: List[Dict[str, Any]] = []
+    for part in content:
+        if not isinstance(part, dict):
+            continue
+        ptype = part.get("type", "")
+        if ptype == "text":
+            converted.append({"type": "input_text", "text": part.get("text", "")})
+        elif ptype == "image_url":
+            # chat.completions nests the URL: {"image_url": {"url": "..."}}
+            image_data = part.get("image_url", {})
+            url = image_data.get("url", "") if isinstance(image_data, dict) else str(image_data)
+            entry: Dict[str, Any] = {"type": "input_image", "image_url": url}
+            # Preserve detail if specified
+            detail = image_data.get("detail") if isinstance(image_data, dict) else None
+            if detail:
+                entry["detail"] = detail
+            converted.append(entry)
+        elif ptype in {"input_text", "input_image"}:
+            # Already in Responses format — pass through
+            converted.append(part)
+        else:
+            # Unknown content type — try to preserve as text
+            text = part.get("text", "")
+            if text:
+                converted.append({"type": "input_text", "text": text})
+
+    return converted or ""
+
+
 class _CodexCompletionsAdapter:
     """Drop-in shim that accepts chat.completions.create() kwargs and
     routes them through the Codex Responses streaming API."""
@@ -649,37 +625,26 @@ class _CodexCompletionsAdapter:
         messages = kwargs.get("messages", [])
         model = kwargs.get("model", self._model)
 
-        # Separate system/instructions from replayable conversation messages,
-        # then route the rest through the SINGLE shared chat->Responses
-        # converter used by the main agent transport
-        # (agent/transports/codex.py). Maintaining a private conversion loop
-        # here let chat-style messages with role="tool" leak straight into
-        # Responses input[] — which the Responses API rejects with
-        # "Invalid value: 'tool'. Supported values are: 'assistant', 'system',
-        # 'developer', and 'user'." (issue #5709, hit hard by flush_memories()
-        # / compression replaying real session history that includes assistant
-        # tool_calls + role="tool" results). The shared converter encodes
-        # assistant tool calls as `function_call` items and tool results as
-        # `function_call_output` items with a valid call_id, so every
-        # Responses path normalizes tool history identically and cannot drift.
-        from agent.codex_responses_adapter import _chat_messages_to_responses_input
-
+        # Separate system/instructions from conversation messages.
+        # Convert chat.completions multimodal content blocks to Responses
+        # API format (input_text / input_image instead of text / image_url).
         instructions = "You are a helpful assistant."
-        replay_messages: List[Dict[str, Any]] = []
+        input_msgs: List[Dict[str, Any]] = []
         for msg in messages:
             role = msg.get("role", "user")
             content = msg.get("content") or ""
             if role == "system":
                 instructions = content if isinstance(content, str) else str(content)
             else:
-                replay_messages.append(msg)
-
-        input_items = _chat_messages_to_responses_input(replay_messages)
+                input_msgs.append({
+                    "role": role,
+                    "content": _convert_content_for_responses(content),
+                })
 
         resp_kwargs: Dict[str, Any] = {
             "model": model,
             "instructions": instructions,
-            "input": input_items or [{"role": "user", "content": ""}],
+            "input": input_msgs or [{"role": "user", "content": ""}],
             "store": False,
         }
 
@@ -1487,9 +1452,6 @@ def _resolve_api_key_provider() -> Tuple[Optional[OpenAI], Optional[str]]:
                         extra["default_headers"] = dict(_ph_aux.default_headers)
                 except Exception:
                     pass
-            _merged_aux = _apply_user_default_headers(extra.get("default_headers"))
-            if _merged_aux:
-                extra["default_headers"] = _merged_aux
             _client = OpenAI(api_key=api_key, base_url=base_url, **extra)
             _client = _maybe_wrap_anthropic(_client, model, api_key, raw_base_url)
             return _client, model
@@ -1527,9 +1489,6 @@ def _resolve_api_key_provider() -> Tuple[Optional[OpenAI], Optional[str]]:
                     extra["default_headers"] = dict(_ph_aux2.default_headers)
             except Exception:
                 pass
-        _merged_aux2 = _apply_user_default_headers(extra.get("default_headers"))
-        if _merged_aux2:
-            extra["default_headers"] = _merged_aux2
         _client = OpenAI(api_key=api_key, base_url=base_url, **extra)
         _client = _maybe_wrap_anthropic(_client, model, api_key, raw_base_url)
         return _client, model
@@ -1920,13 +1879,6 @@ def _try_custom_endpoint() -> Tuple[Optional[Any], Optional[str]]:
     logger.debug("Auxiliary client: custom endpoint (%s, api_mode=%s)", model, custom_mode or "chat_completions")
     _clean_base, _dq = _extract_url_query_params(custom_base)
     _extra = {"default_query": _dq} if _dq else {}
-    # User-configured model.default_headers override the SDK's identifying
-    # headers (User-Agent: OpenAI/Python ..., X-Stainless-*) on this custom
-    # endpoint's auxiliary calls too — matching the main agent client so the
-    # whole session reaches a gateway/WAF that rejects the SDK fingerprint. (#40033)
-    _custom_headers = _apply_user_default_headers(None)
-    if _custom_headers:
-        _extra["default_headers"] = _custom_headers
     if custom_mode == "codex_responses":
         real_client = OpenAI(api_key=custom_key, base_url=_clean_base, **_extra)
         return CodexAuxiliaryClient(real_client, model), model
@@ -2476,25 +2428,6 @@ def _is_connection_error(exc: Exception) -> bool:
     return False
 
 
-def _is_transient_transport_error(exc: Exception) -> bool:
-    """Return True for a one-off transport blip worth retrying ONCE on the
-    same provider before any provider/model fallback.
-
-    Covers connection/streaming-close errors (via the canonical
-    ``_is_connection_error`` detector, shared so the two cannot drift) plus a
-    pure 5xx/408 HTTP status. Deliberately narrow: this is the "retry the
-    same target once" gate, distinct from ``_is_payment_error`` /
-    ``_is_auth_error`` / ``_is_rate_limit_error`` which the except-chain
-    handles by switching provider, refreshing creds, or rotating the pool.
-    """
-    if _is_connection_error(exc):
-        return True
-    status = getattr(exc, "status_code", None) or getattr(
-        getattr(exc, "response", None), "status_code", None
-    )
-    return isinstance(status, int) and (status == 408 or 500 <= status < 600)
-
-
 def _is_auth_error(exc: Exception) -> bool:
     """Detect auth failures that should trigger provider-specific refresh."""
     status = getattr(exc, "status_code", None)
@@ -3315,9 +3248,6 @@ def _to_async_client(sync_client, model: str, is_vision: bool = False):
                     async_kwargs["default_headers"] = dict(_ph_async.default_headers)
         except Exception:
             pass
-    _merged_async = _apply_user_default_headers(async_kwargs.get("default_headers"))
-    if _merged_async:
-        async_kwargs["default_headers"] = _merged_async
     return AsyncOpenAI(**async_kwargs), model
 
 
@@ -3605,9 +3535,6 @@ def resolve_provider_client(
                         extra["default_headers"] = dict(_ph_custom.default_headers)
                 except Exception:
                     pass
-            _merged_custom = _apply_user_default_headers(extra.get("default_headers"))
-            if _merged_custom:
-                extra["default_headers"] = _merged_custom
             client = OpenAI(api_key=custom_key, base_url=_clean_base, **extra)
             client = _wrap_if_needed(client, final_model, custom_base, custom_key)
             return (_to_async_client(client, final_model, is_vision=is_vision) if async_mode
@@ -3684,9 +3611,6 @@ def resolve_provider_client(
                     raw_base_for_wrap = custom_base
                 _clean_base2, _dq2 = _extract_url_query_params(openai_base)
                 _extra2 = {"default_query": _dq2} if _dq2 else {}
-                _headers2 = _apply_user_default_headers(_extra2.get("default_headers"))
-                if _headers2:
-                    _extra2["default_headers"] = _headers2
                 logger.debug(
                     "resolve_provider_client: named custom provider %r (%s, api_mode=%s)",
                     provider, final_model, entry_api_mode or "chat_completions")
@@ -3709,9 +3633,6 @@ def resolve_provider_client(
                         _fallback_base = _to_openai_base_url(custom_base)
                         _fb_clean, _fb_dq = _extract_url_query_params(_fallback_base)
                         _fb_extra = {"default_query": _fb_dq} if _fb_dq else {}
-                        _fb_headers = _apply_user_default_headers(_fb_extra.get("default_headers"))
-                        if _fb_headers:
-                            _fb_extra["default_headers"] = _fb_headers
                         client = OpenAI(api_key=custom_key, base_url=_fb_clean, **_fb_extra)
                         return (_to_async_client(client, final_model, is_vision=is_vision) if async_mode
                                 else (client, final_model))
@@ -3860,9 +3781,6 @@ def resolve_provider_client(
                     headers.update(_ph_main.default_headers)
             except Exception:
                 pass
-        _merged_main = _apply_user_default_headers(headers)
-        if _merged_main:
-            headers = _merged_main
         client = OpenAI(api_key=api_key, base_url=base_url,
                         **({"default_headers": headers} if headers else {}))
 
@@ -4300,15 +4218,13 @@ def get_auxiliary_extra_body() -> dict:
     return _nous_extra_body() if auxiliary_is_nous else {}
 
 
-def auxiliary_max_tokens_param(value: int, *, model: Optional[str] = None) -> dict:
+def auxiliary_max_tokens_param(value: int) -> dict:
     """Return the correct max tokens kwarg for the auxiliary client's provider.
-
+    
     OpenRouter and local models use 'max_tokens'. Direct OpenAI with newer
-    models (gpt-4o, gpt-4.1, gpt-5+, o-series) requires 'max_completion_tokens'.
+    models (gpt-4o, o-series, gpt-5+) requires 'max_completion_tokens'.
     The Codex adapter translates max_tokens internally, so we use max_tokens
-    for it as well. Pass ``model`` so third-party OpenAI-compatible endpoints
-    fronting the newer families are also recognised — URL-only detection
-    misses the case where a custom base URL serves e.g. ``gpt-5.4``.
+    for it as well.
     """
     custom_base = _current_custom_base_url()
     or_key = os.getenv("OPENROUTER_API_KEY")
@@ -4318,9 +4234,6 @@ def auxiliary_max_tokens_param(value: int, *, model: Optional[str] = None) -> di
             and _read_nous_auth() is None
             and base_url_hostname(custom_base) in {"api.openai.com", "api.githubcopilot.com"}):
         return {"max_completion_tokens": value}
-    # ...and for any caller serving a newer OpenAI-family model by name.
-    if model_forces_max_completion_tokens(model):
-        return {"max_completion_tokens": value}
     return {"max_tokens": value}
 
 
@@ -5171,28 +5084,8 @@ def call_llm(
     # Handle unsupported temperature, max_tokens vs max_completion_tokens retry,
     # then payment fallback.
     try:
-        # Retry ONCE on the same provider for a one-off transient transport
-        # blip (streaming-close / incomplete chunked read / 5xx / 408) before
-        # the except-chain below escalates to provider/model fallback. A
-        # single dropped connection shouldn't abandon an otherwise-healthy
-        # provider. A second failure (or any non-transient error) falls
-        # through to ``first_err`` and the existing fallback handling
-        # unchanged. This is the unified home for the transient retry that
-        # every auxiliary task (compression, memory flush, title-gen,
-        # session-search, vision) shares. (PR #16587)
-        try:
-            return _validate_llm_response(
-                client.chat.completions.create(**kwargs), task)
-        except Exception as transient_err:
-            if not _is_transient_transport_error(transient_err):
-                raise
-            logger.info(
-                "Auxiliary %s: transient transport error; retrying once on "
-                "the same provider before fallback: %s",
-                task or "call", transient_err,
-            )
-            return _validate_llm_response(
-                client.chat.completions.create(**kwargs), task)
+        return _validate_llm_response(
+            client.chat.completions.create(**kwargs), task)
     except Exception as first_err:
         if "temperature" in kwargs and _is_unsupported_temperature_error(first_err):
             retry_kwargs = dict(kwargs)
@@ -5658,22 +5551,8 @@ async def async_call_llm(
         kwargs["messages"] = _convert_openai_images_to_anthropic(kwargs["messages"])
 
     try:
-        # Retry ONCE on the same provider for a transient transport blip
-        # before the except-chain escalates to fallback — see call_llm()
-        # for the rationale. (PR #16587)
-        try:
-            return _validate_llm_response(
-                await client.chat.completions.create(**kwargs), task)
-        except Exception as transient_err:
-            if not _is_transient_transport_error(transient_err):
-                raise
-            logger.info(
-                "Auxiliary %s (async): transient transport error; retrying "
-                "once on the same provider before fallback: %s",
-                task or "call", transient_err,
-            )
-            return _validate_llm_response(
-                await client.chat.completions.create(**kwargs), task)
+        return _validate_llm_response(
+            await client.chat.completions.create(**kwargs), task)
     except Exception as first_err:
         if "temperature" in kwargs and _is_unsupported_temperature_error(first_err):
             retry_kwargs = dict(kwargs)

agent/background_review.py

@@ -449,17 +449,6 @@ def _run_review_in_thread(
             # if a future code path bypasses the cache.
             review_agent.session_start = agent.session_start
             review_agent.session_id = agent.session_id
-            # Never let the review fork compress. It shares the parent's
-            # session_id, so if it won a compression race it would rotate the
-            # parent into a NEW child that the gateway never adopts (the fork
-            # is single-lifecycle and dies right after this run_conversation).
-            # The foreground turn would then start from the stale parent and
-            # compress it again, leaving the same parent with two sibling
-            # children (issue #38727). Review also needs full context to
-            # produce a good memory/skill summary — compressing would strip
-            # detail. Both compression triggers in conversation_loop.py gate on
-            # agent.compression_enabled, so this short-circuits both paths.
-            review_agent.compression_enabled = False
 
             from model_tools import get_tool_definitions
             from hermes_cli.plugins import (

agent/chat_completion_helpers.py

@@ -34,7 +34,7 @@ from agent.message_sanitization import (
     _repair_tool_call_arguments,
 )
 from tools.terminal_tool import is_persistent_env
-from utils import base_url_host_matches, base_url_hostname, env_int
+from utils import base_url_host_matches, base_url_hostname
 
 logger = logging.getLogger(__name__)
 
@@ -139,15 +139,6 @@ def interruptible_api_call(agent, api_kwargs: dict):
     result = {"response": None, "error": None}
     request_client_holder = {"client": None, "owner_tid": None}
     request_client_lock = threading.Lock()
-    # Request-local cancellation flag. Distinct from agent._interrupt_requested
-    # because that flag is cleared at run_conversation() turn boundaries, but
-    # this daemon worker thread can outlive the turn (the gateway caches
-    # AIAgent instances per session). Tracks whether THIS specific request was
-    # cancelled by the main thread's interrupt handler, so the transport error
-    # that is the expected consequence of our own force-close isn't misread as
-    # a network bug and surfaced to the caller. (PR #6600 — cascading interrupt
-    # hang.)
-    _request_cancelled = {"value": False}
 
     def _set_request_client(client):
         with request_client_lock:
@@ -238,17 +229,6 @@ def interruptible_api_call(agent, api_kwargs: dict):
                 )
                 result["response"] = request_client.chat.completions.create(**api_kwargs)
         except Exception as e:
-            # If the request was cancelled by the main thread's interrupt
-            # handler, the transport error is the expected consequence of our
-            # own force-close, NOT a network bug. Swallow it instead of
-            # surfacing — the main thread raises InterruptedError. (#6600)
-            if _request_cancelled["value"]:
-                logger.debug(
-                    "Non-streaming worker caught %s after request cancellation — "
-                    "exiting without surfacing a network error.",
-                    type(e).__name__,
-                )
-                return
             result["error"] = e
         finally:
             _close_request_client_once("request_complete")
@@ -526,14 +506,6 @@ def interruptible_api_call(agent, api_kwargs: dict):
             break
 
         if agent._interrupt_requested:
-            # Mark THIS request cancelled before force-closing so the worker's
-            # exception handler recognizes the forced transport error as a
-            # cancel and exits cleanly instead of surfacing a network error or
-            # (in the streaming path) burning full retry cycles. (#6600)
-            _request_cancelled["value"] = True
-            logger.debug(
-                "Force-closing httpx client due to interrupt (not a network error)."
-            )
             # Force-close the in-flight worker-local HTTP connection to stop
             # token generation without poisoning the shared client used to
             # seed future retries.
@@ -1653,14 +1625,6 @@ def interruptible_streaming_api_call(agent, api_kwargs: dict, *, on_first_delta=
     result = {"response": None, "error": None, "partial_tool_names": []}
     request_client_holder = {"client": None, "diag": None, "owner_tid": None}
     request_client_lock = threading.Lock()
-    # Request-local cancellation flag — see interruptible_api_call for the full
-    # rationale. The streaming retry loop is where the 7-minute cascading-
-    # interrupt hang originated: a force-close raised RemoteProtocolError, the
-    # loop classified it as a transient network error, and burned full retry
-    # cycles (and emitted "reconnecting" noise) on a request the user already
-    # cancelled. The token lets the worker recognize its own forced close and
-    # exit immediately instead of retrying. (PR #6600.)
-    _request_cancelled = {"value": False}
 
     def _set_request_client(client):
         with request_client_lock:
@@ -1972,72 +1936,6 @@ def interruptible_streaming_api_call(agent, api_kwargs: dict, *, on_first_delta=
                     ),
                 ))
 
-        # Zero-chunk guard: stream yielded nothing usable — a provider/upstream
-        # error or malformed SSE, not a legitimate empty completion. Raise so the
-        # retry machinery handles it instead of fabricating a successful turn.
-        if (
-            finish_reason is None
-            and not content_parts
-            and not reasoning_parts
-            and not tool_calls_acc
-        ):
-            raise RuntimeError(
-                "Provider returned an empty stream with no finish_reason "
-                "(possible upstream error or malformed SSE response)."
-            )
-
-        # A stream that delivered a tool call but only partial/unparseable
-        # JSON args splits into two very different cases:
-        #
-        #   1. Provider sent finish_reason="length" → a genuine output-cap
-        #      truncation.  Boosting max_tokens on retry is the right move.
-        #
-        #   2. Provider sent NO finish_reason (the SSE simply stopped after
-        #      the opening "{" with no terminator and no [DONE]) → the
-        #      upstream dropped/stalled the connection mid tool-call.  This
-        #      is NOT an output cap — the model never reported hitting one.
-        #      Some dedicated endpoints (e.g. NVIDIA Nemotron Ultra on the
-        #      Nous dedicated endpoint) stall for minutes during large
-        #      tool-arg generation, then close the stream cleanly without a
-        #      finish_reason.  Stamping "length" here sends it down the
-        #      max_tokens-boost truncation path, which retries 3× to no
-        #      effect and finally reports the misleading "Response truncated
-        #      due to output length limit" — the red herring this guards
-        #      against.  Route it through the partial-stream-stub path
-        #      instead so the loop reports an honest mid-tool-call stream
-        #      drop and fails fast rather than escalating output budget.
-        _tool_args_dropped_no_finish = has_truncated_tool_args and finish_reason is None
-        if _tool_args_dropped_no_finish:
-            _dropped_names = [
-                (tool_calls_acc[idx]["function"]["name"] or "?")
-                for idx in sorted(tool_calls_acc)
-            ]
-            logger.warning(
-                "Stream ended with no finish_reason while a tool call's "
-                "arguments were still incomplete (tools=%s); treating as a "
-                "mid-tool-call stream drop, not an output-length truncation.",
-                _dropped_names,
-            )
-            full_reasoning = "".join(reasoning_parts) or None
-            mock_message = SimpleNamespace(
-                role=role,
-                content=full_content,
-                tool_calls=None,
-                reasoning_content=full_reasoning,
-            )
-            mock_choice = SimpleNamespace(
-                index=0,
-                message=mock_message,
-                finish_reason=FINISH_REASON_LENGTH,
-            )
-            return SimpleNamespace(
-                id=PARTIAL_STREAM_STUB_ID,
-                model=model_name,
-                choices=[mock_choice],
-                usage=usage_obj,
-                _dropped_tool_names=_dropped_names or None,
-            )
-
         effective_finish_reason = finish_reason or "stop"
         if has_truncated_tool_args:
             effective_finish_reason = "length"
@@ -2076,14 +1974,6 @@ def interruptible_streaming_api_call(agent, api_kwargs: dict, *, on_first_delta=
         # Per-attempt diagnostic dict for the retry block to consume.
         _diag = agent._stream_diag_init()
         request_client_holder["diag"] = _diag
-        # Defensive: strip Responses-only kwargs (instructions, input, ...)
-        # that can leak in under an api_mode-flip race. The Anthropic SDK
-        # raises a non-retryable TypeError on them, killing the turn. See
-        # #31673 / sanitize_anthropic_kwargs().
-        from agent.anthropic_adapter import sanitize_anthropic_kwargs
-        sanitize_anthropic_kwargs(
-            api_kwargs, log_prefix=getattr(agent, "log_prefix", "")
-        )
         # Use the Anthropic SDK's streaming context manager
         with agent._anthropic_client.messages.stream(**api_kwargs) as stream:
             # The Anthropic SDK exposes the raw httpx response on
@@ -2154,7 +2044,7 @@ def interruptible_streaming_api_call(agent, api_kwargs: dict, *, on_first_delta=
     def _call():
         import httpx as _httpx
 
-        _max_stream_retries = env_int("HERMES_STREAM_RETRIES", 2)
+        _max_stream_retries = int(os.getenv("HERMES_STREAM_RETRIES", 2))
 
         try:
             for _stream_attempt in range(_max_stream_retries + 1):
@@ -2174,21 +2064,6 @@ def interruptible_streaming_api_call(agent, api_kwargs: dict, *, on_first_delta=
                         result["response"] = _call_chat_completions()
                     return  # success
                 except Exception as e:
-                    # If the main poll loop force-closed this request because
-                    # of an interrupt, the resulting transport error is the
-                    # expected consequence of our own close — NOT a transient
-                    # network error. Exit immediately: no retry, no fallback,
-                    # no "reconnecting" status. The outer poll loop raises
-                    # InterruptedError. This is the fix for the cascading-
-                    # interrupt hang where doomed retries burned full
-                    # stream-stale-timeout cycles. (#6600)
-                    if _request_cancelled["value"]:
-                        logger.debug(
-                            "Streaming worker caught %s after request "
-                            "cancellation — exiting without retry.",
-                            type(e).__name__,
-                        )
-                        return
                     _is_timeout = isinstance(
                         e, (_httpx.ReadTimeout, _httpx.ConnectTimeout, _httpx.PoolTimeout)
                     )
@@ -2498,15 +2373,6 @@ def interruptible_streaming_api_call(agent, api_kwargs: dict, *, on_first_delta=
             )
 
         if agent._interrupt_requested:
-            # Mark THIS request cancelled before force-closing so the worker's
-            # exception handler recognizes the forced transport error as a
-            # cancel and exits without retrying or surfacing a network error.
-            # (#6600)
-            _request_cancelled["value"] = True
-            logger.debug(
-                "Force-closing streaming httpx client due to interrupt "
-                "(not a network error)."
-            )
             try:
                 if agent.api_mode == "anthropic_messages":
                     agent._anthropic_client.close()

agent/codex_runtime.py

@@ -25,154 +25,6 @@ from typing import Any, Dict, List
 logger = logging.getLogger(__name__)
 
 
-def _coerce_usage_int(value: Any) -> int:
-    if isinstance(value, bool):
-        return 0
-    if isinstance(value, int):
-        return max(value, 0)
-    if isinstance(value, float):
-        return max(int(value), 0)
-    if isinstance(value, str):
-        try:
-            return max(int(value), 0)
-        except ValueError:
-            return 0
-    return 0
-
-
-def _record_codex_app_server_usage(agent, turn) -> dict[str, Any]:
-    """Translate Codex app-server token usage into Hermes accounting.
-
-    Codex app-server reports usage via thread/tokenUsage/updated as:
-    inputTokens, cachedInputTokens, outputTokens, reasoningOutputTokens,
-    totalTokens.
-
-    Hermes' canonical prompt bucket includes uncached input + cached input.
-    The Codex app-server protocol does not currently expose cache-write tokens,
-    so that bucket remains zero on this runtime.
-
-    Even when Codex omits usage for a turn, Hermes should still count that turn
-    as one API call for session/status accounting.
-    """
-    agent.session_api_calls += 1
-
-    usage = getattr(turn, "token_usage_last", None)
-    if not isinstance(usage, dict) or not usage:
-        if agent._session_db and agent.session_id:
-            try:
-                if not agent._session_db_created:
-                    agent._ensure_db_session()
-                agent._session_db.update_token_counts(
-                    agent.session_id,
-                    model=agent.model,
-                    api_call_count=1,
-                )
-            except Exception as exc:
-                logger.debug(
-                    "Codex app-server api-call persistence failed (session=%s): %s",
-                    agent.session_id, exc,
-                )
-        return {}
-
-    from agent.usage_pricing import CanonicalUsage, estimate_usage_cost
-
-    input_tokens = _coerce_usage_int(usage.get("inputTokens"))
-    cache_read_tokens = _coerce_usage_int(usage.get("cachedInputTokens"))
-    output_tokens = _coerce_usage_int(usage.get("outputTokens"))
-    reasoning_tokens = _coerce_usage_int(usage.get("reasoningOutputTokens"))
-    reported_total = _coerce_usage_int(usage.get("totalTokens"))
-
-    canonical_usage = CanonicalUsage(
-        input_tokens=input_tokens,
-        output_tokens=output_tokens,
-        cache_read_tokens=cache_read_tokens,
-        cache_write_tokens=0,
-        reasoning_tokens=reasoning_tokens,
-        raw_usage=usage,
-    )
-    prompt_tokens = canonical_usage.prompt_tokens
-    completion_tokens = canonical_usage.output_tokens
-    total_tokens = reported_total or canonical_usage.total_tokens
-    usage_dict = {
-        "prompt_tokens": prompt_tokens,
-        "completion_tokens": completion_tokens,
-        "total_tokens": total_tokens,
-        "input_tokens": canonical_usage.input_tokens,
-        "output_tokens": canonical_usage.output_tokens,
-        "cache_read_tokens": canonical_usage.cache_read_tokens,
-        "cache_write_tokens": canonical_usage.cache_write_tokens,
-        "reasoning_tokens": canonical_usage.reasoning_tokens,
-    }
-
-    compressor = getattr(agent, "context_compressor", None)
-    if compressor is not None:
-        try:
-            compressor.update_from_response(usage_dict)
-            context_window = getattr(turn, "model_context_window", None)
-            if isinstance(context_window, int) and context_window > 0:
-                compressor.context_length = context_window
-        except Exception:
-            logger.debug("codex app-server usage update failed", exc_info=True)
-
-    agent.session_prompt_tokens += prompt_tokens
-    agent.session_completion_tokens += completion_tokens
-    agent.session_total_tokens += total_tokens
-    agent.session_input_tokens += canonical_usage.input_tokens
-    agent.session_output_tokens += canonical_usage.output_tokens
-    agent.session_cache_read_tokens += canonical_usage.cache_read_tokens
-    agent.session_cache_write_tokens += canonical_usage.cache_write_tokens
-    agent.session_reasoning_tokens += canonical_usage.reasoning_tokens
-
-    cost_result = estimate_usage_cost(
-        agent.model,
-        canonical_usage,
-        provider=agent.provider,
-        base_url=agent.base_url,
-        api_key=getattr(agent, "api_key", ""),
-    )
-    if cost_result.amount_usd is not None:
-        agent.session_estimated_cost_usd += float(cost_result.amount_usd)
-    agent.session_cost_status = cost_result.status
-    agent.session_cost_source = cost_result.source
-
-    if agent._session_db and agent.session_id:
-        try:
-            if not agent._session_db_created:
-                agent._ensure_db_session()
-            agent._session_db.update_token_counts(
-                agent.session_id,
-                input_tokens=canonical_usage.input_tokens,
-                output_tokens=canonical_usage.output_tokens,
-                cache_read_tokens=canonical_usage.cache_read_tokens,
-                cache_write_tokens=canonical_usage.cache_write_tokens,
-                reasoning_tokens=canonical_usage.reasoning_tokens,
-                estimated_cost_usd=float(cost_result.amount_usd)
-                if cost_result.amount_usd is not None else None,
-                cost_status=cost_result.status,
-                cost_source=cost_result.source,
-                billing_provider=agent.provider,
-                billing_base_url=agent.base_url,
-                billing_mode="subscription_included"
-                if cost_result.status == "included" else None,
-                model=agent.model,
-                api_call_count=1,
-            )
-        except Exception as exc:
-            logger.debug(
-                "Codex app-server token persistence failed (session=%s, tokens=%d): %s",
-                agent.session_id, total_tokens, exc,
-            )
-
-    return {
-        **usage_dict,
-        "last_prompt_tokens": prompt_tokens,
-        "estimated_cost_usd": float(cost_result.amount_usd)
-        if cost_result.amount_usd is not None else None,
-        "cost_status": cost_result.status,
-        "cost_source": cost_result.source,
-    }
-
-
 def run_codex_app_server_turn(
     agent,
     *,
@@ -268,8 +120,6 @@ def run_codex_app_server_turn(
     agent._iters_since_skill = (
         getattr(agent, "_iters_since_skill", 0) + turn.tool_iterations
     )
-    usage_result = _record_codex_app_server_usage(agent, turn)
-    api_calls = 1
 
     # Now check the skill nudge AFTER iters were incremented — same
     # pattern the chat_completions path uses (line ~15432).
@@ -314,13 +164,12 @@ def run_codex_app_server_turn(
     return {
         "final_response": turn.final_text,
         "messages": messages,
-        "api_calls": api_calls,
+        "api_calls": 1,  # one app-server "turn" maps to one logical API call
         "completed": not turn.interrupted and turn.error is None,
         "partial": turn.interrupted or turn.error is not None,
         "error": turn.error,
         "codex_thread_id": turn.thread_id,
         "codex_turn_id": turn.turn_id,
-        **usage_result,
     }
 
 

agent/context_compressor.py

@@ -553,22 +553,6 @@ class ContextCompressor(ContextEngine):
         self.last_rough_tokens_when_real_prompt_fit = 0
         self.awaiting_real_usage_after_compression = False
 
-    def on_session_end(self, session_id: str, messages: List[Dict[str, Any]]) -> None:
-        """Clear per-session compaction state at a real session boundary.
-
-        ``_previous_summary`` is per-session iterative-summary state. It is
-        cleared on ``on_session_reset()`` (/new, /reset), but session *end*
-        (CLI exit, gateway expiry, session-id rotation) goes through
-        ``on_session_end()`` instead — which inherited a no-op from
-        ``ContextEngine``. Without clearing here, a cron/background session's
-        summary could survive on a reused compressor instance and leak into the
-        next live session via the ``_generate_summary()`` iterative-update path
-        (#38788). ``compress()`` already guards the leak at the point of use;
-        this is defense-in-depth that drops the stale summary the moment the
-        owning session ends.
-        """
-        self._previous_summary = None
-
     def update_model(
         self,
         model: str,
@@ -1263,19 +1247,6 @@ Summary generation was unavailable, so this is a best-effort deterministic fallb
         summary_budget = self._compute_summary_budget(turns_to_summarize)
         content_to_summarize = self._serialize_for_summary(turns_to_summarize)
 
-        # Current date for temporal anchoring (see ## Temporal Anchoring below).
-        # Date-only granularity matches system_prompt.py:337 (PR #20451) and the
-        # user's configured timezone via hermes_time.now(). The compaction summary
-        # is a mid-conversation message that is NOT part of the cached prefix, so a
-        # date here never affects prompt-cache stability. Resolved defensively —
-        # a clock failure must never block compaction.
-        try:
-            from hermes_time import now as _hermes_now
-
-            _today_str = _hermes_now().strftime("%Y-%m-%d")
-        except Exception:  # pragma: no cover - clock resolution is best-effort
-            _today_str = ""
-
         # Preamble shared by both first-compaction and iterative-update prompts.
         # Keep the wording deliberately plain: Azure/OpenAI-compatible content
         # filters have flagged stronger "injection" / "do not respond" framing.
@@ -1293,24 +1264,6 @@ Summary generation was unavailable, so this is a best-effort deterministic fallb
             "do not preserve their values."
         )
 
-        # Temporal anchoring directive. Rewrites relative / still-pending-sounding
-        # references into absolute, dated, past-tense facts so a resumed
-        # conversation does not re-issue completed actions. Only emitted when the
-        # current date resolved successfully; otherwise the rule is omitted so the
-        # summarizer is never handed an empty date placeholder.
-        if _today_str:
-            _temporal_anchoring_rule = (
-                f"\nTEMPORAL ANCHORING: The current date is {_today_str}. When an "
-                "action has already been carried out, phrase it as a completed, "
-                "dated, past-tense fact rather than an open instruction. For "
-                'example, rewrite "email John about the proposal" as "Sent the '
-                f'proposal email to John on {_today_str}." Never leave a finished '
-                "action worded as if it still needs doing, and never invent a date "
-                "for work that has not happened yet.\n"
-            )
-        else:
-            _temporal_anchoring_rule = ""
-
         # Shared structured template (used by both paths).
         _template_sections = f"""## Active Task
 [THE SINGLE MOST IMPORTANT FIELD. Capture the user's most recent unfulfilled
@@ -1384,7 +1337,7 @@ Be specific with file paths, commands, line numbers, and results.]
 [Any specific values, error messages, configuration details, or data that would be lost without explicit preservation. NEVER include API keys, tokens, passwords, or credentials — write [REDACTED] instead.]
 
 Target ~{summary_budget} tokens. Be CONCRETE — include file paths, command outputs, error messages, line numbers, and specific values. Avoid vague descriptions like "made some changes" — say exactly what changed.
-{_temporal_anchoring_rule}
+
 Write only the summary body. Do not include any preamble or prefix."""
 
         if self._previous_summary:
@@ -1834,41 +1787,6 @@ The user has requested that this compaction PRIORITISE preserving all informatio
             accumulated += msg_tokens
             cut_idx = i
 
-        # If the backward walk never broke early because the entire transcript
-        # fits within soft_ceiling, accumulated now holds the total transcript
-        # size.  Without intervention _ensure_last_user_message_in_tail pushes
-        # cut_idx forward to include the last user message, and the caller's
-        # compress_start >= compress_end guard either returns unchanged (no-op)
-        # or compresses a single message — both of which trigger the infinite
-        # compaction loop described in #40803.
-        #
-        # Fix: when the whole transcript fits in soft_ceiling, compute a
-        # meaningful cut point using the raw (non-inflated) budget so that
-        # compression actually summarizes a worthwhile middle section.
-        if cut_idx <= head_end and accumulated <= soft_ceiling and accumulated > 0:
-            # The entire compressable region fits in the soft ceiling.
-            # Re-walk with the raw budget (no 1.5x multiplier) to find a
-            # split that gives the summarizer something useful.
-            raw_budget = token_budget
-            raw_accumulated = 0
-            for j in range(n - 1, head_end - 1, -1):
-                raw_msg = messages[j]
-                raw_content = raw_msg.get("content") or ""
-                raw_len = _content_length_for_budget(raw_content)
-                raw_tok = raw_len // _CHARS_PER_TOKEN + 10
-                for tc in raw_msg.get("tool_calls") or []:
-                    if isinstance(tc, dict):
-                        args = tc.get("function", {}).get("arguments", "")
-                        raw_tok += len(args) // _CHARS_PER_TOKEN
-                if raw_accumulated + raw_tok > raw_budget and (n - j) >= min_tail:
-                    cut_idx = j
-                    break
-                raw_accumulated += raw_tok
-                cut_idx = j
-            # If the raw-budget walk also consumed everything (very small
-            # transcript), fall through — the existing fallback logic below
-            # will still force a minimal cut after head_end.
-
         # Ensure we protect at least min_tail messages
         fallback_cut = n - min_tail
         cut_idx = min(cut_idx, fallback_cut)
@@ -1971,21 +1889,6 @@ The user has requested that this compaction PRIORITISE preserving all informatio
         compress_end = self._find_tail_cut_by_tokens(messages, compress_start)
 
         if compress_start >= compress_end:
-            # No compressable window — the entire transcript fits within
-            # the tail budget (soft_ceiling).  Without recording this as
-            # an ineffective compression the anti-thrashing guard in
-            # should_compress() never fires and every subsequent turn
-            # re-triggers a no-op compression loop.  (#40803)
-            self._ineffective_compression_count += 1
-            self._last_compression_savings_pct = 0.0
-            if not self.quiet_mode:
-                logger.warning(
-                    "Compression skipped: compress_start (%d) >= compress_end (%d) "
-                    "— transcript fits within tail budget, nothing to compress. "
-                    "ineffective_compression_count=%d",
-                    compress_start, compress_end,
-                    self._ineffective_compression_count,
-                )
             return messages
 
         turns_to_summarize = messages[compress_start:compress_end]
@@ -2006,13 +1909,6 @@ The user has requested that this compaction PRIORITISE preserving all informatio
             if summary_body and not self._previous_summary:
                 self._previous_summary = summary_body
             turns_to_summarize = messages[max(compress_start, summary_idx + 1):compress_end]
-        elif self._previous_summary:
-            # No handoff summary found in the current messages, but
-            # _previous_summary is non-empty — it was set by a different
-            # (now-ended) session (e.g., a cron job, a prior /new).  Discard
-            # it so _generate_summary() does not inject cross-session content
-            # into the summarizer prompt via the iterative-update path.
-            self._previous_summary = None
 
         if not self.quiet_mode:
             logger.info(

agent/context_references.py

@@ -246,14 +246,7 @@ def _expand_file_reference(
     if not path.is_file():
         return f"{ref.raw}: path is not a file", None
     if _is_binary_file(path):
-        # A binary file can't be inlined as text, but it IS on disk (the agent's
-        # tools run where this resolves — the local cwd, or the staged copy in a
-        # remote session workspace). Returning a bare "not supported" warning
-        # with no content was a dead end: the model saw a failure and gave up
-        # (told the user the file type wasn't supported). Instead, hand it an
-        # actionable block — the path, type, size, and a nudge to use its tools —
-        # so it can read/convert/view the file itself.
-        return None, _binary_reference_block(ref, path)
+        return f"{ref.raw}: binary files are not supported", None
 
     text = path.read_text(encoding="utf-8")
     if ref.line_start is not None:
@@ -297,7 +290,6 @@ def _expand_git_reference(
             capture_output=True,
             text=True,
             timeout=30,
-            stdin=subprocess.DEVNULL,
         )
     except subprocess.TimeoutExpired:
         return f"{ref.raw}: git command timed out (30s)", None
@@ -490,7 +482,6 @@ def _rg_files(path: Path, cwd: Path, limit: int) -> list[Path] | None:
             capture_output=True,
             text=True,
             timeout=10,
-            stdin=subprocess.DEVNULL,
         )
     except (FileNotFoundError, OSError, subprocess.TimeoutExpired):
         return None
@@ -500,30 +491,6 @@ def _rg_files(path: Path, cwd: Path, limit: int) -> list[Path] | None:
     return files[:limit]
 
 
-def _human_bytes(n: int) -> str:
-    size = float(n)
-    for unit in ("B", "KB", "MB", "GB"):
-        if size < 1024 or unit == "GB":
-            return f"{int(size)} {unit}" if unit == "B" else f"{size:.1f} {unit}"
-        size /= 1024
-    return f"{size:.1f} GB"
-
-
-def _binary_reference_block(ref: ContextReference, path: Path) -> str:
-    mime, _ = mimetypes.guess_type(path.name)
-    mime = mime or "application/octet-stream"
-    try:
-        size = _human_bytes(path.stat().st_size)
-    except OSError:
-        size = "unknown size"
-    return (
-        f"📎 {ref.raw} ({mime}, {size}) — binary file, not inlined as text. "
-        f"It is available on disk at `{path}`. Use your tools to work with it "
-        f"(read or convert it, extract its text, or view/render it as needed); "
-        f"do not tell the user the file type is unsupported."
-    )
-
-
 def _file_metadata(path: Path) -> str:
     if _is_binary_file(path):
         return f"{path.stat().st_size} bytes"

agent/conversation_compression.py

@@ -507,29 +507,12 @@ def compress_context(
             agent._session_db.end_session(agent.session_id, "compression")
             old_session_id = agent.session_id
             agent.session_id = f"{datetime.now().strftime('%Y%m%d_%H%M%S')}_{uuid.uuid4().hex[:6]}"
-            # Ordering contract: the agent thread updates the contextvar here;
-            # the gateway propagates to SessionEntry after run_in_executor returns.
             try:
                 from gateway.session_context import set_current_session_id
 
                 set_current_session_id(agent.session_id)
             except Exception:
                 os.environ["HERMES_SESSION_ID"] = agent.session_id
-            # The gateway/tools session context (ContextVar + env) and the
-            # logging session context are SEPARATE mechanisms. The call above
-            # moves the former; the ``[session_id]`` tag on log lines comes
-            # from ``hermes_logging._session_context`` (set once per turn in
-            # conversation_loop.py). Without this, post-rotation log lines in
-            # the same turn keep the STALE old id while the message/DB/gateway
-            # state carry the new one — breaking log correlation exactly at the
-            # compaction boundary (see #34089). Guarded separately so a logging
-            # failure can never regress the routing update above.
-            try:
-                from hermes_logging import set_session_context
-
-                set_session_context(agent.session_id)
-            except Exception:
-                pass
             agent._session_db_created = False
             agent._session_db.create_session(
                 session_id=agent.session_id,

agent/credential_pool.py

@@ -91,7 +91,6 @@ AUTH_TYPE_OAUTH = "oauth"
 AUTH_TYPE_API_KEY = "api_key"
 
 SOURCE_MANUAL = "manual"
-SOURCE_MANUAL_DEVICE_CODE = f"{SOURCE_MANUAL}:device_code"
 
 STRATEGY_FILL_FIRST = "fill_first"
 STRATEGY_ROUND_ROBIN = "round_robin"
@@ -375,7 +374,7 @@ def _iter_custom_providers(config: Optional[dict] = None):
         yield _normalize_custom_pool_name(name), entry
 
 
-def get_custom_provider_pool_key(base_url: Optional[str], provider_name: Optional[str] = None) -> Optional[str]:
+def get_custom_provider_pool_key(base_url: str, provider_name: Optional[str] = None) -> Optional[str]:
     """Look up the custom_providers list in config.yaml and return 'custom:<name>' for a matching base_url.
 
     When provider_name is given, prefer matching by name first (solving the case where

agent/curator.py

@@ -25,6 +25,7 @@ import json
 import logging
 import os
 import re
+import tempfile
 import threading
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
@@ -32,7 +33,6 @@ from typing import Any, Callable, Dict, List, NamedTuple, Optional, Set
 
 from hermes_constants import get_hermes_home
 from tools import skill_usage
-from utils import atomic_json_write
 
 logger = logging.getLogger(__name__)
 
@@ -97,7 +97,20 @@ def load_state() -> Dict[str, Any]:
 def save_state(data: Dict[str, Any]) -> None:
     path = _state_file()
     try:
-        atomic_json_write(path, data, indent=2, sort_keys=True)
+        path.parent.mkdir(parents=True, exist_ok=True)
+        fd, tmp = tempfile.mkstemp(dir=str(path.parent), prefix=".curator_state_", suffix=".tmp")
+        try:
+            with os.fdopen(fd, "w", encoding="utf-8") as f:
+                json.dump(data, f, indent=2, sort_keys=True, ensure_ascii=False)
+                f.flush()
+                os.fsync(f.fileno())
+            os.replace(tmp, path)
+        except BaseException:
+            try:
+                os.unlink(tmp)
+            except OSError:
+                pass
+            raise
     except Exception as e:
         logger.debug("Failed to save curator state: %s", e, exc_info=True)
 
@@ -362,11 +375,6 @@ CURATOR_REVIEW_PROMPT = (
     "into ~/.hermes/skills/.archive/) is the maximum destructive action. "
     "Archives are recoverable; deletion is not.\n"
     "3. DO NOT touch skills shown as pinned=yes. Skip them entirely.\n"
-    "3b. DO NOT archive, delete, consolidate, move, or otherwise modify any "
-    "skill named in the protected built-ins list (currently: plan). These "
-    "back load-bearing UX (slash-command entry points referenced in docs and "
-    "tips) and are filtered out of the candidate list below — never resurrect "
-    "one as an archive or absorb target.\n"
     "4. DO NOT use usage counters as a reason to skip consolidation. The "
     "counters are new and often mostly zero. Judge overlap on CONTENT, "
     "not on use_count. 'use=0' is not evidence a skill is valuable; it's "

agent/error_classifier.py

@@ -966,34 +966,6 @@ def _classify_400(
             should_fallback=False,
         )
 
-    # Request-validation errors (unsupported / unknown parameter) MUST be
-    # checked BEFORE context_overflow.  A GPT-5 model rejecting max_tokens
-    # returns:
-    #   "Unsupported parameter: 'max_tokens' is not supported with this model.
-    #    Use 'max_completion_tokens' instead."
-    # That string contains the literal substring "max_tokens", which is one of
-    # the _CONTEXT_OVERFLOW_PATTERNS — so without this guard the 400 is
-    # misclassified as context_overflow, routed into the compression loop,
-    # re-sent with the same bad parameter, and ends in "Cannot compress
-    # further".  These errors are deterministic (every retry gets the identical
-    # rejection), so classify as a non-retryable format_error and fall back.
-    #
-    # NOTE: we deliberately do NOT key off the generic ``invalid_request_error``
-    # code here — OpenAI stamps that same code on genuine context-overflow 400s,
-    # so matching it would mis-route real overflows away from compression. The
-    # unambiguous signals are the explicit "unsupported/unknown parameter"
-    # message text and the specific parameter-level error codes.
-    if (
-        any(p in error_msg for p in _REQUEST_VALIDATION_PATTERNS
-            if p != "invalid_request_error")
-        or error_code_lower in {"unknown_parameter", "unsupported_parameter"}
-    ):
-        return result_fn(
-            FailoverReason.format_error,
-            retryable=False,
-            should_fallback=True,
-        )
-
     # Context overflow from 400
     if any(p in error_msg for p in _CONTEXT_OVERFLOW_PATTERNS):
         return result_fn(

agent/image_routing.py

@@ -219,35 +219,6 @@ def _supports_vision_override(
         coerced = _coerce_capability_bool(per_model.get("supports_vision"))
         if coerced is not None:
             return coerced
-
-    # 2b. Legacy list-style custom_providers. Entries are dicts with a
-    # "name" key and a nested "models" dict. Match by provider name (which
-    # may appear as the raw name or "custom:<name>" at runtime).
-    custom_providers = cfg.get("custom_providers")
-    if isinstance(custom_providers, list):
-        # Build candidate names: the provider value and the config provider
-        # value, both raw and with "custom:" prefix stripped/added.
-        candidate_names: set = set()
-        for p in filter(None, (provider, config_provider)):
-            candidate_names.add(p)
-            if p.startswith("custom:"):
-                candidate_names.add(p[len("custom:"):])
-            else:
-                candidate_names.add(f"custom:{p}")
-        for entry_raw in custom_providers:
-            if not isinstance(entry_raw, dict):
-                continue
-            entry_name = str(entry_raw.get("name") or "").strip()
-            if entry_name not in candidate_names:
-                continue
-            models_raw = entry_raw.get("models")
-            models_cfg = models_raw if isinstance(models_raw, dict) else {}
-            per_model_raw = models_cfg.get(model)
-            per_model = per_model_raw if isinstance(per_model_raw, dict) else {}
-            coerced = _coerce_capability_bool(per_model.get("supports_vision"))
-            if coerced is not None:
-                return coerced
-
     return None
 
 

agent/insights.py

@@ -20,17 +20,23 @@ import json
 import time
 from collections import Counter, defaultdict
 from datetime import datetime
-from typing import Any, Dict, List, Optional
+from typing import Any, Dict, List
 
 from agent.usage_pricing import (
     CanonicalUsage,
+    DEFAULT_PRICING,
     estimate_usage_cost,
     format_duration_compact,
     has_known_pricing,
 )
 
+_DEFAULT_PRICING = DEFAULT_PRICING
 
 
+def _has_known_pricing(model_name: str, provider: str = None, base_url: str = None) -> bool:
+    """Check if a model has known pricing (vs unknown/custom endpoint)."""
+    return has_known_pricing(model_name, provider=provider, base_url=base_url)
+
 
 def _estimate_cost(
     session_or_model: Dict[str, Any] | str,
@@ -39,8 +45,8 @@ def _estimate_cost(
     *,
     cache_read_tokens: int = 0,
     cache_write_tokens: int = 0,
-    provider: Optional[str] = None,
-    base_url: Optional[str] = None,
+    provider: str = None,
+    base_url: str = None,
 ) -> tuple[float, str]:
     """Estimate the USD cost for a session row or a model/token tuple."""
     if isinstance(session_or_model, dict):
@@ -71,6 +77,9 @@ def _estimate_cost(
     return float(result.amount_usd or 0.0), result.status
 
 
+def _format_duration(seconds: float) -> str:
+    """Format seconds into a human-readable duration string."""
+    return format_duration_compact(seconds)
 
 
 def _bar_chart(values: List[int], max_width: int = 20) -> List[str]:
@@ -426,7 +435,7 @@ class InsightsEngine:
                 included_cost_sessions += 1
             elif status == "unknown":
                 unknown_cost_sessions += 1
-            if has_known_pricing(model, s.get("billing_provider"), s.get("billing_base_url")):
+            if _has_known_pricing(model, s.get("billing_provider"), s.get("billing_base_url")):
                 models_with_pricing.add(display)
             else:
                 models_without_pricing.add(display)
@@ -499,7 +508,7 @@ class InsightsEngine:
             d["tool_calls"] += s.get("tool_call_count") or 0
             estimate, status = _estimate_cost(s)
             d["cost"] += estimate
-            d["has_pricing"] = has_known_pricing(model, s.get("billing_provider"), s.get("billing_base_url"))
+            d["has_pricing"] = _has_known_pricing(model, s.get("billing_provider"), s.get("billing_base_url"))
             d["cost_status"] = status
 
         result = [
@@ -670,7 +679,7 @@ class InsightsEngine:
             top.append({
                 "label": "Longest session",
                 "session_id": longest["id"][:16],
-                "value": format_duration_compact(dur),
+                "value": _format_duration(dur),
                 "date": datetime.fromtimestamp(longest["started_at"]).strftime("%b %d"),
             })
 
@@ -755,7 +764,7 @@ class InsightsEngine:
         lines.append(f"  Input tokens:      {o['total_input_tokens']:<12,}  Output tokens:   {o['total_output_tokens']:,}")
         lines.append(f"  Total tokens:      {o['total_tokens']:,}")
         if o["total_hours"] > 0:
-            lines.append(f"  Active time:       ~{format_duration_compact(o['total_hours'] * 3600):<11}  Avg session:     ~{format_duration_compact(o['avg_session_duration'])}")
+            lines.append(f"  Active time:       ~{_format_duration(o['total_hours'] * 3600):<11}  Avg session:     ~{_format_duration(o['avg_session_duration'])}")
         lines.append(f"  Avg msgs/session:  {o['avg_messages_per_session']:.1f}")
         lines.append("")
 
@@ -870,7 +879,7 @@ class InsightsEngine:
         lines.append(f"**Sessions:** {o['total_sessions']} | **Messages:** {o['total_messages']:,} | **Tool calls:** {o['total_tool_calls']:,}")
         lines.append(f"**Tokens:** {o['total_tokens']:,} (in: {o['total_input_tokens']:,} / out: {o['total_output_tokens']:,})")
         if o["total_hours"] > 0:
-            lines.append(f"**Active time:** ~{format_duration_compact(o['total_hours'] * 3600)} | **Avg session:** ~{format_duration_compact(o['avg_session_duration'])}")
+            lines.append(f"**Active time:** ~{_format_duration(o['total_hours'] * 3600)} | **Avg session:** ~{_format_duration(o['avg_session_duration'])}")
         lines.append("")
 
         # Models (top 5)

agent/lsp/install.py

@@ -262,7 +262,6 @@ def _install_npm(
             capture_output=True,
             text=True,
             timeout=300,
-            stdin=subprocess.DEVNULL,
         )
         if proc.returncode != 0:
             logger.warning(
@@ -311,7 +310,6 @@ def _install_go(pkg: str, bin_name: str) -> Optional[str]:
             text=True,
             timeout=600,
             env=env,
-            stdin=subprocess.DEVNULL,
         )
         if proc.returncode != 0:
             logger.warning(
@@ -349,7 +347,6 @@ def _install_pip(pkg: str, bin_name: str) -> Optional[str]:
             capture_output=True,
             text=True,
             timeout=300,
-            stdin=subprocess.DEVNULL,
         )
         if proc.returncode != 0:
             logger.warning(

agent/memory_manager.py

@@ -28,8 +28,6 @@ from __future__ import annotations
 import logging
 import re
 import inspect
-import threading
-from concurrent.futures import ThreadPoolExecutor
 from typing import Any, Dict, List, Optional
 
 from agent.memory_provider import MemoryProvider
@@ -37,12 +35,6 @@ from tools.registry import tool_error
 
 logger = logging.getLogger(__name__)
 
-# How long shutdown_all() waits for in-flight background sync/prefetch work
-# to drain before abandoning it. A wedged provider must never block process
-# teardown indefinitely — the worker threads are daemon, so anything still
-# running past this window dies with the interpreter.
-_SYNC_DRAIN_TIMEOUT_S = 5.0
-
 
 # ---------------------------------------------------------------------------
 # Context fencing helpers
@@ -260,13 +252,6 @@ class MemoryManager:
         self._providers: List[MemoryProvider] = []
         self._tool_to_provider: Dict[str, MemoryProvider] = {}
         self._has_external: bool = False  # True once a non-builtin provider is added
-        # Background executor for end-of-turn sync/prefetch. Lazily created on
-        # first use so the common builtin-only path spawns no extra threads.
-        # A single worker serializes a provider's writes (turn N must land
-        # before turn N+1) and caps thread growth at one per manager. See
-        # _submit_background() and the sync_all/queue_prefetch_all rationale.
-        self._sync_executor: Optional[ThreadPoolExecutor] = None
-        self._sync_executor_lock = threading.Lock()
 
     # -- Registration --------------------------------------------------------
 
@@ -296,28 +281,9 @@ class MemoryManager:
 
         self._providers.append(provider)
 
-        # Core tool names are reserved — a memory provider must never register
-        # a tool that shadows a built-in (e.g. ``clarify``, ``delegate_task``).
-        # Built-ins always win, so such a tool is dropped at agent init and
-        # would otherwise linger in ``_tool_to_provider`` and hijack dispatch
-        # (#40466). Reject it here, at the door, so it never enters the routing
-        # table at all — matching the built-ins-always-win invariant used by
-        # the TTS/browser/search provider registries.
-        from toolsets import _HERMES_CORE_TOOLS
-
-        _core_tool_names = set(_HERMES_CORE_TOOLS)
-
         # Index tool names → provider for routing
         for schema in provider.get_tool_schemas():
             tool_name = schema.get("name", "")
-            if tool_name in _core_tool_names:
-                logger.warning(
-                    "Memory provider '%s' tool '%s' shadows a reserved core "
-                    "tool name; registration ignored. Core tools always win — "
-                    "rename the provider's tool to something unique.",
-                    provider.name, tool_name,
-                )
-                continue
             if tool_name and tool_name not in self._tool_to_provider:
                 self._tool_to_provider[tool_name] = provider
             elif tool_name in self._tool_to_provider:
@@ -390,27 +356,15 @@ class MemoryManager:
         return "\n\n".join(parts)
 
     def queue_prefetch_all(self, query: str, *, session_id: str = "") -> None:
-        """Queue background prefetch on all providers for the next turn.
-
-        Provider work is dispatched to a background worker so a slow or
-        wedged provider can never block the caller. See ``sync_all`` for
-        the full rationale (agent stuck "running" minutes after a turn).
-        """
-        providers = list(self._providers)
-        if not providers:
-            return
-
-        def _run() -> None:
-            for provider in providers:
-                try:
-                    provider.queue_prefetch(query, session_id=session_id)
-                except Exception as e:
-                    logger.debug(
-                        "Memory provider '%s' queue_prefetch failed (non-fatal): %s",
-                        provider.name, e,
-                    )
-
-        self._submit_background(_run)
+        """Queue background prefetch on all providers for the next turn."""
+        for provider in self._providers:
+            try:
+                provider.queue_prefetch(query, session_id=session_id)
+            except Exception as e:
+                logger.debug(
+                    "Memory provider '%s' queue_prefetch failed (non-fatal): %s",
+                    provider.name, e,
+                )
 
     # -- Sync ----------------------------------------------------------------
 
@@ -434,142 +388,38 @@ class MemoryManager:
         session_id: str = "",
         messages: Optional[List[Dict[str, Any]]] = None,
     ) -> None:
-        """Sync a completed turn to all providers.
-
-        Runs on a background worker thread, NOT inline on the
-        turn-completion path. A provider's ``sync_turn`` may make a
-        blocking network/daemon call (a misconfigured Hindsight daemon
-        was observed blocking ~298s before failing); doing that inline
-        held ``run_conversation`` open long after the user saw their
-        response, so every interface (CLI, TUI, gateway) kept the agent
-        marked "running" for minutes and any follow-up message triggered
-        an aggressive interrupt. Dispatching off-thread means a slow or
-        broken provider can never stall the turn — the sync simply
-        completes (or fails, logged) in the background.
-
-        Writes are serialized through a single worker so turn N lands
-        before turn N+1; provider implementations don't need their own
-        ordering guarantees.
-        """
-        providers = list(self._providers)
-        if not providers:
-            return
-
-        def _run() -> None:
-            for provider in providers:
-                try:
-                    if messages is not None and self._provider_sync_accepts_messages(provider):
-                        provider.sync_turn(
-                            user_content,
-                            assistant_content,
-                            session_id=session_id,
-                            messages=messages,
-                        )
-                    else:
-                        provider.sync_turn(
-                            user_content,
-                            assistant_content,
-                            session_id=session_id,
-                        )
-                except Exception as e:
-                    logger.warning(
-                        "Memory provider '%s' sync_turn failed: %s",
-                        provider.name, e,
-                    )
-
-        self._submit_background(_run)
-
-    # -- Background dispatch -------------------------------------------------
-
-    def _submit_background(self, fn) -> None:
-        """Run ``fn`` on the manager's background worker.
-
-        The executor is created lazily and shared across calls. If the
-        executor can't be created or has already been shut down, ``fn``
-        runs inline as a last-resort fallback — losing the async benefit
-        but never losing the write itself. ``fn`` must do its own
-        per-provider error handling; this wrapper only guards executor
-        plumbing.
-        """
-        executor = self._get_sync_executor()
-        if executor is None:
-            # Executor unavailable (shut down / creation failed) — run
-            # inline rather than drop the work. Slow, but correct.
+        """Sync a completed turn to all providers."""
+        for provider in self._providers:
             try:
-                fn()
-            except Exception as e:  # pragma: no cover - fn guards internally
-                logger.debug("Inline memory background task failed: %s", e)
-            return
-        try:
-            executor.submit(fn)
-        except RuntimeError:
-            # Executor was shut down between the get and the submit
-            # (teardown race). Fall back to inline.
-            try:
-                fn()
-            except Exception as e:  # pragma: no cover - fn guards internally
-                logger.debug("Inline memory background task failed: %s", e)
-
-    def _get_sync_executor(self) -> Optional[ThreadPoolExecutor]:
-        """Lazily create the single-worker background executor."""
-        if self._sync_executor is not None:
-            return self._sync_executor
-        with self._sync_executor_lock:
-            if self._sync_executor is None:
-                try:
-                    self._sync_executor = ThreadPoolExecutor(
-                        max_workers=1,
-                        thread_name_prefix="mem-sync",
+                if messages is not None and self._provider_sync_accepts_messages(provider):
+                    provider.sync_turn(
+                        user_content,
+                        assistant_content,
+                        session_id=session_id,
+                        messages=messages,
                     )
-                except Exception as e:  # pragma: no cover - resource exhaustion
-                    logger.warning("Failed to create memory sync executor: %s", e)
-                    return None
-            return self._sync_executor
-
-    def flush_pending(self, timeout: Optional[float] = None) -> bool:
-        """Block until queued sync/prefetch work has drained.
-
-        Single-worker executor means submitting a sentinel and waiting on
-        it guarantees every previously-submitted task has run. Returns
-        True if the barrier completed within ``timeout`` (or no executor
-        exists), False on timeout. Used at real session boundaries and by
-        tests that need to assert provider state deterministically.
-        """
-        executor = self._sync_executor
-        if executor is None:
-            return True
-        try:
-            fut = executor.submit(lambda: None)
-        except RuntimeError:
-            # Executor already shut down — nothing pending.
-            return True
-        try:
-            fut.result(timeout=timeout)
-            return True
-        except Exception:
-            return False
+                else:
+                    provider.sync_turn(
+                        user_content,
+                        assistant_content,
+                        session_id=session_id,
+                    )
+            except Exception as e:
+                logger.warning(
+                    "Memory provider '%s' sync_turn failed: %s",
+                    provider.name, e,
+                )
 
     # -- Tools ---------------------------------------------------------------
 
     def get_all_tool_schemas(self) -> List[Dict[str, Any]]:
-        """Collect tool schemas from all providers.
-
-        Reserved core tool names (``clarify``, ``delegate_task``, etc.) are
-        skipped — they are rejected from the routing table in
-        :meth:`add_provider`, so the manager must not advertise a schema it
-        will never route. Built-ins always win (#40466).
-        """
-        from toolsets import _HERMES_CORE_TOOLS
-
-        _core_tool_names = set(_HERMES_CORE_TOOLS)
+        """Collect tool schemas from all providers."""
         schemas = []
         seen = set()
         for provider in self._providers:
             try:
                 for schema in provider.get_tool_schemas():
                     name = schema.get("name", "")
-                    if name in _core_tool_names:
-                        continue
                     if name and name not in seen:
                         schemas.append(schema)
                         seen.add(name)
@@ -773,15 +623,7 @@ class MemoryManager:
                 )
 
     def shutdown_all(self) -> None:
-        """Shut down all providers (reverse order for clean teardown).
-
-        Drains the background sync/prefetch executor first (bounded by
-        ``_SYNC_DRAIN_TIMEOUT_S``) so a turn's final sync has a chance to
-        land before providers are torn down. The worker threads are
-        daemon, so anything still wedged past the drain window dies with
-        the interpreter rather than blocking exit.
-        """
-        self._drain_sync_executor()
+        """Shut down all providers (reverse order for clean teardown)."""
         for provider in reversed(self._providers):
             try:
                 provider.shutdown()
@@ -791,52 +633,6 @@ class MemoryManager:
                     provider.name, e,
                 )
 
-    def _drain_sync_executor(self) -> None:
-        """Shut down the background executor, waiting briefly for drain.
-
-        Bounded by ``_SYNC_DRAIN_TIMEOUT_S``: a wedged provider must never
-        hang process/session teardown. We stop accepting new work and
-        cancel anything still queued, then wait at most the drain timeout
-        for the currently-running task on a watcher thread. The worker is
-        daemon, so an over-running task dies with the interpreter.
-        """
-        with self._sync_executor_lock:
-            executor = self._sync_executor
-            self._sync_executor = None
-        if executor is None:
-            return
-        try:
-            # Stop accepting new work and drop anything still queued, but
-            # do NOT block here — cancel_futures cancels not-yet-started
-            # tasks; the in-flight one keeps running on its daemon thread.
-            executor.shutdown(wait=False, cancel_futures=True)
-        except TypeError:
-            # Older Python without cancel_futures kwarg.
-            try:
-                executor.shutdown(wait=False)
-            except Exception as e:  # pragma: no cover
-                logger.debug("Memory sync executor shutdown failed: %s", e)
-            return
-        except Exception as e:  # pragma: no cover
-            logger.debug("Memory sync executor shutdown failed: %s", e)
-            return
-        # Give an in-flight sync a bounded chance to finish on a watcher
-        # thread so we don't block the caller past the drain timeout.
-        drainer = threading.Thread(
-            target=lambda: self._bounded_executor_wait(executor),
-            daemon=True,
-            name="mem-sync-drain",
-        )
-        drainer.start()
-        drainer.join(timeout=_SYNC_DRAIN_TIMEOUT_S)
-
-    @staticmethod
-    def _bounded_executor_wait(executor: ThreadPoolExecutor) -> None:
-        try:
-            executor.shutdown(wait=True)
-        except Exception as e:  # pragma: no cover
-            logger.debug("Memory sync executor drain wait failed: %s", e)
-
     def initialize_all(self, session_id: str, **kwargs) -> None:
         """Initialize all providers.
 

agent/model_metadata.py

@@ -141,8 +141,6 @@ DEFAULT_CONTEXT_LENGTHS = {
     # fuzzy-match collisions (e.g. "anthropic/claude-sonnet-4" is a
     # substring of "anthropic/claude-sonnet-4.6").
     # OpenRouter-prefixed models resolve via OpenRouter live API or models.dev.
-    "claude-fable-5": 1000000,
-    "claude-fable": 1000000,
     "claude-opus-4-8": 1000000,
     "claude-opus-4.8": 1000000,
     "claude-opus-4-7": 1000000,
@@ -966,20 +964,6 @@ def parse_available_output_tokens_from_error(error_msg: str) -> Optional[int]:
     is_output_cap_error = (
         "max_tokens" in error_lower
         and ("available_tokens" in error_lower or "available tokens" in error_lower)
-    ) or (
-        # OpenRouter/Nous phrasing of the same condition.
-        "in the output" in error_lower
-        and "maximum context length" in error_lower
-    ) or (
-        # LM Studio / llama.cpp / some OpenAI-compatible servers:
-        #   "This model's maximum context length is 65536 tokens. However, you
-        #    requested 65536 output tokens and your prompt contains 77409
-        #    characters ..."
-        # The "requested N output tokens" phrasing means the OUTPUT cap is the
-        # problem (the input itself fits) — reduce max_tokens, don't compress.
-        "maximum context length" in error_lower
-        and "requested" in error_lower
-        and "output tokens" in error_lower
     )
     if not is_output_cap_error:
         return None
@@ -998,35 +982,6 @@ def parse_available_output_tokens_from_error(error_msg: str) -> Optional[int]:
             tokens = int(match.group(1))
             if tokens >= 1:
                 return tokens
-
-    # OpenRouter/Nous format: "maximum context length is N … (A of text input,
-    # B of tool input, C in the output)". Available output = ctx - text - tool.
-    _m_ctx = re.search(r'maximum context length is (\d+)', error_lower)
-    _m_parts = re.search(
-        r'\((\d+)\s+of text input,\s*(\d+)\s+of tool input,\s*(\d+)\s+in the output\)',
-        error_lower,
-    )
-    if _m_ctx and _m_parts:
-        _available = int(_m_ctx.group(1)) - int(_m_parts.group(1)) - int(_m_parts.group(2))
-        if _available >= 1:
-            return _available
-
-    # LM Studio / llama.cpp style: context window is reported in tokens but the
-    # prompt size is reported in CHARACTERS, e.g.
-    #   "maximum context length is 65536 tokens ... your prompt contains 77409
-    #    characters ...".
-    # Estimate the input tokens conservatively (~3 chars/token, which
-    # over-reserves the input so the retried output cap stays safely inside the
-    # window) and leave the remainder of the window for output.
-    _m_ctx_tok = re.search(r'maximum context length is (\d+)\s*token', error_lower)
-    _m_chars = re.search(r'prompt contains (\d+)\s*character', error_lower)
-    if _m_ctx_tok and _m_chars:
-        _ctx = int(_m_ctx_tok.group(1))
-        _est_input = (int(_m_chars.group(1)) + 2) // 3
-        _available = _ctx - _est_input
-        if _available >= 1:
-            return _available
-
     return None
 
 
@@ -1712,26 +1667,6 @@ def get_model_context_length(
                 "in config.yaml to override.",
                 model, base_url, f"{DEFAULT_FALLBACK_CONTEXT:,}",
             )
-            # 3b. Before falling back to the hard 256K default, consult the
-            # hardcoded catalog as a last resort.  A proxied/custom Anthropic
-            # gateway (e.g. corporate proxy) fails the Ollama/local probes
-            # above, but the model name may still match an entry in
-            # DEFAULT_CONTEXT_LENGTHS (e.g. "claude-opus-4-8" → 1M).
-            # Without this, the early return here short-circuits the catalog
-            # lookup at step 8 and silently caps context at 256K.
-            model_lower = model.lower()
-            for default_model, length in sorted(
-                DEFAULT_CONTEXT_LENGTHS.items(),
-                key=lambda x: len(x[0]),
-                reverse=True,
-            ):
-                if default_model in model_lower:
-                    logger.info(
-                        "Using hardcoded context length %s for model %r "
-                        "(custom endpoint, catalog match on %r)",
-                        f"{length:,}", model, default_model,
-                    )
-                    return length
             return DEFAULT_FALLBACK_CONTEXT
 
     # 4. Anthropic /v1/models API (only for regular API keys, not OAuth)
@@ -1812,43 +1747,10 @@ def get_model_context_length(
         if ctx is not None:
             save_context_length(model, base_url, ctx)
             return ctx
-    # 5f. OpenRouter live /models metadata — authoritative for OpenRouter-routed
-    # models. OpenRouter's catalog carries per-model context_length (e.g.
-    # anthropic/claude-fable-5 -> 1M) and refreshes as new slugs ship, so it
-    # must win over both models.dev (step 5g) and the hardcoded family catch-all
-    # (step 8). Before this branch, an OpenRouter selection set
-    # effective_provider="openrouter", which (a) made the models.dev lookup miss
-    # brand-new slugs and (b) skipped the step-6 OR fallback (gated on `not
-    # effective_provider`), so a fresh slug like claude-fable-5 fell through to
-    # the generic "claude": 200K entry and under-reported a 1M window. Mirrors
-    # the dedicated Nous/Copilot/GMI branches above.
-    if effective_provider == "openrouter":
-        metadata = fetch_model_metadata()
-        entry = metadata.get(model)
-        if entry:
-            or_ctx = entry.get("context_length")
-            # Guard against the known OpenRouter Kimi-family 32k underreport
-            # (same class the hardcoded overrides exist to mitigate).
-            if isinstance(or_ctx, int) and or_ctx > 0 and not (
-                or_ctx == 32768 and _model_name_suggests_kimi(model)
-            ):
-                return or_ctx
-
     if effective_provider:
         from agent.models_dev import lookup_models_dev_context
         ctx = lookup_models_dev_context(effective_provider, model)
         if ctx:
-            # MiniMax M3: models.dev reports 512K but actual context is 1M.
-            # Prefer hardcoded catalog over stale probe value.
-            if _model_name_suggests_minimax_m3(model):
-                catalog = DEFAULT_CONTEXT_LENGTHS.get("minimax-m3")
-                if catalog and ctx < catalog:
-                    logger.info(
-                        "Rejecting models.dev context=%s for %r "
-                        "(MiniMax-M3 underreport); using hardcoded default %s",
-                        ctx, model, f"{catalog:,}",
-                    )
-                    ctx = catalog
             return ctx
 
     # 6. OpenRouter live API metadata — provider-unaware fallback.

agent/onboarding.py

@@ -26,7 +26,6 @@ logger = logging.getLogger(__name__)
 BUSY_INPUT_FLAG = "busy_input_prompt"
 TOOL_PROGRESS_FLAG = "tool_progress_prompt"
 OPENCLAW_RESIDUE_FLAG = "openclaw_residue_cleanup"
-PROFILE_BUILD_FLAG = "profile_build_offered"
 
 
 # -------------------------------------------------------------------------
@@ -127,62 +126,6 @@ def detect_openclaw_residue(home: Optional[Path] = None) -> bool:
         return False
 
 
-# -------------------------------------------------------------------------
-# Onboarding profile-build path (opt-in, consent-gated)
-# -------------------------------------------------------------------------
-
-def profile_build_mode(config: Mapping[str, Any]) -> str:
-    """Resolve the onboarding profile-build mode from config.
-
-    Returns one of:
-      ``"ask"``  — on first contact, OFFER to build a profile (default).
-      ``"off"``  — never offer; the first-message note stays a plain intro.
-
-    Read from ``config.onboarding.profile_build``. Unknown / missing values
-    fall back to ``"ask"`` so the default experience offers the flow. Any
-    network/account lookups inside the flow are separately consented to in
-    conversation — this setting only governs whether the offer is made.
-    """
-    if not isinstance(config, Mapping):
-        return "ask"
-    onboarding = config.get("onboarding")
-    if not isinstance(onboarding, Mapping):
-        return "ask"
-    mode = onboarding.get("profile_build")
-    if isinstance(mode, str) and mode.strip().lower() == "off":
-        return "off"
-    return "ask"
-
-
-def profile_build_directive() -> str:
-    """System-note directive appended to the very first message ever.
-
-    Instructs the agent to run a short, opt-in, consent-gated profile-build
-    flow and persist confirmed facts to the user-profile memory store
-    (``memory`` tool, ``target="user"``). Phrased so the agent ASKS before any
-    lookup and never silently reads connected accounts — directly addressing
-    the privacy concern that reading email/accounts unprompted feels invasive.
-    """
-    return (
-        "\n\n[System note: This is the user's very first message ever. "
-        "After a one-sentence introduction (mention /help shows commands), "
-        "OFFER — do not assume — to build a short profile of them so you can "
-        "be more useful, and explain they can decline or do it later. If and "
-        "ONLY IF they accept:\n"
-        "  1. Ask for whatever they're comfortable sharing (name, what they "
-        "do, how they like you to work). Volunteered facts come first.\n"
-        "  2. Before ANY external lookup, say what you intend to look up and "
-        "get explicit consent for that step. Never read their connected "
-        "accounts (email, calendar, etc.) silently — ask each time.\n"
-        "  3. With consent, you may use web_search to confirm public details "
-        "(e.g. employer, public profiles) from the data points they gave.\n"
-        "  4. Save each confirmed, durable fact with the memory tool using "
-        "target=\"user\" — keep entries compact and high-signal.\n"
-        "If they decline at any point, stop immediately and continue normally. "
-        "Keep the whole exchange light and conversational, not an interrogation.]"
-    )
-
-
 # -------------------------------------------------------------------------
 # State read / write
 # -------------------------------------------------------------------------
@@ -239,15 +182,12 @@ __all__ = [
     "BUSY_INPUT_FLAG",
     "TOOL_PROGRESS_FLAG",
     "OPENCLAW_RESIDUE_FLAG",
-    "PROFILE_BUILD_FLAG",
     "busy_input_hint_gateway",
     "busy_input_hint_cli",
     "tool_progress_hint_gateway",
     "tool_progress_hint_cli",
     "openclaw_residue_hint_cli",
     "detect_openclaw_residue",
-    "profile_build_mode",
-    "profile_build_directive",
     "is_seen",
     "mark_seen",
 ]

agent/prompt_builder.py

@@ -885,22 +885,6 @@ def build_environment_hints() -> str:
                 f"`uname -a && whoami && pwd`."
             )
 
-    # Hermes desktop GUI — any agent running under the desktop app should know
-    # it. HERMES_DESKTOP marks the backend powering the chat; HERMES_DESKTOP_TERMINAL
-    # marks a hermes launched in the embedded terminal pane. Both set by main.cjs.
-    _truthy = ("1", "true", "yes")
-    _in_desktop = (os.getenv("HERMES_DESKTOP") or "").strip().lower() in _truthy
-    _in_desktop_term = (os.getenv("HERMES_DESKTOP_TERMINAL") or "").strip().lower() in _truthy
-    if _in_desktop or _in_desktop_term:
-        _desktop_hint = "Runtime surface: you're running inside the Hermes desktop GUI app."
-        if _in_desktop_term:
-            _desktop_hint += (
-                " You're in its embedded terminal pane, beside the GUI chat — the user can "
-                "select your output (⌥-drag on macOS, Shift-drag elsewhere) and press "
-                "⌘/Ctrl+L to send it to the chat composer."
-            )
-        hints.append(_desktop_hint)
-
     if is_wsl():
         hints.append(WSL_ENVIRONMENT_HINT)
 

agent/secret_sources/bitwarden.py

@@ -274,7 +274,6 @@ def _platform_asset_name() -> str:
                 capture_output=True,
                 text=True,
                 timeout=2,
-                stdin=subprocess.DEVNULL,
             )
             if "musl" in (res.stdout + res.stderr).lower():
                 libc = "musl"
@@ -325,11 +324,8 @@ def install_bws(*, force: bool = False) -> Path:
 
         with zipfile.ZipFile(zip_path) as zf:
             member = _pick_zip_member(zf, _platform_binary_name())
-            # Zip-slip guard: a malicious archive can carry member names like
-            # ``../../etc/cron.d/x`` or absolute paths.  ``ZipFile.extract``
-            # joins the member onto ``tmp`` without verifying the result stays
-            # inside it, so validate containment before touching the disk.
-            extracted = _safe_extract_member(zf, member, tmp)
+            zf.extract(member, tmp)
+            extracted = tmp / member
 
         # Move into place atomically.  We write to a sibling tempfile in
         # the final directory so the rename can't cross filesystems.
@@ -399,33 +395,6 @@ def _pick_zip_member(zf: zipfile.ZipFile, binary_name: str) -> str:
     return candidates[0]
 
 
-def _safe_extract_member(
-    zf: zipfile.ZipFile, member: str, dest_dir: Path
-) -> Path:
-    """Extract a single archive member, refusing path traversal.
-
-    ``ZipFile.extract`` will happily honour member names containing
-    ``../`` or absolute paths, letting a malicious archive write outside
-    ``dest_dir`` (a "zip-slip").  We resolve the would-be target and
-    confirm it stays within ``dest_dir`` before extracting.
-    """
-    dest_root = os.path.realpath(dest_dir)
-    target = os.path.realpath(os.path.join(dest_root, member))
-    # ``commonpath`` raises ValueError for e.g. different drives on
-    # Windows; treat that as an escape too.
-    try:
-        contained = os.path.commonpath([dest_root, target]) == dest_root
-    except ValueError:
-        contained = False
-    if not contained or target == dest_root:
-        raise RuntimeError(
-            f"Refusing to extract unsafe archive member {member!r}: "
-            f"it escapes the extraction directory"
-        )
-    zf.extract(member, dest_root)
-    return Path(target)
-
-
 # ---------------------------------------------------------------------------
 # Secret fetch + apply
 # ---------------------------------------------------------------------------
@@ -526,7 +495,6 @@ def _run_bws_list(
             capture_output=True,
             text=True,
             timeout=_BWS_RUN_TIMEOUT,
-            stdin=subprocess.DEVNULL,
         )
     except subprocess.TimeoutExpired as exc:
         raise RuntimeError(

agent/skill_preprocessing.py

@@ -74,7 +74,6 @@ def run_inline_shell(command: str, cwd: Path | None, timeout: int) -> str:
             text=True,
             timeout=max(1, int(timeout)),
             check=False,
-            stdin=subprocess.DEVNULL,
         )
     except subprocess.TimeoutExpired:
         return f"[inline-shell timeout after {timeout}s: {command}]"

agent/tool_executor.py

@@ -70,7 +70,6 @@ def _emit_terminal_post_tool_call(
     status: str | None = None,
     error_type: str | None = None,
     error_message: str | None = None,
-    middleware_trace: Optional[list[dict[str, Any]]] = None,
 ) -> None:
     try:
         from model_tools import _emit_post_tool_call_hook
@@ -87,7 +86,6 @@ def _emit_terminal_post_tool_call(
             status=status,
             error_type=error_type,
             error_message=error_message,
-            middleware_trace=list(middleware_trace or []),
         )
     except Exception:
         pass
@@ -113,7 +111,6 @@ def _emit_cancelled_terminal_post_tool_call(
     start_time: float,
     reason: str = "user interrupt",
     error_type: str = "keyboard_interrupt",
-    middleware_trace: Optional[list[dict[str, Any]]] = None,
 ) -> str:
     result = _cancelled_tool_result(reason)
     _emit_terminal_post_tool_call(
@@ -127,7 +124,6 @@ def _emit_cancelled_terminal_post_tool_call(
         status="cancelled",
         error_type=error_type,
         error_message=f"Tool execution cancelled by {reason}",
-        middleware_trace=list(middleware_trace or []),
     )
     return result
 
@@ -181,65 +177,6 @@ def _tool_search_scoped_names(agent) -> frozenset:
     return names
 
 
-def _apply_tool_request_middleware_for_agent(
-    agent,
-    *,
-    function_name: str,
-    function_args: dict,
-    effective_task_id: str,
-    tool_call_id: str,
-) -> tuple[dict, list[dict[str, Any]]]:
-    try:
-        from hermes_cli.middleware import apply_tool_request_middleware
-
-        result = apply_tool_request_middleware(
-            function_name,
-            function_args,
-            task_id=effective_task_id or "",
-            session_id=getattr(agent, "session_id", "") or "",
-            tool_call_id=tool_call_id or "",
-            turn_id=getattr(agent, "_current_turn_id", "") or "",
-            api_request_id=getattr(agent, "_current_api_request_id", "") or "",
-        )
-        payload = result.payload if isinstance(result.payload, dict) else function_args
-        return payload, list(result.trace)
-    except Exception as exc:
-        logger.debug("tool_request middleware error: %s", exc)
-        return function_args, []
-
-
-def _run_agent_tool_execution_middleware(
-    agent,
-    *,
-    function_name: str,
-    function_args: dict,
-    effective_task_id: str,
-    tool_call_id: str,
-    execute,
-) -> tuple[Any, dict]:
-    observed_args = function_args
-
-    def _execute(next_args: dict) -> Any:
-        nonlocal observed_args
-        observed_args = next_args if isinstance(next_args, dict) else function_args
-        return execute(observed_args)
-
-    from hermes_cli.middleware import run_tool_execution_middleware
-
-    result = run_tool_execution_middleware(
-        function_name,
-        function_args,
-        _execute,
-        original_args=function_args,
-        task_id=effective_task_id or "",
-        session_id=getattr(agent, "session_id", "") or "",
-        tool_call_id=tool_call_id or "",
-        turn_id=getattr(agent, "_current_turn_id", "") or "",
-        api_request_id=getattr(agent, "_current_api_request_id", "") or "",
-    )
-    return result, observed_args
-
-
 def execute_tool_calls_concurrent(agent, assistant_message, messages: list, effective_task_id: str, api_call_count: int = 0) -> None:
     """Execute multiple tool calls concurrently using a thread pool.
 
@@ -261,7 +198,7 @@ def execute_tool_calls_concurrent(agent, assistant_message, messages: list, effe
         return
 
     # ── Parse args + pre-execution bookkeeping ───────────────────────
-    parsed_calls = []  # list of (tool_call, function_name, function_args, middleware_trace, block_result, blocked_by_guardrail)
+    parsed_calls = []  # list of (tool_call, function_name, function_args)
     for tool_call in tool_calls:
         function_name = tool_call.function.name
 
@@ -313,14 +250,6 @@ def execute_tool_calls_concurrent(agent, assistant_message, messages: list, effe
         except Exception:
             pass
 
-        function_args, middleware_trace = _apply_tool_request_middleware_for_agent(
-            agent,
-            function_name=function_name,
-            function_args=function_args,
-            effective_task_id=effective_task_id,
-            tool_call_id=getattr(tool_call, "id", "") or "",
-        )
-
         # ── Block evaluation (BEFORE checkpoint preflight) ───────────
         # We must know whether the tool will execute before touching
         # checkpoint state (dedup slot, real snapshots).
@@ -339,7 +268,6 @@ def execute_tool_calls_concurrent(agent, assistant_message, messages: list, effe
                 status="blocked",
                 error_type="tool_scope_block",
                 error_message=_ts_scope_block,
-                middleware_trace=list(middleware_trace),
             )
         else:
             try:
@@ -352,7 +280,6 @@ def execute_tool_calls_concurrent(agent, assistant_message, messages: list, effe
                     tool_call_id=getattr(tool_call, "id", "") or "",
                     turn_id=getattr(agent, "_current_turn_id", "") or "",
                     api_request_id=getattr(agent, "_current_api_request_id", "") or "",
-                    middleware_trace=list(middleware_trace),
                 )
             except Exception:
                 block_message = None
@@ -369,7 +296,6 @@ def execute_tool_calls_concurrent(agent, assistant_message, messages: list, effe
                     status="blocked",
                     error_type="plugin_block",
                     error_message=block_message,
-                    middleware_trace=list(middleware_trace),
                 )
             else:
                 guardrail_decision = agent._tool_guardrails.before_call(function_name, function_args)
@@ -386,7 +312,6 @@ def execute_tool_calls_concurrent(agent, assistant_message, messages: list, effe
                         status="blocked",
                         error_type="guardrail_block",
                         error_message=getattr(guardrail_decision, "message", None) or "Tool blocked by guardrail policy",
-                        middleware_trace=list(middleware_trace),
                     )
 
         # ── Checkpoint preflight (only for tools that will execute) ──
@@ -413,13 +338,13 @@ def execute_tool_calls_concurrent(agent, assistant_message, messages: list, effe
                 except Exception:
                     pass
 
-        parsed_calls.append((tool_call, function_name, function_args, middleware_trace, block_result, blocked_by_guardrail))
+        parsed_calls.append((tool_call, function_name, function_args, block_result, blocked_by_guardrail))
 
     # ── Logging / callbacks ──────────────────────────────────────────
-    tool_names_str = ", ".join(name for _, name, _, _, _, _ in parsed_calls)
+    tool_names_str = ", ".join(name for _, name, _, _, _ in parsed_calls)
     if not agent.quiet_mode:
         print(f"  ⚡ Concurrent: {num_tools} tool calls — {tool_names_str}")
-        for i, (tc, name, args, middleware_trace, block_result, blocked_by_guardrail) in enumerate(parsed_calls, 1):
+        for i, (tc, name, args, block_result, blocked_by_guardrail) in enumerate(parsed_calls, 1):
             args_str = json.dumps(args, ensure_ascii=False)
             if agent.verbose_logging:
                 print(f"  📞 Tool {i}: {name}({list(args.keys())})")
@@ -428,7 +353,7 @@ def execute_tool_calls_concurrent(agent, assistant_message, messages: list, effe
                 args_preview = args_str[:agent.log_prefix_chars] + "..." if len(args_str) > agent.log_prefix_chars else args_str
                 print(f"  📞 Tool {i}: {name}({list(args.keys())}) - {args_preview}")
 
-    for tc, name, args, middleware_trace, block_result, blocked_by_guardrail in parsed_calls:
+    for tc, name, args, block_result, blocked_by_guardrail in parsed_calls:
         if block_result is not None:
             continue
         if agent.tool_progress_callback:
@@ -438,7 +363,7 @@ def execute_tool_calls_concurrent(agent, assistant_message, messages: list, effe
             except Exception as cb_err:
                 logging.debug(f"Tool progress callback error: {cb_err}")
 
-    for tc, name, args, middleware_trace, block_result, blocked_by_guardrail in parsed_calls:
+    for tc, name, args, block_result, blocked_by_guardrail in parsed_calls:
         if block_result is not None:
             continue
         if agent.tool_start_callback:
@@ -448,18 +373,18 @@ def execute_tool_calls_concurrent(agent, assistant_message, messages: list, effe
                 logging.debug(f"Tool start callback error: {cb_err}")
 
     # ── Concurrent execution ─────────────────────────────────────────
-    # Each slot holds (function_name, function_args, function_result, duration, error_flag, blocked_flag, middleware_trace)
+    # Each slot holds (function_name, function_args, function_result, duration, error_flag, blocked_flag)
     results = [None] * num_tools
-    for i, (tc, name, args, middleware_trace, block_result, blocked_by_guardrail) in enumerate(parsed_calls):
+    for i, (tc, name, args, block_result, blocked_by_guardrail) in enumerate(parsed_calls):
         if block_result is not None:
-            results[i] = (name, args, block_result, 0.0, True, True, middleware_trace)
+            results[i] = (name, args, block_result, 0.0, True, True)
 
     # Touch activity before launching workers so the gateway knows
     # we're executing tools (not stuck).
     agent._current_tool = tool_names_str
     agent._touch_activity(f"executing {num_tools} tools concurrently: {tool_names_str}")
 
-    def _run_tool(index, tool_call, function_name, function_args, middleware_trace):
+    def _run_tool(index, tool_call, function_name, function_args):
         """Worker function executed in a thread."""
         # Register this worker tid so the agent can fan out an interrupt
         # to it — see AIAgent.interrupt().  Must happen first thing, and
@@ -498,8 +423,6 @@ def execute_tool_calls_concurrent(agent, assistant_message, messages: list, effe
                     tool_call.id,
                     messages=messages,
                     pre_tool_block_checked=True,
-                    skip_tool_request_middleware=True,
-                    tool_request_middleware_trace=list(middleware_trace),
                 )
             except KeyboardInterrupt:
                 try:
@@ -513,11 +436,10 @@ def execute_tool_calls_concurrent(agent, assistant_message, messages: list, effe
                     effective_task_id=effective_task_id,
                     tool_call_id=getattr(tool_call, "id", "") or "",
                     start_time=start,
-                    middleware_trace=list(middleware_trace),
                 )
                 duration = time.time() - start
                 logger.info("tool %s cancelled (%.2fs)", function_name, duration)
-                results[index] = (function_name, function_args, result, duration, True, False, middleware_trace)
+                results[index] = (function_name, function_args, result, duration, True, False)
                 return
             except Exception as tool_error:
                 result = f"Error executing tool '{function_name}': {tool_error}"
@@ -528,7 +450,7 @@ def execute_tool_calls_concurrent(agent, assistant_message, messages: list, effe
                 logger.info("tool %s failed (%.2fs): %s", function_name, duration, result[:200])
             else:
                 logger.info("tool %s completed (%.2fs, %d chars)", function_name, duration, len(result))
-            results[index] = (function_name, function_args, result, duration, is_error, False, middleware_trace)
+            results[index] = (function_name, function_args, result, duration, is_error, False)
         finally:
             # Tear down worker-tid tracking.  Clear any interrupt bit we may
             # have set so the next task scheduled onto this recycled tid
@@ -553,7 +475,7 @@ def execute_tool_calls_concurrent(agent, assistant_message, messages: list, effe
     try:
         runnable_calls = [
             (i, tc, name, args)
-            for i, (tc, name, args, middleware_trace, block_result, blocked_by_guardrail) in enumerate(parsed_calls)
+            for i, (tc, name, args, block_result, blocked_by_guardrail) in enumerate(parsed_calls)
             if block_result is None
         ]
         futures = []
@@ -565,7 +487,7 @@ def execute_tool_calls_concurrent(agent, assistant_message, messages: list, effe
                     # _approval_session_key) AND thread-local approval/sudo
                     # callbacks into the worker thread; clears callbacks on exit.
                     f = executor.submit(
-                        propagate_context_to_thread(_run_tool), i, tc, name, args, parsed_calls[i][3]
+                        propagate_context_to_thread(_run_tool), i, tc, name, args
                     )
                     futures.append(f)
 
@@ -623,7 +545,7 @@ def execute_tool_calls_concurrent(agent, assistant_message, messages: list, effe
             spinner.stop(f"⚡ {completed}/{num_tools} tools completed in {total_dur:.1f}s total")
 
     # ── Post-execution: display per-tool results ─────────────────────
-    for i, (tc, name, args, middleware_trace, block_result, blocked_by_guardrail) in enumerate(parsed_calls):
+    for i, (tc, name, args, block_result, blocked_by_guardrail) in enumerate(parsed_calls):
         r = results[i]
         blocked = False
         if r is None:
@@ -640,7 +562,6 @@ def execute_tool_calls_concurrent(agent, assistant_message, messages: list, effe
                     status="cancelled",
                     error_type="keyboard_interrupt",
                     error_message="Tool execution cancelled by user interrupt",
-                    middleware_trace=list(middleware_trace),
                 )
             else:
                 function_result = f"Error executing tool '{name}': thread did not return a result"
@@ -654,11 +575,10 @@ def execute_tool_calls_concurrent(agent, assistant_message, messages: list, effe
                     status="error",
                     error_type="thread_missing_result",
                     error_message=function_result,
-                    middleware_trace=list(middleware_trace),
                 )
             tool_duration = 0.0
         else:
-            function_name, function_args, function_result, tool_duration, is_error, blocked, middleware_trace = r
+            function_name, function_args, function_result, tool_duration, is_error, blocked = r
 
             if not blocked:
                 function_result = agent._append_guardrail_observation(
@@ -702,7 +622,7 @@ def execute_tool_calls_concurrent(agent, assistant_message, messages: list, effe
         if agent._should_emit_quiet_tool_messages():
             cute_msg = _get_cute_tool_message_impl(name, args, tool_duration, result=function_result)
             agent._safe_print(f"  {cute_msg}")
-        elif getattr(agent, "tool_progress_mode", "all") != "off":
+        elif not agent.quiet_mode:
             _preview_str = _multimodal_text_summary(function_result)
             if agent.verbose_logging:
                 print(f"  ✅ Tool {i+1} completed in {tool_duration:.2f}s")
@@ -818,14 +738,6 @@ def execute_tool_calls_sequential(agent, assistant_message, messages: list, effe
         except Exception:
             pass
 
-        function_args, middleware_trace = _apply_tool_request_middleware_for_agent(
-            agent,
-            function_name=function_name,
-            function_args=function_args,
-            effective_task_id=effective_task_id,
-            tool_call_id=getattr(tool_call, "id", "") or "",
-        )
-
         # Check plugin hooks for a block directive before executing.
         _block_msg: Optional[str] = None
         _block_error_type = "plugin_block"
@@ -843,7 +755,6 @@ def execute_tool_calls_sequential(agent, assistant_message, messages: list, effe
                     tool_call_id=getattr(tool_call, "id", "") or "",
                     turn_id=getattr(agent, "_current_turn_id", "") or "",
                     api_request_id=getattr(agent, "_current_api_request_id", "") or "",
-                    middleware_trace=list(middleware_trace),
                 )
             except Exception:
                 pass
@@ -942,7 +853,6 @@ def execute_tool_calls_sequential(agent, assistant_message, messages: list, effe
                 status="blocked",
                 error_type=_block_error_type,
                 error_message=_block_msg,
-                middleware_trace=list(middleware_trace),
             )
         elif _guardrail_block_decision is not None:
             # Tool blocked by tool-loop guardrail — synthesize exactly one
@@ -959,131 +869,75 @@ def execute_tool_calls_sequential(agent, assistant_message, messages: list, effe
                 status="blocked",
                 error_type="guardrail_block",
                 error_message=getattr(_guardrail_block_decision, "message", None) or "Tool blocked by guardrail policy",
-                middleware_trace=list(middleware_trace),
             )
         elif function_name == "todo":
-            def _execute(next_args: dict) -> Any:
-                from tools.todo_tool import todo_tool as _todo_tool
-                return _todo_tool(
-                    todos=next_args.get("todos"),
-                    merge=next_args.get("merge", False),
-                    store=agent._todo_store,
-                )
-            function_result, function_args = _run_agent_tool_execution_middleware(
-                agent,
-                function_name=function_name,
-                function_args=function_args,
-                effective_task_id=effective_task_id,
-                tool_call_id=getattr(tool_call, "id", "") or "",
-                execute=_execute,
+            from tools.todo_tool import todo_tool as _todo_tool
+            function_result = _todo_tool(
+                todos=function_args.get("todos"),
+                merge=function_args.get("merge", False),
+                store=agent._todo_store,
             )
             tool_duration = time.time() - tool_start_time
             if agent._should_emit_quiet_tool_messages():
                 agent._vprint(f"  {_get_cute_tool_message_impl('todo', function_args, tool_duration, result=function_result)}")
         elif function_name == "session_search":
-            def _execute(next_args: dict) -> Any:
-                session_db = agent._get_session_db_for_recall()
-                if not session_db:
-                    from hermes_state import format_session_db_unavailable
-                    return json.dumps({"success": False, "error": format_session_db_unavailable()})
+            session_db = agent._get_session_db_for_recall()
+            if not session_db:
+                from hermes_state import format_session_db_unavailable
+                function_result = json.dumps({"success": False, "error": format_session_db_unavailable()})
+            else:
                 from tools.session_search_tool import session_search as _session_search
-                return _session_search(
-                    query=next_args.get("query", ""),
-                    role_filter=next_args.get("role_filter"),
-                    limit=next_args.get("limit", 3),
-                    session_id=next_args.get("session_id"),
-                    around_message_id=next_args.get("around_message_id"),
-                    window=next_args.get("window", 5),
-                    sort=next_args.get("sort"),
+                function_result = _session_search(
+                    query=function_args.get("query", ""),
+                    role_filter=function_args.get("role_filter"),
+                    limit=function_args.get("limit", 3),
+                    session_id=function_args.get("session_id"),
+                    around_message_id=function_args.get("around_message_id"),
+                    window=function_args.get("window", 5),
+                    sort=function_args.get("sort"),
                     db=session_db,
                     current_session_id=agent.session_id,
                 )
-            function_result, function_args = _run_agent_tool_execution_middleware(
-                agent,
-                function_name=function_name,
-                function_args=function_args,
-                effective_task_id=effective_task_id,
-                tool_call_id=getattr(tool_call, "id", "") or "",
-                execute=_execute,
-            )
             tool_duration = time.time() - tool_start_time
             if agent._should_emit_quiet_tool_messages():
                 agent._vprint(f"  {_get_cute_tool_message_impl('session_search', function_args, tool_duration, result=function_result)}")
         elif function_name == "memory":
-            def _execute(next_args: dict) -> Any:
-                target = next_args.get("target", "memory")
-                from tools.memory_tool import memory_tool as _memory_tool
-                result = _memory_tool(
-                    action=next_args.get("action"),
-                    target=target,
-                    content=next_args.get("content"),
-                    old_text=next_args.get("old_text"),
-                    store=agent._memory_store,
-                )
-                # Bridge: notify external memory provider of built-in memory writes
-                if agent._memory_manager and next_args.get("action") in {"add", "replace"}:
-                    try:
-                        agent._memory_manager.on_memory_write(
-                            next_args.get("action", ""),
-                            target,
-                            next_args.get("content", ""),
-                            metadata=agent._build_memory_write_metadata(
-                                task_id=effective_task_id,
-                                tool_call_id=getattr(tool_call, "id", None),
-                            ),
-                        )
-                    except Exception:
-                        pass
-                return result
-            function_result, function_args = _run_agent_tool_execution_middleware(
-                agent,
-                function_name=function_name,
-                function_args=function_args,
-                effective_task_id=effective_task_id,
-                tool_call_id=getattr(tool_call, "id", "") or "",
-                execute=_execute,
+            target = function_args.get("target", "memory")
+            from tools.memory_tool import memory_tool as _memory_tool
+            function_result = _memory_tool(
+                action=function_args.get("action"),
+                target=target,
+                content=function_args.get("content"),
+                old_text=function_args.get("old_text"),
+                store=agent._memory_store,
             )
+            # Bridge: notify external memory provider of built-in memory writes
+            if agent._memory_manager and function_args.get("action") in {"add", "replace"}:
+                try:
+                    agent._memory_manager.on_memory_write(
+                        function_args.get("action", ""),
+                        target,
+                        function_args.get("content", ""),
+                        metadata=agent._build_memory_write_metadata(
+                            task_id=effective_task_id,
+                            tool_call_id=getattr(tool_call, "id", None),
+                        ),
+                    )
+                except Exception:
+                    pass
             tool_duration = time.time() - tool_start_time
             if agent._should_emit_quiet_tool_messages():
                 agent._vprint(f"  {_get_cute_tool_message_impl('memory', function_args, tool_duration, result=function_result)}")
         elif function_name == "clarify":
-            def _execute(next_args: dict) -> Any:
-                from tools.clarify_tool import clarify_tool as _clarify_tool
-                return _clarify_tool(
-                    question=next_args.get("question", ""),
-                    choices=next_args.get("choices"),
-                    callback=agent.clarify_callback,
-                )
-            function_result, function_args = _run_agent_tool_execution_middleware(
-                agent,
-                function_name=function_name,
-                function_args=function_args,
-                effective_task_id=effective_task_id,
-                tool_call_id=getattr(tool_call, "id", "") or "",
-                execute=_execute,
+            from tools.clarify_tool import clarify_tool as _clarify_tool
+            function_result = _clarify_tool(
+                question=function_args.get("question", ""),
+                choices=function_args.get("choices"),
+                callback=agent.clarify_callback,
             )
             tool_duration = time.time() - tool_start_time
             if agent._should_emit_quiet_tool_messages():
                 agent._vprint(f"  {_get_cute_tool_message_impl('clarify', function_args, tool_duration, result=function_result)}")
-        elif function_name == "read_terminal":
-            def _execute(next_args: dict) -> Any:
-                from tools.read_terminal_tool import read_terminal_tool as _read_terminal_tool
-                return _read_terminal_tool(
-                    start_line=next_args.get("start_line"),
-                    count=next_args.get("count"),
-                    callback=getattr(agent, "read_terminal_callback", None),
-                )
-            function_result, function_args = _run_agent_tool_execution_middleware(
-                agent,
-                function_name=function_name,
-                function_args=function_args,
-                effective_task_id=effective_task_id,
-                tool_call_id=getattr(tool_call, "id", "") or "",
-                execute=_execute,
-            )
-            tool_duration = time.time() - tool_start_time
-            if agent._should_emit_quiet_tool_messages():
-                agent._vprint(f"  {_get_cute_tool_message_impl('read_terminal', function_args, tool_duration, result=function_result)}")
         elif function_name == "delegate_task":
             tasks_arg = function_args.get("tasks")
             if tasks_arg and isinstance(tasks_arg, list):
@@ -1103,16 +957,7 @@ def execute_tool_calls_sequential(agent, assistant_message, messages: list, effe
             agent._delegate_spinner = spinner
             _delegate_result = None
             try:
-                def _execute(next_args: dict) -> Any:
-                    return agent._dispatch_delegate_task(next_args)
-                function_result, function_args = _run_agent_tool_execution_middleware(
-                    agent,
-                    function_name=function_name,
-                    function_args=function_args,
-                    effective_task_id=effective_task_id,
-                    tool_call_id=getattr(tool_call, "id", "") or "",
-                    execute=_execute,
-                )
+                function_result = agent._dispatch_delegate_task(function_args)
                 _delegate_result = function_result
             finally:
                 agent._delegate_spinner = None
@@ -1133,16 +978,7 @@ def execute_tool_calls_sequential(agent, assistant_message, messages: list, effe
                 spinner.start()
             _ce_result = None
             try:
-                def _execute(next_args: dict) -> Any:
-                    return agent.context_compressor.handle_tool_call(function_name, next_args, messages=messages)
-                function_result, function_args = _run_agent_tool_execution_middleware(
-                    agent,
-                    function_name=function_name,
-                    function_args=function_args,
-                    effective_task_id=effective_task_id,
-                    tool_call_id=getattr(tool_call, "id", "") or "",
-                    execute=_execute,
-                )
+                function_result = agent.context_compressor.handle_tool_call(function_name, function_args, messages=messages)
                 _ce_result = function_result
             except Exception as tool_error:
                 function_result = json.dumps({"error": f"Context engine tool '{function_name}' failed: {tool_error}"})
@@ -1166,16 +1002,7 @@ def execute_tool_calls_sequential(agent, assistant_message, messages: list, effe
                 spinner.start()
             _mem_result = None
             try:
-                def _execute(next_args: dict) -> Any:
-                    return agent._memory_manager.handle_tool_call(function_name, next_args)
-                function_result, function_args = _run_agent_tool_execution_middleware(
-                    agent,
-                    function_name=function_name,
-                    function_args=function_args,
-                    effective_task_id=effective_task_id,
-                    tool_call_id=getattr(tool_call, "id", "") or "",
-                    execute=_execute,
-                )
+                function_result = agent._memory_manager.handle_tool_call(function_name, function_args)
                 _mem_result = function_result
             except Exception as tool_error:
                 function_result = json.dumps({"error": f"Memory tool '{function_name}' failed: {tool_error}"})
@@ -1205,10 +1032,8 @@ def execute_tool_calls_sequential(agent, assistant_message, messages: list, effe
                     api_request_id=getattr(agent, "_current_api_request_id", "") or "",
                     enabled_tools=list(agent.valid_tool_names) if agent.valid_tool_names else None,
                     skip_pre_tool_call_hook=True,
-                    skip_tool_request_middleware=True,
                     enabled_toolsets=getattr(agent, "enabled_toolsets", None),
                     disabled_toolsets=getattr(agent, "disabled_toolsets", None),
-                    tool_request_middleware_trace=list(middleware_trace),
                 )
                 _spinner_result = function_result
             except KeyboardInterrupt:
@@ -1219,7 +1044,6 @@ def execute_tool_calls_sequential(agent, assistant_message, messages: list, effe
                     effective_task_id=effective_task_id,
                     tool_call_id=getattr(tool_call, "id", "") or "",
                     start_time=tool_start_time,
-                    middleware_trace=list(middleware_trace),
                 )
                 _spinner_result = function_result
                 try:
@@ -1247,10 +1071,8 @@ def execute_tool_calls_sequential(agent, assistant_message, messages: list, effe
                     api_request_id=getattr(agent, "_current_api_request_id", "") or "",
                     enabled_tools=list(agent.valid_tool_names) if agent.valid_tool_names else None,
                     skip_pre_tool_call_hook=True,
-                    skip_tool_request_middleware=True,
                     enabled_toolsets=getattr(agent, "enabled_toolsets", None),
                     disabled_toolsets=getattr(agent, "disabled_toolsets", None),
-                    tool_request_middleware_trace=list(middleware_trace),
                 )
             except KeyboardInterrupt:
                 _emit_cancelled_terminal_post_tool_call(
@@ -1260,7 +1082,6 @@ def execute_tool_calls_sequential(agent, assistant_message, messages: list, effe
                     effective_task_id=effective_task_id,
                     tool_call_id=getattr(tool_call, "id", "") or "",
                     start_time=tool_start_time,
-                    middleware_trace=list(middleware_trace),
                 )
                 try:
                     agent.interrupt("keyboard interrupt")
@@ -1305,7 +1126,6 @@ def execute_tool_calls_sequential(agent, assistant_message, messages: list, effe
                 effective_task_id=effective_task_id,
                 tool_call_id=getattr(tool_call, "id", "") or "",
                 duration_ms=int(tool_duration * 1000),
-                middleware_trace=list(middleware_trace),
             )
         if not _execution_blocked:
             function_result = agent._append_guardrail_observation(

agent/transports/codex_app_server.py

@@ -378,7 +378,6 @@ def check_codex_binary(
             capture_output=True,
             text=True,
             timeout=10,
-            stdin=subprocess.DEVNULL,
         )
     except FileNotFoundError:
         return False, (

agent/transports/codex_app_server_session.py

@@ -72,9 +72,6 @@ class TurnResult:
     error: Optional[str] = None  # Set if turn ended in a non-recoverable error
     turn_id: Optional[str] = None
     thread_id: Optional[str] = None
-    token_usage_last: Optional[dict[str, Any]] = None
-    token_usage_total: Optional[dict[str, Any]] = None
-    model_context_window: Optional[int] = None
     # Hint to the caller that the underlying codex subprocess is likely
     # wedged (turn-level timeout fired, post-tool watchdog tripped, or
     # token-refresh failure killed the child). The caller should retire
@@ -504,7 +501,6 @@ class CodexAppServerSession:
                     pending = self._client.take_notification(timeout=0)
                     if pending is None:
                         break
-                    _apply_token_usage_notification(result, pending)
                     self._track_pending_file_change(pending)
                     proj = projector.project(pending)
                     if proj.messages:
@@ -540,8 +536,6 @@ class CodexAppServerSession:
                 except Exception:  # pragma: no cover - display callback
                     logger.debug("on_event callback raised", exc_info=True)
 
-            _apply_token_usage_notification(result, note)
-
             # Track in-progress fileChange items so the approval bridge
             # can surface a real change summary when codex requests
             # approval (the approval params themselves don't carry the
@@ -808,30 +802,6 @@ class CodexAppServerSession:
         return cached
 
 
-def _apply_token_usage_notification(result: TurnResult, note: dict) -> None:
-    """Capture Codex app-server token usage updates for caller accounting.
-
-    Codex does not put token usage on turn/completed. It emits a separate
-    thread/tokenUsage/updated notification containing cumulative totals and
-    the latest turn breakdown.
-    """
-    if not isinstance(note, dict) or note.get("method") != "thread/tokenUsage/updated":
-        return
-    params = note.get("params") or {}
-    token_usage = params.get("tokenUsage") or {}
-    if not isinstance(token_usage, dict):
-        return
-    last = token_usage.get("last")
-    total = token_usage.get("total")
-    if isinstance(last, dict):
-        result.token_usage_last = dict(last)
-    if isinstance(total, dict):
-        result.token_usage_total = dict(total)
-    window = token_usage.get("modelContextWindow")
-    if isinstance(window, int) and window > 0:
-        result.model_context_window = window
-
-
 def _approval_choice_to_codex_decision(choice: str) -> str:
     """Map Hermes approval choices onto codex's CommandExecutionApprovalDecision
     / FileChangeApprovalDecision wire values.

agent/turn_context.py

@@ -1,388 +0,0 @@
-"""Per-turn setup for ``run_conversation`` (the turn prologue).
-
-``run_conversation`` opened with ~470 lines of straight-line setup before the
-tool-calling loop ever started: stdio guarding, runtime-main wiring, retry-counter
-resets, user-message sanitization, todo/nudge-counter hydration, system-prompt
-restore-or-build, crash-resilience persistence, preflight context compression, the
-``pre_llm_call`` plugin hook, and external-memory prefetch.
-
-All of that is *prologue* — it runs once per turn, has no back-references into the
-loop, and produces a fixed set of values the loop then consumes. ``TurnContext``
-captures those produced values; ``build_turn_context`` performs the setup work and
-returns one. ``run_conversation`` is left to unpack the context and run the loop,
-shrinking the orchestrator by the full prologue.
-
-The builder still mutates ``agent`` heavily (counters, thread id, cached prompt,
-session DB) exactly as the inline code did — those side effects are the point. The
-``TurnContext`` it returns carries only the *locals* the loop reads back.
-
-Behavior is identical to the original inline prologue; this is a pure
-move-and-name refactor with no semantic change.
-"""
-
-from __future__ import annotations
-
-import logging
-import threading
-import uuid
-from dataclasses import dataclass
-from typing import Any, Dict, List, Optional
-
-from agent.iteration_budget import IterationBudget
-from agent.model_metadata import estimate_request_tokens_rough
-
-logger = logging.getLogger(__name__)
-
-
-@dataclass
-class TurnContext:
-    """Values produced by the turn prologue and consumed by the turn loop."""
-
-    # Sanitized inbound message (surrogates stripped).
-    user_message: str
-    # Clean message preserved for transcripts / memory queries (no nudge injection).
-    original_user_message: Any
-    # Working message list for this turn (loop appends to it).
-    messages: List[Dict[str, Any]]
-    # May be reset to None by preflight compression (new session created).
-    conversation_history: Optional[List[Dict[str, Any]]]
-    # Cached system prompt active for this turn (may be rebuilt by compression).
-    active_system_prompt: Optional[str]
-    # Task / turn identifiers.
-    effective_task_id: str
-    turn_id: str
-    # Index of the current user turn within ``messages``.
-    current_turn_user_idx: int
-    # Whether the post-turn memory review should fire.
-    should_review_memory: bool = False
-    # Context contributed by ``pre_llm_call`` plugins (appended to user message).
-    plugin_user_context: str = ""
-    # External-memory prefetch result, reused across loop iterations.
-    ext_prefetch_cache: str = ""
-
-
-def build_turn_context(
-    agent,
-    user_message: str,
-    system_message: Optional[str],
-    conversation_history: Optional[List[Dict[str, Any]]],
-    task_id: Optional[str],
-    stream_callback,
-    persist_user_message: Optional[str],
-    *,
-    restore_or_build_system_prompt,
-    install_safe_stdio,
-    sanitize_surrogates,
-    summarize_user_message_for_log,
-    set_session_context,
-    set_current_write_origin,
-    ra,
-) -> TurnContext:
-    """Run the once-per-turn setup and return the loop's input context.
-
-    The callables/helpers the original prologue referenced from the
-    ``conversation_loop`` module are passed in explicitly to keep this module
-    free of an import cycle with ``agent.conversation_loop``.
-    """
-    # Guard stdio against OSError from broken pipes (systemd/headless/daemon).
-    install_safe_stdio()
-
-    agent._ensure_db_session()
-
-    # Tell auxiliary_client what the live main provider/model are for this turn.
-    try:
-        from agent.auxiliary_client import set_runtime_main
-        set_runtime_main(
-            getattr(agent, "provider", "") or "",
-            getattr(agent, "model", "") or "",
-            base_url=getattr(agent, "base_url", "") or "",
-            api_key=getattr(agent, "api_key", "") or "",
-            api_mode=getattr(agent, "api_mode", "") or "",
-        )
-    except Exception:
-        pass
-
-    # Tag log records on this thread with the session ID for ``hermes logs``.
-    set_session_context(agent.session_id)
-
-    # Bind the skill write-origin ContextVar for this thread.
-    set_current_write_origin(getattr(agent, "_memory_write_origin", "assistant_tool"))
-
-    # Restore the primary runtime if the previous turn activated fallback.
-    agent._restore_primary_runtime()
-
-    # Sanitize surrogate characters from user input.
-    if isinstance(user_message, str):
-        user_message = sanitize_surrogates(user_message)
-    if isinstance(persist_user_message, str):
-        persist_user_message = sanitize_surrogates(persist_user_message)
-
-    # Store stream callback for _interruptible_api_call to pick up.
-    agent._stream_callback = stream_callback
-    agent._persist_user_message_idx = None
-    agent._persist_user_message_override = persist_user_message
-    # Generate unique task_id if not provided to isolate VMs between tasks.
-    effective_task_id = task_id or str(uuid.uuid4())
-    agent._current_task_id = effective_task_id
-    turn_id = f"{agent.session_id or 'session'}:{effective_task_id}:{uuid.uuid4().hex[:8]}"
-    agent._current_turn_id = turn_id
-    agent._current_api_request_id = ""
-
-    # Reset retry counters and iteration budget at the start of each turn.
-    agent._invalid_tool_retries = 0
-    agent._invalid_json_retries = 0
-    agent._empty_content_retries = 0
-    agent._incomplete_scratchpad_retries = 0
-    agent._codex_incomplete_retries = 0
-    agent._thinking_prefill_retries = 0
-    agent._post_tool_empty_retried = False
-    agent._last_content_with_tools = None
-    agent._last_content_tools_all_housekeeping = False
-    agent._mute_post_response = False
-    agent._unicode_sanitization_passes = 0
-    agent._tool_guardrails.reset_for_turn()
-    agent._tool_guardrail_halt_decision = None
-    agent._vision_supported = True
-
-    # Pre-turn connection health check: clean up dead TCP connections.
-    if agent.api_mode != "anthropic_messages":
-        try:
-            if agent._cleanup_dead_connections():
-                agent._emit_status(
-                    "🔌 Detected stale connections from a previous provider "
-                    "issue — cleaned up automatically. Proceeding with fresh "
-                    "connection."
-                )
-        except Exception:
-            pass
-    # Replay compression warning through status_callback for gateway platforms.
-    if agent._compression_warning:
-        agent._replay_compression_warning()
-        agent._compression_warning = None  # send once
-
-    # NOTE: _turns_since_memory and _iters_since_skill are NOT reset here.
-    agent.iteration_budget = IterationBudget(agent.max_iterations)
-
-    # Log conversation turn start for debugging/observability.
-    _preview_text = summarize_user_message_for_log(user_message)
-    _msg_preview = (_preview_text[:80] + "...") if len(_preview_text) > 80 else _preview_text
-    _msg_preview = _msg_preview.replace("\n", " ")
-    logger.info(
-        "conversation turn: session=%s model=%s provider=%s platform=%s history=%d msg=%r",
-        agent.session_id or "none", agent.model, agent.provider or "unknown",
-        agent.platform or "unknown", len(conversation_history or []),
-        _msg_preview,
-    )
-
-    # Initialize conversation (copy to avoid mutating the caller's list).
-    messages = list(conversation_history) if conversation_history else []
-
-    # Hydrate todo store from conversation history.
-    if conversation_history and not agent._todo_store.has_items():
-        agent._hydrate_todo_store(conversation_history)
-
-    # Hydrate per-session nudge counters from persisted history (issue #22357).
-    if conversation_history and agent._user_turn_count == 0:
-        prior_user_turns = sum(
-            1 for m in conversation_history if m.get("role") == "user"
-        )
-        if prior_user_turns > 0:
-            agent._user_turn_count = prior_user_turns
-            if agent._memory_nudge_interval > 0 and agent._turns_since_memory == 0:
-                agent._turns_since_memory = prior_user_turns % agent._memory_nudge_interval
-
-    # Track user turns for memory flush and periodic nudge logic.
-    agent._user_turn_count += 1
-
-    # Reset the streaming context scrubber at the top of each turn.
-    scrubber = getattr(agent, "_stream_context_scrubber", None)
-    if scrubber is not None:
-        scrubber.reset()
-    # Reset the think scrubber for the same reason.
-    think_scrubber = getattr(agent, "_stream_think_scrubber", None)
-    if think_scrubber is not None:
-        think_scrubber.reset()
-
-    # Preserve the original user message (no nudge injection).
-    original_user_message = persist_user_message if persist_user_message is not None else user_message
-
-    # Track memory nudge trigger (turn-based, checked here).
-    should_review_memory = False
-    if (agent._memory_nudge_interval > 0
-            and "memory" in agent.valid_tool_names
-            and agent._memory_store):
-        agent._turns_since_memory += 1
-        if agent._turns_since_memory >= agent._memory_nudge_interval:
-            should_review_memory = True
-            agent._turns_since_memory = 0
-
-    # Add user message.
-    user_msg = {"role": "user", "content": user_message}
-    messages.append(user_msg)
-    current_turn_user_idx = len(messages) - 1
-    agent._persist_user_message_idx = current_turn_user_idx
-
-    if not agent.quiet_mode:
-        _print_preview = summarize_user_message_for_log(user_message)
-        agent._safe_print(
-            f"💬 Starting conversation: '{_print_preview[:60]}"
-            f"{'...' if len(_print_preview) > 60 else ''}'"
-        )
-
-    # ── System prompt (cached per session for prefix caching) ──
-    if agent._cached_system_prompt is None:
-        restore_or_build_system_prompt(agent, system_message, conversation_history)
-
-    active_system_prompt = agent._cached_system_prompt
-
-    # Crash-resilience: persist the inbound user turn as soon as the session row exists.
-    try:
-        agent._persist_session(messages, conversation_history)
-    except Exception:
-        logger.warning(
-            "Early turn-start session persistence failed for session=%s",
-            agent.session_id or "none",
-            exc_info=True,
-        )
-
-    # ── Preflight context compression ──
-    if (
-        agent.compression_enabled
-        and len(messages) > agent.context_compressor.protect_first_n
-                            + agent.context_compressor.protect_last_n + 1
-    ):
-        _preflight_tokens = estimate_request_tokens_rough(
-            messages,
-            system_prompt=active_system_prompt or "",
-            tools=agent.tools or None,
-        )
-        _compressor = agent.context_compressor
-        _defer_preflight = getattr(
-            _compressor,
-            "should_defer_preflight_to_real_usage",
-            lambda _tokens: False,
-        )
-        _preflight_deferred = _defer_preflight(_preflight_tokens)
-
-        if not _preflight_deferred:
-            _last = _compressor.last_prompt_tokens
-            # Do NOT overwrite the -1 sentinel (#36718).
-            if _last >= 0 and _preflight_tokens > _last:
-                _compressor.last_prompt_tokens = _preflight_tokens
-
-        if _preflight_deferred:
-            logger.info(
-                "Skipping preflight compression: rough estimate ~%s >= %s, "
-                "but last real provider prompt was %s after compression",
-                f"{_preflight_tokens:,}",
-                f"{_compressor.threshold_tokens:,}",
-                f"{_compressor.last_real_prompt_tokens:,}",
-            )
-        elif _compressor.should_compress(_preflight_tokens):
-            logger.info(
-                "Preflight compression: ~%s tokens >= %s threshold (model %s, ctx %s)",
-                f"{_preflight_tokens:,}",
-                f"{_compressor.threshold_tokens:,}",
-                agent.model,
-                f"{_compressor.context_length:,}",
-            )
-            agent._emit_status(
-                f"📦 Preflight compression: ~{_preflight_tokens:,} tokens "
-                f">= {_compressor.threshold_tokens:,} threshold. "
-                "This may take a moment."
-            )
-            for _pass in range(3):
-                _orig_len = len(messages)
-                messages, active_system_prompt = agent._compress_context(
-                    messages, system_message, approx_tokens=_preflight_tokens,
-                    task_id=effective_task_id,
-                )
-                if len(messages) >= _orig_len:
-                    break  # Cannot compress further
-                conversation_history = None
-                agent._empty_content_retries = 0
-                agent._thinking_prefill_retries = 0
-                agent._last_content_with_tools = None
-                agent._last_content_tools_all_housekeeping = False
-                agent._mute_post_response = False
-                _preflight_tokens = estimate_request_tokens_rough(
-                    messages,
-                    system_prompt=active_system_prompt or "",
-                    tools=agent.tools or None,
-                )
-                if not _compressor.should_compress(_preflight_tokens):
-                    break
-
-    # Plugin hook: pre_llm_call (context injected into user message, not system prompt).
-    plugin_user_context = ""
-    try:
-        from hermes_cli.plugins import invoke_hook as _invoke_hook
-        _pre_results = _invoke_hook(
-            "pre_llm_call",
-            session_id=agent.session_id,
-            task_id=effective_task_id,
-            turn_id=turn_id,
-            user_message=original_user_message,
-            conversation_history=list(messages),
-            is_first_turn=(not bool(conversation_history)),
-            model=agent.model,
-            platform=getattr(agent, "platform", None) or "",
-            sender_id=getattr(agent, "_user_id", None) or "",
-        )
-        _ctx_parts: list[str] = []
-        for r in _pre_results:
-            if isinstance(r, dict) and r.get("context"):
-                _ctx_parts.append(str(r["context"]))
-            elif isinstance(r, str) and r.strip():
-                _ctx_parts.append(r)
-        if _ctx_parts:
-            plugin_user_context = "\n\n".join(_ctx_parts)
-    except Exception as exc:
-        logger.warning("pre_llm_call hook failed: %s", exc)
-
-    # Per-turn file-mutation verifier state.
-    agent._turn_failed_file_mutations = {}
-
-    # Record the execution thread so interrupt()/clear_interrupt() can scope
-    # the tool-level interrupt signal to THIS agent's thread only.
-    agent._execution_thread_id = threading.current_thread().ident
-
-    # Clear stale per-thread interrupt state, preserving a pending interrupt.
-    ra()._set_interrupt(False, agent._execution_thread_id)
-    if agent._interrupt_requested:
-        ra()._set_interrupt(True, agent._execution_thread_id)
-        agent._interrupt_thread_signal_pending = False
-    else:
-        agent._interrupt_message = None
-        agent._interrupt_thread_signal_pending = False
-
-    # Notify memory providers of the new turn (BEFORE prefetch_all).
-    if agent._memory_manager:
-        try:
-            _turn_msg = original_user_message if isinstance(original_user_message, str) else ""
-            agent._memory_manager.on_turn_start(agent._user_turn_count, _turn_msg)
-        except Exception:
-            pass
-
-    # External memory provider: prefetch once before the tool loop.
-    ext_prefetch_cache = ""
-    if agent._memory_manager:
-        try:
-            _query = original_user_message if isinstance(original_user_message, str) else ""
-            ext_prefetch_cache = agent._memory_manager.prefetch_all(_query) or ""
-        except Exception:
-            pass
-
-    return TurnContext(
-        user_message=user_message,
-        original_user_message=original_user_message,
-        messages=messages,
-        conversation_history=conversation_history,
-        active_system_prompt=active_system_prompt,
-        effective_task_id=effective_task_id,
-        turn_id=turn_id,
-        current_turn_user_idx=current_turn_user_idx,
-        should_review_memory=should_review_memory,
-        plugin_user_context=plugin_user_context,
-        ext_prefetch_cache=ext_prefetch_cache,
-    )

agent/turn_finalizer.py

@@ -1,428 +0,0 @@
-"""Post-loop turn finalization for ``run_conversation``.
-
-Extracted from ``agent/conversation_loop.py`` as part of the god-file
-decomposition campaign (``~/.hermes/plans/god-file-decomposition.md``, Phase 1
-step 4 — the post-loop ``TurnFinalizer`` seam). ``run_conversation``'s tail
-(everything after the main tool-calling ``while`` loop) is lifted here verbatim:
-budget-exhaustion summary, trajectory save, session persist, turn diagnostics,
-response transforms, result-dict assembly, steer drain, and the memory/skill
-review trigger.
-
-Behavior-neutral: the body is moved unchanged. All ``agent.*`` side effects fire
-exactly as before; only the post-loop *locals* are passed in as keyword args, and
-the assembled ``result`` dict is returned to ``run_conversation`` which returns it
-to the caller. The function is synchronous with a single return — mirroring the
-region it replaces (no awaits, no early returns).
-
-Module ``logger`` is imported lazily inside the body (``from
-agent.conversation_loop import logger``) so this module never imports
-``agent.conversation_loop`` at import time -> no import cycle, and the log records
-keep the exact logger name (``"agent.conversation_loop"``).
-"""
-
-from __future__ import annotations
-
-import os
-
-from agent.codex_responses_adapter import _summarize_user_message_for_log
-
-
-def finalize_turn(
-    agent,
-    *,
-    final_response,
-    api_call_count,
-    interrupted,
-    failed,
-    messages,
-    conversation_history,
-    effective_task_id,
-    turn_id,
-    user_message,
-    original_user_message,
-    _should_review_memory,
-    _turn_exit_reason,
-):
-    """Run the post-loop finalization and return the turn ``result`` dict.
-
-    Lifted verbatim from ``run_conversation`` (the region after the main agent
-    loop). See module docstring.
-    """
-    from agent.conversation_loop import logger
-
-    if final_response is None and (
-        api_call_count >= agent.max_iterations
-        or agent.iteration_budget.remaining <= 0
-    ):
-        # Budget exhausted — ask the model for a summary via one extra
-        # API call with tools stripped.  _handle_max_iterations injects a
-        # user message and makes a single toolless request.
-        _turn_exit_reason = f"max_iterations_reached({api_call_count}/{agent.max_iterations})"
-        agent._emit_status(
-            f"⚠️ Iteration budget exhausted ({api_call_count}/{agent.max_iterations}) "
-            "— asking model to summarise"
-        )
-        if not agent.quiet_mode:
-            agent._safe_print(
-                f"\n⚠️  Iteration budget exhausted ({api_call_count}/{agent.max_iterations}) "
-                "— requesting summary..."
-            )
-        final_response = agent._handle_max_iterations(messages, api_call_count)
-
-        # If running as a kanban worker, signal the dispatcher that the
-        # worker could not complete (rather than treating it as a
-        # protocol violation).  The agent loop strips tools before calling
-        # _handle_max_iterations, so the model cannot call kanban_block
-        # itself — we must do it on its behalf.
-        #
-        # We route through ``_record_task_failure(outcome="timed_out")``
-        # rather than ``kanban_block`` so this counts toward the
-        # ``consecutive_failures`` counter and the dispatcher's
-        # ``failure_limit`` circuit breaker (#29747 gap 2).  Without this,
-        # a task whose worker keeps exhausting its budget would block
-        # silently each run, get auto-promoted by the operator (or never
-        # surface), and re-block in an endless loop with no signal.
-        _kanban_task = os.environ.get("HERMES_KANBAN_TASK")
-        if _kanban_task:
-            try:
-                from hermes_cli import kanban_db as _kb
-                _conn = _kb.connect()
-                try:
-                    _kb._record_task_failure(
-                        _conn,
-                        _kanban_task,
-                        error=(
-                            f"Iteration budget exhausted "
-                            f"({api_call_count}/{agent.max_iterations}) — "
-                            "task could not complete within the allowed "
-                            "iterations"
-                        ),
-                        outcome="timed_out",
-                        release_claim=True,
-                        end_run=True,
-                        event_payload_extra={
-                            "budget_used": api_call_count,
-                            "budget_max": agent.max_iterations,
-                        },
-                    )
-                    logger.info(
-                        "recorded budget-exhausted failure for task %s (%d/%d)",
-                        _kanban_task, api_call_count, agent.max_iterations,
-                    )
-                finally:
-                    try:
-                        _conn.close()
-                    except Exception:
-                        pass
-            except Exception:
-                logger.warning(
-                    "Failed to record budget-exhausted failure for task %s",
-                    _kanban_task,
-                    exc_info=True,
-                )
-
-    # Determine if conversation completed successfully
-    completed = (
-        final_response is not None
-        and api_call_count < agent.max_iterations
-        and not failed
-    )
-
-    # Save trajectory if enabled.  ``user_message`` may be a multimodal
-    # list of parts; the trajectory format wants a plain string.
-    agent._save_trajectory(messages, _summarize_user_message_for_log(user_message), completed)
-
-    # Clean up VM and browser for this task after conversation completes
-    agent._cleanup_task_resources(effective_task_id)
-
-    # Persist session to both JSON log and SQLite only after private retry
-    # scaffolding has been removed. Otherwise a later user "continue" turn
-    # can replay assistant("(empty)") / recovery nudges and fall into the
-    # same empty-response loop again.
-    agent._drop_trailing_empty_response_scaffolding(messages)
-    agent._persist_session(messages, conversation_history)
-
-    # ── Turn-exit diagnostic log ─────────────────────────────────────
-    # Always logged at INFO so agent.log captures WHY every turn ended.
-    # When the last message is a tool result (agent was mid-work), log
-    # at WARNING — this is the "just stops" scenario users report.
-    _last_msg_role = messages[-1].get("role") if messages else None
-    _last_tool_name = None
-    if _last_msg_role == "tool":
-        # Walk back to find the assistant message with the tool call
-        for _m in reversed(messages):
-            if _m.get("role") == "assistant" and _m.get("tool_calls"):
-                _tcs = _m["tool_calls"]
-                if _tcs and isinstance(_tcs[0], dict):
-                    _last_tool_name = _tcs[-1].get("function", {}).get("name")
-                break
-
-    _turn_tool_count = sum(
-        1 for m in messages
-        if isinstance(m, dict) and m.get("role") == "assistant" and m.get("tool_calls")
-    )
-    _resp_len = len(final_response) if final_response else 0
-    _budget_used = agent.iteration_budget.used if agent.iteration_budget else 0
-    _budget_max = agent.iteration_budget.max_total if agent.iteration_budget else 0
-
-    _diag_msg = (
-        "Turn ended: reason=%s model=%s api_calls=%d/%d budget=%d/%d "
-        "tool_turns=%d last_msg_role=%s response_len=%d session=%s"
-    )
-    _diag_args = (
-        _turn_exit_reason, agent.model, api_call_count, agent.max_iterations,
-        _budget_used, _budget_max,
-        _turn_tool_count, _last_msg_role, _resp_len,
-        agent.session_id or "none",
-    )
-
-    if _last_msg_role == "tool" and not interrupted:
-        # Agent was mid-work — this is the "just stops" case.
-        logger.warning(
-            "Turn ended with pending tool result (agent may appear stuck). "
-            + _diag_msg + " last_tool=%s",
-            *_diag_args, _last_tool_name,
-        )
-    else:
-        logger.info(_diag_msg, *_diag_args)
-
-    # File-mutation verifier footer.
-    # If one or more ``write_file`` / ``patch`` calls failed during this
-    # turn and were never superseded by a successful write to the same
-    # path, append an advisory footer to the assistant response.  This
-    # catches the specific case — reported by Ben Eng (#15524-adjacent)
-    # — where a model issues a batch of parallel patches, half of them
-    # fail with "Could not find old_string", and the model summarises
-    # the turn claiming every file was edited.  The user then has to
-    # manually run ``git status`` to catch the lie.  With this footer
-    # the truth is surfaced on every turn, so over-claiming is
-    # structurally impossible past the model.
-    #
-    # Gate: only applied when a real text response exists for this
-    # turn and the user didn't interrupt.  Empty/interrupted turns
-    # already have other surface text that shouldn't be augmented.
-    if final_response and not interrupted:
-        try:
-            _failed = getattr(agent, "_turn_failed_file_mutations", None) or {}
-            if _failed and agent._file_mutation_verifier_enabled():
-                footer = agent._format_file_mutation_failure_footer(_failed)
-                if footer:
-                    final_response = final_response.rstrip() + "\n\n" + footer
-        except Exception as _ver_err:
-            logger.debug("file-mutation verifier footer failed: %s", _ver_err)
-
-    # Turn-completion explainer.
-    # When a turn ends abnormally after substantive work — empty content
-    # after retries, a partial/truncated stream, a still-pending tool
-    # result, or an iteration/budget limit — the user otherwise gets a
-    # blank or fragmentary response box with no consolidated reason why
-    # the agent stopped (#34452).  Surface a single user-visible
-    # explanation derived from ``_turn_exit_reason``, mirroring the
-    # file-mutation verifier footer pattern above.
-    #
-    # Gate carefully so healthy turns stay quiet:
-    #   - ``text_response(...)`` exits never produce an explanation
-    #     (handled inside the formatter), so a terse ``Done.`` is silent.
-    #   - We only ACT when there is no genuinely usable reply this turn:
-    #     an empty response, the "(empty)" terminal sentinel, or a
-    #     suspiciously short partial fragment with no terminating
-    #     punctuation (e.g. "The").  A real short answer keeps its text.
-    if not interrupted:
-        try:
-            if agent._turn_completion_explainer_enabled():
-                _stripped = (final_response or "").strip()
-                _is_empty_terminal = _stripped == "" or _stripped == "(empty)"
-                # A short fragment that is not a normal text_response exit
-                # and lacks sentence-ending punctuation is treated as a
-                # truncated partial (the "The" case from #34452).
-                _is_partial_fragment = (
-                    not _is_empty_terminal
-                    and not str(_turn_exit_reason).startswith("text_response")
-                    and len(_stripped) <= 24
-                    and _stripped[-1:] not in {".", "!", "?", "。", "！", "？", "`", ")"}
-                )
-                if _is_empty_terminal or _is_partial_fragment:
-                    _explanation = agent._format_turn_completion_explanation(
-                        _turn_exit_reason
-                    )
-                    if _explanation:
-                        if _is_empty_terminal:
-                            # Replace the bare "(empty)"/blank sentinel with
-                            # the actionable explanation.
-                            final_response = _explanation
-                        else:
-                            # Keep the partial fragment, append the reason so
-                            # the user sees both what arrived and why it
-                            # stopped.
-                            final_response = (
-                                _stripped + "\n\n" + _explanation
-                            )
-        except Exception as _exp_err:
-            logger.debug("turn-completion explainer failed: %s", _exp_err)
-
-    _response_transformed = False
-
-    # Plugin hook: transform_llm_output
-    # Fired once per turn after the tool-calling loop completes.
-    # Plugins can transform the LLM's output text before it's returned.
-    # First hook to return a string wins; None/empty return leaves text unchanged.
-    if final_response and not interrupted:
-        try:
-            from hermes_cli.plugins import invoke_hook as _invoke_hook
-            _transform_results = _invoke_hook(
-                "transform_llm_output",
-                response_text=final_response,
-                session_id=agent.session_id or "",
-                model=agent.model,
-                platform=getattr(agent, "platform", None) or "",
-            )
-            for _hook_result in _transform_results:
-                if isinstance(_hook_result, str) and _hook_result:
-                    final_response = _hook_result
-                    _response_transformed = True
-                    break  # First non-empty string wins
-        except Exception as exc:
-            logger.warning("transform_llm_output hook failed: %s", exc)
-
-    # Plugin hook: post_llm_call
-    # Fired once per turn after the tool-calling loop completes.
-    # Plugins can use this to persist conversation data (e.g. sync
-    # to an external memory system).
-    if final_response and not interrupted:
-        try:
-            from hermes_cli.plugins import invoke_hook as _invoke_hook
-            _invoke_hook(
-                "post_llm_call",
-                session_id=agent.session_id,
-                task_id=effective_task_id,
-                turn_id=turn_id,
-                user_message=original_user_message,
-                assistant_response=final_response,
-                conversation_history=list(messages),
-                model=agent.model,
-                platform=getattr(agent, "platform", None) or "",
-            )
-        except Exception as exc:
-            logger.warning("post_llm_call hook failed: %s", exc)
-
-    # Extract reasoning from the CURRENT turn only.  Walk backwards
-    # but stop at the user message that started this turn — anything
-    # earlier is from a prior turn and must not leak into the reasoning
-    # box (confusing stale display; #17055).  Within the current turn
-    # we still want the *most recent* non-empty reasoning: many
-    # providers (Claude thinking, DeepSeek v4, Codex Responses) emit
-    # reasoning on the tool-call step and leave the final-answer step
-    # with reasoning=None, so picking only the last assistant would
-    # silently drop legitimate same-turn reasoning.
-    last_reasoning = None
-    for msg in reversed(messages):
-        if msg.get("role") == "user":
-            break  # turn boundary — don't cross into prior turns
-        if msg.get("role") == "assistant" and msg.get("reasoning"):
-            last_reasoning = msg["reasoning"]
-            break
-
-    # Build result with interrupt info if applicable
-    result = {
-        "final_response": final_response,
-        "last_reasoning": last_reasoning,
-        "messages": messages,
-        "api_calls": api_call_count,
-        "completed": completed,
-        "turn_exit_reason": _turn_exit_reason,
-        "failed": failed,
-        "partial": False,  # True only when stopped due to invalid tool calls
-        "interrupted": interrupted,
-        "response_transformed": _response_transformed,
-        "response_previewed": getattr(agent, "_response_was_previewed", False),
-        "model": agent.model,
-        "provider": agent.provider,
-        "base_url": agent.base_url,
-        "input_tokens": agent.session_input_tokens,
-        "output_tokens": agent.session_output_tokens,
-        "cache_read_tokens": agent.session_cache_read_tokens,
-        "cache_write_tokens": agent.session_cache_write_tokens,
-        "reasoning_tokens": agent.session_reasoning_tokens,
-        "prompt_tokens": agent.session_prompt_tokens,
-        "completion_tokens": agent.session_completion_tokens,
-        "total_tokens": agent.session_total_tokens,
-        "last_prompt_tokens": getattr(agent.context_compressor, "last_prompt_tokens", 0) or 0,
-        "estimated_cost_usd": agent.session_estimated_cost_usd,
-        "cost_status": agent.session_cost_status,
-        "cost_source": agent.session_cost_source,
-        "session_id": agent.session_id,
-    }
-    if agent._tool_guardrail_halt_decision is not None:
-        result["guardrail"] = agent._tool_guardrail_halt_decision.to_metadata()
-    # If a /steer landed after the final assistant turn (no more tool
-    # batches to drain into), hand it back to the caller so it can be
-    # delivered as the next user turn instead of being silently lost.
-    _leftover_steer = agent._drain_pending_steer()
-    if _leftover_steer:
-        result["pending_steer"] = _leftover_steer
-    agent._response_was_previewed = False
-
-    # Include interrupt message if one triggered the interrupt
-    if interrupted and agent._interrupt_message:
-        result["interrupt_message"] = agent._interrupt_message
-
-    # Clear interrupt state after handling
-    agent.clear_interrupt()
-
-    # Clear stream callback so it doesn't leak into future calls
-    agent._stream_callback = None
-
-    # Check skill trigger NOW — based on how many tool iterations THIS turn used.
-    _should_review_skills = False
-    if (agent._skill_nudge_interval > 0
-            and agent._iters_since_skill >= agent._skill_nudge_interval
-            and "skill_manage" in agent.valid_tool_names):
-        _should_review_skills = True
-        agent._iters_since_skill = 0
-
-    # External memory provider: sync the completed turn + queue next prefetch.
-    agent._sync_external_memory_for_turn(
-        original_user_message=original_user_message,
-        final_response=final_response,
-        interrupted=interrupted,
-        messages=messages,
-    )
-
-    # Background memory/skill review — runs AFTER the response is delivered
-    # so it never competes with the user's task for model attention.
-    if final_response and not interrupted and (_should_review_memory or _should_review_skills):
-        try:
-            agent._spawn_background_review(
-                messages_snapshot=list(messages),
-                review_memory=_should_review_memory,
-                review_skills=_should_review_skills,
-            )
-        except Exception:
-            pass  # Background review is best-effort
-
-    # Note: Memory provider on_session_end() + shutdown_all() are NOT
-    # called here — run_conversation() is called once per user message in
-    # multi-turn sessions. Shutting down after every turn would kill the
-    # provider before the second message. Actual session-end cleanup is
-    # handled by the CLI (atexit / /reset) and gateway (session expiry /
-    # _reset_session).
-
-    # Plugin hook: on_session_end
-    # Fired at the very end of every run_conversation call.
-    # Plugins can use this for cleanup, flushing buffers, etc.
-    try:
-        from hermes_cli.plugins import invoke_hook as _invoke_hook
-        _invoke_hook(
-            "on_session_end",
-            session_id=agent.session_id,
-            task_id=effective_task_id,
-            turn_id=turn_id,
-            completed=completed,
-            interrupted=interrupted,
-            model=agent.model,
-            platform=getattr(agent, "platform", None) or "",
-        )
-    except Exception as exc:
-        logger.warning("on_session_end hook failed: %s", exc)
-
-    return result

agent/turn_retry_state.py

@@ -1,68 +0,0 @@
-"""Per-attempt recovery bookkeeping for the conversation turn loop.
-
-The inner retry loop in ``run_conversation`` (``while retry_count <
-max_retries``) makes several distinct recovery attempts on a single model API
-call: a credential-pool 429 retry, a per-provider OAuth refresh (codex,
-anthropic, nous, copilot), a long-context compression restart, a length-
-continuation restart, and a handful of format-recovery branches (thinking-
-signature stripping, multimodal-tool-content stripping, llama.cpp grammar
-fallback, image shrink, invalid-encrypted-content, 1M-beta header).
-
-Each of those branches is guarded by a one-shot boolean so it fires at most
-once per attempt. They used to be ~16 bare ``*_attempted`` / ``has_retried_*``
-/ ``restart_with_*`` locals declared inline before the loop and threaded
-through its 2,400-line body. ``TurnRetryState`` collapses them into one object
-the loop mutates in place (``state.codex_auth_retry_attempted = True``), giving
-the recovery bookkeeping a single named, testable home.
-
-Loop-control variables (``retry_count``, ``max_retries``,
-``max_compression_attempts``) intentionally stay as plain locals — they are the
-``while`` mechanics, not recovery bookkeeping, and putting them on the object
-would add indirection without clarifying anything.
-
-This module is dependency-free so it can be unit-tested in isolation and
-imported by the turn loop without an import cycle.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass, fields
-
-
-@dataclass
-class TurnRetryState:
-    """One-shot recovery guards + restart signals for a single API-call attempt.
-
-    A fresh instance is created for each iteration of the outer turn loop
-    (once per ``api_call_count``). Each guard fires its recovery branch at most
-    once; the ``restart_with_*`` signals are read by the loop after the attempt
-    to decide whether to rebuild the request and retry.
-    """
-
-    # ── Per-provider OAuth / credential refresh guards ───────────────────
-    codex_auth_retry_attempted: bool = False
-    anthropic_auth_retry_attempted: bool = False
-    nous_auth_retry_attempted: bool = False
-    nous_paid_entitlement_refresh_attempted: bool = False
-    copilot_auth_retry_attempted: bool = False
-
-    # ── Format / payload recovery guards ─────────────────────────────────
-    thinking_sig_retry_attempted: bool = False
-    invalid_encrypted_content_retry_attempted: bool = False
-    image_shrink_retry_attempted: bool = False
-    multimodal_tool_content_retry_attempted: bool = False
-    oauth_1m_beta_retry_attempted: bool = False
-    llama_cpp_grammar_retry_attempted: bool = False
-
-    # ── Transport / rate-limit recovery ──────────────────────────────────
-    primary_recovery_attempted: bool = False
-    has_retried_429: bool = False
-
-    # ── Restart signals (read by the outer loop after the attempt) ───────
-    restart_with_compressed_messages: bool = False
-    restart_with_length_continuation: bool = False
-
-    def __iter__(self):
-        # Convenience for debugging / tests: iterate (name, value) pairs.
-        for f in fields(self):
-            yield f.name, getattr(self, f.name)

agent/usage_pricing.py

@@ -13,7 +13,6 @@ DEFAULT_PRICING = {"input": 0.0, "output": 0.0}
 
 _ZERO = Decimal("0")
 _ONE_MILLION = Decimal("1000000")
-_NOUS_DEFAULT_BASE_URL = "https://inference-api.nousresearch.com/v1"
 
 CostStatus = Literal["actual", "estimated", "included", "unknown"]
 CostSource = Literal[
@@ -571,8 +570,6 @@ def resolve_billing_route(
         return BillingRoute(provider="openai-codex", model=model, base_url=base_url or "", billing_mode="subscription_included")
     if provider_name == "openrouter" or base_url_host_matches(base_url or "", "openrouter.ai"):
         return BillingRoute(provider="openrouter", model=model, base_url=base_url or "", billing_mode="official_models_api")
-    if provider_name == "nous" or base_url_host_matches(base_url or "", "inference-api.nousresearch.com"):
-        return BillingRoute(provider="nous", model=model, base_url=base_url or _NOUS_DEFAULT_BASE_URL, billing_mode="official_models_api")
     if provider_name == "anthropic":
         return BillingRoute(provider="anthropic", model=model.split("/")[-1], base_url=base_url or "", billing_mode="official_docs_snapshot")
     if provider_name == "openai":

apps/bootstrap-installer/src-tauri/src/powershell.rs

@@ -72,7 +72,7 @@ pub async fn run_script(
 
     let mut child: Child = cmd
         .spawn()
-        .with_context(|| format!("spawning {} via {}", script_path.display(), interpreter_label()))?;
+        .with_context(|| format!("spawning {}", script_path.display()))?;
 
     let stdout = child.stdout.take().expect("stdout was piped");
     let stderr = child.stderr.take().expect("stderr was piped");
@@ -177,9 +177,8 @@ async fn recv_cancel(rx: &mut Option<CancelRx>) {
 fn build_command(script_path: &Path, args: &[String]) -> Command {
     // We want PowerShell 5.1 / 7. install.ps1 uses 5.1-safe syntax everywhere.
     // Prefer `powershell.exe` (5.1 baseline, present on every Windows since 7)
-    // over `pwsh.exe` (7+, may not be present). Resolve it by absolute path —
-    // see `windows_powershell_exe`.
-    let mut cmd = Command::new(windows_powershell_exe());
+    // over `pwsh.exe` (7+, may not be present).
+    let mut cmd = Command::new("powershell.exe");
     cmd.arg("-NoProfile");
     cmd.arg("-ExecutionPolicy").arg("Bypass");
     cmd.arg("-File").arg(script_path);
@@ -201,60 +200,6 @@ fn build_command(script_path: &Path, args: &[String]) -> Command {
     cmd
 }
 
-/// Canonical PowerShell 5.1 location under a Windows root (`%SystemRoot%`).
-/// Kept separate (and test-visible) so the path layout is unit-tested on any
-/// host, not just Windows.
-#[cfg(any(target_os = "windows", test))]
-fn powershell_under_root(root: &Path) -> std::path::PathBuf {
-    root.join("System32")
-        .join("WindowsPowerShell")
-        .join("v1.0")
-        .join("powershell.exe")
-}
-
-/// Resolves the PowerShell interpreter to spawn.
-///
-/// `Command::new("powershell.exe")` trusts PATH to contain
-/// `%SystemRoot%\System32\WindowsPowerShell\v1.0`. On machines whose PATH was
-/// trimmed or truncated (Windows silently drops entries once the variable grows
-/// past its length limit), that lookup fails and the spawn dies with
-/// "program not found" before install.ps1 ever runs — the installer then stalls
-/// at "0 of 0 steps". Resolve by absolute path first, then fall back to PATH
-/// (powershell 5.1, then pwsh 7), then a bare name as a last resort.
-#[cfg(target_os = "windows")]
-fn windows_powershell_exe() -> std::path::PathBuf {
-    for var in ["SystemRoot", "windir"] {
-        if let Ok(root) = std::env::var(var) {
-            let candidate = powershell_under_root(Path::new(&root));
-            if candidate.is_file() {
-                return candidate;
-            }
-        }
-    }
-
-    for exe in ["powershell.exe", "pwsh.exe"] {
-        if let Ok(found) = which::which(exe) {
-            return found;
-        }
-    }
-
-    std::path::PathBuf::from("powershell.exe")
-}
-
-/// Human-readable interpreter name for spawn-failure context. On Windows this
-/// is the resolved PowerShell path so a missing/odd interpreter is obvious in
-/// the log (the old message only printed the script path, which read as if the
-/// .ps1 itself was missing).
-#[cfg(target_os = "windows")]
-fn interpreter_label() -> String {
-    windows_powershell_exe().display().to_string()
-}
-
-#[cfg(not(target_os = "windows"))]
-fn interpreter_label() -> String {
-    "bash".to_string()
-}
-
 /// Parses the LAST line of stdout that looks like a JSON object matching
 /// the install.ps1 stage-result contract: `{ok: bool, stage: string, ...}`.
 ///
@@ -344,14 +289,4 @@ info line
         let cwd = stable_script_cwd(script, Some("/"));
         assert_eq!(cwd, Some(Path::new("/")));
     }
-
-    #[test]
-    fn powershell_under_root_uses_system32_v1_layout() {
-        let resolved = powershell_under_root(Path::new("C:\\Windows"));
-        let normalized = resolved.to_string_lossy().replace('\\', "/");
-        assert!(
-            normalized.ends_with("System32/WindowsPowerShell/v1.0/powershell.exe"),
-            "unexpected powershell path: {normalized}"
-        );
-    }
 }

apps/desktop/DESIGN.md

@@ -1,167 +0,0 @@
-# Desktop Design System
-
-Conventions for the Electron desktop app (`apps/desktop`). Read this before
-adding a component, overlay, or style. The rule of thumb: **one source per
-concern, tokens over literals, flat over boxed.** If you reach for a raw color,
-a one-off shadow, a bespoke button, or a hardcoded `px-*` on a control — stop,
-there's already a primitive for it.
-
-## Principles
-
-1. **Flat, not boxed.** No card-in-card, no divider borders inside a panel.
-   Group with whitespace and a single hairline, never nested rounded boxes.
-2. **Borderless + shadow for elevation.** Overlays float on `shadow-nous` + a
-   `--stroke-nous` hairline, not hard borders.
-3. **One primitive per concern.** One `Button`, one set of control variants,
-   one `SearchField`, one `Loader`, one `ErrorState`. Migrate onto them; don't
-   fork.
-4. **Tokens, not literals.** Reference CSS vars (`--ui-*`, `--shadow-nous`,
-   `--theme-*`), never raw hex / ad-hoc rgba in components.
-5. **Style lives in the primitive.** Variants and sizes own padding, radius,
-   color, chrome. Call sites pass a `variant`/`size`, not `className` overrides
-   that re-specify those.
-
-## Surfaces & elevation
-
-Every overlay / dialog / toast (boot-failure, install, notifications,
-model-picker, onboarding, prompt-overlays, updates, base `Dialog`) uses:
-
-```
-shadow-nous           /* downward-weighted, layered contact→ambient falloff */
-border-(--stroke-nous) /* currentColor hairline, theme-adaptive */
-```
-
-Both are CSS vars in `src/styles.css` — tune in one place, everything inherits.
-Don't add per-overlay `shadow-[…]` or `border-(--ui-stroke-secondary)`
-one-offs; if elevation needs to change, change the token.
-
-## Stroke & color tokens
-
-| Token | Use |
-| --- | --- |
-| `--ui-stroke-primary…quaternary` | hairlines, in descending strength |
-| `--ui-stroke-tertiary` | the default in-panel divider / list hairline |
-| `--stroke-nous` | the overlay hairline (pairs with `shadow-nous`) |
-| `--ui-text-primary / -secondary / -tertiary` | text hierarchy |
-| `--ui-bg-quaternary` | soft control fill (secondary button) |
-| `--chrome-action-hover` | hover fill for quiet controls |
-| `--theme-primary`, `--ui-accent` | brand/accent |
-
-Never hardcode `border-gray-*`, `bg-white`, `text-black`, etc. The white tile in
-`BrandMark` is the one sanctioned literal (the mark needs a fixed backdrop).
-
-## Buttons — one component
-
-`src/components/ui/button.tsx` is the single source. Pick a `variant` + `size`;
-do **not** pass `h-*`, `px-*`, `py-*`, or icon-size overrides.
-
-**Variants:** `default` (primary), `destructive`, `secondary` (soft fill —
-the default non-primary look), `outline` (transparent + 1px inset ring, no
-fill/shadow), `ghost`, `link`, `text` (boxless quiet inline — "Cancel",
-"Clear"), `textStrong` (bold underlined inline affordance — "Change",
-"Open logs").
-
-**Sizes:** `default`, `xs`, `sm`, `lg`, `inline` (flush, zero box — for buttons
-that sit inside a heading/sentence; replaces `h-auto px-0 py-0`), and the icon
-family `icon` / `icon-xs` / `icon-sm` / `icon-lg` / `icon-titlebar`.
-
-Notes:
-- Text buttons are square (no radius) and sized by padding + line-height (no
-  fixed heights). Only icon buttons carry the shared 4px radius.
-- SVGs inherit `size-3.5` (`size-3` at `xs`). Don't re-set icon size.
-- Polymorph with `asChild` when the button must render as a link/Slot.
-
-## Form controls
-
-- **`controlVariants`** (`src/components/ui/control.ts`) is the shared shape for
-  `Input` / `Textarea` / `SelectTrigger`. New text-entry controls compose it.
-- **`SearchField`** — borderless, underline-on-focus, auto-width. The only
-  search input. Don't build boxed search bars; don't wrap it in a bordered tile.
-  Empty lists hide their search field.
-- **`SegmentedControl`** — the choice control for small mutually-exclusive sets
-  (color mode, tool-call display, usage period). Replaces radio piles and
-  pill rows.
-- **`Switch`** (`size="xs"`) — bare, with `aria-label`. No bordered text wrapper.
-
-## Layout
-
-- **Gutters:** `PAGE_INSET_X` (`src/app/layout-constants.ts`) for page side
-  padding; `PAGE_INSET_NEG_X` to bleed a child to the edge. Don't hardcode
-  `px-6`/`px-8` on pages.
-- **Master/detail overlays:** `OverlaySplitLayout` + `OverlaySidebar` /
-  `OverlayMain`. Cron, profiles, etc. ride this — don't rebuild a titlebar
-  shell.
-- **Rows:** `ListRow` (settings `primitives.tsx`) for label/description/action
-  rows. Flat, flush-left; no per-row indentation that fights flush headers.
-- **No dividers between rows** unless the list genuinely needs them; prefer
-  spacing. When you do need one, it's a single `--ui-stroke-tertiary` hairline.
-
-## Feedback & empty/error/loading states
-
-- **Loading:** `Loader` (`src/components/ui/loader.tsx`) — animated math/ascii
-  curves (`lemniscate-bloom` for long ops). Never ship the literal text
-  "Loading…".
-- **Errors:** `ErrorState` + the canonical `ErrorIcon` (no bg chip). One look
-  for the React boundary, in-dialog errors, and the boot-failure banner. Pass
-  nodes for title/description so Radix `DialogTitle`/`Description` can flow
-  through for a11y.
-- **Logs:** `LogView` — no bg, hairline border, tight padding, small mono.
-  Every place we surface raw logs uses it.
-- **Empty:** `EmptyState` / `EmptyPanel` — don't hand-roll centered empties.
-
-## Iconography & brand
-
-- **`Codicon`** is the icon set. No mixing icon libraries inline.
-- **`BrandMark`** (`src/components/brand-mark.tsx`) is the brand glyph — the
-  `nous-girl` mark on a white tile, softly rounded, identical in light/dark.
-  It replaced scattered Sparkles glyphs in updates / onboarding / about. Use it
-  for hero/brand moments; don't reintroduce decorative star/sparkle icons.
-
-## Motion
-
-- Quick, functional transitions (~100ms on controls). Respect
-  `prefers-reduced-motion` for anything beyond a fade.
-- Choreographed exits (e.g. onboarding's "matrix" fade-down) stagger per-element
-  then settle the surface — the outer container's fade is *delayed* so it
-  doesn't swallow the inner animation. Don't let a global fade race the detail.
-
-## i18n
-
-- Every user-facing string goes through `useI18n()` (`src/i18n/context.tsx`).
-  No literals in JSX.
-- **Update all locales together** — `en`, `ja`, `zh`, `zh-hant`. A string change
-  in `en.ts` that skips the others is a regression (drifted punctuation,
-  stale labels). Keep trailing-punctuation and tone consistent across all four.
-
-## State (TypeScript)
-
-Mirrors the repo TS style (see root `AGENTS.md`):
-
-- Shared/cross-component state → small **nanostores**, not prop-drilling.
-  Each feature owns its atoms; shared atoms live in `src/store`.
-- Rendering components subscribe with `useStore`; non-render actions read with
-  `$atom.get()`.
-- Colocated action modules over god hooks. A hook owns one narrow job.
-- Keep persistence beside the atom that owns it. Route roots stay thin.
-- Prefer `interface` for public props; extend React primitives
-  (`React.ComponentProps<'button'>`, `Omit<…>`).
-
-## Affordances
-
-- `cursor-pointer` at the primitive level (Button, dropdown/select) — don't
-  hardcode it per call site.
-- Global focus-ring reset; titlebar actions have no active-background state.
-- `Esc` closes every dismissable overlay/dialog (install/onboarding excluded);
-  close is an x-icon, not the word "Close".
-
-## Before you add something — checklist
-
-- [ ] Reuse a primitive (`Button`, `SearchField`, `SegmentedControl`,
-      `ListRow`, `Loader`, `ErrorState`, `LogView`) instead of forking one?
-- [ ] Tokens (`--ui-*`, `shadow-nous`, `--stroke-nous`) — zero raw colors /
-      one-off shadows?
-- [ ] No `className` overriding a primitive's padding / size / radius / chrome?
-- [ ] Overlay uses `shadow-nous` + `border-(--stroke-nous)`, no hard border?
-- [ ] Flat — no card-in-card, no gratuitous row dividers?
-- [ ] All four locales updated for any new/changed string?
-- [ ] `cursor-pointer`, focus ring, and `Esc`-to-close behave?

apps/desktop/electron/bootstrap-runner.cjs

@@ -40,15 +40,6 @@ const path = require('node:path')
 const https = require('node:https')
 const { spawn } = require('node:child_process')
 
-const IS_WINDOWS = process.platform === 'win32'
-
-function hiddenWindowsChildOptions(options = {}) {
-  if (!IS_WINDOWS || Object.prototype.hasOwnProperty.call(options, 'windowsHide')) {
-    return options
-  }
-  return { ...options, windowsHide: true }
-}
-
 const STAMP_COMMIT_RE = /^[0-9a-f]{7,40}$/i
 
 // Stages flagged needs_user_input=true in the manifest are skipped by the
@@ -85,21 +76,6 @@ function bootstrapCacheDir(hermesHome) {
   return path.join(hermesHome, 'bootstrap-cache')
 }
 
-// The install.sh / install.ps1 that ships inside the already-installed agent
-// checkout under ~/.hermes/hermes-agent. Used as a last-resort fallback when
-// the pinned commit can't be fetched from GitHub (e.g. a locally-built desktop
-// app stamped to an unpushed HEAD).
-function installedAgentInstallScript(hermesHome) {
-  if (!hermesHome) return null
-  const candidate = path.join(hermesHome, 'hermes-agent', 'scripts', installScriptName())
-  try {
-    fs.accessSync(candidate, fs.constants.R_OK)
-    return candidate
-  } catch {
-    return null
-  }
-}
-
 function cachedScriptPath(hermesHome, commit) {
   return path.join(bootstrapCacheDir(hermesHome), `install-${commit}.${process.platform === 'win32' ? 'ps1' : 'sh'}`)
 }
@@ -179,7 +155,7 @@ function downloadInstallScript(commit, destPath) {
   })
 }
 
-async function resolveInstallScript({ installStamp, sourceRepoRoot, hermesHome, emit, _download = downloadInstallScript }) {
+async function resolveInstallScript({ installStamp, sourceRepoRoot, hermesHome, emit }) {
   // 1. Dev shortcut: prefer a local checkout's installer so we can iterate
   //    without pushing. SOURCE_REPO_ROOT comes from main.cjs (path.resolve
   //    of APP_ROOT/../..).
@@ -213,87 +189,21 @@ async function resolveInstallScript({ installStamp, sourceRepoRoot, hermesHome,
     type: 'log',
     line: `[bootstrap] fetching ${installScriptName()} for ${installStamp.commit.slice(0, 12)} from GitHub`
   })
-  try {
-    await _download(installStamp.commit, cached)
-    emit({ type: 'log', line: `[bootstrap] saved to ${cached}` })
-    return { path: cached, source: 'download', commit: installStamp.commit, kind: installScriptKind() }
-  } catch (err) {
-    // The pinned commit may not be fetchable from GitHub -- most commonly a
-    // locally-built desktop app stamped to an unpushed HEAD (see
-    // write-build-stamp.cjs fromLocalGit). Fall back to the installer that
-    // ships inside the already-installed agent checkout so dev/self-builds can
-    // still bootstrap instead of dying with a fatal 404.
-    const installed = installedAgentInstallScript(hermesHome)
-    if (installed) {
-      emit({
-        type: 'log',
-        line:
-          `[bootstrap] GitHub fetch failed (${err.message}); ` +
-          `falling back to installed agent ${installScriptName()} at ${installed}`
-      })
-      try {
-        fs.mkdirSync(path.dirname(cached), { recursive: true })
-        fs.copyFileSync(installed, cached)
-        return { path: cached, source: 'installed-agent', commit: installStamp.commit, kind: installScriptKind() }
-      } catch {
-        // Cache copy failed (read-only FS, etc.) -- use the source path directly.
-        return { path: installed, source: 'installed-agent', commit: installStamp.commit, kind: installScriptKind() }
-      }
-    }
-    throw err
-  }
+  await downloadInstallScript(installStamp.commit, cached)
+  emit({ type: 'log', line: `[bootstrap] saved to ${cached}` })
+  return { path: cached, source: 'download', commit: installStamp.commit, kind: installScriptKind() }
 }
 
 // ---------------------------------------------------------------------------
 // powershell wrapper
 // ---------------------------------------------------------------------------
 
-// Canonical PowerShell 5.1 location under a Windows root (%SystemRoot%).
-function powershellUnderRoot(root) {
-  return path.join(root, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe')
-}
-
-// Resolve the PowerShell interpreter to spawn.
-//
-// Spawning bare 'powershell.exe' trusts PATH to contain
-// %SystemRoot%\System32\WindowsPowerShell\v1.0. On machines whose PATH was
-// trimmed, truncated, or stored as a non-expanding REG_SZ (so %SystemRoot%
-// never expands), that lookup fails and the spawn dies with ENOENT before
-// install.ps1 ever runs — the installer stalls at "0 of 0 steps". Resolve by
-// absolute path first, then fall back to PATH (powershell 5.1, then pwsh 7),
-// then a bare name as a last resort.
-function resolveWindowsPowerShell() {
-  for (const v of ['SystemRoot', 'windir']) {
-    const root = process.env[v]
-    if (root) {
-      const candidate = powershellUnderRoot(root)
-      try {
-        if (fs.statSync(candidate).isFile()) return candidate
-      } catch {
-        void 0
-      }
-    }
-  }
-  const pathDirs = (process.env.PATH || process.env.Path || '').split(path.delimiter).filter(Boolean)
-  for (const exe of ['powershell.exe', 'pwsh.exe']) {
-    for (const dir of pathDirs) {
-      const candidate = path.join(dir, exe)
-      try {
-        if (fs.statSync(candidate).isFile()) return candidate
-      } catch {
-        void 0
-      }
-    }
-  }
-  return 'powershell.exe'
-}
-
 function spawnPowerShell(scriptPath, args, { emit, stageName, abortSignal, hermesHome } = {}) {
   return new Promise((resolve, reject) => {
-    const ps = process.platform === 'win32' ? resolveWindowsPowerShell() : 'pwsh'
+    const ps = process.platform === 'win32' ? 'powershell.exe' : 'pwsh'
     const fullArgs = ['-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', scriptPath, ...args]
 
-    const child = spawn(ps, fullArgs, hiddenWindowsChildOptions({
+    const child = spawn(ps, fullArgs, {
       stdio: ['ignore', 'pipe', 'pipe'],
       env: {
         ...process.env,
@@ -301,7 +211,7 @@ function spawnPowerShell(scriptPath, args, { emit, stageName, abortSignal, herme
         // choice rather than re-computing the default.
         HERMES_HOME: hermesHome || process.env.HERMES_HOME || ''
       }
-    }))
+    })
 
     let stdout = ''
     let stderr = ''
@@ -723,7 +633,5 @@ module.exports = {
   // Exposed for testability
   parseStageResult,
   resolveLocalInstallScript,
-  resolveInstallScript,
-  installedAgentInstallScript,
   cachedScriptPath
 }

apps/desktop/electron/bootstrap-runner.test.cjs

@@ -1,21 +1,7 @@
 const assert = require('node:assert/strict')
 const test = require('node:test')
-const fs = require('node:fs')
-const os = require('node:os')
-const path = require('node:path')
 
-const {
-  runBootstrap,
-  resolveInstallScript,
-  installedAgentInstallScript,
-  cachedScriptPath
-} = require('./bootstrap-runner.cjs')
-
-const SCRIPT_NAME = process.platform === 'win32' ? 'install.ps1' : 'install.sh'
-
-function mkTmpHome() {
-  return fs.mkdtempSync(path.join(os.tmpdir(), 'hermes-bootstrap-test-'))
-}
+const { runBootstrap } = require('./bootstrap-runner.cjs')
 
 test('runBootstrap bails immediately when the signal is already aborted', async () => {
   const controller = new AbortController()
@@ -39,100 +25,3 @@ test('runBootstrap bails immediately when the signal is already aborted', async
     'should emit a cancelled failure event'
   )
 })
-
-test('installedAgentInstallScript resolves the installer in the agent checkout', () => {
-  const home = mkTmpHome()
-  try {
-    assert.equal(installedAgentInstallScript(home), null, 'absent before the checkout exists')
-
-    const scriptsDir = path.join(home, 'hermes-agent', 'scripts')
-    fs.mkdirSync(scriptsDir, { recursive: true })
-    const scriptPath = path.join(scriptsDir, SCRIPT_NAME)
-    fs.writeFileSync(scriptPath, '#!/bin/sh\necho hi\n')
-
-    assert.equal(installedAgentInstallScript(home), scriptPath)
-    assert.equal(installedAgentInstallScript(null), null, 'null home -> null')
-  } finally {
-    fs.rmSync(home, { recursive: true, force: true })
-  }
-})
-
-test('resolveInstallScript prefers a cached script without touching the network', async () => {
-  const home = mkTmpHome()
-  try {
-    const commit = 'a'.repeat(40)
-    const cached = cachedScriptPath(home, commit)
-    fs.mkdirSync(path.dirname(cached), { recursive: true })
-    fs.writeFileSync(cached, '#!/bin/sh\necho cached\n')
-
-    const logs = []
-    const result = await resolveInstallScript({
-      installStamp: { commit },
-      sourceRepoRoot: null,
-      hermesHome: home,
-      emit: ev => logs.push(ev)
-    })
-
-    assert.equal(result.source, 'cache')
-    assert.equal(result.path, cached)
-  } finally {
-    fs.rmSync(home, { recursive: true, force: true })
-  }
-})
-
-test('resolveInstallScript falls back to the installed agent checkout on a 404', async () => {
-  const home = mkTmpHome()
-  try {
-    const commit = 'a'.repeat(40)
-    // Seed the installed agent checkout so the fallback has something to resolve.
-    const scriptsDir = path.join(home, 'hermes-agent', 'scripts')
-    fs.mkdirSync(scriptsDir, { recursive: true })
-    const installed = path.join(scriptsDir, SCRIPT_NAME)
-    fs.writeFileSync(installed, '#!/bin/sh\necho fallback\n')
-
-    const logs = []
-    const result = await resolveInstallScript({
-      installStamp: { commit },
-      sourceRepoRoot: null,
-      hermesHome: home,
-      emit: ev => logs.push(ev),
-      // Simulate GitHub returning a 404 for the pinned commit.
-      _download: async () => {
-        throw new Error('Failed to download install.sh: HTTP 404')
-      }
-    })
-
-    assert.equal(result.source, 'installed-agent')
-    // It should have copied the installer into the bootstrap cache.
-    assert.equal(result.path, cachedScriptPath(home, commit))
-    assert.ok(fs.existsSync(result.path), 'fallback script copied into cache')
-    assert.ok(
-      logs.some(ev => /falling back to installed agent/.test(ev.line || '')),
-      'emits a fallback log line'
-    )
-  } finally {
-    fs.rmSync(home, { recursive: true, force: true })
-  }
-})
-
-test('resolveInstallScript rethrows when the 404 fallback is unavailable', async () => {
-  const home = mkTmpHome()
-  try {
-    const commit = 'a'.repeat(40)
-    // No installed agent checkout seeded -> nothing to fall back to.
-    await assert.rejects(
-      resolveInstallScript({
-        installStamp: { commit },
-        sourceRepoRoot: null,
-        hermesHome: home,
-        emit: () => {},
-        _download: async () => {
-          throw new Error('Failed to download install.sh: HTTP 404')
-        }
-      }),
-      /HTTP 404|Failed to download/
-    )
-  } finally {
-    fs.rmSync(home, { recursive: true, force: true })
-  }
-})

apps/desktop/electron/desktop-uninstall.cjs

@@ -1,232 +0,0 @@
-/**
- * desktop-uninstall.cjs
- *
- * Pure, electron-free helpers for the desktop Chat GUI uninstaller. These map
- * the three user-facing uninstall modes to the `hermes uninstall` CLI flags,
- * resolve the running app bundle/exe so a detached cleanup script can remove
- * it after the app quits, and build that cleanup script for each OS.
- *
- * Kept standalone (no `require('electron')`) so it can be unit-tested with
- * `node --test` — same pattern as connection-config.cjs / backend-probes.cjs.
- * main.cjs requires these and wires them into the electron-coupled IPC layer.
- *
- * The three modes mirror the CLI's options exactly:
- *   - 'gui'  → remove ONLY the Chat GUI, keep the agent + all user data.
- *              `hermes uninstall --gui --yes`
- *   - 'lite' → remove the GUI + agent code, KEEP user data (config / sessions
- *              / .env) for a future reinstall. `hermes uninstall --yes`
- *   - 'full' → remove everything: GUI + agent + all user data.
- *              `hermes uninstall --full --yes`
- *
- * Why a detached cleanup script: 'lite'/'full' delete the very venv the
- * `hermes` command runs from, and every mode may need to delete the running
- * app bundle (locked on macOS/Windows while the process is alive). So we hand
- * the work to a detached child that waits for this app's PID to exit, runs the
- * Python uninstall, then removes the app bundle — then the app quits. Same
- * shape as the self-update swap-and-relaunch flow already in main.cjs.
- */
-
-const path = require('node:path')
-
-const UNINSTALL_MODES = ['gui', 'lite', 'full']
-
-/**
- * Map an uninstall mode to the `python -m hermes_cli.uninstall` argv (after the
- * python executable). Uses the dedicated lightweight module entrypoint (not
- * `hermes_cli.main`) so it can run under a system Python OUTSIDE the venv that
- * lite/full delete — see the Finding-3 note in buildWindowsCleanupScript.
- * Throws on an unknown mode so a typo can't silently become a full wipe.
- */
-function uninstallArgsForMode(mode) {
-  if (!UNINSTALL_MODES.includes(mode)) {
-    throw new Error(`Unknown uninstall mode: ${mode}`)
-  }
-  return ['-m', 'hermes_cli.uninstall', '--mode', mode]
-}
-
-/** True when `mode` removes the agent (lite/full), false for gui-only. */
-function modeRemovesAgent(mode) {
-  return mode === 'lite' || mode === 'full'
-}
-
-/** True when `mode` removes user data (full only). */
-function modeRemovesUserData(mode) {
-  return mode === 'full'
-}
-
-/**
- * Resolve the on-disk app bundle/dir to remove for the running desktop app,
- * given the path to the running executable (`process.execPath`) and platform.
- *
- *   macOS:   …/Hermes.app/Contents/MacOS/Hermes  → …/Hermes.app
- *   Windows: …\Hermes\Hermes.exe                 → …\Hermes  (install dir)
- *   Linux:   AppImage → the APPIMAGE env path; unpacked → the *-unpacked dir
- *
- * Returns null when we can't confidently identify a removable bundle (e.g.
- * running from a dev checkout, or a system-package install we must not rmtree).
- */
-function resolveRemovableAppPath(execPath, platform, env = {}) {
-  const exe = String(execPath || '')
-  if (!exe) return null
-
-  // Use the path flavor that matches the TARGET platform, not the host running
-  // this code — so the Windows branch parses backslash paths correctly even
-  // when these pure helpers are unit-tested on Linux/macOS CI.
-  const p = platform === 'win32' ? path.win32 : path.posix
-
-  if (platform === 'darwin') {
-    // …/Hermes.app/Contents/MacOS/Hermes → strip 3 segments to the .app
-    const macOsDir = p.dirname(exe) // …/Contents/MacOS
-    const contents = p.dirname(macOsDir) // …/Contents
-    const appBundle = p.dirname(contents) // …/Hermes.app
-    if (appBundle.endsWith('.app')) return appBundle
-    return null
-  }
-
-  if (platform === 'win32') {
-    // NSIS per-user installs Hermes.exe directly in the install dir.
-    const dir = p.dirname(exe)
-    if (/[\\/]Hermes$/i.test(dir) || /[\\/]hermes-desktop$/i.test(dir)) return dir
-    return null
-  }
-
-  // Linux: an AppImage exposes its own path via the APPIMAGE env var.
-  if (env.APPIMAGE) return env.APPIMAGE
-  // Unpacked electron-builder tree: …/linux-unpacked/hermes
-  const dir = p.dirname(exe)
-  if (/-unpacked$/.test(dir)) return dir
-  return null
-}
-
-/**
- * Should we even try to remove the running app bundle from a cleanup script?
- * Only when packaged AND we resolved a concrete removable path. Dev runs
- * (electron from node_modules) and system-package installs return null above
- * and are left to the OS package manager.
- */
-function shouldRemoveAppBundle(isPackaged, appPath) {
-  return Boolean(isPackaged) && Boolean(appPath)
-}
-
-/**
- * Build a POSIX cleanup shell script (macOS / Linux). It:
- *   1. waits (bounded ~30s) for the desktop PID to exit (venv/bundle unlock),
- *   2. runs the Python uninstall module with the mode,
- *   3. removes the app bundle if one was resolved.
- *
- * `pythonExe` should be a Python OUTSIDE the venv for lite/full (the venv is
- * being deleted); `pythonPath` is prepended to PYTHONPATH so `import hermes_cli`
- * resolves from the agent source. `q()` single-quote-escapes for the shell
- * (closes-escapes-reopens any embedded apostrophe), defending against spaces.
- */
-function buildPosixCleanupScript({ desktopPid, pythonExe, pythonPath, agentRoot, uninstallArgs, appPath, hermesHome }) {
-  const q = s => `'${String(s).replace(/'/g, `'\\''`)}'`
-  const lines = [
-    '#!/bin/bash',
-    'set -u',
-    '# Wait (up to ~30s) for the desktop process to exit so the venv python',
-    '# and the app bundle are no longer in use.',
-    `pid=${Number(desktopPid) || 0}`,
-    'if [ "$pid" -gt 0 ]; then',
-    '  for _ in $(seq 1 60); do',
-    '    kill -0 "$pid" 2>/dev/null || break',
-    '    sleep 0.5',
-    '  done',
-    'fi',
-    `export HERMES_HOME=${q(hermesHome)}`
-  ]
-  if (pythonPath) {
-    lines.push(`export PYTHONPATH=${q(pythonPath)}\${PYTHONPATH:+:$PYTHONPATH}`)
-  }
-  lines.push(
-    `cd ${q(agentRoot)} 2>/dev/null || true`,
-    `${q(pythonExe)} ${uninstallArgs.map(q).join(' ')} || true`
-  )
-  if (appPath) {
-    lines.push(`rm -rf ${q(appPath)} || true`)
-  }
-  // Self-delete the script.
-  lines.push('rm -f "$0" 2>/dev/null || true')
-  lines.push('')
-  return lines.join('\n')
-}
-
-/**
- * Build a Windows cleanup batch script. Same three steps, cmd.exe flavored.
- *
- * Finding 3 (venv self-deletion): for lite/full the agent uninstall rmtree's
- * the venv that contains `python.exe`. A running .exe is mandatory-locked on
- * Windows, so running the uninstall from the venv's OWN python half-fails. The
- * desktop passes a system Python (findSystemPython) as `pythonExe` for those
- * modes + `pythonPath`=agentRoot so `import hermes_cli` resolves from source
- * while the venv is torn down. gui-only doesn't touch the venv, so it can use
- * either interpreter.
- *
- * Wait-loop: bounded (matches POSIX's ~30s cap) so a never-exiting / mismatched
- * PID can't wedge the cleanup forever. The `/FI "PID eq"` filter is an EXACT
- * match, so no redundant `| find` (which would substring-match 99→990).
- *
- * Removal: even after the desktop PID is gone, Windows releases directory
- * handles lazily, so a single `rmdir /s /q` can half-fail — retry up to 10x.
- */
-function buildWindowsCleanupScript({ desktopPid, pythonExe, pythonPath, agentRoot, uninstallArgs, appPath, hermesHome }) {
-  const pid = Number(desktopPid) || 0
-  // cmd.exe has no string escaping inside quotes; strip embedded quotes (paths
-  // under %LOCALAPPDATA% never contain them). `&`/`^` in a path would still be
-  // a problem, but Hermes install paths don't use them.
-  const q = s => `"${String(s).replace(/"/g, '')}"`
-  const lines = [
-    '@echo off',
-    'setlocal enableextensions',
-    `set "HERMES_HOME=${String(hermesHome).replace(/"/g, '')}"`,
-    `set "PID=${pid}"`
-  ]
-  if (pythonPath) {
-    lines.push(`set "PYTHONPATH=${String(pythonPath).replace(/"/g, '')};%PYTHONPATH%"`)
-  }
-  lines.push(
-    'set /a waited=0',
-    ':waitloop',
-    'rem /FI "PID eq %PID%" is an EXACT filter — tasklist outputs the one task',
-    'rem row for that PID, or "INFO: No tasks..." otherwise. /NH drops the',
-    'rem header; findstr matches the PID as a whole space-delimited token so',
-    'rem PID 99 cannot match 990 (the substring trap of a bare `find`).',
-    'tasklist /NH /FI "PID eq %PID%" 2>nul | findstr /r /c:" %PID% " >nul',
-    'if %ERRORLEVEL% neq 0 goto waited_done',
-    'set /a waited+=1',
-    'if %waited% geq 60 goto waited_done',
-    'timeout /t 1 /nobreak >nul',
-    'goto waitloop',
-    ':waited_done',
-    `cd /d ${q(agentRoot)}`,
-    `${q(pythonExe)} ${uninstallArgs.map(q).join(' ')}`
-  )
-  if (appPath) {
-    lines.push(
-      'set /a tries=0',
-      ':rmloop',
-      `if not exist ${q(appPath)} goto rmdone`,
-      `rmdir /s /q ${q(appPath)} >nul 2>&1`,
-      `if not exist ${q(appPath)} goto rmdone`,
-      'set /a tries+=1',
-      'if %tries% geq 10 goto rmdone',
-      'timeout /t 1 /nobreak >nul',
-      'goto rmloop',
-      ':rmdone'
-    )
-  }
-  lines.push('del "%~f0"')
-  lines.push('')
-  return lines.join('\r\n')
-}
-
-module.exports = {
-  UNINSTALL_MODES,
-  buildPosixCleanupScript,
-  buildWindowsCleanupScript,
-  modeRemovesAgent,
-  modeRemovesUserData,
-  resolveRemovableAppPath,
-  shouldRemoveAppBundle,
-  uninstallArgsForMode
-}

apps/desktop/electron/desktop-uninstall.test.cjs

@@ -1,246 +0,0 @@
-/**
- * Tests for electron/desktop-uninstall.cjs.
- *
- * Run with: node --test electron/desktop-uninstall.test.cjs
- * (Wired into npm test:desktop:platforms in package.json.)
- *
- * These are the pure helpers behind the desktop Chat GUI uninstaller: the
- * mode → CLI-flag mapping, the running-app-bundle resolution per OS, and the
- * cleanup-script builders (POSIX + Windows).
- */
-
-const test = require('node:test')
-const assert = require('node:assert/strict')
-
-const {
-  UNINSTALL_MODES,
-  buildPosixCleanupScript,
-  buildWindowsCleanupScript,
-  modeRemovesAgent,
-  modeRemovesUserData,
-  resolveRemovableAppPath,
-  shouldRemoveAppBundle,
-  uninstallArgsForMode
-} = require('./desktop-uninstall.cjs')
-
-// --- uninstallArgsForMode ---
-
-test('uninstallArgsForMode maps each mode to the module-runner argv', () => {
-  assert.deepEqual(uninstallArgsForMode('gui'), ['-m', 'hermes_cli.uninstall', '--mode', 'gui'])
-  assert.deepEqual(uninstallArgsForMode('lite'), ['-m', 'hermes_cli.uninstall', '--mode', 'lite'])
-  assert.deepEqual(uninstallArgsForMode('full'), ['-m', 'hermes_cli.uninstall', '--mode', 'full'])
-})
-
-test('uninstallArgsForMode throws on an unknown mode (no silent full wipe)', () => {
-  assert.throws(() => uninstallArgsForMode('nuke'), /Unknown uninstall mode/)
-  assert.throws(() => uninstallArgsForMode(''), /Unknown uninstall mode/)
-})
-
-test('UNINSTALL_MODES lists exactly the three supported modes', () => {
-  assert.deepEqual([...UNINSTALL_MODES].sort(), ['full', 'gui', 'lite'])
-})
-
-// --- modeRemovesAgent / modeRemovesUserData ---
-
-test('mode predicates classify what each mode removes', () => {
-  assert.equal(modeRemovesAgent('gui'), false)
-  assert.equal(modeRemovesAgent('lite'), true)
-  assert.equal(modeRemovesAgent('full'), true)
-
-  assert.equal(modeRemovesUserData('gui'), false)
-  assert.equal(modeRemovesUserData('lite'), false)
-  assert.equal(modeRemovesUserData('full'), true)
-})
-
-// --- resolveRemovableAppPath ---
-
-test('resolveRemovableAppPath finds the .app bundle on macOS', () => {
-  assert.equal(
-    resolveRemovableAppPath('/Applications/Hermes.app/Contents/MacOS/Hermes', 'darwin'),
-    '/Applications/Hermes.app'
-  )
-  assert.equal(
-    resolveRemovableAppPath('/Users/x/Applications/Hermes.app/Contents/MacOS/Hermes', 'darwin'),
-    '/Users/x/Applications/Hermes.app'
-  )
-})
-
-test('resolveRemovableAppPath: dev-run .app resolves (safety is shouldRemoveAppBundle, not null)', () => {
-  // A dev run from node_modules' Electron DOES resolve to a .app — the real
-  // dev-run safety gate is shouldRemoveAppBundle(isPackaged=false,...), not a
-  // null return here. This test documents that contract.
-  assert.equal(
-    resolveRemovableAppPath('/repo/node_modules/electron/dist/Electron.app/Contents/MacOS/Electron', 'darwin'),
-    '/repo/node_modules/electron/dist/Electron.app'
-  )
-  assert.equal(shouldRemoveAppBundle(false, '/repo/node_modules/electron/dist/Electron.app'), false)
-  // A bare path with no .app ancestor → null.
-  assert.equal(resolveRemovableAppPath('/usr/bin/electron', 'darwin'), null)
-})
-
-test('resolveRemovableAppPath finds the install dir on Windows', () => {
-  assert.equal(
-    resolveRemovableAppPath('C:\\Users\\x\\AppData\\Local\\Programs\\Hermes\\Hermes.exe', 'win32'),
-    'C:\\Users\\x\\AppData\\Local\\Programs\\Hermes'
-  )
-  assert.equal(
-    resolveRemovableAppPath('C:\\Users\\x\\AppData\\Local\\hermes-desktop\\Hermes.exe', 'win32'),
-    'C:\\Users\\x\\AppData\\Local\\hermes-desktop'
-  )
-})
-
-test('resolveRemovableAppPath returns null for an unrecognized Windows dir', () => {
-  assert.equal(resolveRemovableAppPath('C:\\Temp\\foo\\Hermes.exe', 'win32'), null)
-})
-
-test('resolveRemovableAppPath uses APPIMAGE on Linux when set', () => {
-  assert.equal(
-    resolveRemovableAppPath('/tmp/.mount_HermesXXXX/hermes', 'linux', { APPIMAGE: '/home/x/Apps/Hermes.AppImage' }),
-    '/home/x/Apps/Hermes.AppImage'
-  )
-})
-
-test('resolveRemovableAppPath finds the unpacked dir on Linux', () => {
-  assert.equal(
-    resolveRemovableAppPath('/opt/hermes/linux-unpacked/hermes', 'linux', {}),
-    '/opt/hermes/linux-unpacked'
-  )
-  // A system-package install (/usr/bin) → null, left to apt/dnf.
-  assert.equal(resolveRemovableAppPath('/usr/bin/hermes', 'linux', {}), null)
-})
-
-test('resolveRemovableAppPath returns null for an empty exe path', () => {
-  assert.equal(resolveRemovableAppPath('', 'darwin'), null)
-  assert.equal(resolveRemovableAppPath(null, 'win32'), null)
-})
-
-// --- shouldRemoveAppBundle ---
-
-test('shouldRemoveAppBundle requires packaged AND a resolved path', () => {
-  assert.equal(shouldRemoveAppBundle(true, '/Applications/Hermes.app'), true)
-  assert.equal(shouldRemoveAppBundle(false, '/Applications/Hermes.app'), false)
-  assert.equal(shouldRemoveAppBundle(true, null), false)
-  assert.equal(shouldRemoveAppBundle(false, null), false)
-})
-
-// --- buildPosixCleanupScript ---
-
-test('buildPosixCleanupScript waits for the PID, runs the uninstall module, removes bundle', () => {
-  const script = buildPosixCleanupScript({
-    desktopPid: 4321,
-    pythonExe: '/home/x/.hermes/hermes-agent/venv/bin/python',
-    pythonPath: null,
-    agentRoot: '/home/x/.hermes/hermes-agent',
-    uninstallArgs: ['-m', 'hermes_cli.uninstall', '--mode', 'gui'],
-    appPath: '/opt/hermes/linux-unpacked',
-    hermesHome: '/home/x/.hermes'
-  })
-  assert.match(script, /^#!\/bin\/bash/)
-  assert.match(script, /pid=4321/)
-  assert.match(script, /kill -0 "\$pid"/)
-  // bounded wait (~30s), not unbounded
-  assert.match(script, /seq 1 60/)
-  assert.match(script, /'-m' 'hermes_cli\.uninstall' '--mode' 'gui'/)
-  assert.match(script, /rm -rf '\/opt\/hermes\/linux-unpacked'/)
-  assert.match(script, /export HERMES_HOME='\/home\/x\/\.hermes'/)
-})
-
-test('buildPosixCleanupScript exports PYTHONPATH when pythonPath is set (lite/full)', () => {
-  const script = buildPosixCleanupScript({
-    desktopPid: 1,
-    pythonExe: '/usr/bin/python3',
-    pythonPath: '/home/x/.hermes/hermes-agent',
-    agentRoot: '/home/x/.hermes/hermes-agent',
-    uninstallArgs: ['-m', 'hermes_cli.uninstall', '--mode', 'full'],
-    appPath: null,
-    hermesHome: '/home/x/.hermes'
-  })
-  // System python + source on PYTHONPATH so import hermes_cli works while the
-  // venv is torn down.
-  assert.match(script, /export PYTHONPATH='\/home\/x\/\.hermes\/hermes-agent'/)
-  assert.match(script, /'\/usr\/bin\/python3' '-m' 'hermes_cli\.uninstall' '--mode' 'full'/)
-})
-
-test('buildPosixCleanupScript omits PYTHONPATH when pythonPath is null (gui)', () => {
-  const script = buildPosixCleanupScript({
-    desktopPid: 1,
-    pythonExe: '/p/python',
-    pythonPath: null,
-    agentRoot: '/a',
-    uninstallArgs: ['-m', 'hermes_cli.uninstall', '--mode', 'gui'],
-    appPath: null,
-    hermesHome: '/h'
-  })
-  assert.doesNotMatch(script, /export PYTHONPATH/)
-})
-
-test('buildPosixCleanupScript omits the bundle rm when appPath is null', () => {
-  const script = buildPosixCleanupScript({
-    desktopPid: 1,
-    pythonExe: '/p/python',
-    pythonPath: null,
-    agentRoot: '/a',
-    uninstallArgs: ['-m', 'hermes_cli.uninstall', '--mode', 'lite'],
-    appPath: null,
-    hermesHome: '/h'
-  })
-  assert.doesNotMatch(script, /rm -rf '\//)
-  // Still runs the uninstall.
-  assert.match(script, /'-m' 'hermes_cli\.uninstall' '--mode' 'lite'/)
-})
-
-test('buildPosixCleanupScript single-quote-escapes paths with apostrophes', () => {
-  const script = buildPosixCleanupScript({
-    desktopPid: 1,
-    pythonExe: "/home/o'brien/python",
-    pythonPath: null,
-    agentRoot: '/a',
-    uninstallArgs: ['-m', 'hermes_cli.uninstall', '--mode', 'gui'],
-    appPath: null,
-    hermesHome: '/h'
-  })
-  // The apostrophe is closed-escaped-reopened so the shell sees the literal.
-  assert.match(script, /'\/home\/o'\\''brien\/python'/)
-})
-
-// --- buildWindowsCleanupScript ---
-
-test('buildWindowsCleanupScript waits (bounded) for PID, runs uninstall, rmdir bundle', () => {
-  const script = buildWindowsCleanupScript({
-    desktopPid: 9988,
-    pythonExe: 'C:\\Python313\\python.exe',
-    pythonPath: 'C:\\hermes',
-    agentRoot: 'C:\\hermes',
-    uninstallArgs: ['-m', 'hermes_cli.uninstall', '--mode', 'full'],
-    appPath: 'C:\\Users\\x\\AppData\\Local\\Programs\\Hermes',
-    hermesHome: 'C:\\Users\\x\\AppData\\Local\\hermes'
-  })
-  assert.match(script, /@echo off/)
-  assert.match(script, /set "PID=9988"/)
-  // PYTHONPATH set so a system python can import hermes_cli from source.
-  assert.match(script, /set "PYTHONPATH=C:\\hermes;%PYTHONPATH%"/)
-  assert.match(script, /"C:\\Python313\\python.exe" "-m" "hermes_cli\.uninstall" "--mode" "full"/)
-  // Bounded wait-loop (no infinite loop), whole-token PID match (no substring).
-  assert.match(script, /if %waited% geq 60 goto waited_done/)
-  assert.match(script, /findstr \/r \/c:" %PID% "/)
-  assert.doesNotMatch(script, /find "%PID%"/) // the old substring-prone form is gone
-  // Removal is a retry loop (Windows releases dir handles lazily).
-  assert.match(script, /:rmloop/)
-  assert.match(script, /rmdir \/s \/q "C:\\Users\\x\\AppData\\Local\\Programs\\Hermes" >nul 2>&1/)
-  assert.match(script, /if %tries% geq 10 goto rmdone/)
-  assert.match(script, /del "%~f0"/)
-})
-
-test('buildWindowsCleanupScript omits PYTHONPATH + rmdir when not needed (gui, no bundle)', () => {
-  const script = buildWindowsCleanupScript({
-    desktopPid: 2,
-    pythonExe: 'C:\\h\\venv\\Scripts\\python.exe',
-    pythonPath: null,
-    agentRoot: 'C:\\h',
-    uninstallArgs: ['-m', 'hermes_cli.uninstall', '--mode', 'gui'],
-    appPath: null,
-    hermesHome: 'C:\\h'
-  })
-  assert.doesNotMatch(script, /rmdir/)
-  assert.doesNotMatch(script, /set "PYTHONPATH=/)
-})

apps/desktop/electron/preload.cjs

@@ -2,10 +2,8 @@ const { contextBridge, ipcRenderer, webUtils } = require('electron')
 
 contextBridge.exposeInMainWorld('hermesDesktop', {
   getConnection: profile => ipcRenderer.invoke('hermes:connection', profile),
-  revalidateConnection: () => ipcRenderer.invoke('hermes:connection:revalidate'),
   touchBackend: profile => ipcRenderer.invoke('hermes:backend:touch', profile),
   getGatewayWsUrl: profile => ipcRenderer.invoke('hermes:gateway:ws-url', profile),
-  openSessionWindow: sessionId => ipcRenderer.invoke('hermes:window:openSession', sessionId),
   getBootProgress: () => ipcRenderer.invoke('hermes:boot-progress:get'),
   getConnectionConfig: profile => ipcRenderer.invoke('hermes:connection-config:get', profile),
   saveConnectionConfig: payload => ipcRenderer.invoke('hermes:connection-config:save', payload),
@@ -42,7 +40,6 @@ contextBridge.exposeInMainWorld('hermesDesktop', {
   setPreviewShortcutActive: active => ipcRenderer.send('hermes:previewShortcutActive', Boolean(active)),
   openExternal: url => ipcRenderer.invoke('hermes:openExternal', url),
   fetchLinkTitle: url => ipcRenderer.invoke('hermes:fetchLinkTitle', url),
-  sanitizeWorkspaceCwd: cwd => ipcRenderer.invoke('hermes:workspace:sanitize', cwd),
   settings: {
     getDefaultProjectDir: () => ipcRenderer.invoke('hermes:setting:defaultProjectDir:get'),
     setDefaultProjectDir: dir => ipcRenderer.invoke('hermes:setting:defaultProjectDir:set', dir),
@@ -120,10 +117,6 @@ contextBridge.exposeInMainWorld('hermesDesktop', {
     return () => ipcRenderer.removeListener('hermes:bootstrap:event', listener)
   },
   getVersion: () => ipcRenderer.invoke('hermes:version'),
-  uninstall: {
-    summary: () => ipcRenderer.invoke('hermes:uninstall:summary'),
-    run: mode => ipcRenderer.invoke('hermes:uninstall:run', { mode })
-  },
   updates: {
     check: () => ipcRenderer.invoke('hermes:updates:check'),
     apply: opts => ipcRenderer.invoke('hermes:updates:apply', opts),
@@ -134,9 +127,5 @@ contextBridge.exposeInMainWorld('hermesDesktop', {
       ipcRenderer.on('hermes:updates:progress', listener)
       return () => ipcRenderer.removeListener('hermes:updates:progress', listener)
     }
-  },
-  themes: {
-    fetchMarketplace: id => ipcRenderer.invoke('hermes:vscode-theme:fetch', id),
-    searchMarketplace: query => ipcRenderer.invoke('hermes:vscode-theme:search', query)
   }
 })

apps/desktop/electron/session-windows.cjs

@@ -1,86 +0,0 @@
-// Secondary "session windows" — one extra OS window per chat so a user can
-// work with multiple chats side by side. The pure, Electron-free pieces live
-// here so they can be unit-tested with node --test (mirroring how the rest of
-// electron/*.cjs splits testable logic out of the main.cjs monolith).
-
-const { pathToFileURL } = require('node:url')
-
-// Build the renderer URL for a secondary window. The renderer uses a
-// HashRouter, so the session route lives after the '#'. The `?win=secondary`
-// flag MUST sit in the query string BEFORE the '#': anything after the '#' is
-// treated as the route by HashRouter and would break routeSessionId(). The
-// renderer reads the flag from window.location.search to suppress the install /
-// onboarding overlays and the global session sidebar.
-function buildSessionWindowUrl(sessionId, { devServer, rendererIndexPath } = {}) {
-  const route = `#/${encodeURIComponent(sessionId)}`
-
-  if (devServer) {
-    const base = devServer.endsWith('/') ? devServer.slice(0, -1) : devServer
-
-    return `${base}/?win=secondary${route}`
-  }
-
-  return `${pathToFileURL(rendererIndexPath).toString()}?win=secondary${route}`
-}
-
-// A small registry keyed by sessionId that guarantees one window per chat:
-// opening a session that already has a live window focuses it instead of
-// spawning a duplicate, and a window removes itself from the registry when it
-// closes. The actual BrowserWindow construction is injected (the `factory`) so
-// this module stays free of Electron and is unit-testable.
-function createSessionWindowRegistry() {
-  const windows = new Map()
-
-  function openOrFocus(sessionId, factory) {
-    const key = typeof sessionId === 'string' ? sessionId.trim() : ''
-
-    if (!key) {
-      return null
-    }
-
-    const existing = windows.get(key)
-
-    if (existing && !existing.isDestroyed()) {
-      // Focus-or-create: never duplicate a window for the same chat.
-      if (typeof existing.isMinimized === 'function' && existing.isMinimized()) {
-        existing.restore?.()
-      }
-
-      if (typeof existing.isVisible === 'function' && !existing.isVisible()) {
-        existing.show?.()
-      }
-
-      existing.focus?.()
-
-      return existing
-    }
-
-    const win = factory(key)
-
-    if (!win) {
-      return null
-    }
-
-    windows.set(key, win)
-
-    // Self-cleanup on close so the registry never holds a destroyed window.
-    win.on?.('closed', () => {
-      if (windows.get(key) === win) {
-        windows.delete(key)
-      }
-    })
-
-    return win
-  }
-
-  return {
-    openOrFocus,
-    get: key => windows.get(key),
-    has: key => windows.has(key),
-    get size() {
-      return windows.size
-    }
-  }
-}
-
-module.exports = { buildSessionWindowUrl, createSessionWindowRegistry }

apps/desktop/electron/session-windows.test.cjs

@@ -1,165 +0,0 @@
-const assert = require('node:assert/strict')
-const test = require('node:test')
-
-const { buildSessionWindowUrl, createSessionWindowRegistry } = require('./session-windows.cjs')
-
-// A minimal fake BrowserWindow: tracks listeners + destroyed state and lets a
-// test fire the 'closed' event, mirroring the slice of the Electron API the
-// registry actually touches.
-function makeFakeWindow() {
-  const listeners = {}
-  const calls = { focus: 0, show: 0, restore: 0 }
-  let destroyed = false
-  let minimized = false
-  let visible = true
-
-  return {
-    on(event, handler) {
-      listeners[event] = handler
-
-      return this
-    },
-    emit(event) {
-      listeners[event]?.()
-    },
-    isDestroyed: () => destroyed,
-    destroy() {
-      destroyed = true
-    },
-    isMinimized: () => minimized,
-    setMinimized(value) {
-      minimized = value
-    },
-    isVisible: () => visible,
-    setVisible(value) {
-      visible = value
-    },
-    restore() {
-      calls.restore += 1
-      minimized = false
-    },
-    show() {
-      calls.show += 1
-      visible = true
-    },
-    focus() {
-      calls.focus += 1
-    },
-    calls
-  }
-}
-
-test('buildSessionWindowUrl puts the secondary flag before the hash route (dev server)', () => {
-  const url = buildSessionWindowUrl('abc123', { devServer: 'http://localhost:5173' })
-
-  assert.equal(url, 'http://localhost:5173/?win=secondary#/abc123')
-})
-
-test('buildSessionWindowUrl avoids a double slash when the dev server has a trailing slash', () => {
-  const url = buildSessionWindowUrl('abc123', { devServer: 'http://localhost:5173/' })
-
-  assert.equal(url, 'http://localhost:5173/?win=secondary#/abc123')
-})
-
-test('buildSessionWindowUrl encodes the session id in the hash route', () => {
-  const url = buildSessionWindowUrl('a b/c', { devServer: 'http://localhost:5173' })
-
-  // The query flag must precede the '#' or HashRouter would swallow it as the
-  // route; the id is URL-encoded so slashes/spaces survive routeSessionId().
-  assert.equal(url, 'http://localhost:5173/?win=secondary#/a%20b%2Fc')
-  assert.ok(url.indexOf('?win=secondary') < url.indexOf('#'))
-})
-
-test('buildSessionWindowUrl builds a packaged file URL with the flag before the hash', () => {
-  const url = buildSessionWindowUrl('abc', { rendererIndexPath: '/opt/app/index.html' })
-
-  assert.match(url, /^file:\/\/.*index\.html\?win=secondary#\/abc$/)
-})
-
-test('registry opens one window per session and focuses on re-open', () => {
-  const registry = createSessionWindowRegistry()
-  let built = 0
-  const win = makeFakeWindow()
-  const factory = () => {
-    built += 1
-
-    return win
-  }
-
-  const first = registry.openOrFocus('s1', factory)
-  const second = registry.openOrFocus('s1', factory)
-
-  assert.equal(built, 1, 'factory runs once for the same session')
-  assert.equal(first, second)
-  assert.equal(registry.size, 1)
-  assert.equal(win.calls.focus, 1, 'second open focuses the existing window')
-})
-
-test('registry restores + shows a minimized/hidden window on re-open', () => {
-  const registry = createSessionWindowRegistry()
-  const win = makeFakeWindow()
-  registry.openOrFocus('s1', () => win)
-
-  win.setMinimized(true)
-  win.setVisible(false)
-  registry.openOrFocus('s1', () => win)
-
-  assert.equal(win.calls.restore, 1)
-  assert.equal(win.calls.show, 1)
-  assert.equal(win.calls.focus, 1)
-})
-
-test('registry drops the entry when the window closes', () => {
-  const registry = createSessionWindowRegistry()
-  const win = makeFakeWindow()
-  registry.openOrFocus('s1', () => win)
-  assert.equal(registry.size, 1)
-
-  win.emit('closed')
-
-  assert.equal(registry.size, 0)
-  assert.equal(registry.has('s1'), false)
-})
-
-test('registry rebuilds a fresh window after the previous one was destroyed', () => {
-  const registry = createSessionWindowRegistry()
-  const first = makeFakeWindow()
-  registry.openOrFocus('s1', () => first)
-  first.destroy()
-
-  let built = 0
-  const second = makeFakeWindow()
-  const result = registry.openOrFocus('s1', () => {
-    built += 1
-
-    return second
-  })
-
-  assert.equal(built, 1, 'a destroyed window is replaced, not focused')
-  assert.equal(result, second)
-})
-
-test('registry ignores empty / non-string session ids', () => {
-  const registry = createSessionWindowRegistry()
-  let built = 0
-  const factory = () => {
-    built += 1
-
-    return makeFakeWindow()
-  }
-
-  assert.equal(registry.openOrFocus('', factory), null)
-  assert.equal(registry.openOrFocus('   ', factory), null)
-  assert.equal(registry.openOrFocus(null, factory), null)
-  assert.equal(registry.openOrFocus(42, factory), null)
-  assert.equal(built, 0)
-  assert.equal(registry.size, 0)
-})
-
-test('registry trims the session id before keying', () => {
-  const registry = createSessionWindowRegistry()
-  const win = makeFakeWindow()
-  registry.openOrFocus('  s1  ', () => win)
-
-  assert.equal(registry.has('s1'), true)
-})

apps/desktop/electron/vscode-marketplace.cjs

@@ -1,331 +0,0 @@
-'use strict'
-
-/**
- * VS Code Marketplace color-theme fetcher (main process).
- *
- * Resolves an extension's latest version via the (undocumented but stable)
- * gallery ExtensionQuery API, downloads the `.vsix` (a zip), and extracts the
- * color-theme JSON files it contributes. No theme code is ever executed — we
- * only read `package.json` + the referenced `*.json` theme files out of the
- * archive and hand their text back to the renderer to convert.
- *
- * Dependency-free on purpose: a `.vsix` is a plain zip, so we parse the central
- * directory and inflate just the entries we need with `zlib`. Avoids pulling a
- * zip library into the desktop bundle for a feature this small.
- */
-
-const https = require('node:https')
-const zlib = require('node:zlib')
-
-const GALLERY_QUERY_URL = 'https://marketplace.visualstudio.com/_apis/public/gallery/extensionquery'
-const VSIX_ASSET_TYPE = 'Microsoft.VisualStudio.Services.VSIXPackage'
-const MAX_VSIX_BYTES = 40 * 1024 * 1024 // 40 MB — themes are tiny; this is paranoia.
-const MAX_REDIRECTS = 5
-const REQUEST_TIMEOUT_MS = 20_000
-
-const ID_RE = /^[\w-]+\.[\w-]+$/
-
-/** Minimal HTTPS helper with redirect-following, timeout, and a size cap. */
-function request(url, { method = 'GET', headers = {}, body = null, maxBytes = MAX_VSIX_BYTES } = {}, redirectsLeft = MAX_REDIRECTS) {
-  return new Promise((resolve, reject) => {
-    const req = https.request(url, { method, headers }, res => {
-      const status = res.statusCode ?? 0
-
-      if (status >= 300 && status < 400 && res.headers.location) {
-        if (redirectsLeft <= 0) {
-          res.resume()
-          reject(new Error('Too many redirects.'))
-
-          return
-        }
-
-        const next = new URL(res.headers.location, url).toString()
-        res.resume()
-        // Redirects to the CDN are plain GETs (drop the POST body).
-        resolve(request(next, { method: 'GET', headers: { 'User-Agent': headers['User-Agent'] }, maxBytes }, redirectsLeft - 1))
-
-        return
-      }
-
-      if (status < 200 || status >= 300) {
-        res.resume()
-        reject(new Error(`Request failed (${status}) for ${url}`))
-
-        return
-      }
-
-      const chunks = []
-      let total = 0
-
-      res.on('data', chunk => {
-        total += chunk.length
-
-        if (total > maxBytes) {
-          req.destroy()
-          reject(new Error('Response exceeded the size limit.'))
-
-          return
-        }
-
-        chunks.push(chunk)
-      })
-      res.on('end', () => resolve(Buffer.concat(chunks)))
-    })
-
-    req.on('error', reject)
-    req.setTimeout(REQUEST_TIMEOUT_MS, () => req.destroy(new Error('Request timed out.')))
-
-    if (body) {
-      req.write(body)
-    }
-
-    req.end()
-  })
-}
-
-/** Resolve `{ displayName, vsixUrl }` for the latest version of `id`. */
-async function resolveExtension(id) {
-  const json = await queryGallery({
-    // FilterType 7 = ExtensionName (the full publisher.extension id).
-    filters: [{ criteria: [{ filterType: 7, value: id }], pageNumber: 1, pageSize: 1 }],
-    // Flags: IncludeFiles | IncludeVersionProperties | IncludeAssetUri |
-    // IncludeCategoryAndTags | IncludeLatestVersionOnly = 914.
-    flags: 914
-  })
-  const extension = json?.results?.[0]?.extensions?.[0]
-
-  if (!extension) {
-    throw new Error(`Extension "${id}" was not found on the Marketplace.`)
-  }
-
-  const version = extension.versions?.[0]
-
-  if (!version) {
-    throw new Error(`Extension "${id}" has no published versions.`)
-  }
-
-  const asset = (version.files ?? []).find(file => file.assetType === VSIX_ASSET_TYPE)
-  const vsixUrl = asset?.source
-
-  if (!vsixUrl) {
-    throw new Error(`Could not find a downloadable package for "${id}".`)
-  }
-
-  return { displayName: extension.displayName || id, vsixUrl }
-}
-
-/** POST an ExtensionQuery payload and return the parsed gallery response. */
-async function queryGallery(payload, { maxBytes = 4 * 1024 * 1024 } = {}) {
-  const body = JSON.stringify(payload)
-  const raw = await request(GALLERY_QUERY_URL, {
-    method: 'POST',
-    headers: {
-      Accept: 'application/json;api-version=3.0-preview.1',
-      'Content-Type': 'application/json',
-      'Content-Length': Buffer.byteLength(body),
-      'User-Agent': 'Hermes-Desktop'
-    },
-    body,
-    maxBytes
-  })
-
-  return JSON.parse(raw.toString('utf8'))
-}
-
-/**
- * Search the Marketplace for color-theme extensions. With an empty query this
- * returns the most-installed themes; with a query it's a full-text search
- * scoped to the Themes category. Returns lightweight cards (no download).
- */
-/**
- * The "Themes" category also contains file-icon and product-icon themes (the
- * gallery has no color-only category). We can't see an extension's actual
- * contributions without downloading it, so filter the obvious icon packs out by
- * tag + name/description. Color themes that also ship icons are rare; worst case
- * a user installs them by exact id from settings.
- */
-function looksLikeIconTheme(extension) {
-  const tags = (extension.tags ?? []).map(tag => String(tag).toLowerCase())
-
-  if (tags.includes('icon-theme') || tags.includes('product-icon-theme')) {
-    return true
-  }
-
-  const text = `${extension.displayName ?? ''} ${extension.shortDescription ?? ''}`.toLowerCase()
-
-  return /\b(icon theme|file icons?|product icons?|icon pack|fileicons)\b/.test(text)
-}
-
-async function searchMarketplaceThemes(query, limit = 20) {
-  const text = String(query || '').trim()
-  const pageSize = Math.min(Math.max(Number(limit) || 20, 1), 50)
-
-  // FilterType: 8=Target, 5=Category, 10=SearchText, 12=ExcludeWithFlags.
-  const criteria = [
-    { filterType: 8, value: 'Microsoft.VisualStudio.Code' },
-    { filterType: 5, value: 'Themes' },
-    { filterType: 12, value: '4096' } // Exclude unpublished (Unpublished = 0x1000).
-  ]
-
-  if (text) {
-    criteria.push({ filterType: 10, value: text })
-  }
-
-  const json = await queryGallery({
-    // Over-fetch so the icon-theme filter below still leaves a full page.
-    filters: [{ criteria, pageNumber: 1, pageSize: Math.min(pageSize * 2, 50), sortBy: 4, sortOrder: 0 }],
-    // IncludeStatistics (0x100) | IncludeLatestVersionOnly (0x200) | IncludeCategoryAndTags (0x4).
-    flags: 772
-  })
-
-  const extensions = json?.results?.[0]?.extensions ?? []
-
-  return extensions
-    .filter(extension => !looksLikeIconTheme(extension))
-    .slice(0, pageSize)
-    .map(extension => {
-      const publisherName = extension.publisher?.publisherName ?? ''
-      const installStat = (extension.statistics ?? []).find(stat => stat.statisticName === 'install')
-
-      return {
-        extensionId: `${publisherName}.${extension.extensionName}`,
-        displayName: extension.displayName || extension.extensionName,
-        publisher: extension.publisher?.displayName || publisherName,
-        description: extension.shortDescription || '',
-        installs: Math.round(installStat?.value ?? 0)
-      }
-    })
-}
-
-// ─── Minimal zip reader ─────────────────────────────────────────────────────
-
-function findEndOfCentralDirectory(buf) {
-  // EOCD signature 0x06054b50, scanning back from the end (comment is rare).
-  for (let i = buf.length - 22; i >= 0; i--) {
-    if (buf.readUInt32LE(i) === 0x06054b50) {
-      return i
-    }
-  }
-
-  throw new Error('Not a valid zip archive (no end-of-central-directory).')
-}
-
-/** Parse the central directory into a name → record map. */
-function readCentralDirectory(buf) {
-  const eocd = findEndOfCentralDirectory(buf)
-  const count = buf.readUInt16LE(eocd + 10)
-  let offset = buf.readUInt32LE(eocd + 16)
-  const records = new Map()
-
-  for (let i = 0; i < count; i++) {
-    if (buf.readUInt32LE(offset) !== 0x02014b50) {
-      break
-    }
-
-    const method = buf.readUInt16LE(offset + 10)
-    const compressedSize = buf.readUInt32LE(offset + 20)
-    const nameLen = buf.readUInt16LE(offset + 28)
-    const extraLen = buf.readUInt16LE(offset + 30)
-    const commentLen = buf.readUInt16LE(offset + 32)
-    const localOffset = buf.readUInt32LE(offset + 42)
-    const name = buf.toString('utf8', offset + 46, offset + 46 + nameLen)
-
-    records.set(name, { method, compressedSize, localOffset })
-    offset += 46 + nameLen + extraLen + commentLen
-  }
-
-  return records
-}
-
-/** Inflate a single entry to a string. */
-function extractEntry(buf, record) {
-  // The local header's name/extra lengths can differ from the central record,
-  // so re-read them here to locate the compressed payload.
-  if (buf.readUInt32LE(record.localOffset) !== 0x04034b50) {
-    throw new Error('Corrupt zip: bad local file header.')
-  }
-
-  const nameLen = buf.readUInt16LE(record.localOffset + 26)
-  const extraLen = buf.readUInt16LE(record.localOffset + 28)
-  const dataStart = record.localOffset + 30 + nameLen + extraLen
-  const data = buf.subarray(dataStart, dataStart + record.compressedSize)
-
-  // 0 = stored, 8 = deflate. Theme files are one or the other.
-  return record.method === 0 ? data.toString('utf8') : zlib.inflateRawSync(data).toString('utf8')
-}
-
-/** Normalize a package.json theme path to its zip entry name. */
-function themeEntryName(themePath) {
-  const clean = String(themePath).replace(/^\.\//, '').replace(/^\//, '')
-
-  return `extension/${clean}`
-}
-
-/** Extract every contributed color theme from a `.vsix` buffer. */
-function extractThemes(vsixBuffer) {
-  const records = readCentralDirectory(vsixBuffer)
-  const pkgRecord = records.get('extension/package.json')
-
-  if (!pkgRecord) {
-    throw new Error('Package manifest missing from the extension.')
-  }
-
-  const pkg = JSON.parse(extractEntry(vsixBuffer, pkgRecord))
-  const contributed = pkg?.contributes?.themes
-
-  if (!Array.isArray(contributed) || contributed.length === 0) {
-    return []
-  }
-
-  const themes = []
-
-  for (const entry of contributed) {
-    if (!entry?.path) {
-      continue
-    }
-
-    const record = records.get(themeEntryName(entry.path))
-
-    if (!record) {
-      continue
-    }
-
-    try {
-      themes.push({
-        label: entry.label || entry.id || pkg.displayName || pkg.name || 'VS Code Theme',
-        uiTheme: entry.uiTheme,
-        contents: extractEntry(vsixBuffer, record)
-      })
-    } catch {
-      // Skip an entry we can't inflate rather than failing the whole install.
-    }
-  }
-
-  return themes
-}
-
-/**
- * Public entry: resolve, download, and extract color themes for `id`
- * (`publisher.extension`). Returns `{ extensionId, displayName, themes }`.
- */
-async function fetchMarketplaceThemes(id) {
-  const trimmed = String(id || '').trim()
-
-  if (!ID_RE.test(trimmed)) {
-    throw new Error('Expected a Marketplace id like "publisher.extension".')
-  }
-
-  const { displayName, vsixUrl } = await resolveExtension(trimmed)
-  const vsix = await request(vsixUrl, { headers: { 'User-Agent': 'Hermes-Desktop' } })
-  const themes = extractThemes(vsix)
-
-  return { extensionId: trimmed, displayName, themes }
-}
-
-module.exports = {
-  fetchMarketplaceThemes,
-  searchMarketplaceThemes,
-  extractThemes,
-  readCentralDirectory,
-  __testing: { themeEntryName, looksLikeIconTheme }
-}

apps/desktop/electron/vscode-marketplace.test.cjs

@@ -1,113 +0,0 @@
-'use strict'
-
-const assert = require('node:assert')
-const test = require('node:test')
-
-const { __testing, extractThemes, readCentralDirectory } = require('./vscode-marketplace.cjs')
-
-// Build a minimal zip with stored (uncompressed) entries so the test controls
-// the bytes exactly — exercises the central-directory reader + theme extraction
-// without a deflate dependency.
-function makeZip(entries) {
-  const locals = []
-  const centrals = []
-  let offset = 0
-
-  for (const { name, data } of entries) {
-    const nameBuf = Buffer.from(name, 'utf8')
-    const body = Buffer.from(data, 'utf8')
-
-    const local = Buffer.alloc(30 + nameBuf.length)
-    local.writeUInt32LE(0x04034b50, 0)
-    local.writeUInt16LE(0, 8) // method: stored
-    local.writeUInt32LE(body.length, 18) // compressed size
-    local.writeUInt32LE(body.length, 22) // uncompressed size
-    local.writeUInt16LE(nameBuf.length, 26)
-    nameBuf.copy(local, 30)
-
-    locals.push(local, body)
-
-    const central = Buffer.alloc(46 + nameBuf.length)
-    central.writeUInt32LE(0x02014b50, 0)
-    central.writeUInt16LE(0, 10) // method: stored
-    central.writeUInt32LE(body.length, 20)
-    central.writeUInt32LE(body.length, 24)
-    central.writeUInt16LE(nameBuf.length, 28)
-    central.writeUInt32LE(offset, 42) // local header offset
-    nameBuf.copy(central, 46)
-
-    centrals.push(central)
-    offset += local.length + body.length
-  }
-
-  const centralStart = offset
-  const centralBuf = Buffer.concat(centrals)
-
-  const eocd = Buffer.alloc(22)
-  eocd.writeUInt32LE(0x06054b50, 0)
-  eocd.writeUInt16LE(entries.length, 8)
-  eocd.writeUInt16LE(entries.length, 10)
-  eocd.writeUInt32LE(centralBuf.length, 12)
-  eocd.writeUInt32LE(centralStart, 16)
-
-  return Buffer.concat([...locals, centralBuf, eocd])
-}
-
-test('readCentralDirectory finds every entry', () => {
-  const zip = makeZip([
-    { name: 'extension/package.json', data: '{}' },
-    { name: 'extension/themes/x.json', data: '{}' }
-  ])
-
-  const records = readCentralDirectory(zip)
-  assert.ok(records.has('extension/package.json'))
-  assert.ok(records.has('extension/themes/x.json'))
-})
-
-test('extractThemes reads contributed color themes (resolving ./ paths)', () => {
-  const pkg = JSON.stringify({
-    name: 'theme-dracula',
-    displayName: 'Dracula',
-    contributes: {
-      themes: [{ label: 'Dracula', uiTheme: 'vs-dark', path: './themes/dracula.json' }]
-    }
-  })
-  const themeJson = JSON.stringify({ name: 'Dracula', type: 'dark', colors: { 'editor.background': '#282a36' } })
-
-  const zip = makeZip([
-    { name: 'extension/package.json', data: pkg },
-    { name: 'extension/themes/dracula.json', data: themeJson }
-  ])
-
-  const themes = extractThemes(zip)
-  assert.strictEqual(themes.length, 1)
-  assert.strictEqual(themes[0].label, 'Dracula')
-  assert.strictEqual(themes[0].uiTheme, 'vs-dark')
-  assert.match(themes[0].contents, /editor\.background/)
-})
-
-test('extractThemes returns empty when the extension contributes no themes', () => {
-  const zip = makeZip([{ name: 'extension/package.json', data: JSON.stringify({ name: 'x', contributes: {} }) }])
-  assert.deepStrictEqual(extractThemes(zip), [])
-})
-
-test('extractThemes throws when the manifest is missing', () => {
-  const zip = makeZip([{ name: 'extension/other.txt', data: 'hi' }])
-  assert.throws(() => extractThemes(zip), /manifest missing/i)
-})
-
-test('looksLikeIconTheme filters icon/product-icon packs out of theme search', () => {
-  const { looksLikeIconTheme } = __testing
-
-  // Tagged contribution points are the strongest signal.
-  assert.strictEqual(looksLikeIconTheme({ tags: ['theme', 'icon-theme'] }), true)
-  assert.strictEqual(looksLikeIconTheme({ tags: ['product-icon-theme'] }), true)
-
-  // Name/description fallback for packs that don't tag themselves.
-  assert.strictEqual(looksLikeIconTheme({ displayName: 'Material Icon Theme' }), true)
-  assert.strictEqual(looksLikeIconTheme({ shortDescription: 'A pack of file icons.' }), true)
-
-  // Real color themes survive.
-  assert.strictEqual(looksLikeIconTheme({ displayName: 'Dracula Official', tags: ['theme', 'color-theme'] }), false)
-  assert.strictEqual(looksLikeIconTheme({ displayName: 'One Dark Pro' }), false)
-})

apps/desktop/electron/windows-child-process.test.cjs

@@ -1,54 +0,0 @@
-'use strict'
-
-const test = require('node:test')
-const assert = require('node:assert/strict')
-const fs = require('node:fs')
-const path = require('node:path')
-
-const ELECTRON_DIR = __dirname
-
-function readElectronFile(name) {
-  return fs.readFileSync(path.join(ELECTRON_DIR, name), 'utf8')
-}
-
-function requireHiddenChildOptions(source, needle) {
-  const index = source.indexOf(needle)
-  assert.notEqual(index, -1, `missing call site: ${needle}`)
-  const snippet = source.slice(index, index + 700)
-  assert.match(
-    snippet,
-    /hiddenWindowsChildOptions\(/,
-    `expected ${needle} to wrap child-process options with hiddenWindowsChildOptions`
-  )
-}
-
-test('desktop background child processes opt into hidden Windows consoles', () => {
-  const source = readElectronFile('main.cjs')
-
-  assert.match(source, /function hiddenWindowsChildOptions\(options = \{\}\)/)
-
-  requireHiddenChildOptions(source, "execFileSync(\n          'reg'")
-  requireHiddenChildOptions(source, 'execFileSync(pyExe')
-  requireHiddenChildOptions(source, 'spawn(resolveGitBinary()')
-  requireHiddenChildOptions(source, "execFileSync('taskkill'")
-  requireHiddenChildOptions(source, 'spawn(command, args')
-  requireHiddenChildOptions(source, "spawn('curl'")
-  requireHiddenChildOptions(source, 'spawn(backend.command, backend.args')
-  requireHiddenChildOptions(source, 'hermesProcess = spawn(backend.command, backend.args')
-  requireHiddenChildOptions(source, "spawn(py, ['-m', 'hermes_cli.main', 'uninstall', '--gui-summary']")
-})
-
-test('intentional or interactive desktop child processes stay documented', () => {
-  const source = readElectronFile('main.cjs')
-
-  assert.match(source, /windowsHide: false/)
-  assert.match(source, /nodePty\.spawn\(command, args/)
-  assert.match(source, /spawn\('cmd\.exe', \['\/c', 'start'/)
-})
-
-test('bootstrap PowerShell runner hides Windows console children', () => {
-  const source = readElectronFile('bootstrap-runner.cjs')
-
-  assert.match(source, /function hiddenWindowsChildOptions\(options = \{\}\)/)
-  requireHiddenChildOptions(source, 'spawn(ps, fullArgs')
-})

apps/desktop/electron/workspace-cwd.cjs

@@ -1,38 +0,0 @@
-const path = require('node:path')
-
-/** True when `dir` lives inside a packaged app bundle / install tree. */
-function isPackagedInstallPath(dir, { installRoots, isPackaged }) {
-  if (!isPackaged || !dir) {
-    return false
-  }
-
-  let resolved
-
-  try {
-    resolved = path.resolve(String(dir))
-  } catch {
-    return false
-  }
-
-  const roots = new Set(
-    (installRoots ?? [])
-      .filter(Boolean)
-      .map(candidate => path.resolve(String(candidate)))
-  )
-
-  for (const root of roots) {
-    if (resolved === root) {
-      return true
-    }
-
-    const rel = path.relative(root, resolved)
-
-    if (rel && !rel.startsWith('..') && !path.isAbsolute(rel)) {
-      return true
-    }
-  }
-
-  return false
-}
-
-module.exports = { isPackagedInstallPath }

apps/desktop/electron/workspace-cwd.test.cjs

@@ -1,45 +0,0 @@
-/**
- * Tests for electron/workspace-cwd.cjs.
- *
- * Run with: node --test electron/workspace-cwd.test.cjs
- */
-
-const test = require('node:test')
-const assert = require('node:assert/strict')
-const path = require('node:path')
-
-const { isPackagedInstallPath } = require('./workspace-cwd.cjs')
-
-const installRoot = path.resolve('/opt/Hermes')
-
-test('isPackagedInstallPath returns false when not packaged', () => {
-  assert.equal(
-    isPackagedInstallPath(installRoot, { isPackaged: false, installRoots: [installRoot] }),
-    false
-  )
-})
-
-test('isPackagedInstallPath flags the install root itself', () => {
-  assert.equal(
-    isPackagedInstallPath(installRoot, { isPackaged: true, installRoots: [installRoot] }),
-    true
-  )
-})
-
-test('isPackagedInstallPath flags paths nested under the install root', () => {
-  const nested = path.join(installRoot, 'resources', 'app.asar')
-
-  assert.equal(
-    isPackagedInstallPath(nested, { isPackaged: true, installRoots: [installRoot] }),
-    true
-  )
-})
-
-test('isPackagedInstallPath ignores paths outside the install root', () => {
-  const homeProject = path.resolve('/home/user/projects/demo')
-
-  assert.equal(
-    isPackagedInstallPath(homeProject, { isPackaged: true, installRoots: [installRoot] }),
-    false
-  )
-})

apps/desktop/package.json

@@ -18,7 +18,7 @@
     "profile:main": "wait-on http://127.0.0.1:5174 && cross-env XCURSOR_SIZE=24 HERMES_DESKTOP_DEV_SERVER=http://127.0.0.1:5174 electron --inspect=9229 .",
     "profile:main:cpu": "wait-on http://127.0.0.1:5174 && cross-env XCURSOR_SIZE=24 NODE_OPTIONS=--cpu-prof HERMES_DESKTOP_DEV_SERVER=http://127.0.0.1:5174 electron .",
     "start": "npm run build && electron .",
-    "build": "node scripts/assert-root-install.cjs && node scripts/write-build-stamp.cjs && node scripts/stage-native-deps.cjs && tsc -b && vite build && node scripts/assert-dist-built.cjs",
+    "build": "node scripts/assert-root-install.cjs && node scripts/write-build-stamp.cjs && node scripts/stage-native-deps.cjs && tsc -b && vite build",
     "builder": "cross-env NODE_OPTIONS=--max-old-space-size=16384 electron-builder",
     "pack": "npm run build && npm run builder -- --dir",
     "dist": "npm run build && npm run builder",
@@ -35,7 +35,7 @@
     "test:desktop:nsis": "node scripts/test-desktop.mjs nsis",
     "test:desktop:existing": "node scripts/test-desktop.mjs existing",
     "test:desktop:fresh": "node scripts/test-desktop.mjs fresh",
-    "test:desktop:platforms": "node --test electron/bootstrap-platform.test.cjs electron/hardening.test.cjs electron/backend-probes.test.cjs electron/bootstrap-runner.test.cjs electron/connection-config.test.cjs electron/gateway-ws-probe.test.cjs electron/oauth-net-request.test.cjs electron/desktop-uninstall.test.cjs electron/session-windows.test.cjs electron/workspace-cwd.test.cjs electron/windows-child-process.test.cjs",
+    "test:desktop:platforms": "node --test electron/bootstrap-platform.test.cjs electron/hardening.test.cjs electron/backend-probes.test.cjs electron/bootstrap-runner.test.cjs electron/connection-config.test.cjs electron/gateway-ws-probe.test.cjs electron/oauth-net-request.test.cjs",
     "type-check": "tsc -b",
     "lint": "eslint src/ electron/",
     "lint:fix": "eslint src/ electron/ --fix",
@@ -166,8 +166,7 @@
     "afterSign": "scripts/notarize.cjs",
     "asarUnpack": [
       "**/*.node",
-      "**/prebuilds/**",
-      "dist/**"
+      "**/prebuilds/**"
     ],
     "mac": {
       "category": "public.app-category.developer-tools",

apps/desktop/scripts/assert-dist-built.cjs

@@ -1,70 +0,0 @@
-"use strict"
-
-// Build-time guard: refuse to hand a half-built renderer to electron-builder.
-//
-// `npm run pack` / `npm run dist*` are `npm run build && npm run builder`.
-// If the `build` step (tsc -b && vite build) fails but packaging proceeds
-// anyway — a stale checkout that fails typecheck, an interrupted vite build,
-// or npm not short-circuiting `&&` in some shells — electron-builder happily
-// packages an app with an empty or missing `dist/`. The result launches but
-// blank-pages with `ERR_FILE_NOT_FOUND` for dist/index.html, with no clue why.
-//
-// This runs at the tail of `build`, after vite build, so any packaging path
-// inherits it. It fails loud and early instead of shipping a broken bundle.
-// See issues #39484 (renderer blank page) and #41327 / #39472 (dashboard 404).
-
-const fs = require("fs")
-const path = require("path")
-
-// Pure check — returns { ok: true } or { ok: false, error: "..." }.
-// Kept side-effect-free so it can be unit tested without spawning a process.
-function checkDistBuilt(distDir) {
-  if (!fs.existsSync(distDir) || !fs.statSync(distDir).isDirectory()) {
-    return { ok: false, error: `no dist directory at ${distDir}` }
-  }
-
-  const indexHtml = path.join(distDir, "index.html")
-  if (!fs.existsSync(indexHtml) || !fs.statSync(indexHtml).isFile()) {
-    return { ok: false, error: `dist/index.html is missing at ${indexHtml}` }
-  }
-  if (fs.statSync(indexHtml).size === 0) {
-    return { ok: false, error: `dist/index.html is empty at ${indexHtml}` }
-  }
-
-  // index.html alone isn't enough — vite emits hashed JS into dist/assets.
-  // An index.html with no script bundle still blank-pages.
-  const assetsDir = path.join(distDir, "assets")
-  const hasAssets =
-    fs.existsSync(assetsDir) &&
-    fs.statSync(assetsDir).isDirectory() &&
-    fs.readdirSync(assetsDir).some(name => name.endsWith(".js"))
-  if (!hasAssets) {
-    return { ok: false, error: `dist/assets has no built JS bundle (expected vite output under ${assetsDir})` }
-  }
-
-  return { ok: true }
-}
-
-function main() {
-  const desktopRoot = path.resolve(__dirname, "..")
-  const distDir = path.join(desktopRoot, "dist")
-  const result = checkDistBuilt(distDir)
-
-  if (!result.ok) {
-    console.error(`\n✗ assert-dist-built: ${result.error}`)
-    console.error("  The renderer bundle is missing or incomplete, so packaging")
-    console.error("  would produce an app that launches to a blank page.")
-    console.error("  Re-run the build and check the tsc/vite output above for the")
-    console.error("  real failure, then package again:")
-    console.error(`    cd ${desktopRoot} && npm run build\n`)
-    process.exit(1)
-  }
-
-  console.log("✓ assert-dist-built: dist/index.html + assets present")
-}
-
-if (require.main === module) {
-  main()
-}
-
-module.exports = { checkDistBuilt }

apps/desktop/scripts/assert-dist-built.test.cjs

@@ -1,84 +0,0 @@
-const assert = require('node:assert/strict')
-const fs = require('node:fs')
-const os = require('node:os')
-const path = require('node:path')
-const test = require('node:test')
-
-const { checkDistBuilt } = require('../scripts/assert-dist-built.cjs')
-
-function makeDist(extra) {
-  const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'hermes-assert-dist-'))
-  const distDir = path.join(tempRoot, 'dist')
-  fs.mkdirSync(distDir, { recursive: true })
-  if (extra) extra(distDir)
-  return { tempRoot, distDir }
-}
-
-test('checkDistBuilt passes when index.html + an assets JS bundle exist', () => {
-  const { tempRoot, distDir } = makeDist(d => {
-    fs.writeFileSync(path.join(d, 'index.html'), '<!doctype html><div id=root></div>', 'utf8')
-    fs.mkdirSync(path.join(d, 'assets'))
-    fs.writeFileSync(path.join(d, 'assets', 'index-abc123.js'), 'console.log(1)', 'utf8')
-  })
-  try {
-    assert.deepEqual(checkDistBuilt(distDir), { ok: true })
-  } finally {
-    fs.rmSync(tempRoot, { recursive: true, force: true })
-  }
-})
-
-test('checkDistBuilt fails when the dist directory is absent', () => {
-  const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'hermes-assert-dist-'))
-  try {
-    const result = checkDistBuilt(path.join(tempRoot, 'dist'))
-    assert.equal(result.ok, false)
-    assert.match(result.error, /no dist directory/)
-  } finally {
-    fs.rmSync(tempRoot, { recursive: true, force: true })
-  }
-})
-
-test('checkDistBuilt fails when index.html is missing', () => {
-  const { tempRoot, distDir } = makeDist(d => {
-    fs.mkdirSync(path.join(d, 'assets'))
-    fs.writeFileSync(path.join(d, 'assets', 'index-abc123.js'), 'console.log(1)', 'utf8')
-  })
-  try {
-    const result = checkDistBuilt(distDir)
-    assert.equal(result.ok, false)
-    assert.match(result.error, /index\.html is missing/)
-  } finally {
-    fs.rmSync(tempRoot, { recursive: true, force: true })
-  }
-})
-
-test('checkDistBuilt fails when index.html is empty', () => {
-  const { tempRoot, distDir } = makeDist(d => {
-    fs.writeFileSync(path.join(d, 'index.html'), '', 'utf8')
-    fs.mkdirSync(path.join(d, 'assets'))
-    fs.writeFileSync(path.join(d, 'assets', 'index-abc123.js'), 'console.log(1)', 'utf8')
-  })
-  try {
-    const result = checkDistBuilt(distDir)
-    assert.equal(result.ok, false)
-    assert.match(result.error, /index\.html is empty/)
-  } finally {
-    fs.rmSync(tempRoot, { recursive: true, force: true })
-  }
-})
-
-test('checkDistBuilt fails when assets/ has no JS bundle', () => {
-  const { tempRoot, distDir } = makeDist(d => {
-    fs.writeFileSync(path.join(d, 'index.html'), '<!doctype html>', 'utf8')
-    fs.mkdirSync(path.join(d, 'assets'))
-    // CSS only, no JS — still a blank page at runtime.
-    fs.writeFileSync(path.join(d, 'assets', 'index-abc123.css'), 'body{}', 'utf8')
-  })
-  try {
-    const result = checkDistBuilt(distDir)
-    assert.equal(result.ok, false)
-    assert.match(result.error, /no built JS bundle/)
-  } finally {
-    fs.rmSync(tempRoot, { recursive: true, force: true })
-  }
-})

apps/desktop/src/app/chat/composer/attachments.tsx

@@ -3,9 +3,8 @@ import { useStore } from '@nanostores/react'
 import { Codicon } from '@/components/ui/codicon'
 import { Tip } from '@/components/ui/tooltip'
 import { useI18n } from '@/i18n'
-import { AlertCircle, FileText, FolderOpen, ImageIcon, Link, Loader2, Terminal } from '@/lib/icons'
+import { FileText, FolderOpen, ImageIcon, Link, Terminal } from '@/lib/icons'
 import { normalizeOrLocalPreviewTarget } from '@/lib/local-preview'
-import { cn } from '@/lib/utils'
 import type { ComposerAttachment } from '@/store/composer'
 import { notifyError } from '@/store/notifications'
 import { setCurrentSessionPreviewTarget } from '@/store/preview'
@@ -32,9 +31,7 @@ function AttachmentPill({ attachment, onRemove }: { attachment: ComposerAttachme
   const c = t.composer
   const Icon = { folder: FolderOpen, url: Link, image: ImageIcon, file: FileText, terminal: Terminal }[attachment.kind]
   const cwd = useStore($currentCwd)
-  const isUploading = attachment.uploadState === 'uploading'
-  const hasUploadError = attachment.uploadState === 'error'
-  const canPreview = attachment.kind !== 'folder' && attachment.kind !== 'terminal' && !isUploading
+  const canPreview = attachment.kind !== 'folder' && attachment.kind !== 'terminal'
   const detail = attachment.detail && attachment.detail !== attachment.label ? attachment.detail : undefined
 
   async function openPreview() {
@@ -62,15 +59,7 @@ function AttachmentPill({ attachment, onRemove }: { attachment: ComposerAttachme
         throw new Error(c.couldNotPreview(attachment.label))
       }
 
-      // We already hold the image bytes (the card thumbnail) — render those
-      // directly so a screenshot/clipboard image previews even when its only
-      // on-disk copy is a transient path the renderer can't re-read.
-      const withBytes =
-        attachment.kind === 'image' && attachment.previewUrl
-          ? { ...preview, dataUrl: attachment.previewUrl, previewKind: 'image' as const }
-          : preview
-
-      setCurrentSessionPreviewTarget(withBytes, 'manual', target)
+      setCurrentSessionPreviewTarget(preview, 'manual', target)
     } catch (error) {
       notifyError(error, c.previewUnavailable)
     }
@@ -80,51 +69,30 @@ function AttachmentPill({ attachment, onRemove }: { attachment: ComposerAttachme
     <Tip label={attachment.path || attachment.detail || attachment.label}>
       <div className="group/attachment relative min-w-0 shrink-0">
         <button
-          aria-busy={isUploading || undefined}
           aria-label={canPreview ? c.previewLabel(attachment.label) : attachment.label}
-          className={cn(
-            'flex max-w-56 items-center gap-2 rounded-2xl border bg-background/50 px-2 py-1.5 text-left shadow-[inset_0_1px_0_rgba(255,255,255,0.18)] transition-colors disabled:cursor-default',
-            hasUploadError
-              ? 'border-destructive/45 hover:border-destructive/60'
-              : 'border-border/60 hover:border-primary/35 hover:bg-accent/45'
-          )}
+          className="flex max-w-56 items-center gap-2 border border-border/60 bg-background/50 px-2 py-1.5 text-left shadow-[inset_0_1px_0_rgba(255,255,255,0.25)] transition-colors hover:border-primary/35 hover:bg-accent/45 disabled:cursor-default"
           disabled={!canPreview}
           onClick={() => void openPreview()}
           type="button"
         >
-          <span className="relative grid size-8 shrink-0 place-items-center overflow-hidden rounded-lg border border-border/55 bg-muted/35 text-muted-foreground">
-            {attachment.previewUrl && attachment.kind === 'image' ? (
-              <img
-                alt={attachment.label}
-                className="size-full object-cover"
-                draggable={false}
-                src={attachment.previewUrl}
-              />
-            ) : (
+          {attachment.previewUrl && attachment.kind === 'image' ? (
+            <img
+              alt={attachment.label}
+              className="size-8 shrink-0 border border-border/70 object-cover"
+              draggable={false}
+              src={attachment.previewUrl}
+            />
+          ) : (
+            <span className="grid size-8 shrink-0 place-items-center border border-border/55 bg-muted/35 text-muted-foreground">
               <Icon className="size-3.5" />
-            )}
-            {isUploading && (
-              <span className="absolute inset-0 grid place-items-center bg-background/60 backdrop-blur-[1px]">
-                <Loader2 className="size-3.5 animate-spin text-foreground/75" />
-              </span>
-            )}
-            {hasUploadError && (
-              <span className="absolute inset-0 grid place-items-center bg-destructive/15">
-                <AlertCircle className="size-3.5 text-destructive" />
-              </span>
-            )}
-          </span>
+            </span>
+          )}
           <span className="min-w-0">
             <span className="block truncate text-[0.72rem] font-medium leading-4 text-foreground/90">
               {attachment.label}
             </span>
             {detail && (
-              <span
-                className={cn(
-                  'block truncate text-[0.62rem] leading-3.5',
-                  hasUploadError ? 'text-destructive/80' : 'text-muted-foreground/65'
-                )}
-              >
+              <span className="block truncate font-mono text-[0.6rem] leading-3 text-muted-foreground/65">
                 {detail}
               </span>
             )}

apps/desktop/src/app/chat/composer/controls.tsx

@@ -4,7 +4,6 @@ import { Tip } from '@/components/ui/tooltip'
 import { useI18n } from '@/i18n'
 import { triggerHaptic } from '@/lib/haptics'
 import { AudioLines, Layers3, Loader2, Square, SteeringWheel } from '@/lib/icons'
-import { formatCombo } from '@/lib/keybinds/combo'
 import { cn } from '@/lib/utils'
 
 import type { ConversationStatus } from './hooks/use-voice-conversation'
@@ -63,7 +62,6 @@ export function ComposerControls({
 }) {
   const { t } = useI18n()
   const c = t.composer
-  const steerLabel = `${c.steer} (${formatCombo('mod+enter')})`
 
   if (conversation.active) {
     return <ConversationPill {...conversation} disabled={disabled} />
@@ -75,9 +73,9 @@ export function ComposerControls({
     <div className="ml-auto flex shrink-0 items-center gap-(--composer-control-gap)">
       <DictationButton disabled={disabled} onToggle={onDictate} state={state.voice} status={voiceStatus} />
       {canSteer && (
-        <Tip label={steerLabel}>
+        <Tip label={c.steer}>
           <Button
-            aria-label={steerLabel}
+            aria-label={c.steer}
             className={GHOST_ICON_BTN}
             disabled={disabled}
             onClick={onSteer}

apps/desktop/src/app/chat/composer/enter-submit-dom-race.test.tsx

@@ -1,189 +0,0 @@
-import { act, cleanup, fireEvent, render } from '@testing-library/react'
-import { useRef, useState } from 'react'
-import { afterEach, describe, expect, it, vi } from 'vitest'
-
-// No global setupFiles registers auto-cleanup, so unmount between tests —
-// otherwise a second render() leaks the first editor and getByTestId('editor')
-// matches multiple nodes.
-afterEach(cleanup)
-
-// Faithful mirror of index.tsx's Enter wiring (handleEditorKeyDown's Enter
-// branch + submitDraft), driven through REAL DOM keydown events on a
-// contentEditable.
-//
-// Regression repro for #39630: pressing Enter right after typing (fast typing /
-// IME) did nothing. The composer state (`draft` from useAuiState) and its
-// derived `hasComposerPayload` lag the DOM by a render, so the keydown handler
-// read empty state and either dropped the message, drained a queued prompt
-// instead of sending, or (while busy) refused to queue. The fix reads the live
-// editor text — `hasLivePayload` in the handler and a DOM re-sync at the top of
-// submitDraft — so the just-typed text always wins.
-//
-// We model the race deterministically the way the IME repro does: mutate the
-// editor's textContent WITHOUT firing an input event, so the React `draft`
-// state stays stale while the DOM already holds the text.
-function Harness({
-  busy = false,
-  queued = [],
-  onSubmit,
-  onQueue,
-  onCancel,
-  onDrain
-}: {
-  busy?: boolean
-  queued?: readonly string[]
-  onSubmit: (text: string) => void
-  onQueue: (text: string) => void
-  onCancel: () => void
-  onDrain: () => void
-}) {
-  const editorRef = useRef<HTMLDivElement>(null)
-  const draftRef = useRef('')
-  // Mirrors `useAuiState(s => s.composer.text)` — updated only via setText, so
-  // it lags the DOM until React re-renders (the source of the bug).
-  const [draft, setDraft] = useState('')
-  const attachments: unknown[] = []
-
-  const composerPlainText = (el: HTMLElement) => el.textContent ?? ''
-
-  const setText = (next: string) => {
-    draftRef.current = next
-    setDraft(next)
-  }
-
-  const submitDraft = () => {
-    const editor = editorRef.current
-    if (editor) {
-      const domText = composerPlainText(editor)
-      if (domText !== draftRef.current) {
-        draftRef.current = domText
-        setDraft(domText)
-      }
-    }
-
-    const text = draftRef.current
-    const payloadPresent = text.trim().length > 0 || attachments.length > 0
-
-    if (busy) {
-      if (payloadPresent) {
-        onQueue(text)
-      } else {
-        onCancel()
-      }
-    } else if (!payloadPresent && queued.length > 0) {
-      onDrain()
-    } else if (payloadPresent) {
-      onSubmit(text)
-    }
-  }
-
-  const handleKeyDown = (event: React.KeyboardEvent<HTMLDivElement>) => {
-    if (event.key === 'Enter' && !event.shiftKey) {
-      event.preventDefault()
-
-      const editorText = editorRef.current ? composerPlainText(editorRef.current) : draftRef.current
-      const hasLivePayload = editorText.trim().length > 0 || attachments.length > 0
-
-      if (!busy && !hasLivePayload && queued.length > 0) {
-        onDrain()
-
-        return
-      }
-
-      if (busy && !hasLivePayload) {
-        return
-      }
-
-      submitDraft()
-    }
-  }
-
-  // `draft` is read so the lint/compiler treats the stale-state mirror as live;
-  // the assertions prove the handler never relies on it.
-  void draft
-
-  return (
-    <div
-      contentEditable
-      data-testid="editor"
-      onInput={event => setText(composerPlainText(event.currentTarget))}
-      onKeyDown={handleKeyDown}
-      ref={editorRef}
-      suppressContentEditableWarning
-    />
-  )
-}
-
-describe('composer Enter submit — live DOM vs stale composer state (#39630)', () => {
-  it('sends the just-typed text on Enter even when composer state has not synced', async () => {
-    const onSubmit = vi.fn()
-    const { getByTestId } = render(
-      <Harness onCancel={vi.fn()} onDrain={vi.fn()} onQueue={vi.fn()} onSubmit={onSubmit} />
-    )
-    const editor = getByTestId('editor')
-
-    // Fast typing: the DOM has the text but NO input event fired, so `draft`
-    // state is still empty (the exact stale-state race).
-    await act(async () => {
-      editor.textContent = 'hello world'
-      fireEvent.keyDown(editor, { key: 'Enter' })
-    })
-
-    expect(onSubmit).toHaveBeenCalledWith('hello world')
-  })
-
-  it('queues a fast-typed message while busy instead of draining the queue or cancelling', async () => {
-    const onQueue = vi.fn()
-    const onDrain = vi.fn()
-    const onCancel = vi.fn()
-    const { getByTestId } = render(
-      <Harness busy onCancel={onCancel} onDrain={onDrain} onQueue={onQueue} onSubmit={vi.fn()} queued={['queued-1']} />
-    )
-    const editor = getByTestId('editor')
-
-    await act(async () => {
-      editor.textContent = 'urgent follow-up'
-      fireEvent.keyDown(editor, { key: 'Enter' })
-    })
-
-    expect(onQueue).toHaveBeenCalledWith('urgent follow-up')
-    expect(onDrain).not.toHaveBeenCalled()
-    expect(onCancel).not.toHaveBeenCalled()
-  })
-
-  it('treats an empty Enter while busy as a no-op (never an accidental Stop)', async () => {
-    const onCancel = vi.fn()
-    const onSubmit = vi.fn()
-    const onQueue = vi.fn()
-    const { getByTestId } = render(
-      <Harness busy onCancel={onCancel} onDrain={vi.fn()} onQueue={onQueue} onSubmit={onSubmit} />
-    )
-    const editor = getByTestId('editor')
-
-    await act(async () => {
-      editor.textContent = ''
-      fireEvent.keyDown(editor, { key: 'Enter' })
-    })
-
-    expect(onCancel).not.toHaveBeenCalled()
-    expect(onSubmit).not.toHaveBeenCalled()
-    expect(onQueue).not.toHaveBeenCalled()
-  })
-
-  it('drains the next queued prompt on Enter when idle with a truly empty editor', async () => {
-    const onDrain = vi.fn()
-    const onSubmit = vi.fn()
-    const { getByTestId } = render(
-      <Harness onCancel={vi.fn()} onDrain={onDrain} onQueue={vi.fn()} onSubmit={onSubmit} queued={['queued-1']} />
-    )
-    const editor = getByTestId('editor')
-
-    await act(async () => {
-      editor.textContent = ''
-      fireEvent.keyDown(editor, { key: 'Enter' })
-    })
-
-    expect(onDrain).toHaveBeenCalledTimes(1)
-    expect(onSubmit).not.toHaveBeenCalled()
-  })
-})

apps/desktop/src/app/chat/composer/help-hint.tsx

@@ -5,7 +5,7 @@ import { useI18n } from '@/i18n'
 import { COMPLETION_DRAWER_CLASS } from './completion-drawer'
 
 const COMMON_COMMAND_KEYS = ['/help', '/clear', '/resume', '/details', '/copy', '/quit']
-const HOTKEY_KEYS = ['@', '/', '?', 'Enter', 'Cmd/Ctrl+Shift+K', 'Cmd/Ctrl+/', 'Esc', '↑ / ↓']
+const HOTKEY_KEYS = ['@', '/', '?', 'Enter', 'Cmd/Ctrl+K', 'Cmd/Ctrl+L', 'Esc', '↑ / ↓']
 
 export function HelpHint() {
   const { t } = useI18n()

apps/desktop/src/app/chat/composer/index.tsx

@@ -43,7 +43,7 @@ import {
 import { $gatewayState, $messages } from '@/store/session'
 import { $threadScrolledUp } from '@/store/thread-scroll'
 
-import { extractDroppedFiles, HERMES_PATHS_MIME, partitionDroppedFiles } from '../hooks/use-composer-actions'
+import { extractDroppedFiles, HERMES_PATHS_MIME } from '../hooks/use-composer-actions'
 
 import { AttachmentList } from './attachments'
 import { ContextMenu } from './context-menu'
@@ -64,7 +64,7 @@ import { useVoiceConversation } from './hooks/use-voice-conversation'
 import { useVoiceRecorder } from './hooks/use-voice-recorder'
 import {
   dragHasAttachments,
-  droppedFileInlineRefs,
+  droppedFileInlineRef,
   type InlineRefInput,
   insertInlineRefsIntoEditor
 } from './inline-refs'
@@ -814,16 +814,7 @@ export function ChatBar({
     if (event.key === 'Enter' && !event.shiftKey) {
       event.preventDefault()
 
-      // Decide from the DOM, not React state. `hasComposerPayload` is derived
-      // from the AUI composer state, which lags the latest keystroke by a
-      // render, so on fast typing / IME the just-typed text isn't in state yet.
-      // Without the live read, a real message typed while prompts are queued
-      // would drain the queue instead of sending. submitDraft() re-syncs and
-      // sends the live editor text.
-      const editorText = editorRef.current ? composerPlainText(editorRef.current) : draftRef.current
-      const hasLivePayload = editorText.trim().length > 0 || attachments.length > 0
-
-      if (!busy && !hasLivePayload && queuedPrompts.length > 0) {
+      if (!busy && !hasComposerPayload && queuedPrompts.length > 0) {
         void drainNextQueued()
 
         return
@@ -831,10 +822,7 @@ export function ChatBar({
 
       // Empty Enter while busy is a no-op — interrupting is explicit (Stop/Esc),
       // never a stray Enter after sending. With a payload, submitDraft queues it.
-      // Gate on the live DOM payload (not the render-lagged composer state) so a
-      // message typed fast / via IME while busy still reaches submitDraft() and
-      // gets queued instead of being mistaken for an empty Enter.
-      if (busy && !hasLivePayload) {
+      if (busy && !hasComposerPayload) {
         return
       }
 
@@ -931,25 +919,24 @@ export function ChatBar({
       return
     }
 
-    // In-app drags (project tree / gutter) are workspace-relative paths the
-    // gateway resolves directly, so they stay inline @file:/@line: refs. OS
-    // drops are absolute local paths a remote gateway can't read (and images
-    // need byte upload for vision), so route them through the upload pipeline.
-    const { inAppRefs, osDrops } = partitionDroppedFiles(candidates)
-    const refs = droppedFileInlineRefs(inAppRefs, cwd)
+    if (Array.from(event.dataTransfer.types || []).includes(HERMES_PATHS_MIME)) {
+      const refs = candidates
+        .map(candidate => droppedFileInlineRef(candidate, cwd))
+        .filter((ref): ref is string => Boolean(ref))
 
-    if (refs.length && insertInlineRefs(refs)) {
-      triggerHaptic('selection')
+      if (insertInlineRefs(refs)) {
+        triggerHaptic('selection')
+      }
+
+      return
     }
 
-    if (osDrops.length) {
-      void Promise.resolve(onAttachDroppedItems(osDrops)).then(attached => {
-        if (attached) {
-          triggerHaptic('selection')
-          requestMainFocus()
-        }
-      })
-    }
+    void Promise.resolve(onAttachDroppedItems(candidates)).then(attached => {
+      if (attached) {
+        triggerHaptic('selection')
+        requestMainFocus()
+      }
+    })
   }
 
   const handleInputDragOver = (event: ReactDragEvent<HTMLDivElement>) => {
@@ -969,7 +956,11 @@ export function ChatBar({
 
     const candidates = extractDroppedFiles(event.dataTransfer)
 
-    if (!candidates.length) {
+    const refs = candidates
+      .map(candidate => droppedFileInlineRef(candidate, cwd))
+      .filter((ref): ref is string => Boolean(ref))
+
+    if (!refs.length) {
       return
     }
 
@@ -977,27 +968,9 @@ export function ChatBar({
     event.stopPropagation()
     resetDragState()
 
-    // Dropping straight onto the text box used to inline-ref *every* file —
-    // including OS/Finder drops, whose absolute local path a remote gateway
-    // can't read and whose image bytes never reached vision. Split by origin:
-    // in-app drags stay inline refs; OS drops go through the upload pipeline.
-    // (When no upload handler is wired, fall back to inline refs for all.)
-    const attach = onAttachDroppedItems
-    const { inAppRefs, osDrops } = partitionDroppedFiles(candidates)
-    const refs = droppedFileInlineRefs(attach ? inAppRefs : candidates, cwd)
-
-    if (refs.length && insertInlineRefs(refs)) {
+    if (insertInlineRefs(refs)) {
       triggerHaptic('selection')
     }
-
-    if (attach && osDrops.length) {
-      void Promise.resolve(attach(osDrops)).then(attached => {
-        if (attached) {
-          triggerHaptic('selection')
-          requestMainFocus()
-        }
-      })
-    }
   }
 
   const clearDraft = useCallback(() => {
@@ -1239,26 +1212,6 @@ export function ChatBar({
   }, [activeQueueSessionKey, editingQueuedPrompt, queueEdit]) // eslint-disable-line react-hooks/exhaustive-deps
 
   const submitDraft = () => {
-    // Source the text from the DOM editor, not React state. The AUI composer
-    // state (`draft`) and the derived `hasComposerPayload` lag the DOM by a
-    // render, so on fast typing or IME composition the final keystroke(s) may
-    // not have synced yet — reading state here drops the message (Enter looks
-    // like it does nothing; typing a trailing space only "fixes" it because the
-    // extra input event forces a state sync). draftRef is updated on every
-    // input event; refresh it from the editor once more to also cover an
-    // in-flight keystroke that hasn't fired its input event yet.
-    const editor = editorRef.current
-    if (editor) {
-      const domText = composerPlainText(editor)
-      if (domText !== draftRef.current) {
-        draftRef.current = domText
-        aui.composer().setText(domText)
-      }
-    }
-
-    const text = draftRef.current
-    const payloadPresent = text.trim().length > 0 || attachments.length > 0
-
     if (queueEdit) {
       exitQueuedEdit('save')
     } else if (busy) {
@@ -1269,12 +1222,12 @@ export function ChatBar({
       // busy guard for commands that genuinely need an idle session (skill
       // /send directives).  Queuing them would make every slash command wait
       // for the current turn to finish, which is how the TUI never behaves.
-      if (!attachments.length && SLASH_COMMAND_RE.test(text.trim())) {
-        const submitted = text
+      if (!attachments.length && SLASH_COMMAND_RE.test(draft.trim())) {
+        const submitted = draft
         triggerHaptic('submit')
         clearDraft()
         void onSubmit(submitted)
-      } else if (payloadPresent) {
+      } else if (hasComposerPayload) {
         queueCurrentDraft()
       } else {
         // Stop button (the only way to reach here while busy with an empty
@@ -1282,10 +1235,10 @@ export function ChatBar({
         triggerHaptic('cancel')
         void Promise.resolve(onCancel())
       }
-    } else if (!payloadPresent && queuedPrompts.length > 0) {
+    } else if (!hasComposerPayload && queuedPrompts.length > 0) {
       void drainNextQueued()
-    } else if (payloadPresent) {
-      const submitted = text
+    } else if (draft.trim() || attachments.length > 0) {
+      const submitted = draft
       triggerHaptic('submit')
       resetBrowseState(sessionId)
       clearDraft()
@@ -1543,10 +1496,11 @@ export function ChatBar({
           <div className="relative w-full rounded-[inherit]">
             <div
               className={cn(
-                'relative z-4 isolate rounded-[inherit] border border-[color-mix(in_srgb,var(--dt-composer-ring)_calc(18%*var(--composer-ring-strength)),var(--dt-input))] transition-[border-color] duration-200 ease-out',
+                'relative z-4 isolate rounded-[inherit] border border-[color-mix(in_srgb,var(--dt-composer-ring)_calc(18%*var(--composer-ring-strength)),var(--dt-input))] shadow-composer transition-[border-color,box-shadow] duration-200 ease-out',
                 COMPOSER_DROP_FADE_CLASS,
-                'group-focus-within/composer:border-[color-mix(in_srgb,var(--dt-composer-ring)_calc(45%*var(--composer-ring-strength)),transparent)]',
+                'group-focus-within/composer:border-[color-mix(in_srgb,var(--dt-composer-ring)_calc(45%*var(--composer-ring-strength)),transparent)] group-focus-within/composer:shadow-composer-focus',
                 'group-has-data-[state=open]/composer:border-t-transparent',
+                'group-has-data-[state=open]/composer:shadow-[0_0.0625rem_0_0.0625rem_color-mix(in_srgb,var(--dt-composer-ring)_calc(35%*var(--composer-ring-strength)),transparent),0_0.5rem_1.5rem_color-mix(in_srgb,var(--shadow-ink)_6%,transparent)]',
                 dragActive && COMPOSER_DROP_ACTIVE_CLASS
               )}
               data-slot="composer-surface"
@@ -1639,7 +1593,7 @@ export function ChatBarFallback() {
       )}
       data-slot="composer-root"
     >
-      <div className="composer-fallback-surface relative isolate h-(--composer-fallback-height) w-full rounded-[inherit] border border-[color-mix(in_srgb,var(--dt-composer-ring)_calc(18%*var(--composer-ring-strength)),var(--dt-input))]">
+      <div className="composer-fallback-surface relative isolate h-(--composer-fallback-height) w-full rounded-[inherit] border border-[color-mix(in_srgb,var(--dt-composer-ring)_calc(18%*var(--composer-ring-strength)),var(--dt-input))] shadow-composer">
         <div
           aria-hidden
           className={cn(

apps/desktop/src/app/chat/composer/inline-refs.ts

@@ -83,12 +83,6 @@ export function droppedFileInlineRef(candidate: DroppedFile, cwd: string | null
   return `@${kind}:${formatRefValue(rel)}`
 }
 
-/** Resolve a batch of drops to their inline `@file:`/`@line:`/`@folder:` refs,
- * dropping any that carry no path. */
-export function droppedFileInlineRefs(candidates: DroppedFile[], cwd: string | null | undefined): string[] {
-  return candidates.map(candidate => droppedFileInlineRef(candidate, cwd)).filter((ref): ref is string => Boolean(ref))
-}
-
 export function insertInlineRefsIntoEditor(editor: HTMLDivElement, refs: readonly InlineRefInput[]) {
   if (!refs.length) {
     return null

apps/desktop/src/app/chat/composer/queue-panel.tsx

@@ -30,13 +30,13 @@ export function QueuePanel({ busy, editingId, entries, onDelete, onEdit, onSendN
   }
 
   return (
-    <div className="rounded-t-2xl border border-b-0 border-border/65 bg-[color-mix(in_srgb,var(--dt-card)_70%,transparent)] pt-0.5 pb-1 mx-1">
+    <div className="rounded-t-2xl border border-b-0 border-border/65 bg-[color-mix(in_srgb,var(--dt-card)_70%,transparent)] pt-0.5 pb-1">
       <button
-        className="flex w-full items-center gap-1.5 px-2 text-left text-[0.6rem] font-medium text-muted-foreground/92 transition-colors hover:text-foreground/90"
+        className="flex w-full items-center gap-1.5 px-2 py-0.5 text-left text-[0.72rem] font-medium text-muted-foreground/92 transition-colors hover:text-foreground/90"
         onClick={() => setCollapsed(open => !open)}
         type="button"
       >
-        <DisclosureCaret className="shrink-0" open={!collapsed} size="1em" />
+        <DisclosureCaret className="shrink-0" open={!collapsed} size="0.875rem" />
         <span className="truncate">{c.queued(entries.length)}</span>
       </button>
 
@@ -64,7 +64,11 @@ export function QueuePanel({ busy, editingId, entries, onDelete, onEdit, onSendN
                   <p className="truncate text-[0.73rem] leading-4 text-foreground/92">{entryPreview(entry, c)}</p>
                   {(attachmentsCount > 0 || isEditing) && (
                     <div className="mt-0.5 flex items-center gap-1.5 text-[0.64rem] text-muted-foreground/75">
-                      {attachmentsCount > 0 && <span>{c.attachments(attachmentsCount)}</span>}
+                      {attachmentsCount > 0 && (
+                        <span>
+                          {c.attachments(attachmentsCount)}
+                        </span>
+                      )}
                       {isEditing && (
                         <span className="text-[color-mix(in_srgb,var(--dt-composer-ring)_78%,var(--muted-foreground))]">
                           {c.editingInComposer}

apps/desktop/src/app/chat/composer/url-dialog.tsx

@@ -38,9 +38,17 @@ export function UrlDialog({
   return (
     <Dialog onOpenChange={onOpenChange} open={open}>
       <DialogContent className="max-w-md gap-5">
-        <DialogHeader>
-          <DialogTitle icon={Globe}>{c.attachUrlTitle}</DialogTitle>
-          <DialogDescription>{c.attachUrlDesc}</DialogDescription>
+        <DialogHeader className="flex-row items-center gap-3 sm:items-center">
+          <span
+            aria-hidden
+            className="grid size-9 shrink-0 place-items-center rounded-xl bg-[color-mix(in_srgb,var(--dt-primary)_14%,transparent)] text-primary ring-1 ring-inset ring-primary/15"
+          >
+            <Globe className="size-4" />
+          </span>
+          <div className="grid gap-0.5 text-left">
+            <DialogTitle>{c.attachUrlTitle}</DialogTitle>
+            <DialogDescription>{c.attachUrlDesc}</DialogDescription>
+          </div>
         </DialogHeader>
         <form
           className="grid gap-4"

apps/desktop/src/app/chat/hooks/use-composer-actions.test.ts

@@ -1,57 +0,0 @@
-import { describe, expect, it } from 'vitest'
-
-import { type DroppedFile, partitionDroppedFiles } from './use-composer-actions'
-
-// A Finder/Explorer drop carries a native File handle; an in-app drag (project
-// tree, gutter line ref) is path-only. The split decides whether a drop becomes
-// an inline @file: ref (in-app, workspace-relative, gateway-resolvable) or goes
-// through the upload pipeline (OS drop — absolute local path a remote gateway
-// can't read, plus image bytes for vision).
-const osDrop = (path: string): DroppedFile => ({ file: new File(['x'], path.split('/').pop() || 'f'), path })
-const inAppRef = (path: string, extra: Partial<DroppedFile> = {}): DroppedFile => ({ path, ...extra })
-
-describe('partitionDroppedFiles', () => {
-  it('routes File-bearing OS drops to osDrops and path-only in-app drags to inAppRefs', () => {
-    const finderPdf = osDrop('/Users/mahmoud/Downloads/DEVIS_signed.pdf')
-    const projectFile = inAppRef('src/index.ts')
-
-    const { inAppRefs, osDrops } = partitionDroppedFiles([finderPdf, projectFile])
-
-    expect(osDrops).toEqual([finderPdf])
-    expect(inAppRefs).toEqual([projectFile])
-  })
-
-  it('treats an OS screenshot drop as an upload target (so it gets byte upload + vision)', () => {
-    const screenshot = osDrop('/var/folders/tmp/Screenshot 2026-06-09.png')
-
-    const { inAppRefs, osDrops } = partitionDroppedFiles([screenshot])
-
-    expect(osDrops).toEqual([screenshot])
-    expect(inAppRefs).toEqual([])
-  })
-
-  it('keeps gutter line-range drags inline (no File handle)', () => {
-    const lineRef = inAppRef('src/app.ts', { line: 10, lineEnd: 20 })
-
-    const { inAppRefs, osDrops } = partitionDroppedFiles([lineRef])
-
-    expect(osDrops).toEqual([])
-    expect(inAppRefs).toEqual([lineRef])
-  })
-
-  it('splits a mixed drop and preserves order within each group', () => {
-    const a = inAppRef('a.ts')
-    const b = osDrop('/abs/b.pdf')
-    const c = inAppRef('c.ts')
-    const d = osDrop('/abs/d.png')
-
-    const { inAppRefs, osDrops } = partitionDroppedFiles([a, b, c, d])
-
-    expect(inAppRefs).toEqual([a, c])
-    expect(osDrops).toEqual([b, d])
-  })
-
-  it('returns empty groups for an empty drop', () => {
-    expect(partitionDroppedFiles([])).toEqual({ inAppRefs: [], osDrops: [] })
-  })
-})

apps/desktop/src/app/chat/hooks/use-composer-actions.ts

@@ -33,7 +33,7 @@ function blobExtension(blob: Blob): string {
   return (mime && BLOB_MIME_EXTENSION[mime]) || '.png'
 }
 
-export function isImagePath(filePath: string): boolean {
+function isImagePath(filePath: string): boolean {
   return IMAGE_EXTENSION_PATTERN.test(filePath)
 }
 
@@ -181,35 +181,6 @@ export function extractDroppedFiles(transfer: DataTransfer): DroppedFile[] {
   return result
 }
 
-/**
- * Split dropped entries by origin. OS/Finder drops carry a native `File`
- * handle; in-app drags (project tree, gutter line refs) are path-only.
- *
- * The distinction is load-bearing: an in-app path is workspace-relative and
- * resolves on the gateway as-is, so it stays an inline `@file:`/`@line:` ref.
- * An OS drop is an absolute path on *this* machine — the gateway can't read it
- * in remote mode, and an image needs its bytes uploaded to get vision either
- * way. So OS drops must go through the attachment/upload pipeline rather than
- * leaking a local path into the prompt text.
- */
-export function partitionDroppedFiles(candidates: DroppedFile[]): {
-  osDrops: DroppedFile[]
-  inAppRefs: DroppedFile[]
-} {
-  const osDrops: DroppedFile[] = []
-  const inAppRefs: DroppedFile[] = []
-
-  for (const candidate of candidates) {
-    if (candidate.file) {
-      osDrops.push(candidate)
-    } else {
-      inAppRefs.push(candidate)
-    }
-  }
-
-  return { osDrops, inAppRefs }
-}
-
 interface ComposerActionsOptions {
   activeSessionId: string | null
   currentCwd: string

apps/desktop/src/app/chat/index.tsx

@@ -49,9 +49,9 @@ import { ChatDropOverlay } from './chat-drop-overlay'
 import { ChatSwapOverlay } from './chat-swap-overlay'
 import { ChatBar, ChatBarFallback } from './composer'
 import { requestComposerInsert, requestComposerInsertRefs } from './composer/focus'
-import { droppedFileInlineRefs, type SessionDragPayload, sessionInlineRef } from './composer/inline-refs'
+import { droppedFileInlineRef, type SessionDragPayload, sessionInlineRef } from './composer/inline-refs'
 import type { ChatBarState } from './composer/types'
-import { type DroppedFile, partitionDroppedFiles } from './hooks/use-composer-actions'
+import type { DroppedFile } from './hooks/use-composer-actions'
 import { useFileDropZone } from './hooks/use-file-drop-zone'
 import { SessionActionsMenu } from './sidebar/session-actions-menu'
 import { lastVisibleMessageIsUser, threadLoadingState } from './thread-loading'
@@ -124,13 +124,7 @@ function ChatHeader({
 
   return (
     <header className={cn(titlebarHeaderBaseClass, isRoutedSessionView && titlebarHeaderShadowClass)}>
-      <div
-        className="min-w-0 flex-1"
-        style={{
-          maxWidth:
-            'calc(100vw - var(--titlebar-content-inset,0px) - var(--titlebar-tools-right) - var(--titlebar-tools-width) - 1.5rem)'
-        }}
-      >
+      <div className="min-w-0 flex-1">
         <SessionActionsMenu
           align="start"
           onDelete={selectedSessionId ? onDeleteSelectedSession : undefined}
@@ -141,11 +135,11 @@ function ChatHeader({
           title={title}
         >
           <Button
-            className="pointer-events-auto flex h-6 min-w-0 max-w-full gap-1 border border-transparent bg-transparent px-2 py-0 text-(--ui-text-secondary) hover:border-(--ui-stroke-tertiary) hover:bg-(--ui-control-hover-background) hover:text-foreground data-[state=open]:border-(--ui-stroke-tertiary) data-[state=open]:bg-(--ui-control-active-background) [-webkit-app-region:no-drag]"
+            className="pointer-events-auto h-6 min-w-0 gap-1 border border-transparent bg-transparent px-2 py-0 text-(--ui-text-secondary) hover:border-(--ui-stroke-tertiary) hover:bg-(--ui-control-hover-background) hover:text-foreground data-[state=open]:border-(--ui-stroke-tertiary) data-[state=open]:bg-(--ui-control-active-background) [-webkit-app-region:no-drag]"
             type="button"
             variant="ghost"
           >
-            <h2 className="min-w-0 flex-1 truncate text-[0.75rem] font-medium leading-none">{title}</h2>
+            <h2 className="max-w-[52vw] truncate text-[0.75rem] font-medium leading-none">{title}</h2>
             <Codicon className="shrink-0 text-(--ui-text-tertiary)" name="chevron-down" size="0.8125rem" />
           </Button>
         </SessionActionsMenu>
@@ -302,25 +296,19 @@ export function ChatView({
   })
 
   // Drop files anywhere in the conversation area, not just on the composer
-  // input. In-app drags (project tree / gutter) carry workspace-relative paths
-  // the gateway resolves directly, so they stay inline `@file:` refs. OS/Finder
-  // drops carry absolute local paths that don't exist on a remote gateway (and
-  // images need byte upload for vision), so route them through the attachment
-  // pipeline — otherwise the local path leaks into the prompt verbatim.
+  // input — appending the same inline `@file:` ref chips the composer drop
+  // produces (vs. attachment cards) so both surfaces behave identically.
   const onDropFiles = useCallback(
     (candidates: DroppedFile[]) => {
-      const { inAppRefs, osDrops } = partitionDroppedFiles(candidates)
-      const refs = droppedFileInlineRefs(inAppRefs, currentCwd)
+      const refs = candidates
+        .map(candidate => droppedFileInlineRef(candidate, currentCwd))
+        .filter((ref): ref is string => Boolean(ref))
 
       if (refs.length) {
         requestComposerInsert(refs.join(' '), { mode: 'inline', target: 'main' })
       }
-
-      if (osDrops.length) {
-        void onAttachDroppedItems(osDrops)
-      }
     },
-    [currentCwd, onAttachDroppedItems]
+    [currentCwd]
   )
 
   // Dropping a sidebar session inserts an @session link the agent can resolve

apps/desktop/src/app/chat/right-rail/preview-file.tsx

@@ -446,9 +446,7 @@ export function LocalFilePreview({ reloadKey, target }: { reloadKey: number; tar
 
       try {
         if (isImage) {
-          // Prefer bytes the caller already handed us (a pasted/dropped
-          // screenshot) over re-reading a path that may be transient/unreadable.
-          const dataUrl = target.dataUrl || (await window.hermesDesktop.readFileDataUrl(filePath))
+          const dataUrl = await window.hermesDesktop.readFileDataUrl(filePath)
 
           if (active) {
             setState({ dataUrl, loading: false })
@@ -486,7 +484,7 @@ export function LocalFilePreview({ reloadKey, target }: { reloadKey: number; tar
     return () => {
       active = false
     }
-  }, [blockedByTarget, filePath, forcePreview, isImage, isText, reloadKey, target.dataUrl, target.language])
+  }, [blockedByTarget, filePath, forcePreview, isImage, isText, reloadKey, target.language])
 
   if (state.loading) {
     return <PageLoader label={t.preview.loading} />

apps/desktop/src/app/chat/sidebar/cron-jobs-section.tsx

@@ -1,356 +0,0 @@
-import { useStore } from '@nanostores/react'
-import { useEffect, useMemo, useState } from 'react'
-
-import { Codicon } from '@/components/ui/codicon'
-import { DisclosureCaret } from '@/components/ui/disclosure-caret'
-import { SidebarGroup, SidebarGroupContent } from '@/components/ui/sidebar'
-import { Tip } from '@/components/ui/tooltip'
-import { getCronJobRuns, type SessionInfo } from '@/hermes'
-import { useI18n } from '@/i18n'
-import { cn } from '@/lib/utils'
-import { $selectedStoredSessionId } from '@/store/session'
-import type { CronJob } from '@/types/hermes'
-
-import { jobState, jobTitle, STATE_DOT } from '../../cron/job-state'
-import { SidebarPanelLabel } from '../../shell/sidebar-label'
-
-import { SidebarLoadMoreRow } from './load-more-row'
-
-const INACTIVE_STATES = new Set(['completed', 'disabled', 'error', 'paused'])
-
-// Recent runs shown in the inline quick-peek — enough to glance at history
-// without turning the sidebar into the full Cron page.
-const PEEK_RUN_LIMIT = 5
-
-// Runs are written by the background scheduler tick (no UI signal), so poll the
-// open peek so a freshly-fired run shows up within a few seconds.
-const PEEK_POLL_INTERVAL_MS = 8000
-
-// Keep the section compact: show a few jobs up front, reveal more in larger
-// steps on demand (mirrors the messaging sections in the sidebar).
-const INITIAL_VISIBLE_JOBS = 3
-const LOAD_MORE_STEP = 10
-
-const relativeFmt = new Intl.RelativeTimeFormat(undefined, { numeric: 'auto', style: 'short' })
-
-// Localized "in 5 min" / "2 hr ago" without hand-rolled strings — picks the
-// coarsest sensible unit so a daily job reads "in 14 hr", not "in 840 min".
-function relativeTime(targetMs: number, nowMs: number): string {
-  const diff = targetMs - nowMs
-  const abs = Math.abs(diff)
-  const sign = diff < 0 ? -1 : 1
-
-  if (abs < 60_000) {
-    return relativeFmt.format(sign * Math.round(abs / 1000), 'second')
-  }
-
-  if (abs < 3_600_000) {
-    return relativeFmt.format(sign * Math.round(abs / 60_000), 'minute')
-  }
-
-  if (abs < 86_400_000) {
-    return relativeFmt.format(sign * Math.round(abs / 3_600_000), 'hour')
-  }
-
-  return relativeFmt.format(sign * Math.round(abs / 86_400_000), 'day')
-}
-
-function nextRunMs(job: CronJob): null | number {
-  if (!job.next_run_at) {
-    return null
-  }
-
-  const ms = Date.parse(job.next_run_at)
-
-  return Number.isNaN(ms) ? null : ms
-}
-
-// Runs all belong to the same job, so the run name just repeats the job name —
-// the timestamp is what tells them apart. Compact (no year, no seconds) for the
-// narrow sidebar.
-function formatRunTime(seconds?: null | number): string {
-  if (!seconds) {
-    return '—'
-  }
-
-  const date = new Date(seconds * 1000)
-
-  return Number.isNaN(date.valueOf())
-    ? '—'
-    : date.toLocaleString(undefined, { day: 'numeric', hour: 'numeric', minute: '2-digit', month: 'short' })
-}
-
-interface SidebarCronJobsSectionProps {
-  jobs: CronJob[]
-  label: string
-  max?: number
-  // Open a run session's chat (1 click to output).
-  onOpenRun: (sessionId: string) => void
-  // Open the full Cron page focused on this job (manage / full history).
-  onManageJob: (jobId: string) => void
-  // Fire the job now.
-  onTriggerJob: (jobId: string) => void
-  onToggle: () => void
-  open: boolean
-}
-
-export function SidebarCronJobsSection({
-  jobs,
-  label,
-  max = 50,
-  onManageJob,
-  onOpenRun,
-  onTriggerJob,
-  onToggle,
-  open
-}: SidebarCronJobsSectionProps) {
-  const [nowMs, setNowMs] = useState(() => Date.now())
-  // Single-open inline peek so the section stays scannable.
-  const [peekJobId, setPeekJobId] = useState<null | string>(null)
-  // Rows revealed so far; starts compact, grows in steps via "load more".
-  const [visibleCount, setVisibleCount] = useState(INITIAL_VISIBLE_JOBS)
-
-  // One clock for the whole section (rows are pure) so the countdowns tick
-  // without re-rendering the rest of the sidebar. Only runs while expanded.
-  useEffect(() => {
-    if (!open) {
-      return
-    }
-
-    const id = window.setInterval(() => setNowMs(Date.now()), 1000)
-
-    return () => window.clearInterval(id)
-  }, [open])
-
-  // Upcoming first (soonest next run), jobs with no next run sink to the bottom,
-  // then alphabetical for stability.
-  const sorted = useMemo(() => {
-    return [...jobs].sort((a, b) => {
-      const an = nextRunMs(a)
-      const bn = nextRunMs(b)
-
-      if (an !== null && bn !== null && an !== bn) {
-        return an - bn
-      }
-
-      if (an === null && bn !== null) {
-        return 1
-      }
-
-      if (an !== null && bn === null) {
-        return -1
-      }
-
-      return jobTitle(a).localeCompare(jobTitle(b))
-    })
-  }, [jobs])
-
-  const cap = Math.min(visibleCount, max)
-  const shown = sorted.slice(0, cap)
-  const hiddenCount = Math.min(sorted.length, max) - shown.length
-  // When capped, signal "50+" rather than implying the list is complete.
-  const countLabel = jobs.length > max ? `${max}+` : String(jobs.length)
-
-  return (
-    <SidebarGroup className="shrink-0 p-0 pb-1">
-      <div className="group/section flex shrink-0 items-center justify-between pb-1 pt-1.5">
-        <button
-          className="group/section-label flex w-fit items-center gap-1 bg-transparent text-left leading-none"
-          onClick={onToggle}
-          type="button"
-        >
-          <SidebarPanelLabel>{label}</SidebarPanelLabel>
-          <span className="text-[0.6875rem] font-medium text-(--ui-text-quaternary)">{countLabel}</span>
-          <DisclosureCaret
-            className="text-(--ui-text-tertiary) opacity-0 transition group-hover/section-label:opacity-100"
-            open={open}
-          />
-        </button>
-      </div>
-      {open && (
-        <SidebarGroupContent className="flex max-h-72 flex-col gap-px overflow-y-auto overscroll-contain pb-1.75 compact:max-h-none compact:overflow-visible">
-          {shown.map(job => (
-            <CronJobSidebarRow
-              expanded={peekJobId === job.id}
-              job={job}
-              key={job.id}
-              nowMs={nowMs}
-              onManage={() => onManageJob(job.id)}
-              onOpenRun={onOpenRun}
-              onTogglePeek={() => setPeekJobId(prev => (prev === job.id ? null : job.id))}
-              onTrigger={() => onTriggerJob(job.id)}
-            />
-          ))}
-          {hiddenCount > 0 && (
-            <SidebarLoadMoreRow
-              onClick={() => setVisibleCount(count => count + LOAD_MORE_STEP)}
-              step={Math.min(LOAD_MORE_STEP, hiddenCount)}
-            />
-          )}
-        </SidebarGroupContent>
-      )}
-    </SidebarGroup>
-  )
-}
-
-function CronJobSidebarRow({
-  expanded,
-  job,
-  nowMs,
-  onManage,
-  onOpenRun,
-  onTogglePeek,
-  onTrigger
-}: {
-  expanded: boolean
-  job: CronJob
-  nowMs: number
-  onManage: () => void
-  onOpenRun: (sessionId: string) => void
-  onTogglePeek: () => void
-  onTrigger: () => void
-}) {
-  const { t } = useI18n()
-  const c = t.cron
-  const state = jobState(job)
-  const next = nextRunMs(job)
-  const label = jobTitle(job)
-
-  const meta = INACTIVE_STATES.has(state) ? (c.states[state] ?? state) : next !== null ? relativeTime(next, nowMs) : '—'
-
-  return (
-    <div>
-      <div className="group/cron relative grid min-h-[1.625rem] grid-cols-[minmax(0,1fr)_auto] items-center rounded-md hover:bg-(--chrome-action-hover)">
-        {/* Lead with the dot in the same w-3.5 cell + pl-2 the session rows use
-            so the cron dots line up with the sessions above; the caret sits next
-            to the label (matching the other sidebar disclosures) and the whole
-            label area toggles the run peek. */}
-        <button
-          aria-expanded={expanded}
-          aria-label={expanded ? c.hideRuns : c.showRuns}
-          className="flex min-w-0 items-center gap-1.5 bg-transparent py-0.5 pl-2 pr-1 text-left focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring/40"
-          onClick={onTogglePeek}
-          title={label}
-          type="button"
-        >
-          <span className="grid w-3.5 shrink-0 place-items-center">
-            <span
-              aria-hidden="true"
-              className={cn(
-                'size-1 rounded-full',
-                STATE_DOT[state] ?? 'bg-(--ui-text-quaternary)',
-                state === 'running' && 'size-1.5 animate-pulse'
-              )}
-            />
-          </span>
-          <span className="min-w-0 truncate text-[0.8125rem] text-(--ui-text-secondary) group-hover/cron:text-foreground">
-            {label}
-          </span>
-          <DisclosureCaret
-            className={cn(
-              'shrink-0 text-(--ui-text-tertiary) transition',
-              expanded ? 'opacity-100' : 'opacity-0 group-hover/cron:opacity-100'
-            )}
-            open={expanded}
-          />
-        </button>
-        {/* Trailing cluster: countdown by default, quick actions on hover. */}
-        <div className="flex items-center gap-0.5 justify-self-end pr-1">
-          <span className="text-[0.6875rem] text-(--ui-text-tertiary) tabular-nums group-hover/cron:hidden">
-            {meta}
-          </span>
-          <div className="hidden items-center gap-0.5 group-hover/cron:flex">
-            <Tip label={c.triggerNow}>
-              <button
-                aria-label={c.triggerNow}
-                className="grid size-5 place-items-center rounded-sm text-(--ui-text-tertiary) hover:bg-(--ui-control-hover-background) hover:text-foreground"
-                onClick={onTrigger}
-                type="button"
-              >
-                <Codicon name="zap" size="0.75rem" />
-              </button>
-            </Tip>
-            <Tip label={c.manage}>
-              <button
-                aria-label={c.manage}
-                className="grid size-5 place-items-center rounded-sm text-(--ui-text-tertiary) hover:bg-(--ui-control-hover-background) hover:text-foreground"
-                onClick={onManage}
-                type="button"
-              >
-                <Codicon name="watch" size="0.75rem" />
-              </button>
-            </Tip>
-          </div>
-        </div>
-      </div>
-      {expanded && <CronJobSidebarRuns jobId={job.id} onOpenRun={onOpenRun} />}
-    </div>
-  )
-}
-
-function CronJobSidebarRuns({ jobId, onOpenRun }: { jobId: string; onOpenRun: (sessionId: string) => void }) {
-  const { t } = useI18n()
-  const c = t.cron
-  const selectedSessionId = useStore($selectedStoredSessionId)
-  const [runs, setRuns] = useState<null | SessionInfo[]>(null)
-
-  useEffect(() => {
-    let cancelled = false
-
-    const load = () =>
-      getCronJobRuns(jobId, PEEK_RUN_LIMIT)
-        .then(result => {
-          if (!cancelled) {
-            setRuns(result)
-          }
-        })
-        .catch(() => {
-          if (!cancelled) {
-            setRuns(prev => prev ?? [])
-          }
-        })
-
-    void load()
-
-    const intervalId = window.setInterval(() => {
-      if (document.visibilityState === 'visible') {
-        void load()
-      }
-    }, PEEK_POLL_INTERVAL_MS)
-
-    return () => {
-      cancelled = true
-      window.clearInterval(intervalId)
-    }
-  }, [jobId])
-
-  return (
-    <div className="mb-1 ml-[1.375rem] flex flex-col gap-px">
-      {runs === null ? (
-        <div className="flex items-center gap-1.5 py-1 pl-1 text-[0.6875rem] text-(--ui-text-tertiary)">
-          <Codicon name="loading" size="0.75rem" spinning />
-        </div>
-      ) : runs.length === 0 ? (
-        <div className="py-1 pl-1 text-[0.6875rem] text-(--ui-text-tertiary)">{c.noRuns}</div>
-      ) : (
-        <>
-          {runs.map(run => (
-            <button
-              className={cn(
-                'truncate rounded-md px-1.5 py-0.5 text-left text-[0.6875rem] tabular-nums focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring/40',
-                run.id === selectedSessionId
-                  ? 'bg-(--ui-row-active-background) text-foreground'
-                  : 'text-(--ui-text-secondary) hover:bg-(--chrome-action-hover) hover:text-foreground'
-              )}
-              key={run.id}
-              onClick={() => onOpenRun(run.id)}
-              type="button"
-            >
-              {formatRunTime(run.last_active || run.started_at)}
-            </button>
-          ))}
-        </>
-      )}
-    </div>
-  )
-}

apps/desktop/src/app/chat/sidebar/load-more-row.tsx

@@ -1,30 +0,0 @@
-import { Codicon } from '@/components/ui/codicon'
-import { useI18n } from '@/i18n'
-
-interface SidebarLoadMoreRowProps {
-  step: number
-  onClick: () => void
-  loading?: boolean
-}
-
-// "Load N more" affordance shared by the recents, messaging, and cron sections.
-// The chevron sits in the same w-3.5 column the rows use for their dot, so it
-// lines up with the list above.
-export function SidebarLoadMoreRow({ step, onClick, loading = false }: SidebarLoadMoreRowProps) {
-  const { t } = useI18n()
-  const label = loading ? t.sidebar.loading : step > 0 ? t.sidebar.loadCount(step) : t.sidebar.loadMore
-
-  return (
-    <button
-      className="flex min-h-5 items-center gap-1.5 self-start bg-transparent pl-2 text-left text-[0.6875rem] text-(--ui-text-tertiary) transition-colors duration-100 ease-out hover:text-foreground hover:transition-none disabled:cursor-default disabled:opacity-60 disabled:hover:text-(--ui-text-tertiary)"
-      disabled={loading}
-      onClick={onClick}
-      type="button"
-    >
-      <span className="grid w-3.5 shrink-0 place-items-center">
-        <Codicon className="opacity-70" name={loading ? 'loading' : 'chevron-down'} size="0.75rem" spinning={loading} />
-      </span>
-      <span>{label}</span>
-    </button>
-  )
-}

apps/desktop/src/app/chat/sidebar/profile-switcher.tsx

@@ -34,7 +34,6 @@ import { cn } from '@/lib/utils'
 import {
   $activeGatewayProfile,
   $profileColors,
-  $profileCreateRequest,
   $profileOrder,
   $profiles,
   $profileScope,
@@ -83,9 +82,8 @@ const stepThroughCells: Modifier = ({ containerNodeRect, draggingNodeRect, trans
 // Arc-Spaces-style profile rail at the sidebar foot: a default↔all toggle pinned
 // left, the colored named profiles scrolling between, and Manage pinned right.
 // The active profile pops in its own color — the "where am I" cue. Single-
-// profile users see the "+" (create their first profile) and the Manage
-// overflow (edit the default profile's SOUL.md); the colored named squares
-// and the default↔all toggle only appear once a second profile exists.
+// profile users see only the "+" (create their first profile); everything else
+// appears once a second profile exists.
 export function ProfileRail() {
   const { t } = useI18n()
   const p = t.profiles
@@ -180,20 +178,6 @@ export function ProfileRail() {
     void refreshActiveProfile()
   }, [])
 
-  // Open the create dialog when the `profile.create` hotkey fires (the dialog
-  // state lives here, so the global keybind bumps a request atom we watch).
-  const createRequest = useStore($profileCreateRequest)
-  const lastCreateRef = useRef(createRequest)
-
-  useEffect(() => {
-    if (createRequest === lastCreateRef.current) {
-      return
-    }
-
-    lastCreateRef.current = createRequest
-    setCreateOpen(true)
-  }, [createRequest])
-
   return (
     <div aria-label="Profiles" className="flex items-center gap-0.5" role="tablist">
       {/* One button toggles default ↔ all: home face when scoped to a profile,
@@ -215,12 +199,7 @@ export function ProfileRail() {
 
       {/* Single-profile: the active default's home icon next to the create +. */}
       {!multiProfile && defaultProfile && (
-        <ProfilePill
-          active
-          glyph="home"
-          label={defaultProfile.name}
-          onSelect={() => selectProfile(defaultProfile.name)}
-        />
+        <ProfilePill active glyph="home" label={defaultProfile.name} onSelect={() => selectProfile(defaultProfile.name)} />
       )}
 
       <div
@@ -269,11 +248,9 @@ export function ProfileRail() {
         </Tip>
       </div>
 
-      {/* Always reachable, even with only the default profile: the manage
-          overlay is the only place to edit a profile's SOUL.md, and a
-          single-profile user must be able to edit the default's persona
-          without first creating a throwaway second profile. */}
-      <ProfilePill active={false} glyph="ellipsis" label={p.manageProfiles} onSelect={() => navigate(PROFILES_ROUTE)} />
+      {multiProfile && (
+        <ProfilePill active={false} glyph="ellipsis" label={p.manageProfiles} onSelect={() => navigate(PROFILES_ROUTE)} />
+      )}
 
       {/* Land in the new profile on a fresh chat (selectProfile triggers the
           new-session reset), not stuck on the session you were just in. */}

apps/desktop/src/app/chat/sidebar/session-actions-menu.tsx

@@ -21,7 +21,6 @@ import { triggerHaptic } from '@/lib/haptics'
 import { exportSession } from '@/lib/session-export'
 import { notify, notifyError } from '@/store/notifications'
 import { setSessions } from '@/store/session'
-import { canOpenSessionWindow, openSessionInNewWindow } from '@/store/windows'
 
 interface SessionActions {
   sessionId: string
@@ -69,19 +68,6 @@ function useSessionActions({ sessionId, title, pinned = false, profile, onPin, o
         void writeClipboardText(sessionId).catch(err => notifyError(err, r.copyIdFailed))
       }
     },
-    ...(canOpenSessionWindow()
-      ? [
-          {
-            disabled: !sessionId,
-            icon: 'link-external',
-            label: r.newWindow,
-            onSelect: () => {
-              triggerHaptic('selection')
-              void openSessionInNewWindow(sessionId)
-            }
-          }
-        ]
-      : []),
     {
       disabled: !sessionId,
       icon: 'cloud-download',

apps/desktop/src/app/chat/sidebar/session-row.tsx

@@ -2,19 +2,14 @@ import { useStore } from '@nanostores/react'
 import type * as React from 'react'
 
 import { writeSessionDrag } from '@/app/chat/composer/inline-refs'
-import { PlatformAvatar } from '@/app/messaging/platform-icon'
 import { Button } from '@/components/ui/button'
 import { Codicon } from '@/components/ui/codicon'
-import { Tip } from '@/components/ui/tooltip'
 import type { SessionInfo } from '@/hermes'
 import { type Translations, useI18n } from '@/i18n'
 import { sessionTitle } from '@/lib/chat-runtime'
 import { triggerHaptic } from '@/lib/haptics'
-import { modKey } from '@/lib/keybinds/combo'
-import { handoffOriginSource, sessionSourceLabel } from '@/lib/session-source'
 import { cn } from '@/lib/utils'
 import { $attentionSessionIds } from '@/store/session'
-import { canOpenSessionWindow, openSessionInNewWindow } from '@/store/windows'
 
 import { SessionActionsMenu, SessionContextMenu } from './session-actions-menu'
 
@@ -72,11 +67,6 @@ export function SidebarSessionRow({
   const title = sessionTitle(session)
   const age = formatAge(session.last_active || session.started_at, r)
   const handleLabel = `Reorder ${title}`
-  // A handed-off session's live source is local, but it originated on a
-  // messaging platform — surface that origin as a small badge so e.g. a
-  // Telegram thread continued here still reads as Telegram.
-  const handoffSource = handoffOriginSource(session.handoff_state, session.handoff_platform)
-  const handoffLabel = handoffSource ? sessionSourceLabel(handoffSource) ?? handoffSource : null
   // Subscribe per-row (the leaf) instead of drilling a set through the list —
   // the atom is tiny and rarely non-empty. True when a clarify prompt in this
   // session is waiting on the user.
@@ -134,15 +124,11 @@ export function SidebarSessionRow({
               return
             }
 
-            // ⌘-click (mac) / Ctrl-click (win/linux) pops the chat into its own
-            // window — the universal "open in a new window" gesture. Archive
-            // lives in the row's ⋯ and right-click menus. Falls through to a
-            // normal resume when standalone windows aren't available (web embed).
-            if (event[modKey] && canOpenSessionWindow()) {
+            if (event.metaKey || event.ctrlKey) {
               event.preventDefault()
               event.stopPropagation()
               triggerHaptic('selection')
-              void openSessionInNewWindow(session.id)
+              onArchive()
 
               return
             }
@@ -190,18 +176,9 @@ export function SidebarSessionRow({
                 needsInput ? 'overflow-visible' : 'overflow-hidden'
               )}
             >
-              <SidebarRowDot isWorking={isWorking} needsInput={needsInput} />
-            </span>
+            <SidebarRowDot isWorking={isWorking} needsInput={needsInput} />
+          </span>
           )}
-          {handoffSource && handoffLabel ? (
-            <Tip label={r.handoffOrigin(handoffLabel)}>
-              <PlatformAvatar
-                className="size-4 rounded-[4px] text-[0.5rem] [&_svg]:size-2.5"
-                platformId={handoffSource}
-                platformName={handoffLabel}
-              />
-            </Tip>
-          ) : null}
           <span className="min-w-0 flex-1 truncate text-[0.8125rem] font-normal text-(--ui-text-secondary) group-hover:text-foreground group-data-[working=true]:text-foreground/90">
             {title}
           </span>

apps/desktop/src/app/command-palette/index.tsx

@@ -4,10 +4,7 @@ import { Dialog as DialogPrimitive } from 'radix-ui'
 import { useCallback, useEffect, useMemo, useState } from 'react'
 import { useNavigate } from 'react-router-dom'
 
-import { HUD_HEADING, HUD_ITEM, HUD_POSITION, HUD_SURFACE, HUD_TEXT } from '@/app/floating-hud'
-import { setTerminalTakeover } from '@/app/right-sidebar/store'
 import { Command, CommandEmpty, CommandGroup, CommandInput, CommandItem, CommandList } from '@/components/ui/command'
-import { KbdGroup } from '@/components/ui/kbd'
 import { getHermesConfigRecord, listSessions } from '@/hermes'
 import { useI18n } from '@/i18n'
 import { sessionTitle } from '@/lib/chat-runtime'
@@ -15,11 +12,11 @@ import {
   Activity,
   Archive,
   BarChart3,
+  Check,
   ChevronLeft,
   ChevronRight,
   Clock,
   Cpu,
-  Download,
   Globe,
   type IconComponent,
   Info,
@@ -33,18 +30,13 @@ import {
   Settings,
   Settings2,
   Sun,
-  Terminal,
   Users,
   Wrench,
   Zap
 } from '@/lib/icons'
-import { comboTokens } from '@/lib/keybinds/combo'
 import { cn } from '@/lib/utils'
 import { $commandPaletteOpen, closeCommandPalette, setCommandPaletteOpen } from '@/store/command-palette'
-import { $bindings } from '@/store/keybinds'
-import { luminance } from '@/themes/color'
 import { type ThemeMode, useTheme } from '@/themes/context'
-import { isUserTheme, resolveTheme } from '@/themes/user-themes'
 
 import {
   AGENTS_ROUTE,
@@ -62,11 +54,8 @@ import { FIELD_LABELS, SECTIONS } from '../settings/constants'
 import { fieldCopyForSchemaKey } from '../settings/field-copy'
 import { prettyName } from '../settings/helpers'
 
-import { MarketplaceThemePage } from './marketplace-theme-page'
-
 interface PaletteItem {
-  /** Keybind action id — its live combo renders as a hotkey hint. */
-  action?: string
+  active?: boolean
   icon: IconComponent
   id: string
   /** Keep the palette open after running (live-preview pickers like theme/mode). */
@@ -80,16 +69,10 @@ interface PaletteItem {
 }
 
 interface PaletteGroup {
-  /** Optional: a headingless group renders as a bare action row (e.g. the
-   *  "Install theme…" entry pinned atop the theme picker). */
-  heading?: string
+  heading: string
   items: PaletteItem[]
 }
 
-// Nested page → its parent, so Back / Esc step up one level instead of closing
-// the palette. Pages absent here go straight back to the root list.
-const PAGE_PARENTS: Record<string, string> = { 'install-theme': 'theme' }
-
 /** A nested page reachable from a root item via `to`. */
 interface PalettePage {
   groups: PaletteGroup[]
@@ -103,22 +86,6 @@ interface SessionEntry {
   title: string
 }
 
-// cmdk defaults to fuzzy subsequence scoring, so "color" matches anything with
-// c…o…l…o…r scattered across it. Use case-insensitive multi-term substring
-// matching instead: every typed word must literally appear in the item's
-// value/keywords, which keeps results tight and predictable.
-const paletteFilter = (value: string, search: string, keywords?: string[]): number => {
-  const needle = search.trim().toLowerCase()
-
-  if (!needle) {
-    return 1
-  }
-
-  const haystack = `${value} ${keywords?.join(' ') ?? ''}`.toLowerCase()
-
-  return needle.split(/\s+/).every(term => haystack.includes(term)) ? 1 : 0
-}
-
 type SessionRow = Awaited<ReturnType<typeof listSessions>>['sessions'][number]
 
 const toSessionEntry = (session: SessionRow): SessionEntry => ({
@@ -179,32 +146,11 @@ const THEME_MODES: ReadonlyArray<{ icon: IconComponent; mode: ThemeMode }> = [
   { icon: Monitor, mode: 'system' }
 ]
 
-// Which Light/Dark groups a theme belongs in. Built-ins render in both modes
-// (the engine synthesises the missing side). Imported VS Code themes only carry
-// the variant(s) the extension shipped — a single dark theme like Dracula lives
-// under Dark only, while a GitHub/Solarized family (light + dark) lives in both.
-function themeSupportsMode(name: string, target: 'light' | 'dark'): boolean {
-  if (!isUserTheme(name)) {
-    return true
-  }
-
-  const resolved = resolveTheme(name)
-
-  if (!resolved) {
-    return true
-  }
-
-  const background = target === 'dark' ? (resolved.darkColors ?? resolved.colors).background : resolved.colors.background
-
-  return target === 'dark' ? luminance(background) <= 0.5 : luminance(background) > 0.5
-}
-
 export function CommandPalette() {
   const { t } = useI18n()
   const open = useStore($commandPaletteOpen)
-  const bindings = useStore($bindings)
   const navigate = useNavigate()
-  const { availableThemes, resolvedMode, setMode, setTheme, themeName } = useTheme()
+  const { availableThemes, mode, resolvedMode, setMode, setTheme, themeName } = useTheme()
   const [search, setSearch] = useState('')
   const [page, setPage] = useState<string | null>(null)
 
@@ -248,19 +194,10 @@ export function CommandPalette() {
   }, [open])
 
   const go = useCallback((path: string) => () => navigate(path), [navigate])
-
-  // Step up one nested page (or back to the root list), clearing the filter so
-  // the parent page doesn't reopen mid-search.
-  const goBack = useCallback(() => {
-    setSearch('')
-    setPage(prev => (prev ? (PAGE_PARENTS[prev] ?? null) : null))
-  }, [])
-
   const settingsSectionLabel = useCallback(
     (section: (typeof SECTIONS)[number]) => t.settings.sections[section.id] ?? section.label,
     [t.settings.sections]
   )
-
   const configFieldLabel = useCallback(
     (key: string) =>
       fieldCopyForSchemaKey(t.settings.fieldLabels, key) ??
@@ -277,61 +214,20 @@ export function CommandPalette() {
       {
         heading: cc.goTo,
         items: [
+          { icon: Plus, id: 'nav-new', keywords: ['chat', 'create'], label: cc.nav.newChat.title, run: go(NEW_CHAT_ROUTE) },
+          { icon: Settings, id: 'nav-settings', label: cc.nav.settings.title, run: go(SETTINGS_ROUTE) },
           {
-            action: 'session.new',
-            icon: Plus,
-            id: 'nav-new',
-            keywords: ['chat', 'create'],
-            label: cc.nav.newChat.title,
-            run: go(NEW_CHAT_ROUTE)
-          },
-          {
-            action: 'view.showTerminal',
-            icon: Terminal,
-            id: 'nav-terminal',
-            keywords: ['terminal', 'shell', 'console'],
-            label: t.keybinds.actions['view.showTerminal'],
-            run: () => setTerminalTakeover(true)
-          },
-          {
-            action: 'nav.settings',
-            icon: Settings,
-            id: 'nav-settings',
-            label: cc.nav.settings.title,
-            run: go(SETTINGS_ROUTE)
-          },
-          {
-            action: 'nav.skills',
             icon: Wrench,
             id: 'nav-skills',
             keywords: ['tools', 'toolsets'],
             label: cc.nav.skills.title,
             run: go(SKILLS_ROUTE)
           },
-          {
-            action: 'nav.messaging',
-            icon: MessageCircle,
-            id: 'nav-messaging',
-            label: cc.nav.messaging.title,
-            run: go(MESSAGING_ROUTE)
-          },
-          {
-            action: 'nav.artifacts',
-            icon: Package,
-            id: 'nav-artifacts',
-            label: cc.nav.artifacts.title,
-            run: go(ARTIFACTS_ROUTE)
-          },
-          {
-            action: 'nav.cron',
-            icon: Clock,
-            id: 'nav-cron',
-            keywords: ['schedule', 'jobs'],
-            label: t.shell.statusbar.cron,
-            run: go(CRON_ROUTE)
-          },
-          { action: 'nav.profiles', icon: Users, id: 'nav-profiles', label: t.profiles.title, run: go(PROFILES_ROUTE) },
-          { action: 'nav.agents', icon: Cpu, id: 'nav-agents', label: t.agents.title, run: go(AGENTS_ROUTE) }
+          { icon: MessageCircle, id: 'nav-messaging', label: cc.nav.messaging.title, run: go(MESSAGING_ROUTE) },
+          { icon: Package, id: 'nav-artifacts', label: cc.nav.artifacts.title, run: go(ARTIFACTS_ROUTE) },
+          { icon: Clock, id: 'nav-cron', keywords: ['schedule', 'jobs'], label: t.shell.statusbar.cron, run: go(CRON_ROUTE) },
+          { icon: Users, id: 'nav-profiles', label: t.profiles.title, run: go(PROFILES_ROUTE) },
+          { icon: Cpu, id: 'nav-agents', label: t.agents.title, run: go(AGENTS_ROUTE) }
         ]
       },
       {
@@ -477,40 +373,24 @@ export function CommandPalette() {
       theme: {
         title: t.settings.appearance.themeTitle,
         placeholder: t.settings.appearance.themeDesc,
-        groups: [
-          // Pinned at the top: drills into the Marketplace browser.
-          {
-            items: [
-              {
-                icon: Download,
-                id: 'theme-install',
-                keywords: ['install', 'marketplace', 'vscode', 'vs code', 'download', 'new', 'color'],
-                label: t.commandCenter.installTheme.title,
-                to: 'install-theme'
-              }
-            ]
-          },
-          // Built-ins and imported families list under the mode(s) they support;
-          // picking sets skin + mode at once. A multi-variant import (GitHub,
-          // Solarized) appears in both groups and switches variants with the mode.
-          ...(['light', 'dark'] as const).map(groupMode => ({
-            heading: groupMode === 'light' ? t.settings.modeOptions.light.label : t.settings.modeOptions.dark.label,
-            items: availableThemes
-              .filter(theme => themeSupportsMode(theme.name, groupMode))
-              .map(theme => ({
-                active: themeName === theme.name && resolvedMode === groupMode,
-                icon: groupMode === 'light' ? Sun : Moon,
-                id: `theme-${theme.name}-${groupMode}`,
-                keepOpen: true,
-                keywords: ['theme', 'appearance', 'palette', groupMode, theme.label, theme.description ?? ''],
-                label: theme.label,
-                run: () => {
-                  setTheme(theme.name)
-                  setMode(groupMode)
-                }
-              }))
+        // Skins aren't inherently light/dark — the same skin renders in either
+        // mode. Group by appearance so picking an entry sets skin + mode at
+        // once, and keep the palette open so each pick previews live.
+        groups: (['light', 'dark'] as const).map(groupMode => ({
+          heading: groupMode === 'light' ? t.settings.modeOptions.light.label : t.settings.modeOptions.dark.label,
+          items: availableThemes.map(theme => ({
+            active: themeName === theme.name && resolvedMode === groupMode,
+            icon: groupMode === 'light' ? Sun : Moon,
+            id: `theme-${theme.name}-${groupMode}`,
+            keepOpen: true,
+            keywords: ['theme', 'appearance', 'palette', groupMode, theme.label, theme.description ?? ''],
+            label: theme.label,
+            run: () => {
+              setTheme(theme.name)
+              setMode(groupMode)
+            }
           }))
-        ]
+        }))
       },
       'color-mode': {
         title: t.settings.appearance.colorMode,
@@ -519,6 +399,7 @@ export function CommandPalette() {
           {
             heading: t.settings.appearance.colorMode,
             items: THEME_MODES.map(entry => ({
+              active: mode === entry.mode,
               icon: entry.icon,
               id: `mode-${entry.mode}`,
               keepOpen: true,
@@ -528,16 +409,9 @@ export function CommandPalette() {
             }))
           }
         ]
-      },
-      // Server-driven page: items come from the Marketplace, rendered by
-      // <MarketplaceThemePage> (loader + live search + per-row install).
-      'install-theme': {
-        title: t.commandCenter.installTheme.title,
-        placeholder: t.commandCenter.installTheme.placeholder,
-        groups: []
       }
     }),
-    [availableThemes, resolvedMode, setMode, setTheme, t, themeName]
+    [availableThemes, mode, resolvedMode, setMode, setTheme, t, themeName]
   )
 
   const activePage = page ? subPages[page] : null
@@ -562,22 +436,17 @@ export function CommandPalette() {
   return (
     <DialogPrimitive.Root onOpenChange={setCommandPaletteOpen} open={open}>
       <DialogPrimitive.Portal>
-        {/* Transparent overlay: keeps click-away + focus trap, but no dim/blur. */}
-        <DialogPrimitive.Overlay className="fixed inset-0 z-[200]" />
+        <DialogPrimitive.Overlay className="fixed inset-0 z-[200] bg-black/15 backdrop-blur-[1px] data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:animate-in data-[state=open]:fade-in-0" />
         <DialogPrimitive.Content
           aria-describedby={undefined}
-          className={cn(
-            HUD_POSITION,
-            HUD_SURFACE,
-            'z-[210] w-[min(34rem,calc(100vw-2rem))] overflow-hidden duration-150 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[state=open]:animate-in data-[state=open]:fade-in-0 data-[state=open]:slide-in-from-top-2 data-[state=open]:zoom-in-95'
-          )}
+          className="fixed left-1/2 top-[14vh] z-[210] w-[min(40rem,calc(100vw-2rem))] -translate-x-1/2 overflow-hidden rounded-xl border border-(--ui-stroke-secondary) bg-(--ui-chat-bubble-background) shadow-lg duration-150 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[state=open]:animate-in data-[state=open]:fade-in-0 data-[state=open]:slide-in-from-top-2 data-[state=open]:zoom-in-95"
         >
           <DialogPrimitive.Title className="sr-only">{t.commandCenter.paletteTitle}</DialogPrimitive.Title>
-          <Command className="bg-transparent" filter={paletteFilter} loop>
+          <Command className="bg-transparent" loop>
             {activePage && (
               <button
                 className="flex w-full items-center gap-1.5 border-b border-border px-3 py-1.5 text-left text-xs text-muted-foreground transition-colors hover:text-foreground"
-                onClick={goBack}
+                onClick={() => setPage(null)}
                 type="button"
               >
                 <ChevronLeft className="size-3.5" />
@@ -587,7 +456,6 @@ export function CommandPalette() {
               </button>
             )}
             <CommandInput
-              className={HUD_TEXT}
               onKeyDown={event => {
                 if (!activePage) {
                   return
@@ -598,45 +466,38 @@ export function CommandPalette() {
                 if (event.key === 'Escape' || (event.key === 'Backspace' && search === '')) {
                   event.preventDefault()
                   event.stopPropagation()
-                  goBack()
+                  setPage(null)
                 }
               }}
               onValueChange={setSearch}
               placeholder={placeholder}
               value={search}
             />
-            <CommandList className="dt-portal-scrollbar max-h-[min(20rem,56vh)]">
-              {page === 'install-theme' ? (
-                <MarketplaceThemePage onPickTheme={setTheme} search={search} />
-              ) : (
-                <CommandEmpty>{t.commandCenter.noResults}</CommandEmpty>
-              )}
-              {visibleGroups.map((group, index) => (
+            <CommandList className="max-h-[min(24rem,60vh)]">
+              <CommandEmpty>{t.commandCenter.noResults}</CommandEmpty>
+              {visibleGroups.map(group => (
                 <CommandGroup
-                  className={HUD_HEADING}
+                  className="**:[[cmdk-group-heading]]:uppercase **:[[cmdk-group-heading]]:tracking-wider **:[[cmdk-group-heading]]:text-[0.6875rem] **:[[cmdk-group-heading]]:text-muted-foreground/70"
                   heading={group.heading}
-                  key={group.heading ?? `palette-group-${index}`}
+                  key={group.heading}
                 >
                   {group.items.map(item => {
                     const Icon = item.icon
-                    const combo = item.action ? bindings[item.action]?.[0] : undefined
-                    const keys = combo ? comboTokens(combo) : null
 
                     return (
                       <CommandItem
-                        className={cn(HUD_ITEM, HUD_TEXT)}
+                        className="gap-2.5"
                         key={item.id}
                         keywords={item.keywords}
                         onSelect={() => handleSelect(item)}
                         value={`${item.label} ${item.keywords?.join(' ') ?? ''} ${item.id}`}
                       >
-                        <Icon className="size-3.5 shrink-0 text-muted-foreground" />
+                        <Icon className="size-4 shrink-0 text-muted-foreground" />
                         <span className="truncate">{item.label}</span>
-                        {keys && <KbdGroup className="ml-auto" keys={keys} />}
-                        {item.to && (
-                          <ChevronRight
-                            className={cn('size-3.5 shrink-0 text-muted-foreground/70', !keys && 'ml-auto')}
-                          />
+                        {item.to ? (
+                          <ChevronRight className="ml-auto size-4 shrink-0 text-muted-foreground/70" />
+                        ) : (
+                          <Check className={cn('ml-auto size-4 text-foreground', !item.active && 'invisible')} />
                         )}
                       </CommandItem>
                     )

apps/desktop/src/app/command-palette/marketplace-theme-page.tsx

@@ -1,157 +0,0 @@
-/**
- * Cmd-K "Install theme…" page.
- *
- * Browses the VS Code Marketplace for color themes: an empty query shows the
- * most-installed themes, typing runs a live (debounced) search against the
- * Marketplace. Selecting a row downloads + converts + installs it via the same
- * pipeline as the settings importer, then activates it — and stays open so the
- * user can grab several.
- */
-
-import { useQuery } from '@tanstack/react-query'
-import { useEffect, useState } from 'react'
-
-import { HUD_ITEM, HUD_TEXT } from '@/app/floating-hud'
-import type { DesktopMarketplaceSearchItem } from '@/global'
-import { useI18n } from '@/i18n'
-import { triggerHaptic } from '@/lib/haptics'
-import { Check, Download, Loader2, Palette } from '@/lib/icons'
-import { cn } from '@/lib/utils'
-import { installVscodeThemeFromMarketplace } from '@/themes/install'
-
-const compactNumber = new Intl.NumberFormat(undefined, { notation: 'compact', maximumFractionDigits: 1 })
-
-function useDebounced<T>(value: T, delayMs: number): T {
-  const [debounced, setDebounced] = useState(value)
-
-  useEffect(() => {
-    const handle = setTimeout(() => setDebounced(value), delayMs)
-
-    return () => clearTimeout(handle)
-  }, [value, delayMs])
-
-  return debounced
-}
-
-interface MarketplaceThemePageProps {
-  search: string
-  /** Activate a freshly installed theme by slug. */
-  onPickTheme: (name: string) => void
-}
-
-export function MarketplaceThemePage({ search, onPickTheme }: MarketplaceThemePageProps) {
-  const { t } = useI18n()
-  const copy = t.commandCenter.installTheme
-  const debouncedSearch = useDebounced(search.trim(), 300)
-  const [installingId, setInstallingId] = useState<string | null>(null)
-  const [installed, setInstalled] = useState<Record<string, true>>({})
-  const [installError, setInstallError] = useState<string | null>(null)
-
-  const query = useQuery({
-    queryKey: ['marketplace-themes', debouncedSearch],
-    queryFn: () => window.hermesDesktop?.themes?.searchMarketplace(debouncedSearch) ?? Promise.resolve([]),
-    staleTime: 5 * 60 * 1000
-  })
-
-  const install = async (item: DesktopMarketplaceSearchItem) => {
-    if (installingId) {
-      return
-    }
-
-    setInstallingId(item.extensionId)
-    setInstallError(null)
-
-    try {
-      const theme = await installVscodeThemeFromMarketplace(item.extensionId)
-
-      triggerHaptic('crisp')
-      setInstalled(prev => ({ ...prev, [item.extensionId]: true }))
-      onPickTheme(theme.name)
-    } catch (error) {
-      setInstallError(error instanceof Error ? error.message : copy.error)
-    } finally {
-      setInstallingId(null)
-    }
-  }
-
-  if (query.isLoading) {
-    return <Status icon={<Loader2 className="size-3.5 animate-spin" />} text={copy.loading} />
-  }
-
-  if (query.isError) {
-    return <Status text={copy.error} tone="error" />
-  }
-
-  const results = query.data ?? []
-
-  if (results.length === 0) {
-    return <Status text={copy.empty} />
-  }
-
-  return (
-    <div role="listbox">
-      {installError && <p className="px-2 pb-1 pt-1.5 text-[0.6875rem] text-(--ui-red)">{installError}</p>}
-      {results.map(item => {
-        const busy = installingId === item.extensionId
-        const done = installed[item.extensionId]
-
-        return (
-          <button
-            className={cn(
-              'flex w-full items-start rounded-md text-left transition-colors hover:bg-(--chrome-action-hover) disabled:opacity-60 aria-disabled:opacity-60',
-              HUD_ITEM,
-              HUD_TEXT
-            )}
-            disabled={Boolean(installingId) && !busy}
-            key={item.extensionId}
-            onClick={() => void install(item)}
-            onMouseDown={event => event.preventDefault()}
-            role="option"
-            type="button"
-          >
-            <Palette className="mt-0.5 size-3.5 shrink-0 text-muted-foreground" />
-            <span className="flex min-w-0 flex-col">
-              <span className="truncate font-medium">{item.displayName}</span>
-              <span className="truncate text-[0.6875rem] text-muted-foreground/80">
-                {item.publisher}
-                {item.installs > 0 ? ` · ${copy.installs(compactNumber.format(item.installs))}` : ''}
-              </span>
-            </span>
-            <span className="ml-auto mt-0.5 flex shrink-0 items-center gap-1 text-[0.6875rem] text-muted-foreground">
-              {busy ? (
-                <>
-                  <Loader2 className="size-3 animate-spin" />
-                  {copy.installing}
-                </>
-              ) : done ? (
-                <>
-                  <Check className="size-3 text-(--ui-green)" />
-                  {copy.installed}
-                </>
-              ) : (
-                <>
-                  <Download className="size-3" />
-                  {copy.install}
-                </>
-              )}
-            </span>
-          </button>
-        )
-      })}
-    </div>
-  )
-}
-
-function Status({ icon, text, tone }: { icon?: React.ReactNode; text: string; tone?: 'error' }) {
-  return (
-    <div
-      className={cn(
-        'flex items-center justify-center gap-2 px-2 py-6 text-xs',
-        tone === 'error' ? 'text-(--ui-red)' : 'text-muted-foreground'
-      )}
-    >
-      {icon}
-      {text}
-    </div>
-  )
-}

apps/desktop/src/app/cron/cron-job-actions-menu.tsx

@@ -0,0 +1,114 @@
+import type * as React from 'react'
+
+import { Button } from '@/components/ui/button'
+import { Codicon } from '@/components/ui/codicon'
+import { DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuTrigger } from '@/components/ui/dropdown-menu'
+import { useI18n } from '@/i18n'
+import { triggerHaptic } from '@/lib/haptics'
+
+interface CronJobActions {
+  busy?: boolean
+  isPaused: boolean
+  title: string
+  onDelete: () => void
+  onEdit: () => void
+  onPauseResume: () => void
+  onTrigger: () => void
+}
+
+interface CronJobActionsMenuProps
+  extends CronJobActions, Pick<React.ComponentProps<typeof DropdownMenuContent>, 'align' | 'sideOffset'> {
+  children: React.ReactNode
+}
+
+export function CronJobActionsMenu({
+  align = 'end',
+  busy = false,
+  children,
+  isPaused,
+  onDelete,
+  onEdit,
+  onPauseResume,
+  onTrigger,
+  sideOffset = 6,
+  title
+}: CronJobActionsMenuProps) {
+  const { t } = useI18n()
+  const c = t.cron
+
+  return (
+    <DropdownMenu>
+      <DropdownMenuTrigger asChild>{children}</DropdownMenuTrigger>
+      <DropdownMenuContent
+        align={align}
+        aria-label={c.actionsFor(title)}
+        className="w-44"
+        sideOffset={sideOffset}
+      >
+        <DropdownMenuItem
+          disabled={busy}
+          onSelect={() => {
+            triggerHaptic('selection')
+            onPauseResume()
+          }}
+        >
+          <Codicon name={isPaused ? 'play' : 'debug-pause'} size="0.875rem" />
+          <span>{isPaused ? c.resumeTitle : c.pauseTitle}</span>
+        </DropdownMenuItem>
+
+        <DropdownMenuItem
+          disabled={busy}
+          onSelect={() => {
+            triggerHaptic('selection')
+            onTrigger()
+          }}
+        >
+          <Codicon name="zap" size="0.875rem" />
+          <span>{c.triggerNow}</span>
+        </DropdownMenuItem>
+
+        <DropdownMenuItem
+          onSelect={() => {
+            triggerHaptic('selection')
+            onEdit()
+          }}
+        >
+          <Codicon name="edit" size="0.875rem" />
+          <span>{c.edit}</span>
+        </DropdownMenuItem>
+
+        <DropdownMenuItem
+          onSelect={() => {
+            triggerHaptic('warning')
+            onDelete()
+          }}
+          variant="destructive"
+        >
+          <Codicon name="trash" size="0.875rem" />
+          <span>{t.common.delete}</span>
+        </DropdownMenuItem>
+      </DropdownMenuContent>
+    </DropdownMenu>
+  )
+}
+
+interface CronJobActionsTriggerProps extends Omit<React.ComponentProps<typeof Button>, 'size' | 'variant'> {
+  title: string
+}
+
+export function CronJobActionsTrigger({ className, title, ...props }: CronJobActionsTriggerProps) {
+  const { t } = useI18n()
+
+  return (
+    <Button
+      aria-label={t.cron.actionsFor(title)}
+      className={className}
+      size="icon-sm"
+      title={t.cron.actionsTitle}
+      variant="ghost"
+      {...props}
+    >
+      <Codicon className="text-muted-foreground" name="ellipsis" size="0.875rem" />
+    </Button>
+  )
+}

apps/desktop/src/app/cron/index.tsx

@@ -1,6 +1,5 @@
-import { useStore } from '@nanostores/react'
 import type * as React from 'react'
-import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
+import { useCallback, useEffect, useMemo, useState } from 'react'
 
 import { PageLoader } from '@/components/page-loader'
 import { Button } from '@/components/ui/button'
@@ -14,33 +13,29 @@ import {
   DialogTitle
 } from '@/components/ui/dialog'
 import { Input } from '@/components/ui/input'
-import { SearchField } from '@/components/ui/search-field'
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select'
 import { Textarea } from '@/components/ui/textarea'
 import {
   createCronJob,
   type CronJob,
   deleteCronJob,
-  getCronJobRuns,
   getCronJobs,
   pauseCronJob,
   resumeCronJob,
-  type SessionInfo,
   triggerCronJob,
   updateCronJob
 } from '@/hermes'
 import { type Translations, useI18n } from '@/i18n'
 import { AlertTriangle, Clock } from '@/lib/icons'
 import { cn } from '@/lib/utils'
-import { $cronFocusJobId, $cronJobs, setCronFocusJobId, setCronJobs, updateCronJobs } from '@/store/cron'
 import { notify, notifyError } from '@/store/notifications'
 
 import { useRefreshHotkey } from '../hooks/use-refresh-hotkey'
-import { OverlayMain, OverlayNewButton, OverlaySidebar, OverlaySplitLayout } from '../overlays/overlay-split-layout'
 import { OverlayView } from '../overlays/overlay-view'
+import { PageSearchShell } from '../page-search-shell'
 import type { SetStatusbarItemGroup } from '../shell/statusbar-controls'
 
-import { jobState, jobTitle, STATE_DOT } from './job-state'
+import { CronJobActionsMenu, CronJobActionsTrigger } from './cron-job-actions-menu'
 
 const DEFAULT_DELIVER = 'local'
 
@@ -85,6 +80,28 @@ function jobPrompt(job: CronJob): string {
   return asText(job.prompt)
 }
 
+function jobTitle(job: CronJob): string {
+  const name = jobName(job)
+
+  if (name) {
+    return name
+  }
+
+  const prompt = jobPrompt(job)
+
+  if (prompt) {
+    return truncate(prompt, 60)
+  }
+
+  const script = asText(job.script)
+
+  if (script) {
+    return truncate(script, 60)
+  }
+
+  return job.id || 'Cron job'
+}
+
 function jobScheduleDisplay(job: CronJob): string {
   return asText(job.schedule_display) || asText(job.schedule?.display) || asText(job.schedule?.expr) || '—'
 }
@@ -93,6 +110,10 @@ function jobScheduleExpr(job: CronJob): string {
   return asText(job.schedule?.expr) || asText(job.schedule_display) || ''
 }
 
+function jobState(job: CronJob): string {
+  return asText(job.state) || (job.enabled === false ? 'disabled' : 'scheduled')
+}
+
 function jobDeliver(job: CronJob): string {
   return asText(job.deliver) || DEFAULT_DELIVER
 }
@@ -240,38 +261,31 @@ function matchesQuery(job: CronJob, q: string): boolean {
 
 interface CronViewProps extends React.ComponentProps<'section'> {
   onClose: () => void
-  onOpenSession?: (sessionId: string) => void
   setStatusbarItemGroup?: SetStatusbarItemGroup
 }
 
-export function CronView({ onClose, onOpenSession, setStatusbarItemGroup: _setStatusbarItemGroup }: CronViewProps) {
+export function CronView({ onClose, setStatusbarItemGroup: _setStatusbarItemGroup, ...props }: CronViewProps) {
   const { t } = useI18n()
   const c = t.cron
-  // Source of truth is the shared atom (also fed by the controller poll), so the
-  // sidebar and this overlay never drift — a delete here clears the sidebar row
-  // immediately. `loading` only gates the first paint before the atom is filled.
-  const jobs = useStore($cronJobs)
-  const [loading, setLoading] = useState(jobs.length === 0)
+  const [jobs, setJobs] = useState<CronJob[] | null>(null)
   const [query, setQuery] = useState('')
+  const [refreshing, setRefreshing] = useState(false)
   const [busyJobId, setBusyJobId] = useState<null | string>(null)
-  // Master/detail: the job whose schedule + run history fill the right pane.
-  const [selectedJobId, setSelectedJobId] = useState<null | string>(null)
-  // Set when a job is opened from the sidebar so we scroll it into view once the
-  // row exists. Cleared after the scroll fires.
-  const pendingScrollRef = useRef<null | string>(null)
-  const focusJobId = useStore($cronFocusJobId)
 
   const [editor, setEditor] = useState<EditorState>({ mode: 'closed' })
   const [pendingDelete, setPendingDelete] = useState<CronJob | null>(null)
   const [deleting, setDeleting] = useState(false)
 
   const refresh = useCallback(async () => {
+    setRefreshing(true)
+
     try {
-      setCronJobs(await getCronJobs())
+      const result = await getCronJobs()
+      setJobs(result)
     } catch (err) {
       notifyError(err, c.failedLoad)
     } finally {
-      setLoading(false)
+      setRefreshing(false)
     }
   }, [c])
 
@@ -281,47 +295,16 @@ export function CronView({ onClose, onOpenSession, setStatusbarItemGroup: _setSt
     void refresh()
   }, [refresh])
 
-  // Sidebar → "open this job": resolve the focus id (or name) to a job, select
-  // it, queue a scroll, then clear the one-shot focus so re-opening cron
-  // normally doesn't re-trigger it.
-  useEffect(() => {
-    if (!focusJobId) {return}
-
-    const match = jobs.find(job => job.id === focusJobId || jobName(job) === focusJobId)
-
-    if (match) {
-      setSelectedJobId(match.id)
-      pendingScrollRef.current = match.id
+  const visibleJobs = useMemo(() => {
+    if (!jobs) {
+      return []
     }
 
-    setCronFocusJobId(null)
-  }, [focusJobId, jobs])
+    return jobs.filter(job => matchesQuery(job, query.trim())).sort((a, b) => jobTitle(a).localeCompare(jobTitle(b)))
+  }, [jobs, query])
 
-  const visibleJobs = useMemo(
-    () => jobs.filter(job => matchesQuery(job, query.trim())).sort((a, b) => jobTitle(a).localeCompare(jobTitle(b))),
-    [jobs, query]
-  )
-
-  // Detail always reflects a concrete job: the explicitly selected one, else the
-  // first visible row, so the right pane is never empty while jobs exist.
-  const selectedJob = useMemo(
-    () => visibleJobs.find(job => job.id === selectedJobId) ?? visibleJobs[0] ?? null,
-    [visibleJobs, selectedJobId]
-  )
-
-  // Scroll a sidebar-opened job into view once its list row is mounted.
-  useEffect(() => {
-    const target = pendingScrollRef.current
-
-    if (!target || selectedJob?.id !== target) {return}
-
-    pendingScrollRef.current = null
-    requestAnimationFrame(() => {
-      document.querySelector(`[data-cron-row="${CSS.escape(target)}"]`)?.scrollIntoView({ block: 'nearest' })
-    })
-  }, [selectedJob])
-
-  const totalCount = jobs.length
+  const enabledCount = jobs?.filter(job => job.enabled).length ?? 0
+  const totalCount = jobs?.length ?? 0
 
   async function handlePauseResume(job: CronJob) {
     setBusyJobId(job.id)
@@ -329,7 +312,7 @@ export function CronView({ onClose, onOpenSession, setStatusbarItemGroup: _setSt
     try {
       const isPaused = jobState(job) === 'paused'
       const updated = isPaused ? await resumeCronJob(job.id) : await pauseCronJob(job.id)
-      updateCronJobs(rows => rows.map(row => (row.id === job.id ? updated : row)))
+      setJobs(current => (current ? current.map(row => (row.id === job.id ? updated : row)) : current))
       notify({
         kind: 'success',
         title: isPaused ? c.resumed : c.paused,
@@ -347,7 +330,7 @@ export function CronView({ onClose, onOpenSession, setStatusbarItemGroup: _setSt
 
     try {
       const updated = await triggerCronJob(job.id)
-      updateCronJobs(rows => rows.map(row => (row.id === job.id ? updated : row)))
+      setJobs(current => (current ? current.map(row => (row.id === job.id ? updated : row)) : current))
       notify({ kind: 'success', title: c.triggered, message: truncate(jobTitle(job), 60) })
     } catch (err) {
       notifyError(err, c.failedTrigger)
@@ -365,7 +348,7 @@ export function CronView({ onClose, onOpenSession, setStatusbarItemGroup: _setSt
 
     try {
       await deleteCronJob(pendingDelete.id)
-      updateCronJobs(rows => rows.filter(row => row.id !== pendingDelete.id))
+      setJobs(current => (current ? current.filter(row => row.id !== pendingDelete.id) : current))
       notify({ kind: 'success', title: c.deleted, message: truncate(jobTitle(pendingDelete), 60) })
       setPendingDelete(null)
     } catch (err) {
@@ -384,7 +367,7 @@ export function CronView({ onClose, onOpenSession, setStatusbarItemGroup: _setSt
         deliver: values.deliver || DEFAULT_DELIVER
       })
 
-      updateCronJobs(rows => [...rows, created])
+      setJobs(current => (current ? [...current, created] : [created]))
       notify({ kind: 'success', title: c.created, message: truncate(jobTitle(created), 60) })
     } else if (editor.mode === 'edit') {
       const updated = await updateCronJob(editor.job.id, {
@@ -394,7 +377,7 @@ export function CronView({ onClose, onOpenSession, setStatusbarItemGroup: _setSt
         deliver: values.deliver
       })
 
-      updateCronJobs(rows => rows.map(row => (row.id === updated.id ? updated : row)))
+      setJobs(current => (current ? current.map(row => (row.id === updated.id ? updated : row)) : current))
       notify({ kind: 'success', title: c.updated, message: truncate(jobTitle(updated), 60) })
     }
 
@@ -403,62 +386,71 @@ export function CronView({ onClose, onOpenSession, setStatusbarItemGroup: _setSt
 
   return (
     <OverlayView closeLabel={c.close} onClose={onClose}>
-      {loading && jobs.length === 0 ? (
-        <PageLoader label={c.loading} />
-      ) : (
-        <OverlaySplitLayout>
-          <OverlaySidebar>
-            <OverlayNewButton label={c.newCron} onClick={() => setEditor({ mode: 'create' })} />
-            {totalCount > 0 && (
-              <SearchField
-                aria-label={c.search}
-                containerClassName="mb-1 w-full px-2"
-                onChange={setQuery}
-                placeholder={c.search}
-                value={query}
-              />
-            )}
-            {visibleJobs.map(job => (
-              <CronJobListRow
-                active={selectedJob?.id === job.id}
-                c={c}
-                job={job}
-                key={job.id}
-                onSelect={() => setSelectedJobId(job.id)}
-              />
-            ))}
-            {visibleJobs.length === 0 && (
-              <p className="px-2 py-4 text-center text-xs text-muted-foreground">
-                {totalCount === 0 ? c.emptyTitleNew : c.emptyTitleSearch}
-              </p>
-            )}
-          </OverlaySidebar>
-
-          <OverlayMain className="px-0">
-            {selectedJob ? (
-              <CronJobDetail
-                busy={busyJobId === selectedJob.id}
-                c={c}
-                job={selectedJob}
-                onDelete={() => setPendingDelete(selectedJob)}
-                onEdit={() => setEditor({ mode: 'edit', job: selectedJob })}
-                onOpenSession={onOpenSession}
-                onPauseResume={() => void handlePauseResume(selectedJob)}
-                onTrigger={() => void handleTrigger(selectedJob)}
-              />
-            ) : (
-              <div className="grid h-full place-items-center px-6 py-12 text-center text-sm text-muted-foreground">
-                <div>
-                  <Clock className="mx-auto size-6 text-muted-foreground/60" />
-                  <p className="mt-3">{totalCount === 0 ? c.emptyDescNew : c.emptyDescSearch}</p>
-                </div>
-              </div>
-            )}
-          </OverlayMain>
-        </OverlaySplitLayout>
-      )}
-
-      <CronEditorDialog editor={editor} onClose={() => setEditor({ mode: 'closed' })} onSave={handleEditorSave} />
+      <PageSearchShell
+        {...props}
+        onSearchChange={setQuery}
+        searchPlaceholder={c.search}
+        searchTrailingAction={
+          <Button
+            aria-label={refreshing ? c.refreshing : c.refresh}
+            className="text-(--ui-text-tertiary) hover:bg-(--chrome-action-hover) hover:text-foreground"
+            disabled={refreshing}
+            onClick={() => void refresh()}
+            size="icon-xs"
+            title={refreshing ? c.refreshing : c.refresh}
+            type="button"
+            variant="ghost"
+          >
+            <Codicon name="refresh" size="0.875rem" spinning={refreshing} />
+          </Button>
+        }
+        searchValue={query}
+      >
+        {!jobs ? (
+          <PageLoader label={c.loading} />
+        ) : visibleJobs.length === 0 ? (
+          // Empty state owns the primary "create" CTA — we used to also have
+          // one in the filters bar but it was redundant. Only show the button
+          // when there are zero jobs total; the search-empty case ("No
+          // matches") just asks the user to broaden their query.
+          <EmptyState
+            actionLabel={totalCount === 0 ? c.createFirst : undefined}
+            description={totalCount === 0 ? c.emptyDescNew : c.emptyDescSearch}
+            onAction={totalCount === 0 ? () => setEditor({ mode: 'create' }) : undefined}
+            title={totalCount === 0 ? c.emptyTitleNew : c.emptyTitleSearch}
+          />
+        ) : (
+          <div className="h-full overflow-y-auto px-4 py-3">
+            {/* Inline header replaces the old top-bar "New cron" button. We
+                still need a single, always-visible affordance to add a job
+                when the list is non-empty (rows themselves only expose
+                edit/pause/trigger/delete). */}
+            <div className="mb-2 flex items-center justify-between">
+              <span className="text-[0.7rem] uppercase tracking-wide text-muted-foreground">
+                {c.active(enabledCount, totalCount)}
+              </span>
+              <Button onClick={() => setEditor({ mode: 'create' })} size="sm">
+                <Codicon name="add" />
+                {c.newCron}
+              </Button>
+            </div>
+            <div className="divide-y divide-border/40 rounded-lg border border-border/40 bg-background/70">
+              {visibleJobs.map(job => (
+                <CronJobRow
+                  busy={busyJobId === job.id}
+                  c={c}
+                  job={job}
+                  key={job.id}
+                  onDelete={() => setPendingDelete(job)}
+                  onEdit={() => setEditor({ mode: 'edit', job })}
+                  onPauseResume={() => void handlePauseResume(job)}
+                  onTrigger={() => void handleTrigger(job)}
+                />
+              ))}
+            </div>
+          </div>
+        )}
+        <CronEditorDialog editor={editor} onClose={() => setEditor({ mode: 'closed' })} onSave={handleEditorSave} />
 
         <Dialog onOpenChange={open => !open && !deleting && setPendingDelete(null)} open={pendingDelete !== null}>
           <DialogContent className="max-w-md">
@@ -484,52 +476,17 @@ export function CronView({ onClose, onOpenSession, setStatusbarItemGroup: _setSt
             </DialogFooter>
           </DialogContent>
         </Dialog>
+      </PageSearchShell>
     </OverlayView>
   )
 }
 
-function CronJobListRow({
-  active,
-  c,
-  job,
-  onSelect
-}: {
-  active: boolean
-  c: Translations['cron']
-  job: CronJob
-  onSelect: () => void
-}) {
-  const state = jobState(job)
-
-  return (
-    <button
-      className={cn(
-        'flex w-full flex-col items-start gap-0.5 rounded-md px-2 py-1.5 text-left transition-colors',
-        active ? 'bg-accent text-foreground' : 'text-foreground/85 hover:bg-accent/60'
-      )}
-      data-cron-row={job.id}
-      onClick={onSelect}
-      type="button"
-    >
-      <span className="flex w-full items-center gap-2">
-        <span
-          aria-hidden="true"
-          className={cn('size-1.5 shrink-0 rounded-full', STATE_DOT[state] ?? 'bg-muted-foreground')}
-        />
-        <span className="min-w-0 flex-1 truncate text-sm font-medium">{jobTitle(job)}</span>
-      </span>
-      <span className="truncate pl-3.5 text-[0.66rem] text-muted-foreground">{jobScheduleDisplay(job)}</span>
-    </button>
-  )
-}
-
-function CronJobDetail({
+function CronJobRow({
   busy,
   c,
   job,
   onDelete,
   onEdit,
-  onOpenSession,
   onPauseResume,
   onTrigger
 }: {
@@ -538,172 +495,71 @@ function CronJobDetail({
   job: CronJob
   onDelete: () => void
   onEdit: () => void
-  onOpenSession?: (sessionId: string) => void
   onPauseResume: () => void
   onTrigger: () => void
 }) {
   const state = jobState(job)
   const isPaused = state === 'paused'
-  const deliver = jobDeliver(job)
+  const hasName = Boolean(jobName(job))
   const prompt = jobPrompt(job)
+  const deliver = jobDeliver(job)
 
   return (
-    <div className="flex h-full min-h-0 flex-col">
-      <div className="min-h-0 flex-1 overflow-y-auto">
-        <div className="mx-auto max-w-2xl space-y-6 px-6 py-6">
-          <header className="space-y-3">
-            <div className="flex flex-wrap items-start justify-between gap-3">
-              <div className="min-w-0 space-y-1">
-                <div className="flex flex-wrap items-center gap-2">
-                  <h3 className="text-xl font-semibold tracking-tight">{jobTitle(job)}</h3>
-                  <StatePill tone={STATE_TONE[state] ?? 'muted'}>{c.states[state] ?? state}</StatePill>
-                  {deliver && deliver !== DEFAULT_DELIVER && (
-                    <StatePill tone="muted">{c.deliveryLabels[deliver] ?? deliver}</StatePill>
-                  )}
-                </div>
-                <div className="flex flex-wrap items-center gap-x-4 gap-y-1 text-[0.7rem] text-muted-foreground">
-                  <span className="inline-flex items-center gap-1">
-                    <Clock className="size-3" />
-                    {jobScheduleDisplay(job)}
-                  </span>
-                  <span>
-                    {c.last} {formatTime(job.last_run_at)}
-                  </span>
-                  <span>
-                    {c.next} {formatTime(job.next_run_at)}
-                  </span>
-                </div>
-              </div>
-              <div className="flex shrink-0 items-center gap-1">
-                <Button disabled={busy} onClick={onPauseResume} size="sm" variant="outline">
-                  <Codicon name={isPaused ? 'play' : 'debug-pause'} size="0.875rem" />
-                  {isPaused ? c.resumeTitle : c.pauseTitle}
-                </Button>
-                <Button disabled={busy} onClick={onTrigger} size="sm" variant="outline">
-                  <Codicon name="zap" size="0.875rem" />
-                  {c.triggerNow}
-                </Button>
-                <Button onClick={onEdit} size="sm" variant="outline">
-                  <Codicon name="edit" size="0.875rem" />
-                  {c.edit}
-                </Button>
-                <Button
-                  className="text-muted-foreground hover:bg-destructive/10 hover:text-destructive"
-                  onClick={onDelete}
-                  size="sm"
-                  variant="ghost"
-                >
-                  <Codicon name="trash" size="0.875rem" />
-                </Button>
-              </div>
-            </div>
-
-            {prompt && <p className="line-clamp-3 text-xs text-muted-foreground">{prompt}</p>}
-            {job.last_error && (
-              <p className="inline-flex items-start gap-1 text-[0.7rem] text-destructive">
-                <AlertTriangle className="mt-px size-3 shrink-0" />
-                <span className="line-clamp-2">{job.last_error}</span>
-              </p>
-            )}
-          </header>
-
-          <CronJobRuns c={c} jobId={job.id} onOpenSession={onOpenSession} />
+    <div className="grid gap-3 px-3 py-2.5 sm:grid-cols-[minmax(0,1fr)_auto] sm:items-start">
+      <button
+        className="min-w-0 cursor-pointer rounded-md text-left transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring/40"
+        onClick={onEdit}
+        type="button"
+      >
+        <div className="flex flex-wrap items-center gap-2">
+          <span className="truncate text-sm font-medium">{jobTitle(job)}</span>
+          <StatePill tone={STATE_TONE[state] ?? 'muted'}>{c.states[state] ?? state}</StatePill>
+          {deliver && deliver !== DEFAULT_DELIVER && (
+            <StatePill tone="muted">{c.deliveryLabels[deliver] ?? deliver}</StatePill>
+          )}
         </div>
+        {hasName && prompt && <p className="mt-1 truncate text-xs text-muted-foreground">{truncate(prompt, 120)}</p>}
+        <div className="mt-1 flex flex-wrap items-center gap-x-4 gap-y-1 text-[0.68rem] text-muted-foreground">
+          <span className="inline-flex items-center gap-1 font-mono">
+            <Clock className="size-3" />
+            {jobScheduleDisplay(job)}
+          </span>
+          <span>
+            {c.last} {formatTime(job.last_run_at)}
+          </span>
+          <span>
+            {c.next} {formatTime(job.next_run_at)}
+          </span>
+        </div>
+        {job.last_error && (
+          <p className="mt-1 inline-flex items-start gap-1 text-[0.68rem] text-destructive">
+            <AlertTriangle className="mt-px size-3 shrink-0" />
+            <span className="line-clamp-2">{job.last_error}</span>
+          </p>
+        )}
+      </button>
+
+      <div className="flex shrink-0 items-center">
+        <CronJobActionsMenu
+          busy={busy}
+          isPaused={isPaused}
+          onDelete={onDelete}
+          onEdit={onEdit}
+          onPauseResume={onPauseResume}
+          onTrigger={onTrigger}
+          title={jobTitle(job)}
+        >
+          <CronJobActionsTrigger
+            className="text-muted-foreground hover:text-foreground"
+            onClick={event => event.stopPropagation()}
+            title={jobTitle(job)}
+          />
+        </CronJobActionsMenu>
       </div>
     </div>
   )
 }
 
-function formatRunTime(seconds?: null | number): string {
-  if (!seconds) {
-    return '—'
-  }
-
-  const date = new Date(seconds * 1000)
-
-  return Number.isNaN(date.valueOf()) ? '—' : date.toLocaleString()
-}
-
-// Runs are produced by the background scheduler tick (no UI signal), so poll
-// while the panel is open + on tab re-focus so a fired run shows up within a few
-// seconds instead of waiting for a reload.
-const RUNS_POLL_INTERVAL_MS = 8000
-
-function CronJobRuns({
-  c,
-  jobId,
-  onOpenSession
-}: {
-  c: Translations['cron']
-  jobId: string
-  onOpenSession?: (sessionId: string) => void
-}) {
-  const [runs, setRuns] = useState<null | SessionInfo[]>(null)
-
-  useEffect(() => {
-    let cancelled = false
-
-    const load = () =>
-      getCronJobRuns(jobId)
-        .then(result => {
-          if (!cancelled) {setRuns(result)}
-        })
-        .catch(() => {
-          if (!cancelled) {setRuns(prev => prev ?? [])}
-        })
-
-    void load()
-
-    const intervalId = window.setInterval(() => {
-      if (document.visibilityState === 'visible') {void load()}
-    }, RUNS_POLL_INTERVAL_MS)
-
-    const onVisible = () => {
-      if (document.visibilityState === 'visible') {void load()}
-    }
-
-    document.addEventListener('visibilitychange', onVisible)
-
-    return () => {
-      cancelled = true
-      window.clearInterval(intervalId)
-      document.removeEventListener('visibilitychange', onVisible)
-    }
-  }, [jobId])
-
-  return (
-    <div>
-      <div className="mb-1.5 text-[0.62rem] font-medium uppercase tracking-wide text-muted-foreground">
-        {c.runHistory}
-        {runs && runs.length > 0 ? ` · ${runs.length}` : ''}
-      </div>
-      {runs === null ? (
-        <div className="flex items-center gap-1.5 py-1 text-xs text-muted-foreground">
-          <Codicon name="loading" size="0.75rem" spinning />
-        </div>
-      ) : runs.length === 0 ? (
-        <div className="py-1 text-xs text-muted-foreground">{c.noRuns}</div>
-      ) : (
-        <div className="flex flex-col gap-px">
-          {runs.map(run => (
-            <button
-              className="flex items-center justify-between gap-3 rounded-md px-2 py-1 text-left text-xs hover:bg-(--chrome-action-hover) focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring/40"
-              key={run.id}
-              onClick={() => onOpenSession?.(run.id)}
-              type="button"
-            >
-              <span className="truncate text-foreground">{run.title?.trim() || run.preview?.trim() || run.id}</span>
-              <span className="shrink-0 text-[0.62rem] text-muted-foreground tabular-nums">
-                {formatRunTime(run.last_active || run.started_at)}
-              </span>
-            </button>
-          ))}
-        </div>
-      )}
-    </div>
-  )
-}
-
 function StatePill({ children, tone }: { children: string; tone: keyof typeof PILL_TONE }) {
   return (
     <span
@@ -714,6 +570,33 @@ function StatePill({ children, tone }: { children: string; tone: keyof typeof PI
   )
 }
 
+function EmptyState({
+  actionLabel,
+  description,
+  onAction,
+  title
+}: {
+  actionLabel?: string
+  description: string
+  onAction?: () => void
+  title: string
+}) {
+  return (
+    <div className="grid h-full place-items-center px-6 py-12 text-center">
+      <div className="max-w-sm space-y-2">
+        <div className="text-sm font-medium">{title}</div>
+        <p className="text-xs text-muted-foreground">{description}</p>
+        {actionLabel && onAction && (
+          <Button className="mt-2" onClick={onAction} size="sm">
+            <Codicon name="add" />
+            {actionLabel}
+          </Button>
+        )}
+      </div>
+    </div>
+  )
+}
+
 function CronEditorDialog({
   editor,
   onClose,
@@ -870,7 +753,7 @@ function CronEditorDialog({
               <FieldHint>{c.customHint}</FieldHint>
             </Field>
           ) : (
-            <div className="rounded-md bg-(--ui-bg-quinary) px-3 py-2">
+            <div className="rounded-md border border-border/60 bg-muted/30 px-3 py-2">
               <div className="flex flex-wrap items-center justify-between gap-2 text-xs">
                 <span className="font-medium text-foreground">{scheduleHint}</span>
                 <span className="font-mono text-muted-foreground">{schedule}</span>
@@ -879,7 +762,7 @@ function CronEditorDialog({
           )}
 
           {error && (
-            <div className="flex items-start gap-2 rounded-md bg-destructive/10 px-3 py-2 text-xs text-destructive">
+            <div className="flex items-start gap-2 rounded-md border border-destructive/30 bg-destructive/10 px-3 py-2 text-xs text-destructive">
               <AlertTriangle className="mt-0.5 size-3.5 shrink-0" />
               <span>{error}</span>
             </div>

apps/desktop/src/app/cron/job-state.ts

@@ -1,29 +0,0 @@
-import type { CronJob } from '@/types/hermes'
-
-// Status-pip color per cron job state. Single source for the sidebar section and
-// the Cron page so the two never drift. (Animation/size live at the call site.)
-export const STATE_DOT: Record<string, string> = {
-  completed: 'bg-(--ui-text-quaternary)',
-  disabled: 'bg-(--ui-text-quaternary)',
-  enabled: 'bg-primary',
-  error: 'bg-destructive',
-  paused: 'bg-amber-500',
-  running: 'bg-primary',
-  scheduled: 'bg-primary'
-}
-
-// Effective state: explicit state wins; otherwise infer from the enabled flag.
-export function jobState(job: CronJob): string {
-  const state = typeof job.state === 'string' ? job.state.trim() : ''
-
-  return state || (job.enabled === false ? 'disabled' : 'scheduled')
-}
-
-// Human label for a job: name → first 60 of prompt → first 60 of script → id.
-// One source for the sidebar row and the Cron page so the two never drift.
-export function jobTitle(job: CronJob): string {
-  const pick = (v: unknown) => (typeof v === 'string' ? v.trim() : '')
-  const clip = (v: string) => (v.length > 60 ? `${v.slice(0, 60)}…` : v)
-
-  return pick(job.name) || clip(pick(job.prompt)) || clip(pick(job.script)) || job.id || 'Cron job'
-}

apps/desktop/src/app/desktop-controller.tsx

@@ -8,19 +8,12 @@ import { DesktopInstallOverlay } from '@/components/desktop-install-overlay'
 import { DesktopOnboardingOverlay } from '@/components/desktop-onboarding-overlay'
 import { GatewayConnectingOverlay } from '@/components/gateway-connecting-overlay'
 import { Pane, PaneMain } from '@/components/pane-shell'
-import { useMediaQuery } from '@/hooks/use-media-query'
 import { useSkinCommand } from '@/themes/use-skin-command'
 
 import { formatRefValue } from '../components/assistant-ui/directive-text'
-import { getCronJobs, getSessionMessages, listAllProfileSessions, type SessionInfo, triggerCronJob } from '../hermes'
+import { getSessionMessages, listAllProfileSessions, type SessionInfo } from '../hermes'
 import { preserveLocalAssistantErrors, toChatMessages } from '../lib/chat-messages'
-import {
-  isMessagingSource,
-  LOCAL_SESSION_SOURCE_IDS,
-  MESSAGING_SESSION_SOURCE_IDS,
-  normalizeSessionSource
-} from '../lib/session-source'
-import { setCronFocusJobId, setCronJobs } from '../store/cron'
+import { toggleCommandPalette } from '../store/command-palette'
 import {
   $panesFlipped,
   $pinnedSessionIds,
@@ -30,53 +23,36 @@ import {
   FILE_BROWSER_MAX_WIDTH,
   FILE_BROWSER_MIN_WIDTH,
   pinSession,
-  setSidebarOverlayMounted,
   SIDEBAR_DEFAULT_WIDTH,
   SIDEBAR_MAX_WIDTH,
   SIDEBAR_SESSIONS_PAGE_SIZE,
   unpinSession
 } from '../store/layout'
 import { $filePreviewTarget, $previewTarget, closeActiveRightRailTab } from '../store/preview'
-import {
-  $activeGatewayProfile,
-  $freshSessionRequest,
-  $profileScope,
-  ALL_PROFILES,
-  normalizeProfileKey,
-  refreshActiveProfile
-} from '../store/profile'
+import { $activeGatewayProfile, $freshSessionRequest, normalizeProfileKey, refreshActiveProfile } from '../store/profile'
 import {
   $activeSessionId,
   $currentCwd,
   $freshDraftReady,
   $gatewayState,
-  $messagingSessions,
   $selectedStoredSessionId,
   $sessions,
   $workingSessionIds,
-  CRON_SECTION_LIMIT,
-  getRecentlySettledSessionIds,
   mergeSessionPage,
-  MESSAGING_SECTION_LIMIT,
   sessionPinId,
   setAwaitingResponse,
   setBusy,
-  setCronSessions,
   setCurrentBranch,
   setCurrentCwd,
   setCurrentModel,
   setCurrentProvider,
   setMessages,
-  setMessagingPlatformTotals,
-  setMessagingSessions,
-  setMessagingTruncated,
   setSessionProfileTotals,
   setSessions,
   setSessionsLoading,
   setSessionsTotal
 } from '../store/session'
 import { openUpdatesWindow, startUpdatePoller, stopUpdatePoller } from '../store/updates'
-import { isSecondaryWindow } from '../store/windows'
 
 import { ChatView } from './chat'
 import { useComposerActions } from './chat/hooks/use-composer-actions'
@@ -90,16 +66,12 @@ import { ChatSidebar } from './chat/sidebar'
 import { CommandPalette } from './command-palette'
 import { useGatewayBoot } from './gateway/hooks/use-gateway-boot'
 import { useGatewayRequest } from './gateway/hooks/use-gateway-request'
-import { useKeybinds } from './hooks/use-keybinds'
-import { modKey } from '@/lib/keybinds/combo'
-import { SIDEBAR_COLLAPSE_MEDIA_QUERY } from './layout-constants'
 import { ModelPickerOverlay } from './model-picker-overlay'
 import { ModelVisibilityOverlay } from './model-visibility-overlay'
 import { RightSidebarPane } from './right-sidebar'
 import { $terminalTakeover } from './right-sidebar/store'
 import { PersistentTerminal, TerminalSlot } from './right-sidebar/terminal/persistent'
-import { CRON_ROUTE, NEW_CHAT_ROUTE, routeSessionId, sessionRoute, SETTINGS_ROUTE } from './routes'
-import { SessionSwitcher } from './session-switcher'
+import { NEW_CHAT_ROUTE, routeSessionId, sessionRoute, SETTINGS_ROUTE } from './routes'
 import { useContextSuggestions } from './session/hooks/use-context-suggestions'
 import { useCwdActions } from './session/hooks/use-cwd-actions'
 import { useHermesConfig } from './session/hooks/use-hermes-config'
@@ -129,45 +101,13 @@ const ProfilesView = lazy(async () => ({ default: (await import('./profiles')).P
 const SettingsView = lazy(async () => ({ default: (await import('./settings')).SettingsView }))
 const SkillsView = lazy(async () => ({ default: (await import('./skills')).SkillsView }))
 
-// Latest cron-job sessions surfaced in the collapsed "Cron jobs" section. The
-// Cron sessions are written by a background scheduler tick (the desktop
-// backend), so no user action signals the UI. Poll the bounded cron list on
-// this cadence while the app is open + visible so new runs surface promptly
-// instead of waiting for the next user-triggered refreshSessions().
-const CRON_POLL_INTERVAL_MS = 30_000
-// The recents list is local-only: cron rows have their own section, and each
-// messaging platform (telegram, discord, …) is fetched separately into its own
-// self-managed sidebar section (refreshMessagingSessions). Excluding both here
-// keeps "Load more" paging through interactive local chats instead of
-// interleaving gateway threads that bury them.
-const SIDEBAR_EXCLUDED_SOURCES = ['cron', ...MESSAGING_SESSION_SOURCE_IDS]
-// The messaging slice is the inverse: drop cron + every local source so only
-// external-platform conversations remain, then split per platform in the UI.
-const MESSAGING_EXCLUDED_SOURCES = ['cron', ...LOCAL_SESSION_SOURCE_IDS]
-
-// Cheap signature compare so the poll only swaps the atom (and re-renders the
-// sidebar) when the visible cron rows actually changed.
-function sameCronSignature(a: SessionInfo[], b: SessionInfo[]): boolean {
-  if (a.length !== b.length) {
-    return false
-  }
-
-  return a.every((session, i) => session.id === b[i]?.id && session.title === b[i]?.title)
-}
-
 // Rows a session refresh must preserve even if the aggregator omits them:
-// in-flight first turns (message_count 0), pinned rows aged off the page, the
-// actively-viewed chat (its "working" flag clears a beat before the aggregator
-// sees the persisted row), and sessions whose turn just settled (same race, but
-// for a chat the user has already navigated away from). Pass `scope` to only
-// keep the active row when it belongs to the profile being paged.
+// in-flight first turns (message_count 0), pinned rows aged off the page, and
+// the actively-viewed chat (its "working" flag clears a beat before the
+// aggregator sees the persisted row). Pass `scope` to only keep the active row
+// when it belongs to the profile being paged.
 function sessionsToKeep(scope?: string): Set<string> {
-  const keep = new Set<string>([
-    ...$workingSessionIds.get(),
-    ...$pinnedSessionIds.get(),
-    ...getRecentlySettledSessionIds()
-  ])
-
+  const keep = new Set<string>([...$workingSessionIds.get(), ...$pinnedSessionIds.get()])
   const active = $selectedStoredSessionId.get()
 
   if (active) {
@@ -199,11 +139,6 @@ export function DesktopController() {
   const selectedStoredSessionId = useStore($selectedStoredSessionId)
   const terminalTakeover = useStore($terminalTakeover)
   const panesFlipped = useStore($panesFlipped)
-  const profileScope = useStore($profileScope)
-  // Below SIDEBAR_COLLAPSE_BREAKPOINT_PX there's no room for a docked rail —
-  // collapse both sidebars (without touching their stored open state) so the
-  // hover-reveal overlay becomes the way in. Restores once it's wide again.
-  const narrowViewport = useMediaQuery(SIDEBAR_COLLAPSE_MEDIA_QUERY)
 
   const routedSessionId = routeSessionId(location.pathname)
   const routeToken = `${location.pathname}:${location.search}:${location.hash}`
@@ -226,7 +161,7 @@ export function DesktopController() {
     toggleCommandCenter
   } = useOverlayRouting()
 
-  const terminalSidebarOpen = chatOpen && terminalTakeover
+  const terminalTakeoverActive = chatOpen && terminalTakeover
 
   const titlebarToolGroups = useGroupRegistry<TitlebarTool>()
   const statusbarItemGroups = useGroupRegistry<StatusbarItem>()
@@ -272,7 +207,7 @@ export function DesktopController() {
         return
       }
 
-      if (event[modKey] && !event.altKey && !event.shiftKey && event.key.toLowerCase() === 'w') {
+      if ((event.metaKey || event.ctrlKey) && !event.altKey && !event.shiftKey && event.key.toLowerCase() === 'w') {
         event.preventDefault()
         event.stopPropagation()
         closeActiveRightRailTab()
@@ -289,80 +224,30 @@ export function DesktopController() {
     }
   }, [])
 
-  // Cron-job sessions as their own list (latest N). Independent of the recents
-  // page so the two never compete for slots. Cheap + bounded. Kept (even though
-  // the sidebar now lists cron *jobs*, not run sessions) so a pinned cron run
-  // still resolves into the Pinned section via sessionByAnyId.
-  const refreshCronSessions = useCallback(async () => {
-    try {
-      const { sessions } = await listAllProfileSessions(CRON_SECTION_LIMIT, 1, 'exclude', 'recent', 'all', {
-        source: 'cron'
-      })
+  // Global chrome shortcuts (plain Cmd/Ctrl, no alt/shift): Cmd+K / Cmd+P →
+  // command palette (the composer's "drain next queued" moved to Cmd+Shift+K),
+  // Cmd+. → command center (sessions / system / usage).
+  useEffect(() => {
+    const onKeyDown = (event: KeyboardEvent) => {
+      if (!(event.metaKey || event.ctrlKey) || event.altKey || event.shiftKey) {
+        return
+      }
 
-      setCronSessions(prev => (sameCronSignature(prev, sessions) ? prev : sessions))
-    } catch {
-      // Non-fatal: the cron section just stays empty/stale.
+      const key = event.key.toLowerCase()
+
+      if (key === 'k' || key === 'p') {
+        event.preventDefault()
+        toggleCommandPalette()
+      } else if (key === '.') {
+        event.preventDefault()
+        toggleCommandCenter()
+      }
     }
-  }, [])
 
-  // Messaging-platform sessions as their own slice, fetched separately from
-  // local recents so each platform renders a self-managed section and never
-  // competes with local chats for the recents page budget. One combined fetch
-  // seeds every platform; the sidebar splits the rows per source.
-  const refreshMessagingSessions = useCallback(async () => {
-    try {
-      const result = await listAllProfileSessions(MESSAGING_SECTION_LIMIT, 1, 'exclude', 'recent', 'all', {
-        excludeSources: MESSAGING_EXCLUDED_SOURCES
-      })
+    window.addEventListener('keydown', onKeyDown)
 
-      // Drop any non-messaging source the broad exclude didn't catch (custom
-      // sources) — those stay in local recents, not a platform section.
-      const rows = result.sessions.filter(s => isMessagingSource(s.source))
-
-      setMessagingSessions(prev => (sameCronSignature(prev, rows) ? prev : rows))
-      // Hit the cap → at least one platform may have more on disk than loaded,
-      // so platform sections offer their own per-platform "load more".
-      setMessagingTruncated(result.sessions.length >= MESSAGING_SECTION_LIMIT)
-    } catch {
-      // Non-fatal: the messaging sections just stay empty/stale.
-    }
-  }, [])
-
-  // Page a single platform's section independently (mirrors the per-profile
-  // pager): fetch that source's next window and merge it back in place, leaving
-  // every other platform's rows untouched. Resolves the platform's exact total.
-  const loadMoreMessagingForPlatform = useCallback(async (platform: string) => {
-    const inPlatform = (s: SessionInfo) => normalizeSessionSource(s.source) === platform
-    const loaded = $messagingSessions.get().filter(inPlatform).length
-
-    const result = await listAllProfileSessions(loaded + SIDEBAR_SESSIONS_PAGE_SIZE, 1, 'exclude', 'recent', 'all', {
-      source: platform
-    })
-
-    const incoming = result.sessions.filter(s => normalizeSessionSource(s.source) === platform)
-
-    setMessagingSessions(prev => [
-      ...prev.filter(s => !inPlatform(s)),
-      ...mergeSessionPage(prev.filter(inPlatform), incoming, sessionsToKeep())
-    ])
-
-    const total = result.total ?? incoming.length
-    setMessagingPlatformTotals(prev => ({ ...prev, [platform]: Math.max(total, incoming.length) }))
-  }, [])
-
-  // Cron *jobs* drive the sidebar "Cron jobs" section. Jobs are created
-  // synchronously (agent tool call or the cron UI), so refreshing here right
-  // after an agent turn surfaces a new job immediately; the interval poll keeps
-  // next-run/state fresh as the scheduler advances them.
-  const refreshCronJobs = useCallback(async () => {
-    try {
-      const jobs = await getCronJobs()
-
-      setCronJobs(jobs)
-    } catch {
-      // Non-fatal: the cron section just keeps its last-known jobs.
-    }
-  }, [])
+    return () => window.removeEventListener('keydown', onKeyDown)
+  }, [toggleCommandCenter])
 
   const refreshSessions = useCallback(async () => {
     const requestId = refreshSessionsRequestRef.current + 1
@@ -371,23 +256,13 @@ export function DesktopController() {
 
     try {
       const limit = $sessionsLimit.get()
-
       // Require at least one message so abandoned/empty "Untitled" drafts (one
       // was created per TUI/desktop launch before the lazy-create fix) don't
       // clutter the sidebar.
       // Unified cross-profile list (served read-only off each profile's
       // state.db; no per-profile backend is spawned). Single-profile users get
-      // the same rows tagged profile="default". Cron sessions are excluded here
-      // and fetched separately (refreshCronSessions) so the scheduler's
-      // always-newest rows can't consume the recents page budget.
-      // Scope the fetch to the active profile (not always 'all') so a profile
-      // with few recent sessions isn't windowed out of the cross-profile
-      // recency page — the empty-history-on-profile-switch bug.
-      const sessionProfile = profileScope === ALL_PROFILES ? 'all' : profileScope
-
-      const result = await listAllProfileSessions(limit, 1, 'exclude', 'recent', sessionProfile, {
-        excludeSources: SIDEBAR_EXCLUDED_SOURCES
-      })
+      // the same rows tagged profile="default".
+      const result = await listAllProfileSessions(limit, 1)
 
       if (refreshSessionsRequestRef.current === requestId) {
         setSessions(prev => mergeSessionPage(prev, result.sessions, sessionsToKeep()))
@@ -399,11 +274,7 @@ export function DesktopController() {
         setSessionsLoading(false)
       }
     }
-
-    void refreshCronSessions()
-    void refreshCronJobs()
-    void refreshMessagingSessions()
-  }, [profileScope, refreshCronSessions, refreshCronJobs, refreshMessagingSessions])
+  }, [])
 
   const loadMoreSessions = useCallback(() => {
     bumpSessionsLimit()
@@ -416,17 +287,10 @@ export function DesktopController() {
     const key = normalizeProfileKey(profile)
     const inKey = (s: SessionInfo) => normalizeProfileKey(s.profile) === key
     const loaded = $sessions.get().filter(inKey).length
-
-    const result = await listAllProfileSessions(loaded + SIDEBAR_SESSIONS_PAGE_SIZE, 1, 'exclude', 'recent', key, {
-      excludeSources: SIDEBAR_EXCLUDED_SOURCES
-    })
-
+    const result = await listAllProfileSessions(loaded + SIDEBAR_SESSIONS_PAGE_SIZE, 1, 'exclude', 'recent', key)
     const keep = sessionsToKeep(key)
 
-    setSessions(prev => [
-      ...prev.filter(s => !inKey(s)),
-      ...mergeSessionPage(prev.filter(inKey), result.sessions, keep)
-    ])
+    setSessions(prev => [...prev.filter(s => !inKey(s)), ...mergeSessionPage(prev.filter(inKey), result.sessions, keep)])
 
     const total = result.profile_totals?.[key] ?? result.total ?? result.sessions.length
     setSessionProfileTotals(prev => ({ ...prev, [key]: Math.max(total, result.sessions.length) }))
@@ -593,13 +457,40 @@ export function DesktopController() {
     updateSessionState
   })
 
-  // Single global listener for every rebindable hotkey (incl. profile switching)
-  // plus the on-screen keybind editor's capture mode.
-  useKeybinds({
-    startFreshSession: startFreshSessionDraft,
-    toggleCommandCenter,
-    toggleSelectedPin
-  })
+  useEffect(() => {
+    const onKeyDown = (event: KeyboardEvent) => {
+      const target = event.target as HTMLElement | null
+
+      const editing =
+        target?.isContentEditable ||
+        target instanceof HTMLInputElement ||
+        target instanceof HTMLTextAreaElement ||
+        target instanceof HTMLSelectElement
+
+      if (event.defaultPrevented || event.repeat || event.altKey || event.code !== 'KeyN') {
+        return
+      }
+
+      // Two accelerators for "new session":
+      //   - Cmd/Ctrl+N (browser-like, works while typing in any input)
+      //   - Shift+N    (single-key, only when no input is focused)
+      const accelerator = event.metaKey || event.ctrlKey
+      const singleKey = !accelerator && !editing && event.shiftKey
+
+      if (!accelerator && !singleKey) {
+        return
+      }
+
+      event.preventDefault()
+      startFreshSessionDraft()
+      // Briefly light up the sidebar's ⌘N hint so the shortcut is discoverable.
+      window.dispatchEvent(new CustomEvent('hermes:new-session-shortcut'))
+    }
+
+    window.addEventListener('keydown', onKeyDown)
+
+    return () => window.removeEventListener('keydown', onKeyDown)
+  }, [startFreshSessionDraft])
 
   // A profile switch/create drops to a fresh new-session draft so the previously
   // open session doesn't bleed across contexts. Skip the initial value.
@@ -687,19 +578,19 @@ export function DesktopController() {
     submitText,
     transcribeVoiceAudio
   } = usePromptActions({
-    activeSessionId,
-    activeSessionIdRef,
-    branchCurrentSession: branchInNewChat,
-    busyRef,
-    createBackendSessionForSend,
-    handleSkinCommand,
-    refreshSessions,
-    requestGateway,
-    selectedStoredSessionIdRef,
-    startFreshSessionDraft,
-    sttEnabled,
-    updateSessionState
-  })
+      activeSessionId,
+      activeSessionIdRef,
+      branchCurrentSession: branchInNewChat,
+      busyRef,
+      createBackendSessionForSend,
+      handleSkinCommand,
+      refreshSessions,
+      requestGateway,
+      selectedStoredSessionIdRef,
+      startFreshSessionDraft,
+      sttEnabled,
+      updateSessionState
+    })
 
   useGatewayBoot({
     handleGatewayEvent: handleDesktopGatewayEvent,
@@ -721,29 +612,6 @@ export function DesktopController() {
     }
   }, [gatewayState, refreshCurrentModel, refreshSessions])
 
-  // Keep the cron jobs section live without a user action: the scheduler ticks
-  // in the background (advancing next-run/state and creating runs), so poll the
-  // job list on an interval (and on tab re-focus) while connected.
-  useEffect(() => {
-    if (gatewayState !== 'open') {
-      return
-    }
-
-    const tick = () => {
-      if (document.visibilityState === 'visible') {
-        void refreshCronJobs()
-      }
-    }
-
-    const intervalId = window.setInterval(tick, CRON_POLL_INTERVAL_MS)
-    document.addEventListener('visibilitychange', tick)
-
-    return () => {
-      window.clearInterval(intervalId)
-      document.removeEventListener('visibilitychange', tick)
-    }
-  }, [gatewayState, refreshCronJobs])
-
   useRouteResume({
     activeSessionId,
     activeSessionIdRef,
@@ -762,7 +630,6 @@ export function DesktopController() {
 
   const { leftStatusbarItems, statusbarItems } = useStatusbarItems({
     agentsOpen,
-    chatOpen,
     commandCenterOpen,
     extraLeftItems: statusbarItemGroups.flat.left,
     extraRightItems: statusbarItemGroups.flat.right,
@@ -783,52 +650,35 @@ export function DesktopController() {
       currentView={currentView}
       onArchiveSession={sessionId => void archiveSession(sessionId)}
       onDeleteSession={sessionId => void removeSession(sessionId)}
-      onLoadMoreMessaging={loadMoreMessagingForPlatform}
       onLoadMoreProfileSessions={loadMoreSessionsForProfile}
       onLoadMoreSessions={loadMoreSessions}
-      onManageCronJob={jobId => {
-        setCronFocusJobId(jobId)
-        navigate(CRON_ROUTE)
-      }}
       onNavigate={selectSidebarItem}
       onNewSessionInWorkspace={startSessionInWorkspace}
       onResumeSession={sessionId => navigate(sessionRoute(sessionId))}
-      onTriggerCronJob={jobId => {
-        void triggerCronJob(jobId)
-          .then(() => refreshCronJobs())
-          .catch(() => undefined)
-      }}
     />
   )
 
-  // One PTY-backed terminal mounted forever; <TerminalSlot /> placeholders decide
-  // where it shows. Lives in main's stacking context (not the root overlay layer)
-  // so pane resize handles still paint above it. Toggling never rebuilds the shell.
-  const mainOverlays = (
-    <PersistentTerminal cwd={currentCwd} onAddSelectionToChat={composer.addTerminalSelectionAttachment} />
-  )
-
   const overlays = (
     <>
-      {!isSecondaryWindow() && <DesktopInstallOverlay />}
-      {!isSecondaryWindow() && (
-        <DesktopOnboardingOverlay
-          enabled={gatewayState === 'open'}
-          onCompleted={() => {
-            void refreshHermesConfig()
-            void refreshCurrentModel()
-            void queryClient.invalidateQueries({ queryKey: ['model-options'] })
-          }}
-          requestGateway={requestGateway}
-        />
-      )}
+      <DesktopInstallOverlay />
+      {/* One PTY-backed terminal mounted forever; <TerminalSlot /> placeholders
+          decide where it shows. Toggling fullscreen never rebuilds the shell. */}
+      <PersistentTerminal cwd={currentCwd} onAddSelectionToChat={composer.addTerminalSelectionAttachment} />
+      <DesktopOnboardingOverlay
+        enabled={gatewayState === 'open'}
+        onCompleted={() => {
+          void refreshHermesConfig()
+          void refreshCurrentModel()
+          void queryClient.invalidateQueries({ queryKey: ['model-options'] })
+        }}
+        requestGateway={requestGateway}
+      />
       <ModelPickerOverlay gateway={gatewayRef.current || undefined} onSelect={selectModel} />
       <ModelVisibilityOverlay gateway={gatewayRef.current || undefined} onOpenProviders={openProviderSettings} />
       <UpdatesOverlay />
       <GatewayConnectingOverlay />
       <BootFailureOverlay />
       <CommandPalette />
-      <SessionSwitcher />
 
       {settingsOpen && (
         <Suspense fallback={null}>
@@ -871,10 +721,7 @@ export function DesktopController() {
 
       {cronOpen && (
         <Suspense fallback={null}>
-          <CronView
-            onClose={closeOverlayToPreviousRoute}
-            onOpenSession={sessionId => navigate(sessionRoute(sessionId))}
-          />
+          <CronView onClose={closeOverlayToPreviousRoute} />
         </Suspense>
       )}
 
@@ -916,6 +763,12 @@ export function DesktopController() {
     />
   )
 
+  const takeoverTerminalView = (
+    <div className="relative flex h-full min-h-0 min-w-0 flex-col overflow-hidden bg-(--ui-chat-surface-background) pt-(--titlebar-height)">
+      <TerminalSlot />
+    </div>
+  )
+
   // Flipped layout mirrors the default: sessions sidebar → right, file
   // browser + preview rail → left. Same panes, swapped sides.
   const sidebarSide = panesFlipped ? 'right' : 'left'
@@ -942,8 +795,6 @@ export function DesktopController() {
     <Pane
       defaultOpen={false}
       disabled={!chatOpen}
-      forceCollapsed={narrowViewport}
-      hoverReveal
       id="file-browser"
       key="file-browser"
       maxWidth={FILE_BROWSER_MAX_WIDTH}
@@ -960,56 +811,30 @@ export function DesktopController() {
     </Pane>
   )
 
-  const terminalPane = (
-    <Pane
-      defaultOpen
-      disabled={!terminalSidebarOpen}
-      divider
-      id="terminal-sidebar"
-      key="terminal-sidebar"
-      maxWidth="80vw"
-      minWidth="22vw"
-      resizable
-      side={railSide}
-      width="42vw"
-    >
-      <div className="relative flex h-full min-h-0 min-w-0 flex-col overflow-hidden bg-(--ui-editor-surface-background) pt-(--titlebar-height)">
-        <TerminalSlot />
-      </div>
-    </Pane>
-  )
-
   return (
     <AppShell
       leftStatusbarItems={leftStatusbarItems}
       leftTitlebarTools={titlebarToolGroups.flat.left}
-      mainOverlays={mainOverlays}
       onOpenSettings={openSettings}
       overlays={overlays}
-      previewPaneOpen={chatOpen && Boolean(previewTarget || filePreviewTarget)}
       statusbarItems={statusbarItems}
-      terminalPaneOpen={terminalSidebarOpen}
       titlebarTools={titlebarToolGroups.flat.right}
     >
-      {!isSecondaryWindow() && (
-        <Pane
-          forceCollapsed={narrowViewport}
-          hoverReveal
-          id="chat-sidebar"
-          maxWidth={SIDEBAR_MAX_WIDTH}
-          minWidth={SIDEBAR_DEFAULT_WIDTH}
-          onOverlayActiveChange={setSidebarOverlayMounted}
-          resizable
-          side={sidebarSide}
-          width={`${SIDEBAR_DEFAULT_WIDTH}px`}
-        >
-          {sidebar}
-        </Pane>
-      )}
+      <Pane
+        disabled={terminalTakeoverActive}
+        id="chat-sidebar"
+        maxWidth={SIDEBAR_MAX_WIDTH}
+        minWidth={SIDEBAR_DEFAULT_WIDTH}
+        resizable
+        side={sidebarSide}
+        width={`${SIDEBAR_DEFAULT_WIDTH}px`}
+      >
+        {sidebar}
+      </Pane>
       <PaneMain>
         <Routes>
-          <Route element={chatView} index />
-          <Route element={chatView} path=":sessionId" />
+          <Route element={terminalTakeoverActive ? takeoverTerminalView : chatView} index />
+          <Route element={terminalTakeoverActive ? takeoverTerminalView : chatView} path=":sessionId" />
           <Route
             element={
               <Suspense fallback={null}>
@@ -1046,13 +871,11 @@ export function DesktopController() {
       </PaneMain>
       {/*
         Order within a side maps to column order. Default (rail on the right):
-        main | terminal | preview | file-browser. Flipped (rail on the left):
-        mirror to file-browser | preview | terminal | main so terminal stays
-        adjacent to the chat.
+        main | preview | file-browser. Flipped (rail on the left): mirror it to
+        file-browser | preview | main so preview stays adjacent to the chat.
       */}
-      {panesFlipped ? fileBrowserPane : terminalPane}
-      {previewPane}
-      {panesFlipped ? terminalPane : fileBrowserPane}
+      {panesFlipped ? fileBrowserPane : previewPane}
+      {panesFlipped ? previewPane : fileBrowserPane}
     </AppShell>
   )
 }

apps/desktop/src/app/floating-hud.ts

@@ -1,22 +0,0 @@
-// Shared chrome for the top-center floating HUDs (command palette + session
-// switcher). They pin just under the title bar, centered, and lean on a crisp
-// border + shadow to separate from the app — no dimming/blurring backdrop.
-// Each caller layers on its own z-index, width, and overflow.
-export const HUD_POSITION = 'fixed left-1/2 top-3 -translate-x-1/2'
-
-// Matches the app's borderless-overlay surface (dialog, keybind panel, …):
-// hairline `--stroke-nous` paired with the soft `--shadow-nous` float.
-export const HUD_SURFACE = 'rounded-xl border border-(--stroke-nous) bg-(--ui-chat-bubble-background) shadow-nous'
-
-// One row/text size for both HUDs (compact — two notches under `text-sm`).
-export const HUD_TEXT = 'text-xs'
-
-// Shared item layout + padding for both HUDs. Tight vertical rhythm so rows
-// don't feel chunky; overrides the shadcn `CommandItem` default (`px-2 py-1.5`).
-export const HUD_ITEM = 'gap-2 px-2 py-1'
-
-// Section headings styled like the sidebar panel labels: brand-tinted, uppercase,
-// tightly tracked — plain text, no sticky chrome bar. Targets the cmdk group
-// heading via the universal-descendant variant.
-export const HUD_HEADING =
-  '**:[[cmdk-group-heading]]:static **:[[cmdk-group-heading]]:bg-transparent **:[[cmdk-group-heading]]:px-2.5 **:[[cmdk-group-heading]]:pb-1 **:[[cmdk-group-heading]]:pt-2.5 **:[[cmdk-group-heading]]:text-[0.64rem] **:[[cmdk-group-heading]]:font-semibold **:[[cmdk-group-heading]]:uppercase **:[[cmdk-group-heading]]:tracking-[0.16em] **:[[cmdk-group-heading]]:text-(--theme-primary)'

apps/desktop/src/app/gateway/hooks/use-gateway-boot.ts

@@ -29,7 +29,6 @@ import {
   $connection,
   $sessions,
   $workingSessionIds,
-  ensureDefaultWorkspaceCwd,
   setConnection,
   setSessionsLoading
 } from '@/store/session'
@@ -121,13 +120,6 @@ export function useGatewayBoot({
       reconnecting = true
 
       try {
-        // Drop a stale REMOTE backend cache before re-dialing. After sleep/wake a
-        // remote backend can become unreachable, but it has no child process
-        // whose 'exit' would clear the main process's cached descriptor — without
-        // this the renderer re-dials the same dead endpoint forever and stays on
-        // "Starting Hermes…". The probe is a no-op for a healthy or local backend.
-        await desktop.revalidateConnection?.().catch(() => undefined)
-
         const conn = await desktop.getConnection($activeGatewayProfile.get())
 
         if (cancelled) {
@@ -226,15 +218,6 @@ export function useGatewayBoot({
         reconnectAttempt = 0
         reauthNotified = false
         clearReconnectTimer()
-
-        // A revalidate-driven reconnect can rebuild the backend in place when the
-        // cached remote was found dead, which re-drives the boot-progress overlay.
-        // Unlike the initial boot, nothing calls completeDesktopBoot() afterwards,
-        // so dismiss it here once we're open again — otherwise the overlay sticks
-        // at ~94%. A no-op on a normal (non-rebuild) reconnect.
-        if (bootCompleted) {
-          completeDesktopBoot()
-        }
       } else if (bootCompleted && (st === 'closed' || st === 'error')) {
         // The socket dropped after a healthy boot (typically sleep/wake). Try
         // to bring it back instead of leaving the composer stuck disabled.
@@ -352,7 +335,6 @@ export function useGatewayBoot({
           message: translateNow('boot.steps.loadingSettings'),
           progress: 97
         })
-        await ensureDefaultWorkspaceCwd()
         await callbacksRef.current.refreshHermesConfig()
 
         if (cancelled) {

apps/desktop/src/app/hooks/use-keybinds.ts

@@ -1,268 +0,0 @@
-import { useEffect, useRef } from 'react'
-import { useNavigate } from 'react-router-dom'
-
-import { $terminalTakeover, setTerminalTakeover } from '@/app/right-sidebar/store'
-import { PANE_TOGGLE_REVEAL_EVENT } from '@/components/pane-shell'
-import { matchesQuery } from '@/hooks/use-media-query'
-import { PROFILE_SLOT_COUNT, SESSION_SLOT_COUNT } from '@/lib/keybinds/actions'
-import { comboAllowedInInput, comboFromEvent, isEditableTarget } from '@/lib/keybinds/combo'
-import { toggleCommandPalette } from '@/store/command-palette'
-import { $capture, $comboIndex, endCapture, setBinding, toggleKeybindPanel } from '@/store/keybinds'
-import {
-  CHAT_SIDEBAR_PANE_ID,
-  FILE_BROWSER_PANE_ID,
-  requestSessionSearchFocus,
-  setFileBrowserOpen,
-  toggleFileBrowserOpen,
-  togglePanesFlipped,
-  toggleSidebarOpen
-} from '@/store/layout'
-import {
-  $newChatProfile,
-  cycleProfile,
-  requestProfileCreate,
-  switchProfileToSlot,
-  switchToDefaultProfile,
-  toggleShowAllProfiles
-} from '@/store/profile'
-import { setModelPickerOpen } from '@/store/session'
-import {
-  $switcherOpen,
-  closeSwitcher,
-  commitOnCtrlUp,
-  onSwitcherTabDown,
-  onSwitcherTabUp,
-  openOrAdvanceSwitcher,
-  slotSessionId,
-  switcherActive,
-  switcherJustClosed
-} from '@/store/session-switcher'
-import { useTheme } from '@/themes/context'
-
-import { requestComposerFocus } from '../chat/composer/focus'
-import { SIDEBAR_COLLAPSE_MEDIA_QUERY } from '../layout-constants'
-import {
-  AGENTS_ROUTE,
-  ARTIFACTS_ROUTE,
-  CRON_ROUTE,
-  MESSAGING_ROUTE,
-  PROFILES_ROUTE,
-  sessionRoute,
-  SETTINGS_ROUTE,
-  SKILLS_ROUTE
-} from '../routes'
-
-export interface KeybindRuntimeDeps {
-  /** Open/close the command center overlay (sessions / system / usage). */
-  toggleCommandCenter: () => void
-  /** Drop to a fresh new-session draft. */
-  startFreshSession: () => void
-  /** Pin/unpin the active session. */
-  toggleSelectedPin: () => void
-}
-
-type HandlerMap = Record<string, () => void>
-
-// Mount once near the top of the app. Owns the single global keydown listener
-// for every rebindable hotkey: it runs the matched action, or — while capture
-// mode is active (edit overlay / panel rebind) — records the pressed combo.
-export function useKeybinds(deps: KeybindRuntimeDeps): void {
-  const navigate = useNavigate()
-  const { resolvedMode, setMode } = useTheme()
-
-  // Keep the latest closures without re-subscribing the listener.
-  const handlersRef = useRef<HandlerMap>({})
-  const commitSwitcherRef = useRef<() => void>(() => {})
-
-  const profileSwitchHandlers: HandlerMap = {}
-
-  for (let slot = 1; slot <= PROFILE_SLOT_COUNT; slot += 1) {
-    profileSwitchHandlers[`profile.switch.${slot}`] = () => switchProfileToSlot(slot)
-  }
-
-  const goToSession = (sessionId: null | string) => {
-    if (sessionId) {
-      navigate(sessionRoute(sessionId))
-    }
-  }
-
-  // ^N jumps straight to the Nth recent session and dismisses the switcher.
-  const sessionSlotHandlers: HandlerMap = {}
-
-  for (let slot = 1; slot <= SESSION_SLOT_COUNT; slot += 1) {
-    sessionSlotHandlers[`session.slot.${slot}`] = () => {
-      closeSwitcher()
-      goToSession(slotSessionId(slot))
-    }
-  }
-
-  commitSwitcherRef.current = () => goToSession(commitOnCtrlUp())
-
-  const stepSession = (direction: 1 | -1) => {
-    onSwitcherTabDown()
-    goToSession(openOrAdvanceSwitcher(direction))
-  }
-
-  const showFiles = () => {
-    setFileBrowserOpen(true)
-    setTerminalTakeover(false)
-  }
-
-  handlersRef.current = {
-    'keybinds.openPanel': toggleKeybindPanel,
-
-    'composer.focus': () => requestComposerFocus('main'),
-    'composer.modelPicker': () => setModelPickerOpen(true),
-
-    'nav.commandPalette': toggleCommandPalette,
-    'nav.commandCenter': deps.toggleCommandCenter,
-    'nav.settings': () => navigate(SETTINGS_ROUTE),
-    'nav.profiles': () => navigate(PROFILES_ROUTE),
-    'nav.skills': () => navigate(SKILLS_ROUTE),
-    'nav.messaging': () => navigate(MESSAGING_ROUTE),
-    'nav.artifacts': () => navigate(ARTIFACTS_ROUTE),
-    'nav.cron': () => navigate(CRON_ROUTE),
-    'nav.agents': () => navigate(AGENTS_ROUTE),
-
-    'session.new': () => {
-      // Match the sidebar New Session button. A plain keyboard new chat should
-      // target the current live profile, not a stale per-profile quick-create
-      // selection from a prior action.
-      $newChatProfile.set(null)
-      deps.startFreshSession()
-      window.dispatchEvent(new CustomEvent('hermes:new-session-shortcut'))
-    },
-    'session.next': () => stepSession(1),
-    'session.prev': () => stepSession(-1),
-    ...sessionSlotHandlers,
-    'session.focusSearch': requestSessionSearchFocus,
-    'session.togglePin': deps.toggleSelectedPin,
-
-    'view.toggleSidebar': () => {
-      if (matchesQuery(SIDEBAR_COLLAPSE_MEDIA_QUERY)) {
-        window.dispatchEvent(new CustomEvent(PANE_TOGGLE_REVEAL_EVENT, { detail: { id: CHAT_SIDEBAR_PANE_ID } }))
-      } else {
-        toggleSidebarOpen()
-      }
-    },
-    'view.toggleRightSidebar': () => {
-      if (matchesQuery(SIDEBAR_COLLAPSE_MEDIA_QUERY)) {
-        window.dispatchEvent(new CustomEvent(PANE_TOGGLE_REVEAL_EVENT, { detail: { id: FILE_BROWSER_PANE_ID } }))
-      } else {
-        toggleFileBrowserOpen()
-      }
-    },
-    'view.showFiles': showFiles,
-    'view.showTerminal': () => setTerminalTakeover(!$terminalTakeover.get()),
-    'view.flipPanes': togglePanesFlipped,
-
-    'appearance.toggleMode': () => setMode(resolvedMode === 'dark' ? 'light' : 'dark'),
-
-    'profile.default': switchToDefaultProfile,
-    ...profileSwitchHandlers,
-    'profile.next': () => cycleProfile(1),
-    'profile.prev': () => cycleProfile(-1),
-    'profile.toggleAll': toggleShowAllProfiles,
-    'profile.create': requestProfileCreate
-  }
-
-  useEffect(() => {
-    const onKeyDown = (event: KeyboardEvent) => {
-      // Capture mode: the next real key becomes the binding. Swallow everything
-      // so e.g. ⌘K rebinds instead of opening the palette.
-      const capturing = $capture.get()
-
-      if (capturing) {
-        event.preventDefault()
-        event.stopPropagation()
-
-        if (event.key === 'Escape') {
-          endCapture()
-
-          return
-        }
-
-        const combo = comboFromEvent(event)
-
-        if (!combo) {
-          return
-        }
-
-        setBinding(capturing, [combo])
-        endCapture()
-
-        return
-      }
-
-      // While the session switcher is up, Esc abandons it (stay put) before any
-      // combo dispatch — ⌃Tab keeps stepping through the existing handler.
-      if (switcherActive() && event.key === 'Escape') {
-        event.preventDefault()
-        event.stopPropagation()
-        closeSwitcher()
-
-        return
-      }
-
-      const combo = comboFromEvent(event)
-
-      if (!combo) {
-        return
-      }
-
-      const actionId = $comboIndex.get().get(combo)
-
-      if (!actionId) {
-        return
-      }
-
-      if (isEditableTarget(event.target) && !comboAllowedInInput(combo)) {
-        return
-      }
-
-      const handler = handlersRef.current[actionId]
-
-      if (!handler) {
-        return
-      }
-
-      event.preventDefault()
-      handler()
-    }
-
-    // Mac-app-switcher commit: lifting Ctrl with the overlay open lands on the
-    // highlighted session. A window blur (Cmd+Tab away mid-switch) cancels so
-    // the overlay never gets stranded waiting for a keyup that never comes.
-    const onKeyUp = (event: KeyboardEvent) => {
-      if (event.key === 'Tab') {
-        onSwitcherTabUp()
-      }
-
-      if (event.key === 'Control') {
-        commitSwitcherRef.current()
-      }
-    }
-
-    const onBlur = () => switcherActive() && closeSwitcher()
-
-    // Swallow trailing contextmenu after Ctrl+click commit (Electron main menu).
-    const onContextMenu = (event: MouseEvent) => {
-      if ($switcherOpen.get() || switcherJustClosed()) {
-        event.preventDefault()
-        event.stopPropagation()
-      }
-    }
-
-    window.addEventListener('keydown', onKeyDown, { capture: true })
-    window.addEventListener('keyup', onKeyUp, { capture: true })
-    window.addEventListener('blur', onBlur)
-    window.addEventListener('contextmenu', onContextMenu, { capture: true })
-
-    return () => {
-      window.removeEventListener('keydown', onKeyDown, { capture: true })
-      window.removeEventListener('keyup', onKeyUp, { capture: true })
-      window.removeEventListener('blur', onBlur)
-      window.removeEventListener('contextmenu', onContextMenu, { capture: true })
-    }
-  }, [])
-}

apps/desktop/src/app/layout-constants.ts

@@ -11,9 +11,3 @@ export const PAGE_INSET_X = 'px-[clamp(1.25rem,4vw,4rem)]'
 // Matching negative inline-margin to bleed an element (e.g. a sticky header bar)
 // out to the gutter edges before re-applying PAGE_INSET_X.
 export const PAGE_INSET_NEG_X = '-mx-[clamp(1.25rem,4vw,4rem)]'
-
-// Below this viewport width a docked sidebar leaves no room for content, so both
-// rails auto-collapse into the hover-reveal overlay. Single source of truth for
-// the responsive collapse point.
-export const SIDEBAR_COLLAPSE_BREAKPOINT_PX = 768
-export const SIDEBAR_COLLAPSE_MEDIA_QUERY = `(max-width: ${SIDEBAR_COLLAPSE_BREAKPOINT_PX}px)`

apps/desktop/src/app/messaging/index.tsx

@@ -449,7 +449,7 @@ function PlatformDetail({
           {hiddenCount > 0 && (
             <section>
               <button
-                className="flex w-full items-center justify-between gap-2 py-0.5 text-left text-[0.7rem] font-semibold uppercase tracking-[0.14em] text-muted-foreground transition-colors hover:text-foreground"
+                className="flex w-full items-center justify-between gap-2 rounded-lg px-1 py-1 text-left text-xs font-semibold uppercase tracking-[0.14em] text-muted-foreground hover:text-foreground"
                 onClick={() => setShowAdvanced(value => !value)}
                 type="button"
               >
@@ -477,13 +477,17 @@ function PlatformDetail({
 
       <footer className="bg-(--ui-chat-surface-background) px-5 py-2.5">
         <div className="mx-auto flex max-w-2xl flex-wrap items-center gap-2">
-          <Switch
-            aria-label={platform.enabled ? m.disableAria(platform.name) : m.enableAria(platform.name)}
-            checked={platform.enabled}
-            disabled={saving === `enabled:${platform.id}`}
-            onCheckedChange={onToggle}
-            size="xs"
-          />
+          <label className="flex shrink-0 items-center gap-2 rounded-md border border-(--ui-stroke-tertiary) bg-(--ui-bg-quinary) px-2.5 py-1.5 text-[length:var(--conversation-text-font-size)]">
+            <Switch
+              aria-label={platform.enabled ? m.disableAria(platform.name) : m.enableAria(platform.name)}
+              checked={platform.enabled}
+              disabled={saving === `enabled:${platform.id}`}
+              onCheckedChange={onToggle}
+            />
+            <span className="text-xs font-medium text-muted-foreground">
+              {platform.enabled ? m.enabled : m.disabled}
+            </span>
+          </label>
 
           <div className="ml-auto flex items-center gap-2">
             {hasEdits && <span className="text-xs text-muted-foreground">{m.unsavedChanges}</span>}

apps/desktop/src/app/messaging/platform-icon.tsx

@@ -28,17 +28,15 @@ import { cn } from '@/lib/utils'
 type IconKind = 'brand' | 'generic'
 
 interface PlatformIconSpec {
-  Icon?: ComponentType<SVGProps<SVGSVGElement>>
+  Icon: ComponentType<SVGProps<SVGSVGElement>>
   color: string
   kind: IconKind
-  monogram?: string
 }
 
 const PLATFORM_ICONS: Record<string, PlatformIconSpec> = {
   telegram: { Icon: SiTelegram, color: '#26A5E4', kind: 'brand' },
   discord: { Icon: SiDiscord, color: '#5865F2', kind: 'brand' },
   // Slack removed from Simple Icons by Salesforce request — letter monogram.
-  slack: { color: '#4A154B', kind: 'brand', monogram: 'S' },
   mattermost: { Icon: SiMattermost, color: '#0058CC', kind: 'brand' },
   matrix: { Icon: SiMatrix, color: '#000000', kind: 'brand' },
   signal: { Icon: SiSignal, color: '#3A76F0', kind: 'brand' },
@@ -89,7 +87,7 @@ export function PlatformAvatar({ className, platformId, platformName }: Platform
         color
       }}
     >
-      {Icon ? <Icon className="size-3.5" /> : spec.monogram || platformName.charAt(0).toUpperCase()}
+      <Icon className="size-3.5" />
     </span>
   )
 }

apps/desktop/src/app/overlays/overlay-search-input.tsx

@@ -1,6 +1,7 @@
 import type { RefObject } from 'react'
 
 import { SearchField } from '@/components/ui/search-field'
+import { cn } from '@/lib/utils'
 
 interface OverlaySearchInputProps {
   containerClassName?: string
@@ -11,7 +12,6 @@ interface OverlaySearchInputProps {
   value: string
 }
 
-// Borderless underline search — matches the tools/skills page (PageSearchShell).
 export function OverlaySearchInput({
   containerClassName,
   inputRef,
@@ -22,7 +22,11 @@ export function OverlaySearchInput({
 }: OverlaySearchInputProps) {
   return (
     <SearchField
-      containerClassName={containerClassName}
+      containerClassName={cn(
+        'rounded-md border border-(--ui-stroke-tertiary) bg-(--ui-bg-quinary) px-2 shadow-sm focus-within:border-(--ui-stroke-secondary)',
+        containerClassName
+      )}
+      inputClassName="h-8 text-[0.8125rem]"
       inputRef={inputRef}
       loading={loading}
       onChange={onChange}

apps/desktop/src/app/overlays/overlay-split-layout.tsx

@@ -1,7 +1,5 @@
 import type { ReactNode } from 'react'
 
-import { Button } from '@/components/ui/button'
-import { Codicon } from '@/components/ui/codicon'
 import type { IconComponent } from '@/lib/icons'
 import { cn } from '@/lib/utils'
 
@@ -75,31 +73,6 @@ export function OverlayMain({ children, className }: OverlayMainProps) {
   )
 }
 
-// Boxless "+ New …" action that tops an OverlaySidebar list (profiles, cron, …).
-// The text variant underlines on hover, which also strokes the icon glyph — so
-// we keep the button itself underline-free and underline only the label span.
-export function OverlayNewButton({
-  icon = 'add',
-  label,
-  onClick
-}: {
-  icon?: string
-  label: string
-  onClick: () => void
-}) {
-  return (
-    <Button
-      className="group mb-1 w-full justify-start gap-2 text-muted-foreground hover:bg-transparent hover:text-foreground"
-      onClick={onClick}
-      size="sm"
-      variant="ghost"
-    >
-      <Codicon name={icon} />
-      <span className="underline-offset-4 group-hover:underline">{label}</span>
-    </Button>
-  )
-}
-
 export function OverlayNavItem({ active, icon: Icon, label, nested, onClick, trailing }: OverlayNavItemProps) {
   return (
     <button