fix(codex): surface error code in Responses 'failed' status errors

When a Codex Responses turn ends with status=failed, the response carries
the failure details under `response.error` as
`{code, message, param, ...}`. The previous extractor pulled only
`message`, so users seeing a rate-limit failure got a bare "Slow down"
string indistinguishable from a generic stream truncation; an
internal_error with empty message degraded to a dict dump
("{'code': 'internal_error', 'message': ''}").

Extract a `_format_responses_error()` helper that:
- prefixes `code` when both code and message are present
  (e.g. 'rate_limit_exceeded: Slow down')
- falls back to the bare `code` when message is empty
- accepts both dict and attribute-style payloads (SDK and JSON-RPC paths)
- preserves the prior status-only fallback when no error payload exists

Apply the same helper at the sibling site in
`codex_app_server_session.run_turn()` so codex-CLI subprocess turn
failures get the same treatment.

Tests:
- 8 new unit tests for `_format_responses_error` covering both shapes,
  empty/missing fields, non-string fields, and the status-only fallback.
- 2 regression tests on `_normalize_codex_response` for failed status
  with and without a code, asserting the exact RuntimeError message.
- All 3603 tests in tests/agent/ pass.

Adapted from anomalyco/opencode#28757.

MANIFEST.in

@@ -1,9 +1,4 @@
 graft skills
 graft optional-skills
-# Bundled plugin manifests (plugin.yaml / plugin.yml). Without these the
-# PluginManager scan (hermes_cli/plugins.py) finds zero plugins on installs
-# built from the sdist (e.g. Homebrew, downstream packagers). package-data
-# below covers the wheel; this covers the sdist. See #34034 / #28149.
-recursive-include plugins plugin.yaml plugin.yml
 global-exclude __pycache__
 global-exclude *.py[cod]

RELEASE_v0.15.1.md

@@ -1,110 +0,0 @@
-# Hermes Agent v0.15.1 (v2026.5.29)
-
-**Release Date:** May 29, 2026
-**Since v0.15.0:** 28 commits · 21 merged PRs · hotfix release · 9 contributors
-
-> **The Patch Release.** A same-day hotfix for v0.15.0. Headline fix: the dashboard infinite-reload loop that hit anyone running v0.15.0 in loopback mode (Docker, hosted Hermes, fresh installs). A handful of other v0.15.0 follow-ups go along for the ride — kanban worker SIGTERM, `/model` picker unification, `/yolo` session bypass, the full 19,932-entry skills.sh catalog, `.md` media delivery restoration, gateway probe-stepdown safety, web-URL redaction passthrough, kanban worker vision on referenced images, hindsight observation-default. Docker users get an explicit `--insecure` opt-in env var (no more bind-host inference), MCP server bare-command PATH resolution, and arm64 PR-build cache fixes.
-
----
-
-## ✨ Highlights
-
-- **Dashboard 401 reload loop fixed** — In loopback mode the dashboard's identity probe (`/api/auth/me`) returns 401 by design, but v0.15.0's stale-token reload guard treated every 401 as a rotated session token and full-page-reloaded to pick up a fresh one. Every successful sibling call cleared the one-shot reload guard, so the page reload-looped forever (Firefox: "Navigated to /sessions" storm; Chrome: React re-render storm). Fix adds an `allowUnauthorized` opt-out to `fetchJSON` that skips only the loopback stale-token reload — 401 still throws so `AuthWidget` swallows it, gated-mode `login_url` redirects are unaffected. Closes [#34206](https://github.com/NousResearch/hermes-agent/issues/34206), [#34202](https://github.com/NousResearch/hermes-agent/issues/34202). ([#30698](https://github.com/NousResearch/hermes-agent/pull/30698) — @austinpickett)
-
-- **Docker dashboard `--insecure` is now an explicit env opt-in, never derived from bind host** — Previously the Docker entrypoint inferred `--insecure` when the dashboard bound to a non-loopback host. That conflated "I want LAN access" with "I want to disable the same-origin guard." The fix splits them: bind host is bind host, and disabling the dashboard's loopback auth requires an explicit `HERMES_DASHBOARD_INSECURE=1`. Existing setups that genuinely wanted insecure binding must now set the env var. ([#34188](https://github.com/NousResearch/hermes-agent/pull/34188), [#34204](https://github.com/NousResearch/hermes-agent/pull/34204) — @benbarclay)
-
-- **MCP bare command resolution under Docker** — MCP servers configured with bare commands (`npx`, `npm`, `node`) now resolve against `/usr/local/bin` so they actually launch inside the Docker image where those binaries live. v0.15.0 left these failing silently in containers when the agent's effective PATH didn't include the Node toolchain location. ([#34186](https://github.com/NousResearch/hermes-agent/pull/34186) — @benbarclay)
-
-- **Skills page sidebar / source pills restored** — A stale `useMemo` dependency in the new dashboard skills page collapsed the source pills and category sidebar to "All" only. Fixed; both surfaces now reflect the live catalog state. ([#34194](https://github.com/NousResearch/hermes-agent/pull/34194))
-
-- **Kanban worker can be killed again** — `SIGTERM` on a kanban worker was being absorbed by an intermediate process and the worker stayed running. Closes [#28181](https://github.com/NousResearch/hermes-agent/issues/28181). ([#34045](https://github.com/NousResearch/hermes-agent/pull/34045))
-
-- **Full skills.sh catalog (858 → 19,932 entries)** — The skills hub page was pulling a partial paginated catalog. The fetch now walks the sitemap, so all 19,932 skills.sh entries surface in the picker instead of just the first 858. ([#34025](https://github.com/NousResearch/hermes-agent/pull/34025))
-
----
-
-## 🐛 Bug Fixes
-
-### Dashboard / Web
-
-- **`/api/auth/me` 401 no longer triggers reload loop** in loopback mode — ([#30698](https://github.com/NousResearch/hermes-agent/pull/30698) — @austinpickett)
-- **Skills page source pills + category sidebar restored** — stale `useMemo` dep ([#34194](https://github.com/NousResearch/hermes-agent/pull/34194))
-
-### Docker
-
-- **`--insecure` is now explicit opt-in via env var**, not derived from bind host ([#34188](https://github.com/NousResearch/hermes-agent/pull/34188) — @benbarclay)
-- **Dashboard test suite repaired** to match the insecure-opt-in fix ([#34204](https://github.com/NousResearch/hermes-agent/pull/34204) — @benbarclay)
-- **arm64 PR builds skip the GHA cache** to avoid cache-thrash on cross-arch builders ([#33704](https://github.com/NousResearch/hermes-agent/pull/33704) — @BROCCOLO1D)
-
-### MCP
-
-- **Bare `npx`/`npm`/`node` resolve against `/usr/local/bin`** for Docker compatibility ([#34186](https://github.com/NousResearch/hermes-agent/pull/34186) — @benbarclay)
-
-### Kanban
-
-- **Worker SIGTERM actually terminates the process** ([#34045](https://github.com/NousResearch/hermes-agent/pull/34045))
-- **Workers receive images referenced in task bodies** for vision-capable models ([#34210](https://github.com/NousResearch/hermes-agent/pull/34210))
-
-### Gateway
-
-- **`.md` files deliver again** — media-delivery validation defaults to denylist-only instead of an overly-narrow allowlist ([#34022](https://github.com/NousResearch/hermes-agent/pull/34022))
-- **Probe stepdown safety** — on a context-overflow without an explicit provider context limit, the agent no longer steps down to a smaller model based on an unknown ceiling (salvage of [#33673](https://github.com/NousResearch/hermes-agent/pull/33673)) ([#33826](https://github.com/NousResearch/hermes-agent/pull/33826))
-
-### CLI
-
-- **`/yolo` mid-session enables the per-session bypass** instead of just toggling the env var (which the running agent had already snapshotted) ([#33931](https://github.com/NousResearch/hermes-agent/pull/33931) — @kshitijk4poor)
-- **`/model` and `hermes model` show the same list**, plus disk cache for picker startup ([#33867](https://github.com/NousResearch/hermes-agent/pull/33867))
-
-### Skills
-
-- **Full skills.sh catalog via sitemap** — 858 → 19,932 entries ([#34025](https://github.com/NousResearch/hermes-agent/pull/34025))
-
-### Redaction
-
-- **Web URLs pass through unchanged** — the redactor was eating query parameters that looked credential-shaped ([#34029](https://github.com/NousResearch/hermes-agent/pull/34029))
-
----
-
-## ✨ Small Features
-
-- **Hindsight default narrowed to observation-only** for `recall_types` — tool path is also narrowed ([#34079](https://github.com/NousResearch/hermes-agent/pull/34079) — @nicoloboschi, follow-up [#34091](https://github.com/NousResearch/hermes-agent/pull/4df62d239e38bf8c212a595721c9c01e176f6c3a) — @kshitijk4poor)
-- **Memory providers receive completed-turn message context** — salvage of [#28065](https://github.com/NousResearch/hermes-agent/pull/28065) ([#34097](https://github.com/NousResearch/hermes-agent/pull/34097) — @kshitijk4poor, credit to @devwdave)
-
----
-
-## 📚 Documentation
-
-- **`--no-supervise` / `HERMES_GATEWAY_NO_SUPERVISE` documented** in the reference docs (follow-up to [#33583](https://github.com/NousResearch/hermes-agent/pull/33583)) ([#33751](https://github.com/NousResearch/hermes-agent/pull/33751) — @r266-tech)
-
----
-
-## 🛠️ Infrastructure
-
-- **Vercel deploy workflow accepts `workflow_dispatch`** so docs deploys can be manually triggered ([#34081](https://github.com/NousResearch/hermes-agent/pull/34081))
-- **`@nous-research/ui` bumped to 0.18.2** (Nix `npmDepsHash` also updated to match) ([#34193](https://github.com/NousResearch/hermes-agent/pull/34193) follow-ups — @austinpickett)
-
----
-
-## 👥 Contributors
-
-### Core
-- @teknium1
-
-### Community
-- @austinpickett — dashboard 401 reload-loop fix (the headline), `@nous-research/ui` bump, Nix `npmDepsHash` updates
-- @benbarclay — Docker `--insecure` opt-in, MCP bare-command resolution, dashboard test repair
-- @kshitijk4poor — `/yolo` session bypass, completed-turn memory context salvage, hindsight follow-up docs
-- @nicoloboschi — hindsight `recall_types` observation default
-- @BROCCOLO1D — arm64 PR build cache fix
-- @r266-tech — `--no-supervise` reference docs
-- @yangguangjin — probe stepdown safety (salvage of @yanghd's #33673)
-- @devwdave — completed-turn memory context (credited via salvage)
-- @andrewhosf — co-author
-
-### Issue Reporters (the 401 loop)
-- @routesmith ([#34206](https://github.com/NousResearch/hermes-agent/issues/34206))
-- @beeaton ([#34202](https://github.com/NousResearch/hermes-agent/issues/34202))
-
----
-
-**Full Changelog**: [v2026.5.28...v2026.5.29](https://github.com/NousResearch/hermes-agent/compare/v2026.5.28...v2026.5.29)

acp_registry/agent.json

@@ -1,20 +1,16 @@
 {
   "id": "hermes-agent",
   "name": "Hermes Agent",
-  "version": "0.15.2",
+  "version": "0.15.0",
   "description": "Self-improving open-source AI agent by Nous Research with ACP editor integration, persistent memory, skills, and rich tool support.",
   "repository": "https://github.com/NousResearch/hermes-agent",
   "website": "https://hermes-agent.nousresearch.com/docs/user-guide/features/acp",
-  "authors": [
-    "Nous Research"
-  ],
+  "authors": ["Nous Research"],
   "license": "MIT",
   "distribution": {
     "uvx": {
-      "package": "hermes-agent[acp]==0.15.2",
-      "args": [
-        "hermes-acp"
-      ]
+      "package": "hermes-agent[acp]==0.15.0",
+      "args": ["hermes-acp"]
     }
   }
 }

agent/codex_responses_adapter.py

@@ -980,6 +980,48 @@ def _extract_responses_reasoning_text(item: Any) -> str:
     return ""
 
 
+def _format_responses_error(error_obj: Any, response_status: str) -> str:
+    """Build a human-readable error string from a Responses ``response.error`` payload.
+
+    The OpenAI Responses API carries failure details under ``response.error``
+    on terminal ``response.failed`` events, in the shape
+    ``{"code": "rate_limit_exceeded", "message": "Slow down", "param": ...}``.
+    Earlier code only surfaced ``message``, which left users staring at bare
+    strings like ``"Slow down"`` while the failure mode (rate limit vs
+    context-length vs internal_error vs model-overloaded) was hidden in
+    ``code``. We now prefix ``code`` when both are present so consumers can
+    distinguish failure modes without parsing the bare message.
+
+    Falls back to ``code`` alone when ``message`` is empty, and to a stable
+    default referencing the response status when no error payload is
+    available at all. Adapted from anomalyco/opencode#28757.
+    """
+    # Pull code and message from either dict or attribute-style payloads.
+    code: Any = None
+    message: Any = None
+    if isinstance(error_obj, dict):
+        code = error_obj.get("code")
+        message = error_obj.get("message")
+    elif error_obj is not None:
+        code = getattr(error_obj, "code", None)
+        message = getattr(error_obj, "message", None)
+
+    code_str = str(code).strip() if isinstance(code, str) else (str(code).strip() if code else "")
+    message_str = str(message).strip() if isinstance(message, str) else (str(message).strip() if message else "")
+
+    if code_str and message_str:
+        return f"{code_str}: {message_str}"
+    if message_str:
+        return message_str
+    if code_str:
+        return code_str
+    if error_obj:
+        # Last-resort: stringify whatever the provider sent so it's at least
+        # visible in logs/UI rather than silently swallowed.
+        return str(error_obj)
+    return f"Responses API returned status '{response_status}'"
+
+
 # ---------------------------------------------------------------------------
 # Full response normalization
 # ---------------------------------------------------------------------------
@@ -1023,10 +1065,7 @@ def _normalize_codex_response(
 
     if response_status in {"failed", "cancelled"}:
         error_obj = getattr(response, "error", None)
-        if isinstance(error_obj, dict):
-            error_msg = error_obj.get("message") or str(error_obj)
-        else:
-            error_msg = str(error_obj) if error_obj else f"Responses API returned status '{response_status}'"
+        error_msg = _format_responses_error(error_obj, response_status)
         raise RuntimeError(error_msg)
 
     content_parts: List[str] = []

agent/image_routing.py

@@ -37,8 +37,6 @@ from __future__ import annotations
 import base64
 import logging
 import mimetypes
-import os
-import re
 from pathlib import Path
 from typing import Any, Dict, List, Optional, Tuple
 
@@ -48,102 +46,6 @@ logger = logging.getLogger(__name__)
 _VALID_MODES = frozenset({"auto", "native", "text"})
 
 
-# Image extensions used by extract_image_refs(). Kept tight on purpose — we
-# only auto-attach things the model can actually see. Documents/archives are
-# excluded because the gateway's broader extract_local_files() also routes
-# them differently (send_document), and we don't want to attach a PDF as a
-# vision part.
-_IMAGE_EXTS = (
-    ".png", ".jpg", ".jpeg", ".gif", ".webp", ".bmp", ".tiff", ".tif", ".heic",
-)
-_IMAGE_EXT_PATTERN = "|".join(e.lstrip(".") for e in _IMAGE_EXTS)
-
-# Absolute / home-relative local image path. Matches the same shape gateway's
-# extract_local_files() uses: anchors to ``~/`` or ``/``, ignores matches inside
-# URLs (the ``(?<![/:\w.])`` lookbehind), and case-insensitive on the extension.
-_LOCAL_IMAGE_PATH_RE = re.compile(
-    r"(?<![/:\w.])(?:~/|/)(?:[\w.\-]+/)*[\w.\-]+\.(?:" + _IMAGE_EXT_PATTERN + r")\b",
-    re.IGNORECASE,
-)
-
-# http(s) URL ending in an image extension (optionally followed by a
-# query string). Case-insensitive on the extension. Strict ``http(s)://``
-# scheme so we don't accidentally grab ``file://`` URLs or other shapes.
-_IMAGE_URL_RE = re.compile(
-    r"https?://[^\s<>\"']+?\.(?:" + _IMAGE_EXT_PATTERN + r")(?:\?[^\s<>\"']*)?",
-    re.IGNORECASE,
-)
-
-
-def extract_image_refs(text: str) -> Tuple[List[str], List[str]]:
-    """Scan free-form text for image references the model should see.
-
-    Returns ``(local_paths, urls)``:
-
-      * ``local_paths`` — absolute (``/``) or home-relative (``~/``) paths
-        whose suffix is an image extension AND whose expanded form exists
-        on disk as a file. Order-preserving, deduplicated.
-      * ``urls`` — ``http(s)://…`` URLs whose path ends in an image
-        extension (a ``?query`` is allowed after the extension).
-        Order-preserving, deduplicated.
-
-    Matches inside fenced code blocks (``` ``` ```) and inline backticks
-    (`` `…` ``) are skipped so that snippets pasted into a task body for
-    reference aren't mistaken for live attachments. This mirrors the
-    behaviour of ``gateway.platforms.base.BaseAdapter.extract_local_files``.
-
-    Local paths are validated against the filesystem; URLs are not
-    (the provider fetches them at request time).
-    """
-    if not isinstance(text, str) or not text:
-        return [], []
-
-    # Build spans covered by fenced code blocks and inline code so we can
-    # ignore references the author embedded purely as example text.
-    code_spans: list[tuple[int, int]] = []
-    for m in re.finditer(r"```[^\n]*\n.*?```", text, re.DOTALL):
-        code_spans.append((m.start(), m.end()))
-    for m in re.finditer(r"`[^`\n]+`", text):
-        code_spans.append((m.start(), m.end()))
-
-    def _in_code(pos: int) -> bool:
-        return any(s <= pos < e for s, e in code_spans)
-
-    local_paths: list[str] = []
-    seen_paths: set[str] = set()
-    for match in _LOCAL_IMAGE_PATH_RE.finditer(text):
-        if _in_code(match.start()):
-            continue
-        raw = match.group(0)
-        expanded = os.path.expanduser(raw)
-        try:
-            if not os.path.isfile(expanded):
-                continue
-        except OSError:
-            # ENAMETOOLONG / EINVAL on pathological inputs — skip rather than crash.
-            continue
-        if expanded in seen_paths:
-            continue
-        seen_paths.add(expanded)
-        local_paths.append(expanded)
-
-    urls: list[str] = []
-    seen_urls: set[str] = set()
-    for match in _IMAGE_URL_RE.finditer(text):
-        if _in_code(match.start()):
-            continue
-        url = match.group(0)
-        # Strip trailing punctuation that's almost certainly prose, not part
-        # of the URL (e.g. "see https://x.com/a.png." or "/a.png)").
-        url = url.rstrip(".,;:!?)]>")
-        if url in seen_urls:
-            continue
-        seen_urls.add(url)
-        urls.append(url)
-
-    return local_paths, urls
-
-
 # Strict YAML/JSON boolean coercion for capability overrides.
 #
 # ``bool("false")`` is True in Python because non-empty strings are truthy, so
@@ -418,29 +320,20 @@ def _file_to_data_url(path: Path) -> Optional[str]:
 def build_native_content_parts(
     user_text: str,
     image_paths: List[str],
-    image_urls: Optional[List[str]] = None,
 ) -> Tuple[List[Dict[str, Any]], List[str]]:
     """Build an OpenAI-style ``content`` list for a user turn.
 
     Shape:
       [{"type": "text", "text": "...\\n\\n[Image attached at: /local/path]"},
        {"type": "image_url", "image_url": {"url": "data:image/png;base64,..."}},
-       {"type": "image_url", "image_url": {"url": "https://example.com/a.png"}},
        ...]
 
-    Local paths are read from disk and embedded as base64 ``data:`` URLs.
-    Remote URLs (``http(s)://``) are passed through verbatim — the provider
-    fetches them server-side. The model still sees the pixels either way.
-
-    For each successfully attached image, a hint is appended to the text
-    part:
-
-      * local path → ``[Image attached at: <path>]``
-      * URL        → ``[Image attached: <url>]``
-
-    The hint gives the model a string handle so MCP/skill tools that take
-    an image path or URL argument can be invoked on the same image without
-    an extra round-trip. This parallels the text-mode hint produced by
+    The local path of each successfully attached image is appended to the
+    text part as ``[Image attached at: <path>]``. The model still sees the
+    pixels via the ``image_url`` part (full native vision); the path note
+    just gives it a string handle so MCP/skill tools that take an image
+    path or URL argument can be invoked on the same image without an
+    extra round-trip. This parallels the text-mode hint produced by
     ``Runner._enrich_message_with_vision`` (``vision_analyze using image_url:
     <path>``) so behaviour is consistent across both image input modes.
 
@@ -449,14 +342,12 @@ def build_native_content_parts(
     ceiling), the agent's retry loop transparently shrinks and retries
     once — see ``run_agent._try_shrink_image_parts_in_messages``.
 
-    Returns (content_parts, skipped). Skipped entries are local paths
-    that couldn't be read from disk; URLs are never skipped (they're
-    not validated here).
+    Returns (content_parts, skipped_paths). Skipped paths are files that
+    couldn't be read from disk and are NOT advertised in the path hints.
     """
     skipped: List[str] = []
     image_parts: List[Dict[str, Any]] = []
     attached_paths: List[str] = []
-    attached_urls: List[str] = []
 
     for raw_path in image_paths:
         p = Path(raw_path)
@@ -473,26 +364,16 @@ def build_native_content_parts(
         })
         attached_paths.append(str(raw_path))
 
-    for url in image_urls or []:
-        url = (url or "").strip()
-        if not url:
-            continue
-        image_parts.append({
-            "type": "image_url",
-            "image_url": {"url": url},
-        })
-        attached_urls.append(url)
-
     text = (user_text or "").strip()
 
     # If at least one image attached, build a single text part that combines
-    # the user's caption (or a neutral default) with one hint per image.
-    if attached_paths or attached_urls:
+    # the user's caption (or a neutral default) with one path hint per image.
+    if attached_paths:
         base_text = text or "What do you see in this image?"
-        hint_lines: List[str] = []
-        hint_lines.extend(f"[Image attached at: {p}]" for p in attached_paths)
-        hint_lines.extend(f"[Image attached: {u}]" for u in attached_urls)
-        combined_text = f"{base_text}\n\n" + "\n".join(hint_lines)
+        path_hints = "\n".join(
+            f"[Image attached at: {p}]" for p in attached_paths
+        )
+        combined_text = f"{base_text}\n\n{path_hints}"
         parts: List[Dict[str, Any]] = [{"type": "text", "text": combined_text}]
         parts.extend(image_parts)
         return parts, skipped
@@ -507,5 +388,4 @@ def build_native_content_parts(
 __all__ = [
     "decide_image_input_mode",
     "build_native_content_parts",
-    "extract_image_refs",
 ]

agent/transports/codex_app_server_session.py

@@ -31,6 +31,7 @@ import time
 from dataclasses import dataclass, field
 from typing import Any, Callable, Optional
 
+from agent.codex_responses_adapter import _format_responses_error
 from agent.redact import redact_sensitive_text
 from agent.transports.codex_app_server import (
     CodexAppServerClient,
@@ -581,7 +582,7 @@ class CodexAppServerSession:
                         (note.get("params") or {}).get("turn") or {}
                     ).get("error")
                     if err_obj:
-                        err_msg = err_obj.get("message") or str(err_obj)
+                        err_msg = _format_responses_error(err_obj, str(turn_status))
                         # If the turn failed for an auth/refresh reason,
                         # rewrite the error into a re-auth hint AND mark
                         # the session for retirement.

cli.py

@@ -15125,50 +15125,13 @@ def main(
     # Handle single query mode
     if query or image:
         query, single_query_images = _collect_query_images(query, image)
-        # Kanban workers spawn with ``hermes chat -q "work kanban task <id>"``;
-        # the actual task description lives in the task body. Mirror the
-        # gateway/CLI behaviour for inbound images by scanning the body for
-        # local image paths and http(s) image URLs and attaching them to the
-        # worker's first turn. Without this, users who paste a screenshot
-        # path or URL into a kanban task body never get it routed to the
-        # model's vision input.
-        single_query_image_urls: list[str] = []
-        _kanban_task_id = os.environ.get("HERMES_KANBAN_TASK", "").strip()
-        if _kanban_task_id:
-            try:
-                from hermes_cli import kanban_db as _kb
-                from agent.image_routing import extract_image_refs as _extract_refs
-
-                _conn = _kb.connect()
-                try:
-                    _task = _kb.get_task(_conn, _kanban_task_id)
-                finally:
-                    try:
-                        _conn.close()
-                    except Exception:
-                        pass
-                _body = getattr(_task, "body", "") if _task is not None else ""
-                if _body:
-                    _kb_paths, _kb_urls = _extract_refs(_body)
-                    if _kb_paths:
-                        # Dedupe against any --image the user already passed.
-                        _seen = {str(p) for p in single_query_images}
-                        for _p in _kb_paths:
-                            if _p not in _seen:
-                                _seen.add(_p)
-                                single_query_images.append(Path(_p))
-                    if _kb_urls:
-                        single_query_image_urls.extend(_kb_urls)
-            except Exception as _exc:
-                # Best-effort enrichment; never block worker startup on it.
-                logger.debug("kanban image-ref extraction failed: %s", _exc)
         if quiet:
             # Quiet mode: suppress banner, spinner, tool previews.
             # Only print the final response and parseable session info.
             cli.tool_progress_mode = "off"
             if cli._ensure_runtime_credentials():
                 effective_query: Any = query
-                if single_query_images or single_query_image_urls:
+                if single_query_images:
                     # Honour the same image-routing decision used by the
                     # interactive path. With a vision-capable model (incl.
                     # custom-provider models declared via
@@ -15197,26 +15160,19 @@ def main(
                             _parts, _skipped = _build_parts(
                                 query if isinstance(query, str) else "",
                                 [str(p) for p in single_query_images],
-                                image_urls=list(single_query_image_urls) or None,
                             )
                             if any(p.get("type") == "image_url" for p in _parts):
                                 effective_query = _parts
                             else:
                                 # All images unreadable — text fallback.
-                                # ``_preprocess_images_with_vision`` only knows
-                                # about local files; URLs would be lost there,
-                                # so keep the original query text intact when
-                                # only URLs were supplied.
-                                if single_query_images:
-                                    effective_query = cli._preprocess_images_with_vision(
-                                        query, single_query_images, announce=False,
-                                    )
-                        except Exception:
-                            if single_query_images:
                                 effective_query = cli._preprocess_images_with_vision(
                                     query, single_query_images, announce=False,
                                 )
-                    elif single_query_images:
+                        except Exception:
+                            effective_query = cli._preprocess_images_with_vision(
+                                query, single_query_images, announce=False,
+                            )
+                    else:
                         effective_query = cli._preprocess_images_with_vision(
                             query,
                             single_query_images,

hermes_cli/__init__.py

@@ -14,8 +14,8 @@ Provides subcommands for:
 import os
 import sys
 
-__version__ = "0.15.2"
-__release_date__ = "2026.5.29.2"
+__version__ = "0.15.0"
+__release_date__ = "2026.5.28"
 
 
 def _ensure_utf8():

nix/web.nix

@@ -4,7 +4,7 @@ let
   src = ../web;
   npmDeps = pkgs.fetchNpmDeps {
     inherit src;
-    hash = "sha256-HV0aISBVjwbGqDj8qQynSxGFrrZDzuYAW3D3lB/x3zo=";
+    hash = "sha256-6qhGuifHVtCeep1SiQdCUxBMr7UGhYpdMTvXhrQu/zA=";
   };
 
   npm = hermesNpmLib.mkNpmPassthru { folder = "web"; attr = "web"; pname = "hermes-web"; };

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "hermes-agent"
-version = "0.15.2"
+version = "0.15.0"
 description = "The self-improving AI agent — creates skills from experience, improves them during use, and runs anywhere"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -226,14 +226,6 @@ plugins = [
   "*/dashboard/manifest.json",
   "*/dashboard/dist/*",
   "*/dashboard/dist/**/*",
-  # Plugin discovery (hermes_cli/plugins.py) reads a plugin.yaml/plugin.yml
-  # manifest from each bundled plugin directory to register it. Wheels only
-  # carry files declared here, so without this glob the wheel ships every
-  # plugin's Python code but none of its manifests — the scan finds zero
-  # plugins and all gateway platforms fail with "No adapter available for
-  # <platform>" (#34034), web-search providers go missing (#28149), etc.
-  "**/plugin.yaml",
-  "**/plugin.yml",
 ]
 
 [tool.setuptools.packages.find]

tests/agent/test_codex_responses_adapter.py

@@ -1,6 +1,11 @@
 from types import SimpleNamespace
 
-from agent.codex_responses_adapter import _normalize_codex_response
+import pytest
+
+from agent.codex_responses_adapter import (
+    _format_responses_error,
+    _normalize_codex_response,
+)
 
 
 def test_normalize_codex_response_drops_transient_rs_tmp_reasoning_items():
@@ -61,3 +66,111 @@ def test_normalize_codex_response_treats_summary_only_reasoning_as_incomplete():
     assert assistant_message.content == ""
     assert assistant_message.reasoning == "still thinking"
     assert assistant_message.codex_reasoning_items is None
+
+
+# ---------------------------------------------------------------------------
+# _format_responses_error — adapted from anomalyco/opencode#28757.
+# Provider failures should surface BOTH the code (rate_limit_exceeded /
+# context_length_exceeded / internal_error / server_error) and the message,
+# so consumers can tell rate limits apart from context-length failures and
+# both apart from generic stream drops.
+# ---------------------------------------------------------------------------
+
+
+def test_format_responses_error_combines_code_and_message():
+    err = {"code": "rate_limit_exceeded", "message": "Slow down"}
+    assert _format_responses_error(err, "failed") == "rate_limit_exceeded: Slow down"
+
+
+def test_format_responses_error_message_only():
+    err = {"message": "Upstream model unavailable"}
+    assert _format_responses_error(err, "failed") == "Upstream model unavailable"
+
+
+def test_format_responses_error_code_only_when_message_empty():
+    # Some providers/proxies emit a code with an empty message body. We
+    # used to fall back to ``str(error_obj)`` — a dict dump — which leaked
+    # ``{'code': 'internal_error', 'message': ''}`` into chat output. Now
+    # the bare code is surfaced, which is the meaningful field.
+    err = {"code": "internal_error", "message": ""}
+    assert _format_responses_error(err, "failed") == "internal_error"
+
+
+def test_format_responses_error_code_only_when_message_missing():
+    err = {"code": "server_error"}
+    assert _format_responses_error(err, "failed") == "server_error"
+
+
+def test_format_responses_error_attribute_style_payload():
+    # SDK objects expose ``code``/``message`` as attributes rather than dict
+    # keys. The helper must accept both shapes since the Responses SDK
+    # returns SimpleNamespace-style objects on ``response.failed``.
+    err = SimpleNamespace(code="context_length_exceeded", message="too long")
+    assert _format_responses_error(err, "failed") == "context_length_exceeded: too long"
+
+
+def test_format_responses_error_falls_back_to_status_when_empty():
+    assert (
+        _format_responses_error(None, "failed")
+        == "Responses API returned status 'failed'"
+    )
+    assert (
+        _format_responses_error(None, "cancelled")
+        == "Responses API returned status 'cancelled'"
+    )
+
+
+def test_format_responses_error_stringifies_opaque_payload():
+    # Last-resort: a provider sent something that isn't a dict and has no
+    # code/message attributes. Surface its repr rather than swallow it
+    # silently — at least it's visible in logs.
+    assert _format_responses_error("opaque sentinel", "failed") == "opaque sentinel"
+
+
+def test_format_responses_error_ignores_non_string_code_message():
+    # Defensive: a malformed gateway could send numbers/objects in these
+    # fields. We don't want to crash; we want a best-effort string.
+    err = {"code": 500, "message": None}
+    assert _format_responses_error(err, "failed") == "500"
+
+
+def test_normalize_codex_response_failed_includes_code_in_error():
+    """Regression: response_status == 'failed' should surface the error
+    code, not just the message. Used to leak a bare 'Slow down' string
+    that was indistinguishable from a generic stream truncation."""
+    # ``output`` non-empty so we don't trip the "no output items" guard
+    # before reaching the failed-status branch. Real failed responses
+    # often DO carry a partial message item alongside the error.
+    response = SimpleNamespace(
+        status="failed",
+        output=[
+            SimpleNamespace(
+                type="message",
+                role="assistant",
+                status="incomplete",
+                content=[SimpleNamespace(type="output_text", text="partial")],
+            ),
+        ],
+        error={"code": "rate_limit_exceeded", "message": "Slow down"},
+    )
+    with pytest.raises(RuntimeError, match=r"^rate_limit_exceeded: Slow down$"):
+        _normalize_codex_response(response)
+
+
+def test_normalize_codex_response_failed_with_message_only():
+    """Backwards-compat: a failed response with only a message field
+    (no code) should still surface that message verbatim."""
+    response = SimpleNamespace(
+        status="failed",
+        output=[
+            SimpleNamespace(
+                type="message",
+                role="assistant",
+                status="incomplete",
+                content=[SimpleNamespace(type="output_text", text="partial")],
+            ),
+        ],
+        error={"message": "model error"},
+    )
+    with pytest.raises(RuntimeError, match=r"^model error$"):
+        _normalize_codex_response(response)

tests/agent/test_image_routing.py

@@ -16,7 +16,6 @@ from agent.image_routing import (
     _supports_vision_override,
     build_native_content_parts,
     decide_image_input_mode,
-    extract_image_refs,
 )
 
 
@@ -450,190 +449,3 @@ class TestLargeImageHandling:
         assert len(parts) == 2
         assert parts[0]["type"] == "text"
         assert parts[1]["type"] == "image_url"
-
-
-# ─── extract_image_refs ──────────────────────────────────────────────────────
-
-
-class TestExtractImageRefs:
-    """Scan task body / inbound text for image paths and URLs (kanban worker
-    enrichment, issue raised May 2026)."""
-
-    def test_empty_or_none_returns_empty(self):
-        assert extract_image_refs("") == ([], [])
-        assert extract_image_refs(None) == ([], [])  # type: ignore[arg-type]
-
-    def test_finds_absolute_path(self, tmp_path: Path):
-        img = tmp_path / "screenshot.png"
-        img.write_bytes(_png_bytes())
-        body = f"Look at {img} and tell me what's wrong."
-        paths, urls = extract_image_refs(body)
-        assert paths == [str(img)]
-        assert urls == []
-
-    def test_finds_home_relative_path(self, tmp_path: Path, monkeypatch):
-        # Simulate ~/foo.png by pointing HOME at tmp_path and creating the file
-        monkeypatch.setenv("HOME", str(tmp_path))
-        img = tmp_path / "foo.png"
-        img.write_bytes(_png_bytes())
-        paths, urls = extract_image_refs("see ~/foo.png please")
-        assert paths == [str(img)]
-        assert urls == []
-
-    def test_skips_nonexistent_paths(self, tmp_path: Path):
-        # Path-shaped but no file on disk → skipped.
-        body = f"What's at {tmp_path}/never_created.png ?"
-        paths, urls = extract_image_refs(body)
-        assert paths == []
-        assert urls == []
-
-    def test_finds_http_image_url(self):
-        body = "Check out https://example.com/photos/cat.png — cute right?"
-        paths, urls = extract_image_refs(body)
-        assert paths == []
-        assert urls == ["https://example.com/photos/cat.png"]
-
-    def test_finds_https_url_with_query_string(self):
-        body = "Diagram: https://cdn.example.com/img.jpeg?size=large&v=2 here"
-        paths, urls = extract_image_refs(body)
-        assert urls == ["https://cdn.example.com/img.jpeg?size=large&v=2"]
-
-    def test_url_trailing_punctuation_stripped(self):
-        # Prose punctuation right after the URL must not be part of the URL.
-        body = "See https://example.com/a.png."
-        paths, urls = extract_image_refs(body)
-        assert urls == ["https://example.com/a.png"]
-
-    def test_ignores_non_image_urls(self):
-        body = "See https://example.com/page.html and https://x.com/y.pdf"
-        paths, urls = extract_image_refs(body)
-        assert urls == []
-
-    def test_dedupes_paths_and_urls(self, tmp_path: Path):
-        img = tmp_path / "dup.png"
-        img.write_bytes(_png_bytes())
-        body = (
-            f"First {img} then again {img}. "
-            "Also https://example.com/x.png and https://example.com/x.png again."
-        )
-        paths, urls = extract_image_refs(body)
-        assert paths == [str(img)]
-        assert urls == ["https://example.com/x.png"]
-
-    def test_ignores_paths_in_fenced_code_block(self, tmp_path: Path):
-        img = tmp_path / "real.png"
-        img.write_bytes(_png_bytes())
-        body = (
-            "Outside the block, attach this:\n"
-            f"{img}\n"
-            "But not these examples:\n"
-            "```\n"
-            f"some_other_image: /tmp/example.png\n"
-            f"url: https://example.com/example.png\n"
-            "```\n"
-        )
-        paths, urls = extract_image_refs(body)
-        assert paths == [str(img)]
-        assert urls == []
-
-    def test_ignores_paths_in_inline_code(self, tmp_path: Path):
-        img = tmp_path / "real.jpg"
-        img.write_bytes(_png_bytes())
-        body = (
-            f"Attach {img}, but ignore the example "
-            "`https://example.com/skip.png` in backticks."
-        )
-        paths, urls = extract_image_refs(body)
-        assert paths == [str(img)]
-        assert urls == []
-
-    def test_does_not_match_paths_inside_urls(self, tmp_path: Path):
-        # The lookbehind in the regex prevents matching the path-portion of
-        # a URL as a local path. Only the URL should be detected.
-        body = "Just the URL: https://example.com/some/dir/image.png"
-        paths, urls = extract_image_refs(body)
-        assert paths == []
-        assert urls == ["https://example.com/some/dir/image.png"]
-
-    def test_mixed_paths_and_urls(self, tmp_path: Path):
-        img = tmp_path / "local.png"
-        img.write_bytes(_png_bytes())
-        body = (
-            f"Compare local {img} against the design at "
-            "https://example.com/design/v2.png — does it match?"
-        )
-        paths, urls = extract_image_refs(body)
-        assert paths == [str(img)]
-        assert urls == ["https://example.com/design/v2.png"]
-
-    def test_case_insensitive_extension(self, tmp_path: Path):
-        img = tmp_path / "shouty.PNG"
-        img.write_bytes(_png_bytes())
-        body = f"see {img}"
-        paths, urls = extract_image_refs(body)
-        assert paths == [str(img)]
-
-
-# ─── build_native_content_parts with URLs ────────────────────────────────────
-
-
-class TestBuildNativeContentPartsURLs:
-    """URL pass-through support added so kanban task bodies (and other
-    inbound surfaces) can route remote image URLs straight to the model."""
-
-    def test_url_only_no_local_paths(self):
-        parts, skipped = build_native_content_parts(
-            "what is this?",
-            [],
-            image_urls=["https://example.com/diagram.png"],
-        )
-        assert skipped == []
-        assert len(parts) == 2
-        assert parts[0]["type"] == "text"
-        assert "[Image attached: https://example.com/diagram.png]" in parts[0]["text"]
-        assert parts[0]["text"].startswith("what is this?")
-        assert parts[1] == {
-            "type": "image_url",
-            "image_url": {"url": "https://example.com/diagram.png"},
-        }
-
-    def test_mixed_path_and_url(self, tmp_path: Path):
-        img = tmp_path / "local.png"
-        img.write_bytes(_png_bytes())
-        parts, skipped = build_native_content_parts(
-            "compare these",
-            [str(img)],
-            image_urls=["https://example.com/remote.jpg"],
-        )
-        assert skipped == []
-        # 1 text + 2 image parts (local data URL first, then remote URL).
-        image_parts = [p for p in parts if p.get("type") == "image_url"]
-        assert len(image_parts) == 2
-        assert image_parts[0]["image_url"]["url"].startswith("data:image/png;base64,")
-        assert image_parts[1]["image_url"]["url"] == "https://example.com/remote.jpg"
-        text = parts[0]["text"]
-        assert "[Image attached at:" in text
-        assert "[Image attached: https://example.com/remote.jpg]" in text
-
-    def test_empty_url_list_is_no_op(self, tmp_path: Path):
-        img = tmp_path / "x.png"
-        img.write_bytes(_png_bytes())
-        # image_urls=[] should behave the same as not passing it at all.
-        parts_no_urls, _ = build_native_content_parts("hi", [str(img)])
-        parts_empty_urls, _ = build_native_content_parts("hi", [str(img)], image_urls=[])
-        assert parts_no_urls == parts_empty_urls
-
-    def test_blank_url_strings_are_dropped(self):
-        parts, _ = build_native_content_parts(
-            "x", [], image_urls=["", "  ", "https://example.com/a.png"]
-        )
-        image_parts = [p for p in parts if p.get("type") == "image_url"]
-        assert len(image_parts) == 1
-        assert image_parts[0]["image_url"]["url"] == "https://example.com/a.png"
-
-    def test_url_only_inserts_default_prompt_when_text_empty(self):
-        parts, _ = build_native_content_parts(
-            "", [], image_urls=["https://example.com/a.png"]
-        )
-        assert parts[0]["type"] == "text"
-        assert parts[0]["text"].startswith("What do you see in this image?")

tests/docker/test_dashboard.py

@@ -88,15 +88,7 @@ def test_dashboard_slot_reports_up_when_enabled(
     """Symmetry: with HERMES_DASHBOARD=1, s6-svstat reports the slot as up."""
     subprocess.run(
         ["docker", "run", "-d", "--name", container_name,
-         "-e", "HERMES_DASHBOARD=1",
-         # The default dashboard host is 0.0.0.0, which now engages the
-         # OAuth auth gate. Without a provider registered (no
-         # HERMES_DASHBOARD_OAUTH_CLIENT_ID in this test env), start_server
-         # would fail closed and the slot would never come up. Pin the
-         # explicit insecure opt-in to keep this test focused on the s6
-         # supervision contract, not the auth gate.
-         "-e", "HERMES_DASHBOARD_INSECURE=1",
-         built_image, "sleep", "120"],
+         "-e", "HERMES_DASHBOARD=1", built_image, "sleep", "120"],
         check=True, capture_output=True, timeout=30,
     )
     # uvicorn takes a moment to bind; poll svstat.
@@ -121,12 +113,7 @@ def test_dashboard_opt_in_starts(
     """With HERMES_DASHBOARD=1, a dashboard process should be visible."""
     subprocess.run(
         ["docker", "run", "-d", "--name", container_name,
-         "-e", "HERMES_DASHBOARD=1",
-         # Default bind is 0.0.0.0; pin insecure opt-in so the auth gate
-         # doesn't fail-closed before the process can come up. See
-         # test_dashboard_slot_reports_up_when_enabled for the full rationale.
-         "-e", "HERMES_DASHBOARD_INSECURE=1",
-         built_image, "sleep", "120"],
+         "-e", "HERMES_DASHBOARD=1", built_image, "sleep", "120"],
         check=True, capture_output=True, timeout=30,
     )
     # Poll for the dashboard subprocess to appear — the entrypoint
@@ -145,10 +132,6 @@ def test_dashboard_port_override(
     subprocess.run(
         ["docker", "run", "-d", "--name", container_name,
          "-e", "HERMES_DASHBOARD=1", "-e", "HERMES_DASHBOARD_PORT=9120",
-         # Default bind is 0.0.0.0; pin insecure opt-in so the auth gate
-         # doesn't fail-closed before the port is bound. See
-         # test_dashboard_slot_reports_up_when_enabled for the full rationale.
-         "-e", "HERMES_DASHBOARD_INSECURE=1",
          built_image, "sleep", "120"],
         check=True, capture_output=True, timeout=30,
     )
@@ -178,13 +161,7 @@ def test_dashboard_restarts_after_crash(
     """
     subprocess.run(
         ["docker", "run", "-d", "--name", container_name,
-         "-e", "HERMES_DASHBOARD=1",
-         # Default bind is 0.0.0.0; pin insecure opt-in so the auth gate
-         # doesn't fail-closed before the supervised dashboard can come up.
-         # See test_dashboard_slot_reports_up_when_enabled for the full
-         # rationale.
-         "-e", "HERMES_DASHBOARD_INSECURE=1",
-         built_image, "sleep", "120"],
+         "-e", "HERMES_DASHBOARD=1", built_image, "sleep", "120"],
         check=True, capture_output=True, timeout=30,
     )
     # Wait for the first dashboard to come up.
@@ -237,67 +214,36 @@ def test_dashboard_restarts_after_crash(
 # ---------------------------------------------------------------------------
 
 
-def _http_probe(
-    container: str,
-    path: str,
-    *,
-    deadline_s: float = 60.0,
-) -> tuple[int, str]:
-    """Poll ``http://127.0.0.1:9119<path>`` from inside the container.
+def _fetch_api_status(container: str, *, deadline_s: float = 60.0) -> dict:
+    """Poll ``/api/status`` from inside the container via the venv python.
 
-    Returns ``(status_code, body)`` as soon as the dashboard answers any
-    HTTP response — 200, 401, 503, anything. The image doesn't ship
-    ``curl`` but the venv's stdlib ``urllib`` is good enough; we use a
-    proper ``try``/``except`` to intercept ``HTTPError`` because
-    ``urlopen`` raises on 4xx/5xx, and we treat those as legitimate
-    responses (the OAuth gate's 401 IS the success signal for the
-    gate-engaged test).
+    The dashboard binds to ``HERMES_DASHBOARD_HOST`` (typically ``0.0.0.0``)
+    so loopback inside the container works. The image doesn't ship
+    ``curl`` but Python's stdlib ``urllib`` is good enough.
 
-    Connection errors (uvicorn still starting, fail-closed exited) keep
-    the poll loop running until ``deadline_s`` elapses.
-
-    The probe Python program is fed over stdin (``python -``) rather
-    than ``python -c`` so we can use proper multi-line syntax with
-    ``try``/``except`` blocks without escaping hell.
-
-    Raises ``AssertionError`` on timeout.
+    Returns the decoded JSON dict on success; raises AssertionError on
+    timeout.
     """
-    py_program = f"""\
-import urllib.request, urllib.error
-req = urllib.request.Request("http://127.0.0.1:9119{path}")
-try:
-    r = urllib.request.urlopen(req, timeout=5)
-    print(r.status)
-    print(r.read().decode(), end="")
-except urllib.error.HTTPError as h:
-    print(h.code)
-    print(h.read().decode(), end="")
-"""
-    # Feed the program over stdin via a heredoc so docker_exec_sh's
-    # single bash string stays clean. The 'PY' delimiter is quoted to
-    # disable shell expansion inside the heredoc body.
     probe = (
-        "/opt/hermes/.venv/bin/python - <<'PY'\n"
-        f"{py_program}"
-        "PY"
+        "/opt/hermes/.venv/bin/python -c "
+        "'import json,urllib.request as u;"
+        "print(u.urlopen(\"http://127.0.0.1:9119/api/status\",timeout=5)"
+        ".read().decode())'"
     )
     end = time.monotonic() + deadline_s
     last_err = ""
     while time.monotonic() < end:
         r = docker_exec_sh(container, probe, timeout=10)
         if r.returncode == 0 and r.stdout.strip():
-            lines = r.stdout.split("\n", 1)
             try:
-                status = int(lines[0].strip())
-                body = lines[1] if len(lines) > 1 else ""
-                return status, body
-            except (ValueError, IndexError) as exc:
-                last_err = f"parse: {exc!r} / stdout={r.stdout!r}"
+                return json.loads(r.stdout)
+            except (ValueError, json.JSONDecodeError) as exc:  # noqa: F841
+                last_err = f"json parse: {exc!r} / stdout={r.stdout!r}"
         else:
             last_err = f"rc={r.returncode} stderr={r.stderr!r}"
         time.sleep(0.5)
     raise AssertionError(
-        f"Probe of {path} never returned HTTP within {deadline_s}s; "
+        f"/api/status never returned valid JSON within {deadline_s}s; "
         f"last error: {last_err}"
     )
 
@@ -317,17 +263,6 @@ def test_dashboard_oauth_gate_engages_on_non_loopback_bind(
     flipped ``--insecure`` on for any non-loopback bind, which routed
     ``start_server`` straight back into the legacy ``allow_public=True``
     branch and disabled the gate every time.
-
-    We verify two independent observable consequences of the gate being
-    on:
-
-    1. ``/api/auth/providers`` (publicly reachable through the gate so
-       the login page can bootstrap) returns 200 with ``nous`` in the
-       provider list — proves the bundled provider registered.
-    2. ``/api/status`` (a public endpoint under the legacy
-       ``_SESSION_TOKEN`` middleware) returns 401 — proves the OAuth gate
-       runs upstream of the legacy public list and is actively
-       intercepting unauthenticated callers.
     """
     subprocess.run(
         ["docker", "run", "-d", "--name", container_name,
@@ -337,27 +272,15 @@ def test_dashboard_oauth_gate_engages_on_non_loopback_bind(
          built_image, "sleep", "120"],
         check=True, capture_output=True, timeout=30,
     )
-
-    # (1) Provider registry visible via the public bootstrap endpoint.
-    status_code, body = _http_probe(container_name, "/api/auth/providers")
-    assert status_code == 200, (
-        f"/api/auth/providers should return 200 when a provider is "
-        f"registered; got {status_code} body={body!r}"
+    status = _fetch_api_status(container_name)
+    assert status.get("auth_required") is True, (
+        "OAuth gate must be engaged on 0.0.0.0 bind when a provider is "
+        "registered and HERMES_DASHBOARD_INSECURE is unset. Got: "
+        f"{status!r}"
     )
-    payload = json.loads(body)
-    provider_names = [p.get("name") for p in payload.get("providers", [])]
-    assert "nous" in provider_names, (
+    assert "nous" in status.get("auth_providers", []), (
         "Bundled dashboard_auth/nous provider should register when "
-        f"HERMES_DASHBOARD_OAUTH_CLIENT_ID is set. Got: {payload!r}"
-    )
-
-    # (2) /api/status is gated by the OAuth middleware → unauthenticated
-    # callers get 401, not the legacy public 200 JSON.
-    status_code, body = _http_probe(container_name, "/api/status")
-    assert status_code == 401, (
-        "OAuth gate must intercept /api/status on 0.0.0.0 bind when a "
-        "provider is registered and HERMES_DASHBOARD_INSECURE is unset. "
-        f"Got: status={status_code} body={body!r}"
+        f"HERMES_DASHBOARD_OAUTH_CLIENT_ID is set. Got: {status!r}"
     )
 
 
@@ -368,10 +291,6 @@ def test_dashboard_insecure_env_var_opts_out_of_gate(
     for operators running on trusted LANs behind a reverse proxy without
     the OAuth contract. Same opt-out shape as the rest of the s6 boolean
     envs (``HERMES_DASHBOARD``, ``HERMES_DASHBOARD_TUI``).
-
-    With the gate off, ``/api/status`` (a public endpoint under the
-    legacy ``_SESSION_TOKEN`` middleware) returns 200 with the
-    ``auth_required: false`` body — proves the gate is bypassed.
     """
     subprocess.run(
         ["docker", "run", "-d", "--name", container_name,
@@ -381,12 +300,7 @@ def test_dashboard_insecure_env_var_opts_out_of_gate(
          built_image, "sleep", "120"],
         check=True, capture_output=True, timeout=30,
     )
-    status_code, body = _http_probe(container_name, "/api/status")
-    assert status_code == 200, (
-        f"/api/status should return 200 with the auth gate disabled; "
-        f"got {status_code} body={body!r}"
-    )
-    status = json.loads(body)
+    status = _fetch_api_status(container_name)
     assert status.get("auth_required") is False, (
         "HERMES_DASHBOARD_INSECURE=1 must disable the auth gate (explicit "
         f"opt-in for trusted-LAN deployments). Got: {status!r}"

tests/hermes_cli/test_kanban_worker_image_extraction.py

@@ -1,238 +0,0 @@
-"""Worker-side image enrichment for kanban tasks.
-
-When a kanban task body contains a local image path or an ``http(s)://``
-image URL, the worker must surface that image to the model on its first
-user turn — matching the CLI/gateway behaviour for inbound images.
-
-The dispatcher spawns the worker as
-``hermes -p <profile> chat -q "work kanban task <id>"``. The task body
-itself never appears in argv; the worker has to read it from the kanban
-DB during startup. These tests cover the round-trip:
-
-  task body  →  kanban_db.get_task  →  extract_image_refs  →
-  build_native_content_parts  →  multimodal user turn
-"""
-from __future__ import annotations
-
-import base64
-from pathlib import Path
-
-import pytest
-
-from hermes_cli import kanban_db as kb
-from agent.image_routing import (
-    build_native_content_parts,
-    extract_image_refs,
-)
-
-
-# Tiny 1×1 transparent PNG used to back any path the tests stick into a
-# task body. extract_image_refs validates the path exists on disk, so the
-# byte content has to be a real readable file (any image bytes will do).
-_PNG = base64.b64decode(
-    "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR4nGNgYGBgAAAABQABpfZFQAAAAABJRU5ErkJggg=="
-)
-
-
-@pytest.fixture
-def kanban_home(tmp_path: Path, monkeypatch):
-    """Isolated HERMES_HOME with a fresh kanban DB for each test."""
-    home = tmp_path / ".hermes"
-    home.mkdir()
-    monkeypatch.setenv("HERMES_HOME", str(home))
-    monkeypatch.setattr(Path, "home", lambda: tmp_path)
-    kb.init_db()
-    return home
-
-
-def _add_task_with_body(body: str, *, title: str = "Look at this") -> str:
-    conn = kb.connect()
-    try:
-        task_id = kb.create_task(
-            conn,
-            title=title,
-            body=body,
-            assignee="worker-a",
-            tenant=None,
-        )
-    finally:
-        conn.close()
-    return task_id
-
-
-def _read_body(task_id: str) -> str:
-    conn = kb.connect()
-    try:
-        task = kb.get_task(conn, task_id)
-        return (task.body if task is not None else "") or ""
-    finally:
-        conn.close()
-
-
-class TestExtractFromTaskBody:
-    """Read a real kanban task body and run it through extract_image_refs."""
-
-    def test_local_path_in_body_round_trips(self, kanban_home, tmp_path):
-        img = tmp_path / "screenshot.png"
-        img.write_bytes(_PNG)
-        tid = _add_task_with_body(
-            f"Please review the screenshot at {img} and confirm "
-            "the alignment is right."
-        )
-
-        body = _read_body(tid)
-        paths, urls = extract_image_refs(body)
-        assert paths == [str(img)]
-        assert urls == []
-
-    def test_url_in_body_round_trips(self, kanban_home):
-        tid = _add_task_with_body(
-            "The design lives at https://example.com/mock/v3.png — "
-            "make the implementation match it."
-        )
-
-        body = _read_body(tid)
-        paths, urls = extract_image_refs(body)
-        assert paths == []
-        assert urls == ["https://example.com/mock/v3.png"]
-
-    def test_mixed_path_and_url_in_body(self, kanban_home, tmp_path):
-        img = tmp_path / "current.png"
-        img.write_bytes(_PNG)
-        tid = _add_task_with_body(
-            f"Compare the current screenshot {img} against the design at "
-            "https://example.com/target.png and write a diff."
-        )
-
-        body = _read_body(tid)
-        paths, urls = extract_image_refs(body)
-        assert paths == [str(img)]
-        assert urls == ["https://example.com/target.png"]
-
-    def test_body_without_images_yields_nothing(self, kanban_home):
-        tid = _add_task_with_body(
-            "Refactor the auth module to use the new session helper."
-        )
-
-        body = _read_body(tid)
-        paths, urls = extract_image_refs(body)
-        assert paths == []
-        assert urls == []
-
-    def test_empty_body_is_safe(self, kanban_home):
-        tid = _add_task_with_body("")
-
-        body = _read_body(tid)
-        paths, urls = extract_image_refs(body)
-        assert paths == []
-        assert urls == []
-
-
-class TestBuildPartsFromTaskBody:
-    """Verify the full pipeline produces a multimodal user turn."""
-
-    def test_local_path_becomes_native_image_part(self, kanban_home, tmp_path):
-        img = tmp_path / "design.png"
-        img.write_bytes(_PNG)
-        tid = _add_task_with_body(f"Check out {img} — what's broken?")
-        body = _read_body(tid)
-        paths, urls = extract_image_refs(body)
-
-        # Mirrors the cli.py wiring: pass the worker's literal -q argument
-        # (the dispatcher uses ``"work kanban task <id>"``) plus the
-        # extracted refs through build_native_content_parts.
-        parts, skipped = build_native_content_parts(
-            f"work kanban task {tid}",
-            paths,
-            image_urls=urls or None,
-        )
-
-        assert skipped == []
-        # text part + one image_url part
-        assert len(parts) == 2
-        assert parts[0]["type"] == "text"
-        assert parts[0]["text"].startswith(f"work kanban task {tid}")
-        assert f"[Image attached at: {img}]" in parts[0]["text"]
-        assert parts[1]["type"] == "image_url"
-        assert parts[1]["image_url"]["url"].startswith("data:image/png;base64,")
-
-    def test_url_becomes_image_url_part(self, kanban_home):
-        tid = _add_task_with_body(
-            "Reference: https://example.com/target.jpg — match it."
-        )
-        body = _read_body(tid)
-        paths, urls = extract_image_refs(body)
-
-        parts, skipped = build_native_content_parts(
-            f"work kanban task {tid}",
-            paths,
-            image_urls=urls or None,
-        )
-
-        assert skipped == []
-        assert len(parts) == 2
-        assert parts[0]["type"] == "text"
-        assert "[Image attached: https://example.com/target.jpg]" in parts[0]["text"]
-        assert parts[1] == {
-            "type": "image_url",
-            "image_url": {"url": "https://example.com/target.jpg"},
-        }
-
-    def test_body_with_both_yields_two_image_parts(self, kanban_home, tmp_path):
-        img = tmp_path / "local.png"
-        img.write_bytes(_PNG)
-        tid = _add_task_with_body(
-            f"Diff {img} vs https://example.com/target.png — explain it."
-        )
-        body = _read_body(tid)
-        paths, urls = extract_image_refs(body)
-
-        parts, skipped = build_native_content_parts(
-            f"work kanban task {tid}",
-            paths,
-            image_urls=urls or None,
-        )
-
-        assert skipped == []
-        image_parts = [p for p in parts if p.get("type") == "image_url"]
-        assert len(image_parts) == 2
-        # Local file is embedded as a data URL; remote URL passes through.
-        assert image_parts[0]["image_url"]["url"].startswith("data:image/png;base64,")
-        assert image_parts[1]["image_url"]["url"] == "https://example.com/target.png"
-
-    def test_body_with_no_images_leaves_query_untouched(self, kanban_home):
-        tid = _add_task_with_body(
-            "Rewrite the README intro paragraph to focus on use cases."
-        )
-        body = _read_body(tid)
-        paths, urls = extract_image_refs(body)
-
-        parts, skipped = build_native_content_parts(
-            f"work kanban task {tid}",
-            paths,
-            image_urls=urls or None,
-        )
-
-        # No images → plain text-only return (single part, no list mutation).
-        assert skipped == []
-        assert len(parts) == 1
-        assert parts[0]["type"] == "text"
-        assert parts[0]["text"] == f"work kanban task {tid}"
-
-    def test_code_block_example_is_not_attached(self, kanban_home, tmp_path):
-        # Only the real image outside the fenced code block should attach.
-        real = tmp_path / "real.png"
-        real.write_bytes(_PNG)
-        tid = _add_task_with_body(
-            f"Real screenshot:\n{real}\n\n"
-            "Example we DON'T want attached:\n"
-            "```\n"
-            "image: /tmp/example_only.png\n"
-            "url: https://example.com/example.png\n"
-            "```\n"
-        )
-        body = _read_body(tid)
-        paths, urls = extract_image_refs(body)
-
-        assert paths == [str(real)]
-        assert urls == []

tests/test_packaging_metadata.py

@@ -20,42 +20,3 @@ def test_manifest_includes_bundled_skills():
 
     assert "graft skills" in manifest
     assert "graft optional-skills" in manifest
-
-
-def test_bundled_plugin_manifests_ship_in_both_wheel_and_sdist():
-    """Regression test for #34034 / #28149.
-
-    Plugin discovery (hermes_cli/plugins.py) registers each bundled plugin by
-    reading its ``plugin.yaml`` / ``plugin.yml`` manifest. Those manifests are
-    data files, not Python modules, so they only reach installed packages when
-    declared explicitly:
-
-    - wheel  -> ``[tool.setuptools.package-data]`` ``plugins`` glob
-    - sdist  -> ``MANIFEST.in`` (Homebrew and other downstream packagers build
-                from the sdist)
-
-    v0.15.0 declared neither, so the wheel shipped every adapter's Python code
-    but none of its manifests, and *every* gateway platform failed with
-    "No adapter available for <platform>". Both channels must cover manifests.
-    """
-    # There must actually be manifests on disk for the globs to match.
-    on_disk = list((REPO_ROOT / "plugins").rglob("plugin.yaml")) + list(
-        (REPO_ROOT / "plugins").rglob("plugin.yml")
-    )
-    assert on_disk, "expected bundled plugin manifests under plugins/"
-
-    # Wheel channel: package-data must declare a glob that matches plugin
-    # manifests anywhere under the plugins package.
-    data = tomllib.loads((REPO_ROOT / "pyproject.toml").read_text(encoding="utf-8"))
-    plugins_pkg_data = data["tool"]["setuptools"]["package-data"].get("plugins", [])
-    assert any(
-        g.endswith("plugin.yaml") or g.endswith("plugin.yml")
-        for g in plugins_pkg_data
-    ), "pyproject package-data 'plugins' must ship plugin.yaml/plugin.yml (wheel)"
-
-    # Sdist channel: MANIFEST.in must recursively include the manifests so
-    # downstream packagers building from the sdist also get them.
-    manifest = (REPO_ROOT / "MANIFEST.in").read_text(encoding="utf-8")
-    assert "recursive-include plugins" in manifest and "plugin.yaml" in manifest, (
-        "MANIFEST.in must recursive-include plugins plugin.yaml/plugin.yml (sdist)"
-    )

tests/tools/test_mcp_tool_issue_948.py

@@ -34,39 +34,6 @@ def test_resolve_stdio_command_falls_back_to_hermes_node_bin(tmp_path):
     assert env["PATH"].split(os.pathsep)[0] == str(node_bin)
 
 
-def test_resolve_stdio_command_falls_back_to_usr_local_bin():
-    """When ``npx`` isn't on the filtered PATH and isn't under ``$HERMES_HOME/node/bin``
-    or ``~/.local/bin``, the resolver should still locate it at ``/usr/local/bin/npx``.
-
-    This is the canonical install location for Node on Linux from-source builds,
-    the upstream ``node:bookworm-slim`` image (which the Hermes Docker image
-    copies ``node + npm + corepack`` from since #4977), and macOS Homebrew on
-    Intel. Without this candidate, MCP servers run with an ``env.PATH`` that
-    omits ``/usr/local/bin`` (common when users hand-author PATH for sandboxing)
-    fail with ENOENT at ``execvp``.
-    """
-    target = os.path.join(os.sep, "usr", "local", "bin", "npx")
-
-    # Pretend ONLY the /usr/local/bin/npx candidate exists and is executable —
-    # the other candidates ($HERMES_HOME/node/bin/npx and ~/.local/bin/npx)
-    # should fail isfile() and the resolver must fall through to /usr/local/bin.
-    def _fake_isfile(path):
-        return path == target
-
-    def _fake_access(path, _mode):
-        return path == target
-
-    with patch("tools.mcp_tool.shutil.which", return_value=None), \
-         patch("tools.mcp_tool.os.path.isfile", side_effect=_fake_isfile), \
-         patch("tools.mcp_tool.os.access", side_effect=_fake_access):
-        command, env = _resolve_stdio_command("npx", {"PATH": "/opt/data/bin:/usr/bin:/bin"})
-
-    assert command == target
-    # /usr/local/bin must be prepended so npx's shebang (`/usr/bin/env node`)
-    # can find node in the same directory.
-    assert env["PATH"].split(os.pathsep)[0] == os.path.dirname(target)
-
-
 def test_resolve_stdio_command_respects_explicit_empty_path():
     seen_paths = []
 

tools/mcp_tool.py

@@ -422,17 +422,6 @@ def _resolve_stdio_command(command: str, env: dict) -> tuple[str, dict]:
             candidates = [
                 os.path.join(hermes_home, "node", "bin", resolved_command),
                 os.path.join(os.path.expanduser("~"), ".local", "bin", resolved_command),
-                # /usr/local/bin is the canonical install location for Node on
-                # Linux from-source builds, the upstream node:bookworm-slim
-                # image (which the Hermes Docker image copies node + npm +
-                # corepack from since #4977), and macOS Homebrew on Intel.
-                # Without this candidate, any MCP server configured with an
-                # env.PATH that omits /usr/local/bin (a common pattern when
-                # users hand-author PATH for sandboxing) fails with ENOENT
-                # at execvp, and a naive symlink workaround into the user's
-                # PATH only fails one layer deeper because npx's shebang
-                # re-execs /usr/bin/env node which needs the same directory.
-                os.path.join(os.sep, "usr", "local", "bin", resolved_command),
             ]
             for candidate in candidates:
                 if os.path.isfile(candidate) and os.access(candidate, os.X_OK):

uv.lock

@@ -1589,7 +1589,7 @@ wheels = [
 
 [[package]]
 name = "hermes-agent"
-version = "0.15.1"
+version = "0.15.0"
 source = { editable = "." }
 dependencies = [
     { name = "croniter" },

web/package.json

@@ -10,7 +10,7 @@
     "preview": "vite preview"
   },
   "dependencies": {
-    "@nous-research/ui": "0.18.2",
+    "@nous-research/ui": "0.16.0",
     "@observablehq/plot": "^0.6.17",
     "@react-three/fiber": "^9.6.0",
     "@tailwindcss/vite": "^4.2.1",

web/src/App.tsx

@@ -50,12 +50,12 @@ import {
 import { Button } from "@nous-research/ui/ui/components/button";
 import { SelectionSwitcher } from "@nous-research/ui/ui/components/selection-switcher";
 import { Spinner } from "@nous-research/ui/ui/components/spinner";
-import { Typography } from "@nous-research/ui/ui/components/typography/index";
+import { Typography } from "@/components/NouiTypography";
 import { cn } from "@/lib/utils";
 import { Backdrop } from "@/components/Backdrop";
 import { SidebarFooter } from "@/components/SidebarFooter";
 import { SidebarStatusStrip, gatewayLine } from "@/components/SidebarStatusStrip";
-import { useBelowBreakpoint } from "@nous-research/ui/hooks/use-below-breakpoint";
+import { useBelowBreakpoint } from "@/hooks/useBelowBreakpoint";
 import { useSidebarStatus } from "@/hooks/useSidebarStatus";
 import { AuthWidget } from "@/components/AuthWidget";
 import { PageHeaderProvider } from "@/contexts/PageHeaderProvider";

web/src/components/AutoField.tsx

@@ -1,7 +1,7 @@
 import { Select, SelectOption } from "@nous-research/ui/ui/components/select";
 import { Switch } from "@nous-research/ui/ui/components/switch";
-import { Input } from "@nous-research/ui/ui/components/input";
-import { Label } from "@nous-research/ui/ui/components/label";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
 
 function FieldHint({ schema, schemaKey }: { schema: Record<string, unknown>; schemaKey: string }) {
   const keyPath = schemaKey.includes(".") ? schemaKey : "";

web/src/components/BottomPickSheet.tsx

@@ -0,0 +1,225 @@
+import {
+  type PointerEvent as ReactPointerEvent,
+  type ReactNode,
+  useEffect,
+  useRef,
+  useState,
+} from "react";
+import { createPortal } from "react-dom";
+import { Typography } from "@/components/NouiTypography";
+import { cn, themedBody } from "@/lib/utils";
+
+const CLOSE_DRAG_MIN_PX = 72;
+const CLOSE_DRAG_RATIO = 0.18;
+const SHEET_TRANSITION_MS = 280;
+
+/**
+ * Mobile-first picker shell: fixed backdrop + bottom sheet, portaled to `body`
+ * so nested overflow/transform in the sidebar cannot clip menus (theme /
+ * language switchers). Open/close uses slide + fade; teardown is delayed until
+ * the exit animation finishes so animations can complete.
+ *
+ * Drag the header/handle downward to dismiss (skipped when reduced motion is on).
+ */
+export function BottomPickSheet({
+  backdropDismissLabel = "Dismiss",
+  children,
+  onClose,
+  open,
+  title,
+}: BottomPickSheetProps) {
+  const [renderPortal, setRenderPortal] = useState(open);
+  const [entered, setEntered] = useState(false);
+  const [dragOffsetPx, setDragOffsetPx] = useState(0);
+  const [dragActive, setDragActive] = useState(false);
+
+  const closeTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+  const sheetRef = useRef<HTMLDivElement>(null);
+  const dragTrackingRef = useRef(false);
+  const dragStartYRef = useRef(0);
+  const dragOffsetRef = useRef(0);
+
+  const reducedMotion =
+    typeof window !== "undefined" &&
+    window.matchMedia("(prefers-reduced-motion: reduce)").matches;
+
+  const syncDragPx = (next: number) => {
+    dragOffsetRef.current = next;
+    setDragOffsetPx(next);
+  };
+
+  useEffect(() => {
+    if (closeTimerRef.current) {
+      clearTimeout(closeTimerRef.current);
+      closeTimerRef.current = null;
+    }
+
+    const ms = reducedMotion ? 0 : SHEET_TRANSITION_MS;
+
+    let openRafId = 0;
+    let exitRafId = 0;
+
+    if (open) {
+      openRafId = requestAnimationFrame(() => {
+        dragTrackingRef.current = false;
+        dragOffsetRef.current = 0;
+        setDragActive(false);
+        setDragOffsetPx(0);
+        setRenderPortal(true);
+        requestAnimationFrame(() => {
+          requestAnimationFrame(() => setEntered(true));
+        });
+      });
+    } else {
+      exitRafId = requestAnimationFrame(() => {
+        dragTrackingRef.current = false;
+        setDragActive(false);
+        setEntered(false);
+        closeTimerRef.current = window.setTimeout(() => {
+          dragOffsetRef.current = 0;
+          setDragOffsetPx(0);
+          setRenderPortal(false);
+          closeTimerRef.current = null;
+        }, ms);
+      });
+    }
+
+    return () => {
+      cancelAnimationFrame(openRafId);
+      cancelAnimationFrame(exitRafId);
+      if (closeTimerRef.current) {
+        clearTimeout(closeTimerRef.current);
+        closeTimerRef.current = null;
+      }
+    };
+  }, [open, reducedMotion]);
+
+  useEffect(() => {
+    if (!renderPortal) return;
+    const prev = document.body.style.overflow;
+    document.body.style.overflow = "hidden";
+    return () => {
+      document.body.style.overflow = prev;
+    };
+  }, [renderPortal]);
+
+  if (!renderPortal || typeof document === "undefined") return null;
+
+  const durationClass = reducedMotion ? "duration-0" : "duration-[280ms]";
+
+  const draggingVisual = dragActive || dragOffsetPx > 0;
+
+  const onDragPointerDown = (e: ReactPointerEvent<HTMLDivElement>) => {
+    if (reducedMotion || !entered) return;
+    if (e.pointerType === "mouse" && e.button !== 0) return;
+
+    dragTrackingRef.current = true;
+    setDragActive(true);
+    dragStartYRef.current = e.clientY;
+    syncDragPx(0);
+    e.currentTarget.setPointerCapture(e.pointerId);
+  };
+
+  const onDragPointerMove = (e: ReactPointerEvent<HTMLDivElement>) => {
+    if (!dragTrackingRef.current) return;
+    const dy = e.clientY - dragStartYRef.current;
+    const next = Math.max(0, dy);
+    const sheetH = sheetRef.current?.offsetHeight ?? 560;
+    syncDragPx(Math.min(next, sheetH));
+  };
+
+  const endDrag = (e: ReactPointerEvent<HTMLDivElement>) => {
+    if (!dragTrackingRef.current) return;
+    dragTrackingRef.current = false;
+    setDragActive(false);
+    try {
+      e.currentTarget.releasePointerCapture(e.pointerId);
+    } catch {
+      /* already released */
+    }
+
+    const sheetH = sheetRef.current?.offsetHeight ?? 560;
+    const threshold = Math.max(CLOSE_DRAG_MIN_PX, sheetH * CLOSE_DRAG_RATIO);
+    const d = dragOffsetRef.current;
+
+    if (d >= threshold) {
+      onClose();
+      return;
+    }
+    syncDragPx(0);
+  };
+
+  return createPortal(
+    <div className="fixed inset-0 z-[200] flex flex-col justify-end">
+      <button
+        type="button"
+        aria-label={backdropDismissLabel}
+        className={cn(
+          "absolute inset-0 bg-black/55 backdrop-blur-[2px]",
+          "transition-opacity ease-out motion-reduce:transition-none",
+          durationClass,
+          entered ? "opacity-100" : "opacity-0",
+        )}
+        onClick={onClose}
+      />
+
+      <div
+        aria-label={title}
+        aria-modal="true"
+        ref={sheetRef}
+        className={cn(
+          themedBody,
+          "relative flex max-h-[85dvh] min-h-0 flex-col rounded-t-xl border border-current/20",
+          "bg-background-base/98 pb-[max(1rem,env(safe-area-inset-bottom))]",
+          "shadow-[0_-12px_40px_-8px_rgba(0,0,0,0.55)] backdrop-blur-md",
+          "ease-out motion-reduce:transition-none transform-gpu",
+          draggingVisual ? "transition-none" : cn("transition-transform", durationClass),
+          entered ? "translate-y-0" : "translate-y-full",
+        )}
+        role="dialog"
+        style={
+          entered && dragOffsetPx > 0
+            ? { transform: `translateY(${dragOffsetPx}px)` }
+            : undefined
+        }
+      >
+        <div
+          className={cn(
+            "flex shrink-0 flex-col gap-2 border-b border-current/15 px-4 pb-3 pt-2",
+            "touch-none select-none",
+            reducedMotion ? "cursor-default" : "cursor-grab active:cursor-grabbing",
+          )}
+          onPointerCancel={endDrag}
+          onPointerDown={onDragPointerDown}
+          onPointerMove={onDragPointerMove}
+          onPointerUp={endDrag}
+        >
+          <div
+            aria-hidden
+            className="mx-auto h-1 w-10 shrink-0 rounded-full bg-current/20"
+          />
+
+          <Typography
+            mondwest
+            className="text-display text-xs tracking-[0.12em] text-text-tertiary"
+          >
+            {title}
+          </Typography>
+        </div>
+
+        <div className="min-h-0 flex-1 overflow-y-auto overscroll-contain">
+          {children}
+        </div>
+      </div>
+    </div>,
+    document.body,
+  );
+}
+
+interface BottomPickSheetProps {
+  backdropDismissLabel?: string;
+  children: ReactNode;
+  onClose: () => void;
+  open: boolean;
+  title: string;
+}

web/src/components/ChatSidebar.tsx

@@ -25,7 +25,7 @@
 
 import { Button } from "@nous-research/ui/ui/components/button";
 import { Badge } from "@nous-research/ui/ui/components/badge";
-import { Card } from "@nous-research/ui/ui/components/card";
+import { Card } from "@/components/ui/card";
 
 import { ModelPickerDialog } from "@/components/ModelPickerDialog";
 import { ToolCall, type ToolEntry } from "@/components/ToolCall";

web/src/components/DeleteConfirmDialog.tsx

@@ -1,4 +1,4 @@
-import { ConfirmDialog } from "@nous-research/ui/ui/components/confirm-dialog";
+import { ConfirmDialog } from "@/components/ui/confirm-dialog";
 import { useI18n } from "@/i18n";
 
 export function DeleteConfirmDialog({

web/src/components/LanguageSwitcher.tsx

@@ -2,9 +2,9 @@ import { useState, useRef, useEffect } from "react";
 import { createPortal } from "react-dom";
 import { Check } from "lucide-react";
 import { Button } from "@nous-research/ui/ui/components/button";
-import { BottomSheet } from "@nous-research/ui/ui/components/bottom-sheet";
-import { Typography } from "@nous-research/ui/ui/components/typography/index";
-import { useBelowBreakpoint } from "@nous-research/ui/hooks/use-below-breakpoint";
+import { BottomPickSheet } from "@/components/BottomPickSheet";
+import { Typography } from "@/components/NouiTypography";
+import { useBelowBreakpoint } from "@/hooks/useBelowBreakpoint";
 import { useI18n } from "@/i18n/context";
 import { LOCALE_META } from "@/i18n";
 import type { Locale } from "@/i18n";
@@ -87,7 +87,7 @@ export function LanguageSwitcher({ collapsed = false, dropUp = false }: Language
       </Button>
 
       {useMobileSheet && (
-        <BottomSheet
+        <BottomPickSheet
           backdropDismissLabel={t.common.close}
           onClose={() => setOpen(false)}
           open={open}
@@ -101,7 +101,7 @@ export function LanguageSwitcher({ collapsed = false, dropUp = false }: Language
               setOpen={setOpen}
             />
           </div>
-        </BottomSheet>
+        </BottomPickSheet>
       )}
 
       {open && !useMobileSheet && (() => {

web/src/components/ModelPickerDialog.tsx

@@ -2,8 +2,8 @@ import { Button } from "@nous-research/ui/ui/components/button";
 import { Checkbox } from "@nous-research/ui/ui/components/checkbox";
 import { ListItem } from "@nous-research/ui/ui/components/list-item";
 import { Spinner } from "@nous-research/ui/ui/components/spinner";
-import { Input } from "@nous-research/ui/ui/components/input";
-import { Label } from "@nous-research/ui/ui/components/label";
+import { Label } from "@/components/ui/label";
+import { Input } from "@/components/ui/input";
 import type { GatewayClient } from "@/lib/gatewayClient";
 import { Check, Search, X } from "lucide-react";
 import { useEffect, useMemo, useRef, useState } from "react";

web/src/components/NouiTypography.tsx

@@ -0,0 +1,63 @@
+import { forwardRef, type ElementType, type HTMLAttributes, type ReactNode } from "react";
+import { cn } from "@/lib/utils";
+
+type TypographyProps = HTMLAttributes<HTMLElement> & {
+  as?: ElementType;
+  children?: ReactNode;
+  compressed?: boolean;
+  courier?: boolean;
+  expanded?: boolean;
+  mondwest?: boolean;
+  mono?: boolean;
+  sans?: boolean;
+  variant?: "sm" | "md" | "lg" | "xl";
+};
+
+const variantClasses: Record<NonNullable<TypographyProps["variant"]>, string> = {
+  sm: "leading-[1.4] text-[.9375rem] tracking-[0.1875rem]",
+  md: "text-[2.625rem] leading-[1] tracking-[0.0525rem]",
+  lg: "text-[2.625rem] leading-[1] tracking-[0.0525rem]",
+  xl: "text-[4.5rem] leading-[1] tracking-[0.135rem]",
+};
+
+export const Typography = forwardRef<HTMLElement, TypographyProps>(function Typography(
+  {
+    as: Component = "span",
+    className,
+    compressed,
+    courier,
+    expanded,
+    mondwest,
+    mono,
+    sans,
+    variant,
+    ...props
+  },
+  ref,
+) {
+  const hasFontVariant = compressed || courier || expanded || mondwest || mono || sans;
+
+  return (
+    <Component
+      className={cn(
+        compressed && "font-compressed",
+        courier && "font-courier",
+        expanded && "font-expanded",
+        mondwest && "font-mondwest tracking-[0.1875rem]",
+        mono && "font-mono",
+        (!hasFontVariant || sans) && "font-sans",
+        variant && variantClasses[variant],
+        className,
+      )}
+      ref={ref}
+      {...props}
+    />
+  );
+});
+
+export const H2 = forwardRef<HTMLHeadingElement, Omit<TypographyProps, "as">>(function H2(
+  { className, variant = "lg", ...props },
+  ref,
+) {
+  return <Typography as="h2" className={cn("font-bold", className)} variant={variant} ref={ref} {...props} />;
+});

web/src/components/OAuthLoginModal.tsx

@@ -3,9 +3,9 @@ import { ExternalLink, X, Check } from "lucide-react";
 import { Button } from "@nous-research/ui/ui/components/button";
 import { CopyButton } from "@nous-research/ui/ui/components/command-block";
 import { Spinner } from "@nous-research/ui/ui/components/spinner";
-import { H2 } from "@nous-research/ui/ui/components/typography/h2";
+import { H2 } from "@/components/NouiTypography";
 import { api, type OAuthProvider, type OAuthStartResponse } from "@/lib/api";
-import { Input } from "@nous-research/ui/ui/components/input";
+import { Input } from "@/components/ui/input";
 import { useI18n } from "@/i18n";
 import { cn, themedBody } from "@/lib/utils";
 

web/src/components/OAuthProvidersCard.tsx

@@ -16,9 +16,9 @@ import {
   CardDescription,
   CardHeader,
   CardTitle,
-} from "@nous-research/ui/ui/components/card";
+} from "@/components/ui/card";
 import { Badge } from "@nous-research/ui/ui/components/badge";
-import { ConfirmDialog } from "@nous-research/ui/ui/components/confirm-dialog";
+import { ConfirmDialog } from "@/components/ui/confirm-dialog";
 import { OAuthLoginModal } from "@/components/OAuthLoginModal";
 import { useI18n } from "@/i18n";
 

web/src/components/PlatformsCard.tsx

@@ -2,7 +2,7 @@ import { AlertTriangle, Radio, Wifi, WifiOff } from "lucide-react";
 import type { PlatformStatus } from "@/lib/api";
 import { isoTimeAgo } from "@/lib/utils";
 import { Badge } from "@nous-research/ui/ui/components/badge";
-import { Card, CardContent, CardHeader, CardTitle } from "@nous-research/ui/ui/components/card";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { useI18n } from "@/i18n";
 
 export function PlatformsCard({ platforms }: PlatformsCardProps) {

web/src/components/SidebarFooter.tsx

@@ -1,4 +1,4 @@
-import { Typography } from "@nous-research/ui/ui/components/typography/index";
+import { Typography } from "@/components/NouiTypography";
 import type { StatusResponse } from "@/lib/api";
 import { cn } from "@/lib/utils";
 import { useI18n } from "@/i18n";

web/src/components/ThemeSwitcher.tsx

@@ -3,9 +3,9 @@ import { createPortal } from "react-dom";
 import { Palette, Check } from "lucide-react";
 import { Button } from "@nous-research/ui/ui/components/button";
 import { ListItem } from "@nous-research/ui/ui/components/list-item";
-import { BottomSheet } from "@nous-research/ui/ui/components/bottom-sheet";
-import { Typography } from "@nous-research/ui/ui/components/typography/index";
-import { useBelowBreakpoint } from "@nous-research/ui/hooks/use-below-breakpoint";
+import { BottomPickSheet } from "@/components/BottomPickSheet";
+import { Typography } from "@/components/NouiTypography";
+import { useBelowBreakpoint } from "@/hooks/useBelowBreakpoint";
 import { BUILTIN_THEMES, useTheme } from "@/themes";
 import type { DashboardTheme, ThemeListEntry } from "@/themes";
 import { useI18n } from "@/i18n";
@@ -91,7 +91,7 @@ export function ThemeSwitcher({ collapsed = false, dropUp = false }: ThemeSwitch
       </Button>
 
       {useMobileSheet && (
-        <BottomSheet
+        <BottomPickSheet
           backdropDismissLabel={t.common.close}
           onClose={close}
           open={open}
@@ -105,7 +105,7 @@ export function ThemeSwitcher({ collapsed = false, dropUp = false }: ThemeSwitch
               themeName={themeName}
             />
           </div>
-        </BottomSheet>
+        </BottomPickSheet>
       )}
 
       {open && !useMobileSheet && (() => {

web/src/components/Toast.tsx

@@ -0,0 +1,40 @@
+import { useEffect, useState } from "react";
+import { createPortal } from "react-dom";
+
+export function Toast({ toast }: { toast: { message: string; type: "success" | "error" } | null }) {
+  const [visible, setVisible] = useState(false);
+  const [current, setCurrent] = useState(toast);
+
+  useEffect(() => {
+    if (toast) {
+      setCurrent(toast);
+      setVisible(true);
+    } else {
+      setVisible(false);
+      const timer = setTimeout(() => setCurrent(null), 200);
+      return () => clearTimeout(timer);
+    }
+  }, [toast]);
+
+  if (!current) return null;
+
+  // Portal to document.body so the toast escapes any ancestor stacking context
+  // (e.g. <main> has `relative z-2`, which would trap z-50 below the header's z-40).
+  return createPortal(
+    <div
+      role="status"
+      aria-live="polite"
+      className={`fixed top-16 right-4 z-50 border px-4 py-2.5 font-courier text-xs tracking-wider uppercase backdrop-blur-sm ${
+        current.type === "success"
+          ? "bg-success/15 text-success border-success/30"
+          : "bg-destructive/15 text-destructive border-destructive/30"
+      }`}
+      style={{
+        animation: visible ? "toast-in 200ms ease-out forwards" : "toast-out 200ms ease-in forwards",
+      }}
+    >
+      {current.message}
+    </div>,
+    document.body,
+  );
+}

web/src/components/ui/card.tsx

@@ -0,0 +1,63 @@
+import { cn, themedBody } from "@/lib/utils";
+
+/**
+ * Themed card primitive. Themes can restyle every card without touching
+ * call sites by setting CSS vars under the `card` component-style bucket:
+ *
+ *   componentStyles:
+ *     card:
+ *       clipPath: "polygon(10px 0, 100% 0, 100% calc(100% - 10px), calc(100% - 10px) 100%, 0 100%, 0 10px)"
+ *       border: "1px solid var(--color-ring)"
+ *       background: "linear-gradient(180deg, var(--color-card) 0%, transparent 100%)"
+ *       boxShadow: "0 0 0 1px var(--color-ring) inset, 0 0 24px -8px var(--warm-glow)"
+ *
+ * All properties are optional — vars that aren't set compute to their
+ * CSS initial value, so the default shadcn-y card keeps looking normal
+ * for themes that don't override anything.
+ */
+const CARD_STYLE: React.CSSProperties = {
+  clipPath: "var(--component-card-clip-path)",
+  borderImage: "var(--component-card-border-image)",
+  background: "var(--component-card-background)",
+  boxShadow: "var(--component-card-box-shadow)",
+};
+
+export function Card({ className, style, ...props }: React.HTMLAttributes<HTMLDivElement>) {
+  return (
+    <div
+      className={cn(
+        "border border-border bg-card/80 text-card-foreground w-full",
+        themedBody,
+        className,
+      )}
+      style={{ ...CARD_STYLE, ...style }}
+      {...props}
+    />
+  );
+}
+
+export function CardHeader({ className, ...props }: React.HTMLAttributes<HTMLDivElement>) {
+  return <div className={cn("flex flex-col gap-1.5 p-4 border-b border-border", className)} {...props} />;
+}
+
+export function CardTitle({ className, ...props }: React.HTMLAttributes<HTMLHeadingElement>) {
+  return (
+    <h3
+      className={cn(
+        "font-mondwest text-display text-sm tracking-[0.12em] text-text-primary",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+export function CardDescription({ className, ...props }: React.HTMLAttributes<HTMLParagraphElement>) {
+  return (
+    <p className={cn("font-mondwest normal-case text-xs text-muted-foreground", className)} {...props} />
+  );
+}
+
+export function CardContent({ className, ...props }: React.HTMLAttributes<HTMLDivElement>) {
+  return <div className={cn("p-4", className)} {...props} />;
+}

web/src/components/ui/confirm-dialog.tsx

@@ -0,0 +1,137 @@
+import { useEffect, useRef } from "react";
+import { createPortal } from "react-dom";
+import { AlertTriangle } from "lucide-react";
+import { Button } from "@nous-research/ui/ui/components/button";
+import { cn, themedBody } from "@/lib/utils";
+
+export function ConfirmDialog({
+  cancelLabel = "Cancel",
+  confirmLabel = "Confirm",
+  description,
+  destructive = false,
+  loading = false,
+  onCancel,
+  onConfirm,
+  open,
+  title,
+}: ConfirmDialogProps) {
+  const dialogRef = useRef<HTMLDivElement>(null);
+
+  // Focus the confirm button when opened; trap ESC to cancel.
+  useEffect(() => {
+    if (!open) return;
+
+    const prevActive = document.activeElement as HTMLElement | null;
+    dialogRef.current
+      ?.querySelector<HTMLButtonElement>("[data-confirm]")
+      ?.focus();
+
+    const onKey = (e: KeyboardEvent) => {
+      if (e.key === "Escape") {
+        e.preventDefault();
+        onCancel();
+      }
+    };
+
+    document.addEventListener("keydown", onKey);
+    const prevOverflow = document.body.style.overflow;
+    document.body.style.overflow = "hidden";
+
+    return () => {
+      document.removeEventListener("keydown", onKey);
+      document.body.style.overflow = prevOverflow;
+      prevActive?.focus?.();
+    };
+  }, [open, onCancel]);
+
+  if (!open) return null;
+
+  return createPortal(
+    <div
+      role="dialog"
+      aria-modal="true"
+      aria-labelledby="confirm-dialog-title"
+      aria-describedby={description ? "confirm-dialog-desc" : undefined}
+      onClick={(e) => {
+        if (e.target === e.currentTarget) onCancel();
+      }}
+      className={cn(
+        "fixed inset-0 z-50 flex items-center justify-center",
+        "bg-black/60 backdrop-blur-sm",
+        "animate-[fade-in_150ms_ease-out]",
+      )}
+    >
+      <div
+        ref={dialogRef}
+        className={cn(
+          themedBody,
+          "relative w-full max-w-md mx-4",
+          "border border-border bg-card shadow-lg",
+          "animate-[dialog-in_180ms_ease-out]",
+        )}
+      >
+        <div className="flex items-start gap-3 p-4 border-b border-border">
+          {destructive && (
+            <div
+              aria-hidden
+              className="mt-0.5 shrink-0 text-destructive"
+            >
+              <AlertTriangle className="h-4 w-4" />
+            </div>
+          )}
+
+          <div className="flex-1 min-w-0 flex flex-col gap-1">
+            <h2
+              id="confirm-dialog-title"
+              className="font-mondwest text-display text-sm font-bold tracking-[0.12em] blend-lighter"
+            >
+              {title}
+            </h2>
+
+            {description && (
+              <p
+                id="confirm-dialog-desc"
+                className="font-mondwest normal-case text-xs text-muted-foreground leading-relaxed"
+              >
+                {description}
+              </p>
+            )}
+          </div>
+        </div>
+
+        <div className="flex items-center justify-end gap-2 p-3">
+          <Button
+            type="button"
+            outlined
+            onClick={onCancel}
+            disabled={loading}
+          >
+            {cancelLabel}
+          </Button>
+          <Button
+            data-confirm
+            type="button"
+            destructive={destructive}
+            onClick={onConfirm}
+            disabled={loading}
+          >
+            {loading ? "…" : confirmLabel}
+          </Button>
+        </div>
+      </div>
+    </div>,
+    document.body,
+  );
+}
+
+interface ConfirmDialogProps {
+  cancelLabel?: string;
+  confirmLabel?: string;
+  description?: string;
+  destructive?: boolean;
+  loading?: boolean;
+  onCancel: () => void;
+  onConfirm: () => void;
+  open: boolean;
+  title: string;
+}

web/src/components/ui/input.tsx

@@ -0,0 +1,16 @@
+import { cn } from "@/lib/utils";
+
+export function Input({ className, ...props }: React.InputHTMLAttributes<HTMLInputElement>) {
+  return (
+    <input
+      className={cn(
+        "flex h-9 w-full border border-border bg-background/40 px-3 py-1 font-courier text-sm transition-colors",
+        "placeholder:text-muted-foreground",
+        "focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-foreground/30 focus-visible:border-foreground/25",
+        "disabled:cursor-not-allowed disabled:opacity-50",
+        className,
+      )}
+      {...props}
+    />
+  );
+}

web/src/components/ui/label.tsx

@@ -0,0 +1,13 @@
+import { cn } from "@/lib/utils";
+
+export function Label({ className, ...props }: React.LabelHTMLAttributes<HTMLLabelElement>) {
+  return (
+    <label
+      className={cn(
+        "font-mondwest text-xs tracking-[0.1em] uppercase leading-none peer-disabled:cursor-not-allowed peer-disabled:opacity-70",
+        className,
+      )}
+      {...props}
+    />
+  );
+}

web/src/components/ui/separator.tsx

@@ -0,0 +1,19 @@
+import { cn } from "@/lib/utils";
+
+export function Separator({
+  className,
+  orientation = "horizontal",
+  ...props
+}: React.HTMLAttributes<HTMLDivElement> & { orientation?: "horizontal" | "vertical" }) {
+  return (
+    <div
+      role="separator"
+      className={cn(
+        "shrink-0 bg-border",
+        orientation === "horizontal" ? "h-px w-full" : "h-full w-px",
+        className,
+      )}
+      {...props}
+    />
+  );
+}

web/src/contexts/SystemActions.tsx

@@ -1,7 +1,7 @@
 import { useCallback, useEffect, useState } from "react";
 import { api } from "@/lib/api";
 import type { ActionStatusResponse } from "@/lib/api";
-import { Toast } from "@nous-research/ui/ui/components/toast";
+import { Toast } from "@/components/Toast";
 import { useI18n } from "@/i18n";
 import {
   SystemActionsContext,

web/src/hooks/useBelowBreakpoint.ts

@@ -0,0 +1,19 @@
+import { useEffect, useState } from "react";
+
+/** True when viewport width is strictly below `px` (matches Tailwind `min-width: px`). */
+export function useBelowBreakpoint(px: number) {
+  const query = `(max-width: ${px - 1}px)`;
+  const [matches, setMatches] = useState(() =>
+    typeof window !== "undefined" ? window.matchMedia(query).matches : false,
+  );
+
+  useEffect(() => {
+    const mql = window.matchMedia(query);
+    const sync = () => setMatches(mql.matches);
+    sync();
+    mql.addEventListener("change", sync);
+    return () => mql.removeEventListener("change", sync);
+  }, [query]);
+
+  return matches;
+}

web/src/hooks/useConfirmDelete.ts

@@ -0,0 +1,41 @@
+import { useCallback, useState } from "react";
+
+export function useConfirmDelete<TId>({
+  onDelete,
+}: {
+  onDelete: (id: TId) => Promise<void>;
+}) {
+  const [pendingId, setPendingId] = useState<TId | null>(null);
+  const [isDeleting, setIsDeleting] = useState(false);
+
+  const requestDelete = useCallback((id: TId) => {
+    setPendingId(id);
+  }, []);
+
+  const cancel = useCallback(() => {
+    if (!isDeleting) setPendingId(null);
+  }, [isDeleting]);
+
+  const confirm = useCallback(async () => {
+    if (pendingId === null) return;
+    const id = pendingId;
+    setIsDeleting(true);
+    try {
+      await onDelete(id);
+      setPendingId(null);
+    } catch {
+      // Dialog stays open; caller can surface errors in onDelete before rethrowing
+    } finally {
+      setIsDeleting(false);
+    }
+  }, [pendingId, onDelete]);
+
+  return {
+    cancel,
+    confirm,
+    isDeleting,
+    isOpen: pendingId !== null,
+    pendingId,
+    requestDelete,
+  } as const;
+}

web/src/hooks/useToast.ts

@@ -0,0 +1,15 @@
+import { useCallback, useState } from "react";
+
+export function useToast(duration = 3000) {
+  const [toast, setToast] = useState<{ message: string; type: "success" | "error" } | null>(null);
+
+  const showToast = useCallback(
+    (message: string, type: "success" | "error") => {
+      setToast({ message, type });
+      setTimeout(() => setToast(null), duration);
+    },
+    [duration],
+  );
+
+  return { toast, showToast };
+}

web/src/lib/api.ts

@@ -41,11 +41,7 @@ function setSessionHeader(headers: Headers, token: string): void {
   }
 }
 
-export async function fetchJSON<T>(
-  url: string,
-  init?: RequestInit,
-  options?: FetchJSONOptions,
-): Promise<T> {
+export async function fetchJSON<T>(url: string, init?: RequestInit): Promise<T> {
   // Inject the session token into all /api/ requests.
   const headers = new Headers(init?.headers);
   const token = window.__HERMES_SESSION_TOKEN__;
@@ -104,7 +100,7 @@ export async function fetchJSON<T>(
     // that reload once on the first stale-token 401 — gated mode is
     // handled above, so reaching here in gated mode means a real
     // middleware failure that should not reload-loop.
-    if (!window.__HERMES_AUTH_REQUIRED__ && !options?.allowUnauthorized) {
+    if (!window.__HERMES_AUTH_REQUIRED__) {
       let alreadyReloaded = false;
       try {
         alreadyReloaded =
@@ -202,19 +198,8 @@ export const api = {
    * still exists but is never useful there (no Session, no cookie). The
    * AuthWidget component swallows 401s from this call: if the gate isn't
    * engaged, /api/auth/me returns 401 and the widget renders nothing.
-   *
-   * ``allowUnauthorized`` is load-bearing: in loopback mode this endpoint
-   * 401s by design, and fetchJSON's default loopback behaviour treats a
-   * 401 as a rotated session token and full-page-reloads to pick up a
-   * fresh one. Because every *other* dashboard request succeeds (and so
-   * clears the one-shot reload guard), that turns this expected 401 into
-   * an infinite reload loop. Opting out keeps the 401 a plain throw the
-   * widget can catch.
    */
-  getAuthMe: () =>
-    fetchJSON<AuthMeResponse>("/api/auth/me", undefined, {
-      allowUnauthorized: true,
-    }),
+  getAuthMe: () => fetchJSON<AuthMeResponse>("/api/auth/me"),
   logout: () =>
     fetch(`${BASE}/auth/logout`, {
       method: "POST",
@@ -529,15 +514,6 @@ export interface ActionResponse {
   pid: number;
 }
 
-/** Per-call overrides for {@link fetchJSON}. */
-interface FetchJSONOptions {
-  /** When true, a 401 response is surfaced as a normal thrown error rather
-   *  than triggering the loopback stale-token page reload. Use for probes
-   *  whose 401 is an expected signal (e.g. /api/auth/me in non-gated mode)
-   *  rather than evidence of a rotated session token. */
-  allowUnauthorized?: boolean;
-}
-
 export interface ActionStatusResponse {
   exit_code: number | null;
   lines: string[];

web/src/pages/AnalyticsPage.tsx

@@ -20,7 +20,7 @@ import { timeAgo } from "@/lib/utils";
 import { Button } from "@nous-research/ui/ui/components/button";
 import { Spinner } from "@nous-research/ui/ui/components/spinner";
 import { Stats } from "@nous-research/ui/ui/components/stats";
-import { Card, CardContent, CardHeader, CardTitle } from "@nous-research/ui/ui/components/card";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { Badge } from "@nous-research/ui/ui/components/badge";
 import { usePageHeader } from "@/contexts/usePageHeader";
 import { useI18n } from "@/i18n";

web/src/pages/ChatPage.tsx

@@ -23,7 +23,7 @@ import { WebglAddon } from "@xterm/addon-webgl";
 import { Terminal } from "@xterm/xterm";
 import "@xterm/xterm/css/xterm.css";
 import { Button } from "@nous-research/ui/ui/components/button";
-import { Typography } from "@nous-research/ui/ui/components/typography/index";
+import { Typography } from "@/components/NouiTypography";
 import { HERMES_BASE_PATH, buildWsAuthParam } from "@/lib/api";
 import { cn } from "@/lib/utils";
 import { Copy, PanelRight, X } from "lucide-react";

web/src/pages/ConfigPage.tsx

@@ -38,15 +38,15 @@ import {
 } from "lucide-react";
 import { api } from "@/lib/api";
 import { getNestedValue, setNestedValue } from "@/lib/nested";
-import { useToast } from "@nous-research/ui/hooks/use-toast";
-import { Toast } from "@nous-research/ui/ui/components/toast";
+import { useToast } from "@/hooks/useToast";
+import { Toast } from "@/components/Toast";
 import { AutoField } from "@/components/AutoField";
 import { Button } from "@nous-research/ui/ui/components/button";
 import { ListItem } from "@nous-research/ui/ui/components/list-item";
 import { Spinner } from "@nous-research/ui/ui/components/spinner";
-import { Card, CardContent, CardHeader, CardTitle } from "@nous-research/ui/ui/components/card";
-import { ConfirmDialog } from "@nous-research/ui/ui/components/confirm-dialog";
-import { Input } from "@nous-research/ui/ui/components/input";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { ConfirmDialog } from "@/components/ui/confirm-dialog";
+import { Input } from "@/components/ui/input";
 import { Badge } from "@nous-research/ui/ui/components/badge";
 import { useI18n } from "@/i18n";
 import { usePageHeader } from "@/contexts/usePageHeader";

web/src/pages/CronPage.tsx

@@ -4,17 +4,17 @@ import { Badge } from "@nous-research/ui/ui/components/badge";
 import { Button } from "@nous-research/ui/ui/components/button";
 import { Select, SelectOption } from "@nous-research/ui/ui/components/select";
 import { Spinner } from "@nous-research/ui/ui/components/spinner";
-import { H2 } from "@nous-research/ui/ui/components/typography/h2";
+import { H2 } from "@/components/NouiTypography";
 import { api } from "@/lib/api";
 import type { CronJob, ProfileInfo } from "@/lib/api";
 import { DeleteConfirmDialog } from "@/components/DeleteConfirmDialog";
-import { useToast } from "@nous-research/ui/hooks/use-toast";
-import { useConfirmDelete } from "@nous-research/ui/hooks/use-confirm-delete";
+import { useToast } from "@/hooks/useToast";
+import { useConfirmDelete } from "@/hooks/useConfirmDelete";
 import { useModalBehavior } from "@/hooks/useModalBehavior";
-import { Toast } from "@nous-research/ui/ui/components/toast";
-import { Card, CardContent } from "@nous-research/ui/ui/components/card";
-import { Input } from "@nous-research/ui/ui/components/input";
-import { Label } from "@nous-research/ui/ui/components/label";
+import { Toast } from "@/components/Toast";
+import { Card, CardContent } from "@/components/ui/card";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
 import { useI18n } from "@/i18n";
 import { usePageHeader } from "@/contexts/usePageHeader";
 import { PluginSlot } from "@/plugins";

web/src/pages/EnvPage.tsx

@@ -17,9 +17,9 @@ import {
 import { api } from "@/lib/api";
 import type { EnvVarInfo } from "@/lib/api";
 import { DeleteConfirmDialog } from "@/components/DeleteConfirmDialog";
-import { Toast } from "@nous-research/ui/ui/components/toast";
-import { useConfirmDelete } from "@nous-research/ui/hooks/use-confirm-delete";
-import { useToast } from "@nous-research/ui/hooks/use-toast";
+import { Toast } from "@/components/Toast";
+import { useConfirmDelete } from "@/hooks/useConfirmDelete";
+import { useToast } from "@/hooks/useToast";
 import { OAuthProvidersCard } from "@/components/OAuthProvidersCard";
 import { Button } from "@nous-research/ui/ui/components/button";
 import { ListItem } from "@nous-research/ui/ui/components/list-item";
@@ -30,10 +30,10 @@ import {
   CardDescription,
   CardHeader,
   CardTitle,
-} from "@nous-research/ui/ui/components/card";
+} from "@/components/ui/card";
 import { Badge } from "@nous-research/ui/ui/components/badge";
-import { Input } from "@nous-research/ui/ui/components/input";
-import { Label } from "@nous-research/ui/ui/components/label";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
 import { useI18n } from "@/i18n";
 import { usePageHeader } from "@/contexts/usePageHeader";
 import { PluginSlot } from "@/plugins";

web/src/pages/LogsPage.tsx

@@ -12,8 +12,8 @@ import { Button } from "@nous-research/ui/ui/components/button";
 import { FilterGroup, Segmented } from "@nous-research/ui/ui/components/segmented";
 import { Spinner } from "@nous-research/ui/ui/components/spinner";
 import { Switch } from "@nous-research/ui/ui/components/switch";
-import { Card, CardContent, CardHeader, CardTitle } from "@nous-research/ui/ui/components/card";
-import { Label } from "@nous-research/ui/ui/components/label";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { Label } from "@/components/ui/label";
 import { useI18n } from "@/i18n";
 import { usePageHeader } from "@/contexts/usePageHeader";
 import { PluginSlot } from "@/plugins";

web/src/pages/ModelsPage.tsx

@@ -24,9 +24,9 @@ import { formatTokenCount } from "@/lib/format";
 import { Button } from "@nous-research/ui/ui/components/button";
 import { Spinner } from "@nous-research/ui/ui/components/spinner";
 import { Stats } from "@nous-research/ui/ui/components/stats";
-import { Card, CardContent, CardHeader, CardTitle } from "@nous-research/ui/ui/components/card";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { Badge } from "@nous-research/ui/ui/components/badge";
-import { ConfirmDialog } from "@nous-research/ui/ui/components/confirm-dialog";
+import { ConfirmDialog } from "@/components/ui/confirm-dialog";
 import { useModalBehavior } from "@/hooks/useModalBehavior";
 import { usePageHeader } from "@/contexts/usePageHeader";
 import { useI18n } from "@/i18n";

web/src/pages/PluginsPage.tsx

@@ -10,12 +10,12 @@ import { Select, SelectOption } from "@nous-research/ui/ui/components/select";
 import { Switch } from "@nous-research/ui/ui/components/switch";
 import { Spinner } from "@nous-research/ui/ui/components/spinner";
 import { CommandBlock } from "@nous-research/ui/ui/components/command-block";
-import { Card, CardContent, CardHeader, CardTitle } from "@nous-research/ui/ui/components/card";
-import { ConfirmDialog } from "@nous-research/ui/ui/components/confirm-dialog";
-import { Input } from "@nous-research/ui/ui/components/input";
-import { Label } from "@nous-research/ui/ui/components/label";
-import { useToast } from "@nous-research/ui/hooks/use-toast";
-import { Toast } from "@nous-research/ui/ui/components/toast";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { ConfirmDialog } from "@/components/ui/confirm-dialog";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import { useToast } from "@/hooks/useToast";
+import { Toast } from "@/components/Toast";
 import { useI18n } from "@/i18n";
 import { PluginSlot } from "@/plugins";
 import { cn } from "@/lib/utils";

web/src/pages/ProfilesPage.tsx

@@ -14,19 +14,19 @@ import {
   X,
 } from "lucide-react";
 import spinners from "unicode-animations";
-import { H2 } from "@nous-research/ui/ui/components/typography/h2";
+import { H2 } from "@/components/NouiTypography";
 import { api } from "@/lib/api";
 import type { ProfileInfo } from "@/lib/api";
 import { DeleteConfirmDialog } from "@/components/DeleteConfirmDialog";
-import { useToast } from "@nous-research/ui/hooks/use-toast";
-import { useConfirmDelete } from "@nous-research/ui/hooks/use-confirm-delete";
+import { useToast } from "@/hooks/useToast";
+import { useConfirmDelete } from "@/hooks/useConfirmDelete";
 import { useModalBehavior } from "@/hooks/useModalBehavior";
-import { Toast } from "@nous-research/ui/ui/components/toast";
-import { Card, CardContent } from "@nous-research/ui/ui/components/card";
+import { Toast } from "@/components/Toast";
+import { Card, CardContent } from "@/components/ui/card";
 import { Badge } from "@nous-research/ui/ui/components/badge";
 import { Button } from "@nous-research/ui/ui/components/button";
-import { Input } from "@nous-research/ui/ui/components/input";
-import { Label } from "@nous-research/ui/ui/components/label";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
 import { Checkbox } from "@nous-research/ui/ui/components/checkbox";
 import { useI18n } from "@/i18n";
 import { usePageHeader } from "@/contexts/usePageHeader";

web/src/pages/SessionsPage.tsx

@@ -34,18 +34,18 @@ import type {
 import { timeAgo } from "@/lib/utils";
 import { Markdown } from "@/components/Markdown";
 import { PlatformsCard } from "@/components/PlatformsCard";
-import { Toast } from "@nous-research/ui/ui/components/toast";
+import { Toast } from "@/components/Toast";
 import { Button } from "@nous-research/ui/ui/components/button";
 import { ListItem } from "@nous-research/ui/ui/components/list-item";
 import { Segmented } from "@nous-research/ui/ui/components/segmented";
 import { Spinner } from "@nous-research/ui/ui/components/spinner";
 import { Badge } from "@nous-research/ui/ui/components/badge";
-import { Card, CardContent, CardHeader, CardTitle } from "@nous-research/ui/ui/components/card";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { DeleteConfirmDialog } from "@/components/DeleteConfirmDialog";
-import { useConfirmDelete } from "@nous-research/ui/hooks/use-confirm-delete";
-import { Input } from "@nous-research/ui/ui/components/input";
+import { useConfirmDelete } from "@/hooks/useConfirmDelete";
+import { Input } from "@/components/ui/input";
 import { useSystemActions } from "@/contexts/useSystemActions";
-import { useToast } from "@nous-research/ui/hooks/use-toast";
+import { useToast } from "@/hooks/useToast";
 import { useI18n } from "@/i18n";
 import { usePageHeader } from "@/contexts/usePageHeader";
 import { PluginSlot } from "@/plugins";

web/src/pages/SkillsPage.tsx

@@ -17,16 +17,16 @@ import {
 } from "lucide-react";
 import { api } from "@/lib/api";
 import type { SkillInfo, ToolsetInfo } from "@/lib/api";
-import { useToast } from "@nous-research/ui/hooks/use-toast";
-import { Toast } from "@nous-research/ui/ui/components/toast";
-import { Card, CardContent, CardHeader, CardTitle } from "@nous-research/ui/ui/components/card";
+import { useToast } from "@/hooks/useToast";
+import { Toast } from "@/components/Toast";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { Badge } from "@nous-research/ui/ui/components/badge";
 import { Button } from "@nous-research/ui/ui/components/button";
 import { ListItem } from "@nous-research/ui/ui/components/list-item";
 import { Spinner } from "@nous-research/ui/ui/components/spinner";
 import { Switch } from "@nous-research/ui/ui/components/switch";
 import { cn } from "@/lib/utils";
-import { Input } from "@nous-research/ui/ui/components/input";
+import { Input } from "@/components/ui/input";
 import { useI18n } from "@/i18n";
 import { usePageHeader } from "@/contexts/usePageHeader";
 import { PluginSlot } from "@/plugins";

web/src/plugins/registry.ts

@@ -23,10 +23,10 @@ import { Badge } from "@nous-research/ui/ui/components/badge";
 import { Button } from "@nous-research/ui/ui/components/button";
 import { Checkbox } from "@nous-research/ui/ui/components/checkbox";
 import { Select, SelectOption } from "@nous-research/ui/ui/components/select";
-import { Card, CardHeader, CardTitle, CardContent } from "@nous-research/ui/ui/components/card";
-import { Input } from "@nous-research/ui/ui/components/input";
-import { Label } from "@nous-research/ui/ui/components/label";
-import { Separator } from "@nous-research/ui/ui/components/separator";
+import { Card, CardHeader, CardTitle, CardContent } from "@/components/ui/card";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import { Separator } from "@/components/ui/separator";
 import { Tabs, TabsList, TabsTrigger } from "@nous-research/ui/ui/components/tabs";
 import { useI18n } from "@/i18n";
 import { registerSlot, PluginSlot } from "./slots";

website/src/pages/skills/index.tsx

@@ -500,7 +500,7 @@ export default function SkillsDashboard() {
   const sources = useMemo(() => {
     const set = new Set(allSkillsLocal.map((s) => s.source));
     return SOURCE_ORDER.filter((s) => s === "all" || set.has(s));
-  }, [allSkillsLocal]);
+  }, []);
 
   const categoryEntries = useMemo(() => {
     const pool =
@@ -523,7 +523,7 @@ export default function SkillsDashboard() {
     return Array.from(map.entries())
       .sort((a, b) => b[1].count - a[1].count)
       .map(([key, { label, count }]) => ({ key, label, count }));
-  }, [sourceFilter, allSkillsLocal]);
+  }, [sourceFilter]);
 
   const filtered = useMemo(() => {
     const q = debouncedSearch.toLowerCase().trim();