When the terminal's own 'disable mouse reporting' toggle (or an external
app / tmux) clears the DEC mouse modes, a mouse-only user is deadlocked:
every existing recovery trigger (resize, >5s stdin gap + keypress,
raw-mode bounce) needs stdin — and mouse reporting being off is exactly
why no stdin arrives. Users had to resize the window to scroll again.
Fix: a mouse-mode watchdog in App that DECRQM-probes mode 1000 every 2s
while tracking is expected on. If the terminal reports the mode RESET,
reassertTerminalModes() re-arms tracking — the same recovery a resize
performs, without the resize. Probes are skipped whenever a mouse/wheel
event arrived within the interval (tracking provably alive → zero query
chatter during normal use), never fired while paused for an editor
handoff or when /mouse off was chosen, and the watchdog permanently
disables itself on terminals that don't answer DECRQM (DA1-sentinel
resolution via the existing timeout-free TerminalQuerier).
Terminals whose toggle merely gates event delivery report SET, so an
active user toggle is never fought; terminals whose toggle clears the
modes report RESET after re-enable and recover within ~2s.
Follow-ups for the consolidated salvage:
- Memoize the config.yaml-derived timeout on the file's mtime_ns so the
rebuild-on-timeout-change check from PR #57437 costs one stat() per
get_honcho_client() call instead of a full YAML load on the hot path.
- hermes honcho status now displays the host-block-resolved
dialecticCadence (remnant from PR #63776, whose runtime fix landed
in #62290).
- AUTHOR_MAP entries for the salvaged contributor emails.
The Honcho client singleton cached the HTTP timeout at first build.
In long-lived processes (gateway, dashboard), changing the timeout
via config.yaml or HONCHO_TIMEOUT had no effect until restart.
Track the resolved timeout alongside the cached client and compare
on each get_honcho_client() call. When the timeout differs, reset
the singleton so the next call rebuilds with the new value.
Fixes#57347
Fixes Honcho client initialization for setup-generated configs that store
connection details in a named host block (e.g. "local"). Previously:
- base_url was only read from flat config root, not from host_block.
- resolve_active_host() ignored defaultHost and always used the Hermes
profile key ("hermes"), so the host block lookup returned {} and the
api_key was also lost.
FixesNousResearch/hermes-agent#61661
honcho_reasoning's minimal tier hard-caps Honcho's dialectic output at 250
tokens combined with the model's own hidden reasoning tokens. Confirmed via
direct honcho-api server logs that a multi-fact query ("summarize known
facts about this peer and communication preferences") run at
reasoning_level=minimal gets cut off mid chain-of-thought at exactly
output_tokens=250, before the model ever reaches a synthesized answer.
low/medium/high/max fall back to Honcho's much larger global dialectic
default and don't hit this cap. Since dialecticDynamic is on by default and
the calling model picks reasoning_level itself via this tool parameter, the
fix is to make the tradeoff explicit in the parameter description so the
model defaults to low unless the query is genuinely a single-fact lookup.
Schema-description-only change; the shared dialectic_max_chars truncation
cap in session.py's dialectic_query() is a separate fix (its own PR).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Verify that get_prefetch_context queries user context through the
assistant observer when _ai_observe_others is enabled, matching
the fix that routes _fetch_session_context through
_resolve_observer_target.
_fetch_session_context was using user_peer_id directly as observer
when calling _fetch_peer_context, bypassing _resolve_observer_target.
This caused honcho_context to return empty data because the observer
perspective was wrong (user instead of hermes/assistant).
Fixed by resolving observer via _resolve_observer_target(session, 'user'),
consistent with all other call sites (get_peer_card, honcho_search, etc.).
- Make the config imports lazy inside _auto_title_enabled(), matching the
existing _title_language() pattern (title_generator is imported from agent
code paths where a module-level hermes_cli import risks circularity).
- Check the enabled flag after the cheap first-exchange guard in
maybe_auto_title so config isn't read on every turn of a long session.
- Repoint the two new tests at the real import site.
- Document the key in cli-config.yaml.example and merge the enabled flag
into the existing title_generation block in configuration.md.
- AUTHOR_MAP entry for the contributor.
* fix: detect env-var-configured providers absent from PROVIDER_REGISTRY
is_provider_explicitly_configured() only checked PROVIDER_REGISTRY (a
manually-maintained dict) for env-var names. Providers that exist solely
in the models.dev catalog — e.g. openrouter — were never recognised as
explicitly configured, so they were filtered out of the desktop model
picker even when their API key was set in .env.
Add a fallback to get_provider() (which reads the models.dev catalog)
when PROVIDER_REGISTRY returns None. Both ProviderConfig and ProviderDef
expose .auth_type and .api_key_env_vars with the same shape.
* test: keep OpenRouter provider gate assertion behavioral
* chore(release): map salvaged OpenRouter contributor
---------
Co-authored-by: zzpigpinggai <zzpigpinggai@users.noreply.github.com>
Add a developer-guide page for running the Ink TUI and Electron desktop
app from a git worktree without a full npm install per checkout, via the
htui/hgui shell helpers that share node_modules from a canonical deps
checkout by symlink (falling back to a local npm ci when the lockfile
diverges). Registers it in the sidebar, cross-links from the TUI and git
-worktrees pages, and documents the previously-undocumented
HERMES_DESKTOP_PYTHON / HERMES_DESKTOP_DEV_SERVER env vars the desktop
backend reads.
Follow-up to #65890 (router transitions off) and #65898 (structural
compare + first-paint budget): profiling the switch path on real 1000+-
message sessions with a new CDP harness showed the remaining freeze is
NOT markdown rendering — it's a forced-reflow cascade from mount-time
layout reads interleaved with style writes across the transcript's
layout effects, plus the first-paint budget cut landing too late to
stop the full-budget commit.
Measured on the two largest local sessions (996 and 1363 messages),
main-thread longtask totals per switch: warm 2450ms -> 557ms and
1158ms -> 194ms; first paint 1690ms -> 444ms. Harness:
scripts/profile-session-switch.mjs (same CDP family as
profile-real-stream.mjs).
- use-resize-observer: drop the synchronous initial callback and ride
the observer's spec-guaranteed first delivery instead (same frame,
after layout, before paint). The sync call ran while the commit's
layout was dirty, so every size read in a callback forced a full
reflow — with one instance per user bubble (measureClamp read
scrollHeight, then WROTE --human-msg-full, re-dirtying layout for the
next bubble), the switch commit thrashed for over a second. Inside RO
timing the same reads are free. Composer metrics (2x
getBoundingClientRect + documentElement style writes) rides the same
fix.
- Same class, same fix at the remaining call sites profiling surfaced:
ExpandableBlock and TerminalOutput (dozens per tool-heavy transcript)
now measure/pin via RO initial delivery; the tool-window and
thinking-preview pins drop their sync pin() call; the thread
timeline's initial active-tick compute joins its existing
scroll-time rAF batching so back-to-back transcript updates coalesce.
- thread/list: cut the render budget in the RENDER phase (state-from-
props adjustment) instead of the post-commit layout effect. The
effect-time cut was too late — on a warm switch React first built and
committed the full 300-part tree, then re-rendered at 60, then bumped
back to 300, so the expensive commit still happened (and on a cold
switch the bump rAF usually fired while the transcript was still
empty, so the prefetched messages rendered at full budget anyway).
The render-phase cut restarts the component before any child renders;
a second trigger handles the cold path where messages land later
under the same sessionKey.
- thread/list: backfill 60 -> 300 inside startTransition so the older
turns' markdown+shiki render is interruptible background work instead
of a synchronous freeze one frame after the switch paints. Functional
Math.max so an urgent "Show earlier" click can't be rebased back down.
- composer focus: skip the rAF/timeout focus retries when the element
is already focused — focus() runs the full focusing steps (forcing
layout) even on the active element, ~585ms per switch on a large
dirty DOM.
- Replace the tautological render-budget test (it re-declared the
constants locally and asserted 60 < 300) with behavior tests of the
now-exported buildGroups + firstVisibleGroupIndex.
Verification: apps/desktop `npx tsc --noEmit` clean; full
`npx vitest run` 210 files / 1763 passed; manual CDP check confirms the
deferred backfill commits the full transcript, stays pinned to bottom,
and "Show earlier" still pages.
Post-hoc sprite removal is a losing battle (three inpainting strategies
failed QC on letter-edge overlap frames). The production answer: sprites
are BillboardComponent/SpriteComponent/ArrowComponent subobjects — set
bVisible:false via ObjectTools (remove_component fails on default
subobjects), swept scene-wide in one ProgrammaticToolset script
(148 actors, 13 sprites, one round-trip, verified).
New references/advanced-workflows.md covering the sophisticated-workflow
surface, each section exercised against a running editor:
- ProgrammaticToolset batching: full contract (get_execution_environment
gate, execute_tool fully-qualified names, JSON-string inputs,
returnValue unwrapping, allowed imports) + a verified worked example
(12-column colonnade, 36 components in one round-trip vs 37 serial calls)
- Blueprint DSL authoring loop, verified end-to-end: create -> list_graphs
-> get_graph_dsl_docs -> find_node_types per node -> write_graph_dsl ->
compile_blueprint -> spawn instance. Every node-ID gotcha hit live is
recorded (EventTick not Tick, Math|Rotator|MakeRotator, registry
categories vs doc categories, no (self) node)
- PIE session options schema (bSimulate/playMode/warmupSeconds/
startTransform, out-of-process downgrade behavior)
- Sequencer orientation: 140-tool surface mapped by capability group +
sibling keyframing/controlrig/conditions toolsets + minimal cinematic
skeleton
- LogsToolset self-debugging, AutomationTestToolset CI loop,
SemanticSearch, ConfigSettings, project AgentSkillToolset precedence
- Per-situation decision table
New pitfalls from this round's live failures: 10b (refPath-object vs
plain-string params; schema-in-error as tiebreaker), 10c (DSL node IDs
must come from find_node_types). SKILL.md: batching exception wired into
the operating loop, reference table row, description updated.
Ran the full loop against a real editor (blank project, ModelContextProtocol
+ ToolsetRegistry + AllToolsets enabled): raw MCP handshake, discovery walk,
environment relight for golden hour, primitive monument build, virtual-camera
captures with vision judgment, exposure debugging, annotated spatial capture.
67 toolsets advertised; every dispatch semantic below observed, not inferred.
Corrections and additions from the live run:
- Qualified toolset names (editor_toolset.toolsets.scene.SceneTools) with
SHORT tool_name; TOptional params must be explicit null; find_actors
requires ''/[] for its schema-required optionals; ObjectTools values is a
JSON *string*; refPath object references; returnValue wrapping; per-property
failure lists with schema-in-error
- HTTP wire contract: initialize=JSON + session header, tools/call=SSE frame
after game-thread completion (plain-JSON clients read empty body)
- CaptureViewport as virtual camera (captureTransform, meter-unit annotation
grid + actor callouts) verified with pixel evidence; recipes rewritten to
use it instead of viewport piloting
- New pitfalls from real failures: template-level environment-actor
duplication compounding into whiteouts (find-first/spawn-if-missing rule),
template exposure calibration vs physical lux (12b), objective exposure
check via ffprobe YAVG (12c), untitled-level Save-As modal deadlock,
macOS full-Xcode + Metal Toolchain requirement (xcodebuild
-downloadComponent MetalToolchain)
- Live toolset census (67 on blank project), LogsToolset/ConfigSettings/
SemanticSearch highlights, UE EULA 6(e) licensing note
Desktop launch and the update-chain rebuild install npm deps whose child
scripts shell out to a bare `node` (e.g. electron-winstaller's
select-7z-arch.js). When launched from the desktop updater chain
(Desktop -> hermes-setup -> hermes update) the shell PATH customizations are
lost, so the install dies with `'node' is not recognized` / `node: not found`.
- cmd_gui: wrap the npm-install env with with_hermes_node_path(_nixos_build_env())
so managed Node is prepended even on a stripped PATH — mirrors the idiom
already used by the update deps refresh. (The original fix merged nixos_env
on TOP of the managed env, whose full os.environ copy clobbered the managed
PATH back to bare; wrapping fixes that merge order.)
- _cmd_update_impl: spawn the `desktop --build-only` subprocess with
with_hermes_node_path() so the child starts with managed Node from the outset.
Regression test: the desktop install env now prepends the managed Node dir
ahead of a bare updater PATH instead of passing env=None.
Co-authored-by: F4TB0Yz <jfduarte09@gmail.com>
The web dashboard runs inside the gateway process, so `os.environ` carries
`_HERMES_GATEWAY=1`. `_spawn_hermes_action` spread that into the subprocess env,
so a spawned `hermes gateway restart` (dashboard "Enable webhooks", Telegram QR
apply) tripped the in-process restart-loop guard and exited 1 — the gateway
never restarted, but the dashboard reported `restart_started: true` because it
only checks that the spawn succeeded.
Scrub `_HERMES_GATEWAY` from the spawned action's env, matching what the
gateway's own restart watcher already does (gateway/run.py).
Fixes#52470. Adds a test asserting the spawned env drops the loop-guard var
while keeping HERMES_NONINTERACTIVE.
* fix(dashboard): unblock basic auth plugin during interactive password setup
When the dashboard prompts for username/password on a non-loopback bind,
also remove the bundled basic provider from plugins.disabled so
discover_plugins(force=True) can register it (#54489).
* test(dashboard): cover basic auth plugin blocked by plugins.disabled
Regression harness for #54489: credentials in config are not enough when
the bundled basic provider is on the deny-list.
Auto-compression ends the SessionDB session and forks a continuation,
rotating the stored session id. The gateway emits `session.info` with
the new `stored_session_id`, and the desktop's cache entry was updated
via `ensureSessionState` — but the URL route and `$selectedStoredSessionId`
never followed the rotation.
On the next send, `getRuntimeIdForStoredSession(oldStoredId)` returned
null (the cache entry's `storedSessionId` no longer matched the old id),
so `routedSessionNeedsResume` evaluated true, triggering a full
`session.resume` + REST transcript prefetch — the whole thread reloaded.
Fix: a new `$activeSessionStoredId` atom is set in `ensureSessionState`
when the active session's stored id changes. A `useEffect` in
`use-session-actions` subscribes to it and re-anchors the route +
selection (`setSelectedStoredSessionId` + `navigate(replace: true)`),
and cleans up the stale stored→runtime mapping.
`replace: true` because it's the same conversation — compression is
transparent to the user, so back-button stays correct.
* feat(desktop): add useKeybindHint hook and TipKeybindLabel
Add a shared hook that reads the current keybind combo for an action
id from the $bindings store (rebindable) or KEYBIND_READONLY (fixed),
returning a formatted string or null when unbound.
Add TipKeybindLabel — a convenience component that auto-reads both
its label (from i18n) and keybind combo from the action registry.
Pass only actionId for the common case; pass text to override when
the tooltip is context-dependent.
* fix(desktop): replace native title= on buttons with themed Tip
Migrate all <button>/<Button> elements using the native HTML title=
attribute to the instant, themed <Tip> component. Native tooltips are
unstyled, delayed (~500ms OS default), and visually inconsistent with
the app's instant themed tooltips.
Also adds <Tip> wrappers to icon-only buttons that were missing
tooltips entirely (dialog close, search clear, overlay close,
master-detail pane controls, keybind panel rebind/reset buttons).
Adds an enforcement test (no-native-title.test.ts) that scans all
.tsx files for <button>/<Button> with title= and fails if any are
found. Updates DESIGN.md with the icon-only button tooltip rule and
keybind hint guidance.
* feat(desktop): wire keybind hints into button tooltips
Add actionId to TitlebarTool, StatusbarItem, and SidebarNavItem so
their tooltips show the current keybind combo via TipKeybindLabel.
Fix the hardcoded NEW_SESSION_KBD in the sidebar to read from
$bindings so it stays live on rebind.
Wired surfaces:
- Titlebar: sidebar toggle, flip panes, keybinds, settings
- Statusbar: terminal toggle (view.showTerminal)
- Status stack: open agents button (nav.agents)
- Sidebar nav: new session, skills, messaging, artifacts
* feat(desktop): move keybind panel to settings tab with search filter
Move the keyboard shortcuts panel from a Radix Dialog into a proper
Settings tab (/settings?tab=keybinds). The ⌘/ shortcut and titlebar
keyboard button now navigate to this settings tab instead of toggling
a dialog. Adds a search filter to filter shortcuts by label.
- New: src/app/settings/keybind-settings.tsx (extracted from keybind-panel.tsx)
- Delete: src/app/shell/keybind-panel.tsx (dialog wrapper removed)
- Remove: $keybindPanelOpen atom and toggle/open/close functions
- Add: IconKeyboard to lib/icons.ts
- i18n: keybinds.search + settings.nav.keybinds (en, zh, zh-hant, ja)
* refactor(desktop): unify worktree dialog into shared WorktreeDialog
Extract the worktree creation dialog from StartWorkButton (sidebar) into a
shared WorktreeDialog component. Both the sidebar's StartWorkButton and the
composer's CodingStatusRow now use the same dialog, eliminating the duplicated
UI.
The shared dialog keeps the sidebar version's full feature set:
- BaseBranchPicker (filterable base branch combobox)
- Convert mode (check out an existing branch into a worktree)
- Sanitized branch name input
The coding row passes repoPath (from cwd) and onOpenWorktree (which carries
the composer draft to the new session) so the unified dialog works everywhere
there's a repo, not just inside an entered project.
Switching between chat sessions in the desktop app froze for up to ~1–2s on
large transcripts. Profiling the switch path surfaced three main-thread
blockers, fixed here minimally and without changing behavior.
1. JSON.stringify deep-compare (worst case). chatMessagesEquivalent compared
message parts with JSON.stringify(a) === JSON.stringify(b) on every switch.
On image-/large-blob-bearing transcripts this serialized every part twice
and cost well over a second. Replaced with a structural compare that never
stringifies: array-level identity fast-path, per-part reference fast-path,
then type-aware field comparison. The compare's only consumer asks "did the
transcript change, should I setMessages?", so it is deliberately
conservative — a false-negative just causes one extra idempotent
setMessages, while a false-positive (the unsafe direction) is avoided.
2. Scroll-settle loop. thread-list ran a requestAnimationFrame settle loop up
to 90 frames (or 5 stable frames) on every sessionKey change, each frame
forcing a synchronous layout read + write — racing the markdown paint for
up to ~1.5s. A normal synchronous switch stabilizes within a couple
frames, so the ceiling is now 2 stable frames / 15 max.
3. Synchronous first paint of up to 300 parts. On switch, thread-list reset
the render budget to the full RENDER_BUDGET=300, so up to 300 parts went
through markdown + shiki syntax-highlighting synchronously on the switch
commit. It now paints a small FIRST_PAINT_BUDGET=60 first, then bumps to
the full 300 in a requestAnimationFrame after the first commit.
Salvaged from PR #49807 by professorpalmer — re-applied to the restructured
file layout (use-session-actions/utils.ts, thread/list.tsx) and tests merged
into the existing utils.test.ts.
Co-authored-by: Cary Palmer <professorpalmer@users.noreply.github.com>
The sidebar working dot didn't update for background sessions until the
user opened them. Two coupled causes:
1. The gateway's session.info event payload omitted stored_session_id,
so the desktop app had no way to map a background session's runtime
id to its stored id. Without the stored id, setSessionWorking(null,
...) was a no-op — the $workingSessionIds atom never updated.
2. The running→busy transition in the session.info handler was gated on
`apply` (active session only). The gate correctly scopes view-only
side effects (setCurrentModel, setCurrentCwd, etc.) to the focused
chat, but the per-session busy state drives the sidebar indicator and
must reach every session. updateSessionState only mutates the
per-runtime cache entry, and syncSessionStateToView already guards
the view publish to the active session, so ungating is safe.
Fix: add stored_session_id to _session_info() in tui_gateway/server.py,
add the field to GatewayEventPayload, pass it to updateSessionState in
the session.info handler, and ungate the running→busy transition.
generate-patch now emits a has-fixes job output (true/false).
apply-patch is gated on it via `if: needs.generate-patch.outputs.has-fixes == 'true'`,
so when `npm run fix` produces no diff, the privileged job is skipped
entirely — no runner allocation, no redundant checkout/download/push/PR.
Replaces moonshotai/kimi-k2.6 (recommended) and moonshotai/kimi-k2.7-code
with moonshotai/kimi-k3 in both curated lists, regenerates the published
model-catalog.json manifest, and updates the docs example manifest (en+zh).
kimi-k3 verified live on both endpoints (Nous Portal /v1/models and
OpenRouter /api/v1/models; 1M context, $3/$15 per Mtok). Family-prefix
matching already covers k3 in moonshot_schema, cache policy, and context
heuristics — no code changes needed there.
queryRewrite (default off) gates the latest-message rewrite so the
extra auxiliary LLM call is opt-in. firstTurnBaseWait and
firstTurnDialecticWait expose the turn-1 bounded waits in seconds
(0 disables). All three resolve host-block-first like every other
field. Also pins per-host timeout resolution with tests.
