mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-21 16:18:55 +00:00
597615ade4
* feat(attribution): conflict-free contributor mappings via contributors/emails/ directory
The AUTHOR_MAP dict in scripts/release.py was a merge-conflict magnet:
every concurrent salvage PR appended entries to the same lines of the
same file, so parallel PRs re-conflicted on every merge to main.
New system: one file per email under contributors/emails/ — filename is
the commit-author email, first non-comment line is the GitHub login.
File additions never conflict, so any number of PRs can add mappings
concurrently.
- scripts/release.py: AUTHOR_MAP is now LEGACY_AUTHOR_MAP (frozen)
merged with the directory at import time (directory wins). All
existing consumers (resolve_author, contributor_audit.py) unchanged.
- scripts/add_contributor.py: idempotent CLI to add a mapping; refuses
conflicting reassignments (incl. against the legacy map), validates
email/login shapes.
- contributor-check.yml: attribution gate now accepts a mapping file OR
a legacy entry; failure message prints the exact add_contributor
command. Also auto-resolves bare <login>@users.noreply.github.com
emails is intentionally NOT added (kept id+login form only, matching
previous behavior).
- contributor_audit.py: guidance now points at add_contributor.py.
- tests/scripts/test_contributor_map.py: 12 tests covering loader,
merge precedence, CLI idempotency/conflict/validation, subprocess E2E.
* feat(ci): one-shot per-file flake retry in the parallel test runner
A failing test FILE is re-run once in a fresh subprocess. Pass-on-retry
counts as green but is loudly reported in a '⚠ FLAKY' summary section
(with both attempts' output preserved) so the flake gets fixed instead
of eating a full-run rerun. Deterministic failures fail both attempts —
regressions cannot be laundered green.
- --file-retries N / HERMES_TEST_FILE_RETRIES (default 1, 0 disables)
- E2E verified: simulated first-run-fail flake goes green with banner;
deterministic failure still exits 1; retries=0 restores old behavior.
This converts the dominant CI failure mode (one timing-sensitive test
flaking a 4600-test shard, requiring a manual 10-minute rerun and an
agent triage loop) into a self-healing retry that costs one file's
runtime.
* test(approval): loosen wall-clock perf bounds 0.15s -> 2.0s
These guard against catastrophic regex backtracking (seconds-to-minutes
class), but 0.15s is within scheduler-stall noise on loaded shared CI
runners — test_max_accepted_separator_free_input_is_fast failed a CI
shard this week on runner load alone. 2.0s still catches the regression
class with zero flake surface.
* fix(ci): job timeouts everywhere + retries on all network installs
Reliability pass over every workflow:
- timeout-minutes on all 21 jobs that lacked one (a hung job previously
burned the 6-hour default runner budget)
- ./.github/actions/retry wrapped around every network-fetching install
that lacked it: pip installs (deploy-site, skills-index), npm ci
(deploy-site website, upload_to_pypi web + ui-tui), uv sync (docker
test deps). Deterministic build steps (npm run build) deliberately
NOT retried — split into separate steps so a real build failure fails
fast instead of retrying 3x.
* docs(agents): document the file-retry flake policy
* fix(ci): curl retries on deploy hook + skills-index probe
* fix(ci): kill the remaining transient-failure classes in workflows + Dockerfile
From the workflow reliability audit:
- tests.yml: duration-cache restore had NO restore-keys while saves use
run_id-suffixed keys — the cache never matched once, so LPT slicing
always ran blind and unbalanced slices pushed heavy files toward the
per-file timeout. One-line restore-keys fixes slice balancing.
- Label gates (lint ci-reviewed, supply-chain mcp-catalog-reviewed):
'gh pr view || true' turned an API blip into 'label absent' → false
BLOCKING failure. Now 3x retry, and API failure is reported as an API
failure instead of a missing label.
- detect-changes action: compare API retried before failing open (was
silently running all lanes on any blip).
- uv-lockfile-check: 'uv lock --check' resolves against PyPI — retried
so registry blips don't read as 'lockfile stale'.
- docker.yml merge job: imagetools create retried (Docker Hub eventual
consistency on just-pushed digests).
- Dockerfile: apt-get Acquire::Retries=3; s6-overlay ADDs converted to
curl --retry 3 (ADD cannot retry; checksums still enforced); npm
--fetch-retries=5; playwright chromium fetch retried 3x.
- Advisory artifact uploads (per-slice durations, ci-timings report)
get continue-on-error so an artifact-service blip can't fail a green
test slice.
* fix(tests): kill the two root-cause flakes — leaking pre-warm timer + env-dependent provider list
- test_tui_gateway_server.py: session.create / non-eager session.resume
arm a 50ms threading.Timer (_schedule_agent_build) that outlives its
test and fires into the NEXT test's _make_agent mock, racily
corrupting captured state (the recurring session_resume shard
failures). Replaced the per-test whack-a-mole stub with a module-wide
autouse fixture; the 3 worker-lifecycle tests that genuinely need the
deferred build opt back in via @pytest.mark.real_agent_prewarm (new
marker in pyproject).
- test_api_key_providers.py: PROVIDER_ENV_VARS is now derived from the
live PROVIDER_REGISTRY instead of a hand-list that had drifted
(missing HF_TOKEN / DEEPINFRA_API_KEY) — resolve_provider('auto')
tests failed on any machine with HF_TOKEN exported. E2E-verified with
HF_TOKEN/DEEPINFRA_API_KEY set: 42/42 pass.
* test: de-flake 30 timing-sensitive test files for loaded CI runners
Root-cause fixes from the flake audit (session-DB mining + repo sweep):
Event-based sync instead of sleep-sync:
- title_generator: mock sets threading.Event, wait(10) replaces
sleep(0.3) hoping the daemon thread got scheduled
- docker zombie_reaping / profile_gateway: poll-for-state helpers
replace fixed 1-3s sleeps (s6 transitions + SIGCHLD reaping are async)
- process_registry tree test: select()-bounded readline replaces an
unbounded blocking read (parent wedge now fails THIS test with a clear
message instead of an opaque rc=124 file kill); SIGTERM grace 1s->2s
(the 1s partition window mid-interpreter-startup is how a child PID
escaped the live-system guard in CI)
Timeout raises (loaded 8-way-sliced runners see ~5s scheduling floors;
all of these complete in ms-to-1s when healthy so the raises cost
nothing on green runs):
- subprocess/thread waits <= 2s raised to 10-15s across mcp_tool,
mcp_circuit_breaker, mcp_reconnect_retry_reset, mcp_parked_self_probe,
mcp_cancelled_error_propagation, registry, clarify_gateway, interrupt,
voice_cli_integration, docker_environment, session_store_lock_io,
planned_stop_watcher, cli_interrupt_subagent, thread_scoped_output
(joins now also assert not is_alive() so stragglers fail loudly)
- wall-clock discrimination ceilings loosened where the guarded hang is
10x larger: local_background_child_hang 4s->10s, interrupt_cleanup
setup 5s->20s + pgid-exit 30s->60s, mcp_stability grandchild spinup
5s->15s, protocol/gil-starvation fast-handler 0.5s->2s,
iso_certify_seam 1.5s->5s, wait_for_mcp_discovery 0.1s->1s
- narrow assertion windows widened: honcho first-turn wait 0.4..0.65 ->
0.25..2.0 (property is bounded-not-hung, not an exact wall-clock);
compression fork-lock TTL 1s->3s (12 refresh chances per lease);
compression-lock expiry margins symmetric (ttl 0.05->0.5, sleep 1.0)
- telegram hung-DNS bound 1.0->1.4 (fake hang is 1.5s — must stay under)
* fix(tests): repair indentation from de-flake batch edit
* fix(tests): harden env isolation and replace remaining sleep-sync races
The full 42k-test run and complete npm check surfaced three more classes:
- Environment isolation: local ~/.honcho defaultHost and SSH_* variables
leaked into Python/TUI tests. Pin the default Honcho host in the
hermetic fixture, isolate the one fallback test from ~/.honcho, and
blank SSH_* around terminalSetup tests. This flipped 20 false failures
back to deterministic behavior on developer machines.
- Background-thread sleep-sync: Honcho async writer tests patched
time.sleep globally, then busy-polled with that same mocked sleep. Under
full-suite load the poller could starve the writer. Each test now waits
on an Event emitted by the exact flush/retry transition; 30/30 passed
under 15-way contention.
- Desktop streaming: the test slept 80ms and assumed a 500ms timer could
not fire before its assertion. A loaded runner descheduled the test for
>500ms and both chunks arrived. Producer controls now gate second-chunk
and completion transitions explicitly.
Also make file-retry observability complete: a self-healed flaky file now
prints BOTH attempts' full output in the FLAKY summary. Two behavioral
runner tests prove pass-on-retry is green+loud+traceback-preserving, while
a deterministic failure remains red.
* refactor(ci): use gh bot pat, better retries
refactor(ci): use retry action for PR label fetch
the retry action now captures stdout as a step output, so it can serve
double duty: retry + output capture for commands like 'gh pr view' whose
result must be consumed by later steps.
Retry action gains:
- 'stdout' output (heredoc-delimited to preserve newlines)
- tee to temp file so stdout still streams to the job log
- step id 'retry' for output reference
Both lint.yml and supply-chain-audit.yml now use the retry action
directly with 'command: gh pr view ...' and read
steps.<id>.outputs.stdout.
ci: use AUTOFIX_BOT_PAT for all gh CLI / GitHub API auth
Replace secrets.GITHUB_TOKEN and github.token with
secrets.AUTOFIX_BOT_PAT across all workflows and composite actions
that use the gh CLI or GitHub API. The PAT has consistent permissions
across fork PRs (where GITHUB_TOKEN is read-only), avoids API rate
limit sharing with the default token, and is already used by
js-autofix.yml for the same reasons.
19 sites swapped across 9 files:
- lint.yml (3): label fetch, comment post/edit, comment update
- supply-chain-audit.yml (5): scan, critical comment, unbounded dep
comment, label fetch, mcp-catalog comment
- lockfile-diff.yml (1): PR comment post/update
- skills-index-freshness.yml (1): issue creation on degraded probe
- skills-index.yml (2): index build, trigger deploy workflow
- upload_to_pypi.yml (2): release view poll, release upload
- ci.yml (1): timings report
- deploy-site.yml (2): skills index crawl
- detect-changes/action.yml (1): compare API call
---------
Co-authored-by: ethernet <arilotter@gmail.com>
|
||
|---|---|---|
| .. | ||
| __init__.py | ||
| conftest.py | ||
| test_accretion_caps.py | ||
| test_ansi_strip.py | ||
| test_approval.py | ||
| test_approval_deny_rules.py | ||
| test_approval_heartbeat.py | ||
| test_approval_interrupt.py | ||
| test_approval_plugin_hooks.py | ||
| test_approved_command_clean_slate.py | ||
| test_async_delegation.py | ||
| test_base_environment.py | ||
| test_blueprints.py | ||
| test_browser_camofox.py | ||
| test_browser_camofox_auth.py | ||
| test_browser_camofox_ensure_tab.py | ||
| test_browser_camofox_persistence.py | ||
| test_browser_camofox_private_page_guard.py | ||
| test_browser_camofox_state.py | ||
| test_browser_camofox_timeout.py | ||
| test_browser_cdp_override.py | ||
| test_browser_cdp_tool.py | ||
| test_browser_chromium_autoinstall.py | ||
| test_browser_chromium_check.py | ||
| test_browser_cleanup.py | ||
| test_browser_cloud_fallback.py | ||
| test_browser_cloud_provider_cache.py | ||
| test_browser_command_timeout_race.py | ||
| test_browser_console.py | ||
| test_browser_console_ssrf.py | ||
| test_browser_content_none_guard.py | ||
| test_browser_eval_ssrf.py | ||
| test_browser_eval_supervisor_path.py | ||
| test_browser_get_images_ssrf.py | ||
| test_browser_hardening.py | ||
| test_browser_homebrew_paths.py | ||
| test_browser_hybrid_routing.py | ||
| test_browser_lightpanda.py | ||
| test_browser_open_timeout.py | ||
| test_browser_orphan_reaper.py | ||
| test_browser_private_page_action_guard.py | ||
| test_browser_secret_exfil.py | ||
| test_browser_snapshot_ssrf.py | ||
| test_browser_ssrf_local.py | ||
| test_browser_supervisor.py | ||
| test_browser_supervisor_healthcheck.py | ||
| test_browser_type_redaction.py | ||
| test_budget_config.py | ||
| test_checkpoint_manager.py | ||
| test_clarify_gateway.py | ||
| test_clarify_tool.py | ||
| test_clipboard.py | ||
| test_code_execution.py | ||
| test_code_execution_modes.py | ||
| test_code_execution_windows_env.py | ||
| test_command_guards.py | ||
| test_computer_use.py | ||
| test_computer_use_capture_routing.py | ||
| test_computer_use_null_pid_windows.py | ||
| test_computer_use_vision_routing.py | ||
| test_config_null_guard.py | ||
| test_container_cwd_sanitize.py | ||
| test_credential_files.py | ||
| test_credential_pool_env_fallback.py | ||
| test_cron_approval_mode.py | ||
| test_cron_prompt_injection.py | ||
| test_cronjob_run_immediate.py | ||
| test_cronjob_tools.py | ||
| test_cross_profile_guard.py | ||
| test_daemon_pool.py | ||
| test_daytona_environment.py | ||
| test_debug_helpers.py | ||
| test_delegate.py | ||
| test_delegate_composite_toolsets.py | ||
| test_delegate_subagent_timeout_diagnostic.py | ||
| test_delegate_summary_budget.py | ||
| test_delegate_toolset_scope.py | ||
| test_discord_send_message_caption.py | ||
| test_discord_tool.py | ||
| test_docker_cgroup_limits.py | ||
| test_docker_config_migrate.py | ||
| test_docker_environment.py | ||
| test_docker_find.py | ||
| test_docker_network_config.py | ||
| test_docker_orphan_reaper_integration.py | ||
| test_docker_rebootstrap_nous_session.py | ||
| test_dockerfile_immutable_install.py | ||
| test_dockerfile_node_modules_perms.py | ||
| test_dockerfile_pid1_reaping.py | ||
| test_env_passthrough.py | ||
| test_env_probe.py | ||
| test_execute_code_approval_cluster.py | ||
| test_execution_flag_detection.py | ||
| test_feishu_tools.py | ||
| test_file_operations.py | ||
| test_file_operations_edge_cases.py | ||
| test_file_ops_cwd_tracking.py | ||
| test_file_read_guards.py | ||
| test_file_staleness.py | ||
| test_file_state_registry.py | ||
| test_file_sync.py | ||
| test_file_sync_back.py | ||
| test_file_sync_perf.py | ||
| test_file_sync_sigint.py | ||
| test_file_tools.py | ||
| test_file_tools_container_config.py | ||
| test_file_tools_cwd_resolution.py | ||
| test_file_tools_live.py | ||
| test_file_tools_tilde_profile.py | ||
| test_file_write_safety.py | ||
| test_find_shell.py | ||
| test_force_dangerous_override.py | ||
| test_fuzzy_match.py | ||
| test_gateway_cwd_contract.py | ||
| test_gnu_long_option_abbreviation_bypass.py | ||
| test_hardline_blocklist.py | ||
| test_heartbeat_stale_thresholds.py | ||
| test_hermes_subprocess_env.py | ||
| test_hidden_dir_filter.py | ||
| test_homeassistant_tool.py | ||
| test_hook_output_spill.py | ||
| test_image_generation.py | ||
| test_image_generation_artifacts.py | ||
| test_image_generation_env.py | ||
| test_image_generation_image_to_image.py | ||
| test_image_generation_plugin_dispatch.py | ||
| test_image_source.py | ||
| test_init_session_cwd_respect.py | ||
| test_interrupt.py | ||
| test_kanban_redaction.py | ||
| test_kanban_tools.py | ||
| test_lazy_deps.py | ||
| test_lazy_deps_durable_target.py | ||
| test_line_ending_preservation.py | ||
| test_llm_content_none_guard.py | ||
| test_local_background_child_hang.py | ||
| test_local_cwd_permission_fallback.py | ||
| test_local_env_blocklist.py | ||
| test_local_env_cwd_recovery.py | ||
| test_local_env_relative_cwd.py | ||
| test_local_env_session_leak.py | ||
| test_local_env_windows_msys.py | ||
| test_local_interrupt_cleanup.py | ||
| test_local_shell_init.py | ||
| test_local_tempdir.py | ||
| test_managed_browserbase_and_modal.py | ||
| test_managed_media_gateways.py | ||
| test_managed_modal_environment.py | ||
| test_managed_tool_gateway.py | ||
| test_mcp_cancelled_error_propagation.py | ||
| test_mcp_capability_gating.py | ||
| test_mcp_circuit_breaker.py | ||
| test_mcp_client_cert.py | ||
| test_mcp_dashboard_oauth.py | ||
| test_mcp_dynamic_discovery.py | ||
| test_mcp_elicitation.py | ||
| test_mcp_empty_error_message.py | ||
| test_mcp_image_content.py | ||
| test_mcp_invalid_url.py | ||
| test_mcp_list_pagination.py | ||
| test_mcp_loop_profile_override.py | ||
| test_mcp_oauth.py | ||
| test_mcp_oauth_bidirectional.py | ||
| test_mcp_oauth_cold_load_expiry.py | ||
| test_mcp_oauth_integration.py | ||
| test_mcp_oauth_manager.py | ||
| test_mcp_oauth_metadata.py | ||
| test_mcp_parked_self_probe.py | ||
| test_mcp_preflight_content_type.py | ||
| test_mcp_probe.py | ||
| test_mcp_reconnect_retry_reset.py | ||
| test_mcp_reconnect_signal.py | ||
| test_mcp_register_wakes_stale.py | ||
| test_mcp_resource_content.py | ||
| test_mcp_server_log_notifications.py | ||
| test_mcp_sse_transport.py | ||
| test_mcp_stability.py | ||
| test_mcp_stdio_init_timeout.py | ||
| test_mcp_structured_content.py | ||
| test_mcp_tool.py | ||
| test_mcp_tool_401_handling.py | ||
| test_mcp_tool_issue_948.py | ||
| test_mcp_tool_session_expired.py | ||
| test_mcp_utility_capability_gating.py | ||
| test_media_caption_split.py | ||
| test_memory_tool.py | ||
| test_memory_tool_import_fallback.py | ||
| test_memory_tool_schema.py | ||
| test_microsoft_graph_auth.py | ||
| test_microsoft_graph_client.py | ||
| test_modal_bulk_upload.py | ||
| test_modal_sandbox_fixes.py | ||
| test_modal_snapshot_isolation.py | ||
| test_notify_on_complete.py | ||
| test_osv_check.py | ||
| test_parse_env_var.py | ||
| test_patch_failure_tracking.py | ||
| test_patch_parser.py | ||
| test_pr_6656_regressions.py | ||
| test_process_registry.py | ||
| test_read_extract.py | ||
| test_read_loop_detection.py | ||
| test_refresh_agent_mcp_tools.py | ||
| test_registry.py | ||
| test_request_tool_approval.py | ||
| test_resolve_path.py | ||
| test_restored_delegation_ownership.py | ||
| test_schema_sanitizer.py | ||
| test_search_budget_truncation.py | ||
| test_search_error_guard.py | ||
| test_search_hidden_dirs.py | ||
| test_send_message_missing_platforms.py | ||
| test_send_message_react.py | ||
| test_send_message_target_parse.py | ||
| test_send_message_telegram_proxy.py | ||
| test_send_message_tool.py | ||
| test_session_cwd_store.py | ||
| test_session_search.py | ||
| test_shared_container_task_id.py | ||
| test_shell_bypass_denylist.py | ||
| test_signal_media.py | ||
| test_singularity_preflight.py | ||
| test_skill_bundle_provenance.py | ||
| test_skill_env_passthrough.py | ||
| test_skill_improvements.py | ||
| test_skill_manager_tool.py | ||
| test_skill_provenance.py | ||
| test_skill_size_limits.py | ||
| test_skill_usage.py | ||
| test_skill_view_path_check.py | ||
| test_skill_view_traversal.py | ||
| test_skills_ast_audit.py | ||
| test_skills_guard.py | ||
| test_skills_hub.py | ||
| test_skills_hub_browse_sh.py | ||
| test_skills_hub_clawhub.py | ||
| test_skills_list_modified_diff.py | ||
| test_skills_sync.py | ||
| test_skills_tool.py | ||
| test_skills_tool_discovery_cache.py | ||
| test_skills_tool_profile_scope.py | ||
| test_slash_confirm.py | ||
| test_smart_approval_injection.py | ||
| test_spotify_client.py | ||
| test_ssh_bulk_upload.py | ||
| test_ssh_environment.py | ||
| test_stage2_hook_seed_one_symlinks.py | ||
| test_stage2_hook_symlink_chown.py | ||
| test_subprocess_stdin_guard.py | ||
| test_symlink_prefix_confusion.py | ||
| test_sync_back_backends.py | ||
| test_telegram_send_message_caption.py | ||
| test_terminal_compound_background.py | ||
| test_terminal_config_env_sync.py | ||
| test_terminal_env_bridge.py | ||
| test_terminal_exit_semantics.py | ||
| test_terminal_foreground_timeout_cap.py | ||
| test_terminal_none_command_guard.py | ||
| test_terminal_output_transform_hook.py | ||
| test_terminal_requirements.py | ||
| test_terminal_task_cwd.py | ||
| test_terminal_timeout_output.py | ||
| test_terminal_tool.py | ||
| test_terminal_tool_pty_fallback.py | ||
| test_terminal_tool_requirements.py | ||
| test_threaded_process_handle.py | ||
| test_threat_patterns.py | ||
| test_tirith_security.py | ||
| test_todo_tool.py | ||
| test_todo_tool_type_coercion.py | ||
| test_tool_backend_helpers.py | ||
| test_tool_output_limits.py | ||
| test_tool_result_storage.py | ||
| test_tool_search.py | ||
| test_transcription.py | ||
| test_transcription_command_providers.py | ||
| test_transcription_deepinfra.py | ||
| test_transcription_dotenv_fallback.py | ||
| test_transcription_plugin_dispatch.py | ||
| test_transcription_tools.py | ||
| test_tts_command_providers.py | ||
| test_tts_deepinfra.py | ||
| test_tts_dotenv_fallback.py | ||
| test_tts_gemini.py | ||
| test_tts_kittentts.py | ||
| test_tts_max_text_length.py | ||
| test_tts_mistral.py | ||
| test_tts_opus_routing.py | ||
| test_tts_path_traversal.py | ||
| test_tts_piper.py | ||
| test_tts_plugin_dispatch.py | ||
| test_tts_speed.py | ||
| test_tts_xai_speech_tags.py | ||
| test_url_safety.py | ||
| test_video_analyze.py | ||
| test_video_generation_dispatch.py | ||
| test_video_generation_dynamic_schema.py | ||
| test_video_generation_tool_surface_matrix.py | ||
| test_vision_native_fast_path.py | ||
| test_vision_tools.py | ||
| test_voice_cli_integration.py | ||
| test_voice_mode.py | ||
| test_watch_patterns.py | ||
| test_web_extract_robustness.py | ||
| test_web_providers.py | ||
| test_web_providers_brave_free.py | ||
| test_web_providers_ddgs.py | ||
| test_web_providers_searxng.py | ||
| test_web_providers_xai.py | ||
| test_web_tools_config.py | ||
| test_web_tools_dict_urls.py | ||
| test_web_tools_tavily.py | ||
| test_web_tools_truncate.py | ||
| test_website_policy.py | ||
| test_whatsapp_send_message_media.py | ||
| test_windows_compat.py | ||
| test_windows_native_support.py | ||
| test_write_approval.py | ||
| test_write_deny.py | ||
| test_write_file_syntax_gate.py | ||
| test_x_search_tool.py | ||
| test_xai_http_storage.py | ||
| test_yolo_mode.py | ||
| test_zombie_process_cleanup.py | ||