Off macOS, ctrl folds to mod, so a Ctrl+B voice default is the sidebar
chord. Ship Ctrl+Alt+V instead, and let a binding be cleared to an empty
combo so sidebar mod+b can be unbound. Point the Voice settings hint at
the voice conversation action, not dictation.
Revealing the terminal restored the layout but left the composer holding
the keyboard. Terminals stay mounted while hidden, so the activation
focus effect never re-runs. Ctrl+backtick, the palette row, and the
statusbar pill now claim focus on the reveal direction and re-assert if
the composer steals it. Hiding does not. No second focus chord.
remote-secondary: a bot on a remote secondary connection (connections.json)
with the local backend as primary; a client-only image must reach the remote
as image.attach_bytes. startRemoteBackend({hide}) covers client folders with
an empty tmpfs in a private mount namespace (unprivileged userns; annotated
'fidelity' when unavailable), used by both remote specs. remote-topology:
the post-restart state.db poll (which passed before the new backend opened
the DB) is replaced by a new-pid check + the restarted backend serving the
title after reload.
lineage-sidebar's #121148/#121088 steps never compacted (/compress was
refused as would_grow on a tiny transcript), so they could not fail.
lineage-rotation drives real auto-compaction with compression.in_place:
false (state.db-verified sealed parent + continuation) and asserts one
sidebar row per lineage after rotation, reload and cold relaunch; the live
nested-branch shape is KNOWN #121148. lineage-compaction-prompt compacts
inside an acknowledged redirect turn so the refresh passes through
preserveLocalPendingTurnMessages; the duplicate prompt is KNOWN #121088.
known.ts: expectNoSymptom marks a test expected-failing at run time only on
the bug's own assertion (a fix merging first stays green). lineage-sidebar
keeps the branch/switch scenario, drops the #121096 claim and now checks the
in-page duplicate sampler.
A second open while the bar is already visible rewrote EMPTY, which
cleared the query, and the focus effect only watched active, so it
never ran again. Bump focusRequest instead, keep the typed query and
the captured scope, and select the existing text on refocus.
Co-authored-by: David Metcalfe <80915+DavidMetcalfe@users.noreply.github.com>
A manual /compress whose session.compress reply is `status: 'pending'`
(#97948 — the gateway's compute-host wait expired while the host kept
compressing) shows one 8s "still running in the background" toast and
returns. The summary and the success toast are rendered only in the
synchronous result branch that `return` skips, so when the host finishes
the `compacted`/`ready` edge merely clears the spinner: no transcript
line, no completion toast, and hydrateFromStoredSession swaps the
transcript underneath the user with no acknowledgement it ever ran.
Claim the session on the pending reply and announce the completion on the
terminal edge, reusing the notice id the handler already notified under so
the pending toast is replaced in place rather than stacked. The transcript
line is appended only after the hydrate resolves — it replaces the
transcript wholesale and would otherwise drop the line. The claim is
consumed once, so a later auto-compaction cannot replay the notice and an
auto-compaction the user never asked for stays silent.
implicitSlashAcceptIndex() returned null immediately when no command name
had been typed yet (!typed), so the activeExplicit branch was never
reached. Pressing Enter after arrow-key selection on a bare '/' sent a
bare '/' instead of the highlighted command (#98535).
Fix: move the activeExplicit guard above the !typed early-return. A
deliberately arrowed highlight always wins regardless of query content —
'Enter means I want this one' should hold even before any characters are
typed.
Regression tests added:
- bare '/' + arrow-key → returns the highlighted index
- bare '/' + no arrow-key → still returns null (auto-accept not engaged)
Two places map a node id back to its memory card by rebuilding the bare
`memory:<source>:<index>` string: the timeline chart rows and the desktop
starmap's tooltip/body map. With the fingerprint in the id both missed
every card, so a memory row rendered an empty body.
Both now key the card under whichever shapes apply, so an imported or
pre-fingerprint graph keeps working. The CLI help and the memory doc now
describe the id as `journey list` prints it.
(cherry picked from commit fa0c984c5d7d7ad0820fa2f2bde088e532f4e897)
The install dialog gated the package path on the agent install succeeding in
the same click (`agentInstalled && desktopHalfFromPackage`). A package already
on disk answers "Plugin '<name>' already exists. Use force reinstall" without
Force, so the retry fell through to installDesktopPlugin and cloned
desktop-plugins/<git-name>/ beside the package copy the app had already
materialised as desktop-plugins/<manifest-name>/. Two folders, one plugin id:
the on-disk duplicate from #100412 (since e1a6679399 an error row instead of
a competing live instance, but still created by the install flow).
The package path now applies whenever the repo is a unified package, the
backend is local and the Agent box is ticked, whatever the agent install
returned. reconcileDesktopPlugins() is idempotent, so a retry touches
nothing; the desktop success toast is raised only when the agent half landed
or a copy was actually materialised, so a refused install shows the agent
error alone. A failed fresh install no longer leaves a standalone desktop
clone behind for the next successful install to duplicate.
Remote backends keep the separate clone (their plugins/ folder is not
readable from this machine); the Desktop-UI-only tick is unchanged.
Fixes#100412 (install-time half; runtime half landed in #118902).
Tests: two invariants in plugin-install-modal.test.tsx, the first red on
main (installDesktopPlugin called on the refused retry), the second guarding
the remote-backend clone.
(cherry picked from commit 9fbd3a9d8328ea452a4149252a35a0e6f43982e6)
Use a checked private per-user directory in /tmp only when the home-based socket and OpenSSH temporary suffix exceed sun_path. Validate the directory before probing or reusing a master, and prove a real Unix listener binds with a deep HOME.
runSsh dropped Node's close signal, so a null exit code looked like a
plain failure. Every close consumer now keeps that signal. An empty
stderr signal death is not an unreachable host.
- assert-dist-built now parses every emitted dist/assets/*.js chunk as an
ES module (node --input-type=module --check via spawnSync) before the
build reports success
- a silent bundler output loss (observed twice: a 10-byte identifier token
missing from the main chunk) previously shipped a syntactically invalid
bundle that white-screens Electron with Uncaught SyntaxError
- the loud failure feeds the existing update-path honest-retry and
stage-and-swap, so a corrupted build retries instead of shipping
- vitest coverage: invalid chunk fails with the chunk name in the error,
valid chunks (incl. import.meta / template literals) still pass
Fixes#105184
Chat emits file refs as `[label](#media:<encoded path>)`, but the
Artifacts collector classified the raw href and dropped it. Decode
those hrefs before looksLikeArtifact so Windows and POSIX paths,
image markdown, and explicit tool artifact keys are collected.
Legacy MEDIA: tags and plain URLs are unchanged.
Same decode as pull 88158; that patch did not apply cleanly.
Fixes#88084
Co-authored-by: SayHell0W0rld <18085695+SayHell0W0rld@users.noreply.github.com>
before-input-event fires for keyup as well as keydown. A Ctrl+W that
started in another app delivers its keyup when Windows focuses Hermes,
and the shortcut handlers treated that as Close Tab.
Refs #105498
The bare-word fallback still used \S+, so relative paths and unknown
extensions swallowed a trailing backtick. Stop that alternative before
backtick and double-quote, and keep the anchored extension branch.
A bearer 401 from the dashboard gate was returned to the client but
never written to dashboard-auth.log. Record session_rejected with the
client-facing reason, path, and IP, and never the bearer.
When that rejection is the app's saved bearer, the desktop mint error
says the app token is invalid instead of telling the user to
re-authenticate the server OAuth session.
Fixes#103117
An entered lane stopped at 5 chats behind a hover-only "…" that added 5
at a time, and an expanded overview project or entered Home mounted every
loaded row at once. Lanes, expanded projects and Home now page with a
labeled "Show N more in <lane>" row (50 per step), reusing the overview's
show-all row. The collapsed preview and tree request are unchanged.
Co-authored-by: cherrish333013 <139594807+cherrish333013@users.noreply.github.com>
Co-authored-by: George Shalhoub <george@georgeshalhoub.com>
A session row with an empty cwd but a persisted git_repo_root fell to Home:
_project_for_session bailed on the empty cwd before matching the repo root,
and _place_session refused to place it, so the backend owner map made Home
the chat's single owner while the renderer (root-aware) still labeled it with
its project. Match and place on cwd, else git_repo_root; a row is homeless
only when it has neither, matching the renderer's isDetachedSession.
Entered Home's live overlay also upserted every briefly-detached live row
without consulting the authoritative owner map, so a named-project chat whose
session.info landed with an empty cwd listed in Home as well. overlayHomeLane
now takes the owner map from overlayLiveLanes and skips rows (by id or
lineage root) owned by a named project.
Refs #77591 (symptom D, entered-project refetch lag, is not addressed).
Co-authored-by: networthexplained <300128320+networthexplained@users.noreply.github.com>
Both local `hermes serve` spawn sites spread process.env into the child.
Route them through profileBackendParentEnv so a pooled profile backend, and
a primary pinned to (or sticky on) a non-launch profile, only get the
credentials their own profile scope provides (#68367).
Co-authored-by: Yash Jain <23dec512@lnmiit.ac.in>
`hermes desktop` loads its launch profile's .env/.op.env into os.environ
before exec'ing Electron, so every Desktop-spawned backend inherited that
profile's credentials. A named profile with no TLON_* (or its own .op.env)
still came up with the default profile's values ahead of its own dotenv.
profileBackendParentEnv() returns the parent env for a `hermes serve`
child of a given profile: unchanged when the child is the launch profile,
otherwise minus every name the launch profile's .env/.op.env declares
(OS names like PATH/HOME excepted). Mirrors _profile_action_environment on
the dashboard side. Windows folds env names and home paths.
Co-authored-by: Yash Jain <23dec512@lnmiit.ac.in>
Rebased onto main, where params are validated against tui_gateway/contracts
and unknown keys are rejected: the copy_parent_history / omit_messages flags
on session.create and session.branch now answered 4000. Keep both methods'
wire shape unchanged and give the two new methods their own contracts
(session.branch_stored, session.branch_whole) with messages_omitted results;
the handlers take the behaviour as keyword arguments, not wire flags.
