Four independent reviewers swept the #123635 diff. These are the findings that
changed code; each was verified before applying, not taken on report.
Register the recorded key instead of relying on the underscore sweep. The
staged dict becomes the turn's live user message, so _submit_row_session_id
rides every replay of that row. turn_context.py pops PERSISTENCE_ONLY_MESSAGE_FIELDS
from every outgoing copy and its comment says only chat-completions strips
underscore keys — an unregistered key survives to the transport, so a strict
OpenAI-compatible backend could 400 on it. Verified by execution: the registry
pop leaves the key in place and the transport sweeper is what removes it. The
membership is the contract; the underscore is the accident.
Gate each write on the key it writes to. _write_submit_user_row checked
session_key and appended to _submit_row_target_key(session); the two can
disagree after a rotation, so the guard described a write that was not the one
performed. The dead `key` local is gone.
Drop the isinstance/Any guard on _submit_row_owner_key. All three callers
narrow to a dict and check _row_id immediately before; the annotation existed
only to permit the non-dict the guard then rejected.
Log a failed model-switch marker persist at warning, not debug. Filing the
pivot in the live session means the write can now hit CompressionSessionClosedError
on a closed parent, which the old session_key target could not. At debug a
model switch silently loses its durable notice and nothing reaches errors.log —
the sibling persist one screen up already logs at warning.
Test-file: replace the E731 lambda with a named helper, and move _rotated_session
above its first use.
Verified: 7/7 in the regression file, 2113/2113 across the tui_gateway siblings
plus tests/hermes_state, 79/79 in the message-metadata/turn-context suites.
A deferred single-use refresh sweep (_refresh_pending_entries) chained N
cross-process auth-store holds back-to-back. Each hold legitimately spans its
refresh POST (single-use-token safety is test-pinned), but a waiter on the same
profile's auth.json with the shorter AUTH_LOCK_TIMEOUT_SECONDS = 15s timeout (a
Desktop assistant start) starved for the whole chain, not one refresh (#124533).
Space consecutive holds by 0.5s so a waiter's 50ms poll cadence can interleave;
the sweep still finishes promptly. The lock-across-POST contract itself is
deliberately unchanged.
Fixes#104849
Converted `get_skill_commands()` from a single-slot cache (keyed by
`(platform, home)` tuple checked at call time) to a multi-slot dict
`_skill_commands_by_key = {(platform, home): {commands}}` that memoizes
each distinct identity once and serves it forever. The old single-slot
design thrashed in the Desktop `hermes serve` backend because the
platform/home identity flapped between requests (`HERMES_SESSION_PLATFORM`
set to `""` vs. resolved to `None`, profile home overrides) so every
`commands.catalog` poll (~3x/5s) re-scanned the entire skills dir.
Also normalized empty-string to `None` in `_resolve_skill_commands_platform()`
so both spellings share one cache slot (#104849 root cause), and replaced
direct `scan_skill_commands()` calls in `tui_gateway/methods_tools.py`
(two sites: `_catalog_skills`, `_dispatch_skill`) with `get_skill_commands()`
so they benefit from the cache instead of bypassing it.
- `tests/agent/test_skill_commands.py`: 30 tests green (updated monkeypatch
fixtures from `_skill_commands*` globals to `_skill_commands_by_key`).
- New regression test `test_skill_cache_thrash_104849.py`: verifies that
platform flapping (`""` ⇄ `None`) hits the same cache slot (scan once),
and that distinct `(platform, home)` identities each get their own slot
(preserves #14536 / #88023 isolation fixes).
- `test_skill_commands_reload.py`, `test_skill_invocation_description.py`,
`test_prompt_cache_boundary.py`: green.
- `ruff check` on all modified files: clean.
Tested locally: after this patch the collision warning (skill `plan` vs.
core `/plan`) that repeated ~3x/5s while the Desktop window was focused
stopped entirely (zero scans mid-session), matching the issue reporter's
verification.
The gateway auto-load header ('[IMPORTANT: The "X" skill is auto-loaded.
Follow its instructions for this session.]') is scaffolding the describer
did not recognize: session previews showed the raw header + skill body,
the titler titled from the body, and 'hermes sessions retitle-skills'
never offered to repair auto-load sessions (#48359).
describe_skill_invocation now strips the payload (the built skill body
ends with the skill-directory footer note, so the LAST footer marks where
the user's typed text begins — a header quoted inside a body example
cannot end the payload early) and renders the typed request, or '/skill'
for a bare auto-load. Listing queries extend the scaffold LIKE predicate
so long auto-load rows get the same head+tail excerpt window, and the
retitle lookup finds auto-load sessions too.
Fixes#48359
Gateway turns reach the agent enriched with channel-bound skill payloads,
sender metadata and other model context, so the first user message the
titler saw could be thousands of characters of skill text ahead of the
actual question, and new sessions were named after the skill instead of
the request.
The gateway now captures the inbound event text before that enrichment and
passes it as a turn-local title_user_message through TurnContext, the turn
runner, AIAgent.run_conversation and the conversation prologue. Only the
titler reads it: the main model, persisted history and relay metadata still
receive the full enriched message. An explicit empty or whitespace override
suppresses titling for that turn, None keeps the existing model-facing
fallback (attachment-only turns, paste previews), and the override cannot
enable model titling for cron or subagent runs. The value is a per-call
argument, so a cached agent never reuses a previous turn's override.
Rebased onto current main: the gateway call keeps main's pinned channel
prompt for internal events, and the integration fixture's context-prompt
stub accepts main's internal= keyword.
Ritvik Gautam made this change with Doryani AI.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The packaged Desktop with no default project dir resolves its spawn cwd (and
TERMINAL_CWD) to $HOME, and SubdirectoryHintTracker's containment check is
then vacuously true for the whole home subtree: any AGENTS.md, CLAUDE.md or
.cursorrules under ~ is injected into tool results on first touch. The
tracker now treats a home (or container-home) working dir as a fallback, not
a project — hint discovery stays off until the session adopts a real
workspace, and _register_session_cwd re-anchors it there (same hook that
already updates agent.session_cwd). AIAgent init also prefers the session's
own cwd over the launch TERMINAL_CWD, so an agent built for a workspace
session scopes hints to it from the start. .archive joins the excluded dir
names (retired skills trees hold stale AGENTS.md copies).
Rebases the home guard from #77145 (idea + guard direction) onto the current
class shape; covers the install-tree shape #75922 targeted via the shared
home guard.
Fixes#76902
Ref: https://github.com/NousResearch/hermes-agent/issues/75839
Co-authored-by: Sahil-SS9 <218421507+Sahil-SS9@users.noreply.github.com>
OpenAI's Ultrafast service tier (service_tier="ultrafast") is broadly
available for GPT-6 Astra in the API and Codex (Pro 500 / Enterprise),
billed at 6x Standard. GPT-6.1 Sol Ultrafast is announced as coming soon.
- One tier table: agent.fast_mode.parse_service_tier / STATIC_TIERS now
back the CLI, gateway and TUI config loaders (three hand-copied parsers).
- resolve_fast_mode_overrides(tier="ultrafast") sends the tier only for
Ultrafast models on api.openai.com / chatgpt.com; anything else gets
nothing rather than a silent swap to another paid tier.
- /fast ultrafast on CLI, gateway (typed + picker when supported) and TUI;
static-tier attach sites pass the tier through.
- Pricing: the response's SERVED service_tier is folded into usage (Codex
stream assembler keeps it); served ultrafast prices from a published
6x row (272K whole-request tier included). A request asking for
Ultrafast but served at default bills at Standard.
- i18n: 4 new keys in all 17 locales; option lists mention ultrafast.
OpenAI released GPT-6.1 Sol on 2026-09-29. It is live on OpenRouter
(openai/gpt-6.1-sol, -pro) and the direct API; not yet on Nous Portal
or on Codex OAuth for our test account.
- Catalog: OPENROUTER_MODELS + openai-api picker; kept off the nous
list via _OPENROUTER_ONLY until the Portal serves it. Manifest regenerated.
- Context: 1.05M direct API, 272K Codex fallback; 272K compaction
auto-raise on the Codex route.
- Pricing: $2/$10, cached input $0.10 (5%, not 6 Sol's 10%), cache write
$2.50, 2x/1.5x above 272K; -pro aliased to the base row.
- Reasoning: none/minimal return 400 on 6.1 Sol (unlike 6 Sol), so it uses
Astra's low..max ladder without Astra's account gating. OpenRouter's
catalog wrongly lists 'none' for it, so the OpenRouter profile omits a
disable when the OpenAI ladder has no 'none'.
* fix(tools): inline agent tools get the shared argument coercion
Inline agent tools (todo_list, clarify, memory, session_search, and the
rest of INLINE_TOOL_EXECUTORS) never went through handle_function_call.
They did not get coerce_tool_args, so a JSON-encoded string for an array
parameter failed unless the tool parsed it by hand.
Every entry of INLINE_TOOL_EXECUTORS now runs coerce_tool_args first.
The sequential path and the concurrent invoke_tool path both read that
table, so one wrapper covers both.
todo_tool no longer parses a JSON string by hand. The todo_list schema
declares todos as an array, so coercion covers it. The existing test now
calls the dispatch table, not todo_tool directly.
* chore: retrigger CI (zero-job dispatch failure, auto-heal)
Relay 0.9 discovers user and system plugins.toml files outside the Hermes
home, so an exporter or middleware can apply to every Hermes session without
any Hermes setting naming it. Hermes now says which files apply.
The startup line that reports an active plugin host lists the files the
activation loaded. `hermes doctor` gains a NeMo Relay Plugins section: it
resolves the same layers through Relay's validator, which loads no plugin
code and leaves the process-wide host alone, then lists each file, whether
anything is enabled, and any error or warning Relay reports. A configuration
Relay would reject counts as a doctor issue. Validation cannot load dynamic
plugins, so a warning marks the row without counting as an issue.
The docs give the user and system file locations for each platform and point
to `hermes doctor`.
* refactor(desktop): split clarify-tool.tsx into a clarify/ folder
Pure moves, no behaviour change. Parsing, the question-card core
(shell, choice rows, question block), the delivery watchdog, and each
pending/settled card get their own file so the core can be reused.
* feat(clarify): one questions[] shape with per-question status and one outcome
The clarify tool now takes only questions=[{question, choices?, multi_select?}].
A wrong shape is a tool error that names the right one, so a model that
sends the old top-level question/choices corrects itself on the next call.
Every result has the same shape on every surface: each response carries
status (answered, skipped, unanswered) with user_response null unless
answered, and the result carries one outcome (submitted, cancelled,
timed_out, undelivered) plus an optional surface-written notice. The
timeout and cancel sentences that used to pose as the user's answer are
gone, and the compressor reads status instead of matching their prefixes.
The callback contract is callback(questions) -> {answers, outcome, notice?}
(None = skipped, missing qid = unanswered). tui_gateway settles a batch the
same way for the last lock, a cancel, an interrupt and the deadline, and
clarify.lock keeps a null answer as a skip. A multi-select answer that is
not a JSON array counts as one typed ("Other") answer. The tool-row preview
reads the first question.
* feat(clarify): every surface asks through the one question card
CLI: the batch panel is the only panel; Enter on an empty field skips a
question, Ctrl+C cancels and keeps the locked answers, the deadline returns
timed_out. -q and -z return undelivered with a no-user notice.
Ink TUI: the single-question prompt is gone; the card supports multi-select
(Space or a digit toggles, Enter locks, typed Other text joins the picks),
an empty submit skips, Esc cancels, and "Batch" names are dropped.
Desktop: the single-question card is deleted and its keyboard handling moved
into the one card (arrows, letters and digits, auto-advance, Enter picks then
confirms). Confirm enables at one answer; blank questions lock null; Skip and
a composer message cancel; the settled card shows No answer for unanswered
questions. The bots room card follows the same contract.
Messaging: one card per question with a "Reply skip to skip" line in every
locale; timeouts and delivery failures map to timed_out and undelivered.
* fix(clarify): cancelled for a released messaging card, labels win over the skip word
A prose reply to a messaging choice card, /new and session end released
the wait with "", which read as timed_out. They now resolve with a
CANCELLED marker and the tool gets outcome cancelled.
A typed reply that matches a choice label ("Skip") now resolves to that
choice; the skip word applies only when no choice matches.
The bots room card sends the picked labels as they are; the tool already
strips the recommendation label. Unused OUTCOMES and a new docstring and
comment are removed.
* fix(tui): re-editing a multi-select answer keeps its picks
The Ink card stored a multi-select answer as display text ("A, B"), so
revisiting the question put the whole string into Other and re-locked it
as one item. The answers map now keeps the raw JSON array, the card
restores the picks on revisit, and only the display lines format it.
Comments that earlier edits reworded are restored to their original
words, minus the phrases the change made wrong. The compute-host clarify
lock accepts None for a skipped question.
* test(clarify): align three checks with the one-answer confirm and the regenerated keys
The desktop Cmd+Enter test now expects a send with one answer (the blank
question locks null), the compressor test expects the single-answer summary
the code gives, and locales/_keys.desktop.json is regenerated for the
removed and added clarify strings.
* test(tui): the one-question card header is singular
Pick the tools the bridge sentence names from the same availability
conditions that gate the note's sentences instead of substring-searching
the rendered prose, and assert the bridge clause by tool membership
rather than exact wording (simplify-code quality review).
Since #97979 put the desktop GUI tools on the default tool_search defer
list, a Desktop session's valid_tool_names no longer contains
read_window_below (it sits behind the tool_call bridge), so
hud_surface_note() withheld the whole note on every HUD turn: the model
stopped being told that "this"/"here" means the app behind the HUD.
hud_surface_note() now takes the session's deferred-but-callable names
(the same agent/tool_executor._tool_search_scoped_names set the tool_call
dispatch validates against) and counts them as available, adding one
sentence telling the model to call the deferred ones through the
tool_call bridge — a direct call to a deferred name is rejected as an
unknown tool. The defer list, its token saving and the note text for
non-deferred sessions are unchanged.
Reuses the repr-field secret-name policy (is_secret_field_name) so token, password, secret and credential-suffixed fields are masked by field in hermes dump, debug share and /debug. The regression test asserts on what actually reaches the paste service first.
The strict URL-credential pass that hermes dump and debug uploads use
redacted X-Amz-Signature but not X-Goog-Signature (GCS V4 signed URLs)
or sig (Azure SAS), so a fallback base_url signed that way still reached
the dump and the upload. The documented promise is signed-URL signatures
in general.
A fallback_providers base_url can carry its credential in the URL (userinfo, ?key=, #access_token=, X-Amz-Signature=). The force pass leaves those to the log policy, which spares OAuth/magic-link URLs, so hermes dump printed them and debug share / gateway /debug uploaded them. The dump's fallback rendering and the upload copy of the dump now opt into redact_url_credentials.
The strict canonicalizer also turned x-amz-signature into x_amz_signature before the policy lookup, so strict mode never masked it; hyphenated policy names now match as stored.
Ported from #126168.
TUI/Desktop `_make_agent` (plus `hermes -z` and ACP) built AIAgent without the
resolver's `request_overrides`, so a custom entry's `extra_body` only reached
the agent through the init-time re-derivation, which matches `custom:*` alone.
Auxiliary requests never read the entry's `extra_body` at all. A proxy that
requires a body field (`user`) therefore 400'd in the app and on smart
approval while `hermes chat` worked.
- Pass `runtime["request_overrides"]` at every remaining AIAgent build site
(ACP only when no explicit base_url points at another endpoint).
- `_build_call_kwargs` layers the destination entry's `extra_body` under the
task/caller body, using the agent's own matcher, so primary, retry and
fallback requests each get their own endpoint's body and nothing leaks.
Covers holes 1 and 3 of #103738; hole 2 (matching bare/unprefixed names) is
#124290 and is untouched here.
The absorbed turn's map already had the dict guard; a plugin-built survivor carrying a malformed
map still raised in the per-occurrence expansion. Pre-existing (the old merge raised the same way).
Found by the pre-merge correctness and hermes-specific review of this stack:
- A fold after a row whose one response repeated a provider id (one shared uid) appended the
absorbed turn's uid in the wrong slot. The shared uid now fills each of the row's own
occurrences before the fold appends (per_occurrence_tool_call_uids). A single response keeps one
shared uid for a repeated id: every result carries it, so no call looks unanswered.
- A digest-less re-flush of a restored fold (replay heal, adopt after a digest mismatch) let the
stored pre-fold map overwrite the longer live list, so the later occurrence's results paired
with nothing. A live list that starts with every stored occurrence is kept (stored uid or list).
- A dict that lost its uid map (a clone) rewrote tool_call_uids to NULL. The row-addressed
rewrite now fills stored uids for the calls the dict still names; a call it dropped keeps none.
- append_messages_batch(chunk_rows=...) reset the pairing index per chunk, so a result in the chunk
after its call was stored without tool_call_uid (branch/seed copies). The whole batch is paired
before it is chunked.
- _merge_assistant_into keeps its dict guard on the absorbed turn's map (a plugin-built dict with a
non-dict map no longer raises).
- without_persistence_fields() replaces the two hand-written strips (context-engine selection,
token-estimate fingerprint).
- mint_uid() is the one uid minter; uid_list() the one uid-list normalizer (message_metadata's
_absorbed_uids and the codec's _uid_list share it).
- _live_or_column() replaces four copies of 'live key first, column name second'; the absorbed
list writer takes the dict, not a (live_key, column) pair its one caller always passed the same.
- _restore_row_identity() is the one stored-identity-onto-live-dict step, shared by restore and
the row-addressed rewrite (transcript_repair had a hand copy). Restore skips the decoders for
NULL columns (the common row).
- index_tool_call_uids() returns the variants it named, so the flush walk stops computing them
twice; tool_call_uid_from_history drops guards its one caller can't trip.
- rewind returns the replacement dict (the insert already stamps _row_id and message_uid)
instead of re-querying last_insert_rowid.
- _remember_absorbed_row's folded is required, so every call site states the witness rule.
- The backfill reads/deletes state_meta through _meta_row/_delete_meta; chat_completions strips
MESSAGE_UID by constant.
No behaviour change.
hermes_state_messages.py crossed 2000 lines with the v31 identity columns. The codec between
the live identity keys and the four columns (_uid_list/_uid_map and their JSON writers, the
restore decoder) moves to its own sibling; transcript repair imports _uid_map from there.
_json_or moves to hermes_state_common so both modules share it (same 'hermes_state' logger).
No behaviour change.
_merge_assistant_into never joins multimodal (list) content, so a non-empty later turn
beside a list (or a list beside non-empty text) is dropped, yet the fold still recorded its
uid in _absorbed_message_uids, a false claim that its text lives on. The merge now reports
whether the later text was kept and the witness follows it; the retired row id is still
recorded.
Reported by @andrexibiza on #126307.
Folding two assistant turns that reuse a provider id (llama.cpp-style constant ids) leaves
both calls in tool_calls, but the {id: uid} union kept only the later uid, so the first
occurrence lost its identity. The id now maps to a list of uids, one per occurrence in
tool_calls order (merge_tool_call_uids); index_tool_call_uids pairs each call with its own
occurrence, so a following result still pairs with the nearest call. Provider ids are never
rewritten. Persisted and restored as-is (the JSON map accepts list values).
Reported by @andrexibiza on #126307.
message_identity copies the tool-call uid fields only for a copy that also carries
tool_calls/tool_call_id (CLI /branch); the TUI branch and lazy seed copy neither, and a
uid map on a row without its calls pairs nothing. The lazy seed now stamps and builds its
rows in one pass under the history lock.
- The flush walk memoizes each assistant's named ids and uid index across one collect,
so K parallel results no longer recompute K assistants' variants (O(K^2) -> O(K)).
- Restore indexes assistant maps lazily: only a result without a stored uid (an older
build's) needs the index; rows this build wrote never pay for it. Same order, same
shadowing. One decoder (_restore_identity_columns) for both restore paths.
- The token-estimate memo key skips persistence-only fields the estimate never reads.
- Context-engine selection strip: isdisjoint instead of per-key scans.
tool_call_uid_from_history ran reversed(messages[:i]) for every flushed tool result,
copying the whole live list each time. An index walk halves the per-batch cost
(34k-message session, 32 parallel results: 5.4 ms -> 2.7 ms).
The three branch/seed copy paths (TUI/Desktop _persist_branch, the lazy _persist_branch_seed,
CLI /branch) built each child row from a fresh dict, so the insert minted new uids and
per-occurrence tool-call uids while the child agent kept running on the copied live dicts
with the parent's. After a restart the child restored identities the running agent never saw.
message_identity(msg) mints a uid onto the live dict when it has none and returns the identity
fields (uid, merge witness, tool-call uids); every copy row carries them.
The salvage carried two copies of the uid reader (message_metadata._uid_or_none and
hermes_state_messages._message_uid_or_none), two tolerant uid-map parsers
(transcript_repair._json_map and hermes_state_messages._uid_map), and the same four
identity-field copy blocks in _db_flush_row and sync_flushed_message_markers.
message_metadata now owns message_uid_or_none, stamp_message_uid (moved off SessionDB so
non-store callers can mint before a write) and copy_identity_fields; transcript_repair
reuses _uid_map.
- The new trigger's comment sat before its DROP TRIGGER statement, so the settled-trigger skip never matched
and every open issued the DROP and took the write lock (an open blocked behind a sibling's transaction).
The note now lives inside the trigger body.
- SCHEMA_HISTORY['messages'] records the four columns as events 16-18 (one per commit that added them).
- The chat-completions transport strips message_uid like timestamp: a resume surface that feeds restored
dicts straight to the transport must produce the same bytes as the live send path.
- Two trigram-exclusion tests pinned "one version behind" to SCHEMA_VERSION - 1; they exercise the v30
migration, so they now pin v29. The todo-snapshot expectation ignores message_uid like the other
persistence stamps.
(cherry picked from commit 86c87a3cac3d26924cb69b1b183ef8788a726598)
Alternation repair replaces a provisional verification candidate with the final answer instead of
folding it. Its row is still retired through _absorbed_row_ids, but its uid must not appear in the
replacement's _absorbed_message_uids: the witness names text that lives on in the composite.
(cherry picked from commit fd284d1fd35371215a616efab965ef117348f3c0)
- Strip persistence-only fields from a select_context() selection: the request copy was stripped before
the hook, but an engine handing back the conversation_messages clones put timestamp, _row_id and the
new ids on the wire (pre-existing for the old fields).
- Every row carries a message_uid whoever wrote it: an AFTER INSERT trigger mints one for a row inserted
without it (an older build writing into a v31 store); the one-time backfill is gated by its own
state_meta marker so a store whose schema version cannot advance (no FTS5) never rescans.
- One merge-witness helper (record_absorbed_message) for every fold of a durable message: alternation
repair's user and assistant merges, the compressor's in-flight restatement onto the carrier, the real
user anchor folded into a scaffolding turn (the anchor's uid leads), micro-compaction's adjacent-user
merge.
- tool_call_uids follows tool_calls: it is a payload column, so an assistant merge's unioned map is
rewritten with the row instead of being overwritten by the stale stored map on adoption.
- A result pairs with the nearest call naming its provider id: each assistant row's ids shadow earlier
occurrences in the batch, restore and live-list indexes, a call row without a map leaves its result
unpaired, and nothing pairs across a user turn.
- A composite rewind returns and installs the replacement row's uid on the live scaffold.
- Tests: import_foreign_history, hermes sessions recover and backup import carry the ids; the ACP
restore test accounts for the uid on restored rows.
(cherry picked from commit b30636a49cb29fdd21ba4100eef9d810897338be)
Provider tool-call ids repeat: Hermes mints deterministic call_<12hex> ids for identical calls and models
reuse ids, so tool_call_id cannot identify an occurrence. An assistant row now carries
messages.tool_call_uids, a {tool_call_id: uuid4} map for its tool_calls, and each tool-result row carries
the matching messages.tool_call_uid. The provider-facing tool_calls JSON is untouched, so row identity,
display identity and the CAS digest are unchanged and nothing nested reaches the wire.
Minted at the assistant row's first insert; paired onto the result in the same batch, from the live list
when the result is flushed later, or on restore from the preceding assistant row; copied by every clone
and re-insert; restored as the live _tool_call_uids / _tool_call_uid; stripped from provider requests.
(cherry picked from commit aa49c0f59788676d4beca288181711c558fca165)
A merge survivor's _absorbed_message_uids lived only in memory, so an engine that restarted after a
merge was back to parsing "\n\n" to learn which stored messages a composite user row contains. Store
the list in messages.absorbed_message_uids (an owned column: the survivor's row-addressed rewrite and
every re-insert carry it), restore it as the live key, and round-trip it through export/import.
(cherry picked from commit 0bc05f2656229b1010f330e1998684b04d5f963f)
The physical messages.id is re-issued by every copy (in-place compaction generations and their
concurrent-tail clones, rotation children, replace_messages), and _row_id is opt-in on restore, so a
context engine that keeps its own per-message state had nothing stable to key on across a restart or a
compaction boundary and re-identified rows by content and timestamp.
Add messages.message_uid (uuid4 hex), minted once at a row's first insert and stamped on the caller's
dict, copied by every SQL clone, kept by every re-insert of the same dict, left alone by row-addressed
rewrites, restored on every projection, and stripped from provider requests. A consecutive-user merge
survivor keeps its own uid and records the absorbed uids in _absorbed_message_uids. Schema v31 backfills
a uid onto rows that predate the column.
(cherry picked from commit 20d67ffb5e50e0ed956e56ddc7f8e28d36059e2e)
The merge stamped the prefix with or without the "\n\n" separator
depending on whether the absorbed turn was empty, so a later non-empty
override on an empty-merge row came out as "RX". Store the unanswered
text as-is and join at override time with the same rule the merge uses.
The marker recorded by _merge_consecutive_users repeats the unanswered text
already in the row's content, and the rough token estimator priced it as
payload: a merged row with a large unanswered paste was estimated at ~2x its
real size for the rest of the session, pulling compaction forward.
Name the key once in agent/message_metadata.py and put it in
PERSISTENCE_ONLY_MESSAGE_FIELDS, so the estimator skips it and every outgoing
request copy (all transports, plus the iteration-summary call) drops it —
not only the chat-completions underscore sweep.
Follow andrexibiza review on #124770: refresh the merge prefix even when a legal gateway turn cleans to empty text, with live and replay regression controls.
(cherry picked from commit 63ca36db4f2ca6d3dceeedd72d90b19eddc45240)
Re-review of the trust-anchor follow-up:
- Cron runs and Kanban workers no longer anchor trust. The cronjob tool
lets the model pick a job's workdir, which becomes the run's session
cwd, and kanban_create lets it pick a task workspace, which becomes the
worker's launch dir and TERMINAL_CWD. Either one let an agent-cloned
repo become trusted. Both now rely on lsp.trusted_workspaces only.
- A repository at or above $HOME never anchors, not only one at $HOME
exactly.
- Operator roots are recorded only where a tool thread enters
(enabled_for) and when the service is created. _trusted() is now a pure
read. Before, it took _state_lock while two of its callers already held
it, so a change in the roots could deadlock the LSP loop.
- Client lookups go through _live_key(). A multi-root client that
started while its root was untrusted is still found and released after
the root becomes trusted, instead of being orphaned.
- `hermes lsp status` stops listing roots that have since become trusted.
The lint gate reads the cwd the same way the linter subprocess does.
- The path-list parser returns None for a malformed value, and each key
logs its own warning. The _node_modules_trees docstring no longer
mentions Vue.
svelte goes back to the declarative _server() form with an untrusted_init
option on _simple_spawn instead of a one-caller spawn factory, the two
lsp path-list keys share one parser (only the invalid-value result and the
message differ), and the docs say the allowlisted servers run no project
code rather than that they only parse files (yaml-language-server fetches
the schemas a file names).
Pinning `tsdk` to Hermes's TypeScript does not stop Vue from running
project code: @vue/language-core 2.2.x reads `vueCompilerOptions.plugins`
from the project's tsconfig and require()s each entry resolved against the
project root (lib/utils/ts.js, the 'plugins' case), so a cloned repo naming
"./x.js" there executes it on the first .vue edit. Vue now waits for trust
like the other servers that evaluate project files, and `_spawn_vue` reads
the project's node_modules again (it only ever runs trusted).
