Overnight PR shakedown: integrate validated fixes (2026-06-05)#595
Merged
Conversation
added 30 commits
June 5, 2026 03:41
…ndev) — fixes #553 path traversal
…token (im-khang); export getBearerToken from openai-compat-api to satisfy import
… (antoineayoub)
…sses #561 stuck Thinking
…-star) — addresses #570; restored null-guards in normalizeCron that PR removed
…teTree regenerated
…t (PR #523 regression)
…); native worker process fallback for non-tmux platforms
…lelamb) Resolved swarm-dispatch.ts conflict by taking buildHermesChatQueryArgs helper (correct -q prompt adjacency). Adds 8 passing regression tests for native dispatch/runtime + terminal active-mission persistence. eslint --fix on touched files.
…aming stability (JohnGuidry) Addresses #572 (double chat responses) + #561 (stuck Thinking indicator). Adds optimistic-message-reinject hook, vite loadEnv→process.env bridge for SSR bearer token, dedup + streaming stability. eslint --fix on touched files (net lint errors 1700→1588). Build GREEN, test 33 fail/694 pass (zero regressions).
added 22 commits
June 5, 2026 09:49
The model-config provider dropdown in the Providers settings screen (also shown in the in-chat Providers dialog) only offered Custom, OpenRouter, Anthropic, and OpenAI. Despite docker-compose exposing GOOGLE_API_KEY, users could not select Google/Gemini as a provider without hand-editing config. Add 'google' to ModelProviderOption and MODEL_PROVIDER_OPTIONS (label 'Google (Gemini)'), and register 'google' as a known provider prefix so google/* model ids strip correctly.
The chat viewport previously only released stick-to-bottom when the user scrolled up AND was already more than 200px from the bottom. While reading near the end of a streaming response, any upward scroll inside the bottom 200px did nothing — the ResizeObserver then yanked the viewport back to the bottom on the next streaming chunk, producing the 'can't scroll up' tug-of-war reported in #552. Fix: any user-initiated upward scroll releases stick-to-bottom immediately. Re-stick only when the user has stopped scrolling up AND is at the bottom (<=NEAR_BOTTOM_THRESHOLD). Applied symmetrically in ChatContainerRoot (handleScroll) and in chat-message-list's handleUserScroll mirror.
The Workspace model picker only saw entries from ~/.hermes/models.json,
the gateway /v1/models endpoint, and local provider discovery (Ollama,
Atomic Chat). Hermes Agent's actual catalog lives in ~/.hermes/config.yaml
under providers.<id>.models, providers.<id>.model, and model_aliases.
In setups where /v1/models intentionally returns only 'hermes-agent',
this meant the picker showed maybe 4 models out of the ~60 the user
had configured.
Add readClaudeConfigCatalog() to /api/models that walks providers.*.models
(strings or {id,name,provider} objects), each provider's default model,
and model_aliases (mapped to {id: alias, target: '<provider>/<model>'}).
Merge those entries via mergeModelEntries() so existing dedup and ordering
behavior is preserved, and append '+config.yaml' to the source label so
the UI/debug can tell where models came from.
…sh (#594) When React throws 'Failed to execute insertBefore/removeChild ... not a child of this node' (stale DOM/runtime mismatch on navigation), the ErrorBoundary now clears service-worker + cache-storage and reloads once (30s TTL guard to avoid reload loops) instead of leaving the user on a dead error screen.
…570, #573) fetchSessions now sends accept: application/json, verifies the content-type is JSON before parsing, and validates the response shape. When an auth/proxy layer intercepts /api/sessions and returns HTML, the user gets a clear error instead of a React crash from JSON.parse on '<!doctype html>'.
…se_url proxies (#473) /api/models now reads provider base_url + api_key entries from config.yaml and fetches their /v1/models (60s cache, 3s timeout, server-side keys only), merging them into the picker so configured upstream proxies restore dynamic discovery.
…log exhausted, build green
… toggle Echo Studio (integrated from #457 in cycle 2b) was always-visible in the chat sidebar and mobile hamburger nav. It's a scaffold/prototype, so surface it only when opted in. - add experimentalEchoStudio: false to StudioSettings + defaults - new Settings > Labs (experimental) section with a Switch - chat-sidebar + mobile-hamburger filter the Echo Studio nav item by the flag
…fore starting another gateway, Codex auth (codex login + Hermes import) for gpt-5.4 default
outsourc-e
pushed a commit
that referenced
this pull request
Jun 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overnight PR shakedown: integrate validated fixes (2026-06-05)
Consolidates 23 upstream PRs that were individually validated locally, applied to this branch off
origin/main, and verified green. Each was test-gated against a recorded baseline.Baseline (origin/main @ 7f845bc) vs this branch
pnpm buildpnpm testpnpm lintNet (vs baseline): +23 passing tests, −1 failing test. Zero regressions. Zero regressions introduced. The remaining 33 test failures are all pre-existing on
main(mcp-presets-store / mcp-hub-sources seed-vs-user-file bugs, i18n locale labels, e2e specs that need a live server) and are out of scope for this batch.Integrated PRs (PASS — build + test + lint green)
delete process.env.HERMES_HOMEin test setup so model/provider-discovery tests don't leak host envhermesbinary for auto-start~/.local/bin/hermes+~/.hermes/bin/hermesto claude-agent binary candidates-Q -q <prompt>and adds the missingpromptarg to the non-wrapper branch (real bug)path.basename(file.name)+ensureWorkspacePath(destination)re-validation. fixes #553fetchGeminiUsage()+ wired into aggregate provider list127.0.0.1:$PORTfor internal hop so session cookie isn't dropped by reverse proxy (silent 401)resp.items ?? resp.data ?? []— never returns undefined to.mapcallers. relates to #573vm_statreclaimable-page memory on darwin (guarded, timeout'd)waitForCheckpoint:false, AbortSignal timeouts, runtimegetBearerToken()extractSystemPrompt()readssystem_promptthen falls back toSOUL.md.github/CODEOWNERSrouting reviews on sensitive paths to@outsourc-eDEFAULT_SLASH_COMMANDS9→36, addsmergeSlashCommands()dedup, fetches/api/commandson mountonOpenFile/activePathon sidebar; clicking a file loads it into the side Monaco editor instead of a dead placeholder/api/agent-bus(safe-mode missions only)/api/profiles/skills+/api/profiles/toggle-skillroutes; toggle UI; routeTree auto-regenerated/api/external-memory/{providers,candidates,search}; full unit+component tests@playwright/test)/api/runs/active, abandon route, background-runs section. addresses #561DashboardKanbanSection+ incidents/insights wiring. addresses #570where hermesdetection, native child_process fallback when tmux absent, portable/nsis target. addresses #500/#588Fixups applied during integration
getBearerTokenwas imported but notexported inopenai-compat-api.ts— added the export so the build compiles./plugins"…and their status" description that an existing test asserts — restored the description (test green).eslint --fixon the two newagent-busfiles to clear added array-type lint.normalizeCron(raw && typeof…and per-jobtypeof job !== 'object'). SincesafeJsoncan returnnull, this would crash on malformed/empty cron data. Restored both guards while keeping the kanban feature.Direct issue fixes (no upstream PR existed — patched on-branch)
Mergeable PR backlog was exhausted in round 1, so these priority issues were fixed directly on this branch:
40828fc) — add Google (Gemini) to model provider selection andKNOWN_PROVIDER_PREFIXES. build ✅0a6d1bc) — scroll auto-jump fix: releasestickToBottomon any upward user scroll, re-stick only near bottom. build ✅cf16f9a) — config.yaml providers/model aliases merged into/api/models. build ✅9e1b0b0f) — React DOM reconciliation crash recovery with SW/cache clear + one-shot reload guard. build ✅eab27ac3+ existing route/backend fixes) —/api/hermes-tasksexists, task backend probe rejects non-JSON SPA fallback, and/api/sessionsrejects HTML/non-JSON before parsing. build ✅ca5792ea) — live OpenAI-compatible/v1/modelsdiscovery from configuredbase_urlproxies. build ✅enhancedChat,mcp,mcpFallbackdespite healthy gateway/dashboard connectivity #566/Workspace advertises unsupported capabilities (Memory/Config) when connected to a standard Hermes Gateway deployment #590 (d861fb09, verified again in round 2) — capability reporting separates optional gaps (enhancedChat, MCP/dashboard extras) from critical missing APIs. build ✅cb054c59) — documented + scripted user-level service install for Hermes Workspace dashboard:scripts/install-dashboard-service.shinstalls/removes macOS launchd or Linux systemd user services;docs/dashboard-service.md+ README section cover logs, overrides, security. build ✅cb054c59) — Swarm Board now preservestags, supportslabel:Tier1/Tier2two-tier labels, label filter chips, and running-job visibility from status/update time +latestRunsummaries. build ✅cb054c59) — chat message content now supports interactiveselectionCardparts with single/multi/confirm actions that submit a tap/click response back into chat. build ✅cb054c59) — Appearance settings now expose interface font and spacing density, persisted via settings store and applied as root CSS variables/data attributes. build ✅cb054c59) — added backend/api/sessions/search?q=route that proxies Hermes/dashboard FTS5 search when available, falls back to local portable session search, and wired Cmd+K chat scope to debounced backend results/snippets. build ✅cb054c59) — added SCOM/API key registry + rotation checklist (docs/api-key-registry.md) and expanded.env.exampleprovider-key inventory. build ✅cb054c59, root cause pinned + workspace-side fix) — Workspace no longer embedshermes-world.aiin an iframe that fails with “refused to connect”;/playgroundnow shows a full-tab launch/diagnostic card and pins the remaining stale asset MIME issue (/assets/styles-*.cssserved astext/html) to the live HermesWorld deployment/CDN. build ✅workspace_context, so the bug is in the hermes-agent Ollama prompt path, outside this repo.Round-2 local verification after
cb054c59:pnpm build✅ greenpnpm test= 33 failed / 694 passed (exact baseline parity, zero new regressions)pnpm lintstill fails on existing repo debt, but improves vs prior branch baseline: 1766 problems / 1580 errors / 186 warnings (no new lint regressions)Remaining PR matrix after round-2 re-attempts
pr-484; 2 files but 789 insertions / 505 deletions acrossfile-explorer-sidebar.tsxandroutes/files.tsx. It rewrites the same file-open/editor surface already integrated from #545, so applying it would overwrite the validated Monaco/open-file behavior.electron/main.cjsand provider/settings surfaces already diverged from landed Windows/provider fixes.src/server/claude-agent.ts,hermes-agent-startup.ts,playground-hud.tsx, andvite.config.ts. Specific blocker: it restructures binary/path resolution already changed by #540, requiring a deliberate startup-path design pass.src/routes/api/send-stream.tsstreaming path already stabilized by #543/#589. Specific blocker: competing streaming/zero-fork strategy, not a clean cherry-pick.slash-command-menu.tsx,__root.tsx,dashboard-aggregator,swarm-*, andmodels.tsall overlap landed PRs/direct fixes. Needs sequenced review, not bulk apply.package.json,swarm-dispatch.ts,claude-agent.ts,models.ts, and multiple chat/send-stream files conflict with already validated Windows + streaming fixes. Useful intent largely covered by #579./api/send-stream,/api/sessions,/api/models, and kanban backend surfaces already patched multiple times in this branch.kanban-backend.ts,/api/swarm-kanban, and task UI. Round 2 landed the safe subset requested by #491 instead.ghcr.io/mrcoferland/...image rewrite. Specific blocker: unsafe registry rename plus Docker judgment, though helper idea may be cherry-picked later.ma/*API family and project registry. Specific blocker: full product surface overlapping existing Conductor/Gateway/Swarm UI, needs separate PR not consolidation.Remaining open issues — Needs Eric / runtime or infra scope
Hard rules honored
/Users/aurora/hermes-workspace.Cycle 17 (2026-06-05 17:25 EDT)
experimentalEchoStudio: falseto StudioSettings, a new Settings > Labs (experimental) toggle, and gated the nav item in both surfaces. Safer default for main. Build GREEN; tests at baseline parity (pre-existing 33-34 flaky-drift fail count, verified via stash-check — identical at clean HEAD); only 1 pre-existing lint warning on touched files.