…tting

Track A: Workspace breadcrumb navigation
- Breadcrumb path bar with clickable segments when inside subdirectories
- Up button in panel header for parent directory navigation
- S.currentDir state tracking; file ops stay in current directory
- New file/folder creation respects current subdirectory

Track B: Slash commands foundation
- New commands.js module (7th JS module) with command registry and parser
- Built-in commands: /help, /clear, /model, /workspace, /new
- Autocomplete dropdown on / input with arrow/tab/enter/escape navigation
- Unrecognized commands pass through to agent normally

Track C: Send key setting (closes NousResearch#26)
- send_key added to settings defaults in api/config.py
- Settings panel dropdown: Enter (default) vs Ctrl/Cmd+Enter
- Keydown handler rewritten for autocomplete + send key preference
- Setting loaded on boot, persisted to settings.json

5 new tests, 242 total (219 passing, 22 pre-existing failures, 0 regressions).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…space shell

Cherry-picked from PR NousResearch#26 (clawjasper56). Replaces hardcoded
authenticated=true with useQuery to /api/auth-check endpoint.
Resolved conflict with our isMobile state addition.

When the Hermes gateway is running but the HTTP API server is not
enabled, the onboarding screen shows generic advice that doesn't
address the actual problem. Users can have a fully functional gateway
(serving Telegram, Discord, etc.) while the workspace can't connect.

Changes:
- Onboarding connection error now shows step-by-step instructions:
  1. Add API_SERVER_ENABLED=true to ~/.hermes/.env
  2. Restart the gateway
- Updated .env.example to document the requirement
- Added Ollama/LiteLLM/vLLM as explicit alternative backend options

Fixes NousResearch#26

…agents (phase 10)

The SDK landed PRs NousResearch#24/NousResearch#25/NousResearch#26 in synadia-ai/synadia-agents:
- verb-first subjects (`agents.prompt.{a}.{o}.{s}`, `agents.hb.{a}.{o}.{s}`,
  new `agents.status.{a}.{o}.{s}`) and `metadata.protocol_version="0.3"`
- pinned `_INBOX.agents` reply-inbox prefix (caller-side; no-op for us)
- `name`+`session` collapsed into a single `session_name` (the 5th subject
  token) — `Envelope.session` and the `session=` kwarg on `AgentService` /
  `Agent.prompt` are gone. One service = one session_name.

Package + import root rename: `natsagent` → `synadia-ai-agents`,
`synadia_ai.agents`. Service-side class `Agent` → `AgentService`.

Adapter changes:
- Adopt single-service-per-session: rely on Hermes profile isolation for
  multi-session deployments instead of building an envelope.session demuxer
  on top of `AgentService`. The `_session_locks` dict collapses to a single
  `_session_lock`.
- The SDK explicitly does not own NATS connections: callers build the
  client. Adapter calls `nats.connect(servers=...)` or
  `nats.connect(**sdk.load_context_options(name))` directly.
- Config: `extra.name` + `extra.session_default` → required
  `extra.session_name`; env var `HERMES_NATS_NAME`/`HERMES_NATS_SESSION` →
  `HERMES_NATS_SESSION_NAME`. No migration shim — branch hadn't merged.
- Lock identity rebuilt as `{agent}:{owner}:{session_name}`.

Tests + docs:
- conftest mock renamed `_ensure_natsagent_mock` → `_ensure_synadia_agents_mock`,
  installs under `sys.modules["synadia_ai.agents"]`, also stubs `nats` so
  the adapter's `nats.connect(...)` resolves under test.
- New `mock_nats` fixture in test_nats_connect.py; concurrent-distinct-
  sessions test removed (v0.2-only concept); positive test added that
  chat_id is sourced from `settings.session_name` regardless of any stray
  envelope field.
- design doc §1-§6/§11/§17 updated for v0.3; progress doc gains a Phase 10
  decision-log entry; user-facing nats.md rewritten with verb-first subject
  examples, status endpoint walkthrough, and `_INBOX.agents.>` permission
  note.

Live-verified end-to-end against `nats-server -p 4223` + `hermes-local`
context + `model: anthropic/claude-haiku-4.5` over OpenRouter: real prompt
streamed a real haiku reply through `agents.prompt.hermes.rene.local`,
multi-turn session continuity intact, `/status` slash command dispatched
through the gateway's command registry. Discovery shows
`protocol_version: 0.3`. Heartbeats fire on `agents.hb.hermes.rene.local`.
Status endpoint replies on `agents.status.hermes.rene.local`.

NATS gateway tests: 190/190 green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…agents (phase 10)

The SDK landed PRs NousResearch#24/NousResearch#25/NousResearch#26 in synadia-ai/synadia-agents:
- verb-first subjects (`agents.prompt.{a}.{o}.{s}`, `agents.hb.{a}.{o}.{s}`,
  new `agents.status.{a}.{o}.{s}`) and `metadata.protocol_version="0.3"`
- pinned `_INBOX.agents` reply-inbox prefix (caller-side; no-op for us)
- `name`+`session` collapsed into a single `session_name` (the 5th subject
  token) — `Envelope.session` and the `session=` kwarg on `AgentService` /
  `Agent.prompt` are gone. One service = one session_name.

Package + import root rename: `natsagent` → `synadia-ai-agents`,
`synadia_ai.agents`. Service-side class `Agent` → `AgentService`.

Adapter changes:
- Adopt single-service-per-session: rely on Hermes profile isolation for
  multi-session deployments instead of building an envelope.session demuxer
  on top of `AgentService`. The `_session_locks` dict collapses to a single
  `_session_lock`.
- The SDK explicitly does not own NATS connections: callers build the
  client. Adapter calls `nats.connect(servers=...)` or
  `nats.connect(**sdk.load_context_options(name))` directly.
- Config: `extra.name` + `extra.session_default` → required
  `extra.session_name`; env var `HERMES_NATS_NAME`/`HERMES_NATS_SESSION` →
  `HERMES_NATS_SESSION_NAME`. No migration shim — branch hadn't merged.
- Lock identity rebuilt as `{agent}:{owner}:{session_name}`.

Tests + docs:
- conftest mock renamed `_ensure_natsagent_mock` → `_ensure_synadia_agents_mock`,
  installs under `sys.modules["synadia_ai.agents"]`, also stubs `nats` so
  the adapter's `nats.connect(...)` resolves under test.
- New `mock_nats` fixture in test_nats_connect.py; concurrent-distinct-
  sessions test removed (v0.2-only concept); positive test added that
  chat_id is sourced from `settings.session_name` regardless of any stray
  envelope field.
- design doc §1-§6/§11/§17 updated for v0.3; progress doc gains a Phase 10
  decision-log entry; user-facing nats.md rewritten with verb-first subject
  examples, status endpoint walkthrough, and `_INBOX.agents.>` permission
  note.

Live-verified end-to-end against `nats-server -p 4223` + `hermes-local`
context + `model: anthropic/claude-haiku-4.5` over OpenRouter: real prompt
streamed a real haiku reply through `agents.prompt.hermes.rene.local`,
multi-turn session continuity intact, `/status` slash command dispatched
through the gateway's command registry. Discovery shows
`protocol_version: 0.3`. Heartbeats fire on `agents.hb.hermes.rene.local`.
Status endpoint replies on `agents.status.hermes.rene.local`.

NATS gateway tests: 190/190 green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

)

When the WebUI's model picker sets the active provider to
"venice" (or "crof", "bankr", "cometapi"), the agent's
resolve_provider_client() looked up the slug in
PROVIDER_REGISTRY, failed to find it, and raised:

  "Provider 'venice' is set in config.yaml but no API key
   was found. Set the VENICE_API_KEY environment variable..."

VENICE_API_KEY WAS set in env — the failure was because
the agent had no idea which env var or base URL to use for
"venice" as a slug. PROVIDER_REGISTRY entries for the other
OpenAI-compatible aggregators (Z.AI, MiniMax, Mistral, etc.)
already existed; Venice/CrofAI/Bankr/CometAPI just hadn't
been added in the upstream code.

Adds four api_key-auth entries mirroring the existing
OpenAI-compat ones:
- venice → https://api.venice.ai/api/v1 + VENICE_API_KEY
- crof → https://crof.ai/v1 + CROF_API_KEY
- bankr → https://gateway.bankr.bot/v1 + BANKR_API_KEY
- cometapi → https://api.cometapi.com/v1 + COMETAPI_API_KEY

Companion to the WebUI side (PRs #26/#27/#29/#30/#32/#33)
which made these providers discoverable in the model picker
with their live /v1/models catalogs.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

…agents (phase 10)

The SDK landed PRs NousResearch#24/NousResearch#25/NousResearch#26 in synadia-ai/synadia-agents:
- verb-first subjects (`agents.prompt.{a}.{o}.{s}`, `agents.hb.{a}.{o}.{s}`,
  new `agents.status.{a}.{o}.{s}`) and `metadata.protocol_version="0.3"`
- pinned `_INBOX.agents` reply-inbox prefix (caller-side; no-op for us)
- `name`+`session` collapsed into a single `session_name` (the 5th subject
  token) — `Envelope.session` and the `session=` kwarg on `AgentService` /
  `Agent.prompt` are gone. One service = one session_name.

Package + import root rename: `natsagent` → `synadia-ai-agents`,
`synadia_ai.agents`. Service-side class `Agent` → `AgentService`.

Adapter changes:
- Adopt single-service-per-session: rely on Hermes profile isolation for
  multi-session deployments instead of building an envelope.session demuxer
  on top of `AgentService`. The `_session_locks` dict collapses to a single
  `_session_lock`.
- The SDK explicitly does not own NATS connections: callers build the
  client. Adapter calls `nats.connect(servers=...)` or
  `nats.connect(**sdk.load_context_options(name))` directly.
- Config: `extra.name` + `extra.session_default` → required
  `extra.session_name`; env var `HERMES_NATS_NAME`/`HERMES_NATS_SESSION` →
  `HERMES_NATS_SESSION_NAME`. No migration shim — branch hadn't merged.
- Lock identity rebuilt as `{agent}:{owner}:{session_name}`.

Tests + docs:
- conftest mock renamed `_ensure_natsagent_mock` → `_ensure_synadia_agents_mock`,
  installs under `sys.modules["synadia_ai.agents"]`, also stubs `nats` so
  the adapter's `nats.connect(...)` resolves under test.
- New `mock_nats` fixture in test_nats_connect.py; concurrent-distinct-
  sessions test removed (v0.2-only concept); positive test added that
  chat_id is sourced from `settings.session_name` regardless of any stray
  envelope field.
- design doc §1-§6/§11/§17 updated for v0.3; progress doc gains a Phase 10
  decision-log entry; user-facing nats.md rewritten with verb-first subject
  examples, status endpoint walkthrough, and `_INBOX.agents.>` permission
  note.

Live-verified end-to-end against `nats-server -p 4223` + `hermes-local`
context + `model: anthropic/claude-haiku-4.5` over OpenRouter: real prompt
streamed a real haiku reply through `agents.prompt.hermes.rene.local`,
multi-turn session continuity intact, `/status` slash command dispatched
through the gateway's command registry. Discovery shows
`protocol_version: 0.3`. Heartbeats fire on `agents.hb.hermes.rene.local`.
Status endpoint replies on `agents.status.hermes.rene.local`.

NATS gateway tests: 190/190 green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Fixes 12 remaining MEDIUM issues from the deep audit (19 total, 7 fixed in Round 12):

design_agent:
- NousResearch#15: add asyncio.wait_for(300s) around LLM API call to prevent infinite hangs
- NousResearch#17: replace 2x hardcoded 'claude-opus-4-8' with shared DEFAULT_MODEL constant

qa_agent / validate_agent:
- NousResearch#20,NousResearch#22,NousResearch#23: already fixed in Round 12 (verified — dynamic timeout/threshold values used)

memory.py:
- NousResearch#24: frontmatter parser uses regex r'^---$' instead of str.split('---',2),
  preventing false splits on content containing '---' (SQL, markdown tables)
- NousResearch#25: parse and preserve 'description' field from frontmatter in metadata,
  fixing write→load roundtrip data loss

profiles.py:
- NousResearch#26: ProfileConfig now frozen=True (immutable dataclass per coding standards)

deploy_agent:
- NousResearch#31: replace 2x sync subprocess.run with asyncio.create_subprocess_exec
- fix 5x .decode() → .decode('utf-8', errors='replace') for Windows CJK safety
- remove unused import subprocess

db.py:
- NousResearch#27: add class docstring explaining RLock + _unlocked pattern
- NousResearch#28: FK constraints already in DDL (verified PRAGMA foreign_keys=ON active)
- NousResearch#29: add _ensure_connection() with PRAGMA integrity_check(1) + auto-reconnect
       on 4 critical methods (create_task, get_task, claim_task, submit_result)
- extract _create_connection() static method for reuse by reconnect

Tests: 79 passed, 0 failed

- react-router: 7.14.2 → 7.17.0 (CVE-2026-42342, GHSA-8x6r-g9mw-2r78)
- Fixes Dependabot alert NousResearch#26