Fix Docker backend on macOS and subagent auth for Nous Portal#46
Merged
Conversation
Three issues prevented the Docker terminal backend from working: 1. `effective_image` was referenced but never defined — only the Modal backend sets this variable. Use `image` directly instead. 2. `--storage-opt size=N` is unsupported on Docker Desktop for Mac (requires overlay2 with xfs backing). Skip the flag on Darwin. 3. Docker requires absolute paths for `-w` (working directory) but the default cwd was `~`, which Docker does not expand. Default to `/root` and translate any `~` passed in from callers. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When using Nous Portal (or any non-OpenRouter provider), child agents spawned by delegate_task failed with "No pricing available" or "Unknown model" errors because they had no valid API key. The delegate tool passed base_url but not api_key to child AIAgent instances. Without an explicit key, children fell back to the empty OPENROUTER_API_KEY env var, causing auth failures. Extract the parent's API key from _client_kwargs and pass it through. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
… context files The security scanner (skills_guard.py) was only wired into the hub install path. All other write paths to persistent state — skills created by the agent, memory entries, cron prompts, and context files — bypassed it entirely. This closes those gaps: - file_operations: deny-list blocks writes to ~/.ssh, ~/.aws, ~/.hermes/.env, etc. - code_execution_tool: filter secret env vars from sandbox child process - skill_manager_tool: wire scan_skill() into create/edit/patch/write_file with rollback - skills_guard: add "agent-created" trust level (same policy as community) - memory_tool: scan content for injection/exfil before system prompt injection - prompt_builder: scan AGENTS.md, .cursorrules, SOUL.md for prompt injection - cronjob_tools: scan cron prompts for critical threats before scheduling Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Contributor
|
LGTM |
malaiwah
pushed a commit
to malaiwah/hermes-agent
that referenced
this pull request
Apr 5, 2026
Previous run NousResearch#46 failed due to transient network issue. This is a no-op commit to re-trigger the build pipeline. Related: feat: Add gnupg package for GPG email signing
malaiwah
pushed a commit
to malaiwah/hermes-agent
that referenced
this pull request
Apr 11, 2026
Previous run NousResearch#46 failed due to transient network issue. This is a no-op commit to re-trigger the build pipeline. Related: feat: Add gnupg package for GPG email signing
kshitijk4poor
added a commit
that referenced
this pull request
Apr 21, 2026
…metry references Add 6 new reference files with generic reusable patterns: - glsl.md: uniforms, built-in functions, shader templates, Bayer dither - postfx.md: bloom, CRT scanlines, chromatic aberration, feedback glow - layout-compositor.md: layoutTOP, overTOP grids, panel dividers - operator-tips.md: wireframe rendering, feedback TOP setup - geometry-comp.md: instancing, POP vs SOP rendering, shape morphing - audio-reactive.md: band extraction (audiofilterCHOP), beat detection, MIDI Expand SKILL.md with: - TD 2025 API quirks (connection syntax, GLSL TOP rules, expression gotchas) - Trimmed param name table (8 known LLM traps, defers to td_get_par_info) - Slider-to-shader wiring (td_execute_python + ParMode.EXPRESSION) - Frame capture with run()/delayFrames (TOP.save() timing fix) - TD 099 POP vs SOP rendering rules - Incremental build strategy for large scripts - Remote TD setup (PC over Ethernet) - Audio synthesis via CHOPs (LFO-driven envelope pattern) Expand pitfalls.md (#46-63): - Connection syntax, moviefileoutTOP bug, batch frame capture - TOP.save() time advancement, feedback masking, incremental builds - MCP reconnection after project.load(), TOX reverse-engineering - sliderCOMP naming, create() suffix requirement - COMP reparenting (copyOPs), expressionCHOP crash All content is generic — no session-specific paths, hardware, aesthetics, or param-name-only entries (those belong in td_get_par_info). Bumps version 1.0.0 → 2.0.0.
teknium1
pushed a commit
that referenced
this pull request
Apr 27, 2026
…metry references (#13664) Add 6 new reference files with generic reusable patterns: - glsl.md: uniforms, built-in functions, shader templates, Bayer dither - postfx.md: bloom, CRT scanlines, chromatic aberration, feedback glow - layout-compositor.md: layoutTOP, overTOP grids, panel dividers - operator-tips.md: wireframe rendering, feedback TOP setup - geometry-comp.md: instancing, POP vs SOP rendering, shape morphing - audio-reactive.md: band extraction (audiofilterCHOP), beat detection, MIDI Expand pitfalls.md (#46-63): - Connection syntax, moviefileoutTOP bug, batch frame capture - TOP.save() time advancement, feedback masking, incremental builds - MCP reconnection after project.load(), TOX reverse-engineering - sliderCOMP naming, create() suffix requirement - COMP reparenting (copyOPs), expressionCHOP crash - Strip session-specific names in earlier pitfalls (promo_ -> my_) - Audio device CHOP at FPS=0: active=False is the fix, not volume=0 All content is generic — no session-specific paths, hardware, aesthetics, or param-name-only entries (those belong in td_get_par_info). Bumps version 1.0.0 -> 1.1.0. Salvaged from @kshitijk4poor's original PR #13664; dropped setup.sh and troubleshooting.md changes that reverted subsequent HERMES_HOME and pgrep fixes already on main, and preserved original author frontmatter.
angelburgosrosado
pushed a commit
to angelburgosrosado/hermes-agent
that referenced
this pull request
Apr 27, 2026
Fix Docker backend on macOS and subagent auth for Nous Portal
cluricaun28
referenced
this pull request
in cluricaun28/Logos
Apr 28, 2026
…metry references (#13664) Add 6 new reference files with generic reusable patterns: - glsl.md: uniforms, built-in functions, shader templates, Bayer dither - postfx.md: bloom, CRT scanlines, chromatic aberration, feedback glow - layout-compositor.md: layoutTOP, overTOP grids, panel dividers - operator-tips.md: wireframe rendering, feedback TOP setup - geometry-comp.md: instancing, POP vs SOP rendering, shape morphing - audio-reactive.md: band extraction (audiofilterCHOP), beat detection, MIDI Expand pitfalls.md (#46-63): - Connection syntax, moviefileoutTOP bug, batch frame capture - TOP.save() time advancement, feedback masking, incremental builds - MCP reconnection after project.load(), TOX reverse-engineering - sliderCOMP naming, create() suffix requirement - COMP reparenting (copyOPs), expressionCHOP crash - Strip session-specific names in earlier pitfalls (promo_ -> my_) - Audio device CHOP at FPS=0: active=False is the fix, not volume=0 All content is generic — no session-specific paths, hardware, aesthetics, or param-name-only entries (those belong in td_get_par_info). Bumps version 1.0.0 -> 1.1.0. Salvaged from @kshitijk4poor's original PR #13664; dropped setup.sh and troubleshooting.md changes that reverted subsequent HERMES_HOME and pgrep fixes already on main, and preserved original author frontmatter.
ulasbilgen
pushed a commit
to ulasbilgen/hermes-adhd-agent
that referenced
this pull request
May 1, 2026
…metry references (NousResearch#13664) Add 6 new reference files with generic reusable patterns: - glsl.md: uniforms, built-in functions, shader templates, Bayer dither - postfx.md: bloom, CRT scanlines, chromatic aberration, feedback glow - layout-compositor.md: layoutTOP, overTOP grids, panel dividers - operator-tips.md: wireframe rendering, feedback TOP setup - geometry-comp.md: instancing, POP vs SOP rendering, shape morphing - audio-reactive.md: band extraction (audiofilterCHOP), beat detection, MIDI Expand pitfalls.md (NousResearch#46-63): - Connection syntax, moviefileoutTOP bug, batch frame capture - TOP.save() time advancement, feedback masking, incremental builds - MCP reconnection after project.load(), TOX reverse-engineering - sliderCOMP naming, create() suffix requirement - COMP reparenting (copyOPs), expressionCHOP crash - Strip session-specific names in earlier pitfalls (promo_ -> my_) - Audio device CHOP at FPS=0: active=False is the fix, not volume=0 All content is generic — no session-specific paths, hardware, aesthetics, or param-name-only entries (those belong in td_get_par_info). Bumps version 1.0.0 -> 1.1.0. Salvaged from @kshitijk4poor's original PR NousResearch#13664; dropped setup.sh and troubleshooting.md changes that reverted subsequent HERMES_HOME and pgrep fixes already on main, and preserved original author frontmatter.
donald131
pushed a commit
to donald131/hermes-agent
that referenced
this pull request
May 2, 2026
…metry references (NousResearch#13664) Add 6 new reference files with generic reusable patterns: - glsl.md: uniforms, built-in functions, shader templates, Bayer dither - postfx.md: bloom, CRT scanlines, chromatic aberration, feedback glow - layout-compositor.md: layoutTOP, overTOP grids, panel dividers - operator-tips.md: wireframe rendering, feedback TOP setup - geometry-comp.md: instancing, POP vs SOP rendering, shape morphing - audio-reactive.md: band extraction (audiofilterCHOP), beat detection, MIDI Expand pitfalls.md (NousResearch#46-63): - Connection syntax, moviefileoutTOP bug, batch frame capture - TOP.save() time advancement, feedback masking, incremental builds - MCP reconnection after project.load(), TOX reverse-engineering - sliderCOMP naming, create() suffix requirement - COMP reparenting (copyOPs), expressionCHOP crash - Strip session-specific names in earlier pitfalls (promo_ -> my_) - Audio device CHOP at FPS=0: active=False is the fix, not volume=0 All content is generic — no session-specific paths, hardware, aesthetics, or param-name-only entries (those belong in td_get_par_info). Bumps version 1.0.0 -> 1.1.0. Salvaged from @kshitijk4poor's original PR NousResearch#13664; dropped setup.sh and troubleshooting.md changes that reverted subsequent HERMES_HOME and pgrep fixes already on main, and preserved original author frontmatter.
02356abc
pushed a commit
to 02356abc/hermes-agent
that referenced
this pull request
May 14, 2026
…metry references (NousResearch#13664) Add 6 new reference files with generic reusable patterns: - glsl.md: uniforms, built-in functions, shader templates, Bayer dither - postfx.md: bloom, CRT scanlines, chromatic aberration, feedback glow - layout-compositor.md: layoutTOP, overTOP grids, panel dividers - operator-tips.md: wireframe rendering, feedback TOP setup - geometry-comp.md: instancing, POP vs SOP rendering, shape morphing - audio-reactive.md: band extraction (audiofilterCHOP), beat detection, MIDI Expand pitfalls.md (NousResearch#46-63): - Connection syntax, moviefileoutTOP bug, batch frame capture - TOP.save() time advancement, feedback masking, incremental builds - MCP reconnection after project.load(), TOX reverse-engineering - sliderCOMP naming, create() suffix requirement - COMP reparenting (copyOPs), expressionCHOP crash - Strip session-specific names in earlier pitfalls (promo_ -> my_) - Audio device CHOP at FPS=0: active=False is the fix, not volume=0 All content is generic — no session-specific paths, hardware, aesthetics, or param-name-only entries (those belong in td_get_par_info). Bumps version 1.0.0 -> 1.1.0. Salvaged from @kshitijk4poor's original PR NousResearch#13664; dropped setup.sh and troubleshooting.md changes that reverted subsequent HERMES_HOME and pgrep fixes already on main, and preserved original author frontmatter.
dannyJ848
pushed a commit
to dannyJ848/hermes-agent
that referenced
this pull request
May 17, 2026
…metry references (NousResearch#13664) Add 6 new reference files with generic reusable patterns: - glsl.md: uniforms, built-in functions, shader templates, Bayer dither - postfx.md: bloom, CRT scanlines, chromatic aberration, feedback glow - layout-compositor.md: layoutTOP, overTOP grids, panel dividers - operator-tips.md: wireframe rendering, feedback TOP setup - geometry-comp.md: instancing, POP vs SOP rendering, shape morphing - audio-reactive.md: band extraction (audiofilterCHOP), beat detection, MIDI Expand pitfalls.md (NousResearch#46-63): - Connection syntax, moviefileoutTOP bug, batch frame capture - TOP.save() time advancement, feedback masking, incremental builds - MCP reconnection after project.load(), TOX reverse-engineering - sliderCOMP naming, create() suffix requirement - COMP reparenting (copyOPs), expressionCHOP crash - Strip session-specific names in earlier pitfalls (promo_ -> my_) - Audio device CHOP at FPS=0: active=False is the fix, not volume=0 All content is generic — no session-specific paths, hardware, aesthetics, or param-name-only entries (those belong in td_get_par_info). Bumps version 1.0.0 -> 1.1.0. Salvaged from @kshitijk4poor's original PR NousResearch#13664; dropped setup.sh and troubleshooting.md changes that reverted subsequent HERMES_HOME and pgrep fixes already on main, and preserved original author frontmatter.
3 tasks
gweeteve
pushed a commit
to gweeteve/hermes-agent
that referenced
this pull request
Jun 2, 2026
…metry references (NousResearch#13664) Add 6 new reference files with generic reusable patterns: - glsl.md: uniforms, built-in functions, shader templates, Bayer dither - postfx.md: bloom, CRT scanlines, chromatic aberration, feedback glow - layout-compositor.md: layoutTOP, overTOP grids, panel dividers - operator-tips.md: wireframe rendering, feedback TOP setup - geometry-comp.md: instancing, POP vs SOP rendering, shape morphing - audio-reactive.md: band extraction (audiofilterCHOP), beat detection, MIDI Expand pitfalls.md (NousResearch#46-63): - Connection syntax, moviefileoutTOP bug, batch frame capture - TOP.save() time advancement, feedback masking, incremental builds - MCP reconnection after project.load(), TOX reverse-engineering - sliderCOMP naming, create() suffix requirement - COMP reparenting (copyOPs), expressionCHOP crash - Strip session-specific names in earlier pitfalls (promo_ -> my_) - Audio device CHOP at FPS=0: active=False is the fix, not volume=0 All content is generic — no session-specific paths, hardware, aesthetics, or param-name-only entries (those belong in td_get_par_info). Bumps version 1.0.0 -> 1.1.0. Salvaged from @kshitijk4poor's original PR NousResearch#13664; dropped setup.sh and troubleshooting.md changes that reverted subsequent HERMES_HOME and pgrep fixes already on main, and preserved original author frontmatter.
Egavasyug
pushed a commit
to Egavasyug/hermes-agent
that referenced
this pull request
Jun 10, 2026
Fix Docker backend on macOS and subagent auth for Nous Portal
Egavasyug
pushed a commit
to Egavasyug/hermes-agent
that referenced
this pull request
Jun 10, 2026
…metry references (NousResearch#13664) Add 6 new reference files with generic reusable patterns: - glsl.md: uniforms, built-in functions, shader templates, Bayer dither - postfx.md: bloom, CRT scanlines, chromatic aberration, feedback glow - layout-compositor.md: layoutTOP, overTOP grids, panel dividers - operator-tips.md: wireframe rendering, feedback TOP setup - geometry-comp.md: instancing, POP vs SOP rendering, shape morphing - audio-reactive.md: band extraction (audiofilterCHOP), beat detection, MIDI Expand pitfalls.md (NousResearch#46-63): - Connection syntax, moviefileoutTOP bug, batch frame capture - TOP.save() time advancement, feedback masking, incremental builds - MCP reconnection after project.load(), TOX reverse-engineering - sliderCOMP naming, create() suffix requirement - COMP reparenting (copyOPs), expressionCHOP crash - Strip session-specific names in earlier pitfalls (promo_ -> my_) - Audio device CHOP at FPS=0: active=False is the fix, not volume=0 All content is generic — no session-specific paths, hardware, aesthetics, or param-name-only entries (those belong in td_get_par_info). Bumps version 1.0.0 -> 1.1.0. Salvaged from @kshitijk4poor's original PR NousResearch#13664; dropped setup.sh and troubleshooting.md changes that reverted subsequent HERMES_HOME and pgrep fixes already on main, and preserved original author frontmatter.
Vqwa
added a commit
to Vqwa/ip-agent-runtime
that referenced
this pull request
Jun 13, 2026
…results, endpoint pinning, sandbox reaping (#1) * Phase-3 hardening: JWT age+jti+MCP binding, BYOK env containment, framed results, endpoint pinning, sandbox reaping (HARDENING_PLAN H12, H20-H27, H41) Implements the runtime half of the IP hardening plan's Phase 3, plus fixes from the pre-PR adversarial review (1 blocker, 8 should-fixes applied): server.py - H12: iat required; tokens older than 35s (ttl 30 + skew) rejected. - H20: in-process jti dedup (exp-pruned dict; replay -> 401; jti recorded only after all checks so a rejected forgery can't burn the real one). Residual: per-instance only — cross-instance replay stays IAM-bounded. - H21b (verify-if-present): mcp_token_sha256 claim compared constant-time to the shipped config.mcp.token; absent -> allowed + logged. TODO(H21b-flip) to require once Django PR NousResearch#46 is live on the Celery worker. - H24: result channel is FRAMED (===TURN_RESULT_v1=== sentinel + one JSON line, last-sentinel-wins) — stdout noise/injection can't become the result. - H23: child stderr scrubbed BY VALUE (recursive secret harvest over the request incl. JSON-packed blobs, + parent-env E2B key) before the shape regex; collector kept in parity with the worker's. - H27 parent half: orphaned-sandbox reaper (shape-validated ids, capped) runs before home cleanup. Review blocker fixed: RUNTIME_MCP_ENDPOINT_ALLOWLIST is now forwarded through _child_env (it was a dead knob in the served path). turn_worker.py - H22 containment: every BYOK env injection recorded + deleted in finally; the sandbox-env containment assert refuses the turn (env_key_leak) if any unrecorded credential-shaped var is present; e2b path allows exactly E2B_API_KEY, BYOK sandbox paths require it scrubbed. - H23 worker half: error.message + the stderr error line scrubbed by value. - H24 worker half: sentinel-framed final write on success AND error paths. - H25: config.mcp.endpoint pinned to RUNTIME_MCP_ENDPOINT_ALLOWLIST (default https://main.insightfulmcp.com/), exact match after slash normalization, refused BEFORE config.yaml is written. - H26: config.yaml written 0600. tools/environments/e2b.py + plugins/web/oxylabs - H27: sandbox-id breadcrumb + module-level kill_sandbox(); lifetime clamped to the wall budget (env-coupled). - H41: per-URL is_safe_url re-check in the fork-owned oxylabs extract loop. (Audit: the upstream dispatcher gates all extract URLs; two upstream mcp_tool.py probe paths bypass url_safety — ledgered, H25 is the control.) ci_guard_runtime.py + cloudbuild.yaml - Gate-16 child-env check, url_safety metadata-IP floor pin, sentinel-parity check; cloudbuild now RUNS the guard inside the built image before push. deploy/service.yaml refreshed to the live Phase-0 state (runtime-svc@ SA, public key as plain value, ISS/AUD pins, new allowlist knob). tests_runtime/ (48 green locally) excluded from the image. DEPLOY: server+worker halves are lockstep (H24 sentinel) — ship in ONE image revision, never cherry-picked. H21b flip only after Django NousResearch#46 is live. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Phase-4 runtime half: kid-keyed JWT verifier (H30) + extended C9 IAM audit (H38a) - server.py: RUNTIME_JWT_PUBLIC_KEYS_JSON ({kid: PEM}) parsed at import (bad JSON fails the boot); _verify_jwt resolves kid-in-set -> that PEM, kid-less -> the legacy single key (back-compat), unknown kid -> 401. Enables KMS-key rotation by kid (add entry -> deploy -> switch Django signer -> drop old). - deploy/service.yaml: commented RUNTIME_JWT_PUBLIC_KEYS_JSON example keyed by the LIVE KMS resource (global/hosted-agents/turn-jwt-signer/.../1). - deploy/audit_iam.sh: C9 deploy-blocking audit extended — invoker == exactly agent-control@, serviceAccountName == runtime-svc@, runtime SA has zero project bindings, legacy agent-runtime@ absent, secretmanager DATA_READ+WRITE and cloudkms DATA_READ audit configs present. PASSES against live GCP. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * runtime: actually wire ci_guard_runtime.py into cloudbuild + Phase-5 doc truth-up The Phase-3 commit claimed cloudbuild ran the security-invariants guard, but the edit never landed (a failed `cd` aborted the write) — cloudbuild only did docker-build. Wire it for real: a second build step runs ci_guard_runtime.py INSIDE the freshly built image, non-zero blocks the push (fails safe — a broken invariant can't deploy). Validate on the first build (the guard's heavy Hermes deps only exist in the image). Docs reconciled to shipped reality (HARDENING_PLAN H40): - deploy/README.md invariant (c): runtime SA accessor is {e2b-api-key} ONLY, not {jwt-public-key, e2b-api-key} (the public key is a plain env value since H1); dropped the stale jwt-public-key Secret-Manager rotation hint. - FORK_DIVERGENCES.md / RUNTIME_README.md: framing + env-var reconciliation. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: insightfulpipe <contact@insightfulpipe.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
dizhaky
referenced
this pull request
in dizhaky/hermes-agent
Jun 23, 2026
…AN-1385) (#26) baileys 7.0.0-rc.9->rc13 (clears #43 critical) + protobufjs 7.6.4 (#59,#58) in whatsapp-bridge; esbuild+tsx (#46,#61) in ui-tui; @babel/core (#84) in web; joi+http-proxy-middleware (#51,NousResearch#89) in website. js-yaml NousResearch#86 accepted (no in-range fix via gray-matter). Bridge startup verified. NousResearch#93/NousResearch#94 (code fixes) separate. Co-Authored-By: Claude <noreply@anthropic.com>
liuchanchen
pushed a commit
to liuchanchen/hermes-agent
that referenced
this pull request
Jul 3, 2026
…metry references (NousResearch#13664) Add 6 new reference files with generic reusable patterns: - glsl.md: uniforms, built-in functions, shader templates, Bayer dither - postfx.md: bloom, CRT scanlines, chromatic aberration, feedback glow - layout-compositor.md: layoutTOP, overTOP grids, panel dividers - operator-tips.md: wireframe rendering, feedback TOP setup - geometry-comp.md: instancing, POP vs SOP rendering, shape morphing - audio-reactive.md: band extraction (audiofilterCHOP), beat detection, MIDI Expand pitfalls.md (NousResearch#46-63): - Connection syntax, moviefileoutTOP bug, batch frame capture - TOP.save() time advancement, feedback masking, incremental builds - MCP reconnection after project.load(), TOX reverse-engineering - sliderCOMP naming, create() suffix requirement - COMP reparenting (copyOPs), expressionCHOP crash - Strip session-specific names in earlier pitfalls (promo_ -> my_) - Audio device CHOP at FPS=0: active=False is the fix, not volume=0 All content is generic — no session-specific paths, hardware, aesthetics, or param-name-only entries (those belong in td_get_par_info). Bumps version 1.0.0 -> 1.1.0. Salvaged from @kshitijk4poor's original PR NousResearch#13664; dropped setup.sh and troubleshooting.md changes that reverted subsequent HERMES_HOME and pgrep fixes already on main, and preserved original author frontmatter.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Docker backend fixes (macOS)
effective_imagevariable in Docker backend — only the Modal backend defines this; useimagedirectly--storage-opt size=Non macOS — Docker Desktop doesn't support this flag (requires overlay2 with xfs backing)~— Docker requires absolute paths for-w; default to/rootand translate~from callersSubagent auth fix (Nous Portal)
delegate_task— without this, subagents fall back to the emptyOPENROUTER_API_KEYenv var when using Nous Portal, causing "No pricing available" / "Unknown model" errors on every delegationTest plan
hermeswithterminal.backend: dockerworks on macOS (Docker Desktop)--storage-optis supported)🤖 Generated with Claude Code