Fixes NousResearch#633

Problem:
- Sequential numbering gaps (e.g., NousResearch#1, NousResearch#2, NousResearch#5, NousResearch#8) confuse users
- 200 char truncation too aggressive
- Tool messages completely hidden with no indication

Fix:
1. Use separate counter for displayed messages only
2. Skip tool messages but show count at end
3. Skip system messages
4. Increase truncation to 300 chars
5. Display 'N tool messages hidden' summary

Impact:
- Consistent numbering: NousResearch#1, NousResearch#2, NousResearch#3, NousResearch#4
- Users know when tool calls occurred
- More context visible per message

- InlineApprovalCard component with approve/deny buttons
- Cards appear inline in agent output stream (not just bell notification)
- Context preview with code block formatting
- Visual states: pending (amber pulse), approved (green), denied (red)
- Both compact and full-size panels wired with filtered approvals

…ests for upstream readiness' (NousResearch#8) from feat/docker-env-files-cleanup into main

Discovered while verifying PR NousResearch#8 on the live oikos sidecar: BW_SESSION
values were appearing UNMASKED in /opt/data/logs/agent.log because the
existing masking heuristic only matches env names whose UPPERCASE form
contains TOKEN / KEY / SECRET / PASSWORD / CREDENTIAL / PASSWD — and
"BW_SESSION" matches none of those. The full rotating session token
was sitting plaintext in a long-lived log file, defeating the entire
point of rotating it.

Two-pronged fix to make this hard to mis-name in the future:

1. **Origin-based masking (the load-bearing rule).** Anything that
   came from `_extra_env_for_exec()` is masked unconditionally,
   regardless of variable name. By construction the hook produces
   dynamic credential values (otherwise why inject them per exec
   rather than at container spawn?). This catches the gitea PR NousResearch#7 /
   NousResearch#8 `docker_env_files` path AND any future credentials++ registry
   subscribers, without relying on operators to pick "secret-sounding"
   variable names.

2. **Expanded name heuristic** for static env vars whose values
   come from `self._env` / forward_env / passthrough. Adds:
   SESSION, AUTH, COOKIE, JWT, BEARER, SIGNATURE, PIN, PASSPHRASE,
   PRIVATE. False-positive cost (over-masking a log line) is much
   lower than false-negative cost (a real credential in plaintext),
   so the policy is "add aggressively than reluctantly."

4 new tests in tests/tools/test_docker_environment.py:
  - SESSION-named env masked (regression for the BW_SESSION case)
  - AUTH/COOKIE/JWT/BEARER/PASSPHRASE values masked
  - dynamic-origin values masked even with innocuous names like
    INNOCENT_VAR (origin rule overrides name heuristic absence)
  - readability check: PORT/DEBUG/HOME etc are NOT over-masked

Verified live on the running hermes-angelos build: agent.log now
shows `-e BW_SESSION=***` instead of the full session token.

- connection.py: cap header read at 8KB to prevent DoS from malicious handler
- handler.py: use .find() instead of `in` + .index() to eliminate race in patch
- handler.py: add truncated field to execute response when output exceeds 50KB
- server.py: include error data field in formatted error messages
- test: add timeout to test client recv, handle TimeoutExpired in close

Fixes issues NousResearch#1, NousResearch#4, NousResearch#5, NousResearch#6, NousResearch#8, NousResearch#10 from Qwen 3.5 peer review on PR NousResearch#19.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Security:
- NousResearch#1: secret is now required (ValueError if empty), server won't start without it
- NousResearch#2: error responses return generic 'Delivery failed', no internal state leak
- NousResearch#3: rate limiting: 1 msg per chat_id per 30s, returns 429 + retry_after
- NousResearch#8: logging uses %-style formatting, not f-strings

Functionality:
- NousResearch#4: uses gateway.adapters dict directly (verified interface exists)
- NousResearch#5: thread_id support via metadata dict (matches DeliveryRouter pattern)
- NousResearch#6: uses adapter.send(chat_id, content, metadata=) — the real BasePlatformAdapter interface

Code quality:
- NousResearch#7: added tests/test_notify.py with 14 test cases covering all 8 issues
- Platform string → Platform enum conversion with validation

… (follow-up to NousResearch#12908)

Previous commit seeded only ``provider``.  The next CI run (Tests
[24655838688](https://github.com/NousResearch/hermes-agent/actions/runs/24655838688))
shows the same test now trips on ``self.model``:

    FAILED test_interrupt_during_child_api_call_detected
    - AttributeError: 'AIAgent' object has no attribute 'model'

Hit pattern NousResearch#8 from my own pre-push self-review checklist:
"fixed one call site, missed sibling with same pattern."  The
``_create_openai_client`` path reads ``self.provider``, ``self.model``,
and ``self.base_url`` directly — if the mocked-client short-circuit
doesn't engage (as apparently happens under xdist here), each missing
attr surfaces as its own ``AttributeError``.

Seed all three core identity attrs that ``AIAgent.__init__`` sets
(run_agent.py:708, 734, 736) to make the bare-agent stub robust
against any code path that touches them.

Zero production-code change.  7 focused tests still pass.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Covers: progress.json -Xtheirs cherry-pick; retry-prompt context;
background companions with short timeout; candidate-pool refill
trigger; proper BACKEND adapter; softer verify_worker_commit;
audit CSV output; granular failure taxonomy. Each one is a separate
commit; order matters for #3 prereq-of #4 and #8 prereq-of #2.

Acceptance: audit productivity >50% sustained, no cherry_pick_failed
on progress.json-only changes, candidate_refilled event fires on
low-water, companion seam non-blocking, granular failure statuses
in runs.jsonl.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Sequences: #1 (Xtheirs) → #8 (taxonomy) → #2 (retry context) → #6
(softer verify) → #5 (backend adapter) → #3 (bg companions) → #4
(candidate refill) → #7 (CSV audit). Each is one commit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Captures Tier 3 tooling work that was considered during the 2026-04-26
overhaul but deferred. Each section explains the design, why it wasn't
shipped, and the trigger condition that should reopen it.

Tier 3 items deferred:
  NousResearch#7  Lazy MCP discovery — high refactor surface, low immediate value
      (gateway RAM/startup not currently constrained).
  NousResearch#8  Health-aware tool router — overlaps with already-shipped manual
      fallback (Tavily→DDG/httpx); marginal gain doesn't justify
      scaffolding.
  NousResearch#10 Batch tool API — concurrent path + within-turn dedup cache already
      mitigate the common case; would be disruptive.

Each section includes a reference design so future work can pick up
without re-deriving rationale, plus a "reopen when..." condition tied
to observable signals (memory > 4GB, fallback rate > 30%, etc.) so the
weekly health check (or operator) can flag when revisit is justified.

Tier 3 NousResearch#9 (LLM-summarize large results) was shipped in 9b3cef1.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Update snapshot id for ipython

Address adversarial review findings:

1. Race condition (#1): Job-level concurrency with cancel-in-progress
   collapses back-to-back pushes; ref: main checkout always gets latest
   branch state; explicit push target (origin HEAD:main).

2. Loop prevention (#2): File-whitelist check before commit aborts if
   any file outside nix/{tui,web}.nix was modified, preventing
   accidental self-triggering.

3. Silent infra failures (#8): nix-lockfile-check now fails explicitly
   when fix-lockfiles exits without reporting stale status (catches nix
   setup failures, network errors, script bugs that bypass continue-on-error).

4. Commit traceability (#11): Auto-fix commits include source SHA and
   workflow run URL in the commit body.

5. Explicit push target (#12): git push origin HEAD:main instead of
   bare git push.

* ci(nix): auto-fix stale npm hashes on push to main

When a PR merges to main with updated package-lock.json or package.json
in ui-tui/ or web/, the new auto-fix-main job detects stale npmDepsHash
values and pushes a fix commit directly to main.

This eliminates the recurring manual hash-bump PRs (#15420, #15314,
#15272, #15244) by reusing the existing fix-lockfiles --apply pipeline.

The fix commit only touches nix/*.nix files, which are outside the push
path filter (package-lock.json / package.json), so it cannot re-trigger
itself.

Closes #15314

* fix(ci): use GitHub App token for auto-fix-main push

GITHUB_TOKEN commits are invisible to workflow triggers (GitHub's
infinite-loop prevention). The auto-fix-main job pushes directly to
main, so the fix commit never triggered downstream nix.yml verification.

Mint a short-lived token via the repo's GitHub App (daimon-nous, APP_ID
+ APP_PRIVATE_KEY secrets) so the push is treated as a real event and
nix.yml fires to verify the corrected hashes.

Tested via workflow_dispatch dry-run: app token minted successfully,
checkout with app token succeeded, fix job correctly gated.

Resolves review feedback from Bugbot (r3144569551).

* ci(nix): rename lockfile check job for required status check

Rename 'check' → 'nix-lockfile-check' so the status check name is
unambiguous when added as a required check on main.

* fix(ci): harden auto-fix-main against races, loops, and silent failures

Address adversarial review findings:

1. Race condition (#1): Job-level concurrency with cancel-in-progress
   collapses back-to-back pushes; ref: main checkout always gets latest
   branch state; explicit push target (origin HEAD:main).

2. Loop prevention (#2): File-whitelist check before commit aborts if
   any file outside nix/{tui,web}.nix was modified, preventing
   accidental self-triggering.

3. Silent infra failures (#8): nix-lockfile-check now fails explicitly
   when fix-lockfiles exits without reporting stale status (catches nix
   setup failures, network errors, script bugs that bypass continue-on-error).

4. Commit traceability (#11): Auto-fix commits include source SHA and
   workflow run URL in the commit body.

5. Explicit push target (#12): git push origin HEAD:main instead of
   bare git push.

---------

Co-authored-by: alt-glitch <alt-glitch@users.noreply.github.com>

* ci(nix): auto-fix stale npm hashes on push to main

When a PR merges to main with updated package-lock.json or package.json
in ui-tui/ or web/, the new auto-fix-main job detects stale npmDepsHash
values and pushes a fix commit directly to main.

This eliminates the recurring manual hash-bump PRs (NousResearch#15420, NousResearch#15314,
NousResearch#15272, NousResearch#15244) by reusing the existing fix-lockfiles --apply pipeline.

The fix commit only touches nix/*.nix files, which are outside the push
path filter (package-lock.json / package.json), so it cannot re-trigger
itself.

Closes NousResearch#15314

* fix(ci): use GitHub App token for auto-fix-main push

GITHUB_TOKEN commits are invisible to workflow triggers (GitHub's
infinite-loop prevention). The auto-fix-main job pushes directly to
main, so the fix commit never triggered downstream nix.yml verification.

Mint a short-lived token via the repo's GitHub App (daimon-nous, APP_ID
+ APP_PRIVATE_KEY secrets) so the push is treated as a real event and
nix.yml fires to verify the corrected hashes.

Tested via workflow_dispatch dry-run: app token minted successfully,
checkout with app token succeeded, fix job correctly gated.

Resolves review feedback from Bugbot (r3144569551).

* ci(nix): rename lockfile check job for required status check

Rename 'check' → 'nix-lockfile-check' so the status check name is
unambiguous when added as a required check on main.

* fix(ci): harden auto-fix-main against races, loops, and silent failures

Address adversarial review findings:

1. Race condition (NousResearch#1): Job-level concurrency with cancel-in-progress
   collapses back-to-back pushes; ref: main checkout always gets latest
   branch state; explicit push target (origin HEAD:main).

2. Loop prevention (NousResearch#2): File-whitelist check before commit aborts if
   any file outside nix/{tui,web}.nix was modified, preventing
   accidental self-triggering.

3. Silent infra failures (NousResearch#8): nix-lockfile-check now fails explicitly
   when fix-lockfiles exits without reporting stale status (catches nix
   setup failures, network errors, script bugs that bypass continue-on-error).

4. Commit traceability (NousResearch#11): Auto-fix commits include source SHA and
   workflow run URL in the commit body.

5. Explicit push target (NousResearch#12): git push origin HEAD:main instead of
   bare git push.

---------

Co-authored-by: alt-glitch <alt-glitch@users.noreply.github.com>

* ci(nix): auto-fix stale npm hashes on push to main

When a PR merges to main with updated package-lock.json or package.json
in ui-tui/ or web/, the new auto-fix-main job detects stale npmDepsHash
values and pushes a fix commit directly to main.

This eliminates the recurring manual hash-bump PRs (NousResearch#15420, NousResearch#15314,
NousResearch#15272, NousResearch#15244) by reusing the existing fix-lockfiles --apply pipeline.

The fix commit only touches nix/*.nix files, which are outside the push
path filter (package-lock.json / package.json), so it cannot re-trigger
itself.

Closes NousResearch#15314

* fix(ci): use GitHub App token for auto-fix-main push

GITHUB_TOKEN commits are invisible to workflow triggers (GitHub's
infinite-loop prevention). The auto-fix-main job pushes directly to
main, so the fix commit never triggered downstream nix.yml verification.

Mint a short-lived token via the repo's GitHub App (daimon-nous, APP_ID
+ APP_PRIVATE_KEY secrets) so the push is treated as a real event and
nix.yml fires to verify the corrected hashes.

Tested via workflow_dispatch dry-run: app token minted successfully,
checkout with app token succeeded, fix job correctly gated.

Resolves review feedback from Bugbot (r3144569551).

* ci(nix): rename lockfile check job for required status check

Rename 'check' → 'nix-lockfile-check' so the status check name is
unambiguous when added as a required check on main.

* fix(ci): harden auto-fix-main against races, loops, and silent failures

Address adversarial review findings:

1. Race condition (NousResearch#1): Job-level concurrency with cancel-in-progress
   collapses back-to-back pushes; ref: main checkout always gets latest
   branch state; explicit push target (origin HEAD:main).

2. Loop prevention (NousResearch#2): File-whitelist check before commit aborts if
   any file outside nix/{tui,web}.nix was modified, preventing
   accidental self-triggering.

3. Silent infra failures (NousResearch#8): nix-lockfile-check now fails explicitly
   when fix-lockfiles exits without reporting stale status (catches nix
   setup failures, network errors, script bugs that bypass continue-on-error).

4. Commit traceability (NousResearch#11): Auto-fix commits include source SHA and
   workflow run URL in the commit body.

5. Explicit push target (NousResearch#12): git push origin HEAD:main instead of
   bare git push.

---------

Co-authored-by: alt-glitch <alt-glitch@users.noreply.github.com>

…ses picker

Two follow-ups based on user feedback after first ruflo /delegation usage:

1. Bug: typing `NousResearch#8` (or other Shift-digit / mouse / paste sequence) inside
   the curses radiolist exited the picker.

   Root cause: `key in (27, ord("q"))` matched ESC byte (27) which the
   terminal also emits as the leading byte of CSI sequences for unrelated
   keys. So a single ESC byte from a `NousResearch#8` keypress was treated as cancel.

   Fix in hermes_cli/curses_ui.py::curses_radiolist: when ESC arrives,
   briefly poll for a follow-up byte using nodelay() — if -1, it's a real
   lone ESC (cancel); otherwise drain the rest of the sequence and continue
   the loop. Removed the `27, ord("q")` tuple match; ESC is now its own
   guarded branch and `q` keeps its dedicated cancel path. Added explicit
   "any other key — silently ignore" comment so future drift doesn't
   reintroduce the bug.

2. Feature: curated default model assignments for all ~90 ruflo personas.

   New module-level dict ``SUGGESTED_ROLE_MODELS`` in
   hermes_cli/ruflo_agents.py mapping each known agent to one of three
   models based on what the persona actually does:
     - Haiku 4.5: retrieval / triage / scanners / monitors / lookup
       (researcher, scout-explorer, code-analyzer, issue-tracker,
       pii-detector, performance-monitor, etc.)
     - Sonnet 4.6: balanced default for code work, swarm coordination,
       github automation, day-to-day analysis (coder, tester, reviewer,
       all -coordinator/-manager swarm pieces, pr-manager, repo-architect,
       SPARC stages spec/pseudo/refinement, etc.)
     - Opus 4.7: deep reasoning, architecture, security, novel design,
       complex consensus (system-architect, security-architect,
       security-auditor, byzantine-coordinator, raft-manager,
       crdt-synchronizer, ddd-domain-expert, sparc-orchestrator, queen-
       coordinator, injection-analyst, safla-neural, etc.)

   New ``apply_suggested_defaults(overwrite=False)`` writes the map to
   ``delegation.model_by_role`` in one shot. Default mode preserves any
   existing user-customised pins; ``overwrite=True`` clobbers them.

   New slash command forms:
     /delegation defaults            Apply curated defaults (preserve pins)
     /delegation defaults --force    Apply, overwriting existing pins

   Tests: 5 new tests in test_ruflo_agents.py covering empty-fill, pin-
   preservation, force-overwrite, idempotence, and a sanity check that
   every suggested model is one of the three curated choices.

   145/145 tests pass (was 140 before — added 5 new + no regressions).

Upstream catch-up: 1,239 commits merged; only the 9 fork-patched files
conflicted. Resolutions (see docs/LOCAL_PATCHES.md for each patch):

- pyproject.toml: kept CVE pins (aiohttp 3.13.4, anthropic 0.87.0,
  cryptography 46.0.7); adopted upstream pytest-timeout, dropped xdist.
- run_agent.py: upstream split it into thin forwarders + new agent/* modules.
  Re-homed AgentFeeds (NousResearch#9) -- helpers stay in run_agent.py; manifest wiring
  into agent/system_prompt.build_system_prompt_parts (lazy import, monkeypatch
  -safe); config init in agent/agent_init.py. Re-homed origin request_id (NousResearch#1)
  into agent/agent_runtime_helpers + agent/tool_executor.
- hermes_cli/kanban_db.py: ported our crash diagnostics (provider_failure,
  failure_diagnostics) onto upstream's dict crash_details + layered upstream
  error-fingerprinting/systemic detection; unioned forced-skill machinery
  (NousResearch#5/NousResearch#11) with upstream has_spawnable_review/scratch-tip/accept-hooks/
  model_override.
- gateway/run.py: re-homed timestamp prefix (NousResearch#8) into _build_gateway_agent_
  history; combined notify-interval + heartbeat (kept public-progress cadence,
  added upstream edit-in-place heartbeat msg id).
- tests: took upstream conversation_loop refactor + new board= suite; unioned
  fixture env-isolation; added CRASH_GRACE_SECONDS=0 to worker_env fixture.

Merge-touched suites green (851 passed). Remaining full-suite failures are
pre-existing/environmental (macOS services, optional deps).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Baseline is now caught up to upstream/main @ 2d5dcfa (merge 4a9607a).
Update re-homed patch locations after upstream's agent/* refactor:
- NousResearch#1 request_id plumbing -> agent/tool_executor.py + agent/agent_runtime_helpers.py
- NousResearch#8 timestamp prefix -> applied in gateway/run.py::_build_gateway_agent_history
- NousResearch#9 AgentFeeds wiring -> agent/system_prompt.py + config init agent/agent_init.py
  (helpers stay in run_agent.py)
Note test infra moved to pytest-timeout (xdist dropped).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

…ll-authoring docs

The background-review curator (model=flash/9b) was looping on
skill_manage(action='write_file') with content like:

    description: Handling cold case research: questioning assumptions

The second colon inside the unquoted value breaks YAML parsing ("mapping
values are not allowed here").  The generic parser error didn't tell the
9b how to fix it, so it retried with the same malformed YAML repeatedly,
burning iteration budget.

Two changes:

  1. tools/skill_manager_tool.py — when yaml.safe_load fails with the
     "mapping values are not allowed here" signature, walk the YAML text
     line-by-line, find the first unquoted scalar value containing a
     colon, and append a "Likely cause: …" hint showing the exact
     quoted form the caller should retry with.  Same hint covers the
     adjacent indicators (#, &, *, !, |, >, ', ", `).  Generic
     YAMLError messages without that signature are unchanged.

  2. skills/software-development/hermes-agent-skill-authoring/SKILL.md
     gains a Common Pitfalls item NousResearch#8 covering the same case, with the
     quoted-form recipe and a note about the block-scalar `description: |`
     alternative.  This is the canonical "how to author skills" skill;
     anyone (curator fork or interactive agent) reading it will see the
     guidance up front.

Verified end-to-end: feeding the failing content through
_validate_frontmatter now produces "Likely cause: the value for
\`description\` contains an unquoted colon. Wrap the value in single
quotes: description: 'Handling cold case research: questioning
assumptions'" in addition to the original parser message.

Production note: change staged on wpu-lcm-plugin but pod not rolled —
Aina has active conversations (Simon DM + Patrik group) that must not
be interrupted.  Effect lands on next scheduled roll.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* ci(nix): auto-fix stale npm hashes on push to main

When a PR merges to main with updated package-lock.json or package.json
in ui-tui/ or web/, the new auto-fix-main job detects stale npmDepsHash
values and pushes a fix commit directly to main.

This eliminates the recurring manual hash-bump PRs (NousResearch#15420, NousResearch#15314,
NousResearch#15272, NousResearch#15244) by reusing the existing fix-lockfiles --apply pipeline.

The fix commit only touches nix/*.nix files, which are outside the push
path filter (package-lock.json / package.json), so it cannot re-trigger
itself.

Closes NousResearch#15314

* fix(ci): use GitHub App token for auto-fix-main push

GITHUB_TOKEN commits are invisible to workflow triggers (GitHub's
infinite-loop prevention). The auto-fix-main job pushes directly to
main, so the fix commit never triggered downstream nix.yml verification.

Mint a short-lived token via the repo's GitHub App (daimon-nous, APP_ID
+ APP_PRIVATE_KEY secrets) so the push is treated as a real event and
nix.yml fires to verify the corrected hashes.

Tested via workflow_dispatch dry-run: app token minted successfully,
checkout with app token succeeded, fix job correctly gated.

Resolves review feedback from Bugbot (r3144569551).

* ci(nix): rename lockfile check job for required status check

Rename 'check' → 'nix-lockfile-check' so the status check name is
unambiguous when added as a required check on main.

* fix(ci): harden auto-fix-main against races, loops, and silent failures

Address adversarial review findings:

1. Race condition (NousResearch#1): Job-level concurrency with cancel-in-progress
   collapses back-to-back pushes; ref: main checkout always gets latest
   branch state; explicit push target (origin HEAD:main).

2. Loop prevention (NousResearch#2): File-whitelist check before commit aborts if
   any file outside nix/{tui,web}.nix was modified, preventing
   accidental self-triggering.

3. Silent infra failures (NousResearch#8): nix-lockfile-check now fails explicitly
   when fix-lockfiles exits without reporting stale status (catches nix
   setup failures, network errors, script bugs that bypass continue-on-error).

4. Commit traceability (NousResearch#11): Auto-fix commits include source SHA and
   workflow run URL in the commit body.

5. Explicit push target (NousResearch#12): git push origin HEAD:main instead of
   bare git push.

---------

Co-authored-by: alt-glitch <alt-glitch@users.noreply.github.com>

…rs, CRLF, dry_run)

## Fixes

1. **Strict errors are no longer swallowed by line-count mismatches** (NousResearch#4)
   Previously, a patch with both a bare line AND a count mismatch would
   only report the count mismatch, hiding the root cause. Now strict
   errors are checked FIRST.

2. **Strict error messages include the hunk body line number** (#4b)
   New `hunk_body_line` tracker (resets per hunk) makes the offending
   line pinpointable. Example:
     old: 'hunk 1 has a bare line "line3"'
     new: 'hunk 1 line 3 is a bare line "line3"'

3. **CRLF/CR line endings are normalized before parsing** (NousResearch#6)
   `patch_content.replace('\r\n', '\n').replace('\r', '\n')` runs
   before split. Fixes context-mismatch failures on Windows-generated
   patches or git configs with `core.autocrlf=true`. `\r\n` must
   be replaced before `\r` to avoid double-replacement.

4. **New `dry_run` parameter for pre-apply preview** (NousResearch#8)
   Parses the patch and runs ALL path safety checks (traversal,
   sensitive, cross-profile) but does NOT take locks, does NOT check
   staleness, does NOT write files, does NOT update read timestamps.
   Returns the would-be diff in the result JSON with `_dry_run: true`
   and empty `files_modified/created/deleted`. Useful for hand-written
   diffs to verify hunks before committing — analogous to `git apply --check`.
   Implemented as a separate read-only path (not via _apply_file_patch,
   which writes via file_ops.write_file internally).

## Tests

- 5 original tests pass (no regression)
- 7 new tests added covering all 4 fixes:
  - test_strict_error_takes_precedence_over_count_mismatch
  - test_strict_error_includes_body_line_number
  - test_crlf_line_endings_normalized
  - test_cr_only_line_endings_normalized
  - test_dry_run_does_not_modify_file
  - test_dry_run_reports_context_mismatch_without_writing
  - test_dry_run_real_apply_actually_writes

Full tests/tools/ suite: 114 passed, 1 pre-existing failure unrelated
(test_approval.py find -exec vs -delete).

HS invokes `claude -p` as a subprocess for review. The current
`--tools '' --max-turns 1` config only fits plan/architecture review —
using it for code review is a blind spot, since cc judges HS's summary
instead of the real code. Add §3c: a two-tier table (plan review vs
code review with read-only tools), the reviewer-stays-read-only rule,
and pitfall NousResearch#8.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

问题: run_agent.py 第15236行调用 has_incomplete_scratchpad()，但第194-197行
     import from agent.trajectory 中漏掉了该函数，只导入了
     convert_scratchpad_to_think 和 save_trajectory。
     导致运行时 NameError: name 'has_incomplete_scratchpad' is not defined。

修复: 在 import 语句中添加 has_incomplete_scratchpad 导入。

边界: conversation_loop.py（第66行）已正确导入同一函数，无需修改。

测试: git diff 确认仅新增一行导入；函数签名(content: str)与调用方
     (assistant_message.content or '') 类型匹配。

引用: Albert 报告 'Error during OpenAI-compatible API call NousResearch#8'