…d-base-url

fix: update MiniMax/Z.AI model lists, pass base_url to AIAgent

- 6 built-in templates: Code Review, Bug Fix, Feature Build, Research, Refactor, Security Audit
- Template picker modal with search, built-in/custom sections
- 'Use Template' button in New Mission wizard (step 0)
- Auto-populates name, goal, and task list from template
- 'Save as Template' button in mission completion report
- Custom templates stored in localStorage, deletable
- workflow-templates.ts with full CRUD operations

… exec cmd:' log lines' (NousResearch#9) from fix/docker-exec-log-mask-rotating-creds into main

Captures Tier 3 tooling work that was considered during the 2026-04-26
overhaul but deferred. Each section explains the design, why it wasn't
shipped, and the trigger condition that should reopen it.

Tier 3 items deferred:
  NousResearch#7  Lazy MCP discovery — high refactor surface, low immediate value
      (gateway RAM/startup not currently constrained).
  NousResearch#8  Health-aware tool router — overlaps with already-shipped manual
      fallback (Tavily→DDG/httpx); marginal gain doesn't justify
      scaffolding.
  NousResearch#10 Batch tool API — concurrent path + within-turn dedup cache already
      mitigate the common case; would be disruptive.

Each section includes a reference design so future work can pick up
without re-deriving rationale, plus a "reopen when..." condition tied
to observable signals (memory > 4GB, fallback rate > 30%, etc.) so the
weekly health check (or operator) can flag when revisit is justified.

Tier 3 NousResearch#9 (LLM-summarize large results) was shipped in 9b3cef1.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Add logging for first 100 chars of the tool call args json / tool response

Wraps the new POST /api/ad-hoc/quick-post endpoint on the publisher
(merged in hermes-social-media PR #9). Lets Jonathan DM Hermes photos
+ a description, and Hermes posts the bundle directly: media uploads to
Dropbox, caption.md gets written, Telegram approval DM lands within
seconds. Tap Approve → publishes to IG + TikTok.

- QuickPostRequest / QuickPostResponse in publisher_types.py mirror the
  publisher's Zod schema (regex on brand/angle/cta segments, min/max on
  media_urls)
- publisher_quick_post tool in publisher_tools.py with a docstring that
  explains when the agent should reach for it
- 4 new tests cover registration + validation + happy path

Uses the existing PUBLISHER_BASE_URL + PUBLISHER_API_KEY env vars — no
new config required.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Add logging for first 100 chars of the tool call args json / tool response

- #1: Semantic repair log now records each transformation step, not just final rule
- #2: Eliminated double-repair in concurrent execution path
- #3: log_tool_input_repaired now called from production code paths
- #4: _repair_check_path_traversal replaced pass with logger.warning
- #5: _repair_fix_double_escape corrected: 2 backslashes → 1 (was 4→2)
- #6: Fixed malformed backtick in coerce_tool_args docstring
- #7: Registered _repair_strip_shell_prompt in _SEMANTIC_REPAIR_MAP
- #8: Removed dead code in tests (empty patch.dict, unused MagicMock)
- #9: Tightened ambiguous test assertion for required null fields
- NousResearch#10: Added logger.warning for silent exception swallowing
- NousResearch#11: Added EVENT_TOOL_INPUT_REPAIRED to REQUIRED_PAYLOAD_KEYS
- NousResearch#12: Added 7 new edge case tests (multi-rule log, unicode, idempotency)
Total: 39 tests passing

Upstream catch-up: 1,239 commits merged; only the 9 fork-patched files
conflicted. Resolutions (see docs/LOCAL_PATCHES.md for each patch):

- pyproject.toml: kept CVE pins (aiohttp 3.13.4, anthropic 0.87.0,
  cryptography 46.0.7); adopted upstream pytest-timeout, dropped xdist.
- run_agent.py: upstream split it into thin forwarders + new agent/* modules.
  Re-homed AgentFeeds (NousResearch#9) -- helpers stay in run_agent.py; manifest wiring
  into agent/system_prompt.build_system_prompt_parts (lazy import, monkeypatch
  -safe); config init in agent/agent_init.py. Re-homed origin request_id (NousResearch#1)
  into agent/agent_runtime_helpers + agent/tool_executor.
- hermes_cli/kanban_db.py: ported our crash diagnostics (provider_failure,
  failure_diagnostics) onto upstream's dict crash_details + layered upstream
  error-fingerprinting/systemic detection; unioned forced-skill machinery
  (NousResearch#5/NousResearch#11) with upstream has_spawnable_review/scratch-tip/accept-hooks/
  model_override.
- gateway/run.py: re-homed timestamp prefix (NousResearch#8) into _build_gateway_agent_
  history; combined notify-interval + heartbeat (kept public-progress cadence,
  added upstream edit-in-place heartbeat msg id).
- tests: took upstream conversation_loop refactor + new board= suite; unioned
  fixture env-isolation; added CRASH_GRACE_SECONDS=0 to worker_env fixture.

Merge-touched suites green (851 passed). Remaining full-suite failures are
pre-existing/environmental (macOS services, optional deps).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Baseline is now caught up to upstream/main @ 2d5dcfa (merge 4a9607a).
Update re-homed patch locations after upstream's agent/* refactor:
- NousResearch#1 request_id plumbing -> agent/tool_executor.py + agent/agent_runtime_helpers.py
- NousResearch#8 timestamp prefix -> applied in gateway/run.py::_build_gateway_agent_history
- NousResearch#9 AgentFeeds wiring -> agent/system_prompt.py + config init agent/agent_init.py
  (helpers stay in run_agent.py)
Note test infra moved to pytest-timeout (xdist dropped).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Low/zero-drift wiring slice of Paket B (from sync-20260526):
- status.write_runtime_status gains platform_health + token_usage kwargs
  with HUB pressure classification (current_*_pct accessors).
- platforms/base auto-attaches runtime_health() via duck-typing.
- oneshot fallback chain runs through filter_default_gateway_fallbacks.
- display_config: HUB-aware Discord defaults (_HUB_DISCORD_DEFAULTS,
  preview_length=40 per Review-Finding #9) as resolver step 3b.

test_display_config 3-way merged: kept main's mobile-first Telegram
"off" defaults, added the HUB-layer tests, pinned test_high_tier_platforms
to a non-HUB home.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Match the other sandbox backends' per-init filesystem isolation. Docker
stamps a fresh 'hermes-<uuid>' container name on every _init (docker.py:508),
so a destroyed-then-recreated env always sees a brand-new filesystem.

Gondolin's sandbox_dir is deterministic from task_id, and _setup_overlay_mounts
keeps the scratch dir (overlays/<safe>/{upper,work,merged}) on disk across env
lifecycles. The next env that mounts the same guest_path under the same
sandbox_dir inherits the prior session's writes via the persisted upper layer
— a real cross-session contamination bug, not just a disk leak.

Fix: _teardown_overlay_mounts now rmtrees the per-mount scratch dir
(merged.parent) after the lazy unmount returns. Lazy unmount + open-fd-keeps-
inode-alive means this is safe even if the daemon hasn't fully released
handles. Crash recovery still preserves upper/ because the import-time
sweep only unmounts and never rmtrees.

This also closes design-doc revisit item NousResearch#9 (failed-init cleanup).

Test:
  tests/integration/test_gondolin_terminal.py::test_overlay_writes_do_not_leak_
  between_env_lifecycles

A KVM-gated integration test that asserts the behavioural invariant via
the public GondolinEnvironment.execute() API: env1 writes a file into an
overlay extra_mount, env2 (same sandbox_dir, same mount config) must not
see it. Implementation-agnostic — no mention of upper/ or fuse-overlayfs —
so a future migration to a custom upstream VFSProvider (the @earendil-works/
gondolin package ships vfs/provider) satisfies the same contract trivially
and the test passes for free.

Doc updates (DO NOT MERGE revisit list):
  - NousResearch#9 marked resolved (this fix)
  - NousResearch#6 narrowed: lists the one test we now have and what's still missing
  - NousResearch#10 added: task_id='default' is shared across all top-level agents at
    the hermes/gateway layer; concurrent-tenancy isolation needs a
    per-session task_id and is out of scope for this branch
  - NousResearch#11 added: overlay=true + missing readonly is a silent UX trap
    (host-side scratch is created, daemon makes guest mount EROFS)

Regression: all 118 gondolin unit + integration tests pass.

DO NOT MERGE — see docs/design/gondolin-terminal-backend.md.

…e removal, LOOP target warnings

NousResearch#8: Card ID parsing uses regex 'Created\s+card\s+(\S+)' with fallback
NousResearch#9: validate checks gate→revision pairs (referenced gates must have dependents)
NousResearch#10: _find_revision_node documented single-revision assumption
NousResearch#11: LOOP target mismatch warns before fallback
NousResearch#12: Removed unused _find_dependents
NousResearch#7: 32 unit tests — DAG, cycles, LOOP regex, failure propagation, state persistence, validation, card parsing

Resolutions:
- gateway/run.py: take upstream. Our cherry-picked topic-binding patch
  (_refresh_telegram_topic_binding_after_session_switch, for NousResearch#20470) is now
  subsumed by upstream _sync_telegram_topic_binding (NousResearch#20470/NousResearch#29712/NousResearch#33414).
- Dockerfile: merge PATH — keep upstream /opt/hermes/bin privilege-drop shim
  ahead of venv, keep fork /opt/tools persistent-tools volume + pipx/gobin/cargo.
- tests/agent/transports/test_chat_completions.py: keep both (fork codex-ack
  test + upstream extra_content tests).
Brings upstream PR NousResearch#33481 (HOME=/opt/data for s6 gateway services) — closes the
local NousResearch#9 workaround.

Record PR NousResearch#9, Vercel production deployment, Upstash result handoff verification, and the current Slack provider 429 blocker.

Verified: scripts/run_tests.sh tests/hermes_cli/test_elixir_analytics_profile_distribution.py tests/hermes_cli/test_elixir_analytics_runner_plugin.py tests/hermes_cli/test_elixir_analytics_release_packaging.py tests/test_toolsets.py tests/gateway/test_slack.py -- -q

Two new scrapers from scraper-suite PR NousResearch#9 — Jefferson County Sheriff
Foreclosure Sales (JCSD JSON endpoint) and Annual Land Tax Sale
(Collector PDF). Cadence is daily on the mini (launchd plists at 05:45
and 06:00 respectively); 36h tolerance matches the STL Sheriff sibling.

Both scrapers carry meaningful steady-state empty payloads (no active
foreclosure auctions; between annual vintages) → success-with-records=0
is the expected most-days result. Heartbeat alerts only on a real
overdue, not on "no data."

Atlas count bumped 6 → 8.

NousResearch#4 — agent/orchestrator.py: requires_upstream_success=False stranded
     PENDING forever when an upstream failed.  The promotion logic
     only checked all-SUCCEEDED for READY and only the spec.requires
     branch for SKIPPED, leaving cleanup-style tasks in PENDING with
     no path out.  Fix promotes them to READY once every dep
     reaches a terminal state (SUCCEEDED / FAILED / SKIPPED), so
     they actually run.  Existing test_requires_upstream_success_
     false_still_runs (which previously documented the bug) flipped
     to assert correct behaviour + new test
     test_requires_upstream_success_false_waits_for_terminal_state
     locks in the wait-for-all-deps semantics.

NousResearch#5 — agent/audit_log.py: _CHAIN_STATE per-process cache forked the
     hash chain when two processes wrote the same audit.jsonl.
     Fix takes an OS-level fcntl flock around the entire read-tail
     + append critical section AND always re-reads the tail under
     the flock (cache invalidated per-write) — cross-process
     correctness over in-process micro-perf.  Falls back to in-
     process-only on platforms without fcntl (Windows native).

NousResearch#6 — agent/bus.py: publish_lesson_captured hard-coded
     subject="lesson.captured" (with a useless f-prefix), so
     pattern subscribers like 'lesson.*.captured' never matched.
     Fix: derive the middle segment from the lesson's filename
     stem (or a uuid fallback) so subjects look like
     'lesson.add-oauth-login-20260516-1432.captured' — pattern
     matching works, history queries discriminate by lesson, and
     the hierarchical-subject convention documented in the module
     header is honored.

NousResearch#7 — agent/plan_mode.py: refusal_for used str.format with the
     plan_path interpolated, so a path containing '{...}' (legal
     on Linux, common in worktree templates) raised KeyError
     instead of returning the refusal message.  Fix: str.replace
     with no second-pass field-resolution — works for any path
     including ones with curly braces.

NousResearch#8 — cli.py: buf.get("task", message[:120]) eagerly evaluated the
     default; if message was None on a non-interactive code path,
     TypeError propagated into the wrapping try/except and the
     lesson was silently lost.  Fix: compute the fallback string
     once with isinstance guard, then use buf.get("task") or
     fallback.

NousResearch#9 — agent/skill_promotion.py: `threshold = threshold or _int_config(...)`
     in both find_skill_candidates and find_profile_candidates_
     from_usage discarded explicit caller values of 0 — tests
     and operators couldn't disable the gates by passing 0.  Fix:
     `if threshold is None: threshold = _int_config(...)` so 0
     is preserved.

Plus a deferred fix to NousResearch#14 (verifier post-/exit-plan): added a
transient `executing_plan` flag on PlanModeState that exit() sets
and the CLI's VERIFIED branch clears.  Verifier auto_when_plan
now fires only while plan_mode is active OR the plan is actively
executing — not for unrelated chat turns after the plan converges.

274 tests pass.  No regressions.

https://claude.ai/code/session_01PNyEMgrzVHtXnPGwUfotWw