- 新增 agent/token_juice.py（137行），对标 OpenHuman TokenJuice
  Gate 1: 短输出直通 (<240 chars)
  Gate 2: 文件查看命令不压缩 (cat/tail/head/bat)
  Gate 3: 无效摘要丢弃 (压缩比 >= 95% 则拒绝)
- hermes_constants.py: 添加 TokenJuice 常量
- context_compressor.py: 在工具输出修剪和对话摘要两处集成安全阀

- model_metadata.py: 新增 MODEL_COST_PER_1K 价格表（10个主流模型）
  + get_model_cost_tier() 三级分档 (light/medium/heavy)
  + resolve_model_by_cost_tier() 按档位自动选模型
- auxiliary_client.py: 新增 get_cheapest_available_model(tier)
- delegate_tool.py: 子 agent 创建时支持 cost_tier 自动路由
  当 profile 设了 cost_tier 但未指定 model 时，自动选最便宜模型

- 新增 plugins/memory/fts5_builtin/ 插件（~250行，零依赖）
- store.py: SQLite + FTS5 虚拟表 + 自动同步触发器
- __init__.py: FTS5BuiltinProvider 实现 MemoryProvider 接口
  3 个工具: fts5_add / fts5_search / fts5_list
  prefetch() 走 user message 注入路径（保护 prefix cache）
- 配置: memory.provider: fts5_builtin

…tests

- token_juice: add absolute/relative floor checks in compression_safe_to_apply
- fts5_builtin: add on_memory_write mirror, UNIQUE constraint, WAL mode, limit clamping
- tests: add Gate3 regression, model cost-tier routing, fts5 provider tests
- assets: add screenshots, search configs, and worldcup snapshot

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

… entrypoints

- DiscordEntryAdapter: normalizes Discord message payloads into EntryEvent
- Maps: guild->source, category->workspace, channel->session, thread->sub-session
- Bot/self-message rejection, intent detection (mention/command)
- Health reporting: configured/unconfigured
- Full isolation: adapter does not call agents/routes/policy directly
- 39 tests covering registration, normalization, mapping, rejection,
  unsupported entrypoints, adapter isolation, health, intent, pipeline
- Adds docs/known-issues/mcp-tooling-infra-test-failures.md for
  pre-existing infrastructure test debt classification

- FeishuEntryAdapter: normalizes Feishu inbound payloads into EntryEvent
- Maps: tenant_id -> workspace, chat_id -> session, thread_id -> sub-session
- Preserves existing Feishu transport (gateway/platforms/feishu.py untouched)
- Session_key support for backward compatibility with existing session model
- Intent detection: command (/) and mention (@)
- Health reporting: configured/unconfigured based on app_id
- 41 tests covering registration, normalization, mapping, rejection,
  unsupported entrypoints, adapter isolation, health, intent, pipeline
- Audit doc: docs/audits/feishu-source-of-truth-audit.md

- FeishuSessionBindingBridge: sidecar module that records Feishu session
  bindings without affecting existing message flow
- Hooked into FeishuAdapter._process_inbound_message() after session_key
  is built but before _dispatch_inbound_event()
- Uses FeishuEntryAdapter (Phase 5A) to normalize SessionSource into EntryEvent
- Writes to SessionBinding store (Phase 1) with key=feishu:{chat_id}:{thread_id}
- Fully isolated: failures are caught and logged, main flow continues
- Preserves all existing behavior: SessionStore, dispatch, transport untouched
- 9 tests covering happy path, thread/no-thread, idempotency, graceful
  failure, workspace derivation, lookup round-trip, fallback, no side effects

…teractive session cards

Phase 5B implementation:

- feishu_session_resolver.py: Full resolution chain
  (card > alias > p2p > thread > group > ambiguity > default)
  with FEISHU_AMBIGUITY_CARD_ENABLED feature flag (default: false)

- feishu_session_cards.py: Interactive card JSON builder for
  session selection, acknowledgement, and rejection cards

- FeishuEntryAdapter.resolve_session_with_ambiguity(): Delegates
  to resolver for full priority chain resolution

- session_binding.py: SessionBindingValue dataclass with source
  tracking (card/thread/alias/default), backward-compatible read
  of old 2-tuple format, BindingSource literal type

- feishu_session_binding_bridge.py: Extended with
  resolve_feishu_session_from_source(), check_feishu_ambiguity(),
  build_session_selection_card(), handle_select_session_card_action()

Tests: 177 v2.10 scoped tests pass (28 resolver + 17 binding +
21 bridge + 41 feishu adapter + 36 discord + 14 entry + 20 workspace/session)

Phase 5C implementation:

- feishu_permission_gate.py: Two-layer access control model
  (global allowlist + per-group policy: open/allowlist/blacklist/admin_only/disabled)
  Advisory only — does not modify routing or policy execution.
  Includes from_env() builder, check() method, health() snapshot.

- feishu.py: Add select_session card action handler (~8 lines)
  When a user taps a session selection card button, the action is
  dispatched to handle_select_session_card_action() from the bridge.

- Tests: 23 permission gate tests, 200 v2.10 scoped total

…lthCard, V210WorkspaceContext

- Add 5 backend API endpoints: workspaces list/get, sessions list/get, adapters/health
- Add v2.10 TypeScript types and API methods in api.ts
- Add AdapterHealthCard component to OperationsPage
- Add V210WorkspaceContext component to SessionsPage
- Add 12 backend API tests
- Add Phase 6 plan doc

Backend: 212 v2.10 scoped tests pass
Frontend: zero errors build

Phase 7 design doc for Mac App as lightweight desktop shell:
- WKWebView wrapping Web Console at localhost:9119
- Process lifecycle management
- macOS notification bridge
- mac_app EntryAdapter registration
- No code — design documentation only

Gate checks:
- Working tree clean, branch codex/merge-8787-capabilities-into-9119
- 212 v2.10 scoped tests passing, 0 failures
- Frontend build clean (TypeScript + Vite)
- Feishu transport: 9-line sidecar, feature-flagged
- No silent fallbacks, no ambiguities in disabled state
- All non-capabilities explicitly documented

Recommended tag: v2.10-multi-entry-session-binding

- Tag: v2.10-multi-entry-session-binding (858af63)
- 6 phases implemented, 212 tests passing
- Deferred: Lark CLI tooling, streaming cards, approvals, Discord prod, Mac App
- Recommended next: v2.11 Feishu Operation Layer

Six sections covering:
- A: Web Console (AdapterHealthCard, V210WorkspaceContext, API endpoints)
- B: Feishu understandability (entry adapter, resolver, ambiguity, permission gate)
- C: Discord dormant status verification
- D: Release boundaries (Lark CLI, streaming, approvals — none present)
- E: Observations log
- F: Go/No-Go for v2.11

All checks manual, no code changes required.

…d, V210WorkspaceContext

- Add operations + v210 i18n keys to types.ts, en.ts, zh.ts
- Translate key OperationsPage labels: title, agent health, queue, advisory
- Translate AdapterHealthCard: status labels, mode descriptions
- Translate V210WorkspaceContext: mode, workspaces, sessions, adapters
- Entrypoint labels in AdapterHealthCard now show in Chinese (飞书, CLI, etc.)
- All v2.10 components use i18n with fallback to English
- operations + v210 fields are optional in type (non-en/non-zh unchanged)

Frontend build: zero errors. Backend tests: 12 passed.

Bug fixes:
- setTitle('Operations') → setTitle(t.operations?.title ?? ...) with t dependency
- H1 header uses i18n (Agent 运营中心)
- Section labels use i18n (Agent 健康, 队列与调度)
- Badge labels use i18n (仅作参考, 仅作建议)

Fixed: original variable rename corrupted UI text strings (Some operations data).
This version only changes display labels, never touches variable names.

Build: successful. Tests: 12/12 passed.

…tract

browser-host/: new Electron child-process (status/start/stop + snapshot/screenshot/context proxies) — Phase 2B + 2C

plugins/browser-workspace/dashboard/: Codex-like sidebar tab (manifest + bundled dist/index.js) — Phase 4 entry point

hermes_cli/web_server.py: expose /api/browser-host/{status,start,stop,snapshot,screenshot,context} and read-only HTTP proxy to the host on localhost — Phase 2B/2C

web/src/pages/ChatPage.tsx: window.__HERMES_INSERT_CHAT_TEXT__ (term.paste path) + window.__HERMES_SET_BROWSER_CONTEXT_REF__ (metadata only — no DOM/selection/clipboard) — Phase 4A/4B

Out of scope: Kanban review/qa CLI + diff events; Codex-like embedded-chat nav reshuffle; ToolCall selected ring; ChatSidebar structured preview parser; executors/ module; dashboard screenshots.

Add review/qa CLI subcommands, emit diff events after dispatch, and publish diff/review/qa task events to the dashboard WebSocket stream.

Includes focused CLI tests for dispatch diff recording and review/QA result events.

Parse diff, review, QA, and artifact payloads from tool events and render them in a dedicated ChatSidebar detail panel.

Add ToolCall onClick/selected props for activity-list selection and highlight state, with graceful fallback for unparseable results.

Redirect root and unknown routes to /chat when embedded chat mode is enabled, slim the sidebar nav for chat-first usage, and add Config diagnostics links for hidden dashboard pages.

Add the core executor types, registry, router, and health helpers behind a core-safe package API that does not import adapter implementations.

Add router and registry tests covering keyword recommendations, fallback behavior, default manifests, and missing-binary health checks without invoking live models.

Add Hermes Local, Claude Code, Codex, OpenCode, and DeepSeek TUI executor adapters implementing the AgentExecutorAdapter protocol.

CLI adapters use asyncio subprocess array calls without shell=True; Hermes Local restores cwd with try/finally; DeepSeek TUI remains an explicit unavailable stub.

Add adapter registry tests covering imports, missing-binary health checks, inert imports, and no live CLI/model/worktree side effects.

Add project-scoped workspace context, inbox persistence, and per-executor prompt building utilities.

These tools write only to caller-supplied project .hermes files and do not invoke subprocesses, models, git, or external services.

Add tests covering JSON round trips, default loading, prompt generation, inbox lifecycle, and side-effect boundaries.

Add worktree lifecycle utilities and CLI helpers with dirty-tree rejection and confirmation gates for destructive merge/discard operations.

Fix the clean-working-tree preflight check so user dirty files reject worktree creation while .hermes infrastructure files are ignored as intended.

Add worktree tests covering dirty rejection, infra filtering, merge/discard confirmation, and tmp-repo-only git operations.

Add IPC dataclasses, review/QA prompt parsing primitives, and a fixture-driven bridge CLI simulation layer without importing the real review handler.

Keep D1a read-only and subprocess-free; bridge CLI uses local stubs for review/QA simulation while D1b decides the real review backend boundary.

Fix diff deletion parsing so file header lines are not counted as deletions.

Adds the executors/IPC rail for review and QA, parallel to the existing
hermes_cli.kanban_feedback trigger_* path. The two rails target different
consumers (Kanban SQLite vs. Electron IPC) and are NOT interchangeable.

- executors/review_handler.py: trigger_review_ipc / trigger_qa_ipc async
  wrappers around _launch_opencode, with shutil.which gate, OpencodeUnavailable
  exception, emit_diff_event side-channel, and stub_review_report / stub_qa_report
  fallback when opencode is absent. Module docstring documents the dual-rail
  architecture to prevent confusion with kanban_feedback.trigger_*.
- executors/review_cli.py: 6 subcommand handlers (build-prompt / parse /
  executor for both review and QA) + handle_review_command / handle_qa_command
  dispatchers. SEVERITY_ICONS map for human-readable output.
- tests/executors/test_review_handler.py: 582 lines, 9 test classes
  covering rename verification, IPC happy paths, fallback paths, subprocess
  invocation, side-channel events, stub reports, exception handling, and
  boundary guards (no kanban_feedback, no executors.cli, no executors.bridge,
  no sqlite3 imports, no real opencode invocation).
- tests/executors/test_review_cli.py: 443 lines, 9 test classes covering
  all 6 subcommand handlers, dispatchers, SEVERITY_ICONS lookup, and
  parallel boundary guards.

The rename trigger_* -> trigger_*_ipc was required to disambiguate from
hermes_cli.kanban_feedback.trigger_* which writes to the Kanban SQLite
task_events table. Both are live in parallel; callers pick the rail
appropriate to their consumer (CLI vs. Electron IPC).

70 new tests; full executors suite: 415 passing (was 345).

Add the argparse-based executor CLI entry point wiring registry, health, routing, worktree, context, review, QA, inbox, and bridge subcommands.

Preserve destructive operation gates by delegating worktree actions to the guarded C2 handlers, and keep imports free of hermes_cli or live external CLI side effects.

Add CLI tests covering registry commands, delegation, help output, missing binaries, import side effects, and boundary guards.