chore: uptick

tests/acp/test_server.py

@@ -730,6 +730,7 @@ class TestSlashCommands:
         ]
         state.agent.compression_enabled = True
         state.agent._cached_system_prompt = "system"
+        state.agent.tools = None
         original_session_db = object()
         state.agent._session_db = original_session_db
 
@@ -746,7 +747,7 @@ class TestSlashCommands:
         with (
             patch.object(agent.session_manager, "save_session") as mock_save,
             patch(
-                "agent.model_metadata.estimate_messages_tokens_rough",
+                "agent.model_metadata.estimate_request_tokens_rough",
                 side_effect=[40, 12],
             ),
         ):

tests/acp/test_session.py

@@ -8,6 +8,7 @@ from types import SimpleNamespace
 import pytest
 from unittest.mock import MagicMock, patch
 
+from acp_adapter import session as acp_session
 from acp_adapter.session import SessionManager, SessionState
 from hermes_state import SessionDB
 
@@ -42,6 +43,27 @@ class TestCreateSession:
         state = manager.create_session(cwd="/tmp/work")
         assert calls == [(state.session_id, "/tmp/work")]
 
+
+    def test_register_task_cwd_translates_windows_drive_for_wsl_tools(self, monkeypatch):
+        captured = {}
+
+        def fake_register_task_env_overrides(task_id, overrides):
+            captured["task_id"] = task_id
+            captured["overrides"] = overrides
+
+        monkeypatch.setattr("hermes_constants._wsl_detected", True)
+        monkeypatch.setattr(
+            "tools.terminal_tool.register_task_env_overrides",
+            fake_register_task_env_overrides,
+        )
+
+        acp_session._register_task_cwd("session-1", r"E:\Projects\AI\paperclip")
+
+        assert captured == {
+            "task_id": "session-1",
+            "overrides": {"cwd": "/mnt/e/Projects/AI/paperclip"},
+        }
+
     def test_session_ids_are_unique(self, manager):
         s1 = manager.create_session()
         s2 = manager.create_session()
@@ -56,6 +78,59 @@ class TestCreateSession:
         assert manager.get_session("does-not-exist") is None
 
 
+
+
+# ---------------------------------------------------------------------------
+# WSL cwd translation
+# ---------------------------------------------------------------------------
+
+
+class TestWslCwdTranslation:
+    def test_translate_acp_cwd_converts_windows_drive_path_when_wsl(self, monkeypatch):
+        monkeypatch.setattr("hermes_constants._wsl_detected", True)
+
+        assert acp_session._translate_acp_cwd(r"E:\Projects\AI\paperclip") == "/mnt/e/Projects/AI/paperclip"
+
+    def test_translate_acp_cwd_handles_forward_slashes_when_wsl(self, monkeypatch):
+        monkeypatch.setattr("hermes_constants._wsl_detected", True)
+
+        assert acp_session._translate_acp_cwd("D:/work/project") == "/mnt/d/work/project"
+
+    def test_translate_acp_cwd_leaves_windows_drive_path_unchanged_off_wsl(self, monkeypatch):
+        monkeypatch.setattr("hermes_constants._wsl_detected", False)
+
+        assert acp_session._translate_acp_cwd(r"E:\Projects\AI\paperclip") == r"E:\Projects\AI\paperclip"
+
+    def test_translate_acp_cwd_leaves_posix_path_unchanged_on_wsl(self, monkeypatch):
+        monkeypatch.setattr("hermes_constants._wsl_detected", True)
+
+        assert acp_session._translate_acp_cwd("/mnt/e/Projects/AI/paperclip") == "/mnt/e/Projects/AI/paperclip"
+
+    def test_create_session_stores_translated_cwd_on_wsl(self, manager, monkeypatch):
+        monkeypatch.setattr("hermes_constants._wsl_detected", True)
+
+        state = manager.create_session(cwd=r"E:\Projects\AI\paperclip")
+
+        assert state.cwd == "/mnt/e/Projects/AI/paperclip"
+
+    def test_fork_session_stores_translated_cwd_on_wsl(self, manager, monkeypatch):
+        monkeypatch.setattr("hermes_constants._wsl_detected", True)
+        original = manager.create_session(cwd="/tmp/base")
+
+        forked = manager.fork_session(original.session_id, cwd=r"D:\work\project")
+
+        assert forked is not None
+        assert forked.cwd == "/mnt/d/work/project"
+
+    def test_update_cwd_stores_translated_cwd_on_wsl(self, manager, monkeypatch):
+        monkeypatch.setattr("hermes_constants._wsl_detected", True)
+        state = manager.create_session(cwd="/tmp/old")
+
+        updated = manager.update_cwd(state.session_id, cwd=r"C:\Users\foo\project")
+
+        assert updated is not None
+        assert updated.cwd == "/mnt/c/Users/foo/project"
+
 # ---------------------------------------------------------------------------
 # fork
 # ---------------------------------------------------------------------------

tests/acp_adapter/test_acp_commands.py

@@ -0,0 +1,150 @@
+from types import SimpleNamespace
+
+import pytest
+from acp.schema import TextContentBlock
+
+from acp_adapter.server import HermesACPAgent
+from acp_adapter.session import SessionManager
+
+
+class FakeAgent:
+    def __init__(self):
+        self.model = "fake-model"
+        self.provider = "fake-provider"
+        self.enabled_toolsets = ["hermes-acp"]
+        self.disabled_toolsets = []
+        self.tools = []
+        self.valid_tool_names = set()
+        self.steers = []
+        self.runs = []
+
+    def steer(self, text):
+        self.steers.append(text)
+        return True
+
+    def run_conversation(self, *, user_message, conversation_history, task_id, **kwargs):
+        self.runs.append(user_message)
+        messages = list(conversation_history or [])
+        messages.append({"role": "user", "content": user_message})
+        final = f"ran: {user_message}"
+        messages.append({"role": "assistant", "content": final})
+        return {"final_response": final, "messages": messages}
+
+
+class CaptureConn:
+    def __init__(self):
+        self.updates = []
+
+    async def session_update(self, *args, **kwargs):
+        if kwargs:
+            self.updates.append((kwargs.get("session_id"), kwargs.get("update")))
+        else:
+            self.updates.append((args[0], args[1]))
+
+    async def request_permission(self, *args, **kwargs):
+        return SimpleNamespace(outcome="allow")
+
+
+class NoopDb:
+    def get_session(self, *_args, **_kwargs):
+        return None
+
+    def create_session(self, *_args, **_kwargs):
+        return None
+
+    def update_session(self, *_args, **_kwargs):
+        return None
+
+
+def make_agent_and_state():
+    fake = FakeAgent()
+    manager = SessionManager(agent_factory=lambda **kwargs: fake, db=NoopDb())
+    acp_agent = HermesACPAgent(session_manager=manager)
+    state = manager.create_session(cwd=".")
+    conn = CaptureConn()
+    acp_agent.on_connect(conn)
+    return acp_agent, state, fake, conn
+
+
+@pytest.mark.asyncio
+async def test_acp_steer_slash_command_injects_into_running_agent():
+    acp_agent, state, fake, _conn = make_agent_and_state()
+    state.is_running = True
+
+    response = await acp_agent.prompt(
+        session_id=state.session_id,
+        prompt=[TextContentBlock(type="text", text="/steer prefer the simpler fix")],
+    )
+
+    assert response.stop_reason == "end_turn"
+    assert fake.steers == ["prefer the simpler fix"]
+    assert fake.runs == []
+
+
+@pytest.mark.asyncio
+async def test_acp_steer_after_zed_interrupt_replays_interrupted_prompt_with_guidance():
+    acp_agent, state, fake, _conn = make_agent_and_state()
+    state.interrupted_prompt_text = "write hi to a text file"
+
+    response = await acp_agent.prompt(
+        session_id=state.session_id,
+        prompt=[TextContentBlock(type="text", text="/steer write HELLO instead")],
+    )
+
+    assert response.stop_reason == "end_turn"
+    assert fake.steers == []
+    assert fake.runs == [
+        "write hi to a text file\n\nUser correction/guidance after interrupt: write HELLO instead"
+    ]
+    assert state.interrupted_prompt_text == ""
+
+
+@pytest.mark.asyncio
+async def test_acp_steer_on_idle_session_runs_as_regular_prompt():
+    # /steer on an idle session (no running turn, nothing to salvage) should
+    # run the steer payload as a normal user prompt — NOT silently append it
+    # to state.queued_prompts. Without this, users on Zed / other ACP clients
+    # see their /steer turn into "queued for the next turn" when they never
+    # typed /queue. Matches gateway/run.py ~L4898 idle-/steer behavior.
+    acp_agent, state, fake, _conn = make_agent_and_state()
+
+    response = await acp_agent.prompt(
+        session_id=state.session_id,
+        prompt=[TextContentBlock(type="text", text="/steer summarize the README")],
+    )
+
+    assert response.stop_reason == "end_turn"
+    assert fake.steers == []
+    assert fake.runs == ["summarize the README"]
+    assert state.queued_prompts == []
+
+
+@pytest.mark.asyncio
+async def test_acp_queue_slash_command_adds_next_turn_without_running_now():
+    acp_agent, state, fake, _conn = make_agent_and_state()
+
+    response = await acp_agent.prompt(
+        session_id=state.session_id,
+        prompt=[TextContentBlock(type="text", text="/queue run the tests after this")],
+    )
+
+    assert response.stop_reason == "end_turn"
+    assert state.queued_prompts == ["run the tests after this"]
+    assert fake.runs == []
+
+
+@pytest.mark.asyncio
+async def test_acp_prompt_drains_queued_turns_after_current_run():
+    acp_agent, state, fake, conn = make_agent_and_state()
+    state.queued_prompts.append("then run tests")
+
+    response = await acp_agent.prompt(
+        session_id=state.session_id,
+        prompt=[TextContentBlock(type="text", text="make the change")],
+    )
+
+    assert response.stop_reason == "end_turn"
+    assert fake.runs == ["make the change", "then run tests"]
+    assert state.queued_prompts == []
+    agent_messages = [u for _sid, u in conn.updates if getattr(u, "session_update", None) == "agent_message_chunk"]
+    assert len(agent_messages) >= 2

tests/agent/test_auxiliary_named_custom_providers.py

@@ -427,3 +427,68 @@ class TestProvidersDictApiModeAnthropicMessages:
         assert isinstance(sync_client, OpenAI)
         async_client, _ = resolve_provider_client("localchat", async_mode=True)
         assert isinstance(async_client, AsyncOpenAI)
+
+
+class TestCustomProviderAliasCollision:
+    """A user-declared custom_providers entry whose name matches a built-in
+    *alias* (not a canonical provider) must win over the built-in.
+
+    Regression guard for #15743: users who defined fallback_model pointing at
+    a custom_providers entry named ``kimi`` were having requests routed to
+    the built-in kimi-coding endpoint because ``_normalize_aux_provider``
+    rewrote ``kimi`` → ``kimi-coding`` before the named-custom lookup.
+    """
+
+    def test_custom_named_kimi_wins_over_builtin_alias(self, tmp_path):
+        _write_config(tmp_path, {
+            "model": {"provider": "openrouter", "default": "anthropic/claude-sonnet-4.6"},
+            "custom_providers": [
+                {
+                    "name": "kimi",
+                    "base_url": "https://my-custom-kimi.example.com/v1",
+                    "api_key": "my-kimi-key",
+                    "models": {"my-kimi-model": {"context_length": 200000}},
+                },
+            ],
+        })
+        from agent.auxiliary_client import resolve_provider_client
+        from openai import OpenAI
+        client, model = resolve_provider_client("kimi", model="my-kimi-model", raw_codex=True)
+        assert isinstance(client, OpenAI)
+        assert "my-custom-kimi.example.com" in str(client.base_url)
+        assert client.api_key == "my-kimi-key"
+        assert model == "my-kimi-model"
+
+    def test_bare_kimi_without_custom_still_routes_to_builtin(self, tmp_path, monkeypatch):
+        """Regression guard: bare 'kimi' with no custom entry must still
+        reach the built-in kimi-coding provider."""
+        _write_config(tmp_path, {
+            "model": {"provider": "openrouter", "default": "anthropic/claude-sonnet-4.6"},
+        })
+        monkeypatch.setenv("KIMI_API_KEY", "builtin-kimi-key")
+        from agent.auxiliary_client import resolve_provider_client
+        client, _ = resolve_provider_client("kimi", model="kimi-k2-0905-preview", raw_codex=True)
+        assert client is not None
+        base_url = str(client.base_url)
+        # Built-in kimi-coding points at api.moonshot.ai
+        assert "moonshot" in base_url or "kimi" in base_url, f"unexpected base_url {base_url!r}"
+
+    def test_explicit_overrides_applied_on_api_key_branch(self, tmp_path, monkeypatch):
+        """Explicit base_url/api_key from the caller must override the
+        registered provider's defaults on the API-key branch.  Used by
+        _try_activate_fallback to route a fallback through a built-in
+        provider name but targeting a user-supplied endpoint."""
+        _write_config(tmp_path, {
+            "model": {"provider": "openrouter", "default": "anthropic/claude-sonnet-4.6"},
+        })
+        monkeypatch.setenv("KIMI_API_KEY", "builtin-kimi-key")
+        from agent.auxiliary_client import resolve_provider_client
+        from openai import OpenAI
+        client, _ = resolve_provider_client(
+            "kimi-coding", model="kimi-k2", raw_codex=True,
+            explicit_base_url="https://override.example.com",
+            explicit_api_key="override-key",
+        )
+        assert isinstance(client, OpenAI)
+        assert "override.example.com" in str(client.base_url)
+        assert client.api_key == "override-key"

tests/agent/test_context_compressor.py

@@ -640,6 +640,30 @@ class TestCompressWithClient:
                 for tc in msg["tool_calls"]:
                     assert tc["id"] in answered_ids
 
+    def test_sanitizer_matches_responses_call_id_when_id_differs(self, compressor):
+        msgs = [
+            {
+                "role": "assistant",
+                "content": "",
+                "tool_calls": [
+                    {
+                        "id": "fc_123",
+                        "call_id": "call_123",
+                        "response_item_id": "fc_123",
+                        "type": "function",
+                        "function": {"name": "search_files", "arguments": "{}"},
+                    }
+                ],
+            },
+            {"role": "tool", "tool_call_id": "call_123", "content": "result"},
+        ]
+
+        sanitized = compressor._sanitize_tool_pairs(msgs)
+
+        assert [m.get("tool_call_id") for m in sanitized if m.get("role") == "tool"] == [
+            "call_123"
+        ]
+
     def test_summary_role_avoids_consecutive_user_messages(self):
         """Summary role should alternate with the last head message to avoid consecutive same-role messages."""
         mock_client = MagicMock()
@@ -1119,6 +1143,34 @@ class TestTokenBudgetTailProtection:
         # At least one old tool result should have been pruned
         assert pruned >= 1
 
+    def test_prune_short_conv_protects_entire_tail(self, budget_compressor):
+        """Regression guard for PR #17025.
+
+        When ``len(messages) <= protect_tail_count`` and a token budget is
+        also set, every message must be protected. The previous code used
+        ``min(protect_tail_count, len(result) - 1)`` which capped the floor
+        one below the full length, leaving the oldest message eligible for
+        pruning.
+        """
+        c = budget_compressor
+        # 4 messages, protect_tail_count=4 -- nothing should be pruned.
+        # Oldest message is a large tool result; on the buggy path it falls
+        # outside the protected window and gets summarized.
+        messages = [
+            {"role": "tool", "content": "x" * 5000, "tool_call_id": "c0"},
+            {"role": "assistant", "content": "ack"},
+            {"role": "user", "content": "recent"},
+            {"role": "assistant", "content": "reply"},
+        ]
+        result, pruned = c._prune_old_tool_results(
+            messages,
+            protect_tail_count=4,
+            protect_tail_tokens=1_000_000,  # budget large enough to protect all
+        )
+        assert pruned == 0
+        # Tool result at index 0 must be preserved verbatim
+        assert result[0]["content"] == "x" * 5000
+
     def test_prune_without_token_budget_uses_message_count(self, budget_compressor):
         """Without protect_tail_tokens, falls back to message-count behavior."""
         c = budget_compressor

tests/agent/test_curator.py

@@ -86,9 +86,22 @@ def test_curator_config_overrides(curator_env, monkeypatch):
 # should_run_now
 # ---------------------------------------------------------------------------
 
-def test_first_run_always_eligible(curator_env):
+def test_first_run_defers(curator_env):
+    """The FIRST observation of the curator (fresh install, no state file)
+    must NOT trigger an immediate run. The curator is designed to run after
+    a full ``interval_hours`` of skill activity, not on the first background
+    tick after installation. Fixes #18373.
+    """
     c = curator_env["curator"]
-    assert c.should_run_now() is True
+    # No state file — should defer and seed last_run_at.
+    assert c.should_run_now() is False
+    state = c.load_state()
+    assert state.get("last_run_at") is not None, (
+        "first observation should seed last_run_at so the interval clock "
+        "starts ticking instead of firing immediately next tick"
+    )
+    # A second immediate call still returns False (seeded, not yet stale).
+    assert c.should_run_now() is False
 
 
 def test_recent_run_blocks(curator_env):
@@ -265,6 +278,77 @@ def test_run_review_records_state(curator_env):
     assert state["last_run_summary"] is not None
 
 
+def test_dry_run_does_not_advance_state(curator_env, monkeypatch):
+    """Dry-run previews must not bump last_run_at or run_count. A preview
+    shouldn't defer the next scheduled real pass or look like a real run in
+    `hermes curator status`. Fixes #18373.
+    """
+    c = curator_env["curator"]
+    skills_dir = curator_env["home"] / "skills"
+    _write_skill(skills_dir, "a")
+
+    # Stub the LLM so the test doesn't need a provider.
+    monkeypatch.setattr(
+        c, "_run_llm_review",
+        lambda prompt: {
+            "final": "", "summary": "dry preview", "model": "", "provider": "",
+            "tool_calls": [], "error": None,
+        },
+    )
+
+    c.run_curator_review(synchronous=True, dry_run=True)
+    state = c.load_state()
+    assert state.get("last_run_at") is None, "dry-run must not seed last_run_at"
+    assert state.get("run_count", 0) == 0, "dry-run must not bump run_count"
+    assert "dry-run" in (state.get("last_run_summary") or ""), (
+        "dry-run summary should be labeled so status output is unambiguous"
+    )
+
+
+def test_dry_run_injects_report_only_banner(curator_env, monkeypatch):
+    """The dry-run prompt must carry a banner instructing the LLM not to
+    call any mutating tool. This is defense in depth — the caller also
+    skips automatic transitions — but the LLM prompt is the only guard
+    against the model calling skill_manage directly."""
+    c = curator_env["curator"]
+    skills_dir = curator_env["home"] / "skills"
+    _write_skill(skills_dir, "a")
+
+    captured = {}
+    def _stub(prompt):
+        captured["prompt"] = prompt
+        return {"final": "", "summary": "s", "model": "", "provider": "",
+                "tool_calls": [], "error": None}
+    monkeypatch.setattr(c, "_run_llm_review", _stub)
+
+    c.run_curator_review(synchronous=True, dry_run=True)
+    assert "DRY-RUN" in captured["prompt"]
+    assert "DO NOT" in captured["prompt"]
+
+
+def test_dry_run_skips_automatic_transitions(curator_env, monkeypatch):
+    """Dry-run must not call apply_automatic_transitions — the auto pass
+    archives skills deterministically, and a preview must not touch the
+    filesystem."""
+    c = curator_env["curator"]
+    skills_dir = curator_env["home"] / "skills"
+    _write_skill(skills_dir, "a")
+
+    called = {"n": 0}
+    def _explode(*_a, **_kw):
+        called["n"] += 1
+        return {"checked": 0, "marked_stale": 0, "archived": 0, "reactivated": 0}
+    monkeypatch.setattr(c, "apply_automatic_transitions", _explode)
+    monkeypatch.setattr(
+        c, "_run_llm_review",
+        lambda p: {"final": "", "summary": "s", "model": "", "provider": "",
+                   "tool_calls": [], "error": None},
+    )
+
+    c.run_curator_review(synchronous=True, dry_run=True)
+    assert called["n"] == 0, "dry-run must skip apply_automatic_transitions"
+
+
 def test_run_review_synchronous_invokes_llm_stub(curator_env, monkeypatch):
     c = curator_env["curator"]
     skills_dir = curator_env["home"] / "skills"
@@ -327,12 +411,32 @@ def test_maybe_run_curator_runs_when_eligible(curator_env, monkeypatch):
     c = curator_env["curator"]
     skills_dir = curator_env["home"] / "skills"
     _write_skill(skills_dir, "a")
+    # Seed last_run_at far in the past so the interval gate opens — the
+    # "no state" path intentionally defers the first run now (#18373).
+    long_ago = datetime.now(timezone.utc) - timedelta(hours=c.get_interval_hours() * 2)
+    c.save_state({"last_run_at": long_ago.isoformat(), "paused": False})
     # Force idle over threshold
     result = c.maybe_run_curator(idle_for_seconds=99999.0)
     assert result is not None
     assert "started_at" in result
 
 
+def test_maybe_run_curator_defers_on_fresh_install(curator_env):
+    """Fresh install (no curator state file) must NOT fire the curator on
+    the first gateway tick. The first observation seeds last_run_at and
+    returns None. Fixes #18373."""
+    c = curator_env["curator"]
+    skills_dir = curator_env["home"] / "skills"
+    _write_skill(skills_dir, "a")
+    # Infinite idle — the only thing that should block the run is the new
+    # deferred-first-run gate.
+    result = c.maybe_run_curator(idle_for_seconds=99999.0)
+    assert result is None
+    # And the next tick still defers (we seeded last_run_at to "now").
+    result2 = c.maybe_run_curator(idle_for_seconds=99999.0)
+    assert result2 is None
+
+
 def test_maybe_run_curator_swallows_exceptions(curator_env, monkeypatch):
     c = curator_env["curator"]
 
@@ -363,6 +467,19 @@ def test_state_atomic_write_no_tmp_leftovers(curator_env):
         assert not p.name.startswith(".curator_state_"), f"tmp leftover: {p.name}"
 
 
+def test_state_preserves_last_report_path(curator_env):
+    c = curator_env["curator"]
+    c.save_state({
+        "last_run_at": "2026-04-30T12:00:00+00:00",
+        "last_run_summary": "ok",
+        "last_report_path": "/tmp/curator-report",
+        "paused": False,
+        "run_count": 1,
+    })
+    state = c.load_state()
+    assert state["last_report_path"] == "/tmp/curator-report"
+
+
 def test_curator_review_prompt_has_invariants():
     """Core invariants must be in the review prompt text."""
     from agent.curator import CURATOR_REVIEW_PROMPT

tests/agent/test_curator_backup.py

@@ -0,0 +1,316 @@
+"""Tests for agent/curator_backup.py — snapshot + rollback of the skills tree."""
+
+from __future__ import annotations
+
+import importlib
+import json
+import os
+import sys
+import tarfile
+import tempfile
+from pathlib import Path
+
+import pytest
+
+
+@pytest.fixture
+def backup_env(monkeypatch, tmp_path):
+    """Isolate HERMES_HOME + reload modules so every test starts clean."""
+    home = tmp_path / ".hermes"
+    home.mkdir()
+    (home / "skills").mkdir()
+    monkeypatch.setenv("HERMES_HOME", str(home))
+    monkeypatch.setattr(Path, "home", lambda: tmp_path)
+
+    # Reload so get_hermes_home picks up the env var fresh.
+    import hermes_constants
+    importlib.reload(hermes_constants)
+    from agent import curator_backup
+    importlib.reload(curator_backup)
+    return {"home": home, "skills": home / "skills", "cb": curator_backup}
+
+
+def _write_skill(skills_dir: Path, name: str, body: str = "body") -> Path:
+    d = skills_dir / name
+    d.mkdir(parents=True, exist_ok=True)
+    (d / "SKILL.md").write_text(
+        f"---\nname: {name}\ndescription: t\nversion: 1.0\n---\n\n{body}\n",
+        encoding="utf-8",
+    )
+    return d
+
+
+# ---------------------------------------------------------------------------
+# snapshot_skills
+# ---------------------------------------------------------------------------
+
+def test_snapshot_creates_tarball_and_manifest(backup_env):
+    cb = backup_env["cb"]
+    _write_skill(backup_env["skills"], "alpha")
+    _write_skill(backup_env["skills"], "beta")
+
+    snap = cb.snapshot_skills(reason="test")
+    assert snap is not None, "snapshot should succeed with a populated skills dir"
+    assert (snap / "skills.tar.gz").exists()
+    manifest = json.loads((snap / "manifest.json").read_text())
+    assert manifest["reason"] == "test"
+    assert manifest["skill_files"] == 2
+    assert manifest["archive_bytes"] > 0
+
+
+def test_snapshot_excludes_backups_dir_itself(backup_env):
+    """The backup must NOT contain .curator_backups/ — that would recurse
+    with every subsequent snapshot and balloon disk usage."""
+    cb = backup_env["cb"]
+    _write_skill(backup_env["skills"], "alpha")
+    snap1 = cb.snapshot_skills(reason="first")
+    assert snap1 is not None
+    snap2 = cb.snapshot_skills(reason="second")
+    assert snap2 is not None
+    with tarfile.open(snap2 / "skills.tar.gz") as tf:
+        names = tf.getnames()
+    assert not any(n.startswith(".curator_backups") for n in names), (
+        "second snapshot must not contain the first snapshot recursively"
+    )
+
+
+def test_snapshot_excludes_hub_dir(backup_env):
+    """.hub/ is managed by the skills hub. Rolling it back would break
+    lockfile invariants, so the snapshot omits it entirely."""
+    cb = backup_env["cb"]
+    hub = backup_env["skills"] / ".hub"
+    hub.mkdir()
+    (hub / "lock.json").write_text("{}")
+    _write_skill(backup_env["skills"], "alpha")
+    snap = cb.snapshot_skills(reason="t")
+    assert snap is not None
+    with tarfile.open(snap / "skills.tar.gz") as tf:
+        names = tf.getnames()
+    assert not any(n.startswith(".hub") for n in names)
+
+
+def test_snapshot_disabled_returns_none(backup_env, monkeypatch):
+    cb = backup_env["cb"]
+    monkeypatch.setattr(cb, "is_enabled", lambda: False)
+    _write_skill(backup_env["skills"], "alpha")
+    assert cb.snapshot_skills() is None
+    # And no backup dir should have been created
+    assert not (backup_env["skills"] / ".curator_backups").exists()
+
+
+def test_snapshot_uniquifies_when_same_second(backup_env, monkeypatch):
+    """Two snapshots in the same wallclock second must not clobber each
+    other. The module appends a counter to the second snapshot's id."""
+    cb = backup_env["cb"]
+    _write_skill(backup_env["skills"], "alpha")
+    frozen = "2026-05-01T12-00-00Z"
+    monkeypatch.setattr(cb, "_utc_id", lambda now=None: frozen)
+    s1 = cb.snapshot_skills(reason="a")
+    s2 = cb.snapshot_skills(reason="b")
+    assert s1 is not None and s2 is not None
+    assert s1.name == frozen
+    assert s2.name == f"{frozen}-01"
+
+
+def test_snapshot_prunes_to_keep_count(backup_env, monkeypatch):
+    cb = backup_env["cb"]
+    _write_skill(backup_env["skills"], "alpha")
+    monkeypatch.setattr(cb, "get_keep", lambda: 3)
+
+    # Create 5 snapshots with monotonically increasing fake ids
+    ids = [f"2026-05-0{i}T00-00-00Z" for i in range(1, 6)]
+    for i, fid in enumerate(ids):
+        monkeypatch.setattr(cb, "_utc_id", lambda now=None, _f=fid: _f)
+        cb.snapshot_skills(reason=f"n{i}")
+
+    remaining = sorted(p.name for p in (backup_env["skills"] / ".curator_backups").iterdir())
+    # Newest 3 kept (lex order == date order for this id format)
+    assert remaining == ids[2:], f"expected newest 3, got {remaining}"
+
+
+# ---------------------------------------------------------------------------
+# list_backups / _resolve_backup
+# ---------------------------------------------------------------------------
+
+def test_list_backups_empty(backup_env):
+    cb = backup_env["cb"]
+    assert cb.list_backups() == []
+
+
+def test_list_backups_returns_manifest_data(backup_env):
+    cb = backup_env["cb"]
+    _write_skill(backup_env["skills"], "alpha")
+    cb.snapshot_skills(reason="m1")
+    rows = cb.list_backups()
+    assert len(rows) == 1
+    assert rows[0]["reason"] == "m1"
+    assert rows[0]["skill_files"] == 1
+
+
+def test_resolve_backup_newest_when_no_id(backup_env, monkeypatch):
+    cb = backup_env["cb"]
+    _write_skill(backup_env["skills"], "alpha")
+    ids = ["2026-05-01T00-00-00Z", "2026-05-02T00-00-00Z"]
+    for fid in ids:
+        monkeypatch.setattr(cb, "_utc_id", lambda now=None, _f=fid: _f)
+        cb.snapshot_skills()
+    resolved = cb._resolve_backup(None)
+    assert resolved is not None
+    assert resolved.name == "2026-05-02T00-00-00Z", (
+        "resolve(None) must return newest regular snapshot"
+    )
+
+
+def test_resolve_backup_unknown_id_returns_none(backup_env):
+    cb = backup_env["cb"]
+    _write_skill(backup_env["skills"], "alpha")
+    cb.snapshot_skills()
+    assert cb._resolve_backup("not-an-id") is None
+
+
+# ---------------------------------------------------------------------------
+# rollback
+# ---------------------------------------------------------------------------
+
+def test_rollback_restores_deleted_skill(backup_env):
+    """The whole point of this feature: user loses a skill, rollback
+    brings it back."""
+    cb = backup_env["cb"]
+    skills = backup_env["skills"]
+    user_skill = _write_skill(skills, "my-personal-workflow", body="important content")
+    cb.snapshot_skills(reason="pre-simulated-curator")
+
+    # Simulate curator archiving it out of existence
+    import shutil as _sh
+    _sh.rmtree(user_skill)
+    assert not user_skill.exists()
+
+    ok, msg, _ = cb.rollback()
+    assert ok, f"rollback failed: {msg}"
+    assert user_skill.exists(), "my-personal-workflow should be restored"
+    assert "important content" in (user_skill / "SKILL.md").read_text()
+
+
+def test_rollback_is_itself_undoable(backup_env):
+    """A rollback creates its own safety snapshot before replacing the
+    tree, so the user can undo a mistaken rollback. The safety snapshot
+    is a real tarball with reason='pre-rollback to <id>' — it's
+    listed by list_backups() just like any other snapshot and can be
+    restored the same way."""
+    cb = backup_env["cb"]
+    skills = backup_env["skills"]
+    _write_skill(skills, "v1")
+    cb.snapshot_skills(reason="snapshot-of-v1")
+
+    # Overwrite with a new skill state
+    import shutil as _sh
+    _sh.rmtree(skills / "v1")
+    _write_skill(skills, "v2")
+
+    ok, _, _ = cb.rollback()
+    assert ok
+    assert (skills / "v1").exists()
+
+    # list_backups should show a safety snapshot tagged "pre-rollback to <target-id>"
+    rows = cb.list_backups()
+    pre_rollback_entries = [r for r in rows if "pre-rollback" in (r.get("reason") or "")]
+    assert len(pre_rollback_entries) >= 1, (
+        f"expected a pre-rollback safety snapshot in list_backups(), got: "
+        f"{[(r.get('id'), r.get('reason')) for r in rows]}"
+    )
+    # And the transient staging dir must be gone (it's implementation detail)
+    backups_dir = skills / ".curator_backups"
+    staging_dirs = [p for p in backups_dir.iterdir() if p.name.startswith(".rollback-staging-")]
+    assert staging_dirs == [], (
+        f"staging dir should be cleaned up on success, got: {staging_dirs}"
+    )
+
+
+def test_rollback_no_snapshots_returns_error(backup_env):
+    cb = backup_env["cb"]
+    ok, msg, _ = cb.rollback()
+    assert not ok
+    assert "no matching backup" in msg.lower() or "no snapshot" in msg.lower()
+
+
+def test_rollback_rejects_unsafe_tarball(backup_env, monkeypatch):
+    """Tarballs with absolute paths or .. components must be refused even
+    if someone crafts a malicious snapshot. Defense in depth — normal
+    curator snapshots never produce these."""
+    cb = backup_env["cb"]
+    skills = backup_env["skills"]
+    _write_skill(skills, "alpha")
+    cb.snapshot_skills(reason="legit")
+
+    # Hand-craft a malicious tarball replacing the legit one
+    rows = cb.list_backups()
+    snap_dir = Path(rows[0]["path"])
+    mal = snap_dir / "skills.tar.gz"
+    mal.unlink()
+    with tarfile.open(mal, "w:gz") as tf:
+        evil = tempfile.NamedTemporaryFile(delete=False, suffix=".md")
+        evil.write(b"evil")
+        evil.close()
+        tf.add(evil.name, arcname="../../etc/evil.md")
+        os.unlink(evil.name)
+
+    ok, msg, _ = cb.rollback()
+    assert not ok
+    assert "unsafe" in msg.lower() or "refus" in msg.lower() or "extract" in msg.lower()
+
+
+# ---------------------------------------------------------------------------
+# Integration with run_curator_review
+# ---------------------------------------------------------------------------
+
+def test_real_run_takes_pre_snapshot(backup_env, monkeypatch):
+    """A real (non-dry) curator pass must snapshot the tree before calling
+    apply_automatic_transitions. This is the safety net #18373 asked for."""
+    cb = backup_env["cb"]
+    skills = backup_env["skills"]
+    _write_skill(skills, "alpha")
+
+    # Reload curator module against the freshly-env'd hermes_constants
+    from agent import curator
+    importlib.reload(curator)
+
+    # Stub out LLM review and auto transitions — we only care about the
+    # snapshot side-effect.
+    monkeypatch.setattr(
+        curator, "_run_llm_review",
+        lambda p: {"final": "", "summary": "s", "model": "", "provider": "",
+                   "tool_calls": [], "error": None},
+    )
+    monkeypatch.setattr(
+        curator, "apply_automatic_transitions",
+        lambda now=None: {"checked": 1, "marked_stale": 0, "archived": 0, "reactivated": 0},
+    )
+
+    curator.run_curator_review(synchronous=True)
+    # Pre-run snapshot should exist
+    rows = cb.list_backups()
+    assert any(r.get("reason") == "pre-curator-run" for r in rows), (
+        f"expected a pre-curator-run snapshot, got {[r.get('reason') for r in rows]}"
+    )
+
+
+def test_dry_run_skips_snapshot(backup_env, monkeypatch):
+    """Dry-run previews must not spend disk on a snapshot — they don't
+    mutate anything, so there's nothing to back up."""
+    cb = backup_env["cb"]
+    skills = backup_env["skills"]
+    _write_skill(skills, "alpha")
+
+    from agent import curator
+    importlib.reload(curator)
+    monkeypatch.setattr(
+        curator, "_run_llm_review",
+        lambda p: {"final": "", "summary": "s", "model": "", "provider": "",
+                   "tool_calls": [], "error": None},
+    )
+
+    curator.run_curator_review(synchronous=True, dry_run=True)
+    rows = cb.list_backups()
+    assert not any(r.get("reason") == "pre-curator-run" for r in rows), (
+        "dry-run must not create a pre-run snapshot"
+    )

tests/agent/test_curator_reports.py

@@ -270,3 +270,167 @@ def test_state_transitions_captured_in_report(curator_env):
     assert "State transitions" in md
     assert "getting-old" in md
     assert "active → stale" in md
+
+
+# ---------------------------------------------------------------------------
+# Cron job skill reference rewriting (curator ↔ cron integration)
+# ---------------------------------------------------------------------------
+#
+# When the curator consolidates skill X into umbrella Y during a run, any
+# cron job that listed X in its ``skills`` field would fail to load X at
+# run time — the scheduler logs a warning and skips it, so the scheduled
+# job runs without the instructions it was scheduled to follow. These
+# tests verify that _write_run_report calls into cron.jobs to repair
+# those references and records what it did in both run.json and
+# cron_rewrites.json.
+
+
+@pytest.fixture
+def curator_env_with_cron(curator_env, monkeypatch):
+    """Extend curator_env with an initialized + repointed cron.jobs module."""
+    home = curator_env["home"]
+    (home / "cron").mkdir(exist_ok=True)
+    (home / "cron" / "output").mkdir(exist_ok=True)
+
+    import importlib
+    import cron.jobs as jobs_mod
+    importlib.reload(jobs_mod)
+    monkeypatch.setattr(jobs_mod, "HERMES_DIR", home)
+    monkeypatch.setattr(jobs_mod, "CRON_DIR", home / "cron")
+    monkeypatch.setattr(jobs_mod, "JOBS_FILE", home / "cron" / "jobs.json")
+    monkeypatch.setattr(jobs_mod, "OUTPUT_DIR", home / "cron" / "output")
+
+    return {**curator_env, "jobs": jobs_mod}
+
+
+def test_curator_rewrites_cron_skills_when_skill_consolidated(curator_env_with_cron):
+    """A skill consolidated into an umbrella should be rewritten in any
+    cron job's skills list; the rewrite should be visible in run.json
+    and cron_rewrites.json."""
+    curator = curator_env_with_cron["curator"]
+    jobs = curator_env_with_cron["jobs"]
+
+    # Create a cron job that depends on a soon-to-be-consolidated skill
+    job = jobs.create_job(
+        prompt="",
+        schedule="every 1h",
+        skills=["foo"],
+        name="foo-watcher",
+    )
+
+    # Simulate a curator pass that consolidated `foo` → `foo-umbrella`
+    before = [{"name": "foo", "state": "active", "pinned": False}]
+    after = [{"name": "foo-umbrella", "state": "active", "pinned": False}]
+
+    run_dir = curator._write_run_report(
+        started_at=datetime.now(timezone.utc),
+        elapsed_seconds=3.0,
+        auto_counts={"checked": 1, "marked_stale": 0, "archived": 0, "reactivated": 0},
+        auto_summary="no changes",
+        before_report=before,
+        before_names={"foo"},
+        after_report=after,
+        llm_meta=_make_llm_meta(
+            final="Consolidated foo into foo-umbrella.",
+            tool_calls=[
+                {
+                    "name": "skill_manage",
+                    "arguments": json.dumps({
+                        "action": "write_file",
+                        "name": "foo-umbrella",
+                        "file_path": "references/foo.md",
+                        "file_content": "from foo",
+                    }),
+                },
+            ],
+        ),
+    )
+
+    # Cron job is rewritten on disk
+    loaded = jobs.get_job(job["id"])
+    assert loaded["skills"] == ["foo-umbrella"]
+    assert loaded["skill"] == "foo-umbrella"
+
+    # Rewrite is recorded in run.json
+    payload = json.loads((run_dir / "run.json").read_text())
+    assert payload["cron_rewrites"]["jobs_updated"] == 1
+    assert payload["counts"]["cron_jobs_rewritten"] == 1
+    rewrites = payload["cron_rewrites"]["rewrites"]
+    assert len(rewrites) == 1
+    assert rewrites[0]["mapped"] == {"foo": "foo-umbrella"}
+
+    # Separate cron_rewrites.json is written for convenience
+    cron_file = run_dir / "cron_rewrites.json"
+    assert cron_file.exists()
+    detail = json.loads(cron_file.read_text())
+    assert detail["jobs_updated"] == 1
+
+    # Markdown surfaces the change
+    md = (run_dir / "REPORT.md").read_text()
+    assert "Cron job skill references rewritten" in md
+    assert "foo-watcher" in md
+    assert "foo-umbrella" in md
+
+
+def test_curator_drops_pruned_skill_from_cron_job(curator_env_with_cron):
+    """A pruned (no-umbrella) skill should be dropped from the cron
+    job's skill list entirely — there's no forwarding target."""
+    curator = curator_env_with_cron["curator"]
+    jobs = curator_env_with_cron["jobs"]
+
+    job = jobs.create_job(
+        prompt="",
+        schedule="every 1h",
+        skills=["keep", "stale-one"],
+    )
+
+    before = [{"name": "stale-one", "state": "active", "pinned": False}]
+    after: list = []  # stale-one was archived with no target
+
+    run_dir = curator._write_run_report(
+        started_at=datetime.now(timezone.utc),
+        elapsed_seconds=1.0,
+        auto_counts={"checked": 1, "marked_stale": 0, "archived": 1, "reactivated": 0},
+        auto_summary="1 archived",
+        before_report=before,
+        before_names={"stale-one"},
+        after_report=after,
+        llm_meta=_make_llm_meta(),  # no tool calls → classifier marks it pruned
+    )
+
+    loaded = jobs.get_job(job["id"])
+    assert loaded["skills"] == ["keep"]
+
+    payload = json.loads((run_dir / "run.json").read_text())
+    assert payload["cron_rewrites"]["jobs_updated"] == 1
+    rewrites = payload["cron_rewrites"]["rewrites"]
+    assert rewrites[0]["dropped"] == ["stale-one"]
+
+
+def test_curator_report_has_no_cron_section_when_nothing_changes(curator_env_with_cron):
+    """When the curator run doesn't touch any skills, cron jobs are
+    untouched and cron_rewrites.json is not even written."""
+    curator = curator_env_with_cron["curator"]
+    jobs = curator_env_with_cron["jobs"]
+
+    jobs.create_job(prompt="", schedule="every 1h", skills=["foo"])
+
+    run_dir = curator._write_run_report(
+        started_at=datetime.now(timezone.utc),
+        elapsed_seconds=1.0,
+        auto_counts={"checked": 0, "marked_stale": 0, "archived": 0, "reactivated": 0},
+        auto_summary="no changes",
+        before_report=[{"name": "foo", "state": "active", "pinned": False}],
+        before_names={"foo"},
+        after_report=[{"name": "foo", "state": "active", "pinned": False}],
+        llm_meta=_make_llm_meta(),
+    )
+
+    # No rewrites → no separate file, no section in md
+    assert not (run_dir / "cron_rewrites.json").exists()
+    md = (run_dir / "REPORT.md").read_text()
+    assert "Cron job skill references rewritten" not in md
+
+    payload = json.loads((run_dir / "run.json").read_text())
+    assert payload["cron_rewrites"]["jobs_updated"] == 0
+    assert payload["counts"]["cron_jobs_rewritten"] == 0

tests/agent/test_moonshot_schema.py

@@ -115,9 +115,15 @@ class TestMissingTypeFilled:
 
 
 class TestAnyOfParentType:
-    """Rule 2: type must not appear at the anyOf parent level."""
+    """Rule 2: type must not appear at the anyOf parent level.
 
-    def test_parent_type_stripped_when_anyof_present(self):
+    When an anyOf contains a null-type branch, Moonshot rejects it.
+    The sanitizer collapses the anyOf: single non-null branch is promoted,
+    multiple non-null branches have null removed from the list.
+    """
+
+    def test_anyof_null_branch_collapsed_to_single_type(self):
+        """anyOf [string, null] → plain string (anyOf removed)."""
         params = {
             "type": "object",
             "properties": {
@@ -132,25 +138,46 @@ class TestAnyOfParentType:
         }
         out = sanitize_moonshot_tool_parameters(params)
         from_format = out["properties"]["from_format"]
-        assert "type" not in from_format
-        assert "anyOf" in from_format
+        # null branch removed, anyOf collapsed to the single non-null type
+        assert "anyOf" not in from_format
+        assert from_format["type"] == "string"
 
-    def test_anyof_children_missing_type_get_filled(self):
+    def test_anyof_multiple_non_null_preserved(self):
+        """anyOf [string, integer] (no null) → kept as-is with parent type stripped."""
         params = {
             "type": "object",
             "properties": {
-                "value": {
+                "mode": {
                     "anyOf": [
                         {"type": "string"},
-                        {"description": "A typeless option"},
+                        {"type": "integer"},
                     ],
                 },
             },
         }
         out = sanitize_moonshot_tool_parameters(params)
-        children = out["properties"]["value"]["anyOf"]
-        assert children[0]["type"] == "string"
-        assert "type" in children[1]
+        mode = out["properties"]["mode"]
+        assert "anyOf" in mode
+        assert "type" not in mode  # parent type stripped
+
+    def test_anyof_enum_with_null_collapsed(self):
+        """anyOf [{enum: [...], type: string}, {type: null}] → enum + type only."""
+        params = {
+            "type": "object",
+            "properties": {
+                "db_type": {
+                    "anyOf": [
+                        {"enum": ["mysql", "postgresql", ""]},
+                        {"type": "null"},
+                    ],
+                },
+            },
+        }
+        out = sanitize_moonshot_tool_parameters(params)
+        db_type = out["properties"]["db_type"]
+        assert "anyOf" not in db_type
+        assert db_type["type"] == "string"
+        assert db_type["enum"] == ["mysql", "postgresql"]  # "" stripped by enum cleanup
 
 
 class TestTopLevelGuarantees:
@@ -226,7 +253,7 @@ class TestRealWorldMCPShape:
     """End-to-end: a realistic MCP-style schema that used to 400 on Moonshot."""
 
     def test_combined_rewrites(self):
-        # Shape: missing type on a property, anyOf with parent type, array
+        # Shape: missing type on a property, anyOf with parent type + null, array
         # items without type — all in one tool.
         params = {
             "type": "object",
@@ -248,7 +275,125 @@ class TestRealWorldMCPShape:
         }
         out = sanitize_moonshot_tool_parameters(params)
         assert out["properties"]["query"]["type"] == "string"
-        assert "type" not in out["properties"]["filter"]
-        assert out["properties"]["filter"]["anyOf"][0]["type"] == "string"
+        # anyOf with null collapsed to plain type
+        assert "anyOf" not in out["properties"]["filter"]
+        assert out["properties"]["filter"]["type"] == "string"
         assert out["properties"]["tags"]["items"]["type"] == "string"
         assert out["required"] == ["query"]
+
+
+class TestEnumNullStripping:
+    """Rule 3: Moonshot rejects null/empty-string inside enum arrays."""
+
+    def test_enum_null_value_stripped(self):
+        """enum containing Python None must have it removed for Moonshot."""
+        params = {
+            "type": "object",
+            "properties": {
+                "db_type": {
+                    "type": "string",
+                    "enum": ["mysql", "postgresql", None],
+                },
+            },
+        }
+        out = sanitize_moonshot_tool_parameters(params)
+        db_type = out["properties"]["db_type"]
+        assert None not in db_type["enum"]
+        assert "mysql" in db_type["enum"]
+        assert "postgresql" in db_type["enum"]
+
+    def test_enum_empty_string_stripped(self):
+        """enum containing empty string '' must have it removed for Moonshot."""
+        params = {
+            "type": "object",
+            "properties": {
+                "db_type": {
+                    "type": "string",
+                    "enum": ["mysql", "postgresql", ""],
+                },
+            },
+        }
+        out = sanitize_moonshot_tool_parameters(params)
+        db_type = out["properties"]["db_type"]
+        assert "" not in db_type["enum"]
+        assert db_type["enum"] == ["mysql", "postgresql"]
+
+    def test_enum_all_null_becomes_no_enum(self):
+        """enum that only had null/empty values is dropped entirely."""
+        params = {
+            "type": "object",
+            "properties": {
+                "val": {
+                    "type": "string",
+                    "enum": [None, ""],
+                },
+            },
+        }
+        out = sanitize_moonshot_tool_parameters(params)
+        assert "enum" not in out["properties"]["val"]
+
+    def test_dataslayer_db_type_after_mcp_normalize(self):
+        """Real-world: dataslayer db_type anyOf+enum after MCP normalization."""
+        # This is the exact shape after _normalize_mcp_input_schema runs:
+        # anyOf collapsed, but enum still has null + empty string
+        params = {
+            "type": "object",
+            "properties": {
+                "datasource": {"type": "string"},
+                "db_type": {
+                    "enum": ["mysql", "mariadb", "postgresql", "sqlserver", "oracle", "", None],
+                    "type": "string",
+                    "nullable": True,
+                    "default": None,
+                },
+            },
+            "required": ["datasource"],
+        }
+        out = sanitize_moonshot_tool_parameters(params)
+        db_type = out["properties"]["db_type"]
+        assert "nullable" not in db_type, "nullable keyword must be stripped"
+        assert None not in db_type["enum"]
+        assert "" not in db_type["enum"]
+        assert db_type["enum"] == ["mysql", "mariadb", "postgresql", "sqlserver", "oracle"]
+        assert db_type["type"] == "string"
+
+    def test_enum_on_object_type_not_stripped(self):
+        """enum on non-scalar types (object) should NOT be touched."""
+        params = {
+            "type": "object",
+            "properties": {
+                "config": {
+                    "type": "object",
+                    "properties": {},
+                    "enum": [{}, None],
+                },
+            },
+        }
+        out = sanitize_moonshot_tool_parameters(params)
+        # object-typed enum should pass through unchanged
+        assert "enum" in out["properties"]["config"]
+
+    def test_anyof_collapse_still_runs_nullable_and_enum_cleanup(self):
+        """After anyOf collapses to a single non-null branch, the merged
+        node must still have ``nullable`` stripped and null/empty-string
+        values removed from enum — not skipped by the early anyOf return.
+        """
+        params = {
+            "type": "object",
+            "properties": {
+                "db_type": {
+                    "anyOf": [
+                        {"enum": ["mysql", "postgresql", "", None]},
+                        {"type": "null"},
+                    ],
+                    "nullable": True,
+                },
+            },
+        }
+        out = sanitize_moonshot_tool_parameters(params)
+        db_type = out["properties"]["db_type"]
+        assert "anyOf" not in db_type
+        assert "nullable" not in db_type, "nullable must be stripped after anyOf collapse"
+        assert db_type["type"] == "string"
+        assert db_type["enum"] == ["mysql", "postgresql"], \
+            "null/empty enum values must be stripped after anyOf collapse"

tests/agent/test_skill_utils.py

@@ -0,0 +1,58 @@
+"""Tests for agent/skill_utils.py — extract_skill_conditions metadata handling."""
+
+from agent.skill_utils import extract_skill_conditions
+
+
+def test_metadata_as_dict_with_hermes():
+    """Normal case: metadata is a dict containing hermes keys."""
+    frontmatter = {
+        "metadata": {
+            "hermes": {
+                "fallback_for_toolsets": ["toolset_a"],
+                "requires_toolsets": ["toolset_b"],
+                "fallback_for_tools": ["tool_x"],
+                "requires_tools": ["tool_y"],
+            }
+        }
+    }
+    result = extract_skill_conditions(frontmatter)
+    assert result["fallback_for_toolsets"] == ["toolset_a"]
+    assert result["requires_toolsets"] == ["toolset_b"]
+    assert result["fallback_for_tools"] == ["tool_x"]
+    assert result["requires_tools"] == ["tool_y"]
+
+
+def test_metadata_as_string_does_not_crash():
+    """Bug case: metadata is a non-dict truthy value (e.g. a YAML string)."""
+    frontmatter = {"metadata": "some text"}
+    result = extract_skill_conditions(frontmatter)
+    assert result == {
+        "fallback_for_toolsets": [],
+        "requires_toolsets": [],
+        "fallback_for_tools": [],
+        "requires_tools": [],
+    }
+
+
+def test_metadata_as_none():
+    """metadata key is present but set to null/None."""
+    frontmatter = {"metadata": None}
+    result = extract_skill_conditions(frontmatter)
+    assert result == {
+        "fallback_for_toolsets": [],
+        "requires_toolsets": [],
+        "fallback_for_tools": [],
+        "requires_tools": [],
+    }
+
+
+def test_metadata_missing_entirely():
+    """metadata key is absent from frontmatter."""
+    frontmatter = {"name": "my-skill", "description": "Does stuff."}
+    result = extract_skill_conditions(frontmatter)
+    assert result == {
+        "fallback_for_toolsets": [],
+        "requires_toolsets": [],
+        "fallback_for_tools": [],
+        "requires_tools": [],
+    }

tests/agent/test_tool_guardrails.py

@@ -0,0 +1,238 @@
+"""Pure tool-call guardrail primitive tests."""
+
+import json
+
+from agent.tool_guardrails import (
+    ToolCallGuardrailConfig,
+    ToolCallGuardrailController,
+    ToolCallSignature,
+    canonical_tool_args,
+)
+
+
+def test_tool_call_signature_hashes_canonical_nested_unicode_args_without_exposing_raw_args():
+    args_a = {
+        "z": [{"β": "☤", "a": 1}],
+        "a": {"y": 2, "x": "secret-token-value"},
+    }
+    args_b = {
+        "a": {"x": "secret-token-value", "y": 2},
+        "z": [{"a": 1, "β": "☤"}],
+    }
+
+    assert canonical_tool_args(args_a) == canonical_tool_args(args_b)
+    sig_a = ToolCallSignature.from_call("web_search", args_a)
+    sig_b = ToolCallSignature.from_call("web_search", args_b)
+
+    assert sig_a == sig_b
+    assert len(sig_a.args_hash) == 64
+    metadata = sig_a.to_metadata()
+    assert metadata == {"tool_name": "web_search", "args_hash": sig_a.args_hash}
+    assert "secret-token-value" not in json.dumps(metadata)
+    assert "☤" not in json.dumps(metadata)
+
+
+def test_default_config_is_soft_warning_only_with_hard_stop_disabled():
+    cfg = ToolCallGuardrailConfig()
+
+    assert cfg.warnings_enabled is True
+    assert cfg.hard_stop_enabled is False
+    assert cfg.exact_failure_warn_after == 2
+    assert cfg.same_tool_failure_warn_after == 3
+    assert cfg.no_progress_warn_after == 2
+    assert cfg.exact_failure_block_after == 5
+    assert cfg.same_tool_failure_halt_after == 8
+    assert cfg.no_progress_block_after == 5
+
+
+def test_config_parses_nested_warn_and_hard_stop_thresholds():
+    cfg = ToolCallGuardrailConfig.from_mapping(
+        {
+            "warnings_enabled": False,
+            "hard_stop_enabled": True,
+            "warn_after": {
+                "exact_failure": 3,
+                "same_tool_failure": 4,
+                "idempotent_no_progress": 5,
+            },
+            "hard_stop_after": {
+                "exact_failure": 6,
+                "same_tool_failure": 7,
+                "idempotent_no_progress": 8,
+            },
+        }
+    )
+
+    assert cfg.warnings_enabled is False
+    assert cfg.hard_stop_enabled is True
+    assert cfg.exact_failure_warn_after == 3
+    assert cfg.same_tool_failure_warn_after == 4
+    assert cfg.no_progress_warn_after == 5
+    assert cfg.exact_failure_block_after == 6
+    assert cfg.same_tool_failure_halt_after == 7
+    assert cfg.no_progress_block_after == 8
+
+
+def test_default_repeated_identical_failed_call_warns_without_blocking():
+    controller = ToolCallGuardrailController()
+    args = {"query": "same"}
+
+    decisions = []
+    for _ in range(5):
+        assert controller.before_call("web_search", args).action == "allow"
+        decisions.append(
+            controller.after_call("web_search", args, '{"error":"boom"}', failed=True)
+        )
+
+    assert decisions[0].action == "allow"
+    assert [d.action for d in decisions[1:]] == ["warn", "warn", "warn", "warn"]
+    assert {d.code for d in decisions[1:]} == {"repeated_exact_failure_warning"}
+    assert controller.before_call("web_search", args).action == "allow"
+    assert controller.halt_decision is None
+
+
+def test_hard_stop_enabled_blocks_repeated_exact_failure_before_next_execution():
+    controller = ToolCallGuardrailController(
+        ToolCallGuardrailConfig(
+            hard_stop_enabled=True,
+            exact_failure_warn_after=2,
+            exact_failure_block_after=2,
+            same_tool_failure_halt_after=99,
+        )
+    )
+    args = {"query": "same"}
+
+    assert controller.before_call("web_search", args).action == "allow"
+    first = controller.after_call("web_search", args, '{"error":"boom"}', failed=True)
+    assert first.action == "allow"
+
+    assert controller.before_call("web_search", args).action == "allow"
+    second = controller.after_call("web_search", args, '{"error":"boom"}', failed=True)
+    assert second.action == "warn"
+    assert second.code == "repeated_exact_failure_warning"
+
+    blocked = controller.before_call("web_search", args)
+    assert blocked.action == "block"
+    assert blocked.code == "repeated_exact_failure_block"
+    assert blocked.count == 2
+
+
+def test_success_resets_exact_signature_failure_streak():
+    controller = ToolCallGuardrailController(
+        ToolCallGuardrailConfig(hard_stop_enabled=True, exact_failure_block_after=2, same_tool_failure_halt_after=99)
+    )
+    args = {"query": "same"}
+
+    controller.after_call("web_search", args, '{"error":"boom"}', failed=True)
+    controller.after_call("web_search", args, '{"ok":true}', failed=False)
+
+    assert controller.before_call("web_search", args).action == "allow"
+    controller.after_call("web_search", args, '{"error":"boom"}', failed=True)
+    assert controller.before_call("web_search", args).action == "allow"
+
+
+def test_same_tool_varying_args_warns_by_default_without_halting():
+    controller = ToolCallGuardrailController(
+        ToolCallGuardrailConfig(same_tool_failure_warn_after=2, same_tool_failure_halt_after=3)
+    )
+
+    first = controller.after_call("terminal", {"command": "cmd-1"}, '{"exit_code":1}', failed=True)
+    second = controller.after_call("terminal", {"command": "cmd-2"}, '{"exit_code":1}', failed=True)
+    third = controller.after_call("terminal", {"command": "cmd-3"}, '{"exit_code":1}', failed=True)
+    fourth = controller.after_call("terminal", {"command": "cmd-4"}, '{"exit_code":1}', failed=True)
+
+    assert first.action == "allow"
+    assert [second.action, third.action, fourth.action] == ["warn", "warn", "warn"]
+    assert {second.code, third.code, fourth.code} == {"same_tool_failure_warning"}
+    assert controller.halt_decision is None
+
+
+def test_hard_stop_enabled_halts_same_tool_varying_args_failure_streak():
+    controller = ToolCallGuardrailController(
+        ToolCallGuardrailConfig(
+            hard_stop_enabled=True,
+            exact_failure_block_after=99,
+            same_tool_failure_warn_after=2,
+            same_tool_failure_halt_after=3,
+        )
+    )
+
+    first = controller.after_call("terminal", {"command": "cmd-1"}, '{"exit_code":1}', failed=True)
+    assert first.action == "allow"
+    second = controller.after_call("terminal", {"command": "cmd-2"}, '{"exit_code":1}', failed=True)
+    assert second.action == "warn"
+    assert second.code == "same_tool_failure_warning"
+    third = controller.after_call("terminal", {"command": "cmd-3"}, '{"exit_code":1}', failed=True)
+    assert third.action == "halt"
+    assert third.code == "same_tool_failure_halt"
+    assert third.count == 3
+
+
+def test_idempotent_no_progress_repeated_result_warns_without_blocking_by_default():
+    controller = ToolCallGuardrailController(
+        ToolCallGuardrailConfig(no_progress_warn_after=2, no_progress_block_after=2)
+    )
+    args = {"path": "/tmp/same.txt"}
+    result = "same file contents"
+
+    for _ in range(4):
+        assert controller.before_call("read_file", args).action == "allow"
+        decision = controller.after_call("read_file", args, result, failed=False)
+
+    assert decision.action == "warn"
+    assert decision.code == "idempotent_no_progress_warning"
+    assert controller.before_call("read_file", args).action == "allow"
+    assert controller.halt_decision is None
+
+
+def test_hard_stop_enabled_blocks_idempotent_no_progress_future_repeat():
+    controller = ToolCallGuardrailController(
+        ToolCallGuardrailConfig(
+            hard_stop_enabled=True,
+            no_progress_warn_after=2,
+            no_progress_block_after=2,
+        )
+    )
+    args = {"path": "/tmp/same.txt"}
+    result = "same file contents"
+
+    assert controller.before_call("read_file", args).action == "allow"
+    assert controller.after_call("read_file", args, result, failed=False).action == "allow"
+    assert controller.before_call("read_file", args).action == "allow"
+    warn = controller.after_call("read_file", args, result, failed=False)
+    assert warn.action == "warn"
+    assert warn.code == "idempotent_no_progress_warning"
+
+    blocked = controller.before_call("read_file", args)
+    assert blocked.action == "block"
+    assert blocked.code == "idempotent_no_progress_block"
+
+
+def test_mutating_or_unknown_tools_are_not_blocked_for_repeated_identical_success_output_by_default():
+    controller = ToolCallGuardrailController(
+        ToolCallGuardrailConfig(no_progress_warn_after=2, no_progress_block_after=2)
+    )
+
+    for _ in range(3):
+        assert controller.before_call("write_file", {"path": "/tmp/x", "content": "x"}).action == "allow"
+        assert controller.after_call("write_file", {"path": "/tmp/x", "content": "x"}, "ok", failed=False).action == "allow"
+        assert controller.before_call("custom_tool", {"x": 1}).action == "allow"
+        assert controller.after_call("custom_tool", {"x": 1}, "ok", failed=False).action == "allow"
+
+
+def test_reset_for_turn_clears_bounded_guardrail_state():
+    controller = ToolCallGuardrailController(
+        ToolCallGuardrailConfig(hard_stop_enabled=True, exact_failure_block_after=2, no_progress_block_after=2)
+    )
+    controller.after_call("web_search", {"query": "same"}, '{"error":"boom"}', failed=True)
+    controller.after_call("web_search", {"query": "same"}, '{"error":"boom"}', failed=True)
+    controller.after_call("read_file", {"path": "/tmp/x"}, "same", failed=False)
+    controller.after_call("read_file", {"path": "/tmp/x"}, "same", failed=False)
+
+    assert controller.before_call("web_search", {"query": "same"}).action == "block"
+    assert controller.before_call("read_file", {"path": "/tmp/x"}).action == "block"
+
+    controller.reset_for_turn()
+
+    assert controller.before_call("web_search", {"query": "same"}).action == "allow"
+    assert controller.before_call("read_file", {"path": "/tmp/x"}).action == "allow"

tests/cli/test_manual_compress.py

@@ -21,20 +21,21 @@ def test_manual_compress_reports_noop_without_success_banner(capsys):
     shell.agent = MagicMock()
     shell.agent.compression_enabled = True
     shell.agent._cached_system_prompt = ""
+    shell.agent.tools = None
     shell.agent.session_id = shell.session_id  # no-op compression: no split
     shell.agent._compress_context.return_value = (list(history), "")
 
-    def _estimate(messages):
+    def _estimate(messages, **_kwargs):
         assert messages == history
         return 100
 
-    with patch("agent.model_metadata.estimate_messages_tokens_rough", side_effect=_estimate):
+    with patch("agent.model_metadata.estimate_request_tokens_rough", side_effect=_estimate):
         shell._manual_compress()
 
     output = capsys.readouterr().out
     assert "No changes from compression" in output
     assert "✅ Compressed" not in output
-    assert "Rough transcript estimate: ~100 tokens (unchanged)" in output
+    assert "Approx request size: ~100 tokens (unchanged)" in output
 
 
 def test_manual_compress_explains_when_token_estimate_rises(capsys):
@@ -49,22 +50,23 @@ def test_manual_compress_explains_when_token_estimate_rises(capsys):
     shell.agent = MagicMock()
     shell.agent.compression_enabled = True
     shell.agent._cached_system_prompt = ""
+    shell.agent.tools = None
     shell.agent.session_id = shell.session_id  # no-op: no split
     shell.agent._compress_context.return_value = (compressed, "")
 
-    def _estimate(messages):
+    def _estimate(messages, **_kwargs):
         if messages == history:
             return 100
         if messages == compressed:
             return 120
         raise AssertionError(f"unexpected transcript: {messages!r}")
 
-    with patch("agent.model_metadata.estimate_messages_tokens_rough", side_effect=_estimate):
+    with patch("agent.model_metadata.estimate_request_tokens_rough", side_effect=_estimate):
         shell._manual_compress()
 
     output = capsys.readouterr().out
     assert "✅ Compressed: 4 → 3 messages" in output
-    assert "Rough transcript estimate: ~100 → ~120 tokens" in output
+    assert "Approx request size: ~100 → ~120 tokens" in output
     assert "denser summaries" in output
 
 
@@ -89,6 +91,7 @@ def test_manual_compress_syncs_session_id_after_split():
     shell.agent = MagicMock()
     shell.agent.compression_enabled = True
     shell.agent._cached_system_prompt = ""
+    shell.agent.tools = None
     # Simulate _compress_context mutating agent.session_id as a side effect.
     def _fake_compress(*args, **kwargs):
         shell.agent.session_id = new_child_id
@@ -97,7 +100,7 @@ def test_manual_compress_syncs_session_id_after_split():
     shell.agent.session_id = old_id  # starts in sync
     shell._pending_title = "stale title"
 
-    with patch("agent.model_metadata.estimate_messages_tokens_rough", return_value=100):
+    with patch("agent.model_metadata.estimate_request_tokens_rough", return_value=100):
         shell._manual_compress()
 
     # CLI session_id must now point at the continuation child, not the parent.
@@ -118,11 +121,12 @@ def test_manual_compress_no_sync_when_session_id_unchanged():
     shell.agent = MagicMock()
     shell.agent.compression_enabled = True
     shell.agent._cached_system_prompt = ""
+    shell.agent.tools = None
     shell.agent.session_id = shell.session_id
     shell.agent._compress_context.return_value = (list(history), "")
     shell._pending_title = "keep me"
 
-    with patch("agent.model_metadata.estimate_messages_tokens_rough", return_value=100):
+    with patch("agent.model_metadata.estimate_request_tokens_rough", return_value=100):
         shell._manual_compress()
 
     # No split → pending title untouched.

tests/cron/test_rewrite_skill_refs.py

@@ -0,0 +1,289 @@
+"""Tests for cron.jobs.rewrite_skill_refs — the curator integration that
+keeps scheduled cron jobs pointing at the right skill names after a
+consolidation / pruning pass.
+
+Bug this fixes: when the curator consolidates skill X into umbrella Y,
+any cron job whose ``skills`` list contains X would silently fail to
+load X at run time (the scheduler logs a warning and skips it), so the
+job runs without the instructions it was scheduled to follow.
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import pytest
+
+# Ensure project root is importable
+sys.path.insert(0, str(Path(__file__).parent.parent.parent))
+
+
+@pytest.fixture
+def cron_env(tmp_path, monkeypatch):
+    """Isolated cron environment with temp HERMES_HOME."""
+    hermes_home = tmp_path / ".hermes"
+    hermes_home.mkdir()
+    (hermes_home / "cron").mkdir()
+    (hermes_home / "cron" / "output").mkdir()
+    monkeypatch.setenv("HERMES_HOME", str(hermes_home))
+
+    import cron.jobs as jobs_mod
+    monkeypatch.setattr(jobs_mod, "HERMES_DIR", hermes_home)
+    monkeypatch.setattr(jobs_mod, "CRON_DIR", hermes_home / "cron")
+    monkeypatch.setattr(jobs_mod, "JOBS_FILE", hermes_home / "cron" / "jobs.json")
+    monkeypatch.setattr(jobs_mod, "OUTPUT_DIR", hermes_home / "cron" / "output")
+
+    return hermes_home
+
+
+class TestRewriteSkillRefsNoop:
+    """No jobs, no rewrites, no map — every combination of empty inputs."""
+
+    def test_empty_map_and_no_jobs(self, cron_env):
+        from cron.jobs import rewrite_skill_refs
+
+        report = rewrite_skill_refs(consolidated={}, pruned=[])
+        assert report == {"rewrites": [], "jobs_updated": 0, "jobs_scanned": 0}
+
+    def test_jobs_exist_but_map_empty(self, cron_env):
+        from cron.jobs import create_job, rewrite_skill_refs
+
+        create_job(prompt="", schedule="every 1h", skills=["foo"])
+        report = rewrite_skill_refs(consolidated={}, pruned=[])
+        assert report["jobs_updated"] == 0
+        # Early return: we don't even scan when there's nothing to apply.
+        assert report["jobs_scanned"] == 0
+
+    def test_jobs_exist_but_no_match(self, cron_env):
+        from cron.jobs import create_job, get_job, rewrite_skill_refs
+
+        job = create_job(prompt="", schedule="every 1h", skills=["foo"])
+        report = rewrite_skill_refs(
+            consolidated={"unrelated": "umbrella"},
+            pruned=["other"],
+        )
+        assert report["jobs_updated"] == 0
+        assert report["jobs_scanned"] == 1
+        # Job untouched
+        loaded = get_job(job["id"])
+        assert loaded["skills"] == ["foo"]
+
+
+class TestRewriteSkillRefsConsolidation:
+    """Consolidated skills should be replaced with their umbrella target."""
+
+    def test_single_skill_replaced(self, cron_env):
+        from cron.jobs import create_job, get_job, rewrite_skill_refs
+
+        job = create_job(prompt="", schedule="every 1h", skills=["legacy-skill"])
+        report = rewrite_skill_refs(
+            consolidated={"legacy-skill": "umbrella-skill"},
+            pruned=[],
+        )
+
+        assert report["jobs_updated"] == 1
+        loaded = get_job(job["id"])
+        assert loaded["skills"] == ["umbrella-skill"]
+        # Legacy ``skill`` field realigned
+        assert loaded["skill"] == "umbrella-skill"
+
+    def test_multiple_skills_one_consolidated(self, cron_env):
+        from cron.jobs import create_job, get_job, rewrite_skill_refs
+
+        job = create_job(
+            prompt="",
+            schedule="every 1h",
+            skills=["keep-a", "legacy", "keep-b"],
+        )
+        rewrite_skill_refs(consolidated={"legacy": "umbrella"}, pruned=[])
+
+        loaded = get_job(job["id"])
+        # Ordering preserved, legacy replaced in-place
+        assert loaded["skills"] == ["keep-a", "umbrella", "keep-b"]
+
+    def test_umbrella_already_in_list_dedupes(self, cron_env):
+        from cron.jobs import create_job, get_job, rewrite_skill_refs
+
+        # Job already loads the umbrella AND the legacy sub-skill
+        job = create_job(
+            prompt="",
+            schedule="every 1h",
+            skills=["umbrella", "legacy"],
+        )
+        rewrite_skill_refs(consolidated={"legacy": "umbrella"}, pruned=[])
+
+        loaded = get_job(job["id"])
+        # No duplicate — the umbrella stays exactly once
+        assert loaded["skills"] == ["umbrella"]
+
+    def test_rewrite_report_records_mapping(self, cron_env):
+        from cron.jobs import create_job, rewrite_skill_refs
+
+        job = create_job(
+            prompt="",
+            schedule="every 1h",
+            skills=["a", "b"],
+            name="my-job",
+        )
+        report = rewrite_skill_refs(
+            consolidated={"a": "umbrella-a", "b": "umbrella-b"},
+            pruned=[],
+        )
+
+        assert len(report["rewrites"]) == 1
+        entry = report["rewrites"][0]
+        assert entry["job_id"] == job["id"]
+        assert entry["job_name"] == "my-job"
+        assert entry["before"] == ["a", "b"]
+        assert entry["after"] == ["umbrella-a", "umbrella-b"]
+        assert entry["mapped"] == {"a": "umbrella-a", "b": "umbrella-b"}
+        assert entry["dropped"] == []
+
+
+class TestRewriteSkillRefsPruning:
+    """Pruned skills should be dropped outright (no forwarding target)."""
+
+    def test_pruned_skill_dropped(self, cron_env):
+        from cron.jobs import create_job, get_job, rewrite_skill_refs
+
+        job = create_job(
+            prompt="",
+            schedule="every 1h",
+            skills=["keep", "stale"],
+        )
+        report = rewrite_skill_refs(consolidated={}, pruned=["stale"])
+
+        assert report["jobs_updated"] == 1
+        loaded = get_job(job["id"])
+        assert loaded["skills"] == ["keep"]
+        assert loaded["skill"] == "keep"
+
+    def test_all_skills_pruned_leaves_empty_list(self, cron_env):
+        from cron.jobs import create_job, get_job, rewrite_skill_refs
+
+        job = create_job(prompt="", schedule="every 1h", skills=["gone"])
+        rewrite_skill_refs(consolidated={}, pruned=["gone"])
+
+        loaded = get_job(job["id"])
+        assert loaded["skills"] == []
+        assert loaded["skill"] is None
+
+    def test_pruned_report_records_drops(self, cron_env):
+        from cron.jobs import create_job, rewrite_skill_refs
+
+        create_job(prompt="", schedule="every 1h", skills=["keep", "stale"])
+        report = rewrite_skill_refs(consolidated={}, pruned=["stale"])
+
+        entry = report["rewrites"][0]
+        assert entry["dropped"] == ["stale"]
+        assert entry["mapped"] == {}
+
+
+class TestRewriteSkillRefsMixed:
+    """Consolidation + pruning in the same pass."""
+
+    def test_mixed_consolidation_and_pruning(self, cron_env):
+        from cron.jobs import create_job, get_job, rewrite_skill_refs
+
+        job = create_job(
+            prompt="",
+            schedule="every 1h",
+            skills=["keep", "legacy", "stale"],
+        )
+        rewrite_skill_refs(
+            consolidated={"legacy": "umbrella"},
+            pruned=["stale"],
+        )
+
+        loaded = get_job(job["id"])
+        assert loaded["skills"] == ["keep", "umbrella"]
+
+    def test_skill_in_both_maps_wins_as_consolidated(self, cron_env):
+        """Defensive: if a skill appears in both lists (shouldn't happen
+        in practice), prefer consolidation — it has a forwarding target,
+        which is the more useful outcome."""
+        from cron.jobs import create_job, get_job, rewrite_skill_refs
+
+        job = create_job(prompt="", schedule="every 1h", skills=["ambiguous"])
+        rewrite_skill_refs(
+            consolidated={"ambiguous": "umbrella"},
+            pruned=["ambiguous"],
+        )
+
+        loaded = get_job(job["id"])
+        assert loaded["skills"] == ["umbrella"]
+
+
+class TestRewriteSkillRefsMultipleJobs:
+    """Multiple jobs, some affected, some not."""
+
+    def test_only_affected_jobs_reported(self, cron_env):
+        from cron.jobs import create_job, get_job, rewrite_skill_refs
+
+        j1 = create_job(prompt="", schedule="every 1h", skills=["legacy"])
+        j2 = create_job(prompt="", schedule="every 1h", skills=["untouched"])
+        j3 = create_job(prompt="", schedule="every 1h", skills=[])
+
+        report = rewrite_skill_refs(
+            consolidated={"legacy": "umbrella"},
+            pruned=[],
+        )
+
+        assert report["jobs_updated"] == 1
+        assert report["jobs_scanned"] == 3
+        assert len(report["rewrites"]) == 1
+        assert report["rewrites"][0]["job_id"] == j1["id"]
+
+        # Untouched jobs stay put
+        assert get_job(j2["id"])["skills"] == ["untouched"]
+        assert get_job(j3["id"])["skills"] == []
+
+    def test_legacy_skill_field_also_rewritten(self, cron_env):
+        """Old jobs may have the legacy single-skill ``skill`` field
+        set instead of ``skills``. Both paths should be rewritten."""
+        from cron.jobs import create_job, get_job, rewrite_skill_refs
+
+        # Create via the legacy ``skill`` argument
+        job = create_job(
+            prompt="",
+            schedule="every 1h",
+            skill="legacy",
+        )
+        rewrite_skill_refs(consolidated={"legacy": "umbrella"}, pruned=[])
+
+        loaded = get_job(job["id"])
+        assert loaded["skills"] == ["umbrella"]
+        assert loaded["skill"] == "umbrella"
+
+
+class TestRewriteSkillRefsPersistence:
+    """Rewrites persist to disk and survive a reload."""
+
+    def test_changes_persist_across_reload(self, cron_env):
+        import json
+        from cron.jobs import create_job, rewrite_skill_refs, JOBS_FILE
+
+        create_job(prompt="", schedule="every 1h", skills=["legacy"])
+        rewrite_skill_refs(consolidated={"legacy": "umbrella"}, pruned=[])
+
+        # Read raw file contents
+        data = json.loads(JOBS_FILE.read_text())
+        assert data["jobs"][0]["skills"] == ["umbrella"]
+        assert data["jobs"][0]["skill"] == "umbrella"
+
+    def test_noop_does_not_rewrite_file(self, cron_env):
+        from cron.jobs import create_job, rewrite_skill_refs, JOBS_FILE
+
+        create_job(prompt="", schedule="every 1h", skills=["keep"])
+        mtime_before = JOBS_FILE.stat().st_mtime_ns
+
+        # Nothing in the map matches
+        report = rewrite_skill_refs(
+            consolidated={"unrelated": "umbrella"},
+            pruned=["other"],
+        )
+
+        assert report["jobs_updated"] == 0
+        # File untouched — no pointless disk write
+        assert JOBS_FILE.stat().st_mtime_ns == mtime_before

tests/gateway/feishu_helpers.py

@@ -0,0 +1,65 @@
+"""Shared fixtures for Feishu adapter tests (admission, group policy, dispatch)."""
+
+from __future__ import annotations
+
+import threading
+from types import SimpleNamespace
+from typing import Any, Optional
+
+
+def make_sender(sender_type: str = "user", open_id: str = "ou_human",
+                user_id: Optional[str] = None, union_id: Optional[str] = None) -> Any:
+    return SimpleNamespace(
+        sender_type=sender_type,
+        sender_id=SimpleNamespace(open_id=open_id, user_id=user_id, union_id=union_id),
+    )
+
+
+def make_message(message_id: str = "om_xxx", chat_type: str = "p2p",
+                 chat_id: str = "oc_1", mentions: Optional[list] = None) -> Any:
+    return SimpleNamespace(
+        message_id=message_id,
+        chat_type=chat_type,
+        chat_id=chat_id,
+        mentions=mentions,
+        content="",
+        message_type="text",
+    )
+
+
+def make_adapter_skeleton(
+    *,
+    bot_open_id: str = "ou_me",
+    bot_user_id: str = "",
+    allow_bots: str = "none",
+    require_mention: bool = True,
+    group_policy: str = "allowlist",
+) -> Any:
+    from gateway.platforms.feishu import FeishuAdapter
+
+    adapter = object.__new__(FeishuAdapter)
+    adapter._bot_open_id = bot_open_id
+    adapter._bot_user_id = bot_user_id
+    adapter._bot_name = ""
+    adapter._app_id = ""
+    adapter._admins = set()
+    adapter._group_rules = {}
+    adapter._group_policy = group_policy
+    adapter._default_group_policy = group_policy
+    adapter._allowed_group_users = frozenset()
+    adapter._allow_bots = allow_bots
+    adapter._require_mention = require_mention
+    return adapter
+
+
+def install_dedup_state(adapter: Any, seen: Optional[dict] = None) -> None:
+    adapter._seen_message_ids = dict(seen) if seen else {}
+    adapter._seen_message_order = list((seen or {}).keys())
+    adapter._dedup_cache_size = 100
+    adapter._dedup_lock = threading.Lock()
+    adapter._dedup_state_path = None
+    adapter._persist_seen_message_ids = lambda: None
+
+
+def stub_mention(adapter: Any, mentions_self: bool) -> None:
+    adapter._mentions_self = lambda _message: mentions_self

tests/gateway/test_api_server.py

@@ -332,6 +332,36 @@ def auth_adapter():
     return _make_adapter(api_key="sk-secret")
 
 
+# ---------------------------------------------------------------------------
+# Adapter internals
+# ---------------------------------------------------------------------------
+
+
+class TestAgentExecution:
+    @pytest.mark.asyncio
+    async def test_run_agent_uses_session_id_as_task_id(self, adapter):
+        mock_agent = MagicMock()
+        mock_agent.run_conversation.return_value = {"final_response": "ok"}
+        mock_agent.session_prompt_tokens = 1
+        mock_agent.session_completion_tokens = 2
+        mock_agent.session_total_tokens = 3
+
+        with patch.object(adapter, "_create_agent", return_value=mock_agent):
+            result, usage = await adapter._run_agent(
+                user_message="hello",
+                conversation_history=[],
+                session_id="session-123",
+            )
+
+        assert result == {"final_response": "ok"}
+        assert usage == {"input_tokens": 1, "output_tokens": 2, "total_tokens": 3}
+        mock_agent.run_conversation.assert_called_once_with(
+            user_message="hello",
+            conversation_history=[],
+            task_id="session-123",
+        )
+
+
 # ---------------------------------------------------------------------------
 # /health endpoint
 # ---------------------------------------------------------------------------

tests/gateway/test_api_server_runs.py

@@ -253,10 +253,7 @@ class TestRunStatus:
                     await asyncio.sleep(0.05)
 
                 mock_agent.run_conversation.assert_called_once()
-                # task_id stays "default" so the Runs API shares one sandbox
-                # container with CLI/gateway; session_id is surfaced in status
-                # for external UIs to correlate runs with their own session IDs.
-                assert mock_agent.run_conversation.call_args.kwargs["task_id"] == "default"
+                assert mock_agent.run_conversation.call_args.kwargs["task_id"] == "space-session"
                 assert status["session_id"] == "space-session"
 
     @pytest.mark.asyncio

tests/gateway/test_approve_deny_commands.py

@@ -173,6 +173,23 @@ class TestBlockingGatewayApproval:
         assert e1.event.is_set()
         assert e2.event.is_set()
 
+    def test_clear_session_denies_and_signals_all_entries(self):
+        """clear_session must wake blocked entries during boundary cleanup."""
+        from tools.approval import clear_session, _ApprovalEntry, _gateway_queues
+
+        session_key = "test-boundary-cleanup"
+        e1 = _ApprovalEntry({"command": "cmd1"})
+        e2 = _ApprovalEntry({"command": "cmd2"})
+        _gateway_queues[session_key] = [e1, e2]
+
+        clear_session(session_key)
+
+        assert e1.event.is_set()
+        assert e2.event.is_set()
+        assert e1.result == "deny"
+        assert e2.result == "deny"
+        assert session_key not in _gateway_queues
+
 
 # ------------------------------------------------------------------
 # /approve command

tests/gateway/test_compress_command.py

@@ -64,11 +64,13 @@ async def test_compress_command_reports_noop_without_success_banner():
     agent_instance = MagicMock()
     agent_instance.shutdown_memory_provider = MagicMock()
     agent_instance.close = MagicMock()
+    agent_instance._cached_system_prompt = ""
+    agent_instance.tools = None
     agent_instance.context_compressor.has_content_to_compress.return_value = True
     agent_instance.session_id = "sess-1"
     agent_instance._compress_context.return_value = (list(history), "")
 
-    def _estimate(messages):
+    def _estimate(messages, **_kwargs):
         assert messages == history
         return 100
 
@@ -76,13 +78,13 @@ async def test_compress_command_reports_noop_without_success_banner():
         patch("gateway.run._resolve_runtime_agent_kwargs", return_value={"api_key": "test-key"}),
         patch("gateway.run._resolve_gateway_model", return_value="test-model"),
         patch("run_agent.AIAgent", return_value=agent_instance),
-        patch("agent.model_metadata.estimate_messages_tokens_rough", side_effect=_estimate),
+        patch("agent.model_metadata.estimate_request_tokens_rough", side_effect=_estimate),
     ):
         result = await runner._handle_compress_command(_make_event())
 
     assert "No changes from compression" in result
     assert "Compressed:" not in result
-    assert "Rough transcript estimate: ~100 tokens (unchanged)" in result
+    assert "Approx request size: ~100 tokens (unchanged)" in result
     agent_instance.shutdown_memory_provider.assert_called_once()
     agent_instance.close.assert_called_once()
 
@@ -99,11 +101,13 @@ async def test_compress_command_explains_when_token_estimate_rises():
     agent_instance = MagicMock()
     agent_instance.shutdown_memory_provider = MagicMock()
     agent_instance.close = MagicMock()
+    agent_instance._cached_system_prompt = ""
+    agent_instance.tools = None
     agent_instance.context_compressor.has_content_to_compress.return_value = True
     agent_instance.session_id = "sess-1"
     agent_instance._compress_context.return_value = (compressed, "")
 
-    def _estimate(messages):
+    def _estimate(messages, **_kwargs):
         if messages == history:
             return 100
         if messages == compressed:
@@ -114,12 +118,12 @@ async def test_compress_command_explains_when_token_estimate_rises():
         patch("gateway.run._resolve_runtime_agent_kwargs", return_value={"api_key": "test-key"}),
         patch("gateway.run._resolve_gateway_model", return_value="test-model"),
         patch("run_agent.AIAgent", return_value=agent_instance),
-        patch("agent.model_metadata.estimate_messages_tokens_rough", side_effect=_estimate),
+        patch("agent.model_metadata.estimate_request_tokens_rough", side_effect=_estimate),
     ):
         result = await runner._handle_compress_command(_make_event())
 
     assert "Compressed: 4 → 3 messages" in result
-    assert "Rough transcript estimate: ~100 → ~120 tokens" in result
+    assert "Approx request size: ~100 → ~120 tokens" in result
     assert "denser summaries" in result
     agent_instance.shutdown_memory_provider.assert_called_once()
     agent_instance.close.assert_called_once()
@@ -143,6 +147,8 @@ async def test_compress_command_appends_warning_when_summary_generation_fails():
     agent_instance = MagicMock()
     agent_instance.shutdown_memory_provider = MagicMock()
     agent_instance.close = MagicMock()
+    agent_instance._cached_system_prompt = ""
+    agent_instance.tools = None
     agent_instance.context_compressor.has_content_to_compress.return_value = True
     # Simulate summary-generation failure: fallback flag set, dropped count
     # populated, error string captured.
@@ -154,7 +160,7 @@ async def test_compress_command_appends_warning_when_summary_generation_fails():
     agent_instance.session_id = "sess-1"
     agent_instance._compress_context.return_value = (compressed, "")
 
-    def _estimate(messages):
+    def _estimate(messages, **_kwargs):
         if messages == history:
             return 100
         if messages == compressed:
@@ -165,7 +171,7 @@ async def test_compress_command_appends_warning_when_summary_generation_fails():
         patch("gateway.run._resolve_runtime_agent_kwargs", return_value={"api_key": "***"}),
         patch("gateway.run._resolve_gateway_model", return_value="test-model"),
         patch("run_agent.AIAgent", return_value=agent_instance),
-        patch("agent.model_metadata.estimate_messages_tokens_rough", side_effect=_estimate),
+        patch("agent.model_metadata.estimate_request_tokens_rough", side_effect=_estimate),
     ):
         result = await runner._handle_compress_command(_make_event())
 
@@ -200,6 +206,8 @@ async def test_compress_command_surfaces_aux_model_failure_even_when_recovered()
     agent_instance = MagicMock()
     agent_instance.shutdown_memory_provider = MagicMock()
     agent_instance.close = MagicMock()
+    agent_instance._cached_system_prompt = ""
+    agent_instance.tools = None
     agent_instance.context_compressor.has_content_to_compress.return_value = True
     # Fallback placeholder was NOT used — recovery succeeded.
     agent_instance.context_compressor._last_summary_fallback_used = False
@@ -215,7 +223,7 @@ async def test_compress_command_surfaces_aux_model_failure_even_when_recovered()
     agent_instance.session_id = "sess-1"
     agent_instance._compress_context.return_value = (compressed, "")
 
-    def _estimate(messages):
+    def _estimate(messages, **_kwargs):
         if messages == history:
             return 100
         if messages == compressed:
@@ -226,7 +234,7 @@ async def test_compress_command_surfaces_aux_model_failure_even_when_recovered()
         patch("gateway.run._resolve_runtime_agent_kwargs", return_value={"api_key": "***"}),
         patch("gateway.run._resolve_gateway_model", return_value="test-model"),
         patch("run_agent.AIAgent", return_value=agent_instance),
-        patch("agent.model_metadata.estimate_messages_tokens_rough", side_effect=_estimate),
+        patch("agent.model_metadata.estimate_request_tokens_rough", side_effect=_estimate),
     ):
         result = await runner._handle_compress_command(_make_event())
 

tests/gateway/test_config.py

@@ -9,6 +9,7 @@ from gateway.config import (
     Platform,
     PlatformConfig,
     SessionResetPolicy,
+    StreamingConfig,
     _apply_env_overrides,
     load_gateway_config,
 )
@@ -149,6 +150,24 @@ class TestSessionResetPolicy:
         assert restored.notify is False
 
 
+class TestStreamingConfig:
+    def test_from_dict_coerces_quoted_false_enabled(self):
+        restored = StreamingConfig.from_dict({"enabled": "false"})
+        assert restored.enabled is False
+
+    def test_from_dict_malformed_numeric_values_fall_back_to_defaults(self):
+        restored = StreamingConfig.from_dict(
+            {
+                "edit_interval": "oops",
+                "buffer_threshold": "oops",
+                "fresh_final_after_seconds": "oops",
+            }
+        )
+        assert restored.edit_interval == 1.0
+        assert restored.buffer_threshold == 40
+        assert restored.fresh_final_after_seconds == 60.0
+
+
 class TestGatewayConfigRoundtrip:
     def test_full_roundtrip(self):
         config = GatewayConfig(
@@ -194,6 +213,26 @@ class TestGatewayConfigRoundtrip:
         restored = GatewayConfig.from_dict({"always_log_local": "false"})
         assert restored.always_log_local is False
 
+    def test_get_notice_delivery_defaults_to_public(self):
+        config = GatewayConfig(
+            platforms={Platform.SLACK: PlatformConfig(enabled=True, token="***")}
+        )
+
+        assert config.get_notice_delivery(Platform.SLACK) == "public"
+
+    def test_get_notice_delivery_honors_platform_override(self):
+        config = GatewayConfig(
+            platforms={
+                Platform.SLACK: PlatformConfig(
+                    enabled=True,
+                    token="***",
+                    extra={"notice_delivery": "private"},
+                ),
+            }
+        )
+
+        assert config.get_notice_delivery(Platform.SLACK) == "private"
+
 
 class TestLoadGatewayConfig:
     def test_bridges_quick_commands_from_config_yaml(self, tmp_path, monkeypatch):
@@ -360,6 +399,38 @@ class TestLoadGatewayConfig:
             "C01ABC": "Code review mode",
         }
 
+    def test_bridges_feishu_allow_bots_from_config_yaml_to_env(self, tmp_path, monkeypatch):
+        hermes_home = tmp_path / ".hermes"
+        hermes_home.mkdir()
+        config_path = hermes_home / "config.yaml"
+        config_path.write_text(
+            "feishu:\n  allow_bots: mentions\n",
+            encoding="utf-8",
+        )
+
+        monkeypatch.setenv("HERMES_HOME", str(hermes_home))
+        monkeypatch.delenv("FEISHU_ALLOW_BOTS", raising=False)
+
+        load_gateway_config()
+
+        assert os.environ.get("FEISHU_ALLOW_BOTS") == "mentions"
+
+    def test_feishu_allow_bots_env_takes_precedence_over_config_yaml(self, tmp_path, monkeypatch):
+        hermes_home = tmp_path / ".hermes"
+        hermes_home.mkdir()
+        config_path = hermes_home / "config.yaml"
+        config_path.write_text(
+            "feishu:\n  allow_bots: all\n",
+            encoding="utf-8",
+        )
+
+        monkeypatch.setenv("HERMES_HOME", str(hermes_home))
+        monkeypatch.setenv("FEISHU_ALLOW_BOTS", "none")
+
+        load_gateway_config()
+
+        assert os.environ.get("FEISHU_ALLOW_BOTS") == "none"
+
     def test_invalid_quick_commands_in_config_yaml_are_ignored(self, tmp_path, monkeypatch):
         hermes_home = tmp_path / ".hermes"
         hermes_home.mkdir()
@@ -406,6 +477,22 @@ class TestLoadGatewayConfig:
 
         assert config.platforms[Platform.TELEGRAM].extra["disable_link_previews"] is True
 
+    def test_bridges_notice_delivery_from_config_yaml(self, tmp_path, monkeypatch):
+        hermes_home = tmp_path / ".hermes"
+        hermes_home.mkdir()
+        config_path = hermes_home / "config.yaml"
+        config_path.write_text(
+            "slack:\n"
+            "  notice_delivery: private\n",
+            encoding="utf-8",
+        )
+
+        monkeypatch.setenv("HERMES_HOME", str(hermes_home))
+
+        config = load_gateway_config()
+
+        assert config.get_notice_delivery(Platform.SLACK) == "private"
+
     def test_bridges_telegram_proxy_url_from_config_yaml(self, tmp_path, monkeypatch):
         hermes_home = tmp_path / ".hermes"
         hermes_home.mkdir()
@@ -455,6 +542,15 @@ class TestHomeChannelEnvOverrides:
                 {"SLACK_HOME_CHANNEL": "C123", "SLACK_HOME_CHANNEL_NAME": "Ops"},
                 ("C123", "Ops"),
             ),
+            (
+                Platform.WHATSAPP,
+                PlatformConfig(enabled=True),
+                {
+                    "WHATSAPP_HOME_CHANNEL": "1234567890@lid",
+                    "WHATSAPP_HOME_CHANNEL_NAME": "Owner DM",
+                },
+                ("1234567890@lid", "Owner DM"),
+            ),
             (
                 Platform.SIGNAL,
                 PlatformConfig(

tests/gateway/test_delivery.py

@@ -65,4 +65,62 @@ class TestTargetToStringRoundtrip:
         assert reparsed.chat_id == "999"
 
 
+class TestCaseSensitiveChatIdParsing:
+    """Test that chat IDs preserve their original case (issue #11768)."""
+    
+    def test_slack_uppercase_chat_id_preserved(self):
+        """Slack channel IDs like C123ABC should preserve case."""
+        target = DeliveryTarget.parse("slack:C123ABC")
+        assert target.platform == Platform.SLACK
+        assert target.chat_id == "C123ABC"  # Should NOT be lowercased to c123abc
+        assert target.is_explicit is True
+    
+    def test_slack_chat_id_with_thread_preserved(self):
+        """Slack channel:thread IDs should preserve case."""
+        target = DeliveryTarget.parse("slack:C123ABC:thread123")
+        assert target.platform == Platform.SLACK
+        assert target.chat_id == "C123ABC"
+        assert target.thread_id == "thread123"
+    
+    def test_matrix_room_id_preserved(self):
+        """Matrix room IDs like !RoomABC:example.org should preserve case.
+        
+        Note: Matrix room IDs contain colons (e.g., !RoomABC:example.org).
+        Due to the platform:chat_id:thread_id format, these are parsed as
+        chat_id=!RoomABC and thread_id=example.org. This is a known limitation
+        of the current format. The fix preserves case but doesn't change the
+        parsing structure.
+        """
+        target = DeliveryTarget.parse("matrix:!RoomABC:example.org")
+        assert target.platform == Platform.MATRIX
+        # The room ID is split at the first colon after the platform prefix
+        # This is a format limitation - the case is preserved but the structure is split
+        assert target.chat_id == "!RoomABC"
+        assert target.thread_id == "example.org"
+    
+    def test_mixed_case_chat_id_roundtrip(self):
+        """Mixed-case chat IDs should survive parse-to_string roundtrip."""
+        original = "telegram:ChatId123ABC"
+        target = DeliveryTarget.parse(original)
+        s = target.to_string()
+        reparsed = DeliveryTarget.parse(s)
+        assert reparsed.chat_id == "ChatId123ABC"
+
+
+class TestPlatformNameCaseInsensitivity:
+    """Test that platform names are case-insensitive."""
+    
+    def test_uppercase_platform_name(self):
+        """Platform names should be case-insensitive."""
+        target = DeliveryTarget.parse("TELEGRAM:12345")
+        assert target.platform == Platform.TELEGRAM
+        assert target.chat_id == "12345"
+    
+    def test_mixed_case_platform_name(self):
+        """Mixed-case platform names should work."""
+        target = DeliveryTarget.parse("TeleGram:12345")
+        assert target.platform == Platform.TELEGRAM
+        assert target.chat_id == "12345"
+
+
 

tests/gateway/test_discord_free_response.py

@@ -220,6 +220,26 @@ async def test_discord_free_response_channel_can_come_from_config_extra(adapter,
     assert event.text == "allowed from config"
 
 
+def test_discord_free_response_channels_bare_int(adapter, monkeypatch):
+    # YAML `discord.free_response_channels: 1491973769726791812` (single bare
+    # integer) is loaded as an int and previously fell through the
+    # isinstance(str) branch in _discord_free_response_channels, silently
+    # returning an empty set.  Scalar → str coercion makes single-channel
+    # config work without having to quote the ID in YAML.
+    monkeypatch.delenv("DISCORD_FREE_RESPONSE_CHANNELS", raising=False)
+    adapter.config.extra["free_response_channels"] = 1491973769726791812
+
+    assert adapter._discord_free_response_channels() == {"1491973769726791812"}
+
+
+def test_discord_free_response_channels_int_list(adapter, monkeypatch):
+    # YAML list form with bare numeric entries — each element should be coerced.
+    monkeypatch.delenv("DISCORD_FREE_RESPONSE_CHANNELS", raising=False)
+    adapter.config.extra["free_response_channels"] = [1491973769726791812, 99999]
+
+    assert adapter._discord_free_response_channels() == {"1491973769726791812", "99999"}
+
+
 @pytest.mark.asyncio
 async def test_discord_forum_parent_in_free_response_list_allows_forum_thread(adapter, monkeypatch):
     monkeypatch.setenv("DISCORD_REQUIRE_MENTION", "true")

tests/gateway/test_ephemeral_reply.py

@@ -0,0 +1,336 @@
+"""Tests for EphemeralReply — system-notice auto-delete in gateway adapters.
+
+Slash-command handlers in ``gateway/run.py`` can return an
+``EphemeralReply`` wrapper to request auto-deletion of the reply message
+after a TTL.  The base adapter unwraps the sentinel before sending and
+schedules a detached delete task when the platform supports
+``delete_message``.
+
+Covered:
+
+1. ``_unwrap_ephemeral`` returns text + ttl for EphemeralReply, and
+   passes plain strings through unchanged.
+2. TTL is zeroed on platforms that don't override ``delete_message``
+   (silent degrade — message stays in place).
+3. TTL is honored on platforms that DO override ``delete_message``.
+4. ``_schedule_ephemeral_delete`` invokes ``delete_message`` after the
+   configured delay with the correct chat_id / message_id.
+5. ``_process_message_background`` sends the unwrapped text (not the
+   sentinel object) and schedules deletion when appropriate.
+6. The two busy-session bypass paths also unwrap + schedule.
+"""
+
+import asyncio
+from unittest.mock import AsyncMock, patch
+
+import pytest
+
+from gateway.config import Platform, PlatformConfig
+from gateway.platforms.base import (
+    BasePlatformAdapter,
+    EphemeralReply,
+    MessageEvent,
+    MessageType,
+    SendResult,
+)
+from gateway.session import SessionSource
+
+
+class _NoDeleteAdapter(BasePlatformAdapter):
+    """Adapter that does NOT override delete_message (silent degrade)."""
+
+    async def connect(self):
+        pass
+
+    async def disconnect(self):
+        pass
+
+    async def send(self, chat_id, content="", **kwargs):
+        return SendResult(success=True, message_id="m-1")
+
+    async def get_chat_info(self, chat_id):
+        return {}
+
+
+class _DeleteCapableAdapter(BasePlatformAdapter):
+    """Adapter that overrides delete_message (TTL honored)."""
+
+    def __init__(self, *a, **kw):
+        super().__init__(*a, **kw)
+        self.deleted: list[tuple[str, str]] = []
+
+    async def connect(self):
+        pass
+
+    async def disconnect(self):
+        pass
+
+    async def send(self, chat_id, content="", **kwargs):
+        return SendResult(success=True, message_id="m-2")
+
+    async def get_chat_info(self, chat_id):
+        return {}
+
+    async def delete_message(self, chat_id: str, message_id: str) -> bool:
+        self.deleted.append((chat_id, message_id))
+        return True
+
+
+def _no_delete_adapter():
+    return _NoDeleteAdapter(
+        PlatformConfig(enabled=True, token="t"), Platform.TELEGRAM
+    )
+
+
+def _delete_adapter():
+    return _DeleteCapableAdapter(
+        PlatformConfig(enabled=True, token="t"), Platform.TELEGRAM
+    )
+
+
+def _make_event(text="/stop", chat_id="42"):
+    return MessageEvent(
+        text=text,
+        message_id="msg-1",
+        source=SessionSource(
+            platform=Platform.TELEGRAM,
+            chat_id=chat_id,
+            user_id="u-1",
+        ),
+        message_type=MessageType.TEXT,
+    )
+
+
+# ---------------------------------------------------------------------------
+# _unwrap_ephemeral
+# ---------------------------------------------------------------------------
+
+
+def test_unwrap_plain_string_is_passthrough():
+    adapter = _delete_adapter()
+    text, ttl = adapter._unwrap_ephemeral("hello")
+    assert text == "hello"
+    assert ttl == 0
+
+
+def test_unwrap_none_is_passthrough():
+    adapter = _delete_adapter()
+    text, ttl = adapter._unwrap_ephemeral(None)
+    assert text is None
+    assert ttl == 0
+
+
+def test_unwrap_ephemeral_explicit_ttl_on_capable_adapter():
+    adapter = _delete_adapter()
+    text, ttl = adapter._unwrap_ephemeral(EphemeralReply("bye", ttl_seconds=60))
+    assert text == "bye"
+    assert ttl == 60
+
+
+def test_unwrap_ephemeral_zeros_ttl_on_incapable_adapter():
+    """Platforms without delete_message should silently degrade to normal send."""
+    adapter = _no_delete_adapter()
+    text, ttl = adapter._unwrap_ephemeral(EphemeralReply("bye", ttl_seconds=60))
+    assert text == "bye"
+    assert ttl == 0  # forced to 0 — message will stay in place
+
+
+def test_unwrap_ephemeral_default_ttl_from_config():
+    adapter = _delete_adapter()
+    with patch.object(adapter, "_get_ephemeral_system_ttl_default", return_value=120):
+        text, ttl = adapter._unwrap_ephemeral(EphemeralReply("bye"))
+    assert text == "bye"
+    assert ttl == 120
+
+
+def test_unwrap_ephemeral_default_ttl_zero_disables():
+    """Config default of 0 (the shipped default) means the feature is off."""
+    adapter = _delete_adapter()
+    with patch.object(adapter, "_get_ephemeral_system_ttl_default", return_value=0):
+        text, ttl = adapter._unwrap_ephemeral(EphemeralReply("bye"))
+    assert text == "bye"
+    assert ttl == 0
+
+
+def test_unwrap_ephemeral_handles_unreadable_config():
+    adapter = _delete_adapter()
+    with patch.object(
+        adapter,
+        "_get_ephemeral_system_ttl_default",
+        side_effect=RuntimeError("boom"),
+    ):
+        text, ttl = adapter._unwrap_ephemeral(EphemeralReply("bye"))
+    # Fall back to 0 rather than crashing the handler pipeline.
+    assert text == "bye"
+    assert ttl == 0
+
+
+# ---------------------------------------------------------------------------
+# _schedule_ephemeral_delete
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_schedule_ephemeral_delete_calls_delete_after_ttl():
+    adapter = _delete_adapter()
+    # Use a very short TTL to keep the test fast — the implementation
+    # floors sleeps at 1s via ``max(1, int(ttl_seconds))``.  Patch asyncio.sleep
+    # inside the module under test; the test body uses the real one for
+    # scheduler pumping.
+    import gateway.platforms.base as base_module
+
+    sleeps: list[float] = []
+    _real_sleep = base_module.asyncio.sleep
+
+    async def _fake_sleep(duration):
+        sleeps.append(duration)
+        # Yield control so the rest of the task body can run.
+        await _real_sleep(0)
+
+    with patch.object(base_module.asyncio, "sleep", _fake_sleep):
+        adapter._schedule_ephemeral_delete(
+            chat_id="42", message_id="m-2", ttl_seconds=5
+        )
+        # Let the spawned task run.
+        for _ in range(5):
+            await _real_sleep(0)
+
+    # Only the ttl sleep shows up — the test pump uses the real sleep.
+    assert 5 in sleeps
+    assert adapter.deleted == [("42", "m-2")]
+
+
+@pytest.mark.asyncio
+async def test_schedule_ephemeral_delete_swallows_errors():
+    adapter = _delete_adapter()
+
+    async def _boom(*a, **kw):
+        raise RuntimeError("permission denied")
+
+    adapter.delete_message = _boom  # type: ignore[assignment]
+    with patch("gateway.platforms.base.asyncio.sleep", AsyncMock()):
+        adapter._schedule_ephemeral_delete(
+            chat_id="42", message_id="m-2", ttl_seconds=1
+        )
+        # No exception should propagate even though delete_message raised.
+        for _ in range(5):
+            await asyncio.sleep(0)
+
+
+def test_schedule_ephemeral_delete_outside_event_loop_is_noop():
+    """No running loop → no crash, silently drops the request."""
+    adapter = _delete_adapter()
+    # No pytest.mark.asyncio → no loop.  Must not raise.
+    adapter._schedule_ephemeral_delete(
+        chat_id="42", message_id="m-2", ttl_seconds=1
+    )
+    assert adapter.deleted == []
+
+
+# ---------------------------------------------------------------------------
+# _process_message_background unwraps EphemeralReply before send
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_process_message_unwraps_ephemeral_before_send():
+    """The adapter must send the wrapper's .text, never the wrapper object."""
+    adapter = _delete_adapter()
+    adapter._send_with_retry = AsyncMock(
+        return_value=SendResult(success=True, message_id="sent-1")
+    )
+
+    async def _handler(evt):
+        return EphemeralReply("⚡ Stopped.", ttl_seconds=5)
+
+    adapter.set_message_handler(_handler)
+
+    sleeps: list[float] = []
+
+    async def _fake_sleep(duration):
+        sleeps.append(duration)
+
+    event = _make_event()
+    session_key = "agent:main:telegram:private:42"
+    with patch("gateway.platforms.base.asyncio.sleep", _fake_sleep), patch.object(
+        adapter, "_keep_typing", new=AsyncMock()
+    ):
+        await adapter._process_message_background(event, session_key)
+        # Pump until the detached delete task completes.
+        for _ in range(10):
+            await asyncio.sleep(0)
+
+    # Sent text is the unwrapped string, NOT repr(EphemeralReply(...))
+    adapter._send_with_retry.assert_called_once()
+    sent_text = adapter._send_with_retry.call_args.kwargs["content"]
+    assert sent_text == "⚡ Stopped."
+    # Auto-delete scheduled using the returned message_id
+    assert ("42", "sent-1") in adapter.deleted
+
+
+@pytest.mark.asyncio
+async def test_process_message_incapable_platform_does_not_schedule_delete():
+    adapter = _no_delete_adapter()
+    adapter._send_with_retry = AsyncMock(
+        return_value=SendResult(success=True, message_id="sent-1")
+    )
+
+    async def _handler(evt):
+        return EphemeralReply("⚡ Stopped.", ttl_seconds=5)
+
+    adapter.set_message_handler(_handler)
+
+    # Spy on delete_message to confirm it is NOT invoked.
+    delete_calls: list = []
+
+    async def _spy_delete(chat_id, message_id):
+        delete_calls.append((chat_id, message_id))
+        return False
+
+    adapter.delete_message = _spy_delete  # type: ignore[assignment]
+
+    event = _make_event()
+    session_key = "agent:main:telegram:private:42"
+    with patch("gateway.platforms.base.asyncio.sleep", AsyncMock()), patch.object(
+        adapter, "_keep_typing", new=AsyncMock()
+    ):
+        await adapter._process_message_background(event, session_key)
+        for _ in range(10):
+            await asyncio.sleep(0)
+
+    # Send happened with the unwrapped text...
+    adapter._send_with_retry.assert_called_once()
+    assert adapter._send_with_retry.call_args.kwargs["content"] == "⚡ Stopped."
+    # ...but delete was never scheduled because the capability check skipped
+    # the schedule call (TTL was zeroed in _unwrap_ephemeral).
+    # Note: the capability gate on _unwrap_ephemeral checks for
+    # ``type(adapter).delete_message is BasePlatformAdapter.delete_message``.
+    # Monkeypatching the instance does NOT change the class, so this test
+    # verifies the gate uses the class method to detect capability.
+    assert delete_calls == []
+
+
+@pytest.mark.asyncio
+async def test_process_message_plain_string_behaves_unchanged():
+    adapter = _delete_adapter()
+    adapter._send_with_retry = AsyncMock(
+        return_value=SendResult(success=True, message_id="sent-1")
+    )
+
+    async def _handler(evt):
+        return "plain reply"
+
+    adapter.set_message_handler(_handler)
+
+    event = _make_event()
+    session_key = "agent:main:telegram:private:42"
+    with patch("gateway.platforms.base.asyncio.sleep", AsyncMock()), patch.object(
+        adapter, "_keep_typing", new=AsyncMock()
+    ):
+        await adapter._process_message_background(event, session_key)
+        for _ in range(5):
+            await asyncio.sleep(0)
+
+    adapter._send_with_retry.assert_called_once()
+    assert adapter._send_with_retry.call_args.kwargs["content"] == "plain reply"
+    assert adapter.deleted == []  # no auto-delete for plain replies

tests/gateway/test_feishu.py

@@ -8,6 +8,7 @@ import time
 import unittest
 from pathlib import Path
 from types import SimpleNamespace
+from typing import Dict
 from unittest.mock import AsyncMock, Mock, patch
 
 from gateway.platforms.base import ProcessingOutcome
@@ -557,6 +558,16 @@ class TestAdapterModule(unittest.TestCase):
         self.assertEqual(fake_client._ping_interval, 4)
 
 
+def _admits_group(adapter, message, sender_id, chat_id=""):
+    """Group-path shim: run a message through ``_admit`` and return a bool."""
+    sender = SimpleNamespace(sender_type="user", sender_id=sender_id)
+    if not hasattr(message, "chat_type"):
+        message.chat_type = "group"
+    if chat_id:
+        message.chat_id = chat_id
+    return adapter._admit(sender, message) is None
+
+
 class TestAdapterBehavior(unittest.TestCase):
     @patch.dict(os.environ, {}, clear=True)
     def test_build_event_handler_registers_reaction_and_card_processors(self):
@@ -689,6 +700,67 @@ class TestAdapterBehavior(unittest.TestCase):
             adapter._on_reaction_event("im.message.reaction.created_v1", data)
         run_threadsafe.assert_called_once()
 
+    def _build_reaction_adapter(self, *, msg_sender_id: str):
+        """Build a FeishuAdapter wired up to return a single GET-message result."""
+        from gateway.config import PlatformConfig
+        from gateway.platforms.feishu import FeishuAdapter
+
+        adapter = FeishuAdapter(PlatformConfig())
+        adapter._app_id = "cli_self_app"
+        adapter._bot_open_id = "ou_self_bot"
+        adapter._bot_user_id = "u_self_bot"
+
+        msg = SimpleNamespace(
+            sender=SimpleNamespace(sender_type="app", id=msg_sender_id, id_type="app_id"),
+            chat_id="oc_chat",
+            chat_type="group",
+        )
+        response = SimpleNamespace(success=lambda: True, data=SimpleNamespace(items=[msg]))
+        adapter._client = SimpleNamespace(
+            im=SimpleNamespace(
+                v1=SimpleNamespace(message=SimpleNamespace(get=Mock(return_value=response)))
+            )
+        )
+        adapter._build_get_message_request = Mock(return_value=object())
+        adapter._handle_message_with_guards = AsyncMock()
+        adapter._resolve_sender_profile = AsyncMock(
+            return_value={"user_id": "u_human", "user_name": "Human", "user_id_alt": None}
+        )
+        adapter.get_chat_info = AsyncMock(return_value={"name": "Test Chat"})
+        return adapter
+
+    @patch.dict(os.environ, {}, clear=True)
+    def test_reaction_on_peer_bot_message_is_not_routed(self):
+        # GET im/v1/messages sender for bot messages carries id=app_id; a peer
+        # bot's message has a different app_id than ours, so it must be dropped.
+        adapter = self._build_reaction_adapter(msg_sender_id="cli_peer_app")
+
+        event = SimpleNamespace(
+            message_id="om_peer_msg",
+            user_id=SimpleNamespace(open_id="ou_human", user_id=None, union_id=None),
+            reaction_type=SimpleNamespace(emoji_type="THUMBSUP"),
+        )
+        data = SimpleNamespace(event=event)
+        asyncio.run(
+            adapter._handle_reaction_event("im.message.reaction.created_v1", data)
+        )
+        adapter._handle_message_with_guards.assert_not_awaited()
+
+    @patch.dict(os.environ, {}, clear=True)
+    def test_reaction_on_our_own_bot_message_is_routed(self):
+        adapter = self._build_reaction_adapter(msg_sender_id="cli_self_app")
+
+        event = SimpleNamespace(
+            message_id="om_self_msg",
+            user_id=SimpleNamespace(open_id="ou_human", user_id=None, union_id=None),
+            reaction_type=SimpleNamespace(emoji_type="THUMBSUP"),
+        )
+        data = SimpleNamespace(event=event)
+        asyncio.run(
+            adapter._handle_reaction_event("im.message.reaction.created_v1", data)
+        )
+        adapter._handle_message_with_guards.assert_awaited_once()
+
     @patch.dict(os.environ, {"FEISHU_GROUP_POLICY": "open"}, clear=True)
     def test_group_message_requires_mentions_even_when_policy_open(self):
         from gateway.config import PlatformConfig
@@ -697,10 +769,10 @@ class TestAdapterBehavior(unittest.TestCase):
         adapter = FeishuAdapter(PlatformConfig())
         message = SimpleNamespace(mentions=[])
         sender_id = SimpleNamespace(open_id="ou_any", user_id=None)
-        self.assertFalse(adapter._should_accept_group_message(message, sender_id, ""))
+        self.assertFalse(_admits_group(adapter, message, sender_id, ""))
 
         message_with_mention = SimpleNamespace(mentions=[SimpleNamespace(key="@_user_1")])
-        self.assertFalse(adapter._should_accept_group_message(message_with_mention, sender_id, ""))
+        self.assertFalse(_admits_group(adapter, message_with_mention, sender_id, ""))
 
     @patch.dict(os.environ, {"FEISHU_GROUP_POLICY": "open"}, clear=True)
     def test_group_message_with_other_user_mention_is_rejected_when_bot_identity_unknown(self):
@@ -714,59 +786,10 @@ class TestAdapterBehavior(unittest.TestCase):
             id=SimpleNamespace(open_id="ou_other", user_id="u_other"),
         )
 
-        self.assertFalse(adapter._should_accept_group_message(SimpleNamespace(mentions=[other_mention]), sender_id, ""))
-
-    @patch.dict(
-        os.environ,
-        {
-            "FEISHU_BOT_OPEN_ID": "ou_hermes",
-            "FEISHU_BOT_USER_ID": "u_hermes",
-        },
-        clear=True,
-    )
-    def test_other_bot_sender_is_not_treated_as_self_sent_message(self):
-        from gateway.config import PlatformConfig
-        from gateway.platforms.feishu import FeishuAdapter
-
-        adapter = FeishuAdapter(PlatformConfig())
-        event = SimpleNamespace(
-            sender=SimpleNamespace(
-                sender_type="bot",
-                sender_id=SimpleNamespace(open_id="ou_other_bot", user_id="u_other_bot"),
-            )
+        self.assertFalse(
+            _admits_group(adapter, SimpleNamespace(mentions=[other_mention]), sender_id, "")
         )
 
-        self.assertFalse(adapter._is_self_sent_bot_message(event))
-
-    @patch.dict(
-        os.environ,
-        {
-            "FEISHU_BOT_OPEN_ID": "ou_hermes",
-            "FEISHU_BOT_USER_ID": "u_hermes",
-        },
-        clear=True,
-    )
-    def test_self_bot_sender_is_treated_as_self_sent_message(self):
-        from gateway.config import PlatformConfig
-        from gateway.platforms.feishu import FeishuAdapter
-
-        adapter = FeishuAdapter(PlatformConfig())
-        by_open_id = SimpleNamespace(
-            sender=SimpleNamespace(
-                sender_type="bot",
-                sender_id=SimpleNamespace(open_id="ou_hermes", user_id="u_other"),
-            )
-        )
-        by_user_id = SimpleNamespace(
-            sender=SimpleNamespace(
-                sender_type="app",
-                sender_id=SimpleNamespace(open_id="ou_other", user_id="u_hermes"),
-            )
-        )
-
-        self.assertTrue(adapter._is_self_sent_bot_message(by_open_id))
-        self.assertTrue(adapter._is_self_sent_bot_message(by_user_id))
-
     @patch.dict(
         os.environ,
         {
@@ -792,14 +815,14 @@ class TestAdapterBehavior(unittest.TestCase):
         )
 
         self.assertTrue(
-            adapter._should_accept_group_message(
+            _admits_group(adapter,
                 mentioned,
                 SimpleNamespace(open_id="ou_allowed", user_id=None),
                 "",
             )
         )
         self.assertFalse(
-            adapter._should_accept_group_message(
+            _admits_group(adapter,
                 mentioned,
                 SimpleNamespace(open_id="ou_blocked", user_id=None),
                 "",
@@ -828,14 +851,14 @@ class TestAdapterBehavior(unittest.TestCase):
         )
 
         self.assertTrue(
-            adapter._should_accept_group_message(
+            _admits_group(adapter,
                 message,
                 SimpleNamespace(open_id="ou_alice", user_id=None),
                 "oc_chat_a",
             )
         )
         self.assertFalse(
-            adapter._should_accept_group_message(
+            _admits_group(adapter,
                 message,
                 SimpleNamespace(open_id="ou_charlie", user_id=None),
                 "oc_chat_a",
@@ -864,14 +887,14 @@ class TestAdapterBehavior(unittest.TestCase):
         )
 
         self.assertTrue(
-            adapter._should_accept_group_message(
+            _admits_group(adapter,
                 message,
                 SimpleNamespace(open_id="ou_alice", user_id=None),
                 "oc_chat_b",
             )
         )
         self.assertFalse(
-            adapter._should_accept_group_message(
+            _admits_group(adapter,
                 message,
                 SimpleNamespace(open_id="ou_blocked", user_id=None),
                 "oc_chat_b",
@@ -900,14 +923,14 @@ class TestAdapterBehavior(unittest.TestCase):
         )
 
         self.assertTrue(
-            adapter._should_accept_group_message(
+            _admits_group(adapter,
                 message,
                 SimpleNamespace(open_id="ou_admin", user_id=None),
                 "oc_chat_c",
             )
         )
         self.assertFalse(
-            adapter._should_accept_group_message(
+            _admits_group(adapter,
                 message,
                 SimpleNamespace(open_id="ou_regular", user_id=None),
                 "oc_chat_c",
@@ -936,14 +959,14 @@ class TestAdapterBehavior(unittest.TestCase):
         )
 
         self.assertTrue(
-            adapter._should_accept_group_message(
+            _admits_group(adapter,
                 message,
                 SimpleNamespace(open_id="ou_admin", user_id=None),
                 "oc_chat_d",
             )
         )
         self.assertFalse(
-            adapter._should_accept_group_message(
+            _admits_group(adapter,
                 message,
                 SimpleNamespace(open_id="ou_regular", user_id=None),
                 "oc_chat_d",
@@ -973,7 +996,7 @@ class TestAdapterBehavior(unittest.TestCase):
         )
 
         self.assertTrue(
-            adapter._should_accept_group_message(
+            _admits_group(adapter,
                 message,
                 SimpleNamespace(open_id="ou_admin", user_id=None),
                 "oc_chat_e",
@@ -997,7 +1020,7 @@ class TestAdapterBehavior(unittest.TestCase):
         )
 
         self.assertTrue(
-            adapter._should_accept_group_message(
+            _admits_group(adapter,
                 message,
                 SimpleNamespace(open_id="ou_anyone", user_id=None),
                 "oc_chat_unknown",
@@ -1022,8 +1045,12 @@ class TestAdapterBehavior(unittest.TestCase):
             id=SimpleNamespace(open_id="ou_other", user_id="u_other"),
         )
 
-        self.assertTrue(adapter._should_accept_group_message(SimpleNamespace(mentions=[bot_mention]), sender_id, ""))
-        self.assertFalse(adapter._should_accept_group_message(SimpleNamespace(mentions=[other_mention]), sender_id, ""))
+        self.assertTrue(
+            _admits_group(adapter, SimpleNamespace(mentions=[bot_mention]), sender_id, "")
+        )
+        self.assertFalse(
+            _admits_group(adapter, SimpleNamespace(mentions=[other_mention]), sender_id, "")
+        )
 
     @patch.dict(os.environ, {"FEISHU_GROUP_POLICY": "open"}, clear=True)
     def test_group_message_matches_bot_name_when_only_name_available(self):
@@ -1048,8 +1075,12 @@ class TestAdapterBehavior(unittest.TestCase):
             id=SimpleNamespace(open_id=None, user_id=None),
         )
 
-        self.assertTrue(adapter._should_accept_group_message(SimpleNamespace(mentions=[name_only_mention]), sender_id, ""))
-        self.assertFalse(adapter._should_accept_group_message(SimpleNamespace(mentions=[different_mention]), sender_id, ""))
+        self.assertTrue(
+            _admits_group(adapter, SimpleNamespace(mentions=[name_only_mention]), sender_id, "")
+        )
+        self.assertFalse(
+            _admits_group(adapter, SimpleNamespace(mentions=[different_mention]), sender_id, "")
+        )
 
         # Case 2: bot's open_id IS known — a same-name human with different
         # open_id must NOT admit (IDs override names).
@@ -1066,8 +1097,17 @@ class TestAdapterBehavior(unittest.TestCase):
             id=SimpleNamespace(open_id="ou_bot", user_id=None),
         )
 
-        self.assertFalse(adapter2._should_accept_group_message(SimpleNamespace(mentions=[same_name_other_id_mention]), sender_id, ""))
-        self.assertTrue(adapter2._should_accept_group_message(SimpleNamespace(mentions=[bot_mention]), sender_id, ""))
+        self.assertFalse(
+            _admits_group(
+                adapter2,
+                SimpleNamespace(mentions=[same_name_other_id_mention]),
+                sender_id,
+                "",
+            )
+        )
+        self.assertTrue(
+            _admits_group(adapter2, SimpleNamespace(mentions=[bot_mention]), sender_id, "")
+        )
 
     @patch.dict(os.environ, {}, clear=True)
     def test_extract_post_message_as_text(self):
@@ -1411,6 +1451,7 @@ class TestAdapterBehavior(unittest.TestCase):
                 data=SimpleNamespace(event=SimpleNamespace(message=message)),
                 message=message,
                 sender_id=SimpleNamespace(open_id="ou_user", user_id=None, union_id=None),
+                is_bot=False,
                 chat_type="p2p",
                 message_id="om_command",
             )
@@ -1522,13 +1563,14 @@ class TestAdapterBehavior(unittest.TestCase):
             user_id="u_user",
             union_id="on_union",
         )
-        data = SimpleNamespace(event=SimpleNamespace(message=message, sender=SimpleNamespace(sender_id=sender_id)))
+        sender = SimpleNamespace(sender_type="user", sender_id=sender_id)
+        data = SimpleNamespace(event=SimpleNamespace(message=message, sender=sender))
 
         asyncio.run(
             adapter._process_inbound_message(
                 data=data,
                 message=message,
-                sender_id=sender_id,
+                sender_id=sender.sender_id,
                 chat_type="p2p",
                 message_id="om_text",
             )
@@ -1761,13 +1803,14 @@ class TestAdapterBehavior(unittest.TestCase):
             message_id="om_group_text",
         )
         sender_id = SimpleNamespace(open_id="ou_user", user_id=None, union_id=None)
+        sender = SimpleNamespace(sender_type="user", sender_id=sender_id)
         data = SimpleNamespace(event=SimpleNamespace(message=message))
 
         asyncio.run(
             adapter._process_inbound_message(
                 data=data,
                 message=message,
-                sender_id=sender_id,
+                sender_id=sender.sender_id,
                 chat_type="group",
                 message_id="om_group_text",
             )
@@ -1805,6 +1848,7 @@ class TestAdapterBehavior(unittest.TestCase):
                 data=SimpleNamespace(event=SimpleNamespace(message=message)),
                 message=message,
                 sender_id=SimpleNamespace(open_id="ou_user", user_id=None, union_id=None),
+                is_bot=False,
                 chat_type="p2p",
                 message_id="om_reply",
             )
@@ -2667,11 +2711,12 @@ class TestAdapterBehavior(unittest.TestCase):
 
 @unittest.skipUnless(_HAS_LARK_OAPI, "lark-oapi not installed")
 class TestHydrateBotIdentity(unittest.TestCase):
-    """Hydration of bot identity via /open-apis/bot/v3/info and application info.
+    """Hydration of bot identity via ``/open-apis/bot/v3/info``.
 
-    Covers the manual-setup path where FEISHU_BOT_OPEN_ID / FEISHU_BOT_USER_ID
-    are not configured. Hydration must populate _bot_open_id so that
-    _is_self_sent_bot_message() can filter the adapter's own outbound echoes.
+    Covers the manual-setup path where ``FEISHU_BOT_OPEN_ID`` /
+    ``FEISHU_BOT_NAME`` are not configured — hydration populates them so
+    self-echo protection and group @mention gating both have something to
+    match against.
     """
 
     def _make_adapter(self):
@@ -2700,11 +2745,6 @@ class TestHydrateBotIdentity(unittest.TestCase):
 
         self.assertEqual(adapter._bot_open_id, "ou_hermes_hydrated")
         self.assertEqual(adapter._bot_name, "Hermes Bot")
-        # Application-info fallback must NOT run when bot_name is already set.
-        self.assertFalse(
-            adapter._client.application.v6.application.get.called
-            if hasattr(adapter._client, "application") else False
-        )
 
     @patch.dict(
         os.environ,
@@ -2721,7 +2761,6 @@ class TestHydrateBotIdentity(unittest.TestCase):
 
         asyncio.run(adapter._hydrate_bot_identity())
 
-        # Neither probe should run — both fields are already populated.
         adapter._client.request.assert_not_called()
         self.assertEqual(adapter._bot_open_id, "ou_env")
         self.assertEqual(adapter._bot_name, "Env Hermes")
@@ -2766,33 +2805,6 @@ class TestHydrateBotIdentity(unittest.TestCase):
         self.assertEqual(adapter._bot_open_id, "")
         self.assertEqual(adapter._bot_name, "Fallback Bot")
 
-    @patch.dict(os.environ, {}, clear=True)
-    def test_hydrated_open_id_enables_self_send_filter(self):
-        """E2E: after hydration, _is_self_sent_bot_message() rejects adapter's own id."""
-        adapter = self._make_adapter()
-        adapter._client = Mock()
-        payload = json.dumps(
-            {"code": 0, "bot": {"bot_name": "Hermes", "open_id": "ou_hermes"}}
-        ).encode("utf-8")
-        adapter._client.request = Mock(return_value=SimpleNamespace(raw=SimpleNamespace(content=payload)))
-
-        asyncio.run(adapter._hydrate_bot_identity())
-
-        self_event = SimpleNamespace(
-            sender=SimpleNamespace(
-                sender_type="bot",
-                sender_id=SimpleNamespace(open_id="ou_hermes", user_id=""),
-            )
-        )
-        peer_event = SimpleNamespace(
-            sender=SimpleNamespace(
-                sender_type="bot",
-                sender_id=SimpleNamespace(open_id="ou_peer_bot", user_id=""),
-            )
-        )
-        self.assertTrue(adapter._is_self_sent_bot_message(self_event))
-        self.assertFalse(adapter._is_self_sent_bot_message(peer_event))
-
 
 @unittest.skipUnless(_HAS_LARK_OAPI, "lark-oapi not installed")
 class TestPendingInboundQueue(unittest.TestCase):
@@ -3137,7 +3149,7 @@ class TestGroupMentionAtAll(unittest.TestCase):
             mentions=[],
         )
         sender_id = SimpleNamespace(open_id="ou_any", user_id=None)
-        self.assertTrue(adapter._should_accept_group_message(message, sender_id, ""))
+        self.assertTrue(_admits_group(adapter, message, sender_id, ""))
 
     @patch.dict(os.environ, {"FEISHU_GROUP_POLICY": "allowlist", "FEISHU_ALLOWED_USERS": "ou_allowed"}, clear=True)
     def test_at_all_still_requires_policy_gate(self):
@@ -3149,15 +3161,15 @@ class TestGroupMentionAtAll(unittest.TestCase):
         message = SimpleNamespace(content='{"text":"@_all attention"}', mentions=[])
         # Non-allowlisted user — should be blocked even with @_all.
         blocked_sender = SimpleNamespace(open_id="ou_blocked", user_id=None)
-        self.assertFalse(adapter._should_accept_group_message(message, blocked_sender, ""))
+        self.assertFalse(_admits_group(adapter, message, blocked_sender, ""))
         # Allowlisted user — should pass.
         allowed_sender = SimpleNamespace(open_id="ou_allowed", user_id=None)
-        self.assertTrue(adapter._should_accept_group_message(message, allowed_sender, ""))
+        self.assertTrue(_admits_group(adapter, message, allowed_sender, ""))
 
 
 @unittest.skipUnless(_HAS_LARK_OAPI, "lark-oapi not installed")
 class TestSenderNameResolution(unittest.TestCase):
-    """Tests for _resolve_sender_name_from_api."""
+    """Tests for _resolve_sender_name_from_api (contact API + cache)."""
 
     @patch.dict(os.environ, {}, clear=True)
     def test_returns_none_when_client_is_none(self):
@@ -3261,6 +3273,137 @@ class TestSenderNameResolution(unittest.TestCase):
         self.assertIsNone(result)
 
 
+@unittest.skipUnless(_HAS_LARK_OAPI, "lark-oapi not installed")
+class TestBotNameResolution(unittest.TestCase):
+    """Tests for the bot branch of _resolve_sender_name_from_api (basic_batch API + shared cache)."""
+
+    @staticmethod
+    def _batch_payload(bots: Dict[str, str]):
+        import json as _json
+        body = {
+            oid: {"bot_id": oid, "name": name, "i18n_names": {"en_us": name}}
+            for oid, name in bots.items()
+        }
+        return _json.dumps({"code": 0, "msg": "", "data": {"bots": body, "failed_bots": {}}}).encode()
+
+    def _build_adapter_with_bots(self, bots: Dict[str, str]):
+        from gateway.config import PlatformConfig
+        from gateway.platforms.feishu import FeishuAdapter
+
+        adapter = FeishuAdapter(PlatformConfig())
+        calls = []
+
+        def _fake_request(request):
+            calls.append(request)
+            return SimpleNamespace(raw=SimpleNamespace(content=self._batch_payload(bots)))
+
+        adapter._client = SimpleNamespace(request=_fake_request)
+        return adapter, calls
+
+    @patch.dict(os.environ, {}, clear=True)
+    def test_returns_cached_bot_name_without_api_call(self):
+        from gateway.config import PlatformConfig
+        from gateway.platforms.feishu import FeishuAdapter
+
+        adapter = FeishuAdapter(PlatformConfig())
+        adapter._sender_name_cache["ou_peer"] = ("Peer Bot", time.time() + 600)
+        adapter._client = SimpleNamespace(
+            request=lambda _r: (_ for _ in ()).throw(RuntimeError("should not fetch"))
+        )
+        result = asyncio.run(adapter._resolve_sender_name_from_api("ou_peer", is_bot=True))
+        self.assertEqual(result, "Peer Bot")
+
+    @patch.dict(os.environ, {}, clear=True)
+    def test_fetches_and_caches_bot_name(self):
+        adapter, calls = self._build_adapter_with_bots({"ou_peer": "Peer Bot"})
+
+        async def _direct(func, *args, **kwargs):
+            return func(*args, **kwargs)
+
+        with patch("gateway.platforms.feishu.asyncio.to_thread", side_effect=_direct):
+            result = asyncio.run(adapter._resolve_sender_name_from_api("ou_peer", is_bot=True))
+
+        self.assertEqual(result, "Peer Bot")
+        self.assertEqual(adapter._sender_name_cache["ou_peer"][0], "Peer Bot")
+        self.assertEqual(len(calls), 1)
+        self.assertIn("/open-apis/bot/v3/bots/basic_batch", calls[0].uri)
+        # Feishu expects repeated ?bot_ids= params, not comma-joined.
+        self.assertEqual(calls[0].queries, [("bot_ids", "ou_peer")])
+
+    @patch.dict(os.environ, {}, clear=True)
+    def test_api_failure_returns_none_and_does_not_poison_cache(self):
+        from gateway.config import PlatformConfig
+        from gateway.platforms.feishu import FeishuAdapter
+
+        adapter = FeishuAdapter(PlatformConfig())
+
+        def _broken_request(_req):
+            raise RuntimeError("API down")
+
+        adapter._client = SimpleNamespace(request=_broken_request)
+
+        async def _direct(func, *args, **kwargs):
+            return func(*args, **kwargs)
+
+        with patch("gateway.platforms.feishu.asyncio.to_thread", side_effect=_direct):
+            result = asyncio.run(adapter._resolve_sender_name_from_api("ou_peer", is_bot=True))
+
+        self.assertIsNone(result)
+        self.assertNotIn("ou_peer", adapter._sender_name_cache)
+
+    @patch.dict(os.environ, {}, clear=True)
+    def test_bot_absent_from_response_is_not_cached(self):
+        """Bot not in ``data.bots`` (e.g. landed in ``failed_bots``) → no
+        cache entry, next lookup re-fetches."""
+        adapter, _ = self._build_adapter_with_bots({"ou_other": "Other Bot"})
+
+        async def _direct(func, *args, **kwargs):
+            return func(*args, **kwargs)
+
+        with patch("gateway.platforms.feishu.asyncio.to_thread", side_effect=_direct):
+            result = asyncio.run(adapter._resolve_sender_name_from_api("ou_ghost", is_bot=True))
+
+        self.assertIsNone(result)
+        self.assertNotIn("ou_ghost", adapter._sender_name_cache)
+
+    @patch.dict(os.environ, {}, clear=True)
+    def test_empty_name_in_response_is_negative_cached(self):
+        """API returns name="" → cache "" so repeat lookups short-circuit."""
+        adapter, calls = self._build_adapter_with_bots({"ou_nameless": ""})
+
+        async def _direct(func, *args, **kwargs):
+            return func(*args, **kwargs)
+
+        with patch("gateway.platforms.feishu.asyncio.to_thread", side_effect=_direct):
+            first = asyncio.run(adapter._resolve_sender_name_from_api("ou_nameless", is_bot=True))
+            second = asyncio.run(adapter._resolve_sender_name_from_api("ou_nameless", is_bot=True))
+
+        self.assertIsNone(first)
+        self.assertIsNone(second)
+        self.assertEqual(adapter._sender_name_cache["ou_nameless"][0], "")
+        self.assertEqual(len(calls), 1)
+
+    @patch.dict(os.environ, {}, clear=True)
+    def test_non_zero_code_returns_none(self):
+        from gateway.config import PlatformConfig
+        from gateway.platforms.feishu import FeishuAdapter
+
+        adapter = FeishuAdapter(PlatformConfig())
+        error_payload = b'{"code":99991663,"msg":"permission denied"}'
+        adapter._client = SimpleNamespace(
+            request=lambda _r: SimpleNamespace(raw=SimpleNamespace(content=error_payload))
+        )
+
+        async def _direct(func, *args, **kwargs):
+            return func(*args, **kwargs)
+
+        with patch("gateway.platforms.feishu.asyncio.to_thread", side_effect=_direct):
+            result = asyncio.run(adapter._resolve_sender_name_from_api("ou_peer", is_bot=True))
+
+        self.assertIsNone(result)
+        self.assertNotIn("ou_peer", adapter._sender_name_cache)
+
+
 @unittest.skipUnless(_HAS_LARK_OAPI, "lark-oapi not installed")
 class TestProcessingReactions(unittest.TestCase):
     """Typing on start → removed on SUCCESS, swapped for CrossMark on FAILURE,

tests/gateway/test_feishu_bot_admission.py

@@ -0,0 +1,745 @@
+"""Adapter-layer tests for Feishu bot-sender admission (``FeishuAdapter._admit``)."""
+
+from __future__ import annotations
+
+from types import SimpleNamespace
+from typing import Any
+
+import pytest
+
+from tests.gateway.feishu_helpers import (
+    install_dedup_state,
+    make_adapter_skeleton,
+    make_message,
+    make_sender,
+    stub_mention,
+)
+
+
+# --- FeishuAdapterSettings wiring ------------------------------------------
+
+
+@pytest.mark.parametrize(
+    "env_value, expected",
+    [
+        ("none", "none"),
+        ("mentions", "mentions"),
+        ("all", "all"),
+        ("  Mentions  ", "mentions"),
+    ],
+)
+def test_feishu_load_settings_populates_allow_bots(monkeypatch, env_value, expected):
+    from gateway.platforms.feishu import FeishuAdapter
+
+    monkeypatch.setenv("FEISHU_APP_ID", "cli_test")
+    monkeypatch.setenv("FEISHU_APP_SECRET", "secret_test")
+    monkeypatch.setenv("FEISHU_ALLOW_BOTS", env_value)
+
+    settings = FeishuAdapter._load_settings(extra={})
+    assert settings.allow_bots == expected
+
+
+def test_feishu_load_settings_allow_bots_defaults_to_none(monkeypatch):
+    from gateway.platforms.feishu import FeishuAdapter
+
+    monkeypatch.setenv("FEISHU_APP_ID", "cli_test")
+    monkeypatch.setenv("FEISHU_APP_SECRET", "secret_test")
+    monkeypatch.delenv("FEISHU_ALLOW_BOTS", raising=False)
+
+    settings = FeishuAdapter._load_settings(extra={})
+    assert settings.allow_bots == "none"
+
+
+def test_feishu_load_settings_ignores_extra_allow_bots(monkeypatch):
+    # extra is ignored — env is single source of truth (yaml is bridged to env).
+    from gateway.platforms.feishu import FeishuAdapter
+
+    monkeypatch.setenv("FEISHU_APP_ID", "cli_test")
+    monkeypatch.setenv("FEISHU_APP_SECRET", "secret_test")
+    monkeypatch.delenv("FEISHU_ALLOW_BOTS", raising=False)
+
+    settings = FeishuAdapter._load_settings(extra={"allow_bots": "all"})
+    assert settings.allow_bots == "none"
+
+
+def test_feishu_load_settings_falls_back_to_env_when_extra_missing(monkeypatch):
+    from gateway.platforms.feishu import FeishuAdapter
+
+    monkeypatch.setenv("FEISHU_APP_ID", "cli_test")
+    monkeypatch.setenv("FEISHU_APP_SECRET", "secret_test")
+    monkeypatch.setenv("FEISHU_ALLOW_BOTS", "mentions")
+
+    settings = FeishuAdapter._load_settings(extra={})
+    assert settings.allow_bots == "mentions"
+
+
+def test_feishu_load_settings_warns_on_unknown_allow_bots(monkeypatch, caplog):
+    import logging
+
+    from gateway.platforms.feishu import FeishuAdapter
+
+    monkeypatch.setenv("FEISHU_APP_ID", "cli_test")
+    monkeypatch.setenv("FEISHU_APP_SECRET", "secret_test")
+    monkeypatch.setenv("FEISHU_ALLOW_BOTS", "menton")  # typo
+
+    with caplog.at_level(logging.WARNING, logger="gateway.platforms.feishu"):
+        settings = FeishuAdapter._load_settings(extra={})
+
+    assert settings.allow_bots == "none"
+    assert any("allow_bots" in r.message and "menton" in r.message for r in caplog.records)
+
+
+@pytest.mark.parametrize(
+    "env_value, extra, expected",
+    [
+        (None, {}, True),
+        ("false", {}, False),
+        ("true", {}, True),
+        ("true", {"require_mention": False}, False),
+    ],
+)
+def test_feishu_load_settings_require_mention(monkeypatch, env_value, extra, expected):
+    from gateway.platforms.feishu import FeishuAdapter
+
+    monkeypatch.setenv("FEISHU_APP_ID", "cli_test")
+    monkeypatch.setenv("FEISHU_APP_SECRET", "secret_test")
+    if env_value is None:
+        monkeypatch.delenv("FEISHU_REQUIRE_MENTION", raising=False)
+    else:
+        monkeypatch.setenv("FEISHU_REQUIRE_MENTION", env_value)
+
+    settings = FeishuAdapter._load_settings(extra=extra)
+    assert settings.require_mention is expected
+
+
+def test_feishu_load_settings_parses_per_group_require_mention(monkeypatch):
+    from gateway.platforms.feishu import FeishuAdapter
+
+    monkeypatch.setenv("FEISHU_APP_ID", "cli_test")
+    monkeypatch.setenv("FEISHU_APP_SECRET", "secret_test")
+
+    settings = FeishuAdapter._load_settings(extra={
+        "group_rules": {
+            "oc_free": {"policy": "open", "require_mention": False},
+            "oc_strict": {"policy": "open", "require_mention": True},
+            "oc_inherit": {"policy": "open"},
+        },
+    })
+    assert settings.group_rules["oc_free"].require_mention is False
+    assert settings.group_rules["oc_strict"].require_mention is True
+    assert settings.group_rules["oc_inherit"].require_mention is None
+
+
+# --- Module-level helpers --------------------------------------------------
+
+
+def test_sender_identity_collects_every_non_empty_id_variant():
+    from gateway.platforms.feishu import _sender_identity
+
+    sender = SimpleNamespace(
+        sender_id=SimpleNamespace(open_id="ou_x", user_id="", union_id="un_x"),
+    )
+    assert _sender_identity(sender) == frozenset({"ou_x", "un_x"})
+
+
+def test_sender_identity_handles_missing_sender_id():
+    from gateway.platforms.feishu import _sender_identity
+
+    assert _sender_identity(SimpleNamespace()) == frozenset()
+
+
+@pytest.mark.parametrize("sender_type", ["bot", "app"])
+def test_is_bot_sender_treats_bot_and_app_as_bot_origin(sender_type):
+    from gateway.platforms.feishu import _is_bot_sender
+
+    assert _is_bot_sender(SimpleNamespace(sender_type=sender_type)) is True
+
+
+@pytest.mark.parametrize("sender_type", ["user", "", None])
+def test_is_bot_sender_rejects_non_bot_origin(sender_type):
+    from gateway.platforms.feishu import _is_bot_sender
+
+    assert _is_bot_sender(SimpleNamespace(sender_type=sender_type)) is False
+
+
+# --- _admit pipeline matrix ------------------------------------------------
+#
+# Covers the four-step admission pipeline (self_echo → bot_policy →
+# DM bypass → group_policy + mention) as a single result-only matrix.
+# Each row pins one decision in the pipeline; tests asserting call-count
+# semantics live below in their own functions.
+
+
+def _admit_case(
+    *,
+    adapter: dict | None = None,
+    sender: dict | None = None,
+    message: dict | None = None,
+    mentions_self: bool | None = None,
+    expected: str | None = None,
+):
+    return {
+        "adapter": adapter or {},
+        "sender": sender or {},
+        "message": message or {},
+        "mentions_self": mentions_self,
+        "expected": expected,
+    }
+
+
+_ADMIT_CASES = [
+    pytest.param(
+        _admit_case(
+            adapter={"bot_open_id": "ou_me", "allow_bots": "all"},
+            sender={"sender_type": "bot", "open_id": "ou_me"},
+            expected="self_echo",
+        ),
+        id="self_echo:open_id_under_all_mode",
+    ),
+    pytest.param(
+        _admit_case(
+            adapter={"bot_open_id": "", "bot_user_id": "u_me", "allow_bots": "all"},
+            sender={"sender_type": "bot", "open_id": None, "user_id": "u_me"},
+            expected="self_echo",
+        ),
+        id="self_echo:user_id_only",
+    ),
+    pytest.param(
+        _admit_case(
+            adapter={"bot_open_id": "ou_me", "allow_bots": "all"},
+            sender={"sender_type": "bot", "open_id": "ou_me", "user_id": "u_me", "union_id": "un_me"},
+            expected="self_echo",
+        ),
+        id="self_echo:mixed_ids",
+    ),
+    pytest.param(
+        _admit_case(
+            adapter={"bot_open_id": "ou_self", "bot_user_id": "u_self", "allow_bots": "all"},
+            sender={"sender_type": "bot", "open_id": None, "user_id": "u_self"},
+            expected="self_echo",
+        ),
+        id="self_echo:user_id_when_bot_user_id_set",
+    ),
+    pytest.param(
+        _admit_case(
+            adapter={"bot_open_id": "ou_self", "allow_bots": "none"},
+            sender={"sender_type": "bot", "open_id": "ou_peer"},
+            expected="bots_disabled",
+        ),
+        id="bots_disabled:mode_none",
+    ),
+    pytest.param(
+        _admit_case(
+            adapter={"bot_open_id": "ou_self", "allow_bots": ""},
+            sender={"sender_type": "bot", "open_id": "ou_peer"},
+            expected="bots_disabled",
+        ),
+        id="bots_disabled:mode_empty",
+    ),
+    pytest.param(
+        _admit_case(
+            adapter={"bot_open_id": "ou_self", "allow_bots": "loose"},
+            sender={"sender_type": "bot", "open_id": "ou_peer"},
+            expected="bots_disabled",
+        ),
+        id="bots_disabled:mode_unknown_value",
+    ),
+    pytest.param(
+        _admit_case(
+            adapter={"bot_open_id": "", "allow_bots": "none"},
+            sender={"sender_type": "bot", "open_id": "ou_peer"},
+            expected="bots_disabled",
+        ),
+        id="bots_disabled:wins_over_self_ids_unknown",
+    ),
+    pytest.param(
+        _admit_case(
+            adapter={"bot_open_id": "", "allow_bots": "all"},
+            sender={"sender_type": "bot", "open_id": "ou_peer"},
+            expected="self_ids_unknown",
+        ),
+        id="self_ids_unknown:bot_sender_no_self_ids",
+    ),
+    pytest.param(
+        _admit_case(
+            adapter={"bot_open_id": "", "allow_bots": "all"},
+            sender={"sender_type": "app", "open_id": "ou_peer"},
+            expected="self_ids_unknown",
+        ),
+        id="self_ids_unknown:app_sender_no_self_ids",
+    ),
+    pytest.param(
+        _admit_case(
+            adapter={"bot_open_id": "ou_self", "allow_bots": "all"},
+            sender={"sender_type": "app", "open_id": None},
+            expected="self_ids_unknown",
+        ),
+        id="self_ids_unknown:no_sender_ids",
+    ),
+    pytest.param(
+        _admit_case(
+            adapter={"bot_open_id": "ou_self", "allow_bots": "mentions"},
+            sender={"sender_type": "bot", "open_id": "ou_peer"},
+            mentions_self=False,
+            expected="bot_not_mentioned",
+        ),
+        id="mentions_mode:not_mentioned_dm",
+    ),
+    pytest.param(
+        _admit_case(
+            adapter={"bot_open_id": "ou_self", "allow_bots": "mentions"},
+            sender={"sender_type": "bot", "open_id": "ou_peer"},
+            mentions_self=True,
+            expected=None,
+        ),
+        id="mentions_mode:mentioned_dm",
+    ),
+    pytest.param(
+        _admit_case(
+            adapter={"bot_open_id": "ou_self", "allow_bots": "all"},
+            sender={"sender_type": "bot", "open_id": "ou_peer"},
+            mentions_self=False,
+            expected=None,
+        ),
+        id="all_mode:not_mentioned_dm",
+    ),
+    pytest.param(
+        _admit_case(
+            adapter={"bot_open_id": "ou_self", "allow_bots": "all"},
+            sender={"sender_type": "bot", "open_id": "ou_peer"},
+            mentions_self=True,
+            expected=None,
+        ),
+        id="all_mode:mentioned_dm",
+    ),
+    pytest.param(
+        _admit_case(
+            adapter={"bot_open_id": "", "allow_bots": "none"},
+            sender={"sender_type": "user", "open_id": "ou_human"},
+            expected=None,
+        ),
+        id="human:dm_admitted_regardless_of_allow_bots",
+    ),
+    pytest.param(
+        _admit_case(
+            adapter={"allow_bots": "all"},
+            sender={"sender_type": "user", "open_id": "ou_human"},
+            message={"message_id": "om_ok", "chat_type": "p2p"},
+            expected=None,
+        ),
+        id="human:p2p_admitted",
+    ),
+    pytest.param(
+        _admit_case(
+            adapter={
+                "bot_open_id": "ou_self",
+                "require_mention": False,
+                "group_policy": "open",
+            },
+            sender={"sender_type": "user", "open_id": "ou_human"},
+            message={"chat_type": "group"},
+            mentions_self=False,
+            expected=None,
+        ),
+        id="require_mention_false:group_human_no_mention_admitted",
+    ),
+    pytest.param(
+        _admit_case(
+            adapter={
+                "bot_open_id": "ou_self",
+                "allow_bots": "all",
+                "require_mention": False,
+                "group_policy": "open",
+            },
+            sender={"sender_type": "bot", "open_id": "ou_peer"},
+            message={"chat_type": "group"},
+            mentions_self=False,
+            expected=None,
+        ),
+        id="require_mention_false:group_bot_all_mode_admitted",
+    ),
+    pytest.param(
+        _admit_case(
+            adapter={
+                "bot_open_id": "ou_self",
+                "allow_bots": "mentions",
+                "require_mention": False,
+                "group_policy": "open",
+            },
+            sender={"sender_type": "bot", "open_id": "ou_peer"},
+            message={"chat_type": "group"},
+            mentions_self=False,
+            expected="bot_not_mentioned",
+        ),
+        id="require_mention_false:group_bot_mentions_mode_still_gated",
+    ),
+]
+
+
+@pytest.mark.parametrize("case", _ADMIT_CASES)
+def test_admit_pipeline(case):
+    adapter = make_adapter_skeleton(**case["adapter"])
+    if case["mentions_self"] is not None:
+        stub_mention(adapter, case["mentions_self"])
+    sender = make_sender(**case["sender"])
+    message = make_message(**case["message"])
+    assert adapter._admit(sender, message) == case["expected"]
+
+
+# --- Mention call-count semantics ------------------------------------------
+
+
+def test_admit_skips_mention_check_under_all_mode():
+    # Tripwire: under allow_bots=all the mention path must not be probed.
+    adapter = make_adapter_skeleton(bot_open_id="ou_self", allow_bots="all")
+    calls = 0
+
+    def _tripwire(_message):
+        nonlocal calls
+        calls += 1
+        return False
+
+    adapter._mentions_self = _tripwire
+
+    sender = make_sender(sender_type="bot", open_id="ou_peer")
+    assert adapter._admit(sender, make_message()) is None
+    assert calls == 0
+
+
+def test_admit_group_mention_checked_once_per_call():
+    # Stage 2 (mentions mode) and stage 4 (group require_mention) must not
+    # double-evaluate _mentions_self for the same admit call.
+    adapter = make_adapter_skeleton(
+        bot_open_id="ou_self", allow_bots="mentions", require_mention=True,
+        group_policy="open",
+    )
+    calls = 0
+
+    def _counting(_message):
+        nonlocal calls
+        calls += 1
+        return True
+
+    adapter._mentions_self = _counting
+
+    sender = make_sender(sender_type="bot", open_id="ou_peer")
+    assert adapter._admit(sender, make_message(chat_type="group")) is None
+    assert calls == 1
+
+
+# --- Per-group require_mention override ------------------------------------
+
+
+def test_admit_per_group_require_mention_overrides_global():
+    from gateway.platforms.feishu import FeishuGroupRule
+
+    adapter = make_adapter_skeleton(
+        bot_open_id="ou_self", require_mention=True, group_policy="open",
+    )
+    adapter._group_rules = {
+        "oc_free": FeishuGroupRule(policy="open", require_mention=False),
+    }
+    stub_mention(adapter, False)
+
+    sender = make_sender(sender_type="user", open_id="ou_human")
+    assert adapter._admit(sender, make_message(chat_id="oc_free", chat_type="group")) is None
+    assert (
+        adapter._admit(sender, make_message(chat_id="oc_other", chat_type="group"))
+        == "group_policy_rejected"
+    )
+
+
+# --- Hydration -------------------------------------------------------------
+
+
+def test_hydrate_bot_identity_populates_self_ids_from_bot_v3_info(monkeypatch):
+    import asyncio
+
+    from gateway.platforms.feishu import FeishuAdapter
+
+    adapter = object.__new__(FeishuAdapter)
+    adapter._bot_open_id = ""
+    adapter._bot_user_id = ""
+    adapter._bot_name = ""
+    adapter._allow_bots = "all"
+
+    captured = {}
+
+    def _fake_request(request):
+        captured["uri"] = getattr(request, "uri", None)
+        captured["http_method"] = getattr(request, "http_method", None)
+        return SimpleNamespace(raw=SimpleNamespace(
+            content=b'{"code":0,"bot":{"app_name":"Hermes","open_id":"ou_hydrated"}}'
+        ))
+
+    adapter._client = SimpleNamespace(request=_fake_request)
+
+    asyncio.run(adapter._hydrate_bot_identity())
+
+    assert captured["uri"] == "/open-apis/bot/v3/info"
+    assert str(captured["http_method"]).endswith("GET")
+    assert adapter._bot_open_id == "ou_hydrated"
+    assert adapter._bot_name == "Hermes"
+    # /bot/v3/info doesn't surface user_id, so _bot_user_id stays empty.
+    assert adapter._bot_user_id == ""
+
+
+def test_resolve_sender_profile_uses_open_id_for_bot_name_lookup():
+    import asyncio
+
+    from gateway.platforms.feishu import FeishuAdapter
+
+    adapter = object.__new__(FeishuAdapter)
+    adapter._client = object()
+    adapter._sender_name_cache = {}
+    seen_ids = []
+
+    async def _fake_fetch_bot_names(bot_ids):
+        seen_ids.extend(bot_ids)
+        return {"ou_peer": "Peer Bot"}
+
+    adapter._fetch_bot_names = _fake_fetch_bot_names
+
+    profile = asyncio.run(
+        adapter._resolve_sender_profile(
+            SimpleNamespace(open_id="ou_peer", user_id="u_peer", union_id="on_peer"),
+            is_bot=True,
+        )
+    )
+
+    assert seen_ids == ["ou_peer"]
+    assert profile["user_id"] == "u_peer"
+    assert profile["user_name"] == "Peer Bot"
+
+
+# --- _allow_group_message matrix -------------------------------------------
+#
+# Bot-bypass semantics: admitted bots skip allowlist/blacklist (parallel
+# human-scope filters), but channel-level locks (disabled, admin_only) and
+# admin short-circuits still apply.
+
+
+def _group_case(
+    *,
+    adapter: dict | None = None,
+    admins: set | None = None,
+    group_rules: dict | None = None,
+    sender: dict | None = None,
+    chat_id: str = "oc_1",
+    is_bot: bool = False,
+    expected: bool = False,
+):
+    return {
+        "adapter": adapter or {},
+        "admins": admins or set(),
+        "group_rules": group_rules or {},
+        "sender": sender or {},
+        "chat_id": chat_id,
+        "is_bot": is_bot,
+        "expected": expected,
+    }
+
+
+def _group_rule(policy: str, **kwargs):
+    from gateway.platforms.feishu import FeishuGroupRule
+    return FeishuGroupRule(policy=policy, **kwargs)
+
+
+_GROUP_CASES = [
+    pytest.param(
+        _group_case(
+            sender={"sender_type": "bot", "open_id": "ou_peer"},
+            is_bot=True,
+            expected=True,
+        ),
+        id="bot:bypasses_default_allowlist",
+    ),
+    pytest.param(
+        _group_case(
+            sender={"sender_type": "user", "open_id": "ou_stranger"},
+            is_bot=False,
+            expected=False,
+        ),
+        id="human:gated_by_default_allowlist",
+    ),
+    pytest.param(
+        _group_case(
+            admins={"ou_peer"},
+            sender={"sender_type": "bot", "open_id": "ou_peer"},
+            is_bot=True,
+            expected=True,
+        ),
+        id="bot:admin_short_circuit",
+    ),
+    pytest.param(
+        _group_case(
+            admins={"u_admin"},
+            sender={"sender_type": "user", "open_id": None, "user_id": "u_admin"},
+            is_bot=False,
+            expected=True,
+        ),
+        id="human:admin_via_user_id",
+    ),
+    pytest.param(
+        _group_case(
+            sender={"sender_type": "bot", "open_id": "ou_peer"},
+            is_bot=True,
+            expected=True,
+        ),
+        id="bot:allowlist_skipped",
+    ),
+    pytest.param(
+        _group_case(
+            sender={"sender_type": "app", "open_id": "ou_peer"},
+            is_bot=True,
+            expected=True,
+        ),
+        id="app:allowlist_skipped",
+    ),
+]
+
+
+# Channel-lock cases need group_rules construction; keep them in a separate
+# parametrize so we can use _group_rule() (FeishuGroupRule import).
+_GROUP_RULE_CASES = [
+    pytest.param(
+        "disabled", "bot", False,
+        id="bot:disabled_policy_blocks_even_with_bypass",
+    ),
+    pytest.param(
+        "disabled", "app", False,
+        id="app:disabled_policy_blocks_even_with_bypass",
+    ),
+    pytest.param(
+        "admin_only", "bot", False,
+        id="bot:admin_only_policy_blocks_non_admin",
+    ),
+    pytest.param(
+        "admin_only", "app", False,
+        id="app:admin_only_policy_blocks_non_admin",
+    ),
+]
+
+
+@pytest.mark.parametrize("case", _GROUP_CASES)
+def test_allow_group_message_matrix(case):
+    adapter = make_adapter_skeleton(**case["adapter"])
+    adapter._admins = case["admins"]
+    adapter._group_rules = case["group_rules"]
+    sender = make_sender(**case["sender"])
+    assert adapter._allow_group_message(
+        sender_id=sender.sender_id,
+        chat_id=case["chat_id"],
+        is_bot=case["is_bot"],
+    ) is case["expected"]
+
+
+@pytest.mark.parametrize("policy, sender_type, expected", _GROUP_RULE_CASES)
+def test_allow_group_message_channel_locks_apply_to_bots(policy, sender_type, expected):
+    adapter = make_adapter_skeleton()
+    adapter._group_rules = {"oc_locked": _group_rule(policy)}
+    sender = make_sender(sender_type=sender_type, open_id="ou_peer")
+    assert adapter._allow_group_message(
+        sender_id=sender.sender_id,
+        chat_id="oc_locked",
+        is_bot=True,
+    ) is expected
+
+
+@pytest.mark.parametrize("sender_type", ["bot", "app"])
+def test_allow_group_message_blacklist_is_human_scope_only(sender_type):
+    # blacklist is parallel to allowlist (human-scope); admitted bots bypass
+    # it. To block a specific bot, gate upstream via FEISHU_ALLOW_BOTS.
+    adapter = make_adapter_skeleton()
+    adapter._group_rules = {
+        "oc_1": _group_rule("blacklist", blacklist={"ou_peer"})
+    }
+    sender = make_sender(sender_type=sender_type, open_id="ou_peer")
+    assert adapter._allow_group_message(
+        sender_id=sender.sender_id,
+        chat_id="oc_1",
+        is_bot=True,
+    ) is True
+
+
+# --- Realistic payload smoke -----------------------------------------------
+
+
+def test_admit_accepts_realistic_bot_at_bot_group_event():
+    # Locks in the real im.message.receive_v1 payload shape under mode=mentions.
+    adapter = make_adapter_skeleton(bot_open_id="ou_self", allow_bots="mentions")
+
+    mention = SimpleNamespace(
+        key="@_user_1",
+        id=SimpleNamespace(union_id="on_mentionUnion", user_id="", open_id="ou_self"),
+        name="Hermes",
+        mentioned_type="bot",
+        tenant_key="tenant_ab",
+    )
+    message = SimpleNamespace(
+        message_id="om_realistic_bot_at_bot",
+        chat_id="oc_real",
+        chat_type="group",
+        message_type="text",
+        content='{"text":"@_user_1 hello"}',
+        mentions=[mention],
+    )
+    sender = SimpleNamespace(
+        sender_type="bot",
+        sender_id=SimpleNamespace(union_id="on_peerUnion", user_id="u_peer", open_id="ou_peer_bot"),
+        tenant_key="tenant_ab",
+    )
+
+    assert adapter._admit(sender, message) is None
+
+
+# --- Event-dispatch plumbing -----------------------------------------------
+
+
+def test_handle_message_event_data_drops_bot_sender_by_default():
+    import asyncio
+
+    adapter = make_adapter_skeleton()
+    install_dedup_state(adapter)
+    processed = []
+
+    async def _fake_process_inbound_message(**kwargs):
+        processed.append(kwargs)
+
+    adapter._process_inbound_message = _fake_process_inbound_message
+
+    data = SimpleNamespace(
+        event=SimpleNamespace(
+            sender=make_sender(sender_type="bot", open_id="ou_peer"),
+            message=make_message(message_id="om_bot_default", chat_type="p2p"),
+        )
+    )
+
+    asyncio.run(adapter._handle_message_event_data(data))
+    assert processed == []
+
+
+def test_handle_message_event_data_forwards_sender_when_admitted():
+    import asyncio
+
+    adapter = make_adapter_skeleton(allow_bots="all")
+    install_dedup_state(adapter)
+    captured = {}
+
+    async def _fake_process_inbound_message(**kwargs):
+        captured.update(kwargs)
+
+    adapter._process_inbound_message = _fake_process_inbound_message
+
+    sender = make_sender(sender_type="bot", open_id="ou_peer")
+    data = SimpleNamespace(
+        event=SimpleNamespace(
+            sender=sender,
+            message=make_message(message_id="om_bot_ok", chat_type="p2p"),
+        )
+    )
+
+    asyncio.run(adapter._handle_message_event_data(data))
+    assert captured.get("sender_id") is sender.sender_id
+    assert captured.get("is_bot") is True
+    assert captured.get("message_id") == "om_bot_ok"

tests/gateway/test_feishu_bot_auth_bypass.py

@@ -0,0 +1,113 @@
+"""Regression guard for Feishu bot-sender authorization bypass.
+
+Mirrors tests/gateway/test_discord_bot_auth_bypass.py for Platform.FEISHU.
+Without the bypass in gateway/run.py, Feishu bot senders admitted by the
+adapter would be rejected at _is_user_authorized with "Unauthorized user"
+— same class of bug as Discord #4466.
+"""
+
+from __future__ import annotations
+
+from types import SimpleNamespace
+
+import pytest
+
+from gateway.session import Platform, SessionSource
+
+
+@pytest.fixture(autouse=True)
+def _isolate_feishu_env(monkeypatch):
+    for var in (
+        "FEISHU_ALLOW_BOTS",
+        "FEISHU_ALLOWED_USERS",
+        "FEISHU_ALLOW_ALL_USERS",
+        "GATEWAY_ALLOW_ALL_USERS",
+        "GATEWAY_ALLOWED_USERS",
+    ):
+        monkeypatch.delenv(var, raising=False)
+
+
+def _make_bare_runner():
+    from gateway.run import GatewayRunner
+
+    runner = object.__new__(GatewayRunner)
+    runner.pairing_store = SimpleNamespace(is_approved=lambda *_a, **_kw: False)
+    return runner
+
+
+def _make_feishu_bot_source(open_id: str = "ou_peer"):
+    return SessionSource(
+        platform=Platform.FEISHU,
+        chat_id="oc_1",
+        chat_type="group",
+        user_id=open_id,
+        user_name="PeerBot",
+        is_bot=True,
+    )
+
+
+def _make_feishu_human_source(open_id: str = "ou_human"):
+    return SessionSource(
+        platform=Platform.FEISHU,
+        chat_id="oc_1",
+        chat_type="group",
+        user_id=open_id,
+        user_name="Human",
+        is_bot=False,
+    )
+
+
+def test_feishu_bot_authorized_when_allow_bots_mentions(monkeypatch):
+    runner = _make_bare_runner()
+    monkeypatch.setenv("FEISHU_ALLOW_BOTS", "mentions")
+    monkeypatch.setenv("FEISHU_ALLOWED_USERS", "ou_human")
+
+    assert runner._is_user_authorized(_make_feishu_bot_source("ou_peer")) is True
+
+
+def test_feishu_bot_authorized_when_allow_bots_all(monkeypatch):
+    runner = _make_bare_runner()
+    monkeypatch.setenv("FEISHU_ALLOW_BOTS", "all")
+    monkeypatch.setenv("FEISHU_ALLOWED_USERS", "ou_human")
+
+    assert runner._is_user_authorized(_make_feishu_bot_source()) is True
+
+
+def test_feishu_bot_NOT_authorized_when_allow_bots_none(monkeypatch):
+    runner = _make_bare_runner()
+    monkeypatch.setenv("FEISHU_ALLOW_BOTS", "none")
+    monkeypatch.setenv("FEISHU_ALLOWED_USERS", "ou_human")
+
+    assert runner._is_user_authorized(_make_feishu_bot_source("ou_peer")) is False
+
+
+def test_feishu_bot_NOT_authorized_when_allow_bots_unset(monkeypatch):
+    runner = _make_bare_runner()
+    monkeypatch.setenv("FEISHU_ALLOWED_USERS", "ou_human")
+
+    assert runner._is_user_authorized(_make_feishu_bot_source("ou_peer")) is False
+
+
+def test_feishu_human_still_checked_against_allowlist_when_bot_policy_set(monkeypatch):
+    """FEISHU_ALLOW_BOTS=all must NOT open the gate for humans."""
+    runner = _make_bare_runner()
+    monkeypatch.setenv("FEISHU_ALLOW_BOTS", "all")
+    monkeypatch.setenv("FEISHU_ALLOWED_USERS", "ou_human")
+
+    assert runner._is_user_authorized(_make_feishu_human_source("ou_stranger")) is False
+    assert runner._is_user_authorized(_make_feishu_human_source("ou_human")) is True
+
+
+def test_feishu_bot_bypass_does_not_leak_to_other_platforms(monkeypatch):
+    """FEISHU_ALLOW_BOTS=all must not authorize Telegram/Discord bot sources."""
+    runner = _make_bare_runner()
+    monkeypatch.setenv("FEISHU_ALLOW_BOTS", "all")
+
+    telegram_bot = SessionSource(
+        platform=Platform.TELEGRAM,
+        chat_id="123",
+        chat_type="channel",
+        user_id="999",
+        is_bot=True,
+    )
+    assert runner._is_user_authorized(telegram_bot) is False

tests/gateway/test_fresh_reset_skill_injection.py

@@ -0,0 +1,201 @@
+"""Regression tests for topic/channel skill auto-injection after /new or /reset.
+
+Covers the fix for issue #6508.
+
+Before the fix:
+    1. User sends ``/new`` — ``reset_session`` creates a fresh SessionEntry
+       with ``created_at == updated_at``.
+    2. User sends the next message.
+    3. ``get_or_create_session`` finds the entry and bumps
+       ``entry.updated_at = now`` (microseconds after ``created_at``).
+    4. ``_handle_message_with_agent`` checks
+       ``_is_new_session = (created_at == updated_at) or was_auto_reset``.
+       Both are False → ``_is_new_session = False`` → topic/channel skills
+       are silently skipped for the first message of a manually reset session.
+
+After the fix:
+    ``reset_session`` stamps the new entry with ``is_fresh_reset=True``.
+    ``_handle_message_with_agent`` ORs this into ``_is_new_session`` and
+    consumes the flag immediately after the check, so subsequent messages
+    are treated as continuing the session and the flag does not leak.
+
+We use ``was_auto_reset`` for surprise resets (idle/daily/suspended) and
+``is_fresh_reset`` for user-initiated resets because the former also drives
+a "Session automatically reset due to inactivity" user-facing notice and
+a context-note prepend into the agent's prompt — both wrong for an explicit
+/new or /reset.
+"""
+import pytest
+
+from gateway.config import GatewayConfig, Platform
+from gateway.session import SessionEntry, SessionSource, SessionStore
+
+
+def _make_store(tmp_path):
+    return SessionStore(sessions_dir=tmp_path, config=GatewayConfig())
+
+
+def _make_source(chat_id="123", user_id="u1"):
+    return SessionSource(
+        platform=Platform.TELEGRAM,
+        chat_id=chat_id,
+        user_id=user_id,
+    )
+
+
+def _is_new_session(entry) -> bool:
+    """Mirror of the predicate in ``_handle_message_with_agent``.
+
+    Kept in-sync with the production check so this test fails loudly if the
+    upstream logic regresses.
+    """
+    return (
+        entry.created_at == entry.updated_at
+        or getattr(entry, "was_auto_reset", False)
+        or getattr(entry, "is_fresh_reset", False)
+    )
+
+
+# ---------------------------------------------------------------------------
+# reset_session stamps is_fresh_reset=True
+# ---------------------------------------------------------------------------
+
+class TestResetSessionStampsFreshReset:
+    def test_reset_session_sets_is_fresh_reset_true(self, tmp_path):
+        store = _make_store(tmp_path)
+        source = _make_source()
+        store.get_or_create_session(source)
+        session_key = store._generate_session_key(source)
+
+        new_entry = store.reset_session(session_key)
+
+        assert new_entry is not None
+        assert new_entry.is_fresh_reset is True
+
+    def test_reset_session_unknown_key_returns_none(self, tmp_path):
+        store = _make_store(tmp_path)
+        assert store.reset_session("unknown:key") is None
+
+    def test_fresh_session_does_not_have_is_fresh_reset(self, tmp_path):
+        """A vanilla first-time session should not carry the flag."""
+        store = _make_store(tmp_path)
+        entry = store.get_or_create_session(_make_source())
+        assert entry.is_fresh_reset is False
+
+
+# ---------------------------------------------------------------------------
+# Core regression: _is_new_session stays True after updated_at bump
+# ---------------------------------------------------------------------------
+
+class TestIsNewSessionSurvivesUpdatedAtBump:
+    def test_is_new_session_true_after_reset_then_next_message(self, tmp_path):
+        """The actual bug: _is_new_session was False on message after /reset."""
+        store = _make_store(tmp_path)
+        source = _make_source()
+        store.get_or_create_session(source)
+        session_key = store._generate_session_key(source)
+
+        # User sends /reset
+        store.reset_session(session_key)
+
+        # Next inbound message — get_or_create_session bumps updated_at
+        entry = store.get_or_create_session(source)
+
+        # Before the fix: created_at != updated_at, was_auto_reset=False → False
+        # After the fix: is_fresh_reset=True carries the signal through the bump
+        assert _is_new_session(entry) is True
+
+    def test_flag_consumed_after_first_read(self, tmp_path):
+        """After the message handler consumes is_fresh_reset, the NEXT
+        message should not be treated as a new session (skill re-injection
+        must not fire a second time).
+        """
+        store = _make_store(tmp_path)
+        source = _make_source()
+        store.get_or_create_session(source)
+        session_key = store._generate_session_key(source)
+        store.reset_session(session_key)
+
+        # First message — handler consumes the flag
+        entry = store.get_or_create_session(source)
+        assert _is_new_session(entry) is True
+        entry.is_fresh_reset = False  # what _handle_message_with_agent does
+
+        # Second message — must not be treated as new
+        entry = store.get_or_create_session(source)
+        assert _is_new_session(entry) is False
+
+
+# ---------------------------------------------------------------------------
+# Vanilla-session behavior is unchanged
+# ---------------------------------------------------------------------------
+
+class TestVanillaBehaviorUnaffected:
+    def test_ongoing_session_not_flagged_as_new(self, tmp_path):
+        store = _make_store(tmp_path)
+        source = _make_source()
+        store.get_or_create_session(source)
+
+        # Second message on the same session — updated_at bumps,
+        # is_fresh_reset was never set
+        entry = store.get_or_create_session(source)
+        assert entry.is_fresh_reset is False
+        assert _is_new_session(entry) is False
+
+    def test_idle_auto_reset_does_not_set_is_fresh_reset(self, tmp_path):
+        """Idle/daily auto-resets use was_auto_reset — confirm they do NOT
+        also set is_fresh_reset (which would double-fire the skill path and
+        not leak through the auto-reset guard).
+        """
+        store = _make_store(tmp_path)
+        source = _make_source()
+        entry = store.get_or_create_session(source)
+
+        # Simulate the auto-reset code path: get_or_create_session's internal
+        # branch that sets was_auto_reset does NOT touch is_fresh_reset.
+        # Construct a fresh entry the same way that branch does.
+        store._entries.pop(store._generate_session_key(source))
+        fresh = SessionEntry(
+            session_key=entry.session_key,
+            session_id="new_id",
+            created_at=entry.created_at,
+            updated_at=entry.created_at,
+            origin=source,
+            was_auto_reset=True,
+            auto_reset_reason="idle",
+        )
+        assert fresh.is_fresh_reset is False
+        assert fresh.was_auto_reset is True
+
+
+# ---------------------------------------------------------------------------
+# Persistence through sessions.json round-trip
+# ---------------------------------------------------------------------------
+
+class TestPersistence:
+    def test_is_fresh_reset_survives_to_dict_from_dict(self, tmp_path):
+        """Protect against the gateway restarting between /reset and the
+        next message — the flag must be persisted in sessions.json.
+        """
+        store = _make_store(tmp_path)
+        source = _make_source()
+        store.get_or_create_session(source)
+        session_key = store._generate_session_key(source)
+        new_entry = store.reset_session(session_key)
+
+        assert new_entry.is_fresh_reset is True
+        restored = SessionEntry.from_dict(new_entry.to_dict())
+        assert restored.is_fresh_reset is True
+
+    def test_default_false_when_missing_from_dict(self, tmp_path):
+        """Older sessions.json files written before this field existed must
+        load cleanly with is_fresh_reset defaulting to False.
+        """
+        data = {
+            "session_key": "telegram:1:123",
+            "session_id": "sess1",
+            "created_at": "2026-01-01T00:00:00",
+            "updated_at": "2026-01-01T00:00:00",
+        }
+        entry = SessionEntry.from_dict(data)
+        assert entry.is_fresh_reset is False

tests/gateway/test_home_target_env_var.py

@@ -0,0 +1,36 @@
+"""Regression tests for /sethome env-var resolution.
+
+The `/sethome` command writes to a platform's home-target env var. Two platforms
+don't follow the `{PLATFORM}_HOME_CHANNEL` convention: matrix uses
+`MATRIX_HOME_ROOM` and email uses `EMAIL_HOME_ADDRESS`. Before PR #12698
+`/sethome` hardcoded the `_HOME_CHANNEL` suffix, so Matrix and Email saves went
+to env vars nothing read on startup — the home channel appeared to set
+successfully but was lost on every new gateway session.
+"""
+
+from gateway.run import _home_target_env_var
+
+
+def test_matrix_home_target_env_var_uses_home_room():
+    assert _home_target_env_var("matrix") == "MATRIX_HOME_ROOM"
+
+
+def test_email_home_target_env_var_uses_home_address():
+    assert _home_target_env_var("email") == "EMAIL_HOME_ADDRESS"
+
+
+def test_telegram_home_target_env_var_uses_home_channel():
+    assert _home_target_env_var("telegram") == "TELEGRAM_HOME_CHANNEL"
+
+
+def test_discord_home_target_env_var_uses_home_channel():
+    assert _home_target_env_var("discord") == "DISCORD_HOME_CHANNEL"
+
+
+def test_unknown_platform_home_target_env_var_falls_back_to_home_channel():
+    assert _home_target_env_var("custom") == "CUSTOM_HOME_CHANNEL"
+
+
+def test_case_insensitive_platform_name():
+    assert _home_target_env_var("MATRIX") == "MATRIX_HOME_ROOM"
+    assert _home_target_env_var("Email") == "EMAIL_HOME_ADDRESS"

tests/gateway/test_native_image_buffer_isolation.py

@@ -0,0 +1,79 @@
+import pytest
+
+from gateway.config import GatewayConfig, Platform, PlatformConfig
+from gateway.platforms.base import MessageEvent, MessageType
+from gateway.run import GatewayRunner
+from gateway.session import SessionSource, build_session_key
+
+
+def _make_runner() -> GatewayRunner:
+    runner = GatewayRunner.__new__(GatewayRunner)
+    runner.config = GatewayConfig(
+        platforms={Platform.TELEGRAM: PlatformConfig(enabled=True, token="fake")},
+    )
+    runner.adapters = {}
+    runner._model = "openai/gpt-4.1-mini"
+    runner._base_url = None
+    runner._decide_image_input_mode = lambda: "native"
+    return runner
+
+
+def _source(chat_id: str) -> SessionSource:
+    return SessionSource(
+        platform=Platform.TELEGRAM,
+        chat_id=chat_id,
+        chat_type="private",
+        user_name=f"user-{chat_id}",
+    )
+
+
+def _image_event(source: SessionSource, path: str) -> MessageEvent:
+    return MessageEvent(
+        text="see image",
+        message_type=MessageType.PHOTO,
+        source=source,
+        media_urls=[path],
+        media_types=["image/png"],
+    )
+
+
+@pytest.mark.asyncio
+async def test_native_image_buffer_isolated_per_session():
+    runner = _make_runner()
+    source_a = _source("chat-a")
+    source_b = _source("chat-b")
+
+    await runner._prepare_inbound_message_text(
+        event=_image_event(source_a, "/tmp/a.png"),
+        source=source_a,
+        history=[],
+    )
+    await runner._prepare_inbound_message_text(
+        event=_image_event(source_b, "/tmp/b.png"),
+        source=source_b,
+        history=[],
+    )
+
+    assert runner._consume_pending_native_image_paths(build_session_key(source_a)) == ["/tmp/a.png"]
+    assert runner._consume_pending_native_image_paths(build_session_key(source_b)) == ["/tmp/b.png"]
+
+
+@pytest.mark.asyncio
+async def test_native_image_buffer_not_cleared_by_other_sessions_without_images():
+    runner = _make_runner()
+    source_a = _source("chat-a")
+    source_b = _source("chat-b")
+
+    await runner._prepare_inbound_message_text(
+        event=_image_event(source_a, "/tmp/a.png"),
+        source=source_a,
+        history=[],
+    )
+    await runner._prepare_inbound_message_text(
+        event=MessageEvent(text="plain text", source=source_b),
+        source=source_b,
+        history=[],
+    )
+
+    assert runner._consume_pending_native_image_paths(build_session_key(source_a)) == ["/tmp/a.png"]
+    assert runner._consume_pending_native_image_paths(build_session_key(source_b)) == []

tests/gateway/test_notice_delivery.py

@@ -0,0 +1,67 @@
+from unittest.mock import AsyncMock, MagicMock
+
+import pytest
+
+from gateway.config import GatewayConfig, Platform, PlatformConfig
+from gateway.platforms.base import SendResult
+from gateway.run import GatewayRunner
+from gateway.session import SessionSource
+
+
+def _make_source() -> SessionSource:
+    return SessionSource(
+        platform=Platform.SLACK,
+        chat_id="C123",
+        chat_type="channel",
+        user_id="U123",
+        thread_id="111.222",
+    )
+
+
+def _make_runner(extra=None):
+    runner = object.__new__(GatewayRunner)
+    runner.config = GatewayConfig(
+        platforms={
+            Platform.SLACK: PlatformConfig(enabled=True, token="***", extra=extra or {})
+        }
+    )
+    adapter = MagicMock()
+    adapter.send = AsyncMock(return_value=SendResult(success=True, message_id="public-1"))
+    adapter.send_private_notice = AsyncMock(return_value=SendResult(success=True, message_id="private-1"))
+    runner.adapters = {Platform.SLACK: adapter}
+    return runner, adapter
+
+
+@pytest.mark.asyncio
+async def test_deliver_platform_notice_uses_private_delivery_when_configured():
+    runner, adapter = _make_runner(extra={"notice_delivery": "private"})
+
+    await runner._deliver_platform_notice(_make_source(), "hello")
+
+    adapter.send_private_notice.assert_awaited_once_with(
+        "C123",
+        "U123",
+        "hello",
+        metadata={"thread_id": "111.222"},
+    )
+    adapter.send.assert_not_awaited()
+
+
+@pytest.mark.asyncio
+async def test_deliver_platform_notice_falls_back_to_public_when_private_fails():
+    runner, adapter = _make_runner(extra={"notice_delivery": "private"})
+    adapter.send_private_notice = AsyncMock(return_value=SendResult(success=False, error="nope"))
+
+    await runner._deliver_platform_notice(_make_source(), "hello")
+
+    adapter.send.assert_awaited_once_with("C123", "hello", metadata={"thread_id": "111.222"})
+
+
+@pytest.mark.asyncio
+async def test_deliver_platform_notice_uses_public_delivery_by_default():
+    runner, adapter = _make_runner()
+
+    await runner._deliver_platform_notice(_make_source(), "hello")
+
+    adapter.send.assert_awaited_once_with("C123", "hello", metadata={"thread_id": "111.222"})
+    adapter.send_private_notice.assert_not_awaited()

tests/gateway/test_reasoning_command.py

@@ -407,3 +407,44 @@ class TestReasoningCommand:
         assert result["final_response"] == "ok"
         assert _CapturingAgent.last_init is not None
         assert "homeassistant" in set(_CapturingAgent.last_init["enabled_toolsets"])
+
+
+class TestLoadShowReasoningCoercion:
+    """Regression: display.show_reasoning must be coerced, not bool()'d."""
+
+    def _load_with_config(self, tmp_path, monkeypatch, yaml_body: str) -> bool:
+        hermes_home = tmp_path / "hermes"
+        hermes_home.mkdir()
+        (hermes_home / "config.yaml").write_text(yaml_body, encoding="utf-8")
+        monkeypatch.setattr(gateway_run, "_hermes_home", hermes_home)
+        return gateway_run.GatewayRunner._load_show_reasoning()
+
+    def test_quoted_false_is_false(self, tmp_path, monkeypatch):
+        assert self._load_with_config(
+            tmp_path, monkeypatch,
+            'display:\n  show_reasoning: "false"\n',
+        ) is False
+
+    def test_quoted_off_is_false(self, tmp_path, monkeypatch):
+        assert self._load_with_config(
+            tmp_path, monkeypatch,
+            'display:\n  show_reasoning: "off"\n',
+        ) is False
+
+    def test_quoted_true_is_true(self, tmp_path, monkeypatch):
+        assert self._load_with_config(
+            tmp_path, monkeypatch,
+            'display:\n  show_reasoning: "true"\n',
+        ) is True
+
+    def test_bare_true_is_true(self, tmp_path, monkeypatch):
+        assert self._load_with_config(
+            tmp_path, monkeypatch,
+            'display:\n  show_reasoning: true\n',
+        ) is True
+
+    def test_missing_is_false(self, tmp_path, monkeypatch):
+        assert self._load_with_config(
+            tmp_path, monkeypatch,
+            'display: {}\n',
+        ) is False

tests/gateway/test_restart_notification.py

@@ -113,6 +113,36 @@ async def test_restart_command_preserves_thread_id(tmp_path, monkeypatch):
     assert data["thread_id"] == "topic_7"
 
 
+@pytest.mark.asyncio
+async def test_restart_command_uses_atomic_json_writes_for_marker_files(tmp_path, monkeypatch):
+    monkeypatch.setattr(gateway_run, "_hermes_home", tmp_path)
+
+    calls = []
+
+    def _fake_atomic_json_write(path, payload, **kwargs):
+        calls.append((Path(path).name, payload, kwargs))
+
+    monkeypatch.setattr(gateway_run, "atomic_json_write", _fake_atomic_json_write)
+
+    runner, _adapter = make_restart_runner()
+    runner.request_restart = MagicMock(return_value=True)
+
+    source = make_restart_source(chat_id="42")
+    event = MessageEvent(
+        text="/restart",
+        message_type=MessageType.TEXT,
+        source=source,
+        message_id="m1",
+    )
+
+    await runner._handle_restart_command(event)
+
+    names = [name for name, _payload, _kwargs in calls]
+    assert names == [".restart_notify.json", ".restart_last_processed.json"]
+    assert calls[0][1]["chat_id"] == "42"
+    assert calls[1][1]["platform"] == "telegram"
+
+
 # ── _send_restart_notification ───────────────────────────────────────────
 
 

tests/gateway/test_restart_resume_pending.py

@@ -999,3 +999,65 @@ class TestStuckLoopEscalation:
 
         assert store._entries[entry.session_key].resume_pending is False
         assert not counts_file.exists()
+
+    def test_increment_restart_failure_counts_uses_atomic_json_write(
+        self, tmp_path, monkeypatch
+    ):
+        from gateway.run import GatewayRunner
+
+        source = _make_source()
+        session_key = _make_store(tmp_path).get_or_create_session(source).session_key
+
+        monkeypatch.setattr("gateway.run._hermes_home", tmp_path)
+        calls = []
+
+        def _fake_atomic_json_write(path, payload, **kwargs):
+            calls.append((path, payload, kwargs))
+
+        monkeypatch.setattr("gateway.run.atomic_json_write", _fake_atomic_json_write)
+
+        runner = object.__new__(GatewayRunner)
+        runner._increment_restart_failure_counts({session_key})
+
+        assert calls == [
+            (
+                tmp_path / ".restart_failure_counts",
+                {session_key: 1},
+                {"indent": None},
+            )
+        ]
+
+    def test_clear_restart_failure_count_uses_atomic_json_write_when_entries_remain(
+        self, tmp_path, monkeypatch
+    ):
+        import json
+
+        from gateway.run import GatewayRunner
+
+        source = _make_source()
+        session_key = _make_store(tmp_path).get_or_create_session(source).session_key
+        other_key = "agent:main:telegram:dm:other"
+        counts_file = tmp_path / ".restart_failure_counts"
+        counts_file.write_text(
+            json.dumps({session_key: 2, other_key: 1}),
+            encoding="utf-8",
+        )
+
+        monkeypatch.setattr("gateway.run._hermes_home", tmp_path)
+        calls = []
+
+        def _fake_atomic_json_write(path, payload, **kwargs):
+            calls.append((path, payload, kwargs))
+
+        monkeypatch.setattr("gateway.run.atomic_json_write", _fake_atomic_json_write)
+
+        runner = object.__new__(GatewayRunner)
+        runner._clear_restart_failure_count(session_key)
+
+        assert calls == [
+            (
+                tmp_path / ".restart_failure_counts",
+                {other_key: 1},
+                {"indent": None},
+            )
+        ]

tests/gateway/test_session.py

@@ -1243,7 +1243,7 @@ class TestRewriteTranscriptPreservesReasoning:
         assert after[0].get("reasoning_details") == [{"type": "summary", "text": "step by step"}]
         assert after[0].get("codex_reasoning_items") == [{"id": "r1", "type": "reasoning"}]
 
-    def test_db_rewrite_is_atomic_on_insert_failure(self, tmp_path):
+    def test_db_rewrite_is_atomic_on_insert_failure(self, tmp_path, monkeypatch):
         from hermes_state import SessionDB
 
         db = SessionDB(db_path=tmp_path / "test.db")
@@ -1258,16 +1258,27 @@ class TestRewriteTranscriptPreservesReasoning:
         store._db = db
         store._loaded = True
 
+        # Force the second insert inside replace_messages to fail, simulating
+        # any storage-layer error that might abort a multi-row rewrite.
+        real_encode = SessionDB._encode_content
+        calls = {"n": 0}
+
+        def flaky_encode(cls, content):
+            calls["n"] += 1
+            if calls["n"] == 2:
+                raise RuntimeError("simulated storage failure")
+            return real_encode.__func__(cls, content)
+
+        monkeypatch.setattr(SessionDB, "_encode_content", classmethod(flaky_encode))
+
         replacement = [
             {"role": "user", "content": "after user"},
-            {
-                "role": "assistant",
-                "content": {"not": "sqlite-bindable but JSONL-safe"},
-            },
+            {"role": "assistant", "content": "after assistant"},
         ]
 
         store.rewrite_transcript(session_id, replacement)
 
+        # The rewrite must roll back atomically — original messages preserved.
         after = db.get_messages_as_conversation(session_id)
         assert [msg["content"] for msg in after] == [
             "before user",

tests/gateway/test_session_boundary_security_state.py

@@ -10,6 +10,7 @@ from gateway.platforms.base import MessageEvent
 from gateway.session import SessionEntry, SessionSource, build_session_key
 from tools import approval as approval_mod
 from tools.approval import (
+    _ApprovalEntry,
     approve_session,
     enable_session_yolo,
     is_approved,
@@ -172,6 +173,38 @@ async def test_branch_clears_session_scoped_approval_and_yolo_state():
     assert other_key in runner._update_prompt_pending
 
 
+@pytest.mark.asyncio
+async def test_branch_preserves_persisted_assistant_metadata():
+    runner, _session_key = _make_branch_runner()
+    runner.session_store.load_transcript.return_value = [
+        {"role": "user", "content": "hello"},
+        {
+            "role": "assistant",
+            "content": "world",
+            "finish_reason": "stop",
+            "reasoning": "thinking",
+            "reasoning_content": "provider scratchpad",
+            "reasoning_details": [{"type": "summary", "text": "step"}],
+            "codex_reasoning_items": [{"id": "r1", "type": "reasoning"}],
+            "codex_message_items": [{"id": "m1", "type": "message"}],
+        },
+    ]
+
+    result = await runner._handle_branch_command(_make_event("/branch"))
+
+    assert "Branched to" in result
+    append_calls = runner._session_db.append_message.call_args_list
+    assert len(append_calls) == 2
+    assistant_kwargs = append_calls[1].kwargs
+    assert assistant_kwargs["role"] == "assistant"
+    assert assistant_kwargs["finish_reason"] == "stop"
+    assert assistant_kwargs["reasoning"] == "thinking"
+    assert assistant_kwargs["reasoning_content"] == "provider scratchpad"
+    assert assistant_kwargs["reasoning_details"] == [{"type": "summary", "text": "step"}]
+    assert assistant_kwargs["codex_reasoning_items"] == [{"id": "r1", "type": "reasoning"}]
+    assert assistant_kwargs["codex_message_items"] == [{"id": "m1", "type": "message"}]
+
+
 def test_clear_session_boundary_security_state_is_scoped():
     """The helper must wipe only the target session's approval/yolo state.
 
@@ -214,3 +247,30 @@ def test_clear_session_boundary_security_state_is_scoped():
     runner._clear_session_boundary_security_state("")
     assert is_approved(other_key, "recursive delete") is True
     assert other_key in runner._update_prompt_pending
+
+
+def test_clear_session_boundary_security_state_wakes_blocked_approvals():
+    """Boundary cleanup must cancel blocked approval waiters immediately."""
+    from gateway.run import GatewayRunner
+
+    runner = object.__new__(GatewayRunner)
+    runner._pending_approvals = {}
+    runner._update_prompt_pending = {}
+
+    source = _make_source()
+    session_key = build_session_key(source)
+    other_key = "agent:main:telegram:dm:other-chat"
+
+    target_entry = _ApprovalEntry({"command": "rm -rf /tmp/demo"})
+    other_entry = _ApprovalEntry({"command": "rm -rf /tmp/other"})
+    approval_mod._gateway_queues[session_key] = [target_entry]
+    approval_mod._gateway_queues[other_key] = [other_entry]
+
+    runner._clear_session_boundary_security_state(session_key)
+
+    assert target_entry.event.is_set()
+    assert target_entry.result == "deny"
+    assert other_entry.event.is_set() is False
+    assert other_entry.result is None
+    assert session_key not in approval_mod._gateway_queues
+    assert other_key in approval_mod._gateway_queues

tests/gateway/test_session_race_guard.py

@@ -226,6 +226,39 @@ def test_merge_pending_message_event_merges_text_and_photo_followups():
     assert merged.media_types == ["image/png"]
 
 
+def test_merge_pending_message_event_promotes_document_followups_over_text():
+    pending = {}
+    source = SessionSource(
+        platform=Platform.TELEGRAM,
+        chat_id="12345",
+        chat_type="dm",
+        user_id="u1",
+    )
+    session_key = build_session_key(source)
+
+    text_event = MessageEvent(
+        text="please review this",
+        message_type=MessageType.TEXT,
+        source=source,
+    )
+    document_event = MessageEvent(
+        text="",
+        message_type=MessageType.DOCUMENT,
+        source=source,
+        media_urls=["/tmp/report.pdf"],
+        media_types=["application/pdf"],
+    )
+
+    merge_pending_message_event(pending, session_key, text_event, merge_text=True)
+    merge_pending_message_event(pending, session_key, document_event, merge_text=True)
+
+    merged = pending[session_key]
+    assert merged.message_type == MessageType.DOCUMENT
+    assert merged.text == "please review this"
+    assert merged.media_urls == ["/tmp/report.pdf"]
+    assert merged.media_types == ["application/pdf"]
+
+
 @pytest.mark.asyncio
 async def test_recent_telegram_text_followup_is_queued_without_interrupt():
     runner = _make_runner()

tests/gateway/test_signal.py

@@ -1649,3 +1649,148 @@ class TestSignalSendTimeout:
         # 32 attachments × 5s = 160s; ought to comfortably outlast a
         # serial upload of an attachment-heavy batch.
         assert _signal_send_timeout(32) == 160.0
+
+
+# ---------------------------------------------------------------------------
+# Contentless Envelope Filtering (profile key updates, empty messages)
+# ---------------------------------------------------------------------------
+
+class TestSignalContentlessEnvelope:
+    """Verify that profile key updates and empty Signal messages are skipped."""
+
+    @pytest.mark.asyncio
+    async def test_skips_profile_key_update_no_message_field(self, monkeypatch):
+        """Profile key updates may carry a dataMessage without 'message' field.
+        Must be skipped to avoid triggering agent turns for metadata."""
+        adapter = _make_signal_adapter(monkeypatch)
+        captured = {}
+
+        async def fake_handle(event):
+            captured["event"] = event
+
+        adapter.handle_message = fake_handle
+
+        # Profile key update: dataMessage exists but has no "message" field
+        await adapter._handle_envelope({
+            "envelope": {
+                "sourceNumber": "+155****9999",
+                "sourceUuid": "05668cf3-8ffa-467e-9b24-f5eefa5cf475",
+                "sourceName": "Elliott McManis",
+                "timestamp": 1777600696077,
+                "dataMessage": {
+                    # No "message" field — profile key update metadata only
+                    "profileKey": "some-profile-key-data",
+                },
+            }
+        })
+
+        assert "event" not in captured, "Profile key update should be skipped"
+
+    @pytest.mark.asyncio
+    async def test_skips_empty_message(self, monkeypatch):
+        """Empty text messages (message='') should be skipped."""
+        adapter = _make_signal_adapter(monkeypatch)
+        captured = {}
+
+        async def fake_handle(event):
+            captured["event"] = event
+
+        adapter.handle_message = fake_handle
+
+        await adapter._handle_envelope({
+            "envelope": {
+                "sourceNumber": "+155****9999",
+                "sourceUuid": "05668cf3-8ffa-467e-9b24-f5eefa5cf475",
+                "sourceName": "Elliott McManis",
+                "timestamp": 1777600696077,
+                "dataMessage": {
+                    "message": "",
+                },
+            }
+        })
+
+        assert "event" not in captured, "Empty message should be skipped"
+
+    @pytest.mark.asyncio
+    async def test_skips_whitespace_only_message(self, monkeypatch):
+        """Whitespace-only messages ('   ') should be skipped."""
+        adapter = _make_signal_adapter(monkeypatch)
+        captured = {}
+
+        async def fake_handle(event):
+            captured["event"] = event
+
+        adapter.handle_message = fake_handle
+
+        await adapter._handle_envelope({
+            "envelope": {
+                "sourceNumber": "+155****9999",
+                "sourceUuid": "05668cf3-8ffa-467e-9b24-f5eefa5cf475",
+                "sourceName": "Elliott McManis",
+                "timestamp": 1777600696077,
+                "dataMessage": {
+                    "message": "   \n\t  ",
+                },
+            }
+        })
+
+        assert "event" not in captured, "Whitespace-only message should be skipped"
+
+    @pytest.mark.asyncio
+    async def test_allows_message_with_attachment_no_text(self, monkeypatch):
+        """Messages with attachments but no text should still be processed."""
+        adapter = _make_signal_adapter(monkeypatch)
+        captured = {}
+
+        async def fake_handle(event):
+            captured["event"] = event
+
+        adapter.handle_message = fake_handle
+
+        # Mock attachment fetch to return a cached image
+        png_data = b"\x89PNG\r\n\x1a\n" + b"\x00" * 100
+        b64_data = base64.b64encode(png_data).decode()
+        adapter._rpc, _ = _stub_rpc({"data": b64_data})
+
+        with patch("gateway.platforms.signal.cache_image_from_bytes", return_value="/tmp/img.png"):
+            await adapter._handle_envelope({
+                "envelope": {
+                    "sourceNumber": "+155****9999",
+                    "sourceUuid": "05668cf3-8ffa-467e-9b24-f5eefa5cf475",
+                    "sourceName": "Elliott McManis",
+                    "timestamp": 1777600696077,
+                    "dataMessage": {
+                        "message": "",  # No text
+                        "attachments": [{"id": "att-123", "size": 200}],
+                    },
+                }
+            })
+
+        assert "event" in captured, "Message with attachment should NOT be skipped"
+        assert captured["event"].media_urls == ["/tmp/img.png"]
+
+    @pytest.mark.asyncio
+    async def test_allows_normal_text_message(self, monkeypatch):
+        """Normal text messages should still flow through."""
+        adapter = _make_signal_adapter(monkeypatch)
+        captured = {}
+
+        async def fake_handle(event):
+            captured["event"] = event
+
+        adapter.handle_message = fake_handle
+
+        await adapter._handle_envelope({
+            "envelope": {
+                "sourceNumber": "+155****9999",
+                "sourceUuid": "05668cf3-8ffa-467e-9b24-f5eefa5cf475",
+                "sourceName": "Elliott McManis",
+                "timestamp": 1777600696077,
+                "dataMessage": {
+                    "message": "hello world",
+                },
+            }
+        })
+
+        assert "event" in captured, "Normal message should NOT be skipped"
+        assert captured["event"].text == "hello world"

tests/gateway/test_slack.py

@@ -53,6 +53,9 @@ def _ensure_slack_mock():
     ]:
         sys.modules.setdefault(name, mod)
 
+    # aiohttp is imported alongside slack-bolt; mock it if missing
+    sys.modules.setdefault("aiohttp", MagicMock())
+
 
 _ensure_slack_mock()
 
@@ -89,6 +92,46 @@ def _redirect_cache(tmp_path, monkeypatch):
     )
 
 
+# ---------------------------------------------------------------------------
+# TestSlashCommandSessionIsolation
+# ---------------------------------------------------------------------------
+
+class TestSlashCommandSessionIsolation:
+    @pytest.mark.asyncio
+    async def test_channel_slash_command_uses_group_session_semantics(self, adapter):
+        command = {
+            "text": "hello",
+            "user_id": "U123",
+            "channel_id": "C123",
+            "team_id": "T123",
+        }
+
+        await adapter._handle_slash_command(command)
+
+        adapter.handle_message.assert_awaited_once()
+        event = adapter.handle_message.await_args.args[0]
+        assert event.source.chat_type == "group"
+        assert event.source.chat_id == "C123"
+        assert event.source.user_id == "U123"
+
+    @pytest.mark.asyncio
+    async def test_dm_slash_command_keeps_dm_session_semantics(self, adapter):
+        command = {
+            "text": "hello",
+            "user_id": "U123",
+            "channel_id": "D123",
+            "team_id": "T123",
+        }
+
+        await adapter._handle_slash_command(command)
+
+        adapter.handle_message.assert_awaited_once()
+        event = adapter.handle_message.await_args.args[0]
+        assert event.source.chat_type == "dm"
+        assert event.source.chat_id == "D123"
+        assert event.source.user_id == "U123"
+
+
 # ---------------------------------------------------------------------------
 # TestAppMentionHandler
 # ---------------------------------------------------------------------------
@@ -515,6 +558,28 @@ class TestSendDocument:
         sleep_mock.assert_awaited_once()
 
 
+class TestSendPrivateNotice:
+    @pytest.mark.asyncio
+    async def test_send_private_notice_uses_ephemeral_api(self, adapter):
+        adapter._app.client.chat_postEphemeral = AsyncMock(return_value={"message_ts": "123.456"})
+
+        result = await adapter.send_private_notice(
+            chat_id="C123",
+            user_id="U123",
+            content="private hello",
+            metadata={"thread_id": "1234567890.123456"},
+        )
+
+        assert result.success
+        adapter._app.client.chat_postEphemeral.assert_called_once_with(
+            channel="C123",
+            user="U123",
+            text="private hello",
+            mrkdwn=True,
+            thread_ts="1234567890.123456",
+        )
+
+
 # ---------------------------------------------------------------------------
 # TestSendVideo
 # ---------------------------------------------------------------------------
@@ -1088,6 +1153,104 @@ class TestSendTyping:
             status="is thinking...",
         )
 
+    @pytest.mark.asyncio
+    async def test_stop_typing_clears_tracked_thread(self, adapter):
+        adapter._app.client.assistant_threads_setStatus = AsyncMock()
+        await adapter.send_typing("C123", metadata={"thread_id": "parent_ts"})
+
+        await adapter.stop_typing("C123", metadata={"thread_id": "parent_ts"})
+
+        assert adapter._app.client.assistant_threads_setStatus.call_args_list[1] == call(
+            channel_id="C123",
+            thread_ts="parent_ts",
+            status="",
+        )
+        assert "C123" not in adapter._active_status_threads
+
+    @pytest.mark.asyncio
+    async def test_stop_typing_noop_without_tracked_thread(self, adapter):
+        adapter._app.client.assistant_threads_setStatus = AsyncMock()
+
+        await adapter.stop_typing("C123")
+
+        adapter._app.client.assistant_threads_setStatus.assert_not_called()
+
+    @pytest.mark.asyncio
+    async def test_stop_typing_handles_api_error_gracefully(self, adapter):
+        adapter._active_status_threads["C123"] = "parent_ts"
+        adapter._app.client.assistant_threads_setStatus = AsyncMock(
+            side_effect=Exception("missing_scope")
+        )
+
+        await adapter.stop_typing("C123")
+
+        adapter._app.client.assistant_threads_setStatus.assert_called_once_with(
+            channel_id="C123",
+            thread_ts="parent_ts",
+            status="",
+        )
+        assert "C123" not in adapter._active_status_threads
+
+    @pytest.mark.asyncio
+    async def test_send_clears_status_after_final_post(self, adapter):
+        adapter._app.client.chat_postMessage = AsyncMock(return_value={"ts": "reply_ts"})
+        adapter._app.client.assistant_threads_setStatus = AsyncMock()
+        adapter._active_status_threads["C123"] = "parent_ts"
+
+        result = await adapter.send("C123", "done", metadata={"thread_id": "parent_ts"})
+
+        assert result.success
+        adapter._app.client.chat_postMessage.assert_called_once()
+        adapter._app.client.assistant_threads_setStatus.assert_called_once_with(
+            channel_id="C123",
+            thread_ts="parent_ts",
+            status="",
+        )
+        assert "C123" not in adapter._active_status_threads
+
+    @pytest.mark.asyncio
+    async def test_streaming_final_edit_clears_status(self, adapter):
+        adapter._app.client.chat_update = AsyncMock()
+        adapter._app.client.assistant_threads_setStatus = AsyncMock()
+        adapter._active_status_threads["C123"] = "parent_ts"
+
+        result = await adapter.edit_message(
+            "C123",
+            "reply_ts",
+            "done",
+            finalize=True,
+        )
+
+        assert result.success
+        adapter._app.client.chat_update.assert_called_once_with(
+            channel="C123",
+            ts="reply_ts",
+            text="done",
+        )
+        adapter._app.client.assistant_threads_setStatus.assert_called_once_with(
+            channel_id="C123",
+            thread_ts="parent_ts",
+            status="",
+        )
+        assert "C123" not in adapter._active_status_threads
+
+    @pytest.mark.asyncio
+    async def test_streaming_intermediate_edit_keeps_status(self, adapter):
+        adapter._app.client.chat_update = AsyncMock()
+        adapter._app.client.assistant_threads_setStatus = AsyncMock()
+        adapter._active_status_threads["C123"] = "parent_ts"
+
+        result = await adapter.edit_message(
+            "C123",
+            "reply_ts",
+            "partial",
+            finalize=False,
+        )
+
+        assert result.success
+        adapter._app.client.assistant_threads_setStatus.assert_not_called()
+        assert adapter._active_status_threads["C123"] == "parent_ts"
+
 
 # ---------------------------------------------------------------------------
 # TestFormatMessage — Markdown → mrkdwn conversion
@@ -1312,6 +1475,16 @@ class TestFormatMessage:
         result = adapter.format_message("[link](https://x.com?a=1&b=2)")
         assert result == "<https://x.com?a=1&b=2|link>"
 
+    def test_markdown_image_does_not_create_broken_slack_link(self, adapter):
+        """Markdown image syntax should not become '!<url|alt>' in Slack."""
+        result = adapter.format_message("![alt](https://img.example.com/cat.png)")
+        assert result == "![alt](https://img.example.com/cat.png)"
+
+    def test_literal_asterisks_with_spaces_are_not_treated_as_italic(self, adapter):
+        """Asterisks used as plain delimiters should stay literal."""
+        result = adapter.format_message("a * b * c")
+        assert result == "a * b * c"
+
     def test_emoji_shortcodes_passthrough(self, adapter):
         """Emoji shortcodes like :smile: pass through unchanged."""
         assert adapter.format_message(":smile: hello :wave:") == ":smile: hello :wave:"
@@ -2586,3 +2759,284 @@ class TestSlackReplyToText:
         assert msg_event.reply_to_text is None
         # Top-level message: reply_to_message_id must be falsy (None or empty).
         assert not msg_event.reply_to_message_id
+
+
+# ---------------------------------------------------------------------------
+# Slash-command ephemeral ack and routing (#18182)
+# ---------------------------------------------------------------------------
+
+
+class TestSlashEphemeralAck:
+    """Slash commands should produce an ephemeral ack and route replies ephemerally."""
+
+    @pytest.mark.asyncio
+    async def test_slash_command_stashes_response_url(self, adapter):
+        """_handle_slash_command stashes response_url for later ephemeral routing."""
+        command = {
+            "command": "/q",
+            "text": "follow-up question",
+            "user_id": "U_SLASH",
+            "channel_id": "C_SLASH",
+            "response_url": "https://hooks.slack.com/commands/T123/456/abc",
+        }
+        await adapter._handle_slash_command(command)
+
+        # The context should be stashed under (channel_id, user_id).
+        key = ("C_SLASH", "U_SLASH")
+        assert key in adapter._slash_command_contexts
+        ctx = adapter._slash_command_contexts[key]
+        assert ctx["response_url"] == "https://hooks.slack.com/commands/T123/456/abc"
+        assert "ts" in ctx
+
+    @pytest.mark.asyncio
+    async def test_slash_command_without_response_url_does_not_stash(self, adapter):
+        """Commands without a response_url should not create a context."""
+        command = {
+            "command": "/stop",
+            "text": "",
+            "user_id": "U1",
+            "channel_id": "C1",
+            # no response_url
+        }
+        await adapter._handle_slash_command(command)
+        assert len(adapter._slash_command_contexts) == 0
+
+    @pytest.mark.asyncio
+    async def test_pop_slash_context_returns_and_removes(self, adapter):
+        """_pop_slash_context returns the context and removes it."""
+        import time
+        adapter._slash_command_contexts[("C1", "U1")] = {
+            "response_url": "https://hooks.slack.com/test",
+            "ts": time.monotonic(),
+        }
+
+        ctx = adapter._pop_slash_context("C1")
+        assert ctx is not None
+        assert ctx["response_url"] == "https://hooks.slack.com/test"
+        # Must be removed after pop
+        assert len(adapter._slash_command_contexts) == 0
+
+    @pytest.mark.asyncio
+    async def test_pop_slash_context_returns_none_for_no_match(self, adapter):
+        """_pop_slash_context returns None when no context exists."""
+        ctx = adapter._pop_slash_context("C_NONEXISTENT")
+        assert ctx is None
+
+    @pytest.mark.asyncio
+    async def test_pop_slash_context_discards_stale_entries(self, adapter):
+        """Stale contexts older than TTL are cleaned up."""
+        import time
+        adapter._slash_command_contexts[("C1", "U1")] = {
+            "response_url": "https://hooks.slack.com/stale",
+            "ts": time.monotonic() - adapter._SLASH_CTX_TTL - 1,
+        }
+
+        ctx = adapter._pop_slash_context("C1")
+        assert ctx is None
+        assert len(adapter._slash_command_contexts) == 0
+
+    @pytest.mark.asyncio
+    async def test_send_uses_response_url_when_context_exists(self, adapter):
+        """send() should POST to response_url for slash command replies."""
+        import time
+        adapter._slash_command_contexts[("C_SLASH", "U_SLASH")] = {
+            "response_url": "https://hooks.slack.com/commands/T123/456/abc",
+            "ts": time.monotonic(),
+        }
+
+        mock_resp = AsyncMock()
+        mock_resp.status = 200
+        mock_resp.__aenter__ = AsyncMock(return_value=mock_resp)
+        mock_resp.__aexit__ = AsyncMock(return_value=False)
+
+        mock_session = AsyncMock()
+        mock_session.post = MagicMock(return_value=mock_resp)
+        mock_session.__aenter__ = AsyncMock(return_value=mock_session)
+        mock_session.__aexit__ = AsyncMock(return_value=False)
+
+        with patch("gateway.platforms.slack.aiohttp.ClientSession", return_value=mock_session):
+            result = await adapter.send("C_SLASH", "Queued for the next turn.")
+
+        assert result.success is True
+        # Verify response_url was POSTed to
+        mock_session.post.assert_called_once()
+        call_args = mock_session.post.call_args
+        assert call_args[0][0] == "https://hooks.slack.com/commands/T123/456/abc"
+        payload = call_args[1]["json"]
+        assert payload["response_type"] == "ephemeral"
+        assert payload["replace_original"] is True
+        assert "Queued for the next turn" in payload["text"]
+
+        # Context must be consumed
+        assert len(adapter._slash_command_contexts) == 0
+
+    @pytest.mark.asyncio
+    async def test_send_falls_through_without_context(self, adapter):
+        """send() should use normal chat_postMessage when no slash context exists."""
+        mock_result = {"ts": "1234.5678", "ok": True}
+        adapter._app.client.chat_postMessage = AsyncMock(return_value=mock_result)
+
+        result = await adapter.send("C_NORMAL", "Hello world")
+
+        assert result.success is True
+        adapter._app.client.chat_postMessage.assert_called_once()
+
+    @pytest.mark.asyncio
+    async def test_send_slash_ephemeral_fallback_on_post_failure(self, adapter):
+        """_send_slash_ephemeral returns success=True even if POST fails."""
+        import time
+        adapter._slash_command_contexts[("C1", "U1")] = {
+            "response_url": "https://hooks.slack.com/commands/bad",
+            "ts": time.monotonic(),
+        }
+
+        mock_resp = AsyncMock()
+        mock_resp.status = 500
+        mock_resp.text = AsyncMock(return_value="Internal Server Error")
+        mock_resp.__aenter__ = AsyncMock(return_value=mock_resp)
+        mock_resp.__aexit__ = AsyncMock(return_value=False)
+
+        mock_session = AsyncMock()
+        mock_session.post = MagicMock(return_value=mock_resp)
+        mock_session.__aenter__ = AsyncMock(return_value=mock_session)
+        mock_session.__aexit__ = AsyncMock(return_value=False)
+
+        with patch("gateway.platforms.slack.aiohttp.ClientSession", return_value=mock_session):
+            result = await adapter.send("C1", "Some response")
+
+        # Still success — the user saw the initial ack already
+        assert result.success is True
+
+    @pytest.mark.asyncio
+    async def test_send_slash_ephemeral_fallback_on_exception(self, adapter):
+        """_send_slash_ephemeral returns success=True even if aiohttp raises."""
+        import time
+        adapter._slash_command_contexts[("C1", "U1")] = {
+            "response_url": "https://hooks.slack.com/commands/timeout",
+            "ts": time.monotonic(),
+        }
+
+        mock_session = AsyncMock()
+        mock_session.post = MagicMock(side_effect=Exception("connection timeout"))
+        mock_session.__aenter__ = AsyncMock(return_value=mock_session)
+        mock_session.__aexit__ = AsyncMock(return_value=False)
+
+        with patch("gateway.platforms.slack.aiohttp.ClientSession", return_value=mock_session):
+            result = await adapter.send("C1", "Some response")
+
+        assert result.success is True
+
+    @pytest.mark.asyncio
+    async def test_native_slash_stashes_context_and_dispatches(self, adapter):
+        """Full flow: native /q slash → stash + handle_message dispatch."""
+        command = {
+            "command": "/q",
+            "text": "do something",
+            "user_id": "U_Q",
+            "channel_id": "C_Q",
+            "response_url": "https://hooks.slack.com/commands/T1/2/q",
+        }
+        await adapter._handle_slash_command(command)
+
+        # 1. handle_message was called with the right event
+        adapter.handle_message.assert_called_once()
+        event = adapter.handle_message.call_args[0][0]
+        assert event.text == "/q do something"
+        assert event.message_type == MessageType.COMMAND
+
+        # 2. Context stashed for ephemeral routing
+        assert ("C_Q", "U_Q") in adapter._slash_command_contexts
+
+    @pytest.mark.asyncio
+    async def test_legacy_hermes_slash_stashes_context(self, adapter):
+        """Legacy /hermes <subcommand> also stashes context."""
+        command = {
+            "command": "/hermes",
+            "text": "help",
+            "user_id": "U_H",
+            "channel_id": "C_H",
+            "response_url": "https://hooks.slack.com/commands/T1/3/h",
+        }
+        await adapter._handle_slash_command(command)
+
+        adapter.handle_message.assert_called_once()
+        assert ("C_H", "U_H") in adapter._slash_command_contexts
+
+    @pytest.mark.asyncio
+    async def test_freeform_hermes_question_does_not_stash_context(self, adapter):
+        """Free-form /hermes <question> must NOT route agent reply ephemeral."""
+        command = {
+            "command": "/hermes",
+            "text": "what's the weather",
+            "user_id": "U_FREE",
+            "channel_id": "C_FREE",
+            "response_url": "https://hooks.slack.com/commands/T1/4/free",
+        }
+        await adapter._handle_slash_command(command)
+
+        adapter.handle_message.assert_called_once()
+        event = adapter.handle_message.call_args[0][0]
+        # Free-form text — not a command
+        assert event.message_type == MessageType.TEXT
+        assert event.text == "what's the weather"
+        # Context must NOT be stashed — agent reply should be public
+        assert len(adapter._slash_command_contexts) == 0
+
+    @pytest.mark.asyncio
+    async def test_concurrent_users_same_channel_isolates_contexts(self, adapter):
+        """Two users slash on the same channel — each gets their own context."""
+        import time
+        from gateway.platforms.slack import _slash_user_id
+
+        # Simulate two users stashing contexts on the same channel.
+        adapter._slash_command_contexts[("C_SHARED", "U_ALICE")] = {
+            "response_url": "https://hooks.slack.com/alice",
+            "ts": time.monotonic(),
+        }
+        adapter._slash_command_contexts[("C_SHARED", "U_BOB")] = {
+            "response_url": "https://hooks.slack.com/bob",
+            "ts": time.monotonic(),
+        }
+
+        # Alice's send() — ContextVar set to Alice's user_id.
+        token = _slash_user_id.set("U_ALICE")
+        try:
+            ctx = adapter._pop_slash_context("C_SHARED")
+        finally:
+            _slash_user_id.reset(token)
+
+        assert ctx is not None
+        assert ctx["response_url"] == "https://hooks.slack.com/alice"
+        # Bob's context must still be there.
+        assert ("C_SHARED", "U_BOB") in adapter._slash_command_contexts
+        assert len(adapter._slash_command_contexts) == 1
+
+        # Bob's send() — ContextVar set to Bob's user_id.
+        token = _slash_user_id.set("U_BOB")
+        try:
+            ctx = adapter._pop_slash_context("C_SHARED")
+        finally:
+            _slash_user_id.reset(token)
+
+        assert ctx is not None
+        assert ctx["response_url"] == "https://hooks.slack.com/bob"
+        assert len(adapter._slash_command_contexts) == 0
+
+    @pytest.mark.asyncio
+    async def test_no_contextvar_does_not_match_any_context(self, adapter):
+        """send() without ContextVar (non-slash path) must not steal contexts."""
+        import time
+        from gateway.platforms.slack import _slash_user_id
+
+        adapter._slash_command_contexts[("C1", "U1")] = {
+            "response_url": "https://hooks.slack.com/test",
+            "ts": time.monotonic(),
+        }
+
+        # ContextVar is unset (default=None) — simulates a normal message send.
+        assert _slash_user_id.get() is None
+        ctx = adapter._pop_slash_context("C1")
+        # Fallback scan still finds it (channel-only) — this is fine for
+        # the normal single-user case; the ContextVar path is the precise one.
+        # The key invariant is: when the ContextVar IS set, it matches exactly.
+        assert ctx is not None  # fallback path finds the entry

tests/gateway/test_slack_mention.py

@@ -215,6 +215,23 @@ def test_free_response_channels_env_var_fallback(monkeypatch):
     assert OTHER_CHANNEL_ID in result
 
 
+def test_free_response_channels_bare_int():
+    # YAML `free_response_channels: 1491973769726791812` (single bare integer)
+    # is loaded as an int and would previously fall through the isinstance(str)
+    # branch to return an empty set.  Coerce scalar → str so single-channel
+    # config without quoting works as users expect.
+    adapter = _make_adapter(free_response_channels=1491973769726791812)
+    result = adapter._slack_free_response_channels()
+    assert result == {"1491973769726791812"}
+
+
+def test_free_response_channels_int_list():
+    # YAML list form with bare numeric entries — each element should be coerced.
+    adapter = _make_adapter(free_response_channels=[1491973769726791812, 99999])
+    result = adapter._slack_free_response_channels()
+    assert result == {"1491973769726791812", "99999"}
+
+
 # ---------------------------------------------------------------------------
 # Tests: mention gating integration (simulating _handle_slack_message logic)
 # ---------------------------------------------------------------------------

tests/gateway/test_stale_code_self_check.py

@@ -0,0 +1,223 @@
+"""Tests for the gateway stale-code self-check (Issue #17648).
+
+A gateway that survives ``hermes update`` keeps pre-update modules cached
+in ``sys.modules``.  Later imports of names added post-update (e.g.
+``cfg_get`` from PR #17304) raise ImportError against the stale module
+object.  The self-check in ``GatewayRunner._detect_stale_code()`` detects
+this by comparing boot-time sentinel-file mtimes against current ones,
+and ``_trigger_stale_code_restart()`` triggers a graceful restart.
+"""
+
+import os
+import time
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from gateway.run import (
+    GatewayRunner,
+    _compute_repo_mtime,
+    _STALE_CODE_SENTINELS,
+)
+
+
+def _make_tmp_repo(tmp_path: Path) -> Path:
+    """Create a fake repo with all stale-code sentinel files."""
+    for rel in _STALE_CODE_SENTINELS:
+        p = tmp_path / rel
+        p.parent.mkdir(parents=True, exist_ok=True)
+        p.write_text("# test sentinel\n")
+    return tmp_path
+
+
+def _make_runner(repo_root: Path, *, boot_mtime: float, boot_wall: float):
+    """Bare GatewayRunner with just the stale-check attributes set."""
+    runner = object.__new__(GatewayRunner)
+    runner._repo_root_for_staleness = repo_root
+    runner._boot_wall_time = boot_wall
+    runner._boot_repo_mtime = boot_mtime
+    runner._stale_code_notified = set()
+    runner._stale_code_restart_triggered = False
+    return runner
+
+
+def test_compute_repo_mtime_returns_newest(tmp_path):
+    """_compute_repo_mtime returns the newest mtime across sentinel files."""
+    repo = _make_tmp_repo(tmp_path)
+
+    # Stamp a baseline mtime across all sentinels
+    baseline = time.time() - 100
+    for rel in _STALE_CODE_SENTINELS:
+        os.utime(repo / rel, (baseline, baseline))
+
+    # Touch one file forward
+    newer = time.time()
+    os.utime(repo / "hermes_cli/config.py", (newer, newer))
+
+    result = _compute_repo_mtime(repo)
+    assert abs(result - newer) < 1.0  # within 1s (filesystem mtime resolution)
+
+
+def test_compute_repo_mtime_missing_files_returns_zero(tmp_path):
+    """Missing sentinel files return 0.0 (treated as 'can't tell' upstream)."""
+    # tmp_path has none of the sentinels
+    assert _compute_repo_mtime(tmp_path) == 0.0
+
+
+def test_compute_repo_mtime_partial_files_still_works(tmp_path):
+    """Partial sentinel presence still returns newest of the readable ones."""
+    (tmp_path / "hermes_cli").mkdir()
+    target = tmp_path / "hermes_cli" / "config.py"
+    target.write_text("# partial\n")
+    target_mtime = time.time() - 50
+    os.utime(target, (target_mtime, target_mtime))
+
+    result = _compute_repo_mtime(tmp_path)
+    assert abs(result - target_mtime) < 1.0
+
+
+def test_detect_stale_code_false_when_no_boot_snapshot(tmp_path):
+    """No boot snapshot → can't tell → not stale (no restart loop)."""
+    repo = _make_tmp_repo(tmp_path)
+    runner = _make_runner(repo, boot_mtime=0.0, boot_wall=0.0)
+    assert runner._detect_stale_code() is False
+
+
+def test_detect_stale_code_false_when_files_unchanged(tmp_path):
+    """Source files at boot mtime → not stale."""
+    repo = _make_tmp_repo(tmp_path)
+    # Freeze all sentinels to the same mtime
+    baseline = time.time() - 100
+    for rel in _STALE_CODE_SENTINELS:
+        os.utime(repo / rel, (baseline, baseline))
+
+    runner = _make_runner(repo, boot_mtime=baseline, boot_wall=baseline)
+    assert runner._detect_stale_code() is False
+
+
+def test_detect_stale_code_true_after_update(tmp_path):
+    """Sentinel files newer than boot snapshot → stale."""
+    repo = _make_tmp_repo(tmp_path)
+    baseline = time.time() - 100
+    for rel in _STALE_CODE_SENTINELS:
+        os.utime(repo / rel, (baseline, baseline))
+
+    runner = _make_runner(repo, boot_mtime=baseline, boot_wall=baseline)
+
+    # Simulate hermes update touching config.py
+    new_mtime = time.time()
+    os.utime(repo / "hermes_cli/config.py", (new_mtime, new_mtime))
+
+    assert runner._detect_stale_code() is True
+
+
+def test_detect_stale_code_ignores_subsecond_drift(tmp_path):
+    """2-second slack prevents false positives on coarse-mtime filesystems."""
+    repo = _make_tmp_repo(tmp_path)
+    baseline = time.time() - 100
+    for rel in _STALE_CODE_SENTINELS:
+        os.utime(repo / rel, (baseline, baseline))
+
+    runner = _make_runner(repo, boot_mtime=baseline, boot_wall=baseline)
+
+    # Touch config.py 1s newer — within the 2s slack → not stale
+    os.utime(repo / "hermes_cli/config.py", (baseline + 1.0, baseline + 1.0))
+    assert runner._detect_stale_code() is False
+
+    # Touch 5s newer → stale
+    os.utime(repo / "hermes_cli/config.py", (baseline + 5.0, baseline + 5.0))
+    assert runner._detect_stale_code() is True
+
+
+def test_trigger_stale_code_restart_is_idempotent(tmp_path):
+    """Calling _trigger_stale_code_restart twice only requests restart once."""
+    repo = _make_tmp_repo(tmp_path)
+    runner = _make_runner(repo, boot_mtime=1.0, boot_wall=1.0)
+
+    calls = []
+
+    def fake_request_restart(*, detached=False, via_service=False):
+        calls.append((detached, via_service))
+        return True
+
+    runner.request_restart = fake_request_restart
+
+    runner._trigger_stale_code_restart()
+    runner._trigger_stale_code_restart()
+    runner._trigger_stale_code_restart()
+
+    assert len(calls) == 1
+    assert runner._stale_code_restart_triggered is True
+
+
+def test_trigger_stale_code_restart_survives_request_failure(tmp_path):
+    """If request_restart raises, we swallow and mark as triggered anyway."""
+    repo = _make_tmp_repo(tmp_path)
+    runner = _make_runner(repo, boot_mtime=1.0, boot_wall=1.0)
+
+    def boom(*, detached=False, via_service=False):
+        raise RuntimeError("no event loop")
+
+    runner.request_restart = boom
+
+    # Should not raise
+    runner._trigger_stale_code_restart()
+
+    # Marked triggered so we don't retry on every subsequent message
+    assert runner._stale_code_restart_triggered is True
+
+
+def test_detect_stale_code_handles_disappearing_repo_root(tmp_path):
+    """If the repo root vanishes after boot, return False (don't loop)."""
+    repo = _make_tmp_repo(tmp_path)
+    baseline = time.time() - 100
+    for rel in _STALE_CODE_SENTINELS:
+        os.utime(repo / rel, (baseline, baseline))
+
+    runner = _make_runner(repo, boot_mtime=baseline, boot_wall=baseline)
+
+    # Remove all sentinel files — _compute_repo_mtime returns 0.0
+    for rel in _STALE_CODE_SENTINELS:
+        (repo / rel).unlink(missing_ok=True)
+
+    assert runner._detect_stale_code() is False
+
+
+def test_class_level_defaults_prevent_uninitialized_access():
+    """Partial construction via object.__new__ must not crash _detect_stale_code."""
+    runner = object.__new__(GatewayRunner)
+    # Don't set any instance attrs — class-level defaults should kick in
+    runner._repo_root_for_staleness = Path(".")
+    # _boot_wall_time / _boot_repo_mtime fall through to class defaults (0.0)
+    assert runner._detect_stale_code() is False
+    # _stale_code_restart_triggered falls through to class default (False)
+    assert runner._stale_code_restart_triggered is False
+
+
+def test_init_captures_boot_snapshot(monkeypatch, tmp_path):
+    """GatewayRunner.__init__ captures a usable stale-code baseline."""
+    # Stub out the heavy parts of __init__ we don't need.  We only want
+    # to prove the stale-code snapshot is captured before anything else.
+    from gateway import run as run_mod
+
+    calls = {}
+
+    def fake_compute(repo_root):
+        calls["repo_root"] = repo_root
+        return 1234567890.0
+
+    monkeypatch.setattr(run_mod, "_compute_repo_mtime", fake_compute)
+
+    # Build a runner without running the full __init__ — then manually
+    # exercise the stale-check init block that __init__ contains.
+    runner = object.__new__(GatewayRunner)
+    runner._boot_wall_time = time.time()
+    runner._repo_root_for_staleness = Path(run_mod.__file__).resolve().parent.parent
+    runner._boot_repo_mtime = run_mod._compute_repo_mtime(runner._repo_root_for_staleness)
+    runner._stale_code_notified = set()
+    runner._stale_code_restart_triggered = False
+
+    assert runner._boot_repo_mtime == 1234567890.0
+    assert calls["repo_root"] == runner._repo_root_for_staleness
+    assert runner._boot_wall_time > 0

tests/gateway/test_status.py

@@ -2,6 +2,7 @@
 
 import json
 import os
+from pathlib import Path
 from types import SimpleNamespace
 
 from gateway import status
@@ -245,6 +246,27 @@ class TestGatewayPidState:
 
 
 class TestGatewayRuntimeStatus:
+    def test_write_json_file_uses_atomic_json_write(self, tmp_path, monkeypatch):
+        monkeypatch.setenv("HERMES_HOME", str(tmp_path))
+        calls = []
+
+        def _fake_atomic_json_write(path, payload, **kwargs):
+            calls.append((Path(path), payload, kwargs))
+
+        monkeypatch.setattr(status, "atomic_json_write", _fake_atomic_json_write)
+
+        payload = {"gateway_state": "running"}
+        target = tmp_path / "gateway_state.json"
+        status._write_json_file(target, payload)
+
+        assert calls == [
+            (
+                target,
+                payload,
+                {"indent": None, "separators": (",", ":")},
+            )
+        ]
+
     def test_write_runtime_status_overwrites_stale_pid_on_restart(self, tmp_path, monkeypatch):
         """Regression: setdefault() preserved stale PID from previous process (#1631)."""
         monkeypatch.setenv("HERMES_HOME", str(tmp_path))
@@ -349,6 +371,35 @@ class TestTerminatePid:
 
 
 class TestScopedLocks:
+    def test_windows_file_lock_uses_high_offset(self, tmp_path, monkeypatch):
+        lock_path = tmp_path / "gateway.lock"
+        handle = open(lock_path, "a+", encoding="utf-8")
+        fd = handle.fileno()
+        calls = []
+
+        def fake_locking(fd, mode, size):
+            calls.append((fd, mode, size, handle.tell()))
+
+        monkeypatch.setattr(status, "_IS_WINDOWS", True)
+        monkeypatch.setattr(
+            status,
+            "msvcrt",
+            SimpleNamespace(LK_NBLCK=1, LK_UNLCK=2, locking=fake_locking),
+            raising=False,
+        )
+
+        try:
+            assert status._try_acquire_file_lock(handle) is True
+            status._release_file_lock(handle)
+        finally:
+            handle.close()
+
+        assert calls == [
+            (fd, 1, 1, status._WINDOWS_LOCK_OFFSET),
+            (fd, 2, 1, status._WINDOWS_LOCK_OFFSET),
+        ]
+        assert lock_path.read_text(encoding="utf-8") == "\n"
+
     def test_acquire_scoped_lock_rejects_live_other_process(self, tmp_path, monkeypatch):
         monkeypatch.setenv("HERMES_GATEWAY_LOCK_DIR", str(tmp_path / "locks"))
         lock_path = tmp_path / "locks" / "telegram-bot-token-2bb80d537b1da3e3.lock"

tests/gateway/test_status_command.py

@@ -55,6 +55,9 @@ def _make_runner(session_entry: SessionEntry, *, platform: Platform = Platform.T
     runner._pending_approvals = {}
     runner._session_db = MagicMock()
     runner._session_db.get_session_title.return_value = None
+    # Default: no DB row → /status reports 0 tokens.  Tests that exercise
+    # the populated path override this.
+    runner._session_db.get_session.return_value = None
     runner._reasoning_config = None
     runner._provider_routing = {}
     runner._fallback_model = None
@@ -80,6 +83,14 @@ async def test_status_command_reports_running_agent_without_interrupt(monkeypatc
         total_tokens=321,
     )
     runner = _make_runner(session_entry)
+    # Token total comes from the SQLite SessionDB, not SessionEntry.
+    runner._session_db.get_session.return_value = {
+        "input_tokens": 200,
+        "output_tokens": 121,
+        "cache_read_tokens": 0,
+        "cache_write_tokens": 0,
+        "reasoning_tokens": 0,
+    }
     running_agent = MagicMock()
     runner._running_agents[build_session_key(_make_source())] = running_agent
 
@@ -113,6 +124,56 @@ async def test_status_command_includes_session_title_when_present():
     assert "**Title:** My titled session" in result
 
 
+@pytest.mark.asyncio
+async def test_status_command_reads_token_totals_from_session_db():
+    """Regression test for #17158: /status must source token totals from the
+    SQLite SessionDB (where run_agent.py persists them) and sum all component
+    counts, not from SessionEntry (which the agent never writes)."""
+    session_entry = SessionEntry(
+        session_key=build_session_key(_make_source()),
+        session_id="sess-1",
+        created_at=datetime.now(),
+        updated_at=datetime.now(),
+        platform=Platform.TELEGRAM,
+        chat_type="dm",
+        total_tokens=0,  # SessionEntry never gets written to — always 0.
+    )
+    runner = _make_runner(session_entry)
+    runner._session_db.get_session.return_value = {
+        "input_tokens": 1000,
+        "output_tokens": 250,
+        "cache_read_tokens": 500,
+        "cache_write_tokens": 100,
+        "reasoning_tokens": 50,
+    }
+
+    result = await runner._handle_message(_make_event("/status"))
+
+    # 1000 + 250 + 500 + 100 + 50 = 1,900
+    assert "**Tokens:** 1,900" in result
+
+
+@pytest.mark.asyncio
+async def test_status_command_tokens_zero_when_session_db_row_missing():
+    """When the SessionDB has no row for the current session yet (fresh
+    session, no agent calls), /status reports 0 without raising."""
+    session_entry = SessionEntry(
+        session_key=build_session_key(_make_source()),
+        session_id="sess-1",
+        created_at=datetime.now(),
+        updated_at=datetime.now(),
+        platform=Platform.TELEGRAM,
+        chat_type="dm",
+        total_tokens=999,  # This should be ignored.
+    )
+    runner = _make_runner(session_entry)
+    runner._session_db.get_session.return_value = None
+
+    result = await runner._handle_message(_make_event("/status"))
+
+    assert "**Tokens:** 0" in result
+
+
 @pytest.mark.asyncio
 async def test_agents_command_reports_active_agents_and_processes(monkeypatch):
     session_key = build_session_key(_make_source())
@@ -507,3 +568,68 @@ async def test_profile_command_reports_custom_root_profile(monkeypatch, tmp_path
 
     assert "**Profile:** `coder`" in result
     assert f"**Home:** `{profile_home}`" in result
+
+
+@pytest.mark.asyncio
+async def test_post_delivery_callback_generation_snapshot_happens_after_bind():
+    """Regression: the callback_generation snapshot in _process_message_background
+    must happen AFTER the handler runs, not before.
+
+    _hermes_run_generation is set on the interrupt event by
+    GatewayRunner._bind_adapter_run_generation during _handle_message_with_agent.
+    The earlier snapshot-at-task-start always captured None, which bypassed the
+    generation-ownership check in pop_post_delivery_callback and let stale runs
+    fire a fresher run's callbacks.
+    """
+    import asyncio
+    from gateway.platforms.base import BasePlatformAdapter
+
+    source = _make_source()
+    session_key = build_session_key(source)
+    fired = []
+
+    class _ConcreteAdapter(BasePlatformAdapter):
+        platform = Platform.TELEGRAM
+
+        async def connect(self): pass
+        async def disconnect(self): pass
+        async def send(self, chat_id, content, **kwargs): pass
+        async def get_chat_info(self, chat_id): return {}
+
+    adapter = _ConcreteAdapter(
+        PlatformConfig(enabled=True, token="***"), Platform.TELEGRAM
+    )
+
+    async def fake_handler(event):
+        # Simulate what _bind_adapter_run_generation does mid-run.
+        interrupt_event = adapter._active_sessions.get(session_key)
+        setattr(interrupt_event, "_hermes_run_generation", 1)
+        # Stale run registers its callback at generation=1.
+        adapter.register_post_delivery_callback(
+            session_key,
+            lambda: fired.append("older"),
+            generation=1,
+        )
+        # A fresher run overwrites with generation=2 (different dict entry).
+        adapter.register_post_delivery_callback(
+            session_key,
+            lambda: fired.append("newer"),
+            generation=2,
+        )
+        return None
+
+    adapter.set_message_handler(fake_handler)
+    event = MessageEvent(text="hello", source=source, message_id="m1")
+
+    await adapter.handle_message(event)
+    tasks = list(adapter._background_tasks)
+    assert tasks, "expected background task to be created"
+    await asyncio.gather(*tasks)
+
+    # The stale run (generation=1) must NOT fire the fresher run's callback
+    # (generation=2). With the pre-fix code, callback_generation was snapshotted
+    # as None before the handler ran, bypassing the ownership check and firing
+    # "newer" anyway.
+    assert fired == []
+    assert session_key in adapter._post_delivery_callbacks
+    assert adapter._post_delivery_callbacks[session_key][0] == 2

tests/gateway/test_telegram_approval_buttons.py

@@ -59,6 +59,21 @@ def _make_adapter(extra=None):
     return adapter
 
 
+class _AuthRunner:
+    """Minimal runner shim for callback auth tests."""
+
+    def __init__(self, authorized: bool):
+        self.authorized = authorized
+        self.last_source = None
+
+    async def _handle_message(self, event):
+        return None
+
+    def _is_user_authorized(self, source):
+        self.last_source = source
+        return self.authorized
+
+
 # ===========================================================================
 # send_exec_approval — inline keyboard buttons
 # ===========================================================================
@@ -230,6 +245,41 @@ class TestTelegramApprovalCallback:
         edit_kwargs = query.edit_message_text.call_args[1]
         assert "Denied" in edit_kwargs["text"]
 
+    @pytest.mark.asyncio
+    async def test_approval_callback_rejects_user_blocked_by_global_allowlist(self):
+        adapter = _make_adapter()
+        adapter._approval_state[7] = "agent:main:telegram:group:12345:99"
+        runner = _AuthRunner(authorized=False)
+        adapter._message_handler = runner._handle_message
+
+        query = AsyncMock()
+        query.data = "ea:once:7"
+        query.message = MagicMock()
+        query.message.chat_id = 12345
+        query.message.chat.type = "private"
+        query.from_user = MagicMock()
+        query.from_user.id = 222
+        query.from_user.first_name = "Mallory"
+        query.answer = AsyncMock()
+        query.edit_message_text = AsyncMock()
+
+        update = MagicMock()
+        update.callback_query = query
+        context = MagicMock()
+
+        with patch("tools.approval.resolve_gateway_approval") as mock_resolve:
+            await adapter._handle_callback_query(update, context)
+
+        mock_resolve.assert_not_called()
+        query.answer.assert_called_once()
+        assert "not authorized" in query.answer.call_args[1]["text"].lower()
+        query.edit_message_text.assert_not_called()
+        assert adapter._approval_state[7] == "agent:main:telegram:group:12345:99"
+        assert runner.last_source is not None
+        assert runner.last_source.platform == Platform.TELEGRAM
+        assert runner.last_source.user_id == "222"
+        assert runner.last_source.chat_id == "12345"
+
     @pytest.mark.asyncio
     async def test_already_resolved(self):
         adapter = _make_adapter()
@@ -333,6 +383,39 @@ class TestTelegramApprovalCallback:
         query.edit_message_text.assert_not_called()
         assert not (tmp_path / ".update_response").exists()
 
+    @pytest.mark.asyncio
+    async def test_update_prompt_callback_rejects_user_blocked_by_global_allowlist(self, tmp_path):
+        adapter = _make_adapter()
+        runner = _AuthRunner(authorized=False)
+        adapter._message_handler = runner._handle_message
+
+        query = AsyncMock()
+        query.data = "update_prompt:y"
+        query.message = MagicMock()
+        query.message.chat_id = 12345
+        query.message.chat.type = "private"
+        query.from_user = MagicMock()
+        query.from_user.id = 222
+        query.from_user.first_name = "Mallory"
+        query.answer = AsyncMock()
+        query.edit_message_text = AsyncMock()
+
+        update = MagicMock()
+        update.callback_query = query
+        context = MagicMock()
+
+        with patch("hermes_constants.get_hermes_home", return_value=tmp_path):
+            with patch.dict(os.environ, {"TELEGRAM_ALLOWED_USERS": ""}):
+                await adapter._handle_callback_query(update, context)
+
+        query.answer.assert_called_once()
+        assert "not authorized" in query.answer.call_args[1]["text"].lower()
+        query.edit_message_text.assert_not_called()
+        assert not (tmp_path / ".update_response").exists()
+        assert runner.last_source is not None
+        assert runner.last_source.platform == Platform.TELEGRAM
+        assert runner.last_source.user_id == "222"
+
     @pytest.mark.asyncio
     async def test_update_prompt_callback_allows_authorized_user(self, tmp_path):
         """Allowed Telegram users can still answer update prompt buttons."""

tests/gateway/test_update_command.py

@@ -17,13 +17,14 @@ from gateway.session import SessionSource
 
 
 def _make_event(text="/update", platform=Platform.TELEGRAM,
-                user_id="12345", chat_id="67890"):
+                user_id="12345", chat_id="67890", thread_id=None):
     """Build a MessageEvent for testing."""
     source = SessionSource(
         platform=platform,
         user_id=user_id,
         chat_id=chat_id,
         user_name="testuser",
+        thread_id=thread_id,
     )
     return MessageEvent(text=text, source=source)
 
@@ -214,6 +215,34 @@ class TestHandleUpdateCommand:
         assert "timestamp" in data
         assert not (hermes_home / ".update_exit_code").exists()
 
+    @pytest.mark.asyncio
+    async def test_writes_pending_marker_with_thread_id(self, tmp_path):
+        """Persists thread_id so update notifications can route back to the thread."""
+        runner = _make_runner()
+        event = _make_event(
+            platform=Platform.TELEGRAM,
+            chat_id="99999",
+            thread_id="777",
+        )
+
+        fake_root = tmp_path / "project"
+        fake_root.mkdir()
+        (fake_root / ".git").mkdir()
+        (fake_root / "gateway").mkdir()
+        (fake_root / "gateway" / "run.py").touch()
+        fake_file = str(fake_root / "gateway" / "run.py")
+        hermes_home = tmp_path / "hermes"
+        hermes_home.mkdir()
+
+        with patch("gateway.run._hermes_home", hermes_home), \
+             patch("gateway.run.__file__", fake_file), \
+             patch("shutil.which", side_effect=lambda x: "/usr/bin/hermes" if x == "hermes" else "/usr/bin/setsid"), \
+             patch("subprocess.Popen"):
+            await runner._handle_update_command(event)
+
+        data = json.loads((hermes_home / ".update_pending.json").read_text())
+        assert data["thread_id"] == "777"
+
     @pytest.mark.asyncio
     async def test_spawns_setsid(self, tmp_path):
         """Uses setsid when available."""
@@ -432,6 +461,31 @@ class TestSendUpdateNotification:
         assert call_args[0][0] == "67890"  # chat_id
         assert "Update complete" in call_args[0][1] or "update finished" in call_args[0][1].lower()
 
+    @pytest.mark.asyncio
+    async def test_sends_notification_with_thread_metadata(self, tmp_path):
+        """Final update notification preserves thread metadata when present."""
+        runner = _make_runner()
+        hermes_home = tmp_path / "hermes"
+        hermes_home.mkdir()
+
+        pending = {
+            "platform": "telegram",
+            "chat_id": "67890",
+            "thread_id": "777",
+            "user_id": "12345",
+        }
+        (hermes_home / ".update_pending.json").write_text(json.dumps(pending))
+        (hermes_home / ".update_output.txt").write_text("done")
+        (hermes_home / ".update_exit_code").write_text("0")
+
+        mock_adapter = AsyncMock()
+        runner.adapters = {Platform.TELEGRAM: mock_adapter}
+
+        with patch("gateway.run._hermes_home", hermes_home):
+            await runner._send_update_notification()
+
+        assert mock_adapter.send.call_args.kwargs["metadata"] == {"thread_id": "777"}
+
     @pytest.mark.asyncio
     async def test_strips_ansi_codes(self, tmp_path):
         """ANSI escape codes are removed from output."""

tests/gateway/test_update_streaming.py

@@ -321,6 +321,58 @@ class TestWatchUpdateProgress:
         # Check session was marked as having pending prompt
         # (may be cleared by the time we check since update finished)
 
+    @pytest.mark.asyncio
+    async def test_prompt_forwarding_preserves_thread_metadata(self, tmp_path):
+        """Forwarded update prompts keep the originating thread/topic metadata."""
+        runner = _make_runner()
+        hermes_home = tmp_path / "hermes"
+        hermes_home.mkdir()
+
+        pending = {
+            "platform": "telegram",
+            "chat_id": "111",
+            "thread_id": "777",
+            "user_id": "222",
+            "session_key": "agent:main:telegram:group:111:777",
+        }
+        (hermes_home / ".update_pending.json").write_text(json.dumps(pending))
+        (hermes_home / ".update_output.txt").write_text("")
+        (hermes_home / ".update_prompt.json").write_text(json.dumps({
+            "prompt": "Restore local changes? [Y/n]",
+            "default": "y",
+            "id": "threaded-prompt",
+        }))
+
+        class _PromptCapableAdapter:
+            def __init__(self):
+                self.send = AsyncMock()
+                self.prompt_calls = AsyncMock()
+
+            async def send_update_prompt(self, **kwargs):
+                return await self.prompt_calls(**kwargs)
+
+        mock_adapter = _PromptCapableAdapter()
+        runner.adapters = {Platform.TELEGRAM: mock_adapter}
+
+        async def finish_after_prompt():
+            await asyncio.sleep(0.3)
+            (hermes_home / ".update_response").write_text("y")
+            await asyncio.sleep(0.2)
+            (hermes_home / ".update_exit_code").write_text("0")
+
+        with patch("gateway.run._hermes_home", hermes_home):
+            task = asyncio.create_task(finish_after_prompt())
+            await runner._watch_update_progress(
+                poll_interval=0.1,
+                stream_interval=0.2,
+                timeout=5.0,
+            )
+            await task
+
+        assert mock_adapter.prompt_calls.call_args.kwargs["metadata"] == {
+            "thread_id": "777"
+        }
+
     @pytest.mark.asyncio
     async def test_cleans_up_on_completion(self, tmp_path):
         """All marker files are cleaned up when update finishes."""

tests/gateway/test_verbose_command.py

@@ -85,6 +85,25 @@ class TestVerboseCommand:
         saved = yaml.safe_load(config_path.read_text(encoding="utf-8"))
         assert saved["display"]["platforms"]["telegram"]["tool_progress"] == "verbose"
 
+    @pytest.mark.asyncio
+    async def test_quoted_false_keeps_command_disabled(self, tmp_path, monkeypatch):
+        """Quoted false must not enable the /verbose gateway command."""
+        hermes_home = tmp_path / "hermes"
+        hermes_home.mkdir()
+        config_path = hermes_home / "config.yaml"
+        config_path.write_text(
+            'display:\n  tool_progress_command: "false"\n  tool_progress: all\n',
+            encoding="utf-8",
+        )
+
+        monkeypatch.setattr(gateway_run, "_hermes_home", hermes_home)
+
+        runner = _make_runner()
+        result = await runner._handle_verbose_command(_make_event())
+
+        assert "not enabled" in result.lower()
+        assert "tool_progress_command" in result
+
     @pytest.mark.asyncio
     async def test_cycles_through_all_modes(self, tmp_path, monkeypatch):
         """Calling /verbose repeatedly cycles through all four modes."""

tests/hermes_cli/test_auth_commands.py

@@ -5,8 +5,10 @@ from __future__ import annotations
 import base64
 import json
 from datetime import datetime, timezone
+from unittest.mock import patch
 
 import pytest
+import yaml
 
 
 def _write_auth_store(tmp_path, payload: dict) -> None:
@@ -589,6 +591,39 @@ def test_logout_clears_stale_active_codex_without_provider_credentials(tmp_path,
     assert "provider: auto" in config_text
 
 
+def test_reset_config_provider_uses_atomic_yaml_write(tmp_path, monkeypatch):
+    """Logout config reset should delegate the YAML write atomically."""
+    hermes_home = tmp_path / "hermes"
+    hermes_home.mkdir(parents=True, exist_ok=True)
+    monkeypatch.setenv("HERMES_HOME", str(hermes_home))
+    config_path = hermes_home / "config.yaml"
+    original = {
+        "model": {
+            "default": "gpt-5.3-codex",
+            "provider": "openai-codex",
+            "base_url": "https://chatgpt.com/backend-api/codex",
+        }
+    }
+    config_path.write_text(yaml.safe_dump(original, sort_keys=False), encoding="utf-8")
+    original_text = config_path.read_text(encoding="utf-8")
+
+    from hermes_cli.auth import _reset_config_provider
+
+    def _boom(path, data, **kwargs):
+        assert path == config_path
+        assert data["model"]["provider"] == "auto"
+        assert data["model"]["base_url"] == "https://openrouter.ai/api/v1"
+        assert kwargs["sort_keys"] is False
+        raise OSError("simulated atomic write failure")
+
+    with patch("hermes_cli.auth.atomic_yaml_write", side_effect=_boom) as mock_write:
+        with pytest.raises(OSError, match="simulated atomic write failure"):
+            _reset_config_provider()
+
+    assert mock_write.call_count == 1
+    assert config_path.read_text(encoding="utf-8") == original_text
+
+
 def test_auth_list_does_not_call_mutating_select(monkeypatch, capsys):
     from hermes_cli.auth_commands import auth_list_command
 

tests/hermes_cli/test_auth_nous_provider.py

@@ -76,6 +76,20 @@ class TestResolveVerifyFallback:
         )
         assert result is False
 
+    def test_string_false_in_auth_state_does_not_disable_tls_verify(self):
+        import ssl
+        from hermes_cli.auth import _resolve_verify
+
+        result = _resolve_verify(auth_state={"tls": {"insecure": "false"}})
+        assert result is not False
+        assert result is True or isinstance(result, ssl.SSLContext)
+
+    def test_string_true_in_auth_state_disables_tls_verify(self):
+        from hermes_cli.auth import _resolve_verify
+
+        result = _resolve_verify(auth_state={"tls": {"insecure": "true"}})
+        assert result is False
+
     def test_no_ca_bundle_returns_true(self, monkeypatch):
         from hermes_cli.auth import _resolve_verify
 

tests/hermes_cli/test_commands.py

@@ -13,6 +13,7 @@ from hermes_cli.commands import (
     SlashCommandAutoSuggest,
     SlashCommandCompleter,
     _CMD_NAME_LIMIT,
+    _SLACK_RESERVED_COMMANDS,
     _TG_NAME_LIMIT,
     _clamp_command_names,
     _clamp_telegram_names,
@@ -299,9 +300,19 @@ class TestSlackNativeSlashes:
     def test_includes_canonical_commands(self):
         names = {n for n, _d, _h in slack_native_slashes()}
         # Sample of gateway-available canonical commands
-        for expected in ("new", "stop", "background", "model", "help", "status"):
+        for expected in ("new", "stop", "background", "model", "help"):
             assert expected in names, f"missing canonical /{expected}"
 
+    def test_excludes_slack_reserved_commands(self):
+        """Slack built-in commands (e.g. /status, /me, /join) cannot be
+        registered by apps and must be excluded from the manifest.
+        Users can still reach them via /hermes <command>."""
+        names = {n for n, _d, _h in slack_native_slashes()}
+        for reserved in _SLACK_RESERVED_COMMANDS:
+            assert reserved not in names, (
+                f"/{reserved} is a Slack built-in and must not appear in the manifest"
+            )
+
     def test_includes_aliases_as_first_class_slashes(self):
         """Aliases (/btw, /bg, /reset, /q) must be registered as standalone
         slashes — this is the whole point of native-slashes parity."""
@@ -319,6 +330,9 @@ class TestSlackNativeSlashes:
         Telegram but not Slack (because of Slack's 50-slash cap), this
         test fails loudly so we can curate the list rather than silently
         dropping parity.
+
+        Slack-reserved built-in commands (e.g. /status) are excluded
+        from parity checks since they cannot be registered on Slack.
         """
         slack_names = {n for n, _d, _h in slack_native_slashes()}
         tg_names = {n for n, _d in telegram_bot_commands()}
@@ -329,7 +343,8 @@ class TestSlackNativeSlashes:
 
         slack_norm = {_norm(n) for n in slack_names}
         tg_norm = {_norm(n) for n in tg_names}
-        missing = tg_norm - slack_norm
+        reserved_norm = {_norm(n) for n in _SLACK_RESERVED_COMMANDS}
+        missing = (tg_norm - slack_norm) - reserved_norm
         assert not missing, (
             f"commands on Telegram but missing from Slack native slashes: {sorted(missing)}"
         )
@@ -405,6 +420,21 @@ class TestGatewayConfigGate:
         joined = "\n".join(lines)
         assert "`/verbose" in joined
 
+    def test_config_gate_quoted_false_stays_disabled_everywhere(self, tmp_path, monkeypatch):
+        """Quoted false must not enable config-gated gateway commands."""
+        config_file = tmp_path / "config.yaml"
+        config_file.write_text('display:\n  tool_progress_command: "false"\n')
+        monkeypatch.setenv("HERMES_HOME", str(tmp_path))
+
+        lines = gateway_help_lines()
+        joined = "\n".join(lines)
+        names = {name for name, _ in telegram_bot_commands()}
+        mapping = slack_subcommand_map()
+
+        assert "`/verbose" not in joined
+        assert "verbose" not in names
+        assert "verbose" not in mapping
+
     def test_config_gate_excluded_from_telegram_when_off(self, tmp_path, monkeypatch):
         config_file = tmp_path / "config.yaml"
         config_file.write_text("display:\n  tool_progress_command: false\n")

tests/hermes_cli/test_goals.py

@@ -0,0 +1,358 @@
+"""Tests for hermes_cli/goals.py — persistent cross-turn goals."""
+
+from __future__ import annotations
+
+import json
+from unittest.mock import patch, MagicMock
+
+import pytest
+
+
+# ──────────────────────────────────────────────────────────────────────
+# Fixtures
+# ──────────────────────────────────────────────────────────────────────
+
+
+@pytest.fixture
+def hermes_home(tmp_path, monkeypatch):
+    """Isolated HERMES_HOME so SessionDB.state_meta writes don't clobber the real one."""
+    from pathlib import Path
+
+    home = tmp_path / ".hermes"
+    home.mkdir()
+    monkeypatch.setattr(Path, "home", lambda: tmp_path)
+    monkeypatch.setenv("HERMES_HOME", str(home))
+
+    # Bust the goal-module's DB cache for each test so it re-resolves HERMES_HOME.
+    from hermes_cli import goals
+
+    goals._DB_CACHE.clear()
+    yield home
+    goals._DB_CACHE.clear()
+
+
+# ──────────────────────────────────────────────────────────────────────
+# _parse_judge_response
+# ──────────────────────────────────────────────────────────────────────
+
+
+class TestParseJudgeResponse:
+    def test_clean_json_done(self):
+        from hermes_cli.goals import _parse_judge_response
+
+        done, reason = _parse_judge_response('{"done": true, "reason": "all good"}')
+        assert done is True
+        assert reason == "all good"
+
+    def test_clean_json_continue(self):
+        from hermes_cli.goals import _parse_judge_response
+
+        done, reason = _parse_judge_response('{"done": false, "reason": "more work needed"}')
+        assert done is False
+        assert reason == "more work needed"
+
+    def test_json_in_markdown_fence(self):
+        from hermes_cli.goals import _parse_judge_response
+
+        raw = '```json\n{"done": true, "reason": "done"}\n```'
+        done, reason = _parse_judge_response(raw)
+        assert done is True
+        assert "done" in reason
+
+    def test_json_embedded_in_prose(self):
+        """Some models prefix reasoning before emitting JSON — we extract it."""
+        from hermes_cli.goals import _parse_judge_response
+
+        raw = 'Looking at this... the agent says X. Verdict: {"done": false, "reason": "partial"}'
+        done, reason = _parse_judge_response(raw)
+        assert done is False
+        assert reason == "partial"
+
+    def test_string_done_values(self):
+        from hermes_cli.goals import _parse_judge_response
+
+        for s in ("true", "yes", "done", "1"):
+            done, _ = _parse_judge_response(f'{{"done": "{s}", "reason": "r"}}')
+            assert done is True
+        for s in ("false", "no", "not yet"):
+            done, _ = _parse_judge_response(f'{{"done": "{s}", "reason": "r"}}')
+            assert done is False
+
+    def test_malformed_json_fails_open(self):
+        """Non-JSON → not done, with error-ish reason (so judge_goal can map to continue)."""
+        from hermes_cli.goals import _parse_judge_response
+
+        done, reason = _parse_judge_response("this is not json at all")
+        assert done is False
+        assert reason  # non-empty
+
+    def test_empty_response(self):
+        from hermes_cli.goals import _parse_judge_response
+
+        done, reason = _parse_judge_response("")
+        assert done is False
+        assert reason
+
+
+# ──────────────────────────────────────────────────────────────────────
+# judge_goal — fail-open semantics
+# ──────────────────────────────────────────────────────────────────────
+
+
+class TestJudgeGoal:
+    def test_empty_goal_skipped(self):
+        from hermes_cli.goals import judge_goal
+
+        verdict, _ = judge_goal("", "some response")
+        assert verdict == "skipped"
+
+    def test_empty_response_continues(self):
+        from hermes_cli.goals import judge_goal
+
+        verdict, _ = judge_goal("ship the thing", "")
+        assert verdict == "continue"
+
+    def test_no_aux_client_continues(self):
+        """Fail-open: if no aux client, we must return continue, not skipped/done."""
+        from hermes_cli import goals
+
+        with patch(
+            "agent.auxiliary_client.get_text_auxiliary_client",
+            return_value=(None, None),
+        ):
+            verdict, _ = goals.judge_goal("my goal", "my response")
+        assert verdict == "continue"
+
+    def test_api_error_continues(self):
+        """Judge exception → fail-open continue (don't wedge progress on judge bugs)."""
+        from hermes_cli import goals
+
+        fake_client = MagicMock()
+        fake_client.chat.completions.create.side_effect = RuntimeError("boom")
+        with patch(
+            "agent.auxiliary_client.get_text_auxiliary_client",
+            return_value=(fake_client, "judge-model"),
+        ):
+            verdict, reason = goals.judge_goal("goal", "response")
+        assert verdict == "continue"
+        assert "judge error" in reason.lower()
+
+    def test_judge_says_done(self):
+        from hermes_cli import goals
+
+        fake_client = MagicMock()
+        fake_client.chat.completions.create.return_value = MagicMock(
+            choices=[
+                MagicMock(
+                    message=MagicMock(content='{"done": true, "reason": "achieved"}')
+                )
+            ]
+        )
+        with patch(
+            "agent.auxiliary_client.get_text_auxiliary_client",
+            return_value=(fake_client, "judge-model"),
+        ):
+            verdict, reason = goals.judge_goal("goal", "agent response")
+        assert verdict == "done"
+        assert reason == "achieved"
+
+    def test_judge_says_continue(self):
+        from hermes_cli import goals
+
+        fake_client = MagicMock()
+        fake_client.chat.completions.create.return_value = MagicMock(
+            choices=[
+                MagicMock(
+                    message=MagicMock(content='{"done": false, "reason": "not yet"}')
+                )
+            ]
+        )
+        with patch(
+            "agent.auxiliary_client.get_text_auxiliary_client",
+            return_value=(fake_client, "judge-model"),
+        ):
+            verdict, reason = goals.judge_goal("goal", "agent response")
+        assert verdict == "continue"
+        assert reason == "not yet"
+
+
+# ──────────────────────────────────────────────────────────────────────
+# GoalManager lifecycle + persistence
+# ──────────────────────────────────────────────────────────────────────
+
+
+class TestGoalManager:
+    def test_no_goal_initial(self, hermes_home):
+        from hermes_cli.goals import GoalManager
+
+        mgr = GoalManager(session_id="test-sid-1")
+        assert mgr.state is None
+        assert not mgr.is_active()
+        assert not mgr.has_goal()
+        assert "No active goal" in mgr.status_line()
+
+    def test_set_then_status(self, hermes_home):
+        from hermes_cli.goals import GoalManager
+
+        mgr = GoalManager(session_id="test-sid-2", default_max_turns=5)
+        state = mgr.set("port the thing")
+        assert state.goal == "port the thing"
+        assert state.status == "active"
+        assert state.max_turns == 5
+        assert state.turns_used == 0
+        assert mgr.is_active()
+        assert "active" in mgr.status_line().lower()
+        assert "port the thing" in mgr.status_line()
+
+    def test_set_rejects_empty(self, hermes_home):
+        from hermes_cli.goals import GoalManager
+
+        mgr = GoalManager(session_id="test-sid-3")
+        with pytest.raises(ValueError):
+            mgr.set("")
+        with pytest.raises(ValueError):
+            mgr.set("   ")
+
+    def test_pause_and_resume(self, hermes_home):
+        from hermes_cli.goals import GoalManager
+
+        mgr = GoalManager(session_id="test-sid-4")
+        mgr.set("goal text")
+        mgr.pause(reason="user-paused")
+        assert mgr.state.status == "paused"
+        assert not mgr.is_active()
+        assert mgr.has_goal()
+
+        mgr.resume()
+        assert mgr.state.status == "active"
+        assert mgr.is_active()
+
+    def test_clear(self, hermes_home):
+        from hermes_cli.goals import GoalManager
+
+        mgr = GoalManager(session_id="test-sid-5")
+        mgr.set("goal")
+        mgr.clear()
+        assert mgr.state is None
+        assert not mgr.is_active()
+
+    def test_persistence_across_managers(self, hermes_home):
+        """Key invariant: a second manager on the same session sees the goal.
+
+        This is what makes /resume work — each session rebinds its
+        GoalManager and picks up the saved state.
+        """
+        from hermes_cli.goals import GoalManager
+
+        mgr1 = GoalManager(session_id="persist-sid")
+        mgr1.set("do the thing")
+
+        mgr2 = GoalManager(session_id="persist-sid")
+        assert mgr2.state is not None
+        assert mgr2.state.goal == "do the thing"
+        assert mgr2.is_active()
+
+    def test_evaluate_after_turn_done(self, hermes_home):
+        """Judge says done → status=done, no continuation."""
+        from hermes_cli import goals
+        from hermes_cli.goals import GoalManager
+
+        mgr = GoalManager(session_id="eval-sid-1")
+        mgr.set("ship it")
+
+        with patch.object(goals, "judge_goal", return_value=("done", "shipped")):
+            decision = mgr.evaluate_after_turn("I shipped the feature.")
+
+        assert decision["verdict"] == "done"
+        assert decision["should_continue"] is False
+        assert decision["continuation_prompt"] is None
+        assert mgr.state.status == "done"
+        assert mgr.state.turns_used == 1
+
+    def test_evaluate_after_turn_continue_under_budget(self, hermes_home):
+        from hermes_cli import goals
+        from hermes_cli.goals import GoalManager
+
+        mgr = GoalManager(session_id="eval-sid-2", default_max_turns=5)
+        mgr.set("a long goal")
+
+        with patch.object(goals, "judge_goal", return_value=("continue", "more work")):
+            decision = mgr.evaluate_after_turn("made some progress")
+
+        assert decision["verdict"] == "continue"
+        assert decision["should_continue"] is True
+        assert decision["continuation_prompt"] is not None
+        assert "a long goal" in decision["continuation_prompt"]
+        assert mgr.state.status == "active"
+        assert mgr.state.turns_used == 1
+
+    def test_evaluate_after_turn_budget_exhausted(self, hermes_home):
+        """When turn budget hits ceiling, auto-pause instead of continuing."""
+        from hermes_cli import goals
+        from hermes_cli.goals import GoalManager
+
+        mgr = GoalManager(session_id="eval-sid-3", default_max_turns=2)
+        mgr.set("hard goal")
+
+        with patch.object(goals, "judge_goal", return_value=("continue", "not yet")):
+            d1 = mgr.evaluate_after_turn("step 1")
+            assert d1["should_continue"] is True
+            assert mgr.state.turns_used == 1
+            assert mgr.state.status == "active"
+
+            d2 = mgr.evaluate_after_turn("step 2")
+            # turns_used is now 2 which equals max_turns → paused
+            assert d2["should_continue"] is False
+            assert mgr.state.status == "paused"
+            assert mgr.state.turns_used == 2
+            assert "budget" in (mgr.state.paused_reason or "").lower()
+
+    def test_evaluate_after_turn_inactive(self, hermes_home):
+        """evaluate_after_turn is a no-op when goal isn't active."""
+        from hermes_cli.goals import GoalManager
+
+        mgr = GoalManager(session_id="eval-sid-4")
+        d = mgr.evaluate_after_turn("anything")
+        assert d["verdict"] == "inactive"
+        assert d["should_continue"] is False
+
+        mgr.set("a goal")
+        mgr.pause()
+        d2 = mgr.evaluate_after_turn("anything")
+        assert d2["verdict"] == "inactive"
+        assert d2["should_continue"] is False
+
+    def test_continuation_prompt_shape(self, hermes_home):
+        """The continuation prompt must include the goal text verbatim —
+        and must be safe to inject as a user-role message (prompt-cache
+        invariants: no system-prompt mutation)."""
+        from hermes_cli.goals import GoalManager
+
+        mgr = GoalManager(session_id="cont-sid")
+        mgr.set("port goal command to hermes")
+        prompt = mgr.next_continuation_prompt()
+        assert prompt is not None
+        assert "port goal command to hermes" in prompt
+        assert prompt.strip()  # non-empty
+
+
+# ──────────────────────────────────────────────────────────────────────
+# Smoke: CommandDef is wired
+# ──────────────────────────────────────────────────────────────────────
+
+
+def test_goal_command_in_registry():
+    from hermes_cli.commands import resolve_command
+
+    cmd = resolve_command("goal")
+    assert cmd is not None
+    assert cmd.name == "goal"
+
+
+def test_goal_command_dispatches_in_cli_registry_helpers():
+    """goal shows up in autocomplete / help categories alongside other Session cmds."""
+    from hermes_cli.commands import COMMANDS, COMMANDS_BY_CATEGORY
+
+    assert "/goal" in COMMANDS
+    session_cmds = COMMANDS_BY_CATEGORY.get("Session", {})
+    assert "/goal" in session_cmds

tests/hermes_cli/test_model_provider_persistence.py

@@ -71,6 +71,32 @@ class TestSaveModelChoiceAlwaysDict:
 
 
 class TestProviderPersistsAfterModelSave:
+    def test_update_config_for_provider_uses_atomic_yaml_write(self, config_home):
+        """Provider switches should delegate config writes to atomic_yaml_write."""
+        from hermes_cli.auth import _update_config_for_provider
+
+        config_path = config_home / "config.yaml"
+        original_text = config_path.read_text(encoding="utf-8")
+
+        def _boom(path, data, **kwargs):
+            assert path == config_path
+            assert data["model"]["provider"] == "nous"
+            assert data["model"]["base_url"] == "https://inference.example.com/v1"
+            assert data["model"]["default"] == "some-old-model"
+            assert kwargs["sort_keys"] is False
+            raise OSError("simulated atomic write failure")
+
+        with patch("hermes_cli.auth.atomic_yaml_write", side_effect=_boom) as mock_write:
+            with pytest.raises(OSError, match="simulated atomic write failure"):
+                _update_config_for_provider(
+                    "nous",
+                    "https://inference.example.com/v1/",
+                    default_model="llama-3.3",
+                )
+
+        assert mock_write.call_count == 1
+        assert config_path.read_text(encoding="utf-8") == original_text
+
     def test_api_key_provider_saved_when_model_was_string(self, config_home, monkeypatch):
         """_model_flow_api_key_provider must persist the provider even when
         config.model started as a plain string."""

tests/hermes_cli/test_plugins.py

@@ -21,6 +21,7 @@ from hermes_cli.plugins import (
     get_plugin_command_handler,
     get_plugin_commands,
     get_pre_tool_call_block_message,
+    resolve_plugin_command_result,
     discover_plugins,
     invoke_hook,
 )
@@ -1061,6 +1062,45 @@ class TestPluginCommands:
         assert mgr._plugin_commands["cmd-b"]["plugin"] == "plugin-b"
 
 
+class TestPluginCommandResultResolution:
+    def test_returns_sync_values_unchanged(self):
+        assert resolve_plugin_command_result("ok") == "ok"
+
+    def test_awaits_async_result_without_running_loop(self):
+        async def _handler():
+            return "async-ok"
+
+        assert resolve_plugin_command_result(_handler()) == "async-ok"
+
+    def test_awaits_async_result_with_running_loop(self, monkeypatch):
+        class _Loop:
+            pass
+
+        async def _handler():
+            return "threaded-ok"
+
+        monkeypatch.setattr("hermes_cli.plugins.asyncio.get_running_loop", lambda: _Loop())
+        assert resolve_plugin_command_result(_handler()) == "threaded-ok"
+
+    def test_running_loop_timeout_does_not_hang_forever(self, monkeypatch):
+        """Threaded path must abort a hung async handler instead of blocking the caller."""
+        import asyncio as _asyncio
+
+        class _Loop:
+            pass
+
+        async def _slow_handler():
+            await _asyncio.sleep(10)
+            return "should-not-reach"
+
+        monkeypatch.setattr("hermes_cli.plugins.asyncio.get_running_loop", lambda: _Loop())
+        monkeypatch.setattr("hermes_cli.plugins._PLUGIN_COMMAND_AWAIT_TIMEOUT_SECS", 0.1)
+
+        import pytest
+        with pytest.raises(TimeoutError):
+            resolve_plugin_command_result(_slow_handler())
+
+
 # ── TestPluginDispatchTool ────────────────────────────────────────────────
 
 

tests/hermes_cli/test_runtime_provider_resolution.py

@@ -897,6 +897,58 @@ def test_named_custom_provider_does_not_shadow_builtin_provider(monkeypatch):
     assert resolved["requested_provider"] == "nous"
 
 
+def test_named_custom_provider_wins_over_builtin_alias(monkeypatch):
+    """A custom_providers entry named after a built-in *alias* (not a canonical
+    provider name) must win over the built-in.  Regression guard for #15743:
+    when users define ``custom_providers: [{name: kimi, ...}]`` and reference
+    ``provider: kimi``, the built-in alias rewriting (``kimi`` → ``kimi-coding``)
+    would otherwise hijack the request and send it to the wrong endpoint.
+    """
+    monkeypatch.setattr(
+        rp,
+        "load_config",
+        lambda: {
+            "custom_providers": [
+                {
+                    "name": "kimi",
+                    "base_url": "https://my-custom-kimi.example.com/v1",
+                    "api_key": "my-kimi-key",
+                }
+            ]
+        },
+    )
+
+    entry = rp._get_named_custom_provider("kimi")
+
+    assert entry is not None
+    assert entry["base_url"] == "https://my-custom-kimi.example.com/v1"
+    assert entry["api_key"] == "my-kimi-key"
+
+
+def test_named_custom_provider_skipped_for_canonical_built_in(monkeypatch):
+    """Companion to the test above: ``nous`` is a canonical provider name
+    (``resolve_provider('nous') == 'nous'``), so a custom entry with that name
+    should NOT be returned — the built-in wins as before.
+    """
+    monkeypatch.setattr(
+        rp,
+        "load_config",
+        lambda: {
+            "custom_providers": [
+                {
+                    "name": "nous",
+                    "base_url": "http://localhost:1234/v1",
+                    "api_key": "shadow-key",
+                }
+            ]
+        },
+    )
+
+    entry = rp._get_named_custom_provider("nous")
+
+    assert entry is None
+
+
 def test_explicit_openrouter_skips_openai_base_url(monkeypatch):
     """When the user explicitly requests openrouter, OPENAI_BASE_URL
     (which may point to a custom endpoint) must not override the

tests/hermes_cli/test_tools_config.py

@@ -120,7 +120,16 @@ def test_get_platform_tools_preserves_explicit_empty_selection():
 
     enabled = _get_platform_tools(config, "cli")
 
-    assert enabled == set()
+    # An explicit empty list disables every CONFIGURABLE toolset (web,
+    # terminal, memory, …). Non-configurable platform toolsets that ride
+    # along on the platform's default composite (e.g. `kanban`, whose tools
+    # live in _HERMES_CORE_TOOLS but aren't user-toggleable) are still
+    # auto-recovered by _get_platform_tools so saving via `hermes tools`
+    # doesn't silently drop them. The contract this test guards is the
+    # configurable side: nothing the user could have checked in the TUI
+    # checklist should reappear here.
+    configurable = {ts_key for ts_key, _, _ in CONFIGURABLE_TOOLSETS}
+    assert enabled.isdisjoint(configurable)
 
 
 def test_apply_toolset_change_from_default_does_not_enable_default_off_toolsets():

tests/hermes_cli/test_update_gateway_restart.py

@@ -392,6 +392,81 @@ class TestCmdUpdateLaunchdRestart:
         captured = capsys.readouterr().out
         assert "Restart manually: hermes gateway run" in captured
 
+    @patch("shutil.which", return_value=None)
+    @patch("subprocess.run")
+    def test_update_restarts_profile_manual_gateways(
+        self, mock_run, _mock_which, mock_args, capsys, tmp_path, monkeypatch,
+    ):
+        """Profile-mapped manual gateways are relaunched automatically after update."""
+        monkeypatch.setattr(gateway_cli, "is_macos", lambda: True)
+        monkeypatch.setattr(
+            gateway_cli,
+            "get_launchd_plist_path",
+            lambda: tmp_path / "ai.hermes.gateway.plist",
+        )
+
+        mock_run.side_effect = _make_run_side_effect(
+            commit_count="3",
+            launchctl_loaded=False,
+        )
+        process = gateway_cli.ProfileGatewayProcess(
+            profile="coder",
+            path=tmp_path / ".hermes" / "profiles" / "coder",
+            pid=12345,
+        )
+
+        with patch.object(gateway_cli, "find_gateway_pids", return_value=[12345]), \
+             patch.object(gateway_cli, "find_profile_gateway_processes", return_value=[process]), \
+             patch.object(gateway_cli, "launch_detached_profile_gateway_restart", return_value=True) as restart, \
+             patch.object(gateway_cli, "_graceful_restart_via_sigusr1", return_value=True) as graceful, \
+             patch("os.kill") as kill:
+            cmd_update(mock_args)
+
+        captured = capsys.readouterr().out
+        restart.assert_called_once_with("coder", 12345)
+        graceful.assert_called_once()
+        # Graceful drain succeeded — no SIGTERM fallback needed.
+        kill.assert_not_called()
+        assert "Restarting manual gateway profile(s): coder" in captured
+        assert "Restart manually: hermes gateway run" not in captured
+
+    @patch("shutil.which", return_value=None)
+    @patch("subprocess.run")
+    def test_update_profile_manual_gateway_falls_back_to_sigterm(
+        self, mock_run, _mock_which, mock_args, capsys, tmp_path, monkeypatch,
+    ):
+        """When graceful SIGUSR1 drain fails, manual profile restart falls back to SIGTERM."""
+        monkeypatch.setattr(gateway_cli, "is_macos", lambda: True)
+        monkeypatch.setattr(
+            gateway_cli,
+            "get_launchd_plist_path",
+            lambda: tmp_path / "ai.hermes.gateway.plist",
+        )
+
+        mock_run.side_effect = _make_run_side_effect(
+            commit_count="3",
+            launchctl_loaded=False,
+        )
+        process = gateway_cli.ProfileGatewayProcess(
+            profile="coder",
+            path=tmp_path / ".hermes" / "profiles" / "coder",
+            pid=12345,
+        )
+
+        with patch.object(gateway_cli, "find_gateway_pids", return_value=[12345]), \
+             patch.object(gateway_cli, "find_profile_gateway_processes", return_value=[process]), \
+             patch.object(gateway_cli, "launch_detached_profile_gateway_restart", return_value=True) as restart, \
+             patch.object(gateway_cli, "_graceful_restart_via_sigusr1", return_value=False) as graceful, \
+             patch("os.kill") as kill:
+            cmd_update(mock_args)
+
+        captured = capsys.readouterr().out
+        restart.assert_called_once_with("coder", 12345)
+        graceful.assert_called_once()
+        # Graceful drain returned False → SIGTERM fallback.
+        kill.assert_called_once()
+        assert "Restarting manual gateway profile(s): coder" in captured
+
     @patch("shutil.which", return_value=None)
     @patch("subprocess.run")
     def test_update_with_systemd_still_restarts_via_systemd(

tests/hermes_cli/test_update_yes_flag.py

@@ -0,0 +1,167 @@
+"""Tests for `hermes update --yes / -y` — assume yes for interactive prompts.
+
+Covers:
+  1. argparse parses the flag
+  2. Config-migration prompt is auto-answered (no input() call) and migrate_config
+     runs with interactive=False so API-key prompts are skipped
+  3. Autostash restore prompt is auto-answered (prompt_for_restore == False, no
+     input() call) and the stash is applied automatically
+"""
+
+import subprocess
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from hermes_cli.main import cmd_update
+
+
+def _make_run_side_effect(
+    branch="main", verify_ok=True, commit_count="1", dirty=False
+):
+    """Minimal subprocess.run side_effect for the update flow."""
+
+    def side_effect(cmd, **kwargs):
+        joined = " ".join(str(c) for c in cmd)
+
+        if "rev-parse" in joined and "--abbrev-ref" in joined:
+            return subprocess.CompletedProcess(cmd, 0, stdout=f"{branch}\n", stderr="")
+        if "rev-parse" in joined and "--verify" in joined:
+            return subprocess.CompletedProcess(
+                cmd, 0 if verify_ok else 128, stdout="", stderr=""
+            )
+        if "rev-list" in joined:
+            return subprocess.CompletedProcess(
+                cmd, 0, stdout=f"{commit_count}\n", stderr=""
+            )
+        # `git status --porcelain` for dirty-tree detection during autostash.
+        if "status" in joined and "--porcelain" in joined:
+            out = " M hermes_cli/main.py\n" if dirty else ""
+            return subprocess.CompletedProcess(cmd, 0, stdout=out, stderr="")
+        # `git stash list` — return a stash ref when dirty (so _stash_local_changes
+        # gets something to return). _stash_local_changes_if_needed is what we
+        # actually patch in tests that exercise restore, so this is a catch-all.
+        if "stash" in joined and "list" in joined:
+            return subprocess.CompletedProcess(cmd, 0, stdout="", stderr="")
+        return subprocess.CompletedProcess(cmd, 0, stdout="", stderr="")
+
+    return side_effect
+
+
+class TestUpdateYesConfigMigration:
+    """--yes auto-answers the config-migration prompt and skips API-key prompts."""
+
+    @patch("hermes_cli.config.migrate_config")
+    @patch("hermes_cli.config.check_config_version", return_value=(1, 2))
+    @patch("hermes_cli.config.get_missing_config_fields", return_value=[])
+    @patch("hermes_cli.config.get_missing_env_vars", return_value=["NEW_KEY"])
+    @patch("shutil.which", return_value=None)
+    @patch("subprocess.run")
+    def test_yes_auto_migrates_without_input(
+        self,
+        mock_run,
+        _mock_which,
+        _mock_missing_env,
+        _mock_missing_cfg,
+        _mock_version,
+        mock_migrate,
+        capsys,
+    ):
+        mock_run.side_effect = _make_run_side_effect(
+            branch="main", verify_ok=True, commit_count="1"
+        )
+        mock_migrate.return_value = {"env_added": [], "config_added": []}
+
+        args = SimpleNamespace(yes=True)
+
+        with patch("builtins.input") as mock_input:
+            cmd_update(args)
+            # Never prompted the user.
+            mock_input.assert_not_called()
+
+        # migrate_config was invoked with interactive=False — API-key prompts
+        # are suppressed, matching gateway-mode semantics.
+        assert mock_migrate.call_count == 1
+        _, kwargs = mock_migrate.call_args
+        assert kwargs.get("interactive") is False
+
+        out = capsys.readouterr().out
+        assert "--yes: auto-applying config migration" in out
+        # The "Would you like to configure them now?" prompt text never appears.
+        assert "Would you like to configure them now?" not in out
+
+    @patch("hermes_cli.config.migrate_config")
+    @patch("hermes_cli.config.check_config_version", return_value=(1, 2))
+    @patch("hermes_cli.config.get_missing_config_fields", return_value=[])
+    @patch("hermes_cli.config.get_missing_env_vars", return_value=["NEW_KEY"])
+    @patch("shutil.which", return_value=None)
+    @patch("subprocess.run")
+    def test_no_yes_flag_still_prompts_in_tty(
+        self,
+        mock_run,
+        _mock_which,
+        _mock_missing_env,
+        _mock_missing_cfg,
+        _mock_version,
+        mock_migrate,
+        capsys,
+    ):
+        """Regression guard: without --yes, the TTY prompt path still fires."""
+        mock_run.side_effect = _make_run_side_effect(
+            branch="main", verify_ok=True, commit_count="1"
+        )
+        mock_migrate.return_value = {"env_added": [], "config_added": []}
+
+        args = SimpleNamespace(yes=False)
+
+        with patch("builtins.input", return_value="n") as mock_input, patch(
+            "hermes_cli.main.sys"
+        ) as mock_sys:
+            mock_sys.stdin.isatty.return_value = True
+            mock_sys.stdout.isatty.return_value = True
+            cmd_update(args)
+            # The user was actually prompted.
+            assert mock_input.called
+            prompts = [c.args[0] if c.args else "" for c in mock_input.call_args_list]
+            assert any("configure them now" in p for p in prompts)
+
+
+class TestUpdateYesStashRestore:
+    """--yes auto-restores the pre-update autostash without prompting."""
+
+    @patch("hermes_cli.main._restore_stashed_changes")
+    @patch(
+        "hermes_cli.main._stash_local_changes_if_needed",
+        return_value="stash@{0}",
+    )
+    @patch("hermes_cli.config.check_config_version", return_value=(1, 1))
+    @patch("hermes_cli.config.get_missing_config_fields", return_value=[])
+    @patch("hermes_cli.config.get_missing_env_vars", return_value=[])
+    @patch("shutil.which", return_value=None)
+    @patch("subprocess.run")
+    def test_yes_restores_stash_without_prompting(
+        self,
+        mock_run,
+        _mock_which,
+        _mock_missing_env,
+        _mock_missing_cfg,
+        _mock_version,
+        _mock_stash,
+        mock_restore,
+        capsys,
+    ):
+        # Not on main → cmd_update switches to main → autostash fires.
+        mock_run.side_effect = _make_run_side_effect(
+            branch="feature-branch", verify_ok=True, commit_count="1", dirty=True
+        )
+
+        args = SimpleNamespace(yes=True)
+
+        cmd_update(args)
+
+        # _restore_stashed_changes was called, and called with prompt_user=False
+        # every time (so the user never sees "Restore local changes now?").
+        assert mock_restore.called
+        for call in mock_restore.call_args_list:
+            assert call.kwargs.get("prompt_user") is False, (
+                f"Expected prompt_user=False under --yes, got {call.kwargs}"
+            )

tests/hermes_cli/test_user_providers_model_switch.py

@@ -839,3 +839,148 @@ def test_get_named_custom_provider_transport_resolves_via_display_name(monkeypat
     result = rp._get_named_custom_provider("Codex Provider")
     assert result is not None
     assert result["api_mode"] == "codex_responses"
+
+
+# =============================================================================
+# Regression: user_providers override for private models not listed by /v1/models
+# =============================================================================
+
+_REJECTED_VALIDATION = {
+    "accepted": False,
+    "persist": False,
+    "recognized": False,
+    "message": "not found",
+}
+
+
+def _run_user_provider_override_case(
+    *,
+    slug,
+    name,
+    base_url,
+    models,
+    raw_input,
+):
+    """Run ``switch_model`` with a private user provider and a rejected API check.
+
+    The bug in PR #17964 was that ``user_providers`` was treated like a list,
+    so private models listed in ``models:`` never triggered the override path.
+    These tests keep the validation failure in place and prove the config list
+    still wins for both dict- and list-shaped ``models`` entries.
+    """
+    from unittest.mock import patch
+
+    user_providers = {
+        slug: {
+            "name": name,
+            "api": base_url,
+            "discover_models": False,
+            "models": models,
+        }
+    }
+
+    with patch("hermes_cli.model_switch.resolve_alias", return_value=None), \
+         patch("hermes_cli.model_switch.list_provider_models", return_value=[]), \
+         patch("hermes_cli.model_switch.normalize_model_for_provider", side_effect=lambda model, provider: model), \
+         patch("hermes_cli.models.validate_requested_model", return_value=_REJECTED_VALIDATION), \
+         patch("hermes_cli.models.detect_provider_for_model", return_value=None), \
+         patch("hermes_cli.model_switch.get_model_info", return_value=None), \
+         patch("hermes_cli.model_switch.get_model_capabilities", return_value=None), \
+         patch("hermes_cli.runtime_provider.resolve_runtime_provider", return_value={"api_key": "***", "base_url": base_url, "api_mode": "anthropic_messages"}):
+        return switch_model(
+            raw_input=raw_input,
+            current_provider=slug,
+            current_model="old-model",
+            current_base_url=base_url,
+            user_providers=user_providers,
+            custom_providers=[],
+        )
+
+
+@pytest.mark.parametrize(
+    ("slug", "name", "base_url", "models", "raw_input", "expected_model"),
+    [
+        (
+            "kimi-coding",
+            "Kimi Coding Plan",
+            "https://api.kimi.com/coding",
+            {"kimi-k2.6": {}},
+            "kimi-k2.6",
+            "kimi-k2.6",
+        ),
+        (
+            "kimi-dedicated",
+            "Kimi Dedicated",
+            "https://api.kimi.com/v1",
+            [{"name": "moonshotai/Kimi-K2.6-ACED"}],
+            "moonshotai/Kimi-K2.6-ACED",
+            "moonshotai/Kimi-K2.6-ACED",
+        ),
+    ],
+    ids=["kimi-coding-plan-dict", "kimi-k2-6-aced-list"],
+)
+def test_user_provider_override_accepts_listed_private_models(
+    slug,
+    name,
+    base_url,
+    models,
+    raw_input,
+    expected_model,
+):
+    """Private models listed in providers: config should override /v1/models misses.
+
+    Covers both config shapes the fix now accepts:
+    - dict models for the Kimi Coding Plan K2p6 case
+    - list-of-dicts models for the Kimi-K2.6-ACED dedicated case
+    """
+    result = _run_user_provider_override_case(
+        slug=slug,
+        name=name,
+        base_url=base_url,
+        models=models,
+        raw_input=raw_input,
+    )
+
+    assert result.success is True
+    assert result.new_model == expected_model
+    assert result.error_message == ""
+
+
+@pytest.mark.parametrize(
+    ("slug", "name", "base_url", "models", "raw_input"),
+    [
+        (
+            "kimi-coding",
+            "Kimi Coding Plan",
+            "https://api.kimi.com/coding",
+            {"kimi-k2.6": {}},
+            "kimi-k2.6-mangled",
+        ),
+        (
+            "kimi-dedicated",
+            "Kimi Dedicated",
+            "https://api.kimi.com/v1",
+            [{"name": "moonshotai/Kimi-K2.6-ACED"}],
+            "moonshotai/Kimi-K2.6-ACED!!!",
+        ),
+    ],
+    ids=["kimi-coding-plan-dict-mangled", "kimi-k2-6-aced-list-mangled"],
+)
+def test_user_provider_override_rejects_mangled_private_models(
+    slug,
+    name,
+    base_url,
+    models,
+    raw_input,
+):
+    """Malformed model names should fail cleanly, not crash or auto-accept."""
+    result = _run_user_provider_override_case(
+        slug=slug,
+        name=name,
+        base_url=base_url,
+        models=models,
+        raw_input=raw_input,
+    )
+
+    assert result.success is False
+    assert result.error_message == "not found"

tests/run_agent/test_860_dedup.py

@@ -38,6 +38,8 @@ class TestFlushDeduplication:
                 skip_context_files=True,
                 skip_memory=True,
             )
+        # Simulate lazy session creation (normally done by run_conversation)
+        agent._ensure_db_session()
         return agent
 
     def test_flush_writes_only_new_messages(self):

tests/run_agent/test_deepseek_reasoning_content_echo.py

@@ -10,15 +10,21 @@ field, DeepSeek rejects the next request with HTTP 400::
 Fix covers three paths:
 
 1. ``_build_assistant_message`` — new tool-call messages without raw
-   reasoning_content get ``""`` pinned at creation time so nothing gets
+   reasoning_content get ``" "`` pinned at creation time so nothing gets
    persisted poisoned.
 2. ``_copy_reasoning_content_for_api`` — already-poisoned history replays
-   with ``reasoning_content=""`` injected defensively.
+   with ``reasoning_content=" "`` injected defensively.
 3. Detection covers three signals: ``provider == "deepseek"``,
    ``"deepseek" in model``, and ``api.deepseek.com`` host match. The third
    catches custom-provider setups pointing at DeepSeek.
 
-Refs #15250 / #15353.
+The placeholder is a single space (not empty string) because DeepSeek V4 Pro
+tightened validation and rejects empty-string reasoning_content with a
+400 ("The reasoning content in the thinking mode must be passed back to
+the API"). A space satisfies non-empty checks everywhere without leaking
+fabricated reasoning.
+
+Refs #15250 / #15353 / #17341.
 """
 
 from __future__ import annotations
@@ -105,8 +111,8 @@ class TestNeedsDeepSeekToolReasoning:
 class TestCopyReasoningContentForApi:
     """_copy_reasoning_content_for_api pads reasoning_content for DeepSeek tool-calls."""
 
-    def test_deepseek_tool_call_poisoned_history_gets_empty_string(self) -> None:
-        """Already-poisoned history (no reasoning_content, no reasoning) gets ''."""
+    def test_deepseek_tool_call_poisoned_history_gets_space_placeholder(self) -> None:
+        """Already-poisoned history (no reasoning_content, no reasoning) gets ' '."""
         agent = _make_agent(provider="deepseek", model="deepseek-v4-flash")
         source = {
             "role": "assistant",
@@ -115,7 +121,7 @@ class TestCopyReasoningContentForApi:
         }
         api_msg: dict = {}
         agent._copy_reasoning_content_for_api(source, api_msg)
-        assert api_msg.get("reasoning_content") == ""
+        assert api_msg.get("reasoning_content") == " "
 
     def test_deepseek_assistant_no_tool_call_gets_padded(self) -> None:
         """DeepSeek thinking mode pads ALL assistant turns, even without tool_calls."""
@@ -123,7 +129,7 @@ class TestCopyReasoningContentForApi:
         source = {"role": "assistant", "content": "hello"}
         api_msg: dict = {}
         agent._copy_reasoning_content_for_api(source, api_msg)
-        assert api_msg.get("reasoning_content") == ""
+        assert api_msg.get("reasoning_content") == " "
 
     def test_deepseek_explicit_reasoning_content_preserved(self) -> None:
         """When reasoning_content is already set, it's copied verbatim."""
@@ -137,6 +143,42 @@ class TestCopyReasoningContentForApi:
         agent._copy_reasoning_content_for_api(source, api_msg)
         assert api_msg["reasoning_content"] == "<think>real chain of thought</think>"
 
+    def test_deepseek_stale_empty_placeholder_upgraded_to_space(self) -> None:
+        """Sessions persisted before #17341 have ``reasoning_content=""`` pinned
+        at creation time. DeepSeek V4 Pro rejects "" with HTTP 400. When the
+        active provider enforces the thinking-mode echo, the replay path
+        upgrades "" → " " so stale history doesn't break the next turn.
+        """
+        agent = _make_agent(provider="deepseek", model="deepseek-v4-pro")
+        source = {
+            "role": "assistant",
+            "content": "",
+            "reasoning_content": "",
+            "tool_calls": [{"id": "c1", "function": {"name": "terminal"}}],
+        }
+        api_msg: dict = {}
+        agent._copy_reasoning_content_for_api(source, api_msg)
+        assert api_msg["reasoning_content"] == " "
+
+    def test_non_thinking_provider_preserves_empty_reasoning_content_verbatim(self) -> None:
+        """The stale-placeholder upgrade ONLY fires when the active provider
+        enforces thinking-mode echo. On non-thinking providers, an empty
+        reasoning_content must still round-trip verbatim.
+        """
+        agent = _make_agent(
+            provider="openrouter",
+            model="anthropic/claude-sonnet-4.6",
+            base_url="https://openrouter.ai/api/v1",
+        )
+        source = {
+            "role": "assistant",
+            "content": "hi",
+            "reasoning_content": "",
+        }
+        api_msg: dict = {}
+        agent._copy_reasoning_content_for_api(source, api_msg)
+        assert api_msg["reasoning_content"] == ""
+
     def test_deepseek_reasoning_field_promoted(self) -> None:
         """When only 'reasoning' is set, it gets promoted to reasoning_content."""
         agent = _make_agent(provider="deepseek", model="deepseek-v4-flash")
@@ -155,7 +197,7 @@ class TestCopyReasoningContentForApi:
 
         If the source turn has tool_calls AND a 'reasoning' field but NO
         'reasoning_content' key, it's from a prior provider (the DeepSeek
-        build path pins reasoning_content at creation). Inject "" instead
+        build path pins reasoning_content at creation). Inject " " instead
         of forwarding the prior provider's chain of thought.
         """
         agent = _make_agent(provider="deepseek", model="deepseek-v4-flash")
@@ -167,7 +209,7 @@ class TestCopyReasoningContentForApi:
         }
         api_msg: dict = {}
         agent._copy_reasoning_content_for_api(source, api_msg)
-        assert api_msg["reasoning_content"] == ""
+        assert api_msg["reasoning_content"] == " "
 
     def test_kimi_poisoned_cross_provider_history_padded(self) -> None:
         """Kimi path of #15748 — same rule as DeepSeek."""
@@ -180,7 +222,7 @@ class TestCopyReasoningContentForApi:
         }
         api_msg: dict = {}
         agent._copy_reasoning_content_for_api(source, api_msg)
-        assert api_msg["reasoning_content"] == ""
+        assert api_msg["reasoning_content"] == " "
 
     def test_kimi_path_still_works(self) -> None:
         """Existing Kimi detection still pads reasoning_content."""
@@ -192,7 +234,7 @@ class TestCopyReasoningContentForApi:
         }
         api_msg: dict = {}
         agent._copy_reasoning_content_for_api(source, api_msg)
-        assert api_msg.get("reasoning_content") == ""
+        assert api_msg.get("reasoning_content") == " "
 
     def test_kimi_moonshot_base_url(self) -> None:
         agent = _make_agent(
@@ -205,7 +247,7 @@ class TestCopyReasoningContentForApi:
         }
         api_msg: dict = {}
         agent._copy_reasoning_content_for_api(source, api_msg)
-        assert api_msg.get("reasoning_content") == ""
+        assert api_msg.get("reasoning_content") == " "
 
     def test_non_thinking_provider_not_padded(self) -> None:
         """Providers that don't require the echo are untouched."""
@@ -237,7 +279,7 @@ class TestCopyReasoningContentForApi:
         }
         api_msg: dict = {}
         agent._copy_reasoning_content_for_api(source, api_msg)
-        assert api_msg.get("reasoning_content") == ""
+        assert api_msg.get("reasoning_content") == " "
 
     def test_non_assistant_role_ignored(self) -> None:
         """User/tool messages are left alone."""
@@ -302,7 +344,7 @@ class TestBuildAssistantMessageDeepSeekReasoningContent:
 
         assert msg["reasoning_content"] == "DeepSeek model_extra reasoning"
 
-    def test_deepseek_tool_call_without_raw_reasoning_content_gets_empty_string(self) -> None:
+    def test_deepseek_tool_call_without_raw_reasoning_content_gets_space_placeholder(self) -> None:
         agent = _make_agent(provider="deepseek", model="deepseek-v4-flash")
         assistant_message = SimpleNamespace(
             content=None,
@@ -324,7 +366,7 @@ class TestBuildAssistantMessageDeepSeekReasoningContent:
 
         msg = agent._build_assistant_message(assistant_message, "tool_calls")
 
-        assert msg["reasoning_content"] == ""
+        assert msg["reasoning_content"] == " "
         assert msg["tool_calls"][0]["id"] == "call_1"
 
 
@@ -345,22 +387,22 @@ class TestBuildAssistantMessagePadsStrictProviders:
         [
             pytest.param(
                 "deepseek", "deepseek-v4-pro", "",
-                None, "",
+                None, " ",
                 id="deepseek-attr-none",
             ),
             pytest.param(
                 "deepseek", "deepseek-v4-pro", "",
-                _ATTR_ABSENT, "",
+                _ATTR_ABSENT, " ",
                 id="deepseek-attr-absent",
             ),
             pytest.param(
                 "kimi-coding", "kimi-k2.6", "",
-                None, "",
+                None, " ",
                 id="kimi-attr-none",
             ),
             pytest.param(
                 "custom", "kimi-k2", "https://api.moonshot.ai/v1",
-                _ATTR_ABSENT, "",
+                _ATTR_ABSENT, " ",
                 id="moonshot-base-url",
             ),
             pytest.param(

tests/run_agent/test_run_agent.py

@@ -1465,8 +1465,8 @@ class TestBuildAssistantMessage:
 
         This preserves ``_copy_reasoning_content_for_api``'s downstream
         tiers at replay time — cross-provider leak guard (#15748),
-        promote-from-``reasoning``, and DeepSeek/Kimi ""-pad — which
-        would all be bypassed if we eagerly wrote ``reasoning_content=""``
+        promote-from-``reasoning``, and DeepSeek/Kimi " "-pad — which
+        would all be bypassed if we eagerly wrote ``reasoning_content=" "``
         on every assistant turn regardless of provider.
         """
         msg = _mock_assistant_msg(content="plain answer")
@@ -2181,6 +2181,73 @@ class TestHandleMaxIterations:
         kwargs = agent.client.chat.completions.create.call_args.kwargs
         assert "reasoning" not in kwargs.get("extra_body", {})
 
+    def test_codex_summary_sanitizes_orphan_tool_results(self, agent):
+        agent.api_mode = "codex_responses"
+        agent.provider = "openai-codex"
+        agent.base_url = "https://chatgpt.com/backend-api/codex"
+        agent._base_url_lower = agent.base_url.lower()
+        agent._base_url_hostname = "chatgpt.com"
+        agent.model = "gpt-5.5"
+        agent._cached_system_prompt = "You are helpful."
+        captured = {}
+
+        def fake_run_codex_stream(kwargs):
+            captured.update(kwargs)
+            return SimpleNamespace(
+                status="completed",
+                output=[
+                    SimpleNamespace(
+                        type="message",
+                        status="completed",
+                        content=[SimpleNamespace(type="output_text", text="Summary")],
+                    )
+                ],
+            )
+
+        messages = [
+            {"role": "user", "content": "do stuff"},
+            {
+                "role": "tool",
+                "tool_call_id": "call_orphan",
+                "content": "orphaned result from compressed history",
+            },
+        ]
+
+        with patch.object(agent, "_run_codex_stream", side_effect=fake_run_codex_stream):
+            result = agent._handle_max_iterations(messages, 90)
+
+        assert result == "Summary"
+        input_items = captured["input"]
+        assert not any(
+            item.get("type") == "function_call_output"
+            and item.get("call_id") == "call_orphan"
+            for item in input_items
+        )
+
+    def test_api_sanitizer_matches_responses_call_id_when_id_differs(self, agent):
+        messages = [
+            {
+                "role": "assistant",
+                "content": "",
+                "tool_calls": [
+                    {
+                        "id": "fc_123",
+                        "call_id": "call_123",
+                        "response_item_id": "fc_123",
+                        "type": "function",
+                        "function": {"name": "web_search", "arguments": "{}"},
+                    }
+                ],
+            },
+            {"role": "tool", "tool_call_id": "call_123", "content": "result"},
+        ]
+
+        sanitized = agent._sanitize_api_messages(messages)
+
+        assert [m.get("tool_call_id") for m in sanitized if m.get("role") == "tool"] == [
+            "call_123"
+        ]
+
 
 class TestRunConversation:
     """Tests for the main run_conversation method.
@@ -4550,7 +4617,7 @@ class TestReasoningReplayForStrictProviders:
         agent.compression_enabled = False
         agent.save_trajectories = False
 
-    def test_kimi_tool_replay_includes_empty_reasoning_content(self, agent):
+    def test_kimi_tool_replay_includes_space_reasoning_content(self, agent):
         self._setup_agent(agent)
         agent.base_url = "https://api.kimi.com/coding/v1"
         agent._base_url_lower = agent.base_url.lower()
@@ -4587,7 +4654,7 @@ class TestReasoningReplayForStrictProviders:
         assert replayed_assistant["role"] == "assistant"
         assert replayed_assistant["tool_calls"][0]["function"]["name"] == "terminal"
         assert "reasoning_content" in replayed_assistant
-        assert replayed_assistant["reasoning_content"] == ""
+        assert replayed_assistant["reasoning_content"] == " "
 
     def test_explicit_reasoning_content_beats_normalized_reasoning_on_replay(self, agent):
         self._setup_agent(agent)

tests/run_agent/test_tool_call_guardrail_runtime.py

@@ -0,0 +1,275 @@
+"""Runtime tests for tool-call loop guardrails."""
+
+import json
+import uuid
+from types import SimpleNamespace
+from unittest.mock import MagicMock, patch
+
+from run_agent import AIAgent
+
+
+def _make_tool_defs(*names: str) -> list[dict]:
+    return [
+        {
+            "type": "function",
+            "function": {
+                "name": name,
+                "description": f"{name} tool",
+                "parameters": {"type": "object", "properties": {}},
+            },
+        }
+        for name in names
+    ]
+
+
+def _mock_tool_call(name="web_search", arguments="{}", call_id=None):
+    return SimpleNamespace(
+        id=call_id or f"call_{uuid.uuid4().hex[:8]}",
+        type="function",
+        function=SimpleNamespace(name=name, arguments=arguments),
+    )
+
+
+def _mock_response(content="Hello", finish_reason="stop", tool_calls=None):
+    msg = SimpleNamespace(content=content, tool_calls=tool_calls)
+    choice = SimpleNamespace(message=msg, finish_reason=finish_reason)
+    return SimpleNamespace(choices=[choice], model="test/model", usage=None)
+
+
+def _make_agent(*tool_names: str, max_iterations: int = 10, config: dict | None = None) -> AIAgent:
+    with (
+        patch("run_agent.get_tool_definitions", return_value=_make_tool_defs(*tool_names)),
+        patch("run_agent.check_toolset_requirements", return_value={}),
+        patch("hermes_cli.config.load_config", return_value=config or {}),
+        patch("run_agent.OpenAI"),
+    ):
+        agent = AIAgent(
+            api_key="test-key-1234567890",
+            base_url="https://openrouter.ai/api/v1",
+            max_iterations=max_iterations,
+            quiet_mode=True,
+            skip_context_files=True,
+            skip_memory=True,
+        )
+    agent.client = MagicMock()
+    agent._cached_system_prompt = "You are helpful."
+    agent._use_prompt_caching = False
+    agent.tool_delay = 0
+    agent.compression_enabled = False
+    agent.save_trajectories = False
+    return agent
+
+
+def _seed_exact_failures(agent: AIAgent, tool_name: str, args: dict, count: int = 2) -> None:
+    for _ in range(count):
+        agent._tool_guardrails.after_call(
+            tool_name,
+            args,
+            json.dumps({"error": "boom"}),
+            failed=True,
+        )
+
+
+def _hard_stop_config(**overrides) -> dict:
+    cfg = {
+        "tool_loop_guardrails": {
+            "warnings_enabled": True,
+            "hard_stop_enabled": True,
+            "hard_stop_after": {
+                "exact_failure": 2,
+                "same_tool_failure": 8,
+                "idempotent_no_progress": 5,
+            },
+        }
+    }
+    cfg["tool_loop_guardrails"].update(overrides)
+    return cfg
+
+
+def test_default_sequential_path_warns_repeated_exact_failure_without_blocking_execution():
+    agent = _make_agent("web_search")
+    args = {"query": "same"}
+    _seed_exact_failures(agent, "web_search", args)
+    starts = []
+    progress = []
+    agent.tool_start_callback = lambda *a, **k: starts.append((a, k))
+    agent.tool_progress_callback = lambda *a, **k: progress.append((a, k))
+    tc = _mock_tool_call("web_search", json.dumps(args), "c-soft")
+    msg = SimpleNamespace(content="", tool_calls=[tc])
+    messages = []
+
+    with patch("run_agent.handle_function_call", return_value=json.dumps({"error": "boom"})) as mock_hfc:
+        agent._execute_tool_calls_sequential(msg, messages, "task-1")
+
+    mock_hfc.assert_called_once()
+    assert len(starts) == 1
+    assert any(event[0][0] == "tool.completed" for event in progress)
+    assert len(messages) == 1
+    assert messages[0]["role"] == "tool"
+    assert messages[0]["tool_call_id"] == "c-soft"
+    assert "repeated_exact_failure_warning" in messages[0]["content"]
+    assert "repeated_exact_failure_block" not in messages[0]["content"]
+    assert agent._tool_guardrail_halt_decision is None
+
+
+def test_config_enabled_hard_stop_blocks_repeated_exact_failure_before_execution():
+    agent = _make_agent("web_search", config=_hard_stop_config())
+    args = {"query": "same"}
+    _seed_exact_failures(agent, "web_search", args)
+    starts = []
+    progress = []
+    agent.tool_start_callback = lambda *a, **k: starts.append((a, k))
+    agent.tool_progress_callback = lambda *a, **k: progress.append((a, k))
+    tc = _mock_tool_call("web_search", json.dumps(args), "c-block")
+    msg = SimpleNamespace(content="", tool_calls=[tc])
+    messages = []
+
+    with patch("run_agent.handle_function_call", return_value="SHOULD_NOT_RUN") as mock_hfc:
+        agent._execute_tool_calls_sequential(msg, messages, "task-1")
+
+    mock_hfc.assert_not_called()
+    assert starts == []
+    assert progress == []
+    assert len(messages) == 1
+    assert messages[0]["role"] == "tool"
+    assert messages[0]["tool_call_id"] == "c-block"
+    assert "repeated_exact_failure_block" in messages[0]["content"]
+
+
+def test_sequential_after_call_appends_guidance_to_tool_result_without_extra_messages():
+    agent = _make_agent("web_search")
+    args = {"query": "same"}
+    _seed_exact_failures(agent, "web_search", args, count=1)
+    tc = _mock_tool_call("web_search", json.dumps(args), "c-warn")
+    msg = SimpleNamespace(content="", tool_calls=[tc])
+    messages = []
+
+    with patch("run_agent.handle_function_call", return_value=json.dumps({"error": "boom"})):
+        agent._execute_tool_calls_sequential(msg, messages, "task-1")
+
+    assert [m["role"] for m in messages] == ["tool"]
+    assert messages[0]["tool_call_id"] == "c-warn"
+    assert "Tool loop warning" in messages[0]["content"]
+    assert "repeated_exact_failure_warning" in messages[0]["content"]
+
+
+def test_config_enabled_hard_stop_concurrent_path_does_not_submit_blocked_calls_and_preserves_result_order():
+    agent = _make_agent("web_search", config=_hard_stop_config())
+    blocked_args = {"query": "blocked"}
+    allowed_args = {"query": "allowed"}
+    _seed_exact_failures(agent, "web_search", blocked_args)
+    starts = []
+    progress_events = []
+    agent.tool_start_callback = lambda tool_call_id, name, args: starts.append((tool_call_id, name, args))
+    agent.tool_progress_callback = lambda event, name, preview, args, **kw: progress_events.append((event, name, args, kw))
+    calls = [
+        _mock_tool_call("web_search", json.dumps(blocked_args), "c-block"),
+        _mock_tool_call("web_search", json.dumps(allowed_args), "c-allow"),
+    ]
+    msg = SimpleNamespace(content="", tool_calls=calls)
+    messages = []
+    executed = []
+
+    def fake_handle(name, args, task_id, **kwargs):
+        executed.append((name, args, kwargs["tool_call_id"]))
+        return json.dumps({"ok": args["query"]})
+
+    with patch("run_agent.handle_function_call", side_effect=fake_handle):
+        agent._execute_tool_calls_concurrent(msg, messages, "task-1")
+
+    assert executed == [("web_search", allowed_args, "c-allow")]
+    assert [m["tool_call_id"] for m in messages] == ["c-block", "c-allow"]
+    assert "repeated_exact_failure_block" in messages[0]["content"]
+    assert json.loads(messages[1]["content"]) == {"ok": "allowed"}
+    assert starts == [("c-allow", "web_search", allowed_args)]
+    started_events = [event for event in progress_events if event[0] == "tool.started"]
+    completed_events = [event for event in progress_events if event[0] == "tool.completed"]
+    assert started_events == [("tool.started", "web_search", allowed_args, {})]
+    assert len(completed_events) == 1
+    assert completed_events[0][1] == "web_search"
+
+
+def test_plugin_pre_tool_block_wins_without_counting_as_toolguard_block():
+    agent = _make_agent("web_search")
+    args = {"query": "same"}
+    tc = _mock_tool_call("web_search", json.dumps(args), "c-plugin")
+    msg = SimpleNamespace(content="", tool_calls=[tc])
+    messages = []
+
+    with (
+        patch("hermes_cli.plugins.get_pre_tool_call_block_message", return_value="plugin policy"),
+        patch("run_agent.handle_function_call", return_value="SHOULD_NOT_RUN") as mock_hfc,
+    ):
+        agent._execute_tool_calls_sequential(msg, messages, "task-1")
+
+    mock_hfc.assert_not_called()
+    assert "plugin policy" in messages[0]["content"]
+    assert agent._tool_guardrails.before_call("web_search", args).action == "allow"
+
+
+def test_default_run_conversation_warns_without_guardrail_halt():
+    agent = _make_agent("web_search", max_iterations=10)
+    same_args = {"query": "same"}
+    responses = [
+        _mock_response(
+            content="",
+            finish_reason="tool_calls",
+            tool_calls=[_mock_tool_call("web_search", json.dumps(same_args), f"c{i}")],
+        )
+        for i in range(1, 4)
+    ]
+    responses.append(_mock_response(content="done", finish_reason="stop", tool_calls=None))
+    agent.client.chat.completions.create.side_effect = responses
+
+    with (
+        patch("run_agent.handle_function_call", return_value=json.dumps({"error": "boom"})) as mock_hfc,
+        patch.object(agent, "_persist_session"),
+        patch.object(agent, "_save_trajectory"),
+        patch.object(agent, "_cleanup_task_resources"),
+    ):
+        result = agent.run_conversation("search repeatedly")
+
+    assert mock_hfc.call_count == 3
+    assert result["turn_exit_reason"].startswith("text_response")
+    assert "guardrail" not in result
+    assert result["final_response"] == "done"
+    tool_contents = [m["content"] for m in result["messages"] if m.get("role") == "tool"]
+    assert any("repeated_exact_failure_warning" in content for content in tool_contents)
+
+
+def test_config_enabled_hard_stop_run_conversation_returns_controlled_guardrail_halt_without_top_level_error():
+    agent = _make_agent("web_search", max_iterations=10, config=_hard_stop_config())
+    same_args = {"query": "same"}
+    responses = [
+        _mock_response(
+            content="",
+            finish_reason="tool_calls",
+            tool_calls=[_mock_tool_call("web_search", json.dumps(same_args), f"c{i}")],
+        )
+        for i in range(1, 10)
+    ]
+    agent.client.chat.completions.create.side_effect = responses
+
+    with (
+        patch("run_agent.handle_function_call", return_value=json.dumps({"error": "boom"})) as mock_hfc,
+        patch.object(agent, "_persist_session"),
+        patch.object(agent, "_save_trajectory"),
+        patch.object(agent, "_cleanup_task_resources"),
+    ):
+        result = agent.run_conversation("search repeatedly")
+
+    assert mock_hfc.call_count == 2
+    assert result["api_calls"] == 3
+    assert result["api_calls"] < agent.max_iterations
+    assert result["turn_exit_reason"] == "guardrail_halt"
+    assert "error" not in result
+    assert result["completed"] is True
+    assert "stopped retrying" in result["final_response"]
+    assert result["guardrail"]["code"] == "repeated_exact_failure_block"
+    assert result["guardrail"]["tool_name"] == "web_search"
+
+    assistant_tool_calls = [m for m in result["messages"] if m.get("role") == "assistant" and m.get("tool_calls")]
+    for assistant_msg in assistant_tool_calls:
+        call_ids = [tc["id"] for tc in assistant_msg["tool_calls"]]
+        following_results = [m for m in result["messages"] if m.get("role") == "tool" and m.get("tool_call_id") in call_ids]
+        assert len(following_results) == len(call_ids)

tests/test_hermes_state.py

@@ -212,6 +212,82 @@ class TestMessageStorage:
         messages = db.get_messages("s1")
         assert messages[0]["tool_calls"] == tool_calls
 
+    def test_multimodal_list_content_round_trip(self, db):
+        """Multimodal ``content`` (list of parts) must survive the SQLite
+        round-trip.  sqlite3 cannot bind Python lists directly, so the DB
+        layer JSON-encodes structured content on write and decodes on read.
+
+        Regression test for the "Error binding parameter 3: type 'list' is
+        not supported" crash users hit when pasting screenshots into the
+        TUI (issue #17522).
+        """
+        db.create_session(session_id="s1", source="cli")
+        content = [
+            {"type": "text", "text": "describe this screenshot"},
+            {
+                "type": "image_url",
+                "image_url": {"url": "data:image/png;base64,iVBORw0KG..."},
+            },
+        ]
+
+        # Write must not raise
+        db.append_message("s1", role="user", content=content)
+
+        # get_messages decodes back to the original list
+        msgs = db.get_messages("s1")
+        assert len(msgs) == 1
+        assert msgs[0]["content"] == content
+
+        # get_messages_as_conversation decodes back to the original list
+        conv = db.get_messages_as_conversation("s1")
+        assert len(conv) == 1
+        assert conv[0] == {"role": "user", "content": content}
+
+    def test_dict_content_round_trip(self, db):
+        """Dict-shaped content (e.g. provider wrappers) also round-trips."""
+        db.create_session(session_id="s1", source="cli")
+        content = {"parts": [{"text": "hi"}]}
+
+        db.append_message("s1", role="user", content=content)
+        msgs = db.get_messages("s1")
+        assert msgs[0]["content"] == content
+
+    def test_string_content_unchanged_by_encoding(self, db):
+        """Plain strings must not be wrapped — FTS search and legacy
+        consumers depend on raw-string storage for text content.
+        """
+        db.create_session(session_id="s1", source="cli")
+        db.append_message("s1", role="user", content="plain text")
+
+        # Peek at the raw column to confirm no encoding was applied
+        with db._lock:
+            row = db._conn.execute(
+                "SELECT content FROM messages WHERE session_id = ?", ("s1",)
+            ).fetchone()
+        assert row["content"] == "plain text"
+
+    def test_replace_messages_handles_multimodal_content(self, db):
+        """`replace_messages` (used by /retry, /undo, /compress) must also
+        handle list content without crashing."""
+        db.create_session(session_id="s1", source="cli")
+        content = [
+            {"type": "text", "text": "look at this"},
+            {"type": "image_url", "image_url": {"url": "data:image/png;base64,AAA"}},
+        ]
+
+        db.replace_messages(
+            "s1",
+            [
+                {"role": "user", "content": content},
+                {"role": "assistant", "content": "I see a screenshot."},
+            ],
+        )
+
+        msgs = db.get_messages("s1")
+        assert len(msgs) == 2
+        assert msgs[0]["content"] == content
+        assert msgs[1]["content"] == "I see a screenshot."
+
     def test_get_messages_as_conversation(self, db):
         db.create_session(session_id="s1", source="cli")
         db.append_message("s1", role="user", content="Hello")
@@ -323,6 +399,27 @@ class TestMessageStorage:
         assert msg["reasoning"] == "Thinking about what to say"
         assert msg["reasoning_details"] == details
 
+    def test_finish_reason_restored_by_get_messages_as_conversation(self, db):
+        """finish_reason on assistant messages must survive conversation replay.
+
+        Without this, /branch copies and other transcript round-trips silently
+        drop the provider's stop signal.
+        """
+        db.create_session(session_id="s1", source="cli")
+        db.append_message(
+            "s1",
+            role="assistant",
+            content="Done",
+            finish_reason="tool_calls",
+        )
+        db.append_message("s1", role="user", content="next")
+
+        conv = db.get_messages_as_conversation("s1")
+        assert conv[0]["role"] == "assistant"
+        assert conv[0]["finish_reason"] == "tool_calls"
+        # Non-assistant rows should not have a finish_reason key added.
+        assert "finish_reason" not in conv[1]
+
     def test_reasoning_content_persisted_and_restored(self, db):
         """reasoning_content must survive session replay as its own field."""
         db.create_session(session_id="s1", source="cli")
@@ -1719,6 +1816,97 @@ class TestListSessionsRich:
         # No messages, so last_active falls back to started_at
         assert sessions[0]["last_active"] == sessions[0]["started_at"]
 
+    def test_order_by_last_active_surfaces_recently_touched_older_session_first(self, db):
+        t0 = 1709500000.0
+        db.create_session("old", "cli")
+        db.create_session("new", "cli")
+
+        with db._lock:
+            db._conn.execute("UPDATE sessions SET started_at=? WHERE id=?", (t0, "old"))
+            db._conn.execute("UPDATE sessions SET started_at=? WHERE id=?", (t0 + 10, "new"))
+
+        db.append_message("old", "user", "old first")
+        db.append_message("new", "user", "new first")
+        db.append_message("old", "assistant", "old touched later")
+
+        with db._lock:
+            db._conn.execute(
+                "UPDATE messages SET timestamp=? WHERE session_id=? AND role=? AND content=?",
+                (t0 + 1, "old", "user", "old first"),
+            )
+            db._conn.execute(
+                "UPDATE messages SET timestamp=? WHERE session_id=? AND role=? AND content=?",
+                (t0 + 11, "new", "user", "new first"),
+            )
+            db._conn.execute(
+                "UPDATE messages SET timestamp=? WHERE session_id=? AND role=? AND content=?",
+                (t0 + 20, "old", "assistant", "old touched later"),
+            )
+            db._conn.commit()
+
+        assert [s["id"] for s in db.list_sessions_rich(limit=5)] == ["new", "old"]
+        assert [
+            s["id"] for s in db.list_sessions_rich(limit=5, order_by_last_active=True)
+        ] == ["old", "new"]
+
+    def test_order_by_last_active_uses_compression_tip_activity(self, db):
+        """A compression root whose tip was touched recently must rank above
+        a newer uncompressed session, even when that tip activity lives in a
+        different row and the outer LIMIT could otherwise cut it.
+
+        This is the case that forced SQL-level chain walking: a naive "cap
+        the SQL fetch at limit*K" optimization would drop the old root off
+        the SQL page before post-projection could promote it.
+        """
+        t0 = 1709500000.0
+        db.create_session("root1", "cli")
+        with db._lock:
+            db._conn.execute("UPDATE sessions SET started_at=? WHERE id=?", (t0, "root1"))
+            db._conn.execute(
+                "UPDATE sessions SET ended_at=?, end_reason=? WHERE id=?",
+                (t0 + 100, "compression", "root1"),
+            )
+        db.append_message("root1", "user", "old ask")
+
+        # Continuation tip created after root ended; last activity much later.
+        db.create_session("tip1", "cli", parent_session_id="root1")
+        with db._lock:
+            db._conn.execute("UPDATE sessions SET started_at=? WHERE id=?", (t0 + 101, "tip1"))
+        db.append_message("tip1", "user", "latest message")
+
+        # Bunch of newer, uncompressed sessions — fresher start_at but older
+        # last activity than the tip. Explicitly pin message timestamps so
+        # they don't pick up wall-clock from append_message.
+        for i in range(5):
+            sid = f"newer{i}"
+            db.create_session(sid, "cli")
+            with db._lock:
+                db._conn.execute(
+                    "UPDATE sessions SET started_at=? WHERE id=?",
+                    (t0 + 500 + i, sid),
+                )
+            db.append_message(sid, "user", f"msg {i}")
+            with db._lock:
+                db._conn.execute(
+                    "UPDATE messages SET timestamp=? WHERE session_id=? AND content=?",
+                    (t0 + 500 + i, sid, f"msg {i}"),
+                )
+
+        # Tip activity timestamp is the latest thing in the DB.
+        with db._lock:
+            db._conn.execute(
+                "UPDATE messages SET timestamp=? WHERE session_id=? AND content=?",
+                (t0 + 10_000, "tip1", "latest message"),
+            )
+            db._conn.commit()
+
+        # limit=1 is the stress test: the old root must win the single slot.
+        top = db.list_sessions_rich(limit=1, order_by_last_active=True)
+        assert len(top) == 1
+        # Projection surfaces the tip's id in the root's slot.
+        assert top[0]["id"] == "tip1"
+        assert top[0]["_lineage_root_id"] == "root1"
+
     def test_rich_list_includes_title(self, db):
         db.create_session("s1", "cli")
         db.set_session_title("s1", "refactoring auth")

tests/test_tui_gateway_server.py

@@ -59,6 +59,28 @@ def test_write_json_returns_false_on_broken_pipe(monkeypatch):
     assert server.write_json({"ok": True}) is False
 
 
+def test_dispatch_rejects_non_object_request():
+    resp = server.dispatch([])
+
+    assert resp == {
+        "jsonrpc": "2.0",
+        "id": None,
+        "error": {"code": -32600, "message": "invalid request: expected an object"},
+    }
+
+
+def test_dispatch_rejects_non_object_params():
+    resp = server.dispatch(
+        {"id": "1", "method": "session.create", "params": []}
+    )
+
+    assert resp == {
+        "jsonrpc": "2.0",
+        "id": "1",
+        "error": {"code": -32602, "message": "invalid params: expected an object"},
+    }
+
+
 def test_load_enabled_toolsets_prefers_tui_env(monkeypatch):
     monkeypatch.setenv("HERMES_TUI_TOOLSETS", "web, terminal, ,memory")
 
@@ -115,7 +137,10 @@ def test_load_enabled_toolsets_rejects_disabled_mcp_env(monkeypatch, capsys):
     )
     monkeypatch.setattr(config_mod, "load_config", lambda: {"platform_toolsets": {"cli": ["memory"]}})
 
-    assert server._load_enabled_toolsets() == ["memory"]
+    # Sorted: ["kanban", "memory"]. `kanban` is auto-recovered by
+    # _get_platform_tools because it's a non-configurable platform toolset
+    # whose tools live in hermes-cli's universe (see toolsets.py).
+    assert server._load_enabled_toolsets() == ["kanban", "memory"]
     err = capsys.readouterr().err
     assert "ignoring disabled MCP servers" in err
     assert "mcp-off" in err
@@ -134,7 +159,7 @@ def test_load_enabled_toolsets_falls_back_when_tui_env_invalid(monkeypatch, caps
 
     monkeypatch.setattr(config_mod, "load_config", lambda: {"platform_toolsets": {"cli": ["memory"]}})
 
-    assert server._load_enabled_toolsets() == ["memory"]
+    assert server._load_enabled_toolsets() == ["kanban", "memory"]
     assert "using configured CLI toolsets" in capsys.readouterr().err
 
 
@@ -980,6 +1005,21 @@ def test_config_busy_get_and_set(monkeypatch):
     assert ("display.busy_input_mode", "interrupt") in writes
 
 
+def test_config_set_yolo_process_scope_treats_false_like_env_as_disabled(monkeypatch):
+    monkeypatch.setenv("HERMES_YOLO_MODE", "false")
+
+    resp = server.handle_request(
+        {
+            "id": "1",
+            "method": "config.set",
+            "params": {"key": "yolo"},
+        }
+    )
+
+    assert resp["result"]["value"] == "1"
+    assert os.environ.get("HERMES_YOLO_MODE") == "1"
+
+
 def test_config_get_statusbar_survives_non_dict_display(monkeypatch):
     monkeypatch.setattr(server, "_load_cfg", lambda: {"display": "broken"})
 
@@ -1898,6 +1938,55 @@ def test_input_detect_drop_attaches_image(monkeypatch):
     assert resp["result"]["text"] == "[User attached image: cat.png]"
 
 
+def test_input_detect_drop_path_with_spaces(tmp_path):
+    """input.detect_drop correctly handles image paths containing spaces."""
+    # Create a minimal PNG file with a space in its name
+    img = tmp_path / "screenshot with spaces.png"
+    img.write_bytes(b"\x89PNG\r\n\x1a\n")  # valid PNG header
+
+    server._sessions["sid"] = _session()
+
+    resp = server.handle_request(
+        {
+            "id": "2",
+            "method": "input.detect_drop",
+            "params": {"session_id": "sid", "text": str(img)},
+        }
+    )
+
+    assert resp["result"]["matched"] is True
+    assert resp["result"]["is_image"] is True
+    assert resp["result"]["path"] == str(img)
+    assert resp["result"]["text"] == f"[User attached image: {img.name}]"
+    # Verify attachment was recorded in the session
+    assert len(server._sessions["sid"]["attached_images"]) == 1
+    assert server._sessions["sid"]["attached_images"][0] == str(img)
+
+
+def test_input_detect_drop_path_with_spaces_and_remainder(tmp_path):
+    """input.detect_drop splits remainder when path contains spaces."""
+    img = tmp_path / "photo with space.jpg"
+    img.write_bytes(b"\xff\xd8\xff" + b"fakejpeg")  # minimal-ish JPEG header
+
+    server._sessions["sid"] = _session()
+
+    user_input = f"{img} describe this image"
+    resp = server.handle_request(
+        {
+            "id": "3",
+            "method": "input.detect_drop",
+            "params": {"session_id": "sid", "text": user_input},
+        }
+    )
+
+    assert resp["result"]["matched"] is True
+    assert resp["result"]["is_image"] is True
+    assert resp["result"]["path"] == str(img)
+    # Remainder becomes the text sent to the model
+    assert resp["result"]["text"] == "describe this image"
+    assert server._sessions["sid"]["attached_images"][0] == str(img)
+
+
 def test_rollback_restore_resolves_number_and_file_path():
     calls = {}
 
@@ -2214,6 +2303,83 @@ def test_prompt_submit_history_version_match_persists_normally(monkeypatch):
         server._sessions.pop("sid", None)
 
 
+def test_prompt_submit_can_truncate_before_user_ordinal(monkeypatch):
+    """Desktop user-message edits should restart the turn from the edited user."""
+
+    seen = {}
+
+    class _Agent:
+        def run_conversation(
+            self, prompt, conversation_history=None, stream_callback=None
+        ):
+            seen["prompt"] = prompt
+            seen["history"] = conversation_history
+            return {
+                "final_response": "edited reply",
+                "messages": [
+                    *(conversation_history or []),
+                    {"role": "user", "content": prompt},
+                    {"role": "assistant", "content": "edited reply"},
+                ],
+            }
+
+    class _ImmediateThread:
+        def __init__(self, target=None, daemon=None):
+            self._target = target
+
+        def start(self):
+            self._target()
+
+    original_history = [
+        {"role": "user", "content": "first"},
+        {"role": "assistant", "content": "first reply"},
+        {"role": "user", "content": "second"},
+        {"role": "assistant", "content": "second reply"},
+    ]
+    server._sessions["sid"] = _session(agent=_Agent(), history=original_history)
+
+    class _StubDb:
+        def __init__(self):
+            self.replaced = []
+
+        def replace_messages(self, session_id, messages):
+            self.replaced.append((session_id, list(messages)))
+
+    stub_db = _StubDb()
+
+    try:
+        monkeypatch.setattr(server.threading, "Thread", _ImmediateThread)
+        monkeypatch.setattr(server, "_get_usage", lambda _a: {})
+        monkeypatch.setattr(server, "render_message", lambda _t, _c: "")
+        monkeypatch.setattr(server, "_emit", lambda *a: None)
+        monkeypatch.setattr(server, "_get_db", lambda: stub_db)
+
+        resp = server.handle_request(
+            {
+                "id": "1",
+                "method": "prompt.submit",
+                "params": {
+                    "session_id": "sid",
+                    "text": "edited second",
+                    "truncate_before_user_ordinal": 1,
+                },
+            }
+        )
+        assert resp.get("result"), f"got error: {resp.get('error')}"
+
+        assert seen["prompt"] == "edited second"
+        assert seen["history"] == original_history[:2]
+        assert server._sessions["sid"]["history"] == [
+            *original_history[:2],
+            {"role": "user", "content": "edited second"},
+            {"role": "assistant", "content": "edited reply"},
+        ]
+        assert server._sessions["sid"]["history_version"] == 2
+        assert stub_db.replaced == [("session-key", original_history[:2])]
+    finally:
+        server._sessions.pop("sid", None)
+
+
 # ---------------------------------------------------------------------------
 # session.interrupt must only cancel pending prompts owned by the calling
 # session — it must not blast-resolve clarify/sudo/secret prompts on

tests/tools/test_browser_supervisor_healthcheck.py

@@ -0,0 +1,167 @@
+"""Unit tests for _SupervisorRegistry cache-hit healthcheck.
+
+Verifies that get_or_start() does NOT return a cached supervisor whose
+thread has exited or whose event loop has stopped. Avoids a real Chrome —
+the only thing under test is the registry's cache decision.
+"""
+
+from __future__ import annotations
+
+import threading
+from types import SimpleNamespace
+
+import pytest
+
+from tools import browser_supervisor as bs
+
+
+class _FakeLoop:
+    def __init__(self, running: bool) -> None:
+        self._running = running
+
+    def is_running(self) -> bool:
+        return self._running
+
+
+def _make_fake_supervisor(cdp_url: str, *, thread_alive: bool, loop_running: bool):
+    """Build a minimal stand-in for a CDPSupervisor entry in the registry.
+
+    Only the attributes touched by the healthcheck (_thread, _loop, cdp_url)
+    and by the teardown path (stop()) need to exist.
+    """
+
+    if thread_alive:
+        # A thread that is actually running — parks on an Event we never set.
+        hold = threading.Event()
+        t = threading.Thread(target=hold.wait, daemon=True)
+        t.start()
+        # Attach the release hook so the test can let the thread exit.
+        setattr(t, "_release", hold.set)
+    else:
+        # An un-started thread — is_alive() returns False.
+        t = threading.Thread(target=lambda: None)
+
+    stop_calls: list[bool] = []
+
+    fake = SimpleNamespace(
+        cdp_url=cdp_url,
+        _thread=t,
+        _loop=_FakeLoop(loop_running),
+        stop=lambda: stop_calls.append(True),
+    )
+    fake._stop_calls = stop_calls  # type: ignore[attr-defined]
+    return fake
+
+
+@pytest.fixture
+def isolated_registry():
+    """A fresh registry instance, independent of the global SUPERVISOR_REGISTRY."""
+    return bs._SupervisorRegistry()
+
+
+@pytest.fixture
+def stub_cdp_supervisor(monkeypatch):
+    """Replace CDPSupervisor in the module so recreate paths don't touch Chrome.
+
+    Returns a callable that reads the last-constructed fake out.
+    """
+    created: list[SimpleNamespace] = []
+
+    class _StubSupervisor:
+        def __init__(self, *, task_id, cdp_url, dialog_policy, dialog_timeout_s):
+            self.task_id = task_id
+            self.cdp_url = cdp_url
+            self.dialog_policy = dialog_policy
+            self.dialog_timeout_s = dialog_timeout_s
+            # Healthy by default — real thread, running "loop".
+            hold = threading.Event()
+            self._thread = threading.Thread(target=hold.wait, daemon=True)
+            self._thread.start()
+            self._thread_release = hold.set  # type: ignore[attr-defined]
+            self._loop = _FakeLoop(True)
+            self.start_called = False
+            self.stop_called = False
+            created.append(self)
+
+        def start(self, timeout: float = 15.0) -> None:
+            self.start_called = True
+
+        def stop(self) -> None:
+            self.stop_called = True
+            # Release the parked thread so the process exits cleanly.
+            release = getattr(self, "_thread_release", None)
+            if release is not None:
+                release()
+
+    monkeypatch.setattr(bs, "CDPSupervisor", _StubSupervisor)
+    yield created
+    # Teardown: release any parked threads in stubs the test left behind.
+    for s in created:
+        release = getattr(s, "_thread_release", None)
+        if release is not None:
+            release()
+
+
+def test_cache_hit_returns_same_instance_when_healthy(
+    isolated_registry, stub_cdp_supervisor
+):
+    """Sanity: healthy cached supervisor is returned without recreate."""
+    first = isolated_registry.get_or_start(task_id="t1", cdp_url="http://h/1")
+    second = isolated_registry.get_or_start(task_id="t1", cdp_url="http://h/1")
+    assert first is second
+    # Only one CDPSupervisor was ever constructed.
+    assert len(stub_cdp_supervisor) == 1
+    first.stop()
+
+
+def test_dead_thread_triggers_recreate(isolated_registry, stub_cdp_supervisor):
+    """Cached supervisor with a non-live thread must not be reused."""
+    cdp_url = "http://h/2"
+    dead = _make_fake_supervisor(cdp_url, thread_alive=False, loop_running=True)
+    isolated_registry._by_task["t2"] = dead  # pre-seed cache with a dead entry
+
+    fresh = isolated_registry.get_or_start(task_id="t2", cdp_url=cdp_url)
+
+    assert fresh is not dead, "dead-thread supervisor must be replaced"
+    assert dead._stop_calls == [True], "dead supervisor must be torn down"
+    assert isolated_registry._by_task["t2"] is fresh
+    assert len(stub_cdp_supervisor) == 1
+    assert stub_cdp_supervisor[0].start_called
+    fresh.stop()
+
+
+def test_stopped_loop_triggers_recreate(isolated_registry, stub_cdp_supervisor):
+    """Cached supervisor whose event loop is no longer running is recreated."""
+    cdp_url = "http://h/3"
+    broken = _make_fake_supervisor(cdp_url, thread_alive=True, loop_running=False)
+    isolated_registry._by_task["t3"] = broken
+
+    fresh = isolated_registry.get_or_start(task_id="t3", cdp_url=cdp_url)
+
+    assert fresh is not broken
+    assert broken._stop_calls == [True]
+    # Release the still-live thread from the pre-seeded fake so we don't leak.
+    release = getattr(broken._thread, "_release", None)
+    if release is not None:
+        release()
+    assert isolated_registry._by_task["t3"] is fresh
+    fresh.stop()
+
+
+def test_missing_thread_and_loop_attrs_trigger_recreate(
+    isolated_registry, stub_cdp_supervisor
+):
+    """Defensive: None _thread or None _loop counts as unhealthy."""
+    cdp_url = "http://h/4"
+    broken = SimpleNamespace(
+        cdp_url=cdp_url,
+        _thread=None,
+        _loop=None,
+        stop=lambda: None,
+    )
+    isolated_registry._by_task["t4"] = broken
+
+    fresh = isolated_registry.get_or_start(task_id="t4", cdp_url=cdp_url)
+    assert fresh is not broken
+    assert isolated_registry._by_task["t4"] is fresh
+    fresh.stop()

tests/tools/test_delegate.py

@@ -786,6 +786,26 @@ class TestDelegationCredentialResolution(unittest.TestCase):
         self.assertEqual(creds["api_mode"], "chat_completions")
         mock_resolve.assert_called_once_with(requested="openrouter")
 
+    @patch("hermes_cli.runtime_provider.resolve_runtime_provider")
+    def test_provider_resolution_uses_runtime_model_when_config_model_missing(self, mock_resolve):
+        """Named providers should propagate their runtime default model to children."""
+        mock_resolve.return_value = {
+            "provider": "custom",
+            "base_url": "https://my-server.example/v1",
+            "api_key": "sk-test-key",
+            "api_mode": "chat_completions",
+            "model": "server-default-model",
+        }
+        parent = _make_mock_parent(depth=0)
+        cfg = {"provider": "custom:my-server", "model": ""}
+
+        creds = _resolve_delegation_credentials(cfg, parent)
+
+        self.assertEqual(creds["model"], "server-default-model")
+        self.assertEqual(creds["provider"], "custom")
+        self.assertEqual(creds["base_url"], "https://my-server.example/v1")
+        mock_resolve.assert_called_once_with(requested="custom:my-server")
+
     def test_direct_endpoint_uses_configured_base_url_and_api_key(self):
         parent = _make_mock_parent(depth=0)
         cfg = {

tests/tools/test_discord_tool.py

@@ -696,6 +696,38 @@ class TestCapabilityDetection:
         _detect_capabilities("tok", force=True)
         assert mock_req.call_count == 2
 
+    @patch("tools.discord_tool._discord_request")
+    def test_cache_is_keyed_by_token(self, mock_req):
+        """Regression: token A's capabilities must not leak to token B.
+
+        Before the fix, the cache was a single module-global dict. The first
+        call populated it and every subsequent call — regardless of token —
+        returned the same cached value, producing wrong schema gating for
+        rotated or multi-token deployments.
+        """
+        def _per_token_flags(method, path, token, **_kwargs):
+            # token A: both intents; token B: neither.
+            if token == "tok_a":
+                return {"flags": (1 << 14) | (1 << 18)}
+            return {"flags": 0}
+
+        mock_req.side_effect = _per_token_flags
+
+        caps_a = _detect_capabilities("tok_a")
+        caps_b = _detect_capabilities("tok_b")
+
+        assert caps_a["has_members_intent"] is True
+        assert caps_a["has_message_content"] is True
+        assert caps_b["has_members_intent"] is False
+        assert caps_b["has_message_content"] is False
+        # Each token should hit the endpoint exactly once.
+        assert mock_req.call_count == 2
+
+        # Re-requesting either token serves from its own cache entry.
+        _detect_capabilities("tok_a")
+        _detect_capabilities("tok_b")
+        assert mock_req.call_count == 2
+
 
 # ---------------------------------------------------------------------------
 # Config allowlist

tests/tools/test_registry.py

@@ -304,6 +304,7 @@ class TestBuiltinDiscovery:
             "tools.file_tools",
             "tools.homeassistant_tool",
             "tools.image_generation_tool",
+            "tools.kanban_tools",
             "tools.memory_tool",
             "tools.mixture_of_agents_tool",
             "tools.process_registry",

tests/tools/test_session_search.py

@@ -242,6 +242,21 @@ class TestSessionSearchConcurrency:
 
 
 class TestRecentSessionListing:
+    def test_recent_mode_requests_last_active_ordering(self):
+        from unittest.mock import MagicMock
+
+        mock_db = MagicMock()
+        mock_db.list_sessions_rich.return_value = []
+
+        result = json.loads(_list_recent_sessions(mock_db, limit=5))
+
+        assert result["success"] is True
+        mock_db.list_sessions_rich.assert_called_once_with(
+            limit=10,
+            exclude_sources=["tool"],
+            order_by_last_active=True,
+        )
+
     def test_current_child_session_excludes_root_lineage_even_when_child_id_is_longer(self):
         from unittest.mock import MagicMock
 

tests/tools/test_skill_manager_tool.py

@@ -567,6 +567,26 @@ class TestSecurityScanGate:
         with patch("hermes_cli.config.load_config", side_effect=RuntimeError("boom")):
             assert _guard_agent_created_enabled() is False
 
+    def test_guard_flag_quoted_false_stays_disabled(self):
+        """Quoted 'false' from YAML edits must not enable the guard."""
+        from tools.skill_manager_tool import _guard_agent_created_enabled
+
+        for quoted in ("false", "False", "0", "no", "off"):
+            with patch("hermes_cli.config.load_config",
+                       return_value={"skills": {"guard_agent_created": quoted}}):
+                assert _guard_agent_created_enabled() is False, \
+                    f"guard_agent_created={quoted!r} must coerce to False"
+
+    def test_guard_flag_quoted_true_enables(self):
+        """Quoted truthy strings must enable the guard."""
+        from tools.skill_manager_tool import _guard_agent_created_enabled
+
+        for quoted in ("true", "True", "1", "yes", "on"):
+            with patch("hermes_cli.config.load_config",
+                       return_value={"skills": {"guard_agent_created": quoted}}):
+                assert _guard_agent_created_enabled() is True, \
+                    f"guard_agent_created={quoted!r} must coerce to True"
+
 
 # ---------------------------------------------------------------------------
 # External skills directories (skills.external_dirs) — mutations in place

tests/tools/test_terminal_tool.py

@@ -104,6 +104,57 @@ def test_cached_sudo_password_isolated_by_session_key(monkeypatch):
     assert terminal_tool._get_cached_sudo_password() == "alpha-pass"
 
 
+def test_passwordless_sudo_skips_interactive_prompt_and_rewrite(monkeypatch):
+    monkeypatch.delenv("SUDO_PASSWORD", raising=False)
+    monkeypatch.delenv("TERMINAL_ENV", raising=False)
+    monkeypatch.setenv("HERMES_INTERACTIVE", "1")
+
+    def _fail_prompt(*_args, **_kwargs):
+        raise AssertionError(
+            "interactive sudo prompt should not run when sudo -n already works"
+        )
+
+    monkeypatch.setattr(terminal_tool, "_prompt_for_sudo_password", _fail_prompt)
+    monkeypatch.setattr(terminal_tool, "_sudo_nopasswd_works", lambda: True, raising=False)
+
+    transformed, sudo_stdin = terminal_tool._transform_sudo_command("sudo whoami")
+
+    assert transformed == "sudo whoami"
+    assert sudo_stdin is None
+
+
+def test_passwordless_sudo_probe_rechecks_local_terminal(monkeypatch):
+    monkeypatch.delenv("TERMINAL_ENV", raising=False)
+    calls = []
+
+    class Result:
+        def __init__(self, returncode):
+            self.returncode = returncode
+
+    def fake_run(args, **kwargs):
+        calls.append((args, kwargs))
+        return Result(0 if len(calls) == 1 else 1)
+
+    monkeypatch.setattr(terminal_tool.subprocess, "run", fake_run)
+
+    assert terminal_tool._sudo_nopasswd_works() is True
+    assert terminal_tool._sudo_nopasswd_works() is False
+    assert len(calls) == 2
+    assert calls[0][0] == ["sudo", "-n", "true"]
+    assert calls[1][0] == ["sudo", "-n", "true"]
+
+
+def test_passwordless_sudo_probe_is_disabled_for_nonlocal_terminal_env(monkeypatch):
+    monkeypatch.setenv("TERMINAL_ENV", "docker")
+
+    def _fail_run(*_args, **_kwargs):
+        raise AssertionError("host sudo probe must not run for non-local terminal envs")
+
+    monkeypatch.setattr(terminal_tool.subprocess, "run", _fail_run)
+
+    assert terminal_tool._sudo_nopasswd_works() is False
+
+
 def test_validate_workdir_allows_windows_drive_paths():
     assert terminal_tool._validate_workdir(r"C:\Users\Alice\project") is None
     assert terminal_tool._validate_workdir("C:/Users/Alice/project") is None

tests/tools/test_yolo_mode.py

@@ -125,6 +125,33 @@ class TestYoloMode:
                                          approval_callback=lambda *a: "deny")
         assert not result["approved"]
 
+    @pytest.mark.parametrize("value", ["false", "False", "0", "off", "no"])
+    def test_false_like_yolo_values_do_not_bypass_dangerous_command(self, monkeypatch, value):
+        """False-like env strings must not silently enable YOLO bypass."""
+        monkeypatch.setenv("HERMES_YOLO_MODE", value)
+        monkeypatch.setenv("HERMES_INTERACTIVE", "1")
+        monkeypatch.setenv("HERMES_SESSION_KEY", "test-session")
+
+        result = check_dangerous_command(
+            "rm -rf /tmp/stuff",
+            "local",
+            approval_callback=lambda *a: "deny",
+        )
+        assert not result["approved"]
+
+    @pytest.mark.parametrize("value", ["false", "False", "0", "off", "no"])
+    def test_false_like_yolo_values_do_not_bypass_combined_guard(self, monkeypatch, value):
+        """Combined guard must treat false-like YOLO env strings as disabled."""
+        monkeypatch.setenv("HERMES_YOLO_MODE", value)
+        monkeypatch.setenv("HERMES_INTERACTIVE", "1")
+
+        result = check_all_command_guards(
+            "rm -rf /tmp/stuff",
+            "local",
+            approval_callback=lambda *a: "deny",
+        )
+        assert not result["approved"]
+
     def test_session_scoped_yolo_only_bypasses_current_session(self, monkeypatch):
         """Gateway /yolo should only bypass approvals for the active session."""
         monkeypatch.delenv("HERMES_YOLO_MODE", raising=False)

tests/tui_gateway/test_protocol.py

@@ -301,7 +301,7 @@ def test_session_resume_returns_hydrated_messages(server, monkeypatch):
         def get_messages_as_conversation(self, _sid, include_ancestors=False):
             return [
                 {"role": "user", "content": "hello"},
-                {"role": "assistant", "content": "yo"},
+                {"role": "assistant", "content": "yo", "reasoning": "thoughts"},
                 {"role": "tool", "content": "searched"},
                 {"role": "assistant", "content": "   "},
                 {"role": "assistant", "content": None},
@@ -311,7 +311,7 @@ def test_session_resume_returns_hydrated_messages(server, monkeypatch):
     monkeypatch.setattr(server, "_get_db", lambda: _DB())
     monkeypatch.setattr(server, "_make_agent", lambda sid, key, session_id=None: object())
     monkeypatch.setattr(server, "_init_session", lambda sid, key, agent, history, cols=80: None)
-    monkeypatch.setattr(server, "_session_info", lambda _agent: {"model": "test/model"})
+    monkeypatch.setattr(server, "_session_info", lambda _agent, _session=None: {"model": "test/model"})
 
     resp = server.handle_request(
         {
@@ -325,11 +325,99 @@ def test_session_resume_returns_hydrated_messages(server, monkeypatch):
     assert resp["result"]["message_count"] == 3
     assert resp["result"]["messages"] == [
         {"role": "user", "text": "hello"},
-        {"role": "assistant", "text": "yo"},
+        {"role": "assistant", "text": "yo", "reasoning": "thoughts"},
         {"role": "tool", "name": "tool", "context": ""},
     ]
 
 
+def test_session_resume_handles_multimodal_list_content(server, monkeypatch):
+    """A user message persisted with list-shaped multimodal content used to
+    crash session resume with ``'list' object has no attribute 'strip'``."""
+
+    multimodal_user = {
+        "role": "user",
+        "content": [
+            {"type": "text", "text": "describe this"},
+            {
+                "type": "image_url",
+                "image_url": {"url": "data:image/png;base64,AAAA"},
+            },
+        ],
+    }
+    text_only_assistant = {"role": "assistant", "content": "ok"}
+
+    class _DB:
+        def get_session(self, _sid):
+            return {"id": "20260502_000000_listcontent"}
+
+        def get_session_by_title(self, _title):
+            return None
+
+        def reopen_session(self, _sid):
+            return None
+
+        def get_messages_as_conversation(self, _sid, include_ancestors=False):
+            return [multimodal_user, text_only_assistant]
+
+    monkeypatch.setattr(server, "_get_db", lambda: _DB())
+    monkeypatch.setattr(server, "_make_agent", lambda sid, key, session_id=None: object())
+    monkeypatch.setattr(server, "_init_session", lambda sid, key, agent, history, cols=80: None)
+    monkeypatch.setattr(server, "_session_info", lambda _agent, _session=None: {"model": "test/model"})
+
+    resp = server.handle_request(
+        {
+            "id": "r1",
+            "method": "session.resume",
+            "params": {"session_id": "20260502_000000_listcontent", "cols": 100},
+        }
+    )
+
+    assert "error" not in resp
+    assert resp["result"]["message_count"] == 2
+    # The image_url part is preserved as a raw data URL inside the text so
+    # the desktop renderer (which extracts embedded images) sees the same
+    # content the optimistic local cache returns. Otherwise the inline
+    # image flashes during initial cache hydration and then vanishes when
+    # the resume payload overwrites it with cleaned text.
+    assert resp["result"]["messages"] == [
+        {
+            "role": "user",
+            "text": "describe this\ndata:image/png;base64,AAAA",
+        },
+        {"role": "assistant", "text": "ok"},
+    ]
+
+
+def test_make_agent_accepts_list_system_prompt(server, monkeypatch):
+    captured = {}
+
+    class _Agent:
+        def __init__(self, **kwargs):
+            captured.update(kwargs)
+            self.model = kwargs.get("model", "")
+
+    monkeypatch.setitem(sys.modules, "run_agent", types.SimpleNamespace(AIAgent=_Agent))
+    monkeypatch.setitem(
+        sys.modules,
+        "hermes_cli.runtime_provider",
+        types.SimpleNamespace(
+            resolve_runtime_provider=lambda **_kwargs: {
+                "provider": "test",
+                "base_url": None,
+                "api_key": None,
+                "api_mode": None,
+            }
+        ),
+    )
+    monkeypatch.setattr(server, "_load_cfg", lambda: {"agent": {"system_prompt": ["one", "two"]}})
+    monkeypatch.setattr(server, "_resolve_startup_runtime", lambda: ("test/model", "test"))
+    monkeypatch.setattr(server, "_get_db", lambda: None)
+
+    server._make_agent("sid", "session-key", session_id="session-key")
+
+    assert captured["ephemeral_system_prompt"] == "one\ntwo"
+
+
 # ── Config I/O ───────────────────────────────────────────────────────
 
 
@@ -594,6 +682,24 @@ def test_command_dispatch_returns_skill_payload(server):
     assert result["name"] == "hermes-agent-dev"
 
 
+def test_command_dispatch_awaits_async_plugin_handler(server):
+    async def _handler(arg):
+        return f"async:{arg}"
+
+    with patch(
+        "hermes_cli.plugins.get_plugin_command_handler",
+        lambda name: _handler if name == "async-cmd" else None,
+    ):
+        resp = server.handle_request({
+            "id": "r-plugin",
+            "method": "command.dispatch",
+            "params": {"name": "async-cmd", "arg": "hello"},
+        })
+
+    assert "error" not in resp
+    assert resp["result"] == {"type": "plugin", "output": "async:hello"}
+
+
 # ── dispatch(): pool routing for long handlers (#12546) ──────────────