fix(clarify): docstring — put options in choices[] only, never enumerate in question text

The model was enumerating options inside the question string (dead prose the UI
can't render as pickable rows). Schema description now spells out: choices[] is
REQUIRED for selectable options; question holds ONLY the question.

agent/auxiliary_client.py

@@ -3079,20 +3079,23 @@ def _try_configured_fallback_chain(
         if not fb_provider or fb_provider.lower() == skip:
             continue
         fb_model = str(entry.get("model", "")).strip() or None
+        fb_base_url = str(entry.get("base_url", "")).strip() or None
+        fb_api_key = str(entry.get("api_key", "")).strip() or None
 
         label = f"fallback_chain[{i}]({fb_provider})"
 
         try:
-            fb_client, resolved_model = _resolve_fallback_entry(entry)
+            fb_client = _resolve_single_provider(
+                fb_provider, fb_model, fb_base_url, fb_api_key)
         except Exception:
-            fb_client, resolved_model = None, None
+            fb_client = None
 
         if fb_client is not None:
             logger.info(
                 "Auxiliary %s: %s on %s — configured fallback to %s (%s)",
-                task, reason, failed_provider, label, resolved_model or fb_model or "default",
+                task, reason, failed_provider, label, fb_model or "default",
             )
-            return fb_client, resolved_model or fb_model, label
+            return fb_client, fb_model, label
         tried.append(label)
 
     if tried:
@@ -3103,103 +3106,6 @@ def _try_configured_fallback_chain(
     return None, None, ""
 
 
-def _fallback_entry_api_key(entry: Dict[str, Any]) -> Optional[str]:
-    """Resolve inline or env-backed API key from a fallback-chain entry."""
-    explicit = str(entry.get("api_key") or "").strip()
-    if explicit:
-        return explicit
-    key_env = str(entry.get("key_env") or entry.get("api_key_env") or "").strip()
-    if key_env:
-        return os.getenv(key_env, "").strip() or None
-    return None
-
-
-def _resolve_fallback_entry(entry: Dict[str, Any]) -> Tuple[Optional[Any], Optional[str]]:
-    """Resolve one fallback entry through the central provider router."""
-    provider = str(entry.get("provider") or "").strip()
-    model = str(entry.get("model") or "").strip() or None
-    if not provider or not model:
-        return None, None
-    base_url = str(entry.get("base_url") or "").strip() or None
-    api_key = _fallback_entry_api_key(entry)
-    api_mode = str(entry.get("api_mode") or entry.get("transport") or "").strip() or None
-    return resolve_provider_client(
-        provider,
-        model=model,
-        explicit_base_url=base_url,
-        explicit_api_key=api_key,
-        api_mode=api_mode,
-    )
-
-
-def _try_main_fallback_chain(
-    task: Optional[str],
-    failed_provider: str = "",
-    reason: str = "error",
-) -> Tuple[Optional[Any], Optional[str], str]:
-    """Try the top-level main-agent fallback chain for an auxiliary call.
-
-    ``provider: auto`` auxiliary tasks should respect the user's declared
-    main fallback policy before dropping into Hermes' built-in discovery
-    chain. The top-level chain is read through ``get_fallback_chain`` so
-    both modern ``fallback_providers`` and legacy ``fallback_model`` entries
-    participate in the same order as the main agent.
-    """
-    try:
-        from hermes_cli.config import load_config
-        from hermes_cli.fallback_config import get_fallback_chain
-
-        chain = get_fallback_chain(load_config())
-    except Exception as exc:
-        logger.debug("Auxiliary %s: could not load main fallback chain: %s", task or "call", exc)
-        return None, None, ""
-
-    if not chain:
-        return None, None, ""
-
-    failed_norm = (failed_provider or "").strip().lower()
-    main_norm = (_read_main_provider() or "").strip().lower()
-    skip = {p for p in (failed_norm, main_norm, "auto") if p}
-    tried: List[str] = []
-
-    for i, entry in enumerate(chain):
-        if not isinstance(entry, dict):
-            continue
-        fb_provider = str(entry.get("provider") or "").strip()
-        fb_model = str(entry.get("model") or "").strip()
-        if not fb_provider or not fb_model:
-            continue
-        fb_norm = fb_provider.lower()
-        label = f"fallback_providers[{i}]({fb_provider})"
-        if fb_norm in skip:
-            tried.append(f"{label} (skipped)")
-            continue
-        if _is_provider_unhealthy(fb_norm):
-            _log_skip_unhealthy(fb_norm, task)
-            tried.append(f"{label} (unhealthy)")
-            continue
-        try:
-            fb_client, resolved_model = _resolve_fallback_entry(entry)
-        except Exception as exc:
-            logger.debug("Auxiliary %s: main fallback %s failed to resolve: %s", task or "call", label, exc)
-            fb_client, resolved_model = None, None
-        if fb_client is not None:
-            logger.info(
-                "Auxiliary %s: %s on %s — main fallback chain to %s (%s)",
-                task or "call", reason, failed_provider or "auto", label,
-                resolved_model or fb_model,
-            )
-            return fb_client, resolved_model or fb_model, fb_provider
-        tried.append(label)
-
-    if tried:
-        logger.debug(
-            "Auxiliary %s: main fallback chain exhausted (tried: %s)",
-            task or "call", ", ".join(tried),
-        )
-    return None, None, ""
-
-
 def _resolve_single_provider(
     provider: str,
     model: Optional[str] = None,
@@ -3210,19 +3116,16 @@ def _resolve_single_provider(
 
     Uses the existing provider resolution infrastructure where possible.
     """
-    # Reuse resolve_provider_client which handles provider→client mapping.
+    # Reuse resolve_provider_client which handles provider→client mapping
     client, resolved_model = resolve_provider_client(
         provider=provider,
         model=model,
-        explicit_base_url=base_url,
-        explicit_api_key=api_key,
+        base_url=base_url,
+        api_key=api_key,
     )
     return client
 
-def _resolve_auto(
-    main_runtime: Optional[Dict[str, Any]] = None,
-    task: Optional[str] = None,
-) -> Tuple[Optional[OpenAI], Optional[str]]:
+def _resolve_auto(main_runtime: Optional[Dict[str, Any]] = None) -> Tuple[Optional[OpenAI], Optional[str]]:
     """Full auto-detection chain.
 
     Priority:
@@ -3320,22 +3223,7 @@ def _resolve_auto(
                             main_provider, resolved or main_model)
                 return client, resolved or main_model
 
-    # ── Step 2: user-configured fallback policy ─────────────────────────
-    # In auto mode, respect the task-specific fallback chain first, then the
-    # main agent's top-level fallback_providers/fallback_model chain. The
-    # hardcoded provider discovery chain below is only the convenience default
-    # for users who have not declared a fallback policy.
-    if task:
-        fb_client, fb_model, _fb_label = _try_configured_fallback_chain(
-            task, main_provider or "auto", reason="main provider unavailable")
-        if fb_client is not None:
-            return fb_client, fb_model
-    fb_client, fb_model, _fb_label = _try_main_fallback_chain(
-        task, main_provider or "auto", reason="main provider unavailable")
-    if fb_client is not None:
-        return fb_client, fb_model
-
-    # ── Step 3: aggregator / fallback chain ──────────────────────────────
+    # ── Step 2: aggregator / fallback chain ──────────────────────────────
     tried = []
     for label, try_fn in _get_provider_chain():
         if _is_provider_unhealthy(label):
@@ -3456,7 +3344,6 @@ def resolve_provider_client(
     api_mode: str = None,
     main_runtime: Optional[Dict[str, Any]] = None,
     is_vision: bool = False,
-    task: Optional[str] = None,
 ) -> Tuple[Optional[Any], Optional[str]]:
     """Central router: given a provider name and optional model, return a
     configured client with the correct auth, base URL, and API format.
@@ -3577,7 +3464,7 @@ def resolve_provider_client(
 
     # ── Auto: try all providers in priority order ────────────────────
     if provider == "auto":
-        client, resolved = _resolve_auto(main_runtime=main_runtime, task=task)
+        client, resolved = _resolve_auto(main_runtime=main_runtime)
         if client is None:
             return None, None
         # When auto-detection lands on a non-OpenRouter provider (e.g. a
@@ -4470,16 +4357,11 @@ def _client_cache_key(
     api_mode: Optional[str] = None,
     main_runtime: Optional[Dict[str, Any]] = None,
     is_vision: bool = False,
-    task: Optional[str] = None,
 ) -> tuple:
     runtime = _normalize_main_runtime(main_runtime)
     runtime_key = tuple(runtime.get(field, "") for field in _MAIN_RUNTIME_FIELDS) if provider == "auto" else ()
-    # `auto` can now resolve through task-specific or main fallback policy,
-    # so the task participates in the cache key. Non-auto providers keep the
-    # old cache shape because the explicit provider/model tuple is sufficient.
-    task_key = (task or "") if provider == "auto" else ""
     pool_hint = _pool_cache_hint(provider, main_runtime=main_runtime)
-    return (provider, async_mode, base_url or "", api_key or "", api_mode or "", runtime_key, is_vision, task_key, pool_hint)
+    return (provider, async_mode, base_url or "", api_key or "", api_mode or "", runtime_key, is_vision, pool_hint)
 
 
 def _store_cached_client(cache_key: tuple, client: Any, default_model: Optional[str], *, bound_loop: Any = None) -> None:
@@ -4672,7 +4554,6 @@ def _get_cached_client(
     api_mode: str = None,
     main_runtime: Optional[Dict[str, Any]] = None,
     is_vision: bool = False,
-    task: Optional[str] = None,
 ) -> Tuple[Optional[Any], Optional[str]]:
     """Get or create a cached client for the given provider.
 
@@ -4710,7 +4591,6 @@ def _get_cached_client(
         api_mode=api_mode,
         main_runtime=main_runtime,
         is_vision=is_vision,
-        task=task,
     )
     with _client_cache_lock:
         if cache_key in _client_cache:
@@ -4755,7 +4635,6 @@ def _get_cached_client(
         api_mode=api_mode,
         main_runtime=runtime,
         is_vision=is_vision,
-        task=task,
     )
     if client is not None:
         # For async clients, remember which loop they were created on so we
@@ -5261,7 +5140,7 @@ def call_llm(
             if not resolved_base_url:
                 logger.info("Auxiliary %s: provider %s unavailable, trying auto-detection chain",
                             task or "call", resolved_provider)
-                client, final_model = _get_cached_client("auto", main_runtime=main_runtime, task=task)
+                client, final_model = _get_cached_client("auto", main_runtime=main_runtime)
         if client is None:
             raise RuntimeError(
                 f"No LLM provider configured for task={task} provider={resolved_provider}. "
@@ -5587,19 +5466,14 @@ def call_llm(
 
             # Fallback order (#26882, #26803):
             #   1. User-configured fallback_chain (per-task) if set
-            #   2. For auto: top-level main fallback_providers/fallback_model
-            #   3. For auto: built-in auxiliary discovery chain
-            #   4. For explicit aux providers: main agent model safety net
+            #   2. Main agent model (last-resort safety net)
+            # For auto users (no explicit aux provider), use the full
+            # auto-detection chain instead — its Step 1 IS the main agent
+            # model, so users on `auto` already get main-model fallback.
             fb_client, fb_model, fb_label = (None, None, "")
             if is_auto:
-                fb_client, fb_model, fb_label = _try_configured_fallback_chain(
-                    task, resolved_provider or "auto", reason=reason)
-                if fb_client is None:
-                    fb_client, fb_model, fb_label = _try_main_fallback_chain(
-                        task, resolved_provider or "auto", reason=reason)
-                if fb_client is None:
-                    fb_client, fb_model, fb_label = _try_payment_fallback(
-                        resolved_provider, task, reason=reason)
+                fb_client, fb_model, fb_label = _try_payment_fallback(
+                    resolved_provider, task, reason=reason)
             else:
                 fb_client, fb_model, fb_label = _try_configured_fallback_chain(
                     task, resolved_provider or "auto", reason=reason)
@@ -5762,7 +5636,7 @@ async def async_call_llm(
             if not resolved_base_url:
                 logger.info("Auxiliary %s: provider %s unavailable, trying auto-detection chain",
                             task or "call", resolved_provider)
-                client, final_model = _get_cached_client("auto", async_mode=True, main_runtime=main_runtime, task=task)
+                client, final_model = _get_cached_client("auto", async_mode=True)
         if client is None:
             raise RuntimeError(
                 f"No LLM provider configured for task={task} provider={resolved_provider}. "
@@ -6030,19 +5904,13 @@ async def async_call_llm(
 
             # Fallback order (#26882, #26803):
             #   1. User-configured fallback_chain (per-task) if set
-            #   2. For auto: top-level main fallback_providers/fallback_model
-            #   3. For auto: built-in auxiliary discovery chain
-            #   4. For explicit aux providers: main agent model safety net
+            #   2. Main agent model (last-resort safety net)
+            # Auto users get the full auto-detection chain instead — its
+            # Step 1 IS the main agent model.
             fb_client, fb_model, fb_label = (None, None, "")
             if is_auto:
-                fb_client, fb_model, fb_label = _try_configured_fallback_chain(
-                    task, resolved_provider or "auto", reason=reason)
-                if fb_client is None:
-                    fb_client, fb_model, fb_label = _try_main_fallback_chain(
-                        task, resolved_provider or "auto", reason=reason)
-                if fb_client is None:
-                    fb_client, fb_model, fb_label = _try_payment_fallback(
-                        resolved_provider, task, reason=reason)
+                fb_client, fb_model, fb_label = _try_payment_fallback(
+                    resolved_provider, task, reason=reason)
             else:
                 fb_client, fb_model, fb_label = _try_configured_fallback_chain(
                     task, resolved_provider or "auto", reason=reason)

apps/desktop/src/app/session/hooks/use-prompt-actions.ts

@@ -58,7 +58,6 @@ import { clearSessionTodos } from '@/store/todos'
 
 import type {
   ClientSessionState,
-  BrowserManageResponse,
   FileAttachResponse,
   HandoffFailResponse,
   HandoffRequestResponse,
@@ -1142,81 +1141,6 @@ export function usePromptActions({
           } catch (err) {
             renderSlashOutput(`error: ${err instanceof Error ? err.message : String(err)}`)
           }
-        },
-        // /browser connect|disconnect|status manages the live CDP connection on
-        // the gateway host, mirroring the TUI's browser.manage RPC. It mutates
-        // BROWSER_CDP_URL (and may launch Chrome) in the gateway process — only
-        // meaningful when that process runs on this machine, so it's gated to
-        // local connections. A remote gateway would act on the wrong host.
-        browser: async ctx => {
-          const resolved = await withSlashOutput(ctx)
-
-          if (!resolved) {
-            return
-          }
-
-          const { render: renderSlashOutput, sessionId } = resolved
-
-          if ($connection.get()?.mode === 'remote') {
-            renderSlashOutput(
-              '/browser manages a Chromium-family browser on the gateway host — only available when connected to a local gateway.'
-            )
-
-            return
-          }
-
-          const [rawAction = 'status', ...rest] = ctx.arg.trim().split(/\s+/).filter(Boolean)
-          const cmdAction = rawAction.toLowerCase()
-
-          if (!['connect', 'disconnect', 'status'].includes(cmdAction)) {
-            renderSlashOutput(
-              'usage: /browser [connect|disconnect|status] [url] · persistent: set browser.cdp_url in config.yaml'
-            )
-
-            return
-          }
-
-          const url = cmdAction === 'connect' ? rest.join(' ').trim() || 'http://127.0.0.1:9222' : undefined
-
-          if (url) {
-            renderSlashOutput(`checking Chromium-family browser remote debugging at ${url}...`)
-          }
-
-          try {
-            const result = await requestGateway<BrowserManageResponse>('browser.manage', {
-              action: cmdAction,
-              session_id: sessionId,
-              ...(url && { url })
-            })
-
-            // Without a streamed session subscription, the gateway bundles its
-            // progress lines into `messages` — flush them inline.
-            result?.messages?.forEach(message => renderSlashOutput(message))
-
-            if (cmdAction === 'status') {
-              renderSlashOutput(
-                result?.connected
-                  ? `browser connected: ${result.url || '(url unavailable)'}`
-                  : 'browser not connected (try /browser connect <url> or set browser.cdp_url in config.yaml)'
-              )
-
-              return
-            }
-
-            if (cmdAction === 'disconnect') {
-              renderSlashOutput('browser disconnected')
-
-              return
-            }
-
-            if (result?.connected) {
-              renderSlashOutput('Browser connected to live Chromium-family browser via CDP')
-              renderSlashOutput(`Endpoint: ${result.url || '(url unavailable)'}`)
-              renderSlashOutput('next browser tool call will use this CDP endpoint')
-            }
-          } catch (err) {
-            renderSlashOutput(`error: ${err instanceof Error ? err.message : String(err)}`)
-          }
         }
       }
 

apps/desktop/src/app/types.ts

@@ -46,12 +46,6 @@ export interface SlashExecResponse {
   warning?: string
 }
 
-export interface BrowserManageResponse {
-  connected?: boolean
-  url?: string
-  messages?: string[]
-}
-
 export interface SessionSteerResponse {
   // 'queued' == accepted into the live turn's steer slot (injected at the next
   // tool-result boundary); 'rejected' == no live tool window, caller queues.

apps/desktop/src/lib/desktop-slash-commands.test.ts

@@ -52,17 +52,6 @@ describe('desktop slash command curation', () => {
     expect(desktopSlashUnavailableMessage('/personality')).toBeNull()
   })
 
-  it('treats /browser as an executable action command (local-gateway connect)', () => {
-    // /browser used to be terminal-only; it now resolves to a desktop action
-    // handler that routes browser.manage RPC when the gateway is local.
-    expect(isDesktopSlashCommand('/browser')).toBe(true)
-    expect(isDesktopSlashSuggestion('/browser')).toBe(true)
-    expect(desktopSlashUnavailableMessage('/browser')).toBeNull()
-    expect(resolveDesktopCommand('/browser')?.surface).toEqual({ kind: 'action', action: 'browser' })
-    // Bare /browser expands to its sub-action options in the popover.
-    expect(resolveDesktopCommand('/browser')?.args).toBe(true)
-  })
-
   it('allows aliases to execute without cluttering the popover', () => {
     expect(isDesktopSlashSuggestion('/reset')).toBe(false)
     expect(isDesktopSlashCommand('/reset')).toBe(true)

apps/desktop/src/lib/desktop-slash-commands.ts

@@ -30,7 +30,6 @@ export interface DesktopThemeCommandOption {
  */
 export type DesktopActionId =
   | 'branch'
-  | 'browser'
   | 'handoff'
   | 'help'
   | 'new'
@@ -104,12 +103,6 @@ const DESKTOP_COMMAND_SPECS: readonly DesktopCommandSpec[] = [
   { name: '/skin', description: 'Switch desktop theme or cycle to the next one', surface: action('skin'), args: true },
   { name: '/title', description: 'Rename the current session', surface: action('title') },
   { name: '/help', description: 'Show desktop slash commands', aliases: ['/commands'], surface: action('help') },
-  {
-    name: '/browser',
-    description: 'Manage browser CDP connection [connect|disconnect|status] (local gateway only)',
-    surface: action('browser'),
-    args: true
-  },
 
   // Overlay pickers
   { name: '/model', description: 'Switch the model for this session', surface: picker('model'), hidden: true },
@@ -149,7 +142,7 @@ const DESKTOP_COMMAND_SPECS: readonly DesktopCommandSpec[] = [
 // per reason beats 40 identical object literals.
 const NO_DESKTOP_SURFACE: Record<DesktopUnavailableReason, readonly string[]> = {
   terminal: [
-    '/busy', '/clear', '/compact', '/config', '/copy', '/cron', '/details',
+    '/browser', '/busy', '/clear', '/compact', '/config', '/copy', '/cron', '/details',
     '/exit', '/footer', '/gateway', '/gquota', '/history', '/image', '/indicator', '/logs',
     '/mouse', '/paste', '/platforms', '/plugins', '/quit', '/redraw', '/reload', '/restart',
     '/sb', '/set-home', '/sethome', '/snap', '/snapshot', '/statusbar', '/toolsets', '/update', '/verbose'

cli.py

@@ -1273,11 +1273,6 @@ def _setup_worktree(repo_root: str = None) -> Optional[Dict[str, str]]:
         print(f"\033[31m✗ Failed to create worktree: {e}\033[0m")
         return None
 
-    # Lock the worktree so concurrent/later hermes processes' pruning
-    # leaves this session's work alone (locks survive crashes too).
-    # Lock failure is non-fatal — _lock_worktree logs at debug level.
-    _lock_worktree(repo_root, str(wt_path))
-
     # Copy files listed in .worktreeinclude (gitignored files the agent needs)
     include_file = Path(repo_root) / ".worktreeinclude"
     if include_file.exists():
@@ -1388,109 +1383,13 @@ def _worktree_has_unpushed_commits(worktree_path: str, timeout: int = 10) -> boo
         return True
 
 
-def _lock_worktree(repo_root: str, wt_path: str, timeout: int = 10) -> bool:
-    """Lock a worktree using git's native lock mechanism.
-
-    The lock marks the worktree as in-use by a live (or crashed) hermes
-    session so that other hermes processes' pruning leaves it alone.
-    Never raises; returns whether the lock was taken.
-    """
-    import subprocess
-
-    try:
-        result = subprocess.run(
-            ["git", "worktree", "lock",
-             "--reason", f"hermes session pid={os.getpid()}", str(wt_path)],
-            capture_output=True, text=True, timeout=timeout, cwd=repo_root,
-        )
-        if result.returncode != 0:
-            logger.debug(
-                "Failed to lock worktree %s: %s", wt_path, result.stderr.strip()
-            )
-            return False
-        return True
-    except Exception as e:
-        logger.debug("Failed to lock worktree %s: %s", wt_path, e)
-        return False
-
-
-def _unlock_worktree(repo_root: str, wt_path: str, timeout: int = 10) -> bool:
-    """Release a git worktree lock. Never raises."""
-    import subprocess
-
-    try:
-        result = subprocess.run(
-            ["git", "worktree", "unlock", str(wt_path)],
-            capture_output=True, text=True, timeout=timeout, cwd=repo_root,
-        )
-        if result.returncode != 0:
-            logger.debug(
-                "Failed to unlock worktree %s: %s", wt_path, result.stderr.strip()
-            )
-            return False
-        return True
-    except Exception as e:
-        logger.debug("Failed to unlock worktree %s: %s", wt_path, e)
-        return False
-
-
-def _worktree_is_locked(repo_root: str, wt_path: str, timeout: int = 10) -> bool:
-    """Return whether a worktree is locked (per ``git worktree list --porcelain``).
-
-    Fails SAFE: on any error (bad repo_root, git failure, timeout) returns
-    True so callers treat the worktree as in-use and do not delete it.
-    """
-    import subprocess
-
-    try:
-        result = subprocess.run(
-            ["git", "worktree", "list", "--porcelain"],
-            capture_output=True, text=True, timeout=timeout, cwd=repo_root,
-        )
-        if result.returncode != 0:
-            return True
-        target = Path(wt_path).resolve()
-        current_path: Optional[Path] = None
-        for line in result.stdout.splitlines():
-            if line.startswith("worktree "):
-                current_path = Path(line[len("worktree "):].strip()).resolve()
-            elif line == "locked" or line.startswith("locked "):
-                if current_path == target:
-                    return True
-        return False
-    except Exception:
-        return True
-
-
-def _worktree_is_dirty(wt_path: str, timeout: int = 10) -> bool:
-    """Return whether a worktree has uncommitted changes (staged, unstaged,
-    or untracked).
-
-    Fails SAFE: on any error returns True so callers do not delete a
-    worktree whose state they cannot determine.
-    """
-    import subprocess
-
-    try:
-        result = subprocess.run(
-            ["git", "status", "--porcelain"],
-            capture_output=True, text=True, timeout=timeout, cwd=wt_path,
-        )
-        if result.returncode != 0:
-            return True
-        return bool(result.stdout.strip())
-    except Exception:
-        return True
-
-
 def _cleanup_worktree(info: Dict[str, str] = None) -> None:
-    """Remove a worktree and its branch on graceful exit.
+    """Remove a worktree and its branch on exit.
 
-    Preserves the worktree (along with its branch and lock) if it has
-    unpushed commits OR uncommitted changes — either may be work the user
-    has not retrieved yet.  Only clean, fully-pushed worktrees are
-    removed, and the branch is only deleted after ``git worktree remove``
-    actually succeeded.
+    Preserves the worktree only if it has unpushed commits (real work
+    that hasn't been pushed to any remote).  Uncommitted changes alone
+    (untracked files, test artifacts) are not enough to keep it — agent
+    work lives in commits/PRs, not the working tree.
     """
     global _active_worktree
     info = info or _active_worktree
@@ -1507,41 +1406,24 @@ def _cleanup_worktree(info: Dict[str, str] = None) -> None:
         return
 
     has_unpushed = _worktree_has_unpushed_commits(wt_path, timeout=10)
-    is_dirty = _worktree_is_dirty(wt_path)
 
-    if has_unpushed or is_dirty:
-        reason = "unpushed commits" if has_unpushed else "uncommitted changes"
-        print(f"\n\033[33m⚠ Worktree has {reason}, keeping: {wt_path}\033[0m")
-        print(f"  To clean up manually: git worktree unlock {wt_path}")
-        print(f"  then: git worktree remove --force {wt_path}")
+    if has_unpushed:
+        print(f"\n\033[33m⚠ Worktree has unpushed commits, keeping: {wt_path}\033[0m")
+        print(f"  To clean up manually: git worktree remove --force {wt_path}")
         _active_worktree = None
         return
 
-    # Clean and fully pushed — release our lock, then remove.
-    _unlock_worktree(repo_root, wt_path)
-
-    removed = False
+    # Remove worktree (even if working tree is dirty — uncommitted
+    # changes without unpushed commits are just artifacts)
     try:
-        result = subprocess.run(
+        subprocess.run(
             ["git", "worktree", "remove", wt_path, "--force"],
             capture_output=True, text=True, timeout=15, cwd=repo_root,
         )
-        removed = result.returncode == 0
-        if not removed:
-            logger.debug(
-                "Failed to remove worktree %s: %s", wt_path, result.stderr.strip()
-            )
     except Exception as e:
         logger.debug("Failed to remove worktree: %s", e)
 
-    if not removed:
-        # Removal failed — keep the branch so the commits stay reachable.
-        print(f"\033[33m⚠ Could not remove worktree, keeping it (and branch "
-              f"{branch}): {wt_path}\033[0m")
-        _active_worktree = None
-        return
-
-    # Delete the branch only now that the worktree is actually gone.
+    # Delete the branch
     try:
         subprocess.run(
             ["git", "branch", "-D", branch],
@@ -1635,14 +1517,10 @@ def _run_checkpoint_auto_maintenance() -> None:
 def _prune_stale_worktrees(repo_root: str, max_age_hours: int = 24) -> None:
     """Remove stale worktrees and orphaned branches on startup.
 
-    Pruning may only ever delete clean, unlocked, fully-pushed worktrees:
+    Age-based tiers:
     - Under max_age_hours (24h): skip — session may still be active.
-    - Locked (a live or crashed hermes session): skip at ANY age.
-    - Dirty working tree (uncommitted changes): skip at ANY age.
-    - Unpushed commits: skip at ANY age.
-
-    The branch is only deleted after ``git worktree remove`` actually
-    succeeded, so commits never lose their easy reachability.
+    - 24h–72h: remove if no unpushed commits.
+    - Over 72h: force remove regardless (nothing should sit this long).
 
     Also prunes orphaned ``hermes/*`` and ``pr-*`` local branches that
     have no corresponding worktree.
@@ -1657,6 +1535,7 @@ def _prune_stale_worktrees(repo_root: str, max_age_hours: int = 24) -> None:
 
     now = time.time()
     soft_cutoff = now - (max_age_hours * 3600)       # 24h default
+    hard_cutoff = now - (max_age_hours * 3 * 3600)   # 72h default
 
     for entry in worktrees_dir.iterdir():
         if not entry.is_dir() or not entry.name.startswith("hermes-"):
@@ -1670,22 +1549,14 @@ def _prune_stale_worktrees(repo_root: str, max_age_hours: int = 24) -> None:
         except Exception:
             continue
 
-        # A lock means a session (live, or crashed mid-work) owns this
-        # worktree — never touch it, regardless of age.
-        if _worktree_is_locked(repo_root, str(entry)):
-            logger.debug("Skipping locked worktree: %s", entry.name)
-            continue
+        force = mtime <= hard_cutoff  # Over 72h — force remove
 
-        # Uncommitted changes may be work the user hasn't retrieved.
-        if _worktree_is_dirty(str(entry)):
-            logger.debug("Skipping dirty worktree: %s", entry.name)
-            continue
+        if not force:
+            # 24h–72h tier: only remove if no unpushed commits
+            if _worktree_has_unpushed_commits(str(entry), timeout=5):
+                continue  # Has unpushed commits or can't check — skip
 
-        # Unpushed commits are definitely work — keep at any age.
-        if _worktree_has_unpushed_commits(str(entry), timeout=5):
-            continue
-
-        # Safe to remove: clean, unlocked, fully pushed.
+        # Safe to remove
         try:
             branch_result = subprocess.run(
                 ["git", "branch", "--show-current"],
@@ -1693,24 +1564,16 @@ def _prune_stale_worktrees(repo_root: str, max_age_hours: int = 24) -> None:
             )
             branch = branch_result.stdout.strip()
 
-            remove_result = subprocess.run(
+            subprocess.run(
                 ["git", "worktree", "remove", str(entry), "--force"],
                 capture_output=True, text=True, timeout=15, cwd=repo_root,
             )
-            if remove_result.returncode != 0:
-                # Removal failed — keep the branch so the commits stay
-                # reachable.
-                logger.debug(
-                    "Failed to remove worktree %s: %s",
-                    entry.name, remove_result.stderr.strip(),
-                )
-                continue
             if branch:
                 subprocess.run(
                     ["git", "branch", "-D", branch],
                     capture_output=True, text=True, timeout=10, cwd=repo_root,
                 )
-            logger.debug("Pruned stale worktree: %s", entry.name)
+            logger.debug("Pruned stale worktree: %s (force=%s)", entry.name, force)
         except Exception as e:
             logger.debug("Failed to prune worktree %s: %s", entry.name, e)
 

gateway/platforms/base.py

@@ -77,13 +77,6 @@ def _thread_metadata_for_source(source, reply_to_message_id: str | None = None)
     return metadata
 
 
-def _mark_notify_metadata(metadata: dict | None) -> dict:
-    """Clone metadata and mark a user-visible reply as notify-worthy."""
-    notify_metadata = dict(metadata) if metadata else {}
-    notify_metadata["notify"] = True
-    return notify_metadata
-
-
 def _reply_anchor_for_event(event) -> str | None:
     """Return reply_to id for platforms that need reply semantics.
 
@@ -3896,7 +3889,7 @@ class BasePlatformAdapter(ABC):
                     chat_id=event.source.chat_id,
                     content=_text,
                     reply_to=_reply_anchor_for_event(event),
-                    metadata=_mark_notify_metadata(thread_meta),
+                    metadata=thread_meta,
                 )
                 if _eph_ttl > 0 and _r.success and _r.message_id:
                     self._schedule_ephemeral_delete(
@@ -4002,7 +3995,7 @@ class BasePlatformAdapter(ABC):
                             chat_id=event.source.chat_id,
                             content=_text,
                             reply_to=_reply_anchor_for_event(event),
-                            metadata=_mark_notify_metadata(_thread_meta),
+                            metadata=_thread_meta,
                         )
                         if _eph_ttl > 0 and _r.success and _r.message_id:
                             self._schedule_ephemeral_delete(
@@ -4052,7 +4045,7 @@ class BasePlatformAdapter(ABC):
                                 chat_id=event.source.chat_id,
                                 content=_text,
                                 reply_to=_reply_anchor_for_event(event),
-                                metadata=_mark_notify_metadata(_thread_meta),
+                                metadata=_thread_meta,
                             )
                             if _eph_ttl > 0 and _r.success and _r.message_id:
                                 self._schedule_ephemeral_delete(
@@ -4275,12 +4268,6 @@ class BasePlatformAdapter(ABC):
                         )
                         text_content = _recovered
 
-                # Final user-visible content (text, TTS, media, files) gets
-                # the existing notify=True marker. Clone once so typing/status
-                # metadata stays unmarked and progress bubbles remain
-                # thread-strict.
-                _final_thread_metadata = _mark_notify_metadata(_thread_metadata)
-
                 # Auto-TTS: if voice message, generate audio FIRST (before sending text)
                 # Gated via ``_should_auto_tts_for_chat``: fires when the chat has
                 # an explicit ``/voice on|tts`` opt-in OR when ``voice.auto_tts`` is
@@ -4320,7 +4307,7 @@ class BasePlatformAdapter(ABC):
                             chat_id=event.source.chat_id,
                             audio_path=_tts_path,
                             caption=telegram_tts_caption,
-                            metadata=_final_thread_metadata,
+                            metadata=_thread_metadata,
                         )
                         _tts_caption_delivered = bool(
                             telegram_tts_caption and getattr(tts_result, "success", False)
@@ -4335,11 +4322,23 @@ class BasePlatformAdapter(ABC):
                 if text_content and not _tts_caption_delivered:
                     logger.info("[%s] Sending response (%d chars) to %s", self.name, len(text_content), event.source.chat_id)
                     _reply_anchor = _reply_anchor_for_event(event)
+                    # Mark final response messages for notification delivery.
+                    # Platform adapters that support per-message notification
+                    # control (e.g. Telegram's disable_notification) use this
+                    # flag to override silent-mode and ensure the final
+                    # response triggers a push notification.
+                    # Clone to avoid mutating the metadata shared with the
+                    # typing-indicator task (which must remain unmarked).
+                    if _thread_metadata is not None:
+                        _thread_metadata = dict(_thread_metadata)
+                        _thread_metadata["notify"] = True
+                    else:
+                        _thread_metadata = {"notify": True}
                     result = await self._send_with_retry(
                         chat_id=event.source.chat_id,
                         content=text_content,
                         reply_to=_reply_anchor,
-                        metadata=_final_thread_metadata,
+                        metadata=_thread_metadata,
                     )
                     _record_delivery(result)
 
@@ -4368,7 +4367,7 @@ class BasePlatformAdapter(ABC):
                         await self.send_multiple_images(
                             chat_id=event.source.chat_id,
                             images=images,
-                            metadata=_final_thread_metadata,
+                            metadata=_thread_metadata,
                             human_delay=human_delay,
                         )
                     except Exception as batch_err:
@@ -4410,7 +4409,7 @@ class BasePlatformAdapter(ABC):
                         await self.send_multiple_images(
                             chat_id=event.source.chat_id,
                             images=_batch,
-                            metadata=_final_thread_metadata,
+                            metadata=_thread_metadata,
                             human_delay=human_delay,
                         )
                     except Exception as batch_err:
@@ -4425,19 +4424,19 @@ class BasePlatformAdapter(ABC):
                             media_result = await self.send_voice(
                                 chat_id=event.source.chat_id,
                                 audio_path=media_path,
-                                metadata=_final_thread_metadata,
+                                metadata=_thread_metadata,
                             )
                         elif ext in _VIDEO_EXTS:
                             media_result = await self.send_video(
                                 chat_id=event.source.chat_id,
                                 video_path=media_path,
-                                metadata=_final_thread_metadata,
+                                metadata=_thread_metadata,
                             )
                         else:
                             media_result = await self.send_document(
                                 chat_id=event.source.chat_id,
                                 file_path=media_path,
-                                metadata=_final_thread_metadata,
+                                metadata=_thread_metadata,
                             )
 
                         if not media_result.success:
@@ -4455,13 +4454,13 @@ class BasePlatformAdapter(ABC):
                             await self.send_video(
                                 chat_id=event.source.chat_id,
                                 video_path=file_path,
-                                metadata=_final_thread_metadata,
+                                metadata=_thread_metadata,
                             )
                         else:
                             await self.send_document(
                                 chat_id=event.source.chat_id,
                                 file_path=file_path,
-                                metadata=_final_thread_metadata,
+                                metadata=_thread_metadata,
                             )
                     except Exception as file_err:
                         logger.error("[%s] Error sending local file %s: %s", self.name, file_path, file_err)

gateway/platforms/email.py

@@ -678,13 +678,8 @@ class EmailAdapter(BasePlatformAdapter):
         image_url: str,
         caption: Optional[str] = None,
         reply_to: Optional[str] = None,
-        metadata: Optional[Dict[str, Any]] = None,
     ) -> SendResult:
-        """Send an image URL as part of an email body.
-
-        ``metadata`` is accepted to honor the base-class contract; the
-        email body send doesn't use it.
-        """
+        """Send an image URL as part of an email body."""
         text = caption or ""
         text += f"\n\nImage: {image_url}"
         return await self.send(chat_id, text.strip(), reply_to)

gateway/platforms/whatsapp.py

@@ -846,20 +846,13 @@ class WhatsAppAdapter(WhatsAppBehaviorMixin, BasePlatformAdapter):
         image_url: str,
         caption: Optional[str] = None,
         reply_to: Optional[str] = None,
-        metadata: Optional[Dict[str, Any]] = None,
     ) -> SendResult:
-        """Download image URL to cache, send natively via bridge.
-
-        ``metadata`` is accepted to honor the base-class contract — the
-        batch sender ``send_multiple_images`` passes it through to every
-        send path. The bridge media call doesn't use it, matching the
-        sibling overrides (send_video / send_voice / send_document).
-        """
+        """Download image URL to cache, send natively via bridge."""
         try:
             local_path = await cache_image_from_url(image_url)
             return await self._send_media_to_bridge(chat_id, local_path, "image", caption)
         except Exception:
-            return await super().send_image(chat_id, image_url, caption, reply_to, metadata)
+            return await super().send_image(chat_id, image_url, caption, reply_to)
 
     async def send_image_file(
         self,
@@ -1143,15 +1136,6 @@ class WhatsAppAdapter(WhatsAppBehaviorMixin, BasePlatformAdapter):
             body = data.get("body", "")
             if data.get("isGroup"):
                 body = self._clean_bot_mention_text(body, data)
-
-            # If this is a reply, include the quoted message text so the agent
-            # knows exactly what the user is responding to (fixes "approve" context issue)
-            quoted_text = str(data.get("quotedText") or "").strip()
-            if quoted_text and data.get("hasQuotedMessage"):
-                # Truncate long quoted text to keep prompts reasonable
-                if len(quoted_text) > 300:
-                    quoted_text = quoted_text[:297] + "..."
-                body = f"[Replying to: \"{quoted_text}\"]\n{body}"
             MAX_TEXT_INJECT_BYTES = 100 * 1024
             if msg_type == MessageType.DOCUMENT and cached_urls:
                 for doc_path in cached_urls:

gateway/run.py

@@ -413,57 +413,6 @@ def _resolve_progress_thread_id(platform: Any, source_thread_id: Any, event_mess
     return None
 
 
-def _has_platform_display_override(user_config: dict, platform_key: str, setting: str) -> bool:
-    """Return True when display.platforms.<platform> explicitly sets setting."""
-    display = user_config.get("display") if isinstance(user_config, dict) else None
-    if not isinstance(display, dict):
-        return False
-    platforms = display.get("platforms")
-    if not isinstance(platforms, dict):
-        return False
-    platform_cfg = platforms.get(platform_key)
-    return isinstance(platform_cfg, dict) and setting in platform_cfg
-
-
-def _resolve_gateway_display_bool(
-    user_config: dict,
-    platform_key: str,
-    setting: str,
-    *,
-    default: bool = False,
-    platform: Any = None,
-    require_platform_override_for: set[Any] | None = None,
-) -> bool:
-    """Resolve a boolean display setting with optional platform-only opt-in.
-
-    Some display features expose assistant scratch text rather than deliberate
-    user-facing output.  For high-noise threaded chat surfaces such as
-    Mattermost, a global opt-in is too broad: they must be enabled with an
-    explicit display.platforms.<platform>.<setting> override.
-    """
-    current_platform = _gateway_platform_value(platform or platform_key)
-    platform_only = {
-        _gateway_platform_value(candidate)
-        for candidate in (require_platform_override_for or set())
-    }
-    if (
-        current_platform in platform_only
-        and not _has_platform_display_override(user_config, platform_key, setting)
-    ):
-        return False
-
-    from gateway.display_config import resolve_display_setting
-
-    value = resolve_display_setting(user_config, platform_key, setting, default)
-    if isinstance(value, bool):
-        return value
-    if isinstance(value, str):
-        return value.strip().lower() in {"true", "yes", "1", "on"}
-    if value is None:
-        return bool(default)
-    return bool(value)
-
-
 def _telegramize_command_mentions(text: str, platform: Any) -> str:
     """Rewrite slash-command mentions to Telegram-valid command names.
 
@@ -9040,24 +8989,17 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                     source, session_entry, reason="agent-result-compression",
                 )
 
-            # Prepend reasoning/thinking if display is enabled (per-platform).
-            # Mattermost requires explicit per-platform opt-in because this is
-            # scratch text, not ordinary final-answer content.
+            # Prepend reasoning/thinking if display is enabled (per-platform)
             try:
-                _show_reasoning_effective = _resolve_gateway_display_bool(
+                from gateway.display_config import resolve_display_setting as _rds
+                _show_reasoning_effective = _rds(
                     _load_gateway_config(),
                     _platform_config_key(source.platform),
                     "show_reasoning",
-                    default=bool(getattr(self, "_show_reasoning", False)),
-                    platform=source.platform,
-                    require_platform_override_for={Platform.MATTERMOST},
+                    getattr(self, "_show_reasoning", False),
                 )
             except Exception:
-                _show_reasoning_effective = (
-                    False
-                    if source.platform == Platform.MATTERMOST
-                    else getattr(self, "_show_reasoning", False)
-                )
+                _show_reasoning_effective = getattr(self, "_show_reasoning", False)
             if _show_reasoning_effective and response and not _intentional_silence:
                 last_reasoning = agent_result.get("last_reasoning")
                 if last_reasoning:
@@ -13693,32 +13635,18 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
         # in chat platforms while opting into concise mid-turn updates.
         interim_assistant_messages_enabled = (
             source.platform != Platform.WEBHOOK
-            and _resolve_gateway_display_bool(
-                user_config,
-                platform_key,
-                "interim_assistant_messages",
-                default=True,
-                platform=source.platform,
-                require_platform_override_for={Platform.MATTERMOST},
+            and bool(
+                resolve_display_setting(
+                    user_config,
+                    platform_key,
+                    "interim_assistant_messages",
+                    True,
+                )
             )
         )
-        # thinking_progress is independent — if enabled, we need the progress
-        # queue even when tool_progress is off (thinking relay uses same infra).
-        # Mattermost requires a per-platform opt-in: global scratch-text display
-        # is too easy to leak into busy public threads.
-        _thinking_enabled = _resolve_gateway_display_bool(
-            user_config,
-            platform_key,
-            "thinking_progress",
-            default=False,
-            platform=source.platform,
-            require_platform_override_for={Platform.MATTERMOST},
-        )
-        needs_progress_queue = tool_progress_enabled or _thinking_enabled
-
-
+        
         # Queue for progress messages (thread-safe)
-        progress_queue = queue.Queue() if needs_progress_queue else None
+        progress_queue = queue.Queue() if tool_progress_enabled else None
         last_tool = [None]  # Mutable container for tracking in closure
         last_progress_msg = [None]  # Track last message for dedup
         repeat_count = [0]  # How many times the same message repeated
@@ -13824,24 +13752,6 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                     logger.debug("tool-progress onboarding hint failed: %s", _hint_err)
                 return
 
-            # "_thinking" is assistant scratch text between tool calls.  It
-            # is never ordinary tool progress: only relay it when the platform
-            # explicitly opted into thinking_progress.  Handle both legacy
-            # callback shapes: ("_thinking", text) and
-            # ("reasoning.available", "_thinking", text, ...).
-            if event_type == "_thinking" or tool_name == "_thinking":
-                if not _thinking_enabled:
-                    return
-                thinking_text = preview if tool_name == "_thinking" else tool_name
-                msg = f"💬 {thinking_text}" if thinking_text else None
-                if msg:
-                    progress_queue.put(msg)
-                return
-
-            # If tool_progress is off, only _thinking passes through (above).
-            # Regular tool calls are suppressed.
-            if not tool_progress_enabled:
-                return
 
             # Only act on tool.started events (ignore tool.completed, reasoning.available, etc.)
             if event_type not in {"tool.started",}:
@@ -14873,10 +14783,6 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
 
             agent.clarify_callback = _clarify_callback_sync
 
-            # Show assistant thinking between tool calls — independent of
-            # tool_progress mode. Mattermost needs an explicit per-platform
-            # opt-in so global scratch-text display does not leak into threads.
-            agent.thinking_progress = _thinking_enabled
             # Store agent reference for interrupt support
             agent_holder[0] = agent
             # Capture the full tool definitions for transcript logging

gateway/stream_consumer.py

@@ -197,30 +197,6 @@ class GatewayStreamConsumer:
         # this response and route through edit-based for graceful degradation.
         self._draft_failures = 0
 
-    def _metadata_for_send(
-        self,
-        *,
-        final: bool = False,
-        expect_edits: bool = False,
-    ) -> dict | None:
-        """Return per-send metadata for stream-created messages.
-
-        Mattermost treats notify-worthy sends as user-visible final content
-        when deciding whether a broken thread root may fall back flat.  Preview
-        and progress sends keep their original metadata and remain thread-strict.
-
-        ``expect_edits`` preserves the upstream Telegram streaming contract:
-        preview messages that may be edited later must stay on the editable
-        legacy send path, while fresh/fallback final sends can still use richer
-        final-message delivery.
-        """
-        meta = dict(self.metadata) if self.metadata else {}
-        if expect_edits:
-            meta["expect_edits"] = True
-        if final:
-            meta["notify"] = True
-        return meta or None
-
     @property
     def already_sent(self) -> bool:
         """True if at least one message was sent or edited during the run."""
@@ -537,11 +513,7 @@ class GatewayStreamConsumer:
                         chunks_delivered = False
                         reply_to = self._message_id or self._initial_reply_to_id
                         for chunk in chunks:
-                            new_id = await self._send_new_chunk(
-                                chunk,
-                                reply_to,
-                                final=got_done,
-                            )
+                            new_id = await self._send_new_chunk(chunk, reply_to)
                             if new_id is not None and new_id != reply_to:
                                 chunks_delivered = True
                         self._accumulated = ""
@@ -777,13 +749,7 @@ class GatewayStreamConsumer:
         # Strip trailing whitespace/newlines but preserve leading content
         return cleaned.rstrip()
 
-    async def _send_new_chunk(
-        self,
-        text: str,
-        reply_to_id: Optional[str],
-        *,
-        final: bool = False,
-    ) -> Optional[str]:
+    async def _send_new_chunk(self, text: str, reply_to_id: Optional[str]) -> Optional[str]:
         """Send a new message chunk, optionally threaded to a previous message.
 
         Returns the message_id so callers can thread subsequent chunks.
@@ -792,11 +758,15 @@ class GatewayStreamConsumer:
         if not text.strip():
             return reply_to_id
         try:
+            meta = dict(self.metadata) if self.metadata else {}
+            # This chunk becomes the next edit target — adapters that support
+            # rich final sends (Telegram) must keep it on the editable path.
+            meta["expect_edits"] = True
             result = await self.adapter.send(
                 chat_id=self.chat_id,
                 content=text,
                 reply_to=reply_to_id,
-                metadata=self._metadata_for_send(final=final, expect_edits=True),
+                metadata=meta,
             )
             if result.success and result.message_id:
                 self._message_id = str(result.message_id)
@@ -915,7 +885,7 @@ class GatewayStreamConsumer:
                 result = await self.adapter.send(
                     chat_id=self.chat_id,
                     content=chunk,
-                    metadata=self._metadata_for_send(final=True),
+                    metadata=self.metadata,
                 )
                 if result.success:
                     break
@@ -1272,7 +1242,7 @@ class GatewayStreamConsumer:
             result = await self.adapter.send(
                 chat_id=self.chat_id,
                 content=text,
-                metadata=self._metadata_for_send(final=True),
+                metadata=self.metadata,
             )
         except Exception as e:
             logger.debug("Fresh-final send failed, falling back to edit: %s", e)
@@ -1562,10 +1532,7 @@ class GatewayStreamConsumer:
                     chat_id=self.chat_id,
                     content=text,
                     reply_to=self._initial_reply_to_id,
-                    metadata=self._metadata_for_send(
-                        final=finalize,
-                        expect_edits=True,
-                    ),
+                    metadata={**(self.metadata or {}), "expect_edits": True},
                 )
                 if result.success:
                     if result.message_id:

scripts/release.py

@@ -90,7 +90,6 @@ AUTHOR_MAP = {
     "290859878+synapsesx@users.noreply.github.com": "synapsesx",
     "157689911+itsflownium@users.noreply.github.com": "itsflownium",
     "dirtyren@users.noreply.github.com": "dirtyren",
-    "evansrory@gmail.com": "zimigit2020",
     "237263164+ft-ioxcs@users.noreply.github.com": "ft-ioxcs",
     "tharushkadinujaya05@gmail.com": "0xneobyte",
     "138671361+Veritas-7@users.noreply.github.com": "Veritas-7",

tests/agent/test_auxiliary_client.py

@@ -1653,37 +1653,6 @@ class TestAuxiliaryFallbackLayering:
         exc.status_code = 402
         return exc
 
-    def test_auto_provider_uses_task_then_main_chain_before_builtin_chain(self, monkeypatch):
-        """Auto aux call failures try per-task then top-level fallback before built-ins."""
-        primary_client = MagicMock()
-        primary_client.chat.completions.create.side_effect = self._make_payment_err()
-
-        main_chain_client = MagicMock()
-        main_chain_client.chat.completions.create.return_value = MagicMock(choices=[
-            MagicMock(message=MagicMock(content="from main fallback chain"))
-        ])
-
-        with patch("agent.auxiliary_client._get_cached_client",
-                   return_value=(primary_client, "qwen/qwen3.5-122b-a10b")), \
-             patch("agent.auxiliary_client._resolve_task_provider_model",
-                   return_value=("auto", None, None, None, None)), \
-             patch("agent.auxiliary_client._try_configured_fallback_chain",
-                   return_value=(None, None, "")) as mock_task_chain, \
-             patch("agent.auxiliary_client._try_main_fallback_chain",
-                   return_value=(main_chain_client, "inclusionai/ring-2.6-1t:free", "openrouter")) as mock_main_chain, \
-             patch("agent.auxiliary_client._try_payment_fallback") as mock_builtin_chain:
-            result = call_llm(
-                task="title_generation",
-                messages=[{"role": "user", "content": "hello"}],
-            )
-
-        assert main_chain_client.chat.completions.create.called
-        mock_task_chain.assert_called_once_with(
-            "title_generation", "auto", reason="payment error")
-        mock_main_chain.assert_called_once_with(
-            "title_generation", "auto", reason="payment error")
-        mock_builtin_chain.assert_not_called()
-
     def test_explicit_provider_uses_configured_chain_first(self, monkeypatch, caplog):
         """When a user has fallback_chain configured, it's tried BEFORE the main agent model."""
         monkeypatch.setenv("OPENROUTER_API_KEY", "or-key")

tests/agent/test_auxiliary_main_first.py

@@ -118,64 +118,6 @@ class TestResolveAutoMainFirst:
         assert client is chain_client
         assert model == "google/gemini-3-flash-preview"
 
-    def test_main_unavailable_uses_task_fallback_chain_before_builtin_chain(self):
-        """Auto aux resolution honors auxiliary.<task>.fallback_chain before built-ins."""
-        task_client = MagicMock()
-        with patch(
-            "agent.auxiliary_client._read_main_provider", return_value="nvidia",
-        ), patch(
-            "agent.auxiliary_client._read_main_model", return_value="qwen/qwen3.5-122b-a10b",
-        ), patch(
-            "agent.auxiliary_client.resolve_provider_client",
-            return_value=(None, None),  # main provider has no client
-        ), patch(
-            "agent.auxiliary_client._try_configured_fallback_chain",
-            return_value=(task_client, "task-free-model", "fallback_chain[0](openrouter)"),
-        ) as mock_task_chain, patch(
-            "agent.auxiliary_client._try_main_fallback_chain",
-        ) as mock_main_chain, patch(
-            "agent.auxiliary_client._try_openrouter",
-        ) as mock_openrouter:
-            from agent.auxiliary_client import _resolve_auto
-
-            client, model = _resolve_auto(task="title_generation")
-
-        assert client is task_client
-        assert model == "task-free-model"
-        mock_task_chain.assert_called_once_with(
-            "title_generation", "nvidia", reason="main provider unavailable")
-        mock_main_chain.assert_not_called()
-        mock_openrouter.assert_not_called()
-
-    def test_main_unavailable_uses_main_fallback_chain_before_builtin_chain(self):
-        """Auto aux resolution honors top-level fallback_providers before built-ins."""
-        main_fallback_client = MagicMock()
-        with patch(
-            "agent.auxiliary_client._read_main_provider", return_value="nvidia",
-        ), patch(
-            "agent.auxiliary_client._read_main_model", return_value="qwen/qwen3.5-122b-a10b",
-        ), patch(
-            "agent.auxiliary_client.resolve_provider_client",
-            return_value=(None, None),  # main provider has no client
-        ), patch(
-            "agent.auxiliary_client._try_configured_fallback_chain",
-            return_value=(None, None, ""),
-        ), patch(
-            "agent.auxiliary_client._try_main_fallback_chain",
-            return_value=(main_fallback_client, "inclusionai/ring-2.6-1t:free", "openrouter"),
-        ) as mock_main_chain, patch(
-            "agent.auxiliary_client._try_openrouter",
-        ) as mock_openrouter:
-            from agent.auxiliary_client import _resolve_auto
-
-            client, model = _resolve_auto(task="title_generation")
-
-        assert client is main_fallback_client
-        assert model == "inclusionai/ring-2.6-1t:free"
-        mock_main_chain.assert_called_once_with(
-            "title_generation", "nvidia", reason="main provider unavailable")
-        mock_openrouter.assert_not_called()
-
     def test_no_main_config_uses_chain_directly(self):
         """No main provider configured → skip step 1, use chain (no regression)."""
         chain_client = MagicMock()

tests/cli/test_worktree.py

@@ -162,26 +162,11 @@ def _has_unpushed_commits(worktree_path, timeout=10):
         return True
 
 
-def _is_dirty(wt_path, timeout=10):
-    """Test version of the worktree dirty-check helper (fail-safe True)."""
-    try:
-        result = subprocess.run(
-            ["git", "status", "--porcelain"],
-            capture_output=True, text=True, timeout=timeout, cwd=wt_path,
-        )
-        if result.returncode != 0:
-            return True
-        return bool(result.stdout.strip())
-    except Exception:
-        return True
-
-
 def _cleanup_worktree(info):
     """Test version of _cleanup_worktree.
 
-    Mirrors the cli.py contract: preserves the worktree if it has
-    unpushed commits OR uncommitted changes; only deletes the branch
-    after ``git worktree remove`` succeeded.
+    Preserves the worktree only if it has unpushed commits.
+    Dirty working tree alone is not enough to keep it.
     """
     wt_path = info["path"]
     branch = info["branch"]
@@ -193,16 +178,10 @@ def _cleanup_worktree(info):
     if _has_unpushed_commits(wt_path, timeout=10):
         return False  # Did not clean up — has unpushed commits
 
-    if _is_dirty(wt_path):
-        return False  # Did not clean up — uncommitted changes
-
-    result = subprocess.run(
+    subprocess.run(
         ["git", "worktree", "remove", wt_path, "--force"],
         capture_output=True, text=True, timeout=15, cwd=repo_root,
     )
-    if result.returncode != 0:
-        return False  # Removal failed — keep the branch
-
     subprocess.run(
         ["git", "branch", "-D", branch],
         capture_output=True, text=True, timeout=10, cwd=repo_root,
@@ -304,18 +283,17 @@ class TestWorktreeCleanup:
         assert result is True
         assert not Path(info["path"]).exists()
 
-    def test_dirty_worktree_preserved_on_cleanup(self, git_repo):
-        """Dirty working tree is preserved even without unpushed commits.
+    def test_dirty_worktree_cleaned_when_no_unpushed(self, git_repo):
+        """Dirty working tree without unpushed commits is cleaned up.
 
-        Uncommitted changes may be work the user has not retrieved yet —
-        cleanup must never destroy them.
+        Agent sessions typically leave untracked files / artifacts behind.
+        Since all real work is in pushed commits, these don't warrant
+        keeping the worktree.
         """
-        import cli as cli_mod
-
-        info = cli_mod._setup_worktree(str(git_repo))
+        info = _setup_worktree(str(git_repo))
         assert info is not None
 
-        # Make uncommitted changes (staged but uncommitted file)
+        # Make uncommitted changes (untracked file)
         (Path(info["path"]) / "new-file.txt").write_text("uncommitted")
         subprocess.run(
             ["git", "add", "new-file.txt"],
@@ -323,17 +301,10 @@ class TestWorktreeCleanup:
         )
 
         # The git_repo fixture already has a fake remote ref so the initial
-        # commit is seen as "pushed" — only the dirty tree protects it.
-        cli_mod._cleanup_worktree(info)
-        assert Path(info["path"]).exists()  # Preserved despite no unpushed commits
-
-        # Branch and lock are kept too
-        result = subprocess.run(
-            ["git", "branch", "--list", info["branch"]],
-            capture_output=True, text=True, cwd=str(git_repo),
-        )
-        assert info["branch"] in result.stdout
-        assert cli_mod._worktree_is_locked(str(git_repo), info["path"]) is True
+        # commit is seen as "pushed".  No unpushed commits → cleanup proceeds.
+        result = _cleanup_worktree(info)
+        assert result is True  # Cleaned up despite dirty working tree
+        assert not Path(info["path"]).exists()
 
     def test_worktree_with_unpushed_commits_kept(self, git_repo):
         """Worktree with unpushed commits is preserved."""
@@ -757,224 +728,47 @@ class TestStaleWorktreePruning:
         assert not Path(info["path"]).exists()
 
     def test_force_prunes_very_old_worktree(self, git_repo):
-        """Very old (>72h) CLEAN, unlocked, fully-pushed worktrees are pruned."""
+        """Worktrees older than 72h should be force-pruned regardless."""
         import time
-        import cli as cli_mod
 
-        info = cli_mod._setup_worktree(str(git_repo))
+        info = _setup_worktree(str(git_repo))
         assert info is not None
 
-        # _setup_worktree locks the worktree; unlock to simulate a worktree
-        # whose owning session released it (clean + unlocked + pushed).
-        assert cli_mod._unlock_worktree(str(git_repo), info["path"]) is True
-
-        # Make it very old (73h)
-        old_time = time.time() - (73 * 3600)
-        os.utime(info["path"], (old_time, old_time))
-
-        cli_mod._prune_stale_worktrees(str(git_repo))
-
-        assert not Path(info["path"]).exists()
-        # Branch should be gone too
-        result = subprocess.run(
-            ["git", "branch", "--list", info["branch"]],
-            capture_output=True, text=True, cwd=str(git_repo),
-        )
-        assert info["branch"] not in result.stdout
-
-
-class TestWorktreeLocking:
-    """Test git-native worktree locks and the preserve-work contracts.
-
-    These tests exercise the REAL cli.py implementations (not the local
-    reimplementations above), matching the pattern in
-    test_worktree_security.py.
-    """
-
-    def test_setup_worktree_locks(self, git_repo):
-        """_setup_worktree leaves the new worktree locked."""
-        import cli as cli_mod
-
-        info = cli_mod._setup_worktree(str(git_repo))
-        assert info is not None
-
-        # Verify via git worktree list --porcelain: the stanza for this
-        # worktree must contain a "locked" line.
-        result = subprocess.run(
-            ["git", "worktree", "list", "--porcelain"],
-            capture_output=True, text=True, cwd=str(git_repo),
-        )
-        target = Path(info["path"]).resolve()
-        current = None
-        locked = False
-        for line in result.stdout.splitlines():
-            if line.startswith("worktree "):
-                current = Path(line[len("worktree "):].strip()).resolve()
-            elif line == "locked" or line.startswith("locked "):
-                if current == target:
-                    locked = True
-        assert locked
-        assert cli_mod._worktree_is_locked(str(git_repo), info["path"]) is True
-
-    def test_unlock_worktree(self, git_repo):
-        """_unlock_worktree releases the lock taken by _setup_worktree."""
-        import cli as cli_mod
-
-        info = cli_mod._setup_worktree(str(git_repo))
-        assert info is not None
-        assert cli_mod._worktree_is_locked(str(git_repo), info["path"]) is True
-
-        assert cli_mod._unlock_worktree(str(git_repo), info["path"]) is True
-        assert cli_mod._worktree_is_locked(str(git_repo), info["path"]) is False
-
-    def test_prune_skips_locked_very_old_clean_worktree(self, git_repo):
-        """A locked worktree is never pruned, even >72h old and clean."""
-        import time
-        import cli as cli_mod
-
-        info = cli_mod._setup_worktree(str(git_repo))
-        assert info is not None
-        # Still locked from _setup_worktree; clean; fully pushed.
-
-        old_time = time.time() - (80 * 3600)
-        os.utime(info["path"], (old_time, old_time))
-
-        cli_mod._prune_stale_worktrees(str(git_repo))
-
-        assert Path(info["path"]).exists()
-
-    def test_prune_skips_old_dirty_unlocked_worktree(self, git_repo):
-        """An old dirty worktree is not pruned even when unlocked."""
-        import time
-        import cli as cli_mod
-
-        info = cli_mod._setup_worktree(str(git_repo))
-        assert info is not None
-        assert cli_mod._unlock_worktree(str(git_repo), info["path"]) is True
-
-        # Uncommitted change (untracked file)
-        (Path(info["path"]) / "wip.txt").write_text("uncommitted work")
-
-        old_time = time.time() - (25 * 3600)
-        os.utime(info["path"], (old_time, old_time))
-
-        cli_mod._prune_stale_worktrees(str(git_repo))
-
-        assert Path(info["path"]).exists()
-        assert (Path(info["path"]) / "wip.txt").exists()
-
-    def test_prune_preserves_very_old_worktree_with_unpushed_commits(self, git_repo):
-        """Unpushed commits protect a worktree at ANY age — the old >72h
-        force-remove tier is gone."""
-        import time
-        import cli as cli_mod
-
-        info = cli_mod._setup_worktree(str(git_repo))
-        assert info is not None
-        assert cli_mod._unlock_worktree(str(git_repo), info["path"]) is True
-
-        # Unpushed commit (clean tree afterwards)
-        (Path(info["path"]) / "work.txt").write_text("real work")
+        # Make an unpushed commit (would normally protect it)
+        (Path(info["path"]) / "work.txt").write_text("stale work")
         subprocess.run(["git", "add", "work.txt"], cwd=info["path"], capture_output=True)
         subprocess.run(
-            ["git", "commit", "-m", "agent work"],
+            ["git", "commit", "-m", "old agent work"],
             cwd=info["path"], capture_output=True,
         )
 
-        old_time = time.time() - (80 * 3600)
+        # Make it very old (73h — beyond the 72h hard threshold)
+        old_time = time.time() - (73 * 3600)
         os.utime(info["path"], (old_time, old_time))
 
-        cli_mod._prune_stale_worktrees(str(git_repo))
+        # Simulate the force-prune tier check
+        hard_cutoff = time.time() - (72 * 3600)
+        mtime = Path(info["path"]).stat().st_mtime
+        assert mtime <= hard_cutoff  # Should qualify for force removal
 
-        assert Path(info["path"]).exists()
-        result = subprocess.run(
-            ["git", "branch", "--list", info["branch"]],
-            capture_output=True, text=True, cwd=str(git_repo),
+        # Actually remove it (simulates _prune_stale_worktrees force path)
+        branch_result = subprocess.run(
+            ["git", "branch", "--show-current"],
+            capture_output=True, text=True, timeout=5, cwd=info["path"],
         )
-        assert info["branch"] in result.stdout
+        branch = branch_result.stdout.strip()
 
-    def test_cleanup_preserves_dirty_worktree(self, git_repo):
-        """_cleanup_worktree keeps a dirty worktree (untracked file)."""
-        import cli as cli_mod
-
-        info = cli_mod._setup_worktree(str(git_repo))
-        assert info is not None
-
-        (Path(info["path"]) / "scratch.txt").write_text("not yet committed")
-
-        cli_mod._cleanup_worktree(info)
-
-        assert Path(info["path"]).exists()
-        assert (Path(info["path"]) / "scratch.txt").exists()
-
-    def test_cleanup_removes_clean_locked_worktree(self, git_repo):
-        """_cleanup_worktree unlocks then removes a clean, pushed worktree."""
-        import cli as cli_mod
-
-        info = cli_mod._setup_worktree(str(git_repo))
-        assert info is not None
-        assert cli_mod._worktree_is_locked(str(git_repo), info["path"]) is True
-
-        cli_mod._cleanup_worktree(info)
+        subprocess.run(
+            ["git", "worktree", "remove", info["path"], "--force"],
+            capture_output=True, text=True, timeout=15, cwd=str(git_repo),
+        )
+        if branch:
+            subprocess.run(
+                ["git", "branch", "-D", branch],
+                capture_output=True, text=True, timeout=10, cwd=str(git_repo),
+            )
 
         assert not Path(info["path"]).exists()
-        result = subprocess.run(
-            ["git", "branch", "--list", info["branch"]],
-            capture_output=True, text=True, cwd=str(git_repo),
-        )
-        assert info["branch"] not in result.stdout
-
-    def test_branch_kept_when_worktree_remove_fails(self, git_repo, monkeypatch):
-        """If `git worktree remove` fails, the branch must NOT be deleted."""
-        import subprocess as sp
-        import cli as cli_mod
-
-        info = cli_mod._setup_worktree(str(git_repo))
-        assert info is not None
-
-        real_run = sp.run
-
-        def fake_run(cmd, *args, **kwargs):
-            if (
-                isinstance(cmd, (list, tuple))
-                and list(cmd[:3]) == ["git", "worktree", "remove"]
-            ):
-                return sp.CompletedProcess(
-                    cmd, returncode=1, stdout="", stderr="simulated removal failure"
-                )
-            return real_run(cmd, *args, **kwargs)
-
-        monkeypatch.setattr(sp, "run", fake_run)
-
-        cli_mod._cleanup_worktree(info)
-
-        monkeypatch.undo()
-
-        # Worktree dir still present, branch NOT deleted
-        assert Path(info["path"]).exists()
-        result = subprocess.run(
-            ["git", "branch", "--list", info["branch"]],
-            capture_output=True, text=True, cwd=str(git_repo),
-        )
-        assert info["branch"] in result.stdout
-
-    def test_worktree_is_locked_fail_safe(self, tmp_path):
-        """_worktree_is_locked returns True (fail safe) on a bogus repo_root."""
-        import cli as cli_mod
-
-        bogus = tmp_path / "does-not-exist"
-        assert cli_mod._worktree_is_locked(str(bogus), str(bogus / "wt")) is True
-
-        # An existing directory that is not a git repo is also an error case
-        not_repo = tmp_path / "not-a-repo"
-        not_repo.mkdir()
-        assert cli_mod._worktree_is_locked(str(not_repo), str(not_repo / "wt")) is True
-
-    def test_worktree_is_dirty_fail_safe(self, tmp_path):
-        """_worktree_is_dirty returns True (fail safe) on a bogus path."""
-        import cli as cli_mod
-
-        assert cli_mod._worktree_is_dirty(str(tmp_path / "missing")) is True
 
 
 class TestEdgeCases:

tests/gateway/test_mattermost.py

@@ -6,10 +6,7 @@ import pytest
 from unittest.mock import MagicMock, patch, AsyncMock
 
 from gateway.config import Platform, PlatformConfig
-from gateway.run import (
-    _resolve_gateway_display_bool,
-    _resolve_progress_thread_id,
-)
+from gateway.run import _resolve_progress_thread_id
 
 
 class TestMattermostProgressThreadRouting:
@@ -35,97 +32,6 @@ class TestMattermostProgressThreadRouting:
         ) is None
 
 
-class TestMattermostDisplayHygiene:
-    def test_mattermost_requires_platform_opt_in_for_interim_assistant_messages(self):
-        """Global interim commentary must not make Mattermost leak scratch notes."""
-        user_config = {"display": {"interim_assistant_messages": True}}
-
-        assert _resolve_gateway_display_bool(
-            user_config,
-            "mattermost",
-            "interim_assistant_messages",
-            default=True,
-            platform=Platform.MATTERMOST,
-            require_platform_override_for={Platform.MATTERMOST},
-        ) is False
-
-    def test_mattermost_platform_opt_in_can_enable_interim_assistant_messages(self):
-        """Mattermost can still opt into commentary explicitly per platform."""
-        user_config = {
-            "display": {
-                "interim_assistant_messages": False,
-                "platforms": {
-                    "mattermost": {"interim_assistant_messages": True},
-                },
-            }
-        }
-
-        assert _resolve_gateway_display_bool(
-            user_config,
-            "mattermost",
-            "interim_assistant_messages",
-            default=True,
-            platform=Platform.MATTERMOST,
-            require_platform_override_for={Platform.MATTERMOST},
-        ) is True
-
-    def test_mattermost_requires_platform_opt_in_for_thinking_progress(self):
-        """Global thinking_progress must not surface internal analysis in Mattermost."""
-        user_config = {"display": {"thinking_progress": True}}
-
-        assert _resolve_gateway_display_bool(
-            user_config,
-            "mattermost",
-            "thinking_progress",
-            default=False,
-            platform=Platform.MATTERMOST,
-            require_platform_override_for={Platform.MATTERMOST},
-        ) is False
-
-    def test_mattermost_requires_platform_opt_in_for_show_reasoning(self):
-        """Global show_reasoning must not prepend scratch reasoning in Mattermost."""
-        user_config = {"display": {"show_reasoning": True}}
-
-        assert _resolve_gateway_display_bool(
-            user_config,
-            "mattermost",
-            "show_reasoning",
-            default=False,
-            platform=Platform.MATTERMOST,
-            require_platform_override_for={Platform.MATTERMOST},
-        ) is False
-
-    def test_mattermost_platform_opt_in_can_enable_show_reasoning(self):
-        user_config = {
-            "display": {
-                "show_reasoning": False,
-                "platforms": {"mattermost": {"show_reasoning": True}},
-            }
-        }
-
-        assert _resolve_gateway_display_bool(
-            user_config,
-            "mattermost",
-            "show_reasoning",
-            default=False,
-            platform=Platform.MATTERMOST,
-            require_platform_override_for={Platform.MATTERMOST},
-        ) is True
-
-    def test_global_thinking_progress_still_applies_to_other_platforms(self):
-        """The Mattermost guard must not silently neuter Telegram/other chats."""
-        user_config = {"display": {"thinking_progress": True}}
-
-        assert _resolve_gateway_display_bool(
-            user_config,
-            "telegram",
-            "thinking_progress",
-            default=False,
-            platform=Platform.TELEGRAM,
-            require_platform_override_for={Platform.MATTERMOST},
-        ) is True
-
-
 # ---------------------------------------------------------------------------
 # Platform & Config
 # ---------------------------------------------------------------------------
@@ -441,24 +347,6 @@ class TestMattermostSend:
         payload = self.adapter._api_post.call_args_list[0][0][1]
         assert payload["root_id"] == "root_post"
 
-    @pytest.mark.asyncio
-    async def test_progress_send_with_invalid_thread_root_never_falls_back_flat(self):
-        """Tool/status/progress bubbles must stay quiet when the thread is broken."""
-        self.adapter._reply_mode = "thread"
-        self.adapter._api_get = AsyncMock(return_value={"id": "bad_root", "root_id": ""})
-        self.adapter._api_post = AsyncMock(return_value={})
-
-        result = await self.adapter.send(
-            "channel_1",
-            "⚙️ terminal...",
-            metadata={"thread_id": "bad_root"},
-        )
-
-        assert result.success is False
-        assert self.adapter._api_post.call_count == 1
-        payload = self.adapter._api_post.call_args_list[0][0][1]
-        assert payload["root_id"] == "bad_root"
-
     @pytest.mark.asyncio
     async def test_send_api_failure(self):
         """When API returns error, send should return failure."""

tests/gateway/test_media_metadata_contract.py

@@ -1,80 +0,0 @@
-"""Contract: media-send overrides must accept the ``metadata`` kwarg.
-
-``BasePlatformAdapter.send_multiple_images`` passes ``metadata=metadata``
-to ``send_image`` / ``send_image_file`` / ``send_animation`` on every send.
-An override whose signature stops at ``reply_to`` raises ``TypeError:
-send_image() got an unexpected keyword argument 'metadata'`` at runtime —
-which is exactly how image delivery broke on WhatsApp and email.
-
-This mirrors ``test_discord_media_metadata.py`` but covers the two
-adapters that previously slipped, plus a best-effort sweep over every
-adapter that imports cleanly so the next slip is caught at test time.
-"""
-
-from __future__ import annotations
-
-import importlib
-import inspect
-
-import pytest
-
-
-def _accepts_metadata(method) -> bool:
-    params = inspect.signature(method).parameters
-    if "metadata" in params:
-        return True
-    # A ``**kwargs`` catch-all also absorbs metadata (the convention used by
-    # WhatsApp's send_video / send_voice / send_document overrides).
-    return any(p.kind is inspect.Parameter.VAR_KEYWORD for p in params.values())
-
-
-# (module, class) for the two adapters this fix targeted. These must import
-# in CI, so assert directly rather than skipping.
-@pytest.mark.parametrize(
-    "module_name, class_name",
-    [
-        ("gateway.platforms.whatsapp", "WhatsAppAdapter"),
-        ("gateway.platforms.email", "EmailAdapter"),
-    ],
-)
-def test_send_image_accepts_metadata(module_name, class_name):
-    cls = getattr(importlib.import_module(module_name), class_name)
-    assert _accepts_metadata(cls.send_image), (
-        f"{class_name}.send_image must accept 'metadata' (or **kwargs) — "
-        f"send_multiple_images passes it on every send"
-    )
-
-
-# Best-effort sweep across all shipped adapters. Modules whose optional
-# platform SDK isn't installed are skipped; an adapter that imports but
-# whose override drops metadata is a hard failure.
-_ALL_ADAPTERS = [
-    ("gateway.platforms.bluebubbles", "BlueBubblesAdapter"),
-    ("gateway.platforms.dingtalk", "DingTalkAdapter"),
-    ("gateway.platforms.discord", "DiscordAdapter"),
-    ("gateway.platforms.email", "EmailAdapter"),
-    ("gateway.platforms.feishu", "FeishuAdapter"),
-    ("gateway.platforms.matrix", "MatrixAdapter"),
-    ("gateway.platforms.mattermost", "MattermostAdapter"),
-    ("gateway.platforms.signal", "SignalAdapter"),
-    ("gateway.platforms.slack", "SlackAdapter"),
-    ("gateway.platforms.telegram", "TelegramAdapter"),
-    ("gateway.platforms.wecom", "WeComAdapter"),
-    ("gateway.platforms.weixin", "WeixinAdapter"),
-    ("gateway.platforms.whatsapp", "WhatsAppAdapter"),
-    ("gateway.platforms.yuanbao", "YuanbaoAdapter"),
-]
-
-
-@pytest.mark.parametrize("module_name, class_name", _ALL_ADAPTERS)
-def test_all_adapters_send_image_metadata_sweep(module_name, class_name):
-    try:
-        module = importlib.import_module(module_name)
-    except Exception as exc:  # optional platform dep not installed
-        pytest.skip(f"{module_name} not importable: {exc}")
-    cls = getattr(module, class_name, None)
-    if cls is None or "send_image" not in cls.__dict__:
-        pytest.skip(f"{class_name} has no send_image override")
-    assert _accepts_metadata(cls.send_image), (
-        f"{class_name}.send_image drops the 'metadata' kwarg"
-    )

tests/gateway/test_stream_consumer_thread_routing.py

@@ -106,42 +106,6 @@ class TestInitialReplyToId:
         assert call_kwargs["metadata"] == {**metadata, "expect_edits": True}
         assert metadata == {"thread_id": "omt_topic789"}
 
-    @pytest.mark.asyncio
-    async def test_final_first_send_marks_metadata_notify_true(self):
-        """Final streaming sends should use the existing notify=True marker."""
-        adapter = _make_adapter()
-        consumer = GatewayStreamConsumer(
-            adapter,
-            "chat_123",
-            metadata={"thread_id": "root_post_123"},
-            initial_reply_to_id="reply_post_456",
-        )
-
-        await consumer._send_or_edit("Final answer", finalize=True)
-
-        call_kwargs = adapter.send.call_args[1]
-        metadata = call_kwargs["metadata"]
-        assert metadata["thread_id"] == "root_post_123"
-        assert metadata["notify"] is True
-        assert "delivery_kind" not in metadata
-        assert "allow_flat_fallback" not in metadata
-
-    @pytest.mark.asyncio
-    async def test_nonfinal_first_send_does_not_mark_notify(self):
-        """Preview/interim streaming sends must not be notify-worthy."""
-        adapter = _make_adapter()
-        consumer = GatewayStreamConsumer(
-            adapter,
-            "chat_123",
-            metadata={"thread_id": "root_post_123"},
-            initial_reply_to_id="reply_post_456",
-        )
-
-        await consumer._send_or_edit("Preview", finalize=False)
-
-        metadata = adapter.send.call_args[1]["metadata"]
-        assert metadata == {"thread_id": "root_post_123", "expect_edits": True}
-
 
 class TestOverflowFirstMessage:
     """Verify thread routing is preserved when the first message overflows."""

tests/gateway/test_telegram_overflow_partial.py

@@ -134,7 +134,7 @@ async def test_stream_consumer_fallback_sends_tail_after_partial_overflow():
 
     adapter.send.assert_awaited_once()
     assert adapter.send.await_args.kwargs["content"] == "world"
-    assert adapter.send.await_args.kwargs["metadata"] == {"thread_id": "77", "notify": True}
+    assert adapter.send.await_args.kwargs["metadata"] == {"thread_id": "77"}
     adapter.delete_message.assert_not_awaited()
     assert consumer.final_response_sent is True
     assert consumer.final_content_delivered is True

tests/gateway/test_tts_media_routing.py

@@ -76,7 +76,7 @@ async def test_base_adapter_routes_telegram_flac_media_tag_to_document_sender(tm
     adapter.send_document.assert_awaited_once_with(
         chat_id="chat-1",
         file_path=str(media_file),
-        metadata={"notify": True},
+        metadata=None,
     )
     adapter.send_voice.assert_not_awaited()
 
@@ -95,7 +95,7 @@ async def test_base_adapter_routes_non_voice_telegram_ogg_media_tag_to_document_
     adapter.send_document.assert_awaited_once_with(
         chat_id="chat-1",
         file_path=str(media_file),
-        metadata={"notify": True},
+        metadata=None,
     )
     adapter.send_voice.assert_not_awaited()
 
@@ -116,7 +116,7 @@ async def test_base_adapter_routes_voice_tagged_telegram_ogg_media_tag_to_voice_
     adapter.send_voice.assert_awaited_once_with(
         chat_id="chat-1",
         audio_path=str(media_file),
-        metadata={"notify": True},
+        metadata=None,
     )
     adapter.send_document.assert_not_awaited()
 

tests/run_agent/test_async_httpx_del_neuter.py

@@ -176,16 +176,11 @@ class TestClientCacheBoundedGrowth:
         """When the loop changes, the old entry should be replaced, not duplicated."""
         from agent.auxiliary_client import (
             _client_cache,
-            _client_cache_key,
             _client_cache_lock,
             _get_cached_client,
         )
 
-        key = _client_cache_key(
-            "test_replace",
-            async_mode=True,
-            task="",
-        )
+        key = ("test_replace", True, "", "", "", (), False, "")
 
         # Simulate a stale entry from a closed loop
         old_loop = asyncio.new_event_loop()

tools/clarify_tool.py

@@ -93,6 +93,12 @@ CLARIFY_SCHEMA = {
         "or types their own answer via a 5th 'Other' option.\n"
         "2. **Open-ended** — omit choices entirely. The user types a free-form "
         "response.\n\n"
+        "CRITICAL: when you are offering options, put each option ONLY in the "
+        "`choices` array — NEVER enumerate the options inside the `question` "
+        "text. The UI renders `choices` as selectable rows; options written "
+        "into the question string render as dead prose the user can't pick. "
+        "Right: question='Which deployment target?', choices=['staging', "
+        "'prod']. Wrong: question='Which target? 1) staging 2) prod', choices=[].\n\n"
         "Use this tool when:\n"
         "- The task is ambiguous and you need the user to choose an approach\n"
         "- You want post-task feedback ('How did that work out?')\n"
@@ -107,16 +113,22 @@ CLARIFY_SCHEMA = {
         "properties": {
             "question": {
                 "type": "string",
-                "description": "The question to present to the user.",
+                "description": (
+                    "The question itself, and ONLY the question (e.g. 'Which "
+                    "deployment target?'). Do NOT embed the answer options here "
+                    "— pass them as separate elements in `choices`."
+                ),
             },
             "choices": {
                 "type": "array",
                 "items": {"type": "string"},
                 "maxItems": MAX_CHOICES,
                 "description": (
-                    "Up to 4 answer choices. Omit this parameter entirely to "
-                    "ask an open-ended question. When provided, the UI "
-                    "automatically appends an 'Other (type your answer)' option."
+                    "REQUIRED whenever you are presenting selectable options: "
+                    "each distinct option is its own array element (up to 4). "
+                    "The UI renders these as pickable rows and auto-appends an "
+                    "'Other (type your answer)' option. Omit this parameter "
+                    "entirely ONLY for a genuinely open-ended free-text question."
                 ),
             },
         },

website/docs/reference/environment-variables.md

@@ -687,7 +687,7 @@ For task-specific direct endpoints, Hermes uses the task's configured API key or
 
 ## Fallback Providers (config.yaml only)
 
-The primary model fallback chain is configured exclusively through `config.yaml` — there are no environment variables for it. Add a top-level `fallback_providers` list with `provider` and `model` keys to enable automatic failover when your main model encounters errors. Auxiliary tasks whose provider is `auto` also consult this chain before Hermes' built-in auxiliary discovery chain.
+The primary model fallback chain is configured exclusively through `config.yaml` — there are no environment variables for it. Add a top-level `fallback_providers` list with `provider` and `model` keys to enable automatic failover when your main model encounters errors.
 
 ```yaml
 fallback_providers:
@@ -695,7 +695,7 @@ fallback_providers:
     model: anthropic/claude-sonnet-4
 ```
 
-The older top-level `fallback_model` single-provider shape is still read for backward compatibility, but new configuration should use `fallback_providers`. For task-specific auxiliary policy, use `auxiliary.<task>.fallback_chain` in `config.yaml`; there is no environment variable equivalent.
+The older top-level `fallback_model` single-provider shape is still read for backward compatibility, but new configuration should use `fallback_providers`.
 
 See [Fallback Providers](/user-guide/features/fallback-providers) for full details.
 

website/docs/user-guide/configuring-models.md

@@ -53,7 +53,7 @@ Click **Show auxiliary** to reveal the 11 task slots:
 
 ![Auxiliary panel expanded](/img/docs/dashboard-models/auxiliary-expanded.png)
 
-Every auxiliary task defaults to `auto` — meaning Hermes tries your main model for that job too. If that route is unavailable or hits a capacity-style failure, `auto` follows any task-specific `auxiliary.<task>.fallback_chain`, then the main `fallback_providers` / `fallback_model` chain, then Hermes' built-in auxiliary discovery chain. Override a specific task when you want a cheaper or faster model for a side-job.
+Every auxiliary task defaults to `auto` — meaning Hermes uses your main model for that job too. Override a specific task when you want a cheaper or faster model for a side-job.
 
 ### Common override patterns
 
@@ -129,21 +129,7 @@ auxiliary:
     # ... other fields unchanged
 ```
 
-`provider: auto` with `model: ''` tells Hermes to use the main model for that task, while still honoring fallback policy if the main route cannot serve the auxiliary call.
-
-Optional task-specific fallback chains live under the same auxiliary task:
-
-```yaml
-auxiliary:
-  title_generation:
-    provider: auto
-    model: ''
-    fallback_chain:
-      - provider: openrouter
-        model: inclusionai/ring-2.6-1t:free
-```
-
-When `fallback_chain` is absent, `auto` uses the top-level `fallback_providers` chain before the built-in auxiliary discovery chain.
+`provider: auto` with `model: ''` tells Hermes to use the main model for that task.
 
 ## When does it take effect?
 

website/docs/user-guide/features/fallback-providers.md

@@ -168,7 +168,7 @@ fallback_providers:
 | Messaging gateway (Telegram, Discord, etc.) | ✔ |
 | Subagent delegation | ✔ (subagents inherit the parent fallback chain) |
 | Cron jobs | ✔ (cron agents inherit configured fallback providers) |
-| Auxiliary tasks on `provider: auto` | ✔ (try per-task fallback, then the main fallback chain before built-in aux discovery) |
+| Auxiliary tasks (vision, compression) | ✘ (use their own provider chain — see below) |
 
 :::tip
 There are no environment variables for the primary fallback chain — configure it exclusively through `config.yaml` or `hermes fallback`. This is intentional: fallback configuration is a deliberate choice, not something a stale shell export should override.
@@ -195,30 +195,23 @@ Hermes uses separate lightweight models for side tasks. Each task has its own pr
 
 ### Auto-Detection Chain
 
-When a task's provider is set to `"auto"` (the default), Hermes first tries the main provider + main model for that auxiliary task. If that route is unavailable or later fails with a capacity-style error, Hermes now honors user-configured fallback policy before using the built-in discovery chain:
+When a task's provider is set to `"auto"` (the default), Hermes tries providers in order until one works:
 
-```text
-Main provider + main model → auxiliary.<task>.fallback_chain →
-fallback_providers / fallback_model → built-in auxiliary discovery chain
-```
-
-The task-specific chain is most precise and wins when present. The top-level `fallback_providers` chain is the same policy the main agent uses, so free-only or same-provider fallback rules apply to auxiliary tasks on `auto` as well.
-
-**Built-in text discovery chain (compression, web extract, title generation, etc.):**
+**For text tasks (compression, web extract, etc.):**
 
 ```text
 OpenRouter → Nous Portal → Custom endpoint → Codex OAuth →
 API-key providers (z.ai, Kimi, MiniMax, Xiaomi MiMo, Hugging Face, Anthropic) → give up
 ```
 
-**Built-in vision discovery chain:**
+**For vision tasks:**
 
 ```text
 Main provider (if vision-capable) → OpenRouter → Nous Portal →
 Codex OAuth → Anthropic → Custom endpoint → give up
 ```
 
-Those built-in chains are a convenience fallback for users who have not declared a task-specific or main fallback policy.
+If the resolved provider fails at call time, Hermes also has an internal retry: if the provider is not OpenRouter and no explicit `base_url` is set, it tries OpenRouter as a last-resort fallback.
 
 ### Configuring Auxiliary Providers
 
@@ -239,9 +232,6 @@ auxiliary:
   compression:
     provider: "auto"
     model: ""
-    fallback_chain:              # optional, task-specific fallback policy
-      - provider: openrouter
-        model: inclusionai/ring-2.6-1t:free
 
   skills_hub:
     provider: "auto"
@@ -252,9 +242,7 @@ auxiliary:
     model: ""
 ```
 
-Every task above follows the same **provider / model / base_url** pattern. Each task can also declare its own `fallback_chain`; if omitted, `provider: auto` uses the top-level `fallback_providers` chain before Hermes' built-in auxiliary discovery chain.
-
-Context compression is configured under `auxiliary.compression`:
+Every task above follows the same **provider / model / base_url** pattern. Context compression is configured under `auxiliary.compression`:
 
 ```yaml
 auxiliary: