feat(plugins): install from a subdirectory within a repo

Support installing a plugin that lives in a subdirectory of a larger
repo (docs/tests at root, plugin in a subdir) without forcing a
dedicated single-plugin repo.

Identifier syntax:
  owner/repo/path/to/plugin        (shorthand + subpath)
  <url>.git/path/to/plugin         (.git boundary on GitHub-style URLs)
  <url>#path/to/plugin             (explicit fragment, any scheme)

_resolve_git_url now returns (git_url, subdir); _install_plugin_core
reads the manifest from and moves only the subdir, so root-level docs
and tests no longer leak into ~/.hermes/plugins. _resolve_subdir_within
guards against path traversal, missing dirs, and non-directories.

Both the CLI (hermes plugins install) and the dashboard install endpoint
inherit this for free since they share _install_plugin_core. Dashboard
install hint + placeholder updated to advertise the subdir syntax.

agent/anthropic_adapter.py

@@ -821,7 +821,6 @@ def _read_claude_code_credentials_from_keychain() -> Optional[Dict[str, Any]]:
             capture_output=True,
             text=True,
             timeout=5,
-            stdin=subprocess.DEVNULL,
         )
     except (OSError, subprocess.TimeoutExpired):
         logger.debug("Keychain: security command not available or timed out")
@@ -1164,10 +1163,7 @@ def run_oauth_setup_token() -> Optional[str]:
             "Install it with: npm install -g @anthropic-ai/claude-code"
         )
 
-    # Run interactively — stdin/stdout/stderr inherited so the user can
-    # complete the OAuth login prompt. Must keep inherited stdin; the TUI-EOF
-    # concern does not apply to an interactive login the user explicitly
-    # invokes.  noqa: subprocess-stdin
+    # Run interactively — stdin/stdout/stderr inherited so user can interact
     try:
         subprocess.run([claude_path, "setup-token"])
     except (KeyboardInterrupt, EOFError):

agent/context_references.py

@@ -290,7 +290,6 @@ def _expand_git_reference(
             capture_output=True,
             text=True,
             timeout=30,
-            stdin=subprocess.DEVNULL,
         )
     except subprocess.TimeoutExpired:
         return f"{ref.raw}: git command timed out (30s)", None
@@ -483,7 +482,6 @@ def _rg_files(path: Path, cwd: Path, limit: int) -> list[Path] | None:
             capture_output=True,
             text=True,
             timeout=10,
-            stdin=subprocess.DEVNULL,
         )
     except (FileNotFoundError, OSError, subprocess.TimeoutExpired):
         return None

agent/lsp/install.py

@@ -262,7 +262,6 @@ def _install_npm(
             capture_output=True,
             text=True,
             timeout=300,
-            stdin=subprocess.DEVNULL,
         )
         if proc.returncode != 0:
             logger.warning(
@@ -311,7 +310,6 @@ def _install_go(pkg: str, bin_name: str) -> Optional[str]:
             text=True,
             timeout=600,
             env=env,
-            stdin=subprocess.DEVNULL,
         )
         if proc.returncode != 0:
             logger.warning(
@@ -349,7 +347,6 @@ def _install_pip(pkg: str, bin_name: str) -> Optional[str]:
             capture_output=True,
             text=True,
             timeout=300,
-            stdin=subprocess.DEVNULL,
         )
         if proc.returncode != 0:
             logger.warning(

agent/secret_sources/bitwarden.py

@@ -274,7 +274,6 @@ def _platform_asset_name() -> str:
                 capture_output=True,
                 text=True,
                 timeout=2,
-                stdin=subprocess.DEVNULL,
             )
             if "musl" in (res.stdout + res.stderr).lower():
                 libc = "musl"
@@ -526,7 +525,6 @@ def _run_bws_list(
             capture_output=True,
             text=True,
             timeout=_BWS_RUN_TIMEOUT,
-            stdin=subprocess.DEVNULL,
         )
     except subprocess.TimeoutExpired as exc:
         raise RuntimeError(

agent/skill_preprocessing.py

@@ -74,7 +74,6 @@ def run_inline_shell(command: str, cwd: Path | None, timeout: int) -> str:
             text=True,
             timeout=max(1, int(timeout)),
             check=False,
-            stdin=subprocess.DEVNULL,
         )
     except subprocess.TimeoutExpired:
         return f"[inline-shell timeout after {timeout}s: {command}]"

agent/transports/codex_app_server.py

@@ -378,7 +378,6 @@ def check_codex_binary(
             capture_output=True,
             text=True,
             timeout=10,
-            stdin=subprocess.DEVNULL,
         )
     except FileNotFoundError:
         return False, (

apps/desktop/src/app/session/hooks/use-prompt-actions.test.tsx

@@ -4,8 +4,6 @@ import { useEffect } from 'react'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 import { $sessions, setSessions } from '@/store/session'
-import { $connection } from '@/store/session'
-import type { ComposerAttachment } from '@/store/composer'
 import type { SessionInfo } from '@/types/hermes'
 
 import { usePromptActions } from './use-prompt-actions'
@@ -44,10 +42,7 @@ function sessionInfo(overrides: Partial<SessionInfo> = {}): SessionInfo {
 
 interface HarnessHandle {
   steerPrompt: (text: string) => Promise<boolean>
-  submitText: (
-    text: string,
-    options?: { attachments?: ComposerAttachment[]; fromQueue?: boolean }
-  ) => Promise<boolean>
+  submitText: (text: string, options?: { attachments?: never[]; fromQueue?: boolean }) => Promise<boolean>
 }
 
 function Harness({
@@ -319,92 +314,3 @@ describe('usePromptActions steerPrompt', () => {
     expect(requestGateway).not.toHaveBeenCalled()
   })
 })
-
-describe('usePromptActions file attachment sync', () => {
-  afterEach(() => {
-    cleanup()
-    $connection.set(null)
-    vi.restoreAllMocks()
-  })
-
-  function fileAttachment(): ComposerAttachment {
-    return {
-      id: 'file:report.txt',
-      kind: 'file',
-      label: 'report.txt',
-      path: '/Users/alice/Downloads/report.txt',
-      refText: '@file:`/Users/alice/Downloads/report.txt`'
-    }
-  }
-
-  it('uploads file bytes via file.attach on a remote gateway and submits the rewritten ref', async () => {
-    // Remote gateway can't read the client-disk path, so the desktop must upload
-    // the bytes and submit the workspace-relative ref the gateway hands back —
-    // not the original /Users/... path (which would dead-end as "outside the
-    // allowed workspace").
-    $connection.set({ mode: 'remote' } as never)
-    Object.defineProperty(window, 'hermesDesktop', {
-      configurable: true,
-      value: { readFileDataUrl: vi.fn(async () => 'data:text/plain;base64,aGVsbG8=') }
-    })
-
-    const calls: { method: string; params?: Record<string, unknown> }[] = []
-    const requestGateway = vi.fn(async (method: string, params?: Record<string, unknown>) => {
-      calls.push({ method, params })
-      if (method === 'file.attach') {
-        return {
-          attached: true,
-          path: '/remote/work/.hermes/desktop-attachments/report.txt',
-          ref_text: '@file:.hermes/desktop-attachments/report.txt',
-          uploaded: true
-        } as never
-      }
-      return {} as never
-    })
-
-    let handle: HarnessHandle | null = null
-    render(<Harness onReady={h => (handle = h)} refreshSessions={async () => undefined} requestGateway={requestGateway} />)
-
-    const ok = await handle!.submitText('convert this to epub', { attachments: [fileAttachment()] })
-
-    expect(ok).toBe(true)
-    expect(calls.map(c => c.method)).toEqual(['file.attach', 'prompt.submit'])
-    expect(calls[0]?.params).toMatchObject({
-      session_id: RUNTIME_SESSION_ID,
-      path: '/Users/alice/Downloads/report.txt',
-      name: 'report.txt',
-      data_url: 'data:text/plain;base64,aGVsbG8='
-    })
-    expect(calls[1]?.params).toEqual({
-      session_id: RUNTIME_SESSION_ID,
-      text: '@file:.hermes/desktop-attachments/report.txt\n\nconvert this to epub'
-    })
-  })
-
-  it('passes the path directly via file.attach in local mode (no byte upload)', async () => {
-    $connection.set({ mode: 'local' } as never)
-
-    const calls: { method: string; params?: Record<string, unknown> }[] = []
-    const requestGateway = vi.fn(async (method: string, params?: Record<string, unknown>) => {
-      calls.push({ method, params })
-      if (method === 'file.attach') {
-        return { attached: true, ref_text: '@file:data/report.txt', uploaded: false } as never
-      }
-      return {} as never
-    })
-
-    let handle: HarnessHandle | null = null
-    render(<Harness onReady={h => (handle = h)} refreshSessions={async () => undefined} requestGateway={requestGateway} />)
-
-    const ok = await handle!.submitText('summarize', { attachments: [fileAttachment()] })
-
-    expect(ok).toBe(true)
-    expect(calls[0]?.method).toBe('file.attach')
-    // Local mode sends no data_url — the gateway shares this disk.
-    expect(calls[0]?.params).not.toHaveProperty('data_url')
-    expect(calls[1]).toEqual({
-      method: 'prompt.submit',
-      params: { session_id: RUNTIME_SESSION_ID, text: '@file:data/report.txt\n\nsummarize' }
-    })
-  })
-})

apps/desktop/src/app/session/hooks/use-prompt-actions.ts

@@ -47,7 +47,6 @@ import {
 
 import type {
   ClientSessionState,
-  FileAttachResponse,
   ImageAttachResponse,
   SessionSteerResponse,
   SessionTitleResponse,
@@ -104,20 +103,6 @@ async function readImageForRemoteAttach(
   return contentBase64 ? { contentBase64, filename: imageFilenameFromPath(filePath) } : null
 }
 
-// Read a non-image file as a data URL for upload via file.attach. Returns null
-// when the desktop bridge can't read the file (e.g. it was moved/deleted).
-async function readFileDataUrlForAttach(filePath: string): Promise<string | null> {
-  const reader = window.hermesDesktop?.readFileDataUrl
-
-  if (!reader) {
-    return null
-  }
-
-  const dataUrl = await reader(filePath)
-
-  return dataUrl || null
-}
-
 interface PromptActionsOptions {
   activeSessionId: string | null
   activeSessionIdRef: MutableRefObject<string | null>
@@ -227,114 +212,62 @@ export function usePromptActions({
     [selectedStoredSessionIdRef, updateSessionState]
   )
 
-  const syncAttachmentsForSubmit = useCallback(
+  const syncImageAttachmentsForSubmit = useCallback(
     async (
       sessionId: string,
       attachments: ComposerAttachment[],
       options: { updateComposerAttachments?: boolean } = {}
-    ): Promise<ComposerAttachment[]> => {
+    ) => {
       const updateComposerAttachments = options.updateComposerAttachments ?? true
+      const images = attachments.filter(attachment => attachment.kind === 'image' && attachment.path)
       const remote = $connection.get()?.mode === 'remote'
-      const synced: ComposerAttachment[] = []
 
-      for (const attachment of attachments) {
-        // Already-synced or pathless refs (terminal, url, etc.) pass through.
-        if (!attachment.path || attachment.attachedSessionId === sessionId) {
-          synced.push(attachment)
+      for (const attachment of images) {
+        if (attachment.attachedSessionId === sessionId) {
           continue
         }
 
-        if (attachment.kind === 'image') {
-          let result: ImageAttachResponse
+        let result: ImageAttachResponse
 
-          if (remote) {
-            // The gateway is on another machine — it can't read attachment.path
-            // (a path on THIS disk). Upload the bytes via image.attach_bytes.
-            const payload = await readImageForRemoteAttach(attachment.path)
+        if (remote) {
+          // The gateway is on another machine — it can't read attachment.path
+          // (a path on THIS disk). Upload the bytes via image.attach_bytes.
+          const payload = attachment.path ? await readImageForRemoteAttach(attachment.path) : null
 
-            if (!payload) {
-              const label = attachment.label || pathLabel(attachment.path)
-              throw new Error(`Could not read ${label}`)
-            }
-
-            result = await requestGateway<ImageAttachResponse>('image.attach_bytes', {
-              session_id: sessionId,
-              content_base64: payload.contentBase64,
-              filename: payload.filename
-            })
-          } else {
-            result = await requestGateway<ImageAttachResponse>('image.attach', {
-              session_id: sessionId,
-              path: attachment.path
-            })
+          if (!payload) {
+            const label = attachment.label || (attachment.path ? pathLabel(attachment.path) : 'image')
+            throw new Error(`Could not read ${label}`)
           }
 
-          if (!result.attached) {
-            const label = attachment.label || pathLabel(attachment.path)
-            throw new Error(result.message || `Could not attach ${label}`)
-          }
+          result = await requestGateway<ImageAttachResponse>('image.attach_bytes', {
+            session_id: sessionId,
+            content_base64: payload.contentBase64,
+            filename: payload.filename
+          })
+        } else {
+          result = await requestGateway<ImageAttachResponse>('image.attach', {
+            session_id: sessionId,
+            path: attachment.path
+          })
+        }
 
-          const attachedPath = result.path || attachment.path
-          const nextAttachment: ComposerAttachment = {
+        if (!result.attached) {
+          const label = attachment.label || (attachment.path ? pathLabel(attachment.path) : 'image')
+          throw new Error(result.message || `Could not attach ${label}`)
+        }
+
+        const attachedPath = result.path || attachment.path
+
+        if (updateComposerAttachments) {
+          addComposerAttachment({
             ...attachment,
             id: attachment.id,
             label: attachedPath ? pathLabel(attachedPath) : attachment.label,
             path: attachedPath,
             attachedSessionId: sessionId
-          }
-
-          if (updateComposerAttachments) {
-            addComposerAttachment(nextAttachment)
-          }
-
-          synced.push(nextAttachment)
-          continue
-        }
-
-        if (attachment.kind === 'file') {
-          // Non-image file refs are @file: paths the gateway reads with its file
-          // tools. On a remote gateway the desktop path doesn't exist there, so
-          // upload the bytes; the gateway stages them into the session workspace
-          // and hands back a workspace-relative ref that actually resolves.
-          // Local mode can pass the path directly (gateway shares this disk).
-          const dataUrl = remote ? await readFileDataUrlForAttach(attachment.path) : null
-
-          if (remote && !dataUrl) {
-            const label = attachment.label || pathLabel(attachment.path)
-            throw new Error(`Could not read ${label}`)
-          }
-
-          const result = await requestGateway<FileAttachResponse>('file.attach', {
-            session_id: sessionId,
-            path: attachment.path,
-            name: attachment.label || pathLabel(attachment.path),
-            ...(dataUrl ? { data_url: dataUrl } : {})
           })
-
-          if (!result.attached || !result.ref_text) {
-            const label = attachment.label || pathLabel(attachment.path)
-            throw new Error(result.message || `Could not attach ${label}`)
-          }
-
-          const nextAttachment: ComposerAttachment = {
-            ...attachment,
-            id: attachment.id,
-            refText: result.ref_text,
-            attachedSessionId: sessionId
-          }
-
-          if (updateComposerAttachments) {
-            addComposerAttachment(nextAttachment)
-          }
-
-          synced.push(nextAttachment)
-          continue
         }
-
-        synced.push(attachment)
       }
-
-      return synced
     },
     [requestGateway]
   )
@@ -345,42 +278,35 @@ export function usePromptActions({
       const usingComposerAttachments = !options?.attachments
       const attachments = options?.attachments ?? $composerAttachments.get()
 
+      const contextRefs = attachments
+        .map(a => a.refText)
+        .filter(Boolean)
+        .join('\n')
+
       const terminalContextBlocks = terminalContextBlocksFromDraft(rawText).join('\n\n')
       const hasImage = attachments.some(a => a.kind === 'image')
+      const attachmentRefs = attachments.map(attachmentDisplayText).filter((r): r is string => Boolean(r))
 
-      // Refs are recomputed after sync (file.attach rewrites @file: refs to
-      // workspace-relative paths the remote gateway can resolve). Seed the
-      // optimistic message with the pre-sync refs, then rewrite once synced.
-      let attachmentRefs = attachments.map(attachmentDisplayText).filter((r): r is string => Boolean(r))
-      const buildContextText = (atts: ComposerAttachment[]): string => {
-        const contextRefs = atts
-          .map(a => a.refText)
-          .filter(Boolean)
-          .join('\n')
-
-        return (
-          [contextRefs, terminalContextBlocks, visibleText].filter(Boolean).join('\n\n') ||
-          (atts.some(a => a.kind === 'image') ? 'What do you see in this image?' : '')
-        )
-      }
+      const text =
+        [contextRefs, terminalContextBlocks, visibleText].filter(Boolean).join('\n\n') ||
+        (hasImage ? 'What do you see in this image?' : '')
 
       // Queue drains fire on the busy→false settle edge, where busyRef (synced
       // from $busy by a separate effect) may still read true — honoring it would
       // bounce the drained send. The drain lock serializes them; the user path
       // keeps the guard so a stray Enter mid-turn can't double-submit.
-      const hasSendable = Boolean(visibleText || terminalContextBlocks || attachments.length || hasImage)
-      if (!hasSendable || (!options?.fromQueue && busyRef.current)) {
+      if (!text || (!options?.fromQueue && busyRef.current)) {
         return false
       }
 
       const optimisticId = `user-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`
 
-      const buildUserMessage = (): ChatMessage => ({
+      const userMessage: ChatMessage = {
         id: optimisticId,
         role: 'user',
         parts: [textPart(visibleText || (attachmentRefs.length ? '' : attachments.map(a => a.label).join(', ')))],
         attachmentRefs
-      })
+      }
 
       const releaseBusy = () => {
         setMutableRef(busyRef, false)
@@ -397,7 +323,7 @@ export function usePromptActions({
             ...state,
             messages: state.messages.some(m => m.id === optimisticId)
               ? state.messages
-              : [...state.messages, buildUserMessage()],
+              : [...state.messages, userMessage],
             busy: true,
             awaitingResponse: true,
             pendingBranchGroup: null,
@@ -410,18 +336,6 @@ export function usePromptActions({
           selectedStoredSessionIdRef.current
         )
 
-      // After sync rewrites refs, refresh the optimistic message in place so the
-      // transcript shows the resolved @file: ref rather than the local path.
-      const rewriteOptimistic = (sid: string) =>
-        updateSessionState(
-          sid,
-          state => ({
-            ...state,
-            messages: state.messages.map(message => (message.id === optimisticId ? buildUserMessage() : message))
-          }),
-          selectedStoredSessionIdRef.current
-        )
-
       const dropOptimistic = (sid: null | string) => {
         if (!sid) {
           setMessages(current => current.filter(m => m.id !== optimisticId))
@@ -452,7 +366,7 @@ export function usePromptActions({
       if (sessionId) {
         seedOptimistic(sessionId)
       } else {
-        setMessages(current => [...current, buildUserMessage()])
+        setMessages(current => [...current, userMessage])
       }
 
       if (!sessionId) {
@@ -478,14 +392,9 @@ export function usePromptActions({
       }
 
       try {
-        const syncedAttachments = await syncAttachmentsForSubmit(sessionId, attachments, {
+        await syncImageAttachmentsForSubmit(sessionId, attachments, {
           updateComposerAttachments: usingComposerAttachments
         })
-        // Rewrite the optimistic message + prompt text with the synced refs so
-        // the gateway receives @file: paths that resolve in its workspace.
-        attachmentRefs = syncedAttachments.map(attachmentDisplayText).filter((r): r is string => Boolean(r))
-        rewriteOptimistic(sessionId)
-        const text = buildContextText(syncedAttachments)
         await requestGateway('prompt.submit', { session_id: sessionId, text })
 
         if (usingComposerAttachments) {
@@ -533,7 +442,7 @@ export function usePromptActions({
       createBackendSessionForSend,
       requestGateway,
       selectedStoredSessionIdRef,
-      syncAttachmentsForSubmit,
+      syncImageAttachmentsForSubmit,
       updateSessionState
     ]
   )

apps/desktop/src/app/types.ts

@@ -27,20 +27,6 @@ export interface ImageDetachResponse {
   count?: number
 }
 
-export interface FileAttachResponse {
-  attached?: boolean
-  message?: string
-  // Gateway-side absolute path the file was staged to.
-  path?: string
-  // Workspace-relative path used to build ref_text.
-  ref_path?: string
-  // Rewritten @file: ref that resolves on the gateway (workspace-relative).
-  ref_text?: string
-  // True when bytes/host file were copied into the session workspace.
-  uploaded?: boolean
-  name?: string
-}
-
 export interface SlashExecResponse {
   output?: string
   warning?: string

apps/desktop/src/components/assistant-ui/thread.tsx

@@ -77,7 +77,6 @@ import type { HermesGateway } from '@/hermes'
 import { useResizeObserver } from '@/hooks/use-resize-observer'
 import { useI18n } from '@/i18n'
 import { DATA_IMAGE_URL_RE } from '@/lib/embedded-images'
-import { LinkifiedText } from '@/lib/external-link'
 import { triggerHaptic } from '@/lib/haptics'
 import { GitBranchIcon, Loader2Icon, Volume2Icon, VolumeXIcon } from '@/lib/icons'
 import { extractPreviewTargets } from '@/lib/preview-targets'
@@ -920,7 +919,7 @@ const SystemMessage: FC = () => {
       >
         <span className="font-mono text-muted-foreground/55">{slashStatus.groups.command}</span>
         <span className="mx-1.5 text-muted-foreground/35">·</span>
-        <LinkifiedText className="whitespace-pre-wrap" explicitOnly pretty={false} text={slashStatus.groups.output.trim()} />
+        <span className="whitespace-pre-wrap">{slashStatus.groups.output.trim()}</span>
       </MessagePrimitive.Root>
     )
   }
@@ -931,7 +930,7 @@ const SystemMessage: FC = () => {
       data-role="system"
       data-slot="aui_system-message-root"
     >
-      <LinkifiedText className="whitespace-pre-wrap" explicitOnly pretty={false} text={text} />
+      <span className="whitespace-pre-wrap">{text}</span>
     </MessagePrimitive.Root>
   )
 }

apps/desktop/src/lib/external-link.test.tsx

@@ -165,31 +165,4 @@ describe('external link helpers', () => {
       'https://expedia.com/things-to-do/puerto-rico-el-yunque-rainforest-adventure'
     )
   })
-
-  it('explicitOnly skips bare filename/domain tokens and only links explicit URLs', () => {
-    installDesktopBridge()
-
-    render(
-      <LinkifiedText
-        explicitOnly
-        pretty={false}
-        text={'Report  https://paste.rs/abc\nagent.log  https://paste.rs/def\nerrors.log'}
-      />
-    )
-
-    const links = screen.getAllByRole('link')
-    expect(links.map(a => a.getAttribute('href'))).toEqual(['https://paste.rs/abc', 'https://paste.rs/def'])
-    // Bare filename-shaped tokens stay as plain text, not links.
-    expect(screen.queryByText(content => content.includes('agent.log'))).toBeTruthy()
-    expect(links.some(a => (a.textContent ?? '').includes('.log'))).toBe(false)
-  })
-
-  it('without explicitOnly, bare filename tokens are still linkified (default behavior)', () => {
-    installDesktopBridge()
-
-    render(<LinkifiedText pretty={false} text="open agent.log please" />)
-
-    const link = screen.getByRole('link', { name: 'agent.log' })
-    expect(link.getAttribute('href')).toBe('https://agent.log')
-  })
 })

apps/desktop/src/lib/external-link.tsx

@@ -12,12 +12,6 @@ const titleSubs = new Map<string, Set<(value: string) => void>>()
 const URL_RE =
   /(?:https?:\/\/|www\.)[^\s<>"'`]+[^\s<>"'`.,;:!?)]|[a-z0-9](?:[a-z0-9-]*\.)+[a-z]{2,}(?:\/[^\s<>"'`.,;:!?)]*)?/gi
 
-// Explicit-scheme / www. URLs only — no bare-domain matching. Used where the
-// surrounding text is full of filename-shaped tokens (e.g. `agent.log`,
-// `errors.log` in a /debug report) that the bare-domain branch of URL_RE would
-// otherwise mistake for domains and linkify.
-const EXPLICIT_URL_RE = /(?:https?:\/\/|www\.)[^\s<>"'`]+[^\s<>"'`.,;:!?)]/gi
-
 const DOMAIN_RE = /^(?:www\.)?[a-z0-9](?:[a-z0-9-]*\.)+[a-z]{2,}(?::\d+)?(?:[/?#][^\s]*)?$/i
 const SKIP_PROTO_RE = /^(?:file|data|mailto|javascript|blob|chrome|about|hermes):/i
 const LOCAL_HOST_RE = /^(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\])(?::\d+)?$/i
@@ -267,14 +261,13 @@ interface LinkifiedTextProps {
   className?: string
   text: string
   pretty?: boolean
-  explicitOnly?: boolean
 }
 
-export function LinkifiedText({ className, explicitOnly = false, pretty = true, text }: LinkifiedTextProps) {
+export function LinkifiedText({ className, pretty = true, text }: LinkifiedTextProps) {
   const nodes: ReactNode[] = []
   let cursor = 0
 
-  for (const match of text.matchAll(explicitOnly ? EXPLICIT_URL_RE : URL_RE)) {
+  for (const match of text.matchAll(URL_RE)) {
     const raw = match[0]
     const url = normalizeExternalUrl(raw)
     const index = match.index ?? 0

apps/desktop/src/store/updates.ts

@@ -88,8 +88,7 @@ function isUpdateToastSnoozed(): boolean {
 // Must match tui_gateway's DESKTOP_BACKEND_CONTRACT that this build was written
 // against. The backend reports its own value in session runtime info; a lower
 // value (or none — a pre-GUI checkout) means GUI<->backend skew.
-// v2: requires the file.attach RPC (remote-gateway non-image file upload).
-const REQUIRED_BACKEND_CONTRACT = 2
+const REQUIRED_BACKEND_CONTRACT = 1
 const SKEW_TOAST_ID = 'backend-contract-skew'
 
 /**

apps/desktop/tsconfig.json

@@ -1,8 +1,8 @@
 {
   "compilerOptions": {
-    "target": "ES2023",
+    "target": "ES2022",
     "useDefineForClassFields": true,
-    "lib": ["DOM", "DOM.Iterable", "ES2023"],
+    "lib": ["DOM", "DOM.Iterable", "ES2022"],
     "allowJs": false,
     "skipLibCheck": true,
     "esModuleInterop": true,

cli.py

@@ -6218,20 +6218,27 @@ class HermesCLI(CLIAgentSetupMixin, CLICommandsMixin):
         choices visible and lets the normal Enter key binding submit the typed
         or highlighted choice.
 
-        **Platform note (Windows — issue #33961):**
-        Earlier code bypassed the modal on ``sys.platform == "win32"`` and fell
-        back to a raw ``input()`` prompt.  When the confirm was triggered from the
-        ``process_loop`` daemon thread (the normal case) that ``input()`` ran off
-        the main thread and deadlocked against prompt_toolkit's stdin ownership —
-        the user saw a frozen cursor and Ctrl-C was swallowed (bare ``/reset``
-        froze; ``/reset now`` worked only because it skips the prompt entirely).
+        **Platform note (Windows dead-lock — issue #30768):**
+        The queue-based modal relies on prompt_toolkit key bindings receiving
+        keyboard events and calling ``_submit_slash_confirm_response``.  On
+        Windows (PowerShell / Windows Terminal) the prompt_toolkit input
+        channel can become unresponsive when the modal is entered from the
+        ``process_loop`` daemon thread, causing a dead-lock: the user sees the
+        confirmation panel but keystrokes never reach the key bindings and the
+        ``response_queue.get()`` blocks until the 120-second timeout expires.
 
-        Native Windows now uses the same path as Linux/macOS: the modal is set up
-        on ``self._app.loop`` via ``call_soon_threadsafe`` and answered by the
-        normal prompt_toolkit key bindings (the same input channel that already
-        handles ordinary typing on Windows).  The raw ``input()`` fallback is kept
-        only for the genuinely safe cases: no running app (unit tests /
-        non-interactive), no resolvable event loop, or a scheduling failure.
+        To avoid this, we fall back to ``_prompt_text_input`` (a simple
+        ``input()``-based prompt) when any of these conditions hold:
+
+        * ``sys.platform == "win32"`` — native Windows console (ConPTY /
+          win32_input) does not support the modal reliably.
+        * ``self._app`` is not set — unit tests / non-interactive contexts.
+
+        On non-Windows platforms the modal itself is still safe from the
+        ``process_loop`` daemon thread as long as the main-thread event loop
+        owns the prompt_toolkit buffer mutations.  When we are off the main
+        thread, schedule the modal snapshot / restore work on ``self._app.loop``
+        via ``call_soon_threadsafe`` and keep the queue-based response path.
         """
         import threading
         import time as _time
@@ -6244,25 +6251,22 @@ class HermesCLI(CLIAgentSetupMixin, CLICommandsMixin):
         if not getattr(self, "_app", None):
             return self._prompt_text_input("Choice [1/2/3]: ")
 
+        # On Windows the prompt_toolkit input channel can deadlock when the
+        # modal is entered from the process_loop daemon thread — keystrokes
+        # never reach the key bindings, so response_queue.get() blocks for
+        # the full timeout (issue #30768).  Fall back to the simpler
+        # stdin-based prompt which works reliably on Windows.
+        if sys.platform == "win32":
+            return self._prompt_text_input("Choice [1/2/3]: ")
+
         try:
             app_loop = self._app.loop
         except Exception:
             app_loop = None
 
         in_main_thread = threading.current_thread() is threading.main_thread()
-
-        def _stdin_fallback() -> str | None:
-            # On native Windows a raw input() from a non-main thread deadlocks
-            # against prompt_toolkit's stdin ownership (#33961).  With an app
-            # running we cannot safely prompt off the main thread, so cancel
-            # cleanly (None) rather than hang the terminal.
-            if sys.platform == "win32" and not in_main_thread:
-                self._invalidate()
-                return None
-            return self._prompt_text_input("Choice [1/2/3]: ")
-
         if not in_main_thread and app_loop is None:
-            return _stdin_fallback()
+            return self._prompt_text_input("Choice [1/2/3]: ")
 
         response_queue = queue.Queue()
 
@@ -6303,7 +6307,7 @@ class HermesCLI(CLIAgentSetupMixin, CLICommandsMixin):
             return ready.wait(timeout=5)
 
         if not _run_on_app_loop(_setup_modal):
-            return _stdin_fallback()
+            return self._prompt_text_input("Choice [1/2/3]: ")
 
         _last_countdown_refresh = _time.monotonic()
         try:
@@ -8219,10 +8223,9 @@ class HermesCLI(CLIAgentSetupMixin, CLICommandsMixin):
             print("  ⚠️  MCP reload timed out (30s). Some servers may not have reconnected.")
 
     # Inline-skip tokens that bypass the destructive-slash confirmation modal.
-    # A general escape hatch for non-interactive use (scripting/automation) and
-    # for the degraded path where the modal can't be marshaled onto the app loop
-    # — lets users self-serve without flipping approvals.destructive_slash_confirm
-    # in config. (Native Windows now drives the modal normally — see #33961.)
+    # Matches the escape-hatch pattern users on broken modal platforms
+    # (currently native Windows PowerShell — issue #30768) need to self-serve
+    # without having to flip approvals.destructive_slash_confirm in config.
     _DESTRUCTIVE_SKIP_TOKENS = frozenset({"now", "--yes", "-y"})
 
     @classmethod
@@ -8280,9 +8283,8 @@ class HermesCLI(CLIAgentSetupMixin, CLICommandsMixin):
         Inline-skip: if ``cmd_original`` contains ``now``, ``--yes``, or
         ``-y`` as an argument (e.g. ``/reset now``, ``/new --yes My title``),
         the modal is bypassed and ``"once"`` is returned immediately. This is
-        an escape hatch for non-interactive use and for the degraded path where
-        the modal can't be marshaled onto the app loop (native Windows itself now
-        drives the modal normally — see #33961). Callers are responsible
+        an escape hatch for platforms where the prompt_toolkit modal hangs
+        (issue #30768 — native Windows PowerShell). Callers are responsible
         for stripping the skip tokens from any remaining argument parsing
         (see :meth:`_split_destructive_skip`).
 

gateway/platforms/api_server.py

@@ -3510,46 +3510,35 @@ class APIServerAdapter(BasePlatformAdapter):
         loop = asyncio.get_running_loop()
 
         def _run():
-            from gateway.session_context import clear_session_vars, set_session_vars
-
-            tokens = set_session_vars(
-                platform="api_server",
-                chat_id=session_id or "",
-                session_key=gateway_session_key or session_id or "",
-                session_id=session_id or "",
+            agent = self._create_agent(
+                ephemeral_system_prompt=ephemeral_system_prompt,
+                session_id=session_id,
+                stream_delta_callback=stream_delta_callback,
+                tool_progress_callback=tool_progress_callback,
+                tool_start_callback=tool_start_callback,
+                tool_complete_callback=tool_complete_callback,
+                gateway_session_key=gateway_session_key,
             )
-            try:
-                agent = self._create_agent(
-                    ephemeral_system_prompt=ephemeral_system_prompt,
-                    session_id=session_id,
-                    stream_delta_callback=stream_delta_callback,
-                    tool_progress_callback=tool_progress_callback,
-                    tool_start_callback=tool_start_callback,
-                    tool_complete_callback=tool_complete_callback,
-                    gateway_session_key=gateway_session_key,
-                )
-                if agent_ref is not None:
-                    agent_ref[0] = agent
-                effective_task_id = session_id or str(uuid.uuid4())
-                result = agent.run_conversation(
-                    user_message=user_message,
-                    conversation_history=conversation_history,
-                    task_id=effective_task_id,
-                )
-                usage = {
-                    "input_tokens": getattr(agent, "session_prompt_tokens", 0) or 0,
-                    "output_tokens": getattr(agent, "session_completion_tokens", 0) or 0,
-                    "total_tokens": getattr(agent, "session_total_tokens", 0) or 0,
-                }
-                # Include the effective session ID in the result so callers
-                # (e.g. X-Hermes-Session-Id header) can track compression-
-                # triggered session rotations. (#16938)
-                _eff_sid = getattr(agent, "session_id", session_id)
-                if isinstance(_eff_sid, str) and _eff_sid:
-                    result["session_id"] = _eff_sid
-                return result, usage
-            finally:
-                clear_session_vars(tokens)
+            if agent_ref is not None:
+                agent_ref[0] = agent
+            effective_task_id = session_id or str(uuid.uuid4())
+            result = agent.run_conversation(
+                user_message=user_message,
+                conversation_history=conversation_history,
+                task_id=effective_task_id,
+            )
+            usage = {
+                "input_tokens": getattr(agent, "session_prompt_tokens", 0) or 0,
+                "output_tokens": getattr(agent, "session_completion_tokens", 0) or 0,
+                "total_tokens": getattr(agent, "session_total_tokens", 0) or 0,
+            }
+            # Include the effective session ID in the result so callers
+            # (e.g. X-Hermes-Session-Id header) can track compression-
+            # triggered session rotations. (#16938)
+            _eff_sid = getattr(agent, "session_id", session_id)
+            if isinstance(_eff_sid, str) and _eff_sid:
+                result["session_id"] = _eff_sid
+            return result, usage
 
         return await loop.run_in_executor(None, _run)
 

gateway/platforms/base.py

@@ -1795,12 +1795,9 @@ class BasePlatformAdapter(ABC):
 
     # Whether this platform renders triple-backtick fenced code blocks (i.e.
     # ``format_message`` translates/preserves markdown fences into a real code
-    # block).  Capability flag for markdown-aware presentation choices.
+    # block).  Drives presentation choices like rendering a ``terminal`` tool
+    # call's command as a ```bash block instead of a flat preview line.
     # Default False (plain-text platforms); markdown-rendering adapters set True.
-    # Tool-progress uses this to render a terminal command as a bare fenced code
-    # block (no language tag — Slack mrkdwn would print the tag as a literal
-    # first code line).  Plain-text platforms fall back to the short truncated
-    # preview (see gateway/run.py progress_callback).
     supports_code_blocks: bool = False
 
     def __init__(self, config: PlatformConfig, platform: Platform):

gateway/platforms/telegram.py

@@ -181,8 +181,6 @@ def _strip_mdv2(text: str) -> str:
     """
     # Remove escape backslashes before special characters
     cleaned = re.sub(r'\\([_*\[\]()~`>#\+\-=|{}.!\\])', r'\1', text)
-    # Remove standard markdown bold (**text** → text) BEFORE MarkdownV2 bold
-    cleaned = re.sub(r'\*\*([^*]+)\*\*', r'\1', cleaned)
     # Remove MarkdownV2 bold markers that format_message converted from **bold**
     cleaned = re.sub(r'\*([^*]+)\*', r'\1', cleaned)
     # Remove MarkdownV2 italic markers that format_message converted from *italic*
@@ -2210,17 +2208,11 @@ class TelegramAdapter(BasePlatformAdapter):
                 # "Message is not modified" is a no-op, not an error
                 if "not modified" in str(fmt_err).lower():
                     return SendResult(success=True, message_id=message_id)
-                # Fallback: strip MarkdownV2 escapes and retry as clean plain text
-                logger.warning(
-                    "[%s] MarkdownV2 edit failed, falling back to plain text: %s",
-                    self.name,
-                    fmt_err,
-                )
-                _plain = _strip_mdv2(content) if content else content
+                # Fallback: retry without markdown formatting
                 await self._bot.edit_message_text(
                     chat_id=int(chat_id),
                     message_id=int(message_id),
-                    text=_plain,
+                    text=content,
                 )
             return SendResult(success=True, message_id=message_id)
         except Exception as e:

gateway/run.py

@@ -688,18 +688,7 @@ def _last_transcript_timestamp(history: Optional[List[Dict[str, Any]]]) -> Any:
 # ordinary outputs. Only tools that intentionally create deliverable media
 # artifacts should be eligible for automatic append when the model omits them
 # from the final gateway reply.
-_AUTO_APPEND_MEDIA_TOOL_NAMES = {
-    "text_to_speech",
-    "text_to_speech_tool",
-    "image_generate",
-}
-
-# Tools in this set return their deliverable artifact as a JSON payload with a
-# local-file path field rather than a literal ``MEDIA:`` tag (e.g. image_generate
-# returns ``{"success": true, "image": "/abs/path.png"}``). The auto-append path
-# extracts the path from these fields so delivery is deterministic and does not
-# depend on the model restating the path in its final reply.
-_JSON_MEDIA_TOOL_PATH_FIELDS = ("host_image", "image", "agent_visible_image")
+_AUTO_APPEND_MEDIA_TOOL_NAMES = {"text_to_speech", "text_to_speech_tool"}
 
 
 # Extension-anchored MEDIA: matcher for tool results. Mirrors the dispatch-site
@@ -766,28 +755,10 @@ def _collect_auto_append_media_tags(
         if tool_name_by_call_id.get(call_id) not in _AUTO_APPEND_MEDIA_TOOL_NAMES:
             continue
         content = str(msg.get("content") or "")
-        tool_name = tool_name_by_call_id.get(call_id)
-        # JSON-payload tools (image_generate) return a local-file path in a
-        # known field rather than a MEDIA: tag. Extract it so delivery is
-        # deterministic even when the model omits the path from its reply.
-        if tool_name == "image_generate" and "MEDIA:" not in content:
-            try:
-                payload = json.loads(content)
-            except Exception:
-                payload = None
-            if isinstance(payload, dict) and payload.get("success"):
-                for field in _JSON_MEDIA_TOOL_PATH_FIELDS:
-                    path = payload.get(field)
-                    if (isinstance(path, str)
-                            and _TOOL_MEDIA_RE.fullmatch(f"MEDIA:{path}")
-                            and path not in history_media_paths):
-                        media_tags.append(f"MEDIA:{path}")
-                        break
-            continue
         if "MEDIA:" not in content:
             continue
         for match in _TOOL_MEDIA_RE.finditer(content):
-            path = match.group(1).strip().rstrip('",}')
+            path = match.group(1).strip().rstrip('\",}')
             if path and path not in history_media_paths:
                 media_tags.append(f"MEDIA:{path}")
         if "[[audio_as_voice]]" in content:
@@ -13001,14 +12972,13 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
             from agent.display import get_tool_emoji
             emoji = get_tool_emoji(tool_name, default="⚙️")
 
-            # Markdown-capable platforms render a terminal command as a fenced
-            # code block (full command, no truncation) instead of the compact
-            # `terminal: "cmd…"` preview.  Gated on the adapter's
-            # ``supports_code_blocks`` capability so plain-text platforms keep
-            # the short line.  No language tag is emitted — Slack mrkdwn renders
-            # the tag as a literal first code line ("bash"), and a bare fence
-            # renders correctly everywhere that supports blocks.
-            _code_block = None
+            # Markdown-capable platforms render a terminal command as a native
+            # ```bash fenced block (full command, no quotes, no label, no
+            # truncation) instead of the noisy `terminal: "cmd…"` line.  Gated
+            # on the adapter's ``supports_code_blocks`` capability so every
+            # markdown-rendering platform (and plugin adapters that opt in) gets
+            # it, while plain-text platforms keep the compact line.
+            _bash_block = None
             try:
                 _progress_adapter = self.adapters.get(source.platform)
             except Exception:
@@ -13020,14 +12990,13 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                 and isinstance(args.get("command"), str)
                 and args["command"].strip()
             ):
-                _code_block = f"{emoji} {tool_name}\n```\n{args['command'].rstrip()}\n```"
-
+                _bash_block = f"```bash\n{args['command'].rstrip()}\n```"
+            
             # Verbose mode: show detailed arguments, respects tool_preview_length
             if progress_mode == "verbose":
-                if _code_block is not None:
-                    progress_queue.put(_code_block)
-                    return
-                if args:
+                if _bash_block is not None:
+                    msg = _bash_block
+                elif args:
                     from agent.display import get_tool_preview_max_len
                     _pl = get_tool_preview_max_len()
                     args_str = json.dumps(args, ensure_ascii=False, default=str)
@@ -13047,10 +13016,8 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
             # "all" / "new" modes: short preview, respects tool_preview_length
             # config (defaults to 40 chars when unset to keep gateway messages
             # compact — unlike CLI spinners, these persist as permanent messages).
-            # Terminal commands on markdown platforms get the full fenced block
-            # built above instead of the truncated preview.
-            if _code_block is not None:
-                msg = _code_block
+            if _bash_block is not None:
+                msg = _bash_block
             elif preview:
                 from agent.display import get_tool_preview_max_len
                 _pl = get_tool_preview_max_len()
@@ -13163,8 +13130,6 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                     "message_id": message_id,
                     "content": content,
                 }
-                if getattr(adapter, "REQUIRES_EDIT_FINALIZE", False):
-                    kwargs["finalize"] = True
                 if _edit_accepts_metadata:
                     kwargs["metadata"] = _progress_metadata
                 return await adapter.edit_message(**kwargs)

gateway/session_context.py

@@ -106,7 +106,6 @@ def set_session_vars(
     user_id: str = "",
     user_name: str = "",
     session_key: str = "",
-    session_id: str = "",
     message_id: str = "",
     cwd: str = "",
 ) -> list:
@@ -128,7 +127,6 @@ def set_session_vars(
         _SESSION_USER_ID.set(user_id),
         _SESSION_USER_NAME.set(user_name),
         _SESSION_KEY.set(session_key),
-        _SESSION_ID.set(session_id),
         _SESSION_MESSAGE_ID.set(message_id),
     ]
     try:
@@ -159,7 +157,6 @@ def clear_session_vars(tokens: list) -> None:
         _SESSION_USER_ID,
         _SESSION_USER_NAME,
         _SESSION_KEY,
-        _SESSION_ID,
         _SESSION_MESSAGE_ID,
     ):
         var.set("")

hermes_cli/config.py

@@ -13,7 +13,6 @@ This module provides:
 """
 
 import copy
-import json
 import logging
 import os
 import platform
@@ -5153,94 +5152,6 @@ def load_config_readonly() -> Dict[str, Any]:
     return _load_config_impl(want_deepcopy=False)
 
 
-TERMINAL_CONFIG_ENV_MAP = {
-    "backend": "TERMINAL_ENV",
-    "modal_mode": "TERMINAL_MODAL_MODE",
-    "cwd": "TERMINAL_CWD",
-    "timeout": "TERMINAL_TIMEOUT",
-    "lifetime_seconds": "TERMINAL_LIFETIME_SECONDS",
-    "docker_image": "TERMINAL_DOCKER_IMAGE",
-    "docker_forward_env": "TERMINAL_DOCKER_FORWARD_ENV",
-    "singularity_image": "TERMINAL_SINGULARITY_IMAGE",
-    "modal_image": "TERMINAL_MODAL_IMAGE",
-    "daytona_image": "TERMINAL_DAYTONA_IMAGE",
-    "ssh_host": "TERMINAL_SSH_HOST",
-    "ssh_user": "TERMINAL_SSH_USER",
-    "ssh_port": "TERMINAL_SSH_PORT",
-    "ssh_key": "TERMINAL_SSH_KEY",
-    "container_cpu": "TERMINAL_CONTAINER_CPU",
-    "container_memory": "TERMINAL_CONTAINER_MEMORY",
-    "container_disk": "TERMINAL_CONTAINER_DISK",
-    "container_persistent": "TERMINAL_CONTAINER_PERSISTENT",
-    "docker_volumes": "TERMINAL_DOCKER_VOLUMES",
-    "docker_env": "TERMINAL_DOCKER_ENV",
-    "docker_mount_cwd_to_workspace": "TERMINAL_DOCKER_MOUNT_CWD_TO_WORKSPACE",
-    "docker_extra_args": "TERMINAL_DOCKER_EXTRA_ARGS",
-    "docker_run_as_host_user": "TERMINAL_DOCKER_RUN_AS_HOST_USER",
-    "docker_persist_across_processes": "TERMINAL_DOCKER_PERSIST_ACROSS_PROCESSES",
-    "docker_orphan_reaper": "TERMINAL_DOCKER_ORPHAN_REAPER",
-    "sandbox_dir": "TERMINAL_SANDBOX_DIR",
-    "persistent_shell": "TERMINAL_PERSISTENT_SHELL",
-}
-
-
-def _terminal_env_value(value: Any) -> str:
-    if isinstance(value, (list, dict)):
-        return json.dumps(value)
-    return str(value)
-
-
-def terminal_config_env_var_for_key(key: str) -> Optional[str]:
-    """Return the env var mirrored by a ``terminal.*`` config key."""
-    prefix = "terminal."
-    if not key.startswith(prefix):
-        return None
-    return TERMINAL_CONFIG_ENV_MAP.get(key[len(prefix):])
-
-
-def apply_terminal_config_to_env(
-    *,
-    env: Optional[Dict[str, str]] = None,
-    config: Optional[Dict[str, Any]] = None,
-    override: Optional[bool] = None,
-) -> Dict[str, str]:
-    """Bridge ``terminal.*`` config into the env vars terminal tools read.
-
-    ``tools.terminal_tool`` is intentionally environment-driven because it also
-    runs in child processes (TUI, dashboard PTY, gateway workers).  This helper
-    gives those child-process launch paths the same config bridge as classic
-    CLI without importing ``cli.py`` and paying for its startup side effects.
-
-    When the user config contains a ``terminal`` section, config.yaml is
-    authoritative and overrides existing env values.  Otherwise defaults only
-    backfill missing env vars so exported/.env values keep working.
-    """
-    target = os.environ if env is None else env
-
-    raw_config = read_raw_config()
-    file_has_terminal_config = isinstance(raw_config.get("terminal"), dict)
-    should_override = file_has_terminal_config if override is None else override
-
-    cfg = config if config is not None else load_config_readonly()
-    terminal_cfg = cfg.get("terminal", {}) if isinstance(cfg, dict) else {}
-    if not isinstance(terminal_cfg, dict):
-        return target
-
-    for cfg_key, env_var in TERMINAL_CONFIG_ENV_MAP.items():
-        if cfg_key not in terminal_cfg:
-            continue
-        value = terminal_cfg[cfg_key]
-        if cfg_key == "cwd":
-            raw_cwd = str(value or "").strip()
-            if raw_cwd in {".", "auto", "cwd"}:
-                continue
-            if isinstance(value, str):
-                value = os.path.expanduser(value)
-        if should_override or env_var not in target:
-            target[env_var] = _terminal_env_value(value)
-    return target
-
-
 def _load_config_impl(*, want_deepcopy: bool) -> Dict[str, Any]:
     with _CONFIG_LOCK:
         ensure_hermes_home()
@@ -6129,9 +6040,36 @@ def set_config_value(key: str, value: str):
     
     # Keep .env in sync for keys that terminal_tool reads directly from env vars.
     # config.yaml is authoritative, but terminal_tool only reads TERMINAL_ENV etc.
-    env_var = terminal_config_env_var_for_key(key)
-    if env_var and key != "terminal.cwd":
-        save_env_value(env_var, _terminal_env_value(value))
+    _config_to_env_sync = {
+        "terminal.backend": "TERMINAL_ENV",
+        "terminal.modal_mode": "TERMINAL_MODAL_MODE",
+        "terminal.docker_image": "TERMINAL_DOCKER_IMAGE",
+        "terminal.singularity_image": "TERMINAL_SINGULARITY_IMAGE",
+        "terminal.modal_image": "TERMINAL_MODAL_IMAGE",
+        "terminal.daytona_image": "TERMINAL_DAYTONA_IMAGE",
+        "terminal.docker_mount_cwd_to_workspace": "TERMINAL_DOCKER_MOUNT_CWD_TO_WORKSPACE",
+        "terminal.docker_run_as_host_user": "TERMINAL_DOCKER_RUN_AS_HOST_USER",
+        "terminal.docker_persist_across_processes": "TERMINAL_DOCKER_PERSIST_ACROSS_PROCESSES",
+        "terminal.docker_orphan_reaper": "TERMINAL_DOCKER_ORPHAN_REAPER",
+        "terminal.docker_env": "TERMINAL_DOCKER_ENV",
+        # JSON-valued keys (terminal_tool parses these via json.loads). The user
+        # passes JSON on the CLI, so str(value) below already yields valid JSON —
+        # same as terminal.docker_env. cli.py and gateway/run.py bridge these too.
+        "terminal.docker_volumes": "TERMINAL_DOCKER_VOLUMES",
+        "terminal.docker_forward_env": "TERMINAL_DOCKER_FORWARD_ENV",
+        # terminal.cwd intentionally excluded — CLI resolves at runtime,
+        # gateway bridges it in gateway/run.py. Persisting to .env causes
+        # stale values to poison child processes.
+        "terminal.timeout": "TERMINAL_TIMEOUT",
+        "terminal.sandbox_dir": "TERMINAL_SANDBOX_DIR",
+        "terminal.persistent_shell": "TERMINAL_PERSISTENT_SHELL",
+        "terminal.container_cpu": "TERMINAL_CONTAINER_CPU",
+        "terminal.container_memory": "TERMINAL_CONTAINER_MEMORY",
+        "terminal.container_disk": "TERMINAL_CONTAINER_DISK",
+        "terminal.container_persistent": "TERMINAL_CONTAINER_PERSISTENT",
+    }
+    if key in _config_to_env_sync:
+        save_env_value(_config_to_env_sync[key], str(value))
 
     print(f"✓ Set {key} = {value} in {config_path}")
 

hermes_cli/dashboard_register.py

@@ -94,36 +94,19 @@ def _register_self_hosted_client(
     *,
     access_token: str,
     portal_base_url: str,
-    name: Optional[str],
+    name: str,
     custom_redirect_uri: Optional[str],
-    existing_client_id: Optional[str] = None,
     timeout: float = 15.0,
 ) -> dict:
     """POST to the portal's self-hosted-client endpoint and return the JSON body.
 
-    When ``existing_client_id`` is provided (the client_id this install
-    persisted on a prior run), it is sent so the portal updates that existing
-    dashboard record in place instead of minting a duplicate — this is what
-    makes re-running ``hermes dashboard register`` idempotent. The portal
-    falls back to creating a fresh client if the id no longer resolves to a row
-    in the caller's org (stale/deleted), so passing it is always safe.
-
-    ``name`` may be ``None`` on the idempotent update path (re-run without an
-    explicit ``--name``): omitting it tells the portal to keep the name it
-    already stored rather than overwriting it. It is required on the create
-    path; the caller guarantees a value there.
-
     Raises RuntimeError with a user-facing message on any non-2xx response or
     transport failure.
     """
     url = f"{portal_base_url.rstrip('/')}/api/oauth/self-hosted-client"
-    body: dict[str, str] = {}
-    if name:
-        body["name"] = name
+    body: dict[str, str] = {"name": name}
     if custom_redirect_uri:
         body["custom_redirect_uri"] = custom_redirect_uri
-    if existing_client_id:
-        body["client_id"] = existing_client_id
 
     data = json.dumps(body).encode("utf-8")
     req = urllib.request.Request(
@@ -182,20 +165,16 @@ def _print_post_register_hint(
     portal_base_url: str,
     custom_redirect_uri: Optional[str],
     wrote_portal_url: bool,
-    public_url: str = "",
 ) -> None:
     """Print the success summary + the gate-engagement caveat."""
     from hermes_cli.config import get_env_path
 
     env_path = get_env_path()
-    _cid = client_id
     print()
     print(f"  Wrote to {env_path}:")
-    print("    HERMES_DASHBOARD_OAUTH_CLIENT_ID=" + str(_cid))
+    print(f"    HERMES_DASHBOARD_OAUTH_CLIENT_ID={client_id}")
     if wrote_portal_url:
-        print("    HERMES_DASHBOARD_PORTAL_URL=" + str(portal_base_url))
-    if public_url:
-        print("    HERMES_DASHBOARD_PUBLIC_URL=" + str(public_url))
+        print(f"    HERMES_DASHBOARD_PORTAL_URL={portal_base_url}")
     print()
     print(
         "  Heads up — Nous login only *engages* on a non-loopback bind. A plain\n"
@@ -261,48 +240,12 @@ def cmd_dashboard_register(args) -> None:
 
     # Portal override: explicit --portal-url flag wins, else the
     # HERMES_DASHBOARD_PORTAL_URL env var, else the stored login's portal.
-    #
-    # We track whether a custom URL was *explicitly supplied* (flag or env)
-    # separately from the resolved value. An explicit custom URL is an
-    # intentional choice the user wants to persist (and update in place if it
-    # already exists in .env); a portal merely inferred from the stored login
-    # keeps the older, more conservative write-only-if-absent behaviour so we
-    # don't clutter .env for the common production case.
     portal_override = getattr(args, "portal_url", None) or os.environ.get(
         "HERMES_DASHBOARD_PORTAL_URL"
     )
-    custom_portal_supplied = bool(
-        isinstance(portal_override, str) and portal_override.strip()
-    )
     portal_base_url = _resolve_portal_base_url(portal_override)
 
-    # Idempotency: if this install already registered a dashboard, we hold its
-    # client_id locally (HERMES_DASHBOARD_OAUTH_CLIENT_ID). Re-send it so the
-    # portal UPDATES that existing record instead of creating a duplicate. No
-    # stored client_id -> this is a first registration -> create a fresh one
-    # (the original behavior). This mirrors the portal's rule: no client id =
-    # new dashboard; client id present = the stable key of the row to modify.
-    existing_client_id = None
-    try:
-        existing_client_id = get_env_value("HERMES_DASHBOARD_OAUTH_CLIENT_ID")
-    except Exception:
-        existing_client_id = None
-    if isinstance(existing_client_id, str):
-        existing_client_id = existing_client_id.strip() or None
-    else:
-        existing_client_id = None
-
-    explicit_name = getattr(args, "name", None)
-    # Auto-generate a random name ONLY for a first registration. On a re-run
-    # (we hold a client_id) without an explicit --name, keep the name the
-    # portal already stored rather than churning it to a new random value
-    # every time — so leave `name` unset and let the portal preserve it.
-    if explicit_name:
-        name = explicit_name
-    elif existing_client_id:
-        name = None
-    else:
-        name = _generate_dashboard_name()
+    name = getattr(args, "name", None) or _generate_dashboard_name()
     custom_redirect_uri = getattr(args, "redirect_uri", None)
 
     # 2. Register with the portal.
@@ -312,26 +255,20 @@ def cmd_dashboard_register(args) -> None:
             portal_base_url=portal_base_url,
             name=name,
             custom_redirect_uri=custom_redirect_uri,
-            existing_client_id=existing_client_id,
         )
     except RuntimeError as exc:
         print(f"✗ Registration failed: {exc}")
         sys.exit(1)
 
     client_id = str(result["client_id"])
-    registered_name = str(result.get("name") or name or "")
+    registered_name = str(result.get("name") or name)
 
-    # Distinguish create vs update for the user: the portal echoes back the
-    # same client_id we sent when it updated in place.
-    updated_existing = bool(
-        existing_client_id and client_id == existing_client_id
-    )
-    if updated_existing:
-        print(f'✓ Updated dashboard "{registered_name}"')
-    else:
-        print(f'✓ Registered dashboard "{registered_name}"')
+    print(f'✓ Registered dashboard "{registered_name}"')
 
-    # 3. Write env vars idempotently. Always set the client_id.
+    # 3. Write env vars idempotently. Always set the client_id. Only set the
+    #    portal URL when it isn't already configured (env or config) AND differs
+    #    from the production default, so we don't clutter .env for the common case
+    #    but DO persist a non-default portal (e.g. a preview deploy used in dev).
     try:
         save_env_value("HERMES_DASHBOARD_OAUTH_CLIENT_ID", client_id)
     except Exception as exc:
@@ -339,18 +276,6 @@ def cmd_dashboard_register(args) -> None:
         print(f"  Set it manually:  HERMES_DASHBOARD_OAUTH_CLIENT_ID={client_id}")
         sys.exit(1)
 
-    # Persist the portal URL. Two cases:
-    #   a) The user explicitly supplied a custom portal (--portal-url flag or
-    #      HERMES_DASHBOARD_PORTAL_URL env). That's an intentional choice we
-    #      always persist so it survives across sessions — overwriting any
-    #      existing entry in place (save_env_value updates a matching key
-    #      rather than appending a duplicate). This is true even when it equals
-    #      the production default: the user asked for it explicitly.
-    #   b) No custom portal was supplied. Keep the older conservative behaviour:
-    #      only write a portal inferred from the stored login when it isn't
-    #      already configured AND differs from the production default, so we
-    #      don't clutter .env for the common production case and don't alter an
-    #      existing entry unexpectedly.
     wrote_portal_url = False
     default_portal = "https://portal.nousresearch.com"
     existing_portal = None
@@ -358,15 +283,7 @@ def cmd_dashboard_register(args) -> None:
         existing_portal = get_env_value("HERMES_DASHBOARD_PORTAL_URL")
     except Exception:
         existing_portal = None
-
-    if custom_portal_supplied:
-        should_write_portal = existing_portal != portal_base_url
-    else:
-        should_write_portal = (
-            not existing_portal and portal_base_url.rstrip("/") != default_portal
-        )
-
-    if should_write_portal:
+    if not existing_portal and portal_base_url.rstrip("/") != default_portal:
         try:
             save_env_value("HERMES_DASHBOARD_PORTAL_URL", portal_base_url)
             wrote_portal_url = True
@@ -374,54 +291,10 @@ def cmd_dashboard_register(args) -> None:
             # Non-fatal: the client_id is the load-bearing value.
             pass
 
-    # Persist the dashboard public URL derived from the OAuth redirect URI.
-    #
-    # --redirect-uri is the full public HTTPS callback the user registered with
-    # the portal, e.g. https://hermes.example.com/auth/callback. At serve time
-    # the dashboard auth layer (dashboard_auth/routes._redirect_uri) reconstructs
-    # that same callback by taking HERMES_DASHBOARD_PUBLIC_URL and appending
-    # "/auth/callback" verbatim. So the value the runtime actually consumes is
-    # the ORIGIN (scheme://host[:port]), not the full callback path — persisting
-    # the raw redirect URI would double up the path. We derive the origin from
-    # the supplied redirect URI and persist it as HERMES_DASHBOARD_PUBLIC_URL so
-    # the operator doesn't have to re-supply it and the public-URL override is
-    # actually wired (the gate engages and the callback round-trips correctly).
-    #
-    # Like the portal URL, an explicitly supplied value is always written
-    # (updating an existing entry in place rather than appending a duplicate),
-    # a no-op when it already matches, and never written on a localhost-only
-    # install (no --redirect-uri).
-    wrote_public_url = False
-    public_url = ""
-    if custom_redirect_uri:
-        try:
-            from urllib.parse import urlparse
-
-            parsed = urlparse(custom_redirect_uri)
-            if parsed.scheme in ("http", "https") and parsed.netloc:
-                public_url = f"{parsed.scheme}://{parsed.netloc}"
-        except Exception:
-            public_url = ""
-
-    if public_url:
-        existing_public_url = None
-        try:
-            existing_public_url = get_env_value("HERMES_DASHBOARD_PUBLIC_URL")
-        except Exception:
-            existing_public_url = None
-        if existing_public_url != public_url:
-            try:
-                save_env_value("HERMES_DASHBOARD_PUBLIC_URL", public_url)
-                wrote_public_url = True
-            except Exception:
-                # Non-fatal: the client_id is the load-bearing value.
-                pass
-
     # 4. Hint.
     _print_post_register_hint(
         client_id=client_id,
         portal_base_url=portal_base_url,
         custom_redirect_uri=custom_redirect_uri,
         wrote_portal_url=wrote_portal_url,
-        public_url=public_url if wrote_public_url else "",
     )

hermes_cli/doctor.py

@@ -738,14 +738,11 @@ def run_doctor(args):
                         issues,
                     )
 
-            # Warn if model is set to a provider-prefixed name on a provider that doesn't use them.
-            # Vendor/model slugs are valid on aggregator-style providers and on any custom
-            # provider — bare "custom" or a named "custom:<name>" that fronts an OpenAI-compatible
-            # aggregator (e.g. custom:hpc-ai serving deepseek/deepseek-v4-flash) requires the prefix.
+            # Warn if model is set to a provider-prefixed name on a provider that doesn't use them
             provider_for_policy = runtime_provider or catalog_provider
-            provider_policy_id = str(provider_for_policy or "").strip().lower()
             providers_accepting_vendor_slugs = {
                 "openrouter",
+                "custom",
                 "auto",
                 "kilocode",
                 "opencode-zen",
@@ -753,16 +750,11 @@ def run_doctor(args):
                 "lmstudio",
                 "nous",
             }
-            provider_accepts_vendor_slug = (
-                provider_policy_id in providers_accepting_vendor_slugs
-                or provider_policy_id == "custom"
-                or provider_policy_id.startswith("custom:")
-            )
             if (
                 default_model
                 and "/" in default_model
-                and provider_policy_id
-                and not provider_accepts_vendor_slug
+                and provider_for_policy
+                and provider_for_policy not in providers_accepting_vendor_slugs
             ):
                 check_warn(
                     f"model.default '{default_model}' uses a vendor/model slug but provider is '{provider_raw}'",

hermes_cli/main.py

@@ -1825,11 +1825,6 @@ def _launch_tui(
     import tempfile
 
     env = os.environ.copy()
-    try:
-        from hermes_cli.config import apply_terminal_config_to_env
-        apply_terminal_config_to_env(env=env)
-    except Exception:
-        logger.debug("Failed to apply terminal config bridge for TUI launch", exc_info=True)
     active_session_fd, active_session_file = tempfile.mkstemp(
         prefix="hermes-tui-active-session-", suffix=".json"
     )
@@ -5811,16 +5806,6 @@ def _update_via_zip(args):
     except Exception:
         pass
 
-    # Seed the model-catalog disk cache from the freshly-unpacked checkout
-    # (same rationale as the git-pull path in _cmd_update_impl). Non-fatal.
-    try:
-        from hermes_cli.model_catalog import seed_cache_from_checkout
-
-        if seed_cache_from_checkout(PROJECT_ROOT):
-            print("  ✓ Model catalog cache refreshed from checkout")
-    except Exception as e:
-        logger.debug("Model catalog seed during zip update failed: %s", e)
-
     print()
     print("✓ Update complete!")
     try:
@@ -8380,22 +8365,6 @@ def _cmd_update_impl(args, gateway_mode: bool):
         print()
         print("✓ Code updated!")
 
-        # Seed the model-catalog disk cache from the freshly-pulled checkout.
-        # The repo ships the canonical catalog at
-        # website/static/api/model-catalog.json, and `git pull` just made it
-        # current — so copy it straight over ~/.hermes/cache/model_catalog.json
-        # instead of waiting on a network fetch (which can be bot-gated or hit a
-        # Portal hiccup). Keeps the model picker's curated/free lists in sync
-        # with the version the user just installed. Non-fatal on failure: the
-        # normal network refresh still applies on the next picker open.
-        try:
-            from hermes_cli.model_catalog import seed_cache_from_checkout
-
-            if seed_cache_from_checkout(PROJECT_ROOT):
-                print("  ✓ Model catalog cache refreshed from checkout")
-        except Exception as e:
-            logger.debug("Model catalog seed during update failed: %s", e)
-
         # After git pull, source files on disk are newer than cached Python
         # modules in this process.  Reload hermes_constants so that any lazy
         # import executed below (skills sync, gateway restart) sees new

hermes_cli/model_catalog.py

@@ -356,37 +356,6 @@ def get_curated_nous_models() -> list[str] | None:
     return out or None
 
 
-def seed_cache_from_checkout(project_root: "Path | str") -> bool:
-    """Overwrite the disk cache with the catalog shipped in a local checkout.
-
-    ``hermes update`` pulls the latest repo, so the freshly-pulled
-    ``website/static/api/model-catalog.json`` IS the newest catalog — no
-    network round-trip needed. Copying it straight over the disk cache keeps
-    the model picker current even when the remote manifest fetch is bot-gated
-    or the Portal hiccups.
-
-    Reads the shipped manifest, validates it against the schema, and writes it
-    to ``~/.hermes/cache/model_catalog.json`` via the same atomic writer the
-    network path uses. Returns ``True`` on success, ``False`` if the file is
-    missing, malformed, or fails validation (caller should treat a ``False``
-    as non-fatal — the network fetch path still applies on the next picker
-    open).
-    """
-    src = Path(project_root) / "website" / "static" / "api" / "model-catalog.json"
-    try:
-        with open(src, encoding="utf-8") as fh:
-            data = json.load(fh)
-    except (OSError, json.JSONDecodeError) as exc:
-        logger.debug("model catalog seed from checkout skipped (%s): %s", src, exc)
-        return False
-    if not _validate_manifest(data):
-        logger.debug("model catalog seed from checkout skipped: invalid manifest at %s", src)
-        return False
-    _write_disk_cache(data)
-    reset_cache()  # drop the in-process copy so the next read picks up the seed
-    return True
-
-
 def reset_cache() -> None:
     """Clear the in-process cache. Used by tests and ``hermes model --refresh``."""
     global _catalog_cache, _catalog_cache_source_mtime

hermes_cli/models.py

@@ -73,10 +73,8 @@ OPENROUTER_MODELS: list[tuple[str, str]] = [
     # Free tier
     ("openrouter/elephant-alpha",              "free"),
     ("openrouter/owl-alpha",                   "free"),
-    ("poolside/laguna-m.1:free",               "free"),
     ("tencent/hy3-preview:free",               "free"),
     ("nvidia/nemotron-3-super-120b-a12b:free", "free"),
-    ("nvidia/nemotron-3-ultra-550b-a55b:free", "free"),
     ("inclusionai/ring-2.6-1t:free",           "free"),
 ]
 
@@ -766,64 +764,6 @@ _NOUS_RECOMMENDED_CACHE_TTL: int = 600  # seconds (10 minutes)
 _nous_recommended_cache: dict[str, tuple[dict[str, Any], float]] = {}
 
 
-def _nous_recommended_disk_path() -> "Path":
-    """Disk path for the persisted recommended-models cache."""
-    from hermes_constants import get_hermes_home
-    return get_hermes_home() / "cache" / "nous_recommended_cache.json"
-
-
-def _read_nous_recommended_disk(base: str) -> dict[str, Any] | None:
-    """Return the last-known-good payload for ``base`` from disk, or None.
-
-    The disk file is a JSON object keyed by portal base URL so staging and
-    prod don't collide:
-    ``{"<base>": {"data": {...}, "ts": <epoch_seconds>}}``.
-    """
-    try:
-        with open(_nous_recommended_disk_path(), encoding="utf-8") as fh:
-            blob = json.load(fh)
-    except (OSError, json.JSONDecodeError):
-        return None
-    if not isinstance(blob, dict):
-        return None
-    entry = blob.get(base)
-    if not isinstance(entry, dict):
-        return None
-    data = entry.get("data")
-    return data if isinstance(data, dict) and data else None
-
-
-def _write_nous_recommended_disk(base: str, data: dict[str, Any]) -> None:
-    """Persist ``data`` as the last-known-good payload for ``base``.
-
-    Merges into any existing per-base map, then writes atomically. Failures
-    are non-fatal (logged at debug) — the in-process cache still works.
-    """
-    if not data:
-        return
-    path = _nous_recommended_disk_path()
-    try:
-        try:
-            with open(path, encoding="utf-8") as fh:
-                blob = json.load(fh)
-            if not isinstance(blob, dict):
-                blob = {}
-        except (OSError, json.JSONDecodeError):
-            blob = {}
-        blob[base] = {"data": data, "ts": time.time()}
-        path.parent.mkdir(parents=True, exist_ok=True)
-        tmp = path.with_suffix(path.suffix + ".tmp")
-        with open(tmp, "w", encoding="utf-8") as fh:
-            json.dump(blob, fh, indent=2)
-            fh.write("\n")
-        os.replace(tmp, path)
-    except OSError as exc:
-        import logging
-        logging.getLogger(__name__).debug(
-            "nous recommended-models disk cache write failed: %s", exc
-        )
-
-
 def fetch_nous_recommended_models(
     portal_base_url: str = "",
     timeout: float = 5.0,
@@ -834,19 +774,12 @@ def fetch_nous_recommended_models(
 
     Hits ``<portal>/api/nous/recommended-models``. The endpoint is public —
     no auth is required. Results are cached per portal URL for
-    ``_NOUS_RECOMMENDED_CACHE_TTL`` seconds in process; pass
-    ``force_refresh=True`` to bypass the in-process cache.
+    ``_NOUS_RECOMMENDED_CACHE_TTL`` seconds; pass ``force_refresh=True`` to
+    bypass the cache.
 
-    A successful live fetch is also persisted to a per-base disk cache
-    (``$HERMES_HOME/cache/nous_recommended_cache.json``) as last-known-good.
-    When the live fetch fails (network, parse, non-2xx) and the in-process
-    cache is empty, the disk copy is returned instead of ``{}`` — so a
-    transient Portal hiccup no longer silently drops the free/paid model
-    recommendations from the picker. Self-heals on the next successful fetch.
-
-    Returns the parsed JSON dict, or ``{}`` only when neither the network nor
-    any cache layer can supply data. Callers must treat missing/null fields
-    as "no recommendation" and fall back to their own default.
+    Returns the parsed JSON dict on success, or ``{}`` on any failure
+    (network, parse, non-2xx). Callers must treat missing/null fields as
+    "no recommendation" and fall back to their own default.
     """
     base = (portal_base_url or "https://portal.nousresearch.com").rstrip("/")
     now = time.monotonic()
@@ -869,19 +802,6 @@ def fetch_nous_recommended_models(
     except Exception:
         data = {}
 
-    if data:
-        # Live fetch succeeded — refresh both cache layers.
-        _nous_recommended_cache[base] = (data, now)
-        _write_nous_recommended_disk(base, data)
-        return data
-
-    # Live fetch failed. Fall back to the last-known-good disk copy so a
-    # transient Portal hiccup doesn't drop the recommendations entirely.
-    disk = _read_nous_recommended_disk(base)
-    if disk:
-        _nous_recommended_cache[base] = (disk, now)
-        return disk
-
     _nous_recommended_cache[base] = (data, now)
     return data
 

hermes_cli/plugins_cmd.py

@@ -135,34 +135,89 @@ def _sanitize_plugin_name(
     return target
 
 
-def _resolve_git_url(identifier: str) -> str:
-    """Turn an identifier into a cloneable Git URL.
+def _resolve_git_url(identifier: str) -> tuple[str, Optional[str]]:
+    """Turn an identifier into a cloneable Git URL and optional subdirectory.
+
+    Returns ``(git_url, subdir)`` where ``subdir`` is the path within the
+    cloned repository that contains the plugin (``None`` when the plugin lives
+    at the repo root).
 
     Accepted formats:
     - Full URL: https://github.com/owner/repo.git
     - Full URL: git@github.com:owner/repo.git
     - Full URL: ssh://git@github.com/owner/repo.git
     - Shorthand: owner/repo  →  https://github.com/owner/repo.git
+    - Shorthand w/ subdir: owner/repo/path/to/plugin
+      →  (https://github.com/owner/repo.git, "path/to/plugin")
+    - Full URL w/ subdir (``.git`` boundary):
+      https://github.com/owner/repo.git/path/to/plugin
+      →  (https://github.com/owner/repo.git, "path/to/plugin")
+    - Any URL w/ explicit subdir fragment (works for every scheme, incl.
+      ``file://`` and ssh): <url>#path/to/plugin
+      →  (<url>, "path/to/plugin")
 
     NOTE: ``http://`` and ``file://`` schemes are accepted but will trigger a
     security warning at install time.
     """
-    # Already a URL
+    # Already a URL.
     if identifier.startswith(("https://", "http://", "git@", "ssh://", "file://")):
-        return identifier
+        # Explicit ``#subdir`` fragment — unambiguous for any scheme.
+        if "#" in identifier:
+            git_url, _, frag = identifier.partition("#")
+            return git_url, (frag.strip("/") or None)
+        # Natural ``.git/`` boundary (GitHub-style URLs).
+        marker = ".git/"
+        idx = identifier.find(marker)
+        if idx != -1:
+            git_url = identifier[: idx + len(".git")]
+            subdir = identifier[idx + len(marker) :].strip("/")
+            return git_url, (subdir or None)
+        return identifier, None
 
-    # owner/repo shorthand
-    parts = identifier.strip("/").split("/")
-    if len(parts) == 2:
-        owner, repo = parts
-        return f"https://github.com/{owner}/{repo}.git"
+    # owner/repo[/subdir...] shorthand
+    parts = [p for p in identifier.strip("/").split("/") if p]
+    if len(parts) >= 2:
+        owner, repo = parts[0], parts[1]
+        subdir = "/".join(parts[2:]).strip("/")
+        git_url = f"https://github.com/{owner}/{repo}.git"
+        return git_url, (subdir or None)
 
     raise ValueError(
         f"Invalid plugin identifier: '{identifier}'. "
-        "Use a Git URL or owner/repo shorthand."
+        "Use a Git URL or 'owner/repo' shorthand (optionally with a subdirectory: "
+        "'owner/repo/path/to/plugin')."
     )
 
 
+def _resolve_subdir_within(clone_root: Path, subdir: str) -> Path:
+    """Resolve ``subdir`` inside ``clone_root``, rejecting path traversal.
+
+    Guards against ``..`` segments, absolute paths, and symlinks that would
+    escape the cloned repository. Returns the resolved directory path.
+    Raises ``PluginOperationError`` if the path escapes the clone, doesn't
+    exist, or is not a directory.
+    """
+    clone_root = clone_root.resolve()
+    candidate = (clone_root / subdir).resolve()
+
+    # The resolved candidate must stay within the clone root.
+    if candidate != clone_root and clone_root not in candidate.parents:
+        raise PluginOperationError(
+            f"Plugin subdirectory '{subdir}' escapes the repository.",
+        )
+
+    if not candidate.exists():
+        raise PluginOperationError(
+            f"Plugin subdirectory '{subdir}' does not exist in the repository.",
+        )
+    if not candidate.is_dir():
+        raise PluginOperationError(
+            f"Plugin subdirectory '{subdir}' is not a directory.",
+        )
+
+    return candidate
+
+
 def _repo_name_from_url(url: str) -> str:
     """Extract the repo name from a Git URL for the plugin directory name."""
     # Strip trailing .git and slashes
@@ -372,14 +427,14 @@ def _install_plugin_core(identifier: str, *, force: bool) -> tuple[Path, dict, s
     import tempfile
 
     try:
-        git_url = _resolve_git_url(identifier)
+        git_url, subdir = _resolve_git_url(identifier)
     except ValueError as e:
         raise PluginOperationError(str(e)) from e
 
     plugins_dir = _plugins_dir()
 
     with tempfile.TemporaryDirectory() as tmp:
-        tmp_target = Path(tmp) / "plugin"
+        tmp_clone = Path(tmp) / "plugin"
 
         git_exe = _resolve_git_executable()
         if not git_exe:
@@ -387,7 +442,7 @@ def _install_plugin_core(identifier: str, *, force: bool) -> tuple[Path, dict, s
 
         try:
             result = subprocess.run(
-                [git_exe, "clone", "--depth", "1", git_url, str(tmp_target)],
+                [git_exe, "clone", "--depth", "1", git_url, str(tmp_clone)],
                 capture_output=True,
                 text=True,
                 timeout=60,
@@ -405,8 +460,16 @@ def _install_plugin_core(identifier: str, *, force: bool) -> tuple[Path, dict, s
             err = (result.stderr or result.stdout or "").strip()
             raise PluginOperationError(f"Git clone failed:\n{err}")
 
+        # Resolve the directory within the clone that holds the plugin.
+        if subdir:
+            tmp_target = _resolve_subdir_within(tmp_clone, subdir)
+        else:
+            tmp_target = tmp_clone
+
         manifest = _read_manifest(tmp_target)
-        plugin_name = manifest.get("name") or _repo_name_from_url(git_url)
+        plugin_name = manifest.get("name") or (
+            subdir.rstrip("/").rsplit("/", 1)[-1] if subdir else _repo_name_from_url(git_url)
+        )
 
         try:
             target = _sanitize_plugin_name(plugin_name, plugins_dir)
@@ -471,7 +534,7 @@ def cmd_install(
     console = Console()
 
     try:
-        git_url = _resolve_git_url(identifier)
+        git_url, _subdir = _resolve_git_url(identifier)
     except ValueError as e:
         console.print(f"[red]Error:[/red] {e}")
         sys.exit(1)
@@ -482,7 +545,10 @@ def cmd_install(
             "Consider using https:// or git@ for production installs.",
         )
 
-    console.print(f"[dim]Cloning {git_url}...[/dim]")
+    if _subdir:
+        console.print(f"[dim]Cloning {git_url} (subdir: {_subdir})...[/dim]")
+    else:
+        console.print(f"[dim]Cloning {git_url}...[/dim]")
 
     try:
         target, installed_manifest, installed_name = _install_plugin_core(
@@ -1473,7 +1539,7 @@ def dashboard_install_plugin(
     """Non-interactive install for the web dashboard. Returns a JSON-serializable dict."""
     warnings: list[str] = []
     try:
-        git_url = _resolve_git_url(identifier)
+        git_url, _subdir = _resolve_git_url(identifier)
         if git_url.startswith(("http://", "file://")):
             warnings.append(
                 "Insecure URL scheme; prefer https:// or git@ for production installs.",

hermes_cli/providers.py

@@ -492,10 +492,7 @@ def get_label(provider_id: str) -> str:
 
 def is_aggregator(provider: str) -> bool:
     """Return True when the provider is a multi-model aggregator."""
-    provider_norm = normalize_provider(provider or "")
-    if provider_norm.startswith("custom:"):
-        return True
-    pdef = get_provider(provider_norm)
+    pdef = get_provider(provider)
     return pdef.is_aggregator if pdef else False
 
 

hermes_cli/web_server.py

@@ -8573,11 +8573,6 @@ def _resolve_chat_argv(
 
     argv, cwd = _make_tui_argv(PROJECT_ROOT / "ui-tui", tui_dev=False)
     env = os.environ.copy()
-    try:
-        from hermes_cli.config import apply_terminal_config_to_env
-        apply_terminal_config_to_env(env=env)
-    except Exception:
-        _log.debug("Failed to apply terminal config bridge for dashboard chat", exc_info=True)
     env.setdefault("NODE_ENV", "production")
     # Browser-embedded chat should prefer stable wheel-based scrollback over
     # native terminal mouse tracking. When mouse tracking is enabled, wheel

plugins/google_meet/audio_bridge.py

@@ -86,7 +86,6 @@ class AudioBridge:
                         ["pactl", "unload-module", str(mod_id)],
                         check=False,
                         capture_output=True,
-                        stdin=subprocess.DEVNULL,
                     )
                 except Exception:
                     # Best-effort teardown — never raise from here.
@@ -112,7 +111,6 @@ class AudioBridge:
                 check=True,
                 capture_output=True,
                 text=True,
-                stdin=subprocess.DEVNULL,
             )
         except FileNotFoundError as exc:
             raise RuntimeError(
@@ -137,7 +135,6 @@ class AudioBridge:
                 check=True,
                 capture_output=True,
                 text=True,
-                stdin=subprocess.DEVNULL,
             )
         except subprocess.CalledProcessError as exc:
             # Roll back the null-sink we just created so we don't leak it.
@@ -145,7 +142,6 @@ class AudioBridge:
                 ["pactl", "unload-module", str(sink_mod_id)],
                 check=False,
                 capture_output=True,
-                stdin=subprocess.DEVNULL,
             )
             raise RuntimeError(
                 f"pactl load-module virtual-source failed: {exc.stderr or exc}"

plugins/memory/byterover/__init__.py

@@ -94,7 +94,6 @@ def _run_brv(args: List[str], timeout: int = _QUERY_TIMEOUT,
         result = subprocess.run(
             cmd, capture_output=True, text=True,
             timeout=timeout, cwd=effective_cwd, env=env,
-            stdin=subprocess.DEVNULL,
         )
         stdout = result.stdout.strip()
         stderr = result.stderr.strip()

plugins/memory/hindsight/__init__.py

@@ -695,7 +695,6 @@ class HindsightMemoryProvider(MemoryProvider):
                 subprocess.run(
                     [uv_path, "pip", "install", "--python", sys.executable, "--quiet", "--upgrade"] + deps_to_install,
                     check=True, timeout=120, capture_output=True,
-                    stdin=subprocess.DEVNULL,
                 )
                 print("  ✓ Dependencies up to date")
             except Exception as e:
@@ -1102,7 +1101,6 @@ class HindsightMemoryProvider(MemoryProvider):
                             [uv_path, "pip", "install", "--python", sys.executable,
                              "--quiet", "--upgrade", f"hindsight-client>={_MIN_CLIENT_VERSION}"],
                             check=True, timeout=120, capture_output=True,
-                            stdin=subprocess.DEVNULL,
                         )
                         logger.info("hindsight-client upgraded to >=%s", _MIN_CLIENT_VERSION)
                     except Exception as e:

plugins/memory/honcho/cli.py

@@ -416,7 +416,6 @@ def _ensure_sdk_installed() -> bool:
         [sys.executable, "-m", "pip", "install", "honcho-ai>=2.0.1"],
         capture_output=True,
         text=True,
-        stdin=subprocess.DEVNULL,
     )
     if result.returncode == 0:
         print("  Installed.\n")

plugins/memory/honcho/client.py

@@ -628,7 +628,6 @@ class HonchoClientConfig:
             root = subprocess.run(
                 ["git", "rev-parse", "--show-toplevel"],
                 capture_output=True, text=True, cwd=cwd, timeout=5,
-                stdin=subprocess.DEVNULL,
             )
             if root.returncode == 0:
                 return Path(root.stdout.strip()).name

plugins/platforms/discord/adapter.py

@@ -520,7 +520,6 @@ class VoiceReceiver:
                 ],
                 check=True,
                 timeout=10,
-                stdin=subprocess.DEVNULL,
             )
         finally:
             try:

plugins/platforms/discord/voice_mixer.py

@@ -320,7 +320,6 @@ def decode_to_pcm(path: str, *, timeout: float = 30.0) -> Optional[bytes]:
             ],
             capture_output=True,
             timeout=timeout,
-            stdin=subprocess.DEVNULL,
         )
     except (subprocess.TimeoutExpired, FileNotFoundError, OSError) as e:
         logger.warning("decode_to_pcm failed for %s: %s", path, e)

plugins/platforms/photon/README.md

@@ -1,137 +1,123 @@
 # Photon iMessage platform plugin
 
-This plugin connects Hermes Agent to iMessage (and other Spectrum
-interfaces) through [Photon][photon] — a managed service that handles
-iMessage line allocation, delivery, and abuse-prevention so users don't
-have to run their own Mac relay.
+This plugin connects Hermes Agent to iMessage (and WhatsApp Business +
+future Spectrum interfaces) through [Photon][photon] — a managed
+service that handles the iMessage line allocation, delivery, and
+abuse-prevention layer so users don't have to run their own Mac
+relay.
 
-The free tier uses Photon's shared iMessage line pool and is the path we
-recommend for everyone who doesn't already pay for a dedicated number.
+The free tier uses Photon's shared iMessage line pool (`type: shared`)
+and is the path we recommend for everyone who doesn't already pay for a
+dedicated number.
 
 ## Architecture
 
-Like Discord and Slack, Photon is a **persistent-connection** channel — no
-public URL, no webhook, no signing secret. The `spectrum-ts` SDK holds a
-long-lived **gRPC stream** to Photon for both directions. Because the SDK is
-TypeScript-only, Hermes runs it inside a small supervised Node sidecar and
-talks to it over loopback.
-
 ```
-                         gRPC (spectrum-ts)
-┌─────────────────────────┐ ◄───────────────► ┌──────────────────────┐
-│  Photon Spectrum cloud  │   app.messages    │  Node sidecar        │
-│  (iMessage line owner)  │   space.send()    │  (plugins/…/sidecar) │
-└─────────────────────────┘                   └──────────┬───────────┘
-                                       GET /inbound (NDJSON) │  ▲ POST /send
-                                       inbound events        ▼  │ /typing
-                                              ┌──────────────────────┐
-                                              │  PhotonAdapter        │
-                                              │  (Python, in gateway) │
-                                              └──────────────────────┘
+┌─────────────────────────┐    HMAC-signed POSTs      ┌──────────────────┐
+│  Photon Spectrum cloud  │ ──────────────────────►   │  Hermes Agent    │
+│  (iMessage line owner)  │                           │  (Python)        │
+└─────────────────────────┘    JSON over loopback     │                  │
+        ▲                  ◄──────────────────────    │  PhotonAdapter   │
+        │                                             │  + aiohttp recv  │
+        │  spectrum-ts                                │                  │
+        │  SDK (Node)                                 │  spawns + super- │
+        ▼                                             │  vises ▼         │
+┌─────────────────────────┐                           ├──────────────────┤
+│  Node sidecar           │   ◄────  X-Hermes-      ─ │  Node sidecar    │
+│  (plugins/.../sidecar)  │       Sidecar-Token       │  child process   │
+└─────────────────────────┘                           └──────────────────┘
 ```
 
-- **Inbound**: the sidecar consumes the SDK's `app.messages` gRPC stream,
-  normalizes each message, and streams it to the adapter over a loopback
-  `GET /inbound` (NDJSON). The adapter dedupes on `messageId` and dispatches
-  a `MessageEvent` to the gateway. It reconnects automatically if the stream
-  drops; the sidecar owns the gRPC reconnect to Photon.
-- **Outbound**: `send` / `send_typing` are loopback POSTs to the sidecar,
-  authenticated with a shared `X-Hermes-Sidecar-Token`.
+Inbound traffic is webhook-only — Hermes runs an aiohttp listener
+that verifies `X-Spectrum-Signature` and dedupes on `message.id`.
+
+Outbound traffic goes through a tiny Node sidecar that runs the
+`spectrum-ts` SDK. Photon does not currently expose an HTTP
+send-message endpoint; their own docs say:
+
+> Pass `space.id` to `Space.send(...)` from a separate `spectrum-ts`
+> SDK instance to reply. **No public HTTP send endpoint exists today.**
+> — https://photon.codes/docs/webhooks/events
+
+When Photon ships an HTTP send endpoint, `_sidecar_send` is the one
+function that swaps and the sidecar disappears. The rest of the
+plugin stays the same.
 
 ## First-time setup
 
 ```bash
-# One-shot setup: device login (opens browser) + project + user + sidecar deps
+# 1. One-shot setup: device login (opens browser) + project + user + sidecar deps
 hermes photon setup --phone +15551234567
 
-# Start the gateway
+# 2. Expose your webhook URL to the public internet
+#    (cloudflared, ngrok, your gateway's public hostname, etc.)
+#    Then register it with Photon:
+hermes photon webhook register https://your-host.example.com/photon/webhook
+
+# 3. Save the signing secret it prints to ~/.hermes/.env
+#    as PHOTON_WEBHOOK_SECRET=...
+#    Photon only returns it ONCE.
+
+# 4. Start the gateway
 hermes gateway start --platform photon
 ```
 
-`hermes photon setup` does, in order:
-
-1. **Device login** (RFC 8628, `client_id=photon-cli`) — opens
-   `https://app.photon.codes/` for approval and stores the bearer token.
-2. **Find or create** the `Hermes Agent` project on the Photon dashboard.
-3. **Enable Spectrum**, read the project's `spectrumProjectId`, rotate the
-   project secret, and persist both.
-4. **Register your phone number** as a Spectrum user (idempotent — skipped if
-   a user with that number already exists).
-5. **Print the assigned iMessage line** — the number you text to reach your
-   agent.
-6. **Install the sidecar deps** (`spectrum-ts`).
-
-There is no separate `login` command; like every other Hermes channel,
-onboarding goes through one setup surface. Re-running `setup` reuses an
-existing token/project, so it's safe to run again to finish a partial setup.
-Run `hermes photon status` to see what's configured.
+`hermes photon setup` runs the RFC 8628 device-code login as its first
+step — it opens `https://app.photon.codes/` for approval, then
+provisions the Spectrum project + iMessage line. There is no separate
+`login` command; like every other Hermes channel, onboarding goes
+through one setup surface. Re-running `setup` reuses an existing token
+and project, so it's safe to run again to finish a partial setup.
 
 ## Credentials
 
-Runtime SDK credentials live in `~/.hermes/.env` (the same place every other
-channel keeps its token), and the adapter reads them from the environment:
-
-```bash
-PHOTON_PROJECT_ID=<spectrumProjectId>   # the SDK's projectId
-PHOTON_PROJECT_SECRET=<projectSecret>
-```
-
-Management metadata lives in `~/.hermes/auth.json` under `credential_pool`:
+Stored in `~/.hermes/auth.json` under `credential_pool`:
 
 ```jsonc
 {
   "credential_pool": {
     "photon": [
-      { "access_token": "<device-bearer>", "issued_at": ... }
+      { "access_token": "<dashboard-bearer>", "issued_at": ... }
     ],
     "photon_project": [
-      {
-        "dashboard_project_id": "<dashboard id>",
-        "spectrum_project_id": "<spectrumProjectId>",
-        "project_secret": "<projectSecret>",
-        "name": "Hermes Agent"
-      }
+      { "project_id": "...", "project_secret": "...", "name": "Hermes Agent" }
     ]
   }
 }
 ```
 
-> **Note on ids.** A Photon project has two identifiers: the dashboard `id`
-> (used for management API calls) and the `spectrumProjectId` (what the SDK
-> authenticates with). `PHOTON_PROJECT_ID` is the **spectrum** id.
+The per-URL webhook signing secret is treated like an API key and
+lives in `~/.hermes/.env` as `PHOTON_WEBHOOK_SECRET`.
 
 ## Configuration knobs
 
-All env vars are documented in `plugin.yaml`. The most important:
+All env vars are documented in `plugin.yaml`. The most important are:
 
-| Env var                   | Default                    | Meaning                              |
-|---------------------------|----------------------------|--------------------------------------|
-| `PHOTON_PROJECT_ID`       | from .env / auth.json      | Spectrum project id (SDK `projectId`)|
-| `PHOTON_PROJECT_SECRET`   | from .env / auth.json      | Project secret                       |
-| `PHOTON_SIDECAR_PORT`     | 8789                       | Loopback port for the sidecar        |
-| `PHOTON_SIDECAR_AUTOSTART`| true                       | Spawn the sidecar on connect         |
-| `PHOTON_DASHBOARD_HOST`   | https://app.photon.codes   | Dashboard API host                   |
-| `PHOTON_SPECTRUM_HOST`    | https://spectrum.photon.codes | Spectrum API host                 |
-| `PHOTON_HOME_CHANNEL`     | your number (set by setup) | Default space for cron delivery — a space id, or a bare E.164 number (resolved to a DM) |
-| `PHOTON_ALLOWED_USERS`    | your number (set by setup) | Comma-separated E.164 allowlist      |
-| `PHOTON_REQUIRE_MENTION`  | false                      | Gate group chats on a wake word      |
-| `PHOTON_MAX_INLINE_ATTACHMENT_BYTES` | 20 MB           | Max inbound attachment size the sidecar reads & inlines |
+| Env var                  | Default            | Meaning                                 |
+|--------------------------|--------------------|-----------------------------------------|
+| `PHOTON_PROJECT_ID`      | from auth.json     | Spectrum project ID                     |
+| `PHOTON_PROJECT_SECRET`  | from auth.json     | Spectrum project secret (HTTP Basic)    |
+| `PHOTON_WEBHOOK_SECRET`  | (unset)            | Signing secret returned at register     |
+| `PHOTON_WEBHOOK_PORT`    | 8788               | Local port for the aiohttp listener     |
+| `PHOTON_WEBHOOK_PATH`    | /photon/webhook    | Path under which the listener mounts    |
+| `PHOTON_SIDECAR_PORT`    | 8789               | Loopback port for sidecar control      |
+| `PHOTON_HOME_CHANNEL`    | (unset)            | Default space ID for cron delivery     |
+| `PHOTON_ALLOWED_USERS`   | (unset)            | Comma-separated E.164 allowlist        |
 
-## Attachments & limitations
+## Limitations (current Photon API)
 
-- **Inbound attachments and voice notes are downloaded.** The sidecar reads
-  the bytes (`content.read()`) and base64-inlines them on the NDJSON event; the
-  adapter caches them to the shared media cache and populates `media_urls` /
-  `media_types`, so the agent sees the real image/file or can transcribe the
-  voice note — parity with the BlueBubbles iMessage channel. Media larger than
-  `PHOTON_MAX_INLINE_ATTACHMENT_BYTES` (default 20 MB), or any byte read that
-  fails, falls back to a text marker (`[Photon attachment received: …]` or
-  `[Photon voice received: …]`) so the agent still knows something arrived.
-- **Outbound attachments are supported.** Images, voice notes, video, and
-  documents are sent via `space.send(attachment(...))` /
+- **Inbound attachments are metadata only.** Inbound webhooks include the
+  filename + MIME type but no download URL. The plugin surfaces a
+  text marker (`[Photon attachment received: …]`) so the agent knows
+  something arrived, but cannot read the bytes.  Photon's docs note
+  an attachment retrieval endpoint is on the roadmap.
+- **Outbound attachments are supported.** Images, voice notes, video,
+  and documents are sent via `space.send(attachment(...))` /
   `space.send(voice(...))` through the sidecar's `/send-attachment`
-  endpoint; a caption is delivered as a separate text bubble after the media.
-- **Reactions, message effects, polls** — supported by `spectrum-ts` but not
-  yet exposed; the sidecar is the natural place to add them.
+  endpoint. A caption is delivered as a separate text bubble after the
+  media.
+- **Reactions, message effects, polls** — not exposed yet; the
+  `spectrum-ts` SDK supports them, and the sidecar is the natural
+  place to add them when the agent has reason to use them.
 
 [photon]: https://photon.codes/

plugins/platforms/photon/adapter.py

@@ -1,30 +1,32 @@
 """
 Photon Spectrum (iMessage) platform adapter for Hermes Agent.
 
-Both directions of traffic flow through a small supervised Node sidecar
-(see ``sidecar/index.mjs``) that runs the ``spectrum-ts`` SDK — the SDK is
-TypeScript-only and there is no public HTTP message API, so a sidecar is
-unavoidable.
-
 Inbound:
-    The SDK's ``app.messages`` is a long-lived **gRPC** stream. The sidecar
-    serializes each message to a normalized JSON event and streams it to this
-    adapter over a loopback ``GET /inbound`` (NDJSON). A background task here
-    consumes that stream, dedupes on ``messageId``, and dispatches a
-    ``MessageEvent`` to the gateway via ``BasePlatformAdapter.handle_message``.
-    No webhook, no public URL, no signing secret.
+    Photon delivers signed JSON ``POST``s to a URL we register.  The
+    adapter spins up an aiohttp server on ``PHOTON_WEBHOOK_PORT``,
+    verifies ``X-Spectrum-Signature`` (HMAC-SHA256 of
+    ``v0:{timestamp}:{body}`` keyed by the per-URL signing secret),
+    rejects deliveries with a timestamp drift > 5 minutes, dedupes on
+    ``message.id``, and dispatches a normalized ``MessageEvent`` to the
+    gateway runner via ``BasePlatformAdapter.handle_message``.
 
 Outbound:
-    ``send`` / ``send_typing`` are loopback POSTs to the sidecar's control
-    endpoints, authenticated with a shared bearer token.  Outbound media
-    (images, voice notes, video, documents) goes through spectrum-ts'
-    ``attachment()`` / ``voice()`` content builders via the sidecar's
-    ``/send-attachment`` endpoint.
+    Photon does not currently expose a public HTTP send-message
+    endpoint, so the adapter spawns a small Node sidecar (see
+    ``sidecar/index.mjs``) that runs the ``spectrum-ts`` SDK.  Each
+    ``send`` / ``send_typing`` / attachment call from Hermes is a
+    loopback POST to the sidecar with a shared bearer token.  Outbound
+    media (images, voice notes, video, documents) goes through
+    spectrum-ts' ``attachment()`` / ``voice()`` content builders.
+
+When Photon ships an HTTP send endpoint we can collapse the sidecar
+into ``_send_via_http`` and drop the Node dependency entirely.
 """
 from __future__ import annotations
 
 import asyncio
-import base64
+import hashlib
+import hmac
 import json
 import logging
 import os
@@ -37,21 +39,21 @@ import sys
 import time
 from datetime import datetime, timezone
 from pathlib import Path
-from typing import TYPE_CHECKING, Any, Dict, List, Optional
+from typing import Any, Dict, Optional
 
-if TYPE_CHECKING:
-    # Type checkers see ``httpx`` as the always-imported module, so every use
-    # site type-checks cleanly. The runtime fallback below keeps the optional
-    # dependency truly optional (each use site is guarded by HTTPX_AVAILABLE).
+try:
     import httpx
     HTTPX_AVAILABLE = True
-else:
-    try:
-        import httpx
-        HTTPX_AVAILABLE = True
-    except ImportError:  # pragma: no cover - httpx is already a Hermes dep
-        HTTPX_AVAILABLE = False
-        httpx = None
+except ImportError:  # pragma: no cover - httpx is already a Hermes dep
+    HTTPX_AVAILABLE = False
+    httpx = None  # type: ignore[assignment]
+
+try:
+    from aiohttp import web
+    AIOHTTP_AVAILABLE = True
+except ImportError:
+    AIOHTTP_AVAILABLE = False
+    web = None  # type: ignore[assignment]
 
 from gateway.config import Platform, PlatformConfig
 from gateway.platforms.base import (
@@ -60,15 +62,22 @@ from gateway.platforms.base import (
     MessageType,
     SendResult,
 )
-from gateway.platforms.helpers import strip_markdown
 
-from .auth import load_project_credentials
+from .auth import (
+    DEFAULT_SPECTRUM_HOST,
+    load_project_credentials,
+    _spectrum_host,
+)
 
 logger = logging.getLogger(__name__)
 
 # ---------------------------------------------------------------------------
 # Constants
 
+_DEFAULT_WEBHOOK_PORT = 8788
+_DEFAULT_WEBHOOK_PATH = "/photon/webhook"
+_DEFAULT_WEBHOOK_BIND = "0.0.0.0"
+
 _DEFAULT_SIDECAR_PORT = 8789
 _DEFAULT_SIDECAR_BIND = "127.0.0.1"
 
@@ -77,8 +86,11 @@ _DEFAULT_SIDECAR_BIND = "127.0.0.1"
 # size to ~16 KB.  Keep a conservative cap that matches BlueBubbles.
 _MAX_MESSAGE_LENGTH = 8000
 
-# Dedup parameters — the gRPC stream is at-least-once, and a sidecar
-# reconnect can replay, so keep at least 1k ids for ~48h.
+# Spec says reject deliveries older than ~5 minutes for replay protection.
+_TIMESTAMP_DRIFT_SECONDS = 300
+
+# Dedup parameters — keep at least 1k IDs for ~48h per Photon's
+# at-least-once guidance.
 _DEDUP_MAX_SIZE = 4000
 _DEDUP_WINDOW_SECONDS = 48 * 3600
 
@@ -106,7 +118,7 @@ def _coerce_port(value: Any, default: int) -> int:
 
 def check_requirements() -> bool:
     """Return True when both Python deps and the Node sidecar are available."""
-    if not HTTPX_AVAILABLE:
+    if not HTTPX_AVAILABLE or not AIOHTTP_AVAILABLE:
         return False
     if not shutil.which(os.getenv("PHOTON_NODE_BIN") or "node"):
         return False
@@ -134,33 +146,61 @@ def is_connected(cfg: PlatformConfig) -> bool:
 
 
 def _env_enablement() -> Optional[dict]:
-    """Seed PlatformConfig.extra from env so env-only setups appear in status.
-
-    The special ``home_channel`` key is handled by the core plugin hook and
-    becomes a proper ``HomeChannel`` on ``PlatformConfig``.
-    """
+    """Seed PlatformConfig.extra from env so env-only setups appear in status."""
     project_id, project_secret = load_project_credentials()
     if not (project_id and project_secret):
         return None
-    seed = {"project_id": project_id, "project_secret": project_secret}
-    home = os.getenv("PHOTON_HOME_CHANNEL", "").strip()
-    if home:
-        seed["home_channel"] = {
-            "chat_id": home,
-            "name": os.getenv("PHOTON_HOME_CHANNEL_NAME", "Home"),
-        }
-    return seed
+    return {
+        "project_id": project_id,
+        "project_secret": project_secret,
+        "webhook_port": _coerce_port(os.getenv("PHOTON_WEBHOOK_PORT"), _DEFAULT_WEBHOOK_PORT),
+        "webhook_path": os.getenv("PHOTON_WEBHOOK_PATH") or _DEFAULT_WEBHOOK_PATH,
+    }
+
+
+# ---------------------------------------------------------------------------
+# Signature verification
+
+def verify_signature(
+    *,
+    body: bytes,
+    timestamp_header: str,
+    signature_header: str,
+    signing_secret: str,
+    now: Optional[float] = None,
+    drift: int = _TIMESTAMP_DRIFT_SECONDS,
+) -> bool:
+    """Constant-time verify a Photon webhook signature.
+
+    Returns True iff the timestamp is within ``drift`` of *now* AND
+    ``signature_header == "v0=" + hmac_sha256(secret, "v0:{ts}:{body}")``.
+
+    Exposed at module scope so tests can exercise it without an adapter
+    instance.
+    """
+    if not timestamp_header or not signature_header or not signing_secret:
+        return False
+    try:
+        ts = int(timestamp_header)
+    except ValueError:
+        return False
+    if abs((now or time.time()) - ts) > drift:
+        return False
+    if not signature_header.startswith("v0="):
+        return False
+    expected = hmac.new(
+        signing_secret.encode("utf-8"),
+        f"v0:{ts}:".encode("utf-8") + body,
+        hashlib.sha256,
+    ).hexdigest()
+    return hmac.compare_digest(expected, signature_header[3:])
 
 
 # ---------------------------------------------------------------------------
 # Adapter
 
 class PhotonAdapter(BasePlatformAdapter):
-    """Bidirectional bridge to Photon Spectrum via the Node spectrum-ts sidecar.
-
-    Inbound: consume the sidecar's ``/inbound`` gRPC stream.
-    Outbound: loopback POSTs to the sidecar's control channel.
-    """
+    """Inbound: signed webhook on aiohttp. Outbound: Node sidecar via loopback HTTP."""
 
     MAX_MESSAGE_LENGTH = _MAX_MESSAGE_LENGTH
 
@@ -169,8 +209,6 @@ class PhotonAdapter(BasePlatformAdapter):
         extra = config.extra or {}
 
         # Project credentials (env wins, then config.extra, then auth.json).
-        # ``project_id`` here is the project's spectrumProjectId — the value
-        # the spectrum-ts SDK authenticates with.
         stored_id, stored_sec = load_project_credentials()
         self._project_id: str = (
             os.getenv("PHOTON_PROJECT_ID")
@@ -185,6 +223,27 @@ class PhotonAdapter(BasePlatformAdapter):
             or ""
         )
 
+        # Webhook receiver
+        self._webhook_port = _coerce_port(
+            extra.get("webhook_port") or os.getenv("PHOTON_WEBHOOK_PORT"),
+            _DEFAULT_WEBHOOK_PORT,
+        )
+        self._webhook_path = (
+            extra.get("webhook_path")
+            or os.getenv("PHOTON_WEBHOOK_PATH")
+            or _DEFAULT_WEBHOOK_PATH
+        )
+        self._webhook_bind = (
+            extra.get("webhook_bind")
+            or os.getenv("PHOTON_WEBHOOK_BIND")
+            or _DEFAULT_WEBHOOK_BIND
+        )
+        self._webhook_secret: str = (
+            os.getenv("PHOTON_WEBHOOK_SECRET")
+            or extra.get("webhook_secret")
+            or ""
+        )
+
         # Sidecar
         self._sidecar_port = _coerce_port(
             extra.get("sidecar_port") or os.getenv("PHOTON_SIDECAR_PORT"),
@@ -200,13 +259,12 @@ class PhotonAdapter(BasePlatformAdapter):
         self._node_bin = os.getenv("PHOTON_NODE_BIN") or shutil.which("node") or "node"
 
         # Runtime state
+        self._runner: Optional["web.AppRunner"] = None
         self._sidecar_proc: Optional[subprocess.Popen] = None
         self._sidecar_supervisor_task: Optional[asyncio.Task] = None
-        self._inbound_task: Optional[asyncio.Task] = None
-        self._inbound_running = False
         self._http_client: Optional["httpx.AsyncClient"] = None
-        # Lightweight in-memory dedup. The gRPC stream is at-least-once, so we
-        # may see the same messageId more than once (e.g. after a reconnect).
+        # Lightweight in-memory dedup. Photon's at-least-once guarantee
+        # means we WILL see the same message.id more than once.
         self._seen_messages: Dict[str, float] = {}
 
         # Group-chat mention gating (parity with BlueBubbles). When enabled,
@@ -287,6 +345,13 @@ class PhotonAdapter(BasePlatformAdapter):
     # -- Connection lifecycle ---------------------------------------------
 
     async def connect(self) -> bool:
+        if not AIOHTTP_AVAILABLE:
+            self._set_fatal_error(
+                "MISSING_DEP",
+                "aiohttp not installed. Run: pip install aiohttp",
+                retryable=False,
+            )
+            return False
         if not HTTPX_AVAILABLE:
             self._set_fatal_error(
                 "MISSING_DEP", "httpx not installed", retryable=False
@@ -301,11 +366,19 @@ class PhotonAdapter(BasePlatformAdapter):
             )
             return False
 
-        client = httpx.AsyncClient(timeout=30.0)
-        self._http_client = client
+        # Start the aiohttp receiver first; without it the sidecar would
+        # be able to forward inbound traffic to a closed port.
+        try:
+            await self._start_webhook_server()
+        except OSError as e:
+            self._set_fatal_error(
+                "PORT_IN_USE",
+                f"webhook port {self._webhook_port} unavailable: {e}",
+                retryable=True,
+            )
+            return False
 
-        # The sidecar holds the gRPC stream for BOTH directions, so it is
-        # required now (not just for outbound).
+        # Spin up the Node sidecar (required for outbound).
         if self._autostart_sidecar:
             try:
                 await self._start_sidecar()
@@ -315,39 +388,23 @@ class PhotonAdapter(BasePlatformAdapter):
                     f"failed to start Photon sidecar: {e}",
                     retryable=True,
                 )
-                await client.aclose()
-                self._http_client = None
+                await self._stop_webhook_server()
                 return False
         else:
-            logger.warning(
-                "[photon] sidecar autostart disabled — inbound + outbound will fail"
-            )
-
-        # Start consuming the inbound gRPC stream from the sidecar.
-        self._inbound_running = True
-        self._inbound_task = asyncio.get_event_loop().create_task(
-            self._inbound_loop()
-        )
+            logger.info("[photon] sidecar autostart disabled — outbound will fail")
 
+        self._http_client = httpx.AsyncClient(timeout=30.0)
         self._mark_connected()
         logger.info(
-            "[photon] connected — sidecar on %s:%d, streaming inbound over gRPC",
+            "[photon] connected — webhook at %s:%d%s, sidecar on %s:%d",
+            self._webhook_bind, self._webhook_port, self._webhook_path,
             self._sidecar_bind, self._sidecar_port,
         )
         return True
 
     async def disconnect(self) -> None:
-        self._inbound_running = False
-        if self._inbound_task is not None:
-            self._inbound_task.cancel()
-            try:
-                await self._inbound_task
-            except asyncio.CancelledError:
-                pass
-            except Exception:
-                pass
-            self._inbound_task = None
         await self._stop_sidecar()
+        await self._stop_webhook_server()
         if self._http_client is not None:
             try:
                 await self._http_client.aclose()
@@ -356,61 +413,68 @@ class PhotonAdapter(BasePlatformAdapter):
             self._http_client = None
         self._mark_disconnected()
 
-    # -- Inbound stream consumer ------------------------------------------
+    # -- Webhook server ----------------------------------------------------
 
-    async def _inbound_loop(self) -> None:
-        """Consume the sidecar's ``/inbound`` NDJSON stream, with reconnect.
+    async def _start_webhook_server(self) -> None:
+        app = web.Application()
+        app.router.add_post(self._webhook_path, self._handle_webhook)
+        app.router.add_get("/healthz", lambda _: web.Response(text="ok"))
+        self._runner = web.AppRunner(app)
+        await self._runner.setup()
+        site = web.TCPSite(self._runner, self._webhook_bind, self._webhook_port)
+        await site.start()
 
-        The sidecar owns the gRPC reconnect/heartbeat to Photon; this loop
-        only has to re-open the loopback HTTP stream if it drops (e.g. the
-        sidecar restarts).
-        """
-        client = self._http_client
-        if client is None:
-            return
-        url = f"http://{self._sidecar_bind}:{self._sidecar_port}/inbound"
-        headers = {"X-Hermes-Sidecar-Token": self._sidecar_token}
-        backoff = 1.0
-        while self._inbound_running:
+    async def _stop_webhook_server(self) -> None:
+        if self._runner is not None:
             try:
-                async with client.stream(
-                    "GET", url, headers=headers, timeout=None,
-                ) as resp:
-                    if resp.status_code != 200:
-                        raise RuntimeError(f"/inbound returned {resp.status_code}")
-                    backoff = 1.0  # reset on a successful connect
-                    async for line in resp.aiter_lines():
-                        if not self._inbound_running:
-                            break
-                        line = line.strip()
-                        if not line:
-                            continue  # heartbeat
-                        await self._on_inbound_line(line)
-            except asyncio.CancelledError:
-                raise
-            except Exception as e:
-                if not self._inbound_running:
-                    break
-                logger.warning(
-                    "[photon] inbound stream dropped (%s); reconnecting in %.1fs",
-                    e, backoff,
-                )
-                await asyncio.sleep(backoff)
-                backoff = min(backoff * 2, 30.0)
+                await self._runner.cleanup()
+            except Exception:
+                pass
+            self._runner = None
+
+    async def _handle_webhook(self, request: "web.Request") -> "web.Response":
+        body = await request.read()
+        if self._webhook_secret:
+            ts = request.headers.get("X-Spectrum-Timestamp", "")
+            sig = request.headers.get("X-Spectrum-Signature", "")
+            if not verify_signature(
+                body=body,
+                timestamp_header=ts,
+                signature_header=sig,
+                signing_secret=self._webhook_secret,
+            ):
+                logger.warning("[photon] rejected webhook with bad signature")
+                return web.Response(status=401, text="invalid signature")
+        else:
+            logger.warning(
+                "[photon] PHOTON_WEBHOOK_SECRET unset — accepting unsigned "
+                "deliveries. Set the per-URL signing secret returned by "
+                "register-webhook to enable verification."
+            )
 
-    async def _on_inbound_line(self, line: str) -> None:
         try:
-            event = json.loads(line)
+            payload = json.loads(body or b"{}")
         except json.JSONDecodeError:
-            logger.debug("[photon] skipping non-JSON inbound line")
-            return
-        msg_id = event.get("messageId")
-        if msg_id and self._is_duplicate(msg_id):
-            return
+            return web.Response(status=400, text="invalid json")
+        if payload.get("event") != "messages":
+            # Photon currently emits only `messages`; any future event
+            # types are ack'd 200 so they don't retry.
+            return web.Response(text="ok")
+
+        msg = payload.get("message") or {}
+        msg_id = msg.get("id")
+        if not msg_id:
+            return web.Response(status=400, text="missing message.id")
+        if self._is_duplicate(msg_id):
+            return web.Response(text="ok (dup)")
+
         try:
-            await self._dispatch_inbound(event)
+            await self._dispatch_inbound(payload)
         except Exception:
             logger.exception("[photon] inbound dispatch failed")
+            # 200 anyway — we own the dedup; failing here would cause
+            # Photon to retry the same id.
+        return web.Response(text="ok")
 
     def _is_duplicate(self, msg_id: str) -> bool:
         now = time.time()
@@ -424,94 +488,44 @@ class PhotonAdapter(BasePlatformAdapter):
         self._seen_messages[msg_id] = now
         return False
 
-    async def _dispatch_inbound(self, event: Dict[str, Any]) -> None:
-        """Normalize a sidecar inbound event and dispatch it to the gateway.
-
-        Event shape (from ``sidecar/index.mjs``)::
-
-            {
-              "messageId": "...",
-              "platform": "iMessage",
-              "space": {"id": "...", "type": "dm"|"group", "phone": "+E164"},
-              "sender": {"id": "+E164"},
-              "content": {"type": "text", "text": "..."}
-                       | {"type": "attachment"|"voice", "id", "name",
-                          "mimeType", "size", "duration"?, "data"?,
-                          "encoding"?},
-              "timestamp": "2026-05-14T19:06:32.000Z"
-
-        Attachment and voice content carry the bytes inline as base64 ``data``
-        (with ``encoding == "base64"``) when the sidecar could read them
-        within its size cap; otherwise only metadata is present and we surface
-        a marker.
-            }
-        """
-        space = event.get("space") or {}
-        sender = event.get("sender") or {}
-        content = event.get("content") or {}
+    async def _dispatch_inbound(self, payload: Dict[str, Any]) -> None:
+        msg = payload.get("message") or {}
+        space = msg.get("space") or payload.get("space") or {}
+        sender = msg.get("sender") or {}
+        content = msg.get("content") or {}
 
         space_id = space.get("id") or ""
+        sender_id = sender.get("id") or ""
         if not space_id:
             logger.warning("[photon] inbound missing space.id")
             return
 
-        # iMessage spaces carry their type directly — no id string-sniffing.
-        chat_type = "group" if space.get("type") == "group" else "dm"
-        sender_id = sender.get("id") or space.get("phone") or space_id
+        # Space type — Photon documents iMessage DM ids as `any;-;+E164`
+        # and group ids as `any;+;<chat-guid>`.  Use that as the
+        # heuristic; everything else is treated as DM.
+        chat_type = "group" if ";+;" in space_id else "dm"
 
-        ts_str = event.get("timestamp") or ""
+        # Timestamp — ISO 8601 from the platform.
+        ts_str = msg.get("timestamp") or ""
         try:
-            timestamp = (
-                datetime.fromisoformat(ts_str.replace("Z", "+00:00"))
-                if ts_str
-                else datetime.now(tz=timezone.utc)
-            )
+            timestamp = datetime.fromisoformat(ts_str.replace("Z", "+00:00"))
         except ValueError:
             timestamp = datetime.now(tz=timezone.utc)
 
-        # Media attachments (local cached paths) handed to the agent via the
-        # gateway's image-routing path, exactly like the BlueBubbles channel.
-        media_urls: List[str] = []
-        media_types: List[str] = []
-
-        ctype = content.get("type")
-        if ctype == "text":
+        # Content normalization.  Spectrum is a discriminated union;
+        # text vs attachment metadata.  Attachments are metadata-only
+        # today (no download URL) — log + carry the name so the agent
+        # at least knows something was sent.
+        if content.get("type") == "text":
             text = content.get("text") or ""
             mtype = MessageType.TEXT
-        elif ctype in {"attachment", "voice"}:
-            is_voice = ctype == "voice"
-            name = content.get("name") or ("voice" if is_voice else "(unnamed)")
+        elif content.get("type") == "attachment":
+            name = content.get("name") or "(unnamed)"
             mime = content.get("mimeType") or ""
-            mtype = MessageType.VOICE if is_voice else _attachment_message_type(mime)
-            cached = _cache_inbound_attachment(
-                content, name, mime, force_audio=is_voice
-            )
-            if cached:
-                media_urls.append(cached)
-                media_types.append(
-                    mime or ("audio/mp4" if is_voice else "application/octet-stream")
-                )
-                # The real bytes are attached, so the agent sees the media
-                # itself — a short marker is enough text, and it keeps group
-                # mention-gating consistent with plain messages.
-                text = "(voice)" if is_voice else "(attachment)"
-            else:
-                # No bytes (over the sidecar cap, a failed read, or a caching
-                # failure) — fall back to a metadata marker so the agent still
-                # knows something arrived.
-                label = "voice" if is_voice else "attachment"
-                duration = content.get("duration")
-                duration_text = (
-                    f", duration: {duration}s"
-                    if isinstance(duration, (int, float))
-                    else ""
-                )
-                text = (
-                    f"[Photon {label} received: {name} "
-                    f"({mime or 'unknown MIME'}{duration_text})]"
-                )
+            text = f"[Photon attachment received: {name} ({mime}) — no download URL yet]"
+            mtype = _attachment_message_type(mime)
         else:
-            text = f"[Photon content type not handled: {ctype}]"
+            text = f"[Photon content type not handled: {content.get('type')}]"
             mtype = MessageType.TEXT
 
         # Group-mention gating (parity with BlueBubbles). In group chats with
@@ -531,20 +545,18 @@ class PhotonAdapter(BasePlatformAdapter):
             chat_id=space_id,
             chat_name=space_id,
             chat_type=chat_type,
-            user_id=sender_id,
+            user_id=sender_id or space_id,
             user_name=sender_id or None,
         )
-        message_event = MessageEvent(
+        event = MessageEvent(
             text=text,
             message_type=mtype,
             source=source,
-            message_id=event.get("messageId"),
-            raw_message=event,
+            message_id=msg.get("id"),
+            raw_message=payload,
             timestamp=timestamp,
-            media_urls=media_urls,
-            media_types=media_types,
         )
-        await self.handle_message(message_event)
+        await self.handle_message(event)
 
     # -- Sidecar lifecycle -------------------------------------------------
 
@@ -658,7 +670,7 @@ class PhotonAdapter(BasePlatformAdapter):
         reply_to: Optional[str] = None,
         metadata: Optional[Dict[str, Any]] = None,
     ) -> SendResult:
-        return await self._sidecar_send(chat_id, self.format_message(content))
+        return await self._sidecar_send(chat_id, content, reply_to=reply_to)
 
     # -- Outbound media (parity with the BlueBubbles iMessage channel) -----
     #
@@ -684,7 +696,7 @@ class PhotonAdapter(BasePlatformAdapter):
             # Couldn't fetch the URL — fall back to sending it as text.
             return await super().send_image(chat_id, image_url, caption, reply_to)
         return await self._sidecar_send_attachment(
-            chat_id, local_path, caption=caption,
+            chat_id, local_path, caption=caption, reply_to=reply_to,
         )
 
     async def send_image_file(
@@ -697,7 +709,7 @@ class PhotonAdapter(BasePlatformAdapter):
         **kwargs,
     ) -> SendResult:
         return await self._sidecar_send_attachment(
-            chat_id, image_path, caption=caption,
+            chat_id, image_path, caption=caption, reply_to=reply_to,
         )
 
     async def send_voice(
@@ -710,7 +722,7 @@ class PhotonAdapter(BasePlatformAdapter):
         **kwargs,
     ) -> SendResult:
         return await self._sidecar_send_attachment(
-            chat_id, audio_path, caption=caption, kind="voice",
+            chat_id, audio_path, caption=caption, reply_to=reply_to, kind="voice",
         )
 
     async def send_video(
@@ -723,7 +735,7 @@ class PhotonAdapter(BasePlatformAdapter):
         **kwargs,
     ) -> SendResult:
         return await self._sidecar_send_attachment(
-            chat_id, video_path, caption=caption,
+            chat_id, video_path, caption=caption, reply_to=reply_to,
         )
 
     async def send_document(
@@ -737,7 +749,7 @@ class PhotonAdapter(BasePlatformAdapter):
         **kwargs,
     ) -> SendResult:
         return await self._sidecar_send_attachment(
-            chat_id, file_path, name=file_name, caption=caption,
+            chat_id, file_path, name=file_name, caption=caption, reply_to=reply_to,
         )
 
     async def send_animation(
@@ -755,97 +767,23 @@ class PhotonAdapter(BasePlatformAdapter):
 
     async def send_typing(self, chat_id: str, metadata=None) -> None:
         try:
-            await self._sidecar_call(
-                "/typing", {"spaceId": chat_id, "state": "start"}
-            )
+            await self._sidecar_call("/typing", {"spaceId": chat_id})
         except Exception as e:
             logger.debug("[photon] send_typing failed: %s", e)
 
-    async def stop_typing(self, chat_id: str) -> None:
-        try:
-            await self._sidecar_call(
-                "/typing", {"spaceId": chat_id, "state": "stop"}
-            )
-        except Exception as e:
-            logger.debug("[photon] stop_typing failed: %s", e)
-
     async def get_chat_info(self, chat_id: str) -> Dict[str, Any]:
         """Return whatever we know about a Spectrum space id.
 
-        Photon's ``space.id`` is opaque; the inbound event also carries the
-        DM/group type, but here we only have the id, so infer conservatively.
+        Photon's `space.id` is opaque (`any;-;+E164` for DMs,
+        `any;+;<guid>` for groups). We surface that shape directly so
+        the gateway has something to show in session pickers / logs.
         """
-        return {"name": chat_id, "type": "dm", "id": chat_id}
+        chat_type = "group" if ";+;" in chat_id else "dm"
+        return {"name": chat_id, "type": chat_type, "id": chat_id}
 
-    def format_message(self, content: str) -> str:
-        return strip_markdown(content)
-
-    async def _send_with_retry(
-        self,
-        chat_id: str,
-        content: str,
-        reply_to: Optional[str] = None,
-        metadata: Any = None,
-        max_retries: int = 2,
-        base_delay: float = 2.0,
+    async def _sidecar_send(
+        self, space_id: str, text: str, *, reply_to: Optional[str] = None,
     ) -> SendResult:
-        """Photon/iMessage is plain text, so never show the generic Markdown banner."""
-        text = self.format_message(content)
-        result = await self.send(
-            chat_id=chat_id,
-            content=text,
-            reply_to=reply_to,
-            metadata=metadata,
-        )
-        if result.success:
-            return result
-
-        error_str = result.error or ""
-        is_network = result.retryable or self._is_retryable_error(error_str)
-        if not is_network and self._is_timeout_error(error_str):
-            return result
-
-        if is_network:
-            for attempt in range(1, max_retries + 1):
-                delay = base_delay * (2 ** (attempt - 1))
-                logger.warning(
-                    "[photon] Send failed (attempt %d/%d, retrying in %.1fs): %s",
-                    attempt, max_retries, delay, error_str,
-                )
-                await asyncio.sleep(delay)
-                result = await self.send(
-                    chat_id=chat_id,
-                    content=text,
-                    reply_to=reply_to,
-                    metadata=metadata,
-                )
-                if result.success:
-                    return result
-                error_str = result.error or ""
-                if not (result.retryable or self._is_retryable_error(error_str)):
-                    break
-            else:
-                logger.error(
-                    "[photon] Failed to deliver response after %d retries: %s",
-                    max_retries, error_str,
-                )
-                return result
-
-        logger.warning(
-            "[photon] Send failed: %s - retrying plain-text message",
-            error_str,
-        )
-        fallback_result = await self.send(
-            chat_id=chat_id,
-            content=text[: self.MAX_MESSAGE_LENGTH],
-            reply_to=reply_to,
-            metadata=metadata,
-        )
-        if not fallback_result.success:
-            logger.error("[photon] Plain-text retry also failed: %s", fallback_result.error)
-        return fallback_result
-
-    async def _sidecar_send(self, space_id: str, text: str) -> SendResult:
         if len(text) > self.MAX_MESSAGE_LENGTH:
             logger.warning(
                 "[photon] truncating outbound from %d to %d chars",
@@ -853,6 +791,8 @@ class PhotonAdapter(BasePlatformAdapter):
             )
             text = text[: self.MAX_MESSAGE_LENGTH]
         body: Dict[str, Any] = {"spaceId": space_id, "text": text}
+        if reply_to:
+            body["replyTo"] = reply_to
         try:
             data = await self._sidecar_call("/send", body)
         except Exception as e:
@@ -867,6 +807,7 @@ class PhotonAdapter(BasePlatformAdapter):
         name: Optional[str] = None,
         mime_type: Optional[str] = None,
         caption: Optional[str] = None,
+        reply_to: Optional[str] = None,
         kind: str = "attachment",
     ) -> SendResult:
         """POST a local file to the sidecar's ``/send-attachment`` endpoint.
@@ -901,6 +842,8 @@ class PhotonAdapter(BasePlatformAdapter):
             body["mimeType"] = mime_type
         if caption:
             body["caption"] = caption
+        if reply_to:
+            body["replyTo"] = reply_to
         try:
             data = await self._sidecar_call("/send-attachment", body)
         except Exception as e:
@@ -944,87 +887,11 @@ def _attachment_message_type(mime: str) -> MessageType:
     return MessageType.DOCUMENT
 
 
-# MIME → file-extension maps for caching inbound attachment bytes. These mirror
-# the BlueBubbles iMessage channel so both adapters name cached media the same.
-_IMAGE_EXT_BY_MIME = {
-    "image/jpeg": ".jpg",
-    "image/png": ".png",
-    "image/gif": ".gif",
-    "image/webp": ".webp",
-    "image/heic": ".jpg",
-    "image/heif": ".jpg",
-    "image/tiff": ".jpg",
-}
-_AUDIO_EXT_BY_MIME = {
-    "audio/mp3": ".mp3",
-    "audio/mpeg": ".mp3",
-    "audio/ogg": ".ogg",
-    "audio/wav": ".wav",
-    "audio/x-caf": ".mp3",
-    "audio/mp4": ".m4a",
-    "audio/aac": ".m4a",
-}
-
-
-def _cache_inbound_attachment(
-    content: Dict[str, Any],
-    name: str,
-    mime: str,
-    *,
-    force_audio: bool = False,
-) -> Optional[str]:
-    """Decode a base64-inlined inbound attachment and cache it locally.
-
-    The sidecar inlines the attachment bytes as ``content["data"]`` (base64).
-    We decode them and route to the shared media cache by MIME type, returning
-    the cached absolute path so the caller can populate ``media_urls`` (which
-    the gateway then hands to the model). Returns ``None`` when there are no
-    bytes (over the sidecar's inline cap or a failed read) or when caching
-    fails, so the caller can fall back to a text marker.
-    """
-    data_b64 = content.get("data")
-    if not data_b64:
-        return None
-    try:
-        raw = base64.b64decode(data_b64)
-    except (ValueError, TypeError) as exc:
-        logger.warning("[photon] failed to decode inbound attachment bytes: %s", exc)
-        return None
-
-    from gateway.platforms.base import (
-        cache_audio_from_bytes,
-        cache_document_from_bytes,
-        cache_image_from_bytes,
-    )
-
-    mime = (mime or "").lower()
-    # Prefer the real extension from the filename; fall back to the MIME map.
-    suffix = Path(name).suffix if name else ""
-    try:
-        if mime.startswith("image/"):
-            ext = suffix or _IMAGE_EXT_BY_MIME.get(mime, ".jpg")
-            try:
-                return cache_image_from_bytes(raw, ext)
-            except ValueError:
-                # Bytes don't look like a supported image (e.g. HEIC magic) —
-                # still deliver them as a document rather than dropping them.
-                return cache_document_from_bytes(raw, name)
-        if force_audio or mime.startswith("audio/"):
-            ext = suffix or _AUDIO_EXT_BY_MIME.get(
-                mime, ".m4a" if force_audio else ".mp3"
-            )
-            return cache_audio_from_bytes(raw, ext)
-        # Video, application/*, and everything else → document cache.
-        return cache_document_from_bytes(raw, name)
-    except Exception as exc:
-        logger.warning("[photon] failed to cache inbound attachment %s: %s", name, exc)
-        return None
-
-
 # ---------------------------------------------------------------------------
 # Standalone (out-of-process) send for cron deliveries when the gateway
-# is not co-resident.  Reuses a live sidecar already listening on the
-# configured port (cron processes cannot spawn the sidecar themselves).
+# is not co-resident.  Spins up an ephemeral sidecar call by spawning
+# the existing sidecar binary one-shot; if a live sidecar is already
+# listening on the configured port we reuse it.
 
 async def _standalone_send(
     pconfig: PlatformConfig,
@@ -1113,7 +980,7 @@ def register(ctx) -> None:
 
     ctx.register_platform(
         name="photon",
-        label="iMessage via Photon",
+        label="Photon iMessage",
         adapter_factory=lambda cfg: PhotonAdapter(cfg),
         check_fn=check_requirements,
         validate_config=validate_config,
@@ -1144,7 +1011,7 @@ def register(ctx) -> None:
             "Treat replies like regular text messages — short, friendly, no "
             "markdown rendering. Recipient identifiers are E.164 phone "
             "numbers; never expose them in responses unless the user asked. "
-            "Attachments arrive as metadata only."
+            "Attachments arrive as metadata only (no download URL yet)."
         ),
     )
 

plugins/platforms/photon/cli.py

@@ -7,26 +7,25 @@ Subcommands:
     setup              full first-time setup (device login + project + user + sidecar)
     status             show login + project + sidecar dep state
     install-sidecar    npm install inside plugins/platforms/photon/sidecar/
+    webhook register   register the local webhook URL with Photon
+    webhook list       list registered webhooks
+    webhook delete     delete a webhook by id
 
 The device-code login runs automatically as the first step of ``setup``;
 there is no standalone ``login`` verb (matching how every other Hermes
 gateway channel onboards through a single setup surface).
-
-Photon uses the spectrum-ts gRPC stream for inbound — there is no webhook
-to register, so there are no webhook subcommands.
 """
 from __future__ import annotations
 
 import argparse
 import getpass
+import json
 import os
 import shutil
 import subprocess
 import sys
 from pathlib import Path
 
-from hermes_cli.colors import Colors, color
-
 from . import auth as photon_auth
 
 _SIDECAR_DIR = Path(__file__).parent / "sidecar"
@@ -39,14 +38,9 @@ def register_cli(parser: argparse.ArgumentParser) -> None:
     """Wire up `hermes photon ...` subcommands."""
     subs = parser.add_subparsers(dest="photon_command", required=False)
 
-    p_setup = subs.add_parser(
-        "setup",
-        help="First-time setup (device login + project + user + sidecar)",
-    )
-    p_setup.add_argument("--project-name", default=None,
-                         help="Project name (default: 'Hermes Agent')")
-    p_setup.add_argument("--phone", default=None,
-                         help="Your E.164 phone number (e.g. +15551234567)")
+    p_setup = subs.add_parser("setup", help="First-time setup (device login + project + user + sidecar)")
+    p_setup.add_argument("--project-name", default=None, help="Project name (default: 'Hermes Agent')")
+    p_setup.add_argument("--phone", default=None, help="Your E.164 phone number (e.g. +15551234567)")
     p_setup.add_argument("--first-name", default=None)
     p_setup.add_argument("--last-name", default=None)
     p_setup.add_argument("--email", default=None)
@@ -58,6 +52,14 @@ def register_cli(parser: argparse.ArgumentParser) -> None:
     subs.add_parser("status", help="Show login + project + sidecar dep state")
     subs.add_parser("install-sidecar", help="Run npm install inside the sidecar directory")
 
+    p_hook = subs.add_parser("webhook", help="Manage Photon webhook registrations")
+    hook_subs = p_hook.add_subparsers(dest="photon_webhook_command", required=True)
+    p_hook_reg = hook_subs.add_parser("register", help="Register a webhook URL")
+    p_hook_reg.add_argument("url", help="Publicly reachable URL Photon should POST to")
+    hook_subs.add_parser("list", help="List registered webhooks for the current project")
+    p_hook_del = hook_subs.add_parser("delete", help="Delete a webhook by id")
+    p_hook_del.add_argument("webhook_id")
+
     parser.set_defaults(func=dispatch)
 
 
@@ -75,6 +77,8 @@ def dispatch(args: argparse.Namespace) -> int:
         return _cmd_status(args)
     if sub == "install-sidecar":
         return _cmd_install_sidecar(args)
+    if sub == "webhook":
+        return _cmd_webhook(args)
     print(f"unknown subcommand: {sub}", file=sys.stderr)
     return 2
 
@@ -118,7 +122,7 @@ def _cmd_setup(args: argparse.Namespace) -> int:
     # 1. Login (skip if we already have a token).
     token = photon_auth.load_photon_token()
     if not token:
-        print("[1/5] No Photon token found — running device login...")
+        print("[1/4] No Photon token found — running device login...")
         rc = _run_device_login(args)
         if rc != 0:
             return rc
@@ -127,178 +131,85 @@ def _cmd_setup(args: argparse.Namespace) -> int:
             print("login completed but token was not stored", file=sys.stderr)
             return 1
     else:
-        print("[1/5] Reusing existing Photon token")
+        print("[1/4] Reusing existing Photon token")
 
-    # 2. Find or create the "Hermes Agent" project.
-    name = args.project_name or photon_auth.DEFAULT_PROJECT_NAME
-    dashboard_id = photon_auth.load_dashboard_project_id()
-    try:
-        if dashboard_id:
-            print("[2/5] Reusing configured Photon project")
-        else:
-            existing = photon_auth.find_project_by_name(token, name)
-            if existing and existing.get("id"):
-                dashboard_id = existing["id"]
-                print(f"[2/5] Found existing project '{name}'")
-            else:
-                print(f"[2/5] Creating Photon project '{name}'...")
-                created = photon_auth.create_project(token, name=name)
-                dashboard_id = created.get("id")
-                print("  ✓ project created")
-    except Exception as e:
-        print(f"project setup failed: {e}", file=sys.stderr)
-        return 1
-    if not dashboard_id:
-        print("could not resolve a Photon project id", file=sys.stderr)
-        return 1
-
-    # 3. Enable Spectrum, fetch the spectrum project id, rotate the secret,
-    #    and persist both (runtime creds -> ~/.hermes/.env, ids -> auth.json).
-    try:
-        print("[3/5] Enabling Spectrum and provisioning credentials...")
-        proj = photon_auth.ensure_spectrum_enabled(token, dashboard_id)
-        spectrum_id = proj.get("spectrumProjectId")
-        if not spectrum_id:
-            print("spectrum provisioning failed: no spectrum project id", file=sys.stderr)
+    # 2. Create (or surface existing) project.
+    existing_id, existing_secret = photon_auth.load_project_credentials()
+    project_id: str
+    project_secret: str
+    if existing_id and existing_secret:
+        project_id, project_secret = existing_id, existing_secret
+        # `project_id` is a Photon-assigned UUID, not a secret — but we
+        # keep the print terse to avoid CodeQL flow noise.
+        print("[2/4] Reusing existing Photon project")
+    else:
+        name = args.project_name or "Hermes Agent"
+        print(f"[2/4] Creating Photon project '{name}' (spectrum=true, imessage)...")
+        try:
+            data = photon_auth.create_project(token, name=name)
+        except Exception as e:
+            print(f"create-project failed: {e}", file=sys.stderr)
             return 1
-        spectrum_id = str(spectrum_id)
-        secret = photon_auth.regenerate_project_secret(token, dashboard_id)
-        photon_auth.store_project_credentials(
-            spectrum_project_id=spectrum_id,
-            project_secret=secret,
-            dashboard_project_id=dashboard_id,
-            name=name,
-        )
-        # spectrum_id is an opaque non-secret id; safe to show.
-        print(f"  ✓ Spectrum enabled (project id {spectrum_id}) — secret saved")
-    except Exception as e:
-        print(f"spectrum provisioning failed: {e}", file=sys.stderr)
-        return 1
+        project_id = data.get("spectrumProjectId") or data.get("id") or ""
+        project_secret = data.get("projectSecret") or ""
+        if not project_id or not project_secret:
+            print(
+                "create-project did not return spectrumProjectId + "
+                "projectSecret. Re-run after enabling Spectrum on the "
+                "project, or open https://app.photon.codes/ to fetch the "
+                "secret manually.",
+                file=sys.stderr,
+            )
+            return 1
+        photon_auth.store_project_credentials(project_id, project_secret, name=name)
+        print("  ✓ project provisioned (run `hermes photon status` to see the id)")
 
-    # 4. Register the operator's phone number as a Spectrum user (idempotent).
+    # 3. Create a Spectrum user for the operator.
     phone = args.phone or _prompt(
-        color(
-            "[4/5] Your iMessage phone number (E.164, e.g. +15551234567): ",
-            Colors.CYAN,
-        )
+        "Your iMessage phone number (E.164, e.g. +15551234567): "
     )
-    agent_number = None
-    registered_phone = None
-    registered_user_id = None
     if not phone:
-        print("      Skipped user registration (no phone given). Re-run with --phone later.")
+        print("[3/4] Skipped user creation (no phone given). Re-run with --phone later.")
     else:
-        # Name/email are optional and never prompted for — pass --first-name /
-        # --email if you want them sent to the dashboard.
-        first_name = args.first_name
-        email = args.email
+        print("[3/4] Creating shared Spectrum user...")
         try:
-            user, created = photon_auth.register_user_if_absent(
-                spectrum_id, secret,
+            photon_auth.create_user(
+                project_id, project_secret,
                 phone_number=phone,
-                first_name=first_name,
+                first_name=args.first_name,
                 last_name=args.last_name,
-                email=email,
-            )
-        except ValueError as e:
-            print(f"      invalid phone number: {e}", file=sys.stderr)
-            return 1
-        except Exception as e:
-            print(f"      user registration failed: {e}", file=sys.stderr)
-            return 1
-        print("  ✓ phone registered" if created else "  ✓ phone already registered")
-        registered_phone = phone
-        registered_user_id = user.get("id")
-        # The number to text the agent is the user's assigned iMessage line
-        # (the dashboard's "TEXTS ON" column). On shared-number plans there is
-        # no dedicated entry in /lines, so this per-user field is the source of
-        # truth — and we already have it from the (reused) user object.
-        agent_number = photon_auth.user_assigned_line(user)
-        # Allowlist the operator and make their DM the cron home channel —
-        # otherwise the gateway denies their own inbound messages
-        # ("Unauthorized user") and has no default space for cron delivery.
-        _autoconfigure_access(phone)
-
-    # 5. Surface the agent's iMessage number (the number to text the agent).
-    if not agent_number:
-        # No per-user assignment — fall back to a dedicated line if the project
-        # has one provisioned in its line inventory.
-        try:
-            line = photon_auth.get_imessage_line(token, dashboard_id)
-            if line:
-                agent_number = line.get("phoneNumber")
-        except Exception as e:
-            print(f"      (could not fetch the assigned line: {e})", file=sys.stderr)
-    if agent_number:
-        print()
-        print(color("┌─ Your agent's iMessage number ───────────────────────────────", Colors.GREEN))
-        print(
-            color("│  📱 ", Colors.GREEN)
-            + color(str(agent_number), Colors.GREEN, Colors.BOLD)
-        )
-        print(color("│  Text this number from your phone to talk to your agent.", Colors.GREEN))
-        print(color("└──────────────────────────────────────────────────────────────", Colors.GREEN))
-    else:
-        print("      No iMessage line assigned yet — check the Photon dashboard.")
-    if registered_phone:
-        try:
-            photon_auth.store_user_numbers(
-                phone_number=registered_phone,
-                assigned_phone_number=agent_number,
-                user_id=str(registered_user_id) if registered_user_id else None,
-                dashboard_project_id=dashboard_id,
+                email=args.email,
             )
         except Exception as e:
-            print(f"      (could not save Photon status metadata: {e})", file=sys.stderr)
+            print(f"create-user failed: {e}", file=sys.stderr)
+            return 1
+        print("  ✓ user created — check `hermes photon status` or the dashboard for the assigned iMessage line")
 
-    # 6. Sidecar deps (spectrum-ts).
+    # 4. Sidecar deps.
     if args.skip_sidecar_install:
-        print("[5/5] Skipping sidecar npm install (--skip-sidecar-install)")
+        print("[4/4] Skipping sidecar npm install (--skip-sidecar-install)")
     else:
-        print("[5/5] Installing Node sidecar deps (spectrum-ts)...")
+        print("[4/4] Installing Node sidecar deps (spectrum-ts)...")
         rc = _install_sidecar()
         if rc != 0:
             return rc
 
     print()
     print("✓ Photon setup complete.")
-    print("  Start the gateway:  hermes gateway start --platform photon")
+    print("  Next: register a webhook URL Photon can reach:")
+    print("        hermes photon webhook register https://YOUR-PUBLIC-URL/photon/webhook")
+    print("  Then start the gateway:")
+    print("        hermes gateway start --platform photon")
     return 0
 
 
-def _autoconfigure_access(phone: str) -> None:
-    """Allowlist the operator and set their DM as the cron home channel.
-
-    Writes ``PHOTON_ALLOWED_USERS`` (so the gateway authorizes the operator's
-    own inbound messages instead of denying them) and ``PHOTON_HOME_CHANNEL``
-    (the default space for cron delivery) to the operator's E.164 number. Each
-    is only filled when unset, so a hand-tuned allowlist / home channel is
-    never clobbered on a re-run.
-    """
-    try:
-        from hermes_cli.config import get_env_value, save_env_value
-    except ImportError:
-        return
-    for key, label in (
-        ("PHOTON_ALLOWED_USERS", "allowlisted your number"),
-        ("PHOTON_HOME_CHANNEL", "set your DM as the cron home channel"),
-    ):
-        try:
-            if get_env_value(key):
-                print(f"      {key} already set — leaving it as-is.")
-                continue
-            save_env_value(key, phone)
-            print(f"  ✓ {label} ({key})")
-        except Exception as e:
-            print(f"      could not set {key}: {e}", file=sys.stderr)
-
-
 def _cmd_status(_args: argparse.Namespace) -> int:
-    _refresh_status_numbers()
-    # Defer the credential rows to auth.print_credential_summary — its emit
+    # Defer the whole table to auth.print_credential_summary — its emit
     # callback is the only sink that sees credential-derived strings, so
     # cli.py keeps zero taint flow according to CodeQL.
     photon_auth.print_credential_summary(print)
+    # The two non-credential rows live here so the helper stays purely
+    # about credentials.
     node_bin = os.getenv("PHOTON_NODE_BIN") or shutil.which("node")
     sidecar_installed = (_SIDECAR_DIR / "node_modules").exists()
     print(f"  node binary         : {node_bin or '✗ missing (install Node 18+)'}")
@@ -306,21 +217,9 @@ def _cmd_status(_args: argparse.Namespace) -> int:
     return 0
 
 
-def _refresh_status_numbers() -> None:
-    phone, assigned = photon_auth.load_user_numbers()
-    if phone and assigned:
-        return
-    spectrum_id, project_secret = photon_auth.load_project_credentials()
-    if not spectrum_id or not project_secret:
-        return
-    try:
-        photon_auth.refresh_user_numbers(spectrum_id, project_secret)
-    except Exception as e:
-        print(f"      (could not refresh Photon user numbers: {e})", file=sys.stderr)
-
-
 def _cmd_install_sidecar(_args: argparse.Namespace) -> int:
-    return _install_sidecar()
+    rc = _install_sidecar()
+    return rc
 
 
 def _install_sidecar() -> int:
@@ -332,13 +231,9 @@ def _install_sidecar() -> int:
             file=sys.stderr,
         )
         return 1
-    # Always pull the newest published spectrum-ts so every setup runs against
-    # the latest SDK. `spectrum-ts@latest` bumps package.json + package-lock.json
-    # to the current release before installing — a plain `npm install` would
-    # stay pinned to whatever the committed lockfile already resolved.
-    print(f"  $ cd {_SIDECAR_DIR} && {npm} install spectrum-ts@latest")
+    print(f"  $ cd {_SIDECAR_DIR} && {npm} install")
     proc = subprocess.run(  # noqa: S603
-        [npm, "install", "spectrum-ts@latest"],
+        [npm, "install"],
         cwd=str(_SIDECAR_DIR),
         check=False,
     )
@@ -347,6 +242,64 @@ def _install_sidecar() -> int:
     return proc.returncode
 
 
+def _cmd_webhook(args: argparse.Namespace) -> int:
+    sub = getattr(args, "photon_webhook_command", None)
+    project_id, project_secret = photon_auth.load_project_credentials()
+    if not (project_id and project_secret):
+        print(
+            "no Photon project configured — run `hermes photon setup` first",
+            file=sys.stderr,
+        )
+        return 1
+
+    if sub == "register":
+        try:
+            data = photon_auth.register_webhook(
+                project_id, project_secret, webhook_url=args.url
+            )
+        except Exception as e:
+            print(f"register failed: {e}", file=sys.stderr)
+            return 1
+        # The helper does all the formatting + writing; cli.py never
+        # touches the signing-secret value, the path it was written
+        # to, or even the redacted-response dict. on_summary is a
+        # plain printer callback.
+        ok = photon_auth.persist_webhook_signing_secret(data, on_summary=print)
+        if not ok:
+            print(
+                "‼  Photon returned no signing secret in the response, "
+                "or the file write failed. Inspect your home directory "
+                "permissions and re-run; do not retry without first "
+                "deleting the orphaned webhook from the Photon dashboard.",
+                file=sys.stderr,
+            )
+            return 1
+        return 0
+
+    if sub == "list":
+        try:
+            data = photon_auth.list_webhooks(project_id, project_secret)
+        except Exception as e:
+            print(f"list failed: {e}", file=sys.stderr)
+            return 1
+        print(json.dumps(data, indent=2))
+        return 0
+
+    if sub == "delete":
+        try:
+            photon_auth.delete_webhook(
+                project_id, project_secret, webhook_id=args.webhook_id
+            )
+        except Exception as e:
+            print(f"delete failed: {e}", file=sys.stderr)
+            return 1
+        print(f"deleted webhook {args.webhook_id}")
+        return 0
+
+    print(f"unknown webhook subcommand: {sub}", file=sys.stderr)
+    return 2
+
+
 # ---------------------------------------------------------------------------
 # Gateway-setup entry point
 #

plugins/platforms/photon/plugin.yaml

@@ -1,37 +1,52 @@
 name: photon-platform
-label: iMessage via Photon
+label: Photon iMessage
 kind: platform
-version: 0.2.0
+version: 0.1.0
 description: >
   Photon Spectrum gateway adapter for Hermes Agent.
   Connects to iMessage (and other Spectrum interfaces) through Photon's
-  managed Spectrum platform. Both directions run over the `spectrum-ts`
-  SDK's long-lived gRPC stream via a small supervised Node sidecar —
-  inbound messages arrive on the SDK's `app.messages` stream (no webhook,
-  no public URL, no signing secret), and outbound messages are sent over
-  the same sidecar.
+  managed Spectrum platform. Inbound messages arrive as signed webhooks
+  on a local aiohttp server; outbound messages are sent via a small
+  supervised Node sidecar that runs the `spectrum-ts` SDK (Photon does
+  not currently expose a public HTTP send endpoint).
 
-  The plugin ships with a `hermes photon` CLI for the one-time device
-  login + project + user setup. Runtime credentials are written to
-  ``~/.hermes/.env`` (``PHOTON_PROJECT_ID`` = the Spectrum project id,
-  ``PHOTON_PROJECT_SECRET``) like every other channel, with management
-  metadata (device token, dashboard project id) in ``~/.hermes/auth.json``.
-  Photon's free shared-line model lets users get started without a paid plan.
+  The plugin ships with a `hermes photon` CLI for the one-time login
+  + project + user setup, persists Spectrum credentials to
+  ``~/.hermes/auth.json`` under ``credential_pool.photon`` (token) and
+  ``credential_pool.photon_project`` (project id + secret), and exposes
+  Photon's free shared-line model so users can get started without a
+  paid plan.
 author: NousResearch
 requires_env:
   - name: PHOTON_PROJECT_ID
-    description: "Spectrum project id (the project's spectrumProjectId; set by `hermes photon setup`)"
-    prompt: "Photon Spectrum project id"
+    description: "Spectrum project ID (set by `hermes photon setup`)"
+    prompt: "Photon Spectrum project ID"
     url: "https://app.photon.codes/"
     password: false
   - name: PHOTON_PROJECT_SECRET
-    description: "Project secret paired with the Spectrum project id (set by `hermes photon setup`)"
-    prompt: "Photon project secret"
+    description: "Spectrum project secret (set by `hermes photon setup`)"
+    prompt: "Photon Spectrum project secret"
     url: "https://app.photon.codes/"
     password: true
 optional_env:
+  - name: PHOTON_WEBHOOK_SECRET
+    description: "Per-URL HMAC-SHA256 signing secret returned at webhook registration"
+    prompt: "Photon webhook signing secret"
+    password: true
+  - name: PHOTON_WEBHOOK_PORT
+    description: "Local port the webhook receiver listens on (default 8788)"
+    prompt: "Webhook receiver port"
+    password: false
+  - name: PHOTON_WEBHOOK_PATH
+    description: "Path the webhook receiver listens on (default /photon/webhook)"
+    prompt: "Webhook receiver path"
+    password: false
+  - name: PHOTON_WEBHOOK_BIND
+    description: "Bind address for the webhook receiver (default 0.0.0.0)"
+    prompt: "Webhook bind address"
+    password: false
   - name: PHOTON_SIDECAR_PORT
-    description: "Loopback port for the Node sidecar control + inbound channel (default 8789)"
+    description: "Loopback port for the Node sidecar control channel (default 8789)"
     prompt: "Sidecar control port"
     password: false
   - name: PHOTON_SIDECAR_AUTOSTART
@@ -42,14 +57,14 @@ optional_env:
     description: "Path to the node binary (default: shutil.which('node'))"
     prompt: "Node executable path"
     password: false
-  - name: PHOTON_DASHBOARD_HOST
-    description: "Photon Dashboard API host (default https://app.photon.codes)"
-    prompt: "Dashboard host"
-    password: false
-  - name: PHOTON_SPECTRUM_HOST
-    description: "Photon Spectrum API host (default https://spectrum.photon.codes)"
+  - name: PHOTON_API_HOST
+    description: "Spectrum management API host (default https://spectrum.photon.codes)"
     prompt: "Spectrum API host"
     password: false
+  - name: PHOTON_DASHBOARD_HOST
+    description: "Dashboard API host (default https://app.photon.codes)"
+    prompt: "Dashboard host"
+    password: false
   - name: PHOTON_ALLOWED_USERS
     description: "Comma-separated E.164 phone numbers allowed to talk to the bot"
     prompt: "Allowed users (comma-separated)"
@@ -67,8 +82,8 @@ optional_env:
     prompt: "Group mention patterns"
     password: false
   - name: PHOTON_HOME_CHANNEL
-    description: "Default Photon target for cron / notification delivery: Spectrum space id, DM GUID, or bare E.164 phone number"
-    prompt: "Home Photon target"
+    description: "Default Spectrum space ID for cron / notification delivery"
+    prompt: "Home space ID"
     password: false
   - name: PHOTON_HOME_CHANNEL_NAME
     description: "Human label for the home channel"

plugins/platforms/photon/sidecar/index.mjs

@@ -1,46 +1,40 @@
 // Hermes Agent — Photon Spectrum sidecar
 //
-// Spawned by `plugins/platforms/photon/adapter.py` to bridge BOTH directions
-// of messaging to Photon's Spectrum platform via the `spectrum-ts` SDK (the
-// SDK is TypeScript-only, so a Node sidecar is unavoidable — there is no
-// Python SDK and no public HTTP message API).
+// Spawned by `plugins/platforms/photon/adapter.py` to bridge outbound
+// messaging to Photon's Spectrum platform. Inbound messages go directly
+// from Photon's webhook to Hermes' Python aiohttp receiver — this
+// sidecar handles ONLY outbound calls (which require the spectrum-ts
+// SDK because Photon has no public HTTP send endpoint today).
 //
-// Inbound  (gRPC -> Hermes): the SDK's `app.messages` async iterator is a
-//   long-lived gRPC stream. We serialize each `[space, message]` to a
-//   normalized JSON event and stream it to the Python adapter over a
-//   loopback `GET /inbound` (NDJSON). We pause pulling from the stream while
-//   no consumer is attached so a backlog isn't pulled-and-lost before the
-//   gateway connects.
-// Outbound (Hermes -> gRPC): `/send` drives `space.send(...)`; `/typing`
-//   sends the documented `typing("start" | "stop")` content builder.
-//
-// Protocol (all requests require `X-Hermes-Sidecar-Token: ${TOKEN}`):
-//   - GET  /inbound    -> 200 NDJSON stream; one JSON event per line, blank
-//                         lines are heartbeats. One consumer at a time.
-//   - POST /healthz     -> {"ok": true}
-//   - POST /send        -> {"ok": true, "messageId": "..."}
-//       body: {"spaceId": "...", "text": "..."}
-//   - POST /send-attachment -> {"ok": true, "messageId": "..."}
+// Protocol:
+//   - The sidecar listens on http://127.0.0.1:${PORT} (loopback only)
+//   - Each request must include `X-Hermes-Sidecar-Token: ${TOKEN}`
+//   - POST /healthz                     -> {"ok": true}
+//   - POST /send                        -> {"ok": true, "messageId": "..."}
+//       body: {"spaceId": "...", "text": "...", "replyTo": "..." | null}
+//   - POST /send-attachment             -> {"ok": true, "messageId": "..."}
 //       body: {"spaceId": "...", "path": "...", "name": "..." | null,
 //              "mimeType": "..." | null, "caption": "..." | null,
-//              "kind": "attachment" | "voice"}
-//   - POST /typing      -> {"ok": true}
-//       body: {"spaceId": "...", "state": "start" | "stop"}
-//   - POST /shutdown    -> {"ok": true}; then process exits
+//              "kind": "attachment" | "voice", "replyTo": "..." | null}
+//   - POST /typing                      -> {"ok": true}
+//       body: {"spaceId": "..."}
+//   - POST /shutdown                    -> {"ok": true}; then process exits
 //
 // On SIGINT/SIGTERM the sidecar calls `app.stop()` (3s graceful) before
-// exiting. Logs go to stderr; Python supervises restart.
+// exiting. Errors are logged to stderr; Python supervises restart.
 //
-// Env vars (required):
-//   PHOTON_PROJECT_ID      (== the project's spectrumProjectId)
+// Env vars (all required):
+//   PHOTON_PROJECT_ID
 //   PHOTON_PROJECT_SECRET
 //   PHOTON_SIDECAR_PORT
 //   PHOTON_SIDECAR_TOKEN
+//
 // Optional:
-//   PHOTON_SIDECAR_BIND    (default 127.0.0.1)
+//   PHOTON_SIDECAR_BIND  (default 127.0.0.1)
+//   PHOTON_API_HOST      (passed through to spectrum-ts if its config
+//                         honours it)
 
 import http from "node:http";
-import { once } from "node:events";
 
 const projectId = process.env.PHOTON_PROJECT_ID;
 const projectSecret = process.env.PHOTON_PROJECT_SECRET;
@@ -48,17 +42,6 @@ const port = parseInt(process.env.PHOTON_SIDECAR_PORT || "8789", 10);
 const bind = process.env.PHOTON_SIDECAR_BIND || "127.0.0.1";
 const sharedToken = process.env.PHOTON_SIDECAR_TOKEN;
 
-// Inbound binary content is read into memory and base64-inlined on the NDJSON
-// event so the Python adapter can cache the real bytes (and the agent can see
-// images / transcribe voice). Cap the size we inline — above it we forward
-// metadata only and the adapter surfaces a text marker, so one large clip can't
-// balloon a single NDJSON line. Override via PHOTON_MAX_INLINE_ATTACHMENT_BYTES.
-const MAX_INLINE_ATTACHMENT_BYTES =
-  Number(process.env.PHOTON_MAX_INLINE_ATTACHMENT_BYTES) || 20 * 1024 * 1024;
-const DM_CHAT_GUID_RE = /^any;-;(\+\d{6,})$/;
-const E164_RE = /^\+\d{6,}$/;
-const MAX_KNOWN_SPACES = 2048;
-
 if (!projectId || !projectSecret || !sharedToken) {
   console.error(
     "photon-sidecar: PHOTON_PROJECT_ID, PHOTON_PROJECT_SECRET and " +
@@ -69,15 +52,9 @@ if (!projectId || !projectSecret || !sharedToken) {
 
 // Lazy-load spectrum-ts so a missing install fails with a clear message
 // instead of a cryptic module-resolution error during import.
-let Spectrum, imessage, attachment, voice, spectrumText, spectrumTyping;
+let Spectrum, imessage, attachment, voice;
 try {
-  ({
-    Spectrum,
-    attachment,
-    voice,
-    text: spectrumText,
-    typing: spectrumTyping,
-  } = await import("spectrum-ts"));
+  ({ Spectrum, attachment, voice } = await import("spectrum-ts"));
   ({ imessage } = await import("spectrum-ts/providers/imessage"));
 } catch (e) {
   console.error(
@@ -92,179 +69,19 @@ const app = await Spectrum({
   projectId,
   projectSecret,
   providers: [imessage.config()],
-  options: { flattenGroups: true },
 });
 
-// ---------------------------------------------------------------------------
-// Inbound: forward `app.messages` (gRPC stream) to the Python consumer.
-
-// At most one Python consumer is attached at a time (the gateway adapter).
-let consumerRes = null;
-let consumerWaiters = [];
-const knownSpaces = new Map();
-
-function rememberKnownSpace(id, space) {
-  if (!id || typeof id !== "string" || !space) return;
-  if (knownSpaces.has(id)) knownSpaces.delete(id);
-  knownSpaces.set(id, space);
-  if (knownSpaces.size > MAX_KNOWN_SPACES) {
-    const oldest = knownSpaces.keys().next().value;
-    if (oldest) knownSpaces.delete(oldest);
-  }
-}
-
-function phoneTargetFromSpaceId(spaceId) {
-  if (typeof spaceId !== "string") return null;
-  if (E164_RE.test(spaceId)) return spaceId;
-  const dmGuid = spaceId.match(DM_CHAT_GUID_RE);
-  return dmGuid ? dmGuid[1] : null;
-}
-
-function rememberInboundSpace(space, message) {
-  const msgSpace = message?.space || {};
-  const ids = [space?.id, msgSpace.id];
-  for (const id of ids) {
-    rememberKnownSpace(id, space);
-    const phone = phoneTargetFromSpaceId(id);
-    if (phone) rememberKnownSpace(phone, space);
-  }
-}
-
-function waitForConsumer() {
-  if (consumerRes) return Promise.resolve();
-  return new Promise((resolve) => consumerWaiters.push(resolve));
-}
-
-function setConsumer(res) {
-  consumerRes = res;
-  const waiters = consumerWaiters;
-  consumerWaiters = [];
-  for (const resolve of waiters) resolve();
-}
-
-function clearConsumer(res) {
-  if (consumerRes === res) consumerRes = null;
-}
-
-// Write one NDJSON line to the active consumer. Blocks until a consumer is
-// connected; if the write fails (consumer vanished mid-flight) we wait for a
-// new consumer and retry, so a message is never silently dropped here.
-async function deliver(line) {
-  for (;;) {
-    await waitForConsumer();
-    const res = consumerRes;
-    if (!res) continue;
-    try {
-      const flushed = res.write(line + "\n");
-      if (!flushed) await once(res, "drain");
-      return;
-    } catch {
-      clearConsumer(res);
-    }
-  }
-}
-
-async function normalizeBinaryContent(content) {
-  const meta = {
-    type: content.type,
-    id: content.id ?? null,
-    name: content.name ?? null,
-    mimeType: content.mimeType ?? null,
-    size: typeof content.size === "number" ? content.size : null,
-  };
-  if (content.type === "voice" && typeof content.duration === "number") {
-    meta.duration = content.duration;
-  }
-
-  // Read the bytes eagerly and base64-inline them as `data` so the Python
-  // adapter can cache the real file (the agent then sees images and can run
-  // STT on voice notes). Spectrum content objects may not outlive this stream
-  // iteration, so a lazy/on-demand fetch isn't safe. Over-cap content (when
-  // size is known up front) is forwarded as metadata only and the adapter falls
-  // back to a text marker. A read failure must never break the inbound loop.
-  const label = `${content.type} ${meta.name ?? meta.id ?? "(unnamed)"}`;
-  if (meta.size !== null && meta.size > MAX_INLINE_ATTACHMENT_BYTES) {
-    console.error(
-      `photon-sidecar: ${label} (${meta.size} bytes) ` +
-        `exceeds inline cap ${MAX_INLINE_ATTACHMENT_BYTES}; forwarding metadata only`
-    );
-    return meta;
-  }
-  if (typeof content.read === "function") {
-    try {
-      const buf = await content.read();
-      // Guard the case where size was unknown but the bytes turn out to be
-      // over the cap.
-      if (buf && buf.length > MAX_INLINE_ATTACHMENT_BYTES) {
-        console.error(
-          `photon-sidecar: ${label} (${buf.length} bytes) ` +
-            `exceeds inline cap after read; forwarding metadata only`
-        );
-        return meta;
-      }
-      meta.data = Buffer.from(buf).toString("base64");
-      meta.encoding = "base64";
-    } catch (e) {
-      console.error(
-        `photon-sidecar: failed to read ${content.type} bytes ` +
-          "(forwarding metadata only): " +
-          (e && e.stack ? e.stack : String(e))
-      );
-    }
-  }
-  return meta;
-}
-
-async function normalizeContent(content) {
-  if (!content || typeof content !== "object") {
-    return { type: "unknown" };
-  }
-  if (content.type === "text") {
-    return { type: "text", text: content.text || "" };
-  }
-  if (content.type === "attachment" || content.type === "voice") {
-    return await normalizeBinaryContent(content);
-  }
-  return { type: content.type || "unknown" };
-}
-
-async function normalizeEvent(space, message) {
-  try {
-    const msgSpace = message.space || {};
-    const ts = message.timestamp;
-    return {
-      messageId: message.id ?? null,
-      platform: message.platform || space.__platform || "iMessage",
-      space: {
-        id: space.id ?? msgSpace.id ?? null,
-        // iMessage spaces carry `type` ("dm"|"group") and `phone` directly.
-        type: space.type ?? msgSpace.type ?? "dm",
-        phone: space.phone ?? msgSpace.phone ?? null,
-      },
-      sender: { id: message.sender ? message.sender.id : null },
-      content: await normalizeContent(message.content),
-      timestamp:
-        ts instanceof Date ? ts.toISOString() : ts ? String(ts) : null,
-    };
-  } catch (e) {
-    console.error(
-      "photon-sidecar: failed to normalize inbound message: " + String(e)
-    );
-    return null;
-  }
-}
-
+// Drain the inbound stream — Photon's webhook is the canonical inbound
+// path, but we still consume `app.messages` so spectrum-ts' internal
+// reconnect/heartbeat logic keeps running.  Each event is logged at
+// debug level; everything else is a no-op here.
 (async () => {
   try {
-    for await (const [space, message] of app.messages) {
-      // Only forward inbound messages (ignore our own outbound echoes).
-      if (message && message.direction && message.direction !== "inbound") {
-        continue;
-      }
-      rememberInboundSpace(space, message);
-      const event = await normalizeEvent(space, message);
-      if (!event) continue;
-      await deliver(JSON.stringify(event));
+    for await (const [, message] of app.messages) {
+      console.error(
+        `photon-sidecar: drained inbound from ${message.platform} ` +
+          `space=${message.space?.id}`
+      );
     }
   } catch (e) {
     console.error(
@@ -274,9 +91,6 @@ async function normalizeEvent(space, message) {
   }
 })();
 
-// ---------------------------------------------------------------------------
-// HTTP control + inbound server (loopback only).
-
 async function readBody(req) {
   const chunks = [];
   for await (const chunk of req) chunks.push(chunk);
@@ -316,73 +130,27 @@ function ok(res, data) {
   res.end(JSON.stringify({ ok: true, ...data }));
 }
 
-function handleInbound(req, res) {
-  res.statusCode = 200;
-  res.setHeader("Content-Type", "application/x-ndjson");
-  res.setHeader("Cache-Control", "no-store");
-  res.setHeader("Connection", "keep-alive");
-  // One consumer at a time — a fresh connection (e.g. after a reconnect)
-  // supersedes the previous one.
-  if (consumerRes && consumerRes !== res) {
-    try {
-      consumerRes.end();
-    } catch {
-      /* ignore */
-    }
-  }
-  setConsumer(res);
-  // Heartbeat keeps the socket warm through idle periods and lets the Python
-  // side detect a dead pipe promptly.
-  const heartbeat = setInterval(() => {
-    try {
-      res.write("\n");
-    } catch {
-      /* ignore */
-    }
-  }, 25000);
-  const cleanup = () => {
-    clearInterval(heartbeat);
-    clearConsumer(res);
-  };
-  req.on("close", cleanup);
-  req.on("aborted", cleanup);
-  res.on("error", cleanup);
-}
-
 async function resolveSpace(spaceId) {
-  const cached = knownSpaces.get(spaceId);
-  if (cached) return cached;
-
-  const phoneTarget = phoneTargetFromSpaceId(spaceId);
-  // A bare E.164 phone number addresses a DM. Resolve the user, then the (DM)
-  // space — `imessage(app).user(phone)` -> `im.space(user)` — so callers can
-  // pass just "+1..." (e.g. PHOTON_HOME_CHANNEL for cron delivery) instead of
-  // an opaque inbound space id. Photon also represents DM chat ids as
-  // `any;-;+1...`; normalize those through the same path so replies to inbound
-  // DMs still resolve after Python stores the inbound `space.id`.
-  if (phoneTarget && imessage) {
-    try {
-      const im = imessage(app);
-      const user = await im.user(phoneTarget);
-      const space = await im.space(user);
-      rememberKnownSpace(spaceId, space);
-      rememberKnownSpace(phoneTarget, space);
-      rememberKnownSpace(space?.id, space);
-      return space;
-    } catch (e) {
-      console.error(
-        "photon-sidecar: phone->DM resolution failed: " +
-          (e && e.stack ? e.stack : String(e))
-      );
+  // spectrum-ts exposes the same Space methods via `app.space(spaceId)` /
+  // narrowed helpers; we fall back through a few accessor shapes to
+  // tolerate small SDK API drift.
+  if (typeof app.space === "function") {
+    return await app.space(spaceId);
+  }
+  if (app.spaces && typeof app.spaces.get === "function") {
+    return await app.spaces.get(spaceId);
+  }
+  // Last resort — the platform-narrowed helper.
+  if (imessage) {
+    const im = imessage(app);
+    if (typeof im.space === "function") {
+      try {
+        return await im.space({ id: spaceId });
+      } catch {
+        /* fall through */
+      }
     }
   }
-  // No cache hit and not a phone/DM target. spectrum-ts exposes no API to
-  // rehydrate an arbitrary opaque space id: a Space is only obtained from the
-  // inbound `[space, message]` stream (cached above in `knownSpaces`) or
-  // reconstructed for a DM from its phone number. So a group space whose cache
-  // entry was lost — e.g. after a sidecar restart with no fresh inbound message
-  // in that group — cannot be resolved here; a new inbound message in the group
-  // re-warms the cache. DMs are unaffected (reconstructed from the phone).
   throw new Error(`unable to resolve space id ${spaceId}`);
 }
 
@@ -390,10 +158,6 @@ const server = http.createServer(async (req, res) => {
   if (req.headers["x-hermes-sidecar-token"] !== sharedToken) {
     return unauthorized(res);
   }
-  // Long-lived inbound NDJSON stream.
-  if (req.method === "GET" && req.url === "/inbound") {
-    return handleInbound(req, res);
-  }
   if (req.method !== "POST") {
     res.statusCode = 405;
     return res.end();
@@ -409,16 +173,18 @@ const server = http.createServer(async (req, res) => {
     }
     const body = await readBody(req);
     if (req.url === "/send") {
-      const { spaceId, text } = body || {};
+      const { spaceId, text, replyTo } = body || {};
       if (!spaceId || typeof text !== "string") {
         return badRequest(res, "spaceId and text are required");
       }
       const space = await resolveSpace(spaceId);
-      const result = await space.send(spectrumText(text));
-      return ok(res, { messageId: result?.id || null });
+      const result = replyTo
+        ? await space.send(text, { replyTo })
+        : await space.send(text);
+      return ok(res, { messageId: result?.id || result?.messageId || null });
     }
     if (req.url === "/send-attachment") {
-      const { spaceId, path, name, mimeType, caption, kind } =
+      const { spaceId, path, name, mimeType, caption, kind, replyTo } =
         body || {};
       if (!spaceId || typeof path !== "string" || !path) {
         return badRequest(res, "spaceId and path are required");
@@ -436,13 +202,16 @@ const server = http.createServer(async (req, res) => {
           ? voice(path, Object.keys(opts).length ? opts : undefined)
           : attachment(path, Object.keys(opts).length ? opts : undefined);
 
-      const result = await space.send(builder);
+      const sendOpts = replyTo ? { replyTo } : undefined;
+      const result = sendOpts
+        ? await space.send(builder, sendOpts)
+        : await space.send(builder);
 
       // iMessage delivers the caption as a separate bubble; send it
       // after the media so the attachment renders first.
       if (caption && typeof caption === "string") {
         try {
-          await space.send(spectrumText(caption));
+          await space.send(caption);
         } catch (e) {
           console.error(
             "photon-sidecar: attachment sent but caption failed: " +
@@ -450,16 +219,17 @@ const server = http.createServer(async (req, res) => {
           );
         }
       }
-      return ok(res, { messageId: result?.id || null });
+      return ok(res, { messageId: result?.id || result?.messageId || null });
     }
     if (req.url === "/typing") {
-      const { spaceId, state = "start" } = body || {};
+      const { spaceId } = body || {};
       if (!spaceId) return badRequest(res, "spaceId is required");
-      if (state !== "start" && state !== "stop") {
-        return badRequest(res, "state must be start or stop");
-      }
       const space = await resolveSpace(spaceId);
-      await space.send(spectrumTyping(state));
+      if (typeof space.typing === "function") {
+        await space.typing();
+      } else if (typeof space.setTyping === "function") {
+        await space.setTyping(true);
+      }
       return ok(res, {});
     }
     res.statusCode = 404;

plugins/platforms/photon/sidecar/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hermes-agent/photon-sidecar",
   "private": true,
-  "version": "0.2.0",
+  "version": "0.1.0",
   "description": "Spectrum-ts bridge for the Hermes Agent Photon platform plugin.",
   "type": "module",
   "main": "index.mjs",
@@ -12,6 +12,6 @@
     "node": ">=18.17"
   },
   "dependencies": {
-    "spectrum-ts": "^1.18.0"
+    "spectrum-ts": "^0.1.0"
   }
 }

plugins/platforms/simplex/plugin.yaml

@@ -1,7 +1,7 @@
 name: simplex-platform
 label: SimpleX Chat
 kind: platform
-version: 1.1.0
+version: 1.0.0
 description: >
   SimpleX Chat gateway adapter for Hermes Agent.
   Connects to a local simplex-chat daemon via WebSocket and relays
@@ -9,7 +9,7 @@ description: >
   SimpleX is decentralised and assigns no persistent user IDs —
   every contact is an opaque internal ID generated at connection
   time, making it one of the most private messengers available.
-author: Mibayy, jooray
+author: Mibayy
 # ``requires_env`` and ``optional_env`` entries are surfaced in the
 # ``hermes config`` UI via the platform-plugin env var injector in
 # ``hermes_cli/config.py``.
@@ -27,18 +27,6 @@ optional_env:
     description: "Allow any contact to talk to the bot (dev only — disables allowlist)"
     prompt: "Allow all contacts? (true/false)"
     password: false
-  - name: SIMPLEX_AUTO_ACCEPT
-    description: "Auto-accept incoming contact requests (default: true)"
-    prompt: "Auto-accept contact requests? (true/false)"
-    password: false
-  - name: SIMPLEX_GROUP_ALLOWED
-    description: >-
-      Comma-separated SimpleX group IDs the bot should participate in, or
-      '*' to allow any group. Omit to ignore group messages entirely
-      (safer default — a bot in a group otherwise processes every
-      member's traffic).
-    prompt: "Allowed group IDs (comma-separated, or '*' for any)"
-    password: false
   - name: SIMPLEX_HOME_CHANNEL
     description: "Default contact/group ID for cron / notification delivery"
     prompt: "Home channel contact/group ID (or empty)"
@@ -47,10 +35,3 @@ optional_env:
     description: "Human label for the home channel (defaults to the ID)"
     prompt: "Home channel display name (or empty)"
     password: false
-  - name: HERMES_SIMPLEX_TEXT_BATCH_DELAY
-    description: >-
-      Quiet-period seconds (default: 0.8) used to concatenate rapid-fire
-      inbound text messages into a single MessageEvent — same pattern as
-      Telegram's text batching.
-    prompt: "Text batch flush delay in seconds (default 0.8)"
-    password: false

scripts/check_subprocess_stdin.py

@@ -1,177 +0,0 @@
-#!/usr/bin/env python3
-"""Check that subprocess calls in TUI-context code specify stdin=.
-
-When Hermes runs in TUI mode, the gateway child process communicates with
-the Node.js parent over a JSON-RPC protocol on stdin. Subprocess calls that
-inherit this fd can cause the gateway to exit with stdin EOF during tool
-execution (issue #14036, PR #39257).
-
-This script checks that all subprocess.run() and subprocess.Popen() calls
-in TUI-context files (agent/, tools/, plugins/, tui_gateway/) explicitly
-set stdin= to prevent fd inheritance.
-
-Exit codes:
-  0 — all calls are safe
-  1 — violations found
-  2 — script error
-
-Usage:
-  python scripts/check_subprocess_stdin.py [--fix]
-
-With --fix, prints the commands to add stdin=subprocess.DEVNULL to each
-violation (does not modify files).
-"""
-
-from __future__ import annotations
-
-import os
-import re
-import sys
-from pathlib import Path
-
-# Directories that run inside the TUI gateway child process.
-TUI_CONTEXT_DIRS = [
-    "agent/",
-    "tools/",
-    "plugins/",
-    "tui_gateway/",
-]
-
-# Files with intentional stdin= override (e.g. input= creates a pipe).
-# Format: "filepath:line" or just "filepath" to skip the whole file.
-KNOWN_SAFE = {
-    "agent/shell_hooks.py",  # uses input=stdin_json, creates a pipe
-    "plugins/security-guidance/patterns.py",  # subprocess mentions are in reminder strings, not calls
-}
-
-# Inline marker that exempts a single subprocess call from this check.
-# Put it in a comment on (or within) the call when the process MUST inherit
-# stdin — e.g. an interactive login the user explicitly invokes. Travels with
-# the line, so it survives edits that shift line numbers (unlike a pinned
-# file:line entry).
-EXEMPT_MARKER = "noqa: subprocess-stdin"
-
-# Directories to skip entirely.
-SKIP_DIRS = {
-    "tests/",
-    "scripts/",
-    "skills/",
-    "optional-skills/",
-    "hermes_cli/",
-    "gateway/",
-    "cron/",
-}
-
-
-def find_subprocess_calls(content: str, filepath: str) -> list[dict]:
-    """Find all subprocess.run/Popen calls missing stdin= in content."""
-    violations = []
-    lines = content.split("\n")
-
-    # Match only actual function calls — not comments, docstrings, or prose.
-    # The pattern requires an opening paren followed by an arg character
-    # (quote, bracket, letter, or closing paren for empty calls).
-    # This excludes ``subprocess.Popen(...)`` in docstrings and
-    # subprocess.run(...) in comments.
-    pattern = re.compile(r'subprocess\.(run|Popen)\s*\(["\'a-zA-Z_\[\(]')
-
-    for i, line in enumerate(lines):
-        # Skip comments.
-        stripped = line.lstrip()
-        if stripped.startswith("#"):
-            continue
-
-        # Skip lines where the match is inside backticks (docstring references).
-        if "``subprocess" in line:
-            continue
-
-        if not pattern.search(line):
-            continue
-
-        # Collect the full call (may span multiple lines).
-        call_start = i
-        paren_depth = 0
-        found_open = False
-        call_lines = []
-        for j in range(i, min(i + 30, len(lines))):
-            call_lines.append(lines[j])
-            for ch in lines[j]:
-                if ch == "(":
-                    paren_depth += 1
-                    found_open = True
-                elif ch == ")":
-                    paren_depth -= 1
-                    if found_open and paren_depth == 0:
-                        call_text = "\n".join(call_lines)
-
-                        # Already has stdin= → safe.
-                        if "stdin=" in call_text:
-                            break
-
-                        # Has input= → creates a pipe, safe.
-                        if "input=" in call_text:
-                            break
-
-                        # Inline exemption marker on the call itself or within
-                        # the few comment lines immediately above it → the call
-                        # intentionally inherits stdin.
-                        window_start = max(0, i - 4)
-                        preceding = "\n".join(lines[window_start:i])
-                        if EXEMPT_MARKER in call_text or EXEMPT_MARKER in preceding:
-                            break
-
-                        violations.append({
-                            "file": filepath,
-                            "line": i + 1,
-                            "snippet": line.strip()[:120],
-                        })
-                        break
-            else:
-                continue
-            break
-
-    return violations
-
-
-def main() -> int:
-    fix_mode = "--fix" in sys.argv
-    repo_root = Path(__file__).resolve().parent.parent
-    os.chdir(repo_root)
-
-    all_violations = []
-
-    for tui_dir in TUI_CONTEXT_DIRS:
-        dirpath = repo_root / tui_dir
-        if not dirpath.exists():
-            continue
-
-        for py_file in dirpath.rglob("*.py"):
-            rel = str(py_file.relative_to(repo_root))
-
-            # Skip known-safe files.
-            if rel in KNOWN_SAFE:
-                continue
-
-            # Skip test files inside tools/ etc.
-            parts = py_file.parts
-            if any(skip.rstrip("/") in parts for skip in SKIP_DIRS):
-                continue
-
-            content = py_file.read_text()
-            violations = find_subprocess_calls(content, rel)
-            all_violations.extend(violations)
-
-    if all_violations:
-        print(f"❌ {len(all_violations)} subprocess calls missing stdin=:")
-        for v in all_violations:
-            print(f"  {v['file']}:{v['line']}: {v['snippet']}")
-        if fix_mode:
-            print("\nAdd stdin=subprocess.DEVNULL to each call above.")
-        return 1
-    else:
-        print("✅ All TUI-context subprocess calls have explicit stdin=")
-        return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

scripts/release.py

@@ -45,8 +45,6 @@ ACP_REGISTRY_MANIFEST = REPO_ROOT / "acp_registry" / "agent.json"
 
 # Auto-extracted from noreply emails + manual overrides
 AUTHOR_MAP = {
-    "zhuhaoyu0909@icloud.com": "underthestars-zhy",
-    "raysun12142006@gmail.com": "yanxue06",
     "alberto.regalado@ymail.com": "ARegalado1",
     "alchemistchaos@protonmail.com": "AlchemistChaos",  # co-author only
     "gilad@smiti.ai": "giladbau",
@@ -58,14 +56,12 @@ AUTHOR_MAP = {
     "thomas.paquette@gmail.com": "RyTsYdUp",
     "techxacm@gmail.com": "ProgramCaiCai",
     "266365592+bmoore210@users.noreply.github.com": "bmoore210",
-    "157839748+psionic73@users.noreply.github.com": "psionic73",
     "manishbyatroy@gmail.com": "manishbyatroy",
     "chilltulpa@gmail.com": "TheGardenGallery",
     "al@randomsnowflake.me": "randomsnowflake",
     "zakame@zakame.net": "zakame",
     "152110621+jiangkoumo@users.noreply.github.com": "jiangkoumo",
     "834740219@qq.com": "ViewWay",
-    "matt@vestigial.dev": "m4dni5",
     "harjoth.khara@gmail.com": "harjothkhara",
     "129007007+HeLLGURD@users.noreply.github.com": "HeLLGURD",
     "290859878+synapsesx@users.noreply.github.com": "synapsesx",
@@ -975,7 +971,6 @@ AUTHOR_MAP = {
     "draixagent@gmail.com": "draix",
     "martin.alca@gmail.com": "draix",
     "junminliu@gmail.com": "JimLiu",
-    "juraj@bednar.io": "jooray",
     "jarvischer@gmail.com": "maxchernin",
     "levantam.98.2324@gmail.com": "LVT382009",
     "zhurongcheng@rcrai.com": "heykb",
@@ -1246,7 +1241,6 @@ AUTHOR_MAP = {
     "charliekerfoot@gmail.com": "CharlieKerfoot",  # PR #18951
     # Debug share upload-time redaction (May 2026)
     "dhuysamen@gmail.com": "GodsBoy",  # PR #19318
-    "github@nadyahermes.anonaddy.com": "ruangraung",  # PR #42308
     "mrcoferland@gmail.com": "mrcoferland",  # PR #19023
     "chenlinfeng@ruije.com.cn": "noOne-list",  # PR #19050
     "briansu@Mac-mini.attlocal.net": "likejudy",  # PR #19052

tests/cli/test_slash_confirm_windows.py

@@ -1,31 +1,29 @@
-"""Regression tests for #30768, #32383, and #33961.
+"""Regression tests for issue #30768 and #32383.
 
-``_prompt_text_input_modal`` answers destructive-slash confirmations through a
-queue-based modal driven by prompt_toolkit key bindings.  When invoked from the
-``process_loop`` daemon thread it sets the modal up on the app's event loop via
-``call_soon_threadsafe``, so it is safe on every platform — including native
-Windows (#33961), where the earlier ``sys.platform == "win32"`` → raw ``input()``
-fallback deadlocked the daemon thread against prompt_toolkit's stdin ownership.
+``_prompt_text_input_modal`` uses a queue-based modal that relies on
+prompt_toolkit key bindings receiving keyboard events.  On Windows the
+prompt_toolkit input channel can deadlock when the modal is entered from
+the ``process_loop`` daemon thread.  The fix falls back to the simpler
+``_prompt_text_input`` (stdin-based) prompt on Windows.
 
 These tests verify:
-1. Daemon-thread confirm uses the modal via the app loop on Linux AND native
-   Windows (#33961) — never the raw stdin fallback, never a hang.
-2. Main-thread confirm with a running app uses the modal.
-3. The raw stdin fallback is kept ONLY for the safe cases: no running app, and
-   (on win32, off-thread) a scheduling failure degrades to a clean cancel.
-4. Empty choices returns None.
+1. Windows detection triggers the stdin fallback
+2. Non-Windows daemon threads still use the modal via the app loop
+3. macOS/Linux main-thread path still uses the modal (no regression)
+4. No-app path still uses the stdin fallback (existing behavior)
+5. Empty choices returns None (existing behavior)
 """
 
+import queue
 import sys
 import threading
 import time
 from unittest.mock import MagicMock, patch
 
-import pytest
 
 
 def _make_cli():
-    """Minimal HermesCLI shell exposing the prompt/modal helpers."""
+    """Minimal HermesCLI shell exposing prompt/modal helpers."""
     import cli as cli_mod
 
     obj = object.__new__(cli_mod.HermesCLI)
@@ -39,6 +37,9 @@ def _make_cli():
     return obj
 
 
+# ---------------------------------------------------------------------------
+# Sample choices used across tests
+# ---------------------------------------------------------------------------
 _SAMPLE_CHOICES = [
     ("once", "Approve Once", "proceed this time only"),
     ("always", "Always Approve", "proceed and silence this prompt permanently"),
@@ -46,106 +47,119 @@ _SAMPLE_CHOICES = [
 ]
 
 
-def _answer_modal_when_open(cli, response, stop=None):
-    """Push ``response`` onto the modal's response_queue once it opens.
+class TestModalWindowsFallback:
+    """Windows dead-lock regression tests for _prompt_text_input_modal."""
 
-    Gives up after ~2s, or early when ``stop`` is set (the modal will never open,
-    e.g. a scheduling failure) so degraded-path tests don't wait the full budget.
-    """
-    for _ in range(100):
-        if stop is not None and stop.is_set():
-            return
-        state = cli._slash_confirm_state
-        if state and "response_queue" in state:
-            state["response_queue"].put(response)
-            return
-        time.sleep(0.02)
-
-
-def _run_on_daemon(call, cli, *, platform, response, schedule=None):
-    """Invoke ``call`` on a daemon thread — as the process_loop does — answering
-    the modal with ``response`` once it opens.
-
-    Returns ``{result, stdin_called, capture, restore}``.  ``schedule`` overrides
-    the ``call_soon_threadsafe`` side effect (default: run the callback inline);
-    pass a raiser to simulate a scheduling failure.  Fails if the worker hangs,
-    which is the deadlock canary for #33961.
-    """
-    outcome = {"capture": [], "restore": [], "result": None, "stdin_called": False}
-    done = threading.Event()
-
-    def _worker():
-        try:
-            with patch.object(sys, "platform", platform), \
-                 patch.object(cli._app.loop, "call_soon_threadsafe", side_effect=schedule or (lambda cb: cb())), \
-                 patch.object(cli, "_prompt_text_input") as mock_stdin, \
-                 patch.object(cli, "_invalidate"), \
-                 patch.object(cli, "_capture_modal_input_snapshot", side_effect=lambda: outcome["capture"].append(1)), \
-                 patch.object(cli, "_restore_modal_input_snapshot", side_effect=lambda: outcome["restore"].append(1)):
-                outcome["result"] = call()
-                outcome["stdin_called"] = mock_stdin.called
-        finally:
-            done.set()
-
-    worker = threading.Thread(target=_worker, daemon=True)
-    answerer = threading.Thread(target=_answer_modal_when_open, args=(cli, response, done), daemon=True)
-    answerer.start()
-    worker.start()
-    worker.join(timeout=2.0)
-    answerer.join(timeout=2.0)
-    assert not worker.is_alive(), "daemon thread hung — modal deadlocked"
-    return outcome
-
-
-class TestModal:
-    """Behaviour of _prompt_text_input_modal across platforms and threads."""
-
-    @pytest.mark.parametrize("platform", ["linux", "win32"])
-    def test_daemon_thread_uses_modal_via_app_loop(self, platform):
-        """Off the process_loop daemon thread, the confirm uses the modal via
-        call_soon_threadsafe on every platform — including native Windows, where
-        the old win32 early-return deadlocked on raw input() (#33961)."""
+    def test_windows_falls_back_to_stdin(self):
+        """On Windows, _prompt_text_input_modal should use _prompt_text_input."""
         cli = _make_cli()
-        outcome = _run_on_daemon(
-            lambda: cli._prompt_text_input_modal(
-                title="⚠️  /reset",
+
+        with patch.object(sys, "platform", "win32"), \
+             patch.object(cli, "_prompt_text_input", return_value="1") as mock_stdin:
+            result = cli._prompt_text_input_modal(
+                title="⚠️  /new — destroys conversation state",
                 detail="This starts a fresh session.",
                 choices=_SAMPLE_CHOICES,
-                timeout=5,
-            ),
-            cli,
-            platform=platform,
-            response="once",
-        )
-        assert outcome["stdin_called"] is False, "must use the modal, not raw input()"
-        assert outcome["result"] == "once"
-        assert outcome["capture"] == [1]
-        assert outcome["restore"] == [1]
-        assert cli._slash_confirm_state is None
+            )
 
-    def test_main_thread_with_app_uses_modal(self):
-        """On the main thread with a running app, the queue-based modal is used."""
+        # The stdin-based fallback was used, not the modal queue path.
+        mock_stdin.assert_called_once_with("Choice [1/2/3]: ")
+        assert result == "1"
+
+    def test_non_main_thread_uses_modal_via_app_loop(self):
+        """Off the main thread on Linux, keep the modal path via app-loop setup."""
         cli = _make_cli()
+        result_holder = {}
+        setup_calls = []
+        teardown_calls = []
+
+        def _call_soon_threadsafe(callback):
+            callback()
+
+        def run_on_daemon():
+            with patch.object(sys, "platform", "linux"), \
+                 patch.object(cli._app.loop, "call_soon_threadsafe", side_effect=_call_soon_threadsafe), \
+                 patch.object(cli, "_prompt_text_input") as mock_stdin, \
+                 patch.object(cli, "_capture_modal_input_snapshot", side_effect=lambda: setup_calls.append("capture")), \
+                 patch.object(cli, "_restore_modal_input_snapshot", side_effect=lambda: teardown_calls.append("restore")):
+                result_holder["result"] = cli._prompt_text_input_modal(
+                    title="⚠️  /reset",
+                    detail="This starts a fresh session.",
+                    choices=_SAMPLE_CHOICES,
+                    timeout=5,
+                )
+                result_holder["stdin_called"] = mock_stdin.called
+
+        def _submit_after_delay():
+            time.sleep(0.2)
+            state = cli._slash_confirm_state
+            if state and "response_queue" in state:
+                state["response_queue"].put("once")
+
+        submitter = threading.Thread(target=_submit_after_delay, daemon=True)
+        t = threading.Thread(target=run_on_daemon, daemon=True)
+        submitter.start()
+        t.start()
+        t.join(timeout=2.0)
+        submitter.join(timeout=2.0)
+        assert not t.is_alive(), "daemon thread hung — modal deadlocked"
+        assert result_holder["stdin_called"] is False
+        assert result_holder["result"] == "once"
+        assert setup_calls == ["capture"]
+        assert teardown_calls == ["restore"]
+
+    def test_main_thread_non_windows_uses_modal(self):
+        """On macOS/Linux main thread, the queue-based modal is still used."""
+        cli = _make_cli()
+
+        # We need to simulate the modal receiving a response. We'll patch
+        # the response_queue to immediately return a value.
         with patch.object(sys, "platform", "darwin"), \
              patch.object(cli, "_capture_modal_input_snapshot"), \
              patch.object(cli, "_restore_modal_input_snapshot"), \
-             patch.object(cli, "_invalidate"), \
-             patch.object(cli, "_prompt_text_input") as mock_stdin:
-            answerer = threading.Thread(target=_answer_modal_when_open, args=(cli, "once"), daemon=True)
-            answerer.start()
-            result = cli._prompt_text_input_modal(
-                title="⚠️  /new",
-                detail="This starts a fresh session.",
-                choices=_SAMPLE_CHOICES,
-                timeout=5,
-            )
-            answerer.join(timeout=2.0)
+             patch.object(cli, "_invalidate"):
+            # Start the modal in a way that it will receive a response
+            # immediately via the queue.
+            original_queue = queue.Queue
+            original_time = time.monotonic
 
-        mock_stdin.assert_not_called()
-        assert result == "once"
+            def _fake_modal_flow(*args, **kwargs):
+                """Simulate the modal flow: set state, put response, return."""
+                # We'll directly test that the modal path is entered by
+                # checking that _slash_confirm_state was set.
+                pass
+
+            # Since we can't easily mock the internal queue, let's test
+            # that the modal path is entered by checking that
+            # _prompt_text_input was NOT called.
+            with patch.object(cli, "_prompt_text_input") as mock_stdin:
+                # Set up a response that will be put into the queue
+                # after the modal starts waiting.
+                def _submit_after_delay():
+                    time.sleep(0.2)
+                    state = cli._slash_confirm_state
+                    if state and "response_queue" in state:
+                        state["response_queue"].put("once")
+
+                submitter = threading.Thread(target=_submit_after_delay, daemon=True)
+                submitter.start()
+
+                result = cli._prompt_text_input_modal(
+                    title="⚠️  /new",
+                    detail="This starts a fresh session.",
+                    choices=_SAMPLE_CHOICES,
+                    timeout=5,
+                )
+
+                submitter.join(timeout=2.0)
+
+            # The stdin fallback should NOT have been called.
+            mock_stdin.assert_not_called()
+            # The result should be "once" from the simulated modal response.
+            assert result == "once"
 
     def test_no_app_falls_back_to_stdin(self):
-        """Without a running app (oneshot / non-interactive), use the stdin prompt."""
+        """Without a prompt_toolkit app, always use stdin fallback."""
         cli = _make_cli()
         cli._app = None
 
@@ -159,102 +173,78 @@ class TestModal:
         mock_stdin.assert_called_once_with("Choice [1/2/3]: ")
         assert result == "3"
 
-    def test_windows_no_app_falls_back_to_stdin(self):
-        """win32 without a running app keeps stdin — the only case where the raw
-        prompt is safe on Windows, since no app owns the console to deadlock."""
-        cli = _make_cli()
-        cli._app = None
-
-        with patch.object(sys, "platform", "win32"), \
-             patch.object(cli, "_prompt_text_input", return_value="1") as mock_stdin:
-            result = cli._prompt_text_input_modal(
-                title="⚠️  /new — destroys conversation state",
-                detail="This starts a fresh session.",
-                choices=_SAMPLE_CHOICES,
-            )
-
-        mock_stdin.assert_called_once_with("Choice [1/2/3]: ")
-        assert result == "1"
-
-    def test_windows_scheduling_failure_clean_cancels(self):
-        """win32 off the main thread: if marshaling onto the app loop fails, cancel
-        cleanly (None) rather than fall to raw input() (which deadlocks on native
-        Windows) or hang. Asserts the _stdin_fallback guard (#33961)."""
-        cli = _make_cli()
-
-        def _raise(_cb):
-            raise RuntimeError("loop closed")
-
-        outcome = _run_on_daemon(
-            lambda: cli._prompt_text_input_modal(
-                title="⚠️  /reset",
-                detail="This starts a fresh session.",
-                choices=_SAMPLE_CHOICES,
-                timeout=5,
-            ),
-            cli,
-            platform="win32",
-            response="once",
-            schedule=_raise,
-        )
-        assert outcome["stdin_called"] is False, "win32 off-thread must NOT call raw input()"
-        assert outcome["result"] is None
-        assert cli._slash_confirm_state is None
-
-    @pytest.mark.parametrize(
-        "platform, expect_stdin, expect_result",
-        [("win32", False, None), ("linux", True, "1")],
-    )
-    def test_daemon_thread_no_app_loop_uses_fallback(self, platform, expect_stdin, expect_result):
-        """Off the daemon thread with no resolvable app loop (``self._app.loop``
-        is None / raises), the modal can never be scheduled, so the method short-
-        circuits at the app_loop-is-None site (cli.py ~7260) — a distinct path
-        from a call_soon_threadsafe failure. win32 clean-cancels (None) instead of
-        deadlocking on raw input(); other platforms keep the stdin prompt."""
-        cli = _make_cli()
-        cli._app.loop = None  # forces app_loop is None, off the main thread
-
-        outcome = {"result": None, "stdin_called": False}
-        done = threading.Event()
-
-        def _worker():
-            try:
-                with patch.object(sys, "platform", platform), \
-                     patch.object(cli, "_prompt_text_input", return_value="1") as mock_stdin, \
-                     patch.object(cli, "_invalidate"):
-                    outcome["result"] = cli._prompt_text_input_modal(
-                        title="⚠️  /reset",
-                        detail="This starts a fresh session.",
-                        choices=_SAMPLE_CHOICES,
-                        timeout=5,
-                    )
-                    outcome["stdin_called"] = mock_stdin.called
-            finally:
-                done.set()
-
-        worker = threading.Thread(target=_worker, daemon=True)
-        worker.start()
-        worker.join(timeout=2.0)
-        assert not worker.is_alive(), "daemon thread hung — modal deadlocked"
-        assert outcome["stdin_called"] is expect_stdin
-        assert outcome["result"] == expect_result
-        assert cli._slash_confirm_state is None
-
     def test_empty_choices_returns_none(self):
-        """Empty choices returns None without prompting."""
+        """Empty choices list should return None without prompting."""
         cli = _make_cli()
 
         with patch.object(cli, "_prompt_text_input") as mock_stdin:
-            result = cli._prompt_text_input_modal(title="Test", detail="Test", choices=[])
+            result = cli._prompt_text_input_modal(
+                title="Test",
+                detail="Test",
+                choices=[],
+            )
 
         mock_stdin.assert_not_called()
         assert result is None
 
+    def test_windows_fallback_does_not_set_modal_state(self):
+        """Verify Windows fallback doesn't leave _slash_confirm_state set."""
+        cli = _make_cli()
+
+        with patch.object(sys, "platform", "win32"), \
+             patch.object(cli, "_prompt_text_input", return_value="1"):
+            cli._prompt_text_input_modal(
+                title="⚠️  /reset",
+                detail="This starts a fresh session.",
+                choices=_SAMPLE_CHOICES,
+            )
+
+        assert cli._slash_confirm_state is None
+
+    def test_non_main_thread_modal_clears_state(self):
+        """Verify daemon-thread modal teardown does not leave state behind."""
+        cli = _make_cli()
+        errors = []
+
+        def _call_soon_threadsafe(callback):
+            callback()
+
+        def run_on_daemon():
+            try:
+                with patch.object(sys, "platform", "linux"), \
+                     patch.object(cli._app.loop, "call_soon_threadsafe", side_effect=_call_soon_threadsafe):
+                    def _submit_after_delay():
+                        time.sleep(0.2)
+                        state = cli._slash_confirm_state
+                        if state and "response_queue" in state:
+                            state["response_queue"].put("cancel")
+
+                    submitter = threading.Thread(target=_submit_after_delay, daemon=True)
+                    submitter.start()
+                    cli._prompt_text_input_modal(
+                        title="⚠️  /new",
+                        detail="This starts a fresh session.",
+                        choices=_SAMPLE_CHOICES,
+                        timeout=5,
+                    )
+                    submitter.join(timeout=2.0)
+                if cli._slash_confirm_state is not None:
+                    errors.append("_slash_confirm_state should be None")
+            except Exception as exc:
+                errors.append(str(exc))
+
+        t = threading.Thread(target=run_on_daemon, daemon=True)
+        t.start()
+        t.join(timeout=2.0)
+        assert not errors, f"unexpected errors: {errors}"
+        assert cli._slash_confirm_state is None
+
 
 class TestConfirmDestructiveSlashWindows:
-    """End-to-end _confirm_destructive_slash on the native-Windows daemon thread."""
+    """Integration-level tests for _confirm_destructive_slash on Windows."""
 
-    def _make_interactive_cli(self):
+    def test_confirm_destructive_slash_bypasses_modal_on_windows(self):
+        """_confirm_destructive_slash should work on Windows via stdin fallback."""
         cli = _make_cli()
         cli.model = "test-model"
         cli._agent_running = False
@@ -265,140 +255,37 @@ class TestConfirmDestructiveSlashWindows:
         cli._pending_tool_info = {}
         cli._tool_start_time = 0.0
         cli._last_scrollback_tool = ""
-        return cli
 
-    @pytest.mark.parametrize(
-        "response, expected",
-        [("once", "once"), ("cancel", None)],
-    )
-    def test_confirm_destructive_slash_uses_modal_on_windows(self, response, expected):
-        """On native Windows, the bare /new confirm drives the modal (not stdin)
-        and returns the chosen outcome — the bug #33961 froze this path."""
-        cli = self._make_interactive_cli()
-        with patch("cli.load_cli_config", return_value={"approvals": {"destructive_slash_confirm": True}}):
-            outcome = _run_on_daemon(
-                lambda: cli._confirm_destructive_slash(
-                    "new",
-                    "This starts a fresh session.\nThe current conversation history will be discarded.",
-                ),
-                cli,
-                platform="win32",
-                response=response,
+        with patch.object(sys, "platform", "win32"), \
+             patch.object(cli, "_prompt_text_input", return_value="1"), \
+             patch("cli.load_cli_config", return_value={"approvals": {"destructive_slash_confirm": True}}):
+            result = cli._confirm_destructive_slash(
+                "new",
+                "This starts a fresh session.\nThe current conversation history will be discarded.",
             )
 
-        assert outcome["stdin_called"] is False
-        assert outcome["result"] == expected
+        assert result == "once"
 
-
-class TestNativeWindowsNoRawInputDeadlock:
-    """Anti-regression guard exercising the REAL ``_prompt_text_input``.
-
-    Every other test here mocks ``_prompt_text_input`` away, so they only
-    assert *routing* (modal vs. stdin) — they cannot observe the actual hang
-    that #33961 was.  The historical regression was precisely that
-    ``_prompt_text_input_modal`` delegated to the *real* ``_prompt_text_input``
-    on native Windows, which on a non-main thread runs a bare ``input()`` that
-    blocks forever against prompt_toolkit's stdin ownership.
-
-    These tests let the real ``_prompt_text_input`` run with a blocking
-    ``input()`` and assert the worker thread never hangs.  They fail on the
-    pre-#33961 code (win32 → ``_prompt_text_input`` → off-main ``input()``)
-    and pass once the modal path / clean-cancel fallback is in place.
-    """
-
-    def test_win32_daemon_thread_never_blocks_on_real_input(self):
-        """A blocking input() must NOT hang the daemon thread on win32.
-
-        Drives the genuine helper chain (no mock of ``_prompt_text_input``)
-        with ``builtins.input`` patched to block forever. The confirm must
-        resolve via the app-loop modal (answered on a background thread, as
-        the real key bindings would) and never sit in ``input()``.  On the
-        pre-#33961 code the win32 early-return routed to the real
-        ``_prompt_text_input`` → off-main ``input()`` → permanent hang.
-        """
+    def test_confirm_destructive_slash_cancelled_on_windows(self):
+        """Cancellation via stdin fallback works on Windows."""
         cli = _make_cli()
-        cli._app.loop.call_soon_threadsafe = lambda cb: cb()
+        cli.model = "test-model"
+        cli._agent_running = False
+        cli._spinner_text = ""
+        cli._should_exit = False
+        cli._command_running = False
+        cli.session_id = "test-session"
+        cli._pending_tool_info = {}
+        cli._tool_start_time = 0.0
+        cli._last_scrollback_tool = ""
 
-        def _blocking_input(prompt=""):  # stands in for "no line ever arrives"
-            time.sleep(30)
-            return "1"
+        with patch.object(sys, "platform", "win32"), \
+             patch.object(cli, "_prompt_text_input", return_value="3"), \
+             patch("cli.load_cli_config", return_value={"approvals": {"destructive_slash_confirm": True}}):
+            result = cli._confirm_destructive_slash(
+                "reset",
+                "This starts a fresh session.\nThe current conversation history will be discarded.",
+            )
 
-        outcome = {}
-        done = threading.Event()
-
-        def _worker():
-            try:
-                with patch.object(sys, "platform", "win32"), \
-                     patch("builtins.input", side_effect=_blocking_input), \
-                     patch.object(cli, "_capture_modal_input_snapshot"), \
-                     patch.object(cli, "_restore_modal_input_snapshot"), \
-                     patch.object(cli, "_invalidate"):
-                    outcome["result"] = cli._prompt_text_input_modal(
-                        title="/new",
-                        detail="destroys conversation state",
-                        choices=_SAMPLE_CHOICES,
-                        timeout=3,
-                    )
-            finally:
-                done.set()
-
-        worker = threading.Thread(target=_worker, daemon=True)
-        answerer = threading.Thread(
-            target=_answer_modal_when_open, args=(cli, "cancel", done), daemon=True
-        )
-        answerer.start()
-        worker.start()
-        worker.join(timeout=5.0)
-        answerer.join(timeout=5.0)
-        assert not worker.is_alive(), (
-            "daemon thread hung in real input() — native-Windows confirm "
-            "deadlock regressed (#33961)"
-        )
-        # cancel → None; the point is it RETURNED rather than blocking forever.
-        assert outcome.get("result") in (None, "cancel")
-
-    def test_win32_scheduling_failure_cleanly_cancels_no_input(self):
-        """If the modal can't be marshaled onto the app loop on native Windows
-        (scheduling failure) the off-main-thread path must cancel cleanly —
-        NOT fall through to a blocking raw ``input()``.
-
-        This is the degraded branch the pre-#33961 code handled with
-        ``return self._prompt_text_input(...)`` (which deadlocks); the fix
-        returns ``None`` instead.
-        """
-        cli = _make_cli()
-
-        def _raise(cb):  # call_soon_threadsafe scheduling failure
-            raise RuntimeError("event loop closed")
-
-        cli._app.loop.call_soon_threadsafe = _raise
-
-        input_called = {"n": 0}
-
-        def _tracking_input(prompt=""):
-            input_called["n"] += 1
-            time.sleep(30)
-            return "1"
-
-        outcome = {}
-
-        def _worker():
-            with patch.object(sys, "platform", "win32"), \
-                 patch("builtins.input", side_effect=_tracking_input), \
-                 patch.object(cli, "_invalidate"):
-                outcome["result"] = cli._prompt_text_input_modal(
-                    title="/new",
-                    detail="destroys conversation state",
-                    choices=_SAMPLE_CHOICES,
-                    timeout=3,
-                )
-
-        worker = threading.Thread(target=_worker, daemon=True)
-        worker.start()
-        worker.join(timeout=5.0)
-        assert not worker.is_alive(), (
-            "daemon thread hung — win32 scheduling-failure fallback used raw "
-            "input() instead of cleanly cancelling (#33961)"
-        )
-        assert input_called["n"] == 0, "win32 off-thread fallback must not call input()"
-        assert outcome.get("result") is None
+        # Choice "3" normalizes to "cancel", which returns None.
+        assert result is None

tests/gateway/test_media_extraction.py

@@ -159,106 +159,7 @@ caption
         tags, voice = _collect_auto_append_media_tags(messages, history_offset=0)
         assert tags == ["MEDIA:/tmp/voice.ogg"]
         assert voice is True
-
-    def test_gateway_auto_append_image_generate_json_path(self):
-        """image_generate returns a local path in JSON (no MEDIA: tag); it is
-        auto-appended so delivery doesn't depend on the model restating it."""
-        from gateway.run import _collect_auto_append_media_tags
-
-        messages = [
-            {"role": "user", "content": "Make me a cat"},
-            {
-                "role": "assistant",
-                "tool_calls": [
-                    {"id": "call_img", "function": {"name": "image_generate"}}
-                ],
-            },
-            {
-                "role": "tool",
-                "tool_call_id": "call_img",
-                "content": '{"success": true, "image": "/tmp/gen/cat.png", "agent_visible_image": "/tmp/gen/cat.png"}',
-            },
-            {"role": "assistant", "content": "Here's your cat."},
-        ]
-
-        tags, voice = _collect_auto_append_media_tags(messages, history_offset=0)
-        assert tags == ["MEDIA:/tmp/gen/cat.png"]
-        assert voice is False
-
-    def test_gateway_auto_append_image_generate_prefers_host_path(self):
-        """When host and sandbox paths differ, the host-deliverable path wins."""
-        from gateway.run import _collect_auto_append_media_tags
-
-        messages = [
-            {"role": "user", "content": "Make me a dog"},
-            {
-                "role": "assistant",
-                "tool_calls": [
-                    {"id": "call_img", "function": {"name": "image_generate"}}
-                ],
-            },
-            {
-                "role": "tool",
-                "tool_call_id": "call_img",
-                "content": '{"success": true, "host_image": "/host/dog.jpg", "image": "/host/dog.jpg", "agent_visible_image": "/sandbox/dog.jpg"}',
-            },
-        ]
-
-        tags, _ = _collect_auto_append_media_tags(messages, history_offset=0)
-        assert tags == ["MEDIA:/host/dog.jpg"]
-
-    def test_gateway_auto_append_image_generate_failure_and_url_ignored(self):
-        """Failed generations and remote URLs are not auto-delivered."""
-        from gateway.run import _collect_auto_append_media_tags
-
-        def _img_msgs(content):
-            return [
-                {
-                    "role": "assistant",
-                    "tool_calls": [
-                        {"id": "c", "function": {"name": "image_generate"}}
-                    ],
-                },
-                {"role": "tool", "tool_call_id": "c", "content": content},
-            ]
-
-        # Failed generation
-        tags, _ = _collect_auto_append_media_tags(
-            _img_msgs('{"success": false, "image": null, "error": "boom"}'),
-            history_offset=0,
-        )
-        assert tags == []
-
-        # Remote URL is not a local file path
-        tags, _ = _collect_auto_append_media_tags(
-            _img_msgs('{"success": true, "image": "https://fal.media/x/cat.png"}'),
-            history_offset=0,
-        )
-        assert tags == []
-
-    def test_gateway_auto_append_image_generate_dedupes_history(self):
-        """A generated image path already in history is not re-sent."""
-        from gateway.run import _collect_auto_append_media_tags
-
-        messages = [
-            {
-                "role": "assistant",
-                "tool_calls": [
-                    {"id": "c", "function": {"name": "image_generate"}}
-                ],
-            },
-            {
-                "role": "tool",
-                "tool_call_id": "c",
-                "content": '{"success": true, "image": "/tmp/gen/cat.png"}',
-            },
-        ]
-
-        tags, _ = _collect_auto_append_media_tags(
-            messages, history_offset=0, history_media_paths={"/tmp/gen/cat.png"}
-        )
-        assert tags == []
-
+    
     def test_media_tags_not_extracted_from_history(self):
         """MEDIA tags from previous turns should NOT be extracted again."""
         # Simulate conversation history with a TTS call from a previous turn

tests/gateway/test_run_progress_topics.py

@@ -1264,125 +1264,3 @@ async def test_verbose_mode_respects_explicit_tool_preview_length(monkeypatch, t
     assert VerboseAgent.LONG_CODE not in all_content
     # But should still contain the truncated portion with "..."
     assert "..." in all_content
-
-
-class CodeBlockProgressAdapter(ProgressCaptureAdapter):
-    """A markdown-capable progress adapter (declares supports_code_blocks)."""
-
-    supports_code_blocks = True
-
-
-class TerminalCommandAgent:
-    """Emits a terminal tool.started with a real, multi-line command arg."""
-
-    CMD = (
-        "set -euo pipefail\n"
-        "printf 'node: '; node --version\n"
-        "npm install -g hyperframes@latest"
-    )
-
-    def __init__(self, **kwargs):
-        self.tool_progress_callback = kwargs.get("tool_progress_callback")
-        self.tools = []
-
-    def run_conversation(self, message, conversation_history=None, task_id=None):
-        self.tool_progress_callback(
-            "tool.started", "terminal", self.CMD, {"command": self.CMD}
-        )
-        # Let the async progress task drain the queue and send before returning.
-        time.sleep(0.35)
-        return {"final_response": "done", "messages": [], "api_calls": 1}
-
-
-@pytest.mark.asyncio
-async def test_terminal_progress_renders_fenced_code_block(monkeypatch, tmp_path):
-    """Terminal progress on a markdown-capable (supports_code_blocks) gateway
-    renders the full command in a bare fenced code block — no language tag
-    (Slack mrkdwn would print 'bash' as a literal first code line)."""
-    monkeypatch.setenv("HERMES_TOOL_PROGRESS_MODE", "all")
-
-    fake_dotenv = types.ModuleType("dotenv")
-    fake_dotenv.load_dotenv = lambda *args, **kwargs: None
-    monkeypatch.setitem(sys.modules, "dotenv", fake_dotenv)
-
-    fake_run_agent = types.ModuleType("run_agent")
-    fake_run_agent.AIAgent = TerminalCommandAgent
-    monkeypatch.setitem(sys.modules, "run_agent", fake_run_agent)
-    import tools.terminal_tool  # noqa: F401 - register terminal emoji
-
-    adapter = CodeBlockProgressAdapter(platform=Platform.TELEGRAM)
-    runner = _make_runner(adapter)
-    gateway_run = importlib.import_module("gateway.run")
-    monkeypatch.setattr(gateway_run, "_hermes_home", tmp_path)
-    monkeypatch.setattr(gateway_run, "_resolve_runtime_agent_kwargs", lambda: {"api_key": "***"})
-
-    source = SessionSource(
-        platform=Platform.TELEGRAM,
-        chat_id="12345",
-        chat_type="dm",
-        thread_id=None,
-    )
-
-    result = await runner._run_agent(
-        message="hello",
-        context_prompt="",
-        history=[],
-        source=source,
-        session_id="sess-terminal-code-block",
-        session_key="agent:main:telegram:dm:12345",
-    )
-
-    assert result["final_response"] == "done"
-    all_content = " ".join(call["content"] for call in adapter.sent)
-    all_content += " ".join(call["content"] for call in adapter.edits)
-    # Bare fenced block, no language tag (no '```bash').
-    assert "```" in all_content
-    assert "```bash" not in all_content
-    # The full multi-line command body IS present in the block.
-    assert "npm install -g hyperframes@latest" in all_content
-    # No truncated quoted preview for the terminal command.
-    assert 'terminal: "' not in all_content
-
-
-@pytest.mark.asyncio
-async def test_terminal_progress_no_bash_block_in_verbose_mode(monkeypatch, tmp_path):
-    """#41215 also rendered the bash block in verbose mode. The revert removed it
-    from both branches, so verbose progress must not emit a fenced ```bash block
-    either (verbose still shows args by opt-in, just not as a code block)."""
-    monkeypatch.setenv("HERMES_TOOL_PROGRESS_MODE", "verbose")
-
-    fake_dotenv = types.ModuleType("dotenv")
-    fake_dotenv.load_dotenv = lambda *args, **kwargs: None
-    monkeypatch.setitem(sys.modules, "dotenv", fake_dotenv)
-
-    fake_run_agent = types.ModuleType("run_agent")
-    fake_run_agent.AIAgent = TerminalCommandAgent
-    monkeypatch.setitem(sys.modules, "run_agent", fake_run_agent)
-    import tools.terminal_tool  # noqa: F401 - register terminal emoji
-
-    adapter = CodeBlockProgressAdapter(platform=Platform.TELEGRAM)
-    runner = _make_runner(adapter)
-    gateway_run = importlib.import_module("gateway.run")
-    monkeypatch.setattr(gateway_run, "_hermes_home", tmp_path)
-    monkeypatch.setattr(gateway_run, "_resolve_runtime_agent_kwargs", lambda: {"api_key": "***"})
-
-    source = SessionSource(
-        platform=Platform.TELEGRAM,
-        chat_id="12345",
-        chat_type="dm",
-        thread_id=None,
-    )
-
-    result = await runner._run_agent(
-        message="hello",
-        context_prompt="",
-        history=[],
-        source=source,
-        session_id="sess-terminal-verbose-no-bash",
-        session_key="agent:main:telegram:dm:12345",
-    )
-
-    assert result["final_response"] == "done"
-    all_content = " ".join(call["content"] for call in adapter.sent)
-    all_content += " ".join(call["content"] for call in adapter.edits)
-    assert "```bash" not in all_content

tests/gateway/test_session_api.py

@@ -75,54 +75,6 @@ async def test_capabilities_advertises_session_control_surface(adapter):
     }
 
 
-@pytest.mark.asyncio
-async def test_run_agent_binds_api_session_context_for_tool_env(adapter, monkeypatch):
-    """API-server request sessions should reach tools and terminal subprocess env."""
-    monkeypatch.setenv("HERMES_SESSION_ID", "stale-session")
-    observed = {}
-
-    class FakeAgent:
-        session_prompt_tokens = 0
-        session_completion_tokens = 0
-        session_total_tokens = 0
-
-        def __init__(self, session_id: str):
-            self.session_id = session_id
-
-        def run_conversation(self, user_message, conversation_history, task_id):
-            from gateway.session_context import get_session_env
-            from tools.environments.local import _make_run_env
-
-            observed["task_id"] = task_id
-            observed["context_session_id"] = get_session_env("HERMES_SESSION_ID")
-            observed["context_platform"] = get_session_env("HERMES_SESSION_PLATFORM")
-            observed["context_session_key"] = get_session_env("HERMES_SESSION_KEY")
-            observed["child_session_id"] = _make_run_env({}).get("HERMES_SESSION_ID")
-            return {"final_response": "ok"}
-
-    def fake_create_agent(**kwargs):
-        return FakeAgent(kwargs["session_id"])
-
-    monkeypatch.setattr(adapter, "_create_agent", fake_create_agent)
-
-    result, usage = await adapter._run_agent(
-        user_message="hello",
-        conversation_history=[],
-        session_id="request-session",
-        gateway_session_key="request-key",
-    )
-
-    assert result["session_id"] == "request-session"
-    assert usage == {"input_tokens": 0, "output_tokens": 0, "total_tokens": 0}
-    assert observed == {
-        "task_id": "request-session",
-        "context_session_id": "request-session",
-        "context_platform": "api_server",
-        "context_session_key": "request-key",
-        "child_session_id": "request-session",
-    }
-
-
 @pytest.mark.asyncio
 async def test_session_crud_and_message_history(adapter, session_db):
     app = _create_session_app(adapter)

tests/gateway/test_session_env.py

@@ -190,17 +190,6 @@ def test_session_key_falls_back_to_os_environ(monkeypatch):
     assert get_session_env("HERMES_SESSION_KEY") == ""
 
 
-def test_session_id_set_via_contextvars(monkeypatch):
-    """set_session_vars should set HERMES_SESSION_ID via contextvars."""
-    monkeypatch.setenv("HERMES_SESSION_ID", "stale-env-session")
-
-    tokens = set_session_vars(session_id="ctx-session-456")
-    assert get_session_env("HERMES_SESSION_ID") == "ctx-session-456"
-
-    clear_session_vars(tokens)
-    assert get_session_env("HERMES_SESSION_ID") == ""
-
-
 def test_set_session_env_includes_session_key():
     """_set_session_env should propagate session_key from SessionContext."""
     runner = object.__new__(GatewayRunner)

tests/gateway/test_simplex_plugin.py

@@ -205,13 +205,6 @@ def test_corr_id_pending_set_self_trims():
 
 @pytest.mark.asyncio
 async def test_send_dm():
-    """DMs use the bare ``@<id> text`` chat-command form.
-
-    The bracketed form ``@[<id>] text`` is what the daemon's man page
-    documents, but in practice both addressing styles route through
-    the same chat-command parser; bare ``@<id>`` matches what every
-    Hermes deployment has been using in production for months.
-    """
     from gateway.config import PlatformConfig
     cfg = PlatformConfig(enabled=True, extra={"ws_url": "ws://localhost:5225"})
     adapter = SimplexAdapter(cfg)
@@ -229,14 +222,6 @@ async def test_send_dm():
 
 @pytest.mark.asyncio
 async def test_send_group():
-    """Groups use the structured ``/_send #<id> json [...]`` form.
-
-    The bracket chat-command form ``#[<id>] text`` *looks* like an exact
-    ID match in the daemon docs but is parsed as a display-name lookup
-    — so messages to groups whose display name isn't literally the ID
-    silently drop. The structured ``/_send`` form addresses by numeric
-    ID and survives newlines/quoting through ``json.dumps``.
-    """
     from gateway.config import PlatformConfig
     cfg = PlatformConfig(enabled=True, extra={"ws_url": "ws://localhost:5225"})
     adapter = SimplexAdapter(cfg)
@@ -246,11 +231,7 @@ async def test_send_group():
 
     result = await adapter.send("group:grp-99", "Hello, group!")
     payload = json.loads(mock_ws.send.call_args[0][0])
-    assert payload["cmd"].startswith("/_send #grp-99 json ")
-    msg_content = json.loads(payload["cmd"].split(" json ", 1)[1])[0][
-        "msgContent"
-    ]
-    assert msg_content == {"type": "text", "text": "Hello, group!"}
+    assert payload["cmd"] == "#[grp-99] Hello, group!"
     assert result.success is True
 
 

tests/gateway/test_telegram_format.py

@@ -835,7 +835,7 @@ class TestEditMessageStreamingSafety:
         assert second_call == {
             "chat_id": 123,
             "message_id": 456,
-            "text": "final bold",
+            "text": "final **bold**",
         }
 
     @pytest.mark.asyncio

tests/hermes_cli/conftest.py

@@ -2,8 +2,6 @@
 
 from __future__ import annotations
 
-import sys
-
 import pytest
 
 
@@ -23,42 +21,26 @@ def all_assignees_spawnable(monkeypatch):
 
 @pytest.fixture(autouse=True)
 def _suppress_concurrent_hermes_gate(request, monkeypatch):
-    """Default ``_detect_concurrent_hermes_instances`` to ``[]`` on Windows hosts.
+    """Default ``_detect_concurrent_hermes_instances`` to ``[]`` for every test.
 
-    The Windows update path refuses to proceed when another ``hermes.exe`` is
-    detected (issue #26670). On a developer's Windows machine running the test
-    suite via ``hermes`` itself, this would flag the running agent as a
-    concurrent instance and abort every ``cmd_update`` test. This fixture
-    stubs the helper to ``[]`` so those tests run cleanly.
+    The Windows update path now refuses to proceed when another
+    ``hermes.exe`` is detected (issue #26670). On a developer's Windows
+    machine running the test suite via ``hermes`` itself, this would
+    flag the running agent as a concurrent instance and abort every
+    ``cmd_update`` test. Tests that want to exercise the gate explicitly
+    re-patch ``_detect_concurrent_hermes_instances`` with their own
+    return value — autouse here gives a clean default without touching
+    the rest of the suite.
 
-    Scope: the helper short-circuits to ``[]`` via ``not _is_windows()`` on
-    every non-Windows host (Linux CI, macOS), so there is nothing to suppress
-    there — and importing + monkeypatching ``hermes_cli.main`` for every test
-    in the package is exactly what raced a partially-initialized module under
-    pytest's per-test spawn isolation (the AttributeError flake). Gating the
-    whole fixture behind ``sys.platform == "win32"`` means CI never imports or
-    mutates ``main`` here, removing the race at its source while preserving the
-    Windows-dev behavior the fixture exists for.
-
-    Tests that need to call the REAL function (e.g. unit tests for the helper
-    itself, or that force ``_is_windows`` True) opt out with
-    ``@pytest.mark.real_concurrent_gate``.
+    Tests that need to call the REAL function (e.g. unit tests for the
+    helper itself) opt out with ``@pytest.mark.real_concurrent_gate``.
     """
-    if sys.platform != "win32":
-        return
     if request.node.get_closest_marker("real_concurrent_gate"):
         return
     try:
         from hermes_cli import main as _cli_main
     except Exception:
         return
-    # raising=False: defense-in-depth against a transiently partial
-    # hermes_cli.main module under spawn isolation. The attribute always
-    # exists once main.py finishes importing, so a no-op when it's briefly
-    # absent is the correct, race-free default.
     monkeypatch.setattr(
-        _cli_main,
-        "_detect_concurrent_hermes_instances",
-        lambda *_a, **_k: [],
-        raising=False,
+        _cli_main, "_detect_concurrent_hermes_instances", lambda *_a, **_k: []
     )

tests/hermes_cli/test_dashboard_register.py

@@ -27,7 +27,7 @@ import hermes_cli.dashboard_register as dr
 
 
 def _ns(**kw):
-    defaults = dict(name=None, redirect_uri=None, portal_url=None)
+    defaults = dict(name=None, redirect_uri=None)
     defaults.update(kw)
     return argparse.Namespace(**defaults)
 
@@ -76,7 +76,7 @@ def _fake_http_ok(payload: dict):
 
 class TestHappyPath:
     def _run(self, *, args, account_token="tok_abc", portal="https://portal.nousresearch.com",
-             response=None, captured=None, existing_client_id=None):
+             response=None, captured=None):
         response = response or {
             "client_id": "agent:selfhost-1",
             "id": "selfhost-1",
@@ -98,21 +98,12 @@ class TestHappyPath:
         def fake_save(key, value):
             saved[key] = value
 
-        # get_env_value is consulted twice: once for the stored client_id
-        # (idempotency key) and once for HERMES_DASHBOARD_PORTAL_URL. Route by
-        # key so a test can seed a prior client_id while keeping the portal
-        # unset (the default-portal-not-persisted path).
-        def fake_get_env(key):
-            if key == "HERMES_DASHBOARD_OAUTH_CLIENT_ID":
-                return existing_client_id
-            return None
-
         with patch(
             "hermes_cli.auth.resolve_nous_access_token", return_value=account_token
         ), patch("hermes_cli.config.is_managed", return_value=False), patch.object(
             dr, "_resolve_portal_base_url", return_value=portal
         ), patch(
-            "hermes_cli.config.get_env_value", side_effect=fake_get_env
+            "hermes_cli.config.get_env_value", return_value=None
         ), patch(
             "hermes_cli.config.save_env_value", side_effect=fake_save
         ), patch.object(
@@ -166,394 +157,6 @@ class TestHappyPath:
         )
 
 
-class TestIdempotentRerun(TestHappyPath):
-    """Re-running with a stored client_id updates instead of creating.
-
-    Inherits ``_run`` from TestHappyPath; the only new lever is
-    ``existing_client_id`` (the HERMES_DASHBOARD_OAUTH_CLIENT_ID a prior run
-    persisted), which the CLI re-sends so the portal updates that row.
-    """
-
-    def test_stored_client_id_is_sent_as_idempotency_key(self, capsys):
-        captured: dict = {}
-        # Portal echoes back the SAME id -> it updated in place.
-        self._run(
-            args=_ns(),
-            existing_client_id="agent:selfhost-1",
-            response={
-                "client_id": "agent:selfhost-1",
-                "id": "selfhost-1",
-                "name": "dreamy_tesla",
-                "kind": "SELF_HOSTED",
-                "custom_redirect_uri": None,
-                "created_at": "2026-06-04T12:00:00.000Z",
-            },
-            captured=captured,
-        )
-        assert captured["body"]["client_id"] == "agent:selfhost-1"
-
-    def test_rerun_without_name_omits_name_to_preserve_stored(self, capsys):
-        # No --name on a re-run: don't churn the portal-stored name. The CLI
-        # leaves `name` out of the body so the portal keeps what it has.
-        captured: dict = {}
-        self._run(
-            args=_ns(),
-            existing_client_id="agent:selfhost-1",
-            captured=captured,
-        )
-        assert "name" not in captured["body"]
-        assert captured["body"]["client_id"] == "agent:selfhost-1"
-
-    def test_rerun_with_explicit_name_still_sends_name(self, capsys):
-        captured: dict = {}
-        self._run(
-            args=_ns(name="renamed_box"),
-            existing_client_id="agent:selfhost-1",
-            captured=captured,
-        )
-        assert captured["body"]["name"] == "renamed_box"
-        assert captured["body"]["client_id"] == "agent:selfhost-1"
-
-    def test_rerun_prints_updated_when_same_id_returned(self, capsys):
-        self._run(
-            args=_ns(),
-            existing_client_id="agent:selfhost-1",
-            response={
-                "client_id": "agent:selfhost-1",
-                "id": "selfhost-1",
-                "name": "dreamy_tesla",
-                "kind": "SELF_HOSTED",
-                "custom_redirect_uri": None,
-                "created_at": "2026-06-04T12:00:00.000Z",
-            },
-        )
-        out = capsys.readouterr().out
-        assert "Updated dashboard" in out
-        assert "Registered dashboard" not in out
-
-    def test_rerun_persists_returned_client_id(self, capsys):
-        saved = self._run(
-            args=_ns(),
-            existing_client_id="agent:selfhost-1",
-        )
-        # Same id round-trips into .env -> idempotent, one record.
-        assert saved["HERMES_DASHBOARD_OAUTH_CLIENT_ID"] == "agent:selfhost-1"
-
-    def test_stale_id_falls_through_to_create_prints_registered(self, capsys):
-        # Stored id no longer resolves server-side -> portal created a fresh
-        # row and returns a DIFFERENT id. The CLI treats that as a create and
-        # persists the new id (re-run stays safe, never worse than first run).
-        captured: dict = {}
-        saved = self._run(
-            args=_ns(name="seed_name"),
-            existing_client_id="agent:selfhost-stale",
-            response={
-                "client_id": "agent:selfhost-new",
-                "id": "selfhost-new",
-                "name": "seed_name",
-                "kind": "SELF_HOSTED",
-                "custom_redirect_uri": None,
-                "created_at": "2026-06-04T12:00:00.000Z",
-            },
-            captured=captured,
-        )
-        # The stale id is still SENT (portal decides create-vs-update).
-        assert captured["body"]["client_id"] == "agent:selfhost-stale"
-        # Returned id differs from what we sent -> message is "Registered".
-        out = capsys.readouterr().out
-        assert "Registered dashboard" in out
-        assert "Updated dashboard" not in out
-        assert saved["HERMES_DASHBOARD_OAUTH_CLIENT_ID"] == "agent:selfhost-new"
-
-    def test_blank_stored_client_id_treated_as_first_run(self, capsys):
-        # A blank/whitespace stored value is not a usable key: treat as a
-        # first registration (auto-generate a name, don't send client_id).
-        captured: dict = {}
-        self._run(
-            args=_ns(),
-            existing_client_id="   ",
-            captured=captured,
-        )
-        assert "client_id" not in captured["body"]
-        assert captured["body"].get("name")  # auto-generated
-
-
-class TestCustomPortalPersistence:
-    """`--portal-url` / HERMES_DASHBOARD_PORTAL_URL is persisted to .env.
-
-    An *explicitly supplied* custom portal URL is an intentional choice the
-    user wants to survive across sessions, so it's always written (updating an
-    existing entry in place rather than appending a duplicate). When no custom
-    URL is supplied, the older conservative behaviour is preserved: an inferred
-    portal is only written when absent and non-default, and an existing entry
-    is never altered unexpectedly.
-    """
-
-    def _run(self, *, args, portal, existing_portal):
-        """Drive cmd_dashboard_register, capturing save_env_value calls.
-
-        `existing_portal` is what get_env_value returns for
-        HERMES_DASHBOARD_PORTAL_URL (None = not present in .env).
-        """
-        response = {
-            "client_id": "agent:selfhost-1",
-            "id": "selfhost-1",
-            "name": "dreamy_tesla",
-            "kind": "SELF_HOSTED",
-            "custom_redirect_uri": None,
-            "created_at": "2026-06-04T12:00:00.000Z",
-        }
-
-        saved: dict = {}
-
-        def fake_save(key, value):
-            saved[key] = value
-
-        def fake_get_env_value(key, *a, **kw):
-            if key == "HERMES_DASHBOARD_PORTAL_URL":
-                return existing_portal
-            return None
-
-        with patch(
-            "hermes_cli.auth.resolve_nous_access_token", return_value="tok"
-        ), patch("hermes_cli.config.is_managed", return_value=False), patch.dict(
-            dr.os.environ, {}, clear=False
-        ), patch.object(
-            dr, "_resolve_portal_base_url", return_value=portal
-        ), patch(
-            "hermes_cli.config.get_env_value", side_effect=fake_get_env_value
-        ), patch(
-            "hermes_cli.config.save_env_value", side_effect=fake_save
-        ), patch.object(
-            dr.urllib.request, "urlopen", return_value=_fake_http_ok(response)
-        ):
-            # The ambient process env may carry HERMES_DASHBOARD_PORTAL_URL
-            # (e.g. staging dev shells); drop it so `custom_portal_supplied`
-            # is driven solely by the args.portal_url under test.
-            dr.os.environ.pop("HERMES_DASHBOARD_PORTAL_URL", None)
-            dr.cmd_dashboard_register(args)
-        return saved
-
-    def test_explicit_custom_url_persisted_when_var_absent(self, capsys):
-        saved = self._run(
-            args=_ns(portal_url="https://preview.example.com"),
-            portal="https://preview.example.com",
-            existing_portal=None,
-        )
-        assert saved["HERMES_DASHBOARD_PORTAL_URL"] == "https://preview.example.com"
-
-    def test_explicit_custom_url_updates_existing_in_place(self, capsys):
-        # An entry already exists with a different value; the explicit custom
-        # URL overwrites it (save_env_value updates the matching key in place).
-        saved = self._run(
-            args=_ns(portal_url="https://new-preview.example.com"),
-            portal="https://new-preview.example.com",
-            existing_portal="https://old-preview.example.com",
-        )
-        assert (
-            saved["HERMES_DASHBOARD_PORTAL_URL"] == "https://new-preview.example.com"
-        )
-
-    def test_explicit_custom_url_persisted_even_when_equals_default(self, capsys):
-        # User explicitly asked for the production portal — honour the explicit
-        # request and persist it (the no-flag path would skip the default).
-        saved = self._run(
-            args=_ns(portal_url="https://portal.nousresearch.com"),
-            portal="https://portal.nousresearch.com",
-            existing_portal=None,
-        )
-        assert (
-            saved["HERMES_DASHBOARD_PORTAL_URL"] == "https://portal.nousresearch.com"
-        )
-
-    def test_explicit_custom_url_equal_to_existing_is_noop(self, capsys):
-        # Already persisted with the same value → no redundant write.
-        saved = self._run(
-            args=_ns(portal_url="https://preview.example.com"),
-            portal="https://preview.example.com",
-            existing_portal="https://preview.example.com",
-        )
-        assert "HERMES_DASHBOARD_PORTAL_URL" not in saved
-
-    def test_no_flag_default_portal_not_written(self, capsys):
-        # No custom URL supplied, resolves to default → not written.
-        saved = self._run(
-            args=_ns(),
-            portal="https://portal.nousresearch.com",
-            existing_portal=None,
-        )
-        assert "HERMES_DASHBOARD_PORTAL_URL" not in saved
-
-    def test_no_flag_does_not_overwrite_existing_entry(self, capsys):
-        # No custom URL supplied and the var already exists → left untouched,
-        # even if the inferred portal differs (acceptance criterion 4).
-        saved = self._run(
-            args=_ns(),
-            portal="https://inferred-from-login.example.com",
-            existing_portal="https://already-set.example.com",
-        )
-        assert "HERMES_DASHBOARD_PORTAL_URL" not in saved
-
-
-class TestPublicUrlPersistence:
-    """`--redirect-uri` derives & persists HERMES_DASHBOARD_PUBLIC_URL in .env.
-
-    --redirect-uri is the full public callback (e.g.
-    https://hermes.example.com/auth/callback). At serve time the dashboard auth
-    layer reconstructs that callback by appending "/auth/callback" to
-    HERMES_DASHBOARD_PUBLIC_URL, so the value that's actually consumed is the
-    ORIGIN (scheme://host). We derive the origin from the supplied redirect URI
-    and persist THAT as HERMES_DASHBOARD_PUBLIC_URL — the var the runtime reads
-    — so the public-URL override is genuinely wired, not just stored.
-
-    An explicitly supplied value is always written (updating an existing entry
-    in place rather than appending a duplicate); a no-op when it already
-    matches; and never written on a localhost-only install (no --redirect-uri).
-    """
-
-    def _run(self, *, args, existing_public=None):
-        """Drive cmd_dashboard_register, capturing save_env_value calls.
-
-        `existing_public` is what get_env_value returns for
-        HERMES_DASHBOARD_PUBLIC_URL (None = not present in .env).
-        """
-        response = {
-            "client_id": "agent:selfhost-1",
-            "id": "selfhost-1",
-            "name": "dreamy_tesla",
-            "kind": "SELF_HOSTED",
-            "custom_redirect_uri": getattr(args, "redirect_uri", None),
-            "created_at": "2026-06-04T12:00:00.000Z",
-        }
-
-        saved: dict = {}
-
-        def fake_save(key, value):
-            saved[key] = value
-
-        def fake_get_env_value(key, *a, **kw):
-            if key == "HERMES_DASHBOARD_PUBLIC_URL":
-                return existing_public
-            return None
-
-        with patch(
-            "hermes_cli.auth.resolve_nous_access_token", return_value="tok"
-        ), patch("hermes_cli.config.is_managed", return_value=False), patch.dict(
-            dr.os.environ, {}, clear=False
-        ), patch.object(
-            dr, "_resolve_portal_base_url", return_value="https://portal.nousresearch.com"
-        ), patch(
-            "hermes_cli.config.get_env_value", side_effect=fake_get_env_value
-        ), patch(
-            "hermes_cli.config.save_env_value", side_effect=fake_save
-        ), patch.object(
-            dr.urllib.request, "urlopen", return_value=_fake_http_ok(response)
-        ):
-            dr.os.environ.pop("HERMES_DASHBOARD_PORTAL_URL", None)
-            dr.cmd_dashboard_register(args)
-        return saved
-
-    def test_origin_derived_from_full_callback_path(self, capsys):
-        # The key behaviour: a full callback URL is reduced to its ORIGIN so
-        # the runtime's "public_url + /auth/callback" reconstruction matches.
-        saved = self._run(
-            args=_ns(redirect_uri="https://hermes.example.com/auth/callback"),
-            existing_public=None,
-        )
-        assert saved["HERMES_DASHBOARD_PUBLIC_URL"] == "https://hermes.example.com"
-        # The full callback path must NOT be persisted verbatim (would double
-        # the path at serve time).
-        assert "/auth/callback" not in saved["HERMES_DASHBOARD_PUBLIC_URL"]
-
-    def test_origin_preserves_port(self, capsys):
-        saved = self._run(
-            args=_ns(redirect_uri="https://hermes.example.com:8443/auth/callback"),
-            existing_public=None,
-        )
-        assert saved["HERMES_DASHBOARD_PUBLIC_URL"] == "https://hermes.example.com:8443"
-
-    def test_public_url_updates_existing_in_place(self, capsys):
-        # A stale public-url entry exists; the new derived origin overwrites it.
-        saved = self._run(
-            args=_ns(redirect_uri="https://new.example.com/auth/callback"),
-            existing_public="https://old.example.com",
-        )
-        assert saved["HERMES_DASHBOARD_PUBLIC_URL"] == "https://new.example.com"
-
-    def test_public_url_equal_to_existing_is_noop(self, capsys):
-        # Derived origin already matches what's stored → no redundant write.
-        saved = self._run(
-            args=_ns(redirect_uri="https://hermes.example.com/auth/callback"),
-            existing_public="https://hermes.example.com",
-        )
-        assert "HERMES_DASHBOARD_PUBLIC_URL" not in saved
-
-    def test_no_redirect_flag_not_written(self, capsys):
-        # Localhost-only install (no --redirect-uri) → var left untouched.
-        saved = self._run(
-            args=_ns(),
-            existing_public=None,
-        )
-        assert "HERMES_DASHBOARD_PUBLIC_URL" not in saved
-
-    def test_no_redirect_flag_does_not_overwrite_existing(self, capsys):
-        # No --redirect-uri supplied but a value already exists → never touch
-        # it (an existing entry is only changed by an explicit new value).
-        saved = self._run(
-            args=_ns(),
-            existing_public="https://already-set.example.com",
-        )
-        assert "HERMES_DASHBOARD_PUBLIC_URL" not in saved
-
-    def test_non_http_redirect_not_persisted(self, capsys):
-        # A malformed / non-http(s) redirect yields no derivable origin → skip.
-        saved = self._run(
-            args=_ns(redirect_uri="not-a-url"),
-            existing_public=None,
-        )
-        assert "HERMES_DASHBOARD_PUBLIC_URL" not in saved
-
-    def test_public_url_persisted_alongside_portal_url(self, capsys):
-        # Both --portal-url and --redirect-uri supplied → portal_url AND the
-        # derived public_url are both persisted (ADD semantics: the public-url
-        # write does not displace portal-url persistence).
-        response = {
-            "client_id": "agent:selfhost-1",
-            "id": "selfhost-1",
-            "name": "dreamy_tesla",
-            "kind": "SELF_HOSTED",
-            "custom_redirect_uri": "https://hermes.example.com/auth/callback",
-            "created_at": "2026-06-04T12:00:00.000Z",
-        }
-        saved: dict = {}
-
-        def fake_save(key, value):
-            saved[key] = value
-
-        with patch(
-            "hermes_cli.auth.resolve_nous_access_token", return_value="tok"
-        ), patch("hermes_cli.config.is_managed", return_value=False), patch.dict(
-            dr.os.environ, {}, clear=False
-        ), patch.object(
-            dr, "_resolve_portal_base_url", return_value="https://preview.example.com"
-        ), patch(
-            "hermes_cli.config.get_env_value", return_value=None
-        ), patch(
-            "hermes_cli.config.save_env_value", side_effect=fake_save
-        ), patch.object(
-            dr.urllib.request, "urlopen", return_value=_fake_http_ok(response)
-        ):
-            dr.os.environ.pop("HERMES_DASHBOARD_PORTAL_URL", None)
-            dr.cmd_dashboard_register(
-                _ns(
-                    portal_url="https://preview.example.com",
-                    redirect_uri="https://hermes.example.com/auth/callback",
-                )
-            )
-        assert saved["HERMES_DASHBOARD_PORTAL_URL"] == "https://preview.example.com"
-        assert saved["HERMES_DASHBOARD_PUBLIC_URL"] == "https://hermes.example.com"
-
-
 class TestPortalResolution:
     def test_override_arg_wins(self):
         assert (

tests/hermes_cli/test_doctor.py

@@ -540,54 +540,6 @@ def test_run_doctor_accepts_hermes_provider_ids_that_catalog_aliases(
         )
 
 
-def test_run_doctor_accepts_vendor_slugs_for_named_custom_provider(monkeypatch, tmp_path):
-    home = tmp_path / ".hermes"
-    home.mkdir(parents=True, exist_ok=True)
-    (home / "config.yaml").write_text(
-        "model:\n"
-        "  provider: custom:hpc-ai\n"
-        "  default: deepseek/deepseek-v4-flash\n"
-        "custom_providers:\n"
-        "  - name: hpc-ai\n"
-        "    base_url: https://hpc-ai.example/v1\n"
-        "    api_key: test-key\n",
-        encoding="utf-8",
-    )
-
-    monkeypatch.setattr(doctor_mod, "HERMES_HOME", home)
-    monkeypatch.setattr(doctor_mod, "PROJECT_ROOT", tmp_path / "project")
-    monkeypatch.setattr(doctor_mod, "_DHH", str(home))
-    (tmp_path / "project").mkdir(exist_ok=True)
-
-    fake_model_tools = types.SimpleNamespace(
-        check_tool_availability=lambda *a, **kw: ([], []),
-        TOOLSET_REQUIREMENTS={},
-    )
-    monkeypatch.setitem(sys.modules, "model_tools", fake_model_tools)
-
-    try:
-        from hermes_cli import auth as _auth_mod
-        monkeypatch.setattr(_auth_mod, "get_nous_auth_status", lambda: {})
-        monkeypatch.setattr(_auth_mod, "get_codex_auth_status", lambda: {})
-        monkeypatch.setattr(_auth_mod, "get_xai_oauth_auth_status", lambda: {})
-    except Exception:
-        pass
-
-    buf = io.StringIO()
-    with contextlib.redirect_stdout(buf):
-        doctor_mod.run_doctor(Namespace(fix=False))
-
-    out = buf.getvalue()
-    assert "model.provider 'custom:hpc-ai' is not a recognised provider" not in out
-    assert "model.provider 'custom:hpc-ai' is unknown" not in out
-    assert (
-        "model.default 'deepseek/deepseek-v4-flash' uses a vendor/model slug but provider is "
-        "'custom:hpc-ai'"
-        not in out
-    )
-    assert "Either set model.provider to 'openrouter', or drop the vendor prefix." not in out
-
-
 
 
 def test_run_doctor_accepts_kimi_coding_cn_provider(monkeypatch, tmp_path):

tests/hermes_cli/test_model_switch_custom_providers.py

@@ -65,15 +65,6 @@ def test_resolve_provider_full_finds_named_custom_provider():
     assert resolved.source == "user-config"
 
 
-def test_is_aggregator_recognizes_named_custom_provider():
-    assert providers_mod.is_aggregator("custom:hpc-ai") is True
-    assert providers_mod.is_aggregator("custom:litellm") is True
-
-
-def test_is_aggregator_leaves_unknown_provider_non_aggregator():
-    assert providers_mod.is_aggregator("not-a-provider") is False
-
-
 def test_switch_model_accepts_explicit_named_custom_provider(monkeypatch):
     """Shared /model switch pipeline should accept --provider for custom_providers."""
     monkeypatch.setattr(

tests/hermes_cli/test_plugins_cmd.py

@@ -3,6 +3,8 @@
 from __future__ import annotations
 
 import logging
+import os
+import shutil
 from pathlib import Path
 from unittest.mock import MagicMock, patch
 
@@ -16,6 +18,7 @@ from hermes_cli.plugins_cmd import (
     _repo_name_from_url,
     _resolve_git_executable,
     _resolve_git_url,
+    _resolve_subdir_within,
     _sanitize_plugin_name,
 )
 
@@ -97,35 +100,127 @@ class TestSanitizePluginName:
 
 
 class TestResolveGitUrl:
-    """Shorthand and full-URL resolution."""
+    """Shorthand and full-URL resolution, with optional subdirectory."""
 
     def test_owner_repo_shorthand(self):
-        url = _resolve_git_url("owner/repo")
+        url, subdir = _resolve_git_url("owner/repo")
         assert url == "https://github.com/owner/repo.git"
+        assert subdir is None
 
     def test_https_url_passthrough(self):
-        url = _resolve_git_url("https://github.com/x/y.git")
+        url, subdir = _resolve_git_url("https://github.com/x/y.git")
         assert url == "https://github.com/x/y.git"
+        assert subdir is None
 
     def test_ssh_url_passthrough(self):
-        url = _resolve_git_url("git@github.com:x/y.git")
+        url, subdir = _resolve_git_url("git@github.com:x/y.git")
         assert url == "git@github.com:x/y.git"
+        assert subdir is None
 
     def test_http_url_passthrough(self):
-        url = _resolve_git_url("http://example.com/repo.git")
+        url, subdir = _resolve_git_url("http://example.com/repo.git")
         assert url == "http://example.com/repo.git"
+        assert subdir is None
 
     def test_file_url_passthrough(self):
-        url = _resolve_git_url("file:///tmp/repo")
+        url, subdir = _resolve_git_url("file:///tmp/repo")
         assert url == "file:///tmp/repo"
+        assert subdir is None
 
     def test_invalid_single_word_raises(self):
         with pytest.raises(ValueError, match="Invalid plugin identifier"):
             _resolve_git_url("justoneword")
 
-    def test_invalid_three_parts_raises(self):
-        with pytest.raises(ValueError, match="Invalid plugin identifier"):
-            _resolve_git_url("a/b/c")
+    def test_shorthand_with_subdir(self):
+        url, subdir = _resolve_git_url("owner/repo/my-plugin")
+        assert url == "https://github.com/owner/repo.git"
+        assert subdir == "my-plugin"
+
+    def test_shorthand_with_nested_subdir(self):
+        url, subdir = _resolve_git_url("owner/repo/path/to/plugin")
+        assert url == "https://github.com/owner/repo.git"
+        assert subdir == "path/to/plugin"
+
+    def test_shorthand_with_subdir_trailing_slash(self):
+        url, subdir = _resolve_git_url("owner/repo/my-plugin/")
+        assert url == "https://github.com/owner/repo.git"
+        assert subdir == "my-plugin"
+
+    def test_https_url_with_subdir(self):
+        url, subdir = _resolve_git_url("https://github.com/owner/repo.git/my-plugin")
+        assert url == "https://github.com/owner/repo.git"
+        assert subdir == "my-plugin"
+
+    def test_https_url_with_nested_subdir(self):
+        url, subdir = _resolve_git_url(
+            "https://github.com/owner/repo.git/path/to/plugin"
+        )
+        assert url == "https://github.com/owner/repo.git"
+        assert subdir == "path/to/plugin"
+
+    def test_url_with_fragment_subdir(self):
+        url, subdir = _resolve_git_url("https://github.com/owner/repo.git#my-plugin")
+        assert url == "https://github.com/owner/repo.git"
+        assert subdir == "my-plugin"
+
+    def test_file_url_with_fragment_subdir(self):
+        url, subdir = _resolve_git_url("file:///tmp/repo#path/to/plugin")
+        assert url == "file:///tmp/repo"
+        assert subdir == "path/to/plugin"
+
+    def test_ssh_url_with_fragment_subdir(self):
+        url, subdir = _resolve_git_url("git@github.com:owner/repo.git#sub")
+        assert url == "git@github.com:owner/repo.git"
+        assert subdir == "sub"
+
+
+# ── _resolve_subdir_within ──────────────────────────────────────────────────
+
+
+class TestResolveSubdirWithin:
+    """Subdirectory resolution stays within the clone and rejects traversal."""
+
+    def test_valid_subdir(self, tmp_path):
+        (tmp_path / "my-plugin").mkdir()
+        result = _resolve_subdir_within(tmp_path, "my-plugin")
+        assert result == (tmp_path / "my-plugin").resolve()
+
+    def test_valid_nested_subdir(self, tmp_path):
+        (tmp_path / "a" / "b" / "c").mkdir(parents=True)
+        result = _resolve_subdir_within(tmp_path, "a/b/c")
+        assert result == (tmp_path / "a" / "b" / "c").resolve()
+
+    def test_rejects_dot_dot_escape(self, tmp_path):
+        clone = tmp_path / "clone"
+        clone.mkdir()
+        (tmp_path / "secret").mkdir()
+        with pytest.raises(PluginOperationError, match="escapes the repository"):
+            _resolve_subdir_within(clone, "../secret")
+
+    def test_rejects_absolute_path_escape(self, tmp_path):
+        clone = tmp_path / "clone"
+        clone.mkdir()
+        # An absolute path resolves outside the clone root.
+        with pytest.raises(PluginOperationError, match="escapes the repository"):
+            _resolve_subdir_within(clone, "/etc")
+
+    def test_rejects_symlink_escape(self, tmp_path):
+        clone = tmp_path / "clone"
+        clone.mkdir()
+        outside = tmp_path / "outside"
+        outside.mkdir()
+        (clone / "link").symlink_to(outside)
+        with pytest.raises(PluginOperationError, match="escapes the repository"):
+            _resolve_subdir_within(clone, "link")
+
+    def test_rejects_missing_subdir(self, tmp_path):
+        with pytest.raises(PluginOperationError, match="does not exist"):
+            _resolve_subdir_within(tmp_path, "nope")
+
+    def test_rejects_file_not_dir(self, tmp_path):
+        (tmp_path / "afile").write_text("x")
+        with pytest.raises(PluginOperationError, match="not a directory"):
+            _resolve_subdir_within(tmp_path, "afile")
 
 
 # ── _resolve_git_executable ─────────────────────────────────────────────────
@@ -698,3 +793,90 @@ class TestNoAutoActivation:
         # The old code had: "Even with default config, check if a plugin registered one"
         # The fix removes this. Verify it's gone.
         assert "Even with default config, check if a plugin registered one" not in source
+
+
+# ── End-to-end subdirectory install ──────────────────────────────────────────
+
+
+class TestSubdirInstallE2E:
+    """Install a plugin that lives in a subdirectory of a real local git repo."""
+
+    @staticmethod
+    def _make_repo_with_subdir_plugin(repo_root: Path) -> None:
+        """Create a git repo where the plugin lives in ``./my-plugin/`` and the
+        repo root holds unrelated docs/tests."""
+        import subprocess as sp
+
+        repo_root.mkdir(parents=True, exist_ok=True)
+        # Root-level noise: docs + tests that should NOT be installed.
+        (repo_root / "README.md").write_text("# Monorepo docs\n")
+        (repo_root / "tests").mkdir()
+        (repo_root / "tests" / "test_x.py").write_text("def test_x():\n    pass\n")
+        # The actual plugin in a subdirectory.
+        plugin_dir = repo_root / "my-plugin"
+        plugin_dir.mkdir()
+        (plugin_dir / "plugin.yaml").write_text(
+            "name: my-plugin\nmanifest_version: 1\ndescription: A subdir plugin\n"
+        )
+        (plugin_dir / "__init__.py").write_text("# plugin entry\n")
+
+        env = {
+            **os.environ,
+            "GIT_AUTHOR_NAME": "t",
+            "GIT_AUTHOR_EMAIL": "t@t",
+            "GIT_COMMITTER_NAME": "t",
+            "GIT_COMMITTER_EMAIL": "t@t",
+        }
+        sp.run(["git", "init", "-q"], cwd=repo_root, check=True, env=env)
+        sp.run(["git", "add", "-A"], cwd=repo_root, check=True, env=env)
+        sp.run(
+            ["git", "commit", "-q", "-m", "init"],
+            cwd=repo_root,
+            check=True,
+            env=env,
+        )
+
+    def test_installs_only_the_subdir_plugin(self, tmp_path, monkeypatch):
+        if shutil.which("git") is None:
+            pytest.skip("git not available")
+
+        from hermes_cli import plugins_cmd as pc
+
+        repo_root = tmp_path / "monorepo"
+        self._make_repo_with_subdir_plugin(repo_root)
+
+        plugins_dir = tmp_path / "installed"
+        plugins_dir.mkdir()
+        monkeypatch.setattr(pc, "_plugins_dir", lambda: plugins_dir)
+
+        identifier = f"file://{repo_root}#my-plugin"
+        target, manifest, name = pc._install_plugin_core(identifier, force=False)
+
+        # Installed under the plugin's own name, not the repo name.
+        assert name == "my-plugin"
+        assert manifest.get("name") == "my-plugin"
+        assert target == (plugins_dir / "my-plugin").resolve()
+
+        # The plugin's files are present...
+        assert (target / "plugin.yaml").exists()
+        assert (target / "__init__.py").exists()
+        # ...and the repo-root noise is NOT.
+        assert not (target / "README.md").exists()
+        assert not (target / "tests").exists()
+
+    def test_missing_subdir_raises(self, tmp_path, monkeypatch):
+        if shutil.which("git") is None:
+            pytest.skip("git not available")
+
+        from hermes_cli import plugins_cmd as pc
+
+        repo_root = tmp_path / "monorepo"
+        self._make_repo_with_subdir_plugin(repo_root)
+
+        plugins_dir = tmp_path / "installed"
+        plugins_dir.mkdir()
+        monkeypatch.setattr(pc, "_plugins_dir", lambda: plugins_dir)
+
+        identifier = f"file://{repo_root}#does-not-exist"
+        with pytest.raises(PluginOperationError, match="does not exist"):
+            pc._install_plugin_core(identifier, force=False)

tests/hermes_cli/test_tui_resume_flow.py

@@ -896,46 +896,6 @@ def test_launch_tui_exports_model_provider_and_toolsets(monkeypatch, main_mod):
     assert env["NODE_ENV"] == "production"
 
 
-def test_launch_tui_applies_terminal_backend_config(
-    monkeypatch, main_mod, _isolate_hermes_home
-):
-    captured = {}
-    config_path = Path(os.environ["HERMES_HOME"]) / "config.yaml"
-    config_path.write_text(
-        "\n".join(
-            [
-                "terminal:",
-                "  backend: docker",
-                "  docker_image: example/hermes-tools:latest",
-                "  docker_extra_args:",
-                "    - --network=host",
-            ]
-        ),
-        encoding="utf-8",
-    )
-    monkeypatch.delenv("TERMINAL_ENV", raising=False)
-    monkeypatch.delenv("TERMINAL_DOCKER_IMAGE", raising=False)
-    monkeypatch.delenv("TERMINAL_DOCKER_EXTRA_ARGS", raising=False)
-
-    monkeypatch.setattr(
-        main_mod,
-        "_make_tui_argv",
-        lambda tui_dir, tui_dev: (["node", "dist/entry.js"], Path(".")),
-    )
-    monkeypatch.setattr(
-        main_mod.subprocess,
-        "call",
-        lambda argv, cwd=None, env=None: captured.update({"env": env}) or 1,
-    )
-
-    with pytest.raises(SystemExit):
-        main_mod._launch_tui()
-
-    assert captured["env"]["TERMINAL_ENV"] == "docker"
-    assert captured["env"]["TERMINAL_DOCKER_IMAGE"] == "example/hermes-tools:latest"
-    assert captured["env"]["TERMINAL_DOCKER_EXTRA_ARGS"] == '["--network=host"]'
-
-
 def test_launch_tui_exit_code_42_relaunches_update(monkeypatch, main_mod):
     from unittest.mock import patch
 

tests/hermes_cli/test_web_server.py

@@ -4146,39 +4146,6 @@ class TestPtyWebSocket:
         assert env["HERMES_TUI_INLINE"] == "1"
         assert env["HERMES_TUI_DISABLE_MOUSE"] == "1"
 
-    def test_resolve_chat_argv_applies_terminal_backend_config(
-        self, monkeypatch, _isolate_hermes_home
-    ):
-        import hermes_cli.main as main_mod
-
-        config_path = Path(os.environ["HERMES_HOME"]) / "config.yaml"
-        config_path.write_text(
-            "\n".join(
-                [
-                    "terminal:",
-                    "  backend: docker",
-                    "  docker_image: example/hermes-tools:latest",
-                    "  docker_extra_args:",
-                    "    - --network=host",
-                ]
-            ),
-            encoding="utf-8",
-        )
-        monkeypatch.delenv("TERMINAL_ENV", raising=False)
-        monkeypatch.delenv("TERMINAL_DOCKER_IMAGE", raising=False)
-        monkeypatch.delenv("TERMINAL_DOCKER_EXTRA_ARGS", raising=False)
-        monkeypatch.setattr(
-            main_mod,
-            "_make_tui_argv",
-            lambda project_root, tui_dev=False: (["node", "dist/entry.js"], "/tmp/ui-tui"),
-        )
-
-        _argv, _cwd, env = self.ws_module._resolve_chat_argv()
-
-        assert env["TERMINAL_ENV"] == "docker"
-        assert env["TERMINAL_DOCKER_IMAGE"] == "example/hermes-tools:latest"
-        assert env["TERMINAL_DOCKER_EXTRA_ARGS"] == '["--network=host"]'
-
     def test_rejects_when_embedded_chat_disabled(self, monkeypatch):
         monkeypatch.setattr(self.ws_module, "_DASHBOARD_EMBEDDED_CHAT_ENABLED", False)
         from starlette.websockets import WebSocketDisconnect

tests/plugins/platforms/photon/test_auth.py

@@ -1,9 +1,8 @@
-"""Tests for the Photon auth module (device login + dashboard API)."""
+"""Tests for the Photon auth module (device login + project + user creation)."""
 from __future__ import annotations
 
 import json
-import os
-from base64 import b64encode
+import time
 from pathlib import Path
 from typing import Any, Dict
 
@@ -37,152 +36,51 @@ class _FakeResponse:
             raise RuntimeError(f"HTTP {self.status_code}")
 
 
-_PHOTON_ENV = (
-    "PHOTON_PROJECT_ID",
-    "PHOTON_PROJECT_SECRET",
-    "PHOTON_DASHBOARD_PROJECT_ID",
-    "PHOTON_SPECTRUM_HOST",
-    "PHOTON_ALLOWED_USERS",
-    "PHOTON_HOME_CHANNEL",
-)
-
-
 @pytest.fixture
-def tmp_hermes_home(tmp_path: Path, monkeypatch: pytest.MonkeyPatch):
+def tmp_hermes_home(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Path:
     home = tmp_path / "hermes"
     home.mkdir()
     monkeypatch.setenv("HERMES_HOME", str(home))
-    for key in _PHOTON_ENV:
-        monkeypatch.delenv(key, raising=False)
-    yield home
-    # save_env_value() mutates os.environ directly, so scrub any leakage.
-    for key in _PHOTON_ENV:
-        os.environ.pop(key, None)
+    # The auth module memoises by reading get_hermes_home at call time
+    # so the env var is what matters.
+    return home
 
 
-# ---------------------------------------------------------------------------
-# Credential storage
-
 def test_store_and_load_photon_token(tmp_hermes_home: Path) -> None:
     photon_auth.store_photon_token("abc123def456")
     assert photon_auth.load_photon_token() == "abc123def456"
 
     auth_json = json.loads((tmp_hermes_home / "auth.json").read_text())
+    assert "credential_pool" in auth_json
     assert auth_json["credential_pool"]["photon"][0]["access_token"] == "abc123def456"
 
 
-def test_store_project_credentials_round_trip(
-    tmp_hermes_home: Path, monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    # Don't touch .env / os.environ here — exercise the auth.json path.
-    monkeypatch.setattr(photon_auth, "_persist_runtime_env", lambda *a, **k: None)
+def test_store_and_load_project_credentials(tmp_hermes_home: Path) -> None:
     photon_auth.store_project_credentials(
-        spectrum_project_id="sp-123",
-        project_secret="secret-key",
-        dashboard_project_id="dash-456",
-        name="Hermes Agent",
+        "proj-uuid", "secret-key", name="Test Project",
     )
-    for key in _PHOTON_ENV:
-        monkeypatch.delenv(key, raising=False)
-
-    sid, secret = photon_auth.load_project_credentials()
-    assert sid == "sp-123"
+    pid, secret = photon_auth.load_project_credentials()
+    assert pid == "proj-uuid"
     assert secret == "secret-key"
-    assert photon_auth.load_dashboard_project_id() == "dash-456"
-
-
-def test_store_project_credentials_writes_env(tmp_hermes_home: Path) -> None:
-    photon_auth.store_project_credentials(
-        spectrum_project_id="sp-789",
-        project_secret="sek-ret",
-        dashboard_project_id="dash-1",
-    )
-    env_text = (tmp_hermes_home / ".env").read_text()
-    assert "PHOTON_PROJECT_ID=sp-789" in env_text
-    assert "PHOTON_PROJECT_SECRET=sek-ret" in env_text
-
-
-def test_store_user_numbers_round_trip(tmp_hermes_home: Path) -> None:
-    photon_auth.store_user_numbers(
-        phone_number="+15551234567",
-        assigned_phone_number="+16282679185",
-        user_id="user-uuid",
-        dashboard_project_id="dash-uuid",
-    )
-
-    phone, assigned = photon_auth.load_user_numbers()
-    assert phone == "+15551234567"
-    assert assigned == "+16282679185"
-
-    summary = photon_auth.credential_summary()
-    assert summary["phone_number"] == "+15551234567"
-    assert summary["assigned_phone_number"] == "+16282679185"
-
-    rendered: list[str] = []
-    photon_auth.print_credential_summary(rendered.append)
-    assert "  my number           : +15551234567" in rendered[0]
-    assert "  assigned number     : +16282679185" in rendered[0]
-
-
-def test_load_user_numbers_falls_back_to_home_channel(
-    tmp_hermes_home: Path,
-) -> None:
-    from hermes_cli.config import save_env_value
-
-    save_env_value("PHOTON_HOME_CHANNEL", "+15551234567")
-
-    phone, assigned = photon_auth.load_user_numbers()
-    assert phone == "+15551234567"
-    assert assigned is None
-
-
-def test_refresh_user_numbers_reads_existing_assignment(
-    tmp_hermes_home: Path, monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    photon_auth.store_user_numbers(phone_number="+15551234567")
-
-    def fake_get(url: str, **kwargs: Any) -> _FakeResponse:
-        assert kwargs.get("headers", {}).get("Authorization") == (
-            "Basic " + b64encode(b"sp:secret").decode("ascii")
-        )
-        assert url.endswith("/projects/sp/users/")
-        return _FakeResponse(json_body={"succeed": True, "data": {"users": [{
-            "id": "user-uuid",
-            "phoneNumber": "+1 (555) 123-4567",
-            "assignedPhoneNumber": "+16282679185",
-        }]}})
-
-    monkeypatch.setattr(photon_auth.httpx, "get", fake_get)
-
-    phone, assigned = photon_auth.refresh_user_numbers("sp", "secret")
-    assert phone == "+15551234567"
-    assert assigned == "+16282679185"
-    assert photon_auth.load_user_numbers() == ("+15551234567", "+16282679185")
 
 
 def test_load_project_credentials_env_override(
     tmp_hermes_home: Path, monkeypatch: pytest.MonkeyPatch,
 ) -> None:
-    monkeypatch.setattr(photon_auth, "_persist_runtime_env", lambda *a, **k: None)
-    photon_auth.store_project_credentials(
-        spectrum_project_id="from-file", project_secret="secret-file",
-    )
+    photon_auth.store_project_credentials("from-file", "secret-file")
     monkeypatch.setenv("PHOTON_PROJECT_ID", "from-env")
     monkeypatch.setenv("PHOTON_PROJECT_SECRET", "secret-env")
-    sid, secret = photon_auth.load_project_credentials()
-    assert sid == "from-env"
+    pid, secret = photon_auth.load_project_credentials()
+    assert pid == "from-env"
     assert secret == "secret-env"
 
 
-# ---------------------------------------------------------------------------
-# Device login flow
-
-def test_request_device_code_uses_photon_cli(monkeypatch: pytest.MonkeyPatch) -> None:
+def test_request_device_code(monkeypatch: pytest.MonkeyPatch) -> None:
     captured: Dict[str, Any] = {}
 
-    def fake_post(url: str, **kwargs: Any) -> _FakeResponse:
+    def fake_post(url: str, *, json: Dict[str, Any], timeout: float) -> _FakeResponse:
         captured["url"] = url
-        captured["body"] = kwargs.get("json")
+        captured["body"] = json
         return _FakeResponse(json_body={
             "device_code": "dev-code-xyz",
             "user_code": "ABCD-1234",
@@ -197,413 +95,189 @@ def test_request_device_code_uses_photon_cli(monkeypatch: pytest.MonkeyPatch) ->
     code = photon_auth.request_device_code()
     assert code.device_code == "dev-code-xyz"
     assert code.user_code == "ABCD-1234"
+    assert code.expires_in == 600
     assert "/api/auth/device/code" in captured["url"]
-    # Hosted Photon allowlists registered device clients — an unregistered
-    # client_id is rejected with 400 invalid_client. We use Photon's published
-    # CLI device client and send the standard scope.
-    assert captured["body"]["client_id"] == "photon-cli"
-    assert captured["body"]["scope"] == "openid profile email"
+    assert captured["body"]["client_id"] == "hermes-agent"
 
 
-def _device_code() -> "photon_auth.DeviceCode":
-    return photon_auth.DeviceCode(
+def test_poll_for_token_via_header(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Token from set-auth-token header is the documented mechanism."""
+
+    def fake_post(url: str, *, json: Dict[str, Any], timeout: float) -> _FakeResponse:
+        return _FakeResponse(
+            status=200,
+            json_body={"session": {}, "user": {}},
+            headers={"set-auth-token": "bearer-xyz"},
+        )
+
+    monkeypatch.setattr(photon_auth.httpx, "post", fake_post)
+
+    code = photon_auth.DeviceCode(
         device_code="d", user_code="u",
         verification_uri="https://x", verification_uri_complete=None,
         expires_in=10, interval=0,
     )
+    token = photon_auth.poll_for_token(code, interval=0, timeout=2)
+    assert token == "bearer-xyz"
 
 
-def test_poll_for_token_body_access_token(monkeypatch: pytest.MonkeyPatch) -> None:
-    def fake_post(url: str, **kwargs: Any) -> _FakeResponse:
-        return _FakeResponse(status=200, json_body={"access_token": "tok-body"})
+def test_poll_for_token_via_body_fallback(monkeypatch: pytest.MonkeyPatch) -> None:
+    """If the header is absent we fall back to session.access_token."""
+
+    def fake_post(url: str, *, json: Dict[str, Any], timeout: float) -> _FakeResponse:
+        return _FakeResponse(
+            status=200,
+            json_body={"session": {"access_token": "from-body"}, "user": {}},
+        )
 
     monkeypatch.setattr(photon_auth.httpx, "post", fake_post)
-    assert photon_auth.poll_for_token(_device_code(), interval=0, timeout=2) == "tok-body"
+    code = photon_auth.DeviceCode(
+        device_code="d", user_code="u",
+        verification_uri="https://x", verification_uri_complete=None,
+        expires_in=10, interval=0,
+    )
+    assert photon_auth.poll_for_token(code, interval=0, timeout=2) == "from-body"
 
 
-def test_poll_for_token_session_fallback(monkeypatch: pytest.MonkeyPatch) -> None:
-    def fake_post(url: str, **kwargs: Any) -> _FakeResponse:
-        return _FakeResponse(status=200, json_body={"session": {"access_token": "tok-sess"}})
-
-    monkeypatch.setattr(photon_auth.httpx, "post", fake_post)
-    assert photon_auth.poll_for_token(_device_code(), interval=0, timeout=2) == "tok-sess"
-
-
-def test_poll_for_token_header_fallback(monkeypatch: pytest.MonkeyPatch) -> None:
-    def fake_post(url: str, **kwargs: Any) -> _FakeResponse:
-        return _FakeResponse(status=200, json_body={}, headers={"set-auth-token": "tok-hdr"})
-
-    monkeypatch.setattr(photon_auth.httpx, "post", fake_post)
-    assert photon_auth.poll_for_token(_device_code(), interval=0, timeout=2) == "tok-hdr"
-
-
-def test_poll_for_token_pending_then_success(monkeypatch: pytest.MonkeyPatch) -> None:
-    calls = {"n": 0}
-
-    def fake_post(url: str, **kwargs: Any) -> _FakeResponse:
-        calls["n"] += 1
-        if calls["n"] == 1:
-            return _FakeResponse(status=400, json_body={"error": "authorization_pending"})
-        return _FakeResponse(status=200, json_body={"access_token": "tok-eventual"})
-
-    monkeypatch.setattr(photon_auth.httpx, "post", fake_post)
-    assert photon_auth.poll_for_token(_device_code(), interval=0, timeout=5) == "tok-eventual"
-    assert calls["n"] == 2
-
-
-def test_poll_for_token_access_denied(monkeypatch: pytest.MonkeyPatch) -> None:
-    def fake_post(url: str, **kwargs: Any) -> _FakeResponse:
-        return _FakeResponse(status=400, json_body={"error": "access_denied"})
+def test_poll_for_token_propagates_access_denied(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    def fake_post(url: str, *, json: Dict[str, Any], timeout: float) -> _FakeResponse:
+        return _FakeResponse(
+            status=400, json_body={"error": "access_denied"},
+        )
 
     monkeypatch.setattr(photon_auth.httpx, "post", fake_post)
+    code = photon_auth.DeviceCode(
+        device_code="d", user_code="u",
+        verification_uri="https://x", verification_uri_complete=None,
+        expires_in=10, interval=0,
+    )
     with pytest.raises(RuntimeError, match="access_denied"):
-        photon_auth.poll_for_token(_device_code(), interval=0, timeout=2)
+        photon_auth.poll_for_token(code, interval=0, timeout=2)
 
 
-# ---------------------------------------------------------------------------
-# Projects
-
-def test_list_projects_unwraps_list(monkeypatch: pytest.MonkeyPatch) -> None:
-    def fake_get(url: str, **kwargs: Any) -> _FakeResponse:
-        return _FakeResponse(json_body=[{"id": "p1", "name": "Hermes Agent"}])
-
-    monkeypatch.setattr(photon_auth.httpx, "get", fake_get)
-    projects = photon_auth.list_projects("tok")
-    assert projects[0]["id"] == "p1"
-
-
-def test_find_project_by_name_case_insensitive(monkeypatch: pytest.MonkeyPatch) -> None:
-    def fake_get(url: str, **kwargs: Any) -> _FakeResponse:
-        return _FakeResponse(json_body={"data": [
-            {"id": "p1", "name": "Other"},
-            {"id": "p2", "name": "hermes agent"},
-        ]})
-
-    monkeypatch.setattr(photon_auth.httpx, "get", fake_get)
-    proj = photon_auth.find_project_by_name("tok", "Hermes Agent")
-    assert proj is not None and proj["id"] == "p2"
-
-
-def test_create_project_sends_spectrum_true(monkeypatch: pytest.MonkeyPatch) -> None:
-    captured: Dict[str, Any] = {}
-
-    def fake_post(url: str, **kwargs: Any) -> _FakeResponse:
-        captured["url"] = url
-        captured["body"] = kwargs.get("json")
-        captured["headers"] = kwargs.get("headers")
-        return _FakeResponse(json_body={"success": True, "id": "new-proj"})
-
-    monkeypatch.setattr(photon_auth.httpx, "post", fake_post)
-    data = photon_auth.create_project("tok", name="Hermes Agent")
-    assert data["id"] == "new-proj"
-    assert captured["body"]["spectrum"] is True
-    assert captured["body"]["name"] == "Hermes Agent"
-    assert captured["headers"]["Authorization"] == "Bearer tok"
-    assert captured["url"].endswith("/api/projects")
-
-
-def test_create_project_raises_without_id(monkeypatch: pytest.MonkeyPatch) -> None:
-    def fake_post(url: str, **kwargs: Any) -> _FakeResponse:
-        return _FakeResponse(json_body={"success": True})
-
-    monkeypatch.setattr(photon_auth.httpx, "post", fake_post)
-    with pytest.raises(RuntimeError, match="project id"):
-        photon_auth.create_project("tok")
-
-
-def test_ensure_spectrum_enabled_toggles_when_off(monkeypatch: pytest.MonkeyPatch) -> None:
-    get_calls = {"n": 0}
-    posted = {"toggle": False}
-
-    def fake_get(url: str, **kwargs: Any) -> _FakeResponse:
-        get_calls["n"] += 1
-        if get_calls["n"] == 1:
-            return _FakeResponse(json_body={"id": "p", "spectrum": False, "spectrumProjectId": None})
-        return _FakeResponse(json_body={"id": "p", "spectrum": True, "spectrumProjectId": "sp-1"})
-
-    def fake_post(url: str, **kwargs: Any) -> _FakeResponse:
-        if url.endswith("/spectrum/toggle"):
-            posted["toggle"] = True
-        return _FakeResponse(json_body={"success": True})
-
-    monkeypatch.setattr(photon_auth.httpx, "get", fake_get)
-    monkeypatch.setattr(photon_auth.httpx, "post", fake_post)
-    proj = photon_auth.ensure_spectrum_enabled("tok", "p")
-    assert posted["toggle"] is True
-    assert proj["spectrumProjectId"] == "sp-1"
-
-
-def test_ensure_spectrum_enabled_skips_toggle_when_on(monkeypatch: pytest.MonkeyPatch) -> None:
-    posted = {"toggle": False}
-
-    def fake_get(url: str, **kwargs: Any) -> _FakeResponse:
-        return _FakeResponse(json_body={"id": "p", "spectrum": True, "spectrumProjectId": "sp-1"})
-
-    def fake_post(url: str, **kwargs: Any) -> _FakeResponse:
-        if url.endswith("/spectrum/toggle"):
-            posted["toggle"] = True
-        return _FakeResponse(json_body={"success": True})
-
-    monkeypatch.setattr(photon_auth.httpx, "get", fake_get)
-    monkeypatch.setattr(photon_auth.httpx, "post", fake_post)
-    proj = photon_auth.ensure_spectrum_enabled("tok", "p")
-    assert posted["toggle"] is False
-    assert proj["spectrumProjectId"] == "sp-1"
-
-
-def test_regenerate_project_secret(monkeypatch: pytest.MonkeyPatch) -> None:
-    def fake_post(url: str, **kwargs: Any) -> _FakeResponse:
-        assert url.endswith("/regenerate-secret")
-        return _FakeResponse(json_body={"success": True, "projectSecret": "rotated"})
-
-    monkeypatch.setattr(photon_auth.httpx, "post", fake_post)
-    assert photon_auth.regenerate_project_secret("tok", "p") == "rotated"
-
-
-# ---------------------------------------------------------------------------
-# Users
-
 def test_create_user_rejects_invalid_phone() -> None:
     with pytest.raises(ValueError, match="E.164"):
-        photon_auth.create_user("proj", "secret", phone_number="not-a-number")
+        photon_auth.create_user(
+            "proj", "secret", phone_number="not-a-number",
+        )
 
 
-def test_create_user_posts_dashboard_shape(monkeypatch: pytest.MonkeyPatch) -> None:
+def test_create_user_posts_shared_type(monkeypatch: pytest.MonkeyPatch) -> None:
     captured: Dict[str, Any] = {}
 
-    def fake_post(url: str, **kwargs: Any) -> _FakeResponse:
+    def fake_post(url: str, *, json: Dict[str, Any], auth: tuple, timeout: float) -> _FakeResponse:
         captured["url"] = url
-        captured["body"] = kwargs.get("json")
-        captured["headers"] = kwargs.get("headers")
-        return _FakeResponse(json_body={"succeed": True, "data": {
-            "id": "user-uuid", "phoneNumber": "+15551234567",
-        }})
+        captured["body"] = json
+        captured["auth"] = auth
+        return _FakeResponse(json_body={
+            "succeed": True,
+            "data": {
+                "id": "user-uuid",
+                "phoneNumber": "+15551234567",
+                "assignedPhoneNumber": "+15559999999",
+            },
+        })
 
     monkeypatch.setattr(photon_auth.httpx, "post", fake_post)
-    user = photon_auth.create_user("proj-id", "secret", phone_number="+15551234567")
-    assert user["id"] == "user-uuid"
+    user = photon_auth.create_user(
+        "proj-id", "proj-secret",
+        phone_number="+15551234567",
+    )
+    assert user["assignedPhoneNumber"] == "+15559999999"
+    assert captured["auth"] == ("proj-id", "proj-secret")
     assert captured["body"]["type"] == "shared"
     assert captured["body"]["phoneNumber"] == "+15551234567"
-    assert captured["headers"]["Authorization"] == (
-        "Basic " + b64encode(b"proj-id:secret").decode("ascii")
-    )
-    assert captured["url"].endswith("/projects/proj-id/users/")
+    assert "/projects/proj-id/users/" in captured["url"]
 
 
-def test_register_user_if_absent_dedup(monkeypatch: pytest.MonkeyPatch) -> None:
-    posted = {"n": 0}
+def test_register_webhook_surfaces_secret(monkeypatch: pytest.MonkeyPatch) -> None:
+    def fake_post(url: str, *, json: Dict[str, Any], auth: tuple, timeout: float) -> _FakeResponse:
+        return _FakeResponse(json_body={
+            "succeed": True,
+            "data": {
+                "id": "wh-uuid",
+                "webhookUrl": json["webhookUrl"],
+                "signingSecret": "0" * 64,
+            },
+        })
 
-    def fake_get(url: str, **kwargs: Any) -> _FakeResponse:
-        return _FakeResponse(json_body={"succeed": True, "data": {"users": [{
-            "id": "u1",
-            "phoneNumber": "+1 (555) 123-4567",
-            "assignedPhoneNumber": "+16282679185",
-        }]}})
-
-    def fake_post(url: str, **kwargs: Any) -> _FakeResponse:
-        posted["n"] += 1
-        return _FakeResponse(json_body={"success": True, "user": {}})
-
-    monkeypatch.setattr(photon_auth.httpx, "get", fake_get)
     monkeypatch.setattr(photon_auth.httpx, "post", fake_post)
-    # Same number, different formatting — should match and NOT create.
-    user, created = photon_auth.register_user_if_absent(
-        "proj", "secret", phone_number="+15551234567",
+    data = photon_auth.register_webhook(
+        "proj", "secret", webhook_url="https://x.example.com/hook",
     )
-    assert created is False
-    assert user["id"] == "u1"
-    assert posted["n"] == 0
-    # The reused user carries the assigned iMessage line ("TEXTS ON").
-    assert photon_auth.user_assigned_line(user) == "+16282679185"
+    assert data["signingSecret"] == "0" * 64
+    assert data["webhookUrl"] == "https://x.example.com/hook"
 
 
-def test_user_assigned_line() -> None:
-    assert (
-        photon_auth.user_assigned_line({"assignedPhoneNumber": "+16282679185"})
-        == "+16282679185"
-    )
-    # Own number present but no assignment yet (e.g. freshly created user).
-    assert photon_auth.user_assigned_line({"phoneNumber": "+15551234567"}) is None
-    assert photon_auth.user_assigned_line({"assignedPhoneNumber": ""}) is None
-    assert photon_auth.user_assigned_line({}) is None
-    assert photon_auth.user_assigned_line(None) is None
-
-
-def test_register_user_if_absent_creates(monkeypatch: pytest.MonkeyPatch) -> None:
-    def fake_get(url: str, **kwargs: Any) -> _FakeResponse:
-        return _FakeResponse(json_body={"succeed": True, "data": {"users": []}})
-
-    def fake_post(url: str, **kwargs: Any) -> _FakeResponse:
-        return _FakeResponse(json_body={"succeed": True, "data": {"id": "u-new"}})
-
-    monkeypatch.setattr(photon_auth.httpx, "get", fake_get)
-    monkeypatch.setattr(photon_auth.httpx, "post", fake_post)
-    user, created = photon_auth.register_user_if_absent(
-        "proj", "secret", phone_number="+15551234567",
-    )
-    assert created is True
-    assert user["id"] == "u-new"
-
-
-# ---------------------------------------------------------------------------
-# Lines (assigned number)
-
-def test_get_imessage_line_returns_existing(monkeypatch: pytest.MonkeyPatch) -> None:
-    def fake_get(url: str, **kwargs: Any) -> _FakeResponse:
-        return _FakeResponse(json_body=[
-            {"id": "l1", "platform": "imessage", "phoneNumber": "+15559999999", "status": "active"},
-        ])
-
-    monkeypatch.setattr(photon_auth.httpx, "get", fake_get)
-    line = photon_auth.get_imessage_line("tok", "proj")
-    assert line is not None and line["phoneNumber"] == "+15559999999"
-
-
-def test_get_imessage_line_provisions_when_missing(monkeypatch: pytest.MonkeyPatch) -> None:
-    added = {"n": 0}
-
-    def fake_get(url: str, **kwargs: Any) -> _FakeResponse:
-        return _FakeResponse(json_body=[])
-
-    def fake_post(url: str, **kwargs: Any) -> _FakeResponse:
-        added["n"] += 1
-        assert kwargs.get("json", {}).get("platform") == "imessage"
-        return _FakeResponse(json_body={"success": True, "line": {
-            "id": "l-new", "platform": "imessage", "phoneNumber": "+15558888888",
-        }})
-
-    monkeypatch.setattr(photon_auth.httpx, "get", fake_get)
-    monkeypatch.setattr(photon_auth.httpx, "post", fake_post)
-    line = photon_auth.get_imessage_line("tok", "proj")
-    assert added["n"] == 1
-    assert line["phoneNumber"] == "+15558888888"
-
-
-# ---------------------------------------------------------------------------
-# Credential summary (no secret leakage)
-
-def test_credential_summary_no_secret_leak(
-    tmp_hermes_home: Path, monkeypatch: pytest.MonkeyPatch,
+def test_persist_webhook_signing_secret_writes_env(
+    tmp_hermes_home: Path,
 ) -> None:
-    monkeypatch.setattr(photon_auth, "_persist_runtime_env", lambda *a, **k: None)
-    photon_auth.store_photon_token("token-aaaaaaaaaaaaaaaa")
-    photon_auth.store_project_credentials(
-        spectrum_project_id="sp-uuid",
-        project_secret="secret-bbbbbbbbbbb",
-        dashboard_project_id="dash-uuid",
+    """The helper hands the secret to save_env_value, never returns it."""
+    summary: list = []
+    response = {
+        "id": "wh-uuid",
+        "webhookUrl": "https://x.example.com/hook",
+        "signingSecret": "ABCDEF1234567890" * 4,
+    }
+    ok = photon_auth.persist_webhook_signing_secret(
+        response, on_summary=summary.append,
     )
+
+    assert ok is True
+    env_path = tmp_hermes_home / ".env"
+    assert env_path.exists()
+    env_text = env_path.read_text()
+    assert "PHOTON_WEBHOOK_SECRET=ABCDEF1234567890" in env_text
+    # The on_summary callback gets the redacted response + a saved-to path;
+    # none of those strings should leak the raw secret.
+    joined = "\n".join(summary)
+    assert "<redacted>" in joined
+    assert "ABCDEF1234567890" not in joined
+
+
+def test_persist_webhook_signing_secret_no_secret_no_write(
+    tmp_hermes_home: Path,
+) -> None:
+    summary: list = []
+    ok = photon_auth.persist_webhook_signing_secret(
+        {"id": "wh-uuid", "webhookUrl": "https://x"},
+        on_summary=summary.append,
+    )
+    assert ok is False
+    # No env file written; summary callback still received the redacted
+    # response (without a signingSecret key, nothing to redact).
+    assert not (tmp_hermes_home / ".env").exists()
+
+
+def test_credential_summary_returns_only_display_strings(
+    tmp_hermes_home: Path,
+) -> None:
+    """credential_summary must not leak raw token/secret material."""
+    photon_auth.store_photon_token("token-aaaaaaaaaaaaaaaa")
+    photon_auth.store_project_credentials("proj-uuid", "secret-bbbbbbbbbbb")
     summary = photon_auth.credential_summary()
     blob = "\n".join(summary.values())
     assert "token-aaaa" not in blob
     assert "secret-bbbb" not in blob
     assert summary["device_token"].startswith("✓")
     assert summary["project_key"].startswith("✓")
-    assert summary["spectrum_project_id"] == "sp-uuid"
-    assert summary["dashboard_project_id"] == "dash-uuid"
-    assert summary["phone_number"].startswith("✗ missing")
-    assert summary["assigned_phone_number"].startswith("✗ missing")
+    assert summary["project_id"] == "proj-uuid"
 
 
-# ---------------------------------------------------------------------------
-# Device-token candidate extraction + dashboard validation.
-
-def test_device_response_candidates_covers_known_shapes() -> None:
-    candidates = photon_auth._device_response_token_candidates(
-        {
-            "access_token": "tok-snake",
-            "accessToken": "tok-camel",
-            "data": {"access_token": "tok-data"},
-        },
-        headers={"set-auth-token": "Bearer tok-header"},
-    )
-    by_source = {c.source: c.token for c in candidates}
-    assert by_source["access_token"] == "tok-snake"
-    assert by_source["accessToken"] == "tok-camel"
-    assert by_source["data.access_token"] == "tok-data"
-    # "Bearer " prefix is stripped from the header value.
-    assert by_source["set-auth-token"] == "tok-header"
-
-
-def test_device_response_candidates_dedupes() -> None:
-    candidates = photon_auth._device_response_token_candidates(
-        {"access_token": "same", "accessToken": "same"},
-    )
-    assert [c.token for c in candidates] == ["same"]
-
-
-def test_validate_photon_token_rejects_unrecognized_session(
-    monkeypatch: pytest.MonkeyPatch,
+def test_print_credential_summary_emits_only_display_strings(
+    tmp_hermes_home: Path,
 ) -> None:
-    def fake_get(url: str, *, headers: Dict[str, str], timeout: float) -> _FakeResponse:
-        if url.endswith("/api/auth/get-session"):
-            return _FakeResponse(json_body={})  # no "user" key
-        return _FakeResponse(json_body=[])
-
-    monkeypatch.setattr(photon_auth.httpx, "get", fake_get)
-    with pytest.raises(photon_auth.PhotonDashboardAuthError):
-        photon_auth.validate_photon_token("some-token")
-
-
-def test_validate_photon_token_rejects_project_api_denial(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    def fake_get(url: str, *, headers: Dict[str, str], timeout: float) -> _FakeResponse:
-        if url.endswith("/api/auth/get-session"):
-            return _FakeResponse(json_body={"user": {"id": "u1"}})
-        return _FakeResponse(status=403)  # project API rejects
-
-    monkeypatch.setattr(photon_auth.httpx, "get", fake_get)
-    with pytest.raises(photon_auth.PhotonDashboardAuthError):
-        photon_auth.validate_photon_token("some-token")
-
-
-def test_login_device_flow_validates_before_persisting(
-    tmp_hermes_home: Path, monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    def fake_post(url: str, *, json: Dict[str, Any], timeout: float) -> _FakeResponse:
-        if url.endswith("/api/auth/device/code"):
-            return _FakeResponse(json_body={
-                "device_code": "dev", "user_code": "AAAA",
-                "verification_uri": "https://app.photon.codes/device",
-                "verification_uri_complete": None,
-                "expires_in": 600, "interval": 0,
-            })
-        # device/token approval
-        return _FakeResponse(json_body={"access_token": "good-token"})
-
-    def fake_get(url: str, *, headers: Dict[str, str], timeout: float) -> _FakeResponse:
-        if url.endswith("/api/auth/get-session"):
-            return _FakeResponse(json_body={"user": {"id": "u1"}})
-        return _FakeResponse(json_body=[])  # projects OK
-
-    monkeypatch.setattr(photon_auth.httpx, "post", fake_post)
-    monkeypatch.setattr(photon_auth.httpx, "get", fake_get)
-
-    token = photon_auth.login_device_flow(open_browser=False)
-    assert token == "good-token"
-    assert photon_auth.load_photon_token() == "good-token"
-
-
-def test_login_device_flow_raises_when_token_invalid(
-    tmp_hermes_home: Path, monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    def fake_post(url: str, *, json: Dict[str, Any], timeout: float) -> _FakeResponse:
-        if url.endswith("/api/auth/device/code"):
-            return _FakeResponse(json_body={
-                "device_code": "dev", "user_code": "AAAA",
-                "verification_uri": "https://app.photon.codes/device",
-                "verification_uri_complete": None,
-                "expires_in": 600, "interval": 0,
-            })
-        return _FakeResponse(json_body={"access_token": "bad-token"})
-
-    def fake_get(url: str, *, headers: Dict[str, str], timeout: float) -> _FakeResponse:
-        return _FakeResponse(status=401)  # session lookup rejects
-
-    monkeypatch.setattr(photon_auth.httpx, "post", fake_post)
-    monkeypatch.setattr(photon_auth.httpx, "get", fake_get)
-
-    with pytest.raises(photon_auth.PhotonDashboardAuthError):
-        photon_auth.login_device_flow(open_browser=False)
-    # A token that failed validation must never be persisted.
-    assert photon_auth.load_photon_token() is None
+    """The emit callback must never receive raw credential bytes."""
+    photon_auth.store_photon_token("token-aaaaaaaaaaaaaaaa")
+    photon_auth.store_project_credentials("proj-uuid", "secret-bbbbbbbbbbb")
+    lines: list = []
+    photon_auth.print_credential_summary(lines.append)
+    blob = "\n".join(lines)
+    assert "token-aaaa" not in blob
+    assert "secret-bbbb" not in blob
+    assert "✓ stored" in blob   # device token line
+    assert "proj-uuid" in blob   # project id is intentionally surfaced
+    # Header is always emitted
+    assert any("Photon iMessage status" in line for line in lines)

tests/plugins/platforms/photon/test_inbound.py

@@ -1,15 +1,12 @@
 """Inbound dispatch + dedup tests for PhotonAdapter.
 
-These bypass the loopback HTTP stream — they call ``_dispatch_inbound`` /
-``_on_inbound_line`` / ``_is_duplicate`` directly, exercising the
-sidecar-event parsing without spawning the Node sidecar or binding ports.
+These tests bypass the aiohttp server — they call ``_dispatch_inbound``
+and ``_is_duplicate`` directly. That keeps them fast and means we can
+exercise the message-shape parsing logic without binding ports.
 """
 from __future__ import annotations
 
-import base64
-import json
-from pathlib import Path
-from typing import Any, Dict, List
+from typing import List
 
 import pytest
 
@@ -19,39 +16,38 @@ from plugins.platforms.photon.adapter import PhotonAdapter
 
 
 def _make_adapter(monkeypatch: pytest.MonkeyPatch) -> PhotonAdapter:
+    # Avoid touching real auth.json / env.
     monkeypatch.setenv("PHOTON_PROJECT_ID", "test-project-id")
     monkeypatch.setenv("PHOTON_PROJECT_SECRET", "test-project-secret")
+    monkeypatch.delenv("PHOTON_WEBHOOK_SECRET", raising=False)
     cfg = PlatformConfig(enabled=True, token="", extra={})
     return PhotonAdapter(cfg)
 
 
-def _capture(adapter: PhotonAdapter, monkeypatch: pytest.MonkeyPatch) -> List[MessageEvent]:
+@pytest.mark.asyncio
+async def test_dispatch_text_dm(monkeypatch: pytest.MonkeyPatch) -> None:
+    adapter = _make_adapter(monkeypatch)
     captured: List[MessageEvent] = []
 
     async def fake_handle(event: MessageEvent) -> None:
         captured.append(event)
 
     monkeypatch.setattr(adapter, "handle_message", fake_handle)
-    return captured
 
-
-def _dm_event(text: str, msg_id: str = "spc-msg-abc") -> Dict[str, Any]:
-    return {
-        "messageId": msg_id,
-        "platform": "iMessage",
-        "space": {"id": "+15551234567", "type": "dm", "phone": "+15551234567"},
-        "sender": {"id": "+15551234567"},
-        "content": {"type": "text", "text": text},
-        "timestamp": "2026-05-14T19:06:32.000Z",
+    payload = {
+        "event": "messages",
+        "space": {"id": "any;-;+15551234567", "platform": "iMessage"},
+        "message": {
+            "id": "spc-msg-abc",
+            "platform": "iMessage",
+            "direction": "inbound",
+            "timestamp": "2026-05-14T19:06:32.000Z",
+            "sender": {"id": "+15551234567", "platform": "iMessage"},
+            "space": {"id": "any;-;+15551234567", "platform": "iMessage"},
+            "content": {"type": "text", "text": "hello world"},
+        },
     }
-
-
-@pytest.mark.asyncio
-async def test_dispatch_text_dm(monkeypatch: pytest.MonkeyPatch) -> None:
-    adapter = _make_adapter(monkeypatch)
-    captured = _capture(adapter, monkeypatch)
-
-    await adapter._dispatch_inbound(_dm_event("hello world"))
+    await adapter._dispatch_inbound(payload)
 
     assert len(captured) == 1
     event = captured[0]
@@ -61,227 +57,70 @@ async def test_dispatch_text_dm(monkeypatch: pytest.MonkeyPatch) -> None:
     src = event.source
     assert src is not None
     assert src.platform == Platform("photon")
-    assert src.chat_id == "+15551234567"
+    assert src.chat_id == "any;-;+15551234567"
     assert src.chat_type == "dm"
     assert src.user_id == "+15551234567"
 
 
 @pytest.mark.asyncio
-async def test_dispatch_group_type(monkeypatch: pytest.MonkeyPatch) -> None:
+async def test_dispatch_group_id_detected(monkeypatch: pytest.MonkeyPatch) -> None:
     adapter = _make_adapter(monkeypatch)
-    captured = _capture(adapter, monkeypatch)
+    captured: List[MessageEvent] = []
 
-    event = {
-        "messageId": "spc-msg-grp",
-        "space": {"id": "group-guid-xyz", "type": "group", "phone": None},
-        "sender": {"id": "+15551234567"},
-        "content": {"type": "text", "text": "hi group"},
-        "timestamp": "2026-05-14T19:06:32.000Z",
+    async def fake_handle(event: MessageEvent) -> None:
+        captured.append(event)
+
+    monkeypatch.setattr(adapter, "handle_message", fake_handle)
+
+    payload = {
+        "event": "messages",
+        "space": {"id": "any;+;group-guid-xyz", "platform": "iMessage"},
+        "message": {
+            "id": "spc-msg-grp",
+            "timestamp": "2026-05-14T19:06:32.000Z",
+            "sender": {"id": "+15551234567"},
+            "space": {"id": "any;+;group-guid-xyz"},
+            "content": {"type": "text", "text": "hi group"},
+        },
     }
-    await adapter._dispatch_inbound(event)
+    await adapter._dispatch_inbound(payload)
     assert captured[0].source.chat_type == "group"
 
 
-# A real 1x1 transparent PNG (passes base.py's _looks_like_image magic check).
-_PNG_1X1_B64 = (
-    "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkYPhf"
-    "DwAChwGA60e6kgAAAABJRU5ErkJggg=="
-)
+@pytest.mark.asyncio
+async def test_dispatch_attachment_surfaces_marker(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    adapter = _make_adapter(monkeypatch)
+    captured: List[MessageEvent] = []
 
+    async def fake_handle(event: MessageEvent) -> None:
+        captured.append(event)
 
-def _attachment_event(
-    content: Dict[str, Any], msg_id: str = "spc-msg-att"
-) -> Dict[str, Any]:
-    return {
-        "messageId": msg_id,
-        "space": {"id": "+15551234567", "type": "dm", "phone": "+15551234567"},
-        "sender": {"id": "+15551234567"},
-        "content": {"type": "attachment", **content},
-        "timestamp": "2026-05-14T19:06:32.000Z",
+    monkeypatch.setattr(adapter, "handle_message", fake_handle)
+
+    payload = {
+        "event": "messages",
+        "message": {
+            "id": "spc-msg-att",
+            "timestamp": "2026-05-14T19:06:32.000Z",
+            "sender": {"id": "+15551234567"},
+            "space": {"id": "any;-;+15551234567"},
+            "content": {
+                "type": "attachment",
+                "name": "IMG_4127.HEIC",
+                "mimeType": "image/heic",
+                "size": 12345,
+            },
+        },
     }
-
-
-def _voice_event(
-    content: Dict[str, Any], msg_id: str = "spc-msg-voice"
-) -> Dict[str, Any]:
-    return {
-        "messageId": msg_id,
-        "space": {"id": "+15551234567", "type": "dm", "phone": "+15551234567"},
-        "sender": {"id": "+15551234567"},
-        "content": {"type": "voice", **content},
-        "timestamp": "2026-05-14T19:06:32.000Z",
-    }
-
-
-@pytest.mark.asyncio
-async def test_dispatch_attachment_without_bytes_surfaces_marker(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    """No inline ``data`` (over cap / failed sidecar read) -> text marker, no media."""
-    adapter = _make_adapter(monkeypatch)
-    captured = _capture(adapter, monkeypatch)
-
-    event = _attachment_event(
-        {"name": "IMG_4127.HEIC", "mimeType": "image/heic", "size": 12345}
-    )
-    await adapter._dispatch_inbound(event)
+    await adapter._dispatch_inbound(payload)
     assert len(captured) == 1
-    ev = captured[0]
-    assert "Photon attachment received" in ev.text
-    assert "IMG_4127.HEIC" in ev.text
-    assert ev.message_type == MessageType.PHOTO
-    assert ev.media_urls == []
-    assert ev.media_types == []
-
-
-@pytest.mark.asyncio
-async def test_dispatch_attachment_downloads_image(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    """Inline base64 image bytes are decoded, cached, and exposed as media."""
-    adapter = _make_adapter(monkeypatch)
-    captured = _capture(adapter, monkeypatch)
-
-    raw = base64.b64decode(_PNG_1X1_B64)
-    event = _attachment_event(
-        {
-            "name": "photo.png",
-            "mimeType": "image/png",
-            "size": len(raw),
-            "data": _PNG_1X1_B64,
-            "encoding": "base64",
-        }
-    )
-    await adapter._dispatch_inbound(event)
-
-    assert len(captured) == 1
-    ev = captured[0]
-    assert ev.message_type == MessageType.PHOTO
-    assert ev.media_types == ["image/png"]
-    assert len(ev.media_urls) == 1
-    cached = Path(ev.media_urls[0])
-    try:
-        assert cached.is_file()
-        assert cached.read_bytes() == raw
-        assert ev.text == "(attachment)"
-    finally:
-        cached.unlink(missing_ok=True)
-
-
-@pytest.mark.asyncio
-async def test_dispatch_voice_downloads_audio(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    """Inbound Spectrum voice content is cached and routed to auto-STT."""
-    adapter = _make_adapter(monkeypatch)
-    captured = _capture(adapter, monkeypatch)
-
-    raw = b"OggS" + b"\x00" * 32
-    event = _voice_event(
-        {
-            "name": "note.ogg",
-            "mimeType": "audio/ogg",
-            "duration": 7,
-            "size": len(raw),
-            "data": base64.b64encode(raw).decode("ascii"),
-            "encoding": "base64",
-        }
-    )
-    await adapter._dispatch_inbound(event)
-
-    assert len(captured) == 1
-    ev = captured[0]
-    assert ev.message_type == MessageType.VOICE
-    assert ev.media_types == ["audio/ogg"]
-    assert len(ev.media_urls) == 1
-    cached = Path(ev.media_urls[0])
-    try:
-        assert cached.is_file()
-        assert cached.read_bytes() == raw
-        assert ev.text == "(voice)"
-    finally:
-        cached.unlink(missing_ok=True)
-
-
-@pytest.mark.asyncio
-async def test_dispatch_voice_without_bytes_surfaces_marker(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    """Metadata-only voice still tells the agent a voice note arrived."""
-    adapter = _make_adapter(monkeypatch)
-    captured = _capture(adapter, monkeypatch)
-
-    event = _voice_event(
-        {"name": "note.m4a", "mimeType": "audio/mp4", "duration": 12, "size": 12345}
-    )
-    await adapter._dispatch_inbound(event)
-
-    assert len(captured) == 1
-    ev = captured[0]
-    assert "Photon voice received" in ev.text
-    assert "note.m4a" in ev.text
-    assert "duration: 12s" in ev.text
-    assert ev.message_type == MessageType.VOICE
-    assert ev.media_urls == []
-    assert ev.media_types == []
-
-
-@pytest.mark.asyncio
-async def test_dispatch_attachment_downloads_document(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    """Non-image attachments route through the document cache as DOCUMENT."""
-    adapter = _make_adapter(monkeypatch)
-    captured = _capture(adapter, monkeypatch)
-
-    raw = b"%PDF-1.4 hermes test document"
-    event = _attachment_event(
-        {
-            "name": "report.pdf",
-            "mimeType": "application/pdf",
-            "size": len(raw),
-            "data": base64.b64encode(raw).decode("ascii"),
-            "encoding": "base64",
-        }
-    )
-    await adapter._dispatch_inbound(event)
-
-    assert len(captured) == 1
-    ev = captured[0]
-    assert ev.message_type == MessageType.DOCUMENT
-    assert ev.media_types == ["application/pdf"]
-    assert len(ev.media_urls) == 1
-    cached = Path(ev.media_urls[0])
-    try:
-        assert cached.is_file()
-        assert cached.read_bytes() == raw
-        assert ev.text == "(attachment)"
-    finally:
-        cached.unlink(missing_ok=True)
-
-
-@pytest.mark.asyncio
-async def test_on_inbound_line_dispatches_and_dedups(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    adapter = _make_adapter(monkeypatch)
-    captured = _capture(adapter, monkeypatch)
-
-    line = json.dumps(_dm_event("ping", msg_id="dup-1"))
-    await adapter._on_inbound_line(line)
-    await adapter._on_inbound_line(line)  # same messageId -> deduped
-
-    assert len(captured) == 1
-    assert captured[0].text == "ping"
-
-
-@pytest.mark.asyncio
-async def test_on_inbound_line_ignores_bad_json(monkeypatch: pytest.MonkeyPatch) -> None:
-    adapter = _make_adapter(monkeypatch)
-    captured = _capture(adapter, monkeypatch)
-
-    await adapter._on_inbound_line("{not json")
-    assert captured == []
+    event = captured[0]
+    # Attachment carries metadata marker; mime → MessageType.PHOTO.
+    assert "Photon attachment received" in event.text
+    assert "IMG_4127.HEIC" in event.text
+    assert event.message_type == MessageType.PHOTO
 
 
 def test_is_duplicate_window(monkeypatch: pytest.MonkeyPatch) -> None:

tests/plugins/platforms/photon/test_mention_gating.py

@@ -22,6 +22,7 @@ from plugins.platforms.photon.adapter import PhotonAdapter
 def _make_adapter(monkeypatch: pytest.MonkeyPatch, extra: dict | None = None) -> PhotonAdapter:
     monkeypatch.setenv("PHOTON_PROJECT_ID", "test-project-id")
     monkeypatch.setenv("PHOTON_PROJECT_SECRET", "test-project-secret")
+    monkeypatch.delenv("PHOTON_WEBHOOK_SECRET", raising=False)
     monkeypatch.delenv("PHOTON_REQUIRE_MENTION", raising=False)
     monkeypatch.delenv("PHOTON_MENTION_PATTERNS", raising=False)
     cfg = PlatformConfig(enabled=True, token="", extra=extra or {})
@@ -30,21 +31,27 @@ def _make_adapter(monkeypatch: pytest.MonkeyPatch, extra: dict | None = None) ->
 
 def _group_payload(text: str) -> dict:
     return {
-        "messageId": f"grp-{abs(hash(text))}",
-        "space": {"id": "group-guid-xyz", "type": "group", "phone": None},
-        "sender": {"id": "+15551234567"},
-        "content": {"type": "text", "text": text},
-        "timestamp": "2026-05-14T19:06:32.000Z",
+        "event": "messages",
+        "message": {
+            "id": f"grp-{abs(hash(text))}",
+            "timestamp": "2026-05-14T19:06:32.000Z",
+            "sender": {"id": "+15551234567"},
+            "space": {"id": "any;+;group-guid-xyz"},
+            "content": {"type": "text", "text": text},
+        },
     }
 
 
 def _dm_payload(text: str) -> dict:
     return {
-        "messageId": f"dm-{abs(hash(text))}",
-        "space": {"id": "+15551234567", "type": "dm", "phone": "+15551234567"},
-        "sender": {"id": "+15551234567"},
-        "content": {"type": "text", "text": text},
-        "timestamp": "2026-05-14T19:06:32.000Z",
+        "event": "messages",
+        "message": {
+            "id": f"dm-{abs(hash(text))}",
+            "timestamp": "2026-05-14T19:06:32.000Z",
+            "sender": {"id": "+15551234567"},
+            "space": {"id": "any;-;+15551234567"},
+            "content": {"type": "text", "text": text},
+        },
     }
 
 
@@ -119,6 +126,7 @@ def test_custom_mention_patterns_from_config(monkeypatch: pytest.MonkeyPatch) ->
 def test_mention_patterns_env_comma_separated(monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setenv("PHOTON_PROJECT_ID", "test-project-id")
     monkeypatch.setenv("PHOTON_PROJECT_SECRET", "test-project-secret")
+    monkeypatch.delenv("PHOTON_WEBHOOK_SECRET", raising=False)
     monkeypatch.setenv("PHOTON_REQUIRE_MENTION", "true")
     monkeypatch.setenv("PHOTON_MENTION_PATTERNS", r"bot\b, assistant\b")
     cfg = PlatformConfig(enabled=True, token="", extra={})

tests/plugins/platforms/photon/test_setup_access.py

@@ -1,69 +0,0 @@
-"""Tests for `hermes photon setup`'s access auto-configuration.
-
-`_autoconfigure_access` allowlists the operator and points the cron home
-channel at their DM, writing to the per-test ~/.hermes/.env (the hermetic
-HERMES_HOME fixture isolates this). It must fill only unset keys so a re-run
-never clobbers a hand-tuned allowlist.
-"""
-from __future__ import annotations
-
-import pytest
-
-from hermes_cli.config import get_env_value, save_env_value
-from plugins.platforms.photon.adapter import _env_enablement
-from plugins.platforms.photon import cli
-
-
-def test_autoconfigure_access_fills_unset(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.delenv("PHOTON_ALLOWED_USERS", raising=False)
-    monkeypatch.delenv("PHOTON_HOME_CHANNEL", raising=False)
-
-    cli._autoconfigure_access("+15551234567")
-
-    assert get_env_value("PHOTON_ALLOWED_USERS") == "+15551234567"
-    assert get_env_value("PHOTON_HOME_CHANNEL") == "+15551234567"
-
-
-def test_autoconfigure_access_preserves_existing_allowlist(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    monkeypatch.delenv("PHOTON_ALLOWED_USERS", raising=False)
-    monkeypatch.delenv("PHOTON_HOME_CHANNEL", raising=False)
-    # A hand-tuned allowlist already in place must survive a setup re-run.
-    save_env_value("PHOTON_ALLOWED_USERS", "+19998887777,+15551112222")
-
-    cli._autoconfigure_access("+15551234567")
-
-    assert get_env_value("PHOTON_ALLOWED_USERS") == "+19998887777,+15551112222"
-    # The still-unset home channel is filled.
-    assert get_env_value("PHOTON_HOME_CHANNEL") == "+15551234567"
-
-
-def test_env_enablement_seeds_home_channel(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setenv("PHOTON_PROJECT_ID", "project_123")
-    monkeypatch.setenv("PHOTON_PROJECT_SECRET", "secret_123")
-    monkeypatch.setenv("PHOTON_HOME_CHANNEL", "+15551234567")
-    monkeypatch.setenv("PHOTON_HOME_CHANNEL_NAME", "Primary DM")
-
-    seed = _env_enablement()
-
-    assert seed is not None
-    assert seed["home_channel"] == {
-        "chat_id": "+15551234567",
-        "name": "Primary DM",
-    }
-
-
-def test_env_enablement_home_channel_defaults_name(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setenv("PHOTON_PROJECT_ID", "project_123")
-    monkeypatch.setenv("PHOTON_PROJECT_SECRET", "secret_123")
-    monkeypatch.setenv("PHOTON_HOME_CHANNEL", "+15551234567")
-    monkeypatch.delenv("PHOTON_HOME_CHANNEL_NAME", raising=False)
-
-    seed = _env_enablement()
-
-    assert seed is not None
-    assert seed["home_channel"] == {
-        "chat_id": "+15551234567",
-        "name": "Home",
-    }

tests/plugins/platforms/photon/test_signature.py

@@ -0,0 +1,95 @@
+"""Signature verification tests for the Photon webhook receiver."""
+from __future__ import annotations
+
+import hashlib
+import hmac
+import time
+
+import pytest
+
+from plugins.platforms.photon.adapter import verify_signature
+
+
+def _sign(secret: str, body: bytes, ts: int) -> str:
+    return "v0=" + hmac.new(
+        secret.encode(), f"v0:{ts}:".encode() + body, hashlib.sha256,
+    ).hexdigest()
+
+
+def test_accepts_valid_signature() -> None:
+    secret = "topsecret-32chars-or-whatever"
+    body = b'{"event":"messages"}'
+    ts = int(time.time())
+    sig = _sign(secret, body, ts)
+    assert verify_signature(
+        body=body, timestamp_header=str(ts), signature_header=sig,
+        signing_secret=secret,
+    )
+
+
+def test_rejects_tampered_body() -> None:
+    secret = "s"
+    body = b'{"event":"messages"}'
+    ts = int(time.time())
+    sig = _sign(secret, body, ts)
+    assert not verify_signature(
+        body=body + b" tamper", timestamp_header=str(ts),
+        signature_header=sig, signing_secret=secret,
+    )
+
+
+def test_rejects_wrong_secret() -> None:
+    body = b"x"
+    ts = int(time.time())
+    sig = _sign("right", body, ts)
+    assert not verify_signature(
+        body=body, timestamp_header=str(ts), signature_header=sig,
+        signing_secret="wrong",
+    )
+
+
+def test_rejects_drifted_timestamp() -> None:
+    secret = "s"
+    body = b"x"
+    ts = int(time.time()) - 3600  # 1h old; drift window is 5 min
+    sig = _sign(secret, body, ts)
+    assert not verify_signature(
+        body=body, timestamp_header=str(ts), signature_header=sig,
+        signing_secret=secret,
+    )
+
+
+def test_rejects_missing_v0_prefix() -> None:
+    secret = "s"
+    body = b"x"
+    ts = int(time.time())
+    raw_hex = hmac.new(
+        secret.encode(), f"v0:{ts}:".encode() + body, hashlib.sha256,
+    ).hexdigest()
+    # Strip the "v0=" prefix — verify_signature must reject.
+    assert not verify_signature(
+        body=body, timestamp_header=str(ts), signature_header=raw_hex,
+        signing_secret=secret,
+    )
+
+
+def test_rejects_empty_inputs() -> None:
+    assert not verify_signature(
+        body=b"x", timestamp_header="", signature_header="v0=abc",
+        signing_secret="s",
+    )
+    assert not verify_signature(
+        body=b"x", timestamp_header="123", signature_header="",
+        signing_secret="s",
+    )
+    assert not verify_signature(
+        body=b"x", timestamp_header="123", signature_header="v0=abc",
+        signing_secret="",
+    )
+
+
+def test_rejects_non_integer_timestamp() -> None:
+    assert not verify_signature(
+        body=b"x", timestamp_header="not-an-int",
+        signature_header="v0=abc", signing_secret="s",
+    )

tests/test_tui_gateway_server.py

@@ -902,115 +902,6 @@ def test_startup_runtime_detects_provider_for_model_env(monkeypatch):
     )
 
 
-def test_load_fallback_model_merges_chain_providers_first(monkeypatch):
-    # Parity with HermesCLI / gateway: fallback_providers stays first and keeps
-    # its order, with any distinct legacy fallback_model entry merged in after
-    # (deduped on provider/model/base_url).
-    fallback_chain = [
-        {"provider": "openrouter", "model": "openai/gpt-5.5"},
-        {"provider": "anthropic", "model": "claude-sonnet-4-6"},
-    ]
-    monkeypatch.setattr(
-        server,
-        "_load_cfg",
-        lambda: {
-            "fallback_model": {"provider": "legacy", "model": "legacy-model"},
-            "fallback_providers": fallback_chain,
-        },
-    )
-
-    assert server._load_fallback_model() == [
-        {"provider": "openrouter", "model": "openai/gpt-5.5"},
-        {"provider": "anthropic", "model": "claude-sonnet-4-6"},
-        {"provider": "legacy", "model": "legacy-model"},
-    ]
-
-
-def test_make_agent_passes_configured_fallback_chain(monkeypatch):
-    captured = {}
-    fallback_chain = [
-        {"provider": "openrouter", "model": "openai/gpt-5.5"},
-    ]
-
-    def fake_agent(**kwargs):
-        captured.update(kwargs)
-        return types.SimpleNamespace(model=kwargs.get("model"))
-
-    monkeypatch.delenv("HERMES_MODEL", raising=False)
-    monkeypatch.delenv("HERMES_INFERENCE_MODEL", raising=False)
-    monkeypatch.delenv("HERMES_TUI_PROVIDER", raising=False)
-    monkeypatch.setattr(
-        server,
-        "_load_cfg",
-        lambda: {
-            "model": {"default": "gpt-5.5", "provider": "openai-codex"},
-            "fallback_providers": fallback_chain,
-        },
-    )
-    monkeypatch.setattr(
-        "hermes_cli.runtime_provider.resolve_runtime_provider",
-        lambda requested=None, target_model=None: {
-            "provider": "openai-codex",
-            "base_url": "https://chatgpt.com/backend-api/codex",
-            "api_key": "token",
-            "api_mode": "codex_responses",
-            "credential_pool": None,
-        },
-    )
-    monkeypatch.setattr("run_agent.AIAgent", fake_agent)
-    monkeypatch.setattr(server, "_load_enabled_toolsets", lambda: ["file"])
-    monkeypatch.setattr(server, "_get_db", lambda: None)
-
-    agent = server._make_agent("sid", "session-key")
-
-    assert agent.model == "gpt-5.5"
-    assert captured["fallback_model"] == fallback_chain
-    assert captured["platform"] == "tui"
-
-
-def test_background_agent_kwargs_preserves_full_fallback_chain(monkeypatch):
-    chain = [
-        {"provider": "openrouter", "model": "openai/gpt-5.5"},
-        {"provider": "anthropic", "model": "claude-sonnet-4-6"},
-    ]
-    agent = types.SimpleNamespace(
-        model="gpt-5.5",
-        provider="openai-codex",
-        _fallback_chain=chain,
-    )
-    monkeypatch.setattr(server, "_load_cfg", lambda: {"max_turns": 25})
-    monkeypatch.setattr(server, "_load_enabled_toolsets", lambda: ["file"])
-    monkeypatch.setattr(server, "_get_db", lambda: None)
-
-    kwargs = server._background_agent_kwargs(agent, "task-id")
-
-    assert kwargs["fallback_model"] == chain
-
-
-def test_background_agent_kwargs_preserves_empty_fallback_chain(monkeypatch):
-    agent = types.SimpleNamespace(
-        model="gpt-5.5",
-        provider="anthropic",
-        _fallback_chain=[],
-    )
-    monkeypatch.setattr(
-        server,
-        "_load_cfg",
-        lambda: {
-            "max_turns": 25,
-            "fallback_providers": [
-                {"provider": "openrouter", "model": "openai/gpt-5.5"},
-            ],
-        },
-    )
-    monkeypatch.setattr(server, "_load_enabled_toolsets", lambda: ["file"])
-    monkeypatch.setattr(server, "_get_db", lambda: None)
-
-    kwargs = server._background_agent_kwargs(agent, "task-id")
-
-    assert kwargs["fallback_model"] == []
-
-
 def test_startup_runtime_resolves_short_alias_without_network(monkeypatch):
     monkeypatch.setenv("HERMES_MODEL", "sonnet")
     monkeypatch.delenv("HERMES_TUI_PROVIDER", raising=False)
@@ -2914,164 +2805,6 @@ def test_image_attach_accepts_unquoted_screenshot_path_with_spaces(monkeypatch):
     assert len(server._sessions["sid"]["attached_images"]) == 1
 
 
-def test_file_attach_uploads_remote_file_into_session_workspace(monkeypatch, tmp_path):
-    """Remote case: client path doesn't exist on gateway → decode data_url bytes."""
-    workspace = tmp_path / "workspace"
-    workspace.mkdir()
-    fake_cli = types.ModuleType("cli")
-    fake_cli._detect_file_drop = lambda raw: None
-    fake_cli._split_path_input = lambda raw: (raw, "")
-    fake_cli._resolve_attachment_path = lambda raw: None
-
-    server._sessions["sid"] = _session(cwd=str(workspace))
-    monkeypatch.setitem(sys.modules, "cli", fake_cli)
-
-    try:
-        resp = server.handle_request(
-            {
-                "id": "1",
-                "method": "file.attach",
-                "params": {
-                    "session_id": "sid",
-                    "path": "/Users/alice/Downloads/report.txt",
-                    "name": "report.txt",
-                    "data_url": "data:text/plain;base64,aGVsbG8gd29ybGQ=",
-                },
-            }
-        )
-
-        stored = workspace / ".hermes" / "desktop-attachments" / "report.txt"
-        assert resp["result"]["attached"] is True
-        assert resp["result"]["uploaded"] is True
-        assert resp["result"]["path"] == str(stored)
-        assert resp["result"]["ref_text"] == "@file:.hermes/desktop-attachments/report.txt"
-        assert stored.read_text(encoding="utf-8") == "hello world"
-    finally:
-        server._sessions.pop("sid", None)
-
-
-def test_file_attach_copies_gateway_visible_file_outside_workspace(monkeypatch, tmp_path):
-    """Local case: gateway can see the file but it's outside the workspace → copy in."""
-    workspace = tmp_path / "workspace"
-    workspace.mkdir()
-    source = tmp_path / "outside.txt"
-    source.write_text("outside workspace", encoding="utf-8")
-    fake_cli = types.ModuleType("cli")
-    fake_cli._detect_file_drop = lambda raw: None
-    fake_cli._split_path_input = lambda raw: (raw, "")
-    fake_cli._resolve_attachment_path = lambda raw: source
-
-    server._sessions["sid"] = _session(cwd=str(workspace))
-    monkeypatch.setitem(sys.modules, "cli", fake_cli)
-
-    try:
-        resp = server.handle_request(
-            {
-                "id": "1",
-                "method": "file.attach",
-                "params": {"session_id": "sid", "path": str(source)},
-            }
-        )
-
-        stored = workspace / ".hermes" / "desktop-attachments" / "outside.txt"
-        assert resp["result"]["attached"] is True
-        assert resp["result"]["uploaded"] is True
-        assert resp["result"]["ref_text"] == "@file:.hermes/desktop-attachments/outside.txt"
-        assert stored.read_text(encoding="utf-8") == "outside workspace"
-    finally:
-        server._sessions.pop("sid", None)
-
-
-def test_file_attach_uses_in_workspace_file_without_copying(monkeypatch, tmp_path):
-    """Local case: file already inside the workspace → ref it directly, no copy."""
-    workspace = tmp_path / "workspace"
-    (workspace / "data").mkdir(parents=True)
-    source = workspace / "data" / "exam.csv"
-    source.write_text("a,b,c\n1,2,3\n", encoding="utf-8")
-    fake_cli = types.ModuleType("cli")
-    fake_cli._detect_file_drop = lambda raw: None
-    fake_cli._split_path_input = lambda raw: (raw, "")
-    fake_cli._resolve_attachment_path = lambda raw: source
-
-    server._sessions["sid"] = _session(cwd=str(workspace))
-    monkeypatch.setitem(sys.modules, "cli", fake_cli)
-
-    try:
-        resp = server.handle_request(
-            {
-                "id": "1",
-                "method": "file.attach",
-                "params": {"session_id": "sid", "path": str(source)},
-            }
-        )
-
-        assert resp["result"]["attached"] is True
-        assert resp["result"]["uploaded"] is False
-        assert resp["result"]["ref_text"] == "@file:data/exam.csv"
-        # No copy: nothing staged under desktop-attachments.
-        assert not (workspace / ".hermes" / "desktop-attachments").exists()
-    finally:
-        server._sessions.pop("sid", None)
-
-
-def test_file_attach_errors_when_unresolvable_and_no_bytes(monkeypatch, tmp_path):
-    """Remote path not on gateway and no data_url → actionable error, not a stage."""
-    workspace = tmp_path / "workspace"
-    workspace.mkdir()
-    fake_cli = types.ModuleType("cli")
-    fake_cli._detect_file_drop = lambda raw: None
-    fake_cli._split_path_input = lambda raw: (raw, "")
-    fake_cli._resolve_attachment_path = lambda raw: None
-
-    server._sessions["sid"] = _session(cwd=str(workspace))
-    monkeypatch.setitem(sys.modules, "cli", fake_cli)
-
-    try:
-        resp = server.handle_request(
-            {
-                "id": "1",
-                "method": "file.attach",
-                "params": {"session_id": "sid", "path": "/Users/alice/missing.txt"},
-            }
-        )
-
-        assert "error" in resp
-        assert "no data_url" in resp["error"]["message"]
-    finally:
-        server._sessions.pop("sid", None)
-
-
-def test_file_attach_quotes_ref_with_spaces(monkeypatch, tmp_path):
-    """Staged names with spaces must be backtick-quoted so the @file: ref parses."""
-    workspace = tmp_path / "workspace"
-    workspace.mkdir()
-    fake_cli = types.ModuleType("cli")
-    fake_cli._detect_file_drop = lambda raw: None
-    fake_cli._split_path_input = lambda raw: (raw, "")
-    fake_cli._resolve_attachment_path = lambda raw: None
-
-    server._sessions["sid"] = _session(cwd=str(workspace))
-    monkeypatch.setitem(sys.modules, "cli", fake_cli)
-
-    try:
-        resp = server.handle_request(
-            {
-                "id": "1",
-                "method": "file.attach",
-                "params": {
-                    "session_id": "sid",
-                    "name": "my exam schedule.csv",
-                    "data_url": "data:text/csv;base64,YSxiCg==",
-                },
-            }
-        )
-
-        assert resp["result"]["attached"] is True
-        assert resp["result"]["ref_text"] == "@file:`.hermes/desktop-attachments/my exam schedule.csv`"
-    finally:
-        server._sessions.pop("sid", None)
-
-
 def test_commands_catalog_surfaces_quick_commands(monkeypatch):
     monkeypatch.setattr(
         server,

tests/tools/test_docker_environment.py

@@ -109,7 +109,6 @@ def test_ensure_docker_available_uses_resolved_executable(monkeypatch):
             "capture_output": True,
             "text": True,
             "timeout": 5,
-            "stdin": subprocess.DEVNULL,
         })
     ]
 

tests/tools/test_send_message_target_parse.py

@@ -1,20 +0,0 @@
-"""Parser-only tests for send_message targets.
-
-These stay separate from ``test_send_message_tool.py`` because that module
-skips wholesale when optional Telegram dependencies are not installed.
-"""
-
-from tools.send_message_tool import _parse_target_ref
-
-
-def test_photon_e164_target_is_explicit() -> None:
-    chat_id, thread_id, is_explicit = _parse_target_ref("photon", "+15551234567")
-
-    assert chat_id == "+15551234567"
-    assert thread_id is None
-    assert is_explicit is True
-
-
-def test_e164_target_still_requires_phone_platform() -> None:
-    assert _parse_target_ref("matrix", "+15551234567")[2] is False
-

tests/tools/test_send_message_tool.py

@@ -1199,11 +1199,6 @@ class TestParseTargetRefE164:
         assert chat_id == "+15551234567"
         assert is_explicit is True
 
-    def test_photon_e164_is_explicit(self):
-        chat_id, _, is_explicit = _parse_target_ref("photon", "+15551234567")
-        assert chat_id == "+15551234567"
-        assert is_explicit is True
-
     def test_signal_bare_digits_still_work(self):
         """Bare digit strings continue to match the generic numeric branch."""
         chat_id, _, is_explicit = _parse_target_ref("signal", "15551234567")

tests/tools/test_subprocess_stdin_guard.py

@@ -1,70 +0,0 @@
-"""Verify that TUI-context subprocess calls specify stdin=.
-
-This is the pytest wrapper for scripts/check_subprocess_stdin.py.
-It runs as part of the test suite so CI catches regressions when new
-subprocess calls are added without stdin=subprocess.DEVNULL.
-"""
-
-import importlib.util
-import subprocess
-import sys
-from pathlib import Path
-
-REPO_ROOT = Path(__file__).resolve().parents[2]
-SCRIPT = REPO_ROOT / "scripts" / "check_subprocess_stdin.py"
-
-
-def _load_guard():
-    spec = importlib.util.spec_from_file_location("_stdin_guard", SCRIPT)
-    assert spec is not None and spec.loader is not None
-    mod = importlib.util.module_from_spec(spec)
-    spec.loader.exec_module(mod)
-    return mod
-
-
-def test_all_tui_subprocess_calls_have_stdin():
-    """Every subprocess.run/Popen in TUI-context code must set stdin=."""
-    result = subprocess.run(
-        [sys.executable, str(SCRIPT)],
-        capture_output=True,
-        text=True,
-        timeout=30,
-    )
-    assert result.returncode == 0, (
-        f"subprocess stdin= check failed:\n{result.stdout}\n{result.stderr}"
-    )
-
-
-def test_oauth_setup_token_keeps_inherited_stdin():
-    """The interactive 'claude setup-token' login must NOT be muzzled.
-
-    Forcing stdin=subprocess.DEVNULL here would feed the OAuth prompt EOF and
-    break interactive token setup. A blanket DEVNULL sweep over TUI-context
-    subprocess calls must leave this one inheriting stdin. Regression guard for
-    the over-application caught while salvaging the stdin-EOF fix.
-    """
-    src = (REPO_ROOT / "agent" / "anthropic_adapter.py").read_text()
-    assert 'subprocess.run([claude_path, "setup-token"])' in src, (
-        "interactive setup-token call changed shape; re-verify it still "
-        "inherits stdin (no stdin=subprocess.DEVNULL)"
-    )
-    assert 'subprocess.run([claude_path, "setup-token"], stdin' not in src, (
-        "setup-token must inherit stdin so the user can complete the OAuth "
-        "login prompt; do not add stdin=subprocess.DEVNULL"
-    )
-
-
-def test_inline_noqa_marker_exempts_a_call():
-    """The guard honors an inline 'noqa: subprocess-stdin' exemption marker."""
-    guard = _load_guard()
-    flagged = guard.find_subprocess_calls(
-        "import subprocess\nsubprocess.run(['ls'])\n", "x.py"
-    )
-    assert len(flagged) == 1, "unmarked missing-stdin call should be flagged"
-
-    exempt = guard.find_subprocess_calls(
-        "import subprocess\nsubprocess.run(['ls'])  # noqa: subprocess-stdin\n",
-        "x.py",
-    )
-    assert exempt == [], "inline marker should exempt the call"
-

tools/checkpoint_manager.py

@@ -307,7 +307,6 @@ def _run_git(
             timeout=timeout,
             env=env,
             cwd=str(normalized_working_dir),
-            stdin=subprocess.DEVNULL,
         )
         ok = result.returncode == 0
         stdout = result.stdout.strip()
@@ -427,7 +426,6 @@ def _init_store(store: Path, working_dir: str) -> Optional[str]:
             ["git", "init", "--bare", str(store)],
             capture_output=True, text=True,
             env=init_env, timeout=_GIT_TIMEOUT,
-            stdin=subprocess.DEVNULL,
         )
         if result.returncode != 0:
             return f"Shadow store init failed: {result.stderr.strip()}"

tools/code_execution_tool.py

@@ -1618,7 +1618,6 @@ def _is_usable_python(python_path: str) -> bool:
             timeout=5,
             capture_output=True,
             creationflags=subprocess.CREATE_NO_WINDOW if _IS_WINDOWS else 0,
-            stdin=subprocess.DEVNULL,
         )
         return result.returncode == 0
     except (OSError, subprocess.TimeoutExpired, subprocess.SubprocessError):

tools/env_probe.py

@@ -65,7 +65,6 @@ def _run(cmd: list[str], timeout: float = 3.0) -> tuple[int, str, str]:
             text=True,
             timeout=timeout,
             check=False,
-            stdin=subprocess.DEVNULL,
         )
         return result.returncode, (result.stdout or "").strip(), (result.stderr or "").strip()
     except FileNotFoundError:

tools/environments/docker.py

@@ -177,7 +177,6 @@ def reap_orphan_containers(
         listing = subprocess.run(
             [docker, "ps", "-a", *filters, "--format", "{{.ID}}"],
             capture_output=True, text=True, timeout=15, check=False,
-            stdin=subprocess.DEVNULL,
         )
     except (subprocess.TimeoutExpired, OSError) as e:
         logger.debug("orphan reaper docker ps failed: %s", e)
@@ -211,7 +210,6 @@ def reap_orphan_containers(
             result = subprocess.run(
                 [docker, "rm", "-f", cid],
                 capture_output=True, text=True, timeout=30,
-                stdin=subprocess.DEVNULL,
             )
             if result.returncode == 0:
                 removed += 1
@@ -241,7 +239,6 @@ def _container_finished_at(docker_exe: str, container_id: str):
         result = subprocess.run(
             [docker_exe, "inspect", "--format", "{{.State.FinishedAt}}", container_id],
             capture_output=True, text=True, timeout=10, check=False,
-            stdin=subprocess.DEVNULL,
         )
     except (subprocess.TimeoutExpired, OSError) as e:
         logger.debug("orphan reaper docker inspect %s failed: %s", container_id[:12], e)
@@ -384,7 +381,6 @@ def _image_uses_init_entrypoint(docker_exe: str, image: str) -> bool:
             capture_output=True,
             text=True,
             timeout=15,
-            stdin=subprocess.DEVNULL,
         )
     except (subprocess.SubprocessError, OSError) as e:
         logger.debug("Docker: could not inspect entrypoint for %s: %s", image, e)
@@ -457,7 +453,6 @@ def _ensure_docker_available() -> None:
             capture_output=True,
             text=True,
             timeout=5,
-            stdin=subprocess.DEVNULL,
         )
     except FileNotFoundError:
         logger.error(
@@ -838,7 +833,6 @@ class DockerEnvironment(BaseEnvironment):
                             text=True,
                             timeout=30,
                             check=True,
-                            stdin=subprocess.DEVNULL,
                         )
                     except (subprocess.CalledProcessError, subprocess.TimeoutExpired) as e:
                         logger.warning(
@@ -877,7 +871,6 @@ class DockerEnvironment(BaseEnvironment):
                     text=True,
                     timeout=120,  # image pull may take a while
                     check=True,
-                    stdin=subprocess.DEVNULL,
                 )
             except (subprocess.CalledProcessError, subprocess.TimeoutExpired) as e:
                 # Docker may create the container object before `docker run`
@@ -894,7 +887,6 @@ class DockerEnvironment(BaseEnvironment):
                 subprocess.run(
                     [self._docker_exe, "rm", "-f", container_name],
                     capture_output=True, timeout=10,
-                    stdin=subprocess.DEVNULL,
                 )
                 raise
             self._container_id = result.stdout.strip()
@@ -1005,7 +997,6 @@ class DockerEnvironment(BaseEnvironment):
                     subprocess.run(
                         [self._docker_exe, "start", cid],
                         capture_output=True, text=True, timeout=30, check=True,
-                        stdin=subprocess.DEVNULL,
                     )
                     self._container_id = cid
                     logger.info("Recovery: restarted container %s", cid[:12])
@@ -1036,7 +1027,6 @@ class DockerEnvironment(BaseEnvironment):
                 ]
                 result = subprocess.run(
                     run_cmd, capture_output=True, text=True, timeout=120, check=True,
-                    stdin=subprocess.DEVNULL,
                 )
                 self._container_id = result.stdout.strip()
                 self._container_name = new_name
@@ -1091,7 +1081,6 @@ class DockerEnvironment(BaseEnvironment):
             result = subprocess.run(
                 [docker, "info", "--format", "{{.Driver}}"],
                 capture_output=True, text=True, timeout=10,
-                stdin=subprocess.DEVNULL,
             )
             driver = result.stdout.strip().lower()
             if driver != "overlay2":
@@ -1102,15 +1091,13 @@ class DockerEnvironment(BaseEnvironment):
             probe = subprocess.run(
                 [docker, "create", "--storage-opt", "size=1m", "hello-world"],
                 capture_output=True, text=True, timeout=15,
-                stdin=subprocess.DEVNULL,
             )
             if probe.returncode == 0:
                 # Clean up the created container
                 container_id = probe.stdout.strip()
                 if container_id:
                     subprocess.run([docker, "rm", container_id],
-                                   capture_output=True, timeout=5,
-                                   stdin=subprocess.DEVNULL)
+                                   capture_output=True, timeout=5)
                 _storage_opt_ok = True
             else:
                 _storage_opt_ok = False
@@ -1145,7 +1132,6 @@ class DockerEnvironment(BaseEnvironment):
                 text=True,
                 timeout=10,
                 check=False,
-                stdin=subprocess.DEVNULL,
             )
         except (subprocess.TimeoutExpired, OSError) as e:
             logger.debug("docker ps probe failed: %s — will start a fresh container", e)
@@ -1262,7 +1248,6 @@ class DockerEnvironment(BaseEnvironment):
                     subprocess.run(
                         [docker_exe, "stop", "-t", "10", container_id],
                         capture_output=True, timeout=30,
-                        stdin=subprocess.DEVNULL,
                     )
                 except (subprocess.TimeoutExpired, OSError) as e:
                     logger.warning("docker stop %s timed out / failed: %s", log_id, e)
@@ -1271,7 +1256,6 @@ class DockerEnvironment(BaseEnvironment):
                     subprocess.run(
                         [docker_exe, "rm", "-f", container_id],
                         capture_output=True, timeout=30,
-                        stdin=subprocess.DEVNULL,
                     )
                 except (subprocess.TimeoutExpired, OSError) as e:
                     logger.warning("docker rm -f %s failed: %s", log_id, e)

tools/environments/singularity.py

@@ -46,7 +46,6 @@ def _ensure_singularity_available() -> str:
     try:
         result = subprocess.run(
             [exe, "version"], capture_output=True, text=True, timeout=10,
-            stdin=subprocess.DEVNULL,
         )
     except FileNotFoundError:
         raise RuntimeError(
@@ -137,7 +136,6 @@ def _get_or_build_sif(image: str, executable: str = "apptainer") -> str:
             result = subprocess.run(
                 [executable, "build", str(sif_path), image],
                 capture_output=True, text=True, timeout=600, env=env,
-                stdin=subprocess.DEVNULL,
             )
             if result.returncode != 0:
                 logger.warning("SIF build failed, falling back to docker:// URL")
@@ -220,7 +218,7 @@ class SingularityEnvironment(BaseEnvironment):
         cmd.extend([str(self.image), self.instance_id])
 
         try:
-            result = subprocess.run(cmd, capture_output=True, text=True, timeout=120, stdin=subprocess.DEVNULL)
+            result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
             if result.returncode != 0:
                 raise RuntimeError(f"Failed to start instance: {result.stderr}")
             self._instance_started = True
@@ -252,7 +250,6 @@ class SingularityEnvironment(BaseEnvironment):
                 subprocess.run(
                     [self.executable, "instance", "stop", self.instance_id],
                     capture_output=True, text=True, timeout=30,
-                    stdin=subprocess.DEVNULL,
                 )
                 logger.info("Singularity instance %s stopped", self.instance_id)
             except Exception as e:

tools/lazy_deps.py

@@ -365,7 +365,6 @@ def _venv_pip_install(specs: tuple[str, ...], *, timeout: int = 300) -> _Install
             r = subprocess.run(
                 [uv_bin, "pip", "install", *specs],
                 capture_output=True, text=True, timeout=timeout, env=uv_env,
-                stdin=subprocess.DEVNULL,
             )
             if r.returncode == 0:
                 return _InstallResult(True, r.stdout or "", r.stderr or "")
@@ -379,7 +378,6 @@ def _venv_pip_install(specs: tuple[str, ...], *, timeout: int = 300) -> _Install
         probe = subprocess.run(
             pip_cmd + ["--version"],
             capture_output=True, text=True, timeout=15,
-            stdin=subprocess.DEVNULL,
         )
         if probe.returncode != 0:
             raise FileNotFoundError("pip not in venv")
@@ -388,7 +386,6 @@ def _venv_pip_install(specs: tuple[str, ...], *, timeout: int = 300) -> _Install
             subprocess.run(
                 [sys.executable, "-m", "ensurepip", "--upgrade", "--default-pip"],
                 capture_output=True, text=True, timeout=120, check=True,
-                stdin=subprocess.DEVNULL,
             )
         except (subprocess.CalledProcessError, subprocess.TimeoutExpired) as e:
             return _InstallResult(False, "",
@@ -398,7 +395,6 @@ def _venv_pip_install(specs: tuple[str, ...], *, timeout: int = 300) -> _Install
         r = subprocess.run(
             pip_cmd + ["install", *specs],
             capture_output=True, text=True, timeout=timeout,
-            stdin=subprocess.DEVNULL,
         )
         return _InstallResult(r.returncode == 0, r.stdout or "", r.stderr or "")
     except subprocess.TimeoutExpired as e:

tools/process_registry.py

@@ -472,7 +472,6 @@ class ProcessRegistry:
                     text=True,
                     timeout=10,
                     creationflags=windows_hide_flags(),
-                    stdin=subprocess.DEVNULL,
                 )
             except (FileNotFoundError, subprocess.TimeoutExpired, OSError):
                 try:

tools/send_message_tool.py

@@ -38,7 +38,7 @@ _NUMERIC_TOPIC_RE = _TELEGRAM_TOPIC_TARGET_RE
 # below and falls through to channel-name resolution, which has no way to
 # resolve a raw phone number. Keeping the '+' preserves the E.164 form that
 # downstream adapters (signal, etc.) expect.
-_PHONE_PLATFORMS = frozenset({"photon", "signal", "sms", "whatsapp"})
+_PHONE_PLATFORMS = frozenset({"signal", "sms", "whatsapp"})
 _E164_TARGET_RE = re.compile(r"^\s*\+(\d{7,15})\s*$")
 # Email addresses — a valid email like "user@domain.com" should be treated as
 # an explicit target for the email platform, not fall through to channel-name

tools/skills_hub.py

@@ -301,7 +301,6 @@ class GitHubAuth:
             result = subprocess.run(
                 ["gh", "auth", "token"],
                 capture_output=True, text=True, timeout=5,
-                stdin=subprocess.DEVNULL,
             )
             if result.returncode == 0 and result.stdout.strip():
                 return result.stdout.strip()

tools/terminal_tool.py

@@ -2436,13 +2436,13 @@ def check_terminal_requirements() -> bool:
             if not docker:
                 logger.error("Docker executable not found in PATH or common install locations")
                 return False
-            result = subprocess.run([docker, "version"], capture_output=True, timeout=5, stdin=subprocess.DEVNULL)
+            result = subprocess.run([docker, "version"], capture_output=True, timeout=5)
             return result.returncode == 0
 
         elif env_type == "singularity":
             executable = shutil.which("apptainer") or shutil.which("singularity")
             if executable:
-                result = subprocess.run([executable, "--version"], capture_output=True, timeout=5, stdin=subprocess.DEVNULL)
+                result = subprocess.run([executable, "--version"], capture_output=True, timeout=5)
                 return result.returncode == 0
             return False
 

tools/tirith_security.py

@@ -288,7 +288,6 @@ def _verify_cosign(checksums_path: str, sig_path: str, cert_path: str) -> bool |
             capture_output=True,
             text=True,
             timeout=15,
-            stdin=subprocess.DEVNULL,
         )
         if result.returncode == 0:
             logger.info("cosign provenance verification passed")
@@ -735,7 +734,6 @@ def check_command_security(command: str) -> dict:
             capture_output=True,
             text=True,
             timeout=timeout,
-            stdin=subprocess.DEVNULL,
         )
     except OSError as exc:
         # Covers FileNotFoundError, PermissionError, exec format error.

tools/transcription_tools.py

@@ -490,7 +490,6 @@ def _terminate_command_stt_process_tree(proc: subprocess.Popen) -> None:
                 stdout=subprocess.DEVNULL,
                 stderr=subprocess.DEVNULL,
                 timeout=5,
-                stdin=subprocess.DEVNULL,
             )
         except Exception:
             proc.kill()
@@ -556,7 +555,7 @@ def _run_command_stt(command: str, timeout: float) -> subprocess.CompletedProces
     else:
         popen_kwargs["start_new_session"] = True
 
-    proc = subprocess.Popen(command, **popen_kwargs, stdin=subprocess.DEVNULL)
+    proc = subprocess.Popen(command, **popen_kwargs)
     try:
         stdout, stderr = proc.communicate(timeout=timeout)
     except subprocess.TimeoutExpired as exc:
@@ -1187,7 +1186,7 @@ def _prepare_local_audio(file_path: str, work_dir: str) -> tuple[Optional[str],
     command = [ffmpeg, "-y", "-i", file_path, converted_path]
 
     try:
-        subprocess.run(command, check=True, capture_output=True, text=True, timeout=300, stdin=subprocess.DEVNULL)
+        subprocess.run(command, check=True, capture_output=True, text=True, timeout=300)
         return converted_path, None
     except subprocess.TimeoutExpired:
         logger.error("ffmpeg conversion timed out for %s", file_path)
@@ -1233,9 +1232,9 @@ def _transcribe_local_command(file_path: str, model_name: str) -> Dict[str, Any]
             # User-provided templates (env var) may contain shell syntax; auto-detected commands are safe for list mode.
             use_shell = bool(os.getenv(LOCAL_STT_COMMAND_ENV, "").strip())
             if use_shell:
-                subprocess.run(command, shell=True, check=True, capture_output=True, text=True, timeout=300, stdin=subprocess.DEVNULL)
+                subprocess.run(command, shell=True, check=True, capture_output=True, text=True, timeout=300)
             else:
-                subprocess.run(shlex.split(command), check=True, capture_output=True, text=True, timeout=300, stdin=subprocess.DEVNULL)
+                subprocess.run(shlex.split(command), check=True, capture_output=True, text=True, timeout=300)
             
 
             txt_files = sorted(Path(output_dir).glob("*.txt"))

tools/tts_tool.py

@@ -693,7 +693,6 @@ def _terminate_command_tts_process_tree(proc: subprocess.Popen) -> None:
                 stdout=subprocess.DEVNULL,
                 stderr=subprocess.DEVNULL,
                 timeout=5,
-                stdin=subprocess.DEVNULL,
             )
         except Exception:
             proc.kill()
@@ -746,7 +745,7 @@ def _run_command_tts(command: str, timeout: float) -> subprocess.CompletedProces
     else:
         popen_kwargs["start_new_session"] = True
 
-    proc = subprocess.Popen(command, **popen_kwargs, stdin=subprocess.DEVNULL)
+    proc = subprocess.Popen(command, **popen_kwargs)
     try:
         stdout, stderr = proc.communicate(timeout=timeout)
     except subprocess.TimeoutExpired as exc:
@@ -883,7 +882,6 @@ def _convert_to_opus(mp3_path: str) -> Optional[str]:
             ["ffmpeg", "-i", mp3_path, "-acodec", "libopus",
              "-ac", "1", "-b:a", "64k", "-vbr", "off", ogg_path, "-y"],
             capture_output=True, timeout=30,
-            stdin=subprocess.DEVNULL,
         )
         if result.returncode != 0:
             logger.warning("ffmpeg conversion failed with return code %d: %s", 
@@ -1506,7 +1504,7 @@ def _generate_gemini_tts(text: str, output_path: str, tts_config: Dict[str, Any]
                 ]
             else:
                 cmd = [ffmpeg, "-i", wav_path, "-y", "-loglevel", "error", output_path]
-            result = subprocess.run(cmd, capture_output=True, timeout=30, stdin=subprocess.DEVNULL)
+            result = subprocess.run(cmd, capture_output=True, timeout=30)
             if result.returncode != 0:
                 stderr = result.stderr.decode("utf-8", errors="ignore")[:300]
                 raise RuntimeError(f"ffmpeg conversion failed: {stderr}")
@@ -1589,7 +1587,7 @@ def _generate_neutts(text: str, output_path: str, tts_config: Dict[str, Any]) ->
         "--device", device,
     ]
 
-    result = subprocess.run(cmd, capture_output=True, text=True, timeout=120, stdin=subprocess.DEVNULL)
+    result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
     if result.returncode != 0:
         stderr = result.stderr.strip()
         # Filter out the "OK:" line from stderr
@@ -1601,7 +1599,7 @@ def _generate_neutts(text: str, output_path: str, tts_config: Dict[str, Any]) ->
         ffmpeg = shutil.which("ffmpeg")
         if ffmpeg:
             conv_cmd = [ffmpeg, "-i", wav_path, "-y", "-loglevel", "error", output_path]
-            subprocess.run(conv_cmd, check=True, timeout=30, stdin=subprocess.DEVNULL)
+            subprocess.run(conv_cmd, check=True, timeout=30)
             os.remove(wav_path)
         else:
             # No ffmpeg — just rename the WAV to the expected path
@@ -1672,7 +1670,6 @@ def _resolve_piper_voice_path(voice: str, download_dir: Path) -> str:
             [_sys.executable, "-m", "piper.download_voices", voice,
              "--download-dir", str(download_dir)],
             capture_output=True, text=True, timeout=300,
-            stdin=subprocess.DEVNULL,
         )
     except subprocess.TimeoutExpired as exc:
         raise RuntimeError(
@@ -1760,7 +1757,7 @@ def _generate_piper_tts(text: str, output_path: str, tts_config: Dict[str, Any])
         ffmpeg = shutil.which("ffmpeg")
         if ffmpeg:
             conv_cmd = [ffmpeg, "-i", wav_path, "-y", "-loglevel", "error", output_path]
-            subprocess.run(conv_cmd, check=True, timeout=30, stdin=subprocess.DEVNULL)
+            subprocess.run(conv_cmd, check=True, timeout=30)
             try:
                 os.remove(wav_path)
             except OSError:
@@ -1826,7 +1823,7 @@ def _generate_kittentts(text: str, output_path: str, tts_config: Dict[str, Any])
         ffmpeg = shutil.which("ffmpeg")
         if ffmpeg:
             conv_cmd = [ffmpeg, "-i", wav_path, "-y", "-loglevel", "error", output_path]
-            subprocess.run(conv_cmd, check=True, timeout=30, stdin=subprocess.DEVNULL)
+            subprocess.run(conv_cmd, check=True, timeout=30)
             os.remove(wav_path)
         else:
             # No ffmpeg — rename the WAV to the expected path

tools/voice_mode.py

@@ -75,7 +75,6 @@ def _termux_api_app_installed() -> bool:
             text=True,
             timeout=5,
             check=False,
-            stdin=subprocess.DEVNULL,
         )
         return "package:com.termux.api" in (result.stdout or "")
     except Exception:
@@ -389,7 +388,7 @@ class TermuxAudioRecorder:
             "-c", str(CHANNELS),
         ]
         try:
-            subprocess.run(command, capture_output=True, text=True, timeout=15, check=True, stdin=subprocess.DEVNULL)
+            subprocess.run(command, capture_output=True, text=True, timeout=15, check=True)
         except subprocess.CalledProcessError as e:
             details = (e.stderr or e.stdout or str(e)).strip()
             raise RuntimeError(f"Termux microphone start failed: {details}") from e
@@ -406,7 +405,7 @@ class TermuxAudioRecorder:
         mic_cmd = _termux_microphone_command()
         if not mic_cmd:
             return
-        subprocess.run([mic_cmd, "-q"], capture_output=True, text=True, timeout=15, check=False, stdin=subprocess.DEVNULL)
+        subprocess.run([mic_cmd, "-q"], capture_output=True, text=True, timeout=15, check=False)
 
     def stop(self) -> Optional[str]:
         with self._lock:
@@ -1096,7 +1095,7 @@ def play_audio_file(file_path: str) -> bool:
         exe = shutil.which(cmd[0])
         if exe:
             try:
-                proc = subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, stdin=subprocess.DEVNULL)
+                proc = subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
                 with _playback_lock:
                     _active_playback = proc
                 proc.wait(timeout=300)

tui_gateway/server.py

@@ -1041,7 +1041,6 @@ def _git_branch_for_cwd(cwd: str) -> str:
             text=True,
             timeout=1.5,
             check=False,
-            stdin=subprocess.DEVNULL,
         )
         if result.returncode == 0:
             branch = result.stdout.strip()
@@ -1053,7 +1052,6 @@ def _git_branch_for_cwd(cwd: str) -> str:
             text=True,
             timeout=1.5,
             check=False,
-            stdin=subprocess.DEVNULL,
         )
         return head.stdout.strip() if head.returncode == 0 else ""
     except Exception:
@@ -1992,8 +1990,7 @@ def _current_profile_name() -> str:
 # backend reporting less than its required value (or none at all — a pre-GUI
 # checkout), surfacing a one-click "update to align" prompt instead of failing
 # cryptically downstream. Bump whenever the desktop's backend contract changes.
-# v2: adds the file.attach RPC (remote-gateway non-image file upload).
-DESKTOP_BACKEND_CONTRACT = 2
+DESKTOP_BACKEND_CONTRACT = 1
 
 
 def _session_info(agent, session: dict | None = None) -> dict:
@@ -2588,29 +2585,6 @@ def _parse_tui_skills_env() -> list[str]:
     return skills
 
 
-def _load_fallback_model():
-    """Return the configured fallback chain for TUI-created agents.
-
-    Delegates to the shared ``get_fallback_chain`` helper so the TUI path
-    stays in parity with ``HermesCLI.__init__`` and ``gateway/run.py``:
-    ``fallback_providers`` is the primary source of truth and keeps its
-    order, with legacy ``fallback_model`` entries merged in afterwards
-    (deduped on provider/model/base_url).
-    """
-    from hermes_cli.fallback_config import get_fallback_chain
-
-    return get_fallback_chain(_load_cfg())
-
-
-def _agent_fallback_model(agent):
-    """Return an agent's fallback chain without rehydrating deliberately empty chains."""
-    if hasattr(agent, "_fallback_chain"):
-        return getattr(agent, "_fallback_chain") or []
-    if hasattr(agent, "_fallback_model"):
-        return getattr(agent, "_fallback_model", None)
-    return _load_fallback_model()
-
-
 def _background_agent_kwargs(agent, task_id: str) -> dict:
     cfg = _load_cfg()
 
@@ -2645,7 +2619,7 @@ def _background_agent_kwargs(agent, task_id: str) -> dict:
         "request_overrides": dict(getattr(agent, "request_overrides", {}) or {}),
         "platform": "tui",
         "session_db": _get_db(),
-        "fallback_model": _agent_fallback_model(agent),
+        "fallback_model": getattr(agent, "_fallback_model", None),
     }
 
 
@@ -2904,7 +2878,6 @@ def _make_agent(
         pass_session_id=is_truthy_value(os.environ.get("HERMES_TUI_PASS_SESSION_ID")),
         skip_context_files=is_truthy_value(os.environ.get("HERMES_IGNORE_RULES")),
         skip_memory=is_truthy_value(os.environ.get("HERMES_IGNORE_RULES")),
-        fallback_model=_load_fallback_model(),
         **_agent_cbs(sid),
     )
 
@@ -5598,7 +5571,7 @@ def _(rid, params: dict) -> dict:
             str(pdf_path), str(out_prefix),
         ]
         try:
-            res = subprocess.run(argv, capture_output=True, text=True, timeout=120, stdin=subprocess.DEVNULL)
+            res = subprocess.run(argv, capture_output=True, text=True, timeout=120)
         except subprocess.TimeoutExpired:
             return _err(rid, 5028, "pdftoppm timed out (>120s)")
         if res.returncode != 0:
@@ -5632,197 +5605,6 @@ def _(rid, params: dict) -> dict:
         )
 
 
-_ATTACHMENT_REF_NEEDS_QUOTING_RE = None
-
-
-def _format_ref_value(value: str) -> str:
-    """Quote a context-ref value when it contains whitespace or bracket chars.
-
-    Mirrors the desktop ``formatRefValue`` so the staged ``@file:`` ref round-trips
-    through ``agent.context_references`` cleanly.
-    """
-    import re as _re
-
-    global _ATTACHMENT_REF_NEEDS_QUOTING_RE
-    if _ATTACHMENT_REF_NEEDS_QUOTING_RE is None:
-        _ATTACHMENT_REF_NEEDS_QUOTING_RE = _re.compile(r"""[\s()\[\]{}<>"'`]""")
-    if not value or not _ATTACHMENT_REF_NEEDS_QUOTING_RE.search(value):
-        return value
-    if "`" not in value:
-        return f"`{value}`"
-    if '"' not in value:
-        return f'"{value}"'
-    if "'" not in value:
-        return f"'{value}'"
-    return value
-
-
-def _attachment_ref_path(session: dict, target: Path) -> str:
-    """Workspace-relative path for an attachment, or the absolute path if outside."""
-    workspace = Path(_session_cwd(session)).resolve()
-    try:
-        rel = target.resolve().relative_to(workspace)
-        return str(rel).replace(os.sep, "/")
-    except ValueError:
-        return str(target.resolve())
-
-
-def _desktop_attachment_dir(session: dict) -> Path:
-    root = Path(_session_cwd(session)).resolve() / ".hermes" / "desktop-attachments"
-    root.mkdir(parents=True, exist_ok=True)
-    return root
-
-
-def _sanitize_attachment_name(name: str) -> str:
-    import re as _re
-
-    candidate = Path(str(name or "").strip()).name
-    candidate = _re.sub(r"[\x00-\x1f]+", "_", candidate)
-    candidate = candidate.strip().strip(".")
-    return candidate or "attachment"
-
-
-def _unique_attachment_path(root: Path, filename: str) -> Path:
-    candidate = root / filename
-    if not candidate.exists():
-        return candidate
-    stem = Path(filename).stem or "attachment"
-    suffix = Path(filename).suffix
-    counter = 2
-    while True:
-        next_candidate = root / f"{stem}-{counter}{suffix}"
-        if not next_candidate.exists():
-            return next_candidate
-        counter += 1
-
-
-def _resolve_gateway_attachment_path(raw: str) -> Path | None:
-    """Resolve a raw path token to a gateway-visible file, or None."""
-    if not raw:
-        return None
-    try:
-        from cli import _detect_file_drop, _resolve_attachment_path, _split_path_input
-    except Exception:
-        return None
-
-    dropped = _detect_file_drop(raw)
-    if dropped:
-        return Path(dropped["path"]).resolve()
-    path_token, _remainder = _split_path_input(raw)
-    resolved = _resolve_attachment_path(path_token)
-    return Path(resolved).resolve() if resolved is not None else None
-
-
-def _decode_attachment_data_url(data_url: str) -> bytes:
-    """Decode a ``data:<any-mime>;base64,<b64>`` payload to bytes.
-
-    Unlike ``_decode_attach_base64`` (image-mime-specific), this accepts any
-    media type — text/csv, application/pdf, etc. — so non-image file uploads
-    round-trip. Also tolerates a bare base64 string with no data-URL prefix.
-    """
-    import base64 as _base64
-    import binascii as _binascii
-    import re as _re
-
-    cleaned = (data_url or "").strip()
-    m = _re.match(r"^data:[^;,]*(?:;[^;,=]+=[^;,]+)*;base64,(.*)$", cleaned, _re.DOTALL | _re.I)
-    if m:
-        cleaned = m.group(1)
-    cleaned = _re.sub(r"\s+", "", cleaned)
-    try:
-        return _base64.b64decode(cleaned, validate=True)
-    except (ValueError, _binascii.Error) as exc:
-        raise ValueError("invalid data_url payload") from exc
-
-
-def _stage_session_file_attachment(
-    session: dict,
-    *,
-    raw_path: str,
-    data_url: str,
-    name: str,
-) -> tuple[Path, bool]:
-    """Make a desktop file attachment available to the remote gateway agent.
-
-    Three cases:
-      1. The path resolves to a file already INSIDE the session workspace — use
-         it as-is (no copy, ``uploaded=False``).
-      2. The path resolves to a gateway-visible file OUTSIDE the workspace — copy
-         it into ``.hermes/desktop-attachments/`` so the ``@file:`` ref resolves.
-      3. The path doesn't exist on the gateway (the common remote case: it's a
-         path on the CLIENT's disk) — decode the uploaded ``data_url`` bytes and
-         write them into ``.hermes/desktop-attachments/``.
-
-    Returns ``(stored_path, uploaded)``.
-    """
-    workspace = Path(_session_cwd(session)).resolve()
-    resolved = _resolve_gateway_attachment_path(raw_path)
-    if resolved is not None:
-        try:
-            resolved.relative_to(workspace)
-            return resolved, False
-        except ValueError:
-            payload = resolved.read_bytes()
-            filename = resolved.name
-    else:
-        if not data_url:
-            raise ValueError("file not found on gateway and no data_url provided")
-        payload = _decode_attachment_data_url(data_url)
-        filename = _sanitize_attachment_name(name or Path(str(raw_path or "")).name)
-
-    upload_dir = _desktop_attachment_dir(session)
-    target = _unique_attachment_path(upload_dir, _sanitize_attachment_name(filename))
-    target.write_bytes(payload)
-    return target.resolve(), True
-
-
-@method("file.attach")
-def _(rid, params: dict) -> dict:
-    """Stage a non-image file attachment into the session workspace.
-
-    The image/PDF path renders to vision tiles; this one keeps the file as a
-    readable artifact and returns a workspace-relative ``@file:`` ref so the
-    agent's file tools (and ``agent.context_references``) can read it. Solves the
-    remote-gateway case where the desktop passes a path that only exists on the
-    CLIENT's disk: the client uploads ``data_url`` bytes and we materialize the
-    file on the gateway.
-
-    Params:
-      session_id (str, required)
-      path (str): client/host path of the file (used for naming + local-mode
-        gateway-visible resolution).
-      data_url (str): ``data:<mime>;base64,<b64>`` upload of the file bytes,
-        required when the path isn't visible to the gateway.
-      name (str, optional): preferred filename.
-    """
-    session, err = _sess(params, rid)
-    if err:
-        return err
-    raw = str(params.get("path", "") or "").strip()
-    data_url = str(params.get("data_url", "") or "").strip()
-    name = str(params.get("name", "") or "").strip()
-    if not raw and not data_url:
-        return _err(rid, 4015, "path or data_url required")
-    try:
-        stored_path, uploaded = _stage_session_file_attachment(
-            session, raw_path=raw, data_url=data_url, name=name
-        )
-        ref_path = _attachment_ref_path(session, stored_path)
-        return _ok(
-            rid,
-            {
-                "attached": True,
-                "name": stored_path.name,
-                "path": str(stored_path),
-                "ref_path": ref_path,
-                "ref_text": f"@file:{_format_ref_value(ref_path)}",
-                "uploaded": uploaded,
-            },
-        )
-    except Exception as e:
-        return _err(rid, 5028, str(e))
-
-
 @method("image.detach")
 def _(rid, params: dict) -> dict:
     session, err = _sess(params, rid)
@@ -7063,7 +6845,6 @@ def _(rid, params: dict) -> dict:
             timeout=min(int(params.get("timeout", 240)), 600),
             cwd=os.getcwd(),
             env=os.environ.copy(),
-            stdin=subprocess.DEVNULL,
         )
         parts = [r.stdout or "", r.stderr or ""]
         out = "\n".join(p for p in parts if p).strip() or "(no output)"
@@ -7124,7 +6905,6 @@ def _(rid, params: dict) -> dict:
                 capture_output=True,
                 text=True,
                 timeout=30,
-                stdin=subprocess.DEVNULL,
             )
             output = (
                 (r.stdout or "")
@@ -7515,7 +7295,6 @@ def _list_repo_files(root: str) -> list[str]:
             capture_output=True,
             timeout=2.0,
             check=False,
-            stdin=subprocess.DEVNULL,
         )
         if top_result.returncode == 0:
             top = top_result.stdout.decode("utf-8", "replace").strip()
@@ -7533,7 +7312,6 @@ def _list_repo_files(root: str) -> list[str]:
                 capture_output=True,
                 timeout=2.0,
                 check=False,
-                stdin=subprocess.DEVNULL,
             )
             if list_result.returncode == 0:
                 for p in list_result.stdout.decode("utf-8", "replace").split("\0"):
@@ -9267,8 +9045,7 @@ def _(rid, params: dict) -> dict:
         return _err(rid, 5001, "shell.exec unavailable: approval safety module not importable")
     try:
         r = subprocess.run(
-            cmd, shell=True, capture_output=True, text=True, timeout=30, cwd=os.getcwd(),
-            stdin=subprocess.DEVNULL,
+            cmd, shell=True, capture_output=True, text=True, timeout=30, cwd=os.getcwd()
         )
         return _ok(
             rid,

ui-tui/packages/hermes-ink/src/ink/app-rawmode-mouse.test.ts

@@ -1,91 +0,0 @@
-import { EventEmitter } from 'events'
-import React, { useContext, useEffect } from 'react'
-import { describe, expect, it } from 'vitest'
-
-import StdinContext from './components/StdinContext.js'
-import Text from './components/Text.js'
-import Ink from './ink.js'
-import { DISABLE_MOUSE_TRACKING } from './termio/dec.js'
-
-class FakeTty extends EventEmitter {
-  chunks: string[] = []
-  columns = 80
-  rows = 24
-  isTTY = true
-  isRaw = false
-
-  ref(): void {}
-  unref(): void {}
-  read(): null {
-    return null
-  }
-  setEncoding(): this {
-    return this
-  }
-  setRawMode(mode: boolean): this {
-    this.isRaw = mode
-    return this
-  }
-  write(chunk: string | Uint8Array, cb?: (err?: Error | null) => void): boolean {
-    this.chunks.push(typeof chunk === 'string' ? chunk : Buffer.from(chunk).toString('utf8'))
-    cb?.()
-    return true
-  }
-}
-
-const tick = () => new Promise<void>(resolve => setImmediate(resolve))
-
-// A child that grabs the last useInput consumer's raw-mode toggle. Mounting
-// enables raw mode (count 0→1); unmounting disables it (count 1→0), which is
-// the teardown path that must DISABLE_MOUSE_TRACKING so DEC 1003 hover can't
-// leak as cooked-mode `35;col;row M` text over the prompt.
-function RawModeConsumer({ active }: { active: boolean }) {
-  const { setRawMode, isRawModeSupported } = useContext(StdinContext)
-
-  useEffect(() => {
-    if (!active || !isRawModeSupported) {
-      return
-    }
-
-    setRawMode(true)
-
-    return () => setRawMode(false)
-  }, [active, isRawModeSupported, setRawMode])
-
-  return React.createElement(Text, null, 'x')
-}
-
-describe('App raw-mode teardown', () => {
-  it('disables mouse tracking when the last raw-mode consumer detaches', async () => {
-    const stdout = new FakeTty()
-    const stdin = new FakeTty()
-    const stderr = new FakeTty()
-    const ink = new Ink({
-      exitOnCtrlC: false,
-      patchConsole: false,
-      stderr: stderr as unknown as NodeJS.WriteStream,
-      stdin: stdin as unknown as NodeJS.ReadStream,
-      stdout: stdout as unknown as NodeJS.WriteStream
-    })
-
-    // Mouse tracking is asserted on the alt screen; the teardown path lives in
-    // App, independent of who enabled tracking.
-    ink.setAltScreenActive(true, 'all')
-    ink.render(React.createElement(RawModeConsumer, { active: true }))
-    ink.onRender()
-    await tick()
-    expect(stdin.isRaw).toBe(true)
-
-    stdout.chunks = []
-
-    // Drop the consumer → raw-mode count hits 0 → teardown runs.
-    ink.render(React.createElement(RawModeConsumer, { active: false }))
-    ink.onRender()
-    await tick()
-
-    expect(stdin.isRaw).toBe(false)
-    expect(stdout.chunks.join('')).toContain(DISABLE_MOUSE_TRACKING)
-
-    ink.unmount()
-  })
-})

ui-tui/packages/hermes-ink/src/ink/components/App.tsx

@@ -9,7 +9,6 @@ import type { DOMElement } from '../dom.js'
 import { EventEmitter } from '../events/emitter.js'
 import { InputEvent } from '../events/input-event.js'
 import { TerminalFocusEvent } from '../events/terminal-focus-event.js'
-import instances from '../instances.js'
 import {
   INITIAL_STATE,
   type ParsedInput,
@@ -310,21 +309,6 @@ export default class App extends PureComponent<Props, State> {
             }
           })
         })
-
-        // Re-assert mouse tracking on raw-mode re-entry. <AlternateScreen>
-        // owns the initial enable, but its effect only re-runs on a
-        // mode/writeRaw change — NOT on a raw-mode bounce (count 1→0→1, e.g.
-        // an overlay that briefly drops the last useInput consumer). The
-        // teardown above now DISABLE_MOUSE_TRACKING's to stop the cooked-echo
-        // leak, so without this the terminal would be left with tracking off
-        // and the mouse silently dead until the next stdin-gap/resize
-        // re-assert. reassertTerminalModes() is gated on altScreenActive and
-        // idempotent, so it's a no-op when there's nothing to restore.
-        // Deferred (same setImmediate discipline as the XTVERSION probe) so it
-        // lands after any alt-screen enable writes in this render cycle.
-        setImmediate(() => {
-          instances.get(this.props.stdout)?.reassertTerminalModes()
-        })
       }
 
       this.rawModeEnabledCount++
@@ -340,15 +324,6 @@ export default class App extends PureComponent<Props, State> {
       this.props.stdout.write(DFE)
       // Disable bracketed paste mode
       this.props.stdout.write(DBP)
-      // Disable mouse tracking. Tracking is asserted by <AlternateScreen> /
-      // the Ink instance, NOT here — but dropping raw mode + detaching the
-      // readable listener while DEC 1003 hover stays on means the terminal
-      // falls back to cooked-mode echo and every mouse move leaks as text
-      // (`35;col;row M` shards over the prompt). Same hazard handleSuspend()
-      // already guards against; this teardown path missed it. Idempotent
-      // (no-op if tracking was never on), and re-enabling raw mode below
-      // re-asserts tracking so a transient drop→re-add round-trips cleanly.
-      this.props.stdout.write(DISABLE_MOUSE_TRACKING)
       stdin.setRawMode(false)
       stdin.removeListener('readable', this.handleReadable)
       stdin.unref()

web/src/i18n/en.ts

@@ -362,7 +362,7 @@ export const en: Translations = {
     inactive: "inactive",
     installBtn: "Install",
     installHeading: "Install from GitHub / Git URL",
-    installHint: "Use owner/repo shorthand or a full https:// or git@ clone URL.",
+    installHint: "Use owner/repo shorthand or a full https:// or git@ clone URL. For a plugin in a subdirectory, append the path: owner/repo/path/to/plugin (or <url>#path/to/plugin).",
     memoryProviderLabel: "Memory provider",
     missingEnvWarn: "Set these in Keys before the plugin can run:",
     noDashboardTab: "No dashboard tab",

web/src/pages/PluginsPage.tsx

@@ -240,7 +240,7 @@ export default function PluginsPage() {
               <Input
                 className="font-mono-ui lowercase"
                 id="install-url"
-                placeholder="owner/repo or https://..."
+                placeholder="owner/repo, owner/repo/subdir, or https://..."
                 spellCheck={false}
                 value={installId}
                 onChange={(e) => setInstallId(e.target.value)}

website/docs/user-guide/messaging/photon.md

@@ -22,30 +22,26 @@ your account.
 
 ## Architecture
 
-Photon is a **persistent-connection** channel, like Discord or Slack —
-**no webhook, no public URL, no signing secret to manage.**
+Inbound messages arrive as **signed webhooks**: Photon POSTs JSON with
+an `X-Spectrum-Signature` header to a URL you register, and Hermes'
+aiohttp listener verifies the HMAC-SHA256 signature before dispatching
+the event into the agent.
 
-The `spectrum-ts` SDK holds a long-lived **gRPC stream** to Photon for
-both directions. Because the SDK is TypeScript-only, Hermes runs it in a
-small supervised **Node sidecar** and talks to it over loopback:
-
-- **Inbound** — the sidecar consumes the SDK's `app.messages` gRPC
-  stream and forwards each message to the Python adapter over a loopback
-  `GET /inbound` (NDJSON). The adapter dedupes and dispatches it to the
-  agent, reconnecting automatically if the stream drops.
-- **Outbound** — replies are loopback POSTs to the sidecar, which calls
-  `space.send(...)` on the SDK.
-
-The Python plugin starts, supervises, and shuts down the sidecar
-automatically.
+Outbound replies go through a small supervised **Node sidecar** that
+runs the `spectrum-ts` SDK on loopback. Photon does not currently
+expose a public HTTP send-message endpoint — that's a roadmap item on
+their side — so until then the sidecar is the only way to call
+`Space.send(...)`. The Python plugin starts, supervises, and shuts
+down the sidecar automatically. When Photon ships an HTTP send
+endpoint we'll retire the sidecar in a follow-up release.
 
 ## Prerequisites
 
 - A Photon account — sign up at [app.photon.codes][app]
 - **Node.js 18.17 or newer** on PATH (`node --version`)
 - A phone number that can receive iMessage (used to bind your account)
-
-That's it — there is no public URL or tunnel to set up.
+- A publicly reachable URL for the webhook receiver — Cloudflare
+  Tunnel, ngrok, or your own gateway hostname all work
 
 ## First-time setup
 
@@ -62,24 +58,17 @@ hermes gateway setup
 hermes photon setup --phone +15551234567
 ```
 
-The setup, in order:
+The setup:
 
-1. **Device login** (`client_id=photon-cli`) — opens
-   `https://app.photon.codes/` for approval and stores the bearer token.
-2. **Finds or creates** the `Hermes Agent` project on your account.
-3. **Enables Spectrum**, reads the project's Spectrum id, and rotates
-   the project secret.
-4. **Registers your phone number** as a Spectrum user — skipped if a
-   user with that number already exists, so re-running is safe.
-5. **Prints your assigned iMessage line** — the number you text to reach
-   your agent.
-6. **Runs `npm install`** inside the plugin's sidecar directory.
+1. Opens `https://app.photon.codes/` for device approval
+2. Creates a Spectrum-enabled project under your account
+3. Calls the Spectrum `create-user` endpoint with `type: shared` so
+   Photon allocates an iMessage line from the free pool
+4. Runs `npm install` inside the plugin's sidecar directory
 
-Runtime credentials are written to `~/.hermes/.env`
-(`PHOTON_PROJECT_ID` = the Spectrum project id, `PHOTON_PROJECT_SECRET`),
-the same place every other channel keeps its token. Management metadata
-(device token, dashboard project id) lives in `~/.hermes/auth.json` under
-`credential_pool.photon` / `credential_pool.photon_project`.
+Credentials are stored in `~/.hermes/auth.json` under
+`credential_pool.photon` (bearer token) and
+`credential_pool.photon_project` (project id + secret).
 
 ## Authorizing users
 
@@ -142,6 +131,26 @@ Both keys also accept env vars (`PHOTON_REQUIRE_MENTION`,
 `PHOTON_MENTION_PATTERNS`). This is the same mention-gating model the
 BlueBubbles iMessage channel uses.
 
+## Registering the webhook
+
+Photon needs a public URL it can POST to. Expose your local listener
+(default port 8788, path `/photon/webhook`) via Cloudflare Tunnel or
+ngrok, then:
+
+```bash
+hermes photon webhook register https://YOUR-PUBLIC-URL/photon/webhook
+```
+
+The response includes a `signingSecret` — **Photon only returns it
+once.** Save it to `~/.hermes/.env`:
+
+```bash
+PHOTON_WEBHOOK_SECRET=v0_64-char-hex...
+```
+
+The plugin verifies every inbound `POST` against this secret and
+rejects deliveries with a timestamp drift greater than 5 minutes.
+
 ## Start the gateway
 
 ```bash
@@ -151,7 +160,7 @@ hermes gateway start --platform photon
 You'll see something like:
 
 ```
-[photon] connected — sidecar on 127.0.0.1:8789, streaming inbound over gRPC
+[photon] connected — webhook at 0.0.0.0:8788/photon/webhook, sidecar on 127.0.0.1:8789
 ```
 
 Send an iMessage to your assigned number and Hermes will reply.
@@ -162,20 +171,15 @@ Send an iMessage to your assigned number and Hermes will reply.
 hermes photon status
 ```
 
-Prints saved credentials, sidecar health, your registered number, and the
-assigned iMessage line Hermes uses. When a Photon token and dashboard project
-are available, `status` refreshes missing number rows from the dashboard
-without provisioning new lines.
+Prints:
 
 ```
 Photon iMessage status
 ──────────────────────
   device token        : ✓ stored
-  dashboard project   : 3c90c3cc-0d44-4b50-...
-  spectrum project id : sp-...
-  project secret      : ✓ stored
-  my number           : +15551234567
-  assigned number     : +16282679185
+  project id          : 3c90c3cc-0d44-4b50-...
+  project key         : ✓ stored
+  webhook key         : ✓ set
   node binary         : /usr/bin/node
   sidecar deps        : ✓ installed
 ```
@@ -184,19 +188,27 @@ Common issues:
 
 - **`sidecar deps : ✗ run hermes photon install-sidecar`** — Node is
   installed but `spectrum-ts` isn't. Run the suggested command.
-- **`device token : ✗ missing`** — run `hermes photon setup` to log in.
-- **`No iMessage line assigned yet`** — Spectrum is enabled but no line
-  has been provisioned; re-run `hermes photon setup` or check the
-  [dashboard][app].
-- **Sidecar won't start** — confirm `node --version` is 18.17+ and that
-  `hermes photon install-sidecar` completed without errors.
+- **`webhook key : ⚠ unset — verification disabled`** — the
+  plugin will accept ANY POST to the webhook URL, which is unsafe.
+  Re-run `hermes photon webhook register` and store the secret.
+- **`PHOTON_WEBHOOK_PORT` already in use** — set a different port via
+  `~/.hermes/.env`.
+- **Webhook reachable from localhost but Photon can't deliver** —
+  Photon needs a public hostname. Cloudflare Tunnel is the easiest
+  free option.
+
+## Webhook management
+
+```bash
+hermes photon webhook list                  # show registered hooks
+hermes photon webhook delete <webhook-id>   # remove one
+```
 
 ## Limits today
 
-- **Inbound attachments are metadata-only.** Inbound events carry the
-  filename + MIME type; the agent sees a marker but can't yet read the
-  bytes. The SDK exposes attachment bytes via `content.read()`, so this
-  is a sidecar follow-up.
+- **Inbound attachments are metadata-only.** Inbound webhooks carry the
+  filename + MIME type but no download URL — Photon documents an
+  attachment retrieval endpoint as roadmap.
 - **Outbound attachments are supported.** Hermes sends images, voice
   notes, video, and documents through spectrum-ts' `attachment()` /
   `voice()` content builders via the sidecar's `/send-attachment`
@@ -210,19 +222,23 @@ Common issues:
 
 | Variable                  | Default            | Notes                                      |
 |---------------------------|--------------------|--------------------------------------------|
-| `PHOTON_PROJECT_ID`       | from `.env`        | Spectrum project id (the SDK's `projectId`); set by setup |
-| `PHOTON_PROJECT_SECRET`   | from `.env`        | Project secret; set by setup               |
-| `PHOTON_SIDECAR_PORT`     | `8789`             | Loopback port for the sidecar control + inbound channel |
+| `PHOTON_PROJECT_ID`       | from `auth.json`   | Set by `hermes photon setup`               |
+| `PHOTON_PROJECT_SECRET`   | from `auth.json`   | Set by `hermes photon setup`               |
+| `PHOTON_WEBHOOK_SECRET`   | (unset)            | From `hermes photon webhook register`      |
+| `PHOTON_WEBHOOK_PORT`     | `8788`             | Local port for the aiohttp listener        |
+| `PHOTON_WEBHOOK_PATH`     | `/photon/webhook`  | Path under which the listener mounts       |
+| `PHOTON_WEBHOOK_BIND`     | `0.0.0.0`          | Bind address for the listener              |
+| `PHOTON_SIDECAR_PORT`     | `8789`             | Loopback port for sidecar control          |
 | `PHOTON_SIDECAR_AUTOSTART`| `true`             | Whether the adapter spawns the sidecar     |
 | `PHOTON_NODE_BIN`         | `which node`       | Override the Node binary path              |
-| `PHOTON_HOME_CHANNEL`     | (unset)            | Default space id for cron / notifications  |
+| `PHOTON_HOME_CHANNEL`     | (unset)            | Default space ID for cron / notifications  |
 | `PHOTON_HOME_CHANNEL_NAME`| (unset)            | Human label for the home channel           |
 | `PHOTON_ALLOWED_USERS`    | (unset)            | Comma-separated E.164 allowlist            |
 | `PHOTON_ALLOW_ALL_USERS`  | `false`            | Dev only — accept any sender               |
 | `PHOTON_REQUIRE_MENTION`  | `false`            | Require a wake word before responding in groups |
 | `PHOTON_MENTION_PATTERNS` | Hermes wake words  | JSON list / comma / newline regex patterns for group mentions |
+| `PHOTON_API_HOST`         | `spectrum.photon.codes` | Override the Spectrum management API host |
 | `PHOTON_DASHBOARD_HOST`   | `app.photon.codes` | Override the dashboard / device-login host |
-| `PHOTON_SPECTRUM_HOST`    | `spectrum.photon.codes` | Override the Spectrum API host |
 
 [photon]: https://photon.codes/
 [app]: https://app.photon.codes/

website/docs/user-guide/messaging/simplex.md

@@ -54,11 +54,8 @@ SIMPLEX_HOME_CHANNEL=<contact-id>
 | `SIMPLEX_WS_URL` | Yes | WebSocket URL of the simplex-chat daemon |
 | `SIMPLEX_ALLOWED_USERS` | Recommended | Comma-separated allowlist. Each entry can be a numeric `contactId` **or** a display name — both forms work. |
 | `SIMPLEX_ALLOW_ALL_USERS` | Optional | Set `true` to allow every contact (use carefully) |
-| `SIMPLEX_AUTO_ACCEPT` | Optional | Auto-accept incoming contact requests (default: `true`) |
-| `SIMPLEX_GROUP_ALLOWED` | Optional | Comma-separated group IDs the bot participates in, or `*` for any group. Omit to ignore group messages entirely |
-| `SIMPLEX_HOME_CHANNEL` | Optional | Default contact/group ID for cron job delivery |
+| `SIMPLEX_HOME_CHANNEL` | Optional | Default contact ID for cron job delivery |
 | `SIMPLEX_HOME_CHANNEL_NAME` | Optional | Human label for the home channel |
-| `HERMES_SIMPLEX_TEXT_BATCH_DELAY` | Optional | Quiet-period seconds (default: `0.8`) used to concatenate rapid-fire inbound text messages into one event |
 
 ## Find your contact ID or display name
 
@@ -71,37 +68,6 @@ By default **all contacts are denied**. You must either:
 1. Set `SIMPLEX_ALLOWED_USERS` to a comma-separated list of `contactId`s and/or display names (e.g. `SIMPLEX_ALLOWED_USERS=4,alice` matches either contactId 4 or the contact whose display name is "alice"), or
 2. Use **DM pairing** — send any message to the bot and it will reply with a pairing code. Enter that code via `hermes pairing approve simplex <CODE>`.
 
-## Group chats
-
-By default the adapter ignores group messages — a bot in a group otherwise
-processes every member's traffic. Opt-in explicitly:
-
-```
-SIMPLEX_GROUP_ALLOWED=12,34          # specific group IDs
-# or
-SIMPLEX_GROUP_ALLOWED=*              # any group the bot is in
-```
-
-Address groups by prefixing the chat ID with `group:`, e.g.
-`simplex:group:12` in `send_message` or as a cron `deliver=` target.
-
-## Attachments
-
-The adapter supports native SimpleX attachments in both directions:
-
-- **Inbound** — incoming images, voice notes, and files are accepted via
-  the daemon's XFTP flow (`rcvFileDescrReady` → `/freceive` → wait for
-  `rcvFileComplete`) and surfaced as `MessageEvent.media_urls` with the
-  appropriate `MessageType` (`PHOTO`, `VOICE`, `TEXT` + document).
-- **Outbound** — `send_image_file`, `send_voice`, `send_document`, and
-  `send_video` all use the structured `/_send` form with `filePath`, so
-  the receiving SimpleX client renders images inline and plays voice
-  notes inline rather than offering them as downloads.
-
-Agent replies can also embed `MEDIA:/path/to/file` tags in plain text —
-the adapter strips the tag from the body and sends the file as either a
-voice note (audio extensions) or a document.
-
 ## Using SimpleX with cron jobs
 
 ```python

website/static/api/model-catalog.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "updated_at": "2026-06-09T05:57:24Z",
+  "updated_at": "2026-06-04T23:57:51Z",
   "metadata": {
     "source": "hermes-agent repo",
     "docs": "https://hermes-agent.nousresearch.com/docs/reference/model-catalog"
@@ -116,10 +116,6 @@
           "id": "openrouter/owl-alpha",
           "description": "free"
         },
-        {
-          "id": "poolside/laguna-m.1:free",
-          "description": "free"
-        },
         {
           "id": "tencent/hy3-preview:free",
           "description": "free"
@@ -128,10 +124,6 @@
           "id": "nvidia/nemotron-3-super-120b-a12b:free",
           "description": "free"
         },
-        {
-          "id": "nvidia/nemotron-3-ultra-550b-a55b:free",
-          "description": "free"
-        },
         {
           "id": "inclusionai/ring-2.6-1t:free",
           "description": "free"