From 2000278874040f65959a99e9d850a8d59916d4af Mon Sep 17 00:00:00 2001
From: kshitij <82637225+kshitijk4poor@users.noreply.github.com>
Date: Mon, 3 Aug 2026 18:24:46 +0530
Subject: [PATCH] fix(clamps): raise profile fan-out limit to le=500
 (simplify-pass finding)

le=100 would 422 real desktop callers: sessions-settings fetches
archived at limit=200, the command palette lists at 200, and the
electron remote-merge over-fetches limit+offset (exceeds 100 at
offset>=81, and its .catch(()=>null) silently drops remote sessions).
Clamp must sit above real client maxima. New test pins limit=200 w/
offset.
---
 hermes_cli/web_routers/profiles.py              | 9 ++++++---
 tests/hermes_cli/test_dashboard_param_clamps.py | 7 +++++++
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/hermes_cli/web_routers/profiles.py b/hermes_cli/web_routers/profiles.py
index 13aea9fbcf01c..d7bc45c2d8130 100644
--- a/hermes_cli/web_routers/profiles.py
+++ b/hermes_cli/web_routers/profiles.py
@@ -56,10 +56,13 @@ _write_profile_model = late("_write_profile_model")
 
 @sessions_router.get("/api/profiles/sessions")
 def get_profiles_sessions(
-    # ``le=100`` caps the per-request page size (idea from #39200) — this
+    # ``le=500`` caps the per-request page size (idea from #39200) — this
     # endpoint fans the query out across EVERY profile's state.db, so an
-    # unbounded limit multiplies the damage.
-    limit: int = Query(20, ge=0, le=100),
+    # unbounded limit multiplies the damage. 500 (not 100) because real
+    # desktop callers use limit=200 (sessions-settings ARCHIVED_FETCH_LIMIT,
+    # command palette) and the electron remote-merge over-fetches
+    # ``limit + offset``.
+    limit: int = Query(20, ge=0, le=500),
     offset: int = Query(0, ge=0),
     min_messages: int = 0,
     archived: str = "exclude",
diff --git a/tests/hermes_cli/test_dashboard_param_clamps.py b/tests/hermes_cli/test_dashboard_param_clamps.py
index 74c27f6ad4357..96c9dfb9be8a9 100644
--- a/tests/hermes_cli/test_dashboard_param_clamps.py
+++ b/tests/hermes_cli/test_dashboard_param_clamps.py
@@ -39,6 +39,13 @@ class TestSessionPaginationClamps:
         r = client.get("/api/profiles/sessions", params={"limit": 10_000})
         assert r.status_code == 422
 
+    def test_profile_fanout_accepts_real_desktop_maximum(self, client):
+        # Desktop callers use limit=200 (ARCHIVED_FETCH_LIMIT, command
+        # palette) and electron over-fetches limit+offset — the clamp must
+        # sit ABOVE real client maxima, not break them.
+        r = client.get("/api/profiles/sessions", params={"limit": 200, "offset": 120})
+        assert r.status_code == 200
+
     def test_in_range_limit_accepted(self, client):
         r = client.get("/api/sessions", params={"limit": 50})
         assert r.status_code == 200