RomanNum3ral
/
hermes-agent
mirror of https://github.com/NousResearch/hermes-agent.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
hermes-agent/hermes_cli
History
ethernet 25d0bcd424 fix(runtime): resolve Hermes-managed Node and uv before bare PATH 
Hermes installs runtimes for itself — `uv` at `$HERMES_HOME/bin/uv`, Node
at `$HERMES_HOME/node` — and neither directory is on an arbitrary
process's PATH. Every `shutil.which("node"/"npm"/"npx"/"uv")` in Hermes's
own code therefore has two failure modes: the managed runtime is invisible,
so the caller reports "not installed" or degrades to a slower tier on a
machine that has exactly what it needed; and when a system copy also
exists, the one Hermes does not own wins.

Routed the Hermes-owned call sites through managed-aware resolvers:

- `agent/lsp/install.py`, `hermes_cli/dep_ensure.py`, `hermes_cli/main.py`
  (`_make_tui_argv`), `hermes_cli/tools_config.py` (`_run_post_setup`) now
  use `find_node_executable()`.
- `hermes_cli/tools_config.py::_pip_install` and `hermes_cli/setup.py`'s
  vercel install use `ensure_uv()` (installing uv is in scope during setup,
  and the Windows installer's `uv venv` does not seed pip, so the fallback
  tier is "No module named pip"). `tools/lazy_deps.py` uses `resolve_uv()`
  — a lookup, not a bootstrap, because it runs mid-turn for an optional
  dependency and downloading a runtime as a side effect exceeds what the
  caller asked for.
- `hermes_cli/gateway.py`: extracted `_append_node_dir_for_service()`,
  shared by the systemd unit and launchd plist generators, which appends
  the managed dirs before the PATH-resolved one. A service definition is
  written once and survives reboots, so resolving a system Node that
  happens to lead the installing shell's PATH bakes the wrong interpreter
  in permanently. Managed dirs are profile-scoped, so each profile's unit
  still names its own Node; the existing symlink-parent rule (don't
  `.resolve()`) is preserved verbatim.
- `tools/environments/local.py`: the terminal tool's subshell PATH gains
  the managed dirs, appended alongside the sane entries rather than
  prepended — a tool the user deliberately put on their own PATH still
  wins, and the managed one only fills a gap. This is also what makes the
  bare `which("uv")` in `tools/env_probe.py` correct: that probe reports
  the environment the *model* sees, and the model can only run what is on
  that subshell's PATH.

`scripts/install.ps1`: the persisted User PATH update becomes
`Set-ManagedNodeFirstOnUserPath`, a move-to-front rather than an
add-if-missing. Installs made by an older install.ps1 already have the
managed dir in User PATH — at the tail, behind a system Node — and an
add-if-missing check sees it present and leaves that ordering in place
forever, so the users the bug hurt would never be repaired. Unrelated
entries keep their relative order (empty segments included; a trailing
`;` is legal and the installer's other PATH code preserves them),
duplicates collapse, and it writes only when the string actually changes.

Tests:

- `tests/test_managed_runtime_resolution.py` — AST guard that fails any
  new bare `which()` for a managed runtime, with a short justified
  allow-list and a companion test that fails when an allow-list entry goes
  stale. Reading source is banned by AGENTS.md and this is the documented
  exception: the property is "no call site anywhere spells it this way",
  which no runtime seam can observe.
- `scripts/ci/test_install_ps1_path_migration.ps1` — behavioral, not a
  source regex: it lifts the real `Set-ManagedNodeFirstOnUserPath` out of
  install.ps1's AST and rewrites only the two registry calls into an
  in-memory store, so the shipped split/dedupe/prepend/change-detection
  logic executes for real. Not in the default lane (Linux runners have no
  PowerShell host); runs under `pwsh`. 13/13 assertions pass.
 		2026-08-01 21:17:51 -04:00
..
dashboard_auth chore: remove unused imports and dead locals (ruff F401/F841 sweep) 2026-07-29 11:53:39 -07:00
observability perf(config): stop deepcopying config on per-turn read-only paths 2026-07-29 11:33:41 -07:00
proxy rip out brew + pip/PyPI wheel support (#68217) 2026-07-22 16:51:01 -04:00
subcommands fix(pairing): keep GUI approvals off the code brute-force lockout 2026-07-29 17:51:40 -05:00
web_routers fix(api): enforce pagination bounds on session/message list routes 2026-07-31 22:35:49 -07:00
__init__.py chore: release v0.19.1 (2026.7.30) 2026-07-30 16:45:08 -07:00
_early_recovery.py fix(update): test runs never mutate the live checkout — pytest-guard the marker and repair paths 2026-07-29 21:30:53 -07:00
_parser.py feat(kanban): let a task pin its own thinking depth 2026-08-01 16:09:56 -05:00
_scan_venv_blockers.py fix(desktop): use the canonical gateway matcher for the preflight exemption 2026-07-31 22:34:28 -07:00
_subprocess_compat.py fix(git): never block internal git calls on credential prompts 2026-07-28 17:34:21 -07:00
active_sessions.py fix(sessions): claim the cap slot on first turn, not on open 2026-07-28 12:11:52 -05:00
agent_import.py refactor: extract atomic_write_text to utils.py; fix write-failure error handling 2026-07-29 16:49:07 +05:30
approval_mode.py feat(approvals): add cross-surface mode command 2026-07-26 21:13:03 -07:00
approvals_suggest.py feat(approvals): hermes approvals suggest — mine approval history into allowlist proposals 2026-07-26 17:49:03 -07:00
auth.py fix(auth): a transient read failure is not corruption 2026-07-31 22:34:52 -07:00
auth_commands.py fix(auth): make xAI OAuth pools multi-account resilient 2026-07-17 11:37:25 +05:30
azure_detect.py fix(security): secure Azure catalog probes 2026-07-11 12:28:55 +05:30
backup.py fix(state): stop cancelling our own POSIX locks on live SQLite databases 2026-07-25 21:44:43 -07:00
bang_shell.py feat(cli): ! shell mode — run a command without spending a model turn 2026-07-31 21:21:20 -07:00
banner.py fix(cli): route keyless first run into provider onboarding instead of a broken chat 2026-08-01 15:34:16 -07:00
blueprint_cmd.py refactor(cron): rebrand Cron Recipes -> Automation Blueprints 2026-06-11 10:49:47 -07:00
browser_connect.py fix(windows): native Windows correctness for CLI, gateway status, banner, and WSL browser paths 2026-07-29 23:16:18 -07:00
build_info.py
…
bundles.py
…
callbacks.py feat(clarify): add multi-select (checkbox) support to clarify tool 2026-07-26 17:46:55 -07:00
checkpoints.py fix(checkpoints): bind an empty orphan preview to an empty deletion allowlist 2026-07-24 16:01:06 -07:00
claw.py fix: add explicit UTF-8 encoding to all subprocess text=True calls (#53428) 2026-07-24 11:45:57 -07:00
cli_agent_setup_mixin.py fix(cli): route keyless first run into provider onboarding instead of a broken chat 2026-08-01 15:34:16 -07:00
cli_billing_mixin.py chore: remove unused imports and dead locals (ruff F401/F841 sweep) 2026-07-29 11:53:39 -07:00
cli_commands_mixin.py fix(cli): dispatch /indicator to set the busy-indicator style (#50618) 2026-07-31 22:33:16 -07:00
cli_output.py
…
clipboard.py fix(cli): stop hard-wrapping streamed paragraphs; prefer OSC 52 over SSH 2026-07-29 08:42:16 -07:00
codex_models.py fix(codex): send ChatGPT-Account-Id on /models probes 2026-07-21 05:27:13 -07:00
codex_runtime_plugin_migration.py
…
codex_runtime_switch.py refactor(codex-runtime): tidy reapply-migration control flow 2026-07-01 23:51:54 +05:30
colors.py
…
commands.py fix(cli): dispatch /indicator to set the busy-indicator style (#50618) 2026-07-31 22:33:16 -07:00
completion.py
…
config.py fix(config): make get_env_value scope-aware — the last scope-blind credential reader 2026-08-01 16:42:51 -07:00
config_defaults.py feat(desktop): add configurable terminal font family (terminal.font_family in config.yaml) 2026-08-01 14:30:08 -07:00
config_migrations.py refactor: config auto-migration support floor at v12 + deprecated shim retirement 2026-07-29 16:44:31 -07:00
console_engine.py fix(sessions): keep kanban worker runs out of the session lists 2026-07-31 13:53:04 -05:00
container_boot.py fix(install): support non-pid-1 container entrypoints 2026-08-01 10:52:34 -07:00
context_switch_guard.py fix(cli): honor custom_providers in preflight shrink warning 2026-07-22 21:17:21 -07:00
copilot_auth.py fix(model-picker): stop Copilot token-exchange retry backoff from stalling /model open 2026-08-01 14:29:04 -07:00
credential_lifecycle.py fix(credentials): unified provider key delete/update across .env, auth.json, config.yaml (#67213) 2026-07-19 03:02:21 -07:00
cron.py feat(cron): user-owned model pins + cron.model fleet default 2026-07-28 11:52:47 -07:00
curator.py fix(curator): make the autonomous write policy consistent (#67140) 2026-07-25 19:27:17 -07:00
curses_ui.py fix(models): match bare Kimi Coding k3 when searching kimi 2026-07-26 21:22:40 -07:00
dashboard_procs.py refactor: extract dashboard process-hygiene helpers to dashboard_procs.py 2026-07-29 10:59:54 -07:00
dashboard_register.py fix(cli): correct stale `hermes auth login nous` hints to `hermes auth add nous` (#53929) 2026-06-27 21:30:37 -07:00
debug.py fix: remove dead f-string prefixes via ruff F541 (216 sites) (#52336) 2026-07-05 13:42:46 -07:00
default_soul.py fix(soul): installers seed the real default persona, upgrade legacy empty templates (#52246) 2026-06-24 18:56:26 -07:00
dep_ensure.py fix(runtime): resolve Hermes-managed Node and uv before bare PATH 2026-08-01 21:17:51 -04:00
diagnostics_upload.py feat(debug): drop dead confirm step from --nous upload (stateless NAS) 2026-06-30 17:29:23 -07:00
dingtalk_auth.py refactor(setup): route dependency installs through the canonical uv→pip→ensurepip ladder 2026-07-07 04:09:35 -07:00
doctor.py fix(cli): stabilize custom provider identities 2026-07-31 17:26:42 +05:30
dump.py Revert "remove Vercel AI Gateway and Vercel Sandbox (#33067)" 2026-07-29 19:48:37 -07:00
env_loader.py fix(env): narrow startup env scrub to profile-managed ACP keys 2026-08-01 16:42:51 -07:00
fallback_cmd.py refactor(fallback): single owner for backend identity and failure-scoped skips 2026-07-26 23:41:54 -07:00
fallback_config.py fix(auth): resolve fallback api keys through secret_scope, not raw env 2026-07-31 22:35:26 -07:00
focus_view.py feat(cli): /focus — reduced-output view with hidden-line recovery and status indicator 2026-07-26 18:10:34 -07:00
gateway.py fix(runtime): resolve Hermes-managed Node and uv before bare PATH 2026-08-01 21:17:51 -04:00
gateway_enroll.py chore: remove unused imports and dead locals (ruff F401/F841 sweep) 2026-07-29 11:53:39 -07:00
gateway_windows.py fix(update): migrate legacy pythonw Windows gateway launchers to the hidden-console design 2026-07-26 17:50:54 -07:00
goals.py fix(goals): auto-pause goal loop on consecutive transport failures 2026-07-20 05:38:25 -07:00
gui_uninstall.py
…
hooks.py Reapply "feat(observability): integrate NeMo Relay runtime and shared metrics" 2026-07-27 21:10:51 -07:00
init_command.py feat(cli): /init — generate or update AGENTS.md from a project scan 2026-07-26 17:46:29 -07:00
input_sanitize.py fix(input): strip bracketed-paste leaks before prompt persistence (#62557) 2026-07-15 07:39:42 -07:00
inventory.py feat(picker): derive a newest-per-lab featured shortlist from models.dev 2026-07-28 03:52:33 -05:00
journey.py fix(cli): render /journey color instead of leaking raw ANSI 2026-07-01 16:25:48 -05:00
kanban.py chore: remove unused imports and dead locals (ruff F401/F841 sweep) 2026-07-29 11:53:39 -07:00
kanban_db.py feat(kanban): let a task pin its own thinking depth 2026-08-01 16:09:56 -05:00
kanban_decompose.py fix(auxiliary): route direct-create aux callers through call_llm (#65029) 2026-07-15 07:39:17 -07:00
kanban_diagnostics.py fix(kanban): clear failure/crash diagnostics while a retry is in flight 2026-07-09 16:13:59 -05:00
kanban_specify.py fix(auxiliary): route direct-create aux callers through call_llm (#65029) 2026-07-15 07:39:17 -07:00
kanban_swarm.py refactor(kanban): fold worker/orchestrator skills into injected guidance (#50473) 2026-06-21 17:06:48 -07:00
lifecycle.py Reapply "feat(observability): integrate NeMo Relay runtime and shared metrics" 2026-07-27 21:10:51 -07:00
logs.py fix: remove dead f-string prefixes via ruff F541 (216 sites) (#52336) 2026-07-05 13:42:46 -07:00
main.py fix(runtime): resolve Hermes-managed Node and uv before bare PATH 2026-08-01 21:17:51 -04:00
managed_scope.py fix(managed-scope): honor managed scope in all standalone config loaders 2026-06-19 07:46:33 -07:00
managed_uv.py fix(update): let callers pass the platform verdict to the venv helpers 2026-08-01 16:45:00 +05:30
mcp_catalog.py fix(git): never block internal git calls on credential prompts 2026-07-28 17:34:21 -07:00
mcp_config.py fix(mcp): make Figma remote OAuth work via DCR allowlist defaults 2026-07-28 00:53:16 -05:00
mcp_picker.py
…
mcp_security.py fix(security): close hermes-0day MCP-persistence attack surface 2026-06-21 19:05:27 -07:00
mcp_startup.py fix(mcp): ensure MCP discovery completes before agent build in non-interactive sessions 2026-08-01 12:27:31 +05:30
memory_oauth.py feat(memory): Honcho OAuth connect — desktop and CLI flows + token refresh (#44335) 2026-06-22 19:16:47 -05:00
memory_setup.py fix: route memory-provider dep installs through lazy_deps durable target 2026-07-28 22:40:33 -07:00
middleware.py chore: remove unused imports and dead locals (ruff F401/F841 sweep) 2026-07-29 11:53:39 -07:00
migrate.py
…
moa_cmd.py feat(moa): add reference model toggles 2026-07-23 18:11:57 -07:00
moa_config.py feat(moa): default advisor fanout to user_turn — the cheapest cadence 2026-07-23 21:07:18 -07:00
model_catalog.py perf(model-picker): serve stale model caches instantly, refresh in background 2026-08-01 14:52:18 -07:00
model_cost_guard.py
…
model_normalize.py Revert "remove Vercel AI Gateway and Vercel Sandbox (#33067)" 2026-07-29 19:48:37 -07:00
model_search.py fix(picker): fold live bare k3 wire id into curated kimi-k3 row 2026-07-26 21:22:40 -07:00
model_setup_flows.py fix(cli): stabilize custom provider identities 2026-07-31 17:26:42 +05:30
model_switch.py fix(gateway): offload /model context-length resolution off the event loop 2026-07-31 22:39:34 -07:00
models.py perf(model-picker): serve stale model caches instantly, refresh in background 2026-08-01 14:52:18 -07:00
nous_account.py feat(billing): /credits command — balance + portal top-up handoff (#44776) 2026-06-12 08:51:10 +00:00
nous_auth_keepalive.py fix Nous auth refresh for idle agents 2026-06-21 22:43:48 -07:00
nous_billing.py refactor: single shared Retry-After parser 2026-07-29 10:13:50 -07:00
nous_subscription.py chore: remove unused imports and dead locals (ruff F401/F841 sweep) 2026-07-29 11:53:39 -07:00
npm_engine.py fix(update): provision a managed Node runtime when system npm fails engines.npm 2026-08-01 16:40:50 -07:00
onepassword_secrets_cli.py refactor: single build_subprocess_env() factory for all child-process spawns (profile + secret-scrub single owner) 2026-07-29 10:14:11 -07:00
oneshot.py fix(mcp): ensure MCP discovery completes before agent build in non-interactive sessions 2026-08-01 12:27:31 +05:30
pairing.py fix(pairing): keep GUI approvals off the code brute-force lockout 2026-07-29 17:51:40 -05:00
partial_compress.py feat(commands): /compact alias + --preview/--dry-run flags for /compress (#3243 salvage) 2026-07-02 05:10:31 -07:00
pets.py feat(pets): generation RPCs, non-blocking gallery + gateway plumbing 2026-06-24 13:48:38 -05:00
platforms.py
…
plugins.py Reapply "feat(observability): integrate NeMo Relay runtime and shared metrics" 2026-07-27 21:10:51 -07:00
plugins_cmd.py fix(git): never block internal git calls on credential prompts 2026-07-28 17:34:21 -07:00
portal_cli.py fix(auth): use refresh-free Nous status snapshot on read-only display paths 2026-07-28 22:42:19 -07:00
profile_describer.py fix(auxiliary): route direct-create aux callers through call_llm (#65029) 2026-07-15 07:39:17 -07:00
profile_distribution.py fix(distribution): path-aware allowlist; preserve legacy copy-everything when omitted 2026-07-31 22:39:34 -07:00
profiles.py refactor: canonical config loaders for behavioral reads + guarded raw-read primitive (kills the managed-scope/env-expansion drift class) 2026-07-29 10:53:29 -07:00
projects_cmd.py feat(projects): add per-profile project store 2026-06-25 16:40:26 -05:00
projects_db.py feat(desktop): configure repository discovery (supersedes #67630) (#68642) 2026-07-21 10:09:31 -04:00
prompt_size.py fix(prompt-size): include names-only skills in breakdown 2026-07-26 18:06:21 -07:00
prompt_stash.py feat(cli): complete the Ctrl+S prompt stash — keybinding, state machine, tests 2026-07-31 21:21:16 -07:00
provider_catalog.py feat(moa): expose MoA presets as selectable virtual models (#46081) 2026-06-25 13:52:06 -07:00
providers.py refactor(providers): delegate is_official_openai_host to base_url_host_matches 2026-07-31 21:31:56 -07:00
proxy_cli.py chore: remove unused imports and dead locals (ruff F401/F841 sweep) 2026-07-29 11:53:39 -07:00
psutil_android.py
…
pt_input_extras.py fix(cli): route Cmd+Backspace and Cmd+ForwardDelete to the kill bindings 2026-07-30 03:39:26 -05:00
pty_bridge.py refactor: single build_subprocess_env() factory for all child-process spawns (profile + secret-scrub single owner) 2026-07-29 10:14:11 -07:00
pty_session.py feat(pty): periodic reaper wired into dashboard lifespan 2026-07-07 15:15:37 -07:00
relaunch.py revert(windows): roll back terminal-popup PRs #53791 #53810 #53829 (#53853) 2026-06-27 15:59:00 -07:00
route_identity.py refactor: fold simplify-code review findings 2026-07-29 17:13:48 +05:30
runtime_provider.py fix(cli): heal a bare custom provider to its config key, not its display name 2026-07-31 22:36:15 -07:00
secret_prompt.py feat(memory): improve OpenViking setup UX 2026-06-17 01:04:26 +08:00
secrets_cli.py refactor: single build_subprocess_env() factory for all child-process spawns (profile + secret-scrub single owner) 2026-07-29 10:14:11 -07:00
security_advisories.py
…
security_audit.py fix(security): cache OSV malware preflight verdicts and stop double component discovery (#75485) 2026-08-01 10:47:20 -07:00
security_audit_startup.py chore: remove unused imports and dead locals (ruff F401/F841 sweep) 2026-07-29 11:53:39 -07:00
send_cmd.py refactor: canonical config loaders for behavioral reads + guarded raw-read primitive (kills the managed-scope/env-expansion drift class) 2026-07-29 10:53:29 -07:00
service_manager.py fix(hermes_cli): drop privileges before clearing s6-log lock 2026-07-27 19:19:01 +05:30
session_export.py feat: add prompt-only session export 2026-07-07 13:29:58 -07:00
session_export_html.py chore: remove unused imports and dead locals (ruff F401/F841 sweep) 2026-07-29 11:53:39 -07:00
session_export_md.py feat(sessions): full prune-filter set + --redact on sessions export 2026-07-07 12:36:41 -07:00
session_filters.py fix(sessions): preserve recently active sessions during pruning 2026-07-26 19:30:21 -07:00
session_listing.py fix(gateway): scope session lists before limiting 2026-07-31 22:36:55 -07:00
session_recap.py fix(cli): sanitize terminal escapes when replaying stored history (/resume recap, /status recap) 2026-07-17 04:53:38 -07:00
session_recovery.py fix(sessions): verify fully reconstructed recovery 2026-07-26 23:34:29 -07:00
sessions_cmd.py refactor: hoist cmd_sessions out of main() into sessions_cmd.py 2026-07-29 10:59:54 -07:00
setup.py fix(runtime): resolve Hermes-managed Node and uv before bare PATH 2026-08-01 21:17:51 -04:00
setup_hidden_env.py fix(setup): stop asking about self-configuring platform knobs 2026-07-26 08:43:24 -07:00
setup_whatsapp_cloud.py
…
skills_config.py fix(cli): normalize malformed skills config in get_disabled_skills (#61797) 2026-07-09 19:57:54 -07:00
skills_hub.py refactor: remove the claude-marketplace skill source (redundant Marketplace hub tab) 2026-07-28 23:16:27 -07:00
skin_cmd.py feat(themes): `hermes skin set` — deterministic one-color tweak, bg untouched 2026-07-21 21:00:43 -05:00
skin_engine.py feat(themes): dedicated code-syntax palette keys 2026-07-21 21:00:43 -05:00
slack_cli.py fix: route stray HERMES_HOME hardcodes through get_hermes_home() (profile + native-Windows safety) 2026-07-29 09:33:48 -07:00
slash_exec.py refactor: registry-owned execute() on CommandDef — informational commands unified (thin slice) 2026-07-29 12:11:24 -07:00
sqlite_runtime.py fix(runtime): repair vulnerable managed SQLite builds (E-949) 2026-07-24 16:00:03 -07:00
sqlite_safe_read.py fix(cli): untrack sqlite connections only after close succeeds 2026-07-31 23:18:12 -07:00
sqlite_util.py feat(projects): add per-profile project store 2026-06-25 16:40:26 -05:00
status.py modernize re-added Vercel integrations: SDK 0.7.2, telemetry off, sibling-site wiring 2026-07-29 19:48:37 -07:00
stdio.py
…
suggestions_cmd.py fix: remove dead f-string prefixes via ruff F541 (216 sites) (#52336) 2026-07-05 13:42:46 -07:00
telegram_managed_bot.py
…
timeouts.py
…
tips.py feat: raise default tool-calling iteration limit from 90 to 500 2026-07-26 12:54:45 -07:00
tools_config.py fix(runtime): resolve Hermes-managed Node and uv before bare PATH 2026-08-01 21:17:51 -04:00
toolset_validation.py chore: remove unused imports and dead locals (ruff F401/F841 sweep) 2026-07-29 11:53:39 -07:00
uninstall.py fix(install): expose hermes-agent and hermes-acp launchers on PATH 2026-07-31 22:39:11 -07:00
update_cmd.py fix(update): detect EOL-only churn via numstat, not name-only 2026-08-01 14:52:45 -07:00
update_lock.py fix(update): make the ancestor-PID lock handoff cross-platform via psutil 2026-07-31 22:28:46 -07:00
urllib_security.py fix(security): order sanitizer after installed hooks 2026-07-11 12:28:55 +05:30
vercel_auth.py Revert "remove Vercel AI Gateway and Vercel Sandbox (#33067)" 2026-07-29 19:48:37 -07:00
voice.py fix(voice): spoken barge-in works on every TTS playback path (CLI + gateway/desktop backends) 2026-07-29 08:24:00 -07:00
web_deps.py refactor(web): extract sessions/mcp/skills/tools routes to APIRouter modules (wave 2; route-table equality verified) 2026-07-29 16:21:54 -07:00
web_git.py fix(git): never block internal git calls on credential prompts 2026-07-28 17:34:21 -07:00
web_models.py fix(pairing): scope the approve/revoke endpoints to a profile 2026-07-29 18:43:50 -05:00
web_server.py Merge remote-tracking branch 'origin/main' into fix-73914-atomic-cancel 2026-07-31 03:35:08 -03:00
webhook.py fix: repair sweep fallout — duplicate encoding kwargs, non-subprocess call sites, kwarg-snapshot tests 2026-07-24 11:45:57 -07:00
win_pty_bridge.py refactor: single build_subprocess_env() factory for all child-process spawns (profile + secret-scrub single owner) 2026-07-29 10:14:11 -07:00
windows_ssh_runtime.py fix(desktop): keep Windows SSH runtime at machine root 2026-08-01 14:30:16 -07:00
write_approval_commands.py
…
xai_retirement.py fix(config): guard xai migration writer + drop gratuitous annotation 2026-07-05 23:00:34 +05:30