Add an opt-in browser PKCE login for Codex

hermes auth add openai-codex only knew the device-code grant, which some organizations disable. --browser (or auth.codex_login_flow: browser) now runs authorization-code + PKCE on the registered loopback localhost:1455 and stores a manual:loopback_pkce credential. Device code stays the default, and a busy port falls back to it instead of failing.

Serialise list/dict terminal config as JSON so docker volumes survive multiplexing

Under gateway multiplexing, a routed profile’s terminal.docker_volumes / docker_env / docker_forward_env / docker_extra_args never reached the container — the per-turn scope sent Python repr text that json.loads rejected, dropping the whole setting. The scope now carries those values as JSON, so they survive into the container.

Refuse SessionDB open and writes on a deleted WAL generation

A live writer can keep an open fd to an already-unlinked state.db-wal, while a later SessionDB open mints a fresh WAL at the same path — two generations that cannot see each other, which is the intermittent database disk image is malformed report. Writable open now refuses before sqlite3.connect if a deleted WAL/SHM holder exists, and the write path halts if that sidecar identity is gone.

Switch model after refresh when it leaves the catalog

After Refresh Models, the desktop composer could keep showing a model that had left the catalog. Refresh now reconciles: if the current pick is still listed it stays; if not, the session switches to the first selectable model — never wiping on an empty or failed refresh.

Adopt live compression config on the next Desktop/TUI turn

A running Desktop/TUI session kept the compression threshold from agent creation, so hermes config set compression.* updated config.yaml but the next turn still used the old trigger. Now compares the same cache-busting signature at turn start and applies live compression settings in place — no restart, reset, or new chat.

Accept marker-only finish_reason chunks after stream supersession

A concurrent turn or retry could supersede the stream writer just before the provider’s empty terminal chunk, so a finished response was fenced, logged as a mid-stream drop, and retried. Marker-only finish_reason chunks now pass the fence; content, tool-call, and reasoning deltas stay gated. A stream that never sends finish_reason is still treated as a drop.

Keep the dashboard-auth provider registry across plugin-manager unloads

A routine per-home plugin-manager unload disposed the process-global dashboard-auth provider, emptying the registry: sign-in died with 503 until restart. Providers now register as persistent host-owned entries that survive per-home teardown, so a re-discovery can rotate them in place without disabling auth.

Append SSE [DONE] when Nous streams omit the sentinel

Some Nous Portal free-model streams (LongCat, Solar) finish with a valid finish_reason but close without OpenAI’s terminal data: [DONE], so strict clients treat a complete response as truncated. hermes proxy now appends a single [DONE] after a clean EOF when the stream already terminated — never duplicating an upstream sentinel.

Fail loudly when state.db is replaced under a live process

When state.db is swapped out-of-band (a cp/restore/mv onto the same path), SessionDB mistook the generation mismatch for FTS damage and ran a fail-open repair that cannot fix it — a long persistence outage in production. Now records the file’s identity plus a generation stamp, re-checks before any repair, and on mismatch logs FATAL and refuses the in-place rebuild.

Map lineage edit ordinals past the compression prefix

Translates a full-lineage edit ordinal into a tip-relative segment_ordinal so editing a turn after context compression stops failing with 4018 — target user message is no longer in session history.

Scrub lone surrogates before the oneshot stdout write

Sanitizes assistant text through _sanitize_surrogates before hermes --oneshot writes to UTF-8 stdout, so a lone UTF-16 surrogate becomes U+FFFD and the answer prints and exits 0 instead of crashing with UnicodeEncodeError.

Name the missing privileged intents and stop the reconnect loop

Detects Discord's PrivilegedIntentsRequired on connect and logs an actionable fatal naming the exact intents Hermes requests, ending the endless reconnect loop for what is really a Developer Portal config problem.

Omit unsupported metadata on Relay scope.pop

Fixes a Gateway finalization crash where older NeMo Relay bindings rejected the metadata kwarg, leaving scopes unclosed and stalling the event loop with repeated relay-finalization failures.

Bound the stdio initialize handshake to stop a subprocess/FD leak

Bounds the stdio-MCP initialize handshake to stop an unbounded subprocess and file-descriptor leak that ended in EMFILE when a server never completed initialize.