fix: consolidate verified workspace issue sweep (#432)

* fix(start): use server-entry wrapper for production

* fix(swarm): reconcile oneshot checkpoints and ignore phantom blockers

* fix(profiles): sync editable descriptions from profile config

* fix: show cron jobs across Hermes profiles

* fix(capabilities): clarify dashboard-backed API detection

* feat: make Conductor use native Swarm fallback

Treat Workspace-native Swarm as the official Conductor fallback when the dashboard mission API is unavailable. Preserve dashboard-first dispatch, native status/cancel handling, provider-neutral setup docs, and regression coverage for gateway capability detection, swarm health, roster/profile handling, and native Conductor responses.

* fix(usage-meter): reposition menu trigger for better alignment

- Adjusted the position of the menu trigger in the usage meter component to enhance layout consistency and user experience.

fix(chat-panel): adjust position of chat panel toggle button

- Updated the positioning of the chat panel toggle button to improve visibility and accessibility by changing its bottom and right offsets.

* fix(stt): wire Groq/OpenAI voice transcription into chat

* Fix Workspace Kanban loopback dashboard link

* fix(update): do not open historical release notes on startup

* fix(chat): clear stale thinking runs reliably

* fix(dashboard): trust sessions endpoint for status

* fix(settings): address review — local default, OAuth lifecycle, validation

* fix(dashboard): always scrape live session token from HTML

* fix(chat): avoid portable history replay on bound sessions

* fix(settings): remove dead smart routing controls

* fix(tasks-api): guard against HTML catch-all in probeBackend

The /api/hermes-tasks route was renamed to /api/claude-tasks in commit
efcb7d14, but the probe logic still listed the old route as a candidate.
When probed, the SPA catch-all returned a 200 HTML response instead of
a 404, so probeBackend() treated it as a valid (empty) backend and then
failed when the actual task fetch threw.

Fixes:
- probeBackend() now checks Content-Type: application/json and returns
  -1 for non-JSON responses, so future route renames degrade gracefully.
- resolveBackend() now only selects hermes if hermesCount > 0, defaulting
  to claude-tasks (the active backend post rename) when hermes is absent.

* fix(terminal): default cwd to ~ and fallback if path missing

PTY helper chdir fails when ~/.hermes is absent (common in Docker).
Default shell cwd to home; server falls back to HOME if cwd does not exist.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(settings): satisfy lint on custom providers UI

* fix(docker): add -m flag to useradd so workspace home dir is created

Without -m, the system account has no /home/workspace directory.
The auth middleware tries to write the session store at
/home/workspace/.hermes/workspace-sessions.json; mkdirSync fails with
EACCES because /home/ is root-owned (755), causing the 'Failed to
persist session store' warning and a 500 on every authenticated route.

Adding -m causes useradd to create and chown /home/workspace correctly
so the session store can be written on first login.

* fix(tasks): preserve real session links and restore task launch flow

* fix(launchd): install macOS plist from server-entry template

* fix(docker): expose dashboard API and persist workspace volumes

* fix(jobs): serialize deliver targets for cron API

* Make Hermes Workspace installable as PWA

* chore(deps): pin direct tanstack versions

* feat: align semantic Hermes swarm agents

Add semantic swarm roster metadata, profile/tool/skill docs, shared semantic worker ID validation, focused roster regression coverage, and one-shot checkpoint capture for dispatch smoke tests.

* fix(conductor): pass through sessionKeyPrefix from portable spawn result

sessionKeyPrefix was hardcoded to null in conductor-spawn.ts, breaking
async session resolution when the dashboard backend returns a prefix.
Now mirrors the sessionKey pattern and passes through the value from
the spawn result.

Co-authored-by: Hermes Agent

* feat(swarm): bridge workspace kanban to native Hermes

* fix(chat): keep portable main pinned without breaking resolved sessions

* Add Windows startup script for Hermes Workspace

Document PowerShell usage for launching and restarting gateway + workspace via WSL tmux.

Co-Authored-By: Oz <oz-agent@warp.dev>

* fix(config): name Hermes Agent in restart notice

* fix(swarm): reconcile aggregate semantic worker exports

---------

Co-authored-by: Aurora release bot <release@outsourc-e.com>
Co-authored-by: motoki takahashi <motokitakahashi@motokinoMac-mini.local>
Co-authored-by: Vicky Wonder <vicky@openclaw.ai>
Co-authored-by: Vitaliy Isikov <visikov+supagoku@gmail.com>
Co-authored-by: Hermes Agent <hermes-agent@local>
Co-authored-by: Nikolay Mohr <nikomohr96@gmail.com>
Co-authored-by: Niko Mohr <niko@friendsfromcollege.de>
Co-authored-by: wtchronos <262830926+wtchronos@users.noreply.github.com>
Co-authored-by: Dak0verflow <dakotaferris@gmail.com>
Co-authored-by: norema <mamadou.marone.19@gmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: daoyuan <ludaoyuan1989@gmail.com>
Co-authored-by: firemountain <firemountain@gmail.com>
Co-authored-by: RAZSOC Local <razsoc@local>
Co-authored-by: Waylon Kenning <waylonkenning@Waylons-MacBook-Pro.local>
Co-authored-by: Kublai <kublai@kublai.local>
Co-authored-by: justa <justa@local>
Co-authored-by: Oz <oz-agent@warp.dev>

install.sh

@@ -213,6 +213,47 @@ if [[ -d "$INSTALL_DIR/skills" ]]; then
   done
 fi
 
+# ─── macOS LaunchAgent (plist) ───────────────────────────────────────────
+# Best-effort convenience for local macOS installs. This keeps the source of
+# truth in-repo and makes sure launchd runs server-entry.js (the thin HTTP
+# wrapper), not dist/server/server.js directly.
+
+if [[ "$(uname -s)" == "Darwin" ]]; then
+  cyan "→ Installing macOS LaunchAgent (com.hermes.workspace)…"
+
+  PLIST_TEMPLATE="$INSTALL_DIR/macos/com.hermes.workspace.plist.template"
+  PLIST_DEST="$HOME/Library/LaunchAgents/com.hermes.workspace.plist"
+  mkdir -p "$HOME/Library/LaunchAgents"
+
+  NODE_BIN="$(command -v node)"
+  HERMES_PORT="${PORT:-3000}"
+  HERMES_API_GATEWAY="http://127.0.0.1:${GATEWAY_PORT}"
+  TOKEN=""
+
+  if [[ -f "$HOME/.hermes/.env" ]]; then
+    TOKEN="$(grep -E '^(HERMES_API_TOKEN|CLAUDE_API_TOKEN)=' "$HOME/.hermes/.env" | head -1 | cut -d= -f2- | tr -d '"' || true)"
+  fi
+  if [[ -z "$TOKEN" && -f "$INSTALL_DIR/.env" ]]; then
+    TOKEN="$(grep -E '^(HERMES_API_TOKEN|CLAUDE_API_TOKEN)=' "$INSTALL_DIR/.env" | head -1 | cut -d= -f2- | tr -d '"' || true)"
+  fi
+
+  sed \
+    -e "s|{{NODE_BIN}}|${NODE_BIN}|g" \
+    -e "s|{{INSTALL_DIR}}|${INSTALL_DIR}|g" \
+    -e "s|{{PORT}}|${HERMES_PORT}|g" \
+    -e "s|{{HERMES_API_URL}}|${HERMES_API_GATEWAY}|g" \
+    -e "s|{{HERMES_API_TOKEN}}|${TOKEN}|g" \
+    "$PLIST_TEMPLATE" > "$PLIST_DEST"
+
+  launchctl unload "$PLIST_DEST" 2>/dev/null || true
+  if launchctl load -w "$PLIST_DEST" 2>/dev/null; then
+    green "  LaunchAgent loaded ✓ (com.hermes.workspace)"
+  else
+    yellow "  Could not load LaunchAgent now — it will still be available for next login."
+  fi
+  green "  Plist installed: $PLIST_DEST ✓"
+fi
+
 # ─── done ─────────────────────────────────────────────────────────────────
 
 bold ""