fix(hermes): enable model and reasoning controls

[nicolasdmolina]

This is a stacked follow-up to #4678. It targets experiment/hermes-provider-ui, not main, so the work can be reviewed or folded into the existing Hermes PR without creating a competing implementation.

What Changed

• Add a protocol v5 catalog exchange for authenticated, provider-qualified Hermes models and reasoning capabilities.
• Discover catalogs asynchronously per connection generation, use collision-safe request IDs, retain the last good catalog during reconnects, and terminate stale driver streams after instance rebuilds.
• Apply selected models and explicitly chosen reasoning effort at the Hermes turn boundary, then verify the applied configuration in turn.started.
• Make model/reasoning configuration transactional across Hermes memory, persistent session state, database metadata, pending notes, and cached agents. Failed or cancelled starts restore the prior state.
• Keep Hermes's per-model/global reasoning defaults untouched until the user explicitly chooses an override.
• Let bound Hermes Home/agent composers open the model picker when their connected instance reports real choices; single-model instances remain a static label.

Why

#4678 establishes the Hermes gateway and agent UX, but the connected instance is still exposed as one opaque hermes model and the bound composer cannot change model or reasoning. Hermes already has authenticated model inventory and session-scoped /model and /reasoning surfaces, so T3 can expose those choices without owning provider credentials or bypassing Hermes's runtime resolution.

The transaction and lifecycle guards are necessary because a rejected turn must not leave a persisted half-switch behind, and a reconnect/rebuild must not erase a valid catalog or allow an old driver stream to overwrite its replacement.

UI Changes

• Before: bound Hermes composers always showed a static Hermes model label.
• After: the same composer shows the normal model picker when the connected Hermes instance reports multiple models, plus a reasoning selector for capable models.

Screenshots are still pending while this PR is in draft.

Verification

• 185 targeted TypeScript tests passed across server, web, and contracts.
• 187 Hermes gateway Python tests passed.
• Typechecks passed for server, web, contracts, and desktop.
• Repository lint and formatting checks passed.
• Ruff, Python compilation, and git diff --check passed.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• Video is not applicable; there are no animation changes

Note

Enable per-session model and reasoning controls in the Hermes gateway adapter

• Bumps the Hermes gateway wire protocol to v5, adding models.list.request/models.list.response messages and optional modelSelection/reasoningEffort fields on turn.start and turn.started.
• HermesAdapter now applies model and reasoning selections only at fresh turn boundaries via Hermes session-scoped /model and /reasoning commands, verifies Hermes acknowledges the applied selections in turn.started, and compensates with turn.interrupt if they don't match.
• HermesDriver performs asynchronous, generation-scoped model catalog discovery without blocking snapshot reads; requiresNewThreadForModelChange is now false.
• ProviderRegistry.mergeProviderModels retains the previous Hermes model catalog across pending or exhausted discovery snapshots, replacing it only on a completed catalog response.
• The composer model picker renders as a static label only when the composer is bound and the selected instance has no model choices; otherwise it remains interactive.
• Risk: sessionModelSwitch capability changes from "unsupported" to "in-session" for all Hermes sessions; clients that inspect this field will see changed behavior.

📊 Macroscope summarized a5c57be. 13 files reviewed, 0 issues evaluated, 0 issues filtered, 0 comments posted

🗂️ Filtered Issues

No issues evaluated.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 12d85683-d842-4cde-b61a-4dfd05b41d49

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

🟠 High hermes-t3-gateway/adapter.py:1529

restore_prior_memory_configuration unconditionally writes the entire runner-wide runner._reasoning_config from this turn's snapshot on rollback. When another thread's turn successfully changes _reasoning_config while this transaction is suspended (at an await dispatch(...)), a subsequent failure in this turn overwrites that concurrent update with a stale snapshot, silently rolling back another session's reasoning configuration. Consider serializing restoration with configuration dispatch or limiting rollback to session-scoped state.

🤖 Copy this AI Prompt to have your agent fix this:

In file @integrations/hermes-t3-gateway/adapter.py around line 1529:

`restore_prior_memory_configuration` unconditionally writes the entire runner-wide `runner._reasoning_config` from this turn's snapshot on rollback. When another thread's turn successfully changes `_reasoning_config` while this transaction is suspended (at an `await dispatch(...)`), a subsequent failure in this turn overwrites that concurrent update with a stale snapshot, silently rolling back another session's reasoning configuration. Consider serializing restoration with configuration dispatch or limiting rollback to session-scoped state.