@inline-chat/hermes-agent-adapter 1.0.0 → 1.1.0

package/plugin/inline/adapter.py

@@ -9,6 +9,7 @@ from __future__ import annotations
 import asyncio
 import base64
 import hashlib
+import inspect
 import json
 import logging
 import math
@@ -22,6 +23,7 @@ import signal
 import socket
 import subprocess
 import sys
+import threading
 import time
 from collections import OrderedDict
 from datetime import datetime, timezone
@@ -52,11 +54,14 @@ from .message_actions import (
     build_inline_agent_action_input,
     build_inline_agent_action_turn_id,
     build_inline_system_action_id,
+    inline_message_widget_ids,
+    inline_widget_call,
     parse_inline_agent_action_reply_target,
     resolve_inline_message_action_ownership,
 )
 from .profile import bot_state_key, inline_env, legacy_state_dir, may_adopt_legacy_state, state_dir
 from .telemetry import capture_plugin_error
+from .widgets import has_widget_markup, scan_widgets, split_widget_aware, streaming_preview, without_widgets
 
 logger = logging.getLogger(__name__)
 
@@ -64,6 +69,7 @@ _DEFAULT_SIDECAR_PORT = 8794
 _ACTION_EDIT_RETRY_DELAY_SECONDS = 0.5
 _DEFAULT_SIDECAR_BIND = "127.0.0.1"
 _MAX_MESSAGE_LENGTH = 4000
+_APPROVAL_CHOICES = frozenset({"once", "session", "always", "deny"})
 _MODEL_PAGE_SIZE = 8
 _CHOICE_PICKER_MAX_CHOICES = 16
 _CHOICE_PICKER_TTL_SECONDS = 2 * 60
@@ -168,6 +174,29 @@ _INLINE_ENTITY_TYPE_NAMES = {
     14: "group_mention",
 }
 
+_APPROVAL_COMMAND_LIMIT = 2000
+_APPROVAL_FENCE_PATTERN = re.compile(r"(`{3,})[^\n]*\n(.*?)\n\1", re.DOTALL)
+# Same headings as OpenClaw's Inline, Slack and Discord approval cards.
+_APPROVAL_DECISION_HEADINGS = {
+    "once": "✅ Allowed once",
+    "session": "✅ Allowed for this session",
+    "always": "✅ Always allowed",
+    "deny": "❌ Denied",
+}
+_APPROVAL_EXPIRED_HEADING = "⌛ Approval expired"
+
+
+def _approval_command_block(command: str) -> str:
+    body = command if len(command) <= _APPROVAL_COMMAND_LIMIT else f"{command[:_APPROVAL_COMMAND_LIMIT]}…"
+    fence = "````" if "```" in body else "```"
+    return f"{fence}sh\n{body}\n{fence}"
+
+
+def _approval_card_text(heading: str, command: str) -> str:
+    """An answered or expired card: the outcome above the command it was for."""
+    return f"{heading}\n\n{_approval_command_block(command)}" if command else heading
+
+
 _ENV_REF_PATTERN = re.compile(r"^\$\{([A-Za-z_][A-Za-z0-9_]*)\}$")
 _SIDECAR_RETRYABLE_KINDS = {"transient"}
 _INLINE_DISPLAY_DEFAULTS = {
@@ -206,11 +235,42 @@ def _truthy(value: Any, default: bool = False) -> bool:
     return str(value).strip().lower() in {"1", "true", "yes", "on"}
 
 
+_UNAVAILABLE_HERMES_SEAMS: set[str] = set()
+
+
+def _hermes_seam_unavailable(seam: str, effect: str, exc: Optional[BaseException] = None) -> None:
+    """Warn once per process that an undocumented Hermes internal is missing or changed.
+
+    Hermes documents no public API for these seams yet; the Inline repo tracks them in
+    plugins/hermes-agent/docs/hermes-upstream-seams.md.
+    Callers degrade the one feature that needs the seam; message delivery never depends on one.
+    """
+    if seam in _UNAVAILABLE_HERMES_SEAMS:
+        return
+    _UNAVAILABLE_HERMES_SEAMS.add(seam)
+    reason = f"{type(exc).__name__}: {exc}" if exc is not None else "missing"
+    logger.warning("[inline] Hermes internal %s is unavailable (%s); %s", seam, reason, effect)
+
+
+def _display_registration_fields() -> Dict[str, Any]:
+    """Inline's display defaults through the public PlatformEntry fields, when the host has them."""
+    try:
+        from gateway.platform_registry import PlatformEntry
+
+        fields = getattr(PlatformEntry, "__dataclass_fields__", {})
+        if {"display_tier", "display_overrides"}.issubset(fields):
+            # The overrides cover every key a tier sets, so the tier only names the closest base.
+            return {"display_tier": "low", "display_overrides": dict(_INLINE_DISPLAY_DEFAULTS)}
+    except Exception:
+        logger.debug("[inline] Hermes display registration fields are unavailable", exc_info=True)
+    return {}
+
+
 def _install_inline_display_defaults() -> None:
-    """Register Slack-like display defaults for Inline when Hermes exposes them.
+    """Seed Inline's display defaults on hosts that predate PlatformEntry.display_overrides.
 
-    Hermes core owns display resolution. External plugins do not yet have a
-    first-class display-default hook, so we seed the same private table core
+    Newer hosts take the same defaults from ``ctx.register_platform`` (see
+    ``_display_registration_fields``); only older ones need the private table core
     platforms use. User config still wins over these defaults.
     """
     try:
@@ -218,6 +278,10 @@ def _install_inline_display_defaults() -> None:
 
         defaults = getattr(_display_config, "_PLATFORM_DEFAULTS", None)
         if not isinstance(defaults, dict):
+            _hermes_seam_unavailable(
+                "gateway.display_config._PLATFORM_DEFAULTS",
+                "Inline uses Hermes' generic display defaults (tool progress may be shown)",
+            )
             return
         inline_defaults = dict(_INLINE_DISPLAY_DEFAULTS)
         current = defaults.get("inline")
@@ -225,8 +289,12 @@ def _install_inline_display_defaults() -> None:
             defaults["inline"] = {**inline_defaults, **current}
         else:
             defaults["inline"] = inline_defaults
-    except Exception:
-        logger.debug("[inline] failed to install display defaults", exc_info=True)
+    except Exception as exc:
+        _hermes_seam_unavailable(
+            "gateway.display_config._PLATFORM_DEFAULTS",
+            "Inline uses Hermes' generic display defaults (tool progress may be shown)",
+            exc,
+        )
 
 
 def _reply_thread_mode(value: Any, default: str = "auto") -> str:
@@ -570,7 +638,12 @@ def _normalize_inline_plugin_command_text(text: str) -> str:
         from hermes_cli.plugins import get_plugin_commands
         if command not in (get_plugin_commands() or {}):
             return text
-    except Exception:
+    except Exception as exc:
+        _hermes_seam_unavailable(
+            "hermes_cli.plugins.get_plugin_commands",
+            "hyphenated plugin commands must be typed with hyphens in Inline",
+            exc,
+        )
         return text
     # Inline menus require underscores, while Hermes registers plugin commands
     # with hyphens. Normalize before gateway access checks as well as dispatch.
@@ -585,16 +658,30 @@ def _normalize_inline_command_description(raw: str) -> str:
     return description
 
 
-def _inline_menu_commands(max_commands: int = _INLINE_COMMAND_LIMIT) -> tuple[List[Dict[str, Any]], int]:
-    from hermes_cli.commands_platforms import telegram_menu_commands
+def _hermes_menu_commands(max_commands: int) -> tuple[list, int]:
+    """Hermes' gateway command menu; empty when the host no longer exposes it."""
+    try:
+        from hermes_cli.commands_platforms import telegram_menu_commands
 
+        menu_commands, hidden_count = telegram_menu_commands(max_commands=max_commands)
+        return list(menu_commands or []), int(hidden_count or 0)
+    except Exception as exc:
+        _hermes_seam_unavailable(
+            "hermes_cli.commands_platforms.telegram_menu_commands",
+            "the Inline command menu lists only Inline's own commands",
+            exc,
+        )
+        return [], 0
+
+
+def _inline_menu_commands(max_commands: int = _INLINE_COMMAND_LIMIT) -> tuple[List[Dict[str, Any]], int]:
     command_specs = _inline_command_specs()
     local_commands = [
         (spec.name, spec.description)
         for spec in command_specs[:max(0, max_commands)]
     ]
     remaining = max(0, max_commands - len(local_commands))
-    menu_commands, hidden_count = telegram_menu_commands(max_commands=remaining)
+    menu_commands, hidden_count = _hermes_menu_commands(remaining)
     commands: List[Dict[str, Any]] = []
     seen: set[str] = set()
     skipped = 0
@@ -620,11 +707,15 @@ def _inline_menu_commands(max_commands: int = _INLINE_COMMAND_LIMIT) -> tuple[Li
 
 def _inline_skill_catalog() -> List[Dict[str, Any]]:
     """Return installed, enabled Hermes skills in the Bot API catalog shape."""
-    import tools.skills_tool as skills_tool
-
-    # Hermes 0.22.5 made these public; older supported hosts keep the private names.
-    find_all = getattr(skills_tool, "find_all_skills", None) or getattr(skills_tool, "_find_all_skills")
-    sort = getattr(skills_tool, "sort_skills", None) or getattr(skills_tool, "_sort_skills")
+    try:
+        # Public since Hermes 0.22.5 (plugins/index.md § Read the skill catalog).
+        from tools.skills_tool import find_all_skills as find_all, sort_skills as sort
+    except ImportError:
+        # Legacy hosts (< 0.22.5) only had the private names. Drop with that host floor.
+        import tools.skills_tool as legacy_skills_tool
+
+        find_all = getattr(legacy_skills_tool, "_find_all_skills")
+        sort = getattr(legacy_skills_tool, "_sort_skills")
     published: List[Dict[str, Any]] = []
     seen: set[str] = set()
     for skill in sort(find_all(skip_disabled=False)):
@@ -781,6 +872,7 @@ def _apply_yaml_config(yaml_cfg: dict, platform_cfg: dict) -> Optional[dict]:
         "state_path",
         "settings_path",
         "parse_markdown",
+        "cron_mention_prefix",
         "require_mention",
         "strict_mention",
         "allowed_chats",
@@ -816,10 +908,41 @@ def _apply_yaml_config(yaml_cfg: dict, platform_cfg: dict) -> Optional[dict]:
     return extra
 
 
+async def _wait_for_exit(proc: subprocess.Popen, timeout: float) -> bool:
+    """Wait for ``proc`` without blocking the loop or taking an executor worker; False on timeout."""
+    deadline = time.monotonic() + timeout
+    while proc.poll() is None:
+        if time.monotonic() >= deadline:
+            return False
+        await asyncio.sleep(0.05)
+    return True
+
+
+def _token_count(tokens: int) -> str:
+    """"850", "439k", "1.2M": the bridge's wording for context sizes."""
+    if tokens < 1_000:
+        return str(tokens)
+    if tokens < 1_000_000:
+        return f"{tokens // 1_000}k"
+    tenths = tokens // 100_000
+    return f"{tenths // 10}M" if tenths % 10 == 0 else f"{tenths // 10}.{tenths % 10}M"
+
+
+def _accepts_keyword(fn: Callable[..., Any], name: str) -> bool:
+    """Whether a host callable takes keyword ``name`` (host APIs grow optional keywords)."""
+    try:
+        params = inspect.signature(fn).parameters
+    except (TypeError, ValueError):
+        return False
+    return name in params or any(p.kind is inspect.Parameter.VAR_KEYWORD for p in params.values())
+
+
 class InlineAdapter(BasePlatformAdapter):
     MAX_MESSAGE_LENGTH = _MAX_MESSAGE_LENGTH
     supports_code_blocks = True
     splits_long_messages = True
+    # Command preview on an approval card; Hermes sends a longer command whole before the card.
+    _EA_CMD_BUDGET = 2000
 
     def __init__(self, config: PlatformConfig, *, use_ephemeral_sidecar_port: bool = False):
         super().__init__(config, Platform("inline"))
@@ -848,6 +971,10 @@ class InlineAdapter(BasePlatformAdapter):
         _configure_tool_sidecar(bind=self._sidecar_bind, port=self._sidecar_port, token=self._sidecar_token)
         self._node_bin = _find_node_bin() or "node"
         self._parse_markdown = _truthy(extra.get("parse_markdown") if "parse_markdown" in extra else inline_env("INLINE_PARSE_MARKDOWN"), True)
+        cron_mention_prefix = extra.get("cron_mention_prefix") if "cron_mention_prefix" in extra else inline_env("INLINE_CRON_MENTION_PREFIX")
+        self._cron_mention_prefix = cron_mention_prefix.strip() if isinstance(cron_mention_prefix, str) else ""
+        if self._cron_mention_prefix and not self._parse_markdown:
+            logger.warning("[inline] cron_mention_prefix needs parse_markdown=true; scheduled mentions are disabled")
         self._media_max_bytes = int(
             _normalize_positive_float(
                 extra.get("media_max_mb") if "media_max_mb" in extra else inline_env("INLINE_MEDIA_MAX_MB"),
@@ -1024,6 +1151,9 @@ class InlineAdapter(BasePlatformAdapter):
         self._clarify_choices: "OrderedDict[str, List[str]]" = OrderedDict()
         self._clarify_sessions: "OrderedDict[str, str]" = OrderedDict()
         self._approval_sessions: "OrderedDict[str, str]" = OrderedDict()
+        self._partial_sends: "OrderedDict[tuple, bool]" = OrderedDict()
+        self._approval_request_ids: "OrderedDict[str, str]" = OrderedDict()
+        self._approval_commands: "OrderedDict[str, str]" = OrderedDict()
         self._slash_sessions: "OrderedDict[str, str]" = OrderedDict()
         self._choice_picker_sessions: "OrderedDict[str, Dict[str, Any]]" = OrderedDict()
         self._update_prompt_sessions: "OrderedDict[str, Dict[str, Any]]" = OrderedDict()
@@ -1163,12 +1293,14 @@ class InlineAdapter(BasePlatformAdapter):
         """Hermes' own slash-command access for this platform; None on hosts without it."""
         try:
             from gateway.slash_access import policy_from_extra
-        except Exception:
-            return None
-        try:
+
             return policy_from_extra(dict(self.config.extra or {}), "dm" if chat_type == "dm" else "group")
-        except Exception:
-            logger.debug("[inline] slash access policy unavailable", exc_info=True)
+        except Exception as exc:
+            _hermes_seam_unavailable(
+                "gateway.slash_access.policy_from_extra",
+                "only a DM's owner can change reply threads; group settings are locked",
+                exc,
+            )
             return None
 
     def _may_change_reply_threads(self, actor_id: str, chat_type: str) -> bool:
@@ -1176,7 +1308,9 @@ class InlineAdapter(BasePlatformAdapter):
         who may run /threads. Without admin lists Hermes allows everyone, and so does this."""
         policy = self._slash_access_policy(chat_type)
         if policy is None:
-            return True
+            # Every supported host has the policy, so its absence means the seam broke:
+            # keep a DM's owner in control, but never open a group's setting to everyone.
+            return chat_type == "dm"
         return policy.can_run(actor_id, "threads")
 
     def note_turn_thread(self, chat_id: str, message_id: str, thread_id: str) -> None:
@@ -1227,14 +1361,9 @@ class InlineAdapter(BasePlatformAdapter):
         return "group"
 
     def _bot_settings_runner(self) -> Any:
-        runner = getattr(self, "gateway_runner", None)
-        if runner is not None:
-            return runner
-        try:
-            from gateway.run import _gateway_runner_ref
-            return _gateway_runner_ref()
-        except Exception:
-            return None
+        # BasePlatformAdapter.gateway_runner is the runner's documented back-reference;
+        # every supported host sets it before the adapter connects.
+        return getattr(self, "gateway_runner", None)
 
     async def _bot_settings_context(
         self,
@@ -1308,12 +1437,14 @@ class InlineAdapter(BasePlatformAdapter):
         }
         if runner is None:
             return context
+        context["context_usage"] = self._session_context_usage(runner, source)
 
         try:
-            from gateway.run import _load_gateway_config
+            from hermes_cli.config import load_config_readonly
             from hermes_cli.model_switch_providers import list_picker_providers
 
-            cfg = _load_gateway_config() or {}
+            # Read-only: the returned dict is Hermes' shared config cache.
+            cfg = load_config_readonly() or {}
             model_cfg = cfg.get("model") if isinstance(cfg, dict) else {}
             if not isinstance(model_cfg, dict):
                 model_cfg = {"default": str(model_cfg or "")}
@@ -1415,10 +1546,34 @@ class InlineAdapter(BasePlatformAdapter):
                     {"value": value, "label": value.capitalize()} for value in dict.fromkeys(reasoning_values)
                 ],
             })
+        except asyncio.TimeoutError:
+            logger.warning("[inline] agent settings model catalog timed out")
         except Exception as exc:
-            logger.debug("[inline] Hermes runtime settings unavailable: %s", exc)
+            # Model and reasoning rows lean on GatewayRunner internals and the model picker
+            # catalog; without them the settings sheet still offers reply-thread controls.
+            _hermes_seam_unavailable(
+                "GatewayRunner session model/reasoning settings",
+                "Inline agent settings hide the model and reasoning rows",
+                exc,
+            )
         return context
 
+    @staticmethod
+    def _session_context_usage(runner: Any, source: Any) -> Optional[List[int]]:
+        """``[used, window]`` prompt tokens of the chat's resident Hermes agent, read like Hermes'
+        own ``/usage``; None before its first turn or once the agent was evicted."""
+        try:
+            agent = runner._resident_agent_for(runner._session_key_for_source(source))
+            compressor = getattr(agent, "context_compressor", None) if agent is not None else None
+            used = int(getattr(compressor, "last_prompt_tokens", 0) or 0)
+            window = int(getattr(compressor, "context_length", 0) or 0)
+        except Exception as exc:
+            _hermes_seam_unavailable(
+                "GatewayRunner._resident_agent_for", "Inline agent settings omit the context window", exc,
+            )
+            return None
+        return [used, window] if used > 0 and window > 0 else None
+
     @staticmethod
     def _bot_settings_revision(context: Dict[str, Any]) -> str:
         visible = {
@@ -1480,6 +1635,21 @@ class InlineAdapter(BasePlatformAdapter):
                     "options": [{**option, "disabled": False} for option in reasoning_options],
                 }},
             })
+        usage = context.get("context_usage")
+        if usage:
+            used, window = min(usage[0], usage[1]), usage[1]
+            percent = used * 100 // window
+            # The id carries the numbers: Inline's composer draws its context circle from
+            # ``session.context:<used>:<window>``, as it does for coding-agent bridges.
+            runtime_items.append({
+                "id": f"session.context:{usage[0]}:{window}", "label": "Context window",
+                "description": f"{_token_count(usage[0])} of {_token_count(window)} tokens used",
+                "disabled": True,
+                "control": {"oneofKind": "info", "info": {
+                    "text": f"{percent}% full",
+                    "tone": _INLINE_BOT_SETTINGS_TONE_WARNING if percent >= 90 else _INLINE_BOT_SETTINGS_TONE_NEUTRAL,
+                }},
+            })
         if not runtime_items:
             runtime_items.append({
                 "id": "runtime-unavailable", "label": "Runtime", "disabled": False,
@@ -1632,7 +1802,11 @@ class InlineAdapter(BasePlatformAdapter):
                 f"/model {shlex.quote(model)} --provider {shlex.quote(provider)} "
                 f"{'--global' if item_id == 'model-default' else '--session'}"
             )
-            result = await runner._handle_model_command(MessageEvent(
+            handle_model_command = getattr(runner, "_handle_model_command", None)
+            if not callable(handle_model_command):
+                _hermes_seam_unavailable("GatewayRunner._handle_model_command", "Inline settings cannot switch models")
+                raise ValueError("model switching unavailable")
+            result = await handle_model_command(MessageEvent(
                 text=command,
                 message_type=MessageType.TEXT,
                 source=source,
@@ -1645,7 +1819,13 @@ class InlineAdapter(BasePlatformAdapter):
             selected = str(value_body.get("stringValue") or "")
             if selected not in {option.get("value") for option in context.get("reasoning_options") or []}:
                 raise ValueError("reasoning unavailable")
-            runner._apply_reasoning_selection(context["session_key"], "inline", selected)
+            apply_reasoning_selection = getattr(runner, "_apply_reasoning_selection", None)
+            if not callable(apply_reasoning_selection):
+                _hermes_seam_unavailable(
+                    "GatewayRunner._apply_reasoning_selection", "Inline settings cannot change reasoning effort",
+                )
+                raise ValueError("reasoning unavailable")
+            apply_reasoning_selection(context["session_key"], "inline", selected)
             return
         raise ValueError("setting unavailable")
 
@@ -2090,14 +2270,34 @@ class InlineAdapter(BasePlatformAdapter):
         raise RuntimeError(f"Inline sidecar did not become ready within {timeout}: {last_error}")
 
     async def _supervise_sidecar(self, proc: subprocess.Popen) -> None:
-        if proc.stdout is None:
+        """Log sidecar output. A quiet sidecar can go hours without a line, so its blocking
+        read runs on a thread of its own: on the loop's shared executor every sidecar would pin
+        a worker, and a gateway with more Inline bots than workers stalls every other
+        ``to_thread`` job (startup included)."""
+        stdout = proc.stdout
+        if stdout is None:
             return
-        loop = asyncio.get_event_loop()
-        while True:
+        loop = asyncio.get_running_loop()
+        lines: "asyncio.Queue[bytes]" = asyncio.Queue()
+
+        def hand_off(raw: bytes) -> None:
             try:
-                line = await loop.run_in_executor(None, proc.stdout.readline)
+                loop.call_soon_threadsafe(lines.put_nowait, raw)
+            except RuntimeError:
+                pass  # the loop closed first
+
+        def read() -> None:
+            try:
+                for raw in iter(stdout.readline, b""):
+                    hand_off(raw)
             except Exception:
-                return
+                pass
+            finally:
+                hand_off(b"")
+
+        threading.Thread(target=read, name="inline-sidecar-stdout", daemon=True).start()
+        while True:
+            line = await lines.get()
             if not line:
                 return
             text = line.decode("utf-8", "replace").rstrip()
@@ -2126,9 +2326,7 @@ class InlineAdapter(BasePlatformAdapter):
                     )
                 except Exception:
                     pass
-            try:
-                proc.wait(timeout=3.0)
-            except subprocess.TimeoutExpired:
+            if not await _wait_for_exit(proc, 3.0):
                 if sys.platform != "win32":
                     try:
                         os.killpg(os.getpgid(proc.pid), signal.SIGTERM)
@@ -2136,9 +2334,7 @@ class InlineAdapter(BasePlatformAdapter):
                         proc.terminate()
                 else:
                     proc.terminate()
-                try:
-                    proc.wait(timeout=2.0)
-                except subprocess.TimeoutExpired:
+                if not await _wait_for_exit(proc, 2.0):
                     proc.kill()
         finally:
             self._sidecar_proc = None
@@ -2439,10 +2635,12 @@ class InlineAdapter(BasePlatformAdapter):
                 self._schedule_bot_settings_task(self._handle_bot_settings_item(event))
             return
         if kind == "message.action.invoke":
-            if await self._handle_action(event):
+            # A widget call names its widget, never a native control, so it skips system handlers.
+            widget_call = inline_widget_call(event) is not None
+            if not widget_call and await self._handle_action(event):
                 return
             ownership = resolve_inline_message_action_ownership(event.get("actionId"))
-            if ownership.owner == "system" and ownership.explicit:
+            if not widget_call and ownership.owner == "system" and ownership.explicit:
                 await self._answer_action(str(event.get("interactionId") or ""), "Action expired")
                 logger.info("[inline] dropped unhandled system action %s", event.get("actionId") or "")
                 return
@@ -2677,9 +2875,7 @@ class InlineAdapter(BasePlatformAdapter):
             await self.handle_message(MessageEvent(
                 text=text or "[Inline message with no text]", message_type=MessageType.TEXT,
                 source=source, raw_message=event,
-                message_id=build_inline_agent_action_turn_id(
-                    agent_action.get("messageId"), agent_action.get("interactionId"),
-                ) if agent_action else msg_id,
+                message_id=_agent_action_turn_message_id(agent_action, msg_id),
                 timestamp=self._timestamp(event.get("date") or msg.get("date")),
                 allow_gateway_control=not bool(agent_action),
             ))
@@ -2861,14 +3057,7 @@ class InlineAdapter(BasePlatformAdapter):
             message_type=message_type,
             source=source,
             raw_message=event,
-            message_id=(
-                build_inline_agent_action_turn_id(
-                    agent_action.get("messageId"),
-                    agent_action.get("interactionId"),
-                )
-                if agent_action
-                else msg_id
-            ),
+            message_id=_agent_action_turn_message_id(agent_action, msg_id),
             platform_update_id=int(event.get("seq") or 0) if str(event.get("seq") or "").isdigit() else None,
             media_urls=media_urls,
             media_types=media_types,
@@ -2902,6 +3091,12 @@ class InlineAdapter(BasePlatformAdapter):
         if not target:
             await self._answer_action(interaction_id, "Action expired or no longer accessible.")
             return
+        widget_call = inline_widget_call(event)
+        if widget_call is None and str(event.get("actionId") or "") in inline_message_widget_ids(target):
+            # Older realtime SDKs drop the call's name and payload but keep the widget ID.
+            widget_call = {}
+        if widget_call is not None:
+            event = {**event, "widgetCall": widget_call}
 
         synthetic_message = dict(target)
         for stale_key in ("actions", "attachments", "entities", "media", "reactions", "replies", "sender"):
@@ -4352,32 +4547,93 @@ class InlineAdapter(BasePlatformAdapter):
         _, approval_id, choice = parts
         choice = "once" if choice == "approve" else choice
         session_key = self._approval_sessions.get(approval_id)
-        if choice not in {"once", "session", "always", "deny"}:
+        if choice not in _APPROVAL_CHOICES:
             return False
         if not session_key:
-            await self._finish_action(event, "Approval expired", "Approval expired; the command was not run.")
+            command = self._approval_commands.pop(approval_id, None) or await self._approval_command_from_message(event)
+            await self._finish_action(event, "Approval expired", _approval_card_text(_APPROVAL_EXPIRED_HEADING, command))
             return True
         try:
-            from tools.approval import resolve_gateway_approval
-            count = resolve_gateway_approval(session_key, choice)
+            request_id = self._approval_request_ids.get(approval_id)
+            actor_id = str(event.get("actorUserId") or "").strip()
+            refusal = self._approval_refusal(session_key, actor_id, request_id)
+            if refusal:
+                # Another member's approval: leave the card live for the requester.
+                await self._answer_action(str(event.get("interactionId") or ""), refusal)
+                return True
+            count = self._resolve_approval(session_key, choice, request_id, actor_id)
             self._approval_sessions.pop(approval_id, None)
+            self._approval_request_ids.pop(approval_id, None)
+            command = self._approval_commands.pop(approval_id, None) or ""
             if not count:
-                await self._finish_action(event, "Approval expired", "Approval expired; the command was not run.")
+                await self._finish_action(event, "Approval expired", _approval_card_text(_APPROVAL_EXPIRED_HEADING, command))
                 return True
-            labels = {
-                "once": ("Approved once", "Approved once."),
-                "session": ("Approved for session", "Approved for this session."),
-                "always": ("Always allowed", "Always allowed."),
-                "deny": ("Denied", "Denied."),
+            toasts = {
+                "once": "Approved once",
+                "session": "Approved for session",
+                "always": "Always allowed",
+                "deny": "Denied",
             }
-            toast, text = labels[choice]
-            await self._finish_action(event, toast, text)
+            # Slack, Discord and OpenClaw's Inline card say who answered; a bare id is noise.
+            answered_by, _, _ = _inline_sender_identity(_inline_sender_profile(event))
+            heading = _APPROVAL_DECISION_HEADINGS[choice] + (f" by {answered_by}" if answered_by else "")
+            await self._finish_action(event, toasts[choice], _approval_card_text(heading, command))
             return True
         except Exception as exc:
             self._report_error("action.approval", exc)
             logger.exception("[inline] approval action failed")
             return True
 
+    async def _approval_command_from_message(self, event: Dict[str, Any]) -> str:
+        """Recover the command from the card itself when this process no longer has it (e.g. after a restart)."""
+        chat_id = str(event.get("chatId") or "")
+        message_id = str(event.get("messageId") or "")
+        msg = await self._fetch_message(chat_id, message_id) if chat_id and message_id else None
+        if not msg:
+            return ""
+        text = str(msg.get("message") or "")
+        units = text.encode("utf-16-le")
+        for entity in self._message_entities(msg):
+            if self._entity_kind(entity) != "pre":
+                continue
+            offset = _to_int(entity.get("offset"))
+            length = _to_int(entity.get("length"))
+            if offset is None or length is None or offset < 0 or length <= 0:
+                continue
+            return units[offset * 2 : (offset + length) * 2].decode("utf-16-le", errors="ignore").strip()
+        match = _APPROVAL_FENCE_PATTERN.search(text)
+        return match.group(2).strip() if match else ""
+
+    def _approval_refusal(self, session_key: str, actor_id: str, request_id: Optional[str]) -> Optional[str]:
+        """Hermes' approver rule (``approvals.approvers``) for a tap, or None when it may answer.
+        Hosts without the rule leave it to the chat access check every action already passed."""
+        try:
+            from gateway.approval_actor import approval_refusal
+        except ImportError:
+            return None
+        requester = approval_refusal(session_key, actor_id, extra=self.config.extra, request_id=request_id)
+        if not requester:
+            return None
+        try:
+            from gateway.approval_actor import refusal_text
+            return str(refusal_text(requester))
+        except ImportError:
+            return f"Only {requester} can answer this approval."
+
+    def _resolve_approval(self, session_key: str, choice: str, request_id: Optional[str], actor_id: str) -> int:
+        """Resolve only the request the card was sent for; once it settled (timeout, /approve)
+        the tap resolves nothing rather than the next one queued. A card without a request id
+        (hosts before 0.22.7) keeps the oldest-pending behaviour."""
+        from tools import approval as approval_mod
+        resolve_card = getattr(approval_mod, "resolve_gateway_approval_card", None)
+        if resolve_card is not None:
+            if _accepts_keyword(resolve_card, "actor_id"):
+                return resolve_card(session_key, choice, request_id, actor_id=actor_id or None, extra=self.config.extra)
+            return resolve_card(session_key, choice, request_id)
+        if request_id:
+            return approval_mod.resolve_gateway_approval(session_key, choice, request_id=request_id)
+        return approval_mod.resolve_gateway_approval(session_key, choice)
+
     async def _handle_slash_action(self, event: Dict[str, Any]) -> bool:
         action_id = str(event.get("actionId") or "")
         parts = action_id.split(":", 2)
@@ -4392,6 +4648,11 @@ class InlineAdapter(BasePlatformAdapter):
             return True
         try:
             from tools import slash_confirm as slash_confirm_mod
+        except Exception as exc:
+            _hermes_seam_unavailable("tools.slash_confirm.resolve", "Inline slash-confirm buttons cannot answer", exc)
+            await self._finish_action(event, "Unavailable", "This Hermes version cannot record that choice.")
+            return True
+        try:
             result = await slash_confirm_mod.resolve(session_key, confirm_id, choice)
             self._slash_sessions.pop(confirm_id, None)
             text = str(result or ("Cancelled." if choice == "cancel" else "Recorded."))
@@ -4651,7 +4912,10 @@ class InlineAdapter(BasePlatformAdapter):
             from hermes_cli.models_catalog_static import PROVIDER_GROUPS
             label, _desc, members = PROVIDER_GROUPS.get(group_id, (group_id, "", []))
             member_slugs = [str(member) for member in members]
-        except Exception:
+        except Exception as exc:
+            _hermes_seam_unavailable(
+                "hermes_cli.models_catalog_static.PROVIDER_GROUPS", "the model picker cannot open provider groups", exc,
+            )
             member_slugs = []
         by_slug = {
             str(provider.get("slug") or "").strip().lower(): provider
@@ -4750,8 +5014,17 @@ class InlineAdapter(BasePlatformAdapter):
     async def _expensive_model_warning(self, model_id: str, provider_slug: str) -> Optional[Any]:
         try:
             from hermes_cli.model_cost_guard import expensive_model_warning
+        except Exception as exc:
+            _hermes_seam_unavailable(
+                "hermes_cli.model_cost_guard.expensive_model_warning",
+                "the model picker switches without the expensive-model confirmation",
+                exc,
+            )
+            return None
+        try:
             return await asyncio.to_thread(expensive_model_warning, model_id, provider=provider_slug)
         except Exception:
+            logger.warning("[inline] expensive model check failed", exc_info=True)
             return None
 
     async def _edit_action_message(self, event: Dict[str, Any], text: str, actions: Optional[Dict[str, Any]] = None) -> SendResult:
@@ -4793,8 +5066,11 @@ class InlineAdapter(BasePlatformAdapter):
         metadata: Optional[Dict[str, Any]] = None,
         actions: Optional[Dict[str, Any]] = None,
     ) -> SendResult:
+        requested = content
+        content = self._with_cron_mention(content, metadata)
         metadata = self._with_turn_thread(chat_id, reply_to, metadata)
         target = self._target_for(chat_id, metadata)
+        send_options = {"sendMode": "silent"} if (metadata or {}).get("notify") is False else {}
         agent_action_target = parse_inline_agent_action_reply_target(reply_to)
         if agent_action_target:
             chunks = self.truncate_message(self.format_message(content), self.MAX_MESSAGE_LENGTH)
@@ -4819,10 +5095,13 @@ class InlineAdapter(BasePlatformAdapter):
                         "text": chunk,
                         "parseMarkdown": self._parse_markdown,
                         "replyToMsgId": previous_id,
+                        **send_options,
                     })
                     raw_responses.append(continuation.raw_response)
                     if not continuation.success:
-                        return continuation
+                        return self._partial_send_failure(
+                            chat_id, requested, continuation, previous_id, continuation_ids, len(chunks), raw_responses,
+                        )
                     if continuation.message_id:
                         previous_id = str(continuation.message_id)
                         continuation_ids.append(previous_id)
@@ -4848,6 +5127,7 @@ class InlineAdapter(BasePlatformAdapter):
                 "target": target,
                 "text": chunk,
                 "parseMarkdown": self._parse_markdown,
+                **send_options,
             }
             if reply_to and index == 0:
                 body["replyToMsgId"] = str(reply_to)
@@ -4855,7 +5135,12 @@ class InlineAdapter(BasePlatformAdapter):
                 body["actions"] = actions
             last_result = await self._send_sidecar("/send", body)
             if not last_result.success:
-                return last_result
+                if not message_ids:
+                    return last_result
+                return self._partial_send_failure(
+                    chat_id, requested, last_result, message_ids[-1], message_ids[:-1], len(chunks),
+                    [*raw_responses, getattr(last_result, "raw_response", None)],
+                )
             if not marked_visible:
                 self._mark_reply_thread_visible(target)
                 marked_visible = True
@@ -4917,7 +5202,13 @@ class InlineAdapter(BasePlatformAdapter):
         metadata: Optional[Dict[str, Any]] = None,
     ) -> SendResult:
         text = self.format_message(content)
-        if len(text) > self.MAX_MESSAGE_LENGTH:
+        several_widgets = False
+        if self._parse_markdown and has_widget_markup(text):
+            if not finalize:
+                # A streaming preview must not send a widget whose closing tag hasn't arrived.
+                text = streaming_preview(text)
+            several_widgets = len(scan_widgets(text).widgets) > 1
+        if len(text) > self.MAX_MESSAGE_LENGTH or several_widgets:
             if finalize:
                 return await self._edit_overflow_split(chat_id, message_id, content, metadata=metadata)
             text = self.truncate_message(text, self.MAX_MESSAGE_LENGTH)[0]
@@ -5201,35 +5492,31 @@ class InlineAdapter(BasePlatformAdapter):
             "actions": {"rows": self._action_rows(actions)},
         })
 
-    async def send_exec_approval(
-        self,
-        chat_id: str,
-        command: str,
-        session_key: str,
-        description: str = "dangerous command",
-        metadata: Optional[Dict[str, Any]] = None,
-        allow_permanent: bool = True,
-        allow_session: bool = True,
-        smart_denied: bool = False,
-    ) -> SendResult:
+    async def _send_exec_approval_prompt(self, prompt: Any) -> SendResult:
+        """Draw Hermes' exec-approval prompt as an Inline button card.
+
+        Hermes' ``send_exec_approval`` owns the wording, a truncated command's full send and
+        the Deny-only gate of newer hosts; overriding this hook is also how Hermes knows the
+        adapter has native buttons. Inline only draws the offered choices and remembers which
+        request the card answers, so a tap never resolves a different one."""
         approval_id = secrets.token_hex(6)
-        text = f"Command approval required\n\n```\n{command[:2000]}\n```\n\nReason: {description}"
-        if smart_denied:
-            text += "\n\nSmart DENY: owner override applies to this one operation only."
-        actions = [self._action(f"appr:{approval_id}:once", "Allow Once")]
-        if not smart_denied and allow_session:
-            actions.append(self._action(f"appr:{approval_id}:session", "Allow for Session"))
-            if allow_permanent:
-                actions.append(self._action(f"appr:{approval_id}:always", "Always Allow"))
-        actions.append(self._action(f"appr:{approval_id}:deny", "Deny"))
+        actions = [
+            self._action(f"appr:{approval_id}:{choice}", str(label))
+            for label, choice, _style in prompt.actions
+            if choice in _APPROVAL_CHOICES
+        ]
         result = await self._send_sidecar("/send", {
-            "target": self._target_for(chat_id, metadata),
-            "text": text,
+            "target": self._target_for(prompt.chat_id, prompt.metadata),
+            "text": prompt.text,
             "parseMarkdown": self._parse_markdown,
             "actions": {"rows": self._action_rows(actions)},
         })
         if result.success:
-            self._remember(self._approval_sessions, approval_id, session_key)
+            self._remember(self._approval_sessions, approval_id, prompt.session_key)
+            self._remember(self._approval_commands, approval_id, str(getattr(prompt, "command", "") or ""))
+            request_id = getattr(prompt, "request_id", None)
+            if request_id:
+                self._remember(self._approval_request_ids, approval_id, str(request_id))
         return result
 
     async def send_slash_confirm(self, chat_id: str, title: str, message: str, session_key: str, confirm_id: str, metadata: Optional[Dict[str, Any]] = None) -> SendResult:
@@ -5396,7 +5683,8 @@ class InlineAdapter(BasePlatformAdapter):
         try:
             from hermes_cli.providers import get_label
             return str(get_label(slug))
-        except Exception:
+        except Exception as exc:
+            _hermes_seam_unavailable("hermes_cli.providers.get_label", "the model picker shows provider slugs", exc)
             return str(slug or "")
 
     def _build_provider_actions(self, picker_id: str, providers: list, *, include_back: bool = False) -> Dict[str, Any]:
@@ -5409,7 +5697,10 @@ class InlineAdapter(BasePlatformAdapter):
         try:
             from hermes_cli.models_catalog_static import group_providers
             grouped = group_providers(list(by_slug.keys()))
-        except Exception:
+        except Exception as exc:
+            _hermes_seam_unavailable(
+                "hermes_cli.models_catalog_static.group_providers", "the model picker lists providers ungrouped", exc,
+            )
             grouped = [{"kind": "single", "slug": slug} for slug in by_slug.keys()]
         for row in grouped:
             if row.get("kind") == "group":
@@ -5541,6 +5832,81 @@ class InlineAdapter(BasePlatformAdapter):
             out["parent_message_id"] = parent_message_id
         return out
 
+    def _with_cron_mention(self, content: str, metadata: Optional[Dict[str, Any]]) -> str:
+        # Hermes identifies scheduled text sends with job_id. notify also appears
+        # on ordinary replies, so it cannot identify a cron on its own. Decorate
+        # before chunking to mention once, while preserving the supplied body.
+        meta = metadata or {}
+        prefix = self._cron_mention_prefix
+        if not prefix or not self._parse_markdown or not meta.get("job_id") or meta.get("notify") is False:
+            return content
+        if not content or not content.strip() or content.startswith(prefix):
+            return content
+        return f"{prefix}\n\n{content}"
+
+    def truncate_message(
+        self,
+        content: str,
+        max_length: int = _MAX_MESSAGE_LENGTH,
+        len_fn: Optional[Callable[[str], int]] = None,
+    ) -> List[str]:
+        """Hermes splitting, except a widget block is never cut or shares a message with another."""
+        if getattr(self, "_parse_markdown", True):
+            def split_plain(text: str, limit: int) -> List[str]:
+                pieces = self._base_truncate(text, limit, len_fn)
+                # Upstream numbers multi-part output; the parts here are pieces of one reply.
+                return [piece.removesuffix(f" ({i + 1}/{len(pieces)})") for i, piece in enumerate(pieces)]
+
+            chunks = split_widget_aware(content, max_length, split_plain, len_fn or len)
+            if chunks is not None:
+                return chunks
+        return self._base_truncate(content, max_length, len_fn)
+
+    def _base_truncate(self, content: str, max_length: int, len_fn: Optional[Callable[[str], int]]) -> List[str]:
+        base = super().truncate_message
+        if len_fn is not None and _accepts_keyword(base, "len_fn"):
+            return list(base(content, max_length, len_fn=len_fn))
+        return list(base(content, max_length))
+
+    def _partial_send_failure(
+        self, chat_id: str, requested: str, failed: SendResult, last_delivered_id: str,
+        delivered_continuations: List[str], total_chunks: int, raw_responses: List[Any],
+    ) -> SendResult:
+        """A later chunk failed after earlier ones were delivered. ``partial_overflow`` tells Hermes
+        (0.22.7+) not to resend the visible head as plain text; older hosts are stopped in
+        ``_send_plain_fallback``. Either way the reply is not posted twice."""
+        if getattr(BasePlatformAdapter, "_is_partial_delivery", None) is None:
+            self._remember(self._partial_sends, (self._chat_key(chat_id), requested), True, limit=64)
+        return _send_result(
+            success=False,
+            message_id=last_delivered_id,
+            error=failed.error or "continuation failed",
+            error_kind=getattr(failed, "error_kind", None),
+            retryable=bool(getattr(failed, "retryable", False)),
+            raw_response={
+                "partial_overflow": True,
+                "delivered_chunks": 1 + len(delivered_continuations),
+                "total_chunks": total_chunks,
+                "last_message_id": last_delivered_id,
+                "continuation_message_ids": tuple(delivered_continuations),
+                "responses": raw_responses,
+            },
+            continuation_message_ids=tuple(delivered_continuations),
+        )
+
+    async def _send_plain_fallback(self, chat_id: str, content: str, *, reply_to: Optional[str], metadata: Any) -> SendResult:
+        if self._partial_sends.pop((self._chat_key(chat_id), content), None):
+            # Part of this reply is already in the chat: resending it would post that part twice.
+            logger.warning("[inline] send failed after partial delivery; not resending it as plain text")
+            return _send_result(success=False, error="send failed after partial delivery", error_kind="bad_format")
+        # A widget the server rejected would fail the fallback too; keep the prose and say so.
+        if getattr(self, "_parse_markdown", True) and has_widget_markup(content):
+            content = without_widgets(content)
+        base = getattr(super(), "_send_plain_fallback", None)
+        if base is None:
+            return await self.send(chat_id, content, reply_to=reply_to, metadata=metadata)
+        return await base(chat_id, content, reply_to=reply_to, metadata=metadata)
+
     def format_message(self, content: str) -> str:
         # parseMarkdown=false means literal input at every Inline API boundary.
         # Preserve that contract instead of silently rewriting the caller's text.
@@ -5630,6 +5996,13 @@ class InlineAdapter(BasePlatformAdapter):
         return _sidecar_base_url(self._sidecar_bind, self._sidecar_port)
 
 
+def _agent_action_turn_message_id(agent_action: Optional[Dict[str, Any]], msg_id: str) -> str:
+    """A button turn's answer replaces its card; a widget call's answer replies below the widget."""
+    if not agent_action or inline_widget_call(agent_action) is not None:
+        return msg_id
+    return build_inline_agent_action_turn_id(agent_action.get("messageId"), agent_action.get("interactionId"))
+
+
 def _send_result(**kwargs: Any) -> SendResult:
     fields = getattr(SendResult, "__dataclass_fields__", {})
     for optional in ("error_kind", "retry_after"):
@@ -5784,7 +6157,9 @@ def _inline_catalog_part_summary(part: Dict[str, Any]) -> str:
 def _inline_version_text(last_sync: Optional[Dict[str, Any]] = None) -> str:
     version = _installed_inline_plugin_version()
     try:
-        from hermes_cli import __version__ as hermes_version
+        from importlib.metadata import version as _distribution_version
+
+        hermes_version = _distribution_version("hermes-agent")
     except Exception:
         hermes_version = None
 
@@ -5854,7 +6229,9 @@ def register(ctx) -> None:
     from . import cli as _cli
     from . import tools as _tools
 
-    _install_inline_display_defaults()
+    display_fields = _display_registration_fields()
+    if not display_fields:
+        _install_inline_display_defaults()
     ctx.register_platform(
         name="inline",
         label="Inline",
@@ -5877,6 +6254,7 @@ def register(ctx) -> None:
         allow_update_command=True,
         platform_hint=_tools.INLINE_PLATFORM_GUIDANCE,
         **_target_registration_hooks(),
+        **display_fields,
     )
     register_command = getattr(ctx, "register_command", None)
     if callable(register_command):