@pixelbyte-software/pixcode 1.49.10 → 1.50.0

package/scripts/smoke/hermes-rest-codex-launch.mjs

@@ -71,6 +71,10 @@ const server = createServer(async (req, res) => {
       provider: body.provider,
       projectPath: body.projectPath,
       prompt: body.prompt,
+      startupInput: body.startupInput,
+      permissionMode: body.permissionMode,
+      skipPermissions: Boolean(body.skipPermissions),
+      bypassPermissions: Boolean(body.bypassPermissions),
       source: 'hermes-mcp',
       createdAt: new Date().toISOString(),
     };
@@ -149,7 +153,7 @@ try {
   });
   assert.equal(gateway.running, true, 'Hermes REST gateway should be running before /v1/runs');
 
-  const codexPrompt = 'Pixcode Hermes REST smoke: create HERMES_CODEX_REST_SMOKE.txt with the text "Hermes launched Codex through Pixcode MCP".';
+  const codexTask = 'Pixcode Hermes REST smoke: create HERMES_CODEX_REST_SMOKE.txt with the text "Hermes launched Codex through Pixcode MCP", then report the changed file path.';
   const { response, body } = await gatewayFetch(gateway.baseUrl, '/v1/runs', {
     method: 'POST',
     body: JSON.stringify({
@@ -157,10 +161,10 @@ try {
       instructions: [
         'You are testing Pixcode integration.',
         'Use the MCP tool named mcp_pixcode_pixcode_open_cli_terminal exactly once.',
-        'Call it with provider="codex", the supplied projectPath, and the supplied prompt.',
+        'Call it with provider="codex", the supplied projectPath, startupInput equal to the supplied task, prompt="Pixcode Hermes REST smoke visible Codex task", and bypassPermissions=true.',
         'After the tool call, answer with "codex launch requested".',
       ].join(' '),
-      input: `Call mcp_pixcode_pixcode_open_cli_terminal with provider codex, projectPath ${JSON.stringify(projectPath)}, and prompt ${JSON.stringify(codexPrompt)}.`,
+      input: `Call mcp_pixcode_pixcode_open_cli_terminal with provider codex, projectPath ${JSON.stringify(projectPath)}, startupInput ${JSON.stringify(codexTask)}, prompt "Pixcode Hermes REST smoke visible Codex task", and bypassPermissions true.`,
     }),
   });
   if (!response.ok || !body?.run_id) {
@@ -172,8 +176,11 @@ try {
     throw new Error(`Hermes /v1/runs failed: ${status.error || JSON.stringify(status)}`);
   }
 
-  const launch = terminalLaunches.find((event) => event.provider === 'codex' && event.prompt === codexPrompt);
+  const launch = terminalLaunches.find((event) => event.provider === 'codex' && event.startupInput === codexTask);
   assert(launch, `Hermes run completed but did not request Codex launch. Launches: ${JSON.stringify(terminalLaunches)}`);
+  assert.equal(launch.bypassPermissions, true, 'Hermes Codex launch should request provider permission bypass.');
+  assert.equal(launch.skipPermissions, true, 'Hermes Codex launch should carry skipPermissions for providers that use skip flags.');
+  assert.equal(launch.permissionMode, 'bypassPermissions', 'Hermes Codex launch should use bypassPermissions mode.');
   console.log(JSON.stringify({
     ok: true,
     runId: body.run_id,

package/scripts/smoke/hermes-rest-gateway.mjs

@@ -16,7 +16,12 @@ assert.match(service, /export function stopHermesGateway/, 'Pixcode should be ab
 assert.match(service, /\/v1\/chat\/completions/, 'Hermes UI chat should use the documented OpenAI-compatible chat completions endpoint first.');
 assert.match(service, /\/v1\/responses/, 'Hermes UI chat should use the stateful OpenAI-compatible responses endpoint before legacy chat fallback.');
 assert.match(service, /transport:\s*'responses'/, 'Hermes REST responses should report their transport for terminal proof output.');
-assert.match(service, /gatewayArgs[\s\S]+\['gateway', 'run', '--replace'\]/, 'Pixcode should start Hermes gateway in replace mode so an existing gateway does not crash REST chat.');
+assert.match(service, /resolveHermesGatewayHome/, 'Hermes REST gateway should run from a Pixcode-managed Hermes profile.');
+assert.match(service, /seedHermesGatewayHome/, 'Hermes REST gateway should seed the managed profile from the user Hermes profile.');
+assert.match(service, /PIXCODE_HERMES_GATEWAY_HOME/, 'Hermes REST gateway profile path should be overrideable for tests and advanced installs.');
+assert.match(service, /PIXCODE_MANAGED_HERMES_ENV_PREFIXES/, 'Managed Hermes gateway profile should strip messaging platform env vars.');
+assert.match(service, /copyHermesProfileEnv/, 'Managed Hermes gateway profile should copy a sanitized .env instead of raw platform credentials.');
+assert.match(service, /gatewayArgs[\s\S]+\['gateway', 'run', '--replace'\]/, 'Pixcode can use replace mode safely inside its managed Hermes gateway profile.');
 assert.match(service, /gatewayExitMessage/, 'Hermes gateway failures should include recent stderr/stdout instead of only exit code 1.');
 assert.match(service, /API_SERVER_ENABLED:\s*'true'/, 'Hermes gateway env should enable the API server.');
 assert.match(service, /API_SERVER_KEY/, 'Hermes gateway env should set a bearer key.');
@@ -35,11 +40,14 @@ assert.match(routes, /router\.post\('\/gateway\/stop'/, 'Hermes router should ex
 assert.match(routes, /ensureHermesGateway/, 'Hermes router should use the managed gateway service.');
 assert.match(routes, /probeHermesGateway/, 'Hermes router should use the REST probe service.');
 assert.match(routes, /runHermesGatewayPrompt/, 'Hermes router should send chat prompts through the REST gateway service.');
+assert.match(routes, /resolveHermesMcpBaseUrl/, 'Hermes MCP should be configured against the local Pixcode API URL instead of the browser request host.');
+assert.match(routes, /probeExisting:\s*false/, 'Hermes chat should reuse a running gateway instead of killing it on a transient probe failure.');
 
 assert.match(mcpServer, /pixcode_get_hermes_gateway_status/, 'Pixcode MCP should let Hermes inspect gateway status.');
 assert.match(mcpServer, /pixcode_probe_hermes_gateway/, 'Pixcode MCP should let Hermes trigger a REST probe.');
 assert.match(configureMcp, /pixcode_get_hermes_gateway_status/, 'Hermes MCP config should include gateway status tool.');
 assert.match(configureMcp, /pixcode_probe_hermes_gateway/, 'Hermes MCP config should include gateway probe tool.');
+assert.match(configureMcp, /mcp-pixcode/, 'Hermes MCP config should enable the Pixcode MCP toolset for the real CLI.');
 
 assert.match(settingsTab, /gateway\/status/, 'Hermes settings should read gateway status.');
 assert.match(settingsTab, /gateway\/start/, 'Hermes settings should start the REST gateway via API.');

package/scripts/smoke/hermes-settings-commands.mjs

@@ -0,0 +1,166 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+const read = (relativePath) => fs.readFileSync(path.join(repoRoot, relativePath), 'utf8');
+
+const settingsTab = read('src/components/settings/view/tabs/HermesSettingsTab.tsx');
+const settingsModal = read('src/components/settings/view/Settings.tsx');
+const workbench = read('src/components/vscode-workbench/view/VSCodeWorkbench.tsx');
+const serverIndex = read('server/index.js');
+const shellTypes = read('src/components/shell/types/types.ts');
+const shellRuntime = read('src/components/shell/hooks/useShellRuntime.ts');
+const shellConnection = read('src/components/shell/hooks/useShellConnection.ts');
+const shellView = read('src/components/shell/view/Shell.tsx');
+const standaloneShell = read('src/components/standalone-shell/view/StandaloneShell.tsx');
+const hermesRoutes = read('server/modules/orchestration/hermes/hermes.routes.ts');
+const pixcodeMcpServer = read('scripts/hermes/pixcode-mcp-server.mjs');
+
+assert.match(
+  settingsTab,
+  /HERMES_SETTINGS_COMMANDS/,
+  'Hermes settings should define a visible command launcher list.',
+);
+assert.match(settingsTab, /command:\s*'hermes model'/, 'Hermes settings should expose the interactive provider/model wizard.');
+assert.match(settingsTab, /command:\s*'hermes auth'/, 'Hermes settings should expose the credential manager.');
+assert.match(settingsTab, /command:\s*'hermes setup tools'/, 'Hermes settings should expose tool setup.');
+assert.match(settingsTab, /command:\s*'hermes doctor'/, 'Hermes settings should expose diagnostics.');
+assert.match(
+  settingsTab,
+  /pixcode:hermes-terminal[\s\S]+command[\s\S]+title/,
+  'Hermes settings should dispatch command and title to the workbench terminal.',
+);
+assert.match(
+  settingsModal,
+  /<HermesSettingsTab onClose=\{onClose\} \/>/,
+  'Opening a Hermes command from settings should be able to close the settings modal so the terminal is visible.',
+);
+assert.match(
+  workbench,
+  /bottomTerminalCommand/,
+  'Workbench bottom terminal should track the selected Hermes command separately from the mode.',
+);
+assert.match(
+  workbench,
+  /detail:\s*CustomEvent<\{ mode\?: string; command\?: string; title\?: string \}>/,
+  'Workbench should accept Hermes terminal command events from settings.',
+);
+assert.match(
+  workbench,
+  /command=\{hermesCommand\}/,
+  'Hermes bottom terminal should launch the requested Hermes command, not only bare hermes.',
+);
+assert.match(
+  workbench,
+  /HERMES_DEFAULT_COMMAND\s*=\s*'hermes --yolo'/,
+  'Hermes terminal should default to --yolo so Hermes approval prompts do not stop visible work.',
+);
+assert.match(
+  serverIndex,
+  /HERMES_CLI_COMMAND_PATTERN/,
+  'Backend should recognize safe Hermes subcommands for Pixcode MCP setup.',
+);
+assert.doesNotMatch(
+  serverIndex,
+  /command\.trim\(\) === 'hermes'/,
+  'Backend should not limit Pixcode MCP setup to only bare hermes.',
+);
+assert.match(
+  pixcodeMcpServer,
+  /pixcode_read_cli_terminal/,
+  'Pixcode MCP should expose a terminal transcript reader so Hermes can report provider CLI output.',
+);
+assert.match(
+  pixcodeMcpServer,
+  /Use this instead of Hermes shell\/proc\/skill execution/,
+  'Pixcode MCP tool descriptions should explicitly steer Hermes away from non-visible provider proc launches.',
+);
+assert.match(
+  pixcodeMcpServer,
+  /multi-step|piece-by-piece|long-running/i,
+  'Pixcode MCP should tell Hermes to send arbitrary multi-step work as visible provider terminal input.',
+);
+assert.match(
+  pixcodeMcpServer,
+  /startup input typed into the provider CLI/,
+  'Pixcode MCP should describe prompt as real terminal input, not audit text.',
+);
+assert.match(
+  pixcodeMcpServer,
+  /startupInput/,
+  'Pixcode MCP should use startupInput for text typed into provider CLIs.',
+);
+assert.match(
+  pixcodeMcpServer,
+  /audit\/reason text/,
+  'Pixcode MCP should keep prompt as audit text so Hermes does not type explanations into Codex.',
+);
+assert.match(
+  hermesRoutes,
+  /startupInput/,
+  'Hermes terminal launch events should carry startupInput separately from prompt.',
+);
+assert.match(
+  pixcodeMcpServer,
+  /bypassPermissions/,
+  'Pixcode MCP should let Hermes request provider permission bypass for visible work.',
+);
+assert.match(
+  hermesRoutes,
+  /bypassPermissions|skipPermissions/,
+  'Hermes terminal launch events should carry permission bypass state.',
+);
+assert.match(
+  hermesRoutes,
+  /permissionMode/,
+  'Hermes terminal launch events should carry provider permission mode.',
+);
+assert.match(
+  shellTypes,
+  /ShellPermissionOverride/,
+  'Shell types should expose a launch-scoped permission override contract.',
+);
+assert.match(
+  shellRuntime,
+  /permissionOverride/,
+  'Shell runtime should keep launch-scoped permission overrides in refs.',
+);
+assert.match(
+  shellConnection,
+  /permissionOverrideRef/,
+  'Shell websocket init should read launch-scoped permission overrides.',
+);
+assert.match(
+  shellView,
+  /permissionOverride/,
+  'Shell view should accept launch-scoped permission overrides.',
+);
+assert.match(
+  standaloneShell,
+  /permissionOverride/,
+  'Standalone shell should pass launch-scoped permission overrides through to Shell.',
+);
+assert.match(
+  workbench,
+  /terminalPermissionOverride/,
+  'Workbench should apply Hermes launch permission bypass to the provider shell.',
+);
+assert.match(
+  settingsTab,
+  /hermes-agent\.png/,
+  'Hermes settings should use the Hermes logo asset instead of an H glyph.',
+);
+assert.match(
+  workbench,
+  /hermes-agent\.png/,
+  'Workbench Hermes launch surfaces should use the Hermes logo asset instead of an H glyph.',
+);
+assert.match(
+  serverIndex,
+  /\/api\/shell\/sessions\/provider-output/,
+  'Backend should expose recent provider terminal output for Pixcode MCP readback.',
+);
+
+console.log('hermes settings command smoke passed');

package/scripts/smoke/pixcode-workbench-1-48.mjs

@@ -65,10 +65,10 @@ assert.match(workbench, /BOTTOM_TERMINAL_MIN_HEIGHT/, 'Bottom terminal should su
 assert.match(workbench, /isBottomTerminalMinimized/, 'Bottom terminal should support minimizing without closing.');
 assert.match(workbench, /isPlainShell/, 'Bottom terminal should open the selected project folder without starting the selected AI CLI.');
 assert.doesNotMatch(workbench, /HERMES_AGENT_START_COMMAND/, 'Hermes Agent should not launch from the bottom terminal through a server-side sentinel.');
-assert.match(workbench, /HermesApiChatPanel/, 'Hermes Agent should render a REST-backed chat panel in the bottom area.');
-assert.match(workbench, /\/api\/orchestration\/hermes\/gateway\/chat/, 'Hermes chat panel should send prompts through the Pixcode gateway chat API.');
-assert.match(workbench, /HermesTerminalTranscript/, 'Hermes REST panel should render as a terminal transcript, not chat bubbles.');
-assert.match(workbench, /REST POST \//, 'Hermes terminal transcript should show the REST endpoint used for each reply.');
+assert.doesNotMatch(workbench, /HermesApiChatPanel|HermesTerminalTranscript/, 'Hermes Agent should use the real PTY terminal UI, not a custom REST chat transcript.');
+assert.doesNotMatch(workbench, /REST POST \/|transport=|response=|gateway=http/, 'Hermes terminal UI must not expose REST debug internals to the user.');
+assert.match(workbench, /command="hermes"/, 'Hermes Agent bottom panel should launch the actual `hermes` CLI in a PTY.');
+assert.match(workbench, /Pixcode MCP Live/, 'Hermes terminal should show a user-facing Pixcode MCP live badge.');
 assert.doesNotMatch(workbench, /ml-auto border-blue-500\/40 bg-blue-500\/10/, 'Hermes REST panel must not use right-aligned chat bubbles.');
 assert.match(workbench, /terminal-launches\/stream/, 'Hermes CLI launch requests should arrive through an EventSource stream.');
 assert.doesNotMatch(workbench, /HERMES_TERMINAL_LAUNCH_POLL_MS|setInterval\([\s\S]*terminal-launches/, 'Hermes CLI launch requests should not be polled every few seconds.');
@@ -89,6 +89,8 @@ assert.match(serverIndex, /\/api\/shell\/sessions\/terminate/, 'Backend should e
 assert.match(serverIndex, /isPlainShell && !initialCommand/, 'Backend should spawn an interactive plain shell when no terminal command is provided.');
 assert.doesNotMatch(serverIndex, /pixcode:hermes:start/, 'Backend should not need a Hermes terminal sentinel for the workbench Hermes panel.');
 assert.doesNotMatch(serverIndex, /hermesCommand/, 'Provider shell starts should not reference the removed Hermes sentinel variable.');
+assert.match(serverIndex, /configure-pixcode-mcp\.mjs/, 'Hermes PTY launches should configure Pixcode MCP before starting the CLI.');
+assert.match(serverIndex, /resolveHermesMcpBaseUrl/, 'Hermes MCP should use the local Pixcode API base URL from the host process.');
 assert.doesNotMatch(hermesInstallJobs, /iex \(irm https:\/\/raw\.githubusercontent\.com\/NousResearch\/hermes-agent\/main\/scripts\/install\.ps1\)/, 'Windows Hermes install should avoid the old inline iex pattern.');
 assert.doesNotMatch(hermesInstallJobs, /scriptblock\]::Create\(\(irm https:\/\/raw\.githubusercontent\.com\/NousResearch\/hermes-agent\/main\/scripts\/install\.ps1\)\)/, 'Windows Hermes install should avoid scriptblock Invoke-RestMethod eval patterns.');
 assert.match(hermesInstallJobs, /downloadHermesInstaller/, 'Windows Hermes install should download the installer through backend API code before running it.');
@@ -118,12 +120,18 @@ assert.match(hermesRoutes, /createHermesRouter/, 'Hermes should have a dedicated
 assert.match(hermesRoutes, /terminal-launches/, 'Hermes MCP should be able to request visible Pixcode CLI terminal launches.');
 assert.match(hermesRoutes, /terminal-launches\/stream/, 'Hermes MCP terminal launch requests should stream to the workbench over SSE.');
 assert.match(hermesRoutes, /hermesTerminalLaunchEmitter/, 'Hermes terminal launch stream should broadcast new events instead of relying on polling.');
-assert.match(hermesRoutes, /router\.post\('\/gateway\/chat'/, 'Hermes should expose a REST chat endpoint for the bottom panel.');
+assert.match(hermesRoutes, /router\.post\('\/gateway\/chat'/, 'Hermes should still expose a REST chat endpoint for health checks and integrations.');
 assert.match(hermesRoutes, /install-status/, 'Hermes settings and terminal UI should have an install-status endpoint.');
 assert.match(hermesRoutes, /router\.post\('\/install'/, 'Hermes should install through the backend API instead of terminal command paste.');
 assert.match(read('scripts/smoke/hermes-api-install.mjs'), /hermes API install smoke passed/, 'Hermes API install behavior should have a focused smoke test.');
 assert.match(workbench, /terminalStartupInput/, 'Hermes terminal launch prompts should be passed into the selected CLI.');
 assert.match(read('src/components/shell/hooks/useShellConnection.ts'), /startupInputRef/, 'Shell connections should support one-shot startup input for Hermes-triggered CLI work.');
+assert.match(read('src/components/shell/hooks/useShellConnection.ts'), /isCliReadyForStartupInput/, 'Hermes-triggered CLI input should wait until the provider TUI is ready.');
+assert.doesNotMatch(read('src/components/shell/hooks/useShellConnection.ts'), /TERMINAL_INIT_DELAY_MS \* 3/, 'Hermes-triggered CLI input should not be sent on a blind fixed delay.');
+assert.match(shellTerminal, /handleTerminalPaste/, 'Terminal should support browser paste events.');
+assert.match(shellTerminal, /handleCopyPasteShortcut/, 'Terminal should normalize Ctrl/Cmd copy and paste shortcuts.');
+assert.match(shellTerminal, /event\.shiftKey/, 'Terminal should support Ctrl+Shift+C/V style shortcuts.');
+assert.match(shellTerminal, /copyTerminalSelection/, 'Terminal should copy selected terminal text through shortcuts.');
 assert.match(serverIndex, /forceNewSession/, 'Shell backend should support explicit fresh-session launches from the workbench.');
 assert.match(serverIndex, /killProviderPtySessions/, 'Shell backend should terminate old provider PTYs when a fresh CLI session is requested.');
 

package/server/index.js

@@ -390,6 +390,37 @@ function resolvePublicBaseUrl(request) {
     return `${proto}://${String(host).split(',')[0].trim()}`;
 }
 
+function resolveHermesMcpBaseUrl() {
+    const configured = process.env.PIXCODE_INTERNAL_BASE_URL || process.env.PIXCODE_HERMES_BASE_URL;
+    if (configured) return configured.replace(/\/$/, '');
+
+    return `http://127.0.0.1:${process.env.SERVER_PORT || process.env.PORT || '3001'}`;
+}
+
+function quoteBashArg(value) {
+    return `'${String(value).replace(/'/g, "'\\''")}'`;
+}
+
+function quotePowerShellArg(value) {
+    return `"${String(value).replace(/`/g, '``').replace(/\$/g, '`$').replace(/"/g, '`"')}"`;
+}
+
+const HERMES_CLI_COMMAND_PATTERN = /^hermes(?:\s+[A-Za-z0-9._:/=@+-]+)*\s*$/;
+
+function isHermesCliCommand(command) {
+    return typeof command === 'string' && HERMES_CLI_COMMAND_PATTERN.test(command.trim());
+}
+
+function buildHermesCliCommand(command) {
+    const hermesCommand = typeof command === 'string' && command.trim() ? command.trim() : 'hermes';
+    const configureScript = path.join(APP_ROOT, 'scripts', 'hermes', 'configure-pixcode-mcp.mjs');
+    if (os.platform() === 'win32') {
+        return `& ${quotePowerShellArg(process.execPath)} ${quotePowerShellArg(configureScript)} *> $null; ${hermesCommand}`;
+    }
+
+    return `${quoteBashArg(process.execPath)} ${quoteBashArg(configureScript)} >/dev/null 2>&1; exec ${hermesCommand}`;
+}
+
 function getOrCreateHermesApiKey(userId) {
     if (!userId) return null;
 
@@ -492,6 +523,55 @@ app.post('/api/shell/sessions/terminate', authenticateToken, (req, res) => {
     res.json({ success: true, killedSessions });
 });
 
+app.get('/api/shell/sessions/provider-output', authenticateToken, (req, res) => {
+    const provider = String(req.query.provider || 'claude');
+    const projectPath = typeof req.query.projectPath === 'string' && req.query.projectPath.trim()
+        ? req.query.projectPath.trim()
+        : null;
+    const maxChars = Math.min(
+        20000,
+        Math.max(1000, Number.parseInt(String(req.query.maxChars || '12000'), 10) || 12000)
+    );
+
+    if (!SHELL_CLI_PROVIDERS.has(provider)) {
+        return res.status(400).json({ error: 'Unsupported provider' });
+    }
+
+    const requestedProjectPath = projectPath ? path.resolve(projectPath) : null;
+    let matchedSession = null;
+    for (const session of ptySessionsMap.values()) {
+        if (
+            session?.provider === provider &&
+            !session?.isPlainShell &&
+            (!requestedProjectPath || path.resolve(session.projectPath || os.homedir()) === requestedProjectPath)
+        ) {
+            if (!matchedSession || (session.updatedAt || 0) > (matchedSession.updatedAt || 0)) {
+                matchedSession = session;
+            }
+        }
+    }
+
+    if (!matchedSession) {
+        return res.json({
+            active: false,
+            provider,
+            projectPath: requestedProjectPath,
+            output: '',
+            message: 'No active provider terminal session found for this project.',
+        });
+    }
+
+    const rawOutput = matchedSession.buffer.join('').slice(-maxChars);
+    res.json({
+        active: true,
+        provider,
+        projectPath: path.resolve(matchedSession.projectPath || os.homedir()),
+        sessionId: matchedSession.sessionId || null,
+        updatedAt: matchedSession.updatedAt || null,
+        output: stripAnsiSequences(rawOutput),
+    });
+});
+
 // Authentication routes (public)
 app.use('/api/auth', authRoutes);
 
@@ -2182,10 +2262,14 @@ function handleShellConnection(ws, request) {
                 const provider = data.provider || 'claude';
                 const initialCommand = data.initialCommand;
                 const isPlainShell = data.isPlainShell || (!!initialCommand && !hasSession) || provider === 'plain-shell';
+                const isHermesCliLaunch = isPlainShell && isHermesCliCommand(initialCommand);
                 const forceNewSession = Boolean(data.forceNewSession);
                 const shellPermissionMode = normalizeShellPermissionMode(data.permissionMode);
                 const shellSkipPermissions = Boolean(data.skipPermissions);
                 const shellPermissionFlags = buildProviderShellPermissionFlags(provider, shellPermissionMode, shellSkipPermissions);
+                const hermesApiKey = isHermesCliLaunch
+                    ? getOrCreateHermesApiKey(request.user?.id ?? request.user?.userId ?? null)
+                    : null;
                 urlDetectionBuffer = '';
                 announcedAuthUrls.clear();
 
@@ -2314,7 +2398,9 @@ function handleShellConnection(ws, request) {
                     let shellCommand;
                     if (isPlainShell) {
                         // Plain shell mode without an initial command must stay interactive.
-                        shellCommand = initialCommand || null;
+                        shellCommand = isHermesCliLaunch
+                            ? buildHermesCliCommand(initialCommand)
+                            : initialCommand || null;
                     } else if (provider === 'cursor') {
                         const command = buildProviderShellCommand('cursor-agent', shellPermissionFlags);
                         if (hasSession && sessionId) {
@@ -2429,6 +2515,11 @@ function handleShellConnection(ws, request) {
                         TERM: 'xterm-256color',
                         COLORTERM: 'truecolor',
                         FORCE_COLOR: '3',
+                        ...(isHermesCliLaunch ? {
+                            PIXCODE_BASE_URL: resolveHermesMcpBaseUrl(),
+                            PIXCODE_API_KEY: hermesApiKey || '',
+                            PIXCODE_APP_ROOT: APP_ROOT,
+                        } : {}),
                     });
 
                     shellProcess = pty.spawn(shell, shellArgs, {
@@ -2451,12 +2542,14 @@ function handleShellConnection(ws, request) {
                         provider,
                         isPlainShell,
                         keepAliveUntilExit: false,
+                        updatedAt: Date.now(),
                     });
 
                     // Handle data output
                     shellProcess.onData((data) => {
                         const session = ptySessionsMap.get(ptySessionKey);
                         if (!session) return;
+                        session.updatedAt = Date.now();
 
                         if (session.buffer.length < 5000) {
                             session.buffer.push(data);

package/server/modules/orchestration/hermes/hermes.routes.ts

@@ -29,6 +29,10 @@ type HermesTerminalLaunchEvent = {
   provider: string;
   projectPath: string | null;
   prompt: string | null;
+  startupInput: string | null;
+  permissionMode: string | null;
+  skipPermissions: boolean;
+  bypassPermissions: boolean;
   source: string;
   createdAt: string;
 };
@@ -60,6 +64,13 @@ function readUserId(req: PixcodeRequest) {
   return req.user?.id ?? req.user?.userId ?? null;
 }
 
+function resolveHermesMcpBaseUrl() {
+  const configured = process.env.PIXCODE_INTERNAL_BASE_URL || process.env.PIXCODE_HERMES_BASE_URL;
+  if (configured) return configured.replace(/\/$/, '');
+
+  return `http://127.0.0.1:${process.env.SERVER_PORT ?? process.env.PORT ?? '3001'}`;
+}
+
 function readAfterId(req: Request) {
   const after = Number.parseInt(typeof req.query.after === 'string' ? req.query.after : '0', 10);
   return Number.isFinite(after) ? after : 0;
@@ -73,6 +84,24 @@ function rememberHermesTerminalLaunch(event: HermesTerminalLaunchEvent) {
   hermesTerminalLaunchEmitter.emit('terminal-launch', event);
 }
 
+function readTrimmedString(value: unknown) {
+  return typeof value === 'string' && value.trim() ? value.trim() : null;
+}
+
+function readBoolean(value: unknown) {
+  return value === true || value === 'true' || value === '1';
+}
+
+function isLegacyPromptLikelyStartupInput(prompt: string | null) {
+  if (!prompt || prompt.length > 160 || prompt.includes('\n')) return false;
+  if (/^[/:!@]/u.test(prompt)) return true;
+  if (prompt.includes(':')) return false;
+  if (/\b(user|request|reason|audit|task|kullanıcı|kullanicinin|istek|isteği|gorev|görev|terminal|codex|claude|qwen|gemini|cursor|opencode|open|aç|ac|başlat|baslat|send|gönder|gonder)\b/iu.test(prompt)) {
+    return false;
+  }
+  return prompt.length <= 80;
+}
+
 export function createHermesRouter(options: HermesRouterOptions = {}): Router {
   const router = express.Router();
 
@@ -137,7 +166,7 @@ export function createHermesRouter(options: HermesRouterOptions = {}): Router {
       const gateway = await ensureHermesGateway({
         appRoot: options.appRoot ?? process.cwd(),
         pixcodeApiKey: apiKey,
-        pixcodeBaseUrl: options.resolvePublicBaseUrl?.(req) ?? `http://127.0.0.1:${process.env.SERVER_PORT ?? process.env.PORT ?? '3001'}`,
+        pixcodeBaseUrl: resolveHermesMcpBaseUrl(),
         projectPath: typeof body.projectPath === 'string' ? body.projectPath : undefined,
       });
       res.status(202).json(gateway);
@@ -172,7 +201,7 @@ export function createHermesRouter(options: HermesRouterOptions = {}): Router {
         await ensureHermesGateway({
           appRoot: options.appRoot ?? process.cwd(),
           pixcodeApiKey: apiKey,
-          pixcodeBaseUrl: options.resolvePublicBaseUrl?.(req) ?? `http://127.0.0.1:${process.env.SERVER_PORT ?? process.env.PORT ?? '3001'}`,
+          pixcodeBaseUrl: resolveHermesMcpBaseUrl(),
           projectPath: projectPath ?? undefined,
         });
       }
@@ -224,8 +253,9 @@ export function createHermesRouter(options: HermesRouterOptions = {}): Router {
       const gateway = await ensureHermesGateway({
         appRoot: options.appRoot ?? process.cwd(),
         pixcodeApiKey: apiKey,
-        pixcodeBaseUrl: options.resolvePublicBaseUrl?.(req) ?? `http://127.0.0.1:${process.env.SERVER_PORT ?? process.env.PORT ?? '3001'}`,
+        pixcodeBaseUrl: resolveHermesMcpBaseUrl(),
         projectPath,
+        probeExisting: false,
       });
       const run = await runHermesGatewayPrompt(projectPath, {
         input,
@@ -272,7 +302,7 @@ export function createHermesRouter(options: HermesRouterOptions = {}): Router {
       appRoot: options.appRoot ?? process.cwd(),
       force: Boolean(body.force),
       pixcodeApiKey: apiKey,
-      pixcodeBaseUrl: options.resolvePublicBaseUrl?.(req) ?? `http://127.0.0.1:${process.env.SERVER_PORT ?? process.env.PORT ?? '3001'}`,
+      pixcodeBaseUrl: resolveHermesMcpBaseUrl(),
       skipBrowser: body.skipBrowser !== false,
     });
 
@@ -440,15 +470,23 @@ export function createHermesRouter(options: HermesRouterOptions = {}): Router {
     const projectPath = typeof body.projectPath === 'string' && body.projectPath.trim()
       ? body.projectPath.trim()
       : null;
-    const prompt = typeof body.prompt === 'string' && body.prompt.trim()
-      ? body.prompt.trim()
-      : null;
+    const prompt = readTrimmedString(body.prompt ?? body.reason);
+    const requestedStartupInput = readTrimmedString(body.startupInput ?? body.input);
+    const startupInput = requestedStartupInput ?? (isLegacyPromptLikelyStartupInput(prompt) ? prompt : null);
+    const bypassPermissions = readBoolean(body.bypassPermissions);
+    const skipPermissions = readBoolean(body.skipPermissions) || bypassPermissions;
+    const requestedPermissionMode = readTrimmedString(body.permissionMode);
+    const permissionMode = requestedPermissionMode ?? (skipPermissions ? 'bypassPermissions' : null);
 
     const event: HermesTerminalLaunchEvent = {
       id: nextHermesTerminalLaunchId,
       provider,
       projectPath,
       prompt,
+      startupInput,
+      permissionMode,
+      skipPermissions,
+      bypassPermissions,
       source: 'hermes-mcp',
       createdAt: new Date().toISOString(),
     };