* fix(tui): persist gateway lifecycle breadcrumbs to crash log A backend SIGTERM (`=== SIGTERM received ===` in tui_gateway_crash.log) is always a parent action — `gw.kill()` (graceful-exit on a signal to Node, or an explicit /quit) or `start()` replacing a live child. #31051 added parent-side lifecycle breadcrumbs but left them in an in-memory CircularBuffer that dies with the process, so SIGTERM crash reports arrive with no parent context and no way to tell a signal-driven kill from a memory-critical `process.exit(137)` (which closes the child's stdin → clean EOF, not SIGTERM). Persist the death-explaining breadcrumbs (spawn / transport-exit / child-exit / replace-live-child / kill-reason / startup-timeout) plus the graceful-exit signal name and the memory-critical exit into the same crash log the Python side writes, so they interleave by timestamp next to the child's panic entry — making these recurring reports diagnosable. Gated off under VITEST so unit tests stay hermetic. * feat(tui): auto-recover the session when the gateway dies unexpectedly When a still-owned gateway child dies while the TUI is alive (a crash, OOM process.exit, or a SIGTERM/SIGHUP forwarded to it), the app currently nulls the session and drops to an inert "gateway exited" state — the user loses a long session and has to restart + re-run everything. That single behavior is most of the "TUI doesn't survive heavy work" complaint, independent of what does the killing. The 'exit' event only reaches this handler on an *unexpected* death: a user /quit calls process.exit before it fires, and a replaced child is identity- skipped in GatewayClient. So on exit we now respawn the gateway and resume the session that was live (history is persisted in SQLite) via a one-shot recoverSidRef the next gateway.ready consults before forging a new session. The in-flight reply is lost (it died with the process) but the session survives. Bounded to GATEWAY_RECOVERY_LIMIT (3) attempts per GATEWAY_RECOVERY_WINDOW_MS (60s) so a gateway that crash-loops on startup can't spawn-storm; past the budget we fall back to the inert state. * fix(tui): sanitize newlines + soften SIGTERM-cause claim in parentLog Address PR review: - recordParentLifecycle collapses embedded \r\n so a multi-line value (e.g. an error message) stays a single breadcrumb and can't masquerade as a separate entry or as the child's panic output sharing the crash log. - Reword the header: a backend SIGTERM is *usually* a parent action but can come straight from an external supervisor (s6, cgroup OOM, stray kill); the presence/absence of a [tui-parent] line before the child's panic is precisely what disambiguates the two. * fix(tui): clear sid during recovery + extract/test the recovery budget Address PR review: - Null `sid` immediately in the gateway exit handler. While the gateway is down (busy=false) the old sid would otherwise let sid-guarded effects (the 1.5s session.active_list poll, queue drain) fire RPCs at a dead/respawning gateway. recoverSidRef carries the session forward; resumeById restores sid on ready. - Extract the respawn budget into a pure evalRecovery() (gatewayRecovery.ts) and unit-test the bound: allows GATEWAY_RECOVERY_LIMIT within the window, blocks past it, and prunes attempts older than the window so recovery re-arms. * fix(tui): cap parent-log breadcrumb length (PR review) Truncate a single persisted breadcrumb to 4096 chars (matching GatewayClient's in-memory log-line cap) so a pathological value — e.g. a giant error string — can't bloat the shared crash log or add noticeable blocking on the synchronous append during a failure path. Covered by a test. * fix(tui): keep "recovering session…" status visible during resume (PR review) resumeById() synchronously sets status to 'resuming…' on entry, so the recovery branch now applies its 'recovering session…' label *after* calling resumeById — the distinct label sticks for the duration of the resume RPC (which later flips to 'ready') instead of being immediately clobbered. Test updated to assert the ordering. * fix(tui): keep recovery budget alive across a startup crash-loop (PR review) deadSid was read from getUiState().sid, which the first exit nulls — so if the respawned gateway crash-looped before gateway.ready (resumeById never restored sid), later exits saw null and abandoned the session after a single attempt, defeating the bounded retry budget. Lift the whole decision into a pure planGatewayRecovery() that falls back to the pending recoverSidRef target when the live sid is already cleared, and unit-test the crash-loop sequence (keeps retrying the same session up to the limit, then falls back to inert). Supersedes evalRecovery. * chore(tui): drop non-null assertion + clarify breadcrumb cap comment (PR review) - Recovery branch guards on `recoverSidRef && recoverSid` so the ref write needs no `!` assertion (avoids a future unsafe refactor). - Reword the parentLog cap comment: it slices the value to 4096 chars and appends a short truncation marker (so the written line is slightly longer), rather than implying a strict 4096-byte limit. * chore(tui): soften "absence ⇒ external signal" + "any in-flight reply" (PR review) - parentLog header: a missing [tui-parent] line only *suggests* an external signal (the logger is best-effort: VITEST-disabled, failed append swallowed), not a definitive conclusion. - Recovery notice says "any in-flight reply was lost" since the gateway can also exit while idle.
Hermes TUI
React + Ink terminal UI for Hermes. TypeScript owns the screen. Python owns sessions, tools, model calls, and most command logic.
hermes --tui
What runs
The client entrypoint is src/entry.tsx. It exits early if stdin is not a TTY, starts GatewayClient, then renders App.
GatewayClient spawns:
python -m tui_gateway.entry
Interpreter resolution order is: HERMES_PYTHON → PYTHON → $VIRTUAL_ENV/bin/python → ./.venv/bin/python → ./venv/bin/python → python3 (or python on Windows).
The transport is newline-delimited JSON-RPC over stdio:
ui-tui/src tui_gateway/
----------- -------------
entry.tsx entry.py
-> GatewayClient -> request loop
-> App -> server.py RPC handlers
stdin/stdout: JSON-RPC requests, responses, events
stderr: captured into an in-memory log ring
Malformed stdout lines are treated as protocol noise and surfaced as gateway.protocol_error. Stderr lines become gateway.stderr. Neither writes directly into the terminal.
Running it
From the repo root, the normal path is:
hermes --tui
The CLI expects ui-tui/dist/entry.js to exist, or the whole source code available in which to run npm install and npm run dev.
cd ui-tui
npm install
Local package commands:
npm run dev
npm start
npm run build
npm run lint
npm run fmt
npm run fix
Tests use vitest:
npm test # single run
npm run test:watch
App model
src/app.tsx is the center of the UI. Heavy logic is split into src/app/:
createGatewayEventHandler.ts— maps gateway events to state updatescreateSlashHandler.ts— local slash command dispatchuseComposerState.ts— draft, multiline buffer, queue editinguseInputHandlers.ts— keypress routinguseTurnState.ts— agent turn lifecycleoverlayStore.ts/uiStore.ts— nanostores for overlay and UI stategatewayContext.tsx— React context for the gateway clientconstants.ts,helpers.ts,interfaces.ts
The top-level app.tsx composes these into the Ink tree with Static transcript output, a live streaming assistant row, prompt overlays, queue preview, status rule, input line, and completion list.
State managed at the top level includes:
- transcript and streaming state
- queued messages and input history
- session lifecycle
- tool progress and reasoning text
- prompt flows for approval, clarify, sudo, and secret input
- slash command routing
- tab completion and path completion
- theme state from gateway skin data
The UI renders as a normal Ink tree with Static transcript output, a live streaming assistant row, prompt overlays, queue preview, status rule, input line, and completion list.
The intro panel is driven by session.info and rendered through branding.tsx.
Hotkeys and interactions
Current input behavior is split across app.tsx, components/textInput.tsx, and the prompt/picker components.
Main chat input
| Key | Behavior |
|---|---|
Enter |
Submit the current draft |
empty Enter twice |
If queued messages exist and the agent is busy, interrupt the current run. If queued messages exist and the agent is idle, send the next queued message |
Shift+Enter / Alt+Enter |
Insert a newline in the current draft |
\ + Enter |
Append the line to the multiline buffer (fallback for terminals without modifier support) |
Ctrl+C |
Interrupt active run, or clear the current draft, or exit if nothing is pending |
Ctrl+D |
Exit |
Cmd/Ctrl+G / Alt+G |
Open $EDITOR with the current draft (use Alt+G in VSCode/Cursor — they bind the primary keystroke to Find Next) |
Ctrl+L |
New session (same as /clear) |
Ctrl+V / Alt+V |
Paste text first, then fall back to image/path attachment when applicable |
Tab |
Apply the active completion |
Up/Down |
Cycle completions if the completion list is open; otherwise edit queued messages first, then walk input history |
Left/Right |
Move the cursor |
modified Left/Right |
Move by word when the terminal sends Ctrl or Meta with the arrow key |
Home / Ctrl+A |
Start of line |
End / Ctrl+E |
End of line |
Backspace |
Delete the character to the left of the cursor |
Delete |
Delete the character to the right of the cursor |
modified Backspace |
Delete the previous word |
modified Delete |
Delete the next word |
Ctrl+W |
Delete the previous word |
Ctrl+U |
Delete from the cursor back to the start of the line |
Ctrl+K |
Delete from the cursor to the end of the line |
Meta+B / Meta+F |
Move by word |
!cmd |
Run a shell command through the gateway |
{!cmd} |
Inline shell interpolation before send; queued drafts keep the raw text until they are sent |
Notes:
Tabonly applies completions when completions are present and you are not in multiline mode.- Queue/history navigation only applies when you are not in multiline mode.
PgUp/PgDnare left to the terminal emulator; the TUI does not handle them.
Prompt and picker modes
| Context | Keys | Behavior |
|---|---|---|
| approval prompt | Up/Down, Enter |
Move and confirm the selected approval choice |
| approval prompt | o, s, a, d |
Quick-pick once, session, always, deny |
| approval prompt | Esc, Ctrl+C |
Deny |
| clarify prompt with choices | Up/Down, Enter |
Move and confirm the selected choice |
| clarify prompt with choices | single-digit number | Quick-pick the matching numbered choice |
| clarify prompt with choices | Enter on "Other" |
Switch into free-text entry |
| clarify free-text mode | Enter |
Submit typed answer |
| sudo / secret prompt | Enter |
Submit typed value |
| sudo / secret prompt | Ctrl+C |
Cancel by sending an empty response |
| resume picker | Up/Down, Enter |
Move and resume the selected session |
| resume picker | 1-9 |
Quick-pick one of the first nine visible sessions |
| resume picker | Esc, Ctrl+C |
Close the picker |
Notes:
- Clarify free-text mode and masked prompts use
ink-text-input, so text editing there follows the library's default bindings rather thancomponents/textInput.tsx. - When a blocking prompt is open, the main chat input hotkeys are suspended.
- Clarify mode has no dedicated cancel shortcut in the current client. Sudo and secret prompts only expose
Ctrl+Ccancellation from the app-level blocked handler.
Interaction rules
- Plain text entered while the agent is busy is queued instead of sent immediately.
- Slash commands and
!cmddo not queue; they execute immediately even while a run is active. - Queue auto-drains after each assistant response, unless a queued item is currently being edited.
Up/Downprioritizes queued-message editing over history. History only activates when there is no queue to edit.- Queued drafts keep their original
!cmdand{!cmd}text while you edit them. Shell commands and interpolation run when the queued item is actually sent. - If you load a queued item into the input and resubmit plain text, that queue item is replaced, removed from the queue preview, and promoted to send next. If the agent is still busy, the edited item is moved to the front of the queue and sent after the current run completes.
- Completion requests are debounced by 60 ms. Input starting with
/usescomplete.slash. A trailing token that starts with./,../,~/,/, or@usescomplete.path. - Text pastes are inserted inline directly into the draft. Nothing is newline-flattened.
Cmd/Ctrl+G(orAlt+Gin VSCode/Cursor, which intercept the primary keystroke for Find Next) writes the current draft, including any multiline buffer, to a temp file, suspends Ink, launches$EDITOR, then restores the TUI and submits the saved text if the editor exits cleanly.- Input history is stored in
~/.hermes/.hermes_historyor underHERMES_HOME.
Rendering
Assistant output is rendered in one of two ways:
- if the payload already contains ANSI,
messageLine.tsxprints it directly - otherwise
components/markdown.tsxrenders a small Markdown subset into Ink components
The Markdown renderer handles headings, lists, block quotes, tables, fenced code blocks, diff coloring, inline code, emphasis, links, and plain URLs.
Tool/status activity is shown in a live activity lane. Transcript rows stay focused on user/assistant turns.
Prompt flows
The Python gateway can pause the main loop and request structured input:
approval.request: allow once, allow for session, allow always, or denyclarify.request: pick from choices or type a custom answersudo.request: masked password entrysecret.request: masked value entry for a named env varsession.list: used bySessionPickerfor/resume
These are stateful UI branches in app.tsx, not separate screens.
Commands
The local slash handler covers the built-ins that need direct client behavior:
/help/quit,/exit,/q/clear/new/compact/resume/copy/paste/details/logs/statusbar,/sb/queue/undo/retry
Notes:
/copysends the selected assistant response through OSC 52./pastewith no args asks the gateway to attach a clipboard image.- Text paste remains inline-only;
Cmd+V/Ctrl+Vhandle layered text/OSC52/image fallback before/pasteis needed. /details [hidden|collapsed|expanded|cycle]controls thinking/tool-detail visibility./statusbartoggles the status rule on/off.
Anything else falls through to:
slash.execcommand.dispatch
That lets Python own aliases, plugins, skills, and registry-backed commands without duplicating the logic in the TUI.
Event surface
Primary event types the client handles today:
| Event | Payload |
|---|---|
gateway.ready |
{ skin? } |
session.info |
session metadata for banner + tool/skill panels |
message.start |
start assistant streaming |
message.delta |
{ text, rendered? } |
message.complete |
{ text, rendered?, usage, status } |
thinking.delta |
{ text } |
reasoning.delta |
{ text } |
reasoning.available |
{ text } |
status.update |
{ kind, text } |
tool.start |
{ tool_id, name, context? } |
tool.progress |
{ name, preview } |
tool.complete |
{ tool_id, name } |
clarify.request |
{ question, choices?, request_id } |
approval.request |
{ command, description } |
sudo.request |
{ request_id } |
secret.request |
{ prompt, env_var, request_id } |
background.complete |
{ task_id, text } |
error |
{ message } |
gateway.stderr |
synthesized from child stderr |
gateway.protocol_error |
synthesized from malformed stdout |
Theme model
The client starts with DEFAULT_THEME from theme.ts, then merges in gateway skin data from gateway.ready.
Current branding overrides:
- agent name
- prompt symbol
- welcome text
- goodbye text
Current color overrides:
- banner title, accent, border, body, dim
- label, ok, error, warn
branding.tsx uses those values for the logo, session panel, and update notice.
File map
ui-tui/
packages/hermes-ink/ forked Ink renderer (local dep)
src/
entry.tsx TTY gate + render()
app.tsx top-level Ink tree, composes src/app/*
gatewayClient.ts child process + JSON-RPC bridge
theme.ts default palette + skin merge
constants.ts display constants, hotkeys, tool labels
types.ts shared client-side types
banner.ts ASCII art data
app/
createGatewayEventHandler.ts event → state mapping
createSlashHandler.ts local slash dispatch
useComposerState.ts draft + multiline + queue editing
useInputHandlers.ts keypress routing
useTurnState.ts agent turn lifecycle
overlayStore.ts nanostores for overlays
uiStore.ts nanostores for UI flags
gatewayContext.tsx React context for gateway client
constants.ts app-level constants
helpers.ts pure helpers
interfaces.ts internal interfaces
components/
appChrome.tsx status bar, input row, completions
appLayout.tsx top-level layout composition
appOverlays.tsx overlay routing (pickers, prompts)
branding.tsx banner + session summary
markdown.tsx Markdown-to-Ink renderer
maskedPrompt.tsx masked input for sudo / secrets
messageLine.tsx transcript rows
modelPicker.tsx model switch picker
prompts.tsx approval + clarify flows
queuedMessages.tsx queued input preview
sessionPicker.tsx session resume picker
textInput.tsx custom line editor
thinking.tsx spinner, reasoning, tool activity
hooks/
useCompletion.ts tab completion (slash + path)
useInputHistory.ts persistent history navigation
useQueue.ts queued message management
useVirtualHistory.ts in-memory history for pickers
lib/
history.ts persistent input history
messages.ts message formatting helpers
osc52.ts OSC 52 clipboard copy
rpc.ts JSON-RPC type helpers
text.ts text helpers, ANSI detection, previews
types/
hermes-ink.d.ts type declarations for @hermes/ink
__tests__/ vitest suite
Related Python side:
tui_gateway/
entry.py stdio entrypoint
server.py RPC handlers and session logic
render.py optional rich/ANSI bridge
slash_worker.py persistent HermesCLI subprocess for slash commands