* Fix Windows bundled Hermes CLI launcher
* Update kanban service tests for Hermes process wrapper
---------
Co-authored-by: xingzhi <chuzihao.czh@alibaba-inc.com>
Profile avatars are sent to /profiles/:name/avatar as base64 image data
URLs in a JSON body. The handler allows up to 1MB of raw image data,
which is ~1.37MB once base64-encoded — larger than @koa/bodyparser's
default 1mb jsonLimit, so uploads were rejected with HTTP 413 before
reaching the handler.
Set jsonLimit/textLimit to 4mb, leaving the handler's own 1MB raw-size
check as the authoritative limit (now returning a clear 400 instead of
a confusing 413).
Co-authored-by: xingzhi <chuzihao.czh@alibaba-inc.com>
Provider auth controllers derived the credential directory with
`authPath.substring(0, authPath.lastIndexOf('/'))`. On Windows paths use
backslashes, so `lastIndexOf('/')` returns -1 and the slice yields an
empty string, making `mkdirSync('')` throw
`ENOENT: no such file or directory, mkdir ''` during OAuth login.
Replace the manual slicing with the cross-platform `path.dirname()` in
codex-auth (auth.json + codex CLI token paths), xai-auth, and nous-auth.
Fixes Codex/xAI/Nous login on Windows.
Co-authored-by: xingzhi <chuzihao.czh@alibaba-inc.com>
* Add desktop packaging workflow
* Add desktop package homepage
* Fix desktop default credential prompt
* Suppress default credential prompt on desktop
* Publish desktop artifacts on release; reduce CI to PR smoke test
Add desktop-release.yml triggered on release publish (mirroring
docker-publish.yml) to build all platforms and upload .dmg/.exe/
.AppImage/.deb to the GitHub Release.
Trim build.yml desktop job to a PR-only Linux x64 smoke test, since
release artifacts are now produced by desktop-release.yml. This drops
per-push and macOS/Windows packaging from regular CI.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Fix desktop Hermes data home on Windows
---------
Co-authored-by: xingzhi <chuzihao.czh@alibaba-inc.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Adds an opt-in environment variable to suppress the npm-registry update
check. When set, three things change:
1. checkLatestVersion() returns immediately (no outbound fetch)
2. startVersionCheck() does not arm the 30-minute interval
3. /api/health returns webui_latest='' and webui_update_available=false
Use case: hermes-web-ui is bundled inside a packaged distribution like
a desktop app where the user cannot `npm install -g hermes-web-ui@latest`
to apply an upgrade. The 'update available' prompt is then misleading
(the user would have to wait for the wrapper app to ship a new release),
and the recurring HTTPS call to the npm registry is unnecessary noise.
Set HERMES_WEB_UI_DISABLE_UPDATE_CHECK=true | 1 | on | yes to disable.
The default behavior is unchanged.
Discussed in #1091 — proposed by @EKKOLearnAI.
