docs: CHANGELOG stage-359 — close v0.51.65 (stage-358), open Unreleased for 17-PR stage-359 with proper attribution

CHANGELOG.md

@@ -2,24 +2,51 @@
 
 ## [Unreleased]
 
+### Added
+
+- **PR #2287** by @mslovy (refs #2284) — Upload size limit is now runtime-configurable via the `HERMES_WEBUI_MAX_UPLOAD_MB` environment variable. Previously the effective 20 MB cap was hard-coded across multiple layers. Server-side upload limit moves to runtime config; browser-side preflight check stays aligned with the effective backend limit; archive extraction guard continues to scale with the same configured cap. New `_env_mb_bytes()` helper in `api/config.py` parses `HERMES_WEBUI_MAX_UPLOAD_MB`.
+
+- **PR #2291** by @linuxid10t — New "Nous Research" skin option in the Settings → Appearance picker, inspired by [nousresearch.com](https://nousresearch.com). Monospace typography, steel blue (#4682B4) accent, cool gray text, sharp 1-2px corners, thin dashed borders, technical aesthetic.
+
+- **PR #2301** by @franksong2702 (fixes #2289) — Cron detail Prompt and Output panels now have explicit expand/collapse controls in addition to the default capped scroll view. User preference (per-panel) persists across sessions. Narrow accordion-style expansion, not drag-resize, per maintainer direction.
+
+- **PR #2303** by @franksong2702 (fixes #2246) — New per-turn assistant question jump button in the assistant message footer. Allows quick navigation back to the user question that started a long answer. Desktop-only, hidden during live streaming.
+
 ### Fixed
 
-- Docker startup no longer fails when a bind-mounted `~/.hermes/hermes-agent/.git/objects` tree contains read-only git object packs. The root init ownership pass now skips that git object subtree while still chowning the rest of `/home/hermeswebui`, so macOS Docker Desktop bind mounts can start WebUI without requiring writable ownership over agent git internals (fixes #2237).
+- **PR #2275** by @ai-ag2026 — CLI/messaging continuation sessions (sessions stitched from a `parent_session_id` chain) now return their full transcript instead of an empty list. Pre-fix, `get_cli_session_messages()` called `_is_continuation_session()` while walking the parent chain, but `api/models.py` didn't import that helper. The exception was swallowed by `except Exception: return []`, so valid external sessions could fall through silently. Adds regression coverage that a stitched continuation chain returns a non-empty transcript.
 
-- Context-compression snapshot preservation now clears archived parent runtime fields (`active_stream_id`, `pending_user_message`, attachments, and start timestamp) before saving the old session id. This prevents a completed continuation session from leaving its parent looking permanently active/running after compression.
+- **PR #2277** by @eleboucher — Rootless container runtimes (k8s `runAsNonRoot: true`, OpenShift restricted SCC, `docker --user`, rootless Podman) no longer hit a cascade of permission errors at startup. Pre-fix, the rootless branch skipped the root init phase entirely, but root init also did rsync, `/uv_cache` permissions, `~/hermeswebui` home directory creation, and `/workspace` writability. `docker_init.bash` now distinguishes "no root init available" from "root init available but skipped", running the work that doesn't need root in the rootless branch too.
+
+- **PR #2280** by @franksong2702 (closes #2276 — partial) — Adds missing Italian and French translations for `settings_label_fade_text_effect` + `settings_desc_fade_text_effect` (added in v0.51.65 PR #2099). Also extends the i18n parity regression test from covering only `provider_quota_*` keys to also cover settings labels/descriptions, so future PRs that add a new setting label automatically fail CI if they skip a locale.
+
+- **PR #2281** by @franksong2702 (refs #2260) — Onboarding DNS probe now classifies failures consistently as `dns` for `socket.gaierror`, `URLError`/`OSError` wrappers around DNS failures, and reserved non-resolvable TLDs (`.local`, `.invalid`, `.test`, `.example`). Pre-fix, real platform/proxy stacks that wrapped DNS failures as generic exceptions were misreported as `unreachable`. Maintainer direction on #2260 was to tighten product classification rather than relax the e2e test.
+
+- **PR #2282** by @franksong2702 (refs #2264) — Update summary parsing now keeps "unknown-prefix" bullets like `Caveat:` or `Important:` as regular notice bullets instead of silently dropping them. Pre-fix, once the LLM returned at least one recognized `Notice:` bullet, other unrecognized-prefix bullets fell through and disappeared (only the empty-notice fallback at api/updates.py:466 caught them, which never fired when notice_items was non-empty). Preserves existing sentence-splitting fallback for plain prose responses.
+
+- **PR #2285** by @dso2ng (closes #2230 — partial) — Pre-compression snapshots (preserved by PR #2227's compression rotation fix) are no longer shown as duplicate active sidebar rows. Adds a `Session.pre_compression_snapshot` marker; backend stamps it when saving the archived old_sid; sidebar projection in `api/models.py` filters out marker-tagged snapshots from active rows. JSON stays on disk for lineage traversal so the snapshot is still recoverable. Resolves the long-running #2230 follow-up about preserved snapshots accumulating in the sidebar.
+
+- **PR #2288** by @linuxid10t — Theme/skin no longer reset to server defaults on page refresh when the appearance autosave POST silently fails (network glitch, transient error). Pre-fix, the async boot IIFE in `boot.js` unconditionally overwrote `localStorage` with whatever `settings.json` had on the server. Now `localStorage` wins when it has a non-default theme/skin and the autosave is known to have failed.
+
+- **PR #2293** by @franksong2702 (fixes #2237) — Docker startup no longer fails when a bind-mounted `~/.hermes/hermes-agent/.git/objects` tree contains read-only git object packs. The root init ownership pass now skips that git object subtree while still chowning the rest of `/home/hermeswebui`. macOS Docker Desktop bind mounts can now start WebUI without requiring writable ownership over agent git internals.
+
+- **PR #2295** by @ai-ag2026 — Context-compression snapshot preservation now clears archived parent runtime fields (`active_stream_id`, `pending_user_message`, `pending_attachments`, `pending_started_at`) before saving the old session id. Pre-fix, a completed continuation session could leave its archived parent looking permanently active/running after compression (sidebar showed the parent as if it had a live in-flight turn). Continuation session's live state is restored from saved locals after the snapshot write so the active turn is not affected. Stage-359 maintainer fix integrated this runtime-clearing into the `_preserve_pre_compression_snapshot()` helper from #2285 — both PRs touch the same compression rotation block.
+
+- **PR #2296** by @Jordan-SkyLF — Offline/recovery banner now follows the active theme palette via `--warning-*` tokens instead of mixing warning colors with a hard-coded `--bg-1` fallback. Light/custom skins (Sienna, Poseidon, etc.) no longer show a banner that looks detached from the selected palette. Behavior-neutral: offline detection and recovery flow unchanged.
+
+- **PR #2300** by @franksong2702 (refs #2240) — `_has_new_assistant_reply()` shrink-case detection in `api/streaming.py` now returns `False` instead of scanning all messages when `len(result_messages) < prev_count`. Pre-fix, an older assistant reply could hide the current turn's silent-failure banner if the agent dropped history mid-turn. Fail-closed in the exotic shrink case; normal appended-message path unchanged.
+
+- **PR #2302** by @franksong2702 (closes #2240 — partial, refs #749 follow-up) — Profile create API now validates `default_model` / `model_provider` against `/api/models` server-side, returning 400 on invalid values instead of writing them to the new profile's config.yaml. Pre-fix, ordinary browser users were protected by the picker, but hand-crafted API requests could create a profile that looked valid until the agent later tried to resolve a nonexistent model.
+
+- **PR #2306** by @dobby-d-elf — iPhone PWA mobile shell no longer renders broken/unusable. Restores the pre-#2238 iPhone PWA viewport contract by removing the global `viewport-fit=cover` shell change, returning standalone top safe-area scoping, and restoring the proven mobile composer padding. Keeps the useful phone-sidebar improvements from #2238 while scoping its 44px `panel-icon-btn` sizing to sidebar controls so the workspace header no longer collapses on narrow panels. Mobile workspace panel header refined into two rows. Tested on both Desktop and iOS.
+
+## [v0.51.65] — 2026-05-14 — Release AO (stage-358 — 2-PR held-PR clearance — #2099 opt-in streaming text fade + #2165 pooled Codex quota status)
 
 ### Added
 
-- Cron detail prompt and output panels now have expand/collapse controls that
-  remove the inner scroll cap and remember the expanded state per job/run.
+- **PR #2099** by @dobby-d-elf — Adds an opt-in `Settings → Preferences → Fade text effect` toggle (off by default). When enabled, newly streamed output tokens are revealed through an adaptive playout buffer and animated with an opacity-only fade similar to ChatGPT and other frontier LLM apps. Fade locked per stream to avoid mid-stream toggle rewind; reduced-motion users get non-animated text; live cursor hidden while fade is active; custom renderer on `streaming-markdown` parser wraps only newly-appended words; animated spans replace themselves with plain text on `animationend` (event-delegated, no listener leakage); unsafe streamed `href`/`src` values blocked via allowlist regex (rejects `javascript:`, `data:`, `vbscript:`). 200-350ms fade duration scaling with playback speed, 16ms word stagger, 320ms done-drain cap, 160 wps visual cap. Default-off means existing users see no change. 293-line regression test pinning the contract.
 
-- **PR #2099** by @dobby-d-elf — Adds an opt-in `Settings → Preferences → Fade text effect` toggle (off by default). When enabled, newly streamed output tokens are revealed through an adaptive playout buffer and animated with an opacity-only fade similar to ChatGPT and other frontier LLM apps. Implementation details: fade locked per stream to avoid mid-stream toggle rewind; reduced-motion users get non-animated text; live cursor hidden while fade is active; custom renderer on `streaming-markdown` parser wraps only newly-appended words; animated spans replace themselves with plain text on `animationend` (no long-lived wrapper buildup in long responses); unsafe streamed `href`/`src` values blocked in fade renderer `set_attr` path. Performance tuning: 200ms base fade duration scaling to 350ms for fast output, 16ms word stagger, 320ms done-drain wait cap, 160 wps visual cap, max 2-3 words/frame, brief pauses after sentence punctuation. Default-off means existing users see no change. 293-line regression test pinning the contract.
-
-- **PR #2165** by @starship-s — Pooled OpenAI Codex quota status surfaced in the Providers panel. Pre-fix, the Providers page presented Codex quota as if there were only one credential/account state, which was misleading when users authenticate through a credential pool with several usable credentials, temporarily exhausted credentials, failed probes, and different reset windows. Now the active provider quota card includes a credential-pool summary (available / exhausted / failed / checked counts), displays the best currently-available pool windows in the collapsed view as "Best of N", and exposes per-credential detail behind an expandable section. Exhausted credentials are intentionally NOT re-probed while their cooldown is active (matches credential-pool selection behavior, avoids generating failed quota calls from a status page). Manual refresh still means "probe now" but transient refresh failures preserve the last known-good snapshot. JWT decode (`_decode_jwt_claims_unverified`) is used only for token-shape classification (Codex OAuth JWT vs raw OpenAI API key), explicitly NOT for authorization — documented in the function docstring. Per-row plan labels only shown when verified account-limit data is available. Concurrent probing capped at `min(_CODEX_POOL_MAX_WORKERS=6, len(probe_items))` so page render time stays bounded on large pools. Transient `None` probe results are NOT cached (only known unavailable/exhausted states are cached); 32-test regression suite covering pool snapshot, concurrent probe, JWT detection, cache invalidation, transient-vs-known cache distinction, and i18n parity across all currently-supported locales. Scoped to OpenAI Codex (the only provider with the credential-pool/account-limit path needed to surface this accurately).
-
-### Fixed
-
-- Settings i18n parity now covers every `settings_label_*` and `settings_desc_*` key referenced by `static/index.html`. Adds the missing Italian and French translations for the Fade text effect preference and cleans up existing settings-key parity drift in Portuguese and Traditional Chinese locale blocks.
+- **PR #2165** by @starship-s — Pooled OpenAI Codex quota status surfaced in the Providers panel. Collapsed view shows "Best of N" pool summary (available / exhausted / failed / checked counts); expandable per-credential rows. Concurrent probing capped at `min(_CODEX_POOL_MAX_WORKERS=6, len(probe_items))`. Exhausted credentials NOT re-probed during cooldown. Manual refresh = "probe now", but transient `None` probe results are NOT cached (preserves last-known-good warm snapshot); only known-exhausted snapshot objects are cached. JWT decode (`_decode_jwt_claims_unverified`) is documented as classification-only (Codex OAuth JWT vs raw OpenAI API key), explicitly NOT for authorization. Per-row plan labels only shown when verified account-limit data is available. 32-test regression suite + 11-locale i18n parity assertion.
 
 ## [v0.51.64] — 2026-05-14 — Release AN (stage-357 — 3-PR small batch — docker_init k8s whoami fallback + PWA manifest session routes (closes #2226) + aux title test coverage)