Hermes Bot ba6f34488e fix(onboarding,probe): refuse HTTP redirects on probe path (reviewer-flagged on PR #1501) ...

SSRF defense-in-depth: `urllib.request.urlopen` follows redirects by default,
so a probe at `http://example.com/v1/models` could be redirected to
`http://internal-service:8080/admin` — surfacing internal HTTP services to
the authenticated user. The probe is already gated behind WebUI auth and the
local-network check, so the practical attack surface is 'authenticated user
enumerating internal services' (same as `curl` from their browser DevTools).
Tightening the redirect default is cheap insurance.

Implementation:

- New module-level `_NoRedirectHandler` (subclasses `urllib.request.HTTPRedirectHandler`,
  overrides `redirect_request` to return None — urllib then raises `HTTPError(3xx)`
  rather than following).
- New module-level `_PROBE_OPENER = urllib.request.build_opener(_NoRedirectHandler())`.
- `probe_provider_endpoint` switches from `urlopen(req, …)` to `_PROBE_OPENER.open(req, …)`.
- The existing `HTTPError` handler now categorizes 3xx as `unreachable` with a
  detail string mentioning 'redirect' so the user understands what happened.
  3xx does NOT get its own error code in `PROBE_ERROR_CODES` — the error
  taxonomy contract stays the same shape (frontend i18n unchanged).

Added regression test `test_probe_does_not_follow_redirects` in
`tests/test_issue1499_onboarding_probe.py`. Spins up a tiny HTTP server that
302-redirects `/v1/models` to `/different-endpoint` (which would return
`{'data': [{'id': 'should-not-see'}]}` if followed). Asserts the probe
returns `{ok: False, error: 'unreachable', status: 302, detail: …'redirect'…}`
and that the 'should-not-see' string never appears in the result.

Mutation-verified: reverting `_PROBE_OPENER.open` back to `urlopen` causes
the test to fail with "Probe followed a redirect — should have refused".

Suite delta: 3917 → 3918 passing (+1).

Reviewer-flagged in PR #1501. Per the
'reviewer-flagged-fix-in-release-not-followup' policy: <20 LOC defensive
fix, regression test path obvious, ship in this release rather than punting.

2026-05-03 03:21:22 +00:00

..

__init__.py

Hermes WebUI v0.1.0 — initial public release

2026-03-30 20:40:19 -07:00

_pytest_port.py

fix(tests): restore conftest default model in test_default_model_updates_hermes_config — fixes CI ordering failure

2026-04-21 02:25:14 +00:00

conftest.py

fix: validate WebUI launcher can import agent

2026-05-02 19:32:21 +00:00

test_465_session_branching.py

fix: address PR #1405 review feedback — security, voice loop, locale coverage, test fixes

2026-05-01 15:54:27 +00:00

test_499_tts_playback.py

fix: TTS toggle CSS specificity collision (#1409) + Ollama env var bleed (#1410)

2026-05-01 17:14:51 +00:00

test_745_code_block_newlines.py

v0.50.218: chat bubble overflow, project color picker, blockquote renderer (#1085)

2026-04-25 23:08:59 -07:00

test_779_html_preview.py

v0.50.216: compression chains, renderer fixes, HTML preview, approval z-index, /steer fix, reasoning chip (#1075)

2026-04-25 21:06:31 -07:00

test_886_ordered_list_numbering.py

fix(renderer): ordered list items always showed 1. — emit value= on each li (#886) (#904)

2026-04-23 12:15:56 -07:00

test_1003_appearance_autosave.py

release: v0.50.241 (#1293)

2026-04-29 19:54:07 -07:00

test_1003_preferences_autosave.py

fix(autosave): guard preferences-autosave dirty-clear when password/model pending (Opus SHOULD-FIX Q1)

2026-04-30 22:48:20 +00:00

test_1038_pwa_auth_redirect.py

release: v0.50.244 (#1308)

2026-04-29 21:34:27 -07:00

test_1044_mermaid_csp_font.py

v0.50.210: gpt-5.5, cron titles, agent cache, bfcache fix, onboarding fix, mermaid CSP, PWA auth (#1056)

2026-04-25 15:47:44 -07:00

test_1045_bfcache_layout_restore.py

fix: restore inflight session on bfcache pageshow

2026-05-03 01:53:01 +08:00

test_1058_adaptive_title_refresh.py

v0.50.211: compact timestamps, adaptive title refresh, settings picker fix (#1061)

2026-04-25 17:50:58 -07:00

test_1059_settings_picker_active_state.py

v0.50.211: compact timestamps, adaptive title refresh, settings picker fix (#1061)

2026-04-25 17:50:58 -07:00

test_1062_busy_input_modes.py

ui: reflect explicit busy slash command in send button

2026-04-29 04:31:55 +00:00

test_1079_cron_session_project.py

test: bump locale-count assertions for new ja locale (8 -> >=8/9)

2026-05-02 02:50:40 +00:00

test_1325_user_fenced_code.py

feat(chat): render fenced code blocks in user messages (#1325)

2026-04-30 16:18:02 +00:00

test_1432_newchat_and_1423_profile_input.py

fix: new-chat guard ignores in-flight streams (#1432) + profile form auto-capitalizes typed values (#1423)

2026-05-02 00:52:41 +00:00

test_1466_bfcache_inflight_reattach.py

fix: restore inflight session on bfcache pageshow

2026-05-03 01:53:01 +08:00

test_1466_sidebar_cancel_clarify.py

fix: add sidebar cancel for running sessions

2026-05-03 08:46:36 +08:00

test_app_titlebar_restore.py

fix(ui): restore rail-era app titlebar state (v0.50.226) (#1163)

2026-04-27 11:43:32 -07:00

test_approval_card_layering.py

Refine embedded terminal card entrypoint

2026-04-29 04:37:31 +00:00

test_approval_queue.py

fix(approval): close SSE notify-ordering, head-fidelity, and trailing-approval gaps (Opus MUST-FIX A/C/D)

2026-04-30 18:45:15 +00:00

test_approval_sse.py

fix(approval): close SSE notify-ordering, head-fidelity, and trailing-approval gaps (Opus MUST-FIX A/C/D)

2026-04-30 18:45:15 +00:00

test_approval_unblock.py

fix(tests): auto-derive unique port+state-dir per worktree (fixes parallel pytest)

2026-04-14 19:04:48 +00:00

test_auth_session_persistence.py

v0.50.211: compact timestamps, adaptive title refresh, settings picker fix (#1061)

2026-04-25 17:50:58 -07:00

test_auth_sessions.py

fix(auth): prune expired sessions on every verify to prevent memory leak (#196)

2026-04-09 18:05:23 -07:00

test_auto_compression_card.py

fix: batch triage — 12 contributor PRs (v0.50.227) (#1168)

2026-04-27 13:34:59 -07:00

test_background_tasks.py

fix(background): wire completion hook + keep running tasks in tracker

2026-04-24 01:32:47 +00:00

test_batch_fixes.py

release: v0.50.241 (#1293)

2026-04-29 19:54:07 -07:00

test_blockquote_rendering.py

v0.50.218: chat bubble overflow, project color picker, blockquote renderer (#1085)

2026-04-25 23:08:59 -07:00

test_bootstrap_dotenv.py

fix: bootstrap.py loads REPO_ROOT/.env so direct invocation matches start.sh (#730) (#791)

2026-04-20 20:55:53 -07:00

test_bootstrap_foreground.py

test(bootstrap): widen ensure_python_has_webui_deps stub for rebase onto v0.50.269

2026-05-02 19:35:42 +00:00

test_bootstrap_python_selection.py

test(bootstrap): skip venv.EnvBuilder.create() in fail-loud test

2026-05-02 19:45:54 +00:00

test_bugbatch_apr2026.py

v0.50.209: check-for-updates, workspace toggle, HTML preview, provider categories, queue flyout docs (#1042)

2026-04-25 14:33:41 -07:00

test_byok_model_dropdown.py

fix(settings): show live models in default model picker and apply to new chats (#872) (#900)

2026-04-23 09:58:15 -07:00

test_byte_range_parser.py

release: v0.50.241 (#1293)

2026-04-29 19:54:07 -07:00

test_cancel_interrupt.py

fix(streaming): eagerly release session lock in cancel_stream() (#778)

2026-04-20 23:54:40 +00:00

test_chinese_locale.py

fix(i18n): restore zh-Hant locale labels

2026-04-30 15:24:31 +00:00

test_clarify_sse.py

feat(clarify): SSE long-connection for real-time clarify notifications (#1355)

2026-04-30 21:32:51 +00:00

test_clarify_unblock.py

fix: preserve clarify drafts on timeout

2026-04-29 04:32:40 +00:00

test_cli_only_slash_commands.py

Intercept CLI-only slash commands in WebUI (#1382)

2026-05-01 04:46:30 +00:00

test_cmd_dropdown_scroll_838.py

fix(ui): scroll selected item into view on slash command dropdown keyboard navigation (closes #838)

2026-04-21 22:55:09 -07:00

test_cmd_idle_fallback.py

v0.50.217: /queue /interrupt /steer send normally when agent is idle (#1077)

2026-04-25 21:35:51 -07:00

test_commands_endpoint.py

feat: slash command parity + skill autocomplete — v0.50.91 (PR #711)

2026-04-19 05:37:44 +00:00

test_credential_pool_providers.py

release: v0.50.151 — credential_pool provider detection + Ollama Cloud support (PR #820 by @starship-s)

2026-04-22 20:18:02 +00:00

test_cron_manual_run_persistence.py

fix: persist manual cron run results (#1372)

2026-04-30 23:15:31 +00:00

test_cron_needs_attention.py

v0.50.225: cron attention, image lightbox, pytest isolation (#1137)

2026-04-26 21:04:38 -07:00

test_cron_refresh_button_835.py

refactor(ui): three-column layout with left rail + main-view migration (#899)

2026-04-24 09:05:25 -07:00

test_cron_run_job_import.py

fix(cron): import run_job inside _run_cron_tracked to fix NameError (#1310)

2026-04-30 15:24:30 +00:00

test_cron_session_title.py

v0.50.210: gpt-5.5, cron titles, agent cache, bfcache fix, onboarding fix, mermaid CSP, PWA auth (#1056)

2026-04-25 15:47:44 -07:00

test_csv_table_rendering.py

test: bump locale-count assertions for new ja locale (8 -> >=8/9)

2026-05-02 02:50:40 +00:00

test_custom_provider_display_name.py

v0.50.257: 4 Opus pre-release follow-ups + CHANGELOG + test fixes for #1415

2026-05-01 18:30:41 +00:00

test_custom_providers_in_panel.py

fix: address review feedback — restore V3 as legacy, fix zai base_url

2026-04-29 04:31:16 +00:00

test_default_workspace_fallback.py

v0.50.225: cron attention, image lightbox, pytest isolation (#1137)

2026-04-26 21:04:38 -07:00

test_embedded_workspace_terminal.py

Restore terminal resize and collapse controls

2026-04-29 16:45:26 +08:00

test_empty_session_no_disk_write.py

fix(models): defer first save() until session has real state (v0.50.230) (#1185)

2026-04-27 16:44:07 -07:00

test_excalidraw_inline_embed.py

test: bump locale-count assertions for new ja locale (8 -> >=8/9)

2026-05-02 02:50:40 +00:00

test_extension_hooks.py

stage-265: test fix + CHANGELOG for v0.50.265

2026-05-02 03:42:58 +00:00

test_font_size_setting.py

fix(appearance): font size setting now visibly scales UI text (closes #843)

2026-04-21 23:39:39 -07:00

test_gateway_sync.py

fix: expose session lineage metadata in API (#1370)

2026-04-30 23:04:49 +00:00

test_ime_composition.py

v0.50.264 polish followups: i18n parity + assistant-output readability

2026-05-02 04:19:28 +00:00

test_inflight_stream_reuse.py

test: tighten inflight stream reuse invariants

2026-05-02 22:29:14 +08:00

test_issue341.py

feat(theme): replace color scheme system with light/dark + accent skins (PR #627 by @aronprins)

2026-04-18 06:37:09 +00:00

test_issue342.py

fix(test): extend renderMd window to 15000 chars (renderMd grew with diff+tree viewers)

2026-04-29 04:39:50 +00:00

test_issue347.py

fix(ui+pwa): avoid stale Mermaid render errors and bust cached static asset URLs on every release

2026-04-30 16:18:01 +00:00

test_issue357.py

fix: add --chown to Dockerfile COPY so RUN can write api/_version.py (#793)

2026-04-20 21:03:41 -07:00

test_issue401.py

fix: harden _accepts_gzip + update stale test assertions post-#959 (#981)

2026-04-24 11:41:17 -07:00

test_issue467_yolo_mode_toggle.py

fix+feat: batch v0.50.236 — OAuth providers fix, profile switch UX, YOLO mode (#1211)

2026-04-27 22:56:12 -07:00

test_issue470.py

fix(renderer): backtick code spans inside bold/italic no longer get esc'd

2026-04-14 21:14:00 +00:00

test_issue477.py

fix(csp): allow cdn.jsdelivr.net for font-src so KaTeX fonts load (fixes #477)

2026-04-14 21:14:33 +00:00

test_issue483_inline_diff_viewer.py

test: bump locale-count assertions for new ja locale (8 -> >=8/9)

2026-05-02 02:50:40 +00:00

test_issue484_json_tree_viewer.py

feat: collapsible JSON/YAML tree viewer (#484)

2026-04-29 04:34:26 +00:00

test_issue486_487.py

fix: code-in-table CSS sizing + markdown image rendering (#486, #487)

2026-04-14 21:52:34 +00:00

test_issue487b.py

fix(review): 4 issues found in agent review of PR #535

2026-04-16 00:00:22 +00:00

test_issue492_workspace_reorder.py

feat: workspace drag-to-reorder (#492)

2026-04-29 04:33:24 +00:00

test_issue538_mcp_management.py

fix: protect secrets from masked-value round-trip overwrite (#1237)

2026-04-29 04:34:55 +00:00

test_issue569_579.py

feat(ui): add sidebar density mode to session list (#764)

2026-04-20 19:43:40 +00:00

test_issue570_permission.py

fix: catch OSError from SETTINGS_FILE.exists() — Docker UID-mismatch 500 crash (#614)

2026-04-16 20:16:07 -07:00

test_issue572.py

v0.50.210: gpt-5.5, cron titles, agent cache, bfcache fix, onboarding fix, mermaid CSP, PWA auth (#1056)

2026-04-25 15:47:44 -07:00

test_issue603_provider_categories.py

v0.50.209: check-for-updates, workspace toggle, HTML preview, provider categories, queue flyout docs (#1042)

2026-04-25 14:33:41 -07:00

test_issue604_all_providers_model_picker.py

Fix MiniMax China provider visibility

2026-04-29 15:50:32 +08:00

test_issue607.py

fix(streaming): strip Gemma 4 thinking token delimiter in all paths — closes #607

2026-04-18 06:45:39 +00:00

test_issue609.py

fix: HERMES_WEBUI_DEFAULT_WORKSPACE wins over settings.json; trust DEFAULT_WORKSPACE subtree (#610)

2026-04-16 18:09:16 -07:00

test_issue616.py

refactor(ui): three-column layout with left rail + main-view migration (#899)

2026-04-24 09:05:25 -07:00

test_issue632.py

feat(reasoning): full /reasoning CLI parity — show|hide + effort levels via config.yaml (#812)

2026-04-21 15:26:52 -07:00

test_issue634.py

v0.50.207: batch of 10 PRs — TPS stat, SSE guard, session polish, cron UX, folder create, model errors, session speed, title gen (#1031)

2026-04-25 13:07:35 -07:00

test_issue644.py

v0.50.209: check-for-updates, workspace toggle, HTML preview, provider categories, queue flyout docs (#1042)

2026-04-25 14:33:41 -07:00

test_issue646.py

fix(config): default model empty string — no unavailable OpenAI model for non-OpenAI users — closes #646 (PR #649)

2026-04-18 06:46:43 +00:00

test_issue660.py

fix(ui): persist session queue to sessionStorage across page refresh (#768)

2026-04-20 23:04:09 +00:00

test_issue673.py

feat(ui): add sidebar density mode to session list (#764)

2026-04-20 19:43:40 +00:00

test_issue677.py

fix: streaming scroll override, Gemini 3.x models, read-only workspace, two-container UID — v0.50.87 (closes #677 #669 #670 #668)

2026-04-18 17:09:59 +00:00

test_issue739_652_653.py

fix(streaming): quota error detection, error persistence, stream_end session_id fix (#767)

2026-04-20 22:48:19 +00:00

test_issue744.py

fix(ui): restrict edit to latest user message (#747)

2026-04-19 23:11:49 -07:00

test_issue765_streaming_persistence.py

test: stabilize flaky checkpoint test + add regression for #1339 fallback list

2026-04-30 16:20:05 +00:00

test_issue781.py

fix(ui): hide duplicate close button in workspace header at mobile width (#783)

2026-04-21 00:58:02 +00:00

test_issue789.py

fix: batch v0.50.229 — session perf, ephemeral sessions, iOS zoom (#1183)

2026-04-27 16:27:03 -07:00

test_issue798.py

fix(cancel-stream): rename tool_calls to _partial_tool_calls (Opus MUST-FIX)

2026-04-30 23:43:23 +00:00

test_issue803.py

fix: correct webui profile switching state — v0.50.150 (PR #849 by @migueltavares)

2026-04-22 16:27:01 +00:00

test_issue840_slash_echo.py

fix(ui): slash command input now echoed as user message in chat (closes #840)

2026-04-21 23:08:24 -07:00

test_issue852_thinking_card_mirror.py

fix: thinking card no longer mirrors main response — v0.50.154 (closes #852)

2026-04-22 20:21:42 +00:00

test_issue854_live_model_prefix.py

fix(settings): show live models in default model picker and apply to new chats (#872) (#900)

2026-04-23 09:58:15 -07:00

test_issue856_active_session_read_state.py

fix(sessions): preserve unread dots after compression

2026-04-29 04:31:14 +00:00

test_issue856_background_completion_unread.py

fix(sessions): preserve unread dots after compression

2026-04-29 04:31:14 +00:00

test_issue856_pinned_indicator_layout.py

fix: address PR #1405 review feedback — security, voice loop, locale coverage, test fixes

2026-05-01 15:54:27 +00:00

test_issue856_session_streaming_state.py

Fix session list pending message payload

2026-05-03 01:44:38 +08:00

test_issue893_cancel_preserves_partial.py

fix(cancel): preserve partial streamed response on Stop Generation (#893) (#902)

2026-04-23 11:16:59 -07:00

test_issue895_894_nous_prefix.py

fix(models): preserve @nous: prefix in settings + fix cross-namespace 404 for Nous (#895 #894) (#901)

2026-04-23 10:44:10 -07:00

test_issue926_hindsight_docker_dependency.py

v0.50.224: legacy @provider session models, Docker Hindsight dependency (#1131)

2026-04-26 18:47:38 -07:00

test_issue1014_model_not_found.py

v0.50.207: batch of 10 PRs — TPS stat, SSE guard, session polish, cron UX, folder create, model errors, session speed, title gen (#1031)

2026-04-25 13:07:35 -07:00

test_issue1094_provider_bugs.py

v0.50.222: Korean locale, provider fixes, reasoning chip boot, Prism SRI (#1119)

2026-04-26 14:24:20 -07:00

test_issue1095_pasted_images.py

release: v0.50.240

2026-04-29 17:42:32 -07:00

test_issue1096_copy_buttons.py

fix(ui): avoid duplicate header copy buttons (#1096)

2026-04-30 15:24:32 +00:00

test_issue1097_workspace_drag_drop.py

v0.50.223: model picker, idle retry, drag-drop, CSP, clipboard copy (#1127)

2026-04-26 15:29:02 -07:00

test_issue1100_prism_sri.py

v0.50.222: Korean locale, provider fixes, reasoning chip boot, Prism SRI (#1119)

2026-04-26 14:24:20 -07:00

test_issue1103_reasoning_chip_visibility.py

fix: anchor active sessions per browser tab

2026-05-01 19:52:05 +08:00

test_issue1105_ssrf_custom_providers.py

v0.50.221: copy HTTP fix, inline images, mobile tap, custom providers x2 (#1117)

2026-04-26 10:36:59 -07:00

test_issue1106_custom_providers_models.py

v0.50.257: 4 Opus pre-release follow-ups + CHANGELOG + test fixes for #1415

2026-05-01 18:30:41 +00:00

test_issue1112_csp_google_fonts.py

v0.50.223: model picker, idle retry, drag-drop, CSP, clipboard copy (#1127)

2026-04-26 15:29:02 -07:00

test_issue1116_composer_placeholder.py

v0.50.223: model picker, idle retry, drag-drop, CSP, clipboard copy (#1127)

2026-04-26 15:29:02 -07:00

test_issue1118_idle_session_retry.py

v0.50.223: model picker, idle retry, drag-drop, CSP, clipboard copy (#1127)

2026-04-26 15:29:02 -07:00

test_issue1139_password_remote.py

release: v0.50.241 (#1293)

2026-04-29 19:54:07 -07:00

test_issue1140_cron_badge_per_job.py

fix: batch triage — 12 contributor PRs (v0.50.227) (#1168)

2026-04-27 13:34:59 -07:00

test_issue1144_session_time_sync.py

test: stabilize session time bucket boundary

2026-04-29 04:31:36 +00:00

test_issue1154_fenced_code_leak.py

fix: batch v0.50.231 — macOS symlink bypass, workspace panel, fenced code leak (#1194)

2026-04-27 17:43:36 -07:00

test_issue1164_env_file_corruption.py

fix: batch v0.50.228 — renderer, model race, tool card, empty session, .env (#1179)

2026-04-27 15:28:19 -07:00

test_issue1188_fuzzy_match.py

fix: batch v0.50.232 — fuzzy match, codex detection, workspace reload, timestamp sync (#1198)

2026-04-27 18:40:13 -07:00

test_issue1189_openai_codex_detection.py

fix: batch v0.50.232 — fuzzy match, codex detection, workspace reload, timestamp sync (#1198)

2026-04-27 18:40:13 -07:00

test_issue1195_session_profile_routing.py

Revert PR #1342's test_issue1195 rewrite — del sys.modules corrupts shared module state

2026-05-01 05:35:24 +00:00

test_issue1202_oauth_provider_status.py

fix+feat: batch v0.50.236 — OAuth providers fix, profile switch UX, YOLO mode (#1211)

2026-04-27 22:56:12 -07:00

test_issue1217_transcript_compaction.py

Preserve transcript across context compaction

2026-04-29 16:37:08 +08:00

test_issue1228_model_picker_duplicate_ids.py

fix(models): default model rehydration when providers share slash-qualified IDs (#1313)

2026-04-30 15:24:35 +00:00

test_issue1298_cancel_and_activity.py

fix(cancel): gate substring guard on pending_started_at timestamp (Opus review)

2026-04-30 16:28:20 +00:00

test_issue1360_streaming_scroll_hardening.py

Harden streaming scroll unpin behavior (#1360) (#1377)

2026-05-01 04:46:12 +00:00

test_issue1361_cancel_data_loss.py

fix(cancel-stream): rename tool_calls to _partial_tool_calls (Opus MUST-FIX)

2026-04-30 23:43:23 +00:00

test_issue1384_local_provider.py

Heal 'provider: local' mid-conversation crash for local-model users (#1388, fixes #1384)

2026-05-01 05:29:42 +00:00

test_issue1413_li_path_coverage.py

fix: register 5 missing Lucide icons (TTS speaker + queue chevron + insights cards) (#1413)

2026-05-01 17:57:34 +00:00

test_issue1420_lmstudio_provider_env_var.py

fix(onboarding,providers): probe LM Studio /models + align env var with agent CLI (#1499 #1500)

2026-05-03 02:46:24 +00:00

test_issue1431_toolsets_chip_responsive.py

Apply Opus pre-release fixes: dropdown resize guard + display:block

2026-05-02 00:21:15 +00:00

test_issue1436_context_indicator_load_path.py

fix: context-window indicator broken on older sessions (#1436)

2026-05-02 01:43:00 +00:00

test_issue1438_fence_anchoring.py

fix(renderer): line-anchor fence regex to prevent mid-line ``` corruption (#1438)

2026-05-02 02:30:20 +00:00

test_issue1443_ime_helper_promotion.py

v0.50.264 polish followups: i18n parity + assistant-output readability

2026-05-02 04:19:28 +00:00

test_issue1446_glued_heading_lift.py

v0.50.264 polish followups: i18n parity + assistant-output readability

2026-05-02 04:19:28 +00:00

test_issue1447_heading_hierarchy.py

v0.50.264 polish followups: i18n parity + assistant-output readability

2026-05-02 04:19:28 +00:00

test_issue1488_composer_voice_buttons.py

fix(composer): distinct voice-mode icon, descriptive labels, opt-in pref (#1488)

2026-05-02 22:16:23 +00:00

test_issue1494_state_db_fd_leak.py

fix(sqlite): close state.db connections explicitly to stop FD leak in sidebar polling (#1494)

2026-05-03 01:15:26 +00:00

test_issue1499_keyless_onboarding.py

fix(onboarding): allow keyless setup for self-hosted providers (#1499 third sub-bug)

2026-05-03 03:07:07 +00:00

test_issue1499_onboarding_probe.py

fix(onboarding,probe): refuse HTTP redirects on probe path (reviewer-flagged on PR #1501)

2026-05-03 03:21:22 +00:00

test_issue1500_lmstudio_env_var_alignment.py

fix(onboarding,providers): probe LM Studio /models + align env var with agent CLI (#1499 #1500)

2026-05-03 02:46:24 +00:00

test_issue_code_syntax_highlight.py

fix: batch v0.50.231 — macOS symlink bypass, workspace panel, fenced code leak (#1194)

2026-04-27 17:43:36 -07:00

test_issues_373_374_375.py

fix(streaming): quota error detection, error persistence, stream_end session_id fix (#767)

2026-04-20 22:48:19 +00:00

test_issues_853_857.py

v0.50.225: cron attention, image lightbox, pytest isolation (#1137)

2026-04-26 21:04:38 -07:00

test_issues_907_908_909_model_dropdown.py

fix(models): duplicate dropdown entries, stale default model, lowercase injected label (#907 #908 #909) (#918)

2026-04-23 14:41:06 -07:00

test_japanese_locale.py

test: pr1441 IME helper guards + pr1439 ja locale parity

2026-05-02 02:44:59 +00:00

test_korean_locale.py

fix: update Korean locale test to match renamed i18n key

2026-05-01 22:55:46 +08:00

test_language_precedence.py

fix i18n review comments and locale test robustness

2026-04-14 17:14:01 +00:00

test_live_models_ttl_cache.py

Cache /api/models/live with 60s TTL (#1378)

2026-05-01 04:46:15 +00:00

test_login_locale_parity.py

v0.50.264 polish followups: i18n parity + assistant-output readability

2026-05-02 04:19:28 +00:00

test_login_locale.py

feat: add full Russian (ru-RU) localization — v0.50.95 (PR #713)

2026-04-19 06:47:24 +00:00

test_media_inline.py

release: v0.50.241 (#1293)

2026-04-29 19:54:07 -07:00

test_minimax_provider.py

Fix MiniMax China provider visibility

2026-04-29 15:50:32 +08:00

test_mobile_layout.py

fix: new-chat guard ignores in-flight streams (#1432) + profile form auto-capitalizes typed values (#1423)

2026-05-02 00:52:41 +00:00

test_model_cache_metadata.py

release: v0.50.241 (#1293)

2026-04-29 19:54:07 -07:00

test_model_picker_badges.py

fix: add configured model group label

2026-04-30 23:45:46 -06:00

test_model_resolver.py

Fix MiniMax China provider visibility

2026-04-29 15:50:32 +08:00

test_model_scope_copy.py

Clarify model scope in composer and settings

2026-04-29 04:33:29 +00:00

test_native_image_attachments.py

tests: add regression tests + magic-byte image validation for native image attachments

2026-04-29 17:01:01 +08:00

test_norm_model_id_trailing_empty_guard.py

chore(release): stamp v0.50.267 — 7 contributor PR batch + Opus follow-up

2026-05-02 17:03:25 +00:00

test_nous_portal_routing.py

fix: Nous static models use @nous: prefix — v0.50.164 (#885)

2026-04-22 22:56:21 -07:00

test_ollama_model_chip_label_regression.py

release: v0.50.151 — credential_pool provider detection + Ollama Cloud support (PR #820 by @starship-s)

2026-04-22 20:18:02 +00:00

test_onboarding_existing_config.py

v0.50.225: cron attention, image lightbox, pytest isolation (#1137)

2026-04-26 21:04:38 -07:00

test_onboarding_mvp.py

fix(tests): auto-derive unique port+state-dir per worktree (fixes parallel pytest)

2026-04-14 19:04:48 +00:00

test_onboarding_network.py

fix(tests): auto-derive unique port+state-dir per worktree (fixes parallel pytest)

2026-04-14 19:04:48 +00:00

test_onboarding_static.py

fix(ui+pwa): avoid stale Mermaid render errors and bust cached static asset URLs on every release

2026-04-30 16:18:01 +00:00

test_opencode_providers.py

release: v0.50.240

2026-04-29 17:42:32 -07:00

test_orphaned_tool_messages.py

fix: strip orphaned tool messages before sending history to API (fixes #534)

2026-04-15 16:57:31 +00:00

test_parallel_session_switch.py

fix: _loadOlderMessages scrolls to bottom instead of preserving position

2026-04-29 04:30:55 +00:00

test_pdf_html_preview.py

release: v0.50.240

2026-04-29 17:42:32 -07:00

test_pr1318_context_length_fallback.py

fix(streaming): fallback to model_metadata for context_length when compressor missing (#1318 follow-up) (#1348)

2026-04-30 10:27:56 -07:00

test_pr1339_fallback_providers_list.py

test: stabilize flaky checkpoint test + add regression for #1339 fallback list

2026-04-30 16:20:05 +00:00

test_pr1341_context_window_persistence.py

fix(streaming): fallback to model_metadata for context_length when compressor missing (#1318 follow-up) (#1348)

2026-04-30 10:27:56 -07:00

test_pr1350_sse_atomic_subscribe.py

release: v0.50.248

2026-04-30 18:34:37 +00:00

test_pr1350_sse_notify_correctness.py

fix(approval): close SSE notify-ordering, head-fidelity, and trailing-approval gaps (Opus MUST-FIX A/C/D)

2026-04-30 18:45:15 +00:00

test_pr1355_sse_handler_no_deadlock.py

fix(clarify-sse): inline snapshot under _lock to avoid deadlock in handler

2026-04-30 14:39:37 -07:00

test_pr1366_finalize_thinking_card_guard.py

release: v0.50.250

2026-04-30 22:27:40 +00:00

test_pr1370_lineage_metadata_perf_and_orphan.py

fix: nest child sessions under lineage roots

2026-05-02 12:09:36 +08:00

test_pr1375_partial_tool_calls_sanitize.py

fix(cancel-stream): rename tool_calls to _partial_tool_calls (Opus MUST-FIX)

2026-04-30 23:43:23 +00:00

test_pr1441_ime_safari_guard.py

Opus pre-release follow-up: blur resets _imeComposing flag

2026-05-02 02:56:48 +00:00

test_pr1445_opus_followups.py

Opus pre-release follow-ups for PR #1445

2026-05-02 03:49:40 +00:00

test_profile_default_workspace_823.py

fix(workspace): _profileDefaultWorkspace persists after newSession() (#823)

2026-04-21 19:14:31 -07:00

test_profile_env_isolation.py

fix(ci): eliminate test_set_key flakiness — v0.50.161

2026-04-23 02:09:37 +00:00

test_profile_path_security.py

fix(ci): eliminate test_set_key flakiness — v0.50.161

2026-04-23 02:09:37 +00:00

test_profile_switch_1200.py

fix: batch v0.50.234-235 — XSS hardening, workspace validation, profile switch fixes (#1206)

2026-04-27 21:39:30 -07:00

test_profile_switch_ux.py

fix+feat: batch v0.50.236 — OAuth providers fix, profile switch UX, YOLO mode (#1211)

2026-04-27 22:56:12 -07:00

test_profile_terminal_env.py

release: v0.50.240

2026-04-29 17:42:32 -07:00

test_project_chip_ui.py

v0.50.219: project chip context menu + input auto-sizing (#1087)

2026-04-25 23:28:29 -07:00

test_provider_management.py

fix: TTS toggle CSS specificity collision (#1409) + Ollama env var bleed (#1410)

2026-05-01 17:14:51 +00:00

test_provider_mismatch.py

Fix WebUI custom provider routing

2026-05-02 02:11:41 +08:00

test_pwa_manifest_csp.py

fix(csp): add explicit manifest-src 'self' directive (#961)

2026-04-24 10:44:46 -07:00

test_pwa_manifest_sw.py

fix: revert sw.js to relative path + add regression test

2026-05-03 01:29:41 +00:00

test_pytest_state_isolation.py

v0.50.225: cron attention, image lightbox, pytest isolation (#1137)

2026-04-26 21:04:38 -07:00

test_quote_entity_mangling.py

fix(renderer): stop " mangling inside code blocks (#801)

2026-04-21 16:26:51 +00:00

test_real_steer.py

v0.50.215: real /steer via agent.steer() — mid-turn correction without interrupt (#1069)

2026-04-25 19:21:00 -07:00

test_reasoning_chip_btw_fixes.py

v0.50.216: compression chains, renderer fixes, HTML preview, approval z-index, /steer fix, reasoning chip (#1075)

2026-04-25 21:06:31 -07:00

test_reasoning_chip_js_behaviour.py

v0.50.216: compression chains, renderer fixes, HTML preview, approval z-index, /steer fix, reasoning chip (#1075)

2026-04-25 21:06:31 -07:00

test_reasoning_show_hide.py

feat(reasoning): full /reasoning CLI parity — show|hide + effort levels via config.yaml (#812)

2026-04-21 15:26:52 -07:00

test_regressions.py

release: v0.50.240

2026-04-29 17:42:32 -07:00

test_renderer_comprehensive.py

v0.50.216: compression chains, renderer fixes, HTML preview, approval z-index, /steer fix, reasoning chip (#1075)

2026-04-25 21:06:31 -07:00

test_renderer_js_behaviour.py

fix(ui+pwa): avoid stale Mermaid render errors and bust cached static asset URLs on every release

2026-04-30 16:18:01 +00:00

test_russian_locale.py

v0.50.211: compact timestamps, adaptive title refresh, settings picker fix (#1061)

2026-04-25 17:50:58 -07:00

test_security_redaction.py

Fix WebUI custom provider routing

2026-05-02 02:11:41 +08:00

test_service_worker_api_cache.py

fix(ui+pwa): avoid stale Mermaid render errors and bust cached static asset URLs on every release

2026-04-30 16:18:01 +00:00

test_session_batch_select.py

Fix string i18n placeholder interpolation

2026-05-02 23:05:55 +08:00

test_session_cross_tab_sync.py

fix: anchor active sessions per browser tab

2026-05-01 19:52:05 +08:00

test_session_duplicate.py

chore(release): stamp v0.50.268 — 4-PR batch + Opus follow-ups (i18n + per-session fields + None title guard)

2026-05-02 17:54:58 +00:00

test_session_import_cli_fallback_model.py

Add regression test for #1386 (model='unknown' init guard)

2026-05-01 04:48:24 +00:00

test_session_index.py

v0.50.207: batch of 10 PRs — TPS stat, SSE guard, session polish, cron UX, folder create, model errors, session speed, title gen (#1031)

2026-04-25 13:07:35 -07:00

test_session_lineage_collapse.py

fix: nest child sessions under lineage roots

2026-05-02 12:09:36 +08:00

test_session_lineage_metadata_api.py

fix: nest child sessions under lineage roots

2026-05-02 12:09:36 +08:00

test_session_metadata_fast_path.py

v0.50.207: batch of 10 PRs — TPS stat, SSE guard, session polish, cron UX, folder create, model errors, session speed, title gen (#1031)

2026-04-25 13:07:35 -07:00

test_session_ops.py

Show profile home in /status command (refs #463) (#1380)

2026-05-01 04:46:37 +00:00

test_session_rename_lifecycle.py

fix: batch triage — 12 contributor PRs (v0.50.227) (#1168)

2026-04-27 13:34:59 -07:00

test_session_rotate_url_sync.py

fix: sync URL after session id rotation

2026-05-02 10:35:40 +08:00

test_session_search_bfcache_822.py

fix(ui): clear session search on boot + autocomplete=off + pageshow bfcache handler (closes #822)

2026-04-21 22:11:32 -07:00

test_session_sidebar_relative_time.py

v0.50.211: compact timestamps, adaptive title refresh, settings picker fix (#1061)

2026-04-25 17:50:58 -07:00

test_session_sidecar_repair.py

fix: retry stale repair after lock contention

2026-04-29 04:31:37 +00:00

test_session_summary_redaction.py

fix(tests): auto-derive unique port+state-dir per worktree (fixes parallel pytest)

2026-04-14 19:04:48 +00:00

test_settings_navigation_and_detail_refresh.py

refactor(ui): three-column layout with left rail + main-view migration (#899)

2026-04-24 09:05:25 -07:00

test_sienna_skin.py

release: v0.50.244 (#1308)

2026-04-29 21:34:27 -07:00

test_simplified_tool_calling_setting.py

release: v0.50.240

2026-04-29 17:42:32 -07:00

test_skills_category_collapse.py

release: v0.50.240

2026-04-29 17:42:32 -07:00

test_spanish_locale.py

feat(i18n): add Spanish locale for WebUI (#275)

2026-04-11 20:06:37 -07:00

test_sprint1.py

fix(tests): auto-derive unique port+state-dir per worktree (fixes parallel pytest)

2026-04-14 19:04:48 +00:00

test_sprint2.py

fix(tests): auto-derive unique port+state-dir per worktree (fixes parallel pytest)

2026-04-14 19:04:48 +00:00

test_sprint3.py

fix: batch v0.50.234-235 — XSS hardening, workspace validation, profile switch fixes (#1206)

2026-04-27 21:39:30 -07:00

test_sprint4.py

fix(tests): auto-derive unique port+state-dir per worktree (fixes parallel pytest)

2026-04-14 19:04:48 +00:00

test_sprint5.py

feat(workspaces): autocomplete trusted workspace paths — v0.50.162 (PR #880 by @franksong2702, closes #616)

2026-04-23 02:35:58 +00:00

test_sprint6.py

refactor(ui): three-column layout with left rail + main-view migration (#899)

2026-04-24 09:05:25 -07:00

test_sprint7.py

fix(tests): auto-derive unique port+state-dir per worktree (fixes parallel pytest)

2026-04-14 19:04:48 +00:00

test_sprint8.py

fix(tests): auto-derive unique port+state-dir per worktree (fixes parallel pytest)

2026-04-14 19:04:48 +00:00

test_sprint9.py

fix(ui+pwa): avoid stale Mermaid render errors and bust cached static asset URLs on every release

2026-04-30 16:18:01 +00:00

test_sprint10.py

release: v0.50.243 (#1302)

2026-04-29 21:06:30 -07:00

test_sprint11.py

fix(config): default model empty string — no unavailable OpenAI model for non-OpenAI users — closes #646 (PR #649)

2026-04-18 06:46:43 +00:00

test_sprint12.py

fix(models): preserve @nous: prefix in settings + fix cross-namespace 404 for Nous (#895 #894) (#901)

2026-04-23 10:44:10 -07:00

test_sprint13.py

fix(tests): auto-derive unique port+state-dir per worktree (fixes parallel pytest)

2026-04-14 19:04:48 +00:00

test_sprint14.py

fix(tests): auto-derive unique port+state-dir per worktree (fixes parallel pytest)

2026-04-14 19:04:48 +00:00

test_sprint15.py

fix(tests): auto-derive unique port+state-dir per worktree (fixes parallel pytest)

2026-04-14 19:04:48 +00:00

test_sprint16.py

v0.50.264 polish followups: i18n parity + assistant-output readability

2026-05-02 04:19:28 +00:00

test_sprint17.py

fix(tests): auto-derive unique port+state-dir per worktree (fixes parallel pytest)

2026-04-14 19:04:48 +00:00

test_sprint19.py

fix(tests): auto-derive unique port+state-dir per worktree (fixes parallel pytest)

2026-04-14 19:04:48 +00:00

test_sprint20.py

fix: keep busy-input send available on mobile

2026-04-29 04:31:54 +00:00

test_sprint20b.py

fix: keep busy-input send available on mobile

2026-04-29 04:31:54 +00:00

test_sprint23.py

fix(tests): auto-derive unique port+state-dir per worktree (fixes parallel pytest)

2026-04-14 19:04:48 +00:00

test_sprint26.py

feat(theme): replace color scheme system with light/dark + accent skins (PR #627 by @aronprins)

2026-04-18 06:37:09 +00:00

test_sprint27.py

fix(tests): auto-derive unique port+state-dir per worktree (fixes parallel pytest)

2026-04-14 19:04:48 +00:00

test_sprint28.py

fix(tests): auto-derive unique port+state-dir per worktree (fixes parallel pytest)

2026-04-14 19:04:48 +00:00

test_sprint29.py

fix(tests): auto-derive unique port+state-dir per worktree (fixes parallel pytest)

2026-04-14 19:04:48 +00:00

test_sprint30.py

fix: keep clarify countdown steady

2026-04-29 04:32:52 +00:00

test_sprint31.py

fix: address PR #1231 review feedback

2026-04-29 04:31:12 +00:00

test_sprint32.py

fix(security): gate auto-install behind HERMES_WEBUI_AUTO_INSTALL=1 — v0.50.156

2026-04-22 20:49:28 +00:00

test_sprint33.py

v0.47.0: dialogs, session menu, /skills, mobile fixes, mobile QA suite

2026-04-11 12:19:12 -07:00

test_sprint34.py

refactor(ui): three-column layout with left rail + main-view migration (#899)

2026-04-24 09:05:25 -07:00

test_sprint35.py

fix+feat: session title guard + breadcrumb nav + wider panel + responsive msgs (closes #300, #292)

2026-04-12 10:51:48 -07:00

test_sprint36.py

fix: remove deprecated btnCancel; localise composer tooltips with disabled reason branching

2026-04-29 04:31:55 +00:00

test_sprint37.py

fix: batch v0.50.229 — session perf, ephemeral sessions, iOS zoom (#1183)

2026-04-27 16:27:03 -07:00

test_sprint38.py

fix(streaming): strip Gemma 4 thinking token delimiter in all paths — closes #607

2026-04-18 06:45:39 +00:00

test_sprint39.py

fix: HERMES_WEBUI_SKIP_ONBOARDING unconditional + guard against config writes + 10 skipped tests fixed — v0.50.65

2026-04-16 10:19:10 -07:00

test_sprint40_ui_polish.py

fix: correct webui profile switching state — v0.50.150 (PR #849 by @migueltavares)

2026-04-22 16:27:01 +00:00

test_sprint40.py

feat: OAuth provider onboarding path — Codex/Copilot no longer blocks setup (#331)

2026-04-12 14:28:16 -07:00

test_sprint41.py

fix: harden session persistence and per-session lock handling during streaming (v0.50.175, #910) (#910)

2026-04-23 14:25:43 -07:00

test_sprint42.py

Update reasoning metadata guards for context split

2026-04-29 16:46:32 +08:00

test_sprint43.py

security: bandit fixes B310/B324/B110 + QuietHTTPServer (#354)

2026-04-13 11:11:56 -07:00

test_sprint44.py

fix: workspace panel close button — no duplicate X on desktop, mobile X respects file preview (#414)

2026-04-13 23:25:26 -07:00

test_sprint45.py

fix(tests): auto-derive unique port+state-dir per worktree (fixes parallel pytest)

2026-04-14 19:04:48 +00:00

test_sprint46.py

fix(compress): prefer persisted reference handoff after completion — v0.50.90 (PR #699 by @franksong2702)

2026-04-19 04:29:07 +00:00

test_sprint47.py

feat: slash command parity + skill autocomplete — v0.50.91 (PR #711)

2026-04-19 05:37:44 +00:00

test_sprint48.py

fix(streaming): strip malformed DSML function_calls tags (#958)

2026-04-24 11:04:16 -07:00

test_sprint49.py

release: v0.50.240

2026-04-29 17:42:32 -07:00

test_sprint50.py

fix(ui): constrain slash autocomplete width to composer — v0.50.98 (closes #633) (#750)

2026-04-19 23:17:00 -07:00

test_sprint51.py

fix(streaming): eagerly release session lock in cancel_stream() (#778)

2026-04-20 23:54:40 +00:00

test_stage268_opus_followups.py

chore(release): stamp v0.50.268 — 4-PR batch + Opus follow-ups (i18n + per-session fields + None title guard)

2026-05-02 17:54:58 +00:00

test_stale_empty_session_restore.py

release: v0.50.244 (#1308)

2026-04-29 21:34:27 -07:00

test_streaming_markdown.py

fix(streaming): prevent dropped characters in incremental smd path (#960)

2026-04-24 11:04:32 -07:00

test_streaming_race_fix.py

fix: streaming race conditions (#631) + blank-page workspace binding (#804)

2026-04-21 18:47:40 -07:00

test_streaming_session_sidebar.py

fix(models): exempt streaming sessions from Untitled+0-message sidebar filter (#1327)

2026-04-30 15:24:33 +00:00

test_svg_audio_video_rendering.py

test: bump locale-count assertions for new ja locale (8 -> >=8/9)

2026-05-02 02:50:40 +00:00

test_symlink_cycle_detection.py

fix: batch triage — 12 contributor PRs (v0.50.227) (#1168)

2026-04-27 13:34:59 -07:00

test_title_aux_routing.py

fix: harden session sidecar repair

2026-04-29 04:31:36 +00:00

test_title_sanitization.py

fix: remove hardcoded chinese title heuristics (#887)

2026-04-23 09:45:34 -07:00

test_tls_support.py

feat: optional HTTPS/TLS support via cert and key env vars (#199)

2026-04-09 18:08:29 -07:00

test_tool_call_persistence.py

feat: redesign chat transcript + fix streaming/persistence lifecycle — v0.50.70 (PR #587 by @aronprins)

2026-04-16 14:04:42 -07:00

test_ttl_cache.py

perf: TTL cache for model list + incremental session index (#780)

2026-04-21 00:33:03 +00:00

test_ui_card_animation.py

release: v0.50.240

2026-04-29 17:42:32 -07:00

test_ui_tool_call_cleanup.py

release: v0.50.242 — revert assistant serif font + remove Calm theme (#1299)

2026-04-29 19:59:26 -07:00

test_update_banner_fixes.py

v0.50.209: check-for-updates, workspace toggle, HTML preview, provider categories, queue flyout docs (#1042)

2026-04-25 14:33:41 -07:00

test_update_checker.py

v0.44.0: approval fix, login CSP, update diagnostics, Lucide icons

2026-04-10 10:02:28 -07:00

test_updates.py

fix: improve self-update git pull diagnostics (#287)

2026-04-12 00:19:33 -07:00

test_v050253_opus_followups.py

Apply Opus pre-release follow-ups for v0.50.253

2026-05-01 06:53:32 +00:00

test_v050254_opus_followups.py

v0.50.254: Opus follow-up + CHANGELOG

2026-05-01 16:25:04 +00:00

test_v050255_opus_followups.py

v0.50.255: Opus follow-ups (4 fixes) + CHANGELOG

2026-05-01 17:19:53 +00:00

test_v050257_opus_followups.py

v0.50.257: CRITICAL Opus finding — fix non-functional per-session toolset override

2026-05-01 18:36:24 +00:00

test_v050258_opus_followups.py

v0.50.258: Opus follow-up — fix multi-param redirect-encoding bug + CHANGELOG

2026-05-01 21:30:10 +00:00

test_v050259_sessiondb_fd_leak.py

test fix: skip test_session_db_close_is_idempotent when hermes_state not on import path

2026-05-01 22:45:18 +00:00

test_v050260_docker_invariants.py

v0.50.260: Docker reliability batch - PR #1428 + broader UX/docs improvements + Opus advisor fixes

2026-05-01 23:10:52 +00:00

test_version_badge.py

fix: dynamic version badge — read from git tag, never hardcoded (#790)

2026-04-20 20:36:53 -07:00

test_voice_transcribe_endpoint.py

v0.50.25: mobile scroll, import timestamps, profile security, mic fallback (#404)

2026-04-13 22:11:45 -07:00

test_webui_platform_hint.py

fix: identify WebUI sessions as webui platform (#948)

2026-04-24 11:03:42 -07:00

test_workspace_blank_page_fix.py

fix: batch v0.50.231 — macOS symlink bypass, workspace panel, fenced code leak (#1194)

2026-04-27 17:43:36 -07:00

test_workspace_blocked_roots_macos.py

fix: batch v0.50.234-235 — XSS hardening, workspace validation, profile switch fixes (#1206)

2026-04-27 21:39:30 -07:00

test_workspace_files_persist_on_empty_reload.py

fix: batch v0.50.232 — fuzzy match, codex detection, workspace reload, timestamp sync (#1198)

2026-04-27 18:40:13 -07:00

test_workspace_panel_persists_on_empty_boot.py

fix: batch v0.50.231 — macOS symlink bypass, workspace panel, fenced code leak (#1194)

2026-04-27 17:43:36 -07:00

test_workspace_panel_session_list.py

v0.50.221: copy HTTP fix, inline images, mobile tap, custom providers x2 (#1117)

2026-04-26 10:36:59 -07:00