fix: skip first-segment slash strip for URI-scheme model IDs (#3429) - #3436
fix: skip first-segment slash strip for URI-scheme model IDs (#3429)#3436b3nw wants to merge 1 commit into
Conversation
…a#3429) The nesquena#3360 fix introduced first-segment slash stripping in getModelLabel, _normalizeConfiguredModelKey, and _norm_model_id to preserve vendor hierarchy for multi-slash model IDs. This breaks URI-shaped model IDs like gpt://${YANDEX_FOLDER_ID}/deepseek-v4-flash/latest — the scheme portion is treated as a provider prefix, producing labels like /${YANDEX_FOLDER_ID}/... instead of preserving the full URI. Fix: detect URI-scheme IDs (containing ://) and skip the first-segment slash stripping entirely for those inputs. All four affected locations are guarded: - getModelLabel (static/ui.js): regex test before slash strip - _normalizeConfiguredModelKey (static/ui.js): scheme check wraps the colon-prefix and slash-strip logic in a guard - _norm_model_id (api/config.py): "://" in s check before slash strip - _get_label_for_model (api/config.py): _has_scheme lambda guards both the _norm helper and the bare fallback Verification: 7 new regression tests (test_issue3429) covering URI preservation in labels, normalization keys, and backend/frontend parity. All 49 related tests pass (including nesquena#3360, nesquena#1188, nesquena#1228 suites).
Release GM — v0.51.219 (extend URI-scheme model-ID fix to backend normalization, #3436)
|
Thanks @b3nw — shipped (the backend half) in v0.51.219 (Release GM). You spotted that the #3429 URI-scheme bug also lived in the model-IDENTITY paths, not just the visible chip. The front-end label ( The one part I didn't take was your |
…tion + model-key matching (nesquena#3436, @b3nw) v0.51.218 fixed getModelLabel() (the visible chip) for URI-scheme model IDs but left the same first-segment-slash-strip bug in the matching/dedup paths: api/config.py _norm_model_id + _get_label_for_model, and static/ui.js _normalizeConfiguredModelKey. For gpt://folder/model/latest those treat the path slashes as provider delimiters, mis-normalizing the model-identity key (the nesquena#3360 collision class, for URI ids). Adds a URI-scheme guard to all three so the scheme is not stripped. Kept v0.51.218's getModelLabel (more thorough than nesquena#3436's variant — it extracts the model name vs returning the whole id); took nesquena#3436's backend + _normalizeConfiguredModelKey halves with backend/frontend parity tests. Co-authored-by: b3nw <b3nw@duck.com>
…➔ 0.51.230) (#798) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/nesquena/hermes-webui](https://github.com/nesquena/hermes-webui) | patch | `0.51.210` → `0.51.230` | --- ### Release Notes <details> <summary>nesquena/hermes-webui (ghcr.io/nesquena/hermes-webui)</summary> ### [`v0.51.230`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051230--2026-06-03--Release-GX-stage-p14--extract-think-blocks-to-mreasoning--LLM-Wiki-last-writer) [Compare Source](nesquena/hermes-webui@v0.51.229...v0.51.230) ##### Fixed - Assistant message `<think>…</think>` blocks are now extracted into `m.reasoning` instead of being stored inline in `m.content` — **both client-side (streaming/inflight state) and server-side at save time**. Reasoning-only providers such as `MiniMax-M3` (OpenAI-compat) previously left the thinking trace inside the assistant content, bloating persisted session files by 30–50% and bypassing the `m.reasoning` field the thinking card reads on reload. A new `_splitThinkFromContent()` (in `static/messages.js`) and its server-side twin `_split_thinking_from_content()` (in `api/streaming.py`, applied to the final assistant message before `s.save()`) extract a single **leading** block (after lstrip) for all three known tag pairs, matching the live renderer's `_streamDisplay`/`_parseStreamState` semantics exactly: a closed `<think>…</think>` that appears mid-body (e.g. a literal tag inside a fenced code block) stays visible content and is never moved into reasoning, a partial/unclosed block is left intact, and any pre-existing `m.reasoning` (from a separate `on_reasoning` stream) is preserved/merged. So the persisted session file — not just the in-browser copy — is compacted on reload ([#​3455](nesquena/hermes-webui#3455) part 1, [@​gsurenull](https://github.com/gsurenull)). - The LLM Wiki status panel's `Last writer` field is now populated (it always showed `Not available` since the panel shipped in [#​1257](nesquena/hermes-webui#1257)). The reader uses a 3-tier fallback — most-recent page frontmatter (`updated_by`/`writer`/`author`), the most recent `log.md` action verb, then a static `ai-agent` fallback — and reads only frontmatter + log headings, never page bodies, preserving the private-safe status contract ([#​3455](nesquena/hermes-webui#3455) part 2, [@​gsurenull](https://github.com/gsurenull); closes [#​1257](nesquena/hermes-webui#1257)). ### [`v0.51.229`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051229--2026-06-03--Release-GW-stage-p13--model-never-silently-snaps-a-versioned-name-to-a--tier-variant) [Compare Source](nesquena/hermes-webui@v0.51.228...v0.51.229) ##### Fixed - `/model <name>` no longer silently snaps a complete versioned model name to a longer `-tier` variant (and a different price tier). When the typed name ends in a version number (e.g. `mimo-v2.5`) and the catalog has only a longer suffixed variant (e.g. `xiaomi/mimo-v2.5-pro`), both the dropdown matcher (`_findModelInDropdown`) and the command fallback (`_bestModelMatch`) now reject the snap unless the extra text *continues the version* (`.` + digit), rather than upgrading the user to a `-pro`/`-flash` tier they did not type. When nothing matches cleanly, `/model` now shows a *"No model matching … — did you mean …?"* suggestion toast instead of silently switching. Legitimate fuzzy shorthand is preserved (`/model gpt-5` → `gpt-5.4-mini`, `/model claude` → `claude-opus-4.6`, `/model mimo-v2` → `mimo-v2.5-pro`), as is exact-match priority ([#​3368](nesquena/hermes-webui#3368), with [@​garyd9](https://github.com/garyd9); thanks [@​yutaotie](https://github.com/yutaotie) for confirmation). ### [`v0.51.228`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051228--2026-06-03--Release-GV-stage-p12--workspace-file-tree-drop--large-markdown-preview) [Compare Source](nesquena/hermes-webui@v0.51.227...v0.51.228) ##### Fixed - Dropping an OS file onto the **workspace file tree** now uploads it into the workspace only, instead of *also* attaching it to the chat composer. The tree's drag handlers now stop event propagation for OS `Files` drops so the document-level composer drop handler no longer fires for the same drop ([#​3411](nesquena/hermes-webui#3411), [@​pamnard](https://github.com/pamnard)). - Moderately large Markdown documents in the **workspace preview** are no longer forced into plain-text too early. The rich-render ceiling is raised (64 KB / 1500 lines → 256 KB / 5000 lines, and the backend file-read limit 200 KB → 400 KB), and files above the limit gain a **"Render as markdown anyway"** button that force-renders the already-loaded content without a second fetch ([#​3378](nesquena/hermes-webui#3378), [@​starGazerK](https://github.com/starGazerK)). ### [`v0.51.227`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051227--2026-06-03--Release-GU-stage-p11--keep-the-active-New-Chat-visible-in-the-sidebar) [Compare Source](nesquena/hermes-webui@v0.51.226...v0.51.227) ##### Fixed - A freshly-created **New Chat** now stays visible and selected in the sidebar before its first message is sent. The sidebar intentionally filters inactive 0-message sessions, but that filter also hid the *currently active* blank chat until the user sent a turn — so starting a New Chat could make the selected row vanish from the list. The active ephemeral session is now injected into the sidebar render rows (only when the server-side list omits it), while inactive empty sessions stay filtered as before. Starting a New Chat from a CLI-filtered sidebar also switches the source filter back to WebUI so the active chat isn't immediately hidden ([#​3408](nesquena/hermes-webui#3408), [@​AJV20](https://github.com/AJV20)). ### [`v0.51.226`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051226--2026-06-03--Release-GT-stage-p9--mobile-composer-context-usage-ring--activity-feed-default-expand-setting) [Compare Source](nesquena/hermes-webui@v0.51.225...v0.51.226) ##### Added - **Settings → Appearance: "Expand activity feed by default"** — a new checkbox (default off) that expands new Activity disclosures by default as turns arrive. Manual per-turn collapse/expand still wins (an explicit user toggle is preserved), and live "Waiting on model" rows now explain what the agent is doing before and after tool calls ([#​3080](nesquena/hermes-webui#3080), [@​AJV20](https://github.com/AJV20)). ##### Changed - The mobile composer's config button now shows a **context-usage ring** (an SVG progress ring with a centered percentage) in place of the static sliders icon, color-coded green (≤50%) / orange (≤85%) / red (>85%) and reset to 0% on a new session, so context-window pressure is visible at a glance on mobile ([#​3062](nesquena/hermes-webui#3062), [@​NottheGuy007](https://github.com/NottheGuy007)). ### [`v0.51.225`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051225--2026-06-03--Release-GS-stage-p7--remote-gateway-health-probe-resolves-gatewaystate) [Compare Source](nesquena/hermes-webui@v0.51.224...v0.51.225) ##### Fixed - The remote-gateway health probe now correctly reports `gateway_state`, so the Tasks/Cron banner lights up for Docker / remote-gateway deployments. The probe previously hit `/health` and `/status` (neither returns `gateway_state`) and never queried `/health/detailed` (which does), so `gateway_state == "running"` was never observed remotely. The probe now tries `/health/detailed` first, parses the JSON body of a 2xx response to extract `gateway_state`, and unifies the gateway base-URL env precedence to `GATEWAY_HEALTH_URL` > `HERMES_GATEWAY_HEALTH_URL` > `HERMES_API_URL` ([#​3355](nesquena/hermes-webui#3355), [@​rodboev](https://github.com/rodboev)). ### [`v0.51.224`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051224--2026-06-03--Release-GR-stage-p6--profile-toolskill-config-authoritative-on-the-streaming-worker) [Compare Source](nesquena/hermes-webui@v0.51.223...v0.51.224) ##### Fixed - Profile tool/skill restrictions are now respected for WebUI chats even when the per-session "Tool Restrictions" field is left blank. The streaming agent runs on a detached worker thread that does not inherit the per-request thread-local profile context, so the ambient `get_config()` resolved the process-global `default` profile and loaded its `platform_toolsets.cli` (all tools) instead of the session profile's configured list — inflating a tools-disabled profile's prompt from \~400 to \~15K input tokens. The worker now reads the session's own profile config explicitly via a new `get_config_for_profile_home()` helper (a race-free direct disk read with no shared-cache mutation), so toolsets, prefill context, and fallback chains all match the profile the session actually runs under ([#​3294](nesquena/hermes-webui#3294), [@​nesquena-hermes](https://github.com/nesquena-hermes)). ### [`v0.51.223`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051223--2026-06-02--Release-GQ-stage-p5--openai-api-first-class-picker-provider--MiniMax-M3) [Compare Source](nesquena/hermes-webui@v0.51.222...v0.51.223) ##### Fixed - GPT models now appear in the model picker when hermes-agent exposes its built-in OpenAI provider under the `openai-api` slug (the one activated by `OPENAI_API_KEY` / `OPENAI_BASE_URL`, distinct from `openai-codex`). `openai-api` is now a first-class picker provider in `_PROVIDER_DISPLAY` / `_PROVIDER_MODELS` rather than an alias of `openai` — an alias would have fixed the display but broken the send path, since the agent registry has `openai-api` and not `openai`. Env detection for `OPENAI_API_KEY` was also corrected to surface `openai-api` instead of a bare `openai` the agent registry can't resolve ([#​3443](nesquena/hermes-webui#3443), [@​rodboev](https://github.com/rodboev)). ##### Changed - MiniMax default model catalog upgraded to M3 in the model picker ([#​3374](nesquena/hermes-webui#3374), [@​octo-patch](https://github.com/octo-patch)). ### [`v0.51.222`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051222--2026-06-02--Release-GP-stage-p4--backend-bugfix-batch-title-language-drift--orphaned-CLI-sidecar-prune--pin-quota-lineage) [Compare Source](nesquena/hermes-webui@v0.51.221...v0.51.222) ##### Fixed - Auto-generated session titles no longer persist in the wrong language. The title-language guard previously only rejected English titles for *German* conversation starts, so an English chat whose LLM-generated title came back in Chinese, Russian, or another script sailed through and was saved. `_title_language_mismatch` now also does a language-agnostic cross-script check: when the conversation start has a clear dominant writing script and the generated title introduces a substantial amount of a different script (CJK / Cyrillic / Arabic / etc.), the title is rejected and generation falls back to the deterministic topic title. The threshold tolerates a borrowed technical term (a CJK title with one English word still trips; an English title with a single foreign place-name does not), and the legacy German→English heuristic is preserved ([#​3293](nesquena/hermes-webui#3293)). - WebUI sidebar now reconciles orphaned imported-CLI sessions. When a CLI/agent session is opened in the WebUI it gets a WebUI-owned sidecar so it can render and reopen; previously, if the user then deleted that session from the CLI / local Hermes storage, nothing pruned the sidecar and the stale row lingered in the sidebar indefinitely (there is no WebUI delete affordance for CLI rows). Orphaned sidecars whose backing session no longer exists are now pruned on reconciliation ([#​3238](nesquena/hermes-webui#3238)). - Pin quota is now counted by visible session lineage rather than raw session rows, so continuation siblings in the same sidebar-visible lineage no longer each consume a separate pin slot. Previously a pinned session that had been compressed/continued into multiple rows could exhaust the pin limit with what the user sees as a single pinned conversation. The limit check now collapses each lineage to its visible root before counting against `pinned_sessions_limit` ([#​3288](nesquena/hermes-webui#3288), [@​andrewkangkr](https://github.com/andrewkangkr)). ### [`v0.51.221`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051221--2026-06-02--Release-GO-stage-p3e--block-all-workspace-symlink-escapes-security) [Compare Source](nesquena/hermes-webui@v0.51.220...v0.51.221) ##### Security - The workspace file API now blocks **all** symlink escapes from the selected workspace, not just symlinks pointing at system directories. Previously a symlink placed inside a workspace could resolve to an arbitrary external host path (e.g. `~/.ssh`, `~/.hermes/auth.json`) and be read through `/api/list` / `read_file_content` — and since that API is reachable by LLM agent tool calls, an imported or crafted workspace could expose credentials. `safe_resolve_ws` now requires the resolved path stay under the workspace root, `list_dir` hides escaping symlinks (they could never be opened anyway), and `read_file_content` rejects them. Symlinks that resolve back under the workspace still work normally. The directory-list, file-read, file-upload, and archive-extraction paths are additionally hardened against a symlink-swap **TOCTOU** race: each path is opened component-by-component from the workspace root with `O_NOFOLLOW` (an anchored `openat` walk on Linux/macOS, with a plain-open fallback on platforms without `dir_fd` support such as Windows, where creating symlinks needs admin anyway), so a symlink raced into any component after the containment check cannot redirect the read/list/write outside the workspace. Note: an intentional in-workspace symlink pointing to an external directory is no longer followed ([#​3398](nesquena/hermes-webui#3398), [@​Hinotoi-agent](https://github.com/Hinotoi-agent)). ### [`v0.51.220`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051220--2026-06-02--Release-GN-stage-p3c--fix-aux-title-generation-with-provider-model-ids) [Compare Source](nesquena/hermes-webui@v0.51.219...v0.51.220) ##### Fixed - Manual session-title regeneration and background auxiliary title generation no longer fail with `422` / `llm_error_aux` when `auxiliary.title_generation.model` in `config.yaml` is set using the WebUI model-picker's `@provider:model` format (e.g. `@gemini:gemini-3.1-flash-lite`). The `@provider:` prefix is now normalized away via the canonical helper before the id reaches the provider API ([#​3430](nesquena/hermes-webui#3430), [@​pamnard](https://github.com/pamnard)). ### [`v0.51.219`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051219--2026-06-02--Release-GM-stage-p3b--extend-URI-scheme-model-ID-fix-to-backend-normalization--matching) [Compare Source](nesquena/hermes-webui@v0.51.218...v0.51.219) ##### Fixed - Extended the [#​3429](nesquena/hermes-webui#3429) URI-scheme fix beyond the visible model chip (fixed in v0.51.218) to the model-identity normalization and matching paths: `api/config.py` `_norm_model_id` / `_get_label_for_model` and `static/ui.js` `_normalizeConfiguredModelKey` no longer strip the first `/`-segment of a `scheme://` id (e.g. `gpt://${FOLDER}/model/latest`), where the slashes are path separators rather than a provider prefix. This prevents the [#​3360](nesquena/hermes-webui#3360 identity collision/mislabel for URI-shaped model IDs in dropdown matching, badge assignment, and configured-entry dedup. Backend/front-end parity is covered by tests ([#​3436](nesquena/hermes-webui#3436), [@​b3nw](https://github.com/b3nw)). ### [`v0.51.218`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051218--2026-06-02--Release-GL-stage-p3a--fix-getModelLabel-mangling-URI-scheme-model-IDs) [Compare Source](nesquena/hermes-webui@v0.51.217...v0.51.218) ##### Fixed - The composer model chip no longer shows env-var path junk for model IDs that use a URI scheme (e.g. Yandex `gpt://${FOLDER}/deepseek-v4-flash/latest`). A regression from [#​3366](nesquena/hermes-webui#3366) (v0.51.210): `getModelLabel()` stripped the first `/`-segment, which for a `scheme://` id landed inside the `://` and left `/${FOLDER}/…`. The label now detects a URI scheme, drops scheme + authority, and takes the last meaningful path segment (skipping `${…}` placeholders and bare version tails like `latest`); non-URI multi-slash IDs keep their [#​3360](nesquena/hermes-webui#3360) behavior ([#​3429](nesquena/hermes-webui#3429)). ### [`v0.51.217`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051217--2026-06-02--Release-GK-stage-p2f--decode-and-complete-zh-Hant-locale-strings) [Compare Source](nesquena/hermes-webui@v0.51.216...v0.51.217) ##### Changed - Decoded the `zh-Hant` (Traditional Chinese) locale block from `\u`-escaped sequences to literal Chinese text and backfilled missing keys so `zh-Hant` now has full coverage of the English key set. Makes future locale review readable and prevents newer UI keys from falling back to English for Traditional Chinese users. Locale-only — no runtime behavior change ([#​3414](nesquena/hermes-webui#3414), [@​PeterDaveHello](https://github.com/PeterDaveHello)). ##### Fixed - Added the missing `provider_mismatch_warning` string to the French (`fr`) locale. It was absent entirely; the gap was masked by a stale duplicate of the same key in the `zh-Hant` block that [#​3414](nesquena/hermes-webui#3414) removed, so all locales now carry the key. ### [`v0.51.216`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051216--2026-06-02--Release-GJ-stage-p2e--fix-consecutive-user-turn-rejection-on-strict-chat-templates) [Compare Source](nesquena/hermes-webui@v0.51.215...v0.51.216) ##### Fixed - WebUI session/delivery context (connected platforms, home channels, scheduled-task delivery hints) is now injected into the ephemeral **system prompt** instead of being appended as a prefill `user` message. The old prefill produced two consecutive `user` turns (session context + the actual message), which models with strict chat templates (Mistral, Gemma via llama.cpp) reject with a Jinja 500. The same context is preserved — just delivered in a role-alternation-safe place ([#​3324](nesquena/hermes-webui#3324), [@​aether-agent](https://github.com/aether-agent), closes [#​3276](nesquena/hermes-webui#3276)). ### [`v0.51.215`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051215--2026-06-02--Release-GI-stage-p2d--deduplicate-legacy-messages-in-append-only-merge) [Compare Source](nesquena/hermes-webui@v0.51.214...v0.51.215) ##### Fixed - `merge_session_messages_append_only` now deduplicates true duplicate legacy messages (same role, content, AND exact timestamp) that could accumulate in state, while preserving legitimately-repeated identical turns whose timestamps differ even slightly. This avoids both the stale-duplicate buildup and the data-loss class where collapsing same-second distinct turns would drop real messages ([#​3393](nesquena/hermes-webui#3393), [@​thanhtoantnt](https://github.com/thanhtoantnt), closes [#​3346](nesquena/hermes-webui#3346)). ### [`v0.51.214`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051214--2026-06-02--Release-GH-stage-p2c--preserve-loaded-transcript-width-on-same-session-external-refresh) [Compare Source](nesquena/hermes-webui@v0.51.213...v0.51.214) ##### Fixed - A same-session external refresh (e.g. a background poll triggering a force-reload of the conversation you're reading) no longer collapses a long transcript back to the default 30-message tail window and jumps the viewport to a different slice. The already-loaded transcript width and scroll position are now captured before the in-memory transcript is cleared and preserved across the authoritative reload ([#​3326](nesquena/hermes-webui#3326), [@​viraatdas](https://github.com/viraatdas), closes [#​3239](nesquena/hermes-webui#3239)). ### [`v0.51.213`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051213--2026-06-02--Release-GG-stage-p2b--keep-gateway-context-visible-in-chat-transcripts) [Compare Source](nesquena/hermes-webui@v0.51.212...v0.51.213) ##### Fixed - Gateway-backed chat now backfills model-context turns into the visible transcript before saving the latest reply, while keeping hidden `[context compaction]` markers out of the visible transcript. Previously a context-compacted gateway session could collapse the sidebar/header message count to a two-message conversation (and drop older visible turns) while the assistant was responding to hidden prior context. Older visible turns are preserved and compaction markers stay hidden from `saved.messages` ([#​3300](nesquena/hermes-webui#3300), [@​AJV20](https://github.com/AJV20)). ### [`v0.51.212`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051212--2026-06-02--Release-GF-stage-batch2--i18n-regenerate-title-strings--self-restart-argv--todos-cold-load) [Compare Source](nesquena/hermes-webui@v0.51.211...v0.51.212) ##### Fixed - Localized the five `session_title_regenerate*` session-menu strings (the "Regenerate title" action, its description, and the regenerating/regenerated/failed states) that shipped as English text in every non-English locale. Translated across it, ja, ru, es, de, zh, zh-Hant, pt, ko, fr, and tr, matching each locale's existing terminology; `zh`/`zh-Hant` keep the `\u`-escaped style of those blocks ([#​3396](nesquena/hermes-webui#3396), [@​vanshaj-pahwa](https://github.com/vanshaj-pahwa), closes [#​3364](nesquena/hermes-webui#3364)). - Self-update re-exec now distinguishes source checkouts from frozen/packaged builds: a frozen binary (`sys.frozen`) re-execs with `sys.argv` as-is, while source checkouts keep the `[sys.executable] + sys.argv` CPython idiom. Previously the frozen path re-inserted the binary as `argv[1]`, turning re-exec into a no-op that left the WebUI stuck "offline" after every self-update ([#​3395](nesquena/hermes-webui#3395), [@​PatrickNoFilter](https://github.com/PatrickNoFilter)). - The Todos panel now hydrates correctly on a cold session load (page refresh) even when the latest todo tool result is outside the truncated display window: `/api/session` derives a compact `todo_state` sidecar from the full settled transcript, and an explicit empty todo list is honored as the current state instead of falling through to an older non-empty write. A malformed historical tool message can never break session loading ([#​3373](nesquena/hermes-webui#3373), [@​v2psv](https://github.com/v2psv)). ### [`v0.51.211`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051211--2026-06-02--Release-GE-stage-batch1--reasoning-heuristics--model-shortest-match--Copilot-env-token-filter) [Compare Source](nesquena/hermes-webui@v0.51.210...v0.51.211) ##### Fixed - Generalized reasoning-effort capability checks in `_candidate_supports_reasoning` to target whole model families (GPT-5+, Claude 4/3.7, Qwen-3, Kimi, Minimax, Mimo, GLM, Step, and DeepSeek) instead of anchoring on hardcoded version numbers or vendor formats. This prevents the thinking-level configuration selector from being hidden on custom providers, new model releases, or when names carry suffixes like `-free` or `:free` (common on integrations such as Kilo Code or OpenCode Zen). The GPT heuristic is now version-anchored (5+) to avoid falsely enabling reasoning\_effort for gpt-4o/4.1/3.5 on aggregator providers ([#​3379](nesquena/hermes-webui#3379), [@​b3nw](https://github.com/b3nw), closes [#​3377](nesquena/hermes-webui#3377)). - The `/model` slash command no longer selects a longer model variant when a shorter name is a prefix of it (e.g. `/model mimo-v2.5` selecting `mimo-v2.5-pro`). The fuzzy fallback now prefers an exact id/label match and otherwise the shortest matching option, applied to both the main and bare-name (`provider/...`) fallbacks ([#​3394](nesquena/hermes-webui#3394), [@​vanshaj-pahwa](https://github.com/vanshaj-pahwa), closes [#​3368](nesquena/hermes-webui#3368)). - `GITHUB_TOKEN` and `GH_TOKEN` environment variables are now filtered from the Copilot credential pool alongside the seeded `gh`-CLI token, so a classic PAT (`ghp_*`) auto-detected from the environment no longer makes Copilot appear in the model picker when the Copilot API can't use it. User-specific `COPILOT_GITHUB_TOKEN` is still respected ([#​3382](nesquena/hermes-webui#3382), [@​happy5318](https://github.com/happy5318)). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEwMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL3BhdGNoIl19--> Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/798
Conflicts: api/routes.py, static/boot.js, static/i18n.js, static/index.html, static/style.css - boot.js: keep Pure Ink + add Zeus skin - style.css: keep Pure Ink CSS + add Zeus CSS (upstream skin) - index.html: keep dynamic localStorage skins + add zeus/graphite - i18n.js: 5 conflicts resolved, ja dedup (24 lines), upstream translations adopted - routes.py: keep thin dispatch (handler in session_routes.py), merge imports Upstream features absorbed: - Zeus skin, graphite skin rename - PR nesquena#3238 orphaned CLI sidecar pruning (integrated into session_routes.py) - Checkpoint/rollback zh-Hant i18n keys - zh-Hant locale decode + completion (nesquena#3414) - Workspace symlink security hardening (nesquena#3398) - URI scheme model ID fixes (nesquena#3429/nesquena#3436/nesquena#3430) - MiniMax-M3 + OpenAI API picker (nesquena#3374/nesquena#3443) - Workspace tree-drop + large markdown preview (nesquena#3411/nesquena#3378) - Mobile composer context-usage ring (nesquena#3062) - Gateway health probe (nesquena#3355) - Profile tool/skill config scoping (nesquena#3294) - Title language drift fix (nesquena#3293) - Orphaned CLI sidecar prune (nesquena#3238) - Various bug fixes and security hardening Known pre-existing upstream issues (not introduced by this merge): - en: 9 duplicate i18n keys (upstream) - zh: 56 missing translations (upstream never translated) - test_model_scope_copy: .model-group-toggle not in style.css (upstream test bug)
…tion + model-key matching (nesquena#3436, @b3nw) v0.51.218 fixed getModelLabel() (the visible chip) for URI-scheme model IDs but left the same first-segment-slash-strip bug in the matching/dedup paths: api/config.py _norm_model_id + _get_label_for_model, and static/ui.js _normalizeConfiguredModelKey. For gpt://folder/model/latest those treat the path slashes as provider delimiters, mis-normalizing the model-identity key (the nesquena#3360 collision class, for URI ids). Adds a URI-scheme guard to all three so the scheme is not stripped. Kept v0.51.218's getModelLabel (more thorough than nesquena#3436's variant — it extracts the model name vs returning the whole id); took nesquena#3436's backend + _normalizeConfiguredModelKey halves with backend/frontend parity tests. Co-authored-by: b3nw <b3nw@duck.com>
Release GM — v0.51.219 (extend URI-scheme model-ID fix to backend normalization, nesquena#3436)
fix: getModelLabel breaks URI-scheme model IDs (#3429)
Closes #3429
Thinking Path
gpt://${FOLDER_ID}/model/version)split('/').pop()with first-segment-only stripping ingetModelLabel,_normalizeConfiguredModelKey, and_norm_model_idgpt://folder/model/latesthave://in the scheme, and the first/aftergpt:is part of the URI authority, not a provider delimitergetModelLabel("gpt://b1g12345/deepseek-v4-flash/latest")stripsgpt:and returns//b1g12345/deepseek-v4-flash/latest— a broken label shown in the composer chip://presence), preserving both the Bug: Model picker snaps to wrong model when multiple multi-slash IDs share the same base name #3360 multi-slash fix and correct handling of URI-shaped model IDsWhat Changed
Fix 1 —
getModelLabel(static/ui.js)Added a regex check (
/^[a-z][a-z0-9+.-]*:\/\//i) before the first-segment slash strip. When the model ID has a URI scheme, the entire ID is passed through without stripping.Fix 2 —
_normalizeConfiguredModelKey(static/ui.js)Wrapped the existing colon-prefix strip and slash-strip logic in a URI-scheme guard. URI-scheme IDs normalize with their full structure preserved (hyphens still replaced with dots for consistency).
Fix 3 —
_norm_model_id(api/config.py)Added a
"://" not in scheck before the first-segment slash strip. Simple, dependency-free — no regex import needed in the nested function scope.Fix 4 —
_get_label_for_model(api/config.py)Added a
_has_schemelambda ("://" in s) that guards both the_normhelper used for group label lookup and thebarefallback used for title-casing.Files changed
getModelLabeland_normalizeConfiguredModelKey_norm_model_idand_get_label_for_modelWhy It Matters
Any user running Yandex GPT (
gpt://scheme), a custom HTTP-endpoint proxy (https://scheme), or any provider that uses URI-formatted model identifiers will see broken labels in the composer chip and potentially mismatched normalization in badge assignment and configured-entry dedup. The regression was introduced in v0.51.210 and affects all users with URI-scheme model IDs.Verification
Automated tests
pytest tests/test_issue3429_uri_scheme_model_ids.py \ tests/test_issue3360_multi_slash_model_collision.py \ tests/test_norm_model_id_trailing_empty_guard.py \ tests/test_issue1188_fuzzy_match.py \ tests/test_issue1228_model_picker_duplicate_ids.py \ -v # 49 passedNew tests (
test_issue3429):TestGetModelLabelUriScheme— 3 tests: Yandex gpt:// preserved, multiple URI schemes preserved, non-URI slash IDs still strippedTestNormalizeConfiguredModelKeyUriScheme— 2 tests: URI scheme preserved in normalization, regular slash IDs still normalizeTestBackendFrontendUriSchemeParity— 1 test: Python_norm_model_idproduces identical output to JS_normalizeConfiguredModelKeyfor URI and non-URI inputsTestBackendGetLabelUriScheme— 1 test: Python_get_label_for_modeldoes not strip URI schemeExisting test suites — all pass unmodified:
test_issue3360_multi_slash_model_collision(9 tests) — multi-slash fix preservedtest_norm_model_id_trailing_empty_guard(5 tests) — trailing-empty guard preservedtest_issue1188_fuzzy_match(11 tests) — fuzzy match unaffectedtest_issue1228_model_picker_duplicate_ids(17 tests) — provider-aware preference unaffectedRisks / Follow-ups
://substring check (backend) and regex (frontend). This correctly distinguishesgpt://folder/modelfromopenai/gpt-5.5— no known false positives since normal provider/model IDs never contain://.custom://(URI scheme with no path) would skip stripping and normalize to itself — strictly better than the broken empty-string behavior._findModelInDropdownfunction doesn't need a URI guard because it operates on option values via exact match or normalized comparison — the normalization is already guarded.AI Usage Disclosure