Release v0.51.269 — Release IK (stage-b2 — sidebar perf + search scope + Windows ctl) - #3672
Conversation
Co-authored-by: Pamnard <pamnard@users.noreply.github.com>
Co-authored-by: hinotoi-agent <paperlantern.agent@gmail.com>
Co-authored-by: Rod Boev <rod.boev@gmail.com>
|
| Filename | Overview |
|---|---|
| api/routes.py | Adds profile scoping to _handle_sessions_search by filtering sessions to the active profile before any search, mirroring the existing list-endpoint pattern. Both empty-query and full-search paths are updated; all_profiles=1 opt-in is preserved. |
| ctl.sh | Adds Windows (Git Bash/MSYS) support for stop: new _is_windows_bash, _windows_bash_path, _windows_pid_for_bash_pid, and _stop_webui_pid helpers; _is_owned_webui_pid extended with slash-normalised and cygpath-converted path variants. POSIX path unchanged. Two P2 concerns: signal parameter ignored on Windows (always force-kills), and wmic deprecated on modern Windows builds. |
| static/sessions.js | Extracts five sequential .filter() passes into _sidebarRowHasVisibleMessages and _partitionSidebarSessionRows, iterating allMatched exactly twice. All filter conditions, archivedCount semantics, and profileFiltered population are equivalent to the original chain. |
| tests/test_sessions_search_profile_scope.py | New test file covering empty-query scope, title search isolation, content search isolation, and all_profiles=1 aggregate opt-in. Fixtures patch all_sessions, get_session, get_active_profile_name, and j cleanly. |
| tests/test_ctl_script.py | Windows compatibility helpers added (bash_path, bash_pid, windows_pid, process_exists, start_fake_launchd_process). Existing tests updated to use path-normalised assertions and _kill_tree cleanup. launchd test skipped on Windows. |
| tests/test_sidebar_session_partition.py | New regression test validating the single-pass partition helper exists and contains all expected filter gates. Source-text assertions are precise. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[stop_cmd called] --> B{PID file exists & process alive?}
B -- No --> C[_clear_stale_pid / return]
B -- Yes --> D[_stop_webui_pid pid TERM]
D --> E{_is_windows_bash && taskkill available?}
E -- Yes --> F[_windows_pid_for_bash_pid]
F --> G{winpid numeric?}
G -- Yes --> H["taskkill //F //T //PID winpid"]
H --> I[return]
G -- No --> J[POSIX kill pid]
E -- No --> J
I --> K{_is_alive loop x50 / 5s}
K -- dead --> L[rm PID+STATE / Stopped]
K -- still alive --> M[_stop_webui_pid pid KILL]
M --> E
M --> N[rm PID+STATE]
Reviews (1): Last reviewed commit: "docs(changelog): v0.51.269 — Release IK ..." | Re-trigger Greptile
| _stop_webui_pid() { | ||
| local pid="$1" signal="${2:-TERM}" | ||
| if _is_windows_bash && command -v taskkill >/dev/null 2>&1; then | ||
| local winpid | ||
| winpid="$(_windows_pid_for_bash_pid "${pid}")" | ||
| if [[ "${winpid}" =~ ^[0-9]+$ ]]; then | ||
| taskkill //F //T //PID "${winpid}" >/dev/null 2>&1 || true | ||
| return | ||
| fi | ||
| fi | ||
| if [[ "${signal}" == "KILL" ]]; then | ||
| kill -KILL "${pid}" >/dev/null 2>&1 || true | ||
| else | ||
| kill "${pid}" >/dev/null 2>&1 || true | ||
| fi | ||
| } |
There was a problem hiding this comment.
signal parameter silently ignored on Windows — always force-kills
_stop_webui_pid accepts signal (TERM or KILL) but the Windows branch unconditionally invokes taskkill //F //T on both calls. The caller in stop_cmd still prints "Process did not exit after SIGTERM; sending SIGKILL" and then calls this function a second time, but on Windows the first call already force-terminates the tree; the escalation path never has a chance to run and the log message is misleading. If the WebUI needs a graceful-shutdown window (e.g. flushing a write buffer), that window doesn't exist on Windows. Consider omitting the //F flag on the TERM call and reserving the force flag for the KILL call, or documenting that Windows always gets a hard kill.
| if [[ "${winpid}" =~ ^[0-9]+$ ]] && command -v wmic >/dev/null 2>&1; then | ||
| args="$(wmic process where "ProcessId=${winpid}" get CommandLine //value 2>/dev/null | sed -n 's/^CommandLine=//p' | tr -d '\r')" | ||
| if [[ -n "${args}" ]]; then | ||
| printf '%s\n' "${args}" | ||
| return | ||
| fi | ||
| fi |
There was a problem hiding this comment.
wmic is deprecated and absent on many modern Windows installs
wmic was deprecated in Windows 10 21H1 (May 2021) and is absent by default in many Windows 11 builds. The command -v wmic >/dev/null 2>&1 guard degrades gracefully to the ps -f fallback, so this isn't a crash — but wmic will silently be missing on an increasing share of Windows targets. The ps -p "${pid}" -f path (columns starting at field 8) is the de-facto fallback; Get-WmiObject/Get-CimInstance via powershell.exe would be a forward-compatible alternative if the ps -f fallback turns out to be unreliable for detecting the process in practice.
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
#3696) + scope-undef prevention gate (#3698) * fix(sidebar): hoist _sessionAttentionState to top-level scope (#3696) _sessionAttentionState was declared inside renderSessionListFromCache() and relied on function hoisting, but the top-level function _sidebarRowHasVisible Messages (reached via renderSessionListFromCache -> _partitionSidebarSessionRows) called it bare. Hoisting is scoped to the enclosing function, so every sidebar cache-render threw 'ReferenceError: _sessionAttentionState is not defined' and the session list went blank. Regressed in #3672 (v0.51.269) when _sidebarRow HasVisibleMessages was extracted to top level. Fix: move _sessionAttentionState to top-level scope (it is pure — only uses its arg plus the i18n global t), so both the visibility predicate and the nested per-row renderer can reach it. Prevention (the durable half): add scripts/scope_undef_gate.py — models the classic-<script> shared global scope (union of all static files' top-level symbols) and runs ESLint no-undef per file, flagging a function defined nested but called from a sibling scope. Wired into CI (.github/workflows/tests.yml lint job) alongside the existing no-const-assign runtime gate, plus an in-suite test (test_static_js_scope_undef.py) and a focused structural regression test (test_issue3696_session_attention_scope.py). RED/GREEN-validated against the broken tree. * fix(streaming): thread source param into stale-stream bailout; tighten scope gate Opus review of #3698 found the new scope_undef_gate's 'source' allowlist entry was masking a real same-class bug: _bailOutOfTerminalEventsFromStaleStream (declared inside attachLiveStream, params activeSid/streamId/uploaded/options) called _closeSource(source) against a 'source' not in its lexical scope. All 5 call sites are inside _wireSSE(source), but JS scope is lexical not dynamic, so the helper would throw ReferenceError: source is not defined on the stale-stream terminal-event path (user back in an active session whose old stream finalizes late). Fix: thread source as an explicit parameter (declaration + all 5 call sites), the same make-the-dependency-explicit fix as #3696 — and REMOVE the 'source' allowlist entry so the gate stays gated against that name (it now passes because the bug is fixed, not because it's allowlisted). Added the documented false-negative classes from Opus's review to the gate docstring (name-collision shadowing, destructuring-regex gap, exposure escape hatches, name-keyed allowlist) and a focused regression test. This is the prevention gate catching a real latent bug on its first outing. --------- Co-authored-by: nesquena-hermes <nesquena-hermes@users.noreply.github.com>
…➔ 0.51.293) (#856) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/nesquena/hermes-webui](https://github.com/nesquena/hermes-webui) | patch | `0.51.277` → `0.51.293` | --- ### Release Notes <details> <summary>nesquena/hermes-webui (ghcr.io/nesquena/hermes-webui)</summary> ### [`v0.51.293`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051293--2026-06-06--Release-JI-stage-s5--thinking-card-no-longer-renders-twice) [Compare Source](nesquena/hermes-webui@v0.51.292...v0.51.293) ##### Fixed - **The "Thinking" card no longer renders twice on a settled turn.** For a turn that had both a tool call and reasoning (e.g. think → call a tool → answer), the thinking card could appear once inside the collapsed **Activity** group at the top of the turn and again as a stranded second card below the answer and the `Done in …` footer. The thinking-only inline render path (added in v0.51.258 for [#​3592](nesquena/hermes-webui#3592)) now only fires when the turn has no Activity group of its own, and when it does render inline it inserts the card **above** the answer body instead of after the footer. Thinking that echoes the visible answer on a trailing reasoning-only message is also de-duplicated against the whole turn's answer text now, not just the same message's body. Genuinely thinking-only turns still show their thinking inline (the [#​3592](nesquena/hermes-webui#3592) fix is preserved, not reverted). ([#​3709](nesquena/hermes-webui#3709); supersedes [#​3708](nesquena/hermes-webui#3708)) ### [`v0.51.292`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051292--2026-06-06--Release-JH-stage-s4--compression-exhausted-turns-surface-as-errors-not-fake-completions) [Compare Source](nesquena/hermes-webui@v0.51.291...v0.51.292) ##### Fixed - **Context-compression-exhausted turns are no longer finalized as a falsely "completed" response.** When Hermes Agent exhausts context compression in a long tool-heavy turn, the streamed result can end on a tool result or an assistant `tool_calls` turn with no final assistant answer. WebUI previously rendered that as a settled, completed reply. It now classifies a persisted transcript that ends in a tool/tool-call/empty-assistant tail (or an internal `[CONTEXT COMPACTION — REFERENCE ONLY]` marker) — and `compression_exhausted`/`failed`/`partial` agent results — as a terminal failure and surfaces a clear error instead. The compression session-id migration and pre-compression snapshot now run **before** the terminal-failure path returns, so frontend/backend session state stays consistent when exhaustion fires after the agent rotates `session_id`. ([#​3316](nesquena/hermes-webui#3316), [@​franksong2702](https://github.com/franksong2702); fixes [#​3315](nesquena/hermes-webui#3315)) ### [`v0.51.291`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051291--2026-06-06--Release-JG-stage-s2--preserve-live-turn-content-when-switching-away-mid-stream) [Compare Source](nesquena/hermes-webui@v0.51.290...v0.51.291) ##### Fixed - **Switching away from a streaming session no longer loses the in-progress thinking/tool content.** When you clicked to another chat while a session was streaming during a quiet window (mid tool-execution or silent reasoning, between content events) and then switched back, the live turn's tool cards and thinking could disappear permanently — only the elapsed-time clock survived — until the response finished and the transcript re-rendered from the server. Cause: the live-turn DOM snapshot was only captured on content/`tool_complete` SSE events, so the switch-away teardown could run with a stale-or-absent snapshot, and the switch-back fallback rebuilt an empty thinking card. `closeLiveStream()` now snapshots the live turn **before** tearing the stream down, so switching back restores the exact state shown at switch-away. ([#​3668](nesquena/hermes-webui#3668)) ### [`v0.51.290`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051290--2026-06-06--Release-JF-stage-s1--profile-providermodel-now-respected-in-session-resolution) [Compare Source](nesquena/hermes-webui@v0.51.289...v0.51.290) ##### Fixed - **Profile-bound sessions now resolve their provider and model from the profile** instead of silently falling back to the global active provider. Previously, when a chat was started under a profile and the model string was not `@provider:`-qualified (and no explicit provider was sent), the backend used the catalog's global active provider — so a profile wired to one provider/key could silently run on a different one, causing **wrong credentials/billing** and **silent context truncation** (the global default model's advertised context window could differ from what the provider actually served, so the provider dropped the oldest messages and long chats "forgot" earlier content). Resolution is now authoritative from the profile across all four runtime entry points (chat start, streaming worker incl. background/btw runs, and both deferred `/api/session` display resolvers); stale models are still repaired under the profile provider — including the `openai-codex` profile + stale `openai/…` slash-model case — while native slash IDs on OpenRouter/custom providers are preserved and explicit `@provider:` qualifiers still win. ([#​3448](nesquena/hermes-webui#3448), [@​rodboev](https://github.com/rodboev); fixes [#​3405](nesquena/hermes-webui#3405)) ### [`v0.51.289`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051289--2026-06-06--Release-JE-hotfix--sidebar-ReferenceError-3696--scope-undef-prevention-gate) [Compare Source](nesquena/hermes-webui@v0.51.288...v0.51.289) ##### Fixed - **Sidebar no longer crashes with `ReferenceError: _sessionAttentionState is not defined`.** The session-attention helper was declared *inside* `renderSessionListFromCache()` and relied on function hoisting, but the top-level `_sidebarRowHasVisibleMessages` (reached via `renderSessionListFromCache` → `_partitionSidebarSessionRows`) called it bare — and hoisting is scoped to the enclosing function, so every sidebar cache-render threw and the session list went blank. `_sessionAttentionState` is now a top-level function reachable by both call sites. Regressed in [#​3672](nesquena/hermes-webui#3672) (v0.51.269). ([#​3696](nesquena/hermes-webui#3696)) - **Stale-stream terminal events no longer risk a `ReferenceError: source is not defined`.** `_bailOutOfTerminalEventsFromStaleStream` (declared inside `attachLiveStream`) called `_closeSource(source)` against a `source` that was not in its lexical scope — it would have thrown on the late-finalizing-stream path when the user is back in an active session. `source` is now threaded as an explicit parameter. Found by the new scope gate below during review. ([#​3696](nesquena/hermes-webui#3696)) ##### Internal - **New static-JS scope/undefined-reference gate (`scripts/scope_undef_gate.py`).** Models the WebUI's classic-`<script>` shared global scope and runs ESLint `no-undef` per file, flagging a function that is defined only *nested* but called from a sibling/top-level scope — the brick class behind [#​3696](nesquena/hermes-webui#3696) that `node --check`, source-presence tests, and the existing `no-const-assign` runtime gate all miss. Wired into the CI `lint` job alongside the `no-const-assign`/`no-import-assign` runtime gate, with an in-suite test (`tests/test_static_js_scope_undef.py`) and a focused structural regression test (`tests/test_issue3696_session_attention_scope.py`). ([#​3696](nesquena/hermes-webui#3696)) ### [`v0.51.288`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051288--2026-06-06--Release-JD-stage-r24--collapsible-approval-card) [Compare Source](nesquena/hermes-webui@v0.51.287...v0.51.288) ##### Added - **The tool-call approval card can be collapsed to a thin header strip.** A chevron toggle in the approval-card header shrinks the card to just its "Approval required" heading so the tool-call rationale and transcript scrolled above it stay readable; clicking again re-expands it. Includes full ARIA (`aria-expanded`/`aria-controls`/`aria-label`), an icon swap, and transcript reflow that preserves a near-bottom scroll position. State resets to expanded for each new approval, so a fresh approval is never hidden. ([#​3515](nesquena/hermes-webui#3515), [@​rodboev](https://github.com/rodboev); closes [#​3007](nesquena/hermes-webui#3007)) ### [`v0.51.287`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051287--2026-06-06--Release-JC-stage-r22--WeCom-session-classification--worker-profile-picker-hiding) [Compare Source](nesquena/hermes-webui@v0.51.286...v0.51.287) ##### Fixed - **WeCom gateway sessions are now classified as messaging conversations.** Rows arriving with raw sources `wecom` / `wecom_callback` are normalized into the messaging category (alongside weixin/telegram/discord/slack/email) and given proper "WeCom" / "WeCom Callback" display names, so they group and surface correctly in the sidebar. ([#​3653](nesquena/hermes-webui#3653), [@​franksong2702](https://github.com/franksong2702)) ##### Changed - **Worker profiles are hidden from the chat profile picker.** Worker profiles (used for orchestrator/Kanban dispatch) are no longer offered as normal human chat targets in the picker, while still appearing in the profile management view with a "Hidden from chat" badge. The active profile is never hidden. ([#​3662](nesquena/hermes-webui#3662), [@​Chukwuebuka-20](https://github.com/Chukwuebuka-20)) ### [`v0.51.286`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051286--2026-06-06--Release-JB-stage-r21--sidebar-tab-reordering) [Compare Source](nesquena/hermes-webui@v0.51.285...v0.51.286) ##### Added - **Drag-reorder for sidebar tabs.** In Settings → Appearance, the "Sidebar tabs" chips (Tasks, Kanban, Skills, Memory, Spaces, Profiles, Todos, Insights, Logs) can be dragged to reorder how they appear in the left rail and sidebar nav, persisted via a sanitized `tab_order` setting (collapses duplicates, rejects `chat`/`settings`, strips non-strings). Chat and Settings stay fixed. Reorder is pointer/desktop-based (consistent with the existing Kanban drag-and-drop); the chips remain tappable for show/hide on touch. ([#​3067](nesquena/hermes-webui#3067), [@​ai-ag2026](https://github.com/ai-ag2026)) ### [`v0.51.285`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051285--2026-06-06--Release-JA-stage-r19--update-reload-server-identity-race-fix) [Compare Source](nesquena/hermes-webui@v0.51.284...v0.51.285) ##### Fixed - **Don't reload the page until the *replacement* server is actually up after an update.** The post-update reload previously compared raw `/health` uptime, which couldn't distinguish a still-running old process from the restarted one (it could reload against the old process or hang). The client now reads a stable `server_started_at` identity before the update POST and reloads only once `/health` reports a *different* identity (with a null-baseline fallback). Both the force-update and regular apply paths read and pass the baseline. ([#​3654](nesquena/hermes-webui#3654), [@​franksong2702](https://github.com/franksong2702); [#​874](nesquena/hermes-webui#874)) ### [`v0.51.284`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051284--2026-06-05--Release-IZ-stage-w4--sidebar-status-labels--cron-sessions-toggle) [Compare Source](nesquena/hermes-webui@v0.51.283...v0.51.284) ##### Added - **Manual session status labels (Todo / In Progress / Done).** Tag any session from its row's ⋯ menu with a colored status badge (blue Todo / amber In Progress / green Done), stored per-session in localStorage. The badge renders inline on the sidebar row and uses theme variables so it adapts to light/dark and skins. ([#​3570](nesquena/hermes-webui#3570), [@​rodboev](https://github.com/rodboev)) - **"Show cron sessions" preference** (Settings → Preferences). Surfaces cron-job output as conversations in the sidebar. Off by default and gated under "Show non-WebUI sessions" — only active once non-WebUI sessions are enabled — with a note that high-frequency jobs can flood the sidebar. ([#​3514](nesquena/hermes-webui#3514), [@​rodboev](https://github.com/rodboev); closes [#​2841](nesquena/hermes-webui#2841)) ### [`v0.51.283`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051283--2026-06-05--Release-IY-stage-w2--composer-queue-hint-during-auto-compaction) [Compare Source](nesquena/hermes-webui@v0.51.282...v0.51.283) ##### Fixed - **The composer now tells you a message will queue during auto-compaction instead of looking dead.** While automatic compression runs, the send button previously went `disabled` with only a "Waiting for compression to finish" tooltip. It now shows a `queue` action with the placeholder + tooltip "Type a message — it will queue and send after compression", so you can type and have it sent automatically when compaction completes. ([#​3512](nesquena/hermes-webui#3512), [@​rodboev](https://github.com/rodboev); closes [#​3079](nesquena/hermes-webui#3079)) ### [`v0.51.282`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051282--2026-06-05--Release-IX-stage-3544--surface-memoryskill-saves-in-Activity-summary) [Compare Source](nesquena/hermes-webui@v0.51.281...v0.51.282) ##### Added - **The collapsed Activity summary now shows when the agent saved a memory or updated a skill** — e.g. "Activity: 2 tools, 1 memory saved, 1 skill updated" — so persistent-state changes are visible at a glance without expanding the group. Detection matches the real tool action vocabularies (`memory`: add/replace count as saves, `remove` excluded; `skill_manage`: create/patch/edit/write\_file count as updates, delete/remove\_file excluded), and only completed, non-errored calls are counted. The memory/skill counts are subtracted from the tool count so it reflects only non-memory/skill tools. Classification is stamped as durable `data-*` attributes so the suffix survives the live tool-call group's HTML snapshot/restore on session switch. Sessions with no memory/skill writes render the unchanged "Activity: N tools" label. ([#​3544](nesquena/hermes-webui#3544), [@​rodboev](https://github.com/rodboev); closes [#​3340](nesquena/hermes-webui#3340)) ### [`v0.51.281`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051281--2026-06-05--Release-IW-stage-verdigris--Verdigris-emeraldbronze-skin) [Compare Source](nesquena/hermes-webui@v0.51.280...v0.51.281) ##### Added - **New "Verdigris" appearance skin** — a dark-only emerald/forest-green palette (`#​0F1714` background, `#​121D18` sidebar) with bronze-gold accents (`#C89A5A`), named for the green-bronze patina on aged copper. Selectable in Settings → Appearance and via `/theme verdigris`. Fully scoped under `:root.dark[data-skin="verdigris"]` (no bleed into the default appearance or other skins), with component-level accents for the new-chat button, scrollbar, tool cards, tree viewer, session badges/tags, diff blocks, MCP status, and image lightbox. ([#​3602](nesquena/hermes-webui#3602), [@​rodboev](https://github.com/rodboev); closes [#​3357](nesquena/hermes-webui#3357)) ### [`v0.51.280`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051280--2026-06-05--Release-IV-stage-p3i--Windows-self-update-restart-fix) [Compare Source](nesquena/hermes-webui@v0.51.279...v0.51.280) ##### Fixed - **Self-update now restarts correctly on Windows.** `os.execv` does not replace the current process on Windows (it spawns a new one while the old keeps running), so the old process held port 8787 and the new process failed to bind ("address already in use"), surfacing as "Update failed" after the timeout. On Windows the restart now launches a detached new process (`subprocess.Popen` with `DETACHED_PROCESS | CREATE_NEW_PROCESS_GROUP`) and exits the old one immediately to release the port, plus a bounded bind-retry loop in `server_bind()` (up to 10s) to ride out the `SO_EXCLUSIVEADDRUSE` teardown window. POSIX behavior is unchanged (still `os.execv`). ([#​3647](nesquena/hermes-webui#3647), [@​jja881](https://github.com/jja881)) ### [`v0.51.279`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051279--2026-06-05--Release-IU-stage-p3h--preserve-Activitystreaming-turn-on-mid-stream-scroll) [Compare Source](nesquena/hermes-webui@v0.51.278...v0.51.279) ##### Fixed - **Loading earlier messages during an active stream no longer wipes the Activity panel or the current streaming turn.** Two causes: (1) the message merge/dedup keys didn't include `tool_calls`, so assistant messages invoking *different* tools with identical empty content and same-second timestamps collapsed into one — dropping every state.db tool-call after the first the sidecar registered; (2) `_syncToolCallsForLoadedMessages` cleared `S.toolCalls` while `S.busy` blocked the `renderMessages` rebuild. `tool_calls` is now part of the merge/dedup/visible keys (with a preservation branch so distinct tool invocations within the sidecar timestamp window aren't skipped), and the frontend keeps the live tool-call/streaming state when paging in history. ([#​3665](nesquena/hermes-webui#3665), [@​mysoul12138](https://github.com/mysoul12138); fixes [#​3346](nesquena/hermes-webui#3346)) ### [`v0.51.278`](https://github.com/nesquena/hermes-webui/blob/HEAD/CHANGELOG.md#v051278--2026-06-05--Release-IT-stage-p3g--repair-inline-PDF-preview) [Compare Source](nesquena/hermes-webui@v0.51.277...v0.51.278) ##### Fixed - **Inline PDF preview in chat now renders again.** The PDF.js loader previously created a `<script>` with both `src` and `textContent` set (the latter is ignored when `src` is present), so PDF.js never initialized and the preview hung on the spinner before degrading to a download link. It now loads PDF.js via a blob module script that sets the worker source, passes `isEvalSupported:false` to harden the parser, and revokes the blob URL on load. CSP gains `blob:` in `script-src` and a scoped `worker-src blob: 'self' https://cdn.jsdelivr.net` to permit the worker. ([#​3652](nesquena/hermes-webui#3652), [@​xx77yy](https://github.com/xx77yy); closes [#​3649](nesquena/hermes-webui#3649)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEwMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL3BhdGNoIl19--> Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/856
…e + Windows ctl) (nesquena#3672) * perf(ui): single-pass sidebar session row partitioning (nesquena#3658) Co-authored-by: Pamnard <pamnard@users.noreply.github.com> * fix(search): scope session search to active profile (nesquena#3646) Co-authored-by: hinotoi-agent <paperlantern.agent@gmail.com> * fix(ctl): tree-kill ctl.sh stop on Windows (nesquena#3670) Co-authored-by: Rod Boev <rod.boev@gmail.com> * docs(changelog): v0.51.269 — Release IK (stage-b2) --------- Co-authored-by: nesquena-hermes <[email protected]> Co-authored-by: Pamnard <pamnard@users.noreply.github.com> Co-authored-by: hinotoi-agent <paperlantern.agent@gmail.com> Co-authored-by: Rod Boev <rod.boev@gmail.com>
nesquena#3696) + scope-undef prevention gate (nesquena#3698) * fix(sidebar): hoist _sessionAttentionState to top-level scope (nesquena#3696) _sessionAttentionState was declared inside renderSessionListFromCache() and relied on function hoisting, but the top-level function _sidebarRowHasVisible Messages (reached via renderSessionListFromCache -> _partitionSidebarSessionRows) called it bare. Hoisting is scoped to the enclosing function, so every sidebar cache-render threw 'ReferenceError: _sessionAttentionState is not defined' and the session list went blank. Regressed in nesquena#3672 (v0.51.269) when _sidebarRow HasVisibleMessages was extracted to top level. Fix: move _sessionAttentionState to top-level scope (it is pure — only uses its arg plus the i18n global t), so both the visibility predicate and the nested per-row renderer can reach it. Prevention (the durable half): add scripts/scope_undef_gate.py — models the classic-<script> shared global scope (union of all static files' top-level symbols) and runs ESLint no-undef per file, flagging a function defined nested but called from a sibling scope. Wired into CI (.github/workflows/tests.yml lint job) alongside the existing no-const-assign runtime gate, plus an in-suite test (test_static_js_scope_undef.py) and a focused structural regression test (test_issue3696_session_attention_scope.py). RED/GREEN-validated against the broken tree. * fix(streaming): thread source param into stale-stream bailout; tighten scope gate Opus review of nesquena#3698 found the new scope_undef_gate's 'source' allowlist entry was masking a real same-class bug: _bailOutOfTerminalEventsFromStaleStream (declared inside attachLiveStream, params activeSid/streamId/uploaded/options) called _closeSource(source) against a 'source' not in its lexical scope. All 5 call sites are inside _wireSSE(source), but JS scope is lexical not dynamic, so the helper would throw ReferenceError: source is not defined on the stale-stream terminal-event path (user back in an active session whose old stream finalizes late). Fix: thread source as an explicit parameter (declaration + all 5 call sites), the same make-the-dependency-explicit fix as nesquena#3696 — and REMOVE the 'source' allowlist entry so the gate stays gated against that name (it now passes because the bug is fixed, not because it's allowlisted). Added the documented false-negative classes from Opus's review to the gate docstring (name-collision shadowing, destructuring-regex gap, exposure escape hatches, name-keyed allowlist) and a focused regression test. This is the prevention gate catching a real latent bug on its first outing. --------- Co-authored-by: nesquena-hermes <nesquena-hermes@users.noreply.github.com>
Release v0.51.269 — Release IK (stage-b2)
Low-risk Phase-1 batch of 3 isolated contributor PRs (disjoint files: sessions.js / routes.py / ctl.sh). Full suite green, Codex SAFE TO SHIP, Opus ship.
Fixed
?all_profiles=1returns the aggregate).ctl.sh stop(taskkill //F //T) + Windows/POSIX path normalization; POSIX behavior unchanged.Performance
.filter()chain per render); behavior-identical.Gates
node -c+ast.parse+bash -nclean, ruff CLEAN, ESLint runtime CLEAN, browser smoke CLEANctl.sh stopcheck confirming Linux unchanged)Closes #3658, #3646, #3670