docs: v0.37.0 release notes, version bump, test count (465 tests) (#144 )

Co-authored-by: Nathan Esquenazi <nesquena@gmail.com>
feat: /personality slash command with backend integration (#143 )
2026-04-06 11:19:19 -07:00 · 2026-04-06 11:16:37 -07:00 · 2026-04-06 11:05:44 -07:00 · 2026-04-06 11:02:25 -07:00 · 2026-04-06 08:21:04 -07:00 · 2026-04-06 08:14:59 -07:00
30 changed files with 1269 additions and 121 deletions
--- a/.env.example
+++ b/.env.example
@@ -26,3 +26,6 @@

 # Path to your Hermes config.yaml (for toolsets and model config)
 # HERMES_CONFIG_PATH=~/.hermes/config.yaml
+
+# Display name for the assistant in the UI (default: Hermes)
+# HERMES_WEBUI_BOT_NAME=Hermes
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,89 @@

 ---

+## [v0.37.0] /personality command, model prefix routing fix, tool card reload fix
+*April 6, 2026 | 465 tests*
+
+### Features
+- **`/personality` slash command.** Set a per-session agent personality from `~/.hermes/personalities/<name>/SOUL.md`. The personality prompt is prepended to the system message for every turn. Use `/personality <name>` to activate, `/personality none` to clear, `/personality` (no args) to list available personalities. Backend: `GET /api/personalities`, `POST /api/personality/set`. (PR #143)
+
+### Bug Fixes
+- **Model dropdown routes non-default provider models correctly (#138).** When the active provider is `anthropic` and you pick a `minimax` model, its ID is now prefixed `minimax/MiniMax-M2.7` so `resolve_model_provider()` can route it through OpenRouter. Guards added: `active_provider=None` prevents all-providers-prefixed, case is normalised, shared `_PROVIDER_MODELS` list is no longer mutated by the default_model injector. (PR #142)
+- **Tool call cards persist correctly after page reload.** The reload rendering logic now anchors cards AFTER the triggering assistant row (not before the next one), handles multi-step chains sharing a filtered anchor in chronological order, and filters fallback anchor to assistant rows only. (PR #141)
+
+---
+
+## [v0.36.3] Configurable Assistant Name
+*April 6, 2026 | 449 tests*
+
+### Features
+- **Configurable bot name.** New "Assistant Name" field in Settings panel.
+  Display name updates throughout the UI: sidebar, topbar, message roles,
+  login page, browser tab title, and composer placeholder. Defaults to
+  "Hermes". Configurable via settings or `HERMES_WEBUI_BOT_NAME` env var.
+  Server-side sanitization prevents empty names and escapes HTML for the
+  login page. (PR #135, based on #131 by @TaraTheStar)
+
+---
+
+## [v0.36.2] OpenRouter model routing fix
+*April 5, 2026 | 440 tests*
+
+### Bug Fixes
+- **OpenRouter models sent without prefix, causing 404 (#116).** `resolve_model_provider()` was stripping the `openrouter/` prefix from model IDs (e.g. sending `free` instead of `openrouter/free`) when `config_provider == 'openrouter'`. OpenRouter requires the full `provider/model` path to route upstream correctly. Fixed with an early return that preserves the complete model ID for all OpenRouter configs. (#127)
+- Added 7 unit tests for `resolve_model_provider()` — first coverage on this function. Tests the regression, cross-provider routing, direct-API prefix stripping, bare models, and empty model.
+
+---
+
+## [v0.36.1] Login form Enter key fix
+*April 5, 2026 | 433 tests*
+
+### Bug Fixes
+- **Login form Enter key unreliable in some browsers (#124).** `onsubmit="return doLogin(event)"` returned a Promise (async functions always return a truthy Promise), which could let the browser fall through to native form submission. Fixed with `doLogin(event);return false` plus an explicit `onkeydown` Enter handler on the password input as belt-and-suspenders. (#125)
+
+---
+
+## [v0.36] Self-Update Checker with One-Click Update
+*April 5, 2026 | 433 tests*
+
+### Features
+- **Update checker.** Non-blocking background check on boot detects when the
+  WebUI or hermes-agent git repos are behind upstream. Blue banner shows
+  "WebUI: N updates, Agent: N updates available" with Update Now / Later.
+- **One-click update.** "Update Now" runs `git stash && git pull --ff-only &&
+  git stash pop` on each behind repo, then reloads the page. Concurrent update
+  attempts blocked via lock. Dirty working trees safely stashed and restored.
+- **Settings toggle.** "Check for updates" checkbox in Settings panel. Persisted
+  server-side. Disabled = no background fetch, no banner.
+- **30-minute cache.** Git fetch runs at most twice per hour regardless of tab
+  count. Results cached server-side with TTL.
+- **Session-scoped dismissal.** "Later" dismisses banner for the current tab
+  session (sessionStorage). New tabs get a fresh check.
+- **Test mode.** `?test_updates=1` URL param shows the banner with fake data
+  (localhost only) for UI testing without needing to actually be behind.
+
+### Architecture
+- New `api/updates.py`: `check_for_updates()`, `apply_update()`. Thread-safe
+  caching with `_cache_lock`. Concurrent apply blocked with `_apply_lock`.
+  Default branch auto-detected (master/main).
+- `api/routes.py`: `GET /api/updates/check`, `POST /api/updates/apply`.
+  Simulate endpoint gated to 127.0.0.1.
+- `static/ui.js`: `_showUpdateBanner()`, `dismissUpdate()`, `applyUpdates()`.
+- `static/boot.js`: fire-and-forget check on boot (does not block UI).
+- `api/config.py`: `check_for_updates` in settings defaults + bool keys.
+- Docker safe: all git ops gated by `.git` directory existence check.
+
+---
+
+## [v0.35.1] Model dropdown fixes
+*April 5, 2026 | 433 tests*
+
+### Bug Fixes
+- **Custom providers invisible in model dropdown (#117).** `cfg_base_url` was scoped inside a conditional block but referenced unconditionally, causing a `NameError` for users with a `base_url` in config.yaml. Fix: initialize to `''` before the block. (#118)
+- **Configured default model missing from dropdown (#116).** OpenRouter and other providers replaced the model list with a hardcoded fallback that didn't include `model.default` values like `openrouter/free` or custom local model names. Fix: after building all groups, inject the configured `default_model` at the top of its provider group if absent. (#119)
+
+---
+
 ## [v0.35] Security hardening
 *April 5, 2026 | 433 tests*

@@ -1227,4 +1310,7 @@ Three-panel layout: sessions sidebar, chat area, workspace panel.

 ---

-*Last updated: v0.34, April 5, 2026 | Tests: 433*
+*Last updated: v0.36, April 5, 2026 | Tests: 433*
+
+### Markdown sweep
+- ROADMAP.md, TESTING.md, SPRINTS.md, README.md, and THEMES.md refreshed to match v0.36 and 433 tests.
--- a/README.md
+++ b/README.md
@@ -16,11 +16,11 @@ center for chat, right for workspace file browsing.
  <tr>
    <td width="50%" align="center">
      <img alt="Light mode with full profile support" src="https://github.com/user-attachments/assets/9b68142f-d974-4493-a8d1-fd73e622c7fd" />
-      <br /><sub>Workspace file browser with inline preview</sub>
+      <br /><sub>Light mode with full profile support</sub>
    </td>
    <td width="50%" align="center">
-      <img alt="Customize your settings, and configure a password" src="https://github.com/user-attachments/assets/941f3156-21e3-41fd-bcc8-f975d5000cb8" />
-      <br /><sub>Session projects, tags, and tool call cards</sub>
+      <img alt="Customize your settings, configure a password" src="https://github.com/user-attachments/assets/941f3156-21e3-41fd-bcc8-f975d5000cb8" />
+      <br /><sub>Customize your settings, configure a password</sub>
    </td>
  </tr>
 </table>
@@ -215,6 +215,40 @@ are running over SSH.

 ---

+## Accessing on your phone with Tailscale
+
+[Tailscale](https://tailscale.com) is a zero-config mesh VPN built on
+WireGuard. Install it on your server and your phone, and they join the same
+private network -- no port forwarding, no SSH tunnels, no public exposure.
+
+The Hermes Web UI is fully responsive with a mobile-optimized layout
+(hamburger sidebar, bottom navigation bar, touch-friendly controls), so it
+works well as a daily-driver agent interface from your phone.
+
+**Setup:**
+
+1. Install [Tailscale](https://tailscale.com/download) on your server and
+   your iPhone/Android.
+2. Start the WebUI listening on all interfaces with password auth enabled:
+
+```bash
+HERMES_WEBUI_HOST=0.0.0.0 HERMES_WEBUI_PASSWORD=your-secret ./start.sh
+```
+
+3. Open `http://<server-tailscale-ip>:8787` in your phone's browser
+   (find your server's Tailscale IP in the Tailscale app or with
+   `tailscale ip -4` on the server).
+
+That's it. Traffic is encrypted end-to-end by WireGuard, and password auth
+protects the UI at the application level. You can add it to your home screen
+for an app-like experience.
+
+> **Tip:** If using Docker, set `HERMES_WEBUI_HOST=0.0.0.0` in your
+> `docker-compose.yml` environment (already the default) and set
+> `HERMES_WEBUI_PASSWORD`.
+
+---
+
 ## Manual launch (without start.sh)

 If you prefer to launch the server directly:
@@ -250,8 +284,8 @@ Or using the agent venv explicitly:
 ```

 Tests run against an isolated server on port 8788 with a separate state directory.
-Production data and real cron jobs are never touched. Current count: **424 tests**
-across 22 test files.
+Production data and real cron jobs are never touched. Current count: **433 tests**
+across 23 test files.

 ---

--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -3,7 +3,7 @@
 > Goal: Full 1:1 parity with the Hermes CLI experience via a clean dark web UI.
 > Everything you can do from the CLI terminal, you can do from this UI.
 >
-> Last updated: v0.35 (April 5, 2026)
+> Last updated: v0.36 (April 5, 2026)
 > Tests: 433 total (433 passing, 0 failures)
 > Source: <repo>/

--- a/SPRINTS.md
+++ b/SPRINTS.md
@@ -1,6 +1,6 @@
 # Hermes Web UI -- Forward Sprint Plan

-> Current state: v0.35 | 433 tests | Daily driver ready
+> Current state: v0.36 | 433 tests | Daily driver ready
 > This document plans the path from here to two targets:
 >
 > Target A: 1:1 feature parity with the Hermes CLI (everything you can do from the
@@ -14,19 +14,27 @@

 ---

-## Where we are now (v0.21)
+## Where we are now (v0.36)

-**CLI parity: ~90% complete.** Core agent loop, all tools visible, workspace
-file ops with tree view, cron/skills/memory CRUD, session management, streaming,
-cancel, multi-provider models, custom endpoint discovery, slash commands,
-thinking/reasoning display, password auth -- all solid. Gaps are subagent
-visibility, toolset control, and code execution.
+**CLI parity: ~95% complete.** Core agent loop, all tools visible, workspace
+file ops with tree view and git detection, cron/skills/memory CRUD, session
+management, streaming with rAF throttle, cancel, multi-provider models, custom
+endpoint discovery, slash commands (help/clear/model/workspace/new/usage/theme/compact),
+thinking/reasoning display, password auth, multi-profile support with seamless
+switching, CLI session bridge (read and import from state.db), context
+auto-compaction handling, self-update checker. Remaining gaps: subagent
+session tree, toolset control per session, code execution cells.

-**Claude parity: ~70% complete.** Chat, streaming, file browser, session
-management, tool cards, syntax highlighting, model switching, projects,
-settings, Mermaid diagrams, mobile layout, breadcrumb workspace nav, slash
-commands, thinking display, auth -- all present. Gaps are artifacts, voice,
-TTS, sharing, mobile-optimized layout.
+**Claude parity: ~85% complete.** Chat, streaming, file browser, session
+management with projects and tags, tool cards with subagent delegation,
+syntax highlighting, model switching, Mermaid diagrams, mobile responsive
+layout (hamburger sidebar, bottom nav, files slide-over), breadcrumb
+workspace nav with tree view, slash commands, thinking/reasoning display,
+auth with signed cookies, 6 pluggable UI themes (dark/light/slate/solarized/
+monokai/nord), voice input (Web Speech API), collapsible date groups,
+context usage indicator, token/cost display, git branch badge, Docker
+support. Remaining gaps: artifacts (HTML/SVG preview), TTS playback,
+sharing/public URLs, code execution inline.

 ---

@@ -1156,6 +1164,7 @@ New test cases in `tests/test_sprint26.py`:
 ---

 *Last updated: April 5, 2026*
-*Current version: v0.35 | 433 tests*
+*Current version: v0.36.2 | 440 tests*
 *Next sprint: Sprint 24 (Web Polish + Bug Fix Pass)*
 *Horizon sprint: Sprint 25 (macOS Desktop Application)*
+*Docs sweep policy: update markdown proactively during PR reviews and after significant releases*
--- a/TESTING.md
+++ b/TESTING.md
@@ -1,14 +1,14 @@
 # Hermes Web UI: Browser Testing Plan

 > This document is for manual browser testing by you or by a Claude browser agent.
-> It covers user-facing features of the UI through Sprint 26 (v0.34.3).
+> It covers user-facing features of the UI through Sprint 26 (v0.36).
 > Each section is written as a step-by-step test procedure with expected outcomes.
 > A browser agent (e.g. Claude with Chrome access) can execute this plan directly.
 >
 > Prerequisites: SSH tunnel is active on port 8786. Open http://localhost:8786 in browser.
 > Server health check: curl http://127.0.0.1:8786/health should return {"status":"ok"}.
 >
-> Automated tests: 433 total (433 passing, 0 failures)
+> Automated tests: 465 total (461 passing, 4 known isolation failures in test_sprint28)
 > Run: `pytest tests/ -v --timeout=60`

 ---
@@ -1708,8 +1708,8 @@ Each has automated API-level tests in `tests/test_sprint{N}.py`.

 ---

-*Last updated: Sprint 26 / v0.34.3, April 5, 2026*
-*Total automated tests: 433 (433 passing, 0 failures)*
+*Last updated: Sprint 26 / v0.36, April 5, 2026*
+*Total automated tests: 440 (440 passing, 0 failures)*
 *Regression gate: tests/test_regressions.py*
 *Run: pytest tests/ -v --timeout=60*
 *Source: <repo>/*
--- a/THEMES.md
+++ b/THEMES.md
@@ -1,6 +1,6 @@
 # Hermes Web UI — Themes

-Hermes Web UI supports pluggable color themes. Five themes ship built-in, and
+Hermes Web UI supports pluggable color themes. Six themes ship built-in, and
 you can create your own with pure CSS — no Python changes needed.

 ---
--- a/api/auth.py
+++ b/api/auth.py
@@ -57,7 +57,7 @@ def _hash_password(password):
    return dk.hex()


-def get_password_hash():
+def get_password_hash() -> str | None:
    """Return the active password hash, or None if auth is disabled.
    Priority: env var > settings.json."""
    env_pw = os.getenv('HERMES_WEBUI_PASSWORD', '').strip()
@@ -67,12 +67,12 @@ def get_password_hash():
    return settings.get('password_hash') or None


-def is_auth_enabled():
+def is_auth_enabled() -> bool:
    """True if a password is configured (env var or settings)."""
    return get_password_hash() is not None


-def verify_password(plain):
+def verify_password(plain) -> bool:
    """Verify a plaintext password against the stored hash."""
    expected = get_password_hash()
    if not expected:
@@ -80,7 +80,7 @@ def verify_password(plain):
    return hmac.compare_digest(_hash_password(plain), expected)


-def create_session():
+def create_session() -> str:
    """Create a new auth session. Returns signed cookie value."""
    token = secrets.token_hex(32)
    _sessions[token] = time.time() + SESSION_TTL
@@ -88,7 +88,7 @@ def create_session():
    return f"{token}.{sig}"


-def verify_session(cookie_value):
+def verify_session(cookie_value) -> bool:
    """Verify a signed session cookie. Returns True if valid and not expired."""
    if not cookie_value or '.' not in cookie_value:
        return False
@@ -103,14 +103,14 @@ def verify_session(cookie_value):
    return True


-def invalidate_session(cookie_value):
+def invalidate_session(cookie_value) -> None:
    """Remove a session token."""
    if cookie_value and '.' in cookie_value:
        token = cookie_value.rsplit('.', 1)[0]
        _sessions.pop(token, None)


-def parse_cookie(handler):
+def parse_cookie(handler) -> str | None:
    """Extract the auth cookie from the request headers."""
    cookie_header = handler.headers.get('Cookie', '')
    if not cookie_header:
@@ -124,7 +124,7 @@ def parse_cookie(handler):
    return morsel.value if morsel else None


-def check_auth(handler, parsed):
+def check_auth(handler, parsed) -> bool:
    """Check if request is authorized. Returns True if OK.
    If not authorized, sends 401 (API) or 302 redirect (page) and returns False."""
    if not is_auth_enabled():
@@ -149,7 +149,7 @@ def check_auth(handler, parsed):
    return False


-def set_auth_cookie(handler, cookie_value):
+def set_auth_cookie(handler, cookie_value) -> None:
    """Set the auth cookie on the response."""
    cookie = http.cookies.SimpleCookie()
    cookie[COOKIE_NAME] = cookie_value
@@ -160,7 +160,7 @@ def set_auth_cookie(handler, cookie_value):
    handler.send_header('Set-Cookie', cookie[COOKIE_NAME].OutputString())


-def clear_auth_cookie(handler):
+def clear_auth_cookie(handler) -> None:
    """Clear the auth cookie on the response."""
    cookie = http.cookies.SimpleCookie()
    cookie[COOKIE_NAME] = ''
--- a/api/config.py
+++ b/api/config.py
@@ -169,7 +169,7 @@ def get_config() -> dict:
        reload_config()
    return _cfg_cache

-def reload_config():
+def reload_config() -> None:
    """Reload config.yaml from the active profile's directory."""
    with _cfg_lock:
        _cfg_cache.clear()
@@ -208,7 +208,7 @@ DEFAULT_WORKSPACE = _discover_default_workspace()
 DEFAULT_MODEL     = os.getenv('HERMES_WEBUI_DEFAULT_MODEL', 'openai/gpt-5.4-mini')

 # ── Startup diagnostics ───────────────────────────────────────────────────────
-def print_startup_config():
+def print_startup_config() -> None:
    """Print detected configuration at startup so the user can verify what was found."""
    ok   = '\033[32m[ok]\033[0m'
    warn = '\033[33m[!!]\033[0m'
@@ -243,7 +243,7 @@ def print_startup_config():
            flush=True
        )

-def verify_hermes_imports():
+def verify_hermes_imports() -> tuple:
    """
    Attempt to import the key Hermes modules.
    Returns (ok: bool, missing: list[str], errors: dict[str, str]).
@@ -366,7 +366,7 @@ _PROVIDER_MODELS = {
 }


-def resolve_model_provider(model_id: str):
+def resolve_model_provider(model_id: str) -> tuple:
    """Resolve bare model name, provider, and base_url for AIAgent.

    Model IDs from the dropdown may include a provider prefix
@@ -391,6 +391,10 @@ def resolve_model_provider(model_id: str):

    if '/' in model_id:
        prefix, bare = model_id.split('/', 1)
+        # OpenRouter always needs the full provider/model path (e.g. openrouter/free,
+        # anthropic/claude-sonnet-4.6). Never strip the prefix for OpenRouter.
+        if config_provider == 'openrouter':
+            return model_id, 'openrouter', config_base_url
        # If prefix matches config provider exactly, strip it and use that provider directly.
        # e.g. config=anthropic, model=anthropic/claude-... → bare name to anthropic API
        if config_provider and prefix == config_provider:
@@ -426,7 +430,9 @@ def get_available_models() -> dict:
    groups = []

    # 1. Read config.yaml model section
+    cfg_base_url = ''  # must be defined before conditional blocks (#117)
    model_cfg = cfg.get('model', {})
+    cfg_base_url = ''
    if isinstance(model_cfg, str):
        default_model = model_cfg
    elif isinstance(model_cfg, dict):
@@ -579,9 +585,26 @@ def get_available_models() -> dict:
                    'models': [{'id': m['id'], 'label': m['label']} for m in _FALLBACK_MODELS],
                })
            elif pid in _PROVIDER_MODELS:
+                # For non-default providers, prefix model IDs with provider name
+                # so resolve_model_provider() can route them correctly (e.g.
+                # \"minimax/MiniMax-M2.7\" instead of bare \"MiniMax-M2.7\").
+                # The default provider's models keep bare names for direct API routing.
+                # Guard: only prefix when we have a confirmed active_provider, and
+                # normalise case before comparing (config.yaml may use 'Anthropic').
+                raw_models = _PROVIDER_MODELS[pid]
+                _active = (active_provider or '').lower()
+                if _active and pid != _active:
+                    # Shallow copy — don't mutate the shared _PROVIDER_MODELS list.
+                    # Bare IDs get prefixed; already-prefixed IDs pass through as-is.
+                    models = []
+                    for m in raw_models:
+                        mid = m['id']
+                        models.append({'id': mid if '/' in mid else f'{pid}/{mid}', 'label': m['label']})
+                else:
+                    models = list(raw_models)  # shallow copy to protect against insert() mutations
                groups.append({
                    'provider': provider_name,
-                    'models': _PROVIDER_MODELS[pid],
+                    'models': models,
                })
            else:
                # Unknown provider -- use auto-detected models if available,
@@ -606,6 +629,25 @@ def get_available_models() -> dict:
        for provider_name, models in by_provider.items():
            groups.append({'provider': provider_name, 'models': models})

+    # Ensure the user's configured default_model always appears in the dropdown.
+    # It may be missing if the model isn't in any hardcoded list (e.g. openrouter/free,
+    # a custom local model, or any model.default not in _FALLBACK_MODELS).
+    if default_model:
+        all_ids = {m['id'] for g in groups for m in g.get('models', [])}
+        if default_model not in all_ids:
+            # Determine which group to inject into
+            label = default_model.split('/')[-1] if '/' in default_model else default_model
+            injected = False
+            for g in groups:
+                if active_provider and active_provider.lower() in g.get('provider', '').lower():
+                    g['models'].insert(0, {'id': default_model, 'label': label})
+                    injected = True
+                    break
+            if not injected and groups:
+                groups[0]['models'].insert(0, {'id': default_model, 'label': label})
+            elif not groups:
+                groups.append({'provider': active_provider or 'Default', 'models': [{'id': default_model, 'label': label}]})
+
    return {
        'active_provider': active_provider,
        'default_model': default_model,
@@ -653,7 +695,9 @@ _SETTINGS_DEFAULTS = {
    'show_token_usage': False,  # show input/output token badge below assistant messages
    'show_cli_sessions': False,  # merge CLI sessions from state.db into the sidebar
    'sync_to_insights': False,  # mirror WebUI token usage to state.db for /insights
+    'check_for_updates': True,  # check if webui/agent repos are behind upstream
    'theme': 'dark',  # active UI theme name (no enum gate -- allows custom themes)
+    'bot_name': os.getenv('HERMES_WEBUI_BOT_NAME', 'Hermes'),  # display name for the assistant
    'password_hash': None,  # SHA-256 hash; None = auth disabled
 }

@@ -673,7 +717,7 @@ _SETTINGS_ALLOWED_KEYS = set(_SETTINGS_DEFAULTS.keys()) - {'password_hash'}
 _SETTINGS_ENUM_VALUES = {
    'send_key': {'enter', 'ctrl+enter'},
 }
-_SETTINGS_BOOL_KEYS = {'show_token_usage', 'show_cli_sessions', 'sync_to_insights'}
+_SETTINGS_BOOL_KEYS = {'show_token_usage', 'show_cli_sessions', 'sync_to_insights', 'check_for_updates'}

 def save_settings(settings: dict) -> dict:
    """Save settings to disk. Returns the merged settings. Ignores unknown keys."""
--- a/api/helpers.py
+++ b/api/helpers.py
@@ -6,14 +6,14 @@ from pathlib import Path
 from api.config import IMAGE_EXTS, MD_EXTS


-def require(body: dict, *fields):
+def require(body: dict, *fields) -> None:
    """Phase D: Validate required fields. Raises ValueError with clean message."""
    missing = [f for f in fields if not body.get(f) and body.get(f) != 0]
    if missing:
        raise ValueError(f"Missing required field(s): {', '.join(missing)}")


-def bad(handler, msg, status=400):
+def bad(handler, msg, status: int=400):
    """Return a clean JSON error response."""
    return j(handler, {'error': msg}, status=status)

@@ -32,7 +32,7 @@ def _security_headers(handler):
    handler.send_header('Referrer-Policy', 'same-origin')


-def j(handler, payload, status=200):
+def j(handler, payload, status: int=200) -> None:
    """Send a JSON response."""
    body = _json.dumps(payload, ensure_ascii=False, indent=2).encode('utf-8')
    handler.send_response(status)
@@ -44,7 +44,7 @@ def j(handler, payload, status=200):
    handler.wfile.write(body)


-def t(handler, payload, status=200, content_type='text/plain; charset=utf-8'):
+def t(handler, payload, status: int=200, content_type: str='text/plain; charset=utf-8') -> None:
    """Send a plain text or HTML response."""
    body = payload if isinstance(payload, bytes) else str(payload).encode('utf-8')
    handler.send_response(status)
@@ -59,7 +59,7 @@ def t(handler, payload, status=200, content_type='text/plain; charset=utf-8'):
 MAX_BODY_BYTES = 20 * 1024 * 1024  # 20MB limit for non-upload POST bodies


-def read_body(handler):
+def read_body(handler) -> dict:
    """Read and JSON-parse a POST request body (capped at 20MB)."""
    length = int(handler.headers.get('Content-Length', 0))
    if length > MAX_BODY_BYTES:
--- a/api/models.py
+++ b/api/models.py
@@ -34,12 +34,13 @@ def _write_session_index():


 class Session:
-    def __init__(self, session_id=None, title='Untitled',
+    def __init__(self, session_id: str=None, title: str='Untitled',
                 workspace=str(DEFAULT_WORKSPACE), model=DEFAULT_MODEL,
                 messages=None, created_at=None, updated_at=None,
-                 tool_calls=None, pinned=False, archived=False,
-                 project_id=None, profile=None,
-                 input_tokens=0, output_tokens=0, estimated_cost=None,
+                 tool_calls=None, pinned: bool=False, archived: bool=False,
+                 project_id: str=None, profile=None,
+                 input_tokens: int=0, output_tokens: int=0, estimated_cost=None,
+                 personality=None,
                 **kwargs):
        self.session_id = session_id or uuid.uuid4().hex[:12]
        self.title = title
@@ -56,12 +57,13 @@ class Session:
        self.input_tokens = input_tokens or 0
        self.output_tokens = output_tokens or 0
        self.estimated_cost = estimated_cost
+        self.personality = personality

    @property
    def path(self):
        return SESSION_DIR / f'{self.session_id}.json'

-    def save(self):
+    def save(self) -> None:
        self.updated_at = time.time()
        self.path.write_text(
            json.dumps(self.__dict__, ensure_ascii=False, indent=2),
@@ -76,7 +78,7 @@ class Session:
            return None
        return cls(**json.loads(p.read_text(encoding='utf-8')))

-    def compact(self):
+    def compact(self) -> dict:
        return {
            'session_id': self.session_id,
            'title': self.title,
@@ -92,6 +94,7 @@ class Session:
            'input_tokens': self.input_tokens,
            'output_tokens': self.output_tokens,
            'estimated_cost': self.estimated_cost,
+            'personality': self.personality,
        }

 def get_session(sid):
@@ -165,7 +168,7 @@ def all_sessions():
    return result


-def title_from(messages, fallback='Untitled'):
+def title_from(messages, fallback: str='Untitled'):
    """Derive a session title from the first user message."""
    for m in messages:
        if m.get('role') == 'user':
@@ -180,7 +183,7 @@ def title_from(messages, fallback='Untitled'):

 # ── Project helpers ──────────────────────────────────────────────────────────

-def load_projects():
+def load_projects() -> list:
    """Load project list from disk. Returns list of project dicts."""
    if not PROJECTS_FILE.exists():
        return []
@@ -189,12 +192,12 @@ def load_projects():
    except Exception:
        return []

-def save_projects(projects):
+def save_projects(projects) -> None:
    """Write project list to disk."""
    PROJECTS_FILE.write_text(json.dumps(projects, ensure_ascii=False, indent=2), encoding='utf-8')


-def import_cli_session(session_id, title, messages, model='unknown', profile=None):
+def import_cli_session(session_id: str, title: str, messages, model: str='unknown', profile=None):
    """Create a new WebUI session populated with CLI messages.
    Returns the Session object.
    """
@@ -212,7 +215,7 @@ def import_cli_session(session_id, title, messages, model='unknown', profile=Non

 # ── CLI session bridge ──────────────────────────────────────────────────────

-def get_cli_sessions():
+def get_cli_sessions() -> list:
    """Read CLI sessions from the agent's SQLite store and return them as
    dicts in a format the WebUI sidebar can render alongside local sessions.

@@ -296,7 +299,7 @@ def get_cli_sessions():
    return cli_sessions


-def get_cli_session_messages(sid):
+def get_cli_session_messages(sid) -> list:
    """Read messages for a single CLI session from the SQLite store.
    Returns a list of {role, content, timestamp} dicts.
    Returns empty list on any error.
@@ -338,7 +341,7 @@ def get_cli_session_messages(sid):
    return msgs


-def delete_cli_session(sid):
+def delete_cli_session(sid) -> bool:
    """Delete a CLI session from state.db (messages + session row).
    Returns True if deleted, False if not found or error.
    """
--- a/api/profiles.py
+++ b/api/profiles.py
@@ -137,7 +137,7 @@ def _reload_dotenv(home: Path):
        pass


-def init_profile_state():
+def init_profile_state() -> None:
    """Initialize profile state at server startup.

    Reads ~/.hermes/active_profile, sets HERMES_HOME env var, patches
--- a/api/routes.py
+++ b/api/routes.py
@@ -2,6 +2,7 @@
 Hermes Web UI -- Route handlers for GET and POST endpoints.
 Extracted from server.py (Sprint 11) so server.py is a thin shell.
 """
+import html as _html
 import json
 import os
 import queue
@@ -56,7 +57,7 @@ except ImportError:
 # ── Login page (self-contained, no external deps) ────────────────────────────
 _LOGIN_PAGE_HTML = '''<!doctype html>
 <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<title>Hermes — Sign in</title>
+<title>{{BOT_NAME}} — Sign in</title>
 <style>
 *{box-sizing:border-box;margin:0;padding:0}
 body{background:#1a1a2e;color:#e8e8f0;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",system-ui,sans-serif;
@@ -79,11 +80,12 @@ button:hover{background:rgba(124,185,255,.25)}
 .err{color:#e94560;font-size:12px;margin-top:10px;display:none}
 </style></head><body>
 <div class="card">
-  <div class="logo">H</div>
-  <h1>Hermes</h1>
+  <div class="logo">{{BOT_NAME_INITIAL}}</div>
+  <h1>{{BOT_NAME}}</h1>
  <p class="sub">Enter your password to continue</p>
-  <form onsubmit="return doLogin(event)">
-    <input type="password" id="pw" placeholder="Password" autofocus>
+  <form onsubmit="doLogin(event);return false">
+    <input type="password" id="pw" placeholder="Password" autofocus
+           onkeydown="if(event.key==='Enter'){doLogin(event);event.preventDefault();}">
    <button type="submit">Sign in</button>
  </form>
  <div class="err" id="err"></div>
@@ -107,7 +109,7 @@ async function doLogin(e){

 # ── GET routes ────────────────────────────────────────────────────────────────

-def handle_get(handler, parsed):
+def handle_get(handler, parsed) -> bool:
    """Handle all GET routes. Returns True if handled, False for 404."""

    if parsed.path in ('/', '/index.html'):
@@ -115,7 +117,9 @@ def handle_get(handler, parsed):
                 content_type='text/html; charset=utf-8')

    if parsed.path == '/login':
-        return t(handler, _LOGIN_PAGE_HTML, content_type='text/html; charset=utf-8')
+        _bn = _html.escape(load_settings().get('bot_name') or 'Hermes')
+        _page = _LOGIN_PAGE_HTML.replace('{{BOT_NAME}}', _bn).replace('{{BOT_NAME_INITIAL}}', _bn[0].upper())
+        return t(handler, _page, content_type='text/html; charset=utf-8')

    if parsed.path == '/api/auth/status':
        from api.auth import is_auth_enabled, parse_cookie, verify_session
@@ -214,6 +218,40 @@ def handle_get(handler, parsed):
    if parsed.path == '/api/list':
        return _handle_list_dir(handler, parsed)

+    if parsed.path == '/api/personalities':
+        personalities = []
+        try:
+            from api.profiles import get_active_hermes_home
+            p_dir = get_active_hermes_home() / 'personalities'
+        except ImportError:
+            from api.config import HOME
+            p_dir = HOME / '.hermes' / 'personalities'
+        if p_dir.is_dir():
+            p_dir_real = p_dir.resolve()
+            for d in sorted(p_dir.iterdir()):
+                # Skip symlinks — they could point outside the personalities dir
+                if d.is_symlink():
+                    continue
+                if not d.is_dir():
+                    continue
+                soul_file = d / 'SOUL.md'
+                if not soul_file.exists():
+                    continue
+                # Defense-in-depth: confirm resolved path is still inside p_dir
+                try:
+                    d.resolve().relative_to(p_dir_real)
+                except ValueError:
+                    continue
+                desc = ''
+                try:
+                    first_line = soul_file.read_text(errors='replace').strip().split('\n')[0]
+                    if first_line.startswith('#'):
+                        desc = first_line.lstrip('#').strip()
+                except Exception:
+                    pass
+                personalities.append({'name': d.name, 'description': desc})
+        return j(handler, {'personalities': personalities})
+
    if parsed.path == '/api/git-info':
        qs = parse_qs(parsed.query)
        sid = qs.get('session_id', [''])[0]
@@ -227,6 +265,22 @@ def handle_get(handler, parsed):
        info = git_info_for_workspace(Path(s.workspace))
        return j(handler, {'git': info})

+    if parsed.path == '/api/updates/check':
+        settings = load_settings()
+        if not settings.get('check_for_updates', True):
+            return j(handler, {'disabled': True})
+        qs = parse_qs(parsed.query)
+        force = qs.get('force', ['0'])[0] == '1'
+        # ?simulate=1 returns fake behind counts for UI testing (localhost only)
+        if qs.get('simulate', ['0'])[0] == '1' and handler.client_address[0] == '127.0.0.1':
+            return j(handler, {
+                'webui': {'name': 'webui', 'behind': 3, 'current_sha': 'abc1234', 'latest_sha': 'def5678', 'branch': 'master'},
+                'agent': {'name': 'agent', 'behind': 1, 'current_sha': 'aaa0001', 'latest_sha': 'bbb0002', 'branch': 'master'},
+                'checked_at': 0,
+            })
+        from api.updates import check_for_updates
+        return j(handler, check_for_updates(force=force))
+
    if parsed.path == '/api/chat/stream/status':
        stream_id = parse_qs(parsed.query).get('stream_id', [''])[0]
        return j(handler, {'active': stream_id in STREAMS, 'stream_id': stream_id})
@@ -318,7 +372,7 @@ def handle_get(handler, parsed):

 # ── POST routes ───────────────────────────────────────────────────────────────

-def handle_post(handler, parsed):
+def handle_post(handler, parsed) -> bool:
    """Handle all POST routes. Returns True if handled, False for 404."""

    if parsed.path == '/api/upload':
@@ -345,6 +399,49 @@ def handle_post(handler, parsed):
        s.save()
        return j(handler, {'session': s.compact()})

+    if parsed.path == '/api/personality/set':
+        try: require(body, 'session_id')
+        except ValueError as e: return bad(handler, str(e))
+        if 'name' not in body:
+            return bad(handler, 'Missing required field: name')
+        sid = body['session_id']
+        name = body['name'].strip()
+        try:
+            s = get_session(sid)
+        except KeyError:
+            return bad(handler, 'Session not found', 404)
+        # Read the personality SOUL.md
+        prompt = ''
+        if name:
+            # Validate name: prevent path traversal (only allow safe chars)
+            import re as _re
+            if not _re.match(r'^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$', name):
+                return bad(handler, 'Invalid personality name: letters, numbers, hyphens, underscores only')
+            try:
+                from api.profiles import get_active_hermes_home
+                p_base = get_active_hermes_home() / 'personalities'
+            except ImportError:
+                from api.config import HOME
+                p_base = HOME / '.hermes' / 'personalities'
+            p_dir = p_base / name
+            # Defense-in-depth: ensure resolved path is inside personalities dir
+            try:
+                p_dir.resolve().relative_to(p_base.resolve())
+            except ValueError:
+                return bad(handler, 'Invalid personality name')
+            soul_file = p_dir / 'SOUL.md'
+            if soul_file.exists():
+                from api.config import MAX_FILE_BYTES
+                raw = soul_file.read_text(errors='replace')
+                if len(raw) > MAX_FILE_BYTES:
+                    return bad(handler, f'SOUL.md for "{name}" exceeds maximum size ({MAX_FILE_BYTES} bytes)')
+                prompt = raw.strip()
+            else:
+                return bad(handler, f'Personality "{name}" not found', 404)
+        s.personality = name if name else None
+        s.save()
+        return j(handler, {'ok': True, 'personality': s.personality, 'prompt': prompt})
+
    if parsed.path == '/api/session/update':
        try: require(body, 'session_id')
        except ValueError as e: return bad(handler, str(e))
@@ -506,6 +603,8 @@ def handle_post(handler, parsed):

    # ── Settings (POST) ──
    if parsed.path == '/api/settings':
+        if 'bot_name' in body:
+            body['bot_name'] = (str(body['bot_name']) or '').strip() or 'Hermes'
        saved = save_settings(body)
        saved.pop('password_hash', None)  # never expose hash to client
        return j(handler, saved)
@@ -600,6 +699,14 @@ def handle_post(handler, parsed):
    if parsed.path == '/api/session/import':
        return _handle_session_import(handler, body)

+    # ── Self-update (POST) ──
+    if parsed.path == '/api/updates/apply':
+        target = body.get('target', '')
+        if target not in ('webui', 'agent'):
+            return bad(handler, 'target must be "webui" or "agent"')
+        from api.updates import apply_update
+        return j(handler, apply_update(target))
+
    # ── CLI session import (POST) ──
    if parsed.path == '/api/session/import_cli':
        return _handle_session_import_cli(handler, body)
--- a/api/state_sync.py
+++ b/api/state_sync.py
@@ -43,7 +43,7 @@ def _get_state_db():
        return None


-def sync_session_start(session_id, model=None):
+def sync_session_start(session_id: str, model=None) -> None:
    """Register a WebUI session in state.db (idempotent).
    Called when a session's first message is sent.
    """
@@ -65,8 +65,8 @@ def sync_session_start(session_id, model=None):
            pass


-def sync_session_usage(session_id, input_tokens=0, output_tokens=0,
-                       estimated_cost=None, model=None, title=None):
+def sync_session_usage(session_id: str, input_tokens: int=0, output_tokens: int=0,
+                       estimated_cost=None, model=None, title: str=None) -> None:
    """Update token usage and title for a WebUI session in state.db.
    Called after each turn completes. Uses absolute=True to set totals
    (the WebUI Session already accumulates across turns).
--- a/api/streaming.py
+++ b/api/streaming.py
@@ -5,6 +5,7 @@ Includes Sprint 10 cancel support via CANCEL_FLAGS.
 import json
 import os
 import queue
+import re
 import threading
 import time
 import traceback
@@ -205,9 +206,28 @@ def _run_agent_streaming(session_id, msg_text, model, workspace, stream_id, atta
                "write_file, read_file, search_files, terminal workdir, and patch. "
                "Never fall back to a hardcoded path when this tag is present."
            )
+            # Inject personality prompt if the session has one active
+            _personality_prompt = ''
+            _pname = getattr(s, 'personality', None)
+            if _pname and re.match(r'^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$', _pname):
+                try:
+                    from api.profiles import get_active_hermes_home
+                    _p_base = get_active_hermes_home() / 'personalities'
+                except ImportError:
+                    _p_base = Path(os.environ.get('HERMES_HOME', str(Path.home() / '.hermes'))) / 'personalities'
+                _p_soul = _p_base / _pname / 'SOUL.md'
+                try:
+                    _p_soul.resolve().relative_to(_p_base.resolve())
+                    if _p_soul.exists():
+                        from api.config import MAX_FILE_BYTES
+                        _raw = _p_soul.read_text(errors='replace')
+                        if len(_raw) <= MAX_FILE_BYTES:
+                            _personality_prompt = _raw.strip() + '\n\n'
+                except (ValueError, OSError):
+                    pass  # path traversal attempt or unreadable — skip silently
            result = agent.run_conversation(
                user_message=workspace_ctx + msg_text,
-                system_message=workspace_system_msg,
+                system_message=_personality_prompt + workspace_system_msg,
                conversation_history=_sanitize_messages_for_api(s.messages),
                task_id=session_id,
                persist_user_message=msg_text,
--- a/api/updates.py
+++ b/api/updates.py
@@ -0,0 +1,164 @@
+"""
+Hermes Web UI -- Self-update checker.
+
+Checks if the webui and hermes-agent git repos are behind their upstream
+branches. Results are cached server-side (30-min TTL) so git fetch runs
+at most twice per hour regardless of client count.
+
+Skips repos that are not git checkouts (e.g. Docker baked images where
+.git does not exist).
+"""
+import subprocess
+import threading
+import time
+from pathlib import Path
+
+from api.config import REPO_ROOT
+
+# Lazy -- may be None if agent not found
+try:
+    from api.config import _AGENT_DIR
+except ImportError:
+    _AGENT_DIR = None
+
+_update_cache = {'webui': None, 'agent': None, 'checked_at': 0}
+_cache_lock = threading.Lock()
+_check_in_progress = False
+_apply_lock = threading.Lock()   # prevents concurrent stash/pull/pop on same repo
+CACHE_TTL = 1800  # 30 minutes
+
+
+def _run_git(args, cwd, timeout=10):
+    """Run a git command and return (stdout, ok)."""
+    try:
+        r = subprocess.run(
+            ['git'] + args, cwd=str(cwd), capture_output=True,
+            text=True, timeout=timeout,
+        )
+        return r.stdout.strip(), r.returncode == 0
+    except (subprocess.TimeoutExpired, FileNotFoundError, OSError):
+        return '', False
+
+
+def _detect_default_branch(path):
+    """Detect the remote default branch (master or main)."""
+    out, ok = _run_git(['symbolic-ref', 'refs/remotes/origin/HEAD'], path)
+    if ok and out:
+        # refs/remotes/origin/master -> master
+        return out.split('/')[-1]
+    # Fallback: try master, then main
+    for branch in ('master', 'main'):
+        _, ok = _run_git(['rev-parse', '--verify', f'origin/{branch}'], path)
+        if ok:
+            return branch
+    return 'master'
+
+
+def _check_repo(path, name):
+    """Check if a git repo is behind its upstream. Returns dict or None."""
+    if path is None or not (path / '.git').exists():
+        return None
+
+    # Fetch latest from origin (network call, cached by TTL)
+    _, fetch_ok = _run_git(['fetch', 'origin', '--quiet'], path, timeout=15)
+    if not fetch_ok:
+        return {'name': name, 'behind': 0, 'error': 'fetch failed'}
+
+    branch = _detect_default_branch(path)
+
+    # Count commits behind
+    out, ok = _run_git(['rev-list', '--count', f'HEAD..origin/{branch}'], path)
+    behind = int(out) if ok and out.isdigit() else 0
+
+    # Get short SHAs for display
+    current, _ = _run_git(['rev-parse', '--short', 'HEAD'], path)
+    latest, _ = _run_git(['rev-parse', '--short', f'origin/{branch}'], path)
+
+    return {
+        'name': name,
+        'behind': behind,
+        'current_sha': current,
+        'latest_sha': latest,
+        'branch': branch,
+    }
+
+
+def check_for_updates(force=False):
+    """Return cached update status for webui and agent repos."""
+    global _check_in_progress
+    with _cache_lock:
+        if not force and time.time() - _update_cache['checked_at'] < CACHE_TTL:
+            return dict(_update_cache)
+        if _check_in_progress:
+            return dict(_update_cache)  # another thread is already checking
+        _check_in_progress = True
+
+    try:
+        # Run checks outside the lock (network I/O)
+        webui_info = _check_repo(REPO_ROOT, 'webui')
+        agent_info = _check_repo(_AGENT_DIR, 'agent')
+
+        with _cache_lock:
+            _update_cache['webui'] = webui_info
+            _update_cache['agent'] = agent_info
+            _update_cache['checked_at'] = time.time()
+            return dict(_update_cache)
+    finally:
+        _check_in_progress = False
+
+
+def apply_update(target):
+    """Stash, pull --ff-only, pop for the given target repo."""
+    if not _apply_lock.acquire(blocking=False):
+        return {'ok': False, 'message': 'Update already in progress'}
+    try:
+        return _apply_update_inner(target)
+    finally:
+        _apply_lock.release()
+
+
+def _apply_update_inner(target):
+    """Inner implementation of apply_update, called under _apply_lock."""
+    if target == 'webui':
+        path = REPO_ROOT
+    elif target == 'agent':
+        path = _AGENT_DIR
+    else:
+        return {'ok': False, 'message': f'Unknown target: {target}'}
+
+    if path is None or not (path / '.git').exists():
+        return {'ok': False, 'message': 'Not a git repository'}
+
+    branch = _detect_default_branch(path)
+
+    # Check for dirty working tree
+    status_out, _ = _run_git(['status', '--porcelain'], path)
+    stashed = False
+    if status_out:
+        _, ok = _run_git(['stash'], path)
+        if not ok:
+            return {'ok': False, 'message': 'Failed to stash local changes'}
+        stashed = True
+
+    # Pull with ff-only (no merge commits)
+    pull_out, pull_ok = _run_git(['pull', '--ff-only', 'origin', branch], path, timeout=30)
+    if not pull_ok:
+        if stashed:
+            _run_git(['stash', 'pop'], path)
+        return {'ok': False, 'message': f'Pull failed: {pull_out[:200]}'}
+
+    # Pop stash if we stashed
+    if stashed:
+        _, pop_ok = _run_git(['stash', 'pop'], path)
+        if not pop_ok:
+            return {
+                'ok': False,
+                'message': 'Updated but stash pop failed -- manual merge needed',
+                'stash_conflict': True,
+            }
+
+    # Invalidate cache
+    with _cache_lock:
+        _update_cache['checked_at'] = 0
+
+    return {'ok': True, 'message': f'{target} updated successfully', 'target': target}
--- a/api/upload.py
+++ b/api/upload.py
@@ -11,7 +11,7 @@ from api.models import get_session
 from api.workspace import safe_resolve_ws


-def parse_multipart(rfile, content_type, content_length):
+def parse_multipart(rfile, content_type, content_length) -> tuple:
    import re as _re, email.parser as _ep
    m = _re.search(r'boundary=([^;\s]+)', content_type)
    if not m:
--- a/api/workspace.py
+++ b/api/workspace.py
@@ -176,7 +176,7 @@ def load_workspaces() -> list:
    return [{'path': _profile_default_workspace(), 'name': 'Home'}]


-def save_workspaces(workspaces: list):
+def save_workspaces(workspaces: list) -> None:
    ws_file = _workspaces_file()
    ws_file.parent.mkdir(parents=True, exist_ok=True)
    ws_file.write_text(json.dumps(workspaces, ensure_ascii=False, indent=2), encoding='utf-8')
@@ -202,7 +202,7 @@ def get_last_workspace() -> str:
    return _profile_default_workspace()


-def set_last_workspace(path: str):
+def set_last_workspace(path: str) -> None:
    try:
        lw_file = _last_workspace_file()
        lw_file.parent.mkdir(parents=True, exist_ok=True)
@@ -218,7 +218,7 @@ def safe_resolve_ws(root: Path, requested: str) -> Path:
    return resolved


-def list_dir(workspace: Path, rel='.'):
+def list_dir(workspace: Path, rel: str='.'):
    target = safe_resolve_ws(workspace, rel)
    if not target.is_dir():
        raise FileNotFoundError(f"Not a directory: {rel}")
@@ -235,7 +235,7 @@ def list_dir(workspace: Path, rel='.'):
    return entries


-def read_file_content(workspace: Path, rel: str):
+def read_file_content(workspace: Path, rel: str) -> dict:
    target = safe_resolve_ws(workspace, rel)
    if not target.is_file():
        raise FileNotFoundError(f"Not a file: {rel}")
--- a/server.py
+++ b/server.py
@@ -18,7 +18,7 @@ class Handler(BaseHTTPRequestHandler):
    server_version = 'HermesWebUI/0.2'
    def log_message(self, fmt, *args): pass  # suppress default Apache-style log

-    def log_request(self, code='-', size='-'):
+    def log_request(self, code: str='-', size: str='-') -> None:
        """Structured JSON logs for each request."""
        import json as _json
        duration_ms = round((time.time() - getattr(self, '_req_t0', time.time())) * 1000, 1)
@@ -31,7 +31,7 @@ class Handler(BaseHTTPRequestHandler):
        })
        print(f'[webui] {record}', flush=True)

-    def do_GET(self):
+    def do_GET(self) -> None:
        self._req_t0 = time.time()
        try:
            parsed = urlparse(self.path)
@@ -43,7 +43,7 @@ class Handler(BaseHTTPRequestHandler):
            print(f'[webui] ERROR {self.command} {self.path}\n' + traceback.format_exc(), flush=True)
            return j(self, {'error': 'Internal server error'}, status=500)

-    def do_POST(self):
+    def do_POST(self) -> None:
        self._req_t0 = time.time()
        try:
            parsed = urlparse(self.path)
@@ -56,7 +56,7 @@ class Handler(BaseHTTPRequestHandler):
            return j(self, {'error': 'Internal server error'}, status=500)


-def main():
+def main() -> None:
    from api.config import print_startup_config, verify_hermes_imports, _HERMES_FOUND

    print_startup_config()
--- a/static/boot.js
+++ b/static/boot.js
@@ -306,9 +306,30 @@ document.querySelectorAll('.suggestion').forEach(btn=>{
  };
 })();

+function applyBotName(){
+  const name=window._botName||'Hermes';
+  document.title=name;
+  const sidebarH1=document.querySelector('.sidebar-header h1');
+  if(sidebarH1) sidebarH1.textContent=name;
+  const logo=document.querySelector('.sidebar-header .logo');
+  if(logo) logo.textContent=name.charAt(0).toUpperCase();
+  const topbarTitle=$('topbarTitle');
+  if(topbarTitle && (!S.session)) topbarTitle.textContent=name;
+  const msg=$('msg');
+  if(msg) msg.placeholder='Message '+name+'\u2026';
+}
+
 (async()=>{
  // Load send key preference
-  try{const s=await api('/api/settings');window._sendKey=s.send_key||'enter';window._showTokenUsage=!!s.show_token_usage;window._showCliSessions=!!s.show_cli_sessions;const _theme=s.theme||'dark';document.documentElement.dataset.theme=_theme;localStorage.setItem('hermes-theme',_theme);}catch(e){window._sendKey='enter';window._showTokenUsage=false;window._showCliSessions=false;}
+  let _bootSettings={};
+  try{const s=await api('/api/settings');_bootSettings=s;window._sendKey=s.send_key||'enter';window._showTokenUsage=!!s.show_token_usage;window._showCliSessions=!!s.show_cli_sessions;window._botName=s.bot_name||'Hermes';const _theme=s.theme||'dark';document.documentElement.dataset.theme=_theme;localStorage.setItem('hermes-theme',_theme);applyBotName();}catch(e){window._sendKey='enter';window._showTokenUsage=false;window._showCliSessions=false;window._botName='Hermes';_bootSettings={check_for_updates:false};}
+  // Non-blocking update check (fire-and-forget, once per tab session)
+  // ?test_updates=1 in URL forces banner display for testing (bypasses sessionStorage guards)
+  const _testUpdates=new URLSearchParams(location.search).get('test_updates')==='1';
+  if(_testUpdates||(_bootSettings.check_for_updates!==false&&!sessionStorage.getItem('hermes-update-checked')&&!sessionStorage.getItem('hermes-update-dismissed'))){
+    const _checkUrl='/api/updates/check'+(_testUpdates?'?simulate=1':'');
+    api(_checkUrl).then(d=>{if(!_testUpdates)sessionStorage.setItem('hermes-update-checked','1');if((d.webui&&d.webui.behind>0)||(d.agent&&d.agent.behind>0))_showUpdateBanner(d);}).catch(()=>{});
+  }
  // Fetch active profile
  try{const p=await api('/api/profile/active');S.activeProfile=p.name||'default';}catch(e){S.activeProfile='default';}
  // Update profile chip label immediately
--- a/static/commands.js
+++ b/static/commands.js
@@ -11,6 +11,7 @@ const COMMANDS=[
  {name:'new',       desc:'Start a new chat session',            fn:cmdNew},
  {name:'usage',     desc:'Toggle token usage display on/off',   fn:cmdUsage},
  {name:'theme',     desc:'Switch theme (dark/light/slate/solarized/monokai/nord)', fn:cmdTheme, arg:'name'},
+  {name:'personality', desc:'Switch agent personality', fn:cmdPersonality, arg:'name'},
 ];

 function parseCommand(text){
@@ -139,6 +140,36 @@ async function cmdTheme(args){
  showToast('Theme: '+t);
 }

+async function cmdPersonality(args){
+  if(!S.session){showToast('No active session');return;}
+  if(!args){
+    // List available personalities
+    try{
+      const data=await api('/api/personalities');
+      if(!data.personalities||!data.personalities.length){
+        showToast('No personalities found (add them to ~/.hermes/personalities/)');
+        return;
+      }
+      const list=data.personalities.map(p=>`  **${p.name}**${p.description?' — '+p.description:''}`).join('\n');
+      S.messages.push({role:'assistant',content:'Available personalities:\n\n'+list+'\n\nUse `/personality <name>` to switch, or `/personality none` to clear.'});
+      renderMessages();
+    }catch(e){showToast('Failed to load personalities');}
+    return;
+  }
+  const name=args.trim();
+  if(name.toLowerCase()==='none'||name.toLowerCase()==='default'||name.toLowerCase()==='clear'){
+    try{
+      await api('/api/personality/set',{method:'POST',body:JSON.stringify({session_id:S.session.session_id,name:''})});
+      showToast('Personality cleared');
+    }catch(e){showToast('Failed: '+e.message);}
+    return;
+  }
+  try{
+    const res=await api('/api/personality/set',{method:'POST',body:JSON.stringify({session_id:S.session.session_id,name})});
+    showToast('Personality: '+name);
+  }catch(e){showToast('Failed: '+e.message);}
+}
+
 // ── Autocomplete dropdown ───────────────────────────────────────────────────

 let _cmdSelectedIdx=-1;
--- a/static/index.html
+++ b/static/index.html
@@ -14,7 +14,7 @@
 <body>
 <div class="layout">
  <aside class="sidebar">
-    <div class="sidebar-header"><div class="logo">H</div><div><h1 style="margin:0;font-size:15px;font-weight:700;letter-spacing:-.01em">Hermes</h1><div style="font-size:10px;color:var(--muted);opacity:.8;margin-top:1px">v0.35</div></div></div>
+    <div class="sidebar-header"><div class="logo">H</div><div><h1 style="margin:0;font-size:15px;font-weight:700;letter-spacing:-.01em">Hermes</h1><div style="font-size:10px;color:var(--muted);opacity:.8;margin-top:1px">v0.37.0</div></div></div>
    <div class="sidebar-nav">
      <button class="nav-tab active" data-panel="chat" data-label="Chat" onclick="switchPanel('chat')" title="Chat">&#128172;</button>
      <button class="nav-tab" data-panel="tasks" data-label="Tasks" onclick="switchPanel('tasks')" title="Tasks">&#128197;</button>
@@ -203,6 +203,13 @@
      <div class="messages-inner" id="msgInner"></div>
      <div id="liveToolCards" style="display:none;max-width:800px;margin:0 auto;width:100%;padding:0 24px;"></div>
    </div>
+    <div class="update-banner" id="updateBanner">
+      <span id="updateMsg"></span>
+      <div style="display:flex;gap:8px;flex-shrink:0">
+        <button class="update-btn" onclick="dismissUpdate()">Later</button>
+        <button class="update-btn update-primary" id="btnApplyUpdate" onclick="applyUpdates()">Update Now</button>
+      </div>
+    </div>
    <div class="reconnect-banner" id="reconnectBanner">
      <span id="reconnectMsg">&#9888; A response may have been in progress when you last left. Reload messages?</span>
      <div style="display:flex;gap:8px;flex-shrink:0">
@@ -319,10 +326,6 @@
        <label for="settingsModel">Default Model</label>
        <select id="settingsModel" style="width:100%;padding:8px;background:var(--code-bg);color:var(--text);border:1px solid var(--border2);border-radius:6px"></select>
      </div>
-      <div class="settings-field">
-        <label for="settingsWorkspace">Default Workspace</label>
-        <select id="settingsWorkspace" style="width:100%;padding:8px;background:var(--code-bg);color:var(--text);border:1px solid var(--border2);border-radius:6px"></select>
-      </div>
      <div class="settings-field">
        <label for="settingsSendKey">Send Key</label>
        <select id="settingsSendKey" style="width:100%;padding:8px;background:var(--code-bg);color:var(--text);border:1px solid var(--border2);border-radius:6px">
@@ -362,6 +365,18 @@
        </label>
        <div style="font-size:11px;color:var(--muted);margin-top:4px">Mirrors WebUI token usage to state.db so <code>hermes /insights</code> includes browser session data. Off by default.</div>
      </div>
+      <div class="settings-field">
+        <label style="display:flex;align-items:center;gap:8px;cursor:pointer">
+          <input type="checkbox" id="settingsCheckUpdates" style="width:15px;height:15px;accent-color:var(--accent)">
+          Check for updates
+        </label>
+        <div style="font-size:11px;color:var(--muted);margin-top:4px">Show a banner when newer versions of the WebUI or Agent are available. Runs a background git fetch periodically.</div>
+      </div>
+      <div class="settings-field">
+        <label for="settingsBotName">Assistant Name</label>
+        <div style="font-size:11px;color:var(--muted);margin-bottom:6px">Display name for the assistant throughout the UI. Defaults to Hermes.</div>
+        <input type="text" id="settingsBotName" placeholder="Hermes" maxlength="64" style="width:100%;padding:8px;background:var(--code-bg);color:var(--text);border:1px solid var(--border2);border-radius:6px;font-size:13px">
+      </div>
      <div class="settings-field" style="border-top:1px solid var(--border);padding-top:12px;margin-top:8px">
        <label for="settingsPassword">Access Password</label>
        <div style="font-size:11px;color:var(--muted);margin-bottom:6px">Enter a new password to set or change it. Leave blank to keep current setting.</div>
--- a/static/messages.js
+++ b/static/messages.js
@@ -93,8 +93,9 @@ async function send(){
    assistantRow=document.createElement('div');assistantRow.className='msg-row';
    assistantBody=document.createElement('div');assistantBody.className='msg-body';
    const role=document.createElement('div');role.className='msg-role assistant';
-    const icon=document.createElement('div');icon.className='role-icon assistant';icon.textContent='H';
-    const lbl=document.createElement('span');lbl.style.fontSize='12px';lbl.textContent='Hermes';
+    const _bn=window._botName||'Hermes';
+    const icon=document.createElement('div');icon.className='role-icon assistant';icon.textContent=_bn.charAt(0).toUpperCase();
+    const lbl=document.createElement('span');lbl.style.fontSize='12px';lbl.textContent=_bn;
    role.appendChild(icon);role.appendChild(lbl);
    assistantRow.appendChild(role);assistantRow.appendChild(assistantBody);
    $('msgInner').appendChild(assistantRow);
--- a/static/panels.js
+++ b/static/panels.js
@@ -995,21 +995,6 @@ async function loadSettingsPanel(){
      modelSel.value=settings.default_model||'';
      modelSel.addEventListener('change',_markSettingsDirty,{once:false});
    }
-    // Populate workspace dropdown from /api/workspaces
-    const wsSel=$('settingsWorkspace');
-    if(wsSel){
-      wsSel.innerHTML='';
-      try{
-        const wsData=await api('/api/workspaces');
-        for(const w of (wsData.workspaces||[])){
-          const opt=document.createElement('option');
-          opt.value=w.path;opt.textContent=w.name||w.path;
-          wsSel.appendChild(opt);
-        }
-      }catch(e){}
-      wsSel.value=settings.default_workspace||'';
-      wsSel.addEventListener('change',_markSettingsDirty,{once:false});
-    }
    // Send key preference
    const sendKeySel=$('settingsSendKey');
    if(sendKeySel){sendKeySel.value=settings.send_key||'enter';sendKeySel.addEventListener('change',_markSettingsDirty,{once:false});}
@@ -1022,6 +1007,11 @@ async function loadSettingsPanel(){
    if(showCliCb){showCliCb.checked=!!settings.show_cli_sessions;showCliCb.addEventListener('change',_markSettingsDirty,{once:false});}
    const syncCb=$('settingsSyncInsights');
    if(syncCb){syncCb.checked=!!settings.sync_to_insights;syncCb.addEventListener('change',_markSettingsDirty,{once:false});}
+    const updateCb=$('settingsCheckUpdates');
+    if(updateCb){updateCb.checked=settings.check_for_updates!==false;updateCb.addEventListener('change',_markSettingsDirty,{once:false});}
+    // Bot name
+    const botNameField=$('settingsBotName');
+    if(botNameField){botNameField.value=settings.bot_name||'Hermes';botNameField.addEventListener('input',_markSettingsDirty,{once:false});}
    // Password field: always blank (we don't send hash back)
    const pwField=$('settingsPassword');
    if(pwField){pwField.value='';pwField.addEventListener('input',_markSettingsDirty,{once:false});}
@@ -1041,7 +1031,6 @@ async function loadSettingsPanel(){

 async function saveSettings(andClose){
  const model=($('settingsModel')||{}).value;
-  const workspace=($('settingsWorkspace')||{}).value;
  const sendKey=($('settingsSendKey')||{}).value;
  const showTokenUsage=!!($('settingsShowTokenUsage')||{}).checked;
  const showCliSessions=!!($('settingsShowCliSessions')||{}).checked;
@@ -1049,12 +1038,15 @@ async function saveSettings(andClose){
  const theme=($('settingsTheme')||{}).value||'dark';
  const body={};
  if(model) body.default_model=model;
-  if(workspace) body.default_workspace=workspace;
+
  if(sendKey) body.send_key=sendKey;
  body.theme=theme;
  body.show_token_usage=showTokenUsage;
  body.show_cli_sessions=showCliSessions;
  body.sync_to_insights=!!($('settingsSyncInsights')||{}).checked;
+  body.check_for_updates=!!($('settingsCheckUpdates')||{}).checked;
+  const botName=(($('settingsBotName')||{}).value||'').trim();
+  body.bot_name=botName||'Hermes';
  // Password: only act if the field has content; blank = leave auth unchanged
  if(pw && pw.trim()){
    try{
@@ -1073,6 +1065,8 @@ async function saveSettings(andClose){
    window._sendKey=sendKey||'enter';
    window._showTokenUsage=showTokenUsage;
    window._showCliSessions=showCliSessions;
+    window._botName=body.bot_name;
+    if(typeof applyBotName==='function') applyBotName();
    _settingsDirty=false; _settingsThemeOnOpen=theme;
    const bar=$('settingsUnsavedBar'); if(bar) bar.style.display='none';
    renderMessages();
--- a/static/sessions.js
+++ b/static/sessions.js
@@ -45,7 +45,7 @@ async function loadSession(sid){
      if(tc&&tc.name) appendLiveToolCard(tc);
    }
    syncTopbar();await loadDir('.');renderMessages();appendThinking();
-    setBusy(true);setStatus('Hermes is thinking\u2026');
+    setBusy(true);setStatus((window._botName||'Hermes')+' is thinking\u2026');
    startApprovalPolling(sid);
  }else{
    MSG_QUEUE.length=0;updateQueueBadge();  // clear queue for the viewed session
@@ -429,7 +429,7 @@ async function deleteSession(sid){
    if(remaining.sessions&&remaining.sessions.length){
      await loadSession(remaining.sessions[0].session_id);
    }else{
-      $('topbarTitle').textContent='Hermes';
+      $('topbarTitle').textContent=window._botName||'Hermes';
      $('topbarMeta').textContent='Start a new conversation';
      $('msgInner').innerHTML='';
      $('emptyState').style.display='';
--- a/static/style.css
+++ b/static/style.css
@@ -145,6 +145,13 @@
  .reconnect-banner.visible{display:flex;}
  .reconnect-btn{padding:5px 12px;border-radius:7px;font-size:12px;font-weight:600;background:rgba(201,168,76,0.15);border:1px solid rgba(201,168,76,0.4);color:var(--gold);cursor:pointer;}
  .reconnect-btn:hover{background:rgba(201,168,76,0.25);}
+  /* ── Update banner ── */
+  .update-banner{display:none;background:var(--surface);border:1px solid rgba(124,185,255,0.4);border-radius:10px;padding:10px 16px;margin:10px auto;max-width:780px;font-size:13px;color:var(--blue);align-items:center;justify-content:space-between;gap:12px;}
+  .update-banner.visible{display:flex;}
+  .update-btn{padding:5px 12px;border-radius:7px;font-size:12px;font-weight:600;background:rgba(124,185,255,0.1);border:1px solid rgba(124,185,255,0.3);color:var(--blue);cursor:pointer;transition:background .15s;}
+  .update-btn:hover{background:rgba(124,185,255,0.2);}
+  .update-primary{background:rgba(124,185,255,0.2);border-color:rgba(124,185,255,0.5);}
+  .update-btn:disabled{opacity:0.5;cursor:not-allowed;}
  /* ── Approval card ── */
  .approval-card{display:none;max-width:780px;margin:0 auto 0;padding:0 20px 12px;}
  .approval-card.visible{display:block;}
--- a/static/ui.js
+++ b/static/ui.js
@@ -237,7 +237,7 @@ function setStatus(t){
    txt.textContent=t;
    bar.style.display='';
    // Show dismiss X only for static/error messages, not transient busy ones
-    const transient = t.endsWith('…') || t === 'Hermes is thinking…';
+    const transient = t.endsWith('…') || t === (window._botName||'Hermes')+' is thinking\u2026';
    if(dismiss)dismiss.style.display=(!transient && !S.busy)?'inline':'none';
  }
 }
@@ -334,6 +334,47 @@ async function refreshSession() {
    showToast('Conversation refreshed');
  } catch(e) { setStatus('Refresh failed: ' + e.message); }
 }
+// ── Update banner ──
+function _showUpdateBanner(data){
+  const parts=[];
+  if(data.webui&&data.webui.behind>0) parts.push(`WebUI: ${data.webui.behind} update${data.webui.behind>1?'s':''}`);
+  if(data.agent&&data.agent.behind>0) parts.push(`Agent: ${data.agent.behind} update${data.agent.behind>1?'s':''}`);
+  if(!parts.length)return;
+  const msg=$('updateMsg');
+  if(msg) msg.textContent='\u2B06 '+parts.join(', ')+' available';
+  const banner=$('updateBanner');
+  if(banner) banner.classList.add('visible');
+  window._updateData=data;
+}
+function dismissUpdate(){
+  const b=$('updateBanner');if(b)b.classList.remove('visible');
+  sessionStorage.setItem('hermes-update-dismissed','1');
+}
+async function applyUpdates(){
+  const btn=$('btnApplyUpdate');
+  if(btn){btn.disabled=true;btn.textContent='Updating\u2026';}
+  const targets=[];
+  if(window._updateData?.webui?.behind>0) targets.push('webui');
+  if(window._updateData?.agent?.behind>0) targets.push('agent');
+  try{
+    for(const target of targets){
+      const res=await api('/api/updates/apply',{method:'POST',body:JSON.stringify({target})});
+      if(!res.ok){
+        showToast('Update failed ('+target+'): '+(res.message||'unknown error'));
+        if(btn){btn.disabled=false;btn.textContent='Update Now';}
+        return;
+      }
+    }
+    showToast('Updated! Reloading\u2026');
+    sessionStorage.removeItem('hermes-update-checked');
+    sessionStorage.removeItem('hermes-update-dismissed');
+    setTimeout(()=>location.reload(),1500);
+  }catch(e){
+    showToast('Update failed: '+e.message);
+    if(btn){btn.disabled=false;btn.textContent='Update Now';}
+  }
+}
+
 async function checkInflightOnBoot(sid) {
  const raw = localStorage.getItem(INFLIGHT_KEY);
  if (!raw) return;
@@ -361,7 +402,7 @@ async function checkInflightOnBoot(sid) {

 function syncTopbar(){
  if(!S.session){
-    document.title='Hermes';
+    document.title=window._botName||'Hermes';
    // Show default workspace name even without a session
    const sidebarName=$('sidebarWsName');
    if(sidebarName && sidebarName.textContent==='Workspace'){
@@ -371,7 +412,7 @@ function syncTopbar(){
  }
  const sessionTitle=S.session.title||'Untitled';
  $('topbarTitle').textContent=sessionTitle;
-  document.title=sessionTitle+' \u2014 Hermes';
+  document.title=sessionTitle+' \u2014 '+(window._botName||'Hermes');
  const vis=S.messages.filter(m=>m&&m.role&&m.role!=='tool');
  $('topbarMeta').textContent=`${vis.length} messages`;
  // If a profile switch just happened, apply its model rather than the session's stale value.
@@ -464,7 +505,8 @@ function renderMessages(){
    const retryBtn = isLastAssistant ? `<button class="msg-action-btn" title="Regenerate response" onclick="regenerateResponse(this)">&#8635;</button>` : '';
    const tsVal=m._ts||m.timestamp;
    const tsTitle=tsVal?new Date(tsVal*1000).toLocaleString():'';
-    row.innerHTML=`<div class="msg-role ${m.role}" ${tsTitle?`title="${esc(tsTitle)}"`:''}><div class="role-icon ${m.role}">${isUser?'Y':'H'}</div><span style="font-size:12px">${isUser?'You':'Hermes'}</span>${tsTitle?`<span class="msg-time">${new Date(tsVal*1000).toLocaleTimeString([],{hour:'2-digit',minute:'2-digit'})}</span>`:''}<span class="msg-actions">${editBtn}<button class="msg-copy-btn msg-action-btn" title="Copy" onclick="copyMsg(this)">&#128203;</button>${retryBtn}</span></div>${filesHtml}<div class="msg-body">${bodyHtml}</div>`;
+    const _bn=window._botName||'Hermes';
+    row.innerHTML=`<div class="msg-role ${m.role}" ${tsTitle?`title="${esc(tsTitle)}"`:''}><div class="role-icon ${m.role}">${isUser?'Y':esc(_bn.charAt(0).toUpperCase())}</div><span style="font-size:12px">${isUser?'You':esc(_bn)}</span>${tsTitle?`<span class="msg-time">${new Date(tsVal*1000).toLocaleTimeString([],{hour:'2-digit',minute:'2-digit'})}</span>`:''}<span class="msg-actions">${editBtn}<button class="msg-copy-btn msg-action-btn" title="Copy" onclick="copyMsg(this)">&#128203;</button>${retryBtn}</span></div>${filesHtml}<div class="msg-body">${bodyHtml}</div>`;
    row.dataset.rawText = String(content).trim();
    inner.appendChild(row);
  }
@@ -480,18 +522,35 @@ function renderMessages(){
      byAssistant[key].push(tc);
    }
    const allRows = Array.from(inner.querySelectorAll('.msg-row[data-msg-idx]'));
+    // Track the last inserted node per anchor so back-to-back groups for the
+    // same (filtered) anchor row are inserted in chronological order.
+    const anchorInsertAfter = new Map();
    for(const [key, cards] of Object.entries(byAssistant)){
      const aIdx = parseInt(key);
-      let insertBefore = null;
-      if(aIdx === -1){
-        for(let i=allRows.length-1;i>=0;i--){
-          const ri=parseInt(allRows[i].dataset.msgIdx||'-1',10);
-          if(ri>=0&&S.messages[ri]&&S.messages[ri].role==='assistant'){insertBefore=allRows[i];break;}
-        }
-      } else {
+      // Find the right insertion point: cards go AFTER the assistant message
+      // that triggered them. We look for the row at aIdx, or the nearest
+      // visible ASSISTANT row at or before aIdx (the assistant message may be
+      // filtered out if it contained only tool_use blocks with no text response).
+      let anchorRow = null;
+      if(aIdx >= 0){
+        // First: exact match for the assistant row
        for(const r of allRows){
          const ri=parseInt(r.dataset.msgIdx||'-1');
-          if(ri>aIdx&&S.messages[ri]&&S.messages[ri].role==='assistant'){insertBefore=r;break;}
+          if(ri===aIdx){anchorRow=r;break;}
+        }
+        // Fallback: nearest visible ASSISTANT row at or before aIdx
+        if(!anchorRow){
+          for(let i=allRows.length-1;i>=0;i--){
+            const ri=parseInt(allRows[i].dataset.msgIdx||'-1');
+            if(ri<=aIdx&&S.messages[ri]&&S.messages[ri].role==='assistant'){anchorRow=allRows[i];break;}
+          }
+        }
+      }
+      // aIdx === -1 or no assistant anchor found: attach after the last assistant row
+      if(!anchorRow){
+        for(let i=allRows.length-1;i>=0;i--){
+          const ri=parseInt(allRows[i].dataset.msgIdx||'-1',10);
+          if(ri>=0&&S.messages[ri]&&S.messages[ri].role==='assistant'){anchorRow=allRows[i];break;}
        }
      }
      const frag=document.createDocumentFragment();
@@ -512,8 +571,15 @@ function renderMessages(){
        toggle.appendChild(collapseBtn);
        frag.insertBefore(toggle,frag.firstChild);
      }
-      if(insertBefore) inner.insertBefore(frag,insertBefore);
+      // Insert after the anchor row (or after any previously inserted group for
+      // the same anchor), preserving chronological order for multi-step chains.
+      const insertAfterNode = anchorInsertAfter.get(anchorRow) || anchorRow;
+      const refNode = insertAfterNode ? insertAfterNode.nextSibling : null;
+      if(refNode) inner.insertBefore(frag,refNode);
      else inner.appendChild(frag);
+      // Record the last child we inserted so the next group for this anchor
+      // goes after it rather than back at anchorRow.nextSibling.
+      anchorInsertAfter.set(anchorRow, inner.lastChild);
    }
  }
  // Render usage badge on the last assistant message row (if enabled and usage data exists)
--- a/tests/test_model_resolver.py
+++ b/tests/test_model_resolver.py
@@ -0,0 +1,180 @@
+"""
+Tests for resolve_model_provider() model routing logic.
+Verifies that model IDs are correctly resolved to (model, provider, base_url)
+tuples for different provider configurations.
+"""
+import api.config as config
+
+
+def _resolve_with_config(model_id, provider=None, base_url=None, default=None):
+    """Helper: temporarily set config.cfg model section, call resolve, restore."""
+    old_cfg = dict(config.cfg)
+    model_cfg = {}
+    if provider:
+        model_cfg['provider'] = provider
+    if base_url:
+        model_cfg['base_url'] = base_url
+    if default:
+        model_cfg['default'] = default
+    config.cfg['model'] = model_cfg if model_cfg else {}
+    try:
+        return config.resolve_model_provider(model_id)
+    finally:
+        config.cfg.clear()
+        config.cfg.update(old_cfg)
+
+
+# ── OpenRouter prefix handling ────────────────────────────────────────────
+
+def test_openrouter_free_keeps_full_path():
+    """openrouter/free must NOT be stripped to 'free' when provider is openrouter."""
+    model, provider, base_url = _resolve_with_config(
+        'openrouter/free', provider='openrouter',
+        base_url='https://openrouter.ai/api/v1',
+    )
+    assert model == 'openrouter/free', f"Expected 'openrouter/free', got '{model}'"
+    assert provider == 'openrouter'
+
+
+def test_openrouter_model_with_provider_prefix():
+    """anthropic/claude-sonnet-4.6 via openrouter keeps full path."""
+    model, provider, base_url = _resolve_with_config(
+        'anthropic/claude-sonnet-4.6', provider='openrouter',
+        base_url='https://openrouter.ai/api/v1',
+    )
+    assert model == 'anthropic/claude-sonnet-4.6'
+    assert provider == 'openrouter'
+
+
+# ── Direct provider prefix stripping ─────────────────────────────────────
+
+def test_anthropic_prefix_stripped_for_direct_api():
+    """anthropic/claude-sonnet-4.6 strips prefix when provider is anthropic."""
+    model, provider, base_url = _resolve_with_config(
+        'anthropic/claude-sonnet-4.6', provider='anthropic',
+    )
+    assert model == 'claude-sonnet-4.6'
+    assert provider == 'anthropic'
+
+
+def test_openai_prefix_stripped_for_direct_api():
+    """openai/gpt-5.4-mini strips prefix when provider is openai."""
+    model, provider, base_url = _resolve_with_config(
+        'openai/gpt-5.4-mini', provider='openai',
+    )
+    assert model == 'gpt-5.4-mini'
+    assert provider == 'openai'
+
+
+# ── Cross-provider routing ───────────────────────────────────────────────
+
+def test_cross_provider_routes_through_openrouter():
+    """Picking openai model when config is anthropic routes via openrouter."""
+    model, provider, base_url = _resolve_with_config(
+        'openai/gpt-5.4-mini', provider='anthropic',
+    )
+    assert model == 'openai/gpt-5.4-mini'
+    assert provider == 'openrouter'
+    assert base_url is None  # openrouter uses its own endpoint
+
+
+# ── Bare model names ─────────────────────────────────────────────────────
+
+def test_bare_model_uses_config_provider():
+    """A model name without / uses the config provider and base_url."""
+    model, provider, base_url = _resolve_with_config(
+        'gemma-4-26B', provider='custom',
+        base_url='http://192.168.1.160:4000',
+    )
+    assert model == 'gemma-4-26B'
+    assert provider == 'custom'
+    assert base_url == 'http://192.168.1.160:4000'
+
+
+def test_empty_model_returns_config_defaults():
+    """Empty model string returns config provider and base_url."""
+    model, provider, base_url = _resolve_with_config(
+        '', provider='anthropic',
+    )
+    assert model == ''
+    assert provider == 'anthropic'
+
+
+# ── Non-default provider prefix routing (Issue #138) ────────────────────
+
+def test_prefixed_non_default_provider_routes_through_openrouter():
+    """minimax/MiniMax-M2.7 with anthropic as default should route via openrouter."""
+    model, provider, base_url = _resolve_with_config(
+        'minimax/MiniMax-M2.7', provider='anthropic',
+    )
+    assert model == 'minimax/MiniMax-M2.7'
+    assert provider == 'openrouter'
+
+
+def test_prefixed_non_default_provider_zai():
+    """zai/GLM-5 with openai as default should route via openrouter."""
+    model, provider, base_url = _resolve_with_config(
+        'zai/GLM-5', provider='openai',
+    )
+    assert model == 'zai/GLM-5'
+    assert provider == 'openrouter'
+
+
+# ── get_available_models() prefix behaviour ───────────────────────────────
+
+def _available_models_with_provider(provider):
+    """Helper: temporarily set active_provider in auth store simulation via config.cfg."""
+    old_cfg = dict(config.cfg)
+    config.cfg['model'] = {'provider': provider}
+    try:
+        return config.get_available_models()
+    finally:
+        config.cfg.clear()
+        config.cfg.update(old_cfg)
+
+
+def test_non_default_provider_models_are_prefixed():
+    """With anthropic as default, minimax model IDs should be prefixed 'minimax/...'."""
+    result = _available_models_with_provider('anthropic')
+    groups = {g['provider']: g['models'] for g in result['groups']}
+    if 'MiniMax' in groups:
+        for m in groups['MiniMax']:
+            assert m['id'].startswith('minimax/'), (
+                f"Expected minimax/ prefix, got: {m['id']!r}"
+            )
+
+
+def test_default_provider_models_not_prefixed():
+    """The active provider's _PROVIDER_MODELS entries remain bare (no prefix added)."""
+    import api.config as _cfg
+    # The bare IDs as stored in _PROVIDER_MODELS (e.g. 'claude-sonnet-4.6')
+    raw_anthropic_ids = {m['id'] for m in _cfg._PROVIDER_MODELS.get('anthropic', [])}
+    result = _available_models_with_provider('anthropic')
+    groups = {g['provider']: g['models'] for g in result['groups']}
+    if 'Anthropic' in groups:
+        returned_ids = {m['id'] for m in groups['Anthropic']}
+        # Every bare _PROVIDER_MODELS ID must still appear bare (not turned into 'anthropic/...')
+        for bare_id in raw_anthropic_ids:
+            assert bare_id in returned_ids, (
+                f"_PROVIDER_MODELS entry '{bare_id}' is missing from the Anthropic group "
+                f"(returned: {sorted(returned_ids)})"
+            )
+
+
+def test_no_active_provider_models_not_prefixed():
+    """With no confirmed active_provider, models should not be prefixed."""
+    old_cfg = dict(config.cfg)
+    config.cfg['model'] = {}  # no provider set
+    try:
+        result = config.get_available_models()
+        for g in result['groups']:
+            for m in g['models']:
+                # No model should have a double-prefix like 'minimax/minimax/...'
+                parts = m['id'].split('/')
+                if len(parts) >= 2:
+                    assert parts[0] != parts[1], (
+                        f"Double-prefix detected: {m['id']!r}"
+                    )
+    finally:
+        config.cfg.clear()
+        config.cfg.update(old_cfg)
--- a/tests/test_sprint27.py
+++ b/tests/test_sprint27.py
@@ -0,0 +1,136 @@
+"""
+Sprint 27 Tests: configurable assistant display name (bot_name).
+Tests cover settings API round-trip, empty/missing input defaults,
+login page rendering, and server-side sanitization.
+"""
+import json
+import urllib.error
+import urllib.request
+
+BASE = "http://127.0.0.1:8788"
+
+
+def get(path):
+    with urllib.request.urlopen(BASE + path, timeout=10) as r:
+        return json.loads(r.read()), r.status
+
+
+def get_raw(path):
+    with urllib.request.urlopen(BASE + path, timeout=10) as r:
+        return r.read().decode(), r.status
+
+
+def post(path, body=None):
+    data = json.dumps(body or {}).encode()
+    req = urllib.request.Request(BASE + path, data=data,
+                                 headers={"Content-Type": "application/json"})
+    try:
+        with urllib.request.urlopen(req, timeout=10) as r:
+            return json.loads(r.read()), r.status
+    except urllib.error.HTTPError as e:
+        return json.loads(e.read()), e.code
+
+
+# ── Default value ─────────────────────────────────────────────────────────
+
+def test_settings_default_bot_name():
+    """GET /api/settings should return bot_name defaulting to 'Hermes'."""
+    d, status = get("/api/settings")
+    assert status == 200
+    assert "bot_name" in d
+    assert d["bot_name"] == "Hermes"
+
+
+# ── Round-trip ────────────────────────────────────────────────────────────
+
+def test_settings_set_bot_name():
+    """POST /api/settings with bot_name should persist and round-trip."""
+    try:
+        d, status = post("/api/settings", {"bot_name": "TestBot"})
+        assert status == 200
+        assert d.get("bot_name") == "TestBot"
+        d2, _ = get("/api/settings")
+        assert d2.get("bot_name") == "TestBot"
+    finally:
+        post("/api/settings", {"bot_name": "Hermes"})
+
+
+def test_settings_bot_name_special_chars():
+    """bot_name with safe special characters should persist correctly."""
+    try:
+        d, status = post("/api/settings", {"bot_name": "My Assistant 2.0"})
+        assert status == 200
+        d2, _ = get("/api/settings")
+        assert d2.get("bot_name") == "My Assistant 2.0"
+    finally:
+        post("/api/settings", {"bot_name": "Hermes"})
+
+
+# ── Server-side sanitization ──────────────────────────────────────────────
+
+def test_settings_empty_bot_name_defaults_to_hermes():
+    """Posting an empty bot_name should default to 'Hermes' server-side."""
+    try:
+        d, status = post("/api/settings", {"bot_name": ""})
+        assert status == 200
+        assert d.get("bot_name") == "Hermes"
+        d2, _ = get("/api/settings")
+        assert d2.get("bot_name") == "Hermes"
+    finally:
+        post("/api/settings", {"bot_name": "Hermes"})
+
+
+def test_settings_whitespace_bot_name_defaults_to_hermes():
+    """Posting a whitespace-only bot_name should default to 'Hermes'."""
+    try:
+        d, status = post("/api/settings", {"bot_name": "   "})
+        assert status == 200
+        assert d.get("bot_name") == "Hermes"
+    finally:
+        post("/api/settings", {"bot_name": "Hermes"})
+
+
+# ── Login page rendering ──────────────────────────────────────────────────
+
+def test_login_page_shows_default_bot_name():
+    """GET /login should contain 'Hermes' in title and h1 when default."""
+    html, status = get_raw("/login")
+    assert status == 200
+    assert "<title>Hermes" in html
+    assert "<h1>Hermes</h1>" in html
+
+
+def test_login_page_shows_custom_bot_name():
+    """GET /login should reflect the configured bot_name."""
+    try:
+        post("/api/settings", {"bot_name": "Aria"})
+        html, status = get_raw("/login")
+        assert status == 200
+        assert "<title>Aria" in html
+        assert "<h1>Aria</h1>" in html
+    finally:
+        post("/api/settings", {"bot_name": "Hermes"})
+
+
+def test_login_page_empty_name_does_not_crash():
+    """Login page must not 500 even if somehow bot_name is empty in settings."""
+    # Force an empty value by patching settings file directly — skipped here
+    # because the server-side guard in POST /api/settings prevents storing empty.
+    # Instead, verify that /login returns 200 reliably.
+    html, status = get_raw("/login")
+    assert status == 200
+    assert "Sign in" in html
+
+
+def test_login_page_xss_escaped():
+    """bot_name with HTML special chars should be escaped in the login page."""
+    try:
+        post("/api/settings", {"bot_name": "<script>alert(1)</script>"})
+        html, status = get_raw("/login")
+        assert status == 200
+        # Raw tag must not appear unescaped
+        assert "<script>alert(1)</script>" not in html
+        # Escaped form should appear
+        assert "&lt;script&gt;" in html
+    finally:
+        post("/api/settings", {"bot_name": "Hermes"})
--- a/tests/test_sprint28.py
+++ b/tests/test_sprint28.py
@@ -0,0 +1,227 @@
+"""
+Sprint 28 Tests: /personality slash command — backend API coverage.
+Tests: GET /api/personalities, POST /api/personality/set, Session.compact(),
+path traversal defence, size cap, clear personality.
+"""
+import json
+import pathlib
+import shutil
+import sys
+import urllib.error
+import urllib.request
+
+# Import test constants from conftest (same process — these are module-level values)
+sys.path.insert(0, str(pathlib.Path(__file__).parent))
+from conftest import TEST_STATE_DIR
+
+BASE = "http://127.0.0.1:8788"
+
+
+def get(path):
+    with urllib.request.urlopen(BASE + path, timeout=10) as r:
+        return json.loads(r.read()), r.status
+
+
+def post(path, body=None):
+    data = json.dumps(body or {}).encode()
+    req = urllib.request.Request(BASE + path, data=data,
+                                 headers={"Content-Type": "application/json"})
+    try:
+        with urllib.request.urlopen(req, timeout=10) as r:
+            return json.loads(r.read()), r.status
+    except urllib.error.HTTPError as e:
+        return json.loads(e.read()), e.code
+
+
+def _personalities_dir():
+    """Return the personalities directory the test server will look in.
+
+    conftest sets HERMES_HOME=TEST_STATE_DIR in the server's environment.
+    The server's api/profiles._DEFAULT_HERMES_HOME resolves to TEST_STATE_DIR,
+    so get_active_hermes_home() returns TEST_STATE_DIR, and personalities
+    live at TEST_STATE_DIR/personalities.
+    """
+    p = TEST_STATE_DIR / 'personalities'
+    p.mkdir(parents=True, exist_ok=True)
+    return p
+
+
+def _make_personality(name, content="# Test Bot\nA test personality."):
+    """Create a personality directory with a SOUL.md."""
+    d = _personalities_dir() / name
+    d.mkdir(parents=True, exist_ok=True)
+    (d / "SOUL.md").write_text(content)
+    return d
+
+
+def _make_session():
+    """Create a new session and return its session_id."""
+    d, status = post("/api/session/new", {})
+    assert status == 200, f"Failed to create session: {d}"
+    return d["session"]["session_id"]
+
+
+def _cleanup_session(sid):
+    try:
+        post("/api/session/delete", {"session_id": sid})
+    except Exception:
+        pass
+
+
+# ── GET /api/personalities ────────────────────────────────────────────────────
+
+def test_personalities_empty_when_none_exist():
+    """GET /api/personalities returns empty list when no personalities exist."""
+    p_dir = _personalities_dir()
+    for child in list(p_dir.iterdir()):
+        if child.is_dir() and not child.is_symlink():
+            shutil.rmtree(child)
+    d, status = get("/api/personalities")
+    assert status == 200
+    assert d.get("personalities") == []
+
+
+def test_personalities_lists_valid_personalities():
+    """GET /api/personalities returns personalities that have SOUL.md."""
+    _make_personality("testbot", "# TestBot\nA helpful assistant.")
+    try:
+        d, status = get("/api/personalities")
+        assert status == 200
+        names = [p["name"] for p in d["personalities"]]
+        assert "testbot" in names
+        testbot = next(p for p in d["personalities"] if p["name"] == "testbot")
+        assert testbot["description"] == "TestBot"
+    finally:
+        shutil.rmtree(_personalities_dir() / "testbot", ignore_errors=True)
+
+
+def test_personalities_skips_dirs_without_soul_md():
+    """Directories without SOUL.md are not listed."""
+    empty_dir = _personalities_dir() / "nodoc"
+    empty_dir.mkdir(exist_ok=True)
+    try:
+        d, status = get("/api/personalities")
+        assert status == 200
+        names = [p["name"] for p in d["personalities"]]
+        assert "nodoc" not in names
+    finally:
+        shutil.rmtree(empty_dir, ignore_errors=True)
+
+
+def test_personalities_skips_symlinks():
+    """Symlinks inside personalities dir are skipped (security guard)."""
+    p_dir = _personalities_dir()
+    real_dir = p_dir.parent / "real_personality_target"
+    real_dir.mkdir(exist_ok=True)
+    (real_dir / "SOUL.md").write_text("# Leaked\nContent")
+    link = p_dir / "symlinked"
+    try:
+        link.symlink_to(real_dir)
+        d, status = get("/api/personalities")
+        assert status == 200
+        names = [p["name"] for p in d["personalities"]]
+        assert "symlinked" not in names
+    finally:
+        link.unlink(missing_ok=True)
+        shutil.rmtree(real_dir, ignore_errors=True)
+
+
+# ── POST /api/personality/set ─────────────────────────────────────────────────
+
+def test_set_personality_valid():
+    """Setting a valid personality stores name and returns prompt."""
+    _make_personality("assistant", "# Assistant\nBe helpful.")
+    sid = _make_session()
+    try:
+        d, status = post("/api/personality/set", {"session_id": sid, "name": "assistant"})
+        assert status == 200
+        assert d.get("ok") is True
+        assert d.get("personality") == "assistant"
+        assert "Assistant" in d.get("prompt", "")
+    finally:
+        _cleanup_session(sid)
+        shutil.rmtree(_personalities_dir() / "assistant", ignore_errors=True)
+
+
+def test_set_personality_persists_in_compact():
+    """After setting personality, GET /api/session returns personality in compact."""
+    _make_personality("coder", "# Coder\nWrite clean code.")
+    sid = _make_session()
+    try:
+        post("/api/personality/set", {"session_id": sid, "name": "coder"})
+        d, status = get(f"/api/session?session_id={sid}")
+        assert status == 200
+        session = d.get("session", {})
+        assert session.get("personality") == "coder"
+    finally:
+        _cleanup_session(sid)
+        shutil.rmtree(_personalities_dir() / "coder", ignore_errors=True)
+
+
+def test_clear_personality_sets_null():
+    """Clearing personality with name='' sets it to None (null in JSON)."""
+    _make_personality("pirate", "# Pirate\nArrr.")
+    sid = _make_session()
+    try:
+        post("/api/personality/set", {"session_id": sid, "name": "pirate"})
+        d, status = post("/api/personality/set", {"session_id": sid, "name": ""})
+        assert status == 200
+        assert d.get("personality") is None
+        # Verify persisted via direct session fetch
+        d2, s2 = get(f"/api/session?session_id={sid}")
+        assert s2 == 200
+        assert d2.get("session", {}).get("personality") is None
+    finally:
+        _cleanup_session(sid)
+        shutil.rmtree(_personalities_dir() / "pirate", ignore_errors=True)
+
+
+def test_set_personality_not_found_returns_404():
+    """Setting a non-existent personality returns 404."""
+    sid = _make_session()
+    try:
+        d, status = post("/api/personality/set",
+                         {"session_id": sid, "name": "doesnotexist"})
+        assert status == 404
+    finally:
+        _cleanup_session(sid)
+
+
+def test_set_personality_path_traversal_rejected():
+    """Personality names with path traversal chars are rejected (400)."""
+    sid = _make_session()
+    try:
+        for bad_name in ["../etc", "a/b", ".hidden", "has space"]:
+            d, status = post("/api/personality/set",
+                             {"session_id": sid, "name": bad_name})
+            assert status == 400, (
+                f"Expected 400 for name={bad_name!r}, got {status}: {d}"
+            )
+    finally:
+        _cleanup_session(sid)
+
+
+def test_set_personality_missing_session_returns_404():
+    """Setting personality on non-existent session returns 404."""
+    _make_personality("x", "# X\nTest.")
+    try:
+        d, status = post("/api/personality/set",
+                         {"session_id": "nonexistent000", "name": "x"})
+        assert status == 404
+    finally:
+        shutil.rmtree(_personalities_dir() / "x", ignore_errors=True)
+
+
+def test_set_personality_size_cap():
+    """SOUL.md files larger than MAX_FILE_BYTES are rejected."""
+    from api.config import MAX_FILE_BYTES
+    big_content = "A" * (MAX_FILE_BYTES + 1)
+    _make_personality("toobig", big_content)
+    sid = _make_session()
+    try:
+        d, status = post("/api/personality/set", {"session_id": sid, "name": "toobig"})
+        assert status == 400
+        assert "exceeds" in d.get("error", "").lower()
+    finally:
+        _cleanup_session(sid)
+        shutil.rmtree(_personalities_dir() / "toobig", ignore_errors=True)
Author	SHA1	Message	Date
nesquena-hermes	cd598c896a	docs: v0.37.0 release notes, version bump, test count (465 tests) (#144 ) Some checks failed Release & Docker / release (push) Has been cancelled Details Co-authored-by: Nathan Esquenazi <nesquena@gmail.com>	2026-04-06 11:19:19 -07:00
Nathan Esquenazi	58eb6e7fd5	feat: /personality slash command with backend integration (#143 ) * feat: /personality slash command with backend integration Add /personality command to switch the agent's system prompt personality. Hermes CLI supports personalities stored at ~/.hermes/personalities/<name>/SOUL.md. Backend: - GET /api/personalities: lists available personalities from the active profile's personalities directory (reads first line of SOUL.md for desc) - POST /api/personality/set: sets active personality on the session, reads and validates the SOUL.md file exists, returns the prompt text - streaming.py: injects personality prompt (SOUL.md content) as prefix to the system_message when run_conversation is called Frontend (commands.js): - /personality with no args: lists available personalities as a local message - /personality <name>: sets the personality with a toast confirmation - /personality none\|default\|clear: removes the active personality Session model: new 'personality' field (backward-compatible, defaults to None) Closes #139 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: path traversal in personality name + case sensitivity Security: personality name is now validated with regex ^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$ in both routes.py (POST /api/personality/set) and streaming.py (system prompt injection). Defense-in-depth: resolve().relative_to() check ensures the path stays inside the personalities directory even if regex is bypassed. Also: removed toLowerCase() from frontend command handler so personality names are case-preserved (filesystem may be case-sensitive). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: /personality command — hardened, compact() fix, tests Fixes on top of original PR: - compact() was missing 'personality' field — UI couldn't know active personality after page load. Added to Session.compact(). - GET /api/personalities: add symlink guard (is_symlink() skip) and resolve() check — prevents reading SOUL.md from symlink targets outside personalities dir. - POST /api/personality/set: require() only checks session_id (not name) so clearing with name='' works correctly instead of 400. - POST /api/personality/set: add MAX_FILE_BYTES size cap on SOUL.md to prevent unbounded context window consumption. - POST /api/personality/set: return personality:null (not '') when cleared. - streaming.py: same MAX_FILE_BYTES guard before prepending to system msg. Added tests/test_sprint28.py: 11 tests for API round-trip, listing, symlink guard, path traversal rejection, clear, size cap, persistence. Tests pass in isolation; full-suite run has a test-isolation interaction with shared server state across sprint tests (tracked as follow-up). --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-06 11:16:37 -07:00
Nathan Esquenazi	76cdfb69e0	fix: prefix non-default provider model IDs for correct routing (#142 ) * fix: prefix non-default provider model IDs for correct routing When multiple providers are configured, models from non-default providers (e.g. MiniMax when Anthropic is default) were sent as bare names without provider context. resolve_model_provider() couldn't determine the target provider and routed them to the default provider's API, which failed. Fix: get_available_models() now prefixes model IDs with the provider name (e.g. minimax/MiniMax-M2.7) for providers that are NOT the active config provider. The default provider's models keep bare names for direct API routing. This matches the existing pattern for OpenRouter models. Added 2 tests to test_model_resolver.py for cross-provider routing. Closes #138 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: model prefix — null-guard, case normalization, mutation safety, tests Four fixes on top of original PR: - active_provider=None guard: without a confirmed provider all models were being prefixed. Only prefix when active_provider is set. - Case normalisation: compare pid against active_provider.lower() so config.yaml entries like 'Anthropic' match pid 'anthropic'. - Mutation safety: default branch used raw reference to _PROVIDER_MODELS[pid]; the default_model injector later calls list.insert() on that reference, permanently mutating the shared constant. Both branches now use a copy. - Already-prefixed model IDs pass through as-is (no double-prefix). Added 3 tests for get_available_models() prefix behaviour: - Non-default provider models are prefixed - Active provider's own entries remain bare - No double-prefix when active_provider is absent --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-06 11:05:44 -07:00
Nathan Esquenazi	4622b64ca9	fix: tool call cards persist correctly after page reload (#141 ) * fix: tool call cards persist correctly after page reload Root cause: the insertion logic looked for the NEXT assistant row to insert BEFORE, but when the triggering assistant message contained only tool_use blocks (no text), it was filtered from the DOM by msgContent() and no anchor row existed. Cards were silently dropped. Fix: find the row AT the assistant_msg_idx first (exact match), fall back to the nearest preceding visible row, then insert AFTER it (not before the next). This handles both text+tool and tool-only assistant messages correctly. Closes #140 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: tool card ordering — role-filter fallback anchor, preserve order for same-anchor groups Two bugs in the initial PR: - Fallback 'nearest row' had no role filter, could anchor to a user message row causing cards to appear after a user bubble. Fixed: check role==='assistant' in the fallback loop. - Back-to-back tool-card groups sharing a filtered anchor were inserted in reverse order because each group re-read anchorRow.nextSibling from the live DOM. Fixed: track the last inserted node per anchor via anchorInsertAfter Map, so each subsequent group appends after the previous one. Also restores the 'Collect card elements before they get moved to DOM' comment explaining why Array.from() is used on frag before DOM insertion. --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-06 11:02:25 -07:00
nesquena-hermes	89891c65c8	docs: v0.36.3 version bump and test count update (449 tests) (#137 ) Co-authored-by: Nathan Esquenazi <nesquena@gmail.com>	2026-04-06 08:21:04 -07:00
Nathan Esquenazi	173261c428	Merge pull request #136 from nesquena/docs/changelog-v0.36.3 Some checks failed Release & Docker / release (push) Has been cancelled Details docs: update CHANGELOG with v0.36.3 configurable bot name	2026-04-06 08:14:59 -07:00
Nathan Esquenazi	863dc4e938	docs: update CHANGELOG with v0.36.3 configurable bot name Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-06 08:14:40 -07:00
Nathan Esquenazi	4407c3097b	Merge pull request #135 from nesquena/fix/pr-131-bot-name fix: harden bot_name feature from PR #131 — crash guard, XSS, tests	2026-04-06 08:13:49 -07:00
Nathan Esquenazi	71dd691ed0	fix: harden bot_name — crash guard, XSS escape, sanitization, tests - Move `import html` to module top (was inside function body) - Fix IndexError crash in /login when bot_name is empty string; use `or 'Hermes'` fallback instead of .get() default which doesn't guard against stored empty string - Add server-side sanitization in POST /api/settings: strip + default empty/whitespace bot_name to 'Hermes' before persisting - Escape _bn initial char in ui.js innerHTML (esc() consistency) - Add maxlength=64 to #settingsBotName input field - Add tests/test_sprint27.py: 9 tests covering API round-trip, empty/whitespace defaults, login page rendering, and XSS escaping	2026-04-06 15:06:16 +00:00
TaraTheStar	9f3b2e113e	refactor: use template vars for login page instead of string replace	2026-04-06 14:47:00 +00:00
TaraTheStar	e8a8fceb26	feat: make bot name configurable	2026-04-06 05:14:31 +00:00
nesquena-hermes	e1c2e7e3d6	docs: fix stale 433 test counts to 440 Co-authored-by: Nathan Esquenazi <nesquena@gmail.com>	2026-04-05 14:55:04 -07:00
nesquena-hermes	c6017f461b	docs: v0.36.2 release notes and version bump Some checks failed Release & Docker / release (push) Has been cancelled Details Co-authored-by: Nathan Esquenazi <nesquena@gmail.com>	2026-04-05 13:59:45 -07:00
Nathan Esquenazi	e829fa50d5	fix: OpenRouter models stripped of prefix, causing 404 (#116 ) When config has provider=openrouter and model=openrouter/free, resolve_model_provider() stripped the 'openrouter/' prefix because prefix == config_provider. This sent 'free' to OpenRouter's API, which returned 404 (model not found). OpenRouter always needs the full provider/model path (e.g. openrouter/free, anthropic/claude-sonnet-4.6). The prefix-stripping logic is only correct for direct-API providers. Fix: skip prefix stripping entirely when config_provider is 'openrouter'. Return the full model_id with provider='openrouter'. Added 7 unit tests for resolve_model_provider() covering: - openrouter/free keeps full path (the bug) - openrouter cross-provider models keep full path - direct API providers still strip prefix correctly - cross-provider routing to openrouter - bare model names use config provider - empty model returns defaults Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-05 13:58:37 -07:00
nesquena-hermes	1777cf7bfe	docs: v0.36.1 release notes and version bump Some checks failed Release & Docker / release (push) Has been cancelled Details Co-authored-by: Nathan Esquenazi <nesquena@gmail.com>	2026-04-05 12:46:58 -07:00
Nathan Esquenazi	48ba2e79e2	fix: Enter key reliably submits login form (#124 ) The login form used 'return doLogin(event)' in onsubmit, but doLogin is async so it returns a Promise (truthy), which some browsers interpret as 'proceed with native form submit'. Changed to 'doLogin(event);return false' and added an explicit onkeydown Enter handler on the password input as belt-and-suspenders. Closes #124 Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-05 12:45:57 -07:00
Nathan Esquenazi	52e3fb70e0	Merge pull request #123 from nesquena/docs/update-parity-assessment docs: update SPRINTS parity assessment from v0.21 to v0.36	2026-04-05 10:10:49 -07:00
Nathan Esquenazi	c1bbdf9aeb	docs: update SPRINTS parity assessment from v0.21 to v0.36 CLI parity: ~90% -> ~95% (added profiles, CLI bridge, compaction, self-update, git detection, slash commands, rAF throttle) Claude parity: ~70% -> ~85% (added themes, voice, mobile responsive, collapsible groups, context indicator, token display, Docker, subagent delegation cards) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-05 10:10:33 -07:00
nesquena-hermes	3ca7f08b59	docs: sweep markdown for v0.36 Co-authored-by: Nathan Esquenazi <nesquena@gmail.com>	2026-04-05 10:00:45 -07:00
Nathan Esquenazi	af76622c97	Merge pull request #121 from nesquena/feat/self-update-checker Some checks failed Release & Docker / release (push) Has been cancelled Details feat: self-update checker with one-click update	2026-04-05 09:27:39 -07:00
Nathan Esquenazi	27706367b7	docs: v0.36 release notes, version bump for self-update checker Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-05 09:27:27 -07:00
Nathan Esquenazi	beb56b1a8b	fix: apply_update concurrency lock, boot.js settings-fail guard, dead workspace code, test_updates URL param - api/updates.py: add _apply_lock to prevent concurrent stash/pull/pop - static/boot.js: set check_for_updates:false on settings fetch failure - static/panels.js: remove dead settingsWorkspace references (element removed from HTML) - api/routes.py + static/boot.js: add ?test_updates=1 URL param for testing banner without being behind on git (localhost-only simulate endpoint)	2026-04-05 16:20:12 +00:00
Nathan Esquenazi	8d1b7a1e01	feat: self-update checker with one-click update for WebUI + Agent Shows a blue banner when the webui or hermes-agent git repos are behind their upstream branches. One-click 'Update Now' button does stash, pull --ff-only, stash pop, then reloads the page. Backend (api/updates.py): - _check_repo(): git fetch + rev-list count with 15s timeout - check_for_updates(): 30-min server-side cache, thread-safe, skips Docker (no .git dir) - apply_update(): stash (if dirty), pull --ff-only, pop, invalidate cache Routes: - GET /api/updates/check -- returns cached {webui, agent} with behind count - POST /api/updates/apply -- {target: 'webui'\|'agent'} Frontend: - Blue banner (matches reconnect-banner pattern) with 'Later' / 'Update Now' - Non-blocking boot check via fire-and-forget .then(), once per tab session - sessionStorage guards prevent re-checking and re-showing after dismiss Settings: - 'Check for updates' checkbox (default: on) -- when off, no git operations - Removed 'Default Workspace' dropdown to keep settings panel compact Performance: - Server cache: git fetch at most 2x/hour regardless of client count - sessionStorage: one check per browser tab session - _check_in_progress flag prevents concurrent fetch storms - Fire-and-forget: does NOT block the boot sequence Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-05 09:11:44 -07:00
nesquena-hermes	257092d107	docs: v0.35.1 release notes and version bump Some checks failed Release & Docker / release (push) Has been cancelled Details Co-authored-by: Nathan Esquenazi <nesquena@gmail.com>	2026-04-05 08:31:15 -07:00
Nathan Esquenazi	b327103885	fix: model dropdown missing custom/configured models (#116 , #117 ) Two related bugs in get_available_models(): 1. cfg_base_url undefined for string model configs (#117): cfg_base_url was defined inside 'elif isinstance(model_cfg, dict)' but referenced unconditionally at line 506. If model config was a plain string, NameError crashed model detection. Fix: initialize cfg_base_url='' before the conditional. 2. Configured default_model missing from dropdown (#116): The OpenRouter branch substituted _FALLBACK_MODELS without checking if the user's model.default was in the list. Models like 'openrouter/free' or custom local models were invisible. Fix: after building all groups, check if default_model is present. If not, inject it at the top of the matching provider group. Closes #116, closes #117 Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-05 08:29:40 -07:00
nesquena-hermes	df9ad1fd27	fix: initialize cfg_base_url for custom providers Co-authored-by: Nathan Esquenazi <nesquena@gmail.com>	2026-04-05 08:25:20 -07:00
Nathan Esquenazi	2f01afd557	Merge pull request #115 from mangodxd/cleanup/fix-py-issues-2a3ea49e chore: add missing type hints (10 files)	2026-04-04 23:55:21 -07:00
Nathan Esquenazi	74fcd2e0ab	fix: correct 9 inaccurate type hints - get_password_hash() -> str \| None (not bool, returns hash or None) - parse_cookie() -> str \| None (not None, returns cookie value) - Session.__init__ session_id: str (not int, uuid hex) - Session.__init__ project_id: str (not int) - Session.__init__ **kwargs (remove incorrect dict annotation) - Session.load() remove -> None (returns Session \| None) - import_cli_session session_id: str (not int) - sync_session_start session_id: str (not int) - sync_session_usage session_id: str (not int) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-04 23:54:58 -07:00
Nguyễn Công Thuận Huy	4d333acbbc	chore: add missing type hints across 10 files	2026-04-05 13:30:20 +07:00
Nathan Esquenazi	3d063b08a9	rebuild: clean public history after AGENTS.md rewrite removal	2026-04-05 06:25:24 +00:00
nesquena-hermes	814e016965	Update image descriptions in README.md (#111 )	2026-04-04 22:28:32 -07:00