fix: render inline formatting in markdown table cells (#273)

Table cells used esc() which escaped all HTML including <strong>,
<em>, <code> tags. Changed to inlineMd() which processes markdown
bold/italic/code/links and allows safe HTML tags through.

This runs after the pre-pass that converts <strong> to ** and
<em> to *, so both HTML tags and markdown syntax in table cells
are rendered correctly.

Fixes #273

Co-authored-by: Nathan Esquenazi <nesquena@gmail.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.env.example

@@ -26,3 +26,6 @@
 
 # Path to your Hermes config.yaml (for toolsets and model config)
 # HERMES_CONFIG_PATH=~/.hermes/config.yaml
+
+# Display name for the assistant in the UI (default: Hermes)
+# HERMES_WEBUI_BOT_NAME=Hermes

.gitignore

@@ -25,3 +25,6 @@ full-UI.png
 # OS files
 .DS_Store
 Thumbs.db
+
+# Local reference clones — never committed
+docs/

ARCHITECTURE.md

@@ -40,6 +40,7 @@ This makes the code easy to modify from a terminal or by an agent.
       models.py            Session model + CRUD, per-session profile tracking (~137 lines)
       profiles.py          Profile state management, hermes_cli wrapper (~246 lines)
       routes.py            All GET + POST route handlers (~1180 lines)
+      startup.py           Startup helpers: auto_install_agent_deps() (~50 lines)
       streaming.py         SSE engine, run_agent, cancel, HERMES_HOME save/restore (~236 lines)
       upload.py            Multipart parser, file upload handler (~78 lines)
       workspace.py         File ops: list_dir, read_file_content, workspace helpers (~77 lines)

CHANGELOG.md

@@ -5,6 +5,401 @@
 
 ---
 
+
+## [v0.48.0] Real-time gateway session sync (PR #274)
+
+- **Real-time gateway session sync** (PR #274, @bergeouss): Gateway sessions from Telegram, Discord, Slack, and other messaging platforms now appear in the WebUI sidebar and update in real time as new messages arrive. Enable via the "Show agent sessions" checkbox (renamed from "Show CLI sessions").
+  - `api/gateway_watcher.py`: background daemon thread polling `state.db` every 5s using MD5 hash-based change detection
+  - New SSE endpoint `/api/sessions/gateway/stream` for real-time push to browser
+  - Dynamic source badges: telegram (blue), discord (purple), slack (dark purple), cli (green)
+  - Zero changes to hermes-agent — WebUI reads the shared `state.db` that both components access
+  - 10 new tests in `test_gateway_sync.py` covering metadata, filtering, SSE, and watcher lifecycle
+  - 658 tests (up from 648)
+## [v0.47.1] Spanish locale (PR #275)
+
+- **Spanish (es) locale** (PR #275, @gabogabucho): Full Spanish translation for all 175 UI strings. Exposed automatically in the language selector via existing `LOCALES` wiring. Includes regression tests verifying locale presence, representative translations, and key-parity with English. 648 tests (up from 645).
+## [v0.47.0] — 2026-04-11
+
+### Features
+- **`/skills [query]` slash command** (PR #257): Fetches from `/api/skills`, groups results by category (alphabetically), renders as a formatted assistant message. Optional query filters by name, description, or category. Shows in the `/` autocomplete dropdown. i18n for en/de/zh/zh-Hant. 1 regression test added.
+- **Shared app dialogs replace native `confirm()`/`prompt()`** (PR #251, extracted from #242 by @aronprins): `showConfirmDialog()` and `showPromptDialog()` in `ui.js`, backed by `#appDialogOverlay`. Replaces all 11 native browser dialog call sites across panels.js, sessions.js, ui.js, workspace.js. Full keyboard focus trap (Tab/Escape/Enter), ARIA roles, danger mode, focus restore, mobile-responsive buttons. i18n for en/de/zh/zh-Hant. 5 new tests in `test_sprint33.py`.
+- **Session `⋯` action dropdown** (PR #252, extracted from #242 by @aronprins): Replaces 5 per-row hover buttons (pin/move/archive/duplicate/delete) with a single `⋯` trigger. Menu uses `position:fixed` to avoid sidebar clipping. Full close handling: click-outside, scroll, Escape, resize-reposition. `test_sprint16.py` updated to assert the new trigger exists and old button classes are gone.
+
+### Bug Fixes
+- **Custom provider with slash model name no longer rerouted to OpenRouter** (PR #255): `resolve_model_provider()` now returns immediately with the configured `provider`/`base_url` when `base_url` is set, before the slash-based OpenRouter heuristic runs. Fixes `google/gemma-4-26b-a4b` with `provider: custom` being silently routed to OpenRouter (401 errors). 1 regression test added. Fixes #230.
+- **Android Chrome: workspace panel now closeable on mobile** (PR #256): `toggleMobileFiles()` now shows/hides the mobile overlay. New `closeMobileFiles()` helper closes the right panel with correct overlay tracking. Overlay tap-to-close calls both `closeMobileSidebar()` and `closeMobileFiles()`. Mobile-only `×` close button added to workspace panel header. Fix applied during review: `closeMobileSidebar()` now checks if the right panel is still open before hiding the overlay. Fixes #247.
+- **Android Chrome: profile dropdown no longer clipped on mobile** (PR #256): `.profile-dropdown` switches to `position:fixed; top:56px; right:8px` at `max-width:900px`, escaping the `overflow-x:auto` stacking context that was making it invisible. Fixes #246.
+
+### Tests
+- **Mobile layout regression suite** (PR #254): 14 static tests in `tests/test_mobile_layout.py` that run on every QA pass. Covers: CSS breakpoints at 900px/640px, right panel slide-over, mobile overlay, bottom nav, files button, profile dropdown z-index, chip overflow, workspace close, `100dvh`, 44px touch targets, 16px textarea font. All pass against current and future master.
+
+**CSS hotfix (commit a2ae953, post-tag):** session action menu — icon now displays inline-left of text. The `.ws-opt` base class (`flex-direction:column`) was causing SVG icons to stack above the label. Fixed with 3 CSS rule overrides on `.session-action-opt`.
+
+**645 tests (up from 624 on v0.46.0 — +21 new tests)**
+
+---
+
+## [v0.46.0] — 2026-04-11
+
+### Features
+- **Docker UID/GID matching** (PR #237 by @mmartial): New `docker_init.bash` entrypoint adds `hermeswebui`/`hermeswebuitoo` user pattern so container-created files match the host user UID/GID. Prevents `.hermes` volume mounts from being owned by root. Configure via `WANTED_UID` and `WANTED_GID` env vars (default 1000/1000). README updated with setup instructions.
+  - `Dockerfile` — two-user pattern with passwordless sudo; `/.within_container` marker for in-container detection; starts as `hermeswebuitoo`, switches to correct UID/GID
+  - `docker-compose.yml` — mounts `.hermes` at `/home/hermeswebui/.hermes`; uses `${UID:-1000}/${GID:-1000}` for UID/GID passthrough
+  - `server.py` — detects `/.within_container` and prints a note when binding to 0.0.0.0
+
+### Security
+- **Credential redaction in API responses** (PR #243 by @kcclaw001): All API endpoints now redact credentials from responses at the response layer. Session files on disk are unchanged; only the API output is masked.
+  - `api/helpers.py` — `redact_session_data()` and `_redact_value()` apply pattern-based redaction to messages, tool_calls, and title; covers GitHub PATs, OpenAI/Anthropic keys, AWS keys, Slack tokens, HuggingFace tokens, Authorization Bearer headers, and PEM private key blocks
+  - `api/routes.py` — `GET /api/session`, `GET /api/session/export`, `GET /api/memory` all wrapped with redaction
+  - `api/streaming.py` — SSE `done` event payload redacted before broadcast
+  - `api/startup.py` — new `fix_credential_permissions()` called at startup; `chmod 600` on `.env`, `google_token.json`, `auth.json`, `.signing_key` if they have group/other read bits set
+  - `tests/test_security_redaction.py` — 13 new tests covering redaction functions and endpoint structural verification
+
+### Bug Fixes
+- **Custom model list discovery with config API key** (PR #238 by @ccqqlo): `get_available_models()` now reads `api_key` from `config.yaml` before env vars when fetching `/v1/models` from custom endpoints (LM Studio, Ollama, etc.). Priority: `model.api_key` → `providers.<active>.api_key` → `providers.custom.api_key` → env vars. Also adds `OpenAI/Python 1.0` User-Agent header. Fixes model picker collapsing to single default model for config-only setups. 1 new regression test.
+- **HTML entity decode before markdown processing** (PR #239 by @Argonaut790): Adds `decode()` helper in `renderMd()` to fix double-escaping of HTML entities from LLM output (e.g. `&lt;code&gt;` becoming `&amp;lt;code&amp;gt;` instead of rendering). XSS-safe: decode runs before `esc()`, only 5 entity patterns (`&lt;`, `&gt;`, `&amp;`, `&quot;`, `&#39;`).
+- **Simplified Chinese translations completed** (PR #239 by @Argonaut790): 40+ missing keys added to `zh` locale (123 → 164 keys). New `zh-Hant` (Traditional Chinese) locale with 163 keys.
+- **Cancel button now interrupts agent execution** (PR #244 by @huangzt): `cancel_stream()` now calls `agent.interrupt()` to stop backend tool execution, not just the SSE stream. `AGENT_INSTANCES` dict (protected by `STREAMS_LOCK`) tracks active agents. Race condition fixed: after storing agent, immediately checks if cancel was already requested. Frontend: removes stale "Cancelling..." status text; `setBusy(false)` always called on cancel. 6 new unit tests in `tests/test_cancel_interrupt.py`.
+
+**624 tests (up from 604 on v0.45.0 — +20 new tests)**
+
+---
+
+## [v0.45.0] — 2026-04-10
+
+### Features
+- **Custom endpoint fields in new profile form** (PR #233, fixes #170): The New Profile form now accepts optional Base URL and API key fields. When provided, both are written into the new profile's `config.yaml` under the `model` section, enabling local-endpoint setups (Ollama, LMStudio, etc.) to be configured in one step without editing YAML manually. The write is a no-op when both fields are left blank, so existing profile creation behavior is unchanged.
+  - `api/profiles.py` — `_write_endpoint_to_config()` merges `base_url`/`api_key` into `config.yaml` using `yaml.safe_load` + `yaml.dump`, preserving any existing keys
+  - `api/routes.py` — accepts `base_url` and `api_key` from POST body; validates that `base_url`, if provided, starts with `http://` or `https://` (returns 400 for invalid schemes)
+  - `static/index.html` — two new inputs added to the New Profile form: Base URL (with `http://localhost:11434` placeholder) and API key (password type)
+  - `static/panels.js` — `submitProfileCreate()` reads both fields, validates URL format client-side before sending, and includes them in the create payload; `toggleProfileForm()` clears them on cancel
+  - 9 tests in `tests/test_sprint31.py` covering: config write (base_url, api_key, both, merge, no-op), route acceptance, profile path in response, and invalid-scheme rejection
+
+**604 tests (up from 595)**
+
+## [v0.44.1] — 2026-04-10
+
+- **Unskip 16 approval tests** (PR #231): `test_approval_unblock.py` was importing `has_pending` and `pop_pending` from `tools.approval`, which the agent module had removed. The import failure tripped the `APPROVAL_AVAILABLE` guard and skipped all 16 tests in the file. Neither symbol was used in any test body. Removing the stale imports restores **595/595 passing, 0 skipped**.
+
+## [v0.44.0] — 2026-04-10
+
+### Features
+- **Lucide SVG icons** (PR #221): Replaces all emoji icons in the sidebar, workspace, and tool cards with self-hosted Lucide SVG paths via `static/icons.js`. No CDN dependency — icons are bundled directly. The `li(name)` renderer uses a hardcoded whitelist, so server-supplied tool names never inject arbitrary SVG. All 35 `onclick=` functions verified to exist in JS; all 21 icon references verified in `icons.js`.
+
+### Bug Fixes
+- **Approval card hides immediately on respond/stream-end** (PR #225): `respondApproval()` and all stream-end SSE handlers (done, cancel, apperror, error, start-error) now call `hideApprovalCard(true)`. Previously the 30s minimum-visibility guard deferred the hide, leaving the card visible with disabled buttons for up to 30s after the user clicked Approve/Deny or the session completed. The poll-loop tick correctly keeps no-force so the guard still protects against transient polling gaps. Adds 11 structural tests for the timer logic.
+- **Login page CSP fix** (PR #226): Moves `doLogin()` and Enter key listener from inline `<script>`/`onsubmit`/`onkeydown` attributes into `static/login.js`. Inline handlers are blocked by strict `script-src` CSP, causing silent login failure. i18n error strings now passed via `data-*` attributes instead of injected JS literals. Also guards `res.json()` parse with try/catch so non-JSON server errors fall back to the password-error message. Fixes #222.
+- **Update error messages** (PR #227): `_apply_update_inner()` now fetches before pulling and surfaces three distinct failure modes with actionable recovery commands: network unreachable, diverged history (`git reset --hard`), and missing upstream tracking branch (`git branch --set-upstream-to`). Generic fallback truncates to 300 chars with a sentinel for empty output. Adds 13 tests covering all new diagnostic code paths. Fixes #223.
+- **Approval pending check** (PR #228): `GET /api/approval/pending` always returned `{pending: null}` after the agent module renamed `has_pending` to `has_blocking_approval`. The route now checks `_pending` directly under `_lock`, matching how `submit_pending` writes to it. Fixes `test_approval_submit_and_respond`.
+
+### Tests
+- 579 passing, 16 skipped at this tag (595/595 after v0.44.1 unskip — +24 new tests across PRs #225, #227, #228)
+
+## [v0.43.1] — 2026-04-10
+
+- **CSRF fix for reverse proxies** (PR #219): The CSRF check now accepts `X-Forwarded-Host` and `X-Real-Host` headers in addition to `Host`, so deployments behind Caddy, nginx, and Traefik no longer reject POST requests with "Cross-origin request rejected". Security is preserved — requests with no matching proxy header are still rejected. Fixes #218.
+
+## [v0.43.0] — 2026-04-10
+
+### Features
+- **Auto-install agent dependencies on startup** (PRs #215 + #216): When `hermes-agent` is found on disk but its Python dependencies are missing (common in Docker deployments where the agent is volume-mounted post-build), `server.py` now calls `api/startup.auto_install_agent_deps()` to install from `requirements.txt` or `pyproject.toml`. Falls back gracefully — failures are logged and never fatal.
+
+### Bug Fixes
+- **Session ID validator broadened** (PR #212): `Session.load()` rejected any session ID containing non-hex characters, breaking sessions created by the new hermes-agent format (`YYYYMMDD_HHMMSS_xxxxxx`). Validator now accepts `[0-9a-z_]` while rejecting path traversal patterns (null bytes, slashes, backslashes, dot-extensions).
+- **Test suite isolation** (PR #216): `conftest.py` now kills any stale process on the test port (8788) before starting the fixture server. Stale QA harness servers (8792/8793) could occupy 8788 and cause non-deterministic test failures across the full suite.
+
+## [v0.42.2] — 2026-04-10
+
+### Bug Fixes
+- **CSP blocking inline event handlers** (PR #209): `script-src 'self'` blocked all 55+ inline `onclick=` handlers in `index.html`, making the settings panel, sidebar navigation, and most interactive controls non-functional. Added `'unsafe-inline'` to `script-src`. Also restores `https://cdn.jsdelivr.net` to `script-src` and `style-src` for Mermaid.js and Prism.js (dropped in v0.42.1).
+
+## [v0.42.1] — 2026-04-11
+
+### Bug Fixes
+- **i18n button text stripping** (post-review): Three sidebar buttons (`+ New job`, `+ New skill`, `+ New profile`) and three suggestion buttons had `data-i18n` on the outer element, which caused `applyLocaleToDOM` to replace the entire `textContent` — stripping the `+` prefix and emoji characters on locale switch. Fixed by wrapping only the translatable label text in a `<span data-i18n="...">`.
+- **German translation corrections** (post-review): Fixed `cancelling` (imperative → progressive `"Wird abgebrochen…"`), `editing` (first-person verb → noun `"Bearbeitung"`), and completed truncated descriptions for `empty_subtitle`, `settings_desc_check_updates`, and `settings_desc_cli_sessions`.
+
+## [v0.42.0] — 2026-04-10
+
+### Features
+- **German translation** (PR #190 by @DavidSchuchert): Complete `de` locale covering all UI strings — settings, commands, sidebar, approval cards. Also extends the i18n system with `data-i18n-title` and `data-i18n-placeholder` attribute support so tooltip text and input placeholders are now translatable. German speech recognition uses `de-DE`.
+
+### Bug Fixes
+- **Custom slash-model routing** (PR #189 by @smurmann): Model IDs like `google/gemma-4-26b-a4b` from custom providers (LM Studio, Ollama) were silently misrouted to OpenRouter because of the slash-heuristic. Custom providers now win: entries in `config.yaml → custom_providers` are checked first, so their model IDs route to the correct local endpoint regardless of format.
+- **Phantom Custom group in model picker** (PR #191 by @mbac): When `model.provider` was a named provider (e.g. `openai-codex`) and `model.base_url` was set, `hermes_cli` reported `'custom'` as authenticated, producing a duplicate "Custom" group in the dropdown. The real provider's group was missing the configured default model. Fixed by discarding the phantom `custom` entry when a real named provider is active.
+- **Hyphen/space model group injection** (PR #191): The "ensure default_model appears" post-pass used `active_provider.lower() in group_name.lower()`, which fails for `openai-codex` vs display name `OpenAI Codex` (hyphen vs space). Now uses `_PROVIDER_DISPLAY` for exact display-name matching.
+
+## [v0.41.0] — 2026-04-10
+
+### Features
+- **Optional HTTPS/TLS support** (PR #199): Set `HERMES_WEBUI_TLS_CERT` and
+  `HERMES_WEBUI_TLS_KEY` env vars to enable HTTPS natively. Uses
+  `ssl.PROTOCOL_TLS_SERVER` with TLS 1.2 minimum. Gracefully falls back to HTTP
+  if cert loading fails. No reverse proxy required for LAN/VPN deployments.
+
+### Bug Fixes
+- **CSP blocking Mermaid and Prism** (PR #197): Added Content-Security-Policy and
+  Permissions-Policy headers to every response. CSP allows `cdn.jsdelivr.net` in
+  `script-src` and `style-src` for Mermaid.js (dynamically loaded) and Prism.js
+  (statically loaded with SRI integrity hashes). All other external origins blocked.
+- **Session memory leak** (PR #196): `api/auth.py` accumulated expired session tokens
+  indefinitely. Added `_prune_expired_sessions()` called lazily on every
+  `verify_session()` call. No background thread, no lock contention.
+- **Slow-client thread exhaustion** (PR #198): Added `Handler.timeout = 30` to kill
+  idle/stalled connections before they exhaust the thread pool.
+- **False update alerts on feature branches** (PR #201): Update checker compared
+  `HEAD..origin/master` even when on a feature branch, counting unrelated master
+  commits as missing updates. Now uses `git rev-parse --abbrev-ref @{upstream}` to
+  track the current branch's upstream. Falls back to default branch when no upstream
+  is set.
+- **CLI session file browser returning 404** (PR #204): `/api/list` only checked
+  the WebUI in-memory session dict, so CLI sessions shown in the sidebar always
+  returned 404 for file browsing. Now falls back to `get_cli_sessions()` — the same
+  pattern used by `/api/session` GET and `/api/sessions` list.
+
+## [v0.40.2] — 2026-04-09
+
+### Features
+- **Full approval UI** (PR #187): When the agent triggers a dangerous command
+  (e.g. `rm -rf`, `pkill -9`), a polished approval card now appears immediately
+  instead of leaving the chat stuck in "Thinking…" forever. Four one-click buttons:
+  Allow once, Allow session, Always allow, Deny. Enter key defaults to Allow once.
+  Buttons disable immediately on click to prevent double-submit. Card auto-focuses
+  Allow once so keyboard-only users can approve in one keystroke. All labels and
+  the heading are fully i18n-translated (English + Chinese).
+
+### Bug Fixes
+- **Approval SSE event never sent** (PR #187): `register_gateway_notify()` was
+  never called before the agent ran, so the approval module had no way to push
+  the `approval` SSE event to the frontend. Fixed by registering a callback that
+  calls `put('approval', ...)` the instant a dangerous command is detected.
+- **Agent thread never unblocked** (PR #187): `/api/approval/respond` did not call
+  `resolve_gateway_approval()`, so the agent thread waited for the full 5-minute
+  gateway timeout. Now calls it on every respond, waking the thread immediately.
+- **`_unreg_notify` scoping** (PR #187): Variable was only assigned inside a `try`
+  block but referenced in `finally`. Initialised to `None` before the `try` so the
+  `finally` guard is always well-defined.
+
+### Tests
+- 32 new tests in `tests/test_sprint30.py`: approval card HTML structure, all 4
+  button IDs and data-i18n labels, keyboard shortcut in boot.js, i18n keys in both
+  locales, CSS loading/disabled/kbd states, messages.js button-disable behaviour,
+  streaming.py scoping, HTTP regression for all 4 choices.
+- 16 tests in `tests/test_approval_unblock.py` (gateway approval unit + HTTP).
+- **547 tests total** (499 → 515 → 547).
+
+---
+
+## [v0.40.1] — 2026-04-09
+
+### Bug Fixes
+- **Default locale on first install** (PR #185): A fresh install would start in
+  English based on the server default, but `loadLocale()` could resurrect a
+  stale or unsupported locale code from `localStorage`. Now `loadLocale()` falls
+  back to English when there is no saved code or the saved code is not in the
+  LOCALES bundle. `setLocale()` also stores the resolved code, so an unknown
+  input never persists to storage.
+
+---
+
+## [v0.40.0] — 2026-04-09
+
+### Features
+- **i18n — pluggable language switcher** (PR #179): Settings panel now has a
+  Language dropdown. Ships with English and Chinese (中文). All UI strings use
+  a `t()` helper that falls back to English for missing keys. The login page
+  also localises — title, placeholder, button, and error strings all respond to
+  the saved locale. Add a language by adding a LOCALES entry to `static/i18n.js`.
+- **Notification sound + browser notifications** (PR #180): Two new settings
+  toggles. "Notification sound" plays a short two-tone chime when the assistant
+  finishes or an approval card appears. "Browser notification" fires a system
+  notification when the tab is in the background.
+- **Thinking / reasoning block display** (PR #181, #182): Inline `<think>…</think>`
+  and Gemma 4 `<|channel>thought…<channel|>` tags are parsed out of assistant
+  messages and rendered as a collapsible 💡 "Thinking" card above the reply.
+  During streaming, the bubble shows "Thinking…" until the tag closes. Hardened
+  against partial-tag edge cases and empty thinking blocks.
+
+### Bug Fixes
+- **Stray `}` in message row HTML** (PR #183): A typo in the i18n refactor left
+  an extra `}` in the `msg-role` div template literal, producing `<div class="msg-role user" }>`.
+  Removed.
+- **JS-escape login locale strings** (PR #183): `LOGIN_INVALID_PW` and
+  `LOGIN_CONN_FAILED` were injected into a JS string context without escaping
+  single quotes or backslashes. Now uses minimal JS-string escaping.
+
+---
+
+## [v0.39.1] — 2026-04-08
+
+### Bug Fixes
+- **_ENV_LOCK deadlock resolved.** The environment variable lock was held for
+  the entire duration of agent execution (including all tool calls and streaming),
+  blocking all concurrent requests. Now the lock is acquired only for the brief
+  env variable read/write operations, released before the agent runs, and
+  re-acquired in the finally block for restoration.
+
+---
+
+## [v0.39.0] — 2026-04-08
+
+### Security (12 fixes — PR #171 by @betamod, reviewed by @nesquena-hermes)
+
+- **CSRF protection**: all POST endpoints now validate `Origin`/`Referer` against `Host`. Non-browser clients (curl, agent) without these headers are unaffected.
+- **PBKDF2 password hashing**: `save_settings()` was using single-iteration SHA-256. Now calls `auth._hash_password()` — PBKDF2-HMAC-SHA256 with 600,000 iterations and a per-installation random salt.
+- **Login rate limiting**: 5 failed attempts per 60 seconds per IP returns HTTP 429.
+- **Session ID validation**: `Session.load()` rejects any non-hex character before touching the filesystem, preventing path traversal via crafted session IDs.
+- **SSRF DNS resolution**: `get_available_models()` resolves DNS before checking private IPs. Prevents DNS rebinding attacks. Known-local providers (Ollama, LM Studio, localhost) are whitelisted.
+- **Non-loopback startup warning**: server prints a clear warning when binding to `0.0.0.0` without a password set — a common Docker footgun.
+- **ENV_LOCK consistency**: `_ENV_LOCK` now wraps all `os.environ` mutations in both the sync chat and streaming restore blocks, preventing races across concurrent requests.
+- **Stored XSS prevention**: files with `text/html`, `application/xhtml+xml`, or `image/svg+xml` MIME types are forced to `Content-Disposition: attachment`, preventing execution in-browser.
+- **HMAC signature**: extended from 64 bits to 128 bits (16-char to 32-char hex).
+- **Skills path validation**: `resolve().relative_to(SKILLS_DIR)` check added after skill directory construction to prevent traversal.
+- **Secure cookie flag**: auto-set when TLS or `X-Forwarded-Proto: https` is detected. Uses `getattr` safely so plain sockets don't raise `AttributeError`.
+- **Error path sanitization**: `_sanitize_error()` strips absolute filesystem paths from exception messages before they reach the client.
+
+### Tests
+- Added `tests/test_sprint29.py` — 33 tests covering all 12 security fixes.
+
+---
+
+## [v0.38.6] — 2026-04-07
+
+### Fixed
+- **`/insights` message count always 0 for WebUI sessions** (#163, #164): `sync_session_usage()` wrote token counts, cost, model, and title to `state.db` but never `message_count`. Both the streaming and sync chat paths now pass `len(s.messages)`. Note: `/insights` sync is opt-in — enable **Sync to Insights** in Settings (it's off by default).
+
+---
+
+## [v0.38.5] — 2026-04-06
+
+### Fixed
+- **Custom endpoint URL construction** (#138, #160): `base_url` ending in `/v1` was incorrectly stripped before appending `/models`, producing `http://host/models` instead of `http://host/v1/models`. Fixed to append directly.
+- **`custom_providers` config entries now appear in dropdown** (#138, #160): Models defined under `config.yaml` `custom_providers` (e.g. Ollama aliases, Azure model overrides) are now always included in the dropdown, even when the `/v1/models` endpoint is unreachable.
+- **Custom endpoint API key reads profile `.env`** (#138, #160): Custom endpoint auth now checks `~/.hermes/.env` keys in addition to `os.environ`.
+
+---
+
+## [v0.38.4] — 2026-04-06
+
+### Fixed
+- **Copilot false positive in model dropdown** (#158): `list_available_providers()` reported Copilot as available on any machine with `gh` CLI auth, because the Copilot token resolver falls back to `gh auth token`. The dropdown now skips any provider whose credential source is `'gh auth token'` — only explicit, dedicated credentials count. Users with `GITHUB_TOKEN` explicitly set in their `.env` still see Copilot correctly.
+
+---
+
+## [v0.38.3] — 2026-04-06
+
+### Fixed
+- **Model dropdown shows only configured providers** (#155): Provider detection now uses `hermes_cli.models.list_available_providers()` — the same auth check the Hermes agent uses at runtime — instead of scanning raw API key env vars. The dropdown now reflects exactly what the user has configured (auth.json, credential pools, OAuth flows like Copilot). When no providers are detected, shows only the configured default model rather than a full generic list. Added `copilot` and `gemini` to the curated model lists. Falls back to env var scanning for standalone installs without hermes-agent.
+
+---
+
+## [v0.38.2] — 2026-04-06
+
+### Fixed
+- **Tool cards actually render on page reload** (#140, #153): PR #149 fixed the wrong filter — it updated `vis` but not `visWithIdx` (the loop that actually creates DOM rows), so anchor rows were never inserted. This PR fixes `visWithIdx`. Additionally, `streaming.py`'s `assistant_msg_idx` builder previously only scanned Anthropic content-array format and produced `idx=-1` for all OpenAI-format tool calls (the format used in saved sessions); it now handles both. As a final fallback, `renderMessages()` now builds tool card data directly from per-message `tool_calls` arrays when `S.toolCalls` is empty, covering historical sessions that predate session-level tool tracking.
+
+---
+
+## [v0.38.1] — 2026-04-06
+
+### Fixed
+- **Model selector duplicates** (#147, #151): When `config.yaml` sets `model.default` with a provider prefix (e.g. `anthropic/claude-opus-4.6`), the model dropdown no longer shows a duplicate entry alongside the existing bare-ID entry. The dedup check now normalizes both sides before comparing.
+- **Stale model labels** (#147, #151): Sessions created with models no longer in the current provider list now show `"ModelName (unavailable)"` in muted text with a tooltip, instead of appearing as a normal selectable option that would fail silently on send.
+
+---
+
+## [v0.38.0] — 2026-04-06
+
+### Fixed
+- **Multi-provider model routing (#138):** Non-default provider models now use `@provider:model` format. `resolve_model_provider()` routes them through `resolve_runtime_provider(requested=provider)` — no OpenRouter fallback for users with direct provider keys.
+- **Personalities from config.yaml (#139):** `/api/personalities` reads from `config.yaml` `agent.personalities` (the documented mechanism). Personality prompts pass via `agent.ephemeral_system_prompt`.
+- **Tool call cards survive page reload (#140):** Assistant messages with only `tool_use` content are no longer filtered from the render list, preserving anchor rows for tool card display.
+
+---
+
+## [v0.37.0] /personality command, model prefix routing fix, tool card reload fix
+*April 6, 2026 | 465 tests*
+
+### Features
+- **`/personality` slash command.** Set a per-session agent personality from `~/.hermes/personalities/<name>/SOUL.md`. The personality prompt is prepended to the system message for every turn. Use `/personality <name>` to activate, `/personality none` to clear, `/personality` (no args) to list available personalities. Backend: `GET /api/personalities`, `POST /api/personality/set`. (PR #143)
+
+### Bug Fixes
+- **Model dropdown routes non-default provider models correctly (#138).** When the active provider is `anthropic` and you pick a `minimax` model, its ID is now prefixed `minimax/MiniMax-M2.7` so `resolve_model_provider()` can route it through OpenRouter. Guards added: `active_provider=None` prevents all-providers-prefixed, case is normalised, shared `_PROVIDER_MODELS` list is no longer mutated by the default_model injector. (PR #142)
+- **Tool call cards persist correctly after page reload.** The reload rendering logic now anchors cards AFTER the triggering assistant row (not before the next one), handles multi-step chains sharing a filtered anchor in chronological order, and filters fallback anchor to assistant rows only. (PR #141)
+
+---
+
+## [v0.36.3] Configurable Assistant Name
+*April 6, 2026 | 449 tests*
+
+### Features
+- **Configurable bot name.** New "Assistant Name" field in Settings panel.
+  Display name updates throughout the UI: sidebar, topbar, message roles,
+  login page, browser tab title, and composer placeholder. Defaults to
+  "Hermes". Configurable via settings or `HERMES_WEBUI_BOT_NAME` env var.
+  Server-side sanitization prevents empty names and escapes HTML for the
+  login page. (PR #135, based on #131 by @TaraTheStar)
+
+---
+
+## [v0.36.2] OpenRouter model routing fix
+*April 5, 2026 | 440 tests*
+
+### Bug Fixes
+- **OpenRouter models sent without prefix, causing 404 (#116).** `resolve_model_provider()` was stripping the `openrouter/` prefix from model IDs (e.g. sending `free` instead of `openrouter/free`) when `config_provider == 'openrouter'`. OpenRouter requires the full `provider/model` path to route upstream correctly. Fixed with an early return that preserves the complete model ID for all OpenRouter configs. (#127)
+- Added 7 unit tests for `resolve_model_provider()` — first coverage on this function. Tests the regression, cross-provider routing, direct-API prefix stripping, bare models, and empty model.
+
+---
+
+## [v0.36.1] Login form Enter key fix
+*April 5, 2026 | 433 tests*
+
+### Bug Fixes
+- **Login form Enter key unreliable in some browsers (#124).** `onsubmit="return doLogin(event)"` returned a Promise (async functions always return a truthy Promise), which could let the browser fall through to native form submission. Fixed with `doLogin(event);return false` plus an explicit `onkeydown` Enter handler on the password input as belt-and-suspenders. (#125)
+
+---
+
+## [v0.36] Self-Update Checker with One-Click Update
+*April 5, 2026 | 433 tests*
+
+### Features
+- **Update checker.** Non-blocking background check on boot detects when the
+  WebUI or hermes-agent git repos are behind upstream. Blue banner shows
+  "WebUI: N updates, Agent: N updates available" with Update Now / Later.
+- **One-click update.** "Update Now" runs `git stash && git pull --ff-only &&
+  git stash pop` on each behind repo, then reloads the page. Concurrent update
+  attempts blocked via lock. Dirty working trees safely stashed and restored.
+- **Settings toggle.** "Check for updates" checkbox in Settings panel. Persisted
+  server-side. Disabled = no background fetch, no banner.
+- **30-minute cache.** Git fetch runs at most twice per hour regardless of tab
+  count. Results cached server-side with TTL.
+- **Session-scoped dismissal.** "Later" dismisses banner for the current tab
+  session (sessionStorage). New tabs get a fresh check.
+- **Test mode.** `?test_updates=1` URL param shows the banner with fake data
+  (localhost only) for UI testing without needing to actually be behind.
+
+### Architecture
+- New `api/updates.py`: `check_for_updates()`, `apply_update()`. Thread-safe
+  caching with `_cache_lock`. Concurrent apply blocked with `_apply_lock`.
+  Default branch auto-detected (master/main).
+- `api/routes.py`: `GET /api/updates/check`, `POST /api/updates/apply`.
+  Simulate endpoint gated to 127.0.0.1.
+- `static/ui.js`: `_showUpdateBanner()`, `dismissUpdate()`, `applyUpdates()`.
+- `static/boot.js`: fire-and-forget check on boot (does not block UI).
+- `api/config.py`: `check_for_updates` in settings defaults + bool keys.
+- Docker safe: all git ops gated by `.git` directory existence check.
+
+---
+
+## [v0.35.1] Model dropdown fixes
+*April 5, 2026 | 433 tests*
+
+### Bug Fixes
+- **Custom providers invisible in model dropdown (#117).** `cfg_base_url` was scoped inside a conditional block but referenced unconditionally, causing a `NameError` for users with a `base_url` in config.yaml. Fix: initialize to `''` before the block. (#118)
+- **Configured default model missing from dropdown (#116).** OpenRouter and other providers replaced the model list with a hardcoded fallback that didn't include `model.default` values like `openrouter/free` or custom local model names. Fix: after building all groups, inject the configured `default_model` at the top of its provider group if absent. (#119)
+
+---
+
 ## [v0.35] Security hardening
 *April 5, 2026 | 433 tests*
 
@@ -1227,4 +1622,7 @@ Three-panel layout: sessions sidebar, chat area, workspace panel.
 
 ---
 
-*Last updated: v0.34, April 5, 2026 | Tests: 433*
+*Last updated: v0.36, April 5, 2026 | Tests: 433*
+
+### Markdown sweep
+- ROADMAP.md, TESTING.md, SPRINTS.md, README.md, and THEMES.md refreshed to match v0.36 and 433 tests.

Dockerfile

@@ -3,21 +3,79 @@ FROM python:3.12-slim
 LABEL maintainer="nesquena"
 LABEL description="Hermes Web UI — browser interface for Hermes Agent"
 
-WORKDIR /app
+# Install system packages
+ENV DEBIAN_FRONTEND=noninteractive
 
-# Copy source
-COPY . /app
+# Make use of apt-cacher-ng if available
+RUN if [ "A${BUILD_APT_PROXY:-}" != "A" ]; then \
+        echo "Using APT proxy: ${BUILD_APT_PROXY}"; \
+        printf 'Acquire::http::Proxy "%s";\n' "$BUILD_APT_PROXY" > /etc/apt/apt.conf.d/01proxy; \
+    fi \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates wget gnupg \
+    && rm -rf /var/lib/apt/lists/* \
+    && apt-get clean
 
-# Install Python dependencies
-RUN pip install --no-cache-dir -r requirements.txt
+RUN apt-get update -y --fix-missing --no-install-recommends \
+    && apt-get install -y --no-install-recommends \
+    apt-utils \
+    locales \
+    ca-certificates \
+    sudo \
+    curl \
+    rsync \
+    && apt-get upgrade -y \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+
+# UTF-8
+RUN localedef -i en_US -c -f UTF-8 -A /usr/share/locale/locale.alias en_US.UTF-8
+ENV LANG=en_US.utf8
+ENV LC_ALL=C
+
+# Set environment variables
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PYTHONIOENCODING=utf-8
+
+WORKDIR /apptoo
+
+# Every sudo group user does not need a password
+RUN echo '%sudo ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers
+
+# Create a new group for the hermeswebui and hermeswebuitoo users
+RUN groupadd -g 1024 hermeswebui \ 
+    && groupadd -g 1025 hermeswebuitoo
+
+# The hermeswebui (resp. hermeswebuitoo) user will have UID 1024 (resp. 1025), 
+# be part of the hermeswebui (resp. hermeswebuitoo) and users groups and be sudo capable (passwordless) 
+RUN useradd -u 1024 -d /home/hermeswebui -g hermeswebui -s /bin/bash -m hermeswebui \
+    && usermod -G users hermeswebui \
+    && adduser hermeswebui sudo
+RUN useradd -u 1025 -d /home/hermeswebuitoo -g hermeswebuitoo -s /bin/bash -m hermeswebuitoo \
+    && usermod -G users hermeswebuitoo \
+    && adduser hermeswebuitoo sudo
+RUN chown -R hermeswebuitoo:hermeswebuitoo /apptoo
+
+USER root
+
+COPY --chmod=555 docker_init.bash /hermeswebui_init.bash
+
+RUN touch /.within_container
+
+# Remove APT proxy configuration and clean up APT downloaded files
+RUN rm -rf /var/lib/apt/lists/* /etc/apt/apt.conf.d/01proxy \
+    && apt-get clean
+
+USER hermeswebuitoo
+
+COPY . /apptoo
 
 # Default to binding all interfaces (required for container networking)
 ENV HERMES_WEBUI_HOST=0.0.0.0
 ENV HERMES_WEBUI_PORT=8787
 
-# State directory (mount as volume for persistence)
-ENV HERMES_WEBUI_STATE_DIR=/data
-
 EXPOSE 8787
 
-CMD ["python", "server.py"]
+CMD ["/hermeswebui_init.bash"]
+

HERMES.md

@@ -1,165 +1,176 @@
 # Why Hermes
 
-Hermes is a persistent, autonomous AI agent that lives on your server. It remembers everything,
-schedules work while you sleep, and gets more capable the longer it runs. This document explains
-the mental model, why that matters, and how Hermes compares to every major AI tool available today.
+Hermes is a persistent, autonomous AI agent that runs on your server. It has layered memory that
+accumulates across sessions, a cron scheduler that fires jobs while you're offline, and a
+self-improving skills system that saves reusable procedures automatically. You reach it from a
+terminal, a browser, or a messaging app — and it's the same agent with the same history every time.
+
+This document explains the mental model, how Hermes compares to other tools honestly, and where
+it is and is not the right choice.
 
 ---
 
-## The Core Idea: Assistants Forget. Agents Don't.
+## The real problem: most tools are excellent in the moment and weak over time
 
-Every time you open Claude Code, Codex, or a chat window, the tool starts from zero. It does not
-know who you are, what you worked on yesterday, how your repo is structured, or what bugs you
-already fixed. You re-explain yourself every single session. The tool is powerful in the moment
-and useless the next day.
+Memory is no longer a differentiator on its own. ChatGPT, Claude, Cursor, and GitHub Copilot all
+have some form of memory now. Anthropic, OpenAI, and Microsoft are all shipping scheduling and
+agent features. The category boundaries that existed twelve months ago are blurring fast.
 
-Hermes fills that gap. It runs on your server, retains context across every session, and acts
-on your behalf whether or not you are at a keyboard.
+Hermes is not the only tool with memory or automation. It is the tool that makes those
+capabilities durable, self-hosted, cross-surface, and cumulative on your own server. The
+distinction that matters is not "has memory" vs. "has no memory" — it's whether context persists
+across sessions automatically, whether execution happens on hardware you control, whether you can
+reach the same agent identity from any device, and whether the system gets meaningfully better at
+your specific workflow over time without manual configuration.
 
 ```
-Assistant model:  You -> [Tool] -> Answer -> Done
-                  (tool forgets everything when the window closes)
+Session-scoped:   You -> [Tool] -> Answer -> Done
+                  (some tools now carry memory, but the execution is stateless)
 
-Agent model:      You <-> [Hermes] <-> (memory, skills, schedule, tools)
-                  (persistent, learns your stack, acts on your behalf, runs while you're offline)
+Persistent agent: You <-> [Hermes] <-> (memory, skills, schedule, tools, surfaces)
+                  (runs on your server, accumulates context, acts on your behalf offline)
 ```
 
 ---
 
-## The Three Pillars
+## A note on convergence
 
-### 1. Memory That Compounds
+The market is converging. Chat assistants are adding task scheduling and file connectors. IDE
+tools are launching cloud agent modes. CLI tools are adding skills systems and mobile surfaces.
+The lines between "assistant," "editor," and "agent" are dissolving.
 
-Hermes has layered memory that survives every session, every reboot, every model swap:
+This makes comparisons harder but also makes the question sharper: what actually matters when
+every tool is claiming some version of every feature? For Hermes, the answer is synthesis. Any
+single feature — memory, scheduling, messaging — is available somewhere else. The value is
+having all of them in one self-hosted system, running continuously, with a persistent identity
+that accumulates real knowledge of your stack over time.
 
-- **User profile** -- who you are, your preferences, your communication style, things you've
-  corrected Hermes on
-- **Agent memory** -- facts about your environment, your toolchain, your project conventions
-- **Skills** -- reusable procedures Hermes discovers and saves; it never has to relearn how to
-  deploy your app, run your tests, or review a PR
-- **Session history** -- every past conversation is searchable; Hermes can recall what you
-  worked on last Tuesday
+---
+
+## The three pillars
+
+### 1. Memory that compounds
+
+Hermes has layered memory that survives every session, every reboot, and every model swap:
+
+- User profile — who you are, your preferences, your communication style, things you've corrected Hermes on
+- Agent memory — facts about your environment, your toolchain, your project conventions
+- Skills — reusable procedures Hermes discovers and saves automatically; it never has to relearn how to deploy your app, run your tests, or review a PR
+- Session history — every past conversation is searchable; Hermes can recall what you worked on last Tuesday
 
 When you correct Hermes, it remembers. When it solves a tricky problem, it saves the approach.
-When it learns your stack, that knowledge carries into every future session.
+When it learns your stack, that knowledge carries into every future session. You never configure
+this manually — it happens in the background as a side effect of normal use.
 
-### 2. Autonomous Scheduling
+### 2. Autonomous scheduling
 
-Hermes can run jobs without you present -- every hour, every morning, on any cron schedule.
-It fires up a fresh session, runs the task, and delivers the result to wherever you want it:
-Telegram, Discord, Slack, Signal, WhatsApp, SMS, email, and more.
+Hermes can run jobs without you present — every hour, every morning, on any cron schedule. It
+fires up a fresh session with full access to your memory and skills, runs the task, and delivers
+the result wherever you want it: Telegram, Discord, Slack, Signal, WhatsApp, SMS, email, and more.
 
 Things Hermes can do while you sleep:
 
 - Review new pull requests on your GitHub repo and post a full verdict comment
-- Send you a morning briefing of news, markets, or anything else you care about
+- Send a morning briefing of news, markets, or anything else you track
 - Run your test suite and alert you if something breaks
 - Watch a competitor's blog for new posts and summarize them
 - Monitor a datasource and notify you when a threshold is crossed
 
-### 3. Reach It From Anywhere
+The difference from cloud-scheduled alternatives is that the job runs on your server, with your
+memory and skills, and your data never leaves your hardware.
+
+### 3. Reach it from anywhere
 
 Hermes runs on your server and is reachable from every surface: terminal over SSH, the web UI
 (this project), and messaging apps including Telegram, Discord, Slack, WhatsApp, Signal, and
 Matrix. Start a task from your phone, check it from the browser on your laptop, continue it in
-a terminal on a remote server. The same agent, memory, and history follow you everywhere.
+a terminal on a remote server. The same agent, memory, and history follow you across all of them.
 
 ---
 
-## A Framework for AI Tools
+## How AI tools are layered today
 
-There are four distinct categories of AI tool. Understanding the category tells you what a tool
-can and cannot do.
+The old four-category model — chat, editor, CLI, agent — is too clean. These layers are actively
+collapsing into each other. Here is a more honest picture:
 
-### Category 1: Chat Assistants
-*Claude.ai, ChatGPT, Gemini*
+Chat assistants (Claude.ai, ChatGPT) now have persistent memory, task scheduling, 50+ service
+connectors, and in some cases full agent modes with computer use. They are no longer "just chat."
 
-You open a window, ask something, get an answer. No persistent memory beyond the conversation,
-no ability to run code or touch files, no way to act on your behalf. Excellent for Q&A,
-drafting, and brainstorming. You re-explain your context every session.
+IDE tools (Cursor, Windsurf, Copilot) have shipped or are shipping cross-session memory,
+cloud-based background agents, and in Cursor's case a full Automations platform with Slack
+integration. Cursor v3.0 (April 2026) is explicitly agent-first.
 
-### Category 2: IDE Integrations
-*GitHub Copilot, Cursor, Windsurf, Zed AI*
+CLI tools (Claude Code, Codex, OpenCode) have added hooks, skills, desktop app automations,
+and multi-surface reach. Claude Code now spans terminal, IDE, desktop, and browser. Codex has
+become a product family: CLI, IDE extension, desktop app, and Codex Cloud.
 
-Deep inside your editor. Autocomplete, inline diffs, refactors -- all excellent. Windsurf was
-earliest with workspace-scoped memory (Cascade Memories); Copilot has been shipping repo-level
-memory since late 2025 and is catching up. Cursor has no native memory as of early 2026. None
-have scheduling or messaging access. Tied to one machine and one editor.
+Persistent self-hosted agents (Hermes, OpenClaw) sit at the intersection: they combine the
+tool-use power of CLI agents, the memory of chat assistants, the scheduling of automation
+platforms, and the cross-surface reach of messaging integrations — running continuously on
+hardware you own.
 
-### Category 3: Agentic CLI Tools
-*Claude Code, Codex CLI, OpenCode, Aider*
-
-The current frontier for most developers. Can use real tools -- run shell commands, read and
-write files, search the web, call APIs. Great for deep, multi-step tasks in a single terminal
-session. All are adding memory and scheduling features to varying degrees (see comparisons below),
-but the core model is still session-scoped: you invoke it, it works, it stops.
-
-### Category 4: Persistent Autonomous Agents
-*Hermes, OpenClaw (as of early 2026)*
-
-All the tool use of Category 3, plus memory that accumulates across sessions, plus always-on
-scheduling, plus multi-modal access from any device or messaging app. Gets more useful over time
-rather than resetting to zero. Hermes and OpenClaw are the two primary open-source, self-hosted
-tools in this category. OpenClaw is a gateway-centric automation platform; Hermes is a
-self-improving agent that writes and reuses its own procedures from experience.
+The question is not which category a tool belongs to. The question is which combination of
+capabilities you actually need, where that execution lives, and whether the system gets better
+at your specific context over time.
 
 ---
 
-## How Hermes Compares
+## How Hermes compares
 
 ### vs. OpenClaw
 
-OpenClaw is the most direct comparison to Hermes and the question most people ask first.
-Both are open-source, self-hosted, always-on agents with persistent memory, cron scheduling,
-and messaging app integration. If you're evaluating Hermes, you should evaluate OpenClaw too.
+OpenClaw is the most direct comparison and the question most people ask first. Both are
+open-source, self-hosted, always-on agents with persistent memory, cron scheduling, and messaging
+app integration. If you're evaluating Hermes, evaluate OpenClaw too.
 
-OpenClaw (MIT, ~347k GitHub stars) is built around a **Gateway** control plane written in
-Node.js/TypeScript. It excels at broad personal automation: native Chrome/Chromium control for
-browser automation, the widest messaging platform support in the space (WhatsApp, Telegram,
-Signal, iMessage, LINE, WeChat, Slack, Discord, Teams, Matrix, and more), voice wake words,
-and a ClawHub skill marketplace where users share pre-built automations. The community is large
-and the ecosystem is growing fast.
+OpenClaw (MIT) is built around a Gateway control plane written in Node.js/TypeScript. It has the
+widest messaging coverage in the space — 24+ channels including WhatsApp, Telegram, Signal,
+iMessage, LINE, WeChat, Slack, Discord, Teams, Matrix, Google Chat, Feishu, Mattermost, IRC,
+Nextcloud Talk, and more. It has native Chrome/Chromium control via CDP, voice wake words on
+macOS and iOS, and a ClawHub marketplace with 10,700+ skills. The community is large (350k+
+GitHub stars, 16,900+ commits) and growing.
 
-Hermes takes a different approach. It is built in Python and centers on a **self-improving
-agent loop** rather than a gateway control plane. The core difference is in how skills work:
-OpenClaw skills are primarily human-authored plugins installed from a marketplace; Hermes
-**writes and saves its own skills automatically** as part of every session. When Hermes solves
-a problem a new way, it saves the procedure and reuses it going forward without any user effort.
+Hermes is built in Python and centers on a self-improving agent loop rather than a gateway
+control plane. The core architectural difference is in skills: OpenClaw skills are primarily
+human-authored plugins installed from a marketplace. Hermes writes and saves its own skills
+automatically as part of every session. When Hermes solves a problem a new way, it saves the
+procedure and reuses it without any user effort. That's not a subtle distinction — it's the
+reason Hermes gets meaningfully better at your workflow without you maintaining a plugin library.
 
-Beyond the skills architecture, there are two other practical differences worth knowing:
+Two practical differences worth knowing directly:
 
-**Stability.** OpenClaw's community forums and GitHub issues document a recurring pattern of
-update-breaking regressions -- for example, Telegram integration was broken across multiple
-releases in early 2026. The unofficial WhatsApp Web protocol OpenClaw uses is known to
-disconnect and requires periodic re-pairing (this is documented in OpenClaw's own FAQ).
-Hermes has had no equivalent release breakages.
+Stability. OpenClaw's GitHub issues and community forums document recurring update-breaking
+regressions. Telegram integration was broken across multiple releases from early 2026 through
+at least April 2026. The unofficial WhatsApp Web protocol OpenClaw relies on disconnects and
+requires periodic re-pairing — this is in OpenClaw's own FAQ.
 
-**Security.** ClawHub's open publishing model has been exploited repeatedly. A community audit
-identified over a thousand malicious skills in the marketplace including prompt injections and
-tool-poisoning payloads; the community-maintained awesome-openclaw-skills list tracks confirmed
-removals and flags known bad actors. Hermes has no third-party marketplace and a correspondingly
-smaller attack surface.
+Security. ClawHub's open publishing model has been exploited at scale. Three separate audits in
+early 2026 found serious problems: Koi Security (January 2026) linked 335 skills to a campaign
+called "ClawHavoc" that delivered Atomic Stealer malware on macOS; Bitdefender found roughly
+900 malicious packages representing about 20% of the ecosystem at the time; Snyk's "ToxicSkills"
+report (February 2026) found malicious skills across roughly 4,000 scanned packages. China's
+CNCERT issued a national warning about ClawHub. Hermes has no third-party marketplace and a
+correspondingly smaller attack surface.
 
-**OpenClaw's genuine strengths** are worth stating plainly: it has broader messaging coverage
-(iMessage, LINE, WeChat, Teams -- platforms Hermes does not support), native browser and
-computer control via Chrome CDP, voice wake words on macOS and iOS, a larger community, and
-more third-party integrations than Hermes. If those capabilities matter most to you, OpenClaw
-is worth a serious look.
+OpenClaw's genuine strengths are worth stating plainly: broader messaging coverage (iMessage,
+LINE, WeChat, Teams, Google Chat — platforms Hermes does not support), native browser and
+computer control via Chrome CDP, voice wake words, a larger community, and more third-party
+integrations than Hermes. If those capabilities matter most, OpenClaw is worth a serious look.
 
-Where Hermes is the better fit: you want an agent that self-improves from experience without
-manual plugin authoring, you work in Python and want access to the ML/data science ecosystem,
-you want a stable deployment that does not break between updates, or you want a full web chat
-UI rather than a monitoring dashboard.
+Where Hermes fits better: you want an agent that self-improves from experience without managing
+a plugin library, you work in Python and want the ML/data science ecosystem, you want a stable
+deployment that doesn't break between updates, or you want a full web chat UI rather than a
+control dashboard.
 
 | | OpenClaw | Hermes |
 |---|---|---|
 | Persistent memory | Yes | Yes |
 | Scheduled jobs (cron) | Yes | Yes |
-| Messaging app access | Yes (15+ platforms, incl. iMessage/WeChat) | Yes (10+ platforms) |
-| Web UI | Gateway dashboard (monitoring only) | Full three-panel chat UI |
+| Messaging app access | Yes (24+ platforms, incl. iMessage/WeChat/LINE) | Yes (many platforms) |
+| Web UI | Chat UI + control dashboard | Full three-panel chat UI |
 | Self-hosted | Yes | Yes |
 | Open source | Yes (MIT) | Yes |
-| Self-improving skills | Partial (AI can generate skills; not the default loop) | Yes (automatic, first-class) |
+| Self-improving skills | Partial (AI can generate; not the default loop) | Yes (automatic, first-class) |
 | Browser / computer control | Yes (native Chrome CDP) | Via shell / tools |
 | Voice wake words | Yes (macOS/iOS) | No |
 | Python / ML ecosystem | No (Node.js) | Yes |
@@ -167,209 +178,312 @@ UI rather than a monitoring dashboard.
 | Multi-profile support | Via binding-rule routing | Yes (first-class named profiles) |
 | Provider-agnostic | Yes | Yes |
 | Update reliability | Moderate (documented regressions) | High |
+| Memory inspectability | Limited | Yes (markdown files, editable) |
+| Self-hosted autonomous execution | Yes | Yes |
 
 ### vs. Claude Code (Anthropic)
 
-Claude Code is Anthropic's official agentic CLI and one of the best tools in Category 3.
-In a single focused session it is capable -- deep code understanding, shell access, file
-editing, multi-step reasoning.
+Claude Code is Anthropic's official agentic tool and one of the strongest options for focused
+coding sessions. It has deep code understanding, shell access, file editing, and multi-step
+reasoning. It has been expanding rapidly — it now spans terminal, IDE plugin, desktop app, and
+browser surfaces — and the gap is closing in several areas.
 
-Claude Code has been adding features rapidly and the gap is narrowing:
+What Claude Code has that's worth knowing:
 
-- **Hooks system** -- 13 event types (SessionStart, PreToolUse, PostToolUse, Stop, etc.) with
-  4 handler types (shell command, HTTP endpoint, LLM prompt, sub-agent); deterministic
+- Hooks system — 26 event types (SessionStart, PreToolUse, PostToolUse, Stop, and more) with
+  4 handler types (shell command, HTTP endpoint, LLM prompt, sub-agent); gives deterministic
   non-LLM control over the agent lifecycle
-- **Plugins / Skills** -- installable via `/plugin install`, hot-reloaded from `~/.claude/skills`,
-  with a marketplace; skills and slash commands unified as of v2.1.0
-- **Scheduling** -- `/loop` (session-scoped), cloud-managed cron via `claude.ai/code/scheduled`
-  (Anthropic infrastructure, minimum interval applies), and desktop app automations
-- **Messaging channels** -- Telegram, Discord, iMessage, and webhooks via the Channels feature
-  (research preview, v2.1.80+); deep Slack integration that triggers cloud sessions and creates PRs
-- **Claude Cowork** -- a separate product for knowledge workers; connects to 38+
-  services via MCP including Slack, Gmail, Microsoft Teams, Notion, Jira, Salesforce, and more
-- **Memory** -- CLAUDE.md and MEMORY.md for project-level context; auto-memory rolling out
+- Plugins / Skills — installable via `/plugin install`, hot-reloaded from `~/.claude/skills`,
+  with a marketplace; includes the official ralph-wiggum plugin (`/ralph-loop`) for
+  autonomous iteration toward a completion goal (distinct from `/loop`)
+- `/loop` — a native bundled skill, available in every session without any plugin, that runs
+  a prompt on a repeating schedule within an active CLI session (polling/monitoring use case);
+  session-scoped, dies when the terminal closes
+- Scheduling — cloud-managed cron (Anthropic infrastructure, minimum 1-hour interval) and
+  desktop app scheduled tasks (run locally while the app is open, minimum 1-minute interval,
+  full local file access); no self-hosted cron
+- Messaging channels — Telegram, Discord, and iMessage via the Channels feature (research
+  preview, requires Bun runtime); Slack is the most-requested addition and has not yet shipped
+- Memory — CLAUDE.md and MEMORY.md for project-level context; auto-memory since v2.1.59+
+- Claude Cowork — a separate knowledge-worker product connecting 38+ services via MCP
+  including Gmail, Microsoft Teams, Notion, Jira, Salesforce, and more
 
-These are real features. The key differences that remain:
+Claude Code's source was briefly and accidentally made public in March 2026 before being taken
+down. The CLI ships as minified/bundled TypeScript compiled with Bun — it is not open source.
 
-- Claude Code's scheduling runs on **Anthropic's cloud** (or requires the desktop app open),
-  not a self-hosted server; cloud jobs have a minimum interval and your data leaves your hardware
-- Memory is **project-file-based** (CLAUDE.md / MEMORY.md), not a knowledge graph that
-  accumulates automatically across all your work; auto-memory is still rolling out
-- **Not provider-agnostic** -- routes through Bedrock or Vertex but always hits a Claude model;
-  you cannot switch to GPT, Gemini, or a local model
-- **Not open source** -- proprietary; the CLI ships obfuscated JavaScript
-- Messaging channels are a **research preview** requiring Bun runtime; not yet production-grade
+Key differences that remain:
+
+- Scheduling requires cloud (Anthropic infrastructure, data off your hardware, 1-hour minimum)
+  or the desktop app (runs locally, but the app must stay open — not a headless server process);
+  neither runs as a server daemon the way Hermes cron does
+- Memory is project-file-based (CLAUDE.md / MEMORY.md plus rolling auto-memory); it doesn't
+  automatically accumulate a cross-project knowledge graph the way Hermes does
+- Not provider-agnostic — routes through Anthropic, Bedrock, Vertex, or Foundry, but always
+  a Claude model; you can't switch to GPT, Gemini, or a local model
+- Messaging channels are still a research preview, not production
 
 Hermes can use Claude Code as a sub-agent. For large implementation tasks, Hermes can spawn
 Claude Code to handle the heavy lifting and fold the result back into its own memory and history.
 
 | | Claude Code | Hermes |
 |---|---|---|
-| Persistent memory (automatic) | Partial (CLAUDE.md / MEMORY.md, rolling out) | Yes |
-| Skills / hooks system | Yes (Hooks + Plugin/Skills marketplace) | Yes (auto-generated from experience) |
+| Persistent memory (automatic) | Partial (CLAUDE.md / MEMORY.md + auto-memory v2.1.59+) | Yes |
+| Skills / hooks system | Yes (26-event Hooks + Plugin/Skills marketplace) | Yes (auto-generated from experience) |
 | Scheduled jobs (self-hosted) | No (cloud or desktop-app only) | Yes |
-| Messaging access | Partial (Telegram/Discord/iMessage via research preview; Slack native) | Yes (10+ platforms, production) |
+| Messaging access | Partial (Telegram/Discord/iMessage research preview; Slack not yet) | Yes (many platforms, production) |
 | Cowork connectors (Slack, Gmail, etc.) | Yes (via Claude Cowork, separate product) | Via agent tool use |
 | Web UI | Yes (claude.ai/code, Anthropic-hosted) | Yes (self-hosted) |
-| Provider-agnostic | No (Claude models only, via Bedrock/Vertex) | Yes (any provider) |
+| Provider-agnostic | No (Claude models only) | Yes (any provider) |
 | Self-hosted scheduling | No | Yes |
 | Open source | No | Yes |
+| Background/cloud agent mode | Yes (cloud-scheduled) | Yes (self-hosted cron) |
 | Runs as sub-agent of Hermes | Yes | N/A |
+| Memory inspectability | Partial (CLAUDE.md readable; auto-memory less so) | Yes (markdown files) |
 
 ### vs. Codex CLI (OpenAI)
 
-Codex CLI is OpenAI's open-source agentic terminal tool (Apache 2.0, ~73k GitHub stars). It
-supports 10+ providers including Anthropic, Google, Mistral, Groq, and local models via Ollama.
-It added persistent session memory in v0.100.0 with `codex resume`. The desktop app has an
-Automations feature for scheduled local tasks.
+Codex CLI (Apache 2.0, ~60k GitHub stars) started as a straightforward terminal tool and has
+expanded into a product family. It was rewritten from TypeScript to Rust. It now includes an IDE
+extension, a desktop app with an Automations feature, and Codex Cloud for remote execution. A
+Skills system is shared across surfaces. It supports 12+ built-in providers: OpenAI, Anthropic,
+Google/Gemini, Mistral, Groq, Ollama, OpenRouter, LM Studio, Together AI, DeepSeek, xAI,
+Azure OpenAI, and custom endpoints.
 
-The CLI itself has no native scheduling (open feature request as of early 2026). Memory is
-session-history-based rather than a living knowledge graph. No messaging app access. A strong
-tool for single-session coding; Hermes adds the always-on layer on top.
+The CLI itself has no native scheduling (open feature request). Session continuity is available
+via `codex resume`. Memory is session-history-based plus AGENTS.md project context — not a
+living knowledge graph that accumulates across all your projects. No first-party messaging
+integration. The Automations feature in the desktop app covers scheduled local tasks but doesn't
+reach the cross-session, cross-surface continuity Hermes has.
 
 | | Codex CLI | Hermes |
 |---|---|---|
 | Persistent memory | Partial (session history + AGENTS.md) | Yes (automatic, layered) |
-| Scheduled jobs | Partial (desktop app only; CLI has none) | Yes |
+| Scheduled jobs | Partial (desktop app Automations; CLI has none) | Yes |
 | Messaging app access | No | Yes |
-| Web UI | No | Yes (self-hosted) |
-| Provider-agnostic | Yes (10+ providers) | Yes (10+ providers) |
+| Web UI | No (CLI + desktop app) | Yes (self-hosted) |
+| Provider-agnostic | Yes (12+ providers) | Yes |
 | Self-hosted | Yes | Yes |
 | Open source | Yes (Apache 2.0) | Yes |
+| Background/cloud agent mode | Yes (Codex Cloud) | Yes (self-hosted cron) |
+| Self-improving skills | No | Yes |
 
 ### vs. OpenCode
 
-OpenCode is an open-source TUI agentic coding assistant, provider-agnostic across 75+ providers.
-It has a WebUI embedded in its binary and an official desktop app. It uses SQLite for session
-history and AGENTS.md for project context.
+OpenCode is an open-source TUI agentic coding assistant supporting 75+ providers. It has a WebUI
+embedded in its binary, an official desktop app, SQLite session history, and AGENTS.md project
+context. It supports CLAUDE.md as a fallback for users migrating from Claude Code. There are 30+
+community plugins, and community messaging integrations exist for Telegram, Slack, Discord, and
+Microsoft Teams — though none are first-party and all require manual setup.
 
-No native scheduled jobs (a community background plugin exists), no first-party messaging
-integration (community Telegram bots exist but require manual setup), and no automatic
-cross-session semantic memory. Good for interactive terminal coding sessions.
+OpenCode Go ($10/month) and OpenCode Zen (curated model service) are subscription tiers. The
+GitHub Copilot official integration launched January 2026. There is no native scheduling; a
+community background plugin exists. No automatic cross-session semantic memory.
 
 | | OpenCode | Hermes |
 |---|---|---|
 | Persistent memory | Partial (session history + AGENTS.md) | Yes (automatic, layered) |
 | Scheduled jobs | No (community plugin only) | Yes |
-| Messaging app access | No (community Telegram bot only) | Yes (first-party, 10+ platforms) |
+| Messaging app access | Community integrations only (Telegram/Slack/Discord/Teams) | Yes (first-party, many platforms) |
 | Web UI | Yes (embedded + desktop app) | Yes (self-hosted) |
 | Mobile access | No | Yes |
-| Skills system | No | Yes |
+| Skills / plugins | Yes (30+ community plugins) | Yes (auto-generated, first-party) |
 | Provider-agnostic | Yes (75+ providers) | Yes |
 | Open source | Yes | Yes |
+| Self-hosted autonomous execution | No | Yes |
 
-### vs. Cursor / Windsurf / Copilot
+### vs. Cursor
 
-Category 2 tools -- exceptional at in-editor autocomplete, inline diffs, and code review.
-Not competing for the same job as Hermes, and they work well alongside it.
+Cursor has changed substantially. The "no memory, no scheduling, no messaging" description was
+accurate in 2024 and is wrong now.
 
-Windsurf was earliest with workspace-scoped memory (Cascade Memories); Copilot has been
-shipping repo-level memory since late 2025. Cursor has no native cross-session memory as of
-early 2026. None have scheduling or messaging access.
+Memories (per-project cross-session knowledge base) shipped in beta with v1.0 in June 2025.
+Automations launched March 5, 2026 — time-based, event-based (GitHub/Linear/PagerDuty), and
+communication-based (Slack) triggers that fire background agents on cloud VMs. The web app,
+mobile agent, and Slack bot give it multi-surface reach. Cursor v3.0 (April 2, 2026) is
+explicitly agent-first with Design Mode and 30+ marketplace plugins. Cursor acquired Supermaven
+for autocomplete. As of early 2026 it's valued at $29.3B with $2B ARR. It is not a narrow editor
+tool anymore.
+
+Hermes still has a different profile: it's self-hosted and server-resident, the same persistent
+identity follows you across every surface without cloud intermediation, and it works with any
+model family rather than being cloud-VM-based. For workflows that require data sovereignty,
+self-hosted scheduling, or deep Python/ML tooling on your own hardware, Cursor's cloud-agent
+architecture is a fundamental mismatch. For teams that want editor-native agents with strong
+IDE integration, Cursor's recent evolution is significant.
 
 | | Cursor | Windsurf | Copilot | Hermes |
 |---|---|---|---|---|
-| In-editor autocomplete | Excellent | Excellent | Excellent | No |
+| In-editor autocomplete | Excellent (Supermaven) | Excellent (Cascade) | Excellent | No |
 | Inline diff / refactor | Yes | Yes | Yes | Via shell |
-| Cross-session memory | No | Yes (workspace) | Partial (repo, early access) | Yes |
-| Scheduled background jobs | No | No | No | Yes |
-| Messaging app / mobile | No | No | No | Yes |
+| Cross-session memory | Yes (Memories, per-project) | Yes (Cascade Memories, workspace) | Yes (Agentic Memory, repo-scoped, 28-day expiry) | Yes (automatic, persistent) |
+| Scheduled background jobs | Yes (Automations, cloud VM) | No | Via Coding Agent (issue-driven) | Yes (self-hosted cron) |
+| Messaging app / multi-surface | Yes (Slack bot, web app, mobile) | No | Via Copilot CLI / fleet | Yes (many platforms) |
+| Background/cloud agent mode | Yes (Automations on cloud VMs) | No | Yes (Coding Agent, GA Mar 2026) | Yes (self-hosted) |
 | Terminal tool use | Limited | Limited | Limited | Full |
 | Self-hosted | No | No | No | Yes |
-| Provider-agnostic | Partial | Partial | No | Yes |
+| Self-hosted autonomous execution | No | No | No | Yes |
+| Provider-agnostic | Partial | Partial | No (GitHub models) | Yes |
 | Open source | No | No | No | Yes |
+| Memory inspectability | Partial | Yes (stored locally) | Limited | Yes (markdown files) |
 
-### vs. Claude.ai / ChatGPT
+### vs. Claude.ai and ChatGPT
 
-Category 1. For drafting, Q&A, and brainstorming in the moment, both are excellent.
+These are no longer simple chat tools. The description of "no memory, no scheduling, no
+messaging" is inaccurate for both.
 
-Claude.ai memory has been improving -- it now generates memory from chat history, not just
-user-curated entries. Claude.ai can also execute code and read/write files in a sandboxed
-environment via Artifacts. These are real capabilities, just not the same as direct filesystem
-or shell access on your own server.
+Claude Cowork (in Claude Desktop) launched scheduled tasks on February 25, 2026 — hourly,
+daily, weekly, weekdays, and on-demand. It runs in an isolated VM with file and shell access.
+Claude has 50+ service connectors as of February 2026 including Slack (launched January 26,
+2026), Gmail, Google Calendar, Google Drive, Microsoft 365, Notion, Asana, Linear, and Jira.
+Memory auto-generates from chat history, not just user-curated entries. Code execution and
+file access in Artifacts is sandboxed, not the same as shell access on your own server.
 
-| | Claude.ai / ChatGPT | Hermes |
-|---|---|---|
-| Memory across conversations | Yes (improving; auto-generated from history) | Yes (deep, automatic) |
-| Runs shell commands | No | Yes |
-| Code execution | Sandboxed (Artifacts) | Yes (full shell) |
-| Reads / writes files | Sandboxed (Artifacts) | Yes (full filesystem) |
-| Schedules background jobs | No | Yes |
-| Web UI | Yes | Yes |
-| Messaging apps | No | Yes |
-| Self-hosted | No | Yes |
-| Provider-agnostic | No | Yes |
-| Open source | No | Yes |
+ChatGPT has Agent Mode (launched July 17, 2025), Scheduled Tasks (January 2025, recurring
+automated prompts), a computer-using agent, Projects, 50+ connectors including Gmail, GitHub,
+and Google Drive, dual-mode memory (auto + manual), and ChatGPT Pulse for Pro users (daily
+research briefings). It is not a passive Q&A interface.
+
+Where Claude.ai and ChatGPT differ from Hermes: neither is self-hosted, neither is
+provider-agnostic, and neither gives you execution on your own hardware. Connectors and
+scheduling exist, but they run on Anthropic's or OpenAI's infrastructure. Your memory, session
+history, and agent execution live on their servers, not yours. For many use cases that's fine
+— they are capable and well-supported. For privacy-conscious users, regulated environments, or
+workflows that require persistent server-side execution on controlled hardware, it's a
+disqualifying constraint.
+
+| | Claude.ai | ChatGPT | Hermes |
+|---|---|---|---|
+| Memory across conversations | Yes (auto-generated from history) | Yes (dual-mode: auto + manual) | Yes (deep, automatic) |
+| Scheduled tasks | Yes (Cowork: hourly/daily/weekly) | Yes (since Jan 2025) | Yes (any cron, self-hosted) |
+| Service connectors / messaging | Yes (50+ via Cowork) | Yes (50+ connectors) | Yes (many platforms, direct) |
+| Runs shell commands | Sandboxed (Cowork VM) | Sandboxed | Yes (full shell) |
+| Code execution | Sandboxed | Sandboxed | Yes (full shell) |
+| Reads / writes files | Sandboxed | Sandboxed | Yes (full filesystem) |
+| Web UI | Yes (Anthropic-hosted) | Yes (OpenAI-hosted) | Yes (self-hosted) |
+| Self-hosted | No | No | Yes |
+| Provider-agnostic | No | No | Yes |
+| Open source | No | No | Yes |
+| Self-hosted autonomous execution | No | No | Yes |
+| Memory inspectability | Limited | Limited | Yes (markdown files) |
 
 ---
 
-## The Compounding Advantage
+## The compounding advantage
 
-What matters most about Hermes is that it improves over time. That is the point.
+What distinguishes Hermes from most of the tools above is that it gets meaningfully better at
+your specific workflow over time without manual configuration.
 
 Every time Hermes encounters a new environment, it saves facts to memory. Every time it solves
 a problem a new way, it saves the approach as a skill. Every time you correct it, it updates its
-profile of you. Every session, every scheduled job, every tool call, the agent gets more
-calibrated to you and your workflow.
+profile of you. Every session, every scheduled job, every tool call adds to a body of knowledge
+that is specific to you, stored on your hardware, and available to every future interaction.
 
-A Claude Code session on day one and day one hundred are identical. A Hermes agent on day one
-and day one hundred is smarter about you -- it knows your stack, your conventions, your
-preferences, and the solutions that have worked before.
+A Claude Code session on day one and day one hundred are identical — it starts fresh. A Hermes
+agent on day one and day one hundred knows your stack, your conventions, your preferences, and
+the solutions that have worked before. That's the actual compounding.
 
 ---
 
-## Who Hermes Is For
+## Who Hermes is for
 
-**Solo developers and power users** who don't want to re-explain their stack every session and
-want an AI that actually knows their environment.
+Solo developers and power users who don't want to re-explain their stack every session and want
+an AI that actually knows their environment.
 
-**Teams on a shared server** where multiple people want Claude-quality AI access without each
-paying for a separate subscription or running local tooling.
+Teams on a shared server where multiple people want capable AI access without each paying for
+a separate subscription or running separate local tooling.
 
-**Automation-heavy workflows** where you want an AI running tasks on a schedule, delivering
-results to your phone, without babysitting it.
+Automation-heavy workflows where you want an AI running tasks on a schedule, delivering results
+to your phone, without babysitting it.
 
-**Privacy-conscious users** who want their conversations, memory, and files on their own
-hardware.
+Privacy-conscious users who want their conversations, memory, and files on their own hardware.
 
-**Multi-model users** who want to switch between OpenAI, Anthropic, Google, DeepSeek, and
-others based on cost, capability, or rate limits, without rebuilding their workflow each time.
+Multi-model users who want to switch between OpenAI, Anthropic, Google, DeepSeek, and others
+based on cost, capability, or rate limits, without rebuilding their workflow each time.
 
 ---
 
-## Scope and Limits
+## What Hermes is not
 
-**Hermes lives in the terminal, browser, and messaging apps.** For in-editor autocomplete and
-inline diffs, use Cursor or Windsurf alongside it -- they do that job better.
+Hermes is not the best in-editor autocomplete tool. Cursor and Windsurf do that job better.
+Use one alongside Hermes.
 
-**You run Hermes on your own server.** That means initial setup, but your data stays on your
+It is not zero-setup. You are running a server. That means initial configuration, and it means
+you're responsible for uptime, upgrades, and backups. The tradeoff is data sovereignty and
+control; that only makes sense if you actually want it.
+
+It does not make weaker models magical. Memory and skills help, but the underlying model still
+determines reasoning quality. Hermes with a weak model is a well-organized weak model.
+
+It still needs guardrails, approvals, and observability for high-stakes automations. Autonomous
+execution on a schedule with shell access is powerful and requires judgment about what to
+approve. Terminal commands can require confirmation before running; use that for anything
+consequential.
+
+If you need the absolute lowest-friction path to a one-off answer or a quick edit, a chat
+interface or an in-editor tool is the right call. Hermes is for continuity and autonomy, not
+minimum-friction one-shots.
+
+---
+
+## Scope and limits
+
+Hermes lives in the terminal, browser, and messaging apps. For in-editor autocomplete and inline
+diffs, use Cursor or Windsurf — they do that job better and work well alongside Hermes.
+
+You run Hermes on your own server. That means initial setup, but your data stays on your
 hardware and you control the schedule, the models, and the costs.
 
-**Hermes is an orchestration and memory layer.** It makes whatever model you point it at more
-useful over time. The models do the reasoning; Hermes makes sure that reasoning accumulates into
+Hermes is an orchestration and memory layer. It makes whatever model you point at it more useful
+over time. The models do the reasoning; Hermes makes sure that reasoning accumulates into
 something durable.
 
 ---
 
-## Quick Reference
+## Security and control
 
-| | OpenClaw | Claude Code | Codex CLI | OpenCode | Cursor | Claude.ai | Hermes |
-|---|---|---|---|---|---|---|---|
-| Persistent memory (auto) | Yes | Partial† | Partial | Partial | No | Yes (improving) | **Yes** |
-| Scheduled / background jobs | Yes | Partial‡ | Partial§ | No | No | No | **Yes (self-hosted)** |
-| Messaging app access | Yes (15+ platforms) | Partial (Telegram/Discord preview; Slack native) | No | No | No | No | **Yes (10+ platforms)** |
-| Web UI | Dashboard only | Yes (Anthropic cloud) | No | Yes | No | Yes | **Yes (self-hosted)** |
-| Skills system | Yes (marketplace) | Yes (Hooks + Plugins) | No | No | No | No | **Yes** |
-| Self-improving skills | Partial | No | No | No | No | No | **Yes** |
-| Browser / computer control | Yes (Chrome CDP) | No | No | No | No | No | Via shell |
-| Python / ML ecosystem | No (Node.js) | No | No | No | No | No | **Yes** |
-| In-editor autocomplete | No | No | No | No | Yes | No | No |
-| Orchestrates other agents | No | No | No | No | No | No | **Yes** |
-| Provider-agnostic | Yes | No (Claude only) | Yes | Yes | Partial | No | **Yes** |
-| Self-hosted | Yes | No | Yes | Yes | No | No | **Yes** |
-| Open source | Yes (MIT) | No | Yes | Yes | No | No | **Yes** |
-| Always-on / autonomous | Yes | No | No | No | No | No | **Yes** |
+Memory is stored locally on your server as readable, editable files: user profile, agent memory,
+and skills are all markdown. Session history is in SQLite on your machine. You can inspect,
+edit, or delete any of it directly.
 
-† Claude Code has CLAUDE.md / MEMORY.md project context and rolling auto-memory, but not full automatic cross-session recall  
-‡ Claude Code scheduling: cloud-managed (Anthropic infrastructure) or desktop-app only; no self-hosted cron  
-§ Codex scheduling: desktop app Automations only; CLI has no native scheduling
+If you want external memory providers, eight are supported: Mem0, Honcho, Hindsight, RetainDB,
+ByteRover, Supermemory, Holographic, and others. These are optional and configurable.
+
+Execution runs in configurable backends: local shell, Docker, SSH, Daytona, Singularity, or
+Modal. You choose what execution environment Hermes operates in and what it can reach.
+
+Terminal commands can require confirmation before running. For any automation that touches
+production systems or makes external calls, enable approval controls.
+
+Secrets stay on your hardware. Hermes does not phone home; it calls whatever model APIs you
+configure directly.
+
+Multiple profiles give isolation between users or projects. A shared server can have separate
+profiles with separate memory, separate skills, and separate history.
+
+---
+
+## Quick reference
+
+| | OpenClaw | Claude Code | Codex | OpenCode | Cursor | Copilot | Claude.ai | ChatGPT | Hermes |
+|---|---|---|---|---|---|---|---|---|---|
+| Persistent memory (auto) | Yes | Partial† | Partial | Partial | Yes (per-project) | Yes (repo-scoped‡) | Yes | Yes | Yes |
+| Scheduled / background jobs | Yes | Partial§ | Partial¶ | No | Yes (Automations) | Via Coding Agent | Yes (Cowork) | Yes | Yes (self-hosted) |
+| Messaging / multi-surface | Yes (24+ platforms) | Partial (preview) | No | Community only | Yes (Slack/web/mobile) | Via CLI/fleet | Yes (50+ connectors) | Yes (50+ connectors) | Yes (many platforms) |
+| Web UI | Chat UI + control dashboard | Anthropic-hosted | No | Yes | Yes + mobile | github.com | Yes (Claude Desktop) | Yes | Yes (self-hosted) |
+| Skills system | Yes (ClawHub marketplace) | Yes (Hooks + Plugins) | Partial (Skills) | Community plugins | Yes (marketplace) | No | No | No | Yes (auto-generated) |
+| Self-improving skills | Partial | No | No | No | No | No | No | No | Yes |
+| Browser / computer control | Yes (Chrome CDP) | No | No | No | No | No | No | Yes (CUA) | Via shell |
+| In-editor autocomplete | No | No | Via extension | No | Excellent | Excellent | No | No | No |
+| Orchestrates other agents | No | No | No | No | No | No | No | No | Yes |
+| Provider-agnostic | Yes | No (Claude only) | Yes | Yes | Partial | No | No | No | Yes |
+| Self-hosted | Yes | No | Yes (CLI) | Yes | No | No | No | No | Yes |
+| Self-hosted autonomous execution | Yes | No | No | No | No | No | No | No | Yes |
+| Background/cloud agent mode | Yes | Yes (cloud) | Yes (Codex Cloud) | No | Yes (cloud VMs) | Yes (Coding Agent) | Yes (Cowork VM) | Yes (Agent Mode) | Yes (self-hosted) |
+| Memory inspectability | Limited | Partial | Partial | Partial | Partial | Limited | Limited | Limited | Yes (markdown files) |
+| Open source | Yes (MIT) | No | Yes (Apache 2.0) | Yes | No | No | No | No | Yes |
+| Always-on autonomous execution | Yes | No | No | No | No | No | No | No | Yes |
+
+† Claude Code: CLAUDE.md / MEMORY.md project context plus auto-memory since v2.1.59+; no automatic cross-project accumulation
+‡ Copilot Agentic Memory: public preview Jan 15, 2026; enabled by default Mar 4, 2026; repo-scoped, auto-expires after 28 days
+§ Claude Code scheduling: cloud-managed (Anthropic infrastructure) or desktop-app only; no self-hosted cron
+¶ Codex scheduling: desktop app Automations only; CLI has no native scheduling

README.md

@@ -1,6 +1,6 @@
 # Hermes Web UI
 
-[Hermes Agent](https://hermes-agent.nousresearch.com/) is a sophisticated autonomous agent that lives on your server, accessed via a terminal or messaging apps, remembers what it learns, and gets more capable the longer it runs.
+[Hermes Agent](https://hermes-agent.nousresearch.com/) is a sophisticated autonomous agent that lives on your server, accessed via a terminal or messaging apps, that remembers what it learns and gets more capable the longer it runs.
 
 Hermes WebUI is a lightweight, dark-themed web app interface in your browser for [Hermes Agent](https://hermes-agent.nousresearch.com/).
 Full parity with the CLI experience - everything you can do from a terminal,
@@ -16,11 +16,11 @@ center for chat, right for workspace file browsing.
   <tr>
     <td width="50%" align="center">
       <img alt="Light mode with full profile support" src="https://github.com/user-attachments/assets/9b68142f-d974-4493-a8d1-fd73e622c7fd" />
-      <br /><sub>Workspace file browser with inline preview</sub>
+      <br /><sub>Light mode with full profile support</sub>
     </td>
     <td width="50%" align="center">
-      <img alt="Customize your settings, and configure a password" src="https://github.com/user-attachments/assets/941f3156-21e3-41fd-bcc8-f975d5000cb8" />
-      <br /><sub>Session projects, tags, and tool call cards</sub>
+      <img alt="Customize your settings, configure a password" src="https://github.com/user-attachments/assets/941f3156-21e3-41fd-bcc8-f975d5000cb8" />
+      <br /><sub>Customize your settings, configure a password</sub>
     </td>
   </tr>
 </table>
@@ -92,7 +92,16 @@ ecosystem. See [HERMES.md](HERMES.md) for the full side-by-side.
 
 ## Quick start
 
-First, you need to install and configure [Hermes Agent](https://hermes-agent.nousresearch.com/). Once installed:
+First, you need to install and configure [Hermes Agent](https://hermes-agent.nousresearch.com/docs/getting-started/quickstart) on your computer or server. This includes the following steps to complete:
+
+* [ ] Running the `curl` command to download and setup Hermes
+* [ ] Configure your [LLM provider](https://hermes-agent.nousresearch.com/docs/getting-started/quickstart#2-set-up-a-provider) with `hermes model`
+* [ ] Configure yout [messaging gateways](https://hermes-agent.nousresearch.com/docs/user-guide/messaging/) with `hermes gateway setup`
+* [ ] Can start chatting with hermes on command-line with `hermes`
+* [ ] Optional: [Configure your extended memory provider](https://hermes-agent.nousresearch.com/docs/user-guide/features/memory-providers)
+* [ ] Optional: [Configure your tools](https://hermes-agent.nousresearch.com/docs/user-guide/features/tools)
+
+Once installed, you can now setup the web UI with:
 
 ```bash
 git clone https://github.com/nesquena/hermes-webui.git hermes-webui
@@ -100,11 +109,11 @@ cd hermes-webui
 ./start.sh
 ```
 
-That is it. The script will:
+That is it! The script will:
 
-1. Locate your Hermes agent checkout automatically.
+1. Locate your Hermes agent directory automatically.
 2. Find (or create) a Python environment with the required dependencies.
-3. Start the server.
+3. Start the web server.
 4. Print the URL (and SSH tunnel command if you are on a remote machine).
 
 ---
@@ -113,14 +122,23 @@ That is it. The script will:
 
 **Pre-built images** (amd64 + arm64) are published to GHCR on every release:
 
+Make sure the `HERMES_WEBUI_STATE_DIR` (by default `~/.hermes/webui-mvp`, as detailed in the `.env.example` file) folder exist with the UID/GID of the owner of the `.hermes` folder. 
+The container will also mount your configured "workspace" (also from the example .env.example) as `/workspace`. adapt the location as needed.
+
+
 ```bash
 docker pull ghcr.io/nesquena/hermes-webui:latest
-docker run -d -p 8787:8787 -v ~/.hermes:/root/.hermes ghcr.io/nesquena/hermes-webui:latest
+docker run -d \
+-e WANTED_UID=`id -u` -e WANTED_GID=`id -g` \
+-v ~/.hermes:/home/hermeswebui/.hermes -e HERMES_WEBUI_STATE_DIR=/home/hermeswebui/.hermes/webui-mvp \
+-v ~/workspace:/workspace \
+-p 8787:8787 ghcr.io/nesquena/hermes-webui:latest
 ```
 
 Or run with Docker Compose (recommended):
 
 ```bash
+# Check the docker-compose.yml and make sure to adapt as needed, at minimum WANTED_UID/WANTED_GID
 docker compose up -d
 ```
 
@@ -128,7 +146,11 @@ Or build locally:
 
 ```bash
 docker build -t hermes-webui .
-docker run -d -p 8787:8787 -v ~/.hermes:/root/.hermes hermes-webui
+docker run -d \
+-e WANTED_UID=`id -u` -e WANTED_GID=`id -g` \
+-v ~/.hermes:/home/hermeswebui/.hermes -e HERMES_WEBUI_STATE_DIR=/home/hermeswebui/.hermes/webui-mvp \
+-v ~/workspace:/workspace \
+-p 8787:8787 hermes-webui
 ```
 
 Open http://localhost:8787 in your browser.
@@ -136,11 +158,13 @@ Open http://localhost:8787 in your browser.
 To enable password protection:
 
 ```bash
-docker run -d -p 8787:8787 -e HERMES_WEBUI_PASSWORD=your-secret -v ~/.hermes:/root/.hermes ghcr.io/nesquena/hermes-webui:latest
+docker run -d \
+-e WANTED_UID=`id -u` -e WANTED_GID=`id -g` \
+-v ~/.hermes:/home/hermeswebui/.hermes -e HERMES_WEBUI_STATE_DIR=/home/hermeswebui/.hermes/webui-mvp \
+-v ~/workspace:/workspace \
+-p 8787:8787 -e HERMES_WEBUI_PASSWORD=your-secret ghcr.io/nesquena/hermes-webui:latest
 ```
 
-Session data persists in a named volume (`hermes-data`) across restarts.
-
 > **Note:** By default, Docker Compose binds to `127.0.0.1` (localhost only).
 > To expose on a network, change the port to `"8787:8787"` in `docker-compose.yml`
 > and set `HERMES_WEBUI_PASSWORD` to enable authentication.
@@ -215,6 +239,40 @@ are running over SSH.
 
 ---
 
+## Accessing on your phone with Tailscale
+
+[Tailscale](https://tailscale.com) is a zero-config mesh VPN built on
+WireGuard. Install it on your server and your phone, and they join the same
+private network -- no port forwarding, no SSH tunnels, no public exposure.
+
+The Hermes Web UI is fully responsive with a mobile-optimized layout
+(hamburger sidebar, bottom navigation bar, touch-friendly controls), so it
+works well as a daily-driver agent interface from your phone.
+
+**Setup:**
+
+1. Install [Tailscale](https://tailscale.com/download) on your server and
+   your iPhone/Android.
+2. Start the WebUI listening on all interfaces with password auth enabled:
+
+```bash
+HERMES_WEBUI_HOST=0.0.0.0 HERMES_WEBUI_PASSWORD=your-secret ./start.sh
+```
+
+3. Open `http://<server-tailscale-ip>:8787` in your phone's browser
+   (find your server's Tailscale IP in the Tailscale app or with
+   `tailscale ip -4` on the server).
+
+That's it. Traffic is encrypted end-to-end by WireGuard, and password auth
+protects the UI at the application level. You can add it to your home screen
+for an app-like experience.
+
+> **Tip:** If using Docker, set `HERMES_WEBUI_HOST=0.0.0.0` in your
+> `docker-compose.yml` environment (already the default) and set
+> `HERMES_WEBUI_PASSWORD`.
+
+---
+
 ## Manual launch (without start.sh)
 
 If you prefer to launch the server directly:
@@ -250,8 +308,8 @@ Or using the agent venv explicitly:
 ```
 
 Tests run against an isolated server on port 8788 with a separate state directory.
-Production data and real cron jobs are never touched. Current count: **424 tests**
-across 22 test files.
+Production data and real cron jobs are never touched. Current count: **433 tests**
+across 23 test files.
 
 ---
 
@@ -315,6 +373,7 @@ across 22 test files.
 - Gateway status dots (green = running), model info, skill count per profile
 - Profiles management panel -- create, switch, and delete profiles from the sidebar
 - Clone config from active profile on create
+- Optional custom endpoint fields on create -- Base URL and API key written into the profile's `config.yaml` at creation time, so Ollama, LMStudio, and other local endpoints can be configured without editing files manually
 - Seamless switching -- no server restart; reloads config, skills, memory, cron, models
 - Per-session profile tracking (records which profile was active at creation)
 

ROADMAP.md

@@ -3,8 +3,8 @@
 > Goal: Full 1:1 parity with the Hermes CLI experience via a clean dark web UI.
 > Everything you can do from the CLI terminal, you can do from this UI.
 >
-> Last updated: v0.35 (April 5, 2026)
-> Tests: 433 total (433 passing, 0 failures)
+> Last updated: v0.48.0 (April 12, 2026) — 658 tests, 658 passing
+> Tests: 604 total (604 passing, 0 failures)
 > Source: <repo>/
 
 ---
@@ -40,6 +40,12 @@
 | Sprint 21 | Mobile responsive + Docker | Hamburger sidebar, bottom nav, files slide-over, Docker support (#21, #7) | 415 |
 | Sprint 22 | Multi-profile support | Profile picker, management panel, seamless switching, per-session tracking (#28) | 415 |
 | Sprint 23 | Agentic transparency | Token/cost display, subagent cards, skill picker in cron, skill linked files, workspace tree persistence, timestamp fixes | 424 |
+| v0.44.0 patch | Fix batch: approval card, login CSP, update diagnostics, Lucide icons | PRs #221 #225 #226 #227 #228 | 579 |
+| v0.45.0 | Custom endpoint in new profile form | Base URL + API key fields; server-side URL validation; config.yaml merge; 9 new tests (PR #233, fixes #170) | 604 |
+| v0.46.0 | Security, Docker UID/GID, model discovery, i18n, cancel fix | Credential redaction in API responses (PR #243); Docker UID/GID matching (PR #237); custom model API key discovery (PR #238); HTML entity decode + zh/zh-Hant i18n (PR #239); cancel interrupts agent (PR #244); +20 tests | 624 |
+| v0.47.0 | Dialogs, session menu, skills command, mobile fixes, mobile QA | Shared app dialogs (#251); session ⋯ menu (#252); mobile QA suite (#254); custom provider slash routing fix (#255); Android Chrome mobile fixes (#256); /skills command (#257); +21 tests | 645 |
+| v0.47.1 | Spanish locale | Full Spanish (es) locale, 175 keys, key-parity tests (#275 @gabogabucho); +3 tests | 648 |
+| v0.48.0 | Gateway session sync | Real-time Telegram/Discord/Slack sessions in sidebar via SSE + DB polling (#274 @bergeouss); +10 tests | 658 |
 | v0.32 | Auto-compaction handling | Compression detection, /compact command, real context window indicator | 424 |
 | v0.33 | /insights sync | Opt-in state.db sync so `hermes /insights` includes WebUI sessions | 424 |
 | v0.34 | Sprint 26 — Pluggable themes | Dark, Light, Slate, Solarized, Monokai, Nord; settings unsaved-changes guard; /theme command | 433 |
@@ -47,6 +53,9 @@
 | v0.34.2 | Theme text colors | 5 new per-theme typography variables (--strong, --em, --code-text, --code-inline-bg, --pre-text) | 433 |
 | v0.34.3 | Light theme final polish | 46 light-scoped selector overrides for sidebar, roles, chips, interactive elements | 433 |
 | v0.35 | Security hardening | Env race fix, random signing key, upload path traversal, PBKDF2 password hash | 433 |
+| v0.36–v0.37 | Model routing, personality config, tool card reload, duplicate model fixes | Model routing by provider prefix, personality via config.yaml, tool cards reload on page refresh | 466 |
+| v0.38.0–v0.38.6 | Model selector, custom endpoints, OLED theme, reasoning display, insights sync | Custom endpoint URL fix, OLED theme, top-level reasoning field fix, message_count sync to state.db | 466 |
+| v0.39.0 | Security hardening (Sprint 29) | CSRF, PBKDF2, rate limiting, session ID validation, SSRF, ENV_LOCK, XSS, HMAC, skills traversal, secure cookie, error sanitization, startup warning | 499 |
 
 ---
 

SPRINTS.md

@@ -1,6 +1,6 @@
 # Hermes Web UI -- Forward Sprint Plan
 
-> Current state: v0.35 | 433 tests | Daily driver ready
+> Current state: v0.36 | 433 tests | Daily driver ready
 > This document plans the path from here to two targets:
 >
 > Target A: 1:1 feature parity with the Hermes CLI (everything you can do from the
@@ -14,19 +14,27 @@
 
 ---
 
-## Where we are now (v0.21)
+## Where we are now (v0.36)
 
-**CLI parity: ~90% complete.** Core agent loop, all tools visible, workspace
-file ops with tree view, cron/skills/memory CRUD, session management, streaming,
-cancel, multi-provider models, custom endpoint discovery, slash commands,
-thinking/reasoning display, password auth -- all solid. Gaps are subagent
-visibility, toolset control, and code execution.
+**CLI parity: ~95% complete.** Core agent loop, all tools visible, workspace
+file ops with tree view and git detection, cron/skills/memory CRUD, session
+management, streaming with rAF throttle, cancel, multi-provider models, custom
+endpoint discovery, slash commands (help/clear/model/workspace/new/usage/theme/compact),
+thinking/reasoning display, password auth, multi-profile support with seamless
+switching, CLI session bridge (read and import from state.db), context
+auto-compaction handling, self-update checker. Remaining gaps: subagent
+session tree, toolset control per session, code execution cells.
 
-**Claude parity: ~70% complete.** Chat, streaming, file browser, session
-management, tool cards, syntax highlighting, model switching, projects,
-settings, Mermaid diagrams, mobile layout, breadcrumb workspace nav, slash
-commands, thinking display, auth -- all present. Gaps are artifacts, voice,
-TTS, sharing, mobile-optimized layout.
+**Claude parity: ~85% complete.** Chat, streaming, file browser, session
+management with projects and tags, tool cards with subagent delegation,
+syntax highlighting, model switching, Mermaid diagrams, mobile responsive
+layout (hamburger sidebar, bottom nav, files slide-over), breadcrumb
+workspace nav with tree view, slash commands, thinking/reasoning display,
+auth with signed cookies, 6 pluggable UI themes (dark/light/slate/solarized/
+monokai/nord), voice input (Web Speech API), collapsible date groups,
+context usage indicator, token/cost display, git branch badge, Docker
+support. Remaining gaps: artifacts (HTML/SVG preview), TTS playback,
+sharing/public URLs, code execution inline.
 
 ---
 
@@ -1155,7 +1163,8 @@ New test cases in `tests/test_sprint26.py`:
 
 ---
 
-*Last updated: April 5, 2026*
-*Current version: v0.35 | 433 tests*
+*Last updated: April 10, 2026*
+*Current version: v0.45.0 | 604 tests*
 *Next sprint: Sprint 24 (Web Polish + Bug Fix Pass)*
 *Horizon sprint: Sprint 25 (macOS Desktop Application)*
+*Docs sweep policy: update markdown proactively during PR reviews and after significant releases*

TESTING.md

@@ -1,14 +1,14 @@
 # Hermes Web UI: Browser Testing Plan
 
 > This document is for manual browser testing by you or by a Claude browser agent.
-> It covers user-facing features of the UI through Sprint 26 (v0.34.3).
+> It covers user-facing features of the UI through Sprint 26 (v0.36.2) and later releases.
 > Each section is written as a step-by-step test procedure with expected outcomes.
 > A browser agent (e.g. Claude with Chrome access) can execute this plan directly.
 >
 > Prerequisites: SSH tunnel is active on port 8786. Open http://localhost:8786 in browser.
 > Server health check: curl http://127.0.0.1:8786/health should return {"status":"ok"}.
 >
-> Automated tests: 433 total (433 passing, 0 failures)
+> Automated tests: 658 total (658 passing, 0 skipped, 0 known failures)
 > Run: `pytest tests/ -v --timeout=60`
 
 ---
@@ -1708,8 +1708,8 @@ Each has automated API-level tests in `tests/test_sprint{N}.py`.
 
 ---
 
-*Last updated: Sprint 26 / v0.34.3, April 5, 2026*
-*Total automated tests: 433 (433 passing, 0 failures)*
+*Last updated: v0.47.0, April 11, 2026*
+*Total automated tests: 645 (645 passing, 0 failures)*
 *Regression gate: tests/test_regressions.py*
 *Run: pytest tests/ -v --timeout=60*
 *Source: <repo>/*

THEMES.md

@@ -1,6 +1,6 @@
 # Hermes Web UI — Themes
 
-Hermes Web UI supports pluggable color themes. Five themes ship built-in, and
+Hermes Web UI supports pluggable color themes. Seven themes ship built-in, and
 you can create your own with pure CSS — no Python changes needed.
 
 ---
@@ -27,6 +27,7 @@ preview is instant — the UI updates as you click through options.
 | **Solarized Dark** | Ethan Schoonover's classic dark palette. Teal background, warm accents. |
 | **Monokai** | Warm dark theme inspired by the Monokai editor scheme. Green/pink accents. |
 | **Nord** | Arctic blue-gray palette from the Nord color system. Calm and minimal. |
+| **OLED** | True black (#000) backgrounds for OLED displays. Minimizes glow and burn-in risk. |
 | **Custom themes** | Any string accepted by `settings.json`, `POST /api/settings`, and `/theme` if added to the picker/command list. Pure CSS variables only. |
 
 ---

api/auth.py

@@ -24,6 +24,26 @@ SESSION_TTL = 86400  # 24 hours
 # Active sessions: token -> expiry timestamp
 _sessions = {}
 
+# ── Login rate limiter ──────────────────────────────────────────────────────
+_login_attempts = {}  # ip -> [timestamp, ...]
+_LOGIN_MAX_ATTEMPTS = 5
+_LOGIN_WINDOW = 60  # seconds
+
+def _check_login_rate(ip: str) -> bool:
+    """Return True if the IP is allowed to attempt login."""
+    now = time.time()
+    attempts = _login_attempts.get(ip, [])
+    # Prune old attempts
+    attempts = [t for t in attempts if now - t < _LOGIN_WINDOW]
+    _login_attempts[ip] = attempts
+    return len(attempts) < _LOGIN_MAX_ATTEMPTS
+
+def _record_login_attempt(ip: str) -> None:
+    now = time.time()
+    attempts = _login_attempts.get(ip, [])
+    attempts.append(now)
+    _login_attempts[ip] = attempts
+
 
 def _signing_key():
     """Return a random signing key, generating and persisting one on first call."""
@@ -57,7 +77,7 @@ def _hash_password(password):
     return dk.hex()
 
 
-def get_password_hash():
+def get_password_hash() -> str | None:
     """Return the active password hash, or None if auth is disabled.
     Priority: env var > settings.json."""
     env_pw = os.getenv('HERMES_WEBUI_PASSWORD', '').strip()
@@ -67,12 +87,12 @@ def get_password_hash():
     return settings.get('password_hash') or None
 
 
-def is_auth_enabled():
+def is_auth_enabled() -> bool:
     """True if a password is configured (env var or settings)."""
     return get_password_hash() is not None
 
 
-def verify_password(plain):
+def verify_password(plain) -> bool:
     """Verify a plaintext password against the stored hash."""
     expected = get_password_hash()
     if not expected:
@@ -80,20 +100,28 @@ def verify_password(plain):
     return hmac.compare_digest(_hash_password(plain), expected)
 
 
-def create_session():
+def create_session() -> str:
     """Create a new auth session. Returns signed cookie value."""
     token = secrets.token_hex(32)
     _sessions[token] = time.time() + SESSION_TTL
-    sig = hmac.new(_signing_key(), token.encode(), hashlib.sha256).hexdigest()[:16]
+    sig = hmac.new(_signing_key(), token.encode(), hashlib.sha256).hexdigest()[:32]
     return f"{token}.{sig}"
 
 
-def verify_session(cookie_value):
+def _prune_expired_sessions():
+    """Remove all expired session entries to prevent unbounded memory growth."""
+    now = time.time()
+    for token in [t for t, exp in _sessions.items() if now > exp]:
+        _sessions.pop(token, None)
+
+
+def verify_session(cookie_value) -> bool:
     """Verify a signed session cookie. Returns True if valid and not expired."""
     if not cookie_value or '.' not in cookie_value:
         return False
+    _prune_expired_sessions()  # lazy cleanup on every verification attempt
     token, sig = cookie_value.rsplit('.', 1)
-    expected_sig = hmac.new(_signing_key(), token.encode(), hashlib.sha256).hexdigest()[:16]
+    expected_sig = hmac.new(_signing_key(), token.encode(), hashlib.sha256).hexdigest()[:32]
     if not hmac.compare_digest(sig, expected_sig):
         return False
     expiry = _sessions.get(token)
@@ -103,14 +131,14 @@ def verify_session(cookie_value):
     return True
 
 
-def invalidate_session(cookie_value):
+def invalidate_session(cookie_value) -> None:
     """Remove a session token."""
     if cookie_value and '.' in cookie_value:
         token = cookie_value.rsplit('.', 1)[0]
         _sessions.pop(token, None)
 
 
-def parse_cookie(handler):
+def parse_cookie(handler) -> str | None:
     """Extract the auth cookie from the request headers."""
     cookie_header = handler.headers.get('Cookie', '')
     if not cookie_header:
@@ -124,7 +152,7 @@ def parse_cookie(handler):
     return morsel.value if morsel else None
 
 
-def check_auth(handler, parsed):
+def check_auth(handler, parsed) -> bool:
     """Check if request is authorized. Returns True if OK.
     If not authorized, sends 401 (API) or 302 redirect (page) and returns False."""
     if not is_auth_enabled():
@@ -149,7 +177,7 @@ def check_auth(handler, parsed):
     return False
 
 
-def set_auth_cookie(handler, cookie_value):
+def set_auth_cookie(handler, cookie_value) -> None:
     """Set the auth cookie on the response."""
     cookie = http.cookies.SimpleCookie()
     cookie[COOKIE_NAME] = cookie_value
@@ -157,10 +185,13 @@ def set_auth_cookie(handler, cookie_value):
     cookie[COOKIE_NAME]['samesite'] = 'Lax'
     cookie[COOKIE_NAME]['path'] = '/'
     cookie[COOKIE_NAME]['max-age'] = str(SESSION_TTL)
+    # Set Secure flag when connection is HTTPS
+    if getattr(handler.request, 'getpeercert', None) is not None or handler.headers.get('X-Forwarded-Proto', '') == 'https':
+        cookie[COOKIE_NAME]['secure'] = True
     handler.send_header('Set-Cookie', cookie[COOKIE_NAME].OutputString())
 
 
-def clear_auth_cookie(handler):
+def clear_auth_cookie(handler) -> None:
     """Clear the auth cookie on the response."""
     cookie = http.cookies.SimpleCookie()
     cookie[COOKIE_NAME] = ''

api/config.py

@@ -28,6 +28,11 @@ REPO_ROOT = Path(__file__).parent.parent.resolve()
 HOST = os.getenv('HERMES_WEBUI_HOST', '127.0.0.1')
 PORT = int(os.getenv('HERMES_WEBUI_PORT', '8787'))
 
+# ── TLS/HTTPS config (optional, env-overridable) ────────────────────────────
+TLS_CERT = os.getenv('HERMES_WEBUI_TLS_CERT', '').strip() or None
+TLS_KEY = os.getenv('HERMES_WEBUI_TLS_KEY', '').strip() or None
+TLS_ENABLED = TLS_CERT is not None and TLS_KEY is not None
+
 # ── State directory (env-overridable, never inside repo) ──────────────────────
 STATE_DIR = Path(os.getenv(
     'HERMES_WEBUI_STATE_DIR',
@@ -169,7 +174,7 @@ def get_config() -> dict:
         reload_config()
     return _cfg_cache
 
-def reload_config():
+def reload_config() -> None:
     """Reload config.yaml from the active profile's directory."""
     with _cfg_lock:
         _cfg_cache.clear()
@@ -208,7 +213,7 @@ DEFAULT_WORKSPACE = _discover_default_workspace()
 DEFAULT_MODEL     = os.getenv('HERMES_WEBUI_DEFAULT_MODEL', 'openai/gpt-5.4-mini')
 
 # ── Startup diagnostics ───────────────────────────────────────────────────────
-def print_startup_config():
+def print_startup_config() -> None:
     """Print detected configuration at startup so the user can verify what was found."""
     ok   = '\033[32m[ok]\033[0m'
     warn = '\033[33m[!!]\033[0m'
@@ -243,7 +248,7 @@ def print_startup_config():
             flush=True
         )
 
-def verify_hermes_imports():
+def verify_hermes_imports() -> tuple:
     """
     Attempt to import the key Hermes modules.
     Returns (ok: bool, missing: list[str], errors: dict[str, str]).
@@ -296,7 +301,7 @@ _FALLBACK_MODELS = [
     {'provider': 'OpenAI',    'id': 'openai/o4-mini',                   'label': 'o4-mini'},
     {'provider': 'Anthropic', 'id': 'anthropic/claude-sonnet-4.6',      'label': 'Claude Sonnet 4.6'},
     {'provider': 'Anthropic', 'id': 'anthropic/claude-sonnet-4-5',      'label': 'Claude Sonnet 4.5'},
-    {'provider': 'Anthropic', 'id': 'anthropic/claude-haiku-3-5',       'label': 'Claude Haiku 3.5'},
+    {'provider': 'Anthropic', 'id': 'anthropic/claude-haiku-4-5',       'label': 'Claude Haiku 4.5'},
     {'provider': 'Other',     'id': 'google/gemini-2.5-pro',            'label': 'Gemini 2.5 Pro'},
     {'provider': 'Other',     'id': 'deepseek/deepseek-chat-v3-0324',   'label': 'DeepSeek V3'},
     {'provider': 'Other',     'id': 'meta-llama/llama-4-scout',         'label': 'Llama 4 Scout'},
@@ -318,7 +323,7 @@ _PROVIDER_MODELS = {
         {'id': 'claude-opus-4.6',    'label': 'Claude Opus 4.6'},
         {'id': 'claude-sonnet-4.6',  'label': 'Claude Sonnet 4.6'},
         {'id': 'claude-sonnet-4-5',  'label': 'Claude Sonnet 4.5'},
-        {'id': 'claude-haiku-3-5',   'label': 'Claude Haiku 3.5'},
+        {'id': 'claude-haiku-4-5',   'label': 'Claude Haiku 4.5'},
     ],
     'openai': [
         {'id': 'gpt-5.4-mini', 'label': 'GPT-5.4 Mini'},
@@ -363,18 +368,41 @@ _PROVIDER_MODELS = {
         {'id': 'MiniMax-M2.5-highspeed', 'label': 'MiniMax M2.5 Highspeed'},
         {'id': 'MiniMax-M2.1',           'label': 'MiniMax M2.1'},
     ],
+    # GitHub Copilot — model IDs served via the Copilot API
+    'copilot': [
+        {'id': 'gpt-5.4',           'label': 'GPT-5.4'},
+        {'id': 'gpt-5.4-mini',      'label': 'GPT-5.4 Mini'},
+        {'id': 'gpt-4o',            'label': 'GPT-4o'},
+        {'id': 'claude-opus-4.6',   'label': 'Claude Opus 4.6'},
+        {'id': 'claude-sonnet-4.6', 'label': 'Claude Sonnet 4.6'},
+        {'id': 'gemini-2.5-pro',    'label': 'Gemini 2.5 Pro'},
+    ],
+    # 'gemini' is the hermes_cli provider ID for Google AI Studio
+    'gemini': [
+        {'id': 'gemini-2.5-pro',   'label': 'Gemini 2.5 Pro'},
+        {'id': 'gemini-2.0-flash', 'label': 'Gemini 2.0 Flash'},
+    ],
 }
 
 
-def resolve_model_provider(model_id: str):
-    """Resolve bare model name, provider, and base_url for AIAgent.
+def resolve_model_provider(model_id: str) -> tuple:
+    """Resolve model name, provider, and base_url for AIAgent.
 
-    Model IDs from the dropdown may include a provider prefix
-    (e.g. 'anthropic/claude-sonnet-4.6').  Direct-API providers expect
-    bare model names, while OpenRouter expects the full provider/model path.
+    Model IDs from the dropdown can be in several formats:
+      - 'claude-sonnet-4.6'            (bare name, uses config default provider)
+      - 'anthropic/claude-sonnet-4.6'  (OpenRouter-style provider/model)
+      - '@minimax:MiniMax-M2.7'        (explicit provider hint from dropdown)
 
-    Also reads base_url from config.yaml so providers with custom endpoints
-    (e.g. MiniMax, Z.AI) are routed correctly.
+    The @provider:model format is used for models from non-default provider
+    groups in the dropdown, so we can route them through the correct provider
+    via resolve_runtime_provider(requested=provider) instead of the default.
+
+    Custom OpenAI-compatible endpoints are special: their model IDs often look
+    like provider/model (for example ``google/gemma-4-26b-a4b``), which would be
+    mistaken for an OpenRouter model if we only looked at the slash. To avoid
+    that, first check whether the selected model matches an entry in
+    config.yaml -> custom_providers and route it through that named custom
+    provider.
 
     Returns (model, provider, base_url) where provider and base_url may be None.
     """
@@ -389,16 +417,45 @@ def resolve_model_provider(model_id: str):
     if not model_id:
         return model_id, config_provider, config_base_url
 
+    # Custom providers declared in config.yaml should win over slash-based
+    # OpenRouter heuristics. Their model IDs commonly contain '/' too.
+    custom_providers = cfg.get('custom_providers', [])
+    if isinstance(custom_providers, list):
+        for entry in custom_providers:
+            if not isinstance(entry, dict):
+                continue
+            entry_model = (entry.get('model') or '').strip()
+            entry_name = (entry.get('name') or '').strip()
+            entry_base_url = (entry.get('base_url') or '').strip()
+            if entry_model and entry_name and model_id == entry_model:
+                provider_hint = 'custom:' + entry_name.lower().replace(' ', '-')
+                return model_id, provider_hint, entry_base_url or None
+
+    # @provider:model format — explicit provider hint from the dropdown.
+    # Route through that provider directly (resolve_runtime_provider will
+    # resolve credentials in streaming.py).
+    if model_id.startswith('@') and ':' in model_id:
+        provider_hint, bare_model = model_id[1:].split(':', 1)
+        return bare_model, provider_hint, None
+
     if '/' in model_id:
         prefix, bare = model_id.split('/', 1)
+        # OpenRouter always needs the full provider/model path (e.g. openrouter/free,
+        # anthropic/claude-sonnet-4.6). Never strip the prefix for OpenRouter.
+        if config_provider == 'openrouter':
+            return model_id, 'openrouter', config_base_url
         # If prefix matches config provider exactly, strip it and use that provider directly.
         # e.g. config=anthropic, model=anthropic/claude-... → bare name to anthropic API
         if config_provider and prefix == config_provider:
             return bare, config_provider, config_base_url
+        # If a custom endpoint base_url is configured, don't reroute through OpenRouter
+        # just because the model name contains a slash (e.g. google/gemma-4-26b-a4b).
+        # The user has explicitly pointed at a base_url, so trust their routing config.
+        if config_base_url:
+            return model_id, config_provider, config_base_url
         # If prefix does NOT match config provider, the user picked a cross-provider model
         # from the OpenRouter dropdown (e.g. config=anthropic but picked openai/gpt-5.4-mini).
         # In this case always route through openrouter with the full provider/model string.
-        # Never strip the prefix and try a direct-API call to a provider whose key may not exist.
         if prefix in _PROVIDER_MODELS and prefix != config_provider:
             return model_id, 'openrouter', None
 
@@ -426,7 +483,9 @@ def get_available_models() -> dict:
     groups = []
 
     # 1. Read config.yaml model section
+    cfg_base_url = ''  # must be defined before conditional blocks (#117)
     model_cfg = cfg.get('model', {})
+    cfg_base_url = ''
     if isinstance(model_cfg, str):
         default_model = model_cfg
     elif isinstance(model_cfg, dict):
@@ -456,50 +515,76 @@ def get_available_models() -> dict:
             except Exception:
                 pass
 
-    # 4. Check for API keys that imply available providers
-    try:
-        from api.profiles import get_active_hermes_home as _gah2
-        hermes_env_path = _gah2() / '.env'
-    except ImportError:
-        hermes_env_path = HOME / '.hermes' / '.env'
-    env_keys = {}
-    if hermes_env_path.exists():
-        try:
-            for line in hermes_env_path.read_text().splitlines():
-                line = line.strip()
-                if line and not line.startswith('#') and '=' in line:
-                    k, v = line.split('=', 1)
-                    env_keys[k.strip()] = v.strip().strip('"').strip("'")
-        except Exception:
-            pass
-
-    # Merge with actual env
-    all_env = {**env_keys}
-    for k in ('ANTHROPIC_API_KEY', 'OPENAI_API_KEY', 'OPENROUTER_API_KEY',
-              'GOOGLE_API_KEY', 'GLM_API_KEY', 'KIMI_API_KEY', 'DEEPSEEK_API_KEY'):
-        val = os.getenv(k)
-        if val:
-            all_env[k] = val
-
+    # 4. Detect available providers.
+    # Primary: ask hermes-agent's auth layer — the authoritative source. It checks
+    # auth.json, credential pools, and env vars the same way the agent does at runtime,
+    # so the dropdown reflects exactly what the user has configured.
+    # Fallback: scan raw API key env vars (matches old behaviour if hermes not available).
     detected_providers = set()
     if active_provider:
         detected_providers.add(active_provider)
-    if all_env.get('ANTHROPIC_API_KEY'):
-        detected_providers.add('anthropic')
-    if all_env.get('OPENAI_API_KEY'):
-        detected_providers.add('openai')
-    if all_env.get('OPENROUTER_API_KEY'):
-        detected_providers.add('openrouter')
-    if all_env.get('GOOGLE_API_KEY'):
-        detected_providers.add('google')
-    if all_env.get('GLM_API_KEY'):
-        detected_providers.add('zai')
-    if all_env.get('KIMI_API_KEY'):
-        detected_providers.add('kimi-coding')
-    if all_env.get('MINIMAX_API_KEY') or all_env.get('MINIMAX_CN_API_KEY'):
-        detected_providers.add('minimax')
-    if all_env.get('DEEPSEEK_API_KEY'):
-        detected_providers.add('deepseek')
+    all_env: dict = {}  # profile .env keys — populated below, used by custom endpoint auth
+
+    _hermes_auth_used = False
+    try:
+        from hermes_cli.models import list_available_providers as _lap
+        from hermes_cli.auth import get_auth_status as _gas
+        for _p in _lap():
+            if not _p.get('authenticated'):
+                continue
+            # Exclude providers whose credential came from an ambient token
+            # (e.g. 'gh auth token' for Copilot on a machine with gh CLI auth).
+            # Only include providers with an explicit, dedicated credential.
+            try:
+                _src = _gas(_p['id']).get('key_source', '')
+                if _src == 'gh auth token':
+                    continue
+            except Exception:
+                pass
+            detected_providers.add(_p['id'])
+        _hermes_auth_used = True
+    except Exception:
+        pass
+
+    if not _hermes_auth_used:
+        # Fallback: scan .env and os.environ for known API key variables
+        try:
+            from api.profiles import get_active_hermes_home as _gah2
+            hermes_env_path = _gah2() / '.env'
+        except ImportError:
+            hermes_env_path = HOME / '.hermes' / '.env'
+        env_keys = {}
+        if hermes_env_path.exists():
+            try:
+                for line in hermes_env_path.read_text().splitlines():
+                    line = line.strip()
+                    if line and not line.startswith('#') and '=' in line:
+                        k, v = line.split('=', 1)
+                        env_keys[k.strip()] = v.strip().strip('"').strip("'")
+            except Exception:
+                pass
+        all_env = {**env_keys}
+        for k in ('ANTHROPIC_API_KEY', 'OPENAI_API_KEY', 'OPENROUTER_API_KEY',
+                  'GOOGLE_API_KEY', 'GLM_API_KEY', 'KIMI_API_KEY', 'DEEPSEEK_API_KEY'):
+            val = os.getenv(k)
+            if val:
+                all_env[k] = val
+        if all_env.get('ANTHROPIC_API_KEY'):
+            detected_providers.add('anthropic')
+        if all_env.get('OPENAI_API_KEY'):
+            detected_providers.add('openai')
+        if all_env.get('OPENROUTER_API_KEY'):
+            detected_providers.add('openrouter')
+        if all_env.get('GOOGLE_API_KEY'):
+            detected_providers.add('google')
+        if all_env.get('GLM_API_KEY'):
+            detected_providers.add('zai')
+        if all_env.get('KIMI_API_KEY'):
+            detected_providers.add('kimi-coding')
+        if all_env.get('MINIMAX_API_KEY') or all_env.get('MINIMAX_CN_API_KEY'):
+            detected_providers.add('minimax')
+        if all_env.get('DEEPSEEK_API_KEY'):
+            detected_providers.add('deepseek')
 
     # 3. Fetch models from custom endpoint if base_url is configured
     auto_detected_models = []
@@ -511,9 +596,9 @@ def get_available_models() -> dict:
             # Normalize the base_url and build models endpoint
             base_url = cfg_base_url.strip()
             if base_url.endswith('/v1'):
-                endpoint_url = base_url[:-3] + '/models'
+                endpoint_url = base_url + '/models'  # /v1/models
             else:
-                endpoint_url = base_url + '/v1/models'
+                endpoint_url = base_url.rstrip('/') + '/v1/models'
 
             # Detect provider from base_url
             provider = 'custom'
@@ -533,18 +618,53 @@ def get_available_models() -> dict:
                 except ValueError:
                     pass
 
-            # Resolve API key from environment
+            # Resolve API key for the custom / OpenAI-compatible endpoint.
+            # Priority:
+            #   1. model.api_key in config.yaml
+            #   2. provider-specific providers.<active>.api_key / providers.custom.api_key
+            #   3. env/.env fallbacks
             headers = {}
-            api_key_vars = ('HERMES_API_KEY', 'HERMES_OPENAI_API_KEY', 'OPENAI_API_KEY',
-                            'LOCAL_API_KEY', 'OPENROUTER_API_KEY', 'API_KEY')
-            for key in api_key_vars:
-                api_key = os.getenv(key)
-                if api_key:
-                    headers['Authorization'] = f'Bearer {api_key}'
-                    break
+            api_key = ''
+            if isinstance(model_cfg, dict):
+                api_key = (model_cfg.get('api_key') or '').strip()
+            if not api_key:
+                providers_cfg = cfg.get('providers', {})
+                if isinstance(providers_cfg, dict):
+                    for provider_key in filter(None, [active_provider, 'custom']):
+                        provider_cfg = providers_cfg.get(provider_key, {})
+                        if isinstance(provider_cfg, dict):
+                            api_key = (provider_cfg.get('api_key') or '').strip()
+                            if api_key:
+                                break
+            if not api_key:
+                api_key_vars = ('HERMES_API_KEY', 'HERMES_OPENAI_API_KEY', 'OPENAI_API_KEY',
+                                'LOCAL_API_KEY', 'OPENROUTER_API_KEY', 'API_KEY')
+                for key in api_key_vars:
+                    api_key = (all_env.get(key) or os.getenv(key) or '').strip()
+                    if api_key:
+                        break
+            if api_key:
+                headers['Authorization'] = f'Bearer {api_key}'
 
-            # Fetch model list from endpoint
+            # Fetch model list from endpoint (with SSRF protection)
+            import socket
+            # Resolve hostname and check against private IPs after DNS lookup
+            parsed_url = urlparse(endpoint_url if '://' in endpoint_url else f'http://{endpoint_url}')
+            if parsed_url.hostname:
+                try:
+                    resolved_ips = socket.getaddrinfo(parsed_url.hostname, None)
+                    for _, _, _, _, addr in resolved_ips:
+                        addr_obj = ipaddress.ip_address(addr[0])
+                        if addr_obj.is_private or addr_obj.is_loopback or addr_obj.is_link_local:
+                            # Allow known local providers (ollama, lmstudio)
+                            is_known_local = any(k in (parsed_url.hostname or '').lower()
+                                                 for k in ('ollama', 'localhost', '127.0.0.1', 'lmstudio', 'lm-studio'))
+                            if not is_known_local:
+                                raise ValueError(f'SSRF: resolved hostname to private IP {addr[0]}')
+                except socket.gaierror:
+                    pass  # DNS resolution failed -- let urllib handle it
             req = urllib.request.Request(endpoint_url, method='GET')
+            req.add_header('User-Agent', 'OpenAI/Python 1.0')
             for k, v in headers.items():
                 req.add_header(k, v)
             with urllib.request.urlopen(req, timeout=10) as response:
@@ -568,6 +688,30 @@ def get_available_models() -> dict:
         except Exception:
             pass  # custom endpoint unreachable or misconfigured -- fail silently
 
+    # 3b. Include models from custom_providers config entries.
+    # These are explicitly configured and should always appear even when the
+    # /v1/models endpoint is unreachable or returns a subset.
+    _custom_providers_cfg = cfg.get('custom_providers', [])
+    if isinstance(_custom_providers_cfg, list):
+        _seen_custom_ids = {m['id'] for m in auto_detected_models}
+        for _cp in _custom_providers_cfg:
+            if not isinstance(_cp, dict):
+                continue
+            _cp_model = _cp.get('model', '')
+            if _cp_model and _cp_model not in _seen_custom_ids:
+                _cp_label = _cp_model.split('/')[-1] if '/' in _cp_model else _cp_model
+                auto_detected_models.append({'id': _cp_model, 'label': _cp_label})
+                _seen_custom_ids.add(_cp_model)
+                detected_providers.add('custom')
+
+    # If the user configured a real model.provider, the base_url belongs to
+    # THAT provider, not to a separate "Custom" group. hermes_cli reports
+    # 'custom' as authenticated whenever base_url is set, which would otherwise
+    # build a phantom "Custom" bucket next to the real provider's group. Drop
+    # it unless the user explicitly chose 'custom' as their active provider.
+    if active_provider and active_provider != 'custom':
+        detected_providers.discard('custom')
+
     # 5. Build model groups
     if detected_providers:
         for pid in sorted(detected_providers):
@@ -579,9 +723,26 @@ def get_available_models() -> dict:
                     'models': [{'id': m['id'], 'label': m['label']} for m in _FALLBACK_MODELS],
                 })
             elif pid in _PROVIDER_MODELS:
+                # For non-default providers, prefix model IDs with @provider:model
+                # so resolve_model_provider() routes through that specific provider
+                # via resolve_runtime_provider(requested=provider).
+                # The default provider's models keep bare names for direct API routing.
+                raw_models = _PROVIDER_MODELS[pid]
+                _active = (active_provider or '').lower()
+                if _active and pid != _active:
+                    models = []
+                    for m in raw_models:
+                        mid = m['id']
+                        # Don't double-prefix; use @provider: hint for bare names
+                        if mid.startswith('@') or '/' in mid:
+                            models.append({'id': mid, 'label': m['label']})
+                        else:
+                            models.append({'id': f'@{pid}:{mid}', 'label': m['label']})
+                else:
+                    models = list(raw_models)
                 groups.append({
                     'provider': provider_name,
-                    'models': _PROVIDER_MODELS[pid],
+                    'models': models,
                 })
             else:
                 # Unknown provider -- use auto-detected models if available,
@@ -597,14 +758,43 @@ def get_available_models() -> dict:
                         'models': [{'id': default_model, 'label': default_model.split('/')[-1]}],
                     })
     else:
-        # No providers detected -- use fallback grouped list
-        by_provider = {}
-        for m in _FALLBACK_MODELS:
-            by_provider.setdefault(m['provider'], []).append(
-                {'id': m['id'], 'label': m['label']}
+        # No providers detected. Show only the configured default model so the user
+        # can at least send messages with their current setting. Avoid showing a
+        # generic multi-provider list — those models wouldn't be routable anyway.
+        label = default_model.split('/')[-1] if '/' in default_model else default_model
+        groups.append({'provider': 'Default', 'models': [{'id': default_model, 'label': label}]})
+
+    # Ensure the user's configured default_model always appears in the dropdown.
+    # It may be missing if the model isn't in any hardcoded list (e.g. openrouter/free,
+    # a custom local model, or any model.default not in _FALLBACK_MODELS).
+    # Normalize before comparing: strip provider prefix so 'anthropic/claude-opus-4.6'
+    # matches 'claude-opus-4.6' already in the list and avoids a duplicate entry.
+    if default_model:
+        _norm = lambda mid: mid.split('/', 1)[-1] if '/' in mid else mid
+        all_ids_norm = {_norm(m['id']) for g in groups for m in g.get('models', [])}
+        if _norm(default_model) not in all_ids_norm:
+            # Determine which group to inject into. Compare against the
+            # provider's display name from _PROVIDER_DISPLAY rather than
+            # doing a substring match on active_provider — substring
+            # matching breaks on hyphenated provider IDs like 'openai-codex'
+            # vs display name 'OpenAI Codex' (hyphen vs. space), which
+            # silently falls through to groups[0] and lands the model in
+            # the wrong group.
+            label = default_model.split('/')[-1] if '/' in default_model else default_model
+            target_display = (
+                _PROVIDER_DISPLAY.get(active_provider, active_provider or '').lower()
+                if active_provider else ''
             )
-        for provider_name, models in by_provider.items():
-            groups.append({'provider': provider_name, 'models': models})
+            injected = False
+            for g in groups:
+                if target_display and g.get('provider', '').lower() == target_display:
+                    g['models'].insert(0, {'id': default_model, 'label': label})
+                    injected = True
+                    break
+            if not injected and groups:
+                groups[0]['models'].insert(0, {'id': default_model, 'label': label})
+            elif not groups:
+                groups.append({'provider': active_provider or 'Default', 'models': [{'id': default_model, 'label': label}]})
 
     return {
         'active_provider': active_provider,
@@ -623,6 +813,7 @@ CHAT_LOCK         = threading.Lock()
 STREAMS: dict     = {}
 STREAMS_LOCK      = threading.Lock()
 CANCEL_FLAGS: dict = {}
+AGENT_INSTANCES: dict = {}  # stream_id -> AIAgent instance for interrupt propagation
 SERVER_START_TIME = time.time()
 
 # ── Thread-local env context ─────────────────────────────────────────────────
@@ -653,8 +844,13 @@ _SETTINGS_DEFAULTS = {
     'show_token_usage': False,  # show input/output token badge below assistant messages
     'show_cli_sessions': False,  # merge CLI sessions from state.db into the sidebar
     'sync_to_insights': False,  # mirror WebUI token usage to state.db for /insights
+    'check_for_updates': True,  # check if webui/agent repos are behind upstream
     'theme': 'dark',  # active UI theme name (no enum gate -- allows custom themes)
-    'password_hash': None,  # SHA-256 hash; None = auth disabled
+    'language': 'en',  # UI locale code; must match a key in static/i18n.js LOCALES
+    'bot_name': os.getenv('HERMES_WEBUI_BOT_NAME', 'Hermes'),  # display name for the assistant
+    'sound_enabled': False,  # play notification sound when assistant finishes
+    'notifications_enabled': False,  # browser notification when tab is in background
+    'password_hash': None,  # PBKDF2-HMAC-SHA256 hash; None = auth disabled
 }
 
 def load_settings() -> dict:
@@ -673,17 +869,19 @@ _SETTINGS_ALLOWED_KEYS = set(_SETTINGS_DEFAULTS.keys()) - {'password_hash'}
 _SETTINGS_ENUM_VALUES = {
     'send_key': {'enter', 'ctrl+enter'},
 }
-_SETTINGS_BOOL_KEYS = {'show_token_usage', 'show_cli_sessions', 'sync_to_insights'}
+_SETTINGS_BOOL_KEYS = {'show_token_usage', 'show_cli_sessions', 'sync_to_insights', 'check_for_updates', 'sound_enabled', 'notifications_enabled'}
+# Language codes are validated as short alphanumeric BCP-47-like tags (e.g. 'en', 'zh', 'fr')
+_SETTINGS_LANG_RE = __import__('re').compile(r'^[a-zA-Z]{2,10}(-[a-zA-Z0-9]{2,8})?$')
 
 def save_settings(settings: dict) -> dict:
     """Save settings to disk. Returns the merged settings. Ignores unknown keys."""
-    import hashlib as _hl
     current = load_settings()
     # Handle _set_password: hash and store as password_hash
     raw_pw = settings.pop('_set_password', None)
     if raw_pw and isinstance(raw_pw, str) and raw_pw.strip():
-        salt = str(STATE_DIR).encode()
-        current['password_hash'] = _hl.sha256(salt + raw_pw.strip().encode()).hexdigest()
+        # Use PBKDF2 from auth module (600k iterations) -- never raw SHA-256
+        from api.auth import _hash_password
+        current['password_hash'] = _hash_password(raw_pw.strip())
     # Handle _clear_password: explicitly disable auth
     if settings.pop('_clear_password', False):
         current['password_hash'] = None
@@ -692,6 +890,9 @@ def save_settings(settings: dict) -> dict:
             # Validate enum-constrained keys
             if k in _SETTINGS_ENUM_VALUES and v not in _SETTINGS_ENUM_VALUES[k]:
                 continue
+            # Validate language codes (BCP-47-like: 'en', 'zh', 'fr', 'zh-CN')
+            if k == 'language' and (not isinstance(v, str) or not _SETTINGS_LANG_RE.match(v)):
+                continue
             # Coerce bool keys
             if k in _SETTINGS_BOOL_KEYS:
                 v = bool(v)

api/gateway_watcher.py

@@ -0,0 +1,225 @@
+"""
+Hermes Web UI -- Gateway session watcher.
+
+Background daemon thread that polls state.db every 5 seconds for changes
+to gateway sessions (telegram, discord, slack, etc.). When changes are
+detected, it pushes notifications to all subscribed SSE clients.
+
+This enables real-time session list updates in the sidebar without
+requiring any changes to hermes-agent.
+"""
+import hashlib
+import json
+import os
+import queue
+import sqlite3
+import threading
+import time
+from pathlib import Path
+
+from api.config import HOME
+
+
+# ── State hash tracking ─────────────────────────────────────────────────────
+
+def _snapshot_hash(sessions: list) -> str:
+    """Create a lightweight hash of session IDs and timestamps for change detection."""
+    key = '|'.join(
+        f"{s['session_id']}:{s.get('updated_at', 0)}:{s.get('message_count', 0)}"
+        for s in sorted(sessions, key=lambda x: x['session_id'])
+    )
+    return hashlib.md5(key.encode()).hexdigest()
+
+
+# ── DB resolution (shared pattern with state_sync.py) ──────────────────────
+
+def _get_state_db_path() -> Path:
+    """Resolve state.db path for the active profile."""
+    try:
+        from api.profiles import get_active_hermes_home
+        hermes_home = Path(get_active_hermes_home()).expanduser().resolve()
+    except Exception:
+        hermes_home = Path(os.getenv('HERMES_HOME', str(HOME / '.hermes'))).expanduser().resolve()
+    return hermes_home / 'state.db'
+
+
+def _get_agent_sessions_from_db() -> list:
+    """Read all non-webui sessions from state.db.
+    Returns list of session dicts, or empty list on any error.
+    """
+    db_path = _get_state_db_path()
+    if not db_path.exists():
+        return []
+
+    try:
+        with sqlite3.connect(str(db_path)) as conn:
+            conn.row_factory = sqlite3.Row
+            cur = conn.cursor()
+            cur.execute("""
+                SELECT s.id, s.title, s.model, s.message_count,
+                       s.started_at, s.source,
+                       MAX(m.timestamp) AS last_activity
+                FROM sessions s
+                LEFT JOIN messages m ON m.session_id = s.id
+                WHERE s.source IS NOT NULL AND s.source != 'webui'
+                GROUP BY s.id
+                ORDER BY COALESCE(MAX(m.timestamp), s.started_at) DESC
+                LIMIT 200
+            """)
+            sessions = []
+            for row in cur.fetchall():
+                sessions.append({
+                    'session_id': row['id'],
+                    'title': row['title'] or 'Agent Session',
+                    'model': row['model'] or 'unknown',
+                    'message_count': row['message_count'] or 0,
+                    'created_at': row['started_at'],
+                    'updated_at': row['last_activity'] or row['started_at'],
+                    'source': row['source'] or 'cli',
+                })
+            return sessions
+    except Exception:
+        return []
+
+
+# ── GatewayWatcher ──────────────────────────────────────────────────────────
+
+class GatewayWatcher:
+    """Background thread that polls state.db for agent session changes.
+
+    Usage:
+        watcher = GatewayWatcher()
+        watcher.start()
+        q = watcher.subscribe()
+        # ... receive change events via q.get() ...
+        watcher.unsubscribe(q)
+        watcher.stop()
+    """
+
+    POLL_INTERVAL = 5  # seconds between polls
+    SUBSCRIBER_TIMEOUT = 30  # seconds before sending keepalive comment
+
+    def __init__(self):
+        self._subscribers: list[queue.Queue] = []
+        self._sub_lock = threading.Lock()
+        self._stop_event = threading.Event()
+        self._thread: threading.Thread | None = None
+        self._last_hash: str = ''
+        self._last_sessions: list = []
+
+    def start(self):
+        """Start the watcher daemon thread."""
+        if self._thread and self._thread.is_alive():
+            return
+        self._stop_event.clear()
+        self._thread = threading.Thread(target=self._poll_loop, daemon=True, name='gateway-watcher')
+        self._thread.start()
+
+    def stop(self):
+        """Stop the watcher thread."""
+        self._stop_event.set()
+        # Wake up any subscribers
+        with self._sub_lock:
+            for q in self._subscribers:
+                try:
+                    q.put(None)  # sentinel
+                except Exception:
+                    pass
+        if self._thread:
+            self._thread.join(timeout=3)
+            self._thread = None
+
+    def subscribe(self) -> queue.Queue:
+        """Subscribe to change events. Returns a queue.Queue.
+        Events are dicts: {'type': 'sessions_changed', 'sessions': [...]}
+        A None sentinel means the watcher is stopping.
+        """
+        q = queue.Queue(maxsize=10)
+        with self._sub_lock:
+            self._subscribers.append(q)
+        return q
+
+    def unsubscribe(self, q: queue.Queue):
+        """Remove a subscriber queue."""
+        with self._sub_lock:
+            try:
+                self._subscribers.remove(q)
+            except ValueError:
+                pass
+
+    def _notify_subscribers(self, sessions: list):
+        """Push change event to all subscribers."""
+        event = {
+            'type': 'sessions_changed',
+            'sessions': sessions,
+        }
+        with self._sub_lock:
+            dead = []
+            for q in self._subscribers:
+                try:
+                    q.put_nowait(event)
+                except queue.Full:
+                    dead.append(q)  # remove slow consumers
+                except Exception:
+                    dead.append(q)
+            for q in dead:
+                try:
+                    self._subscribers.remove(q)
+                except ValueError:
+                    pass
+                # Send a None sentinel so the SSE handler unblocks, closes,
+                # and lets the browser's EventSource auto-reconnect.
+                try:
+                    q.put_nowait(None)
+                except Exception:
+                    pass
+
+    def _poll_loop(self):
+        """Main polling loop. Runs in a daemon thread."""
+        while not self._stop_event.is_set():
+            try:
+                sessions = _get_agent_sessions_from_db()
+                current_hash = _snapshot_hash(sessions)
+
+                if current_hash != self._last_hash:
+                    self._last_hash = current_hash
+                    self._last_sessions = sessions
+                    self._notify_subscribers(sessions)
+            except Exception:
+                pass  # never crash the watcher
+
+            # Sleep in small increments so we can stop promptly
+            for _ in range(self.POLL_INTERVAL * 10):
+                if self._stop_event.is_set():
+                    return
+                time.sleep(0.1)
+
+
+# ── Module-level singleton ─────────────────────────────────────────────────
+
+_watcher: GatewayWatcher | None = None
+_watcher_lock = threading.Lock()
+
+
+def start_watcher():
+    """Start the global gateway watcher (idempotent)."""
+    global _watcher
+    with _watcher_lock:
+        if _watcher is None:
+            _watcher = GatewayWatcher()
+            _watcher.start()
+
+
+def stop_watcher():
+    """Stop the global gateway watcher."""
+    global _watcher
+    with _watcher_lock:
+        if _watcher is not None:
+            _watcher.stop()
+            _watcher = None
+
+
+def get_watcher() -> GatewayWatcher | None:
+    """Get the global watcher instance (or None if not started)."""
+    with _watcher_lock:
+        return _watcher

api/helpers.py

@@ -2,22 +2,32 @@
 Hermes Web UI -- HTTP helper functions.
 """
 import json as _json
+import re as _re
 from pathlib import Path
 from api.config import IMAGE_EXTS, MD_EXTS
 
 
-def require(body: dict, *fields):
+def require(body: dict, *fields) -> None:
     """Phase D: Validate required fields. Raises ValueError with clean message."""
     missing = [f for f in fields if not body.get(f) and body.get(f) != 0]
     if missing:
         raise ValueError(f"Missing required field(s): {', '.join(missing)}")
 
 
-def bad(handler, msg, status=400):
+def bad(handler, msg, status: int=400):
     """Return a clean JSON error response."""
     return j(handler, {'error': msg}, status=status)
 
 
+def _sanitize_error(e: Exception) -> str:
+    """Strip filesystem paths from exception messages before returning to client."""
+    import re
+    msg = str(e)
+    # Remove absolute paths (Unix and Windows)
+    msg = re.sub(r'(?:(?:/[a-zA-Z0-9_.-]+)+|(?:[A-Z]:\\[^\s]+))', '<path>', msg)
+    return msg
+
+
 def safe_resolve(root: Path, requested: str) -> Path:
     """Resolve a relative path inside root, raising ValueError on traversal."""
     resolved = (root / requested).resolve()
@@ -30,9 +40,21 @@ def _security_headers(handler):
     handler.send_header('X-Content-Type-Options', 'nosniff')
     handler.send_header('X-Frame-Options', 'DENY')
     handler.send_header('Referrer-Policy', 'same-origin')
+    handler.send_header(
+        'Content-Security-Policy',
+        "default-src 'self'; "
+        "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; "
+        "style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; "
+        "img-src 'self' data:; font-src 'self' data:; connect-src 'self'; "
+        "base-uri 'self'; form-action 'self'"
+    )
+    handler.send_header(
+        'Permissions-Policy',
+        'camera=(), microphone=(), geolocation=()'
+    )
 
 
-def j(handler, payload, status=200):
+def j(handler, payload, status: int=200) -> None:
     """Send a JSON response."""
     body = _json.dumps(payload, ensure_ascii=False, indent=2).encode('utf-8')
     handler.send_response(status)
@@ -44,7 +66,7 @@ def j(handler, payload, status=200):
     handler.wfile.write(body)
 
 
-def t(handler, payload, status=200, content_type='text/plain; charset=utf-8'):
+def t(handler, payload, status: int=200, content_type: str='text/plain; charset=utf-8') -> None:
     """Send a plain text or HTML response."""
     body = payload if isinstance(payload, bytes) else str(payload).encode('utf-8')
     handler.send_response(status)
@@ -59,7 +81,89 @@ def t(handler, payload, status=200, content_type='text/plain; charset=utf-8'):
 MAX_BODY_BYTES = 20 * 1024 * 1024  # 20MB limit for non-upload POST bodies
 
 
-def read_body(handler):
+# ── Credential redaction ──────────────────────────────────────────────────────
+
+def _build_redact_fn():
+    """Return redact_sensitive_text from hermes-agent if available, else a fallback."""
+    try:
+        from agent.redact import redact_sensitive_text
+        return redact_sensitive_text
+    except ImportError:
+        pass
+
+    # Minimal fallback covering the most common credential prefixes
+    _CRED_RE = _re.compile(
+        r"(?<![A-Za-z0-9_-])("
+        r"sk-[A-Za-z0-9_-]{10,}"          # OpenAI / Anthropic / OpenRouter
+        r"|ghp_[A-Za-z0-9]{10,}"          # GitHub PAT (classic)
+        r"|github_pat_[A-Za-z0-9_]{10,}"  # GitHub PAT (fine-grained)
+        r"|gho_[A-Za-z0-9]{10,}"          # GitHub OAuth token
+        r"|ghu_[A-Za-z0-9]{10,}"          # GitHub user-to-server token
+        r"|ghs_[A-Za-z0-9]{10,}"          # GitHub server-to-server token
+        r"|ghr_[A-Za-z0-9]{10,}"          # GitHub refresh token
+        r"|AKIA[A-Z0-9]{16}"              # AWS Access Key ID
+        r"|xox[baprs]-[A-Za-z0-9-]{10,}" # Slack tokens
+        r"|hf_[A-Za-z0-9]{10,}"          # HuggingFace token
+        r"|SG\.[A-Za-z0-9_-]{10,}"       # SendGrid API key
+        r")(?![A-Za-z0-9_-])"
+    )
+    _AUTH_HDR_RE = _re.compile(r"(Authorization:\s*Bearer\s+)(\S+)", _re.IGNORECASE)
+    _ENV_RE = _re.compile(
+        r"([A-Z0-9_]{0,50}(?:API_?KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH)[A-Z0-9_]{0,50})"
+        r"\s*=\s*(['\"]?)(\S+)\2"
+    )
+    _PRIVKEY_RE = _re.compile(
+        r"-----BEGIN[A-Z ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z ]*PRIVATE KEY-----"
+    )
+
+    def _mask(token: str) -> str:
+        return f"{token[:6]}...{token[-4:]}" if len(token) >= 18 else "***"
+
+    def _fallback_redact(text: str) -> str:
+        if not isinstance(text, str) or not text:
+            return text
+        text = _CRED_RE.sub(lambda m: _mask(m.group(1)), text)
+        text = _AUTH_HDR_RE.sub(lambda m: m.group(1) + _mask(m.group(2)), text)
+        text = _ENV_RE.sub(
+            lambda m: f"{m.group(1)}={m.group(2)}{_mask(m.group(3))}{m.group(2)}", text
+        )
+        text = _PRIVKEY_RE.sub("[REDACTED PRIVATE KEY]", text)
+        return text
+
+    return _fallback_redact
+
+
+_redact_text = _build_redact_fn()
+
+
+def _redact_value(v):
+    """Recursively redact credentials from strings, dicts, and lists."""
+    if isinstance(v, str):
+        return _redact_text(v)
+    if isinstance(v, dict):
+        return {k: _redact_value(val) for k, val in v.items()}
+    if isinstance(v, list):
+        return [_redact_value(item) for item in v]
+    return v
+
+
+def redact_session_data(session_dict: dict) -> dict:
+    """Redact credentials from message content and tool_call data before API response.
+
+    Applies to: messages[], tool_calls[], and title.
+    The underlying session file is not modified; redaction is response-layer only.
+    """
+    result = dict(session_dict)
+    if isinstance(result.get('title'), str):
+        result['title'] = _redact_text(result['title'])
+    if 'messages' in result:
+        result['messages'] = _redact_value(result['messages'])
+    if 'tool_calls' in result:
+        result['tool_calls'] = _redact_value(result['tool_calls'])
+    return result
+
+
+def read_body(handler) -> dict:
     """Read and JSON-parse a POST request body (capped at 20MB)."""
     length = int(handler.headers.get('Content-Length', 0))
     if length > MAX_BODY_BYTES:

api/models.py

@@ -34,12 +34,13 @@ def _write_session_index():
 
 
 class Session:
-    def __init__(self, session_id=None, title='Untitled',
+    def __init__(self, session_id: str=None, title: str='Untitled',
                  workspace=str(DEFAULT_WORKSPACE), model=DEFAULT_MODEL,
                  messages=None, created_at=None, updated_at=None,
-                 tool_calls=None, pinned=False, archived=False,
-                 project_id=None, profile=None,
-                 input_tokens=0, output_tokens=0, estimated_cost=None,
+                 tool_calls=None, pinned: bool=False, archived: bool=False,
+                 project_id: str=None, profile=None,
+                 input_tokens: int=0, output_tokens: int=0, estimated_cost=None,
+                 personality=None,
                  **kwargs):
         self.session_id = session_id or uuid.uuid4().hex[:12]
         self.title = title
@@ -56,12 +57,13 @@ class Session:
         self.input_tokens = input_tokens or 0
         self.output_tokens = output_tokens or 0
         self.estimated_cost = estimated_cost
+        self.personality = personality
 
     @property
     def path(self):
         return SESSION_DIR / f'{self.session_id}.json'
 
-    def save(self):
+    def save(self) -> None:
         self.updated_at = time.time()
         self.path.write_text(
             json.dumps(self.__dict__, ensure_ascii=False, indent=2),
@@ -71,12 +73,15 @@ class Session:
 
     @classmethod
     def load(cls, sid):
+        # Validate session ID format to prevent path traversal
+        if not sid or not all(c in '0123456789abcdefghijklmnopqrstuvwxyz_' for c in sid):
+            return None
         p = SESSION_DIR / f'{sid}.json'
         if not p.exists():
             return None
         return cls(**json.loads(p.read_text(encoding='utf-8')))
 
-    def compact(self):
+    def compact(self) -> dict:
         return {
             'session_id': self.session_id,
             'title': self.title,
@@ -92,6 +97,7 @@ class Session:
             'input_tokens': self.input_tokens,
             'output_tokens': self.output_tokens,
             'estimated_cost': self.estimated_cost,
+            'personality': self.personality,
         }
 
 def get_session(sid):
@@ -165,7 +171,7 @@ def all_sessions():
     return result
 
 
-def title_from(messages, fallback='Untitled'):
+def title_from(messages, fallback: str='Untitled'):
     """Derive a session title from the first user message."""
     for m in messages:
         if m.get('role') == 'user':
@@ -180,7 +186,7 @@ def title_from(messages, fallback='Untitled'):
 
 # ── Project helpers ──────────────────────────────────────────────────────────
 
-def load_projects():
+def load_projects() -> list:
     """Load project list from disk. Returns list of project dicts."""
     if not PROJECTS_FILE.exists():
         return []
@@ -189,12 +195,12 @@ def load_projects():
     except Exception:
         return []
 
-def save_projects(projects):
+def save_projects(projects) -> None:
     """Write project list to disk."""
     PROJECTS_FILE.write_text(json.dumps(projects, ensure_ascii=False, indent=2), encoding='utf-8')
 
 
-def import_cli_session(session_id, title, messages, model='unknown', profile=None):
+def import_cli_session(session_id: str, title: str, messages, model: str='unknown', profile=None):
     """Create a new WebUI session populated with CLI messages.
     Returns the Session object.
     """
@@ -212,7 +218,7 @@ def import_cli_session(session_id, title, messages, model='unknown', profile=Non
 
 # ── CLI session bridge ──────────────────────────────────────────────────────
 
-def get_cli_sessions():
+def get_cli_sessions() -> list:
     """Read CLI sessions from the agent's SQLite store and return them as
     dicts in a format the WebUI sidebar can render alongside local sessions.
 
@@ -263,6 +269,7 @@ def get_cli_sessions():
                        MAX(m.timestamp) AS last_activity
                 FROM sessions s
                 LEFT JOIN messages m ON m.session_id = s.id
+                WHERE s.source IS NOT NULL AND s.source != 'webui'
                 GROUP BY s.id
                 ORDER BY COALESCE(MAX(m.timestamp), s.started_at) DESC
                 LIMIT 200
@@ -274,9 +281,11 @@ def get_cli_sessions():
                 # the active CLI profile so sidebar filtering works either way.
                 profile = _cli_profile  # CLI DB has no profile column; use active profile
 
+                _source = row['source'] or 'cli'
+                _display_title = row['title'] or f'{_source.title()} Session'
                 cli_sessions.append({
                     'session_id': sid,
-                    'title': row['title'] or 'CLI Session',
+                    'title': _display_title,
                     'workspace': str(get_last_workspace()),
                     'model': row['model'] or 'unknown',
                     'message_count': row['message_count'] or 0,
@@ -286,7 +295,7 @@ def get_cli_sessions():
                     'archived': False,
                     'project_id': None,
                     'profile': profile,
-                    'source_tag': 'cli',
+                    'source_tag': _source,
                     'is_cli_session': True,
                 })
     except Exception:
@@ -296,7 +305,7 @@ def get_cli_sessions():
     return cli_sessions
 
 
-def get_cli_session_messages(sid):
+def get_cli_session_messages(sid) -> list:
     """Read messages for a single CLI session from the SQLite store.
     Returns a list of {role, content, timestamp} dicts.
     Returns empty list on any error.
@@ -338,7 +347,7 @@ def get_cli_session_messages(sid):
     return msgs
 
 
-def delete_cli_session(sid):
+def delete_cli_session(sid) -> bool:
     """Delete a CLI session from state.db (messages + session row).
     Returns True if deleted, False if not found or error.
     """

api/profiles.py

@@ -137,7 +137,7 @@ def _reload_dotenv(home: Path):
         pass
 
 
-def init_profile_state():
+def init_profile_state() -> None:
     """Initialize profile state at server startup.
 
     Reads ~/.hermes/active_profile, sets HERMES_HOME env var, patches
@@ -294,8 +294,38 @@ def _create_profile_fallback(name: str, clone_from: str = None,
     return profile_dir
 
 
+def _write_endpoint_to_config(profile_dir: Path, base_url: str = None, api_key: str = None) -> None:
+    """Write custom endpoint fields into config.yaml for a profile."""
+    if not base_url and not api_key:
+        return
+    config_path = profile_dir / 'config.yaml'
+    try:
+        import yaml as _yaml
+    except ImportError:
+        return
+    cfg = {}
+    if config_path.exists():
+        try:
+            loaded = _yaml.safe_load(config_path.read_text())
+            if isinstance(loaded, dict):
+                cfg = loaded
+        except Exception:
+            pass
+    model_section = cfg.get('model', {})
+    if not isinstance(model_section, dict):
+        model_section = {}
+    if base_url:
+        model_section['base_url'] = base_url
+    if api_key:
+        model_section['api_key'] = api_key
+    cfg['model'] = model_section
+    config_path.write_text(_yaml.dump(cfg, default_flow_style=False, allow_unicode=True))
+
+
 def create_profile_api(name: str, clone_from: str = None,
-                       clone_config: bool = False) -> dict:
+                       clone_config: bool = False,
+                       base_url: str = None,
+                       api_key: str = None) -> dict:
     """Create a new profile. Returns the new profile info dict."""
     _validate_profile_name(name)
     # Defense-in-depth: validate clone_from here too, even though routes.py
@@ -315,11 +345,26 @@ def create_profile_api(name: str, clone_from: str = None,
     except ImportError:
         _create_profile_fallback(name, clone_from, clone_config)
 
+    # Resolve the profile directory from the profile list when possible.
+    # hermes_cli and the webui runtime do not always agree on the exact root,
+    # so we prefer the path returned by list_profiles_api() and fall back to the
+    # standard profile location only if the profile cannot be found there yet.
+    profile_path = _DEFAULT_HERMES_HOME / 'profiles' / name
+    for p in list_profiles_api():
+        if p['name'] == name:
+            try:
+                profile_path = Path(p.get('path') or profile_path)
+            except Exception:
+                pass
+            break
+
+    profile_path.mkdir(parents=True, exist_ok=True)
+    _write_endpoint_to_config(profile_path, base_url=base_url, api_key=api_key)
+
     # Find and return the newly created profile info.
     # When hermes_cli is not importable, list_profiles_api() also falls back
     # to the stub default-only list and won't find the new profile by name.
     # In that case, return a complete profile dict directly.
-    profile_path = _DEFAULT_HERMES_HOME / 'profiles' / name
     for p in list_profiles_api():
         if p['name'] == name:
             return p

api/routes.py

@@ -2,6 +2,7 @@
 Hermes Web UI -- Route handlers for GET and POST endpoints.
 Extracted from server.py (Sprint 11) so server.py is a thin shell.
 """
+import html as _html
 import json
 import os
 import queue
@@ -19,7 +20,34 @@ from api.config import (
     IMAGE_EXTS, MD_EXTS, MIME_MAP, MAX_FILE_BYTES, MAX_UPLOAD_BYTES,
     CHAT_LOCK, load_settings, save_settings,
 )
-from api.helpers import require, bad, safe_resolve, j, t, read_body, _security_headers
+from api.helpers import require, bad, safe_resolve, j, t, read_body, _security_headers, _sanitize_error, redact_session_data, _redact_text
+
+# ── CSRF: validate Origin/Referer on POST ────────────────────────────────────
+import re as _re
+def _check_csrf(handler) -> bool:
+    """Reject cross-origin POST requests. Returns True if OK."""
+    origin = handler.headers.get('Origin', '')
+    referer = handler.headers.get('Referer', '')
+    host = handler.headers.get('Host', '')
+    if not origin and not referer:
+        return True  # non-browser clients (curl, agent) have no Origin
+    target = origin or referer
+    # Extract host:port from origin/referer
+    m = _re.match(r'^https?://([^/]+)', target)
+    if not m:
+        return False
+    origin_host = m.group(1)
+    # Allow same-origin: check Host, X-Forwarded-Host (reverse proxy), and
+    # X-Real-Host against the origin. Reverse proxies (Caddy, nginx) set
+    # X-Forwarded-Host to the client's original Host header.
+    allowed_hosts = {h.strip() for h in [
+        host,
+        handler.headers.get('X-Forwarded-Host', ''),
+        handler.headers.get('X-Real-Host', ''),
+    ] if h.strip()}
+    if origin_host in allowed_hosts:
+        return True
+    return False
 from api.models import (
     Session, get_session, new_session, all_sessions, title_from,
     _write_session_index, SESSION_INDEX_FILE,
@@ -36,27 +64,46 @@ from api.streaming import _sse, _run_agent_streaming, cancel_stream
 # Approval system (optional -- graceful fallback if agent not available)
 try:
     from tools.approval import (
-        has_pending, pop_pending, submit_pending,
+        submit_pending,
         approve_session, approve_permanent, save_permanent_allowlist,
         is_approved, _pending, _lock, _permanent_approved,
+        resolve_gateway_approval,
     )
 except ImportError:
-    has_pending = lambda *a, **k: False
-    pop_pending = lambda *a, **k: None
+
     submit_pending = lambda *a, **k: None
     approve_session = lambda *a, **k: None
     approve_permanent = lambda *a, **k: None
     save_permanent_allowlist = lambda *a, **k: None
     is_approved = lambda *a, **k: True
+    resolve_gateway_approval = lambda *a, **k: 0
     _pending = {}
     _lock = threading.Lock()
     _permanent_approved = set()
 
 
+# ── Login page locale strings ─────────────────────────────────────────────────
+# Add entries here to support more languages on the login page.
+# The key must match the 'language' setting value (from static/i18n.js LOCALES).
+_LOGIN_LOCALE = {
+    'en': {
+        'lang': 'en', 'title': 'Sign in',
+        'subtitle': 'Enter your password to continue',
+        'placeholder': 'Password', 'btn': 'Sign in',
+        'invalid_pw': 'Invalid password', 'conn_failed': 'Connection failed',
+    },
+    'zh': {
+        'lang': 'zh-CN', 'title': '\u767b\u5f55',
+        'subtitle': '\u8f93\u5165\u5bc6\u7801\u7ee7\u7eed\u4f7f\u7528',
+        'placeholder': '\u5bc6\u7801', 'btn': '\u767b\u5f55',
+        'invalid_pw': '\u5bc6\u7801\u9519\u8bef', 'conn_failed': '\u8fde\u63a5\u5931\u8d25',
+    },
+}
+
 # ── Login page (self-contained, no external deps) ────────────────────────────
 _LOGIN_PAGE_HTML = '''<!doctype html>
-<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<title>Hermes — Sign in</title>
+<html lang="{{LANG}}"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>{{BOT_NAME}} — {{LOGIN_TITLE}}</title>
 <style>
 *{box-sizing:border-box;margin:0;padding:0}
 body{background:#1a1a2e;color:#e8e8f0;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",system-ui,sans-serif;
@@ -79,35 +126,21 @@ button:hover{background:rgba(124,185,255,.25)}
 .err{color:#e94560;font-size:12px;margin-top:10px;display:none}
 </style></head><body>
 <div class="card">
-  <div class="logo">H</div>
-  <h1>Hermes</h1>
-  <p class="sub">Enter your password to continue</p>
-  <form onsubmit="return doLogin(event)">
-    <input type="password" id="pw" placeholder="Password" autofocus>
-    <button type="submit">Sign in</button>
+  <div class="logo">{{BOT_NAME_INITIAL}}</div>
+  <h1>{{BOT_NAME}}</h1>
+  <p class="sub">{{LOGIN_SUBTITLE}}</p>
+  <form id="login-form" data-invalid-pw="{{LOGIN_INVALID_PW}}" data-conn-failed="{{LOGIN_CONN_FAILED}}">
+    <input type="password" id="pw" placeholder="{{LOGIN_PLACEHOLDER}}" autofocus>
+    <button type="submit">{{LOGIN_BTN}}</button>
   </form>
   <div class="err" id="err"></div>
 </div>
-<script>
-async function doLogin(e){
-  e.preventDefault();
-  const pw=document.getElementById('pw').value;
-  const err=document.getElementById('err');
-  err.style.display='none';
-  try{
-    const res=await fetch('/api/auth/login',{method:'POST',
-      headers:{'Content-Type':'application/json'},
-      body:JSON.stringify({password:pw}),credentials:'include'});
-    const data=await res.json();
-    if(res.ok&&data.ok){window.location.href='/';}
-    else{err.textContent=data.error||'Invalid password';err.style.display='block';}
-  }catch(ex){err.textContent='Connection failed';err.style.display='block';}
-}
-</script></body></html>'''
+<script src="/static/login.js"></script>
+</body></html>'''
 
 # ── GET routes ────────────────────────────────────────────────────────────────
 
-def handle_get(handler, parsed):
+def handle_get(handler, parsed) -> bool:
     """Handle all GET routes. Returns True if handled, False for 404."""
 
     if parsed.path in ('/', '/index.html'):
@@ -115,7 +148,23 @@ def handle_get(handler, parsed):
                  content_type='text/html; charset=utf-8')
 
     if parsed.path == '/login':
-        return t(handler, _LOGIN_PAGE_HTML, content_type='text/html; charset=utf-8')
+        _settings = load_settings()
+        _bn = _html.escape(_settings.get('bot_name') or 'Hermes')
+        _lang = _settings.get('language', 'en')
+        _login_strings = _LOGIN_LOCALE.get(_lang, _LOGIN_LOCALE['en'])
+        _page = (
+            _LOGIN_PAGE_HTML
+            .replace('{{BOT_NAME}}', _bn)
+            .replace('{{BOT_NAME_INITIAL}}', _bn[0].upper())
+            .replace('{{LANG}}', _html.escape(_login_strings['lang']))
+            .replace('{{LOGIN_TITLE}}', _html.escape(_login_strings['title']))
+            .replace('{{LOGIN_SUBTITLE}}', _html.escape(_login_strings['subtitle']))
+            .replace('{{LOGIN_PLACEHOLDER}}', _html.escape(_login_strings['placeholder']))
+            .replace('{{LOGIN_BTN}}', _html.escape(_login_strings['btn']))
+            .replace('{{LOGIN_INVALID_PW}}', _html.escape(_login_strings['invalid_pw']))
+            .replace('{{LOGIN_CONN_FAILED}}', _html.escape(_login_strings['conn_failed']))
+        )
+        return t(handler, _page, content_type='text/html; charset=utf-8')
 
     if parsed.path == '/api/auth/status':
         from api.auth import is_auth_enabled, parse_cookie, verify_session
@@ -154,10 +203,11 @@ def handle_get(handler, parsed):
             return j(handler, {'error': 'session_id is required'}, status=400)
         try:
             s = get_session(sid)
-            return j(handler, {'session': s.compact() | {
+            raw = s.compact() | {
                 'messages': s.messages,
                 'tool_calls': getattr(s, 'tool_calls', []),
-            }})
+            }
+            return j(handler, {'session': redact_session_data(raw)})
         except KeyError:
             # Not a WebUI session -- try CLI store
             msgs = get_cli_session_messages(sid)
@@ -183,7 +233,7 @@ def handle_get(handler, parsed):
                     'messages': msgs,
                     'tool_calls': [],
                 }
-                return j(handler, {'session': sess})
+                return j(handler, {'session': redact_session_data(sess)})
             return bad(handler, 'Session not found', 404)
 
     if parsed.path == '/api/sessions':
@@ -214,6 +264,26 @@ def handle_get(handler, parsed):
     if parsed.path == '/api/list':
         return _handle_list_dir(handler, parsed)
 
+    if parsed.path == '/api/personalities':
+        # Read personalities from config.yaml agent.personalities section
+        # (matches hermes-agent CLI behavior, not filesystem SOUL.md approach)
+        from api.config import reload_config as _reload_cfg
+        _reload_cfg()  # pick up config.yaml changes without server restart
+        from api.config import get_config as _get_cfg
+        _cfg = _get_cfg()
+        agent_cfg = _cfg.get('agent', {})
+        raw_personalities = agent_cfg.get('personalities', {})
+        personalities = []
+        if isinstance(raw_personalities, dict):
+            for name, value in raw_personalities.items():
+                desc = ''
+                if isinstance(value, dict):
+                    desc = value.get('description', '')
+                elif isinstance(value, str):
+                    desc = value[:80] + ('...' if len(value) > 80 else '')
+                personalities.append({'name': name, 'description': desc})
+        return j(handler, {'personalities': personalities})
+
     if parsed.path == '/api/git-info':
         qs = parse_qs(parsed.query)
         sid = qs.get('session_id', [''])[0]
@@ -227,6 +297,22 @@ def handle_get(handler, parsed):
         info = git_info_for_workspace(Path(s.workspace))
         return j(handler, {'git': info})
 
+    if parsed.path == '/api/updates/check':
+        settings = load_settings()
+        if not settings.get('check_for_updates', True):
+            return j(handler, {'disabled': True})
+        qs = parse_qs(parsed.query)
+        force = qs.get('force', ['0'])[0] == '1'
+        # ?simulate=1 returns fake behind counts for UI testing (localhost only)
+        if qs.get('simulate', ['0'])[0] == '1' and handler.client_address[0] == '127.0.0.1':
+            return j(handler, {
+                'webui': {'name': 'webui', 'behind': 3, 'current_sha': 'abc1234', 'latest_sha': 'def5678', 'branch': 'master'},
+                'agent': {'name': 'agent', 'behind': 1, 'current_sha': 'aaa0001', 'latest_sha': 'bbb0002', 'branch': 'master'},
+                'checked_at': 0,
+            })
+        from api.updates import check_for_updates
+        return j(handler, check_for_updates(force=force))
+
     if parsed.path == '/api/chat/stream/status':
         stream_id = parse_qs(parsed.query).get('stream_id', [''])[0]
         return j(handler, {'active': stream_id in STREAMS, 'stream_id': stream_id})
@@ -241,6 +327,9 @@ def handle_get(handler, parsed):
     if parsed.path == '/api/chat/stream':
         return _handle_sse_stream(handler, parsed)
 
+    if parsed.path == '/api/sessions/gateway/stream':
+        return _handle_gateway_sse_stream(handler)
+
     if parsed.path == '/api/file/raw':
         return _handle_file_raw(handler, parsed)
 
@@ -318,8 +407,11 @@ def handle_get(handler, parsed):
 
 # ── POST routes ───────────────────────────────────────────────────────────────
 
-def handle_post(handler, parsed):
+def handle_post(handler, parsed) -> bool:
     """Handle all POST routes. Returns True if handled, False for 404."""
+    # CSRF: reject cross-origin browser requests
+    if not _check_csrf(handler):
+        return j(handler, {'error': 'Cross-origin request rejected'}, status=403)
 
     if parsed.path == '/api/upload':
         return handle_upload(handler)
@@ -345,6 +437,44 @@ def handle_post(handler, parsed):
         s.save()
         return j(handler, {'session': s.compact()})
 
+    if parsed.path == '/api/personality/set':
+        try: require(body, 'session_id')
+        except ValueError as e: return bad(handler, str(e))
+        if 'name' not in body:
+            return bad(handler, 'Missing required field: name')
+        sid = body['session_id']
+        name = body['name'].strip()
+        try:
+            s = get_session(sid)
+        except KeyError:
+            return bad(handler, 'Session not found', 404)
+        # Resolve personality from config.yaml agent.personalities section
+        # (matches hermes-agent CLI behavior)
+        prompt = ''
+        if name:
+            from api.config import reload_config as _reload_cfg2
+            _reload_cfg2()  # pick up config changes without restart
+            from api.config import get_config as _get_cfg2
+            _cfg2 = _get_cfg2()
+            agent_cfg = _cfg2.get('agent', {})
+            raw_personalities = agent_cfg.get('personalities', {})
+            if not isinstance(raw_personalities, dict) or name not in raw_personalities:
+                return bad(handler, f'Personality "{name}" not found in config.yaml', 404)
+            value = raw_personalities[name]
+            # Resolve prompt using the same logic as hermes-agent cli.py
+            if isinstance(value, dict):
+                parts = [value.get('system_prompt', '') or value.get('prompt', '')]
+                if value.get('tone'):
+                    parts.append(f'Tone: {value["tone"]}')
+                if value.get('style'):
+                    parts.append(f'Style: {value["style"]}')
+                prompt = '\n'.join(p for p in parts if p)
+            else:
+                prompt = str(value)
+        s.personality = name if name else None
+        s.save()
+        return j(handler, {'ok': True, 'personality': s.personality, 'prompt': prompt})
+
     if parsed.path == '/api/session/update':
         try: require(body, 'session_id')
         except ValueError as e: return bad(handler, str(e))
@@ -466,7 +596,7 @@ def handle_post(handler, parsed):
             result = switch_profile(name)
             return j(handler, result)
         except (ValueError, FileNotFoundError) as e:
-            return bad(handler, str(e), 404)
+            return bad(handler, _sanitize_error(e), 404)
         except RuntimeError as e:
             return bad(handler, str(e), 409)
 
@@ -481,12 +611,18 @@ def handle_post(handler, parsed):
             clone_from = str(clone_from).strip()
             if not _re.match(r'^[a-z0-9][a-z0-9_-]{0,63}$', clone_from):
                 return bad(handler, 'Invalid clone_from name')
+        base_url = body.get('base_url', '').strip() if body.get('base_url') else None
+        api_key = body.get('api_key', '').strip() if body.get('api_key') else None
+        if base_url and not base_url.startswith(('http://', 'https://')):
+            return bad(handler, 'base_url must start with http:// or https://')
         try:
             from api.profiles import create_profile_api
             result = create_profile_api(
                 name,
                 clone_from=clone_from,
                 clone_config=bool(body.get('clone_config', False)),
+                base_url=base_url,
+                api_key=api_key,
             )
             return j(handler, {'ok': True, 'profile': result})
         except (ValueError, FileExistsError, RuntimeError) as e:
@@ -500,12 +636,14 @@ def handle_post(handler, parsed):
             result = delete_profile_api(name)
             return j(handler, result)
         except (ValueError, FileNotFoundError) as e:
-            return bad(handler, str(e))
+            return bad(handler, _sanitize_error(e))
         except RuntimeError as e:
             return bad(handler, str(e), 409)
 
     # ── Settings (POST) ──
     if parsed.path == '/api/settings':
+        if 'bot_name' in body:
+            body['bot_name'] = (str(body['bot_name']) or '').strip() or 'Hermes'
         saved = save_settings(body)
         saved.pop('password_hash', None)  # never expose hash to client
         return j(handler, saved)
@@ -600,6 +738,14 @@ def handle_post(handler, parsed):
     if parsed.path == '/api/session/import':
         return _handle_session_import(handler, body)
 
+    # ── Self-update (POST) ──
+    if parsed.path == '/api/updates/apply':
+        target = body.get('target', '')
+        if target not in ('webui', 'agent'):
+            return bad(handler, 'target must be "webui" or "agent"')
+        from api.updates import apply_update
+        return j(handler, apply_update(target))
+
     # ── CLI session import (POST) ──
     if parsed.path == '/api/session/import_cli':
         return _handle_session_import_cli(handler, body)
@@ -607,10 +753,15 @@ def handle_post(handler, parsed):
     # ── Auth endpoints (POST) ──
     if parsed.path == '/api/auth/login':
         from api.auth import verify_password, create_session, set_auth_cookie, is_auth_enabled
+        from api.auth import _check_login_rate, _record_login_attempt
         if not is_auth_enabled():
             return j(handler, {'ok': True, 'message': 'Auth not enabled'})
+        client_ip = handler.client_address[0]
+        if not _check_login_rate(client_ip):
+            return j(handler, {'error': 'Too many attempts. Try again in a minute.'}, status=429)
         password = body.get('password', '')
         if not verify_password(password):
+            _record_login_attempt(client_ip)
             return bad(handler, 'Invalid password', 401)
         cookie_val = create_session()
         handler.send_response(200)
@@ -670,7 +821,8 @@ def _handle_session_export(handler, parsed):
     if not sid: return bad(handler, 'session_id is required')
     try: s = get_session(sid)
     except KeyError: return bad(handler, 'Session not found', 404)
-    payload = json.dumps(s.__dict__, ensure_ascii=False, indent=2)
+    safe = redact_session_data(s.__dict__)
+    payload = json.dumps(safe, ensure_ascii=False, indent=2)
     handler.send_response(200)
     handler.send_header('Content-Type', 'application/json; charset=utf-8')
     handler.send_header('Content-Disposition', f'attachment; filename="hermes-{sid}.json"')
@@ -714,15 +866,29 @@ def _handle_list_dir(handler, parsed):
     qs = parse_qs(parsed.query)
     sid = qs.get('session_id', [''])[0]
     if not sid: return bad(handler, 'session_id is required')
-    try: s = get_session(sid)
-    except KeyError: return bad(handler, 'Session not found', 404)
+    try:
+        s = get_session(sid)
+        workspace = s.workspace
+    except KeyError:
+        # Fallback for CLI sessions not loaded in WebUI memory
+        try:
+            cli_meta = None
+            for cs in get_cli_sessions():
+                if cs['session_id'] == sid:
+                    cli_meta = cs
+                    break
+            if not cli_meta:
+                return bad(handler, 'Session not found', 404)
+            workspace = cli_meta.get('workspace', '')
+        except Exception:
+            return bad(handler, 'Session not found', 404)
     try:
         return j(handler, {
-            'entries': list_dir(Path(s.workspace), qs.get('path', ['.'])[0]),
+            'entries': list_dir(Path(workspace), qs.get('path', ['.'])[0]),
             'path': qs.get('path', ['.'])[0],
         })
     except (FileNotFoundError, ValueError) as e:
-        return bad(handler, str(e), 404)
+        return bad(handler, _sanitize_error(e), 404)
 
 
 def _handle_sse_stream(handler, parsed):
@@ -751,6 +917,52 @@ def _handle_sse_stream(handler, parsed):
     return True
 
 
+def _handle_gateway_sse_stream(handler):
+    """SSE endpoint for real-time gateway session updates.
+    Streams change events from the gateway watcher background thread.
+    Only active when show_cli_sessions (show_agent_sessions) setting is enabled.
+    """
+    # Check if the feature is enabled
+    settings = load_settings()
+    if not settings.get('show_cli_sessions'):
+        return j(handler, {'error': 'agent sessions not enabled'}, status=404)
+
+    from api.gateway_watcher import get_watcher
+    watcher = get_watcher()
+    if watcher is None:
+        return j(handler, {'error': 'watcher not started'}, status=503)
+
+    handler.send_response(200)
+    handler.send_header('Content-Type', 'text/event-stream; charset=utf-8')
+    handler.send_header('Cache-Control', 'no-cache')
+    handler.send_header('X-Accel-Buffering', 'no')
+    handler.send_header('Connection', 'keep-alive')
+    handler.end_headers()
+
+    q = watcher.subscribe()
+    try:
+        # Send initial snapshot immediately
+        from api.models import get_cli_sessions
+        initial = get_cli_sessions()
+        _sse(handler, 'sessions_changed', {'sessions': initial})
+
+        while True:
+            try:
+                event_data = q.get(timeout=30)
+            except queue.Empty:
+                handler.wfile.write(b': keepalive\n\n')
+                handler.wfile.flush()
+                continue
+            if event_data is None:
+                break  # watcher is stopping
+            _sse(handler, event_data.get('type', 'sessions_changed'), event_data)
+    except (BrokenPipeError, ConnectionResetError, ConnectionAbortedError):
+        pass
+    finally:
+        watcher.unsubscribe(q)
+    return True
+
+
 def _handle_file_raw(handler, parsed):
     qs = parse_qs(parsed.query)
     sid = qs.get('session_id', [''])[0]
@@ -771,9 +983,14 @@ def _handle_file_raw(handler, parsed):
     handler.send_header('Content-Type', mime)
     handler.send_header('Content-Length', str(len(raw_bytes)))
     handler.send_header('Cache-Control', 'no-store')
-    if force_download:
+    # Security: force download for dangerous MIME types to prevent XSS
+    dangerous_types = {'text/html', 'application/xhtml+xml', 'image/svg+xml'}
+    if force_download or mime in dangerous_types:
         handler.send_header('Content-Disposition',
             f'attachment; filename="{target.name}"; filename*=UTF-8\'\'{safe_name}')
+    else:
+        handler.send_header('Content-Disposition',
+            f'inline; filename="{target.name}"; filename*=UTF-8\'\'{safe_name}')
     handler.end_headers()
     handler.wfile.write(raw_bytes)
     return True
@@ -788,15 +1005,15 @@ def _handle_file_read(handler, parsed):
     rel = qs.get('path', [''])[0]
     if not rel: return bad(handler, 'path is required')
     try: return j(handler, read_file_content(Path(s.workspace), rel))
-    except (FileNotFoundError, ValueError) as e: return bad(handler, str(e), 404)
+    except (FileNotFoundError, ValueError) as e: return bad(handler, _sanitize_error(e), 404)
 
 
 def _handle_approval_pending(handler, parsed):
     sid = parse_qs(parsed.query).get('session_id', [''])[0]
-    if has_pending(sid):
-        with _lock:
-            p = dict(_pending.get(sid, {}))
-        return j(handler, {'pending': p})
+    with _lock:
+        p = _pending.get(sid)
+    if p:
+        return j(handler, {'pending': dict(p)})
     return j(handler, {'pending': None})
 
 
@@ -877,7 +1094,7 @@ def _handle_memory_read(handler):
     memory = mem_file.read_text(encoding='utf-8', errors='replace') if mem_file.exists() else ''
     user = user_file.read_text(encoding='utf-8', errors='replace') if user_file.exists() else ''
     return j(handler, {
-        'memory': memory, 'user': user,
+        'memory': _redact_text(memory), 'user': _redact_text(user),
         'memory_path': str(mem_file), 'user_path': str(user_file),
         'memory_mtime': mem_file.stat().st_mtime if mem_file.exists() else None,
         'user_mtime': user_file.stat().st_mtime if user_file.exists() else None,
@@ -939,12 +1156,14 @@ def _handle_chat_sync(handler, body):
     if not msg: return j(handler, {'error': 'empty message'}, status=400)
     workspace = Path(body.get('workspace') or s.workspace).expanduser().resolve()
     s.workspace = str(workspace); s.model = body.get('model') or s.model
-    old_cwd = os.environ.get('TERMINAL_CWD')
-    os.environ['TERMINAL_CWD'] = str(workspace)
-    old_exec_ask = os.environ.get('HERMES_EXEC_ASK')
-    old_session_key = os.environ.get('HERMES_SESSION_KEY')
-    os.environ['HERMES_EXEC_ASK'] = '1'
-    os.environ['HERMES_SESSION_KEY'] = s.session_id
+    from api.streaming import _ENV_LOCK
+    with _ENV_LOCK:
+        old_cwd = os.environ.get('TERMINAL_CWD')
+        os.environ['TERMINAL_CWD'] = str(workspace)
+        old_exec_ask = os.environ.get('HERMES_EXEC_ASK')
+        old_session_key = os.environ.get('HERMES_SESSION_KEY')
+        os.environ['HERMES_EXEC_ASK'] = '1'
+        os.environ['HERMES_SESSION_KEY'] = s.session_id
     try:
         from run_agent import AIAgent
         with CHAT_LOCK:
@@ -954,7 +1173,7 @@ def _handle_chat_sync(handler, body):
             _api_key = None
             try:
                 from hermes_cli.runtime_provider import resolve_runtime_provider
-                _rt = resolve_runtime_provider()
+                _rt = resolve_runtime_provider(requested=_provider)
                 _api_key = _rt.get("api_key")
                 # Also use runtime provider/base_url if the webui config didn't resolve them
                 if not _provider:
@@ -987,12 +1206,13 @@ def _handle_chat_sync(handler, body):
                 persist_user_message=msg,
             )
     finally:
-        if old_cwd is None: os.environ.pop('TERMINAL_CWD', None)
-        else: os.environ['TERMINAL_CWD'] = old_cwd
-        if old_exec_ask is None: os.environ.pop('HERMES_EXEC_ASK', None)
-        else: os.environ['HERMES_EXEC_ASK'] = old_exec_ask
-        if old_session_key is None: os.environ.pop('HERMES_SESSION_KEY', None)
-        else: os.environ['HERMES_SESSION_KEY'] = old_session_key
+        with _ENV_LOCK:
+            if old_cwd is None: os.environ.pop('TERMINAL_CWD', None)
+            else: os.environ['TERMINAL_CWD'] = old_cwd
+            if old_exec_ask is None: os.environ.pop('HERMES_EXEC_ASK', None)
+            else: os.environ['HERMES_EXEC_ASK'] = old_exec_ask
+            if old_session_key is None: os.environ.pop('HERMES_SESSION_KEY', None)
+            else: os.environ['HERMES_SESSION_KEY'] = old_session_key
     s.messages = result.get('messages') or s.messages
     s.title = title_from(s.messages, s.title); s.save()
     # Sync to state.db for /insights (opt-in setting)
@@ -1006,6 +1226,7 @@ def _handle_chat_sync(handler, body):
                 estimated_cost=s.estimated_cost,
                 model=s.model,
                 title=s.title,
+                message_count=len(s.messages),
             )
     except Exception:
         pass
@@ -1091,7 +1312,7 @@ def _handle_file_delete(handler, body):
         if target.is_dir(): return bad(handler, 'Cannot delete directories via this endpoint')
         target.unlink()
         return j(handler, {'ok': True, 'path': body['path']})
-    except (ValueError, PermissionError) as e: return bad(handler, str(e))
+    except (ValueError, PermissionError) as e: return bad(handler, _sanitize_error(e))
 
 
 def _handle_file_save(handler, body):
@@ -1105,7 +1326,7 @@ def _handle_file_save(handler, body):
         if target.is_dir(): return bad(handler, 'Cannot save: path is a directory')
         target.write_text(body.get('content', ''), encoding='utf-8')
         return j(handler, {'ok': True, 'path': body['path'], 'size': target.stat().st_size})
-    except (ValueError, PermissionError) as e: return bad(handler, str(e))
+    except (ValueError, PermissionError) as e: return bad(handler, _sanitize_error(e))
 
 
 def _handle_file_create(handler, body):
@@ -1119,7 +1340,7 @@ def _handle_file_create(handler, body):
         target.parent.mkdir(parents=True, exist_ok=True)
         target.write_text(body.get('content', ''), encoding='utf-8')
         return j(handler, {'ok': True, 'path': str(target.relative_to(Path(s.workspace)))})
-    except (ValueError, PermissionError) as e: return bad(handler, str(e))
+    except (ValueError, PermissionError) as e: return bad(handler, _sanitize_error(e))
 
 
 def _handle_file_rename(handler, body):
@@ -1138,7 +1359,7 @@ def _handle_file_rename(handler, body):
         source.rename(dest)
         new_rel = str(dest.relative_to(Path(s.workspace)))
         return j(handler, {'ok': True, 'old_path': body['path'], 'new_path': new_rel})
-    except (ValueError, PermissionError, OSError) as e: return bad(handler, str(e))
+    except (ValueError, PermissionError, OSError) as e: return bad(handler, _sanitize_error(e))
 
 
 def _handle_create_dir(handler, body):
@@ -1151,7 +1372,7 @@ def _handle_create_dir(handler, body):
         if target.exists(): return bad(handler, 'Path already exists')
         target.mkdir(parents=True)
         return j(handler, {'ok': True, 'path': str(target.relative_to(Path(s.workspace)))})
-    except (ValueError, PermissionError, OSError) as e: return bad(handler, str(e))
+    except (ValueError, PermissionError, OSError) as e: return bad(handler, _sanitize_error(e))
 
 
 def _handle_workspace_add(handler, body):
@@ -1198,6 +1419,7 @@ def _handle_approval_respond(handler, body):
     choice = body.get('choice', 'deny')
     if choice not in ('once', 'session', 'always', 'deny'):
         return bad(handler, f'Invalid choice: {choice}')
+    # Pop the legacy polling-mode pending entry (no-op when gateway path is active).
     with _lock:
         pending = _pending.pop(sid, None)
     if pending:
@@ -1208,6 +1430,10 @@ def _handle_approval_respond(handler, body):
             for k in keys:
                 approve_session(sid, k); approve_permanent(k)
             save_permanent_allowlist(_permanent_approved)
+    # Unblock the agent thread waiting in the gateway approval queue.
+    # This is the primary signal when streaming is active — the agent
+    # thread is parked in entry.event.wait() and needs to be woken up.
+    resolve_gateway_approval(sid, choice, resolve_all=False)
     return j(handler, {'ok': True, 'choice': choice})
 
 
@@ -1225,6 +1451,11 @@ def _handle_skill_save(handler, body):
         skill_dir = SKILLS_DIR / category / skill_name
     else:
         skill_dir = SKILLS_DIR / skill_name
+    # Validate resolved path stays within SKILLS_DIR
+    try:
+        skill_dir.resolve().relative_to(SKILLS_DIR.resolve())
+    except ValueError:
+        return bad(handler, 'Invalid skill path')
     skill_dir.mkdir(parents=True, exist_ok=True)
     skill_file = skill_dir / 'SKILL.md'
     skill_file.write_text(body['content'], encoding='utf-8')

api/startup.py

@@ -0,0 +1,74 @@
+"""Hermes Web UI -- startup helpers."""
+from __future__ import annotations
+import os, stat, subprocess, sys
+from pathlib import Path
+
+# Credential files that should never be world-readable
+_SENSITIVE_FILES = (
+    '.env',
+    'google_token.json',
+    'google_client_secret.json',
+    '.signing_key',
+    'auth.json',
+)
+
+
+def fix_credential_permissions() -> None:
+    """Ensure sensitive files in HERMES_HOME are chmod 600 (owner-only)."""
+    hermes_home = Path(os.environ.get('HERMES_HOME', str(Path.home() / '.hermes')))
+    if not hermes_home.is_dir():
+        return
+    for name in _SENSITIVE_FILES:
+        fpath = hermes_home / name
+        if not fpath.exists():
+            continue
+        try:
+            current = stat.S_IMODE(fpath.stat().st_mode)
+            if current & 0o077:  # group or other bits set
+                fpath.chmod(0o600)
+                print(f'  [security] fixed permissions on {fpath.name} ({oct(current)} -> 0600)', flush=True)
+        except OSError:
+            pass  # best-effort; don't abort startup
+
+
+def _agent_dir() -> Path | None:
+    hermes_home = Path(os.environ.get('HERMES_HOME', str(Path.home() / '.hermes')))
+    for raw in [os.environ.get('HERMES_WEBUI_AGENT_DIR', '').strip(), str(hermes_home / 'hermes-agent')]:
+        if not raw:
+            continue
+        p = Path(raw).expanduser()
+        if p.is_dir():
+            return p.resolve()
+    return None
+
+def auto_install_agent_deps() -> bool:
+    agent_dir = _agent_dir()
+    if agent_dir is None:
+        print('[!!] Auto-install skipped: agent directory not found.', flush=True)
+        return False
+    req_file = agent_dir / 'requirements.txt'
+    pyproject = agent_dir / 'pyproject.toml'
+    if req_file.exists():
+        install_args = [sys.executable, '-m', 'pip', 'install', '--quiet', '-r', str(req_file)]
+        print(f'     Installing from {req_file} ...', flush=True)
+    elif pyproject.exists():
+        install_args = [sys.executable, '-m', 'pip', 'install', '--quiet', str(agent_dir)]
+        print(f'     Installing from {agent_dir} (pyproject.toml) ...', flush=True)
+    else:
+        print('[!!] Auto-install skipped: no requirements.txt or pyproject.toml in agent dir.', flush=True)
+        return False
+    try:
+        result = subprocess.run(install_args, capture_output=True, text=True, timeout=120)
+        if result.returncode != 0:
+            print(f'[!!] pip install failed (exit {result.returncode}):', flush=True)
+            for line in (result.stderr or '').splitlines()[-10:]:
+                print(f'     {line}', flush=True)
+            return False
+        print('[ok] pip install completed.', flush=True)
+        return True
+    except subprocess.TimeoutExpired:
+        print('[!!] Auto-install timed out after 120s.', flush=True)
+        return False
+    except Exception as e:
+        print(f'[!!] Auto-install error: {e}', flush=True)
+        return False

api/state_sync.py

@@ -43,7 +43,7 @@ def _get_state_db():
         return None
 
 
-def sync_session_start(session_id, model=None):
+def sync_session_start(session_id: str, model=None) -> None:
     """Register a WebUI session in state.db (idempotent).
     Called when a session's first message is sent.
     """
@@ -65,8 +65,9 @@ def sync_session_start(session_id, model=None):
             pass
 
 
-def sync_session_usage(session_id, input_tokens=0, output_tokens=0,
-                       estimated_cost=None, model=None, title=None):
+def sync_session_usage(session_id: str, input_tokens: int=0, output_tokens: int=0,
+                       estimated_cost=None, model=None, title: str=None,
+                       message_count: int=None) -> None:
     """Update token usage and title for a WebUI session in state.db.
     Called after each turn completes. Uses absolute=True to set totals
     (the WebUI Session already accumulates across turns).
@@ -92,6 +93,17 @@ def sync_session_usage(session_id, input_tokens=0, output_tokens=0,
                 db.set_session_title(session_id, title)
             except Exception:
                 pass
+        # Update message count
+        if message_count is not None:
+            try:
+                def _set_msg_count(conn):
+                    conn.execute(
+                        "UPDATE sessions SET message_count = ? WHERE id = ?",
+                        (message_count, session_id),
+                    )
+                db._execute_write(_set_msg_count)
+            except Exception:
+                pass
     except Exception:
         pass  # never crash the WebUI for sync failures
     finally:

api/streaming.py

@@ -11,11 +11,12 @@ import traceback
 from pathlib import Path
 
 from api.config import (
-    STREAMS, STREAMS_LOCK, CANCEL_FLAGS, CLI_TOOLSETS,
+    STREAMS, STREAMS_LOCK, CANCEL_FLAGS, AGENT_INSTANCES, CLI_TOOLSETS,
     LOCK, SESSIONS, SESSION_DIR,
     _get_session_agent_lock, _set_thread_env, _clear_thread_env,
     resolve_model_provider,
 )
+from api.helpers import redact_session_data
 
 # Global lock for os.environ writes. Per-session locks (_agent_lock) prevent
 # concurrent runs of the SAME session, but two DIFFERENT sessions can still
@@ -28,6 +29,23 @@ try:
     from run_agent import AIAgent
 except ImportError:
     AIAgent = None
+
+def _get_ai_agent():
+    """Return AIAgent class, retrying the import if the initial attempt failed.
+
+    auto_install_agent_deps() in server.py may install missing packages after
+    this module is first imported (common in Docker with a volume-mounted agent).
+    Re-attempting the import here picks up the newly installed packages without
+    requiring a server restart.
+    """
+    global AIAgent
+    if AIAgent is None:
+        try:
+            from run_agent import AIAgent as _cls  # noqa: PLC0415
+            AIAgent = _cls
+        except ImportError:
+            pass
+    return AIAgent
 from api.models import get_session, title_from
 from api.workspace import set_last_workspace
 
@@ -107,18 +125,41 @@ def _run_agent_streaming(session_id, msg_text, model, workspace, stream_id, atta
             HERMES_HOME=_profile_home,
         )
         # Still set process-level env as fallback for tools that bypass thread-local
+        # Acquire lock only for the env mutation, then release before the agent runs.
+        # The finally block re-acquires to restore — keeping critical sections short
+        # and preventing a deadlock where the restore would re-enter the same lock.
         with _ENV_LOCK:
-          old_cwd = os.environ.get('TERMINAL_CWD')
-          old_exec_ask = os.environ.get('HERMES_EXEC_ASK')
-          old_session_key = os.environ.get('HERMES_SESSION_KEY')
-          old_hermes_home = os.environ.get('HERMES_HOME')
-          os.environ['TERMINAL_CWD'] = str(s.workspace)
-          os.environ['HERMES_EXEC_ASK'] = '1'
-          os.environ['HERMES_SESSION_KEY'] = session_id
-          if _profile_home:
-              os.environ['HERMES_HOME'] = _profile_home
+            old_cwd = os.environ.get('TERMINAL_CWD')
+            old_exec_ask = os.environ.get('HERMES_EXEC_ASK')
+            old_session_key = os.environ.get('HERMES_SESSION_KEY')
+            old_hermes_home = os.environ.get('HERMES_HOME')
+            os.environ['TERMINAL_CWD'] = str(s.workspace)
+            os.environ['HERMES_EXEC_ASK'] = '1'
+            os.environ['HERMES_SESSION_KEY'] = session_id
+            if _profile_home:
+                os.environ['HERMES_HOME'] = _profile_home
+        # Lock released — agent runs without holding it
+        # Register a gateway-style notify callback so the approval system can
+        # push the `approval` SSE event the moment a dangerous command is
+        # detected, without waiting for the next on_tool() poll cycle.
+        # Without this, the agent thread blocks inside the terminal tool
+        # waiting for approval that the UI never knew to ask for, leaving
+        # the chat stuck in "Thinking…" forever.
+        _approval_registered = False
+        _unreg_notify = None
+        try:
+            from tools.approval import (
+                register_gateway_notify as _reg_notify,
+                unregister_gateway_notify as _unreg_notify,
+            )
+            def _approval_notify_cb(approval_data):
+                put('approval', approval_data)
+            _reg_notify(session_id, _approval_notify_cb)
+            _approval_registered = True
+        except ImportError:
+            pass  # approval module not available — fall back to polling
 
-          try:
+        try:
             def on_token(text):
                 if text is None:
                     return  # end-of-stream sentinel
@@ -130,23 +171,29 @@ def _run_agent_streaming(session_id, msg_text, model, workspace, stream_id, atta
                     for k, v in list(args.items())[:4]:
                         s2 = str(v); args_snap[k] = s2[:120]+('...' if len(s2)>120 else '')
                 put('tool', {'name': name, 'preview': preview, 'args': args_snap})
-                # also check for pending approval and surface it immediately
-                from tools.approval import has_pending as _has_pending, _pending, _lock
-                if _has_pending(session_id):
-                    with _lock:
-                        p = dict(_pending.get(session_id, {}))
-                    if p:
-                        put('approval', p)
+                # Fallback: poll for pending approval in case notify_cb wasn't
+                # registered (e.g. older approval module without gateway support).
+                try:
+                    from tools.approval import has_pending as _has_pending, _pending, _lock
+                    if _has_pending(session_id):
+                        with _lock:
+                            p = dict(_pending.get(session_id, {}))
+                        if p:
+                            put('approval', p)
+                except ImportError:
+                    pass
 
-            if AIAgent is None:
+            _AIAgent = _get_ai_agent()
+            if _AIAgent is None:
                 raise ImportError("AIAgent not available -- check that hermes-agent is on sys.path")
             resolved_model, resolved_provider, resolved_base_url = resolve_model_provider(model)
 
-            # Resolve API key via Hermes runtime provider (matches gateway behaviour)
+            # Resolve API key via Hermes runtime provider (matches gateway behaviour).
+            # Pass the resolved provider so non-default providers get their own credentials.
             resolved_api_key = None
             try:
                 from hermes_cli.runtime_provider import resolve_runtime_provider
-                _rt = resolve_runtime_provider()
+                _rt = resolve_runtime_provider(requested=resolved_provider)
                 resolved_api_key = _rt.get("api_key")
                 if not resolved_provider:
                     resolved_provider = _rt.get("provider")
@@ -178,7 +225,7 @@ def _run_agent_streaming(session_id, msg_text, model, workspace, stream_id, atta
             else:
                 _fallback_resolved = None
 
-            agent = AIAgent(
+            agent = _AIAgent(
                 model=resolved_model,
                 provider=resolved_provider,
                 base_url=resolved_base_url,
@@ -191,6 +238,20 @@ def _run_agent_streaming(session_id, msg_text, model, workspace, stream_id, atta
                 stream_delta_callback=on_token,
                 tool_progress_callback=on_tool,
             )
+
+            # Store agent instance for cancel/interrupt propagation
+            with STREAMS_LOCK:
+                AGENT_INSTANCES[stream_id] = agent
+                # Check if cancel was requested during agent initialization
+                if stream_id in CANCEL_FLAGS and CANCEL_FLAGS[stream_id].is_set():
+                    # Cancel arrived during agent creation - interrupt immediately
+                    try:
+                        agent.interrupt("Cancelled before start")
+                    except Exception:
+                        pass
+                    put('cancel', {'message': 'Cancelled by user'})
+                    return
+
             # Prepend workspace context so the agent always knows which directory
             # to use for file operations, regardless of session age or AGENTS.md defaults.
             workspace_ctx = f"[Workspace: {s.workspace}]\n"
@@ -205,6 +266,27 @@ def _run_agent_streaming(session_id, msg_text, model, workspace, stream_id, atta
                 "write_file, read_file, search_files, terminal workdir, and patch. "
                 "Never fall back to a hardcoded path when this tag is present."
             )
+            # Resolve personality prompt from config.yaml agent.personalities
+            # (matches hermes-agent CLI behavior — passes via ephemeral_system_prompt)
+            _personality_prompt = None
+            _pname = getattr(s, 'personality', None)
+            if _pname:
+                _agent_cfg = _cfg.get('agent', {})
+                _personalities = _agent_cfg.get('personalities', {})
+                if isinstance(_personalities, dict) and _pname in _personalities:
+                    _pval = _personalities[_pname]
+                    if isinstance(_pval, dict):
+                        _parts = [_pval.get('system_prompt', '') or _pval.get('prompt', '')]
+                        if _pval.get('tone'):
+                            _parts.append(f'Tone: {_pval["tone"]}')
+                        if _pval.get('style'):
+                            _parts.append(f'Style: {_pval["style"]}')
+                        _personality_prompt = '\n'.join(p for p in _parts if p)
+                    else:
+                        _personality_prompt = str(_pval)
+            # Pass personality via ephemeral_system_prompt (agent's own mechanism)
+            if _personality_prompt:
+                agent.ephemeral_system_prompt = _personality_prompt
             result = agent.run_conversation(
                 user_message=workspace_ctx + msg_text,
                 system_message=workspace_system_msg,
@@ -271,6 +353,7 @@ def _run_agent_streaming(session_id, msg_text, model, workspace, stream_id, atta
             for msg_idx, m in enumerate(s.messages):
                 if m.get('role') == 'assistant':
                     c = m.get('content', '')
+                    # Anthropic format: content is a list with type=tool_use blocks
                     if isinstance(c, list):
                         for p in c:
                             if isinstance(p, dict) and p.get('type') == 'tool_use':
@@ -278,6 +361,22 @@ def _run_agent_streaming(session_id, msg_text, model, workspace, stream_id, atta
                                 pending_names[tid] = p.get('name', '')
                                 pending_args[tid] = p.get('input', {})
                                 pending_asst_idx[tid] = msg_idx
+                    # OpenAI format: tool_calls as top-level field on the message
+                    for tc in m.get('tool_calls', []):
+                        if not isinstance(tc, dict):
+                            continue
+                        tid = tc.get('id', '') or tc.get('call_id', '')
+                        fn = tc.get('function', {})
+                        name = fn.get('name', '')
+                        try:
+                            import json as _j
+                            args = _j.loads(fn.get('arguments', '{}') or '{}')
+                        except Exception:
+                            args = {}
+                        if tid and name:
+                            pending_names[tid] = name
+                            pending_args[tid] = args
+                            pending_asst_idx[tid] = msg_idx
                 elif m.get('role') == 'tool':
                     tid = m.get('tool_call_id') or m.get('tool_use_id', '')
                     name = pending_names.get(tid, '')
@@ -327,6 +426,7 @@ def _run_agent_streaming(session_id, msg_text, model, workspace, stream_id, atta
                         estimated_cost=s.estimated_cost,
                         model=model,
                         title=s.title,
+                        message_count=len(s.messages),
                     )
             except Exception:
                 pass  # never crash the stream for sync failures
@@ -337,16 +437,25 @@ def _run_agent_streaming(session_id, msg_text, model, workspace, stream_id, atta
                 usage['context_length'] = getattr(_cc, 'context_length', 0) or 0
                 usage['threshold_tokens'] = getattr(_cc, 'threshold_tokens', 0) or 0
                 usage['last_prompt_tokens'] = getattr(_cc, 'last_prompt_tokens', 0) or 0
-            put('done', {'session': s.compact() | {'messages': s.messages, 'tool_calls': tool_calls}, 'usage': usage})
-          finally:
-            if old_cwd is None: os.environ.pop('TERMINAL_CWD', None)
-            else: os.environ['TERMINAL_CWD'] = old_cwd
-            if old_exec_ask is None: os.environ.pop('HERMES_EXEC_ASK', None)
-            else: os.environ['HERMES_EXEC_ASK'] = old_exec_ask
-            if old_session_key is None: os.environ.pop('HERMES_SESSION_KEY', None)
-            else: os.environ['HERMES_SESSION_KEY'] = old_session_key
-            if old_hermes_home is None: os.environ.pop('HERMES_HOME', None)
-            else: os.environ['HERMES_HOME'] = old_hermes_home
+            raw_session = s.compact() | {'messages': s.messages, 'tool_calls': tool_calls}
+            put('done', {'session': redact_session_data(raw_session), 'usage': usage})
+        finally:
+            # Unregister the gateway approval callback and unblock any threads
+            # still waiting on approval (e.g. stream cancelled mid-approval).
+            if _approval_registered and _unreg_notify is not None:
+                try:
+                    _unreg_notify(session_id)
+                except Exception:
+                    pass
+            with _ENV_LOCK:
+                if old_cwd is None: os.environ.pop('TERMINAL_CWD', None)
+                else: os.environ['TERMINAL_CWD'] = old_cwd
+                if old_exec_ask is None: os.environ.pop('HERMES_EXEC_ASK', None)
+                else: os.environ['HERMES_EXEC_ASK'] = old_exec_ask
+                if old_session_key is None: os.environ.pop('HERMES_SESSION_KEY', None)
+                else: os.environ['HERMES_SESSION_KEY'] = old_session_key
+                if old_hermes_home is None: os.environ.pop('HERMES_HOME', None)
+                else: os.environ['HERMES_HOME'] = old_hermes_home
 
     except Exception as e:
         print('[webui] stream error:\n' + traceback.format_exc(), flush=True)
@@ -367,6 +476,7 @@ def _run_agent_streaming(session_id, msg_text, model, workspace, stream_id, atta
         with STREAMS_LOCK:
             STREAMS.pop(stream_id, None)
             CANCEL_FLAGS.pop(stream_id, None)
+            AGENT_INSTANCES.pop(stream_id, None)  # Clean up agent instance reference
 
 # ============================================================
 # SECTION: HTTP Request Handler
@@ -381,9 +491,31 @@ def cancel_stream(stream_id: str) -> bool:
     with STREAMS_LOCK:
         if stream_id not in STREAMS:
             return False
+
+        # Set WebUI layer cancel flag
         flag = CANCEL_FLAGS.get(stream_id)
         if flag:
             flag.set()
+
+        # Interrupt the AIAgent instance to stop tool execution
+        agent = AGENT_INSTANCES.get(stream_id)
+        if agent:
+            try:
+                agent.interrupt("Cancelled by user")
+            except Exception as e:
+                # Log but don't block the cancel flow
+                import logging
+                logging.getLogger(__name__).debug(
+                    f"Failed to interrupt agent for stream {stream_id}: {e}"
+                )
+        else:
+            # Agent not yet stored - cancel_event flag will be checked by agent thread
+            import logging
+            logging.getLogger(__name__).debug(
+                f"Cancel requested for stream {stream_id} before agent ready - "
+                f"cancel_event flag set, will be checked on agent startup"
+            )
+
         # Put a cancel sentinel into the queue so the SSE handler wakes up
         q = STREAMS.get(stream_id)
         if q:

api/updates.py

@@ -0,0 +1,216 @@
+"""
+Hermes Web UI -- Self-update checker.
+
+Checks if the webui and hermes-agent git repos are behind their upstream
+branches. Results are cached server-side (30-min TTL) so git fetch runs
+at most twice per hour regardless of client count.
+
+Skips repos that are not git checkouts (e.g. Docker baked images where
+.git does not exist).
+"""
+import subprocess
+import threading
+import time
+from pathlib import Path
+
+from api.config import REPO_ROOT
+
+# Lazy -- may be None if agent not found
+try:
+    from api.config import _AGENT_DIR
+except ImportError:
+    _AGENT_DIR = None
+
+_update_cache = {'webui': None, 'agent': None, 'checked_at': 0}
+_cache_lock = threading.Lock()
+_check_in_progress = False
+_apply_lock = threading.Lock()   # prevents concurrent stash/pull/pop on same repo
+CACHE_TTL = 1800  # 30 minutes
+
+
+def _run_git(args, cwd, timeout=10):
+    """Run a git command and return (stdout, ok)."""
+    try:
+        r = subprocess.run(
+            ['git'] + args, cwd=str(cwd), capture_output=True,
+            text=True, timeout=timeout,
+        )
+        return r.stdout.strip(), r.returncode == 0
+    except (subprocess.TimeoutExpired, FileNotFoundError, OSError):
+        return '', False
+
+
+def _detect_default_branch(path):
+    """Detect the remote default branch (master or main)."""
+    out, ok = _run_git(['symbolic-ref', 'refs/remotes/origin/HEAD'], path)
+    if ok and out:
+        # refs/remotes/origin/master -> master
+        return out.split('/')[-1]
+    # Fallback: try master, then main
+    for branch in ('master', 'main'):
+        _, ok = _run_git(['rev-parse', '--verify', f'origin/{branch}'], path)
+        if ok:
+            return branch
+    return 'master'
+
+
+def _check_repo(path, name):
+    """Check if a git repo is behind its upstream. Returns dict or None."""
+    if path is None or not (path / '.git').exists():
+        return None
+
+    # Fetch latest from origin (network call, cached by TTL)
+    _, fetch_ok = _run_git(['fetch', 'origin', '--quiet'], path, timeout=15)
+    if not fetch_ok:
+        return {'name': name, 'behind': 0, 'error': 'fetch failed'}
+
+    # Use the current branch's upstream tracking branch, not the repo default.
+    # This avoids false "N updates behind" alerts when the user is on a feature
+    # branch and master/main has moved forward with unrelated commits.
+    # If no upstream is set (brand-new local branch), fall back to the default branch.
+    upstream, ok = _run_git(['rev-parse', '--abbrev-ref', '@{upstream}'], path)
+    if ok and upstream:
+        # upstream is like "origin/feat/foo" — use it directly in rev-list
+        compare_ref = upstream
+    else:
+        branch = _detect_default_branch(path)
+        compare_ref = f'origin/{branch}'
+
+    # Count commits behind
+    out, ok = _run_git(['rev-list', '--count', f'HEAD..{compare_ref}'], path)
+    behind = int(out) if ok and out.isdigit() else 0
+
+    # Get short SHAs for display
+    current, _ = _run_git(['rev-parse', '--short', 'HEAD'], path)
+    latest, _ = _run_git(['rev-parse', '--short', compare_ref], path)
+
+    return {
+        'name': name,
+        'behind': behind,
+        'current_sha': current,
+        'latest_sha': latest,
+        'branch': compare_ref,
+    }
+
+
+def check_for_updates(force=False):
+    """Return cached update status for webui and agent repos."""
+    global _check_in_progress
+    with _cache_lock:
+        if not force and time.time() - _update_cache['checked_at'] < CACHE_TTL:
+            return dict(_update_cache)
+        if _check_in_progress:
+            return dict(_update_cache)  # another thread is already checking
+        _check_in_progress = True
+
+    try:
+        # Run checks outside the lock (network I/O)
+        webui_info = _check_repo(REPO_ROOT, 'webui')
+        agent_info = _check_repo(_AGENT_DIR, 'agent')
+
+        with _cache_lock:
+            _update_cache['webui'] = webui_info
+            _update_cache['agent'] = agent_info
+            _update_cache['checked_at'] = time.time()
+            return dict(_update_cache)
+    finally:
+        _check_in_progress = False
+
+
+def apply_update(target):
+    """Stash, pull --ff-only, pop for the given target repo."""
+    if not _apply_lock.acquire(blocking=False):
+        return {'ok': False, 'message': 'Update already in progress'}
+    try:
+        return _apply_update_inner(target)
+    finally:
+        _apply_lock.release()
+
+
+def _apply_update_inner(target):
+    """Inner implementation of apply_update, called under _apply_lock."""
+    if target == 'webui':
+        path = REPO_ROOT
+    elif target == 'agent':
+        path = _AGENT_DIR
+    else:
+        return {'ok': False, 'message': f'Unknown target: {target}'}
+
+    if path is None or not (path / '.git').exists():
+        return {'ok': False, 'message': 'Not a git repository'}
+
+    # Use the current branch's upstream for pull, matching the behaviour
+    # of _check_repo. Falls back to default branch if no upstream is set.
+    upstream, ok = _run_git(['rev-parse', '--abbrev-ref', '@{upstream}'], path)
+    if ok and upstream:
+        compare_ref = upstream
+    else:
+        branch = _detect_default_branch(path)
+        compare_ref = f'origin/{branch}'
+
+    # Fetch before attempting pull, so the remote ref is current.
+    _, fetch_ok = _run_git(['fetch', 'origin', '--quiet'], path, timeout=15)
+    if not fetch_ok:
+        return {
+            'ok': False,
+            'message': (
+                'Could not reach the remote repository. '
+                'Check your internet connection and try again.'
+            ),
+        }
+
+    # Check for dirty working tree
+    status_out, _ = _run_git(['status', '--porcelain'], path)
+    stashed = False
+    if status_out:
+        _, ok = _run_git(['stash'], path)
+        if not ok:
+            return {'ok': False, 'message': 'Failed to stash local changes'}
+        stashed = True
+
+    # Pull with ff-only (no merge commits)
+    pull_out, pull_ok = _run_git(['pull', '--ff-only', compare_ref], path, timeout=30)
+    if not pull_ok:
+        if stashed:
+            _run_git(['stash', 'pop'], path)
+
+        # Diagnose the most common failure modes and surface actionable messages.
+        pull_lower = pull_out.lower()
+        if 'not possible to fast-forward' in pull_lower or 'diverged' in pull_lower:
+            return {
+                'ok': False,
+                'message': (
+                    f'The local {target} repo has commits that are not on the remote '
+                    'branch, so a fast-forward update is not possible. '
+                    'Run: git -C ' + str(path) + ' fetch origin && '
+                    'git -C ' + str(path) + ' reset --hard ' + compare_ref
+                ),
+                'diverged': True,
+            }
+        if 'does not track' in pull_lower or 'no tracking information' in pull_lower:
+            return {
+                'ok': False,
+                'message': (
+                    f'The local {target} branch has no upstream tracking branch configured. '
+                    'Run: git -C ' + str(path) + ' branch --set-upstream-to=' + compare_ref
+                ),
+            }
+        # Generic fallback — include the raw git output for debugging.
+        detail = pull_out.strip()[:300] if pull_out.strip() else '(no output from git)'
+        return {'ok': False, 'message': f'Pull failed: {detail}'}
+
+    # Pop stash if we stashed
+    if stashed:
+        _, pop_ok = _run_git(['stash', 'pop'], path)
+        if not pop_ok:
+            return {
+                'ok': False,
+                'message': 'Updated but stash pop failed -- manual merge needed',
+                'stash_conflict': True,
+            }
+
+    # Invalidate cache
+    with _cache_lock:
+        _update_cache['checked_at'] = 0
+
+    return {'ok': True, 'message': f'{target} updated successfully', 'target': target}

api/upload.py

@@ -11,7 +11,7 @@ from api.models import get_session
 from api.workspace import safe_resolve_ws
 
 
-def parse_multipart(rfile, content_type, content_length):
+def parse_multipart(rfile, content_type, content_length) -> tuple:
     import re as _re, email.parser as _ep
     m = _re.search(r'boundary=([^;\s]+)', content_type)
     if not m:

api/workspace.py

@@ -176,7 +176,7 @@ def load_workspaces() -> list:
     return [{'path': _profile_default_workspace(), 'name': 'Home'}]
 
 
-def save_workspaces(workspaces: list):
+def save_workspaces(workspaces: list) -> None:
     ws_file = _workspaces_file()
     ws_file.parent.mkdir(parents=True, exist_ok=True)
     ws_file.write_text(json.dumps(workspaces, ensure_ascii=False, indent=2), encoding='utf-8')
@@ -202,7 +202,7 @@ def get_last_workspace() -> str:
     return _profile_default_workspace()
 
 
-def set_last_workspace(path: str):
+def set_last_workspace(path: str) -> None:
     try:
         lw_file = _last_workspace_file()
         lw_file.parent.mkdir(parents=True, exist_ok=True)
@@ -218,7 +218,7 @@ def safe_resolve_ws(root: Path, requested: str) -> Path:
     return resolved
 
 
-def list_dir(workspace: Path, rel='.'):
+def list_dir(workspace: Path, rel: str='.'):
     target = safe_resolve_ws(workspace, rel)
     if not target.is_dir():
         raise FileNotFoundError(f"Not a directory: {rel}")
@@ -235,7 +235,7 @@ def list_dir(workspace: Path, rel='.'):
     return entries
 
 
-def read_file_content(workspace: Path, rel: str):
+def read_file_content(workspace: Path, rel: str) -> dict:
     target = safe_resolve_ws(workspace, rel)
     if not target.is_file():
         raise FileNotFoundError(f"Not a file: {rel}")

docker-compose.yml

@@ -4,19 +4,27 @@ services:
   hermes-webui:
     build: .
     ports:
+    # select only one; use 127.0.0.1 version to expose to localhost only
       - "127.0.0.1:8787:8787"
+#      - "8787:8787"
     volumes:
-      # Persist session data, settings, and projects across restarts
-      - hermes-data:/data
+      # Within the containe the tool expects to find the .hermes location at /home/hermeswebui/.hermes, so we mount it there; this allows you to manage agent profiles and other features that rely on the .hermes directory from your host machine, make sure to adapt the path if your HERMES_HOME is different
       # Mount hermes home for agent features and profile management
-      - ${HERMES_HOME:-${HOME}/.hermes}:/root/.hermes
+      - ${HERMES_HOME:-${HOME}/.hermes}:/home/hermeswebui/.hermes
+      # Your workspace directory shown on first launch (adapt if yours is different, the container will use the mounted /workspace)
+      - ${HERMES_HOME:-${HOME}}/workspace:/workspace
     environment:
+      # Modify the UID and GID to match your user; docker compose starts as root by default, but the container will drop privileges to the specified UID/GID
+      - WANTED_UID=${UID:-1000}
+      - WANTED_GID=${GID:-1000}
+      # Required: bind address and port
       - HERMES_WEBUI_HOST=0.0.0.0
       - HERMES_WEBUI_PORT=8787
-      - HERMES_WEBUI_STATE_DIR=/data
+      # Where to store sessions, workspaces, and other state (default: ~/.hermes/webui-mvp)
+      - HERMES_WEBUI_STATE_DIR=/home/hermeswebui/.hermes/webui-mvp
+      # Default workspace directory shown on first launch
+#      - HERMES_WEBUI_DEFAULT_WORKSPACE=/workspace
       # Optional: set a password for remote access
       # - HERMES_WEBUI_PASSWORD=your-secret-password
     restart: unless-stopped
 
-volumes:
-  hermes-data:

docker_init.bash

@@ -0,0 +1,228 @@
+#!/bin/bash
+
+set -e
+
+error_exit() {
+  echo -n "!! ERROR: "
+  echo $*
+  echo "!! Exiting script (ID: $$)"
+  exit 1
+}
+
+ok_exit() {
+  echo $*
+  echo "++ Exiting script (ID: $$)"
+  exit 0
+}
+
+## Environment variables loaded when passing environment variables from user to user
+# Ignore list: variables to ignore when loading environment variables from user to user
+export ENV_IGNORELIST="HOME PWD USER SHLVL TERM OLDPWD SHELL _ SUDO_COMMAND HOSTNAME LOGNAME MAIL SUDO_GID SUDO_UID SUDO_USER CHECK_NV_CUDNN_VERSION VIRTUAL_ENV VIRTUAL_ENV_PROMPT ENV_IGNORELIST ENV_OBFUSCATE_PART"
+# Obfuscate part: part of the key to obfuscate when loading environment variables from user to user, ex: HF_TOKEN, ...
+export ENV_OBFUSCATE_PART="TOKEN API KEY"
+
+# Check for ENV_IGNORELIST and ENV_OBFUSCATE_PART
+if [ -z "${ENV_IGNORELIST+x}" ]; then error_exit "ENV_IGNORELIST not set"; fi
+if [ -z "${ENV_OBFUSCATE_PART+x}" ]; then error_exit "ENV_OBFUSCATE_PART not set"; fi
+
+whoami=`whoami`
+script_dir=$(dirname $0)
+script_name=$(basename $0)
+echo ""; echo ""
+echo "======================================"
+echo "=================== Starting script (ID: $$)"
+echo "== Running ${script_name} in ${script_dir} as ${whoami}"
+script_fullname=$0
+echo "  - script_fullname: ${script_fullname}"
+ignore_value="VALUE_TO_IGNORE"
+
+# everyone can read our files by default
+umask 0022
+
+# Write a world-writeable file (preferably inside /tmp -- ie within the container)
+write_worldtmpfile() {
+  tmpfile=$1
+  if [ -z "${tmpfile}" ]; then error_exit "write_worldfile: missing argument"; fi
+  if [ -f $tmpfile ]; then rm -f $tmpfile; fi
+  echo -n $2 > ${tmpfile}
+  chmod 777 ${tmpfile}
+}
+
+itdir=/tmp/hermeswebui_init
+if [ ! -d $itdir ]; then mkdir $itdir; chmod 777 $itdir; fi
+if [ ! -d $itdir ]; then error_exit "Failed to create $itdir"; fi
+
+# Set user and group id
+# logic: if not set and file exists, use file value, else use default. Create file for persistence when the container is re-run
+# reasoning: needed when using docker compose as the file will exist in the stopped container, and changing the value from environment variables or configuration file must be propagated from hermeswebuitoo to hermeswebuitoo transition (those values are the only ones loaded before the environment variables dump file are loaded)
+it=$itdir/hermeswebui_user_uid
+if [ -z "${WANTED_UID+x}" ]; then
+  if [ -f $it ]; then WANTED_UID=$(cat $it); fi
+fi
+WANTED_UID=${WANTED_UID:-1024}
+write_worldtmpfile $it "$WANTED_UID"
+echo "-- WANTED_UID: \"${WANTED_UID}\""
+
+it=$itdir/hermeswebui_user_gid
+if [ -z "${WANTED_GID+x}" ]; then
+  if [ -f $it ]; then WANTED_GID=$(cat $it); fi
+fi
+WANTED_GID=${WANTED_GID:-1024}
+write_worldtmpfile $it "$WANTED_GID"
+echo "-- WANTED_GID: \"${WANTED_GID}\""
+
+echo "== Most Environment variables set"
+
+# Check user id and group id
+new_gid=`id -g`
+new_uid=`id -u`
+echo "== user ($whoami)"
+echo "  uid: $new_uid / WANTED_UID: $WANTED_UID"
+echo "  gid: $new_gid / WANTED_GID: $WANTED_GID"
+
+save_env() {
+  tosave=$1
+  echo "-- Saving environment variables to $tosave"
+  env | sort > "$tosave"
+}
+
+load_env() {
+  tocheck=$1
+  overwrite_if_different=$2
+  ignore_list="${ENV_IGNORELIST}"
+  obfuscate_part="${ENV_OBFUSCATE_PART}"
+  if [ -f "$tocheck" ]; then
+    echo "-- Loading environment variables from $tocheck (overwrite existing: $overwrite_if_different) (ignorelist: $ignore_list) (obfuscate: $obfuscate_part)"
+    while IFS='=' read -r key value; do
+      doit=false
+      # checking if the key is in the ignorelist
+      for i in $ignore_list; do
+        if [[ "A$key" ==  "A$i" ]]; then doit=ignore; break; fi
+      done
+      if [[ "A$doit" == "Aignore" ]]; then continue; fi
+      rvalue=$value
+      # checking if part of the key is in the obfuscate list
+      doobs=false
+      for i in $obfuscate_part; do
+        if [[ "A$key" == *"$i"* ]]; then doobs=obfuscate; break; fi
+      done
+      if [[ "A$doobs" == "Aobfuscate" ]]; then rvalue="**OBFUSCATED**"; fi
+
+      if [ -z "${!key}" ]; then
+        echo "  ++ Setting environment variable $key [$rvalue]"
+        doit=true
+      elif [ "A$overwrite_if_different" == "Atrue" ]; then
+        cvalue="${!key}"
+        if [[ "A${doobs}" == "Aobfuscate" ]]; then cvalue="**OBFUSCATED**"; fi
+        if [[ "A${!key}" != "A${value}" ]]; then
+          echo "  @@ Overwriting environment variable $key [$cvalue] -> [$rvalue]"
+          doit=true
+        else
+          echo "  == Environment variable $key [$rvalue] already set and value is unchanged"
+        fi
+      fi
+      if [[ "A$doit" == "Atrue" ]]; then
+        export "$key=$value"
+      fi
+    done < "$tocheck"
+  fi
+}
+
+# hermeswebuitoo is a specfiic user not existing by default on ubuntu, we can check its whomai
+if [ "A${whoami}" == "Ahermeswebuitoo" ]; then 
+  echo "-- Running as hermeswebuitoo, will switch hermeswebui to the desired UID/GID"
+  # The script is started as hermeswebuitoo -- UID/GID 1025/1025
+
+  # We are altering the UID/GID of the hermeswebui user to the desired ones and restarting as that user
+  # using usermod for the already create hermeswebui user, knowing it is not already in use
+  # per usermod manual: "You must make certain that the named user is not executing any processes when this command is being executed"
+  sudo groupmod -o -g ${WANTED_GID} hermeswebui || error_exit "Failed to set GID of hermeswebui user"
+  sudo usermod -o -u ${WANTED_UID} hermeswebui || error_exit "Failed to set UID of hermeswebui user"
+  sudo chown -R ${WANTED_UID}:${WANTED_GID} /home/hermeswebui || error_exit "Failed to set owner of /home/hermeswebui"
+  save_env /tmp/hermeswebuitoo_env.txt  
+  # restart the script as hermeswebui set with the correct UID/GID this time
+  echo "-- Restarting as hermeswebui user with UID ${WANTED_UID} GID ${WANTED_GID}"
+  sudo su hermeswebui $script_fullname || error_exit "subscript failed"
+  ok_exit "Clean exit"
+fi
+
+# If we are here, the script is started as another user than hermeswebuitoo
+# because the whoami value for the hermeswebui user can be any existing user, we can not check against it
+# instead we check if the UID/GID are the expected ones
+if [ "$WANTED_GID" != "$new_gid" ]; then error_exit "hermeswebui MUST be running as UID ${WANTED_UID} GID ${WANTED_GID}, current UID ${new_uid} GID ${new_gid}"; fi
+if [ "$WANTED_UID" != "$new_uid" ]; then error_exit "hermeswebui MUST be running as UID ${WANTED_UID} GID ${WANTED_GID}, current UID ${new_uid} GID ${new_gid}"; fi
+
+########## 'hermeswebui' specific section below
+
+# We are therefore running as hermeswebui
+echo ""; echo "== Running as hermeswebui"
+
+# Load environment variables one by one if they do not exist from /tmp/hermeswebuitoo_env.txt
+it=/tmp/hermeswebuitoo_env.txt
+if [ -f $it ]; then
+  echo "-- Loading not already set environment variables from $it"
+  load_env $it true
+fi
+
+##
+echo ""; echo "-- Making sure /app is owned by the hermeswebui user to avoid permission issues when running the server "
+sudo mkdir -p /app || error_exit "Failed to create /app directory"
+sudo chown hermeswebui:hermeswebui /app || error_exit "Failed to set owner of /app to hermeswebui user"
+sudo rsync -av --chown=hermeswebui:hermeswebui /apptoo/ /app/ || error_exit "Failed to sync /apptoo to /app with correct ownership"
+it=/app/.testfile; touch $it || error_exit "Failed to verify /app directory"
+rm -f $it || error_exit "Failed to delete test file in /app"
+
+######## Environment variables (consume AFTER the load_env)
+
+echo ""; echo "== Checking required environment variables for hermes-webui"
+
+echo ""; echo "-- HERMES_WEBUI_VERSION: Where to store sessions, workspaces, and other state (default: ~/.hermes/webui-mvp)"
+if [ -z "${HERMES_WEBUI_STATE_DIR+x}" ]; then error_exit "HERMES_WEBUI_STATE_DIR not set"; fi; 
+echo "-- HERMES_WEBUI_STATE_DIR: $HERMES_WEBUI_STATE_DIR"
+if [ ! -d "$HERMES_WEBUI_STATE_DIR" ]; then mkdir -p $HERMES_WEBUI_STATE_DIR || error_exit "Failed to create state directory at $HERMES_WEBUI_STATE_DIR"; fi
+if [ ! -d "$HERMES_WEBUI_STATE_DIR" ]; then error_exit "HERMES_WEBUI_STATE_DIR directory does not exist at $HERMES_WEBUI_STATE_DIR"; fi
+it="$HERMES_WEBUI_STATE_DIR/.testfile"; touch $it || error_exit "Failed to verify state directory at $HERMES_WEBUI_STATE_DIR"
+rm -f $it || error_exit "Failed to delete test file in $HERMES_WEBUI_STATE_DIR"
+
+echo ""; echo "-- HERMES_WEBUI_DEFAULT_WORKSPACE: Default workspace directory shown on first launch"
+if [ -z "${HERMES_WEBUI_DEFAULT_WORKSPACE+x}" ]; then echo "HERMES_WEBUI_DEFAULT_WORKSPACE not set, setting to /workspace"; export HERMES_WEBUI_DEFAULT_WORKSPACE="/workspace"; fi;
+echo "-- HERMES_WEBUI_DEFAULT_WORKSPACE: $HERMES_WEBUI_DEFAULT_WORKSPACE"
+if [ ! -d "$HERMES_WEBUI_DEFAULT_WORKSPACE" ]; then mkdir -p $HERMES_WEBUI_DEFAULT_WORKSPACE || error_exit "Failed to create default workspace at $HERMES_WEBUI_DEFAULT_WORKSPACE"; fi
+if [ ! -d "$HERMES_WEBUI_DEFAULT_WORKSPACE" ]; then error_exit "HERMES_WEBUI_DEFAULT_WORKSPACE directory does not exist at $HERMES_WEBUI_DEFAULT_WORKSPACE"; fi
+it="$HERMES_WEBUI_DEFAULT_WORKSPACE/.testfile"; touch $it || error_exit "Failed to verify default workspace at $HERMES_WEBUI_DEFAULT_WORKSPACE"
+rm -f $it || error_exit "Failed to delete test file in $HERMES_WEBUI_DEFAULT_WORKSPACE"
+
+echo ""; echo "==================="
+echo ""; echo "== Installing uv and creating a new virtual environment for hermes-webui"
+
+curl -LsSf https://astral.sh/uv/install.sh | sh
+export PATH="/home/hermeswebui/.local/bin/:$PATH"
+export UV_PROJECT_ENVIRONMENT=venv
+
+export UV_CACHE_DIR=/uv_cache
+sudo mkdir -p ${UV_CACHE_DIR} || error_exit "Failed to create /uv_cache directory"
+sudo chown hermeswebui:hermeswebui ${UV_CACHE_DIR} || error_exit "Failed to set owner of ${UV_CACHE_DIR} to hermeswebui user"
+
+cd /app
+uv venv venv
+export VIRTUAL_ENV=/app/venv
+test -d /app/venv
+test -f /app/venv/bin/activate
+
+echo "";echo "== Activating hermes webui's virtual environment"
+source /app/venv/bin/activate || error_exit "Failed to activate hermeswebui virtual environment"
+test -x /app/venv/bin/python3
+
+echo ""; echo "== Installing hermes-webui dependencies"
+uv pip install -r requirements.txt --trusted-host pypi.org --trusted-host files.pythonhosted.org
+uv pip install -U pip setuptools --trusted-host pypi.org --trusted-host files.pythonhosted.org
+test -x /app/venv/bin/pip
+
+echo ""; echo "== Adding hermes-agent's pyproject.toml base dependencies to the virtual environment"
+uv pip install /home/hermeswebui/.hermes/hermes-agent --trusted-host pypi.org --trusted-host files.pythonhosted.org || error_exit "Failed to install hermes-agent's requirements"
+
+echo ""; echo "== Running hermes-webui"
+cd /app; python server.py || error_exit "hermes-webui failed or exited with an error"
+
+# we should never be here because the server should be running indefinitely, but if we are, we exit safely
+ok_exit "Clean exit"

server.py

@@ -12,13 +12,15 @@ from api.auth import check_auth
 from api.config import HOST, PORT, STATE_DIR, SESSION_DIR, DEFAULT_WORKSPACE
 from api.helpers import j
 from api.routes import handle_get, handle_post
+from api.startup import auto_install_agent_deps, fix_credential_permissions
 
 
 class Handler(BaseHTTPRequestHandler):
+    timeout = 30  # seconds — kills idle/incomplete connections to prevent thread exhaustion
     server_version = 'HermesWebUI/0.2'
     def log_message(self, fmt, *args): pass  # suppress default Apache-style log
 
-    def log_request(self, code='-', size='-'):
+    def log_request(self, code: str='-', size: str='-') -> None:
         """Structured JSON logs for each request."""
         import json as _json
         duration_ms = round((time.time() - getattr(self, '_req_t0', time.time())) * 1000, 1)
@@ -31,7 +33,7 @@ class Handler(BaseHTTPRequestHandler):
         })
         print(f'[webui] {record}', flush=True)
 
-    def do_GET(self):
+    def do_GET(self) -> None:
         self._req_t0 = time.time()
         try:
             parsed = urlparse(self.path)
@@ -43,7 +45,7 @@ class Handler(BaseHTTPRequestHandler):
             print(f'[webui] ERROR {self.command} {self.path}\n' + traceback.format_exc(), flush=True)
             return j(self, {'error': 'Internal server error'}, status=500)
 
-    def do_POST(self):
+    def do_POST(self) -> None:
         self._req_t0 = time.time()
         try:
             parsed = urlparse(self.path)
@@ -56,28 +58,97 @@ class Handler(BaseHTTPRequestHandler):
             return j(self, {'error': 'Internal server error'}, status=500)
 
 
-def main():
+def main() -> None:
     from api.config import print_startup_config, verify_hermes_imports, _HERMES_FOUND
 
     print_startup_config()
 
+    # Fix sensitive file permissions before doing anything else
+    fix_credential_permissions()
+
+    within_container = False
+    # Check for the "/.within_container" file to determine if we're running inside a container; this file is created in the Dockerfile
+    try:
+        with open('/.within_container', 'r') as f:
+            within_container = True
+    except FileNotFoundError:
+        pass
+
+    if within_container:
+        print('[ok] Running within container.', flush=True)
+
+    # Security: warn if binding non-loopback without authentication
+    from api.auth import is_auth_enabled
+    if HOST not in ('127.0.0.1', '::1', 'localhost') and not is_auth_enabled():
+        print(f'[!!] WARNING: Binding to {HOST} with NO PASSWORD SET.', flush=True)
+        print(f'     Anyone on the network can access your filesystem and agent.', flush=True)
+        print(f'     Set a password via Settings or HERMES_WEBUI_PASSWORD env var.', flush=True)
+        print(f'     To suppress: bind to 127.0.0.1 or set a password.', flush=True)
+        if within_container:
+            print(f'     Note: You are running within a container, must bind to 0.0.0.0 to publish the port.', flush=True)
+    elif not is_auth_enabled():
+        print(f'  [tip] No password set. Any process on this machine can read sessions', flush=True)
+        print(f'        and memory via the local API. Set HERMES_WEBUI_PASSWORD to', flush=True)
+        print(f'        enable authentication.', flush=True)
+
     ok, missing, errors = verify_hermes_imports()
     if not ok and _HERMES_FOUND:
         print(f'[!!] Warning: Hermes agent found but missing modules: {missing}', flush=True)
         for mod, err in errors.items():
             print(f'     {mod}: {err}', flush=True)
-        print('     Agent features may not work correctly.', flush=True)
+        print('     Attempting to install missing dependencies from agent requirements.txt...', flush=True)
+        auto_install_agent_deps()
+        ok, missing, errors = verify_hermes_imports()
+        if not ok:
+            print(f'[!!] Still missing after install attempt: {missing}', flush=True)
+            for mod, err in errors.items():
+                print(f'     {mod}: {err}', flush=True)
+            print('     Agent features may not work correctly.', flush=True)
+        else:
+            print('[ok] Agent dependencies installed successfully.', flush=True)
 
     STATE_DIR.mkdir(parents=True, exist_ok=True)
     SESSION_DIR.mkdir(parents=True, exist_ok=True)
     DEFAULT_WORKSPACE.mkdir(parents=True, exist_ok=True)
+
+    # Start the gateway session watcher for real-time SSE updates
+    try:
+        from api.gateway_watcher import start_watcher
+        start_watcher()
+    except Exception as e:
+        print(f'[!!] WARNING: Gateway watcher failed to start: {e}', flush=True)
+
     httpd = ThreadingHTTPServer((HOST, PORT), Handler)
-    print(f'  Hermes Web UI listening on http://{HOST}:{PORT}', flush=True)
-    if HOST == '127.0.0.1':
+
+    # ── TLS/HTTPS setup (optional) ─────────────────────────────────────────
+    from api.config import TLS_ENABLED, TLS_CERT, TLS_KEY
+    scheme = 'https' if TLS_ENABLED else 'http'
+    if TLS_ENABLED:
+        try:
+            import ssl
+            ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+            ctx.minimum_version = ssl.TLSVersion.TLSv1_2
+            ctx.load_cert_chain(TLS_CERT, TLS_KEY)
+            httpd.socket = ctx.wrap_socket(httpd.socket, server_side=True)
+            print(f'  TLS enabled: cert={TLS_CERT}, key={TLS_KEY}', flush=True)
+        except Exception as e:
+            print(f'[!!] WARNING: TLS setup failed ({e}), falling back to HTTP', flush=True)
+            scheme = 'http'
+
+    print(f'  Hermes Web UI listening on {scheme}://{HOST}:{PORT}', flush=True)
+    if HOST == '127.0.0.1' or within_container:
         print(f'  Remote access: ssh -N -L {PORT}:127.0.0.1:{PORT} <user>@<your-server>', flush=True)
-    print(f'  Then open:     http://localhost:{PORT}', flush=True)
+    print(f'  Then open:     {scheme}://localhost:{PORT}', flush=True)
     print('', flush=True)
-    httpd.serve_forever()
+    try:
+        httpd.serve_forever()
+    finally:
+        # Stop the gateway watcher on shutdown
+        try:
+            from api.gateway_watcher import stop_watcher
+            stop_watcher()
+        except Exception:
+            pass
 
 if __name__ == '__main__':
     main()

static/boot.js

@@ -4,8 +4,8 @@ async function cancelStream(){
   try{
     await fetch(new URL(`/api/chat/cancel?stream_id=${encodeURIComponent(streamId)}`,location.origin).href,{credentials:'include'});
     const btn=$('btnCancel');if(btn)btn.style.display='none';
-    setStatus('Cancelling…');
-  }catch(e){setStatus('Cancel failed: '+e.message);}
+    // Don't set status here - let the SSE cancel event handle UI cleanup
+  }catch(e){setStatus(t('cancel_failed')+e.message);}
 }
 
 // ── Mobile navigation ──────────────────────────────────────────────────────
@@ -21,12 +21,37 @@ function closeMobileSidebar(){
   const sidebar=document.querySelector('.sidebar');
   const overlay=$('mobileOverlay');
   if(sidebar)sidebar.classList.remove('mobile-open');
-  if(overlay)overlay.classList.remove('visible');
+  // only hide overlay if right panel is also closed
+  const panel=document.querySelector('.rightpanel');
+  if(!panel||!panel.classList.contains('mobile-open')){
+    if(overlay)overlay.classList.remove('visible');
+  }
 }
 function toggleMobileFiles(){
   const panel=document.querySelector('.rightpanel');
+  const overlay=$('mobileOverlay');
   if(!panel)return;
-  panel.classList.toggle('mobile-open');
+  if(panel.classList.contains('mobile-open')){
+    panel.classList.remove('mobile-open');
+    // only hide overlay if left sidebar is also closed
+    const sidebar=document.querySelector('.sidebar');
+    if(!sidebar||!sidebar.classList.contains('mobile-open')){
+      if(overlay)overlay.classList.remove('visible');
+    }
+  } else {
+    panel.classList.add('mobile-open');
+    if(overlay)overlay.classList.add('visible');
+  }
+}
+function closeMobileFiles(){
+  const panel=document.querySelector('.rightpanel');
+  const overlay=$('mobileOverlay');
+  if(panel)panel.classList.remove('mobile-open');
+  // only hide overlay if left sidebar is also closed
+  const sidebar=document.querySelector('.sidebar');
+  if(!sidebar||!sidebar.classList.contains('mobile-open')){
+    if(overlay)overlay.classList.remove('visible');
+  }
 }
 function mobileSwitchPanel(name){
   // Switch the panel content view
@@ -66,7 +91,7 @@ $('btnAttach').onclick=()=>$('fileInput').click();
   const recognition=new SpeechRecognition();
   recognition.continuous=false;
   recognition.interimResults=true;
-  recognition.lang='en-US';
+  recognition.lang=(typeof _locale!=='undefined'&&_locale._speech)||'en-US';
 
   let _finalText='';
   let _prefix='';
@@ -108,11 +133,11 @@ $('btnAttach').onclick=()=>$('fileInput').click();
   recognition.onerror=(event)=>{
     _setRecording(false);
     const msgs={
-      'not-allowed':'Microphone access denied. Check browser permissions.',
-      'no-speech':'No speech detected. Try again.',
-      'network':'Speech recognition unavailable.',
+      'not-allowed':t('mic_denied'),
+      'no-speech':t('mic_no_speech'),
+      'network':t('mic_network'),
     };
-    showToast(msgs[event.error]||'Voice input error: '+event.error);
+    showToast(msgs[event.error]||t('mic_error')+event.error);
   };
 
   function _stopMic(){
@@ -160,10 +185,10 @@ $('importFileInput').onchange=async(e)=>{
     if(res.ok&&res.session){
       await loadSession(res.session.session_id);
       await renderSessionList();
-      showToast('Session imported');
+      showToast(t('session_imported'));
     }
   }catch(err){
-    showToast('Import failed: '+(err.message||'Invalid JSON'));
+    showToast(t('import_failed')+(err.message||t('import_invalid_json')));
   }
 };
 // btnRefreshFiles is now panel-icon-btn in header (see HTML)
@@ -219,6 +244,17 @@ $('msg').addEventListener('keydown',e=>{
 });
 // B14: Cmd/Ctrl+K creates a new chat from anywhere
 document.addEventListener('keydown',async e=>{
+  // Enter on approval card = Allow once (when a button inside the card is focused or
+  // card is visible and focus is not on an input/textarea/select)
+  if(e.key==='Enter'&&!e.metaKey&&!e.ctrlKey&&!e.shiftKey){
+    const card=$('approvalCard');
+    const tag=(document.activeElement||{}).tagName||'';
+    if(card&&card.classList.contains('visible')&&tag!=='TEXTAREA'&&tag!=='INPUT'&&tag!=='SELECT'){
+      e.preventDefault();
+      if(typeof respondApproval==='function') respondApproval('once');
+      return;
+    }
+  }
   if((e.metaKey||e.ctrlKey)&&e.key==='k'){
     e.preventDefault();
     if(!S.busy){await newSession();await renderSessionList();$('msg').focus();}
@@ -251,7 +287,7 @@ $('msg').addEventListener('paste',e=>{
     return new File([blob],`screenshot-${Date.now()}.${ext}`,{type:i.type});
   });
   addFiles(files);
-  setStatus(`Image pasted: ${files.map(f=>f.name).join(', ')}`);
+  setStatus(t('image_pasted')+files.map(f=>f.name).join(', '));
 });
 document.querySelectorAll('.suggestion').forEach(btn=>{
   btn.onclick=()=>{$('msg').value=btn.dataset.msg;send();};
@@ -306,9 +342,30 @@ document.querySelectorAll('.suggestion').forEach(btn=>{
   };
 })();
 
+function applyBotName(){
+  const name=window._botName||'Hermes';
+  document.title=name;
+  const sidebarH1=document.querySelector('.sidebar-header h1');
+  if(sidebarH1) sidebarH1.textContent=name;
+  const logo=document.querySelector('.sidebar-header .logo');
+  if(logo) logo.textContent=name.charAt(0).toUpperCase();
+  const topbarTitle=$('topbarTitle');
+  if(topbarTitle && (!S.session)) topbarTitle.textContent=name;
+  const msg=$('msg');
+  if(msg) msg.placeholder='Message '+name+'\u2026';
+}
+
 (async()=>{
   // Load send key preference
-  try{const s=await api('/api/settings');window._sendKey=s.send_key||'enter';window._showTokenUsage=!!s.show_token_usage;window._showCliSessions=!!s.show_cli_sessions;const _theme=s.theme||'dark';document.documentElement.dataset.theme=_theme;localStorage.setItem('hermes-theme',_theme);}catch(e){window._sendKey='enter';window._showTokenUsage=false;window._showCliSessions=false;}
+  let _bootSettings={};
+  try{const s=await api('/api/settings');_bootSettings=s;window._sendKey=s.send_key||'enter';window._showTokenUsage=!!s.show_token_usage;window._showCliSessions=!!s.show_cli_sessions;window._soundEnabled=!!s.sound_enabled;window._notificationsEnabled=!!s.notifications_enabled;window._botName=s.bot_name||'Hermes';const _theme=s.theme||'dark';document.documentElement.dataset.theme=_theme;localStorage.setItem('hermes-theme',_theme);if(s.language&&typeof setLocale==='function'){setLocale(s.language);if(typeof applyLocaleToDOM==='function')applyLocaleToDOM();}applyBotName();}catch(e){window._sendKey='enter';window._showTokenUsage=false;window._showCliSessions=false;window._soundEnabled=false;window._notificationsEnabled=false;window._botName='Hermes';_bootSettings={check_for_updates:false};}
+  // Non-blocking update check (fire-and-forget, once per tab session)
+  // ?test_updates=1 in URL forces banner display for testing (bypasses sessionStorage guards)
+  const _testUpdates=new URLSearchParams(location.search).get('test_updates')==='1';
+  if(_testUpdates||(_bootSettings.check_for_updates!==false&&!sessionStorage.getItem('hermes-update-checked')&&!sessionStorage.getItem('hermes-update-dismissed'))){
+    const _checkUrl='/api/updates/check'+(_testUpdates?'?simulate=1':'');
+    api(_checkUrl).then(d=>{if(!_testUpdates)sessionStorage.setItem('hermes-update-checked','1');if((d.webui&&d.webui.behind>0)||(d.agent&&d.agent.behind>0))_showUpdateBanner(d);}).catch(()=>{});
+  }
   // Fetch active profile
   try{const p=await api('/api/profile/active');S.activeProfile=p.name||'default';}catch(e){S.activeProfile='default';}
   // Update profile chip label immediately
@@ -328,11 +385,13 @@ document.querySelectorAll('.suggestion').forEach(btn=>{
   _initResizePanels();
   const saved=localStorage.getItem('hermes-webui-session');
   if(saved){
-    try{await loadSession(saved);await renderSessionList();await checkInflightOnBoot(saved);return;}
+    try{await loadSession(saved);await renderSessionList();if(typeof startGatewaySSE==='function')startGatewaySSE();await checkInflightOnBoot(saved);return;}
     catch(e){localStorage.removeItem('hermes-webui-session');}
   }
   // no saved session - show empty state, wait for user to hit +
   $('emptyState').style.display='';
   await renderSessionList();
+  // Start real-time gateway session sync if setting is enabled
+  if(typeof startGatewaySSE==='function') startGatewaySSE();
 })();
 

static/commands.js

@@ -3,14 +3,16 @@
 // (no round-trip to the agent) and shows feedback via toast or local message.
 
 const COMMANDS=[
-  {name:'help',      desc:'List available commands',             fn:cmdHelp},
-  {name:'clear',     desc:'Clear conversation messages',         fn:cmdClear},
-  {name:'compact',   desc:'Compress conversation context',       fn:cmdCompact},
-  {name:'model',     desc:'Switch model (e.g. /model gpt-4o)',  fn:cmdModel,     arg:'model_name'},
-  {name:'workspace', desc:'Switch workspace by name',            fn:cmdWorkspace, arg:'name'},
-  {name:'new',       desc:'Start a new chat session',            fn:cmdNew},
-  {name:'usage',     desc:'Toggle token usage display on/off',   fn:cmdUsage},
-  {name:'theme',     desc:'Switch theme (dark/light/slate/solarized/monokai/nord)', fn:cmdTheme, arg:'name'},
+  {name:'help',      desc:t('cmd_help'),             fn:cmdHelp},
+  {name:'clear',     desc:t('cmd_clear'),         fn:cmdClear},
+  {name:'compact',   desc:t('cmd_compact'),       fn:cmdCompact},
+  {name:'model',     desc:t('cmd_model'),  fn:cmdModel,     arg:'model_name'},
+  {name:'workspace', desc:t('cmd_workspace'),            fn:cmdWorkspace, arg:'name'},
+  {name:'new',       desc:t('cmd_new'),            fn:cmdNew},
+  {name:'usage',     desc:t('cmd_usage'),   fn:cmdUsage},
+  {name:'theme',     desc:t('cmd_theme'), fn:cmdTheme, arg:'name'},
+  {name:'personality', desc:t('cmd_personality'), fn:cmdPersonality, arg:'name'},
+  {name:'skills', desc:t('cmd_skills'), fn:cmdSkills, arg:'query'},
 ];
 
 function parseCommand(text){
@@ -42,10 +44,10 @@ function cmdHelp(){
     const usage=c.arg?` <${c.arg}>`:'';
     return `  /${c.name}${usage} — ${c.desc}`;
   });
-  const msg={role:'assistant',content:'**Available commands:**\n'+lines.join('\n')};
+  const msg={role:'assistant',content:t('available_commands')+'\n'+lines.join('\n')};
   S.messages.push(msg);
   renderMessages();
-  showToast('Type / to see commands');
+  showToast(t('type_slash'));
 }
 
 function cmdClear(){
@@ -54,11 +56,11 @@ function cmdClear(){
   clearLiveToolCards();
   renderMessages();
   $('emptyState').style.display='';
-  showToast('Conversation cleared');
+  showToast(t('conversation_cleared'));
 }
 
 async function cmdModel(args){
-  if(!args){showToast('Usage: /model <name>');return;}
+  if(!args){showToast(t('model_usage'));return;}
   const sel=$('modelSelect');
   if(!sel)return;
   const q=args.toLowerCase();
@@ -69,36 +71,36 @@ async function cmdModel(args){
       match=opt.value;break;
     }
   }
-  if(!match){showToast(`No model matching "${args}"`);return;}
+  if(!match){showToast(t('no_model_match')+`"${args}"`);return;}
   sel.value=match;
   await sel.onchange();
-  showToast(`Switched to ${match}`);
+  showToast(t('switched_to')+match);
 }
 
 async function cmdWorkspace(args){
-  if(!args){showToast('Usage: /workspace <name>');return;}
+  if(!args){showToast(t('workspace_usage'));return;}
   try{
     const data=await api('/api/workspaces');
     const q=args.toLowerCase();
     const ws=(data.workspaces||[]).find(w=>
       (w.name||'').toLowerCase().includes(q)||w.path.toLowerCase().includes(q)
     );
-    if(!ws){showToast(`No workspace matching "${args}"`);return;}
+    if(!ws){showToast(t('no_workspace_match')+`"${args}"`);return;}
     if(!S.session)return;
     await api('/api/session/update',{method:'POST',body:JSON.stringify({
       session_id:S.session.session_id,workspace:ws.path,model:S.session.model
     })});
     S.session.workspace=ws.path;
     syncTopbar();await loadDir('.');
-    showToast(`Switched to workspace: ${ws.name||ws.path}`);
-  }catch(e){showToast('Workspace switch failed: '+e.message);}
+    showToast(t('switched_workspace')+(ws.name||ws.path));
+  }catch(e){showToast(t('workspace_switch_failed')+e.message);}
 }
 
 async function cmdNew(){
   await newSession();
   await renderSessionList();
   $('msg').focus();
-  showToast('New session created');
+  showToast(t('new_session'));
 }
 
 function cmdCompact(){
@@ -107,7 +109,7 @@ function cmdCompact(){
   // We send a user message so it appears in the conversation.
   $('msg').value='Please compress and summarize the conversation context to free up space.';
   send();
-  showToast('Requesting context compression...');
+  showToast(t('compressing'));
 }
 
 async function cmdUsage(){
@@ -120,23 +122,96 @@ async function cmdUsage(){
   const cb=$('settingsShowTokenUsage');
   if(cb) cb.checked=next;
   renderMessages();
-  showToast('Token usage '+(next?'on':'off'));
+  showToast(next?t('token_usage_on'):t('token_usage_off'));
 }
 
 async function cmdTheme(args){
-  const themes=['dark','light','slate','solarized','monokai','nord'];
+  const themes=['dark','light','slate','solarized','monokai','nord','oled'];
   if(!args||!themes.includes(args.toLowerCase())){
-    showToast('Usage: /theme '+themes.join('|'));
+    showToast(t('theme_usage')+themes.join('|'));
     return;
   }
-  const t=args.toLowerCase();
-  document.documentElement.dataset.theme=t;
-  localStorage.setItem('hermes-theme',t);
-  try{await api('/api/settings',{method:'POST',body:JSON.stringify({theme:t})});}catch(e){}
+  const themeName=args.toLowerCase();
+  document.documentElement.dataset.theme=themeName;
+  localStorage.setItem('hermes-theme',themeName);
+  try{await api('/api/settings',{method:'POST',body:JSON.stringify({theme:themeName})});}catch(e){}
   // Update settings dropdown if panel is open
   const sel=$('settingsTheme');
-  if(sel)sel.value=t;
-  showToast('Theme: '+t);
+  if(sel)sel.value=themeName;
+  showToast(t('theme_set')+themeName);
+}
+
+async function cmdSkills(args){
+  try{
+    const data = await api('/api/skills');
+    let skills = data.skills || [];
+    if(args){
+      const q = args.toLowerCase();
+      skills = skills.filter(s =>
+        (s.name||'').toLowerCase().includes(q) ||
+        (s.description||'').toLowerCase().includes(q) ||
+        (s.category||'').toLowerCase().includes(q)
+      );
+    }
+    if(!skills.length){
+      const msg = {role:'assistant', content: args ? `No skills matching "${args}".` : 'No skills found.'};
+      S.messages.push(msg); renderMessages(); return;
+    }
+    // Group by category
+    const byCategory = {};
+    skills.forEach(s => {
+      const cat = s.category || 'General';
+      if(!byCategory[cat]) byCategory[cat] = [];
+      byCategory[cat].push(s);
+    });
+    const lines = [];
+    for(const [cat, items] of Object.entries(byCategory).sort()){
+      lines.push(`**${cat}**`);
+      items.forEach(s => {
+        const desc = s.description ? ` — ${s.description.slice(0,80)}${s.description.length>80?'...':''}` : '';
+        lines.push(`  \`${s.name}\`${desc}`);
+      });
+      lines.push('');
+    }
+    const header = args
+      ? `Skills matching "${args}" (${skills.length}):\n\n`
+      : `Available skills (${skills.length}):\n\n`;
+    S.messages.push({role:'assistant', content: header + lines.join('\n')});
+    renderMessages();
+    showToast(t('type_slash'));
+  }catch(e){
+    showToast('Failed to load skills: '+e.message);
+  }
+}
+
+async function cmdPersonality(args){
+  if(!S.session){showToast(t('no_active_session'));return;}
+  if(!args){
+    // List available personalities
+    try{
+      const data=await api('/api/personalities');
+      if(!data.personalities||!data.personalities.length){
+        showToast(t('no_personalities'));
+        return;
+      }
+      const list=data.personalities.map(p=>`  **${p.name}**${p.description?' — '+p.description:''}`).join('\n');
+      S.messages.push({role:'assistant',content:t('available_personalities')+'\n\n'+list+t('personality_switch_hint')});
+      renderMessages();
+    }catch(e){showToast(t('personalities_load_failed'));}
+    return;
+  }
+  const name=args.trim();
+  if(name.toLowerCase()==='none'||name.toLowerCase()==='default'||name.toLowerCase()==='clear'){
+    try{
+      await api('/api/personality/set',{method:'POST',body:JSON.stringify({session_id:S.session.session_id,name:''})});
+      showToast(t('personality_cleared'));
+    }catch(e){showToast(t('failed_colon')+e.message);}
+    return;
+  }
+  try{
+    const res=await api('/api/personality/set',{method:'POST',body:JSON.stringify({session_id:S.session.session_id,name})});
+    showToast(t('personality_set')+name);
+  }catch(e){showToast(t('failed_colon')+e.message);}
 }
 
 // ── Autocomplete dropdown ───────────────────────────────────────────────────

static/icons.js

@@ -0,0 +1,69 @@
+// ── Lucide icon library (self-hosted SVG paths, no CDN dependency) ──────────
+// All icons are 24×24 viewBox, stroke-based, currentColor.
+// Usage: li('folder')  →  returns a ready-to-embed SVG string
+// The returned SVG uses display:inline-block + vertical-align so it sits
+// neatly beside text in both HTML templates and innerHTML assignments.
+
+const LI_PATHS = {
+  // Navigation tabs
+  'message-square':  '<path d="M21 15a2 2 0 0 1-2 2H7l-4 4V5a2 2 0 0 1 2-2h14a2 2 0 0 1 2 2z"/>',
+  'calendar':        '<rect x="3" y="4" width="18" height="18" rx="2"/><line x1="16" y1="2" x2="16" y2="6"/><line x1="8" y1="2" x2="8" y2="6"/><line x1="3" y1="10" x2="21" y2="10"/>',
+  'layers':          '<path d="M12 2L2 7l10 5 10-5-10-5z"/><path d="M2 17l10 5 10-5"/><path d="M2 12l10 5 10-5"/>',
+  'lightbulb':       '<path d="M12 2a7 7 0 0 1 7 7c0 2.5-1.3 4.7-3.2 6H8.2C6.3 13.7 5 11.5 5 9a7 7 0 0 1 7-7z"/><line x1="9" y1="17" x2="15" y2="17"/><line x1="10" y1="20" x2="14" y2="20"/>',
+  'folder':          '<path d="M22 19a2 2 0 0 1-2 2H4a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h5l2 3h9a2 2 0 0 1 2 2z"/>',
+  'list-todo':       '<rect x="3" y="5" width="6" height="6" rx="1"/><path d="m3 17 2 2 4-4"/><path d="M13 6h8"/><path d="M13 12h8"/><path d="M13 18h8"/>',
+  // Editing / actions
+  'pencil':          '<path d="M17 3a2.85 2.83 0 1 1 4 4L7.5 20.5 2 22l1.5-5.5Z"/>',
+  'chevron-down':    '<polyline points="6 9 12 15 18 9"/>',
+  'download':        '<path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="7 10 12 15 17 10"/><line x1="12" y1="15" x2="12" y2="3"/>',
+  'upload':          '<path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="17 8 12 3 7 8"/><line x1="12" y1="3" x2="12" y2="15"/>',
+  'braces':          '<path d="M8 3H7a2 2 0 0 0-2 2v5a2 2 0 0 1-2 2 2 2 0 0 1 2 2v5c0 1.1.9 2 2 2h1"/><path d="M16 3h1a2 2 0 0 1 2 2v5a2 2 0 0 0 2 2 2 2 0 0 0-2 2v5a2 2 0 0 1-2 2h-1"/>',
+  'trash-2':         '<path d="M3 6h18"/><path d="M19 6v14c0 1-1 2-2 2H7c-1 0-2-1-2-2V6"/><path d="M8 6V4c0-1 1-2 2-2h4c1 0 2 1 2 2v2"/><line x1="10" y1="11" x2="10" y2="17"/><line x1="14" y1="11" x2="14" y2="17"/>',
+  'settings':        '<circle cx="12" cy="12" r="3"/><path d="M19.4 15a1.65 1.65 0 0 0 .33 1.82l.06.06a2 2 0 0 1-2.83 2.83l-.06-.06a1.65 1.65 0 0 0-1.82-.33 1.65 1.65 0 0 0-1 1.51V21a2 2 0 0 1-4 0v-.09A1.65 1.65 0 0 0 9 19.4a1.65 1.65 0 0 0-1.82.33l-.06.06a2 2 0 0 1-2.83-2.83l.06-.06A1.65 1.65 0 0 0 4.68 15a1.65 1.65 0 0 0-1.51-1H3a2 2 0 0 1 0-4h.09A1.65 1.65 0 0 0 4.6 9a1.65 1.65 0 0 0-.33-1.82l-.06-.06a2 2 0 0 1 2.83-2.83l.06.06A1.65 1.65 0 0 0 9 4.68a1.65 1.65 0 0 0 1-1.51V3a2 2 0 0 1 4 0v.09a1.65 1.65 0 0 0 1 1.51 1.65 1.65 0 0 0 1.82-.33l.06-.06a2 2 0 0 1 2.83 2.83l-.06.06A1.65 1.65 0 0 0 19.4 9a1.65 1.65 0 0 0 1.51 1H21a2 2 0 0 1 0 4h-.09a1.65 1.65 0 0 0-1.51 1z"/>',
+  'alert-triangle':  '<path d="M10.29 3.86L1.82 18a2 2 0 0 0 1.71 3h16.94a2 2 0 0 0 1.71-3L13.71 3.86a2 2 0 0 0-3.42 0z"/><line x1="12" y1="9" x2="12" y2="13"/><line x1="12" y1="17" x2="12.01" y2="17"/>',
+  'refresh-cw':      '<polyline points="23 4 23 10 17 10"/><polyline points="1 20 1 14 7 14"/><path d="M3.51 9a9 9 0 0 1 14.85-3.36L23 10M1 14l4.64 4.36A9 9 0 0 0 20.49 15"/>',
+  'check':           '<polyline points="20 6 9 17 4 12"/>',
+  'lock':            '<rect x="3" y="11" width="18" height="11" rx="2" ry="2"/><path d="M7 11V7a5 5 0 0 1 10 0v4"/>',
+  'star':            '<polygon points="12 2 15.09 8.26 22 9.27 17 14.14 18.18 21.02 12 17.77 5.82 21.02 7 14.14 2 9.27 8.91 8.26 12 2"/>',
+  'x':               '<line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/>',
+  'square':          '<rect x="3" y="3" width="18" height="18" rx="2" ry="2"/>',
+  'plus':            '<line x1="12" y1="5" x2="12" y2="19"/><line x1="5" y1="12" x2="19" y2="12"/>',
+  'arrow-up':        '<line x1="12" y1="19" x2="12" y2="5"/><polyline points="5 12 12 5 19 12"/>',
+  'loader':          '<line x1="12" y1="2" x2="12" y2="6"/><line x1="12" y1="18" x2="12" y2="22"/><line x1="4.93" y1="4.93" x2="7.76" y2="7.76"/><line x1="16.24" y1="16.24" x2="19.07" y2="19.07"/><line x1="2" y1="12" x2="6" y2="12"/><line x1="18" y1="12" x2="22" y2="12"/><line x1="4.93" y1="19.07" x2="7.76" y2="16.24"/><line x1="16.24" y1="7.76" x2="19.07" y2="4.93"/>',
+  // Tool icons
+  'terminal':        '<polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/>',
+  'file-text':       '<path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z"/><polyline points="14 2 14 8 20 8"/><line x1="16" y1="13" x2="8" y2="13"/><line x1="16" y1="17" x2="8" y2="17"/><polyline points="10 9 9 9 8 9"/>',
+  'file-pen':        '<path d="M12 22h6a2 2 0 0 0 2-2V7l-5-5H6a2 2 0 0 0-2 2v10"/><path d="M14 2v4a2 2 0 0 0 2 2h4"/><path d="M10.4 19.4 14 16l-4-1 .4 4.4z"/><path d="m14 16 1.5-1.5a2.12 2.12 0 0 1 3 3L17 19"/>',
+  'search':          '<circle cx="11" cy="11" r="8"/><line x1="21" y1="21" x2="16.65" y2="16.65"/>',
+  'globe':           '<circle cx="12" cy="12" r="10"/><line x1="2" y1="12" x2="22" y2="12"/><path d="M12 2a15.3 15.3 0 0 1 4 10 15.3 15.3 0 0 1-4 10 15.3 15.3 0 0 1-4-10 15.3 15.3 0 0 1 4-10z"/>',
+  'play':            '<polygon points="5 3 19 12 5 21 5 3"/>',
+  'wrench':          '<path d="M14.7 6.3a1 1 0 0 0 0 1.4l1.6 1.6a1 1 0 0 0 1.4 0l3.77-3.77a6 6 0 0 1-7.94 7.94l-6.91 6.91a2.12 2.12 0 0 1-3-3l6.91-6.91a6 6 0 0 1 7.94-7.94l-3.76 3.76z"/>',
+  'brain':           '<path d="M9.5 2A2.5 2.5 0 0 1 12 4.5v15a2.5 2.5 0 0 1-4.96-.44 2.5 2.5 0 0 1-2.96-3.08 3 3 0 0 1-.34-5.58 2.5 2.5 0 0 1 1.32-4.24 2.5 2.5 0 0 1 1.98-3A2.5 2.5 0 0 1 9.5 2z"/><path d="M14.5 2A2.5 2.5 0 0 0 12 4.5v15a2.5 2.5 0 0 0 4.96-.44 2.5 2.5 0 0 0 2.96-3.08 3 3 0 0 0 .34-5.58 2.5 2.5 0 0 0-1.32-4.24 2.5 2.5 0 0 0-1.98-3A2.5 2.5 0 0 0 14.5 2z"/>',
+  'book-open':       '<path d="M2 3h6a4 4 0 0 1 4 4v14a3 3 0 0 0-3-3H2z"/><path d="M22 3h-6a4 4 0 0 0-4 4v14a3 3 0 0 1 3-3h7z"/>',
+  'clock':           '<circle cx="12" cy="12" r="10"/><polyline points="12 6 12 12 16 14"/>',
+  'bot':             '<rect x="3" y="11" width="18" height="10" rx="2"/><circle cx="12" cy="5" r="2"/><path d="M12 7v4"/><line x1="8" y1="16" x2="8" y2="16"/><line x1="16" y1="16" x2="16" y2="16"/>',
+  'eye':             '<path d="M1 12s4-8 11-8 11 8 11 8-4 8-11 8-11-8-11-8z"/><circle cx="12" cy="12" r="3"/>',
+  'shuffle':         '<polyline points="16 3 21 3 21 8"/><line x1="4" y1="20" x2="21" y2="3"/><polyline points="21 16 21 21 16 21"/><line x1="15" y1="15" x2="21" y2="21"/><line x1="4" y1="4" x2="9" y2="9"/>',
+  // File-type icons
+  'image':           '<rect x="3" y="3" width="18" height="18" rx="2" ry="2"/><circle cx="8.5" cy="8.5" r="1.5"/><polyline points="21 15 16 10 5 21"/>',
+  'file-code':       '<path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z"/><polyline points="14 2 14 8 20 8"/><polyline points="10 13 8 15 10 17"/><polyline points="14 13 16 15 14 17"/>',
+  'zap':             '<polygon points="13 2 3 14 12 14 11 22 21 10 12 10 13 2"/>',
+  // Suggestion buttons
+  'clipboard-list':  '<path d="M16 4h2a2 2 0 0 1 2 2v14a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2V6a2 2 0 0 1 2-2h2"/><rect x="8" y="2" width="8" height="4" rx="1" ry="1"/><line x1="9" y1="12" x2="15" y2="12"/><line x1="9" y1="16" x2="12" y2="16"/>',
+  'map':             '<polygon points="1 6 1 22 8 18 16 22 23 18 23 2 16 6 8 2 1 6"/><line x1="8" y1="2" x2="8" y2="18"/><line x1="16" y1="6" x2="16" y2="22"/>',
+};
+
+/**
+ * Returns a Lucide SVG string for the given icon name.
+ * @param {string} name  – key in LI_PATHS (e.g. 'folder', 'trash-2')
+ * @param {number} size  – width/height in px (default 16)
+ * @returns {string} SVG element string ready for innerHTML
+ */
+function li(name, size = 16) {
+  const p = LI_PATHS[name];
+  if (!p) { console.warn('li(): unknown icon', name); return ''; }
+  return `<svg width="${size}" height="${size}" viewBox="0 0 24 24" fill="none" `
+       + `stroke="currentColor" stroke-width="2" stroke-linecap="round" `
+       + `stroke-linejoin="round" aria-hidden="true" `
+       + `style="display:inline-block;vertical-align:-0.15em;flex-shrink:0">${p}</svg>`;
+}

static/index.html

@@ -14,32 +14,32 @@
 <body>
 <div class="layout">
   <aside class="sidebar">
-    <div class="sidebar-header"><div class="logo">H</div><div><h1 style="margin:0;font-size:15px;font-weight:700;letter-spacing:-.01em">Hermes</h1><div style="font-size:10px;color:var(--muted);opacity:.8;margin-top:1px">v0.35</div></div></div>
+    <div class="sidebar-header"><div class="logo">H</div><div><h1 style="margin:0;font-size:15px;font-weight:700;letter-spacing:-.01em">Hermes</h1><div style="font-size:10px;color:var(--muted);opacity:.8;margin-top:1px">v0.48.0</div></div></div>
     <div class="sidebar-nav">
-      <button class="nav-tab active" data-panel="chat" data-label="Chat" onclick="switchPanel('chat')" title="Chat">&#128172;</button>
-      <button class="nav-tab" data-panel="tasks" data-label="Tasks" onclick="switchPanel('tasks')" title="Tasks">&#128197;</button>
-      <button class="nav-tab" data-panel="skills" data-label="Skills" onclick="switchPanel('skills')" title="Skills">&#129513;</button>
-      <button class="nav-tab" data-panel="memory" data-label="Memory" onclick="switchPanel('memory')" title="Memory">&#129504;</button>
-      <button class="nav-tab" data-panel="workspaces" data-label="Spaces" onclick="switchPanel('workspaces')" title="Spaces">&#128193;</button>
-      <button class="nav-tab" data-panel="profiles" data-label="Profiles" onclick="switchPanel('profiles')" title="Agent profiles"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M20 21v-2a4 4 0 0 0-4-4H8a4 4 0 0 0-4 4v2"/><circle cx="12" cy="7" r="4"/></svg></button>
-      <button class="nav-tab" data-panel="todos" data-label="Todos" onclick="switchPanel('todos')" title="Current task list">&#9989;</button>
+      <button class="nav-tab active" data-panel="chat" data-label="Chat" onclick="switchPanel('chat')" title="Chat" data-i18n-title="tab_chat"><svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M21 15a2 2 0 0 1-2 2H7l-4 4V5a2 2 0 0 1 2-2h14a2 2 0 0 1 2 2z"/></svg></button>
+      <button class="nav-tab" data-panel="tasks" data-label="Tasks" onclick="switchPanel('tasks')" title="Tasks" data-i18n-title="tab_tasks"><svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><rect x="3" y="4" width="18" height="18" rx="2"/><line x1="16" y1="2" x2="16" y2="6"/><line x1="8" y1="2" x2="8" y2="6"/><line x1="3" y1="10" x2="21" y2="10"/></svg></button>
+      <button class="nav-tab" data-panel="skills" data-label="Skills" onclick="switchPanel('skills')" title="Skills" data-i18n-title="tab_skills"><svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M12 2L2 7l10 5 10-5-10-5z"/><path d="M2 17l10 5 10-5"/><path d="M2 12l10 5 10-5"/></svg></button>
+      <button class="nav-tab" data-panel="memory" data-label="Memory" onclick="switchPanel('memory')" title="Memory" data-i18n-title="tab_memory"><svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M12 2a7 7 0 0 1 7 7c0 2.5-1.3 4.7-3.2 6H8.2C6.3 13.7 5 11.5 5 9a7 7 0 0 1 7-7z"/><line x1="9" y1="17" x2="15" y2="17"/><line x1="10" y1="20" x2="14" y2="20"/></svg></button>
+      <button class="nav-tab" data-panel="workspaces" data-label="Spaces" onclick="switchPanel('workspaces')" title="Spaces" data-i18n-title="tab_workspaces"><svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M22 19a2 2 0 0 1-2 2H4a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h5l2 3h9a2 2 0 0 1 2 2z"/></svg></button>
+      <button class="nav-tab" data-panel="profiles" data-label="Profiles" onclick="switchPanel('profiles')" title="Agent profiles" data-i18n-title="tab_profiles"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M20 21v-2a4 4 0 0 0-4-4H8a4 4 0 0 0-4 4v2"/><circle cx="12" cy="7" r="4"/></svg></button>
+      <button class="nav-tab" data-panel="todos" data-label="Todos" onclick="switchPanel('todos')" title="Current task list" data-i18n-title="tab_todos"><svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><rect x="3" y="5" width="6" height="6" rx="1"/><path d="m3 17 2 2 4-4"/><path d="M13 6h8"/><path d="M13 12h8"/><path d="M13 18h8"/></svg></button>
     </div>
     <!-- Chat panel -->
     <div class="panel-view active" id="panelChat">
       <div class="sidebar-section">
         <button class="new-chat-btn" id="btnNewChat">
           <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5"><line x1="12" y1="5" x2="12" y2="19"/><line x1="5" y1="12" x2="19" y2="12"/></svg>
-          New conversation <span style="font-size:10px;opacity:.5;margin-left:4px">&#8984;K</span>
+          <span data-i18n="new_conversation">New conversation</span> <span style="font-size:10px;opacity:.5;margin-left:4px">&#8984;K</span>
         </button>
       </div>
-      <div class="session-search"><input id="sessionSearch" placeholder="Filter conversations..." oninput="filterSessions()"></div>
+      <div class="session-search"><input id="sessionSearch" placeholder="Filter conversations..." data-i18n-placeholder="filter_conversations" oninput="filterSessions()"></div>
       <div class="session-list" id="sessionList"></div>
     </div>
     <!-- Tasks (cron) panel -->
     <div class="panel-view" id="panelTasks">
       <div class="sidebar-section" style="padding-bottom:4px;display:flex;align-items:center;justify-content:space-between">
-        <div style="font-size:11px;color:var(--muted)">Scheduled jobs</div>
-        <button class="cron-btn run" style="padding:3px 8px;font-size:10px" onclick="toggleCronForm()">+ New job</button>
+        <div style="font-size:11px;color:var(--muted)" data-i18n="scheduled_jobs">Scheduled jobs</div>
+        <button class="cron-btn run" style="padding:3px 8px;font-size:10px" onclick="toggleCronForm()">+ <span data-i18n="new_job">New job</span></button>
       </div>
       <!-- Create job form (hidden by default) -->
       <div id="cronCreateForm" style="display:none;padding:8px 12px;border-bottom:1px solid var(--border);flex-shrink:0">
@@ -57,18 +57,18 @@
           <div id="cronFormSkillTags" class="skill-picker-tags"></div>
         </div>
         <div style="display:flex;gap:6px">
-          <button class="cron-btn run" style="flex:1" onclick="submitCronCreate()">Create job</button>
-          <button class="cron-btn" style="flex:1" onclick="toggleCronForm()">Cancel</button>
+          <button class="cron-btn run" style="flex:1" onclick="submitCronCreate()" data-i18n="create_job">Create job</button>
+          <button class="cron-btn" style="flex:1" onclick="toggleCronForm()" data-i18n="cancel">Cancel</button>
         </div>
         <div id="cronFormError" style="font-size:11px;color:var(--accent);margin-top:6px;display:none"></div>
       </div>
-      <div class="cron-list" id="cronList"><div style="padding:12px;color:var(--muted);font-size:12px">Loading...</div></div>
+      <div class="cron-list" id="cronList"><div style="padding:12px;color:var(--muted);font-size:12px" data-i18n="loading">Loading...</div></div>
     </div>
     <!-- Skills panel -->
     <div class="panel-view" id="panelSkills">
       <div class="sidebar-section" style="padding-bottom:4px;display:flex;align-items:center;justify-content:space-between">
-        <div class="skills-search" style="flex:1;padding:0"><input id="skillsSearch" placeholder="Search skills..." oninput="filterSkills()"></div>
-        <button class="cron-btn run" style="padding:3px 8px;font-size:10px;flex-shrink:0;margin-left:6px" onclick="toggleSkillForm()">+ New skill</button>
+        <div class="skills-search" style="flex:1;padding:0"><input id="skillsSearch" placeholder="Search skills..." data-i18n-placeholder="search_skills" oninput="filterSkills()"></div>
+        <button class="cron-btn run" style="padding:3px 8px;font-size:10px;flex-shrink:0;margin-left:6px" onclick="toggleSkillForm()">+ <span data-i18n="new_skill">New skill</span></button>
       </div>
       <!-- Skill create/edit form (hidden by default) -->
       <div id="skillCreateForm" style="display:none;padding:8px 12px;border-bottom:1px solid var(--border);flex-shrink:0">
@@ -76,46 +76,46 @@
         <input id="skillFormCategory" placeholder="Category (optional, e.g. devops)" style="width:100%;background:rgba(255,255,255,.05);border:1px solid var(--border2);border-radius:6px;color:var(--text);padding:5px 8px;font-size:12px;outline:none;margin-bottom:6px;box-sizing:border-box">
         <textarea id="skillFormContent" rows="6" placeholder="SKILL.md content (YAML frontmatter + markdown body)" style="width:100%;background:rgba(255,255,255,.05);border:1px solid var(--border2);border-radius:6px;color:var(--text);padding:5px 8px;font-size:12px;outline:none;resize:vertical;font-family:'SF Mono',ui-monospace,monospace;margin-bottom:6px;box-sizing:border-box"></textarea>
         <div style="display:flex;gap:6px">
-          <button class="cron-btn run" style="flex:1" onclick="submitSkillSave()">Save skill</button>
-          <button class="cron-btn" style="flex:1" onclick="toggleSkillForm()">Cancel</button>
+          <button class="cron-btn run" style="flex:1" onclick="submitSkillSave()" data-i18n="save_skill">Save skill</button>
+          <button class="cron-btn" style="flex:1" onclick="toggleSkillForm()" data-i18n="cancel">Cancel</button>
         </div>
         <div id="skillFormError" style="font-size:11px;color:var(--accent);margin-top:6px;display:none"></div>
       </div>
-      <div class="skills-list" id="skillsList"><div style="padding:12px;color:var(--muted);font-size:12px">Loading...</div></div>
+      <div class="skills-list" id="skillsList"><div style="padding:12px;color:var(--muted);font-size:12px" data-i18n="loading">Loading...</div></div>
     </div>
     <!-- Memory panel -->
     <div class="panel-view" id="panelMemory">
       <div style="padding:8px 12px 4px;display:flex;align-items:center;justify-content:space-between;flex-shrink:0">
-        <span style="font-size:11px;color:var(--muted)">Personal memory</span>
-        <button class="cron-btn run" id="memEditBtn" style="padding:3px 8px;font-size:10px" onclick="toggleMemoryEdit()">&#9998; Edit</button>
+        <span style="font-size:11px;color:var(--muted)" data-i18n="personal_memory">Personal memory</span>
+        <button class="cron-btn run" id="memEditBtn" style="padding:3px 8px;font-size:10px" onclick="toggleMemoryEdit()"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M17 3a2.85 2.83 0 1 1 4 4L7.5 20.5 2 22l1.5-5.5Z"/></svg> <span data-i18n="edit">Edit</span></button>
       </div>
-      <div class="memory-panel" id="memoryPanel"><div style="color:var(--muted);font-size:12px">Loading...</div></div>
+      <div class="memory-panel" id="memoryPanel"><div style="color:var(--muted);font-size:12px" data-i18n="loading">Loading...</div></div>
       <!-- Memory edit form (hidden by default) -->
       <div id="memoryEditForm" style="display:none;padding:8px 12px;border-top:1px solid var(--border);flex-shrink:0">
-        <div style="font-size:11px;color:var(--muted);margin-bottom:4px">Editing: <span id="memEditSection">memory</span></div>
+        <div style="font-size:11px;color:var(--muted);margin-bottom:4px"><span data-i18n="editing">Editing</span>: <span id="memEditSection">memory</span></div>
         <textarea id="memEditContent" rows="10" style="width:100%;background:rgba(255,255,255,.05);border:1px solid var(--border2);border-radius:6px;color:var(--text);padding:5px 8px;font-size:11px;outline:none;resize:vertical;font-family:'SF Mono',ui-monospace,monospace;box-sizing:border-box;margin-bottom:6px;line-height:1.5"></textarea>
         <div style="display:flex;gap:6px">
-          <button class="cron-btn run" style="flex:1" onclick="submitMemorySave()">Save</button>
-          <button class="cron-btn" style="flex:1" onclick="closeMemoryEdit()">Cancel</button>
+          <button class="cron-btn run" style="flex:1" onclick="submitMemorySave()" data-i18n="save">Save</button>
+          <button class="cron-btn" style="flex:1" onclick="closeMemoryEdit()" data-i18n="cancel">Cancel</button>
         </div>
         <div id="memEditError" style="font-size:11px;color:var(--accent);margin-top:6px;display:none"></div>
       </div>
     </div>
     <!-- Todo panel -->
     <div class="panel-view" id="panelTodos">
-      <div style="padding:10px 12px 4px;font-size:11px;color:var(--muted);flex-shrink:0">Current task list</div>
+      <div style="padding:10px 12px 4px;font-size:11px;color:var(--muted);flex-shrink:0" data-i18n="current_task_list">Current task list</div>
       <div id="todoPanel" style="flex:1;overflow-y:auto;padding:8px 12px"></div>
     </div>
     <!-- Workspaces panel -->
     <div class="panel-view" id="panelWorkspaces">
-      <div style="padding:10px 12px 4px;font-size:11px;color:var(--muted)">Add and switch workspaces for your sessions.</div>
-      <div style="flex:1;overflow-y:auto;padding:0 12px 12px" id="workspacesPanel"><div style="color:var(--muted);font-size:12px">Loading...</div></div>
+      <div style="padding:10px 12px 4px;font-size:11px;color:var(--muted)" data-i18n="workspace_desc">Add and switch workspaces for your sessions.</div>
+      <div style="flex:1;overflow-y:auto;padding:0 12px 12px" id="workspacesPanel"><div style="color:var(--muted);font-size:12px" data-i18n="loading">Loading...</div></div>
     </div>
     <!-- Profiles panel -->
     <div class="panel-view" id="panelProfiles">
       <div class="sidebar-section" style="padding-bottom:4px;display:flex;align-items:center;justify-content:space-between">
-        <div style="font-size:11px;color:var(--muted)">Agent profiles</div>
-        <button class="cron-btn run" style="padding:3px 8px;font-size:10px" onclick="toggleProfileForm()">+ New profile</button>
+        <div style="font-size:11px;color:var(--muted)" data-i18n="tab_profiles">Agent profiles</div>
+        <button class="cron-btn run" style="padding:3px 8px;font-size:10px" onclick="toggleProfileForm()">+ <span data-i18n="new_profile">New profile</span></button>
       </div>
       <!-- Profile create form (hidden by default) -->
       <div id="profileCreateForm" style="display:none;padding:8px 12px;border-bottom:1px solid var(--border);flex-shrink:0">
@@ -123,6 +123,8 @@
         <label style="display:flex;align-items:center;gap:6px;font-size:11px;color:var(--muted);margin-bottom:8px;cursor:pointer">
           <input type="checkbox" id="profileFormClone" style="accent-color:var(--accent)"> Clone config from active profile
         </label>
+        <input id="profileFormBaseUrl" placeholder="Base URL (optional, e.g. http://localhost:11434)" style="width:100%;background:rgba(255,255,255,.05);border:1px solid var(--border2);border-radius:6px;color:var(--text);padding:5px 8px;font-size:12px;outline:none;margin-bottom:6px;box-sizing:border-box">
+        <input id="profileFormApiKey" type="password" placeholder="API key (optional)" style="width:100%;background:rgba(255,255,255,.05);border:1px solid var(--border2);border-radius:6px;color:var(--text);padding:5px 8px;font-size:12px;outline:none;margin-bottom:6px;box-sizing:border-box">
         <div style="display:flex;gap:6px">
           <button class="cron-btn run" style="flex:1" onclick="submitProfileCreate()">Create</button>
           <button class="cron-btn" style="flex:1" onclick="toggleProfileForm()">Cancel</button>
@@ -153,19 +155,19 @@
       </select>
       <div style="position:relative">
         <div id="sidebarWsDisplay" style="display:flex;align-items:center;gap:7px;padding:0 0 8px;cursor:pointer;border-radius:8px;transition:background .15s" onclick="toggleWsDropdown()" title="Switch workspace">
-          <span style="font-size:14px;opacity:.7">&#128193;</span>
+          <span style="opacity:.7;line-height:1"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M22 19a2 2 0 0 1-2 2H4a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h5l2 3h9a2 2 0 0 1 2 2z"/></svg></span>
           <div style="min-width:0;flex:1">
             <div style="font-size:11px;font-weight:600;color:var(--text);overflow:hidden;text-overflow:ellipsis;white-space:nowrap" id="sidebarWsName">Workspace</div>
             <div style="font-size:10px;color:var(--muted);overflow:hidden;text-overflow:ellipsis;white-space:nowrap;margin-top:1px" id="sidebarWsPath"></div>
           </div>
-          <span style="font-size:10px;color:var(--muted);flex-shrink:0">&#9662;</span>
+          <span style="color:var(--muted);flex-shrink:0;line-height:1"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><polyline points="6 9 12 15 18 9"/></svg></span>
         </div>
         <div class="ws-dropdown" id="wsDropdown"></div>
       </div>
       <div class="sidebar-actions">
-        <button class="sm-btn" id="btnDownload" title="Download as Markdown">&#8595; Transcript</button>
-        <button class="sm-btn" id="btnExportJSON" title="Export full session as JSON">&#10092;/&#10093; JSON</button>
-        <button class="sm-btn" id="btnImportJSON" title="Import session from JSON">&#8593; Import</button>
+        <button class="sm-btn" id="btnDownload" title="Download as Markdown" data-i18n-title="download_transcript"><svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="7 10 12 15 17 10"/><line x1="12" y1="15" x2="12" y2="3"/></svg> <span data-i18n="transcript">Transcript</span></button>
+        <button class="sm-btn" id="btnExportJSON" title="Export full session as JSON"><svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M8 3H7a2 2 0 0 0-2 2v5a2 2 0 0 1-2 2 2 2 0 0 1 2 2v5c0 1.1.9 2 2 2h1"/><path d="M16 3h1a2 2 0 0 1 2 2v5a2 2 0 0 0 2 2 2 2 0 0 0-2 2v5a2 2 0 0 1-2 2h-1"/></svg> JSON</button>
+        <button class="sm-btn" id="btnImportJSON" title="Import session from JSON"><svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="17 8 12 3 7 8"/><line x1="12" y1="3" x2="12" y2="15"/></svg> <span data-i18n="import">Import</span></button>
         <input type="file" id="importFileInput" accept=".json" style="display:none">
       </div>
     </div>
@@ -176,63 +178,99 @@
       <button class="mobile-hamburger" id="btnHamburger" onclick="toggleMobileSidebar()" title="Menu">
         <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><line x1="3" y1="6" x2="21" y2="6"/><line x1="3" y1="12" x2="21" y2="12"/><line x1="3" y1="18" x2="21" y2="18"/></svg>
       </button>
-      <div style="flex:1;min-width:0;overflow:hidden"><div class="topbar-title" id="topbarTitle">Hermes</div><div class="topbar-meta" id="topbarMeta">Start a new conversation</div></div>
+      <div style="flex:1;min-width:0;overflow:hidden"><div class="topbar-title" id="topbarTitle">Hermes</div><div class="topbar-meta" id="topbarMeta" data-i18n="new_conversation">Start a new conversation</div></div>
       <div class="topbar-chips">
         <div id="profileChipWrap" style="position:relative">
-          <div class="chip profile-chip" id="profileChip" onclick="toggleProfileDropdown()" title="Switch profile" style="cursor:pointer"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" style="vertical-align:-1px;margin-right:3px"><path d="M20 21v-2a4 4 0 0 0-4-4H8a4 4 0 0 0-4 4v2"/><circle cx="12" cy="7" r="4"/></svg><span id="profileChipLabel">default</span> &#9662;</div>
+          <div class="chip profile-chip" id="profileChip" onclick="toggleProfileDropdown()" title="Switch profile" style="cursor:pointer"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" style="vertical-align:-1px;margin-right:3px"><path d="M20 21v-2a4 4 0 0 0-4-4H8a4 4 0 0 0-4 4v2"/><circle cx="12" cy="7" r="4"/></svg><span id="profileChipLabel">default</span> <svg width="10" height="10" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><polyline points="6 9 12 15 18 9"/></svg></div>
           <div class="profile-dropdown" id="profileDropdown"></div>
         </div>
         <div class="chip model" id="modelChip">GPT-5.4 Mini</div>
 
-        <button class="chip clear-btn" id="btnClearConv" onclick="clearConversation()" title="Clear all messages in this conversation" style="display:none">&#128465; Clear</button>
-        <button class="chip gear-btn" id="btnSettings" onclick="toggleSettings()" title="Settings">&#9881;</button>
-        <button class="chip mobile-files-btn" id="btnMobileFiles" onclick="toggleMobileFiles()" title="Files">&#128193;</button>
+        <button class="chip clear-btn" id="btnClearConv" onclick="clearConversation()" title="Clear all messages in this conversation" style="display:none"><svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M3 6h18"/><path d="M19 6v14c0 1-1 2-2 2H7c-1 0-2-1-2-2V6"/><path d="M8 6V4c0-1 1-2 2-2h4c1 0 2 1 2 2v2"/></svg> <span data-i18n="copy">Clear</span></button>
+        <button class="chip gear-btn" id="btnSettings" onclick="toggleSettings()" title="Settings" data-i18n-title="settings_title"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="12" cy="12" r="3"/><path d="M19.4 15a1.65 1.65 0 0 0 .33 1.82l.06.06a2 2 0 0 1-2.83 2.83l-.06-.06a1.65 1.65 0 0 0-1.82-.33 1.65 1.65 0 0 0-1 1.51V21a2 2 0 0 1-4 0v-.09A1.65 1.65 0 0 0 9 19.4a1.65 1.65 0 0 0-1.82.33l-.06.06a2 2 0 0 1-2.83-2.83l.06-.06A1.65 1.65 0 0 0 4.68 15a1.65 1.65 0 0 0-1.51-1H3a2 2 0 0 1 0-4h.09A1.65 1.65 0 0 0 4.6 9a1.65 1.65 0 0 0-.33-1.82l-.06-.06a2 2 0 0 1 2.83-2.83l.06.06A1.65 1.65 0 0 0 9 4.68a1.65 1.65 0 0 0 1-1.51V3a2 2 0 0 1 4 0v.09a1.65 1.65 0 0 0 1 1.51 1.65 1.65 0 0 0 1.82-.33l.06-.06a2 2 0 0 1 2.83 2.83l-.06.06A1.65 1.65 0 0 0 19.4 9a1.65 1.65 0 0 0 1.51 1H21a2 2 0 0 1 0 4h-.09a1.65 1.65 0 0 0-1.51 1z"/></svg></button>
+        <button class="chip mobile-files-btn" id="btnMobileFiles" onclick="toggleMobileFiles()" title="Files"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M22 19a2 2 0 0 1-2 2H4a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h5l2 3h9a2 2 0 0 1 2 2z"/></svg></button>
       </div>
     </div>
     <div class="messages" id="messages">
       <div class="empty-state" id="emptyState">
-        <div class="empty-logo">🦉</div>
-        <h2>What can I help with?</h2>
-        <p>Ask anything, run commands, explore files, or manage your scheduled tasks.</p>
+        <div class="empty-logo"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="80" height="80" aria-label="Hermes caduceus">
+          <defs>
+            <linearGradient id="hermes-gold" x1="0%" y1="0%" x2="0%" y2="100%">
+              <stop offset="0%" style="stop-color:#F5C542;stop-opacity:1"/>
+              <stop offset="100%" style="stop-color:#D4961C;stop-opacity:1"/>
+            </linearGradient>
+          </defs>
+          <rect x="30" y="10" width="4" height="46" rx="2" fill="url(#hermes-gold)"/>
+          <path d="M30 18 C24 14, 14 14, 10 18 C14 16, 22 16, 28 20" fill="#F5C542" opacity="0.9"/>
+          <path d="M30 22 C26 19, 18 19, 14 22 C18 20, 24 20, 28 24" fill="#D4961C" opacity="0.8"/>
+          <path d="M34 18 C40 14, 50 14, 54 18 C50 16, 42 16, 36 20" fill="#F5C542" opacity="0.9"/>
+          <path d="M34 22 C38 19, 46 19, 50 22 C46 20, 40 20, 36 24" fill="#D4961C" opacity="0.8"/>
+          <path d="M32 48 C22 44, 20 38, 26 34 C20 36, 18 42, 24 46 C18 40, 22 30, 30 28 C24 32, 22 38, 28 42" fill="none" stroke="#F5C542" stroke-width="2.5" stroke-linecap="round"/>
+          <path d="M32 48 C42 44, 44 38, 38 34 C44 36, 46 42, 40 46 C46 40, 42 30, 34 28 C40 32, 42 38, 36 42" fill="none" stroke="#D4961C" stroke-width="2.5" stroke-linecap="round"/>
+          <circle cx="32" cy="10" r="4" fill="#F5C542"/>
+          <circle cx="32" cy="10" r="2" fill="#FFF8E1" opacity="0.7"/>
+        </svg></div>
+        <h2 data-i18n="empty_title">What can I help with?</h2>
+        <p data-i18n="empty_subtitle">Ask anything, run commands, explore files, or manage your scheduled tasks.</p>
         <div class="suggestion-grid">
-          <button class="suggestion" data-msg="What files are in this workspace?">📁 What files are in this workspace?</button>
-          <button class="suggestion" data-msg="What's on my schedule today?">📋 What's on my schedule today?</button>
-          <button class="suggestion" data-msg="Help me plan a small project.">🗺 Help me plan a small project.</button>
+          <button class="suggestion" data-msg="What files are in this workspace?"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M22 19a2 2 0 0 1-2 2H4a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h5l2 3h9a2 2 0 0 1 2 2z"/></svg> <span data-i18n="suggest_files">What files are in this workspace?</span></button>
+          <button class="suggestion" data-msg="What's on my schedule today?"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M16 4h2a2 2 0 0 1 2 2v14a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2V6a2 2 0 0 1 2-2h2"/><rect x="8" y="2" width="8" height="4" rx="1" ry="1"/><line x1="9" y1="12" x2="15" y2="12"/><line x1="9" y1="16" x2="12" y2="16"/></svg> <span data-i18n="suggest_schedule">What's on my schedule today?</span></button>
+          <button class="suggestion" data-msg="Help me plan a small project."><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><polygon points="1 6 1 22 8 18 16 22 23 18 23 2 16 6 8 2 1 6"/><line x1="8" y1="2" x2="8" y2="18"/><line x1="16" y1="6" x2="16" y2="22"/></svg> <span data-i18n="suggest_plan">Help me plan a small project.</span></button>
         </div>
       </div>
       <div class="messages-inner" id="msgInner"></div>
       <div id="liveToolCards" style="display:none;max-width:800px;margin:0 auto;width:100%;padding:0 24px;"></div>
     </div>
-    <div class="reconnect-banner" id="reconnectBanner">
-      <span id="reconnectMsg">&#9888; A response may have been in progress when you last left. Reload messages?</span>
+    <div class="update-banner" id="updateBanner">
+      <span id="updateMsg"></span>
       <div style="display:flex;gap:8px;flex-shrink:0">
-        <button class="reconnect-btn" onclick="dismissReconnect()">Dismiss</button>
-        <button class="reconnect-btn" onclick="refreshSession()">&#8635; Reload</button>
+        <button class="update-btn" onclick="dismissUpdate()">Later</button>
+        <button class="update-btn update-primary" id="btnApplyUpdate" onclick="applyUpdates()">Update Now</button>
       </div>
     </div>
-    <div class="approval-card" id="approvalCard">
+    <div class="reconnect-banner" id="reconnectBanner">
+      <span id="reconnectMsg"><svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" style="vertical-align:-1px"><path d="M10.29 3.86L1.82 18a2 2 0 0 0 1.71 3h16.94a2 2 0 0 0 1.71-3L13.71 3.86a2 2 0 0 0-3.42 0z"/><line x1="12" y1="9" x2="12" y2="13"/><line x1="12" y1="17" x2="12.01" y2="17"/></svg> A response may have been in progress when you last left. Reload messages?</span>
+      <div style="display:flex;gap:8px;flex-shrink:0">
+        <button class="reconnect-btn" onclick="dismissReconnect()">Dismiss</button>
+        <button class="reconnect-btn" onclick="refreshSession()"><svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" style="vertical-align:-1px"><polyline points="23 4 23 10 17 10"/><polyline points="1 20 1 14 7 14"/><path d="M3.51 9a9 9 0 0 1 14.85-3.36L23 10M1 14l4.64 4.36A9 9 0 0 0 20.49 15"/></svg> Reload</button>
+      </div>
+    </div>
+    <div class="approval-card" id="approvalCard" role="alertdialog" aria-labelledby="approvalHeading" aria-describedby="approvalDesc">
       <div class="approval-inner">
         <div class="approval-header">
           <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M10.29 3.86L1.82 18a2 2 0 0 0 1.71 3h16.94a2 2 0 0 0 1.71-3L13.71 3.86a2 2 0 0 0-3.42 0z"/><line x1="12" y1="9" x2="12" y2="13"/><line x1="12" y1="17" x2="12.01" y2="17"/></svg>
-          Dangerous command — approval required
+          <span id="approvalHeading" data-i18n="approval_heading">Approval required</span>
         </div>
         <div class="approval-desc" id="approvalDesc"></div>
         <div class="approval-cmd" id="approvalCmd"></div>
         <div class="approval-btns">
-          <button class="approval-btn once" onclick="respondApproval('once')">&#10003; Allow once</button>
-          <button class="approval-btn session" onclick="respondApproval('session')">&#128274; Allow this session</button>
-          <button class="approval-btn always" onclick="respondApproval('always')">&#9734; Always allow</button>
-          <button class="approval-btn deny" onclick="respondApproval('deny')">&#10005; Deny</button>
+          <button class="approval-btn once" id="approvalBtnOnce" onclick="respondApproval('once')" title="Allow this one command (Enter)" data-i18n-title="approval_btn_once_title">
+            <span class="approval-btn-icon"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><polyline points="20 6 9 17 4 12"/></svg></span>
+            <span class="approval-btn-label" data-i18n="approval_btn_once">Allow once</span>
+            <kbd class="approval-kbd">↵</kbd>
+          </button>
+          <button class="approval-btn session" id="approvalBtnSession" onclick="respondApproval('session')" title="Allow for this session">
+            <span class="approval-btn-icon"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><rect x="3" y="11" width="18" height="11" rx="2" ry="2"/><path d="M7 11V7a5 5 0 0 1 10 0v4"/></svg></span>
+            <span class="approval-btn-label" data-i18n="approval_btn_session">Allow session</span>
+          </button>
+          <button class="approval-btn always" id="approvalBtnAlways" onclick="respondApproval('always')" title="Always allow this command pattern">
+            <span class="approval-btn-icon"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><polygon points="12 2 15.09 8.26 22 9.27 17 14.14 18.18 21.02 12 17.77 5.82 21.02 7 14.14 2 9.27 8.91 8.26 12 2"/></svg></span>
+            <span class="approval-btn-label" data-i18n="approval_btn_always">Always allow</span>
+          </button>
+          <button class="approval-btn deny" id="approvalBtnDeny" onclick="respondApproval('deny')" title="Deny — do not run this command">
+            <span class="approval-btn-icon"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg></span>
+            <span class="approval-btn-label" data-i18n="approval_btn_deny">Deny</span>
+          </button>
         </div>
       </div>
     </div>
     <!-- Activity bar: shows tool progress / status above composer (not inside input) -->
     <div id="activityBar" style="display:none;max-width:800px;margin:0 auto;width:100%;padding:0 24px;">
       <div id="activityBarInner" style="display:flex;align-items:center;gap:8px;padding:6px 12px;border-radius:8px;background:rgba(255,255,255,.04);border:1px solid rgba(255,255,255,.07);font-size:12px;color:var(--muted);animation:fadeIn .15s ease;">
-        <span id="activityIcon" style="font-size:13px;opacity:.6">&#9881;</span>
+        <span id="activityIcon" style="opacity:.6;line-height:1"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><line x1="12" y1="2" x2="12" y2="6"/><line x1="12" y1="18" x2="12" y2="22"/><line x1="4.93" y1="4.93" x2="7.76" y2="7.76"/><line x1="16.24" y1="16.24" x2="19.07" y2="19.07"/><line x1="2" y1="12" x2="6" y2="12"/><line x1="18" y1="12" x2="22" y2="12"/><line x1="4.93" y1="19.07" x2="7.76" y2="16.24"/><line x1="16.24" y1="7.76" x2="19.07" y2="4.93"/></svg></span>
         <span id="activityText" style="flex:1;overflow:hidden;text-overflow:ellipsis;white-space:nowrap"></span>
-        <button id="btnCancel" onclick="cancelStream()" style="display:none;background:rgba(233,69,96,.12);border:1px solid rgba(233,69,96,.35);color:#e94560;font-size:11px;font-weight:600;padding:3px 10px;border-radius:6px;cursor:pointer;flex-shrink:0;transition:background .15s" title="Cancel this task">&#9632; Cancel</button>
-        <button id="btnDismissStatus" onclick="setStatus('')" style="display:none;background:none;border:none;color:var(--muted);font-size:14px;line-height:1;cursor:pointer;padding:0 2px;opacity:.5;flex-shrink:0" title="Dismiss">&#x2715;</button>
+        <button id="btnCancel" onclick="cancelStream()" style="display:none;background:rgba(233,69,96,.12);border:1px solid rgba(233,69,96,.35);color:#e94560;font-size:11px;font-weight:600;padding:3px 10px;border-radius:6px;cursor:pointer;flex-shrink:0;transition:background .15s;align-items:center;gap:4px" title="Cancel this task"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><rect x="3" y="3" width="18" height="18" rx="2" ry="2"/></svg> Cancel</button>
+        <button id="btnDismissStatus" onclick="setStatus('')" style="display:none;background:none;border:none;color:var(--muted);line-height:1;cursor:pointer;padding:0 2px;opacity:.5;flex-shrink:0" title="Dismiss"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg></button>
         <span id="activityDots" style="display:flex;gap:3px;align-items:center">
           <span style="width:4px;height:4px;border-radius:50%;background:var(--blue);opacity:.3;animation:pulse 1.4s ease-in-out infinite"></span>
           <span style="width:4px;height:4px;border-radius:50%;background:var(--blue);opacity:.3;animation:pulse 1.4s ease-in-out .22s infinite"></span>
@@ -285,11 +323,12 @@
       <span>Workspace</span>
       <span class="git-badge" id="gitBadge" style="display:none"></span>
       <div class="panel-actions">
-        <button class="panel-icon-btn" id="btnUpDir" title="Parent directory" onclick="navigateUp()" style="display:none">&#8593;</button>
-        <button class="panel-icon-btn" id="btnNewFile" title="New file" onclick="promptNewFile()">&#43;</button>
-        <button class="panel-icon-btn" id="btnNewFolder" title="New folder" onclick="promptNewFolder()">&#128193;</button>
-        <button class="panel-icon-btn" id="btnRefreshPanel" title="Refresh" onclick="if(S.session)loadDir(S.currentDir)">&#8635;</button>
-        <button class="panel-icon-btn close-preview" id="btnClearPreview" title="Close preview">&#10005;</button>
+        <button class="panel-icon-btn" id="btnUpDir" title="Parent directory" onclick="navigateUp()" style="display:none"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><line x1="12" y1="19" x2="12" y2="5"/><polyline points="5 12 12 5 19 12"/></svg></button>
+        <button class="panel-icon-btn" id="btnNewFile" title="New file" onclick="promptNewFile()"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><line x1="12" y1="5" x2="12" y2="19"/><line x1="5" y1="12" x2="19" y2="12"/></svg></button>
+        <button class="panel-icon-btn" id="btnNewFolder" title="New folder" onclick="promptNewFolder()"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M22 19a2 2 0 0 1-2 2H4a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h5l2 3h9a2 2 0 0 1 2 2z"/></svg></button>
+        <button class="panel-icon-btn" id="btnRefreshPanel" title="Refresh" onclick="if(S.session)loadDir(S.currentDir)"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><polyline points="23 4 23 10 17 10"/><polyline points="1 20 1 14 7 14"/><path d="M3.51 9a9 9 0 0 1 14.85-3.36L23 10M1 14l4.64 4.36A9 9 0 0 0 20.49 15"/></svg></button>
+        <button class="panel-icon-btn close-preview" id="btnClearPreview" title="Close preview"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg></button>
+        <button class="panel-icon-btn mobile-close-btn" onclick="closeMobileFiles()" title="Close" aria-label="Close workspace panel">×</button>
       </div>
     </div>
     <div class="breadcrumb-bar" id="breadcrumbBar" style="display:none"></div>
@@ -298,8 +337,8 @@
       <div class="preview-path" id="previewPath">
         <span id="previewPathText"></span>
         <span class="preview-badge" id="previewBadge"></span>
-        <button id="btnDownloadFile" class="panel-icon-btn" style="margin-left:auto;font-size:12px;width:auto;padding:2px 8px" onclick="downloadFile(_previewCurrentPath)" title="Download file to your computer">&#8681; Download</button>
-        <button id="btnEditFile" class="panel-icon-btn" style="font-size:12px;width:auto;padding:2px 8px;display:none" onclick="toggleEditMode()">&#9998; Edit</button>
+        <button id="btnDownloadFile" class="panel-icon-btn" style="margin-left:auto;font-size:12px;width:auto;padding:2px 8px;display:inline-flex;align-items:center;gap:4px" onclick="downloadFile(_previewCurrentPath)" title="Download file to your computer"><svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="7 10 12 15 17 10"/><line x1="12" y1="15" x2="12" y2="3"/></svg> Download</button>
+        <button id="btnEditFile" class="panel-icon-btn" style="font-size:12px;width:auto;padding:2px 8px;display:none;align-items:center;gap:4px" onclick="toggleEditMode()"><svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M17 3a2.85 2.83 0 1 1 4 4L7.5 20.5 2 22l1.5-5.5Z"/></svg> Edit</button>
       </div>
       <pre class="preview-code" id="previewCode"></pre>
       <div class="preview-img-wrap" id="previewImgWrap" style="display:none"><img class="preview-img" id="previewImg" src="" alt=""></div>
@@ -311,27 +350,23 @@
 <div class="settings-overlay" id="settingsOverlay" style="display:none">
   <div class="settings-panel">
     <div class="settings-header">
-      <h3 style="margin:0;font-size:16px">Settings</h3>
-      <button class="panel-icon-btn" onclick="_closeSettingsPanel()" title="Close">&#10005;</button>
+      <h3 style="margin:0;font-size:16px" data-i18n="settings_title">Settings</h3>
+      <button class="panel-icon-btn" onclick="_closeSettingsPanel()" title="Close"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg></button>
     </div>
     <div class="settings-body">
       <div class="settings-field">
-        <label for="settingsModel">Default Model</label>
+        <label for="settingsModel" data-i18n="settings_label_model">Default Model</label>
         <select id="settingsModel" style="width:100%;padding:8px;background:var(--code-bg);color:var(--text);border:1px solid var(--border2);border-radius:6px"></select>
       </div>
       <div class="settings-field">
-        <label for="settingsWorkspace">Default Workspace</label>
-        <select id="settingsWorkspace" style="width:100%;padding:8px;background:var(--code-bg);color:var(--text);border:1px solid var(--border2);border-radius:6px"></select>
-      </div>
-      <div class="settings-field">
-        <label for="settingsSendKey">Send Key</label>
+        <label for="settingsSendKey" data-i18n="settings_label_send_key">Send Key</label>
         <select id="settingsSendKey" style="width:100%;padding:8px;background:var(--code-bg);color:var(--text);border:1px solid var(--border2);border-radius:6px">
           <option value="enter">Enter (Shift+Enter for newline)</option>
           <option value="ctrl+enter">Ctrl+Enter (Enter for newline)</option>
         </select>
       </div>
       <div class="settings-field">
-        <label for="settingsTheme">Theme</label>
+        <label for="settingsTheme" data-i18n="settings_label_theme">Theme</label>
         <select id="settingsTheme" style="width:100%;padding:8px;background:var(--code-bg);color:var(--text);border:1px solid var(--border2);border-radius:6px" onchange="document.documentElement.dataset.theme=this.value;localStorage.setItem('hermes-theme',this.value)">
           <option value="dark">Dark (default)</option>
           <option value="light">Light</option>
@@ -339,64 +374,97 @@
           <option value="solarized">Solarized Dark</option>
           <option value="monokai">Monokai</option>
           <option value="nord">Nord</option>
+          <option value="oled">OLED</option>
         </select>
       </div>
+      <div class="settings-field">
+        <label for="settingsLanguage" data-i18n="settings_label_language">Language</label>
+        <select id="settingsLanguage" style="width:100%;padding:8px;background:var(--code-bg);color:var(--text);border:1px solid var(--border2);border-radius:6px"></select>
+      </div>
+      <div class="settings-field">
+        <label style="display:flex;align-items:center;gap:8px;cursor:pointer">
+          <input type="checkbox" id="settingsSoundEnabled" style="width:15px;height:15px;accent-color:var(--accent)">
+          <span data-i18n="settings_label_sound">Notification sound</span>
+        </label>
+        <div style="font-size:11px;color:var(--muted);margin-top:4px" data-i18n="settings_desc_sound">Play a sound when the assistant finishes a response.</div>
+      </div>
+      <div class="settings-field">
+        <label style="display:flex;align-items:center;gap:8px;cursor:pointer">
+          <input type="checkbox" id="settingsNotificationsEnabled" style="width:15px;height:15px;accent-color:var(--accent)">
+          <span data-i18n="settings_label_notifications">Browser notifications</span>
+        </label>
+        <div style="font-size:11px;color:var(--muted);margin-top:4px" data-i18n="settings_desc_notifications">Show a system notification when a response completes while the tab is in the background.</div>
+      </div>
       <div class="settings-field">
         <label style="display:flex;align-items:center;gap:8px;cursor:pointer">
           <input type="checkbox" id="settingsShowTokenUsage" style="width:15px;height:15px;accent-color:var(--accent)">
-          Show token usage after responses
+          <span data-i18n="settings_label_token_usage">Show token usage after responses</span>
         </label>
-        <div style="font-size:11px;color:var(--muted);margin-top:4px">Displays input/output token count below each assistant reply. Also toggled with <code>/usage</code>.</div>
+        <div style="font-size:11px;color:var(--muted);margin-top:4px" data-i18n="settings_desc_token_usage">Displays input/output token count below each assistant reply. Also toggled with <code>/usage</code>.</div>
       </div>
       <div class="settings-field">
         <label style="display:flex;align-items:center;gap:8px;cursor:pointer">
           <input type="checkbox" id="settingsShowCliSessions" style="width:15px;height:15px;accent-color:var(--accent)">
-          Show CLI sessions in sidebar
+          <span data-i18n="settings_label_cli_sessions">Show agent sessions in sidebar</span>
         </label>
-        <div style="font-size:11px;color:var(--muted);margin-top:4px">Merges sessions from the Hermes CLI (state.db) into the session list. Click a CLI session to import it and continue the conversation.</div>
+        <div style="font-size:11px;color:var(--muted);margin-top:4px" data-i18n="settings_desc_cli_sessions">Merges sessions from Hermes agent platforms (CLI, Telegram, Discord, Slack, etc.) into the session list. Agent sessions are view-only.</div>
       </div>
       <div class="settings-field">
         <label style="display:flex;align-items:center;gap:8px;cursor:pointer">
           <input type="checkbox" id="settingsSyncInsights" style="width:15px;height:15px;accent-color:var(--accent)">
-          Sync usage to /insights
+          <span data-i18n="settings_label_sync_insights">Sync usage to /insights</span>
         </label>
-        <div style="font-size:11px;color:var(--muted);margin-top:4px">Mirrors WebUI token usage to state.db so <code>hermes /insights</code> includes browser session data. Off by default.</div>
+        <div style="font-size:11px;color:var(--muted);margin-top:4px" data-i18n="settings_desc_sync_insights">Mirrors WebUI token usage to state.db so <code>hermes /insights</code> includes browser session data. Off by default.</div>
+      </div>
+      <div class="settings-field">
+        <label style="display:flex;align-items:center;gap:8px;cursor:pointer">
+          <input type="checkbox" id="settingsCheckUpdates" style="width:15px;height:15px;accent-color:var(--accent)">
+          <span data-i18n="settings_label_check_updates">Check for updates</span>
+        </label>
+        <div style="font-size:11px;color:var(--muted);margin-top:4px" data-i18n="settings_desc_check_updates">Show a banner when newer versions of the WebUI or Agent are available. Runs a background git fetch periodically.</div>
+      </div>
+      <div class="settings-field">
+        <label for="settingsBotName" data-i18n="settings_label_bot_name">Assistant Name</label>
+        <div style="font-size:11px;color:var(--muted);margin-bottom:6px" data-i18n="settings_desc_bot_name">Display name for the assistant throughout the UI. Defaults to Hermes.</div>
+        <input type="text" id="settingsBotName" placeholder="Hermes" maxlength="64" style="width:100%;padding:8px;background:var(--code-bg);color:var(--text);border:1px solid var(--border2);border-radius:6px;font-size:13px">
       </div>
       <div class="settings-field" style="border-top:1px solid var(--border);padding-top:12px;margin-top:8px">
-        <label for="settingsPassword">Access Password</label>
-        <div style="font-size:11px;color:var(--muted);margin-bottom:6px">Enter a new password to set or change it. Leave blank to keep current setting.</div>
-        <input type="password" id="settingsPassword" placeholder="Enter new password…" style="width:100%;padding:8px;background:var(--code-bg);color:var(--text);border:1px solid var(--border2);border-radius:6px;font-size:13px">
+        <label for="settingsPassword" data-i18n="settings_label_password">Access Password</label>
+        <div style="font-size:11px;color:var(--muted);margin-bottom:6px" data-i18n="settings_desc_password">Enter a new password to set or change it. Leave blank to keep current setting.</div>
+        <input type="password" id="settingsPassword" placeholder="Enter new password…" data-i18n-placeholder="password_placeholder" style="width:100%;padding:8px;background:var(--code-bg);color:var(--text);border:1px solid var(--border2);border-radius:6px;font-size:13px">
       </div>
-      <button class="sm-btn" onclick="saveSettings()" style="margin-top:12px;width:100%;padding:8px;font-weight:600">Save Settings</button>
-      <button class="sm-btn" id="btnDisableAuth" onclick="disableAuth()" style="margin-top:6px;width:100%;padding:8px;font-weight:600;color:#e8a030;border-color:rgba(232,160,48,.3);display:none">Disable Auth</button>
-      <button class="sm-btn" id="btnSignOut" onclick="signOut()" style="margin-top:6px;width:100%;padding:8px;font-weight:600;color:var(--accent);border-color:rgba(233,69,96,.3);display:none">Sign Out</button>
+      <button class="sm-btn" onclick="saveSettings()" style="margin-top:12px;width:100%;padding:8px;font-weight:600" data-i18n="settings_save_btn">Save Settings</button>
+      <button class="sm-btn" id="btnDisableAuth" onclick="disableAuth()" style="margin-top:6px;width:100%;padding:8px;font-weight:600;color:#e8a030;border-color:rgba(232,160,48,.3);display:none" data-i18n="disable_auth">Disable Auth</button>
+      <button class="sm-btn" id="btnSignOut" onclick="signOut()" style="margin-top:6px;width:100%;padding:8px;font-weight:600;color:var(--accent);border-color:rgba(233,69,96,.3);display:none" data-i18n="sign_out">Sign Out</button>
     </div>
   </div>
 </div>
-<div class="mobile-overlay" id="mobileOverlay" onclick="closeMobileSidebar()"></div>
+<div class="mobile-overlay" id="mobileOverlay" onclick="closeMobileSidebar();closeMobileFiles()"></div>
 <nav class="mobile-bottom-nav" id="mobileBottomNav">
   <button class="mobile-nav-btn active" data-panel="chat" onclick="mobileSwitchPanel('chat')">
     <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><path d="M21 15a2 2 0 0 1-2 2H7l-4 4V5a2 2 0 0 1 2-2h14a2 2 0 0 1 2 2z"/></svg>
-    <span>Chat</span>
+    <span data-i18n="tab_chat">Chat</span>
   </button>
   <button class="mobile-nav-btn" data-panel="tasks" onclick="mobileSwitchPanel('tasks')">
     <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><rect x="3" y="4" width="18" height="18" rx="2"/><line x1="16" y1="2" x2="16" y2="6"/><line x1="8" y1="2" x2="8" y2="6"/><line x1="3" y1="10" x2="21" y2="10"/></svg>
-    <span>Tasks</span>
+    <span data-i18n="tab_tasks">Tasks</span>
   </button>
   <button class="mobile-nav-btn" data-panel="skills" onclick="mobileSwitchPanel('skills')">
     <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><path d="M12 2L2 7l10 5 10-5-10-5z"/><path d="M2 17l10 5 10-5"/><path d="M2 12l10 5 10-5"/></svg>
-    <span>Skills</span>
+    <span data-i18n="tab_skills">Skills</span>
   </button>
   <button class="mobile-nav-btn" data-panel="memory" onclick="mobileSwitchPanel('memory')">
     <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><path d="M12 2a7 7 0 0 1 7 7c0 2.5-1.3 4.7-3.2 6H8.2C6.3 13.7 5 11.5 5 9a7 7 0 0 1 7-7z"/><line x1="9" y1="17" x2="15" y2="17"/><line x1="10" y1="20" x2="14" y2="20"/></svg>
-    <span>Memory</span>
+    <span data-i18n="tab_memory">Memory</span>
   </button>
   <button class="mobile-nav-btn" data-panel="workspaces" onclick="mobileSwitchPanel('workspaces')">
     <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><path d="M2 4h8l2 2h10v14H2z"/></svg>
-    <span>Spaces</span>
+    <span data-i18n="tab_workspaces">Spaces</span>
   </button>
 </nav>
 <div class="toast" id="toast"></div>
+<script src="/static/i18n.js"></script>
+<script src="/static/icons.js"></script>
 <script src="/static/ui.js"></script>
 <script src="/static/workspace.js"></script>
 <script src="/static/sessions.js"></script>
@@ -404,5 +472,21 @@
 <script src="/static/messages.js"></script>
 <script src="/static/panels.js"></script>
 <script src="/static/boot.js"></script>
+<div class="app-dialog-overlay" id="appDialogOverlay" style="display:none" aria-hidden="true">
+  <div class="app-dialog" id="appDialog" role="dialog" aria-modal="true" aria-labelledby="appDialogTitle" aria-describedby="appDialogDesc">
+    <div class="app-dialog-header">
+      <div class="app-dialog-title" id="appDialogTitle">Confirm action</div>
+      <button class="app-dialog-close" id="appDialogClose" type="button" aria-label="Close dialog">
+        <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+      </button>
+    </div>
+    <div class="app-dialog-desc" id="appDialogDesc"></div>
+    <input class="app-dialog-input" id="appDialogInput" type="text" style="display:none">
+    <div class="app-dialog-actions">
+      <button class="app-dialog-btn" id="appDialogCancel" type="button" data-i18n="cancel">Cancel</button>
+      <button class="app-dialog-btn confirm" id="appDialogConfirm" type="button">Confirm</button>
+    </div>
+  </div>
+</div>
 </body>
-</html>
+</html>

static/login.js

@@ -0,0 +1,55 @@
+/* Login page — external script, no inline handlers.
+ * Loaded by the /login route. Reads data attributes from the form for
+ * i18n strings so the server does not need to inject JS literals.
+ */
+document.addEventListener('DOMContentLoaded', function () {
+  var form = document.getElementById('login-form');
+  var input = document.getElementById('pw');
+
+  if (!form || !input) return;
+
+  var invalidPw = form.getAttribute('data-invalid-pw') || 'Invalid password';
+  var connFailed = form.getAttribute('data-conn-failed') || 'Connection failed';
+
+  function showErr(msg) {
+    var err = document.getElementById('err');
+    if (err) { err.textContent = msg; err.style.display = 'block'; }
+  }
+
+  function hideErr() {
+    var err = document.getElementById('err');
+    if (err) { err.style.display = 'none'; }
+  }
+
+  async function doLogin(e) {
+    e.preventDefault();
+    var pw = input.value;
+    hideErr();
+    try {
+      var res = await fetch('/api/auth/login', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ password: pw }),
+        credentials: 'include',
+      });
+      var data = {};
+      try { data = await res.json(); } catch (_) {}
+      if (res.ok && data.ok) {
+        window.location.href = '/';
+      } else {
+        showErr(data.error || invalidPw);
+      }
+    } catch (ex) {
+      showErr(connFailed);
+    }
+  }
+
+  form.addEventListener('submit', doLogin);
+
+  input.addEventListener('keydown', function (e) {
+    if (e.key === 'Enter') {
+      e.preventDefault();
+      doLogin(e);
+    }
+  });
+});

static/messages.js

@@ -24,7 +24,7 @@ async function send(){
   setStatus(S.pendingFiles&&S.pendingFiles.length?'Uploading…':'Sending…');
   let uploaded=[];
   try{uploaded=await uploadPendingFiles();}
-  catch(e){if(!text){setStatus(`❌ ${e.message}`);return;}}
+  catch(e){if(!text){setStatus(`Upload error: ${e.message}`);return;}}
 
   let msgText=text;
   if(uploaded.length&&!msgText)msgText=`I've uploaded ${uploaded.length} file(s): ${uploaded.join(', ')}`;
@@ -69,12 +69,12 @@ async function send(){
     markInflight(activeSid, streamId);
     // Show Cancel button
     const cancelBtn=$('btnCancel');
-    if(cancelBtn) cancelBtn.style.display='';
+    if(cancelBtn) cancelBtn.style.display='inline-flex';
   }catch(e){
     delete INFLIGHT[activeSid];
     stopApprovalPolling();
     // Only hide approval card if it belongs to the session that just finished
-    if(!_approvalSessionId || _approvalSessionId===activeSid) hideApprovalCard();removeThinking();
+    if(!_approvalSessionId || _approvalSessionId===activeSid) hideApprovalCard(true);removeThinking();
     S.messages.push({role:'assistant',content:`**Error:** ${e.message}`});
     renderMessages();setBusy(false);setStatus('Error: '+e.message);
     return;
@@ -84,6 +84,11 @@ async function send(){
   let assistantText='';
   let assistantRow=null;
   let assistantBody=null;
+  // Thinking tag patterns for streaming display
+  const _thinkPairs=[
+    {open:'<think>',close:'</think>'},
+    {open:'<|channel>thought\n',close:'<channel|>'}
+  ];
 
   function ensureAssistantRow(){
     if(assistantRow)return;
@@ -93,8 +98,9 @@ async function send(){
     assistantRow=document.createElement('div');assistantRow.className='msg-row';
     assistantBody=document.createElement('div');assistantBody.className='msg-body';
     const role=document.createElement('div');role.className='msg-role assistant';
-    const icon=document.createElement('div');icon.className='role-icon assistant';icon.textContent='H';
-    const lbl=document.createElement('span');lbl.style.fontSize='12px';lbl.textContent='Hermes';
+    const _bn=window._botName||'Hermes';
+    const icon=document.createElement('div');icon.className='role-icon assistant';icon.textContent=_bn.charAt(0).toUpperCase();
+    const lbl=document.createElement('span');lbl.style.fontSize='12px';lbl.textContent=_bn;
     role.appendChild(icon);role.appendChild(lbl);
     assistantRow.appendChild(role);assistantRow.appendChild(assistantBody);
     $('msgInner').appendChild(assistantRow);
@@ -105,12 +111,36 @@ async function send(){
 
   // rAF-throttled rendering: buffer tokens, render at most once per frame
   let _renderPending=false;
+  // Extract display text from assistantText, stripping completed thinking blocks
+  // and hiding content still inside an open thinking block.
+  function _streamDisplay(){
+    const raw=assistantText;
+    for(const {open,close} of _thinkPairs){
+      if(raw.startsWith(open)){
+        const ci=raw.indexOf(close,open.length);
+        if(ci!==-1){
+          // Thinking block complete — strip it, show the rest
+          return raw.slice(ci+close.length).replace(/^\s+/,'');
+        }
+        // Still inside thinking block — show placeholder
+        return '';
+      }
+      // Hide partial tag prefixes while streaming so users don't see
+      // `<thi`, `<think`, etc. before the model finishes the token.
+      if(open.startsWith(raw)) return '';
+    }
+    return raw;
+  }
   function _scheduleRender(){
     if(_renderPending) return;
     _renderPending=true;
     requestAnimationFrame(()=>{
       _renderPending=false;
-      if(assistantBody) assistantBody.innerHTML=renderMd(assistantText);
+      if(assistantBody){
+        const txt=_streamDisplay();
+        const isThinking=!txt&&assistantText.length>0;
+        assistantBody.innerHTML=txt?renderMd(txt):(isThinking?'<span style="color:var(--muted);font-size:13px">Thinking\u2026</span>':'');
+      }
       scrollIfPinned();
     });
   }
@@ -142,6 +172,8 @@ async function send(){
       const d=JSON.parse(e.data);
       d._session_id=activeSid;
       showApprovalCard(d);
+      playNotificationSound();
+      sendBrowserNotification('Approval required',d.description||'Tool approval needed');
     });
 
     source.addEventListener('done',e=>{
@@ -150,7 +182,7 @@ async function send(){
       delete INFLIGHT[activeSid];
       clearInflight();
       stopApprovalPolling();
-      if(!_approvalSessionId || _approvalSessionId===activeSid) hideApprovalCard();
+      if(!_approvalSessionId || _approvalSessionId===activeSid) hideApprovalCard(true);
       if(S.session&&S.session.session_id===activeSid){
         S.activeStreamId=null;
         const _cb=$('btnCancel');if(_cb)_cb.style.display='none';
@@ -175,6 +207,8 @@ async function send(){
         syncTopbar();renderMessages();loadDir('.');
       }
       renderSessionList();setBusy(false);setStatus('');
+      playNotificationSound();
+      sendBrowserNotification('Response complete',assistantText?assistantText.slice(0,100):'Task finished');
     });
 
     source.addEventListener('compressed',e=>{
@@ -193,19 +227,18 @@ async function send(){
       // This is distinct from the SSE network 'error' event below.
       source.close();
       delete INFLIGHT[activeSid];clearInflight();stopApprovalPolling();
-      if(!_approvalSessionId||_approvalSessionId===activeSid) hideApprovalCard();
+      if(!_approvalSessionId||_approvalSessionId===activeSid) hideApprovalCard(true);
       if(S.session&&S.session.session_id===activeSid){
         S.activeStreamId=null;const _cbe=$('btnCancel');if(_cbe)_cbe.style.display='none';
         clearLiveToolCards();if(!assistantText)removeThinking();
         try{
           const d=JSON.parse(e.data);
           const isRateLimit=d.type==='rate_limit';
-          const icon=isRateLimit?'⏱️':'⚠️';
           const label=isRateLimit?'Rate limit reached':'Error';
           const hint=d.hint?`\n\n*${d.hint}*`:'';
-          S.messages.push({role:'assistant',content:`**${icon} ${label}:** ${d.message}${hint}`});
+          S.messages.push({role:'assistant',content:`**${label}:** ${d.message}${hint}`});
         }catch(_){
-          S.messages.push({role:'assistant',content:'**⚠️ Error:** An error occurred. Check server logs.'});
+          S.messages.push({role:'assistant',content:'**Error:** An error occurred. Check server logs.'});
         }
         renderMessages();
       }else if(typeof trackBackgroundError==='function'){
@@ -222,7 +255,7 @@ async function send(){
       try{
         const d=JSON.parse(e.data);
         // Show as a small inline notice, not a full error
-        setStatus(`⚠️ ${d.message||'Warning'}`);
+        setStatus(`${d.message||'Warning'}`);
         // If it's a fallback notice, show it briefly then clear
         if(d.type==='fallback') setTimeout(()=>setStatus(''),4000);
       }catch(_){}
@@ -253,7 +286,7 @@ async function send(){
     source.addEventListener('cancel',e=>{
       source.close();
       delete INFLIGHT[activeSid];clearInflight();stopApprovalPolling();
-      if(!_approvalSessionId||_approvalSessionId===activeSid) hideApprovalCard();
+      if(!_approvalSessionId||_approvalSessionId===activeSid) hideApprovalCard(true);
       if(S.session&&S.session.session_id===activeSid){
         S.activeStreamId=null;const _cbc=$('btnCancel');if(_cbc)_cbc.style.display='none';
       }
@@ -262,13 +295,14 @@ async function send(){
         S.messages.push({role:'assistant',content:'*Task cancelled.*'});renderMessages();
       }
       renderSessionList();
-      if(!S.session||!INFLIGHT[S.session.session_id]){setBusy(false);setStatus('');}
+      // Always clear busy state and status when cancel event is received
+      setBusy(false);setStatus('');
     });
   }
 
   function _handleStreamError(){
     delete INFLIGHT[activeSid];clearInflight();stopApprovalPolling();
-    if(!_approvalSessionId||_approvalSessionId===activeSid) hideApprovalCard();
+    if(!_approvalSessionId||_approvalSessionId===activeSid) hideApprovalCard(true);
     if(S.session&&S.session.session_id===activeSid){
       S.activeStreamId=null;const _cbe=$('btnCancel');if(_cbe)_cbe.style.display='none';
       clearLiveToolCards();if(!assistantText)removeThinking();
@@ -308,11 +342,45 @@ function autoResize(){const el=$('msg');el.style.height='auto';el.style.height=M
 
 // ── Approval polling ──
 let _approvalPollTimer = null;
+let _approvalHideTimer = null;
+let _approvalVisibleSince = 0;
+let _approvalSignature = '';
+const APPROVAL_MIN_VISIBLE_MS = 30000;
 
 // showApprovalCard moved above respondApproval
 
-function hideApprovalCard() {
-  $("approvalCard").classList.remove("visible");
+function _clearApprovalHideTimer() {
+  if (_approvalHideTimer) {
+    clearTimeout(_approvalHideTimer);
+    _approvalHideTimer = null;
+  }
+}
+
+function _resetApprovalCardState() {
+  _clearApprovalHideTimer();
+  _approvalVisibleSince = 0;
+  _approvalSignature = '';
+}
+
+function hideApprovalCard(force=false) {
+  const card = $("approvalCard");
+  if (!card) return;
+  if (!force && _approvalVisibleSince) {
+    const remaining = APPROVAL_MIN_VISIBLE_MS - (Date.now() - _approvalVisibleSince);
+    if (remaining > 0) {
+      const scheduledSignature = _approvalSignature;
+      _clearApprovalHideTimer();
+      _approvalHideTimer = setTimeout(() => {
+        _approvalHideTimer = null;
+        if (_approvalSignature !== scheduledSignature) return;
+        hideApprovalCard(true);
+      }, remaining);
+      return;
+    }
+  }
+  _approvalSessionId = null;
+  _resetApprovalCardState();
+  card.classList.remove("visible");
   $("approvalCmd").textContent = "";
   $("approvalDesc").textContent = "";
 }
@@ -321,32 +389,56 @@ function hideApprovalCard() {
 let _approvalSessionId = null;
 
 function showApprovalCard(pending) {
-  $("approvalDesc").textContent = pending.description || "";
-  $("approvalCmd").textContent = pending.command || "";
   const keys = pending.pattern_keys || (pending.pattern_key ? [pending.pattern_key] : []);
-  $("approvalDesc").textContent = (pending.description || "") + (keys.length ? " [" + keys.join(", ") + "]" : "");
+  const desc = (pending.description || "") + (keys.length ? " [" + keys.join(", ") + "]" : "");
+  const cmd = pending.command || "";
+  const sig = JSON.stringify({desc, cmd, sid: pending._session_id || (S.session && S.session.session_id) || null});
+  const card = $("approvalCard");
+  const sameApproval = card.classList.contains("visible") && _approvalSignature === sig;
+  $("approvalDesc").textContent = desc;
+  $("approvalCmd").textContent = cmd;
   _approvalSessionId = pending._session_id || (S.session && S.session.session_id) || null;
-  $("approvalCard").classList.add("visible");
+  _approvalSignature = sig;
+  if (!sameApproval) {
+    _approvalVisibleSince = Date.now();
+    _clearApprovalHideTimer();
+  }
+  // Re-enable buttons in case a previous approval disabled them
+  ["approvalBtnOnce","approvalBtnSession","approvalBtnAlways","approvalBtnDeny"].forEach(id => {
+    const b = $(id); if (b) { b.disabled = false; b.classList.remove("loading"); }
+  });
+  card.classList.add("visible");
+  if (!sameApproval) card.scrollIntoView({block:"nearest", behavior:"smooth"});
+  // Apply current locale to data-i18n elements inside the card
+  if (typeof applyLocaleToDOM === "function") applyLocaleToDOM();
+  // Focus Allow once button so Enter works immediately
+  const onceBtn = $("approvalBtnOnce");
+  if (onceBtn) setTimeout(() => onceBtn.focus(), 50);
 }
 
 async function respondApproval(choice) {
   const sid = _approvalSessionId || (S.session && S.session.session_id);
   if (!sid) return;
-  hideApprovalCard();
+  // Disable all buttons immediately to prevent double-submit
+  ["approvalBtnOnce","approvalBtnSession","approvalBtnAlways","approvalBtnDeny"].forEach(id => {
+    const b = $(id);
+    if (b) { b.disabled = true; if (b.id === "approvalBtn" + choice.charAt(0).toUpperCase() + choice.slice(1)) b.classList.add("loading"); }
+  });
   _approvalSessionId = null;
+  hideApprovalCard(true);
   try {
     await api("/api/approval/respond", {
       method: "POST",
       body: JSON.stringify({ session_id: sid, choice })
     });
-  } catch(e) { setStatus("Approval error: " + e.message); }
+  } catch(e) { setStatus(t("approval_responding") + " " + e.message); }
 }
 
 function startApprovalPolling(sid) {
   stopApprovalPolling();
   _approvalPollTimer = setInterval(async () => {
     if (!S.busy || !S.session || S.session.session_id !== sid) {
-      stopApprovalPolling(); hideApprovalCard(); return;
+      stopApprovalPolling(); hideApprovalCard(true); return;
     }
     try {
       const data = await api("/api/approval/pending?session_id=" + encodeURIComponent(sid));
@@ -359,5 +451,36 @@ function startApprovalPolling(sid) {
 function stopApprovalPolling() {
   if (_approvalPollTimer) { clearInterval(_approvalPollTimer); _approvalPollTimer = null; }
 }
-// ── Panel navigation (Chat / Tasks / Skills / Memory) ──
 
+// ── Notifications and Sound ──────────────────────────────────────────────────
+
+function playNotificationSound(){
+  if(!window._soundEnabled) return;
+  try{
+    const ctx=new (window.AudioContext||window.webkitAudioContext)();
+    const osc=ctx.createOscillator();
+    const gain=ctx.createGain();
+    osc.connect(gain);gain.connect(ctx.destination);
+    osc.type='sine';osc.frequency.setValueAtTime(660,ctx.currentTime);
+    osc.frequency.setValueAtTime(880,ctx.currentTime+0.1);
+    gain.gain.setValueAtTime(0.3,ctx.currentTime);
+    gain.gain.exponentialRampToValueAtTime(0.01,ctx.currentTime+0.3);
+    osc.start(ctx.currentTime);osc.stop(ctx.currentTime+0.3);
+    osc.onended=()=>ctx.close();
+  }catch(e){console.warn('Notification sound failed:',e);}
+}
+
+function sendBrowserNotification(title,body){
+  if(!window._notificationsEnabled||!document.hidden) return;
+  if(!('Notification' in window)) return;
+  const botName=window._botName||'Hermes';
+  if(Notification.permission==='granted'){
+    new Notification(title||botName,{body:body});
+  }else if(Notification.permission!=='denied'){
+    Notification.requestPermission().then(p=>{
+      if(p==='granted') new Notification(title||botName,{body:body});
+    });
+  }
+}
+
+// ── Panel navigation (Chat / Tasks / Skills / Memory) ──

static/panels.js

@@ -296,7 +296,8 @@ async function cronEditSave(id) {
 }
 
 async function cronDelete(id) {
-  if (!confirm('Delete this cron job? This cannot be undone.')) return;
+  const _delCron=await showConfirmDialog({title:'Delete cron job',message:'This cannot be undone.',confirmLabel:'Delete',danger:true,focusCancel:true});
+  if(!_delCron) return;
   try {
     await api('/api/crons/delete', {method:'POST', body: JSON.stringify({job_id: id})});
     showToast('Job deleted');
@@ -339,7 +340,8 @@ function loadTodos() {
 
 async function clearConversation() {
   if(!S.session) return;
-  if(!confirm('Clear all messages in this conversation? This cannot be undone.')) return;
+  const _clrMsg=await showConfirmDialog({title:'Clear conversation',message:'Clear all messages? This cannot be undone.',confirmLabel:'Clear',danger:true,focusCancel:true});
+  if(!_clrMsg) return;
   try {
     const data = await api('/api/session/clear', {method:'POST',
       body: JSON.stringify({session_id: S.session.session_id})});
@@ -644,7 +646,8 @@ async function addWorkspace(){
 }
 
 async function removeWorkspace(path){
-  if(!confirm(`Remove workspace "${path}"?`))return;
+  const _rmWs=await showConfirmDialog({title:'Remove workspace',message:`Remove "${path}"?`,confirmLabel:'Remove',danger:true,focusCancel:true});
+  if(!_rmWs) return;
   try{
     const data=await api('/api/workspaces/remove',{method:'POST',body:JSON.stringify({path})});
     _workspaceList=data.workspaces;
@@ -841,6 +844,8 @@ function toggleProfileForm() {
   if (form.style.display !== 'none') {
     $('profileFormName').value = '';
     $('profileFormClone').checked = false;
+    if ($('profileFormBaseUrl')) $('profileFormBaseUrl').value = '';
+    if ($('profileFormApiKey')) $('profileFormApiKey').value = '';
     const errEl = $('profileFormError');
     if (errEl) errEl.style.display = 'none';
     $('profileFormName').focus();
@@ -854,7 +859,15 @@ async function submitProfileCreate() {
   if (!name) { errEl.textContent = 'Name is required'; errEl.style.display = ''; return; }
   if (!/^[a-z0-9][a-z0-9_-]{0,63}$/.test(name)) { errEl.textContent = 'Lowercase letters, numbers, hyphens, underscores only'; errEl.style.display = ''; return; }
   try {
-    await api('/api/profile/create', { method: 'POST', body: JSON.stringify({ name, clone_config: cloneConfig }) });
+    const baseUrl = (($('profileFormBaseUrl') && $('profileFormBaseUrl').value) || '').trim();
+    const apiKey = (($('profileFormApiKey') && $('profileFormApiKey').value) || '').trim();
+    if (baseUrl && !/^https?:\/\//.test(baseUrl)) {
+      errEl.textContent = 'Base URL must start with http:// or https://'; errEl.style.display = ''; return;
+    }
+    const payload = { name, clone_config: cloneConfig };
+    if (baseUrl) payload.base_url = baseUrl;
+    if (apiKey) payload.api_key = apiKey;
+    await api('/api/profile/create', { method: 'POST', body: JSON.stringify(payload) });
     toggleProfileForm();
     await loadProfilesPanel();
     showToast('Profile created: ' + name);
@@ -862,7 +875,8 @@ async function submitProfileCreate() {
 }
 
 async function deleteProfile(name) {
-  if (!confirm(`Delete profile "${name}"? This removes all config, skills, memory, and sessions for this profile.`)) return;
+  const _delProf=await showConfirmDialog({title:`Delete profile "${name}"?`,message:'This removes all config, skills, memory, and sessions for this profile.',confirmLabel:'Delete',danger:true,focusCancel:true});
+  if(!_delProf) return;
   try {
     await api('/api/profile/delete', { method: 'POST', body: JSON.stringify({ name }) });
     await loadProfilesPanel();
@@ -975,6 +989,8 @@ function _markSettingsDirty(){
 async function loadSettingsPanel(){
   try{
     const settings=await api('/api/settings');
+    // Apply server-persisted locale immediately (overrides localStorage boot default)
+    if(settings.language && typeof setLocale==='function') setLocale(settings.language);
     // Populate model dropdown from /api/models
     const modelSel=$('settingsModel');
     if(modelSel){
@@ -995,33 +1011,41 @@ async function loadSettingsPanel(){
       modelSel.value=settings.default_model||'';
       modelSel.addEventListener('change',_markSettingsDirty,{once:false});
     }
-    // Populate workspace dropdown from /api/workspaces
-    const wsSel=$('settingsWorkspace');
-    if(wsSel){
-      wsSel.innerHTML='';
-      try{
-        const wsData=await api('/api/workspaces');
-        for(const w of (wsData.workspaces||[])){
-          const opt=document.createElement('option');
-          opt.value=w.path;opt.textContent=w.name||w.path;
-          wsSel.appendChild(opt);
-        }
-      }catch(e){}
-      wsSel.value=settings.default_workspace||'';
-      wsSel.addEventListener('change',_markSettingsDirty,{once:false});
-    }
     // Send key preference
     const sendKeySel=$('settingsSendKey');
     if(sendKeySel){sendKeySel.value=settings.send_key||'enter';sendKeySel.addEventListener('change',_markSettingsDirty,{once:false});}
     // Theme preference
     const themeSel=$('settingsTheme');
     if(themeSel){themeSel.value=settings.theme||'dark';themeSel.addEventListener('change',_markSettingsDirty,{once:false});}
+    // Language preference — populate from LOCALES bundle
+    const langSel=$('settingsLanguage');
+    if(langSel){
+      langSel.innerHTML='';
+      if(typeof LOCALES!=='undefined'){
+        for(const [code,bundle] of Object.entries(LOCALES)){
+          const opt=document.createElement('option');
+          opt.value=code;opt.textContent=bundle._label||code;
+          langSel.appendChild(opt);
+        }
+      }
+      langSel.value=settings.language||'en';
+      langSel.addEventListener('change',_markSettingsDirty,{once:false});
+    }
     const showUsageCb=$('settingsShowTokenUsage');
     if(showUsageCb){showUsageCb.checked=!!settings.show_token_usage;showUsageCb.addEventListener('change',_markSettingsDirty,{once:false});}
     const showCliCb=$('settingsShowCliSessions');
     if(showCliCb){showCliCb.checked=!!settings.show_cli_sessions;showCliCb.addEventListener('change',_markSettingsDirty,{once:false});}
     const syncCb=$('settingsSyncInsights');
     if(syncCb){syncCb.checked=!!settings.sync_to_insights;syncCb.addEventListener('change',_markSettingsDirty,{once:false});}
+    const updateCb=$('settingsCheckUpdates');
+    if(updateCb){updateCb.checked=settings.check_for_updates!==false;updateCb.addEventListener('change',_markSettingsDirty,{once:false});}
+    const soundCb=$('settingsSoundEnabled');
+    if(soundCb){soundCb.checked=!!settings.sound_enabled;soundCb.addEventListener('change',_markSettingsDirty,{once:false});}
+    const notifCb=$('settingsNotificationsEnabled');
+    if(notifCb){notifCb.checked=!!settings.notifications_enabled;notifCb.addEventListener('change',_markSettingsDirty,{once:false});}
+    // Bot name
+    const botNameField=$('settingsBotName');
+    if(botNameField){botNameField.value=settings.bot_name||'Hermes';botNameField.addEventListener('input',_markSettingsDirty,{once:false});}
     // Password field: always blank (we don't send hash back)
     const pwField=$('settingsPassword');
     if(pwField){pwField.value='';pwField.addEventListener('input',_markSettingsDirty,{once:false});}
@@ -1035,33 +1059,43 @@ async function loadSettingsPanel(){
       if(disableBtn) disableBtn.style.display=active?'':'none';
     }catch(e){}
   }catch(e){
-    showToast('Failed to load settings: '+e.message);
+    showToast(t('settings_load_failed')+e.message);
   }
 }
 
 async function saveSettings(andClose){
   const model=($('settingsModel')||{}).value;
-  const workspace=($('settingsWorkspace')||{}).value;
   const sendKey=($('settingsSendKey')||{}).value;
   const showTokenUsage=!!($('settingsShowTokenUsage')||{}).checked;
   const showCliSessions=!!($('settingsShowCliSessions')||{}).checked;
   const pw=($('settingsPassword')||{}).value;
   const theme=($('settingsTheme')||{}).value||'dark';
+  const language=($('settingsLanguage')||{}).value||'en';
   const body={};
   if(model) body.default_model=model;
-  if(workspace) body.default_workspace=workspace;
+
   if(sendKey) body.send_key=sendKey;
   body.theme=theme;
+  body.language=language;
   body.show_token_usage=showTokenUsage;
   body.show_cli_sessions=showCliSessions;
   body.sync_to_insights=!!($('settingsSyncInsights')||{}).checked;
+  body.check_for_updates=!!($('settingsCheckUpdates')||{}).checked;
+  body.sound_enabled=!!($('settingsSoundEnabled')||{}).checked;
+  body.notifications_enabled=!!($('settingsNotificationsEnabled')||{}).checked;
+  const botName=(($('settingsBotName')||{}).value||'').trim();
+  body.bot_name=botName||'Hermes';
   // Password: only act if the field has content; blank = leave auth unchanged
   if(pw && pw.trim()){
     try{
       await api('/api/settings',{method:'POST',body:JSON.stringify({...body,_set_password:pw.trim()})});
       window._sendKey=sendKey||'enter';
       window._showTokenUsage=showTokenUsage;
-      showToast('Settings saved (password set — login now required)');
+      window._soundEnabled=body.sound_enabled;
+      window._notificationsEnabled=body.notifications_enabled;
+      if(typeof setLocale==='function') setLocale(language);
+      if(typeof applyLocaleToDOM==='function') applyLocaleToDOM();
+      showToast(t('settings_saved_pw'));
       _settingsDirty=false; _settingsThemeOnOpen=theme;
       const bar=$('settingsUnsavedBar'); if(bar) bar.style.display='none';
       $('settingsOverlay').style.display='none';
@@ -1073,14 +1107,23 @@ async function saveSettings(andClose){
     window._sendKey=sendKey||'enter';
     window._showTokenUsage=showTokenUsage;
     window._showCliSessions=showCliSessions;
+    window._soundEnabled=body.sound_enabled;
+    window._notificationsEnabled=body.notifications_enabled;
+    window._botName=body.bot_name;
+    if(typeof applyBotName==='function') applyBotName();
+    if(typeof setLocale==='function') setLocale(language);
+    if(typeof applyLocaleToDOM==='function') applyLocaleToDOM();
+    // Restart gateway SSE when agent session setting changes
+    if(typeof startGatewaySSE==='function'){if(showCliSessions)startGatewaySSE();else if(typeof stopGatewaySSE==='function')stopGatewaySSE();}
     _settingsDirty=false; _settingsThemeOnOpen=theme;
     const bar=$('settingsUnsavedBar'); if(bar) bar.style.display='none';
     renderMessages();
+    if(typeof syncTopbar==='function') syncTopbar();
     if(typeof renderSessionList==='function') renderSessionList();
-    showToast('Settings saved');
+    showToast(t('settings_saved'));
     $('settingsOverlay').style.display='none';
   }catch(e){
-    showToast('Save failed: '+e.message);
+    showToast(t('settings_save_failed')+e.message);
   }
 }
 
@@ -1094,7 +1137,8 @@ async function signOut(){
 }
 
 async function disableAuth(){
-  if(!confirm('Disable password protection? Anyone will be able to access this instance.')) return;
+  const _disAuth=await showConfirmDialog({title:'Disable password protection',message:'Anyone will be able to access this instance.',confirmLabel:'Disable',danger:true,focusCancel:true});
+  if(!_disAuth) return;
   try{
     await api('/api/settings',{method:'POST',body:JSON.stringify({_clear_password:true})});
     showToast('Auth disabled — password protection removed');

static/sessions.js

@@ -7,8 +7,169 @@ const ICONS={
   unarchive:'<svg width="14" height="14" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.3"><rect x="1.5" y="2" width="13" height="3" rx="1"/><path d="M2.5 5v8h11V5"/><polyline points="6.5,7 8,5.5 9.5,7"/></svg>',
   dup:'<svg width="14" height="14" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.3"><rect x="4.5" y="4.5" width="8.5" height="8.5" rx="1.5"/><path d="M3 11.5V3h8.5"/></svg>',
   trash:'<svg width="14" height="14" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.3"><path d="M3.5 4.5h9M6.5 4.5V3h3v1.5M4.5 4.5v8.5h7v-8.5"/><line x1="7" y1="7" x2="7" y2="11"/><line x1="9" y1="7" x2="9" y2="11"/></svg>',
+  more:'<svg width="14" height="14" viewBox="0 0 16 16" fill="currentColor" stroke="none"><circle cx="8" cy="3" r="1.25"/><circle cx="8" cy="8" r="1.25"/><circle cx="8" cy="13" r="1.25"/></svg>',
 };
 
+
+let _sessionActionMenu = null;
+let _sessionActionAnchor = null;
+let _sessionActionSessionId = null;
+
+function closeSessionActionMenu(){
+  if(_sessionActionMenu){
+    _sessionActionMenu.remove();
+    _sessionActionMenu = null;
+  }
+  if(_sessionActionAnchor){
+    _sessionActionAnchor.classList.remove('active');
+    const row=_sessionActionAnchor.closest('.session-item');
+    if(row) row.classList.remove('menu-open');
+    _sessionActionAnchor = null;
+  }
+  _sessionActionSessionId = null;
+}
+
+function _positionSessionActionMenu(anchorEl){
+  if(!_sessionActionMenu || !anchorEl) return;
+  const rect=anchorEl.getBoundingClientRect();
+  const menuW=Math.min(280, Math.max(220, _sessionActionMenu.scrollWidth || 220));
+  let left=rect.right-menuW;
+  if(left<8) left=8;
+  if(left+menuW>window.innerWidth-8) left=window.innerWidth-menuW-8;
+  _sessionActionMenu.style.left=left+'px';
+  _sessionActionMenu.style.top='8px';
+  const menuH=_sessionActionMenu.offsetHeight || 0;
+  let top=rect.bottom+6;
+  if(top+menuH>window.innerHeight-8 && rect.top>menuH+12){
+    top=rect.top-menuH-6;
+  }
+  if(top<8) top=8;
+  _sessionActionMenu.style.top=top+'px';
+}
+
+function _buildSessionAction(label, meta, icon, onSelect, extraClass=''){
+  const opt=document.createElement('button');
+  opt.type='button';
+  opt.className='ws-opt session-action-opt'+(extraClass?` ${extraClass}`:'');
+  opt.innerHTML=
+    `<span class="ws-opt-action">`
+      + `<span class="ws-opt-icon">${icon}</span>`
+      + `<span class="session-action-copy">`
+        + `<span class="ws-opt-name">${esc(label)}</span>`
+        + (meta?`<span class="session-action-meta">${esc(meta)}</span>`:'')
+      + `</span>`
+    + `</span>`;
+  opt.onclick=async(e)=>{
+    e.preventDefault();
+    e.stopPropagation();
+    await onSelect();
+  };
+  return opt;
+}
+
+function _openSessionActionMenu(session, anchorEl){
+  if(_sessionActionMenu && _sessionActionSessionId===session.session_id && _sessionActionAnchor===anchorEl){
+    closeSessionActionMenu();
+    return;
+  }
+  closeSessionActionMenu();
+  const menu=document.createElement('div');
+  menu.className='session-action-menu open';
+  menu.appendChild(_buildSessionAction(
+    session.pinned?'Unpin conversation':'Pin conversation',
+    session.pinned?'Remove from the pinned section':'Keep this conversation at the top',
+    session.pinned?ICONS.pin:ICONS.unpin,
+    async()=>{
+      closeSessionActionMenu();
+      const newPinned=!session.pinned;
+      try{
+        await api('/api/session/pin',{method:'POST',body:JSON.stringify({session_id:session.session_id,pinned:newPinned})});
+        session.pinned=newPinned;
+        if(S.session&&S.session.session_id===session.session_id) S.session.pinned=newPinned;
+        renderSessionList();
+      }catch(err){showToast('Pin failed: '+err.message);}
+    },
+    session.pinned?'is-active':''
+  ));
+  menu.appendChild(_buildSessionAction(
+    'Move to project',
+    session.project_id?'Change which project this conversation belongs to':'Assign this conversation to a project',
+    ICONS.folder,
+    async()=>{
+      closeSessionActionMenu();
+      _showProjectPicker(session, anchorEl);
+    }
+  ));
+  menu.appendChild(_buildSessionAction(
+    session.archived?'Restore conversation':'Archive conversation',
+    session.archived?'Bring this conversation back into the main list':'Hide this conversation until archived is shown',
+    session.archived?ICONS.unarchive:ICONS.archive,
+    async()=>{
+      closeSessionActionMenu();
+      try{
+        await api('/api/session/archive',{method:'POST',body:JSON.stringify({session_id:session.session_id,archived:!session.archived})});
+        session.archived=!session.archived;
+        if(S.session&&S.session.session_id===session.session_id) S.session.archived=session.archived;
+        await renderSessionList();
+        showToast(session.archived?'Session archived':'Session restored');
+      }catch(err){showToast('Archive failed: '+err.message);}
+    }
+  ));
+  menu.appendChild(_buildSessionAction(
+    'Duplicate conversation',
+    'Create a copy with the same workspace and model',
+    ICONS.dup,
+    async()=>{
+      closeSessionActionMenu();
+      try{
+        const res=await api('/api/session/new',{method:'POST',body:JSON.stringify({workspace:session.workspace,model:session.model})});
+        if(res.session){
+          await api('/api/session/rename',{method:'POST',body:JSON.stringify({session_id:res.session.session_id,title:(session.title||'Untitled')+' (copy)'})});
+          await loadSession(res.session.session_id);
+          await renderSessionList();
+          showToast('Session duplicated');
+        }
+      }catch(err){showToast('Duplicate failed: '+err.message);}
+    }
+  ));
+  menu.appendChild(_buildSessionAction(
+    'Delete conversation',
+    'Permanently remove this conversation',
+    ICONS.trash,
+    async()=>{
+      closeSessionActionMenu();
+      await deleteSession(session.session_id);
+    },
+    'danger'
+  ));
+  document.body.appendChild(menu);
+  _sessionActionMenu = menu;
+  _sessionActionAnchor = anchorEl;
+  _sessionActionSessionId = session.session_id;
+  anchorEl.classList.add('active');
+  const row=anchorEl.closest('.session-item');
+  if(row) row.classList.add('menu-open');
+  _positionSessionActionMenu(anchorEl);
+}
+
+document.addEventListener('click',e=>{
+  if(!_sessionActionMenu) return;
+  if(_sessionActionMenu.contains(e.target)) return;
+  if(_sessionActionAnchor && _sessionActionAnchor.contains(e.target)) return;
+  closeSessionActionMenu();
+});
+document.addEventListener('scroll',e=>{
+  if(!_sessionActionMenu) return;
+  if(_sessionActionMenu.contains(e.target)) return;
+  closeSessionActionMenu();
+}, true);
+document.addEventListener('keydown',e=>{
+  if(e.key==='Escape' && _sessionActionMenu) closeSessionActionMenu();
+});
+window.addEventListener('resize',()=>{
+  if(_sessionActionMenu && _sessionActionAnchor) _positionSessionActionMenu(_sessionActionAnchor);
+});
+
 async function newSession(flash){
   MSG_QUEUE.length=0;updateQueueBadge();
   S.toolCalls=[];
@@ -45,7 +206,7 @@ async function loadSession(sid){
       if(tc&&tc.name) appendLiveToolCard(tc);
     }
     syncTopbar();await loadDir('.');renderMessages();appendThinking();
-    setBusy(true);setStatus('Hermes is thinking\u2026');
+    setBusy(true);setStatus((window._botName||'Hermes')+' is thinking\u2026');
     startApprovalPolling(sid);
   }else{
     MSG_QUEUE.length=0;updateQueueBadge();  // clear queue for the viewed session
@@ -87,6 +248,35 @@ async function renderSessionList(){
   }catch(e){console.warn('renderSessionList',e);}
 }
 
+// ── Gateway session SSE (real-time sync for agent sessions) ──
+let _gatewaySSE = null;
+
+function startGatewaySSE(){
+  stopGatewaySSE();
+  if(!window._showCliSessions) return;
+  try{
+    _gatewaySSE = new EventSource('/api/sessions/gateway/stream');
+    _gatewaySSE.addEventListener('sessions_changed', (ev) => {
+      try{
+        const data = JSON.parse(ev.data);
+        if(data.sessions){
+          renderSessionList(); // re-fetch and re-render
+        }
+      }catch(e){ /* ignore parse errors */ }
+    });
+    _gatewaySSE.onerror = () => {
+      // EventSource auto-reconnects; no action needed
+    };
+  }catch(e){ /* SSE not available */ }
+}
+
+function stopGatewaySSE(){
+  if(_gatewaySSE){
+    _gatewaySSE.close();
+    _gatewaySSE = null;
+  }
+}
+
 let _searchDebounceTimer = null;
 let _contentSearchResults = [];  // results from /api/sessions/search content scan
 
@@ -248,6 +438,7 @@ function renderSessionListFromCache(){
     const el=document.createElement('div');
     const isActive=S.session&&s.session_id===S.session.session_id;
     el.className='session-item'+(isActive?' active':'')+(isActive&&S.session&&S.session._flash?' new-flash':'')+(s.archived?' archived':'')+(s.is_cli_session?' cli-session':'');
+    if(s.source_tag) el.dataset.source=s.source_tag;
     if(isActive&&S.session&&S.session._flash)delete S.session._flash;
     const rawTitle=s.title||'Untitled';
     const tags=(rawTitle.match(/#[\w-]+/g)||[]);
@@ -314,7 +505,7 @@ function renderSessionListFromCache(){
     if(s.project_id){
       const proj=_allProjects.find(p=>p.project_id===s.project_id);
       if(proj){
-        if(!isActive) el.style.borderLeftColor=proj.color||'var(--blue)';
+        // project color shown via dot indicator, not left border
         const dot=document.createElement('span');
         dot.className='session-project-dot';
         dot.style.background=proj.color||'var(--blue)';
@@ -323,65 +514,21 @@ function renderSessionListFromCache(){
       }
     }
     el.appendChild(title);
-    // Action buttons overlay (appears on hover with gradient fade)
     const actions=document.createElement('div');
     actions.className='session-actions';
-    // Pin toggle
-    const pinBtn=document.createElement('button');
-    pinBtn.className='act-pin'+(s.pinned?' pinned':'');
-    pinBtn.innerHTML=s.pinned?ICONS.pin:ICONS.unpin;
-    pinBtn.title=s.pinned?'Unpin':'Pin to top';
-    pinBtn.onclick=async(e)=>{
-      e.stopPropagation();e.preventDefault();
-      const newPinned=!s.pinned;
-      try{
-        await api('/api/session/pin',{method:'POST',body:JSON.stringify({session_id:s.session_id,pinned:newPinned})});
-        s.pinned=newPinned;
-        if(S.session&&S.session.session_id===s.session_id) S.session.pinned=newPinned;
-        renderSessionList();
-      }catch(err){showToast('Pin failed: '+err.message);}
+    const menuBtn=document.createElement('button');
+    menuBtn.type='button';
+    menuBtn.className='session-actions-trigger';
+    menuBtn.title='Conversation actions';
+    menuBtn.setAttribute('aria-haspopup','menu');
+    menuBtn.setAttribute('aria-label','Conversation actions');
+    menuBtn.innerHTML=ICONS.more;
+    menuBtn.onclick=(e)=>{
+      e.stopPropagation();
+      e.preventDefault();
+      _openSessionActionMenu(s, menuBtn);
     };
-    actions.appendChild(pinBtn);
-    // Move to project
-    const move=document.createElement('button');
-    move.className='act-move';move.innerHTML=ICONS.folder;move.title='Move to project';
-    move.onclick=async(e)=>{e.stopPropagation();e.preventDefault();_showProjectPicker(s,move);};
-    actions.appendChild(move);
-    // Archive
-    const archive=document.createElement('button');
-    archive.className='act-archive';archive.innerHTML=s.archived?ICONS.unarchive:ICONS.archive;
-    archive.title=s.archived?'Unarchive':'Archive';
-    archive.onclick=async(e)=>{
-      e.stopPropagation();e.preventDefault();
-      try{
-        await api('/api/session/archive',{method:'POST',body:JSON.stringify({session_id:s.session_id,archived:!s.archived})});
-        s.archived=!s.archived;
-        if(S.session&&S.session.session_id===s.session_id) S.session.archived=s.archived;
-        await renderSessionList();
-        showToast(s.archived?'Session archived':'Session restored');
-      }catch(err){showToast('Archive failed: '+err.message);}
-    };
-    actions.appendChild(archive);
-    // Duplicate
-    const dup=document.createElement('button');
-    dup.className='act-dup';dup.innerHTML=ICONS.dup;dup.title='Duplicate';
-    dup.onclick=async(e)=>{
-      e.stopPropagation();e.preventDefault();
-      try{
-        const res=await api('/api/session/new',{method:'POST',body:JSON.stringify({workspace:s.workspace,model:s.model})});
-        if(res.session){
-          await api('/api/session/rename',{method:'POST',body:JSON.stringify({session_id:res.session.session_id,title:(s.title||'Untitled')+' (copy)'})});
-          await loadSession(res.session.session_id);await renderSessionList();
-          showToast('Session duplicated');
-        }
-      }catch(err){showToast('Duplicate failed: '+err.message);}
-    };
-    actions.appendChild(dup);
-    // Trash
-    const trash=document.createElement('button');
-    trash.className='act-trash';trash.innerHTML=ICONS.trash;trash.title='Delete';
-    trash.onclick=async(e)=>{e.stopPropagation();e.preventDefault();await deleteSession(s.session_id);};
-    actions.appendChild(trash);
+    actions.appendChild(menuBtn);
     el.appendChild(actions);
 
     // Use a click timer to distinguish single-click (navigate) from double-click (rename).
@@ -417,7 +564,8 @@ function renderSessionListFromCache(){
 }
 
 async function deleteSession(sid){
-  if(!confirm('Delete this conversation?'))return;
+  const _delSess=await showConfirmDialog({title:'Delete conversation',message:'This cannot be undone.',confirmLabel:'Delete',danger:true,focusCancel:true});
+  if(!_delSess) return;
   try{
     await api('/api/session/delete',{method:'POST',body:JSON.stringify({session_id:sid})});
   }catch(e){setStatus(`Delete failed: ${e.message}`);return;}
@@ -429,7 +577,7 @@ async function deleteSession(sid){
     if(remaining.sessions&&remaining.sessions.length){
       await loadSession(remaining.sessions[0].session_id);
     }else{
-      $('topbarTitle').textContent='Hermes';
+      $('topbarTitle').textContent=window._botName||'Hermes';
       $('topbarMeta').textContent='Start a new conversation';
       $('msgInner').innerHTML='';
       $('emptyState').style.display='';
@@ -493,7 +641,7 @@ function _showProjectPicker(session, anchorEl){
     picker.remove();
     document.removeEventListener('click',close);
     // Prompt for name inline
-    const name=prompt('Project name:');
+    const name=await showPromptDialog({title:'New project',message:'',placeholder:'Project name',confirmLabel:t('create')});
     if(!name||!name.trim()) return;
     const color=PROJECT_COLORS[_allProjects.length%PROJECT_COLORS.length];
     const res=await api('/api/projects/create',{method:'POST',body:JSON.stringify({name:name.trim(),color})});
@@ -532,7 +680,7 @@ function _showProjectPicker(session, anchorEl){
   setTimeout(()=>document.addEventListener('click',close),0);
 }
 
-function _startProjectCreate(bar, addBtn){
+async function _startProjectCreate(bar, addBtn){
   const inp=document.createElement('input');
   inp.className='project-create-input';
   inp.placeholder='Project name';
@@ -579,7 +727,8 @@ function _startProjectRename(proj, chip){
 }
 
 async function _confirmDeleteProject(proj){
-  if(!confirm('Delete project "'+proj.name+'"? Sessions will be unassigned but not deleted.')){return;}
+  const _delProj=await showConfirmDialog({title:`Delete project "${proj.name}"?`,message:'Sessions will be unassigned but not deleted.',confirmLabel:'Delete',danger:true,focusCancel:true});
+  if(!_delProj) return;
   await api('/api/projects/delete',{method:'POST',body:JSON.stringify({project_id:proj.project_id})});
   if(_activeProject===proj.project_id) _activeProject=null;
   await renderSessionList();

static/style.css

@@ -33,7 +33,7 @@
   /* ── Light theme: sidebar, roles, chips, active states ── */
   :root[data-theme="light"] .session-item{color:#5a544a;}
   :root[data-theme="light"] .session-item:hover{background:rgba(0,0,0,.06);color:#2c2825;}
-  :root[data-theme="light"] .session-item.active{background:rgba(45,111,163,.1);color:#1a5a8a;border-left-color:#2d6fa3;}
+  :root[data-theme="light"] .session-item.active{background:rgba(45,111,163,.1);color:#1a5a8a;}
   :root[data-theme="light"] .session-item.active .session-actions{background:linear-gradient(to right,transparent,rgba(228,224,216,.95) 12px);}
   :root[data-theme="light"] .session-pin-indicator{color:#996b15;}
   :root[data-theme="light"] .session-date-header.pinned{color:#996b15;}
@@ -100,6 +100,15 @@
     --focus-ring:rgba(129,161,193,.35);--focus-glow:rgba(129,161,193,.08);
     --strong:#eceff4;--em:#b8c0cc;--code-text:#a3be8c;--code-inline-bg:rgba(0,0,0,.2);--pre-text:#d8dee9;
   }
+  /* ── OLED theme ── */
+  :root[data-theme="oled"]{
+    --bg:#000000;--sidebar:#000000;--border:rgba(255,255,255,0.06);--border2:rgba(255,255,255,0.12);
+    --text:#e0e0e0;--muted:#777777;--accent:#ff3b5c;--blue:#6cb4ff;--gold:#d4a74a;--code-bg:#080808;
+    --surface:#0a0a0a;--topbar-bg:rgba(0,0,0,.98);--main-bg:rgba(0,0,0,0.5);
+    --focus-ring:rgba(108,180,255,.3);--focus-glow:rgba(108,180,255,.06);
+    --strong:#ffffff;--em:#c0c0d0;--code-text:#e8b86d;--code-inline-bg:rgba(255,255,255,.06);--pre-text:#d0d0d8;
+    --input-bg:rgba(255,255,255,.03);--hover-bg:rgba(255,255,255,.05);
+  }
   body{background:var(--bg);color:var(--text);height:100vh;height:100dvh;overflow:hidden;display:flex;}
   .layout{display:flex;width:100%;height:100vh;height:100dvh;}
   .sidebar{width:300px;background:var(--sidebar);border-right:1px solid var(--border);display:flex;flex-direction:column;overflow:visible;flex-shrink:0;}
@@ -120,15 +129,24 @@
   .session-item:hover{background:var(--hover-bg);color:var(--text);}
   .session-item.active{background:rgba(232,160,48,0.12);color:#e8a030;border-left:2px solid #e8a030;padding-left:8px;}
   .session-title{flex:1;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;}
-  /* ── Session action button overlay ── */
-  .session-actions{position:absolute;right:0;top:0;bottom:0;display:flex;align-items:center;gap:2px;padding:0 6px 0 16px;background:linear-gradient(to right,transparent,var(--sidebar) 12px);opacity:0;pointer-events:none;transition:opacity .15s ease;border-radius:0 8px 8px 0;}
-  .session-item:hover .session-actions{opacity:1;pointer-events:auto;}
-  .session-item.active .session-actions{background:linear-gradient(to right,transparent,rgba(30,22,8,.95) 12px);}
-  .session-actions button{background:none;border:none;color:var(--muted);cursor:pointer;padding:2px 3px;line-height:1;transition:color .12s;display:flex;align-items:center;}
-  .session-actions button:hover{color:var(--text);}
-  .session-actions .act-trash:hover{color:var(--accent);}
-  .session-actions .act-pin.pinned{color:#f5c542;}
-  .session-actions .act-pin.pinned:hover{color:#d4a017;}
+  /* ── Session action trigger + dropdown (⋯ menu) ── */
+  .session-actions{position:absolute;right:6px;top:50%;transform:translateY(-50%);display:flex;align-items:center;justify-content:center;opacity:0;pointer-events:none;transition:opacity .15s ease;}
+  .session-item:hover .session-actions,.session-item:focus-within .session-actions,.session-item.menu-open .session-actions{opacity:1;pointer-events:auto;}
+  .session-actions-trigger{width:26px;height:26px;border:1px solid transparent;border-radius:8px;background:transparent;color:var(--muted);cursor:pointer;padding:0;line-height:1;display:inline-flex;align-items:center;justify-content:center;transition:background .12s,color .12s,border-color .12s;}
+  .session-actions-trigger:hover{background:var(--hover-bg);color:var(--text);}
+  .session-actions-trigger.active{background:rgba(124,185,255,.1);border-color:rgba(124,185,255,.2);color:var(--text);}
+  .session-actions-trigger svg{display:block;}
+  .session-action-menu{display:block;position:fixed;left:0;top:0;right:auto;bottom:auto;min-width:220px;max-width:min(280px,calc(100vw - 16px));background:var(--surface);border:1px solid var(--border2);border-radius:10px;box-shadow:0 -4px 24px rgba(0,0,0,.4);z-index:999;overflow:hidden;max-height:320px;overflow-y:auto;}
+  .session-action-menu.open{display:block;}
+  .session-action-opt{width:100%;background:none;border:none;text-align:left;font:inherit;color:var(--text);flex-direction:row!important;gap:0!important;padding:0!important;}
+  .session-action-opt .ws-opt-action{display:flex;flex-direction:row;align-items:center;gap:10px;width:100%;padding:10px 14px;}
+  .session-action-opt .ws-opt-icon{color:var(--muted);transition:color .12s,opacity .12s;flex-shrink:0;display:flex;align-items:center;width:16px;}
+  .session-action-opt:hover .ws-opt-icon{color:var(--text);opacity:1;}
+  .session-action-copy{display:flex;flex-direction:column;gap:2px;min-width:0;}
+  .session-action-meta{font-size:11px;color:var(--muted);line-height:1.3;white-space:normal;opacity:.72;}
+  .session-action-opt.is-active{background:rgba(124,185,255,.1);}
+  .session-action-opt.danger:hover{background:rgba(233,69,96,.08);}
+  .session-action-opt.danger .ws-opt-icon,.session-action-opt.danger .ws-opt-name{color:var(--accent);}
   /* Hide overlay during inline rename */
   .session-item:has(.session-title-input) .session-actions{display:none;}
   @keyframes newflash{0%{background:rgba(124,185,255,0.22);color:var(--blue);}100%{background:transparent;color:var(--muted);}}
@@ -139,28 +157,62 @@
   .session-date-header.pinned{color:#f5c542;}
   .session-date-caret{font-size:9px;transition:transform .2s;flex-shrink:0;display:inline-block;}
   .session-date-caret.collapsed{transform:rotate(-90deg);}
+
+  /* ── Shared app dialogs (replace native confirm/prompt) ── */
+  .app-dialog-overlay{position:fixed;inset:0;background:rgba(7,12,19,.62);backdrop-filter:blur(6px);z-index:1100;display:none;align-items:center;justify-content:center;padding:24px;}
+  .app-dialog{width:min(460px,100%);background:linear-gradient(180deg,rgba(21,31,45,.98),rgba(13,20,31,.98));border:1px solid rgba(124,185,255,.2);border-radius:18px;box-shadow:0 18px 60px rgba(0,0,0,.45);padding:18px 18px 16px;color:var(--text);}
+  .app-dialog-header{display:flex;align-items:flex-start;justify-content:space-between;gap:12px;margin-bottom:10px;}
+  .app-dialog-title{font-size:16px;font-weight:700;letter-spacing:.01em;color:var(--text);}
+  .app-dialog-close{display:inline-flex;align-items:center;justify-content:center;width:32px;height:32px;border:none;border-radius:10px;background:rgba(255,255,255,.04);color:var(--muted);cursor:pointer;transition:background .15s,color .15s;}
+  .app-dialog-close:hover{background:rgba(255,255,255,.09);color:var(--text);}
+  .app-dialog-desc{font-size:13px;line-height:1.6;color:var(--muted);white-space:pre-wrap;}
+  .app-dialog-input{width:100%;margin-top:14px;padding:11px 12px;background:rgba(255,255,255,.04);border:1px solid var(--border2);border-radius:10px;color:var(--text);font-size:14px;outline:none;box-sizing:border-box;}
+  .app-dialog-input:focus{border-color:rgba(124,185,255,.55);box-shadow:0 0 0 3px rgba(124,185,255,.12);}
+  .app-dialog-actions{display:flex;justify-content:flex-end;gap:10px;margin-top:18px;flex-wrap:wrap;}
+  .app-dialog-btn{display:inline-flex;align-items:center;justify-content:center;min-width:104px;padding:10px 14px;border-radius:10px;border:1px solid var(--border2);background:rgba(255,255,255,.05);color:var(--text);font-size:13px;font-weight:600;cursor:pointer;transition:transform .15s,background .15s,border-color .15s;}
+  .app-dialog-btn:hover{transform:translateY(-1px);background:rgba(255,255,255,.1);}
+  .app-dialog-btn.confirm{border-color:rgba(124,185,255,.45);background:rgba(124,185,255,.14);color:var(--blue);}
+  .app-dialog-btn.confirm:hover{background:rgba(124,185,255,.22);border-color:rgba(124,185,255,.65);}
+  .app-dialog-btn.confirm.danger{border-color:rgba(233,69,96,.4);background:rgba(233,69,96,.14);color:var(--accent);}
+  .app-dialog-btn.confirm.danger:hover{background:rgba(233,69,96,.22);border-color:rgba(233,69,96,.58);}
+  .app-dialog-btn:focus-visible,.app-dialog-close:focus-visible{outline:2px solid rgba(124,185,255,.85);outline-offset:2px;}
   .toast{position:fixed;bottom:24px;left:50%;transform:translateX(-50%);background:var(--surface);backdrop-filter:blur(12px);border:1px solid rgba(124,185,255,0.25);color:var(--text);font-size:13px;padding:10px 20px;border-radius:12px;pointer-events:none;opacity:0;transition:opacity .2s,transform .2s;z-index:100;box-shadow:0 4px 20px rgba(0,0,0,.3);letter-spacing:.01em;}
   .toast.show{opacity:1;transform:translateX(-50%) translateY(-2px);}
   .reconnect-banner{display:none;background:var(--surface);border:1px solid rgba(201,168,76,0.4);border-radius:10px;padding:10px 16px;margin:10px auto;max-width:780px;font-size:13px;color:var(--gold);display:none;align-items:center;justify-content:space-between;gap:12px;}
   .reconnect-banner.visible{display:flex;}
   .reconnect-btn{padding:5px 12px;border-radius:7px;font-size:12px;font-weight:600;background:rgba(201,168,76,0.15);border:1px solid rgba(201,168,76,0.4);color:var(--gold);cursor:pointer;}
   .reconnect-btn:hover{background:rgba(201,168,76,0.25);}
+  /* ── Update banner ── */
+  .update-banner{display:none;background:var(--surface);border:1px solid rgba(124,185,255,0.4);border-radius:10px;padding:10px 16px;margin:10px auto;max-width:780px;font-size:13px;color:var(--blue);align-items:center;justify-content:space-between;gap:12px;}
+  .update-banner.visible{display:flex;}
+  .update-btn{padding:5px 12px;border-radius:7px;font-size:12px;font-weight:600;background:rgba(124,185,255,0.1);border:1px solid rgba(124,185,255,0.3);color:var(--blue);cursor:pointer;transition:background .15s;}
+  .update-btn:hover{background:rgba(124,185,255,0.2);}
+  .update-primary{background:rgba(124,185,255,0.2);border-color:rgba(124,185,255,0.5);}
+  .update-btn:disabled{opacity:0.5;cursor:not-allowed;}
   /* ── Approval card ── */
   .approval-card{display:none;max-width:780px;margin:0 auto 0;padding:0 20px 12px;}
   .approval-card.visible{display:block;}
-  .approval-inner{background:var(--surface);backdrop-filter:blur(8px);border:1px solid rgba(233,69,96,0.35);border-radius:14px;padding:14px 16px;}
+  .approval-inner{background:var(--surface);backdrop-filter:blur(8px);border:1px solid rgba(233,69,96,0.35);border-radius:14px;padding:16px 18px;}
   .approval-header{display:flex;align-items:center;gap:8px;margin-bottom:10px;font-size:13px;font-weight:600;color:#e94560;}
-  .approval-desc{font-size:12px;color:var(--muted);margin-bottom:8px;}
-  .approval-cmd{background:var(--code-bg);border:1px solid var(--border);border-radius:8px;padding:8px 12px;font-family:"SF Mono",ui-monospace,monospace;font-size:12px;color:var(--pre-text);white-space:pre-wrap;word-break:break-all;margin-bottom:12px;max-height:120px;overflow-y:auto;}
-  .approval-btns{display:flex;gap:8px;flex-wrap:wrap;}
-  .approval-btn{padding:6px 14px;border-radius:8px;font-size:12px;font-weight:600;border:1px solid var(--border2);background:var(--hover-bg);color:var(--text);cursor:pointer;transition:all .15s;}
-  .approval-btn:hover{background:rgba(255,255,255,0.12);}
-  .approval-btn.once{border-color:rgba(124,185,255,0.5);color:var(--blue);}
-  .approval-btn.once:hover{background:rgba(124,185,255,0.15);}
-  .approval-btn.session{border-color:rgba(124,185,255,0.3);color:var(--blue);}
+  .approval-desc{font-size:12px;color:var(--muted);margin-bottom:8px;line-height:1.5;}
+  .approval-cmd{background:var(--code-bg);border:1px solid var(--border);border-radius:8px;padding:8px 12px;font-family:"SF Mono",ui-monospace,monospace;font-size:12px;color:var(--pre-text);white-space:pre-wrap;word-break:break-all;margin-bottom:14px;max-height:120px;overflow-y:auto;}
+  .approval-btns{display:flex;gap:8px;flex-wrap:wrap;align-items:center;}
+  .approval-btn{display:inline-flex;align-items:center;gap:6px;padding:7px 15px;border-radius:8px;font-size:12px;font-weight:600;border:1px solid var(--border2);background:var(--hover-bg);color:var(--text);cursor:pointer;transition:all .15s;white-space:nowrap;}
+  .approval-btn:hover{background:rgba(255,255,255,0.12);transform:translateY(-1px);box-shadow:0 2px 8px rgba(0,0,0,0.2);}
+  .approval-btn:active{transform:translateY(0);box-shadow:none;}
+  .approval-btn:disabled{opacity:.5;cursor:not-allowed;transform:none;}
+  .approval-btn-icon{font-size:13px;line-height:1;}
+  .approval-btn-label{line-height:1;}
+  .approval-kbd{display:inline-flex;align-items:center;justify-content:center;padding:1px 5px;border-radius:4px;font-size:10px;font-family:inherit;background:rgba(255,255,255,.08);border:1px solid rgba(255,255,255,.15);color:var(--muted);line-height:1.4;margin-left:2px;}
+  .approval-btn.once{border-color:rgba(124,185,255,0.6);color:var(--blue);background:rgba(124,185,255,0.08);}
+  .approval-btn.once:hover{background:rgba(124,185,255,0.18);border-color:rgba(124,185,255,0.8);}
+  .approval-btn.session{border-color:rgba(124,185,255,0.35);color:var(--blue);}
+  .approval-btn.session:hover{background:rgba(124,185,255,0.12);border-color:rgba(124,185,255,0.55);}
   .approval-btn.always{border-color:rgba(201,168,76,0.5);color:var(--gold);}
+  .approval-btn.always:hover{background:rgba(201,168,76,0.12);border-color:rgba(201,168,76,0.7);}
   .approval-btn.deny{border-color:rgba(233,69,96,0.5);color:var(--accent);}
-  .approval-btn.deny:hover{background:rgba(233,69,96,0.12);}
+  .approval-btn.deny:hover{background:rgba(233,69,96,0.12);border-color:rgba(233,69,96,0.7);}
+  .approval-btn.loading{opacity:.7;cursor:wait;}
   /* Sidebar navigation tabs */
   .sidebar-nav{display:flex;border-bottom:1px solid var(--border);flex-shrink:0;padding:6px 8px 0;gap:2px;}
   .nav-tab{flex:1;padding:10px 4px 8px;font-size:20px;text-align:center;cursor:pointer;color:var(--muted);border:none;background:none;transition:color .15s;border-bottom:2px solid transparent;white-space:nowrap;overflow:hidden;position:relative;}
@@ -318,6 +370,7 @@
   .panel-actions{display:flex;gap:4px;}
   .panel-icon-btn{width:24px;height:24px;background:none;border:none;color:var(--muted);cursor:pointer;border-radius:5px;font-size:13px;display:flex;align-items:center;justify-content:center;transition:all .15s;}
   .panel-icon-btn:hover{background:rgba(255,255,255,.08);color:var(--text);}
+  .mobile-close-btn{display:none;}
   /* File row actions (shown on hover) */
   /* file-item-actions removed: delete button is now a flex child */
   .file-action-btn{width:20px;height:20px;background:rgba(0,0,0,.4);border:none;border-radius:4px;color:var(--muted);cursor:pointer;font-size:11px;display:flex;align-items:center;justify-content:center;}
@@ -446,12 +499,21 @@
     .approval-card{padding:0 10px 8px;}
     .approval-btns{gap:6px;}
     .approval-btn{padding:8px 12px;font-size:12px;min-height:44px;}
+    .approval-kbd{display:none;}
+    .app-dialog-overlay{padding:12px;}
+    .app-dialog{width:100%;padding:16px 16px 14px;border-radius:16px;}
+    .app-dialog-actions{flex-direction:column-reverse;align-items:stretch;}
+    .app-dialog-btn{width:100%;min-height:44px;}
     /* Tool cards */
     .tool-card{margin-left:0!important;font-size:12px;}
     /* Settings modal */
     .settings-panel{width:95vw;max-width:95vw;min-height:min(580px,88vh);max-height:92vh;}
     /* Login page responsive */
     .card{width:90vw;max-width:320px;padding:28px 24px;}
+    /* Workspace panel mobile close button */
+    .mobile-close-btn{display:inline-flex;}
+    /* Profile dropdown — escape overflow-x:auto clipping context */
+    .profile-dropdown{position:fixed;top:56px;right:8px;left:auto;max-width:calc(100vw - 16px);}
   }
 
 /* ── Workspace dropdown (topbar) ── */
@@ -800,13 +862,13 @@ body.resizing{user-select:none;cursor:col-resize;}
 
 .bg-error-banner{background:rgba(229,62,62,.15);border:1px solid rgba(229,62,62,.3);color:#fca5a5;padding:8px 16px;font-size:12px;display:flex;align-items:center;justify-content:space-between;gap:12px;border-radius:0;}
 
-/* ── CLI session items in sidebar ── */
+/* ── CLI / Agent session items in sidebar ── */
 .session-item.cli-session {
   border-left-color: var(--gold);
-  padding-right: 36px; /* make room for session-actions overlay */
+  padding-right: 40px; /* make room for the session actions trigger */
 }
 .session-item.cli-session::after {
-  content: 'cli';
+  content: attr(data-source);
   font-size: 9px;
   font-weight: 600;
   text-transform: uppercase;
@@ -820,3 +882,10 @@ body.resizing{user-select:none;cursor:col-resize;}
 .session-item.cli-session:hover::after {
   display: none; /* hide badge on hover so session-actions icons are fully reachable */
 }
+/* Source-specific colors for gateway sessions */
+.session-item.cli-session[data-source="telegram"] { border-left-color: #0088cc; }
+.session-item.cli-session[data-source="telegram"]::after { color: #0088cc; }
+.session-item.cli-session[data-source="discord"] { border-left-color: #5865F2; }
+.session-item.cli-session[data-source="discord"]::after { color: #5865F2; }
+.session-item.cli-session[data-source="slack"] { border-left-color: #4A154B; }
+.session-item.cli-session[data-source="slack"]::after { color: #4A154B; }

static/ui.js

@@ -135,6 +135,10 @@ function getModelLabel(modelId){
 
 function renderMd(raw){
   let s=raw||'';
+  // Pre-pass: decode HTML entities first so markdown processing works correctly.
+  // This prevents double-escaping when LLM outputs entities like < > &
+  const decode=s=>s.replace(/&lt;/g,'<').replace(/&gt;/g,'>').replace(/&amp;/g,'&').replace(/&quot;/g,'"').replace(/&#39;/g,"'");
+  s=decode(s);
   // Pre-pass: convert safe inline HTML tags the model may emit into their
   // markdown equivalents so the pipeline can render them correctly.
   // Only runs OUTSIDE fenced code blocks and backtick spans (stash + restore).
@@ -207,8 +211,8 @@ function renderMd(raw){
     if(rows.length<2)return block;
     const isSep=r=>/^\|[\s|:-]+\|$/.test(r.trim());
     if(!isSep(rows[1]))return block;
-    const parseRow=r=>r.trim().replace(/^\|/,'').replace(/\|$/,'').split('|').map(c=>`<td>${esc(c.trim())}</td>`).join('');
-    const parseHeader=r=>r.trim().replace(/^\|/,'').replace(/\|$/,'').split('|').map(c=>`<th>${esc(c.trim())}</th>`).join('');
+    const parseRow=r=>r.trim().replace(/^\|/,'').replace(/\|$/,'').split('|').map(c=>`<td>${inlineMd(c.trim())}</td>`).join('');
+    const parseHeader=r=>r.trim().replace(/^\|/,'').replace(/\|$/,'').split('|').map(c=>`<th>${inlineMd(c.trim())}</th>`).join('');
     const header=`<tr>${parseHeader(rows[0])}</tr>`;
     const body=rows.slice(2).map(r=>`<tr>${parseRow(r)}</tr>`).join('');
     return `<table><thead>${header}</thead><tbody>${body}</tbody></table>`;
@@ -237,7 +241,7 @@ function setStatus(t){
     txt.textContent=t;
     bar.style.display='';
     // Show dismiss X only for static/error messages, not transient busy ones
-    const transient = t.endsWith('…') || t === 'Hermes is thinking…';
+    const transient = t.endsWith('…') || t === (window._botName||'Hermes')+' is thinking\u2026';
     if(dismiss)dismiss.style.display=(!transient && !S.busy)?'inline':'none';
   }
 }
@@ -292,6 +296,148 @@ function updateQueueBadge(){
 }
 function showToast(msg,ms){const el=$('toast');el.textContent=msg;el.classList.add('show');clearTimeout(el._t);el._t=setTimeout(()=>el.classList.remove('show'),ms||2800);}
 
+// ── Shared app dialogs ───────────────────────────────────────────────────────
+// showConfirmDialog(opts) and showPromptDialog(opts) replace browser-native dialog calls
+// throughout the UI. Both return Promises and support: title, message, confirmLabel,
+// cancelLabel, danger (confirm only), placeholder/value/inputType (prompt only).
+
+const APP_DIALOG={resolve:null,kind:null,lastFocus:null};
+let _appDialogBound=false;
+
+function _isAppDialogOpen(){
+  const overlay=$('appDialogOverlay');
+  return !!(overlay&&overlay.style.display!=='none');
+}
+
+function _getAppDialogFocusable(){
+  return [$('appDialogInput'), $('appDialogCancel'), $('appDialogConfirm'), $('appDialogClose')]
+    .filter(el=>el&&el.style.display!=='none'&&!el.disabled);
+}
+
+function _finishAppDialog(result, restoreFocus=true){
+  const overlay=$('appDialogOverlay');
+  const dialog=$('appDialog');
+  const input=$('appDialogInput');
+  const confirmBtn=$('appDialogConfirm');
+  const resolve=APP_DIALOG.resolve;
+  const lastFocus=APP_DIALOG.lastFocus;
+  APP_DIALOG.resolve=null;
+  APP_DIALOG.kind=null;
+  APP_DIALOG.lastFocus=null;
+  if(overlay){overlay.style.display='none';overlay.setAttribute('aria-hidden','true');}
+  if(dialog) dialog.setAttribute('role','dialog');
+  if(input){input.value='';input.style.display='none';input.placeholder='';}
+  if(confirmBtn){confirmBtn.classList.remove('danger');confirmBtn.textContent=t('dialog_confirm_btn');}
+  if(restoreFocus&&lastFocus&&typeof lastFocus.focus==='function'){setTimeout(()=>lastFocus.focus(),0);}
+  if(resolve) resolve(result);
+}
+
+function _ensureAppDialogBindings(){
+  if(_appDialogBound) return;
+  _appDialogBound=true;
+  const overlay=$('appDialogOverlay');
+  const cancelBtn=$('appDialogCancel');
+  const confirmBtn=$('appDialogConfirm');
+  const closeBtn=$('appDialogClose');
+  if(overlay){
+    overlay.addEventListener('click',e=>{
+      if(e.target===overlay) _finishAppDialog(APP_DIALOG.kind==='prompt'?null:false);
+    });
+  }
+  if(cancelBtn) cancelBtn.addEventListener('click',()=>_finishAppDialog(APP_DIALOG.kind==='prompt'?null:false));
+  if(closeBtn)  closeBtn.addEventListener('click',()=>_finishAppDialog(APP_DIALOG.kind==='prompt'?null:false));
+  if(confirmBtn){
+    confirmBtn.addEventListener('click',()=>{
+      if(APP_DIALOG.kind==='prompt'){
+        const input=$('appDialogInput');
+        _finishAppDialog(input?input.value:null);
+      }else{
+        _finishAppDialog(true);
+      }
+    });
+  }
+  document.addEventListener('keydown',e=>{
+    if(!_isAppDialogOpen()) return;
+    if(e.key==='Escape'){
+      e.preventDefault();
+      _finishAppDialog(APP_DIALOG.kind==='prompt'?null:false);
+      return;
+    }
+    if(e.key==='Enter'){
+      const target=e.target;
+      const isTextarea=target&&target.tagName==='TEXTAREA';
+      if(!isTextarea){
+        e.preventDefault();
+        if(target===cancelBtn||target===closeBtn){
+          _finishAppDialog(APP_DIALOG.kind==='prompt'?null:false);
+        }else if(APP_DIALOG.kind==='prompt'){
+          const input=$('appDialogInput');
+          _finishAppDialog(input?input.value:null);
+        }else{
+          _finishAppDialog(true);
+        }
+      }
+      return;
+    }
+    if(e.key==='Tab'){
+      const nodes=_getAppDialogFocusable();
+      if(!nodes.length) return;
+      const idx=nodes.indexOf(document.activeElement);
+      let nextIdx=idx;
+      if(e.shiftKey){nextIdx=idx<=0?nodes.length-1:idx-1;}
+      else{nextIdx=idx===-1||idx===nodes.length-1?0:idx+1;}
+      e.preventDefault();
+      nodes[nextIdx].focus();
+    }
+  }, true);
+}
+
+function showConfirmDialog(opts={}){
+  _ensureAppDialogBindings();
+  if(APP_DIALOG.resolve) _finishAppDialog(false,false);
+  const overlay=$('appDialogOverlay'),dialog=$('appDialog'),title=$('appDialogTitle'),
+    desc=$('appDialogDesc'),input=$('appDialogInput'),cancelBtn=$('appDialogCancel'),confirmBtn=$('appDialogConfirm');
+  APP_DIALOG.resolve=null;APP_DIALOG.kind='confirm';APP_DIALOG.lastFocus=document.activeElement;
+  if(title) title.textContent=opts.title||t('dialog_confirm_title');
+  if(desc) desc.textContent=opts.message||'';
+  if(input){input.style.display='none';input.value='';}
+  if(cancelBtn) cancelBtn.textContent=opts.cancelLabel||t('cancel');
+  if(confirmBtn){
+    confirmBtn.textContent=opts.confirmLabel||t('dialog_confirm_btn');
+    confirmBtn.classList.toggle('danger',!!opts.danger);
+  }
+  if(dialog) dialog.setAttribute('role',opts.danger?'alertdialog':'dialog');
+  if(overlay){overlay.style.display='flex';overlay.setAttribute('aria-hidden','false');}
+  return new Promise(resolve=>{
+    APP_DIALOG.resolve=resolve;
+    setTimeout(()=>((opts.focusCancel?cancelBtn:confirmBtn)||confirmBtn||cancelBtn).focus(),0);
+  });
+}
+
+function showPromptDialog(opts={}){
+  _ensureAppDialogBindings();
+  if(APP_DIALOG.resolve) _finishAppDialog(null,false);
+  const overlay=$('appDialogOverlay'),dialog=$('appDialog'),title=$('appDialogTitle'),
+    desc=$('appDialogDesc'),input=$('appDialogInput'),cancelBtn=$('appDialogCancel'),confirmBtn=$('appDialogConfirm');
+  APP_DIALOG.resolve=null;APP_DIALOG.kind='prompt';APP_DIALOG.lastFocus=document.activeElement;
+  if(title) title.textContent=opts.title||t('dialog_prompt_title');
+  if(desc) desc.textContent=opts.message||'';
+  if(input){
+    input.type=opts.inputType||'text';input.style.display='';
+    input.value=opts.value||'';input.placeholder=opts.placeholder||'';
+    input.autocomplete='off';input.spellcheck=false;
+  }
+  if(cancelBtn) cancelBtn.textContent=opts.cancelLabel||t('cancel');
+  if(confirmBtn){confirmBtn.textContent=opts.confirmLabel||t('create');confirmBtn.classList.remove('danger');}
+  if(dialog) dialog.setAttribute('role','dialog');
+  if(overlay){overlay.style.display='flex';overlay.setAttribute('aria-hidden','false');}
+  return new Promise(resolve=>{
+    APP_DIALOG.resolve=resolve;
+    setTimeout(()=>{if(input&&input.style.display!=='none')input.focus();else if(confirmBtn)confirmBtn.focus();},0);
+  });
+}
+
+
 function copyMsg(btn){
   const row=btn.closest('.msg-row');
   const text=row?row.dataset.rawText:'';
@@ -334,6 +480,47 @@ async function refreshSession() {
     showToast('Conversation refreshed');
   } catch(e) { setStatus('Refresh failed: ' + e.message); }
 }
+// ── Update banner ──
+function _showUpdateBanner(data){
+  const parts=[];
+  if(data.webui&&data.webui.behind>0) parts.push(`WebUI: ${data.webui.behind} update${data.webui.behind>1?'s':''}`);
+  if(data.agent&&data.agent.behind>0) parts.push(`Agent: ${data.agent.behind} update${data.agent.behind>1?'s':''}`);
+  if(!parts.length)return;
+  const msg=$('updateMsg');
+  if(msg) msg.textContent='\u2B06 '+parts.join(', ')+' available';
+  const banner=$('updateBanner');
+  if(banner) banner.classList.add('visible');
+  window._updateData=data;
+}
+function dismissUpdate(){
+  const b=$('updateBanner');if(b)b.classList.remove('visible');
+  sessionStorage.setItem('hermes-update-dismissed','1');
+}
+async function applyUpdates(){
+  const btn=$('btnApplyUpdate');
+  if(btn){btn.disabled=true;btn.textContent='Updating\u2026';}
+  const targets=[];
+  if(window._updateData?.webui?.behind>0) targets.push('webui');
+  if(window._updateData?.agent?.behind>0) targets.push('agent');
+  try{
+    for(const target of targets){
+      const res=await api('/api/updates/apply',{method:'POST',body:JSON.stringify({target})});
+      if(!res.ok){
+        showToast('Update failed ('+target+'): '+(res.message||'unknown error'));
+        if(btn){btn.disabled=false;btn.textContent='Update Now';}
+        return;
+      }
+    }
+    showToast('Updated! Reloading\u2026');
+    sessionStorage.removeItem('hermes-update-checked');
+    sessionStorage.removeItem('hermes-update-dismissed');
+    setTimeout(()=>location.reload(),1500);
+  }catch(e){
+    showToast('Update failed: '+e.message);
+    if(btn){btn.disabled=false;btn.textContent='Update Now';}
+  }
+}
+
 async function checkInflightOnBoot(sid) {
   const raw = localStorage.getItem(INFLIGHT_KEY);
   if (!raw) return;
@@ -346,12 +533,12 @@ async function checkInflightOnBoot(sid) {
     const status = await api(`/api/chat/stream/status?stream_id=${encodeURIComponent(streamId || '')}`);
     if (status.active) {
       // Stream is genuinely still running -- show the banner
-      showReconnectBanner('A response is still being generated. Reload when ready?');
+      showReconnectBanner(t('reconnect_active'));
     } else {
       // Stream finished. Only show banner if reload happened within 90 seconds
       // (longer gap = normal completed session, not a mid-stream reload)
       if (Date.now() - ts < 90 * 1000) {
-        showReconnectBanner('A response was in progress when you last left. Messages may have updated.');
+        showReconnectBanner(t('reconnect_finished'));
       } else {
         clearInflight();  // completed normally, no banner needed
       }
@@ -361,19 +548,19 @@ async function checkInflightOnBoot(sid) {
 
 function syncTopbar(){
   if(!S.session){
-    document.title='Hermes';
+    document.title=window._botName||'Hermes';
     // Show default workspace name even without a session
     const sidebarName=$('sidebarWsName');
     if(sidebarName && sidebarName.textContent==='Workspace'){
-      sidebarName.textContent='No workspace';
+      sidebarName.textContent=t('no_workspace');
     }
     return;
   }
-  const sessionTitle=S.session.title||'Untitled';
+  const sessionTitle=S.session.title||t('untitled');
   $('topbarTitle').textContent=sessionTitle;
-  document.title=sessionTitle+' \u2014 Hermes';
+  document.title=sessionTitle+' \u2014 '+(window._botName||'Hermes');
   const vis=S.messages.filter(m=>m&&m.role&&m.role!=='tool');
-  $('topbarMeta').textContent=`${vis.length} messages`;
+  $('topbarMeta').textContent=t('n_messages',vis.length);
   // If a profile switch just happened, apply its model rather than the session's stale value.
   // S._pendingProfileModel is set by switchToProfile() and cleared here after one application.
   const modelOverride=S._pendingProfileModel;
@@ -383,11 +570,16 @@ function syncTopbar(){
   } else {
     const m=S.session.model||'';
     const applied=_applyModelToDropdown(m,$('modelSelect'));
-    // If the model isn't in the list at all, add it so the session value is preserved
+    // If the model isn't in the current provider list, add it as a visually marked
+    // "(unavailable)" entry so the session value is preserved without misleading the user.
+    // Selecting it will still attempt to send (same as before), but the label makes
+    // clear it's a stale model from a previous session.
     if(!applied && m){
       const opt=document.createElement('option');
       opt.value=m;
-      opt.textContent=getModelLabel(m);
+      opt.textContent=getModelLabel(m)+t('model_unavailable');
+      opt.style.color='var(--muted, #888)';
+      opt.title=t('model_unavailable_title');
       $('modelSelect').appendChild(opt);
       $('modelSelect').value=m;
     }
@@ -424,16 +616,24 @@ function renderMessages(){
   const inner=$('msgInner');
   const vis=S.messages.filter(m=>{
     if(!m||!m.role||m.role==='tool')return false;
+    // Keep assistant messages with tool_use content even if they have no text,
+    // so tool cards can be anchored to their DOM rows on page reload (#140).
+    if(m.role==='assistant'&&Array.isArray(m.content)&&m.content.some(p=>p&&p.type==='tool_use'))return true;
     return msgContent(m)||m.attachments?.length;
   });
   $('emptyState').style.display=vis.length?'none':'';
   inner.innerHTML='';
-  // Track original indices (in S.messages) so truncate knows the cut point
+  // Track original indices (in S.messages) so truncate knows the cut point.
+  // Also include assistant messages that have tool_calls (OpenAI format) or
+  // tool_use content (Anthropic format) even when their text is empty — these
+  // rows serve as DOM anchors for tool card insertion on page reload.
   const visWithIdx=[];
   let rawIdx=0;
   for(const m of S.messages){
     if(!m||!m.role||m.role==='tool'){rawIdx++;continue;}
-    if(msgContent(m)||m.attachments?.length) visWithIdx.push({m,rawIdx});
+    const hasTc=Array.isArray(m.tool_calls)&&m.tool_calls.length>0;
+    const hasTu=Array.isArray(m.content)&&m.content.some(p=>p&&p.type==='tool_use');
+    if(msgContent(m)||m.attachments?.length||(m.role==='assistant'&&(hasTc||hasTu))) visWithIdx.push({m,rawIdx});
     rawIdx++;
   }
   for(let vi=0;vi<visWithIdx.length;vi++){
@@ -445,12 +645,32 @@ function renderMessages(){
       thinkingText=content.filter(p=>p&&(p.type==='thinking'||p.type==='reasoning')).map(p=>p.thinking||p.reasoning||p.text||'').join('\n');
       content=content.filter(p=>p&&p.type==='text').map(p=>p.text||p.content||'').join('\n');
     }
+    // Also check top-level reasoning field (Hermes format)
+    if(!thinkingText && m.reasoning){
+      thinkingText=m.reasoning;
+    }
+    // Parse inline thinking tags from plain text: <think>...</think> (DeepSeek, QwQ, etc.)
+    // and Gemma 4 channel tokens: <|channel>thought\n...<channel|>
+    if(!thinkingText && typeof content==='string'){
+      const thinkMatch=content.match(/^<think>([\s\S]*?)<\/think>\s*/);
+      if(thinkMatch){
+        thinkingText=thinkMatch[1].trim();
+        content=content.slice(thinkMatch[0].length);
+      }
+      if(!thinkingText){
+        const gemmaMatch=content.match(/^<\|channel>thought\n([\s\S]*?)<channel\|>\s*/);
+        if(gemmaMatch){
+          thinkingText=gemmaMatch[1].trim();
+          content=content.slice(gemmaMatch[0].length);
+        }
+      }
+    }
     const isUser=m.role==='user';
     const isLastAssistant=!isUser&&vi===visWithIdx.length-1;
     // Render thinking card before the assistant message (collapsed by default)
     if(thinkingText&&!isUser){
       const thinkRow=document.createElement('div');thinkRow.className='msg-row thinking-card-row';
-      thinkRow.innerHTML=`<div class="thinking-card"><div class="thinking-card-header" onclick="this.parentElement.classList.toggle('open')"><span class="thinking-card-icon">&#128161;</span><span class="thinking-card-label">Thinking</span><span class="thinking-card-toggle">&#9656;</span></div><div class="thinking-card-body"><pre>${esc(thinkingText)}</pre></div></div>`;
+      thinkRow.innerHTML=`<div class="thinking-card"><div class="thinking-card-header" onclick="this.parentElement.classList.toggle('open')"><span class="thinking-card-icon">&#128161;</span><span class="thinking-card-label">${t('thinking')}</span><span class="thinking-card-toggle">&#9656;</span></div><div class="thinking-card-body"><pre>${esc(thinkingText)}</pre></div></div>`;
       inner.appendChild(thinkRow);
     }
     const row=document.createElement('div');row.className='msg-row';
@@ -460,17 +680,40 @@ function renderMessages(){
       filesHtml=`<div class="msg-files">${m.attachments.map(f=>`<div class="msg-file-badge">&#128206; ${esc(f)}</div>`).join('')}</div>`;
     const bodyHtml = isUser ? esc(String(content)).replace(/\n/g,'<br>') : renderMd(String(content));
     // Action buttons for this bubble
-    const editBtn  = isUser  ? `<button class="msg-action-btn" title="Edit message" onclick="editMessage(this)">&#9998;</button>` : '';
-    const retryBtn = isLastAssistant ? `<button class="msg-action-btn" title="Regenerate response" onclick="regenerateResponse(this)">&#8635;</button>` : '';
+    const editBtn  = isUser  ? `<button class="msg-action-btn" title="${t('edit_message')}" onclick="editMessage(this)">&#9998;</button>` : '';
+    const retryBtn = isLastAssistant ? `<button class="msg-action-btn" title="${t('regenerate')}" onclick="regenerateResponse(this)">&#8635;</button>` : '';
     const tsVal=m._ts||m.timestamp;
     const tsTitle=tsVal?new Date(tsVal*1000).toLocaleString():'';
-    row.innerHTML=`<div class="msg-role ${m.role}" ${tsTitle?`title="${esc(tsTitle)}"`:''}><div class="role-icon ${m.role}">${isUser?'Y':'H'}</div><span style="font-size:12px">${isUser?'You':'Hermes'}</span>${tsTitle?`<span class="msg-time">${new Date(tsVal*1000).toLocaleTimeString([],{hour:'2-digit',minute:'2-digit'})}</span>`:''}<span class="msg-actions">${editBtn}<button class="msg-copy-btn msg-action-btn" title="Copy" onclick="copyMsg(this)">&#128203;</button>${retryBtn}</span></div>${filesHtml}<div class="msg-body">${bodyHtml}</div>`;
+    const _bn=window._botName||'Hermes';
+    row.innerHTML=`<div class="msg-role ${m.role}" ${tsTitle?`title="${esc(tsTitle)}"`:''}><div class="role-icon ${m.role}">${isUser?'Y':esc(_bn.charAt(0).toUpperCase())}</div><span style="font-size:12px">${isUser?t('you'):esc(_bn)}</span>${tsTitle?`<span class="msg-time">${new Date(tsVal*1000).toLocaleTimeString([],{hour:'2-digit',minute:'2-digit'})}</span>`:''}<span class="msg-actions">${editBtn}<button class="msg-copy-btn msg-action-btn" title="${t('copy')}" onclick="copyMsg(this)">&#128203;</button>${retryBtn}</span></div>${filesHtml}<div class="msg-body">${bodyHtml}</div>`;
     row.dataset.rawText = String(content).trim();
     inner.appendChild(row);
   }
   // Insert settled tool call cards (history view only).
   // During live streaming, tool cards are rendered in #liveToolCards by the
   // tool SSE handler and never mixed into the message list until done fires.
+  //
+  // Fallback: if S.toolCalls is empty (sessions that predate session-level tool
+  // tracking, or runs that didn't go through the normal streaming path), build
+  // a display list from per-message tool_calls (OpenAI format) stored in each
+  // assistant message. This covers the reload case described in issue #140.
+  if(!S.busy && (!S.toolCalls||!S.toolCalls.length)){
+    const derived=[];
+    S.messages.forEach((m,rawIdx)=>{
+      if(m.role!=='assistant') return;
+      (m.tool_calls||[]).forEach(tc=>{
+        if(!tc||typeof tc!=='object') return;
+        const fn=tc.function||{};
+        const name=fn.name||tc.name||'tool';
+        let args={};
+        try{ args=JSON.parse(fn.arguments||'{}'); }catch(e){}
+        let argsSnap={};
+        Object.keys(args).slice(0,4).forEach(k=>{ const v=String(args[k]); argsSnap[k]=v.slice(0,120)+(v.length>120?'...':''); });
+        derived.push({name,snippet:'',tid:tc.id||tc.call_id||'',assistant_msg_idx:rawIdx,args:argsSnap,done:true});
+      });
+    });
+    if(derived.length) S.toolCalls=derived;
+  }
   if(!S.busy && S.toolCalls && S.toolCalls.length){
     inner.querySelectorAll('.tool-card-row').forEach(el=>el.remove());
     const byAssistant = {};
@@ -480,18 +723,35 @@ function renderMessages(){
       byAssistant[key].push(tc);
     }
     const allRows = Array.from(inner.querySelectorAll('.msg-row[data-msg-idx]'));
+    // Track the last inserted node per anchor so back-to-back groups for the
+    // same (filtered) anchor row are inserted in chronological order.
+    const anchorInsertAfter = new Map();
     for(const [key, cards] of Object.entries(byAssistant)){
       const aIdx = parseInt(key);
-      let insertBefore = null;
-      if(aIdx === -1){
-        for(let i=allRows.length-1;i>=0;i--){
-          const ri=parseInt(allRows[i].dataset.msgIdx||'-1',10);
-          if(ri>=0&&S.messages[ri]&&S.messages[ri].role==='assistant'){insertBefore=allRows[i];break;}
-        }
-      } else {
+      // Find the right insertion point: cards go AFTER the assistant message
+      // that triggered them. We look for the row at aIdx, or the nearest
+      // visible ASSISTANT row at or before aIdx (the assistant message may be
+      // filtered out if it contained only tool_use blocks with no text response).
+      let anchorRow = null;
+      if(aIdx >= 0){
+        // First: exact match for the assistant row
         for(const r of allRows){
           const ri=parseInt(r.dataset.msgIdx||'-1');
-          if(ri>aIdx&&S.messages[ri]&&S.messages[ri].role==='assistant'){insertBefore=r;break;}
+          if(ri===aIdx){anchorRow=r;break;}
+        }
+        // Fallback: nearest visible ASSISTANT row at or before aIdx
+        if(!anchorRow){
+          for(let i=allRows.length-1;i>=0;i--){
+            const ri=parseInt(allRows[i].dataset.msgIdx||'-1');
+            if(ri<=aIdx&&S.messages[ri]&&S.messages[ri].role==='assistant'){anchorRow=allRows[i];break;}
+          }
+        }
+      }
+      // aIdx === -1 or no assistant anchor found: attach after the last assistant row
+      if(!anchorRow){
+        for(let i=allRows.length-1;i>=0;i--){
+          const ri=parseInt(allRows[i].dataset.msgIdx||'-1',10);
+          if(ri>=0&&S.messages[ri]&&S.messages[ri].role==='assistant'){anchorRow=allRows[i];break;}
         }
       }
       const frag=document.createDocumentFragment();
@@ -503,17 +763,24 @@ function renderMessages(){
         // Collect card elements before they get moved to DOM
         const cardEls=Array.from(frag.querySelectorAll('.tool-card'));
         const expandBtn=document.createElement('button');
-        expandBtn.textContent='Expand all';
+        expandBtn.textContent=t('expand_all');
         expandBtn.onclick=()=>cardEls.forEach(c=>c.classList.add('open'));
         const collapseBtn=document.createElement('button');
-        collapseBtn.textContent='Collapse all';
+        collapseBtn.textContent=t('collapse_all');
         collapseBtn.onclick=()=>cardEls.forEach(c=>c.classList.remove('open'));
         toggle.appendChild(expandBtn);
         toggle.appendChild(collapseBtn);
         frag.insertBefore(toggle,frag.firstChild);
       }
-      if(insertBefore) inner.insertBefore(frag,insertBefore);
+      // Insert after the anchor row (or after any previously inserted group for
+      // the same anchor), preserving chronological order for multi-step chains.
+      const insertAfterNode = anchorInsertAfter.get(anchorRow) || anchorRow;
+      const refNode = insertAfterNode ? insertAfterNode.nextSibling : null;
+      if(refNode) inner.insertBefore(frag,refNode);
       else inner.appendChild(frag);
+      // Record the last child we inserted so the next group for this anchor
+      // goes after it rather than back at anchorRow.nextSibling.
+      anchorInsertAfter.set(anchorRow, inner.lastChild);
     }
   }
   // Render usage badge on the last assistant message row (if enabled and usage data exists)
@@ -543,12 +810,26 @@ function renderMessages(){
 }
 
 function toolIcon(name){
-  const icons={terminal:'⬛',read_file:'📄',write_file:'✏️',search_files:'🔍',
-    web_search:'🌐',web_extract:'🌐',execute_code:'⚙️',patch:'🔧',
-    memory:'🧠',skill_manage:'📚',todo:'✅',cronjob:'⏱️',delegate_task:'🤖',
-    send_message:'💬',browser_navigate:'🌐',vision_analyze:'👁️',
-    subagent_progress:'🔀'};
-  return icons[name]||'🔧';
+  const icons={
+    terminal:        li('terminal'),
+    read_file:       li('file-text'),
+    write_file:      li('file-pen'),
+    search_files:    li('search'),
+    web_search:      li('globe'),
+    web_extract:     li('globe'),
+    execute_code:    li('play'),
+    patch:           li('wrench'),
+    memory:          li('brain'),
+    skill_manage:    li('book-open'),
+    todo:            li('list-todo'),
+    cronjob:         li('clock'),
+    delegate_task:   li('bot'),
+    send_message:    li('message-square'),
+    browser_navigate:li('globe'),
+    vision_analyze:  li('eye'),
+    subagent_progress:li('shuffle'),
+  };
+  return icons[name]||li('wrench');
 }
 
 function buildToolCard(tc){
@@ -686,7 +967,7 @@ async function submitEdit(msgIdx, newText) {
     // Now send the edited message as a new chat
     $('msg').value = newText;
     await send();
-  } catch(e) { setStatus('Edit failed: ' + e.message); }
+  } catch(e) { setStatus(t('edit_failed') + e.message); }
 }
 
 async function regenerateResponse(btn) {
@@ -712,7 +993,7 @@ async function regenerateResponse(btn) {
     renderMessages();
     $('msg').value = lastUserText;
     await send();
-  } catch(e) { setStatus('Regenerate failed: ' + e.message); }
+  } catch(e) { setStatus(t('regen_failed') + e.message); }
 }
 
 function highlightCode(container) {
@@ -731,12 +1012,12 @@ function addCopyButtons(container){
     if(pre.querySelector('.code-copy-btn')) return;
     const btn=document.createElement('button');
     btn.className='code-copy-btn';
-    btn.textContent='Copy';
+    btn.textContent=t('copy');
     btn.onclick=(e)=>{
       e.stopPropagation();
       navigator.clipboard.writeText(codeEl.textContent).then(()=>{
-        btn.textContent='Copied!';
-        setTimeout(()=>{btn.textContent='Copy';},1500);
+        btn.textContent=t('copied');
+        setTimeout(()=>{btn.textContent=t('copy');},1500);
       });
     };
     const header=pre.previousElementSibling;
@@ -804,17 +1085,17 @@ function appendThinking(){
 function removeThinking(){const el=$('thinkingRow');if(el)el.remove();}
 
 function fileIcon(name, type){
-  if(type==='dir') return '📁';
+  if(type==='dir') return li('folder',14);
   const e=fileExt(name);
-  if(IMAGE_EXTS.has(e)) return '📷';
-  if(MD_EXTS.has(e))    return '📝';
-  if(typeof DOWNLOAD_EXTS!=='undefined'&&DOWNLOAD_EXTS.has(e)) return '⬇️';
-  if(e==='.py')   return '🐍';
-  if(e==='.js'||e==='.ts'||e==='.jsx'||e==='.tsx') return '⚡';
-  if(e==='.json'||e==='.yaml'||e==='.yml'||e==='.toml') return '⚙';
-  if(e==='.sh'||e==='.bash') return '💻';
-  if(e==='.pdf') return '⬇️';
-  return '📄';
+  if(IMAGE_EXTS.has(e)) return li('image',14);
+  if(MD_EXTS.has(e))    return li('file-text',14);
+  if(typeof DOWNLOAD_EXTS!=='undefined'&&DOWNLOAD_EXTS.has(e)) return li('download',14);
+  if(e==='.py')   return li('file-code',14);
+  if(e==='.js'||e==='.ts'||e==='.jsx'||e==='.tsx') return li('zap',14);
+  if(e==='.json'||e==='.yaml'||e==='.yml'||e==='.toml') return li('settings',14);
+  if(e==='.sh'||e==='.bash') return li('terminal',14);
+  if(e==='.pdf') return li('download',14);
+  return li('file-text',14);
 }
 
 function renderBreadcrumb(){
@@ -884,12 +1165,12 @@ function _renderTreeItems(container, entries, depth){
 
     // Icon
     const iconEl=document.createElement('span');
-    iconEl.className='file-icon';iconEl.textContent=fileIcon(item.name,item.type);
+    iconEl.className='file-icon';iconEl.innerHTML=fileIcon(item.name,item.type);
     el.appendChild(iconEl);
 
     // Name
     const nameEl=document.createElement('span');
-    nameEl.className='file-name';nameEl.textContent=item.name;nameEl.title='Double-click to rename';
+    nameEl.className='file-name';nameEl.textContent=item.name;nameEl.title=t('double_click_rename');
     nameEl.ondblclick=(e)=>{
       e.stopPropagation();
       // For directories, double-click navigates (breadcrumb view)
@@ -906,11 +1187,11 @@ function _renderTreeItems(container, entries, depth){
               await api('/api/file/rename',{method:'POST',body:JSON.stringify({
                 session_id:S.session.session_id,path:item.path,new_name:newName
               })});
-              showToast(`Renamed to ${newName}`);
+              showToast(t('renamed_to')+newName);
               // Invalidate cache and re-render
               delete S._dirCache[S.currentDir];
               await loadDir(S.currentDir);
-            }catch(err){showToast('Rename failed: '+err.message);}
+            }catch(err){showToast(t('rename_failed')+err.message);}
           }
         }
         inp.replaceWith(nameEl);
@@ -936,7 +1217,7 @@ function _renderTreeItems(container, entries, depth){
     // Delete button -- for files
     if(item.type==='file'){
       const del=document.createElement('button');
-      del.className='file-del-btn';del.title='Delete';del.textContent='\u00d7';
+      del.className='file-del-btn';del.title=t('delete_title');del.textContent='\u00d7';
       del.onclick=async(e)=>{e.stopPropagation();await deleteWorkspaceFile(item.path,item.name);};
       el.appendChild(del);
     }
@@ -977,7 +1258,7 @@ function _renderTreeItems(container, entries, depth){
         const empty=document.createElement('div');
         empty.className='file-item file-empty';
         empty.style.paddingLeft=(8+(depth+1)*16)+'px';
-        empty.textContent='(empty)';
+        empty.textContent=t('empty_dir');
         container.appendChild(empty);
       }
     }
@@ -986,39 +1267,40 @@ function _renderTreeItems(container, entries, depth){
 
 async function deleteWorkspaceFile(relPath, name){
   if(!S.session)return;
-  if(!confirm(`Delete ${name}?`))return;
+  const _delFile=await showConfirmDialog({title:t('delete_confirm',name),message:'',confirmLabel:'Delete',danger:true,focusCancel:true});
+  if(!_delFile) return;
   try{
     await api('/api/file/delete',{method:'POST',body:JSON.stringify({session_id:S.session.session_id,path:relPath})});
-    showToast(`Deleted ${name}`);
+    showToast(t('deleted')+name);
     // Close preview if we just deleted the viewed file
     if($('previewPathText').textContent===relPath)$('btnClearPreview').onclick();
     await loadDir(S.currentDir);
-  }catch(e){setStatus('Delete failed: '+e.message);}
+  }catch(e){setStatus(t('delete_failed')+e.message);}
 }
 
 async function promptNewFile(){
   if(!S.session)return;
-  const name=prompt('New file name (e.g. notes.md):','');
+  const name=await showPromptDialog({title:t('new_file_prompt'),placeholder:'filename.txt',confirmLabel:t('create')});
   if(!name||!name.trim())return;
   const relPath=S.currentDir==='.'?name.trim():(S.currentDir+'/'+name.trim());
   try{
     await api('/api/file/create',{method:'POST',body:JSON.stringify({session_id:S.session.session_id,path:relPath,content:''})});
-    showToast(`Created ${name.trim()}`);
+    showToast(t('created')+name.trim());
     await loadDir(S.currentDir);
     openFile(relPath);
-  }catch(e){setStatus('Create failed: '+e.message);}
+  }catch(e){setStatus(t('create_failed')+e.message);}
 }
 
 async function promptNewFolder(){
   if(!S.session)return;
-  const name=prompt('New folder name:','');
+  const name=await showPromptDialog({title:t('new_folder_prompt'),placeholder:'folder-name',confirmLabel:t('create')});
   if(!name||!name.trim())return;
   const relPath=S.currentDir==='.'?name.trim():(S.currentDir+'/'+name.trim());
   try{
     await api('/api/file/create-dir',{method:'POST',body:JSON.stringify({session_id:S.session.session_id,path:relPath})});
-    showToast(`Created folder ${name.trim()}`);
+    showToast(t('folder_created')+name.trim());
     await loadDir(S.currentDir);
-  }catch(e){setStatus('Create folder failed: '+e.message);}
+  }catch(e){setStatus(t('folder_create_failed')+e.message);}
 }
 
 function renderTray(){
@@ -1028,7 +1310,7 @@ function renderTray(){
   updateSendBtn();
   S.pendingFiles.forEach((f,i)=>{
     const chip=document.createElement('div');chip.className='attach-chip';
-    chip.innerHTML=`&#128206; ${esc(f.name)} <button title="Remove">&#10005;</button>`;
+    chip.innerHTML=`&#128206; ${esc(f.name)} <button title="${t('remove_title')}">&#10005;</button>`;
     chip.querySelector('button').onclick=()=>{S.pendingFiles.splice(i,1);renderTray();};
     tray.appendChild(chip);
   });
@@ -1050,12 +1332,12 @@ async function uploadPendingFiles(){
       const data=await res.json();
       if(data.error)throw new Error(data.error);
       names.push(data.filename);
-    }catch(e){failures++;setStatus(`\u274c Upload failed: ${f.name} \u2014 ${e.message}`);}
+    }catch(e){failures++;setStatus(`\u274c ${t('upload_failed')}${f.name} \u2014 ${e.message}`);}
     bar.style.width=`${Math.round((i+1)/total*100)}%`;
   }
   barWrap.classList.remove('active');bar.style.width='0%';
   S.pendingFiles=[];renderTray();
-  if(failures===total&&total>0)throw new Error(`All ${total} upload(s) failed`);
+  if(failures===total&&total>0)throw new Error(t('all_uploads_failed',total));
   return names;
 }
 

static/workspace.js

@@ -54,7 +54,7 @@ async function loadDir(path){
     }
     if(typeof clearPreview==='function'){
       if(typeof _previewDirty!=='undefined'&&_previewDirty){
-        if(confirm('You have unsaved changes in the preview. Discard and navigate?'))clearPreview();
+        showConfirmDialog({title:t('unsaved_confirm'),message:'',confirmLabel:'Discard',danger:true,focusCancel:true}).then(ok=>{if(ok)clearPreview();});
       }else{
         clearPreview();
       }
@@ -131,8 +131,8 @@ function updateEditBtn(){
   const editable = _previewCurrentMode==='code'||_previewCurrentMode==='md';
   btn.style.display = editable?'':'none';
   const editing = $('previewEditArea').style.display!=='none';
-  btn.innerHTML = editing ? '💾 Save' : '✎ Edit';
-  btn.title = editing ? 'Save changes' : 'Edit this file';
+  btn.innerHTML = editing ? `💾 ${t('save')}` : `✎ ${t('edit')}`;
+  btn.title = editing ? t('save_title') : t('edit_title');
   btn.style.color = editing ? 'var(--blue)' : '';
   if(_previewDirty) btn.innerHTML = '💾 Save*';
 }
@@ -154,8 +154,8 @@ async function toggleEditMode(){
       $('previewEditArea').style.display='none';
       if(_previewCurrentMode==='code') $('previewCode').style.display='';
       else $('previewMd').style.display='';
-      showToast('Saved');
-    }catch(e){setStatus('Save failed: '+e.message);}
+      showToast(t('saved'));
+    }catch(e){setStatus(t('save_failed')+e.message);}
   }else{
     // Enter edit mode: populate textarea with current content
     const currentText = _previewCurrentMode==='code'
@@ -206,7 +206,7 @@ async function openFile(path){
     const url=`/api/file/raw?session_id=${encodeURIComponent(S.session.session_id)}&path=${encodeURIComponent(path)}`;
     $('previewImg').alt=path;
     $('previewImg').src=url;
-    $('previewImg').onerror=()=>setStatus('Could not load image');
+    $('previewImg').onerror=()=>setStatus(t('image_load_failed'));
   } else if(MD_EXTS.has(ext)){
     // Markdown: fetch text, render with renderMd, display as formatted HTML
     try{
@@ -214,7 +214,7 @@ async function openFile(path){
       showPreview('md');
       _previewRawContent = data.content;
       $('previewMd').innerHTML=renderMd(data.content);
-    }catch(e){setStatus('Could not open file');}
+    }catch(e){setStatus(t('file_open_failed'));}
   } else {
     // Plain code / text -- but fall back to download if server signals binary
     try{
@@ -242,6 +242,6 @@ function downloadFile(path){
   a.href=url;a.download=filename;
   document.body.appendChild(a);a.click();
   setTimeout(()=>document.body.removeChild(a),100);
-  showToast(`Downloading ${filename}\u2026`,2000);
+  showToast(t('downloading',filename),2000);
 }
 

tests/conftest.py

@@ -210,6 +210,18 @@ def test_server():
     Start an isolated test server on TEST_PORT with a clean state directory.
     Paths are discovered dynamically -- no hardcoded absolute path assumptions.
     """
+    # Kill any leftover process on the test port before starting.
+    # Stale servers from QA harness runs or prior test sessions cause
+    # conftest to think the server is already up, producing false failures.
+    try:
+        import subprocess as _sp
+        _sp.run(['fuser', '-k', f'{TEST_PORT}/tcp'],
+                capture_output=True, timeout=5)
+    except Exception:
+        pass
+    import time as _time
+    _time.sleep(0.5)  # brief pause to let the port release
+
     # Clean slate
     if TEST_STATE_DIR.exists():
         shutil.rmtree(TEST_STATE_DIR)
@@ -226,6 +238,13 @@ def test_server():
     # Isolated cron state
     (TEST_STATE_DIR / 'cron').mkdir(parents=True, exist_ok=True)
 
+    # Expose TEST_STATE_DIR to the test process itself so that tests which write
+    # directly to state.db (e.g. test_gateway_sync.py) always use the same path
+    # as the server.  Other test files (test_auth_sessions.py) may override
+    # HERMES_WEBUI_STATE_DIR for their own purposes, but HERMES_WEBUI_TEST_STATE_DIR
+    # is reserved for this mapping and is never overridden by individual test files.
+    os.environ.setdefault('HERMES_WEBUI_TEST_STATE_DIR', str(TEST_STATE_DIR))
+
     env = os.environ.copy()
     env.update({
         "HERMES_WEBUI_PORT":              str(TEST_PORT),

tests/test_approval_unblock.py

@@ -0,0 +1,288 @@
+"""
+Tests for fix/approval-stuck-thinking:
+Verify that /api/approval/respond correctly unblocks gateway approval queues
+and that the approval module exports the symbols streaming.py and routes.py
+need to prevent the UI getting stuck in "Thinking…" during dangerous commands.
+"""
+
+import json
+import threading
+import uuid
+import urllib.request
+import urllib.error
+import urllib.parse
+
+import pytest
+
+# Import approval internals — shared module-level state within this process.
+# The HTTP tests use the test server (port 8788, separate process).
+# The unit tests operate directly on the module.
+try:
+    from tools.approval import (
+        register_gateway_notify,
+        unregister_gateway_notify,
+        resolve_gateway_approval,
+        _gateway_queues,
+        _gateway_notify_cbs,
+        _lock,
+        _ApprovalEntry,
+        submit_pending,
+    )
+    # has_pending and pop_pending were removed from tools.approval when the
+    # agent renamed has_pending -> has_blocking_approval (gateway queue check)
+    # and removed the polling-mode pop_pending. Routes now check _pending
+    # directly. These symbols are no longer part of the public API.
+    APPROVAL_AVAILABLE = True
+except ImportError:
+    APPROVAL_AVAILABLE = False
+
+pytestmark = pytest.mark.skipif(
+    not APPROVAL_AVAILABLE,
+    reason="tools.approval not available in this environment"
+)
+
+BASE = "http://127.0.0.1:8788"
+
+
+def get(path):
+    url = BASE + path
+    with urllib.request.urlopen(url, timeout=10) as r:
+        return json.loads(r.read())
+
+
+def post(path, body=None):
+    url = BASE + path
+    data = json.dumps(body or {}).encode()
+    req = urllib.request.Request(url, data=data,
+          headers={"Content-Type": "application/json"})
+    try:
+        with urllib.request.urlopen(req, timeout=10) as r:
+            return json.loads(r.read()), r.status
+    except urllib.error.HTTPError as e:
+        return json.loads(e.read()), e.code
+
+
+# ── Unit tests (in-process, no HTTP server needed) ──────────────────────────
+
+class TestGatewayApprovalUnblocking:
+    """Unit tests for the gateway queue unblocking mechanism."""
+
+    def test_resolve_gateway_approval_sets_event(self):
+        """resolve_gateway_approval() must set the entry's event and store the result."""
+        sid = f"unit-resolve-{uuid.uuid4().hex[:8]}"
+        data = {"command": "rm -rf /tmp/x", "description": "recursive delete"}
+        entry = _ApprovalEntry(data)
+        with _lock:
+            _gateway_queues.setdefault(sid, []).append(entry)
+
+        resolved = resolve_gateway_approval(sid, "once", resolve_all=False)
+        assert resolved == 1
+        assert entry.event.is_set()
+        assert entry.result == "once"
+
+        # Queue should be cleaned up
+        with _lock:
+            assert sid not in _gateway_queues
+
+    def test_resolve_gateway_approval_deny(self):
+        """Deny choice is propagated correctly."""
+        sid = f"unit-deny-{uuid.uuid4().hex[:8]}"
+        entry = _ApprovalEntry({"command": "pkill -9 x", "description": "force kill"})
+        with _lock:
+            _gateway_queues.setdefault(sid, []).append(entry)
+
+        resolve_gateway_approval(sid, "deny")
+        assert entry.result == "deny"
+
+    def test_resolve_gateway_approval_no_queue_is_harmless(self):
+        """resolve_gateway_approval with no queue entry returns 0, no crash."""
+        sid = f"unit-no-queue-{uuid.uuid4().hex[:8]}"
+        result = resolve_gateway_approval(sid, "once")
+        assert result == 0
+
+    def test_resolve_all_unblocks_multiple_entries(self):
+        """resolve_all=True unblocks every pending entry in the queue."""
+        sid = f"unit-resolve-all-{uuid.uuid4().hex[:8]}"
+        entries = [_ApprovalEntry({"command": f"cmd{i}"}) for i in range(3)]
+        with _lock:
+            _gateway_queues[sid] = list(entries)
+
+        resolved = resolve_gateway_approval(sid, "session", resolve_all=True)
+        assert resolved == 3
+        for e in entries:
+            assert e.event.is_set()
+            assert e.result == "session"
+
+    def test_register_and_fire_notify_cb(self):
+        """register_gateway_notify stores the cb; calling it delivers approval data."""
+        sid = f"unit-notify-{uuid.uuid4().hex[:8]}"
+        fired = []
+        register_gateway_notify(sid, lambda d: fired.append(d))
+
+        with _lock:
+            cb = _gateway_notify_cbs.get(sid)
+        assert cb is not None
+
+        data = {"command": "test", "description": "test"}
+        cb(data)
+        assert fired == [data]
+
+        unregister_gateway_notify(sid)
+
+    def test_unregister_clears_cb_and_signals_entries(self):
+        """unregister_gateway_notify removes cb and unblocks any queued entries."""
+        sid = f"unit-unreg-{uuid.uuid4().hex[:8]}"
+        register_gateway_notify(sid, lambda d: None)
+
+        entry = _ApprovalEntry({"command": "x"})
+        with _lock:
+            _gateway_queues.setdefault(sid, []).append(entry)
+
+        unregister_gateway_notify(sid)
+
+        assert entry.event.is_set(), "unregister should signal blocked entries"
+        with _lock:
+            assert sid not in _gateway_notify_cbs
+            assert sid not in _gateway_queues
+
+    def test_streaming_approval_integration(self):
+        """
+        End-to-end unit simulation of the streaming.py fix:
+        1. streaming.py registers notify_cb
+        2. check_all_command_guards fires notify_cb (pushing approval SSE)
+        3. User responds — resolve_gateway_approval unblocks agent thread
+        4. Agent thread sees choice and continues
+        """
+        sid = f"unit-e2e-{uuid.uuid4().hex[:8]}"
+        approval_events_sent = []
+
+        # Step 1: streaming.py registers the notify callback
+        def _approval_notify_cb(approval_data):
+            approval_events_sent.append(approval_data)  # would be put('approval', ...)
+        register_gateway_notify(sid, _approval_notify_cb)
+
+        # Step 2: check_all_command_guards fires the callback and queues an entry
+        approval_data = {
+            "command": "rm -rf /tmp/test",
+            "pattern_key": "recursive delete",
+            "pattern_keys": ["recursive delete"],
+            "description": "recursive delete",
+        }
+        entry = _ApprovalEntry(approval_data)
+        with _lock:
+            _gateway_queues.setdefault(sid, []).append(entry)
+        # notify_cb fires synchronously (gateway notifies user)
+        with _lock:
+            cb = _gateway_notify_cbs.get(sid)
+        cb(approval_data)
+
+        assert len(approval_events_sent) == 1, "approval SSE event should have been queued"
+
+        # Step 3: user responds via /api/approval/respond → resolve_gateway_approval
+        resolved = resolve_gateway_approval(sid, "once")
+        assert resolved == 1
+
+        # Step 4: agent thread is unblocked with the correct choice
+        assert entry.event.is_set()
+        assert entry.result == "once"
+
+        # Cleanup
+        unregister_gateway_notify(sid)
+
+
+# ── Symbol existence tests ───────────────────────────────────────────────────
+
+class TestApprovalModuleExports:
+    """Verify the module exports all symbols that streaming.py and routes.py need."""
+
+    def test_register_gateway_notify_exported(self):
+        import tools.approval as ap
+        assert hasattr(ap, "register_gateway_notify"), \
+            "tools.approval must export register_gateway_notify"
+
+    def test_unregister_gateway_notify_exported(self):
+        import tools.approval as ap
+        assert hasattr(ap, "unregister_gateway_notify"), \
+            "tools.approval must export unregister_gateway_notify"
+
+    def test_resolve_gateway_approval_exported(self):
+        import tools.approval as ap
+        assert hasattr(ap, "resolve_gateway_approval"), \
+            "tools.approval must export resolve_gateway_approval"
+
+    def test_approval_entry_exported(self):
+        import tools.approval as ap
+        assert hasattr(ap, "_ApprovalEntry"), \
+            "tools.approval must export _ApprovalEntry"
+
+
+# ── HTTP regression tests (test server, port 8788) ───────────────────────────
+
+class TestApprovalHTTPEndpoints:
+    """
+    Regression tests for /api/approval/respond against the live test server.
+    These verify that the HTTP layer behaves correctly — they don't rely on
+    in-process module state shared with the server subprocess.
+    """
+
+    def test_respond_returns_ok_no_pending(self):
+        """respond with no pending entry returns ok (no crash, no 500)."""
+        sid = f"http-no-pending-{uuid.uuid4().hex[:8]}"
+        result, status = post("/api/approval/respond", {
+            "session_id": sid,
+            "choice": "deny",
+        })
+        assert status == 200
+        assert result["ok"] is True
+
+    def test_respond_clears_injected_pending(self):
+        """Inject a pending entry, respond, verify it's cleared."""
+        sid = f"http-clear-{uuid.uuid4().hex[:8]}"
+        cmd = "rm -rf /tmp/testdir"
+
+        inject = get(f"/api/approval/inject_test?session_id={urllib.parse.quote(sid)}"
+                     f"&pattern_key=recursive+delete&command={urllib.parse.quote(cmd)}")
+        assert inject["ok"] is True
+
+        data = get(f"/api/approval/pending?session_id={urllib.parse.quote(sid)}")
+        assert data["pending"] is not None
+
+        result, status = post("/api/approval/respond", {
+            "session_id": sid,
+            "choice": "deny",
+        })
+        assert status == 200
+        assert result["ok"] is True
+
+        data2 = get(f"/api/approval/pending?session_id={urllib.parse.quote(sid)}")
+        assert data2["pending"] is None, "pending should be cleared after respond"
+
+    def test_respond_rejects_invalid_choice(self):
+        """respond with an unknown choice returns 400."""
+        result, status = post("/api/approval/respond", {
+            "session_id": "some-session",
+            "choice": "INVALID",
+        })
+        assert status == 400
+
+    def test_respond_requires_session_id(self):
+        """respond without session_id returns 400."""
+        result, status = post("/api/approval/respond", {"choice": "deny"})
+        assert status == 400
+
+    def test_respond_session_choice_clears_pending(self):
+        """Inject pending, respond with 'session', verify cleared."""
+        sid = f"http-session-{uuid.uuid4().hex[:8]}"
+        inject = get(f"/api/approval/inject_test?session_id={urllib.parse.quote(sid)}"
+                     f"&pattern_key=force+kill+processes&command=pkill+-9+something")
+        assert inject["ok"] is True
+
+        result, status = post("/api/approval/respond", {
+            "session_id": sid,
+            "choice": "session",
+        })
+        assert status == 200
+        assert result["choice"] == "session"
+
+        data = get(f"/api/approval/pending?session_id={urllib.parse.quote(sid)}")
+        assert data["pending"] is None

tests/test_auth_sessions.py

@@ -0,0 +1,134 @@
+"""
+Tests for auth session lifecycle — session creation, verification, expiry,
+and lazy pruning of expired entries.
+"""
+import time
+import unittest
+from pathlib import Path
+import tempfile
+import os
+
+# Isolate state dir so we don't touch real sessions
+_TEST_STATE = Path(tempfile.mkdtemp())
+os.environ["HERMES_WEBUI_STATE_DIR"] = str(_TEST_STATE)
+
+import sys
+sys.path.insert(0, str(Path(__file__).parent.parent))
+
+import importlib
+
+# Force re-import of auth module so it picks up our TEST_STATE_DIR
+auth = importlib.import_module("api.auth")
+
+
+class TestSessionPruning(unittest.TestCase):
+    """Verify expired session cleanup works correctly."""
+
+    def setUp(self):
+        # Clear any leftover sessions from other tests
+        auth._sessions.clear()
+
+    def test_session_created_valid(self):
+        """A fresh session token should verify as valid."""
+        token = auth.create_session()
+        self.assertTrue(auth.verify_session(token))
+
+    def test_expired_session_pruned(self):
+        """Manually inserting an expired entry should be pruned on next verify_session call."""
+        # Insert sessions that have already expired
+        auth._sessions["fake_token"] = time.time() - 100
+        auth._sessions["another_fake"] = time.time() - 50
+        # Insert one valid session (far future)
+        auth._sessions["good_token"] = time.time() + 3600
+
+        # _sessions has 3 entries, 2 expired
+        self.assertEqual(len(auth._sessions), 3)
+
+        # Call verify_session — this triggers _prune_expired_sessions()
+        # Cookie format is token.signature, so we need a dot to pass the early check
+        auth.verify_session("fake_token.fake_sig")
+
+        # After verification, only the valid session should remain
+        self.assertEqual(len(auth._sessions), 1)
+        self.assertIn("good_token", auth._sessions)
+        self.assertNotIn("fake_token", auth._sessions)
+        self.assertNotIn("another_fake", auth._sessions)
+
+    def test_prune_does_not_remove_valid_sessions(self):
+        """_prune_expired_sessions should never remove sessions that are still active."""
+        auth._sessions["active_1"] = time.time() + 86400  # 24 hours from now
+        auth._sessions["active_2"] = time.time() + 7200    # 2 hours from now
+        auth._sessions["expired_1"] = time.time() - 10
+
+        auth._prune_expired_sessions()
+
+        self.assertEqual(len(auth._sessions), 2)
+        self.assertIn("active_1", auth._sessions)
+        self.assertIn("active_2", auth._sessions)
+        self.assertNotIn("expired_1", auth._sessions)
+
+    def test_verify_session_prunes_before_verification(self):
+        """verify_session should prune expired entries before checking the target token.
+
+        This ensures that _prune_expired_sessions() is called at the very top
+        of verify_session(), so cleanup happens on every auth check.
+        """
+        auth._sessions["expired_for_test"] = time.time() - 999
+
+        # verify_session with an invalid cookie triggers the full path:
+        # _prune_expired_sessions -> signature check -> return False
+        result = auth.verify_session("nonexistent.bad_sig")
+        self.assertFalse(result)
+
+        # The expired entry should have been cleaned up
+        self.assertNotIn("expired_for_test", auth._sessions)
+
+    def test_prune_handles_empty_dict(self):
+        """_prune_expired_sessions should be safe on an empty dict."""
+        auth._sessions.clear()
+        auth._prune_expired_sessions()
+        self.assertEqual(len(auth._sessions), 0)
+
+    def test_session_ttl_is_24_hours(self):
+        """Newly created sessions should have the expected 24-hour TTL."""
+        auth._sessions.clear()
+        token_hex = auth.create_session().split(".")[0]
+        # The _sessions dict stores token -> expiry_time
+        # We can check the expiry is approximately SESSION_TTL seconds from now
+        # by looking up the raw entry via the token
+        from api.auth import _sessions, SESSION_TTL
+        # find our entry
+        for t, exp in _sessions.items():
+            if t == token_hex:
+                # expiry should be within 5 seconds of now + SESSION_TTL
+                expected = time.time() + SESSION_TTL
+                self.assertAlmostEqual(exp, expected, delta=5)
+                break
+        else:
+            self.fail("Session token not found in _sessions")
+
+
+class TestSessionInvalidation(unittest.TestCase):
+    """Test session logout / invalidation."""
+
+    def setUp(self):
+        auth._sessions.clear()
+
+    def test_invalidate_session_removes_token(self):
+        """Calling invalidate_session should remove the token from _sessions."""
+        token = auth.create_session()
+        self.assertTrue(auth.verify_session(token))
+
+        auth.invalidate_session(token)
+        # Token should be gone
+        self.assertFalse(auth.verify_session(token))
+
+    def test_invalidate_unknown_token_is_safe(self):
+        """Invalidating a non-existent token should not raise."""
+        auth._sessions.clear()
+        auth.invalidate_session("nonexistent_token")
+        # Should not raise
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_cancel_interrupt.py

@@ -0,0 +1,115 @@
+"""
+Unit tests for cancel/interrupt functionality.
+Tests the integration between cancel_stream() and agent.interrupt().
+"""
+import pytest
+import queue
+import threading
+from unittest.mock import Mock
+
+from api.streaming import cancel_stream
+from api.config import AGENT_INSTANCES, STREAMS, CANCEL_FLAGS
+
+
+class TestCancelInterrupt:
+    """Test suite for cancel/interrupt functionality"""
+
+    def setup_method(self):
+        """Clean up before each test"""
+        AGENT_INSTANCES.clear()
+        STREAMS.clear()
+        CANCEL_FLAGS.clear()
+
+    def teardown_method(self):
+        """Clean up after each test"""
+        AGENT_INSTANCES.clear()
+        STREAMS.clear()
+        CANCEL_FLAGS.clear()
+
+    def test_cancel_calls_agent_interrupt(self):
+        """Verify that cancel_stream() calls agent.interrupt() when agent exists"""
+        # Setup
+        stream_id = "test_stream_123"
+        mock_agent = Mock()
+        mock_agent.interrupt = Mock()
+
+        STREAMS[stream_id] = queue.Queue()
+        CANCEL_FLAGS[stream_id] = threading.Event()
+        AGENT_INSTANCES[stream_id] = mock_agent
+
+        # Execute
+        result = cancel_stream(stream_id)
+
+        # Assert
+        assert result is True
+        mock_agent.interrupt.assert_called_once_with("Cancelled by user")
+        assert CANCEL_FLAGS[stream_id].is_set()
+
+    def test_cancel_handles_interrupt_exception(self):
+        """Verify that cancel_stream() handles interrupt() exceptions gracefully"""
+        stream_id = "test_stream_456"
+        mock_agent = Mock()
+        mock_agent.interrupt = Mock(side_effect=RuntimeError("Agent error"))
+
+        STREAMS[stream_id] = queue.Queue()
+        CANCEL_FLAGS[stream_id] = threading.Event()
+        AGENT_INSTANCES[stream_id] = mock_agent
+
+        # Should not raise exception
+        result = cancel_stream(stream_id)
+
+        # Assert
+        assert result is True
+        mock_agent.interrupt.assert_called_once()
+        assert CANCEL_FLAGS[stream_id].is_set()
+
+    def test_cancel_before_agent_ready(self):
+        """Test cancel when agent not yet stored in AGENT_INSTANCES (race condition)"""
+        stream_id = "test_stream_789"
+
+        STREAMS[stream_id] = queue.Queue()
+        CANCEL_FLAGS[stream_id] = threading.Event()
+        # Note: AGENT_INSTANCES[stream_id] not set (simulating race condition)
+
+        # Should succeed even without agent
+        result = cancel_stream(stream_id)
+
+        # Assert
+        assert result is True
+        assert CANCEL_FLAGS[stream_id].is_set()
+        # Agent will check this flag when it starts
+
+    def test_cancel_nonexistent_stream(self):
+        """Test cancel for a stream that doesn't exist"""
+        result = cancel_stream("nonexistent_stream")
+        assert result is False
+
+    def test_cancel_sets_cancel_event(self):
+        """Verify that cancel_stream() sets the cancel_event flag"""
+        stream_id = "test_stream_event"
+
+        STREAMS[stream_id] = queue.Queue()
+        cancel_event = threading.Event()
+        CANCEL_FLAGS[stream_id] = cancel_event
+
+        result = cancel_stream(stream_id)
+
+        assert result is True
+        assert cancel_event.is_set()
+
+    def test_cancel_puts_sentinel_in_queue(self):
+        """Verify that cancel_stream() puts cancel sentinel in queue"""
+        stream_id = "test_stream_queue"
+        q = queue.Queue()
+
+        STREAMS[stream_id] = q
+        CANCEL_FLAGS[stream_id] = threading.Event()
+
+        result = cancel_stream(stream_id)
+
+        assert result is True
+        # Check that cancel message was queued
+        assert not q.empty()
+        event_type, data = q.get_nowait()
+        assert event_type == 'cancel'
+        assert data['message'] == 'Cancelled by user'

tests/test_gateway_sync.py

@@ -0,0 +1,364 @@
+"""
+Tests for Phase 1: Real-time Gateway Session Sync.
+
+Tests are ordered TDD-style:
+  1. Gateway sessions appear in /api/sessions when setting enabled
+  2. Gateway sessions excluded when setting disabled
+  3. Gateway sessions have correct metadata (source_tag, is_cli_session)
+  4. SSE stream endpoint opens and receives events
+  5. Watcher detects new sessions inserted into state.db
+  6. Settings UI has renamed label
+"""
+import json
+import os
+import pathlib
+import sqlite3
+import time
+import urllib.error
+import urllib.request
+
+REPO_ROOT = pathlib.Path(__file__).parent.parent.resolve()
+BASE = "http://127.0.0.1:8788"
+
+
+def get(path):
+    with urllib.request.urlopen(BASE + path, timeout=10) as r:
+        return json.loads(r.read()), r.status
+
+
+def post(path, body=None):
+    data = json.dumps(body or {}).encode()
+    req = urllib.request.Request(BASE + path, data=data,
+                                  headers={"Content-Type": "application/json"})
+    try:
+        with urllib.request.urlopen(req, timeout=10) as r:
+            return json.loads(r.read()), r.status
+    except urllib.error.HTTPError as e:
+        try:
+            return json.loads(e.read()), e.code
+        except Exception:
+            return {}, e.code
+
+
+def _get_test_state_dir():
+    """Return the test state directory (matches conftest.py TEST_STATE_DIR).
+
+    conftest.py sets HERMES_WEBUI_TEST_STATE_DIR in the test-process environment
+    (via os.environ.setdefault) so that tests writing directly to state.db always
+    use the same path the test server was started with.  If the env var is not
+    set (e.g. when running this file standalone), fall back to the conftest
+    formula: HERMES_HOME/webui-mvp-test.
+    """
+    explicit = os.getenv('HERMES_WEBUI_TEST_STATE_DIR')
+    if explicit:
+        return pathlib.Path(explicit)
+    hermes_home = pathlib.Path(os.getenv('HERMES_HOME', str(pathlib.Path.home() / '.hermes')))
+    return hermes_home / 'webui-mvp-test'  # matches conftest.py TEST_STATE_DIR formula
+
+
+def _get_state_db_path():
+    """Return path to the test state.db."""
+    return _get_test_state_dir() / 'state.db'
+
+
+def _ensure_state_db():
+    """Create state.db with sessions and messages tables if it doesn't exist.
+    Returns a connection. Does NOT delete existing data (safe for parallel tests).
+    """
+    db_path = _get_state_db_path()
+    db_path.parent.mkdir(parents=True, exist_ok=True)
+    conn = sqlite3.connect(str(db_path))
+    conn.row_factory = sqlite3.Row
+    conn.execute("PRAGMA journal_mode=WAL")
+    conn.executescript("""
+        CREATE TABLE IF NOT EXISTS sessions (
+            id TEXT PRIMARY KEY,
+            source TEXT NOT NULL,
+            user_id TEXT,
+            model TEXT,
+            started_at REAL NOT NULL,
+            message_count INTEGER DEFAULT 0,
+            title TEXT
+        );
+        CREATE TABLE IF NOT EXISTS messages (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            session_id TEXT NOT NULL,
+            role TEXT NOT NULL,
+            content TEXT,
+            timestamp REAL NOT NULL
+        );
+    """)
+    conn.commit()
+    return conn
+
+
+def _insert_gateway_session(conn, session_id='20260401_120000_abcdefgh', source='telegram',
+                             title='Telegram Chat', model='anthropic/claude-sonnet-4-5',
+                             started_at=None, message_count=2):
+    """Insert a gateway session into state.db."""
+    conn.execute(
+        "INSERT OR REPLACE INTO sessions (id, source, title, model, started_at, message_count) "
+        "VALUES (?, ?, ?, ?, ?, ?)",
+        (session_id, source, title, model, started_at or time.time(), message_count)
+    )
+    # Delete any existing messages for this session (idempotent re-insert)
+    conn.execute("DELETE FROM messages WHERE session_id = ?", (session_id,))
+    # Insert some messages
+    conn.execute(
+        "INSERT INTO messages (session_id, role, content, timestamp) VALUES (?, 'user', ?, ?)",
+        (session_id, 'Hello from Telegram', started_at or time.time())
+    )
+    conn.execute(
+        "INSERT INTO messages (session_id, role, content, timestamp) VALUES (?, 'assistant', ?, ?)",
+        (session_id, 'Hi there!', (started_at or time.time()) + 1)
+    )
+    conn.commit()
+
+
+def _remove_test_sessions(conn, *session_ids):
+    """Remove specific test sessions from state.db (parallel-safe cleanup)."""
+    for sid in session_ids:
+        conn.execute("DELETE FROM messages WHERE session_id = ?", (sid,))
+        conn.execute("DELETE FROM sessions WHERE id = ?", (sid,))
+    conn.commit()
+
+
+def _cleanup_state_db():
+    """Remove state.db if it exists (only used for tests that need a blank slate)."""
+    db_path = _get_state_db_path()
+    for p in [db_path, db_path.parent / 'state.db-wal', db_path.parent / 'state.db-shm']:
+        try:
+            p.unlink(missing_ok=True)
+        except Exception:
+            pass
+
+
+# ── Tests ──────────────────────────────────────────────────────────────────
+
+def test_gateway_sessions_appear_when_enabled():
+    """Gateway sessions from state.db appear in /api/sessions when show_cli_sessions is on."""
+    conn = _ensure_state_db()
+    try:
+        _insert_gateway_session(conn, session_id='gw_test_tg_001', source='telegram', title='TG Test Chat')
+
+        # Enable the setting
+        post('/api/settings', {'show_cli_sessions': True})
+
+        data, status = get('/api/sessions')
+        assert status == 200
+        sessions = data.get('sessions', [])
+        gw_ids = [s['session_id'] for s in sessions if s.get('session_id') == 'gw_test_tg_001']
+        assert len(gw_ids) == 1, f"Expected gateway session gw_test_tg_001, got {[s['session_id'] for s in sessions]}"
+    finally:
+        try:
+            _remove_test_sessions(conn, 'gw_test_tg_001')
+            conn.close()
+        except Exception:
+            pass
+        post('/api/settings', {'show_cli_sessions': False})
+
+
+def test_gateway_sessions_excluded_when_disabled():
+    """Gateway sessions are NOT returned when show_cli_sessions is off."""
+    conn = _ensure_state_db()
+    try:
+        _insert_gateway_session(conn, session_id='gw_test_dc_001', source='discord', title='DC Test Chat')
+
+        # Ensure setting is off
+        post('/api/settings', {'show_cli_sessions': False})
+
+        data, status = get('/api/sessions')
+        assert status == 200
+        sessions = data.get('sessions', [])
+        gw_ids = [s['session_id'] for s in sessions if s.get('session_id') == 'gw_test_dc_001']
+        assert len(gw_ids) == 0, "Gateway session should not appear when setting is off"
+    finally:
+        try:
+            _remove_test_sessions(conn, 'gw_test_dc_001')
+            conn.close()
+        except Exception:
+            pass
+
+
+def test_gateway_session_has_correct_metadata():
+    """Gateway sessions include source_tag and is_cli_session fields."""
+    conn = _ensure_state_db()
+    try:
+        _insert_gateway_session(conn, session_id='gw_meta_001', source='telegram', title='Meta Test')
+
+        post('/api/settings', {'show_cli_sessions': True})
+
+        data, status = get('/api/sessions')
+        assert status == 200
+        sessions = data.get('sessions', [])
+        gw = next((s for s in sessions if s['session_id'] == 'gw_meta_001'), None)
+        assert gw is not None, "Gateway session not found"
+        assert gw.get('source_tag') == 'telegram', f"Expected source_tag=telegram, got {gw.get('source_tag')}"
+        assert gw.get('is_cli_session') is True, "is_cli_session should be True for agent sessions"
+        assert gw.get('title') == 'Meta Test'
+    finally:
+        try:
+            _remove_test_sessions(conn, 'gw_meta_001')
+            conn.close()
+        except Exception:
+            pass
+        post('/api/settings', {'show_cli_sessions': False})
+
+
+def test_gateway_session_has_message_count():
+    """Gateway sessions report correct message_count from state.db."""
+    conn = _ensure_state_db()
+    try:
+        _insert_gateway_session(conn, session_id='gw_msg_001', source='discord', title='Msg Count Test', message_count=5)
+
+        post('/api/settings', {'show_cli_sessions': True})
+
+        data, status = get('/api/sessions')
+        assert status == 200
+        sessions = data.get('sessions', [])
+        gw = next((s for s in sessions if s['session_id'] == 'gw_msg_001'), None)
+        assert gw is not None
+        assert gw.get('message_count') == 5, f"Expected message_count=5, got {gw.get('message_count')}"
+    finally:
+        try:
+            _remove_test_sessions(conn, 'gw_msg_001')
+            conn.close()
+        except Exception:
+            pass
+        post('/api/settings', {'show_cli_sessions': False})
+
+
+def test_gateway_sessions_multiple_sources():
+    """Sessions from multiple gateway sources (telegram, discord, slack) all appear."""
+    conn = _ensure_state_db()
+    try:
+        _insert_gateway_session(conn, session_id='gw_multi_tg', source='telegram', title='TG Chat')
+        _insert_gateway_session(conn, session_id='gw_multi_dc', source='discord', title='DC Chat')
+        _insert_gateway_session(conn, session_id='gw_multi_sl', source='slack', title='SL Chat')
+
+        post('/api/settings', {'show_cli_sessions': True})
+
+        data, status = get('/api/sessions')
+        assert status == 200
+        sessions = data.get('sessions', [])
+        gw_ids = {s['session_id'] for s in sessions if s.get('session_id') in ('gw_multi_tg', 'gw_multi_dc', 'gw_multi_sl')}
+        assert len(gw_ids) == 3, f"Expected 3 gateway sessions, got {len(gw_ids)}: {gw_ids}"
+    finally:
+        try:
+            _remove_test_sessions(conn, 'gw_multi_tg', 'gw_multi_dc', 'gw_multi_sl')
+            conn.close()
+        except Exception:
+            pass
+        post('/api/settings', {'show_cli_sessions': False})
+
+
+def test_gateway_session_messages_readable():
+    """Gateway session messages can be loaded via /api/session."""
+    conn = _ensure_state_db()
+    try:
+        _insert_gateway_session(conn, session_id='gw_read_001', source='telegram', title='Readable')
+
+        post('/api/settings', {'show_cli_sessions': True})
+
+        data, status = get(f'/api/session?session_id=gw_read_001')
+        assert status == 200
+        msgs = data.get('session', {}).get('messages', [])
+        assert len(msgs) >= 2, f"Expected at least 2 messages, got {len(msgs)}"
+        assert msgs[0].get('role') == 'user'
+        assert msgs[0].get('content') == 'Hello from Telegram'
+    finally:
+        try:
+            _remove_test_sessions(conn, 'gw_read_001')
+            conn.close()
+        except Exception:
+            pass
+        post('/api/settings', {'show_cli_sessions': False})
+
+
+def test_gateway_sse_stream_endpoint_exists():
+    """GET /api/sessions/gateway/stream returns a response (200 or 200-range)."""
+    # The SSE endpoint requires show_cli_sessions to be enabled
+    post('/api/settings', {'show_cli_sessions': True})
+    try:
+        req = urllib.request.Request(BASE + '/api/sessions/gateway/stream')
+        with urllib.request.urlopen(req, timeout=5) as r:
+            assert r.status in (200, 204), f"Expected 200/204, got {r.status}"
+            # SSE should have content-type text/event-stream
+            ctype = r.headers.get('Content-Type', '')
+            assert 'text/event-stream' in ctype, f"Expected text/event-stream, got {ctype}"
+    except Exception as e:
+        # Timeout is acceptable — means the connection is held open (SSE behavior)
+        if 'timed out' in str(e).lower() or 'timeout' in str(e).lower():
+            pass  # Good: SSE keeps the connection open
+        else:
+            raise
+    finally:
+        post('/api/settings', {'show_cli_sessions': False})
+
+
+def test_gateway_webui_sessions_not_duplicated():
+    """If a session_id exists both in WebUI store and state.db, it's not duplicated."""
+    # Create a WebUI session with a known ID
+    body = {}
+    d, _ = post('/api/session/new', body)
+    webui_sid = d['session']['session_id']
+
+    try:
+        # Insert the same session_id into state.db as a gateway session
+        conn = _ensure_state_db()
+        _insert_gateway_session(conn, session_id=webui_sid, source='telegram', title='Dup Test')
+        conn.close()
+
+        post('/api/settings', {'show_cli_sessions': True})
+
+        data, status = get('/api/sessions')
+        assert status == 200
+        sessions = data.get('sessions', [])
+        matching = [s for s in sessions if s['session_id'] == webui_sid]
+        assert len(matching) == 1, f"Expected 1 entry for {webui_sid}, got {len(matching)}"
+    finally:
+        try:
+            conn2 = sqlite3.connect(str(_get_state_db_path()))
+            _remove_test_sessions(conn2, webui_sid)
+            conn2.close()
+        except Exception:
+            pass
+        post('/api/session/delete', {'session_id': webui_sid})
+        post('/api/settings', {'show_cli_sessions': False})
+
+
+def test_gateway_sessions_no_state_db():
+    """When state.db doesn't exist, /api/sessions works fine (no gateway sessions)."""
+    _cleanup_state_db()
+
+    post('/api/settings', {'show_cli_sessions': True})
+    try:
+        data, status = get('/api/sessions')
+        assert status == 200
+        # Should succeed with just webui sessions (or empty)
+        assert 'sessions' in data
+    finally:
+        post('/api/settings', {'show_cli_sessions': False})
+
+
+def test_cli_sessions_still_work():
+    """CLI sessions (source='cli') still appear alongside gateway sessions."""
+    conn = _ensure_state_db()
+    try:
+        _insert_gateway_session(conn, session_id='cli_legacy_001', source='cli', title='CLI Legacy')
+        _insert_gateway_session(conn, session_id='gw_new_001', source='telegram', title='GW New')
+
+        post('/api/settings', {'show_cli_sessions': True})
+
+        data, status = get('/api/sessions')
+        assert status == 200
+        sessions = data.get('sessions', [])
+        agent_ids = {s['session_id'] for s in sessions if s.get('session_id') in ('cli_legacy_001', 'gw_new_001')}
+        assert len(agent_ids) == 2, f"Expected 2 agent sessions (cli + gateway), got {len(agent_ids)}"
+    finally:
+        try:
+            _remove_test_sessions(conn, 'cli_legacy_001', 'gw_new_001')
+            conn.close()
+        except Exception:
+            pass
+        post('/api/settings', {'show_cli_sessions': False})

tests/test_mobile_layout.py

@@ -0,0 +1,177 @@
+"""
+Mobile layout regression tests — run on every QA pass.
+
+These tests check that the CSS and HTML structure required for correct
+mobile rendering (375px–640px viewport widths) is intact after every change.
+They are static checks (no server needed) that catch common regressions:
+
+  - Mobile breakpoints present for key layout elements
+  - Right panel slide-over markup and CSS intact
+  - Profile dropdown not clipped by overflow on mobile
+  - Composer footer chips scroll correctly on narrow viewports
+  - Mobile bottom nav and overlay markup present
+  - No full-viewport overflow that would break scroll
+
+Run as part of the standard test suite:
+    pytest tests/test_mobile_layout.py -v
+"""
+
+import pathlib
+import re
+
+REPO = pathlib.Path(__file__).parent.parent
+HTML = (REPO / "static" / "index.html").read_text(encoding="utf-8")
+CSS  = (REPO / "static" / "style.css").read_text(encoding="utf-8")
+
+
+# ── Mobile breakpoint rules ───────────────────────────────────────────────────
+
+def test_mobile_breakpoint_900px_present():
+    """@media(max-width:900px) must hide the right panel and show mobile-files-btn."""
+    assert "@media(max-width:900px)" in CSS or "@media (max-width: 900px)" in CSS, \
+        "Missing @media(max-width:900px) breakpoint in style.css"
+    # Right panel should be hidden at 900px, replaced by slide-over
+    assert ".rightpanel{display:none" in CSS or ".rightpanel {display:none" in CSS or \
+           re.search(r'max-width:900px\).*?\.rightpanel\{display:none', CSS, re.DOTALL), \
+        ".rightpanel must be display:none at max-width:900px (slide-over replaces it)"
+
+
+def test_mobile_breakpoint_640px_present():
+    """@media(max-width:640px) must exist for narrow phone layouts."""
+    assert "@media(max-width:640px)" in CSS or "@media (max-width: 640px)" in CSS, \
+        "Missing @media(max-width:640px) breakpoint in style.css"
+
+
+def test_rightpanel_mobile_slide_over_css():
+    """Right panel must have position:fixed slide-over CSS for mobile."""
+    # At max-width:900px the rightpanel should be position:fixed, off-screen right
+    assert "position:fixed" in CSS, \
+        "style.css must have position:fixed for rightpanel mobile slide-over"
+    assert ".rightpanel.mobile-open{right:0" in CSS or ".rightpanel.mobile-open {right:0" in CSS, \
+        ".rightpanel.mobile-open must set right:0 to slide panel in from right"
+    assert "right:-320px" in CSS or "right: -320px" in CSS, \
+        "rightpanel must start off-screen (right:-320px) on mobile"
+
+
+def test_mobile_overlay_present():
+    """Mobile overlay element must exist for tap-to-close sidebar behavior."""
+    assert 'id="mobileOverlay"' in HTML, \
+        "#mobileOverlay element missing from index.html"
+    assert "mobile-overlay" in CSS, \
+        ".mobile-overlay CSS rule missing from style.css"
+
+
+def test_mobile_bottom_nav_present():
+    """Mobile bottom navigation bar must be present."""
+    assert "mobile-bottom-nav" in HTML or "mobile-nav-btn" in HTML, \
+        "Mobile bottom nav (.mobile-bottom-nav or .mobile-nav-btn) missing from index.html"
+    assert "mobile-bottom-nav" in CSS, \
+        ".mobile-bottom-nav CSS rule missing from style.css"
+
+
+def test_mobile_files_button_present():
+    """Mobile files toggle button (#btnMobileFiles) must be in HTML and CSS."""
+    assert 'id="btnMobileFiles"' in HTML, \
+        "#btnMobileFiles missing from index.html"
+    assert "mobile-files-btn" in CSS, \
+        ".mobile-files-btn CSS missing from style.css"
+
+
+# ── Profile dropdown overflow ─────────────────────────────────────────────────
+
+def test_profile_dropdown_not_clipped_by_overflow():
+    """Profile dropdown must not be inside an overflow:hidden or overflow-x:auto ancestor
+    without a higher z-index escape hatch.
+
+    The topbar-chips container uses overflow-x:auto on mobile, which creates a
+    stacking context that clips absolutely-positioned children. The profile dropdown
+    must use position:fixed on mobile OR the topbar-chips must not clip it.
+    """
+    # The profile-chip wrapper must have position:relative so the dropdown can escape
+    assert 'id="profileChipWrap"' in HTML, \
+        "#profileChipWrap missing from index.html"
+    # Profile dropdown must have a z-index high enough to clear the topbar
+    assert ".profile-dropdown{" in CSS or ".profile-dropdown {" in CSS, \
+        ".profile-dropdown CSS rule missing"
+    # z-index must be at least 200 (topbar is z-index:10)
+    m = re.search(r'\.profile-dropdown\{[^}]*z-index:(\d+)', CSS)
+    if m:
+        assert int(m.group(1)) >= 100, \
+            f".profile-dropdown z-index {m.group(1)} is too low — must be >= 100 to clear topbar"
+
+
+def test_topbar_chips_mobile_overflow():
+    """topbar-chips must use overflow-x:auto on mobile for chip scrolling.
+
+    Chips (profile, workspace, model, files) must scroll horizontally on narrow
+    viewports rather than wrapping onto a second line which would break the topbar layout.
+    """
+    # At narrow viewport, topbar-chips should scroll
+    assert "overflow-x:auto" in CSS or "overflow-x: auto" in CSS, \
+        "topbar-chips must have overflow-x:auto for mobile chip scrolling"
+
+
+# ── Workspace panel close ─────────────────────────────────────────────────────
+
+def test_workspace_close_button_present():
+    """Workspace panel must have a close/hide button accessible on mobile."""
+    # Either a dedicated mobile close button or the X button that closes the panel
+    has_close = (
+        'onclick="toggleMobileFiles()"' in HTML or
+        'toggleMobileFiles' in HTML
+    )
+    assert has_close, \
+        "toggleMobileFiles() must be wired to a button to close the workspace panel on mobile"
+
+
+def test_toggle_mobile_files_js_defined():
+    """toggleMobileFiles() must be defined in boot.js."""
+    boot_js = (REPO / "static" / "boot.js").read_text(encoding="utf-8")
+    assert "function toggleMobileFiles()" in boot_js, \
+        "toggleMobileFiles() missing from static/boot.js"
+    assert "mobile-open" in boot_js, \
+        "toggleMobileFiles() must toggle mobile-open class on the right panel"
+
+
+# ── Viewport and scroll safety ────────────────────────────────────────────────
+
+def test_body_overflow_hidden():
+    """body must have overflow:hidden to prevent double scrollbars on mobile."""
+    assert "body{" in CSS or "body {" in CSS, \
+        "body rule missing from style.css"
+    assert re.search(r'body\{[^}]*overflow:hidden', CSS), \
+        "body must have overflow:hidden to prevent double scrollbars"
+
+
+def test_100dvh_viewport_height():
+    """Layout must use 100dvh (dynamic viewport height) for correct mobile sizing.
+
+    On mobile Safari and Chrome, 100vh includes the browser chrome (address bar),
+    causing content to be hidden. 100dvh accounts for the actual available height.
+    """
+    assert "100dvh" in CSS, \
+        "style.css must use 100dvh for correct mobile viewport height (100vh hides content under address bar)"
+
+
+def test_composer_touch_target_size():
+    """Send button and composer inputs must have minimum 44px touch targets on mobile.
+
+    Apple HIG and Google Material guidelines both require 44px minimum touch targets.
+    """
+    # Check that mobile CSS doesn't make the send button smaller than 44×44
+    # We check that there's at least a min-height definition for touch targets
+    assert re.search(r'(min-height|height).*44px', CSS), \
+        "style.css must define 44px minimum touch targets for mobile (send button, nav buttons)"
+
+
+# ── Input zoom prevention ─────────────────────────────────────────────────────
+
+def test_composer_textarea_font_size_mobile():
+    """Composer textarea must have font-size >= 16px on mobile.
+
+    iOS Safari zooms the viewport when an input with font-size < 16px is focused,
+    which breaks the layout. The composer textarea must be >= 16px at mobile widths.
+    """
+    # Check for 16px font-size on the textarea in a mobile breakpoint
+    assert re.search(r'font-size:16px', CSS), \
+        "Composer textarea must have font-size:16px at mobile widths to prevent iOS zoom-on-focus"

tests/test_model_resolver.py

@@ -0,0 +1,423 @@
+"""
+Tests for resolve_model_provider() model routing logic.
+Verifies that model IDs are correctly resolved to (model, provider, base_url)
+tuples for different provider configurations.
+"""
+import api.config as config
+
+
+def _resolve_with_config(model_id, provider=None, base_url=None, default=None, custom_providers=None):
+    """Helper: temporarily set config.cfg model/custom provider sections, call resolve, restore."""
+    old_cfg = dict(config.cfg)
+    model_cfg = {}
+    if provider:
+        model_cfg['provider'] = provider
+    if base_url:
+        model_cfg['base_url'] = base_url
+    if default:
+        model_cfg['default'] = default
+    config.cfg['model'] = model_cfg if model_cfg else {}
+    if custom_providers is not None:
+        config.cfg['custom_providers'] = custom_providers
+    try:
+        return config.resolve_model_provider(model_id)
+    finally:
+        config.cfg.clear()
+        config.cfg.update(old_cfg)
+
+
+# ── OpenRouter prefix handling ────────────────────────────────────────────
+
+def test_openrouter_free_keeps_full_path():
+    """openrouter/free must NOT be stripped to 'free' when provider is openrouter."""
+    model, provider, base_url = _resolve_with_config(
+        'openrouter/free', provider='openrouter',
+        base_url='https://openrouter.ai/api/v1',
+    )
+    assert model == 'openrouter/free', f"Expected 'openrouter/free', got '{model}'"
+    assert provider == 'openrouter'
+
+
+def test_openrouter_model_with_provider_prefix():
+    """anthropic/claude-sonnet-4.6 via openrouter keeps full path."""
+    model, provider, base_url = _resolve_with_config(
+        'anthropic/claude-sonnet-4.6', provider='openrouter',
+        base_url='https://openrouter.ai/api/v1',
+    )
+    assert model == 'anthropic/claude-sonnet-4.6'
+    assert provider == 'openrouter'
+
+
+# ── Direct provider prefix stripping ─────────────────────────────────────
+
+def test_anthropic_prefix_stripped_for_direct_api():
+    """anthropic/claude-sonnet-4.6 strips prefix when provider is anthropic."""
+    model, provider, base_url = _resolve_with_config(
+        'anthropic/claude-sonnet-4.6', provider='anthropic',
+    )
+    assert model == 'claude-sonnet-4.6'
+    assert provider == 'anthropic'
+
+
+def test_openai_prefix_stripped_for_direct_api():
+    """openai/gpt-5.4-mini strips prefix when provider is openai."""
+    model, provider, base_url = _resolve_with_config(
+        'openai/gpt-5.4-mini', provider='openai',
+    )
+    assert model == 'gpt-5.4-mini'
+    assert provider == 'openai'
+
+
+# ── Cross-provider routing ───────────────────────────────────────────────
+
+def test_cross_provider_routes_through_openrouter():
+    """Picking openai model when config is anthropic routes via openrouter."""
+    model, provider, base_url = _resolve_with_config(
+        'openai/gpt-5.4-mini', provider='anthropic',
+    )
+    assert model == 'openai/gpt-5.4-mini'
+    assert provider == 'openrouter'
+    assert base_url is None  # openrouter uses its own endpoint
+
+
+# ── Bare model names ─────────────────────────────────────────────────────
+
+def test_bare_model_uses_config_provider():
+    """A model name without / uses the config provider and base_url."""
+    model, provider, base_url = _resolve_with_config(
+        'gemma-4-26B', provider='custom',
+        base_url='http://192.168.1.160:4000',
+    )
+    assert model == 'gemma-4-26B'
+    assert provider == 'custom'
+    assert base_url == 'http://192.168.1.160:4000'
+
+
+def test_empty_model_returns_config_defaults():
+    """Empty model string returns config provider and base_url."""
+    model, provider, base_url = _resolve_with_config(
+        '', provider='anthropic',
+    )
+    assert model == ''
+    assert provider == 'anthropic'
+
+
+# ── @provider:model hint routing (Issue #138 v2) ────────────────────────
+
+def test_provider_hint_routes_to_specific_provider():
+    """@minimax:MiniMax-M2.7 routes to minimax provider directly."""
+    model, provider, base_url = _resolve_with_config(
+        '@minimax:MiniMax-M2.7', provider='anthropic',
+    )
+    assert model == 'MiniMax-M2.7'
+    assert provider == 'minimax'
+    assert base_url is None  # resolve_runtime_provider will fill this
+
+
+def test_provider_hint_zai():
+    """@zai:GLM-5 routes to zai provider directly."""
+    model, provider, base_url = _resolve_with_config(
+        '@zai:GLM-5', provider='openai',
+    )
+    assert model == 'GLM-5'
+    assert provider == 'zai'
+
+
+def test_provider_hint_deepseek():
+    """@deepseek:deepseek-chat routes to deepseek provider."""
+    model, provider, base_url = _resolve_with_config(
+        '@deepseek:deepseek-chat', provider='anthropic',
+    )
+    assert model == 'deepseek-chat'
+    assert provider == 'deepseek'
+
+
+def test_slash_prefix_non_default_still_routes_openrouter():
+    """minimax/MiniMax-M2.7 (old format) still routes through openrouter."""
+    model, provider, base_url = _resolve_with_config(
+        'minimax/MiniMax-M2.7', provider='anthropic',
+    )
+    assert model == 'minimax/MiniMax-M2.7'
+    assert provider == 'openrouter'
+
+
+def test_custom_provider_model_with_slash_routes_to_named_custom_provider():
+    """Slash-containing custom endpoint model IDs must not be mistaken for OpenRouter models."""
+    model, provider, base_url = _resolve_with_config(
+        'google/gemma-4-26b-a4b',
+        provider='openrouter',
+        base_url='https://openrouter.ai/api/v1',
+        custom_providers=[{
+            'name': 'Local LM Studio',
+            'base_url': 'http://lmstudio.local:1234/v1',
+            'model': 'google/gemma-4-26b-a4b',
+        }],
+    )
+    assert model == 'google/gemma-4-26b-a4b'
+    assert provider == 'custom:local-lm-studio'
+    assert base_url == 'http://lmstudio.local:1234/v1'
+
+
+# ── get_available_models() @provider: hint behaviour ──────────────────────
+
+def _available_models_with_provider(provider):
+    """Helper: temporarily set active_provider in config."""
+    old_cfg = dict(config.cfg)
+    config.cfg['model'] = {'provider': provider}
+    try:
+        return config.get_available_models()
+    finally:
+        config.cfg.clear()
+        config.cfg.update(old_cfg)
+
+
+def test_non_default_provider_models_use_hint_prefix():
+    """With anthropic as default, minimax model IDs should use @minimax: prefix."""
+    result = _available_models_with_provider('anthropic')
+    groups = {g['provider']: g['models'] for g in result['groups']}
+    if 'MiniMax' in groups:
+        for m in groups['MiniMax']:
+            assert m['id'].startswith('@minimax:'), (
+                f"Expected @minimax: prefix, got: {m['id']!r}"
+            )
+
+
+def test_no_duplicate_when_default_model_is_prefixed():
+    """Issue #147 Bug 2: 'anthropic/claude-opus-4.6' as default_model must not
+    inject a duplicate alongside the existing bare 'claude-opus-4.6' entry in
+    the same provider group."""
+    import api.config as _cfg
+    old_cfg = dict(_cfg.cfg)
+    _cfg.cfg['model'] = {
+        'provider': 'anthropic',
+        'default': 'anthropic/claude-opus-4.6',
+    }
+    try:
+        result = _cfg.get_available_models()
+        norm = lambda mid: mid.split('/', 1)[-1] if '/' in mid else mid
+        # Check each group individually: no group should have two entries that
+        # normalize to the same bare model name
+        for g in result['groups']:
+            bare_ids = [norm(m['id']) for m in g['models']]
+            duplicates = [mid for mid in set(bare_ids) if bare_ids.count(mid) > 1]
+            assert not duplicates, (
+                f"Provider group '{g['provider']}' has duplicate models after normalization: "
+                f"{duplicates}\nFull group: {[m['id'] for m in g['models']]}"
+            )
+    finally:
+        _cfg.cfg.clear()
+        _cfg.cfg.update(old_cfg)
+
+
+def test_default_provider_models_not_prefixed():
+    """The active provider's models remain bare (no @prefix added)."""
+    import api.config as _cfg
+    raw_anthropic_ids = {m['id'] for m in _cfg._PROVIDER_MODELS.get('anthropic', [])}
+    result = _available_models_with_provider('anthropic')
+    groups = {g['provider']: g['models'] for g in result['groups']}
+    if 'Anthropic' in groups:
+        returned_ids = {m['id'] for m in groups['Anthropic']}
+        for bare_id in raw_anthropic_ids:
+            assert bare_id in returned_ids, (
+                f"_PROVIDER_MODELS entry '{bare_id}' is missing from the Anthropic group"
+            )
+
+
+# ── get_available_models(): phantom "Custom" group regression ─────────────
+#
+# When the user has model.provider set to a real provider (e.g. openai-codex)
+# AND a model.base_url set, hermes_cli reports the 'custom' pseudo-provider as
+# authenticated. The WebUI picker must NOT build a separate "Custom" group in
+# that case — the base_url belongs to the active provider.
+
+def _available_models_with_full_cfg(provider, default, base_url):
+    """Helper: set model.provider, model.default, model.base_url at once.
+
+    Clears model-override env vars (HERMES_MODEL, OPENAI_MODEL, LLM_MODEL)
+    during the call so the real hermes profile environment doesn't leak into
+    the test and override the fixture's default model.
+    """
+    import os
+    import api.config as _cfg
+    old_cfg = dict(_cfg.cfg)
+    _cfg.cfg['model'] = {
+        'provider': provider,
+        'default': default,
+        'base_url': base_url,
+    }
+    # Clear model-override env vars to prevent the real profile from leaking in
+    _model_env_keys = ('HERMES_MODEL', 'OPENAI_MODEL', 'LLM_MODEL')
+    _saved_env = {k: os.environ.pop(k, None) for k in _model_env_keys}
+    try:
+        return _cfg.get_available_models()
+    finally:
+        _cfg.cfg.clear()
+        _cfg.cfg.update(old_cfg)
+        for k, v in _saved_env.items():
+            if v is not None:
+                os.environ[k] = v
+
+
+def test_no_phantom_custom_group_when_active_provider_is_set(monkeypatch):
+    """Issue: with provider=openai-codex + base_url set, gpt-5.4 was landing
+    under a phantom "Custom" group instead of the "OpenAI Codex" group."""
+    import sys, types
+
+    # Force hermes_cli to report both the real provider and the phantom
+    # 'custom' as authenticated, simulating what list_available_providers()
+    # returns when base_url is configured.
+    fake_mod = types.ModuleType('hermes_cli.models')
+    fake_mod.list_available_providers = lambda: [
+        {'id': 'openai-codex', 'authenticated': True},
+        {'id': 'custom',       'authenticated': True},
+    ]
+    fake_auth = types.ModuleType('hermes_cli.auth')
+    fake_auth.get_auth_status = lambda pid: {'key_source': 'env'}
+    monkeypatch.setitem(sys.modules, 'hermes_cli.models', fake_mod)
+    monkeypatch.setitem(sys.modules, 'hermes_cli.auth', fake_auth)
+
+    result = _available_models_with_full_cfg(
+        provider='openai-codex',
+        default='gpt-5.4',
+        base_url='https://chatgpt.com/backend-api/codex',
+    )
+    group_names = [g['provider'] for g in result['groups']]
+    assert 'Custom' not in group_names, (
+        f"Phantom 'Custom' group present; full groups: {group_names}"
+    )
+
+
+def test_default_model_lands_under_active_provider_group(monkeypatch):
+    """The configured default_model must appear under the active provider's
+    display group, even when the model isn't in _PROVIDER_MODELS[provider]
+    AND the active provider isn't the alphabetical first detected provider.
+
+    Regression guard for a hyphen-vs-space bug in the "ensure default_model
+    appears" post-pass: the substring check `active_provider.lower() in
+    g.get('provider', '').lower()` was failing for 'openai-codex' vs
+    display name 'OpenAI Codex' (hyphen vs. space), silently falling back
+    to groups[0] — which, when another provider sorted earlier
+    alphabetically (e.g. 'anthropic'), placed gpt-5.4 in the WRONG group.
+    """
+    import sys, types
+    fake_mod = types.ModuleType('hermes_cli.models')
+    fake_mod.list_available_providers = lambda: [
+        {'id': 'anthropic',    'authenticated': True},  # sorts before openai-codex
+        {'id': 'openai-codex', 'authenticated': True},
+        {'id': 'custom',       'authenticated': True},
+    ]
+    fake_auth = types.ModuleType('hermes_cli.auth')
+    fake_auth.get_auth_status = lambda pid: {'key_source': 'env'}
+    monkeypatch.setitem(sys.modules, 'hermes_cli.models', fake_mod)
+    monkeypatch.setitem(sys.modules, 'hermes_cli.auth', fake_auth)
+
+    result = _available_models_with_full_cfg(
+        provider='openai-codex',
+        default='gpt-5.4',
+        base_url='https://chatgpt.com/backend-api/codex',
+    )
+    groups = {g['provider']: [m['id'] for m in g['models']] for g in result['groups']}
+    assert 'OpenAI Codex' in groups, f"OpenAI Codex group missing: {list(groups)}"
+    assert 'gpt-5.4' in groups['OpenAI Codex'], (
+        f"gpt-5.4 not in OpenAI Codex group; contents: {groups['OpenAI Codex']}"
+    )
+    # And crucially, it must NOT have landed in the alphabetically-first
+    # group (Anthropic) via the fallback path.
+    assert 'gpt-5.4' not in groups.get('Anthropic', []), (
+        f"gpt-5.4 leaked into Anthropic group via fallback: {groups.get('Anthropic')}"
+    )
+
+
+def test_custom_endpoint_uses_model_config_api_key_for_model_discovery(monkeypatch):
+    """Custom endpoint model discovery must use model.api_key from config.yaml,
+    not only environment variables, otherwise the dropdown collapses to the
+    default model when /v1/models requires auth."""
+    import json as _json
+    import api.config as _cfg
+
+    old_cfg = dict(_cfg.cfg)
+    _cfg.cfg['model'] = {
+        'provider': 'custom',
+        'default': 'gpt-5.4',
+        'base_url': 'https://example.test/v1',
+        'api_key': 'sk-test-model-key',
+    }
+    _cfg.cfg.pop('providers', None)
+
+    captured = {}
+
+    class _Resp:
+        def read(self):
+            return _json.dumps({'data': [{'id': 'gpt-5.2', 'name': 'GPT-5.2'}]}).encode('utf-8')
+        def __enter__(self):
+            return self
+        def __exit__(self, exc_type, exc, tb):
+            return False
+
+    def _fake_urlopen(req, timeout=10):
+        captured['auth'] = req.get_header('Authorization')
+        captured['ua'] = req.get_header('User-agent')
+        return _Resp()
+
+    monkeypatch.setattr('urllib.request.urlopen', _fake_urlopen)
+    monkeypatch.setattr('socket.getaddrinfo', lambda *a, **k: [])
+    monkeypatch.delenv('OPENAI_API_KEY', raising=False)
+    monkeypatch.delenv('HERMES_API_KEY', raising=False)
+    monkeypatch.delenv('HERMES_OPENAI_API_KEY', raising=False)
+    monkeypatch.delenv('LOCAL_API_KEY', raising=False)
+    monkeypatch.delenv('OPENROUTER_API_KEY', raising=False)
+    monkeypatch.delenv('API_KEY', raising=False)
+    try:
+        result = _cfg.get_available_models()
+    finally:
+        _cfg.cfg.clear()
+        _cfg.cfg.update(old_cfg)
+
+    assert captured['auth'] == 'Bearer sk-test-model-key'
+    assert captured['ua'] == 'OpenAI/Python 1.0'
+    groups = {g['provider']: [m['id'] for m in g['models']] for g in result['groups']}
+    assert 'Custom' in groups
+    assert 'gpt-5.2' in groups['Custom']
+
+
+# -- Issue #230: custom provider with slash model name -----------------------
+
+def test_custom_endpoint_slash_model_routes_to_custom_not_openrouter():
+    """Regression test for #230.
+
+    When provider=custom (or any non-openrouter provider) and base_url is set,
+    a model name containing a slash (e.g. google/gemma-4-26b-a4b) must NOT be
+    rerouted to OpenRouter -- it should stay on the configured custom endpoint.
+    """
+    # --- custom provider with slash model name should NOT go to openrouter ---
+    model, provider, base_url = _resolve_with_config(
+        'google/gemma-4-26b-a4b',
+        provider='custom',
+        base_url='http://127.0.0.1:1234/v1',
+        default='google/gemma-4-26b-a4b',
+    )
+    assert provider.startswith('custom'), (
+        "Expected provider starting with 'custom', got '{}'. "
+        "Slash in model name should NOT trigger OpenRouter rerouting when base_url is set.".format(provider)
+    )
+    assert base_url == 'http://127.0.0.1:1234/v1', (
+        "Expected base_url 'http://127.0.0.1:1234/v1', got '{}'.".format(base_url)
+    )
+    assert model == 'google/gemma-4-26b-a4b', (
+        "Model name should be preserved as-is, got '{}'.".format(model)
+    )
+
+    # --- openrouter with slash model name MUST still route to openrouter -----
+    model_or, provider_or, _ = _resolve_with_config(
+        'google/gemma-4-26b-a4b',
+        provider='openrouter',
+        base_url='https://openrouter.ai/api/v1',
+        default='google/gemma-4-26b-a4b',
+    )
+    assert provider_or == 'openrouter', (
+        "Expected provider 'openrouter', got '{}'. "
+        "Slash model via openrouter provider must still resolve to openrouter.".format(provider_or)
+    )
+    assert model_or == 'google/gemma-4-26b-a4b', (
+        "Model name should be preserved for openrouter, got '{}'.".format(model_or)
+    )

tests/test_regressions.py

@@ -472,3 +472,24 @@ def test_upload_error_has_no_trace_field():
     assert "trace" not in body, \
         "Upload errors must not leak stack traces to clients"
     assert "error" in body, "Error responses must include an 'error' key"
+
+
+# ── #248: /skills slash command ───────────────────────────────────────────────
+
+def test_skills_slash_command_defined():
+    """#248: /skills command must be registered in COMMANDS and implemented.
+    Verifies the command entry, function definition, and i18n key are all present.
+    """
+    src = (REPO_ROOT / "static/commands.js").read_text()
+
+    # 1. 'skills' must appear in the COMMANDS array definition
+    assert "name:'skills'" in src or 'name:"skills"' in src, \
+        "COMMANDS array must include an entry with name:'skills'"
+
+    # 2. cmdSkills function must be defined
+    assert "function cmdSkills" in src, \
+        "cmdSkills function must be defined in commands.js"
+
+    # 3. i18n key cmd_skills must be referenced (wired to COMMANDS entry)
+    assert "cmd_skills" in src, \
+        "cmd_skills i18n key must be referenced in commands.js"

tests/test_security_redaction.py

@@ -0,0 +1,310 @@
+"""
+Security tests: credential redaction in API responses.
+
+Verifies that credentials (GitHub PATs, API keys, etc.) are masked in:
+  - GET /api/session  (messages and tool_calls)
+  - GET /api/memory   (MEMORY.md and USER.md content)
+  - GET /api/session/export (downloaded JSON)
+  - SSE done event    (session payload in stream)
+
+Tests run against the isolated test test_server on port 8788.
+"""
+
+import json
+import pathlib
+import sys
+import urllib.request
+import urllib.error
+import pytest
+
+sys.path.insert(0, str(pathlib.Path(__file__).parent.parent.parent))
+
+
+def _server_is_up(port: int = 8788) -> bool:
+    """Return True if the test server is accepting connections."""
+    try:
+        urllib.request.urlopen(f"http://127.0.0.1:{port}/health", timeout=2)
+        return True
+    except Exception:
+        return False
+
+
+# _needs_server: these tests require the conftest test_server fixture (port 8788).
+# The skipif is evaluated lazily via the fixture, not at collection time.
+_needs_server = pytest.mark.usefixtures("test_server")
+
+BASE = "http://127.0.0.1:8788"
+
+# Sample credentials that should be masked in every API response
+_FAKE_GITHUB_PAT = "ghp_TestFakeCredential1234567890ab"
+_FAKE_SK_KEY     = "sk-TestFakeOpenAIKey1234567890abcdef"
+_FAKE_HF_TOKEN   = "hf_TestFakeHuggingFaceToken12345"
+_FAKE_AWS_KEY    = "AKIATESTFAKEKEY12345"
+
+
+# ── HTTP helpers ──────────────────────────────────────────────────────────────
+
+def _get(path):
+    with urllib.request.urlopen(BASE + path, timeout=10) as r:
+        return json.loads(r.read())
+
+
+def _post(path, body=None):
+    data = json.dumps(body or {}).encode()
+    req = urllib.request.Request(
+        BASE + path, data=data,
+        headers={"Content-Type": "application/json"},
+    )
+    try:
+        with urllib.request.urlopen(req, timeout=10) as r:
+            return json.loads(r.read()), r.status
+    except urllib.error.HTTPError as e:
+        return json.loads(e.read()), e.code
+
+
+def _get_raw(path):
+    """Return raw bytes (used for export endpoint)."""
+    with urllib.request.urlopen(BASE + path, timeout=10) as r:
+        return r.read()
+
+
+def _assert_no_plaintext_credentials(text: str, label: str = ""):
+    """Assert that none of the fake credential strings appear in text."""
+    for cred in (_FAKE_GITHUB_PAT, _FAKE_SK_KEY, _FAKE_HF_TOKEN, _FAKE_AWS_KEY):
+        assert cred not in text, (
+            f"{label}: credential '{cred[:12]}...' found in plaintext. "
+            "Redaction is not working."
+        )
+
+
+# ── helpers.py unit tests (import-level, no test_server needed) ───────────────────
+
+def test_redact_value_str():
+    """_redact_value masks a plaintext GitHub PAT in a string."""
+    from api.helpers import _redact_value
+    result = _redact_value(f"my token is {_FAKE_GITHUB_PAT} bye")
+    assert _FAKE_GITHUB_PAT not in result
+    assert "ghp_Te" in result  # prefix preserved
+
+
+def test_redact_value_dict():
+    """_redact_value recurses into dicts."""
+    from api.helpers import _redact_value
+    d = {"content": f"key={_FAKE_SK_KEY}", "role": "user"}
+    result = _redact_value(d)
+    assert _FAKE_SK_KEY not in result["content"]
+    assert result["role"] == "user"  # innocent values untouched
+
+
+def test_redact_value_list():
+    """_redact_value recurses into lists."""
+    from api.helpers import _redact_value
+    lst = [{"content": _FAKE_GITHUB_PAT}, {"content": "safe text"}]
+    result = _redact_value(lst)
+    assert _FAKE_GITHUB_PAT not in result[0]["content"]
+    assert result[1]["content"] == "safe text"
+
+
+def test_redact_session_data_messages():
+    """redact_session_data masks credentials in messages[]."""
+    from api.helpers import redact_session_data
+    session = {
+        "session_id": "abc123",
+        "title": f"my token {_FAKE_GITHUB_PAT}",
+        "messages": [
+            {"role": "user", "content": f"token: {_FAKE_GITHUB_PAT}"},
+            {"role": "assistant", "content": "sure"},
+        ],
+        "tool_calls": [
+            {"name": "terminal", "args": {"command": f"gh auth login --token {_FAKE_GITHUB_PAT}"},
+             "snippet": "ok"},
+        ],
+    }
+    result = redact_session_data(session)
+    dump = json.dumps(result)
+    _assert_no_plaintext_credentials(dump, "redact_session_data")
+    # Safe fields remain intact
+    assert result["session_id"] == "abc123"
+    assert result["messages"][1]["content"] == "sure"
+
+
+def test_redact_session_data_multiple_cred_types():
+    """redact_session_data handles sk-, ghp_, hf_, and AKIA keys."""
+    from api.helpers import redact_session_data
+    session = {
+        "title": "test",
+        "messages": [{"role": "user", "content": (
+            f"openai={_FAKE_SK_KEY} "
+            f"github={_FAKE_GITHUB_PAT} "
+            f"hf={_FAKE_HF_TOKEN} "
+            f"aws={_FAKE_AWS_KEY}"
+        )}],
+        "tool_calls": [],
+    }
+    result = redact_session_data(session)
+    dump = json.dumps(result)
+    _assert_no_plaintext_credentials(dump, "multi-type redaction")
+
+
+def test_redact_session_data_non_sensitive_unchanged():
+    """redact_session_data does not corrupt innocent content."""
+    from api.helpers import redact_session_data
+    session = {
+        "title": "Hello world",
+        "messages": [{"role": "user", "content": "What is 2+2?"}],
+        "tool_calls": [{"name": "terminal", "snippet": "4"}],
+    }
+    result = redact_session_data(session)
+    assert result["title"] == "Hello world"
+    assert result["messages"][0]["content"] == "What is 2+2?"
+    assert result["tool_calls"][0]["snippet"] == "4"
+
+
+# ── API-level tests (require running test server started by conftest.py) ─────
+# Run via `start.sh && pytest tests/test_security_redaction.py -v`
+
+def _create_session_with_credentials() -> str:
+    """Write a session file with credential-containing messages directly to disk.
+
+    Bypasses the server's in-memory cache so the GET endpoint is forced to read
+    from disk, exercising the redaction code path on load.
+    Uses TEST_STATE_DIR from conftest.py (the isolated test server state directory).
+    """
+    import time, uuid
+    try:
+        from conftest import TEST_STATE_DIR
+        sessions_dir = TEST_STATE_DIR / "sessions"
+    except ImportError:
+        from api.config import SESSION_DIR as sessions_dir
+    sessions_dir = pathlib.Path(sessions_dir)
+    sessions_dir.mkdir(parents=True, exist_ok=True)
+
+    # Use a unique session ID that is NOT in the server's LRU cache
+    sid = "sec_test_" + uuid.uuid4().hex[:8]
+    now = time.time()
+    session_file = sessions_dir / f"{sid}.json"
+    session_file.write_text(json.dumps({
+        "session_id": sid,
+        "title": f"session with {_FAKE_GITHUB_PAT}",
+        "workspace": "/tmp",
+        "model": "test",
+        "created_at": now,
+        "updated_at": now,
+        "pinned": False, "archived": False, "project_id": None,
+        "profile": "default", "input_tokens": 0, "output_tokens": 0,
+        "estimated_cost": None, "personality": None,
+        "messages": [
+            {"role": "user",      "content": f"my PAT is {_FAKE_GITHUB_PAT}"},
+            {"role": "assistant", "content": f"sk key is {_FAKE_SK_KEY}"},
+            {"role": "tool",      "content": "result ok", "name": "terminal"},
+        ],
+        "tool_calls": [
+            {"name": "terminal",
+             "args": {"command": f"gh auth login --token {_FAKE_GITHUB_PAT}"},
+             "snippet": "blocked"}
+        ],
+    }))
+    return sid
+
+
+def test_api_session_redacts_messages():
+    """GET /api/session route must call redact_session_data() before returning."""
+    import inspect
+    import api.routes as routes
+    src = inspect.getsource(routes.handle_get)
+    # Verify redact_session_data is applied to the session payload
+    assert "redact_session_data" in src, (
+        "api/routes.py handle_get must call redact_session_data() on /api/session response"
+    )
+
+
+def test_api_session_redacts_title():
+    """redact_session_data must redact credentials from session title field."""
+    from api.helpers import redact_session_data
+    session = {
+        "session_id": "abc123",
+        "title": f"session with {_FAKE_GITHUB_PAT}",
+        "messages": [],
+        "tool_calls": [],
+    }
+    result = redact_session_data(session)
+    assert _FAKE_GITHUB_PAT not in result["title"], (
+        f"redact_session_data must mask credentials in title field"
+    )
+    assert result["session_id"] == "abc123"  # safe fields preserved
+
+
+@_needs_server
+def test_api_sessions_list_redacts_titles(test_server):
+    """GET /api/sessions must not return session titles containing credentials."""
+    _create_session_with_credentials()
+    data = _get("/api/sessions")
+    dump = json.dumps(data)
+    _assert_no_plaintext_credentials(dump, "GET /api/sessions titles")
+
+
+def test_api_session_export_redacts():
+    """GET /api/session/export must call redact_session_data() in _handle_session_export."""
+    import inspect
+    import api.routes as routes
+    # The export handler is a separate function (_handle_session_export)
+    src = inspect.getsource(routes._handle_session_export)
+    assert "redact_session_data" in src, (
+        "_handle_session_export must call redact_session_data() before serving download"
+    )
+
+
+@_needs_server
+def test_api_memory_redacts_via_write_read(test_server):
+    """Credential written to MEMORY.md must be masked in GET /api/memory response."""
+    original = _get("/api/memory").get("memory", "")
+
+    cred_content = f"GitHub PAT: {_FAKE_GITHUB_PAT}\nNormal note: hello world"
+    data, status = _post("/api/memory/write", {"section": "memory", "content": cred_content})
+    assert status == 200, f"memory/write failed: {data}"
+
+    try:
+        read_back = _get("/api/memory")
+        dump = json.dumps(read_back)
+        _assert_no_plaintext_credentials(dump, "GET /api/memory")
+        assert "hello world" in read_back["memory"]   # non-sensitive content preserved
+    finally:
+        _post("/api/memory/write", {"section": "memory", "content": original})
+
+
+# ── startup: fix_credential_permissions ──────────────────────────────────────
+
+def test_fix_credential_permissions_corrects_loose_files(tmp_path, monkeypatch):
+    """fix_credential_permissions() tightens group/other read bits."""
+    import os
+    from api.startup import fix_credential_permissions
+
+    env_file = tmp_path / ".env"
+    env_file.write_text("SECRET=abc")
+    env_file.chmod(0o644)  # world-readable -- should be fixed
+
+    google_file = tmp_path / "google_token.json"
+    google_file.write_text("{}")
+    google_file.chmod(0o664)  # group-readable -- should be fixed
+
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path))
+    fix_credential_permissions()
+
+    import stat
+    assert stat.S_IMODE(env_file.stat().st_mode) == 0o600, ".env not fixed to 600"
+    assert stat.S_IMODE(google_file.stat().st_mode) == 0o600, "google_token.json not fixed to 600"
+
+
+def test_fix_credential_permissions_skips_correct_files(tmp_path, monkeypatch):
+    """fix_credential_permissions() does not alter already-strict files."""
+    env_file = tmp_path / ".env"
+    env_file.write_text("SECRET=abc")
+    env_file.chmod(0o600)
+
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path))
+
+    from api.startup import fix_credential_permissions
+    fix_credential_permissions()
+
+    import stat
+    assert stat.S_IMODE(env_file.stat().st_mode) == 0o600

tests/test_spanish_locale.py

@@ -0,0 +1,45 @@
+from pathlib import Path
+import re
+
+
+REPO = Path(__file__).resolve().parent.parent
+
+
+def read(path: Path) -> str:
+    return path.read_text(encoding="utf-8")
+
+
+def test_spanish_locale_block_exists():
+    src = read(REPO / "static" / "i18n.js")
+    assert "\n  es: {" in src
+    assert "_label: 'Español'" in src
+    assert "_speech: 'es-ES'" in src
+
+
+def test_spanish_locale_includes_representative_translations():
+    src = read(REPO / "static" / "i18n.js")
+    expected = [
+        "settings_title: 'Configuración'",
+        "login_title: 'Iniciar sesión'",
+        "approval_heading: 'Se requiere aprobación'",
+        "tab_tasks: 'Tareas'",
+        "tab_skills: 'Habilidades'",
+        "tab_memory: 'Memoria'",
+    ]
+    for entry in expected:
+        assert entry in src
+
+
+def test_spanish_locale_covers_english_keys():
+    src = read(REPO / "static" / "i18n.js")
+    en_match = re.search(r"\n  en: \{([\s\S]*?)\n  \},\n\n  es: \{", src)
+    es_match = re.search(r"\n  es: \{([\s\S]*?)\n  \},\n\n  de: \{", src)
+    assert en_match, "English locale block not found"
+    assert es_match, "Spanish locale block not found"
+
+    key_pattern = re.compile(r"^\s{4}([a-zA-Z0-9_]+):", re.MULTILINE)
+    en_keys = set(key_pattern.findall(en_match.group(1)))
+    es_keys = set(key_pattern.findall(es_match.group(1)))
+
+    missing = sorted(en_keys - es_keys)
+    assert not missing, f"Spanish locale missing keys: {missing}"

tests/test_sprint16.py

@@ -700,10 +700,20 @@ def test_style_css_active_session_uses_gold(cleanup_test_sessions):
         "Active session gold color (#e8a030) not found in style.css"
 
 
-def test_sessions_js_active_skips_project_border(cleanup_test_sessions):
-    """sessions.js must not override active session border-left with project color."""
+def test_sessions_js_uses_action_menu_not_per_row_buttons(cleanup_test_sessions):
+    """sessions.js must use the single ⋯ action menu instead of per-row buttons.
+
+    The per-row button overlay was replaced with a single ⋯ trigger that opens a
+    positioned dropdown (session-action-menu). This removes the borderLeftColor
+    project colour override that the old code applied, which was the original
+    concern this test guarded. The new design uses a dot indicator for project
+    membership instead.
+    """
     src = REPO_ROOT / "static" / "sessions.js"
     code = src.read_text()
-    # The fix: only set borderLeftColor if NOT the active session
-    assert "isActive" in code, "isActive check not found in sessions.js"
-    assert "borderLeftColor" in code, "borderLeftColor not found in sessions.js"
+    assert "session-actions-trigger" in code, "session-actions-trigger not found in sessions.js"
+    assert "_openSessionActionMenu" in code, "_openSessionActionMenu not found in sessions.js"
+    assert "closeSessionActionMenu" in code, "closeSessionActionMenu not found in sessions.js"
+    # The old per-row buttons must not be present (they were replaced by the menu)
+    assert "act-pin" not in code, "old act-pin per-row button still in sessions.js"
+    assert "act-archive" not in code, "old act-archive per-row button still in sessions.js"

tests/test_sprint20.py

@@ -213,9 +213,14 @@ def test_boot_js_recognition_interim_results():
 
 
 def test_boot_js_recognition_lang_en():
-    """recognition.lang must be set to en-US."""
+    """recognition.lang must be set (static en-US or dynamic via _locale._speech)."""
     js, _ = get_text("/static/boot.js")
-    assert "recognition.lang='en-US'" in js or 'recognition.lang = "en-US"' in js or "recognition.lang='en-US'" in js
+    # Accept either the old static value or the new locale-driven assignment
+    assert (
+        "recognition.lang='en-US'" in js
+        or 'recognition.lang = "en-US"' in js
+        or "recognition.lang=" in js  # dynamic: recognition.lang=(_locale._speech)||'en-US'
+    )
 
 
 def test_boot_js_onresult_handler():

tests/test_sprint27.py

@@ -0,0 +1,136 @@
+"""
+Sprint 27 Tests: configurable assistant display name (bot_name).
+Tests cover settings API round-trip, empty/missing input defaults,
+login page rendering, and server-side sanitization.
+"""
+import json
+import urllib.error
+import urllib.request
+
+BASE = "http://127.0.0.1:8788"
+
+
+def get(path):
+    with urllib.request.urlopen(BASE + path, timeout=10) as r:
+        return json.loads(r.read()), r.status
+
+
+def get_raw(path):
+    with urllib.request.urlopen(BASE + path, timeout=10) as r:
+        return r.read().decode(), r.status
+
+
+def post(path, body=None):
+    data = json.dumps(body or {}).encode()
+    req = urllib.request.Request(BASE + path, data=data,
+                                 headers={"Content-Type": "application/json"})
+    try:
+        with urllib.request.urlopen(req, timeout=10) as r:
+            return json.loads(r.read()), r.status
+    except urllib.error.HTTPError as e:
+        return json.loads(e.read()), e.code
+
+
+# ── Default value ─────────────────────────────────────────────────────────
+
+def test_settings_default_bot_name():
+    """GET /api/settings should return bot_name defaulting to 'Hermes'."""
+    d, status = get("/api/settings")
+    assert status == 200
+    assert "bot_name" in d
+    assert d["bot_name"] == "Hermes"
+
+
+# ── Round-trip ────────────────────────────────────────────────────────────
+
+def test_settings_set_bot_name():
+    """POST /api/settings with bot_name should persist and round-trip."""
+    try:
+        d, status = post("/api/settings", {"bot_name": "TestBot"})
+        assert status == 200
+        assert d.get("bot_name") == "TestBot"
+        d2, _ = get("/api/settings")
+        assert d2.get("bot_name") == "TestBot"
+    finally:
+        post("/api/settings", {"bot_name": "Hermes"})
+
+
+def test_settings_bot_name_special_chars():
+    """bot_name with safe special characters should persist correctly."""
+    try:
+        d, status = post("/api/settings", {"bot_name": "My Assistant 2.0"})
+        assert status == 200
+        d2, _ = get("/api/settings")
+        assert d2.get("bot_name") == "My Assistant 2.0"
+    finally:
+        post("/api/settings", {"bot_name": "Hermes"})
+
+
+# ── Server-side sanitization ──────────────────────────────────────────────
+
+def test_settings_empty_bot_name_defaults_to_hermes():
+    """Posting an empty bot_name should default to 'Hermes' server-side."""
+    try:
+        d, status = post("/api/settings", {"bot_name": ""})
+        assert status == 200
+        assert d.get("bot_name") == "Hermes"
+        d2, _ = get("/api/settings")
+        assert d2.get("bot_name") == "Hermes"
+    finally:
+        post("/api/settings", {"bot_name": "Hermes"})
+
+
+def test_settings_whitespace_bot_name_defaults_to_hermes():
+    """Posting a whitespace-only bot_name should default to 'Hermes'."""
+    try:
+        d, status = post("/api/settings", {"bot_name": "   "})
+        assert status == 200
+        assert d.get("bot_name") == "Hermes"
+    finally:
+        post("/api/settings", {"bot_name": "Hermes"})
+
+
+# ── Login page rendering ──────────────────────────────────────────────────
+
+def test_login_page_shows_default_bot_name():
+    """GET /login should contain 'Hermes' in title and h1 when default."""
+    html, status = get_raw("/login")
+    assert status == 200
+    assert "<title>Hermes" in html
+    assert "<h1>Hermes</h1>" in html
+
+
+def test_login_page_shows_custom_bot_name():
+    """GET /login should reflect the configured bot_name."""
+    try:
+        post("/api/settings", {"bot_name": "Aria"})
+        html, status = get_raw("/login")
+        assert status == 200
+        assert "<title>Aria" in html
+        assert "<h1>Aria</h1>" in html
+    finally:
+        post("/api/settings", {"bot_name": "Hermes"})
+
+
+def test_login_page_empty_name_does_not_crash():
+    """Login page must not 500 even if somehow bot_name is empty in settings."""
+    # Force an empty value by patching settings file directly — skipped here
+    # because the server-side guard in POST /api/settings prevents storing empty.
+    # Instead, verify that /login returns 200 reliably.
+    html, status = get_raw("/login")
+    assert status == 200
+    assert "Sign in" in html
+
+
+def test_login_page_xss_escaped():
+    """bot_name with HTML special chars should be escaped in the login page."""
+    try:
+        post("/api/settings", {"bot_name": "<script>alert(1)</script>"})
+        html, status = get_raw("/login")
+        assert status == 200
+        # Raw tag must not appear unescaped
+        assert "<script>alert(1)</script>" not in html
+        # Escaped form should appear
+        assert "&lt;script&gt;" in html
+    finally:
+        post("/api/settings", {"bot_name": "Hermes"})

tests/test_sprint28.py

@@ -0,0 +1,224 @@
+"""
+Sprint 28 Tests: /personality slash command — backend API coverage.
+Tests: GET /api/personalities, POST /api/personality/set, Session.compact(),
+path traversal defence, size cap, clear personality.
+"""
+import json
+import pathlib
+import shutil
+import sys
+import urllib.error
+import urllib.request
+
+# Import test constants from conftest (same process — these are module-level values)
+sys.path.insert(0, str(pathlib.Path(__file__).parent))
+from conftest import TEST_STATE_DIR
+
+BASE = "http://127.0.0.1:8788"
+
+
+def get(path):
+    with urllib.request.urlopen(BASE + path, timeout=10) as r:
+        return json.loads(r.read()), r.status
+
+
+def post(path, body=None):
+    data = json.dumps(body or {}).encode()
+    req = urllib.request.Request(BASE + path, data=data,
+                                 headers={"Content-Type": "application/json"})
+    try:
+        with urllib.request.urlopen(req, timeout=10) as r:
+            return json.loads(r.read()), r.status
+    except urllib.error.HTTPError as e:
+        return json.loads(e.read()), e.code
+
+
+def _personalities_dir():
+    """Return the personalities directory the test server will look in.
+
+    conftest sets HERMES_HOME=TEST_STATE_DIR in the server's environment.
+    The server's api/profiles._DEFAULT_HERMES_HOME resolves to TEST_STATE_DIR,
+    so get_active_hermes_home() returns TEST_STATE_DIR, and personalities
+    live at TEST_STATE_DIR/personalities.
+    """
+    p = TEST_STATE_DIR / 'personalities'
+    p.mkdir(parents=True, exist_ok=True)
+    return p
+
+
+def _make_personality(name, content="# Test Bot\nA test personality."):
+    """Create a personality directory with a SOUL.md."""
+    d = _personalities_dir() / name
+    d.mkdir(parents=True, exist_ok=True)
+    (d / "SOUL.md").write_text(content)
+    return d
+
+
+def _make_session():
+    """Create a new session and return its session_id."""
+    d, status = post("/api/session/new", {})
+    assert status == 200, f"Failed to create session: {d}"
+    return d["session"]["session_id"]
+
+
+def _cleanup_session(sid):
+    try:
+        post("/api/session/delete", {"session_id": sid})
+    except Exception:
+        pass
+
+
+# ── GET /api/personalities ────────────────────────────────────────────────────
+
+def test_personalities_empty_when_none_exist():
+    """GET /api/personalities returns empty list when no personalities exist."""
+    p_dir = _personalities_dir()
+    for child in list(p_dir.iterdir()):
+        if child.is_dir() and not child.is_symlink():
+            shutil.rmtree(child)
+    d, status = get("/api/personalities")
+    assert status == 200
+    assert d.get("personalities") == []
+
+
+def test_personalities_lists_from_config():
+    """GET /api/personalities returns personalities from config.yaml agent.personalities.
+    Skipped if no personalities configured in test environment.
+    """
+    d, status = get("/api/personalities")
+    assert status == 200
+    assert isinstance(d.get("personalities"), list)
+    # If personalities are configured, verify structure
+    for p in d.get("personalities", []):
+        assert "name" in p
+        assert "description" in p
+
+
+def test_personalities_returns_empty_when_none_configured():
+    """GET /api/personalities returns empty list when no personalities in config."""
+    # The test server starts with a clean state dir (no config.yaml),
+    # so agent.personalities is empty by default
+    d, status = get("/api/personalities")
+    assert status == 200
+    # May or may not have personalities depending on the real ~/.hermes/config.yaml
+    # being loaded. Just verify the structure is correct.
+    assert isinstance(d.get("personalities"), list)
+
+
+def test_personalities_skips_non_dict_config():
+    """GET /api/personalities handles non-dict agent config gracefully."""
+    d, status = get("/api/personalities")
+    assert status == 200
+    assert isinstance(d.get("personalities"), list)
+
+
+# ── POST /api/personality/set ─────────────────────────────────────────────────
+
+_test_personalities = {}
+
+def _inject_personality(name, value):
+    """Write a personality into the test config.yaml so the server picks it up."""
+    _test_personalities[name] = value
+    _write_test_config()
+
+def _remove_personality(name):
+    """Remove a personality from the test config.yaml."""
+    _test_personalities.pop(name, None)
+    _write_test_config()
+
+def _write_test_config():
+    """Write config.yaml with test personalities using simple YAML format."""
+    TEST_STATE_DIR.mkdir(parents=True, exist_ok=True)
+    config_path = TEST_STATE_DIR / 'config.yaml'
+    lines = ['agent:', '  personalities:']
+    for pname, pval in _test_personalities.items():
+        if isinstance(pval, dict):
+            lines.append(f'    {pname}:')
+            for k, v in pval.items():
+                lines.append(f'      {k}: "{v}"')
+        else:
+            lines.append(f'    {pname}: "{pval}"')
+    config_path.write_text('\n'.join(lines) + '\n')
+
+
+def test_set_personality_valid():
+    """Setting a personality that exists in config stores name and returns prompt.
+    Skipped if config.yaml has no personalities (common in test environments).
+    """
+    # First check if any personalities are configured
+    d, status = get("/api/personalities")
+    if not d.get("personalities"):
+        return  # skip — no personalities in test server config
+    name = d["personalities"][0]["name"]
+    sid = _make_session()
+    try:
+        d2, status2 = post("/api/personality/set", {"session_id": sid, "name": name})
+        assert status2 == 200
+        assert d2.get("ok") is True
+        assert d2.get("personality") == name
+    finally:
+        _cleanup_session(sid)
+
+
+def test_set_personality_persists_in_compact():
+    """After setting personality, GET /api/session returns personality in compact.
+    Skipped if config.yaml has no personalities.
+    """
+    d, status = get("/api/personalities")
+    if not d.get("personalities"):
+        return  # skip
+    name = d["personalities"][0]["name"]
+    sid = _make_session()
+    try:
+        post("/api/personality/set", {"session_id": sid, "name": name})
+        d2, status2 = get(f"/api/session?session_id={sid}")
+        assert status2 == 200
+        session = d2.get("session", {})
+        assert session.get("personality") == name
+    finally:
+        _cleanup_session(sid)
+
+
+def test_clear_personality_sets_null():
+    """Clearing personality with name='' sets it to None (null in JSON)."""
+    sid = _make_session()
+    try:
+        # Set a personality name directly on the session (no config validation needed for clear)
+        d, status = post("/api/personality/set", {"session_id": sid, "name": ""})
+        assert status == 200
+        assert d.get("personality") is None
+        # Verify persisted
+        d2, s2 = get(f"/api/session?session_id={sid}")
+        assert s2 == 200
+        assert d2.get("session", {}).get("personality") is None
+    finally:
+        _cleanup_session(sid)
+
+
+def test_set_personality_not_found_returns_404():
+    """Setting a non-existent personality returns 404."""
+    sid = _make_session()
+    try:
+        d, status = post("/api/personality/set",
+                         {"session_id": sid, "name": "doesnotexist"})
+        assert status == 404
+    finally:
+        _cleanup_session(sid)
+
+
+def test_set_personality_nonexistent_returns_404():
+    """Names not in config.yaml agent.personalities return 404."""
+    sid = _make_session()
+    try:
+        d, status = post("/api/personality/set",
+                         {"session_id": sid, "name": "doesnotexist"})
+        assert status == 404, f"Expected 404, got {status}: {d}"
+    finally:
+        _cleanup_session(sid)
+
+
+def test_set_personality_missing_session_returns_404():
+    """Setting personality on non-existent session returns 404."""
+    d, status = post("/api/personality/set",
+                     {"session_id": "nonexistent000", "name": "x"})
+    assert status == 404

tests/test_sprint29.py

@@ -0,0 +1,466 @@
+"""
+Sprint 29 Tests: Security hardening — 12 fixes from PR #171.
+
+Covers:
+  1. CSRF protection — cross-origin POST rejected, same-origin allowed
+  2. Login rate limiting — 5th attempt 429, 6th rejected, still works after burst
+  3. Session ID validation — non-hex chars rejected in Session.load()
+  4. Error path sanitization — _sanitize_error() strips filesystem paths
+  5. Secure cookie detection — getattr used safely on plain socket
+  6. HMAC signature length — 32-char hex (128-bit), not 16
+  7. Skills path traversal — path outside SKILLS_DIR rejected
+  8. Content-Disposition for dangerous MIME types — HTML/SVG force download
+  9. PBKDF2 password hashing — save_settings uses auth._hash_password
+  10. Non-loopback startup warning (manual / integration test)
+  11. SSRF DNS check logic (unit test on helper function)
+  12. ENV_LOCK export — _ENV_LOCK importable from streaming module
+"""
+import importlib
+import json
+import pathlib
+import sys
+import time
+import urllib.error
+import urllib.request
+
+sys.path.insert(0, str(pathlib.Path(__file__).parent))
+from conftest import TEST_STATE_DIR
+
+BASE = "http://127.0.0.1:8788"
+
+
+def get(path, headers=None):
+    req = urllib.request.Request(BASE + path, headers=headers or {})
+    try:
+        with urllib.request.urlopen(req, timeout=10) as r:
+            return json.loads(r.read()), r.status
+    except urllib.error.HTTPError as e:
+        return json.loads(e.read()), e.code
+
+
+def post(path, body=None, headers=None):
+    data = json.dumps(body or {}).encode()
+    h = {"Content-Type": "application/json"}
+    if headers:
+        h.update(headers)
+    req = urllib.request.Request(BASE + path, data=data, headers=h)
+    try:
+        with urllib.request.urlopen(req, timeout=10) as r:
+            return json.loads(r.read()), r.status
+    except urllib.error.HTTPError as e:
+        return json.loads(e.read()), e.code
+
+
+# ── 1. CSRF Protection ─────────────────────────────────────────────────────
+
+
+class TestCSRF:
+    def test_no_origin_no_referer_allowed(self):
+        """Curl-style request with no Origin/Referer must pass CSRF check."""
+        body, status = post("/api/sessions/new", {})
+        # Should succeed (200 or 404) but NOT 403
+        assert status != 403, f"Expected non-403 for no-origin request, got {status}"
+
+    def test_cross_origin_post_rejected(self):
+        """Cross-origin POST (Origin != Host) must be rejected with 403."""
+        body, status = post(
+            "/api/sessions/new",
+            {},
+            headers={"Origin": "http://evil.com", "Host": "127.0.0.1:8788"},
+        )
+        assert status == 403, f"Expected 403 for cross-origin request, got {status}: {body}"
+        assert "cross-origin" in body.get("error", "").lower() or "rejected" in body.get("error", "").lower()
+
+    def test_same_origin_post_allowed(self):
+        """Same-origin POST (Origin matches Host) must be allowed."""
+        body, status = post(
+            "/api/sessions/new",
+            {},
+            headers={"Origin": "http://127.0.0.1:8788", "Host": "127.0.0.1:8788"},
+        )
+        assert status != 403, f"Expected non-403 for same-origin request, got {status}: {body}"
+
+    def test_same_origin_referer_allowed(self):
+        """Same-origin Referer (matching Host) must be allowed."""
+        body, status = post(
+            "/api/sessions/new",
+            {},
+            headers={"Referer": "http://127.0.0.1:8788/", "Host": "127.0.0.1:8788"},
+        )
+        assert status != 403, f"Expected non-403 for same-referer request, got {status}: {body}"
+
+
+# ── 2. Login Rate Limiting ─────────────────────────────────────────────────
+
+
+class TestLoginRateLimit:
+    def test_rate_limit_triggers_429(self):
+        """More than 5 failed login attempts from same IP must yield 429."""
+        from api.auth import _login_attempts, _LOGIN_WINDOW
+
+        # Force the rate limiter state: inject 5 stale-now timestamps so next call is fresh
+        # Actually easier: just hit the endpoint 6 times with wrong password
+        # But we can't set a password in a test without config file.
+        # Instead test the helper directly.
+        import time
+        from api import auth as _auth
+
+        # Reset state for a fake IP
+        fake_ip = "10.255.254.253"
+        _auth._login_attempts[fake_ip] = []
+
+        # Record 5 attempts — should still be allowed
+        for _ in range(5):
+            _auth._record_login_attempt(fake_ip)
+        assert not _auth._check_login_rate(fake_ip), \
+            "After 5 attempts, _check_login_rate should return False (blocked)"
+
+    def test_rate_limit_resets_after_window(self):
+        """After window expires, rate limit resets."""
+        import time
+        from api import auth as _auth
+
+        fake_ip = "10.255.254.252"
+        # Inject 5 old timestamps (outside window)
+        old_ts = time.time() - 70  # 70s ago, outside 60s window
+        _auth._login_attempts[fake_ip] = [old_ts] * 5
+        assert _auth._check_login_rate(fake_ip), \
+            "After window expires, IP should be allowed again"
+
+    def test_rate_limit_endpoint_returns_429(self, webui_server):
+        """Live endpoint: 6th bad attempt returns 429 (auth enabled required)."""
+        # This test only runs meaningfully when auth is enabled.
+        # We can still verify the helper returns 429 from the unit test above.
+        # If auth not enabled, endpoint returns 200 OK with 'Auth not enabled'.
+        from api import auth as _auth
+
+        fake_ip = "10.255.254.251"
+        # Fill the bucket
+        _auth._login_attempts[fake_ip] = [time.time()] * 5
+        assert not _auth._check_login_rate(fake_ip)
+
+
+# ── 3. Session ID Validation ───────────────────────────────────────────────
+
+
+class TestSessionIDValidation:
+    def test_hex_session_id_loads(self, tmp_path):
+        """A valid hex session ID gets past the validation check."""
+        import sys
+        sys.path.insert(0, str(pathlib.Path(__file__).parent.parent))
+        from api.models import Session, SESSION_DIR
+        valid_hex = "deadbeef" * 8  # 64 hex chars
+        # Should not raise — returns None only if file doesn't exist (it won't)
+        result = Session.load(valid_hex)
+        assert result is None  # No file, but no error
+
+    def test_new_format_session_id_passes_validation(self):
+        """New hermes-agent session IDs (YYYYMMDD_HHMMSS_xxxxxx) must pass validation."""
+        from api.models import Session
+        # Should pass the validator (returns None only because the file doesn't exist)
+        result = Session.load("20260406_164014_74b2d1")
+        assert result is None  # file doesn't exist, but validator passed
+
+    def test_non_hex_session_id_rejected(self):
+        """A session ID with dangerous chars must be rejected."""
+        from api.models import Session
+        evil_ids = [
+            "../../../etc/passwd",
+            "../../../../root/.ssh/id_rsa",
+            "session; rm -rf /",
+            "hello world",
+            "ZZZZZZZZZZZZZZZZ",
+            "session\x00evil",
+            "..\\..\\windows\\system32",
+            "session/../../etc/passwd",
+            "valid_looking.json",
+        ]
+        for sid in evil_ids:
+            result = Session.load(sid)
+            assert result is None, \
+                f"Session.load should reject dangerous ID '{sid}', got {result}"
+
+    def test_empty_session_id_rejected(self):
+        """An empty session ID must be rejected."""
+        from api.models import Session
+        assert Session.load("") is None
+        assert Session.load(None) is None
+
+
+# ── 4. Error Path Sanitization ────────────────────────────────────────────
+
+
+class TestSanitizeError:
+    def test_unix_path_stripped(self):
+        from api.helpers import _sanitize_error
+        e = FileNotFoundError("/home/hermes/.hermes/sessions/abc123.json")
+        result = _sanitize_error(e)
+        assert "/home/hermes" not in result
+        assert "<path>" in result
+
+    def test_nested_unix_path_stripped(self):
+        from api.helpers import _sanitize_error
+        e = ValueError("cannot read /var/lib/hermes/data.db: permission denied")
+        result = _sanitize_error(e)
+        assert "/var/lib/hermes" not in result
+        assert "<path>" in result
+
+    def test_no_path_unchanged(self):
+        from api.helpers import _sanitize_error
+        e = ValueError("session not found")
+        result = _sanitize_error(e)
+        assert result == "session not found"
+
+    def test_windows_path_stripped(self):
+        from api.helpers import _sanitize_error
+        e = FileNotFoundError("C:\\Users\\hermes\\AppData\\sessions\\x.json not found")
+        result = _sanitize_error(e)
+        assert "C:\\Users\\hermes" not in result
+
+    def test_live_404_does_not_leak_path(self, webui_server):
+        """Live server: file-not-found errors must not expose filesystem paths."""
+        body, status = post("/api/file/read", {"path": "../../etc/passwd"})
+        err = body.get("error", "")
+        assert "/home" not in err and "/var" not in err and "/etc" not in err, \
+            f"Error message leaks filesystem path: {err}"
+
+
+# ── 5. Secure Cookie Flag ─────────────────────────────────────────────────
+
+
+class TestSecureCookieFlag:
+    def test_getattr_safe_on_plain_socket(self):
+        """getattr(handler.request, 'getpeercert', None) must not raise on plain socket."""
+        import socket
+        # Plain socket has no getpeercert attribute
+        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        try:
+            result = getattr(s, 'getpeercert', None)
+            assert result is None, \
+                f"Expected None on plain socket, got {result}"
+        finally:
+            s.close()
+
+    def test_secure_flag_not_set_for_plain_http(self, webui_server):
+        """Login endpoint over plain HTTP must NOT set Secure cookie flag."""
+        # Auth is disabled in tests, so this just checks no crash
+        body, status = post("/api/auth/login", {"password": "test"})
+        # Either 200 (auth not enabled) or 401 (auth enabled, wrong pw)
+        assert status in (200, 401, 429), f"Unexpected status {status}"
+
+
+# ── 6. HMAC Signature Length ──────────────────────────────────────────────
+
+
+class TestHMACLength:
+    def test_session_token_sig_is_32_chars(self):
+        """Session cookie signature must be 32 hex chars (128-bit), not 16."""
+        from api.auth import create_session
+        cookie = create_session()
+        token, sig = cookie.rsplit('.', 1)
+        assert len(sig) == 32, \
+            f"Expected 32-char signature (128-bit), got {len(sig)}: {sig}"
+
+    def test_verify_session_rejects_old_16char_sig(self):
+        """A cookie with a 16-char sig must fail verification."""
+        import hmac as _hmac
+        import hashlib
+        from api.auth import _signing_key, verify_session, _sessions
+        import time
+        import secrets
+
+        token = secrets.token_hex(32)
+        _sessions[token] = time.time() + 3600  # valid session
+        old_sig = _hmac.new(_signing_key(), token.encode(), hashlib.sha256).hexdigest()[:16]
+        old_cookie = f"{token}.{old_sig}"
+        # Should fail: sig length wrong
+        assert not verify_session(old_cookie), \
+            "Old 16-char sig cookie must not verify (sig mismatch)"
+
+
+# ── 7. Skills Path Traversal ──────────────────────────────────────────────
+
+
+class TestSkillsPathTraversal:
+    def test_traversal_rejected(self, webui_server):
+        """Saving a skill with a traversal path must return 400."""
+        body, status = post("/api/skills/save", {
+            "name": "../../evil",
+            "content": "# evil",
+        })
+        assert status in (400, 403), \
+            f"Expected 400/403 for traversal skill path, got {status}: {body}"
+
+    def test_valid_skill_accepted(self, webui_server):
+        """Saving a skill with a valid name must succeed."""
+        body, status = post("/api/skills/save", {
+            "name": "test-security-skill",
+            "content": "---\nname: test-security-skill\ndescription: test\n---\n# test",
+        })
+        # 500 = skills module not available (hermes-agent not installed) — skip
+        if status == 500:
+            import pytest; pytest.skip("skills module requires hermes-agent")
+        # Should succeed (200) or need auth (401/403) — not path error (400)
+        assert status in (200, 401, 403, 404), \
+            f"Valid skill save got unexpected status {status}: {body}"
+
+
+# ── 8. Content-Disposition for Dangerous MIME Types ───────────────────────
+
+
+class TestContentDisposition:
+    def test_html_file_forced_download(self, webui_server, tmp_path):
+        """HTML files served via /api/file/raw must have Content-Disposition: attachment."""
+        import urllib.request
+        import urllib.error
+
+        # Use a session to create an HTML file in the workspace
+        sessions_body, _ = post("/api/sessions/new", {})
+        sid = sessions_body.get("session_id") or sessions_body.get("id")
+        if not sid:
+            return  # Skip if sessions API shape is unexpected
+
+        # Can't easily create a file via the test server without a workspace,
+        # so test the logic directly instead.
+        from api.routes import _handle_file_raw
+        dangerous_types = {'text/html', 'application/xhtml+xml', 'image/svg+xml'}
+        for mime in dangerous_types:
+            assert mime in dangerous_types, f"{mime} should be in dangerous_types set"
+
+    def test_dangerous_mime_types_set_complete(self):
+        """The set of dangerous MIME types must include html, xhtml, and svg."""
+        import ast
+        import pathlib
+        routes_src = pathlib.Path(__file__).parent.parent / "api" / "routes.py"
+        src = routes_src.read_text()
+        assert "text/html" in src
+        assert "application/xhtml+xml" in src
+        assert "image/svg+xml" in src
+        assert "dangerous_types" in src
+
+
+# ── 9. PBKDF2 Password Hashing ───────────────────────────────────────────
+
+
+class TestPasswordHashing:
+    def test_hash_password_is_hex(self):
+        """_hash_password must produce a non-empty hex string (PBKDF2-SHA256)."""
+        from api.auth import _hash_password
+        result = _hash_password("mysecretpassword")
+        assert isinstance(result, str) and len(result) == 64, \
+            f"Expected 64-char hex hash (SHA-256 output), got len={len(result)}: {result}"
+        # Hex-only chars
+        assert all(c in "0123456789abcdef" for c in result), \
+            f"Hash must be hex string, got: {result}"
+
+    def test_hash_password_is_deterministic_with_same_salt(self):
+        """_hash_password must return the same hash for same input (signing key is stable)."""
+        from api.auth import _hash_password
+        h1 = _hash_password("consistent_password")
+        h2 = _hash_password("consistent_password")
+        assert h1 == h2, "Same password must produce same hash (stable signing key)"
+
+    def test_hash_password_different_inputs_differ(self):
+        """Different passwords must produce different hashes."""
+        from api.auth import _hash_password
+        assert _hash_password("password_a") != _hash_password("password_b"), \
+            "Different passwords must produce different hashes"
+
+    def test_hash_password_longer_than_sha256(self):
+        """PBKDF2 with 600k iterations is much stronger than single SHA-256.
+        We verify indirectly: the code must call pbkdf2_hmac, not sha256 directly."""
+        import inspect
+        from api import auth as _auth
+        src = inspect.getsource(_auth._hash_password)
+        assert "pbkdf2_hmac" in src, \
+            "_hash_password must use pbkdf2_hmac, not raw sha256"
+        assert "600_000" in src or "600000" in src, \
+            "_hash_password must use 600,000 iterations"
+
+    def test_save_settings_stores_64char_hex_hash(self):
+        """save_settings with _set_password must store a 64-char hex hash (PBKDF2)."""
+        from api.config import save_settings, load_settings, SETTINGS_FILE
+        import json
+
+        # Remember original content so we can restore it
+        original = None
+        if SETTINGS_FILE.exists():
+            original = SETTINGS_FILE.read_text()
+
+        try:
+            save_settings({"_set_password": "test_pbkdf2_pw"})
+            settings = load_settings()
+            ph = settings.get("password_hash", "")
+            assert len(ph) == 64 and all(c in "0123456789abcdef" for c in ph), \
+                f"save_settings must store 64-char hex PBKDF2 hash, got: {ph!r}"
+        finally:
+            # Restore original settings
+            if original is not None:
+                SETTINGS_FILE.write_text(original)
+            else:
+                save_settings({"_clear_password": True})
+
+
+# ── 10. Non-loopback Startup Warning ─────────────────────────────────────
+
+
+class TestStartupWarning:
+    def test_warning_code_present_in_server(self):
+        """server.py must contain non-loopback warning code."""
+        src = pathlib.Path(__file__).parent.parent / "server.py"
+        text = src.read_text()
+        assert "0.0.0.0" in text or "non-loopback" in text.lower() or "WARNING" in text, \
+            "server.py must contain non-loopback warning logic"
+        assert "is_auth_enabled" in text, \
+            "server.py must check is_auth_enabled() before warning"
+
+
+# ── 11. SSRF DNS Check ─────────────────────────────────────────────────────
+
+
+class TestSSRFCheck:
+    def test_ssrf_guard_code_present_in_config(self):
+        """config.py must contain SSRF DNS resolution guard."""
+        src = pathlib.Path(__file__).parent.parent / "api" / "config.py"
+        text = src.read_text()
+        assert "getaddrinfo" in text, "SSRF guard must resolve DNS with getaddrinfo"
+        assert "is_private" in text, "SSRF guard must check is_private IP"
+        assert "is_loopback" in text, "SSRF guard must check is_loopback IP"
+
+    def test_known_local_providers_whitelisted(self):
+        """Ollama and localhost endpoints should NOT be blocked by SSRF guard."""
+        src = pathlib.Path(__file__).parent.parent / "api" / "config.py"
+        text = src.read_text()
+        assert "ollama" in text.lower()
+        assert "localhost" in text.lower()
+        assert "lmstudio" in text.lower() or "lm-studio" in text.lower()
+
+
+# ── 12. ENV_LOCK Export ────────────────────────────────────────────────────
+
+
+class TestENVLock:
+    def test_env_lock_importable_from_streaming(self):
+        """_ENV_LOCK must be importable from api.streaming."""
+        from api.streaming import _ENV_LOCK
+        import threading
+        assert isinstance(_ENV_LOCK, type(threading.Lock())), \
+            "_ENV_LOCK must be a threading.Lock"
+
+    def test_env_lock_importable_in_routes(self):
+        """api.routes must be able to import _ENV_LOCK from api.streaming."""
+        # If routes.py fails to import, this will raise ImportError
+        import importlib
+        import api.routes  # noqa: F401 -- just checking import works
+        # No error means the circular import is OK
+
+
+# ── Fixture ────────────────────────────────────────────────────────────────
+
+import pytest
+
+
+@pytest.fixture(scope="module")
+def webui_server():
+    """Reuse the module-scoped server started by conftest.py."""
+    return BASE

tests/test_sprint30.py

@@ -0,0 +1,386 @@
+"""
+Sprint 30: Approval card UI, i18n coverage, and approval flow polish.
+
+Tests for:
+- Approval card HTML structure (all 4 buttons, IDs, data-i18n attrs)
+- Keyboard shortcut handler presence in boot.js
+- i18n keys for approval card in both locales
+- CSS for approval-btn states (loading, disabled, kbd badge)
+- respondApproval loading/disable pattern in messages.js
+- streaming.py scoping fix (_unreg_notify=None initialisation)
+- Approval respond HTTP endpoint (existing + new behaviour)
+"""
+
+import json
+import re
+import urllib.request
+import urllib.error
+import urllib.parse
+
+import pytest
+
+BASE = "http://127.0.0.1:8788"
+
+
+def get(path):
+    url = BASE + path
+    with urllib.request.urlopen(url, timeout=10) as r:
+        return json.loads(r.read())
+
+
+def post(path, body=None):
+    url = BASE + path
+    data = json.dumps(body or {}).encode()
+    req = urllib.request.Request(url, data=data,
+          headers={"Content-Type": "application/json"})
+    try:
+        with urllib.request.urlopen(req, timeout=10) as r:
+            return json.loads(r.read()), r.status
+    except urllib.error.HTTPError as e:
+        return json.loads(e.read()), e.code
+
+
+def read(path):
+    with open(path, encoding="utf-8") as f:
+        return f.read()
+
+
+import pathlib
+REPO = pathlib.Path(__file__).parent.parent
+
+
+# ── HTML structure ───────────────────────────────────────────────────────────
+
+class TestApprovalCardHTML:
+
+    def test_approval_card_has_four_buttons(self):
+        html = read(REPO / "static/index.html")
+        for choice in ("once", "session", "always", "deny"):
+            assert f"respondApproval('{choice}')" in html, \
+                f"approval button for '{choice}' missing from index.html"
+
+    def test_approval_buttons_have_ids(self):
+        html = read(REPO / "static/index.html")
+        for btn_id in ("approvalBtnOnce", "approvalBtnSession",
+                       "approvalBtnAlways", "approvalBtnDeny"):
+            assert f'id="{btn_id}"' in html, \
+                f"button id '{btn_id}' missing from approval card"
+
+    def test_approval_heading_has_data_i18n(self):
+        html = read(REPO / "static/index.html")
+        assert 'data-i18n="approval_heading"' in html, \
+            "approval heading missing data-i18n attribute"
+
+    def test_approval_buttons_have_data_i18n_labels(self):
+        html = read(REPO / "static/index.html")
+        for key in ("approval_btn_once", "approval_btn_session",
+                    "approval_btn_always", "approval_btn_deny"):
+            assert f'data-i18n="{key}"' in html, \
+                f"button label data-i18n='{key}' missing"
+
+    def test_approval_once_button_has_kbd_badge(self):
+        html = read(REPO / "static/index.html")
+        assert '<kbd class="approval-kbd">' in html, \
+            "kbd badge missing from Allow once button"
+
+    def test_approval_card_has_aria_roles(self):
+        html = read(REPO / "static/index.html")
+        assert 'role="alertdialog"' in html, \
+            "approval card missing role=alertdialog for accessibility"
+        assert 'aria-labelledby="approvalHeading"' in html, \
+            "approval card missing aria-labelledby"
+
+
+# ── CSS ──────────────────────────────────────────────────────────────────────
+
+class TestApprovalCardCSS:
+
+    def test_btn_disabled_style_present(self):
+        css = read(REPO / "static/style.css")
+        assert ".approval-btn:disabled" in css, \
+            "disabled state style missing for approval buttons"
+
+    def test_btn_loading_class_present(self):
+        css = read(REPO / "static/style.css")
+        assert ".approval-btn.loading" in css, \
+            "loading class style missing for approval buttons"
+
+    def test_approval_kbd_style_present(self):
+        css = read(REPO / "static/style.css")
+        assert ".approval-kbd" in css, \
+            ".approval-kbd style missing from style.css"
+
+    def test_approval_kbd_hidden_on_mobile(self):
+        css = read(REPO / "static/style.css")
+        # Should be display:none inside the mobile media query
+        assert ".approval-kbd{display:none;}" in css or \
+               ".approval-kbd { display: none; }" in css or \
+               re.search(r'\.approval-kbd\s*\{[^}]*display\s*:\s*none', css), \
+            ".approval-kbd should be hidden on mobile"
+
+    def test_btn_transform_on_hover(self):
+        css = read(REPO / "static/style.css")
+        assert "translateY(-1px)" in css, \
+            "hover lift effect missing from approval buttons"
+
+    def test_four_choice_styles_present(self):
+        css = read(REPO / "static/style.css")
+        for cls in (".approval-btn.once", ".approval-btn.session",
+                    ".approval-btn.always", ".approval-btn.deny"):
+            assert cls in css, f"CSS class '{cls}' missing"
+
+
+# ── i18n keys ────────────────────────────────────────────────────────────────
+
+class TestApprovalI18nKeys:
+
+    REQUIRED_KEYS = [
+        "approval_heading",
+        "approval_btn_once",
+        "approval_btn_session",
+        "approval_btn_always",
+        "approval_btn_deny",
+        "approval_responding",
+    ]
+
+    def test_english_locale_has_all_approval_keys(self):
+        src = read(REPO / "static/i18n.js")
+        # Find en locale block (before the first closing };)
+        en_block_end = src.find("\n};")
+        en_block = src[:en_block_end]
+        for key in self.REQUIRED_KEYS:
+            assert f"{key}:" in en_block, \
+                f"English locale missing i18n key: {key}"
+
+    def test_chinese_locale_has_all_approval_keys(self):
+        src = read(REPO / "static/i18n.js")
+        # Find zh locale block (from `  zh: {` to the closing `  },` before `};`)
+        zh_start = src.find("\n  zh: {")
+        assert zh_start != -1, "zh locale block not found in i18n.js"
+        zh_block = src[zh_start:]
+        for key in self.REQUIRED_KEYS:
+            assert f"{key}:" in zh_block, \
+                f"Chinese locale missing i18n key: {key}"
+
+    def test_approval_heading_english_value(self):
+        src = read(REPO / "static/i18n.js")
+        assert "approval_heading: 'Approval required'" in src, \
+            "English approval_heading value incorrect"
+
+    def test_approval_btn_once_english_value(self):
+        src = read(REPO / "static/i18n.js")
+        assert "approval_btn_once: 'Allow once'" in src, \
+            "English approval_btn_once value incorrect"
+
+    def test_approval_btn_deny_english_value(self):
+        src = read(REPO / "static/i18n.js")
+        assert "approval_btn_deny: 'Deny'" in src, \
+            "English approval_btn_deny value incorrect"
+
+
+# ── messages.js behaviour ────────────────────────────────────────────────────
+
+class TestApprovalMessagesJS:
+
+    def test_show_approval_card_re_enables_buttons(self):
+        src = read(REPO / "static/messages.js")
+        assert "b.disabled = false" in src and "loading" in src, \
+            "showApprovalCard should re-enable buttons on each show"
+
+    def test_respond_disables_buttons_immediately(self):
+        src = read(REPO / "static/messages.js")
+        assert "b.disabled = true" in src, \
+            "respondApproval should disable buttons immediately to prevent double-submit"
+
+    def test_respond_uses_i18n_for_error(self):
+        src = read(REPO / "static/messages.js")
+        # Should use t('approval_responding') not a hardcoded string
+        assert "t(\"approval_responding\")" in src or "t('approval_responding')" in src, \
+            "respondApproval error message should use t('approval_responding')"
+
+    def test_show_card_applies_locale_to_dom(self):
+        src = read(REPO / "static/messages.js")
+        assert "applyLocaleToDOM" in src, \
+            "showApprovalCard should call applyLocaleToDOM to translate data-i18n labels"
+
+    def test_show_card_focuses_once_button(self):
+        src = read(REPO / "static/messages.js")
+        assert "approvalBtnOnce" in src and "focus()" in src, \
+            "showApprovalCard should focus the Allow once button"
+
+
+# ── boot.js keyboard shortcut ────────────────────────────────────────────────
+
+class TestApprovalKeyboardShortcut:
+
+    def test_enter_shortcut_present_in_boot_js(self):
+        src = read(REPO / "static/boot.js")
+        assert "respondApproval('once')" in src or 'respondApproval("once")' in src, \
+            "Enter shortcut calling respondApproval('once') missing from boot.js"
+
+    def test_enter_shortcut_checks_card_visible(self):
+        src = read(REPO / "static/boot.js")
+        assert "approvalCard" in src and "visible" in src, \
+            "Enter shortcut should check if approval card is visible"
+
+    def test_enter_shortcut_guards_input_elements(self):
+        src = read(REPO / "static/boot.js")
+        assert "TEXTAREA" in src and "INPUT" in src, \
+            "Enter shortcut should not fire when focus is on TEXTAREA or INPUT"
+
+
+# ── streaming.py scoping fix ─────────────────────────────────────────────────
+
+class TestStreamingApprovalScoping:
+
+    def test_unreg_notify_initialised_to_none(self):
+        src = read(REPO / "api/streaming.py")
+        assert "_unreg_notify = None" in src, \
+            "_unreg_notify must be initialised to None before the try block"
+
+    def test_finally_checks_unreg_notify_not_none(self):
+        src = read(REPO / "api/streaming.py")
+        assert "_unreg_notify is not None" in src, \
+            "finally block must check '_unreg_notify is not None' before calling it"
+
+    def test_approval_registered_flag_present(self):
+        src = read(REPO / "api/streaming.py")
+        assert "_approval_registered = False" in src, \
+            "_approval_registered flag must be initialised to False"
+
+
+# ── HTTP regression: approval respond ────────────────────────────────────────
+
+class TestApprovalRespondHTTP:
+
+    def test_respond_ok_with_all_choices(self):
+        for choice in ("once", "session", "always", "deny"):
+            import uuid
+            sid = f"sprint30-{uuid.uuid4().hex[:8]}"
+            result, status = post("/api/approval/respond",
+                                  {"session_id": sid, "choice": choice})
+            assert status == 200, f"choice={choice} should return 200"
+            assert result["ok"] is True
+            assert result["choice"] == choice
+
+    def test_respond_rejects_bad_choice(self):
+        result, status = post("/api/approval/respond",
+                              {"session_id": "x", "choice": "HACKED"})
+        assert status == 400
+
+    def test_respond_requires_session_id(self):
+        result, status = post("/api/approval/respond", {"choice": "deny"})
+        assert status == 400
+
+    def test_respond_returns_choice_field(self):
+        import uuid
+        sid = f"sprint30-choice-{uuid.uuid4().hex[:8]}"
+        result, status = post("/api/approval/respond",
+                              {"session_id": sid, "choice": "always"})
+        assert status == 200
+        assert "choice" in result
+        assert result["choice"] == "always"
+
+
+class TestApprovalCardTimerLogic:
+    """Tests for the 30s minimum visibility guard introduced in PR #225."""
+
+    def _get_js(self):
+        return pathlib.Path(__file__).parent.parent / 'static' / 'messages.js'
+
+    def test_approval_min_visible_ms_constant_present(self):
+        """APPROVAL_MIN_VISIBLE_MS constant exists and is 30000."""
+        src = self._get_js().read_text()
+        assert 'APPROVAL_MIN_VISIBLE_MS' in src
+        import re
+        m = re.search(r'APPROVAL_MIN_VISIBLE_MS\s*=\s*(\d+)', src)
+        assert m is not None, 'APPROVAL_MIN_VISIBLE_MS not assigned'
+        assert int(m.group(1)) == 30000, f'Expected 30000, got {m.group(1)}'
+
+    def test_hide_approval_card_has_force_parameter(self):
+        """hideApprovalCard() accepts a force parameter."""
+        src = self._get_js().read_text()
+        assert 'hideApprovalCard(force=false)' in src or \
+               'hideApprovalCard(force = false)' in src, \
+            'hideApprovalCard must have force=false default parameter'
+
+    def test_hide_approval_card_checks_force_flag(self):
+        """hideApprovalCard body has a conditional on force."""
+        src = self._get_js().read_text()
+        # The guard: if (!force && _approvalVisibleSince)
+        assert '!force' in src, 'hideApprovalCard must check !force before deferred hide'
+
+    def test_approval_hide_timer_variable_present(self):
+        """Module-level _approvalHideTimer variable is declared."""
+        src = self._get_js().read_text()
+        assert '_approvalHideTimer' in src
+
+    def test_approval_visible_since_variable_present(self):
+        """Module-level _approvalVisibleSince variable is declared."""
+        src = self._get_js().read_text()
+        assert '_approvalVisibleSince' in src
+
+    def test_approval_signature_variable_present(self):
+        """Module-level _approvalSignature variable is declared."""
+        src = self._get_js().read_text()
+        assert '_approvalSignature' in src
+
+    def test_respond_approval_calls_hide_with_force(self):
+        """respondApproval must call hideApprovalCard(true) — not no-arg."""
+        src = self._get_js().read_text()
+        # Extract respondApproval function body
+        import re
+        m = re.search(r'async function respondApproval.*?(?=\nasync function|\nfunction |\Z)',
+                      src, re.DOTALL)
+        assert m, 'respondApproval function not found'
+        body = m.group(0)
+        # Must call hideApprovalCard(true), not the bare hideApprovalCard()
+        assert 'hideApprovalCard(true)' in body, \
+            'respondApproval must call hideApprovalCard(true) so card hides immediately after user clicks'
+        # Must NOT have bare hideApprovalCard() without force
+        bare_calls = re.findall(r'hideApprovalCard\((?!true)', body)
+        assert not bare_calls, \
+            f'respondApproval has bare hideApprovalCard() calls (no force=true): {bare_calls}'
+
+    def test_stream_done_calls_hide_with_force(self):
+        """Done SSE event handler must call hideApprovalCard(true)."""
+        src = self._get_js().read_text()
+        # Find the done event handler section (stopApprovalPolling followed by hideApprovalCard)
+        import re
+        # Look for pattern: stopApprovalPolling();\n + hideApprovalCard
+        matches = re.findall(
+            r'stopApprovalPolling\(\);\s*\n\s*if\(!_approvalSessionId[^)]*\)\s*hideApprovalCard\((\w*)\)',
+            src
+        )
+        # All stopApprovalPolling paths that call hideApprovalCard should use force=true
+        for match in matches:
+            assert match == 'true', \
+                f'After stopApprovalPolling(), hideApprovalCard called without force=true (got: {match!r})'
+
+    def test_poll_loop_still_uses_no_force(self):
+        """Poll loop hideApprovalCard() (when pending gone) keeps no-force — correct behavior."""
+        src = self._get_js().read_text()
+        # Line 446: else { hideApprovalCard(); } — this is the poll-loop path
+        # The 30s guard should protect this call (don't force from poll ticks)
+        assert 'else { hideApprovalCard(); }' in src or \
+               'else {hideApprovalCard();}' in src or \
+               'else { hideApprovalCard() }' in src, \
+            'Poll loop should still call hideApprovalCard() without force=true'
+
+    def test_show_approval_card_signature_dedup(self):
+        """showApprovalCard uses a signature to avoid resetting timer on repeat polls."""
+        src = self._get_js().read_text()
+        # The sig computation must use JSON.stringify on card content
+        import re
+        m = re.search(r'function showApprovalCard.*?(?=\nfunction |\nasync function |\Z)',
+                      src, re.DOTALL)
+        assert m, 'showApprovalCard function not found'
+        body = m.group(0)
+        assert 'JSON.stringify' in body, 'showApprovalCard must compute a signature via JSON.stringify'
+        assert '_approvalSignature' in body, 'showApprovalCard must check/set _approvalSignature'
+
+    def test_clear_approval_hide_timer_helper_present(self):
+        """_clearApprovalHideTimer helper exists to cancel deferred hides."""
+        src = self._get_js().read_text()
+        assert '_clearApprovalHideTimer' in src, \
+            '_clearApprovalHideTimer helper must exist to cancel deferred setTimeout'

tests/test_sprint31.py

@@ -0,0 +1,143 @@
+"""
+Tests for issue #170: new profile form with optional custom endpoint fields.
+
+Tests cover:
+  1. _write_endpoint_to_config writes base_url into config.yaml
+  2. _write_endpoint_to_config writes api_key into config.yaml
+  3. _write_endpoint_to_config writes both together
+  4. _write_endpoint_to_config merges with existing config (does not clobber)
+  5. _write_endpoint_to_config is a no-op when both args are None/empty
+  6. API route accepts base_url and api_key in POST body
+  7. Profile created via API has base_url in config.yaml
+"""
+import json
+import pathlib
+import shutil
+import os
+import pytest
+
+yaml = pytest.importorskip("yaml", reason="PyYAML required for config write tests")
+
+
+# ── 1-5: _write_endpoint_to_config unit tests ─────────────────────────────────
+
+class TestWriteEndpointToConfig:
+    def test_writes_base_url(self, tmp_path):
+        from api.profiles import _write_endpoint_to_config
+        _write_endpoint_to_config(tmp_path, base_url="http://localhost:11434")
+        cfg = yaml.safe_load((tmp_path / "config.yaml").read_text())
+        assert cfg["model"]["base_url"] == "http://localhost:11434"
+
+    def test_writes_api_key(self, tmp_path):
+        from api.profiles import _write_endpoint_to_config
+        _write_endpoint_to_config(tmp_path, api_key="sk-local-test")
+        cfg = yaml.safe_load((tmp_path / "config.yaml").read_text())
+        assert cfg["model"]["api_key"] == "sk-local-test"
+
+    def test_writes_both(self, tmp_path):
+        from api.profiles import _write_endpoint_to_config
+        _write_endpoint_to_config(tmp_path, base_url="http://localhost:8080", api_key="mykey")
+        cfg = yaml.safe_load((tmp_path / "config.yaml").read_text())
+        assert cfg["model"]["base_url"] == "http://localhost:8080"
+        assert cfg["model"]["api_key"] == "mykey"
+
+    def test_merges_with_existing_config(self, tmp_path):
+        """Does not clobber other top-level config keys."""
+        existing = {"model": {"default": "gpt-4o", "provider": "openai"}, "agent": {"max_turns": 90}}
+        (tmp_path / "config.yaml").write_text(yaml.dump(existing))
+        from api.profiles import _write_endpoint_to_config
+        _write_endpoint_to_config(tmp_path, base_url="http://localhost:1234")
+        cfg = yaml.safe_load((tmp_path / "config.yaml").read_text())
+        # Existing keys preserved
+        assert cfg["model"]["default"] == "gpt-4o"
+        assert cfg["model"]["provider"] == "openai"
+        assert cfg["agent"]["max_turns"] == 90
+        # New key added
+        assert cfg["model"]["base_url"] == "http://localhost:1234"
+
+    def test_noop_when_both_none(self, tmp_path):
+        from api.profiles import _write_endpoint_to_config
+        _write_endpoint_to_config(tmp_path, base_url=None, api_key=None)
+        assert not (tmp_path / "config.yaml").exists()
+
+    def test_noop_when_both_empty_strings(self, tmp_path):
+        from api.profiles import _write_endpoint_to_config
+        _write_endpoint_to_config(tmp_path, base_url="", api_key="")
+        assert not (tmp_path / "config.yaml").exists()
+
+
+# ── 6-7: API integration tests ────────────────────────────────────────────────
+
+_TEST_BASE = "http://127.0.0.1:8788"
+
+
+def _post(path, body=None):
+    import urllib.request
+    data = json.dumps(body or {}).encode()
+    req = urllib.request.Request(
+        _TEST_BASE + path, data=data, headers={"Content-Type": "application/json"}
+    )
+    try:
+        with urllib.request.urlopen(req, timeout=10) as r:
+            return json.loads(r.read()), None
+    except urllib.error.HTTPError as e:
+        try:
+            return json.loads(e.read()), e.code
+        except Exception:
+            return {}, e.code
+
+
+class TestProfileCreateAPIWithEndpoint:
+    _PROFILE_NAME = "test-ep-sprint31"
+
+    def _cleanup(self):
+        """Remove the test profile from wherever hermes_cli placed it."""
+        home_hermes = pathlib.Path.home() / ".hermes"
+        # Walk all profile roots: real ~/.hermes, and any subdirs that might be HERMES_HOME
+        roots_to_check = set()
+        roots_to_check.add(home_hermes)
+        for root, dirs, _ in os.walk(str(home_hermes)):
+            if "profiles" in dirs:
+                roots_to_check.add(pathlib.Path(root))
+            if root.count(os.sep) - str(home_hermes).count(os.sep) > 4:
+                break  # don't recurse too deep
+        for search_root in roots_to_check:
+            candidate = search_root / "profiles" / self._PROFILE_NAME
+            if candidate.exists():
+                shutil.rmtree(candidate)
+
+    def setup_method(self, _):
+        self._cleanup()
+
+    def teardown_method(self, _):
+        self._cleanup()
+
+    def test_api_route_accepts_base_url(self, test_server):
+        """POST /api/profile/create with base_url returns ok:True."""
+        data, err = _post("/api/profile/create", {
+            "name": self._PROFILE_NAME,
+            "base_url": "http://localhost:11434",
+        })
+        assert err is None, f"Expected 200, got {err}: {data}"
+        assert data.get("ok") is True
+
+    def test_api_route_writes_base_url_to_config(self, test_server):
+        """Route accepts base_url and returns profile metadata.
+
+        The actual config.yaml write is covered by the unit tests above.
+        """
+        data, err = _post("/api/profile/create", {
+            "name": self._PROFILE_NAME,
+            "base_url": "http://localhost:9999",
+        })
+        assert err is None, f"Expected 200, got {err}: {data}"
+        assert data.get("ok") is True
+        assert data.get("profile", {}).get("path"), f"API response missing profile.path: {data}"
+
+    def test_api_route_rejects_invalid_base_url(self, test_server):
+        """POST /api/profile/create with a non-http base_url returns 400."""
+        data, err = _post("/api/profile/create", {
+            "name": self._PROFILE_NAME,
+            "base_url": "ftp://localhost:11434",
+        })
+        assert err == 400, f"Expected 400, got {err}: {data}"

tests/test_sprint32.py

@@ -0,0 +1,71 @@
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+import subprocess
+from api.startup import auto_install_agent_deps
+
+class TestAutoInstallAgentDeps:
+    def test_installs_from_requirements_txt(self, tmp_path):
+        agent_dir = tmp_path / 'hermes-agent'
+        agent_dir.mkdir()
+        req = agent_dir / 'requirements.txt'
+        req.write_text('pyyaml\n')
+        with patch.dict('os.environ', {'HERMES_WEBUI_AGENT_DIR': str(agent_dir)}, clear=False):
+            with patch('subprocess.run') as mock_run:
+                mock_run.return_value = MagicMock(returncode=0, stderr='')
+                assert auto_install_agent_deps() is True
+                args = mock_run.call_args[0][0]
+                assert '-r' in args and str(req) in args
+
+    def test_falls_back_to_pyproject(self, tmp_path):
+        agent_dir = tmp_path / 'hermes-agent'
+        agent_dir.mkdir()
+        (agent_dir / 'pyproject.toml').write_text('[project]\nname="hermes-agent"\n')
+        with patch.dict('os.environ', {'HERMES_WEBUI_AGENT_DIR': str(agent_dir)}, clear=False):
+            with patch('subprocess.run') as mock_run:
+                mock_run.return_value = MagicMock(returncode=0, stderr='')
+                assert auto_install_agent_deps() is True
+                args = mock_run.call_args[0][0]
+                assert str(agent_dir) in args and '-r' not in args
+
+    def test_skips_when_agent_dir_missing(self, tmp_path, capsys):
+        missing = tmp_path / 'nonexistent-agent'
+        # Patch both HERMES_WEBUI_AGENT_DIR and HERMES_HOME so the fallback
+        # path (HERMES_HOME/hermes-agent) also resolves to a nonexistent dir,
+        # preventing the real agent dir from being found in the test environment.
+        env_overrides = {
+            'HERMES_WEBUI_AGENT_DIR': str(missing),
+            'HERMES_HOME': str(tmp_path / 'no-hermes-home'),
+        }
+        with patch.dict('os.environ', env_overrides, clear=False):
+            with patch('subprocess.run') as mock_run:
+                assert auto_install_agent_deps() is False
+                assert not mock_run.called
+        assert 'skipped' in capsys.readouterr().out.lower()
+
+    def test_skips_when_no_install_file(self, tmp_path, capsys):
+        agent_dir = tmp_path / 'hermes-agent'
+        agent_dir.mkdir()
+        with patch.dict('os.environ', {'HERMES_WEBUI_AGENT_DIR': str(agent_dir)}, clear=False):
+            with patch('subprocess.run') as mock_run:
+                assert auto_install_agent_deps() is False
+                assert not mock_run.called
+        assert 'skipped' in capsys.readouterr().out.lower()
+
+    def test_tolerates_pip_failure(self, tmp_path, capsys):
+        agent_dir = tmp_path / 'hermes-agent'
+        agent_dir.mkdir()
+        (agent_dir / 'requirements.txt').write_text('somepkg\n')
+        with patch.dict('os.environ', {'HERMES_WEBUI_AGENT_DIR': str(agent_dir)}, clear=False):
+            with patch('subprocess.run') as mock_run:
+                mock_run.return_value = MagicMock(returncode=1, stderr='ERROR: could not find package')
+                assert auto_install_agent_deps() is False
+        assert 'failed' in capsys.readouterr().out.lower() or 'pip' in capsys.readouterr().out.lower()
+
+    def test_tolerates_timeout(self, tmp_path, capsys):
+        agent_dir = tmp_path / 'hermes-agent'
+        agent_dir.mkdir()
+        (agent_dir / 'requirements.txt').write_text('somepkg\n')
+        with patch.dict('os.environ', {'HERMES_WEBUI_AGENT_DIR': str(agent_dir)}, clear=False):
+            with patch('subprocess.run', side_effect=subprocess.TimeoutExpired('pip', 120)):
+                assert auto_install_agent_deps() is False
+        assert 'timed out' in capsys.readouterr().out.lower()

tests/test_sprint33.py

@@ -0,0 +1,59 @@
+"""
+Sprint 33 Tests: Shared app dialogs replace native confirm/prompt usage.
+
+These tests verify the static assets expose the reusable confirm/input modal
+and that browser-native confirm/prompt calls are no longer used in the Web UI.
+"""
+
+import pathlib
+import re
+
+
+REPO = pathlib.Path(__file__).parent.parent
+
+
+def read(path):
+    return (REPO / path).read_text(encoding="utf-8")
+
+
+def test_index_has_shared_app_dialog_markup():
+    html = read("static/index.html")
+    assert 'id="appDialogOverlay"' in html
+    assert 'id="appDialog"' in html
+    assert 'id="appDialogTitle"' in html
+    assert 'id="appDialogDesc"' in html
+    assert 'id="appDialogInput"' in html
+    assert 'id="appDialogCancel"' in html
+    assert 'id="appDialogConfirm"' in html
+
+
+def test_app_dialog_css_rules_exist():
+    css = read("static/style.css")
+    for selector in (
+        ".app-dialog-overlay",
+        ".app-dialog",
+        ".app-dialog-input",
+        ".app-dialog-actions",
+        ".app-dialog-btn.confirm",
+        ".app-dialog-btn.confirm.danger",
+    ):
+        assert selector in css, f"missing CSS selector: {selector}"
+
+
+def test_ui_js_exposes_shared_dialog_helpers():
+    src = read("static/ui.js")
+    assert "function showConfirmDialog(opts={})" in src
+    assert "function showPromptDialog(opts={})" in src
+    assert "document.addEventListener('keydown'" in src
+
+
+def test_no_native_confirm_calls_remain_in_static_js():
+    for path in (REPO / "static").glob("*.js"):
+        src = path.read_text(encoding="utf-8")
+        assert not re.search(r"\bconfirm\s*\(", src), f"native confirm() remains in {path.name}"
+
+
+def test_no_native_prompt_calls_remain_in_static_js():
+    for path in (REPO / "static").glob("*.js"):
+        src = path.read_text(encoding="utf-8")
+        assert not re.search(r"\bprompt\s*\(", src), f"native prompt() remains in {path.name}"

tests/test_tls_support.py

@@ -0,0 +1,214 @@
+"""
+Tests for optional TLS/HTTPS support (HERMES_WEBUI_TLS_CERT / TLS_KEY).
+
+Tests use a self-signed certificate generated at test time via openssl.
+"""
+import http.client
+import json
+import os
+import ssl
+import subprocess
+import textwrap
+import time
+import tempfile
+import unittest
+from contextlib import suppress
+from pathlib import Path
+
+ROOT = Path(__file__).parent.parent
+
+
+def _gen_test_cert(tmpdir: Path) -> tuple[str, str]:
+    """Generate a self-signed cert and key pair for testing."""
+    cert = str(tmpdir / "test_cert.pem")
+    key = str(tmpdir / "test_key.pem")
+    subprocess.run(
+        ["openssl", "req", "-x509", "-newkey", "rsa:2048",
+         "-keyout", key, "-out", cert, "-days", "1", "-nodes",
+         "-subj", "/CN=localhost"],
+        check=True, capture_output=True,
+    )
+    return cert, key
+
+
+def _find_free_port() -> int:
+    import socket
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
+        s.bind(("127.0.0.1", 0))
+        return s.getsockname()[1]
+
+
+def _wait_for_server(host: str, port: int, use_ssl: bool = False,
+                     timeout: float = 8.0) -> bool:
+    """Poll until the server accepts a connection or times out."""
+    ctx = None
+    if use_ssl:
+        ctx = ssl.create_default_context()
+        ctx.check_hostname = False
+        ctx.verify_mode = ssl.CERT_NONE
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        try:
+            if use_ssl:
+                c = http.client.HTTPSConnection(host, port, timeout=2, context=ctx)
+            else:
+                c = http.client.HTTPConnection(host, port, timeout=2)
+            c.request("GET", "/health")
+            resp = c.getresponse()
+            resp.read()
+            c.close()
+            return True
+        except Exception:
+            time.sleep(0.5)
+    return False
+
+
+def _start_server(port: int, cert: str = None, key: str = None) -> subprocess.Popen:
+    """Start server.py as a subprocess with the given TLS env vars."""
+    env = {k: v for k, v in os.environ.items()}
+    env["HERMES_WEBUI_HOST"] = "127.0.0.1"
+    env["HERMES_WEBUI_PORT"] = str(port)
+    env.pop("HERMES_WEBUI_TLS_CERT", None)
+    env.pop("HERMES_WEBUI_TLS_KEY", None)
+    if cert:
+        env["HERMES_WEBUI_TLS_CERT"] = cert
+    if key:
+        env["HERMES_WEBUI_TLS_KEY"] = key
+    env["HERMES_WEBUI_STATE_DIR"] = str(Path(tempfile.mkdtemp()))
+    proc = subprocess.Popen(
+        [os.sys.executable, str(ROOT / "server.py")],
+        env=env, stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
+        text=True,
+    )
+    return proc
+
+
+# ── Test class ──────────────────────────────────────────────────────────────
+
+class TestTLSConfigFlag(unittest.TestCase):
+
+    def test_tls_enabled_true_when_both_env_set(self):
+        code = textwrap.dedent("""\
+            import os
+            os.environ['HERMES_WEBUI_TLS_CERT'] = '/tmp/cert.pem'
+            os.environ['HERMES_WEBUI_TLS_KEY'] = '/tmp/key.pem'
+            from api.config import TLS_ENABLED
+            print(TLS_ENABLED)
+        """)
+        r = subprocess.run(
+            [os.sys.executable, "-c", code],
+            capture_output=True, text=True, timeout=10,
+            cwd=str(ROOT),
+        )
+        self.assertEqual(r.stdout.strip(), "True")
+
+    def test_tls_enabled_false_when_env_absent(self):
+        env = {k: v for k, v in os.environ.items()
+               if k not in ("HERMES_WEBUI_TLS_CERT", "HERMES_WEBUI_TLS_KEY")}
+        code = textwrap.dedent("""\
+            import os
+            os.environ.pop('HERMES_WEBUI_TLS_CERT', None)
+            os.environ.pop('HERMES_WEBUI_TLS_KEY', None)
+            from api.config import TLS_ENABLED
+            print(TLS_ENABLED)
+        """)
+        r = subprocess.run(
+            [os.sys.executable, "-c", code],
+            capture_output=True, text=True, timeout=10,
+            cwd=str(ROOT), env=env,
+        )
+        self.assertEqual(r.stdout.strip(), "False")
+
+    def test_tls_enabled_false_when_only_cert_set(self):
+        env = {k: v for k, v in os.environ.items()
+               if k not in ("HERMES_WEBUI_TLS_CERT", "HERMES_WEBUI_TLS_KEY")}
+        env["HERMES_WEBUI_TLS_CERT"] = "/tmp/cert.pem"
+        code = textwrap.dedent("""\
+            from api.config import TLS_ENABLED
+            print(TLS_ENABLED)
+        """)
+        r = subprocess.run(
+            [os.sys.executable, "-c", code],
+            capture_output=True, text=True, timeout=10,
+            cwd=str(ROOT), env=env,
+        )
+        self.assertEqual(r.stdout.strip(), "False")
+
+
+class TestTLSEndToEnd(unittest.TestCase):
+
+    @classmethod
+    def setUpClass(cls):
+        cls._tmpdir = Path(tempfile.mkdtemp())
+        cls._cert, cls._key = _gen_test_cert(cls._tmpdir)
+
+    @classmethod
+    def tearDownClass(cls):
+        with suppress(Exception):
+            import shutil
+            shutil.rmtree(cls._tmpdir, ignore_errors=True)
+
+    def tearDown(self):
+        if hasattr(self, "_proc") and self._proc.poll() is None:
+            self._proc.terminate()
+            try:
+                self._proc.wait(timeout=5)
+            except subprocess.TimeoutExpired:
+                self._proc.kill()
+
+    def test_https_server_responds_to_health(self):
+        port = _find_free_port()
+        self._proc = _start_server(port, cert=self._cert, key=self._key)
+        self.assertTrue(
+            _wait_for_server("127.0.0.1", port, use_ssl=True),
+            "TLS server did not start in time",
+        )
+        ctx = ssl.create_default_context()
+        ctx.check_hostname = False
+        ctx.verify_mode = ssl.CERT_NONE
+        conn = http.client.HTTPSConnection("127.0.0.1", port, timeout=5, context=ctx)
+        conn.request("GET", "/health")
+        resp = conn.getresponse()
+        self.assertEqual(resp.status, 200)
+        data = json.loads(resp.read())
+        self.assertEqual(data.get("status"), "ok")
+        conn.close()
+
+    def test_http_without_tls_still_works(self):
+        port = _find_free_port()
+        self._proc = _start_server(port)
+        self.assertTrue(
+            _wait_for_server("127.0.0.1", port, use_ssl=False),
+        )
+        conn = http.client.HTTPConnection("127.0.0.1", port, timeout=5)
+        conn.request("GET", "/health")
+        resp = conn.getresponse()
+        self.assertEqual(resp.status, 200)
+        data = json.loads(resp.read())
+        self.assertEqual(data.get("status"), "ok")
+        conn.close()
+
+    def test_tls_startup_failure_fallback_to_http(self):
+        """Bad cert paths should print a warning and start HTTP anyway."""
+        port = _find_free_port()
+        self._proc = _start_server(
+            port, cert="/nonexistent/cert.pem", key="/nonexistent/key.pem",
+        )
+        # Server should be reachable over plain HTTP even though TLS setup failed
+        self.assertTrue(
+            _wait_for_server("127.0.0.1", port, use_ssl=False),
+            "HTTP fallback server did not start after TLS failure",
+        )
+        # Confirm TLS warning was printed
+        import fcntl
+        os.set_blocking(self._proc.stdout.fileno(), False)
+        output = ""
+        try:
+            output = self._proc.stdout.read(2000) or ""
+        except BlockingIOError:
+            output = ""
+        self.assertIn("TLS setup failed", output)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_update_checker.py

@@ -0,0 +1,317 @@
+"""
+Tests for api/updates.py -- specifically the diagnostic code paths added
+in fix/223-update-pull-failed-diagnostics (PR #227).
+
+Tests cover the four new branches in _apply_update_inner():
+  1. fetch fails  → network error message
+  2. pull fails + diverged history  → recovery command with git reset --hard
+  3. pull fails + no upstream tracking  → recovery command with set-upstream-to
+  4. pull fails + generic fallback  → raw git output truncated at 300 chars
+"""
+from pathlib import Path
+from unittest.mock import patch, call
+import subprocess
+
+import pytest
+
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+def _make_run_git_side_effect(*sequence):
+    """Return a side_effect function that yields successive (stdout, ok) tuples."""
+    it = iter(sequence)
+    def _side_effect(args, cwd, timeout=10):
+        return next(it)
+    return _side_effect
+
+
+# ---------------------------------------------------------------------------
+# Path used for patching
+# ---------------------------------------------------------------------------
+
+_MODULE = 'api.updates'
+
+
+# ---------------------------------------------------------------------------
+# Tests for _apply_update_inner() diagnostic paths
+# ---------------------------------------------------------------------------
+
+class TestApplyUpdateDiagnostics:
+    """New code paths introduced in PR #227."""
+
+    def _apply(self, target, run_git_side_effect):
+        """Call _apply_update_inner with _apply_lock bypassed and _run_git mocked."""
+        from api import updates
+        with patch(f'{_MODULE}._run_git', side_effect=run_git_side_effect), \
+             patch.object(updates, '_apply_lock') as mock_lock:
+            mock_lock.acquire.return_value = True
+            mock_lock.release.return_value = None
+            return updates._apply_update_inner(target)
+
+    # ------------------------------------------------------------------
+    # Path 1: fetch step fails → network error message
+    # ------------------------------------------------------------------
+
+    def test_fetch_failure_returns_network_error_message(self, tmp_path):
+        """When git fetch fails, return a human-readable connection error."""
+        (tmp_path / '.git').mkdir()
+
+        from api import updates
+        with patch(f'{_MODULE}.REPO_ROOT', tmp_path), \
+             patch(f'{_MODULE}._run_git') as mock_run_git:
+            # Call sequence: upstream query, fetch
+            mock_run_git.side_effect = [
+                ('origin/master', True),   # rev-parse @{upstream}
+                ('', False),               # fetch fails
+            ]
+            result = updates._apply_update_inner('webui')
+
+        assert result['ok'] is False
+        msg = result['message'].lower()
+        assert 'could not reach' in msg or 'internet connection' in msg or 'remote repository' in msg
+
+    def test_fetch_failure_does_not_attempt_pull(self, tmp_path):
+        """When fetch fails, pull is never called."""
+        (tmp_path / '.git').mkdir()
+
+        from api import updates
+        with patch(f'{_MODULE}.REPO_ROOT', tmp_path), \
+             patch(f'{_MODULE}._run_git') as mock_run_git:
+            mock_run_git.side_effect = [
+                ('origin/master', True),   # upstream query
+                ('', False),               # fetch fails
+            ]
+            updates._apply_update_inner('webui')
+            # Only 2 calls: upstream query + fetch. No pull call.
+            assert mock_run_git.call_count == 2
+
+    # ------------------------------------------------------------------
+    # Path 2: pull fails + diverged history
+    # ------------------------------------------------------------------
+
+    def test_diverged_history_returns_reset_hard_command(self, tmp_path):
+        """Diverged history produces a message with 'reset --hard'."""
+        (tmp_path / '.git').mkdir()
+
+        from api import updates
+        with patch(f'{_MODULE}.REPO_ROOT', tmp_path), \
+             patch(f'{_MODULE}._run_git') as mock_run_git:
+            mock_run_git.side_effect = [
+                ('origin/master', True),                          # upstream query
+                ('', True),                                       # fetch succeeds
+                ('', True),                                       # status --porcelain (clean)
+                ('Not possible to fast-forward, aborting.', False),  # pull fails
+            ]
+            result = updates._apply_update_inner('webui')
+
+        assert result['ok'] is False
+        assert result.get('diverged') is True
+        msg = result['message']
+        assert 'reset --hard' in msg
+
+    def test_diverged_history_message_contains_compare_ref(self, tmp_path):
+        """Diverged history message includes the upstream ref."""
+        (tmp_path / '.git').mkdir()
+
+        from api import updates
+        with patch(f'{_MODULE}.REPO_ROOT', tmp_path), \
+             patch(f'{_MODULE}._run_git') as mock_run_git:
+            mock_run_git.side_effect = [
+                ('origin/feat/my-feature', True),   # upstream query
+                ('', True),                         # fetch
+                ('', True),                         # status (clean)
+                ('Your branch and origin have diverged.', False),  # pull
+            ]
+            result = updates._apply_update_inner('webui')
+
+        assert result['ok'] is False
+        assert 'origin/feat/my-feature' in result['message']
+
+    def test_diverged_matching_is_case_insensitive(self, tmp_path):
+        """'DIVERGED' in uppercase is still detected."""
+        (tmp_path / '.git').mkdir()
+
+        from api import updates
+        with patch(f'{_MODULE}.REPO_ROOT', tmp_path), \
+             patch(f'{_MODULE}._run_git') as mock_run_git:
+            mock_run_git.side_effect = [
+                ('origin/master', True),
+                ('', True),
+                ('', True),
+                ('DIVERGED from upstream', False),
+            ]
+            result = updates._apply_update_inner('webui')
+
+        assert result['ok'] is False
+        assert result.get('diverged') is True
+
+    # ------------------------------------------------------------------
+    # Path 3: pull fails + no upstream tracking configured
+    # ------------------------------------------------------------------
+
+    def test_no_tracking_returns_set_upstream_command(self, tmp_path):
+        """Missing upstream tracking branch produces set-upstream-to message."""
+        (tmp_path / '.git').mkdir()
+
+        from api import updates
+        with patch(f'{_MODULE}.REPO_ROOT', tmp_path), \
+             patch(f'{_MODULE}._run_git') as mock_run_git:
+            mock_run_git.side_effect = [
+                ('origin/master', True),                               # upstream query
+                ('', True),                                            # fetch
+                ('', True),                                            # status (clean)
+                ('There is no tracking information for the current branch.', False),  # pull
+            ]
+            result = updates._apply_update_inner('webui')
+
+        assert result['ok'] is False
+        assert 'set-upstream-to' in result['message']
+        assert result.get('diverged') is None
+
+    def test_no_tracking_alternate_phrasing(self, tmp_path):
+        """'does not track' alternate git message is also detected."""
+        (tmp_path / '.git').mkdir()
+
+        from api import updates
+        with patch(f'{_MODULE}.REPO_ROOT', tmp_path), \
+             patch(f'{_MODULE}._run_git') as mock_run_git:
+            mock_run_git.side_effect = [
+                ('origin/master', True),
+                ('', True),
+                ('', True),
+                ('fatal: The current branch local does not track a remote branch.', False),
+            ]
+            result = updates._apply_update_inner('webui')
+
+        assert result['ok'] is False
+        assert 'set-upstream-to' in result['message']
+
+    def test_no_tracking_message_contains_compare_ref(self, tmp_path):
+        """set-upstream-to message includes the upstream ref to configure."""
+        (tmp_path / '.git').mkdir()
+
+        from api import updates
+        with patch(f'{_MODULE}.REPO_ROOT', tmp_path), \
+             patch(f'{_MODULE}._run_git') as mock_run_git:
+            mock_run_git.side_effect = [
+                ('origin/main', True),
+                ('', True),
+                ('', True),
+                ('no tracking information', False),
+            ]
+            result = updates._apply_update_inner('webui')
+
+        assert result['ok'] is False
+        assert 'origin/main' in result['message']
+
+    # ------------------------------------------------------------------
+    # Path 4: pull fails + generic fallback (truncated raw output)
+    # ------------------------------------------------------------------
+
+    def test_generic_failure_includes_truncated_git_output(self, tmp_path):
+        """Generic pull failure includes up to 300 chars of git output."""
+        (tmp_path / '.git').mkdir()
+        long_error = 'X' * 500  # 500-char error from git
+
+        from api import updates
+        with patch(f'{_MODULE}.REPO_ROOT', tmp_path), \
+             patch(f'{_MODULE}._run_git') as mock_run_git:
+            mock_run_git.side_effect = [
+                ('origin/master', True),
+                ('', True),
+                ('', True),
+                (long_error, False),
+            ]
+            result = updates._apply_update_inner('webui')
+
+        assert result['ok'] is False
+        msg = result['message']
+        # The raw output in the message must be truncated at 300 chars
+        assert 'X' * 300 in msg
+        assert 'X' * 301 not in msg
+
+    def test_generic_failure_empty_output_shows_sentinel(self, tmp_path):
+        """When git produces no output, message contains a fallback sentinel."""
+        (tmp_path / '.git').mkdir()
+
+        from api import updates
+        with patch(f'{_MODULE}.REPO_ROOT', tmp_path), \
+             patch(f'{_MODULE}._run_git') as mock_run_git:
+            mock_run_git.side_effect = [
+                ('origin/master', True),
+                ('', True),
+                ('', True),
+                ('', False),   # pull fails with empty output
+            ]
+            result = updates._apply_update_inner('webui')
+
+        assert result['ok'] is False
+        assert 'no output' in result['message'].lower() or result['message']
+
+    def test_generic_failure_does_not_set_diverged(self, tmp_path):
+        """A generic pull failure must not set diverged=True."""
+        (tmp_path / '.git').mkdir()
+
+        from api import updates
+        with patch(f'{_MODULE}.REPO_ROOT', tmp_path), \
+             patch(f'{_MODULE}._run_git') as mock_run_git:
+            mock_run_git.side_effect = [
+                ('origin/master', True),
+                ('', True),
+                ('', True),
+                ('Some unrecognized git error', False),
+            ]
+            result = updates._apply_update_inner('webui')
+
+        assert result['ok'] is False
+        assert not result.get('diverged')
+
+    # ------------------------------------------------------------------
+    # Regression: existing success path still works after fetch addition
+    # ------------------------------------------------------------------
+
+    def test_successful_update_still_returns_ok(self, tmp_path):
+        """Fetch + status + pull success path returns ok=True (regression guard)."""
+        (tmp_path / '.git').mkdir()
+
+        from api import updates
+        # Patch the cache's 'checked_at' key directly to avoid the lock
+        # invalidation block raising. We use a fresh dict swap.
+        fake_cache = {'webui': None, 'agent': None, 'checked_at': 1}
+        with patch(f'{_MODULE}.REPO_ROOT', tmp_path), \
+             patch(f'{_MODULE}._run_git') as mock_run_git, \
+             patch(f'{_MODULE}._update_cache', fake_cache), \
+             patch(f'{_MODULE}._cache_lock'):
+            mock_run_git.side_effect = [
+                ('origin/master', True),          # upstream query
+                ('', True),                       # fetch succeeds
+                ('', True),                       # status (clean working tree)
+                ('Already up to date.', True),    # pull succeeds
+            ]
+            result = updates._apply_update_inner('webui')
+
+        assert result['ok'] is True
+
+    # ------------------------------------------------------------------
+    # Agent target works the same as webui target
+    # ------------------------------------------------------------------
+
+    def test_fetch_failure_for_agent_target(self, tmp_path):
+        """Fetch failure path also works when target='agent'."""
+        (tmp_path / '.git').mkdir()
+
+        from api import updates
+        with patch(f'{_MODULE}._AGENT_DIR', tmp_path), \
+             patch(f'{_MODULE}._run_git') as mock_run_git:
+            mock_run_git.side_effect = [
+                ('origin/master', True),
+                ('', False),   # fetch fails
+            ]
+            result = updates._apply_update_inner('agent')
+
+        assert result['ok'] is False
+        assert 'could not reach' in result['message'].lower() or \
+               'internet' in result['message'].lower() or \
+               'remote' in result['message'].lower()