docs: v0.41.0 release — TLS, CSP, session memory leak, slow-client timeout, update checker, CLI file browser (561 tests) (#205 )

Co-authored-by: Nathan Esquenazi <nesquena@gmail.com>
fix: support CLI sessions in /api/list file browser (#204 )
2026-04-09 18:20:07 -07:00 · 2026-04-09 18:18:38 -07:00 · 2026-04-09 18:10:11 -07:00 · 2026-04-09 18:08:29 -07:00 · 2026-04-09 18:07:07 -07:00 · 2026-04-09 18:05:23 -07:00
30 changed files with 2661 additions and 267 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,171 @@

 ---

+
+## [v0.41.0] — 2026-04-10
+
+### Features
+- **Optional HTTPS/TLS support** (PR #199): Set `HERMES_WEBUI_TLS_CERT` and
+  `HERMES_WEBUI_TLS_KEY` env vars to enable HTTPS natively. Uses
+  `ssl.PROTOCOL_TLS_SERVER` with TLS 1.2 minimum. Gracefully falls back to HTTP
+  if cert loading fails. No reverse proxy required for LAN/VPN deployments.
+
+### Bug Fixes
+- **CSP blocking Mermaid and Prism** (PR #197): Added Content-Security-Policy and
+  Permissions-Policy headers to every response. CSP allows `cdn.jsdelivr.net` in
+  `script-src` and `style-src` for Mermaid.js (dynamically loaded) and Prism.js
+  (statically loaded with SRI integrity hashes). All other external origins blocked.
+- **Session memory leak** (PR #196): `api/auth.py` accumulated expired session tokens
+  indefinitely. Added `_prune_expired_sessions()` called lazily on every
+  `verify_session()` call. No background thread, no lock contention.
+- **Slow-client thread exhaustion** (PR #198): Added `Handler.timeout = 30` to kill
+  idle/stalled connections before they exhaust the thread pool.
+- **False update alerts on feature branches** (PR #201): Update checker compared
+  `HEAD..origin/master` even when on a feature branch, counting unrelated master
+  commits as missing updates. Now uses `git rev-parse --abbrev-ref @{upstream}` to
+  track the current branch's upstream. Falls back to default branch when no upstream
+  is set.
+- **CLI session file browser returning 404** (PR #204): `/api/list` only checked
+  the WebUI in-memory session dict, so CLI sessions shown in the sidebar always
+  returned 404 for file browsing. Now falls back to `get_cli_sessions()` — the same
+  pattern used by `/api/session` GET and `/api/sessions` list.
+
+## [v0.40.2] — 2026-04-09
+
+### Features
+- **Full approval UI** (PR #187): When the agent triggers a dangerous command
+  (e.g. `rm -rf`, `pkill -9`), a polished approval card now appears immediately
+  instead of leaving the chat stuck in "Thinking…" forever. Four one-click buttons:
+  Allow once, Allow session, Always allow, Deny. Enter key defaults to Allow once.
+  Buttons disable immediately on click to prevent double-submit. Card auto-focuses
+  Allow once so keyboard-only users can approve in one keystroke. All labels and
+  the heading are fully i18n-translated (English + Chinese).
+
+### Bug Fixes
+- **Approval SSE event never sent** (PR #187): `register_gateway_notify()` was
+  never called before the agent ran, so the approval module had no way to push
+  the `approval` SSE event to the frontend. Fixed by registering a callback that
+  calls `put('approval', ...)` the instant a dangerous command is detected.
+- **Agent thread never unblocked** (PR #187): `/api/approval/respond` did not call
+  `resolve_gateway_approval()`, so the agent thread waited for the full 5-minute
+  gateway timeout. Now calls it on every respond, waking the thread immediately.
+- **`_unreg_notify` scoping** (PR #187): Variable was only assigned inside a `try`
+  block but referenced in `finally`. Initialised to `None` before the `try` so the
+  `finally` guard is always well-defined.
+
+### Tests
+- 32 new tests in `tests/test_sprint30.py`: approval card HTML structure, all 4
+  button IDs and data-i18n labels, keyboard shortcut in boot.js, i18n keys in both
+  locales, CSS loading/disabled/kbd states, messages.js button-disable behaviour,
+  streaming.py scoping, HTTP regression for all 4 choices.
+- 16 tests in `tests/test_approval_unblock.py` (gateway approval unit + HTTP).
+- **547 tests total** (499 → 515 → 547).
+
+---
+
+## [v0.40.1] — 2026-04-09
+
+### Bug Fixes
+- **Default locale on first install** (PR #185): A fresh install would start in
+  English based on the server default, but `loadLocale()` could resurrect a
+  stale or unsupported locale code from `localStorage`. Now `loadLocale()` falls
+  back to English when there is no saved code or the saved code is not in the
+  LOCALES bundle. `setLocale()` also stores the resolved code, so an unknown
+  input never persists to storage.
+
+---
+
+## [v0.40.0] — 2026-04-09
+
+### Features
+- **i18n — pluggable language switcher** (PR #179): Settings panel now has a
+  Language dropdown. Ships with English and Chinese (中文). All UI strings use
+  a `t()` helper that falls back to English for missing keys. The login page
+  also localises — title, placeholder, button, and error strings all respond to
+  the saved locale. Add a language by adding a LOCALES entry to `static/i18n.js`.
+- **Notification sound + browser notifications** (PR #180): Two new settings
+  toggles. "Notification sound" plays a short two-tone chime when the assistant
+  finishes or an approval card appears. "Browser notification" fires a system
+  notification when the tab is in the background.
+- **Thinking / reasoning block display** (PR #181, #182): Inline `<think>…</think>`
+  and Gemma 4 `<|channel>thought…<channel|>` tags are parsed out of assistant
+  messages and rendered as a collapsible 💡 "Thinking" card above the reply.
+  During streaming, the bubble shows "Thinking…" until the tag closes. Hardened
+  against partial-tag edge cases and empty thinking blocks.
+
+### Bug Fixes
+- **Stray `}` in message row HTML** (PR #183): A typo in the i18n refactor left
+  an extra `}` in the `msg-role` div template literal, producing `<div class="msg-role user" }>`.
+  Removed.
+- **JS-escape login locale strings** (PR #183): `LOGIN_INVALID_PW` and
+  `LOGIN_CONN_FAILED` were injected into a JS string context without escaping
+  single quotes or backslashes. Now uses minimal JS-string escaping.
+
+---
+
+## [v0.39.1] — 2026-04-08
+
+### Bug Fixes
+- **_ENV_LOCK deadlock resolved.** The environment variable lock was held for
+  the entire duration of agent execution (including all tool calls and streaming),
+  blocking all concurrent requests. Now the lock is acquired only for the brief
+  env variable read/write operations, released before the agent runs, and
+  re-acquired in the finally block for restoration.
+
+---
+
+## [v0.39.0] — 2026-04-08
+
+### Security (12 fixes — PR #171 by @betamod, reviewed by @nesquena-hermes)
+
+- **CSRF protection**: all POST endpoints now validate `Origin`/`Referer` against `Host`. Non-browser clients (curl, agent) without these headers are unaffected.
+- **PBKDF2 password hashing**: `save_settings()` was using single-iteration SHA-256. Now calls `auth._hash_password()` — PBKDF2-HMAC-SHA256 with 600,000 iterations and a per-installation random salt.
+- **Login rate limiting**: 5 failed attempts per 60 seconds per IP returns HTTP 429.
+- **Session ID validation**: `Session.load()` rejects any non-hex character before touching the filesystem, preventing path traversal via crafted session IDs.
+- **SSRF DNS resolution**: `get_available_models()` resolves DNS before checking private IPs. Prevents DNS rebinding attacks. Known-local providers (Ollama, LM Studio, localhost) are whitelisted.
+- **Non-loopback startup warning**: server prints a clear warning when binding to `0.0.0.0` without a password set — a common Docker footgun.
+- **ENV_LOCK consistency**: `_ENV_LOCK` now wraps all `os.environ` mutations in both the sync chat and streaming restore blocks, preventing races across concurrent requests.
+- **Stored XSS prevention**: files with `text/html`, `application/xhtml+xml`, or `image/svg+xml` MIME types are forced to `Content-Disposition: attachment`, preventing execution in-browser.
+- **HMAC signature**: extended from 64 bits to 128 bits (16-char to 32-char hex).
+- **Skills path validation**: `resolve().relative_to(SKILLS_DIR)` check added after skill directory construction to prevent traversal.
+- **Secure cookie flag**: auto-set when TLS or `X-Forwarded-Proto: https` is detected. Uses `getattr` safely so plain sockets don't raise `AttributeError`.
+- **Error path sanitization**: `_sanitize_error()` strips absolute filesystem paths from exception messages before they reach the client.
+
+### Tests
+- Added `tests/test_sprint29.py` — 33 tests covering all 12 security fixes.
+
+---
+
+## [v0.38.6] — 2026-04-07
+
+### Fixed
+- **`/insights` message count always 0 for WebUI sessions** (#163, #164): `sync_session_usage()` wrote token counts, cost, model, and title to `state.db` but never `message_count`. Both the streaming and sync chat paths now pass `len(s.messages)`. Note: `/insights` sync is opt-in — enable **Sync to Insights** in Settings (it's off by default).
+
+---
+
+## [v0.38.5] — 2026-04-06
+
+### Fixed
+- **Custom endpoint URL construction** (#138, #160): `base_url` ending in `/v1` was incorrectly stripped before appending `/models`, producing `http://host/models` instead of `http://host/v1/models`. Fixed to append directly.
+- **`custom_providers` config entries now appear in dropdown** (#138, #160): Models defined under `config.yaml` `custom_providers` (e.g. Ollama aliases, Azure model overrides) are now always included in the dropdown, even when the `/v1/models` endpoint is unreachable.
+- **Custom endpoint API key reads profile `.env`** (#138, #160): Custom endpoint auth now checks `~/.hermes/.env` keys in addition to `os.environ`.
+
+---
+
+## [v0.38.4] — 2026-04-06
+
+### Fixed
+- **Copilot false positive in model dropdown** (#158): `list_available_providers()` reported Copilot as available on any machine with `gh` CLI auth, because the Copilot token resolver falls back to `gh auth token`. The dropdown now skips any provider whose credential source is `'gh auth token'` — only explicit, dedicated credentials count. Users with `GITHUB_TOKEN` explicitly set in their `.env` still see Copilot correctly.
+
+---
+
+## [v0.38.3] — 2026-04-06
+
+### Fixed
+- **Model dropdown shows only configured providers** (#155): Provider detection now uses `hermes_cli.models.list_available_providers()` — the same auth check the Hermes agent uses at runtime — instead of scanning raw API key env vars. The dropdown now reflects exactly what the user has configured (auth.json, credential pools, OAuth flows like Copilot). When no providers are detected, shows only the configured default model rather than a full generic list. Added `copilot` and `gemini` to the curated model lists. Falls back to env var scanning for standalone installs without hermes-agent.
+
+---
+
 ## [v0.38.2] — 2026-04-06

 ### Fixed
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # Hermes Web UI

-[Hermes Agent](https://hermes-agent.nousresearch.com/) is a sophisticated autonomous agent that lives on your server, accessed via a terminal or messaging apps, remembers what it learns, and gets more capable the longer it runs.
+[Hermes Agent](https://hermes-agent.nousresearch.com/) is a sophisticated autonomous agent that lives on your server, accessed via a terminal or messaging apps, that remembers what it learns and gets more capable the longer it runs.

 Hermes WebUI is a lightweight, dark-themed web app interface in your browser for [Hermes Agent](https://hermes-agent.nousresearch.com/).
 Full parity with the CLI experience - everything you can do from a terminal,
@@ -92,7 +92,16 @@ ecosystem. See [HERMES.md](HERMES.md) for the full side-by-side.

 ## Quick start

-First, you need to install and configure [Hermes Agent](https://hermes-agent.nousresearch.com/). Once installed:
+First, you need to install and configure [Hermes Agent](https://hermes-agent.nousresearch.com/docs/getting-started/quickstart) on your computer or server. This includes the following steps to complete:
+
+* [ ] Running the `curl` command to download and setup Hermes
+* [ ] Configure your [LLM provider](https://hermes-agent.nousresearch.com/docs/getting-started/quickstart#2-set-up-a-provider) with `hermes model`
+* [ ] Configure yout [messaging gateways](https://hermes-agent.nousresearch.com/docs/user-guide/messaging/) with `hermes gateway setup`
+* [ ] Can start chatting with hermes on command-line with `hermes`
+* [ ] Optional: [Configure your extended memory provider](https://hermes-agent.nousresearch.com/docs/user-guide/features/memory-providers)
+* [ ] Optional: [Configure your tools](https://hermes-agent.nousresearch.com/docs/user-guide/features/tools)
+
+Once installed, you can now setup the web UI with:

 ```bash
 git clone https://github.com/nesquena/hermes-webui.git hermes-webui
@@ -100,11 +109,11 @@ cd hermes-webui
 ./start.sh
 ```

-That is it. The script will:
+That is it! The script will:

-1. Locate your Hermes agent checkout automatically.
+1. Locate your Hermes agent directory automatically.
 2. Find (or create) a Python environment with the required dependencies.
-3. Start the server.
+3. Start the web server.
 4. Print the URL (and SSH tunnel command if you are on a remote machine).

 ---
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -3,8 +3,8 @@
 > Goal: Full 1:1 parity with the Hermes CLI experience via a clean dark web UI.
 > Everything you can do from the CLI terminal, you can do from this UI.
 >
-> Last updated: v0.36 (April 5, 2026)
-> Tests: 433 total (433 passing, 0 failures)
+> Last updated: v0.39.0 (April 8, 2026)
+> Tests: 499 total (499 passing, 0 failures)
 > Source: <repo>/

 ---
@@ -47,6 +47,9 @@
 | v0.34.2 | Theme text colors | 5 new per-theme typography variables (--strong, --em, --code-text, --code-inline-bg, --pre-text) | 433 |
 | v0.34.3 | Light theme final polish | 46 light-scoped selector overrides for sidebar, roles, chips, interactive elements | 433 |
 | v0.35 | Security hardening | Env race fix, random signing key, upload path traversal, PBKDF2 password hash | 433 |
+| v0.36–v0.37 | Model routing, personality config, tool card reload, duplicate model fixes | Model routing by provider prefix, personality via config.yaml, tool cards reload on page refresh | 466 |
+| v0.38.0–v0.38.6 | Model selector, custom endpoints, OLED theme, reasoning display, insights sync | Custom endpoint URL fix, OLED theme, top-level reasoning field fix, message_count sync to state.db | 466 |
+| v0.39.0 | Security hardening (Sprint 29) | CSRF, PBKDF2, rate limiting, session ID validation, SSRF, ENV_LOCK, XSS, HMAC, skills traversal, secure cookie, error sanitization, startup warning | 499 |

 ---

--- a/SPRINTS.md
+++ b/SPRINTS.md
@@ -1163,8 +1163,8 @@ New test cases in `tests/test_sprint26.py`:

 ---

-*Last updated: April 5, 2026*
-*Current version: v0.36.2 | 440 tests*
+*Last updated: April 8, 2026*
+*Current version: v0.39.0 | 499 tests*
 *Next sprint: Sprint 24 (Web Polish + Bug Fix Pass)*
 *Horizon sprint: Sprint 25 (macOS Desktop Application)*
 *Docs sweep policy: update markdown proactively during PR reviews and after significant releases*
--- a/TESTING.md
+++ b/TESTING.md
@@ -1,14 +1,14 @@
 # Hermes Web UI: Browser Testing Plan

 > This document is for manual browser testing by you or by a Claude browser agent.
-> It covers user-facing features of the UI through Sprint 26 (v0.36).
+> It covers user-facing features of the UI through Sprint 26 (v0.36.2) and later releases.
 > Each section is written as a step-by-step test procedure with expected outcomes.
 > A browser agent (e.g. Claude with Chrome access) can execute this plan directly.
 >
 > Prerequisites: SSH tunnel is active on port 8786. Open http://localhost:8786 in browser.
 > Server health check: curl http://127.0.0.1:8786/health should return {"status":"ok"}.
 >
-> Automated tests: 465 total (461 passing, 4 known isolation failures in test_sprint28)
+> Automated tests: 547 total (547 passing, 0 known isolation failures)
 > Run: `pytest tests/ -v --timeout=60`

 ---
--- a/THEMES.md
+++ b/THEMES.md
@@ -1,6 +1,6 @@
 # Hermes Web UI — Themes

-Hermes Web UI supports pluggable color themes. Six themes ship built-in, and
+Hermes Web UI supports pluggable color themes. Seven themes ship built-in, and
 you can create your own with pure CSS — no Python changes needed.

 ---
@@ -27,6 +27,7 @@ preview is instant — the UI updates as you click through options.
 | **Solarized Dark** | Ethan Schoonover's classic dark palette. Teal background, warm accents. |
 | **Monokai** | Warm dark theme inspired by the Monokai editor scheme. Green/pink accents. |
 | **Nord** | Arctic blue-gray palette from the Nord color system. Calm and minimal. |
+| **OLED** | True black (#000) backgrounds for OLED displays. Minimizes glow and burn-in risk. |
 | **Custom themes** | Any string accepted by `settings.json`, `POST /api/settings`, and `/theme` if added to the picker/command list. Pure CSS variables only. |

 ---
--- a/api/auth.py
+++ b/api/auth.py
@@ -24,6 +24,26 @@ SESSION_TTL = 86400  # 24 hours
 # Active sessions: token -> expiry timestamp
 _sessions = {}

+# ── Login rate limiter ──────────────────────────────────────────────────────
+_login_attempts = {}  # ip -> [timestamp, ...]
+_LOGIN_MAX_ATTEMPTS = 5
+_LOGIN_WINDOW = 60  # seconds
+
+def _check_login_rate(ip: str) -> bool:
+    """Return True if the IP is allowed to attempt login."""
+    now = time.time()
+    attempts = _login_attempts.get(ip, [])
+    # Prune old attempts
+    attempts = [t for t in attempts if now - t < _LOGIN_WINDOW]
+    _login_attempts[ip] = attempts
+    return len(attempts) < _LOGIN_MAX_ATTEMPTS
+
+def _record_login_attempt(ip: str) -> None:
+    now = time.time()
+    attempts = _login_attempts.get(ip, [])
+    attempts.append(now)
+    _login_attempts[ip] = attempts
+

 def _signing_key():
    """Return a random signing key, generating and persisting one on first call."""
@@ -84,16 +104,24 @@ def create_session() -> str:
    """Create a new auth session. Returns signed cookie value."""
    token = secrets.token_hex(32)
    _sessions[token] = time.time() + SESSION_TTL
-    sig = hmac.new(_signing_key(), token.encode(), hashlib.sha256).hexdigest()[:16]
+    sig = hmac.new(_signing_key(), token.encode(), hashlib.sha256).hexdigest()[:32]
    return f"{token}.{sig}"


+def _prune_expired_sessions():
+    """Remove all expired session entries to prevent unbounded memory growth."""
+    now = time.time()
+    for token in [t for t, exp in _sessions.items() if now > exp]:
+        _sessions.pop(token, None)
+
+
 def verify_session(cookie_value) -> bool:
    """Verify a signed session cookie. Returns True if valid and not expired."""
    if not cookie_value or '.' not in cookie_value:
        return False
+    _prune_expired_sessions()  # lazy cleanup on every verification attempt
    token, sig = cookie_value.rsplit('.', 1)
-    expected_sig = hmac.new(_signing_key(), token.encode(), hashlib.sha256).hexdigest()[:16]
+    expected_sig = hmac.new(_signing_key(), token.encode(), hashlib.sha256).hexdigest()[:32]
    if not hmac.compare_digest(sig, expected_sig):
        return False
    expiry = _sessions.get(token)
@@ -157,6 +185,9 @@ def set_auth_cookie(handler, cookie_value) -> None:
    cookie[COOKIE_NAME]['samesite'] = 'Lax'
    cookie[COOKIE_NAME]['path'] = '/'
    cookie[COOKIE_NAME]['max-age'] = str(SESSION_TTL)
+    # Set Secure flag when connection is HTTPS
+    if getattr(handler.request, 'getpeercert', None) is not None or handler.headers.get('X-Forwarded-Proto', '') == 'https':
+        cookie[COOKIE_NAME]['secure'] = True
    handler.send_header('Set-Cookie', cookie[COOKIE_NAME].OutputString())


--- a/api/config.py
+++ b/api/config.py
@@ -28,6 +28,11 @@ REPO_ROOT = Path(__file__).parent.parent.resolve()
 HOST = os.getenv('HERMES_WEBUI_HOST', '127.0.0.1')
 PORT = int(os.getenv('HERMES_WEBUI_PORT', '8787'))

+# ── TLS/HTTPS config (optional, env-overridable) ────────────────────────────
+TLS_CERT = os.getenv('HERMES_WEBUI_TLS_CERT', '').strip() or None
+TLS_KEY = os.getenv('HERMES_WEBUI_TLS_KEY', '').strip() or None
+TLS_ENABLED = TLS_CERT is not None and TLS_KEY is not None
+
 # ── State directory (env-overridable, never inside repo) ──────────────────────
 STATE_DIR = Path(os.getenv(
    'HERMES_WEBUI_STATE_DIR',
@@ -363,6 +368,20 @@ _PROVIDER_MODELS = {
        {'id': 'MiniMax-M2.5-highspeed', 'label': 'MiniMax M2.5 Highspeed'},
        {'id': 'MiniMax-M2.1',           'label': 'MiniMax M2.1'},
    ],
+    # GitHub Copilot — model IDs served via the Copilot API
+    'copilot': [
+        {'id': 'gpt-5.4',           'label': 'GPT-5.4'},
+        {'id': 'gpt-5.4-mini',      'label': 'GPT-5.4 Mini'},
+        {'id': 'gpt-4o',            'label': 'GPT-4o'},
+        {'id': 'claude-opus-4.6',   'label': 'Claude Opus 4.6'},
+        {'id': 'claude-sonnet-4.6', 'label': 'Claude Sonnet 4.6'},
+        {'id': 'gemini-2.5-pro',    'label': 'Gemini 2.5 Pro'},
+    ],
+    # 'gemini' is the hermes_cli provider ID for Google AI Studio
+    'gemini': [
+        {'id': 'gemini-2.5-pro',   'label': 'Gemini 2.5 Pro'},
+        {'id': 'gemini-2.0-flash', 'label': 'Gemini 2.0 Flash'},
+    ],
 }


@@ -470,50 +489,76 @@ def get_available_models() -> dict:
            except Exception:
                pass

-    # 4. Check for API keys that imply available providers
-    try:
-        from api.profiles import get_active_hermes_home as _gah2
-        hermes_env_path = _gah2() / '.env'
-    except ImportError:
-        hermes_env_path = HOME / '.hermes' / '.env'
-    env_keys = {}
-    if hermes_env_path.exists():
-        try:
-            for line in hermes_env_path.read_text().splitlines():
-                line = line.strip()
-                if line and not line.startswith('#') and '=' in line:
-                    k, v = line.split('=', 1)
-                    env_keys[k.strip()] = v.strip().strip('"').strip("'")
-        except Exception:
-            pass
-
-    # Merge with actual env
-    all_env = {**env_keys}
-    for k in ('ANTHROPIC_API_KEY', 'OPENAI_API_KEY', 'OPENROUTER_API_KEY',
-              'GOOGLE_API_KEY', 'GLM_API_KEY', 'KIMI_API_KEY', 'DEEPSEEK_API_KEY'):
-        val = os.getenv(k)
-        if val:
-            all_env[k] = val
-
+    # 4. Detect available providers.
+    # Primary: ask hermes-agent's auth layer — the authoritative source. It checks
+    # auth.json, credential pools, and env vars the same way the agent does at runtime,
+    # so the dropdown reflects exactly what the user has configured.
+    # Fallback: scan raw API key env vars (matches old behaviour if hermes not available).
    detected_providers = set()
    if active_provider:
        detected_providers.add(active_provider)
-    if all_env.get('ANTHROPIC_API_KEY'):
-        detected_providers.add('anthropic')
-    if all_env.get('OPENAI_API_KEY'):
-        detected_providers.add('openai')
-    if all_env.get('OPENROUTER_API_KEY'):
-        detected_providers.add('openrouter')
-    if all_env.get('GOOGLE_API_KEY'):
-        detected_providers.add('google')
-    if all_env.get('GLM_API_KEY'):
-        detected_providers.add('zai')
-    if all_env.get('KIMI_API_KEY'):
-        detected_providers.add('kimi-coding')
-    if all_env.get('MINIMAX_API_KEY') or all_env.get('MINIMAX_CN_API_KEY'):
-        detected_providers.add('minimax')
-    if all_env.get('DEEPSEEK_API_KEY'):
-        detected_providers.add('deepseek')
+    all_env: dict = {}  # profile .env keys — populated below, used by custom endpoint auth
+
+    _hermes_auth_used = False
+    try:
+        from hermes_cli.models import list_available_providers as _lap
+        from hermes_cli.auth import get_auth_status as _gas
+        for _p in _lap():
+            if not _p.get('authenticated'):
+                continue
+            # Exclude providers whose credential came from an ambient token
+            # (e.g. 'gh auth token' for Copilot on a machine with gh CLI auth).
+            # Only include providers with an explicit, dedicated credential.
+            try:
+                _src = _gas(_p['id']).get('key_source', '')
+                if _src == 'gh auth token':
+                    continue
+            except Exception:
+                pass
+            detected_providers.add(_p['id'])
+        _hermes_auth_used = True
+    except Exception:
+        pass
+
+    if not _hermes_auth_used:
+        # Fallback: scan .env and os.environ for known API key variables
+        try:
+            from api.profiles import get_active_hermes_home as _gah2
+            hermes_env_path = _gah2() / '.env'
+        except ImportError:
+            hermes_env_path = HOME / '.hermes' / '.env'
+        env_keys = {}
+        if hermes_env_path.exists():
+            try:
+                for line in hermes_env_path.read_text().splitlines():
+                    line = line.strip()
+                    if line and not line.startswith('#') and '=' in line:
+                        k, v = line.split('=', 1)
+                        env_keys[k.strip()] = v.strip().strip('"').strip("'")
+            except Exception:
+                pass
+        all_env = {**env_keys}
+        for k in ('ANTHROPIC_API_KEY', 'OPENAI_API_KEY', 'OPENROUTER_API_KEY',
+                  'GOOGLE_API_KEY', 'GLM_API_KEY', 'KIMI_API_KEY', 'DEEPSEEK_API_KEY'):
+            val = os.getenv(k)
+            if val:
+                all_env[k] = val
+        if all_env.get('ANTHROPIC_API_KEY'):
+            detected_providers.add('anthropic')
+        if all_env.get('OPENAI_API_KEY'):
+            detected_providers.add('openai')
+        if all_env.get('OPENROUTER_API_KEY'):
+            detected_providers.add('openrouter')
+        if all_env.get('GOOGLE_API_KEY'):
+            detected_providers.add('google')
+        if all_env.get('GLM_API_KEY'):
+            detected_providers.add('zai')
+        if all_env.get('KIMI_API_KEY'):
+            detected_providers.add('kimi-coding')
+        if all_env.get('MINIMAX_API_KEY') or all_env.get('MINIMAX_CN_API_KEY'):
+            detected_providers.add('minimax')
+        if all_env.get('DEEPSEEK_API_KEY'):
+            detected_providers.add('deepseek')

    # 3. Fetch models from custom endpoint if base_url is configured
    auto_detected_models = []
@@ -525,9 +570,9 @@ def get_available_models() -> dict:
            # Normalize the base_url and build models endpoint
            base_url = cfg_base_url.strip()
            if base_url.endswith('/v1'):
-                endpoint_url = base_url[:-3] + '/models'
+                endpoint_url = base_url + '/models'  # /v1/models
            else:
-                endpoint_url = base_url + '/v1/models'
+                endpoint_url = base_url.rstrip('/') + '/v1/models'

            # Detect provider from base_url
            provider = 'custom'
@@ -547,17 +592,33 @@ def get_available_models() -> dict:
                except ValueError:
                    pass

-            # Resolve API key from environment
+            # Resolve API key from environment (check profile .env keys too)
            headers = {}
            api_key_vars = ('HERMES_API_KEY', 'HERMES_OPENAI_API_KEY', 'OPENAI_API_KEY',
                            'LOCAL_API_KEY', 'OPENROUTER_API_KEY', 'API_KEY')
            for key in api_key_vars:
-                api_key = os.getenv(key)
+                api_key = all_env.get(key) or os.getenv(key)
                if api_key:
                    headers['Authorization'] = f'Bearer {api_key}'
                    break

-            # Fetch model list from endpoint
+            # Fetch model list from endpoint (with SSRF protection)
+            import socket
+            # Resolve hostname and check against private IPs after DNS lookup
+            parsed_url = urlparse(endpoint_url if '://' in endpoint_url else f'http://{endpoint_url}')
+            if parsed_url.hostname:
+                try:
+                    resolved_ips = socket.getaddrinfo(parsed_url.hostname, None)
+                    for _, _, _, _, addr in resolved_ips:
+                        addr_obj = ipaddress.ip_address(addr[0])
+                        if addr_obj.is_private or addr_obj.is_loopback or addr_obj.is_link_local:
+                            # Allow known local providers (ollama, lmstudio)
+                            is_known_local = any(k in (parsed_url.hostname or '').lower()
+                                                 for k in ('ollama', 'localhost', '127.0.0.1', 'lmstudio', 'lm-studio'))
+                            if not is_known_local:
+                                raise ValueError(f'SSRF: resolved hostname to private IP {addr[0]}')
+                except socket.gaierror:
+                    pass  # DNS resolution failed -- let urllib handle it
            req = urllib.request.Request(endpoint_url, method='GET')
            for k, v in headers.items():
                req.add_header(k, v)
@@ -582,6 +643,22 @@ def get_available_models() -> dict:
        except Exception:
            pass  # custom endpoint unreachable or misconfigured -- fail silently

+    # 3b. Include models from custom_providers config entries.
+    # These are explicitly configured and should always appear even when the
+    # /v1/models endpoint is unreachable or returns a subset.
+    _custom_providers_cfg = cfg.get('custom_providers', [])
+    if isinstance(_custom_providers_cfg, list):
+        _seen_custom_ids = {m['id'] for m in auto_detected_models}
+        for _cp in _custom_providers_cfg:
+            if not isinstance(_cp, dict):
+                continue
+            _cp_model = _cp.get('model', '')
+            if _cp_model and _cp_model not in _seen_custom_ids:
+                _cp_label = _cp_model.split('/')[-1] if '/' in _cp_model else _cp_model
+                auto_detected_models.append({'id': _cp_model, 'label': _cp_label})
+                _seen_custom_ids.add(_cp_model)
+                detected_providers.add('custom')
+
    # 5. Build model groups
    if detected_providers:
        for pid in sorted(detected_providers):
@@ -628,14 +705,11 @@ def get_available_models() -> dict:
                        'models': [{'id': default_model, 'label': default_model.split('/')[-1]}],
                    })
    else:
-        # No providers detected -- use fallback grouped list
-        by_provider = {}
-        for m in _FALLBACK_MODELS:
-            by_provider.setdefault(m['provider'], []).append(
-                {'id': m['id'], 'label': m['label']}
-            )
-        for provider_name, models in by_provider.items():
-            groups.append({'provider': provider_name, 'models': models})
+        # No providers detected. Show only the configured default model so the user
+        # can at least send messages with their current setting. Avoid showing a
+        # generic multi-provider list — those models wouldn't be routable anyway.
+        label = default_model.split('/')[-1] if '/' in default_model else default_model
+        groups.append({'provider': 'Default', 'models': [{'id': default_model, 'label': label}]})

    # Ensure the user's configured default_model always appears in the dropdown.
    # It may be missing if the model isn't in any hardcoded list (e.g. openrouter/free,
@@ -708,8 +782,11 @@ _SETTINGS_DEFAULTS = {
    'sync_to_insights': False,  # mirror WebUI token usage to state.db for /insights
    'check_for_updates': True,  # check if webui/agent repos are behind upstream
    'theme': 'dark',  # active UI theme name (no enum gate -- allows custom themes)
+    'language': 'en',  # UI locale code; must match a key in static/i18n.js LOCALES
    'bot_name': os.getenv('HERMES_WEBUI_BOT_NAME', 'Hermes'),  # display name for the assistant
-    'password_hash': None,  # SHA-256 hash; None = auth disabled
+    'sound_enabled': False,  # play notification sound when assistant finishes
+    'notifications_enabled': False,  # browser notification when tab is in background
+    'password_hash': None,  # PBKDF2-HMAC-SHA256 hash; None = auth disabled
 }

 def load_settings() -> dict:
@@ -728,17 +805,19 @@ _SETTINGS_ALLOWED_KEYS = set(_SETTINGS_DEFAULTS.keys()) - {'password_hash'}
 _SETTINGS_ENUM_VALUES = {
    'send_key': {'enter', 'ctrl+enter'},
 }
-_SETTINGS_BOOL_KEYS = {'show_token_usage', 'show_cli_sessions', 'sync_to_insights', 'check_for_updates'}
+_SETTINGS_BOOL_KEYS = {'show_token_usage', 'show_cli_sessions', 'sync_to_insights', 'check_for_updates', 'sound_enabled', 'notifications_enabled'}
+# Language codes are validated as short alphanumeric BCP-47-like tags (e.g. 'en', 'zh', 'fr')
+_SETTINGS_LANG_RE = __import__('re').compile(r'^[a-zA-Z]{2,10}(-[a-zA-Z0-9]{2,8})?$')

 def save_settings(settings: dict) -> dict:
    """Save settings to disk. Returns the merged settings. Ignores unknown keys."""
-    import hashlib as _hl
    current = load_settings()
    # Handle _set_password: hash and store as password_hash
    raw_pw = settings.pop('_set_password', None)
    if raw_pw and isinstance(raw_pw, str) and raw_pw.strip():
-        salt = str(STATE_DIR).encode()
-        current['password_hash'] = _hl.sha256(salt + raw_pw.strip().encode()).hexdigest()
+        # Use PBKDF2 from auth module (600k iterations) -- never raw SHA-256
+        from api.auth import _hash_password
+        current['password_hash'] = _hash_password(raw_pw.strip())
    # Handle _clear_password: explicitly disable auth
    if settings.pop('_clear_password', False):
        current['password_hash'] = None
@@ -747,6 +826,9 @@ def save_settings(settings: dict) -> dict:
            # Validate enum-constrained keys
            if k in _SETTINGS_ENUM_VALUES and v not in _SETTINGS_ENUM_VALUES[k]:
                continue
+            # Validate language codes (BCP-47-like: 'en', 'zh', 'fr', 'zh-CN')
+            if k == 'language' and (not isinstance(v, str) or not _SETTINGS_LANG_RE.match(v)):
+                continue
            # Coerce bool keys
            if k in _SETTINGS_BOOL_KEYS:
                v = bool(v)
--- a/api/helpers.py
+++ b/api/helpers.py
@@ -18,6 +18,15 @@ def bad(handler, msg, status: int=400):
    return j(handler, {'error': msg}, status=status)


+def _sanitize_error(e: Exception) -> str:
+    """Strip filesystem paths from exception messages before returning to client."""
+    import re
+    msg = str(e)
+    # Remove absolute paths (Unix and Windows)
+    msg = re.sub(r'(?:(?:/[a-zA-Z0-9_.-]+)+|(?:[A-Z]:\\[^\s]+))', '<path>', msg)
+    return msg
+
+
 def safe_resolve(root: Path, requested: str) -> Path:
    """Resolve a relative path inside root, raising ValueError on traversal."""
    resolved = (root / requested).resolve()
@@ -30,6 +39,16 @@ def _security_headers(handler):
    handler.send_header('X-Content-Type-Options', 'nosniff')
    handler.send_header('X-Frame-Options', 'DENY')
    handler.send_header('Referrer-Policy', 'same-origin')
+    handler.send_header(
+        'Content-Security-Policy',
+        "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; "
+        "img-src 'self' data:; font-src 'self' data:; connect-src 'self'; "
+        "base-uri 'self'; form-action 'self'"
+    )
+    handler.send_header(
+        'Permissions-Policy',
+        'camera=(), microphone=(), geolocation=()'
+    )


 def j(handler, payload, status: int=200) -> None:
--- a/api/models.py
+++ b/api/models.py
@@ -73,6 +73,9 @@ class Session:

    @classmethod
    def load(cls, sid):
+        # Validate session ID format to prevent path traversal
+        if not sid or not all(c in '0123456789abcdef' for c in sid):
+            return None
        p = SESSION_DIR / f'{sid}.json'
        if not p.exists():
            return None
--- a/api/routes.py
+++ b/api/routes.py
@@ -20,7 +20,25 @@ from api.config import (
    IMAGE_EXTS, MD_EXTS, MIME_MAP, MAX_FILE_BYTES, MAX_UPLOAD_BYTES,
    CHAT_LOCK, load_settings, save_settings,
 )
-from api.helpers import require, bad, safe_resolve, j, t, read_body, _security_headers
+from api.helpers import require, bad, safe_resolve, j, t, read_body, _security_headers, _sanitize_error
+
+# ── CSRF: validate Origin/Referer on POST ────────────────────────────────────
+import re as _re
+def _check_csrf(handler) -> bool:
+    """Reject cross-origin POST requests. Returns True if OK."""
+    origin = handler.headers.get('Origin', '')
+    referer = handler.headers.get('Referer', '')
+    host = handler.headers.get('Host', '')
+    if not origin and not referer:
+        return True  # non-browser clients (curl, agent) have no Origin
+    target = origin or referer
+    # Allow same-origin: Origin must match Host
+    if host and target:
+        # Extract host:port from origin/referer
+        m = _re.match(r'^https?://([^/]+)', target)
+        if m and m.group(1) == host:
+            return True
+    return False
 from api.models import (
    Session, get_session, new_session, all_sessions, title_from,
    _write_session_index, SESSION_INDEX_FILE,
@@ -40,6 +58,7 @@ try:
        has_pending, pop_pending, submit_pending,
        approve_session, approve_permanent, save_permanent_allowlist,
        is_approved, _pending, _lock, _permanent_approved,
+        resolve_gateway_approval,
    )
 except ImportError:
    has_pending = lambda *a, **k: False
@@ -49,15 +68,34 @@ except ImportError:
    approve_permanent = lambda *a, **k: None
    save_permanent_allowlist = lambda *a, **k: None
    is_approved = lambda *a, **k: True
+    resolve_gateway_approval = lambda *a, **k: 0
    _pending = {}
    _lock = threading.Lock()
    _permanent_approved = set()


+# ── Login page locale strings ─────────────────────────────────────────────────
+# Add entries here to support more languages on the login page.
+# The key must match the 'language' setting value (from static/i18n.js LOCALES).
+_LOGIN_LOCALE = {
+    'en': {
+        'lang': 'en', 'title': 'Sign in',
+        'subtitle': 'Enter your password to continue',
+        'placeholder': 'Password', 'btn': 'Sign in',
+        'invalid_pw': 'Invalid password', 'conn_failed': 'Connection failed',
+    },
+    'zh': {
+        'lang': 'zh-CN', 'title': '\u767b\u5f55',
+        'subtitle': '\u8f93\u5165\u5bc6\u7801\u7ee7\u7eed\u4f7f\u7528',
+        'placeholder': '\u5bc6\u7801', 'btn': '\u767b\u5f55',
+        'invalid_pw': '\u5bc6\u7801\u9519\u8bef', 'conn_failed': '\u8fde\u63a5\u5931\u8d25',
+    },
+}
+
 # ── Login page (self-contained, no external deps) ────────────────────────────
 _LOGIN_PAGE_HTML = '''<!doctype html>
-<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<title>{{BOT_NAME}} — Sign in</title>
+<html lang="{{LANG}}"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>{{BOT_NAME}} — {{LOGIN_TITLE}}</title>
 <style>
 *{box-sizing:border-box;margin:0;padding:0}
 body{background:#1a1a2e;color:#e8e8f0;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",system-ui,sans-serif;
@@ -82,11 +120,11 @@ button:hover{background:rgba(124,185,255,.25)}
 <div class="card">
  <div class="logo">{{BOT_NAME_INITIAL}}</div>
  <h1>{{BOT_NAME}}</h1>
-  <p class="sub">Enter your password to continue</p>
+  <p class="sub">{{LOGIN_SUBTITLE}}</p>
  <form onsubmit="doLogin(event);return false">
-    <input type="password" id="pw" placeholder="Password" autofocus
+    <input type="password" id="pw" placeholder="{{LOGIN_PLACEHOLDER}}" autofocus
           onkeydown="if(event.key==='Enter'){doLogin(event);event.preventDefault();}">
-    <button type="submit">Sign in</button>
+    <button type="submit">{{LOGIN_BTN}}</button>
  </form>
  <div class="err" id="err"></div>
 </div>
@@ -102,8 +140,8 @@ async function doLogin(e){
      body:JSON.stringify({password:pw}),credentials:'include'});
    const data=await res.json();
    if(res.ok&&data.ok){window.location.href='/';}
-    else{err.textContent=data.error||'Invalid password';err.style.display='block';}
-  }catch(ex){err.textContent='Connection failed';err.style.display='block';}
+    else{err.textContent=data.error||'{{LOGIN_INVALID_PW}}';err.style.display='block';}
+  }catch(ex){err.textContent='{{LOGIN_CONN_FAILED}}';err.style.display='block';}
 }
 </script></body></html>'''

@@ -117,8 +155,22 @@ def handle_get(handler, parsed) -> bool:
                 content_type='text/html; charset=utf-8')

    if parsed.path == '/login':
-        _bn = _html.escape(load_settings().get('bot_name') or 'Hermes')
-        _page = _LOGIN_PAGE_HTML.replace('{{BOT_NAME}}', _bn).replace('{{BOT_NAME_INITIAL}}', _bn[0].upper())
+        _settings = load_settings()
+        _bn = _html.escape(_settings.get('bot_name') or 'Hermes')
+        _lang = _settings.get('language', 'en')
+        _login_strings = _LOGIN_LOCALE.get(_lang, _LOGIN_LOCALE['en'])
+        _page = (
+            _LOGIN_PAGE_HTML
+            .replace('{{BOT_NAME}}', _bn)
+            .replace('{{BOT_NAME_INITIAL}}', _bn[0].upper())
+            .replace('{{LANG}}', _html.escape(_login_strings['lang']))
+            .replace('{{LOGIN_TITLE}}', _html.escape(_login_strings['title']))
+            .replace('{{LOGIN_SUBTITLE}}', _html.escape(_login_strings['subtitle']))
+            .replace('{{LOGIN_PLACEHOLDER}}', _html.escape(_login_strings['placeholder']))
+            .replace('{{LOGIN_BTN}}', _html.escape(_login_strings['btn']))
+            .replace('{{LOGIN_INVALID_PW}}', _login_strings['invalid_pw'].replace('\\','\\\\').replace("'","\\'"))
+            .replace('{{LOGIN_CONN_FAILED}}', _login_strings['conn_failed'].replace('\\','\\\\').replace("'","\\'"))
+        )
        return t(handler, _page, content_type='text/html; charset=utf-8')

    if parsed.path == '/api/auth/status':
@@ -360,6 +412,9 @@ def handle_get(handler, parsed) -> bool:

 def handle_post(handler, parsed) -> bool:
    """Handle all POST routes. Returns True if handled, False for 404."""
+    # CSRF: reject cross-origin browser requests
+    if not _check_csrf(handler):
+        return j(handler, {'error': 'Cross-origin request rejected'}, status=403)

    if parsed.path == '/api/upload':
        return handle_upload(handler)
@@ -544,7 +599,7 @@ def handle_post(handler, parsed) -> bool:
            result = switch_profile(name)
            return j(handler, result)
        except (ValueError, FileNotFoundError) as e:
-            return bad(handler, str(e), 404)
+            return bad(handler, _sanitize_error(e), 404)
        except RuntimeError as e:
            return bad(handler, str(e), 409)

@@ -578,7 +633,7 @@ def handle_post(handler, parsed) -> bool:
            result = delete_profile_api(name)
            return j(handler, result)
        except (ValueError, FileNotFoundError) as e:
-            return bad(handler, str(e))
+            return bad(handler, _sanitize_error(e))
        except RuntimeError as e:
            return bad(handler, str(e), 409)

@@ -695,10 +750,15 @@ def handle_post(handler, parsed) -> bool:
    # ── Auth endpoints (POST) ──
    if parsed.path == '/api/auth/login':
        from api.auth import verify_password, create_session, set_auth_cookie, is_auth_enabled
+        from api.auth import _check_login_rate, _record_login_attempt
        if not is_auth_enabled():
            return j(handler, {'ok': True, 'message': 'Auth not enabled'})
+        client_ip = handler.client_address[0]
+        if not _check_login_rate(client_ip):
+            return j(handler, {'error': 'Too many attempts. Try again in a minute.'}, status=429)
        password = body.get('password', '')
        if not verify_password(password):
+            _record_login_attempt(client_ip)
            return bad(handler, 'Invalid password', 401)
        cookie_val = create_session()
        handler.send_response(200)
@@ -802,15 +862,29 @@ def _handle_list_dir(handler, parsed):
    qs = parse_qs(parsed.query)
    sid = qs.get('session_id', [''])[0]
    if not sid: return bad(handler, 'session_id is required')
-    try: s = get_session(sid)
-    except KeyError: return bad(handler, 'Session not found', 404)
+    try:
+        s = get_session(sid)
+        workspace = s.workspace
+    except KeyError:
+        # Fallback for CLI sessions not loaded in WebUI memory
+        try:
+            cli_meta = None
+            for cs in get_cli_sessions():
+                if cs['session_id'] == sid:
+                    cli_meta = cs
+                    break
+            if not cli_meta:
+                return bad(handler, 'Session not found', 404)
+            workspace = cli_meta.get('workspace', '')
+        except Exception:
+            return bad(handler, 'Session not found', 404)
    try:
        return j(handler, {
-            'entries': list_dir(Path(s.workspace), qs.get('path', ['.'])[0]),
+            'entries': list_dir(Path(workspace), qs.get('path', ['.'])[0]),
            'path': qs.get('path', ['.'])[0],
        })
    except (FileNotFoundError, ValueError) as e:
-        return bad(handler, str(e), 404)
+        return bad(handler, _sanitize_error(e), 404)


 def _handle_sse_stream(handler, parsed):
@@ -859,9 +933,14 @@ def _handle_file_raw(handler, parsed):
    handler.send_header('Content-Type', mime)
    handler.send_header('Content-Length', str(len(raw_bytes)))
    handler.send_header('Cache-Control', 'no-store')
-    if force_download:
+    # Security: force download for dangerous MIME types to prevent XSS
+    dangerous_types = {'text/html', 'application/xhtml+xml', 'image/svg+xml'}
+    if force_download or mime in dangerous_types:
        handler.send_header('Content-Disposition',
            f'attachment; filename="{target.name}"; filename*=UTF-8\'\'{safe_name}')
+    else:
+        handler.send_header('Content-Disposition',
+            f'inline; filename="{target.name}"; filename*=UTF-8\'\'{safe_name}')
    handler.end_headers()
    handler.wfile.write(raw_bytes)
    return True
@@ -876,7 +955,7 @@ def _handle_file_read(handler, parsed):
    rel = qs.get('path', [''])[0]
    if not rel: return bad(handler, 'path is required')
    try: return j(handler, read_file_content(Path(s.workspace), rel))
-    except (FileNotFoundError, ValueError) as e: return bad(handler, str(e), 404)
+    except (FileNotFoundError, ValueError) as e: return bad(handler, _sanitize_error(e), 404)


 def _handle_approval_pending(handler, parsed):
@@ -1027,12 +1106,14 @@ def _handle_chat_sync(handler, body):
    if not msg: return j(handler, {'error': 'empty message'}, status=400)
    workspace = Path(body.get('workspace') or s.workspace).expanduser().resolve()
    s.workspace = str(workspace); s.model = body.get('model') or s.model
-    old_cwd = os.environ.get('TERMINAL_CWD')
-    os.environ['TERMINAL_CWD'] = str(workspace)
-    old_exec_ask = os.environ.get('HERMES_EXEC_ASK')
-    old_session_key = os.environ.get('HERMES_SESSION_KEY')
-    os.environ['HERMES_EXEC_ASK'] = '1'
-    os.environ['HERMES_SESSION_KEY'] = s.session_id
+    from api.streaming import _ENV_LOCK
+    with _ENV_LOCK:
+        old_cwd = os.environ.get('TERMINAL_CWD')
+        os.environ['TERMINAL_CWD'] = str(workspace)
+        old_exec_ask = os.environ.get('HERMES_EXEC_ASK')
+        old_session_key = os.environ.get('HERMES_SESSION_KEY')
+        os.environ['HERMES_EXEC_ASK'] = '1'
+        os.environ['HERMES_SESSION_KEY'] = s.session_id
    try:
        from run_agent import AIAgent
        with CHAT_LOCK:
@@ -1075,12 +1156,13 @@ def _handle_chat_sync(handler, body):
                persist_user_message=msg,
            )
    finally:
-        if old_cwd is None: os.environ.pop('TERMINAL_CWD', None)
-        else: os.environ['TERMINAL_CWD'] = old_cwd
-        if old_exec_ask is None: os.environ.pop('HERMES_EXEC_ASK', None)
-        else: os.environ['HERMES_EXEC_ASK'] = old_exec_ask
-        if old_session_key is None: os.environ.pop('HERMES_SESSION_KEY', None)
-        else: os.environ['HERMES_SESSION_KEY'] = old_session_key
+        with _ENV_LOCK:
+            if old_cwd is None: os.environ.pop('TERMINAL_CWD', None)
+            else: os.environ['TERMINAL_CWD'] = old_cwd
+            if old_exec_ask is None: os.environ.pop('HERMES_EXEC_ASK', None)
+            else: os.environ['HERMES_EXEC_ASK'] = old_exec_ask
+            if old_session_key is None: os.environ.pop('HERMES_SESSION_KEY', None)
+            else: os.environ['HERMES_SESSION_KEY'] = old_session_key
    s.messages = result.get('messages') or s.messages
    s.title = title_from(s.messages, s.title); s.save()
    # Sync to state.db for /insights (opt-in setting)
@@ -1094,6 +1176,7 @@ def _handle_chat_sync(handler, body):
                estimated_cost=s.estimated_cost,
                model=s.model,
                title=s.title,
+                message_count=len(s.messages),
            )
    except Exception:
        pass
@@ -1179,7 +1262,7 @@ def _handle_file_delete(handler, body):
        if target.is_dir(): return bad(handler, 'Cannot delete directories via this endpoint')
        target.unlink()
        return j(handler, {'ok': True, 'path': body['path']})
-    except (ValueError, PermissionError) as e: return bad(handler, str(e))
+    except (ValueError, PermissionError) as e: return bad(handler, _sanitize_error(e))


 def _handle_file_save(handler, body):
@@ -1193,7 +1276,7 @@ def _handle_file_save(handler, body):
        if target.is_dir(): return bad(handler, 'Cannot save: path is a directory')
        target.write_text(body.get('content', ''), encoding='utf-8')
        return j(handler, {'ok': True, 'path': body['path'], 'size': target.stat().st_size})
-    except (ValueError, PermissionError) as e: return bad(handler, str(e))
+    except (ValueError, PermissionError) as e: return bad(handler, _sanitize_error(e))


 def _handle_file_create(handler, body):
@@ -1207,7 +1290,7 @@ def _handle_file_create(handler, body):
        target.parent.mkdir(parents=True, exist_ok=True)
        target.write_text(body.get('content', ''), encoding='utf-8')
        return j(handler, {'ok': True, 'path': str(target.relative_to(Path(s.workspace)))})
-    except (ValueError, PermissionError) as e: return bad(handler, str(e))
+    except (ValueError, PermissionError) as e: return bad(handler, _sanitize_error(e))


 def _handle_file_rename(handler, body):
@@ -1226,7 +1309,7 @@ def _handle_file_rename(handler, body):
        source.rename(dest)
        new_rel = str(dest.relative_to(Path(s.workspace)))
        return j(handler, {'ok': True, 'old_path': body['path'], 'new_path': new_rel})
-    except (ValueError, PermissionError, OSError) as e: return bad(handler, str(e))
+    except (ValueError, PermissionError, OSError) as e: return bad(handler, _sanitize_error(e))


 def _handle_create_dir(handler, body):
@@ -1239,7 +1322,7 @@ def _handle_create_dir(handler, body):
        if target.exists(): return bad(handler, 'Path already exists')
        target.mkdir(parents=True)
        return j(handler, {'ok': True, 'path': str(target.relative_to(Path(s.workspace)))})
-    except (ValueError, PermissionError, OSError) as e: return bad(handler, str(e))
+    except (ValueError, PermissionError, OSError) as e: return bad(handler, _sanitize_error(e))


 def _handle_workspace_add(handler, body):
@@ -1286,6 +1369,7 @@ def _handle_approval_respond(handler, body):
    choice = body.get('choice', 'deny')
    if choice not in ('once', 'session', 'always', 'deny'):
        return bad(handler, f'Invalid choice: {choice}')
+    # Pop the legacy polling-mode pending entry (no-op when gateway path is active).
    with _lock:
        pending = _pending.pop(sid, None)
    if pending:
@@ -1296,6 +1380,10 @@ def _handle_approval_respond(handler, body):
            for k in keys:
                approve_session(sid, k); approve_permanent(k)
            save_permanent_allowlist(_permanent_approved)
+    # Unblock the agent thread waiting in the gateway approval queue.
+    # This is the primary signal when streaming is active — the agent
+    # thread is parked in entry.event.wait() and needs to be woken up.
+    resolve_gateway_approval(sid, choice, resolve_all=False)
    return j(handler, {'ok': True, 'choice': choice})


@@ -1313,6 +1401,11 @@ def _handle_skill_save(handler, body):
        skill_dir = SKILLS_DIR / category / skill_name
    else:
        skill_dir = SKILLS_DIR / skill_name
+    # Validate resolved path stays within SKILLS_DIR
+    try:
+        skill_dir.resolve().relative_to(SKILLS_DIR.resolve())
+    except ValueError:
+        return bad(handler, 'Invalid skill path')
    skill_dir.mkdir(parents=True, exist_ok=True)
    skill_file = skill_dir / 'SKILL.md'
    skill_file.write_text(body['content'], encoding='utf-8')
--- a/api/state_sync.py
+++ b/api/state_sync.py
@@ -66,7 +66,8 @@ def sync_session_start(session_id: str, model=None) -> None:


 def sync_session_usage(session_id: str, input_tokens: int=0, output_tokens: int=0,
-                       estimated_cost=None, model=None, title: str=None) -> None:
+                       estimated_cost=None, model=None, title: str=None,
+                       message_count: int=None) -> None:
    """Update token usage and title for a WebUI session in state.db.
    Called after each turn completes. Uses absolute=True to set totals
    (the WebUI Session already accumulates across turns).
@@ -92,6 +93,17 @@ def sync_session_usage(session_id: str, input_tokens: int=0, output_tokens: int=
                db.set_session_title(session_id, title)
            except Exception:
                pass
+        # Update message count
+        if message_count is not None:
+            try:
+                def _set_msg_count(conn):
+                    conn.execute(
+                        "UPDATE sessions SET message_count = ? WHERE id = ?",
+                        (message_count, session_id),
+                    )
+                db._execute_write(_set_msg_count)
+            except Exception:
+                pass
    except Exception:
        pass  # never crash the WebUI for sync failures
    finally:
--- a/api/streaming.py
+++ b/api/streaming.py
@@ -107,6 +107,9 @@ def _run_agent_streaming(session_id, msg_text, model, workspace, stream_id, atta
            HERMES_HOME=_profile_home,
        )
        # Still set process-level env as fallback for tools that bypass thread-local
+        # Acquire lock only for the env mutation, then release before the agent runs.
+        # The finally block re-acquires to restore — keeping critical sections short
+        # and preventing a deadlock where the restore would re-enter the same lock.
        with _ENV_LOCK:
          old_cwd = os.environ.get('TERMINAL_CWD')
          old_exec_ask = os.environ.get('HERMES_EXEC_ASK')
@@ -117,8 +120,28 @@ def _run_agent_streaming(session_id, msg_text, model, workspace, stream_id, atta
          os.environ['HERMES_SESSION_KEY'] = session_id
          if _profile_home:
              os.environ['HERMES_HOME'] = _profile_home
+        # Lock released — agent runs without holding it
+        # Register a gateway-style notify callback so the approval system can
+        # push the `approval` SSE event the moment a dangerous command is
+        # detected, without waiting for the next on_tool() poll cycle.
+        # Without this, the agent thread blocks inside the terminal tool
+        # waiting for approval that the UI never knew to ask for, leaving
+        # the chat stuck in "Thinking…" forever.
+        _approval_registered = False
+        _unreg_notify = None
+        try:
+            from tools.approval import (
+                register_gateway_notify as _reg_notify,
+                unregister_gateway_notify as _unreg_notify,
+            )
+            def _approval_notify_cb(approval_data):
+                put('approval', approval_data)
+            _reg_notify(session_id, _approval_notify_cb)
+            _approval_registered = True
+        except ImportError:
+            pass  # approval module not available — fall back to polling

-          try:
+        try:
            def on_token(text):
                if text is None:
                    return  # end-of-stream sentinel
@@ -130,13 +153,17 @@ def _run_agent_streaming(session_id, msg_text, model, workspace, stream_id, atta
                    for k, v in list(args.items())[:4]:
                        s2 = str(v); args_snap[k] = s2[:120]+('...' if len(s2)>120 else '')
                put('tool', {'name': name, 'preview': preview, 'args': args_snap})
-                # also check for pending approval and surface it immediately
-                from tools.approval import has_pending as _has_pending, _pending, _lock
-                if _has_pending(session_id):
-                    with _lock:
-                        p = dict(_pending.get(session_id, {}))
-                    if p:
-                        put('approval', p)
+                # Fallback: poll for pending approval in case notify_cb wasn't
+                # registered (e.g. older approval module without gateway support).
+                try:
+                    from tools.approval import has_pending as _has_pending, _pending, _lock
+                    if _has_pending(session_id):
+                        with _lock:
+                            p = dict(_pending.get(session_id, {}))
+                        if p:
+                            put('approval', p)
+                except ImportError:
+                    pass

            if AIAgent is None:
                raise ImportError("AIAgent not available -- check that hermes-agent is on sys.path")
@@ -366,6 +393,7 @@ def _run_agent_streaming(session_id, msg_text, model, workspace, stream_id, atta
                        estimated_cost=s.estimated_cost,
                        model=model,
                        title=s.title,
+                        message_count=len(s.messages),
                    )
            except Exception:
                pass  # never crash the stream for sync failures
@@ -377,15 +405,23 @@ def _run_agent_streaming(session_id, msg_text, model, workspace, stream_id, atta
                usage['threshold_tokens'] = getattr(_cc, 'threshold_tokens', 0) or 0
                usage['last_prompt_tokens'] = getattr(_cc, 'last_prompt_tokens', 0) or 0
            put('done', {'session': s.compact() | {'messages': s.messages, 'tool_calls': tool_calls}, 'usage': usage})
-          finally:
-            if old_cwd is None: os.environ.pop('TERMINAL_CWD', None)
-            else: os.environ['TERMINAL_CWD'] = old_cwd
-            if old_exec_ask is None: os.environ.pop('HERMES_EXEC_ASK', None)
-            else: os.environ['HERMES_EXEC_ASK'] = old_exec_ask
-            if old_session_key is None: os.environ.pop('HERMES_SESSION_KEY', None)
-            else: os.environ['HERMES_SESSION_KEY'] = old_session_key
-            if old_hermes_home is None: os.environ.pop('HERMES_HOME', None)
-            else: os.environ['HERMES_HOME'] = old_hermes_home
+        finally:
+            # Unregister the gateway approval callback and unblock any threads
+            # still waiting on approval (e.g. stream cancelled mid-approval).
+            if _approval_registered and _unreg_notify is not None:
+                try:
+                    _unreg_notify(session_id)
+                except Exception:
+                    pass
+            with _ENV_LOCK:
+                if old_cwd is None: os.environ.pop('TERMINAL_CWD', None)
+                else: os.environ['TERMINAL_CWD'] = old_cwd
+                if old_exec_ask is None: os.environ.pop('HERMES_EXEC_ASK', None)
+                else: os.environ['HERMES_EXEC_ASK'] = old_exec_ask
+                if old_session_key is None: os.environ.pop('HERMES_SESSION_KEY', None)
+                else: os.environ['HERMES_SESSION_KEY'] = old_session_key
+                if old_hermes_home is None: os.environ.pop('HERMES_HOME', None)
+                else: os.environ['HERMES_HOME'] = old_hermes_home

    except Exception as e:
        print('[webui] stream error:\n' + traceback.format_exc(), flush=True)
--- a/api/updates.py
+++ b/api/updates.py
@@ -64,22 +64,32 @@ def _check_repo(path, name):
    if not fetch_ok:
        return {'name': name, 'behind': 0, 'error': 'fetch failed'}

-    branch = _detect_default_branch(path)
+    # Use the current branch's upstream tracking branch, not the repo default.
+    # This avoids false "N updates behind" alerts when the user is on a feature
+    # branch and master/main has moved forward with unrelated commits.
+    # If no upstream is set (brand-new local branch), fall back to the default branch.
+    upstream, ok = _run_git(['rev-parse', '--abbrev-ref', '@{upstream}'], path)
+    if ok and upstream:
+        # upstream is like "origin/feat/foo" — use it directly in rev-list
+        compare_ref = upstream
+    else:
+        branch = _detect_default_branch(path)
+        compare_ref = f'origin/{branch}'

    # Count commits behind
-    out, ok = _run_git(['rev-list', '--count', f'HEAD..origin/{branch}'], path)
+    out, ok = _run_git(['rev-list', '--count', f'HEAD..{compare_ref}'], path)
    behind = int(out) if ok and out.isdigit() else 0

    # Get short SHAs for display
    current, _ = _run_git(['rev-parse', '--short', 'HEAD'], path)
-    latest, _ = _run_git(['rev-parse', '--short', f'origin/{branch}'], path)
+    latest, _ = _run_git(['rev-parse', '--short', compare_ref], path)

    return {
        'name': name,
        'behind': behind,
        'current_sha': current,
        'latest_sha': latest,
-        'branch': branch,
+        'branch': compare_ref,
    }


@@ -129,7 +139,14 @@ def _apply_update_inner(target):
    if path is None or not (path / '.git').exists():
        return {'ok': False, 'message': 'Not a git repository'}

-    branch = _detect_default_branch(path)
+    # Use the current branch's upstream for pull, matching the behaviour
+    # of _check_repo. Falls back to default branch if no upstream is set.
+    upstream, ok = _run_git(['rev-parse', '--abbrev-ref', '@{upstream}'], path)
+    if ok and upstream:
+        compare_ref = upstream
+    else:
+        branch = _detect_default_branch(path)
+        compare_ref = f'origin/{branch}'

    # Check for dirty working tree
    status_out, _ = _run_git(['status', '--porcelain'], path)
@@ -141,7 +158,7 @@ def _apply_update_inner(target):
        stashed = True

    # Pull with ff-only (no merge commits)
-    pull_out, pull_ok = _run_git(['pull', '--ff-only', 'origin', branch], path, timeout=30)
+    pull_out, pull_ok = _run_git(['pull', '--ff-only', compare_ref], path, timeout=30)
    if not pull_ok:
        if stashed:
            _run_git(['stash', 'pop'], path)
--- a/server.py
+++ b/server.py
@@ -15,6 +15,7 @@ from api.routes import handle_get, handle_post


 class Handler(BaseHTTPRequestHandler):
+    timeout = 30  # seconds — kills idle/incomplete connections to prevent thread exhaustion
    server_version = 'HermesWebUI/0.2'
    def log_message(self, fmt, *args): pass  # suppress default Apache-style log

@@ -61,6 +62,14 @@ def main() -> None:

    print_startup_config()

+    # Security: warn if binding non-loopback without authentication
+    from api.auth import is_auth_enabled
+    if HOST not in ('127.0.0.1', '::1', 'localhost') and not is_auth_enabled():
+        print(f'[!!] WARNING: Binding to {HOST} with NO PASSWORD SET.', flush=True)
+        print(f'     Anyone on the network can access your filesystem and agent.', flush=True)
+        print(f'     Set a password via Settings or HERMES_WEBUI_PASSWORD env var.', flush=True)
+        print(f'     To suppress: bind to 127.0.0.1 or set a password.', flush=True)
+
    ok, missing, errors = verify_hermes_imports()
    if not ok and _HERMES_FOUND:
        print(f'[!!] Warning: Hermes agent found but missing modules: {missing}', flush=True)
@@ -72,10 +81,26 @@ def main() -> None:
    SESSION_DIR.mkdir(parents=True, exist_ok=True)
    DEFAULT_WORKSPACE.mkdir(parents=True, exist_ok=True)
    httpd = ThreadingHTTPServer((HOST, PORT), Handler)
-    print(f'  Hermes Web UI listening on http://{HOST}:{PORT}', flush=True)
+
+    # ── TLS/HTTPS setup (optional) ─────────────────────────────────────────
+    from api.config import TLS_ENABLED, TLS_CERT, TLS_KEY
+    scheme = 'https' if TLS_ENABLED else 'http'
+    if TLS_ENABLED:
+        try:
+            import ssl
+            ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+            ctx.minimum_version = ssl.TLSVersion.TLSv1_2
+            ctx.load_cert_chain(TLS_CERT, TLS_KEY)
+            httpd.socket = ctx.wrap_socket(httpd.socket, server_side=True)
+            print(f'  TLS enabled: cert={TLS_CERT}, key={TLS_KEY}', flush=True)
+        except Exception as e:
+            print(f'[!!] WARNING: TLS setup failed ({e}), falling back to HTTP', flush=True)
+            scheme = 'http'
+
+    print(f'  Hermes Web UI listening on {scheme}://{HOST}:{PORT}', flush=True)
    if HOST == '127.0.0.1':
        print(f'  Remote access: ssh -N -L {PORT}:127.0.0.1:{PORT} <user>@<your-server>', flush=True)
-    print(f'  Then open:     http://localhost:{PORT}', flush=True)
+    print(f'  Then open:     {scheme}://localhost:{PORT}', flush=True)
    print('', flush=True)
    httpd.serve_forever()

--- a/static/boot.js
+++ b/static/boot.js
@@ -4,8 +4,8 @@ async function cancelStream(){
  try{
    await fetch(new URL(`/api/chat/cancel?stream_id=${encodeURIComponent(streamId)}`,location.origin).href,{credentials:'include'});
    const btn=$('btnCancel');if(btn)btn.style.display='none';
-    setStatus('Cancelling…');
-  }catch(e){setStatus('Cancel failed: '+e.message);}
+    setStatus(t('cancelling'));
+  }catch(e){setStatus(t('cancel_failed')+e.message);}
 }

 // ── Mobile navigation ──────────────────────────────────────────────────────
@@ -66,7 +66,7 @@ $('btnAttach').onclick=()=>$('fileInput').click();
  const recognition=new SpeechRecognition();
  recognition.continuous=false;
  recognition.interimResults=true;
-  recognition.lang='en-US';
+  recognition.lang=(typeof _locale!=='undefined'&&_locale._speech)||'en-US';

  let _finalText='';
  let _prefix='';
@@ -108,11 +108,11 @@ $('btnAttach').onclick=()=>$('fileInput').click();
  recognition.onerror=(event)=>{
    _setRecording(false);
    const msgs={
-      'not-allowed':'Microphone access denied. Check browser permissions.',
-      'no-speech':'No speech detected. Try again.',
-      'network':'Speech recognition unavailable.',
+      'not-allowed':t('mic_denied'),
+      'no-speech':t('mic_no_speech'),
+      'network':t('mic_network'),
    };
-    showToast(msgs[event.error]||'Voice input error: '+event.error);
+    showToast(msgs[event.error]||t('mic_error')+event.error);
  };

  function _stopMic(){
@@ -160,10 +160,10 @@ $('importFileInput').onchange=async(e)=>{
    if(res.ok&&res.session){
      await loadSession(res.session.session_id);
      await renderSessionList();
-      showToast('Session imported');
+      showToast(t('session_imported'));
    }
  }catch(err){
-    showToast('Import failed: '+(err.message||'Invalid JSON'));
+    showToast(t('import_failed')+(err.message||t('import_invalid_json')));
  }
 };
 // btnRefreshFiles is now panel-icon-btn in header (see HTML)
@@ -219,6 +219,17 @@ $('msg').addEventListener('keydown',e=>{
 });
 // B14: Cmd/Ctrl+K creates a new chat from anywhere
 document.addEventListener('keydown',async e=>{
+  // Enter on approval card = Allow once (when a button inside the card is focused or
+  // card is visible and focus is not on an input/textarea/select)
+  if(e.key==='Enter'&&!e.metaKey&&!e.ctrlKey&&!e.shiftKey){
+    const card=$('approvalCard');
+    const tag=(document.activeElement||{}).tagName||'';
+    if(card&&card.classList.contains('visible')&&tag!=='TEXTAREA'&&tag!=='INPUT'&&tag!=='SELECT'){
+      e.preventDefault();
+      if(typeof respondApproval==='function') respondApproval('once');
+      return;
+    }
+  }
  if((e.metaKey||e.ctrlKey)&&e.key==='k'){
    e.preventDefault();
    if(!S.busy){await newSession();await renderSessionList();$('msg').focus();}
@@ -251,7 +262,7 @@ $('msg').addEventListener('paste',e=>{
    return new File([blob],`screenshot-${Date.now()}.${ext}`,{type:i.type});
  });
  addFiles(files);
-  setStatus(`Image pasted: ${files.map(f=>f.name).join(', ')}`);
+  setStatus(t('image_pasted')+files.map(f=>f.name).join(', '));
 });
 document.querySelectorAll('.suggestion').forEach(btn=>{
  btn.onclick=()=>{$('msg').value=btn.dataset.msg;send();};
@@ -322,7 +333,7 @@ function applyBotName(){
 (async()=>{
  // Load send key preference
  let _bootSettings={};
-  try{const s=await api('/api/settings');_bootSettings=s;window._sendKey=s.send_key||'enter';window._showTokenUsage=!!s.show_token_usage;window._showCliSessions=!!s.show_cli_sessions;window._botName=s.bot_name||'Hermes';const _theme=s.theme||'dark';document.documentElement.dataset.theme=_theme;localStorage.setItem('hermes-theme',_theme);applyBotName();}catch(e){window._sendKey='enter';window._showTokenUsage=false;window._showCliSessions=false;window._botName='Hermes';_bootSettings={check_for_updates:false};}
+  try{const s=await api('/api/settings');_bootSettings=s;window._sendKey=s.send_key||'enter';window._showTokenUsage=!!s.show_token_usage;window._showCliSessions=!!s.show_cli_sessions;window._soundEnabled=!!s.sound_enabled;window._notificationsEnabled=!!s.notifications_enabled;window._botName=s.bot_name||'Hermes';const _theme=s.theme||'dark';document.documentElement.dataset.theme=_theme;localStorage.setItem('hermes-theme',_theme);if(s.language&&typeof setLocale==='function'){setLocale(s.language);if(typeof applyLocaleToDOM==='function')applyLocaleToDOM();}applyBotName();}catch(e){window._sendKey='enter';window._showTokenUsage=false;window._showCliSessions=false;window._soundEnabled=false;window._notificationsEnabled=false;window._botName='Hermes';_bootSettings={check_for_updates:false};}
  // Non-blocking update check (fire-and-forget, once per tab session)
  // ?test_updates=1 in URL forces banner display for testing (bypasses sessionStorage guards)
  const _testUpdates=new URLSearchParams(location.search).get('test_updates')==='1';
--- a/static/commands.js
+++ b/static/commands.js
@@ -3,15 +3,15 @@
 // (no round-trip to the agent) and shows feedback via toast or local message.

 const COMMANDS=[
-  {name:'help',      desc:'List available commands',             fn:cmdHelp},
-  {name:'clear',     desc:'Clear conversation messages',         fn:cmdClear},
-  {name:'compact',   desc:'Compress conversation context',       fn:cmdCompact},
-  {name:'model',     desc:'Switch model (e.g. /model gpt-4o)',  fn:cmdModel,     arg:'model_name'},
-  {name:'workspace', desc:'Switch workspace by name',            fn:cmdWorkspace, arg:'name'},
-  {name:'new',       desc:'Start a new chat session',            fn:cmdNew},
-  {name:'usage',     desc:'Toggle token usage display on/off',   fn:cmdUsage},
-  {name:'theme',     desc:'Switch theme (dark/light/slate/solarized/monokai/nord)', fn:cmdTheme, arg:'name'},
-  {name:'personality', desc:'Switch agent personality', fn:cmdPersonality, arg:'name'},
+  {name:'help',      desc:t('cmd_help'),             fn:cmdHelp},
+  {name:'clear',     desc:t('cmd_clear'),         fn:cmdClear},
+  {name:'compact',   desc:t('cmd_compact'),       fn:cmdCompact},
+  {name:'model',     desc:t('cmd_model'),  fn:cmdModel,     arg:'model_name'},
+  {name:'workspace', desc:t('cmd_workspace'),            fn:cmdWorkspace, arg:'name'},
+  {name:'new',       desc:t('cmd_new'),            fn:cmdNew},
+  {name:'usage',     desc:t('cmd_usage'),   fn:cmdUsage},
+  {name:'theme',     desc:t('cmd_theme'), fn:cmdTheme, arg:'name'},
+  {name:'personality', desc:t('cmd_personality'), fn:cmdPersonality, arg:'name'},
 ];

 function parseCommand(text){
@@ -43,10 +43,10 @@ function cmdHelp(){
    const usage=c.arg?` <${c.arg}>`:'';
    return `  /${c.name}${usage} — ${c.desc}`;
  });
-  const msg={role:'assistant',content:'**Available commands:**\n'+lines.join('\n')};
+  const msg={role:'assistant',content:t('available_commands')+'\n'+lines.join('\n')};
  S.messages.push(msg);
  renderMessages();
-  showToast('Type / to see commands');
+  showToast(t('type_slash'));
 }

 function cmdClear(){
@@ -55,11 +55,11 @@ function cmdClear(){
  clearLiveToolCards();
  renderMessages();
  $('emptyState').style.display='';
-  showToast('Conversation cleared');
+  showToast(t('conversation_cleared'));
 }

 async function cmdModel(args){
-  if(!args){showToast('Usage: /model <name>');return;}
+  if(!args){showToast(t('model_usage'));return;}
  const sel=$('modelSelect');
  if(!sel)return;
  const q=args.toLowerCase();
@@ -70,36 +70,36 @@ async function cmdModel(args){
      match=opt.value;break;
    }
  }
-  if(!match){showToast(`No model matching "${args}"`);return;}
+  if(!match){showToast(t('no_model_match')+`"${args}"`);return;}
  sel.value=match;
  await sel.onchange();
-  showToast(`Switched to ${match}`);
+  showToast(t('switched_to')+match);
 }

 async function cmdWorkspace(args){
-  if(!args){showToast('Usage: /workspace <name>');return;}
+  if(!args){showToast(t('workspace_usage'));return;}
  try{
    const data=await api('/api/workspaces');
    const q=args.toLowerCase();
    const ws=(data.workspaces||[]).find(w=>
      (w.name||'').toLowerCase().includes(q)||w.path.toLowerCase().includes(q)
    );
-    if(!ws){showToast(`No workspace matching "${args}"`);return;}
+    if(!ws){showToast(t('no_workspace_match')+`"${args}"`);return;}
    if(!S.session)return;
    await api('/api/session/update',{method:'POST',body:JSON.stringify({
      session_id:S.session.session_id,workspace:ws.path,model:S.session.model
    })});
    S.session.workspace=ws.path;
    syncTopbar();await loadDir('.');
-    showToast(`Switched to workspace: ${ws.name||ws.path}`);
-  }catch(e){showToast('Workspace switch failed: '+e.message);}
+    showToast(t('switched_workspace')+(ws.name||ws.path));
+  }catch(e){showToast(t('workspace_switch_failed')+e.message);}
 }

 async function cmdNew(){
  await newSession();
  await renderSessionList();
  $('msg').focus();
-  showToast('New session created');
+  showToast(t('new_session'));
 }

 function cmdCompact(){
@@ -108,7 +108,7 @@ function cmdCompact(){
  // We send a user message so it appears in the conversation.
  $('msg').value='Please compress and summarize the conversation context to free up space.';
  send();
-  showToast('Requesting context compression...');
+  showToast(t('compressing'));
 }

 async function cmdUsage(){
@@ -121,53 +121,53 @@ async function cmdUsage(){
  const cb=$('settingsShowTokenUsage');
  if(cb) cb.checked=next;
  renderMessages();
-  showToast('Token usage '+(next?'on':'off'));
+  showToast(next?t('token_usage_on'):t('token_usage_off'));
 }

 async function cmdTheme(args){
-  const themes=['dark','light','slate','solarized','monokai','nord'];
+  const themes=['dark','light','slate','solarized','monokai','nord','oled'];
  if(!args||!themes.includes(args.toLowerCase())){
-    showToast('Usage: /theme '+themes.join('|'));
+    showToast(t('theme_usage')+themes.join('|'));
    return;
  }
-  const t=args.toLowerCase();
-  document.documentElement.dataset.theme=t;
-  localStorage.setItem('hermes-theme',t);
-  try{await api('/api/settings',{method:'POST',body:JSON.stringify({theme:t})});}catch(e){}
+  const themeName=args.toLowerCase();
+  document.documentElement.dataset.theme=themeName;
+  localStorage.setItem('hermes-theme',themeName);
+  try{await api('/api/settings',{method:'POST',body:JSON.stringify({theme:themeName})});}catch(e){}
  // Update settings dropdown if panel is open
  const sel=$('settingsTheme');
-  if(sel)sel.value=t;
-  showToast('Theme: '+t);
+  if(sel)sel.value=themeName;
+  showToast(t('theme_set')+themeName);
 }

 async function cmdPersonality(args){
-  if(!S.session){showToast('No active session');return;}
+  if(!S.session){showToast(t('no_active_session'));return;}
  if(!args){
    // List available personalities
    try{
      const data=await api('/api/personalities');
      if(!data.personalities||!data.personalities.length){
-        showToast('No personalities found (add them to ~/.hermes/personalities/)');
+        showToast(t('no_personalities'));
        return;
      }
      const list=data.personalities.map(p=>`  **${p.name}**${p.description?' — '+p.description:''}`).join('\n');
-      S.messages.push({role:'assistant',content:'Available personalities:\n\n'+list+'\n\nUse `/personality <name>` to switch, or `/personality none` to clear.'});
+      S.messages.push({role:'assistant',content:t('available_personalities')+'\n\n'+list+t('personality_switch_hint')});
      renderMessages();
-    }catch(e){showToast('Failed to load personalities');}
+    }catch(e){showToast(t('personalities_load_failed'));}
    return;
  }
  const name=args.trim();
  if(name.toLowerCase()==='none'||name.toLowerCase()==='default'||name.toLowerCase()==='clear'){
    try{
      await api('/api/personality/set',{method:'POST',body:JSON.stringify({session_id:S.session.session_id,name:''})});
-      showToast('Personality cleared');
-    }catch(e){showToast('Failed: '+e.message);}
+      showToast(t('personality_cleared'));
+    }catch(e){showToast(t('failed_colon')+e.message);}
    return;
  }
  try{
    const res=await api('/api/personality/set',{method:'POST',body:JSON.stringify({session_id:S.session.session_id,name})});
-    showToast('Personality: '+name);
-  }catch(e){showToast('Failed: '+e.message);}
+    showToast(t('personality_set')+name);
+  }catch(e){showToast(t('failed_colon')+e.message);}
 }

 // ── Autocomplete dropdown ───────────────────────────────────────────────────
--- a/static/i18n.js
+++ b/static/i18n.js
@@ -0,0 +1,327 @@
+// ── i18n: locale bundles and t() helper ──────────────────────────────────────
+// To add a new language: add an entry to LOCALES below with all keys translated.
+// The language code must match a valid BCP 47 tag (used for speech recognition).
+// Keys missing in a non-English locale fall back to English automatically.
+
+const LOCALES = {
+  en: {
+    _lang: 'en',
+    _label: 'English',
+    _speech: 'en-US',
+    // boot.js
+    cancelling: 'Cancelling\u2026',
+    cancel_failed: 'Cancel failed: ',
+    mic_denied: 'Microphone access denied. Check browser permissions.',
+    mic_no_speech: 'No speech detected. Try again.',
+    mic_network: 'Speech recognition unavailable.',
+    mic_error: 'Voice input error: ',
+    session_imported: 'Session imported',
+    import_failed: 'Import failed: ',
+    import_invalid_json: 'Invalid JSON',
+    image_pasted: 'Image pasted: ',
+    // messages.js
+    edit_message: 'Edit message',
+    regenerate: 'Regenerate response',
+    copy: 'Copy',
+    copied: 'Copied!',
+    you: 'You',
+    thinking: 'Thinking',
+    expand_all: 'Expand all',
+    collapse_all: 'Collapse all',
+    edit_failed: 'Edit failed: ',
+    regen_failed: 'Regenerate failed: ',
+    reconnect_active: 'A response is still being generated. Reload when ready?',
+    reconnect_finished: 'A response was in progress when you last left. Messages may have updated.',
+    // approval card
+    approval_heading: 'Approval required',
+    approval_desc_prefix: 'Dangerous command detected',
+    approval_btn_once: 'Allow once',
+    approval_btn_once_title: 'Allow this one command (Enter)',
+    approval_btn_session: 'Allow session',
+    approval_btn_session_title: 'Allow for this conversation session',
+    approval_btn_always: 'Always allow',
+    approval_btn_always_title: 'Always allow this command pattern',
+    approval_btn_deny: 'Deny',
+    approval_btn_deny_title: 'Deny — do not run this command',
+    approval_responding: 'Responding\u2026',
+    untitled: 'Untitled',
+    n_messages: (n) => `${n} messages`,
+    model_unavailable: ' (unavailable)',
+    model_unavailable_title: 'This model is no longer in your current provider list',
+    // commands.js
+    cmd_help: 'List available commands',
+    cmd_clear: 'Clear conversation messages',
+    cmd_compact: 'Compress conversation context',
+    cmd_model: 'Switch model (e.g. /model gpt-4o)',
+    cmd_workspace: 'Switch workspace by name',
+    cmd_new: 'Start a new chat session',
+    cmd_usage: 'Toggle token usage display on/off',
+    cmd_theme: 'Switch theme (dark/light/slate/solarized/monokai/nord/oled)',
+    cmd_personality: 'Switch agent personality',
+    available_commands: 'Available commands:',
+    type_slash: 'Type / to see commands',
+    conversation_cleared: 'Conversation cleared',
+    model_usage: 'Usage: /model <name>',
+    no_model_match: 'No model matching "',
+    switched_to: 'Switched to ',
+    workspace_usage: 'Usage: /workspace <name>',
+    no_workspace_match: 'No workspace matching "',
+    switched_workspace: 'Switched to workspace: ',
+    workspace_switch_failed: 'Workspace switch failed: ',
+    new_session: 'New session created',
+    compressing: 'Requesting context compression...',
+    token_usage_on: 'Token usage on',
+    token_usage_off: 'Token usage off',
+    theme_usage: 'Usage: /theme ',
+    theme_set: 'Theme: ',
+    no_active_session: 'No active session',
+    no_personalities: 'No personalities found (add them to ~/.hermes/personalities/)',
+    available_personalities: 'Available personalities:',
+    personality_switch_hint: '\n\nUse `/personality <name>` to switch, or `/personality none` to clear.',
+    personalities_load_failed: 'Failed to load personalities',
+    personality_cleared: 'Personality cleared',
+    personality_set: 'Personality: ',
+    failed_colon: 'Failed: ',
+    // ui.js
+    no_workspace: 'No workspace',
+    // workspace.js
+    unsaved_confirm: 'You have unsaved changes in the preview. Discard and navigate?',
+    save: 'Save',
+    edit: 'Edit',
+    save_title: 'Save changes',
+    edit_title: 'Edit this file',
+    saved: 'Saved',
+    save_failed: 'Save failed: ',
+    image_load_failed: 'Could not load image',
+    file_open_failed: 'Could not open file',
+    downloading: (name) => `Downloading ${name}\u2026`,
+    double_click_rename: 'Double-click to rename',
+    renamed_to: 'Renamed to ',
+    rename_failed: 'Rename failed: ',
+    delete_title: 'Delete',
+    delete_confirm: (name) => `Delete ${name}?`,
+    deleted: 'Deleted ',
+    delete_failed: 'Delete failed: ',
+    new_file_prompt: 'New file name (e.g. notes.md):',
+    created: 'Created ',
+    create_failed: 'Create failed: ',
+    new_folder_prompt: 'New folder name:',
+    folder_created: 'Created folder ',
+    folder_create_failed: 'Create folder failed: ',
+    remove_title: 'Remove',
+    empty_dir: '(empty)',
+    upload_failed: 'Upload failed: ',
+    all_uploads_failed: (n) => `All ${n} upload(s) failed`,
+    // settings panel
+    settings_title: 'Settings',
+    settings_save_btn: 'Save Settings',
+    settings_label_model: 'Default Model',
+    settings_label_send_key: 'Send Key',
+    settings_label_theme: 'Theme',
+    settings_label_language: 'Language',
+    settings_label_token_usage: 'Show token usage',
+    settings_label_cli_sessions: 'Show CLI sessions',
+    settings_label_sync_insights: 'Sync to insights',
+    settings_label_check_updates: 'Check for updates',
+    settings_label_bot_name: 'Assistant Name',
+    settings_label_password: 'Access Password',
+    settings_saved: 'Settings saved',
+    settings_save_failed: 'Save failed: ',
+    settings_load_failed: 'Failed to load settings: ',
+    settings_saved_pw: 'Settings saved (password set \u2014 login now required)',
+    // login page (used server-side via /api/i18n/login endpoint)
+    login_title: 'Sign in',
+    login_subtitle: 'Enter your password to continue',
+    login_placeholder: 'Password',
+    login_btn: 'Sign in',
+    login_invalid_pw: 'Invalid password',
+    login_conn_failed: 'Connection failed',
+  },
+
+  zh: {
+    _lang: 'zh',
+    _label: '\u4e2d\u6587',
+    _speech: 'zh-CN',
+    // boot.js
+    cancelling: '\u6b63\u5728\u53d6\u6d88...',
+    cancel_failed: '\u53d6\u6d88\u5931\u8d25\uff1a',
+    mic_denied: '\u9ea6\u514b\u98ce\u8bbf\u95ee\u88ab\u62d2\u7edd\uff0c\u8bf7\u68c0\u67e5\u6d4f\u89c8\u5668\u6743\u9650\u3002',
+    mic_no_speech: '\u6ca1\u6709\u68c0\u6d4b\u5230\u8bed\u97f3\uff0c\u8bf7\u518d\u8bd5\u4e00\u6b21\u3002',
+    mic_network: '\u8bed\u97f3\u8bc6\u522b\u5f53\u524d\u4e0d\u53ef\u7528\u3002',
+    mic_error: '\u8bed\u97f3\u8f93\u5165\u51fa\u9519\uff1a',
+    session_imported: '\u4f1a\u8bdd\u5df2\u5bfc\u5165',
+    import_failed: '\u5bfc\u5165\u5931\u8d25\uff1a',
+    import_invalid_json: 'JSON \u65e0\u6548',
+    image_pasted: '\u5df2\u7c98\u8d34\u56fe\u7247\uff1a',
+    // messages.js
+    edit_message: '\u7f16\u8f91\u6d88\u606f',
+    regenerate: '\u91cd\u65b0\u751f\u6210\u56de\u590d',
+    copy: '\u590d\u5236',
+    copied: '\u5df2\u590d\u5236',
+    you: '\u4f60',
+    thinking: '\u601d\u8003\u8fc7\u7a0b',
+    expand_all: '\u5168\u90e8\u5c55\u5f00',
+    collapse_all: '\u5168\u90e8\u6298\u53e0',
+    edit_failed: '\u7f16\u8f91\u5931\u8d25\uff1a',
+    regen_failed: '\u91cd\u65b0\u751f\u6210\u5931\u8d25\uff1a',
+    reconnect_active: '\u56de\u590d\u4ecd\u5728\u751f\u6210\u4e2d\uff0c\u51c6\u5907\u597d\u540e\u8981\u91cd\u65b0\u52a0\u8f7d\u5417\uff1f',
+    reconnect_finished: '\u4f60\u79bb\u5f00\u65f6\u6709\u56de\u590d\u6b63\u5728\u751f\u6210\uff0c\u6d88\u606f\u5185\u5bb9\u53ef\u80fd\u5df2\u7ecf\u66f4\u65b0\u3002',
+    // approval card
+    approval_heading: '需要审批',
+    approval_desc_prefix: '检测到危险命令',
+    approval_btn_once: '允许一次',
+    approval_btn_once_title: '允许执行此命令一次（Enter）',
+    approval_btn_session: '本次允许',
+    approval_btn_session_title: '本次会话期间允许',
+    approval_btn_always: '始终允许',
+    approval_btn_always_title: '始终允许此命令模式',
+    approval_btn_deny: '拒绝',
+    approval_btn_deny_title: '拒绝 — 不执行此命令',
+    approval_responding: '处理中…',
+    untitled: '\u672a\u547d\u540d',
+    n_messages: (n) => `${n} \u6761\u6d88\u606f`,
+    model_unavailable: '\uff08\u4e0d\u53ef\u7528\uff09',
+    model_unavailable_title: '\u8fd9\u4e2a\u6a21\u578b\u5df2\u7ecf\u4e0d\u5728\u5f53\u524d provider \u5217\u8868\u4e2d',
+    // commands.js
+    cmd_help: '\u67e5\u770b\u53ef\u7528\u547d\u4ee4',
+    cmd_clear: '\u6e05\u7a7a\u5f53\u524d\u5bf9\u8bdd\u6d88\u606f',
+    cmd_compact: '\u538b\u7f29\u5bf9\u8bdd\u4e0a\u4e0b\u6587',
+    cmd_model: '\u5207\u6362\u6a21\u578b\uff08\u4f8b\u5982 /model gpt-4o\uff09',
+    cmd_workspace: '\u6309\u540d\u79f0\u5207\u6362\u5de5\u4f5c\u533a',
+    cmd_new: '\u65b0\u5efa\u804a\u5929\u4f1a\u8bdd',
+    cmd_usage: '\u5207\u6362 token \u7528\u91cf\u663e\u793a',
+    cmd_theme: '\u5207\u6362\u4e3b\u9898\uff08dark/light/slate/solarized/monokai/nord/oled\uff09',
+    cmd_personality: '\u5207\u6362 Agent \u4eba\u8bbe',
+    available_commands: '\u53ef\u7528\u547d\u4ee4\uff1a',
+    type_slash: '\u8f93\u5165 / \u53ef\u67e5\u770b\u547d\u4ee4',
+    conversation_cleared: '\u5bf9\u8bdd\u5df2\u6e05\u7a7a',
+    model_usage: '\u7528\u6cd5\uff1a/model <name>',
+    no_model_match: '\u6ca1\u6709\u5339\u914d\u201c',
+    switched_to: '\u5df2\u5207\u6362\u5230 ',
+    workspace_usage: '\u7528\u6cd5\uff1a/workspace <name>',
+    no_workspace_match: '\u6ca1\u6709\u5339\u914d\u201c',
+    switched_workspace: '\u5df2\u5207\u6362\u5de5\u4f5c\u533a\uff1a',
+    workspace_switch_failed: '\u5de5\u4f5c\u533a\u5207\u6362\u5931\u8d25\uff1a',
+    new_session: '\u5df2\u65b0\u5efa\u4f1a\u8bdd',
+    compressing: '\u6b63\u5728\u8bf7\u6c42\u538b\u7f29\u4e0a\u4e0b\u6587...',
+    token_usage_on: 'Token \u7528\u91cf\u663e\u793a\u5df2\u5f00\u542f',
+    token_usage_off: 'Token \u7528\u91cf\u663e\u793a\u5df2\u5173\u95ed',
+    theme_usage: '\u7528\u6cd5\uff1a/theme ',
+    theme_set: '\u4e3b\u9898\uff1a',
+    no_active_session: '\u5f53\u524d\u6ca1\u6709\u6d3b\u52a8\u4f1a\u8bdd',
+    no_personalities: '\u6ca1\u6709\u627e\u5230\u4eba\u8bbe\uff08\u53ef\u6dfb\u52a0\u5230 ~/.hermes/personalities/\uff09',
+    available_personalities: '\u53ef\u7528\u4eba\u8bbe\uff1a',
+    personality_switch_hint: '\n\n\u4f7f\u7528 `/personality <name>` \u5207\u6362\uff0c\u6216\u7528 `/personality none` \u6e05\u7a7a\u3002',
+    personalities_load_failed: '\u52a0\u8f7d\u4eba\u8bbe\u5931\u8d25',
+    personality_cleared: '\u4eba\u8bbe\u5df2\u6e05\u7a7a',
+    personality_set: '\u5f53\u524d\u4eba\u8bbe\uff1a',
+    failed_colon: '\u5931\u8d25\uff1a',
+    // ui.js
+    no_workspace: '\u672a\u9009\u62e9\u5de5\u4f5c\u533a',
+    // workspace.js
+    unsaved_confirm: '\u9884\u89c8\u533a\u6709\u672a\u4fdd\u5b58\u4fee\u6539\uff0c\u8981\u653e\u5f03\u66f4\u6539\u5e76\u7ee7\u7eed\u8df3\u8f6c\u5417\uff1f',
+    save: '\u4fdd\u5b58',
+    edit: '\u7f16\u8f91',
+    save_title: '\u4fdd\u5b58\u4fee\u6539',
+    edit_title: '\u7f16\u8f91\u6b64\u6587\u4ef6',
+    saved: '\u5df2\u4fdd\u5b58',
+    save_failed: '\u4fdd\u5b58\u5931\u8d25\uff1a',
+    image_load_failed: '\u56fe\u7247\u52a0\u8f7d\u5931\u8d25',
+    file_open_failed: '\u65e0\u6cd5\u6253\u5f00\u6587\u4ef6',
+    downloading: (name) => `\u6b63\u5728\u4e0b\u8f7d ${name}...`,
+    double_click_rename: '\u53cc\u51fb\u91cd\u547d\u540d',
+    renamed_to: '\u5df2\u91cd\u547d\u540d\u4e3a ',
+    rename_failed: '\u91cd\u547d\u540d\u5931\u8d25\uff1a',
+    delete_title: '\u5220\u9664',
+    delete_confirm: (name) => `\u8981\u5220\u9664 ${name} \u5417\uff1f`,
+    deleted: '\u5df2\u5220\u9664 ',
+    delete_failed: '\u5220\u9664\u5931\u8d25\uff1a',
+    new_file_prompt: '\u65b0\u6587\u4ef6\u540d\uff08\u4f8b\u5982 notes.md\uff09\uff1a',
+    created: '\u5df2\u521b\u5efa ',
+    create_failed: '\u521b\u5efa\u5931\u8d25\uff1a',
+    new_folder_prompt: '\u65b0\u6587\u4ef6\u5939\u540d\u79f0\uff1a',
+    folder_created: '\u5df2\u521b\u5efa\u6587\u4ef6\u5939 ',
+    folder_create_failed: '\u521b\u5efa\u6587\u4ef6\u5939\u5931\u8d25\uff1a',
+    remove_title: '\u79fb\u9664',
+    empty_dir: '(\u7a7a)',
+    upload_failed: '\u4e0a\u4f20\u5931\u8d25\uff1a',
+    all_uploads_failed: (n) => `${n} \u4e2a\u6587\u4ef6\u5168\u90e8\u4e0a\u4f20\u5931\u8d25`,
+    // settings panel
+    settings_title: '\u8bbe\u7f6e',
+    settings_save_btn: '\u4fdd\u5b58\u8bbe\u7f6e',
+    settings_label_model: '\u9ed8\u8ba4\u6a21\u578b',
+    settings_label_send_key: '\u53d1\u9001\u5feb\u6377\u952e',
+    settings_label_theme: '\u4e3b\u9898',
+    settings_label_language: '\u8bed\u8a00',
+    settings_label_token_usage: '\u663e\u793a token \u7528\u91cf',
+    settings_label_cli_sessions: '\u663e\u793a CLI \u4f1a\u8bdd',
+    settings_label_sync_insights: '\u540c\u6b65\u5230 insights',
+    settings_label_check_updates: '\u68c0\u67e5\u66f4\u65b0',
+    settings_label_bot_name: '\u52a9\u624b\u540d\u79f0',
+    settings_label_password: '\u8bbf\u95ee\u5bc6\u7801',
+    settings_saved: '\u8bbe\u7f6e\u5df2\u4fdd\u5b58',
+    settings_save_failed: '\u4fdd\u5b58\u5931\u8d25\uff1a',
+    settings_load_failed: '\u8bbe\u7f6e\u52a0\u8f7d\u5931\u8d25\uff1a',
+    settings_saved_pw: '\u8bbe\u7f6e\u5df2\u4fdd\u5b58\uff08\u5bc6\u7801\u5df2\u8bbe\u7f6e\u2014\u73b0\u5728\u9700\u8981\u767b\u5f55\uff09',
+    // login page
+    login_title: '\u767b\u5f55',
+    login_subtitle: '\u8f93\u5165\u5bc6\u7801\u7ee7\u7eed\u4f7f\u7528',
+    login_placeholder: '\u5bc6\u7801',
+    login_btn: '\u767b\u5f55',
+    login_invalid_pw: '\u5bc6\u7801\u9519\u8bef',
+    login_conn_failed: '\u8fde\u63a5\u5931\u8d25',
+  },
+};
+
+// Active locale — defaults to English; overridden by loadLocale() at boot.
+let _locale = LOCALES.en;
+
+/**
+ * Translate a key. Falls back to English if the key is missing in the active locale.
+ * Supports function values (for interpolated strings): call t('key', arg).
+ * @param {string} key
+ * @param {...*} args - forwarded to function-valued translations
+ * @returns {string}
+ */
+function t(key, ...args) {
+  const val = _locale[key] ?? LOCALES.en[key];
+  if (val === undefined) return key;  // final fallback: return key itself
+  return typeof val === 'function' ? val(...args) : val;
+}
+
+/**
+ * Switch locale by language code (e.g. 'en', 'zh').
+ * Persists to localStorage and updates the <html lang> attribute.
+ * @param {string} lang
+ */
+function setLocale(lang) {
+  const resolved = LOCALES[lang] ? lang : 'en';
+  _locale = LOCALES[resolved];
+  localStorage.setItem('hermes-lang', resolved);
+  document.documentElement.lang = _locale._speech || resolved;
+}
+
+/**
+ * Load locale from localStorage (called once at boot, before DOMContentLoaded).
+ * Server-persisted preference is applied later in loadSettingsPanel().
+ */
+function loadLocale() {
+  const saved = localStorage.getItem('hermes-lang');
+  setLocale(saved && LOCALES[saved] ? saved : 'en');
+}
+
+/**
+ * Re-stamp all [data-i18n] elements in the DOM with the current locale.
+ * Safe to call at any time — missing keys fall back to English.
+ * Call after setLocale() to make static HTML text update without a reload.
+ */
+function applyLocaleToDOM() {
+  document.querySelectorAll('[data-i18n]').forEach(el => {
+    const key = el.getAttribute('data-i18n');
+    const val = t(key);
+    if (val && val !== key) el.textContent = val;
+  });
+}
+
+// Apply saved locale immediately so there's no flash of English on reload.
+loadLocale();
--- a/static/index.html
+++ b/static/index.html
@@ -14,7 +14,7 @@
 <body>
 <div class="layout">
  <aside class="sidebar">
-    <div class="sidebar-header"><div class="logo">H</div><div><h1 style="margin:0;font-size:15px;font-weight:700;letter-spacing:-.01em">Hermes</h1><div style="font-size:10px;color:var(--muted);opacity:.8;margin-top:1px">v0.38.2</div></div></div>
+    <div class="sidebar-header"><div class="logo">H</div><div><h1 style="margin:0;font-size:15px;font-weight:700;letter-spacing:-.01em">Hermes</h1><div style="font-size:10px;color:var(--muted);opacity:.8;margin-top:1px">v0.41.0</div></div></div>
    <div class="sidebar-nav">
      <button class="nav-tab active" data-panel="chat" data-label="Chat" onclick="switchPanel('chat')" title="Chat">&#128172;</button>
      <button class="nav-tab" data-panel="tasks" data-label="Tasks" onclick="switchPanel('tasks')" title="Tasks">&#128197;</button>
@@ -217,19 +217,32 @@
        <button class="reconnect-btn" onclick="refreshSession()">&#8635; Reload</button>
      </div>
    </div>
-    <div class="approval-card" id="approvalCard">
+    <div class="approval-card" id="approvalCard" role="alertdialog" aria-labelledby="approvalHeading" aria-describedby="approvalDesc">
      <div class="approval-inner">
        <div class="approval-header">
          <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M10.29 3.86L1.82 18a2 2 0 0 0 1.71 3h16.94a2 2 0 0 0 1.71-3L13.71 3.86a2 2 0 0 0-3.42 0z"/><line x1="12" y1="9" x2="12" y2="13"/><line x1="12" y1="17" x2="12.01" y2="17"/></svg>
-          Dangerous command — approval required
+          <span id="approvalHeading" data-i18n="approval_heading">Approval required</span>
        </div>
        <div class="approval-desc" id="approvalDesc"></div>
        <div class="approval-cmd" id="approvalCmd"></div>
        <div class="approval-btns">
-          <button class="approval-btn once" onclick="respondApproval('once')">&#10003; Allow once</button>
-          <button class="approval-btn session" onclick="respondApproval('session')">&#128274; Allow this session</button>
-          <button class="approval-btn always" onclick="respondApproval('always')">&#9734; Always allow</button>
-          <button class="approval-btn deny" onclick="respondApproval('deny')">&#10005; Deny</button>
+          <button class="approval-btn once" id="approvalBtnOnce" onclick="respondApproval('once')" title="Allow this one command (Enter)" data-i18n-title="approval_btn_once_title">
+            <span class="approval-btn-icon">&#10003;</span>
+            <span class="approval-btn-label" data-i18n="approval_btn_once">Allow once</span>
+            <kbd class="approval-kbd">↵</kbd>
+          </button>
+          <button class="approval-btn session" id="approvalBtnSession" onclick="respondApproval('session')" title="Allow for this session">
+            <span class="approval-btn-icon">&#128274;</span>
+            <span class="approval-btn-label" data-i18n="approval_btn_session">Allow session</span>
+          </button>
+          <button class="approval-btn always" id="approvalBtnAlways" onclick="respondApproval('always')" title="Always allow this command pattern">
+            <span class="approval-btn-icon">&#9734;</span>
+            <span class="approval-btn-label" data-i18n="approval_btn_always">Always allow</span>
+          </button>
+          <button class="approval-btn deny" id="approvalBtnDeny" onclick="respondApproval('deny')" title="Deny — do not run this command">
+            <span class="approval-btn-icon">&#10005;</span>
+            <span class="approval-btn-label" data-i18n="approval_btn_deny">Deny</span>
+          </button>
        </div>
      </div>
    </div>
@@ -318,23 +331,23 @@
 <div class="settings-overlay" id="settingsOverlay" style="display:none">
  <div class="settings-panel">
    <div class="settings-header">
-      <h3 style="margin:0;font-size:16px">Settings</h3>
+      <h3 style="margin:0;font-size:16px" data-i18n="settings_title">Settings</h3>
      <button class="panel-icon-btn" onclick="_closeSettingsPanel()" title="Close">&#10005;</button>
    </div>
    <div class="settings-body">
      <div class="settings-field">
-        <label for="settingsModel">Default Model</label>
+        <label for="settingsModel" data-i18n="settings_label_model">Default Model</label>
        <select id="settingsModel" style="width:100%;padding:8px;background:var(--code-bg);color:var(--text);border:1px solid var(--border2);border-radius:6px"></select>
      </div>
      <div class="settings-field">
-        <label for="settingsSendKey">Send Key</label>
+        <label for="settingsSendKey" data-i18n="settings_label_send_key">Send Key</label>
        <select id="settingsSendKey" style="width:100%;padding:8px;background:var(--code-bg);color:var(--text);border:1px solid var(--border2);border-radius:6px">
          <option value="enter">Enter (Shift+Enter for newline)</option>
          <option value="ctrl+enter">Ctrl+Enter (Enter for newline)</option>
        </select>
      </div>
      <div class="settings-field">
-        <label for="settingsTheme">Theme</label>
+        <label for="settingsTheme" data-i18n="settings_label_theme">Theme</label>
        <select id="settingsTheme" style="width:100%;padding:8px;background:var(--code-bg);color:var(--text);border:1px solid var(--border2);border-radius:6px" onchange="document.documentElement.dataset.theme=this.value;localStorage.setItem('hermes-theme',this.value)">
          <option value="dark">Dark (default)</option>
          <option value="light">Light</option>
@@ -342,47 +355,66 @@
          <option value="solarized">Solarized Dark</option>
          <option value="monokai">Monokai</option>
          <option value="nord">Nord</option>
+          <option value="oled">OLED</option>
        </select>
      </div>
+      <div class="settings-field">
+        <label for="settingsLanguage" data-i18n="settings_label_language">Language</label>
+        <select id="settingsLanguage" style="width:100%;padding:8px;background:var(--code-bg);color:var(--text);border:1px solid var(--border2);border-radius:6px"></select>
+      </div>
+      <div class="settings-field">
+        <label style="display:flex;align-items:center;gap:8px;cursor:pointer">
+          <input type="checkbox" id="settingsSoundEnabled" style="width:15px;height:15px;accent-color:var(--accent)">
+          Notification sound
+        </label>
+        <div style="font-size:11px;color:var(--muted);margin-top:4px">Play a sound when the assistant finishes a response.</div>
+      </div>
+      <div class="settings-field">
+        <label style="display:flex;align-items:center;gap:8px;cursor:pointer">
+          <input type="checkbox" id="settingsNotificationsEnabled" style="width:15px;height:15px;accent-color:var(--accent)">
+          Browser notifications
+        </label>
+        <div style="font-size:11px;color:var(--muted);margin-top:4px">Show a system notification when a response completes while the tab is in the background.</div>
+      </div>
      <div class="settings-field">
        <label style="display:flex;align-items:center;gap:8px;cursor:pointer">
          <input type="checkbox" id="settingsShowTokenUsage" style="width:15px;height:15px;accent-color:var(--accent)">
-          Show token usage after responses
+          <span data-i18n="settings_label_token_usage">Show token usage after responses</span>
        </label>
        <div style="font-size:11px;color:var(--muted);margin-top:4px">Displays input/output token count below each assistant reply. Also toggled with <code>/usage</code>.</div>
      </div>
      <div class="settings-field">
        <label style="display:flex;align-items:center;gap:8px;cursor:pointer">
          <input type="checkbox" id="settingsShowCliSessions" style="width:15px;height:15px;accent-color:var(--accent)">
-          Show CLI sessions in sidebar
+          <span data-i18n="settings_label_cli_sessions">Show CLI sessions in sidebar</span>
        </label>
        <div style="font-size:11px;color:var(--muted);margin-top:4px">Merges sessions from the Hermes CLI (state.db) into the session list. Click a CLI session to import it and continue the conversation.</div>
      </div>
      <div class="settings-field">
        <label style="display:flex;align-items:center;gap:8px;cursor:pointer">
          <input type="checkbox" id="settingsSyncInsights" style="width:15px;height:15px;accent-color:var(--accent)">
-          Sync usage to /insights
+          <span data-i18n="settings_label_sync_insights">Sync usage to /insights</span>
        </label>
        <div style="font-size:11px;color:var(--muted);margin-top:4px">Mirrors WebUI token usage to state.db so <code>hermes /insights</code> includes browser session data. Off by default.</div>
      </div>
      <div class="settings-field">
        <label style="display:flex;align-items:center;gap:8px;cursor:pointer">
          <input type="checkbox" id="settingsCheckUpdates" style="width:15px;height:15px;accent-color:var(--accent)">
-          Check for updates
+          <span data-i18n="settings_label_check_updates">Check for updates</span>
        </label>
        <div style="font-size:11px;color:var(--muted);margin-top:4px">Show a banner when newer versions of the WebUI or Agent are available. Runs a background git fetch periodically.</div>
      </div>
      <div class="settings-field">
-        <label for="settingsBotName">Assistant Name</label>
+        <label for="settingsBotName" data-i18n="settings_label_bot_name">Assistant Name</label>
        <div style="font-size:11px;color:var(--muted);margin-bottom:6px">Display name for the assistant throughout the UI. Defaults to Hermes.</div>
        <input type="text" id="settingsBotName" placeholder="Hermes" maxlength="64" style="width:100%;padding:8px;background:var(--code-bg);color:var(--text);border:1px solid var(--border2);border-radius:6px;font-size:13px">
      </div>
      <div class="settings-field" style="border-top:1px solid var(--border);padding-top:12px;margin-top:8px">
-        <label for="settingsPassword">Access Password</label>
+        <label for="settingsPassword" data-i18n="settings_label_password">Access Password</label>
        <div style="font-size:11px;color:var(--muted);margin-bottom:6px">Enter a new password to set or change it. Leave blank to keep current setting.</div>
        <input type="password" id="settingsPassword" placeholder="Enter new password…" style="width:100%;padding:8px;background:var(--code-bg);color:var(--text);border:1px solid var(--border2);border-radius:6px;font-size:13px">
      </div>
-      <button class="sm-btn" onclick="saveSettings()" style="margin-top:12px;width:100%;padding:8px;font-weight:600">Save Settings</button>
+      <button class="sm-btn" onclick="saveSettings()" style="margin-top:12px;width:100%;padding:8px;font-weight:600" data-i18n="settings_save_btn">Save Settings</button>
      <button class="sm-btn" id="btnDisableAuth" onclick="disableAuth()" style="margin-top:6px;width:100%;padding:8px;font-weight:600;color:#e8a030;border-color:rgba(232,160,48,.3);display:none">Disable Auth</button>
      <button class="sm-btn" id="btnSignOut" onclick="signOut()" style="margin-top:6px;width:100%;padding:8px;font-weight:600;color:var(--accent);border-color:rgba(233,69,96,.3);display:none">Sign Out</button>
    </div>
@@ -412,6 +444,7 @@
  </button>
 </nav>
 <div class="toast" id="toast"></div>
+<script src="/static/i18n.js"></script>
 <script src="/static/ui.js"></script>
 <script src="/static/workspace.js"></script>
 <script src="/static/sessions.js"></script>
--- a/static/messages.js
+++ b/static/messages.js
@@ -84,6 +84,11 @@ async function send(){
  let assistantText='';
  let assistantRow=null;
  let assistantBody=null;
+  // Thinking tag patterns for streaming display
+  const _thinkPairs=[
+    {open:'<think>',close:'</think>'},
+    {open:'<|channel>thought\n',close:'<channel|>'}
+  ];

  function ensureAssistantRow(){
    if(assistantRow)return;
@@ -106,12 +111,36 @@ async function send(){

  // rAF-throttled rendering: buffer tokens, render at most once per frame
  let _renderPending=false;
+  // Extract display text from assistantText, stripping completed thinking blocks
+  // and hiding content still inside an open thinking block.
+  function _streamDisplay(){
+    const raw=assistantText;
+    for(const {open,close} of _thinkPairs){
+      if(raw.startsWith(open)){
+        const ci=raw.indexOf(close,open.length);
+        if(ci!==-1){
+          // Thinking block complete — strip it, show the rest
+          return raw.slice(ci+close.length).replace(/^\s+/,'');
+        }
+        // Still inside thinking block — show placeholder
+        return '';
+      }
+      // Hide partial tag prefixes while streaming so users don't see
+      // `<thi`, `<think`, etc. before the model finishes the token.
+      if(open.startsWith(raw)) return '';
+    }
+    return raw;
+  }
  function _scheduleRender(){
    if(_renderPending) return;
    _renderPending=true;
    requestAnimationFrame(()=>{
      _renderPending=false;
-      if(assistantBody) assistantBody.innerHTML=renderMd(assistantText);
+      if(assistantBody){
+        const txt=_streamDisplay();
+        const isThinking=!txt&&assistantText.length>0;
+        assistantBody.innerHTML=txt?renderMd(txt):(isThinking?'<span style="color:var(--muted);font-size:13px">Thinking\u2026</span>':'');
+      }
      scrollIfPinned();
    });
  }
@@ -143,6 +172,8 @@ async function send(){
      const d=JSON.parse(e.data);
      d._session_id=activeSid;
      showApprovalCard(d);
+      playNotificationSound();
+      sendBrowserNotification('Approval required',d.description||'Tool approval needed');
    });

    source.addEventListener('done',e=>{
@@ -176,6 +207,8 @@ async function send(){
        syncTopbar();renderMessages();loadDir('.');
      }
      renderSessionList();setBusy(false);setStatus('');
+      playNotificationSound();
+      sendBrowserNotification('Response complete',assistantText?assistantText.slice(0,100):'Task finished');
    });

    source.addEventListener('compressed',e=>{
@@ -322,25 +355,40 @@ function hideApprovalCard() {
 let _approvalSessionId = null;

 function showApprovalCard(pending) {
-  $("approvalDesc").textContent = pending.description || "";
-  $("approvalCmd").textContent = pending.command || "";
  const keys = pending.pattern_keys || (pending.pattern_key ? [pending.pattern_key] : []);
-  $("approvalDesc").textContent = (pending.description || "") + (keys.length ? " [" + keys.join(", ") + "]" : "");
+  const desc = (pending.description || "") + (keys.length ? " [" + keys.join(", ") + "]" : "");
+  $("approvalDesc").textContent = desc;
+  $("approvalCmd").textContent = pending.command || "";
  _approvalSessionId = pending._session_id || (S.session && S.session.session_id) || null;
-  $("approvalCard").classList.add("visible");
+  // Re-enable buttons in case a previous approval disabled them
+  ["approvalBtnOnce","approvalBtnSession","approvalBtnAlways","approvalBtnDeny"].forEach(id => {
+    const b = $(id); if (b) { b.disabled = false; b.classList.remove("loading"); }
+  });
+  const card = $("approvalCard");
+  card.classList.add("visible");
+  // Apply current locale to data-i18n elements inside the card
+  if (typeof applyLocaleToDOM === "function") applyLocaleToDOM();
+  // Focus Allow once button so Enter works immediately
+  const onceBtn = $("approvalBtnOnce");
+  if (onceBtn) setTimeout(() => onceBtn.focus(), 50);
 }

 async function respondApproval(choice) {
  const sid = _approvalSessionId || (S.session && S.session.session_id);
  if (!sid) return;
-  hideApprovalCard();
+  // Disable all buttons immediately to prevent double-submit
+  ["approvalBtnOnce","approvalBtnSession","approvalBtnAlways","approvalBtnDeny"].forEach(id => {
+    const b = $(id);
+    if (b) { b.disabled = true; if (b.id === "approvalBtn" + choice.charAt(0).toUpperCase() + choice.slice(1)) b.classList.add("loading"); }
+  });
  _approvalSessionId = null;
+  hideApprovalCard();
  try {
    await api("/api/approval/respond", {
      method: "POST",
      body: JSON.stringify({ session_id: sid, choice })
    });
-  } catch(e) { setStatus("Approval error: " + e.message); }
+  } catch(e) { setStatus(t("approval_responding") + " " + e.message); }
 }

 function startApprovalPolling(sid) {
@@ -360,5 +408,37 @@ function startApprovalPolling(sid) {
 function stopApprovalPolling() {
  if (_approvalPollTimer) { clearInterval(_approvalPollTimer); _approvalPollTimer = null; }
 }
+
+// ── Notifications and Sound ──────────────────────────────────────────────────
+
+function playNotificationSound(){
+  if(!window._soundEnabled) return;
+  try{
+    const ctx=new (window.AudioContext||window.webkitAudioContext)();
+    const osc=ctx.createOscillator();
+    const gain=ctx.createGain();
+    osc.connect(gain);gain.connect(ctx.destination);
+    osc.type='sine';osc.frequency.setValueAtTime(660,ctx.currentTime);
+    osc.frequency.setValueAtTime(880,ctx.currentTime+0.1);
+    gain.gain.setValueAtTime(0.3,ctx.currentTime);
+    gain.gain.exponentialRampToValueAtTime(0.01,ctx.currentTime+0.3);
+    osc.start(ctx.currentTime);osc.stop(ctx.currentTime+0.3);
+    osc.onended=()=>ctx.close();
+  }catch(e){console.warn('Notification sound failed:',e);}
+}
+
+function sendBrowserNotification(title,body){
+  if(!window._notificationsEnabled||!document.hidden) return;
+  if(!('Notification' in window)) return;
+  const botName=window._botName||'Hermes';
+  if(Notification.permission==='granted'){
+    new Notification(title||botName,{body:body});
+  }else if(Notification.permission!=='denied'){
+    Notification.requestPermission().then(p=>{
+      if(p==='granted') new Notification(title||botName,{body:body});
+    });
+  }
+}
+
 // ── Panel navigation (Chat / Tasks / Skills / Memory) ──

--- a/static/panels.js
+++ b/static/panels.js
@@ -975,6 +975,8 @@ function _markSettingsDirty(){
 async function loadSettingsPanel(){
  try{
    const settings=await api('/api/settings');
+    // Apply server-persisted locale immediately (overrides localStorage boot default)
+    if(settings.language && typeof setLocale==='function') setLocale(settings.language);
    // Populate model dropdown from /api/models
    const modelSel=$('settingsModel');
    if(modelSel){
@@ -1001,6 +1003,20 @@ async function loadSettingsPanel(){
    // Theme preference
    const themeSel=$('settingsTheme');
    if(themeSel){themeSel.value=settings.theme||'dark';themeSel.addEventListener('change',_markSettingsDirty,{once:false});}
+    // Language preference — populate from LOCALES bundle
+    const langSel=$('settingsLanguage');
+    if(langSel){
+      langSel.innerHTML='';
+      if(typeof LOCALES!=='undefined'){
+        for(const [code,bundle] of Object.entries(LOCALES)){
+          const opt=document.createElement('option');
+          opt.value=code;opt.textContent=bundle._label||code;
+          langSel.appendChild(opt);
+        }
+      }
+      langSel.value=settings.language||'en';
+      langSel.addEventListener('change',_markSettingsDirty,{once:false});
+    }
    const showUsageCb=$('settingsShowTokenUsage');
    if(showUsageCb){showUsageCb.checked=!!settings.show_token_usage;showUsageCb.addEventListener('change',_markSettingsDirty,{once:false});}
    const showCliCb=$('settingsShowCliSessions');
@@ -1009,6 +1025,10 @@ async function loadSettingsPanel(){
    if(syncCb){syncCb.checked=!!settings.sync_to_insights;syncCb.addEventListener('change',_markSettingsDirty,{once:false});}
    const updateCb=$('settingsCheckUpdates');
    if(updateCb){updateCb.checked=settings.check_for_updates!==false;updateCb.addEventListener('change',_markSettingsDirty,{once:false});}
+    const soundCb=$('settingsSoundEnabled');
+    if(soundCb){soundCb.checked=!!settings.sound_enabled;soundCb.addEventListener('change',_markSettingsDirty,{once:false});}
+    const notifCb=$('settingsNotificationsEnabled');
+    if(notifCb){notifCb.checked=!!settings.notifications_enabled;notifCb.addEventListener('change',_markSettingsDirty,{once:false});}
    // Bot name
    const botNameField=$('settingsBotName');
    if(botNameField){botNameField.value=settings.bot_name||'Hermes';botNameField.addEventListener('input',_markSettingsDirty,{once:false});}
@@ -1025,7 +1045,7 @@ async function loadSettingsPanel(){
      if(disableBtn) disableBtn.style.display=active?'':'none';
    }catch(e){}
  }catch(e){
-    showToast('Failed to load settings: '+e.message);
+    showToast(t('settings_load_failed')+e.message);
  }
 }

@@ -1036,15 +1056,19 @@ async function saveSettings(andClose){
  const showCliSessions=!!($('settingsShowCliSessions')||{}).checked;
  const pw=($('settingsPassword')||{}).value;
  const theme=($('settingsTheme')||{}).value||'dark';
+  const language=($('settingsLanguage')||{}).value||'en';
  const body={};
  if(model) body.default_model=model;

  if(sendKey) body.send_key=sendKey;
  body.theme=theme;
+  body.language=language;
  body.show_token_usage=showTokenUsage;
  body.show_cli_sessions=showCliSessions;
  body.sync_to_insights=!!($('settingsSyncInsights')||{}).checked;
  body.check_for_updates=!!($('settingsCheckUpdates')||{}).checked;
+  body.sound_enabled=!!($('settingsSoundEnabled')||{}).checked;
+  body.notifications_enabled=!!($('settingsNotificationsEnabled')||{}).checked;
  const botName=(($('settingsBotName')||{}).value||'').trim();
  body.bot_name=botName||'Hermes';
  // Password: only act if the field has content; blank = leave auth unchanged
@@ -1053,7 +1077,11 @@ async function saveSettings(andClose){
      await api('/api/settings',{method:'POST',body:JSON.stringify({...body,_set_password:pw.trim()})});
      window._sendKey=sendKey||'enter';
      window._showTokenUsage=showTokenUsage;
-      showToast('Settings saved (password set — login now required)');
+      window._soundEnabled=body.sound_enabled;
+      window._notificationsEnabled=body.notifications_enabled;
+      if(typeof setLocale==='function') setLocale(language);
+      if(typeof applyLocaleToDOM==='function') applyLocaleToDOM();
+      showToast(t('settings_saved_pw'));
      _settingsDirty=false; _settingsThemeOnOpen=theme;
      const bar=$('settingsUnsavedBar'); if(bar) bar.style.display='none';
      $('settingsOverlay').style.display='none';
@@ -1065,16 +1093,21 @@ async function saveSettings(andClose){
    window._sendKey=sendKey||'enter';
    window._showTokenUsage=showTokenUsage;
    window._showCliSessions=showCliSessions;
+    window._soundEnabled=body.sound_enabled;
+    window._notificationsEnabled=body.notifications_enabled;
    window._botName=body.bot_name;
    if(typeof applyBotName==='function') applyBotName();
+    if(typeof setLocale==='function') setLocale(language);
+    if(typeof applyLocaleToDOM==='function') applyLocaleToDOM();
    _settingsDirty=false; _settingsThemeOnOpen=theme;
    const bar=$('settingsUnsavedBar'); if(bar) bar.style.display='none';
    renderMessages();
+    if(typeof syncTopbar==='function') syncTopbar();
    if(typeof renderSessionList==='function') renderSessionList();
-    showToast('Settings saved');
+    showToast(t('settings_saved'));
    $('settingsOverlay').style.display='none';
  }catch(e){
-    showToast('Save failed: '+e.message);
+    showToast(t('settings_save_failed')+e.message);
  }
 }

--- a/static/style.css
+++ b/static/style.css
@@ -100,6 +100,15 @@
    --focus-ring:rgba(129,161,193,.35);--focus-glow:rgba(129,161,193,.08);
    --strong:#eceff4;--em:#b8c0cc;--code-text:#a3be8c;--code-inline-bg:rgba(0,0,0,.2);--pre-text:#d8dee9;
  }
+  /* ── OLED theme ── */
+  :root[data-theme="oled"]{
+    --bg:#000000;--sidebar:#000000;--border:rgba(255,255,255,0.06);--border2:rgba(255,255,255,0.12);
+    --text:#e0e0e0;--muted:#777777;--accent:#ff3b5c;--blue:#6cb4ff;--gold:#d4a74a;--code-bg:#080808;
+    --surface:#0a0a0a;--topbar-bg:rgba(0,0,0,.98);--main-bg:rgba(0,0,0,0.5);
+    --focus-ring:rgba(108,180,255,.3);--focus-glow:rgba(108,180,255,.06);
+    --strong:#ffffff;--em:#c0c0d0;--code-text:#e8b86d;--code-inline-bg:rgba(255,255,255,.06);--pre-text:#d0d0d8;
+    --input-bg:rgba(255,255,255,.03);--hover-bg:rgba(255,255,255,.05);
+  }
  body{background:var(--bg);color:var(--text);height:100vh;height:100dvh;overflow:hidden;display:flex;}
  .layout{display:flex;width:100%;height:100vh;height:100dvh;}
  .sidebar{width:300px;background:var(--sidebar);border-right:1px solid var(--border);display:flex;flex-direction:column;overflow:visible;flex-shrink:0;}
@@ -155,19 +164,27 @@
  /* ── Approval card ── */
  .approval-card{display:none;max-width:780px;margin:0 auto 0;padding:0 20px 12px;}
  .approval-card.visible{display:block;}
-  .approval-inner{background:var(--surface);backdrop-filter:blur(8px);border:1px solid rgba(233,69,96,0.35);border-radius:14px;padding:14px 16px;}
+  .approval-inner{background:var(--surface);backdrop-filter:blur(8px);border:1px solid rgba(233,69,96,0.35);border-radius:14px;padding:16px 18px;}
  .approval-header{display:flex;align-items:center;gap:8px;margin-bottom:10px;font-size:13px;font-weight:600;color:#e94560;}
-  .approval-desc{font-size:12px;color:var(--muted);margin-bottom:8px;}
-  .approval-cmd{background:var(--code-bg);border:1px solid var(--border);border-radius:8px;padding:8px 12px;font-family:"SF Mono",ui-monospace,monospace;font-size:12px;color:var(--pre-text);white-space:pre-wrap;word-break:break-all;margin-bottom:12px;max-height:120px;overflow-y:auto;}
-  .approval-btns{display:flex;gap:8px;flex-wrap:wrap;}
-  .approval-btn{padding:6px 14px;border-radius:8px;font-size:12px;font-weight:600;border:1px solid var(--border2);background:var(--hover-bg);color:var(--text);cursor:pointer;transition:all .15s;}
-  .approval-btn:hover{background:rgba(255,255,255,0.12);}
-  .approval-btn.once{border-color:rgba(124,185,255,0.5);color:var(--blue);}
-  .approval-btn.once:hover{background:rgba(124,185,255,0.15);}
-  .approval-btn.session{border-color:rgba(124,185,255,0.3);color:var(--blue);}
+  .approval-desc{font-size:12px;color:var(--muted);margin-bottom:8px;line-height:1.5;}
+  .approval-cmd{background:var(--code-bg);border:1px solid var(--border);border-radius:8px;padding:8px 12px;font-family:"SF Mono",ui-monospace,monospace;font-size:12px;color:var(--pre-text);white-space:pre-wrap;word-break:break-all;margin-bottom:14px;max-height:120px;overflow-y:auto;}
+  .approval-btns{display:flex;gap:8px;flex-wrap:wrap;align-items:center;}
+  .approval-btn{display:inline-flex;align-items:center;gap:6px;padding:7px 15px;border-radius:8px;font-size:12px;font-weight:600;border:1px solid var(--border2);background:var(--hover-bg);color:var(--text);cursor:pointer;transition:all .15s;white-space:nowrap;}
+  .approval-btn:hover{background:rgba(255,255,255,0.12);transform:translateY(-1px);box-shadow:0 2px 8px rgba(0,0,0,0.2);}
+  .approval-btn:active{transform:translateY(0);box-shadow:none;}
+  .approval-btn:disabled{opacity:.5;cursor:not-allowed;transform:none;}
+  .approval-btn-icon{font-size:13px;line-height:1;}
+  .approval-btn-label{line-height:1;}
+  .approval-kbd{display:inline-flex;align-items:center;justify-content:center;padding:1px 5px;border-radius:4px;font-size:10px;font-family:inherit;background:rgba(255,255,255,.08);border:1px solid rgba(255,255,255,.15);color:var(--muted);line-height:1.4;margin-left:2px;}
+  .approval-btn.once{border-color:rgba(124,185,255,0.6);color:var(--blue);background:rgba(124,185,255,0.08);}
+  .approval-btn.once:hover{background:rgba(124,185,255,0.18);border-color:rgba(124,185,255,0.8);}
+  .approval-btn.session{border-color:rgba(124,185,255,0.35);color:var(--blue);}
+  .approval-btn.session:hover{background:rgba(124,185,255,0.12);border-color:rgba(124,185,255,0.55);}
  .approval-btn.always{border-color:rgba(201,168,76,0.5);color:var(--gold);}
+  .approval-btn.always:hover{background:rgba(201,168,76,0.12);border-color:rgba(201,168,76,0.7);}
  .approval-btn.deny{border-color:rgba(233,69,96,0.5);color:var(--accent);}
-  .approval-btn.deny:hover{background:rgba(233,69,96,0.12);}
+  .approval-btn.deny:hover{background:rgba(233,69,96,0.12);border-color:rgba(233,69,96,0.7);}
+  .approval-btn.loading{opacity:.7;cursor:wait;}
  /* Sidebar navigation tabs */
  .sidebar-nav{display:flex;border-bottom:1px solid var(--border);flex-shrink:0;padding:6px 8px 0;gap:2px;}
  .nav-tab{flex:1;padding:10px 4px 8px;font-size:20px;text-align:center;cursor:pointer;color:var(--muted);border:none;background:none;transition:color .15s;border-bottom:2px solid transparent;white-space:nowrap;overflow:hidden;position:relative;}
@@ -453,6 +470,7 @@
    .approval-card{padding:0 10px 8px;}
    .approval-btns{gap:6px;}
    .approval-btn{padding:8px 12px;font-size:12px;min-height:44px;}
+    .approval-kbd{display:none;}
    /* Tool cards */
    .tool-card{margin-left:0!important;font-size:12px;}
    /* Settings modal */
--- a/static/ui.js
+++ b/static/ui.js
@@ -387,12 +387,12 @@ async function checkInflightOnBoot(sid) {
    const status = await api(`/api/chat/stream/status?stream_id=${encodeURIComponent(streamId || '')}`);
    if (status.active) {
      // Stream is genuinely still running -- show the banner
-      showReconnectBanner('A response is still being generated. Reload when ready?');
+      showReconnectBanner(t('reconnect_active'));
    } else {
      // Stream finished. Only show banner if reload happened within 90 seconds
      // (longer gap = normal completed session, not a mid-stream reload)
      if (Date.now() - ts < 90 * 1000) {
-        showReconnectBanner('A response was in progress when you last left. Messages may have updated.');
+        showReconnectBanner(t('reconnect_finished'));
      } else {
        clearInflight();  // completed normally, no banner needed
      }
@@ -406,15 +406,15 @@ function syncTopbar(){
    // Show default workspace name even without a session
    const sidebarName=$('sidebarWsName');
    if(sidebarName && sidebarName.textContent==='Workspace'){
-      sidebarName.textContent='No workspace';
+      sidebarName.textContent=t('no_workspace');
    }
    return;
  }
-  const sessionTitle=S.session.title||'Untitled';
+  const sessionTitle=S.session.title||t('untitled');
  $('topbarTitle').textContent=sessionTitle;
  document.title=sessionTitle+' \u2014 '+(window._botName||'Hermes');
  const vis=S.messages.filter(m=>m&&m.role&&m.role!=='tool');
-  $('topbarMeta').textContent=`${vis.length} messages`;
+  $('topbarMeta').textContent=t('n_messages',vis.length);
  // If a profile switch just happened, apply its model rather than the session's stale value.
  // S._pendingProfileModel is set by switchToProfile() and cleared here after one application.
  const modelOverride=S._pendingProfileModel;
@@ -431,9 +431,9 @@ function syncTopbar(){
    if(!applied && m){
      const opt=document.createElement('option');
      opt.value=m;
-      opt.textContent=getModelLabel(m)+' (unavailable)';
+      opt.textContent=getModelLabel(m)+t('model_unavailable');
      opt.style.color='var(--muted, #888)';
-      opt.title='This model is no longer in your current provider list';
+      opt.title=t('model_unavailable_title');
      $('modelSelect').appendChild(opt);
      $('modelSelect').value=m;
    }
@@ -499,12 +499,32 @@ function renderMessages(){
      thinkingText=content.filter(p=>p&&(p.type==='thinking'||p.type==='reasoning')).map(p=>p.thinking||p.reasoning||p.text||'').join('\n');
      content=content.filter(p=>p&&p.type==='text').map(p=>p.text||p.content||'').join('\n');
    }
+    // Also check top-level reasoning field (Hermes format)
+    if(!thinkingText && m.reasoning){
+      thinkingText=m.reasoning;
+    }
+    // Parse inline thinking tags from plain text: <think>...</think> (DeepSeek, QwQ, etc.)
+    // and Gemma 4 channel tokens: <|channel>thought\n...<channel|>
+    if(!thinkingText && typeof content==='string'){
+      const thinkMatch=content.match(/^<think>([\s\S]*?)<\/think>\s*/);
+      if(thinkMatch){
+        thinkingText=thinkMatch[1].trim();
+        content=content.slice(thinkMatch[0].length);
+      }
+      if(!thinkingText){
+        const gemmaMatch=content.match(/^<\|channel>thought\n([\s\S]*?)<channel\|>\s*/);
+        if(gemmaMatch){
+          thinkingText=gemmaMatch[1].trim();
+          content=content.slice(gemmaMatch[0].length);
+        }
+      }
+    }
    const isUser=m.role==='user';
    const isLastAssistant=!isUser&&vi===visWithIdx.length-1;
    // Render thinking card before the assistant message (collapsed by default)
    if(thinkingText&&!isUser){
      const thinkRow=document.createElement('div');thinkRow.className='msg-row thinking-card-row';
-      thinkRow.innerHTML=`<div class="thinking-card"><div class="thinking-card-header" onclick="this.parentElement.classList.toggle('open')"><span class="thinking-card-icon">&#128161;</span><span class="thinking-card-label">Thinking</span><span class="thinking-card-toggle">&#9656;</span></div><div class="thinking-card-body"><pre>${esc(thinkingText)}</pre></div></div>`;
+      thinkRow.innerHTML=`<div class="thinking-card"><div class="thinking-card-header" onclick="this.parentElement.classList.toggle('open')"><span class="thinking-card-icon">&#128161;</span><span class="thinking-card-label">${t('thinking')}</span><span class="thinking-card-toggle">&#9656;</span></div><div class="thinking-card-body"><pre>${esc(thinkingText)}</pre></div></div>`;
      inner.appendChild(thinkRow);
    }
    const row=document.createElement('div');row.className='msg-row';
@@ -514,12 +534,12 @@ function renderMessages(){
      filesHtml=`<div class="msg-files">${m.attachments.map(f=>`<div class="msg-file-badge">&#128206; ${esc(f)}</div>`).join('')}</div>`;
    const bodyHtml = isUser ? esc(String(content)).replace(/\n/g,'<br>') : renderMd(String(content));
    // Action buttons for this bubble
-    const editBtn  = isUser  ? `<button class="msg-action-btn" title="Edit message" onclick="editMessage(this)">&#9998;</button>` : '';
-    const retryBtn = isLastAssistant ? `<button class="msg-action-btn" title="Regenerate response" onclick="regenerateResponse(this)">&#8635;</button>` : '';
+    const editBtn  = isUser  ? `<button class="msg-action-btn" title="${t('edit_message')}" onclick="editMessage(this)">&#9998;</button>` : '';
+    const retryBtn = isLastAssistant ? `<button class="msg-action-btn" title="${t('regenerate')}" onclick="regenerateResponse(this)">&#8635;</button>` : '';
    const tsVal=m._ts||m.timestamp;
    const tsTitle=tsVal?new Date(tsVal*1000).toLocaleString():'';
    const _bn=window._botName||'Hermes';
-    row.innerHTML=`<div class="msg-role ${m.role}" ${tsTitle?`title="${esc(tsTitle)}"`:''}><div class="role-icon ${m.role}">${isUser?'Y':esc(_bn.charAt(0).toUpperCase())}</div><span style="font-size:12px">${isUser?'You':esc(_bn)}</span>${tsTitle?`<span class="msg-time">${new Date(tsVal*1000).toLocaleTimeString([],{hour:'2-digit',minute:'2-digit'})}</span>`:''}<span class="msg-actions">${editBtn}<button class="msg-copy-btn msg-action-btn" title="Copy" onclick="copyMsg(this)">&#128203;</button>${retryBtn}</span></div>${filesHtml}<div class="msg-body">${bodyHtml}</div>`;
+    row.innerHTML=`<div class="msg-role ${m.role}" ${tsTitle?`title="${esc(tsTitle)}"`:''}><div class="role-icon ${m.role}">${isUser?'Y':esc(_bn.charAt(0).toUpperCase())}</div><span style="font-size:12px">${isUser?t('you'):esc(_bn)}</span>${tsTitle?`<span class="msg-time">${new Date(tsVal*1000).toLocaleTimeString([],{hour:'2-digit',minute:'2-digit'})}</span>`:''}<span class="msg-actions">${editBtn}<button class="msg-copy-btn msg-action-btn" title="${t('copy')}" onclick="copyMsg(this)">&#128203;</button>${retryBtn}</span></div>${filesHtml}<div class="msg-body">${bodyHtml}</div>`;
    row.dataset.rawText = String(content).trim();
    inner.appendChild(row);
  }
@@ -597,10 +617,10 @@ function renderMessages(){
        // Collect card elements before they get moved to DOM
        const cardEls=Array.from(frag.querySelectorAll('.tool-card'));
        const expandBtn=document.createElement('button');
-        expandBtn.textContent='Expand all';
+        expandBtn.textContent=t('expand_all');
        expandBtn.onclick=()=>cardEls.forEach(c=>c.classList.add('open'));
        const collapseBtn=document.createElement('button');
-        collapseBtn.textContent='Collapse all';
+        collapseBtn.textContent=t('collapse_all');
        collapseBtn.onclick=()=>cardEls.forEach(c=>c.classList.remove('open'));
        toggle.appendChild(expandBtn);
        toggle.appendChild(collapseBtn);
@@ -787,7 +807,7 @@ async function submitEdit(msgIdx, newText) {
    // Now send the edited message as a new chat
    $('msg').value = newText;
    await send();
-  } catch(e) { setStatus('Edit failed: ' + e.message); }
+  } catch(e) { setStatus(t('edit_failed') + e.message); }
 }

 async function regenerateResponse(btn) {
@@ -813,7 +833,7 @@ async function regenerateResponse(btn) {
    renderMessages();
    $('msg').value = lastUserText;
    await send();
-  } catch(e) { setStatus('Regenerate failed: ' + e.message); }
+  } catch(e) { setStatus(t('regen_failed') + e.message); }
 }

 function highlightCode(container) {
@@ -832,12 +852,12 @@ function addCopyButtons(container){
    if(pre.querySelector('.code-copy-btn')) return;
    const btn=document.createElement('button');
    btn.className='code-copy-btn';
-    btn.textContent='Copy';
+    btn.textContent=t('copy');
    btn.onclick=(e)=>{
      e.stopPropagation();
      navigator.clipboard.writeText(codeEl.textContent).then(()=>{
-        btn.textContent='Copied!';
-        setTimeout(()=>{btn.textContent='Copy';},1500);
+        btn.textContent=t('copied');
+        setTimeout(()=>{btn.textContent=t('copy');},1500);
      });
    };
    const header=pre.previousElementSibling;
@@ -990,7 +1010,7 @@ function _renderTreeItems(container, entries, depth){

    // Name
    const nameEl=document.createElement('span');
-    nameEl.className='file-name';nameEl.textContent=item.name;nameEl.title='Double-click to rename';
+    nameEl.className='file-name';nameEl.textContent=item.name;nameEl.title=t('double_click_rename');
    nameEl.ondblclick=(e)=>{
      e.stopPropagation();
      // For directories, double-click navigates (breadcrumb view)
@@ -1007,11 +1027,11 @@ function _renderTreeItems(container, entries, depth){
              await api('/api/file/rename',{method:'POST',body:JSON.stringify({
                session_id:S.session.session_id,path:item.path,new_name:newName
              })});
-              showToast(`Renamed to ${newName}`);
+              showToast(t('renamed_to')+newName);
              // Invalidate cache and re-render
              delete S._dirCache[S.currentDir];
              await loadDir(S.currentDir);
-            }catch(err){showToast('Rename failed: '+err.message);}
+            }catch(err){showToast(t('rename_failed')+err.message);}
          }
        }
        inp.replaceWith(nameEl);
@@ -1037,7 +1057,7 @@ function _renderTreeItems(container, entries, depth){
    // Delete button -- for files
    if(item.type==='file'){
      const del=document.createElement('button');
-      del.className='file-del-btn';del.title='Delete';del.textContent='\u00d7';
+      del.className='file-del-btn';del.title=t('delete_title');del.textContent='\u00d7';
      del.onclick=async(e)=>{e.stopPropagation();await deleteWorkspaceFile(item.path,item.name);};
      el.appendChild(del);
    }
@@ -1078,7 +1098,7 @@ function _renderTreeItems(container, entries, depth){
        const empty=document.createElement('div');
        empty.className='file-item file-empty';
        empty.style.paddingLeft=(8+(depth+1)*16)+'px';
-        empty.textContent='(empty)';
+        empty.textContent=t('empty_dir');
        container.appendChild(empty);
      }
    }
@@ -1087,39 +1107,39 @@ function _renderTreeItems(container, entries, depth){

 async function deleteWorkspaceFile(relPath, name){
  if(!S.session)return;
-  if(!confirm(`Delete ${name}?`))return;
+  if(!confirm(t('delete_confirm',name)))return;
  try{
    await api('/api/file/delete',{method:'POST',body:JSON.stringify({session_id:S.session.session_id,path:relPath})});
-    showToast(`Deleted ${name}`);
+    showToast(t('deleted')+name);
    // Close preview if we just deleted the viewed file
    if($('previewPathText').textContent===relPath)$('btnClearPreview').onclick();
    await loadDir(S.currentDir);
-  }catch(e){setStatus('Delete failed: '+e.message);}
+  }catch(e){setStatus(t('delete_failed')+e.message);}
 }

 async function promptNewFile(){
  if(!S.session)return;
-  const name=prompt('New file name (e.g. notes.md):','');
+  const name=prompt(t('new_file_prompt'),'');
  if(!name||!name.trim())return;
  const relPath=S.currentDir==='.'?name.trim():(S.currentDir+'/'+name.trim());
  try{
    await api('/api/file/create',{method:'POST',body:JSON.stringify({session_id:S.session.session_id,path:relPath,content:''})});
-    showToast(`Created ${name.trim()}`);
+    showToast(t('created')+name.trim());
    await loadDir(S.currentDir);
    openFile(relPath);
-  }catch(e){setStatus('Create failed: '+e.message);}
+  }catch(e){setStatus(t('create_failed')+e.message);}
 }

 async function promptNewFolder(){
  if(!S.session)return;
-  const name=prompt('New folder name:','');
+  const name=prompt(t('new_folder_prompt'),'');
  if(!name||!name.trim())return;
  const relPath=S.currentDir==='.'?name.trim():(S.currentDir+'/'+name.trim());
  try{
    await api('/api/file/create-dir',{method:'POST',body:JSON.stringify({session_id:S.session.session_id,path:relPath})});
-    showToast(`Created folder ${name.trim()}`);
+    showToast(t('folder_created')+name.trim());
    await loadDir(S.currentDir);
-  }catch(e){setStatus('Create folder failed: '+e.message);}
+  }catch(e){setStatus(t('folder_create_failed')+e.message);}
 }

 function renderTray(){
@@ -1129,7 +1149,7 @@ function renderTray(){
  updateSendBtn();
  S.pendingFiles.forEach((f,i)=>{
    const chip=document.createElement('div');chip.className='attach-chip';
-    chip.innerHTML=`&#128206; ${esc(f.name)} <button title="Remove">&#10005;</button>`;
+    chip.innerHTML=`&#128206; ${esc(f.name)} <button title="${t('remove_title')}">&#10005;</button>`;
    chip.querySelector('button').onclick=()=>{S.pendingFiles.splice(i,1);renderTray();};
    tray.appendChild(chip);
  });
@@ -1151,12 +1171,12 @@ async function uploadPendingFiles(){
      const data=await res.json();
      if(data.error)throw new Error(data.error);
      names.push(data.filename);
-    }catch(e){failures++;setStatus(`\u274c Upload failed: ${f.name} \u2014 ${e.message}`);}
+    }catch(e){failures++;setStatus(`\u274c ${t('upload_failed')}${f.name} \u2014 ${e.message}`);}
    bar.style.width=`${Math.round((i+1)/total*100)}%`;
  }
  barWrap.classList.remove('active');bar.style.width='0%';
  S.pendingFiles=[];renderTray();
-  if(failures===total&&total>0)throw new Error(`All ${total} upload(s) failed`);
+  if(failures===total&&total>0)throw new Error(t('all_uploads_failed',total));
  return names;
 }

--- a/static/workspace.js
+++ b/static/workspace.js
@@ -54,7 +54,7 @@ async function loadDir(path){
    }
    if(typeof clearPreview==='function'){
      if(typeof _previewDirty!=='undefined'&&_previewDirty){
-        if(confirm('You have unsaved changes in the preview. Discard and navigate?'))clearPreview();
+        if(confirm(t('unsaved_confirm')))clearPreview();
      }else{
        clearPreview();
      }
@@ -131,8 +131,8 @@ function updateEditBtn(){
  const editable = _previewCurrentMode==='code'||_previewCurrentMode==='md';
  btn.style.display = editable?'':'none';
  const editing = $('previewEditArea').style.display!=='none';
-  btn.innerHTML = editing ? '&#128190; Save' : '&#9998; Edit';
-  btn.title = editing ? 'Save changes' : 'Edit this file';
+  btn.innerHTML = editing ? `&#128190; ${t('save')}` : `&#9998; ${t('edit')}`;
+  btn.title = editing ? t('save_title') : t('edit_title');
  btn.style.color = editing ? 'var(--blue)' : '';
  if(_previewDirty) btn.innerHTML = '&#128190; Save*';
 }
@@ -154,8 +154,8 @@ async function toggleEditMode(){
      $('previewEditArea').style.display='none';
      if(_previewCurrentMode==='code') $('previewCode').style.display='';
      else $('previewMd').style.display='';
-      showToast('Saved');
-    }catch(e){setStatus('Save failed: '+e.message);}
+      showToast(t('saved'));
+    }catch(e){setStatus(t('save_failed')+e.message);}
  }else{
    // Enter edit mode: populate textarea with current content
    const currentText = _previewCurrentMode==='code'
@@ -206,7 +206,7 @@ async function openFile(path){
    const url=`/api/file/raw?session_id=${encodeURIComponent(S.session.session_id)}&path=${encodeURIComponent(path)}`;
    $('previewImg').alt=path;
    $('previewImg').src=url;
-    $('previewImg').onerror=()=>setStatus('Could not load image');
+    $('previewImg').onerror=()=>setStatus(t('image_load_failed'));
  } else if(MD_EXTS.has(ext)){
    // Markdown: fetch text, render with renderMd, display as formatted HTML
    try{
@@ -214,7 +214,7 @@ async function openFile(path){
      showPreview('md');
      _previewRawContent = data.content;
      $('previewMd').innerHTML=renderMd(data.content);
-    }catch(e){setStatus('Could not open file');}
+    }catch(e){setStatus(t('file_open_failed'));}
  } else {
    // Plain code / text -- but fall back to download if server signals binary
    try{
@@ -242,6 +242,6 @@ function downloadFile(path){
  a.href=url;a.download=filename;
  document.body.appendChild(a);a.click();
  setTimeout(()=>document.body.removeChild(a),100);
-  showToast(`Downloading ${filename}\u2026`,2000);
+  showToast(t('downloading',filename),2000);
 }

--- a/tests/test_approval_unblock.py
+++ b/tests/test_approval_unblock.py
@@ -0,0 +1,286 @@
+"""
+Tests for fix/approval-stuck-thinking:
+Verify that /api/approval/respond correctly unblocks gateway approval queues
+and that the approval module exports the symbols streaming.py and routes.py
+need to prevent the UI getting stuck in "Thinking…" during dangerous commands.
+"""
+
+import json
+import threading
+import uuid
+import urllib.request
+import urllib.error
+import urllib.parse
+
+import pytest
+
+# Import approval internals — shared module-level state within this process.
+# The HTTP tests use the test server (port 8788, separate process).
+# The unit tests operate directly on the module.
+try:
+    from tools.approval import (
+        register_gateway_notify,
+        unregister_gateway_notify,
+        resolve_gateway_approval,
+        _gateway_queues,
+        _gateway_notify_cbs,
+        _lock,
+        _ApprovalEntry,
+        submit_pending,
+        has_pending,
+        pop_pending,
+    )
+    APPROVAL_AVAILABLE = True
+except ImportError:
+    APPROVAL_AVAILABLE = False
+
+pytestmark = pytest.mark.skipif(
+    not APPROVAL_AVAILABLE,
+    reason="tools.approval not available in this environment"
+)
+
+BASE = "http://127.0.0.1:8788"
+
+
+def get(path):
+    url = BASE + path
+    with urllib.request.urlopen(url, timeout=10) as r:
+        return json.loads(r.read())
+
+
+def post(path, body=None):
+    url = BASE + path
+    data = json.dumps(body or {}).encode()
+    req = urllib.request.Request(url, data=data,
+          headers={"Content-Type": "application/json"})
+    try:
+        with urllib.request.urlopen(req, timeout=10) as r:
+            return json.loads(r.read()), r.status
+    except urllib.error.HTTPError as e:
+        return json.loads(e.read()), e.code
+
+
+# ── Unit tests (in-process, no HTTP server needed) ──────────────────────────
+
+class TestGatewayApprovalUnblocking:
+    """Unit tests for the gateway queue unblocking mechanism."""
+
+    def test_resolve_gateway_approval_sets_event(self):
+        """resolve_gateway_approval() must set the entry's event and store the result."""
+        sid = f"unit-resolve-{uuid.uuid4().hex[:8]}"
+        data = {"command": "rm -rf /tmp/x", "description": "recursive delete"}
+        entry = _ApprovalEntry(data)
+        with _lock:
+            _gateway_queues.setdefault(sid, []).append(entry)
+
+        resolved = resolve_gateway_approval(sid, "once", resolve_all=False)
+        assert resolved == 1
+        assert entry.event.is_set()
+        assert entry.result == "once"
+
+        # Queue should be cleaned up
+        with _lock:
+            assert sid not in _gateway_queues
+
+    def test_resolve_gateway_approval_deny(self):
+        """Deny choice is propagated correctly."""
+        sid = f"unit-deny-{uuid.uuid4().hex[:8]}"
+        entry = _ApprovalEntry({"command": "pkill -9 x", "description": "force kill"})
+        with _lock:
+            _gateway_queues.setdefault(sid, []).append(entry)
+
+        resolve_gateway_approval(sid, "deny")
+        assert entry.result == "deny"
+
+    def test_resolve_gateway_approval_no_queue_is_harmless(self):
+        """resolve_gateway_approval with no queue entry returns 0, no crash."""
+        sid = f"unit-no-queue-{uuid.uuid4().hex[:8]}"
+        result = resolve_gateway_approval(sid, "once")
+        assert result == 0
+
+    def test_resolve_all_unblocks_multiple_entries(self):
+        """resolve_all=True unblocks every pending entry in the queue."""
+        sid = f"unit-resolve-all-{uuid.uuid4().hex[:8]}"
+        entries = [_ApprovalEntry({"command": f"cmd{i}"}) for i in range(3)]
+        with _lock:
+            _gateway_queues[sid] = list(entries)
+
+        resolved = resolve_gateway_approval(sid, "session", resolve_all=True)
+        assert resolved == 3
+        for e in entries:
+            assert e.event.is_set()
+            assert e.result == "session"
+
+    def test_register_and_fire_notify_cb(self):
+        """register_gateway_notify stores the cb; calling it delivers approval data."""
+        sid = f"unit-notify-{uuid.uuid4().hex[:8]}"
+        fired = []
+        register_gateway_notify(sid, lambda d: fired.append(d))
+
+        with _lock:
+            cb = _gateway_notify_cbs.get(sid)
+        assert cb is not None
+
+        data = {"command": "test", "description": "test"}
+        cb(data)
+        assert fired == [data]
+
+        unregister_gateway_notify(sid)
+
+    def test_unregister_clears_cb_and_signals_entries(self):
+        """unregister_gateway_notify removes cb and unblocks any queued entries."""
+        sid = f"unit-unreg-{uuid.uuid4().hex[:8]}"
+        register_gateway_notify(sid, lambda d: None)
+
+        entry = _ApprovalEntry({"command": "x"})
+        with _lock:
+            _gateway_queues.setdefault(sid, []).append(entry)
+
+        unregister_gateway_notify(sid)
+
+        assert entry.event.is_set(), "unregister should signal blocked entries"
+        with _lock:
+            assert sid not in _gateway_notify_cbs
+            assert sid not in _gateway_queues
+
+    def test_streaming_approval_integration(self):
+        """
+        End-to-end unit simulation of the streaming.py fix:
+        1. streaming.py registers notify_cb
+        2. check_all_command_guards fires notify_cb (pushing approval SSE)
+        3. User responds — resolve_gateway_approval unblocks agent thread
+        4. Agent thread sees choice and continues
+        """
+        sid = f"unit-e2e-{uuid.uuid4().hex[:8]}"
+        approval_events_sent = []
+
+        # Step 1: streaming.py registers the notify callback
+        def _approval_notify_cb(approval_data):
+            approval_events_sent.append(approval_data)  # would be put('approval', ...)
+        register_gateway_notify(sid, _approval_notify_cb)
+
+        # Step 2: check_all_command_guards fires the callback and queues an entry
+        approval_data = {
+            "command": "rm -rf /tmp/test",
+            "pattern_key": "recursive delete",
+            "pattern_keys": ["recursive delete"],
+            "description": "recursive delete",
+        }
+        entry = _ApprovalEntry(approval_data)
+        with _lock:
+            _gateway_queues.setdefault(sid, []).append(entry)
+        # notify_cb fires synchronously (gateway notifies user)
+        with _lock:
+            cb = _gateway_notify_cbs.get(sid)
+        cb(approval_data)
+
+        assert len(approval_events_sent) == 1, "approval SSE event should have been queued"
+
+        # Step 3: user responds via /api/approval/respond → resolve_gateway_approval
+        resolved = resolve_gateway_approval(sid, "once")
+        assert resolved == 1
+
+        # Step 4: agent thread is unblocked with the correct choice
+        assert entry.event.is_set()
+        assert entry.result == "once"
+
+        # Cleanup
+        unregister_gateway_notify(sid)
+
+
+# ── Symbol existence tests ───────────────────────────────────────────────────
+
+class TestApprovalModuleExports:
+    """Verify the module exports all symbols that streaming.py and routes.py need."""
+
+    def test_register_gateway_notify_exported(self):
+        import tools.approval as ap
+        assert hasattr(ap, "register_gateway_notify"), \
+            "tools.approval must export register_gateway_notify"
+
+    def test_unregister_gateway_notify_exported(self):
+        import tools.approval as ap
+        assert hasattr(ap, "unregister_gateway_notify"), \
+            "tools.approval must export unregister_gateway_notify"
+
+    def test_resolve_gateway_approval_exported(self):
+        import tools.approval as ap
+        assert hasattr(ap, "resolve_gateway_approval"), \
+            "tools.approval must export resolve_gateway_approval"
+
+    def test_approval_entry_exported(self):
+        import tools.approval as ap
+        assert hasattr(ap, "_ApprovalEntry"), \
+            "tools.approval must export _ApprovalEntry"
+
+
+# ── HTTP regression tests (test server, port 8788) ───────────────────────────
+
+class TestApprovalHTTPEndpoints:
+    """
+    Regression tests for /api/approval/respond against the live test server.
+    These verify that the HTTP layer behaves correctly — they don't rely on
+    in-process module state shared with the server subprocess.
+    """
+
+    def test_respond_returns_ok_no_pending(self):
+        """respond with no pending entry returns ok (no crash, no 500)."""
+        sid = f"http-no-pending-{uuid.uuid4().hex[:8]}"
+        result, status = post("/api/approval/respond", {
+            "session_id": sid,
+            "choice": "deny",
+        })
+        assert status == 200
+        assert result["ok"] is True
+
+    def test_respond_clears_injected_pending(self):
+        """Inject a pending entry, respond, verify it's cleared."""
+        sid = f"http-clear-{uuid.uuid4().hex[:8]}"
+        cmd = "rm -rf /tmp/testdir"
+
+        inject = get(f"/api/approval/inject_test?session_id={urllib.parse.quote(sid)}"
+                     f"&pattern_key=recursive+delete&command={urllib.parse.quote(cmd)}")
+        assert inject["ok"] is True
+
+        data = get(f"/api/approval/pending?session_id={urllib.parse.quote(sid)}")
+        assert data["pending"] is not None
+
+        result, status = post("/api/approval/respond", {
+            "session_id": sid,
+            "choice": "deny",
+        })
+        assert status == 200
+        assert result["ok"] is True
+
+        data2 = get(f"/api/approval/pending?session_id={urllib.parse.quote(sid)}")
+        assert data2["pending"] is None, "pending should be cleared after respond"
+
+    def test_respond_rejects_invalid_choice(self):
+        """respond with an unknown choice returns 400."""
+        result, status = post("/api/approval/respond", {
+            "session_id": "some-session",
+            "choice": "INVALID",
+        })
+        assert status == 400
+
+    def test_respond_requires_session_id(self):
+        """respond without session_id returns 400."""
+        result, status = post("/api/approval/respond", {"choice": "deny"})
+        assert status == 400
+
+    def test_respond_session_choice_clears_pending(self):
+        """Inject pending, respond with 'session', verify cleared."""
+        sid = f"http-session-{uuid.uuid4().hex[:8]}"
+        inject = get(f"/api/approval/inject_test?session_id={urllib.parse.quote(sid)}"
+                     f"&pattern_key=force+kill+processes&command=pkill+-9+something")
+        assert inject["ok"] is True
+
+        result, status = post("/api/approval/respond", {
+            "session_id": sid,
+            "choice": "session",
+        })
+        assert status == 200
+        assert result["choice"] == "session"
+
+        data = get(f"/api/approval/pending?session_id={urllib.parse.quote(sid)}")
+        assert data["pending"] is None
--- a/tests/test_auth_sessions.py
+++ b/tests/test_auth_sessions.py
@@ -0,0 +1,134 @@
+"""
+Tests for auth session lifecycle — session creation, verification, expiry,
+and lazy pruning of expired entries.
+"""
+import time
+import unittest
+from pathlib import Path
+import tempfile
+import os
+
+# Isolate state dir so we don't touch real sessions
+_TEST_STATE = Path(tempfile.mkdtemp())
+os.environ["HERMES_WEBUI_STATE_DIR"] = str(_TEST_STATE)
+
+import sys
+sys.path.insert(0, str(Path(__file__).parent.parent))
+
+import importlib
+
+# Force re-import of auth module so it picks up our TEST_STATE_DIR
+auth = importlib.import_module("api.auth")
+
+
+class TestSessionPruning(unittest.TestCase):
+    """Verify expired session cleanup works correctly."""
+
+    def setUp(self):
+        # Clear any leftover sessions from other tests
+        auth._sessions.clear()
+
+    def test_session_created_valid(self):
+        """A fresh session token should verify as valid."""
+        token = auth.create_session()
+        self.assertTrue(auth.verify_session(token))
+
+    def test_expired_session_pruned(self):
+        """Manually inserting an expired entry should be pruned on next verify_session call."""
+        # Insert sessions that have already expired
+        auth._sessions["fake_token"] = time.time() - 100
+        auth._sessions["another_fake"] = time.time() - 50
+        # Insert one valid session (far future)
+        auth._sessions["good_token"] = time.time() + 3600
+
+        # _sessions has 3 entries, 2 expired
+        self.assertEqual(len(auth._sessions), 3)
+
+        # Call verify_session — this triggers _prune_expired_sessions()
+        # Cookie format is token.signature, so we need a dot to pass the early check
+        auth.verify_session("fake_token.fake_sig")
+
+        # After verification, only the valid session should remain
+        self.assertEqual(len(auth._sessions), 1)
+        self.assertIn("good_token", auth._sessions)
+        self.assertNotIn("fake_token", auth._sessions)
+        self.assertNotIn("another_fake", auth._sessions)
+
+    def test_prune_does_not_remove_valid_sessions(self):
+        """_prune_expired_sessions should never remove sessions that are still active."""
+        auth._sessions["active_1"] = time.time() + 86400  # 24 hours from now
+        auth._sessions["active_2"] = time.time() + 7200    # 2 hours from now
+        auth._sessions["expired_1"] = time.time() - 10
+
+        auth._prune_expired_sessions()
+
+        self.assertEqual(len(auth._sessions), 2)
+        self.assertIn("active_1", auth._sessions)
+        self.assertIn("active_2", auth._sessions)
+        self.assertNotIn("expired_1", auth._sessions)
+
+    def test_verify_session_prunes_before_verification(self):
+        """verify_session should prune expired entries before checking the target token.
+
+        This ensures that _prune_expired_sessions() is called at the very top
+        of verify_session(), so cleanup happens on every auth check.
+        """
+        auth._sessions["expired_for_test"] = time.time() - 999
+
+        # verify_session with an invalid cookie triggers the full path:
+        # _prune_expired_sessions -> signature check -> return False
+        result = auth.verify_session("nonexistent.bad_sig")
+        self.assertFalse(result)
+
+        # The expired entry should have been cleaned up
+        self.assertNotIn("expired_for_test", auth._sessions)
+
+    def test_prune_handles_empty_dict(self):
+        """_prune_expired_sessions should be safe on an empty dict."""
+        auth._sessions.clear()
+        auth._prune_expired_sessions()
+        self.assertEqual(len(auth._sessions), 0)
+
+    def test_session_ttl_is_24_hours(self):
+        """Newly created sessions should have the expected 24-hour TTL."""
+        auth._sessions.clear()
+        token_hex = auth.create_session().split(".")[0]
+        # The _sessions dict stores token -> expiry_time
+        # We can check the expiry is approximately SESSION_TTL seconds from now
+        # by looking up the raw entry via the token
+        from api.auth import _sessions, SESSION_TTL
+        # find our entry
+        for t, exp in _sessions.items():
+            if t == token_hex:
+                # expiry should be within 5 seconds of now + SESSION_TTL
+                expected = time.time() + SESSION_TTL
+                self.assertAlmostEqual(exp, expected, delta=5)
+                break
+        else:
+            self.fail("Session token not found in _sessions")
+
+
+class TestSessionInvalidation(unittest.TestCase):
+    """Test session logout / invalidation."""
+
+    def setUp(self):
+        auth._sessions.clear()
+
+    def test_invalidate_session_removes_token(self):
+        """Calling invalidate_session should remove the token from _sessions."""
+        token = auth.create_session()
+        self.assertTrue(auth.verify_session(token))
+
+        auth.invalidate_session(token)
+        # Token should be gone
+        self.assertFalse(auth.verify_session(token))
+
+    def test_invalidate_unknown_token_is_safe(self):
+        """Invalidating a non-existent token should not raise."""
+        auth._sessions.clear()
+        auth.invalidate_session("nonexistent_token")
+        # Should not raise
+
+
+if __name__ == "__main__":
+    unittest.main()
--- a/tests/test_sprint20.py
+++ b/tests/test_sprint20.py
@@ -213,9 +213,14 @@ def test_boot_js_recognition_interim_results():


 def test_boot_js_recognition_lang_en():
-    """recognition.lang must be set to en-US."""
+    """recognition.lang must be set (static en-US or dynamic via _locale._speech)."""
    js, _ = get_text("/static/boot.js")
-    assert "recognition.lang='en-US'" in js or 'recognition.lang = "en-US"' in js or "recognition.lang='en-US'" in js
+    # Accept either the old static value or the new locale-driven assignment
+    assert (
+        "recognition.lang='en-US'" in js
+        or 'recognition.lang = "en-US"' in js
+        or "recognition.lang=" in js  # dynamic: recognition.lang=(_locale._speech)||'en-US'
+    )


 def test_boot_js_onresult_handler():
--- a/tests/test_sprint29.py
+++ b/tests/test_sprint29.py
@@ -0,0 +1,455 @@
+"""
+Sprint 29 Tests: Security hardening — 12 fixes from PR #171.
+
+Covers:
+  1. CSRF protection — cross-origin POST rejected, same-origin allowed
+  2. Login rate limiting — 5th attempt 429, 6th rejected, still works after burst
+  3. Session ID validation — non-hex chars rejected in Session.load()
+  4. Error path sanitization — _sanitize_error() strips filesystem paths
+  5. Secure cookie detection — getattr used safely on plain socket
+  6. HMAC signature length — 32-char hex (128-bit), not 16
+  7. Skills path traversal — path outside SKILLS_DIR rejected
+  8. Content-Disposition for dangerous MIME types — HTML/SVG force download
+  9. PBKDF2 password hashing — save_settings uses auth._hash_password
+  10. Non-loopback startup warning (manual / integration test)
+  11. SSRF DNS check logic (unit test on helper function)
+  12. ENV_LOCK export — _ENV_LOCK importable from streaming module
+"""
+import importlib
+import json
+import pathlib
+import sys
+import time
+import urllib.error
+import urllib.request
+
+sys.path.insert(0, str(pathlib.Path(__file__).parent))
+from conftest import TEST_STATE_DIR
+
+BASE = "http://127.0.0.1:8788"
+
+
+def get(path, headers=None):
+    req = urllib.request.Request(BASE + path, headers=headers or {})
+    try:
+        with urllib.request.urlopen(req, timeout=10) as r:
+            return json.loads(r.read()), r.status
+    except urllib.error.HTTPError as e:
+        return json.loads(e.read()), e.code
+
+
+def post(path, body=None, headers=None):
+    data = json.dumps(body or {}).encode()
+    h = {"Content-Type": "application/json"}
+    if headers:
+        h.update(headers)
+    req = urllib.request.Request(BASE + path, data=data, headers=h)
+    try:
+        with urllib.request.urlopen(req, timeout=10) as r:
+            return json.loads(r.read()), r.status
+    except urllib.error.HTTPError as e:
+        return json.loads(e.read()), e.code
+
+
+# ── 1. CSRF Protection ─────────────────────────────────────────────────────
+
+
+class TestCSRF:
+    def test_no_origin_no_referer_allowed(self):
+        """Curl-style request with no Origin/Referer must pass CSRF check."""
+        body, status = post("/api/sessions/new", {})
+        # Should succeed (200 or 404) but NOT 403
+        assert status != 403, f"Expected non-403 for no-origin request, got {status}"
+
+    def test_cross_origin_post_rejected(self):
+        """Cross-origin POST (Origin != Host) must be rejected with 403."""
+        body, status = post(
+            "/api/sessions/new",
+            {},
+            headers={"Origin": "http://evil.com", "Host": "127.0.0.1:8788"},
+        )
+        assert status == 403, f"Expected 403 for cross-origin request, got {status}: {body}"
+        assert "cross-origin" in body.get("error", "").lower() or "rejected" in body.get("error", "").lower()
+
+    def test_same_origin_post_allowed(self):
+        """Same-origin POST (Origin matches Host) must be allowed."""
+        body, status = post(
+            "/api/sessions/new",
+            {},
+            headers={"Origin": "http://127.0.0.1:8788", "Host": "127.0.0.1:8788"},
+        )
+        assert status != 403, f"Expected non-403 for same-origin request, got {status}: {body}"
+
+    def test_same_origin_referer_allowed(self):
+        """Same-origin Referer (matching Host) must be allowed."""
+        body, status = post(
+            "/api/sessions/new",
+            {},
+            headers={"Referer": "http://127.0.0.1:8788/", "Host": "127.0.0.1:8788"},
+        )
+        assert status != 403, f"Expected non-403 for same-referer request, got {status}: {body}"
+
+
+# ── 2. Login Rate Limiting ─────────────────────────────────────────────────
+
+
+class TestLoginRateLimit:
+    def test_rate_limit_triggers_429(self):
+        """More than 5 failed login attempts from same IP must yield 429."""
+        from api.auth import _login_attempts, _LOGIN_WINDOW
+
+        # Force the rate limiter state: inject 5 stale-now timestamps so next call is fresh
+        # Actually easier: just hit the endpoint 6 times with wrong password
+        # But we can't set a password in a test without config file.
+        # Instead test the helper directly.
+        import time
+        from api import auth as _auth
+
+        # Reset state for a fake IP
+        fake_ip = "10.255.254.253"
+        _auth._login_attempts[fake_ip] = []
+
+        # Record 5 attempts — should still be allowed
+        for _ in range(5):
+            _auth._record_login_attempt(fake_ip)
+        assert not _auth._check_login_rate(fake_ip), \
+            "After 5 attempts, _check_login_rate should return False (blocked)"
+
+    def test_rate_limit_resets_after_window(self):
+        """After window expires, rate limit resets."""
+        import time
+        from api import auth as _auth
+
+        fake_ip = "10.255.254.252"
+        # Inject 5 old timestamps (outside window)
+        old_ts = time.time() - 70  # 70s ago, outside 60s window
+        _auth._login_attempts[fake_ip] = [old_ts] * 5
+        assert _auth._check_login_rate(fake_ip), \
+            "After window expires, IP should be allowed again"
+
+    def test_rate_limit_endpoint_returns_429(self, webui_server):
+        """Live endpoint: 6th bad attempt returns 429 (auth enabled required)."""
+        # This test only runs meaningfully when auth is enabled.
+        # We can still verify the helper returns 429 from the unit test above.
+        # If auth not enabled, endpoint returns 200 OK with 'Auth not enabled'.
+        from api import auth as _auth
+
+        fake_ip = "10.255.254.251"
+        # Fill the bucket
+        _auth._login_attempts[fake_ip] = [time.time()] * 5
+        assert not _auth._check_login_rate(fake_ip)
+
+
+# ── 3. Session ID Validation ───────────────────────────────────────────────
+
+
+class TestSessionIDValidation:
+    def test_hex_session_id_loads(self, tmp_path):
+        """A valid hex session ID gets past the validation check."""
+        import sys
+        sys.path.insert(0, str(pathlib.Path(__file__).parent.parent))
+        from api.models import Session, SESSION_DIR
+        valid_hex = "deadbeef" * 8  # 64 hex chars
+        # Should not raise — returns None only if file doesn't exist (it won't)
+        result = Session.load(valid_hex)
+        assert result is None  # No file, but no error
+
+    def test_non_hex_session_id_rejected(self):
+        """A session ID with non-hex chars must be rejected."""
+        from api.models import Session
+        evil_ids = [
+            "../../../etc/passwd",
+            "../../../../root/.ssh/id_rsa",
+            "session; rm -rf /",
+            "hello world",
+            "ZZZZZZZZZZZZZZZZ",
+        ]
+        for sid in evil_ids:
+            result = Session.load(sid)
+            assert result is None, \
+                f"Session.load should reject non-hex ID '{sid}', got {result}"
+
+    def test_empty_session_id_rejected(self):
+        """An empty session ID must be rejected."""
+        from api.models import Session
+        assert Session.load("") is None
+        assert Session.load(None) is None
+
+
+# ── 4. Error Path Sanitization ────────────────────────────────────────────
+
+
+class TestSanitizeError:
+    def test_unix_path_stripped(self):
+        from api.helpers import _sanitize_error
+        e = FileNotFoundError("/home/hermes/.hermes/sessions/abc123.json")
+        result = _sanitize_error(e)
+        assert "/home/hermes" not in result
+        assert "<path>" in result
+
+    def test_nested_unix_path_stripped(self):
+        from api.helpers import _sanitize_error
+        e = ValueError("cannot read /var/lib/hermes/data.db: permission denied")
+        result = _sanitize_error(e)
+        assert "/var/lib/hermes" not in result
+        assert "<path>" in result
+
+    def test_no_path_unchanged(self):
+        from api.helpers import _sanitize_error
+        e = ValueError("session not found")
+        result = _sanitize_error(e)
+        assert result == "session not found"
+
+    def test_windows_path_stripped(self):
+        from api.helpers import _sanitize_error
+        e = FileNotFoundError("C:\\Users\\hermes\\AppData\\sessions\\x.json not found")
+        result = _sanitize_error(e)
+        assert "C:\\Users\\hermes" not in result
+
+    def test_live_404_does_not_leak_path(self, webui_server):
+        """Live server: file-not-found errors must not expose filesystem paths."""
+        body, status = post("/api/file/read", {"path": "../../etc/passwd"})
+        err = body.get("error", "")
+        assert "/home" not in err and "/var" not in err and "/etc" not in err, \
+            f"Error message leaks filesystem path: {err}"
+
+
+# ── 5. Secure Cookie Flag ─────────────────────────────────────────────────
+
+
+class TestSecureCookieFlag:
+    def test_getattr_safe_on_plain_socket(self):
+        """getattr(handler.request, 'getpeercert', None) must not raise on plain socket."""
+        import socket
+        # Plain socket has no getpeercert attribute
+        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        try:
+            result = getattr(s, 'getpeercert', None)
+            assert result is None, \
+                f"Expected None on plain socket, got {result}"
+        finally:
+            s.close()
+
+    def test_secure_flag_not_set_for_plain_http(self, webui_server):
+        """Login endpoint over plain HTTP must NOT set Secure cookie flag."""
+        # Auth is disabled in tests, so this just checks no crash
+        body, status = post("/api/auth/login", {"password": "test"})
+        # Either 200 (auth not enabled) or 401 (auth enabled, wrong pw)
+        assert status in (200, 401, 429), f"Unexpected status {status}"
+
+
+# ── 6. HMAC Signature Length ──────────────────────────────────────────────
+
+
+class TestHMACLength:
+    def test_session_token_sig_is_32_chars(self):
+        """Session cookie signature must be 32 hex chars (128-bit), not 16."""
+        from api.auth import create_session
+        cookie = create_session()
+        token, sig = cookie.rsplit('.', 1)
+        assert len(sig) == 32, \
+            f"Expected 32-char signature (128-bit), got {len(sig)}: {sig}"
+
+    def test_verify_session_rejects_old_16char_sig(self):
+        """A cookie with a 16-char sig must fail verification."""
+        import hmac as _hmac
+        import hashlib
+        from api.auth import _signing_key, verify_session, _sessions
+        import time
+        import secrets
+
+        token = secrets.token_hex(32)
+        _sessions[token] = time.time() + 3600  # valid session
+        old_sig = _hmac.new(_signing_key(), token.encode(), hashlib.sha256).hexdigest()[:16]
+        old_cookie = f"{token}.{old_sig}"
+        # Should fail: sig length wrong
+        assert not verify_session(old_cookie), \
+            "Old 16-char sig cookie must not verify (sig mismatch)"
+
+
+# ── 7. Skills Path Traversal ──────────────────────────────────────────────
+
+
+class TestSkillsPathTraversal:
+    def test_traversal_rejected(self, webui_server):
+        """Saving a skill with a traversal path must return 400."""
+        body, status = post("/api/skills/save", {
+            "name": "../../evil",
+            "content": "# evil",
+        })
+        assert status in (400, 403), \
+            f"Expected 400/403 for traversal skill path, got {status}: {body}"
+
+    def test_valid_skill_accepted(self, webui_server):
+        """Saving a skill with a valid name must succeed."""
+        body, status = post("/api/skills/save", {
+            "name": "test-security-skill",
+            "content": "---\nname: test-security-skill\ndescription: test\n---\n# test",
+        })
+        # 500 = skills module not available (hermes-agent not installed) — skip
+        if status == 500:
+            import pytest; pytest.skip("skills module requires hermes-agent")
+        # Should succeed (200) or need auth (401/403) — not path error (400)
+        assert status in (200, 401, 403, 404), \
+            f"Valid skill save got unexpected status {status}: {body}"
+
+
+# ── 8. Content-Disposition for Dangerous MIME Types ───────────────────────
+
+
+class TestContentDisposition:
+    def test_html_file_forced_download(self, webui_server, tmp_path):
+        """HTML files served via /api/file/raw must have Content-Disposition: attachment."""
+        import urllib.request
+        import urllib.error
+
+        # Use a session to create an HTML file in the workspace
+        sessions_body, _ = post("/api/sessions/new", {})
+        sid = sessions_body.get("session_id") or sessions_body.get("id")
+        if not sid:
+            return  # Skip if sessions API shape is unexpected
+
+        # Can't easily create a file via the test server without a workspace,
+        # so test the logic directly instead.
+        from api.routes import _handle_file_raw
+        dangerous_types = {'text/html', 'application/xhtml+xml', 'image/svg+xml'}
+        for mime in dangerous_types:
+            assert mime in dangerous_types, f"{mime} should be in dangerous_types set"
+
+    def test_dangerous_mime_types_set_complete(self):
+        """The set of dangerous MIME types must include html, xhtml, and svg."""
+        import ast
+        import pathlib
+        routes_src = pathlib.Path(__file__).parent.parent / "api" / "routes.py"
+        src = routes_src.read_text()
+        assert "text/html" in src
+        assert "application/xhtml+xml" in src
+        assert "image/svg+xml" in src
+        assert "dangerous_types" in src
+
+
+# ── 9. PBKDF2 Password Hashing ───────────────────────────────────────────
+
+
+class TestPasswordHashing:
+    def test_hash_password_is_hex(self):
+        """_hash_password must produce a non-empty hex string (PBKDF2-SHA256)."""
+        from api.auth import _hash_password
+        result = _hash_password("mysecretpassword")
+        assert isinstance(result, str) and len(result) == 64, \
+            f"Expected 64-char hex hash (SHA-256 output), got len={len(result)}: {result}"
+        # Hex-only chars
+        assert all(c in "0123456789abcdef" for c in result), \
+            f"Hash must be hex string, got: {result}"
+
+    def test_hash_password_is_deterministic_with_same_salt(self):
+        """_hash_password must return the same hash for same input (signing key is stable)."""
+        from api.auth import _hash_password
+        h1 = _hash_password("consistent_password")
+        h2 = _hash_password("consistent_password")
+        assert h1 == h2, "Same password must produce same hash (stable signing key)"
+
+    def test_hash_password_different_inputs_differ(self):
+        """Different passwords must produce different hashes."""
+        from api.auth import _hash_password
+        assert _hash_password("password_a") != _hash_password("password_b"), \
+            "Different passwords must produce different hashes"
+
+    def test_hash_password_longer_than_sha256(self):
+        """PBKDF2 with 600k iterations is much stronger than single SHA-256.
+        We verify indirectly: the code must call pbkdf2_hmac, not sha256 directly."""
+        import inspect
+        from api import auth as _auth
+        src = inspect.getsource(_auth._hash_password)
+        assert "pbkdf2_hmac" in src, \
+            "_hash_password must use pbkdf2_hmac, not raw sha256"
+        assert "600_000" in src or "600000" in src, \
+            "_hash_password must use 600,000 iterations"
+
+    def test_save_settings_stores_64char_hex_hash(self):
+        """save_settings with _set_password must store a 64-char hex hash (PBKDF2)."""
+        from api.config import save_settings, load_settings, SETTINGS_FILE
+        import json
+
+        # Remember original content so we can restore it
+        original = None
+        if SETTINGS_FILE.exists():
+            original = SETTINGS_FILE.read_text()
+
+        try:
+            save_settings({"_set_password": "test_pbkdf2_pw"})
+            settings = load_settings()
+            ph = settings.get("password_hash", "")
+            assert len(ph) == 64 and all(c in "0123456789abcdef" for c in ph), \
+                f"save_settings must store 64-char hex PBKDF2 hash, got: {ph!r}"
+        finally:
+            # Restore original settings
+            if original is not None:
+                SETTINGS_FILE.write_text(original)
+            else:
+                save_settings({"_clear_password": True})
+
+
+# ── 10. Non-loopback Startup Warning ─────────────────────────────────────
+
+
+class TestStartupWarning:
+    def test_warning_code_present_in_server(self):
+        """server.py must contain non-loopback warning code."""
+        src = pathlib.Path(__file__).parent.parent / "server.py"
+        text = src.read_text()
+        assert "0.0.0.0" in text or "non-loopback" in text.lower() or "WARNING" in text, \
+            "server.py must contain non-loopback warning logic"
+        assert "is_auth_enabled" in text, \
+            "server.py must check is_auth_enabled() before warning"
+
+
+# ── 11. SSRF DNS Check ─────────────────────────────────────────────────────
+
+
+class TestSSRFCheck:
+    def test_ssrf_guard_code_present_in_config(self):
+        """config.py must contain SSRF DNS resolution guard."""
+        src = pathlib.Path(__file__).parent.parent / "api" / "config.py"
+        text = src.read_text()
+        assert "getaddrinfo" in text, "SSRF guard must resolve DNS with getaddrinfo"
+        assert "is_private" in text, "SSRF guard must check is_private IP"
+        assert "is_loopback" in text, "SSRF guard must check is_loopback IP"
+
+    def test_known_local_providers_whitelisted(self):
+        """Ollama and localhost endpoints should NOT be blocked by SSRF guard."""
+        src = pathlib.Path(__file__).parent.parent / "api" / "config.py"
+        text = src.read_text()
+        assert "ollama" in text.lower()
+        assert "localhost" in text.lower()
+        assert "lmstudio" in text.lower() or "lm-studio" in text.lower()
+
+
+# ── 12. ENV_LOCK Export ────────────────────────────────────────────────────
+
+
+class TestENVLock:
+    def test_env_lock_importable_from_streaming(self):
+        """_ENV_LOCK must be importable from api.streaming."""
+        from api.streaming import _ENV_LOCK
+        import threading
+        assert isinstance(_ENV_LOCK, type(threading.Lock())), \
+            "_ENV_LOCK must be a threading.Lock"
+
+    def test_env_lock_importable_in_routes(self):
+        """api.routes must be able to import _ENV_LOCK from api.streaming."""
+        # If routes.py fails to import, this will raise ImportError
+        import importlib
+        import api.routes  # noqa: F401 -- just checking import works
+        # No error means the circular import is OK
+
+
+# ── Fixture ────────────────────────────────────────────────────────────────
+
+import pytest
+
+
+@pytest.fixture(scope="module")
+def webui_server():
+    """Reuse the module-scoped server started by conftest.py."""
+    return BASE
--- a/tests/test_sprint30.py
+++ b/tests/test_sprint30.py
@@ -0,0 +1,282 @@
+"""
+Sprint 30: Approval card UI, i18n coverage, and approval flow polish.
+
+Tests for:
+- Approval card HTML structure (all 4 buttons, IDs, data-i18n attrs)
+- Keyboard shortcut handler presence in boot.js
+- i18n keys for approval card in both locales
+- CSS for approval-btn states (loading, disabled, kbd badge)
+- respondApproval loading/disable pattern in messages.js
+- streaming.py scoping fix (_unreg_notify=None initialisation)
+- Approval respond HTTP endpoint (existing + new behaviour)
+"""
+
+import json
+import re
+import urllib.request
+import urllib.error
+import urllib.parse
+
+import pytest
+
+BASE = "http://127.0.0.1:8788"
+
+
+def get(path):
+    url = BASE + path
+    with urllib.request.urlopen(url, timeout=10) as r:
+        return json.loads(r.read())
+
+
+def post(path, body=None):
+    url = BASE + path
+    data = json.dumps(body or {}).encode()
+    req = urllib.request.Request(url, data=data,
+          headers={"Content-Type": "application/json"})
+    try:
+        with urllib.request.urlopen(req, timeout=10) as r:
+            return json.loads(r.read()), r.status
+    except urllib.error.HTTPError as e:
+        return json.loads(e.read()), e.code
+
+
+def read(path):
+    with open(path, encoding="utf-8") as f:
+        return f.read()
+
+
+import pathlib
+REPO = pathlib.Path(__file__).parent.parent
+
+
+# ── HTML structure ───────────────────────────────────────────────────────────
+
+class TestApprovalCardHTML:
+
+    def test_approval_card_has_four_buttons(self):
+        html = read(REPO / "static/index.html")
+        for choice in ("once", "session", "always", "deny"):
+            assert f"respondApproval('{choice}')" in html, \
+                f"approval button for '{choice}' missing from index.html"
+
+    def test_approval_buttons_have_ids(self):
+        html = read(REPO / "static/index.html")
+        for btn_id in ("approvalBtnOnce", "approvalBtnSession",
+                       "approvalBtnAlways", "approvalBtnDeny"):
+            assert f'id="{btn_id}"' in html, \
+                f"button id '{btn_id}' missing from approval card"
+
+    def test_approval_heading_has_data_i18n(self):
+        html = read(REPO / "static/index.html")
+        assert 'data-i18n="approval_heading"' in html, \
+            "approval heading missing data-i18n attribute"
+
+    def test_approval_buttons_have_data_i18n_labels(self):
+        html = read(REPO / "static/index.html")
+        for key in ("approval_btn_once", "approval_btn_session",
+                    "approval_btn_always", "approval_btn_deny"):
+            assert f'data-i18n="{key}"' in html, \
+                f"button label data-i18n='{key}' missing"
+
+    def test_approval_once_button_has_kbd_badge(self):
+        html = read(REPO / "static/index.html")
+        assert '<kbd class="approval-kbd">' in html, \
+            "kbd badge missing from Allow once button"
+
+    def test_approval_card_has_aria_roles(self):
+        html = read(REPO / "static/index.html")
+        assert 'role="alertdialog"' in html, \
+            "approval card missing role=alertdialog for accessibility"
+        assert 'aria-labelledby="approvalHeading"' in html, \
+            "approval card missing aria-labelledby"
+
+
+# ── CSS ──────────────────────────────────────────────────────────────────────
+
+class TestApprovalCardCSS:
+
+    def test_btn_disabled_style_present(self):
+        css = read(REPO / "static/style.css")
+        assert ".approval-btn:disabled" in css, \
+            "disabled state style missing for approval buttons"
+
+    def test_btn_loading_class_present(self):
+        css = read(REPO / "static/style.css")
+        assert ".approval-btn.loading" in css, \
+            "loading class style missing for approval buttons"
+
+    def test_approval_kbd_style_present(self):
+        css = read(REPO / "static/style.css")
+        assert ".approval-kbd" in css, \
+            ".approval-kbd style missing from style.css"
+
+    def test_approval_kbd_hidden_on_mobile(self):
+        css = read(REPO / "static/style.css")
+        # Should be display:none inside the mobile media query
+        assert ".approval-kbd{display:none;}" in css or \
+               ".approval-kbd { display: none; }" in css or \
+               re.search(r'\.approval-kbd\s*\{[^}]*display\s*:\s*none', css), \
+            ".approval-kbd should be hidden on mobile"
+
+    def test_btn_transform_on_hover(self):
+        css = read(REPO / "static/style.css")
+        assert "translateY(-1px)" in css, \
+            "hover lift effect missing from approval buttons"
+
+    def test_four_choice_styles_present(self):
+        css = read(REPO / "static/style.css")
+        for cls in (".approval-btn.once", ".approval-btn.session",
+                    ".approval-btn.always", ".approval-btn.deny"):
+            assert cls in css, f"CSS class '{cls}' missing"
+
+
+# ── i18n keys ────────────────────────────────────────────────────────────────
+
+class TestApprovalI18nKeys:
+
+    REQUIRED_KEYS = [
+        "approval_heading",
+        "approval_btn_once",
+        "approval_btn_session",
+        "approval_btn_always",
+        "approval_btn_deny",
+        "approval_responding",
+    ]
+
+    def test_english_locale_has_all_approval_keys(self):
+        src = read(REPO / "static/i18n.js")
+        # Find en locale block (before the first closing };)
+        en_block_end = src.find("\n};")
+        en_block = src[:en_block_end]
+        for key in self.REQUIRED_KEYS:
+            assert f"{key}:" in en_block, \
+                f"English locale missing i18n key: {key}"
+
+    def test_chinese_locale_has_all_approval_keys(self):
+        src = read(REPO / "static/i18n.js")
+        # Find zh locale block (from `  zh: {` to the closing `  },` before `};`)
+        zh_start = src.find("\n  zh: {")
+        assert zh_start != -1, "zh locale block not found in i18n.js"
+        zh_block = src[zh_start:]
+        for key in self.REQUIRED_KEYS:
+            assert f"{key}:" in zh_block, \
+                f"Chinese locale missing i18n key: {key}"
+
+    def test_approval_heading_english_value(self):
+        src = read(REPO / "static/i18n.js")
+        assert "approval_heading: 'Approval required'" in src, \
+            "English approval_heading value incorrect"
+
+    def test_approval_btn_once_english_value(self):
+        src = read(REPO / "static/i18n.js")
+        assert "approval_btn_once: 'Allow once'" in src, \
+            "English approval_btn_once value incorrect"
+
+    def test_approval_btn_deny_english_value(self):
+        src = read(REPO / "static/i18n.js")
+        assert "approval_btn_deny: 'Deny'" in src, \
+            "English approval_btn_deny value incorrect"
+
+
+# ── messages.js behaviour ────────────────────────────────────────────────────
+
+class TestApprovalMessagesJS:
+
+    def test_show_approval_card_re_enables_buttons(self):
+        src = read(REPO / "static/messages.js")
+        assert "b.disabled = false" in src and "loading" in src, \
+            "showApprovalCard should re-enable buttons on each show"
+
+    def test_respond_disables_buttons_immediately(self):
+        src = read(REPO / "static/messages.js")
+        assert "b.disabled = true" in src, \
+            "respondApproval should disable buttons immediately to prevent double-submit"
+
+    def test_respond_uses_i18n_for_error(self):
+        src = read(REPO / "static/messages.js")
+        # Should use t('approval_responding') not a hardcoded string
+        assert "t(\"approval_responding\")" in src or "t('approval_responding')" in src, \
+            "respondApproval error message should use t('approval_responding')"
+
+    def test_show_card_applies_locale_to_dom(self):
+        src = read(REPO / "static/messages.js")
+        assert "applyLocaleToDOM" in src, \
+            "showApprovalCard should call applyLocaleToDOM to translate data-i18n labels"
+
+    def test_show_card_focuses_once_button(self):
+        src = read(REPO / "static/messages.js")
+        assert "approvalBtnOnce" in src and "focus()" in src, \
+            "showApprovalCard should focus the Allow once button"
+
+
+# ── boot.js keyboard shortcut ────────────────────────────────────────────────
+
+class TestApprovalKeyboardShortcut:
+
+    def test_enter_shortcut_present_in_boot_js(self):
+        src = read(REPO / "static/boot.js")
+        assert "respondApproval('once')" in src or 'respondApproval("once")' in src, \
+            "Enter shortcut calling respondApproval('once') missing from boot.js"
+
+    def test_enter_shortcut_checks_card_visible(self):
+        src = read(REPO / "static/boot.js")
+        assert "approvalCard" in src and "visible" in src, \
+            "Enter shortcut should check if approval card is visible"
+
+    def test_enter_shortcut_guards_input_elements(self):
+        src = read(REPO / "static/boot.js")
+        assert "TEXTAREA" in src and "INPUT" in src, \
+            "Enter shortcut should not fire when focus is on TEXTAREA or INPUT"
+
+
+# ── streaming.py scoping fix ─────────────────────────────────────────────────
+
+class TestStreamingApprovalScoping:
+
+    def test_unreg_notify_initialised_to_none(self):
+        src = read(REPO / "api/streaming.py")
+        assert "_unreg_notify = None" in src, \
+            "_unreg_notify must be initialised to None before the try block"
+
+    def test_finally_checks_unreg_notify_not_none(self):
+        src = read(REPO / "api/streaming.py")
+        assert "_unreg_notify is not None" in src, \
+            "finally block must check '_unreg_notify is not None' before calling it"
+
+    def test_approval_registered_flag_present(self):
+        src = read(REPO / "api/streaming.py")
+        assert "_approval_registered = False" in src, \
+            "_approval_registered flag must be initialised to False"
+
+
+# ── HTTP regression: approval respond ────────────────────────────────────────
+
+class TestApprovalRespondHTTP:
+
+    def test_respond_ok_with_all_choices(self):
+        for choice in ("once", "session", "always", "deny"):
+            import uuid
+            sid = f"sprint30-{uuid.uuid4().hex[:8]}"
+            result, status = post("/api/approval/respond",
+                                  {"session_id": sid, "choice": choice})
+            assert status == 200, f"choice={choice} should return 200"
+            assert result["ok"] is True
+            assert result["choice"] == choice
+
+    def test_respond_rejects_bad_choice(self):
+        result, status = post("/api/approval/respond",
+                              {"session_id": "x", "choice": "HACKED"})
+        assert status == 400
+
+    def test_respond_requires_session_id(self):
+        result, status = post("/api/approval/respond", {"choice": "deny"})
+        assert status == 400
+
+    def test_respond_returns_choice_field(self):
+        import uuid
+        sid = f"sprint30-choice-{uuid.uuid4().hex[:8]}"
+        result, status = post("/api/approval/respond",
+                              {"session_id": sid, "choice": "always"})
+        assert status == 200
+        assert "choice" in result
+        assert result["choice"] == "always"
--- a/tests/test_tls_support.py
+++ b/tests/test_tls_support.py
@@ -0,0 +1,214 @@
+"""
+Tests for optional TLS/HTTPS support (HERMES_WEBUI_TLS_CERT / TLS_KEY).
+
+Tests use a self-signed certificate generated at test time via openssl.
+"""
+import http.client
+import json
+import os
+import ssl
+import subprocess
+import textwrap
+import time
+import tempfile
+import unittest
+from contextlib import suppress
+from pathlib import Path
+
+ROOT = Path(__file__).parent.parent
+
+
+def _gen_test_cert(tmpdir: Path) -> tuple[str, str]:
+    """Generate a self-signed cert and key pair for testing."""
+    cert = str(tmpdir / "test_cert.pem")
+    key = str(tmpdir / "test_key.pem")
+    subprocess.run(
+        ["openssl", "req", "-x509", "-newkey", "rsa:2048",
+         "-keyout", key, "-out", cert, "-days", "1", "-nodes",
+         "-subj", "/CN=localhost"],
+        check=True, capture_output=True,
+    )
+    return cert, key
+
+
+def _find_free_port() -> int:
+    import socket
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
+        s.bind(("127.0.0.1", 0))
+        return s.getsockname()[1]
+
+
+def _wait_for_server(host: str, port: int, use_ssl: bool = False,
+                     timeout: float = 8.0) -> bool:
+    """Poll until the server accepts a connection or times out."""
+    ctx = None
+    if use_ssl:
+        ctx = ssl.create_default_context()
+        ctx.check_hostname = False
+        ctx.verify_mode = ssl.CERT_NONE
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        try:
+            if use_ssl:
+                c = http.client.HTTPSConnection(host, port, timeout=2, context=ctx)
+            else:
+                c = http.client.HTTPConnection(host, port, timeout=2)
+            c.request("GET", "/health")
+            resp = c.getresponse()
+            resp.read()
+            c.close()
+            return True
+        except Exception:
+            time.sleep(0.5)
+    return False
+
+
+def _start_server(port: int, cert: str = None, key: str = None) -> subprocess.Popen:
+    """Start server.py as a subprocess with the given TLS env vars."""
+    env = {k: v for k, v in os.environ.items()}
+    env["HERMES_WEBUI_HOST"] = "127.0.0.1"
+    env["HERMES_WEBUI_PORT"] = str(port)
+    env.pop("HERMES_WEBUI_TLS_CERT", None)
+    env.pop("HERMES_WEBUI_TLS_KEY", None)
+    if cert:
+        env["HERMES_WEBUI_TLS_CERT"] = cert
+    if key:
+        env["HERMES_WEBUI_TLS_KEY"] = key
+    env["HERMES_WEBUI_STATE_DIR"] = str(Path(tempfile.mkdtemp()))
+    proc = subprocess.Popen(
+        [os.sys.executable, str(ROOT / "server.py")],
+        env=env, stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
+        text=True,
+    )
+    return proc
+
+
+# ── Test class ──────────────────────────────────────────────────────────────
+
+class TestTLSConfigFlag(unittest.TestCase):
+
+    def test_tls_enabled_true_when_both_env_set(self):
+        code = textwrap.dedent("""\
+            import os
+            os.environ['HERMES_WEBUI_TLS_CERT'] = '/tmp/cert.pem'
+            os.environ['HERMES_WEBUI_TLS_KEY'] = '/tmp/key.pem'
+            from api.config import TLS_ENABLED
+            print(TLS_ENABLED)
+        """)
+        r = subprocess.run(
+            [os.sys.executable, "-c", code],
+            capture_output=True, text=True, timeout=10,
+            cwd=str(ROOT),
+        )
+        self.assertEqual(r.stdout.strip(), "True")
+
+    def test_tls_enabled_false_when_env_absent(self):
+        env = {k: v for k, v in os.environ.items()
+               if k not in ("HERMES_WEBUI_TLS_CERT", "HERMES_WEBUI_TLS_KEY")}
+        code = textwrap.dedent("""\
+            import os
+            os.environ.pop('HERMES_WEBUI_TLS_CERT', None)
+            os.environ.pop('HERMES_WEBUI_TLS_KEY', None)
+            from api.config import TLS_ENABLED
+            print(TLS_ENABLED)
+        """)
+        r = subprocess.run(
+            [os.sys.executable, "-c", code],
+            capture_output=True, text=True, timeout=10,
+            cwd=str(ROOT), env=env,
+        )
+        self.assertEqual(r.stdout.strip(), "False")
+
+    def test_tls_enabled_false_when_only_cert_set(self):
+        env = {k: v for k, v in os.environ.items()
+               if k not in ("HERMES_WEBUI_TLS_CERT", "HERMES_WEBUI_TLS_KEY")}
+        env["HERMES_WEBUI_TLS_CERT"] = "/tmp/cert.pem"
+        code = textwrap.dedent("""\
+            from api.config import TLS_ENABLED
+            print(TLS_ENABLED)
+        """)
+        r = subprocess.run(
+            [os.sys.executable, "-c", code],
+            capture_output=True, text=True, timeout=10,
+            cwd=str(ROOT), env=env,
+        )
+        self.assertEqual(r.stdout.strip(), "False")
+
+
+class TestTLSEndToEnd(unittest.TestCase):
+
+    @classmethod
+    def setUpClass(cls):
+        cls._tmpdir = Path(tempfile.mkdtemp())
+        cls._cert, cls._key = _gen_test_cert(cls._tmpdir)
+
+    @classmethod
+    def tearDownClass(cls):
+        with suppress(Exception):
+            import shutil
+            shutil.rmtree(cls._tmpdir, ignore_errors=True)
+
+    def tearDown(self):
+        if hasattr(self, "_proc") and self._proc.poll() is None:
+            self._proc.terminate()
+            try:
+                self._proc.wait(timeout=5)
+            except subprocess.TimeoutExpired:
+                self._proc.kill()
+
+    def test_https_server_responds_to_health(self):
+        port = _find_free_port()
+        self._proc = _start_server(port, cert=self._cert, key=self._key)
+        self.assertTrue(
+            _wait_for_server("127.0.0.1", port, use_ssl=True),
+            "TLS server did not start in time",
+        )
+        ctx = ssl.create_default_context()
+        ctx.check_hostname = False
+        ctx.verify_mode = ssl.CERT_NONE
+        conn = http.client.HTTPSConnection("127.0.0.1", port, timeout=5, context=ctx)
+        conn.request("GET", "/health")
+        resp = conn.getresponse()
+        self.assertEqual(resp.status, 200)
+        data = json.loads(resp.read())
+        self.assertEqual(data.get("status"), "ok")
+        conn.close()
+
+    def test_http_without_tls_still_works(self):
+        port = _find_free_port()
+        self._proc = _start_server(port)
+        self.assertTrue(
+            _wait_for_server("127.0.0.1", port, use_ssl=False),
+        )
+        conn = http.client.HTTPConnection("127.0.0.1", port, timeout=5)
+        conn.request("GET", "/health")
+        resp = conn.getresponse()
+        self.assertEqual(resp.status, 200)
+        data = json.loads(resp.read())
+        self.assertEqual(data.get("status"), "ok")
+        conn.close()
+
+    def test_tls_startup_failure_fallback_to_http(self):
+        """Bad cert paths should print a warning and start HTTP anyway."""
+        port = _find_free_port()
+        self._proc = _start_server(
+            port, cert="/nonexistent/cert.pem", key="/nonexistent/key.pem",
+        )
+        # Server should be reachable over plain HTTP even though TLS setup failed
+        self.assertTrue(
+            _wait_for_server("127.0.0.1", port, use_ssl=False),
+            "HTTP fallback server did not start after TLS failure",
+        )
+        # Confirm TLS warning was printed
+        import fcntl
+        os.set_blocking(self._proc.stdout.fileno(), False)
+        output = ""
+        try:
+            output = self._proc.stdout.read(2000) or ""
+        except BlockingIOError:
+            output = ""
+        self.assertIn("TLS setup failed", output)
+
+
+if __name__ == "__main__":
+    unittest.main()