Merge pull request #457 from nesquena/release/v0.50.40

release: v0.50.40 — session UI polish, test port isolation, 6 bug fixes

ARCHITECTURE.md

@@ -7,6 +7,11 @@
 >
 > Keep this document updated as architecture changes are made.
 
+> Current shipped build: `v0.50.36-local.1` (April 14, 2026).
+> Baseline: upstream `nesquena/hermes-webui` `v0.50.36`.
+> Intentional local delta: first-time password enablement from Settings immediately issues a `hermes_session` cookie so the current browser remains signed in. The previous `Assistant Reply Language` customization has been removed, and legacy `assistant_language` settings are filtered out on load/save.
+> Automated coverage: 1059 passing tests.
+
 ---
 
 ## 1. Overview and Purpose
@@ -23,6 +28,11 @@ frontend framework. The Python server is split into a routing shell (server.py)
 business logic modules (api/). The frontend is seven vanilla JS modules loaded from static/.
 This makes the code easy to modify from a terminal or by an agent.
 
+For the current local build, the codebase is intentionally as close to upstream as possible:
+the app now tracks upstream `v0.50.36`, keeps the password-session continuity patch in the
+settings/onboarding flow, and does not carry forward the prior reply-language preference
+feature.
+
 Hermes-level chrome is intentionally consolidated: the sidebar has no dedicated brand header.
 Instead, the footer exposes a single "Hermes WebUI" launch button that opens one tabbed
 control-center modal for global preferences, conversation import/export, and clear-conversation
@@ -63,7 +73,7 @@ actions. The topbar remains focused on conversation context and the workspace/fi
       panels.js            Cron, skills, memory, workspace, profiles, todo, settings (~974 lines)
       commands.js          Slash command registry, parser, autocomplete dropdown (~156 lines)
       onboarding.js        First-run wizard overlay, provider setup flow, and settings/workspace orchestration.
-      boot.js              Event wiring, mobile nav, voice input, boot IIFE (~338 lines)
+      boot.js              Event wiring, mobile sidebar/workspace nav, voice input, boot IIFE (~338 lines)
     tests/
       conftest.py          Isolated test server (port 8788, separate HERMES_HOME) (~240 lines)
       test_sprint{1-20b}.py Feature tests per sprint (21 files, 415 test functions)

CHANGELOG.md

@@ -1,5 +1,215 @@
 # Hermes Web UI -- Changelog
 
+## [v0.50.40] feat: session UI polish + parallel test isolation
+
+**Session sidebar improvements:**
+- `static/sessions.js` + `style.css`: Hide session timestamps to give titles full available width — no more title truncation from inline timestamps (PR #449)
+- `static/style.css`: Active session title now uses `var(--gold)` theme variable instead of hardcoded `#e8a030` — adapts correctly across all 7 themes (PR #451, fixes #440)
+- `api/models.py` + `api/gateway_watcher.py`: Return `None` instead of the string `'unknown'` for missing gateway session model — Telegram sessions no longer show `telegram · unknown` (PR #452, fixes #443)
+- `static/style.css` + `static/sessions.js`: Mute Telegram badge from saturated `#0088cc` to `rgba(0, 136, 204, 0.55)`. Add `_formatSourceTag()` helper mapping platform IDs to display names (`telegram` → `via Telegram`) (PR #453, fixes #442)
+
+**Bug fixes:**
+- `api/config.py` `resolve_model_provider()`: Strip provider prefix from model ID when a custom `base_url` is configured (`openai/gpt-5.4` → `gpt-5.4`) — fixes broken chats after switching to a custom endpoint (PR #454, fixes #433)
+- `static/panels.js` `switchToProfile()`: Apply profile default workspace to new session created during profile switch — workspace chip no longer shows "No active workspace" after switching profiles mid-conversation (PR #455, fixes #424)
+
+**Test infrastructure:**
+- `tests/conftest.py` + `tests/_pytest_port.py` (new): Auto-derive unique port and state dir per worktree from repo path hash (range 20000-29999). Running pytest in two worktrees simultaneously no longer causes port conflicts. All 43 test files updated from hardcoded `BASE = "http://127.0.0.1:8788"` to `from tests._pytest_port import BASE` (PR #456)
+
+- Total tests: 1098 (was 1078)
+
+## [v0.50.39] fix: orphan gateway sessions + first-password-enablement session continuity
+
+Two bug fixes:
+
+**PR #423 — Fix orphan gateway sessions in sidebar (@aronprins, fix by maintainer)**
+`gateway_watcher.py`'s `_get_agent_sessions_from_db()` was missing the
+`HAVING COUNT(m.id) > 0` clause that `get_cli_sessions()` already had. Sessions
+with no messages (e.g. created then abandoned before any turns) would appear in the
+sidebar via the SSE watcher stream even after the initial page load filtered them out.
+One-line SQL fix applied to both query paths.
+
+**PR #434 — First-password-enablement session continuity (@SaulgoodMan-C)**
+When a user enables a password for the first time via POST `/api/settings`,
+the current browser session was being terminated — requiring the user to log in
+again immediately after setting their password. Fix: the response now includes
+`auth_enabled`, `logged_in`, and `auth_just_enabled` fields, and issues a
+`hermes_session` cookie when auth is first enabled, so the browser remains logged in.
+Also: legacy `assistant_language` key is now dropped from settings on next save.
+New i18n keys for password replacement/keep-existing states (en, es, de, zh, zh-Hant).
+
+- `api/config.py`: `_SETTINGS_LEGACY_DROP_KEYS` removes `assistant_language` on load
+- `api/routes.py`: first-password-enable session continuity with `auth_just_enabled` flag
+- `static/panels.js`: `_setSettingsAuthButtonsVisible()` + `_applySavedSettingsUi()` helpers
+- `static/i18n.js`: password state i18n keys across 5 locales
+- `tests/test_sprint45.py`: 3 new integration tests (auth continuity + legacy key cleanup)
+
+- Total tests: 1078 (was 1075)
+
+
+## [v0.50.38] feat: mobile nav cleanup, Prism syntax highlighting, zh-CN/zh-Hant i18n
+
+Three community contributions combined:
+
+**PR #425 — Remove mobile bottom nav (@aronprins)**
+The fixed iOS-style bottom navigation bar on phones has been removed. The sidebar drawer
+tabs already handle all navigation — the bottom nav was redundant and consumed ~56px of
+vertical chat space. `test_mobile_layout.py` updated with `test_mobile_bottom_nav_removed()`
+and new sidebar nav coverage tests.
+
+**PR #426 — Prism syntax highlighting with light + dark theme token colors (@GiggleSamurai)**
+Fenced code blocks now emit `class="language-{lang}"` on `<code>` elements, enabling Prism's
+autoloader to apply token-level syntax highlighting. Added 36-line `:root[data-theme="light"]`
+token color overrides scoped to light theme only; dark/dim/monokai/nord themes unaffected.
+Background guard uses `var(--code-bg) !important` to prevent Prism's dark background from
+overriding theme variables. 2 new regression tests in `test_issue_code_syntax_highlight.py`.
+
+**PR #428 — zh-CN/zh-Hant i18n hardening (@vansour)**
+Pluggable `resolvePreferredLocale()` function with smart zh-CN/zh-SG/zh-TW/zh-HK variant
+mapping. Full zh-Simplified and zh-Traditional locale blocks added to `i18n.js`. Login page
+locale routing updated in `api/routes.py` (`_resolve_login_locale_key()` helper). Hardcoded
+strings in `panels.js` cron UI extracted to i18n keys. 3 new test files:
+`test_chinese_locale.py`, `test_language_precedence.py`, `test_login_locale.py`.
+
+- Total tests: 1075 (was 1063)
+
+## [v0.50.37] fix(onboarding): skip wizard when Hermes is already configured
+
+Fixes #420 — existing Hermes users with a valid `config.yaml` were shown the first-run
+onboarding wizard on every WebUI load because the only completion gate was
+`settings.onboarding_completed` in the WebUI's own settings file. Users who configured
+Hermes via the CLI before the WebUI existed had no such flag, so the wizard always fired
+and could silently overwrite their working config.
+
+**Changes:**
+1. `api/onboarding.py` `get_onboarding_status()`: auto-complete when `config.yaml` exists
+   AND `chat_ready=True`. Existing configured users are never shown the wizard.
+2. `api/onboarding.py` `apply_onboarding_setup()`: refuse to overwrite an existing
+   `config.yaml` without `confirm_overwrite=True` in the request body. Returns
+   `{error: "config_exists", requires_confirm: true}` for the frontend to handle.
+3. `static/index.html`: "Skip setup" button added to wizard footer — users are never
+   trapped in the wizard.
+4. `static/onboarding.js`: `skipOnboarding()` calls `/api/onboarding/complete` without
+   modifying config, then closes the overlay.
+5. `static/boot.js`: Escape key now dismisses the onboarding overlay.
+6. `static/i18n.js`: `onboarding_skip` / `onboarding_skipped` keys added to en + es locales.
+7. `tests/test_onboarding_existing_config.py`: 8 new unit tests covering gate logic and
+   overwrite guard.
+
+- Total tests: 1063 (was 1055)
+
+
+## [v0.50.36] fix: workspace list cleaner — allow own-profile paths, remove brittle string filter
+
+Two bugs in `_clean_workspace_list()` caused workspace additions to silently disappear on the next `load_workspaces()` call, breaking `test_workspace_add_no_duplicate` and `test_workspace_rename` (and potentially causing real-world workspace list corruption):
+
+**Bug 1 — Brittle string filter removed:** `if 'test-workspace' in path or 'webui-mvp-test' in path: continue` dropped any workspace path containing those substrings. In the test server, `TEST_WORKSPACE` is `~/.hermes/profiles/webui/webui-mvp-test/test-workspace`, so every workspace added during tests was silently discarded on the next `load_workspaces()` call. The `p.is_dir()` check already handles genuinely non-existent paths — the string filter was redundant and harmful.
+
+**Bug 2 — Cross-profile filter was too broad:** `if p is under ~/.hermes/profiles/: skip` was designed to block cross-profile workspace leakage, but it also removed paths under the *current* profile's own directory (e.g. `~/.hermes/profiles/webui/...`). Fixed: now only skips paths under `profiles/` that are NOT under the current profile's own `hermes_home`.
+
+- `api/workspace.py`: remove string-match filter; fix cross-profile check to allow own-profile paths
+- All 1055 tests now pass (was 1053 pass + 2 fail)
+
+## [v0.50.35] fix: workspace trust boundary — cross-platform, multi-workspace support
+
+v0.50.34's workspace trust check was too restrictive: it required all workspaces to be under `DEFAULT_WORKSPACE` (/home/hermes/workspace), which blocked every profile-specific workspace (~/CodePath, ~/hermes-webui-public, ~/WebUI, ~/Camanji, etc.) and prevented switching between workspaces at all.
+
+Replaced with a three-layer model that works cross-platform and supports multiple workspaces per profile:
+
+1. **Blocklist** — `/etc`, `/usr`, `/var`, `/bin`, `/sbin`, `/boot`, `/proc`, `/sys`, `/dev`, `/root`, `/lib`, `/lib64`, `/opt/homebrew` always rejected, closing the original CVSS 8.8 vulnerability
+2. **Home-directory check** — any path under `Path.home()` is trusted; `Path.home()` is cross-platform (`~/...` on Linux/macOS, `C:\\Users\\...` on Windows); allows all profile workspaces simultaneously since they don't need to share a single ancestor
+3. **Saved-workspace escape hatch** — paths already in the profile's saved workspace list are trusted regardless of location, covering self-hosted deployments with workspaces outside home (`/data/projects`, `/opt/workspace`, etc.)
+
+- `api/workspace.py`: rewritten `resolve_trusted_workspace()` with the three-layer model
+- `tests/test_sprint3.py`: updated error-message assertions from `"trusted workspace root"` → `"outside"` (covers both old and new error strings)
+- 1053 tests total (unchanged)
+
+## [v0.50.34] fix(workspace): restrict session workspaces to trusted roots [SECURITY] (#415)
+
+Session creation, update, chat-start, and workspace-add endpoints accepted arbitrary caller-supplied workspace paths. An authenticated caller could repoint a session to any directory the process could access, then use normal file read/write APIs to operate on attacker-chosen locations. CVSS 8.8 High (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
+
+- `api/workspace.py`: new `resolve_trusted_workspace(path)` helper — resolves path, checks existence + is_dir, enforces `path.relative_to(_BOOT_DEFAULT_WORKSPACE)` containment; requests outside the WebUI workspace root fail with 400
+- `api/routes.py`: apply `resolve_trusted_workspace()` to all four entry points — `POST /api/session/new`, `POST /api/session/update`, `POST /api/chat/start` (workspace override), `POST /api/workspaces/add`
+- `tests/test_sprint3.py`, `tests/test_sprint5.py`: regression tests for rejected outside-root paths on all four entry points; existing workspace tests updated to use trusted child directories
+- `tests/test_sprint1.py`, `tests/test_sprint4.py`, `tests/test_sprint13.py`: aligned to new trusted-root contract
+- Fix: use `_BOOT_DEFAULT_WORKSPACE` (respects `HERMES_WEBUI_DEFAULT_WORKSPACE` env for test isolation) rather than `_profile_default_workspace()` (reads agent terminal.cwd which may differ)
+- Original PR by @Hinotoi-agent (cherry-picked; branch was 6 commits behind master)
+- 1053 tests total (up from 1051; 2 pre-existing test_sprint5 isolation failures on master, not introduced by this PR)
+
+## [v0.50.33] fix: workspace panel close button — no duplicate X on desktop, mobile X respects file preview (#413)
+
+**Bug 1 — Duplicate X on desktop:** `#btnClearPreview` (the X icon) was always visible regardless of panel state, so desktop browse mode showed both the chevron collapse button and the X simultaneously. Fixed in `syncWorkspacePanelUI()`: on non-compact (desktop) viewports, `clearBtn.style.display` is set to `none` when no file preview is open, and cleared (shown) when a preview is active.
+
+**Bug 2 — Mobile X collapsed the whole panel instead of dismissing the file:** `.mobile-close-btn` was wired to `closeWorkspacePanel()` directly, bypassing the two-step close logic. Fixed by changing `onclick` to `handleWorkspaceClose()`, which calls `clearPreview()` first if a file is open, and falls through to `closeWorkspacePanel()` otherwise.
+
+**Also:** widened the `test_server_delete_invalidates_index` window from 600 → 1200 chars to accommodate the session_id validation guards added in v0.50.32 (#412).
+
+- `static/boot.js`: `syncWorkspacePanelUI()` sets `clearBtn.style.display` based on `hasPreview` when `!isCompact`
+- `static/index.html`: `.mobile-close-btn` onclick changed from `closeWorkspacePanel()` to `handleWorkspaceClose()`
+- `tests/test_sprint44.py`: 10 new regression tests covering both fixes
+- `tests/test_mobile_layout.py`: updated to accept `handleWorkspaceClose()` as valid onclick
+- `tests/test_regressions.py`: widened delete handler window to 1200 chars
+- 1051 tests total (up from 1041)
+
+## [v0.50.32] fix(sessions): validate session_id before deleting session files [SECURITY] (#409)
+
+`/api/session/delete` accepted arbitrary `session_id` values from the request body and built the delete path directly as `SESSION_DIR / f"{sid}.json"`. Because pathlib discards the prefix when `sid` is an absolute path, an attacker could supply `/tmp/victim` and cause the server to unlink `victim.json` outside the session store. Traversal-style values (`../../etc/target`) were also accepted. CVSS 8.1 High (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).
+
+- `api/routes.py`: validate `session_id` against `[0-9a-z_]+` allowlist (covers `uuid4().hex[:12]` WebUI IDs and `YYYYMMDD_HHMMSS_hex` CLI IDs) before path construction; resolve candidate path and enforce `path.relative_to(SESSION_DIR)` containment before unlinking; only invalidate session index on successful deletion path, not on rejected requests
+- `tests/test_sprint3.py`: 2 new regression tests — absolute-path payload rejected and file preserved, traversal payload rejected and file preserved
+- Original PR by @Hinotoi-agent (cherry-picked; branch was 4 commits behind master)
+- 1041 tests total (up from 1039)
+
+## [v0.50.31] fix: delegate all live model fetching to agent's provider_model_ids()
+
+`_handle_live_models()` in `api/routes.py` previously maintained its own per-provider fetch logic and returned `not_supported` for Anthropic, Google, and Gemini. Now it delegates entirely to the agent's `hermes_cli.models.provider_model_ids()` — the single authoritative resolver — and `_fetchLiveModels()` in `ui.js` no longer skips any provider.
+
+**What each provider now returns (live data where credentials are present, static fallback otherwise):**
+- `anthropic` — live from `api.anthropic.com/v1/models` (API key or OAuth token with correct beta headers)
+- `copilot` — live from `api.githubcopilot.com/models` with required Copilot headers
+- `openai-codex` — Codex OAuth endpoint → `~/.codex/` cache → `DEFAULT_CODEX_MODELS`
+- `nous` — live from Nous inference portal
+- `deepseek`, `kimi-coding` — generic OpenAI-compat `/v1/models`
+- `opencode-zen`, `opencode-go` — OpenCode live catalog
+- `openrouter` — curated static list (live returns 300+ which floods the picker)
+- `google`, `gemini`, `zai`, `minimax` — static list (non-standard or Anthropic-compat endpoints)
+- All others — graceful static fallback from `_PROVIDER_MODELS`
+
+The hardcoded lists in `_PROVIDER_MODELS` remain as credential-missing / network-unavailable fallbacks. `api/routes.py` shrank by ~100 lines. Updated 2 tests to reflect the improved behavior.
+
+- 1039 tests total (up from 1038)
+
+## [v0.50.30] fix: openai-codex live model fetch routes through agent's get_codex_model_ids()
+
+`_handle_live_models()` was grouping `openai-codex` with `openai` and sending `GET https://api.openai.com/v1/models` — which returns 403 because Codex auth is OAuth-based via `chatgpt.com`, not a standard API key. The live fetch silently failed, so users only ever saw the hardcoded static list.
+
+- `api/routes.py`: dedicated early-return branch for `openai-codex` that calls `hermes_cli.codex_models.get_codex_model_ids()` — the same resolver the agent CLI uses. Resolution order: live Codex API (if OAuth token available, hits `chatgpt.com/backend-api/codex/models`) → `~/.codex/` local cache (written by the Codex CLI) → `DEFAULT_CODEX_MODELS` hardcoded fallback. Users with a valid Codex session now get their exact subscription model list including any models not in the hardcoded list.
+- `api/routes.py`: improved label generation for Codex model IDs (e.g. `gpt-5.4-mini` → `GPT 5.4 Mini`)
+- `tests/test_opencode_providers.py`: structural regression test verifying the dedicated `openai-codex` branch exists and calls `get_codex_model_ids()`
+- 1038 tests total (up from 1037)
+
+## [v0.50.29] fix: correct tool call card rendering on session load after context compaction (closes #401) (#402)
+
+- `static/sessions.js`: replace the flat B9 filter in `loadSession()` with a full sanitization pass that builds `origIdxToSanitizedIdx` — each `session.tool_calls[].assistant_msg_idx` is remapped to the new sanitized-array position as messages are filtered; for tool calls whose empty-assistant host was filtered out, they attach to the nearest prior kept assistant
+- `static/sessions.js`: set `S.toolCalls=[]` instead of pre-filling from session-level `tool_calls` — this lets `renderMessages()` use its fallback derivation from per-message `tool_calls` (which already carry correct indices into the sanitized message array); the fix eliminates the "200+ tool cards all on the wrong message" symptom on context-compacted session load
+- `tests/test_issue401.py`: 8 regression tests — 4 static structural checks and 4 behavioural Node.js tests covering index remapping, multiple consecutive empty assistants, no-filtering pass-through, and `tool`-role message exclusion
+- Original PR by @franksong2702 (cherry-picked onto master; branch was 31 commits behind)
+- 1037 tests total (up from 1029)
+
+## [v0.50.28] fix: expand openai-codex model catalog to match DEFAULT_CODEX_MODELS
+
+`_PROVIDER_MODELS["openai-codex"]` only listed `codex-mini-latest`, so profiles using the `openai-codex` provider (e.g. a CodePath profile with `default: gpt-5.4`) showed only one entry in the model dropdown. Updated to mirror the agent's authoritative `DEFAULT_CODEX_MODELS` list: `gpt-5.4`, `gpt-5.4-mini`, `gpt-5.3-codex`, `gpt-5.2-codex`, `gpt-5.1-codex-max`, `gpt-5.1-codex-mini`, `codex-mini-latest`. Added 2 regression tests.
+
+- 1029 tests total (up from 1027)
+
+## [v0.50.27] feat: relative time labels in session sidebar (#394)
+
+- `static/sessions.js`: new `_sessionCalendarBoundaries()` (DST-safe via `new Date(y,m,d)` construction), `_localDayOrdinal()`, `_formatSessionDate()` (includes year for dates from prior years); `_formatRelativeSessionTime()` now uses calendar midnight boundaries consistent with `_sessionTimeBucketLabel()` — no more label/bucket mismatch; all relative time strings call `t()` for localization; meta row only appended when non-empty (removes redundant group-header fallback); dead `ONE_DAY` constant removed
+- `static/style.css`: add `session-item.active .session-title{color:#1a5a8a}` to light-theme block (fixes active title color in light mode)
+- `static/i18n.js`: 11 new i18n keys (`session_time_*`) in both English and Spanish locale blocks; callable keys use arrow-function pattern consistent with existing `n_messages`
+- `tests/test_session_sidebar_relative_time.py`: 5 tests — structural presence checks, behavioral Node.js tests via subprocess (yesterday/week boundary correctness, `just now` threshold, year-in-date for old sessions, full i18n key coverage for en+es)
+- Original PR by @Jordan-SkyLF (two-pass review: blocking issues fixed in second commit)
+- 1027 tests total (up from 1022)
+
 ## [v0.50.26] fix(sessions): redact sensitive titles in session list and search responses [SECURITY] (#400)
 
 - `api/routes.py`: apply `_redact_text()` to session titles in all four response paths — `/api/sessions` merged list, `/api/sessions/search` empty-q, title-match, and content-match; use `dict(s)` copy before mutating to avoid corrupting the in-memory session cache

CONTRIBUTING.md

@@ -0,0 +1,171 @@
+# Contributing to Hermes WebUI
+
+Thanks for contributing.
+
+Hermes WebUI is intentionally simple to work on: Python on the server, vanilla JS in the browser, no build step, no bundler, no frontend framework. The best pull requests preserve that simplicity while solving a real problem cleanly.
+
+## Two Paths to a Strong Pull Request
+
+### Path 1: Small, Focused Changes
+
+This is the fastest path to review and merge.
+
+- Fix one clear bug or add one tightly scoped improvement
+- Touch the fewest files you can
+- Avoid drive-by refactors mixed into functional changes
+- Run the relevant tests locally before opening the PR
+- Keep the PR description concise and specific
+
+These are the changes that are easiest to review and safest to merge quickly.
+
+### Path 2: Bigger Changes
+
+If you want to change architecture, reshape a workflow, add a substantial UI feature, or alter core behavior, align on direction first.
+
+- Open an issue, start a discussion, or open a draft PR early
+- Explain the problem you are solving, not just the implementation you want
+- Call out tradeoffs, migration risk, and any alternatives you considered
+- Keep the final PR easy to review by separating unrelated work
+
+Large changes are welcome, but surprise rewrites are hard to review well.
+
+## What We Expect in Every PR
+
+### 1. One Logical Change Per PR
+
+Keep each PR focused. A small related group of fixes is fine. A bug fix plus a CSS cleanup plus a refactor plus a docs rewrite is not.
+
+### 2. Local Verification
+
+Run the test suite locally:
+
+```bash
+pytest tests/ -v --timeout=60
+```
+
+CI also runs this suite on Python `3.11`, `3.12`, and `3.13`.
+
+If your change affects browser behavior, also run the relevant manual checks from [TESTING.md](TESTING.md).
+
+### 3. Clear PR Description
+
+There is currently no PR template in this repo, so include the important sections yourself:
+
+- Thinking Path
+- What Changed
+- Why It Matters
+- Verification
+- Risks / Follow-ups
+- Model Used
+
+If the change is user-visible, include screenshots or a short video.
+
+For UI or UX changes, before/after images are required. PRs that change the interface or interaction flow without before/after images will likely be ignored, or closed in a regular maintainer sweep without review.
+
+### 4. AI Usage Disclosure
+
+If AI helped produce the change, say so in the PR description.
+
+Include:
+
+- Provider
+- Exact model name or ID
+- Any notable mode or tool use that mattered
+
+If no AI was used, write: `None — human-authored`.
+
+### 5. Keep the Docs Honest
+
+If your change alters behavior, architecture, testing, setup, or user-facing workflows, update the relevant docs in the same PR.
+
+Common files:
+
+- [README.md](README.md) for setup, usage, and contributor-facing commands
+- [ROADMAP.md](ROADMAP.md) for shipped features and sprint history
+- [ARCHITECTURE.md](ARCHITECTURE.md) for implementation details and design constraints
+- [TESTING.md](TESTING.md) for manual and automated verification guidance
+- [CHANGELOG.md](CHANGELOG.md) when maintainers want release-note-ready entries
+
+## Project-Specific Guidelines
+
+### Preserve the Design Constraints
+
+Hermes WebUI is deliberately:
+
+- No build step
+- No bundler
+- No frontend framework
+- Easy to modify from a terminal
+
+Do not introduce new infrastructure or dependencies unless the gain is clear and the tradeoff is justified.
+
+### Match the Existing Shape of the Codebase
+
+- Server logic belongs in `api/` with `server.py` staying thin
+- Frontend behavior belongs in the existing `static/*.js` modules
+- Prefer extending current patterns over introducing parallel abstractions
+- Keep changes legible to future contributors working directly from the repo in a terminal
+
+### Be Careful With User-Facing Changes
+
+This project is heavily UI-driven. If you change interaction flows, session behavior, workspace browsing, onboarding, or mobile layouts:
+
+- test the happy path
+- test reload behavior where relevant
+- test narrow/mobile layouts where relevant
+- include before/after images in the PR
+
+### Security and Safety Matter
+
+This app can expose workspace contents, run agent actions, and optionally sit behind a reverse proxy or Docker deployment. Treat auth, path handling, uploads, streaming, and environment handling as high-risk areas.
+
+If your PR touches security-sensitive behavior, say so explicitly in the PR description and explain how you verified it.
+
+## Writing a Good PR Message
+
+Start with a short Thinking Path that explains the chain from project goal to the specific fix.
+
+Example:
+
+> - Hermes WebUI aims for near 1:1 parity with the Hermes CLI in a browser
+> - Long-running chat turns rely on SSE streaming and session recovery
+> - Reloading during an in-flight turn can leave the UI in an inconsistent state
+> - The bug was that recovered sessions restored messages but not the live stream state
+> - This PR fixes the recovery path so in-flight turns reconnect cleanly after reload
+> - The benefit is that users can refresh or reconnect without losing visibility into active work
+
+Another example:
+
+> - Hermes WebUI is intentionally a simple Python + vanilla JS application
+> - The right panel is used for workspace browsing and previews
+> - On mobile, panel state changes need to be obvious and touch-friendly
+> - The existing close affordance was inconsistent with the bottom-nav flow
+> - This PR fixes the mobile panel close behavior and aligns it with the current navigation model
+> - The result is fewer dead-end UI states on phones
+
+After that, cover:
+
+- what you changed
+- why you changed it
+- how you verified it
+- what risks remain
+
+## Review Tips
+
+Want the smoothest review?
+
+- Keep diffs tight
+- Name things clearly
+- Avoid unnecessary rewrites
+- Add short comments only where the code would otherwise be hard to follow
+- Respond directly to review feedback and update the PR description if the scope changes
+
+## Development References
+
+- [README.md](README.md)
+- [ARCHITECTURE.md](ARCHITECTURE.md)
+- [TESTING.md](TESTING.md)
+- [ROADMAP.md](ROADMAP.md)
+- [SPRINTS.md](SPRINTS.md)
+
+Questions are best raised early, before a large change is finished.

README.md

@@ -277,8 +277,8 @@ WireGuard. Install it on your server and your phone, and they join the same
 private network -- no port forwarding, no SSH tunnels, no public exposure.
 
 The Hermes Web UI is fully responsive with a mobile-optimized layout
-(hamburger sidebar, bottom navigation bar, touch-friendly controls), so it
-works well as a daily-driver agent interface from your phone.
+(hamburger sidebar, sidebar top tabs in the drawer, touch-friendly controls),
+so it works well as a daily-driver agent interface from your phone.
 
 **Setup:**
 
@@ -451,10 +451,10 @@ across 53 test files.
 
 ### Mobile responsive
 - Hamburger sidebar -- slide-in overlay on mobile (<640px)
-- Bottom navigation bar -- 5-tab iOS-style fixed bar
+- Sidebar top tabs stay available on mobile; no fixed bottom nav stealing chat height
 - Files slide-over panel from right edge
 - Touch targets minimum 44px on all interactive elements
-- Composer positioned above bottom nav
+- Full-height chat/composer on phones without bottom-nav spacing
 - Desktop layout completely unchanged
 
 ---
@@ -542,7 +542,7 @@ A run of focused quality-of-life improvements: terminal tool approval prompts th
 Added the 7th built-in theme: pure black backgrounds with warm accents tuned to reduce burn-in risk. Small diff, big impact for anyone on an OLED display.
 
 **[@Bobby9228](https://github.com/Bobby9228)** — Mobile Profiles button + Android Chrome fixes (PRs #253, #263, #265)
-Added the Profiles tab to the mobile bottom navigation bar, making profile switching reachable on phones, plus a set of Android Chrome-specific fixes for the profile dropdown.
+Added the Profiles entry to the mobile navigation flow, making profile switching reachable on phones, plus a set of Android Chrome-specific fixes for the profile dropdown.
 
 **[@franksong2702](https://github.com/franksong2702)** — Session title guard + breadcrumb nav (PRs #301, #302)
 Two clean bug fixes / features: the session title guard that stops `title_from()` from overwriting user-renamed sessions after every turn, and clickable breadcrumb navigation in the workspace file preview panel.

ROADMAP.md

@@ -3,10 +3,10 @@
 > Goal: Full 1:1 parity with the Hermes CLI experience via a clean dark web UI.
 > Everything you can do from the CLI terminal, you can do from this UI.
 >
-> Last updated: v0.50.21 (April 13, 2026) — 961 tests, 961 passing
-> Full production-ready: onboarding wizard, multi-profile support, KaTeX math rendering,
-> live reasoning cards with localStorage reload recovery, CSRF reverse proxy fixes, Docker improvements.
-> Tests: 961 total (961 passing, 0 failures)
+> Last updated: v0.50.36-local.1 (April 14, 2026) — 1059 tests, 1059 passing
+> Full production-ready: upstream v0.50.36 synced locally, with only the first-password session continuity patch retained.
+> Local delta: enabling password from Settings keeps the current browser signed in; the former Assistant Reply Language enhancement has been removed.
+> Tests: 1059 total (1059 passing, 0 failures)
 > Source: <repo>/
 
 ---
@@ -39,7 +39,7 @@
 | Sprint 18 | Thinking display + workspace tree | File preview auto-close, thinking/reasoning cards, expandable directory tree (#22) | 318 |
 | Sprint 19 | Auth + security hardening | Password auth (off by default), login page, security headers, 20MB body limit (#23) | 328 |
 | Sprint 20 | Voice input + send button | Voice input (Web Speech API), send button icon-circle with pop-in animation | 415 |
-| Sprint 21 | Mobile responsive + Docker | Hamburger sidebar, bottom nav, files slide-over, Docker support (#21, #7) | 415 |
+| Sprint 21 | Mobile responsive + Docker | Hamburger sidebar, mobile nav, files slide-over, Docker support (#21, #7) | 415 |
 | Sprint 22 | Multi-profile support | Profile picker, management panel, seamless switching, per-session tracking (#28) | 415 |
 | Sprint 23 | Agentic transparency | Token/cost display, subagent cards, skill picker in cron, skill linked files, workspace tree persistence, timestamp fixes | 424 |
 | v0.44.0 patch | Fix batch: approval card, login CSP, update diagnostics, Lucide icons | PRs #221 #225 #226 #227 #228 | 579 |
@@ -50,7 +50,7 @@
 | v0.48.0 | Gateway session sync | Real-time Telegram/Discord/Slack sessions in sidebar via SSE + DB polling (#274 @bergeouss); +10 tests | 658 |
 | v0.48.1 | Table inline formatting | `inlineMd()` in table cells — **bold**, *italic*, `code`, links render correctly (PR #278); 0 new tests | 658 |
 | v0.48.2 | Provider mismatch warning | Toast warning + auth_mismatch error type for provider/model mismatches (#283, fixes #266); +21 tests | 679 |
-| v0.49.1 | Docker docs + mobile Profiles button | Two-container Docker compose (#291/#288); Profiles button in mobile bottom nav with mobileSwitchPanel, data-panel, correct SVG size and position (#297/#265 @gabogabucho); +3 tests | 700 |
+| v0.49.1 | Docker docs + mobile Profiles button | Two-container Docker compose (#291/#288); Profiles added to the mobile navigation flow with correct panel wiring and SVG sizing (#297/#265 @gabogabucho); +3 tests | 700 |
 | v0.49.0 | First-run onboarding wizard + self-update hardening | One-shot bootstrap + guided setup wizard; provider config persisted to config.yaml + .env; OpenRouter/Anthropic/OpenAI/Custom; wizard hidden after completion (#285); self-update stderr/split-ref/conflict fixes (#287); skip flaky redaction test (#289); +18 tests | 697 |
 | v0.32 | Auto-compaction handling | Compression detection, /compact command, real context window indicator | 424 |
 | v0.33 | /insights sync | Opt-in state.db sync so `hermes /insights` includes WebUI sessions | 424 |
@@ -74,6 +74,7 @@
 | v0.50.16–v0.50.17 | CSRF reverse proxy + Docker uv pre-install | Scheme-aware CSRF port normalization for non-standard ports (@lx3133584), Docker uv pre-installed at build time as root (fixes air-gapped startup, @mmartial-pattern) | 900 |
 | v0.50.18–v0.50.19 | Workspace fallback + Unicode filenames | Cascading workspace path recovery (@Jordan-SkyLF), Unicode Content-Disposition headers with RFC 5987 filename* (@shaoxianbilly), silent auth error surfacing, stale model cleanup | 924 |
 | v0.50.20–v0.50.21 | Silent errors + live model fetching + durable streaming recovery | apperror on empty agent response, /api/models/live endpoint with SSRF guard, live reasoning cards, tool_complete SSE events, SESSION_QUEUES, localStorage reload recovery (@Jordan-SkyLF) | 961 |
+| v0.50.22–v0.50.36-local.1 | Upstream sync + minimal local patch retention | Synced to upstream `v0.50.36`; retained first-password session continuity in Settings/onboarding; removed local Assistant Reply Language enhancement; added legacy settings cleanup regression coverage | 1059 |
 
 ---
 
@@ -223,7 +224,7 @@
 - [x] Voice input via Web Speech API (Sprint 20)
 
 ### Mobile
-- [x] Mobile responsive layout — hamburger sidebar, bottom nav, files slide-over (Sprint 21)
+- [x] Mobile responsive layout — hamburger sidebar, sidebar tabs on phones, files slide-over (Sprint 21 + later mobile nav simplification)
 
 ### Profiles
 - [x] Multi-profile support — create, switch, delete profiles (Sprint 22, Issue #28)

TESTING.md

@@ -8,7 +8,7 @@
 > Prerequisites: SSH tunnel is active on port 8787. Open http://localhost:8787 in browser.
 > Server health check: curl http://127.0.0.1:8787/health should return {"status":"ok"}.
 >
-> Automated tests: 961 total (961 passing, 0 known failures). Includes onboarding coverage for bootstrap/static wizard presence, real provider config persistence (`config.yaml` + `.env`), and the `/api/onboarding/*` backend.
+> Automated tests: 1098 total (1098 passing, 0 known failures). Includes onboarding coverage for bootstrap/static wizard presence, real provider config persistence (`config.yaml` + `.env`), the `/api/onboarding/*` backend, and the onboarding skip/existing-config guard.
 > Run: `pytest tests/ -v --timeout=60`
 
 ---
@@ -1715,12 +1715,13 @@ Each has automated API-level tests in `tests/test_sprint{N}.py`.
 - Open on mobile viewport (<640px): hamburger icon visible in topbar.
 - Tap hamburger → sidebar slides in from left with backdrop overlay.
 - Tap outside sidebar → closes. Tap a session → closes and loads session.
-- Bottom navigation bar: 5 tabs (Chat, Tasks, Skills, Memory, Spaces).
-- Tap "Tasks" in bottom nav → sidebar opens showing Tasks panel.
-- Tap "Chat" in bottom nav → sidebar closes (chat is in main area).
+- Sidebar top nav remains visible inside the mobile drawer; includes Chat/Tasks/Skills/Memory/Spaces/Profile tabs.
+- Tap "Tasks" in the drawer nav → Tasks panel opens in the sidebar drawer.
+- Tap "Chat" in the drawer nav → sidebar closes and chat is unobstructed in the main area.
 - Files button in topbar → right panel slides in from right.
+- No fixed mobile bottom nav; chat transcript and composer use the reclaimed vertical space.
 - All touch targets are at least 44px (session items, buttons, icons).
-- Desktop viewport (>640px): no hamburger, no bottom nav, no mobile elements.
+- Desktop viewport (>640px): no hamburger or mobile overlay; desktop layout unchanged.
 - Docker: `docker compose up -d` starts server on port 8787.
 - Docker: session data persists across container restarts (named volume).
 

api/config.py

@@ -466,7 +466,13 @@ _PROVIDER_MODELS = {
         {"id": "o4-mini", "label": "o4-mini"},
     ],
     "openai-codex": [
-        {"id": "codex-mini-latest", "label": "Codex Mini"},
+        {"id": "gpt-5.4", "label": "GPT-5.4"},
+        {"id": "gpt-5.4-mini", "label": "GPT-5.4 Mini"},
+        {"id": "gpt-5.3-codex", "label": "GPT-5.3 Codex"},
+        {"id": "gpt-5.2-codex", "label": "GPT-5.2 Codex"},
+        {"id": "gpt-5.1-codex-max", "label": "GPT-5.1 Codex Max"},
+        {"id": "gpt-5.1-codex-mini", "label": "GPT-5.1 Codex Mini"},
+        {"id": "codex-mini-latest", "label": "Codex Mini (latest)"},
     ],
     "google": [
         {"id": "gemini-2.5-pro", "label": "Gemini 2.5 Pro"},
@@ -631,7 +637,10 @@ def resolve_model_provider(model_id: str) -> tuple:
         # just because the model name contains a slash (e.g. google/gemma-4-26b-a4b).
         # The user has explicitly pointed at a base_url, so trust their routing config.
         if config_base_url:
-            return model_id, config_provider, config_base_url
+            # Strip provider prefix (e.g. 'openai/gpt-5.4' -> 'gpt-5.4') so prefixed
+            # model IDs from previous sessions don't break custom endpoint routing.
+            bare_model = model_id.split('/', 1)[-1]
+            return bare_model, config_provider, config_base_url
         # If prefix does NOT match config provider, the user picked a cross-provider model
         # from the OpenRouter dropdown (e.g. config=anthropic but picked openai/gpt-5.4-mini).
         # In this case always route through openrouter with the full provider/model string.
@@ -1120,6 +1129,7 @@ _SETTINGS_DEFAULTS = {
     "bubble_layout": False,  # right-aligned user / left-aligned assistant chat bubbles
     "password_hash": None,  # PBKDF2-HMAC-SHA256 hash; None = auth disabled
 }
+_SETTINGS_LEGACY_DROP_KEYS = {"assistant_language"}
 
 
 def load_settings() -> dict:
@@ -1129,7 +1139,13 @@ def load_settings() -> dict:
         try:
             stored = json.loads(SETTINGS_FILE.read_text(encoding="utf-8"))
             if isinstance(stored, dict):
-                settings.update(stored)
+                settings.update(
+                    {
+                        k: v
+                        for k, v in stored.items()
+                        if k not in _SETTINGS_LEGACY_DROP_KEYS
+                    }
+                )
         except Exception:
             logger.debug("Failed to load settings from %s", SETTINGS_FILE)
     return settings

api/gateway_watcher.py

@@ -66,6 +66,7 @@ def _get_agent_sessions_from_db() -> list:
                 LEFT JOIN messages m ON m.session_id = s.id
                 WHERE s.source IS NOT NULL AND s.source != 'webui'
                 GROUP BY s.id
+                HAVING COUNT(m.id) > 0
                 ORDER BY COALESCE(MAX(m.timestamp), s.started_at) DESC
                 LIMIT 200
             """)
@@ -74,7 +75,7 @@ def _get_agent_sessions_from_db() -> list:
                 sessions.append({
                     'session_id': row['id'],
                     'title': row['title'] or 'Agent Session',
-                    'model': row['model'] or 'unknown',
+                    'model': row['model'] or None,
                     'message_count': row['message_count'] or 0,
                     'created_at': row['started_at'],
                     'updated_at': row['last_activity'] or row['started_at'],

api/models.py

@@ -309,7 +309,7 @@ def get_cli_sessions() -> list:
                     'session_id': sid,
                     'title': _display_title,
                     'workspace': str(get_last_workspace()),
-                    'model': row['model'] or 'unknown',
+                    'model': row['model'] or None,
                     'message_count': row['message_count'] or 0,
                     'created_at': row['started_at'],
                     'updated_at': raw_ts,

api/onboarding.py

@@ -404,8 +404,15 @@ def get_onboarding_status() -> dict:
     skip_requested = skip_env in {"1", "true", "yes"}
     auto_completed = skip_requested and bool(runtime.get("chat_ready"))
 
+    # Auto-complete for existing Hermes users: if config.yaml already exists
+    # AND the system is chat_ready, treat onboarding as done.  These users
+    # configured Hermes via the CLI before the Web UI existed; they must never
+    # be shown the first-run wizard — it would silently overwrite their config.
+    config_exists = Path(_get_config_path()).exists()
+    config_auto_completed = config_exists and bool(runtime.get("chat_ready"))
+
     return {
-        "completed": bool(settings.get("onboarding_completed")) or auto_completed,
+        "completed": bool(settings.get("onboarding_completed")) or auto_completed or config_auto_completed,
         "settings": {
             "default_model": settings.get("default_model") or DEFAULT_MODEL,
             "default_workspace": settings.get("default_workspace")
@@ -454,7 +461,21 @@ def apply_onboarding_setup(body: dict) -> dict:
         if parsed.scheme not in {"http", "https"}:
             raise ValueError("base_url must start with http:// or https://")
 
-    cfg = _load_yaml_config(_get_config_path())
+    config_path = _get_config_path()
+    # Guard: if config.yaml already exists and the caller did not explicitly
+    # acknowledge the overwrite, refuse to proceed.  The frontend must pass
+    # confirm_overwrite=True after showing the user a confirmation step.
+    if Path(config_path).exists() and not body.get("confirm_overwrite"):
+        return {
+            "error": "config_exists",
+            "message": (
+                "Hermes is already configured (config.yaml exists). "
+                "Pass confirm_overwrite=true to overwrite it."
+            ),
+            "requires_confirm": True,
+        }
+
+    cfg = _load_yaml_config(config_path)
     env_path = _get_active_hermes_home() / ".env"
     env_values = _load_env_file(env_path)
 
@@ -478,7 +499,7 @@ def apply_onboarding_setup(body: dict) -> dict:
         model_cfg.pop("base_url", None)
 
     cfg["model"] = model_cfg
-    _save_yaml_config(_get_config_path(), cfg)
+    _save_yaml_config(config_path, cfg)
 
     if api_key:
         _write_env_file(env_path, {provider_meta["env_var"]: api_key})

api/routes.py

@@ -180,6 +180,7 @@ from api.workspace import (
     list_dir,
     read_file_content,
     safe_resolve_ws,
+    resolve_trusted_workspace,
 )
 from api.upload import handle_upload, handle_transcribe
 from api.streaming import _sse, _run_agent_streaming, cancel_stream
@@ -227,6 +228,24 @@ _LOGIN_LOCALE = {
         "invalid_pw": "Invalid password",
         "conn_failed": "Connection failed",
     },
+    "es": {
+        "lang": "es-ES",
+        "title": "Iniciar sesi\u00f3n",
+        "subtitle": "Introduce tu contrase\u00f1a para continuar",
+        "placeholder": "Contrase\u00f1a",
+        "btn": "Entrar",
+        "invalid_pw": "Contrase\u00f1a inv\u00e1lida",
+        "conn_failed": "Error de conexi\u00f3n",
+    },
+    "de": {
+        "lang": "de-DE",
+        "title": "Anmelden",
+        "subtitle": "Geben Sie Ihr Passwort ein, um fortzufahren",
+        "placeholder": "Passwort",
+        "btn": "Anmelden",
+        "invalid_pw": "Ung\u00fcltiges Passwort",
+        "conn_failed": "Verbindung fehlgeschlagen",
+    },
     "zh": {
         "lang": "zh-CN",
         "title": "\u767b\u5f55",
@@ -236,8 +255,49 @@ _LOGIN_LOCALE = {
         "invalid_pw": "\u5bc6\u7801\u9519\u8bef",
         "conn_failed": "\u8fde\u63a5\u5931\u8d25",
     },
+    "zh-Hant": {
+        "lang": "zh-TW",
+        "title": "\u767b\u5f55",
+        "subtitle": "\u8f38\u5165\u5bc6\u78bc\u7e7c\u7e8c\u4f7f\u7528",
+        "placeholder": "\u5bc6\u78bc",
+        "btn": "\u767b\u5f55",
+        "invalid_pw": "\u5bc6\u78bc\u932f\u8aa4",
+        "conn_failed": "\u9023\u63a5\u5931\u6557",
+    },
 }
 
+
+def _resolve_login_locale_key(raw_lang: str | None) -> str:
+    """Resolve settings.language to a known _LOGIN_LOCALE key."""
+    if not raw_lang:
+        return "en"
+    lang = str(raw_lang).strip()
+    if not lang:
+        return "en"
+    if lang in _LOGIN_LOCALE:
+        return lang
+
+    normalized = lang.replace("_", "-")
+    lower = normalized.lower()
+
+    # Case-insensitive direct key match first.
+    for key in _LOGIN_LOCALE:
+        if key.lower() == lower:
+            return key
+
+    # Common Chinese aliases.
+    if lower == "zh" or lower.startswith("zh-cn") or lower.startswith("zh-sg") or lower.startswith("zh-hans"):
+        return "zh"
+    if lower.startswith("zh-tw") or lower.startswith("zh-hk") or lower.startswith("zh-mo") or lower.startswith("zh-hant"):
+        return "zh-Hant" if "zh-Hant" in _LOGIN_LOCALE else "zh"
+
+    # Fallback to base language subtag (e.g. en-US -> en).
+    base = lower.split("-", 1)[0]
+    for key in _LOGIN_LOCALE:
+        if key.lower() == base:
+            return key
+    return "en"
+
 # ── Login page (self-contained, no external deps) ────────────────────────────
 _LOGIN_PAGE_HTML = """<!doctype html>
 <html lang="{{LANG}}"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
@@ -293,7 +353,9 @@ def handle_get(handler, parsed) -> bool:
         _settings = load_settings()
         _bn = _html.escape(_settings.get("bot_name") or "Hermes")
         _lang = _settings.get("language", "en")
-        _login_strings = _LOGIN_LOCALE.get(_lang, _LOGIN_LOCALE["en"])
+        _login_strings = _LOGIN_LOCALE[
+            _resolve_login_locale_key(_lang)
+        ]
         _page = (
             _LOGIN_PAGE_HTML.replace("{{BOT_NAME}}", _bn)
             .replace("{{BOT_NAME_INITIAL}}", _bn[0].upper())
@@ -638,7 +700,11 @@ def handle_post(handler, parsed) -> bool:
     body = read_body(handler)
 
     if parsed.path == "/api/session/new":
-        s = new_session(workspace=body.get("workspace"), model=body.get("model"))
+        try:
+            workspace = str(resolve_trusted_workspace(body.get("workspace"))) if body.get("workspace") else None
+        except ValueError as e:
+            return bad(handler, str(e))
+        s = new_session(workspace=workspace, model=body.get("model"))
         return j(handler, {"session": s.compact() | {"messages": s.messages}})
 
     if parsed.path == "/api/sessions/cleanup":
@@ -713,7 +779,10 @@ def handle_post(handler, parsed) -> bool:
             s = get_session(body["session_id"])
         except KeyError:
             return bad(handler, "Session not found", 404)
-        new_ws = str(Path(body.get("workspace", s.workspace)).expanduser().resolve())
+        try:
+            new_ws = str(resolve_trusted_workspace(body.get("workspace", s.workspace)))
+        except ValueError as e:
+            return bad(handler, str(e))
         s.workspace = new_ws
         s.model = body.get("model", s.model)
         s.save()
@@ -724,10 +793,16 @@ def handle_post(handler, parsed) -> bool:
         sid = body.get("session_id", "")
         if not sid:
             return bad(handler, "session_id is required")
+        if not all(c in '0123456789abcdefghijklmnopqrstuvwxyz_' for c in sid):
+            return bad(handler, "Invalid session_id", 400)
         # Delete from WebUI session store
         with LOCK:
             SESSIONS.pop(sid, None)
-        p = SESSION_DIR / f"{sid}.json"
+        try:
+            p = (SESSION_DIR / f"{sid}.json").resolve()
+            p.relative_to(SESSION_DIR.resolve())
+        except Exception:
+            return bad(handler, "Invalid session_id", 400)
         try:
             p.unlink(missing_ok=True)
         except Exception:
@@ -912,11 +987,56 @@ def handle_post(handler, parsed) -> bool:
 
     # ── Settings (POST) ──
     if parsed.path == "/api/settings":
+        from api.auth import (
+            create_session,
+            is_auth_enabled,
+            parse_cookie,
+            set_auth_cookie,
+            verify_session,
+        )
+
         if "bot_name" in body:
             body["bot_name"] = (str(body["bot_name"]) or "").strip() or "Hermes"
+
+        auth_enabled_before = is_auth_enabled()
+        current_cookie = parse_cookie(handler)
+        logged_in_before = bool(current_cookie and verify_session(current_cookie))
+        requested_password = bool(
+            isinstance(body.get("_set_password"), str)
+            and body.get("_set_password", "").strip()
+        )
+
         saved = save_settings(body)
         saved.pop("password_hash", None)  # never expose hash to client
-        return j(handler, saved)
+
+        auth_enabled_after = is_auth_enabled()
+        auth_just_enabled = bool(
+            requested_password and auth_enabled_after and not auth_enabled_before
+        )
+        logged_in_after = logged_in_before
+        new_cookie = None
+
+        if auth_just_enabled and not logged_in_before:
+            new_cookie = create_session()
+            logged_in_after = True
+
+        saved["auth_enabled"] = auth_enabled_after
+        saved["logged_in"] = logged_in_after
+        saved["auth_just_enabled"] = auth_just_enabled
+
+        if not new_cookie:
+            return j(handler, saved)
+
+        response_body = json.dumps(saved, ensure_ascii=False, indent=2).encode("utf-8")
+        handler.send_response(200)
+        handler.send_header("Content-Type", "application/json; charset=utf-8")
+        handler.send_header("Content-Length", str(len(response_body)))
+        handler.send_header("Cache-Control", "no-store")
+        set_auth_cookie(handler, new_cookie)
+        _security_headers(handler)
+        handler.end_headers()
+        handler.wfile.write(response_body)
+        return True
 
     if parsed.path == "/api/onboarding/setup":
         # Writing API keys to disk - restrict to local/private networks unless auth is active.
@@ -1448,140 +1568,87 @@ def _handle_approval_inject(handler, parsed):
 
 
 def _handle_live_models(handler, parsed):
-    """Fetch the live model list from a provider's /v1/models endpoint.
+    """Return the live model list for a provider.
 
-    Returns the provider's actual model catalog so the UI can show all
-    available models, not just the hardcoded fallback list.
+    Delegates to the agent's provider_model_ids() which handles:
+    - OpenRouter: live fetch from /api/v1/models
+    - Anthropic: live fetch from /v1/models (API key or OAuth token)
+    - Copilot: live fetch from api.githubcopilot.com/models with correct headers
+    - openai-codex: Codex OAuth endpoint + local ~/.codex/ cache fallback
+    - Nous: live fetch from inference-api.nousresearch.com/v1/models
+    - DeepSeek, kimi-coding, opencode-zen/go, custom: generic OpenAI-compat /v1/models
+    - ZAI, MiniMax, Google/Gemini: fall back to static list (non-standard endpoints)
+    - All others: static _PROVIDER_MODELS fallback
+
+    The agent already maintains all provider-specific auth and endpoint logic
+    in one place; the WebUI inherits it rather than duplicating it.
 
     Query params:
-        provider  (optional) — provider ID to fetch for; defaults to active
-        base_url  (optional) — override the base URL for the provider
-
-    Providers that don't expose a /v1/models endpoint (Anthropic) are not
-    supported here — the caller should fall back to the static list.
-
-    Supported: openai, openrouter, custom (any OpenAI-compatible endpoint).
+        provider  (optional) — provider ID; defaults to active profile provider
     """
-    import urllib.request as _ur
-    import ipaddress as _ip
-    import socket as _sock
-    from urllib.parse import urlparse as _up
-
     qs = parse_qs(parsed.query)
     provider = (qs.get("provider", [""])[0] or "").lower().strip()
-    base_url_override = (qs.get("base_url", [""])[0] or "").strip()
 
     try:
-        from api.config import get_config as _gc, resolve_model_provider as _rmp
+        from api.config import get_config as _gc
         cfg = _gc()
-        active_provider = cfg.get("model", {}).get("provider") or ""
         if not provider:
-            provider = active_provider
+            provider = cfg.get("model", {}).get("provider") or ""
+        if not provider:
+            return j(handler, {"error": "no_provider", "models": []})
 
-        # Resolve API key and base URL for this provider
-        api_key = None
-        base_url = base_url_override or ""
+        # Delegate to the agent's live-fetch + fallback resolver.
+        # provider_model_ids() tries live endpoints first and falls back to
+        # the static _PROVIDER_MODELS list — it never raises.
         try:
-            from hermes_cli.runtime_provider import resolve_runtime_provider
-            rt = resolve_runtime_provider(requested=provider)
-            api_key = rt.get("api_key")
-            if not base_url:
-                base_url = rt.get("base_url") or ""
-        except Exception:
-            pass
+            import sys as _sys
+            import os as _os
+            _agent_dir = _os.path.join(_os.path.dirname(_os.path.dirname(_os.path.abspath(__file__))),
+                                       "..", "..", ".hermes", "hermes-agent")
+            _agent_dir = _os.path.normpath(_agent_dir)
+            if _agent_dir not in _sys.path:
+                _sys.path.insert(0, _agent_dir)
+            from hermes_cli.models import provider_model_ids as _pmi
+            ids = _pmi(provider)
+        except Exception as _import_err:
+            logger.debug("provider_model_ids import failed for %s: %s", provider, _import_err)
+            # Last resort: return the WebUI's own static catalog
+            from api.config import _PROVIDER_MODELS as _pm
+            ids = [m["id"] for m in _pm.get(provider, [])]
 
-        # Determine the /v1/models endpoint URL
-        if not base_url:
-            if provider in ("openai", "openai-codex", "copilot"):
-                base_url = "https://api.openai.com/v1"
-            elif provider == "openrouter":
-                base_url = "https://openrouter.ai/api/v1"
-            elif provider in ("anthropic",):
-                # Anthropic doesn't support /v1/models in a standard way
-                return j(handler, {"error": "not_supported", "models": []})
-            elif provider in ("google", "gemini"):
-                return j(handler, {"error": "not_supported", "models": []})
-            else:
-                # Generic OpenAI-compatible — try common paths
-                base_url = ""
+        if not ids:
+            return j(handler, {"provider": provider, "models": [], "count": 0})
 
-        if not base_url:
-            return j(handler, {"error": "no_base_url", "models": []})
+        # Normalise to {id, label} — provider_model_ids() returns plain string IDs
+        def _make_label(mid):
+            """Best-effort human label from a model ID string."""
+            # Preserve slashes for router IDs like "anthropic/claude-sonnet-4.6"
+            display = mid.split("/")[-1] if "/" in mid else mid
+            parts = display.split("-")
+            result = []
+            for p in parts:
+                pl = p.lower()
+                if pl == "gpt":
+                    result.append("GPT")
+                elif pl in ("claude", "gemini", "gemma", "llama", "mistral",
+                            "qwen", "deepseek", "grok", "kimi", "glm"):
+                    result.append(p.capitalize())
+                elif p[:1].isdigit():
+                    result.append(p)  # version numbers: 5.4, 3.5, 4.6 — unchanged
+                else:
+                    result.append(p.capitalize())
+            label = " ".join(result)
+            # Restore well-known uppercase tokens that title-casing breaks
+            for orig in ("GPT", "GLM", "API", "AI", "XL", "MoE"):
+                label = label.replace(orig.title(), orig)
+            return label
 
-        # Build URL safely
-        base_url = base_url.rstrip("/")
-        if base_url.endswith("/v1"):
-            endpoint_url = base_url + "/models"
-        elif "/v1" in base_url:
-            endpoint_url = base_url.rstrip("/") + "/models"
-        else:
-            endpoint_url = base_url + "/v1/models"
-
-        # Validate scheme (B310 guard)
-        parsed_ep = _up(endpoint_url)
-        if parsed_ep.scheme not in ("http", "https"):
-            return j(handler, {"error": "invalid_scheme", "models": []}, status=400)
-
-        # SSRF guard: block private IPs (allow known local provider hostnames).
-        # Use exact hostname match — NOT substring — to prevent bypass via
-        # hostnames like evil-ollama.attacker.com containing "ollama".
-        _KNOWN_LOCAL_HOSTS = {"localhost", "127.0.0.1", "0.0.0.0", "::1"}
-        if parsed_ep.hostname:
-            hostname_lower = (parsed_ep.hostname or "").lower()
-            try:
-                for _, _, _, _, addr in _sock.getaddrinfo(parsed_ep.hostname, None):
-                    addr_obj = _ip.ip_address(addr[0])
-                    if addr_obj.is_private or addr_obj.is_loopback:
-                        if hostname_lower not in _KNOWN_LOCAL_HOSTS:
-                            return j(handler, {"error": "ssrf_blocked", "models": []}, status=400)
-            except _sock.gaierror:
-                pass
-
-        # Fetch models
-        req = _ur.Request(endpoint_url, method="GET")
-        req.add_header("User-Agent", "HermesWebUI/1.0")
-        if api_key:
-            req.add_header("Authorization", f"Bearer {api_key}")
-        with _ur.urlopen(req, timeout=8) as resp:  # nosec B310
-            raw = resp.read().decode("utf-8")
-
-        import json as _json
-        data = _json.loads(raw)
-        raw_models = data.get("data") or data.get("models") or []
-
-        # Normalise to {id, label} list; filter to text-generation models
-        models = []
-        seen = set()
-        for m in raw_models:
-            if not isinstance(m, dict):
-                continue
-            mid = m.get("id") or m.get("name") or ""
-            if not mid or mid in seen:
-                continue
-            # Skip embedding/image/audio models for direct providers
-            obj_type = (m.get("object") or "").lower()
-            if obj_type and obj_type not in ("model",):
-                continue
-            # Heuristic: skip obvious non-chat models
-            if any(skip in mid.lower() for skip in ("embed", "tts", "whisper", "dall-e", "davinci-edit", "babbage", "ada", "curie")):
-                continue
-            seen.add(mid)
-            label = m.get("name") or m.get("display_name") or mid
-            # For OpenAI, the id IS the label — clean it up
-            if label == mid:
-                label = mid.replace("-", " ").replace(".", ".").title()
-                # Restore original casing for well-known names
-                for known in ("GPT", "o1", "o3", "o4", "gpt"):
-                    label = label.replace(known.title(), known)
-            models.append({"id": mid, "label": label})
-
-        # Sort: newest (higher version numbers) first via lexicographic sort on reversed id
-        models.sort(key=lambda m: m["id"], reverse=True)
-
-        return j(handler, {"provider": provider, "models": models, "count": len(models)})
+        models_out = [{"id": mid, "label": _make_label(mid)} for mid in ids if mid]
+        return j(handler, {"provider": provider, "models": models_out,
+                           "count": len(models_out)})
 
     except Exception as _e:
-        logger.debug("Failed to fetch live models for %s: %s", provider, _e)
+        logger.debug("_handle_live_models failed for %s: %s", provider, _e)
         return j(handler, {"error": str(_e), "models": []})
 
 
@@ -1715,7 +1782,10 @@ def _handle_chat_start(handler, body):
     if not msg:
         return bad(handler, "message is required")
     attachments = [str(a) for a in (body.get("attachments") or [])][:20]
-    workspace = str(Path(body.get("workspace") or s.workspace).expanduser().resolve())
+    try:
+        workspace = str(resolve_trusted_workspace(body.get("workspace") or s.workspace))
+    except ValueError as e:
+        return bad(handler, str(e))
     model = body.get("model") or s.model
     stream_id = uuid.uuid4().hex
     s.workspace = workspace
@@ -2063,11 +2133,10 @@ def _handle_workspace_add(handler, body):
     name = body.get("name", "").strip()
     if not path_str:
         return bad(handler, "path is required")
-    p = Path(path_str).expanduser().resolve()
-    if not p.exists():
-        return bad(handler, f"Path does not exist: {p}")
-    if not p.is_dir():
-        return bad(handler, f"Path is not a directory: {p}")
+    try:
+        p = resolve_trusted_workspace(path_str)
+    except ValueError as e:
+        return bad(handler, str(e))
     wss = load_workspaces()
     if any(w["path"] == str(p) for w in wss):
         return bad(handler, "Workspace already in list")

api/workspace.py

@@ -92,7 +92,6 @@ def _profile_default_workspace() -> str:
 def _clean_workspace_list(workspaces: list) -> list:
     """Sanitize a workspace list:
     - Remove entries whose paths no longer exist on disk.
-    - Remove entries that look like test artifacts (webui-mvp-test, test-workspace).
     - Remove entries whose paths live inside another profile's directory
       (e.g. ~/.hermes/profiles/X/... should not appear on a different profile).
     - Rename any entry whose name is literally 'default' to 'Home' (avoids
@@ -105,18 +104,24 @@ def _clean_workspace_list(workspaces: list) -> list:
         path = w.get('path', '')
         name = w.get('name', '')
         p = Path(path).resolve() if path else Path('/')
-        # Skip test artifacts
-        if 'test-workspace' in path or 'webui-mvp-test' in path:
-            continue
         # Skip paths that no longer exist
         if not p.is_dir():
             continue
-        # Skip paths inside a named profile's directory (cross-profile leak)
+        # Skip paths inside a DIFFERENT profile's directory (cross-profile leak).
+        # Allow paths inside the CURRENT profile's own directory (e.g. test workspaces
+        # created under ~/.hermes/profiles/webui/webui-mvp-test/).
         try:
             p.relative_to(hermes_profiles)
-            continue  # it IS under profiles/ — remove it
+            # p is under ~/.hermes/profiles/ — only skip if it's under a DIFFERENT profile
+            try:
+                from api.profiles import get_active_hermes_home
+                own_profile_dir = get_active_hermes_home().resolve()
+                p.relative_to(own_profile_dir)
+                # p is under our own profile dir — keep it
+            except (ValueError, Exception):
+                continue  # under profiles/ but not our own — cross-profile leak, skip
         except ValueError:
-            pass
+            pass  # not under profiles/ at all — keep it
         # Rename confusing 'default' label to 'Home'
         if name.lower() == 'default':
             name = 'Home'
@@ -214,6 +219,76 @@ def set_last_workspace(path: str) -> None:
         logger.debug("Failed to set last workspace")
 
 
+def resolve_trusted_workspace(path: str | Path | None = None) -> Path:
+    """Resolve and validate a workspace path.
+
+    A path is trusted if it satisfies at least one of:
+      (A) It is under the user's home directory (Path.home()).
+          Works cross-platform: ~/... on Linux/macOS, C:\\Users\\... on Windows.
+      (B) It is already in the profile's saved workspace list.
+          This covers self-hosted deployments where workspaces live outside home
+          (e.g. /data/projects, /opt/workspace) — once a workspace is saved by
+          an admin, it can be reused without re-validation.
+
+    Additionally enforced regardless of (A)/(B):
+      1. The path must exist.
+      2. The path must be a directory.
+      3. The path must not be a known system root (/etc, /usr, /var, /bin, /sbin,
+         /boot, /proc, /sys, /dev, /root on Linux/macOS; Windows system dirs).
+         This prevents even admin-saved workspaces from pointing at OS internals.
+
+    None/empty path falls back to the boot-time DEFAULT_WORKSPACE, which is always
+    trusted (it was validated at server startup).
+    """
+    _BLOCKED_SYSTEM_ROOTS = {
+        # Linux / macOS
+        Path('/etc'), Path('/usr'), Path('/var'), Path('/bin'), Path('/sbin'),
+        Path('/boot'), Path('/proc'), Path('/sys'), Path('/dev'), Path('/root'),
+        Path('/lib'), Path('/lib64'), Path('/opt/homebrew'),
+    }
+
+    if path in (None, ""):
+        return Path(_BOOT_DEFAULT_WORKSPACE).expanduser().resolve()
+
+    candidate = Path(path).expanduser().resolve()
+
+    if not candidate.exists():
+        raise ValueError(f"Path does not exist: {candidate}")
+    if not candidate.is_dir():
+        raise ValueError(f"Path is not a directory: {candidate}")
+
+    # Block known system roots and their children
+    for blocked in _BLOCKED_SYSTEM_ROOTS:
+        try:
+            candidate.relative_to(blocked)
+            raise ValueError(f"Path points to a system directory: {candidate}")
+        except ValueError as e:
+            if "system directory" in str(e):
+                raise
+            # relative_to raised ValueError = candidate is NOT under blocked = safe
+
+    # (A) Trusted if under the user's home directory — cross-platform via Path.home()
+    try:
+        candidate.relative_to(Path.home().resolve())
+        return candidate
+    except ValueError:
+        pass
+
+    # (B) Trusted if already in the saved workspace list — covers non-home installs
+    try:
+        saved = load_workspaces()
+        saved_paths = {Path(w["path"]).resolve() for w in saved if w.get("path")}
+        if candidate in saved_paths:
+            return candidate
+    except Exception:
+        pass
+
+    raise ValueError(
+        f"Path is outside the user home directory and not in the saved workspace "
+        f"list: {candidate}. Add it via Settings → Workspaces first."
+    )
+
+
 def safe_resolve_ws(root: Path, requested: str) -> Path:
     """Resolve a relative path inside a workspace root, raising ValueError on traversal."""
     resolved = (root / requested).resolve()

server.py

@@ -44,7 +44,7 @@ class QuietHTTPServer(ThreadingHTTPServer):
 
 class Handler(BaseHTTPRequestHandler):
     timeout = 30  # seconds — kills idle/incomplete connections to prevent thread exhaustion
-    server_version = 'HermesWebUI/0.2'
+    server_version = 'HermesWebUI/0.50.38'
     def log_message(self, fmt, *args): pass  # suppress default Apache-style log
 
     def log_request(self, code: str='-', size: str='-') -> None:

static/boot.js

@@ -118,6 +118,10 @@ function syncWorkspacePanelUI(){
   if(clearBtn){
     clearBtn.disabled=!isOpen;
     clearBtn.title=hasPreview?'Close preview':'Hide workspace panel';
+    // On desktop, only show the X button when a file preview is open.
+    // In browse mode the chevron (btnCollapseWorkspacePanel) already serves
+    // as the close control, so showing both produces a duplicate X.
+    if(!isCompact) clearBtn.style.display=hasPreview?'':'none';
   }
 }
 
@@ -151,11 +155,7 @@ function toggleWorkspacePanel(force){
   openWorkspacePanel(nextMode);
 }
 function mobileSwitchPanel(name){
-  // Switch the panel content view
   switchPanel(name);
-  // For non-chat panels (tasks, skills, memory, spaces), open the sidebar
-  // so the panel is visible. For 'chat', the content is in the main area —
-  // just close the sidebar so the chat view is unobstructed.
   if(name==='chat'){
     closeMobileSidebar();
   } else {
@@ -166,10 +166,6 @@ function mobileSwitchPanel(name){
       if(overlay)overlay.classList.add('visible');
     }
   }
-  // Update bottom nav active state
-  document.querySelectorAll('.mobile-nav-btn').forEach(btn=>{
-    btn.classList.toggle('active',btn.dataset.panel===name);
-  });
 }
 
 $('btnSend').onclick=()=>{
@@ -480,6 +476,12 @@ document.addEventListener('keydown',async e=>{
     if(!S.busy){await newSession();await renderSessionList();closeMobileSidebar();$('msg').focus();}
   }
   if(e.key==='Escape'){
+    // Close onboarding overlay if open (skip/dismiss the wizard)
+    const onboardingOverlay=$('onboardingOverlay');
+    if(onboardingOverlay&&onboardingOverlay.style.display!=='none'){
+      if(typeof skipOnboarding==='function') skipOnboarding();
+      return;
+    }
     // Close settings overlay if open
     const settingsOverlay=$('settingsOverlay');
     if(settingsOverlay&&settingsOverlay.style.display!=='none'){_closeSettingsPanel();return;}
@@ -582,7 +584,45 @@ function applyBotName(){
 (async()=>{
   // Load send key preference
   let _bootSettings={};
-  try{const s=await api('/api/settings');_bootSettings=s;window._sendKey=s.send_key||'enter';window._showTokenUsage=!!s.show_token_usage;window._showCliSessions=!!s.show_cli_sessions;window._soundEnabled=!!s.sound_enabled;window._notificationsEnabled=!!s.notifications_enabled;window._botName=s.bot_name||'Hermes';const _theme=s.theme||'dark';document.documentElement.dataset.theme=_theme;localStorage.setItem('hermes-theme',_theme);document.body.classList.toggle('bubble-layout',!!s.bubble_layout);if(s.language&&typeof setLocale==='function'){setLocale(s.language);if(typeof applyLocaleToDOM==='function')applyLocaleToDOM();}applyBotName();}catch(e){window._sendKey='enter';window._showTokenUsage=false;window._showCliSessions=false;window._soundEnabled=false;window._notificationsEnabled=false;window._botName='Hermes';_bootSettings={check_for_updates:false};document.body.classList.remove('bubble-layout');}
+  try{
+    const s=await api('/api/settings');
+    _bootSettings=s;
+    window._sendKey=s.send_key||'enter';
+    window._showTokenUsage=!!s.show_token_usage;
+    window._showCliSessions=!!s.show_cli_sessions;
+    window._soundEnabled=!!s.sound_enabled;
+    window._notificationsEnabled=!!s.notifications_enabled;
+    window._botName=s.bot_name||'Hermes';
+    const _theme=s.theme||'dark';
+    document.documentElement.dataset.theme=_theme;
+    localStorage.setItem('hermes-theme',_theme);
+    document.body.classList.toggle('bubble-layout',!!s.bubble_layout);
+    if(typeof setLocale==='function'){
+      const _lang=typeof resolvePreferredLocale==='function'
+        ? resolvePreferredLocale(s.language, localStorage.getItem('hermes-lang'))
+        : (s.language || localStorage.getItem('hermes-lang') || 'en');
+      setLocale(_lang);
+      if(typeof applyLocaleToDOM==='function')applyLocaleToDOM();
+    }
+    applyBotName();
+  }catch(e){
+    window._sendKey='enter';
+    window._showTokenUsage=false;
+    window._showCliSessions=false;
+    window._soundEnabled=false;
+    window._notificationsEnabled=false;
+    window._botName='Hermes';
+    _bootSettings={check_for_updates:false};
+    document.body.classList.remove('bubble-layout');
+    if(typeof setLocale==='function'){
+      const _lang=typeof resolvePreferredLocale==='function'
+        ? resolvePreferredLocale(null, localStorage.getItem('hermes-lang'))
+        : (localStorage.getItem('hermes-lang') || 'en');
+      setLocale(_lang);
+      if(typeof applyLocaleToDOM==='function')applyLocaleToDOM();
+    }
+    applyBotName();
+  }
   // Non-blocking update check (fire-and-forget, once per tab session)
   // ?test_updates=1 in URL forces banner display for testing (bypasses sessionStorage guards)
   const _testUpdates=new URLSearchParams(location.search).get('test_updates')==='1';

static/i18n.js

@@ -140,7 +140,8 @@ const LOCALES = {
     settings_saved: 'Settings saved',
     settings_save_failed: 'Save failed: ',
     settings_load_failed: 'Failed to load settings: ',
-    settings_saved_pw: 'Settings saved (password set \u2014 login now required)',
+    settings_saved_pw: 'Settings saved — password protection enabled and this browser stays signed in',
+    settings_saved_pw_updated: 'Settings saved — password updated',
     // login page (used server-side via /api/i18n/login endpoint)
     login_title: 'Sign in',
     login_subtitle: 'Enter your password to continue',
@@ -166,6 +167,17 @@ const LOCALES = {
     tab_todos: 'Todos',
     new_conversation: 'New conversation',
     filter_conversations: 'Filter conversations...',
+    session_time_unknown: 'Unknown',
+    session_time_just_now: 'just now',
+    session_time_minutes_ago: (n) => `${n} minute${n === 1 ? '' : 's'} ago`,
+    session_time_hours_ago: (n) => `${n} hour${n === 1 ? '' : 's'} ago`,
+    session_time_days_ago: (n) => `${n} day${n === 1 ? '' : 's'} ago`,
+    session_time_last_week: 'last week',
+    session_time_bucket_today: 'Today',
+    session_time_bucket_yesterday: 'Yesterday',
+    session_time_bucket_this_week: 'This week',
+    session_time_bucket_last_week: 'Last week',
+    session_time_bucket_older: 'Older',
     scheduled_jobs: 'Scheduled jobs',
     new_job: 'New job',
     loading: 'Loading...',
@@ -209,6 +221,8 @@ const LOCALES = {
     onboarding_lead: 'A quick guided setup will verify Hermes, save a real provider configuration, choose a workspace and model, and optionally protect the app with a password.',
     onboarding_back: 'Back',
     onboarding_continue: 'Continue',
+    onboarding_skip: 'Skip setup',
+    onboarding_skipped: 'Setup skipped — using existing config.',
     onboarding_open: 'Open Hermes',
     onboarding_step_system_title: 'System check',
     onboarding_step_system_desc: 'Verify Hermes Agent and config visibility.',
@@ -268,6 +282,9 @@ const LOCALES = {
     onboarding_notice_finish: 'You can reopen Settings later to change any of this.',
     onboarding_not_set: 'Not set',
     onboarding_password_will_enable: 'Will be enabled',
+    onboarding_password_will_replace: 'Will be replaced',
+    onboarding_password_keep_existing: 'Keep current password',
+    onboarding_password_remains_disabled: 'Will remain disabled',
     onboarding_password_skipped: 'Skipped for now',
     onboarding_finish_help: 'Finishing stores <code>onboarding_completed</code> in settings and drops you into the normal app.',
     onboarding_error_choose_workspace: 'Choose a workspace before continuing.',
@@ -277,6 +294,120 @@ const LOCALES = {
     onboarding_error_workspace_required: 'Workspace is required.',
     onboarding_error_model_required: 'Model is required.',
     onboarding_complete: 'Onboarding complete',
+    // panel/runtime i18n
+    error_prefix: 'Error: ',
+    not_available: 'N/A',
+    never: 'never',
+    add: 'Add',
+    add_failed: 'Add failed: ',
+    remove_failed: 'Remove failed: ',
+    switch_failed: 'Switch failed: ',
+    name_required: 'Name is required',
+    content_required: 'Content is required',
+    view: 'View',
+    dismiss: 'Dismiss',
+    disable: 'Disable',
+    cron_no_jobs: 'No scheduled jobs found.',
+    cron_status_off: 'off',
+    cron_status_paused: 'paused',
+    cron_status_error: 'error',
+    cron_status_active: 'active',
+    cron_next: 'Next',
+    cron_last: 'Last',
+    cron_run_now: 'Run now',
+    cron_pause: 'Pause',
+    cron_resume: 'Resume',
+    cron_job_name_placeholder: 'Job name',
+    cron_schedule_placeholder: 'Schedule',
+    cron_prompt_placeholder: 'Prompt',
+    cron_last_output: 'Last output',
+    cron_all_runs: 'All runs',
+    cron_hide_runs: 'Hide runs',
+    cron_no_runs_yet: '(no runs yet)',
+    cron_schedule_required_example: 'Schedule is required (e.g. "0 9 * * *" or "every 1h")',
+    cron_schedule_required: 'Schedule is required',
+    cron_prompt_required: 'Prompt is required',
+    cron_job_created: 'Job created',
+    cron_job_triggered: 'Job triggered',
+    cron_job_paused: 'Job paused',
+    cron_job_resumed: 'Job resumed',
+    cron_job_updated: 'Job updated',
+    cron_delete_confirm_title: 'Delete cron job',
+    cron_delete_confirm_message: 'This cannot be undone.',
+    cron_job_deleted: 'Job deleted',
+    cron_completion_status: (name, status) => `Cron "${name}" ${status}`,
+    status_failed: 'failed',
+    status_completed: 'completed',
+    todos_no_active: 'No active task list in this session.',
+    clear_conversation_title: 'Clear conversation',
+    clear_conversation_message: 'Clear all messages? This cannot be undone.',
+    clear_failed: 'Clear failed: ',
+    skills_no_match: 'No skills match.',
+    linked_files: 'Linked Files',
+    skill_load_failed: 'Could not load skill: ',
+    skill_file_load_failed: 'Could not load file: ',
+    skill_name_required: 'Skill name is required',
+    skill_updated: 'Skill updated',
+    skill_created: 'Skill created',
+    memory_notes_label: 'memory (notes)',
+    memory_saved: 'Memory saved',
+    my_notes: 'My Notes',
+    user_profile: 'User Profile',
+    no_notes_yet: 'No notes yet.',
+    no_profile_yet: 'No profile yet.',
+    workspace_choose_path: 'Choose workspace path',
+    workspace_choose_path_meta: 'Add a validated path and switch this conversation',
+    workspace_manage: 'Manage workspaces',
+    workspace_manage_meta: 'Open the Spaces panel',
+    workspace_use_title: 'Use in current session',
+    workspace_use: 'Use',
+    workspace_add_path_placeholder: 'Add workspace path (e.g. /home/user/my-project)',
+    workspace_paths_validated_hint: 'Paths are validated as existing directories before saving.',
+    workspace_added: 'Workspace added',
+    workspace_remove_confirm_title: 'Remove workspace',
+    workspace_remove_confirm_message: (path) => `Remove "${path}"?`,
+    workspace_removed: 'Workspace removed',
+    workspace_switch_prompt_title: 'Switch workspace',
+    workspace_switch_prompt_message: 'Enter an absolute workspace path to add and switch this conversation to.',
+    workspace_switch_prompt_confirm: 'Switch',
+    workspace_switch_prompt_placeholder: '/Users/you/project',
+    workspace_not_added: 'Workspace was not added',
+    workspace_already_saved: 'Workspace already saved — choose it from the list',
+    workspace_busy_switch: 'Cannot switch workspace while agent is running',
+    discard_file_edits_title: 'Discard file edits?',
+    discard_file_edits_message: 'Switching workspaces will discard unsaved file edits in the preview.',
+    workspace_switched_to: (name) => `Switched to ${name}`,
+    profiles_no_profiles: 'No profiles found.',
+    profile_api_keys_configured: 'API keys configured',
+    profile_gateway_running: 'Gateway running',
+    profile_gateway_stopped: 'Gateway stopped',
+    profile_active: 'ACTIVE',
+    profile_no_configuration: 'No configuration',
+    profile_skill_count: (count) => `${count} skill${count === 1 ? '' : 's'}`,
+    profile_use: 'Use',
+    profile_switch_title: 'Switch to this profile',
+    profile_delete_title: 'Delete this profile',
+    manage_profiles: 'Manage profiles',
+    profiles_load_failed: 'Failed to load profiles',
+    profiles_busy_switch: 'Cannot switch profiles while agent is running',
+    profile_switched_new_conversation: (name) => `Switched to profile: ${name} — new conversation started`,
+    profile_switched: (name) => `Switched to profile: ${name}`,
+    profile_name_rule: 'Lowercase letters, numbers, hyphens, underscores only',
+    profile_base_url_rule: 'Base URL must start with http:// or https://',
+    profile_created: (name) => `Profile created: ${name}`,
+    profile_delete_confirm_title: (name) => `Delete profile "${name}"?`,
+    profile_delete_confirm_message: 'This removes all config, skills, memory, and sessions for this profile.',
+    profile_deleted: (name) => `Profile deleted: ${name}`,
+    active_conversation_none: 'No active conversation selected.',
+    active_conversation_meta: (title, count) => `${title} · ${count} message${count === 1 ? '' : 's'}`,
+    settings_unsaved_changes: 'You have unsaved changes.',
+    sign_out_failed: 'Sign out failed: ',
+    disable_auth_confirm_title: 'Disable password protection',
+    disable_auth_confirm_message: 'Anyone will be able to access this instance.',
+    auth_disabled: 'Auth disabled — password protection removed',
+    disable_auth_failed: 'Failed to disable auth: ',
+    bg_error_single: (title) => `"${title}" has encountered an error`,
+    bg_error_multi: (count) => `${count} sessions have encountered an error`,
   },
 
   es: {
@@ -407,7 +538,8 @@ const LOCALES = {
     settings_saved: 'Configuración guardada',
     settings_save_failed: 'Error al guardar: ',
     settings_load_failed: 'Error al cargar la configuración: ',
-    settings_saved_pw: 'Configuración guardada (contraseña establecida — ahora se requiere iniciar sesión)',
+    settings_saved_pw: 'Configuración guardada — la contraseña queda activada y este navegador sigue autenticado',
+    settings_saved_pw_updated: 'Configuración guardada — contraseña actualizada',
     // login page (used server-side via /api/i18n/login endpoint)
     login_title: 'Iniciar sesión',
     login_subtitle: 'Introduce tu contraseña para continuar',
@@ -433,6 +565,17 @@ const LOCALES = {
     tab_todos: 'Todos',
     new_conversation: 'Nueva conversación',
     filter_conversations: 'Filtrar conversaciones...',
+    session_time_unknown: 'Desconocido',
+    session_time_just_now: 'justo ahora',
+    session_time_minutes_ago: (n) => `hace ${n} minuto${n === 1 ? '' : 's'}`,
+    session_time_hours_ago: (n) => `hace ${n} hora${n === 1 ? '' : 's'}`,
+    session_time_days_ago: (n) => `hace ${n} día${n === 1 ? '' : 's'}`,
+    session_time_last_week: 'la semana pasada',
+    session_time_bucket_today: 'Hoy',
+    session_time_bucket_yesterday: 'Ayer',
+    session_time_bucket_this_week: 'Esta semana',
+    session_time_bucket_last_week: 'La semana pasada',
+    session_time_bucket_older: 'Más antiguo',
     scheduled_jobs: 'Tareas programadas',
     new_job: 'Nueva tarea',
     loading: 'Cargando...',
@@ -476,6 +619,8 @@ const LOCALES = {
     onboarding_lead: 'Una guía rápida verificará Hermes, guardará una configuración real del proveedor, elegirá un espacio de trabajo y un modelo, y opcionalmente protegerá la app con una contraseña.',
     onboarding_back: 'Atrás',
     onboarding_continue: 'Continuar',
+    onboarding_skip: 'Omitir configuración',
+    onboarding_skipped: 'Configuración omitida — se usa la configuración existente.',
     onboarding_open: 'Abrir Hermes',
     onboarding_step_system_title: 'Comprobación del sistema',
     onboarding_step_system_desc: 'Verifica Hermes Agent y la visibilidad de la configuración.',
@@ -535,6 +680,9 @@ const LOCALES = {
     onboarding_notice_finish: 'Puedes volver a abrir Configuración más tarde para cambiar cualquiera de estos valores.',
     onboarding_not_set: 'Sin definir',
     onboarding_password_will_enable: 'Se activará',
+    onboarding_password_will_replace: 'Se reemplazará',
+    onboarding_password_keep_existing: 'Mantener la contraseña actual',
+    onboarding_password_remains_disabled: 'Seguirá desactivada',
     onboarding_password_skipped: 'Se omitirá por ahora',
     onboarding_finish_help: 'Al finalizar se guarda <code>onboarding_completed</code> en la configuración y entras en la app normal.',
     onboarding_error_choose_workspace: 'Elige un espacio de trabajo antes de continuar.',
@@ -544,6 +692,120 @@ const LOCALES = {
     onboarding_error_workspace_required: 'El espacio de trabajo es obligatorio.',
     onboarding_error_model_required: 'El modelo es obligatorio.',
     onboarding_complete: 'Onboarding completado',
+    // panel/runtime i18n
+    error_prefix: 'Error: ',
+    not_available: 'N/A',
+    never: 'never',
+    add: 'Add',
+    add_failed: 'Add failed: ',
+    remove_failed: 'Remove failed: ',
+    switch_failed: 'Switch failed: ',
+    name_required: 'Name is required',
+    content_required: 'Content is required',
+    view: 'View',
+    dismiss: 'Dismiss',
+    disable: 'Disable',
+    cron_no_jobs: 'No scheduled jobs found.',
+    cron_status_off: 'off',
+    cron_status_paused: 'paused',
+    cron_status_error: 'error',
+    cron_status_active: 'active',
+    cron_next: 'Next',
+    cron_last: 'Last',
+    cron_run_now: 'Run now',
+    cron_pause: 'Pause',
+    cron_resume: 'Resume',
+    cron_job_name_placeholder: 'Job name',
+    cron_schedule_placeholder: 'Schedule',
+    cron_prompt_placeholder: 'Prompt',
+    cron_last_output: 'Last output',
+    cron_all_runs: 'All runs',
+    cron_hide_runs: 'Hide runs',
+    cron_no_runs_yet: '(no runs yet)',
+    cron_schedule_required_example: 'Schedule is required (e.g. "0 9 * * *" or "every 1h")',
+    cron_schedule_required: 'Schedule is required',
+    cron_prompt_required: 'Prompt is required',
+    cron_job_created: 'Job created',
+    cron_job_triggered: 'Job triggered',
+    cron_job_paused: 'Job paused',
+    cron_job_resumed: 'Job resumed',
+    cron_job_updated: 'Job updated',
+    cron_delete_confirm_title: 'Delete cron job',
+    cron_delete_confirm_message: 'This cannot be undone.',
+    cron_job_deleted: 'Job deleted',
+    cron_completion_status: (name, status) => `Cron "${name}" ${status}`,
+    status_failed: 'failed',
+    status_completed: 'completed',
+    todos_no_active: 'No active task list in this session.',
+    clear_conversation_title: 'Clear conversation',
+    clear_conversation_message: 'Clear all messages? This cannot be undone.',
+    clear_failed: 'Clear failed: ',
+    skills_no_match: 'No skills match.',
+    linked_files: 'Linked Files',
+    skill_load_failed: 'Could not load skill: ',
+    skill_file_load_failed: 'Could not load file: ',
+    skill_name_required: 'Skill name is required',
+    skill_updated: 'Skill updated',
+    skill_created: 'Skill created',
+    memory_notes_label: 'memory (notes)',
+    memory_saved: 'Memory saved',
+    my_notes: 'My Notes',
+    user_profile: 'User Profile',
+    no_notes_yet: 'No notes yet.',
+    no_profile_yet: 'No profile yet.',
+    workspace_choose_path: 'Choose workspace path',
+    workspace_choose_path_meta: 'Add a validated path and switch this conversation',
+    workspace_manage: 'Manage workspaces',
+    workspace_manage_meta: 'Open the Spaces panel',
+    workspace_use_title: 'Use in current session',
+    workspace_use: 'Use',
+    workspace_add_path_placeholder: 'Add workspace path (e.g. /home/user/my-project)',
+    workspace_paths_validated_hint: 'Paths are validated as existing directories before saving.',
+    workspace_added: 'Workspace added',
+    workspace_remove_confirm_title: 'Remove workspace',
+    workspace_remove_confirm_message: (path) => `Remove "${path}"?`,
+    workspace_removed: 'Workspace removed',
+    workspace_switch_prompt_title: 'Switch workspace',
+    workspace_switch_prompt_message: 'Enter an absolute workspace path to add and switch this conversation to.',
+    workspace_switch_prompt_confirm: 'Switch',
+    workspace_switch_prompt_placeholder: '/Users/you/project',
+    workspace_not_added: 'Workspace was not added',
+    workspace_already_saved: 'Workspace already saved — choose it from the list',
+    workspace_busy_switch: 'Cannot switch workspace while agent is running',
+    discard_file_edits_title: 'Discard file edits?',
+    discard_file_edits_message: 'Switching workspaces will discard unsaved file edits in the preview.',
+    workspace_switched_to: (name) => `Switched to ${name}`,
+    profiles_no_profiles: 'No profiles found.',
+    profile_api_keys_configured: 'API keys configured',
+    profile_gateway_running: 'Gateway running',
+    profile_gateway_stopped: 'Gateway stopped',
+    profile_active: 'ACTIVE',
+    profile_no_configuration: 'No configuration',
+    profile_skill_count: (count) => `${count} habilidad${count === 1 ? '' : 'es'}`,
+    profile_use: 'Use',
+    profile_switch_title: 'Switch to this profile',
+    profile_delete_title: 'Eliminar este perfil',
+    manage_profiles: 'Manage profiles',
+    profiles_load_failed: 'Failed to load profiles',
+    profiles_busy_switch: 'Cannot switch profiles while agent is running',
+    profile_switched_new_conversation: (name) => `Switched to profile: ${name} — new conversation started`,
+    profile_switched: (name) => `Switched to profile: ${name}`,
+    profile_name_rule: 'Lowercase letters, numbers, hyphens, underscores only',
+    profile_base_url_rule: 'Base URL must start with http:// or https://',
+    profile_created: (name) => `Profile created: ${name}`,
+    profile_delete_confirm_title: (name) => `Delete profile "${name}"?`,
+    profile_delete_confirm_message: 'This removes all config, skills, memory, and sessions for this profile.',
+    profile_deleted: (name) => `Profile deleted: ${name}`,
+    active_conversation_none: 'No active conversation selected.',
+    active_conversation_meta: (title, count) => `${title} · ${count} message${count === 1 ? '' : 's'}`,
+    settings_unsaved_changes: 'You have unsaved changes.',
+    sign_out_failed: 'Sign out failed: ',
+    disable_auth_confirm_title: 'Disable password protection',
+    disable_auth_confirm_message: 'Anyone will be able to access this instance.',
+    auth_disabled: 'Auth disabled — password protection removed',
+    disable_auth_failed: 'Failed to disable auth: ',
+    bg_error_single: (title) => `"${title}" has encountered an error`,
+    bg_error_multi: (count) => `${count} sessions have encountered an error`,
   },
 
   de: {
@@ -681,7 +943,8 @@ const LOCALES = {
     settings_saved: 'Einstellungen gespeichert',
     settings_save_failed: 'Speichern fehlgeschlagen: ',
     settings_load_failed: 'Laden der Einstellungen fehlgeschlagen: ',
-    settings_saved_pw: 'Einstellungen gespeichert (Passwort gesetzt \u2014 Login jetzt erforderlich)',
+    settings_saved_pw: 'Einstellungen gespeichert — Passwortschutz aktiviert und dieser Browser bleibt angemeldet',
+    settings_saved_pw_updated: 'Einstellungen gespeichert — Passwort aktualisiert',
     // login page
     login_title: 'Anmelden',
     login_subtitle: 'Geben Sie Ihr Passwort ein, um fortzufahren',
@@ -743,6 +1006,10 @@ const LOCALES = {
     suggest_files: 'Welche Dateien sind in diesem Workspace?',
     suggest_schedule: 'Was steht heute auf meinem Plan?',
     suggest_plan: 'Hilf mir, ein kleines Projekt zu planen.',
+    onboarding_password_will_enable: 'Wird aktiviert',
+    onboarding_password_will_replace: 'Wird ersetzt',
+    onboarding_password_keep_existing: 'Aktuelles Passwort beibehalten',
+    onboarding_password_remains_disabled: 'Bleibt deaktiviert',
   },
 
   zh: {
@@ -872,6 +1139,7 @@ const LOCALES = {
     settings_label_theme: '\u4e3b\u9898',
     settings_label_language: '\u8bed\u8a00',
     settings_label_token_usage: '\u663e\u793a token \u7528\u91cf',
+    settings_label_bubble_layout: '聊天气泡布局',
     settings_label_cli_sessions: '\u663e\u793a CLI \u4f1a\u8bdd',
     settings_label_sync_insights: '\u540c\u6b65\u5230 insights',
     settings_label_check_updates: '\u68c0\u67e5\u66f4\u65b0',
@@ -880,7 +1148,8 @@ const LOCALES = {
     settings_saved: '\u8bbe\u7f6e\u5df2\u4fdd\u5b58',
     settings_save_failed: '\u4fdd\u5b58\u5931\u8d25\uff1a',
     settings_load_failed: '\u8bbe\u7f6e\u52a0\u8f7d\u5931\u8d25\uff1a',
-    settings_saved_pw: '\u8bbe\u7f6e\u5df2\u4fdd\u5b58\uff08\u5bc6\u7801\u5df2\u8bbe\u7f6e\u2014\u73b0\u5728\u9700\u8981\u767b\u5f55\uff09',
+    settings_saved_pw: '\u8bbe\u7f6e\u5df2\u4fdd\u5b58\uff0c\u5df2\u542f\u7528\u5bc6\u7801\u4fdd\u62a4\uff0c\u5f53\u524d\u6d4f\u89c8\u5668\u4f1a\u4fdd\u6301\u767b\u5f55',
+    settings_saved_pw_updated: '\u8bbe\u7f6e\u5df2\u4fdd\u5b58\uff0c\u5bc6\u7801\u5df2\u66f4\u65b0',
     // login page
     login_title: '\u767b\u5f55',
     login_subtitle: '\u8f93\u5165\u5bc6\u7801\u7ee7\u7eed\u4f7f\u7528',
@@ -895,8 +1164,20 @@ const LOCALES = {
     tab_tasks: '任务',
     tab_todos: '待办',
     tab_workspaces: '工作区',
+    tab_profiles: '配置',
     new_conversation: '新建对话',
     filter_conversations: '筛选对话…',
+    session_time_unknown: '未知',
+    session_time_just_now: '刚刚',
+    session_time_minutes_ago: (n) => `${n} 分钟前`,
+    session_time_hours_ago: (n) => `${n} 小时前`,
+    session_time_days_ago: (n) => `${n} 天前`,
+    session_time_last_week: '上周',
+    session_time_bucket_today: '今天',
+    session_time_bucket_yesterday: '昨天',
+    session_time_bucket_this_week: '本周',
+    session_time_bucket_last_week: '上周',
+    session_time_bucket_older: '更早',
     scheduled_jobs: '定时任务',
     new_job: '新任务',
     search_skills: '搜索技能…',
@@ -904,6 +1185,7 @@ const LOCALES = {
     save_skill: '保存技能',
     personal_memory: '个人记忆',
     current_task_list: '当前任务列表',
+    workspace_desc: '为你的会话添加并切换工作区。',
     new_profile: '新配置',
     transcript: '记录',
     download_transcript: '下载为 Markdown',
@@ -925,11 +1207,205 @@ const LOCALES = {
     settings_desc_sound: '助手完成回复时播放提示音。',
     settings_desc_notifications: '当标签页在后台时，回复完成后显示系统通知。',
     settings_desc_token_usage: '在助手每次回复下方显示输入/输出 token 数量。也可以用 /usage 切换。',
+    settings_desc_bubble_layout: '开启后将用户消息右对齐、助手消息左对齐。默认关闭，以保持代码块和工具输出为全宽显示。',
     settings_desc_cli_sessions: '将 Hermes CLI（state.db）中的会话合并到会话列表。点击某个 CLI 会话可导入并继续对话。',
     settings_desc_sync_insights: '将 WebUI token 使用情况同步到 state.db，使 hermes /insights 包含浏览器会话数据。默认关闭。',
     settings_desc_check_updates: '当有更新的 WebUI 或助手版本时显示横幅。会在后台定期执行 git fetch。',
     settings_desc_bot_name: '助手在 UI 中的显示名称。默认为 Hermes。',
     settings_desc_password: '输入新密码以设置或更改。留空保持当前设置。',
+    // onboarding
+    onboarding_badge: '首次运行',
+    onboarding_title: '欢迎使用 Hermes Web UI',
+    onboarding_lead: '快速引导将验证 Hermes、保存真实的提供商配置、选择工作区和模型，并可选设置密码保护应用。',
+    onboarding_back: '返回',
+    onboarding_continue: '继续',
+    onboarding_skip: '跳过设置',
+    onboarding_skipped: '设置已跳过 — 使用现有配置。',
+    onboarding_open: '打开 Hermes',
+    onboarding_step_system_title: '系统检查',
+    onboarding_step_system_desc: '验证 Hermes Agent 与配置可见性。',
+    onboarding_step_setup_title: '提供商设置',
+    onboarding_step_setup_desc: '保存最小可用的 Hermes 提供商配置。',
+    onboarding_step_workspace_title: '工作区 + 模型',
+    onboarding_step_workspace_desc: '为新会话和聊天选择默认值。',
+    onboarding_step_password_title: '可选密码',
+    onboarding_step_password_desc: '在分享前为 Web UI 添加保护。',
+    onboarding_step_finish_title: '完成',
+    onboarding_step_finish_desc: '确认信息并进入应用。',
+    onboarding_notice_system_ready: 'Hermes Agent 看起来可从 Web UI 访问。',
+    onboarding_notice_system_unavailable: 'Hermes Agent 尚未完全可用。Bootstrap 可以安装它，但提供商设置可能仍需要终端。',
+    onboarding_check_agent: 'Hermes Agent',
+    onboarding_check_agent_ready: '已检测且可导入',
+    onboarding_check_agent_missing: '缺失或仅部分可导入',
+    onboarding_check_password: '密码',
+    onboarding_check_password_enabled: '已启用',
+    onboarding_check_password_disabled: '尚未启用',
+    onboarding_check_provider: '提供商配置',
+    onboarding_check_provider_ready: '可开始聊天',
+    onboarding_check_provider_partial: '已保存但不完整',
+    onboarding_check_provider_pending: '需要验证',
+    onboarding_config_file: '配置文件：',
+    onboarding_env_file: '.env 文件：',
+    onboarding_unknown: '未知',
+    onboarding_current_provider: '当前配置：',
+    onboarding_missing_imports: '缺失导入：',
+    onboarding_notice_setup_required: '请先在此选择一个简单的提供商路径。高级 OAuth 流程暂时仍建议在 Hermes CLI 中完成。',
+    onboarding_notice_setup_already_ready: '已检测到可用的 Hermes 提供商配置。你可以保留它，或在这里替换。',
+    onboarding_oauth_provider_ready_title: '提供商已完成认证',
+    onboarding_oauth_provider_ready_body: '此实例已配置为使用通过 Hermes CLI 设置的 OAuth 提供商（<strong>{provider}</strong>）。这里不需要 API key，点击继续即可完成设置。',
+    onboarding_oauth_provider_not_ready_title: 'OAuth 提供商尚未认证',
+    onboarding_oauth_provider_not_ready_body: '此实例已配置为使用 <strong>{provider}</strong>，该提供商使用 OAuth 而非 API key。请在终端运行 <code>hermes auth</code> 或 <code>hermes model</code> 完成认证，然后重新加载 Web UI。',
+    onboarding_oauth_switch_hint: '或者在下方选择其他提供商，切换到 API key 配置：',
+    onboarding_notice_workspace: '这些值复用与正式应用相同的设置 API。',
+    onboarding_workspace_label: '工作区',
+    onboarding_workspace_or_path: '或输入工作区路径',
+    onboarding_workspace_placeholder: '/home/you/workspace',
+    onboarding_provider_label: '设置模式',
+    onboarding_quick_setup_badge: '快速设置',
+    onboarding_api_key_label: 'API key',
+    onboarding_api_key_placeholder: '留空可保留已保存的 key',
+    onboarding_api_key_help_prefix: '会作为密钥保存到 Hermes .env 文件中，变量名为',
+    onboarding_base_url_label: 'Base URL',
+    onboarding_base_url_placeholder: 'https://your-endpoint.example/v1',
+    onboarding_base_url_help: '用于 OpenAI 兼容路由、自托管服务、LiteLLM、Ollama、LM Studio、vLLM 或类似端点。',
+    onboarding_model_label: '默认模型',
+    onboarding_workspace_help: '选择设置完成后 Hermes 在新聊天中使用的模型。',
+    onboarding_custom_model_placeholder: 'your-model-name',
+    onboarding_custom_model_help: '对于自定义端点，请填写服务端要求的精确模型 ID。',
+    onboarding_notice_password_enabled: '已配置密码。仅在你想替换时输入新密码。',
+    onboarding_notice_password_recommended: '可选，但如果你会把 UI 暴露到 localhost 之外，建议设置。',
+    onboarding_password_label: '密码（可选）',
+    onboarding_password_placeholder: '留空则跳过',
+    onboarding_password_help: '密码通过现有设置 API 保存，并在服务端进行哈希处理。',
+    onboarding_notice_finish: '你之后仍可在设置中修改这些选项。',
+    onboarding_not_set: '未设置',
+    onboarding_password_will_enable: '将启用',
+    onboarding_password_will_replace: '将被替换',
+    onboarding_password_keep_existing: '保留当前密码',
+    onboarding_password_remains_disabled: '将保持禁用',
+    onboarding_password_skipped: '暂时跳过',
+    onboarding_finish_help: '完成后会在设置中写入 <code>onboarding_completed</code>，并进入常规应用界面。',
+    onboarding_error_choose_workspace: '继续前请先选择工作区。',
+    onboarding_error_choose_model: '继续前请先选择模型。',
+    onboarding_error_provider_required: '继续前请先选择设置模式。',
+    onboarding_error_base_url_required: '自定义端点必须填写 Base URL。',
+    onboarding_error_workspace_required: '必须填写工作区。',
+    onboarding_error_model_required: '必须填写模型。',
+    onboarding_complete: '引导完成',
+    // panel/runtime i18n
+    error_prefix: '错误：',
+    not_available: '无',
+    never: '从未',
+    add: '添加',
+    add_failed: '添加失败：',
+    remove_failed: '移除失败：',
+    switch_failed: '切换失败：',
+    name_required: '名称不能为空',
+    content_required: '内容不能为空',
+    view: '查看',
+    dismiss: '忽略',
+    disable: '停用',
+    cron_no_jobs: '未找到定时任务。',
+    cron_status_off: '关闭',
+    cron_status_paused: '暂停',
+    cron_status_error: '错误',
+    cron_status_active: '运行中',
+    cron_next: '下次',
+    cron_last: '上次',
+    cron_run_now: '立即运行',
+    cron_pause: '暂停',
+    cron_resume: '恢复',
+    cron_job_name_placeholder: '任务名称',
+    cron_schedule_placeholder: '调度表达式',
+    cron_prompt_placeholder: '提示词',
+    cron_last_output: '最近输出',
+    cron_all_runs: '全部运行记录',
+    cron_hide_runs: '隐藏记录',
+    cron_no_runs_yet: '（暂无运行记录）',
+    cron_schedule_required_example: '必须填写调度（例如 "0 9 * * *" 或 "every 1h"）',
+    cron_schedule_required: '必须填写调度',
+    cron_prompt_required: '必须填写提示词',
+    cron_job_created: '任务已创建',
+    cron_job_triggered: '任务已触发',
+    cron_job_paused: '任务已暂停',
+    cron_job_resumed: '任务已恢复',
+    cron_job_updated: '任务已更新',
+    cron_delete_confirm_title: '删除定时任务',
+    cron_delete_confirm_message: '此操作无法撤销。',
+    cron_job_deleted: '任务已删除',
+    cron_completion_status: (name, status) => `定时任务“${name}”${status}`,
+    status_failed: '失败',
+    status_completed: '完成',
+    todos_no_active: '此会话暂无活动任务列表。',
+    clear_conversation_title: '清空对话',
+    clear_conversation_message: '要清空所有消息吗？此操作无法撤销。',
+    clear_failed: '清空失败：',
+    skills_no_match: '没有匹配的技能。',
+    linked_files: '关联文件',
+    skill_load_failed: '加载技能失败：',
+    skill_file_load_failed: '加载文件失败：',
+    skill_name_required: '技能名称不能为空',
+    skill_updated: '技能已更新',
+    skill_created: '技能已创建',
+    memory_notes_label: '记忆（备注）',
+    memory_saved: '记忆已保存',
+    my_notes: '我的备注',
+    user_profile: '用户画像',
+    no_notes_yet: '暂无备注。',
+    no_profile_yet: '暂无用户画像。',
+    workspace_choose_path: '选择工作区路径',
+    workspace_choose_path_meta: '添加已校验路径并切换当前会话',
+    workspace_manage: '管理工作区',
+    workspace_manage_meta: '打开 Spaces 面板',
+    workspace_use_title: '用于当前会话',
+    workspace_use: '使用',
+    workspace_add_path_placeholder: '添加工作区路径（例如 /home/user/my-project）',
+    workspace_paths_validated_hint: '保存前会校验路径是否为已存在目录。',
+    workspace_added: '工作区已添加',
+    workspace_remove_confirm_title: '移除工作区',
+    workspace_remove_confirm_message: (path) => `要移除“${path}”吗？`,
+    workspace_removed: '工作区已移除',
+    workspace_switch_prompt_title: '切换工作区',
+    workspace_switch_prompt_message: '输入绝对路径以添加并切换当前会话的工作区。',
+    workspace_switch_prompt_confirm: '切换',
+    workspace_switch_prompt_placeholder: '/Users/you/project',
+    workspace_not_added: '工作区未添加成功',
+    workspace_already_saved: '工作区已存在，请在列表中选择',
+    workspace_busy_switch: 'Agent 运行中，无法切换工作区',
+    discard_file_edits_title: '放弃文件编辑？',
+    discard_file_edits_message: '切换工作区将丢弃预览区未保存的文件修改。',
+    workspace_switched_to: (name) => `已切换到 ${name}`,
+    profiles_no_profiles: '未找到配置档。',
+    profile_api_keys_configured: '已配置 API 密钥',
+    profile_gateway_running: '网关运行中',
+    profile_gateway_stopped: '网关已停止',
+    profile_active: '当前',
+    profile_no_configuration: '无配置',
+    profile_skill_count: (count) => `${count} 个技能`,
+    profile_use: '使用',
+    profile_switch_title: '切换到此配置档',
+    profile_delete_title: '删除此配置档',
+    manage_profiles: '管理配置档',
+    profiles_load_failed: '加载配置档失败',
+    profiles_busy_switch: 'Agent 运行中，无法切换配置档',
+    profile_switched_new_conversation: (name) => `已切换到配置档：${name}，并新建对话`,
+    profile_switched: (name) => `已切换到配置档：${name}`,
+    profile_name_rule: '仅允许小写字母、数字、连字符和下划线',
+    profile_base_url_rule: 'Base URL 必须以 http:// 或 https:// 开头',
+    profile_created: (name) => `配置档已创建：${name}`,
+    profile_delete_confirm_title: (name) => `删除配置档“${name}”？`,
+    profile_delete_confirm_message: '这将删除该配置档的所有配置、技能、记忆和会话。',
+    profile_deleted: (name) => `配置档已删除：${name}`,
+    active_conversation_none: '当前未选择活动会话。',
+    active_conversation_meta: (title, count) => `${title} · ${count} 条消息`,
+    settings_unsaved_changes: '你有未保存的更改。',
+    sign_out_failed: '退出登录失败：',
+    disable_auth_confirm_title: '停用密码保护',
+    disable_auth_confirm_message: '任何人都可以访问此实例。',
+    auth_disabled: '认证已停用，密码保护已移除',
+    disable_auth_failed: '停用认证失败：',
+    bg_error_single: (title) => `“${title}”出现错误`,
+    bg_error_multi: (count) => `${count} 个会话出现错误`,
   },
 
   // Traditional Chinese (zh-Hant)
@@ -1060,7 +1536,8 @@ const LOCALES = {
     settings_saved: '\u8a2d\u5b9a\u5df2\u5132\u5b58',
     settings_save_failed: '\u5132\u5b58\u5931\u6557\uff1a',
     settings_load_failed: '\u8a2d\u5b9a\u52a0\u8f09\u5931\u6557\uff1a',
-    settings_saved_pw: '\u8a2d\u5b9a\u5df2\u5132\u5b58\uff08\u5bc6\u78bc\u5df2\u8a2d\u5b9a\u2014\u73fe\u5728\u9700\u8981\u767b\u5f55\uff09',
+    settings_saved_pw: '\u8a2d\u5b9a\u5df2\u5132\u5b58\uff0c\u5bc6\u78bc\u4fdd\u8b77\u5df2\u555f\u7528\uff0c\u7576\u524d\u700f\u89bd\u5668\u6703\u4fdd\u6301\u767b\u5165',
+    settings_saved_pw_updated: '\u8a2d\u5b9a\u5df2\u5132\u5b58\uff0c\u5bc6\u78bc\u5df2\u66f4\u65b0',
     // login page
     login_title: '\u767b\u5f55',
     login_subtitle: '\u8f38\u5165\u5bc6\u78bc\u7e7c\u7e8c\u4f7f\u7528',
@@ -1118,6 +1595,10 @@ const LOCALES = {
     settings_desc_check_updates: '\u7576\u6709\u66f4\u65b0\u7684 WebUI \u6216\u52a9\u624b\u7248\u672c\u6642\u986f\u793a\u6a19\u8a18\u3002\u5c07\u5728\u5f8c\u81ea\u6b63\u5e38\u57f7\u884c Git-Fetch\u3002',
     settings_desc_bot_name: '\u52a9\u624b\u5728 UI \u4e2d\u7684\u986f\u793a\u540d\u7a31\u3002\u9810\u8a2d\u70b8\u7528\u6539\u3002',
     settings_desc_password: '\u8a2d\u5b9a WebUI \u767b\u5165\u5bc6\u78bc\u3002\u5047\u5982\u5df2\u8a2d\u7f6e\uff0c\u6bcf\u6b21\u52a0\u8f09\u90fd\u9700\u8981\u767b\u5165\u3002',
+    onboarding_password_will_enable: '\u5c07\u6703\u555f\u7528',
+    onboarding_password_will_replace: '\u5c07\u6703\u53d6\u4ee3',
+    onboarding_password_keep_existing: '\u4fdd\u7559\u76ee\u524d\u5bc6\u78bc',
+    onboarding_password_remains_disabled: '\u6703\u7e7c\u7e8c\u4fdd\u6301\u95dc\u9589',
     settings_label_sound: '\u901a\u77e5\u8072\u97f3',
     // boot.js
     cancelling: '\u6b63\u5728\u53d6\u6d88...',
@@ -1144,6 +1625,52 @@ const LOCALES = {
 // Active locale — defaults to English; overridden by loadLocale() at boot.
 let _locale = LOCALES.en;
 
+/**
+ * Resolve an incoming locale tag to a known LOCALES key.
+ * Supports exact keys, case-insensitive matches, and a few common aliases
+ * (e.g. zh-CN -> zh, zh-TW -> zh-Hant). Returns null when unresolved.
+ * @param {string} lang
+ * @returns {string|null}
+ */
+function resolveLocale(lang) {
+  if (typeof lang !== 'string') return null;
+  const raw = lang.trim();
+  if (!raw) return null;
+  if (LOCALES[raw]) return raw;
+
+  const lower = raw.toLowerCase().replace(/_/g, '-');
+
+  // Case-insensitive direct match first.
+  const direct = Object.keys(LOCALES).find((k) => k.toLowerCase() === lower);
+  if (direct) return direct;
+
+  // Common Chinese variants.
+  if (lower === 'zh' || lower.startsWith('zh-cn') || lower.startsWith('zh-sg') || lower.startsWith('zh-hans')) {
+    return LOCALES.zh ? 'zh' : null;
+  }
+  if (lower.startsWith('zh-tw') || lower.startsWith('zh-hk') || lower.startsWith('zh-mo') || lower.startsWith('zh-hant')) {
+    return LOCALES['zh-Hant'] ? 'zh-Hant' : null;
+  }
+
+  // Fallback to base language subtag (e.g. en-US -> en).
+  const base = lower.split('-')[0];
+  const baseMatch = Object.keys(LOCALES).find((k) => k.toLowerCase() === base);
+  return baseMatch || null;
+}
+
+/**
+ * Resolve locale with precedence:
+ * 1) primary (typically server setting)
+ * 2) fallback (typically localStorage)
+ * 3) English
+ * @param {string} primary
+ * @param {string} fallback
+ * @returns {string}
+ */
+function resolvePreferredLocale(primary, fallback) {
+  return resolveLocale(primary) || resolveLocale(fallback) || 'en';
+}
+
 /**
  * Translate a key. Falls back to English if the key is missing in the active locale.
  * Supports function values (for interpolated strings): call t('key', arg).
@@ -1163,7 +1690,7 @@ function t(key, ...args) {
  * @param {string} lang
  */
 function setLocale(lang) {
-  const resolved = LOCALES[lang] ? lang : 'en';
+  const resolved = resolveLocale(lang) || 'en';
   _locale = LOCALES[resolved];
   localStorage.setItem('hermes-lang', resolved);
   document.documentElement.lang = _locale._speech || resolved;
@@ -1174,8 +1701,7 @@ function setLocale(lang) {
  * Server-persisted preference is applied later in loadSettingsPanel().
  */
 function loadLocale() {
-  const saved = localStorage.getItem('hermes-lang');
-  setLocale(saved && LOCALES[saved] ? saved : 'en');
+  setLocale(resolvePreferredLocale(null, localStorage.getItem('hermes-lang')));
 }
 
 /**

static/index.html

@@ -358,7 +358,7 @@
         <button class="panel-icon-btn" id="btnNewFolder" title="New folder" onclick="promptNewFolder()"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M22 19a2 2 0 0 1-2 2H4a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h5l2 3h9a2 2 0 0 1 2 2z"/></svg></button>
         <button class="panel-icon-btn" id="btnRefreshPanel" title="Refresh" onclick="if(S.session)loadDir(S.currentDir)"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><polyline points="23 4 23 10 17 10"/><polyline points="1 20 1 14 7 14"/><path d="M3.51 9a9 9 0 0 1 14.85-3.36L23 10M1 14l4.64 4.36A9 9 0 0 0 20.49 15"/></svg></button>
         <button class="panel-icon-btn close-preview" id="btnClearPreview" title="Close preview"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg></button>
-        <button class="panel-icon-btn mobile-close-btn" onclick="closeWorkspacePanel()" title="Close" aria-label="Close workspace panel">×</button>
+        <button class="panel-icon-btn mobile-close-btn" onclick="handleWorkspaceClose()" title="Close" aria-label="Close workspace panel">×</button>
       </div>
     </div>
     <div class="breadcrumb-bar" id="breadcrumbBar" style="display:none"></div>
@@ -391,6 +391,7 @@
         <div class="onboarding-body" id="onboardingBody"></div>
         <div class="onboarding-actions">
           <button class="sm-btn" id="onboardingBackBtn" onclick="prevOnboardingStep()" style="display:none" data-i18n="onboarding_back">Back</button>
+          <button class="sm-btn" id="onboardingSkipBtn" onclick="skipOnboarding()" style="margin-right:auto;opacity:.7" data-i18n="onboarding_skip">Skip setup</button>
           <button class="sm-btn" id="onboardingNextBtn" onclick="nextOnboardingStep()" style="font-weight:700;color:var(--blue);border-color:rgba(124,185,255,.32)" data-i18n="onboarding_continue">Continue</button>
         </div>
       </div>
@@ -535,7 +536,7 @@
                 <div class="settings-section-title">System</div>
                 <div class="settings-section-meta">Instance version and access controls.</div>
               </div>
-              <span class="settings-version-badge">v0.50.26</span>
+              <span class="settings-version-badge">v0.50.40</span>
             </div>
             <div class="settings-field" style="border-top:1px solid var(--border);padding-top:12px;margin-top:8px">
               <label for="settingsPassword" data-i18n="settings_label_password">Access Password</label>
@@ -552,32 +553,6 @@
   </div>
 </div>
 <div class="mobile-overlay" id="mobileOverlay" onclick="closeMobileSidebar()"></div>
-<nav class="mobile-bottom-nav" id="mobileBottomNav">
-  <button class="mobile-nav-btn active" data-panel="chat" onclick="mobileSwitchPanel('chat')">
-    <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><path d="M21 15a2 2 0 0 1-2 2H7l-4 4V5a2 2 0 0 1 2-2h14a2 2 0 0 1 2 2z"/></svg>
-    <span data-i18n="tab_chat">Chat</span>
-  </button>
-  <button class="mobile-nav-btn" data-panel="tasks" onclick="mobileSwitchPanel('tasks')">
-    <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><rect x="3" y="4" width="18" height="18" rx="2"/><line x1="16" y1="2" x2="16" y2="6"/><line x1="8" y1="2" x2="8" y2="6"/><line x1="3" y1="10" x2="21" y2="10"/></svg>
-    <span data-i18n="tab_tasks">Tasks</span>
-  </button>
-  <button class="mobile-nav-btn" data-panel="skills" onclick="mobileSwitchPanel('skills')">
-    <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><path d="M12 2L2 7l10 5 10-5-10-5z"/><path d="M2 17l10 5 10-5"/><path d="M2 12l10 5 10-5"/></svg>
-    <span data-i18n="tab_skills">Skills</span>
-  </button>
-  <button class="mobile-nav-btn" data-panel="memory" onclick="mobileSwitchPanel('memory')">
-    <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><path d="M12 2a7 7 0 0 1 7 7c0 2.5-1.3 4.7-3.2 6H8.2C6.3 13.7 5 11.5 5 9a7 7 0 0 1 7-7z"/><line x1="9" y1="17" x2="15" y2="17"/><line x1="10" y1="20" x2="14" y2="20"/></svg>
-    <span data-i18n="tab_memory">Memory</span>
-  </button>
-  <button class="mobile-nav-btn" data-panel="workspaces" onclick="mobileSwitchPanel('workspaces')">
-    <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><path d="M2 4h8l2 2h10v14H2z"/></svg>
-    <span data-i18n="tab_workspaces">Spaces</span>
-  </button>
-  <button class="mobile-nav-btn" data-panel="profiles" onclick="mobileSwitchPanel('profiles')">
-    <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M20 21v-2a4 4 0 0 0-4-4H8a4 4 0 0 0-4 4v2"/><circle cx="12" cy="7" r="4"/></svg>
-    <span data-i18n="tab_profiles">Profiles</span>
-  </button>
-</nav>
 <div class="app-dialog-overlay" id="appDialogOverlay" style="display:none" aria-hidden="true">
   <div class="app-dialog" id="appDialog" role="dialog" aria-modal="true" aria-labelledby="appDialogTitle" aria-describedby="appDialogDesc">
     <div class="app-dialog-header">

static/onboarding.js

@@ -224,12 +224,19 @@ function _renderOnboardingBody(){
       <div><strong>${t('onboarding_provider_label')}</strong><span>${esc((provider&&provider.label)||ONBOARDING.form.provider||t('onboarding_not_set'))}</span></div>
       <div><strong>${t('onboarding_model_label')}</strong><span>${esc(_getOnboardingSelectedModel()||t('onboarding_not_set'))}</span></div>
       <div><strong>${t('onboarding_workspace_label')}</strong><span>${esc(ONBOARDING.form.workspace||t('onboarding_not_set'))}</span></div>
-      <div><strong>${t('onboarding_check_password')}</strong><span>${ONBOARDING.form.password?t('onboarding_password_will_enable'):t('onboarding_password_skipped')}</span></div>
+      <div><strong>${t('onboarding_check_password')}</strong><span>${t(_getOnboardingPasswordSummaryKey(settings))}</span></div>
     </div>
     ${ONBOARDING.form.baseUrl?`<p class="onboarding-copy"><strong>${t('onboarding_base_url_label')}</strong> ${esc(ONBOARDING.form.baseUrl)}</p>`:''}
     <p class="onboarding-copy">${t('onboarding_finish_help')}</p>`;
 }
 
+function _getOnboardingPasswordSummaryKey(settings){
+  const hasExistingPassword=!!(settings&&settings.password_enabled);
+  const hasNewPassword=!!((ONBOARDING.form.password||'').trim());
+  if(hasNewPassword) return hasExistingPassword?'onboarding_password_will_replace':'onboarding_password_will_enable';
+  return hasExistingPassword?'onboarding_password_keep_existing':'onboarding_password_remains_disabled';
+}
+
 function syncOnboardingWorkspaceSelect(value){
   ONBOARDING.form.workspace=value;
   const input=$('onboardingWorkspaceInput');
@@ -309,7 +316,10 @@ async function _saveOnboardingDefaults(){
   }
   const body={default_workspace:workspace,default_model:model};
   if(password) body._set_password=password;
-  await api('/api/settings',{method:'POST',body:JSON.stringify(body)});
+  const saved=await api('/api/settings',{method:'POST',body:JSON.stringify(body)});
+  if(ONBOARDING.status){
+    ONBOARDING.status.settings={...(ONBOARDING.status.settings||{}),password_enabled:!!saved.auth_enabled};
+  }
   localStorage.setItem('hermes-webui-model',model);
   if($('modelSelect')) _applyModelToDropdown(model,$('modelSelect'));
 }
@@ -330,6 +340,18 @@ async function _finishOnboarding(){
   }
 }
 
+async function skipOnboarding(){
+  try{
+    // Mark onboarding completed server-side without changing any config
+    await api('/api/onboarding/complete',{method:'POST',body:'{}'});
+    ONBOARDING.active=false;
+    $('onboardingOverlay').style.display='none';
+    showToast(t('onboarding_skipped')||'Setup skipped');
+  }catch(e){
+    _setOnboardingNotice((e.message||String(e)),'warn');
+  }
+}
+
 async function nextOnboardingStep(){
   try{
     if(ONBOARDING.steps[ONBOARDING.step]==='setup'){

static/panels.js

@@ -24,7 +24,7 @@ async function loadCrons() {
   try {
     const data = await api('/api/crons');
     if (!data.jobs || !data.jobs.length) {
-      box.innerHTML = '<div style="padding:16px;color:var(--muted);font-size:12px">No scheduled jobs found.</div>';
+      box.innerHTML = `<div style="padding:16px;color:var(--muted);font-size:12px">${esc(t('cron_no_jobs'))}</div>`;
       return;
     }
     box.innerHTML = '';
@@ -33,42 +33,42 @@ async function loadCrons() {
       item.className = 'cron-item';
       item.id = 'cron-' + job.id;
       const statusClass = job.enabled === false ? 'disabled' : job.state === 'paused' ? 'paused' : job.last_status === 'error' ? 'error' : 'active';
-      const statusLabel = job.enabled === false ? 'off' : job.state === 'paused' ? 'paused' : job.last_status === 'error' ? 'error' : 'active';
-      const nextRun = job.next_run_at ? new Date(job.next_run_at).toLocaleString() : 'N/A';
-      const lastRun = job.last_run_at ? new Date(job.last_run_at).toLocaleString() : 'never';
+      const statusLabel = job.enabled === false ? t('cron_status_off') : job.state === 'paused' ? t('cron_status_paused') : job.last_status === 'error' ? t('cron_status_error') : t('cron_status_active');
+      const nextRun = job.next_run_at ? new Date(job.next_run_at).toLocaleString() : t('not_available');
+      const lastRun = job.last_run_at ? new Date(job.last_run_at).toLocaleString() : t('never');
       item.innerHTML = `
         <div class="cron-header" onclick="toggleCron('${job.id}')">
           <span class="cron-name" title="${esc(job.name)}">${esc(job.name)}</span>
           <span class="cron-status ${statusClass}">${statusLabel}</span>
         </div>
         <div class="cron-body" id="cron-body-${job.id}">
-          <div class="cron-schedule">${li('clock',12)} ${esc(job.schedule_display || job.schedule?.expression || '')} &nbsp;|&nbsp; Next: ${esc(nextRun)} &nbsp;|&nbsp; Last: ${esc(lastRun)}</div>
+          <div class="cron-schedule">${li('clock',12)} ${esc(job.schedule_display || job.schedule?.expression || '')} &nbsp;|&nbsp; ${esc(t('cron_next'))}: ${esc(nextRun)} &nbsp;|&nbsp; ${esc(t('cron_last'))}: ${esc(lastRun)}</div>
           <div class="cron-prompt">${esc((job.prompt||'').slice(0,300))}${(job.prompt||'').length>300?'…':''}</div>
           <div class="cron-actions">
-            <button class="cron-btn run" onclick="cronRun('${job.id}')">${li('play',12)} Run now</button>
-            ${statusLabel==='paused'
-              ? `<button class="cron-btn" onclick="cronResume('${job.id}')">${li('play',12)} Resume</button>`
-              : `<button class="cron-btn pause" onclick="cronPause('${job.id}')">${li('pause',12)} Pause</button>`}
-            <button class="cron-btn" onclick="cronEditOpen('${job.id}',${JSON.stringify(job).replace(/"/g,'&quot;')})">${li('pencil',12)} Edit</button>
-            <button class="cron-btn" style="border-color:rgba(201,168,76,.3);color:var(--accent)" onclick="cronDelete('${job.id}')">${li('trash-2',12)} Delete</button>
+            <button class="cron-btn run" onclick="cronRun('${job.id}')">${li('play',12)} ${esc(t('cron_run_now'))}</button>
+            ${job.state==='paused'
+              ? `<button class="cron-btn" onclick="cronResume('${job.id}')">${li('play',12)} ${esc(t('cron_resume'))}</button>`
+              : `<button class="cron-btn pause" onclick="cronPause('${job.id}')">${li('pause',12)} ${esc(t('cron_pause'))}</button>`}
+            <button class="cron-btn" onclick="cronEditOpen('${job.id}',${JSON.stringify(job).replace(/"/g,'&quot;')})">${li('pencil',12)} ${esc(t('edit'))}</button>
+            <button class="cron-btn" style="border-color:rgba(201,168,76,.3);color:var(--accent)" onclick="cronDelete('${job.id}')">${li('trash-2',12)} ${esc(t('delete_title'))}</button>
           </div>
           <!-- Inline edit form, hidden by default -->
           <div id="cron-edit-${job.id}" style="display:none;margin-top:8px;border-top:1px solid var(--border);padding-top:8px">
-            <input id="cron-edit-name-${job.id}" placeholder="Job name" style="width:100%;background:rgba(255,255,255,.05);border:1px solid var(--border2);border-radius:6px;color:var(--text);padding:5px 8px;font-size:12px;outline:none;margin-bottom:5px;box-sizing:border-box">
-            <input id="cron-edit-schedule-${job.id}" placeholder="Schedule" style="width:100%;background:rgba(255,255,255,.05);border:1px solid var(--border2);border-radius:6px;color:var(--text);padding:5px 8px;font-size:12px;outline:none;margin-bottom:5px;box-sizing:border-box">
-            <textarea id="cron-edit-prompt-${job.id}" rows="3" placeholder="Prompt" style="width:100%;background:rgba(255,255,255,.05);border:1px solid var(--border2);border-radius:6px;color:var(--text);padding:5px 8px;font-size:12px;outline:none;resize:none;font-family:inherit;margin-bottom:5px;box-sizing:border-box"></textarea>
+            <input id="cron-edit-name-${job.id}" placeholder="${esc(t('cron_job_name_placeholder'))}" style="width:100%;background:rgba(255,255,255,.05);border:1px solid var(--border2);border-radius:6px;color:var(--text);padding:5px 8px;font-size:12px;outline:none;margin-bottom:5px;box-sizing:border-box">
+            <input id="cron-edit-schedule-${job.id}" placeholder="${esc(t('cron_schedule_placeholder'))}" style="width:100%;background:rgba(255,255,255,.05);border:1px solid var(--border2);border-radius:6px;color:var(--text);padding:5px 8px;font-size:12px;outline:none;margin-bottom:5px;box-sizing:border-box">
+            <textarea id="cron-edit-prompt-${job.id}" rows="3" placeholder="${esc(t('cron_prompt_placeholder'))}" style="width:100%;background:rgba(255,255,255,.05);border:1px solid var(--border2);border-radius:6px;color:var(--text);padding:5px 8px;font-size:12px;outline:none;resize:none;font-family:inherit;margin-bottom:5px;box-sizing:border-box"></textarea>
             <div id="cron-edit-err-${job.id}" style="font-size:11px;color:var(--accent);display:none;margin-bottom:5px"></div>
             <div style="display:flex;gap:6px">
-              <button class="cron-btn run" style="flex:1" onclick="cronEditSave('${job.id}')">Save</button>
-              <button class="cron-btn" style="flex:1" onclick="cronEditClose('${job.id}')">Cancel</button>
+              <button class="cron-btn run" style="flex:1" onclick="cronEditSave('${job.id}')">${esc(t('save'))}</button>
+              <button class="cron-btn" style="flex:1" onclick="cronEditClose('${job.id}')">${esc(t('cancel'))}</button>
             </div>
           </div>
           <div id="cron-output-${job.id}">
             <div class="cron-last-header" style="display:flex;align-items:center;justify-content:space-between">
-              <span>Last output</span>
-              <button class="cron-btn" style="padding:1px 8px;font-size:10px" onclick="loadCronHistory('${job.id}',this)">All runs</button>
+              <span>${esc(t('cron_last_output'))}</span>
+              <button class="cron-btn" style="padding:1px 8px;font-size:10px" onclick="loadCronHistory('${job.id}',this)">${esc(t('cron_all_runs'))}</button>
             </div>
-            <div class="cron-last" id="cron-out-text-${job.id}" style="color:var(--muted);font-size:11px">Loading…</div>
+            <div class="cron-last" id="cron-out-text-${job.id}" style="color:var(--muted);font-size:11px">${esc(t('loading'))}</div>
             <div id="cron-history-${job.id}" style="display:none"></div>
           </div>
         </div>`;
@@ -76,7 +76,7 @@ async function loadCrons() {
       // Eagerly load last output for visible items
       loadCronOutput(job.id);
     }
-  } catch(e) { box.innerHTML = `<div style="padding:12px;color:var(--accent);font-size:12px">Error: ${esc(e.message)}</div>`; }
+  } catch(e) { box.innerHTML = `<div style="padding:12px;color:var(--accent);font-size:12px">${esc(t('error_prefix'))}${esc(e.message)}</div>`; }
 }
 
 let _cronSelectedSkills=[];
@@ -164,18 +164,18 @@ async function submitCronCreate(){
   const deliver=$('cronFormDeliver').value;
   const errEl=$('cronFormError');
   errEl.style.display='none';
-  if(!schedule){errEl.textContent='Schedule is required (e.g. "0 9 * * *" or "every 1h")';errEl.style.display='';return;}
-  if(!prompt){errEl.textContent='Prompt is required';errEl.style.display='';return;}
+  if(!schedule){errEl.textContent=t('cron_schedule_required_example');errEl.style.display='';return;}
+  if(!prompt){errEl.textContent=t('cron_prompt_required');errEl.style.display='';return;}
   try{
     const body={schedule,prompt,deliver};
     if(name)body.name=name;
     if(_cronSelectedSkills.length)body.skills=_cronSelectedSkills;
     await api('/api/crons/create',{method:'POST',body:JSON.stringify(body)});
     toggleCronForm();
-    showToast('Job created');
+    showToast(t('cron_job_created'));
     await loadCrons();
   }catch(e){
-    errEl.textContent='Error: '+e.message;errEl.style.display='';
+    errEl.textContent=t('error_prefix')+e.message;errEl.style.display='';
   }
 }
 
@@ -192,7 +192,7 @@ async function loadCronOutput(jobId) {
     const data = await api(`/api/crons/output?job_id=${encodeURIComponent(jobId)}&limit=1`);
     const el = $('cron-out-text-' + jobId);
     if (!el) return;
-    if (!data.outputs || !data.outputs.length) { el.textContent = '(no runs yet)'; return; }
+    if (!data.outputs || !data.outputs.length) { el.textContent = t('cron_no_runs_yet'); return; }
     const out = data.outputs[0];
     const ts = out.filename.replace('.md','').replace(/_/g,' ');
     el.textContent = ts + '\n\n' + _cronOutputSnippet(out.content);
@@ -205,14 +205,14 @@ async function loadCronHistory(jobId, btn) {
   // Toggle: if already open, close it
   if (histEl.style.display !== 'none') {
     histEl.style.display = 'none';
-    if (btn) btn.textContent = 'All runs';
+    if (btn) btn.textContent = t('cron_all_runs');
     return;
   }
-  if (btn) btn.textContent = 'Loading…';
+  if (btn) btn.textContent = t('loading');
   try {
     const data = await api(`/api/crons/output?job_id=${encodeURIComponent(jobId)}&limit=20`);
     if (!data.outputs || !data.outputs.length) {
-      histEl.innerHTML = '<div style="font-size:11px;color:var(--muted);padding:4px 0">(no runs yet)</div>';
+      histEl.innerHTML = `<div style="font-size:11px;color:var(--muted);padding:4px 0">${esc(t('cron_no_runs_yet'))}</div>`;
     } else {
       histEl.innerHTML = data.outputs.map((out, i) => {
         const ts = out.filename.replace('.md','').replace(/_/g,' ');
@@ -228,9 +228,9 @@ async function loadCronHistory(jobId, btn) {
       }).join('');
     }
     histEl.style.display = '';
-    if (btn) btn.textContent = 'Hide runs';
+    if (btn) btn.textContent = t('cron_hide_runs');
   } catch(e) {
-    if (btn) btn.textContent = 'All runs';
+    if (btn) btn.textContent = t('cron_all_runs');
   }
 }
 
@@ -242,25 +242,25 @@ function toggleCron(id) {
 async function cronRun(id) {
   try {
     await api('/api/crons/run', {method:'POST', body: JSON.stringify({job_id: id})});
-    showToast('Job triggered');
+    showToast(t('cron_job_triggered'));
     setTimeout(() => loadCronOutput(id), 5000);
-  } catch(e) { showToast('Run failed: ' + e.message, 4000); }
+  } catch(e) { showToast(t('failed_colon') + e.message, 4000); }
 }
 
 async function cronPause(id) {
   try {
     await api('/api/crons/pause', {method:'POST', body: JSON.stringify({job_id: id})});
-    showToast('Job paused');
+    showToast(t('cron_job_paused'));
     await loadCrons();
-  } catch(e) { showToast('Pause failed: ' + e.message, 4000); }
+  } catch(e) { showToast(t('failed_colon') + e.message, 4000); }
 }
 
 async function cronResume(id) {
   try {
     await api('/api/crons/resume', {method:'POST', body: JSON.stringify({job_id: id})});
-    showToast('Job resumed');
+    showToast(t('cron_job_resumed'));
     await loadCrons();
-  } catch(e) { showToast('Resume failed: ' + e.message, 4000); }
+  } catch(e) { showToast(t('failed_colon') + e.message, 4000); }
 }
 
 function cronEditOpen(id, job) {
@@ -284,25 +284,25 @@ async function cronEditSave(id) {
   const schedule = $('cron-edit-schedule-' + id).value.trim();
   const prompt = $('cron-edit-prompt-' + id).value.trim();
   const errEl = $('cron-edit-err-' + id);
-  if (!schedule) { errEl.textContent = 'Schedule is required'; errEl.style.display = ''; return; }
-  if (!prompt) { errEl.textContent = 'Prompt is required'; errEl.style.display = ''; return; }
+  if (!schedule) { errEl.textContent = t('cron_schedule_required'); errEl.style.display = ''; return; }
+  if (!prompt) { errEl.textContent = t('cron_prompt_required'); errEl.style.display = ''; return; }
   try {
     const updates = {job_id: id, schedule, prompt};
     if (name) updates.name = name;
     await api('/api/crons/update', {method:'POST', body: JSON.stringify(updates)});
-    showToast('Job updated');
+    showToast(t('cron_job_updated'));
     await loadCrons();
-  } catch(e) { errEl.textContent = 'Error: ' + e.message; errEl.style.display = ''; }
+  } catch(e) { errEl.textContent = t('error_prefix') + e.message; errEl.style.display = ''; }
 }
 
 async function cronDelete(id) {
-  const _delCron=await showConfirmDialog({title:'Delete cron job',message:'This cannot be undone.',confirmLabel:'Delete',danger:true,focusCancel:true});
+  const _delCron=await showConfirmDialog({title:t('cron_delete_confirm_title'),message:t('cron_delete_confirm_message'),confirmLabel:t('delete_title'),danger:true,focusCancel:true});
   if(!_delCron) return;
   try {
     await api('/api/crons/delete', {method:'POST', body: JSON.stringify({job_id: id})});
-    showToast('Job deleted');
+    showToast(t('cron_job_deleted'));
     await loadCrons();
-  } catch(e) { showToast('Delete failed: ' + e.message, 4000); }
+  } catch(e) { showToast(t('delete_failed') + e.message, 4000); }
 }
 
 function loadTodos() {
@@ -324,7 +324,7 @@ function loadTodos() {
     }
   }
   if (!todos.length) {
-    panel.innerHTML = '<div style="color:var(--muted);font-size:12px;padding:4px 0">No active task list in this session.</div>';
+    panel.innerHTML = `<div style="color:var(--muted);font-size:12px;padding:4px 0">${esc(t('todos_no_active'))}</div>`;
     return;
   }
   const statusIcon = {pending:li('square',14), in_progress:li('loader',14), completed:li('check',14), cancelled:li('x',14)};
@@ -341,7 +341,7 @@ function loadTodos() {
 
 async function clearConversation() {
   if(!S.session) return;
-  const _clrMsg=await showConfirmDialog({title:'Clear conversation',message:'Clear all messages? This cannot be undone.',confirmLabel:'Clear',danger:true,focusCancel:true});
+  const _clrMsg=await showConfirmDialog({title:t('clear_conversation_title'),message:t('clear_conversation_message'),confirmLabel:t('clear'),danger:true,focusCancel:true});
   if(!_clrMsg) return;
   try {
     const data = await api('/api/session/clear', {method:'POST',
@@ -351,8 +351,8 @@ async function clearConversation() {
     S.toolCalls = [];
     syncTopbar();
     renderMessages();
-    showToast('Conversation cleared');
-  } catch(e) { setStatus('Clear failed: ' + e.message); }
+    showToast(t('conversation_cleared'));
+  } catch(e) { setStatus(t('clear_failed') + e.message); }
 }
 
 // ── Skills panel ──
@@ -382,7 +382,7 @@ function renderSkills(skills) {
   }
   const box = $('skillsList');
   box.innerHTML = '';
-  if (!filtered.length) { box.innerHTML = '<div style="padding:12px;color:var(--muted);font-size:12px">No skills match.</div>'; return; }
+  if (!filtered.length) { box.innerHTML = `<div style="padding:12px;color:var(--muted);font-size:12px">${esc(t('skills_no_match'))}</div>`; return; }
   for (const [cat, items] of Object.entries(cats).sort()) {
     const sec = document.createElement('div');
     sec.className = 'skills-category';
@@ -418,7 +418,7 @@ async function openSkill(name, el) {
     const lf = data.linked_files || {};
     const categories = Object.entries(lf).filter(([,files]) => files && files.length > 0);
     if (categories.length) {
-      html += '<div class="skill-linked-files"><div style="font-size:11px;font-weight:600;color:var(--muted);text-transform:uppercase;letter-spacing:.05em;margin-bottom:8px">Linked Files</div>';
+      html += `<div class="skill-linked-files"><div style="font-size:11px;font-weight:600;color:var(--muted);text-transform:uppercase;letter-spacing:.05em;margin-bottom:8px">${esc(t('linked_files'))}</div>`;
       for (const [cat, files] of categories) {
         html += `<div class="skill-linked-section"><h4>${esc(cat)}</h4>`;
         for (const f of files) {
@@ -435,7 +435,7 @@ async function openSkill(name, el) {
     });
     $('previewArea').classList.add('visible');
     $('fileTree').style.display = 'none';
-  } catch(e) { setStatus('Could not load skill: ' + e.message); }
+  } catch(e) { setStatus(t('skill_load_failed') + e.message); }
 }
 
 async function openSkillFile(skillName, filePath) {
@@ -453,7 +453,7 @@ async function openSkillFile(skillName, filePath) {
       $('previewCode').textContent = data.content || '';
       requestAnimationFrame(() => highlightCode());
     }
-  } catch(e) { setStatus('Could not load file: ' + e.message); }
+  } catch(e) { setStatus(t('skill_file_load_failed') + e.message); }
 }
 
 // ── Skill create/edit form ──
@@ -479,15 +479,15 @@ async function submitSkillSave() {
   const content = $('skillFormContent').value;
   const errEl = $('skillFormError');
   errEl.style.display = 'none';
-  if (!name) { errEl.textContent = 'Skill name is required'; errEl.style.display = ''; return; }
-  if (!content.trim()) { errEl.textContent = 'Content is required'; errEl.style.display = ''; return; }
+  if (!name) { errEl.textContent = t('skill_name_required'); errEl.style.display = ''; return; }
+  if (!content.trim()) { errEl.textContent = t('content_required'); errEl.style.display = ''; return; }
   try {
     await api('/api/skills/save', {method:'POST', body: JSON.stringify({name, category: category||undefined, content})});
-    showToast(_editingSkillName ? 'Skill updated' : 'Skill created');
+    showToast(_editingSkillName ? t('skill_updated') : t('skill_created'));
     _skillsData = null;
     toggleSkillForm();
     await loadSkills();
-  } catch(e) { errEl.textContent = 'Error: ' + e.message; errEl.style.display = ''; }
+  } catch(e) { errEl.textContent = t('error_prefix') + e.message; errEl.style.display = ''; }
 }
 
 // ── Memory inline edit ──
@@ -498,7 +498,7 @@ function toggleMemoryEdit() {
   if (!form) return;
   const open = form.style.display !== 'none';
   if (open) { form.style.display = 'none'; return; }
-  $('memEditSection').textContent = 'memory (notes)';
+  $('memEditSection').textContent = t('memory_notes_label');
   $('memEditContent').value = _memoryData ? (_memoryData.memory || '') : '';
   $('memEditError').style.display = 'none';
   form.style.display = '';
@@ -515,10 +515,10 @@ async function submitMemorySave() {
   errEl.style.display = 'none';
   try {
     await api('/api/memory/write', {method:'POST', body: JSON.stringify({section: 'memory', content})});
-    showToast('Memory saved');
+    showToast(t('memory_saved'));
     closeMemoryEdit();
     await loadMemory(true);
-  } catch(e) { errEl.textContent = 'Error: ' + e.message; errEl.style.display = ''; }
+  } catch(e) { errEl.textContent = t('error_prefix') + e.message; errEl.style.display = ''; }
 }
 
 // ── Workspace management ──
@@ -550,7 +550,7 @@ function syncWorkspaceDisplays(){
   if(composerLabel) composerLabel.textContent=label;
   if(composerChip){
     composerChip.disabled=!hasSession;
-    composerChip.title=hasSession?ws:'No active workspace';
+    composerChip.title=hasSession?ws:t('no_workspace');
     composerChip.classList.toggle('active',!!(composerDropdown&&composerDropdown.classList.contains('open')));
   }
 }
@@ -610,15 +610,15 @@ function renderWorkspaceDropdownInto(dd, workspaces, currentWs){
   }
   dd.appendChild(document.createElement('div')).className='ws-divider';
   dd.appendChild(_renderWorkspaceAction(
-    'Choose workspace path',
-    'Add a validated path and switch this conversation',
+    t('workspace_choose_path'),
+    t('workspace_choose_path_meta'),
     li('folder',12),
     ()=>promptWorkspacePath()
   ));
   const div=document.createElement('div');div.className='ws-divider';dd.appendChild(div);
   dd.appendChild(_renderWorkspaceAction(
-    'Manage workspaces',
-    'Open the Spaces panel',
+    t('workspace_manage'),
+    t('workspace_manage_meta'),
     li('settings',12),
     ()=>{closeWsDropdown();mobileSwitchPanel('workspaces');}
   ));
@@ -693,19 +693,19 @@ function renderWorkspacesPanel(workspaces){
         <div class="ws-row-path">${esc(w.path)}</div>
       </div>
       <div class="ws-row-actions">
-        <button class="ws-action-btn" title="Use in current session" onclick="switchToWorkspace('${esc(w.path)}','${esc(w.name)}')">${li('arrow-right',12)} Use</button>
-        <button class="ws-action-btn danger" title="Remove" onclick="removeWorkspace('${esc(w.path)}')">${li('x',12)}</button>
+        <button class="ws-action-btn" title="${esc(t('workspace_use_title'))}" onclick="switchToWorkspace('${esc(w.path)}','${esc(w.name)}')">${li('arrow-right',12)} ${esc(t('workspace_use'))}</button>
+        <button class="ws-action-btn danger" title="${esc(t('remove'))}" onclick="removeWorkspace('${esc(w.path)}')">${li('x',12)}</button>
       </div>`;
     panel.appendChild(row);
   }
   const addRow=document.createElement('div');addRow.className='ws-add-row';
   addRow.innerHTML=`
-    <input id="wsAddInput" placeholder="Add workspace path (e.g. /home/user/my-project)" style="flex:1;background:rgba(255,255,255,.06);border:1px solid var(--border2);border-radius:7px;color:var(--text);padding:7px 10px;font-size:12px;outline:none;">
-    <button class="ws-action-btn" onclick="addWorkspace()">${li('plus',12)} Add</button>`;
+    <input id="wsAddInput" placeholder="${esc(t('workspace_add_path_placeholder'))}" style="flex:1;background:rgba(255,255,255,.06);border:1px solid var(--border2);border-radius:7px;color:var(--text);padding:7px 10px;font-size:12px;outline:none;">
+    <button class="ws-action-btn" onclick="addWorkspace()">${li('plus',12)} ${esc(t('add'))}</button>`;
   panel.appendChild(addRow);
   const hint=document.createElement('div');
   hint.style.cssText='font-size:11px;color:var(--muted);padding:4px 0 8px';
-  hint.textContent='Paths are validated as existing directories before saving.';
+  hint.textContent=t('workspace_paths_validated_hint');
   panel.appendChild(hint);
 }
 
@@ -718,28 +718,28 @@ async function addWorkspace(){
     _workspaceList=data.workspaces;
     renderWorkspacesPanel(data.workspaces);
     if(input)input.value='';
-    showToast('Workspace added');
-  }catch(e){setStatus('Add failed: '+e.message);}
+    showToast(t('workspace_added'));
+  }catch(e){setStatus(t('add_failed')+e.message);}
 }
 
 async function removeWorkspace(path){
-  const _rmWs=await showConfirmDialog({title:'Remove workspace',message:`Remove "${path}"?`,confirmLabel:'Remove',danger:true,focusCancel:true});
+  const _rmWs=await showConfirmDialog({title:t('workspace_remove_confirm_title'),message:t('workspace_remove_confirm_message',path),confirmLabel:t('remove'),danger:true,focusCancel:true});
   if(!_rmWs) return;
   try{
     const data=await api('/api/workspaces/remove',{method:'POST',body:JSON.stringify({path})});
     _workspaceList=data.workspaces;
     renderWorkspacesPanel(data.workspaces);
-    showToast('Workspace removed');
-  }catch(e){setStatus('Remove failed: '+e.message);}
+    showToast(t('workspace_removed'));
+  }catch(e){setStatus(t('remove_failed')+e.message);}
 }
 
 async function promptWorkspacePath(){
   if(!S.session)return;
   const value=await showPromptDialog({
-    title:'Switch workspace',
-    message:'Enter an absolute workspace path to add and switch this conversation to.',
-    confirmLabel:'Switch',
-    placeholder:'/Users/you/project',
+    title:t('workspace_switch_prompt_title'),
+    message:t('workspace_switch_prompt_message'),
+    confirmLabel:t('workspace_switch_prompt_confirm'),
+    placeholder:t('workspace_switch_prompt_placeholder'),
     value:S.session.workspace||''
   });
   const path=(value||'').trim();
@@ -748,27 +748,27 @@ async function promptWorkspacePath(){
     const data=await api('/api/workspaces/add',{method:'POST',body:JSON.stringify({path})});
     _workspaceList=data.workspaces||[];
     const target=_workspaceList[_workspaceList.length-1];
-    if(!target) throw new Error('Workspace was not added');
+    if(!target) throw new Error(t('workspace_not_added'));
     await switchToWorkspace(target.path,target.name);
   }catch(e){
     if(String(e.message||'').includes('Workspace already in list')){
-      showToast('Workspace already saved — choose it from the list');
+      showToast(t('workspace_already_saved'));
       return;
     }
-    showToast('Workspace switch failed: '+e.message);
+    showToast(t('workspace_switch_failed')+e.message);
   }
 }
 
 async function switchToWorkspace(path,name){
   if(!S.session)return;
   if(S.busy){
-    showToast('Cannot switch workspace while agent is running');
+    showToast(t('workspace_busy_switch'));
     return;
   }
   if(typeof _previewDirty!=='undefined'&&_previewDirty){
     const discard=await showConfirmDialog({
-      title:'Discard file edits?',
-      message:'Switching workspaces will discard unsaved file edits in the preview.',
+      title:t('discard_file_edits_title'),
+      message:t('discard_file_edits_message'),
       confirmLabel:t('discard'),
       danger:true
     });
@@ -784,8 +784,8 @@ async function switchToWorkspace(path,name){
     S.session.workspace=path;
     syncTopbar();
     await loadDir('.');
-    showToast(`Switched to ${name||getWorkspaceFriendlyName(path)}`);
-  }catch(e){setStatus('Switch failed: '+e.message);}
+    showToast(t('workspace_switched_to',name||getWorkspaceFriendlyName(path)));
+  }catch(e){setStatus(t('switch_failed')+e.message);}
 }
 
 // ── Profile panel + dropdown ──
@@ -799,7 +799,7 @@ async function loadProfilesPanel() {
     _profilesCache = data;
     panel.innerHTML = '';
     if (!data.profiles || !data.profiles.length) {
-      panel.innerHTML = '<div style="padding:16px;color:var(--muted);font-size:12px">No profiles found.</div>';
+      panel.innerHTML = `<div style="padding:16px;color:var(--muted);font-size:12px">${esc(t('profiles_no_profiles'))}</div>`;
       return;
     }
     for (const p of data.profiles) {
@@ -808,22 +808,22 @@ async function loadProfilesPanel() {
       const meta = [];
       if (p.model) meta.push(p.model.split('/').pop());
       if (p.provider) meta.push(p.provider);
-      if (p.skill_count) meta.push(p.skill_count + ' skill' + (p.skill_count !== 1 ? 's' : ''));
-      if (p.has_env) meta.push('API keys configured');
+      if (p.skill_count) meta.push(t('profile_skill_count', p.skill_count));
+      if (p.has_env) meta.push(t('profile_api_keys_configured'));
       const gwDot = p.gateway_running
-        ? '<span class="profile-opt-badge running" title="Gateway running"></span>'
-        : '<span class="profile-opt-badge stopped" title="Gateway stopped"></span>';
+        ? `<span class="profile-opt-badge running" title="${esc(t('profile_gateway_running'))}"></span>`
+        : `<span class="profile-opt-badge stopped" title="${esc(t('profile_gateway_stopped'))}"></span>`;
       const isActive = p.name === data.active;
-      const activeBadge = isActive ? '<span style="color:var(--link);font-size:10px;font-weight:600;margin-left:6px">ACTIVE</span>' : '';
+      const activeBadge = isActive ? `<span style="color:var(--link);font-size:10px;font-weight:600;margin-left:6px">${esc(t('profile_active'))}</span>` : '';
       card.innerHTML = `
         <div class="profile-card-header">
           <div style="min-width:0;flex:1">
             <div class="profile-card-name${isActive ? ' is-active' : ''}">${gwDot}${esc(p.name)}${p.is_default ? ' <span style="opacity:.5">(default)</span>' : ''}${activeBadge}</div>
-            ${meta.length ? `<div class="profile-card-meta">${esc(meta.join(' \u00b7 '))}</div>` : '<div class="profile-card-meta">No configuration</div>'}
+            ${meta.length ? `<div class="profile-card-meta">${esc(meta.join(' \u00b7 '))}</div>` : `<div class="profile-card-meta">${esc(t('profile_no_configuration'))}</div>`}
           </div>
           <div class="profile-card-actions">
-            ${!isActive ? `<button class="ws-action-btn" onclick="switchToProfile('${esc(p.name)}')" title="Switch to this profile">Use</button>` : ''}
-            ${!p.is_default ? `<button class="ws-action-btn danger" onclick="deleteProfile('${esc(p.name)}')" title="Delete this profile">${li('x',12)}</button>` : ''}
+            ${!isActive ? `<button class="ws-action-btn" onclick="switchToProfile('${esc(p.name)}')" title="${esc(t('profile_switch_title'))}">${esc(t('profile_use'))}</button>` : ''}
+            ${!p.is_default ? `<button class="ws-action-btn danger" onclick="deleteProfile('${esc(p.name)}')" title="${esc(t('profile_delete_title'))}">${li('x',12)}</button>` : ''}
           </div>
         </div>`;
       panel.appendChild(card);
@@ -844,7 +844,7 @@ function renderProfileDropdown(data) {
     opt.className = 'profile-opt' + (p.name === active ? ' active' : '');
     const meta = [];
     if (p.model) meta.push(p.model.split('/').pop());
-    if (p.skill_count) meta.push(p.skill_count + ' skills');
+    if (p.skill_count) meta.push(t('profile_skill_count', p.skill_count));
     const gwDot = `<span class="profile-opt-badge ${p.gateway_running ? 'running' : 'stopped'}"></span>`;
     const checkmark = p.name === active ? ' <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="var(--link)" stroke-width="3" style="vertical-align:-1px"><polyline points="20 6 9 17 4 12"/></svg>' : '';
     opt.innerHTML = `<div class="profile-opt-name">${gwDot}${esc(p.name)}${p.is_default ? ' <span style="opacity:.5;font-weight:400">(default)</span>' : ''}${checkmark}</div>` +
@@ -859,7 +859,7 @@ function renderProfileDropdown(data) {
   // Divider + Manage link
   const div = document.createElement('div'); div.className = 'ws-divider'; dd.appendChild(div);
   const mgmt = document.createElement('div'); mgmt.className = 'profile-opt ws-manage';
-  mgmt.innerHTML = `${li('settings',12)} Manage profiles`;
+  mgmt.innerHTML = `${li('settings',12)} ${esc(t('manage_profiles'))}`;
   mgmt.onclick = () => { closeProfileDropdown(); mobileSwitchPanel('profiles'); };
   dd.appendChild(mgmt);
 }
@@ -876,7 +876,7 @@ function toggleProfileDropdown() {
     _positionProfileDropdown();
     const chip=$('profileChip');
     if(chip) chip.classList.add('active');
-  }).catch(e => { showToast('Failed to load profiles'); });
+  }).catch(e => { showToast(t('profiles_load_failed')); });
 }
 
 function closeProfileDropdown() {
@@ -894,7 +894,7 @@ window.addEventListener('resize',()=>{
 });
 
 async function switchToProfile(name) {
-  if (S.busy) { showToast('Cannot switch profiles while agent is running'); return; }
+  if (S.busy) { showToast(t('profiles_busy_switch')); return; }
 
   // Determine whether the current session has any messages.
   // A session with messages is "in progress" and belongs to the current profile —
@@ -947,13 +947,25 @@ async function switchToProfile(name) {
       // The current session has messages and belongs to the previous profile.
       // Start a new session for the new profile so nothing gets cross-tagged.
       await newSession(false);
+      // Apply profile default workspace to the newly created session (fixes #424)
+      if (S._profileDefaultWorkspace && S.session) {
+        try {
+          await api('/api/session/update', { method: 'POST', body: JSON.stringify({
+            session_id: S.session.session_id,
+            workspace: S._profileDefaultWorkspace,
+            model: S.session.model,
+          })});
+          S.session.workspace = S._profileDefaultWorkspace;
+        } catch (_) {}
+      }
+      updateWorkspaceChip();
       await renderSessionList();
-      showToast('Switched to profile: ' + name + ' — new conversation started');
+      showToast(t('profile_switched_new_conversation', name));
     } else {
       // No messages yet — just refresh the list and topbar in place
       await renderSessionList();
       syncTopbar();
-      showToast('Switched to profile: ' + name);
+      showToast(t('profile_switched', name));
     }
 
     // ── Sidebar panels ─────────────────────────────────────────────────────
@@ -963,7 +975,7 @@ async function switchToProfile(name) {
     if (_currentPanel === 'profiles') await loadProfilesPanel();
     if (_currentPanel === 'workspaces') await loadWorkspacesPanel();
 
-  } catch (e) { showToast('Switch failed: ' + e.message); }
+  } catch (e) { showToast(t('switch_failed') + e.message); }
 }
 
 function toggleProfileForm() {
@@ -985,13 +997,13 @@ async function submitProfileCreate() {
   const name = ($('profileFormName').value || '').trim().toLowerCase();
   const cloneConfig = $('profileFormClone').checked;
   const errEl = $('profileFormError');
-  if (!name) { errEl.textContent = 'Name is required'; errEl.style.display = ''; return; }
-  if (!/^[a-z0-9][a-z0-9_-]{0,63}$/.test(name)) { errEl.textContent = 'Lowercase letters, numbers, hyphens, underscores only'; errEl.style.display = ''; return; }
+  if (!name) { errEl.textContent = t('name_required'); errEl.style.display = ''; return; }
+  if (!/^[a-z0-9][a-z0-9_-]{0,63}$/.test(name)) { errEl.textContent = t('profile_name_rule'); errEl.style.display = ''; return; }
   try {
     const baseUrl = (($('profileFormBaseUrl') && $('profileFormBaseUrl').value) || '').trim();
     const apiKey = (($('profileFormApiKey') && $('profileFormApiKey').value) || '').trim();
     if (baseUrl && !/^https?:\/\//.test(baseUrl)) {
-      errEl.textContent = 'Base URL must start with http:// or https://'; errEl.style.display = ''; return;
+      errEl.textContent = t('profile_base_url_rule'); errEl.style.display = ''; return;
     }
     const payload = { name, clone_config: cloneConfig };
     if (baseUrl) payload.base_url = baseUrl;
@@ -999,18 +1011,21 @@ async function submitProfileCreate() {
     await api('/api/profile/create', { method: 'POST', body: JSON.stringify(payload) });
     toggleProfileForm();
     await loadProfilesPanel();
-    showToast('Profile created: ' + name);
-  } catch (e) { errEl.textContent = e.message || 'Create failed'; errEl.style.display = ''; }
+    showToast(t('profile_created', name));
+  } catch (e) {
+    errEl.textContent = e.message || t('create_failed');
+    errEl.style.display = '';
+  }
 }
 
 async function deleteProfile(name) {
-  const _delProf=await showConfirmDialog({title:`Delete profile "${name}"?`,message:'This removes all config, skills, memory, and sessions for this profile.',confirmLabel:'Delete',danger:true,focusCancel:true});
+  const _delProf=await showConfirmDialog({title:t('profile_delete_confirm_title',name),message:t('profile_delete_confirm_message'),confirmLabel:t('delete_title'),danger:true,focusCancel:true});
   if(!_delProf) return;
   try {
     await api('/api/profile/delete', { method: 'POST', body: JSON.stringify({ name }) });
     await loadProfilesPanel();
-    showToast('Profile deleted: ' + name);
-  } catch (e) { showToast('Delete failed: ' + e.message); }
+    showToast(t('profile_deleted', name));
+  } catch (e) { showToast(t('delete_failed') + e.message); }
 }
 
 // ── Memory panel ──
@@ -1023,23 +1038,23 @@ async function loadMemory(force) {
     panel.innerHTML = `
       <div class="memory-section">
         <div class="memory-section-title">
-          <span style="display:inline-flex;align-items:center;gap:6px">${li('brain',14)} My Notes</span>
+          <span style="display:inline-flex;align-items:center;gap:6px">${li('brain',14)} ${esc(t('my_notes'))}</span>
           <span class="memory-mtime">${fmtTime(data.memory_mtime)}</span>
         </div>
         ${data.memory
           ? `<div class="memory-content preview-md">${renderMd(data.memory)}</div>`
-          : '<div class="memory-empty">No notes yet.</div>'}
+          : `<div class="memory-empty">${esc(t('no_notes_yet'))}</div>`}
       </div>
       <div class="memory-section">
         <div class="memory-section-title">
-          <span style="display:inline-flex;align-items:center;gap:6px">${li('user',14)} User Profile</span>
+          <span style="display:inline-flex;align-items:center;gap:6px">${li('user',14)} ${esc(t('user_profile'))}</span>
           <span class="memory-mtime">${fmtTime(data.user_mtime)}</span>
         </div>
         ${data.user
           ? `<div class="memory-content preview-md">${renderMd(data.user)}</div>`
-          : '<div class="memory-empty">No profile yet.</div>'}
+          : `<div class="memory-empty">${esc(t('no_profile_yet'))}</div>`}
       </div>`;
-  } catch(e) { panel.innerHTML = `<div style="color:var(--accent);font-size:12px">Error: ${esc(e.message)}</div>`; }
+  } catch(e) { panel.innerHTML = `<div style="color:var(--accent);font-size:12px">${esc(t('error_prefix'))}${esc(e.message)}</div>`; }
 }
 
 // Drag and drop
@@ -1074,12 +1089,12 @@ function switchSettingsSection(name){
 function _syncHermesPanelSessionActions(){
   const hasSession=!!S.session;
   const visibleMessages=hasSession?(S.messages||[]).filter(m=>m&&m.role&&m.role!=='tool').length:0;
-  const title=hasSession?(S.session.title||'Untitled'):'No active conversation selected.';
+  const title=hasSession?(S.session.title||t('untitled')):t('active_conversation_none');
   const meta=$('hermesSessionMeta');
   if(meta){
     meta.textContent=hasSession
-      ? `${title} · ${visibleMessages} message${visibleMessages===1?'':'s'}`
-      : 'No active conversation selected.';
+      ? t('active_conversation_meta', title, visibleMessages)
+      : t('active_conversation_none');
   }
   const setDisabled=(id,disabled)=>{
     const el=$(id);
@@ -1148,10 +1163,10 @@ function _showSettingsUnsavedBar(){
   bar = document.createElement('div');
   bar.id = 'settingsUnsavedBar';
   bar.style.cssText = 'display:flex;align-items:center;justify-content:space-between;gap:8px;background:rgba(233,69,96,.12);border:1px solid rgba(233,69,96,.3);border-radius:8px;padding:10px 14px;margin:0 0 12px;font-size:13px;';
-  bar.innerHTML = '<span style="color:var(--text)">You have unsaved changes.</span>'
+  bar.innerHTML = `<span style="color:var(--text)">${esc(t('settings_unsaved_changes'))}</span>`
     + '<span style="display:flex;gap:8px">'
-    + '<button onclick="_discardSettings()" style="padding:5px 12px;border-radius:6px;border:1px solid var(--border2);background:rgba(255,255,255,.06);color:var(--muted);cursor:pointer;font-size:12px;font-weight:600">Discard</button>'
-    + '<button onclick="saveSettings(true)" style="padding:5px 12px;border-radius:6px;border:none;background:var(--accent);color:#fff;cursor:pointer;font-size:12px;font-weight:600">Save</button>'
+    + `<button onclick="_discardSettings()" style="padding:5px 12px;border-radius:6px;border:1px solid var(--border2);background:rgba(255,255,255,.06);color:var(--muted);cursor:pointer;font-size:12px;font-weight:600">${esc(t('discard'))}</button>`
+    + `<button onclick="saveSettings(true)" style="padding:5px 12px;border-radius:6px;border:none;background:var(--accent);color:#fff;cursor:pointer;font-size:12px;font-weight:600">${esc(t('save'))}</button>`
     + '</span>';
   const body = document.querySelector('.settings-main') || document.querySelector('.settings-body') || document.querySelector('.settings-panel');
   if(body) body.prepend(bar);
@@ -1171,8 +1186,14 @@ function _markSettingsDirty(){
 async function loadSettingsPanel(){
   try{
     const settings=await api('/api/settings');
-    // Apply server-persisted locale immediately (overrides localStorage boot default)
-    if(settings.language && typeof setLocale==='function') setLocale(settings.language);
+    const resolvedLanguage=(typeof resolvePreferredLocale==='function')
+      ? resolvePreferredLocale(settings.language, localStorage.getItem('hermes-lang'))
+      : (settings.language || localStorage.getItem('hermes-lang') || 'en');
+    // Keep settings modal and current page strings in sync with the resolved locale.
+    if(typeof setLocale==='function'){
+      setLocale(resolvedLanguage);
+      if(typeof applyLocaleToDOM==='function') applyLocaleToDOM();
+    }
     // Populate model dropdown from /api/models
     const modelSel=$('settingsModel');
     if(modelSel){
@@ -1210,7 +1231,7 @@ async function loadSettingsPanel(){
           langSel.appendChild(opt);
         }
       }
-      langSel.value=settings.language||'en';
+      langSel.value=resolvedLanguage;
       langSel.addEventListener('change',_markSettingsDirty,{once:false});
     }
     const showUsageCb=$('settingsShowTokenUsage');
@@ -1236,11 +1257,7 @@ async function loadSettingsPanel(){
     // Show auth buttons only when auth is active
     try{
       const authStatus=await api('/api/auth/status');
-      const active=authStatus.auth_enabled;
-      const signOutBtn=$('btnSignOut');
-      if(signOutBtn) signOutBtn.style.display=active?'':'none';
-      const disableBtn=$('btnDisableAuth');
-      if(disableBtn) disableBtn.style.display=active?'':'none';
+      _setSettingsAuthButtonsVisible(!!authStatus.auth_enabled);
     }catch(e){}
     _syncHermesPanelSessionActions();
     switchSettingsSection(_settingsSection);
@@ -1249,6 +1266,39 @@ async function loadSettingsPanel(){
   }
 }
 
+function _setSettingsAuthButtonsVisible(active){
+  const signOutBtn=$('btnSignOut');
+  if(signOutBtn) signOutBtn.style.display=active?'':'none';
+  const disableBtn=$('btnDisableAuth');
+  if(disableBtn) disableBtn.style.display=active?'':'none';
+}
+
+function _applySavedSettingsUi(saved, body, opts){
+  const {sendKey,showTokenUsage,showCliSessions,theme,language}=opts;
+  window._sendKey=sendKey||'enter';
+  window._showTokenUsage=showTokenUsage;
+  window._showCliSessions=showCliSessions;
+  window._soundEnabled=body.sound_enabled;
+  window._notificationsEnabled=body.notifications_enabled;
+  window._botName=body.bot_name||'Hermes';
+  document.body.classList.toggle('bubble-layout', !!body.bubble_layout);
+  if(typeof applyBotName==='function') applyBotName();
+  if(typeof setLocale==='function') setLocale(language);
+  if(typeof applyLocaleToDOM==='function') applyLocaleToDOM();
+  if(typeof startGatewaySSE==='function'){
+    if(showCliSessions) startGatewaySSE();
+    else if(typeof stopGatewaySSE==='function') stopGatewaySSE();
+  }
+  _setSettingsAuthButtonsVisible(!!saved.auth_enabled);
+  _settingsDirty=false;
+  _settingsThemeOnOpen=theme;
+  const bar=$('settingsUnsavedBar');
+  if(bar) bar.style.display='none';
+  renderMessages();
+  if(typeof syncTopbar==='function') syncTopbar();
+  if(typeof renderSessionList==='function') renderSessionList();
+}
+
 async function saveSettings(andClose){
   const model=($('settingsModel')||{}).value;
   const sendKey=($('settingsSendKey')||{}).value;
@@ -1276,37 +1326,16 @@ async function saveSettings(andClose){
   // Password: only act if the field has content; blank = leave auth unchanged
   if(pw && pw.trim()){
     try{
-      await api('/api/settings',{method:'POST',body:JSON.stringify({...body,_set_password:pw.trim()})});
-      window._sendKey=sendKey||'enter';
-      window._showTokenUsage=showTokenUsage;
-      window._soundEnabled=body.sound_enabled;
-      window._notificationsEnabled=body.notifications_enabled;
-      if(typeof setLocale==='function') setLocale(language);
-      if(typeof applyLocaleToDOM==='function') applyLocaleToDOM();
-      showToast(t('settings_saved_pw'));
-      _settingsDirty=false; _settingsThemeOnOpen=theme;
+      const saved=await api('/api/settings',{method:'POST',body:JSON.stringify({...body,_set_password:pw.trim()})});
+      _applySavedSettingsUi(saved, body, {sendKey,showTokenUsage,showCliSessions,theme,language});
+      showToast(t(saved.auth_just_enabled?'settings_saved_pw':'settings_saved_pw_updated'));
       _hideSettingsPanel();
       return;
-    }catch(e){showToast('Save failed: '+e.message);return;}
+    }catch(e){showToast(t('settings_save_failed')+e.message);return;}
   }
   try{
-    await api('/api/settings',{method:'POST',body:JSON.stringify(body)});
-    window._sendKey=sendKey||'enter';
-    window._showTokenUsage=showTokenUsage;
-    window._showCliSessions=showCliSessions;
-    window._soundEnabled=body.sound_enabled;
-    window._notificationsEnabled=body.notifications_enabled;
-    window._botName=body.bot_name;
-    if(typeof applyBotName==='function') applyBotName();
-    if(typeof setLocale==='function') setLocale(language);
-    if(typeof applyLocaleToDOM==='function') applyLocaleToDOM();
-    // Restart gateway SSE when agent session setting changes
-    if(typeof startGatewaySSE==='function'){if(showCliSessions)startGatewaySSE();else if(typeof stopGatewaySSE==='function')stopGatewaySSE();}
-    _settingsDirty=false; _settingsThemeOnOpen=theme;
-    const bar=$('settingsUnsavedBar'); if(bar) bar.style.display='none';
-    renderMessages();
-    if(typeof syncTopbar==='function') syncTopbar();
-    if(typeof renderSessionList==='function') renderSessionList();
+    const saved=await api('/api/settings',{method:'POST',body:JSON.stringify(body)});
+    _applySavedSettingsUi(saved, body, {sendKey,showTokenUsage,showCliSessions,theme,language});
     showToast(t('settings_saved'));
     _hideSettingsPanel();
   }catch(e){
@@ -1319,23 +1348,23 @@ async function signOut(){
     await api('/api/auth/logout',{method:'POST',body:'{}'});
     window.location.href='/login';
   }catch(e){
-    showToast('Sign out failed: '+e.message);
+    showToast(t('sign_out_failed')+e.message);
   }
 }
 
 async function disableAuth(){
-  const _disAuth=await showConfirmDialog({title:'Disable password protection',message:'Anyone will be able to access this instance.',confirmLabel:'Disable',danger:true,focusCancel:true});
+  const _disAuth=await showConfirmDialog({title:t('disable_auth_confirm_title'),message:t('disable_auth_confirm_message'),confirmLabel:t('disable'),danger:true,focusCancel:true});
   if(!_disAuth) return;
   try{
     await api('/api/settings',{method:'POST',body:JSON.stringify({_clear_password:true})});
-    showToast('Auth disabled — password protection removed');
+    showToast(t('auth_disabled'));
     // Hide both auth buttons since auth is now off
     const disableBtn=$('btnDisableAuth');
     if(disableBtn) disableBtn.style.display='none';
     const signOutBtn=$('btnSignOut');
     if(signOutBtn) signOutBtn.style.display='none';
   }catch(e){
-    showToast('Failed to disable auth: '+e.message);
+    showToast(t('disable_auth_failed')+e.message);
   }
 }
 
@@ -1359,7 +1388,7 @@ function startCronPolling(){
       const data=await api(`/api/crons/recent?since=${_cronPollSince}`);
       if(data.completions&&data.completions.length>0){
         for(const c of data.completions){
-          showToast(`Cron "${c.name}" ${c.status==='error'?'failed':'completed'}`,4000);
+          showToast(t('cron_completion_status', c.name, c.status==='error' ? t('status_failed') : t('status_completed')),4000);
           _cronPollSince=Math.max(_cronPollSince,c.completed_at);
         }
         _cronUnreadCount+=data.completions.length;
@@ -1404,7 +1433,7 @@ const _backgroundErrors=[];  // {session_id, title, message, ts}
 function trackBackgroundError(sessionId, title, message){
   // Only track if user is NOT currently viewing this session
   if(S.session&&S.session.session_id===sessionId) return;
-  _backgroundErrors.push({session_id:sessionId, title:title||'Untitled', message, ts:Date.now()});
+  _backgroundErrors.push({session_id:sessionId, title:title||t('untitled'), message, ts:Date.now()});
   showErrorBanner();
 }
 
@@ -1421,7 +1450,8 @@ function showErrorBanner(){
   const latest=_backgroundErrors[0];  // FIFO: show oldest (first) error
   if(!latest){banner.style.display='none';return;}
   const count=_backgroundErrors.length;
-  banner.innerHTML=`<span>\u26a0 ${count>1?count+' sessions have':'"'+esc(latest.title)+'" has'} encountered an error</span><div style="display:flex;gap:6px;flex-shrink:0"><button class="reconnect-btn" onclick="navigateToErrorSession()">View</button><button class="reconnect-btn" onclick="dismissErrorBanner()">Dismiss</button></div>`;
+  const msg=count>1?t('bg_error_multi',count):t('bg_error_single',latest.title);
+  banner.innerHTML=`<span>\u26a0 ${esc(msg)}</span><div style="display:flex;gap:6px;flex-shrink:0"><button class="reconnect-btn" onclick="navigateToErrorSession()">${esc(t('view'))}</button><button class="reconnect-btn" onclick="dismissErrorBanner()">${esc(t('dismiss'))}</button></div>`;
   banner.style.display='';
 }
 

static/sessions.js

@@ -42,6 +42,35 @@ async function loadSession(sid){
   S.session=data.session;
   S.lastUsage={...(data.session.last_usage||{})};
   localStorage.setItem('hermes-webui-session',S.session.session_id);
+  // B9: sanitize empty assistant messages (PR #402) — build index map to remap
+  // session-level tool_calls.assistant_msg_idx to the new sanitized positions.
+  const allMsgs = data.session.messages || [];
+  const sanitized = [];
+  const origIdxToSanitizedIdx = {};
+  let lastKeptAsstIdx = -1;
+  for (let i = 0; i < allMsgs.length; i++) {
+    const m = allMsgs[i];
+    if (!m || !m.role) continue;
+    if (m.role === 'tool') continue;
+    if (m.role === 'assistant') {
+      let c = m.content || '';
+      if (Array.isArray(c)) c = c.filter(p => p && p.type === 'text').map(p => p.text || '').join('');
+      if (!String(c).trim().length) { continue; }  // empty assistant — skip
+      lastKeptAsstIdx = sanitized.length;
+    }
+    origIdxToSanitizedIdx[i] = sanitized.length;
+    sanitized.push(m);
+  }
+  if (data.session.tool_calls && data.session.tool_calls.length) {
+    for (const tc of data.session.tool_calls) {
+      if (!tc || tc.assistant_msg_idx === undefined) continue;
+      const origIdx = tc.assistant_msg_idx;
+      tc.assistant_msg_idx = (origIdx in origIdxToSanitizedIdx)
+        ? origIdxToSanitizedIdx[origIdx]
+        : (lastKeptAsstIdx >= 0 ? lastKeptAsstIdx : -1);
+    }
+  }
+  data.session.messages = sanitized;
   const activeStreamId=data.session.active_stream_id||null;
   if(!INFLIGHT[sid]&&activeStreamId&&typeof loadInflightState==='function'){
     const stored=loadInflightState(sid, activeStreamId);
@@ -54,9 +83,6 @@ async function loadSession(sid){
       };
     }
   }
-  // Keep raw session.messages intact so side panels (e.g. Todos) can still
-  // reconstruct state from tool outputs after reload. Visible transcript rows
-  // are filtered later by renderMessages().
   if(INFLIGHT[sid]){
     S.messages=INFLIGHT[sid].messages;
     S.toolCalls=(INFLIGHT[sid].toolCalls||[]);
@@ -80,7 +106,11 @@ async function loadSession(sid){
     S.messages=data.session.messages||[];
     const pendingMsg=typeof getPendingSessionMessage==='function'?getPendingSessionMessage(data.session):null;
     if(pendingMsg) S.messages.push(pendingMsg);
-    S.toolCalls=(data.session.tool_calls||[]).map(tc=>({...tc,done:true}));
+    // Fix (PR #402): do NOT pre-fill S.toolCalls from session-level tool_calls —
+    // those have stale assistant_msg_idx values after B9 sanitization. Instead,
+    // set S.toolCalls=[] and let renderMessages() derive them from per-message
+    // tool_calls (which already have correct sanitized-array indices).
+    S.toolCalls=[];
     clearLiveToolCards();
     if(activeStreamId){
       S.busy=true;
@@ -344,6 +374,72 @@ function filterSessions(){
   }, 350);
 }
 
+function _sessionTimestampMs(session) {
+  const raw = Number(session && (session.updated_at || session.created_at || 0));
+  return Number.isFinite(raw) ? raw * 1000 : 0;
+}
+
+function _localDayOrdinal(timestampMs) {
+  const date = new Date(timestampMs);
+  return Math.floor(Date.UTC(date.getFullYear(), date.getMonth(), date.getDate()) / 86400000);
+}
+
+function _sessionCalendarBoundaries(nowMs = Date.now()) {
+  const now = new Date(nowMs);
+  const startOfToday = new Date(now.getFullYear(), now.getMonth(), now.getDate());
+  const startOfYesterday = new Date(now.getFullYear(), now.getMonth(), now.getDate() - 1);
+  const startOfWeek = new Date(startOfToday);
+  startOfWeek.setDate(startOfWeek.getDate() - ((startOfWeek.getDay() + 6) % 7));
+  const startOfLastWeek = new Date(startOfWeek);
+  startOfLastWeek.setDate(startOfLastWeek.getDate() - 7);
+  return {
+    startOfToday: startOfToday.getTime(),
+    startOfYesterday: startOfYesterday.getTime(),
+    startOfWeek: startOfWeek.getTime(),
+    startOfLastWeek: startOfLastWeek.getTime(),
+  };
+}
+
+function _formatSessionDate(timestampMs, nowMs = Date.now()) {
+  const date = new Date(timestampMs);
+  const now = new Date(nowMs);
+  const options = {month:'short', day:'numeric'};
+  if (date.getFullYear() !== now.getFullYear()) options.year = 'numeric';
+  return date.toLocaleDateString(undefined, options);
+}
+
+function _formatRelativeSessionTime(timestampMs, nowMs = Date.now()) {
+  if (!timestampMs) return t('session_time_unknown');
+  const diffMs = Math.max(0, nowMs - timestampMs);
+  const minute = 60 * 1000;
+  const hour = 60 * minute;
+  const {startOfToday, startOfYesterday, startOfWeek, startOfLastWeek} = _sessionCalendarBoundaries(nowMs);
+  const dayDiff = Math.max(0, _localDayOrdinal(nowMs) - _localDayOrdinal(timestampMs));
+  if (timestampMs >= startOfToday) {
+    if (diffMs < minute) return t('session_time_just_now');
+    if (diffMs < hour) {
+      const minutes = Math.floor(diffMs / minute);
+      return t('session_time_minutes_ago', minutes);
+    }
+    const hours = Math.floor(diffMs / hour);
+    return t('session_time_hours_ago', hours);
+  }
+  if (timestampMs >= startOfYesterday) return t('session_time_bucket_yesterday');
+  if (timestampMs >= startOfWeek) return t('session_time_days_ago', dayDiff);
+  if (timestampMs >= startOfLastWeek) return t('session_time_last_week');
+  return _formatSessionDate(timestampMs, nowMs);
+}
+
+function _sessionTimeBucketLabel(timestampMs, nowMs = Date.now()) {
+  if (!timestampMs) return t('session_time_bucket_older');
+  const {startOfToday, startOfYesterday, startOfWeek, startOfLastWeek} = _sessionCalendarBoundaries(nowMs);
+  if (timestampMs >= startOfToday) return t('session_time_bucket_today');
+  if (timestampMs >= startOfYesterday) return t('session_time_bucket_yesterday');
+  if (timestampMs >= startOfWeek) return t('session_time_bucket_this_week');
+  if (timestampMs >= startOfLastWeek) return t('session_time_bucket_last_week');
+  return t('session_time_bucket_older');
+}
+
 function renderSessionListFromCache(){
   // Don't re-render while user is actively renaming a session (would destroy the input)
   if(_renamingSid) return;
@@ -430,12 +526,12 @@ function renderSessionListFromCache(){
     empty.textContent='No sessions in this project yet.';
     list.appendChild(empty);
   }
+  const orderedSessions=[...sessions].sort((a,b)=>_sessionTimestampMs(b)-_sessionTimestampMs(a));
   // Separate pinned from unpinned
-  const pinned=sessions.filter(s=>s.pinned);
-  const unpinned=sessions.filter(s=>!s.pinned);
-  // Date grouping: Pinned / Today / Yesterday / Earlier
+  const pinned=orderedSessions.filter(s=>s.pinned);
+  const unpinned=orderedSessions.filter(s=>!s.pinned);
+  // Date grouping: Pinned / Today / Yesterday / This week / Last week / Older
   const now=Date.now();
-  const ONE_DAY=86400000;
   // Collapse state persisted in localStorage
   let _groupCollapsed={};
   try{_groupCollapsed=JSON.parse(localStorage.getItem('hermes-date-groups-collapsed')||'{}');}catch(e){}
@@ -445,8 +541,8 @@ function renderSessionListFromCache(){
   let curLabel=null,curItems=[];
   if(pinned.length) groups.push({label:'\u2605 Pinned',items:pinned,isPinned:true});
   for(const s of unpinned){
-    const ts=(s.updated_at||s.created_at||0)*1000;
-    const label=ts>now-ONE_DAY?'Today':ts>now-2*ONE_DAY?'Yesterday':'Earlier';
+    const ts=_sessionTimestampMs(s);
+    const label=_sessionTimeBucketLabel(ts, now);
     if(label!==curLabel){
       if(curItems.length) groups.push({label:curLabel,items:curItems});
       curLabel=label;curItems=[s];
@@ -482,6 +578,10 @@ function renderSessionListFromCache(){
   }
   // ── Render session items (extracted for group body use) ──
   // Note: declared after the groups loop but available via function hoisting.
+  function _formatSourceTag(tag){
+    const names={telegram:'via Telegram',discord:'via Discord',slack:'via Slack',cli:'CLI',feishu:'via Feishu',weixin:'via WeChat'};
+    return names[tag]||tag;
+  }
   function _renderOneSession(s){
     const el=document.createElement('div');
     const isActive=S.session&&s.session_id===S.session.session_id;
@@ -491,10 +591,27 @@ function renderSessionListFromCache(){
     const rawTitle=s.title||'Untitled';
     const tags=(rawTitle.match(/#[\w-]+/g)||[]);
     const cleanTitle=tags.length?rawTitle.replace(/#[\w-]+/g,'').trim():rawTitle;
+    const sessionText=document.createElement('div');
+    sessionText.className='session-text';
+    const titleRow=document.createElement('div');
+    titleRow.className='session-title-row';
     const title=document.createElement('span');
     title.className='session-title';
     title.textContent=cleanTitle||'Untitled';
     title.title='Double-click to rename';
+    const tsMs=_sessionTimestampMs(s);
+    titleRow.appendChild(title);
+    const metaBits=[];
+    if(s.is_cli_session && s.source_tag) metaBits.push(_formatSourceTag(s.source_tag));
+    if(s.message_count) metaBits.push(t('n_messages', s.message_count));
+    if(s.model) metaBits.push(String(s.model).split('/').pop());
+    sessionText.appendChild(titleRow);
+    if(metaBits.length){
+      const meta=document.createElement('div');
+      meta.className='session-meta';
+      meta.textContent=metaBits.join(' · ');
+      sessionText.appendChild(meta);
+    }
     // Append tag chips after the title text
     for(const tag of tags){
       const chip=document.createElement('span');
@@ -561,7 +678,7 @@ function renderSessionListFromCache(){
         title.appendChild(dot);
       }
     }
-    el.appendChild(title);
+    el.appendChild(sessionText);
     // Single trigger button that opens a shared dropdown menu
     const actions=document.createElement('div');
     actions.className='session-actions';

static/style.css

@@ -34,6 +34,7 @@
   :root[data-theme="light"] .session-item{color:#5a544a;}
   :root[data-theme="light"] .session-item:hover{background:rgba(0,0,0,.06);color:#2c2825;}
   :root[data-theme="light"] .session-item.active{background:rgba(45,111,163,.1);color:#1a5a8a;}
+  :root[data-theme="light"] .session-item.active .session-title{color:#1a5a8a;}
   :root[data-theme="light"] .session-pin-indicator{color:#996b15;}
   :root[data-theme="light"] .session-date-header.pinned{color:#996b15;}
   :root[data-theme="light"] .session-actions-trigger.active,
@@ -76,6 +77,42 @@
   :root[data-theme="light"] .profile-opt:hover{background:rgba(0,0,0,.05);}
   :root[data-theme="light"] .profile-opt.active{background:rgba(45,111,163,.06);}
   :root[data-theme="light"] .profile-chip{color:#7a5a90!important;}
+  /* ── Light theme: Prism syntax token overrides (prism-tomorrow is dark-only) ── */
+  :root[data-theme="light"] .token.comment,
+  :root[data-theme="light"] .token.prolog,
+  :root[data-theme="light"] .token.doctype,
+  :root[data-theme="light"] .token.cdata{color:#7a7060;font-style:italic;}
+  :root[data-theme="light"] .token.punctuation{color:#5a4e44;}
+  :root[data-theme="light"] .token.namespace{opacity:.8;}
+  :root[data-theme="light"] .token.property,
+  :root[data-theme="light"] .token.tag,
+  :root[data-theme="light"] .token.boolean,
+  :root[data-theme="light"] .token.number,
+  :root[data-theme="light"] .token.constant,
+  :root[data-theme="light"] .token.symbol,
+  :root[data-theme="light"] .token.deleted{color:#a0290a;}
+  :root[data-theme="light"] .token.selector,
+  :root[data-theme="light"] .token.attr-name,
+  :root[data-theme="light"] .token.string,
+  :root[data-theme="light"] .token.char,
+  :root[data-theme="light"] .token.builtin,
+  :root[data-theme="light"] .token.inserted{color:#276b30;}
+  :root[data-theme="light"] .token.operator,
+  :root[data-theme="light"] .token.entity,
+  :root[data-theme="light"] .token.url,
+  :root[data-theme="light"] .language-css .token.string,
+  :root[data-theme="light"] .style .token.string{color:#5a3e8a;}
+  :root[data-theme="light"] .token.atrule,
+  :root[data-theme="light"] .token.attr-value,
+  :root[data-theme="light"] .token.keyword{color:#2d6fa3;}
+  :root[data-theme="light"] .token.function,
+  :root[data-theme="light"] .token.class-name{color:#7a3a00;}
+  :root[data-theme="light"] .token.regex,
+  :root[data-theme="light"] .token.important,
+  :root[data-theme="light"] .token.variable{color:#8a4a00;}
+  :root[data-theme="light"] .token.important,
+  :root[data-theme="light"] .token.bold{font-weight:bold;}
+  :root[data-theme="light"] .token.italic{font-style:italic;}
   :root[data-theme="light"] .nav-tab:hover::after{background:var(--surface);border-color:rgba(45,111,163,.25);color:#2d6fa3;}
   :root[data-theme="light"] .cron-status.disabled{background:rgba(0,0,0,.05);}
   :root[data-theme="light"] .cron-btn{background:rgba(0,0,0,.04);}
@@ -129,10 +166,15 @@
   .session-search input::placeholder{color:var(--muted);opacity:.7;}
   /* Inline session title edit */
   .session-title-input{flex:1;background:var(--surface);border:1px solid rgba(124,185,255,.6);border-radius:6px;color:var(--text);padding:3px 8px;font-size:13px;outline:none;min-width:0;box-shadow:0 0 0 2px rgba(124,185,255,.15);font-family:inherit;}
-  .session-item{padding:8px 40px 8px 8px;margin-bottom:2px;border-radius:8px;cursor:pointer;font-size:13px;color:var(--muted);white-space:nowrap;overflow:hidden;text-overflow:ellipsis;transition:background .15s,color .15s;display:flex;align-items:center;gap:6px;min-width:0;position:relative;}
+  .session-item{padding:8px 40px 8px 8px;margin-bottom:2px;border-radius:8px;cursor:pointer;font-size:13px;color:var(--muted);transition:background .15s,color .15s;display:flex;align-items:flex-start;gap:8px;min-width:0;position:relative;}
   .session-item:hover{background:var(--hover-bg);color:var(--text);}
   .session-item.active{background:rgba(232,160,48,0.12);color:#e8a030;}
-  .session-title{flex:1;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;}
+  .session-text{flex:1;min-width:0;display:flex;flex-direction:column;gap:2px;overflow:hidden;}
+  .session-title-row{display:flex;align-items:flex-start;gap:8px;min-width:0;}
+  .session-title{flex:1;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;color:var(--text);}
+  .session-item.active .session-title{color:var(--gold);}
+  .session-time{display:none;}
+  .session-meta{font-size:11px;line-height:1.35;color:var(--muted);white-space:nowrap;overflow:hidden;text-overflow:ellipsis;}
   /* ── Session action trigger + dropdown ── */
   .session-actions{position:absolute;right:6px;top:50%;transform:translateY(-50%);display:flex;align-items:center;justify-content:center;opacity:0;pointer-events:none;transition:opacity .15s ease;}
   .session-item:hover .session-actions,.session-item:focus-within .session-actions,.session-item.menu-open .session-actions{opacity:1;pointer-events:auto;}
@@ -376,6 +418,8 @@
   .msg-body code{font-family:"SF Mono","Fira Code",ui-monospace,monospace;font-size:12.5px;background:var(--code-inline-bg);padding:1px 5px;border-radius:4px;color:var(--code-text);}
   .msg-body pre{background:var(--code-bg);border:1px solid var(--border);border-radius:10px;padding:14px 16px;overflow-x:auto;margin:10px 0;}
   .msg-body pre code{background:none;padding:0;border-radius:0;color:var(--pre-text);font-size:13px;line-height:1.6;}
+  /* Keep original theme background — prevent prism-tomorrow from overriding --code-bg */
+  .msg-body pre[class*="language-"],.msg-body pre code[class*="language-"]{background:var(--code-bg) !important;}
   .pre-header{font-size:10px;font-weight:600;text-transform:uppercase;letter-spacing:.06em;color:var(--muted);padding:8px 16px 8px;background:var(--input-bg);border-radius:10px 10px 0 0;border:1px solid var(--border);border-bottom:1px solid var(--border);display:flex;align-items:center;gap:6px;}
   .pre-header::before{content:'';width:8px;height:8px;border-radius:50%;background:var(--muted);opacity:.4;}
   .pre-header+pre{border-radius:0 0 10px 10px;border-top:none;margin-top:0;}
@@ -530,6 +574,8 @@
   .preview-md code{font-family:"SF Mono",ui-monospace,monospace;font-size:11.5px;background:var(--code-inline-bg);padding:1px 5px;border-radius:4px;color:var(--code-text);}
   .preview-md pre{background:var(--code-bg);border:1px solid var(--border);border-radius:8px;padding:10px 12px;overflow-x:auto;margin:8px 0;}
   .preview-md pre code{background:none;padding:0;color:var(--pre-text);font-size:11.5px;line-height:1.55;}
+  /* Keep original theme background — prevent prism-tomorrow from overriding --code-bg */
+  .preview-md pre[class*="language-"],.preview-md pre code[class*="language-"]{background:var(--code-bg) !important;}
   .preview-md blockquote{border-left:3px solid var(--blue);padding-left:12px;color:var(--muted);font-style:italic;margin:8px 0;}
   .preview-md strong{color:var(--strong);font-weight:600;}.preview-md em{color:var(--em);}
   .preview-md a{color:var(--blue);text-decoration:underline;}
@@ -551,7 +597,6 @@
   .mobile-hamburger{display:none;}
   .mobile-files-btn{display:none!important;}
   .mobile-overlay{display:none;}
-  .mobile-bottom-nav{display:none;}
 
   @media(min-width:901px){
     .layout.workspace-panel-collapsed .rightpanel{width:0 !important;opacity:0;transform:translateX(14px);border-left-color:transparent;pointer-events:none;}
@@ -587,20 +632,6 @@
       box-shadow:-4px 0 24px rgba(0,0,0,.4);}
     .rightpanel.mobile-open{right:0;}
     .rightpanel .resize-handle{display:none;}
-    /* Bottom navigation bar */
-    .mobile-bottom-nav{display:flex;position:fixed;bottom:0;left:0;right:0;
-      background:var(--sidebar);border-top:1px solid var(--border);
-      z-index:150;padding:4px 0 env(safe-area-inset-bottom,0);
-      justify-content:space-around;align-items:center;}
-    .mobile-nav-btn{display:flex;flex-direction:column;align-items:center;gap:2px;
-      background:none;border:none;color:var(--muted);font-size:9px;padding:6px 4px;
-      cursor:pointer;min-width:44px;min-height:44px;justify-content:center;
-      -webkit-tap-highlight-color:transparent;transition:color .15s;}
-    .mobile-nav-btn.active{color:var(--blue);}
-    .mobile-nav-btn:hover{color:var(--text);}
-    .mobile-nav-btn svg{flex-shrink:0;}
-    /* Hide sidebar nav tabs (replaced by bottom nav) */
-    .sidebar-nav{display:none;}
     /* Keep the Hermes control available at the bottom of the mobile sidebar */
     .sidebar-bottom{display:block;padding:10px;}
     /* Topbar adjustments */
@@ -614,13 +645,10 @@
     .settings-tab{flex-shrink:0;}
     .settings-main{padding:18px 16px;}
     .hermes-action-grid{grid-template-columns:1fr;}
-    /* Messages area — account for bottom nav */
-    .messages{padding-bottom:60px;}
     .messages-inner{padding:12px 10px 20px;}
     .msg-body{padding-left:0;max-width:100%;}
     .msg-role{font-size:12px;}
-    /* Composer — above bottom nav */
-    .composer-wrap{padding:8px 10px 12px!important;margin-bottom:56px;}
+    .composer-wrap{padding:8px 10px 12px!important;}
     .composer-box{border-radius:12px;}
     .composer-box textarea{font-size:16px;min-height:40px;}
     .composer-footer{padding:6px 8px 8px!important;gap:8px;}
@@ -1071,8 +1099,8 @@ body.resizing{user-select:none;cursor:col-resize;}
   display: none;
 }
 /* Source-specific colors for gateway sessions */
-.session-item.cli-session[data-source="telegram"] { border-left-color: #0088cc; }
-.session-item.cli-session[data-source="telegram"]::after { color: #0088cc; }
+.session-item.cli-session[data-source="telegram"] { border-left-color: rgba(0, 136, 204, 0.55); }
+.session-item.cli-session[data-source="telegram"]::after { color: rgba(0, 136, 204, 0.55); }
 .session-item.cli-session[data-source="discord"] { border-left-color: #5865F2; }
 .session-item.cli-session[data-source="discord"]::after { color: #5865F2; }
 .session-item.cli-session[data-source="slack"] { border-left-color: #4A154B; }

static/ui.js

@@ -105,7 +105,7 @@ const _liveModelCache={};
 async function _fetchLiveModels(provider, sel){
   if(!provider||!sel) return;
   // Don't fetch for providers where we know it's unsupported or unnecessary
-  if(['anthropic','google','gemini'].includes(provider)) return;
+  // All providers now supported via agent's provider_model_ids() — no exclusions needed
   if(_liveModelCache[provider]) return; // already fetched this session
   try{
     const url=new URL('/api/models/live',location.origin);
@@ -411,7 +411,12 @@ function renderMd(raw){
     const id='mermaid-'+Math.random().toString(36).slice(2,10);
     return `<div class="mermaid-block" data-mermaid-id="${id}">${esc(code.trim())}</div>`;
   });
-  s=s.replace(/```([\w+-]*)\n?([\s\S]*?)```/g,(_,lang,code)=>{const h=lang?`<div class="pre-header">${esc(lang)}</div>`:'';return `${h}<pre><code>${esc(code.replace(/\n$/,''))}</code></pre>`;});
+  s=s.replace(/```([\w+-]*)\n?([\s\S]*?)```/g,(_,lang,code)=>{
+    const normalizedLang=(lang||'').trim().toLowerCase();
+    const h=normalizedLang?`<div class="pre-header">${esc(normalizedLang)}</div>`:'';
+    const langAttr=normalizedLang?` class="language-${esc(normalizedLang)}"`:'';
+    return `${h}<pre><code${langAttr}>${esc(code.replace(/\n$/,''))}</code></pre>`;
+  });
   s=s.replace(/`([^`\n]+)`/g,(_,c)=>`<code>${esc(c)}</code>`);
   // inlineMd: process bold/italic/code/links within a single line of text.
   // Used inside list items and blockquotes where the text may already contain

tests/_pytest_port.py

@@ -0,0 +1,42 @@
+"""
+Shared test server constants for use in individual test files.
+
+Instead of hardcoding ``BASE = "http://127.0.0.1:8788"`` in every test file,
+import from here so the port and state dir are always consistent with
+what conftest.py computed for this worktree.
+
+Usage::
+
+    from tests._pytest_port import BASE
+
+conftest.py publishes ``HERMES_WEBUI_TEST_PORT`` and
+``HERMES_WEBUI_TEST_STATE_DIR`` to ``os.environ`` at module level
+(before any test file is imported), so this module always reads the
+correct values.  The auto-derivation fallback matches conftest's logic
+exactly, so standalone imports also work correctly.
+"""
+import hashlib
+import os
+import pathlib
+
+def _auto_test_port(repo_root: pathlib.Path) -> int:
+    h = int(hashlib.md5(str(repo_root).encode()).hexdigest(), 16)
+    return 20000 + (h % 10000)
+
+def _auto_state_dir_name(repo_root: pathlib.Path) -> str:
+    h = hashlib.md5(str(repo_root).encode()).hexdigest()[:8]
+    return f"webui-test-{h}"
+
+_TESTS_DIR   = pathlib.Path(__file__).parent.resolve()
+_REPO_ROOT   = _TESTS_DIR.parent.resolve()
+_HERMES_HOME = pathlib.Path(os.getenv('HERMES_HOME',
+                             str(pathlib.Path.home() / '.hermes')))
+
+TEST_PORT = int(os.environ.get('HERMES_WEBUI_TEST_PORT',
+                               str(_auto_test_port(_REPO_ROOT))))
+BASE = f"http://127.0.0.1:{TEST_PORT}"
+
+TEST_STATE_DIR = pathlib.Path(os.environ.get(
+    'HERMES_WEBUI_TEST_STATE_DIR',
+    str(_HERMES_HOME / _auto_state_dir_name(_REPO_ROOT))
+))

tests/conftest.py

@@ -31,14 +31,37 @@ HOME       = pathlib.Path.home()
 HERMES_HOME = pathlib.Path(os.getenv('HERMES_HOME', str(HOME / '.hermes')))
 
 # ── Test server config ────────────────────────────────────────────────────
-TEST_PORT      = int(os.getenv('HERMES_WEBUI_TEST_PORT', '8788'))
+# Port and state dir auto-derive from the repo path when no env var is set,
+# giving every worktree its own isolated port (8800-8899) and state directory.
+# Override with HERMES_WEBUI_TEST_PORT / HERMES_WEBUI_TEST_STATE_DIR to pin.
+
+def _auto_test_port(repo_root) -> int:
+    """Map repo path to a unique port in 20000-29999 (10k range = near-zero collisions).
+    Far from system port ranges and Linux ephemeral ports (32768+).
+    Override with HERMES_WEBUI_TEST_PORT to use a specific port."""
+    import hashlib
+    h = int(hashlib.md5(str(repo_root).encode()).hexdigest(), 16)
+    return 20000 + (h % 10000)
+
+def _auto_state_dir_name(repo_root) -> str:
+    import hashlib
+    h = hashlib.md5(str(repo_root).encode()).hexdigest()[:8]
+    return f"webui-test-{h}"
+
+TEST_PORT      = int(os.getenv('HERMES_WEBUI_TEST_PORT',
+                               str(_auto_test_port(REPO_ROOT))))
 TEST_BASE      = f"http://127.0.0.1:{TEST_PORT}"
 TEST_STATE_DIR = pathlib.Path(os.getenv(
     'HERMES_WEBUI_TEST_STATE_DIR',
-    str(HERMES_HOME / 'webui-mvp-test')
+    str(HERMES_HOME / _auto_state_dir_name(REPO_ROOT))
 ))
 TEST_WORKSPACE = TEST_STATE_DIR / 'test-workspace'
 
+# Publish at module level so _pytest_port.py (imported at collection time)
+# and any test file using os.environ sees the right values immediately.
+os.environ.setdefault('HERMES_WEBUI_TEST_PORT', str(TEST_PORT))
+os.environ.setdefault('HERMES_WEBUI_TEST_STATE_DIR', str(TEST_STATE_DIR))
+
 # ── Server script: always relative to repo root ───────────────────────────
 SERVER_SCRIPT = REPO_ROOT / 'server.py'
 if not SERVER_SCRIPT.exists():
@@ -245,7 +268,10 @@ def test_server():
     # as the server.  Other test files (test_auth_sessions.py) may override
     # HERMES_WEBUI_STATE_DIR for their own purposes, but HERMES_WEBUI_TEST_STATE_DIR
     # is reserved for this mapping and is never overridden by individual test files.
-    os.environ.setdefault('HERMES_WEBUI_TEST_STATE_DIR', str(TEST_STATE_DIR))
+    # Export both port and state-dir as env vars so individual test files
+    # can read them without importing conftest (avoids circular imports).
+    os.environ.setdefault('HERMES_WEBUI_TEST_PORT', str(TEST_PORT))
+    # os.environ already set at module level above; no-op here.
 
     env = os.environ.copy()
     env.update({

tests/test_approval_unblock.py

@@ -41,7 +41,7 @@ pytestmark = pytest.mark.skipif(
     reason="tools.approval not available in this environment"
 )
 
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 
 
 def get(path):

tests/test_chinese_locale.py

@@ -0,0 +1,111 @@
+from collections import Counter
+from pathlib import Path
+import re
+
+
+REPO = Path(__file__).resolve().parent.parent
+
+
+def read(path: Path) -> str:
+    return path.read_text(encoding="utf-8")
+
+
+def extract_locale_block(src: str, locale_key: str) -> str:
+    start_match = re.search(rf"\b{re.escape(locale_key)}\s*:\s*\{{", src)
+    assert start_match, f"{locale_key} locale block not found"
+
+    start = start_match.end() - 1  # "{"
+    depth = 0
+    in_single = False
+    in_double = False
+    in_backtick = False
+    escape = False
+
+    for i in range(start, len(src)):
+        ch = src[i]
+
+        if escape:
+            escape = False
+            continue
+
+        if in_single:
+            if ch == "\\":
+                escape = True
+            elif ch == "'":
+                in_single = False
+            continue
+
+        if in_double:
+            if ch == "\\":
+                escape = True
+            elif ch == '"':
+                in_double = False
+            continue
+
+        if in_backtick:
+            if ch == "\\":
+                escape = True
+            elif ch == "`":
+                in_backtick = False
+            continue
+
+        if ch == "'":
+            in_single = True
+            continue
+        if ch == '"':
+            in_double = True
+            continue
+        if ch == "`":
+            in_backtick = True
+            continue
+
+        if ch == "{":
+            depth += 1
+            continue
+        if ch == "}":
+            depth -= 1
+            if depth == 0:
+                return src[start + 1 : i]
+
+    raise AssertionError(f"{locale_key} locale block braces are not balanced")
+
+
+def test_chinese_locale_block_exists():
+    src = read(REPO / "static" / "i18n.js")
+    assert "\n  zh: {" in src
+    assert "_lang: 'zh'" in src
+    assert "_speech: 'zh-CN'" in src
+
+
+def test_chinese_locale_includes_representative_translations():
+    src = read(REPO / "static" / "i18n.js")
+    expected = [
+        "settings_title: '\\u8bbe\\u7f6e'",
+        "login_title: '\\u767b\\u5f55'",
+        "approval_heading: '需要审批'",
+        "tab_tasks: '任务'",
+        "tab_profiles: '配置'",
+        "session_time_just_now: '刚刚'",
+        "onboarding_title: '欢迎使用 Hermes Web UI'",
+        "onboarding_complete: '引导完成'",
+    ]
+    for entry in expected:
+        assert entry in src
+
+
+def test_chinese_locale_covers_english_keys():
+    src = read(REPO / "static" / "i18n.js")
+    key_pattern = re.compile(r"^\s{4}([a-zA-Z0-9_]+):", re.MULTILINE)
+    en_keys = set(key_pattern.findall(extract_locale_block(src, "en")))
+    zh_keys = set(key_pattern.findall(extract_locale_block(src, "zh")))
+
+    missing = sorted(en_keys - zh_keys)
+    assert not missing, f"Chinese locale missing keys: {missing}"
+
+
+def test_chinese_locale_has_no_duplicate_keys():
+    src = read(REPO / "static" / "i18n.js")
+    key_pattern = re.compile(r"^\s{4}([a-zA-Z0-9_]+):", re.MULTILINE)
+    keys = key_pattern.findall(extract_locale_block(src, "zh"))
+    duplicates = sorted(k for k, count in Counter(keys).items() if count > 1)
+    assert not duplicates, f"Chinese locale has duplicate keys: {duplicates}"

tests/test_gateway_sync.py

@@ -18,7 +18,7 @@ import urllib.error
 import urllib.request
 
 REPO_ROOT = pathlib.Path(__file__).parent.parent.resolve()
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 
 
 def get(path):
@@ -49,11 +49,9 @@ def _get_test_state_dir():
     set (e.g. when running this file standalone), fall back to the conftest
     formula: HERMES_HOME/webui-mvp-test.
     """
-    explicit = os.getenv('HERMES_WEBUI_TEST_STATE_DIR')
-    if explicit:
-        return pathlib.Path(explicit)
-    hermes_home = pathlib.Path(os.getenv('HERMES_HOME', str(pathlib.Path.home() / '.hermes')))
-    return hermes_home / 'webui-mvp-test'  # matches conftest.py TEST_STATE_DIR formula
+    # Use _pytest_port which applies the same auto-derivation as conftest.py
+    from tests._pytest_port import TEST_STATE_DIR as _ptsd
+    return _ptsd
 
 
 def _get_state_db_path():

tests/test_issue336.py

@@ -34,7 +34,7 @@ STYLE_CSS = (REPO_ROOT / "static" / "style.css").read_text()
 INDEX_HTML = (REPO_ROOT / "static" / "index.html").read_text()
 I18N_JS = (REPO_ROOT / "static" / "i18n.js").read_text()
 
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 
 
 def _get(path):
@@ -261,7 +261,7 @@ class TestBubbleLayoutI18N(unittest.TestCase):
         )
 
 
-# ── Integration tests (require live server on port 8788) ─────────────────
+# ── Integration tests (require live server on test server port) ─────────────────
 
 
 class TestBubbleLayoutSettingsAPI(unittest.TestCase):
@@ -272,7 +272,7 @@ class TestBubbleLayoutSettingsAPI(unittest.TestCase):
         try:
             d, status = _get("/api/settings")
         except OSError:
-            self.skipTest("Server not running on port 8788")
+            self.skipTest("Server not running on test server port")
         self.assertEqual(status, 200)
         self.assertIn(
             "bubble_layout",
@@ -289,7 +289,7 @@ class TestBubbleLayoutSettingsAPI(unittest.TestCase):
         try:
             _, status = _post("/api/settings", {"bubble_layout": True})
         except OSError:
-            self.skipTest("Server not running on port 8788")
+            self.skipTest("Server not running on test server port")
         self.assertEqual(status, 200)
         d, _ = _get("/api/settings")
         self.assertTrue(d["bubble_layout"], "bubble_layout=True must persist after POST")
@@ -302,7 +302,7 @@ class TestBubbleLayoutSettingsAPI(unittest.TestCase):
             _post("/api/settings", {"bubble_layout": True})
             _post("/api/settings", {"bubble_layout": False})
         except OSError:
-            self.skipTest("Server not running on port 8788")
+            self.skipTest("Server not running on test server port")
         d, _ = _get("/api/settings")
         self.assertFalse(d["bubble_layout"], "bubble_layout=False must persist after POST")
 
@@ -311,7 +311,7 @@ class TestBubbleLayoutSettingsAPI(unittest.TestCase):
         try:
             _post("/api/settings", {"bubble_layout": "1"})
         except OSError:
-            self.skipTest("Server not running on port 8788")
+            self.skipTest("Server not running on test server port")
         d, _ = _get("/api/settings")
         self.assertIsInstance(
             d["bubble_layout"],

tests/test_issue401.py

@@ -0,0 +1,216 @@
+"""
+Regression tests for issue #401 / PR #402:
+Tool call cards show incorrect/duplicate entries on session load after context compaction.
+
+Root cause: loadSession() applied its own B9 sanitization (producing a new message array
+with different indices) but did not remap the session-level tool_calls.assistant_msg_idx
+values to match. It then assigned the broken tool_calls directly to S.toolCalls, bypassing
+renderMessages()'s fallback that correctly derives tool calls from per-message tool_calls.
+
+Fix: build origIdxToSanitizedIdx during the B9 pass and remap each tc.assistant_msg_idx;
+set S.toolCalls=[] so renderMessages() uses the fallback derivation.
+
+These tests verify the JS logic statically (no server needed).
+"""
+import pathlib
+import subprocess
+import textwrap
+import json
+
+REPO_ROOT = pathlib.Path(__file__).parent.parent.resolve()
+SESSIONS_JS = (REPO_ROOT / "static" / "sessions.js").read_text(encoding="utf-8")
+
+
+# --- Static structural checks ---
+
+def test_loadsession_sets_toolcalls_empty():
+    """loadSession must set S.toolCalls=[] instead of pre-filling from session-level tool_calls."""
+    assert "S.toolCalls=[]" in SESSIONS_JS, (
+        "loadSession() must set S.toolCalls=[] so renderMessages() uses its fallback "
+        "derivation from per-message tool_calls with correct sanitized-array indices"
+    )
+
+
+def test_loadsession_does_not_assign_broken_tool_calls():
+    """loadSession must NOT assign session.tool_calls directly to S.toolCalls (causes index mismatch)."""
+    # The old broken pattern: S.toolCalls=(data.session.tool_calls||[]).map(tc=>({...tc,done:true}))
+    assert "S.toolCalls=(data.session.tool_calls" not in SESSIONS_JS, (
+        "loadSession() must not assign session-level tool_calls directly to S.toolCalls — "
+        "those indices are relative to the pre-sanitization array and will be wrong after B9 filtering"
+    )
+
+
+def test_loadsession_builds_idx_remap():
+    """loadSession must build an origIdxToSanitizedIdx map during B9 sanitization."""
+    assert "origIdxToSanitizedIdx" in SESSIONS_JS, (
+        "loadSession() must build origIdxToSanitizedIdx during B9 sanitization "
+        "to remap session-level tool_calls.assistant_msg_idx"
+    )
+
+
+def test_loadsession_remaps_assistant_msg_idx():
+    """loadSession must remap tc.assistant_msg_idx using the index map."""
+    assert "tc.assistant_msg_idx" in SESSIONS_JS, (
+        "loadSession() must update tc.assistant_msg_idx using the sanitized index map"
+    )
+
+
+# --- Behavioural Node.js tests ---
+
+def _run_js(script_body: str) -> dict:
+    """Run a JS snippet that exercises the B9 sanitization logic extracted from sessions.js."""
+    # Extract just the B9 + index-remap block from loadSession
+    # We'll re-implement it inline for testability
+    script = textwrap.dedent(f"""
+        // Simulate the B9 sanitization + index remap logic from loadSession()
+        function sanitizeAndRemap(messages, tool_calls) {{
+            const allMsgs = messages || [];
+            const sanitized = [];
+            const origIdxToSanitizedIdx = {{}};
+            let lastKeptAsstIdx = -1;
+            for (let i = 0; i < allMsgs.length; i++) {{
+                const m = allMsgs[i];
+                if (!m || !m.role) continue;
+                if (m.role === 'tool') continue;
+                if (m.role === 'assistant') {{
+                    let c = m.content || '';
+                    if (Array.isArray(c)) c = c.filter(p => p && p.type === 'text').map(p => p.text || '').join('');
+                    if (!String(c).trim().length) {{ continue; }}
+                    lastKeptAsstIdx = sanitized.length;
+                }}
+                origIdxToSanitizedIdx[i] = sanitized.length;
+                sanitized.push(m);
+            }}
+            const remapped = (tool_calls || []).map(tc => {{
+                if (!tc || tc.assistant_msg_idx === undefined) return tc;
+                const origIdx = tc.assistant_msg_idx;
+                const newIdx = (origIdx in origIdxToSanitizedIdx)
+                    ? origIdxToSanitizedIdx[origIdx]
+                    : (lastKeptAsstIdx >= 0 ? lastKeptAsstIdx : -1);
+                return {{ ...tc, assistant_msg_idx: newIdx }};
+            }});
+            return {{ sanitized, remapped }};
+        }}
+
+        {script_body}
+    """)
+    proc = subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    )
+    return json.loads(proc.stdout)
+
+
+def test_b9_remaps_tool_call_idx_after_empty_assistant_filtered():
+    """Tool call pointing to index 1 (empty assistant at orig idx 1, kept at idx 0) remaps correctly."""
+    result = _run_js("""
+        const messages = [
+            { role: 'user', content: 'hello' },          // orig 0 -> sanitized 0
+            { role: 'assistant', content: '' },           // orig 1 -> FILTERED (empty)
+            { role: 'assistant', content: 'done.' },      // orig 2 -> sanitized 1
+        ];
+        const tool_calls = [
+            { name: 'terminal', assistant_msg_idx: 1 },   // pointed to filtered-out empty assistant
+            { name: 'read_file', assistant_msg_idx: 2 },  // pointed to kept assistant
+        ];
+        const { sanitized, remapped } = sanitizeAndRemap(messages, tool_calls);
+        process.stdout.write(JSON.stringify({
+            sanitized_length: sanitized.length,
+            tc0_new_idx: remapped[0].assistant_msg_idx,  // should attach to lastKeptAsstIdx = 1
+            tc1_new_idx: remapped[1].assistant_msg_idx,  // should remap 2 -> 1
+        }));
+    """)
+    assert result["sanitized_length"] == 2, f"Expected 2 messages after B9, got {result['sanitized_length']}"
+    assert result["tc0_new_idx"] == 1, (
+        f"Tool call pointing to filtered empty assistant should attach to last kept assistant (idx 1), got {result['tc0_new_idx']}"
+    )
+    assert result["tc1_new_idx"] == 1, (
+        f"Tool call pointing to orig idx 2 should remap to sanitized idx 1, got {result['tc1_new_idx']}"
+    )
+
+
+def test_b9_remaps_multiple_empty_assistants():
+    """Multiple consecutive empty assistants all remap to the last (nearest) kept assistant.
+
+    Note: the remapping pass runs after the full sanitization loop, so lastKeptAsstIdx
+    already reflects the final kept-assistant position. This means even empty-assistant
+    tool calls that came BEFORE the kept assistant get attached to it — which is correct
+    behavior for context-compacted sessions where all tool calls belong to the one
+    non-empty assistant response.
+    """
+    result = _run_js("""
+        const messages = [
+            { role: 'user', content: 'go' },              // orig 0 -> sanitized 0
+            { role: 'assistant', content: '' },           // orig 1 -> FILTERED
+            { role: 'assistant', content: '' },           // orig 2 -> FILTERED
+            { role: 'assistant', content: '' },           // orig 3 -> FILTERED
+            { role: 'assistant', content: 'result' },     // orig 4 -> sanitized 1
+        ];
+        const tool_calls = [
+            { name: 'a', assistant_msg_idx: 1 },
+            { name: 'b', assistant_msg_idx: 2 },
+            { name: 'c', assistant_msg_idx: 3 },
+            { name: 'd', assistant_msg_idx: 4 },
+        ];
+        const { sanitized, remapped } = sanitizeAndRemap(messages, tool_calls);
+        process.stdout.write(JSON.stringify({
+            sanitized_length: sanitized.length,
+            tc0_idx: remapped[0].assistant_msg_idx,
+            tc1_idx: remapped[1].assistant_msg_idx,
+            tc2_idx: remapped[2].assistant_msg_idx,
+            tc3_idx: remapped[3].assistant_msg_idx,
+        }));
+    """)
+    assert result["sanitized_length"] == 2
+    # Tool calls from filtered empty assistants: after the full loop, lastKeptAsstIdx=1,
+    # so all filtered-assistant tool calls correctly attach to the kept assistant at idx 1.
+    assert result["tc0_idx"] == 1, f"Expected 1 (last kept asst), got {result['tc0_idx']}"
+    assert result["tc1_idx"] == 1
+    assert result["tc2_idx"] == 1
+    # Tool call from the kept assistant at orig idx 4 -> sanitized idx 1
+    assert result["tc3_idx"] == 1, f"Expected 1, got {result['tc3_idx']}"
+
+
+def test_b9_no_filtering_needed_indices_preserved():
+    """When no empty assistant messages exist, indices should pass through unchanged."""
+    result = _run_js("""
+        const messages = [
+            { role: 'user', content: 'hi' },              // orig 0 -> sanitized 0
+            { role: 'assistant', content: 'hello' },      // orig 1 -> sanitized 1
+            { role: 'user', content: 'more' },            // orig 2 -> sanitized 2
+            { role: 'assistant', content: 'yes' },        // orig 3 -> sanitized 3
+        ];
+        const tool_calls = [
+            { name: 'x', assistant_msg_idx: 1 },
+            { name: 'y', assistant_msg_idx: 3 },
+        ];
+        const { sanitized, remapped } = sanitizeAndRemap(messages, tool_calls);
+        process.stdout.write(JSON.stringify({
+            sanitized_length: sanitized.length,
+            tc0_idx: remapped[0].assistant_msg_idx,
+            tc1_idx: remapped[1].assistant_msg_idx,
+        }));
+    """)
+    assert result["sanitized_length"] == 4
+    assert result["tc0_idx"] == 1, f"Expected 1, got {result['tc0_idx']}"
+    assert result["tc1_idx"] == 3, f"Expected 3, got {result['tc1_idx']}"
+
+
+def test_b9_tool_role_messages_filtered():
+    """Messages with role='tool' must be filtered out and not affect index mapping."""
+    result = _run_js("""
+        const messages = [
+            { role: 'user', content: 'run' },             // orig 0 -> sanitized 0
+            { role: 'tool', content: 'output' },          // orig 1 -> FILTERED (tool role)
+            { role: 'assistant', content: 'done' },       // orig 2 -> sanitized 1
+        ];
+        const tool_calls = [
+            { name: 'terminal', assistant_msg_idx: 2 },
+        ];
+        const { sanitized, remapped } = sanitizeAndRemap(messages, tool_calls);
+        process.stdout.write(JSON.stringify({
+            sanitized_length: sanitized.length,
+            tc0_idx: remapped[0].assistant_msg_idx,
+        }));
+    """)
+    assert result["sanitized_length"] == 2, f"tool-role message must be filtered, got {result['sanitized_length']}"
+    assert result["tc0_idx"] == 1, f"Expected orig idx 2 -> sanitized idx 1, got {result['tc0_idx']}"

tests/test_issue_code_syntax_highlight.py

@@ -0,0 +1,25 @@
+"""Regression tests for fenced code block syntax highlighting."""
+from pathlib import Path
+
+UI_JS = Path(__file__).resolve().parent.parent / "static" / "ui.js"
+
+
+def _read_ui_js() -> str:
+    return UI_JS.read_text()
+
+
+def test_fenced_code_blocks_add_prism_language_class():
+    js = _read_ui_js()
+    assert 'class="language-${esc(normalizedLang)}"' in js, (
+        "Fenced code blocks should add Prism language-* classes so syntax highlighting works"
+    )
+
+
+def test_fenced_code_blocks_keep_existing_pre_header_layout():
+    js = _read_ui_js()
+    assert 'return `${h}<pre><code${langAttr}>${esc(code.replace(/\\n$/,' in js, (
+        "The syntax-highlight fix should preserve the existing fenced code block layout"
+    )
+    assert '<div class="code-block">' not in js, (
+        "This fix should not introduce a new wrapper around fenced code blocks"
+    )

tests/test_issues_373_374_375.py

@@ -174,10 +174,14 @@ class TestLiveModelFetching:
             "_handle_live_models must have SSRF protection for private IP ranges (#375)"
         )
 
-    def test_live_models_unsupported_providers_gracefully_handled(self):
-        """Providers without /v1/models support must return not_supported gracefully."""
-        assert "not_supported" in ROUTES_PY, (
-            "_handle_live_models must return not_supported for Anthropic/Google (#375)"
+    def test_live_models_all_providers_handled_via_agent(self):
+        """_handle_live_models must delegate to provider_model_ids() which handles all
+        providers gracefully — live fetch where possible, static fallback otherwise.
+        The old 'not_supported' return for Anthropic/Google is superseded: those
+        providers now return live or static model lists via the agent delegate."""
+        assert "provider_model_ids" in ROUTES_PY, (
+            "_handle_live_models must delegate to hermes_cli.models.provider_model_ids() "
+            "so all providers are handled uniformly (#375 upgrade)"
         )
 
     def test_frontend_has_fetch_live_models_function(self):
@@ -204,11 +208,16 @@ class TestLiveModelFetching:
             "_fetchLiveModels must track existing model IDs to avoid duplicates (#375)"
         )
 
-    def test_frontend_live_fetch_skips_unsupported_providers(self):
-        """_fetchLiveModels must skip providers that don't support live fetching (#375)."""
-        assert "anthropic" in UI_JS and "google" in UI_JS, (
-            "_fetchLiveModels must skip Anthropic and Google (no /v1/models support) (#375)"
-        )
+    def test_frontend_live_fetch_covers_all_providers(self):
+        """_fetchLiveModels no longer skips any provider — all providers return
+        live or fallback models via provider_model_ids() on the backend (#375 upgrade)."""
+        # The old skip list (anthropic, google, gemini) must be gone from the guard
+        skip_guard_pos = UI_JS.find("includes(provider)")
+        if skip_guard_pos != -1:
+            guard_line = UI_JS[max(0,skip_guard_pos-100):skip_guard_pos+50]
+            assert "anthropic" not in guard_line, (
+                "_fetchLiveModels must not skip anthropic — backend now handles it (#375 upgrade)"
+            )
 
     def test_live_models_endpoint_wired_in_routes(self):
         """The /api/models/live path must be handled in handle_get()."""

tests/test_language_precedence.py

@@ -0,0 +1,262 @@
+import json
+import pathlib
+import re
+import subprocess
+import textwrap
+
+
+REPO_ROOT = pathlib.Path(__file__).parent.parent.resolve()
+I18N_JS = (REPO_ROOT / "static" / "i18n.js").read_text(encoding="utf-8")
+BOOT_JS = (REPO_ROOT / "static" / "boot.js").read_text(encoding="utf-8")
+PANELS_JS = (REPO_ROOT / "static" / "panels.js").read_text(encoding="utf-8")
+
+
+def _run_i18n_case(script_expr: str) -> dict:
+    wrapped_expr = f"(() => ({script_expr}))()"
+    script = textwrap.dedent(
+        f"""
+        const fs = require('fs');
+        const vm = require('vm');
+        const src = fs.readFileSync({json.dumps(str(REPO_ROOT / "static" / "i18n.js"))}, 'utf8');
+        const storage = {{}};
+        const ctx = {{
+          localStorage: {{
+            getItem: (k) => Object.prototype.hasOwnProperty.call(storage, k) ? storage[k] : null,
+            setItem: (k, v) => {{ storage[k] = String(v); }},
+          }},
+          document: {{
+            documentElement: {{ lang: '' }},
+            querySelectorAll: () => [],
+          }},
+        }};
+        vm.createContext(ctx);
+        vm.runInContext(src, ctx);
+        const out = vm.runInContext({json.dumps(wrapped_expr)}, ctx);
+        process.stdout.write(JSON.stringify(out));
+        """
+    )
+    proc = subprocess.run(["node", "-e", script], check=True, capture_output=True, text=True)
+    return json.loads(proc.stdout)
+
+
+def _extract_call_arglists(src: str, fn_name: str) -> list[str]:
+    token = f"{fn_name}("
+    out = []
+    search_from = 0
+
+    while True:
+        start = src.find(token, search_from)
+        if start < 0:
+            return out
+
+        i = start + len(token)
+        depth = 1
+        in_single = False
+        in_double = False
+        in_backtick = False
+        escape = False
+
+        while i < len(src):
+            ch = src[i]
+
+            if escape:
+                escape = False
+                i += 1
+                continue
+
+            if in_single:
+                if ch == "\\":
+                    escape = True
+                elif ch == "'":
+                    in_single = False
+                i += 1
+                continue
+
+            if in_double:
+                if ch == "\\":
+                    escape = True
+                elif ch == '"':
+                    in_double = False
+                i += 1
+                continue
+
+            if in_backtick:
+                if ch == "\\":
+                    escape = True
+                elif ch == "`":
+                    in_backtick = False
+                i += 1
+                continue
+
+            if ch == "'":
+                in_single = True
+            elif ch == '"':
+                in_double = True
+            elif ch == "`":
+                in_backtick = True
+            elif ch == "(":
+                depth += 1
+            elif ch == ")":
+                depth -= 1
+                if depth == 0:
+                    out.append(src[start + len(token) : i])
+                    break
+            i += 1
+
+        search_from = start + len(token)
+
+
+def _split_top_level_args(arg_src: str) -> list[str]:
+    args = []
+    cur = []
+    paren = 0
+    brace = 0
+    bracket = 0
+    in_single = False
+    in_double = False
+    in_backtick = False
+    escape = False
+
+    for ch in arg_src:
+        if escape:
+            cur.append(ch)
+            escape = False
+            continue
+
+        if in_single:
+            cur.append(ch)
+            if ch == "\\":
+                escape = True
+            elif ch == "'":
+                in_single = False
+            continue
+
+        if in_double:
+            cur.append(ch)
+            if ch == "\\":
+                escape = True
+            elif ch == '"':
+                in_double = False
+            continue
+
+        if in_backtick:
+            cur.append(ch)
+            if ch == "\\":
+                escape = True
+            elif ch == "`":
+                in_backtick = False
+            continue
+
+        if ch == "'":
+            in_single = True
+            cur.append(ch)
+            continue
+        if ch == '"':
+            in_double = True
+            cur.append(ch)
+            continue
+        if ch == "`":
+            in_backtick = True
+            cur.append(ch)
+            continue
+
+        if ch == "(":
+            paren += 1
+            cur.append(ch)
+            continue
+        if ch == ")":
+            paren -= 1
+            cur.append(ch)
+            continue
+        if ch == "{":
+            brace += 1
+            cur.append(ch)
+            continue
+        if ch == "}":
+            brace -= 1
+            cur.append(ch)
+            continue
+        if ch == "[":
+            bracket += 1
+            cur.append(ch)
+            continue
+        if ch == "]":
+            bracket -= 1
+            cur.append(ch)
+            continue
+
+        if ch == "," and paren == 0 and brace == 0 and bracket == 0:
+            args.append("".join(cur).strip())
+            cur = []
+            continue
+
+        cur.append(ch)
+
+    if cur:
+        args.append("".join(cur).strip())
+    return args
+
+
+def _has_precedence_call(src: str, first_arg: str) -> bool:
+    expected_second = {
+        "localStorage.getItem('hermes-lang')",
+        'localStorage.getItem("hermes-lang")',
+    }
+    for arg_src in _extract_call_arglists(src, "resolvePreferredLocale"):
+        args = _split_top_level_args(arg_src)
+        if len(args) < 2:
+            continue
+        first = re.sub(r"\s+", "", args[0])
+        second = re.sub(r"\s+", "", args[1])
+        if first == first_arg and second in expected_second:
+            return True
+    return False
+
+
+def test_i18n_exposes_locale_resolvers():
+    assert "function resolveLocale(" in I18N_JS
+    assert "function resolvePreferredLocale(" in I18N_JS
+
+
+def test_locale_alias_resolution_and_precedence_logic():
+    result = _run_i18n_case(
+        """
+{
+  zhCn: resolveLocale('zh-CN'),
+  zhTw: resolveLocale('zh_TW'),
+  enUs: resolveLocale('EN-us'),
+  esMx: resolveLocale('es-MX'),
+  bad: resolveLocale('xx-YY'),
+  preferred1: resolvePreferredLocale('zh-CN', 'en'),
+  preferred2: resolvePreferredLocale('xx-YY', 'zh-Hant'),
+  preferred3: resolvePreferredLocale('', 'xx-YY'),
+}
+        """
+    )
+    assert result["zhCn"] == "zh"
+    assert result["zhTw"] == "zh-Hant"
+    assert result["enUs"] == "en"
+    assert result["esMx"] == "es"
+    assert result["bad"] is None
+    assert result["preferred1"] == "zh"
+    assert result["preferred2"] == "zh-Hant"
+    assert result["preferred3"] == "en"
+
+
+def test_set_locale_normalizes_alias_and_persists_canonical_key():
+    result = _run_i18n_case(
+        """
+{
+  ...(setLocale('zh-CN'), {}),
+  saved: localStorage.getItem('hermes-lang'),
+  htmlLang: document.documentElement.lang,
+}
+        """
+    )
+    assert result["saved"] == "zh"
+    assert result["htmlLang"] == "zh-CN"
+
+
+def test_boot_and_settings_panel_use_shared_locale_precedence():
+    assert _has_precedence_call(BOOT_JS, "s.language")
+    assert _has_precedence_call(PANELS_JS, "settings.language")

tests/test_login_locale.py

@@ -0,0 +1,68 @@
+import json
+import urllib.error
+import urllib.request
+
+
+from tests._pytest_port import BASE
+
+
+def get(path):
+    with urllib.request.urlopen(BASE + path, timeout=10) as r:
+        return json.loads(r.read()), r.status
+
+
+def get_raw(path):
+    with urllib.request.urlopen(BASE + path, timeout=10) as r:
+        return r.read().decode(), r.status
+
+
+def post(path, body=None):
+    data = json.dumps(body or {}).encode()
+    req = urllib.request.Request(
+        BASE + path, data=data, headers={"Content-Type": "application/json"}
+    )
+    try:
+        with urllib.request.urlopen(req, timeout=10) as r:
+            return json.loads(r.read()), r.status
+    except urllib.error.HTTPError as e:
+        return json.loads(e.read()), e.code
+
+
+def _current_language():
+    settings, status = get("/api/settings")
+    assert status == 200
+    return settings.get("language") or "en"
+
+
+def test_login_page_uses_simplified_chinese_for_zh_cn_alias():
+    prev_lang = _current_language()
+    try:
+        saved, status = post("/api/settings", {"language": "zh-CN"})
+        assert status == 200
+        assert saved.get("language") == "zh-CN"
+        html, status2 = get_raw("/login")
+        assert status2 == 200
+        assert 'lang="zh-CN"' in html
+        assert "\u767b\u5f55" in html
+        assert "\u8f93\u5165\u5bc6\u7801\u7ee7\u7eed\u4f7f\u7528" in html
+    finally:
+        restored, restore_status = post("/api/settings", {"language": prev_lang})
+        assert restore_status == 200
+        assert restored.get("language") == prev_lang
+
+
+def test_login_page_uses_traditional_chinese_for_zh_hant():
+    prev_lang = _current_language()
+    try:
+        saved, status = post("/api/settings", {"language": "zh-Hant"})
+        assert status == 200
+        assert saved.get("language") == "zh-Hant"
+        html, status2 = get_raw("/login")
+        assert status2 == 200
+        assert 'lang="zh-TW"' in html
+        assert "\u8f38\u5165\u5bc6\u78bc\u7e7c\u7e8c\u4f7f\u7528" in html
+        assert "\u5bc6\u78bc\u932f\u8aa4" in html
+    finally:
+        restored, restore_status = post("/api/settings", {"language": prev_lang})
+        assert restore_status == 200
+        assert restored.get("language") == prev_lang

tests/test_mobile_layout.py

@@ -9,7 +9,7 @@ They are static checks (no server needed) that catch common regressions:
   - Right panel slide-over markup and CSS intact
   - Profile dropdown not clipped by overflow on mobile
   - Composer footer chips scroll correctly on narrow viewports
-  - Mobile bottom nav and overlay markup present
+  - Mobile sidebar navigation stays available on phones
   - No full-viewport overflow that would break scroll
 
 Run as part of the standard test suite:
@@ -61,12 +61,20 @@ def test_mobile_overlay_present():
         ".mobile-overlay CSS rule missing from style.css"
 
 
-def test_mobile_bottom_nav_present():
-    """Mobile bottom navigation bar must be present."""
-    assert "mobile-bottom-nav" in HTML or "mobile-nav-btn" in HTML, \
-        "Mobile bottom nav (.mobile-bottom-nav or .mobile-nav-btn) missing from index.html"
-    assert "mobile-bottom-nav" in CSS, \
-        ".mobile-bottom-nav CSS rule missing from style.css"
+def test_sidebar_nav_present():
+    """Sidebar top navigation tabs must be present."""
+    assert 'class="sidebar-nav"' in HTML, \
+        ".sidebar-nav missing from index.html"
+    assert ".sidebar-nav{" in CSS or ".sidebar-nav {" in CSS, \
+        ".sidebar-nav CSS rule missing from style.css"
+
+
+def test_mobile_does_not_hide_sidebar_nav():
+    """Phone breakpoint must keep the sidebar top navigation visible."""
+    mobile_block = re.search(r'@media\(max-width:640px\)\{(.*)\n\s*\}', CSS, re.DOTALL)
+    assert mobile_block, "Missing @media(max-width:640px) block in style.css"
+    assert ".sidebar-nav{display:none" not in mobile_block.group(1).replace(" ", ""), \
+        ".sidebar-nav must stay visible on mobile"
 
 
 def test_mobile_files_button_present():
@@ -115,13 +123,16 @@ def test_topbar_chips_mobile_overflow():
 
 def test_workspace_close_button_present():
     """Workspace panel must have a close/hide button accessible on mobile."""
-    # Either a dedicated mobile close button or the toggle button that closes the panel
+    # Accept handleWorkspaceClose() (two-step close: file→browse→closed), or the
+    # lower-level functions directly.  handleWorkspaceClose is preferred because
+    # it dismisses a file preview first before closing the panel.
     has_close = (
+        'onclick="handleWorkspaceClose()"' in HTML or
         'onclick="closeWorkspacePanel()"' in HTML or
         'onclick="toggleWorkspacePanel()"' in HTML
     )
     assert has_close, \
-        "closeWorkspacePanel() or toggleWorkspacePanel() must be wired to a button to close the workspace panel on mobile"
+        "handleWorkspaceClose() or closeWorkspacePanel() must be wired to a button to close the workspace panel on mobile"
 
 
 def test_toggle_mobile_files_js_defined():
@@ -219,34 +230,20 @@ def test_composer_textarea_font_size_mobile():
 
 
 
-# ── Profiles button in mobile bottom nav ─────────────────────────────────────
+# ── Sidebar tabs on mobile ───────────────────────────────────────────────────
 
-def test_mobile_profiles_button_present():
-    """Mobile bottom nav must include a Profiles button (PR #265)."""
-    assert 'data-panel="profiles"' in HTML and 'mobileSwitchPanel' in HTML, \
-        "Mobile nav must have a Profiles button with data-panel='profiles' and mobileSwitchPanel"
+def test_profiles_sidebar_tab_present():
+    """Sidebar tab strip must include Profiles."""
+    assert 'class="nav-tab" data-panel="profiles"' in HTML, \
+        "Sidebar nav must have a Profiles tab"
 
 
-def test_mobile_profiles_button_uses_mobileSwitchPanel():
-    """Profiles mobile nav button must use mobileSwitchPanel, not raw switchPanel."""
-    import re
-    match = re.search(
-        r'<button[^>]*mobile-nav-btn[^>]*data-panel="profiles"[^>]*>|'
-        r'<button[^>]*data-panel="profiles"[^>]*mobile-nav-btn[^>]*>',
-        HTML
-    )
-    assert match, "Could not find mobile-nav-btn with data-panel='profiles'"
-    btn_html = HTML[match.start():match.start()+300]
-    assert "mobileSwitchPanel('profiles')" in btn_html, \
-        "Profiles mobile nav button must call mobileSwitchPanel('profiles')"
-
-
-def test_mobile_profiles_button_is_last_in_nav():
-    """Profiles button must appear after Spaces in the mobile bottom nav."""
-    spaces_pos = HTML.find('data-panel="workspaces"')
-    profiles_pos = HTML.rfind('data-panel="profiles"')
-    assert spaces_pos > 0 and profiles_pos > spaces_pos, \
-        "Profiles button must appear after Spaces button in the mobile nav"
+def test_mobile_bottom_nav_removed():
+    """The old fixed mobile bottom nav should not be present anymore."""
+    assert "mobile-bottom-nav" not in HTML, \
+        "mobile-bottom-nav markup should be removed from index.html"
+    assert "mobile-bottom-nav" not in CSS, \
+        "mobile-bottom-nav CSS should be removed from style.css"
 
 
 # ── Mobile Enter key inserts newline (PR #315, fixes #269) ───────────────────

tests/test_model_resolver.py

@@ -403,8 +403,10 @@ def test_custom_endpoint_slash_model_routes_to_custom_not_openrouter():
     assert base_url == 'http://127.0.0.1:1234/v1', (
         "Expected base_url 'http://127.0.0.1:1234/v1', got '{}'.".format(base_url)
     )
-    assert model == 'google/gemma-4-26b-a4b', (
-        "Model name should be preserved as-is, got '{}'.".format(model)
+    # Fix #433: provider prefix is now stripped for custom endpoints so stale
+    # prefixed model IDs from previous sessions do not break custom endpoint routing.
+    assert model == 'gemma-4-26b-a4b', (
+        "Model name prefix should be stripped for custom base_url endpoint, got '{}'.".format(model)
     )
 
     # --- openrouter with slash model name MUST still route to openrouter -----

tests/test_onboarding_existing_config.py

@@ -0,0 +1,341 @@
+"""Tests for fix: onboarding wizard must not fire when Hermes is already configured.
+
+Issue #420 — existing Hermes users (config.yaml present + chat_ready) were
+shown the first-run wizard because the only gate was settings.onboarding_completed.
+
+Covers:
+  (a) config.yaml present + chat_ready=True  →  completed=True (no wizard)
+  (b) no config.yaml                         →  completed=False (wizard fires)
+  (c) apply_onboarding_setup refuses to overwrite an existing config without
+      confirm_overwrite=True
+"""
+from __future__ import annotations
+
+import json
+import os
+import pathlib
+import urllib.error
+import urllib.request
+from unittest import mock
+
+import pytest
+
+# ---------------------------------------------------------------------------
+# Unit tests — no live server needed, test logic directly via imports
+# ---------------------------------------------------------------------------
+
+
+def _make_status(*, config_exists: bool, chat_ready: bool, onboarding_done: bool = False):
+    """Call get_onboarding_status() with a controlled filesystem + settings."""
+    import importlib
+
+    # Import fresh copies each call so module-level state doesn't bleed across
+    import api.onboarding as mod
+
+    fake_config_path = pathlib.Path("/tmp/_test_config.yaml")
+
+    settings = {"onboarding_completed": onboarding_done}
+
+    # Build a minimal runtime dict that get_onboarding_status() would produce
+    # from _status_from_runtime.  We only need the keys the gate checks.
+    runtime = {
+        "chat_ready": chat_ready,
+        "provider_configured": chat_ready,
+        "provider_ready": chat_ready,
+        "setup_state": "ready" if chat_ready else "needs_provider",
+        "provider_note": "test note",
+        "current_provider": "openrouter" if chat_ready else None,
+        "current_model": "anthropic/claude-sonnet-4.6" if chat_ready else None,
+        "current_base_url": None,
+        "env_path": "/tmp/.hermes_test/.env",
+    }
+
+    with (
+        mock.patch.object(mod, "load_settings", return_value=settings),
+        mock.patch.object(mod, "get_config", return_value={}),
+        mock.patch.object(
+            mod,
+            "verify_hermes_imports",
+            return_value=(chat_ready, [], {}),
+        ),
+        mock.patch.object(mod, "_status_from_runtime", return_value=runtime),
+        mock.patch.object(mod, "load_workspaces", return_value=[]),
+        mock.patch.object(mod, "get_last_workspace", return_value=None),
+        mock.patch.object(mod, "get_available_models", return_value=[]),
+        mock.patch.object(mod, "_get_config_path", return_value=fake_config_path),
+        mock.patch.object(pathlib.Path, "exists") as mock_exists,
+    ):
+        # Make Path(_get_config_path()).exists() return config_exists
+        mock_exists.return_value = config_exists
+        result = mod.get_onboarding_status()
+
+    return result
+
+
+class TestOnboardingGate:
+    def test_config_exists_and_chat_ready_returns_completed_true(self):
+        """Primary fix: existing valid config → wizard must NOT fire."""
+        result = _make_status(config_exists=True, chat_ready=True)
+        assert result["completed"] is True, (
+            "Wizard fired for existing Hermes user! "
+            "config.yaml + chat_ready must auto-complete onboarding."
+        )
+
+    def test_no_config_returns_completed_false(self):
+        """Fresh install with no config → wizard should fire."""
+        result = _make_status(config_exists=False, chat_ready=False)
+        assert result["completed"] is False, (
+            "Fresh install must show the wizard (completed should be False)."
+        )
+
+    def test_config_exists_but_not_chat_ready_still_shows_wizard(self):
+        """Broken/incomplete config (config.yaml exists but chat_ready=False) →
+        still show wizard so the user can fix it."""
+        result = _make_status(config_exists=True, chat_ready=False)
+        # Should NOT be auto-completed — config is present but broken
+        assert result["completed"] is False, (
+            "Broken config (chat_ready=False) must still show the wizard."
+        )
+
+    def test_onboarding_done_flag_always_respected(self):
+        """If user already completed onboarding in settings, never show wizard."""
+        result = _make_status(config_exists=False, chat_ready=False, onboarding_done=True)
+        assert result["completed"] is True
+
+    def test_config_exists_always_exposed_in_system(self):
+        """config_exists must still appear in the response system block."""
+        result = _make_status(config_exists=True, chat_ready=True)
+        assert "config_exists" in result["system"]
+        assert result["system"]["config_exists"] is True
+
+
+class TestApplyOnboardingSetupGuard:
+    """Fix #2: apply_onboarding_setup must not silently overwrite config.yaml."""
+
+    def _call_setup(self, body: dict, config_yaml_exists: bool):
+        import api.onboarding as mod
+
+        fake_config_path = pathlib.Path("/tmp/_test_config.yaml")
+
+        with (
+            mock.patch.object(mod, "_get_config_path", return_value=fake_config_path),
+            mock.patch.object(pathlib.Path, "exists", return_value=config_yaml_exists),
+        ):
+            return mod.apply_onboarding_setup(body)
+
+    def test_setup_blocked_when_config_exists_without_confirm(self):
+        """Must return an error dict (not raise) if config.yaml exists and no confirm_overwrite."""
+        result = self._call_setup(
+            {
+                "provider": "openrouter",
+                "model": "anthropic/claude-sonnet-4.6",
+                "api_key": "test-key",
+            },
+            config_yaml_exists=True,
+        )
+        assert isinstance(result, dict), "Expected a dict response, not an exception"
+        assert result.get("error") == "config_exists", (
+            f"Expected error='config_exists', got: {result}"
+        )
+        assert result.get("requires_confirm") is True
+
+    def test_setup_allowed_with_confirm_overwrite(self):
+        """With confirm_overwrite=True, setup may proceed (will hit real logic)."""
+        import api.onboarding as mod
+
+        fake_config_path = pathlib.Path("/tmp/_test_config_confirm.yaml")
+        fake_config_path.unlink(missing_ok=True)  # start clean
+        try:
+            # Without patching Path.exists, use a non-existent path so it won't block
+            result = mod.apply_onboarding_setup(
+                {
+                    "provider": "openrouter",
+                    "model": "anthropic/claude-sonnet-4.6",
+                    "api_key": "test-key-confirm",
+                    "confirm_overwrite": True,
+                }
+            )
+            # Should NOT return config_exists error
+            if isinstance(result, dict):
+                assert result.get("error") != "config_exists", (
+                    "confirm_overwrite=True should bypass the config-exists guard."
+                )
+        finally:
+            fake_config_path.unlink(missing_ok=True)
+
+    def test_setup_allowed_when_no_config_exists(self):
+        """Fresh install: no config.yaml → setup proceeds normally (no blocking error)."""
+        import api.onboarding as mod
+
+        fake_config_path = pathlib.Path("/tmp/_test_config_fresh.yaml")
+        fake_config_path.unlink(missing_ok=True)
+        try:
+            with mock.patch.object(mod, "_get_config_path", return_value=fake_config_path):
+                result = mod.apply_onboarding_setup(
+                    {
+                        "provider": "openrouter",
+                        "model": "anthropic/claude-sonnet-4.6",
+                        "api_key": "test-key-fresh",
+                    }
+                )
+            if isinstance(result, dict):
+                assert result.get("error") != "config_exists"
+        finally:
+            fake_config_path.unlink(missing_ok=True)
+
+
+# ---------------------------------------------------------------------------
+# Integration tests — require the live test server on port 8788
+# ---------------------------------------------------------------------------
+
+from tests._pytest_port import BASE
+
+
+def _http_get(path):
+    with urllib.request.urlopen(BASE + path, timeout=10) as r:
+        return json.loads(r.read()), r.status
+
+
+def _http_post(path, body=None):
+    req = urllib.request.Request(
+        BASE + path,
+        data=json.dumps(body or {}).encode(),
+        headers={"Content-Type": "application/json"},
+    )
+    try:
+        with urllib.request.urlopen(req, timeout=10) as r:
+            return json.loads(r.read()), r.status
+    except urllib.error.HTTPError as e:
+        return json.loads(e.read()), e.code
+
+
+def _server_hermes_home() -> pathlib.Path:
+    data, _ = _http_get("/api/onboarding/status")
+    env_path = data.get("system", {}).get("env_path", "")
+    if env_path:
+        return pathlib.Path(env_path).parent
+    return pathlib.Path(os.environ.get("HERMES_WEBUI_TEST_STATE_DIR", str(pathlib.Path.home() / ".hermes" / "webui-mvp-test")))
+
+
+def _server_reachable() -> bool:
+    try:
+        _http_get("/health")
+        return True
+    except Exception:
+        return False
+
+
+# Mark integration tests to only run when test server is up
+requires_server = pytest.mark.skipif(
+    not _server_reachable(),
+    reason="Test server on :8788 not reachable",
+)
+
+
+try:
+    import yaml as _yaml
+    _HAS_YAML = True
+except ImportError:
+    _HAS_YAML = False
+
+_needs_yaml = pytest.mark.skipif(
+    not _HAS_YAML, reason="PyYAML not installed"
+)
+
+
+@requires_server
+class TestOnboardingGateIntegration:
+    """Live-server integration tests for the onboarding gate fix."""
+
+    @pytest.fixture(autouse=True)
+    def _clean(self):
+        hermes_home = _server_hermes_home()
+        for rel in ("config.yaml", ".env"):
+            (hermes_home / rel).unlink(missing_ok=True)
+        yield
+        for rel in ("config.yaml", ".env"):
+            (hermes_home / rel).unlink(missing_ok=True)
+
+    def test_no_config_wizard_fires(self):
+        """No config.yaml → completed=False."""
+        data, status = _http_get("/api/onboarding/status")
+        assert status == 200
+        assert data["completed"] is False
+
+    @_needs_yaml
+    def test_existing_config_and_chat_ready_skips_wizard(self):
+        """Write a valid config.yaml + .env → completed must be True."""
+        import yaml
+
+        hermes_home = _server_hermes_home()
+        # Write a real config.yaml
+        cfg = {"model": {"provider": "openrouter", "default": "anthropic/claude-sonnet-4.6"}}
+        (hermes_home / "config.yaml").write_text(
+            yaml.safe_dump(cfg, sort_keys=False), encoding="utf-8"
+        )
+        # Write a fake API key so provider_ready (and thus chat_ready) fires
+        # — but only when hermes_cli imports are available
+        data, _ = _http_get("/api/onboarding/status")
+        if data["system"]["hermes_found"] and data["system"]["imports_ok"]:
+            (hermes_home / ".env").write_text(
+                "OPENROUTER_API_KEY=test-existing-key\n", encoding="utf-8"
+            )
+            data, status = _http_get("/api/onboarding/status")
+            assert status == 200
+            assert data["completed"] is True, (
+                "Existing config + chat_ready must auto-complete onboarding."
+            )
+        else:
+            # Agent not installed: chat_ready is always False, so wizard still
+            # fires — that is the correct behaviour (can't verify readiness).
+            assert data["completed"] is False
+
+    @_needs_yaml
+    def test_setup_blocked_for_existing_config(self):
+        """POST /api/onboarding/setup must return config_exists error if config.yaml exists."""
+        import yaml
+
+        hermes_home = _server_hermes_home()
+        cfg = {"model": {"provider": "openrouter", "default": "anthropic/claude-sonnet-4.6"}}
+        (hermes_home / "config.yaml").write_text(
+            yaml.safe_dump(cfg, sort_keys=False), encoding="utf-8"
+        )
+
+        data, status = _http_post(
+            "/api/onboarding/setup",
+            {
+                "provider": "openrouter",
+                "model": "anthropic/claude-sonnet-4.6",
+                "api_key": "test-key",
+            },
+        )
+        assert status == 200
+        assert data.get("error") == "config_exists", (
+            f"Expected config_exists guard. Got: {data}"
+        )
+        assert data.get("requires_confirm") is True
+
+    @_needs_yaml
+    def test_setup_allowed_with_confirm_overwrite(self):
+        """POST /api/onboarding/setup with confirm_overwrite=True succeeds."""
+        import yaml
+
+        hermes_home = _server_hermes_home()
+        cfg = {"model": {"provider": "openrouter", "default": "anthropic/claude-sonnet-4.6"}}
+        (hermes_home / "config.yaml").write_text(
+            yaml.safe_dump(cfg, sort_keys=False), encoding="utf-8"
+        )
+
+        data, status = _http_post(
+            "/api/onboarding/setup",
+            {
+                "provider": "openrouter",
+                "model": "anthropic/claude-sonnet-4.6",
+                "api_key": "test-key",
+                "confirm_overwrite": True,
+            },
+        )
+        assert status == 200
+        assert data.get("error") != "config_exists", (
+            "confirm_overwrite=True must bypass the guard."
+        )

tests/test_onboarding_mvp.py

@@ -13,7 +13,7 @@ import urllib.request
 
 import pytest
 
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 
 # Check if pyyaml is available — onboarding setup tests need it on the server
 try:

tests/test_onboarding_network.py

@@ -24,7 +24,7 @@ import urllib.request
 import pytest
 
 REPO = pathlib.Path(__file__).parent.parent
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 
 # ---------------------------------------------------------------------------
 # Unit tests — directly test the IP-resolution + guard logic in routes.py
@@ -128,14 +128,14 @@ class TestOnboardingIPLogic:
 
 
 # ---------------------------------------------------------------------------
-# Integration tests — hit the live test server at port 8788
+# Integration tests — hit the live test server at test server port
 # ---------------------------------------------------------------------------
 
 @pytest.mark.integration
 class TestOnboardingSetupEndpoint:
     """
     Integration tests for /api/onboarding/setup.
-    These require the test server running on port 8788.
+    These require the test server running on test server port.
     """
 
     def _post(self, path: str, data: dict, headers: dict | None = None) -> tuple[int, dict]:
@@ -157,7 +157,7 @@ class TestOnboardingSetupEndpoint:
         Requests from 127.0.0.1 (which is what the test server sees) should
         pass the IP check. We confirm no 403 is returned.
         """
-        # The test server runs on 127.0.0.1:8788 so client_address[0] is 127.0.0.1.
+        # The test server runs on 127.0.0.1:{TEST_PORT} so client_address[0] is 127.0.0.1.
         # A valid setup payload with a mock provider should not be rejected for IP reasons.
         # We patch apply_onboarding_setup to avoid actually writing any config.
         import unittest.mock

tests/test_opencode_providers.py

@@ -68,3 +68,54 @@ def test_opencode_zen_detected_via_env_key(monkeypatch):
 
 def test_opencode_go_detected_via_env_key(monkeypatch):
     _models_with_env_key(monkeypatch, "OPENCODE_GO_API_KEY", "OpenCode Go")
+
+
+def test_openai_codex_model_catalog_includes_gpt54():
+    """openai-codex catalog must include gpt-5.4 and the standard Codex lineup."""
+    assert "openai-codex" in config._PROVIDER_MODELS
+    ids = [m["id"] for m in config._PROVIDER_MODELS["openai-codex"]]
+    assert "gpt-5.4" in ids, f"gpt-5.4 missing from openai-codex catalog: {ids}"
+    assert "gpt-5.4-mini" in ids, f"gpt-5.4-mini missing from openai-codex catalog: {ids}"
+    assert "gpt-5.3-codex" in ids, f"gpt-5.3-codex missing from openai-codex catalog: {ids}"
+    assert "gpt-5.2-codex" in ids, f"gpt-5.2-codex missing from openai-codex catalog: {ids}"
+
+
+def test_openai_codex_display_name():
+    """openai-codex must have a human-readable display name."""
+    assert "openai-codex" in config._PROVIDER_DISPLAY
+    assert config._PROVIDER_DISPLAY["openai-codex"] == "OpenAI Codex"
+
+
+def test_live_models_handler_delegates_to_provider_model_ids():
+    """_handle_live_models must delegate to the agent's provider_model_ids()
+    rather than maintain its own per-provider fetch logic.
+    """
+    import pathlib
+    routes_src = (pathlib.Path(__file__).parent.parent / "api" / "routes.py").read_text()
+    assert "provider_model_ids" in routes_src, (
+        "_handle_live_models must call hermes_cli.models.provider_model_ids() "
+        "to delegate all provider-specific live-fetch logic to the agent"
+    )
+    # The old per-provider base_url hardcoding should be gone
+    assert "https://api.openai.com/v1" not in routes_src, (
+        "_handle_live_models must not hardcode api.openai.com — "
+        "provider resolution is handled by the agent"
+    )
+    assert "not_supported" not in routes_src, (
+        "_handle_live_models must not return not_supported for any provider — "
+        "provider_model_ids() falls back to static list automatically"
+    )
+
+
+def test_live_models_ui_no_longer_skips_any_provider():
+    """_fetchLiveModels in ui.js must not exclude any provider from live fetching.
+    Previously anthropic, google, and gemini were skipped — now provider_model_ids()
+    handles them all (with graceful fallback to static lists).
+    """
+    import pathlib
+    ui_src = (pathlib.Path(__file__).parent.parent / "static" / "ui.js").read_text()
+    # The old exclusion list must be gone
+    assert "includes(provider)" not in ui_src or "anthropic" not in ui_src[:ui_src.find("includes(provider)")+100], (
+        "_fetchLiveModels must not skip anthropic, google, or gemini — "
+        "the backend now returns live models for all providers"
+    )

tests/test_provider_mismatch.py

@@ -16,7 +16,7 @@ import re
 import urllib.request
 
 REPO_ROOT = pathlib.Path(__file__).parent.parent.resolve()
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 
 
 def _read(rel_path: str) -> str:

tests/test_regressions.py

@@ -5,6 +5,7 @@ These tests exist specifically to prevent those bugs from silently returning.
 Each test is tagged with the sprint/commit where the bug was found and fixed.
 """
 import json
+import os
 import pathlib
 import time
 import urllib.error
@@ -12,7 +13,7 @@ import urllib.request
 import urllib.parse
 REPO_ROOT = pathlib.Path(__file__).parent.parent.resolve()
 
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 
 def get(path):
     with urllib.request.urlopen(BASE + path, timeout=10) as r:
@@ -104,7 +105,7 @@ def test_session_with_tool_calls_in_json_loads_ok(cleanup_test_sessions):
     sid = make_session(cleanup_test_sessions)
 
     # Manually inject tool_calls into the session's JSON file
-    sessions_dir = pathlib.Path.home() / ".hermes" / "webui-mvp-test" / "sessions"
+    sessions_dir = pathlib.Path(os.environ.get("HERMES_WEBUI_TEST_STATE_DIR", str(pathlib.Path.home() / ".hermes" / "webui-mvp-test"))) / "sessions"
     session_file = sessions_dir / f"{sid}.json"
     if session_file.exists():
         d = json.loads(session_file.read_text())
@@ -310,7 +311,10 @@ def test_server_delete_invalidates_index(cleanup_test_sessions):
             text.find('if parsed.path == "/api/session/delete":'),
         )
         if delete_idx >= 0:
-            delete_block = text[delete_idx:delete_idx+600]
+            # Use 1200 chars to accommodate any validation/guard code added
+            # before the SESSION_INDEX_FILE.unlink() call (e.g. session_id
+            # character checks, path traversal guards).
+            delete_block = text[delete_idx:delete_idx+1200]
             assert "SESSION_INDEX_FILE" in delete_block, \
                 f"{label} session/delete must invalidate SESSION_INDEX_FILE"
             return

tests/test_security_redaction.py

@@ -33,7 +33,7 @@ def _server_is_up(port: int = 8788) -> bool:
 # The skipif is evaluated lazily via the fixture, not at collection time.
 _needs_server = pytest.mark.usefixtures("test_server")
 
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 
 # Sample credentials that should be masked in every API response
 _FAKE_GITHUB_PAT = "ghp_TestFakeCredential1234567890ab"

tests/test_session_sidebar_relative_time.py

@@ -0,0 +1,141 @@
+import json
+import pathlib
+import subprocess
+import textwrap
+
+REPO_ROOT = pathlib.Path(__file__).parent.parent.resolve()
+SESSIONS_JS = (REPO_ROOT / "static" / "sessions.js").read_text(encoding="utf-8")
+STYLE_CSS = (REPO_ROOT / "static" / "style.css").read_text(encoding="utf-8")
+I18N_JS = (REPO_ROOT / "static" / "i18n.js").read_text(encoding="utf-8")
+
+
+def _extract_function(source: str, name: str) -> str:
+    marker = f"function {name}"
+    start = source.index(marker)
+    brace_start = source.index("{", start)
+    depth = 0
+    for idx in range(brace_start, len(source)):
+        ch = source[idx]
+        if ch == "{":
+            depth += 1
+        elif ch == "}":
+            depth -= 1
+            if depth == 0:
+                return source[start : idx + 1]
+    raise AssertionError(f"Could not extract {name}")
+
+
+def _run_session_time_case(script_body: str) -> dict:
+    functions = "\n\n".join(
+        _extract_function(SESSIONS_JS, name)
+        for name in (
+            "_localDayOrdinal",
+            "_sessionCalendarBoundaries",
+            "_formatSessionDate",
+            "_formatRelativeSessionTime",
+            "_sessionTimeBucketLabel",
+        )
+    )
+    script = textwrap.dedent(
+        f"""
+        process.env.TZ = 'UTC';
+        const translations = {{
+          session_time_unknown: 'Unknown',
+          session_time_just_now: 'just now',
+          session_time_minutes_ago: (n) => `${{n}} minute${{n === 1 ? '' : 's'}} ago`,
+          session_time_hours_ago: (n) => `${{n}} hour${{n === 1 ? '' : 's'}} ago`,
+          session_time_days_ago: (n) => `${{n}} day${{n === 1 ? '' : 's'}} ago`,
+          session_time_last_week: 'last week',
+          session_time_bucket_today: 'Today',
+          session_time_bucket_yesterday: 'Yesterday',
+          session_time_bucket_this_week: 'This week',
+          session_time_bucket_last_week: 'Last week',
+          session_time_bucket_older: 'Older',
+        }};
+        function t(key, ...args) {{
+          const val = translations[key];
+          return typeof val === 'function' ? val(...args) : val;
+        }}
+        {functions}
+        {script_body}
+        """
+    )
+    proc = subprocess.run(["node", "-e", script], check=True, capture_output=True, text=True)
+    return json.loads(proc.stdout)
+
+
+def test_session_sidebar_js_has_dynamic_relative_time_helpers():
+    assert "function _sessionCalendarBoundaries" in SESSIONS_JS
+    assert "function _formatRelativeSessionTime" in SESSIONS_JS
+    assert "function _sessionTimeBucketLabel" in SESSIONS_JS
+    assert "session_time_bucket_last_week" in SESSIONS_JS
+    assert "session_time_bucket_this_week" in SESSIONS_JS
+    assert "session_time_bucket_older" in SESSIONS_JS
+
+
+def test_session_sidebar_renders_relative_time_and_meta_rows():
+    # session-time element was removed from sessions.js in v0.50.40 to
+    # give session titles full width — the CSS class is kept but set to display:none.
+    assert "session-time" not in SESSIONS_JS or True  # intentionally removed from JS
+    assert "session-meta" in SESSIONS_JS
+    assert "orderedSessions" in SESSIONS_JS
+    assert ".session-time" in STYLE_CSS
+    assert ".session-meta" in STYLE_CSS
+    assert ".session-title-row" in STYLE_CSS
+    assert ".session-item.active .session-title" in STYLE_CSS
+    assert "metaBits.join(' · ')" in SESSIONS_JS
+    assert "|| _sessionTimeBucketLabel" not in SESSIONS_JS
+    assert "const ONE_DAY=86400000;" not in SESSIONS_JS
+
+
+def test_relative_time_uses_calendar_boundaries_and_year_for_old_sessions():
+    result = _run_session_time_case(
+        """
+        const now = Date.UTC(2026, 3, 15, 1, 0, 0);
+        const mondayLate = Date.UTC(2026, 3, 13, 23, 0, 0);
+        const oldSession = Date.UTC(2024, 2, 5, 12, 0, 0);
+        process.stdout.write(JSON.stringify({
+          relative: _formatRelativeSessionTime(mondayLate, now),
+          bucket: _sessionTimeBucketLabel(mondayLate, now),
+          oldDate: _formatRelativeSessionTime(oldSession, now),
+        }));
+        """
+    )
+    assert result["relative"] == "2 days ago"
+    assert result["bucket"] == "This week"
+    assert "2024" in result["oldDate"]
+
+
+def test_relative_time_handles_just_now_and_dst_safe_yesterday_boundary():
+    result = _run_session_time_case(
+        """
+        const now = Date.UTC(2026, 2, 9, 12, 0, 0);
+        const justNow = now - 30 * 1000;
+        const yesterday = Date.UTC(2026, 2, 8, 23, 30, 0);
+        process.stdout.write(JSON.stringify({
+          justNow: _formatRelativeSessionTime(justNow, now),
+          yesterday: _formatRelativeSessionTime(yesterday, now),
+          yesterdayBucket: _sessionTimeBucketLabel(yesterday, now),
+        }));
+        """
+    )
+    assert result["justNow"] == "just now"
+    assert result["yesterday"] == "Yesterday"
+    assert result["yesterdayBucket"] == "Yesterday"
+
+
+def test_relative_time_strings_are_localized_in_english_and_spanish_bundles():
+    for key in (
+        "session_time_unknown",
+        "session_time_just_now",
+        "session_time_minutes_ago",
+        "session_time_hours_ago",
+        "session_time_days_ago",
+        "session_time_last_week",
+        "session_time_bucket_today",
+        "session_time_bucket_yesterday",
+        "session_time_bucket_this_week",
+        "session_time_bucket_last_week",
+        "session_time_bucket_older",
+    ):
+        assert key in I18N_JS

tests/test_session_summary_redaction.py

@@ -11,7 +11,7 @@ import pytest
 sys.path.insert(0, str(pathlib.Path(__file__).parent.parent.parent))
 
 _needs_server = pytest.mark.usefixtures("test_server")
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 _FULL_SECRET = "sk-" + ("B" * 24)
 
 

tests/test_sprint1.py

@@ -1,7 +1,7 @@
 """
 Sprint 1 test suite for the Hermes Web UI.
 
-Tests use the ISOLATED test server running on http://127.0.0.1:8788.
+Tests use the ISOLATED test server. Port is auto-derived per worktree (see conftest.py).
 Production server (port 8787) and your real conversations are never touched.
 Start the server before running:
     <repo>/start.sh
@@ -27,7 +27,7 @@ import pathlib
 # Allow importing server modules directly for unit tests
 sys.path.insert(0, str(pathlib.Path(__file__).parent.parent.parent))
 
-BASE = "http://127.0.0.1:8788"  # test server (isolated from production)
+from tests._pytest_port import BASE
 
 
 # ──────────────────────────────────────────────
@@ -145,10 +145,13 @@ def test_session_update():
     """Create session, update workspace and model, verify persisted."""
     data, _ = post("/api/session/new", {})
     sid = data["session"]["session_id"]
+    current_ws = pathlib.Path(data["session"]["workspace"])
+    child_ws = current_ws / f"session-update-{uuid.uuid4().hex[:6]}"
+    child_ws.mkdir(parents=True, exist_ok=True)
 
     updated, status = post("/api/session/update", {
         "session_id": sid,
-        "workspace": "/tmp",
+        "workspace": str(child_ws),
         "model": "anthropic/claude-sonnet-4.6"
     })
     assert status == 200

tests/test_sprint10.py

@@ -4,7 +4,7 @@ Sprint 10 Tests: server.py split, cancel endpoint, cron history, tool card polis
 import json, pathlib, urllib.error, urllib.request, urllib.parse
 REPO_ROOT = pathlib.Path(__file__).parent.parent.resolve()
 
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 
 def get(path):
     with urllib.request.urlopen(BASE + path, timeout=10) as r:
@@ -107,7 +107,7 @@ def test_crons_output_limit_param(cleanup_test_sessions):
 def test_cron_history_button_in_panels_js(cleanup_test_sessions):
     src, _ = get_text("/static/panels.js")
     assert "loadCronHistory" in src
-    assert "All runs" in src
+    assert "cron_all_runs" in src  # i18n key (was hardcoded 'All runs' before i18n hardening)
 
 def test_cron_output_snippet_helper(cleanup_test_sessions):
     src, _ = get_text("/static/panels.js")

tests/test_sprint11.py

@@ -4,7 +4,7 @@ Sprint 11 Tests: multi-provider model support, streaming smoothness, routes extr
 import json, pathlib, urllib.error, urllib.request, urllib.parse
 REPO_ROOT = pathlib.Path(__file__).parent.parent.resolve()
 
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 
 def get(path):
     with urllib.request.urlopen(BASE + path, timeout=10) as r:

tests/test_sprint12.py

@@ -3,7 +3,7 @@ Sprint 12 Tests: settings panel, session pinning, session import, SSE reconnect.
 """
 import json, pathlib, urllib.error, urllib.request, urllib.parse
 
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 
 
 def get(path):

tests/test_sprint13.py

@@ -3,7 +3,7 @@ Sprint 13 Tests: cron recent endpoint, session duplicate, background alerts.
 """
 import json, pathlib, urllib.error, urllib.request
 
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 
 
 def get(path):
@@ -107,14 +107,16 @@ def test_workspace_add_rejects_nonexistent():
     assert status == 400
 
 def test_workspace_add_accepts_real_dir():
-    """Adding a real directory succeeds."""
-    import tempfile
-    tmp = tempfile.mkdtemp()
+    """Adding a real directory under the trusted workspace root succeeds."""
+    d, _ = post("/api/session/new", {})
+    root = pathlib.Path(d["session"]["workspace"])
+    tmp = root / "trusted-add-test"
+    tmp.mkdir(parents=True, exist_ok=True)
     try:
-        d, status = post("/api/workspaces/add", {"path": tmp, "name": "test-ws"})
+        d, status = post("/api/workspaces/add", {"path": str(tmp), "name": "test-ws"})
         assert status == 200
         assert d["ok"] is True
     finally:
-        post("/api/workspaces/remove", {"path": tmp})
+        post("/api/workspaces/remove", {"path": str(tmp)})
         import shutil
         shutil.rmtree(tmp, ignore_errors=True)

tests/test_sprint14.py

@@ -3,7 +3,7 @@ Sprint 14 Tests: file rename, folder create, session archive, session tags, merm
 """
 import json, os, pathlib, shutil, tempfile, urllib.error, urllib.request
 
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 
 
 def get(path):

tests/test_sprint15.py

@@ -3,7 +3,7 @@ Sprint 15 Tests: session projects (CRUD, move, backward compat).
 """
 import json, urllib.error, urllib.request
 
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 
 
 def get(path):

tests/test_sprint16.py

@@ -7,7 +7,7 @@ import pathlib
 import re
 import urllib.request
 
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 REPO_ROOT = pathlib.Path(__file__).parent.parent
 
 

tests/test_sprint17.py

@@ -3,7 +3,7 @@ Sprint 17 Tests: send_key setting, commands.js static file, workspace subdir lis
 """
 import json, urllib.error, urllib.request
 
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 
 
 def get(path):

tests/test_sprint19.py

@@ -3,7 +3,7 @@ Sprint 19 Tests: auth/login, security headers, request size limit.
 """
 import json, urllib.error, urllib.request
 
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 
 
 def get(path, headers=None):

tests/test_sprint2.py

@@ -1,7 +1,7 @@
 """Sprint 2 tests: image preview, file types, markdown. Uses cleanup_test_sessions fixture."""
 import io, json, uuid, urllib.request, urllib.error, pathlib
 
-BASE = "http://127.0.0.1:8788"  # test server (isolated from production)
+from tests._pytest_port import BASE
 
 def get(path):
     with urllib.request.urlopen(BASE + path, timeout=10) as r:

tests/test_sprint20.py

@@ -10,7 +10,7 @@ import urllib.request
 import json
 import pathlib
 
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 
 
 def get_text(path):

tests/test_sprint20b.py

@@ -5,7 +5,7 @@ icon-only circle design.
 import re
 import urllib.request
 
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 
 
 def get_text(path):

tests/test_sprint23.py

@@ -4,7 +4,7 @@ subagent card names, skill picker in cron, skill linked files.
 """
 import json, urllib.error, urllib.request
 
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 
 
 def get(path):

tests/test_sprint26.py

@@ -4,7 +4,7 @@ custom theme names accepted.
 """
 import json, urllib.error, urllib.request
 
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 
 
 def get(path):

tests/test_sprint27.py

@@ -7,7 +7,7 @@ import json
 import urllib.error
 import urllib.request
 
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 
 
 def get(path):

tests/test_sprint28.py

@@ -14,7 +14,7 @@ import urllib.request
 sys.path.insert(0, str(pathlib.Path(__file__).parent))
 from conftest import TEST_STATE_DIR
 
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 
 
 def get(path):

tests/test_sprint29.py

@@ -27,7 +27,7 @@ import urllib.request
 sys.path.insert(0, str(pathlib.Path(__file__).parent))
 from conftest import TEST_STATE_DIR
 
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 
 
 def get(path, headers=None):

tests/test_sprint3.py

@@ -1,7 +1,7 @@
 """Sprint 3 tests: cron API, skills API, memory API, input validation."""
 import json, uuid, urllib.request, urllib.error
 
-BASE = "http://127.0.0.1:8788"  # test server (isolated from production)
+from tests._pytest_port import BASE
 
 def get(path):
     with urllib.request.urlopen(BASE + path, timeout=10) as r:
@@ -114,6 +114,24 @@ def test_session_delete_requires_session_id():
     result, status = post("/api/session/delete", {})
     assert status == 400
 
+
+def test_session_delete_rejects_absolute_path_payload(tmp_path):
+    victim = tmp_path / "victim.json"
+    victim.write_text("TOPSECRET", encoding="utf-8")
+    result, status = post("/api/session/delete", {"session_id": str(victim.with_suffix(""))})
+    assert status == 400
+    assert victim.exists(), "absolute-path payload must not delete arbitrary files"
+
+
+def test_session_delete_rejects_traversal_payload(tmp_path):
+    victim = tmp_path / "outside.json"
+    victim.write_text("TOPSECRET", encoding="utf-8")
+    traversal = f"../../../../{victim.with_suffix('').as_posix().lstrip('/')}"
+    result, status = post("/api/session/delete", {"session_id": traversal})
+    assert status == 400
+    assert victim.exists(), "traversal payload must not delete arbitrary files"
+
+
 def test_chat_start_requires_session_id():
     result, status = post("/api/chat/start", {"message": "hello"})
     assert status == 400
@@ -127,6 +145,43 @@ def test_session_update_unknown_id_returns_404():
     result, status = post("/api/session/update", {"session_id": "nosuchsession", "model": "openai/gpt-5.4-mini"})
     assert status == 404
 
+
+def test_session_update_rejects_workspace_outside_trusted_root(tmp_path):
+    d, _ = post("/api/session/new", {})
+    sid = d["session"]["session_id"]
+    outside = tmp_path / "outside"
+    outside.mkdir(parents=True, exist_ok=True)
+    result, status = post("/api/session/update", {"session_id": sid, "workspace": str(outside)})
+    assert status == 400
+    assert "outside" in result.get("error", "").lower()
+
+
+def test_chat_start_rejects_workspace_outside_trusted_root(tmp_path):
+    d, _ = post("/api/session/new", {})
+    sid = d["session"]["session_id"]
+    outside = tmp_path / "outside-chat"
+    outside.mkdir(parents=True, exist_ok=True)
+    result, status = post("/api/chat/start", {"session_id": sid, "message": "hello", "workspace": str(outside)})
+    assert status == 400
+    assert "outside" in result.get("error", "").lower()
+
+
+def test_workspace_add_rejects_path_outside_trusted_root(tmp_path):
+    outside = tmp_path / "outside-add"
+    outside.mkdir(parents=True, exist_ok=True)
+    result, status = post("/api/workspaces/add", {"path": str(outside), "name": "Outside"})
+    assert status == 400
+    assert "outside" in result.get("error", "").lower()
+
+
+def test_session_new_rejects_workspace_outside_trusted_root(tmp_path):
+    outside = tmp_path / "outside-new"
+    outside.mkdir(parents=True, exist_ok=True)
+    result, status = post("/api/session/new", {"workspace": str(outside)})
+    assert status == 400
+    assert "outside" in result.get("error", "").lower()
+
+
 def test_session_search_returns_matches(cleanup_test_sessions):
     sid, _ = make_session_tracked(cleanup_test_sessions)
     post("/api/session/rename", {"session_id": sid, "title": f"unique-s3-{sid}"})

tests/test_sprint30.py

@@ -19,7 +19,7 @@ import urllib.parse
 
 import pytest
 
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 
 
 def get(path):

tests/test_sprint31.py

@@ -68,7 +68,7 @@ class TestWriteEndpointToConfig:
 
 # ── 6-7: API integration tests ────────────────────────────────────────────────
 
-_TEST_BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE as _TEST_BASE
 
 
 def _post(path, body=None):

tests/test_sprint32.py

@@ -1,6 +1,7 @@
 from pathlib import Path
 from unittest.mock import MagicMock, patch
 import subprocess
+import os
 from api.startup import auto_install_agent_deps
 
 class TestAutoInstallAgentDeps:

tests/test_sprint34.py

@@ -22,7 +22,7 @@ import unittest.mock
 import pytest
 
 REPO = pathlib.Path(__file__).parent.parent
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 
 
 # ── Helpers ──────────────────────────────────────────────────────────────────

tests/test_sprint4.py

@@ -1,7 +1,7 @@
 """Sprint 4 tests: relocation, session rename, search, file ops, validation."""
 import json, pathlib, uuid, urllib.request, urllib.error
 
-BASE = "http://127.0.0.1:8788"  # test server (isolated from production)
+from tests._pytest_port import BASE
 
 def get(path):
     with urllib.request.urlopen(BASE + path, timeout=10) as r:
@@ -149,8 +149,10 @@ def test_file_requires_path(cleanup_test_sessions):
         assert e.code == 400
 
 def test_new_session_inherits_workspace(cleanup_test_sessions):
-    sid, _ = make_session_tracked(cleanup_test_sessions)
-    post("/api/session/update", {"session_id": sid, "workspace": "/tmp", "model": "openai/gpt-5.4-mini"})
+    sid, ws = make_session_tracked(cleanup_test_sessions)
+    child = ws / f"workspace-inherit-{uuid.uuid4().hex[:6]}"
+    child.mkdir(parents=True, exist_ok=True)
+    post("/api/session/update", {"session_id": sid, "workspace": str(child), "model": "openai/gpt-5.4-mini"})
     sid2, _ = make_session_tracked(cleanup_test_sessions)
     data, _ = get(f"/api/session?session_id={sid2}")
-    assert data["session"]["workspace"] == "/tmp"
+    assert data["session"]["workspace"] == str(child)

tests/test_sprint40_ui_polish.py

@@ -0,0 +1,327 @@
+"""
+Sprint 40 UI Polish Tests: Active session title uses CSS theme variable (issue #440).
+
+Covers:
+- .session-item.active .session-title uses var(--gold) instead of hardcoded #e8a030
+- The hardcoded amber color #e8a030 is NOT present in the active session title rule
+"""
+import os
+import pathlib
+import re
+import sys
+import unittest
+from unittest import mock
+
+# Ensure repo is on sys.path so api.config can be imported
+_REPO_ROOT = pathlib.Path(__file__).parent.parent
+if str(_REPO_ROOT) not in sys.path:
+    sys.path.insert(0, str(_REPO_ROOT))
+
+REPO_ROOT  = _REPO_ROOT
+STYLE_CSS  = (REPO_ROOT / "static" / "style.css").read_text()
+SESSIONS_JS = (REPO_ROOT / "static" / "sessions.js").read_text()
+PANELS_JS   = (REPO_ROOT / "static" / "panels.js").read_text()
+
+try:
+    from api import config as _api_config
+    _config_available = True
+except Exception:
+    _api_config = None
+    _config_available = False
+
+# Combined tests for Sprint 40 — Session + UI Polish
+# Covers: active title color, unknown model, Telegram badge,
+#         custom endpoint model routing, workspace chip
+
+
+# ── #451 active title ─────────────────────────────────────────────
+class TestActiveSessionTitleThemeColor(unittest.TestCase):
+
+    def test_active_session_title_uses_theme_variable(self):
+        """
+        .session-item.active .session-title must use var(--gold) not a hardcoded hex.
+        The light-theme override line (data-theme="light") is allowed to keep its own
+        hardcoded color; we only check the base/dark rule.
+        """
+        # Find all lines that match the active session title selector
+        lines = STYLE_CSS.splitlines()
+        base_rule_lines = [
+            line for line in lines
+            if ".session-item.active .session-title" in line
+            and 'data-theme="light"' not in line
+        ]
+
+        self.assertTrue(
+            len(base_rule_lines) >= 1,
+            "Could not find .session-item.active .session-title base rule in style.css"
+        )
+
+        for line in base_rule_lines:
+            self.assertIn(
+                "var(--gold)",
+                line,
+                f"Expected var(--gold) in active session title rule, got: {line.strip()}"
+            )
+            self.assertNotIn(
+                "#e8a030",
+                line,
+                f"Hardcoded #e8a030 must be removed from active session title rule: {line.strip()}"
+            )
+
+
+if __name__ == "__main__":
+    unittest.main()
+
+# ── #452 unknown model ─────────────────────────────────────────────
+class TestGatewaySessionNullModel(unittest.TestCase):
+    """Verify that api/models.py and api/gateway_watcher.py do not
+    fall back to the string 'unknown' for missing model values."""
+
+    def test_gateway_session_null_model_returns_none_not_unknown(self):
+        """api/models.py must not use `or 'unknown'` for the model field
+        so that a NULL model in state.db is returned as None (falsy) to
+        the frontend rather than the truthy string 'unknown'."""
+        models_src = (REPO_ROOT / "api" / "models.py").read_text()
+        # Ensure the old fallback pattern is gone
+        self.assertNotIn(
+            "'model': row['model'] or 'unknown'",
+            models_src,
+            "api/models.py must not use `or 'unknown'` for the model field "
+            "(fixes #443: gateway sessions showed 'telegram · unknown')",
+        )
+
+    def test_gateway_watcher_null_model_returns_none_not_unknown(self):
+        """api/gateway_watcher.py must not use `or 'unknown'` for the model
+        field so that a NULL model in state.db is returned as None (falsy)."""
+        gw_src = (REPO_ROOT / "api" / "gateway_watcher.py").read_text()
+        self.assertNotIn(
+            "'model': row['model'] or 'unknown'",
+            gw_src,
+            "api/gateway_watcher.py must not use `or 'unknown'` for the model "
+            "field (fixes #443: gateway sessions showed 'telegram · unknown')",
+        )
+
+    def test_gateway_session_model_uses_none_fallback(self):
+        """Both source files must use `row['model'] or None` (explicit None
+        fallback) for the model field assignment."""
+        models_src = (REPO_ROOT / "api" / "models.py").read_text()
+        gw_src = (REPO_ROOT / "api" / "gateway_watcher.py").read_text()
+        self.assertIn(
+            "'model': row['model'] or None,",
+            models_src,
+            "api/models.py should assign `row['model'] or None` for the model field",
+        )
+        self.assertIn(
+            "'model': row['model'] or None,",
+            gw_src,
+            "api/gateway_watcher.py should assign `row['model'] or None` for the model field",
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()
+
+# ── #453 telegram badge ─────────────────────────────────────────────
+class TestTelegramBadgeMutedColor(unittest.TestCase):
+
+    def test_telegram_badge_uses_muted_color(self):
+        """Telegram badge rules must use rgba(0, 136, 204, 0.55) not #0088cc."""
+        # Extract only the telegram-related CSS block
+        telegram_lines = [
+            line for line in STYLE_CSS.splitlines()
+            if 'data-source="telegram"' in line or "data-source='telegram'" in line
+        ]
+        self.assertTrue(
+            len(telegram_lines) >= 2,
+            "Expected at least 2 telegram badge CSS rules"
+        )
+        muted_color = "rgba(0, 136, 204, 0.55)"
+        for line in telegram_lines:
+            self.assertIn(
+                muted_color, line,
+                f"Telegram CSS rule should use {muted_color!r}, got: {line!r}"
+            )
+            self.assertNotIn(
+                "#0088cc", line,
+                f"Telegram CSS rule must not use saturated #0088cc, got: {line!r}"
+            )
+
+    def test_telegram_border_left_color_muted(self):
+        """The border-left-color rule for telegram uses rgba."""
+        pattern = r'\.session-item\.cli-session\[data-source=["\']telegram["\']\]\s*\{[^}]*border-left-color:\s*rgba\(0,\s*136,\s*204,\s*0\.55\)'
+        self.assertRegex(STYLE_CSS, pattern,
+            "border-left-color for telegram should be rgba(0, 136, 204, 0.55)")
+
+    def test_telegram_after_color_muted(self):
+        """The ::after color rule for telegram uses rgba."""
+        pattern = r'\.session-item\.cli-session\[data-source=["\']telegram["\']\]::after\s*\{[^}]*color:\s*rgba\(0,\s*136,\s*204,\s*0\.55\)'
+        self.assertRegex(STYLE_CSS, pattern,
+            "::after color for telegram should be rgba(0, 136, 204, 0.55)")
+
+
+class TestFormatSourceTagHelper(unittest.TestCase):
+
+    def test_format_source_tag_helper_exists(self):
+        """_formatSourceTag function must be defined in sessions.js."""
+        self.assertIn("function _formatSourceTag(", SESSIONS_JS,
+            "_formatSourceTag helper function not found in sessions.js")
+
+    def test_format_source_tag_maps_telegram(self):
+        """_formatSourceTag maps 'telegram' to 'via Telegram'."""
+        self.assertIn("telegram:'via Telegram'", SESSIONS_JS,
+            "sessions.js should map telegram -> 'via Telegram'")
+
+    def test_format_source_tag_maps_discord(self):
+        """_formatSourceTag maps 'discord' to 'via Discord'."""
+        self.assertIn("discord:'via Discord'", SESSIONS_JS,
+            "sessions.js should map discord -> 'via Discord'")
+
+    def test_format_source_tag_maps_slack(self):
+        """_formatSourceTag maps 'slack' to 'via Slack'."""
+        self.assertIn("slack:'via Slack'", SESSIONS_JS,
+            "sessions.js should map slack -> 'via Slack'")
+
+    def test_metabits_uses_format_helper(self):
+        """The metaBits push for source_tag should use _formatSourceTag."""
+        self.assertIn("metaBits.push(_formatSourceTag(s.source_tag))", SESSIONS_JS,
+            "metaBits push should wrap source_tag with _formatSourceTag()")
+
+    def test_raw_source_tag_not_pushed_directly(self):
+        """The old raw metaBits.push(s.source_tag) should not exist."""
+        self.assertNotIn("metaBits.push(s.source_tag)", SESSIONS_JS,
+            "Raw s.source_tag should not be pushed directly to metaBits")
+
+
+if __name__ == "__main__":
+    unittest.main()
+
+# ── #454 model routing ─────────────────────────────────────────────
+@unittest.skipUnless(_config_available, "api.config not importable")
+class TestCustomEndpointModelStripping:
+    """Tests for fix #433: strip provider prefix when custom base_url is set."""
+
+    def _resolve(self, model_id, provider=None, base_url=None):
+        """Helper: set cfg directly (same pattern as test_model_resolver.py)."""
+        old_cfg = dict(_api_config.cfg)
+        model_cfg = {}
+        if provider:
+            model_cfg['provider'] = provider
+        if base_url:
+            model_cfg['base_url'] = base_url
+        _api_config.cfg['model'] = model_cfg
+        try:
+            return _api_config.resolve_model_provider(model_id)
+        finally:
+            _api_config.cfg.clear()
+            _api_config.cfg.update(old_cfg)
+
+    def test_prefixed_model_stripped_for_custom_endpoint(self):
+        """Issue #433: 'openai/gpt-5.4' with custom base_url returns bare 'gpt-5.4'."""
+        model, provider, base_url = self._resolve(
+            'openai/gpt-5.4',
+            provider='custom',
+            base_url='http://my-proxy.local:8080/v1',
+        )
+        assert model == 'gpt-5.4', (
+            "Expected bare 'gpt-5.4' for custom endpoint, got '{}'."
+            " Stale provider-prefix must be stripped.".format(model)
+        )
+        assert base_url == 'http://my-proxy.local:8080/v1'
+        assert provider == 'custom'
+
+    def test_bare_model_unchanged_for_custom_endpoint(self):
+        """Bare model ID (no slash) must pass through untouched with custom base_url."""
+        model, provider, base_url = self._resolve(
+            'gpt-4o',
+            provider='custom',
+            base_url='http://my-proxy.local:8080/v1',
+        )
+        assert model == 'gpt-4o', (
+            "Bare model 'gpt-4o' should not be modified, got '{}'.".format(model)
+        )
+        assert base_url == 'http://my-proxy.local:8080/v1'
+        assert provider == 'custom'
+
+    def test_prefixed_model_kept_for_openrouter(self):
+        """When NO custom base_url (openrouter route), prefixed model must stay prefixed."""
+        model, provider, base_url = self._resolve(
+            'openai/gpt-5.4',
+            provider='anthropic',  # cross-provider pick triggers openrouter routing
+        )
+        # Cross-provider model with openrouter routing must keep full provider/model path
+        assert 'openai/gpt-5.4' in model or provider == 'openrouter', (
+            "Expected prefixed model or openrouter routing for non-custom endpoint, "
+            "got model='{}', provider='{}'.".format(model, provider)
+        )
+        assert base_url is None, (
+            "OpenRouter routing must not set a base_url, got '{}'.".format(base_url)
+        )
+
+# ── #455 workspace chip ─────────────────────────────────────────────
+class TestWorkspaceChipAfterProfileSwitch(unittest.TestCase):
+    """Verify that switchToProfile() applies the profile default workspace
+    to the new session when a conversation is in progress (fixes #424)."""
+
+    def test_workspace_chip_updated_after_profile_switch(self):
+        """After await newSession(false) in the sessionInProgress branch,
+        the code must call updateWorkspaceChip() so the chip reflects the
+        new profile's default workspace instead of showing 'No active workspace'."""
+        # Find the sessionInProgress block
+        idx = PANELS_JS.find('if (sessionInProgress)')
+        self.assertGreater(idx, -1, "sessionInProgress branch must exist in panels.js")
+
+        # Slice from that point to cover the relevant block
+        block = PANELS_JS[idx:idx + 1000]
+
+        # newSession(false) must be called first
+        self.assertIn('await newSession(false)', block,
+                      "sessionInProgress branch must call await newSession(false)")
+
+        # The fix: updateWorkspaceChip() must be called after newSession(false)
+        pos_new_session = block.find('await newSession(false)')
+        pos_update_chip = block.find('updateWorkspaceChip()')
+        self.assertGreater(pos_update_chip, -1,
+                           "updateWorkspaceChip() must be called in the sessionInProgress branch")
+        self.assertGreater(pos_update_chip, pos_new_session,
+                           "updateWorkspaceChip() must be called AFTER newSession(false)")
+
+    def test_profile_default_workspace_applied_to_new_session(self):
+        """After newSession(false) the code must assign S._profileDefaultWorkspace
+        to S.session.workspace so the session is correctly tagged."""
+        idx = PANELS_JS.find('if (sessionInProgress)')
+        self.assertGreater(idx, -1)
+        block = PANELS_JS[idx:idx + 1000]
+
+        # The fix block must set S.session.workspace from S._profileDefaultWorkspace
+        self.assertIn('S.session.workspace = S._profileDefaultWorkspace', block,
+                      "S.session.workspace must be set from S._profileDefaultWorkspace "
+                      "in the sessionInProgress branch after newSession(false)")
+
+    def test_api_session_update_called_for_new_session_workspace(self):
+        """The fix must call /api/session/update to persist the workspace on the server."""
+        idx = PANELS_JS.find('if (sessionInProgress)')
+        self.assertGreater(idx, -1)
+        block = PANELS_JS[idx:idx + 1000]
+
+        # Must patch the session on the backend too
+        self.assertIn('/api/session/update', block,
+                      "The sessionInProgress branch must call /api/session/update "
+                      "to persist the new workspace after newSession(false)")
+
+    def test_update_workspace_chip_before_render_session_list(self):
+        """updateWorkspaceChip() should be called before renderSessionList()
+        so the chip is correct when the UI re-renders."""
+        idx = PANELS_JS.find('if (sessionInProgress)')
+        self.assertGreater(idx, -1)
+        block = PANELS_JS[idx:idx + 1000]
+
+        pos_chip = block.find('updateWorkspaceChip()')
+        pos_render = block.find('await renderSessionList()')
+        self.assertGreater(pos_chip, -1, "updateWorkspaceChip() must exist in block")
+        self.assertGreater(pos_render, -1, "renderSessionList() must exist in block")
+        self.assertLess(pos_chip, pos_render,
+                        "updateWorkspaceChip() must be called before renderSessionList()")
+
+
+if __name__ == '__main__':
+    unittest.main()

tests/test_sprint44.py

@@ -0,0 +1,134 @@
+"""
+Sprint 44 Tests: Workspace panel close button fixes (PR #413).
+
+Covers:
+- index.html: mobile-close-btn now calls handleWorkspaceClose() instead of
+  closeWorkspacePanel(), so hitting X while a file is open returns you to the
+  file browser rather than collapsing the whole panel.
+- boot.js: syncWorkspacePanelUI() hides #btnClearPreview (the X icon) on
+  desktop when no file preview is open, eliminating the duplicate X that
+  appeared alongside the chevron collapse button.
+- boot.js: handleWorkspaceClose() logic — clears preview when one is visible,
+  closes panel otherwise (existing function, confirmed wired to both buttons).
+"""
+import pathlib
+import re
+import unittest
+
+REPO = pathlib.Path(__file__).parent.parent
+HTML = (REPO / "static" / "index.html").read_text(encoding="utf-8")
+BOOT_JS = (REPO / "static" / "boot.js").read_text(encoding="utf-8")
+
+
+class TestMobileCloseButtonBehavior(unittest.TestCase):
+    """mobile-close-btn must call handleWorkspaceClose(), not closeWorkspacePanel()."""
+
+    def test_mobile_close_btn_calls_handle_workspace_close(self):
+        """mobile-close-btn onclick must be handleWorkspaceClose(), not closeWorkspacePanel()."""
+        m = re.search(r'class="[^"]*mobile-close-btn[^"]*"[^>]*>', HTML)
+        self.assertIsNotNone(m, "mobile-close-btn element not found in index.html")
+        btn_html = m.group(0)
+        self.assertIn(
+            'onclick="handleWorkspaceClose()"',
+            btn_html,
+            "mobile-close-btn must call handleWorkspaceClose() so that hitting X "
+            "while a file is open closes the file first, not the whole panel",
+        )
+
+    def test_mobile_close_btn_does_not_call_close_workspace_panel_directly(self):
+        """mobile-close-btn must NOT call closeWorkspacePanel() directly."""
+        m = re.search(r'class="[^"]*mobile-close-btn[^"]*"[^>]*>', HTML)
+        self.assertIsNotNone(m, "mobile-close-btn element not found in index.html")
+        btn_html = m.group(0)
+        self.assertNotIn(
+            'onclick="closeWorkspacePanel()"',
+            btn_html,
+            "mobile-close-btn must not call closeWorkspacePanel() directly — "
+            "it would bypass the two-step close logic and collapse the panel even "
+            "when a file is being viewed",
+        )
+
+    def test_handle_workspace_close_defined_in_boot_js(self):
+        """handleWorkspaceClose() must be defined in boot.js."""
+        self.assertIn(
+            "function handleWorkspaceClose()",
+            BOOT_JS,
+            "handleWorkspaceClose() is missing from boot.js",
+        )
+
+    def test_handle_workspace_close_clears_preview_first(self):
+        """handleWorkspaceClose() must call clearPreview() when a preview is visible."""
+        # The function must check for visible preview and call clearPreview
+        self.assertIn(
+            "clearPreview()",
+            BOOT_JS,
+            "handleWorkspaceClose() must call clearPreview() when preview is visible",
+        )
+    def test_handle_workspace_close_falls_back_to_close_panel(self):
+        """handleWorkspaceClose() must call closeWorkspacePanel() as fallback."""
+        # Find the function start and extract until the closing brace by scanning
+        start = BOOT_JS.find("function handleWorkspaceClose()")
+        self.assertNotEqual(start, -1, "handleWorkspaceClose() not found in boot.js")
+        # Extract a generous window after the function start
+        fn_window = BOOT_JS[start : start + 400]
+        self.assertIn(
+            "closeWorkspacePanel()",
+            fn_window,
+            "handleWorkspaceClose() must call closeWorkspacePanel() as its fallback path",
+        )
+
+
+class TestDesktopNoDuplicateXButton(unittest.TestCase):
+    """On desktop, only one X/close control should appear at a time."""
+
+    def test_sync_workspace_panel_ui_hides_clear_preview_on_desktop(self):
+        """syncWorkspacePanelUI() must set display:none on btnClearPreview when no preview and desktop."""
+        self.assertIn(
+            "clearBtn.style.display",
+            BOOT_JS,
+            "syncWorkspacePanelUI() must control clearBtn.style.display to hide it "
+            "on desktop when no file preview is open",
+        )
+
+    def test_clear_preview_hidden_when_no_preview(self):
+        """The display toggle for btnClearPreview must key off hasPreview."""
+        # Expect something like: clearBtn.style.display=hasPreview?'':'none'
+        # or clearBtn.style.display = hasPreview ? '' : 'none'
+        pattern = r"clearBtn\.style\.display\s*=\s*hasPreview"
+        self.assertRegex(
+            BOOT_JS,
+            pattern,
+            "btnClearPreview display must be conditioned on hasPreview in "
+            "syncWorkspacePanelUI() to avoid a duplicate X on desktop",
+        )
+
+    def test_clear_preview_toggle_only_applied_on_desktop(self):
+        """The display toggle must be guarded by !isCompact so mobile is unaffected."""
+        # Expect: if(!isCompact) clearBtn.style.display=...
+        pattern = r"isCompact.*clearBtn\.style\.display|clearBtn\.style\.display.*isCompact"
+        self.assertRegex(
+            BOOT_JS,
+            pattern,
+            "btnClearPreview display toggle must be guarded by isCompact so the "
+            "mobile X button visibility is not accidentally affected",
+        )
+
+    def test_btnclearpreview_exists_in_html(self):
+        """#btnClearPreview must still exist in the HTML (not removed)."""
+        self.assertIn(
+            'id="btnClearPreview"',
+            HTML,
+            "#btnClearPreview must remain in index.html",
+        )
+
+    def test_btncollapseWorkspacepanel_exists_in_html(self):
+        """#btnCollapseWorkspacePanel (chevron) must still exist in the HTML."""
+        self.assertIn(
+            'id="btnCollapseWorkspacePanel"',
+            HTML,
+            "#btnCollapseWorkspacePanel must remain in index.html",
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_sprint45.py

@@ -0,0 +1,157 @@
+"""
+Sprint 45 Tests: v0.50.36 upstream sync with minimal local patch retention.
+
+Covers:
+- First password enablement via POST /api/settings keeps the current browser logged in
+- The returned auth metadata is present and onboarding can continue with the issued cookie
+- Legacy assistant_language is no longer exposed and is removed on the next save
+- The local reply-language UI/runtime enhancement is gone from the synced codebase
+"""
+import json
+import pathlib
+import urllib.error
+import urllib.request
+
+import os
+
+from tests._pytest_port import BASE
+REPO = pathlib.Path(__file__).parent.parent
+# Use HERMES_WEBUI_TEST_STATE_DIR if available (set by conftest for the test process),
+# falling back to the conventional webui-mvp-test path.
+def _get_settings_file() -> pathlib.Path:
+    """Resolve SETTINGS_FILE at call time (env var set by conftest after module import)."""
+    state_dir = pathlib.Path(
+        os.environ.get("HERMES_WEBUI_TEST_STATE_DIR",
+                       str(pathlib.Path.home() / ".hermes" / "webui-mvp-test"))
+    )
+    return state_dir / "settings.json"
+
+
+def get(path, headers=None):
+    req = urllib.request.Request(BASE + path, headers=headers or {})
+    try:
+        with urllib.request.urlopen(req, timeout=10) as r:
+            return json.loads(r.read()), r.status, dict(r.headers)
+    except urllib.error.HTTPError as e:
+        return json.loads(e.read()), e.code, dict(e.headers)
+
+
+def post(path, body=None, headers=None):
+    req = urllib.request.Request(
+        BASE + path,
+        data=json.dumps(body or {}).encode(),
+        headers={"Content-Type": "application/json", **(headers or {})},
+    )
+    try:
+        with urllib.request.urlopen(req, timeout=10) as r:
+            return json.loads(r.read()), r.status, dict(r.headers)
+    except urllib.error.HTTPError as e:
+        return json.loads(e.read()), e.code, dict(e.headers)
+
+
+def read(path):
+    return (REPO / path).read_text(encoding="utf-8")
+
+
+def _snapshot_settings_file():
+    if _get_settings_file().exists():
+        return _get_settings_file().read_text(encoding="utf-8")
+    return None
+
+
+def _restore_settings_file(original_text):
+    if original_text is None:
+        _get_settings_file().unlink(missing_ok=True)
+        return
+    _get_settings_file().write_text(original_text, encoding="utf-8")
+
+
+def test_first_password_enablement_returns_cookie_and_keeps_browser_logged_in():
+    original_settings = _snapshot_settings_file()
+    cookie_header = None  # captured for teardown use
+    try:
+        saved, status, headers = post("/api/settings", {"_set_password": "sprint45-secret"})
+        assert status == 200
+        assert saved["auth_enabled"] is True
+        assert saved["logged_in"] is True
+        assert saved["auth_just_enabled"] is True
+
+        set_cookie = headers.get("Set-Cookie", "")
+        assert "hermes_session=" in set_cookie
+        cookie_header = set_cookie.split(";", 1)[0]
+
+        auth, auth_status, _ = get("/api/auth/status", headers={"Cookie": cookie_header})
+        assert auth_status == 200
+        assert auth["auth_enabled"] is True
+        assert auth["logged_in"] is True
+
+        done, done_status, _ = post(
+            "/api/onboarding/complete",
+            {},
+            headers={"Cookie": cookie_header},
+        )
+        assert done_status == 200
+        assert done["completed"] is True
+    finally:
+        # First: write a clean settings file (no password_hash) directly to disk
+        try:
+            import json as _json
+            clean = _json.loads(original_settings) if original_settings else {}
+            clean.pop("password_hash", None)
+            _get_settings_file().parent.mkdir(parents=True, exist_ok=True)
+            _get_settings_file().write_text(_json.dumps(clean, indent=2), encoding="utf-8")
+        except Exception:
+            pass
+        # Then: tell the server to clear auth via API (must use the session cookie)
+        try:
+            _headers = {"Cookie": cookie_header} if cookie_header else {}
+            post("/api/settings", {"_clear_password": True}, headers=_headers)
+        except Exception:
+            pass
+        _restore_settings_file(original_settings)
+
+
+def test_legacy_assistant_language_is_hidden_and_removed_on_next_save():
+    original_settings = _snapshot_settings_file()
+    try:
+        _get_settings_file().parent.mkdir(parents=True, exist_ok=True)
+        _get_settings_file().write_text(
+            json.dumps(
+                {
+                    "assistant_language": "zh",
+                    "send_key": "enter",
+                    "onboarding_completed": False,
+                },
+                ensure_ascii=False,
+                indent=2,
+            ),
+            encoding="utf-8",
+        )
+
+        loaded, status, _ = get("/api/settings")
+        assert status == 200
+        assert "assistant_language" not in loaded
+
+        saved, save_status, _ = post("/api/settings", {"send_key": "ctrl+enter"})
+        assert save_status == 200
+        assert "assistant_language" not in saved
+        assert saved["send_key"] == "ctrl+enter"
+
+        persisted = json.loads(_get_settings_file().read_text(encoding="utf-8"))
+        assert "assistant_language" not in persisted
+    finally:
+        _restore_settings_file(original_settings)
+
+
+def test_reply_language_customization_ui_and_runtime_are_removed():
+    index_html = read("static/index.html")
+    panels_js = read("static/panels.js")
+    streaming_py = read("api/streaming.py")
+
+    assert "settingsAssistantLanguage" not in index_html
+    assert "assistant_language" not in panels_js
+    assert "settingsAssistantLanguage" not in panels_js
+    assert "assistant_language" not in streaming_py
+    assert "Default reply language:" not in streaming_py
+
+

tests/test_sprint5.py

@@ -1,7 +1,8 @@
 """Sprint 5 tests: workspace CRUD, file save, session index, JS serving."""
 import json, pathlib, uuid, urllib.request, urllib.error
+import os
 
-BASE = "http://127.0.0.1:8788"  # test server (isolated from production)
+from tests._pytest_port import BASE
 
 def get(path):
     with urllib.request.urlopen(BASE + path, timeout=10) as r:
@@ -31,6 +32,12 @@ def make_session_tracked(created_list, ws=None):
     return sid, _pathlib.Path(d["session"]["workspace"])
 
 
+def make_workspace_child(base: pathlib.Path, name: str) -> pathlib.Path:
+    target = base / name
+    target.mkdir(parents=True, exist_ok=True)
+    return target
+
+
 def test_server_running_from_new_location():
     data, status = get("/health")
     assert status == 200 and data["status"] == "ok"
@@ -44,11 +51,13 @@ def test_workspaces_list():
     data, status = get("/api/workspaces")
     assert status == 200 and "workspaces" in data and "last" in data
 
-def test_workspace_add_valid():
-    post("/api/workspaces/remove", {"path": "/tmp"})
-    result, status = post("/api/workspaces/add", {"path": "/tmp", "name": "Temp"})
-    assert status == 200 and any(w["path"]=="/tmp" for w in result["workspaces"])
-    post("/api/workspaces/remove", {"path": "/tmp"})
+def test_workspace_add_valid(cleanup_test_sessions):
+    _, ws = make_session_tracked(cleanup_test_sessions)
+    child = make_workspace_child(ws, f"workspace-add-{uuid.uuid4().hex[:6]}")
+    post("/api/workspaces/remove", {"path": str(child)})
+    result, status = post("/api/workspaces/add", {"path": str(child), "name": "Temp"})
+    assert status == 200 and any(w["path"] == str(child) for w in result["workspaces"])
+    post("/api/workspaces/remove", {"path": str(child)})
 
 def test_workspace_add_validates_existence():
     result, status = post("/api/workspaces/add", {"path": "/tmp/does_not_exist_xyz_999"})
@@ -58,40 +67,47 @@ def test_workspace_add_validates_is_dir():
     result, status = post("/api/workspaces/add", {"path": "/etc/hostname"})
     assert status == 400
 
-def test_workspace_add_no_duplicate():
-    post("/api/workspaces/remove", {"path": "/tmp"})
-    post("/api/workspaces/add", {"path": "/tmp"})
-    result, status = post("/api/workspaces/add", {"path": "/tmp"})
+def test_workspace_add_no_duplicate(cleanup_test_sessions):
+    _, ws = make_session_tracked(cleanup_test_sessions)
+    child = make_workspace_child(ws, f"workspace-dup-{uuid.uuid4().hex[:6]}")
+    post("/api/workspaces/remove", {"path": str(child)})
+    post("/api/workspaces/add", {"path": str(child)})
+    result, status = post("/api/workspaces/add", {"path": str(child)})
     assert status == 400 and "already" in result.get("error","").lower()
-    post("/api/workspaces/remove", {"path": "/tmp"})
+    post("/api/workspaces/remove", {"path": str(child)})
 
 def test_workspace_add_requires_path():
     result, status = post("/api/workspaces/add", {})
     assert status == 400
 
-def test_workspace_remove():
-    post("/api/workspaces/remove", {"path": "/tmp"})
-    post("/api/workspaces/add", {"path": "/tmp", "name": "Temp"})
-    result, status = post("/api/workspaces/remove", {"path": "/tmp"})
-    assert status == 200 and "/tmp" not in [w["path"] for w in result["workspaces"]]
+def test_workspace_remove(cleanup_test_sessions):
+    _, ws = make_session_tracked(cleanup_test_sessions)
+    child = make_workspace_child(ws, f"workspace-remove-{uuid.uuid4().hex[:6]}")
+    post("/api/workspaces/remove", {"path": str(child)})
+    post("/api/workspaces/add", {"path": str(child), "name": "Temp"})
+    result, status = post("/api/workspaces/remove", {"path": str(child)})
+    assert status == 200 and str(child) not in [w["path"] for w in result["workspaces"]]
 
-def test_workspace_rename():
-    post("/api/workspaces/remove", {"path": "/tmp"})
-    post("/api/workspaces/add", {"path": "/tmp", "name": "Temp"})
-    result, status = post("/api/workspaces/rename", {"path": "/tmp", "name": "My Temp"})
+def test_workspace_rename(cleanup_test_sessions):
+    _, ws = make_session_tracked(cleanup_test_sessions)
+    child = make_workspace_child(ws, f"workspace-rename-{uuid.uuid4().hex[:6]}")
+    post("/api/workspaces/remove", {"path": str(child)})
+    post("/api/workspaces/add", {"path": str(child), "name": "Temp"})
+    result, status = post("/api/workspaces/rename", {"path": str(child), "name": "My Temp"})
     assert status == 200
-    assert {w["path"]: w["name"] for w in result["workspaces"]}.get("/tmp") == "My Temp"
-    post("/api/workspaces/remove", {"path": "/tmp"})
+    assert {w["path"]: w["name"] for w in result["workspaces"]}.get(str(child)) == "My Temp"
+    post("/api/workspaces/remove", {"path": str(child)})
 
 def test_workspace_rename_unknown():
     result, status = post("/api/workspaces/rename", {"path": "/no/such/path", "name": "X"})
     assert status == 404
 
 def test_last_workspace_updates_on_session_update(cleanup_test_sessions):
-    sid, _ = make_session_tracked(cleanup_test_sessions)
-    post("/api/session/update", {"session_id": sid, "workspace": "/tmp", "model": "openai/gpt-5.4-mini"})
+    sid, ws = make_session_tracked(cleanup_test_sessions)
+    child = make_workspace_child(ws, f"workspace-last-{uuid.uuid4().hex[:6]}")
+    post("/api/session/update", {"session_id": sid, "workspace": str(child), "model": "openai/gpt-5.4-mini"})
     data, _ = get("/api/workspaces")
-    assert data["last"] == "/tmp"
+    assert data["last"] == str(child)
 
 def test_file_save(cleanup_test_sessions):
     sid, ws = make_session_tracked(cleanup_test_sessions)
@@ -117,7 +133,7 @@ def test_file_save_path_traversal_blocked(cleanup_test_sessions):
 
 def test_session_index_created_after_save(cleanup_test_sessions):
     # Index is created in the TEST state dir, not the production dir
-    test_state_dir = pathlib.Path.home() / ".hermes" / "webui-mvp-test"
+    test_state_dir = pathlib.Path(os.environ.get("HERMES_WEBUI_TEST_STATE_DIR", str(pathlib.Path.home() / ".hermes" / "webui-mvp-test")))
     index_path = test_state_dir / "sessions" / "_index.json"
     make_session_tracked(cleanup_test_sessions)
     # Index may not exist yet if cleanup already wiped it -- just check the endpoint works
@@ -133,8 +149,9 @@ def test_sessions_endpoint_returns_sorted():
         assert sessions[0]["updated_at"] >= sessions[1]["updated_at"]
 
 def test_new_session_inherits_last_workspace(cleanup_test_sessions):
-    sid, _ = make_session_tracked(cleanup_test_sessions)
-    post("/api/session/update", {"session_id": sid, "workspace": "/tmp", "model": "openai/gpt-5.4-mini"})
+    sid, ws = make_session_tracked(cleanup_test_sessions)
+    child = make_workspace_child(ws, f"workspace-inherit-{uuid.uuid4().hex[:6]}")
+    post("/api/session/update", {"session_id": sid, "workspace": str(child), "model": "openai/gpt-5.4-mini"})
     sid2, _ = make_session_tracked(cleanup_test_sessions)
     d, _ = get(f"/api/session?session_id={sid2}")
-    assert d["session"]["workspace"] == "/tmp"
+    assert d["session"]["workspace"] == str(child)

tests/test_sprint6.py

@@ -2,7 +2,7 @@
 import json, uuid, pathlib, urllib.request, urllib.error
 REPO_ROOT = pathlib.Path(__file__).parent.parent.resolve()
 
-BASE = "http://127.0.0.1:8788"  # isolated test server
+from tests._pytest_port import BASE
 
 def get(path):
     with urllib.request.urlopen(BASE + path, timeout=10) as r:

tests/test_sprint7.py

@@ -3,7 +3,7 @@ Sprint 7 Tests: Cron CRUD, Skill CRUD, Memory Write, Session Content Search, Hea
 """
 import json, pathlib, urllib.error, urllib.parse, urllib.request
 
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 
 def get(path):
     with urllib.request.urlopen(BASE + path, timeout=10) as r:

tests/test_sprint8.py

@@ -3,7 +3,7 @@ Sprint 8 Tests: Edit/regenerate, clear conversation, truncate, reconnect banner
 """
 import json, pathlib, urllib.error, urllib.parse, urllib.request
 
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 
 def get(path):
     with urllib.request.urlopen(BASE + path, timeout=10) as r:

tests/test_sprint9.py

@@ -4,7 +4,7 @@ Run: python -m pytest tests/test_sprint9.py -v
 """
 import json, pathlib, urllib.error, urllib.request
 
-BASE = "http://127.0.0.1:8788"
+from tests._pytest_port import BASE
 
 def get_text(path):
     with urllib.request.urlopen(BASE + path, timeout=10) as r: