chore(release): stamp v0.50.274 — LM Studio onboarding fully fixed (#1499 #1500)

PR #1501 closes all three sub-bugs from #1420:
- #1499 (a): probe <base_url>/models before persisting
- #1499 (third sub-bug): keyless setup is a first-class state for self-hosted providers
- #1500: webui env var aligned with agent CLI's canonical LM_API_KEY

Backed by 60+ regression tests (38 new + 22 updated). Pre-release Opus
advisor pass: ship-ready. Independent review by nesquena: APPROVED with
4 non-blocking observations (1 fixed in-release, 3 deferred to follow-ups
#1502 + #1503 + future helper extraction).

Closes #1499, closes #1500.
Refs #1502 (legacy alias sunset tracking), #1503 (probe re-render UX papercut).

CHANGELOG.md

@@ -1,5 +1,18 @@
 # Hermes Web UI -- Changelog
 
+## [v0.50.274] — 2026-05-03
+
+### Fixed (1 PR — three sub-bugs from #1420)
+
+- **LM Studio onboarding fully fixed: probe before persist + keyless setup + agent-aligned env var** (#1501, self-built; reporters @chwps and @AdoneyGalvan; closes #1499 and #1500) — three LM Studio onboarding bugs that piled on top of each other in practice, fixed together because fixing only one left the broken UX. (1) **#1499 (a) — Onboarding wizard probes `<base_url>/models` before persisting.** Pre-fix the wizard finished in 239ms with zero outbound HTTP, silently persisted unreachable URLs, and left users with empty model dropdowns. New `POST /api/onboarding/probe` endpoint validates the configured base URL with a 5s timeout and 256 KB body cap. 8 stable error codes (`invalid_url`, `dns`, `connect_refused`, `timeout`, `http_4xx`, `http_5xx`, `parse`, `unreachable`) each get a localized hint — the `connect_refused` message tells Docker users to try the host IP instead of `localhost`. Stdlib-only (`urllib.request` + `socket`, no httpx dep). Probe response is read-only — never persisted. SSRF-defense: probe refuses HTTP redirects (`_NoRedirectHandler` + `_PROBE_OPENER`), gated on local-network OR auth OR `HERMES_WEBUI_ONBOARDING_OPEN=1`. Frontend wires the probe debounced (400ms on baseUrl input) AND blocking (Continue refuses to advance until probe `ok` for `requires_base_url=True` providers). Probe-discovered models populate the wizard's model dropdown. (2) **#1499 (third sub-bug) — Keyless setup is a first-class state for self-hosted providers.** Pre-fix the wizard rejected an empty api_key for `lmstudio` / `ollama` / `custom`, forcing keyless users to type random gibberish into a password field. New `key_optional: True` flag on those three providers — `apply_onboarding_setup` skips the "{env_var} is required" check, doesn't write a placeholder to `.env`, and `_status_from_runtime` reports `provider_ready=True` based on `base_url` alone. Cloud providers (openrouter / anthropic / openai / gemini / deepseek / …) remain key-required. Frontend renders the field as "API key (optional)" with placeholder "Leave blank for keyless servers" and an italic muted help paragraph: "Most LM Studio / Ollama / vLLM installs run keyless — leave this blank if your server doesn't require authentication. Use the Test connection button to verify." (3) **#1500 — Webui env var aligned with the agent CLI's canonical `LM_API_KEY`.** Pre-fix the WebUI wrote `LMSTUDIO_API_KEY` to `.env`, but the agent CLI runtime (hermes_cli/auth.py:182, `api_key_env_vars=("LM_API_KEY",)`) read `LM_API_KEY` — auth-enabled LM Studio users got Settings reporting `has_key=True` but agent runtime returning 401. Onboarding now writes the canonical `LM_API_KEY`. Legacy `LMSTUDIO_API_KEY` preserved as a read-only fallback in two new alias dicts (`env_var_aliases` in `_SUPPORTED_PROVIDER_SETUPS`, `_PROVIDER_ENV_VAR_ALIASES` in `api/providers.py`) so existing users don't see Settings flip to "no key" on upgrade. Alias mechanism is general — future env-var renames get the same gentle-migration path. **Migration note for existing users on auth-enabled LM Studio:** Settings will continue to report `has_key=True` after upgrade via the legacy alias, but the agent runtime has always read `LM_API_KEY` — chat will keep failing the same 401 way until you rename the variable in `~/.hermes/.env` from `LMSTUDIO_API_KEY=...` to `LM_API_KEY=...` (one-time step). 16 i18n keys × 9 locales (English canonical, others `// TODO: translate` markers per the v0.50.271 #1488 convention). Backed by 60+ regression tests across 4 files (38 new + 22 updated): probe error codes pinned via mutation-verified mock servers, keyless-vs-cloud schema flags pinned, env-var canonical+alias pinned, redirect-refusal pinned with mutation verification, end-to-end route smoke tests against the live test fixture. (`api/onboarding.py`, `api/providers.py`, `api/routes.py`, `static/onboarding.js`, `static/i18n.js`, `static/style.css`, `tests/test_issue1499_onboarding_probe.py`, `tests/test_issue1499_keyless_onboarding.py`, `tests/test_issue1500_lmstudio_env_var_alignment.py`, `tests/test_issue1420_lmstudio_provider_env_var.py`)
+
+### Notes
+
+- 3879 → 3918 tests passing (+39: 17 probe + 16 keyless + 5 env-var + 1 redirect; the existing #1420 suite was updated for the canonical-name rename and remains 5 tests).
+- Pre-release Opus advisor pass: ship-ready, no MUST-FIX. One non-blocking observation deferred as #1503 (API-key input can lose focus mid-typing if probe completes during a typing pause — 400ms debounce + full-form re-render race; UX papercut, not a release blocker, manual repro on localhost didn't catch it because localhost probes complete too fast for the bug window).
+- Independent review by `nesquena` flagged 4 non-blocking items: redirect-refusal (addressed in-release as commit `ba6f344` per `reviewer-flagged-fix-in-release-not-followup` policy — <20 LOC defensive fix, regression test mutation-verified); test count drift (cosmetic); legacy alias sunset path (filed as #1502 with target review ~Nov 2026); local-network gate code duplication between `/api/onboarding/setup` and `/api/onboarding/probe` (deferred — extract whenever someone touches both routes for an unrelated reason).
+- Closes #1499 (all three sub-bugs) and #1500. Follow-up issues filed: #1502 (alias sunset tracking), #1503 (probe re-render UX papercut).
+
 ## [v0.50.273] — 2026-05-03
 
 ### Fixed (1 PR)

ROADMAP.md

@@ -3,7 +3,7 @@
 > Goal: Full 1:1 parity with the Hermes CLI experience via a clean dark web UI.
 > Everything you can do from the CLI terminal, you can do from this UI.
 >
-> Last updated: v0.50.273 (May 03, 2026) — 3879 tests collected
+> Last updated: v0.50.274 (May 03, 2026) — 3918 tests collected
 > Tests: `pytest tests/ --collect-only -q`
 > Source: <repo>/
 

TESTING.md

@@ -1835,8 +1835,8 @@ Bridged CLI sessions:
 
 ---
 
-*Last updated: v0.50.273, May 03, 2026*
-*Total automated tests collected: 3879*
+*Last updated: v0.50.274, May 03, 2026*
+*Total automated tests collected: 3918*
 *Regression gate: tests/test_regressions.py*
 *Run: pytest tests/ -v --timeout=60*
 *Source: <repo>/*