CHANGELOG: document Opus pre-release follow-ups for v0.50.252

CHANGELOG.md

@@ -14,6 +14,10 @@
 - **`/api/models/live` now caches results for 60 seconds** — repeated model-list refreshes (every panel open, every workspace switch) hit upstream provider APIs every time. The new in-memory TTL cache keyed by `(active_profile, provider)` returns deep copies so callers can't mutate the cache, expires after 60s, and is guarded by `threading.RLock` for thread-safety. The cache lives next to `_handle_live_models` and is cleared via `_clear_live_models_cache()` in tests. 4 regression tests cover hit-within-TTL, expiry, profile-scoping (default vs research stay separate), and mutation isolation. (`api/routes.py`, `tests/test_live_models_ttl_cache.py`) @NocGeek — PR #1378
 - **WebUI explains CLI-only slash commands instead of forwarding them to the model** — typing `/browser connect` or any other Hermes CLI-only command in the WebUI used to fall through as plain text, so the model would explain the command instead of the app. The frontend now lazy-fetches `/api/commands` metadata, matches by name and aliases, and intercepts any command flagged `cli_only` with a local assistant message that explains the command is CLI-only. Special note for `/browser` about how WebUI's browser tools must be configured server-side (CLI-only `/browser` itself does not work in the WebUI). Built on the existing `cli_only` field that `/api/commands` already exposed; no agent-side changes. (`static/commands.js`, `static/messages.js`, `tests/test_cli_only_slash_commands.py`) @NocGeek — PR #1382
 
+### Changed
+- **API credential redaction now uses `force=True`** — `_combined_redact` (introduced by #1379) now passes `force=True` to `redact_sensitive_text` so the agent's broader patterns (Stripe `sk_live_`, Google `AIza…`, JWT `eyJ…`, DB connection strings, Telegram bot tokens) run regardless of the user's `HERMES_REDACT_SECRETS` opt-in. The local fallback then handles the short-prefix shapes the agent omits (`ghp_`, `sk-`, `hf_`, `AKIA`). WebUI API responses are a hard safety boundary — no opt-in should be required. (`api/helpers.py`) — Opus pre-release follow-up
+- **`_active_profile_for_live_models_cache` logs the fallback path** — when `get_active_profile_name()` raises (transient state, mid-switch, etc.) the live-models cache (#1378) falls back to `"default"`, mis-scoping the cache for up to 60s. Now logs at debug so we can detect this in production logs without changing the blast radius (TTL still caps the bad-cache window). (`api/routes.py`) — Opus pre-release follow-up
+
 ## [v0.50.251] — 2026-04-30
 
 ### Fixed