chore(release): stamp v0.51.26 — 5-PR Release D follow-on batch (profile-isolation hardening + context-length config overrides + sidebar polish)

CHANGELOG.md

@@ -1,5 +1,38 @@
 # Hermes Web UI -- Changelog
 
+## [v0.51.26] — 2026-05-08 — 5-PR follow-on contributor batch (Release D: profile-isolation hardening across cache + skills + gateway-health, context-length config-override threading, sidebar segment count UI polish)
+
+### Fixed (5 PRs + 1 absorbed test)
+
+- **PR #1901** by @Michaelyklam — Use root-level Hermes home for gateway health status. Hermes gateway runtime state (`gateway.pid`, `gateway_state.json`) is a **root-level singleton** shared across all profiles, but WebUI under a profile-scoped `HERMES_HOME` was looking inside the profile's home directory — always missing the canonical files. Fix: resolve gateway PID path through `get_default_hermes_root()` (which correctly handles the `<root>/profiles/<name>` case by walking up to the un-profiled root). Standard `~/.hermes` and Docker `/opt/data` layouts both work. Graceful degradation when bundled hermes-agent isn't available (`try/except` returns None, falls through to pre-fix `read_runtime_status()` / `get_running_pid()` calls — preserves WebUI-only installs). Closes #1878.
+
+- **PR #1906** by @dso2ng (first-time contributor) — Sidebar UI polish: show collapsed session segment count. The sidebar already collapses continuation/compression lineage rows and carries `_lineage_collapsed_count` / `_lineage_segments` metadata. Backend can also expose `_compression_segment_count` even when the full segment list isn't materialized client-side. Pre-fix the UI showed one compact row without making it clear that it represented multiple collapsed segments. Adds `_sessionSegmentCount(s)` helper picking the largest available count, `i18n` `session_meta_segments` keys for 9 locales (en/es/de/zh/zh-Hant/ru/ja/pt/ko), and a threshold-of-`>1` rendering check that suppresses single-segment cases. Empty-array case (`Math.max(0, ...[])` = 0) gracefully falls through to omitting the badge.
+
+- **PR #1903** by @Michaelyklam — Scope skills endpoints to active profile. The Skills tab was using Hermes Agent's startup-time `SKILLS_DIR`, so switching browser profiles via the `hermes_profile` cookie did not change which local skills were listed or edited. Fix: resolve `get_active_hermes_home() / "skills"` at request time across list/content/save/delete endpoints (`api/routes.py`), without mutating process-wide state. Per-request resolution is microsecond-scale (TLS attribute lookup + path concat, no filesystem I/O). Net security improvement: `_handle_skill_delete` now validates `skill_name` for `/` and `..` before `rglob`. Closes #1880.
+
+- **PR #1898** by @nesquena-hermes (production fix) **+ functional test from PR #1904** by @Michaelyklam — Same-session profile switches were silently reusing the cached `AIAgent` from the previous profile. The agent's `_cached_system_prompt` (built from `load_soul_md()` at construction time) is sourced from `HERMES_HOME` — so when a user switched personas mid-session, the second turn carried the first profile's SOUL.md and any other profile-scoped context. **Reported by @AvidFuturist in Discord** (May 8 2026): two custom personas, mid-session switch, second turn loaded the wrong identity. Fix: append `_profile_home` (already resolved at line 1958, well before the signature blob at line ~2399) to the `SESSION_AGENT_CACHE` signature blob with `or ''` fallback for empty-HERMES_HOME deployments. Profile switches now produce a different signature, force a cache miss, and rebuild the agent under the new profile's `HERMES_HOME`. **Test absorption (Co-authored-by: Michael Lam):** replaced #1898's source-string-only test with @Michaelyklam's superior **functional regression** from PR #1904 — creates two synthetic profile homes with distinct `SOUL.md` contents, runs `_run_agent_streaming()` three times on the same session (profile A, profile A, profile B), and asserts `prompts_used_for_runs == [ALPHA, ALPHA, BETA]`. Kept the source-string ordering checks (`_profile_home` resolved before signature, `or ''` fallback) since the functional test alone wouldn't catch ordering regressions. Closes #1897.
+
+- **PR #1900** by @nesquena-hermes — The two `get_model_context_length()` fallback callsites in `api/streaming.py` (one for session persistence ~L2950, one for the SSE usage payload ~L3050) were calling the resolver with **only `model + base_url`**, omitting `config_context_length`, `provider`, and `custom_providers`. When the agent's `context_compressor` reports 0 (fresh / cached / transitioning agent), context-length resolution falls all the way through to `DEFAULT_FALLBACK_CONTEXT = 256_000` even when the user has set `model.context_length: 1048576` in `config.yaml` or has a 1M model with a `custom_providers` per-model override. **For users with a context-management plugin, this cascades into a session-killing failure mode**: auto-compression triggers far too early → flood of compress requests → 429s → credential pool exhaustion → fallback also 429s → "API call failed after 3 retries". **Reported by @AvidFuturist in Discord** with deepseek-v4-flash (1M context window). Reproduced 5×. Fix: thread `config_context_length=_cfg_ctx_len` (parsed from `_cfg.get('model', {}).get('context_length')` with safe int validation), `provider=resolved_provider or ''`, and `custom_providers=_cfg_custom_providers` through both fallback callsites. The bundled hermes-agent's resolver consults these in Step 0 ("Explicit config override — user knows best") before any probing, so a user-set context_length always wins over the 256K default. Both callsites wrapped in `try/except TypeError` for back-compat with users who pin hermes-agent to a pre-kwargs version (dead-code-defensive in production deployments running the bundled agent — kept as a safety net for mismatched-version installs). Closes #1896.
+
+### Tests
+
+4872 → **4890 collected, 4879 passing, 0 regressions** (+18 net new). Full suite ~136s on Python 3.11. JS syntax check (`node -c`) passes on both modified `.js` files. Browser API sanity harness (port 8789) all-green: 11 endpoints + 20 QA tests verified. Opus advisor pass: SHIP with three release-note call-outs, none blocking.
+
+### Pre-release verification
+
+- Full pytest under `HERMES_HOME` isolation: **4879 passed, 8 skipped, 1 xfailed, 2 xpassed, 8 subtests passed** in 136.03s.
+- Browser API harness against stage-321 on port 8789: all 11 checks PASS + 20 QA security/regression tests PASS.
+- `node -c` on `static/i18n.js`, `static/sessions.js`: clean.
+- Stage diff: 13 files, +1220/-32.
+- Opus advisor pass on stage-321 brief: **SHIP**. All 5 PRs verified correct with test coverage solid. Three call-outs incorporated above (#1901 helper name corrected, #1898+#1904 combo retained, #1900 legacy fallback documented).
+- v0.51.25 fixes verified preserved across rebase: `_strip_workspace_prefix` (×3), `on_interim_assistant` (×2), `_max_iterations_cfg` (×6), `if input_tokens > 0:` Opus defensive guard (×1).
+- Pre-stamp re-fetch of all 6 PR heads (incl. #1904 absorbed): no contributor force-pushes during the Opus window.
+
+### Notes for users
+
+- **#1900 mismatched-version safety net**: WebUI v0.51.26 paired with a pre-kwargs hermes-agent (one that doesn't yet support `config_context_length` / `custom_providers` kwargs on `get_model_context_length()`) will exercise the legacy 2-arg fallback. Users running the bundled agent take the new fast path and never touch the fallback.
+- **#1905 closed as superseded** — Michaelyklam filed a parallel-iteration take on #1896 with a slightly different shape (factored helper vs inline kwargs). Closed without merge per the same-author parallel-iteration pattern; #1900's review history was further along.
+
 ## [v0.51.25] — 2026-05-08 — 6-PR streaming/runtime contributor batch (Release C: profile-isolated quota probes, request wedge diagnostics, max_turns config honor, per-turn usage overwrite, interim_assistant SSE wiring, workspace-prefix transcript dedup)
 
 ### Fixed (6 PRs)

ROADMAP.md

@@ -2,7 +2,7 @@
 
 > Web companion to the Hermes Agent CLI. Same workflows, browser-native.
 >
-> Last updated: v0.51.25 (May 8, 2026) — 4872 tests collected — 6-PR Release C batch (profile-isolated quota probes, request wedge diagnostics, max_turns config honor, per-turn usage overwrite, interim_assistant SSE wiring, workspace-prefix transcript dedup)
+> Last updated: v0.51.26 (May 8, 2026) — 4890 tests collected — 5-PR Release D batch (gateway health root home, sidebar segment count, skills profile scoping, profile-home cache signature, context-length config overrides)
 > Test source: `pytest tests/ --collect-only -q`
 > Per-version detail: see [CHANGELOG.md](./CHANGELOG.md)
 

TESTING.md

@@ -1835,8 +1835,8 @@ Bridged CLI sessions:
 
 ---
 
-*Last updated: v0.51.25, May 8, 2026*
-*Total automated tests collected: 4872*
+*Last updated: v0.51.26, May 8, 2026*
+*Total automated tests collected: 4890*
 *Regression gate: tests/test_regressions.py*
 *Run: pytest tests/ -v --timeout=60*
 *Source: <repo>/*