Merge remote-tracking branch 'origin/master' into franksong2702/live-worklog-settle-no-blank

.gitignore

@@ -80,3 +80,7 @@ docs/ui-ux/review-shots/
 
 # Python build metadata (never commit generated egg-info)
 *.egg-info/
+
+# Local WebUI runtime data and credentials
+.webui_password
+attachments/

CHANGELOG.md

@@ -25,6 +25,8 @@
 
 ### Fixed
 
+- **The admin model-reload endpoint (`POST /api/admin/reload`) no longer crashes.** Reloading `api.models` rebound three names onto the routes module, but one of them — `_routes.compact = _models.compact` — referenced `compact` as if it were a module-level attribute when it is actually a method of the `Session` class, so the handler raised `AttributeError: module 'api.models' has no attribute 'compact'` and the reload failed with a 500. The invalid rebinding is removed (nothing reads `api.routes.compact`); the two genuinely module-level rebindings (`get_session`, `Session`) are unchanged, and the endpoint now returns `{"status": "ok"}`. Thanks @mspgle-dotcom. (#6477)
+
 - **Abandoned embedded terminals are now reaped instead of leaking a running shell forever (#4633 backend half).** A WebUI terminal whose viewer dropped its output stream without an explicit close (tab close, crash, network drop) previously kept its shell process and pty fd alive indefinitely — there is no `PDEATHSIG`, so nothing tore it down until the terminal cap happened to evict it. A background reaper now closes any terminal that has been unwatched (zero attached output streams) for longer than a 15-minute grace, and sweeps dead-process terminals immediately; the grace deliberately spans a tab refresh or brief network drop so a genuine reconnect keeps the session. The output-stream attach is now atomic against the reaper (a single registry-locked lookup+subscribe), so a viewer can never end up subscribed to a terminal the reaper is tearing down, and a race resolves to exactly one winner — attach keeps the terminal, or the reaper wins and the stream cleanly reports "terminal not running." A related leak is closed too: if writing the SSE response headers fails after attaching (client already gone), the subscription is now always unsubscribed instead of pinning the terminal un-reapable. Thanks @ai-ag2026. (#5844, #4633)
 
 - **Typing in the composer no longer causes a layout round-trip on every keystroke.** A single-row composer append now skips rewriting the textarea height when the height can't change, removing a per-keystroke reflow that could disturb caret stability and assistive-tech focus. An oversized composer, a text replacement, and session/draft restore still fully remeasure so the box shrinks back correctly, and the minimum-height check parses only genuine pixel values (a percentage/`auto`/`calc()` min-height fails closed to the full resize). Thanks @sheldon-im. (#6349)

api/routes.py

@@ -14571,7 +14571,6 @@ def handle_post(handler, parsed) -> bool:
         import api.routes as _routes
         _routes.get_session = _models.get_session
         _routes.Session = _models.Session
-        _routes.compact = _models.compact
         return j(handler, {"status": "ok", "reloaded": "api.models"})
 
     if parsed.path == "/api/sessions/cleanup":

tests/test_admin_reload.py

@@ -0,0 +1,55 @@
+from __future__ import annotations
+
+import io
+import json
+from urllib.parse import urlparse
+
+
+class FakeHandler:
+    def __init__(self):
+        self.status = None
+        self.sent_headers = []
+        self.body = bytearray()
+        self.wfile = self
+        self.rfile = io.BytesIO(b"{}")
+        self.headers = {"Content-Length": "2"}
+        self.client_address = ("127.0.0.1", 0)
+        self.request = None
+
+    def send_response(self, status):
+        self.status = status
+
+    def send_header(self, name, value):
+        self.sent_headers.append((name, value))
+
+    def end_headers(self):
+        pass
+
+    def write(self, data):
+        self.body.extend(data)
+
+    def json_body(self):
+        return json.loads(bytes(self.body).decode("utf-8"))
+
+
+def test_admin_reload_returns_ok_without_binding_missing_compact(monkeypatch):
+    import importlib
+    from api import routes
+
+    monkeypatch.setattr(routes, "_check_csrf", lambda handler: True)
+    monkeypatch.setattr(
+        routes,
+        "_guard_request_session_visibility",
+        lambda handler, parsed, body=None, method="POST": True,
+    )
+    # Exercise the endpoint bindings without mutating the real api.models module.
+    monkeypatch.setattr(importlib, "reload", lambda module: module)
+
+    handler = FakeHandler()
+    handled = routes.handle_post(handler, urlparse("/api/admin/reload"))
+
+    assert handled is None
+    assert handler.status == 200
+    assert handler.json_body() == {"status": "ok", "reloaded": "api.models"}
+    assert routes.get_session.__module__ == "api.models"
+    assert routes.Session.__module__ == "api.models"