nesquena-hermesandMubashirrrr 7b02883dcf Release v0.51.233 — Release HA (stage-q3) (#3487) ...

## Release v0.51.233 — Release HA (stage-q3)

Single high-impact data-integrity fix.

### Fix
| PR | Author | Fix |
|----|--------|-----|
| #3472 | @Mubashirrrr | Guard `/api/session/truncate` `keep_count` against a **silent persisted transcript wipe** (negative value sliced as `messages[:-N]`, deleting the newest N messages and saving to disk) and an HTTP 500 (non-numeric). Now validates before the destructive slice — non-int → 400, negative → 400 — mirroring the existing `/api/session/branch` guard. `keep_count=0` "clear all" semantics preserved. |

### Gate results
- **Full pytest suite**: 7450 passed, 7 skipped, 3 xpassed, **0 failed**
- **ruff forward gate**: CLEAN
- **browser-smoke gate**: CLEAN (`/`, `/#settings`, `/#sessions` — zero console errors)
- **Codex (regression)**: SAFE TO SHIP (probed the route directly — negative/non-numeric → 400 without mutation; `keep_count=2`/`0` still work)
- **Opus (correctness)**: SAFE TO SHIP (guard placed before slice + save; both front-end callers compute from a non-negative DOM index)

Co-authored-by: Mubashirrrr <Mubashirrrr@users.noreply.github.com>

2026-06-03 09:34:31 -07:00

..

__init__.py

Hermes Web UI — Sprints 11-14: multi-provider models, settings, session QoL, alerts, polish

2026-03-31 07:02:47 +00:00

agent_health.py

Release v0.51.225 — Release GS (stage-p7 — remote gateway health probe resolves gateway_state #3355) (#3458)

2026-06-02 18:56:25 -07:00

agent_sessions.py

fix: keep webui mirrored sessions out of cli filter

2026-05-28 00:51:12 +02:00

auth.py

fix: harden WebUI bugfix sweep

2026-05-28 13:38:50 -04:00

background.py

feat(commands): /background, /btw slash commands + undo button + reasoning chip

2026-04-24 01:24:51 +00:00

clarify.py

feat: add distinct attention request sound

2026-05-30 19:40:40 +00:00

commands.py

fix(security): drop unsafe-eval + add jsdelivr to CSP, sanitize plugin error

2026-05-11 17:53:02 +00:00

compression_anchor.py

fix(sidebar): keep newer continuation visible over older snapshot

2026-05-28 13:38:06 -06:00

config.py

Release v0.51.228 — Release GV (stage-p12 — workspace tree-drop #3411 + large-markdown preview #3378) (#3463)

2026-06-02 20:58:22 -07:00

dashboard_probe.py

fix: preserve IPv6 dashboard link brackets

2026-05-19 21:35:10 -04:00

extensions.py

Opus pre-release follow-ups for PR #1445

2026-05-02 03:49:40 +00:00

gateway_chat.py

fix(gateway): carry WebUI delivery context on gateway-backed path too (Codex MUST-FIX on #3324)

2026-06-02 19:42:14 +00:00

gateway_watcher.py

release: v0.50.241 (#1293)

2026-04-29 19:54:07 -07:00

goals.py

fix(i18n): localize /goal runtime status strings

2026-05-10 15:21:24 +08:00

helpers.py

fix(todos): hydrate cold-load state from session snapshot

2026-06-02 17:33:49 +00:00

kanban_bridge.py

perf(http): enable HTTP/1.1 keep-alive

2026-05-24 18:26:56 +00:00

metering.py

fix: show TPS in assistant message headers

2026-05-04 21:26:43 +00:00

models.py

Release v0.51.222 — Release GP (stage-p4 — backend bugfix batch: title language drift #3293 + orphaned CLI sidecar prune #3238 + pin-quota lineage #3288) (#3452)

2026-06-02 17:35:18 -07:00

oauth.py

fix(oauth): serialize Anthropic env fallback reads

2026-05-07 02:47:19 +00:00

onboarding.py

Classify onboarding DNS probe failures consistently

2026-05-15 08:51:30 +08:00

passkeys.py

feat: support passkey-only auth

2026-05-25 00:14:38 +00:00

paths.py

fix(profiles): avoid config import cycle

2026-06-01 05:05:16 +00:00

plugins.py

fix(#2622): plugin card UX — legible Open button, single badge, visible toggle + reject protocol-relative tab.path

2026-06-02 03:58:02 +00:00

profiles.py

fix(profiles): TOCTOU-safe _SKILLS_STATS_CACHE read via .get() (Opus pre-release nit on #3341)

2026-06-01 18:38:39 +00:00

providers.py

fix: honor shared OpenCode key at runtime

2026-05-30 02:18:06 +00:00

request_diagnostics.py

fix: add request wedge diagnostics

2026-05-08 15:37:08 +00:00

rollback.py

v0.50.255: Opus follow-ups (4 fixes) + CHANGELOG

2026-05-01 17:19:53 +00:00

routes.py

Release v0.51.233 — Release HA (stage-q3) (#3487)

2026-06-03 09:34:31 -07:00

run_journal.py

fix: filter interrupted recovery control text from visible transcript (#3321)

2026-06-01 20:07:16 +00:00

runner_client.py

harden: runner client rejects non-http(s) base_url + no redirect-follow (#3073)

2026-05-31 17:49:26 +00:00

runtime_adapter.py

Stage 398: PR #2696 — feat(runtime): add runner-local adapter selection (RuntimeAdapter slice 4c, feature-flagged)

2026-05-21 17:43:54 +00:00

session_discoverability.py

Merge PR #3048

2026-05-28 17:47:33 +00:00

session_events.py

sync session list from server events

2026-05-20 08:18:56 -06:00

session_lifecycle.py

fix: align WebUI memory commits with CLI boundaries

2026-05-17 05:04:57 -06:00

session_ops.py

fix(session): preserve sidecar truncation boundary

2026-05-25 21:21:15 +08:00

session_recovery.py

fix(session): rebuild missing startup index

2026-05-20 23:43:30 +08:00

skill_usage.py

fix: remove webui-side writer to avoid conflict with agent

2026-05-27 20:57:32 +08:00

startup.py

fix: P0 hotfixes — API regression, code block parser, chmod override

2026-05-01 12:10:48 +00:00

state_sync.py

fix: use Optional[T] for default None parameters in state_sync.py

2026-06-01 17:20:17 +00:00

streaming.py

Release v0.51.230 — Release GX (stage-p14 — extract <think> to m.reasoning #3455 + LLM Wiki last-writer #1257) (#3466)

2026-06-02 22:48:35 -07:00

system_health.py

feat: add VPS resource health panel

2026-05-05 17:30:56 +00:00

terminal.py

fix(terminal): harden supervisor lifecycle and eliminate timeout race conditions

2026-05-25 20:45:17 +05:00

todo_state.py

fix(todos): hydrate cold-load state from session snapshot

2026-06-02 17:33:49 +00:00

turn_journal.py

fix: handle Windows media and turn journal edge cases

2026-05-30 11:15:35 +02:00

updates.py

fix(updates): re-exec correctly in both source and frozen builds

2026-06-02 17:33:49 +00:00

upload.py

Release v0.51.221 — Release GO (stage-p3e — block all workspace symlink escapes + portable TOCTOU hardening [security]) (#3398) (#3451)

2026-06-02 16:56:30 -07:00

usage.py

fix: display canonical cache hit percentage

2026-05-19 02:27:12 -06:00

workspace_git.py

fix(workspace): tighten git subprocess trust boundary

2026-05-20 11:02:45 +00:00

workspace.py

Release v0.51.231 — Release GY (stage-q1) (#3484)

2026-06-03 09:13:01 -07:00

worktrees.py

Harden worktree removal safeguards

2026-05-13 09:49:15 +08:00