nesquena-hermes 3a63fe479e fix(security): gate auto-install behind HERMES_WEBUI_AUTO_INSTALL=1 — v0.50.156 ...

Breaking: auto_install_agent_deps() is now disabled by default. Set HERMES_WEBUI_AUTO_INSTALL=1 to re-enable. New _trusted_agent_dir() checks ownership and permission bits. Addresses #842 by @tomaioo.

2026-04-22 20:49:28 +00:00

..

__init__.py

Hermes Web UI — Sprints 11-14: multi-provider models, settings, session QoL, alerts, polish

2026-03-31 07:02:47 +00:00

auth.py

release: v0.50.102–v0.50.108 batch (code blocks, utf-8, image URLs, deletion warning, PermissionError, Docker docs, kimi-k2.5) (#755)

2026-04-20 00:26:55 -07:00

clarify.py

feat: harden clarify dialog flow and refresh recovery

2026-04-15 13:10:50 +08:00

commands.py

feat: slash command parity + skill autocomplete — v0.50.91 (PR #711)

2026-04-19 05:37:44 +00:00

config.py

release: v0.50.151 — credential_pool provider detection + Ollama Cloud support (PR #820 by @starship-s)

2026-04-22 20:18:02 +00:00

gateway_watcher.py

fix(sessions): surface gateway SSE failures and add polling fallback (#828)

2026-04-21 21:18:55 -07:00

helpers.py

fix: correct webui profile switching state — v0.50.150 (PR #849 by @migueltavares)

2026-04-22 16:27:01 +00:00

models.py

fix: prune stale session index entries after session-id rotation — v0.50.148 (PR #847 by @franksong2702)

2026-04-22 16:26:38 +00:00

onboarding.py

fix(onboarding): recognize credential_pool OAuth auth for openai-codex (#797)

2026-04-21 15:41:34 +00:00

profiles.py

fix(profiles): complete profile isolation via cookie + thread-local (#805)

2026-04-21 17:04:11 +00:00

routes.py

release: v0.50.151 — credential_pool provider detection + Ollama Cloud support (PR #820 by @starship-s)

2026-04-22 20:18:02 +00:00

session_ops.py

feat: slash command parity + skill autocomplete — v0.50.91 (PR #711)

2026-04-19 05:37:44 +00:00

startup.py

fix(security): gate auto-install behind HERMES_WEBUI_AUTO_INSTALL=1 — v0.50.156

2026-04-22 20:49:28 +00:00

state_sync.py

security: bandit fixes B310/B324/B110 + QuietHTTPServer (#354)

2026-04-13 11:11:56 -07:00

streaming.py

fix: Honcho per-session uses stable session ID across WebUI turns — v0.50.155 (closes #855)

2026-04-22 20:48:52 +00:00

updates.py

fix: update banner — conflict recovery path + server self-restart after update (#816)

2026-04-21 17:10:41 -07:00

upload.py

v0.50.25: mobile scroll, import timestamps, profile security, mic fallback (#404)

2026-04-13 22:11:45 -07:00

workspace.py

fix: HERMES_WEBUI_DEFAULT_WORKSPACE wins over settings.json; trust DEFAULT_WORKSPACE subtree (#610)

2026-04-16 18:09:16 -07:00