nesquena/hermes-webui v0.50.254

on GitHub

v0.50.254 — P0 hotfix batch + per-tab URL anchors

Fast-follow release on top of v0.50.253. Headline fix is a critical 500-error regression that landed in v0.50.252 — please update if you hit TypeError: redact_sensitive_text() on /api/sessions or /api/memory.

Fixed

• API 500 regression on /api/sessions, /api/memory (#1394) — _combined_redact now falls back gracefully when redact_sensitive_text(text, force=True) raises TypeError on older hermes-agent builds that predate the force kwarg. Local fallback (ghp_/sk-/hf_/AKIA) still runs unconditionally. (#1400, @bergeouss)

• JSON/YAML code block tree-view: newlines lost, jsyaml retry missing (#1397) — browsers normalize \n to space inside HTML attribute values, so data-raw lost newlines and tree views came out single-line. Now encoded as 
. Separately, when jsyaml hadn't loaded yet, the init function set data-tree-init=1 immediately and never retried after the lazy load — fixed by deferring the marker and calling _loadJsyamlThen(initTreeViews). (#1400, @bergeouss)

• Credential permission fixer respects HERMES_HOME_MODE and HERMES_SKIP_CHMOD (#1389) — Docker setups that intentionally use group bits no longer have their declared mode silently overridden to 0600. HERMES_SKIP_CHMOD=1 bypasses the fixer entirely; HERMES_HOME_MODE set means only world bits are stripped, group access is preserved. (#1400, @bergeouss)

• Sidebar session click is now instant on mouse, drag-aware on touch (#1398) — the previous 300ms tap delay applied to every device, which mouse users perceived as lag. Now 0ms for mouse, 300ms for touch (where it's still needed for tap-vs-double-tap-rename and tap-vs-drag disambiguation). Adds pointermove drag detection — movement >5px cancels the pending tap and suppresses hover via a .dragging class. (#1398, @JKJameson)

• Per-tab session URL anchors via /session/<id> (#1392) — replaces the cross-tab localStorage['hermes-webui-session'] active-session bus with per-tab URL ownership. Two tabs viewing different sessions can no longer yank each other around when localStorage changes. <base href> script in index.html stops at the /session/ marker so subpath mounts (/myapp/session/<id>) still resolve assets correctly; fetch/SSE URL builders all migrated to document.baseURI||location.href. The popstate handler navigates between sessions via browser back/forward but refuses to switch mid-stream. The cross-tab storage handler was deliberately defanged so it only re-renders the sidebar — it no longer force-loads the new sid into the current tab. (#1392, @dso2ng)

Changed

• Settings toggle: "Show CLI sessions" → "Show non-WebUI sessions" (#1407) — the old label was misleading: the feature surfaces conversations from CLI, Telegram, Discord, Slack, WeChat, and other non-WebUI channels — not just CLI. Pure rename across all 8 locales (en, zh, zh-Hant, ru, es, de, pt, ko); underlying setting and code paths untouched. (#1407, @franksong2702)

• popstate handler refuses to switch sessions mid-stream — Opus pre-release follow-up. Mirrors the same S.busy guard the cross-tab storage handler had. PR #1392 introduced the popstate listener without the guard, so a user mid-stream who absent-mindedly hit browser Back used to lose their active turn. Now shows a toast and stays on the current session.

Tests

3567 passed, 2 skipped, 3 xpassed. Browser tests + Agent Browser CDP visual QA all green (23/23). Opus advisor reviewed the full stage diff. Independent end-to-end review by @nesquena traced the headline P0 fix to the upstream agent signature, verified the per-tab URL anchor across 10 base-href mount scenarios, and signed off ✅.

Contributors

@bergeouss · @franksong2702 · @JKJameson · @dso2ng · @nesquena (review)

Full Changelog: v0.50.253...v0.50.254