v0.51.19 — 15-PR contributor sweep + 1 in-stage absorb

Single-commit release rolling up 15 contributor PRs spanning workspace robustness, IPv6 server bind, bootstrap path discovery, named custom provider routing, quota cards (Codex/Anthropic), live Codex model listing, sidebar/composer/approval correctness, and historical-transcript repair tooling.

Constituent PRs

Backend / config

• #1798 by @Michaelyklam — Workspace path inaccessibility (closes #1795 P0/M1). _clean_workspace_list() was destructive on macOS TCC denial; replaced with non-destructive _safe_resolve() + _workspace_access_error() that distinguishes missing/inaccessible.
• #1818 by @franksong2702 — Named custom provider routing (closes #1806). model.provider: <custom_providers[].name> now normalizes to custom:<name> slug at config-resolution time. Three new helpers + base-url-to-named-slug fallback + dedup of stale base-url-derived custom:* slugs.
• #1816 by @MacLeodMike — IPv6 bind support. QuietHTTPServer.__init__ flips address_family = socket.AF_INET6 when host string contains ':'. Loopback warning gate adds ::1.
• #1815 by @Saik0s — bootstrap.py venv symlinks=True. Fixes SIGABRT-on-import for shared-library mise/asdf Python on macOS.
• #1817 by @Saik0s — bootstrap.py discover agent dir via hermes CLI shebang. Last-resort fallback for non-standard agent install paths.

Backend / providers

• #1805 by @franksong2702 — Provider account quota cards. Extends /api/provider/quota to OAuth-backed providers (openai-codex, anthropic) via cron_profile_context_for_home-wrapped agent calls.
• #1812 by @franksong2702 — Live Codex models in provider card (closes #1807). Calls hermes_cli.models.provider_model_ids("openai-codex") instead of static _PROVIDER_MODELS snapshot.

Frontend / sessions

• #1797 by @Michaelyklam — Preserve first-turn sidebar row during refresh (closes #1792). _mergeOptimisticFirstTurnSessions gated on _isOptimisticFirstTurnSessionRow.
• #1802 by @ai-ag2026 — Cross-surface session continuations stay visible. Backend marks _cross_surface_child_session; frontend keeps marked rows top-level instead of nesting.
• #1819 by @dso2ng — Approval/clarify prompts session-owned (closes #1694). Per-session caches; background-session prompts cache but don't paint; switch back re-renders.

Frontend / ui

• #1813 by @ai-ag2026 — Hide workspace metadata in user bubbles. Display-only strip; m.content unchanged.
• #1801 by @Michaelyklam — Error toasts copy-friendly (closes #1796). 20s default + Copy button + hover/focus pause.
• #1803 by @franksong2702 — File picker + HTML preview interactions (closes #1800). Visually-hidden file input + non-submit btnAttach + CSP sandbox HTML inline path.

Streaming

• #1809 by @ai-ag2026 — Dedupe workspace-prefixed user turns after compaction.

Ops

• #1811 by @ai-ag2026 — Workspace user turn repair script. Manual operator-invoked migration tool; cleans sidecar JSON + optional SQLite.

In-stage absorbs (during pre-release gate)

1. api/config.py — Added resolve_alias=False flag to _resolve_configured_provider_id() so resolve_model_provider() preserves raw 'ollama' / 'lm-studio' / 'vllm' etc. provider strings for _LOCAL_SERVER_PROVIDERS set membership in #1625's full-model-id-preservation contract. PR #1818's swap was correct for active-provider/badge surfaces but broke this branch via _resolve_provider_alias collapsing 'ollama' → 'custom'.
2. tests/test_bootstrap_discover_agent.py — Pinned Path.home() in _isolate_discover_agent_dir so PR #1817's tests don't pick up the dev machine's real ~/.hermes/hermes-agent. Test-only.

Tests

• 4747 → 4790 collected (+43)
• 4776 passed, 11 skipped, 1 xfailed, 2 xpassed, 0 failed in 145.9s
• Browser API harness 11/11 endpoints green
• JS syntax check 5/5 modified files green (node -c)
• Python syntax check 25/25 files green
• No file deletions, no merge-conflict markers

Pre-release verification

• All 15 PRs CI-green individually
• File overlaps resolved via stage-HEAD rebase for sibling PRs (sessions.js trio: 1797/1802/1819; ui.js trio: 1801/1803/1813; api/providers.py pair: 1805/1812; bootstrap.py pair: 1815/1817; CHANGELOG.md stripped from contributor branches before merge)
• Pre-stamp re-fetch: all 15 PR heads still match local rebases (no mid-sweep force-pushes)
• Opus advisor: SHIP verdict, 0 MUST-FIX, 0 SHOULD-FIX in-release. Two narrow follow-ups deferred to new issues:
  • custom_providers[].name == "ollama" + non-loopback base_url combo (partial #1625 regression for narrow config)
  • _cron_env_lock process-wide serialization on quota fetches across profiles

Maintainer triage

• PR #1814 by @hualong1009 → maintainer-review. Targets same #1806 root as #1818 but at runtime layer with 96 LOC of branchy logic and zero tests; complementary in principle but needs tests + dedup with #1818's helpers post-merge before mergeable. Posted structured comment with three actionable asks.

Closes #1792, #1795, #1796, #1800, #1806, #1807, #1694.