From 26d0f457918170e9ed45f80fd0104ca055be1a49 Mon Sep 17 00:00:00 2001 From: nesquena-hermes <226517000+nesquena-hermes@users.noreply.github.com> Date: Sat, 2 May 2026 00:52:41 +0000 Subject: [PATCH 1/2] fix: new-chat guard ignores in-flight streams (#1432) + profile form auto-capitalizes typed values (#1423) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two unrelated UX bugs, both small surgical fixes with regression tests. Issue #1432 — "+" button doesn't open new chat during streaming ================================================================ Reported by @Olyno: clicking "+" after sending a first message keeps redirecting to the same chat instead of opening a new blank conversation, making parallel chats impossible until the first response finishes. Root cause: static/boot.js:691 (and the Cmd/Ctrl+K branch at :844) had an empty-session guard from #1171 that skipped newSession() when message_count===0: if(S.session && (S.session.message_count||0)===0){ $('msg').focus(); closeMobileSidebar(); return; } But during the first user turn of a brand-new session, message_count is still 0 server-side because the user message hasn't been merged into s.messages yet. The guard treated that as "empty" and silently dropped the click, blocking parallel chats for the entire stream duration. Fix: Tighten the predicate to also exclude in-flight state: if(S.session && (S.session.message_count||0)===0 && !S.busy && !S.session.active_stream_id && !S.session.pending_user_message){ $('msg').focus(); closeMobileSidebar(); return; } Same predicate applied to the Cmd/Ctrl+K handler at :844. The in-flight signal (active_stream_id || pending_user_message) is the same one _restoreSettledSession() in messages.js:1081 already uses to decide whether a session is "settled" — keeping both call sites aligned. Verified end-to-end: with S.busy=true and pending_user_message set, the old guard returned `block=true` (= the bug), the new guard returns `block=false` (= fixed). With a truly empty session (no busy, no pending), both old and new guards still block — preserving #1171 behavior. Issue #1423 — Profile name field auto-capitalizes typed values ============================================================== Self-reported (Mac app, May 1 2026): typing `hello` into the New Profile "Name" field shows `Hello` after blur/autofill, contradicting the "Lowercase letters, numbers, hyphens, underscores only" hint right next to it. The form lowercases on submit so stored data is correct, but the displayed value during typing is misleading. Root cause: static/panels.js:2532 had only autocomplete="off": Missing three attributes that actually prevent the misbehavior: - autocapitalize="none" — mobile keyboards (iOS Safari, Android Chrome, WKWebView in the Mac app) auto-capitalize the first letter without it - autocorrect="off" — Safari runs autocorrect on blur, can rewrite hello→Hello - spellcheck="false" — desktop browsers may run spellcheck on blur Fix: Add the three attributes to profileFormName. Also added to profileFormBaseUrl since URLs are similarly bad targets for autocapitalize/autocorrect. profileFormApiKey is type="password" and already has correct browser behavior. Verified end-to-end against the live DOM: openProfileCreate() → getElementById('profileFormName').getAttribute(...) returns the new attributes correctly, with required preserved. Tests ----- 3648 passed, 2 skipped, 3 xpassed (was 3640 — added 8 new regression tests in test_1432_newchat_and_1423_profile_input.py). One pre-existing test had to be widened: tests/test_mobile_layout.py test_new_conversation_closes_mobile_sidebar grabbed only the first 500 chars of the btnNewChat handler block to scan for closeMobileSidebar. The new comment block pushed closeMobileSidebar past that window even though both calls are still present. Bumped the window to 1500 chars and the shortcut-block lines from 12 to 24 to match the multi-line guard. Closes #1432 Closes #1423 Reported by @Olyno (#1432, GitHub) --- CHANGELOG.md | 6 + static/boot.js | 35 ++++- static/panels.js | 4 +- ...est_1432_newchat_and_1423_profile_input.py | 122 ++++++++++++++++++ tests/test_mobile_layout.py | 6 +- 5 files changed, 163 insertions(+), 10 deletions(-) create mode 100644 tests/test_1432_newchat_and_1423_profile_input.py diff --git a/CHANGELOG.md b/CHANGELOG.md index 8bd401e1..543e7e67 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,11 @@ # Hermes Web UI -- Changelog +## [Unreleased] + +### Fixed +- **New-chat button (`+`) and Cmd/Ctrl+K were no-ops while the first message was streaming** (#1432, closes #1432) — the empty-session guard from #1171 (`message_count===0` → focus composer instead of creating a new session) didn't account for in-flight streams, where the user's message hasn't been merged into `s.messages` server-side yet. Clicking `+` during the first response of a brand-new session was silently dropped, so users couldn't actually start a parallel conversation. The guard now also requires `!S.busy && !S.session.active_stream_id && !S.session.pending_user_message` — the same in-flight signal already used by `_restoreSettledSession()` in `messages.js:1081`. (`static/boot.js`) +- **Profile-name field auto-capitalized typed values despite the "lowercase only" hint** (#1423, closes #1423) — the input had `autocomplete="off"` but was missing `autocapitalize="none"`, `autocorrect="off"`, and `spellcheck="false"`, so mobile keyboards (iOS Safari/WKWebView, Android Chrome) silently capitalized the first letter and desktop spellcheck could rewrite the value on blur. The form lowercases on submit, so stored data was always correct — the bug was a misleading display during typing. Same attributes added to the Base URL field for the same reason (URLs are not natural-language text). The API key field is `type="password"` and already has correct browser behavior. (`static/panels.js`) + ## [v0.50.261] — 2026-05-02 ### Changed diff --git a/static/boot.js b/static/boot.js index e4134258..15e51e9d 100644 --- a/static/boot.js +++ b/static/boot.js @@ -689,9 +689,24 @@ window._micPendingSend=window._micPendingSend||false; })(); $('fileInput').onchange=e=>{addFiles(Array.from(e.target.files));e.target.value='';}; $('btnNewChat').onclick=async()=>{ - // If the current session has no messages, just focus the composer rather than - // creating another empty session that will clutter the sidebar list (#1171). - if(S.session&&(S.session.message_count||0)===0){$('msg').focus();closeMobileSidebar();return;} + // If the current session has no messages AND nothing is in flight, just focus + // the composer rather than creating another empty session that will clutter the + // sidebar list (#1171). + // + // The "nothing in flight" half is critical (#1432): if the user clicks + while + // their first message is still streaming (or queued), `message_count` is still 0 + // server-side because the user turn hasn't been merged yet. The old guard treated + // that as "empty" and made + a no-op for the entire stream duration, so users + // couldn't actually start a parallel chat. Use the same in-flight signal as + // `_restoreSettledSession()` in messages.js: an active stream id or a queued + // pending user message means the session is real, not empty. + if(S.session + && (S.session.message_count||0)===0 + && !S.busy + && !S.session.active_stream_id + && !S.session.pending_user_message){ + $('msg').focus();closeMobileSidebar();return; + } await newSession();await renderSessionList();closeMobileSidebar();$('msg').focus(); }; $('btnDownload').onclick=()=>{ @@ -839,9 +854,17 @@ document.addEventListener('keydown',async e=>{ } if((e.metaKey||e.ctrlKey)&&e.key==='k'){ e.preventDefault(); - // If the current session has no messages, just focus the composer rather than - // creating another empty session that will clutter the sidebar list (#1171). - if(S.session&&(S.session.message_count||0)===0){$('msg').focus();return;} + // If the current session has no messages AND nothing is in flight, just focus + // the composer rather than creating another empty session that will clutter + // the sidebar list (#1171). See the matching guard in $('btnNewChat').onclick + // and bug #1432 for why the in-flight check is needed. + if(S.session + && (S.session.message_count||0)===0 + && !S.busy + && !S.session.active_stream_id + && !S.session.pending_user_message){ + $('msg').focus();return; + } // Cmd/Ctrl+K should always create a new conversation, even while the current // one is still streaming. The old !S.busy guard meant users had to wait for // a long generation to finish before they could start something new — exactly diff --git a/static/panels.js b/static/panels.js index b744cebb..2be1fa33 100644 --- a/static/panels.js +++ b/static/panels.js @@ -2529,7 +2529,7 @@ function _renderProfileForm(){
- +
${esc(t('profile_name_rule') || 'Lowercase letters, numbers, hyphens, underscores only.')}
@@ -2539,7 +2539,7 @@ function _renderProfileForm(){
- +
diff --git a/tests/test_1432_newchat_and_1423_profile_input.py b/tests/test_1432_newchat_and_1423_profile_input.py new file mode 100644 index 00000000..05c1dd6e --- /dev/null +++ b/tests/test_1432_newchat_and_1423_profile_input.py @@ -0,0 +1,122 @@ +""" +Regression tests for #1432 (new-chat empty-session guard ignores in-flight streams) +and #1423 (profile name input lacks autocapitalize/spellcheck attrs). + +Both bugs ship as static-asset diffs verified by reading the JS files. +""" +import os +import re + +STATIC_DIR = os.path.join(os.path.dirname(__file__), '..', 'static') + + +def _read(filename): + return open(os.path.join(STATIC_DIR, filename), encoding='utf-8').read() + + +class TestIssue1432NewChatGuardInFlight: + """`+` button and Cmd/Ctrl+K must create a new chat even while the current + session is still streaming. The empty-session guard from #1171 was checking + `message_count===0` only, which is true the entire time the first user + message is in flight (server-side count not yet updated). The guard now + also requires `!S.busy && !S.session.active_stream_id && + !S.session.pending_user_message` — same in-flight signal used at + `static/messages.js:_restoreSettledSession()`. + """ + + def test_btnNewChat_handler_checks_in_flight_state(self): + src = _read('boot.js') + # Locate the btnNewChat onclick handler + m = re.search( + r"\$\('btnNewChat'\)\.onclick=async\(\)=>\{(.*?)\};", + src, re.DOTALL, + ) + assert m, "btnNewChat onclick handler not found in boot.js" + body = m.group(1) + # The empty-session guard must check all three in-flight signals + assert 'message_count' in body, \ + "btnNewChat guard missing message_count check" + assert 'S.busy' in body, \ + "btnNewChat guard missing S.busy check (#1432)" + assert 'active_stream_id' in body, \ + "btnNewChat guard missing active_stream_id check (#1432)" + assert 'pending_user_message' in body, \ + "btnNewChat guard missing pending_user_message check (#1432)" + + def test_cmdK_handler_checks_in_flight_state(self): + src = _read('boot.js') + # Locate the Cmd/Ctrl+K branch — it sits inside a keydown listener + idx = src.find("(e.metaKey||e.ctrlKey)&&e.key==='k'") + assert idx >= 0, "Cmd/Ctrl+K handler not found in boot.js" + # Read the next ~1500 chars (handler body) + body = src[idx:idx + 1500] + assert 'message_count' in body, \ + "Cmd/Ctrl+K guard missing message_count check" + assert 'S.busy' in body, \ + "Cmd/Ctrl+K guard missing S.busy check (#1432)" + assert 'active_stream_id' in body, \ + "Cmd/Ctrl+K guard missing active_stream_id check (#1432)" + assert 'pending_user_message' in body, \ + "Cmd/Ctrl+K guard missing pending_user_message check (#1432)" + + def test_in_flight_signal_matches_restoreSettledSession(self): + """The new in-flight check uses the same signal as the canonical + 'session is in flight' detector at messages.js:_restoreSettledSession. + Verifying both files use the same shape so future refactors don't + diverge.""" + msgs_src = _read('messages.js') + # The canonical detector + assert 'session.active_stream_id||session.pending_user_message' in msgs_src, \ + "Canonical in-flight detector at _restoreSettledSession changed shape — " \ + "boot.js #1432 fix uses the same signals; keep them aligned" + + +class TestIssue1423ProfileFormAutocapitalize: + """Profile name and base-url inputs must suppress browser + auto-capitalization, autocorrect, and spell-check. Without these + attributes, mobile keyboards (iOS/Android) capitalize the first letter + and desktop spellcheck can rewrite the typed value on blur — even though + the placeholder/hint says lowercase only. The form lowercases on submit + so stored data is correct; the bug is purely a misleading display.""" + + def _profile_input_html(self, input_id): + src = _read('panels.js') + # Match the input element — pull the full opening tag + m = re.search( + rf']*id="{re.escape(input_id)}"[^>]*>', + src, + ) + return m.group(0) if m else None + + def test_profile_name_has_autocapitalize_none(self): + html = self._profile_input_html('profileFormName') + assert html, "profileFormName input not found in panels.js" + assert 'autocapitalize="none"' in html, \ + f"profileFormName missing autocapitalize=\"none\" (#1423): {html}" + + def test_profile_name_has_spellcheck_false(self): + html = self._profile_input_html('profileFormName') + assert html, "profileFormName input not found" + assert 'spellcheck="false"' in html, \ + f"profileFormName missing spellcheck=\"false\" (#1423): {html}" + + def test_profile_name_has_autocorrect_off(self): + html = self._profile_input_html('profileFormName') + assert html, "profileFormName input not found" + assert 'autocorrect="off"' in html, \ + f"profileFormName missing autocorrect=\"off\" (#1423): {html}" + + def test_profile_name_keeps_required(self): + """Regression guard: required must still be present.""" + html = self._profile_input_html('profileFormName') + assert ' required' in html, \ + f"profileFormName lost required attribute: {html}" + + def test_profile_baseurl_has_autocapitalize_none(self): + """Base URL inputs are equally bad targets for autocapitalize.""" + html = self._profile_input_html('profileFormBaseUrl') + assert html, "profileFormBaseUrl input not found" + assert 'autocapitalize="none"' in html, \ + f"profileFormBaseUrl missing autocapitalize=\"none\" (#1423)" + assert 'spellcheck="false"' in html, \ + f"profileFormBaseUrl missing spellcheck=\"false\" (#1423)" diff --git a/tests/test_mobile_layout.py b/tests/test_mobile_layout.py index f8acd21f..904130e2 100644 --- a/tests/test_mobile_layout.py +++ b/tests/test_mobile_layout.py @@ -463,14 +463,16 @@ def test_new_conversation_closes_mobile_sidebar(): # Handler is now multi-line — search for the full block rather than a single line. assert "$('btnNewChat').onclick" in boot_js, "btnNewChat onclick handler missing from static/boot.js" # Find the handler block and verify closeMobileSidebar appears in it. + # The handler grew comments after #1432 (in-flight guard refactor), so use a + # generous window to cover the full handler body. idx = boot_js.find("$('btnNewChat').onclick") - handler_block = boot_js[idx:idx+500] + handler_block = boot_js[idx:idx+1500] assert "closeMobileSidebar" in handler_block, \ "btnNewChat handler must closeMobileSidebar() after creating the new session" shortcut_line = next((ln for ln in boot_js.splitlines() if "e.key==='k'" in ln or "e.key === 'k'" in ln), "") assert shortcut_line, "Cmd/Ctrl+K new chat shortcut missing from static/boot.js" - shortcut_block = "\n".join(boot_js.splitlines()[boot_js.splitlines().index(shortcut_line):boot_js.splitlines().index(shortcut_line)+12]) + shortcut_block = "\n".join(boot_js.splitlines()[boot_js.splitlines().index(shortcut_line):boot_js.splitlines().index(shortcut_line)+24]) assert "closeMobileSidebar" in shortcut_block, \ "Cmd/Ctrl+K new chat shortcut must closeMobileSidebar() after creating the new session" From 2ec15a434581e348e0e71fbf330cec430b3f3dd4 Mon Sep 17 00:00:00 2001 From: nesquena-hermes <226517000+nesquena-hermes@users.noreply.github.com> Date: Sat, 2 May 2026 01:02:23 +0000 Subject: [PATCH 2/2] docs: v0.50.262 release notes and version bump - CHANGELOG: stamp [Unreleased] -> [v0.50.262] dated 2026-05-02 - ROADMAP: bump 'Last updated' to v0.50.262 / 3648 tests - TESTING: bump test count 3309 -> 3648 in header and footer + date --- CHANGELOG.md | 4 ++-- ROADMAP.md | 2 +- TESTING.md | 6 +++--- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 543e7e67..a2cec01f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,9 +1,9 @@ # Hermes Web UI -- Changelog -## [Unreleased] +## [v0.50.262] — 2026-05-02 ### Fixed -- **New-chat button (`+`) and Cmd/Ctrl+K were no-ops while the first message was streaming** (#1432, closes #1432) — the empty-session guard from #1171 (`message_count===0` → focus composer instead of creating a new session) didn't account for in-flight streams, where the user's message hasn't been merged into `s.messages` server-side yet. Clicking `+` during the first response of a brand-new session was silently dropped, so users couldn't actually start a parallel conversation. The guard now also requires `!S.busy && !S.session.active_stream_id && !S.session.pending_user_message` — the same in-flight signal already used by `_restoreSettledSession()` in `messages.js:1081`. (`static/boot.js`) +- **New-chat button (`+`) and Cmd/Ctrl+K were no-ops while the first message was streaming** (#1432, closes #1432) — the empty-session guard from #1171 (`message_count===0` → focus composer instead of creating a new session) didn't account for in-flight streams, where the user's message hasn't been merged into `s.messages` server-side yet. Clicking `+` during the first response of a brand-new session was silently dropped, so users couldn't actually start a parallel conversation. The guard now also requires `!S.busy && !S.session.active_stream_id && !S.session.pending_user_message` — the same in-flight signal already used by `_restoreSettledSession()` in `messages.js:1081`. Reported by @Olyno. (`static/boot.js`) - **Profile-name field auto-capitalized typed values despite the "lowercase only" hint** (#1423, closes #1423) — the input had `autocomplete="off"` but was missing `autocapitalize="none"`, `autocorrect="off"`, and `spellcheck="false"`, so mobile keyboards (iOS Safari/WKWebView, Android Chrome) silently capitalized the first letter and desktop spellcheck could rewrite the value on blur. The form lowercases on submit, so stored data was always correct — the bug was a misleading display during typing. Same attributes added to the Base URL field for the same reason (URLs are not natural-language text). The API key field is `type="password"` and already has correct browser behavior. (`static/panels.js`) ## [v0.50.261] — 2026-05-02 diff --git a/ROADMAP.md b/ROADMAP.md index 4fa869a1..1d613d0e 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -3,7 +3,7 @@ > Goal: Full 1:1 parity with the Hermes CLI experience via a clean dark web UI. > Everything you can do from the CLI terminal, you can do from this UI. > -> Last updated: v0.50.245 (April 30, 2026) — 3309 tests collected +> Last updated: v0.50.262 (May 2, 2026) — 3648 tests collected > Tests: `pytest tests/ --collect-only -q` > Source: / diff --git a/TESTING.md b/TESTING.md index a47d20ed..9c06314c 100644 --- a/TESTING.md +++ b/TESTING.md @@ -8,7 +8,7 @@ > Prerequisites: SSH tunnel is active on port 8787. Open http://localhost:8787 in browser. > Server health check: curl http://127.0.0.1:8787/health should return {"status":"ok"}. > -> Automated coverage: 3309 tests collected via `pytest tests/ --collect-only -q`. Tests run on every PR via GitHub Actions on Python 3.11, 3.12, and 3.13. The suite covers the bootstrap/static wizard, real provider config persistence (`config.yaml` + `.env`), the `/api/onboarding/*` backend, the onboarding skip/existing-config guard, CSS regression coverage for thinking/tool card animation, streaming session persistence, mobile layout breakpoints, locale parity across 9 languages, and ~700 issue/PR-pinned regression tests. +> Automated coverage: 3648 tests collected via `pytest tests/ --collect-only -q`. Tests run on every PR via GitHub Actions on Python 3.11, 3.12, and 3.13. The suite covers the bootstrap/static wizard, real provider config persistence (`config.yaml` + `.env`), the `/api/onboarding/*` backend, the onboarding skip/existing-config guard, CSS regression coverage for thinking/tool card animation, streaming session persistence, mobile layout breakpoints, locale parity across 9 languages, and ~700 issue/PR-pinned regression tests. > Run: `pytest tests/ -v --timeout=60` > > Local regression focus: verify that a previously closed workspace panel stays visually closed from first paint through boot completion on desktop refresh; there should be no brief open-then-close flash. @@ -1835,8 +1835,8 @@ Bridged CLI sessions: --- -*Last updated: v0.50.245, April 30, 2026* -*Total automated tests collected: 3309* +*Last updated: v0.50.262, May 2, 2026* +*Total automated tests collected: 3648* *Regression gate: tests/test_regressions.py* *Run: pytest tests/ -v --timeout=60* *Source: /*