Basit Mustafa b072a6887c fix(csp): add explicit manifest-src 'self' directive (#961) ... PR #920 added static/manifest.json and sw.js for PWA support. The CSP in _security_headers() had no explicit manifest-src directive, so browsers fell back to default-src 'self' and emitted a console warning on every page load. The fallback is functionally correct but non-compliant with CSP Level 3 best practice of declaring each directive explicitly. Adds manifest-src 'self' before base-uri. No origin set is changed. Regression test added alongside existing CSP coverage in test_pwa_manifest_csp.py. Co-authored with Claude Sonnet 4.6 / Anthropic.		2026-04-24 10:44:46 -07:00
..
__init__.py	Hermes Web UI — Sprints 11-14: multi-provider models, settings, session QoL, alerts, polish	2026-03-31 07:02:47 +00:00
auth.py	release: v0.50.102–v0.50.108 batch (code blocks, utf-8, image URLs, deletion warning, PermissionError, Docker docs, kimi-k2.5) (#755)	2026-04-20 00:26:55 -07:00
background.py	feat(commands): /background, /btw slash commands + undo button + reasoning chip	2026-04-24 01:24:51 +00:00
clarify.py	feat: harden clarify dialog flow and refresh recovery	2026-04-15 13:10:50 +08:00
commands.py	feat: slash command parity + skill autocomplete — v0.50.91 (PR #711)	2026-04-19 05:37:44 +00:00
config.py	fix(models): duplicate dropdown entries, stale default model, lowercase injected label (#907 #908 #909) (#918)	2026-04-23 14:41:06 -07:00
gateway_watcher.py	fix(sessions): surface gateway SSE failures and add polling fallback (#828)	2026-04-21 21:18:55 -07:00
helpers.py	fix(csp): add explicit manifest-src 'self' directive (#961)	2026-04-24 10:44:46 -07:00
models.py	fix: harden session persistence and per-session lock handling during streaming (v0.50.175, #910) (#910)	2026-04-23 14:25:43 -07:00
onboarding.py	fix: persist onboarding_completed for CLI-configured users on first chat_ready (#922)	2026-04-23 15:46:02 -07:00
profiles.py	fix(profiles): complete profile isolation via cookie + thread-local (#805)	2026-04-21 17:04:11 +00:00
providers.py	fix(ci): eliminate test_set_key flakiness — v0.50.161	2026-04-23 02:09:37 +00:00
routes.py	feat(commands): /background, /btw slash commands + undo button + reasoning chip	2026-04-24 01:24:51 +00:00
session_ops.py	fix: harden session persistence and per-session lock handling during streaming (v0.50.175, #910) (#910)	2026-04-23 14:25:43 -07:00
startup.py	fix(security): gate auto-install behind HERMES_WEBUI_AUTO_INSTALL=1 — v0.50.156	2026-04-22 20:49:28 +00:00
state_sync.py	security: bandit fixes B310/B324/B110 + QuietHTTPServer (#354)	2026-04-13 11:11:56 -07:00
streaming.py	feat(commands): /background, /btw slash commands + undo button + reasoning chip	2026-04-24 01:24:51 +00:00
updates.py	fix: update banner — conflict recovery path + server self-restart after update (#816)	2026-04-21 17:10:41 -07:00
upload.py	v0.50.25: mobile scroll, import timestamps, profile security, mic fallback (#404)	2026-04-13 22:11:45 -07:00
workspace.py	feat(workspaces): autocomplete trusted workspace paths — v0.50.162 (PR #880 by @franksong2702, closes #616)	2026-04-23 02:35:58 +00:00