HERMES-GIELIE/api
nesquena-hermes aae584ba57
Release v0.51.235 — Release HC (stage-q5) (#3490)
## Release v0.51.235 — Release HC (stage-q5)

Single fix in the data-sensitive transcript-merge path, with a Codex-found MUST-FIX applied.

### Fix
| PR | Author | Fix |
|----|--------|-----|
| #3468 | @jasonjcwu | `_find_current_user_turn` returns the **last** matching user turn instead of the first, so post-compression `result_messages` (which carries the full history) no longer replays the entire conversation when the user repeats a similar question (137-msg session → 89 duplicate replays). |

### Pre-release review caught a CORE issue (fixed before ship)
Codex's regression gate found that a naive last-match could be overridden by a **synthetic `role:"user"` continuation prompt** (the agent loop injects "Continue"/empty-recovery nudges — verified at `conversation_loop.py:1763/4183/4356`) that only *substring*-matches the user text — anchoring the merge **past** the real turn and dropping the assistant/tool output in between. Applied the fix: track **strong** (exact `_looks_like_current_user_turn`) and **weak** (substring) matches separately and return `last_strong → last_weak → fallback`. The real turn (strong) always wins over a later synthetic continuation (weak).

Opus reviewed the original and said ship; the applied fix is strictly safer than what it reviewed.

### Gate results
- **Full pytest suite**: 7465 passed, 8 skipped, 3 xpassed, **0 failed**
- **ruff forward gate**: CLEAN
- **browser-smoke gate**: CLEAN
- **Codex (regression)**: SHIP ONLY WITH FIXES → fix applied → re-reviewed **SAFE TO SHIP**
- **Opus (correctness)**: SHIP IT (on the pre-fix code; applied fix is strictly safer)
- **Regression test** (`tests/test_issue3468_duplicate_after_compression.py`, 7 cases): pins the last-match behavior, the strong-beats-later-weak invariant, and the end-to-end no-duplicate-replay invariant — each **verified to fail against the pre-fix logic**.

Co-authored-by: jasonjcwu <jasonjcwu@users.noreply.github.com>
2026-06-03 10:11:32 -07:00
..
__init__.py
agent_health.py Release v0.51.225 — Release GS (stage-p7 — remote gateway health probe resolves gateway_state #3355) (#3458) 2026-06-02 18:56:25 -07:00
agent_sessions.py fix: keep webui mirrored sessions out of cli filter 2026-05-28 00:51:12 +02:00
auth.py fix: harden WebUI bugfix sweep 2026-05-28 13:38:50 -04:00
background.py
clarify.py feat: add distinct attention request sound 2026-05-30 19:40:40 +00:00
commands.py
compression_anchor.py fix(sidebar): keep newer continuation visible over older snapshot 2026-05-28 13:38:06 -06:00
config.py Release v0.51.228 — Release GV (stage-p12 — workspace tree-drop #3411 + large-markdown preview #3378) (#3463) 2026-06-02 20:58:22 -07:00
dashboard_probe.py fix: preserve IPv6 dashboard link brackets 2026-05-19 21:35:10 -04:00
extensions.py
gateway_chat.py fix(gateway): carry WebUI delivery context on gateway-backed path too (Codex MUST-FIX on #3324) 2026-06-02 19:42:14 +00:00
gateway_watcher.py
goals.py
helpers.py fix(todos): hydrate cold-load state from session snapshot 2026-06-02 17:33:49 +00:00
kanban_bridge.py perf(http): enable HTTP/1.1 keep-alive 2026-05-24 18:26:56 +00:00
metering.py
models.py Release v0.51.222 — Release GP (stage-p4 — backend bugfix batch: title language drift #3293 + orphaned CLI sidecar prune #3238 + pin-quota lineage #3288) (#3452) 2026-06-02 17:35:18 -07:00
oauth.py
onboarding.py
passkeys.py feat: support passkey-only auth 2026-05-25 00:14:38 +00:00
paths.py fix(profiles): avoid config import cycle 2026-06-01 05:05:16 +00:00
plugins.py fix(#2622): plugin card UX — legible Open button, single badge, visible toggle + reject protocol-relative tab.path 2026-06-02 03:58:02 +00:00
profiles.py fix(profiles): TOCTOU-safe _SKILLS_STATS_CACHE read via .get() (Opus pre-release nit on #3341) 2026-06-01 18:38:39 +00:00
providers.py fix: honor shared OpenCode key at runtime 2026-05-30 02:18:06 +00:00
request_diagnostics.py
rollback.py
routes.py Release v0.51.233 — Release HA (stage-q3) (#3487) 2026-06-03 09:34:31 -07:00
run_journal.py fix: filter interrupted recovery control text from visible transcript (#3321) 2026-06-01 20:07:16 +00:00
runner_client.py harden: runner client rejects non-http(s) base_url + no redirect-follow (#3073) 2026-05-31 17:49:26 +00:00
runtime_adapter.py Stage 398: PR #2696 — feat(runtime): add runner-local adapter selection (RuntimeAdapter slice 4c, feature-flagged) 2026-05-21 17:43:54 +00:00
session_discoverability.py Merge PR #3048 2026-05-28 17:47:33 +00:00
session_events.py sync session list from server events 2026-05-20 08:18:56 -06:00
session_lifecycle.py fix: align WebUI memory commits with CLI boundaries 2026-05-17 05:04:57 -06:00
session_ops.py fix(session): preserve sidecar truncation boundary 2026-05-25 21:21:15 +08:00
session_recovery.py fix(session): rebuild missing startup index 2026-05-20 23:43:30 +08:00
skill_usage.py fix: remove webui-side writer to avoid conflict with agent 2026-05-27 20:57:32 +08:00
startup.py
state_sync.py fix: use Optional[T] for default None parameters in state_sync.py 2026-06-01 17:20:17 +00:00
streaming.py Release v0.51.235 — Release HC (stage-q5) (#3490) 2026-06-03 10:11:32 -07:00
system_health.py
terminal.py fix(terminal): harden supervisor lifecycle and eliminate timeout race conditions 2026-05-25 20:45:17 +05:00
todo_state.py fix(todos): hydrate cold-load state from session snapshot 2026-06-02 17:33:49 +00:00
turn_journal.py fix: handle Windows media and turn journal edge cases 2026-05-30 11:15:35 +02:00
updates.py fix(updates): re-exec correctly in both source and frozen builds 2026-06-02 17:33:49 +00:00
upload.py Release v0.51.221 — Release GO (stage-p3e — block all workspace symlink escapes + portable TOCTOU hardening [security]) (#3398) (#3451) 2026-06-02 16:56:30 -07:00
usage.py fix: display canonical cache hit percentage 2026-05-19 02:27:12 -06:00
workspace.py Release v0.51.234 — Release HB (stage-q4) (#3488) 2026-06-03 09:53:32 -07:00
workspace_git.py fix(workspace): tighten git subprocess trust boundary 2026-05-20 11:02:45 +00:00
worktrees.py