nesquena-hermes 38933b288d Stage-394 follow-up: profile-switch reconciliation + a11y switch role + server-side chat/settings filter ...

Per deep-review verdict SHIP-WITH-FIXES on PR #2636:

1. Profile-switch reconciliation: _refreshProfileSwitchBackground now re-fetches
   /api/settings and re-applies hidden_tabs for the new profile. Without this,
   Profile A's hidden-tabs choice stayed in effect under Profile B until the
   user opened Settings → Appearance.

2. A11y: switched chips from role=button + aria-pressed to role=switch +
   aria-checked. The pressed/not-pressed wording confused screen-reader users
   because chip-off looks like the off state. Added role=group +
   aria-labelledby on the container, and a :focus-visible style on the chips.

3. Server-side belt-and-suspenders: api/config.py now strips 'chat' and
   'settings' from hidden_tabs at validation time, matching the client's apply-
   time filter. A tampered POST can no longer persist the forbidden values.

3 new regression tests added (chat/settings rejection, profile-switch wiring,
chip a11y attributes).

Co-authored-by: FrancescoFarinola <francesco.farinola@example.com>

2026-05-20 23:05:19 +00:00

..

__init__.py

Hermes Web UI — Sprints 11-14: multi-provider models, settings, session QoL, alerts, polish

2026-03-31 07:02:47 +00:00

agent_health.py

fix(agent-health): treat stale running gateway as unknown

2026-05-11 23:13:09 +00:00

agent_sessions.py

fix: cap CLI session sidebar state scans

2026-05-20 12:47:03 -07:00

auth.py

Add session-bound CSRF token checks

2026-05-18 07:14:26 +08:00

background.py

feat(commands): /background, /btw slash commands + undo button + reasoning chip

2026-04-24 01:24:51 +00:00

clarify.py

chore: address review notes — dedup comment and 409-path clarification

2026-05-20 19:57:20 +00:00

commands.py

fix(security): drop unsafe-eval + add jsdelivr to CSP, sanitize plugin error

2026-05-11 17:53:02 +00:00

compression_anchor.py

feat(webui): render indexed context metadata

2026-05-19 18:52:50 +00:00

config.py

Stage-394 follow-up: profile-switch reconciliation + a11y switch role + server-side chat/settings filter

2026-05-20 23:05:19 +00:00

dashboard_probe.py

fix: preserve IPv6 dashboard link brackets

2026-05-19 21:35:10 -04:00

extensions.py

Opus pre-release follow-ups for PR #1445

2026-05-02 03:49:40 +00:00

gateway_watcher.py

release: v0.50.241 (#1293)

2026-04-29 19:54:07 -07:00

goals.py

fix(i18n): localize /goal runtime status strings

2026-05-10 15:21:24 +08:00

helpers.py

stage-348: apply Opus SHOULD-FIX-pre-merge — add '://' to _SENSITIVE_LOWER_MARKERS

2026-05-13 16:54:36 +00:00

kanban_bridge.py

stage-315 absorb: document handle_kanban_* three-valued return contract

2026-05-07 18:52:01 +00:00

metering.py

fix: show TPS in assistant message headers

2026-05-04 21:26:43 +00:00

models.py

Stage 393: PR #2633

2026-05-20 22:23:53 +00:00

oauth.py

fix(oauth): serialize Anthropic env fallback reads

2026-05-07 02:47:19 +00:00

onboarding.py

Classify onboarding DNS probe failures consistently

2026-05-15 08:51:30 +08:00

profiles.py

Stage 393: PR #2637

2026-05-20 22:24:40 +00:00

providers.py

fix: show config-managed custom providers

2026-05-20 06:27:00 -07:00

request_diagnostics.py

fix: add request wedge diagnostics

2026-05-08 15:37:08 +00:00

rollback.py

v0.50.255: Opus follow-ups (4 fixes) + CHANGELOG

2026-05-01 17:19:53 +00:00

routes.py

Stage 393: PR #2637

2026-05-20 22:24:40 +00:00

run_journal.py

Address run journal replay review

2026-05-16 02:58:34 +00:00

runtime_adapter.py

feat(runtime): add runner adapter facade

2026-05-19 12:06:57 -07:00

session_events.py

sync session list from server events

2026-05-20 08:18:56 -06:00

session_lifecycle.py

fix: align WebUI memory commits with CLI boundaries

2026-05-17 05:04:57 -06:00

session_ops.py

Show profile home in /status command (refs #463) (#1380)

2026-05-01 04:46:37 +00:00

session_recovery.py

fix(session): rebuild missing startup index

2026-05-20 23:43:30 +08:00

startup.py

fix: P0 hotfixes — API regression, code block parser, chmod override

2026-05-01 12:10:48 +00:00

state_sync.py

security: bandit fixes B310/B324/B110 + QuietHTTPServer (#354)

2026-04-13 11:11:56 -07:00

streaming.py

Stage 392: PR #2651

2026-05-20 21:48:04 +00:00

system_health.py

feat: add VPS resource health panel

2026-05-05 17:30:56 +00:00

terminal.py

fix: reap terminal shells on shutdown

2026-05-19 04:57:51 -07:00

turn_journal.py

fix: lock turn journal appends

2026-05-15 16:39:45 -07:00

updates.py

Stage 378: PR #2146

2026-05-17 19:55:09 +00:00

upload.py

fix(upload): scope archive extraction to per-session attachment dir

2026-05-18 21:22:02 +03:00

usage.py

fix: display canonical cache hit percentage

2026-05-19 02:27:12 -06:00

workspace.py

refactor: reduce stale workspace recovery fix

2026-05-12 06:28:35 -06:00

worktrees.py

Harden worktree removal safeguards

2026-05-13 09:49:15 +08:00