nesquena-hermes 8da96a84d3 refactor(#5534): move CORS preflight header logic into api/routes (keep server.py thin) ...

The initial fix added ~16 lines to server.py, tripping test_server_py_under_750_lines
(server.py must stay a thin dispatcher; logic belongs in api/). Moved the whole
preflight-response into apply_cors_preflight_headers(handler) in api/routes.py;
server.py's do_OPTIONS is now a 4-line dispatcher. server.py 764 -> 746 lines.
Same security behavior (same-origin/allowlist echo, Vary: Origin, no wildcard,
header-less denial); test rewritten to the header-emitting API + added Vary and
no-header-on-denial assertions and a routes.py wildcard regression guard.

2026-07-05 02:35:10 +00:00

..

__init__.py

…

agent_health.py

fix(health): send Bearer auth on remote /health/detailed probe (#5418)

2026-07-02 16:24:39 +00:00

agent_sessions.py

fix(#5587): keep active CLI sessions visible before final output

2026-07-05 01:25:50 +00:00

auth_oidc.py

fix(#3825): harden oidc endpoint and claim validation

2026-06-30 20:59:19 -04:00

auth.py

fix(#5578): stop login next= param from nesting into itself and exploding the URL

2026-07-05 00:12:19 +00:00

background_process.py

fix(webui): render a server-initiated turn that finished during an SSE gap on a visible tab

2026-06-30 17:13:45 +00:00

background.py

…

clarify.py

stage #4524: clarify 409-terminal (id-guarded, loading-cleared) + SSE-notify on expiry (#4504) + v0.51.534 CHANGELOG

2026-06-20 05:36:56 +00:00

commands.py

fix(webui): guard non-dict resolve_moa_preset result in resolve_moa_config

2026-07-01 07:54:48 -05:00

compression_anchor.py

Address compaction marker and redaction review

2026-06-26 00:12:09 +00:00

config.py

harden #5511: active provider owns its OWN providers: allowlist (complete ownership model)

2026-07-04 07:28:44 +00:00

crash_visibility.py

fix(webui): crash visibility — faulthandler + thread excepthook + exit audit (#4633)

2026-07-01 18:01:39 +00:00

dashboard_probe.py

fix: preserve IPv6 dashboard link brackets

2026-05-19 21:35:10 -04:00

extensions.py

fix: prefer IPv4 for extension gallery downloads to prevent timeout on broken IPv6

2026-07-03 20:26:18 +00:00

gateway_chat.py

fix(#5564): mint stable per-message ids so large-session forks align

2026-07-04 22:46:56 +00:00

gateway_restart.py

fix(health): preserve restart failure contract and proofs (#5156)

2026-06-29 03:44:06 +00:00

gateway_watcher.py

Release PF (v0.51.445): scope gateway watcher to active profile (#2848) (#4275)

2026-06-15 15:41:21 -07:00

goals.py

fix(i18n): localize /goal runtime status strings

2026-05-10 15:21:24 +08:00

helpers.py

fix(redaction): memoize deterministic API response redactor

2026-06-29 18:22:18 +00:00

kanban_bridge.py

rebase(#2814): resolve i18n onto current master + add kanban_view_* keys to all 13 locales

2026-06-23 23:40:45 +00:00

metering.py

fix: show TPS in assistant message headers

2026-05-04 21:26:43 +00:00

models.py

fix(#5570): skip clear sentinel backups during recovery

2026-07-05 02:10:30 +00:00

oauth.py

Avoid blocking OAuth flow lock during Codex start

2026-06-17 00:20:49 +00:00

office_documents.py

#5142: office-doc preview + safe docx editing (#540), rebased on master; optional deps

2026-07-02 01:15:57 +00:00

onboarding.py

feat(#3260): self-hosted provider setup (Ollama/LM Studio) in Settings (i18n complete)

2026-07-02 08:17:44 +00:00

passkeys.py

Release v0.51.270 — Release IL (stage-u1 — un-hold batch: #3517 #3624 #3613) (#3674)

2026-06-05 11:35:26 -07:00

paths.py

fix(profiles): avoid config import cycle

2026-06-01 05:05:16 +00:00

plugin_providers.py

Release v0.51.270 — Release IL (stage-u1 — un-hold batch: #3517 #3624 #3613) (#3674)

2026-06-05 11:35:26 -07:00

plugins.py

fix(#2622): plugin card UX — legible Open button, single badge, visible toggle + reject protocol-relative tab.path

2026-06-02 03:58:02 +00:00

profiles.py

fix(#5567): pin worker profile via hermes-agent v0.18.0 context-local HERMES_HOME override

2026-07-04 23:40:10 +00:00

providers.py

feat(#3260): self-hosted provider setup (Ollama/LM Studio) in Settings (i18n complete)

2026-07-02 08:17:44 +00:00

request_diagnostics.py

fix(#4973): replace per-request diagnostics Timer with a process-global watchdog thread

2026-06-26 07:58:13 +00:00

rollback.py

fix(#4410): pre-check workspace leaf type via lstat + close fd on non-regular (Codex gate v2)

2026-06-18 19:22:29 +00:00

route_approvals.py

fix(#5000): relay mirrored gateway approvals after stream loss

2026-06-27 06:03:24 +00:00

route_session_list_cache.py

feat: add Webhooks sidebar filter parity

2026-06-30 17:06:31 +00:00

routes.py

refactor(#5534): move CORS preflight header logic into api/routes (keep server.py thin)

2026-07-05 02:35:10 +00:00

run_journal.py

fix(streaming): tighten tool limit terminal guards

2026-06-12 10:03:31 +08:00

runner_client.py

fix(gateway): correct approval URL and thread session history into runs API (#4479)

2026-06-19 13:16:39 -04:00

runtime_adapter.py

Stage 398: PR #2696 — feat(runtime): add runner-local adapter selection (RuntimeAdapter slice 4c, feature-flagged)

2026-05-21 17:43:54 +00:00

session_discoverability.py

Merge PR #3048

2026-05-28 17:47:33 +00:00

session_events.py

feat(sessions): carry changed session_id in session-list-changed events (#4221) (#4233)

2026-06-15 00:10:01 -07:00

session_export_html.py

#4968: export chat to self-contained themed HTML, rebased on master

2026-07-02 02:36:09 +00:00

session_lifecycle.py

fix(#5543): fire-and-forget commit_session_memory + drain-safe managed stop

2026-07-04 21:40:21 +00:00

session_ops.py

fix(#5563): align forked context to display for large (compacted) sessions

2026-07-04 20:55:06 +00:00

session_recovery.py

fix(#5570): also suppress restore when post-clear messages exist (gate fix)

2026-07-05 02:10:30 +00:00

skill_usage.py

fix: remove webui-side writer to avoid conflict with agent

2026-05-27 20:57:32 +08:00

sse_chunked.py

stage #4447: opt-in chunked SSE for buffering proxies (#4447) + v0.51.524 CHANGELOG

2026-06-19 22:09:17 +00:00

startup.py

…

state_sync.py

fix: use Optional[T] for default None parameters in state_sync.py

2026-06-01 17:20:17 +00:00

streaming.py

fix(#5575): preserve completed assistant replies during settle

2026-07-05 01:15:09 +00:00

system_health.py

fix: keep psutil optional for system health

2026-06-26 20:49:13 +00:00

terminal.py

Release v0.51.304 — Release JT (stage-p2a — un-held terminal reaper + opt-in Docker GPU) (#3757)

2026-06-06 18:04:16 -07:00

todo_state.py

Release v0.51.261 — Release IC (stage-r11) (#3616)

2026-06-04 16:46:20 -07:00

turn_journal.py

Release v0.51.326 — Release KP (#3618 + #3802 + #3762 + #3810) (#3816)

2026-06-07 23:18:51 -07:00

updates.py

fix(webui): resolve git.exe via Windows registry/known paths so WEBUI_VERSION doesn't degrade to 'unknown'

2026-07-04 15:36:59 +08:00

upload.py

fix(auth): enforce active-profile session IDs

2026-06-30 04:28:15 +00:00

usage.py

fix: display canonical cache hit percentage

2026-05-19 02:27:12 -06:00

webui_session_db.py

fix(#4767): review fixes - more edge cases

2026-06-24 18:08:50 +00:00

workspace_git.py

release: v0.51.506 — harden destructive workspace Git paths vs repo-local execution (#3879, #3777)

2026-06-19 02:14:13 +00:00

workspace.py

#5142: office-doc preview + safe docx editing (#540), rebased on master; optional deps

2026-07-02 01:15:57 +00:00

worktrees.py

Harden worktree removal safeguards

2026-05-13 09:49:15 +08:00