sync: upstream v0.51.184 (full catch-up from v0.51.131)

.github/workflows/browser-smoke.yml

@@ -0,0 +1,42 @@
+name: Browser smoke
+
+# Headless page-load smoke: boots the real server.py (agent-free) and loads the
+# key pages in Chromium, failing on any console error or uncaught JS exception.
+# This catches the runtime-JS brick class (const-reassign, function/window
+# collision) that `node --check`, ESLint, and the mocked pytest suite cannot
+# see — they only manifest when a real browser executes the page.
+#
+# No secrets, no credentials: the server boots agent-free and the smoke script
+# strips every *_API_KEY from the environment before launch.
+
+on:
+  pull_request:
+    branches: [master]
+  push:
+    branches: [master]
+
+jobs:
+  browser-smoke:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+          cache-dependency-path: |
+            **/requirements*.txt
+            **/pyproject.toml
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install "pyyaml>=6.0" playwright
+          # Install only the Chromium browser + its system deps.
+          python -m playwright install --with-deps chromium
+
+      - name: Run browser smoke
+        run: python tests/browser_smoke.py

.github/workflows/docker-smoke.yml

@@ -10,10 +10,12 @@ name: Docker smoke
 #
 # Scope (intentionally small for v1):
 #   - 3 compose variants (single, two-container, three-container)
-#   - For multi-container variants, rebuild the local Dockerfile and re-tag
-#     it as ghcr.io/nesquena/hermes-webui:latest BEFORE `up` so the PR's
-#     changes to docker_init.bash / Dockerfile actually execute. Without this
-#     the multi-container variants would pull the previous release from GHCR
+#   - For multi-container variants, the image is built from the PR's local
+#     Dockerfile (via the build-image job + GHA layer cache) and tagged
+#     ghcr.io/thecouchcoder-com/hermes-webui:latest — the name those compose
+#     files reference — BEFORE `up`, so the PR's changes to
+#     docker_init.bash / Dockerfile actually execute. Without this the
+#     multi-container variants would pull the previous release from GHCR
 #     and silently miss every PR-level regression.
 #   - Pre-flight `docker compose config` job to catch schema/interpolation drift.
 #   - Reaper before each smoke run + trap on EXIT for orphan defence.
@@ -66,10 +68,31 @@ jobs:
             echo "::endgroup::"
           done
 
+  # Build the Docker image once and cache layers via GHA cache.
+  # The smoke matrix jobs then pull from this cache instead of rebuilding
+  # from scratch, saving ~1-3 minutes per variant.
+  build-image:
+    name: Build Docker image (cache layers)
+    runs-on: ubuntu-latest
+    needs: compose-config
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Build and cache Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          load: true
+          tags: ghcr.io/thecouchcoder-com/hermes-webui:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
   smoke:
     name: Smoke ${{ matrix.variant }}
     runs-on: ubuntu-latest
-    needs: compose-config
+    needs: [compose-config, build-image]
     timeout-minutes: 15
     strategy:
       fail-fast: false
@@ -81,6 +104,23 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - uses: docker/setup-buildx-action@v3
+
+      # Restore the cached Docker image from the build-image job.
+      # Read-only: the build-image job already populated the GHA cache, so the
+      # smoke variants only need cache-from (no redundant cache-to re-export).
+      # This builds and tags ghcr.io/thecouchcoder-com/hermes-webui:latest —
+      # the image the multi-container compose files reference — straight from
+      # the layer cache, so the PR's Dockerfile changes are exercised without a
+      # from-scratch rebuild on every variant.
+      - name: Restore Docker image from cache
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          load: true
+          tags: ghcr.io/thecouchcoder-com/hermes-webui:latest
+          cache-from: type=gha
+
       - name: Resolve compose file + project name
         id: vars
         run: |
@@ -119,16 +159,6 @@ jobs:
             docker network rm "$n" || true
           done
 
-      - name: Build local Dockerfile
-        # We always build the local Dockerfile so the PR's changes are tested,
-        # even on the multi-container variants whose compose files reference
-        # ghcr.io/thecouchcoder-com/hermes-webui:latest. Without this retag,
-        # multi-container smoke runs would try to pull from GHCR (we don't
-        # publish a `:latest` tag) and fail before the PR's code is exercised.
-        run: |
-          set -euo pipefail
-          docker build -t ghcr.io/thecouchcoder-com/hermes-webui:latest .
-
       - name: Prepare ephemeral host paths
         id: paths
         run: |

.github/workflows/tests.yml

@@ -10,8 +10,19 @@ jobs:
   test:
     runs-on: ubuntu-latest
     strategy:
+      # Don't cancel the other shards/versions when one fails — we want the full
+      # failure picture across the matrix in a single run.
+      fail-fast: false
       matrix:
         python-version: ['3.11', '3.12', '3.13']
+        # Split the suite across 3 parallel shards per Python version. pytest-shard
+        # partitions tests deterministically by test-id hash; the suite was made
+        # shard-safe (no cross-test state leakage) so every shard passes
+        # independently. See docs/agent-memory note on test-suite shard-safety.
+        # NOTE: pytest-shard is 0-indexed — shard ids must be 0..num_shards-1.
+        # Using 1-based ids would crash the out-of-range job AND silently skip
+        # shard 0's tests.
+        shard: [0, 1, 2]
 
     steps:
       - uses: actions/checkout@v4
@@ -20,11 +31,16 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
+          cache: 'pip'
+          cache-dependency-path: |
+            **/setup.cfg
+            **/requirements*.txt
+            **/pyproject.toml
 
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install "pyyaml>=6.0" pytest pytest-timeout pytest-asyncio
+          pip install "pyyaml>=6.0" pytest pytest-timeout pytest-asyncio pytest-shard
           # Install the `mcp` package so tests/test_mcp_server.py runs in CI.
           # The package is an optional runtime dep of mcp_server.py — users
           # who run the MCP integration install it themselves; CI installs
@@ -33,5 +49,5 @@ jobs:
           # importorskip and the matrix stays green.
           pip install mcp || echo "mcp install failed — test_mcp_server.py will importorskip"
 
-      - name: Run tests
-        run: pytest tests/ -v --timeout=60
+      - name: Run tests (shard ${{ matrix.shard }} of 3)
+        run: pytest tests/ -v --timeout=60 --shard-id=${{ matrix.shard }} --num-shards=3

.gitignore

@@ -59,3 +59,7 @@ graphify-out/
 .graphify_uncached.txt
 
 .venv/
+
+# Dev-only lint tooling (ESLint runtime-error guard) — see TESTING.md
+node_modules/
+package-lock.json

ARCHITECTURE.md

@@ -122,6 +122,10 @@ Environment variables controlling behavior:
     HERMES_WEBUI_DEFAULT_MODEL     Optional model override; unset means provider default
     HERMES_WEBUI_PASSWORD          Optional: enable password auth (off by default)
     HERMES_WEBUI_SKIP_ONBOARDING   Optional: bypass the first-run onboarding wizard
+    HERMES_PREFILL_MESSAGES_FILE   Optional JSON message list for browser-turn prefill context
+    HERMES_WEBUI_PREFILL_MESSAGES_SCRIPT Optional command that prints JSON messages or plain-text user prefill context
+    HERMES_WEBUI_PREFILL_MESSAGES_SCRIPT_TIMEOUT Optional script timeout in seconds (default 5, max 30)
+    HERMES_WEBUI_PREFILL_CONTEXT_MAX_CHARS Optional parsed prefill budget in characters (default 12000, 0 disables)
     HERMES_HOME                    Base directory for Hermes state (~/.hermes by default)
 
 Test isolation environment variables (set by conftest.py):