feat: add WebUI status command card

[Michaelyklam]

Thinking Path

• Hermes WebUI aims for CLI parity while keeping slash commands local and lightweight.
• Issue feat: /status command — at-a-glance session info card in Web UI #463 called out that session/model/profile/status details were scattered across chips/tooltips, with no single WebUI /status view.
• The existing client already has the needed session, usage, profile, workspace, and model/provider state, so the smallest useful fix is a client-handled command rather than a new backend endpoint.
• This PR renders /status as an assistant-style inline card and keeps it ephemeral so it does not mutate persisted transcript history.
• The result is quick at-a-glance session diagnostics without sending a command to the agent.

What Changed

• Added /status to the WebUI slash command registry/help and implemented it from already-loaded client state.
• Replaced the old status endpoint round-trip path with an ephemeral assistant message carrying structured _statusCard data.
• Added a safe status-card renderer with escaped row values, a truncated/copyable session-id pill, and responsive card styling.
• Includes model/provider, active profile, workspace, personality, created/updated times, token/cost usage, message count, and running state where available.
• Added localized status strings and regression coverage for command registration, no agent/API send path, ephemeral rendering, escaping, styling hooks, and message visibility.

Why It Matters

WebUI users can now inspect the same kind of operational context the CLI exposes without hunting through several UI surfaces or involving the agent. Keeping it client-handled avoids extra latency and avoids polluting saved session history with diagnostic snapshots.

UI Media

Before: WebUI had no /status info card; users had to infer status from scattered chips/tooltips.

After: /status renders an inline assistant-style status card:

Verification

• env -u HERMES_CONFIG_PATH /home/michael/.hermes/hermes-agent/venv/bin/python -m pytest tests/test_status_command_card.py -q → 7 passed in 1.36s
• env -u HERMES_CONFIG_PATH /home/michael/.hermes/hermes-agent/venv/bin/python -m pytest tests/test_status_command_card.py tests/test_cli_only_slash_commands.py tests/test_subpath_frontend_routes.py -q → 23 passed in 1.54s
• env -u HERMES_CONFIG_PATH -u HERMES_WEBUI_PASSWORD TZ=UTC LANG=C.UTF-8 LC_ALL=C.UTF-8 /home/michael/.hermes/hermes-agent/venv/bin/python -m pytest tests/test_status_command_card.py tests/test_chinese_locale.py -q → 12 passed in 2.14s
• node --check static/commands.js static/ui.js static/i18n.js static/messages.js → passed
• git diff --check → passed
• Browser QA: ran an isolated local WebUI server with synthetic session data, executed /status, verified the DOM had one [data-status-card], confirmed the card shows session ID, title, model/provider, profile, workspace, timestamps, token/cost usage, message count, and running state, then captured the screenshot above.

Full-suite note:

• Attempted env -u HERMES_CONFIG_PATH -u HERMES_WEBUI_PASSWORD TZ=UTC LANG=C.UTF-8 LC_ALL=C.UTF-8 /home/michael/.hermes/hermes-agent/venv/bin/python -m pytest tests/ -q; it did not pass in this local environment: 488 failed, 3791 passed, 5 skipped, 3 xfailed, 1 warning, 13 errors, 8 subtests passed in 334.35s. The failures were broad server-fixture/environment failures dominated by urllib.error.URLError: <urlopen error [Errno 111] Connection refused> against the shared test server at 127.0.0.1:20128, plus onboarding fixture errors, not failures in the new focused /status coverage.

Risks / Follow-ups

• The card is intentionally ephemeral: it appears in the current in-memory chat view but is not persisted to session history. If maintainers want command output saved like a normal assistant turn, that should be a separate product decision.
• Provider is taken from model_provider, active provider state, or split from provider-prefixed model names. If future sessions carry richer provider metadata, the card can display that directly.

Model Used

AI assisted.

• Provider: OpenAI Codex
• Model: gpt-5.5
• Notable tool use: Hermes Agent terminal/file tools, pytest, node syntax checks, GitHub CLI, and browser QA with synthetic/private-safe session data.

Closes #463

[nesquena-hermes]

Closed by the v0.51.1 release in PR #1681 (merged at e23ba59). Massive thanks @Michaelyklam — this is now 19 merged PRs across the v0.50.292–v0.51.1 release window, an extraordinary contribution rate. Each PR was per-claim-vs-diff verified against your description and every security-relevant code path checked under independent review (Opus advisor, 6/6 questions clean). Your closes #N references are all accurate, your Thinking Path / What Changed / Why It Matters body template is consistently helpful, and your test coverage is solid behavioral scope (not source-string scaffolding) on every PR.

Live on production: https://github.com/nesquena/hermes-webui/releases/tag/v0.51.1

🚀