feat: link official Hermes dashboard

[Michaelyklam]

Thinking Path

• Hermes WebUI already has primary navigation for related Hermes surfaces, but the official hermes dashboard is a separate local service.
• Issue feat(nav): detect and link to running Hermes Agent dashboard (acts as another menu item) #1459 asked for a discoverable WebUI link without iframe embedding or brittle browser-side localhost probing.
• The current Hermes Agent dashboard exposes its identifying read-only status at GET /api/status, not /api/version, so the WebUI can safely probe that endpoint server-side.
• The smallest useful fix is a loopback-only server probe plus a hidden-by-default nav item that appears only when the official dashboard is reachable or explicitly enabled.
• Users get a quick path from WebUI to the official dashboard while avoiding CORS failures, mixed-content issues, and arbitrary local-network probing.

Closes #1459.

What Changed

• Added api/dashboard_probe.py for official dashboard detection using /api/status, short timeouts, strict loopback-only URL normalization, and auto / always / never configuration.
• Added GET /api/dashboard/status, GET /api/dashboard/config, and POST /api/dashboard/config routes.
• Added hidden dashboard nav buttons in the desktop rail and mobile nav; the link appears between Insights and Settings and opens in a new tab with noopener,noreferrer.
• Added Settings → System controls for dashboard link mode and optional loopback URL override.
• Added frontend 60-second status caching, browser-host URL derivation, non-loopback warning text, and localized translation keys.
• Added regression coverage for backend probing/config/routes, frontend link/caching/opening contract, and subpath-safety expectations.
• Added UI evidence at docs/pr-media/1459/dashboard-nav-link.png.

Why It Matters

This makes the official Hermes Agent Dashboard discoverable from WebUI without making the browser guess whether 127.0.0.1:9119 means the server or the user's local machine. Keeping the probe server-side and loopback-only also avoids turning the setting into a generic SSRF/local-network scanner.

Verification

/home/michael/.hermes/hermes-agent/venv/bin/python -m pytest tests/test_dashboard_probe.py tests/test_dashboard_link_ui.py tests/test_subpath_frontend_routes.py tests/test_chinese_locale.py tests/test_japanese_locale.py tests/test_korean_locale.py tests/test_russian_locale.py tests/test_spanish_locale.py -q
node --check static/ui.js
node --check static/i18n.js
node --check static/panels.js
/home/michael/.hermes/hermes-agent/venv/bin/python -m py_compile api/dashboard_probe.py api/routes.py
git diff --check
HERMES_WEBUI_TEST_PORT=28942 HERMES_WEBUI_TEST_STATE_DIR=/tmp/hermes-webui-kanban/t_abdc1f16/full-suite-state-2 env -u HERMES_CONFIG_PATH /home/michael/.hermes/hermes-agent/venv/bin/python -m pytest tests/ -q

Result:

48 passed in 2.26s
node --check / py_compile / git diff --check passed
4304 passed, 2 skipped, 1 xfailed, 2 xpassed, 1 warning, 8 subtests passed in 391.33s (0:06:31)

Manual/browser verification:

• Verified against an isolated WebUI server on 127.0.0.1:18760 and a synthetic official-dashboard status server on 127.0.0.1:19119.
• Confirmed /api/dashboard/status returned running: true, host: 127.0.0.1, port: 19119, url: http://127.0.0.1:19119, version: 0.12.0-test, enabled: auto.
• Confirmed both dashboard buttons become visible and derive http://127.0.0.1:19119 for the browser.
• Confirmed click behavior calls window.open('http://127.0.0.1:19119', '_blank', 'noopener,noreferrer').
• Confirmed the nav item appears between Insights and Settings and the badge now reads as an external-link marker rather than just a dot.

UI media:

Risks / Follow-ups

• The dashboard link is intentionally conservative: auto mode suppresses probing when WebUI itself is bound to a non-loopback host, while always can still show an explicitly configured loopback target.
• The optional URL override only accepts loopback base URLs with explicit ports; broader dashboard discovery would need a separate product/security decision.
• The external-link badge is small to fit the nav rail, but browser QA confirmed it is clearer than a notification dot.

Model Used

AI assisted.

• Provider: OpenAI Codex
• Model: gpt-5.5
• Notable tool use: Hermes Kanban, terminal/git/pytest/node checks, browser QA, GitHub CLI

[nesquena-hermes]

Closed by the v0.51.1 release in PR #1681 (merged at e23ba59). Massive thanks @Michaelyklam — this is now 19 merged PRs across the v0.50.292–v0.51.1 release window, an extraordinary contribution rate. Each PR was per-claim-vs-diff verified against your description and every security-relevant code path checked under independent review (Opus advisor, 6/6 questions clean). Your closes #N references are all accurate, your Thinking Path / What Changed / Why It Matters body template is consistently helpful, and your test coverage is solid behavioral scope (not source-string scaffolding) on every PR.

Live on production: https://github.com/nesquena/hermes-webui/releases/tag/v0.51.1

🚀