Issues

• An unresolved ${VAR} in a named profile's custom provider api_key is sent to the provider as the literal key

  bug
  nesquena/hermes-webui#8976 · Filter by author nesquena-hermes opened on Nov 10, 2026

• Context-length lookup's credential choice differs from the chat's merge (cost-only)

  bug
  nesquena/hermes-webui#8975 · Filter by author nesquena-hermes opened on Nov 10, 2026

• Streaming drops the Agent's switched-off refusal: resolve_runtime_provider errors are printed and the turn routes through WebUI's merge

  buginvestigationprioritysecurity
  nesquena/hermes-webui#8974 · Filter by author nesquena-hermes opened on Nov 10, 2026 · Critical Bug Fix

• Chat pairs a named custom provider's key with another record's URL (credential-pool seeding and _runtime_preferred_base_url)

  buginvestigationprioritysecurity
  nesquena/hermes-webui#8973 · Filter by author nesquena-hermes opened on Nov 10, 2026 · Critical Bug Fix

• Gateway mode refusals: follow-ups to #8860 (owning profile, handoff summary, UI, test coverage)

  buginvestigationsecurity
  nesquena/hermes-webui#8971 · Filter by author nesquena-hermes opened on Nov 9, 2026 · Backlog - Holding Pattern

• Manual compression worker reads the process-default profile's WebUI config

  buginvestigationprioritysecurity
  nesquena/hermes-webui#8970 · Filter by author nesquena-hermes opened on Nov 9, 2026 · Critical Bug Fix
  1

• /goal stores contract lines as plain goal text, and /goal gate add replaces the goal

  bugcli-paritypriority
  nesquena/hermes-webui#8965 · Filter by author starship-s opened on Nov 9, 2026 · Critical Bug Fix
  1

• Context-length lookup selects alias and placeholder records for sessions the chat routes elsewhere

  buginvestigationsecurity
  nesquena/hermes-webui#8964 · Filter by author nesquena-hermes opened on Nov 9, 2026 · Backlog - Holding Pattern

• Context-length lookup sends no key for a raw-named providers record whose api_key_env the chat uses

  buginvestigationsprint-candidate
  nesquena/hermes-webui#8963 · Filter by author nesquena-hermes opened on Nov 9, 2026 · Backlog - Holding Pattern

• Chat sends a provider record's key to the model block's base_url when the Agent resolved that record at its own URL

  buginvestigationprioritysecurity
  nesquena/hermes-webui#8962 · Filter by author nesquena-hermes opened on Nov 9, 2026 · Critical Bug Fix
  1

• Context-length lookup sends a built-in provider's record or model-block key that the chat never sends

  buginvestigationsecurity
  nesquena/hermes-webui#8960 · Filter by author nesquena-hermes opened on Nov 9, 2026 · Backlog - Holding Pattern

• Chat sends the keyless placeholder for a legacy custom_providers entry whose key is set with api_key_env

  buginvestigationpriority
  nesquena/hermes-webui#8959 · Filter by author nesquena-hermes opened on Nov 9, 2026 · Critical Bug Fix

• Session update and chat start look up a key_cmd route's context window without a key, so the chat falls back to 256,000

  bugupstream-change
  nesquena/hermes-webui#8957 · Filter by author nesquena-hermes opened on Nov 9, 2026 · Backlog - Holding Pattern

• Context-length lookup takes its URL and context-length override from the first matching providers record, even a disabled one

  bug
  nesquena/hermes-webui#8955 · Filter by author nesquena-hermes opened on Nov 9, 2026 · Backlog - Holding Pattern

• Chat sends a built-in provider's key to a switched-off spelling's base_url when that record lists the model

  bugprioritysecurity
  nesquena/hermes-webui#8954 · Filter by author nesquena-hermes opened on Nov 9, 2026 · Critical Bug Fix
  1

• Session context lookup asks the model block's URL when the chat's custom route uses key_cmd, a credential pool or a host-gated env key

  bugupstream-change
  nesquena/hermes-webui#8953 · Filter by author nesquena-hermes opened on Nov 9, 2026 · Backlog - Holding Pattern
  1

• Named custom provider with both a providers record and a same-name legacy entry: the chat, the Agent and the context-length lookup each pick a different source

  buginvestigation
  nesquena/hermes-webui#8952 · Filter by author nesquena-hermes opened on Nov 9, 2026 · Backlog - Holding Pattern

• Chat never sends a configured model.api_key when the named custom: record (or legacy entry) at the same URL is keyless

  bug
  nesquena/hermes-webui#8948 · Filter by author nesquena-hermes opened on Nov 9, 2026 · Backlog - Holding Pattern

• Model-switch context-length lookup asks a different host from the one the session chats with (pre-existing, display only)

  bug
  nesquena/hermes-webui#8941 · Filter by author nesquena-hermes opened on Nov 9, 2026 · Backlog - Holding Pattern

• Feature request: Favorite models in the model picker

  enhancement
  nesquena/hermes-webui#8937 · Filter by author TimmySheep opened on Nov 9, 2026 · Backlog - Holding Pattern
  2

• macOS: test portability failures (GNU mv -T in tests, host git credential helper in update tests)

  bugpriority
  nesquena/hermes-webui#8931 · Filter by author nesquena-hermes opened on Nov 9, 2026 · Critical Bug Fix
  2

• macOS: _atomic_write_text drops the setgid bit (fchmod before write)

  bugprioritysprint-candidate
  nesquena/hermes-webui#8930 · Filter by author nesquena-hermes opened on Nov 9, 2026 · Critical Bug Fix
  1

• Context-length key ownership: canonicalise hosts in the origin compare (IDN, trailing dot, IPv6); optional idna, fail closed

  bugsecurity
  nesquena/hermes-webui#8922 · Filter by author nesquena-hermes opened on Nov 8, 2026 · Backlog - Holding Pattern

• Switching to an idle session can render the other session's in-flight live turn

  buginvestigationprioritysessionstreaming
  nesquena/hermes-webui#8920 · Filter by author ligongfu opened on Nov 8, 2026 · Critical Bug Fix
  1

• #8917 follow-ups: probe-fixture cache restore, alias-site pin test, streaming-site symmetry, lookup key-rule docs

  bugtracking
  nesquena/hermes-webui#8919 · Filter by author nesquena-hermes opened on Nov 8, 2026 · Backlog - Holding Pattern