Ben Barclay 4b9d9b205b fix(dashboard): use loopback host for in-container WebSocket client (#58993) [salvage #59682] (#60092) ... * fix(dashboard): use loopback host for in-container WebSocket client (#58993) Fixes #58993 - the in-container Dashboard's WebSocket client was dialing the bind host (0.0.0.0) instead of 127.0.0.1, hijacking the host browser when the container port was exposed. * `hermes_cli/web_server.py::resolve_dashboard_ws_url()` now substitutes 127.0.0.1 for any 0.0.0.0 bind host discovered via the existing `find_unused_port` / `get_listen_address` path. LAN IPs and explicit `DASHBOARD_WS_HOST` overrides pass through unchanged. * Existing tests preserved (no regression on the explicit-bind case). Tests in `tests/dashboard/test_ws_client_host.py` cover: - Bind host 0.0.0.0 → ws URL uses 127.0.0.1 - Bind host 127.0.0.1 → ws URL uses 127.0.0.1 (no regression) - Bind host 192.168.1.5 → ws URL preserves the LAN IP - DASHBOARD_WS_HOST env override wins over auto-detection AI-assisted fix by https://github.com/SquabbyZ/peaks-loop (cherry picked from commit 5501dd38d660619729ebcad85b75a8f46f8deb38) * chore(release): map SquabbyZ email for AUTHOR_MAP attribution (#59682) --------- Co-authored-by: SquabbyZ <601709253@qq.com>		2026-07-07 18:33:28 +10:00
..
acp	fix(acp): also preserve archived rows on model-switch / restore saves	2026-07-01 17:16:51 +05:30
acp_adapter	…
agent	fix(usage): scope Codex usage pool fallback to AuthError, keep singleton token on account_id read failure	2026-07-07 12:01:33 +05:30
ci	…
cli	perf(cli): TTFT round 2 — live reasoning by default, partial-line streaming, prompt-build cache, stale budget-warning docs (#59389)	2026-07-06 00:16:38 -07:00
computer_use	fix(computer-use): sanitize env on the 4 remaining cua-driver spawn sites (#59165)	2026-07-05 14:48:20 -07:00
cron	refactor(cron): derive one-shot run-claim TTL from HERMES_CRON_TIMEOUT (#59567)	2026-07-06 04:57:09 -07:00
dashboard	fix(dashboard): use loopback host for in-container WebSocket client (#58993) [salvage #59682] (#60092)	2026-07-07 18:33:28 +10:00
docker	fix: remove dead f-string prefixes via ruff F541 (216 sites) (#52336)	2026-07-05 13:42:46 -07:00
e2e	fix(gateway): route SessionDB calls through AsyncSessionDB	2026-06-29 15:51:57 -07:00
fakes	…
fixtures/plugins/example-dashboard/dashboard	…
gateway	fix(gateway): per-profile pairing whitelist isolation in multiplex mode (#53045 salvage) (#59330)	2026-07-07 18:25:52 +10:00
hermes_cli	fix(auth): per-profile Anthropic OAuth file + complete port-binding platform set (#57563 salvage) (#59339)	2026-07-07 08:33:06 +00:00
hermes_state	…
honcho_plugin	…
integration	fix: remove dead f-string prefixes via ruff F541 (216 sites) (#52336)	2026-07-05 13:42:46 -07:00
manual	docs(cron): scope in_channel to channels; document DM continuation knob	2026-07-01 03:16:13 -07:00
openviking_plugin	…
plugins	fix(photon): auto-reinstall stale sidecar deps before start	2026-07-05 17:38:32 -07:00
providers	…
run_agent	test: expect model slug in autoraise notice dict (follow-up to gpt-5.4 extension)	2026-07-06 12:46:20 -07:00
scripts	…
secret_sources	feat(secrets): adapt 1Password onto the SecretSource interface	2026-07-06 04:58:07 -07:00
skills	blocked-tail pass: blind opt-out default, email fallback, peopleconnect delete-wipes-suppression	2026-07-03 15:21:04 -04:00
stress	fix: remove dead f-string prefixes via ruff F541 (216 sites) (#52336)	2026-07-05 13:42:46 -07:00
tools	feat(docker): re-seed a terminally-dead Nous bootstrap session on boot (#59983)	2026-07-07 06:57:23 +00:00
tui_gateway	fix(tui_gateway): route setup.runtime_check and setup.status to RPC pool	2026-07-02 15:44:37 -05:00
website	…
__init__.py	…
conftest.py	…
run_interrupt_test.py	…
test_account_usage.py	…
test_assistant_ui_tap_compat.py	…
test_atomic_replace_symlinks.py	fix(config): preserve owner on atomic writes (#56644)	2026-07-03 14:27:34 +10:00
test_background_review_list_shapes.py	fix(background-review): guard summarize against list-shaped tool responses (#59437)	2026-07-06 03:28:30 -07:00
test_background_review_session_isolation.py	test(review): add integration guards for the two isolation wirings (review)	2026-07-01 16:21:39 +05:30
test_base_url_hostname.py	…
test_batch_runner_checkpoint.py	…
test_bitwarden_secrets.py	feat(secrets): pluggable SecretSource interface + multi-source orchestrator	2026-07-06 04:58:07 -07:00
test_cli_file_drop.py	…
test_cli_manual_compress.py	…
test_cli_skin_integration.py	…
test_code_skew.py	…
test_copilot_initiator.py	fix(copilot): set x-initiator per turn so user prompts bill as premium requests (salvage #4097) (#58544)	2026-07-05 00:44:15 -07:00
test_ctx_halving_fix.py	…
test_dashboard_sidecar_close_on_disconnect.py	…
test_delegate_cascade_49148.py	…
test_desktop_electron_pin.py	…
test_desktop_mac_entitlements.py	…
test_dispatch_session_id.py	…
test_empty_model_fallback.py	…
test_empty_session_hygiene.py	…
test_env_loader_op_bootstrap.py	fix(secrets): make 1Password bootstrap token reliable outside systemd	2026-07-06 04:58:07 -07:00
test_env_loader_secret_sources.py	feat(secrets): adapt 1Password onto the SecretSource interface	2026-07-06 04:58:07 -07:00
test_evidence_store.py	…
test_fast_safe_load.py	perf(startup): parse config + plugin manifests with libyaml CSafeLoader (#54486)	2026-06-28 15:38:39 -07:00
test_gateway_streaming_nested_config.py	…
test_get_tool_definitions_cache_isolation.py	…
test_hermes_bootstrap.py	…
test_hermes_constants.py	test: update reasoning-effort docstring guards for new 'max' level	2026-07-04 14:19:44 +05:30
test_hermes_home_profile_warning.py	…
test_hermes_logging.py	fix(logging): drive rotating file handlers through an async QueueListener	2026-07-05 11:44:53 +05:30
test_hermes_state.py	feat(sessions): full filter surface for prune + bulk archive subcommand (#59327)	2026-07-05 22:04:52 -07:00
test_hermes_state_compression_locks.py	…
test_hermes_state_wal_fallback.py	…
test_honcho_client_concurrency.py	…
test_honcho_client_config.py	…
test_honcho_session_context.py	…
test_honcho_startup_fail_open.py	…
test_install_diverged_update.py	test(installer): cover diverged managed-clone recovery in install scripts	2026-06-30 20:11:01 +07:00
test_install_lockfile_churn.py	…
test_install_no_initial_commit.py	…
test_install_ps1_native_stderr_eap.py	…
test_install_ps1_python_fallback_venv.py	…
test_install_ps1_uv_powershell_host.py	…
test_install_ps1_web_server_syntax_probe.py	fix(install): guard Windows desktop installs against broken web_server	2026-07-05 19:35:30 -07:00
test_install_sh_browser_install.py	…
test_install_sh_install_method_stamp.py	…
test_install_sh_node_global_prefix.py	…
test_install_sh_pythonpath_sanitization.py	…
test_install_sh_root_fhs_uv_python_path.py	…
test_install_sh_setup_wizard_tty_probe.py	…
test_install_sh_symlink_stomp.py	…
test_install_sh_termux_network_prereqs.py	…
test_install_unmerged_index.py	…
test_ipv4_preference.py	…
test_lazy_session_regressions.py	…
test_lint_config.py	…
test_live_system_guard_self_test.py	…
test_mcp_serve.py	refactor: consolidate gateway session metadata into state.db (#58899)	2026-07-05 14:01:03 -07:00
test_mini_swe_runner.py	…
test_minimax_model_validation.py	…
test_minimax_oauth.py	…
test_minisweagent_path.py	…
test_model_forces_max_completion_tokens.py	…
test_model_picker_scroll.py	…
test_model_tools.py	fix(toolsets): preserve core tools when a posture toolset is in disabled_toolsets (#57315)	2026-07-05 14:51:49 -07:00
test_model_tools_async_bridge.py	…
test_ollama_num_ctx.py	test(vision): cover Ollama /api/show vision capability routing (#54511)	2026-06-28 22:52:59 -07:00
test_onepassword_secrets.py	feat(secrets): add 1Password (op://) secret source	2026-07-06 04:58:07 -07:00
test_output_cap_parsing.py	fix(context): parse vLLM's token-based output-cap error format	2026-07-01 03:17:48 -07:00
test_package_json_lazy_deps.py	…
test_packaging_metadata.py	security(deps): enforce aiohttp CVE floor on all lazy messaging paths + coverage guard	2026-07-01 02:51:45 -07:00
test_plugin_skills.py	…
test_plugin_utils.py	…
test_process_loop_event_loop_warning.py	…
test_profile_isolation_runtime.py	test(profile): two-profile regression suite + preserve skills_hub monkeypatch seam	2026-06-30 15:30:06 -07:00
test_project_metadata.py	fix(memory): lazy-install supermemory + mem0 SDKs like honcho/hindsight	2026-06-29 00:25:36 -07:00
test_retry_utils.py	refactor(retry): single-source Z.AI overload short-attempts + drop change-detector assert	2026-07-07 11:57:01 +05:30
test_run_tests_parallel.py	…
test_sanitize_tool_error.py	…
test_setup_temporary_outputs.py	…
test_slash_worker_watchdog.py	…
test_sql_injection.py	…
test_stale_utils_module_import.py	…
test_state_db_malformed_repair.py	…
test_subprocess_home_isolation.py	…
test_termux_all_extra_compat.py	…
test_timezone.py	…
test_toolset_distributions.py	…
test_toolsets.py	feat(mcp): adopt mcp__server__tool naming convention	2026-07-05 13:40:21 -07:00
test_trajectory_compressor.py	…
test_trajectory_compressor_async.py	…
test_transform_llm_output_hook.py	…
test_transform_tool_result_hook.py	…
test_tui_gateway_loop_noise.py	…
test_tui_gateway_queue_on_busy.py	…
test_tui_gateway_server.py	fix(tui): probe active custom model provider	2026-07-06 13:08:50 -07:00
test_tui_gateway_ws.py	fix(tui): start MCP discovery for websocket sessions	2026-06-28 04:14:12 -07:00
test_tui_mcp_late_refresh.py	…
test_utils_truthy_values.py	…
test_web_server.py	fix(dashboard): disable ws keepalive ping on loopback to survive event-loop stalls	2026-07-03 03:33:22 +05:30
test_wheel_locales_e2e.py	…
test_windows_subprocess_no_window_flags.py	test: make windows no-window-flag assertions immune to update-check daemon	2026-06-30 01:35:55 -05:00
test_yaml_indent_consistency_31999.py	…
test_yuanbao_integration.py	…
test_yuanbao_markdown.py	…
test_yuanbao_pipeline.py	fix(yuanbao): skip resource resolve on cache hits	2026-07-05 13:53:30 -07:00
test_yuanbao_proto.py	…
test_yuanbao_reconnect_set_active.py	fix(yuanbao): restore active singleton after WS reconnect	2026-07-05 00:41:34 -07:00
test_yuanbao_shutdown.py	…