v0.46.0: security, Docker UID/GID, model discovery, i18n, cancel fix

* fix: decode HTML entities before markdown processing + zh/zh-Hant translations (#239)

Adds decode() helper in renderMd() to fix double-escaping of HTML entities
from LLM output (e.g. <code> becoming <code> instead
of rendering). XSS-safe: decode runs before esc(), only 5 entity patterns.

Also adds 40+ missing zh (Simplified Chinese) translation keys and a new
zh-Hant (Traditional Chinese) locale with 163 keys.

Fix applied: removed duplicate settings_label_notifications key in both
zh and zh-Hant locales.

Fixes #240

* fix: restore custom model list discovery with config api key (#238)

get_available_models() now reads api_key from config.yaml before env vars:
  1. model.api_key
  2. providers.<active>.api_key / providers.custom.api_key
  3. env var fallbacks (HERMES_API_KEY, OPENAI_API_KEY, etc.)

Also adds OpenAI/Python User-Agent header and a regression test covering
authenticated /v1/models discovery.

Fixes users with LM Studio / Ollama custom endpoints configured in
config.yaml whose model picker silently collapsed to the default model.

* feat: Docker UID/GID matching to avoid root-owned .hermes files (#237)

Adds docker_init.bash with hermeswebuitoo/hermeswebui user pattern so
container files match the host user UID/GID. Prevents .hermes volume
mounts from being owned by root when using a non-root host user.

Configure via WANTED_UID and WANTED_GID env vars (default 1000/1000).
Readme updated with setup instructions.

Fix applied: removed duplicate WANTED_GID=1000 line in docker-compose.yml
that was overriding the ${GID:-1000} variable expansion.

* security: redact credentials from API responses and fix credential file permissions (#243)

Adds response-layer credential redaction to three endpoints:
  - GET /api/session — messages[], tool_calls[], and title
  - GET /api/session/export — download also redacted
  - SSE done event — session payload in stream
  - GET /api/memory — MEMORY.md and USER.md content

Adds api/startup.py with fix_credential_permissions() at server startup.
Adds 13 tests in tests/test_security_redaction.py.

Merged with #237 container detection changes in server.py.

* fix: cancel button now interrupts agent and cleans up UI state (#244)

Wires agent.interrupt() into cancel_stream() so the backend actually
stops tool execution when the user clicks Cancel, rather than only
stopping the SSE stream while the agent keeps running.

Changes:
  - api/config.py: adds AGENT_INSTANCES dict (stream_id -> AIAgent)
  - api/streaming.py: stores agent in AGENT_INSTANCES after creation,
    checks CANCEL_FLAGS immediately after store (race condition fix),
    calls agent.interrupt() in cancel_stream(), cleans up in finally block
  - static/boot.js: removes stale setStatus(cancelling) call
  - static/messages.js: setBusy(false)/setStatus('') unconditionally on cancel

Race condition fix: after storing agent in AGENT_INSTANCES, immediately
checks if CANCEL_FLAGS[stream_id] is already set (cancel arrived during
agent init) and interrupts before starting. Check is inside the same
STREAMS_LOCK acquisition, making it atomic.

New test file: tests/test_cancel_interrupt.py with 6 unit tests.

* docs: v0.46.0 release notes, bump version, update test counts

---------

Co-authored-by: Nathan Esquenazi <nesquena@gmail.com>

static/boot.js

@@ -4,7 +4,7 @@ async function cancelStream(){
   try{
     await fetch(new URL(`/api/chat/cancel?stream_id=${encodeURIComponent(streamId)}`,location.origin).href,{credentials:'include'});
     const btn=$('btnCancel');if(btn)btn.style.display='none';
-    setStatus(t('cancelling'));
+    // Don't set status here - let the SSE cancel event handle UI cleanup
   }catch(e){setStatus(t('cancel_failed')+e.message);}
 }
 

static/i18n.js

@@ -366,7 +366,7 @@ const LOCALES = {
 
   zh: {
     _lang: 'zh',
-    _label: '\u4e2d\u6587',
+    _label: '\u7b80\u4f53\u4e2d\u6587',
     _speech: 'zh-CN',
     // boot.js
     cancelling: '\u6b63\u5728\u53d6\u6d88...',
@@ -496,6 +496,246 @@ const LOCALES = {
     login_btn: '\u767b\u5f55',
     login_invalid_pw: '\u5bc6\u7801\u9519\u8bef',
     login_conn_failed: '\u8fde\u63a5\u5931\u8d25',
+    // missing keys from English
+    tab_chat: '\u804a\u5929',
+    tab_memory: '\u8a18\u61b6',
+    tab_skills: '\u6280\u80fd',
+    tab_tasks: '\u4efb\u52d9',
+    tab_todos: '\u5f85\u8e29',
+    tab_workspaces: '\u5de5\u4f5c\u5340',
+    new_conversation: '\u65b0\u5b58\u5c0d\u8a71',
+    filter_conversations: '\u7b5c\u9078\u5b58\u5c0d\u8a71',
+    scheduled_jobs: '\u5b58\u5287\u4efb\u52d9',
+    new_job: '\u65b0\u4efb\u52d9',
+    search_skills: '\u641c\u5c0b\u6280\u80fd',
+    new_skill: '\u65b0\u6280\u80fd',
+    save_skill: '\u5132\u5b58\u6280\u80fd',
+    personal_memory: '\u500b\u4eba\u8a18\u61b6',
+    current_task_list: '\u76ee\u524d\u4efb\u52d9\u6e05\u55ae',
+    new_profile: '\u65b0\u914d\u7f6e\u6a94',
+    transcript: '\u8a18\u9304',
+    download_transcript: '\u4e0b\u8f09\u8a18\u9304',
+    import: '\u5c0e\u5165',
+    editing: '\u7de8\u8f2f\u4e2d',
+    empty_title: '\u7a7a\u767c\u5b58\u7a7a\u9593',
+    empty_subtitle: '\u9ede\u64ca\u4e0a\u65b9\u6309\u9215\u958b\u59cb\u5c0d\u8a71',
+    cancel: '\u53d6\u6d88',
+    loading: '\u52a0\u8f09\u4e2d',
+    create_job: '\u5efa\u7acb\u4efb\u52d9',
+    suggest_plan: '\u5efa\u8b70\u8a08\u5287',
+    suggest_schedule: '\u5efa\u8b70\u6642\u7a0b',
+    suggest_files: '\u5efa\u8b70\u6a94\u6848',
+    sign_out: '\u767b\u51fa',
+    password_placeholder: '\u5bc6\u7801',
+    disable_auth: '\u505c\u7528\u9a57\u8b49',
+    settings_label_sound: '\u901a\u77e5\u8072\u97f3',
+    settings_label_notifications: '\u700f\u89bd\u901a\u77e5',
+    settings_desc_sound: '\u52a9\u624b\u5b8c\u6210\u56de\u7b54\u6642\u64a9\u653e\u8072\u97f3\u3002',
+    settings_desc_notifications: '\u7576\u5206\u9801\u5728\u5f8c\u53f0\u6642\uff0c\u6709\u56de\u7b54\u5b8c\u6210\u6e05\u55ae\u6703\u986f\u793a\u7cfb\u7d71\u901a\u77e5\u3002',
+    settings_desc_token_usage: '\u5728\u52a9\u624b\u6bcf\u6b21\u56de\u7b54\u4e0b\u65b9\u986f\u793a Input/Output token \u6578\u91cf\u3002\u4e5f\u53ef\u4ee5\u7528 /usage \u5207\u63db\u3002',
+    settings_desc_cli_sessions: '\u5c07 Hermes CLI (\u7684 state.db) \u4e2d\u7684\u4f1a\u8a71\u6dfb\u52a0\u5230\u4f1a\u8a71\u6e05\u55ae\u3002\u9ede\u64ca\u4e00\u500b CLI \u4f1a\u8a71\u5c07\u5c0e\u5165\u5b83\u7a0b\u5f0f\u4e26\u7e7c\u7e8c\u5b58\u5c0d\u8a71\u3002',
+    settings_desc_sync_insights: '\u5c07 WebUI token \u4f7f\u7528\u60c5\u6cc1\u540c\u6b65\u5230 state.db\uff0c\u8a93 hermes /insights \u5305\u542b\u700f\u89bd\u5668\u4f1a\u8a71\u6578\u64da\u3002\u9810\u8a2d\u70b8\u555f\u7528\u3002',
+    settings_desc_check_updates: '\u7576\u6709\u66f4\u65b0\u7684 WebUI \u6216\u52a9\u624b\u7248\u672c\u6642\u986f\u793a\u6a19\u8a18\u3002\u5c07\u5728\u5f8c\u81ea\u6b63\u5e38\u57f7\u884c Git-Fetch\u3002',
+    settings_desc_bot_name: '\u52a9\u624b\u5728 UI \u4e2d\u7684\u986f\u793a\u540d\u7a31\u3002\u9810\u8a2d\u70b8\u7528\u6539\u3002',
+    settings_desc_password: '\u8a2d\u5b9a WebUI \u767b\u5165\u5bc6\u7801\u3002\u5047\u5982\u5df2\u8a2d\u7f6e\uff0c\u6bcf\u6b21\u52a0\u8f09\u90fd\u9700\u8981\u767b\u5165\u3002',
+    settings_label_sound: '\u901a\u77e5\u8072\u97f3',
+  },
+
+  // Traditional Chinese (zh-Hant)
+  'zh-Hant': {
+    _lang: 'zh-Hant',
+    _label: '\u7e41\u9ad4\u4e2d\u6587',
+    _speech: 'zh-TW',
+    // boot.js
+    cancelling: '\u6b63\u5728\u53d6\u6d88...',
+    cancel_failed: '\u53d6\u6d88\u5931\u6557\uff1a',
+    mic_denied: '\u9ea6\u514b\u98a8\u8a2a\u554f\u88ab\u62d2\u7d75\uff0c\u8acb\u6aa2\u67e5\u700f\u89bd\u5668\u6b0a\u9650\u3002',
+    mic_no_speech: '\u6c92\u6709\u6aa2\u6e2c\u5230\u8a71\u97f3\uff0c\u8acb\u518d\u5617\u4e00\u6b21\u3002',
+    mic_network: '\u8a71\u97f3\u8b58\u5225\u76ee\u524d\u4e0d\u53ef\u7528\u3002',
+    mic_error: '\u8a71\u97f3\u8f38\u5165\u51fa\u932f\uff1a',
+    session_imported: '\u6703\u8a71\u5df2\u5c0e\u5165',
+    import_failed: '\u5c0e\u5165\u5931\u6557\uff1a',
+    import_invalid_json: 'JSON \u7121\u6548',
+    image_pasted: '\u5df2\u7c98\u8cbc\u5716\u7247\uff1a',
+    // messages.js
+    edit_message: '\u7de8\u8f2f\u8a0a\u606f',
+    regenerate: '\u91cd\u65b0\u751f\u6210\u56de\u8986',
+    copy: '\u8907\u88fd',
+    copied: '\u5df2\u8907\u88fd',
+    you: '\u4f60',
+    thinking: '\u601d\u8003\u904e\u7a0b',
+    expand_all: '\u5168\u90e8\u5c55\u958b',
+    collapse_all: '\u5168\u90e8\u6298\u758a',
+    edit_failed: '\u7de8\u8f2f\u5931\u6557\uff1a',
+    regen_failed: '\u91cd\u65b0\u751f\u6210\u5931\u6557\uff1a',
+    reconnect_active: '\u56de\u8986\u4ecd\u5728\u751f\u6210\u4e2d\uff0c\u6e96\u5099\u597d\u5f8c\u8981\u91cd\u65b0\u52a0\u8f09\u55ce\uff1f',
+    reconnect_finished: '\u4f60\u96e2\u958b\u6642\u6709\u56de\u8986\u6b63\u5728\u751f\u6210\uff0c\u8a0a\u606f\u5167\u5bb9\u53ef\u80fd\u5df2\u7d93\u66f4\u65b0\u3002',
+    // approval card
+    approval_heading: '\u9700\u8981\u5ba1\u6838',
+    approval_desc_prefix: '\u6aa2\u6e2c\u5230\u5371\u96aa\u547d\u4ee4',
+    approval_btn_once: '\u5141\u8a31\u4e00\u6b21',
+    approval_btn_once_title: '\u5141\u8a31\u57f7\u884c\u6b64\u547d\u4ee4\u4e00\u6b21\uff08Enter\uff09',
+    approval_btn_session: '\u672c\u6b21\u5141\u8a31',
+    approval_btn_session_title: '\u672c\u6b21\u6703\u8a71\u671f\u9593\u5141\u8a31',
+    approval_btn_always: '\u59c4\u59b9\u5141\u8a31',
+    approval_btn_always_title: '\u59c4\u59b9\u5141\u8a31\u6b64\u547d\u4ee4\u6a21\u5f0f',
+    approval_btn_deny: '\u62d2\u7edd',
+    approval_btn_deny_title: '\u62d2\u7edd — \u4e0d\u57f7\u884c\u6b64\u547d\u4ee4',
+    approval_responding: '\u8655\u7406\u4e2d\u2026',
+    untitled: '\u672a\u547d\u540d',
+    n_messages: (n) => `${n} \u689d\u8a0a\u606f`,
+    model_unavailable: '\uff08\u4e0d\u53ef\u7528\uff09',
+    model_unavailable_title: '\u6b64\u6a21\u578b\u5df2\u7d93\u4e0d\u5728\u7576\u524d provider \u5217\u8868\u4e2d',
+    // commands.js
+    cmd_help: '\u67e5\u770b\u53ef\u7528\u547d\u4ee4',
+    cmd_clear: '\u6e05\u7a7a\u7576\u524d\u5c0d\u8a71\u8a0a\u606f',
+    cmd_compact: '\u58d3\u7e2e\u5c0d\u8a71\u4e0a\u4e0b\u6587',
+    cmd_model: '\u5207\u63db\u6a21\u578b\uff08\u4f8b\u5982 /model gpt-4o\uff09',
+    cmd_workspace: '\u6309\u540d\u7a31\u5207\u63db\u5de5\u4f5c\u5340',
+    cmd_new: '\u65b0\u5efa\u804a\u5929\u6703\u8a71',
+    cmd_usage: '\u5207\u63db token \u7528\u91cf\u986f\u793a',
+    cmd_theme: '\u5207\u63db\u4e3b\u984c\uff08dark/light/slate/solarized/monokai/nord/oled\uff09',
+    cmd_personality: '\u5207\u63db Agent \u4eba\u8a2d',
+    available_commands: '\u53ef\u7528\u547d\u4ee4\uff1a',
+    type_slash: '\u8f38\u5165 / \u53ef\u67e5\u770b\u547d\u4ee4',
+    conversation_cleared: '\u5c0d\u8a71\u5df2\u6e05\u7a7a',
+    model_usage: '\u7528\u6cd5\uff1a/model <name>',
+    no_model_match: '\u6c92\u6709\u5339\u914d\u201c',
+    switched_to: '\u5df2\u5207\u63db\u5230 ',
+    workspace_usage: '\u7528\u6cd5\uff1a/workspace <name>',
+    no_workspace_match: '\u6c92\u6709\u5339\u914d\u201c',
+    switched_workspace: '\u5df2\u5207\u63db\u5de5\u4f5c\u5340\uff1a',
+    workspace_switch_failed: '\u5de5\u4f5c\u5340\u5207\u63db\u5931\u6557\uff1a',
+    new_session: '\u5df2\u65b0\u5efa\u6703\u8a71',
+    compressing: '\u6b63\u5728\u8981\u6c42\u58d3\u7e2e\u4e0a\u4e0b\u6587...',
+    token_usage_on: 'Token \u7528\u91cf\u986f\u793a\u5df2\u958b\u555f',
+    token_usage_off: 'Token \u7528\u91cf\u986f\u793a\u5df2\u95dc\u9589',
+    theme_usage: '\u7528\u6cd5\uff1a/theme ',
+    theme_set: '\u4e3b\u984c\uff1a',
+    no_active_session: '\u7576\u524d\u6c92\u6709\u6d3b\u52d5\u6703\u8a71',
+    no_personalities: '\u6c92\u6709\u627e\u5230\u4eba\u8a2d\uff08\u53ef\u6dfb\u52a0\u5230 ~/.hermes/personalities/\uff09',
+    available_personalities: '\u53ef\u7528\u4eba\u8a2d\uff1a',
+    personality_switch_hint: '\n\n\u4f7f\u7528 `/personality <name>` \u5207\u63db\uff0c\u6216\u7528 `/personality none` \u6e05\u7a7a\u3002',
+    personalities_load_failed: '\u52a0\u8f7d\u4eba\u8a2d\u5931\u6557',
+    personality_cleared: '\u4eba\u8a2d\u5df2\u6e05\u7a7a',
+    personality_set: '\u7576\u524d\u4eba\u8a2d\uff1a',
+    failed_colon: '\u5931\u6557\uff1a',
+    // ui.js
+    no_workspace: '\u672a\u9078\u64c7\u5de5\u4f5c\u5340',
+    // workspace.js
+    unsaved_confirm: '\u9810\u89bd\u5340\u6709\u672a\u5132\u5b58\u4fee\u6539\uff0c\u8981\u653e\u68c4\u66f4\u6539\u5e76\u7e7c\u7e8c\u8df3\u8ee2\u55ce\uff1f',
+    save: '\u5132\u5b58',
+    edit: '\u7de8\u8f2f',
+    save_title: '\u5132\u5b58\u4fee\u6539',
+    edit_title: '\u7de8\u8f2f\u6b64\u6587\u4ef6',
+    saved: '\u5df2\u5132\u5b58',
+    save_failed: '\u5132\u5b58\u5931\u6557\uff1a',
+    image_load_failed: '\u5716\u7247\u52a0\u8f09\u5931\u6557',
+    file_open_failed: '\u7121\u6cd5\u6253\u958b\u6587\u4ef6',
+    downloading: (name) => `\u6b63\u5728\u4e0b\u8f09 ${name}...`,
+    double_click_rename: '\u96d9\u64ca\u91cd\u547d\u540d',
+    renamed_to: '\u5df2\u91cd\u547d\u540d\u70ba ',
+    rename_failed: '\u91cd\u547d\u540d\u5931\u6557\uff1a',
+    delete_title: '\u522a\u9664',
+    delete_confirm: (name) => `\u8981\u522a\u9664 ${name} \u55ce\uff1f`,
+    deleted: '\u5df2\u522a\u9664 ',
+    delete_failed: '\u522a\u9664\u5931\u6557\uff1a',
+    new_file_prompt: '\u65b0\u6587\u4ef6\u540d\uff08\u4f8b\u5982 notes.md\uff09\uff1a',
+    created: '\u5df2\u5275\u5efa ',
+    create_failed: '\u5275\u5efa\u5931\u6557\uff1a',
+    new_folder_prompt: '\u65b0\u6587\u4ef6\u593e\u540d\u7a31\uff1a',
+    folder_created: '\u5df2\u5275\u5efa\u6587\u4ef6\u593e ',
+    folder_create_failed: '\u5275\u5efa\u6587\u4ef6\u593e\u5931\u6557\uff1a',
+    remove_title: '\u79fb\u9664',
+    empty_dir: '(\u7a7a)',
+    upload_failed: '\u4e0a\u50b3\u5931\u6557\uff1a',
+    all_uploads_failed: (n) => `${n} \u500b\u6587\u4ef6\u5168\u90e8\u4e0a\u50b3\u5931\u6557`,
+    // settings panel
+    settings_title: '\u8a2d\u5b9a',
+    settings_save_btn: '\u5132\u5b58\u8a2d\u5b9a',
+    settings_label_model: '\u9ed8\u8a8d\u6a21\u578b',
+    settings_label_send_key: '\u767c\u9001\u5feb\u6377\u9375',
+    settings_label_theme: '\u4e3b\u984c',
+    settings_label_language: '\u8a9d\u8a00',
+    settings_label_token_usage: '\u986f\u793a token \u7528\u91cf',
+    settings_label_cli_sessions: '\u986f\u793a CLI \u6703\u8a71',
+    settings_label_sync_insights: '\u540c\u6b65\u5230 insights',
+    settings_label_check_updates: '\u6aa2\u67e5\u66f4\u65b0',
+    settings_label_bot_name: '\u52a9\u624b\u540d\u7a31',
+    settings_label_password: '\u8a2a\u8aad\u5bc6\u78bc',
+    settings_saved: '\u8a2d\u5b9a\u5df2\u5132\u5b58',
+    settings_save_failed: '\u5132\u5b58\u5931\u6557\uff1a',
+    settings_load_failed: '\u8a2d\u5b9a\u52a0\u8f09\u5931\u6557\uff1a',
+    settings_saved_pw: '\u8a2d\u5b9a\u5df2\u5132\u5b58\uff08\u5bc6\u78bc\u5df2\u8a2d\u5b9a\u2014\u73fe\u5728\u9700\u8981\u767b\u5f55\uff09',
+    // login page
+    login_title: '\u767b\u5f55',
+    login_subtitle: '\u8f38\u5165\u5bc6\u78bc\u7e7c\u7e8c\u4f7f\u7528',
+    login_placeholder: '\u5bc6\u78bc',
+    login_btn: '\u767b\u5f55',
+    login_invalid_pw: '\u5bc6\u78bc\u932f\u8aa4',
+    login_conn_failed: '\u9023\u63a5\u5931\u6557',
+    // missing keys from English
+    tab_chat: '\u804a\u5929',
+    tab_memory: '\u8a18\u61b6',
+    tab_skills: '\u6280\u80fd',
+    tab_tasks: '\u4efb\u52d9',
+    tab_todos: '\u5f85\u8e29',
+    tab_workspaces: '\u5de5\u4f5c\u5340',
+    new_conversation: '\u65b0\u5b58\u5c0d\u8a71',
+    filter_conversations: '\u7b5c\u9078\u5b58\u5c0d\u8a71',
+    scheduled_jobs: '\u5b58\u5287\u4efb\u52d9',
+    new_job: '\u65b0\u4efb\u52d9',
+    search_skills: '\u641c\u5c0b\u6280\u80fd',
+    new_skill: '\u65b0\u6280\u80fd',
+    save_skill: '\u5132\u5b58\u6280\u80fd',
+    personal_memory: '\u500b\u4eba\u8a18\u61b6',
+    current_task_list: '\u76ee\u524d\u4efb\u52d9\u6e05\u55ae',
+    new_profile: '\u65b0\u914d\u7f6e\u6a94',
+    transcript: '\u8a18\u9304',
+    download_transcript: '\u4e0b\u8f09\u8a18\u9304',
+    import: '\u5c0e\u5165',
+    editing: '\u7de8\u8f2f\u4e2d',
+    empty_title: '\u7a7a\u767c\u5b58\u7a7a\u9593',
+    empty_subtitle: '\u9ede\u64ca\u4e0a\u65b9\u6309\u9215\u958b\u59cb\u5c0d\u8a71',
+    cancel: '\u53d6\u6d88',
+    loading: '\u52a0\u8f09\u4e2d',
+    create_job: '\u5efa\u7acb\u4efb\u52d9',
+    suggest_plan: '\u5efa\u8b70\u8a08\u5287',
+    suggest_schedule: '\u5efa\u8b70\u6642\u7a0b',
+    suggest_files: '\u5efa\u8b70\u6a94\u6848',
+    sign_out: '\u767b\u51fa',
+    password_placeholder: '\u5bc6\u78bc',
+    disable_auth: '\u505c\u7528\u9a57\u8b49',
+    settings_label_sound: '\u901a\u77e5\u8072\u97f3',
+    settings_label_notifications: '\u700f\u89bd\u901a\u77e5',
+    settings_desc_sound: '\u52a9\u624b\u5b8c\u6210\u56de\u7b54\u6642\u64a9\u653e\u8072\u97f3\u3002',
+    settings_desc_notifications: '\u7576\u5206\u9801\u5728\u5f8c\u81ea\u6642\uff0c\u6709\u56de\u7b54\u5b8c\u6210\u6e05\u55ae\u6703\u986f\u793a\u7cfb\u7d71\u901a\u77e5\u3002',
+    settings_desc_token_usage: '\u5728\u52a9\u624b\u6bcf\u6b21\u56de\u7b54\u4e0b\u65b9\u986f\u793a Input/Output token \u6578\u91cf\u3002\u4e5f\u53ef\u4ee5\u7528 /usage \u5207\u63db\u3002',
+    settings_desc_cli_sessions: '\u5c07 Hermes CLI (\u7684 state.db) \u4e2d\u7684\u6703\u8a71\u6dfb\u52a0\u5230\u6703\u8a71\u6e05\u55ae\u3002\u9ede\u64ca\u4e00\u500b CLI \u6703\u8a71\u5c07\u5c0e\u5165\u5b83\u7a0b\u5f0f\u4e26\u7e7c\u7e8c\u5b58\u5c0d\u8a71\u3002',
+    settings_desc_sync_insights: '\u5c07 WebUI token \u4f7f\u7528\u60c5\u6cc1\u540c\u6b65\u5230 state.db\uff0c\u8a93 hermes /insights \u5305\u542b\u700f\u89bd\u5668\u6703\u8a71\u6578\u64da\u3002\u9810\u8a2d\u70b8\u555f\u7528\u3002',
+    settings_desc_check_updates: '\u7576\u6709\u66f4\u65b0\u7684 WebUI \u6216\u52a9\u624b\u7248\u672c\u6642\u986f\u793a\u6a19\u8a18\u3002\u5c07\u5728\u5f8c\u81ea\u6b63\u5e38\u57f7\u884c Git-Fetch\u3002',
+    settings_desc_bot_name: '\u52a9\u624b\u5728 UI \u4e2d\u7684\u986f\u793a\u540d\u7a31\u3002\u9810\u8a2d\u70b8\u7528\u6539\u3002',
+    settings_desc_password: '\u8a2d\u5b9a WebUI \u767b\u5165\u5bc6\u78bc\u3002\u5047\u5982\u5df2\u8a2d\u7f6e\uff0c\u6bcf\u6b21\u52a0\u8f09\u90fd\u9700\u8981\u767b\u5165\u3002',
+    settings_label_sound: '\u901a\u77e5\u8072\u97f3',
+    // boot.js
+    cancelling: '\u6b63\u5728\u53d6\u6d88...',
+    cancel_failed: '\u53d6\u6d88\u5931\u6557\uff1a',
+    mic_denied: '\u9ea6\u514b\u98a8\u8a2a\u554f\u88ab\u62d2\u7d75\uff0c\u8acb\u6aa2\u67e5\u700f\u89bd\u5668\u6b0a\u9650\u3002',
+    mic_no_speech: '\u6c92\u6709\u6aa2\u6e2c\u5230\u8a71\u97f3\uff0c\u8acb\u518d\u5617\u4e00\u6b21\u3002',
+    mic_network: '\u8a71\u97f3\u8b58\u5225\u76ee\u524d\u4e0d\u53ef\u7528\u3002',
+    mic_error: '\u8a71\u97f3\u8f38\u5165\u51fa\u932f\uff1a',
+    session_imported: '\u6703\u8a71\u5df2\u5c0e\u5165',
+    import_failed: '\u5c0e\u5165\u5931\u6557\uff1a',
+    import_invalid_json: 'JSON \u7121\u6548',
+    image_pasted: '\u5df2\u7c98\u8cbc\u5716\u7247\uff1a',
+    // messages.js
+    edit_message: '\u7de8\u8f2f\u8a0a\u606f',
+    regenerate: '\u91cd\u65b0\u751f\u6210\u56de\u8986',
+    copy: '\u8907\u88fd',
+    copied: '\u5df2\u8907\u88fd',
+    // ui.js
+    workspace_desc: '\u8acb\u9078\u64c7\u5de5\u4f5c\u5340\uff0c\u6216\u8f09\u5165\u65b0\u540d\u7a31\u5beb\u4e00\u500b',
+    tab_profiles: '\u914d\u7f6e',
   },
 };
 

static/index.html

@@ -14,7 +14,7 @@
 <body>
 <div class="layout">
   <aside class="sidebar">
-    <div class="sidebar-header"><div class="logo">H</div><div><h1 style="margin:0;font-size:15px;font-weight:700;letter-spacing:-.01em">Hermes</h1><div style="font-size:10px;color:var(--muted);opacity:.8;margin-top:1px">v0.45.0</div></div></div>
+    <div class="sidebar-header"><div class="logo">H</div><div><h1 style="margin:0;font-size:15px;font-weight:700;letter-spacing:-.01em">Hermes</h1><div style="font-size:10px;color:var(--muted);opacity:.8;margin-top:1px">v0.46.0</div></div></div>
     <div class="sidebar-nav">
       <button class="nav-tab active" data-panel="chat" data-label="Chat" onclick="switchPanel('chat')" title="Chat" data-i18n-title="tab_chat"><svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M21 15a2 2 0 0 1-2 2H7l-4 4V5a2 2 0 0 1 2-2h14a2 2 0 0 1 2 2z"/></svg></button>
       <button class="nav-tab" data-panel="tasks" data-label="Tasks" onclick="switchPanel('tasks')" title="Tasks" data-i18n-title="tab_tasks"><svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><rect x="3" y="4" width="18" height="18" rx="2"/><line x1="16" y1="2" x2="16" y2="6"/><line x1="8" y1="2" x2="8" y2="6"/><line x1="3" y1="10" x2="21" y2="10"/></svg></button>

static/messages.js

@@ -295,7 +295,8 @@ async function send(){
         S.messages.push({role:'assistant',content:'*Task cancelled.*'});renderMessages();
       }
       renderSessionList();
-      if(!S.session||!INFLIGHT[S.session.session_id]){setBusy(false);setStatus('');}
+      // Always clear busy state and status when cancel event is received
+      setBusy(false);setStatus('');
     });
   }
 

static/ui.js

@@ -135,6 +135,10 @@ function getModelLabel(modelId){
 
 function renderMd(raw){
   let s=raw||'';
+  // Pre-pass: decode HTML entities first so markdown processing works correctly.
+  // This prevents double-escaping when LLM outputs entities like < > &
+  const decode=s=>s.replace(/&lt;/g,'<').replace(/&gt;/g,'>').replace(/&amp;/g,'&').replace(/&quot;/g,'"').replace(/&#39;/g,"'");
+  s=decode(s);
   // Pre-pass: convert safe inline HTML tags the model may emit into their
   // markdown equivalents so the pipeline can render them correctly.
   // Only runs OUTSIDE fenced code blocks and backtick spans (stash + restore).