Nathan Esquenazi 71dd691ed0 fix: harden bot_name — crash guard, XSS escape, sanitization, tests ...

- Move `import html` to module top (was inside function body)
- Fix IndexError crash in /login when bot_name is empty string;
  use `or 'Hermes'` fallback instead of .get() default which
  doesn't guard against stored empty string
- Add server-side sanitization in POST /api/settings: strip + default
  empty/whitespace bot_name to 'Hermes' before persisting
- Escape _bn initial char in ui.js innerHTML (esc() consistency)
- Add maxlength=64 to #settingsBotName input field
- Add tests/test_sprint27.py: 9 tests covering API round-trip,
  empty/whitespace defaults, login page rendering, and XSS escaping

2026-04-06 15:06:16 +00:00

..

__init__.py

Hermes WebUI v0.1.0 — initial public release

2026-03-30 20:40:19 -07:00

conftest.py

fix: auto-skip agent-dependent tests when hermes-agent not installed (#86)

2026-04-04 14:51:15 -07:00

test_model_resolver.py

fix: OpenRouter models stripped of prefix, causing 404 (#116)

2026-04-05 13:58:37 -07:00

test_regressions.py

fix: stop leaking stack traces to clients in HTTP 500 responses

2026-04-03 06:41:32 -07:00

test_sprint1.py

Hermes Web UI — Sprints 11-14: multi-provider models, settings, session QoL, alerts, polish

2026-03-31 07:02:47 +00:00

test_sprint2.py

Hermes WebUI v0.1.0 — initial public release

2026-03-30 20:40:19 -07:00

test_sprint3.py

Hermes WebUI v0.1.0 — initial public release

2026-03-30 20:40:19 -07:00

test_sprint4.py

Hermes WebUI v0.1.0 — initial public release

2026-03-30 20:40:19 -07:00

test_sprint5.py

Hermes WebUI v0.1.0 — initial public release

2026-03-30 20:40:19 -07:00

test_sprint6.py

Hermes WebUI v0.1.0 — initial public release

2026-03-30 20:40:19 -07:00

test_sprint7.py

Hermes WebUI v0.1.0 — initial public release

2026-03-30 20:40:19 -07:00

test_sprint8.py

Hermes WebUI v0.1.0 — initial public release

2026-03-30 20:40:19 -07:00

test_sprint9.py

Hermes WebUI v0.1.0 — initial public release

2026-03-30 20:40:19 -07:00

test_sprint10.py

Hermes WebUI v0.1.0 — initial public release

2026-03-30 20:40:19 -07:00

test_sprint11.py

Hermes Web UI — Sprints 11-14: multi-provider models, settings, session QoL, alerts, polish

2026-03-31 07:02:47 +00:00

test_sprint12.py

Hermes Web UI — Sprints 11-14: multi-provider models, settings, session QoL, alerts, polish

2026-03-31 07:02:47 +00:00

test_sprint13.py

Hermes Web UI — Sprints 11-14: multi-provider models, settings, session QoL, alerts, polish

2026-03-31 07:02:47 +00:00

test_sprint14.py

Hermes Web UI — Sprints 11-14: multi-provider models, settings, session QoL, alerts, polish

2026-03-31 07:02:47 +00:00

test_sprint15.py

feat: Sprint 15 — session projects, code copy button, tool card toggle

2026-04-02 00:11:49 -07:00

test_sprint16.py

feat: safe HTML rendering in AI responses + active session gold style + Sprint 16 tests

2026-04-03 00:27:43 +00:00

test_sprint17.py

feat: Sprint 17 -- workspace breadcrumbs, slash commands, send key setting

2026-04-03 04:13:38 -07:00

test_sprint19.py

fix(auth): harden password_hash handling in settings API

2026-04-03 06:21:04 -07:00

test_sprint20.py

fix: mic appends to existing textarea text instead of replacing it

2026-04-03 14:13:29 +00:00

test_sprint20b.py

fix: test_send_pop_in keyframe parser hit wrong @keyframes block

2026-04-03 14:23:56 +00:00

test_sprint23.py

fix: test hardening for sprint 23 — handle missing cron/skills modules in test env

2026-04-03 19:16:17 -07:00

test_sprint26.py

fix: settings unsaved-changes guard, add Slate theme, improve Light theme

2026-04-05 04:00:24 +00:00

test_sprint27.py

fix: harden bot_name — crash guard, XSS escape, sanitization, tests

2026-04-06 15:06:16 +00:00