Sabo/webui
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
b86ace6ce3b5ad5677eeb17bbe2be2f44fcfef54
webui/ROADMAP.md
nesquena-hermes b86ace6ce3 v0.47.0: dialogs, session menu, /skills, mobile fixes, mobile QA suite 
* fix: custom provider with slash model name no longer rerouted to OpenRouter (#255)

When base_url is configured in config.yaml, resolve_model_provider() now
trusts the configured provider/base_url entirely and skips the slash-based
OpenRouter heuristic. Fixes google/gemma-4-26b-a4b with provider:custom
being silently routed to OpenRouter, resulting in 401 errors.

Fixes #230

* test: mobile layout regression suite — 14 tests for every QA run (#254)

Adds tests/test_mobile_layout.py with 14 static regression tests that run
on every QA pass to catch mobile layout breakage before it reaches prod.
Covers: breakpoints at 900px/640px, right panel slide-over CSS, mobile
overlay, bottom nav, files button, profile dropdown z-index, chip overflow,
workspace close, 100dvh, 44px touch targets, 16px font-size on textarea.

* feat: /skills slash command lists and filters available Hermes skills (#257)

Adds /skills [query] command to commands.js. Fetches from /api/skills,
groups by category (alphabetically sorted), displays as a formatted
assistant message. Optional query filters by name, description, or category.
i18n keys added for en, de, zh, zh-Hant. 1 regression test added.

Fixes #248

* feat: shared app dialogs replace native confirm()/prompt() calls (#251)

Adds showConfirmDialog() and showPromptDialog() helpers to ui.js, backed
by a themed #appDialogOverlay. Replaces all 11 native browser confirm/prompt
call sites across panels.js, sessions.js, ui.js, workspace.js.

Supports: danger mode, keyboard focus trap (Tab/Escape/Enter), focus restore,
ARIA roles, mobile-responsive stacked buttons at 640px. i18n for en/de/zh/zh-Hant.
5 new tests in test_sprint33.py verify markup, CSS, helpers, and absence of
native dialog calls.

Extracted from PR #242.

* fix: Android Chrome mobile — workspace panel close + profile dropdown (#256)

Fix #247: toggleMobileFiles() now shows/hides the mobile overlay when
toggling the right workspace panel. New closeMobileFiles() helper closes
the panel with correct overlay state tracking. Overlay onclick calls both
closeMobileSidebar() and closeMobileFiles(). Mobile-only close button (x)
added to workspace panel header.

Fix #246: profile dropdown uses position:fixed;top:56px;right:8px at
max-width:900px, escaping the overflow-x:auto stacking context that was
clipping it on Android Chrome.

Fix applied during review: closeMobileSidebar() now checks if the right
panel is still open before hiding the overlay, preventing the overlay from
disappearing when only the sidebar is closed.

Fixes #247 Fixes #246

* feat: session ⋯ action dropdown replaces per-row buttons (#252)

Replaces the 5 per-row hover action buttons (pin/move/archive/duplicate/trash)
with a single ⋯ trigger that opens a positioned dropdown menu. Menu has full
keyboard (Escape), click-outside, scroll, and resize-reposition handling.
Position:fixed prevents sidebar clipping.

5 actions: Pin/Unpin, Move to project, Archive/Unarchive, Duplicate, Delete
(danger style). Each with icon and descriptive subtitle.

Updated test_sprint16.py: test_sessions_js_uses_action_menu_not_per_row_buttons
asserts the new trigger and menu functions exist, old per-row classes are gone.

Extracted from PR #242.

* docs: v0.47.0 release notes, bump version, update test counts (645)

---------

Co-authored-by: Nathan Esquenazi <nesquena@gmail.com>
2026-04-11 12:19:12 -07:00

19 KiB
Raw Blame History

Hermes Web UI: Full Parity Roadmap

Goal: Full 1:1 parity with the Hermes CLI experience via a clean dark web UI. Everything you can do from the CLI terminal, you can do from this UI.

Last updated: v0.47.0 (April 11, 2026) — 645 tests, 645 passing Tests: 604 total (604 passing, 0 failures) Source: /

Sprint History (Completed)

Sprint Theme Highlights Tests
Sprint 1 Bug fixes + foundations B1-B11 fixed, LOCK on SESSIONS, section headers, request logging 19
Sprint 2 Rich file preview Image preview, rendered markdown, table support, smart icons 27
Sprint 3 Panel nav + viewers Sidebar tabs, cron/skills/memory panels, B6/B10/B14, Phase D start 48
Sprint 4 Relocation + power features Source to /, CSS extracted, session rename/search, file ops 68
Sprint 5 Phase A complete + workspace JS extracted (server.py 1778->1042 lines), workspace management, copy message, file editor, session index 86
Test hardening Isolated test environment Port 8788 test server, conftest autouse, cleanup_zero_message, 5 test files rewritten 90
Sprint 6 Polish + Phase E complete HTML to static/, resizable panels, cron create, session JSON export, Escape from editor 106
Sprint 7 Wave 2 Core: CRUD + Search Cron edit/delete, skill create/edit/delete, memory write, session content search, health improvements, git init 125
Sprint 8 Daily Driver Finish Line Edit+regenerate user messages, regenerate last response, clear conversation, Prism.js syntax highlighting, reconnect banner fix, session list scroll fix 139
Sprint 8 hotfix Message queue + INFLIGHT fix Queue messages while busy (toast + badge + auto-drain), INFLIGHT-first loadSession (message stays on switch-away/back) 139
Sprint 9 Codebase health + daily driver gaps app.js deleted and replaced by 6 modules, tool call cards inline, attachment persistence on reload, todo list panel 149
Sprint 10 Server health + operational polish server.py split into api/ modules, background task cancel, cron run history viewer, tool card UX polish 167
Sprint 10 fixes Import regressions + regression tests uuid, AIAgent, has_pending, SSE cancel loop, Session.init tool_calls; test_regressions.py 177
Concurrency sweeps Multi-session correctness Approval cross-session (R10), activity bar per-session (R11), live cards on switch-back (R12), tool cards after done (R13), session model authoritative (R14), newSession cards (R15) 190
Sprint 11 Multi-provider models + streaming Dynamic model dropdown (any Hermes provider), smooth scroll pinning, routes extracted to api/routes.py (server.py 704→76 lines) 201
Sprint 12 Settings + reliability + session QoL Settings panel (gear icon, settings.json), SSE auto-reconnect, pin sessions, import session from JSON 211
Sprint 13 Alerts + polish Cron completion alerts (polling + badge), background error banner, session duplicate, browser tab title 221
Sprint 14 Visual polish + workspace ops Mermaid diagrams, message timestamps, file rename, folder create, session tags, session archive 233
Sprint 15 Session projects + code copy Session projects/folders, code block copy button, tool card expand/collapse toggle 237
Sprint 16 Session sidebar visual polish SVG action icons, overlay hover actions, pin indicator, project border, safe HTML rendering 289
Sprint 17 Workspace polish + slash commands + settings Breadcrumb navigation, slash command autocomplete, send key setting (#26) 318
Sprint 18 Thinking display + workspace tree File preview auto-close, thinking/reasoning cards, expandable directory tree (#22) 318
Sprint 19 Auth + security hardening Password auth (off by default), login page, security headers, 20MB body limit (#23) 328
Sprint 20 Voice input + send button Voice input (Web Speech API), send button icon-circle with pop-in animation 415
Sprint 21 Mobile responsive + Docker Hamburger sidebar, bottom nav, files slide-over, Docker support (#21, #7) 415
Sprint 22 Multi-profile support Profile picker, management panel, seamless switching, per-session tracking (#28) 415
Sprint 23 Agentic transparency Token/cost display, subagent cards, skill picker in cron, skill linked files, workspace tree persistence, timestamp fixes 424
v0.44.0 patch Fix batch: approval card, login CSP, update diagnostics, Lucide icons PRs #221 #225 #226 #227 #228 579
v0.45.0 Custom endpoint in new profile form Base URL + API key fields; server-side URL validation; config.yaml merge; 9 new tests (PR #233, fixes #170) 604
v0.46.0 Security, Docker UID/GID, model discovery, i18n, cancel fix Credential redaction in API responses (PR #243); Docker UID/GID matching (PR #237); custom model API key discovery (PR #238); HTML entity decode + zh/zh-Hant i18n (PR #239); cancel interrupts agent (PR #244); +20 tests 624
v0.47.0 Dialogs, session menu, skills command, mobile fixes, mobile QA Shared app dialogs (#251); session ⋯ menu (#252); mobile QA suite (#254); custom provider slash routing fix (#255); Android Chrome mobile fixes (#256); /skills command (#257); +21 tests 645
v0.32 Auto-compaction handling Compression detection, /compact command, real context window indicator 424
v0.33 /insights sync Opt-in state.db sync so hermes /insights includes WebUI sessions 424
v0.34 Sprint 26 — Pluggable themes Dark, Light, Slate, Solarized, Monokai, Nord; settings unsaved-changes guard; /theme command 433
v0.34.1 Theme variable polish 30+ hardcoded dark-navy colors replaced with theme-aware CSS variables 433
v0.34.2 Theme text colors 5 new per-theme typography variables (--strong, --em, --code-text, --code-inline-bg, --pre-text) 433
v0.34.3 Light theme final polish 46 light-scoped selector overrides for sidebar, roles, chips, interactive elements 433
v0.35 Security hardening Env race fix, random signing key, upload path traversal, PBKDF2 password hash 433
v0.36–v0.37 Model routing, personality config, tool card reload, duplicate model fixes Model routing by provider prefix, personality via config.yaml, tool cards reload on page refresh 466
v0.38.0–v0.38.6 Model selector, custom endpoints, OLED theme, reasoning display, insights sync Custom endpoint URL fix, OLED theme, top-level reasoning field fix, message_count sync to state.db 466
v0.39.0 Security hardening (Sprint 29) CSRF, PBKDF2, rate limiting, session ID validation, SSRF, ENV_LOCK, XSS, HMAC, skills traversal, secure cookie, error sanitization, startup warning 499

Current Architecture Status

Layer Location Status
Python server /server.py (~81 lines) + api/ modules (~3210 lines) Thin shell + auth middleware + business logic in api/
HTML template /static/index.html (~364 lines) Served from disk
CSS /static/style.css (~670 lines) Served from disk, incl. mobile responsive
JavaScript /static/{ui,workspace,sessions,messages,panels,boot,commands}.js 7 modules, ~3610 lines total
Docker Dockerfile, docker-compose.yml, .dockerignore python:3.12-slim, multi-arch (amd64+arm64)
CI/CD .github/workflows/release.yml Auto-release + GHCR publish on tag push
Runtime state ~/.hermes/webui-mvp/sessions/ Session JSON files
Test server Port 8788, state dir ~/.hermes/webui-mvp-test/ Isolated, wiped per run
Production server Port 8787 SSH tunnel from Mac

Feature Parity Checklist

Chat and Agent

  • Send messages, get SSE-streaming responses
  • Switch models per session (10 models, grouped by provider)
  • Multi-provider API support: use any Hermes agent API provider (OpenAI, Anthropic, Google, etc.) directly, not just OpenRouter (Sprint 11)
  • Custom endpoint model discovery: auto-detect models from Ollama, LM Studio, and other local LLM servers via base_url (PR #18)
  • Upload files to workspace (drag-drop, click, clipboard paste)
  • File tray with remove button
  • Tool progress shown in activity bar above composer
  • Approval card for dangerous commands (Allow once/session/always, Deny)
  • Approval polling + SSE-pushed approval events
  • INFLIGHT guard: switch sessions mid-request without losing response
  • Session restores from localStorage on page load
  • Reconnect banner if page reloaded mid-stream
  • Copy message to clipboard (hover icon on each bubble)
  • Edit last user message and regenerate
  • Branch/fork conversation (Wave 3)
  • Token/cost estimate per message (Sprint 23)

Tool Visibility

  • Tool progress in activity bar (moved out of composer footer)
  • Approval card with all 4 choices
  • Tool call cards inline (collapsed, show name/args/result)

Workspace / Files

  • Browse workspace directory tree with type icons
  • Preview text/code files (read-only)
  • Preview markdown files (rendered, tables supported)
  • Preview image files (PNG, JPG, GIF, SVG, WEBP inline)
  • Edit files inline (Edit button, Enter to save, Escape to cancel)
  • Create new file (+ button in panel header)
  • Delete file (hover trash, confirm dialog)
  • File name truncation with tooltip for long names
  • Right panel resizable (drag inner edge)
  • Syntax highlighted code preview (Prism.js)
  • Rename file (Sprint 14)
  • Create folder (Sprint 14)

Sessions

  • Create session (+ button or Cmd/Ctrl+K)
  • Load session (click in sidebar)
  • Delete session (hover trash, toast, correct fallback)
  • Auto-title from first user message
  • Rename session title (double-click in sidebar, Enter saves, Escape cancels)
  • Filter/search sessions by title (live filter box)
  • Date group headers (Today / Yesterday / Earlier)
  • Download session as Markdown transcript
  • Export session as JSON (full messages + metadata)
  • Session inherits last-used workspace on creation
  • Session content search (search message text across sessions)
  • Session tags / labels (Sprint 14)
  • Archive sessions (Sprint 14)
  • Clear conversation (wipe messages, keep session) (Wave 3)
  • Import session from JSON (Sprint 12)
  • Pin/star sessions to top of list (Sprint 12)
  • Duplicate session (Sprint 13)
  • Session projects / folders (Sprint 15)

Workspace Management

  • Add workspace with path validation (must be existing directory)
  • Remove workspace
  • Rename workspace display name
  • Quick-switch workspace from topbar dropdown
  • Sidebar live workspace display (name + path, updates in real time)
  • New sessions inherit last used workspace
  • Workspace list persists to workspaces.json
  • Workspace reorder (drag) (Wave 2)

Scheduled Tasks (Cron)

  • View all cron jobs (Tasks sidebar tab)
  • View last run output per job (auto-loaded on expand)
  • Expand job to see prompt, schedule, last output
  • Run job manually (Run now button)
  • Pause / Resume job
  • Create cron job from UI (+ New job form with name, schedule, prompt, delivery)
  • Edit existing cron job
  • Delete cron job
  • View full cron run history (expandable per job)
  • Skill picker in cron create form (Sprint 23)

Skills

  • List all skills grouped by category (Skills sidebar tab)
  • Search/filter skills by name, description, category
  • View full SKILL.md content in right preview panel
  • Create skill
  • Edit skill
  • Delete skill
  • View skill linked files (Sprint 23)

Memory

  • View personal notes (MEMORY.md) rendered as markdown (Memory tab)
  • View user profile (USER.md) rendered as markdown (Memory tab)
  • Last-modified timestamp on each section
  • Add/edit memory entry inline

Configuration

  • Settings panel (default model, default workspace) (Sprint 12)
  • Send key preference (Enter or Ctrl+Enter) (Sprint 17)
  • Password authentication (Sprint 19)
  • Enable/disable toolsets per session (deferred)

Notifications

  • Cron job completion alerts (Sprint 13)
  • Background agent error alerts (Sprint 13)

Workspace

  • Breadcrumb navigation in subdirectories (Sprint 17)
  • Workspace tree view with expand/collapse (Sprint 18, Issue #22)
  • File preview auto-close on directory navigation (Sprint 18)

Slash Commands

  • Command registry + autocomplete dropdown (Sprint 17)
  • Built-in: /help, /clear, /model, /workspace, /new (Sprint 17)

Security

  • Password auth with signed cookies (Sprint 19, Issue #23)
  • Security headers (X-Content-Type-Options, X-Frame-Options) (Sprint 19)
  • POST body size limit (20MB) (Sprint 19)

Thinking / Reasoning

  • Collapsible thinking cards for extended-thinking models (Sprint 18)

Voice

  • Voice input via Web Speech API (Sprint 20)

Mobile

  • Mobile responsive layout — hamburger sidebar, bottom nav, files slide-over (Sprint 21)

Profiles

  • Multi-profile support — create, switch, delete profiles (Sprint 22, Issue #28)

Advanced / Future

  • Subagent session tree -- show subagent hierarchy in sidebar with expand/collapse (PR #75)
  • Specialized tool card renderers -- diff viewer, terminal output, todo checklist views (PR #75)
  • Streaming performance -- rAF-throttled token rendering (Sprint 24, PR #81)
  • Workspace git detection -- branch name and dirty status badge (Sprint 24, PR #82)
  • Collapsible date groups -- click group headers to collapse (Sprint 24, PR #80)
  • Context usage indicator -- token count and cost in composer footer (Sprint 24, PR #83)
  • LLM-generated session titles -- auto-title via small model instead of first-message substring (PR #75)
  • Workspace git detection -- show branch name, dirty status in workspace header (PR #75)
  • Clarify dialog -- agent can ask clarifying questions that block until user responds (PR #75)
  • Gateway approval polling -- support blocking approvals from messaging gateway (PR #75)
  • Unified session storage -- SessionDB shared between webui and CLI (PR #75)
  • TTS playback of responses (deferred)
  • Background task cancel (activity bar Cancel button)
  • Code execution cell (deferred)
  • Desktop application (Sprint 25, PLANNED)
  • Pluggable UI themes -- Dark, Light, Slate, Solarized, Monokai, Nord (Sprint 26, v0.34)
  • Extended slash command / skill integration (deferred)
  • Virtual scroll for large lists (deferred)

Sprint 7: Wave 2 Core -- Cron/Skill/Memory CRUD + Session Content Search (COMPLETED)

Theme: "Wave 2 Core -- Cron/Skill/Memory CRUD + Session Content Search"

Track A: Bug Fixes

Item Description
Activity bar sizing Activity bar sometimes overlaps first message on short viewports
Model dropdown sync Model chip in topbar sometimes shows stale model after session switch
Cron output truncation Long cron output in the tasks panel overflows its container

Track B: Features

Feature What Value
Session content search Search message text across all sessions, not just titles. GET /api/sessions/search already does title search; extend to message content with a configurable depth limit High: the single most-requested nav feature after rename
Cron edit + delete Edit an existing cron job (name, schedule, prompt, delivery) inline in the tasks panel. Delete with confirm. POST /api/crons/update and /api/crons/delete High: closes the cron CRUD gap (create was Sprint 6)
Skill create + edit A "New skill" form in the Skills panel. Name, category, SKILL.md content in a textarea editor. Save calls POST /api/skills/save (writes to ~/.hermes/skills/). Edit opens existing skill in the same editor High: biggest remaining CLI gap after cron

Track C: Architecture

Item What
Phase E: app.js module split (start) Split app.js (1332 lines) into logical modules: sessions.js, chat.js, workspace.js, panels.js, ui.js. Serve via ES module imports in index.html. This is Phase E completion.
Health endpoint improvement Add active_streams, uptime_seconds to /health response (Phase G)
Git init git init , first commit, push to private GitHub repo

Tests

  • ~20 new pytest tests (cron update/delete, skill save, session content search)
  • TESTING.md: Sections 29-31 (cron edit, skill edit, session search)
  • Estimated total after Sprint 7: ~126

Wave 2: Full CRUD and Interaction Parity

Status: In progress. Sprint 6 completed cron create and workspace management. Remaining Wave 2 items targeted for Sprints 7-8.

Sprint 2.0: Workspace Management (COMPLETE Sprint 5+6)

All workspace features delivered: add/validate/remove/rename workspaces, topbar quick-switch, sidebar live display, new sessions inherit last workspace. See Sprint 5 completed section.

Sprint 2.1: Cron Job Management (Partial -- Sprint 7 for remaining)

  • View all jobs (Sprint 3)
  • Run / pause / resume (Sprint 3)
  • Create job from UI (Sprint 6)
  • Edit job
  • Delete job
  • Full cron run history

Sprint 2.2: Skill Management (Partial -- Sprint 7 for remaining)

  • List all skills with categories (Sprint 3)
  • View SKILL.md content (Sprint 3)
  • Create skill
  • Edit skill
  • Delete skill

Sprint 2.3: Memory Write (Sprint 7)

  • View notes + profile (Sprint 3)
  • Edit notes inline

Sprint 2.4: Todo Management (Wave 2)

  • View current todo list (sidebar Todo panel, parsed from session history)

Sprint 2.5: Session Content Search (Sprint 7)

  • Session title search (Sprint 4)
  • Message content search across sessions

Sprint 2.6: Session Rename (COMPLETE Sprint 4)

Double-click any session title in the left sidebar to edit inline. Enter saves, Escape cancels. Topbar updates immediately.

Completed Waves (Summary)

Wave Theme Key Deliverables
Wave 2 Full CRUD + Interaction Cron/skill/memory CRUD, session search, workspace management, session rename
Wave 3 Power Features Tool call cards, multi-model dropdown, resizable panels, file actions, conversation controls
Wave 4 Settings + Notifications Settings panel, cron alerts, background error banner
Wave 5 Session Continuity Session tags, archive, projects/folders
Wave 6 Agentic Features Background task cancel, voice input (Web Speech API)
Wave 7 Production Hardening Password auth, security headers, mobile responsive, Docker + GHCR CI

User Requested Features

Community-requested enhancements tracked from GitHub issues. All shipped.

Feature Issue Shipped Sprint
Workspace tree view #22 Done Sprint 18
Docker container + GHCR images #7 Done Sprint 21 + v0.28.1 CI
Authentication #23 Done Sprint 19
Send key / personalization #26 Done Sprint 17
Multi-profile support #28 Done Sprint 22
Mobile responsive UI #21 Done Sprint 21
Profile creation in Docker #44 Done v0.27
Reference in New Issue View Git Blame Copy Permalink