Rename the raw pre stash variable so static substring checks for _pre_stash continue to target the intended code-block stash section.

Made-with: Cursor

… model (#1169)

When a user has a provider-specific model configured (e.g. Kimi K2 via Nous)
that isn't in the static model list, syncTopbar() fires a setTimeout callback
that finds the model absent from the dropdown and persists the wrong fallback
model (first static option, e.g. Opus 4.6) to disk — before _fetchLiveModels()
returns. This corrupts the session on every load.

Fix has two parts:
1. Track _liveModelFetchPending per provider. While a live fetch is in flight,
   syncTopbar()'s 'model not found' branch skips both the sel.value override
   and the /api/session/update persist call entirely.
2. In _addLiveModelsToSelect(), after inserting new models, re-apply
   S.session.model if it is now resolvable in the updated dropdown. This
   restores the correct model even if syncTopbar() already ran.

Closes #1169

…1170)

Two separate bugs prevented users from reading tool output:

1. JS truncation at 220 chars was too aggressive — stack traces and file paths
   are regularly cut mid-line. Raised to 800 chars so most outputs display
   in full without needing 'Show more'.

2. .tool-card-detail had overflow:hidden in both closed and open states.
   While required for the max-height CSS transition animation when closed,
   overflow:hidden on the parent clips the inner <pre>'s scroll — the
   pre had overflow-y:auto but could never actually scroll. Fixed by
   adding overflow:auto on .tool-card.open .tool-card-detail.

Also raised the inner pre max-height from 180px → 360px and the card cap
from 520px → 600px to give long tool outputs more room.

Test updated to match the new max-height values and assert overflow:auto
on the open card state.

Closes #1170

…lready empty (#1171)

Clicking 'New Conversation' or pressing Cmd+K repeatedly when the current
session has zero messages created N empty 'Untitled' sessions that piled up
in the sidebar list until the 60-second cleanup filter hid them.

Added a message_count guard to both the btnNewChat onclick handler and the
Cmd+K keydown handler: if the current session is already empty, just focus
the composer and return rather than POSTing /api/session/new again.

Test updated to match the now multi-line btnNewChat handler and the extended
shortcut block slice.

Closes #1171

…am writes

Two-part fix for the race condition where WebUI onboarding corrupts
the shared .env file, breaking CLI/Telegram integrations:

Cause 1 — Missing lock on onboarding's _write_env_file:
  onboarding.py had a duplicate _write_env_file() without _ENV_LOCK,
  while providers.py's version held the lock. Concurrent writes from
  the WebUI (onboarding flow) and the Telegram bot could corrupt the
  shared ~/.hermes/.env file, causing API keys to vanish.

  Fix: Remove the duplicate from onboarding.py and import the locked
  version from providers.py. All monkey-patching tests continue to
  work since the name api.onboarding._write_env_file is preserved.

Cause 2 — _write_env_file destroyed comments and reordered keys:
  Both _write_env_file copies loaded the .env into a dict (dropping
  comments/blank lines) and rewrote it sorted alphabetically. This
  meant any comments in the user's .env were silently lost on every
  WebUI config save.

  Fix: Refactored providers._write_env_file to preserve comments, blank
  lines, and original key order. Updates happen in-place on existing
  lines; new keys are appended with a blank-line separator; deleted
  keys are removed cleanly.

Includes 8 tests: comment preservation, blank lines, key order, key
removal, empty file, import verification, and lock presence check.