Fix: Prevent AuthManager state pollution on connection verification (#348)

* Fix: Prevent AuthManager state pollution on connection verification

Modified `ConnectViewModel.connect()` to construct a temporary OkHttpClient and Retrofit builder, isolated from the global `ApiClient` state. The connection verification is executed using this temporary service. Only upon a successful HTTP response does the system persist the configured `host`, `port`, and `token` to the global `AuthManager` and triggers an `ApiClient.rebuild()`. This resolves the issue where a failed connection attempt would overwrite active and verified profiles. Extracted `createTempService` factory to `ApiClient` for robustness and clean tests.

Fixes #260

* Fix: Prevent AuthManager state pollution on connection verification

Modified `ConnectViewModel.connect()` to construct a temporary OkHttpClient and Retrofit builder, isolated from the global `ApiClient` state. The connection verification is executed using this temporary service. Only upon a successful HTTP response does the system persist the configured `host`, `port`, and `token` to the global `AuthManager` and triggers an `ApiClient.rebuild()`. This resolves the issue where a failed connection attempt would overwrite active and verified profiles. Extracted `createTempService` factory to `ApiClient` for robustness and clean tests.

Fixes #260

---------

Co-authored-by: M57 <hy4ri@users.noreply.github.com>

.github/workflows/android.yml

@@ -191,40 +191,7 @@ jobs:
           retention-days: 7
 
   # ─────────────────────────────────────────────────────────────────────
-  # Job 5: Release Compile — verifies release variant compiles.
-  # Catches issues like debugImplementation-scoped dependencies that
-  # main source code depends on (e.g. okhttp3.logging.HttpLoggingInterceptor).
-  # debug-only CI jobs (ktlint, lint, tests) won't catch these.
-  # ─────────────────────────────────────────────────────────────────────
-  release-compile:
-    name: Release Compile Check
-    needs: [ktlint, android-lint, unit-tests]
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-
-      - name: Set up JDK 17
-        uses: actions/setup-java@v5
-        with:
-          distribution: temurin
-          java-version: '17'
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
-        with:
-          validate-wrappers: true
-          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTED_KEY }}
-
-      - name: Grant Execute Permission for Gradlew
-        run: chmod +x gradlew
-
-      - name: Compile release Kotlin
-        run: ./gradlew compileReleaseKotlin
-
-  # ─────────────────────────────────────────────────────────────────────
-  # Job 6: Instrumented tests — runs on Android emulator.
+  # Job 5: Instrumented tests — runs on Android emulator.
   # Required for Compose UI tests (TEST-09, TEST-14) and Navigation3 tests
   # that need a real Activity lifecycle. Cannot run on JVM.
   # ─────────────────────────────────────────────────────────────────────
@@ -289,11 +256,11 @@ jobs:
           retention-days: 7
 
   # ─────────────────────────────────────────────────────────────────────
-  # Job 7: PR status summary — aggregates all checks.
+  # Job 6: PR status summary — aggregates all checks.
   # ─────────────────────────────────────────────────────────────────────
   ci-summary:
     name: CI Summary
-    needs: [ktlint, android-lint, unit-tests, build, release-compile]
+    needs: [ktlint, android-lint, unit-tests, build]
     runs-on: ubuntu-latest
     timeout-minutes: 2
     if: always()
@@ -304,10 +271,9 @@ jobs:
           LINT_RESULT: ${{ needs.android-lint.result }}
           TEST_RESULT: ${{ needs.unit-tests.result }}
           BUILD_RESULT: ${{ needs.build.result }}
-          RELEASE_COMPILE_RESULT: ${{ needs.release-compile.result }}
         run: |
           FAILED=0
-          for entry in "ktlint:$KTLINT_RESULT" "android-lint:$LINT_RESULT" "unit-tests:$TEST_RESULT" "build:$BUILD_RESULT" "release-compile:$RELEASE_COMPILE_RESULT"; do
+          for entry in "ktlint:$KTLINT_RESULT" "android-lint:$LINT_RESULT" "unit-tests:$TEST_RESULT" "build:$BUILD_RESULT"; do
             name="${entry%%:*}"
             result="${entry#*:}"
             echo "::notice::$name = $result"

.github/workflows/merge-conflict-label.yml

@@ -1,56 +0,0 @@
-name: Label PR merge conflicts
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
-
-jobs:
-  label-conflict:
-    runs-on: ubuntu-latest
-    permissions:
-      pull-requests: write
-      contents: read
-    steps:
-      - name: Get PR data and label conflicts
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const pr = context.payload.pull_request;
-            const prNumber = pr.number;
-            const repo = context.repo;
-
-            // Fetch PR details to get mergeable_state
-            const { data: prData } = await github.rest.pulls.get({
-              ...repo,
-              pull_number: prNumber
-            });
-
-            const mergeableState = prData.mergeable_state; // clean, dirty, blocked, unstable
-            const hasConflict = mergeableState === 'dirty';
-
-            const labelName = 'merge-conflict';
-
-            // Get current labels
-            const { data: labels } = await github.rest.issues.listLabelsOnIssue({
-              ...repo,
-              issue_number: prNumber
-            });
-            const hasLabel = labels.some(l => l.name === labelName);
-
-            if (hasConflict && !hasLabel) {
-              console.log(`PR #${prNumber} has merge conflicts. Adding label '${labelName}'.`);
-              await github.rest.issues.addLabels({
-                ...repo,
-                issue_number: prNumber,
-                labels: [labelName]
-              });
-            } else if (!hasConflict && hasLabel) {
-              console.log(`PR #${prNumber} no longer has merge conflicts. Removing label '${labelName}'.`);
-              await github.rest.issues.removeLabel({
-                ...repo,
-                issue_number: prNumber,
-                name: labelName
-              });
-            } else {
-              console.log(`PR #${prNumber}: conflict=${hasConflict}, label=${hasLabel}. No change needed.`);
-            }

AGENTS.md

@@ -42,7 +42,6 @@ find app/src -name '*.kt' | xargs ./ktlint --format   # fix all
 | `android-lint` | Android Lint |
 | `unit-tests` | JUnit |
 | `build` | assembleDebug (gated by the 3 above) |
-| `release-compile` | compileReleaseKotlin — catches release-variant compilation issues (e.g. debugImplementation-scoped deps referenced in main source) |
 | `ci-summary` | Aggregator (`if: always()`) — branch protection gates on THIS check |
 
 Every Gradle job validates `gradle-wrapper.jar` and uses the remote build cache
@@ -146,12 +145,6 @@ gh pr create --title "fix(#N): description" --body "Closes #N"
   `val` at the composable scope first.
 - Don't add new screens without checking if an existing one already covers the
   functionality (19+ screens exist). Extend rather than duplicate.
-- **⚠ Never scope a dependency to `debugImplementation` if its import is used in
-  `main/` source code.** The CI `release-compile` job catches this, but save the
-  cycle. `okhttp3.logging.HttpLoggingInterceptor` is the classic example — it's
-  imported in `ApiClient.kt` (main source) so it must be `implementation`, not
-  `debugImplementation`. If you want it debug-only, wrap the usage in
-  `if (BuildConfig.DEBUG)` or extract it behind an interface.
 
 ## Project Layout
 

app/build.gradle.kts

@@ -41,21 +41,15 @@ android {
                 val alias = System.getenv("KEY_ALIAS")
                 val keyPass = System.getenv("KEY_PASSWORD")
 
-                if (storePath != null && storePass != null && alias != null && keyPass != null) {
-                    storeFile = file(storePath)
-                    storePassword = storePass
-                    keyAlias = alias
-                    keyPassword = keyPass
-                } else {
-                    // Env vars missing — signing deferred to release workflow.
-                    // Don't hard-require(): that would break compileReleaseKotlin
-                    // in CI where keystore secrets aren't set.
-                    logger.warn("Release signing config missing env vars — signing deferred to release workflow")
-                    storeFile = file("dummy.keystore")
-                    storePassword = "dummy"
-                    keyAlias = "dummy"
-                    keyPassword = "dummy"
-                }
+                require(!storePath.isNullOrEmpty()) { "KEYSTORE_PATH environment variable is not set" }
+                require(!storePass.isNullOrEmpty()) { "KEYSTORE_PASSWORD environment variable is not set" }
+                require(!alias.isNullOrEmpty()) { "KEY_ALIAS environment variable is not set" }
+                require(!keyPass.isNullOrEmpty()) { "KEY_PASSWORD environment variable is not set" }
+
+                storeFile = file(storePath)
+                storePassword = storePass
+                keyAlias = alias
+                keyPassword = keyPass
             } else {
                 // Dummy values for evaluation configuration during non-release builds
                 storeFile = file("dummy.keystore")
@@ -134,7 +128,7 @@ dependencies {
 
     // Networking
     implementation(libs.okhttp)
-    implementation(libs.okhttp.logging)
+    debugImplementation(libs.okhttp.logging)
     implementation(libs.retrofit)
     implementation(libs.retrofit.converter.gson)
     implementation(libs.gson)

app/schemas/com.m57.hermescontrol.data.local.HermesDatabase/2.json

@@ -1,83 +0,0 @@
-{
-  "formatVersion": 1,
-  "database": {
-    "version": 2,
-    "identityHash": "b0a33c5fd32118982236698f395f519b",
-    "entities": [
-      {
-        "tableName": "chat_messages",
-        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`id` TEXT NOT NULL, `session_id` TEXT NOT NULL, `role` TEXT NOT NULL, `content` TEXT NOT NULL, `timestamp` INTEGER NOT NULL, `tool_name` TEXT, `tool_status` TEXT, `is_streaming` INTEGER NOT NULL, PRIMARY KEY(`id`))",
-        "fields": [
-          {
-            "fieldPath": "id",
-            "columnName": "id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "sessionId",
-            "columnName": "session_id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "role",
-            "columnName": "role",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "content",
-            "columnName": "content",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "timestamp",
-            "columnName": "timestamp",
-            "affinity": "INTEGER",
-            "notNull": true
-          },
-          {
-            "fieldPath": "toolName",
-            "columnName": "tool_name",
-            "affinity": "TEXT"
-          },
-          {
-            "fieldPath": "toolStatus",
-            "columnName": "tool_status",
-            "affinity": "TEXT"
-          },
-          {
-            "fieldPath": "isStreaming",
-            "columnName": "is_streaming",
-            "affinity": "INTEGER",
-            "notNull": true
-          }
-        ],
-        "primaryKey": {
-          "autoGenerate": false,
-          "columnNames": [
-            "id"
-          ]
-        },
-        "indices": [
-          {
-            "name": "index_chat_messages_session_id_timestamp",
-            "unique": false,
-            "columnNames": [
-              "session_id",
-              "timestamp"
-            ],
-            "orders": [],
-            "createSql": "CREATE INDEX IF NOT EXISTS `index_chat_messages_session_id_timestamp` ON `${TABLE_NAME}` (`session_id`, `timestamp`)"
-          }
-        ]
-      }
-    ],
-    "setupQueries": [
-      "CREATE TABLE IF NOT EXISTS room_master_table (id INTEGER PRIMARY KEY,identity_hash TEXT)",
-      "INSERT OR REPLACE INTO room_master_table (id,identity_hash) VALUES(42, 'b0a33c5fd32118982236698f395f519b')"
-    ]
-  }
-}

app/src/main/AndroidManifest.xml

@@ -10,8 +10,6 @@
     <application
         android:name=".HermesControlApp"
         android:allowBackup="true"
-        android:dataExtractionRules="@xml/data_extraction_rules"
-        android:fullBackupContent="@xml/backup_rules"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
         android:roundIcon="@mipmap/ic_launcher_round"

app/src/main/java/com/m57/hermescontrol/Navigation.kt

@@ -326,8 +326,7 @@ private fun appEntryProvider(
 
 @Composable
 fun MainNavigation(sessionId: String? = null) {
-    val token by AuthManager.tokenFlow.collectAsState()
-    val hasToken = !token.isNullOrBlank()
+    val hasToken = !AuthManager.getToken().isNullOrBlank()
     val startScreen: NavKey = if (hasToken) ChatScreen else ConnectScreen
 
     val backStack = rememberNavBackStack(startScreen)

app/src/main/java/com/m57/hermescontrol/data/local/AuthManager.kt

@@ -57,10 +57,6 @@ object AuthManager {
 
     private val _bottomNavDisplayModeFlow = MutableStateFlow<BottomNavDisplayMode>(BottomNavDisplayMode.ICON_AND_TEXT)
     val bottomNavDisplayModeFlow: StateFlow<BottomNavDisplayMode> = _bottomNavDisplayModeFlow.asStateFlow()
-
-    private val _tokenFlow = MutableStateFlow<String?>(null)
-    val tokenFlow: StateFlow<String?> = _tokenFlow.asStateFlow()
-
     private val gson = com.google.gson.Gson()
 
     /**
@@ -88,7 +84,6 @@ object AuthManager {
             _useDynamicColorsFlow.value = isUseDynamicColors()
             _themePresetFlow.value = getThemePreset()
             _bottomNavDisplayModeFlow.value = getBottomNavDisplayMode()
-            _tokenFlow.value = getToken()
         }
     }
 
@@ -108,9 +103,6 @@ object AuthManager {
                 >() {}.type
             gson.fromJson(json, type) ?: emptyList()
         } catch (e: Exception) {
-            if (com.m57.hermescontrol.BuildConfig.DEBUG) {
-                android.util.Log.w("AuthManager", "Failed to parse connection profiles", e)
-            }
             emptyList()
         }
     }
@@ -127,9 +119,6 @@ object AuthManager {
         token: String?,
     ) {
         requirePrefs().edit().putString("token_$profileId", token).apply()
-        if (getSelectedProfileId() == profileId) {
-            _tokenFlow.value = token
-        }
     }
 
     fun getSelectedProfileId(): String? {
@@ -139,7 +128,6 @@ object AuthManager {
 
     fun setSelectedProfileId(id: String?) {
         requirePrefs().edit().putString(KEY_SELECTED_PROFILE_ID, id).apply()
-        _tokenFlow.value = getToken()
     }
 
     // ── Token ────────────────────────────────────────────────────────────
@@ -147,7 +135,8 @@ object AuthManager {
     fun getToken(): String? {
         val selectedId = getSelectedProfileId()
         if (selectedId != null) {
-            return getProfileToken(selectedId)
+            val token = getProfileToken(selectedId)
+            if (token != null) return token
         }
         return requirePrefs().getString(KEY_TOKEN, null)
     }
@@ -158,7 +147,6 @@ object AuthManager {
             setProfileToken(selectedId, token)
         } else {
             requirePrefs().edit().putString(KEY_TOKEN, token).apply()
-            _tokenFlow.value = token
         }
     }
 

app/src/main/java/com/m57/hermescontrol/data/local/ChatMessageEntity.kt

@@ -12,10 +12,7 @@ import androidx.room.PrimaryKey
  * thread. The [timestamp] field preserves original ordering even if Room
  * reorders internally.
  */
-@Entity(
-    tableName = "chat_messages",
-    indices = [androidx.room.Index(value = ["session_id", "timestamp"])],
-)
+@Entity(tableName = "chat_messages")
 data class ChatMessageEntity(
     @PrimaryKey
     val id: String,

app/src/main/java/com/m57/hermescontrol/data/local/HermesDatabase.kt

@@ -4,13 +4,11 @@ import android.content.Context
 import androidx.room.Database
 import androidx.room.Room
 import androidx.room.RoomDatabase
-import androidx.room.migration.Migration
-import androidx.sqlite.db.SupportSQLiteDatabase
 import com.m57.hermescontrol.BuildConfig
 
 @Database(
     entities = [ChatMessageEntity::class],
-    version = 2,
+    version = 1,
     exportSchema = true,
 )
 abstract class HermesDatabase : RoomDatabase() {
@@ -20,16 +18,6 @@ abstract class HermesDatabase : RoomDatabase() {
         @Volatile
         private var instance: HermesDatabase? = null
 
-        private val MIGRATION_1_2 =
-            object : Migration(1, 2) {
-                override fun migrate(db: SupportSQLiteDatabase) {
-                    db.execSQL(
-                        "CREATE INDEX IF NOT EXISTS `index_chat_messages_session_id_timestamp` " +
-                            "ON `chat_messages` (`session_id`, `timestamp`)",
-                    )
-                }
-            }
-
         fun get(context: Context): HermesDatabase =
             instance ?: synchronized(this) {
                 instance ?: Room
@@ -37,8 +25,7 @@ abstract class HermesDatabase : RoomDatabase() {
                         context.applicationContext,
                         HermesDatabase::class.java,
                         "hermes_control.db",
-                    ).addMigrations(MIGRATION_1_2)
-                    .apply {
+                    ).apply {
                         if (BuildConfig.DEBUG) {
                             fallbackToDestructiveMigration(false)
                         }

app/src/main/java/com/m57/hermescontrol/data/remote/ApiClient.kt

@@ -2,7 +2,6 @@ package com.m57.hermescontrol.data.remote
 
 import com.m57.hermescontrol.BuildConfig
 import com.m57.hermescontrol.data.local.AuthManager
-import okhttp3.CertificatePinner
 import okhttp3.Interceptor
 import okhttp3.OkHttpClient
 import okhttp3.logging.HttpLoggingInterceptor
@@ -24,8 +23,6 @@ object ApiClient {
     @Volatile
     private var service: HermesApiService? = null
 
-    private val connectionPool = okhttp3.ConnectionPool()
-
     /** The current [HermesApiService] instance. Lazily created on first access. */
     val hermesApi: HermesApiService
         get() {
@@ -42,6 +39,47 @@ object ApiClient {
         }
     }
 
+    /** Creates a standalone, temporary [HermesApiService] without modifying the global instance. */
+    fun createTempService(
+        host: String,
+        port: Int,
+        token: String,
+    ): HermesApiService {
+        val tempAuthInterceptor =
+            Interceptor { chain ->
+                val request =
+                    if (token.isNotBlank()) {
+                        chain
+                            .request()
+                            .newBuilder()
+                            .addHeader("Authorization", "Bearer $token")
+                            .build()
+                    } else {
+                        chain.request()
+                    }
+                chain.proceed(request)
+            }
+
+        val tempOkHttp =
+            OkHttpClient
+                .Builder()
+                .addInterceptor(tempAuthInterceptor)
+                .connectTimeout(15, TimeUnit.SECONDS)
+                .readTimeout(30, TimeUnit.SECONDS)
+                .writeTimeout(15, TimeUnit.SECONDS)
+                .build()
+
+        val tempRetrofit =
+            Retrofit
+                .Builder()
+                .baseUrl("http://$host:$port/")
+                .client(tempOkHttp)
+                .addConverterFactory(GsonConverterFactory.create())
+                .build()
+
+        return tempRetrofit.create(HermesApiService::class.java)
+    }
+
     // ── Internal ─────────────────────────────────────────────────────────
 
     private fun buildService(): HermesApiService {
@@ -75,18 +113,11 @@ object ApiClient {
                 chain.proceed(request)
             }
 
-        // SEC-11: No certificate pinning is configured by default since the app
-        // intentionally uses HTTP for LAN and hosts are dynamic.
-        // CertificatePinner infrastructure is provided here if HTTPS is used with a known host.
-        val certificatePinner = CertificatePinner.Builder().build()
-
         val okHttp =
             OkHttpClient
                 .Builder()
-                .connectionPool(connectionPool)
                 .addInterceptor(authInterceptor)
                 .addInterceptor(logging)
-                .certificatePinner(certificatePinner)
                 .connectTimeout(15, TimeUnit.SECONDS)
                 .readTimeout(30, TimeUnit.SECONDS)
                 .writeTimeout(15, TimeUnit.SECONDS)

app/src/main/java/com/m57/hermescontrol/data/ws/HermesWsClient.kt

@@ -13,15 +13,10 @@ import kotlinx.coroutines.delay
 import kotlinx.coroutines.flow.MutableSharedFlow
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.SharedFlow
-import kotlinx.coroutines.flow.SharingStarted
 import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asSharedFlow
 import kotlinx.coroutines.flow.asStateFlow
-import kotlinx.coroutines.flow.buffer
-import kotlinx.coroutines.flow.flowOn
-import kotlinx.coroutines.flow.map
-import kotlinx.coroutines.flow.shareIn
 import kotlinx.coroutines.launch
-import okhttp3.CertificatePinner
 import okhttp3.OkHttpClient
 import okhttp3.Request
 import okhttp3.Response
@@ -79,38 +74,19 @@ object HermesWsClient {
     @Volatile
     private var reconnectJob: Job? = null
 
-    // SEC-11: No certificate pinning is configured by default since the app
-    // intentionally uses HTTP for LAN and hosts are dynamic.
-    // CertificatePinner infrastructure is provided here if HTTPS is used with a known host.
-    private val certificatePinner = CertificatePinner.Builder().build()
-
     private val okHttpClient =
         OkHttpClient
             .Builder()
-            .certificatePinner(certificatePinner)
             .readTimeout(0, TimeUnit.MILLISECONDS) // keep-alive forever
             .pingInterval(30, TimeUnit.SECONDS)
             .build()
 
     // ── Public observable stream ─────────────────────────────────────────
 
-    private val rawMessages = MutableSharedFlow<String>(extraBufferCapacity = 64)
+    private val _events = MutableSharedFlow<WsEvent>(extraBufferCapacity = 64)
 
     /** Collect this from ViewModels to receive all parsed [WsEvent]s. */
-    val events: SharedFlow<WsEvent> =
-        rawMessages
-            .buffer()
-            .map { text ->
-                try {
-                    val rpc = gson.fromJson(text, JsonRpcResponse::class.java)
-                    EventParser.parse(rpc, text)
-                } catch (e: Exception) {
-                    Log.e(TAG, "Failed to parse message", e)
-                    WsEvent.Unknown(text)
-                }
-            }
-            .flowOn(Dispatchers.IO)
-            .shareIn(wsScope, SharingStarted.Eagerly)
+    val events: SharedFlow<WsEvent> = _events.asSharedFlow()
 
     // ── Connection status flow ──────────────────────────────────────────
     private val _connectionStatus = MutableStateFlow(ConnectionStatus.DISCONNECTED)
@@ -187,8 +163,7 @@ object HermesWsClient {
         val url = AuthManager.wsUrl()
         // B2 (Jun 18 2026, kanban t_8884db16): url contains the auth token
         // as a query param — never stream to logcat in release builds.
-        val safeUrl = url.replace(Regex("token=[^&]+"), "token=REDACTED")
-        if (BuildConfig.DEBUG) Log.d(TAG, "Connecting to $safeUrl")
+        if (BuildConfig.DEBUG) Log.d(TAG, "Connecting to $url")
 
         val request = Request.Builder().url(url).build()
         webSocket = okHttpClient.newWebSocket(request, WsListenerImpl())
@@ -234,6 +209,10 @@ object HermesWsClient {
             }
     }
 
+    private fun emit(event: WsEvent) {
+        _events.tryEmit(event)
+    }
+
     // ── Listener ─────────────────────────────────────────────────────────
 
     private class WsListenerImpl : WebSocketListener() {
@@ -255,7 +234,14 @@ object HermesWsClient {
             // AI reply tokens and tool output — never stream to logcat in
             // release builds.
             if (BuildConfig.DEBUG) Log.d(TAG, "← $text")
-            rawMessages.tryEmit(text)
+            try {
+                val rpc = gson.fromJson(text, JsonRpcResponse::class.java)
+                val event = EventParser.parse(rpc, text)
+                emit(event)
+            } catch (e: Exception) {
+                Log.e(TAG, "Failed to parse message", e)
+                emit(WsEvent.Unknown(text))
+            }
         }
 
         override fun onClosing(

app/src/main/java/com/m57/hermescontrol/notification/ChatNotificationService.kt

@@ -21,10 +21,8 @@ import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.Job
 import kotlinx.coroutines.SupervisorJob
 import kotlinx.coroutines.cancel
-import kotlinx.coroutines.delay
 import kotlinx.coroutines.flow.collect
 import kotlinx.coroutines.launch
-import java.util.concurrent.atomic.AtomicBoolean
 
 /**
  * Foreground service that keeps the WebSocket connection alive while the app
@@ -59,10 +57,11 @@ class ChatNotificationService : Service() {
         internal const val NOTIFICATION_ID = 1
         internal const val PENDING_NOTIFICATION_ID = 2
 
-        private val isAppInForeground = AtomicBoolean(false)
+        @Volatile
+        private var isAppInForeground = false
 
         fun setAppForeground(foreground: Boolean) {
-            isAppInForeground.set(foreground)
+            isAppInForeground = foreground
         }
     }
 
@@ -80,27 +79,22 @@ class ChatNotificationService : Service() {
         eventCollector =
             serviceScope.launch {
                 HermesWsClient.events.collect { event ->
-                    if (!isAppInForeground.get()) {
-                        launch {
-                            delay(500)
-                            if (!isAppInForeground.get()) {
-                                when (event) {
-                                    is WsEvent.MessageComplete -> {
-                                        val preview =
-                                            event.text
-                                                .take(100)
-                                                .replace("\n", " ")
-                                                .ifBlank { getString(R.string.notif_new_message) }
-                                        showReplyNotification(preview, event.sessionId)
-                                    }
-
-                                    is WsEvent.ClarifyRequest -> {
-                                        showReplyNotification(getString(R.string.notif_clarification_needed), null)
-                                    }
-
-                                    else -> {}
-                                }
+                    if (!isAppInForeground) {
+                        when (event) {
+                            is WsEvent.MessageComplete -> {
+                                val preview =
+                                    event.text
+                                        .take(100)
+                                        .replace("\n", " ")
+                                        .ifBlank { getString(R.string.notif_new_message) }
+                                showReplyNotification(preview, event.sessionId)
                             }
+
+                            is WsEvent.ClarifyRequest -> {
+                                showReplyNotification(getString(R.string.notif_clarification_needed), null)
+                            }
+
+                            else -> {}
                         }
                     }
                 }
@@ -119,7 +113,6 @@ class ChatNotificationService : Service() {
                 .setContentText(text)
                 .setStyle(NotificationCompat.BigTextStyle().bigText(text))
                 .setPriority(NotificationCompat.PRIORITY_HIGH)
-                .setVisibility(NotificationCompat.VISIBILITY_PRIVATE)
                 .setAutoCancel(true)
                 .setContentIntent(buildContentIntent(sessionId))
 

app/src/main/java/com/m57/hermescontrol/notification/NotificationReplyReceiver.kt

@@ -53,24 +53,22 @@ open class NotificationReplyReceiver : BroadcastReceiver() {
             val pendingResult = goAsyncCompat()
             kotlinx.coroutines.CoroutineScope(kotlinx.coroutines.Dispatchers.IO).launch {
                 try {
-                    kotlinx.coroutines.withTimeout(5000L) {
-                        val db =
-                            com.m57.hermescontrol.data.local.HermesDatabase
-                                .get(context)
-                        val dao = db.chatMessageDao()
-                        val entity =
-                            com.m57.hermescontrol.data.local.ChatMessageEntity(
-                                id =
-                                    java.util.UUID
-                                        .randomUUID()
-                                        .toString(),
-                                sessionId = sessionId,
-                                role = "USER",
-                                content = replyText,
-                                timestamp = System.currentTimeMillis(),
-                            )
-                        dao.upsert(entity)
-                    }
+                    val db =
+                        com.m57.hermescontrol.data.local.HermesDatabase
+                            .get(context)
+                    val dao = db.chatMessageDao()
+                    val entity =
+                        com.m57.hermescontrol.data.local.ChatMessageEntity(
+                            id =
+                                java.util.UUID
+                                    .randomUUID()
+                                    .toString(),
+                            sessionId = sessionId,
+                            role = "USER",
+                            content = replyText,
+                            timestamp = System.currentTimeMillis(),
+                        )
+                    dao.upsert(entity)
                 } catch (e: Exception) {
                     android.util.Log.e("NotificationReply", "Failed to save replied message to Room DB", e)
                 } finally {

app/src/main/java/com/m57/hermescontrol/ui/achievements/AchievementsScreen.kt

@@ -65,16 +65,17 @@ fun AchievementsScreen(
         onOpenDrawer = onOpenDrawer,
         isRefreshing = state.isLoading,
         onRefresh = { viewModel.loadAchievements() },
-    ) {
+    ) { paddingValues ->
         when {
             state.isLoading && state.achievements.isEmpty() -> {
-                LoadingState()
+                LoadingState(modifier = Modifier.padding(paddingValues))
             }
 
             state.errorMessage != null && state.achievements.isEmpty() -> {
                 ErrorState(
                     message = state.errorMessage ?: "",
                     onRetry = { viewModel.loadAchievements() },
+                    modifier = Modifier.padding(paddingValues),
                 )
             }
 
@@ -83,12 +84,13 @@ fun AchievementsScreen(
                     title = stringResource(R.string.achievements_empty_title),
                     subtitle = stringResource(R.string.achievements_empty_desc),
                     icon = Icons.Filled.Refresh,
+                    modifier = Modifier.padding(paddingValues),
                 )
             }
 
             else -> {
                 LazyColumn(
-                    modifier = Modifier.fillMaxSize(),
+                    modifier = Modifier.fillMaxSize().padding(paddingValues),
                     contentPadding = PaddingValues(16.dp),
                     verticalArrangement = Arrangement.spacedBy(12.dp),
                 ) {
@@ -99,7 +101,7 @@ fun AchievementsScreen(
                             placeholder = "Search achievements...",
                         )
                     }
-                    items(filteredAchievements, key = { it.id }) { achievement ->
+                    items(filteredAchievements) { achievement ->
                         val pct = achievement.progress_pct?.toFloat()?.div(100f) ?: 0f
 
                         Card(

app/src/main/java/com/m57/hermescontrol/ui/channels/ChannelsScreen.kt

@@ -69,16 +69,17 @@ fun ChannelsScreen(
         onOpenDrawer = onOpenDrawer,
         isRefreshing = state.isLoading,
         onRefresh = { viewModel.loadPlatforms() },
-    ) {
+    ) { paddingValues ->
         when {
             state.isLoading && state.platforms.isEmpty() -> {
-                LoadingState()
+                LoadingState(modifier = Modifier.padding(paddingValues))
             }
 
             state.errorMessage != null -> {
                 ErrorState(
                     message = state.errorMessage ?: "",
                     onRetry = { viewModel.loadPlatforms() },
+                    modifier = Modifier.padding(paddingValues),
                 )
             }
 
@@ -86,12 +87,13 @@ fun ChannelsScreen(
                 EmptyState(
                     title = stringResource(R.string.channels_empty_title),
                     subtitle = stringResource(R.string.channels_empty_desc),
+                    modifier = Modifier.padding(paddingValues),
                 )
             }
 
             else -> {
                 LazyColumn(
-                    modifier = Modifier.fillMaxSize(),
+                    modifier = Modifier.fillMaxSize().padding(paddingValues),
                     contentPadding = listContentPadding,
                     verticalArrangement = listItemSpacing,
                 ) {

app/src/main/java/com/m57/hermescontrol/ui/chat/ChatBubble.kt

@@ -10,9 +10,10 @@ import androidx.compose.animation.fadeOut
 import androidx.compose.animation.scaleIn
 import androidx.compose.animation.scaleOut
 import androidx.compose.foundation.BorderStroke
+import androidx.compose.foundation.ExperimentalFoundationApi
 import androidx.compose.foundation.background
 import androidx.compose.foundation.clickable
-import androidx.compose.foundation.gestures.detectTapGestures
+import androidx.compose.foundation.combinedClickable
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
@@ -52,7 +53,6 @@ import androidx.compose.ui.draw.clip
 import androidx.compose.ui.graphics.Brush
 import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.graphics.luminance
-import androidx.compose.ui.input.pointer.pointerInput
 import androidx.compose.ui.platform.LocalClipboardManager
 import androidx.compose.ui.platform.LocalConfiguration
 import androidx.compose.ui.platform.LocalUriHandler
@@ -129,6 +129,7 @@ fun ChatBubble(
     }
 }
 
+@OptIn(ExperimentalFoundationApi::class)
 @Composable
 private fun UserBubble(
     message: ChatMessage,
@@ -173,18 +174,17 @@ private fun UserBubble(
             )
         val primary = MaterialTheme.colorScheme.primary
         val secondary = MaterialTheme.colorScheme.secondary
-        val onPrimary = MaterialTheme.colorScheme.onPrimary
         val avgLuminance = (primary.luminance() + secondary.luminance()) / 2f
         val userBubbleTextColor =
             if (avgLuminance > 0.5f) {
-                if (onPrimary.luminance() < 0.5f) {
-                    onPrimary
+                if (MaterialTheme.colorScheme.onPrimary.luminance() < 0.5f) {
+                    MaterialTheme.colorScheme.onPrimary
                 } else {
                     Color(0xFF1A1A24)
                 }
             } else {
-                if (onPrimary.luminance() > 0.5f) {
-                    onPrimary
+                if (MaterialTheme.colorScheme.onPrimary.luminance() > 0.5f) {
+                    MaterialTheme.colorScheme.onPrimary
                 } else {
                     Color.White
                 }
@@ -203,13 +203,13 @@ private fun UserBubble(
                             ),
                         ).background(brush = gradientBrush)
                         .testTag("chat_bubble_user")
-                        .pointerInput(message.id) {
-                            detectTapGestures(
-                                onLongPress = {
-                                    showCopyButton = true
-                                },
-                            )
-                        },
+                        .combinedClickable(
+                            role = Role.Button,
+                            onClick = {},
+                            onLongClick = {
+                                showCopyButton = true
+                            },
+                        ),
                 color = Color.Transparent,
                 tonalElevation = 0.dp,
             ) {
@@ -270,6 +270,7 @@ private fun UserBubble(
     }
 }
 
+@OptIn(ExperimentalFoundationApi::class)
 @Composable
 private fun AssistantBubble(
     message: ChatMessage,
@@ -280,17 +281,16 @@ private fun AssistantBubble(
     modifier: Modifier = Modifier,
 ) {
     val bubbleColor = if (isDarkTheme) AssistantBubble else AssistantBubbleLight
-    val onSurface = MaterialTheme.colorScheme.onSurface
     val textColor =
         if (bubbleColor.luminance() > 0.5f) {
-            if (onSurface.luminance() < 0.5f) {
-                onSurface
+            if (MaterialTheme.colorScheme.onSurface.luminance() < 0.5f) {
+                MaterialTheme.colorScheme.onSurface
             } else {
                 Color(0xFF1A1A24)
             }
         } else {
-            if (onSurface.luminance() > 0.5f) {
-                onSurface
+            if (MaterialTheme.colorScheme.onSurface.luminance() > 0.5f) {
+                MaterialTheme.colorScheme.onSurface
             } else {
                 Color(0xFFE8E6EE)
             }
@@ -318,7 +318,7 @@ private fun AssistantBubble(
                 modifier =
                     Modifier
                         .widthIn(max = maxWidth)
-                        .let { if (!message.isStreaming) it.animateContentSize() else it }
+                        .animateContentSize()
                         .clip(
                             RoundedCornerShape(
                                 topStart = 4.dp,
@@ -327,13 +327,13 @@ private fun AssistantBubble(
                                 bottomEnd = 16.dp,
                             ),
                         ).testTag("chat_bubble_assistant")
-                        .pointerInput(message.id) {
-                            detectTapGestures(
-                                onLongPress = {
-                                    showCopyButton = true
-                                },
-                            )
-                        },
+                        .combinedClickable(
+                            role = Role.Button,
+                            onClick = {},
+                            onLongClick = {
+                                showCopyButton = true
+                            },
+                        ),
                 color = bubbleColor,
                 border =
                     BorderStroke(

app/src/main/java/com/m57/hermescontrol/ui/chat/ChatScreen.kt

@@ -75,6 +75,7 @@ import androidx.compose.material3.TextButton
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.DisposableEffect
 import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.SideEffect
 import androidx.compose.runtime.derivedStateOf
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableIntStateOf
@@ -103,6 +104,7 @@ import androidx.lifecycle.compose.collectAsStateWithLifecycle
 import androidx.lifecycle.viewmodel.compose.viewModel
 import com.m57.hermescontrol.NavigationController
 import com.m57.hermescontrol.R
+import com.m57.hermescontrol.data.local.AuthManager
 import com.m57.hermescontrol.data.ws.ConnectionStatus
 import com.m57.hermescontrol.notification.NotificationHelper
 import com.m57.hermescontrol.theme.StatusRed
@@ -139,9 +141,8 @@ fun ChatScreen(
     // during composition — BEFORE any WebSocket event (GatewayReady) can be
     // processed. This ensures GatewayReady sees the pending session and
     // resumes it instead of creating a new empty chat (issue #240).
-    remember(sessionId) {
+    SideEffect {
         viewModel.initialSessionId = sessionId
-        true
     }
 
     // Switch to the session from a notification tap or history screen when provided.
@@ -173,7 +174,6 @@ fun ChatScreen(
                     androidx.lifecycle.Lifecycle.Event.ON_START -> {
                         NotificationHelper.setAppForeground(context, true)
                         NotificationHelper.stop(context)
-                        viewModel.refreshSettings()
                         viewModel.refreshCurrentSession()
                     }
 
@@ -212,7 +212,7 @@ fun ChatScreen(
     }
 
     // Auto-scroll to bottom on new messages
-    LaunchedEffect(state.messages.size, state.streamingMessage != null, state.isThinking) {
+    LaunchedEffect(state.messages.size, state.streamingMessage?.content?.length, state.isThinking) {
         val totalItems =
             state.messages.size +
                 (if (state.streamingMessage != null) 1 else 0) +
@@ -245,21 +245,15 @@ fun ChatScreen(
         )
     }
 
-    val backgroundColor = MaterialTheme.colorScheme.background
-    val surfaceVariantColor = MaterialTheme.colorScheme.surfaceVariant
-    val primaryColor = MaterialTheme.colorScheme.primary
-
     val backgroundGradient =
-        remember(backgroundColor, surfaceVariantColor, primaryColor) {
-            Brush.verticalGradient(
-                colors =
-                    listOf(
-                        backgroundColor,
-                        surfaceVariantColor.copy(alpha = 0.3f),
-                        primaryColor.copy(alpha = 0.05f),
-                    ),
-            )
-        }
+        Brush.verticalGradient(
+            colors =
+                listOf(
+                    MaterialTheme.colorScheme.background,
+                    MaterialTheme.colorScheme.surfaceVariant.copy(alpha = 0.3f),
+                    MaterialTheme.colorScheme.primary.copy(alpha = 0.05f),
+                ),
+        )
 
     // Scroll to current search match
     LaunchedEffect(state.isSearchActive, state.currentSearchMatchIndex, state.searchMatchIndices) {
@@ -447,15 +441,13 @@ fun ChatScreen(
 
                         val isLastMessage = index == state.messages.lastIndex
                         val isAssistant = message.role == MessageRole.ASSISTANT
+                        val typingEnabled = AuthManager.isTypingEffectEnabled()
+                        val typingDelayMs = AuthManager.getTypingEffectDelayMs()
 
-                        if (state.typingEffectEnabled &&
-                            isLastMessage &&
-                            isAssistant &&
-                            lastAnimatedMessageId != message.id
-                        ) {
+                        if (typingEnabled && isLastMessage && isAssistant && lastAnimatedMessageId != message.id) {
                             StreamingBubbleWithTypingEffect(
                                 streaming = message,
-                                typingDelayMs = state.typingEffectDelayMs,
+                                typingDelayMs = typingDelayMs,
                                 isDark = isDark,
                                 onAnimationComplete = {
                                     lastAnimatedMessageId = message.id
@@ -474,10 +466,13 @@ fun ChatScreen(
                     // Streaming message — rendered separately for O(1) updates
                     state.streamingMessage?.let { streaming ->
                         item(key = "streaming-${streaming.id}") {
-                            if (state.typingEffectEnabled && streaming.isStreaming) {
+                            val typingEnabled = AuthManager.isTypingEffectEnabled()
+                            val typingDelayMs = AuthManager.getTypingEffectDelayMs()
+
+                            if (typingEnabled && streaming.isStreaming) {
                                 StreamingBubbleWithTypingEffect(
                                     streaming = streaming,
-                                    typingDelayMs = state.typingEffectDelayMs,
+                                    typingDelayMs = typingDelayMs,
                                     isDark = isDark,
                                 )
                             } else {
@@ -721,7 +716,7 @@ private fun ChatInputBar(
                             LazyColumn(
                                 modifier = Modifier.heightIn(max = 200.dp),
                             ) {
-                                items(filteredCommands, key = { it }) { cmd ->
+                                items(filteredCommands) { cmd ->
                                     val description =
                                         when (cmd) {
                                             "/help" -> stringResource(R.string.command_help_desc)

app/src/main/java/com/m57/hermescontrol/ui/chat/ChatViewModel.kt

@@ -57,9 +57,6 @@ data class ChatUiState(
     val searchQuery: String = "",
     val searchMatchIndices: List<Int> = emptyList(),
     val currentSearchMatchIndex: Int = -1,
-    // Cached settings
-    val typingEffectEnabled: Boolean = true,
-    val typingEffectDelayMs: Int = 30,
 ) {
     /** Convenience — derived from [connectionStatus]. */
     val isConnected: Boolean get() = connectionStatus == ConnectionStatus.CONNECTED
@@ -96,12 +93,6 @@ class ChatViewModel(
 
     private var pendingCleanupJob: Job? = null
 
-    private val streamingBuffer = java.lang.StringBuilder()
-    private var lastFlushMs = 0L
-
-    private val thinkingBuffer = java.lang.StringBuilder()
-    private var lastThinkingFlushMs = 0L
-
     // ── Public state ─────────────────────────────────────────────────────
 
     /**
@@ -121,7 +112,6 @@ class ChatViewModel(
         )
 
     init {
-        refreshSettings()
         connectWebSocket()
         viewModelScope.launch {
             wsClient.events.collect { event ->
@@ -254,11 +244,6 @@ class ChatViewModel(
         var orphanToPersist: ChatMessage? = null
         val sessionId = _uiState.value.currentSessionId
 
-        streamingBuffer.clear()
-        thinkingBuffer.clear()
-        lastFlushMs = 0L
-        lastThinkingFlushMs = 0L
-
         // Create the streaming message as a standalone state field.
         val msg =
             ChatMessage(
@@ -296,61 +281,41 @@ class ChatViewModel(
 
     private fun handleMessageToken(event: WsEvent.MessageToken) {
         if (!isCurrentSession(event.sessionId)) return
-
-        streamingBuffer.append(event.token)
-        val now = System.currentTimeMillis()
-
-        // Always flush in tests, or if enough time has passed
-        val shouldFlush = (now - lastFlushMs >= 33L) || lastFlushMs == 0L || isTestEnvironment()
-        if (shouldFlush) {
-            val currentContent = streamingBuffer.toString()
-            lastFlushMs = now
-            _uiState.update { state ->
-                val current = state.streamingMessage
-                if (current != null) {
-                    state.copy(
-                        streamingMessage =
-                            current.copy(
-                                content = currentContent,
-                            ),
-                        isThinking = false,
+        _uiState.update { state ->
+            val current = state.streamingMessage
+            if (current != null) {
+                state.copy(
+                    streamingMessage =
+                        current.copy(
+                            content = current.content + event.token,
+                        ),
+                    isThinking = false,
+                )
+            } else {
+                // Fallback: no MessageStart was received — create one now
+                val msg =
+                    ChatMessage(
+                        role = MessageRole.ASSISTANT,
+                        content = event.token,
+                        isStreaming = true,
                     )
-                } else {
-                    // Fallback: no MessageStart was received — create one now
-                    val msg =
-                        ChatMessage(
-                            role = MessageRole.ASSISTANT,
-                            content = currentContent,
-                            isStreaming = true,
-                        )
-                    streamingMessageId = msg.id
-                    state.copy(
-                        streamingMessage = msg,
-                        isAgentTyping = true,
-                        isThinking = false,
-                    )
-                }
+                streamingMessageId = msg.id
+                state.copy(
+                    streamingMessage = msg,
+                    isAgentTyping = true,
+                    isThinking = false,
+                )
             }
         }
     }
 
     private fun handleThinkingDelta(event: WsEvent.ThinkingDelta) {
         if (!isCurrentSession(event.sessionId)) return
-
-        thinkingBuffer.append(event.token)
-        val now = System.currentTimeMillis()
-
-        // Always flush in tests, or if enough time has passed
-        val shouldFlush = (now - lastThinkingFlushMs >= 33L) || lastThinkingFlushMs == 0L || isTestEnvironment()
-        if (shouldFlush) {
-            val currentContent = thinkingBuffer.toString()
-            lastThinkingFlushMs = now
-            _uiState.update { state ->
-                state.copy(
-                    isThinking = true,
-                    thinkingText = currentContent,
-                )
-            }
+        _uiState.update { state ->
+            state.copy(
+                isThinking = true,
+                thinkingText = state.thinkingText + event.token,
+            )
         }
     }
 
@@ -360,9 +325,6 @@ class ChatViewModel(
         var finalizedMsg: ChatMessage? = null
         var sessionId: String? = null
 
-        streamingBuffer.clear()
-        thinkingBuffer.clear()
-
         _uiState.update { state ->
             val streaming = state.streamingMessage
             val msg =
@@ -409,20 +371,9 @@ class ChatViewModel(
         var orphan: ChatMessage? = null
         var sessionId: String? = null
 
-        // Flush any remaining buffered content to the message before marking it done
-        val finalContent = streamingBuffer.toString()
-        val finalThinkingText = thinkingBuffer.toString()
-
-        streamingBuffer.clear()
-        thinkingBuffer.clear()
-
         _uiState.update { state ->
             val streaming = state.streamingMessage
-            val msg =
-                streaming?.copy(
-                    content = finalContent.ifEmpty { streaming.content },
-                    isStreaming = false,
-                )
+            val msg = streaming?.copy(isStreaming = false)
             orphan = msg
             sessionId = state.currentSessionId
             if (msg != null) {
@@ -460,7 +411,7 @@ class ChatViewModel(
         var orphanToPersist: ChatMessage? = null
         val sessionId = _uiState.value.currentSessionId
 
-        val contentJson = event.data?.let { gson.toJson(it) } ?: ""
+        val contentJson = event.data?.let { Gson().toJson(it) } ?: ""
         val toolMessage =
             ChatMessage(
                 role = MessageRole.TOOL,
@@ -509,7 +460,7 @@ class ChatViewModel(
                         it.toolStatus == ToolStatus.RUNNING
                 }
             if (toolIdx >= 0) {
-                val contentJson = event.data?.let { gson.toJson(it) } ?: ""
+                val contentJson = event.data?.let { Gson().toJson(it) } ?: ""
                 val updated =
                     messages[toolIdx].copy(
                         toolStatus = ToolStatus.COMPLETED,
@@ -599,8 +550,6 @@ class ChatViewModel(
             }
 
             WsMethods.SESSION_INTERRUPT -> {
-                streamingBuffer.clear()
-                thinkingBuffer.clear()
                 _uiState.update {
                     it.copy(
                         isAgentTyping = false,
@@ -864,22 +813,11 @@ class ChatViewModel(
         loadSessionMessages(sessionId)
     }
 
-    fun refreshSettings() {
-        _uiState.update { state ->
-            state.copy(
-                typingEffectEnabled = AuthManager.isTypingEffectEnabled(),
-                typingEffectDelayMs = AuthManager.getTypingEffectDelayMs(),
-            )
-        }
-    }
-
     fun switchSession(sessionId: String) {
         if (sessionId == _uiState.value.currentSessionId) return
 
         // Reset streaming state
         streamingMessageId = null
-        streamingBuffer.clear()
-        thinkingBuffer.clear()
 
         _uiState.update {
             val title = it.sessions.find { s -> s.id == sessionId }?.title ?: "Hermes"
@@ -1105,13 +1043,13 @@ class ChatViewModel(
                 while (true) {
                     delay(PENDING_REQUEST_TIMEOUT_MS)
                     val now = System.currentTimeMillis()
-                    val iterator = pendingRequests.entries.iterator()
-                    while (iterator.hasNext()) {
-                        val entry = iterator.next()
-                        if (now - entry.value.createdAt > PENDING_REQUEST_TIMEOUT_MS) {
-                            iterator.remove()
-                            Log.w(TAG, "Request timed out: ${entry.value.method} (id=${entry.key})")
+                    val stale =
+                        pendingRequests.entries.filter {
+                            now - it.value.createdAt > PENDING_REQUEST_TIMEOUT_MS
                         }
+                    for (entry in stale) {
+                        pendingRequests.remove(entry.key)
+                        Log.w(TAG, "Request timed out: ${entry.value.method} (id=${entry.key})")
                     }
                 }
             }
@@ -1197,21 +1135,6 @@ class ChatViewModel(
         }
     }
 
-    private var isTestEnv: Boolean? = null
-
-    private fun isTestEnvironment(): Boolean {
-        if (isTestEnv == null) {
-            isTestEnv =
-                try {
-                    Class.forName("org.junit.Test")
-                    true
-                } catch (e: ClassNotFoundException) {
-                    false
-                }
-        }
-        return isTestEnv == true
-    }
-
     // ── Lifecycle ─────────────────────────────────────────────────────────
 
     override fun onCleared() {
@@ -1219,8 +1142,4 @@ class ChatViewModel(
         pendingCleanupJob?.cancel()
         wsClient.disconnect()
     }
-
-    companion object {
-        private val gson = Gson()
-    }
 }

app/src/main/java/com/m57/hermescontrol/ui/common/SharedComponents.kt

@@ -246,7 +246,7 @@ fun FilterChipRow(
             ),
         horizontalArrangement = Arrangement.spacedBy(spacing.sm),
     ) {
-        items(chips, key = { it }) { chip ->
+        items(chips) { chip ->
             FilterChip(
                 selected = chip == selectedChip,
                 onClick = { onChipSelected(chip) },

app/src/main/java/com/m57/hermescontrol/ui/connect/ConnectViewModel.kt

@@ -39,22 +39,6 @@ class ConnectViewModel(private val app: Application) : ViewModel() {
         loadSavedValues()
     }
 
-    private suspend fun isHostAllowed(host: String): Boolean =
-        withContext(Dispatchers.IO) {
-            if (host == "localhost" || host == "127.0.0.1" || host == "0.0.0.0") return@withContext false
-            if (host.startsWith("169.254.")) return@withContext false
-            if (host == "metadata.google.internal") return@withContext false
-            try {
-                val address = java.net.InetAddress.getByName(host)
-                if (address.isLoopbackAddress || address.isAnyLocalAddress || address.isLinkLocalAddress) {
-                    return@withContext false
-                }
-                true
-            } catch (e: Exception) {
-                false
-            }
-        }
-
     fun loadSavedValues() {
         val savedToken = AuthManager.getToken() ?: ""
         val savedHost = AuthManager.getHost()
@@ -147,15 +131,17 @@ class ConnectViewModel(private val app: Application) : ViewModel() {
         viewModelScope.launch {
             val result =
                 withContext(Dispatchers.IO) {
-                    // Update ApiClient temporarily with current inputs to verify connection
+                    val tempApi = ApiClient.createTempService(state.host, port, state.token)
+                    safeApiCall { tempApi.getStatus() }
+                }
+            when (result) {
+                is NetworkResult.Success -> {
+                    // Only persist credentials to global state upon successful verification
                     AuthManager.setToken(state.token)
                     AuthManager.setHost(state.host)
                     AuthManager.setPort(port)
                     ApiClient.rebuild()
-                    safeApiCall { ApiClient.hermesApi.getStatus() }
-                }
-            when (result) {
-                is NetworkResult.Success -> {
+
                     if (state.saveProfile) {
                         val currentProfiles = AuthManager.getConnectionProfiles()
                         val existingIndex =
@@ -203,10 +189,6 @@ class ConnectViewModel(private val app: Application) : ViewModel() {
                             is NetworkError.Http -> {
                                 when (err.code) {
                                     401 -> {
-                                        AuthManager.setToken(null)
-                                        if (AuthManager.getSelectedProfileId() != null) {
-                                            AuthManager.setProfileToken(AuthManager.getSelectedProfileId()!!, null)
-                                        }
                                         app.getString(R.string.connect_error_401)
                                     }
 
@@ -283,25 +265,15 @@ class ConnectViewModel(private val app: Application) : ViewModel() {
                 val port = uri.getQueryParameter("port")
                 val token = uri.getQueryParameter("token")
                 if (host != null && port != null && token != null) {
-                    viewModelScope.launch {
-                        if (!isHostAllowed(host)) {
-                            _uiState.update {
-                                it.copy(
-                                    errorMessage = app.getString(R.string.connect_error_invalid_host),
-                                )
-                            }
-                            return@launch
-                        }
-                        _uiState.update {
-                            it.copy(
-                                host = host,
-                                port = port,
-                                token = token,
-                                errorMessage = null,
-                            )
-                        }
-                        connect()
+                    _uiState.update {
+                        it.copy(
+                            host = host,
+                            port = port,
+                            token = token,
+                            errorMessage = null,
+                        )
                     }
+                    connect()
                     return
                 }
             }
@@ -319,25 +291,15 @@ class ConnectViewModel(private val app: Application) : ViewModel() {
                     val port = json.get("port")?.asInt?.toString() ?: json.get("port")?.asString
                     val token = json.get("token")?.asString
                     if (host != null && port != null && token != null) {
-                        viewModelScope.launch {
-                            if (!isHostAllowed(host)) {
-                                _uiState.update {
-                                    it.copy(
-                                        errorMessage = app.getString(R.string.connect_error_invalid_host),
-                                    )
-                                }
-                                return@launch
-                            }
-                            _uiState.update {
-                                it.copy(
-                                    host = host,
-                                    port = port,
-                                    token = token,
-                                    errorMessage = null,
-                                )
-                            }
-                            connect()
+                        _uiState.update {
+                            it.copy(
+                                host = host,
+                                port = port,
+                                token = token,
+                                errorMessage = null,
+                            )
                         }
+                        connect()
                         return
                     }
                     // Decoded valid JSON but missing required fields

app/src/main/java/com/m57/hermescontrol/ui/cron/CronJobsScreen.kt

@@ -89,7 +89,7 @@ fun CronJobsScreen(
                     contentPadding = listContentPadding,
                     verticalArrangement = listItemSpacing,
                 ) {
-                    items(state.jobs, key = { it.id }) { job ->
+                    items(state.jobs) { job ->
                         Card(
                             modifier = Modifier.fillMaxWidth(),
                             colors =

app/src/main/java/com/m57/hermescontrol/ui/kanban/KanbanScreen.kt

@@ -85,16 +85,17 @@ fun KanbanScreen(
         onOpenDrawer = onOpenDrawer,
         isRefreshing = state.isLoading,
         onRefresh = { viewModel.loadBoards() },
-    ) {
+    ) { paddingValues ->
         when {
             state.isLoading && state.boards.isEmpty() -> {
-                LoadingState()
+                LoadingState(modifier = Modifier.padding(paddingValues))
             }
 
             state.errorMessage != null -> {
                 ErrorState(
                     message = state.errorMessage ?: "",
                     onRetry = { viewModel.loadBoards() },
+                    modifier = Modifier.padding(paddingValues),
                 )
             }
 
@@ -106,10 +107,11 @@ fun KanbanScreen(
                         Text(
                             text = state.errorMessage ?: "",
                             color = MaterialTheme.colorScheme.error,
+                            modifier = Modifier.padding(paddingValues),
                         )
                     } else {
                         Column(
-                            modifier = Modifier.fillMaxSize(),
+                            modifier = Modifier.fillMaxSize().padding(paddingValues),
                         ) {
                             SearchBar(
                                 query = query,
@@ -147,7 +149,7 @@ fun KanbanScreen(
                                     contentPadding = PaddingValues(16.dp),
                                     horizontalArrangement = Arrangement.spacedBy(16.dp),
                                 ) {
-                                    items(state.columns, key = { it.name }) { column ->
+                                    items(state.columns) { column ->
                                         val colName = column.name
                                         val colTasks =
                                             filteredTasks.filter {
@@ -176,7 +178,7 @@ fun KanbanScreen(
                                                 modifier = Modifier.weight(1f),
                                                 verticalArrangement = Arrangement.spacedBy(8.dp),
                                             ) {
-                                                items(colTasks, key = { it.id }) { task ->
+                                                items(colTasks) { task ->
                                                     TaskCard(
                                                         task = task,
                                                         onMoveLeft =

app/src/main/java/com/m57/hermescontrol/ui/keys/KeysScreen.kt

@@ -125,7 +125,7 @@ fun KeysScreen(
                                     placeholder = "Search keys...",
                                 )
                             }
-                            items(filteredEnvVars.toList(), key = { it.first }) { (key, config) ->
+                            items(filteredEnvVars.toList()) { (key, config) ->
                                 var isEditing by remember { mutableStateOf(false) }
                                 val revealedVal = state.revealedValues[key]
                                 val isRevealed = revealedVal != null

app/src/main/java/com/m57/hermescontrol/ui/mcp/McpServersScreen.kt

@@ -116,7 +116,7 @@ fun McpServersScreen(
                                     placeholder = "Search MCP servers...",
                                 )
                             }
-                            items(filteredServers, key = { it.name }) { server ->
+                            items(filteredServers) { server ->
                                 Card(
                                     modifier = Modifier.fillMaxWidth(),
                                     colors =

app/src/main/java/com/m57/hermescontrol/ui/model/ModelScreen.kt

@@ -134,7 +134,7 @@ fun ModelScreen(
                                     placeholder = "Search models...",
                                 )
                             }
-                            items(filteredProviders, key = { it.slug }) { provider ->
+                            items(filteredProviders) { provider ->
                                 val isExpanded = expandedProviderSlug == provider.slug
                                 val isCurrent = provider.is_current == true
 

app/src/main/java/com/m57/hermescontrol/ui/pairing/PairingScreen.kt

@@ -121,7 +121,7 @@ fun PairingScreen(
                                     }
                                 }
 
-                                items(pending, key = { "${it.platform}_${it.code ?: it.user_id}" }) { item ->
+                                items(pending) { item ->
                                     Card(
                                         modifier = Modifier.fillMaxWidth(),
                                         colors =
@@ -201,7 +201,7 @@ fun PairingScreen(
                                     }
                                 }
                             } else {
-                                items(approved, key = { "${it.platform}_${it.user_id}" }) { item ->
+                                items(approved) { item ->
                                     Card(
                                         modifier = Modifier.fillMaxWidth(),
                                     ) {

app/src/main/java/com/m57/hermescontrol/ui/plugins/PluginsScreen.kt

@@ -119,7 +119,7 @@ fun PluginsScreen(
                                     placeholder = "Search plugins...",
                                 )
                             }
-                            items(filteredPlugins, key = { it.name }) { plugin ->
+                            items(filteredPlugins) { plugin ->
                                 Card(modifier = Modifier.fillMaxWidth()) {
                                     Column(modifier = Modifier.padding(16.dp)) {
                                         Row(

app/src/main/java/com/m57/hermescontrol/ui/profiles/ProfilesScreen.kt

@@ -118,7 +118,7 @@ fun ProfilesScreen(
                             contentPadding = PaddingValues(16.dp),
                             verticalArrangement = Arrangement.spacedBy(12.dp),
                         ) {
-                            items(state.profiles, key = { it.name }) { profile ->
+                            items(state.profiles) { profile ->
                                 val isActive = profile.name == state.activeProfileName
                                 Card(
                                     modifier = Modifier.fillMaxWidth(),

app/src/main/java/com/m57/hermescontrol/ui/sessions/SessionsScreen.kt

@@ -105,7 +105,7 @@ fun SessionsScreen(
                             placeholder = "Search sessions...",
                         )
                     }
-                    items(filteredSessions, key = { it.id }) { session ->
+                    items(filteredSessions) { session ->
                         Card(
                             modifier =
                                 Modifier

app/src/main/java/com/m57/hermescontrol/ui/skills/SkillsScreen.kt

@@ -237,7 +237,7 @@ fun SkillsScreen(
                             }
                         }
                     } else {
-                        items(filtered, key = { it.name }) { skill ->
+                        items(filtered) { skill ->
                             Card(
                                 modifier = Modifier.fillMaxWidth(),
                                 colors =

app/src/main/java/com/m57/hermescontrol/ui/toolsets/ToolsetsScreen.kt

@@ -133,7 +133,7 @@ fun ToolsetsScreen(
                                     placeholder = "Search toolsets...",
                                 )
                             }
-                            items(filteredToolsets, key = { it.name }) { toolset ->
+                            items(filteredToolsets) { toolset ->
                                 Card(
                                     modifier = Modifier.fillMaxWidth(),
                                     colors =

app/src/main/java/com/m57/hermescontrol/ui/webhooks/WebhooksScreen.kt

@@ -192,7 +192,7 @@ fun WebhooksScreen(
                                     }
                                 }
                             } else {
-                                items(filteredSubscriptions, key = { it.name }) { sub ->
+                                items(filteredSubscriptions) { sub ->
                                     Card(
                                         modifier = Modifier.fillMaxWidth(),
                                     ) {

app/src/main/res/values/strings.xml

@@ -178,7 +178,6 @@
     <string name="connect_error_refused">Connection refused – is Hermes running?</string>
     <string name="connect_error_resolve">Could not resolve host</string>
     <string name="connect_error_connection_failed">Connection failed: %1$s</string>
-    <string name="connect_error_invalid_host">Invalid or forbidden host in pairing string</string>
     <string name="connect_error_missing_fields">Malformed pairing string — missing host, port, or token</string>
     <string name="connect_error_malformed">Malformed pairing string — expected URL or Base64-encoded JSON</string>
     <string name="connect_error_parse_failed">Failed to parse pairing string: %1$s</string>

app/src/main/res/xml/backup_rules.xml

@@ -6,6 +6,8 @@
    See https://developer.android.com/about/versions/12/backup-restore
 -->
 <full-backup-content>
-    <exclude domain="database" path="hermes_control.db" />
-    <exclude domain="sharedpref" path="hermes_secure_prefs.xml" />
+    <!--
+   <include domain="sharedpref" path="."/>
+   <exclude domain="sharedpref" path="device.xml"/>
+-->
 </full-backup-content>

app/src/main/res/xml/data_extraction_rules.xml

@@ -5,11 +5,15 @@
 -->
 <data-extraction-rules>
     <cloud-backup>
-        <exclude domain="database" path="hermes_control.db" />
-        <exclude domain="sharedpref" path="hermes_secure_prefs.xml" />
+        <!-- TODO: Use <include> and <exclude> to control what is backed up.
+        <include .../>
+        <exclude .../>
+        -->
     </cloud-backup>
+    <!--
     <device-transfer>
-        <exclude domain="database" path="hermes_control.db" />
-        <exclude domain="sharedpref" path="hermes_secure_prefs.xml" />
+        <include .../>
+        <exclude .../>
     </device-transfer>
+    -->
 </data-extraction-rules>

app/src/test/java/com/m57/hermescontrol/E2eIntegrationTest.kt

@@ -72,6 +72,7 @@ class E2eIntegrationTest {
 
         mockApiService = mockk()
         every { ApiClient.hermesApi } returns mockApiService
+        every { ApiClient.createTempService(any(), any(), any()) } returns mockApiService
         every { ApiClient.rebuild() } returns Unit
 
         // Default AuthManager stubs
@@ -774,7 +775,6 @@ class E2eIntegrationTest {
             assertEquals("Invalid token (401 Unauthorized)", viewModel.uiState.value.errorMessage)
             assertFalse(viewModel.uiState.value.connectionSuccess)
             // Verify AuthManager.setToken(null) was called
-            verify { AuthManager.setToken(null) }
         }
 
     // ── Tier 4: Real-World Scenarios ─────────────────────────────────────

app/src/test/java/com/m57/hermescontrol/data/local/AuthManagerTest.kt

@@ -139,11 +139,11 @@ class AuthManagerTest {
     }
 
     @Test
-    fun testGetToken_returnsNullWhenProfileTokenMissing() {
+    fun testGetToken_fallsBackToGlobalWhenProfileTokenMissing() {
         every { mockPrefs.getString("selected_profile_id", null) } returns "prof-1"
         every { mockPrefs.getString("token_prof-1", null) } returns null // no profile token
         every { mockPrefs.getString("auth_token", null) } returns "global-token"
-        assertNull(AuthManager.getToken())
+        assertEquals("global-token", AuthManager.getToken())
     }
 
     @Test
@@ -293,18 +293,18 @@ class AuthManagerTest {
     }
 
     @Test
-    fun testGetToken_returnsNullWhenSelectedProfileLacksToken() {
-        // Profile A is selected but has no token → should return null, not global
+    fun testGetToken_fallsBackToGlobalWhenSelectedProfileLacksToken() {
+        // Profile A is selected but has no token → falls back to global
         every { mockPrefs.getString("selected_profile_id", null) } returns "prof-a"
         every { mockPrefs.getString("token_prof-a", null) } returns null
         every { mockPrefs.getString("auth_token", null) } returns "shared-global-token"
 
-        assertNull(AuthManager.getToken())
+        assertEquals("shared-global-token", AuthManager.getToken())
 
-        // Switch to Profile B, which also has no token → should return null
+        // Switch to Profile B, which also has no token → same global fallback
         every { mockPrefs.getString("selected_profile_id", null) } returns "prof-b"
         every { mockPrefs.getString("token_prof-b", null) } returns null
-        assertNull(AuthManager.getToken())
+        assertEquals("shared-global-token", AuthManager.getToken())
     }
 
     @Test
@@ -314,11 +314,11 @@ class AuthManagerTest {
         every { mockPrefs.getString("token_prof-a", null) } returns "token-a"
         assertEquals("token-a", AuthManager.getToken())
 
-        // Profile B has no token, but global exists → should return null
+        // Profile B has no token, but global exists
         every { mockPrefs.getString("selected_profile_id", null) } returns "prof-b"
         every { mockPrefs.getString("token_prof-b", null) } returns null
         every { mockPrefs.getString("auth_token", null) } returns "fallback"
-        assertNull(AuthManager.getToken())
+        assertEquals("fallback", AuthManager.getToken())
 
         // Profile C has its own token too
         every { mockPrefs.getString("selected_profile_id", null) } returns "prof-c"

app/src/test/java/com/m57/hermescontrol/notification/ChatNotificationServiceTest.kt

@@ -2,6 +2,7 @@ package com.m57.hermescontrol.notification
 
 import org.junit.Assert.assertEquals
 import org.junit.Test
+import java.lang.reflect.Modifier
 
 /**
  * Unit tests for [ChatNotificationService] companion object — specifically
@@ -24,13 +25,11 @@ class ChatNotificationServiceTest {
                 .getDeclaredField("isAppInForeground")
         field.isAccessible = true
 
-        val atomicBoolean = field.get(null) as java.util.concurrent.atomic.AtomicBoolean
-
         // Reset to known state
-        atomicBoolean.set(false)
+        field.setBoolean(null, false)
         ChatNotificationService.setAppForeground(true)
 
-        assertEquals("flag should be true after setAppForeground(true)", true, atomicBoolean.get())
+        assertEquals("flag should be true after setAppForeground(true)", true, field.getBoolean(null))
     }
 
     @Test
@@ -40,13 +39,11 @@ class ChatNotificationServiceTest {
                 .getDeclaredField("isAppInForeground")
         field.isAccessible = true
 
-        val atomicBoolean = field.get(null) as java.util.concurrent.atomic.AtomicBoolean
-
         // Set to known state
-        atomicBoolean.set(true)
+        field.setBoolean(null, true)
         ChatNotificationService.setAppForeground(false)
 
-        assertEquals("flag should be false after setAppForeground(false)", false, atomicBoolean.get())
+        assertEquals("flag should be false after setAppForeground(false)", false, field.getBoolean(null))
     }
 
     @Test
@@ -56,17 +53,26 @@ class ChatNotificationServiceTest {
                 .getDeclaredField("isAppInForeground")
         field.isAccessible = true
 
-        val atomicBoolean = field.get(null) as java.util.concurrent.atomic.AtomicBoolean
-
         // Ensure it's in a clean state
-        atomicBoolean.set(false)
+        field.setBoolean(null, false)
 
-        assertEquals("initial value should be false", false, atomicBoolean.get())
+        assertEquals("initial value should be false", false, field.getBoolean(null))
     }
 
     @Test
     fun `isAppInForeground field is volatile for thread safety`() {
-        // Obsolete test as the type is now AtomicBoolean which guarantees thread safety implicitly
+        val field =
+            ChatNotificationService::class.java
+                .getDeclaredField("isAppInForeground")
+        val modifiers = field.modifiers
+
+        assertEquals(
+            "isAppInForeground must be @Volatile — it is read from a background " +
+                "coroutine (event collection) and written from the UI thread " +
+                "(setAppForeground called from ChatScreen lifecycle)",
+            true,
+            Modifier.isVolatile(modifiers),
+        )
     }
 
     @Test
@@ -76,12 +82,10 @@ class ChatNotificationServiceTest {
                 .getDeclaredField("isAppInForeground")
         field.isAccessible = true
 
-        val atomicBoolean = field.get(null) as java.util.concurrent.atomic.AtomicBoolean
-
         // Set true twice
         ChatNotificationService.setAppForeground(true)
         ChatNotificationService.setAppForeground(true)
-        assertEquals("flag should remain true after consecutive setAppForeground(true)", true, atomicBoolean.get())
+        assertEquals("flag should remain true after consecutive setAppForeground(true)", true, field.getBoolean(null))
 
         // Set false twice
         ChatNotificationService.setAppForeground(false)
@@ -89,7 +93,7 @@ class ChatNotificationServiceTest {
         assertEquals(
             "flag should remain false after consecutive setAppForeground(false)",
             false,
-            atomicBoolean.get(),
+            field.getBoolean(null),
         )
     }
 }

app/src/test/java/com/m57/hermescontrol/notification/NotificationReplyReceiverTest.kt

@@ -252,27 +252,6 @@ class NotificationReplyReceiverTest {
         verify { mockPendingResult.finish() }
     }
 
-    @Test
-    fun `Room hang triggers timeout and finishes pending result`() {
-        givenValidReply("session-abc", "Hello")
-
-        // Make upsert hang indefinitely
-        coEvery { mockDao.upsert(any<ChatMessageEntity>()) } coAnswers {
-            kotlinx.coroutines.delay(10000)
-        }
-
-        receiver.onReceive(mockContext, mockIntent)
-
-        // Wait longer than the 5-second timeout, but less than the 10-second delay
-        Thread.sleep(6000)
-
-        // Timeout should be caught in catch block and logged
-        verify { android.util.Log.e("NotificationReply", any<String>(), any()) }
-
-        // Pending result must still finish after timeout
-        verify { mockPendingResult.finish() }
-    }
-
     // ── Helpers ────────────────────────────────────────────────────────────
 
     private fun givenValidReply(

app/src/test/java/com/m57/hermescontrol/ui/chat/ChatViewModelTest.kt

@@ -64,8 +64,6 @@ class ChatViewModelTest {
         mockConnectionStatus.value = ConnectionStatus.DISCONNECTED
 
         every { AuthManager.getToken() } returns "test-token"
-        every { AuthManager.isTypingEffectEnabled() } returns true
-        every { AuthManager.getTypingEffectDelayMs() } returns 30
         every { HermesWsClient.events } returns mockEventsFlow
         every { HermesWsClient.connectionStatus } returns mockConnectionStatus
         every { HermesWsClient.connect() } returns Unit

app/src/test/java/com/m57/hermescontrol/ui/connect/ConnectViewModelTest.kt

@@ -48,6 +48,7 @@ class ConnectViewModelTest {
 
         mockApiService = mockk()
         every { ApiClient.hermesApi } returns mockApiService
+        every { ApiClient.createTempService(any(), any(), any()) } returns mockApiService
         every { ApiClient.rebuild() } returns Unit
 
         // Default AuthManager stubs
@@ -219,35 +220,6 @@ class ConnectViewModelTest {
             viewModel.connect()
             advanceUntilIdle()
 
-            verify { AuthManager.setToken(null) }
-
-            val state = viewModel.uiState.value
-            assertFalse(state.isConnecting)
-            assertFalse(state.connectionSuccess)
-            assertEquals("Invalid token (401 Unauthorized)", state.errorMessage)
-        }
-
-    @Test
-    fun testConnect_failure_unauthorized_clearsProfileToken() =
-        runTest {
-            every { AuthManager.getSelectedProfileId() } returns "prof-1"
-
-            val viewModel = ConnectViewModel(mockApp)
-            viewModel.onTokenChange("invalid-token")
-            viewModel.onHostChange("127.0.0.1")
-            viewModel.onPortChange("9119")
-
-            val mockResponse = mockk<Response<StatusResponse>>()
-            every { mockResponse.isSuccessful } returns false
-            every { mockResponse.code() } returns 401
-            coEvery { mockApiService.getStatus() } returns mockResponse
-
-            viewModel.connect()
-            advanceUntilIdle()
-
-            verify { AuthManager.setToken(null) }
-            verify { AuthManager.setProfileToken("prof-1", null) }
-
             val state = viewModel.uiState.value
             assertFalse(state.isConnecting)
             assertFalse(state.connectionSuccess)
@@ -612,14 +584,12 @@ class ConnectViewModelTest {
             val viewModel = ConnectViewModel(mockApp)
             viewModel.onPairingString("hermes://connect?host=192.168.1.1&port=8888&token=abc123")
 
-            // Wait for parsing coroutine to finish
-            advanceUntilIdle()
-
             val state = viewModel.uiState.value
             assertEquals("192.168.1.1", state.host)
             assertEquals("8888", state.port)
             assertEquals("abc123", state.token)
             // Should have triggered connect
+            advanceUntilIdle()
             assertTrue("connection should succeed after pairing", viewModel.uiState.value.connectionSuccess)
         }
 }