Set android:allowBackup="false" to stop the OS from snapshotting
/data/data/com.m57.hermescontrol/ (server_store.json, SQLCipher DB,
EncryptedSharedPreferences tokens/cookies, PersistentCookieJar) into
the user's Google Drive. Removes a credential + chat-history exfil
surface via Google account compromise.
Co-authored-by: M57 <Hy4ri@users.noreply.github.com>
* [feature] issue #634: HTTPS + reverse-proxy server endpoint support
- Add ServerEndpoint model (scheme-aware base URL, resolve/webSocketUrl/relativeRequestPath, cleartext policy)
- AuthManager: baseUrl is canonical; setHost/setPort derive from endpoint; endpointForBuild() for scheme-aware URLs
- ApiClient/CookieManager/HermesWsClient: route through ServerEndpoint (no hardcoded http://)
- Data migration: ServerUrlMigration converts legacy host/port to baseUrl
- UI: Connect/AuthLogin/Settings now use a single Server URL field with transport warning
- Build: ALLOW_CLEARTEXT buildConfigField + manifest placeholder for dev
- Tests: ServerEndpointTest + ServerUrlMigrationTest; adapt existing suite to baseUrl API
Co-Authored-By: M57 <Hy4ri@users.noreply.github.com>
* fix(authlogin): basic-auth derives token automatically, no manual entry
connectBasicAuth() built a fresh OkHttpClient for the password-login call and
a different one for the ws-ticket call, so the Set-Cookie from
/auth/password-login (the session token lives in the cookie, not the JSON body)
never reached /api/auth/ws-ticket. That 401'd the ticket request, returned null,
and the UI fell back to asking the user to paste a token.
Both calls now use the shared OkHttpProvider.probe client (same CookieManager
jar), so the session cookie flows through and the WS ticket mints automatically —
matching the dashboard contract (routes.py: password-login sets Set-Cookie,
ws-ticket requires it).
Add AuthLoginBasicAuthFlowTest proving the cookie propagates on the shared
client (and that ws-ticket 401s without it).
Fixes the basic-auth token prompt reported against issue #634.
* chore: remove TASK-634-TESTS.md (stray task-tracking doc, not part of feature)
* ci: broaden .gitguardian.yml test-file ignores (unit + instrumented + variant dirs)
* feat(authlogin): smart auth-mode detection from /api/status + drop pairing-string login
- Replace 302-sniff probe with authoritative GET /api/status read
(auth_required + auth_providers) to derive DashboardAuthMode.
- Add OAUTH mode (stubbed, 'coming soon' UI, TODO tracks issue #639).
- Render login UI by detected mode: token (loopback), username+password
(basic/gated), or OAuth notice.
- Remove legacy pairing-string box + onPairingString/applyLegacyPairing.
- Extract internal deriveAuthMode() + add 5 unit tests.
Closes nothing; OAuth tracked in #639.
* fix(chat): don't block WS connect on empty token in gated (ticket) mode
connectWebSocket() gated on getToken() != null, correct for loopback
(token) mode but wrong for gated (ticket) mode: the ticket is minted
fresh by HermesWsClient.refreshWsTicketIfNeeded() from the persisted
session cookie, so getToken() is expected empty at connect time. The
early return left the WS unopened -> DISCONNECTED -> chat showed
'reconnect' immediately after basic-auth login.
Only require a non-blank token in non-gated mode.
Fixes#640.
* test: remove onPairingString test cases for deleted pairing-login path
The pairing-string login (onPairingString/applyLegacyPairing) was removed
from ConnectViewModel, so the 5 tests that exercised it (3 in
ConnectViewModelTest, 2 in E2eIntegrationTest) no longer compile. Remove
them. Also drop the now-orphaned connect_pairing_string from values-ko.
Fixes the Unit & Integration Tests CI failure on PR #638.
---------
Co-authored-by: hy4ri <hy4ri@users.noreply.github.com>
Verified against backend source at tip 299e409f15 (tui_gateway/server.py).
- SubscriptionCurrent: add cancel_at_period_end / cancellation_effective_at / cancellation_effective_display (emitted by _serialize_subscription_state, were missing on mobile).
- SubscriptionTier: align to wire shape {tier_id, name, tier_order, dollars_per_month_display, monthly_credits, is_current, is_enabled}; old {tier_name, price, currency, interval} never matched the backend and is unused in-app.
- NOTE: usage.bars UsageBar *_display string model is CORRECT — the backend serializes raw *_usd floats to *_display strings via _serialize_usage_bar before sending. Issue #631 misidentified this as a gap; switching to *_usd would break the bars. No change made there.
Co-authored-by: ronia <ronia@m57>
* feat(billing): adopt subscription.* + usage.bars WS methods (issue #628)
Add Billing/Plan screen + WS client surface for the backend release audit
(hermes-agent 0bf44d557..614dc194e). credits.view was removed upstream;
subscription.{state,preview,change,resume,upgrade} + usage.bars replace it.
- WsMethods: add SUBSCRIPTION_* + USAGE_BARS constants
- BillingModels: @Serializable request/response (snake_case, ignoreUnknownKeys)
- BillingRepository: WS dispatch via HermesWsClient.request + typed decode;
HermesRpcException (-32601) surfaces as featureUnavailable, not a crash
- BillingViewModel: plan/usage load + upgrade/change/resume/cancel actions
- BillingScreen: HermesScaffold composable (plan card, usage bars, actions)
- NavigationKeys + ScreenRegistry + strings (en/ko) wire BillingScreen into
the INSPECT drawer section
Verified: ./gradlew ktlintCheck + compileDebugKotlin both BUILD SUCCESSFUL.
* fix(billing): align models + UI to live gateway wire shape (issue #628)
Live-probed the 6 subscription.* / usage.bars RPCs against the running
backend (hermes-agent dashboard :9119, 2026-07-19). Findings:
- subscription.state returns logged_in / current / tiers / usage (nested),
NOT the legacy subscription_type_id / renews_at fields the models assumed.
- Mutating RPCs (preview/change/resume/upgrade) return ok:false *results*
with error/message/payload (e.g. invalid_token when not portal-authed),
not RPC-level errors — so the ViewModel's HermesRpcException guard never
fired and the screen silently half-decoded null fields.
- subscription.upgrade also returns an idempotency_key not in the model.
Changes:
- BillingModels: re-shape SubscriptionStateResponse around current/tiers/
usage; add ok/error/message/payload envelope + idempotency_key to the
action responses; add SubscriptionCurrent / SubscriptionTier / preview
payload types. All nullable + ignoreUnknownKeys (graceful degrade).
- BillingViewModel: detect ok:false results on every call and route to
featureUnavailable / errorMessage instead of swallowing them.
- BillingScreen: read plan from subscription.current; render a clean
'no active plan' / 'log in to Nous Portal' card on the logged-out path
instead of a broken null plan card.
- strings: add billing_no_active_plan / billing_login_required (en + ko).
Verified: ./gradlew ktlintCheck + compileDebugKotlin both BUILD SUCCESSFUL.
* fix(billing): address independent review (agy) — error routing + icon
Triage of the independent AGY review on PR #629:
Fixed (real issues):
- BillingViewModel: usage.bars RPC failure (-32601) no longer marks the
whole feature unavailable (was blocking the plan card despite the
'non-fatal' comment); it is now correctly non-fatal.
- BillingViewModel: a failed primary subscription load now surfaces
errorMessage even when usage bars loaded (was swallowed by
'sub == null && bars == null').
- BillingScreen: render state.errorMessage as an error card inside
BillingContent so failed mutating actions (upgrade/cancel) are visible
instead of silently disappearing.
- BillingScreen: wrap the dead AccountBalanceWallet expression in a real
Icon() composable in FeatureUnavailableState.
Declined (with rationale, recorded for maintainer):
- Tier-select / upgrade UI (review issue #4): explicitly out of scope per
the PR body — 'Plan-selection UI ... is not built ... left for a
follow-up once backend returns the available plans.'
- Rename snake_case Kotlin props to camelCase (review nit #2): incorrect —
OkHttpProvider uses JsonNamingStrategy.SnakeCase, which maps snake_case
wire keys onto snake_case properties; the props are correct. Fixed the
misleading doc comment instead.
* fix(billing): match REAL logged-in wire shapes + kill null-result crash
The live gateway probe (logged-in Nous Portal session, 2026-07-19) showed
the earlier models assumed the WRONG shape:
- subscription.state.current is {tier_id, tier_name, monthly_credits,
credits_remaining, cycle_ends_at, pending_downgrade_*} — NOT the legacy
subscription_type_id/status/renews_at fields. Screen rendered 'Free / no
plan' for a real logged-in user.
- usage.bars is {available, status, plan_name, plan_bar{remaining_display,
total_display, pct_used, fill_fraction}, topup_bar} — NOT a List<UsageBar>.
- Mutating RPCs return error:'insufficient_scope' when the Portal token
lacks billing:manage scope (ok:false result, not an RPC error).
Crash fix (root cause of 'Billing RPC returned no result payload'):
- BillingRepository.decode() now returns null on a missing/null result
instead of requireNotNull() -> IllegalStateException. All repo methods
return nullable; ViewModel handles null as a non-fatal 'No billing data
returned' instead of crashing.
- BillingScreen.PlanCard / UsageBarRow rewritten to the real fields; the
resume/cancel branch now gates on can_change_plan (no status field exists
on current anymore).
- UsageBarsResponse + UsageBar reshaped to plan_bar/topup_bar; added
billing_credits_remaining / billing_plan / billing_topup strings (en+ko).
Verified: ktlint clean + compileDebugKotlin BUILD SUCCESSFUL. Decode sim
against the captured live responses confirms PlanCard/UsageBarRow/error
paths all resolve with no null-crash.
* fix(billing): decode WS result that arrives as toAny() Map, not JsonElement
Root cause of 'No billing data returned' on a logged-in server: the backend
returns a valid subscription.state result, but HermesWsClient.request()
yields result already converted via JsonElement.toAny() (a Map<String,Any?>),
not a raw JsonElement. BillingRepository.decode() only accepted JsonElement,
so was null and the repo returned null -> ViewModel showed
the generic 'No billing data returned' message. The server DOES have billing
(logged_in:true, tier_name:Free, /usr/bin/bash.10 credits) — the app just couldn't parse it.
Fix: decode() now normalizes whatever arrives — a kotlinx JsonElement OR the
toAny() Map/List — back into a JsonElement via a recursive Any->JsonElement
walk, then deserializes. Both shapes decode correctly now.
This also means the previous 'Billing RPC returned no result payload' crash
and the generic 'no data' message were both symptoms of this same parse gap,
not a missing backend feature.
Verified: ktlint clean + compileDebugKotlin BUILD SUCCESSFUL.
* perf(analytics): preload on launch + split-fetch + disk cache (issue #537)
Cut perceived analytics-tab latency for every user regardless of backend
DB size:
A. Preload analytics (7/30/90) in the background on app launch
(AnalyticsPreloader) so the tab renders instantly when opened.
B. Split the two endpoint fetches: /models (~0.1s, carries the
totals card) now renders immediately while the slow /usage (insights
engine over full message history) streams in behind a placeholder.
C. Persist last successful response to DataStore so a cold app launch
serves last session's data instantly, then refreshes (AnalyticsCacheStore).
Root cause of the slowness is server-side (/api/analytics/usage cold
read of a multi-GB state.db); these client changes make the common
case instant and never block the UI on the slow call.
* fix(analytics): address agy review — null-safety, profile-keyed cache, no main-thread block
Triage of independent agy review (High model) on PR #630:
Fixed (real):
- Blank-on-cold-launch: AnalyticsContent early-returned on null
usage, blanking the tab while the slow /usage call loaded. Now
renders the fast /models half + placeholders; usage-only cards
(totals, daily chart) and Skills/Tools tabs guard on usage != null.
- Profile isolation: cache was keyed by days only -> cross-profile
data leak on switch/cold-start. Now keyed "$days:$profile".
- Main-thread block: ViewModel.init used runBlocking(IO) on the
UI thread at startup. Moved disk-seed into viewModelScope.launch.
- Serialization parity: cache used bare kotlinx Json; switch to
OkHttpProvider.json (ignoreUnknownKeys) so a backend field
addition can't break on-disk decode.
Declined (not introduced by this PR / protected by viewModelScope):
- "safeApiCall swallows CancellationException": pre-existing
NetworkResult.kt behavior; viewModelScope cancellation already
prevents post-clear state updates. Out of scope for this change.
* fix(analytics): crash on tab open — LocalContext is Activity, not Application
AnalyticsScreen cast LocalContext.current as Application, but under
Compose the composition context is the *Activity*, so the cast threw
ClassCastException the moment the tab composed (on tap). Use
.applicationContext, which resolves to the Application instance.
---------
Co-authored-by: M57 <hy4ri@users.noreply.github.com>
* feat(billing): adopt subscription.* + usage.bars WS methods (issue #628)
Add Billing/Plan screen + WS client surface for the backend release audit
(hermes-agent 0bf44d557..614dc194e). credits.view was removed upstream;
subscription.{state,preview,change,resume,upgrade} + usage.bars replace it.
- WsMethods: add SUBSCRIPTION_* + USAGE_BARS constants
- BillingModels: @Serializable request/response (snake_case, ignoreUnknownKeys)
- BillingRepository: WS dispatch via HermesWsClient.request + typed decode;
HermesRpcException (-32601) surfaces as featureUnavailable, not a crash
- BillingViewModel: plan/usage load + upgrade/change/resume/cancel actions
- BillingScreen: HermesScaffold composable (plan card, usage bars, actions)
- NavigationKeys + ScreenRegistry + strings (en/ko) wire BillingScreen into
the INSPECT drawer section
Verified: ./gradlew ktlintCheck + compileDebugKotlin both BUILD SUCCESSFUL.
* fix(billing): align models + UI to live gateway wire shape (issue #628)
Live-probed the 6 subscription.* / usage.bars RPCs against the running
backend (hermes-agent dashboard :9119, 2026-07-19). Findings:
- subscription.state returns logged_in / current / tiers / usage (nested),
NOT the legacy subscription_type_id / renews_at fields the models assumed.
- Mutating RPCs (preview/change/resume/upgrade) return ok:false *results*
with error/message/payload (e.g. invalid_token when not portal-authed),
not RPC-level errors — so the ViewModel's HermesRpcException guard never
fired and the screen silently half-decoded null fields.
- subscription.upgrade also returns an idempotency_key not in the model.
Changes:
- BillingModels: re-shape SubscriptionStateResponse around current/tiers/
usage; add ok/error/message/payload envelope + idempotency_key to the
action responses; add SubscriptionCurrent / SubscriptionTier / preview
payload types. All nullable + ignoreUnknownKeys (graceful degrade).
- BillingViewModel: detect ok:false results on every call and route to
featureUnavailable / errorMessage instead of swallowing them.
- BillingScreen: read plan from subscription.current; render a clean
'no active plan' / 'log in to Nous Portal' card on the logged-out path
instead of a broken null plan card.
- strings: add billing_no_active_plan / billing_login_required (en + ko).
Verified: ./gradlew ktlintCheck + compileDebugKotlin both BUILD SUCCESSFUL.
* fix(billing): address independent review (agy) — error routing + icon
Triage of the independent AGY review on PR #629:
Fixed (real issues):
- BillingViewModel: usage.bars RPC failure (-32601) no longer marks the
whole feature unavailable (was blocking the plan card despite the
'non-fatal' comment); it is now correctly non-fatal.
- BillingViewModel: a failed primary subscription load now surfaces
errorMessage even when usage bars loaded (was swallowed by
'sub == null && bars == null').
- BillingScreen: render state.errorMessage as an error card inside
BillingContent so failed mutating actions (upgrade/cancel) are visible
instead of silently disappearing.
- BillingScreen: wrap the dead AccountBalanceWallet expression in a real
Icon() composable in FeatureUnavailableState.
Declined (with rationale, recorded for maintainer):
- Tier-select / upgrade UI (review issue #4): explicitly out of scope per
the PR body — 'Plan-selection UI ... is not built ... left for a
follow-up once backend returns the available plans.'
- Rename snake_case Kotlin props to camelCase (review nit #2): incorrect —
OkHttpProvider uses JsonNamingStrategy.SnakeCase, which maps snake_case
wire keys onto snake_case properties; the props are correct. Fixed the
misleading doc comment instead.
* fix(billing): match REAL logged-in wire shapes + kill null-result crash
The live gateway probe (logged-in Nous Portal session, 2026-07-19) showed
the earlier models assumed the WRONG shape:
- subscription.state.current is {tier_id, tier_name, monthly_credits,
credits_remaining, cycle_ends_at, pending_downgrade_*} — NOT the legacy
subscription_type_id/status/renews_at fields. Screen rendered 'Free / no
plan' for a real logged-in user.
- usage.bars is {available, status, plan_name, plan_bar{remaining_display,
total_display, pct_used, fill_fraction}, topup_bar} — NOT a List<UsageBar>.
- Mutating RPCs return error:'insufficient_scope' when the Portal token
lacks billing:manage scope (ok:false result, not an RPC error).
Crash fix (root cause of 'Billing RPC returned no result payload'):
- BillingRepository.decode() now returns null on a missing/null result
instead of requireNotNull() -> IllegalStateException. All repo methods
return nullable; ViewModel handles null as a non-fatal 'No billing data
returned' instead of crashing.
- BillingScreen.PlanCard / UsageBarRow rewritten to the real fields; the
resume/cancel branch now gates on can_change_plan (no status field exists
on current anymore).
- UsageBarsResponse + UsageBar reshaped to plan_bar/topup_bar; added
billing_credits_remaining / billing_plan / billing_topup strings (en+ko).
Verified: ktlint clean + compileDebugKotlin BUILD SUCCESSFUL. Decode sim
against the captured live responses confirms PlanCard/UsageBarRow/error
paths all resolve with no null-crash.
* fix(billing): decode WS result that arrives as toAny() Map, not JsonElement
Root cause of 'No billing data returned' on a logged-in server: the backend
returns a valid subscription.state result, but HermesWsClient.request()
yields result already converted via JsonElement.toAny() (a Map<String,Any?>),
not a raw JsonElement. BillingRepository.decode() only accepted JsonElement,
so was null and the repo returned null -> ViewModel showed
the generic 'No billing data returned' message. The server DOES have billing
(logged_in:true, tier_name:Free, /usr/bin/bash.10 credits) — the app just couldn't parse it.
Fix: decode() now normalizes whatever arrives — a kotlinx JsonElement OR the
toAny() Map/List — back into a JsonElement via a recursive Any->JsonElement
walk, then deserializes. Both shapes decode correctly now.
This also means the previous 'Billing RPC returned no result payload' crash
and the generic 'no data' message were both symptoms of this same parse gap,
not a missing backend feature.
Verified: ktlint clean + compileDebugKotlin BUILD SUCCESSFUL.
---------
Co-authored-by: M57 <hy4ri@users.noreply.github.com>
Turn dead-end empty states into on-ramps by wiring the existing
EmptyState actionLabel/onAction params to real next actions.
Screens wired (real, existing actions):
- Skills (installed): Browse skill hub -> setViewMode(HUB)
- Skills (hub): Retry search -> searchHub(hubQuery)
- Cron Jobs: Create your first job -> openNewJobDialog()
- MCP servers: Add a server -> toggleAddForm() (literal moved to strings.xml)
- Webhooks: Create subscription -> showCreateDialog() (literal moved to strings.xml)
- Channels: Connect a Telegram channel -> startTelegramOnboarding()
- Model: Configure model -> navigateTo(SettingsConnection)
- Sessions (history): Start a new chat -> navigateTo(ChatScreen)
- Analytics: Explore Skills or Cron jobs -> navigateTo(SkillsScreen)
- Keys (no match): Clear search -> query = ""
All new labels use strings.xml (empty_action_* / screenname_empty_*).
Deviations from issue (documented honestly):
- Toolsets, Profiles, Plugins keep Refresh. No in-app create path exists
(toolsets are server-defined toggles; profiles/plugins have no create
dialog wired in UI). Refresh is the correct recovery there, not a fake
'create' CTA. Flagged for follow-up if create flows get built.
- Skills: edited the real private InstalledSkillsView in SkillsScreen.kt;
the duplicate internal one in InstalledSkillsTab.kt is dead code.
Verified: ktlintCheck clean, assembleDebug green.
Co-authored-by: M57 <hy4ri@users.noreply.github.com>
Co-authored-by: Ronia <ronia@hermes>
Removed docs/color-hardcoded-audit.md per request. Replaced 2 hardcoded
Color literals with theme tokens; added CI guard blocking new literals.
Co-authored-by: Hy4ri <hy4ri@users.noreply.github.com>
Replaces the fragile DRAWER_GESTURE_SCREENS global set + defensive
LaunchedEffect(snapTo(Closed)) + closeDrawer callback workaround with a
single source of truth: each screen declares its drawer-gesture preference
via HermesScaffold's new drawerGesturesEnabled parameter (default true).
Architecture:
- DrawerGestureController holds the active gesture state. HermesScaffold
reconciles each screen's preference into it via SideEffect; when a screen
opts out while the drawer is open, the controller closes the drawer itself.
- LocalDrawerGestureController CompositionLocal flows the controller from
MainNavigation down to ModalNavigationDrawer, which reads .enabled and
passes it to Material's gesturesEnabled parameter.
- DisableDrawerGestures() helper for entry screens that don't use
HermesScaffold (Landing, AuthLogin, PairingCodeEntry).
- All 6 Settings drill-down sub-pages pass drawerGesturesEnabled = false.
- NavigationController.closeDrawer removed; navigateTo no longer needs a
synchronous drawer-dismiss hook.
Removes: DRAWER_GESTURE_SCREENS set, both LaunchedEffect(gesturesEnabled)
and LaunchedEffect(drawerGesturesEnabled) blocks, drawerGesturesEnabled
local state, closeDrawer callback on NavigationController.
Fixes the recurring drawer-scrim stuck-open bug class (PRs #445, #454, #455).
Verified: ktlintCheck, assembleDebug, testDebugUnitTest all green locally.
Co-authored-by: Hy4ri <hy4ri@users.noreply.github.com>
Split the 2,267-line ChatScreen.kt into 11 single-purpose files under
ui/chat/components/, keeping ChatScreen.kt as a thin (~530 line)
entry compositor that delegates rendering to the new components.
Files extracted:
- ChatConnectionBanner.kt — top banner (reconnecting/disconnected/auth-expired)
- ChatMessageList.kt — message list + search bar overlay + empty state
- ChatComposer.kt — input bar + attachment chips + slash dropdown
- ChatSearchBar.kt — CompactSearchInput + SearchBarRow
- ChatDialogs.kt — ClarifyDialog, SudoPromptDialog, SecretPromptDialog, ReloginDialog
- ChatIndicators.kt — ThinkingIndicator, ReasoningIndicator, SubagentIndicatorRow
- ChatScrollFab.kt — scrollToBottom utils + FAB
- ChatLifecycleEffects.kt — session switch, lifecycle observer, auto-scroll, error snackbars
- ChatReactions.kt — ReactionHeartsOverlay + FloatingHeart animation
- ChatStreaming.kt — StreamingBubbleWithTypingEffect
- ChatLoadingOverlay.kt — full-screen semi-transparent loading overlay
No behavioral change. All composables are public where they need to be
called from ChatScreen, otherwise keep their original visibility.
Unblocks #583 and #584 which were previously too risky to attempt in
the 2.2k-line file.
Co-authored-by: M57 <hy4ri@users.noreply.github.com>
Independently verified dead weight: computed defined vs used set across
all source sets (R.string.* in Kotlin + @string/* in XML/manifest).
Zero references in app/src/main, androidTest, or test fixtures.
- values/strings.xml: -77 unused <string> entries (818 -> 741)
- values-ko/strings.xml: -67 corresponding entries (704 -> 637)
Build: ./gradlew assembleDebug BUILD SUCCESSFUL (no missing-resource errors).
True KO translation gap after prune = 741 used EN - 637 translated KO = 104
(previously mis-stated as 114; the 67 removed were never translated anyway).
Co-authored-by: M57 <hy4ri@users.noreply.github.com>
Add ToastHost interface + override keyword to the 3 ViewModels that
declared clearToast() without implementing the interface. This aligns
them with the other 17 ViewModels and enables polymorphic substitution
where ToastHost is expected.
Fixes#614
Co-authored-by: M57 <hy4ri@users.noreply.github.com>
* feat: auto-scroll long chat title once on load + on tap
* fix: resolve state delegate + suspension compile errors in AutoScrollingTitleText
* fix: use Int scroll offset for animateScrollTo
* fix: measure real container width for title marquee (was always Infinity)
* fix: ease the title marquee scroll (FastOutSlowInEasing + glided return)
* fix: address agy review — cancel overlapping scrolls + one-shot on-load guard + clickable on box
* fix(ui): smooth out top app bar collapse transition
Use dynamic layout padding based on scroll offset to prevent blank gap at the top of content when app bar collapses.
---------
Co-authored-by: M57 <hy4ri@users.noreply.github.com>
* feat(#606): support auth mode + bearer token when adding HTTP MCP servers
- Extend AddMcpServerRequest with auth (none|header|oauth) and bearerToken
- Add auth mode FilterChip selector in HTTP add-server dialog
- Conditionally show masked bearer token field when auth == header
- Wire new fields through McpServersViewModel request builder
Backend contract: exactly one of url/command required; bearer_token
requires auth == "header"; args/env only for stdio. SnakeCase naming
strategy auto-serializes bearerToken -> bearer_token.
Fixes#606
* fix(#606): address agy review — remember PasswordVisualTransformation + FlowRow for auth chips
- Wrap PasswordVisualTransformation in remember {} to avoid per-recomposition allocation
- Use FlowRow for the 3 auth-mode FilterChips so they wrap on narrow screens instead of overflowing
* refactor(settings): drill-down navigation replacing tabbed layout
Replaces the 4-tab settings layout with a native Android-style drill-down:
a single category list (SettingsScreen) where each row pushes a dedicated
sub-page onto the Navigation3 back stack (SettingsConnection / Appearance /
Chat / NavBar / Behavior / About). Each sub-page is its own NavKey destination
registered in Navigation.kt and reuses the existing section composables.
- SettingsScreen becomes the category list with icon + label + summary
(Appearance row shows live theme + language, e.g. "Dark · 한국어").
- New SettingsSubPages.kt hosts the 6 full-screen sub-pages.
- AboutSection promoted out of SettingsScreen into its own sub-page.
- SettingsViewModel remains the single source of truth; no persistence changes.
- Adds settings_summary_* strings for list subtitles.
Consumes the in-app language switcher from the prior commit (AppearancePage
passes appLanguage through to AppearanceSection).
* [bug] fix settings sub-page back button opening drawer on first tap
The ModalNavigationDrawer wraps the whole app and stays gesture-enabled on
the Settings root (a DRAWER_GESTURE_SCREEN). Drilling into a sub-page
(SettingsConnection/Appearance/Chat/NavBar/Behavior/About) disables gestures,
but the existing LaunchedEffect only snapped the drawer closed when it was
already isOpen. The drawer's scrim surface lingered during the transition and
intercepted the first back-button tap, sliding the sidebar open instead of
navigating back.
Now snapTo(Closed) unconditionally whenever gestures are disabled — a safe
no-op when already closed — so the sub-page back button works on the first tap.
* [bug] fix settings sub-page back button opening drawer (gesture-surface race)
The first "back" tap on a settings sub-page opened the sidebar instead of
navigating back. Root cause: Settings root is a gesture-enabled drawer screen,
and the sub-pages are the first destinations ever drilled down from it. When
navigating in, ModalNavigationDrawer's gesture interceptor surface lingered
for a frame (gesture -> non-gesture transition), so the top-left tap was
consumed by the drawer instead of the Back IconButton. The previous snapTo
fix only reset drawer *state*, not the gesture layer, so it didn't help.
Fix: NavigationController now holds a closeDrawer hook (set by MainNavigation)
and invokes it synchronously inside navigateTo() when pushing a non-primary
sub-page. The drawer is dismissed in the same tap handler that triggers the
navigation, before any recomposition, so the sub-page is never tappable while
the gesture surface is still mounted. The LaunchedEffect(gesturesEnabled)
snapTo remains as a backstop for non-navigateTo entries.
* fix(#603): delay drawer gesture activation to prevent residual swipe
* fix(#603): fix settings back navigation and drawer auto-open
---------
Co-authored-by: hy4ri <hy4ri@users.noreply.github.com>
Add a Language selector to Settings → Appearance that overrides the app
display language independent of the device locale. Persists a BCP-47 code
in ServerStoreState.appLanguage; MainActivity.attachBaseContext applies it
via a ContextWrapper (works on minSdk 26, no AppCompat dependency needed
since the Activity is a plain ComponentActivity). Selecting a language
recreates the activity so resources re-resolve immediately.
Includes System default / English / 한국어 options, plus a unit test for
the locale-code resolver.
Note: the new string keys (settings_item_language, language_system,
language_english, language_korean) should be backfilled into values-ko
once PR #602 lands.
Co-authored-by: hy4ri <hy4ri@users.noreply.github.com>
Allow the chat input to be sent while the agent is mid-turn or awaiting
approval. The backend's prompt.submit busy-input policy already queues any
prompt that lands during a running turn (tui_gateway/server.py:_handle_busy_submit)
and drains it as the next turn, so the message is never dropped.
- ChatInputPolicy: pure, testable send/placeholder decision logic
- ChatScreen: canSend stays enabled while typing/approving; placeholder shows
'Queued — sends when agent is free' when text is present during a busy turn
- ChatInputPolicyTest: truth-table covering typing, approval-pending,
disconnected, empty, attachment, and slash-command cases
- strings: chat_input_placeholder_queue
Note: this supersedes the Genesi599 fork's approach (dispatchViaRpc('queue ...')),
which double-submits and relies on a 4018-prone command.dispatch path. The
backend-queued prompt.submit path is the correct, single-submission contract.
Co-authored-by: M57 <m57@hermes-control.app>
* fix(#589): show in-session model picker when user sends /model
Typing a bare '/model' in the chat composer now opens the model picker so
the user can hot-swap the CURRENT session's model via the existing
slash-command path, instead of hand-typing the provider/model string.
- ChatViewModel.preloadModelOptions() caches GET /api/model/options at
GatewayReady so the picker opens instantly; falls back to on-demand
refresh if opened before preload finishes.
- sendMessage() intercepts a bare '/model' (no arg) -> showModelPicker=true
instead of dispatching; a typed '/model provider/model' still dispatches
via handleSlashCommand.
- sendSlashModel() routes through command.dispatch with session_id, so the
swap is session-scoped (not the global POST /api/model/set).
- Extracted ModelPickerDialog into ui/model/components and reused by both
ModelScreen and ChatScreen (adds loading + empty states).
- Added a top-bar model chip (current session model label) that opens the
same picker.
- Added unit tests: bare /model opens picker, picker selection hot-swaps via
slash dispatch with session_id, typed /model with arg dispatches directly.
Note: CI shows 2 pre-existing test failures (ChatViewModelTest.testToggleSearch,
HermesWsClientTest.testAutoReconnect) that also fail on a clean main full
suite (MockK static-mock leakage between classes). Unrelated to this change;
compile + ktlint + the 3 new tests pass.
* fix(#589): use backend-valid session-scoped /model command syntax
The model picker now dispatches the canonical backend command form
'/model <model> --provider <slug> --session' instead of the unsupported
'provider/model' slash form. The '--session' flag keeps the switch scoped
to the current chat only (per-session override) and never writes the global
model config, which matches the backend model-switch contract.
- sendSlashModel builds '/model $model --provider $provider --session'.
- Updated unit tests to assert the corrected arg payload
('gpt-4o --provider openai --session') and the fully-typed dispatch path.
* fix(#589): add pinned-models section to in-session model picker
- ModelPickerDialog now renders a Pinned section (mirrors global model screen)
- search filter matches model names too, not just provider name/slug
- ChatUiState gains modelPickerPinned, fed from AuthManager.getPinnedModels()
- top-bar model chip removed; picker opens on /model only
- test mock for getPinnedModels() added
* fix(#589): route /model via prompt.submit instead of command.dispatch (resolves 4018)
/model is a real backend slash command handled in the backend's message
pipeline (_handle_message -> _handle_model_command), so it must arrive as
a normal prompt.submit message, not the command.dispatch RPC (which only
knows quick/plugin/bundle/skill commands and 4018s on /model).
- SlashCommandDispatcher: add SlashResult.ModelSwitch, map /model -> ModelSwitch
- ChatViewModel: handle ModelSwitch -> handleModelSwitch() sends via
WsMethods.PROMPT_SUBMIT with {session_id, text}
- Tests: rewrite the two /model tests to assert prompt.submit (previously
asserted the buggy command.dispatch path); add /model -> ModelSwitch test
Independent agy review: APPROVE, no blocking issues.
* fix(#589): route /model via slash.exec (correct transport; prompt.submit made LLM treat it as text)
Earlier attempt routed /model through prompt.submit, but the TUI gateway's
prompt.submit handler does NOT parse slash commands — it runs the text as a
normal agent turn, so the LLM received '/model ...' as a user message (the
exact reported bug). The correct RPC is slash.exec, which runs the command
through the slash worker and _mirror_slash_side_effects -> _apply_model_switch
to hot-swap the live session model. command.dispatch is also wrong (only knows
quick/plugin/bundle/skill commands -> 4018).
- WsMethods: add SLASH_EXEC = "slash.exec"
- ChatViewModel.handleModelSwitch: send slash.exec with {command, session_id}
(previously prompt.submit with {text}); corrected doc comment
- SlashCommandDispatcher: corrected comments (slash.exec, not prompt.submit)
- ChatViewModelTest: rewrite both /model tests to assert slash.exec with the
/model <model> --provider <slug> --session command string
- SlashCommandDispatcherTest: /model -> ModelSwitch already covered
Verified against hermes-agent tui_gateway/server.py: slash.exec (L13190) ->
worker.run + _mirror_slash_side_effects (L13299) -> _apply_model_switch (L13118);
parse_model_flags accepts --provider/--session (hermes_cli/model_switch.py:355).
Independent agy review of the prior attempt: APPROVE (the wrong-transport
assumption was the author's, not agy's).
* fix(#589): route /model via config.set key=model (slash.exec 4001'd; prompt.submit made LLM treat it as text)
Third transport attempt, now verified against the gateway source:
- prompt.submit: gateway runs text as a normal agent turn -> LLM sees '/model'
as a message (the original reported bug). WRONG.
- slash.exec: gateway returns 4001 'session not found'. The slash worker path
resolves the session differently / requires agent-built state the mobile
session isn't in at switch time. WRONG.
- config.set key=model: gateway (server.py config.set L10253) routes key=='model'
straight to _apply_model_switch using the SAME _sessions.get(session_id)
lookup that the working command.dispatch uses. CORRECT.
sendSlashModel still builds '/model <model> --provider <slug> --session';
parse_model_flags (hermes_cli/model_switch.py:355) extracts model/provider/
session from it. handleModelSwitch now sends config.set {key:model, value:
command, session_id}.
- WsMethods: add CONFIG_SET = 'config.set'
- ChatViewModel.handleModelSwitch: config.set instead of slash.exec
- SlashCommandDispatcher: comments updated (config.set, not slash.exec)
- ChatViewModelTest: both /model tests assert config.set key=model + command
- also fixes the MockK testToggleSearch flake by preloading byte-buddy agent
via JAVA_TOOL_OPTIONS locally (container blocks JVM self-attach)
* fix(#589): strip /model prefix before config.set key=model (5001 'model names can't have spaces')
config.set key=model passes the value DIRECTLY to parse_model_flags — it does
NOT strip a leading '/model' the way slash.exec / prompt.submit do. Sending
'/model <model> ...' made parse_model_flags treat '/model <model>' as the
model name (contains a space) -> 5001.
handleModelSwitch now strips the '/model' prefix and sends the bare spec
'<model> --provider <slug> --session', matching the TUI client's
modelValueForConfigSet (ui-tui session.ts:23) used by useMainApp.ts:123.
- ChatViewModel.handleModelSwitch: spec = command.removePrefix('/model').trim()
- ChatViewModelTest: assert bare spec 'gpt-4o --provider openai --session'
- comment updated
* fix(#589): strip /model prefix case-insensitively before config.set
SlashCommandDispatcher and isModelPickerCommand match /model
case-insensitively, but handleModelSwitch used removePrefix("/model")
(case-sensitive). A typed /MODEL ... forwarded the literal slash prefix
to config.set and the backend's parse_model_flags wouldn't recognize it
— silent hot-swap failure.
Use startsWith("/model", ignoreCase=true) + substring(6) so any casing
is stripped. Added a regression test asserting /MODEL does not forward a
leading slash.
* fix(test): inject searchDispatcher to fix MockKException in testToggleSearch
---------
Co-authored-by: M57 <m57@hermes-control.app>
* feat(#530): add SessionSearch models + searchSessions endpoint + contract tests
* feat(#530): wire server-backed search into Sessions screen (debounce + render)
* style(#530): ktlint import ordering on HermesApiService
* fix(#530): ktlint-clean overlap wrap + map search snippet to title
* fix(#530): map search snippet to title so results show + highlight
* fix(#530): render search hits as honest result cards instead of faking title
Backend SessionSearchResult carries no session name (only snippet + metadata),
so mapping snippet->title made the card show raw excerpt as the title. Instead,
render a dedicated SearchResultCard: 'Match' label + session id, highlighted
snippet as body, and source/model/played-at chips. Added SessionInfo.model and
a friendly relative-time formatter. ktlint clean, compileDebugKotlin + unit
tests pass.
* fix(#530): strip JSON from search snippet + tighten result card padding
* fix(#530): strip FTS highlight markers from search snippet on client
agy's backend change re-wraps matched terms in >>>term<<< markers inside the
clean snippet, but the mobile highlights by raw query term and never consumed
those markers — so literal '>>>'/'<<<' would render in result text. Strip the
markers before passing the snippet to highlightText so the query highlight
still works on clean text.
* fix(#530): integrate tree-flattening hierarchy with search modes in SessionsScreen
* fix(#530): fix test assertion and mock ApiClient in SessionsViewModelTest
* fix(#530): resolve compose PaddingValues compile error and fix slash-preservation test path
* fix(#530): clean search snippet from JSON payload and add unit test
---------
Co-authored-by: M57 <m57@hermes-control.app>
The backend terminal tool (tools/terminal_tool.py) returns a single merged
'output' string plus 'exit_code' and 'error' — never 'stdout'/'stderr'.
ChatBubble was reading the non-existent 'stdout' key, so command output was
silently dropped and only the Duration footer showed.
- Parse 'output' as canonical; keep legacy 'stdout'/'stderr' fallback for
backward compat.
- Route terminal output into mainOutput so it renders like other tool bubbles.
- Surface non-zero exit codes as an error line when no 'error' string is set.
- Remove dead 'stderr' render branch.
- Update ToolBubbleParsingTest to assert the real payload shape (incl. the
exact issue-585 'echo hellp' sample) and add regression cases.
Co-authored-by: hy4ri <hy4ri@users.noreply.github.com>
* refactor(theme): split per-preset color schemes into theme/presets/
Move each ThemePreset's ColorScheme + status colors into its own file under
theme/presets/ (Default, Monochrome, Gruvbox, Catppuccin, Amoled, NeonNoir).
Theme.kt becomes a thin dispatcher via resolveColorScheme/resolveStatusColors,
making individual themes far easier to create and edit.
- AMOLED keeps a dark-only scheme (falls back to default light)
- MONOCHROME/AMOLED reuse default status colors (no bespoke semantic set)
- aligned to current Voltage Purple palette + on* status-color params
Verified: ktlint clean, compileDebugKotlin passes.
* refactor(theme): make all preset files uniform 4-token shape
Every preset file now exports XxxDarkColorScheme / XxxLightColorScheme /
XxxDarkStatusColors / XxxLightStatusColors so they share one shape and import
order. MONOCHROME + AMOLED alias the default status colors; AMOLED also gets an
explicit AmoledLightColorScheme = DefaultLightColorScheme alias.
Theme.kt dispatcher is now a pure lookup (no special-casing) for both color
scheme and status colors. No runtime behavior change — pure structural cleanup.
Verified: ktlint clean, compileDebugKotlin passes.
* docs(theme): add THEMES.md documenting the per-preset convention
Co-located in theme/ — covers layout, the uniform 4-token shape, the pure
lookup dispatcher, why DEFAULT uses design tokens (intentional, not a bug),
and a step-by-step 'add a new theme' recipe.
Verified: ktlint clean.
---------
Co-authored-by: M57 <m57@hermes-control.app>
* fix(#584): follow stream without freezing (persistent snapshotFlow)
The auto-scroll LaunchedEffect was keyed on (messages.size,
streamingMessage?.content?.length, isThinking) — those change on EVERY
streamed token, so the effect restarted per token and cancelled the
in-flight animateScrollToItem, leaving the view stuck/frozen mid-stream.
Replace it with a single persistent LaunchedEffect(Unit) + snapshotFlow +
collectLatest. The streaming follow now uses an instant scrollToBottom
(animated=false) which is idempotent per token and has no animation to
cancel; a discrete new message arriving while at the bottom still animates.
Because the effect runs once, mirror the params through rememberUpdatedState
and read them live inside snapshotFlow/collectLatest so the flow actually
fires per token and session-switch detection uses the current session id
(rather than stale first-composition closure captures).
* fix(#584): leave scroll free during streaming (no auto-follow)
m57 follow-up: the previous fix stopped the freeze but still force-pinned
to the bottom while streaming. Now, while a message is streaming, the
scroll is left completely free — no auto-follow of the streaming message —
so the user can scroll up/down to read while it generates.
Auto-scroll only on explicit actions (send / FAB / session switch) and when
a discrete non-streaming message lands while already pinned to the bottom.
streamingMessage is dropped from the snapshotFlow keys so the flow no
longer churns per token.
---------
Co-authored-by: M57 <m57@hermes-control.app>
* fix(#583): align last message bottom to viewport on scroll-to-bottom
animateScrollToItem(lastIndex) only top-aligns the last item, so when the
last message is taller than the viewport its bottom is clipped below the fold.
Replace the 4 scroll-to-bottom call sites (send auto-scroll, session-switch,
auto-scroll-on-new-message, and the FAB) with a scrollToBottom() helper that
top-aligns then scrolls the exact remaining delta so the last item's bottom
edge is visible.
Using the remaining delta (not scrollOffset=Int.MAX_VALUE) avoids integer
overflow in the internal scroll-position clamp, which would wrap the offset to
0 and scroll back to the top for tall items.
* fix(#583): keep smooth animation on scroll-to-bottom when animated
agy review (PR #590) flagged that the animated path did an instant
scrollToItem then only animated the small remaining delta, causing a hard
jump on FAB / send clicks instead of a smooth scroll. Use animateScrollToItem
when animated, scrollToItem when instant.
---------
Co-authored-by: M57 <m57@hermes-control.app>
* fix(#587): forward session_id on image.attach_bytes and await the RPC
The mobile image-send path called image.attach_bytes without the required
session_id field, so the gateway resolver (_sess) returned
JsonRpcError(code=4001, message=session not found).
- Add "session_id" to agentSessionId to the image.attach_bytes params
(desktop reference client already does this; mobile was the outlier).
- Switch the image branch from fire-and-forget wsClient.send to the
awaited sendRpcAndAwait() layer (same awaited-RPC path used for
slash commands, #526). This also removes the race where prompt.submit
could fire before the image was staged, and surfaces RPC errors
instead of silently swallowing them.
Root cause verified against tui_gateway/server.py _sess() and the
desktop use-prompt-actions reference. ChatViewModel.kt passes ktlintCheck.
Closes#587
* fix(#587): also forward session_id on file.attach (same 4001 bug)
The image branch was fixed in the prior commit, but the file branch
(sendMessage else -> file.attach) omitted session_id too, so non-image
file uploads also hit JsonRpcError(code=4001, "session not found").
The backend file.attach handler (tui_gateway/server.py _sess) requires
session_id exactly like image.attach_bytes.
Add "session_id" to agentSessionId to the file.attach params, and
refresh the sendMessage flow comment (no longer fire-and-forget).
Verified by source: both image.attach_bytes and file.attach call the
same _sess resolver. Camera capture is unaffected (it produces an
image/jpeg attachment, which already routes through the fixed
image.attach_bytes branch).
ChatViewModel.kt passes ktlintCheck.
* test(#587): regression for image.attach_bytes session_id
Adds testSendMessage_imageAttachment_sendsSessionId, which proves the
image-attach RPC is issued with session_id (the missing field that
caused JsonRpcError 4001 'session not found').
Root blocker found: readContentUriBase64 constructs
android.util.Base64OutputStream, which throws MockK's 'Stub!' on the
JVM test, making the read return null and the image branch never run.
Mocking the Base64OutputStream constructor lets the read succeed so the
request(any(), capture(paramsSlot), any()) stub captures the params and
the session_id assertion holds.
Full ChatViewModelTest suite passes; ktlint-clean.
---------
Co-authored-by: M57 <m57@hermes-control.app>
* fix(#575): drop description text from slash-command suggestions
* fix(#575): show /stop and /interrupt in slash-command menu
* fix(#574): hide desktop/CLI-only slash commands from mobile suggestion menu
Recreate hiddenSlashDisplay blocklist removed in 1f322e3 with the 33
cli_only/TUI-only commands that don't function on mobile (issue #574).
/stop and /interrupt intentionally remain visible (they work on mobile, #575).
---------
Co-authored-by: M57 <hy4ri@users.noreply.github.com>
Co-authored-by: M57 <m57@hermes-control.app>
* fix(#575): drop description text from slash-command suggestions
* fix(#575): show /stop and /interrupt in slash-command menu
---------
Co-authored-by: M57 <hy4ri@users.noreply.github.com>
* fix(#572): clarify Dismiss now informs agent instead of silently dropping
* fix(#572): clarify Dismiss rejects the question (no answer) instead of telling agent to proceed
---------
Co-authored-by: M57 <m57@hermes-control.app>
* fix: refresh loopback dashboard token after restart
The gateway regenerates its ephemeral session token on every restart, so the
token the app persisted becomes stale. After a dashboard restart REST calls
401 and the WebSocket auto-reconnect loop hangs in AUTH_EXPIRED until the user
manually re-authenticates.
- Add DashboardSessionTokenRefresher: re-reads the injected
window.__HERMES_SESSION_TOKEN__ from the dashboard SPA and writes it back to
AuthManager.
- TokenRefreshAuthenticator: on a 401 retry, scrape a fresh token from the
dashboard and retry instead of giving up.
- HermesWsClient: refresh the token before each non-gated WebSocket handshake so
reconnects don't get stuck on a stale token; guard serverStore read against
IllegalStateException.
Covers the loopback (--insecure) deployment path; gated/ticket mode is untouched.
* fix: harden dashboard token refresher (sync, body cap, blank-token test)
Second-opinion review flagged robustness gaps (no correctness/security
regressions in the happy path):
- DashboardSessionTokenRefresher.refresh(): @Synchronized to dedupe
concurrent 401 / reconnect storms instead of each firing its own GET.
- Cap SPA HTML read at 64 KiB before regex scan (defensive against OOM on
low-end devices); we only need the injected token near the document top.
- HermesWsClient: log (not silently swallow) the transient uninitialized
serverStore case so a real misconfig is still visible.
- Add test: blank-injected token returns null.
---------
Co-authored-by: M57 <m57@hermes-control.app>
* feat(#538): wire tool.progress/generating + subagent.* events into chat
* fix(#538): remove subagent indicator on subagent.complete so it doesn't linger
* style(#538): drop dead Elvis on non-nullable event.text in onMessageComplete
---------
Co-authored-by: M57 <m57@hermes-control.app>
* feat(#533): add session.branch (fork a conversation) to mobile
The gateway already supports session.branch (tui_gateway/server.py), but
the mobile had no client surface. This adds:
- WsMethods.SESSION_BRANCH = "session.branch"
- A Branch (CallSplit) action on each session card that forks it via the
session.branch WS RPC with the source session_id (and optional name).
- branchedSessionId state -> SessionsScreen navigates to the freshly
forked session on success; RpcError -> toast; spinner while branching.
- SessionsViewModelTest (4 tests): forwards session_id, forwards name,
sets branchedSessionId on success, toast+no-branch on RpcError, and
consumeBranchedSession clears the pending id.
Verified against the live gateway contract: session.branch expects
{session_id, name?} and returns {session_id, title, parent}. Local
testDebugUnitTest: 4/4 pass, ktlint clean.
* refactor(#533): make /fork work via chat instead of a session-menu button
Per review feedback: the session.branch surface belongs in the chat
composer, not the session list menu.
- SlashCommandDispatcher: /fork and /branch -> new SlashResult.SessionBranch.
- ChatViewModel: handles SessionBranch by sending session.branch with the
active runtime session id (optional arg = branch title), and on the RPC
result switches the current session to the new forked one (mirrors the
SESSION_CREATE handler). This fixes /fork, which previously fell through to
command.dispatch and 4018'd (backend only knows session.branch).
- Removed the Branch (CallSplit) button + navigation LaunchedEffect from
SessionsScreen/SessionsViewModel (reverted those two files to main) and
dropped the now-unused sessions_action_branch string.
- Tests: deleted SessionsViewModelTest (branch-only); added /fork -> SessionBranch
to SlashCommandDispatcherTest and two ChatViewModel tests asserting /fork
sends session.branch with the session id + optional name.
Local testDebugUnitTest: SlashCommandDispatcherTest 8/8, ChatViewModelTest 50/50,
0 failures. ktlint clean.
---------
Co-authored-by: ronia <ronia@m57>
- SlashCommandDispatcherTest: covers all branch routes (Interrupt /
NewSession / RpcDispatch) incl. case-insensitivity, args, slash-only,
empty, and unknown commands.
- SlashCommandDispatchRpcTest: asserts a non-hardcoded command is
forwarded to COMMAND_DISPATCH with the exact {name,arg,session_id}
shape the gateway expects, args split correctly, and that client-
handled /stop + /new do NOT hit the backend.
Verified against the live hermes-agent gateway: commands.catalog returns
185 catalog entries but command.dispatch only handles a subset, so most
forwarded commands currently 4018. These tests lock the client contract;
the backend gap is tracked separately.
Co-authored-by: M57 <m57@hermes-control.app>
* fix(#548): stop System tab button text truncation + fix two wrong labels
* fix(system): remove inline icons from narrow system action buttons to prevent text cutoff
* fix(system): restore action icons and implement dynamic font scaling for button text
* fix: stack icon above text in system buttons to prevent label clipping
Replace horizontal Icon+Text layout with vertical Column stacking
(icon on top, text centered below) — the same pattern Material 3
NavigationBar items use. Gives text the full button width so labels
like 'Security Audit' and 'Config Migrate' never get cut off.
* fix: add missing ImageVector import for system buttons fix
---------
Co-authored-by: M57 <m57@hermes-control.app>
Mobile was silently dropping two event types the gateway emits. This adds
parsing + UI surfacing for both, bringing mobile to parity with desktop
(which shows gateway errors as red toasts).
- `error` (backend crash) -> WsEvent.GatewayError, surfaced in the existing
error banner (mirrors how RpcError is handled).
- `background.complete` (scheduled job finished) -> WsEvent.BackgroundComplete,
surfaced as a non-blocking snackbar in ChatScreen.
Changes:
- WsEvent.kt: add GatewayError(message?) + BackgroundComplete(data?) sealed subtypes.
- EventParser.kt: handle "error" + "background.complete"; unknowns still fall
through to Unknown (no behavior change for existing event types).
- ChatWsEventReducer.kt: onGatewayError (sets errorMessage, clears loading) +
onBackgroundComplete (sets backgroundCompleteMessage); mirrors onRpcError.
- ChatViewModel.kt: backgroundCompleteMessage state field, clearBackgroundComplete(),
handleWsEvent branches (ViewModel owns the snackbar trigger).
- ChatScreen.kt: pass backgroundCompleteMessage to ChatLifecycleEffects + a
LaunchedEffect that shows the snackbar and calls clearBackgroundComplete().
- EventParserTest.kt: cover both new events (incl. missing-message case).
Pure additive; sealed class + exhaustive when() preserved. Verified:
compileDebugKotlin + ktlintCheck green; EventParserTest passes.
Closes#527
Co-authored-by: M57 <m57@hermes-control.app>
* fix(ws): align RPC timeout to 120s + rejectAllPending on disconnect (fixes#526)
Mobile's pending-request handling diverged from the desktop contract
(apps/shared JsonRpcGatewayClient) in two ways that caused silent hangs:
1. Timeout was 30s while the desktop uses 120s (DEFAULT_REQUEST_TIMEOUT_MS),
so legitimately long agent turns were pruned early. Align to 120s and use
it for both the cleanup sweep and sendRpcAndAwait's per-call withTimeout.
2. The cleanup sweep only Log.w'd stale requests and dropped them — it never
failed the CompletableDeferred, so sendRpcAndAwait callers awaiting a
server that never answered HUNG FOREVER. And on disconnect/reconnect there
was NO rejectAllPending, so in-flight awaited RPCs also hung until their
own timeout.
Changes (all in ChatViewModel.kt):
- cleanup sweep now completeExceptionally()s the deferred AND surfaces a
'Request timed out' error for fire-and-forget RPCs (was silently dropped)
- new rejectAllPending() fails + clears every in-flight pending deferred;
wired into the disconnect-status collector and reconnect()
- PENDING_REQUEST_TIMEOUT_MS = 120_000 (matches desktop); sendRpcAndAwait
uses it instead of a hardcoded 30s
Tests: 2 new ChatViewModelTest cases cover rejectAllPending on disconnect
and on reconnect (no hang, VM stays usable). (Timeout-surfacing path shares
the deferred-fail logic with handleRpcError; the 120s sweep can't run under
the unit-test dispatcher's periodic-timer limitation, noted in PR.)
Mirrors the desktop-app audit in /opt/hermes-agent.
* fix(ws): aggregate pending-request cleanup into a single UI update (PR #541)
Sourcery review (PR #541): startPendingRequestCleanup emitted one
_uiState.update{} per stale request inside the loop, causing N separate
emissions / redundant recompositions when many RPCs time out at once.
Collect fire-and-forget methods and emit a single combined errorMessage
update after the loop.
rejectAllPending is intentionally left silent on disconnect/reconnect:
those are transient socket events (the RPC often completes on the new
socket), so surfacing a scary error banner is UX noise. Only the
timeout path surfaces errors — that is a genuine failure. This matches
the desktop JsonRpcGatewayClient.rejectAllPending semantics.
* refactor(ws): move awaited-RPC pending/timeout layer into HermesWsClient (closes#526)
Issue #526: port the JsonRpcGatewayClient.request() pattern into
HermesWsClient. HermesWsClient now owns the in-flight map, per-call
120s timeout, resolve-on-RpcResult/RpcError, and rejectAllPending on
disconnect/reconnect. ChatViewModel.sendRpcAndAwait simply delegates
to wsClient.request(...).await(); its local pendingRequests map,
PendingRequest, startPendingRequestCleanup loop and rejectAllPending
are removed. Fire-and-forget send() is unchanged.
---------
Co-authored-by: M57 <m57@hermes-control.app>
* fix(network): scope management REST calls with ?profile= (fixes#528)
Mobile fired all management REST calls with NO profile scope, so every
profile read/wrote the backend's implicit default profile — multi-profile
setups silently corrupted config/skills/toolsets/mcp/model/env.
Add ProfileScopeInterceptor (OkHttp) that appends ?profile=<activeProfile>
to the same endpoint families the desktop/web dashboard scopes
(web/src/lib/api.ts PROFILE_SCOPED_PREFIXES), respecting:
- no active profile -> pass through (legacy default behavior)
- explicit ?profile= on the URL wins over the global scope
- only scoped families rewritten; ops/pairing/cron/profiles stay global
Wired into ApiClient.buildService(). 5 MockWebServer tests cover scoped
append, explicit-param precedence, no-profile passthrough, non-scoped skip,
and skills scoping.
Mirrors desktop/web contract derived from audit of /opt/hermes-agent.
* fix(ci): stub getSelectedProfileId in ApiClientTest + harden prefix match (fixes PR #540)
- ApiClientTest: stub AuthManager.getSelectedProfileId() to null. The new
ProfileScopeInterceptor (registered in ApiClient.buildService) calls it, and
the unstubbed real method threw IllegalStateException at AuthManager.kt:56,
breaking all 4 auth-interceptor tests.
- ProfileScopeInterceptor: replace startsWith(prefix) with whole-segment match
(path == prefix || path.startsWith(prefix/)) so lookalike paths like
/api/statusXYZ are NOT wrongly scoped (Sourcery review, PR #540).
- ProfileScopeInterceptorTest: add lookalikePath_notScoped + scopedSubPath_isScoped
to lock the segment-boundary fix.
Previously mobile dropped the gateway's sudo.request and secret.request
events, so any agent turn needing a sudo password or a secret value hung
forever with no UI. Now:
- EventParser maps sudo.request / secret.request -> WsEvent.SudoRequest / SecretRequest
- ChatViewModel surfaces a secure dialog (SudoPromptUi / SecretPromptUi) and
replies via sudo.respond / secret.respond with session_id + request_id + payload
- ChatWsEventReducer explicitly branches the new events (no-op, VM-owned)
- ChatScreen renders password-masked SudoPromptDialog / SecretPromptDialog
- 6 unit tests cover prompt-state, RPC params, and prompt-clearing
Mirrors desktop/web contract (apps/shared GatewayEventName + tui_gateway).
Derives from audit of /opt/hermes-agent desktop app.
Explicit IO context for DB/WS/notify path. replyScope already uses
Dispatchers.IO; this makes the offload local and explicit. Keep return@withContext
only because nothing follows the withContext block today.
The parseToolOutput function in ChatBubble.kt was handling the specific
parsing and formatting logic for the "todo" tool inline, making the
function long and harder to read.
This commit extracts the todo-specific formatting logic into a new
private function formatTodoToolOutput, improving the readability and
maintainability of ChatBubble.kt without changing any behavior.
Appends testToggleSearch verifying toggleSearch() activates search,
setSearchQuery sets the query, and toggling off resets searchQuery to empty.
Rebased onto current main (post-#511/#512).
* Test PairingCodeEntryViewModel onManualCodeChange
Added unit tests to cover the `onManualCodeChange` function in `PairingCodeEntryViewModel`.
The test validates that the function properly updates the state and handles string trimming
as well as error message clearance.
Changes include:
- Created `PairingCodeEntryViewModelTest.kt` in `app/src/test/java/com/m57/hermescontrol/ui/pairing/`
- Implemented `testOnManualCodeChange_updatesStateAndClearsError` to check correct state update logic and verify error clear functionality.
- Implemented `testOnManualCodeChange_trimsInput` to verify input is properly trimmed.
- Added necessary mock setup to deal with Android components (`Application` and `android.util.Log`).
* Fix ktlint format issue in PairingCodeEntryViewModelTest
Ran `ktlint --format` to fix the `standard:no-empty-first-line-in-class-body`
formatting violation introduced in the previous commit.
* Add unit tests for ChatViewModel attachment manipulation
Adds tests covering addAttachment, removeAttachment (valid/invalid indices),
and clearAttachments in ChatViewModelTest. This ensures the attachment
state management logic works as expected.
* test(#511): add mixed valid/invalid remove sequence + DRY attachment setup
Folds in both Sourcery review notes:
- New testRemoveAttachment_mixedValidAndInvalidSequence asserts list
stays consistent across a valid remove, out-of-bounds + negative no-ops,
then another valid remove on the shifted list.
- addDummyAttachments() helper removes repeated VM/advance/add boilerplate.
Verified: ktlintCheck clean + ChatViewModelTest 37/37 pass locally.
Refactored the deeply nested `parseDaysOfWeek` function using guard clauses to flatten the logic structure. By returning early on invalid conditions (`dowPart == "*" || domPart != "*" || monthPart != "*"` and `hoursList.size != 1 || minutesList.size != 1`), the remaining function body's indentation is reduced by two levels.
This improves overall code readability and maintainability without altering existing functionality. The change was verified against existing unit tests, which all pass.
Added SystemViewModelTest to provide basic testing coverage for the
openUpdateConfirm and closeUpdateConfirm methods. These methods
handle state changes within the UI without side-effects or
dependencies, so straightforward property assertions were sufficient.
This improves overall code reliability by ensuring simple UI boolean
states function predictably.
Add unit tests to `ChatViewModelTest.kt` to cover the `interruptSession`
method. The tests verify that `interruptSession` correctly sends the
`SESSION_INTERRUPT` RPC via the WebSocket client when a session ID is
present, and that it safely does nothing when the session ID is missing.
This improves test coverage for the chat control logic.
Added unit tests to `KeysViewModelTest.kt` to cover `setNewKeyName` and `setNewKeyValue` functions. This ensures that the state flow correctly updates when key names and values are modified. This increases the test coverage for UI state manipulation within the Keys settings module.
* Add unit test for ChatViewModel.refreshSettings
This commit adds a missing test case for the `refreshSettings` function in `ChatViewModel.kt`. The new test verifies that the UI state correctly updates to reflect changes in `AuthManager` properties such as `typingEffectEnabled` and `typingEffectDelayMs`. This resolves the testing gap and ensures safer refactoring for settings management in the future.
* test(#506): strengthen refreshSettings test to prove live re-read + drop test_plan.md
Re-stub AuthManager after construction and assert the state delta, so the
test actually catches a regression where refreshSettings() would cache the
init-time value instead of re-reading AuthManager live. Removes the one-off
Jules planning artifact from the repo root.
The hub card UI is rendered by the local private HubSkillCard in SkillsScreen.kt (not the unused components/HubSkillsTab.kt copy). Moved SourceBadge out of the top-right name row to the left of the Install button in the card footer (left-aligned source, right-aligned action), tying the skill origin (hub/clawhub/etc) to the install action.
* feat(#500): tap-to-reveal detail dialog for truncated cards
Add shared DetailDialog composable and wire tap-to-open full metadata
dialogs across Skills (installed + hub), MCP servers, Plugins, Toolsets,
and Webhooks screens. Action buttons stay on the card (sticky); tapping
the card body reveals untruncated description + key metadata.
Refs: #500
* fix(#500): resolve compile errors from missing runtime imports + dialog scope
- add missing androidx.compose.runtime.mutableStateOf/remember imports
in InstalledSkillsTab + HubSkillsTab (caused 'Unresolved reference'
cascade on compileDebugKotlin)
- move PluginsScreen detail dialog inside the composable function scope
(was nested in OrphanPluginCard -> showDetail unresolved)
- DetailDialog rows type: Pair<String?,String?> -> Pair<String,String?>
(key always non-null; fixes type-inference failure)
- drop unnecessary safe call on non-null label
Verified locally with the Android SDK:
./gradlew :app:compileDebugKotlin -> BUILD SUCCESSFUL
./gradlew :app:testDebugUnitTest -> BUILD SUCCESSFUL
Refs: #500
* refactor(#500): extract toDetailRows() mappers + semantic status tones; wire SkillsScreen hub browse
- add DetailRows.kt with @Composable extension mappers for Skill/HubSkill/
McpServer/PluginInfo/Toolset/WebhookSubscription -> List<DetailRow>
- DetailDialog now renders status rows via LocalHermesStatusColors (review #2):
SUCCESS/NEUTRAL/WARNING/ERROR/INFO tones instead of plain onSurfaceVariant
- wire SkillsScreen.HubBrowseView/HubSkillCard tap -> DetailDialog (same UX as
other screens) — user request
- remove JVM-signature-clashing Pair overload; drop unused Color import
- add detail_dialog_trust_level string (HubSkill has no version field)
- verified: compileDebugKotlin + testDebugUnitTest PASS locally w/ ANDROID_HOME
* fix(#500): full hub description in dialog + no name truncation
- HubBrowseView (both SkillsScreen + HubSkillsTab): on card tap, fetch
previewHubSkill(identifier) to get the FULL SkillContentResponse.content
(search snippet was truncated); dialog shows full content once loaded,
with a spinner while previewing. Falls back to snippet if no identifier.
- SkillsViewModel: add hubPreviewContent/isHubPreviewing/hubPreviewError
state + previewHubSkill()/clearHubPreview() (uses existing preview endpoint)
- DetailDialog: title now wraps fully (removed maxLines=2 ellipsis cap) so
long skill names are never cut off
- verified: compileDebugKotlin PASS + ktlint clean (local ANDROID_HOME)
- Replace machine-specific build instructions (/opt/android-sdk paths)
with generic gradle commands any contributor can use
- Remove Ronia-specific agent-author rule that would confuse external
contributors
- Remove kanban-internal bug annotation format from commit conventions
- Reword stale 'no SDK' caveat in Things to Avoid to match new build section
Backend commit 37a4cf900 (hermes-agent) flipped the default of
GET /api/model/options's include_unconfigured parameter from true
to false, so the mobile Models picker was silently regressing to
showing only configured/authenticated providers — the skeleton rows
for unconfigured providers (with setup-hint warnings) stopped arriving.
Add include_unconfigured as a @Query param defaulting to true so the
full provider universe is restored on the Models screen. Both current
call sites (ModelViewModel + ProfilesViewModel) invoke the API without
passing the new param, so they automatically pick up the true default.
* refactor(settings): remove current connection editor fields
Remove the active host, port, token fields, and clear token button from the main Connection tab, as profiles are now managed exclusively through the ProfileEditorDialog.
* feat(settings): migrate to full auto-save design and remove save button
Update settings change listeners (auto-reconnect, typing effect delay/toggle) to save state immediately to AuthManager. Remove the manual Save button from the scaffold's top bar and delete the redundant SaveIndicator.
* style(settings): clean up unused imports from settings UI cleanup
* fix(chat): resolve compose resource lint error and initial state test failure
Pre-resolve empty credentials string resource at the composable scope to fix LocalContext resource query lint error. Update testInitialStateAndConnection to use DISCONNECTED state to trigger connection and pass verification.
* fix(ws): stop chat opening from racing the singleton into a stuck RECONNECTING
Root cause: HermesWsClient is a global singleton connected once at login;
every tab observes its single connectionStatus. ChatViewModel is recreated
on every chat-tab open and its init calls connectWebSocket() -> wsClient.connect().
connect() only guarded the CONNECTED case, so when the socket had dropped
(singleton in RECONNECTING with its own scheduled reconnect) opening chat
spawned a SECOND socket on the same webSocket field. The orphaned socket's
later onClosed set connected=false + re-armed RECONNECTING after the new
socket connected, and currentBackoff kept resetting on each chat open,
leaving the status stuck on RECONNECTING while every other tab (which never
calls connect()) stayed healthy.
Fix:
- HermesWsClient.connect() now no-ops while CONNECTING/RECONNECTING (in-flight
socket already pending) and while AUTH_EXPIRED (needs re-auth, not a loop).
- ChatViewModel.connectWebSocket() mirrors the same terminal-state guard so
the chat tab never disturbs an already-working or already-recovering
connection. Behavior-preserving: happy path (CONNECTED) and genuine
terminal states (DISCONNECTED/NO_NETWORK) still connect as before.
* fix(#470): sync cookie store scope with selected profile ID
Update AuthManager to switch CookieManager to the active server profile ID on startup and on runtime profile change.
* fix(#470): prevent stale token cache and load initial cookie scope
Pass active profile scope to CookieManager.initialize on startup and update setProfileToken to sync the in-memory cachedToken.
* feat(chat): add re-login action and credentials popup to connection banner
Add a Re-login button to the connection status banner and a dialog to prompt for credentials, allowing the user to refresh session cookies/tokens and reconnect the WebSocket.
* fix(chat): address PR #495 review feedback
* fix(chat): restore reconnect action in banner
* fix: resolve composable invocation in ReloginDialog
* fix(chat): enable re-login action during reconnecting state
Add the Re-login button to the connection status banner when connectionStatus is RECONNECTING, allowing users to re-authenticate and resolve stuck reconnect loops.
* fix(chat): surface all disconnected states in reconnect banner (issue #491)
The connection-status banner only appeared for RECONNECTING/DISCONNECTED,
so NO_NETWORK and AUTH_EXPIRED left the user staring at a silent chat with
no feedback and no way to recover — the core of the 'reconnecting is not
user-friendly' complaint.
ChatTopBanner now shows for every non-connected, non-connecting state:
- RECONNECTING: spinner + 'Reconnecting to Hermes…' (auto, no button)
- DISCONNECTED: 'Disconnected from Hermes' + Reconnect
- NO_NETWORK: 'No network connection' + Reconnect (force a retry)
- AUTH_EXPIRED: 'Session expired' + 'Sign in again' -> AuthLoginScreen
The auto-reconnect engine (backoff, network-return trigger, in-flight
message queue in HermesWsClient) is untouched — this only makes the stuck
states visible and actionable.
* fix(chat): use LocalHermesStatusColors for reconnect banner (review fix)
Per AGENTS.md, semantic status colors must come from
LocalHermesStatusColors, never MaterialTheme.colorScheme. The reconnect
banner used errorContainer/onErrorContainer directly, which is both a
semantic-color violation and inconsistent with the rest of the app
(Navigation.kt maps DISCONNECTED/NO_NETWORK/AUTH_EXPIRED -> .error;
TelegramOnboardingDialog uses .errorContainer for error surfaces).
Switch Surface bg to errorContainer and foreground (spinner, text,
button content) to error via LocalHermesStatusColors.current.
* fix(chat): make search bar clickable by giving ChatMessageList a vertical layout
The search bar (AnimatedVisibility) and the message LazyColumn were
emitted as siblings with no container. The call site is a Box, which
overlays children — so the LazyColumn rendered on top of the search bar,
intercepting every pointer event. The bar stayed visible but was dead
(nothing inside clickable: input, nav arrows, close).
Wrap ChatMessageList's children in a Column so the bar occupies real
layout space above the list; the LazyColumn now takes weight(1f) and
scrolls independently. Fixes#490.
* refactor(chat): simplify search-list LazyColumn modifier
Use fillMaxWidth().weight(1f) instead of fillMaxSize().weight(1f) inside
the new Column — weight already claims the remaining vertical space, so
fillMaxSize was redundant/contradictory (Sourcery review nit).
Note: the Sourcery 'use LocalHermesStatusColors' suggestion on the search
bar Surface is a false positive — that rule covers SEMANTIC status colors
(success/warning/error/info) only. surfaceContainerLow/outline are neutral
Material surface chrome, not status colors; LocalHermesStatusColors does
not even expose them. The corresponding status dot correctly uses StatusRed.
* refactor(chat): extract streaming state into ChatStreamingController
Moves streaming buffers, streamingMessageId, and the two token/delta
handlers out of ChatViewModel into a dedicated controller. Mirrors the
ChatSearchDelegate seam; _streamingState stays VM-owned and the WS
reducer is untouched. Behavior-preserving, ChatScreen unchanged.
* refactor(chat): drop write-only streamingMessageId in ChatStreamingController
Sourcery flagged streamingMessageId as write-only. Verified via git grep
that it was write-only in origin/main too (zero readers anywhere in the
repo), so removing it is behavior-preserving. beginStreamingMessage() now
delegates its buffer reset to resetStreaming() to remove the duplication
Sourcery noted. Kept the injected scope param — it mirrors the
ChatSearchDelegate seam (that delegate uses scope.launch) and keeps the
controller constructor shape consistent.
* refactor(chat): extract ChatSearchDelegate from ChatViewModel god-object
Move the 4 search methods (toggleSearch/setSearchQuery/navigateSearchMatch/
clearSearch) + searchJob field into a dedicated ChatSearchDelegate that owns the
chat-search state transitions against the shared _uiState flow. ChatViewModel
keeps thin one-line delegating wrappers so its public API (used by ChatScreen)
is unchanged.
This is the first separable slice of the ChatViewModel god-object (1421 LOC,
47 funcs). Streaming/session/WS clusters are intentionally left in place - they
are entangled and will be addressed separately to avoid splitting one logical
op across classes.
Verified: ktlintCheck PASS, compileDebugKotlin PASS (local SDK).
* refactor(chat): extract ChatAttachmentsDelegate from ChatViewModel
Move addAttachment/removeAttachment/clearAttachments into a dedicated
ChatAttachmentsDelegate that owns pendingAttachments state transitions against
the shared _uiState flow. ChatViewModel keeps 3 one-line delegating wrappers -
public API unchanged. Read sites (sendMessage) already read pendingAttachments
straight off uiState, so no delegate read API needed.
Second separable slice of the ChatViewModel god-object (after #486 search).
Verified: ktlintCheck PASS, compileDebugKotlin PASS (local SDK).
* refactor(chat): address Sourcery review on search extraction
- Inject the CoroutineDispatcher into ChatSearchDelegate instead of
hardcoding Dispatchers.Default (defaults to Dispatchers.Default so
behavior is unchanged; now customizable per environment).
- Group the four search delegating methods in ChatViewModel under a
'Compatibility façade' comment marking them as the transitional API
surface around ChatSearchDelegate.
* refactor(ui): extract SkillsStep to components package
Move the 252-LOC SkillsStep composable out of ProfilesScreen.kt into
ui/profiles/components/SkillsStep.kt. Body is verbatim (behavior-preserving);
only package + imports changed. Parent now imports and calls it directly.
Verified: ktlintCheck PASS, compileDebugKotlin PASS (local SDK).
Note: sibling screens resolve Modifier.weight() without an explicit import;
matching that convention (no spurious weight import) to avoid the
internal RowColumnParentData.weight shadowing error.
* refactor(ui): extract ProfileBuilderView cluster to components package
Move the Profile Builder wizard (ProfileBuilderView + validateProfileName +
IdentityStep/ModelStep/McpStep/AddMcpDialog/ReviewStep) out of ProfilesScreen.kt
into ui/profiles/components/ProfileBuilderView.kt. Body is verbatim
(behavior-preserving); only package + imports changed.
Notable wiring required:
- validateProfileName kept as internal fun: it is also used by the parent's
clone dialog, so both the screen and the builder share it via import.
- ProfilesUiState/ProfilesViewModel imported from the ui.profiles package.
- SkillsStep call resolves to the already-extracted sibling file (same package).
Verified: ktlintCheck PASS, compileDebugKotlin PASS (local SDK).
* refactor(ui): extract MoaConfigDialog cluster to components package
Move the Mixture-of-Agents config dialog (MoaConfigDialog + MoaConfigEditor +
MoaSlotPicker + MoaPickerTarget sealed class) out of ModelScreen.kt into
ui/model/components/MoaConfigDialog.kt. Body is verbatim (behavior-preserving);
only package + imports + entry visibility changed.
- Entry MoaConfigDialog is internal (called by ModelScreen root); the editor,
slot picker, and sealed class stay private to the new file.
- The @Composable annotation preceding the declaration is moved with the
cluster (earlier attempt left it orphaned, causing a duplicate-annotation
compile error at the next declaration).
Verified: ktlintCheck PASS, compileDebugKotlin PASS (local SDK).
* refactor(ui): extract PlatformCard + TelegramOnboardingDialog clusters
Move two self-contained clusters out of ChannelsScreen.kt:
- PlatformCard.kt: StateStyle (private data class) + platformStateStyle +
StateBadge + PlatformCard. Entry PlatformCard is internal (called by
ChannelsScreen root); StateStyle/StateBadge/platformStateStyle stay private.
- TelegramOnboardingDialog.kt: TelegramOnboardingDialog. Entry internal.
Wiring required:
- ConfigureForm kept in ChannelsScreen as internal (shared by PlatformCard
and the screen root) and imported into PlatformCard.kt.
- ChannelsUiState/OnboardingPhase imported from the ui.channels package.
- formatTimestamp left in the screen (used by ConfigureForm).
Verified: ktlintCheck PASS, compileDebugKotlin PASS (local SDK).
* refactor(ui): extract SkillsScreen sub-composables to components package
Split the 914-line SkillsScreen.kt into the screen root plus 4 cohesive
component files under ui/skills/components/:
- SourceBadge.kt: shared SourceBadge (internal, used by both tabs)
- InstalledSkillsTab.kt: InstalledSkillsView + SkillCard + SkillPreviewDialog
- HubSkillsTab.kt: HubBrowseView + HubSkillCard
- SkillEditorDialog.kt: SkillEditorDialog
Wiring required:
- CATEGORY_ALL promoted private -> internal in SkillsScreen (shared by the
screen root and InstalledSkillsView) and imported where needed.
- SkillFilter / SkillsUiState imported from the ui.skills package.
- HubBrowseView now reads isHubSearching/hubResults/hubSearchError off its
SkillsUiState param (fields, not locals) - no behavior change.
Verified: ktlintCheck PASS, compileDebugKotlin PASS (local SDK).
* refactor(ui): extract SettingsScreen + SystemScreen sub-composables
SettingsScreen.kt (1238 -> ~340): move self-contained sections into
ui/settings/components/ - ConnectionSection (+TestResultCard/SaveIndicator/
TestConnectionButton), BehaviorSection, AppearanceSection (+ChatSection/
NavBarSection), AboutSection, ProfileEditorDialog (+DeleteProfileConfirmDialog).
Shared leaves SectionCard/InfoRow kept in the screen as internal and imported
by the extracted files.
SystemScreen.kt (1755 -> 1619): move CredentialEntryRow + HookCard into
ui/system/components/ (both internal). formatBytes/formatDuration helpers stay
in the screen (used by the root and remaining content).
Verified: ktlintCheck PASS, compileDebugKotlin PASS (local SDK).
* fix(#485): use LocalHermesStatusColors for PlatformCard state colors
Map platform connection-status badges to semantic LocalHermesStatusColors
slots (success/warning/error) + add neutral slot for not_configured/disabled.
Removes hardcoded hex (Color(0xFF...)) and MaterialTheme.colorScheme usage
flagged by Sourcery; neutral defaults to StatusGrey so existing theme
providers are untouched.
Replace the manual session-cookie interceptor in ApiClient and the
manual cookie branch in TokenRefreshAuthenticator with a shared
PersistentCookieJar backed by an encrypted, per-server EncryptedCookieStore.
- Add CookieStore iface + EncryptedCookieStore (EncryptedSharedPreferences,
per-server scope, legacy single-cookie migration)
- Add CookieSerialization (OkHttp Cookie <-> holder) + PersistentCookieJar
(in-mem cache, async persist, atomic useStore scope switching, prune,
session-cookie accessor)
- Add CookieManager coordinator (init/useStore/prune/clear) and wire its
cookieJar into OkHttpProvider base/websocket/probe (lazy)
- AuthManager.get/setSessionCookie now delegate to CookieManager; add
pruneServerCache(); clear path drops the scope's session cookie
- AuthLoginViewModel + HermesWsClient rely on the jar for Set-Cookie capture
and session-cookie re-attachment (no manual header injection)
- Add fakes (FakeEncryptedCookieStore/buildFakePersistentCookieJar) + unit
tests (PersistentCookieJarTest, CookieManagerTest); inject fake jar into
ApiClientTest/HermesWsClientTest setup
WS token-out-of-URL (step 5) deferred: backend hermes-agent authenticates
WS only via ws.query_params, so moving it requires a coordinated backend
change (noted for follow-up).
Verified: testDebugUnitTest (334 passing) + assembleDebug green via local SDK.
* Remove Settings connection profile dropdown; make saved-profile cards tappable to switch
The profile dropdown in the Settings > Connection tab was the only way to
switch the active profile from Settings. Removing it left a regression, so
each saved-profile Card now has clickable { viewModel.selectProfile(profile.id) }
reusing the existing isActive highlight. The isNotEmpty guard stays so the
section hides cleanly when there are no profiles.
* Tighten spacing between Test Connection and Logout buttons (16dp -> 8dp)
* Tighten Test Connection / Logout spacing further (8dp -> 4dp)
* Tighten Test Connection / Logout spacing further (4dp -> 2dp)
* Add accessibility role to profile cards (clickable role = Role.Button)
Sourcery flagged the now-clickable profile Card as missing semantics for
assistive tech. Use clickable(role = Role.Button) so TalkBack announces it
as an actionable control. Role import added.
- Remove the Logout button from the About tab content.
- Add the Logout button at the bottom of the Connection tab so users
can sign out directly where they manage their connection.
- Delete the unused, duplicate AboutSection() composable (it was never
called and carried its own Logout button) to keep a single source of
truth for the action.
Logout behavior is unchanged: it still calls viewModel.logout() then
onLogout() (navigates to login). Verified with assembleDebug + ktlint.
* fix(#478): rework default login to use unified ConnectionProfile model
- AuthManager: drop legacy auth_token path; getToken/setToken now delegate
to the selected profile (profile token only, no global fallback)
- setHost/setPort always write the selected profile (no top-level host/port branch)
- Add DEFAULT_PROFILE_ID + ensureDefaultProfile()/ensureDefaultSelected() so the
selected profile is never null; ensureDefaultSelected() only falls back when
nothing is selected (never clobbers an existing choice); ensureDefaultProfile()
only injects a Default profile on fresh install, never into an existing list
- One-time migration folds legacy standalone auth_token into the Default profile,
batched into a single SharedPreferences transaction (guarded by legacy_default_migrated)
- ConnectViewModel.connect() persists via setToken/setHost/setPort (delegate to
the selected profile) — keeps the existing persistence contract
- Connect/Settings: remove the '(none)'/standalone profile option; deleteProfile
falls back to Default profile instead of null selection
- Update AuthManagerTest/ConnectViewModelTest to the unified model; fix test
stub ordering + migration re-init; remove dead connect_profile_none / settings_profile_none strings
Closes#478
* fix: stub AuthManager.ensureDefaultSelected() in E2eIntegrationTest
The #478 ConnectViewModel.connect() success branch now calls
AuthManager.ensureDefaultSelected() on the non-saveProfile path.
E2eIntegrationTest.setUp() mocks AuthManager as a non-relaxed mockkObject
but never stubs that method, so the unstubbed call throws MockKException inside
viewModelScope.launch, leaving connectionSuccess unset and failing 3 tests:
- testFullUserSessionFlow
- testConnectViewModel_onPairingString_base64Format
- testConnectViewModel_onPairingString_urlFormat
Add the missing stub. Verified locally: full suite 322/322 passing.
---------
Co-authored-by: ronia <ronia@m57>
- ChatViewModel: drop fetchAndDisplayStatus/Sessions/Stats — left behind
after slash-command dispatch rework (e7b2973c); /status /sessions /stats
now route to backend via SlashCommandDispatcher.RpcDispatch -> WS COMMAND_DISPATCH.
Zero call sites, grep-confirmed.
- AuthManager: drop KEY_SELECTED_PROFILE_ID const — selected profile id
moved to ServerStore StateFlow (getSelectedProfileId/setSelectedProfileId).
Legacy PREFS key never read.
- Theme: drop ENABLE_DYNAMIC_COLOR const — theming reads useDynamicColors
setting (Theme.kt:318), not this const. Dead since that refactor.
Verification: ktlintCheck PASS, compileDebugKotlin PASS (local SDK).
Per behavior-preserving-cleanup: grep zero refs, not exported, no
dynamic/reflection access, git blame shows original intent superseded.
* feat(#480): pass refresh=true on Models pull-to-refresh to re-probe custom providers
* test(#480): assert refresh flag propagation for default vs pull-to-refresh loads
* fix(#480): capture refresh arg via slot instead of brittle coVerify in propagation test
---------
Co-authored-by: ronia <ronia@m57>
* feat(#471): implement DataStore-based server configuration and self-healing
* refactor(#471): address Sourcery feedback on ANR risk and reset method splitting
* refactor(#471): implement synchronous ServerStore initialization to fully remove ANR risk
* feat(#471): show profile name, host and port on add profile, redirect to login on save, and support shortcut login buttons for existing profiles
* refactor: migrate Gson serialization to kotlinx.serialization
* fix(dto): resolve serializing Any? and Map<String, Any?> with JsonElement
* test(refactor): fix unit test issues under kotlinx.serialization and update nullable DTO defaults
* fix(chat): support flexible numeric and string decoding for message timestamps
* fix(chat): sequentialize cache loading to avoid overwriting network state
* fix: disable versionControlInfo for reproducible F-Droid builds
Add versionControlInfoEnabled = false to strip the embedded git
revision metadata from the APK. This prevents byte-level differences
between GitHub-released and F-Droid-built APKs (AGP embeds branch
name, which differs between detached-HEAD CI and main-branch builds).
* fix: make version control info empty for reproducible F-Droid builds
The extractReleaseVersionControlInfo task generates
META-INF/version-control-info.textproto, which differs between
GitHub CI (builds on main branch) and F-Droid CI (detached HEAD).
This caused a 'dex/prof differs from embedded git revision' failure.
Fix: empty the file via doLast hook + exclude it from packaging.
* fix: use robust task hook for reproducible version-control-info
Replace brittle buildFeatures flag (not available in AGP 9.0.1)
with a lazy tasks.matching hook that empties the generated
version-control-info.textproto after extraction. Both CI
environments produce identical content (empty file), ensuring
byte-for-byte reproducible APKs.
---------
Co-authored-by: M57 <hy4ri@users.noreply.github.com>
* fix(#472): refactor ChatViewModelTest to use Fake* + Turbine
Replace Mockk-heavy test setup with FakeChatPersistenceRepository (+
in-memory FakeChatMessageDao) and add Turbine for Flow assertions.
Changes:
- Add Turbine v1.2.0 dependency (libs.versions.toml + build.gradle.kts)
- Create FakeChatMessageDao – in-memory DAO with MutableStateFlow
- Create FakeChatPersistenceRepository – delegates to FakeDao
- ChatViewModel: make repo injectable (@VisibleForTesting lateinit var)
- Rewrite ChatViewModelTest (751 lines vs 1,212): clearer helpers,
Turbine test for streaming Flow sequence, same 29 tests with
identical assertions, ~38% line reduction
Test: ktlint --format passes clean
* fix(#472): address review — constructor injection, ConcurrentHashMap, MockWebServer tests
Addresses all feedback from Sourcery review on PR #474:
Constructor injection (was lateinit var):
- Move repo to ChatViewModel primary constructor with default
- Remove @VisibleForTesting lateinit var + init block assignment
- Tests pass repo directly via constructor
Simplify FakeChatMessageDao:
- Replace manual synchronized(lock) with ConcurrentHashMap
- Same thread safety, 48% less code, no boilerplate lock object
New MockWebServer tests:
- HermesApiServiceMockWebServerTest: 6 tests covering getStatus,
getSessions, getSessionMessages + edge cases (null fields,
empty lists, slash-encoded session IDs)
* fix: CI compilation errors — open class, TestScope receiver, runBlocking
Three compilation errors blocking CI:
- ChatPersistenceRepository was final, but FakeChatPersistenceRepository
extends it → make it open class
- createViewModelWithSession() called advanceUntilIdle (TestScope ext)
and emit() (suspend) without a TestScope receiver or coroutine ctx →
make it fun TestScope.xxx() and use tryEmit() for non-suspend emission
- HermesApiServiceMockWebServerTest called suspend API methods from
regular @Test methods → wrap each test in runBlocking
* fix: test runtime failures — suspend helper + fix JSON escaping
- Use so emit()
(suspend) is valid and events are delivered synchronously instead of
buffered via tryEmit() which was causing 17 test failures
- Fix MalformedJsonException in MockWebServer test by using plain string
content instead of unescaped JSON-within-JSON
* fix: correct req-id values in ChatViewModelTest — SESSION_CREATE is req-id-3
* fix(test): correct ChatViewModelTest assertions for Fakes+Turbine refactor
- testMessageStreamingFlow: collect streamingState via Turbine
(ThinkingDelta/MessageToken mutate streamingState, not uiState)
- testToolExecution_finalizesPreviousStreamingMessage:
account for messages[0] = "Session created" system message
- testMessageStart_finalizesPreviousStreamingMessage:
same index offset (messages[1] is the finalized stream)
- testClarifyRequestCustomResponse: options is emptyList(), not null;
message count is 3 (session-create + user clarify reply)
Fixes CI failures introduced in PR #474.
---------
Co-authored-by: M57 <hy4ri@users.noreply.github.com>
* fix(chat): support session IDs containing slashes in Retrofit endpoints
Set encoded = true on the @Path("id") annotations for all session endpoints
to prevent URL-encoding slashes, which caused 404 errors.
* chore: clean up inline comments — drop kanban metadata, align issue ref to #468
---------
Co-authored-by: M57 <hy4ri@users.noreply.github.com>
* fix: correct FilterChipRow and EmptyState API mismatches + ktlint fmt
* fix: add missing Save import, fix verticalArrangement double-wrapping
* fix: address Sourcery review — strings, enums, hubQuery, StatusColors
• Hardcoded strings → stringResource (Installed, Browse Hub, Statuses, All sources)
• Magic string filters → SkillFilter enum + CATEGORY_ALL constant
• FilterChipRow made generic with chipLabel parameter
• HubBrowseView hubQuery driven from ViewModel state (no dupe)
• ViewModel toasts use getString(R.string.*) via AndroidViewModel
• MaterialTheme.colorScheme.error → LocalHermesStatusColors.current.error
* fix: OpenDrawer → Menu, listContentPadding is PaddingValues not ext
NavIcon.OpenDrawer doesn't exist, use NavIcon.Menu. listContentPadding is a val PaddingValues, not a Modifier extension — use Modifier.padding(listContentPadding).
* fix: NavIcon.Menu(onClick) -> NavIcon.Menu(onOpen)
* fix: pass mockApp to SkillsViewModel in unit tests (now AndroidViewModel)
* fix: mock getString in unit tests for AndroidViewModel string resources
* fix: anyVararg<Any?>() → anyVararg<Any>() to satisfy type bound
anyVararg<T> has bound T : Any, so Any? doesn't compile.
Any is a subtype of Any? at the JVM level, so the matcher
works correctly for vararg Any? parameters.
* fix: use anyVararg<String>() for getString mock to match actual runtime types
The previous anyVararg<Any>() did not match getString(Int, Object...) vararg
calls at runtime — mockk's relaxed mock returned '' for all formatted string
resources, causing all Skills error-path assertions to fail (9 tests).
Root cause: mockk vararg matchers match by reified element type. The Java
method Context.getString(int, Object...) passes format args as String at
runtime (via Kotlin's spread). anyVararg<Any>() with Any (boxed) doesn't
match Object/String vararg elements reliably, but anyVararg<String>() does,
since String satisfies the T : Any bound and matches the actual runtime type.
Also added getString(Int) stub for the no-arg overload used by enums.
* fix: stub getString per-resource-ID to bypass mockk Java vararg bug
mockk has a known bug matching Java vararg methods like
Context.getString(int, Object...) with anyVararg<T>() — the matcher
silently fails to match, and the relaxed mock returns '' for all
formatted string resource calls. This caused 8 Skills error-path tests
to fail (errorMessage/toastMessage was '' instead of containing 'HTTP 500').
Root cause: confirmed via test report artifacts — errorMessage was
non-null but empty string, proving the vararg stub never matched.
Fix: replace the generic anyVararg<String>() stub with explicit per-
resource-ID stubs using eq() + any<String>() matchers. Each formatted
string resource is stubbed individually, returning the format arg
(the dynamic error message) so the test assertions find 'HTTP 500'
and 'Timeout' substrings.
References:
- https://stackoverflow.com/questions/54326914/using-mockk-to-match-any-varargs
- https://github.com/mockk/mockk/issues/224
* fix(skills): replace AndroidViewModel getString() with hardcoded strings to fix unit tests
The SkillsViewModel was using getApplication<Application>().getString() for
error/success messages. In unit tests, mockk cannot reliably stub Java vararg
Context.getString(int, Object...), causing NullPointerException inside
coroutine onError callbacks. All other ViewModels in the codebase use hardcoded
strings; this change aligns SkillsViewModel with that convention.
* test: add hub search/install/uninstall/preview coverage + rm vestigial stubs
- Remove unused mockApp.getString() per-resource-ID stubs (SkillsViewModel
no longer calls getApplication().getString() — hardcoded strings now).
- Add 10 tests covering hub search (success/empty/error/emptyQuery),
hub install (success/error), hub uninstall (success/error), and skill
preview (success/error). Uses existing mockk + runTest patterns.
* fix: correct import ordering for HubSkill (H < S)
Move HubSkill import before KanbanBoard (H < K) and remove duplicate
that was between SessionListResponse and Skill.
* test: remove coVerify from emptyQuery test (cross-test mock state)
* fix: remove double-stacked padding in SkillsScreen (HermesScaffold handles it)
Per AGENTS.md — HermesScaffold already offsets for the top bar
internally, so .padding(padding) on inner content creases double-stacked
top padding.
* refactor: merge preview + edit button in SkillCard into single adaptive action
Per AGENTS.md — two nearly-identical icon buttons (Preview + Edit)
side by side was confusing. Merged into one Edit button since
both opened the same skill content dialog (editable for installed,
read-only for hub is handled by the ViewModel).
* fix: revert onCategoryChange to non-null String (FilterChipRow<T> needs it)
Also removes leftover Preview icon import that ktlint flagged.
* refactor: restructure SkillCard layout — name gets full width, actions below
The old layout crammed icon, name, source badge, edit button, uninstall
button, AND toggle switch all on one horizontal row. Long skill names
got truncated to 2-3 characters.
New layout:
- Top row: icon | name (weight 1f) | source badge | toggle switch
- Below: category (if present)
- Below: description (if present)
- Bottom row: edit + uninstall buttons (end-aligned, only if hub source)
The name Text now has weight(1f) so it fills all available space.
* fix: fix brace nesting + move icon to far left for extra name space
* fix: add missing height import
* refactor: remove Extension icon from SkillCard for cleaner layout
* fix: remove double-stacked padding in SkillEditorDialog and SkillPreviewDialog
Both dialogs had the AGENTS.md footgun: HermesScaffold already offsets
the top bar internally, but the inner Box had .padding(padding) stacking
an extra ~56dp gap between the header and the edit text field.
* fix(skills-hub): unwrap SkillHubSearchResponse wrapper
Backend changed /api/skills/hub/search from returning a raw JSON
array to an object wrapper: { results: [...], source_counts: {...}, ... }
- Added SkillHubSearchResponse, SkillHubInstalledEntry models
- Extended HubSkill with identifier, trustLevel, repo, tags
- Updated API endpoint return type to SkillHubSearchResponse
- ViewModel unwraps data?.results.orEmpty() instead of data.orEmpty()
* fix: unwrap SkillHubSearchResponse in ProfilesViewModel too + remove unused HubSkill import
* fix: update test mocks to use SkillHubSearchResponse wrapper
* fix: refactor HubSkillCard layout — remove icon, name gets full width, install below
* fix: use unique key for hub results + weight(1f) to prevent scroll crash
* fix(skills): resolve crash due to duplicate keys in lazy list
* feat(skills): move search hub button into trailing icon of search bar
---------
Co-authored-by: M57 <hy4ri@users.noreply.github.com>
* feat(#442): categorized env keys screen with add/remove, search, and gateway restart
- Group env vars by category (LLM Providers, Tool API Keys, Messaging
Platforms, Agent Settings, Other) with collapsible AnimatedVisibility
sections matching MCP screen pattern
- Add new env var form (PUT /api/env) with key/value inputs
- Delete env var via DELETE /api/env with EnvVarDeleteRequest body
- Reveal/hide/edit inline per-card controls
- Search bar filtering across key names and descriptions
- Gateway restart banner with one-click action when changes are dirty
- Track keysChanged flag showing restart prompt after mutations
- Wire delete endpoint in HermesApiService using @HTTP(hasBody=true)
- Add EnvVarDeleteRequest data model class
* fix(#442): update test to match new categorized KeysViewModel API
* fix(#442): satisfy ktlint multiline-expression-wrapping rule
---------
Co-authored-by: Hermes Agent <hermes@agent.local>
* feat(#444): add MCP API endpoints and data models
- Add McpServer.status and McpServer.error fields for diagnostics
- Add AddMcpServerRequest, McpCatalogResponse/Entry/EnvVar models
- Add McpServerTestResponse model
- Add POST addMcpServer, PUT updateMcpServer, POST restartMcpServer
- Add GET getMcpCatalog, POST installMcpCatalogEntry
* feat(#444): add server form, enriched server cards, catalog section
- Add HTTP/stdio inline server form with tabs
- Enriched server cards with status badge, restart, env var editing
- Add/edit/remove environment variables per server
- Catalog section with search, result cards, install flow with env vars
- Status badge colors: running=green, error=red, stopped/gray
- Server diagnostics shown as error badges on cards
- New string resources for all MCP UI elements
* fix(#444): add missing McpServer import to HermesApiService
* fix(#444): cleanup review issues — dead code, spinner, unused strings
- Remove unused serverDiagnostics from UiState
- Remove unused showDiagnostics local state in ServerCard
- Remove unused McpServerTestResponse model
- Remove redundant refreshDiagnostics() alias
- Replace catalog loading text with CircularProgressIndicator
- Remove unused string resources (action_restarting, diagnostics, catalog_load)
* fix(#444): remove remaining showDiagnostics reference at line 348
---------
Co-authored-by: Hermes Agent <hermes@agent.local>
