* fix(network): scope management REST calls with ?profile= (fixes#528)
Mobile fired all management REST calls with NO profile scope, so every
profile read/wrote the backend's implicit default profile — multi-profile
setups silently corrupted config/skills/toolsets/mcp/model/env.
Add ProfileScopeInterceptor (OkHttp) that appends ?profile=<activeProfile>
to the same endpoint families the desktop/web dashboard scopes
(web/src/lib/api.ts PROFILE_SCOPED_PREFIXES), respecting:
- no active profile -> pass through (legacy default behavior)
- explicit ?profile= on the URL wins over the global scope
- only scoped families rewritten; ops/pairing/cron/profiles stay global
Wired into ApiClient.buildService(). 5 MockWebServer tests cover scoped
append, explicit-param precedence, no-profile passthrough, non-scoped skip,
and skills scoping.
Mirrors desktop/web contract derived from audit of /opt/hermes-agent.
* fix(ci): stub getSelectedProfileId in ApiClientTest + harden prefix match (fixes PR #540)
- ApiClientTest: stub AuthManager.getSelectedProfileId() to null. The new
ProfileScopeInterceptor (registered in ApiClient.buildService) calls it, and
the unstubbed real method threw IllegalStateException at AuthManager.kt:56,
breaking all 4 auth-interceptor tests.
- ProfileScopeInterceptor: replace startsWith(prefix) with whole-segment match
(path == prefix || path.startsWith(prefix/)) so lookalike paths like
/api/statusXYZ are NOT wrongly scoped (Sourcery review, PR #540).
- ProfileScopeInterceptorTest: add lookalikePath_notScoped + scopedSubPath_isScoped
to lock the segment-boundary fix.
M57
c5d1ef1c42