bonzi/hermes-mobile
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: prevent bearer setup migration bypass

Browse Source
This commit is contained in:
Hermes Agent
2026-07-25 00:17:08 +00:00
parent ec49e639f7
commit 049e93ae3d
6 changed files with 28 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
PROJECT_PLAN.md
+3 -1
View File
@@ -58,7 +58,9 @@ _Move finished items here with date, commit, and verification. Keep this section
- Added direct password login through `/auth/password-login`, allowlisted session-cookie extraction, encrypted cookie/password storage, credential redaction, replacement/retention rules, and cookie-authenticated gateway probes without persisting raw credentials in UI state or connection forms.
- Added Settings entry for editing the same profile, skip behavior for existing valid configurations, one-time legacy/current-profile setup-version migration, and accessible adaptive Compose semantics plus phone/tablet/light/dark previews.
- Fixed a restart bypass: a profile saved by a failed first-run connection test remains in mandatory setup until setup completion is durably recorded; valid migrated and completed profiles still skip setup.
- Repaired current-key existing-user migration: a valid pre-wizard bearer profile stored under the then-current connection keys now receives the one-time completion migration, while untested no-auth profiles remain mandatory.
- Repaired the setup gate so only valid profiles with recorded legacy provenance receive the one-time completion migration; untested first-run None and Bearer profiles remain mandatory after restart.
- Follow-up regression repair on 2026-07-25: removed bearer-token-only self-migration, which could classify a failed/offline first-run Bearer profile as a historical profile. Added a focused restart regression covering that state.
- Verification for the follow-up repair: offline focused `SetupWizardReducerTest` plus `:app:assembleDebug` passed (43 tasks, 9 executed); `git diff --check` passed.
- Verification for the migration repair: source-current offline focused `SetupWizardReducerTest` plus `:app:assembleDebug` passed (43 tasks, 9 executed); `git diff --check` passed.
- Verification on 2026-07-24: source-current offline `:app:testDebugUnitTest :app:assembleDebug` passed (43 tasks, 4 executed; all unit tests passed), including the focused restart-regression test; `git diff --check` passed. No device, release, or real gateway credential test is claimed.
- Task 5 source-current re-verification on 2026-07-24: `/root/.openclaw/workspace/scripts/hermes-mobile-preflight.sh` passed; the documented offline `:app:testDebugUnitTest :app:assembleDebug` command passed (43 tasks, 1 executed); the generated Gradle XML report records 106 tests with 0 failures/errors, including 29 `SetupWizardReducerTest` cases; and `git diff --check` passed. A localhost gateway health probe returned HTTP 200, establishing reachability only. The debug APK reports package `cloud.molberg.hermesmobile`, version `0.1.0-beta.1` (`10001`), SHA-256 `45e4ab4783a74eb766070b0f670a2631a9ebdc044468bbe03087788f8106f150`. No ADB device/emulator or `/dev/kvm` was available; no device installation, real authentication, release, or end-to-end gateway verification is claimed.