bonzi/hermes-mobile
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add first-run setup wizard

Browse Source
This commit is contained in:
Hermes Agent
2026-07-24 18:15:30 +00:00
parent 3b883bd534
commit 5b3263ef14
17 changed files with 2831 additions and 103 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/DIRECT_GATEWAY_ARCHITECTURE.md
+14
View File
@@ -95,6 +95,20 @@ Security and reliability rules:
- A later milestone may add opt-in mDNS/QR setup, certificate pinning/identity binding, and richer connectivity observation only after direct-gateway basics are verified.
- The current upstream identity-binding limitation and the stronger contract needed are tracked in `docs/BLOCKERS.md`.
## First-run setup and authentication
The Android app owns one versioned setup profile. First launch shows welcome/privacy guidance and requires an explicit Remote HTTPS URL; a Local HTTPS URL is optional and represents the same logical gateway for local-first routing. A valid existing profile bypasses mandatory setup, while legacy/current valid profiles are marked migrated once without requiring credential re-entry. Settings reopens the same wizard state for later edits.
Supported client authentication modes are:
- **None** — probes and compatible requests carry no authorization credential.
- **Bearer** — the token is encrypted at rest and sent only to the selected configured gateway through the existing authorization-header path.
- **Username/password** — the client posts directly to the configured Remote gateway's `/auth/password-login`, accepts only allowlisted Hermes session-cookie names from `Set-Cookie`, encrypts the password and resulting cookie at rest, and sends only the cookie pair on subsequent authenticated checks.
Raw bearer tokens, passwords, and session cookies are excluded from Compose wizard state string output, connection forms, diagnostics, and logs. Changing the remote URL or username invalidates credentials bound to the previous gateway/account; editing may retain an existing encrypted credential only while its binding remains unchanged. Login redirects are disabled, cookie values are validated against header injection, and unsuccessful login clears the prior session cookie.
Setup completion is gated on the same local-first compatibility test used by connection Settings: Local is attempted first when configured, then Remote is used as fallback. This source contract has unit/build verification only; no real gateway credentials, attached Android target, clean install, or release flow has been verified.
## Android Contract Milestones
1. Auth and connection: validate local + remote URLs, store bearer tokens securely, probe `GET /health`, use `GET /v1/models` as the first authenticated check, and make local-first fallback observable/retryable.