release(server): server-v1.11.2

fix(android): serialize endpoint probe invalidation

CHANGELOG.md

@@ -8,15 +8,21 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 
 ### Fixed
 
+- Android no longer crashes when a route probe finishes while a network change invalidates the endpoint cache.
 - Android opens an authenticated Gateway chat on the first foreground launch instead of waiting for a background-and-resume cycle to leave the waking state. (#495, #528)
 - Android Dashboard sign-in removes pasted line breaks from username and password fields, matching the browser login while preserving every other credential character. (#541)
-- **Relay tool availability avoids repeated Windows loopback delays and preserves multi-PC capabilities.** Host-local Android, Desktop, and Phone paths use explicit IPv4 loopback, while Desktop checks share a bounded health snapshot that preserves per-client advertisements and fails closed when Hermes-Relay is unavailable. (#562, #563)
 - Android keeps saved Dashboard sign-ins bound to their connection when switching gateways, rather than letting a stale resolver route invalidate another connection's session.
 - Bot Mode no longer crashes when different connections have bots with the same profile name. Both the conversation list and Active Now strip preserve each bot's connection, and opening progress appears only on the selected bot.
 - Android feedback uses themed banners and action cards instead of platform toasts and default snackbars. Dashboard errors no longer misidentify missing resources as an outdated Relay. Developer settings includes local-only message previews.
 - Missing chat attachments show their error and retry in the attachment card without repeated global popups. Global action messages occupy the top message area instead of covering the composer.
 - Chat distinguishes session preparation from response streaming and retains initialization errors that arrive before the session acknowledgement. Long-press the agent header to open a live session-diagnostics drawer.
 - Delegated-agent activity survives parent replies and leaves compact history entries for later read-only review. The activity strip appears only while work runs; historical process views cannot stop or dismiss live work. (#447)
+
+## [Plugin 1.11.2] - 2026-09-09
+
+### Fixed
+
+- **Relay tool availability avoids repeated Windows loopback delays and preserves multi-PC capabilities.** Host-local Android, Desktop, and Phone paths use explicit IPv4 loopback, while Desktop checks share a bounded health snapshot that preserves per-client advertisements and fails closed when Hermes-Relay is unavailable. (#562, #563)
 - **`android_*` tools resolve bridge credentials written after host startup.** Requests retry profile-scoped env and active bridge-session credentials after a stale token is rejected, and vision navigation now shares the same current Relay transport instead of the retired standalone default.
 - **`android_setup` accepts both its canonical and legacy schema keys.** `bridge_session_token` and `pairing_code` are accepted, while a missing token returns a structured error.
 - **Android tool setup tests use a temporary Hermes home.** Test runs no longer write bridge settings into a developer environment.

PLUGIN_RELEASE_NOTES.md

@@ -1,15 +1,17 @@
 # Hermes-Relay Plugin v__VERSION__
 
-**Release Date:** August 31, 2026
+**Release Date:** September 9, 2026
 
 ## Summary
 
-This patch restores native installation compatibility on affected Hermes versions and makes Relay prompt context advertise only capabilities the selected session can actually call. Standard Chat, Manage, standard voice, and ordinary inbound files remain upstream-owned.
+This patch makes Android and Desktop tool availability fast and reliable when Relay is unavailable, starts late-created Android bridge sessions without restarting Hermes, and restores compatibility with both current and legacy `android_setup` arguments. Standard Chat, Manage, standard voice, and ordinary inbound files remain upstream-owned.
 
 ## Fixed
 
-- **Native installer compatibility.** The plugin keeps its complete current manifest while avoiding the installer/runtime schema mismatch that caused `manifest_version 2` installs to fail after an apparent Hermes update.
-- **Capability-gated phone context.** Phone-control and cross-platform delivery guidance now follows the selected session/profile tool catalog instead of implying unavailable `android_*` or `send_message` callables.
+- **Fast, accurate tool availability.** Android and Desktop tool checks use explicit IPv4 loopback and one bounded health snapshot instead of repeated per-tool connection attempts. Multi-PC capability advertisements remain isolated, and unavailable Relay clients continue to fail closed.
+- **Late Android bridge recovery.** `android_*` calls retry profile-scoped and active bridge-session credentials after a stale token is rejected, so a phone connected after Hermes startup becomes usable without restarting the host.
+- **Compatible Android setup arguments.** `android_setup` accepts the canonical `bridge_session_token` and `pairing_code` fields as well as their legacy aliases, with structured errors when no usable credential is supplied.
+- **Isolated setup tests.** Android tool setup tests use a temporary Hermes home instead of writing bridge settings into the operator environment.
 
 ## Install / update
 

app/src/androidTest/kotlin/com/hermesandroid/relay/network/shared/EndpointResolverConcurrencyInstrumentedTest.kt

@@ -0,0 +1,100 @@
+package com.hermesandroid.relay.network.shared
+
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import com.hermesandroid.relay.data.ApiEndpoint
+import com.hermesandroid.relay.data.EndpointCandidate
+import kotlinx.coroutines.CoroutineStart
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.async
+import kotlinx.coroutines.runBlocking
+import kotlinx.coroutines.withTimeout
+import okhttp3.OkHttpClient
+import okhttp3.Protocol
+import okhttp3.Response
+import okhttp3.ResponseBody.Companion.toResponseBody
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import org.junit.runner.RunWith
+import java.io.InterruptedIOException
+import java.util.concurrent.CountDownLatch
+import java.util.concurrent.TimeUnit
+import java.util.concurrent.atomic.AtomicInteger
+
+@RunWith(AndroidJUnit4::class)
+class EndpointResolverConcurrencyInstrumentedTest {
+
+    @Test
+    fun probeCompletionRacingInvalidation_staysCrashFreeOnAndroidCollections() = runBlocking {
+        repeat(25) { iteration ->
+            val candidateCount = 8
+            val requestsStarted = CountDownLatch(candidateCount)
+            val releaseRequests = CountDownLatch(1)
+            val raceGate = CountDownLatch(1)
+            val requestSequence = AtomicInteger(0)
+            val client = OkHttpClient.Builder()
+                .addInterceptor { chain ->
+                    if (requestSequence.incrementAndGet() <= candidateCount) {
+                        requestsStarted.countDown()
+                        releaseRequests.await(5, TimeUnit.SECONDS)
+                        throw InterruptedIOException("instrumented invalidation race")
+                    }
+                    Response.Builder()
+                        .request(chain.request())
+                        .protocol(Protocol.HTTP_1_1)
+                        .code(200)
+                        .message("OK")
+                        .body("{}".toResponseBody())
+                        .build()
+                }
+                .build()
+            val resolver = EndpointResolver(client)
+            val candidates = (1..candidateCount).map { index ->
+                EndpointCandidate(
+                    role = "instrumented-$iteration-$index",
+                    priority = 0,
+                    api = ApiEndpoint(host = "127.0.0.1", port = 1, tls = false),
+                )
+            }
+
+            try {
+                val staleResolve = async(start = CoroutineStart.UNDISPATCHED) {
+                    resolver.resolve(candidates, EndpointSurface.Api)
+                }
+                assertTrue(requestsStarted.await(5, TimeUnit.SECONDS))
+
+                val invalidation = async(Dispatchers.Default) {
+                    raceGate.await(5, TimeUnit.SECONDS)
+                    resolver.clearCache()
+                }
+                val completions = async(Dispatchers.Default) {
+                    raceGate.await(5, TimeUnit.SECONDS)
+                    releaseRequests.countDown()
+                }
+                raceGate.countDown()
+
+                withTimeout(2_000L) {
+                    invalidation.await()
+                    completions.await()
+                    staleResolve.await()
+                }
+                assertTrue(resolver.cacheSnapshot().isEmpty())
+
+                resolver.clearCache()
+                val freshWinner = withTimeout(2_000L) {
+                    resolver.resolve(listOf(candidates.first()), EndpointSurface.Api)
+                }
+                assertEquals(candidates.first(), freshWinner)
+                assertTrue(
+                    resolver.probeOutcomes.value.getValue(
+                        EndpointResolver.cacheKey(candidates.first(), EndpointSurface.Api),
+                    ).reachable,
+                )
+            } finally {
+                raceGate.countDown()
+                releaseRequests.countDown()
+                client.dispatcher.executorService.shutdown()
+            }
+        }
+    }
+}

app/src/main/kotlin/com/hermesandroid/relay/network/shared/EndpointResolver.kt

@@ -149,7 +149,10 @@ class EndpointResolver(
     )
 
     private val probeCache = ConcurrentHashMap<String, CacheEntry>()
-    private val inFlightProbes = ConcurrentHashMap<String, Deferred<Boolean>>()
+    // Every access is owned by [probeStateLock]. This must not be a
+    // concurrently-mutated collection: clearCache() takes a stable snapshot
+    // while completion callbacks remove finished probes.
+    private val inFlightProbes = mutableMapOf<String, Deferred<Boolean>>()
     private val probeScope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
     private val probeStateLock = Any()
     private var probeGeneration = 0L
@@ -486,7 +489,13 @@ class EndpointResolver(
                     probe(candidate, surface, generation)
                 }.also { deferred ->
                     inFlightProbes[key] = deferred
-                    deferred.invokeOnCompletion { inFlightProbes.remove(key, deferred) }
+                    deferred.invokeOnCompletion {
+                        synchronized(probeStateLock) {
+                            // Identity-aware removal prevents an invalidated
+                            // probe from removing its fresh replacement.
+                            inFlightProbes.remove(key, deferred)
+                        }
+                    }
                     deferred.start()
                 }
             }

app/src/test/kotlin/com/hermesandroid/relay/network/shared/EndpointResolverTest.kt

@@ -477,6 +477,151 @@ class EndpointResolverTest {
         )
     }
 
+    @Test
+    fun clearCache_handlesConcurrentProbeCompletions_withoutThrowingOrPublishingStaleState() = runTest {
+        val candidateCount = 24
+        val staleRequestsStarted = CountDownLatch(candidateCount)
+        val releaseStaleRequests = CountDownLatch(1)
+        val staleRequestsFinished = CountDownLatch(candidateCount)
+        val raceGate = CountDownLatch(1)
+        val requestSequence = AtomicInteger(0)
+        val blockingClient = fastClient.newBuilder()
+            .addInterceptor { chain ->
+                if (requestSequence.incrementAndGet() <= candidateCount) {
+                    staleRequestsStarted.countDown()
+                    try {
+                        releaseStaleRequests.await(5, TimeUnit.SECONDS)
+                    } finally {
+                        staleRequestsFinished.countDown()
+                    }
+                    throw InterruptedIOException("concurrent invalidation test probe")
+                }
+                chain.proceed(chain.request())
+            }
+            .build()
+        val resolver = EndpointResolver(blockingClient, clock = { clockMillis.get() })
+        val candidates = (1..candidateCount).map { index ->
+            candidate("concurrent-clear-$index", priority = 0, server = reachableServer)
+        }
+
+        try {
+            val staleResolve = async(start = CoroutineStart.UNDISPATCHED) {
+                resolver.resolve(candidates, EndpointSurface.Api)
+            }
+            assertTrue(
+                "every physical probe must be active before the completion/invalidation race",
+                staleRequestsStarted.await(5, TimeUnit.SECONDS),
+            )
+
+            val invalidation = async(Dispatchers.Default) {
+                raceGate.await(5, TimeUnit.SECONDS)
+                resolver.clearCache()
+            }
+            val completions = async(Dispatchers.Default) {
+                raceGate.await(5, TimeUnit.SECONDS)
+                releaseStaleRequests.countDown()
+            }
+            raceGate.countDown()
+
+            withContext(Dispatchers.Default.limitedParallelism(1)) {
+                withTimeout(2_000L) {
+                    invalidation.await()
+                    completions.await()
+                    staleResolve.await()
+                }
+            }
+            assertTrue(staleRequestsFinished.await(5, TimeUnit.SECONDS))
+            assertTrue(resolver.cacheSnapshot().isEmpty())
+
+            resolver.clearCache()
+            val freshWinner = withContext(Dispatchers.Default.limitedParallelism(1)) {
+                withTimeout(2_000L) {
+                    resolver.resolve(listOf(candidates.first()), EndpointSurface.Api)
+                }
+            }
+            assertEquals(candidates.first(), freshWinner)
+            assertTrue(
+                "a completion racing invalidation must not overwrite the fresh generation",
+                resolver.probeOutcomes.value.getValue(
+                    EndpointResolver.cacheKey(candidates.first(), EndpointSurface.Api),
+                ).reachable,
+            )
+        } finally {
+            raceGate.countDown()
+            releaseStaleRequests.countDown()
+        }
+    }
+
+    @Test
+    fun invalidatedProbeCompletion_cannotRemoveFreshReplacement() = runTest {
+        val staleRequestStarted = CountDownLatch(1)
+        val releaseStaleRequest = CountDownLatch(1)
+        val staleRequestFinished = CountDownLatch(1)
+        val freshRequestStarted = CountDownLatch(1)
+        val releaseFreshRequest = CountDownLatch(1)
+        val requestSequence = AtomicInteger(0)
+        val blockingClient = fastClient.newBuilder()
+            .addInterceptor { chain ->
+                when (requestSequence.incrementAndGet()) {
+                    1 -> {
+                        staleRequestStarted.countDown()
+                        try {
+                            releaseStaleRequest.await(5, TimeUnit.SECONDS)
+                        } finally {
+                            staleRequestFinished.countDown()
+                        }
+                        throw InterruptedIOException("invalidated identity test probe")
+                    }
+                    2 -> {
+                        freshRequestStarted.countDown()
+                        releaseFreshRequest.await(5, TimeUnit.SECONDS)
+                        chain.proceed(chain.request())
+                    }
+                    else -> chain.proceed(chain.request())
+                }
+            }
+            .build()
+        val resolver = EndpointResolver(blockingClient, clock = { clockMillis.get() })
+        val candidate = candidate("replacement-identity-test", priority = 0, server = reachableServer)
+
+        try {
+            val staleResolve = async(start = CoroutineStart.UNDISPATCHED) {
+                resolver.resolve(listOf(candidate), EndpointSurface.Api)
+            }
+            assertTrue(staleRequestStarted.await(5, TimeUnit.SECONDS))
+            resolver.clearCache()
+
+            val freshResolve = async(start = CoroutineStart.UNDISPATCHED) {
+                resolver.resolve(listOf(candidate), EndpointSurface.Api)
+            }
+            assertTrue(freshRequestStarted.await(5, TimeUnit.SECONDS))
+
+            releaseStaleRequest.countDown()
+            assertTrue(staleRequestFinished.await(5, TimeUnit.SECONDS))
+            withContext(Dispatchers.Default.limitedParallelism(1)) {
+                withTimeout(1_000L) { staleResolve.await() }
+            }
+
+            val joiningResolve = async(start = CoroutineStart.UNDISPATCHED) {
+                resolver.resolve(listOf(candidate), EndpointSurface.Api)
+            }
+            releaseFreshRequest.countDown()
+
+            withContext(Dispatchers.Default.limitedParallelism(1)) {
+                assertEquals(candidate, withTimeout(2_000L) { freshResolve.await() })
+                assertEquals(candidate, withTimeout(2_000L) { joiningResolve.await() })
+            }
+            assertEquals(
+                "the late stale completion must leave the fresh shared probe registered",
+                2,
+                requestSequence.get(),
+            )
+        } finally {
+            releaseStaleRequest.countDown()
+            releaseFreshRequest.countDown()
+        }
+    }
+
     // ---------------------------------------------------------------
     // Test 6 — cached-reachable result is re-probed after TTL
     // ---------------------------------------------------------------

plugin/dashboard/manifest.json

@@ -3,7 +3,7 @@
   "label": "Hermes-Relay",
   "description": "Paired devices, Bridge activity, media tokens, and remote access for Hermes-Relay",
   "icon": "Activity",
-  "version": "1.11.1",
+  "version": "1.11.2",
   "tab": {
     "path": "/relay",
     "position": "after:skills"

plugin/dashboard/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "hermes-relay-dashboard",
-  "version": "1.11.1",
+  "version": "1.11.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "hermes-relay-dashboard",
-      "version": "1.11.1",
+      "version": "1.11.2",
       "devDependencies": {
         "esbuild": "^0.25.12",
         "qrcode": "^1.5.4"

plugin/dashboard/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hermes-relay-dashboard",
-  "version": "1.11.1",
+  "version": "1.11.2",
   "private": true,
   "description": "Hermes-Relay dashboard plugin frontend (IIFE bundle). Loaded verbatim by the hermes-agent dashboard via the Plugin SDK global.",
   "scripts": {

plugin/plugin.yaml

@@ -2,7 +2,7 @@ name: hermes-relay
 # Temporary v1 shim for Hermes installers that reject manifests the runtime supports; see docs/project/TODO.md.
 manifest_version: 1
 api_version: 1
-version: 1.11.1
+version: 1.11.2
 description: "Hermes-Relay plugin for QR pairing, relay sessions, dashboard management, remote desktop/phone tooling, and optional legacy compatibility diagnostics. Standard chat, Manage, and dashboard voice remain vanilla upstream Hermes surfaces."
 author: Axiom Labs
 license: MIT

plugin/relay/__init__.py

@@ -19,7 +19,7 @@ See ``plugin/relay/server.py`` for the aiohttp server,
 # CLI+UI releases use desktop/package.json and desktop-v* tags. The /health endpoint
 # reports this plugin version, and stale values make live diagnosis harder than
 # it should be.
-__version__ = "1.11.1"
+__version__ = "1.11.2"
 
 from .server import create_app, main  # noqa: E402 — must come after __version__
 

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "hermes-relay"
-version = "1.11.1"
+version = "1.11.2"
 description = "Hermes-Relay plugin — Android device control toolset, QR pairing CLI, and WSS relay server for hermes-agent"
 requires-python = ">=3.11"
 dependencies = [