hermes-relay

Files

T

Bailey DixonandClaude Opus 4.7 fae8ccd58f feat(pairing): multi-endpoint pairing + first-class Tailscale (ADR 24, 25)

Multi-endpoint pairing (ADR 24):
- QR schema now carries an optional ordered `endpoints` array with
  strict priority + reachability-as-tiebreaker semantics. Emits
  `hermes:3` when endpoints are present; `hermes:2` stays when
  only a legacy single-URL pair is emitted. Old v1/v2 QRs parse
  unchanged — phone synthesizes a priority-0 candidate for them.
- Reachability probe: HEAD /health per candidate, 2s timeout, 30s
  per-endpoint cache. NetworkCallback re-probes on network change.
- Paired Devices screen now renders one row per (device, endpoint);
  Settings gains an Endpoints card with per-endpoint health chip +
  manual override + "probe now" + SPKI pin inspection.
- Open-vocabulary roles: `lan` / `tailscale` / `public` get styled
  chips; unknown roles render as "Custom VPN (<role>)". HMAC
  canonicalization preserves role strings verbatim + array order.

First-class Tailscale (ADR 25):
- New `plugin/relay/tailscale.py` + `tailscale_cli.py` helpers +
  `scripts/hermes-relay-tailscale` shell shim (mirrors `hermes-pair`).
  Shells `tailscale serve --bg --https=<port> http://127.0.0.1:<port>`.
- `install.sh` gains optional step 7/7 — silent skip when binary
  absent or TS_DECLINE=1; auto-enable with TS_AUTO=1.
- `pair.py --mode auto` auto-detects Tailscale and emits a
  priority-1 `tailscale` endpoint when available.
- Auto-retires when upstream hermes-agent PR #9295 merges, via
  `canonical_upstream_present()` probe — same shape as
  `hermes_relay_bootstrap/`.

Dashboard Remote Access tab:
- New 5th tab surfacing Tailscale status, public URL pin, live
  reachability, and one-click QR regen with current modes.
- 6 new loopback-only proxy routes under
  `/api/plugins/hermes-relay/remote-access/*`.
- Bundle rebuilt (plugin/dashboard/dist/index.js).

Docs:
- New `docs/remote-access.md` operator-facing setup guide covering
  Tailscale (recommended) / Caddy+LE / Cloudflare Tunnel /
  WireGuard / plaintext-over-VPN with working config blocks.
- security.md + relay-server.md + spec.md §3.3 + README.md +
  CHANGELOG.md + DEVLOG.md + CLAUDE.md all synced.

Tests:
- Python: 71 new/updated tests (pairing schema + QR sign canonical
  form + Tailscale helper + dashboard proxy routes).
- Android: 9 HermesPairingPayload tests (v1/v2/v3 + role vocab) +
  7 MockWebServer-backed EndpointResolver tests.
- Lint + compileGooglePlayDebugKotlin green locally.

Restored `profilesUpdatedEvents` emitter in AuthManager /
ConnectionViewModel that the Kt-Payload agent had collaterally
deleted while adding endpoint persistence — unrelated but the
bundle would not compile without it.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-04-19 17:37:31 -04:00

bridge-smoke.sh

fix(bridge-smoke): foreground hermes app for clipboard round-trip

2026-04-14 20:40:03 -04:00

bump-version.sh

docs: migrate policy to main+dev branching model

2026-04-19 12:02:49 -04:00

dev.bat

chore: migrate applicationId to com.axiomlabs.hermesrelay + AGP 9.1.1

2026-04-13 19:03:51 -04:00

dev.sh

chore: migrate applicationId to com.axiomlabs.hermesrelay + AGP 9.1.1