feat(desktop): continue a secure session on phone

[joelbrilliant]

What changed

• Adds a Continue on phone action to persisted Desktop sessions.
• Reads the operator's configured dashboard public URL through a new authenticated endpoint.
• Probes the public target and only renders a QR code when it is reachable, HTTPS and protected by the dashboard auth gate.
• Preserves path prefixes and routes the session through its exact Hermes profile.
• Adds loading, error, retry, copy-link and open-in-browser states in every Desktop locale.

Why

Hermes already supports resuming a session in the dashboard with /chat?resume=<session id>, but Desktop users have to reconstruct that URL themselves. This makes the existing remote path discoverable from the session they are already using.

The security boundary is deliberate. The handoff never embeds a token or credential, refuses HTTP and URL user info, and does not expose a QR code for an unreachable or non-gated dashboard. The new configuration endpoint remains behind the existing dashboard authentication middleware.

Applicability

This is configuration-driven rather than tied to one operator. It works with any HTTPS, OAuth-gated Hermes dashboard, including path-prefixed and multi-profile deployments. No hostname, token, profile name, tunnel provider or install path is built in. Loopback-only and fixed-token deployments intentionally remain unavailable because a scannable URL must not contain credentials.

Verification

• npx vitest run src/app/chat/continue-on-phone-dialog.test.tsx src/lib/continue-on-phone.test.ts src/app/chat/sidebar: 71 passed.
• python -m pytest tests/hermes_cli/test_web_server.py -q -k dashboard_remote_access: 2 passed.
• npm run typecheck: passed.
• Changed-file ESLint: passed with no warnings.
• npm run build: passed.
• Browser verification covered ready, loading and recoverable error states at desktop width and 393 x 852. The narrow layout had no horizontal overflow, and Copy link plus Open in browser both used the exact profile-scoped session URL.

Known upstream test debt

The full Desktop suite still has one ToolsetConfigPanel assertion expecting Installed while the component renders Ready. A clean origin-nous/main worktree reproduced the same failure. The focused test file passes in isolation.

The full test_web_server.py file also reaches the existing shared virtual environment failure where its Python binary references a missing temporary libpython3.11.dylib. The two new endpoint tests pass directly.

[joelbrilliant]

Rebased onto current main (766c617) and pushed follow-up fixes as 1b7962513. The rebase rewrote history, hence the forced update; the branch is the feature commit plus one fix commit on top.

• Rebase conflict: apps/desktop/src/hermes.ts, where main's new Custom* endpoint types landed in the same sorted import/export lists as this branch's DashboardRemoteAccessResponse. Both sets kept, sorted.
• Profile propagation: sessions resolved by id were upserted without a profile tag, so the handoff URL could omit ?profile= and the phone would resume against the gateway's sticky active profile rather than the owning one. resolveStoredSession now stamps the active profile on the untagged row, mirroring the existing upsertOptimisticSession pattern in the same file; all three menu surfaces read from the same store row, so the one chokepoint covers them.
• Unavailable-state copy: no longer implies a token-authenticated dashboard is unauthenticated. It now states the real requirement, an HTTPS public URL serving a browser sign-in (OAuth-gated) dashboard, and that token-authenticated dashboards cannot be opened from a phone browser. All four locales updated, keys unchanged.
• Docs: web-dashboard.md gains a "Continue a session on your phone" section covering prerequisites (dashboard.public_url or HERMES_DASHBOARD_PUBLIC_URL, HTTPS, browser sign-in gated dashboard, token-proxy topologies called out as unsupported), that the QR encodes the URL only with no credentials, and the auth-gated GET /api/dashboard/remote-access endpoint.
• Test fidelity: added a pytest that writes dashboard.public_url into the per-test temp HERMES_HOME config.yaml and asserts the endpoint returns it through real config loading, no resolve_public_url monkeypatch. The existing mocked test stays.

Evidence: pytest -k remote_access 3/3; desktop vitest 40/40 across the dialog, lib, sidebar and utils files; desktop typecheck, eslint on changed files and the full desktop build clean.

[teknium1]

Thanks for the carefully scoped handoff flow and the auth-gate checks. The feature remains absent from current main, but one profile-routing issue needs correction.

Problems

• hermes_cli/web_server.py:18249 resolves the URL without accepting or scoping the profile query. Desktop supplies the owning profile in apps/desktop/src/lib/continue-on-phone.ts:64; in global-remote mode Electron appends that query (apps/desktop/electron/connection-config.ts:353-387). The handler therefore ignores it and can return the dashboard process/default profile's dashboard.public_url, while the QR keeps the named session profile.

Suggested changes

• Accept profile: Optional[str] = None and resolve the URL inside _config_profile_scope(profile) (the existing per-request configuration scope at hermes_cli/web_server.py:15412-15429). Add a named-profile endpoint regression test with distinct public URLs.

Automated hermes-sweeper review.