feat: authorize iOS Hermes accounts and secure session isolation

Sources/App/AuthStore.swift

@@ -0,0 +1,103 @@
+import Foundation
+
+@MainActor
+final class AuthStore: ObservableObject {
+    @Published private(set) var user: AuthUser?
+    @Published private(set) var token: String?
+    @Published private(set) var isBusy = false
+    @Published private(set) var error: String?
+    var disconnectAccount: (() async -> Void)?
+    let config: ServerConfig
+    private let client: AuthClient
+    private let tokens: TokenStore
+    private var generation = 0
+    private var operation: Task<AuthUser, Error>?
+    private var loginOperation: Task<AuthLoginResponse, Error>?
+    let fixture: Bool
+
+    init(config: ServerConfig, client: AuthClient? = nil, tokens: TokenStore = KeychainTokenStore(), fixture: Bool = false) {
+        self.config = config
+        self.client = client ?? AuthClient(config: config)
+        self.tokens = tokens
+        self.fixture = fixture
+        if fixture {
+            user = AuthUser(id: "offline-fixture", username: "fixture", displayName: "Offline fixture", role: "user", status: "ready")
+            token = "offline-fixture-not-a-server-token"
+        }
+    }
+    func restore() async {
+        guard !fixture, !isBusy, user == nil else { return }
+        generation += 1
+        let current = generation
+        isBusy = true
+        do {
+            guard let saved = try tokens.token(origin: config.baseURL.absoluteString) else { isBusy = false; return }
+            let task = Task { try await client.me(token: saved) }
+            operation = task
+            let verified = try await task.value
+            guard current == generation, !Task.isCancelled else { return }
+            guard ["ready", "provisioning"].contains(verified.status) else { throw AuthError.status(403) }
+            user = verified
+            token = saved
+        } catch {
+            guard current == generation else { return }
+            if let authError = error as? AuthError,
+               case .status(let status) = authError, status == 401 || status == 403 {
+                try? tokens.save(nil, origin: config.baseURL.absoluteString)
+                self.error = "Please sign in to continue."
+            } else {
+                // An outage is not revocation. Preserve the origin-scoped bearer
+                // for a subsequent launch/retry, but expose no unverified user UI.
+                self.error = "Could not verify your saved sign-in. Check the connection or sign in again."
+            }
+        }
+        guard current == generation else { return }
+        isBusy = false
+        operation = nil
+    }
+    func login(username: String, password: String) async {
+        guard !isBusy else { return }
+        if fixture {
+            user = AuthUser(id: "offline-" + username, username: username, displayName: username, role: "user", status: "ready")
+            token = "offline-fixture-not-a-server-token"
+            return
+        }
+        generation += 1
+        let current = generation
+        isBusy = true
+        error = nil
+        do {
+            let task = Task { try await client.login(username: username, password: password) }
+            loginOperation = task
+            let response = try await task.value
+            guard current == generation, !Task.isCancelled else { return }
+            guard !response.token.isEmpty, ["ready", "provisioning"].contains(response.user.status), response.expiresAt > Date().timeIntervalSince1970 else { throw AuthError.status(403) }
+            try tokens.save(response.token, origin: config.baseURL.absoluteString)
+            token = response.token
+            user = response.user
+        } catch {
+            guard current == generation else { return }
+            self.error = error.localizedDescription
+        }
+        guard current == generation else { return }
+        isBusy = false
+        loginOperation = nil
+    }
+    func logout(disconnect: () async -> Void) async {
+        generation += 1
+        loginOperation?.cancel()
+        loginOperation = nil
+        operation?.cancel()
+        operation = nil
+        let previous = token
+        token = nil // immediately disables bootstrap; account UI stays until transport closes
+        isBusy = true
+        await disconnect()
+        try? tokens.save(nil, origin: config.baseURL.absoluteString)
+        user = nil
+        disconnectAccount = nil
+        error = nil
+        if let previous, !fixture { try? await client.logout(token: previous) }
+        isBusy = false
+    }
+}

Sources/App/SettingsStore.swift

@@ -8,9 +8,6 @@ final class SettingsStore: ObservableObject {
     @Published var voiceID: String {
         didSet { AppPreferences.store.set(voiceID, forKey: Keys.voiceID) }
     }
-    @Published var modelID: String? {
-        didSet { AppPreferences.store.set(modelID, forKey: Keys.modelID) }
-    }
     @Published var textMode: Bool {
         didSet { AppPreferences.store.set(textMode, forKey: Keys.textMode) }
     }
@@ -18,7 +15,6 @@ final class SettingsStore: ObservableObject {
     private enum Keys {
         static let serverURL = "serverURL"
         static let voiceID = "voiceID"
-        static let modelID = "modelID"
         static let textMode = "textMode"
     }
 
@@ -41,7 +37,6 @@ final class SettingsStore: ObservableObject {
         }
         let storedVoice = d.string(forKey: Keys.voiceID)
         voiceID = Voices.all.contains { $0.id == storedVoice } ? (storedVoice ?? "") : Voices.defaultID
-        modelID = d.string(forKey: Keys.modelID)
         textMode = d.bool(forKey: Keys.textMode)
     }
 
@@ -64,7 +59,6 @@ enum AppPreferences {
             if ProcessInfo.processInfo.arguments.contains("--live-testing") {
                 defaults.set(SettingsStore.defaultServerURL, forKey: "serverURL")
                 defaults.set(true, forKey: "textMode")
-                defaults.set("qwen2.5-vl-3b", forKey: "modelID")
             }
             return defaults
         }

Sources/App/VoiceApp.swift

@@ -6,12 +6,12 @@ struct VoiceApp: App {
     @StateObject private var settings = SettingsStore()
 
     init() {
-        LiveKitSDK.setLogLevel(.debug)
+        LiveKitSDK.setLogLevel(.error)
     }
 
     var body: some Scene {
         WindowGroup {
-            ConversationView(settings: settings)
+            AuthenticationRoot(settings: settings)
                 .tint(Nearlight.rosewood)
         }
     }

Sources/Features/Conversation/ConversationView.swift

@@ -4,26 +4,32 @@ import SwiftUI
 /// Owns one session across all tabs. Changing tabs never ends a conversation.
 struct ConversationView: View {
     @ObservedObject var settings: SettingsStore
+    @ObservedObject var auth: AuthStore
+    let user: AuthUser
+    let bearerToken: String
     @State private var session: VoiceSession
     @State private var activeServerURL: String
     @State private var pendingServerURL: String?
     @State private var isReplacingSession = false
     @State private var selectedTab = 0
 
-    init(settings: SettingsStore) {
+    init(settings: SettingsStore, auth: AuthStore, user: AuthUser, bearerToken: String) {
+        self.auth = auth
+        self.user = user
+        self.bearerToken = bearerToken
         self.settings = settings
         let url = settings.trimmedServerURL
         _activeServerURL = State(initialValue: url)
-        _session = State(initialValue: Self.makeSession(url, settings: settings))
+        _session = State(initialValue: Self.makeSession(url, settings: settings, bearerToken: bearerToken, userID: user.id))
     }
 
-    private static func makeSession(_ url: String, settings: SettingsStore) -> VoiceSession {
+    private static func makeSession(_ url: String, settings: SettingsStore, bearerToken: String, userID: String) -> VoiceSession {
         guard case .success(let config) = ServerConfig.parse(url) else {
             preconditionFailure("Stored server URL failed validation; init sanitizes to a valid value.")
         }
-        let session = VoiceSession(config: config, tokenClient: TokenClient(config: config), settings: settings)
+        let session = VoiceSession(config: config, tokenClient: TokenClient(config: config, bearerToken: bearerToken), settings: settings, userID: userID)
         #if DEBUG
-        if ProcessInfo.processInfo.arguments.contains("--ui-fixtures") {
+        if userID == "offline-fixture", ProcessInfo.processInfo.arguments.contains("--ui-fixtures") {
             session.transcriptHandler.receiveDataTranscript(role: .user, text: "Help me plan a quiet weekend.")
             session.transcriptHandler.receiveDataTranscript(role: .agent, text: "Let’s leave some room to breathe. A walk, a good book, and time for your favorite music would be a lovely start.")
             session.taskStore.injectSampleEvents()
@@ -45,7 +51,12 @@ struct ConversationView: View {
         TabView(selection: $selectedTab) {
             NavigationStack {
                 ConversationContent(settings: settings, session: session)
-                    .toolbar { settingsLink }
+                    .toolbar {
+                        settingsLink
+                        ToolbarItem(placement: .topBarLeading) {
+                            Button("Sign out") { Task { await auth.logout { await session.disconnect() } } }
+                        }
+                    }
             }
             .tabItem { Label("Talk", systemImage: "bubble.left.and.bubble.right") }
             .tag(0)
@@ -57,7 +68,16 @@ struct ConversationView: View {
         .onChange(of: settings.textMode) { _, enabled in
             Task { await session.applyTextMode(enabled) }
         }
-        .onChange(of: settings.serverURL) { _, value in replaceServer(value) }
+        .onChange(of: settings.serverURL) { _, value in
+            if auth.fixture { replaceServer(value) }
+        }
+        .onAppear {
+            auth.disconnectAccount = { [weak session] in await session?.disconnect() }
+            session.onUnauthorized = { [weak auth, weak session] in
+                await auth?.logout { await session?.disconnect() }
+            }
+        }
+        .disabled(auth.isBusy || auth.token == nil)
     }
 
     @ToolbarContentBuilder private var settingsLink: some ToolbarContent {
@@ -84,7 +104,7 @@ struct ConversationView: View {
                 guard next != activeServerURL else { continue }
                 await session.disconnect()
                 activeServerURL = next
-                session = Self.makeSession(next, settings: settings)
+                session = Self.makeSession(next, settings: settings, bearerToken: bearerToken, userID: user.id)
             }
             isReplacingSession = false
         }
@@ -167,6 +187,10 @@ private struct ConversationContent: View {
                 if failureNotice != nil { failureBanner }
             } else {
                 statusStrip
+                if let activity = session.assistantActivity {
+                    Label(activity, systemImage: "clock").font(.callout)
+                        .padding().accessibilityIdentifier("assistant.progress")
+                }
                 if session.isReconnecting { reconnectBanner }
                 if failureNotice != nil { failureBanner }
                 TranscriptListView(events: transcripts.events, onClear: transcripts.clearAll)
@@ -610,4 +634,4 @@ extension VoiceSession {
     }
 }
 
-#Preview { ConversationView(settings: SettingsStore()) }
+#Preview { AuthenticationRoot(settings: SettingsStore()) }

Sources/Features/Conversation/LoginView.swift

@@ -0,0 +1,97 @@
+import SwiftUI
+
+struct LoginView: View {
+    @ObservedObject var auth: AuthStore
+    @ObservedObject var settings: SettingsStore
+    @State private var username = ""
+    @State private var password = ""
+    @State private var server = ""
+    @State private var serverError: String?
+    var body: some View {
+        NavigationStack {
+            Form {
+                Section {
+                    Text("Sign in to Hope").font(.title2.bold())
+                    Text("Use the account provided by your server administrator. Hermes is managed by your server.")
+                        .foregroundStyle(.secondary)
+                }
+                Section("Account") {
+                    TextField("Username", text: $username).textContentType(.username)
+                        .textInputAutocapitalization(.never).autocorrectionDisabled()
+                    SecureField("Password", text: $password).textContentType(.password)
+                    Button("Sign in") {
+                        let suppliedPassword = password
+                        password = ""
+                        Task { await auth.login(username: username, password: suppliedPassword) }
+                    }
+                    .disabled(auth.isBusy || username.isEmpty || password.isEmpty)
+                    if auth.isBusy { ProgressView("Signing in…") }
+                    if let error = auth.error { Text(error).foregroundStyle(.red) }
+                }
+                Section("Server") {
+                    TextField("HTTPS server address", text: $server).keyboardType(.URL)
+                        .textInputAutocapitalization(.never).autocorrectionDisabled()
+                    Button("Save server address") {
+                        switch ServerConfig.parse(server) {
+                        case .success(let config): settings.serverURL = config.baseURL.absoluteString
+                        case .failure(let error): serverError = error.localizedDescription
+                        }
+                    }.disabled(auth.isBusy)
+                    if let serverError { Text(serverError).foregroundStyle(.red) }
+                    Text("Connections use HTTPS and secure WebSockets. A private server certificate may require an installed, trusted CA on this iPhone.")
+                        .font(.footnote).foregroundStyle(.secondary)
+                }
+            }
+            .navigationTitle("Hope")
+            .onAppear { server = settings.serverURL }
+        }
+    }
+}
+
+struct AuthenticationRoot: View {
+    @ObservedObject var settings: SettingsStore
+    @State private var auth: AuthStore
+    @State private var replacement: Task<Void, Never>?
+    init(settings: SettingsStore) {
+        self.settings = settings
+        _auth = State(initialValue: Self.makeAuth(settings))
+    }
+    private static func makeAuth(_ settings: SettingsStore) -> AuthStore {
+        guard case .success(let config) = ServerConfig.parse(settings.serverURL) else { preconditionFailure("Invalid configured origin") }
+        #if DEBUG
+        if ProcessInfo.processInfo.arguments.contains("--ui-testing"), !ProcessInfo.processInfo.arguments.contains("--live-testing") {
+            return AuthStore(config: config, tokens: MemoryTokenStore(), fixture: true)
+        }
+        #endif
+        return AuthStore(config: config)
+    }
+    var body: some View {
+        RootContent(settings: settings, auth: auth)
+            .task(id: auth.config.baseURL) { await auth.restore() }
+            .onChange(of: settings.serverURL) { _, _ in
+                guard !auth.fixture else { return }
+                guard replacement == nil else { return }
+                replacement = Task { @MainActor in
+                    await auth.logout { await auth.disconnectAccount?() }
+                    guard !Task.isCancelled else { return }
+                    // Read latest origin after teardown; intermediate edits never
+                    // restore credentials or connect an intermediate account.
+                    auth = Self.makeAuth(settings)
+                    replacement = nil
+                }
+            }
+    }
+}
+private struct RootContent: View {
+    @ObservedObject var settings: SettingsStore
+    @ObservedObject var auth: AuthStore
+    var body: some View {
+        if let user = auth.user {
+            ConversationView(settings: settings, auth: auth, user: user, bearerToken: auth.token ?? "")
+                .id(auth.config.baseURL.absoluteString + ":" + user.id)
+
+        } else {
+            LoginView(auth: auth, settings: settings)
+        }
+    }
+}

Sources/Features/Settings/ConnectionTestView.swift

@@ -2,6 +2,7 @@ import SwiftUI
 
 struct ConnectionTestView: View {
     @ObservedObject var settings: SettingsStore
+    var bearerToken: String = ""
     @State private var isBusy = false
     @State private var result: Result<TokenResponse, Error>?
     @State private var urlError: String?
@@ -67,7 +68,7 @@ struct ConnectionTestView: View {
         case .success(let config):
             isBusy = true
             Task {
-                let client = TokenClient(config: config)
+                let client = TokenClient(config: config, bearerToken: bearerToken)
                 do {
                     let response = try await client.fetchToken()
                     result = .success(response)

Sources/Features/Settings/SettingsView.swift

@@ -13,7 +13,6 @@ struct SettingsView: View {
     @State private var urlError: String?
     @State private var showVoicePicker = false
     @State private var savedURLConfirmation: String?
-    @State private var showModelPicker = false
     @FocusState private var urlFocused: Bool
     init(settings: SettingsStore, session: VoiceSession) {
         self.settings = settings
@@ -46,19 +45,6 @@ struct SettingsView: View {
             } footer: {
                 Text("Voice and typing preferences are saved on this iPhone. You can switch modes from the Talk tab.")
             }
-            Section {
-                if session.isReady, !session.models.isEmpty {
-                    Button {
-                        showModelPicker = true
-                    } label: {
-                        LabeledContent("Model", value: session.selectedModel ?? settings.modelID ?? "Server default")
-                    }
-                } else {
-                    LabeledContent("Model", value: settings.modelID ?? "Server default")
-                    Text("Connect from Talk to see the models available on your server.")
-                        .font(.footnote).foregroundStyle(Nearlight.quiet)
-                }
-            } header: { Text("Intelligence") }
             Section {
                 Text("Server URL")
                     .font(.footnote.weight(.semibold))
@@ -106,7 +92,7 @@ struct SettingsView: View {
                         .foregroundStyle(Nearlight.quiet)
                 }
                 NavigationLink("Connection test") {
-                    ConnectionTestView(settings: settings)
+                    ConnectionTestView(settings: settings, bearerToken: session.bootstrapBearerToken)
                 }
             } header: {
                 Text("Connection")
@@ -120,9 +106,7 @@ struct SettingsView: View {
         .sheet(isPresented: $showVoicePicker) {
             VoicePickerView(settings: settings, session: session)
         }
-        .sheet(isPresented: $showModelPicker) {
-            ModelPickerView(settings: settings, session: session)
-        }
+
     }
 
     /// Validates the draft and persists it only on success. On failure the
@@ -190,51 +174,6 @@ struct VoicePickerView: View {
     }
 }
 
-struct ModelPickerView: View {
-    @ObservedObject var settings: SettingsStore
-    @ObservedObject var session: VoiceSession
-    @Environment(\.dismiss) private var dismiss
-
-    private var activeModelID: String? {
-        if !session.models.isEmpty,
-           let selected = session.selectedModel ?? settings.modelID,
-           session.models.contains(where: { $0.id == selected }) {
-            return selected
-        }
-        return session.models.first?.id
-    }
-
-    var body: some View {
-        NavigationStack {
-            List {
-                ForEach(session.models, id: \.id) { model in
-                    Button {
-                        settings.modelID = model.id
-                        Task { await session.selectModel(model.id) }
-                        dismiss()
-                    } label: {
-                        HStack {
-                            Text(model.name ?? model.id)
-                            if activeModelID == model.id {
-                                Spacer()
-                                Image(systemName: "checkmark")
-                                    .foregroundStyle(Nearlight.rosewood)
-                            }
-                        }
-                    }
-                    .accessibilityAddTraits(activeModelID == model.id ? .isSelected : [])
-                }
-            }
-            .navigationTitle("Model")
-            .toolbar {
-                ToolbarItem(placement: .cancellationAction) {
-                    Button("Cancel") { dismiss() }
-                }
-            }
-        }
-    }
-}
-
 #Preview {
     let previewSettings = SettingsStore()
     guard case .success(let previewConfig) = ServerConfig.parse(SettingsStore.defaultServerURL) else {

Sources/LiveKit/ControlChannel.swift

@@ -6,15 +6,8 @@ import LiveKit
 @MainActor
 final class ControlChannel: NSObject, RoomDelegate {
 
-    struct ModelInfo: Equatable {
-        let id: String
-        let name: String?
-    }
-
     enum InboundEvent {
         case agentReady
-        case models([ModelInfo], selected: String?)
-        case modelChanged(String)
         case taskEvent(TaskEventPayload)
     }
 
@@ -43,22 +36,6 @@ final class ControlChannel: NSObject, RoomDelegate {
                 session?.agentReadyReceived()
             }
             return true
-        case "models":
-            var models: [ModelInfo] = []
-            for item in json["models"]?.arrayValue ?? [] {
-                if let obj = item.objectValue, let id = obj["id"]?.stringValue {
-                    models.append(ModelInfo(id: id, name: obj["name"]?.stringValue))
-                } else if let id = item.stringValue {
-                    models.append(ModelInfo(id: id, name: nil))
-                }
-            }
-            onEvent?(.models(models, selected: json["selected"]?.stringValue))
-            return true
-        case "model_changed":
-            if let model = json["model"]?.stringValue {
-                onEvent?(.modelChanged(model))
-            }
-            return true
         default:
             return false
         }
@@ -97,14 +74,6 @@ final class ControlChannel: NSObject, RoomDelegate {
         try await publish(["type": "set_voice", "voice": voiceID], topic: "voice-control", room: room)
     }
 
-    func setModel(_ modelID: String, room: Room) async throws {
-        try await publish(["type": "set_model", "model": modelID], topic: "voice-control", room: room)
-    }
-
-    func getModels(room: Room) async throws {
-        try await publish(["type": "get_models"], topic: "voice-control", room: room)
-    }
-
     func setMode(_ mode: String, room: Room) async throws {
         try await publish(["type": "set_mode", "mode": mode], topic: "conversation-control", room: room)
     }

Sources/LiveKit/TranscriptHandler.swift

@@ -30,6 +30,7 @@ final class TranscriptHandler: ObservableObject {
     /// history; live events append/update here. Trimmed to 50 finals.
     @Published private(set) var events: [TranscriptEvent] = []
 
+    var acceptsRoom: ((Room) -> Bool)?
     let history: TranscriptHistory
 
     // MARK: Cross-source dedupe state
@@ -204,8 +205,9 @@ extension TranscriptHandler: RoomDelegate {
             TranscriptEvent(id: $0.id, role: resolvedRole, text: $0.text, isFinal: $0.isFinal, timestamp: $0.lastReceivedTime)
         }
         Task { @MainActor [weak self] in
+            guard let self, self.acceptsRoom?(room) ?? true else { return }
             for event in events {
-                self?.receiveSegment(id: event.id, role: event.role, text: event.text, isFinal: event.isFinal)
+                self.receiveSegment(id: event.id, role: event.role, text: event.text, isFinal: event.isFinal)
             }
         }
     }

Sources/LiveKit/TranscriptHistory.swift

@@ -16,11 +16,14 @@ struct HistoryEntry: Codable, Equatable {
 final class TranscriptHistory: ObservableObject {
     @Published private(set) var entries: [HistoryEntry] = []
 
-    static let key = "voice_history"
+    static let key = "voice_history_isolated_tests"
+    private let storageKey: String
     static let maxEntries = 50
 
-    init() {
-        if let raw = AppPreferences.store.string(forKey: Self.key),
+    init(origin: String? = nil, userID: String? = nil) {
+        // Length-prefixed parts prevent ambiguous origin/account combinations.
+        storageKey = origin.flatMap { origin in userID.map { "voice_history_v2:\(origin.utf8.count):\(origin):\($0)" } } ?? Self.key
+        if let raw = AppPreferences.store.string(forKey: storageKey),
            let data = raw.data(using: .utf8),
            let decoded = try? JSONDecoder().decode([HistoryEntry].self, from: data) {
             entries = Array(decoded.suffix(Self.maxEntries))
@@ -45,6 +48,6 @@ final class TranscriptHistory: ObservableObject {
 
     private func persist() {
         guard let data = try? JSONEncoder().encode(entries) else { return }
-        AppPreferences.store.set(String(decoding: data, as: UTF8.self), forKey: Self.key)
+        AppPreferences.store.set(String(decoding: data, as: UTF8.self), forKey: storageKey)
     }
 }

Sources/LiveKit/VoiceSession.swift

@@ -36,8 +36,8 @@ final class VoiceSession: ObservableObject {
     @Published private(set) var isMuted = false
     @Published private(set) var micError: String?
     @Published private(set) var isReconnecting = false
-    @Published private(set) var models: [ControlChannel.ModelInfo] = []
-    @Published private(set) var selectedModel: String?
+    @Published private(set) var assistantActivity: String?
+    private var workingRequests: [String: String] = [:]
 
     /// Identity of the current room. Every async callback that could outlive a
     /// disconnect/reconnect compares its captured generation against this before
@@ -45,7 +45,7 @@ final class VoiceSession: ObservableObject {
     private(set) var sessionGeneration = 0
     private(set) var room = Room()
     let controlChannel = ControlChannel()
-    let transcriptHandler = TranscriptHandler()
+    let transcriptHandler: TranscriptHandler
     let stateModel = ConversationStateModel()
     let taskStore = TaskStore()
     private let config: ServerConfig
@@ -85,10 +85,15 @@ final class VoiceSession: ObservableObject {
     /// terminal failure) and ignored. Cleared when the new room connects.
     private var isTearingDown = false
 
-    init(config: ServerConfig, tokenClient: TokenClient, settings: SettingsStore) {
+    init(config: ServerConfig, tokenClient: TokenClient, settings: SettingsStore, userID: String? = nil) {
+        transcriptHandler = TranscriptHandler(history: TranscriptHistory(origin: config.baseURL.absoluteString, userID: userID))
         self.config = config
         self.tokenClient = tokenClient
         self.settings = settings
+        transcriptHandler.acceptsRoom = { [weak self] source in
+            guard let self else { return false }
+            return self.room === source && !self.isTearingDown && self.state == .ready
+        }
         room.add(delegate: self)
         room.add(delegate: controlChannel)
         room.add(delegate: transcriptHandler)
@@ -111,21 +116,8 @@ final class VoiceSession: ObservableObject {
         // Restrict inbound control-event application to active lifecycle states
         // so late events from a failed/tearing-down room cannot repopulate stale
         // fields (agent, models, mic state) into a fresh retry (Iteration 08 Item 3).
-        guard state == .connecting || state == .waitingAgent || state == .ready else { return }
+        guard !isTearingDown, state == .connecting || state == .waitingAgent || state == .ready else { return }
         switch event {
-        case .models(let received, let selected):
-            models = received
-            // The persisted preference is deterministic; an early `models.selected`
-            // event must not silently replace it before sync-on-join has run.
-            if selectedModel == nil, settings.modelID == nil, let selected {
-                selectedModel = selected
-                settings.modelID = selected
-            }
-            logger.log("models received count=\(received.count) selected=\(selected ?? "nil", privacy: .public)")
-        case .modelChanged(let model):
-            selectedModel = model
-            settings.modelID = model
-            logger.log("model_changed applied: \(model, privacy: .public)")
         case .taskEvent(let payload):
             taskStore.apply(payload)
         default:
@@ -133,6 +125,13 @@ final class VoiceSession: ObservableObject {
         }
     }
 
+    var onUnauthorized: (() async -> Void)? {
+        get { tokenClient.onUnauthorized }
+        set { tokenClient.onUnauthorized = newValue }
+    }
+
+    var bootstrapBearerToken: String { tokenClient.bearerToken }
+
     var isReady: Bool { state == .ready }
 
     /// Clear all per-room/session ephemeral published fields so the failed or
@@ -150,8 +149,8 @@ final class VoiceSession: ObservableObject {
         isMuted = false
         userWantsMicMuted = false
         micError = nil
-        models = []
-        selectedModel = nil
+        workingRequests.removeAll()
+        assistantActivity = nil
         isReconnecting = false
         reconnectAttempted = false
         micMutedByInterruption = false
@@ -206,7 +205,7 @@ final class VoiceSession: ObservableObject {
         let result: Result<Void, Error>
         do {
             let token = try await tokenClient.fetchToken()
-            logger.log("token ok room=\(token.room, privacy: .public)")
+            guard generation == sessionGeneration, !Task.isCancelled, !isTearingDown else { return }
             try await room.connect(url: config.livekitURL.absoluteString, token: token.token, connectOptions: makeConnectOptions())
             result = .success(())
         } catch {
@@ -327,7 +326,7 @@ final class VoiceSession: ObservableObject {
     }
 
     func agentReadyReceived() {
-        guard state == .waitingAgent, sessionGeneration > 0 else {
+        guard !isTearingDown, state == .waitingAgent, sessionGeneration > 0 else {
             logger.log("agent_ready ignored in state \(String(describing: self.state), privacy: .public)")
             return
         }
@@ -351,7 +350,7 @@ final class VoiceSession: ObservableObject {
     private func syncSettingsOnJoin(generation: Int) async {
         guard generation == sessionGeneration, isReady else { return }
         // Each sync operation is independent and best-effort: a failed set_voice
-        // or invalid persisted model must not prevent set_mode from being sent.
+        // must not prevent set_mode from being sent. Hermes is server-managed.
         let voiceID = settings.voiceID
         do {
             try await controlChannel.setVoice(voiceID, room: room)
@@ -361,17 +360,6 @@ final class VoiceSession: ObservableObject {
             logger.error("sync-on-join set_voice failed: \(String(describing: error), privacy: .public)")
         }
         guard generation == sessionGeneration else { return }
-        let model = settings.modelID ?? selectedModel
-        if let model {
-            do {
-                try await controlChannel.setModel(model, room: room)
-                guard generation == sessionGeneration else { return }
-                logger.log("sync-on-join set_model sent: \(model, privacy: .public)")
-            } catch {
-                logger.error("sync-on-join set_model failed: \(String(describing: error), privacy: .public)")
-            }
-        }
-        guard generation == sessionGeneration else { return }
         // Sync the agent's conversation mode with the persisted setting.
         let mode = settings.textMode ? "text" : "voice"
         do {
@@ -396,19 +384,6 @@ final class VoiceSession: ObservableObject {
         }
     }
 
-    func selectModel(_ id: String) async {
-        settings.modelID = id
-        guard isReady else { return }
-        let generation = sessionGeneration
-        do {
-            try await controlChannel.setModel(id, room: room)
-            guard generation == sessionGeneration else { return }
-            logger.log("set_model sent: \(id, privacy: .public)")
-        } catch {
-            logger.error("set_model failed: \(String(describing: error), privacy: .public)")
-        }
-    }
-
     private func scanForAgent() {
         for participant in room.remoteParticipants.values {
             if isAgentParticipant(participant) {
@@ -427,6 +402,18 @@ final class VoiceSession: ObservableObject {
     }
 
     func enableMicrophone() async {
+        let predecessor = micOpTask
+        let generation = sessionGeneration
+        let task = Task { @MainActor in
+            await predecessor?.value
+            guard !Task.isCancelled, generation == sessionGeneration, isReady, !settings.textMode else { return }
+            await enableMicrophoneSerialized()
+        }
+        micOpTask = task
+        await task.value
+    }
+
+    private func enableMicrophoneSerialized() async {
         // Text mode invariant: the microphone must never be enabled while text
         // mode is active. This enforces the privacy contract at the API level,
         // not just in the view layer (Finding 4).
@@ -436,9 +423,15 @@ final class VoiceSession: ObservableObject {
         }
         let generation = sessionGeneration
         for attempt in 0..<3 {
+            guard generation == sessionGeneration, isReady, !settings.textMode, !Task.isCancelled else { return }
             do {
                 try await room.localParticipant.setMicrophone(enabled: true)
                 guard generation == sessionGeneration else { return }
+                if settings.textMode || Task.isCancelled {
+                    try? await room.localParticipant.setMicrophone(enabled: false)
+                    isMuted = true
+                    return
+                }
                 isMuted = false
                 userWantsMicMuted = false
                 micError = nil
@@ -461,6 +454,18 @@ final class VoiceSession: ObservableObject {
     }
 
     func setMuted(_ muted: Bool) async {
+        let predecessor = micOpTask
+        let generation = sessionGeneration
+        let task = Task { @MainActor in
+            await predecessor?.value
+            guard !Task.isCancelled, generation == sessionGeneration else { return }
+            await setMutedSerialized(muted)
+        }
+        micOpTask = task
+        await task.value
+    }
+
+    private func setMutedSerialized(_ muted: Bool) async {
         guard isReady else { return }
         // Text mode invariant: unmuting (enabling the mic) is not permitted
         // while text mode is active. Muting is always allowed.
@@ -472,6 +477,11 @@ final class VoiceSession: ObservableObject {
         do {
             try await room.localParticipant.setMicrophone(enabled: !muted)
             guard generation == sessionGeneration else { return }
+            if !muted && settings.textMode {
+                try? await room.localParticipant.setMicrophone(enabled: false)
+                isMuted = true
+                return
+            }
             isMuted = muted
             // Track explicit user mute intent separately from hardware state.
             // Interruption begin operations use this after awaiting the
@@ -502,11 +512,14 @@ final class VoiceSession: ObservableObject {
     /// current session.
     func applyTextMode(_ enabled: Bool) async {
         guard isReady else { return }
+        guard enabled == settings.textMode else { return }
         if enabled {
             await setMuted(true)
+            guard settings.textMode else { return }
             await setMode("text")
         } else {
             await setMode("voice")
+            guard !settings.textMode else { return }
             await enableMicrophone()
         }
     }
@@ -518,6 +531,7 @@ final class VoiceSession: ObservableObject {
     }
 
     func disconnect() async {
+        tokenClient.cancel()
         // Set the teardown guard first so any .disconnected callback from our
         // own room.disconnect() is ignored (not treated as a terminal failure).
         isTearingDown = true
@@ -651,6 +665,11 @@ final class VoiceSession: ObservableObject {
                     do {
                         try await self.room.localParticipant.setMicrophone(enabled: true)
                         guard !Task.isCancelled, self.sessionGeneration == generation else { return }
+                        if self.settings.textMode {
+                            try? await self.room.localParticipant.setMicrophone(enabled: false)
+                            self.isMuted = true
+                            return
+                        }
                         self.isMuted = false
                         logger.log("audio interruption ended, resuming mic (seq=\(currentSeq))")
                     } catch {
@@ -666,6 +685,20 @@ final class VoiceSession: ObservableObject {
         }
     }
 
+    func receiveAssistantProgress(_ data: Data) {
+        struct Progress: Decodable { let type: String; let request_id: String; let status: String; let message: String }
+        guard let progress = try? JSONDecoder().decode(Progress.self, from: data),
+              progress.type == "assistant_progress", !progress.request_id.isEmpty else { return }
+        switch progress.status {
+        case "working": workingRequests[progress.request_id] = progress.message.isEmpty ? "Hope is working on your request…" : progress.message
+        case "completed": workingRequests.removeValue(forKey: progress.request_id)
+        case "failed": workingRequests.removeValue(forKey: progress.request_id)
+        default: return
+        }
+        assistantActivity = workingRequests.values.sorted().first
+        if progress.status == "failed" { assistantActivity = "Hope could not complete that request. Please try again." }
+    }
+
     func tickAudioLevels(local: Float, remote: Float) {
         stateModel.tick(localAudioLevel: local, remoteAudioLevel: remote)
     }
@@ -718,9 +751,12 @@ extension VoiceSession: RoomDelegate {
     }
 
     nonisolated func room(_ room: Room, participant: RemoteParticipant?, didReceiveData data: Data, forTopic topic: String, encryptionType: EncryptionType) {
-        logger.log("data topic=\(topic, privacy: .public) bytes=\(data.count) payload=\(String(data: data.prefix(300), encoding: .utf8) ?? "<binary>", privacy: .public)")
         Task { @MainActor [weak self] in
-            guard let self, self.room === room else { return }
+            guard let self, self.room === room, !self.isTearingDown, self.state == .ready || self.state == .waitingAgent else { return }
+            if topic == "assistant-progress" {
+                self.receiveAssistantProgress(data)
+                return
+            }
             // Secondary transcript source (finals only).
             if topic == "transcript",
                let json = try? JSONDecoder().decode([String: JSONValue].self, from: data),

Sources/Networking/AuthClient.swift

@@ -0,0 +1,77 @@
+import Foundation
+
+struct AuthUser: Codable, Equatable {
+    let id: String
+    let username: String
+    let displayName: String?
+    let role: String
+    let status: String
+    enum CodingKeys: String, CodingKey {
+        case id, username, role, status
+        case displayName = "display_name"
+    }
+}
+struct AuthLoginResponse: Decodable {
+    let token: String
+    let user: AuthUser
+    let expiresAt: Double
+    enum CodingKeys: String, CodingKey {
+        case token, user
+        case expiresAt = "expires_at"
+    }
+    init(from decoder: Decoder) throws {
+        let c = try decoder.container(keyedBy: CodingKeys.self)
+        token = try c.decode(String.self, forKey: .token)
+        user = try c.decode(AuthUser.self, forKey: .user)
+        if let seconds = try? c.decode(Double.self, forKey: .expiresAt) { expiresAt = seconds }
+        else {
+            let raw = try c.decode(String.self, forKey: .expiresAt)
+            guard let date = ISO8601DateFormatter().date(from: raw) else { throw AuthError.invalidResponse }
+            expiresAt = date.timeIntervalSince1970
+        }
+    }
+
+}
+enum AuthError: LocalizedError {
+    case status(Int)
+    case invalidResponse
+    var errorDescription: String? {
+        switch self {
+        case .status(401): return "Your sign-in expired or the username and password were not accepted. Sign in again."
+        case .status(403): return "This account is not authorized. Contact your server administrator."
+        case .status: return "The server could not complete sign-in. Try again later."
+        case .invalidResponse: return "The server returned an unexpected authentication response."
+        }
+    }
+}
+final class AuthClient {
+    let config: ServerConfig
+    private let session: URLSession
+    init(config: ServerConfig, session: URLSession? = nil) {
+        self.config = config
+        self.session = session ?? TLSPinning.session()
+    }
+    private func request(_ path: String, method: String, token: String? = nil, body: Data? = nil) async throws -> Data {
+        var request = URLRequest(url: config.baseURL.appendingPathComponent(path))
+        request.httpMethod = method
+        request.timeoutInterval = 10
+        request.httpBody = body
+        if body != nil { request.setValue("application/json", forHTTPHeaderField: "Content-Type") }
+        if let token { request.setValue("Bearer \(token)", forHTTPHeaderField: "Authorization") }
+        let (data, response) = try await session.data(for: request)
+        guard let http = response as? HTTPURLResponse else { throw AuthError.invalidResponse }
+        guard (200..<300).contains(http.statusCode) else { throw AuthError.status(http.statusCode) }
+        return data
+    }
+    func login(username: String, password: String) async throws -> AuthLoginResponse {
+        let body = try JSONSerialization.data(withJSONObject: ["username": username, "password": password])
+        return try JSONDecoder().decode(AuthLoginResponse.self, from: await request("api/auth/login", method: "POST", body: body))
+    }
+    func me(token: String) async throws -> AuthUser {
+        struct Response: Decodable { let user: AuthUser }
+        return try JSONDecoder().decode(Response.self, from: await request("api/auth/me", method: "GET", token: token)).user
+    }
+    func logout(token: String) async throws {
+        _ = try await request("api/auth/logout", method: "POST", token: token)
+    }
+}

Sources/Networking/KeychainTokenStore.swift

@@ -0,0 +1,43 @@
+import Foundation
+import Security
+
+protocol TokenStore {
+    func token(origin: String) throws -> String?
+    func save(_ token: String?, origin: String) throws
+}
+struct KeychainTokenStore: TokenStore {
+    private func query(_ origin: String) -> [String: Any] {
+        [kSecClass as String: kSecClassGenericPassword,
+         kSecAttrService as String: "dev.shane.voice.auth",
+         kSecAttrAccount as String: origin]
+    }
+    func token(origin: String) throws -> String? {
+        var q = query(origin)
+        q[kSecReturnData as String] = true
+        q[kSecMatchLimit as String] = kSecMatchLimitOne
+        var result: CFTypeRef?
+        let status = SecItemCopyMatching(q as CFDictionary, &result)
+        if status == errSecItemNotFound { return nil }
+        guard status == errSecSuccess, let data = result as? Data else { throw StoreError.failed }
+        return String(data: data, encoding: .utf8)
+    }
+    func save(_ token: String?, origin: String) throws {
+        let q = query(origin)
+        let deletion = SecItemDelete(q as CFDictionary)
+        guard deletion == errSecSuccess || deletion == errSecItemNotFound else { throw StoreError.failed }
+        guard let token else { return }
+        var item = q
+        item[kSecValueData as String] = Data(token.utf8)
+        item[kSecAttrAccessible as String] = kSecAttrAccessibleWhenUnlockedThisDeviceOnly
+        guard SecItemAdd(item as CFDictionary, nil) == errSecSuccess else { throw StoreError.failed }
+    }
+    enum StoreError: LocalizedError {
+        case failed
+        var errorDescription: String? { "Could not securely save the sign-in on this iPhone." }
+    }
+}
+final class MemoryTokenStore: TokenStore {
+    private var values: [String: String] = [:]
+    func token(origin: String) throws -> String? { values[origin] }
+    func save(_ token: String?, origin: String) throws { values[origin] = token }
+}

Sources/Networking/ServerConfig.swift

@@ -29,19 +29,19 @@ struct ServerConfig: Equatable {
             return .failure(.invalidURL(raw))
         }
         if scheme != "https" { return .failure(.notHTTPS(raw)) }
-        var c = components
-        c.path = ""
-        c.fragment = nil
-        guard let base = c.url else { return .failure(.invalidURL(raw)) }
-        // LAN deployment: LiveKit is reachable directly on :7880 (plain ws).
-        // Real domains use wss via same origin. The SDK derives /rtc from the base.
-        let livekit: URL
-        if Self.isPrivateIP(host) {
-            livekit = URL(string: "ws://\(host):7880")!
-        } else {
-            let portSuffix = components.port.map { ":\($0)" } ?? ""
-            livekit = URL(string: "wss://\(host)\(portSuffix)/livekit")!
+        guard components.user == nil, components.password == nil,
+              components.query == nil, components.fragment == nil else {
+            return .failure(.invalidURL(raw))
         }
+        var c = components
+        c.scheme = "https"
+        c.host = host.lowercased()
+        if c.port == 443 { c.port = nil }
+        c.path = ""
+        guard let base = c.url else { return .failure(.invalidURL(raw)) }
+        c.scheme = "wss"
+        c.path = "/livekit"
+        guard let livekit = c.url else { return .failure(.invalidURL(raw)) }
         return .success(ServerConfig(baseURL: base, livekitURL: livekit))
     }
 

Sources/Networking/TLSPinning.swift

@@ -15,7 +15,10 @@ enum TLSPinning {
     static let host = "192.168.86.2"
 
     static func session() -> URLSession {
-        let config = URLSessionConfiguration.default
+        let config = URLSessionConfiguration.ephemeral
+        config.urlCache = nil
+        config.httpCookieStorage = nil
+        config.urlCredentialStorage = nil
         config.timeoutIntervalForRequest = 15
         return URLSession(configuration: config, delegate: PinnedTrustDelegate(), delegateQueue: nil)
     }
@@ -37,7 +40,12 @@ enum TLSPinning {
     }
 }
 
-final class PinnedTrustDelegate: NSObject, URLSessionDelegate {
+final class PinnedTrustDelegate: NSObject, URLSessionDelegate, URLSessionTaskDelegate {
+    func urlSession(_ session: URLSession, task: URLSessionTask, willPerformHTTPRedirection response: HTTPURLResponse, newRequest request: URLRequest, completionHandler: @escaping (URLRequest?) -> Void) {
+        // Authentication/password-bearing requests must never be redirected to
+        // another endpoint or origin. Correct the configured server instead.
+        completionHandler(nil)
+    }
     func urlSession(_ session: URLSession, didReceive challenge: URLAuthenticationChallenge, completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
         guard challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodServerTrust,
               let trust = challenge.protectionSpace.serverTrust else {

Sources/Networking/TokenClient.swift

@@ -42,22 +42,36 @@ enum TokenError: LocalizedError {
 final class TokenClient {
     let config: ServerConfig
     private let session: URLSession
+    var onUnauthorized: (() async -> Void)?
+    let bearerToken: String
 
-    init(config: ServerConfig) {
+    init(config: ServerConfig, bearerToken: String = "", session: URLSession? = nil) {
         self.config = config
-        self.session = TLSPinning.session()
+        self.session = session ?? TLSPinning.session()
+        self.bearerToken = bearerToken
     }
 
+    func cancel() { session.getAllTasks { $0.forEach { $0.cancel() } } }
+
     func fetchToken() async throws -> TokenResponse {
+        #if DEBUG
+        if ProcessInfo.processInfo.arguments.contains("--ui-testing"),
+           !ProcessInfo.processInfo.arguments.contains("--live-testing") {
+            throw URLError(.cannotConnectToHost) // offline fixtures never contact any configured server
+        }
+        #endif
+        guard !bearerToken.isEmpty else { throw AuthError.status(401) }
         var request = URLRequest(url: config.baseURL.appendingPathComponent("token"))
         request.httpMethod = "POST"
+        request.setValue("Bearer \(bearerToken)", forHTTPHeaderField: "Authorization")
         request.timeoutInterval = 10
         let (data, response) = try await session.data(for: request)
         guard let http = response as? HTTPURLResponse else {
             throw TokenError.decodeFailed
         }
         guard (200..<300).contains(http.statusCode) else {
-            let detail = String(data: data, encoding: .utf8) ?? ""
+            if http.statusCode == 401 || http.statusCode == 403 { await onUnauthorized?() }
+            let detail = ""
             throw TokenError.httpStatus(http.statusCode, detail)
         }
         do {