release: prepare Android 1.19.0 and Plugin 1.13.1

CHANGELOG.md

@@ -6,38 +6,46 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 
 ## [Unreleased]
 
+## [Android 1.19.0] - 2026-10-20
+
 ### Added
 
-- Android can mute built-in English tool updates independently of assistant readback on Standard and Relay voice output. (#753)
-- Android marks unread completed conversations in the session drawer and shows unread conversation counts on profiles and the chat header.
-- Reply notifications show the owning agent's official profile name and cached avatar, plus the conversation title.
+- Unread markers in the session drawer and counts on profiles and the chat header make background completions easier to find.
+- Built-in English tool updates can be muted independently of assistant readback on Standard and Relay voice output.
+
+### Changed
+
+- Reply alerts show the owning agent display name, cached avatar, and conversation title.
+- Relay session controls distinguish shortening from operator-approved renewal, retain actionable update failures, and make duration controls accessible.
+- Settings distinguish phone interruption from host barge-in and explain that Hold mode can still listen for spoken interruption. Saved choices and defaults remain unchanged.
 
 ### Fixed
 
-- Android: retry oversized conversation history in smaller pages while preserving message order, compacted history, and memory limits. Individually oversized messages fail explicitly without presenting an empty or partial transcript.
-- Android distinguishes phone interruption from host barge-in and explains that Hold mode can still listen for spoken interruption, without changing saved choices or defaults. (#752)
-- Android prevents a chat-state race from dropping Final answer only speech requests. (#751)
-- Plugin uses the selected speech renderer's model and voice defaults when a profile changes provider, while preserving explicit selections. (#750)
-- Android preserves whole-sentence streaming audio and short replies after tool-call gaps, and drains delivered PCM before ending speech. (#704)
-- Desktop operations addressed with `device_id` use only the exact authenticated device identity and refuse missing or duplicate targets, without matching another computer's name.
-- Android avoids redundant conversation history in Gateway send/recovery responses and pauses automatic conversation reopening after a recorded out-of-memory crash, preserving saved conversations and drafts. (#700)
-- Android preserves native Dashboard sign-in during reverse-proxy access failures and retries refresh on a later request when the route is reachable again. (#711)
-- Secure Link accepts PEM certificate chains, exports only the leaf certificate for pairing, and reports invalid certificate/key configurations without exposing private file paths. (#712)
-- Android keeps ONNX Runtime on 1.27.0 so sherpa-onnx native libs match the packaged runtime ABI.
-- Android Voice no longer ends a reply while the last synthesized audio file is still playing, so Continuous mode reopens the microphone only after playback has finished.
-- Android session transcript loads request include_compacted=true so reopen keeps compaction-archived scrollback.
-- Secure Link supports paired-device listing, session shortening, and revocation with the existing Relay authorization rules.
-- Android pauses both wake-word listener modes before voice capture and resumes listening after voice exits, preventing microphone conflicts. (#681)
-- Android Relay sessions distinguish shortening from operator-approved renewal, retain actionable update failures, and expose accessible pairing duration controls. (#659)
+- Long tools and provider waits stay active. Missing completion events recover from server state, including work started by another client, without sending Stop.
+- Oversized history responses retry with smaller pages while keeping the latest 500 messages in order. Individual messages above the safety limit show an explicit error.
+- Reopening a conversation includes messages archived by context compaction instead of showing only its summary and recent tail.
+- Gateway responses avoid duplicate history transfers. After a recorded out-of-memory crash, automatic reopening pauses while saved conversations and drafts remain intact.
+- Temporary reverse-proxy access failures preserve the native Dashboard session and allow a later refresh when the route is reachable again.
+- Notification permission defaults refresh after onboarding, and background alerts retain their original connection, profile, and conversation across navigation.
+- Replies from different running conversations have separate notification slots. Opening one preserves alerts from the others.
+- Chat progress remains above the current composer and clears when the turn finishes or waits for input.
+- Both wake-word modes pause before voice capture and resume after voice exits, preventing microphone conflicts.
+- Assistant activation waits for microphone startup to finish instead of reporting activation before capture is ready.
+- Profile state arriving during connection setup no longer races initialization.
+- The selected palette stays applied after the startup loading screen instead of leaving parts of the interface dark.
+- Streaming playback retains whole sentences and short replies after tool-call gaps, and drains delivered audio before ending speech.
+- Voice waits for the last synthesized audio file to finish before reopening the microphone in Continuous mode, and settles failed playback.
+- Final answer only speech no longer disappears during a chat-state race.
+- The packaged voice runtime remains aligned with the speech engine native libraries.
 
-- Android avoids a startup crash when profile state arrives during connection setup.
-- Android refreshes background-alert permission defaults after onboarding and keeps notification delivery tied to the original connection, profile, and conversation across navigation.
-- Replies from conversations left running get separate notification slots; opening one conversation preserves alerts from others.
-- Chat progress stays above the composer while scrolling and disappears when the turn finishes or waits for input.
-- Android keeps the selected Appearance palette after the startup loading screen instead of leaving parts of the UI dark. (#678)
+## [Plugin 1.13.1] - 2026-10-20
 
-- Android keeps user-started Dashboard browser sign-in connected through its callback and session verification, then ends the foreground service. Callback pages identify the selected sign-in provider.
-- Android keeps quiet tools and provider waits alive, including turns submitted by another client, and recovers missing completion events from authoritative Gateway state without sending Stop.
+### Fixed
+
+- Use the selected speech renderer's model and voice defaults when a profile changes provider, while preserving explicit selections.
+- Accept Secure Link PEM certificate chains, export only the leaf certificate for pairing, and report invalid certificate/key configurations without exposing private file paths.
+- Support paired-device listing, session shortening, and revocation over Secure Link with the existing Relay authorization rules.
+- Route desktop operations addressed with device_id only to the exact authenticated device. Missing, duplicate, or conflicting targets fail without name matching or fallback to another computer.
 
 ## [0.4.0-beta.10] - 2026-10-08
 

PLUGIN_RELEASE_NOTES.md

@@ -1,23 +1,23 @@
 # Hermes-Relay Plugin v__VERSION__
 
-**Release Date:** October 7, 2026
+**Release Date:** October 20, 2026
 
 ## Summary
 
-Dashboard pairing provides separate Android and CLI+UI choices, clearer connection addresses, and more reliable QR invites.
-
-## Added
-
-- CLI+UI pairing invites include route candidates and Secure Link certificate trust.
+Secure Link handles certificate chains and paired-session management more reliably. Profile voice output uses the selected renderer's defaults, and exact desktop targets cannot fall back to another computer.
 
 ## Fixed
 
-- Connection guidance shows protocols and ports, includes direct Tailscale Relay routes, and avoids assuming a public Relay listener from a Dashboard address.
-- Expired and oversized invites show actionable errors. QR codes remain fully visible, and setup distinguishes Plugin activation from discovery.
+- Use the selected speech renderer's model and voice defaults when a profile changes provider, while preserving explicit selections.
+- Accept Secure Link PEM certificate chains, export only the leaf certificate for pairing, and report invalid certificate/key configurations without exposing private file paths.
+- Support paired-device listing, session shortening, and revocation over Secure Link with the existing Relay authorization rules.
+- Route desktop operations addressed with device_id only to the exact authenticated device. Missing, duplicate, or conflicting targets fail without name matching or fallback to another computer.
 
 ## Compatibility
 
-Full-invite CLI import requires a compatible CLI build newer than the currently published 0.4.0-beta.8. This Plugin release does not publish that companion. Existing Android pairing and legacy CLI connection settings remain supported.
+Standard Android Chat and Voice remain upstream-only. This release updates the optional Plugin and does not publish a CLI+UI companion. Friendly desktop names remain supported through the `device` field; `device_id` requires the authenticated identity and fails when that exact target is unavailable or ambiguous.
+
+Screenshot failure-result masking remains tracked separately in [#743](https://github.com/Codename-11/hermes-relay/issues/743); this release does not claim to resolve every screenshot failure.
 
 ## Install / update
 
@@ -29,7 +29,7 @@ Full-invite CLI import requires a compatible CLI build newer than the currently
     # or, if already installed:
     hermes-relay-update
 
-Restart or reload the Hermes Dashboard and Relay after updating so the new manifest and provider context are active.
+Reload the Plugin and restart Relay after updating so the new server code and tool registrations are active. Existing agent sessions may retain their current tool catalog until the next session.
 
 ## Verify
 

RELEASE_NOTES.md

@@ -1,30 +1,46 @@
-# Hermes-Relay Android v1.18.1
+# Hermes-Relay Android v1.19.0
 
-**Release Date:** September 29, 2026
+**Release Date:** October 20, 2026
 
 ## Download
 
-> Installing on your phone? Download `hermes-relay-1.18.1-sideload-release.apk` and tap it for the full feature set, or install from [Google Play](https://play.google.com/store/apps/details?id=com.axiomlabs.hermesrelay).
+> Installing on your phone? Download `hermes-relay-1.19.0-sideload-release.apk` and tap it for the full feature set, or install from [Google Play](https://play.google.com/store/apps/details?id=com.axiomlabs.hermesrelay).
 
 The `.aab` file is a Play Console upload bundle and cannot be installed by tapping it on a phone.
 
 Verify the download against `SHA256SUMS.txt`. See the [sideload guide](https://hermes-relay.dev/docs/guide/sideload) for installation help.
 
 ## Summary
 
-Dashboard browser sign-in remains connected while a provider completes authentication and Hermes-Relay verifies the session. Callback pages identify the selected provider.
+Larger conversations open more reliably, quiet turns recover without interruption, and unread replies are easier to find. Voice playback, microphone handoff, sign-in, and startup appearance receive reliability fixes.
+
+## Added
+
+- Unread conversation markers and counts in Sessions, profiles, and the chat header.
+- Optional muting of built-in English tool announcements independently of assistant readback.
 
 ## Changed
 
-- Browser callback success and error pages show the selected provider and use guidance that applies to self-hosted and hosted Hermes.
+- Reply notifications identify the agent and conversation.
+- Pairing controls distinguish shortening from operator-approved renewal and retain actionable errors.
+- Voice settings distinguish phone interruption from host barge-in and explain Hold mode without changing defaults.
 
 ## Fixed
 
-- A bounded sign-in foreground service keeps the browser callback and session verification connected while Hermes-Relay is in the background. It ends after completion, cancellation, or timeout.
+- Oversized history pages retry in smaller windows while preserving the recent 500-message window, order, compacted scrollback, profile scope, and existing memory guards. Complete reads retain their aggregate safety limits; individually oversized messages fail explicitly.
+- Gateway replies avoid duplicate history transfers. Automatic conversation restoration pauses after a recorded out-of-memory crash while saved conversations and drafts remain intact.
+- Quiet tools and missing completion events recover from authoritative Gateway state without sending Stop.
+- Temporary reverse-proxy failures preserve native Dashboard sign-in.
+- Background alerts retain conversation ownership, refresh onboarding permission defaults, and keep separate notification slots. Chat progress remains above the current composer.
+- Wake-word listeners hand the microphone to voice capture; assistant activation waits for microphone startup.
+- Streaming speech preserves whole sentences and short replies after tool gaps. File playback drains before Continuous mode listens again, and Final answer only speech survives chat-state races.
+- Native voice runtime compatibility, profile-state startup ordering, and the saved Appearance palette remain consistent after startup.
 
 ## Install / Verify
 
-- App version: **1.18.1** (versionCode **59**).
-- Standard Chat, sessions, profiles, Manage, and Standard Voice use current upstream Hermes. The optional Hermes-Relay Plugin **1.12.0** supplies Relay tools and Secure Link host support.
-- Existing saved connections, profiles, sessions, history, and drafts remain in place.
-- Basic/password, self-hosted OIDC, and Nous sign-in passed on a physical Samsung device with Battery Saver off. Other OEMs, Battery Saver-on behavior, and process death during provider UI were not separately verified.
+- App version: **1.19.0** (versionCode **60**).
+- Standard Chat, history, Manage, and Standard Voice use current upstream Hermes. The optional Hermes-Relay Plugin **1.13.1** supplies Relay tools and Secure Link host fixes.
+- Existing connections, profiles, sessions, history, drafts, and composer layout are preserved.
+- History recovery is covered by production HTTP fixtures and a Standard Phone API 36 rendered failure/reopen test. These checks do not certify behavior on every physical device.
+- Recent voice changes have source and fixture coverage; physical listening verification remains incomplete.
+- Screenshot upload authentication through Dashboard ingress remains tracked separately in [#745](https://github.com/Codename-11/hermes-relay/issues/745). This release does not claim to fix all screenshot behavior.

app/src/googlePlay/play/release-notes/en-US/default.txt

@@ -1,3 +1,3 @@
-v1.18.1 - Reliable browser sign-in
+v1.19.0 - Reliable chats, alerts, and voice
 
-Browser sign-in stays connected while you complete your provider's flow and return to Hermes-Relay. The sign-in notification ends when the attempt finishes or is canceled, and callback pages identify the selected provider.
+Open larger conversations with safer history loading and keep compacted scrollback. Find unread background replies with clearer alerts and counts. Voice preserves complete replies, hands off the microphone reliably, and offers optional muting of English tool announcements. Sign-in survives temporary proxy failures, pairing lifetime controls are clearer, and your selected appearance stays applied after startup.