Add an optional auth-token (bearer) field and a custom-headers textarea to
the MCP 'Add server' pane. URL-mode servers are now registered by writing
hermes config directly via the venv's config helpers (save_env_value +
save_config) instead of shelling into the interactive, network-probing
'hermes mcp add --url' flow that hung/504'd on auth challenges.
- Token is stored in ~/.hermes/.env (mode 600) and referenced in config.yaml
as 'Authorization: Bearer ${MCP_<NAME>_API_KEY}' — never plaintext config.
- Registration is non-blocking: no live probe, so a slow/unreachable server
can't hang the request.
- Add a per-server 'Test' button (POST /api/mcp/test -> hermes mcp test).
- Contract tests for the new fields, payload, no-probe path, and test route.
- Fix payload field names (snake_case → camelCase) so creates/updates
actually reach the server correctly
- Fix reveal dialog not opening after create/rotate (plain_key → plaintextKey)
- Add GET /api/admin/api-users/:id so the edit button loads existing data
- Show server errors inline in the dialog instead of silently succeeding
- Add 30d/90d/1y/Never expiration preset buttons
- Default new keys to pre+post access, 60 rpm, 1M monthly tokens
- Surface errors on revoke, reactivate, rotate, and delete actions
- Add client-side validation for required numeric fields
- Add contract tests covering all the above fixes
Adds §21 API Users pane with full CRUD, key rotation, log download, revoke/reactivate, and one-time key reveal dialog. Includes static UI contract test.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Zachariah K. Sharma