Agent Review — PR #40 Sprint 21 Mobile Responsive + Docker

Verdict: APPROVED WITH FIXES — 5 issues found and fixed directly on the branch (commit 574cd2c). All 415 tests pass post-fix.

Security Audit

All mandatory security checks passed:

• Malicious code scan: CLEAN — no eval(), atob(), base64, exec(), document.write
• Path traversal: INTACT — relative_to() in _serve_static, Invalid category guard, client_address loopback gate all present
• SRI hashes: INTACT — 3 integrity= hashes on jsDelivr resources unchanged, mermaid pinned to @10.9.3
• renderMd XSS: CLEAN — no unescaped user content via innerHTML
• External URLs: Only http://localhost:8787 in README docs — not a concern

Bugs Fixed (commit 574cd2c)

BUG-1 [CRITICAL] — CSS cascade broke entire mobile slide-in feature
File: static/style.css

The @media(max-width:640px) block sets position:fixed on .sidebar and .rightpanel to enable the slide-in overlay behavior. But two bare position:relative rules existed later in the file (lines 528/530) — CSS specificity is equal so the later rule always wins, even on mobile. The sidebar/rightpanel would never float above content: .sidebar.mobile-open{left:0} with position:relative is just a minor offset, not an overlay. The entire slide-in feature was silently broken.

Fix: Wrapped both rules in @media(min-width:641px) so they only apply on desktop.

BUG-2 [MEDIUM] — mobileSwitchPanel() always reopened the sidebar
File: static/boot.js

The function closed the sidebar then immediately reopened it. A code comment said "close after a moment" but no setTimeout or auto-close logic existed. For the Chat tab, the chat content lives in the main area — reopening the sidebar just overlaid it and required an extra tap to dismiss.

Fix: Only open the sidebar for non-chat panels. Tapping Chat on the bottom nav now closes the sidebar so the chat area is unobstructed.

BUG-3 [MEDIUM] — Dockerfile missing pip install
File: Dockerfile

pyyaml is not in the python:3.12-slim base image. The Dockerfile copied source but never ran pip install -r requirements.txt. Container startup would fail immediately with ImportError: No module named 'yaml'.

Fix: Added RUN pip install --no-cache-dir -r requirements.txt after COPY . /app.

SEC-2 [MEDIUM] — No .dockerignore
File: .dockerignore (new)

COPY . /app with no .dockerignore included .git/, tests/, and .env* in every Docker image.

Fix: Added .dockerignore excluding .git, .pytest_cache, __pycache__, tests/, and .env*.

NIT-3 [LOW] — docker-compose tilde expansion
File: docker-compose.yml

${HERMES_HOME:-~/.hermes} — Docker Compose does not shell-expand ~ in variable default values. If HERMES_HOME is unset, it would attempt to mount a literal directory named ~/.hermes rather than the actual home directory.

Fix: Changed to ${HERMES_HOME:-${HOME}/.hermes}.

Other Findings (Not Fixed — Informational)

SEC-1 [MEDIUM] — Docker: unauthenticated by default, bound to 0.0.0.0

docker-compose.yml binds port 8787 to all interfaces with the password line commented out. Running docker compose up -d on a VPS or LAN machine exposes an unauthenticated UI. Recommendation: add a warning block in README, or change the default port binding to 127.0.0.1:8787:8787 with a note to change it for remote access.

SEC-3 [LOW] — Container runs as root

No USER directive. The ~/.hermes volume (containing API keys in config.yaml) is mounted at /root/.hermes and read by the root process.

NIT-2 — Right panel has no close-by-tap-outside mechanism on mobile

The hamburger sidebar has #mobileOverlay with onclick=closeMobileSidebar(). The files right-panel has no corresponding overlay — once opened, there is no way to dismiss it except tapping the Files button again. Not a blocker but worth a follow-up issue.

Test Results

What Looks Good

• Mobile CSS structure is correct — hamburger + overlay + bottom nav all properly hidden at min-width:641px so desktop is untouched
• sessions.js change is safe: closeMobileSidebar() called with a typeof guard before loadSession()
• _extract_keyframe helper in tests correctly uses css.find('@keyframes ' + name) (forward search), fixing the rfind-hits-wrong-block bug that was failing on master
• All SRI hashes intact, no new external CDN resources added
• No dead event listeners in boot.js, no leftover es.addEventListener patterns

Ready to merge after your sign-off. All 5 fixes are in commit 574cd2c on this branch.