Feature request: Biometric / device lock on app launch and background resume

[Papyrus-Bundecca]

Problem

Hermes Relay currently launches directly into the active chat interface and gateway session without requiring authentication. If an unlocked device is handed to another person or accessed without authorization, all conversation history, paired agent profiles, and agent tool execution surfaces are immediately accessible.

While Android offers OS-level profiles or Private Space on newer OS releases, in-app access gating is standard practice for clients handling sensitive infrastructure, personal data, and command execution (similar to Signal or Bitwarden).

Proposed Solution

Add an optional "App Lock" toggle under Settings (e.g., Security or Privacy):

1. BiometricPrompt Integration:

   • Use Jetpack to trigger the system biometric / device credential prompt (fingerprint, face unlock, or device PIN).
   • Gate app launch and return from background behind this prompt.

2. Lock Timeout Configuration:

   • Options: Immediately, 1 minute, 5 minutes, 15 minutes.

3. Screen Protection ():

   • Provide an option or default behavior to set when locked or backgrounded, preventing conversation snapshots in the Android recent-apps switcher.

Alternatives Considered

• Supervised Mode: Currently exists in the app, but its scope is restricted to locking settings configuration behind a custom PBKDF2 PIN rather than protecting the chat interface or app launch.
• OS-level App Lock / Private Space: Disables background notifications and companion alerts, disrupting proactive agent messaging.

[hermes-relay-triage]

🤖 Hermes-Relay automated triage

Thanks for laying out the threat model and clearly separating this from Supervised Mode!

Current origin/dev explicitly documents biometric or device-credential gating as Terminal-only; Chat and Bridge are intentionally outside that gate. The Android activity also has no app-wide resume lock or secure-recents protection today, so this is a design change rather than an apparent regression. The proposed timeout and background-snapshot behavior are specific enough for maintainer review.

A maintainer will follow up to decide whether that security model should change and how an app-wide gate should interact with notification, deep-link, assistant, and Supervised Mode entry paths.