[Skeyelab]

Why

I walked the signup path as a new user. The product works, but several things made it look broken, and the copy assumed OpenClaw even though the first real client is a Hermes Agent plugin.

Onboarding

Before	After
Sign-up flashed "Account created" for 800ms, then dropped you on the sign-in form	Signs you in and lands on the dashboard; if that fails, sign-in says "Account created. Sign in to continue."
A new account saw "Welcome back" above 8 zeroed tiles	"Set up your first node" with a CTA; metrics appear once a node exists
"No nodes have been registered yet."	"No nodes yet…" plus a Create your first node button
"Saved: http://127.0.0.1:18789" for a URL you never saved	Only shown once you actually save one
"Sign in with your Neon Auth account", "Create one through your Neon Auth configuration flow first"	No vendor details; a plain link to create an account
Sidebar labelled every user "Admin"	Removed; there are no roles

Agent-agnostic

• Hermes Agent and OpenClaw are named as examples instead of OpenClaw being the whole product.
• The connect modal now leads with Hermes Agent: hermes plugins install ericdahl-dev/clawproxy-hermes, the two env vars, and the rule that the clawproxy route name must match the Hermes route name. The protocol block stays for any other agent.
• That block now documents pull_method: "POST". The route only accepts POST, which is why the relay's HTTP fallback never delivered anything (fixed separately in fix(relay): make the HTTP fallback work and handle SIGTERM #82).

Landing page

"No vendor lock-in — no third-party relay in the webhook path" was false: hosted clawproxy is a third-party relay in the webhook path. It now says clawproxy is free while in beta and can be self-hosted.

Tests

Written first: overviewIntro (first-run vs returning), landing copy, buildHermesSetup and the POST documentation, the sign-up auto sign-in and its fallback, sign-in copy and the confirmation banner, and the nodes page's saved-URL and empty-state behavior. Existing tests that encoded the old copy were updated with a note on why.

yarn vitest run: 265/265. Lint clean, no type errors outside tests.

[strix-security]

Strix Security Review

No security issues found.

Review summary

Reviewed all 22 changed files in PR #86, a copy/onboarding and agent-agnostic messaging change set. The only behavioral change of security note is the sign-up flow, which now auto-authenticates the new account via the Neon Auth SDK and navigates to the dashboard, falling back to the sign-in page with a static confirmation banner driven by a registered=1 query parameter (compared, never rendered). The new Hermes setup string and saved-base-URL value are rendered through React JSX (auto-escaped) and never reach an HTML-injection sink, and the added dashboard node-count query remains a parameterized Drizzle ORM call executed after requireAdminUser(). No injection, authentication, authorization, or data-exposure issues were identified in the changed code; static analysis (74 rules) reported zero findings. No changes requested.

_{Updated for ac4cdc4.}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}