mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-31 19:16:29 +00:00
1443be72f7
Sweeps user-facing docs (English + zh-Hans mirrors) to the new auth model now that the legacy dashboard session token is gone: - loopback bind: no identity gate (the bind is the boundary) + a Sec-Fetch-Site CSRF guard on mutating requests + localhost-only CORS - gated (non-loopback) bind: pluggable OAuth/basic-auth provider; REST via session cookie, WS via single-use ?ticket= Files: - configuring-models.md: drop the X-Hermes-Session-Token header from the /api/model/* curl examples; replace the window.__HERMES_SESSION_TOKEN__ 'grab it from devtools' note with the no-loopback-auth / gated-cookie model - features/kanban.md: kanban routes + WS no longer described as token-gated (loopback none; gated cookie + ?ticket=) - features/web-dashboard.md: /api/pty WS auth reworded; the Security warning now names the loopback-bind boundary + CSRF guard + CORS instead of 'no authentication of its own', linking the gated auth section - features/extending-the-dashboard.md: plugin routes 'require no identity auth on a loopback bind' (kept the --host 0.0.0.0 / untrusted-plugin warning) - zh-Hans mirrors of all four Left untouched (verified NOT the legacy token): HERMES_DASHBOARD_BASIC_AUTH_SECRET (basic provider cookies), the basic-auth 'asks for a session token' login hint, desktop i18n remote-gateway token strings (remote 'token' mode kept), faq /usage, homeassistant session tokens. Co-authored-by: Hermes subagent <noreply@nousresearch.com> |
||
|---|---|---|
| .. | ||
| developer-guide | ||
| getting-started | ||
| guides | ||
| integrations | ||
| reference | ||
| user-guide | ||
| index.mdx | ||
| user-stories.mdx | ||