mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-31 19:16:29 +00:00
1443be72f7
Sweeps user-facing docs (English + zh-Hans mirrors) to the new auth model now that the legacy dashboard session token is gone: - loopback bind: no identity gate (the bind is the boundary) + a Sec-Fetch-Site CSRF guard on mutating requests + localhost-only CORS - gated (non-loopback) bind: pluggable OAuth/basic-auth provider; REST via session cookie, WS via single-use ?ticket= Files: - configuring-models.md: drop the X-Hermes-Session-Token header from the /api/model/* curl examples; replace the window.__HERMES_SESSION_TOKEN__ 'grab it from devtools' note with the no-loopback-auth / gated-cookie model - features/kanban.md: kanban routes + WS no longer described as token-gated (loopback none; gated cookie + ?ticket=) - features/web-dashboard.md: /api/pty WS auth reworded; the Security warning now names the loopback-bind boundary + CSRF guard + CORS instead of 'no authentication of its own', linking the gated auth section - features/extending-the-dashboard.md: plugin routes 'require no identity auth on a loopback bind' (kept the --host 0.0.0.0 / untrusted-plugin warning) - zh-Hans mirrors of all four Left untouched (verified NOT the legacy token): HERMES_DASHBOARD_BASIC_AUTH_SECRET (basic provider cookies), the basic-auth 'asks for a session token' login hint, desktop i18n remote-gateway token strings (remote 'token' mode kept), faq /usage, homeassistant session tokens. Co-authored-by: Hermes subagent <noreply@nousresearch.com> |
||
|---|---|---|
| .. | ||
| features | ||
| messaging | ||
| secrets | ||
| skills | ||
| _category_.json | ||
| checkpoints-and-rollback.md | ||
| cli.md | ||
| configuration.md | ||
| configuring-models.md | ||
| desktop.md | ||
| docker.md | ||
| git-worktrees.md | ||
| multi-profile-gateways.md | ||
| profile-distributions.md | ||
| profiles.md | ||
| security.md | ||
| sessions.md | ||
| tui.md | ||
| windows-native.md | ||
| windows-wsl-quickstart.md | ||