Sweeps user-facing docs (English + zh-Hans mirrors) to the new auth model
now that the legacy dashboard session token is gone:
- loopback bind: no identity gate (the bind is the boundary) + a
Sec-Fetch-Site CSRF guard on mutating requests + localhost-only CORS
- gated (non-loopback) bind: pluggable OAuth/basic-auth provider; REST via
session cookie, WS via single-use ?ticket=
Files:
- configuring-models.md: drop the X-Hermes-Session-Token header from the
/api/model/* curl examples; replace the window.__HERMES_SESSION_TOKEN__
'grab it from devtools' note with the no-loopback-auth / gated-cookie model
- features/kanban.md: kanban routes + WS no longer described as token-gated
(loopback none; gated cookie + ?ticket=)
- features/web-dashboard.md: /api/pty WS auth reworded; the Security warning
now names the loopback-bind boundary + CSRF guard + CORS instead of 'no
authentication of its own', linking the gated auth section
- features/extending-the-dashboard.md: plugin routes 'require no identity
auth on a loopback bind' (kept the --host 0.0.0.0 / untrusted-plugin warning)
- zh-Hans mirrors of all four
Left untouched (verified NOT the legacy token): HERMES_DASHBOARD_BASIC_AUTH_SECRET
(basic provider cookies), the basic-auth 'asks for a session token' login hint,
desktop i18n remote-gateway token strings (remote 'token' mode kept), faq /usage,
homeassistant session tokens.
Co-authored-by: Hermes subagent <noreply@nousresearch.com>
1443be72f7