+ WjxaRt0tRt^RIHt^RIt^RIHt^RIt^RIt^RI t ^RI t ^RI t ^RI t ^RI t ^RIt^RIt^RIt^RIt^RIHt^RIHt^RIHt^RIHt^RIHtHtHtH t ]!]!4PDPDPG4t$]%!]$4] PL9d#] PLPO^]%!]$44^R I(H)t)^R I*H+t+^R I,H-t-H.t.H/t/^R I0H1t1^R I2H3t3R] Pr9d]!] PrR,4M]!]!4PDR, t:]Pv!]<4t=^RI>H?t?H@t@HAtAHBtBHCtCHDtDHEtEHFtFHGtGHHtHHItIHJtJRRltKRRRlltLRtM^RINHOtORRltPRRltQRRltR]-!R ]+!4P]OR!7tT^R"IUHVtV]TP]V4^R#IXHYtZ]TP]Z4R$R%lt\]\!4s]R&t^Rs_]^kRs`]^kRsa]^kR'R(ltbR)R*ltcR+R,ltdR-te^R.IfHgthR/R0lti]j!R104tk]^kR2R3ltlR4R5ltm^R6InHotoHptpHqtqHrtrHstsHtttHutuHvtvRR7R8lltw]TPR94R:R;l4ty^RR?l4t]TP]{4]TPR94R@RAl4t]TPR94RBRCl4t]TPR94RDREl4tRFt!RGRH4t]!4t]TPR94RIRJl4t]TP]1RKRL.RL.RM7RNtROtRPRQltRRRSlt^RTIHt^RUIHtHt^RVIHt^RWIHt^RXIzHtHtHt] EP4!RY4tRt]!] EP4!RZR[44t]^8:d]=EPCR]]4RtM]]8d]=EPCR^]]4]tRtRtRtR_RR`R/t]^kRaRblt]EPL!4tRctRs]^kRRdRe/RfRgllltRs]^kRhRilt]EPZ!RjRk4Rs]^kRRlRmllt^RnIHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHt]TP]P4]TP]P4]TP]P4]TP]P4]TP]P4]TP]P4]TP]P4]TP]EP4]TP]EP4]TP]EP4]TP]EP4]TP]P4]TP]EP4]TP]P4]TP]P4]TP]P4]TP]P4]TP]EP4]TP]EP4]TP]P4]TP]P4]TP]P4]TP]EP4]TP]P4]TP]P4]TP]P4]TP]P4]TP]P4]TP]P4]TP]P4]TP]P4]TP]P4]!4^R#IHYt]TP]4]!]T4RoRpltRqRrltRsRe/RtRulltRvRwltRxRyltRzR{ltR|R/R}R~lltRtRRltRRRlltR# ]4d=^RI5H6t6]6!R4^R I,H-t-H.t.H/t/^R I0H1t1^R I2H3t3EL ]7d ]8!R4hi;ii;i ]]3d+]=EPCR\] EP4!RZ44RtEL%i;i)uHermes Agent — Web UI server: FastAPI app assembly, auth/host middleware, ``start_server``. Route handlers live in ``web_routers/``; their helpers live in the sibling ``web_server_`` modules and are re-imported here so ``web_server.`` stays the single late-binding seam tests monkeypatch (``web_deps.late``). Usage: ``python -m hermes_cli.main web [--port 8080]``. )asynccontextmanagerN)deque)get_install_id)is_desktop_owned_backend) run_reaper)Path)AnyDictOptionalTuple load_config)get_version_info)FastAPI HTTPExceptionRequest)CORSMiddleware) JSONResponse) ensure_importwebzOWeb UI requires fastapi and uvicorn. Run hermes pm repair, then restart Hermes.HERMES_WEB_DISTweb_dist) PORT_IN_USE_EXIT_CODE_dashboard_forwarded_allow_ips_eager_reconcile_own_session_db_maybe_open_browser_port_bind_conflict_read_bound_port_report_port_in_use_start_parent_death_watchdog_uvicorn_console_logging_warm_gateway_module_write_dashboard_ready_file_write_machine_sentinel_linec0V^8dQhR\R\/#)namereturnstrbool)formats"IC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\web_server.py __annotate__r-QsDDSD4Dcn^RIHpHpV!\V44;'gVR8g;'d V!V4#)a A gateway already ticks this profile's store with live adapters: its OWN process, or the live default multiplexer (a served satellite has no gateway.pid of its own). Winning the tick-lock race here would deliver through the standalone path (#52202, #100489, #107485).)_check_gateway_running_served_by_running_multiplexerdefault)hermes_cli.profilesr0r1r)r&homer0r1s&& r,_gateway_owns_cronr5Qs<[ !$t* - D D BB,_start_desktop_cron_ticker..ss *.__annotate__s   r.cp<\SS4# \d\PRRR7R#i;i)zADesktop cron: gateway-ownership probe failed; starting the tickerTexc_infoF)r5 Exception_logwarningrOsr,_owned*_start_desktop_cron_ticker.._owneds9 )(H==  `ko p s "55zDesktop cron scheduler waiting: live gateway owns cron on this HERMES_HOME; the gateway ticks with live adapters (re-probing every %ds)Nz:Desktop cron scheduler started (provider=%s, interval=%ds))cron.scheduler_providerr=r>hermes_constantsr?r@r isinstancer3rFhermes_loggingrLrZinfolenrY exceptionwaitr&start)r7r8r=r>r?r@providerrK start_kwargsrJinitial_profile_homesrLr&_homer\rPrQrFs&& @@@r,_start_desktop_cron_tickerrk[sm WG%'HO%&H$X.;;)HIL$h/L(33 d =LM$1O !$1>_-/;^,E*+@A H-.-BC-BkdT-BC , .-KL )+7 (   88 IINOW ??8,,xxIIJHMM[cd NN:..AD d NNb c ds*E$15E$& E3E$E$$ FFg?) app_lifespanc0V^8dQhR\R\/#)r%appr&)rr))r+s"r,r-r-s  G 3 r.c\VPV4# \d#T!4p\TPY4Tu#i;i)zReturn ``app.state.``, lazily creating it for non-``with`` TestClient usages. The lifespan normally initialises these on the running event loop (an asyncio.Lock created at import time binds to whatever loop was active then). )getattrstateAttributeErrorsetattr)rnr&factoryvalues&&& r,_app_state_defaultrvsA syy$''   4' s*AAcDV^8dQhR\R\P/#r%rnr')rasyncioLock)r+s"r,r-r-s"CCWCCr.c8\VR\P4#)chat_argv_lock)rvryrzrns&r,_get_chat_argv_lockr~s c#3W\\ BBr.cRV^8dQhR\R\\\3,/#rx)rdictr)r)r+s"r,r-r-s&EEwE4T ?Er.c$\VR\4#)pty_active_session_files)rvrr}s&r,_get_pty_active_session_filesrs c#=t DDr.z Hermes Agent)titleversionlifespan)AuthBodyLimitMiddleware)routerc$V^8dQhR\/#rSr))r+s"r,r-r-sYYYr.c|\PPR4;'g\P!^ 4#)HERMES_DASHBOARD_SESSION_TOKEN)osenvirongetsecrets token_urlsaferNr.r,_resolve_session_tokenrs* ::>>: ; X Xw?T?TUW?XXr.zX-Hermes-Session-Tokenc(V^8dQhR\RR/#)r%tokenr'Nr)r+s"r,r-r-sCDr.cV'dVsR#R#rB)_SESSION_TOKEN)rs&r,_apply_ssh_session_tokenrs  r.c>V^8dQhR\\,RR/#)r%noncer'Nr r))r+s"r,r-r-s(3-Dr.c4VsRsRsV'd\P!4R,p\PPTRT 24p\TRRR7;_uu_4pTPR\P!4 R24RRR4Ts\P!T4pYPTP3sR#R# \ \ 3dR#i;i +'giL];i \ dLki;i \ dR#i;i)Npurelibz.hermes-ssh-runtime-wzutf-8)encodingzpid= )_SSH_OWNER_NONCE_SSH_RUNTIME_PURELIB_SSH_RUNTIME_MARKER sysconfig get_pathsKeyErrorOSErrorrpathjoinopenwritegetpidstatst_devst_ino)rrmarkerfhsts& r,_apply_ssh_owner_noncers  ))+I6G WW\\'-A%+IJFfcG444 }B/05"(  !B$+YY #B % '"   54       sLC 9C7&)C$ C7.D C! C!$ C4 /C77 DD DDc$V^8dQhR\/#rSrT)r+s"r,r-r- s 5 5T 5r.c\e$\PP\4#\fR#\wrp\P !V4pTPTP3Y38H# \ dR#i;i)NTF) rrrisfilerrrrr)rdeviceinoders r,_ssh_runtime_intactr st&ww~~122#1GU WWW  IIryy !f_ 44 sA22 BBT)PUBLIC_API_PATHSc0V^8dQhR\R\/#)r%requestr')rr*)r+s"r,r-r-$s S Sg S$ Sr.c|VPP\R4pV'd@\P!VP 4\ P 44'dR#VPPRR4p\P!VP 4R\ 2P 44#)zTrue if the request carries a valid dashboard session token. The dedicated header avoids collisions with reverse proxies that already use ``Authorization`` (Caddy ``basic_auth``); the legacy Bearer path stays for older dashboard bundles. T authorizationzBearer )headersr_SESSION_HEADER_NAMEhmaccompare_digestencoder)rsession_headerauths& r,_has_valid_session_tokenr$s__(()=rBN$--n.C.C.E~G\G\G^__ ??   3D   t{{}7G.H.O.O.Q RRr.z/api/files/downloadc<V^8dQhR\R\R\/#)r%rrr')rr)r*)r+s"r,r-r-7s&XXGX3X4Xr.cV\9dR#VPPRR4p\V4;'d8\P !VP 4\P 44#)Frr)_QUERY_TOKEN_API_PATHS query_paramsrr*rrrr)rrrs&& r,_has_valid_query_tokenr7sT ))  $ $Wb 1E ; W W4..u||~~?T?T?VWWr.c(V^8dQhR\RR/#)r%rr'Nr)r+s"r,r-r->sDDGDDr.c<\VPRR4'g\VPRR4RJdR#\VPPRR4'd\VPRR4RJpM \V4pV'g\ RR R 7hR#) u!Authorize a sensitive endpoint, raising 401 if the caller isn't allowed. Loopback mode (``auth_required`` False): validate the SPA-injected ``_SESSION_TOKEN``. Gated mode: the token is NOT injected (cookie auth), and ``gated_auth_middleware`` already 401'd anything without a verified ``request.state.session`` — requiring the absent token here would make every ``_require_token`` endpoint unreachable behind the gate, so defer to it. A verified native owner (``authenticate_native_http``) is the same-user principal the outer seams already accepted; local Desktop runs with no static token, so that principal must satisfy route-local policy too. Hosted plugins receive this guard's decision via private IPC and request-local state, not via a forwarded gateway credential or a process-wide bypass. native_http_principalNhosted_http_authenticatedT auth_requiredFsession Unauthorized) status_codedetail)rprqrnrr)roks& r,_require_tokenr>s  6==w}}&A4HDPw{{  /599 W]]It 4D @ %g . NCC r.) _DESKTOP_ATTACHMENT_WS_MAX_BYTES_LOOPBACK_HOST_VALUES_dashboard_public_hosts_desktop_loopback_auth_exempt_host_header_hostname_is_accepted_hostpublic_hosts_engage_gateshould_require_authchV^8dQhR\R\\\,,R\/#)r%hosttrusted_public_hostsr')r)r frozensetr*)r+s"r,r-r-cs4 W W  W"9S>2 W  Wr.cZVf \4p\V4;'g \V4#)zGate required for a non-loopback bind OR a non-loopback ``dashboard.public_url``. Callers may pass the already-resolved host set so startup and request validation share one snapshot. )rrr)rrs&&r,should_require_dashboard_authrcs-#68 t $ V V(@AU(VVr.httpc$V^8dQhR\/#r%rr)r+s"r,r-r-rs$$'$r.c ."\\PRR4pV'd^\VPP RR4V\\PR\ 444'g\RRR/R 7#V!V4GRjxL #L5i) ziReject requests whose Host header doesn't match the bound interface (DNS rebinding, GHSA-ppp5-vxwm-4cf7). bound_hostNrrrirzfInvalid Host header. Dashboard requests must use the bound hostname or the configured public hostname.rcontent)rprnrqrrrrr)r call_nextrs&& r,host_header_middlewarerqsL$7J+FB'WSYYH^`i`k5lH  7# ## #sB BBB)PluginApiWebSocketGate_plugin_api_name_plugin_api_request_refused) forward_secondary_plugin_requestplugin_request_scopec$V^8dQhR\/#rr)r+s"r,r-r-s$$G$r.c"VPPp\VP4pV'd\ VP RR4'gg\ VP RR4'gJ\ VP P RR4'g#\V4'g\W4'dr\VP4;_uu_4\V4GRjxL 'd\RRR/R 7uuRRR4#\W4GRjxL pRRR4XeV#V!V4GRjxL #LTL$ +'giL*;iL5i) aBlock requests to disabled plugin API routes at request time (:func:`_plugin_api_request_refused`). Registered BEFORE the auth middlewares (runs AFTER them): an unauthenticated caller must get auth's 401, never this 404, or the status code becomes a plugin-name oracle. token_authenticatedFrNrirzPlugin not foundr) urlrrscoperprqrnrrrrrr)rrr plugin_namehosteds&& r,_plugin_api_runtime_gaters ;;  D"7==1K 4e<< 7=="94 @ @ 7;;$$ou = = #G , , !' 0 0 !'-- 0 00===#hHZ=[\1 0Q1 0 $s`CED>%D:& D>0D>> E D>D<D>E5E6E:D><D>> E Ec$V^8dQhR\/#rr)r+s"r,r-r-s;;;r.c:"^RIHpV!W4GRjxL #L5i)uOAuth gate — active only when start_server flags ``auth_required``; pass-through on loopback. Registered between host_header and auth_middleware: host check → cookie auth → token auth. )gated_auth_middlewareN)$hermes_cli.dashboard_auth.middlewarer)rrrs&& r,_dashboard_auth_gaters K&w: :: :s c$V^8dQhR\/#rr)r+s"r,r-r-s$$7$r.c"VPPp\VPRR4'g\VPRR4'g\VPPRR4'gkVP R4'dTV\ 9dIVP R4'g2\V4'g!\W4'g\RR R /R 7#V!V4GRjxL #L5i) uRequire the session token on all /api/ routes except the public list. Skipped for requests the token-auth seam already authenticated (``token_authenticated``) and when the OAuth gate is active — cookie auth is then authoritative and the loopback-only token path must not override it. rFrNrz/api/z/api/mcp/oauth/callback/rrrr) rrrprqrn startswith_PUBLIC_API_PATHSrrr)rrrs&& r,auth_middlewarers ;;  D GMM#8% @ @ '>EE ))?EBB OOG $ $ ) ) :;;(11&w55h5OPP7# ## #sBC6!C63> ' &8? ' & &s8A*AA* AAA A*A A' ! A*gr@ca]tRtRtoRt]3V3RlRlltV3RlRltV3RlRltV3R lR lt V3R lR lt R t Vt R#)DashboardHealthiuDashboard-process health: rolling unhandled-error/5xx window + periodic self-test result. Feeds ``components`` on the PUBLIC ``/api/status``, so :meth:`snapshot` exports counts and enums only — never ``last_error_type``/``last_error_path``. c$<V^8dQhRS[RR/#)r%window_secondsr'Nfloat)r+ __classdict__s"r,r-DashboardHealth.__annotate__s11u1TX1r.cWn\RR7VnRVnRVnRVnRVnRVnRVnR#))maxlenNunknown) rr _error_timeslast_error_typelast_error_path last_error_atselftest_statusselftest_http_status selftest_at)selfrs&&r,__init__DashboardHealth.__init__sE,*/s*;.2.2.2$-37!,0r.c*<V^8dQhRS[RS[RR/#)r%exc_typerr'Nr)r+rs"r,r-rs"!!S!!!r.c\P!4pVPPV4WnW nW0nR#rB)timerappendrrr)r#r'rnows&&& r, record_errorDashboardHealth.record_errors3iik   %'# r.c:<V^8dQhRS[RS[S[,RR/#)r%passed http_statusr'N)r*r r;)r+rs"r,r-rs&''d'#'4'r.chV'dRMRVnW n\P!4VnR#)rfailingN)r r!r)r")r#r/r0s&&&r,record_selftestDashboardHealth.record_selftests"'-t9$/!99;r.c <V^8dQhRS[/#rS)r;)r+rs"r,r-rs&&C&r.c\P!4VP, pVP'd5VP^,V8dVPP4KF\ VP4#))r)rrpopleftrc)r#cutoffs& r,recent_error_count"DashboardHealth.recent_error_countsYt222D$5$5a$86$A    % % '4$$%%r.c6<V^8dQhRS[S[S[3,/#rS)rr)r)r+rs"r,r-r s   $sCx.  r.c VP4pV'gVPR8XdRMRpRVRVRVPRVP/#)zAPublic component payload: status enum + counts + timestamps only.r2degradedrstatusrecent_unhandled_errorsrselftest)r:r r)r#errorsr?s& r,snapshotDashboardHealth.snapshot sQ((* &$*>*>)*KRV f %v T// ,,   r.)rrrrr"r!r rN) __name__ __module__ __qualname____firstlineno____doc__ _DASHBOARD_HEALTH_WINDOW_SECONDSr$r,r3r:rC__static_attributes____classdictcell__)rs@r,rrsB 0P11!!'' &&   r.rc$V^8dQhR\/#rr)r+s"r,r-r-s   r.cf"V!V4GRjxL pTPR8d8\PRTP 2TP P 4T#LN \dDp\P\T4PTP P 4hRp?ii;i5i)z[Outermost non-CORS middleware: count unhandled exceptions and 5xx; re-raises, never alters.Nihttp_)rYDASHBOARD_HEALTHr,typerErrr)rrresponseexcs&& r,_dashboard_health_middlewarerTs"7++s"%%h.B.B-C&DgkkFVFVW O , %%d3i&8&8'++:J:JK s8B1 A AA A B1A B.+>B))B..B1z*^https?://(localhost|127\.0\.0\.1)(:\d+)?$*)allow_origin_regex allow_methods allow_headersgN@z/api/sessions?limit=1cV^8dQhRR/#r%r'NrN)r+s"r,r-r-;s 6 6 6r.c"^RIpTPTP\R7RR7;_uu_4GRjxL pTP \ \\/R7GRjxL pRRR4GRjxL \PXP^8HTP4R# \dR#i;iL~LWLI +GRjxL 'giL`;i \d\PRR4R#i;i5i)zARun one authenticated in-process self-test request and record it.Nr}zhttp://127.0.0.1) transportbase_url)rF) httpx ImportError AsyncClient ASGITransportrnr_DASHBOARD_SELFTEST_ROUTErrrPr3rrY)r^clientresps r,_dashboard_selftest_oncere;s6$$u/B/Bs/B/KVh$iiims$=H\^lGmnnDji(()9)9S)@$BRBRS jnjiii 6((56sDB)3CB;C%C%B=&C* C5B?61C'D) B84D7B88D;C=C?CC C  C C C!D>DDDcV^8dQhRR/#rZrN)r+s"r,r-r-Js ) ) )r.c"^RIp\P !\ 4GRjxL \\PRR4'dKF\4GRjxL KZ \d\PR4R#i;iLbL/5i)z4Periodic self-test driver started from the lifespan.Nu2httpx unavailable — dashboard self-test disabledrF) r^r_rZdebugrysleep$_DASHBOARD_SELFTEST_INTERVAL_SECONDSrprnrqre)r^s r,_dashboard_selftest_looprkJss mm@AAA 399ou 5 5 &(((  GH B )sCB A"B B 4B B B " BB BB  B )web_server_gateway)_ACTION_LOG_FILES"_terminate_desktop_managed_gateway)_auto_archive_ticker_loop) PTY_REGISTRY)_discover_dashboard_plugins_mount_plugin_api_routes mount_spaGATEWAY_HEALTH_URLGATEWAY_HEALTH_TIMEOUT1u>Invalid GATEWAY_HEALTH_TIMEOUT value %r — using default 1.0suNInvalid non-positive GATEWAY_HEALTH_TIMEOUT value %.3fs — using default 1.0szKCapping GATEWAY_HEALTH_TIMEOUT %.3fs to %.3fs for dashboard liveness probesrootruc:V^8dQhR\\,/#rSr)r+s"r,r-r-s;; ;r.c"\\R7#)z*Process-lifetime-cached stable install id.)cache)_shared_get_install_id_INSTALL_ID_CACHErNr.r,rrs !(9 ::r.g$@ interruptFcV^8dQhR\\,R\R\\P \3,/#)r%profiler}r')r r)r*tuple subprocessPopen)r+s"r,r-r-s8((HSM((Y^_i_o_oqu_uYv(r.c \P!VR4R.V,,p\PPR4pVeUVP 4fC\P PR4pVeV\ V48XdVR3#\R4h\pVeiVwrgpV\ V48Xd\P!4V, MRp V e2V \8d'\PRV \VRR 44VR3#\P!VR4p \P!4V \ V43sV R 3#) u\Spawn ``hermes gateway restart``, reusing an in-flight or recent restart. Concurrent children race each other on the kill-and-start path, so a live child is reused; requests within ``GATEWAY_RESTART_COOLDOWN_SECONDS`` for the same profile coalesce onto the last spawn too (#89034). This process stops nothing itself: the child decides whether the restart is even allowed (``_cmd_restart``'s multiplexer guard), so the orphan reap (#77276) runs there, after that guard — reaping here killed the profile's gateway and then the child refused to start a replacement (#125394). Returns ``(proc, reused)``. restartz --interruptzgateway-restartNTz7gateway restart already in progress for another profilezCoalescing gateway restart: one was started %.1fs ago (pid %s) and the gateway may still be coming back; not spawning another (#89034).pid?F) _gateway_mod_gateway_subcommand _ACTION_PROCSrpoll_ACTION_COMMANDSr RuntimeError_LAST_GATEWAY_RESTARTr) monotonic GATEWAY_RESTART_COOLDOWN_SECONDSrZrbrp_spawn_hermes_action) rr} subcommandexistingexisting_commandrecent spawned_at recent_procrecent_commandageprocs &$ r,_spawn_gateway_restartrs3 11'9EZcHccJ))--.?@H  7'88<<=NO  #'75;L'LT> !TUU "F 28/ /=zAR/Rdnn+X\ ?s%EE II- UC0  $ $  , ,Z9J KD!^^-tU:5FG ;r.cFV^8dQhR\\,R\/#)r% signaturer')r r)r*)r+s"r,r-r-s  Xc] t r.c4VfRsR#V\8XdR#VsR#)zQTrue if ``signature`` is new and should be logged now; ``None`` clears the latch.NFT)_voice_list_last_error)rs&r,_voice_list_error_logged_oncers(!%**& r.zcomputer-use-grantzaction-computer-use-grant.logc0V^8dQhR\R\/#)r% force_rescanr')r*rI)r+s"r,r-r-s $ $ $$ $r.c^RIHpHpV!4pVe V!W04#\RJ;'gGT;'g=\;QJd R\4F 'gK RM RM!R\44pV'd \ 4s\#)zPThe active scope's dashboard plugins: a secondary profile's are its own (PLG-3).)profile_dashboard_pluginssecondary_profile_homeNc3l"TF*p\VR,4P4'*xK, R#5i)_dirN)ris_dir.0ps& r, )_get_dashboard_plugins..s,D.FD6O " " $$$.Fs24TF)%hermes_cli.web_server_plugin_profilesrr_dashboard_plugins_cacheanyrq)rrrr4stales& r,_get_dashboard_pluginsrsh ! #D (<< $ ,     D.FDD.FDAE #>#@ ##r.)filesgit local_modelsr?actionsaudiodisplaysessionsprofilesmemory_providers config_envmodels messagingoauthcronmcpopsskillstools analyticschat_wschat_workspaces dashboard_uishared_metrics delegationc0V^8dQhR\R\/#)r%rr'r)r+s"r,r-r-?sRRCRCRr.c.p^RIHpVP'dVPRVP 24T\ 9d$Rp^RIHpT!4pRT;'gR R2pRpMR T R 2pRpTR , p^R IH p^R I H pT!4p T PR4;'g/PR4;'g/p T PR4;'g/PR4;'g.p \T PR44;'d4\T PR4;'gT PR44p T 'd"\T 4T,'d RT,pRT RT R2p T'd'T RRPT4,R,, p Y,# \dELi;i \dEL}i;i \dLpi;i)a[Actionable SystemExit text for a gated bind with no registered auth provider. Names the exact trigger: on a loopback bind the ONLY trigger is dashboard.public_url, so print the offending URL and the remove-it exit. Bundled providers expose ``LAST_SKIP_REASON`` so an installed-but- unconfigured provider is not reported as merely "no providers". )nousu • nous: r)resolve_public_urlzdashboard.public_url is set to zuT — an operator-declared external URL engages the auth gate even on a loopback bindzIf this dashboard should be LOCAL-ONLY (no reverse proxy), remove dashboard.public_url from config.yaml (and unset HERMES_DASHBOARD_PUBLIC_URL) to restore the unauthenticated loopback mode. z-the auth gate engages on non-loopback binds ()uTConfigure an auth provider before exposing the dashboard: • Password: set dashboard.basic_auth.username + password_hash in config.yaml (hash with: python -c "from plugins.dashboard_auth.basic import hash_password; print(hash_password('your-password'))") • OAuth: run `hermes dashboard register` (Nous Portal) or install a DashboardAuthProvider plugin. There is no unauthenticated public-dashboard option. For local-only use, bind 127.0.0.1 and leave dashboard.public_url unset; a configured external public URL requires auth even when a local reverse proxy reaches a loopback backend.r )_BASIC_AUTH_PLUGIN_KEYS dashboard basic_authpluginsdisabledusername password_hashpasswordzThe 'basic' dashboard-auth plugin is in plugins.disabled but dashboard.basic_auth is configured. Remove 'basic' from plugins.disabled (or run `hermes plugins enable basic`), then restart the dashboard. zRefusing to bind dashboard to u — z), but no auth providers are registered. z)Bundled providers reported these issues: rz )plugins.dashboard_authrLAST_SKIP_REASONr*rYr hermes_cli.dashboard_auth.prefixrhermes_cli.configr hermes_cli.plugins_cmdrrr*setr)r skip_reasons _nous_plugin public_urlr gate_reasonfix_hint _load_cfgrcfgbar has_credsmsgs& r,_no_auth_provider_messager?s!L ?  ( ( (   ,|/L/L.M N O $$   K+-J.33345& '  / FdV1M   A H  >Bkggk"((b - -l ; A ArGGI&,,"11*=CC +,ddbff_6M6c6cQSQWQWXbQc1d #h-*AAA! H )eK=A4 5 ;dii >UUX^^^ >I       f    sdF2F2 G:*G%G>GG2#GG4G!G2 GG GG G$#G$c xV^8dQhR\R\R\\,R\\,RR/#)r%r allow_publicssh_session_tokenssh_owner_noncer'N)r)r*r )r+s"r,r-r-sB3 3 3 3  }3 c] 3  3 r.c \4\Pn\ WV4'd5\ V4\Pn\PR4M7\V\PP4\PnV'd"V\9d\PRV4\PP 'd\^RI H pV!4'g\\V44h\PRVRP!RV!4444R#R#)zResolve the trusted public hosts + auth-gate flag onto ``app.state``. Fails closed (``SystemExit`` with an actionable message) when the gate engages but no dashboard auth provider is registered. zDesktop-owned loopback backend: dashboard.public_url does not engage the ticket gate for this process; the public deployment keeps its own gate.u--insecure no longer bypasses dashboard authentication. A non-loopback bind (%s) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.)list_providersz=Dashboard binding to %s with auth gate enabled. Providers: %sz, c38"TFqPxK R#5irB)r&rs& r,r'_configure_auth_gate..s7&6ff&6sN)rrnrqrrrrrZrbrrr[hermes_cli.dashboard_authr SystemExitrr)rrrrrs&&&& r,_configure_auth_gaters&=%>CII"%ToNN#6d";   " #@ciiFdFd"e $99     yy<6t<= = K  II7n&67 7 r. ssh_isolatedc<V^8dQhR\R\R\/#)r%rportr)r)r;r*)r+s"r,r-r-s&@*@*@*3@*@*r.cZa^RIpV\9p\4PR4;'g/oR RV3Rlllp\ pV'dR MV!R4V!R43wrxV'dN^RIHp Hp H p H p V !4\ Pn V !\ \ PP4pYr\4VPW`VRR\\ PP 4\#S4VV\$^R 7 p WP'V 43# \d/oLi;i) aBuild the uvicorn ``Config`` + ``Server`` for this bind (reads ``app.state.auth_required``). uvicorn.Server is driven directly (not uvicorn.run) so startup is split from the main loop: after startup() the socket is bound and held by uvicorn, so the OS-assigned port can be read with no pre-bind-then-close TOCTOU. Explicit taken ports are caught by the #93608 preflight probe; uvicorn's own bind error stays the fallback for races. Nrc<V^8dQhR\R\R\/#)r%keyr2r')r)r)r+s"r,r-+_build_uvicorn_server..__annotate__s!cEUr.cl<\SPW44# \\3dTu#i;irB)rr TypeError ValueError)rr2 _dash_cfgs&&r,_ws_ping_setting/_build_uvicorn_server.._ws_ping_settings5 s45 5:& N s 33ws_ping_intervalws_ping_timeout)TUNNEL_WS_PING_INTERVAL_STUNNEL_WS_PING_TIMEOUT_SIdleClientTrackerwrap_asgi_with_ws_trackingr[) rr log_level log_config proxy_headersforwarded_allow_ipsrr ws_max_sizetimeout_graceful_shutdown)g4@)NN)uvicornrr rrYrnhermes_cli.web_server_idle_exitrrrrrqssh_isolated_clientsr Configr*rrrServer)rrrr  _is_loopbackr served_app ping_interval ping_timeoutrrrrconfigrs&&$ @r,_build_uvicorn_serverrs00LM%%k288b J2>,+,.>?P.QESM p p):)< &/SYY5S5ST &?| ^^DI$399223;9E&$4 #$!F$ >>&) ))U  sDD D*)D*c(V^8dQhR\RR/#)r%whatr'Nr)r+s"r,r-r- s00s040r.ctV!4R# \d"p\PRY4Rp?R#Rp?ii;i)zNRun a best-effort startup step; any failure (import included) is a debug line.z%s skipped: %sN)rYrZrh)rfnrSs&& r, _best_effortr s.0  0 #T//0s 727c0V^8dQhR\R\/#)r%roler'r()r+s"r,r-r-sCDr.c^RIHp^RIHpVP V4pTf\ TPT44#TP\P!48XdR#T!TPTP4fR#TPT4R# \ dR#i;i \ dR#i;i \ dR#i;i \ dR#i;i)aTrue when the conflicting host owner was reaped/cleared and the claim is worth retrying. HELD_BY_OTHER helper for #121964. A stale record with no live owner is retracted via ``discard_dead_record`` (which only removes provably-gone owners); a live owner is reaped only when the spawn ledger proves it is a dead session's orphan. Anything else returns False and the caller stays observe-only. Never raises. host_rendezvous)reap_orphaned_backend_ownerFT) gatewayr hermes_cli.process_identityr! read_recordrYr*discard_dead_recordrrr create_time)rhrr!owners& r,!_reclaim_host_from_orphaned_ownerr)s.Gt$ } ..t45 5 yyBIIK &uyy%2C2C D L M  t$ %         sFBB-%B?C B*)B*- B<;B<? C C C C c4V^8dQhR\R\RR/#r%rrr'Nr)r;)r+s"r,r-r-7s!3333c3d3r.c>^RIHp\4pV'd VPM VPpVP V4wrVWRP PJd\PRV4R#WRP PJd-V'g%\V4'dVP V4wrVWRP PJd}VPV4pV'd3\PRTV'dVPV4MR4R#\PRV'dVPV4MR4R#V\P nVP%VVVVP'4\(R7VP+V4R#)zPublish this backend's host record: ``ROLE_SERVE`` for the machine-level owner, ``ROLE_DESKTOP_SERVE`` for a Desktop-owned child.rzuHost backend lock could not be opened (%s); this backend is not discoverable. This is NOT another backend holding it.Nz0another Desktop backend holds the %s record (%s)z owner unknownzAnother backend already owns this host (%s); this one bound anyway (observe-only). Multiplex-only expects exactly one backend per host.)rrrr)r"r rROLE_DESKTOP_SERVE ROLE_SERVEclaim_host_lockHostLockOutcomeCOULD_NOT_OPENrZr[ HELD_BY_OTHERr)r$rhdescribernrq host_rolepublish_recordserved_profilesrcleanup_on_exit)rrr' desktop_childroutcomeerrorr(s&& r,_publish_host_rendezvousr<7sJ.,.M$12 r}}D''-NG$$333  67< > $$222= -T 2 2//5NG$$222t$  JJI4-2r{{5) I   S"'BKK _ CII  ##%tr. ssh_lock_pathcV^8dQhR\R\R\R\R\R\R\R\\,R R / #) r%rrheadlessisolated open_browserinitial_profilestart_mcp_discovery_after_bindr=r'Nr)r;r*r r)r+s"r,r-r-ms[W[W [W  [W  [W  [W[W[W%)[WD>[W [Wr.caaaaaaaaaRRlp RRlp \4'd \RV 4\RV 4\4\\P RR4ei^R IHp Hp \\4PR 4;'g/PR V 44p V !V\P PV R 7\\P RR4f\4'd^R IHpV!V4\\P RR4e)V'd!\"'d^RIHpV!W\"R7\)WR7oS\P nS'*\P nRVVVVV3Rllp\RV4\RVV3Rl4\/S4S'd\1RS 24\1RS 24M\1RS 24S'd\3RS RS 2RR7M^RIHp\3RV!S4 RS 24\9SSVS4V'd^RIHpV!\>R\@R 7R#R$lp\R%V4R&oR'o\FPH!4oR(VVVV3R)lloSPKSSSPM4S,4R# \\3dT p EL&i;i \Bd\>PER!RR"7Li;i)*zPost-bind arming on the serving loop right after ``server.startup()``. Reap prior corpses, parent-death watchdog, process identity, READY announcement, browser open, deferred MCP discovery, loop-noise filter, loop heartbeat. cV^8dQhRR/#rZrN)r+s"r,r-(_on_server_started..__annotate__s..$.r.c ^RIHpV!4R#)r7#_reap_orphaned_desktop_local_servesN)hermes_cli.dashboard_procsrJrIs r,_reap_desktop_serves0_on_server_started.._reap_desktop_servess R+-r.cV^8dQhRR/#rZrN)r+s"r,r-rGs$$t$r.c ^RIHpV!4R#)r7reap_orphaned_mcp_helpersN)r#rQrPs r,_reap_mcp_helpers-_on_server_started.._reap_mcp_helperss I!#r.zorphan desktop-local serve reapzorphan MCP helper reaprN)DEFAULT_IDLE_GRACE_Sstart_idle_watchdogrssh_isolated_idle_grace_s)grace_s)start_code_skew_watchdog)start_owner_watchdog) lock_pathr)fallbackcV^8dQhRR/#rZrN)r+s"r,r-rGs+++r.c r<^RIHpHpT!S'dRMRRSRSRS;'gRRS/R 7V!4R #) r7) attach_self_to_kill_on_close_job register_selfserverrrrrr@)rN)r#r^r_)r^r_ actual_portr?rrBr@s r,_register_identity._on_server_started.._register_identitys<_G[D&+y/BWBWUWYcemn  )*r.zprocess-identity registrationzhost rendezvous publishc<\SS4#rB)r<)rarsr,rC$_on_server_started..s4LTS^4_r.zHERMES_BACKEND_READY port=zHERMES_DASHBOARD_READY port=z Hermes backend listening on :T)flush)format_url_hostu Hermes Web UI → http://)defer_background_mcp_discoveryzdashboard-mcp-discovery)logger thread_namedelayz!Deferred MCP discovery arm failedrWcV^8dQhRR/#rZrN)r+s"r,r-rGs>>4>r.cH^RIHpV!\P!44R#)r7install_loop_noise_filterN)tui_gateway.loop_noiserpryget_running_loopros r,_install_noise_filter1_on_server_started.._install_noise_filtersD!'":":"<=r.zloop noise filter installg@g@c(V^8dQhR\RR/#)r%expectedr'Nr)r+s"r,r-rGsOO%ODOr.c<SP4pW, pVS8d\PRV4SPSSVS,4R#)z1event loop stalled %.1fs (GIL pressure suspected)N)r)rZr[ call_later)rvr+drift _hb_interval_hb_loop_hb_stall_threshold_loop_heartbeats& r,r}+_on_server_started.._loop_heartbeatsDmmo & & LLLe TL/3;MNr.)'rrrrprnrqr rTrUrr rrrrhermes_cli.web_server_skew_exitrXr hermes_cli.web_server_owner_exitrYr bound_port serves_spar"r#printhermes_cli.url_utilsrhrhermes_cli.mcp_startuprirZ_DESKTOP_MCP_DISCOVERY_DELAY_SrYrhryrrrxr))serverrrr?r@rArBrCr=rLrRrTrUgracerXrYrbrhrirsrzr{r|r}ras&d$dd$d$$ @@@@@r,_on_server_startedrms,. $  !!68LM)+<=!"syy0$7C] );=,,[9??RDDE`bvwxE FCII$B$BERsyy0$7CG_GaGa M (syy0$7C ZjZj JVDTU"69K&CII ( ,.CD L'')HOO  ox}}7UV[:& )(E )f K JJ:TJ J Ks*.$J:J:K:KK"K98K9cvVP4pVeV\PJd\P#V#)uLoop factory for serve on Windows: always a selector loop. uvicorn 0.41's ``asyncio_loop_factory`` returns ProactorEventLoop on win32, on which uvicorn's socket stack binds-but-never-accepts (READY prints, then WinError 10014 accept failures, exit 1, desktop ECONNREFUSED — #120164, regression of #50641). A factory that already yields selector loops (older uvicorn, explicit ``--loop``) passes through. )get_loop_factoryryProactorEventLoopSelectorEventLoop)rrts& r,_windows_serve_loop_factoryr s5%%'G'W%>%>>((( Nr.c4V^8dQhR\R\RR/#r+r,)r+s"r,r-r-s!))C)s)t)r.c\Pp/p\PR8Xd^RIHpR\ V4/pV!V!43/VBR# \dR\Pp/p\P!\P!44LZ \dLhi;ii;i \dR#\dDpTP^8Xd-\Y#4'd\Y#4\\4RhhRp?ii;i)aDrive ``serve()`` on the loop uvicorn expects. POSIX keeps ``asyncio.run`` (already a SelectorEventLoop / uvloop). On Windows ``asyncio.run`` defaults to a ProactorEventLoop, on which uvicorn binds a socket that never accepts (#50641), so mirror uvicorn's own runner + loop factory there (hand-installed selector policy for uvicorn < 0.36). Ctrl+C -> clean return; probe-to-bind port race -> sentinel + exit code. win32) asyncio_run loop_factoryN)ryrunsysplatformuvicorn._compatrrrYset_event_loop_policyWindowsSelectorEventLoopPolicyKeyboardInterruptrcoderrr)r`rrrrunner runner_kwargsrSs&&&& r, _run_servers[[FM ||w  =+-H-PQM uw(-( [[FM --::<      88q=0<<  +23 = sLA B, B)+)B B%!B)$B%%B), D:DD>DDcV^8dQhR\R\R\R\R\R\R\R\\,R \\,R \R \\,/ #) r%rrrArrBr?r@rrrCr=rD)r+s"r,r-r-Fsx+x+ x+ x+x+ x+  x+  x+x+ }x+c]x+%)x+D>x+r.c 4aaaaaaa a aa\T;'gR4\V4^RIHp V !4^RIp ^RIHp V !4\SW7V4S\Pn \S;'gR4\Pn\!SS\#V4R7woo^RIHpV!4\)SS4'd\+SS4\-\.4h^R IHpV!4VVVVVVVVV V 3 R lp\7VSSS4R# \d!p\PRT4Rp?LRp?ii;i \d!p\PRT4Rp?LRp?ii;i \d\P5R R R 7Li;i)aStart the web UI server. ``initial_profile`` is appended to the auto-opened URL as ``?profile=`` (profile alias `` dashboard``). ``headless`` is the ``serve`` path: JSON-RPC/WS backend, no UI build, no SPA mount (``HERMES_SERVE_HEADLESS``). ``isolated`` (``--isolated``) is recorded in the spawn ledger so attach-first discovery never adopts this process. ``ssh_session_token``/``ssh_owner_nonce`` are process-local Desktop SSH bootstrap state, never persisted or exported to children; ``ssh_lock_path`` is the Desktop's ``backend.lock.json`` for that ownership slot (supersession watchdog). ``start_mcp_discovery_after_bind`` (Desktop ``serve``) defers MCP discovery until the ready sentinel is written so its SDK import can't hold the GIL against the pre-bind path. r)apply_nofile_soft_limitN)start_nous_auth_keepalivez%Nous auth keepalive did not start: %s)r)"install_exit_flush_signal_handlersz,exit-flush signal handlers not installed: %s)&activate_multi_profile_hosting_eagerlyz%eager multi-profile activation failedTrWc<< "SP'gSP4SPS4SnSP 4;_uu_4SP 4GRjxL SP 'd RRR4R#\SSSSSSSS S R7 S'd^RIH pV!RRR7SP4GRjxL SP'dSP4GRjxL RRR4R#LL:L +'giR#;i5i)N)rrr?r@rArBrCr=)record_process_ready serve_bootT) background) loadedloadlifespan_classrcapture_signalsstartup should_exitr/hermes_cli.observability.shared_metrics_startupr main_loopstartedshutdown) rrr?rrBr@rArrr=rCs r,_servestart_server.._serves}}} KKM //7  # # % %.." " "!!!& % !!) //M+ `$\dC""$ $ $~~~oo'''-& % "& %'-& % %slADD(D)D?D D ?D D D D3D4D8 DDDD D  D)rrhermes_cli.resource_limitsrr hermes_cli.nous_auth_keepaliverrYrZrhrrnrqrr)rBrr*tui_gateway.serverrrrrr!tui_gateway.launch_profile_policyrr[r)rrrArrBr?r@rrrCr=rr rrSrrrrrsfff&fff&&ff @@r, start_serverrFsX6.44"5?+CAL!#|P CII!$O$9$9r :CII*4DIZD[\NFF HI*,4&&D$'.//M\.0((:vvtT*] A :C@@A, H A3GGH0 M rs+    P@---H~$$++335 |CHH$HHOOAs<())4 776.&3Drzz2Q4 ,- .W[\dWeWlWloyWy"     DQ/l"%3 CEN,<,>,K,KVbcH*+C'( Y()/"&&7;;%)) 8 5$$( Y S *34I3J)KKXD2    W$$.i$$<)*;;$$, ? ? $) , , ^#$  (D%% (,$3 6 )&:_D3 ii 45!"#BII.F$LMaLLX"::LLU# :,)" 06tWd.KK;")$( TXW(u((\)-, 13RS,0/ $"8=''(;%%&'../>(()?))*=''(?))*?001#//0#334#112+223%334>(()%,,-$++,=''(#112>--.<&&';%%&;%%&>,,-#**+>(()=''($++,?))**112'../)001%,,- M)* #Rj3 l@*@*F0D3l[W%)[W| )Xx+x+w(   $e   ;22   9    ~ I"LLH *+" "s0a9bb$a//a??b/b98b9