+ WjKRt^RIHt^RIt^RIHtHt^RIHtRt Rt Rt RR R R /R R llt R Rlt R R /RRlltR R /RRlltR#)a Server-rendered /login page (no React, no SPA bundle, no injected token). Providers come from the registry; an OAuth provider renders an anchor to ``/auth/login?provider=``, a ``supports_password`` provider renders a credential form wired by :data:`_PASSWORD_FORM_SCRIPT`. Styling mirrors the ``@nous-research/ui`` design system; fonts load from the SPA's ``/fonts/`` mount, which the gate allowlists pre-auth. The ``class="provider-btn"`` anchor is test-stable: the suite extracts its href to walk the OAuth flow. ) annotationsN)quote urlencode)list_session_providersu Sign in — Hermes Agent
NousResearch

Sign in

Choose a sign-in method to continue to the Hermes Agent dashboard.

{provider_buttons}
Public bind · Auth required
{password_script} u Sign-in unavailable — Hermes Agent

Sign-in unavailable

This dashboard is bound to a non-loopback host but no authentication providers are available.

Configure the bundled username/password provider or an OAuth provider. See the dashboard authentication documentation for setup instructions.

For auth-free local use, bind to 127.0.0.1 and connect through an SSH tunnel or Tailscale.

aE next_pathprefixc$V^8dQhRRRRRR/#rstrrreturn)formats"XC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\dashboard_auth\login_page.py __annotate__rs!$1$1C$1c$13$1c x\4pV'g\#V'd'R\P!\ VRR7RR7 2MRpVUu.uFop\ VRR4'd\ W@VR7MKR V R \P!VPRR7 V R \P!VP4 R 2NKq pp\;QJdR V4F 'gK RM RM !R V44p\PRPV4V'd\MRR7p\Wq4#uupi)uReturn the full HTML for ``GET /login``. ``next_path`` is threaded into each provider button/form so the OAuth round trip carries it end-to-end. The caller validates it same-origin; it is HTML-escaped here as defence in depth. ``prefix`` — when set, the path prefix from ``X-Forwarded-Prefix`` (e.g. ``"/hermes"``). Prepended to all auth URLs so the login page works behind a reverse proxy that mounts the dashboard at a sub-path. Empty string (default) means no prefix — bare-root deploys are unaffected. z&next=r)safeTrsupports_passwordF)r$ Sign in with c3<"TFp\VRR4xK R#5i)rFN)getattr).0ps& r $render_login_html..sZPY1+> F FPYs provider_buttonspassword_script)r _EMPTY_HTMLhtmlescaperr_render_password_formname display_nameany_LOGIN_HTML_TEMPLATErjoin_PASSWORD_FORM_SCRIPT_apply_proxy_prefix)rr providersnext_qsrbuttonsneeds_password_scripthtml_outs$$ rrender_login_htmlr4s&'(I PYt{{5#`` gains ``data-prefix`` so the password-login JS (a plain string, never ``str.format``-aware) can prepend the prefix to its fetch target and post-login landing. * ``@font-face`` ``url('/fonts/...')`` becomes ``url('/fonts/...')`` so the fonts load from the mount instead of the origin root (404 behind a prefix-stripping proxy). z
z
z url('/fonts/zurl('z/fonts/)replace)r3rs&&rr.r.sJ ,?xr*JANH%xw0GHH Orc4V^8dQhRRRRRRRRRRRRRR/#) r authorize_pathr code_challengecode_challenge_method redirect_uristaterr r)rs"rrrsH&);>"25>A!rc RVRVRVRV/p.pVFop \P!V R\/VCRV P/C4 2RR7p VP R V R \P!V P 4 R 24Kq V'g\ #\\PR PV4R R7V4#)aProvider picker for a native authorize request with more than one interactive provider. Every link re-enters ``/auth/native/authorize`` with the SAME desktop PKCE inputs plus an explicit ``provider``, so the choice never leaves the validated native flow. ``prefix`` (from ``X-Forwarded-Prefix``) rewrites the template's font URLs so the page works behind a reverse-proxy sub-path; the buttons' ``authorize_path`` is already prefixed by the caller. r:r;r<r=?providerTrrrrr rr!) r%r&rr(appendr)r$r.r+rr,) r/r9r:r;r<r=rcommonr1rhrefs $$$$$$$ r"render_native_provider_choice_htmlrDs0GI^lGU>'B&C4I J  ##!YYw/ $ E rc$V^8dQhRRRRRR/#r r)rs"rrrs!!!s!s!C!rc\P!VPRR7p\P!VP4pV'd\P!VRR7MRpRV RV RV R2#)uUsername/password form for a ``supports_password`` provider. ``next_path`` rides in a hidden field (already validated by the caller, HTML-escaped here). The provider name is a ``data-`` attribute so the script does not depend on field ordering. ``prefix`` — reverse-proxy path prefix (e.g. ``"/hermes"``); kept for interface parity with the other renderers (the submit handler reads the prefix from ``
``). Trrz1
Sign in with z7
)r%r&r(r))r@rrpnameplabel safe_nexts&&$ rr'r'sm KK T 2E [[.. /F6? IT2RI ;E7C88>x@;;D+F r)__doc__ __future__rr% urllib.parserrhermes_cli.dashboard_authrr+r$r-r4r.rDr'rrrrNsm # )<]~R |-`$1"$1B$1N(6!R!!r