mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-11-06 05:17:15 +00:00
unsupportedpastels
01888fc206
On the gateway's Webapp behind the sign-in gate, a provider token worked on its own (bearer header, socket ?token=) only when this listener gave it to a native app's sign-in. The deployment session token (HERMES_DASHBOARD_SESSION_TOKEN, literal or file:<path>) that the bundled session-token provider vouches for was therefore refused with 401 / close 4401, although the docs promise it authorizes the gated listener. The bearer, peek_session and socket ?token= checks now call access_token_works_alone: token_works_alone (looked up at call time) or the token the registered session-token provider read at startup, compared in constant time by the provider's matches_token, which its verify_session also uses. With the provider not registered (dashboard.session_token_auth enabled: false) the token is refused as on main. token_works_alone and the refresh route are unchanged from main: the deployment token has no refresh.