Skip to content

docs: remote desktop connect uses username/password, not --insecure + session token - #38926

Merged
benbarclay merged 1 commit into
mainfrom
hermes/hermes-eea9d256
Jun 4, 2026
Merged

docs: remote desktop connect uses username/password, not --insecure + session token#38926
benbarclay merged 1 commit into
mainfrom
hermes/hermes-eea9d256

Conversation

@teknium1

@teknium1 teknium1 commented Jun 4, 2026

Copy link
Copy Markdown
Collaborator

Summary

The documented way to connect Hermes Desktop to a remote backend is now set a username and password, run hermes dashboard --host 0.0.0.0, and Sign in — replacing the old --insecure + pinned HERMES_DASHBOARD_SESSION_TOKEN path, which served an unauthenticated dashboard with a copy-pasted token.

The username/password dashboard-auth provider (shipped in #38819) and the desktop Sign-in flow (#38851) make this the real path; binding to a non-loopback address engages the auth gate and the basic provider handles login. No token to mint, copy, or paste.

Changes

  • user-guide/desktop.md — rewrote "Connecting to a remote backend": set HERMES_DASHBOARD_BASIC_AUTH_USERNAME/_PASSWORD (+ _SECRET for restart-stable sessions), run hermes dashboard --host 0.0.0.0, then Sign in in the app. New troubleshooting (401, missing Sign-in button, signed-out-on-restart). Noted the gateway must be running on the remote host.
  • user-guide/features/web-dashboard.md — rewrote both remote-backend sections (the close-code triage overview and the dedicated section) for the user/pass + Sign-in flow; renamed "OAuth Authentication (gated mode)" → "Authentication (gated mode)" and reframed --insecure as a discouraged escape hatch (:::danger) rather than a co-equal use case; dropped the now-removed --tui flag from the systemd example (feat(dashboard): always enable embedded chat; remove dashboard --tui flag #38591).
  • reference/environment-variables.md — lead with HERMES_DASHBOARD_BASIC_AUTH_*; dropped the HERMES_DASHBOARD_SESSION_TOKEN / HERMES_DESKTOP_REMOTE_TOKEN remote-connect entries; HERMES_DESKTOP_REMOTE_URL no longer claims a paired token.
  • user-guide/docker.md — present the username/password provider as the simplest way to satisfy the gate's provider requirement.

What's intentionally left: --insecure still appears as a documented escape hatch (the flag exists), and the verbatim fail-closed CLI error block is unchanged (it must match real output). Session-token references unrelated to the remote-desktop path (kanban internal token, local-dashboard scripting) are untouched.

Validation

Check Result
All file links + heading anchors in the 4 edited files resolve (scripted check; #authentication-gated-mode, #usernamepassword-provider-no-oauth-idp, #connecting-hermes-desktop-to-a-remote-backend all present)
Renamed-heading anchor (#oauth-authentication-gated-mode) referenced elsewhere none — no broken cross-page links
Auth-gate behavior matches code confirmed in hermes_cli/web_server.py: host != loopback AND NOT allow_public → gate engages (auth_required=True)

Docusaurus npm build not run (no node_modules in the dev checkout); links verified by script instead.

🤖 Generated with Hermes

Infographic

remote-desktop-password-auth

@teknium1
docs: remote desktop connect uses username/password, not --insecure +…
c8e8662 
… session token

The documented path for connecting Hermes Desktop to a remote backend was
`--insecure` + a pinned HERMES_DASHBOARD_SESSION_TOKEN — an unauthenticated
bind plus a copy-pasted token. Replace it everywhere with the bundled
username/password dashboard-auth provider: set HERMES_DASHBOARD_BASIC_AUTH_*,
run `hermes dashboard --host 0.0.0.0` (the non-loopback bind engages the auth
gate), and Sign in from the app.

- desktop.md: rewrite 'Connecting to a remote backend' for the user/pass + Sign in flow
- web-dashboard.md: rewrite both remote-backend sections (overview + dedicated);
  reframe the auth-gate section so --insecure is a discouraged escape hatch, not a
  co-equal use case; drop the removed --tui flag from the systemd example
- environment-variables.md: lead with HERMES_DASHBOARD_BASIC_AUTH_*; drop the
  session-token / HERMES_DESKTOP_REMOTE_TOKEN remote-connect entries
- docker.md: mention the username/password provider as the simplest gate provider
@alt-glitch alt-glitch added type/docs Documentation improvements P3 Low — cosmetic, nice to have comp/gateway Gateway runner, session dispatch, delivery area/auth Authentication, OAuth, credential pools labels Jun 4, 2026
@benbarclay
benbarclay merged commit c0435f4 into main Jun 4, 2026
10 checks passed
@benbarclay
benbarclay deleted the hermes/hermes-eea9d256 branch June 4, 2026 11:24
Yuki-14544869 pushed a commit to Yuki-14544869/hermes-agent that referenced this pull request Jun 4, 2026
@teknium1 @Yuki-14544869
docs: remote desktop connect uses username/password, not --insecure +…
cdf3652 
… session token (NousResearch#38926)

The documented path for connecting Hermes Desktop to a remote backend was
`--insecure` + a pinned HERMES_DASHBOARD_SESSION_TOKEN — an unauthenticated
bind plus a copy-pasted token. Replace it everywhere with the bundled
username/password dashboard-auth provider: set HERMES_DASHBOARD_BASIC_AUTH_*,
run `hermes dashboard --host 0.0.0.0` (the non-loopback bind engages the auth
gate), and Sign in from the app.

- desktop.md: rewrite 'Connecting to a remote backend' for the user/pass + Sign in flow
- web-dashboard.md: rewrite both remote-backend sections (overview + dedicated);
  reframe the auth-gate section so --insecure is a discouraged escape hatch, not a
  co-equal use case; drop the removed --tui flag from the systemd example
- environment-variables.md: lead with HERMES_DASHBOARD_BASIC_AUTH_*; drop the
  session-token / HERMES_DESKTOP_REMOTE_TOKEN remote-connect entries
- docker.md: mention the username/password provider as the simplest gate provider
davidgut1982 pushed a commit to davidgut1982/hermes-agent that referenced this pull request Jun 5, 2026
@teknium1
docs: remote desktop connect uses username/password, not --insecure +…
ed56551 
… session token (NousResearch#38926)

The documented path for connecting Hermes Desktop to a remote backend was
`--insecure` + a pinned HERMES_DASHBOARD_SESSION_TOKEN — an unauthenticated
bind plus a copy-pasted token. Replace it everywhere with the bundled
username/password dashboard-auth provider: set HERMES_DASHBOARD_BASIC_AUTH_*,
run `hermes dashboard --host 0.0.0.0` (the non-loopback bind engages the auth
gate), and Sign in from the app.

- desktop.md: rewrite 'Connecting to a remote backend' for the user/pass + Sign in flow
- web-dashboard.md: rewrite both remote-backend sections (overview + dedicated);
  reframe the auth-gate section so --insecure is a discouraged escape hatch, not a
  co-equal use case; drop the removed --tui flag from the systemd example
- environment-variables.md: lead with HERMES_DASHBOARD_BASIC_AUTH_*; drop the
  session-token / HERMES_DESKTOP_REMOTE_TOKEN remote-connect entries
- docker.md: mention the username/password provider as the simplest gate provider
Kyzcreig added a commit to ANG-Ventures/hermes-agent that referenced this pull request Jun 5, 2026
@Kyzcreig @teknium1 Aegis
feat(log): tag Turn-ended diag line with cron task id (task=) (#11)
a061c17 
* docs: remote desktop connect uses username/password, not --insecure + session token (NousResearch#38926)

The documented path for connecting Hermes Desktop to a remote backend was
`--insecure` + a pinned HERMES_DASHBOARD_SESSION_TOKEN — an unauthenticated
bind plus a copy-pasted token. Replace it everywhere with the bundled
username/password dashboard-auth provider: set HERMES_DASHBOARD_BASIC_AUTH_*,
run `hermes dashboard --host 0.0.0.0` (the non-loopback bind engages the auth
gate), and Sign in from the app.

- desktop.md: rewrite 'Connecting to a remote backend' for the user/pass + Sign in flow
- web-dashboard.md: rewrite both remote-backend sections (overview + dedicated);
  reframe the auth-gate section so --insecure is a discouraged escape hatch, not a
  co-equal use case; drop the removed --tui flag from the systemd example
- environment-variables.md: lead with HERMES_DASHBOARD_BASIC_AUTH_*; drop the
  session-token / HERMES_DESKTOP_REMOTE_TOKEN remote-connect entries
- docker.md: mention the username/password provider as the simplest gate provider

* fix(cli): clear screen on exit so live chrome isn't stranded in scrollback (NousResearch#38928)

The classic CLI left its live bottom chrome — the status bar, input box,
and separator rules — frozen in terminal scrollback after exit, on every
exit path (/exit, /quit, Ctrl+C, EOF) and on both Linux and Windows. The
prior erase_when_done=True fix (bf82a7f) routes prompt_toolkit's teardown
through renderer.erase(), but that walks back by the renderer's internal
cursor model and does not reliably wipe the chrome in practice — users still
saw a dead status bar + the rest of the session sitting above the resume
summary.

Clear the screen + scrollback directly at the single exit funnel instead.
All exit paths converge on _print_exit_summary() (called from the run-loop
finally block after app.run() returns and prompt_toolkit has restored
terminal modes), so a new _clear_terminal_on_exit() helper runs there before
the summary prints. It writes ESC[3J ESC[2J ESC[H (erase scrollback, erase
screen, home cursor) on a real TTY, no-ops silently when stdout is not a
terminal (pipes/redirects), and falls back to the platform clear command if
the escape write fails. Works on Linux, macOS, and modern Windows terminals
(Terminal/conhost with VT processing, already enabled by prompt_toolkit).

The resume/goodbye summary now prints at a clean top-left with nothing
stranded above it.

Fixes NousResearch#38252.

* feat(approval): env-gated reboot/shutdown downgrade (HERMES_ALLOW_REBOOT)

The reboot/shutdown family is on the unconditional hardline blocklist —
the correct default for most agents, but a hard blocker for fleet/ops
agents that legitimately need to restart the Linux hosts they manage.

Add an opt-in escape hatch: when HERMES_ALLOW_REBOOT is set truthy, the
reboot/shutdown family downgrades from HARDLINE to the DANGEROUS layer —
still approval-gated, and yolo / approvals.mode=off can pass it through.
Every other catastrophic pattern (root recursive delete, filesystem
format, raw-device overwrite, fork bomb, kill -1) stays unconditionally
hardline.

Default (flag unset) is byte-identical to the historical always-block
behavior. Verified: 129 tests pass including new downgrade and
isolation tests.

* feat(log): tag Turn-ended diag line with cron task id (task=)

The cron scheduler already threads the job id into the agent as task_id
(cron/scheduler.py -> run_conversation(task_id=...) -> effective_task_id).
Surface it in the per-turn 'Turn ended' diagnostic log as task=<id> so cron
turns can be attributed to their job. Enables model-fallback-check.py to detect
when a model-pinned cron silently ran on a fallback model, replacing an
unreliable time-window heuristic with exact job-id attribution.

Additive logging only — no control flow change. Both logger.info and the
'pending tool result' logger.warning branch share _diag_msg/_diag_args, so both
gain the field. Format-specifier/arg count kept in lockstep (guarded by test).

tests/agent/test_turn_ended_task_id_log.py: 3 contract tests (task= present,
specifiers==args, last arg is effective_task_id).

---------

Co-authored-by: Teknium <127238744+teknium1@users.noreply.github.com>
Co-authored-by: Kyzcreig <9063726+Kyzcreig@users.noreply.github.com>
Co-authored-by: Aegis <aegis@hermes.local>
Kyzcreig added a commit to ANG-Ventures/hermes-agent that referenced this pull request Jun 5, 2026
@Kyzcreig @teknium1
fix(blackbox): background_review fork inherits parent chat context (#12)
20e7fd2 
* docs: remote desktop connect uses username/password, not --insecure + session token (NousResearch#38926)

The documented path for connecting Hermes Desktop to a remote backend was
`--insecure` + a pinned HERMES_DASHBOARD_SESSION_TOKEN — an unauthenticated
bind plus a copy-pasted token. Replace it everywhere with the bundled
username/password dashboard-auth provider: set HERMES_DASHBOARD_BASIC_AUTH_*,
run `hermes dashboard --host 0.0.0.0` (the non-loopback bind engages the auth
gate), and Sign in from the app.

- desktop.md: rewrite 'Connecting to a remote backend' for the user/pass + Sign in flow
- web-dashboard.md: rewrite both remote-backend sections (overview + dedicated);
  reframe the auth-gate section so --insecure is a discouraged escape hatch, not a
  co-equal use case; drop the removed --tui flag from the systemd example
- environment-variables.md: lead with HERMES_DASHBOARD_BASIC_AUTH_*; drop the
  session-token / HERMES_DESKTOP_REMOTE_TOKEN remote-connect entries
- docker.md: mention the username/password provider as the simplest gate provider

* fix(cli): clear screen on exit so live chrome isn't stranded in scrollback (NousResearch#38928)

The classic CLI left its live bottom chrome — the status bar, input box,
and separator rules — frozen in terminal scrollback after exit, on every
exit path (/exit, /quit, Ctrl+C, EOF) and on both Linux and Windows. The
prior erase_when_done=True fix (bf82a7f) routes prompt_toolkit's teardown
through renderer.erase(), but that walks back by the renderer's internal
cursor model and does not reliably wipe the chrome in practice — users still
saw a dead status bar + the rest of the session sitting above the resume
summary.

Clear the screen + scrollback directly at the single exit funnel instead.
All exit paths converge on _print_exit_summary() (called from the run-loop
finally block after app.run() returns and prompt_toolkit has restored
terminal modes), so a new _clear_terminal_on_exit() helper runs there before
the summary prints. It writes ESC[3J ESC[2J ESC[H (erase scrollback, erase
screen, home cursor) on a real TTY, no-ops silently when stdout is not a
terminal (pipes/redirects), and falls back to the platform clear command if
the escape write fails. Works on Linux, macOS, and modern Windows terminals
(Terminal/conhost with VT processing, already enabled by prompt_toolkit).

The resume/goodbye summary now prints at a clean top-left with nothing
stranded above it.

Fixes NousResearch#38252.

* feat(approval): env-gated reboot/shutdown downgrade (HERMES_ALLOW_REBOOT)

The reboot/shutdown family is on the unconditional hardline blocklist —
the correct default for most agents, but a hard blocker for fleet/ops
agents that legitimately need to restart the Linux hosts they manage.

Add an opt-in escape hatch: when HERMES_ALLOW_REBOOT is set truthy, the
reboot/shutdown family downgrades from HARDLINE to the DANGEROUS layer —
still approval-gated, and yolo / approvals.mode=off can pass it through.
Every other catastrophic pattern (root recursive delete, filesystem
format, raw-device overwrite, fork bomb, kill -1) stays unconditionally
hardline.

Default (flag unset) is byte-identical to the historical always-block
behavior. Verified: 129 tests pass including new downgrade and
isolation tests.

* fix(blackbox): background_review fork inherits parent chat context

Memory/skill background-review forks constructed AIAgent with platform=
but no chat_id/chat_name/chat_type, so their blackbox telemetry rows landed
with empty chat fields and were un-attributable in /cost session.

Pass through parent's _chat_id/_chat_name/_chat_type (coerced to '') so
review-fork turns are attributed to the originating channel.

Regression test asserts the fork inherits all three chat fields.

---------

Co-authored-by: Teknium <127238744+teknium1@users.noreply.github.com>
Co-authored-by: Kyzcreig <9063726+Kyzcreig@users.noreply.github.com>
changman pushed a commit to changman/hermes-agent that referenced this pull request Jun 10, 2026
@teknium1 @changman
docs: remote desktop connect uses username/password, not --insecure +…
368a8cc 
… session token (NousResearch#38926)

The documented path for connecting Hermes Desktop to a remote backend was
`--insecure` + a pinned HERMES_DASHBOARD_SESSION_TOKEN — an unauthenticated
bind plus a copy-pasted token. Replace it everywhere with the bundled
username/password dashboard-auth provider: set HERMES_DASHBOARD_BASIC_AUTH_*,
run `hermes dashboard --host 0.0.0.0` (the non-loopback bind engages the auth
gate), and Sign in from the app.

- desktop.md: rewrite 'Connecting to a remote backend' for the user/pass + Sign in flow
- web-dashboard.md: rewrite both remote-backend sections (overview + dedicated);
  reframe the auth-gate section so --insecure is a discouraged escape hatch, not a
  co-equal use case; drop the removed --tui flag from the systemd example
- environment-variables.md: lead with HERMES_DASHBOARD_BASIC_AUTH_*; drop the
  session-token / HERMES_DESKTOP_REMOTE_TOKEN remote-connect entries
- docker.md: mention the username/password provider as the simplest gate provider
alt-glitch pushed a commit that referenced this pull request Jun 14, 2026
@teknium1
docs: remote desktop connect uses username/password, not --insecure +…
c32beeb 
… session token (#38926)

The documented path for connecting Hermes Desktop to a remote backend was
`--insecure` + a pinned HERMES_DASHBOARD_SESSION_TOKEN — an unauthenticated
bind plus a copy-pasted token. Replace it everywhere with the bundled
username/password dashboard-auth provider: set HERMES_DASHBOARD_BASIC_AUTH_*,
run `hermes dashboard --host 0.0.0.0` (the non-loopback bind engages the auth
gate), and Sign in from the app.

- desktop.md: rewrite 'Connecting to a remote backend' for the user/pass + Sign in flow
- web-dashboard.md: rewrite both remote-backend sections (overview + dedicated);
  reframe the auth-gate section so --insecure is a discouraged escape hatch, not a
  co-equal use case; drop the removed --tui flag from the systemd example
- environment-variables.md: lead with HERMES_DASHBOARD_BASIC_AUTH_*; drop the
  session-token / HERMES_DESKTOP_REMOTE_TOKEN remote-connect entries
- docker.md: mention the username/password provider as the simplest gate provider
kossteg pushed a commit to kossteg/hermes-agent that referenced this pull request Jun 16, 2026
@teknium1 @kossteg
docs: remote desktop connect uses username/password, not --insecure +…
62fa298 
… session token (NousResearch#38926)

The documented path for connecting Hermes Desktop to a remote backend was
`--insecure` + a pinned HERMES_DASHBOARD_SESSION_TOKEN — an unauthenticated
bind plus a copy-pasted token. Replace it everywhere with the bundled
username/password dashboard-auth provider: set HERMES_DASHBOARD_BASIC_AUTH_*,
run `hermes dashboard --host 0.0.0.0` (the non-loopback bind engages the auth
gate), and Sign in from the app.

- desktop.md: rewrite 'Connecting to a remote backend' for the user/pass + Sign in flow
- web-dashboard.md: rewrite both remote-backend sections (overview + dedicated);
  reframe the auth-gate section so --insecure is a discouraged escape hatch, not a
  co-equal use case; drop the removed --tui flag from the systemd example
- environment-variables.md: lead with HERMES_DASHBOARD_BASIC_AUTH_*; drop the
  session-token / HERMES_DESKTOP_REMOTE_TOKEN remote-connect entries
- docker.md: mention the username/password provider as the simplest gate provider
T02200059 pushed a commit to T02200059/hermes-agent that referenced this pull request Jun 18, 2026
@teknium1
docs: remote desktop connect uses username/password, not --insecure +…
679a88d 
… session token (NousResearch#38926)

The documented path for connecting Hermes Desktop to a remote backend was
`--insecure` + a pinned HERMES_DASHBOARD_SESSION_TOKEN — an unauthenticated
bind plus a copy-pasted token. Replace it everywhere with the bundled
username/password dashboard-auth provider: set HERMES_DASHBOARD_BASIC_AUTH_*,
run `hermes dashboard --host 0.0.0.0` (the non-loopback bind engages the auth
gate), and Sign in from the app.

- desktop.md: rewrite 'Connecting to a remote backend' for the user/pass + Sign in flow
- web-dashboard.md: rewrite both remote-backend sections (overview + dedicated);
  reframe the auth-gate section so --insecure is a discouraged escape hatch, not a
  co-equal use case; drop the removed --tui flag from the systemd example
- environment-variables.md: lead with HERMES_DASHBOARD_BASIC_AUTH_*; drop the
  session-token / HERMES_DESKTOP_REMOTE_TOKEN remote-connect entries
- docker.md: mention the username/password provider as the simplest gate provider
waefrebeorn pushed a commit to waefrebeorn/slermes that referenced this pull request Jul 2, 2026
@teknium1
docs: remote desktop connect uses username/password, not --insecure +…
82cf585 
… session token (NousResearch#38926)

The documented path for connecting Hermes Desktop to a remote backend was
`--insecure` + a pinned HERMES_DASHBOARD_SESSION_TOKEN — an unauthenticated
bind plus a copy-pasted token. Replace it everywhere with the bundled
username/password dashboard-auth provider: set HERMES_DASHBOARD_BASIC_AUTH_*,
run `hermes dashboard --host 0.0.0.0` (the non-loopback bind engages the auth
gate), and Sign in from the app.

- desktop.md: rewrite 'Connecting to a remote backend' for the user/pass + Sign in flow
- web-dashboard.md: rewrite both remote-backend sections (overview + dedicated);
  reframe the auth-gate section so --insecure is a discouraged escape hatch, not a
  co-equal use case; drop the removed --tui flag from the systemd example
- environment-variables.md: lead with HERMES_DASHBOARD_BASIC_AUTH_*; drop the
  session-token / HERMES_DESKTOP_REMOTE_TOKEN remote-connect entries
- docker.md: mention the username/password provider as the simplest gate provider
santhreal pushed a commit to santhreal/hermes-agent that referenced this pull request Jul 13, 2026
@teknium1
docs: remote desktop connect uses username/password, not --insecure +…
4fbaf93 
… session token (NousResearch#38926)

The documented path for connecting Hermes Desktop to a remote backend was
`--insecure` + a pinned HERMES_DASHBOARD_SESSION_TOKEN — an unauthenticated
bind plus a copy-pasted token. Replace it everywhere with the bundled
username/password dashboard-auth provider: set HERMES_DASHBOARD_BASIC_AUTH_*,
run `hermes dashboard --host 0.0.0.0` (the non-loopback bind engages the auth
gate), and Sign in from the app.

- desktop.md: rewrite 'Connecting to a remote backend' for the user/pass + Sign in flow
- web-dashboard.md: rewrite both remote-backend sections (overview + dedicated);
  reframe the auth-gate section so --insecure is a discouraged escape hatch, not a
  co-equal use case; drop the removed --tui flag from the systemd example
- environment-variables.md: lead with HERMES_DASHBOARD_BASIC_AUTH_*; drop the
  session-token / HERMES_DESKTOP_REMOTE_TOKEN remote-connect entries
- docker.md: mention the username/password provider as the simplest gate provider
donbowman pushed a commit to donbowman/hermes-agent that referenced this pull request Jul 13, 2026
@teknium1 @donbowman
docs: remote desktop connect uses username/password, not --insecure +…
eb929f8 
… session token (NousResearch#38926)

The documented path for connecting Hermes Desktop to a remote backend was
`--insecure` + a pinned HERMES_DASHBOARD_SESSION_TOKEN — an unauthenticated
bind plus a copy-pasted token. Replace it everywhere with the bundled
username/password dashboard-auth provider: set HERMES_DASHBOARD_BASIC_AUTH_*,
run `hermes dashboard --host 0.0.0.0` (the non-loopback bind engages the auth
gate), and Sign in from the app.

- desktop.md: rewrite 'Connecting to a remote backend' for the user/pass + Sign in flow
- web-dashboard.md: rewrite both remote-backend sections (overview + dedicated);
  reframe the auth-gate section so --insecure is a discouraged escape hatch, not a
  co-equal use case; drop the removed --tui flag from the systemd example
- environment-variables.md: lead with HERMES_DASHBOARD_BASIC_AUTH_*; drop the
  session-token / HERMES_DESKTOP_REMOTE_TOKEN remote-connect entries
- docker.md: mention the username/password provider as the simplest gate provider
Gravezzz pushed a commit to Gravezzz/hermes-agent that referenced this pull request Jul 21, 2026
@teknium1
docs: remote desktop connect uses username/password, not --insecure +…
b830d1c 
… session token (NousResearch#38926)

The documented path for connecting Hermes Desktop to a remote backend was
`--insecure` + a pinned HERMES_DASHBOARD_SESSION_TOKEN — an unauthenticated
bind plus a copy-pasted token. Replace it everywhere with the bundled
username/password dashboard-auth provider: set HERMES_DASHBOARD_BASIC_AUTH_*,
run `hermes dashboard --host 0.0.0.0` (the non-loopback bind engages the auth
gate), and Sign in from the app.

- desktop.md: rewrite 'Connecting to a remote backend' for the user/pass + Sign in flow
- web-dashboard.md: rewrite both remote-backend sections (overview + dedicated);
  reframe the auth-gate section so --insecure is a discouraged escape hatch, not a
  co-equal use case; drop the removed --tui flag from the systemd example
- environment-variables.md: lead with HERMES_DASHBOARD_BASIC_AUTH_*; drop the
  session-token / HERMES_DESKTOP_REMOTE_TOKEN remote-connect entries
- docker.md: mention the username/password provider as the simplest gate provider
@zhenheco zhenheco mentioned this pull request Jul 21, 2026
Closed
leewenjie pushed a commit to leewenjie/hermes-agent that referenced this pull request Aug 7, 2026
@teknium1
docs: remote desktop connect uses username/password, not --insecure +…
2b710c4 
… session token (NousResearch#38926)

The documented path for connecting Hermes Desktop to a remote backend was
`--insecure` + a pinned HERMES_DASHBOARD_SESSION_TOKEN — an unauthenticated
bind plus a copy-pasted token. Replace it everywhere with the bundled
username/password dashboard-auth provider: set HERMES_DASHBOARD_BASIC_AUTH_*,
run `hermes dashboard --host 0.0.0.0` (the non-loopback bind engages the auth
gate), and Sign in from the app.

- desktop.md: rewrite 'Connecting to a remote backend' for the user/pass + Sign in flow
- web-dashboard.md: rewrite both remote-backend sections (overview + dedicated);
  reframe the auth-gate section so --insecure is a discouraged escape hatch, not a
  co-equal use case; drop the removed --tui flag from the systemd example
- environment-variables.md: lead with HERMES_DASHBOARD_BASIC_AUTH_*; drop the
  session-token / HERMES_DESKTOP_REMOTE_TOKEN remote-connect entries
- docker.md: mention the username/password provider as the simplest gate provider
@ether-btc ether-btc mentioned this pull request Aug 29, 2026
Open
melon-xf added a commit to melon-xf/hermes-agent that referenced this pull request Sep 3, 2026
@melon-xf
docs: remote desktop connect uses username/password, not --insecure +…
c5b58bb 
… session token (NousResearch#38926)

The documented path for connecting Hermes Desktop to a remote backend was
`--insecure` + a pinned HERMES_DASHBOARD_SESSION_TOKEN — an unauthenticated
bind plus a copy-pasted token. Replace it everywhere with the bundled
username/password dashboard-auth provider: set HERMES_DASHBOARD_BASIC_AUTH_*,
run `hermes dashboard --host 0.0.0.0` (the non-loopback bind engages the auth
gate), and Sign in from the app.

- desktop.md: rewrite 'Connecting to a remote backend' for the user/pass + Sign in flow
- web-dashboard.md: rewrite both remote-backend sections (overview + dedicated);
  reframe the auth-gate section so --insecure is a discouraged escape hatch, not a
  co-equal use case; drop the removed --tui flag from the systemd example
- environment-variables.md: lead with HERMES_DASHBOARD_BASIC_AUTH_*; drop the
  session-token / HERMES_DESKTOP_REMOTE_TOKEN remote-connect entries
- docker.md: mention the username/password provider as the simplest gate provider
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area/auth Authentication, OAuth, credential pools comp/gateway Gateway runner, session dispatch, delivery P3 Low — cosmetic, nice to have type/docs Documentation improvements

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@teknium1 @benbarclay @alt-glitch