feat(dashboard): log HTTP access + WebSocket lifecycle to the gui surface

[kshitijk4poor]

Summary

The messaging gateway logs every inbound message to gateway.log, but its dashboard/TUI twin (gui.log) was nearly silent. The dashboard FastAPI app had host-header / auth-gate / auth middlewares but no access log, and 3 of 4 WebSocket endpoints logged nothing at all.

The worst case: /api/pty logged pty accepted on connect but was completely silent on close — a PTY EOF (backend crash), a send failure, or a client drop left no trace. So the common user reports ("chat disconnected", "TUI froze", "dashboard hung") were unreproducible: nothing landed in gui.log from the surface that broke.

This extends the convention tui_gateway/ws.py::handle_ws already establishes — a structured ws closed peer=… reason=… <counters> line — across the whole dashboard surface, at the same INFO granularity as gateway.log, into the gui.log already sized for it (10MB×5). Pairs with #48981 (which made gui.log shareable via hermes debug share).

Changes (hermes_cli/web_server.py)

• HTTP access-log middleware, registered LIFO-outermost so it captures the final status code (including 400/401 produced by the middlewares above it). One INFO line per request: http method=… path=… status=… dur_ms=… rid=… peer=….
  • Path only — never the query string (tokens ride in query on some routes).
  • UA/referer at DEBUG (-v) only.
  • Reads an inbound X-Request-ID (proxy/SPA) or mints one, and echoes it on the response for client-side correlation.
• /api/pty: structured close line across all exit paths — client_disconnect | pty_eof | send_failed | error — with dur_s and bytes_in/out counters.
• /api/pub + /api/events: accept + structured close (reason/duration/frames) + all reject paths (were silent end-to-end).
• /api/ws: reject paths logged (were bare close(code)); request id threaded into handle_ws.

tui_gateway/ws.py

handle_ws gains an optional rid=None arg, stamped on its existing accept/close lines so a WS session correlates with the HTTP upgrade that opened it. Backward-compatible with the stdio entry-point (tui_gateway.entry), which calls handle_ws(ws).

Scope / privacy

Metadata only — no request/response bodies, no WS frame payloads, no headers/cookies on the INFO lines. Opt-in body capture is deliberately a separate change so this stays clear of the debug share privacy surface (#22016).

Verbosity

Matches the house convention: everything at INFO to gui.log (the gateway.log granularity), noisier fields at DEBUG behind the existing global -v. No new verbosity knob.

Test plan

• pytest tests/hermes_cli/test_web_server.py tests/test_tui_gateway_ws.py — 310 passed
• 8 new tests, behavior-contract style (assert field shape, not frozen strings):
  • HTTP: access-line fields + X-Request-ID round-trip + query-string redaction + inbound-rid propagation + 401-is-still-logged (proves outermost ordering)
  • WS: /api/pub + /api/events accept/close lines; reject logging
  • tui_gateway: rid stamped on accept/close; rid=None default preserved
• Live E2E under TestClient: confirmed events accepted … / events closed peer=… reason=client_disconnect dur_s=… actually fire
• Note: the 3 TestPtyWebSocket round-trip tests fail identically on clean main in a sandboxed runner (need a real TTY) — pre-existing, not introduced here (stash-verified against main).

Follow-up (separate PR)

Opt-in request/response body capture behind a config.yaml gate + hermes tools toggle, structurally excluded from debug share. Tracked separately so the gating is done right.

[github-actions]

🔎 Lint report: feat/dashboard-ws-http-observability vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 11063 on HEAD, 11056 on base (🆕 +7)

🆕 New issues (3):

Rule	Count
unresolved-attribute	2
unsupported-operator	1

First entries

run_agent.py:2971: [unresolved-attribute] unresolved-attribute: Object of type `Self@get_credits_spent_micros` has no attribute `_credits_session_start_micros`
hermes_cli/web_server.py:11203: [unsupported-operator] unsupported-operator: Operator `+=` is not supported between objects of type `str` and `int`
tests/run_agent/test_credits_notices_toggle.py:76: [unresolved-attribute] unresolved-attribute: Unresolved attribute `_credits_session_start_micros` on type `AIAgent`

✅ Fixed issues (1):

Rule	Count
invalid-assignment	1

First entries

tests/run_agent/test_credits_notices_toggle.py:76: [invalid-assignment] invalid-assignment: Object of type `None` is not assignable to attribute `_credits_session_start_micros` of type `int`

Unchanged: 5786 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.