# NousResearch/hermes-agent · Dashboard basic auth silent lockout bug and fixes

## Open now

- 1 issue, 2 PRs open on GitHub.
- #110069: \[Bug\]: dashboard.basic_auth accepts a malformed password_hash and an empty password — silent lockout
- PR #110077: fix(cli): reject dashboard.basic_auth writes that silently lock out the dashboard
- PR #110114: fix(dashboard-auth): reject malformed scrypt password_hash instead of silent lockout

A bug where malformed or empty scrypt password hashes are silently accepted, locking users out of the dashboard. The group includes the bug report and two fix attempts targeting CLI and dashboard auth validation.

## TL;DR

- 3 member(s): 1 open issue(s), 0 closed issue(s), 2 open PR(s), 0 merged PR(s), 0 PR(s) closed without merging.
- No fix has been merged to main; one or more PRs were attempted (see below).
- **Recommended:** review the prior/competing PR(s) below. A fix was attempted but not merged; your case may extend or revive that work.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `unresolved`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`STRUCTURAL_SPANNING`): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
- Pairwise link density `0.67`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Open related issues

- #110069: \[Bug\]: dashboard.basic_auth accepts a malformed password_hash and an empty password — silent lockout

## Prior & competing PRs

- **#110077: fix(cli): reject dashboard.basic_auth writes that silently lock out the dashboard**. open
  - maintainer direction: category `silent_close`; implication `active`
  - files: `hermes_cli/config.py`, `tests/hermes_cli/test_config_set_dashboard_basic_auth.py`
- **#110114: fix(dashboard-auth): reject malformed scrypt password_hash instead of silent lockout**. open
  - maintainer direction: category `duplicate_of`; implication `duplicate`; refs `#110092`, `#110077`, `#110069`
  - files: `plugins/dashboard_auth/basic/__init__.py`, `tests/plugins/dashboard_auth/test_basic_provider.py`

## Fix status

- No merged fix on record.
- Subsystem: `dashboard`