Cairn
NousResearch/hermes-agent

Dashboard auth URLs and X-Forwarded-Prefix handling behind subpath proxies

Cluster 118056 · dashboard. Data as of

Nothing open on GitHub. Fix merged in #133903 on 6 Oct 2026. Check it covers your case.

The short answer

0open issues
0open PRs
3items grouped
Known?
Yes. 3 related items grouped here, 1 issue already closed.
Fix event
A fix was merged to main in PR #133903. Check it covers your case. No release data is tracked.
Tracker
The maintainers' tracker marks this unresolved. That is separate from the fix event.
Still open
Nothing open on GitHub.

All three members concern the dashboard login page not honoring X-Forwarded-Prefix when served behind a reverse proxy subpath, with a PKCE cookie Path mismatch affecting /auth/password-login and native/Desktop sign-in. Two are fix-style titles and one describes the problem; their current status is not stated here.

Open issues0

No open issues.

Open PRs0

No open pull requests.

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

  • #133903 fix(dashboard): auth URLs honour X-Forwarded-Prefix behind reverse-proxy subpath

    merged to main

    files: hermes_cli/dashboard_auth/login_page.py, hermes_cli/dashboard_auth/middleware.py, hermes_cli/dashboard_auth/routes.py, tests/hermes_cli/test_dashboard_auth_401_reauth.py, tests/hermes_cli/test_dashboard_auth_prefix.py, web/src/lib/api.ts

1 PR closed without merging

From the close comments: done elsewhere 1

  • #118058 fix(dashboard-auth): build login-page URLs from X-Forwarded-Prefix so the PKCE cookie reaches /auth/password-login · done elsewhere → 354ad3d, #133903, #118055, #118056
Closed issues · 1
  • Closed#118056Dashboard login page ignores X-Forwarded-Prefix: PKCE cookie Path mismatch dead-ends native/Desktop sign-in
How this cluster was grouped
  • Link evidence (structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
  • Pairwise link density 0.67: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
dashboard
Merged PRs
#133903
Closed issues
1
Attempts
1 PR closed without merging
Fix link checked
6 Oct 2026

For your agent

The same facts, typed.

cluster/118056.json
cluster/118056.md