{"repo":"NousResearch/hermes-agent","public_id":"93026","display_label":"Dashboard auth bypass when reverse proxy declared","summary":"These items address a scenario where dashboards bound to loopback addresses remain unauthenticated when a public URL is declared, because the auth check does not account for the operator-configured public URL. The members propose or discuss engaging the authentication gate in that case.","subsystem":null,"counts":{"members":5,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":3,"attempt_prs":1},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":93456,"merged_at":"2026-08-24T02:55:18+00:00"},"resolution":{"state":"resolved","by":"pr-93456"},"freshness":{"state":"verified","last_verified_at":"2026-08-24T02:55:18+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.4},"fix_edges":[{"issue_number":93017,"pr_number":93398,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-08-24T01:27:23+00:00"},{"issue_number":93022,"pr_number":93394,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-08-24T01:27:08+00:00"},{"issue_number":93026,"pr_number":93394,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false,"pr_merged_at":"2026-08-24T01:27:08+00:00"},{"issue_number":93026,"pr_number":93398,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false,"pr_merged_at":"2026-08-24T01:27:23+00:00"},{"issue_number":93026,"pr_number":93456,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-08-24T02:55:18+00:00"}],"members":[{"kind":"issue","number":93026,"title":"should_require_auth() ignores the operator-declared public_url, leaving loopback-bound dashboards behind a reverse proxy unauthenticated","url":null,"state":"closed"},{"kind":"pr","number":93097,"title":"fix(dashboard): engage the auth gate when a public URL is declared on a loopback bind","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"fdff700dc","number":0},{"kind":"pr","value":"#72127","number":72127},{"kind":"pr","value":"#93026","number":93026},{"kind":"pr","value":"#93456","number":93456},{"kind":"pr","value":"#93394","number":93394},{"kind":"pr","value":"#93395","number":93395},{"kind":"pr","value":"#93398","number":93398}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":93394,"title":"Short sessions no longer permanently disable auto-compaction (#93022, salvage #93093)","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["agent/context_compressor.py","contributors/emails/[redacted:email]","tests/agent/test_compaction_anti_thrash.py","tests/agent/test_compression_anti_thrash_persistence.py","tests/agent/test_context_compressor_structural_backoff.py","tests/agent/test_context_compressor_summary_continuity.py","tests/run_agent/test_infinite_compaction_loop.py"]},{"kind":"pr","number":93398,"title":"install.ps1 no longer crashes at line 367 under StrictMode (#93017, salvage #93020)","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["scripts/install.ps1","tests/test_install_ps1_resolver_strictmode.py"]},{"kind":"pr","number":93456,"title":"Loopback dashboards behind a declared reverse proxy are no longer unauthenticated (#93026, salvage #72127)","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["contributors/emails/e-macgregor@users.noreply.github.com","hermes_cli/config_defaults.py","hermes_cli/main.py","hermes_cli/web_server.py","tests/hermes_cli/test_dashboard_auth_gate.py","tests/hermes_cli/test_dashboard_unified_launch.py","tests/hermes_cli/test_web_server_host_header.py","website/docs/reference/environment-variables.md","website/docs/user-guide/features/web-dashboard.md"]}],"trust":{"default_tier":"verified","includes_suggested":false}}