hermes - 💡(How to fix) Fix [Bug]: Gated mode - Dashbaord not loading available plugins [2 pull requests]

Bug Description

When you setup the Dashboard with a DashboardAuthProvider, the Plugins page is not loading discovered plugins.

Steps to Reproduce

1. Configure Nous DashboardAuthProvider or a custom one according to the documentation in Gated mode
2. Start the gateway with dashboard
3. Log-in the dashboard at /login
4. Go to the dashboard page /plugins

Expected Behavior

Plugin page loads properly all available plugins as it should like in insecure mode.

Actual Behavior

1. Plugins page show the message: Installed plugins, No results
2. The error from the endpoint "/api/dashboard/plugins/hub" is 401 and response: {"detail":"Unauthorized"}

Affected Component

Gateway (Telegram/Discord/Slack/WhatsApp)

Messaging Platform (if gateway-related)

N/A (CLI only)

Debug Report

N/A

Operating System

Podman

Python Version

No response

Hermes Version

v0.15.1

Additional Logs / Traceback (optional)

Root Cause Analysis (optional)

The issue seems to be here: https://github.com/NousResearch/hermes-agent/blob/5921d667855880b0aa2083a50f001748aed52f3e/hermes_cli/web_server.py#L149

Some Dashboard endpoints check if a session token is passed by the HTTP Header X-Hermes-Session-Token. However, in Gated mode, the session token is never passed to the client side according to that logic : https://github.com/NousResearch/hermes-agent/blob/5921d667855880b0aa2083a50f001748aed52f3e/hermes_cli/web_server.py#L3871

Proposed Fix (optional)

the method _require_token should implement a check if the current request already passed the auth through the auth middleware.

Something like so would fix the issue:

def _require_token(request: Request) -> None:
    """Validate the ephemeral session token.  Raises 401 on mismatch.

    In OAuth gated mode (``app.state.auth_required is True``) the cookie-based
    gate in ``gated_auth_middleware`` is authoritative — it already verified
    the session before we reach this point, so skip the legacy token check.
    """
    if getattr(request.app.state, "auth_required", False):
        return
    if not _has_valid_session_token(request):
        raise HTTPException(status_code=401, detail="Unauthorized")

Are you willing to submit a PR for this?

• I'd like to fix this myself and submit a PR