hermes - 💡(How to fix) Fix Dashboard SPA reload loop on /api/auth/me when running with --insecure (no OAuth provider)

Bug

When running hermes dashboard --insecure (without an OAuth auth provider), the SPA enters an infinite reload/redirect loop on certain tabs (e.g. Sessions).

Root cause

The endpoint GET /api/auth/me in dashboard_auth/routes.py always checks request.state.session, which is None when the auth gate is not engaged (insecure mode, auth_required=False on app.state). It returns HTTP 401, which causes the SPA to attempt a redirect to /login. Since no OAuth provider is configured, the login page cannot complete the auth round-trip, resulting in an infinite redirect → reload cycle.

Reproduction

1. Start the dashboard without an OAuth provider:

   hermes dashboard --host 0.0.0.0 --port 9119 --insecure

2. Open the dashboard in a browser.
3. Navigate to Config, change the web theme and save.
4. Reload the page (Ctrl+R).
5. The page enters an infinite reload/flicker loop (sessions page).

DevTools evidence

GET http://mini:1414/api/auth/me 401 (Unauthorized)

This error repeats infinitely in the console until Escape is pressed twice to stop the reload loop.

Suggested fix

In hermes_cli/dashboard_auth/routes.py, the api_auth_me handler should check request.app.state.auth_required first. When the auth gate is not active (insecure mode), return a 200 with an anonymous local session instead of raising 401:

if not getattr(request.app.state, "auth_required", False):
    return {
        "user_id": "local",
        "email": "",
        "display_name": "Local User",
        "org_id": None,
        "provider": None,
        "expires_at": None,
    }

This prevents the SPA from entering the 401→login redirect loop when no OAuth provider is configured.

Environment

• Hermes Agent version: latest 0.15.0 (pip install, 2026-05-29)
• OS: AlmaLinux 9.7
• Binding: --host 0.0.0.0 --insecure