PR #15736: feat(cli): add --insecure-chat flag for non-loopback WS chat clients

• Repository: NousResearch/hermes-agent
• Author: qpilotwave
• State: open | merged: False
• Link: https://github.com/NousResearch/hermes-agent/pull/15736

Description (problem / solution / changelog)

What does this PR do?

The embedded TUI Chat tab (hermes dashboard --tui) rejects WebSocket connections from non-loopback IPs to prevent unauthorized remote access to the PTY. This is correct for localhost-only use, but blocks usage over Tailscale, VPNs, or LAN when the dashboard is intentionally bound to a non-loopback address with --insecure.

Add --insecure-chat which, when combined with --tui, skips the ws.client.host loopback check on all chat WebSocket endpoints:

• /api/pty
• /api/ws
• /api/pub
• /api/events

Update the web-dashboard docs to document the new flag, clarify that the Chat tab only appears when --tui is passed.

Related Issue

#15731

Type of Change

• ✨ New feature (non-breaking change that adds functionality)

Changes Made

<!-- List the specific changes. Include file paths for code changes. -->

• Add --insecure-chat flag parsing: hermes_cli/main.py
• Skip checks when --insecure-chat flag is passed: hermes_cli/web_server.py
• Document new flag, clarify that --tui flag in hermes dashboard command: website/docs/user-guide/features/web-dashboard.md

How to Test

<!-- Steps to verify this change works. For bugs: reproduction steps + proof that the fix works. -->

1. run hermes dashboard --tui --host 0.0.0.0 --insecure --insecure-chat
2. go to chat tab in Hermes web dashboard (use non-loopback ip address of the host)
3. confirm you can chat with the agent

Checklist

<!-- Complete these before requesting review. -->

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: Arch Linux

Documentation & Housekeeping

<!-- Check all that apply. It's OK to check "N/A" if a category doesn't apply to your change. -->

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

<!-- If applicable, add screenshots or log output showing the fix/feature in action. -->

Changed files

• hermes_cli/main.py (modified, +9/-0)
• hermes_cli/web_server.py (modified, +11/-4)
• website/docs/user-guide/features/web-dashboard.md (modified, +13/-1)