[Bug]: Gateway crashes on Nous Portal token expiry with no remote recovery path

[Mitch1200]

Bug Description

When the Nous Portal access token expires, the gateway returns a canned error message and stops processing. For users running Hermes headlessly (e.g. on a home server accessed remotely via Telegram/Discord), this is unrecoverable without physical access — the only fix is hermes login at the terminal.

Request: Auto-refresh the Nous Portal token in the background when it's near expiry, or trigger a re-auth flow that can be completed via a chat command (e.g. /login delivering an auth URL to the home channel).

Steps to Reproduce

Nous Portal access token needs to expire.

Expected Behavior

Auto refresh the access token in the background when near expiry or don't leave the user in the lurch when it does expire.

Actual Behavior

Effectively crashed. No way to make use of agent remotely unless server is reset.

Affected Component

Gateway (Telegram/Discord/Slack/WhatsApp)

Messaging Platform (if gateway-related)

Discord

Debug Report

--- hermes dump ---
version:          0.18.0 [6fcd470d] (2026-07-04)
os:               Darwin 25.4.0 arm64
python:           3.11.15
openai_sdk:       2.24.0
profile:          default
hermes_home:      ~/.hermes
model:            anthropic/claude-sonnet-4.6
provider:         nous
terminal:         local

api_keys:
  openrouter           not set
  openai               not set
  anthropic            not set
  anthropic_token      not set
  nous                 not set
  google/gemini        not set
  gemini               not set
  glm/zai              not set
  zai                  not set
  kimi                 not set
  minimax              not set
  deepseek             not set
  dashscope            not set
  huggingface          not set
  nvidia               not set
  opencode_zen         not set
  opencode_go          not set
  kilocode             not set
  firecrawl            not set
  tavily               not set
  browserbase          not set
  fal                  not set
  elevenlabs           not set
  github               not set

features:
  toolsets:           hermes-cli
  mcp_servers:        0
  memory_provider:    built-in
  gateway:            unknown
  platforms:          telegram, discord
  cron_jobs:          8 active / 9 total
  skills:             94

config_overrides:
  agent.max_turns: 150
  compression.threshold: 0.8
  display.streaming: True
  tts.provider: openai
--- end dump ---


--- agent.log (last 200 lines) ---
2026-07-04 20:07:39,338 INFO hermes_cli.plugins: Plugin 'web-parallel' registered web provider: parallel
2026-07-04 20:07:39,339 INFO hermes_cli.plugins: Plugin 'web-searxng' registered web provider: searxng
2026-07-04 20:07:39,339 INFO hermes_cli.plugins: Plugin 'web-tavily' registered web provider: tavily
2026-07-04 20:07:39,339 INFO hermes_cli.plugins: Plugin 'web-xai' registered web provider: xai
2026-07-04 20:07:39,342 INFO hermes_cli.plugins: Plugin discovery complete: 51 found, 44 enabled
2026-07-04 20:07:39,403 INFO hermes_cli.web_server: Mounted plugin API routes: /api/plugins/hermes-achievements/
2026-07-04 20:07:39,426 INFO hermes_cli.web_server: Mounted plugin API routes: /api/plugins/kanban/
2026-07-04 20:07:39,429 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:07:49,738 INFO hermes_cli.plugins: Plugin 'browser-browser-use' registered browser provider: browser-use
2026-07-04 20:07:49,738 INFO hermes_cli.plugins: Plugin 'browser-browserbase' registered browser provider: browserbase
2026-07-04 20:07:49,738 INFO hermes_cli.plugins: Plugin 'browser-firecrawl' registered browser provider: firecrawl
2026-07-04 20:07:49,767 INFO hermes_cli.plugins: Plugin 'fal' registered image_gen provider: fal
2026-07-04 20:07:49,767 INFO hermes_cli.plugins: Plugin 'krea' registered image_gen provider: krea
2026-07-04 20:07:49,767 INFO hermes_cli.plugins: Plugin 'openai' registered image_gen provider: openai
2026-07-04 20:07:49,767 INFO hermes_cli.plugins: Plugin 'openai-codex' registered image_gen provider: openai-codex
2026-07-04 20:07:49,767 INFO hermes_cli.plugins: Plugin 'openrouter' registered image_gen provider: openrouter
2026-07-04 20:07:49,767 INFO hermes_cli.plugins: Plugin 'openrouter' registered image_gen provider: nous
2026-07-04 20:07:49,768 INFO hermes_cli.plugins: Plugin 'xai' registered image_gen provider: xai
2026-07-04 20:07:49,769 INFO hermes_cli.plugins: Plugin 'fal' registered video_gen provider: fal
2026-07-04 20:07:49,769 INFO hermes_cli.plugins: Plugin 'xai' registered video_gen provider: xai
2026-07-04 20:07:49,770 INFO hermes_cli.plugins: Plugin 'web-brave-free' registered web provider: brave-free
2026-07-04 20:07:49,770 INFO hermes_cli.plugins: Plugin 'web-ddgs' registered web provider: ddgs
2026-07-04 20:07:49,770 INFO hermes_cli.plugins: Plugin 'web-exa' registered web provider: exa
2026-07-04 20:07:49,770 INFO hermes_cli.plugins: Plugin 'web-firecrawl' registered web provider: firecrawl
2026-07-04 20:07:49,771 INFO hermes_cli.plugins: Plugin 'web-parallel' registered web provider: parallel
2026-07-04 20:07:49,771 INFO hermes_cli.plugins: Plugin 'web-searxng' registered web provider: searxng
2026-07-04 20:07:49,771 INFO hermes_cli.plugins: Plugin 'web-tavily' registered web provider: tavily
2026-07-04 20:07:49,771 INFO hermes_cli.plugins: Plugin 'web-xai' registered web provider: xai
2026-07-04 20:07:49,774 INFO hermes_cli.plugins: Plugin discovery complete: 51 found, 44 enabled
2026-07-04 20:07:49,836 INFO hermes_cli.web_server: Mounted plugin API routes: /api/plugins/hermes-achievements/
2026-07-04 20:07:49,859 INFO hermes_cli.web_server: Mounted plugin API routes: /api/plugins/kanban/
2026-07-04 20:07:49,862 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:08:00,178 INFO hermes_cli.plugins: Plugin 'browser-browser-use' registered browser provider: browser-use
2026-07-04 20:08:00,178 INFO hermes_cli.plugins: Plugin 'browser-browserbase' registered browser provider: browserbase
2026-07-04 20:08:00,179 INFO hermes_cli.plugins: Plugin 'browser-firecrawl' registered browser provider: firecrawl
2026-07-04 20:08:00,207 INFO hermes_cli.plugins: Plugin 'fal' registered image_gen provider: fal
2026-07-04 20:08:00,208 INFO hermes_cli.plugins: Plugin 'krea' registered image_gen provider: krea
2026-07-04 20:08:00,208 INFO hermes_cli.plugins: Plugin 'openai' registered image_gen provider: openai
2026-07-04 20:08:00,208 INFO hermes_cli.plugins: Plugin 'openai-codex' registered image_gen provider: openai-codex
2026-07-04 20:08:00,208 INFO hermes_cli.plugins: Plugin 'openrouter' registered image_gen provider: openrouter
2026-07-04 20:08:00,208 INFO hermes_cli.plugins: Plugin 'openrouter' registered image_gen provider: nous
2026-07-04 20:08:00,208 INFO hermes_cli.plugins: Plugin 'xai' registered image_gen provider: xai
2026-07-04 20:08:00,210 INFO hermes_cli.plugins: Plugin 'fal' registered video_gen provider: fal
2026-07-04 20:08:00,210 INFO hermes_cli.plugins: Plugin 'xai' registered video_gen provider: xai
2026-07-04 20:08:00,210 INFO hermes_cli.plugins: Plugin 'web-brave-free' registered web provider: brave-free
2026-07-04 20:08:00,210 INFO hermes_cli.plugins: Plugin 'web-ddgs' registered web provider: ddgs
2026-07-04 20:08:00,211 INFO hermes_cli.plugins: Plugin 'web-exa' registered web provider: exa
2026-07-04 20:08:00,211 INFO hermes_cli.plugins: Plugin 'web-firecrawl' registered web provider: firecrawl
2026-07-04 20:08:00,211 INFO hermes_cli.plugins: Plugin 'web-parallel' registered web provider: parallel
2026-07-04 20:08:00,211 INFO hermes_cli.plugins: Plugin 'web-searxng' registered web provider: searxng
2026-07-04 20:08:00,212 INFO hermes_cli.plugins: Plugin 'web-tavily' registered web provider: tavily
2026-07-04 20:08:00,212 INFO hermes_cli.plugins: Plugin 'web-xai' registered web provider: xai
2026-07-04 20:08:00,215 INFO hermes_cli.plugins: Plugin discovery complete: 51 found, 44 enabled
2026-07-04 20:08:00,277 INFO hermes_cli.web_server: Mounted plugin API routes: /api/plugins/hermes-achievements/
2026-07-04 20:08:00,300 INFO hermes_cli.web_server: Mounted plugin API routes: /api/plugins/kanban/
2026-07-04 20:08:00,302 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:08:10,613 INFO hermes_cli.plugins: Plugin 'browser-browser-use' registered browser provider: browser-use
2026-07-04 20:08:10,613 INFO hermes_cli.plugins: Plugin 'browser-browserbase' registered browser provider: browserbase
2026-07-04 20:08:10,613 INFO hermes_cli.plugins: Plugin 'browser-firecrawl' registered browser provider: firecrawl
2026-07-04 20:08:10,642 INFO hermes_cli.plugins: Plugin 'fal' registered image_gen provider: fal
2026-07-04 20:08:10,642 INFO hermes_cli.plugins: Plugin 'krea' registered image_gen provider: krea
2026-07-04 20:08:10,642 INFO hermes_cli.plugins: Plugin 'openai' registered image_gen provider: openai
2026-07-04 20:08:10,642 INFO hermes_cli.plugins: Plugin 'openai-codex' registered image_gen provider: openai-codex
2026-07-04 20:08:10,642 INFO hermes_cli.plugins: Plugin 'openrouter' registered image_gen provider: openrouter
2026-07-04 20:08:10,642 INFO hermes_cli.plugins: Plugin 'openrouter' registered image_gen provider: nous
2026-07-04 20:08:10,643 INFO hermes_cli.plugins: Plugin 'xai' registered image_gen provider: xai
2026-07-04 20:08:10,644 INFO hermes_cli.plugins: Plugin 'fal' registered video_gen provider: fal
2026-07-04 20:08:10,644 INFO hermes_cli.plugins: Plugin 'xai' registered video_gen provider: xai
2026-07-04 20:08:10,645 INFO hermes_cli.plugins: Plugin 'web-brave-free' registered web provider: brave-free
2026-07-04 20:08:10,645 INFO hermes_cli.plugins: Plugin 'web-ddgs' registered web provider: ddgs
2026-07-04 20:08:10,645 INFO hermes_cli.plugins: Plugin 'web-exa' registered web provider: exa
2026-07-04 20:08:10,645 INFO hermes_cli.plugins: Plugin 'web-firecrawl' registered web provider: firecrawl
2026-07-04 20:08:10,646 INFO hermes_cli.plugins: Plugin 'web-parallel' registered web provider: parallel
2026-07-04 20:08:10,646 INFO hermes_cli.plugins: Plugin 'web-searxng' registered web provider: searxng
2026-07-04 20:08:10,646 INFO hermes_cli.plugins: Plugin 'web-tavily' registered web provider: tavily
2026-07-04 20:08:10,646 INFO hermes_cli.plugins: Plugin 'web-xai' registered web provider: xai
2026-07-04 20:08:10,649 INFO hermes_cli.plugins: Plugin discovery complete: 51 found, 44 enabled
2026-07-04 20:08:10,711 INFO hermes_cli.web_server: Mounted plugin API routes: /api/plugins/hermes-achievements/
2026-07-04 20:08:10,734 INFO hermes_cli.web_server: Mounted plugin API routes: /api/plugins/kanban/
2026-07-04 20:08:10,736 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:08:21,043 INFO hermes_cli.plugins: Plugin 'browser-browser-use' registered browser provider: browser-use
2026-07-04 20:08:21,043 INFO hermes_cli.plugins: Plugin 'browser-browserbase' registered browser provider: browserbase
2026-07-04 20:08:21,044 INFO hermes_cli.plugins: Plugin 'browser-firecrawl' registered browser provider: firecrawl
2026-07-04 20:08:21,072 INFO hermes_cli.plugins: Plugin 'fal' registered image_gen provider: fal
2026-07-04 20:08:21,072 INFO hermes_cli.plugins: Plugin 'krea' registered image_gen provider: krea
2026-07-04 20:08:21,072 INFO hermes_cli.plugins: Plugin 'openai' registered image_gen provider: openai
2026-07-04 20:08:21,072 INFO hermes_cli.plugins: Plugin 'openai-codex' registered image_gen provider: openai-codex
2026-07-04 20:08:21,072 INFO hermes_cli.plugins: Plugin 'openrouter' registered image_gen provider: openrouter
2026-07-04 20:08:21,073 INFO hermes_cli.plugins: Plugin 'openrouter' registered image_gen provider: nous
2026-07-04 20:08:21,073 INFO hermes_cli.plugins: Plugin 'xai' registered image_gen provider: xai
2026-07-04 20:08:21,074 INFO hermes_cli.plugins: Plugin 'fal' registered video_gen provider: fal
2026-07-04 20:08:21,075 INFO hermes_cli.plugins: Plugin 'xai' registered video_gen provider: xai
2026-07-04 20:08:21,075 INFO hermes_cli.plugins: Plugin 'web-brave-free' registered web provider: brave-free
2026-07-04 20:08:21,075 INFO hermes_cli.plugins: Plugin 'web-ddgs' registered web provider: ddgs
2026-07-04 20:08:21,075 INFO hermes_cli.plugins: Plugin 'web-exa' registered web provider: exa
2026-07-04 20:08:21,076 INFO hermes_cli.plugins: Plugin 'web-firecrawl' registered web provider: firecrawl
2026-07-04 20:08:21,076 INFO hermes_cli.plugins: Plugin 'web-parallel' registered web provider: parallel
2026-07-04 20:08:21,076 INFO hermes_cli.plugins: Plugin 'web-searxng' registered web provider: searxng
2026-07-04 20:08:21,076 INFO hermes_cli.plugins: Plugin 'web-tavily' registered web provider: tavily
2026-07-04 20:08:21,076 INFO hermes_cli.plugins: Plugin 'web-xai' registered web provider: xai
2026-07-04 20:08:21,079 INFO hermes_cli.plugins: Plugin discovery complete: 51 found, 44 enabled
2026-07-04 20:08:21,141 INFO hermes_cli.web_server: Mounted plugin API routes: /api/plugins/hermes-achievements/
2026-07-04 20:08:21,165 INFO hermes_cli.web_server: Mounted plugin API routes: /api/plugins/kanban/
2026-07-04 20:08:21,167 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:08:31,495 INFO hermes_cli.plugins: Plugin 'browser-browser-use' registered browser provider: browser-use
2026-07-04 20:08:31,496 INFO hermes_cli.plugins: Plugin 'browser-browserbase' registered browser provider: browserbase
2026-07-04 20:08:31,496 INFO hermes_cli.plugins: Plugin 'browser-firecrawl' registered browser provider: firecrawl
2026-07-04 20:08:31,525 INFO hermes_cli.plugins: Plugin 'fal' registered image_gen provider: fal
2026-07-04 20:08:31,525 INFO hermes_cli.plugins: Plugin 'krea' registered image_gen provider: krea
2026-07-04 20:08:31,525 INFO hermes_cli.plugins: Plugin 'openai' registered image_gen provider: openai
2026-07-04 20:08:31,526 INFO hermes_cli.plugins: Plugin 'openai-codex' registered image_gen provider: openai-codex
2026-07-04 20:08:31,526 INFO hermes_cli.plugins: Plugin 'openrouter' registered image_gen provider: openrouter
2026-07-04 20:08:31,526 INFO hermes_cli.plugins: Plugin 'openrouter' registered image_gen provider: nous
2026-07-04 20:08:31,526 INFO hermes_cli.plugins: Plugin 'xai' registered image_gen provider: xai
2026-07-04 20:08:31,528 INFO hermes_cli.plugins: Plugin 'fal' registered video_gen provider: fal
2026-07-04 20:08:31,528 INFO hermes_cli.plugins: Plugin 'xai' registered video_gen provider: xai
2026-07-04 20:08:31,528 INFO hermes_cli.plugins: Plugin 'web-brave-free' registered web provider: brave-free
2026-07-04 20:08:31,528 INFO hermes_cli.plugins: Plugin 'web-ddgs' registered web provider: ddgs
2026-07-04 20:08:31,529 INFO hermes_cli.plugins: Plugin 'web-exa' registered web provider: exa
2026-07-04 20:08:31,529 INFO hermes_cli.plugins: Plugin 'web-firecrawl' registered web provider: firecrawl
2026-07-04 20:08:31,529 INFO hermes_cli.plugins: Plugin 'web-parallel' registered web provider: parallel
2026-07-04 20:08:31,529 INFO hermes_cli.plugins: Plugin 'web-searxng' registered web provider: searxng
2026-07-04 20:08:31,530 INFO hermes_cli.plugins: Plugin 'web-tavily' registered web provider: tavily
2026-07-04 20:08:31,530 INFO hermes_cli.plugins: Plugin 'web-xai' registered web provider: xai
2026-07-04 20:08:31,533 INFO hermes_cli.plugins: Plugin discovery complete: 51 found, 44 enabled
2026-07-04 20:08:31,596 INFO hermes_cli.web_server: Mounted plugin API routes: /api/plugins/hermes-achievements/
2026-07-04 20:08:31,619 INFO hermes_cli.web_server: Mounted plugin API routes: /api/plugins/kanban/
2026-07-04 20:08:31,622 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:08:41,943 INFO hermes_cli.plugins: Plugin 'browser-browser-use' registered browser provider: browser-use
2026-07-04 20:08:41,943 INFO hermes_cli.plugins: Plugin 'browser-browserbase' registered browser provider: browserbase
2026-07-04 20:08:41,943 INFO hermes_cli.plugins: Plugin 'browser-firecrawl' registered browser provider: firecrawl
2026-07-04 20:08:41,972 INFO hermes_cli.plugins: Plugin 'fal' registered image_gen provider: fal
2026-07-04 20:08:41,972 INFO hermes_cli.plugins: Plugin 'krea' registered image_gen provider: krea
2026-07-04 20:08:41,972 INFO hermes_cli.plugins: Plugin 'openai' registered image_gen provider: openai
2026-07-04 20:08:41,973 INFO hermes_cli.plugins: Plugin 'openai-codex' registered image_gen provider: openai-codex
2026-07-04 20:08:41,973 INFO hermes_cli.plugins: Plugin 'openrouter' registered image_gen provider: openrouter
2026-07-04 20:08:41,973 INFO hermes_cli.plugins: Plugin 'openrouter' registered image_gen provider: nous
2026-07-04 20:08:41,973 INFO hermes_cli.plugins: Plugin 'xai' registered image_gen provider: xai
2026-07-04 20:08:41,975 INFO hermes_cli.plugins: Plugin 'fal' registered video_gen provider: fal
2026-07-04 20:08:41,975 INFO hermes_cli.plugins: Plugin 'xai' registered video_gen provider: xai
2026-07-04 20:08:41,975 INFO hermes_cli.plugins: Plugin 'web-brave-free' registered web provider: brave-free
2026-07-04 20:08:41,975 INFO hermes_cli.plugins: Plugin 'web-ddgs' registered web provider: ddgs
2026-07-04 20:08:41,976 INFO hermes_cli.plugins: Plugin 'web-exa' registered web provider: exa
2026-07-04 20:08:41,976 INFO hermes_cli.plugins: Plugin 'web-firecrawl' registered web provider: firecrawl
2026-07-04 20:08:41,976 INFO hermes_cli.plugins: Plugin 'web-parallel' registered web provider: parallel
2026-07-04 20:08:41,976 INFO hermes_cli.plugins: Plugin 'web-searxng' registered web provider: searxng
2026-07-04 20:08:41,976 INFO hermes_cli.plugins: Plugin 'web-tavily' registered web provider: tavily
2026-07-04 20:08:41,977 INFO hermes_cli.plugins: Plugin 'web-xai' registered web provider: xai
2026-07-04 20:08:41,980 INFO hermes_cli.plugins: Plugin discovery complete: 51 found, 44 enabled
2026-07-04 20:08:42,043 INFO hermes_cli.web_server: Mounted plugin API routes: /api/plugins/hermes-achievements/
2026-07-04 20:08:42,066 INFO hermes_cli.web_server: Mounted plugin API routes: /api/plugins/kanban/
2026-07-04 20:08:42,069 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:08:52,390 INFO hermes_cli.plugins: Plugin 'browser-browser-use' registered browser provider: browser-use
2026-07-04 20:08:52,391 INFO hermes_cli.plugins: Plugin 'browser-browserbase' registered browser provider: browserbase
2026-07-04 20:08:52,391 INFO hermes_cli.plugins: Plugin 'browser-firecrawl' registered browser provider: firecrawl
2026-07-04 20:08:52,420 INFO hermes_cli.plugins: Plugin 'fal' registered image_gen provider: fal
2026-07-04 20:08:52,420 INFO hermes_cli.plugins: Plugin 'krea' registered image_gen provider: krea
2026-07-04 20:08:52,421 INFO hermes_cli.plugins: Plugin 'openai' registered image_gen provider: openai
2026-07-04 20:08:52,421 INFO hermes_cli.plugins: Plugin 'openai-codex' registered image_gen provider: openai-codex
2026-07-04 20:08:52,421 INFO hermes_cli.plugins: Plugin 'openrouter' registered image_gen provider: openrouter
2026-07-04 20:08:52,421 INFO hermes_cli.plugins: Plugin 'openrouter' registered image_gen provider: nous
2026-07-04 20:08:52,421 INFO hermes_cli.plugins: Plugin 'xai' registered image_gen provider: xai
2026-07-04 20:08:52,423 INFO hermes_cli.plugins: Plugin 'fal' registered video_gen provider: fal
2026-07-04 20:08:52,423 INFO hermes_cli.plugins: Plugin 'xai' registered video_gen provider: xai
2026-07-04 20:08:52,423 INFO hermes_cli.plugins: Plugin 'web-brave-free' registered web provider: brave-free
2026-07-04 20:08:52,424 INFO hermes_cli.plugins: Plugin 'web-ddgs' registered web provider: ddgs
2026-07-04 20:08:52,424 INFO hermes_cli.plugins: Plugin 'web-exa' registered web provider: exa
2026-07-04 20:08:52,424 INFO hermes_cli.plugins: Plugin 'web-firecrawl' registered web provider: firecrawl
2026-07-04 20:08:52,424 INFO hermes_cli.plugins: Plugin 'web-parallel' registered web provider: parallel
2026-07-04 20:08:52,425 INFO hermes_cli.plugins: Plugin 'web-searxng' registered web provider: searxng
2026-07-04 20:08:52,425 INFO hermes_cli.plugins: Plugin 'web-tavily' registered web provider: tavily
2026-07-04 20:08:52,425 INFO hermes_cli.plugins: Plugin 'web-xai' registered web provider: xai
2026-07-04 20:08:52,428 INFO hermes_cli.plugins: Plugin discovery complete: 51 found, 44 enabled
2026-07-04 20:08:52,491 INFO hermes_cli.web_server: Mounted plugin API routes: /api/plugins/hermes-achievements/
2026-07-04 20:08:52,515 INFO hermes_cli.web_server: Mounted plugin API routes: /api/plugins/kanban/
2026-07-04 20:08:52,517 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:09:02,832 INFO hermes_cli.plugins: Plugin 'browser-browser-use' registered browser provider: browser-use
2026-07-04 20:09:02,832 INFO hermes_cli.plugins: Plugin 'browser-browserbase' registered browser provider: browserbase
2026-07-04 20:09:02,832 INFO hermes_cli.plugins: Plugin 'browser-firecrawl' registered browser provider: firecrawl
2026-07-04 20:09:02,861 INFO hermes_cli.plugins: Plugin 'fal' registered image_gen provider: fal
2026-07-04 20:09:02,861 INFO hermes_cli.plugins: Plugin 'krea' registered image_gen provider: krea
2026-07-04 20:09:02,862 INFO hermes_cli.plugins: Plugin 'openai' registered image_gen provider: openai
2026-07-04 20:09:02,862 INFO hermes_cli.plugins: Plugin 'openai-codex' registered image_gen provider: openai-codex
2026-07-04 20:09:02,862 INFO hermes_cli.plugins: Plugin 'openrouter' registered image_gen provider: openrouter
2026-07-04 20:09:02,862 INFO hermes_cli.plugins: Plugin 'openrouter' registered image_gen provider: nous
2026-07-04 20:09:02,862 INFO hermes_cli.plugins: Plugin 'xai' registered image_gen provider: xai
2026-07-04 20:09:02,864 INFO hermes_cli.plugins: Plugin 'fal' registered video_gen provider: fal
2026-07-04 20:09:02,864 INFO hermes_cli.plugins: Plugin 'xai' registered video_gen provider: xai
2026-07-04 20:09:02,864 INFO hermes_cli.plugins: Plugin 'web-brave-free' registered web provider: brave-free
2026-07-04 20:09:02,864 INFO hermes_cli.plugins: Plugin 'web-ddgs' registered web provider: ddgs
2026-07-04 20:09:02,865 INFO hermes_cli.plugins: Plugin 'web-exa' registered web provider: exa
2026-07-04 20:09:02,865 INFO hermes_cli.plugins: Plugin 'web-firecrawl' registered web provider: firecrawl
2026-07-04 20:09:02,865 INFO hermes_cli.plugins: Plugin 'web-parallel' registered web provider: parallel
2026-07-04 20:09:02,865 INFO hermes_cli.plugins: Plugin 'web-searxng' registered web provider: searxng
2026-07-04 20:09:02,866 INFO hermes_cli.plugins: Plugin 'web-tavily' registered web provider: tavily
2026-07-04 20:09:02,866 INFO hermes_cli.plugins: Plugin 'web-xai' registered web provider: xai
2026-07-04 20:09:02,869 INFO hermes_cli.plugins: Plugin discovery complete: 51 found, 44 enabled
2026-07-04 20:09:02,932 INFO hermes_cli.web_server: Mounted plugin API routes: /api/plugins/hermes-achievements/
2026-07-04 20:09:02,955 INFO hermes_cli.web_server: Mounted plugin API routes: /api/plugins/kanban/
2026-07-04 20:09:02,958 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.

--- errors.log (last 100 lines) ---
2026-07-04 19:54:47,084 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:54:57,526 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:55:07,955 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:55:18,391 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:55:28,827 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:55:39,275 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:55:49,713 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:56:00,144 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:56:10,576 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:56:21,016 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:56:22,525 WARNING hermes_cli.config: providers.ollama: unknown config keys ignored: num_ctx
2026-07-04 19:56:23,484 WARNING [20260626_174156_653003c6] hermes_cli.config: providers.ollama: unknown config keys ignored: num_ctx
2026-07-04 19:56:23,505 WARNING [20260626_174156_653003c6] hermes_cli.config: providers.ollama: unknown config keys ignored: num_ctx
2026-07-04 19:56:31,454 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:56:41,890 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:56:52,329 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:57:02,778 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:57:13,218 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:57:23,645 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:57:34,091 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:57:44,531 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:57:49,346 WARNING hermes_cli.config: providers.ollama: unknown config keys ignored: num_ctx
2026-07-04 19:57:50,318 WARNING [20260626_174156_653003c6] hermes_cli.config: providers.ollama: unknown config keys ignored: num_ctx
2026-07-04 19:57:50,338 WARNING [20260626_174156_653003c6] hermes_cli.config: providers.ollama: unknown config keys ignored: num_ctx
2026-07-04 19:57:54,971 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:58:05,402 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:58:15,842 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:58:20,732 WARNING hermes_cli.config: providers.ollama: unknown config keys ignored: num_ctx
2026-07-04 19:58:21,654 WARNING [20260626_174156_653003c6] hermes_cli.config: providers.ollama: unknown config keys ignored: num_ctx
2026-07-04 19:58:21,674 WARNING [20260626_174156_653003c6] hermes_cli.config: providers.ollama: unknown config keys ignored: num_ctx
2026-07-04 19:58:26,271 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:58:36,706 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:58:47,143 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:58:57,575 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:59:04,043 WARNING hermes_cli.config: providers.ollama: unknown config keys ignored: num_ctx
2026-07-04 19:59:05,278 WARNING [20260626_174156_653003c6] hermes_cli.config: providers.ollama: unknown config keys ignored: num_ctx
2026-07-04 19:59:05,297 WARNING [20260626_174156_653003c6] hermes_cli.config: providers.ollama: unknown config keys ignored: num_ctx
2026-07-04 19:59:08,015 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:59:18,452 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:59:28,889 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:59:39,325 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 19:59:49,761 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:00:00,190 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:00:10,629 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:00:21,069 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:00:31,511 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:00:32,413 WARNING hermes_cli.config: providers.ollama: unknown config keys ignored: num_ctx
2026-07-04 20:00:34,882 WARNING [20260626_174156_653003c6] hermes_cli.config: providers.ollama: unknown config keys ignored: num_ctx
2026-07-04 20:00:34,900 WARNING [20260626_174156_653003c6] hermes_cli.config: providers.ollama: unknown config keys ignored: num_ctx
2026-07-04 20:00:41,947 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:00:52,382 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:01:02,821 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:01:09,707 WARNING hermes_cli.config: providers.ollama: unknown config keys ignored: num_ctx
2026-07-04 20:01:13,280 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:01:23,715 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:01:34,163 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:01:44,611 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:01:55,053 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:02:02,924 WARNING hermes_cli.config: providers.ollama: unknown config keys ignored: num_ctx
2026-07-04 20:02:05,491 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:02:15,923 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:02:26,354 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:02:36,791 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:02:47,226 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:02:57,653 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:03:08,086 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:03:18,524 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:03:28,963 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:03:39,398 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:03:49,837 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:04:00,275 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:04:10,714 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:04:21,144 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:04:31,578 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:04:42,011 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:04:52,440 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:05:02,878 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:05:13,314 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:05:23,752 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:05:34,188 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:05:44,617 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:05:55,052 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:06:05,497 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:06:15,931 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:06:26,380 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:06:36,808 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:06:47,237 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:06:57,686 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:07:08,117 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:07:18,556 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:07:28,990 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:07:39,429 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:07:49,862 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:08:00,302 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:08:10,736 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:08:21,167 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:08:31,622 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:08:42,069 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:08:52,517 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.
2026-07-04 20:09:02,958 WARNING hermes_cli.web_server: --insecure no longer bypasses dashboard authentication. A non-loopback bind (0.0.0.0) now ALWAYS requires an auth provider (OAuth or the bundled password provider). Configure one — see below — or bind to 127.0.0.1 and reach it over an SSH tunnel / Tailscale.

--- gateway.log (last 100 lines) ---
2026-07-04 19:48:21,768 INFO gateway.run: Shutdown phase: all adapters disconnected at +1.64s
2026-07-04 19:48:21,772 INFO gateway.run: Shutdown phase: final-cleanup tool kill done at +1.64s
2026-07-04 19:48:21,786 INFO gateway.run: Shutdown phase: SessionDB close done at +1.66s
2026-07-04 19:48:21,787 INFO gateway.run: Gateway stopped by an unexpected signal — persisting gateway_state=running so container_boot auto-starts on the next boot (issue #42675)
2026-07-04 19:48:21,789 INFO gateway.run: Gateway stopped (total teardown 1.66s)
2026-07-04 19:48:21,789 INFO gateway.run: Gateway housekeeping stopped
2026-07-04 19:48:21,790 INFO gateway.run: Exiting with code 1 (signal-initiated shutdown without restart request) so systemd Restart=on-failure can revive the gateway.
┌─────────────────────────────────────────────────────────┐
│           ⚕ Hermes Gateway Starting...                 │
├─────────────────────────────────────────────────────────┤
│  Messaging platforms + cron scheduler                    │
│  Press Ctrl+C to stop                                   │
└─────────────────────────────────────────────────────────┘

[hermes] [boot] Hermes backend is ready. Finalizing desktop startup

Operating System

macOS 15.2

Python Version

No response

Hermes Version

No response

Additional Logs / Traceback (optional)

Root Cause Analysis (optional)

No response

Proposed Fix (optional)

No response

Are you willing to submit a PR for this?

• I'd like to fix this myself and submit a PR

[Trufiji]

Corroborating report — same root cause, second deployment, high frequency

We're hitting what looks like the same underlying fault on a separate always-on macOS deployment, and want to add hard data because for us this is happening constantly, not just at token expiry. Frankly it's been a real source of frustration — it reads to the operator as "Hermes keeps losing Nous," and we spent real time chasing phantom causes before pinning it down.

Environment

Build	5445e42b8 (2026-07-03), i.e. current main
OS	macOS 26.5.1, arm64 (M4 Mac mini, headless / remote-accessed)
Provider	nous, Nous Portal Ultra plan (no credit ceiling — see below)
Gateway	launchd-managed, 24/7, Telegram + Slack + Home Assistant

The symptom, quantified

The gateway logs Primary provider auth failed: No access token found for Nous Portal login. — trying fallback and drops the turn to a fallback provider. Count of that exact log line, after our Ultra plan went active (so this is purely the token path, not billing):

Date	"No access token" events
2026-07-01	35
2026-07-02	66
2026-07-03	36
2026-07-04	16
2026-07-05	16
Total (5 days)	197

These cluster tightly around concurrent load — scheduled cron jobs firing on the hour and active chat turns landing in the same second.

Why we think it's a refresh-window race, not plain expiry

The Nous Portal access token has a ~15-minute lifetime (expires_in: 899). It's being refreshed fine on the whole — auth.json rewrites itself every few minutes and we caught it mid-refresh repeatedly. The failures happen when multiple in-process callers hit the credential resolve path in the same instant a refresh is swapping the token, and one of them reads an empty/absent access_token:

hermes_cli/auth.py:5563-5565

access_token = state.get("access_token")
...
if not isinstance(access_token, str) or not access_token:
    raise AuthError("No access token found for Nous Portal login.",
                    provider="nous", relogin_required=True)

The refresh itself IS file-locked (_auth_store_lock, _nous_shared_store_lock, _merge_shared_nous_oauth_state) — so this isn't an unlocked write race. It reads as a narrow read-side window where a caller resolves credentials while a rotation is in flight and gets a transient empty token instead of retrying/waiting on the same lock. On single-user interactive use it'd be invisible; under a busy multi-session gateway it fires many times a day.

Separately — and this confirms it's NOT billing

On the pre-Ultra period we also saw 94 out of funds / balance too low 401s between 2026-06-20 and 2026-06-29. Those went to zero the moment Ultra activated (0 occurrences since 2026-06-30). So the 197 token events above are a distinct, money-unrelated defect.

Impact

• Not a hard crash for us, but every event degrades a turn to a fallback model mid-conversation — inconsistent quality, and alarming to a non-technical operator watching it happen.
• Combines badly with the OP's scenario ([Bug]: Gateway crashes on Nous Portal token expiry with no remote recovery path #58572): on a headless box the token path is exactly where you don't want fragility.

Suggested fix direction (aligned with OP's request)

1. On the resolve path, when access_token is transiently empty during an in-flight refresh, wait on the existing lock and re-read rather than raising AuthError(relogin_required=True) — a transient empty read is not a re-login condition.
2. Distinguish "token momentarily rotating" from "token genuinely expired/revoked" before surfacing relogin_required.
3. (OP's ask) a chat-command re-auth path (/login delivering the device URL to the home channel) for headless recovery when a refresh genuinely fails.

Happy to supply full hermes debug share logs or run any instrumented build against this — we can reproduce it daily just by leaving the gateway under normal cron + chat load.

[Slayer3110-ai]

Independent reproduction + log evidence

Confirmed on a separate install (Linux/x86_64, Hermes running headless, gateway connected to Telegram DM). Same root cause: Portal OAuth token reaches "terminal auth death" → gateway continues dispatching turns for ~6 hours against a dead token → no user-visible warning.

Timeline from ~/.hermes/logs/errors.log

2026-07-09 10:19:32  WARNING  hermes_cli.auth: Nous OAuth state quarantined
                                  (terminal auth death):
                                  error_code: "invalid_grant"
                                  reason: "runtime_access_refresh_failure"
                                  token_already_expired: true
2026-07-09 10:19:32  WARNING  hermes_cli.auth: Nous OAuth state quarantined
                                  (terminal auth death):
                                  error_code: "invalid_grant"
                                  reason: "credential_pool_refresh_failure"
                                                          ^-- pool emptied at 10:19

After that, every gateway turn logged the same fallback loop with no operator notice:

2026-07-09 16:04:35  WARNING  gateway.run: Primary provider auth failed:
                                  No access token found for Nous Portal
                                  login. — trying fallback
2026-07-09 16:13:45  WARNING  gateway.run: Primary provider auth failed:
                                  No access token found for Nous Portal
                                  login. — trying fallback
2026-07-09 16:18:03  WARNING  gateway.run: Primary provider auth failed:
                                  No access token found for Nous Portal
                                  login. — trying fallback

What I observed from the TUI side

• Channel: Telegram DM (8692644992) over the home channel
• Symptom: gateway accepted incoming messages, but every response attempt hung and then returned the canned "primary provider auth failed" error
• 6+ hour window of unavailability between token quarantine (10:19) and operator noticing
• No proactive notification fired at quarantine time — the user only saw the failure when they tried to send a message

Key signals for the fix in #59718

1. The quarantine warning is the canonical signal — reason field distinguishes runtime_access_refresh_failure (Portal rejected the refresh token) from credential_pool_refresh_failure (pool ran out). Both are terminal, both need the same response: prompt the operator to re-auth, with a remote path (Telegram/Discord /login deep link to the portal URL).
2. Pre-expiry warning is missing. hermes status shows Access exp: <timestamp> but nothing fires when that timestamp is, say, 30 min away. A cron pre-check would beat the cut-off entirely.
3. Quarantine → user-visible error is too slow. 6 hours elapsed between the quarantine and the user seeing anything. The warning should surface on the next inbound message, not just sit in errors.log.
4. Network side is fine. During the outage: inference-api.nousresearch.com resolved, ping 8.8.8.8 was 15 ms / 0% loss, hermes status was readable. The bug is purely on the auth path.

Suggested test plan for #59718

• Force-quarantine the auth state (mock invalid_grant on refresh), confirm the gateway emits a user-visible alert on the next inbound message (not the 100th).
• Confirm hermes status shows the quarantine reason and a /login <url> deep link to the home channel.
• Confirm a pre-expiry cron (e.g. 30 min before Access exp) fires to the home channel with a one-tap re-auth path.

Happy to provide the full log slice or test on a sandboxed token if it helps.