Dashboard Chat tab broken behind HA Supervisor ingress (502 on /v1/health, 401 on /api/auth/me) — v0.18.2

[slawa19]

Summary

Dashboard Chat tab fails to start new sessions when accessed through Home Assistant Supervisor ingress (401 Unauthorized on /api/auth/me, 502 Bad Gateway on /v1/health), causing "Session ended" state with non-functional "Start new session" button.

Environment

• Hermes Agent version: 0.18.2 (release v2026.7.7.2, 2026-07-08)
• Home Assistant OS: HAOS x86-64, 16GB RAM
• Deployment: Hermes Agent addon (0a6523c6_hermes_agent) accessed via HA Supervisor ingress
• Ingress prefix length: /api/hassio_ingress/cGinERVSyGG5zOckZiqzcr7MKQRPjk1twunLi0xJNaw (63 chars + /dashboard = 73 chars total)

Symptoms

1. Dashboard loads successfully (login works)
2. "Start new session" button renders but clicking does nothing
3. Browser console shows:
   • api/hassio_ingress/.../v1/health → 502 Bad Gateway
   • api/hassio_ingress/.../dashboard/api/auth/me → 401 Unauthorized
4. Direct WebSocket connections work:
   • ws://127.0.0.1:49169/dashboard/api/pty?token=... → ✅ Connected
   • ws://127.0.0.1:49169/dashboard/api/console?token=... → ✅ Connected
5. Direct API calls work:
   • http://127.0.0.1:8642/v1/health → ✅ {"status": "ok"}
   • http://127.0.0.1:49469/api/auth/me with Bearer token → ❌ 401 Unauthorized

Root Cause Analysis

Issue 1: 502 on /v1/health through ingress

nginx config (/etc/nginx/nginx.conf):

location /v1/ {
    proxy_pass http://hermes_api_0/v1/;  # hermes_api_0 = 127.0.0.1:8642
    proxy_set_header Host $host;
    # Missing: X-Forwarded-Prefix handling
}

Problem: HA ingress adds X-Forwarded-Prefix: /api/hassio_ingress/<token>/dashboard, but nginx strips path prefix before proxying to API server. API server receives /v1/health without context of the ingress prefix, causing routing mismatch.

Verified: curl http://127.0.0.1:8642/v1/health works directly.

Issue 2: 401 on /dashboard/api/auth/me

nginx config:

location /dashboard/api/ {
    proxy_pass http://hermes_dashboard_0/api/;  # 127.0.0.1:49469
    proxy_set_header Authorization "Bearer Ut_bjQ0PIyq45KYsnMP_vm6CoPgu2h0enmiDwgjuQkc";
}

Problem: Token in nginx matches _SESSION_TOKEN injected into dashboard HTML, but web_server.py::check_auth() returns 401. Possible causes:

• Host header validation fails (ingress Host != 127.0.0.1)
• Origin validation fails (ingress Origin != http://127.0.0.1)
• CORS middleware blocks cross-origin request from ingress

Verified: curl http://127.0.0.1:49469/api/auth/me with same Bearer token returns 401.

Reproduction Steps

1. Install Hermes Agent addon on HAOS
2. Access dashboard via HA sidebar (ingress) or http://<ha-ip>:8123/api/hassio_ingress/<token>/dashboard
3. Navigate to Chat tab
4. Click "Start new session"
5. Observe: button does nothing, console shows 502/401 errors

Expected Behavior

• /v1/health through ingress → 200 OK
• /dashboard/api/auth/me through ingress → 200 with user data
• "Start new session" button → starts new chat session

Actual Behavior

• /v1/health → 502 Bad Gateway
• /dashboard/api/auth/me → 401 Unauthorized
• "Start new session" → no-op (blocked by failed API calls)

Related Issues

• dashboard: X-Forwarded-Prefix silently dropped when longer than 64 chars — breaks Home Assistant Supervisor ingress (blank white dashboard) #59476 (closed 2026-07-06): X-Forwarded-Prefix > 64 chars — fixed in 0.18.2 ✅
• fix(dashboard): accept HA ingress prefix paths #59479, fix(dashboard): raise X-Forwarded-Prefix cap to 256 chars + warn on rejection #59490, fix(dashboard): accept HA ingress prefix paths (salvage #59479) #59534 (closed): HA ingress prefix path handling — fixed in 0.18.2 ✅

This is a NEW issue not covered by the above fixes. The prefix length fix is applied (_MAX_PREFIX_LENGTH = 256), but 502/401 persist.

Workaround

Direct access to dashboard on port 49469 (bypass ingress) works:

# From host machine (not HA container)
curl http://127.0.0.1:49469/api/auth/me \
  -H "X-Hermes-Session-Token: Ut_bjQ0PIyq45KYsnMP_vm6CoPgu2h0enmiDwgjuQkc"

Logs

nginx access log

192.168.50.233 - /api/hassio_ingress/cGinERVSyGG5zOckZiqzcr7MKQRPjk1twunLi0xJNaw/v1/health 502
192.168.50.233 - /api/hassio_ingress/cGinERVSyGG5zOckZiqzcr7MKQRPjk1twunLi0xJNaw/dashboard/api/auth/me 401

Gateway log

2026-07-14 10:09:06,721 INFO gateway.run: Connecting to api_server...
2026-07-14 10:09:06,842 INFO gateway.platforms.api_server: [Api_Server] API server listening on http://127.0.0.1:8642 (model: hermes-agent)
2026-07-14 10:09:06,903 INFO gateway.run: ✓ api_server connected

No errors in gateway log — API server starts successfully.

Suggested Fix

For 502 on /v1/health:

Update nginx config to handle ingress prefix:

location /v1/ {
    proxy_pass http://hermes_api_0/v1/;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Prefix $http_x_ingress_path;  # Add this
}

For 401 on /dashboard/api/auth/me:

Investigate web_server.py::check_auth() — likely needs to:

1. Accept ingress Host header (not just 127.0.0.1)
2. Accept ingress Origin header
3. Handle X-Forwarded-Host header for validation

Impact

• Severity: Medium — dashboard Chat tab unusable through ingress (primary access method for HA users)
• Workaround: Direct port access (requires firewall/port forwarding config)
• Affected users: All Home Assistant addon users accessing dashboard via ingress

[teknium1]

This automated hermes-sweeper review could not reproduce a Hermes core/dashboard failure from the reported HTTP results.

• v2026.7.7.2 already registers GET /v1/health in gateway/platforms/api_server.py:4978; the handler returns the normal health JSON response.
• /api/auth/me is an auth-gate identity probe. In loopback mode it intentionally returns 401 without a verified gate session (hermes_cli/dashboard_auth/routes.py:594-599), and web/src/components/AuthWidget.tsx:58-66 explicitly treats that 401 as expected and hides the optional widget.
• The dashboard client has no /v1/health call, so that upstream 502 cannot explain the Chat tab's session-start path from this repository.

The remaining 502 evidence points to the Home Assistant add-on/nginx deployment path, whose configuration is outside this repository.