hermes-agent 1.2.1 — UI OAuth for MCP servers under expose: dashboard - #534
Merged
Conversation
A real user's 'MCP not working': the platform terminates TLS at the edge,
the dashboard saw itself as http://, and registered a cleartext OAuth
callback -- refused by auth providers ('cleartext http redirect_uris are
only allowed for loopback hosts', measured against auth.cpln.io). The
dashboard's operator knob is its public URL; under expose: dashboard the
chart now sets HERMES_DASHBOARD_PUBLIC_URL from $(CPLN_GLOBAL_ENDPOINT)
(platform-injected https canonical, expanded at container start -- the
langfuse/plane pattern). Verified live end to end before this commit: 55
Control Plane tools over authenticated OAuth, tokens surviving redeploys.
README: OAuth-MCP walkthrough (UI flow for expose: dashboard, CLI
paste-back for expose: api, the registration error quoted as signpost);
Anthropic keys must be workspace-scoped (identity-linked keys 400 with
'anthropic-workspace-id is required' and hermes has no header hook for
anthropic); an OAuth-connected MCP server acts AS the authenticator --
stated in bold, since cpln's toolset includes create/delete.
…haustion Six live attempts on v2026.8.31, each eliminating a layer: chromium downloads (6s) and launches by hand with zero missing libs -- but the image ships none of its three browser drivers (lightpanda engine, agent-browser CLI, and the active backend's browser-use CLI), the run-as-hermes gateway scrubs HOME and PLAYWRIGHT_BROWSERS_PATH, and after installing everything the backend still demands a running Chrome to attach to. The failure is silent: the agent answers via web_extract with a soft note, so it looks like it worked. README now says NOT functional rather than downloads-on- demand; briefing carries the full elimination chain so nobody re-walks it.
…ch (attempt 7) Giving the backend a running Chrome instead of hoping it launches one: persistent headless chromium + browser.cdp_url measured working end to end (CDP websocket resolved, real navigation visible in chrome's own tab list). README states the one verified path; briefing records the recipe and the 1.3.0 sidecar-container shape that productizes it.
…to end The intro still headlined browser automation unqualified and the resources comments still rationalized maxCpu with the on-demand-browser story, both contradicting the measured verdict two sections later. Browser detail moved out of a paragraph-length Architecture bullet into its own section per conventions; intro and comments now point at it. Audited: YAML blocks byte-match shipped values (3 flagged lines are the deliberate OpenRouter switch example), section order conforms, links checked.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See commit message; born from a live user incident yesterday. Review diff:
git diff 5deb2c3..HEAD -- hermes-agent/versions/1.2.1/. Verified: default render byte-identical ports/env to 1.2.0 minus the new conditional; both arms render; lint FAIL-free. Live verification happening this morning on the frontier round (the deployment IS the test).🤖 Generated with Claude Code