hermes-agent/.hermes/plans/2026-05-21-dashboard-oauth-auth.md

# Dashboard OAuth Authentication Implementation Plan

> **For Hermes:** Use `subagent-driven-development` skill to implement this plan task-by-task.

**Goal:** Put an OAuth login gate in front of `hermes dashboard` whenever it binds to a non-loopback host without `--insecure`. Default provider is Nous Portal (authorization-code + PKCE); the provider layer is plugin-extensible so others (Google, GitHub, self-hosted OIDC, header-trust) can be added later without modifying core.

**Architecture:**

Three new layers slot into the existing `hermes_cli/web_server.py`:

1. A **dashboard-auth provider registry** in `hermes_cli/dashboard_auth/` exposing a small `DashboardAuthProvider` protocol (`name`, `display_name`, `start_login()`, `complete_login(callback_params)`, `verify_session(cookies)`, `refresh_session(cookies)`, `revoke_session(cookies)`). Providers are registered through a new `ctx.register_dashboard_auth_provider(provider)` plugin hook, mirroring `register_image_gen_provider` / `register_memory_provider`.
2. A **default Nous provider plugin** at `plugins/dashboard-auth-nous/` that talks to the Portal's authorization-code + PKCE endpoints (developed in `nous-account-service`). Token verification reuses the existing `/api/oauth/account` userinfo path; refresh reuses the device-flow `POST /oauth/token` with `grant_type=refresh_token`. Bundled with Hermes so the default install Just Works™.
3. An **auth gate** in `hermes_cli/web_server.py`:
   - A FastAPI middleware (ordered before `auth_middleware`) that gates everything when `auth.required is True`, except routes under `/auth/`, the narrow login-bootstrap public API, and the `/login` HTML.
   - Three new routes (`/auth/login`, `/auth/callback`, `/auth/logout`) plus `/api/auth/providers`, `/api/auth/me`, `/api/auth/refresh`.
   - HttpOnly `Secure` `SameSite=Lax` cookies: `hermes_session_at` (Portal access JWT) and `hermes_session_rt` (Portal refresh token, opaque). Plus `hermes_session_pkce` for the short-lived PKCE state during the OAuth round-trip.
   - PTY/WS auth: server-side endpoint `/api/auth/ws-ticket` mints a short-lived single-use ticket from a valid cookie; the SPA passes it as `?ticket=` to `/api/pty` and `/api/ws`. The existing `_SESSION_TOKEN` becomes legacy and is unused in auth-required mode (the SPA reads its cookie identity, not the injected script).

**Tech Stack:**

- Python: FastAPI, httpx, PyJWT (already in deps via `jose` in NAS but we'll use `pyjwt` since `cryptography` is already pulled in), cryptography (existing).
- Frontend: minimal server-rendered Jinja-style HTML for `/login` (no React bundle); the existing React SPA gets a small "load cookie identity from `/api/auth/me` instead of `window.__HERMES_SESSION_TOKEN__`" change.
- Portal side: depends on a new authorization-code endpoint pair on `portal.nousresearch.com`. This plan documents the contract; cross-repo work happens in `nous-account-service`.

---

## ⚠️ Contract Anchor (Plan v2 — re-validated 2026-05-21)

**Source of truth:** `nous-account-service` PR #180 `docs/agent-dashboard-oauth-contract.md` ([link](https://github.com/NousResearch/nous-account-service/pull/180)).

The Portal's published contract differs from our initial assumptions in several material ways. This plan was revised after fetching PR #180 to bring our design into compliance. Phases 0–3 (already implemented) are NOT affected — they only set up the gate-engagement plumbing, not the OAuth payload specifics. **Phases 4, 6, and 7 are rewritten below; the original drafts are kept inline as "Original (rejected)" blocks so reviewers can see why each call was made.**

### Material findings from the contract

| # | Topic | Original plan said | Contract requires |
|---|---|---|---|
| C1 | **`client_id`** | Static `hermes-dashboard` (one OAuth client for all dashboards) | **Per-instance synthesized: `agent:{AgentInstance.id}`**. Portal injects `HERMES_DASHBOARD_OAUTH_CLIENT_ID` at provisioning time. Dashboard MUST NOT attempt OAuth if missing. |
| C2 | **Audience claim** | `aud = "hermes-cli:hermes-dashboard"` | **`aud = client_id`** (bare, no prefix). Each dashboard verifies tokens issued specifically to itself. |
| C3 | **Scopes** | `openid profile email inference:invoke tool:invoke` | **`agent_dashboard:access`** only (or omit; default). No OIDC scopes are honoured for this flow. |
| C4 | **Token claims** | `email`, `email_verified`, `name`, `session_id` | These are NOT emitted. Available claims: `iss`, `aud`, `exp`, `sub` (user_id), `client_id`, `agent_instance_id`, `org_id`, `scope`, `token_use`, `product_id`, `nous_client`, plus optional rate-limit hints. **No email, no display name.** |
| C5 | **Refresh tokens** | Refresh-in-cookie (Phase 6 silent-refresh) | **No refresh tokens** in V1. 401 → re-auth via full `/oauth/authorize` redirect. |
| C6 | **Token TTL** | Not pinned | 900 seconds (15 minutes). With no refresh, users re-auth every 15 min of active use. |
| C7 | **Verification mode** | JWKS or userinfo fallback | **JWKS only** — `GET /.well-known/jwks.json`, RS256. There is no userinfo endpoint in the contract. |
| C8 | **Redirect URI** | `https://*.fly.dev/auth/callback` wildcard | Two shapes only: exact `https://{flyAppName}.fly.dev/auth/callback` (per `AgentInstance.flyAppName`) OR `http://{localhost,127.0.0.1}:{any-port}/auth/callback` (unconditional carve-out, including prod). |
| C9 | **Agent-instance check** | Not in plan | Contract recommends defense-in-depth: after `aud` passes, verify `claims["agent_instance_id"] == HERMES_DASHBOARD_AGENT_INSTANCE_ID` (or extract from client_id). |
| C10 | **Env var names** | `HERMES_DASHBOARD_AUTH_NOUS_PORTAL_URL` | Portal injects `HERMES_DASHBOARD_PORTAL_URL` at provisioning. Match exactly. |
| C11 | **`oauth_contract_version` claim** | Not in plan | Contract says `1`; verifiers must check before trusting other claims. (Current code does NOT actually emit this — flagged back to Portal team. Treat as tolerant: if missing, proceed with a warning log; if present and != 1, refuse.) |

### What this kills

- **Phase 6 (silent refresh) is entirely deleted.** Replaced by a thinner "401 → re-auth redirect" UX. The refresh-token cookie (`hermes_session_rt`) is removed from the design — there is no refresh token to put in it.
- **The "userinfo fallback verification mode"** in Phase 4 is deleted. JWKS is mandatory.
- **The `Session.email` / `Session.display_name` fields** stay (we already shipped them in Phase 1) but the Nous provider will populate them with empty strings + the user's opaque Portal `sub` claim as a fallback display value. Phase 7's AuthWidget shows the truncated `user_id`, not a name/email.
- **The plan's promise of "all claims in the access token" is broken** by the contract — but in our favor: less round-tripping, just less to display.

### What stays the same

- All of Phases 0–3 (gate engagement, plugin hook, middleware, cookies for the access token only, routes, login page) are unaffected. The cookie machinery already only requires the access token to be set; we'll simply pass `refresh_token=""` everywhere.
- The "fail closed if zero providers" + "fail closed if `HERMES_DASHBOARD_OAUTH_CLIENT_ID` is missing" stories combine cleanly: in the gated-public path, both must be true.
- Multi-provider plugin extensibility stays — only Nous ships, but the architecture supports adding a `Custom OIDC` provider later.

### Decision Log updates (resolving the above)

| Original Q | New resolution |
|---|---|
| QC — Refresh strategy (c2) | **REVERSED to c1 (no refresh).** Contract V1 has no refresh tokens. |
| Q5 — Redirect URI (wildcard) | **REVERSED.** Each `AgentInstance` has a single canonical Fly URL it was provisioned at; the dashboard reads its own `HERMES_DASHBOARD_OAUTH_CLIENT_ID` to derive the instance id and uses `request.url_for("auth_callback")` (under `proxy_headers=True`) for the redirect. Localhost dev: only `localhost` and `127.0.0.1` work, never `0.0.0.0`. |
| Q6 — JWT claims (all in access token) | **PARTIALLY HONORED.** All claims that DO exist are in the JWT — but `email`/`name` aren't in the contract. AuthWidget surfaces `user_id` (truncated) instead. |
| Q12 — Operator setup (zero config) | **REVISED.** Zero config for the **bundled** flow (Portal-managed Fly agent), because the Portal injects the env vars at provisioning. The dashboard is NOT meant to be self-hosted with OAuth in V1 — operator-owned dashboards stay loopback-only or `--insecure`. |

### Open Questions added

| OQ-C1 | Should the AuthWidget make a separate authenticated call to a Portal userinfo endpoint to surface email/name? Punt for V1; show truncated `user_id`. Revisit if a Portal `/api/oauth/userinfo` endpoint lands. |
| OQ-C2 | The contract documents an `oauth_contract_version` claim but the issuer code doesn't emit it. Flag back to Portal team in PR #180 review. Hermes implementation logs a warning and proceeds if absent (tolerant); refuses if present and != 1. |
| OQ-C3 | Staging Portal lives at `portal.rewbs.uk`. Smoke test against that before considering Phase 4 done. |

---

## Background From The Codebase

Findings from grepping `hermes_cli/web_server.py`, `hermes_cli/auth.py`, `hermes_cli/plugins.py`, and the Portal `nous-account-service` repo:

### Current state

- **`_SESSION_TOKEN`** (`hermes_cli/web_server.py:86`) is generated fresh at server start and injected into the SPA `index.html` via `<script>window.__HERMES_SESSION_TOKEN__="…"</script>` (`_serve_index`, ~line 3685). Every browser that can `GET /` reads it. The token gates all `/api/...` routes except `_PUBLIC_API_PATHS` via `auth_middleware` (~line 237).
- **DNS-rebinding defense** lives in `host_header_middleware` (~line 207). It compares the inbound `Host` header against `app.state.bound_host` set by `start_server`. We must preserve this; the new auth gate is an additional layer on top.
- **`--insecure` and `--host`** wire through `hermes_cli/main.py:13140–13157` → `cmd_dashboard` (~10282) → `start_server(host=, allow_public=getattr(args, "insecure", False))` (~10338). `start_server` (`web_server.py:4514`) raises `SystemExit` if `host not in _LOCALHOST and not allow_public`.
- **`/api/status`** is in `_PUBLIC_API_PATHS` because the sidebar polls it pre-token; it returns version, profile, gateway state, etc. The login page only needs version + auth-bootstrap info, so we will narrow what's public.
- **PTY auth** (`/api/pty`, `/api/ws`, `/api/pub`, `/api/events`) uses the SPA-injected token as a `?token=` query param (`web_server.py:3530, 3562, 3591`). Browsers cannot set `Authorization` on WebSocket upgrade, so query-param auth stays — but the token source flips from "injected script" to "server-minted short-lived ticket from cookie".
- **Plugin registry** is at `hermes_cli/plugins.py` (`PluginContext` class). It already has `register_context_engine`, `register_image_gen_provider`, `register_memory_provider`, `register_video_gen_provider` (~lines 499, 531, 558). Adding `register_dashboard_auth_provider` follows the exact same pattern.
- **Existing Nous OAuth in Hermes** is **device flow only** (`hermes_cli/auth.py:73–190`, `PROVIDER_REGISTRY["nous"]`). It already speaks `portal.nousresearch.com`, knows `client_id="hermes-cli"`, scopes `inference:invoke tool:invoke`, and persists tokens to `~/.hermes/auth.json` under `providers.nous`. **The dashboard auth flow is distinct from this**: it's a *user-identity* session for the operator, not an *inference credential* for the agent. They share Portal infrastructure but live in different stores (cookies vs. `auth.json`) and use different client_ids and scopes.
- **`auth.json` keys for `providers.nous`** (confirmed from disk): `access_token`, `refresh_token`, `client_id`, `portal_base_url`, `inference_base_url`, `token_type`, `scope`, `obtained_at`, `expires_at`, `agent_key`, `agent_key_expires_at`, `tls`, `agent_key_id`, `agent_key_expires_in`, `agent_key_reused`, `agent_key_obtained_at`, `expires_in`. The dashboard session does NOT need agent_key fields — those are inference-side.

### Portal endpoints already shipped

In `/home/ben/nous/nous-account-service/src/app/api/oauth/`:

- `POST /api/oauth/device/code` — device-flow code request (existing, NOT used by dashboard).
- `POST /api/oauth/device/verify` — device-flow approval (existing, NOT used by dashboard).
- `POST /api/oauth/token` — token exchange + refresh (existing). Accepts `grant_type=urn:ietf:params:oauth:grant-type:device_code` today; needs to also accept `grant_type=authorization_code` (cross-repo work).
- `GET /api/oauth/account` — userinfo (existing, returns `{userId, orgId, ...}` after JWT validation). Reusable as-is for verifying a JWT carried in the dashboard cookie.

### Portal endpoints to be developed (cross-repo dependency)

This plan **assumes** but does not implement the Portal side. The contract Hermes will speak:

- `GET https://portal.nousresearch.com/oauth/authorize?response_type=code&client_id=hermes-dashboard&redirect_uri=<dashboard_callback>&scope=openid+profile+email+inference%3Ainvoke+tool%3Ainvoke&state=<csrf>&code_challenge=<S256>&code_challenge_method=S256` — browser-redirect endpoint that prompts the logged-in Portal user to approve the Hermes dashboard, then 302s to `redirect_uri?code=<auth_code>&state=<csrf>`.
- `POST https://portal.nousresearch.com/api/oauth/token` (existing endpoint, extended) — accepts `grant_type=authorization_code&code=<auth_code>&code_verifier=<pkce>&client_id=hermes-dashboard&redirect_uri=<dashboard_callback>` and returns `{access_token, refresh_token, token_type: "Bearer", expires_in, scope}`. The access token is a JWT with the claims listed below.

The client_id `hermes-dashboard` must be added to the Portal's `OAUTH_CLIENT_PRODUCT_CONTEXT_MAP` (`src/server/oauth/access-token-issuer.ts:49`). The Portal-side change is tracked separately; this plan flags every place Hermes assumes that client_id is registered.

**Redirect URI handling (per Q5):** the initial design only needs to support Fly.io-hosted dashboards. The Portal will whitelist `https://*.fly.dev/auth/callback` for the `hermes-dashboard` client_id. Other deployments (custom domains, on-prem) are out of scope for v1; operators with those needs would register their own Portal OAuth client and override via config (`dashboard.auth.providers.nous.client_id`, future work).

### JWT claims expected on the access token (per Q6 — all claims in the access token, no userinfo round-trip required)

```json
{
  "iss": "https://portal.nousresearch.com",
  "sub": "<userId>",
  "aud": "hermes-cli:hermes-dashboard",
  "exp": <unix>,
  "iat": <unix>,
  "client_id": "hermes-dashboard",
  "scope": "openid profile email inference:invoke tool:invoke",
  "org_id": "<orgId>",
  "email": "<user email>",
  "email_verified": true,
  "name": "<display name>",
  "session_id": "<server-side session id; opaque>"
}
```

`org_id`, `email`, `name` are net-new to the existing Portal `access-token-issuer.ts` payload (today it carries `userId`, `orgId`, `client_id`, `aud`, `sub`, `exp`, `iat`, `session_id`, `scope`, rate-limit entitlement). Cross-repo work item: extend `issueOAuthAccessToken` to include `email`, `email_verified`, `name` when the scope includes `profile email`. The Portal already has all three fields on the `User` row, so this is purely a claim-projection change.

### JWT signing

Portal currently signs with `AUTH_SECRET` (HS256) and only opens RS256 via `OAUTH_PRIVATE_KEY` for specific paths. **Hermes will verify with the public JWKS** at `https://portal.nousresearch.com/.well-known/jwks.json` — this requires the Portal to migrate dashboard-issued tokens to RS256/JWKS. Tracked as a cross-repo prerequisite. If JWKS isn't ready by Phase 4, we fall back to validating the JWT via `GET /api/oauth/account` (a network round-trip per request, cacheable for 60s), which is correct but slower. The plan's verification module supports both modes from day one and picks based on `nous.signing_mode: jwks | userinfo`.

---

## Key Design Decisions

| # | Decision | Why |
|---|---|---|
| 1 | Auth gate ONLY when `host != loopback` AND `--insecure` not set. | Matches Q1+Q2. Loopback stays zero-friction; `--insecure` stays as escape hatch with current "no-auth" semantics; new behavior fires for any other non-loopback bind. |
| 2 | Stateless server, refresh-in-cookie. | Q9 + Q-C2. No server-side session store, but the refresh cookie lets us silently refresh expired access tokens so the dashboard survives all-day tabs. |
| 3 | `DashboardAuthProvider` is a plugin hook (`ctx.register_dashboard_auth_provider`). | Q-A. Mirrors existing plugin shapes; the Nous provider ships as `plugins/dashboard-auth-nous/` so third parties have a verbatim template. |
| 4 | Multiple stacked providers; login page lists all. | Q-D. With only Nous installed it's a one-button page. No `dashboard.auth.provider` selector — the operator chooses at login time. |
| 5 | Server-rendered `/login` / `/auth/callback` / `/auth/logout`. | Q-E (e1) + Q15. Pre-login pages must NOT load the React bundle (which would also load `window.__HERMES_SESSION_TOKEN__`). Jinja-style HTML rendered straight from FastAPI. |
| 6 | Narrow `/api/auth/providers` for the login-page bootstrap; remove `/api/status` from `_PUBLIC_API_PATHS` only when gate is active. | Q15. When gate is off (loopback), nothing changes — `/api/status` stays public for sidebar polling. When gate is on, the login HTML hits only the narrow endpoint; post-login SPA continues to read `/api/status` (now auth-gated). |
| 7 | WS auth = short-lived ticket from `/api/auth/ws-ticket`. | Browsers cannot set Authorization on WS upgrade. Tickets are random 32-byte tokens, single-use, 30-second TTL, minted only after cookie verification. Replaces `?token=<_SESSION_TOKEN>` in auth-required mode. |
| 8 | `--tui` (embedded PTY) works in gated mode. | Q11. Same ticket flow. |
| 9 | Audit log to `~/.hermes/logs/dashboard-auth.log` (JSON-lines). | Q14. One line per `login_start | login_success | login_failure | refresh_success | refresh_failure | logout | revoke`. Profile-aware path. |
| 10 | Fail-closed if zero providers are registered AND gate is active. | Q13. Loopback mode never hits this. Non-loopback mode with no provider plugins installed = `start_server` raises `SystemExit("dashboard auth gate is enabled but no auth providers are registered")`. |
| 11 | PKCE (S256) is mandatory for the authorization-code flow. | Defense-in-depth even though Portal will also enforce. |
| 12 | Cookies: `Secure` when bound on TLS, omitted otherwise. `SameSite=Lax` always. `HttpOnly` always. Path scoped to `/`. | TLS termination for Fly.io is upstream; we detect `X-Forwarded-Proto: https` to decide. |

---

## Decision Log (Open Questions resolved during planning)

| Q | Resolution |
|---|---|
| Q1 — `--insecure` semantics | Keep current "no auth, no warning" behavior. Auth gate engages only for non-loopback binds where `--insecure` was NOT passed. |
| Q2 — Loopback auth opt-in | Out of scope for v1. Punt to a future `dashboard.auth.required: true` config knob. |
| Q3 — VPS/Fly path | **Primary use case for v1.** Cross-repo Portal redirect-URI whitelist must accept `https://*.fly.dev/auth/callback`. |
| Q4 — OAuth flow | Authorization Code + PKCE (S256). |
| Q5 — Redirect URI | `https://*.fly.dev/auth/callback` wildcard for v1. Operators with other deployments register their own Portal client (future, not in v1). |
| Q6 — JWT claims | All claims in access token. Portal must extend `access-token-issuer.ts` to add `email`, `email_verified`, `name` for `profile email` scope. |
| Q7 — Other providers | Google, GitHub, OIDC, etc. Not implemented; abstraction must support them. |
| Q8 — Plugin vs in-tree | Plugin. `plugins/dashboard-auth-nous/` is the default; third parties drop in `~/.hermes/plugins/dashboard-auth-*/`. |
| Q9 — Session model | Stateless. JWT-in-cookie. |
| Q10 — Multi-user | Single user only. No per-user UI state. |
| Q11 — `--tui` interaction | Same auth applies; WS ticketing flow. |
| Q12 — Operator setup | Zero config. Baked-in `client_id=hermes-dashboard` + Portal URL. |
| Q13 — Portal down | Fail-closed. Provider plugin's `verify_session` raises → middleware returns 503 with a "Portal unreachable, try again" page. |
| Q14 — Audit log | Yes. `~/.hermes/logs/dashboard-auth.log` (JSON-lines). |
| Q15 — `/api/status` | Stays public when gate is off. When gate is on, becomes auth-gated; login HTML uses `/api/auth/providers` for bootstrap. |
| QC — Refresh strategy | Refresh-in-cookie (c2). Access token in `hermes_session_at`, refresh token in `hermes_session_rt`. Server-side `/api/auth/refresh` silently rotates both when the access token is within 60s of expiry. |
| QD — Provider selection | Multi-provider stack; login page lists all registered providers. |
| QE — Login route shape | `/auth/login`, `/auth/callback`, `/auth/logout`, server-rendered HTML. |

---

## Phases Overview

| # | Phase | Shippable on its own? | Exit gate |
|---|---|---|---|
| 0 | Regression harness + auth-gate detection skeleton | Yes (no behavior change) | All existing tests pass; new tests assert "gate is OFF in loopback mode" and "gate is ON for non-loopback w/o --insecure" |
| 1 | `DashboardAuthProvider` protocol + plugin hook + audit logger | Yes (no provider registers yet → gate fails-closed only if anyone tried to enable it) | `register_dashboard_auth_provider` works in unit test; nothing changes for the loopback dashboard |
| 2 | `plugins/dashboard-auth-nous/` provider (no Portal integration yet — uses a stub) | No (skipped in CI; bench tested w/ Portal stub) | Stub provider passes the provider protocol contract test; `/auth/login` returns a redirect to the stub |
| 3 | Auth gate middleware + cookie machinery + `/auth/*` routes + audit log | Yes for stub provider | End-to-end test: bind to `0.0.0.0` with stub provider; `GET /` redirects to `/auth/login`; complete stub OAuth round-trip; receive cookie; `GET /api/status` now 200s |
| 4 | Real Nous provider implementation (JWKS verify OR userinfo fallback) | Once Portal RS256/JWKS lands or with userinfo mode | Real OAuth round-trip against staging Portal succeeds end-to-end |
| 5 | WS ticket auth (`/api/auth/ws-ticket`) + SPA cookie identity refit + remove `window.__HERMES_SESSION_TOKEN__` injection in gated mode | Yes | `--tui` works in gated mode; `/api/pty?ticket=…` accepted; no token leaks to unauthenticated index.html |
| 6 | Refresh-in-cookie machinery (`/api/auth/refresh`, silent-refresh middleware) | Yes | Test: access token mocked to expire in 30s; subsequent request silently refreshes; cookie is rotated |
| 7 | Documentation, dashboard sidebar "Logged in as …" widget, CLI status integration | Yes | `hermes status` shows dashboard auth state; docs updated |

---

## Cross-Repo Coordination Checklist

Tracked separately from the task list; Hermes-side work is independent except where called out.

| Item | Repo | Owner | Required by Phase |
|---|---|---|---|
| Add `hermes-dashboard` to `OAUTH_CLIENT_PRODUCT_CONTEXT_MAP` | `nous-account-service` | Portal team | Phase 4 |
| Implement `GET /oauth/authorize` (browser approval UI) | `nous-account-service` | Portal team | Phase 4 |
| Extend `POST /api/oauth/token` to accept `grant_type=authorization_code` with PKCE | `nous-account-service` | Portal team | Phase 4 |
| Extend `issueOAuthAccessToken` to include `email`, `email_verified`, `name` claims when `scope` includes `profile email` | `nous-account-service` | Portal team | Phase 4 |
| Whitelist `https://*.fly.dev/auth/callback` as redirect URI for `hermes-dashboard` client | `nous-account-service` | Portal team | Phase 4 |
| (Optional, future) Publish JWKS at `/.well-known/jwks.json` and migrate dashboard tokens to RS256 | `nous-account-service` | Portal team | Phase 4 enhancement (Phase 4 ships with `signing_mode=userinfo` fallback first) |

If Portal isn't ready by Phase 4, the plugin ships with `signing_mode=userinfo` as default and switches to `jwks` once the JWKS endpoint is live. No Hermes code change needed for the swap.

---

## Open Questions (still TBD — flag at Phase 4 kickoff)

1. **Cookie domain in multi-tenant Fly setup.** Each Fly app gets its own subdomain (`hermes-agent-prod-<id>.fly.dev`). Cookies will be set scoped to that exact host with no `Domain` attribute — works for single-tenant. If we ever serve multiple Hermes dashboards from sibling subdomains and want SSO across them, revisit. Not in v1.

2. **Org selection UX.** A user with multiple orgs at Portal would today see the org_id baked into the JWT by Portal's resolution logic (probably their default org). If Portal exposes an org-selection step in `/oauth/authorize`, we get it for free. If not, the dashboard will be bound to whichever org Portal picked, and switching requires `/auth/logout` + re-login. Defer; revisit when first multi-org operator complains.

3. **Session length policy.** Refresh tokens are valid for 30 days on the Portal side today. We honor that. We do NOT add a separate Hermes-side maximum-session-age cap. If sec-eng wants one later, it goes in the audit log + a cookie expiry override.

---

## Phase 0 — Regression Harness + Gate-Detection Skeleton

**Goal:** Lock current dashboard behavior with tests, then introduce a single `should_require_auth(host, allow_public)` helper that returns `True` for non-loopback + non-`--insecure` binds. Nothing actually gates yet; this phase just installs the predicate that later phases branch on.

**Why TDD-first:** auth middleware is load-bearing infrastructure. Per `writing-plans`, infra changes need a behavioral harness against the current code before we touch anything.

### Task 0.1: Write the dashboard-auth regression harness

**Objective:** A pytest module that exercises today's `_SESSION_TOKEN` flow end-to-end against the live FastAPI app, so we can prove later phases don't regress loopback behavior.

**Files:**
- Create: `tests/hermes_cli/test_dashboard_auth_gate.py`

**Step 1: Write the harness.**

```python
"""Regression harness for the dashboard auth gate.

Phase 0 — establish a baseline pin on the current (pre-OAuth) behavior so
later phases can prove they didn't break loopback mode.
"""
import pytest
from fastapi.testclient import TestClient

from hermes_cli import web_server


@pytest.fixture
def client_loopback(monkeypatch):
    # Reset bound_host between tests
    web_server.app.state.bound_host = "127.0.0.1"
    web_server.app.state.bound_port = 9119
    return TestClient(web_server.app)


def test_loopback_status_is_public(client_loopback):
    """`/api/status` must remain reachable without a token in loopback mode."""
    r = client_loopback.get("/api/status")
    assert r.status_code == 200
    body = r.json()
    assert "version" in body


def test_loopback_protected_route_requires_token(client_loopback):
    """Any non-public /api/ route must require the session token."""
    r = client_loopback.get("/api/sessions")
    assert r.status_code == 401


def test_loopback_protected_route_accepts_session_token(client_loopback):
    """The injected SPA token unlocks protected /api/ routes."""
    r = client_loopback.get(
        "/api/sessions",
        headers={"X-Hermes-Session-Token": web_server._SESSION_TOKEN},
    )
    # 200 or 404 (no sessions yet) both prove the auth layer let it through.
    assert r.status_code in (200, 404)


def test_loopback_index_injects_session_token(client_loopback):
    """Loopback mode keeps injecting the SPA token into index.html.

    This is the property that the new auth gate MUST disable once a gated
    bind is detected. Phase 3 will add an inverse test for the gated path.
    """
    r = client_loopback.get("/")
    if r.status_code == 404:
        pytest.skip("WEB_DIST not built in this env")
    assert "__HERMES_SESSION_TOKEN__" in r.text


def test_loopback_host_header_validation_still_enforced(client_loopback):
    """DNS-rebinding protection: a foreign Host header is rejected."""
    r = client_loopback.get("/api/status", headers={"Host": "evil.test"})
    assert r.status_code == 400
```

**Step 2: Run the harness against `main`.**

```bash
scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_gate.py -v
```

**Expected:** All five tests pass (the `index` test may skip in CI if `WEB_DIST` isn't built). If any fails, STOP — current behavior was already broken and the rest of the plan rests on a wrong baseline.

**Step 3: Commit.**

```bash
git add tests/hermes_cli/test_dashboard_auth_gate.py
git commit -m "test(dashboard): pin current loopback auth behavior as regression harness"
```

### Task 0.2: Add the `should_require_auth` predicate

**Objective:** A single source of truth for "is the auth gate active?" — used by `start_server`, the middleware, and the SPA token injection.

**Files:**
- Modify: `hermes_cli/web_server.py` — add helper near the existing `_LOCALHOST` constant in `start_server`, but as a module-level function so middleware can call it.
- Test: `tests/hermes_cli/test_dashboard_auth_gate.py`

**Step 1: Write failing test.**

Append to `tests/hermes_cli/test_dashboard_auth_gate.py`:

```python
from hermes_cli.web_server import should_require_auth


@pytest.mark.parametrize("host,allow_public,expected", [
    ("127.0.0.1", False, False),
    ("127.0.0.1", True,  False),
    ("localhost", False, False),
    ("::1",       False, False),
    ("0.0.0.0",   True,  False),   # --insecure escape hatch
    ("0.0.0.0",   False, True),
    ("192.168.1.5", False, True),
    ("10.0.0.1", True,   False),
    ("100.64.0.1", False, True),   # Tailscale CGNAT — treated as public
    ("hermes-agent-prod-abc.fly.dev", False, True),
])
def test_should_require_auth_truth_table(host, allow_public, expected):
    assert should_require_auth(host, allow_public) is expected
```

**Step 2: Run, observe failure.**

```bash
scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_gate.py::test_should_require_auth_truth_table -v
```

Expected: `ImportError: cannot import name 'should_require_auth'`.

**Step 3: Add the predicate.**

Insert in `hermes_cli/web_server.py` **immediately after** the `_LOOPBACK_HOST_VALUES` definition (~line 159):

```python
_LOCALHOST_HOSTS: frozenset = frozenset({"127.0.0.1", "localhost", "::1"})


def should_require_auth(host: str, allow_public: bool) -> bool:
    """Return True iff the dashboard auth gate must be active.

    Truth table:
      host == loopback                              → False (no auth)
      host != loopback AND allow_public (--insecure)→ False (legacy escape hatch)
      host != loopback AND NOT allow_public         → True  (gate engages)

    "Loopback" matches the same set used by ``--insecure`` enforcement in
    ``start_server``: 127.0.0.1, localhost, ::1. RFC1918 / CGNAT / link-local
    are deliberately treated as PUBLIC — a hostile device on the same LAN is
    exactly the threat model the gate is designed for.
    """
    return (host not in _LOCALHOST_HOSTS) and (not allow_public)
```

**Step 4: Run, verify pass.**

```bash
scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_gate.py -v
```

Expected: all tests pass (including the new parametrized one with 10 cases).

**Step 5: Commit.**

```bash
git add hermes_cli/web_server.py tests/hermes_cli/test_dashboard_auth_gate.py
git commit -m "feat(dashboard): add should_require_auth predicate for OAuth gate"
```

### Task 0.3: Surface the gate flag on `app.state` so middleware can read it

**Objective:** Wire `should_require_auth(host, allow_public)` into `start_server` so the rest of the system has one place to ask "are we gated?"

**Files:**
- Modify: `hermes_cli/web_server.py:4514` (`start_server`)
- Test: `tests/hermes_cli/test_dashboard_auth_gate.py`

**Step 1: Write failing test.**

Append:

```python
def test_start_server_sets_auth_required_flag_on_app_state(monkeypatch):
    """``start_server`` must record auth_required so middleware can read it."""
    # Don't actually start uvicorn — patch it out and only inspect side effects.
    called = {}

    def fake_run(*args, **kwargs):
        called["host"] = kwargs.get("host")

    monkeypatch.setattr(web_server, "uvicorn", type("U", (), {"run": staticmethod(fake_run)}))
    # The "0.0.0.0 without --insecure" case currently raises SystemExit. We're
    # going to change that in Phase 3 (replace SystemExit with "gate engages"),
    # but for now the helper itself is what we're testing.
    web_server.app.state.bound_host = None
    web_server.app.state.bound_port = None
    web_server.app.state.auth_required = None

    with pytest.raises(SystemExit):
        # SystemExit is fine — we just want the state flag set before the exit.
        web_server.start_server(host="0.0.0.0", port=9119,
                                open_browser=False, allow_public=False)
    # Even though it exited, the flag must have been computed and stashed.
    assert web_server.app.state.auth_required is True


def test_start_server_loopback_does_not_set_auth_required(monkeypatch):
    monkeypatch.setattr(web_server, "uvicorn", type("U", (), {"run": staticmethod(lambda *a, **k: None)}))
    web_server.app.state.auth_required = None
    web_server.start_server(host="127.0.0.1", port=9119,
                            open_browser=False, allow_public=False)
    assert web_server.app.state.auth_required is False
```

**Step 2: Run, observe failure.**

```bash
scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_gate.py -v -k auth_required_flag
```

**Step 3: Edit `start_server` to set the flag.**

In `hermes_cli/web_server.py` `start_server`, **before** the `_LOCALHOST = (...)` check (~line 4528), insert:

```python
    app.state.auth_required = should_require_auth(host, allow_public)
```

The existing `SystemExit` branch stays for now — Phase 3 will replace it with "the gate engages" once the gate exists.

**Step 4: Run, verify pass.**

```bash
scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_gate.py -v
```

**Step 5: Commit.**

```bash
git add hermes_cli/web_server.py tests/hermes_cli/test_dashboard_auth_gate.py
git commit -m "feat(dashboard): stash auth_required flag on app.state"
```

### Phase 0 Exit Gate

```bash
scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_gate.py -v
```

All tests pass. `should_require_auth` is the single predicate. `app.state.auth_required` is the runtime flag. No behavior has changed — the SystemExit branch in `start_server` still fires for `0.0.0.0 + no --insecure`.

---

## Phase 1 — Provider Protocol + Plugin Hook + Audit Logger

**Goal:** Define the `DashboardAuthProvider` ABC + registry, the `ctx.register_dashboard_auth_provider` plugin hook, and the audit logger. No HTTP routes yet — pure plumbing.

**Why this comes before the gate:** the gate's middleware delegates to providers. We can't write the middleware without a provider contract to mock.

### Task 1.1: Define `DashboardAuthProvider` ABC + `Session` dataclass

**Objective:** A minimal protocol every auth provider implements, plus the dataclass representing a verified session.

**Files:**
- Create: `hermes_cli/dashboard_auth/__init__.py`
- Create: `hermes_cli/dashboard_auth/base.py`
- Create: `tests/hermes_cli/test_dashboard_auth_provider_base.py`

**Step 1: Write the failing protocol test.**

```python
# tests/hermes_cli/test_dashboard_auth_provider_base.py
"""Contract test for DashboardAuthProvider implementations.

Every provider plugin should import and call ``assert_protocol_compliance``
on its provider instance in its own unit test. This module also tests the
abstract base raises on missing methods so the contract is enforced.
"""
import pytest

from hermes_cli.dashboard_auth.base import (
    DashboardAuthProvider,
    Session,
    LoginStart,
    assert_protocol_compliance,
)


def test_session_has_required_fields():
    s = Session(
        user_id="u1",
        email="a@b.com",
        display_name="A",
        org_id="org_1",
        provider="test",
        expires_at=1234567890,
        access_token="at",
        refresh_token="rt",
    )
    assert s.user_id == "u1"
    assert s.provider == "test"


def test_login_start_has_redirect_and_state():
    ls = LoginStart(
        redirect_url="https://portal/authorize?...",
        cookie_payload={"hermes_session_pkce": "verifier=abc;state=xyz"},
    )
    assert ls.redirect_url.startswith("https://")
    assert "hermes_session_pkce" in ls.cookie_payload


def test_abstract_provider_cannot_be_instantiated():
    with pytest.raises(TypeError):
        DashboardAuthProvider()


class _BrokenProvider(DashboardAuthProvider):
    name = "broken"
    display_name = "Broken"
    # Deliberately missing all the methods.


def test_assert_protocol_compliance_rejects_partial_impl():
    with pytest.raises(TypeError):
        assert_protocol_compliance(_BrokenProvider)


class _CompliantProvider(DashboardAuthProvider):
    name = "ok"
    display_name = "OK"

    def start_login(self, *, redirect_uri: str) -> LoginStart:
        return LoginStart(redirect_url="x", cookie_payload={})

    def complete_login(self, *, code, state, code_verifier, redirect_uri) -> Session:
        return Session(
            user_id="u", email="x", display_name="x", org_id="o",
            provider=self.name, expires_at=0,
            access_token="a", refresh_token="r",
        )

    def verify_session(self, *, access_token: str) -> Session | None:
        return None

    def refresh_session(self, *, refresh_token: str) -> Session:
        return Session(
            user_id="u", email="x", display_name="x", org_id="o",
            provider=self.name, expires_at=0,
            access_token="a", refresh_token="r",
        )

    def revoke_session(self, *, refresh_token: str) -> None:
        return None


def test_assert_protocol_compliance_accepts_full_impl():
    assert_protocol_compliance(_CompliantProvider) is None
```

**Step 2: Run, observe failure.**

```bash
scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_provider_base.py -v
```

Expected: `ImportError: No module named 'hermes_cli.dashboard_auth'`.

**Step 3: Write the base module.**

```python
# hermes_cli/dashboard_auth/__init__.py
"""Dashboard authentication provider framework.

The dashboard auth gate engages only when the dashboard binds to a non-loopback
host without ``--insecure``. In that mode, every request must carry a verified
session from one of the registered ``DashboardAuthProvider`` plugins.

The Nous provider lives in ``plugins/dashboard-auth-nous/`` and is the default.
Third parties register their own providers via the plugin hook
``ctx.register_dashboard_auth_provider``.
"""
from hermes_cli.dashboard_auth.base import (
    DashboardAuthProvider,
    Session,
    LoginStart,
    assert_protocol_compliance,
)
from hermes_cli.dashboard_auth.registry import (
    register_provider,
    get_provider,
    list_providers,
    clear_providers,
)

__all__ = [
    "DashboardAuthProvider",
    "Session",
    "LoginStart",
    "assert_protocol_compliance",
    "register_provider",
    "get_provider",
    "list_providers",
    "clear_providers",
]
```

```python
# hermes_cli/dashboard_auth/base.py
"""Abstract base + dataclasses for dashboard auth providers."""
from __future__ import annotations

from abc import ABC, abstractmethod
from dataclasses import dataclass
from typing import Optional


@dataclass(frozen=True)
class Session:
    """A verified identity. Returned by ``complete_login`` and ``verify_session``.

    All fields are mandatory. Providers that don't have a concept of orgs
    should set ``org_id`` to an empty string. ``access_token`` and
    ``refresh_token`` are opaque to Hermes — provider-specific.
    """
    user_id: str
    email: str
    display_name: str
    org_id: str
    provider: str
    expires_at: int  # unix seconds; the access_token's exp claim
    access_token: str
    refresh_token: str


@dataclass(frozen=True)
class LoginStart:
    """First leg of the OAuth round trip.

    ``redirect_url`` is the URL the browser must navigate to (e.g. the
    Portal's ``/oauth/authorize``). ``cookie_payload`` is a dict of cookie
    name → serialised value that the auth route will Set-Cookie on the
    response. Used for PKCE state, CSRF nonces, etc. Cookies set here MUST
    be HttpOnly Secure SameSite=Lax and TTL ≤ 10 minutes (login lifetime).
    """
    redirect_url: str
    cookie_payload: dict[str, str]


class DashboardAuthProvider(ABC):
    """Protocol every dashboard-auth provider plugin implements.

    Lifecycle:
      1. ``start_login`` — user clicks "Log in with X" on the login page.
         Provider returns a redirect URL and any PKCE/CSRF state to stash
         in short-lived cookies.
      2. Browser bounces through the OAuth IDP and lands at /auth/callback.
      3. ``complete_login`` — exchange the code + verifier for a Session.
      4. ``verify_session`` — called on every request to validate the access
         token in the cookie. Returns ``None`` if the token is expired or
         invalid (middleware then triggers refresh or logout).
      5. ``refresh_session`` — called when the access token is near expiry.
         Returns a new Session with rotated tokens.
      6. ``revoke_session`` — called on /auth/logout. Best-effort.

    Failure semantics:
      * ``start_login`` may raise ``ProviderError`` if the IDP is unreachable.
      * ``complete_login`` raises ``InvalidCodeError`` on bad code/state.
      * ``verify_session`` returns ``None`` on expiry; raises ``ProviderError``
        on IDP-unreachable. The middleware treats expiry and unreachable
        differently (expiry → refresh; unreachable → 503).
      * ``refresh_session`` raises ``RefreshExpiredError`` when the refresh
        token is also invalid; middleware then forces re-login.
    """
    name: str = ""
    display_name: str = ""

    @abstractmethod
    def start_login(self, *, redirect_uri: str) -> LoginStart: ...

    @abstractmethod
    def complete_login(
        self,
        *,
        code: str,
        state: str,
        code_verifier: str,
        redirect_uri: str,
    ) -> Session: ...

    @abstractmethod
    def verify_session(self, *, access_token: str) -> Optional[Session]: ...

    @abstractmethod
    def refresh_session(self, *, refresh_token: str) -> Session: ...

    @abstractmethod
    def revoke_session(self, *, refresh_token: str) -> None: ...


class ProviderError(Exception):
    """IDP unreachable, network error, etc. Middleware → 503."""


class InvalidCodeError(Exception):
    """The OAuth callback code/state didn't validate. Middleware → 400."""


class RefreshExpiredError(Exception):
    """Refresh token is dead. Middleware forces re-login (clears cookies, 302 → /auth/login)."""


def assert_protocol_compliance(cls) -> None:
    """Raise TypeError if ``cls`` doesn't implement the full provider protocol.

    Call this in every provider plugin's unit tests:

      def test_protocol_compliance():
          assert_protocol_compliance(MyProvider)
    """
    required_methods = (
        "start_login",
        "complete_login",
        "verify_session",
        "refresh_session",
        "revoke_session",
    )
    required_attrs = ("name", "display_name")

    for attr in required_attrs:
        val = getattr(cls, attr, "")
        if not val:
            raise TypeError(
                f"{cls.__name__} missing or empty attribute: {attr!r}"
            )
    for method in required_methods:
        if not callable(getattr(cls, method, None)):
            raise TypeError(
                f"{cls.__name__} missing method: {method}"
            )
    # Also catch the ABC-not-overridden case
    if getattr(cls, "__abstractmethods__", None):
        raise TypeError(
            f"{cls.__name__} has unimplemented abstract methods: "
            f"{sorted(cls.__abstractmethods__)}"
        )
```

**Step 4: Run, verify pass.**

```bash
scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_provider_base.py -v
```

All 6 tests should pass.

**Step 5: Commit.**

```bash
git add hermes_cli/dashboard_auth/ tests/hermes_cli/test_dashboard_auth_provider_base.py
git commit -m "feat(dashboard-auth): define DashboardAuthProvider ABC + Session dataclass"
```

### Task 1.2: Provider registry

**Objective:** A module-level dict of `name → provider` with register/get/list. Mirrors `agent/image_gen_registry.py` (see `register_provider` at the existing image-gen one for the prior art).

**Files:**
- Create: `hermes_cli/dashboard_auth/registry.py`
- Modify: `tests/hermes_cli/test_dashboard_auth_provider_base.py`

**Step 1: Write failing test.**

Append to `tests/hermes_cli/test_dashboard_auth_provider_base.py`:

```python
from hermes_cli.dashboard_auth import (
    register_provider,
    get_provider,
    list_providers,
    clear_providers,
)


@pytest.fixture(autouse=True)
def _isolated_registry():
    clear_providers()
    yield
    clear_providers()


def test_registry_register_and_get(_isolated_registry=None):
    p = _CompliantProvider()
    register_provider(p)
    assert get_provider("ok") is p


def test_registry_get_missing_returns_none(_isolated_registry=None):
    assert get_provider("nope") is None


def test_registry_lists_in_registration_order(_isolated_registry=None):
    class A(_CompliantProvider): name = "a"
    class B(_CompliantProvider): name = "b"
    register_provider(A())
    register_provider(B())
    names = [p.name for p in list_providers()]
    assert names == ["a", "b"]


def test_registry_rejects_non_compliant_provider(_isolated_registry=None):
    with pytest.raises(TypeError):
        register_provider(_BrokenProvider())


def test_registry_rejects_duplicate_name(_isolated_registry=None):
    register_provider(_CompliantProvider())
    with pytest.raises(ValueError, match="already registered"):
        register_provider(_CompliantProvider())
```

**Step 2: Run, observe failure.**

```bash
scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_provider_base.py -v -k registry
```

**Step 3: Write the registry.**

```python
# hermes_cli/dashboard_auth/registry.py
"""Module-level registry for DashboardAuthProvider instances.

Plugins call ``register_provider`` via the plugin context hook at startup.
The auth gate middleware iterates ``list_providers()`` and uses ``get_provider``
to dispatch on the session's ``provider`` field.
"""
from __future__ import annotations

import logging
import threading
from typing import List, Optional

from hermes_cli.dashboard_auth.base import (
    DashboardAuthProvider,
    assert_protocol_compliance,
)

_log = logging.getLogger(__name__)
_lock = threading.Lock()
_providers: dict[str, DashboardAuthProvider] = {}


def register_provider(provider: DashboardAuthProvider) -> None:
    """Register a provider. Raises TypeError on protocol violation, ValueError on duplicate name."""
    assert_protocol_compliance(type(provider))
    with _lock:
        if provider.name in _providers:
            raise ValueError(
                f"dashboard-auth provider already registered: {provider.name!r}"
            )
        _providers[provider.name] = provider
    _log.info("dashboard-auth: registered provider %r (%s)",
              provider.name, provider.display_name)


def get_provider(name: str) -> Optional[DashboardAuthProvider]:
    with _lock:
        return _providers.get(name)


def list_providers() -> List[DashboardAuthProvider]:
    """All registered providers, in registration order."""
    with _lock:
        return list(_providers.values())


def clear_providers() -> None:
    """Test-only: drop all registrations."""
    with _lock:
        _providers.clear()
```

**Step 4: Run, verify pass.**

```bash
scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_provider_base.py -v
```

**Step 5: Commit.**

```bash
git add hermes_cli/dashboard_auth/registry.py tests/hermes_cli/test_dashboard_auth_provider_base.py
git commit -m "feat(dashboard-auth): registry for DashboardAuthProvider plugins"
```

### Task 1.3: Plugin hook — `ctx.register_dashboard_auth_provider`

**Objective:** Add the method to `PluginContext` so plugins can register providers from their `register(ctx)` entry point.

**Files:**
- Modify: `hermes_cli/plugins.py` — add a new method on `PluginContext` (~line 556 region, after `register_image_gen_provider`).
- Test: `tests/hermes_cli/test_dashboard_auth_plugin_hook.py`

**Step 1: Write failing test.**

```python
# tests/hermes_cli/test_dashboard_auth_plugin_hook.py
"""The plugin context exposes register_dashboard_auth_provider.

Mirrors the image-gen / memory-provider hooks. See plugins.py:531 for prior art.
"""
import pytest
from hermes_cli.dashboard_auth import clear_providers, get_provider
from hermes_cli.dashboard_auth.base import (
    DashboardAuthProvider, Session, LoginStart,
)


@pytest.fixture(autouse=True)
def _isolated():
    clear_providers()
    yield
    clear_providers()


class _Stub(DashboardAuthProvider):
    name = "stub"
    display_name = "Stub IdP"
    def start_login(self, *, redirect_uri): return LoginStart(redirect_url="x", cookie_payload={})
    def complete_login(self, **kw): return Session("u", "e", "n", "o", "stub", 0, "a", "r")
    def verify_session(self, **kw): return None
    def refresh_session(self, **kw): return Session("u", "e", "n", "o", "stub", 0, "a", "r")
    def revoke_session(self, **kw): pass


def test_plugin_ctx_can_register_dashboard_auth_provider(tmp_path):
    from hermes_cli.plugins import PluginContext, PluginManifest
    manifest = PluginManifest(name="dashboard-auth-stub", version="0.0.1",
                              description="stub", path=tmp_path)
    # PluginManager is the parent of PluginContext; minimal shim for the test
    class _Manager:
        _cli_ref = None
        _context_engine = None
        _tools = {}
    ctx = PluginContext(manifest=manifest, manager=_Manager())
    assert hasattr(ctx, "register_dashboard_auth_provider")
    ctx.register_dashboard_auth_provider(_Stub())
    assert get_provider("stub").display_name == "Stub IdP"


def test_plugin_ctx_rejects_non_provider(tmp_path):
    from hermes_cli.plugins import PluginContext, PluginManifest
    manifest = PluginManifest(name="bad", version="0.0.1", description="", path=tmp_path)
    class _Manager:
        _cli_ref = None
        _context_engine = None
        _tools = {}
    ctx = PluginContext(manifest=manifest, manager=_Manager())
    # Pass something that's not a DashboardAuthProvider; expect a warning log
    # and the registry stays empty (mirrors the image_gen behaviour).
    import logging
    with pytest.raises(Exception):
        ctx.register_dashboard_auth_provider("not a provider")
    assert get_provider("stub") is None
```

**Step 2: Run, observe failure.**

```bash
scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_plugin_hook.py -v
```

**Step 3: Add the method to `PluginContext`.**

In `hermes_cli/plugins.py`, **after** `register_image_gen_provider` (~line 554, before `register_video_gen_provider`):

```python
    # -- dashboard auth provider registration --------------------------------

    def register_dashboard_auth_provider(self, provider) -> None:
        """Register a dashboard authentication provider.

        ``provider`` must be an instance of
        :class:`hermes_cli.dashboard_auth.DashboardAuthProvider`. Used by
        the dashboard auth gate (engaged when the dashboard binds to a
        non-loopback host without ``--insecure``).
        """
        from hermes_cli.dashboard_auth import (
            DashboardAuthProvider, register_provider,
        )

        if not isinstance(provider, DashboardAuthProvider):
            logger.warning(
                "Plugin %r tried to register a dashboard-auth provider that "
                "does not inherit from DashboardAuthProvider. Ignoring.",
                self.manifest.name,
            )
            raise TypeError(
                "register_dashboard_auth_provider expects a "
                "DashboardAuthProvider instance"
            )
        register_provider(provider)
        logger.info(
            "Plugin %r registered dashboard-auth provider: %s (%s)",
            self.manifest.name, provider.name, provider.display_name,
        )
```

**Step 4: Run, verify pass.**

```bash
scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_plugin_hook.py -v
```

**Step 5: Commit.**

```bash
git add hermes_cli/plugins.py tests/hermes_cli/test_dashboard_auth_plugin_hook.py
git commit -m "feat(plugins): add register_dashboard_auth_provider hook on PluginContext"
```

### Task 1.4: Audit logger

**Objective:** Profile-aware JSON-lines log at `~/.hermes/logs/dashboard-auth.log`, one line per auth event. Used by the middleware (Phase 3) and `/auth/*` routes (Phase 3).

**Files:**
- Create: `hermes_cli/dashboard_auth/audit.py`
- Create: `tests/hermes_cli/test_dashboard_auth_audit.py`

**Step 1: Write failing test.**

```python
# tests/hermes_cli/test_dashboard_auth_audit.py
import json
import pytest

from hermes_cli.dashboard_auth.audit import audit_log, AuditEvent


@pytest.fixture
def profile_home(tmp_path, monkeypatch):
    home = tmp_path / ".hermes"
    home.mkdir()
    monkeypatch.setattr("pathlib.Path.home", lambda: tmp_path)
    monkeypatch.setenv("HERMES_HOME", str(home))
    yield home


def test_audit_writes_jsonlines(profile_home):
    audit_log(AuditEvent.LOGIN_START, provider="nous", ip="1.2.3.4")
    audit_log(AuditEvent.LOGIN_SUCCESS, provider="nous", user_id="u1",
              email="a@b.com", ip="1.2.3.4")

    path = profile_home / "logs" / "dashboard-auth.log"
    assert path.exists(), f"audit log not created at {path}"
    lines = path.read_text().strip().splitlines()
    assert len(lines) == 2

    entry = json.loads(lines[1])
    assert entry["event"] == "login_success"
    assert entry["provider"] == "nous"
    assert entry["user_id"] == "u1"
    assert entry["email"] == "a@b.com"
    assert "ts" in entry  # ISO-8601 timestamp


def test_audit_redacts_token_like_values(profile_home):
    audit_log(AuditEvent.LOGIN_SUCCESS, provider="nous", access_token="should-not-appear")
    entry = json.loads((profile_home / "logs" / "dashboard-auth.log").read_text())
    # Tokens must NEVER end up in the audit log raw. The function should
    # either drop them or replace with "<redacted>".
    assert "should-not-appear" not in json.dumps(entry)


def test_audit_all_event_types_have_string_values(profile_home):
    for ev in AuditEvent:
        assert isinstance(ev.value, str)
        assert ev.value
```

**Step 2: Run, observe failure.**

```bash
scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_audit.py -v
```

**Step 3: Implement.**

```python
# hermes_cli/dashboard_auth/audit.py
"""Audit log for dashboard auth events.

Profile-aware location: ``$HERMES_HOME/logs/dashboard-auth.log``.
Format: one JSON object per line. Token-like fields are stripped before
serialisation to avoid leaking refresh tokens or JWTs to disk.
"""
from __future__ import annotations

import datetime as _dt
import enum
import json
import logging
import os
import threading
from pathlib import Path
from typing import Any

_log = logging.getLogger(__name__)
_write_lock = threading.Lock()

# Field names that must never appear in the log raw. Any kwarg matching
# these is silently dropped.
_REDACTED_FIELDS = frozenset({
    "access_token", "refresh_token", "code", "code_verifier",
    "state", "ticket", "cookie", "Authorization", "authorization",
})


class AuditEvent(enum.Enum):
    LOGIN_START = "login_start"
    LOGIN_SUCCESS = "login_success"
    LOGIN_FAILURE = "login_failure"
    LOGOUT = "logout"
    REFRESH_SUCCESS = "refresh_success"
    REFRESH_FAILURE = "refresh_failure"
    REVOKE = "revoke"
    SESSION_VERIFY_FAILURE = "session_verify_failure"
    WS_TICKET_MINTED = "ws_ticket_minted"


def _resolve_log_path() -> Path:
    """Resolve $HERMES_HOME/logs/dashboard-auth.log without importing hermes_constants.

    Mirrors ``hermes_constants.get_hermes_home`` semantics: env var wins, else
    ``~/.hermes``. Keeping a local copy avoids an import cycle from the
    middleware which lives below hermes_cli.
    """
    home = os.environ.get("HERMES_HOME") or str(Path.home() / ".hermes")
    return Path(home) / "logs" / "dashboard-auth.log"


def audit_log(event: AuditEvent, **fields: Any) -> None:
    """Append one event to the audit log.

    Token-like fields are dropped. Missing log directory is created.
    Write failures are logged at WARNING but never raise — auth must not
    fail because the audit logger broke.
    """
    safe_fields = {
        k: v for k, v in fields.items()
        if k not in _REDACTED_FIELDS
    }
    entry = {
        "ts": _dt.datetime.now(_dt.timezone.utc).isoformat(),
        "event": event.value,
        **safe_fields,
    }
    line = json.dumps(entry, separators=(",", ":")) + "\n"
    path = _resolve_log_path()
    try:
        path.parent.mkdir(parents=True, exist_ok=True)
        with _write_lock:
            with open(path, "a", encoding="utf-8") as f:
                f.write(line)
    except Exception as e:
        _log.warning("dashboard-auth audit log write failed: %s", e)
```

**Step 4: Run, verify pass.**

```bash
scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_audit.py -v
```

**Step 5: Commit.**

```bash
git add hermes_cli/dashboard_auth/audit.py tests/hermes_cli/test_dashboard_auth_audit.py
git commit -m "feat(dashboard-auth): json-lines audit log at \$HERMES_HOME/logs/dashboard-auth.log"
```

### Phase 1 Exit Gate

```bash
scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_provider_base.py tests/hermes_cli/test_dashboard_auth_plugin_hook.py tests/hermes_cli/test_dashboard_auth_audit.py -v
```

All tests pass. `DashboardAuthProvider`, registry, plugin hook, and audit logger exist. Loopback dashboard behavior is unchanged.

---

## Phase 2 — Stub Provider for End-to-End Local Testing

**Goal:** A self-contained "no-IDP-needed" provider that completes a fake OAuth round trip locally. Lets Phase 3 (the gate + routes) be tested end-to-end without depending on either Portal staging or the real Nous plugin. Lives in the test tree only; never registered in production code paths.

**Why a stub before the real Nous provider:** decouples middleware development from cross-repo Portal coordination. Phase 4 swaps the stub for the real provider; nothing in the middleware changes.

### Task 2.1: Implement the stub provider

**Objective:** A `StubAuthProvider` that returns a fixed redirect URL, accepts any code, and issues a deterministic Session. Used in `tests/hermes_cli/test_dashboard_auth_gate_e2e.py` (Phase 3).

**Files:**
- Create: `tests/hermes_cli/conftest_dashboard_auth.py` — shared fixtures + the stub class.
- Create: `tests/hermes_cli/test_dashboard_auth_stub_provider.py` — protocol-compliance test for the stub.

**Step 1: Write the contract test.**

```python
# tests/hermes_cli/test_dashboard_auth_stub_provider.py
"""Stub provider exists for E2E gate testing. Validate it against the protocol."""
import pytest
from hermes_cli.dashboard_auth.base import assert_protocol_compliance
from tests.hermes_cli.conftest_dashboard_auth import StubAuthProvider


def test_stub_complies_with_protocol():
    assert_protocol_compliance(StubAuthProvider) is None


def test_stub_start_login_returns_callback_redirect():
    p = StubAuthProvider()
    ls = p.start_login(redirect_uri="https://x.fly.dev/auth/callback")
    # Stub bounces straight back to the callback with a fake code.
    assert "code=stub_code" in ls.redirect_url
    assert "state=" in ls.redirect_url
    assert "hermes_session_pkce" in ls.cookie_payload


def test_stub_complete_login_with_matching_state_succeeds():
    p = StubAuthProvider()
    ls = p.start_login(redirect_uri="https://x.fly.dev/auth/callback")
    # Pull the state and verifier out of cookie_payload
    payload = dict(item.split("=", 1) for item in
                   ls.cookie_payload["hermes_session_pkce"].split(";"))
    sess = p.complete_login(
        code="stub_code", state=payload["state"],
        code_verifier=payload["verifier"],
        redirect_uri="https://x.fly.dev/auth/callback",
    )
    assert sess.user_id == "stub-user-1"
    assert sess.email == "stub@example.test"
    assert sess.provider == "stub"


def test_stub_complete_login_rejects_mismatched_state():
    from hermes_cli.dashboard_auth.base import InvalidCodeError
    p = StubAuthProvider()
    with pytest.raises(InvalidCodeError):
        p.complete_login(code="stub_code", state="WRONG",
                         code_verifier="v", redirect_uri="https://x.fly.dev/auth/callback")


def test_stub_verify_session_round_trips():
    p = StubAuthProvider()
    ls = p.start_login(redirect_uri="https://x.fly.dev/auth/callback")
    payload = dict(item.split("=", 1) for item in
                   ls.cookie_payload["hermes_session_pkce"].split(";"))
    sess = p.complete_login(code="stub_code", state=payload["state"],
                            code_verifier=payload["verifier"],
                            redirect_uri="https://x.fly.dev/auth/callback")
    verified = p.verify_session(access_token=sess.access_token)
    assert verified is not None
    assert verified.user_id == "stub-user-1"


def test_stub_verify_expired_session_returns_none():
    p = StubAuthProvider(default_ttl=0)
    ls = p.start_login(redirect_uri="https://x/auth/callback")
    payload = dict(item.split("=", 1) for item in
                   ls.cookie_payload["hermes_session_pkce"].split(";"))
    sess = p.complete_login(code="stub_code", state=payload["state"],
                            code_verifier=payload["verifier"],
                            redirect_uri="https://x/auth/callback")
    assert p.verify_session(access_token=sess.access_token) is None
```

**Step 2: Run, observe failure.**

```bash
scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_stub_provider.py -v
```

**Step 3: Implement the stub.**

```python
# tests/hermes_cli/conftest_dashboard_auth.py
"""Stub auth provider + shared fixtures for dashboard-auth tests.

This file is import-only — does NOT register the stub globally. Each test
that needs the stub imports ``StubAuthProvider`` and registers it through
a fixture so the registry stays isolated.
"""
from __future__ import annotations

import json
import secrets
import time
import base64
import hmac
import hashlib

from hermes_cli.dashboard_auth.base import (
    DashboardAuthProvider, Session, LoginStart,
    InvalidCodeError, ProviderError, RefreshExpiredError,
)


_STUB_SECRET = b"stub-test-secret-not-for-prod"


def _sign(payload: dict) -> str:
    """Produce a tamper-evident opaque token. Not a real JWT — just enough to round-trip."""
    raw = json.dumps(payload, separators=(",", ":")).encode()
    sig = hmac.new(_STUB_SECRET, raw, hashlib.sha256).digest()
    return base64.urlsafe_b64encode(raw + b"." + sig).decode()


def _unsign(token: str) -> dict | None:
    try:
        blob = base64.urlsafe_b64decode(token.encode())
        raw, sig = blob.rsplit(b".", 1)
        expected = hmac.new(_STUB_SECRET, raw, hashlib.sha256).digest()
        if not hmac.compare_digest(sig, expected):
            return None
        return json.loads(raw)
    except Exception:
        return None


class StubAuthProvider(DashboardAuthProvider):
    """Local fake IDP for E2E tests.

    ``start_login`` returns a redirect to ``{redirect_uri}?code=stub_code&state={s}``
    so the test harness can do the whole round trip in-process without
    talking to anything external.

    ``access_token`` is an HMAC-signed JSON blob; ``verify_session`` decodes
    and checks ``expires_at``.
    """
    name = "stub"
    display_name = "Stub IdP (test only)"

    def __init__(self, default_ttl: int = 3600):
        self._default_ttl = default_ttl
        self._state_to_verifier: dict[str, str] = {}

    def start_login(self, *, redirect_uri: str) -> LoginStart:
        state = secrets.token_urlsafe(16)
        verifier = secrets.token_urlsafe(32)
        self._state_to_verifier[state] = verifier
        return LoginStart(
            redirect_url=f"{redirect_uri}?code=stub_code&state={state}",
            cookie_payload={
                "hermes_session_pkce": f"state={state};verifier={verifier}",
            },
        )

    def complete_login(self, *, code, state, code_verifier, redirect_uri) -> Session:
        if code != "stub_code":
            raise InvalidCodeError(f"stub expects code='stub_code', got {code!r}")
        expected_verifier = self._state_to_verifier.get(state)
        if expected_verifier is None or expected_verifier != code_verifier:
            raise InvalidCodeError(f"stub state/verifier mismatch")
        del self._state_to_verifier[state]
        now = int(time.time())
        return Session(
            user_id="stub-user-1",
            email="stub@example.test",
            display_name="Stub User",
            org_id="stub-org-1",
            provider=self.name,
            expires_at=now + self._default_ttl,
            access_token=_sign({
                "sub": "stub-user-1", "email": "stub@example.test",
                "name": "Stub User", "org_id": "stub-org-1",
                "exp": now + self._default_ttl,
            }),
            refresh_token=_sign({
                "sub": "stub-user-1", "kind": "refresh",
                "exp": now + 30 * 86400,
            }),
        )

    def verify_session(self, *, access_token: str):
        payload = _unsign(access_token)
        if payload is None or payload.get("exp", 0) < int(time.time()):
            return None
        return Session(
            user_id=payload["sub"],
            email=payload["email"],
            display_name=payload["name"],
            org_id=payload["org_id"],
            provider=self.name,
            expires_at=payload["exp"],
            access_token=access_token,
            refresh_token="",  # not surfaced on verify
        )

    def refresh_session(self, *, refresh_token: str) -> Session:
        payload = _unsign(refresh_token)
        if payload is None or payload.get("exp", 0) < int(time.time()):
            raise RefreshExpiredError("stub refresh token expired/invalid")
        now = int(time.time())
        return Session(
            user_id=payload["sub"],
            email="stub@example.test",
            display_name="Stub User",
            org_id="stub-org-1",
            provider=self.name,
            expires_at=now + self._default_ttl,
            access_token=_sign({
                "sub": payload["sub"], "email": "stub@example.test",
                "name": "Stub User", "org_id": "stub-org-1",
                "exp": now + self._default_ttl,
            }),
            refresh_token=_sign({
                "sub": payload["sub"], "kind": "refresh",
                "exp": now + 30 * 86400,
            }),
        )

    def revoke_session(self, *, refresh_token: str) -> None:
        # Stub is in-memory; nothing to revoke server-side.
        return None
```

**Step 4: Run, verify pass.**

```bash
scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_stub_provider.py -v
```

All 6 tests should pass.

**Step 5: Commit.**

```bash
git add tests/hermes_cli/conftest_dashboard_auth.py tests/hermes_cli/test_dashboard_auth_stub_provider.py
git commit -m "test(dashboard-auth): stub auth provider for E2E gate testing"
```

### Phase 2 Exit Gate

The stub provider is a fully-conformant `DashboardAuthProvider`. It can be registered in any test that needs to exercise the auth gate end-to-end without external dependencies. Phase 3 will use it as the test driver.

---

## Phase 3 — Auth Gate Middleware, Cookies, `/auth/*` Routes, Login HTML

**Goal:** The actual gate. When `app.state.auth_required is True`:
- Every request to `/api/*` (except a narrow allowlist) and every HTML page (except `/auth/*` and `/login`) requires a valid session cookie.
- `GET /login` serves a server-rendered HTML page listing every registered provider.
- `GET /auth/login?provider=<name>` calls `provider.start_login(...)`, sets the PKCE state cookie, and 302s to the IDP.
- `GET /auth/callback?code&state` calls `provider.complete_login(...)`, sets the session cookies, and 302s to `/`.
- `POST /auth/logout` clears cookies, calls `provider.revoke_session(...)`, redirects to `/login`.
- `GET /api/auth/providers` (public when gate is on) — list providers for the login page bootstrap.
- `GET /api/auth/me` (auth-required) — return the verified Session as JSON for the SPA.
- `index.html` token injection is suppressed when `app.state.auth_required is True`.
- `_PUBLIC_API_PATHS` is narrowed when the gate is on: `/api/auth/providers` is added, `/api/status` is removed.

**Why this is one phase:** these pieces are mutually-dependent (middleware can't be tested without routes; routes can't be tested without cookies; cookies can't be tested without the middleware). They land in one phase, behind tests, with the stub provider as the driver.

### Task 3.1: Cookie machinery

**Objective:** Helper functions that set/clear/read the three cookies (`hermes_session_at`, `hermes_session_rt`, `hermes_session_pkce`) consistently. Centralised so every code path agrees on flags.

**Files:**
- Create: `hermes_cli/dashboard_auth/cookies.py`
- Create: `tests/hermes_cli/test_dashboard_auth_cookies.py`

**Step 1: Write failing test.**

```python
# tests/hermes_cli/test_dashboard_auth_cookies.py
import pytest
from fastapi import FastAPI
from fastapi.responses import Response
from fastapi.testclient import TestClient

from hermes_cli.dashboard_auth.cookies import (
    set_session_cookies, clear_session_cookies,
    set_pkce_cookie, clear_pkce_cookie,
    read_session_cookies, read_pkce_cookie,
    SESSION_AT_COOKIE, SESSION_RT_COOKIE, PKCE_COOKIE,
)


def _build_app():
    app = FastAPI()

    @app.get("/set")
    def set_endpoint(request):
        r = Response("ok")
        set_session_cookies(r, access_token="AT", refresh_token="RT",
                            access_token_expires_in=3600, use_https=True)
        return r

    @app.get("/set-pkce")
    def set_pkce(request):
        r = Response("ok")
        set_pkce_cookie(r, payload="state=s;verifier=v", use_https=True)
        return r

    @app.get("/clear")
    def clear(request):
        r = Response("ok")
        clear_session_cookies(r)
        clear_pkce_cookie(r)
        return r

    return app


def test_session_cookies_are_httponly_samesite_lax_secure_in_https():
    app = _build_app()
    client = TestClient(app)
    r = client.get("/set")
    cookies = r.headers.get_list("set-cookie")
    at = next(c for c in cookies if c.startswith(f"{SESSION_AT_COOKIE}="))
    rt = next(c for c in cookies if c.startswith(f"{SESSION_RT_COOKIE}="))
    for c in (at, rt):
        assert "HttpOnly" in c
        assert "SameSite=lax" in c.lower() or "SameSite=Lax" in c
        assert "Secure" in c
        assert "Path=/" in c


def test_session_cookies_omit_secure_when_http(monkeypatch):
    app = FastAPI()

    @app.get("/x")
    def x():
        r = Response("ok")
        set_session_cookies(r, access_token="AT", refresh_token="RT",
                            access_token_expires_in=3600, use_https=False)
        return r

    r = TestClient(app).get("/x")
    for c in r.headers.get_list("set-cookie"):
        if c.startswith(f"{SESSION_AT_COOKIE}=") or c.startswith(f"{SESSION_RT_COOKIE}="):
            assert "Secure" not in c, f"Cookie unexpectedly Secure: {c}"


def test_clear_session_cookies_emits_expired_at_and_rt():
    app = _build_app()
    r = TestClient(app).get("/clear")
    cookies = r.headers.get_list("set-cookie")
    assert any(c.startswith(f"{SESSION_AT_COOKIE}=") and "Max-Age=0" in c for c in cookies)
    assert any(c.startswith(f"{SESSION_RT_COOKIE}=") and "Max-Age=0" in c for c in cookies)


def test_pkce_cookie_short_ttl_and_path_root():
    app = _build_app()
    r = TestClient(app).get("/set-pkce")
    c = next(x for x in r.headers.get_list("set-cookie") if x.startswith(f"{PKCE_COOKIE}="))
    assert "HttpOnly" in c
    assert "Max-Age=600" in c  # 10 minutes
    assert "Path=/" in c


def test_read_session_cookies_from_request(monkeypatch):
    from starlette.requests import Request
    scope = {
        "type": "http",
        "headers": [(b"cookie", f"{SESSION_AT_COOKIE}=at_value; {SESSION_RT_COOKIE}=rt_value".encode())],
    }
    req = Request(scope)
    at, rt = read_session_cookies(req)
    assert at == "at_value"
    assert rt == "rt_value"


def test_read_session_cookies_missing_returns_none():
    from starlette.requests import Request
    req = Request({"type": "http", "headers": []})
    assert read_session_cookies(req) == (None, None)
```

**Step 2: Run, observe failure.**

```bash
scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_cookies.py -v
```

**Step 3: Implement.**

```python
# hermes_cli/dashboard_auth/cookies.py
"""Cookie helpers for dashboard auth.

Three cookies in play:
  - hermes_session_at: the OAuth access token (HttpOnly, lifetime = token TTL)
  - hermes_session_rt: the OAuth refresh token (HttpOnly, lifetime = 30 days)
  - hermes_session_pkce: short-lived PKCE state + CSRF nonce
                         (HttpOnly, lifetime = 10 minutes)

All three are SameSite=Lax (browser will send on cross-site GET top-level
navigation, which we need for the IDP redirect back to /auth/callback)
and Path=/. Secure is set ONLY when the dashboard was reached over HTTPS
(detected via ``X-Forwarded-Proto`` upstream of Fly's TLS terminator, or a
direct https:// scheme). Loopback dev traffic is always HTTP so Secure
would lock the cookies out of the browser.
"""
from __future__ import annotations

from typing import Optional, Tuple

from fastapi import Request
from fastapi.responses import Response

SESSION_AT_COOKIE = "hermes_session_at"
SESSION_RT_COOKIE = "hermes_session_rt"
PKCE_COOKIE = "hermes_session_pkce"

# 30 days — matches Portal's REFRESH_TOKEN_TTL_SECONDS
_RT_MAX_AGE = 30 * 24 * 60 * 60
_PKCE_MAX_AGE = 10 * 60


def _common_attrs(use_https: bool) -> dict:
    attrs = {
        "httponly": True,
        "samesite": "lax",
        "path": "/",
    }
    if use_https:
        attrs["secure"] = True
    return attrs


def set_session_cookies(
    response: Response,
    *,
    access_token: str,
    refresh_token: str,
    access_token_expires_in: int,
    use_https: bool,
) -> None:
    response.set_cookie(
        SESSION_AT_COOKIE, access_token,
        max_age=access_token_expires_in,
        **_common_attrs(use_https),
    )
    response.set_cookie(
        SESSION_RT_COOKIE, refresh_token,
        max_age=_RT_MAX_AGE,
        **_common_attrs(use_https),
    )


def clear_session_cookies(response: Response) -> None:
    # Use max_age=0 to make the browser drop both cookies immediately.
    # Path must match the set-path for the delete to apply.
    response.set_cookie(SESSION_AT_COOKIE, "", max_age=0, path="/", httponly=True, samesite="lax")
    response.set_cookie(SESSION_RT_COOKIE, "", max_age=0, path="/", httponly=True, samesite="lax")


def set_pkce_cookie(response: Response, *, payload: str, use_https: bool) -> None:
    response.set_cookie(
        PKCE_COOKIE, payload,
        max_age=_PKCE_MAX_AGE,
        **_common_attrs(use_https),
    )


def clear_pkce_cookie(response: Response) -> None:
    response.set_cookie(PKCE_COOKIE, "", max_age=0, path="/", httponly=True, samesite="lax")


def read_session_cookies(request: Request) -> Tuple[Optional[str], Optional[str]]:
    at = request.cookies.get(SESSION_AT_COOKIE)
    rt = request.cookies.get(SESSION_RT_COOKIE)
    return at, rt


def read_pkce_cookie(request: Request) -> Optional[str]:
    return request.cookies.get(PKCE_COOKIE)


def detect_https(request: Request) -> bool:
    """Decide whether to set Secure flag.

    Trusts ``X-Forwarded-Proto`` only when ``proxy_headers=True`` is enabled
    on uvicorn — currently OFF in start_server. Falls back to the request
    URL's scheme.
    """
    # request.url.scheme reflects the actual incoming scheme when uvicorn
    # is configured with proxy_headers=True, or the raw scheme otherwise.
    # Fly.io terminates TLS upstream and sets X-Forwarded-Proto=https on
    # forwarded requests.  We re-enable proxy_headers in start_server only
    # for the auth-required path; see Phase 3.5.
    return request.url.scheme == "https"
```

**Step 4: Run, verify pass.**

```bash
scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_cookies.py -v
```

**Step 5: Commit.**

```bash
git add hermes_cli/dashboard_auth/cookies.py tests/hermes_cli/test_dashboard_auth_cookies.py
git commit -m "feat(dashboard-auth): cookie helpers for session_at/session_rt/pkce"
```

### Task 3.2: Auth-gate middleware

**Objective:** A new FastAPI middleware that runs after `host_header_middleware` and before the existing `auth_middleware`. When `app.state.auth_required is True`:
- Allowlist routes (`/auth/*`, `/login`, `/api/auth/providers`, static assets) pass through.
- Everything else requires a valid `hermes_session_at` cookie. The middleware verifies it via the provider, attaches the verified Session to `request.state.session`, and continues.
- Failed verification → 401 (for `/api/*`) or 302 to `/login` (for HTML routes).
- The existing `_SESSION_TOKEN`-based `auth_middleware` is **skipped** when the gate is active (cookie auth supersedes it).

**Files:**
- Create: `hermes_cli/dashboard_auth/middleware.py`
- Modify: `hermes_cli/web_server.py` — register the middleware near `host_header_middleware`, and short-circuit `auth_middleware` when gate is on.
- Create: `tests/hermes_cli/test_dashboard_auth_middleware.py`

**Step 1: Write failing test.**

```python
# tests/hermes_cli/test_dashboard_auth_middleware.py
"""Behavioural tests for the auth-gate middleware.

Uses the StubAuthProvider so we don't talk to a real IDP.
"""
import pytest
from fastapi.testclient import TestClient

from hermes_cli import web_server
from hermes_cli.dashboard_auth import clear_providers, register_provider
from hermes_cli.dashboard_auth.cookies import SESSION_AT_COOKIE
from tests.hermes_cli.conftest_dashboard_auth import StubAuthProvider


@pytest.fixture
def gated_app(monkeypatch):
    """Configure web_server.app to gated mode with the stub provider."""
    clear_providers()
    provider = StubAuthProvider()
    register_provider(provider)
    web_server.app.state.bound_host = "0.0.0.0"
    web_server.app.state.bound_port = 9119
    web_server.app.state.auth_required = True
    yield TestClient(web_server.app, base_url="https://gated.fly.dev")
    clear_providers()
    web_server.app.state.auth_required = False
    web_server.app.state.bound_host = "127.0.0.1"


def test_gated_status_now_requires_auth(gated_app):
    """When gate is on, /api/status is NOT public — login bootstrap uses /api/auth/providers instead."""
    r = gated_app.get("/api/status")
    assert r.status_code == 401


def test_gated_html_redirects_to_login(gated_app):
    r = gated_app.get("/", follow_redirects=False)
    assert r.status_code == 302
    assert r.headers["location"] == "/login"


def test_gated_auth_providers_is_public(gated_app):
    r = gated_app.get("/api/auth/providers")
    assert r.status_code == 200
    body = r.json()
    assert any(p["name"] == "stub" for p in body["providers"])
    assert body["providers"][0]["display_name"] == "Stub IdP (test only)"


def test_gated_login_html_is_public(gated_app):
    r = gated_app.get("/login")
    assert r.status_code == 200
    assert "Stub IdP" in r.text


def test_gated_static_assets_are_public(gated_app):
    # Built assets under /assets/* are mounted as StaticFiles; without
    # them the SPA can't even render the login page in the user's
    # branded skin. Allow these through.
    r = gated_app.get("/assets/_nonexistent.css")
    # 404 not 401 — proves middleware let it through to the route handler
    assert r.status_code == 404


def test_gated_valid_cookie_unlocks_api_status(gated_app):
    # First do the login round trip to obtain a valid access token.
    r1 = gated_app.get("/auth/login?provider=stub", follow_redirects=False)
    # /auth/login should 302 with PKCE cookie set
    pkce = next(c for c in r1.headers.get_list("set-cookie")
                if c.startswith("hermes_session_pkce="))
    assert "HttpOnly" in pkce

    redirect = r1.headers["location"]
    # Stub redirects to {redirect_uri}?code=stub_code&state=...
    assert "code=stub_code" in redirect

    # Issue a fake browser hop to /auth/callback carrying the same cookie.
    state = redirect.split("state=")[1]
    cookies = gated_app.cookies  # picked up the pkce cookie from r1
    r2 = gated_app.get(
        f"/auth/callback?code=stub_code&state={state}",
        follow_redirects=False,
    )
    assert r2.status_code == 302
    assert r2.headers["location"] == "/"
    # Session cookies must be set now
    set_cookies = r2.headers.get_list("set-cookie")
    assert any(c.startswith("hermes_session_at=") for c in set_cookies)
    assert any(c.startswith("hermes_session_rt=") for c in set_cookies)

    # And /api/status should now succeed.
    r3 = gated_app.get("/api/status")
    assert r3.status_code == 200


def test_gated_invalid_cookie_returns_401_on_api(gated_app):
    gated_app.cookies.set(SESSION_AT_COOKIE, "totally-not-a-valid-token")
    r = gated_app.get("/api/sessions")
    assert r.status_code == 401


def test_gated_invalid_cookie_redirects_on_html(gated_app):
    gated_app.cookies.set(SESSION_AT_COOKIE, "garbage")
    r = gated_app.get("/", follow_redirects=False)
    assert r.status_code == 302
    assert r.headers["location"] == "/login"


def test_gated_zero_providers_fails_closed(monkeypatch):
    """If gate is on but no providers are registered, login bootstrap fails closed."""
    clear_providers()
    web_server.app.state.bound_host = "0.0.0.0"
    web_server.app.state.auth_required = True
    try:
        client = TestClient(web_server.app)
        r = client.get("/api/auth/providers")
        assert r.status_code == 503
        assert "no auth providers" in r.text.lower()
    finally:
        web_server.app.state.auth_required = False
```

**Step 2: Run, observe failure.** (Will fail because the middleware doesn't exist yet.)

```bash
scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_middleware.py -v
```

**Step 3: Implement the middleware module.**

```python
# hermes_cli/dashboard_auth/middleware.py
"""Auth-gate middleware for the dashboard.

Engaged when ``app.state.auth_required is True``. The gate's job:
  1. Allow a small set of routes through unauthenticated (login page,
     /auth/* OAuth round trip, /api/auth/providers, static assets).
  2. For everything else, demand a valid session cookie and attach the
     verified ``Session`` to ``request.state.session``.
  3. On HTML routes, redirect missing/invalid cookies to /login.
     On /api/* routes, return 401 JSON.
"""
from __future__ import annotations

import logging
from typing import Iterable

from fastapi import Request
from fastapi.responses import JSONResponse, RedirectResponse

from hermes_cli.dashboard_auth import get_provider
from hermes_cli.dashboard_auth.audit import audit_log, AuditEvent
from hermes_cli.dashboard_auth.base import ProviderError
from hermes_cli.dashboard_auth.cookies import read_session_cookies

_log = logging.getLogger(__name__)

# Paths that bypass the auth gate. Order matters: prefix match.
_GATE_PUBLIC_PREFIXES: tuple[str, ...] = (
    "/auth/login",
    "/auth/callback",
    "/auth/logout",
    "/login",
    "/api/auth/providers",
    "/assets/",
    "/favicon.ico",
    "/ds-assets/",
    "/fonts/",
    "/fonts-terminal/",
)


def _path_is_public(path: str) -> bool:
    return any(path == p or path.startswith(p) for p in _GATE_PUBLIC_PREFIXES)


async def gated_auth_middleware(request: Request, call_next):
    """Engaged only when app.state.auth_required is True."""
    if not getattr(request.app.state, "auth_required", False):
        return await call_next(request)

    path = request.url.path
    if _path_is_public(path):
        return await call_next(request)

    at, _rt = read_session_cookies(request)
    if not at:
        return _unauth_response(path, reason="no_cookie")

    # Look up the provider that issued the access_token. For the stateless
    # design we *try every registered provider's verify_session* until one
    # returns a Session. Providers MUST return None for tokens they don't
    # recognise (rather than raise). Cheap because verification is local
    # JWT decode (with optional userinfo network call for the Nous
    # `signing_mode=userinfo` mode — that path adds a 60-second cache).
    from hermes_cli.dashboard_auth import list_providers
    session = None
    for provider in list_providers():
        try:
            session = provider.verify_session(access_token=at)
        except ProviderError as e:
            _log.warning("dashboard-auth: provider %r unreachable: %s",
                         provider.name, e)
            audit_log(AuditEvent.SESSION_VERIFY_FAILURE,
                      provider=provider.name, reason="provider_unreachable",
                      ip=_client_ip(request))
            return JSONResponse(
                {"detail": f"Auth provider {provider.name!r} unreachable"},
                status_code=503,
            )
        if session is not None:
            break

    if session is None:
        audit_log(AuditEvent.SESSION_VERIFY_FAILURE, reason="no_provider_recognises",
                  ip=_client_ip(request))
        return _unauth_response(path, reason="invalid_or_expired_session")

    request.state.session = session
    return await call_next(request)


def _unauth_response(path: str, *, reason: str):
    """API routes → 401 JSON; HTML routes → 302 → /login."""
    if path.startswith("/api/"):
        return JSONResponse(
            {"detail": "Unauthorized", "reason": reason},
            status_code=401,
        )
    return RedirectResponse(url="/login", status_code=302)


def _client_ip(request: Request) -> str:
    fwd = request.headers.get("x-forwarded-for", "")
    if fwd:
        return fwd.split(",")[0].strip()
    return request.client.host if request.client else ""
```

**Step 4: Wire the middleware into `web_server.py`.**

In `hermes_cli/web_server.py`, immediately after `host_header_middleware` (around line 233), add:

```python
from hermes_cli.dashboard_auth.middleware import gated_auth_middleware

@app.middleware("http")
async def _gated_auth_proxy(request: Request, call_next):
    return await gated_auth_middleware(request, call_next)
```

And update the existing `auth_middleware` (line 237) to short-circuit when the gate is on:

```python
@app.middleware("http")
async def auth_middleware(request: Request, call_next):
    """Require the session token on all /api/ routes except the public list."""
    # When the OAuth gate is active, cookie auth supersedes the legacy
    # _SESSION_TOKEN. The gated_auth_middleware has already verified the
    # session; we skip the token check here.
    if getattr(request.app.state, "auth_required", False):
        return await call_next(request)
    path = request.url.path
    if path.startswith("/api/") and path not in _PUBLIC_API_PATHS:
        if not _has_valid_session_token(request):
            return JSONResponse(
                status_code=401,
                content={"detail": "Unauthorized"},
            )
    return await call_next(request)
```

**Step 5: Run, verify the tests pass.** (Will still fail on tests that exercise routes the next sub-task adds.)

```bash
scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_middleware.py -v -k "not auth_login and not callback"
```

Expected: tests that don't depend on the `/auth/*` routes pass. The route-dependent tests still fail.

**Step 6: Commit.**

```bash
git add hermes_cli/dashboard_auth/middleware.py hermes_cli/web_server.py
git commit -m "feat(dashboard-auth): auth-gate middleware (cookie-based, gated on app.state.auth_required)"
```

### Task 3.3: `/auth/login`, `/auth/callback`, `/auth/logout` routes

**Objective:** The three OAuth round-trip endpoints. They are FastAPI routes (not middleware) because they need response bodies / cookies / redirects.

**Files:**
- Create: `hermes_cli/dashboard_auth/routes.py`
- Modify: `hermes_cli/web_server.py` — import + mount the router.

**Step 1: Implement the routes.**

```python
# hermes_cli/dashboard_auth/routes.py
"""HTTP routes for the dashboard-auth OAuth round trip.

Mounted at root (no prefix). The router is registered in web_server.py
only — it doesn't auto-gate; gating is done by gated_auth_middleware,
which allowlists /auth/*.
"""
from __future__ import annotations

import logging
import urllib.parse

from fastapi import APIRouter, HTTPException, Request
from fastapi.responses import RedirectResponse, JSONResponse

from hermes_cli.dashboard_auth import get_provider, list_providers
from hermes_cli.dashboard_auth.audit import audit_log, AuditEvent
from hermes_cli.dashboard_auth.base import (
    InvalidCodeError, ProviderError, RefreshExpiredError,
)
from hermes_cli.dashboard_auth.cookies import (
    set_session_cookies, clear_session_cookies,
    set_pkce_cookie, clear_pkce_cookie,
    read_session_cookies, read_pkce_cookie,
    detect_https,
)

_log = logging.getLogger(__name__)

router = APIRouter()


def _redirect_uri(request: Request) -> str:
    """Reconstruct the absolute callback URL the IDP will redirect back to.

    Reads from the request URL — under Fly's proxy with proxy_headers=True,
    this picks up the public https URL from X-Forwarded-Host + Proto.
    """
    return str(request.url_for("auth_callback"))


def _client_ip(request: Request) -> str:
    fwd = request.headers.get("x-forwarded-for", "")
    if fwd:
        return fwd.split(",")[0].strip()
    return request.client.host if request.client else ""


@router.get("/auth/login", name="auth_login")
async def auth_login(request: Request, provider: str):
    p = get_provider(provider)
    if p is None:
        raise HTTPException(status_code=404, detail=f"Unknown provider: {provider!r}")

    try:
        ls = p.start_login(redirect_uri=_redirect_uri(request))
    except ProviderError as e:
        audit_log(AuditEvent.LOGIN_FAILURE, provider=provider,
                  reason="provider_unreachable", ip=_client_ip(request))
        raise HTTPException(status_code=503, detail=f"Provider unreachable: {e}")

    audit_log(AuditEvent.LOGIN_START, provider=provider, ip=_client_ip(request))

    resp = RedirectResponse(url=ls.redirect_url, status_code=302)
    # The login start may stash one or more cookies (PKCE state, etc.)
    # We expect the canonical key `hermes_session_pkce` plus possibly a
    # `provider_name` so the callback knows which provider to dispatch to.
    pkce = ls.cookie_payload.get("hermes_session_pkce", "")
    # Pack provider name into the PKCE blob so callback can find it.
    if "provider=" not in pkce:
        pkce = f"provider={provider};{pkce}"
    set_pkce_cookie(resp, payload=pkce, use_https=detect_https(request))
    return resp


@router.get("/auth/callback", name="auth_callback")
async def auth_callback(request: Request, code: str = "", state: str = "",
                         error: str = "", error_description: str = ""):
    pkce_raw = read_pkce_cookie(request)
    if not pkce_raw:
        audit_log(AuditEvent.LOGIN_FAILURE, reason="missing_pkce_cookie",
                  ip=_client_ip(request))
        raise HTTPException(status_code=400, detail="Missing PKCE state cookie")

    # Parse the semicolon-delimited blob: provider=...;state=...;verifier=...
    parts = dict(p.split("=", 1) for p in pkce_raw.split(";") if "=" in p)
    provider_name = parts.get("provider", "")
    expected_state = parts.get("state", "")
    verifier = parts.get("verifier", "")

    p = get_provider(provider_name)
    if p is None:
        raise HTTPException(status_code=400, detail=f"Unknown provider in cookie: {provider_name!r}")

    if error:
        audit_log(AuditEvent.LOGIN_FAILURE, provider=provider_name,
                  reason="idp_error", error=error, ip=_client_ip(request))
        raise HTTPException(
            status_code=400,
            detail=f"OAuth error from provider: {error} ({error_description})",
        )

    if state != expected_state:
        audit_log(AuditEvent.LOGIN_FAILURE, provider=provider_name,
                  reason="state_mismatch", ip=_client_ip(request))
        raise HTTPException(status_code=400, detail="OAuth state mismatch (CSRF check failed)")

    try:
        session = p.complete_login(
            code=code, state=state, code_verifier=verifier,
            redirect_uri=_redirect_uri(request),
        )
    except InvalidCodeError as e:
        audit_log(AuditEvent.LOGIN_FAILURE, provider=provider_name,
                  reason="invalid_code", ip=_client_ip(request))
        raise HTTPException(status_code=400, detail=f"Invalid code: {e}")
    except ProviderError as e:
        audit_log(AuditEvent.LOGIN_FAILURE, provider=provider_name,
                  reason="provider_unreachable", ip=_client_ip(request))
        raise HTTPException(status_code=503, detail=f"Provider unreachable: {e}")

    audit_log(AuditEvent.LOGIN_SUCCESS, provider=provider_name,
              user_id=session.user_id, email=session.email,
              org_id=session.org_id, ip=_client_ip(request))

    import time
    expires_in = max(60, session.expires_at - int(time.time()))
    resp = RedirectResponse(url="/", status_code=302)
    use_https = detect_https(request)
    set_session_cookies(
        resp,
        access_token=session.access_token,
        refresh_token=session.refresh_token,
        access_token_expires_in=expires_in,
        use_https=use_https,
    )
    clear_pkce_cookie(resp)
    return resp


@router.post("/auth/logout", name="auth_logout")
async def auth_logout(request: Request):
    at, rt = read_session_cookies(request)
    if rt:
        # Best-effort revoke at the provider — failure is logged but doesn't
        # affect the local logout outcome.
        from hermes_cli.dashboard_auth import list_providers
        for provider in list_providers():
            try:
                provider.revoke_session(refresh_token=rt)
            except Exception as e:
                _log.warning("dashboard-auth: revoke on %r failed: %s",
                             provider.name, e)

    sess = getattr(request.state, "session", None)
    audit_log(
        AuditEvent.LOGOUT,
        provider=(sess.provider if sess else "unknown"),
        user_id=(sess.user_id if sess else ""),
        ip=_client_ip(request),
    )

    resp = RedirectResponse(url="/login", status_code=302)
    clear_session_cookies(resp)
    clear_pkce_cookie(resp)
    return resp


@router.get("/api/auth/providers")
async def api_auth_providers():
    providers = list_providers()
    if not providers:
        # Q13: fail-closed when zero providers are registered.
        return JSONResponse(
            {"detail": "no auth providers registered"},
            status_code=503,
        )
    return {
        "providers": [
            {"name": p.name, "display_name": p.display_name}
            for p in providers
        ],
    }


@router.get("/api/auth/me")
async def api_auth_me(request: Request):
    """Return the verified session JSON. Auth-required (middleware gates this)."""
    sess = getattr(request.state, "session", None)
    if sess is None:
        # Should be unreachable; middleware enforces. Defence in depth.
        raise HTTPException(status_code=401, detail="Unauthorized")
    return {
        "user_id": sess.user_id,
        "email": sess.email,
        "display_name": sess.display_name,
        "org_id": sess.org_id,
        "provider": sess.provider,
        "expires_at": sess.expires_at,
    }
```

**Step 2: Mount the router.**

In `hermes_cli/web_server.py`, near the existing route definitions (after the `host_header_middleware` block, before the SPA mount at the bottom), add:

```python
from hermes_cli.dashboard_auth.routes import router as _dashboard_auth_router
app.include_router(_dashboard_auth_router)
```

**Step 3: Commit.**

```bash
git add hermes_cli/dashboard_auth/routes.py hermes_cli/web_server.py
git commit -m "feat(dashboard-auth): /auth/{login,callback,logout} + /api/auth/{providers,me} routes"
```

### Task 3.4: `/login` server-rendered HTML page

**Objective:** A minimal styled HTML page (no React bundle) that lists every registered provider. Inline CSS — matches the existing Hermes branding colors but doesn't pull from the build.

**Files:**
- Create: `hermes_cli/dashboard_auth/login_page.py`
- Modify: `hermes_cli/dashboard_auth/routes.py` — add `GET /login`.

**Step 1: Write the page renderer.**

```python
# hermes_cli/dashboard_auth/login_page.py
"""Server-rendered /login page. No React, no JavaScript dependency.

Listed providers come from the registry. Clicking a provider sends a GET
to /auth/login?provider=<name>.
"""
from __future__ import annotations

import html

from hermes_cli.dashboard_auth import list_providers

# Inline minimal CSS. The dashboard's full skin lives in the React bundle
# which we deliberately do NOT load here — the login page must not depend
# on the SPA build being present or on the injected session token.
_LOGIN_HTML_TEMPLATE = """\
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Sign in — Hermes Agent</title>
<style>
  :root {{
    --bg: #0a0a0b;
    --fg: #e5e5e7;
    --accent: #f97316;
    --border: #27272a;
  }}
  html, body {{
    margin: 0; padding: 0; height: 100%;
    background: var(--bg); color: var(--fg);
    font: 16px/1.5 system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
  }}
  main {{
    max-width: 28rem; margin: 10vh auto; padding: 2rem;
    border: 1px solid var(--border); border-radius: 0.75rem;
    background: rgba(255,255,255,0.02);
  }}
  h1 {{ margin: 0 0 0.5rem; font-size: 1.5rem; }}
  p  {{ margin: 0 0 1.5rem; opacity: 0.7; }}
  .provider-list {{ display: grid; gap: 0.75rem; }}
  .provider-btn {{
    display: block; width: 100%; box-sizing: border-box;
    padding: 0.875rem 1rem; text-align: center;
    background: var(--accent); color: #0a0a0b;
    font-weight: 600; font-size: 1rem;
    border-radius: 0.5rem; text-decoration: none;
    border: 0; cursor: pointer;
  }}
  .provider-btn:hover {{ filter: brightness(1.1); }}
  .empty {{
    padding: 1rem; border-radius: 0.5rem;
    background: rgba(248, 113, 113, 0.1); color: #fca5a5;
    border: 1px solid rgba(248, 113, 113, 0.3);
  }}
  footer {{ margin-top: 2rem; font-size: 0.875rem; opacity: 0.5; text-align: center; }}
</style>
</head>
<body>
<main>
  <h1>Sign in to Hermes Agent</h1>
  <p>Choose a sign-in method to continue.</p>
  <div class="provider-list">
{provider_buttons}
  </div>
  <footer>This dashboard is bound to a non-loopback host.<br>
  Sign-in is required for security.</footer>
</main>
</body>
</html>
"""

_EMPTY_HTML = """\
<!doctype html>
<html><body><main style="font-family: system-ui; max-width: 36rem; margin: 10vh auto; padding: 2rem;">
<h1>Sign-in unavailable</h1>
<p>This dashboard is bound to a non-loopback host but no authentication providers are installed.</p>
<p>Install <code>plugins/dashboard-auth-nous</code> (default) or another auth provider, or restart with
<code>--insecure</code> to bypass the auth gate (not recommended on untrusted networks).</p>
</main></body></html>
"""


def render_login_html() -> str:
    providers = list_providers()
    if not providers:
        return _EMPTY_HTML

    buttons = []
    for p in providers:
        buttons.append(
            f'    <a class="provider-btn" href="/auth/login?provider='
            f'{html.escape(p.name, quote=True)}">'
            f'Sign in with {html.escape(p.display_name)}</a>'
        )
    return _LOGIN_HTML_TEMPLATE.format(provider_buttons="\n".join(buttons))
```

**Step 2: Add the route.**

In `hermes_cli/dashboard_auth/routes.py`, add at the top of the route list:

```python
from fastapi.responses import HTMLResponse
from hermes_cli.dashboard_auth.login_page import render_login_html


@router.get("/login", name="login")
async def login_page(request: Request):
    return HTMLResponse(
        render_login_html(),
        headers={"Cache-Control": "no-store, no-cache, must-revalidate"},
    )
```

**Step 3: Commit.**

```bash
git add hermes_cli/dashboard_auth/login_page.py hermes_cli/dashboard_auth/routes.py
git commit -m "feat(dashboard-auth): server-rendered /login page listing providers"
```

### Task 3.5: Suppress `_SESSION_TOKEN` injection and harden `start_server` when gate is on

**Objective:**
1. When `auth_required is True`, `_serve_index` must NOT inject `window.__HERMES_SESSION_TOKEN__`. The post-login SPA reads identity from `/api/auth/me` instead.
2. `start_server`'s SystemExit on `host != loopback && not allow_public` is replaced with "the auth gate engages" branching. If zero providers are registered AND gate would be active, fail closed (SystemExit with a clear message).
3. Re-enable `proxy_headers=True` on uvicorn when gate is active so cookies see the real client scheme (`X-Forwarded-Proto`) behind Fly's TLS terminator.

**Files:**
- Modify: `hermes_cli/web_server.py` — `_serve_index` (~line 3676), `start_server` (~line 4514).

**Step 1: Write failing tests.**

Append to `tests/hermes_cli/test_dashboard_auth_gate.py`:

```python
def test_gated_index_does_not_inject_session_token(monkeypatch):
    web_server.app.state.auth_required = True
    web_server.app.state.bound_host = "0.0.0.0"
    try:
        client = TestClient(web_server.app)
        r = client.get("/login")  # _serve_index isn't hit on /login
        # And confirm the SPA index itself (post-login) doesn't leak the token.
        # But /  redirects to /login when no cookie, so we can't easily get to
        # _serve_index without an authenticated cookie. Verify the helper
        # directly:
        from hermes_cli.web_server import WEB_DIST
        if (WEB_DIST / "index.html").exists():
            # Construct a Request and call _serve_index directly via a
            # known-good path is fiddly; instead read the function source's
            # branch handling. For an integration test, use a logged-in
            # cookie via Stub provider and check the body of /.
            pass
    finally:
        web_server.app.state.auth_required = False


def test_start_server_with_gate_and_no_providers_fails_closed(monkeypatch):
    from hermes_cli.dashboard_auth import clear_providers
    clear_providers()
    monkeypatch.setattr(web_server, "uvicorn", type("U", (), {"run": staticmethod(lambda *a, **k: None)}))
    with pytest.raises(SystemExit, match="no auth providers"):
        web_server.start_server(host="0.0.0.0", port=9119,
                                open_browser=False, allow_public=False)


def test_start_server_with_gate_and_provider_proceeds(monkeypatch):
    from hermes_cli.dashboard_auth import clear_providers, register_provider
    from tests.hermes_cli.conftest_dashboard_auth import StubAuthProvider
    clear_providers()
    register_provider(StubAuthProvider())
    called = {}
    def fake_run(*a, **kw):
        called.update(kw)
    monkeypatch.setattr(web_server, "uvicorn", type("U", (), {"run": staticmethod(fake_run)}))
    web_server.start_server(host="0.0.0.0", port=9119,
                            open_browser=False, allow_public=False)
    assert called["host"] == "0.0.0.0"
    # proxy_headers must be True in gated mode so X-Forwarded-Proto from Fly
    # is honoured for cookie Secure-flag decisions.
    assert called["proxy_headers"] is True
    clear_providers()
```

**Step 2: Modify `_serve_index`.**

In `hermes_cli/web_server.py:3676`:

```python
    def _serve_index(prefix: str = ""):
        html = _index_path.read_text()
        chat_js = "true" if _DASHBOARD_EMBEDDED_CHAT_ENABLED else "false"

        # When the OAuth gate is active, do NOT inject _SESSION_TOKEN — the
        # SPA reads identity from /api/auth/me using cookie auth instead.
        if getattr(app.state, "auth_required", False):
            bootstrap_script = (
                f"<script>"
                f"window.__HERMES_DASHBOARD_EMBEDDED_CHAT__={chat_js};"
                f'window.__HERMES_BASE_PATH__="{prefix}";'
                f"window.__HERMES_AUTH_REQUIRED__=true;"
                f"</script>"
            )
        else:
            bootstrap_script = (
                f'<script>window.__HERMES_SESSION_TOKEN__="{_SESSION_TOKEN}";'
                f"window.__HERMES_DASHBOARD_EMBEDDED_CHAT__={chat_js};"
                f'window.__HERMES_BASE_PATH__="{prefix}";'
                f"window.__HERMES_AUTH_REQUIRED__=false;"
                f"</script>"
            )
        # ... rest of the function (asset-prefix rewrites) unchanged, but
        # replace ``token_script`` with ``bootstrap_script`` on the final
        # ``html.replace("</head>", ...)`` call.
```

**Step 3: Modify `start_server`.**

Replace the `_LOCALHOST` block (lines ~4528–4539) with:

```python
    app.state.auth_required = should_require_auth(host, allow_public)

    if app.state.auth_required:
        from hermes_cli.dashboard_auth import list_providers
        if not list_providers():
            raise SystemExit(
                f"Refusing to bind dashboard to {host} — the auth gate is "
                f"required but no auth providers are registered. Install the "
                f"default Nous provider (plugins/dashboard-auth-nous) or another "
                f"DashboardAuthProvider plugin. Pass --insecure to skip the "
                f"auth gate (NOT recommended on untrusted networks)."
            )
        _log.info(
            "Dashboard binding to %s with OAuth auth gate enabled. "
            "Providers: %s", host,
            ", ".join(p.name for p in list_providers()),
        )
    elif host not in _LOCALHOST and allow_public:
        _log.warning(
            "Binding to %s with --insecure — the dashboard has no robust "
            "authentication. Only use on trusted networks.", host,
        )
```

The original `_LOCALHOST = (...)` constant tuple and the SystemExit at line 4530 are removed (the predicate has subsumed them).

Update the `uvicorn.run` call (line 4583):

```python
    uvicorn.run(
        app, host=host, port=port, log_level="warning",
        # Trust X-Forwarded-Proto / X-Forwarded-For ONLY when the auth gate
        # is engaged AND we're behind a known terminator (Fly.io). The
        # gateway never runs publicly without a terminator; in loopback
        # mode there's nothing to proxy.
        proxy_headers=bool(app.state.auth_required),
    )
```

**Step 4: Run, verify pass.**

```bash
scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_gate.py tests/hermes_cli/test_dashboard_auth_middleware.py -v
```

**Step 5: Commit.**

```bash
git add hermes_cli/web_server.py tests/hermes_cli/test_dashboard_auth_gate.py
git commit -m "feat(dashboard-auth): suppress _SESSION_TOKEN injection in gated mode; fail-closed without providers"
```

### Phase 3 Exit Gate

End-to-end test passes:

```bash
scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_gate.py tests/hermes_cli/test_dashboard_auth_middleware.py tests/hermes_cli/test_dashboard_auth_cookies.py tests/hermes_cli/test_dashboard_auth_stub_provider.py -v
```

Manual smoke test:
1. `hermes dashboard --host 0.0.0.0 --port 9119` with the stub registered via a local `~/.hermes/plugins/dashboard-auth-stub/` plugin. Expect: server starts, listens on `0.0.0.0:9119`.
2. Browser to `http://localhost:9119/` → 302 → `/login` → "Sign in with Stub IdP" button.
3. Click → bounces through `/auth/login?provider=stub` → stub redirects to `/auth/callback?code=stub_code&state=…` → 302 → `/`.
4. The SPA loads with cookies, hits `/api/auth/me`, displays "Logged in as Stub User".
5. `~/.hermes/logs/dashboard-auth.log` contains `login_start` and `login_success` entries.

Loopback regression test passes unchanged:

```bash
hermes dashboard
# → http://127.0.0.1:9119 still works without any login, token still injected
```

---

## Phase 4 — Real Nous Provider Plugin (v2 — contract-compliant)

> **Plan v2 rewrite.** This section was rewritten on 2026-05-21 after fetching the Portal's published contract (PR #180). The original draft (which assumed a static `hermes-dashboard` client_id, userinfo-fallback verification, and broad OIDC scopes) is preserved further below under "Phase 4 v1 (rejected — preserved for archeology)" for reviewer context.

**Goal:** Ship `plugins/dashboard-auth-nous/` as a real `DashboardAuthProvider` that implements the Nous Portal authorization-code + PKCE flow per `nous-account-service/docs/agent-dashboard-oauth-contract.md`. Bundled with Hermes (lives under `plugins/`, auto-loaded). The plugin is a no-op unless the Portal-injected env vars are present, so it has zero impact on loopback-only / `--insecure` operators.

**Dependencies:** Portal-side endpoints already exist in PR #180:
- `GET /oauth/authorize` (authorization endpoint)
- `POST /api/oauth/token` (token endpoint, accepts `grant_type=authorization_code`)
- `GET /.well-known/jwks.json` (RS256 signing keys, RFC-7517 JWK Set, cache `public, max-age=300, stale-while-revalidate=300`)

There is no userinfo endpoint and no refresh-token endpoint for the dashboard flow. Token lifetime is 900 seconds.

### Task 4.1: Plugin skeleton + env-driven provider class

**Objective:** A `plugins/dashboard-auth-nous/` directory that registers a `NousDashboardAuthProvider` ONLY when `HERMES_DASHBOARD_OAUTH_CLIENT_ID` is set. If unset (the common case for loopback / `--insecure` operators), the plugin loads but registers nothing — the gate then fails closed if it's actually engaged, which is correct.

**Files:**
- Create: `plugins/dashboard-auth-nous/plugin.yaml`
- Create: `plugins/dashboard-auth-nous/__init__.py`
- Create: `plugins/dashboard-auth-nous/provider.py`
- Create: `plugins/dashboard-auth-nous/test_provider.py`

**Step 1: Plugin manifest.**

```yaml
# plugins/dashboard-auth-nous/plugin.yaml
name: dashboard-auth-nous
version: 1.0.0
description: "Default dashboard auth provider for Hermes — OAuth via Nous Portal (portal.nousresearch.com)."
author: NousResearch
kind: dashboard_auth
pip_dependencies:
  - httpx
  - pyjwt[crypto]
```

**Step 2: Plugin entry point — conditional registration.**

```python
# plugins/dashboard-auth-nous/__init__.py
"""Default dashboard-auth provider — Nous Portal OAuth.

Auto-loaded by the plugin system at startup. Registers the provider only
when the Portal-injected env vars are present; otherwise loads silently
so loopback / --insecure operators don't see a spurious "auth misconfigured"
warning every time they start the dashboard.
"""
import logging
import os

from plugins.dashboard_auth_nous.provider import NousDashboardAuthProvider

_log = logging.getLogger(__name__)


def register(ctx):
    """Plugin entry — called by the plugin loader.

    Required env vars (Portal injects these at Fly.io provisioning time):
      HERMES_DASHBOARD_OAUTH_CLIENT_ID  — must be shape ``agent:{instance_id}``
      HERMES_DASHBOARD_PORTAL_URL       — e.g. https://portal.nousresearch.com

    With both present, registers the provider. With either missing, logs a
    DEBUG note and returns silently — operator-owned dashboards binding to
    loopback (or running with --insecure) are not expected to set these.
    The gate-engagement layer fails closed if a public bind is attempted
    with zero providers registered, so the failure mode is already covered.
    """
    client_id = os.environ.get("HERMES_DASHBOARD_OAUTH_CLIENT_ID", "").strip()
    portal_url = os.environ.get("HERMES_DASHBOARD_PORTAL_URL", "").strip()

    if not client_id or not portal_url:
        _log.debug(
            "dashboard-auth-nous: env vars missing "
            "(HERMES_DASHBOARD_OAUTH_CLIENT_ID=%r, HERMES_DASHBOARD_PORTAL_URL=%r); "
            "not registering provider.",
            bool(client_id), bool(portal_url),
        )
        return

    if not client_id.startswith("agent:"):
        _log.warning(
            "dashboard-auth-nous: HERMES_DASHBOARD_OAUTH_CLIENT_ID=%r does not "
            "match contract shape 'agent:{instance_id}'; not registering provider. "
            "Set this env var to the value provisioned by Nous Portal.",
            client_id,
        )
        return

    ctx.register_dashboard_auth_provider(
        NousDashboardAuthProvider(client_id=client_id, portal_url=portal_url)
    )
```

**Step 3: Provider implementation — contract-compliant.**

```python
# plugins/dashboard-auth-nous/provider.py
"""NousDashboardAuthProvider — authorization-code + PKCE against Nous Portal.

Implements ``nous-account-service/docs/agent-dashboard-oauth-contract.md``
(PR #180). Key contract points encoded here:

  - client_id is per-instance (``agent:{instance_id}``), injected at
    provisioning. Stored on ``self._client_id``; ``self._agent_instance_id``
    is the suffix used for defense-in-depth claim verification.
  - scope is ``agent_dashboard:access`` only.
  - redirect_uri is computed from request.url_for("auth_callback") under
    proxy_headers=True so Fly's TLS terminator's X-Forwarded-Proto / Host
    are honoured.
  - tokens are RS256-signed JWTs verified against ``/.well-known/jwks.json``;
    JWKS is cached for 5 minutes with stale-while-revalidate.
  - V1 has no refresh tokens — refresh_session always raises
    RefreshExpiredError so the middleware redirects to /auth/login.
"""
from __future__ import annotations

import base64
import hashlib
import logging
import secrets
import time
import urllib.parse
from typing import Optional

import httpx
import jwt
from jwt import PyJWKClient

from hermes_cli.dashboard_auth.base import (
    DashboardAuthProvider,
    Session,
    LoginStart,
    InvalidCodeError,
    ProviderError,
    RefreshExpiredError,
)

_log = logging.getLogger(__name__)

# Contract: ``agent_dashboard:access`` is the scope name for this flow.
_SCOPE = "agent_dashboard:access"

# Contract: tolerant treatment — if the claim is missing, warn and proceed;
# if present and != 1, refuse. See OQ-C2.
_EXPECTED_CONTRACT_VERSION = 1

# Contract: JWKS cache lifetime (matches Portal's Cache-Control header).
_JWKS_CACHE_SECONDS = 300


def _b64url_no_pad(raw: bytes) -> str:
    return base64.urlsafe_b64encode(raw).rstrip(b"=").decode()


class NousDashboardAuthProvider(DashboardAuthProvider):
    """Nous Portal OAuth via authorization-code + PKCE (S256)."""

    name = "nous"
    display_name = "Nous Research"

    def __init__(self, *, client_id: str, portal_url: str) -> None:
        if not client_id.startswith("agent:"):
            # Defense-in-depth — the plugin entry already filters, but the
            # provider should never be constructed with a malformed id.
            raise ValueError(
                f"client_id must match contract shape 'agent:{{instance_id}}', "
                f"got {client_id!r}"
            )
        self._client_id = client_id
        self._agent_instance_id = client_id[len("agent:"):]
        self._portal_url = portal_url.rstrip("/")
        self._jwks_url = f"{self._portal_url}/.well-known/jwks.json"
        self._authorize_url = f"{self._portal_url}/oauth/authorize"
        self._token_url = f"{self._portal_url}/api/oauth/token"
        # PyJWKClient handles cache + stale-while-revalidate semantics.
        self._jwks = PyJWKClient(
            self._jwks_url,
            cache_keys=True,
            lifespan=_JWKS_CACHE_SECONDS,
        )

    # ---------------- start_login -------------------------------------

    def start_login(self, *, redirect_uri: str) -> LoginStart:
        # Validate redirect_uri shape early to surface misconfiguration before
        # the user is bounced to Portal and gets an opaque error.
        parsed = urllib.parse.urlparse(redirect_uri)
        if parsed.scheme not in ("https", "http"):
            raise ProviderError(f"redirect_uri must be http(s), got {redirect_uri!r}")
        if parsed.scheme == "http" and parsed.hostname not in ("localhost", "127.0.0.1"):
            raise ProviderError(
                f"redirect_uri may only use http:// for localhost/127.0.0.1, "
                f"got {redirect_uri!r}"
            )

        code_verifier = _b64url_no_pad(secrets.token_bytes(64))  # ~86 chars
        code_challenge = _b64url_no_pad(hashlib.sha256(code_verifier.encode()).digest())
        state = _b64url_no_pad(secrets.token_bytes(32))

        params = {
            "response_type": "code",
            "client_id": self._client_id,
            "redirect_uri": redirect_uri,
            "scope": _SCOPE,
            "state": state,
            "code_challenge": code_challenge,
            "code_challenge_method": "S256",
        }
        authorize_url = f"{self._authorize_url}?{urllib.parse.urlencode(params)}"
        return LoginStart(
            authorize_url=authorize_url,
            state=state,
            code_verifier=code_verifier,
        )

    # ---------------- complete_login ----------------------------------

    def complete_login(
        self,
        *,
        code: str,
        code_verifier: str,
        redirect_uri: str,
    ) -> Session:
        try:
            response = httpx.post(
                self._token_url,
                data={
                    "grant_type": "authorization_code",
                    "code": code,
                    "redirect_uri": redirect_uri,
                    "client_id": self._client_id,
                    "code_verifier": code_verifier,
                },
                headers={"Accept": "application/json"},
                timeout=10.0,
            )
        except httpx.RequestError as exc:
            raise ProviderError(f"Portal token endpoint unreachable: {exc}") from exc

        if response.status_code == 400:
            # Contract: invalid_code, invalid_grant, redirect_uri_mismatch all
            # surface here.
            body = response.json() if response.headers.get("content-type", "").startswith("application/json") else {}
            error_code = body.get("error", "invalid_request")
            raise InvalidCodeError(f"Portal rejected code: {error_code}")
        if response.status_code != 200:
            raise ProviderError(
                f"Portal token endpoint returned {response.status_code}: "
                f"{response.text[:200]}"
            )

        payload = response.json()
        access_token = payload.get("access_token")
        if not access_token:
            raise ProviderError("Portal token response missing access_token")
        # Contract V1: no refresh token. If one is present, we deliberately
        # ignore it (forward-compat: a future Portal can issue one without
        # forcing us to ship a new Hermes version).
        token_type = payload.get("token_type", "").lower()
        if token_type and token_type != "bearer":
            raise ProviderError(f"unexpected token_type={token_type!r}")

        claims = self._verify_jwt(access_token)
        return self._session_from_claims(access_token, claims)

    # ---------------- refresh_session ---------------------------------

    def refresh_session(self, *, refresh_token: str) -> Session:
        # Contract V1 has no refresh tokens. The cookie machinery may still
        # call this if a future Portal change starts issuing them; for now
        # we always force re-auth.
        raise RefreshExpiredError(
            "Nous Portal does not issue refresh tokens in OAuth contract v1; "
            "user must re-authenticate."
        )

    # ---------------- verify_session (called per request) -------------

    def verify_session(self, *, access_token: str) -> Session:
        claims = self._verify_jwt(access_token)
        return self._session_from_claims(access_token, claims)

    # ---------------- internals --------------------------------------

    def _verify_jwt(self, access_token: str) -> dict:
        try:
            signing_key = self._jwks.get_signing_key_from_jwt(access_token)
        except jwt.PyJWKClientError as exc:
            raise ProviderError(f"JWKS lookup failed: {exc}") from exc

        try:
            claims = jwt.decode(
                access_token,
                signing_key.key,
                algorithms=["RS256"],
                # Contract: audience is the bare client_id for agent:* clients.
                audience=self._client_id,
                # Issuer is the Portal base URL. Pin it.
                issuer=self._portal_url,
                options={"require": ["exp", "iat", "aud", "iss", "sub"]},
            )
        except jwt.ExpiredSignatureError as exc:
            raise InvalidCodeError(f"access token expired: {exc}") from exc
        except jwt.InvalidTokenError as exc:
            raise ProviderError(f"access token verification failed: {exc}") from exc

        # Defense-in-depth: contract recommends verifying agent_instance_id
        # matches our configured client_id suffix. (Doc says all client_id-shaped
        # claims should be cross-checked.)
        token_instance_id = claims.get("agent_instance_id")
        if token_instance_id and token_instance_id != self._agent_instance_id:
            raise ProviderError(
                f"agent_instance_id mismatch: token={token_instance_id!r} "
                f"vs configured={self._agent_instance_id!r}"
            )

        # Tolerant contract-version check (see OQ-C2).
        contract_version = claims.get("oauth_contract_version")
        if contract_version is None:
            _log.warning(
                "Nous Portal token missing oauth_contract_version claim "
                "(contract says it should be %d); proceeding anyway.",
                _EXPECTED_CONTRACT_VERSION,
            )
        elif contract_version != _EXPECTED_CONTRACT_VERSION:
            raise ProviderError(
                f"unsupported oauth_contract_version={contract_version!r}, "
                f"expected {_EXPECTED_CONTRACT_VERSION}"
            )

        return claims

    def _session_from_claims(self, access_token: str, claims: dict) -> Session:
        # Contract V1 emits no email / display_name. We surface the user_id
        # (truncated) in the AuthWidget; Session keeps the fields for forward
        # compatibility but populates them with empty strings.
        user_id = str(claims.get("sub", ""))
        if not user_id:
            raise ProviderError("token missing 'sub' (user_id) claim")
        return Session(
            provider_name=self.name,
            user_id=user_id,
            email="",
            display_name="",
            access_token=access_token,
            refresh_token="",  # contract V1: no refresh
            expires_at=int(claims["exp"]),
            extra={
                "org_id": claims.get("org_id"),
                "agent_instance_id": claims.get("agent_instance_id"),
                "scope": claims.get("scope"),
            },
        )
```

**Step 4: Tests.**

The test suite covers four shapes:

1. **Plugin registration gating** — env unset / malformed `client_id` → no registration.
2. **`start_login` shape** — generates correct `code_verifier` (43-128 chars), `code_challenge` (S256 of verifier), and authorize URL with all required params.
3. **`complete_login` happy path + error mapping** — httpx mocked. 200 with valid JWT → `Session`; 400 → `InvalidCodeError`; 500 → `ProviderError`; 200 without `access_token` → `ProviderError`.
4. **`verify_session` token verification** — uses an RSA keypair generated in `conftest`; signs a JWT with the expected claims and verifies it round-trips. Negative cases: wrong `aud`, wrong `iss`, missing `sub`, `agent_instance_id` mismatch, `oauth_contract_version=2` rejection, missing `oauth_contract_version` warning.

Skip `refresh_session` happy path — it has none; one test asserts `RefreshExpiredError` is always raised.

### Task 4.2: Smoke test against staging Portal (`portal.rewbs.uk`)

**Objective:** Manual end-to-end run against the staging Portal before considering Phase 4 done. Not a CI gate; the OAuth flow needs a real browser. Document the checklist:

1. Provision a fake Fly app pointing to localhost (e.g. via `fly apps create` + DNS override) OR — easier — patch the Portal's `flyAppName → canonicalRedirectUri` to allow `http://localhost:8080/auth/callback`.
2. Set `HERMES_DASHBOARD_OAUTH_CLIENT_ID=agent:{instance_id}`, `HERMES_DASHBOARD_PORTAL_URL=https://portal.rewbs.uk`.
3. `hermes dashboard --host 0.0.0.0 --port 8080`.
4. Open `http://localhost:8080/`. Expect bounce to `/login`. Click "Continue with Nous Research".
5. Expect Portal `/oauth/authorize` page; sign in; consent.
6. Expect redirect to `/auth/callback?code=…&state=…`; cookie set; redirect to `/`.
7. Open dev tools; `/api/auth/me` returns user_id; `/api/pty` ticket-auth path works (Phase 5).
8. Wait 900 s; expect 401 on next mutation; expect SPA to redirect to `/login` (Phase 6 v2).

### Phase 4 v1 (rejected — preserved for archeology)

The v1 draft below assumed (a) a static `hermes-dashboard` OAuth client, (b) `signing_mode=userinfo` with JWKS as a future upgrade, and (c) refresh tokens. All three were reversed by the contract; see Contract Anchor above.



### Task 4.1: Plugin skeleton + provider class

**Objective:** A `plugins/dashboard-auth-nous/` directory with `plugin.yaml`, `__init__.py` that imports and registers the provider, and `provider.py` that implements the OAuth dance.

**Files:**
- Create: `plugins/dashboard-auth-nous/plugin.yaml`
- Create: `plugins/dashboard-auth-nous/__init__.py`
- Create: `plugins/dashboard-auth-nous/provider.py`
- Create: `plugins/dashboard-auth-nous/test_provider.py`

**Step 1: Plugin manifest.**

```yaml
# plugins/dashboard-auth-nous/plugin.yaml
name: dashboard-auth-nous
version: 1.0.0
description: "Default dashboard auth provider for Hermes — OAuth via Nous Portal (portal.nousresearch.com)."
author: NousResearch
kind: dashboard_auth
pip_dependencies:
  - httpx
  - pyjwt[crypto]
```

**Step 2: Plugin entry point.**

```python
# plugins/dashboard-auth-nous/__init__.py
"""Default dashboard-auth provider — Nous Portal OAuth.

Auto-loaded by the plugin system at startup. Registers the provider into
the dashboard-auth registry via the plugin context hook.
"""
from plugins.dashboard_auth_nous.provider import NousDashboardAuthProvider


def register(ctx):
    """Plugin entry — called by the plugin loader.

    Honours these env vars (typically left unset; the defaults are correct
    for production Nous Portal):

      HERMES_DASHBOARD_AUTH_NOUS_PORTAL_URL  — override portal base URL
                                               (default: https://portal.nousresearch.com)
      HERMES_DASHBOARD_AUTH_NOUS_CLIENT_ID   — override OAuth client_id
                                               (default: hermes-dashboard)
      HERMES_DASHBOARD_AUTH_NOUS_SIGNING_MODE — "userinfo" (default) or "jwks"
    """
    ctx.register_dashboard_auth_provider(NousDashboardAuthProvider())
```

**Step 3: Provider implementation.**

```python
# plugins/dashboard-auth-nous/provider.py
"""NousDashboardAuthProvider — authorization-code + PKCE against Nous Portal."""
from __future__ import annotations

import base64
import hashlib
import logging
import os
import secrets
import time
import urllib.parse
from typing import Optional

import httpx

from hermes_cli.dashboard_auth.base import (
    DashboardAuthProvider,
    Session,
    LoginStart,
    InvalidCodeError,
    ProviderError,
    RefreshExpiredError,
)

_log = logging.getLogger(__name__)

_DEFAULT_PORTAL_URL = "https://portal.nousresearch.com"
_DEFAULT_CLIENT_ID = "hermes-dashboard"
_DEFAULT_SIGNING_MODE = "userinfo"  # or "jwks"

# Scopes:
#   openid profile email — identity claims
#   inference:invoke tool:invoke — Hermes inherits these from Portal's default
#                                  scope set, so the agent can use them later.
_SCOPE = "openid profile email inference:invoke tool:invoke"


def _b64url_no_pad(raw: bytes) -> str:
    return base64.urlsafe_b64encode(raw).rstrip(b"=").decode()


def _make_pkce_pair() -> tuple[str, str]:
    verifier = _b64url_no_pad(secrets.token_bytes(64))
    challenge = _b64url_no_pad(hashlib.sha256(verifier.encode()).digest())
    return verifier, challenge


class NousDashboardAuthProvider(DashboardAuthProvider):
    name = "nous"
    display_name = "Nous Portal"

    def __init__(self):
        self._portal_url = (
            os.getenv("HERMES_DASHBOARD_AUTH_NOUS_PORTAL_URL")
            or _DEFAULT_PORTAL_URL
        ).rstrip("/")
        self._client_id = (
            os.getenv("HERMES_DASHBOARD_AUTH_NOUS_CLIENT_ID")
            or _DEFAULT_CLIENT_ID
        )
        self._signing_mode = (
            os.getenv("HERMES_DASHBOARD_AUTH_NOUS_SIGNING_MODE")
            or _DEFAULT_SIGNING_MODE
        )
        # Simple 60s memoisation for verify_session in userinfo mode so we
        # don't hammer Portal on every browser request.
        self._verify_cache: dict[str, tuple[int, Session]] = {}

    # ---- OAuth ---------------------------------------------------------

    def start_login(self, *, redirect_uri: str) -> LoginStart:
        verifier, challenge = _make_pkce_pair()
        state = _b64url_no_pad(secrets.token_bytes(24))
        params = {
            "response_type": "code",
            "client_id": self._client_id,
            "redirect_uri": redirect_uri,
            "scope": _SCOPE,
            "state": state,
            "code_challenge": challenge,
            "code_challenge_method": "S256",
        }
        auth_url = f"{self._portal_url}/oauth/authorize?" + urllib.parse.urlencode(params)
        return LoginStart(
            redirect_url=auth_url,
            cookie_payload={
                # Caller (routes.py) prepends `provider=nous;`
                "hermes_session_pkce": f"state={state};verifier={verifier}",
            },
        )

    def complete_login(
        self, *, code, state, code_verifier, redirect_uri,
    ) -> Session:
        token_url = f"{self._portal_url}/api/oauth/token"
        try:
            with httpx.Client(timeout=httpx.Timeout(15.0)) as client:
                r = client.post(
                    token_url,
                    data={
                        "grant_type": "authorization_code",
                        "code": code,
                        "code_verifier": code_verifier,
                        "client_id": self._client_id,
                        "redirect_uri": redirect_uri,
                    },
                    headers={"Accept": "application/json"},
                )
        except httpx.HTTPError as e:
            raise ProviderError(f"Portal token endpoint unreachable: {e}")

        if r.status_code == 400:
            raise InvalidCodeError(f"Portal rejected code: {r.text}")
        if r.status_code >= 500:
            raise ProviderError(f"Portal token endpoint returned {r.status_code}")
        if r.status_code != 200:
            raise InvalidCodeError(f"Portal token exchange failed: HTTP {r.status_code} {r.text}")

        body = r.json()
        return self._session_from_token_response(body)

    def verify_session(self, *, access_token: str) -> Optional[Session]:
        # Cache hit?
        now = int(time.time())
        cached = self._verify_cache.get(access_token)
        if cached and cached[0] > now:
            return cached[1]

        if self._signing_mode == "jwks":
            return self._verify_via_jwks(access_token)
        return self._verify_via_userinfo(access_token)

    def refresh_session(self, *, refresh_token: str) -> Session:
        token_url = f"{self._portal_url}/api/oauth/token"
        try:
            with httpx.Client(timeout=httpx.Timeout(15.0)) as client:
                r = client.post(
                    token_url,
                    data={
                        "grant_type": "refresh_token",
                        "refresh_token": refresh_token,
                        "client_id": self._client_id,
                    },
                    headers={"Accept": "application/json"},
                )
        except httpx.HTTPError as e:
            raise ProviderError(f"Portal refresh endpoint unreachable: {e}")

        if r.status_code in (400, 401):
            # Portal indicates the refresh token is dead.
            raise RefreshExpiredError(f"Portal rejected refresh: {r.text}")
        if r.status_code != 200:
            raise ProviderError(f"Portal refresh failed: HTTP {r.status_code} {r.text}")

        return self._session_from_token_response(r.json())

    def revoke_session(self, *, refresh_token: str) -> None:
        # Portal's existing API exposes revocation through Account Service's
        # /api/account/oauth/sessions delete-by-id route. The refresh token
        # itself isn't accepted as a revoke key. Best-effort: we POST it to
        # the token endpoint with grant_type=refresh_token, then discard the
        # response — this consumes the refresh and rotates it server-side,
        # which is sufficient for "this old refresh is now dead". A future
        # iteration can add a dedicated /api/oauth/revoke endpoint.
        try:
            with httpx.Client(timeout=httpx.Timeout(5.0)) as client:
                client.post(
                    f"{self._portal_url}/api/oauth/token",
                    data={
                        "grant_type": "refresh_token",
                        "refresh_token": refresh_token,
                        "client_id": self._client_id,
                    },
                )
        except httpx.HTTPError:
            # Best-effort; log but don't raise.
            _log.warning("dashboard-auth-nous: revoke best-effort call failed", exc_info=True)

    # ---- internals -----------------------------------------------------

    def _session_from_token_response(self, body: dict) -> Session:
        access_token = body.get("access_token", "")
        refresh_token = body.get("refresh_token", "")
        if not access_token or not refresh_token:
            raise ProviderError("Portal token response missing tokens")

        # Decode the JWT payload (no signature verification here — only used
        # to extract claims for the Session dataclass; signature verification
        # happens in verify_session).
        claims = self._decode_jwt_payload_unsafe(access_token)
        now = int(time.time())
        expires_at = int(claims.get("exp", now + 3600))
        return Session(
            user_id=str(claims.get("sub", "")),
            email=str(claims.get("email", "")),
            display_name=str(claims.get("name", "") or claims.get("email", "")),
            org_id=str(claims.get("org_id", "")),
            provider=self.name,
            expires_at=expires_at,
            access_token=access_token,
            refresh_token=refresh_token,
        )

    def _decode_jwt_payload_unsafe(self, token: str) -> dict:
        """Decode the JWT payload without verification. Used only to extract
        claims for the Session dataclass; signature verification is the job
        of ``verify_session``."""
        try:
            header_b64, payload_b64, _sig = token.split(".")
            padded = payload_b64 + "=" * (-len(payload_b64) % 4)
            import json
            return json.loads(base64.urlsafe_b64decode(padded))
        except Exception as e:
            raise ProviderError(f"Cannot decode JWT payload: {e}")

    def _verify_via_userinfo(self, access_token: str) -> Optional[Session]:
        """Use Portal's /api/oauth/account as a userinfo endpoint.

        Cached for 60 seconds keyed on the access_token. Returns None if
        Portal returns 401 (expired/invalid token).
        """
        try:
            with httpx.Client(timeout=httpx.Timeout(10.0)) as client:
                r = client.get(
                    f"{self._portal_url}/api/oauth/account",
                    headers={
                        "Authorization": f"Bearer {access_token}",
                        "Accept": "application/json",
                    },
                )
        except httpx.HTTPError as e:
            raise ProviderError(f"Portal /api/oauth/account unreachable: {e}")

        if r.status_code == 401:
            return None
        if r.status_code >= 500:
            raise ProviderError(f"Portal /api/oauth/account returned {r.status_code}")
        if r.status_code != 200:
            return None

        body = r.json()
        # Cache the verified Session for 60 seconds.
        claims = self._decode_jwt_payload_unsafe(access_token)
        now = int(time.time())
        sess = Session(
            user_id=str(body.get("userId", claims.get("sub", ""))),
            email=str(body.get("email", claims.get("email", ""))),
            display_name=str(body.get("name", claims.get("name", "") or body.get("email", ""))),
            org_id=str(body.get("orgId", claims.get("org_id", ""))),
            provider=self.name,
            expires_at=int(claims.get("exp", now + 3600)),
            access_token=access_token,
            refresh_token="",  # not returned on verify
        )
        self._verify_cache[access_token] = (now + 60, sess)
        return sess

    def _verify_via_jwks(self, access_token: str) -> Optional[Session]:
        """Verify the JWT signature against Portal's JWKS."""
        try:
            import jwt as _jwt
            from jwt import PyJWKClient
        except ImportError:
            raise ProviderError("pyjwt[crypto] not installed — falling back to userinfo")

        jwks_url = f"{self._portal_url}/.well-known/jwks.json"
        try:
            client = PyJWKClient(jwks_url)
            signing_key = client.get_signing_key_from_jwt(access_token)
            claims = _jwt.decode(
                access_token,
                signing_key.key,
                algorithms=["RS256"],
                audience=f"hermes-cli:{self._client_id}",
                issuer=self._portal_url,
            )
        except _jwt.ExpiredSignatureError:
            return None
        except _jwt.InvalidTokenError as e:
            _log.warning("dashboard-auth-nous: JWT validation failed: %s", e)
            return None
        except Exception as e:
            raise ProviderError(f"JWKS verify failed: {e}")

        now = int(time.time())
        sess = Session(
            user_id=str(claims.get("sub", "")),
            email=str(claims.get("email", "")),
            display_name=str(claims.get("name", "") or claims.get("email", "")),
            org_id=str(claims.get("org_id", "")),
            provider=self.name,
            expires_at=int(claims.get("exp", now + 3600)),
            access_token=access_token,
            refresh_token="",
        )
        self._verify_cache[access_token] = (now + 60, sess)
        return sess
```

**Step 4: Unit tests for the provider.**

```python
# plugins/dashboard-auth-nous/test_provider.py
"""Unit tests for the Nous dashboard-auth provider. Mocks Portal endpoints."""
import json
import time
import pytest
import respx
import httpx

from hermes_cli.dashboard_auth.base import (
    assert_protocol_compliance, InvalidCodeError, ProviderError, RefreshExpiredError,
)
from plugins.dashboard_auth_nous.provider import NousDashboardAuthProvider


def test_protocol_compliance():
    assert_protocol_compliance(NousDashboardAuthProvider) is None


def test_start_login_returns_authorize_url():
    p = NousDashboardAuthProvider()
    ls = p.start_login(redirect_uri="https://x.fly.dev/auth/callback")
    assert ls.redirect_url.startswith("https://portal.nousresearch.com/oauth/authorize?")
    assert "response_type=code" in ls.redirect_url
    assert "client_id=hermes-dashboard" in ls.redirect_url
    assert "code_challenge_method=S256" in ls.redirect_url
    assert "state=" in ls.redirect_url
    assert "scope=" in ls.redirect_url
    # State+verifier go into the cookie payload
    pkce = ls.cookie_payload["hermes_session_pkce"]
    assert "state=" in pkce
    assert "verifier=" in pkce


@respx.mock
def test_complete_login_happy_path():
    p = NousDashboardAuthProvider()
    # Forge a JWT-shaped access_token: header.payload.sig with a real payload
    import base64
    payload = {
        "sub": "u_123", "email": "u@nous.com", "name": "U Nous",
        "org_id": "org_x", "exp": int(time.time()) + 3600,
        "aud": "hermes-cli:hermes-dashboard",
    }
    payload_b64 = base64.urlsafe_b64encode(json.dumps(payload).encode()).rstrip(b"=").decode()
    access_token = f"hdr.{payload_b64}.sig"

    respx.post("https://portal.nousresearch.com/api/oauth/token").mock(
        return_value=httpx.Response(200, json={
            "access_token": access_token, "refresh_token": "rt_xyz",
            "token_type": "Bearer", "expires_in": 3600,
            "scope": "openid profile email inference:invoke tool:invoke",
        })
    )

    sess = p.complete_login(code="auth_code", state="s", code_verifier="v",
                            redirect_uri="https://x.fly.dev/auth/callback")
    assert sess.user_id == "u_123"
    assert sess.email == "u@nous.com"
    assert sess.display_name == "U Nous"
    assert sess.org_id == "org_x"
    assert sess.access_token == access_token
    assert sess.refresh_token == "rt_xyz"
    assert sess.provider == "nous"


@respx.mock
def test_complete_login_invalid_code_raises():
    p = NousDashboardAuthProvider()
    respx.post("https://portal.nousresearch.com/api/oauth/token").mock(
        return_value=httpx.Response(400, json={"error": "invalid_grant"})
    )
    with pytest.raises(InvalidCodeError):
        p.complete_login(code="bad", state="s", code_verifier="v",
                         redirect_uri="https://x.fly.dev/auth/callback")


@respx.mock
def test_complete_login_portal_5xx_raises_provider_error():
    p = NousDashboardAuthProvider()
    respx.post("https://portal.nousresearch.com/api/oauth/token").mock(
        return_value=httpx.Response(503, json={"error": "service_unavailable"})
    )
    with pytest.raises(ProviderError):
        p.complete_login(code="c", state="s", code_verifier="v",
                         redirect_uri="https://x.fly.dev/auth/callback")


@respx.mock
def test_verify_session_userinfo_mode_happy():
    p = NousDashboardAuthProvider()
    import base64
    payload = {"sub": "u1", "email": "u@x.com", "name": "U", "org_id": "o",
               "exp": int(time.time()) + 3600}
    token = f"hdr.{base64.urlsafe_b64encode(json.dumps(payload).encode()).rstrip(b'=').decode()}.sig"
    respx.get("https://portal.nousresearch.com/api/oauth/account").mock(
        return_value=httpx.Response(200, json={
            "userId": "u1", "email": "u@x.com", "name": "U", "orgId": "o",
        })
    )
    sess = p.verify_session(access_token=token)
    assert sess is not None
    assert sess.user_id == "u1"


@respx.mock
def test_verify_session_userinfo_401_returns_none():
    p = NousDashboardAuthProvider()
    import base64
    payload = {"sub": "u1", "exp": int(time.time()) + 3600}
    token = f"hdr.{base64.urlsafe_b64encode(json.dumps(payload).encode()).rstrip(b'=').decode()}.sig"
    respx.get("https://portal.nousresearch.com/api/oauth/account").mock(
        return_value=httpx.Response(401)
    )
    assert p.verify_session(access_token=token) is None


@respx.mock
def test_refresh_session_happy():
    p = NousDashboardAuthProvider()
    import base64
    payload = {"sub": "u1", "email": "u@x.com", "name": "U", "org_id": "o",
               "exp": int(time.time()) + 3600}
    new_token = f"hdr.{base64.urlsafe_b64encode(json.dumps(payload).encode()).rstrip(b'=').decode()}.sig"
    respx.post("https://portal.nousresearch.com/api/oauth/token").mock(
        return_value=httpx.Response(200, json={
            "access_token": new_token, "refresh_token": "rt_new",
            "token_type": "Bearer", "expires_in": 3600,
        })
    )
    sess = p.refresh_session(refresh_token="rt_old")
    assert sess.access_token == new_token
    assert sess.refresh_token == "rt_new"


@respx.mock
def test_refresh_session_expired_raises():
    p = NousDashboardAuthProvider()
    respx.post("https://portal.nousresearch.com/api/oauth/token").mock(
        return_value=httpx.Response(400, json={"error": "invalid_grant"})
    )
    with pytest.raises(RefreshExpiredError):
        p.refresh_session(refresh_token="rt_dead")
```

**Step 5: Run, verify pass.**

```bash
scripts/run_tests.sh plugins/dashboard-auth-nous/test_provider.py -v
```

Adds `respx` to the test deps if not already present.

**Step 6: Commit.**

```bash
git add plugins/dashboard-auth-nous/
git commit -m "feat(dashboard-auth-nous): default OAuth provider for Nous Portal (authcode + PKCE)"
```

### Task 4.2: Integrate plugin discovery for dashboard-auth

**Objective:** Confirm the existing plugin loader picks up `plugins/dashboard-auth-nous/` on `hermes dashboard` startup. The plugin manager should already auto-discover any plugin with a `plugin.yaml`; this task verifies and locks that behavior with a test.

**Files:**
- Modify (only if needed): `hermes_cli/plugins.py` — confirm the loader scans `plugins/` for built-in plugins. (It already does — `plugins/memory/honcho/` and `plugins/image_gen/openai/` are auto-loaded.)
- Test: `tests/hermes_cli/test_dashboard_auth_plugin_discovery.py`

**Step 1: Test the discovery integration.**

```python
# tests/hermes_cli/test_dashboard_auth_plugin_discovery.py
"""When the dashboard starts, the bundled Nous auth provider must auto-register."""
from hermes_cli.dashboard_auth import clear_providers, get_provider
from hermes_cli.plugins import PluginManager


def test_bundled_nous_auth_plugin_is_discovered_and_registered(tmp_path, monkeypatch):
    clear_providers()
    # Use a real PluginManager pointed at the repo's plugins/ dir.
    mgr = PluginManager()
    mgr.discover_and_load()
    # Either the Nous provider OR no provider is acceptable in CI where
    # plugins might be opt-in; assert that if the plugin is in the registry,
    # it speaks the correct portal URL.
    nous = get_provider("nous")
    if nous is not None:
        assert nous.display_name == "Nous Portal"
    clear_providers()
```

**Step 2: Run.**

```bash
scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_plugin_discovery.py -v
```

**Step 3: Commit.**

```bash
git add tests/hermes_cli/test_dashboard_auth_plugin_discovery.py
git commit -m "test(dashboard-auth): verify Nous provider auto-loads through plugin discovery"
```

### Phase 4 Exit Gate

```bash
scripts/run_tests.sh plugins/dashboard-auth-nous/ tests/hermes_cli/test_dashboard_auth_plugin_discovery.py -v
```

Integration smoke (requires staging Portal access — operator-run, not CI):

1. Set `HERMES_DASHBOARD_AUTH_NOUS_PORTAL_URL=https://staging.portal.nousresearch.com`.
2. `hermes dashboard --host 0.0.0.0 --port 9119`
3. Visit `http://localhost:9119/login` → click "Sign in with Nous Portal" → redirected to staging Portal → approve → redirected back to `/`.
4. `/api/auth/me` returns `{user_id, email, display_name, org_id, provider: "nous", expires_at}`.

**Hard dependency on cross-repo work:** Phase 4 cannot pass the integration smoke until the Portal-side items in the Cross-Repo Coordination Checklist land. The unit tests (mocked Portal endpoints) pass independently.

---

## Phase 5 — WebSocket Ticket Auth (`--tui` Support in Gated Mode)

**Goal:** The PTY/WS endpoints (`/api/pty`, `/api/ws`, `/api/pub`, `/api/events`) currently authenticate via `?token=<_SESSION_TOKEN>`. In gated mode the SPA has cookies, not the token. This phase adds a `/api/auth/ws-ticket` endpoint that mints a short-lived single-use ticket from a valid cookie, and updates each WS endpoint to accept either the legacy token (loopback mode) OR a ticket (gated mode).

### Task 5.1: Ticket store + mint endpoint

**Objective:** A small in-memory ticket store with TTL + single-use semantics, and an authenticated endpoint that mints a ticket for the cookie's session.

**Files:**
- Create: `hermes_cli/dashboard_auth/ws_tickets.py`
- Modify: `hermes_cli/dashboard_auth/routes.py` — add `/api/auth/ws-ticket`.
- Create: `tests/hermes_cli/test_dashboard_auth_ws_tickets.py`

**Step 1: Write failing test.**

```python
# tests/hermes_cli/test_dashboard_auth_ws_tickets.py
import time
import pytest
from hermes_cli.dashboard_auth.ws_tickets import (
    mint_ticket, consume_ticket, TicketInvalid,
)


def test_mint_and_consume_round_trip():
    ticket = mint_ticket(user_id="u1", provider="nous")
    # Must be opaque token (urlsafe base64ish), reasonable length
    assert len(ticket) >= 32
    info = consume_ticket(ticket)
    assert info["user_id"] == "u1"
    assert info["provider"] == "nous"


def test_ticket_is_single_use():
    ticket = mint_ticket(user_id="u1", provider="stub")
    consume_ticket(ticket)
    with pytest.raises(TicketInvalid, match="already consumed|unknown"):
        consume_ticket(ticket)


def test_expired_ticket_rejected(monkeypatch):
    real_time = time.time
    t0 = real_time()
    monkeypatch.setattr("hermes_cli.dashboard_auth.ws_tickets.time.time",
                        lambda: t0)
    ticket = mint_ticket(user_id="u1", provider="stub")
    # Jump forward 31 seconds (TTL = 30s)
    monkeypatch.setattr("hermes_cli.dashboard_auth.ws_tickets.time.time",
                        lambda: t0 + 31)
    with pytest.raises(TicketInvalid, match="expired"):
        consume_ticket(ticket)


def test_unknown_ticket_rejected():
    with pytest.raises(TicketInvalid, match="unknown"):
        consume_ticket("nope-never-minted")
```

**Step 2: Implement.**

```python
# hermes_cli/dashboard_auth/ws_tickets.py
"""Short-lived single-use tickets for WS-upgrade auth in gated mode.

Browsers cannot set Authorization on a WebSocket upgrade. In loopback
mode the legacy ``?token=<_SESSION_TOKEN>`` query param works because
the token comes from the injected SPA script. In gated mode there is no
injected token — the SPA gets a fresh ticket via the authenticated REST
endpoint ``/api/auth/ws-ticket`` and passes that as ``?ticket=`` on the
WS upgrade.

Tickets are single-use, TTL = 30 seconds. In-memory; the dashboard is a
single process so no distributed coordination is needed.
"""
from __future__ import annotations

import secrets
import threading
import time
from typing import Optional

_TTL_SECONDS = 30
_lock = threading.Lock()
_tickets: dict[str, tuple[int, dict]] = {}  # ticket -> (expires_at, info)


class TicketInvalid(Exception):
    """Ticket missing, expired, or already consumed."""


def mint_ticket(*, user_id: str, provider: str) -> str:
    """Generate a one-shot ticket bound to this user identity."""
    ticket = secrets.token_urlsafe(32)
    info = {"user_id": user_id, "provider": provider, "minted_at": int(time.time())}
    with _lock:
        _tickets[ticket] = (int(time.time()) + _TTL_SECONDS, info)
        _gc_expired_locked()
    return ticket


def consume_ticket(ticket: str) -> dict:
    """Validate and consume. Raises TicketInvalid on missing/expired/used."""
    now = int(time.time())
    with _lock:
        entry = _tickets.pop(ticket, None)
        if entry is None:
            raise TicketInvalid(f"unknown ticket: {ticket[:8]}…")
        expires_at, info = entry
        if expires_at < now:
            raise TicketInvalid("expired")
        return info


def _gc_expired_locked() -> None:
    now = int(time.time())
    expired = [t for t, (exp, _) in _tickets.items() if exp < now]
    for t in expired:
        _tickets.pop(t, None)
```

**Step 3: Add the mint endpoint.**

In `hermes_cli/dashboard_auth/routes.py`:

```python
from hermes_cli.dashboard_auth.ws_tickets import mint_ticket


@router.post("/api/auth/ws-ticket", name="auth_ws_ticket")
async def api_auth_ws_ticket(request: Request):
    """Mint a short-lived WS ticket for the authenticated session."""
    sess = getattr(request.state, "session", None)
    if sess is None:
        # Middleware should already have rejected, but check defensively.
        raise HTTPException(status_code=401, detail="Unauthorized")
    ticket = mint_ticket(user_id=sess.user_id, provider=sess.provider)
    audit_log(AuditEvent.WS_TICKET_MINTED, provider=sess.provider,
              user_id=sess.user_id, ip=_client_ip(request))
    return {"ticket": ticket, "ttl_seconds": 30}
```

**Step 4: Run, verify pass.**

```bash
scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_ws_tickets.py -v
```

**Step 5: Commit.**

```bash
git add hermes_cli/dashboard_auth/ws_tickets.py hermes_cli/dashboard_auth/routes.py tests/hermes_cli/test_dashboard_auth_ws_tickets.py
git commit -m "feat(dashboard-auth): single-use WS tickets for cookie→ws bridge"
```

### Task 5.2: Update WS endpoints to accept tickets

**Objective:** `/api/pty`, `/api/ws`, `/api/pub`, `/api/events` accept either `?token=<_SESSION_TOKEN>` (loopback) or `?ticket=<ticket>` (gated). In gated mode the legacy token path is rejected.

**Files:**
- Modify: `hermes_cli/web_server.py:3520` (`/api/ws`), `:3562`, `:3591`, plus `/api/pty` (~line 3264).

**Step 1: Write failing test.**

Append to `tests/hermes_cli/test_dashboard_auth_middleware.py`:

```python
def test_ws_accepts_ticket_in_gated_mode(gated_app):
    # Authenticate via the stub round trip, then mint a ticket.
    r1 = gated_app.get("/auth/login?provider=stub", follow_redirects=False)
    state = r1.headers["location"].split("state=")[1]
    r2 = gated_app.get(f"/auth/callback?code=stub_code&state={state}",
                       follow_redirects=False)
    assert r2.status_code == 302

    rt = gated_app.post("/api/auth/ws-ticket")
    assert rt.status_code == 200
    ticket = rt.json()["ticket"]

    # The PTY endpoint should accept ?ticket=... in gated mode.
    # Use the WS test client. Don't actually do the PTY handshake — the
    # auth gate is what we're testing.
    with gated_app.websocket_connect(f"/api/pty?ticket={ticket}") as ws:
        # Either we read a banner or the server closes cleanly because no
        # tty-write follows. Both prove the auth gate accepted the ticket.
        pass


def test_ws_rejects_legacy_token_in_gated_mode(gated_app):
    # Even if you somehow knew the legacy _SESSION_TOKEN, gated mode
    # must NOT accept it.
    from hermes_cli import web_server
    with pytest.raises(Exception):  # WSException / ConnectionClosed
        with gated_app.websocket_connect(
            f"/api/pty?token={web_server._SESSION_TOKEN}"
        ):
            pass


def test_ws_rejects_consumed_ticket(gated_app):
    r1 = gated_app.get("/auth/login?provider=stub", follow_redirects=False)
    state = r1.headers["location"].split("state=")[1]
    gated_app.get(f"/auth/callback?code=stub_code&state={state}", follow_redirects=False)
    rt = gated_app.post("/api/auth/ws-ticket")
    ticket = rt.json()["ticket"]

    # First use — fine
    with gated_app.websocket_connect(f"/api/pty?ticket={ticket}"):
        pass
    # Second use — rejected (single-use)
    with pytest.raises(Exception):
        with gated_app.websocket_connect(f"/api/pty?ticket={ticket}"):
            pass
```

**Step 2: Update each WS endpoint.**

Pattern for each (refactor the duplicated check into a helper):

```python
# In hermes_cli/web_server.py — add near the other helpers

def _ws_auth_ok(ws: WebSocket, app_state) -> bool:
    """Validate WS auth in either loopback or gated mode.

    Returns True if the ws should be accepted. Caller is responsible for
    closing with the right code if False.
    """
    if getattr(app_state, "auth_required", False):
        ticket = ws.query_params.get("ticket", "")
        if not ticket:
            return False
        from hermes_cli.dashboard_auth.ws_tickets import consume_ticket, TicketInvalid
        try:
            consume_ticket(ticket)
            return True
        except TicketInvalid:
            return False
    token = ws.query_params.get("token", "")
    return hmac.compare_digest(token.encode(), _SESSION_TOKEN.encode())
```

Then update each WS handler to use it:

```python
@app.websocket("/api/ws")
async def gateway_ws(ws: WebSocket) -> None:
    if not _DASHBOARD_EMBEDDED_CHAT_ENABLED:
        await ws.close(code=4403)
        return
    if not _ws_auth_ok(ws, app.state):
        await ws.close(code=4401)
        return
    if not _ws_client_is_allowed(ws):
        await ws.close(code=4403)
        return
    from tui_gateway.ws import handle_ws
    await handle_ws(ws)
```

Same surgery for `/api/pty`, `/api/pub`, `/api/events`.

**Step 3: SPA-side change.**

The React SPA's WS client must, in `auth_required` mode, fetch a fresh ticket from `/api/auth/ws-ticket` before each connect rather than using `window.__HERMES_SESSION_TOKEN__`.

Files:
- Modify: `web/src/pages/ChatPage.tsx` — the xterm.js WebSocket connect.
- Modify: `web/src/lib/api.ts` — add `getWsTicket()` typed wrapper.

```typescript
// web/src/lib/api.ts — add:
export async function getWsTicket(): Promise<{ ticket: string; ttl_seconds: number }> {
  const r = await fetch('/api/auth/ws-ticket', { method: 'POST', credentials: 'include' });
  if (!r.ok) throw new Error(`ws-ticket: HTTP ${r.status}`);
  return r.json();
}
```

```typescript
// web/src/pages/ChatPage.tsx — replace token usage with:
const ws_url = window.__HERMES_AUTH_REQUIRED__
  ? `/api/pty?ticket=${encodeURIComponent((await getWsTicket()).ticket)}`
  : `/api/pty?token=${encodeURIComponent(window.__HERMES_SESSION_TOKEN__)}`;
```

**Step 4: Run, verify pass.**

```bash
scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_middleware.py -v -k ws
```

**Step 5: Commit.**

```bash
git add hermes_cli/web_server.py web/src/pages/ChatPage.tsx web/src/lib/api.ts tests/hermes_cli/test_dashboard_auth_middleware.py
git commit -m "feat(dashboard-auth): WS ticket auth for /api/pty + /api/ws + /api/pub + /api/events"
```

### Phase 5 Exit Gate

`hermes dashboard --host 0.0.0.0 --port 9119 --tui` with the stub provider:
1. Login as before.
2. Visit `/chat` → xterm.js opens.
3. The browser's network tab shows `POST /api/auth/ws-ticket` returning 200, immediately followed by `GET /api/pty?ticket=…` upgrading to WS.
4. The TUI is interactive.

Loopback `hermes dashboard --tui` keeps working without any of the above (legacy token path).

---

## Phase 6 — 401-Triggered Re-Authentication (v2 — contract-compliant)

> **Plan v2 rewrite.** The Portal contract V1 does not issue refresh tokens (see Contract Anchor C5). Silent-refresh machinery is replaced by a "401 → redirect to `/login`" UX. The v1 draft is preserved below as "Phase 6 v1 (rejected — preserved for archeology)" so reviewers can see the alternative we explored.

**Goal:** When the access token in `hermes_session_at` expires (15-minute TTL per contract C6), the dashboard cleanly bounces the user back through `/oauth/authorize`. No silent refresh; no UX surprises beyond the single redirect. The behaviour must be identical whether the expiry is detected (a) at the gateway middleware (HTML navigation request) or (b) by an XHR / fetch from the SPA.

### Design overview

Two interception points handle expiry:

1. **`gated_auth_middleware` (HTML navigation requests).** Already in place from Phase 3. When `verify_session` raises `InvalidCodeError("access token expired: …")`, the middleware:
   - clears the `hermes_session_at` cookie,
   - audit-logs `auth.session_expired`,
   - returns `RedirectResponse("/login?next={original_path}", status_code=303)`.
2. **`/api/*` JSON endpoints.** A new sibling middleware (`gated_api_auth_middleware`) handles XHR fetches: instead of redirecting (which a `fetch()` call cannot follow into the OAuth dance), it returns `401 {"error": "session_expired", "login_url": "/login?next=…"}`. The SPA's global fetch wrapper notices the 401 and triggers a full-page navigation to `login_url`.

This split is canonical OAuth UX — modern SPAs interpret 401 as "your session is gone" and any subsequent decision (re-auth flow choice, where to send the user) is conveyed in the body. The middleware does not return 302 to `/login` for API requests because (a) most browsers' fetch APIs swallow the redirect into the cross-origin OAuth flow opaquely, and (b) returning HTML in response to `Accept: application/json` confuses front-end frameworks.

### Task 6.1: API auth middleware + `session_expired` envelope

**Files:**
- Modify: `hermes_cli/dashboard_auth/middleware.py` — add `gated_api_auth_middleware`.
- Modify: `hermes_cli/web_server.py` — wire it in alongside `gated_auth_middleware`.
- Add: `tests/hermes_cli/test_dashboard_auth_api_401.py`.

**Behavior:**
- Path matches `/api/*` and **not** the auth allowlist (`/api/auth/providers`, `/api/auth/login`, `/api/auth/callback`).
- Reads `hermes_session_at` cookie; if absent → `401 {"error": "unauthenticated", "login_url": "/login"}`.
- If present, calls the provider's `verify_session`. On any exception (`InvalidCodeError` / `ProviderError` / `RefreshExpiredError`) → clear cookie, audit-log, return `401 {"error": "session_expired", "login_url": "/login?next=/"}`. (`next=/` not `next={path}` for API calls — the user wasn't navigating to the API endpoint directly.)
- On success, stash claims on `request.state.auth_session` and call the route.

**Audit-log events added:**
- `auth.api_unauthenticated` — `/api/*` request with no cookie.
- `auth.api_session_expired` — `/api/*` request with expired/invalid cookie.

**WebSocket endpoints (`/api/pty`, `/api/ws`) are NOT covered by this middleware.** They use the ticket-auth flow from Phase 5. A WS upgrade request with an expired access-token cookie should never reach `/api/auth/ws-ticket` (which is an HTTP POST covered by this middleware), so the SPA's ticket-fetch step is the natural failure point.

### Task 6.2: SPA global 401 handler

**Files:**
- Modify: `dashboard/src/api/client.ts` (or wherever the central fetch wrapper lives — find via grep).
- Add: `dashboard/src/api/__tests__/sessionExpired.test.ts`.

**Behavior:**
- Single shared `apiFetch(path, init)` helper used by all SPA code.
- When `response.status === 401 && response.headers.get("content-type")?.startsWith("application/json")`:
  1. Parse body.
  2. If `body.error in ("unauthenticated", "session_expired")`, call `window.location.assign(body.login_url)`. Return a never-resolving promise so the caller's `.then` doesn't fire — the page is going away.
  3. Otherwise, reject normally (the route returned a domain 401 like "monitor X is read-only for your role").
- One small UX nicety: before the redirect, the helper sets `sessionStorage.setItem("hermes.lastLocation", window.location.pathname)` so the post-login redirect can land back where the user was. The `/auth/callback` handler reads this and, if it's a same-origin path, uses it as the `next=` value.

### Task 6.3: Remove the `hermes_session_rt` cookie + refresh path

**Files:**
- Modify: `hermes_cli/dashboard_auth/cookies.py` — drop `set_refresh_cookie`, `clear_refresh_cookie`, `get_refresh_token`.
- Modify: `hermes_cli/dashboard_auth/routes.py` — `/auth/callback` no longer writes a refresh cookie; `/auth/logout` no longer needs to clear it (it never existed).
- Modify: `tests/hermes_cli/test_dashboard_auth_cookies.py` — drop the three RT tests; add a regression that `hermes_session_rt` is NOT a cookie name we emit.

**Rationale:** Contract V1 does not issue refresh tokens, so persisting one is dead state. The provider's `refresh_session` raises `RefreshExpiredError` unconditionally; if we wired the middleware to call it, the cookie machinery would observe an empty `refresh_token` and the result would be the same as having no cookie. Keeping the cookie around is just attack surface.

**Forward compatibility:** if Portal later starts issuing refresh tokens, the provider's `complete_login` already ignores them today (line `# Contract V1: no refresh token. If one is present, we deliberately ignore it`). To turn them on later, three things change: cookies.py grows the RT cookie back, provider sets `Session.refresh_token`, middleware adds a "near-expiry → refresh" branch in front of the expired branch. None of those changes break the V1 behavior; they're additive. Document this in the file header.

### Task 6.4: Audit-log + observability

**Files:**
- Modify: `hermes_cli/dashboard_auth/audit.py` — extend `AuditEvent` enum with `API_UNAUTHENTICATED`, `API_SESSION_EXPIRED` (already covered above for completeness).
- Modify: `docs/dashboard-auth-operations.md` (new in Phase 7) — document the redirect/401 split + how to read the audit log to debug "users keep getting logged out".

### Phase 6 v1 (rejected — preserved for archeology)

The v1 draft below implemented silent token refresh in the middleware: when the access token was within 60s of expiry, the provider's `refresh_session` would mint a new pair using the stored refresh token, and the user would never see a re-auth screen until the 30-day refresh token itself expired. This is the right design IF refresh tokens exist. They don't in V1 (contract C5), so the entire path is unimplementable. Reverted to 401-redirect UX above.



### Task 6.1: Refresh helper + `/api/auth/refresh` endpoint

**Objective:** A function the middleware calls when verify says "expired", and a manual `/api/auth/refresh` endpoint for the SPA to invoke proactively.

**Files:**
- Create: `hermes_cli/dashboard_auth/refresh.py`
- Modify: `hermes_cli/dashboard_auth/middleware.py` — call refresh when verify returns None.
- Modify: `hermes_cli/dashboard_auth/routes.py` — add `/api/auth/refresh`.

**Step 1: Implement the refresh helper.**

```python
# hermes_cli/dashboard_auth/refresh.py
"""Cookie-rotating refresh helper.

The middleware calls ``maybe_refresh_session`` whenever ``verify_session``
returned None and a refresh token is available. On success the response
gets new ``hermes_session_at`` + ``hermes_session_rt`` cookies.
"""
from __future__ import annotations

import logging
import time
from typing import Optional, Tuple

from fastapi import Request
from fastapi.responses import Response

from hermes_cli.dashboard_auth import list_providers
from hermes_cli.dashboard_auth.audit import audit_log, AuditEvent
from hermes_cli.dashboard_auth.base import (
    Session, RefreshExpiredError, ProviderError,
)
from hermes_cli.dashboard_auth.cookies import (
    set_session_cookies, clear_session_cookies, detect_https,
)

_log = logging.getLogger(__name__)


def attempt_refresh(*, refresh_token: str) -> Optional[Session]:
    """Try every provider until one accepts the refresh token.

    Returns the new Session on success. Returns None if every provider
    rejected the token. Raises ProviderError if at least one provider
    was unreachable AND none succeeded.
    """
    last_provider_error: Optional[ProviderError] = None
    for provider in list_providers():
        try:
            return provider.refresh_session(refresh_token=refresh_token)
        except RefreshExpiredError:
            # Token doesn't belong to this provider (or is truly dead); try next.
            continue
        except ProviderError as e:
            last_provider_error = e
            continue
    if last_provider_error:
        raise last_provider_error
    return None


def apply_refresh_to_response(
    request: Request,
    response: Response,
    session: Session,
) -> None:
    """Set the new session cookies on ``response``."""
    expires_in = max(60, session.expires_at - int(time.time()))
    set_session_cookies(
        response,
        access_token=session.access_token,
        refresh_token=session.refresh_token,
        access_token_expires_in=expires_in,
        use_https=detect_https(request),
    )
```

**Step 2: Wire silent refresh into the middleware.**

In `hermes_cli/dashboard_auth/middleware.py`, after the `if session is None:` block, insert a refresh attempt BEFORE the bail-out:

```python
    if session is None:
        # Silent refresh attempt — if we still have a refresh token, try it.
        if _rt:
            try:
                refreshed = attempt_refresh(refresh_token=_rt)
            except ProviderError as e:
                _log.warning("dashboard-auth refresh: provider unreachable: %s", e)
                audit_log(AuditEvent.REFRESH_FAILURE, reason="provider_unreachable",
                          ip=_client_ip(request))
                return _unauth_response(path, reason="refresh_unreachable")
            if refreshed is not None:
                # Carry on with the refreshed session; the response handler
                # rotates the cookies on the way out via the wrapper below.
                request.state.session = refreshed
                request.state._session_just_refreshed = refreshed
                response = await call_next(request)
                apply_refresh_to_response(request, response, refreshed)
                audit_log(AuditEvent.REFRESH_SUCCESS,
                          provider=refreshed.provider,
                          user_id=refreshed.user_id,
                          ip=_client_ip(request))
                return response
            audit_log(AuditEvent.REFRESH_FAILURE, reason="refresh_expired",
                      ip=_client_ip(request))
        audit_log(AuditEvent.SESSION_VERIFY_FAILURE, reason="no_provider_recognises",
                  ip=_client_ip(request))
        return _unauth_response(path, reason="invalid_or_expired_session")
```

Imports at the top of middleware.py:

```python
from hermes_cli.dashboard_auth.refresh import attempt_refresh, apply_refresh_to_response
```

**Step 3: Manual `/api/auth/refresh` endpoint.**

In `hermes_cli/dashboard_auth/routes.py`:

```python
from hermes_cli.dashboard_auth.refresh import attempt_refresh, apply_refresh_to_response


@router.post("/api/auth/refresh", name="auth_refresh")
async def api_auth_refresh(request: Request):
    """SPA-triggered explicit refresh.

    Reads the refresh token from cookies, calls the provider, rotates the
    session cookies on the response. SPA uses this to extend a session
    proactively (e.g. when the user navigates back to a tab they left open
    for hours).
    """
    _at, rt = read_session_cookies(request)
    if not rt:
        raise HTTPException(status_code=401, detail="No refresh token in cookie")
    try:
        sess = attempt_refresh(refresh_token=rt)
    except ProviderError as e:
        audit_log(AuditEvent.REFRESH_FAILURE, reason="provider_unreachable",
                  ip=_client_ip(request))
        raise HTTPException(status_code=503, detail=f"Provider unreachable: {e}")

    if sess is None:
        # Refresh truly dead → clear cookies and tell SPA to re-login.
        resp = JSONResponse(
            {"detail": "Refresh expired; re-login required"},
            status_code=401,
        )
        clear_session_cookies(resp)
        audit_log(AuditEvent.REFRESH_FAILURE, reason="refresh_expired",
                  ip=_client_ip(request))
        return resp

    audit_log(AuditEvent.REFRESH_SUCCESS,
              provider=sess.provider, user_id=sess.user_id,
              ip=_client_ip(request))
    resp = JSONResponse({
        "user_id": sess.user_id,
        "email": sess.email,
        "display_name": sess.display_name,
        "provider": sess.provider,
        "expires_at": sess.expires_at,
    })
    apply_refresh_to_response(request, resp, sess)
    return resp
```

**Step 4: Test.**

```python
# tests/hermes_cli/test_dashboard_auth_refresh.py
"""Silent refresh and explicit /api/auth/refresh."""
import time
import pytest
from fastapi.testclient import TestClient

from hermes_cli import web_server
from hermes_cli.dashboard_auth import clear_providers, register_provider
from hermes_cli.dashboard_auth.cookies import SESSION_AT_COOKIE, SESSION_RT_COOKIE
from tests.hermes_cli.conftest_dashboard_auth import StubAuthProvider


@pytest.fixture
def gated_app():
    clear_providers()
    register_provider(StubAuthProvider())
    web_server.app.state.bound_host = "0.0.0.0"
    web_server.app.state.auth_required = True
    yield TestClient(web_server.app, base_url="https://gated.fly.dev")
    clear_providers()
    web_server.app.state.auth_required = False


def _login(client) -> dict:
    r1 = client.get("/auth/login?provider=stub", follow_redirects=False)
    state = r1.headers["location"].split("state=")[1]
    r2 = client.get(f"/auth/callback?code=stub_code&state={state}",
                    follow_redirects=False)
    cookies = {}
    for raw in r2.headers.get_list("set-cookie"):
        name, _, rest = raw.partition("=")
        val = rest.split(";", 1)[0]
        cookies[name] = val
    return cookies


def test_explicit_refresh_rotates_cookies(gated_app):
    cookies = _login(gated_app)
    old_at = cookies[SESSION_AT_COOKIE]
    old_rt = cookies[SESSION_RT_COOKIE]
    r = gated_app.post("/api/auth/refresh")
    assert r.status_code == 200
    new_at = next((c.split(";")[0].split("=", 1)[1]
                   for c in r.headers.get_list("set-cookie")
                   if c.startswith(f"{SESSION_AT_COOKIE}=")), None)
    new_rt = next((c.split(";")[0].split("=", 1)[1]
                   for c in r.headers.get_list("set-cookie")
                   if c.startswith(f"{SESSION_RT_COOKIE}=")), None)
    assert new_at and new_at != old_at
    assert new_rt and new_rt != old_rt


def test_silent_refresh_on_expired_access_token():
    # Configure the stub provider with a very short TTL so the first /api/me
    # call sees an expired token, but the refresh succeeds.
    clear_providers()
    register_provider(StubAuthProvider(default_ttl=0))
    web_server.app.state.auth_required = True
    try:
        client = TestClient(web_server.app, base_url="https://gated.fly.dev")
        cookies = _login(client)
        # /api/auth/me with an expired AT must succeed because middleware
        # silently refreshes.
        r = client.get("/api/auth/me")
        assert r.status_code == 200
        # And the response carries rotated cookies.
        set_cookies = r.headers.get_list("set-cookie")
        assert any(c.startswith(f"{SESSION_AT_COOKIE}=") for c in set_cookies)
    finally:
        clear_providers()
        web_server.app.state.auth_required = False


def test_refresh_without_rt_cookie_returns_401(gated_app):
    r = gated_app.post("/api/auth/refresh")
    assert r.status_code == 401


def test_refresh_with_dead_token_clears_cookies(gated_app):
    gated_app.cookies.set(SESSION_RT_COOKIE, "garbage-refresh-token")
    r = gated_app.post("/api/auth/refresh")
    assert r.status_code == 401
    # Clearing cookies on a dead refresh
    set_cookies = r.headers.get_list("set-cookie")
    assert any(c.startswith(f"{SESSION_AT_COOKIE}=") and "Max-Age=0" in c for c in set_cookies)
```

**Step 5: Run, verify pass.**

```bash
scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_refresh.py -v
```

**Step 6: Commit.**

```bash
git add hermes_cli/dashboard_auth/refresh.py hermes_cli/dashboard_auth/middleware.py hermes_cli/dashboard_auth/routes.py tests/hermes_cli/test_dashboard_auth_refresh.py
git commit -m "feat(dashboard-auth): silent refresh on expired AT + manual /api/auth/refresh"
```

### Phase 6 Exit Gate

```bash
scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_refresh.py -v
```

Manual: leave a dashboard tab open with the stub provider configured to issue 60-second access tokens. After 60 seconds the next page interaction is invisibly upgraded — no login redirect. The audit log shows `refresh_success` entries.

---

## Phase 7 — SPA "Logged in as …" Widget, CLI Status, Documentation

> **Plan v2 note.** Contract C4 means the JWT does NOT emit `email` or `display_name` claims, and contract C7 means there's no userinfo endpoint to fetch them from. The widget shown below was originally drafted as "Logged in as Foo <foo@bar.com>"; the implementation surfaces a truncated `user_id` instead (`Logged in as usr_abc123…`). The `/api/auth/me` payload retains empty `email` / `display_name` fields for forward-compat with a future Portal userinfo endpoint (OQ-C1).

**Goal:** User-visible polish — the gated dashboard surfaces the current identity, `hermes status` reports auth-gate state, and the docs site has a guide for VPS/Fly deployments.

### Task 7.1: SPA sidebar identity widget (v2)

**Objective:** A small "Logged in as Foo <foo@bar.com>  ⏻" widget at the top of the sidebar. Hits `/api/auth/me` on mount; the logout icon POSTs `/auth/logout`.

**Files:**
- Create: `web/src/components/AuthWidget.tsx`
- Modify: `web/src/App.tsx` — mount the widget at the top of the sidebar.
- Modify: `web/src/lib/api.ts` — add `getMe()` and `logout()`.

```typescript
// web/src/lib/api.ts — add
export interface AuthMe {
  user_id: string;
  email: string;
  display_name: string;
  org_id: string;
  provider: string;
  expires_at: number;
}

export async function getAuthMe(): Promise<AuthMe | null> {
  const r = await fetch('/api/auth/me', { credentials: 'include' });
  if (r.status === 401) return null;
  if (!r.ok) throw new Error(`auth/me: HTTP ${r.status}`);
  return r.json();
}

export async function logout(): Promise<void> {
  const r = await fetch('/auth/logout', {
    method: 'POST',
    credentials: 'include',
    redirect: 'manual',
  });
  // Server returns 302 → /login. With redirect: 'manual', fetch resolves
  // with status 0 in browsers — we manually navigate.
  window.location.href = '/login';
}
```

```typescript
// web/src/components/AuthWidget.tsx
import { useEffect, useState } from 'react';
import { getAuthMe, logout, AuthMe } from '../lib/api';

export function AuthWidget() {
  const [me, setMe] = useState<AuthMe | null | undefined>(undefined);

  useEffect(() => {
    if (!window.__HERMES_AUTH_REQUIRED__) return;
    getAuthMe().then(setMe).catch(() => setMe(null));
  }, []);

  if (!window.__HERMES_AUTH_REQUIRED__) return null;
  if (me === undefined) return <div className="text-xs opacity-50 px-3 py-2">Loading…</div>;
  if (me === null) return null;

  return (
    <div className="flex items-center gap-2 px-3 py-2 border-b border-zinc-800 text-xs">
      <div className="flex-1 min-w-0">
        <div className="truncate font-medium">{me.display_name}</div>
        <div className="truncate opacity-60">{me.email}</div>
      </div>
      <button
        onClick={() => logout()}
        title="Log out"
        className="opacity-60 hover:opacity-100"
      >⏻</button>
    </div>
  );
}
```

In `web/src/App.tsx`, mount at the top of the sidebar:

```typescript
import { AuthWidget } from './components/AuthWidget';
// ...
<aside>
  <AuthWidget />
  {/* existing sidebar items */}
</aside>
```

Add to `web/src/vite-env.d.ts` (or wherever globals are declared):

```typescript
interface Window {
  __HERMES_SESSION_TOKEN__?: string;
  __HERMES_DASHBOARD_EMBEDDED_CHAT__?: boolean;
  __HERMES_BASE_PATH__?: string;
  __HERMES_AUTH_REQUIRED__?: boolean;
}
```

**Commit:**

```bash
git add web/
git commit -m "feat(dashboard-auth): SPA auth widget showing logged-in identity + logout button"
```

### Task 7.2: `hermes status` integration

**Objective:** `hermes status` reports whether the gateway/dashboard has an active OAuth gate.

**Files:**
- Modify: `hermes_cli/status.py` — extend the existing reporter.

```python
# In hermes_cli/status.py, add to the report block:

# ... after the existing nous_logged_in line ...
def _dashboard_auth_status() -> str:
    """Reports number of registered dashboard-auth providers."""
    try:
        from hermes_cli.dashboard_auth import list_providers
        providers = list_providers()
    except Exception:
        return "not available"
    if not providers:
        return "no auth providers registered (loopback only)"
    names = ", ".join(p.name for p in providers)
    return f"{len(providers)} provider(s): {names}"

# Print in the report:
print(f"  dashboard auth providers: {_dashboard_auth_status()}")
```

**Commit:**

```bash
git add hermes_cli/status.py
git commit -m "feat(status): report dashboard-auth provider availability"
```

### Task 7.3: Documentation

**Objective:** A doc page covering the auth gate, how to deploy publicly, and how to write a custom provider plugin.

**Files:**
- Create: `website/docs/user-guide/features/dashboard-auth.md`
- Modify: `website/sidebars.ts` — link the new page.

Content sketch (full prose in the file):

```markdown
# Dashboard Authentication

When `hermes dashboard` binds to a non-loopback host (any IP other than
`127.0.0.1`, `localhost`, or `::1`) **without** `--insecure`, an OAuth
authentication gate is automatically engaged. By default, sign-in uses
your Nous Portal account.

## When the gate is active

| Command | Gate? |
|---|---|
| `hermes dashboard`                                 | Off (loopback) |
| `hermes dashboard --host 0.0.0.0`                  | On |
| `hermes dashboard --host 0.0.0.0 --insecure`       | Off (legacy escape hatch) |
| `hermes dashboard --host 192.168.1.5`              | On |
| `hermes dashboard --host fly-app.fly.dev`          | On |

## Default sign-in: Nous Portal

The default provider is bundled (`plugins/dashboard-auth-nous`) and needs
zero configuration. Visiting the dashboard prompts a "Sign in with Nous
Portal" button → OAuth redirect → back to your dashboard.

## Logging out

Click ⏻ in the sidebar widget, or `POST /auth/logout`. The browser cookies
are cleared and the refresh token is best-effort revoked at Portal.

## Audit log

Every sign-in attempt, success, refresh, and logout is recorded at
`$HERMES_HOME/logs/dashboard-auth.log` (JSON-lines).

## Adding a custom auth provider

(Plugin authoring guide — `DashboardAuthProvider` ABC, `register(ctx)`
example, link to `plugins/dashboard-auth-nous/` as the canonical template.)

## Forcing the legacy no-auth behavior

For trusted-network or testing scenarios, pass `--insecure`:

```
hermes dashboard --host 0.0.0.0 --insecure
```

Be aware: this exposes API keys and config without authentication. Only
use on private LANs where you trust every device.
```

**Commit:**

```bash
git add website/docs/user-guide/features/dashboard-auth.md website/sidebars.ts
git commit -m "docs(dashboard): document the OAuth auth gate + custom provider authoring"
```

### Phase 7 Exit Gate

Visual confirmation:
1. Gated dashboard renders the AuthWidget in the sidebar showing "Stub User · stub@example.test · ⏻".
2. Clicking ⏻ logs out, clears cookies, redirects to `/login`.
3. `hermes status` prints `dashboard auth providers: 1 provider(s): nous`.
4. Docs site renders the new page; sidebar links work.

---

## Risk Register

| # | Risk | Likelihood | Impact | Mitigation |
|---|---|---|---|---|
| R1 | A misconfigured operator believes the gate is on when it isn't, exposes dashboard publicly | Med | High | `start_server` prints `OAuth auth gate enabled` to stdout at bind time. `hermes status` shows the active state. Audit log writes `dashboard binding to host: <X>, gate: <on/off>` on every start. |
| R2 | Refresh token in cookie is exfiltrated via XSS | Low | High | HttpOnly cookie prevents JS access. CSP headers on `/` (added in Phase 7) restrict inline-script sources. The dashboard already escapes all user-supplied content; this plan doesn't add new XSS surface. |
| R3 | OAuth redirect URI mismatch breaks the round-trip in Fly setups | Med | High | The Portal whitelists `*.fly.dev/auth/callback`; verify with each new Fly hostname. `audit_log` records `idp_error` events so misconfigs are visible. Operators with custom domains follow the Open Question #1 path (out of v1 scope but flagged). |
| R4 | Portal JWKS rollout slips; userinfo mode hammers Portal with one network call per dashboard request | Med | Med | 60-second per-token cache in `_verify_via_userinfo` keeps the load to ~1 req/min/user. Add a metric/log if cache hit rate drops. |
| R5 | The `hermes-dashboard` client_id is not yet registered on Portal at code-merge time | High | Med | Phase 4 ships with the userinfo fallback and unit tests use respx mocks — code merges and CI passes without Portal. Operator-run smoke test (Phase 4 exit gate) gates the actual release. |
| R6 | Browsers reject cookies because Fly TLS terminates HTTPS but uvicorn sees HTTP without `proxy_headers` | High | High | `start_server` re-enables `proxy_headers=True` when gate is active. `detect_https` reads from `request.url.scheme` which honors `X-Forwarded-Proto` when proxy_headers is True. Tested in Phase 3.5. |
| R7 | Memory leak in `_verify_cache` for the userinfo mode | Low | Low | LRU-bounded to access tokens still in valid cookies; tokens are 1-hour-TTL so the dict size is bounded by simultaneous-user count. If telemetry shows growth, swap to `lru_cache` with explicit max=10000. |
| R8 | Stub provider accidentally leaks into a production build | Low | High | Lives under `tests/`, not `plugins/` or `hermes_cli/`. The plugin discovery scanner doesn't traverse `tests/`. CI assertion: `grep -r StubAuthProvider plugins/ hermes_cli/` returns nothing. |
| R9 | Loopback regression: existing dashboards stop accepting the injected token | Med | High | Phase 0's harness pins current behavior. Every subsequent phase reruns it. Pre-merge: full `scripts/run_tests.sh` against the whole suite. |
| R10 | Single-user-only assumption is violated by a future feature change | Low | Med | The session model treats every cookie as authoritative for the dashboard process; there's no per-user UI state. If multi-user is ever needed, audit `/api/sessions`, `/api/config`, and the PTY bridge — each currently writes to single shared state. Flagged in Open Questions #2. |

## Rollout

Phases 0–3 land first as one unit (the gate + stub-driven E2E). After merge, the gate is OFF by default for everyone (loopback unchanged) and OPT-IN for non-loopback (operator must pass --insecure to bypass, or install a provider plugin).

Phases 4–7 land in sequence as the Portal cross-repo work completes. Phase 4 is the first user-visible step; Phases 5–6–7 are quality-of-life improvements that don't change correctness.

### Pre-merge checklist for each phase

- [ ] All new tests pass
- [ ] Loopback regression harness from Phase 0 still passes
- [ ] No new errors at `WARNING` or higher in `agent.log` / `gateway.log` when starting a loopback dashboard
- [ ] Manual smoke test (Phase exit gate) walked by the implementer
- [ ] `hermes status` output unchanged (until Phase 7's intentional addition)

### Pre-release checklist for Phase 4

- [ ] Portal team confirms `hermes-dashboard` client_id is registered in `OAUTH_CLIENT_PRODUCT_CONTEXT_MAP`
- [ ] Portal team confirms `https://*.fly.dev/auth/callback` is in the redirect-URI whitelist for `hermes-dashboard`
- [ ] Portal team confirms `GET /oauth/authorize` route is live
- [ ] Portal team confirms `POST /api/oauth/token` accepts `grant_type=authorization_code` with PKCE
- [ ] Portal team confirms access token includes `email`, `email_verified`, `name` claims
- [ ] Operator walks the end-to-end flow against staging Portal once
- [ ] Operator confirms `~/.hermes/logs/dashboard-auth.log` records `login_success` event with correct user_id + email
- [ ] Operator confirms refresh works by setting access-token TTL to 60s and leaving the tab open for 90s

## Verification Strategy

| Layer | How |
|---|---|
| Provider protocol | Unit tests in `tests/hermes_cli/test_dashboard_auth_provider_base.py` — every provider plugin must call `assert_protocol_compliance` in its own tests. |
| Cookies | Unit tests in `tests/hermes_cli/test_dashboard_auth_cookies.py` cover HttpOnly/Secure/SameSite/Max-Age semantics. |
| Middleware | Behavioral tests in `tests/hermes_cli/test_dashboard_auth_middleware.py` exercise gated vs loopback modes with the stub provider. |
| Real provider | `plugins/dashboard-auth-nous/test_provider.py` uses respx to mock Portal endpoints. Real-Portal smoke is operator-run. |
| End-to-end | The Phase 3 exit gate is a full browser round trip with the stub. Phase 4 exit gate is the same against staging Portal. |
| Regression | Phase 0's harness is rerun by every subsequent phase as part of its exit gate. |
| Audit log | Tests in `test_dashboard_auth_audit.py` confirm event types, JSON format, and token redaction. |
| WS auth | Tests in `test_dashboard_auth_middleware.py::test_ws_*` cover ticket mint/consume/expire across loopback and gated. |

## Timeline (rough)

Each phase is independently shippable. A focused engineer can land:

| Phase | Effort |
|---|---|
| 0 | ½ day |
| 1 | 1 day |
| 2 | ½ day |
| 3 | 2 days |
| 4 | 1 day Hermes side + cross-repo coordination (variable) |
| 5 | 1 day |
| 6 | 1 day |
| 7 | 1 day |

Total: ~7–8 working days on the Hermes side. Cross-repo Portal work is on top of that and gates Phase 4's actual usefulness.

## Files Changed Summary

New:
- `hermes_cli/dashboard_auth/__init__.py`
- `hermes_cli/dashboard_auth/base.py`
- `hermes_cli/dashboard_auth/registry.py`
- `hermes_cli/dashboard_auth/audit.py`
- `hermes_cli/dashboard_auth/cookies.py`
- `hermes_cli/dashboard_auth/middleware.py`
- `hermes_cli/dashboard_auth/routes.py`
- `hermes_cli/dashboard_auth/login_page.py`
- `hermes_cli/dashboard_auth/ws_tickets.py`
- `hermes_cli/dashboard_auth/refresh.py`
- `plugins/dashboard-auth-nous/plugin.yaml`
- `plugins/dashboard-auth-nous/__init__.py`
- `plugins/dashboard-auth-nous/provider.py`
- `plugins/dashboard-auth-nous/test_provider.py`
- `web/src/components/AuthWidget.tsx`
- `website/docs/user-guide/features/dashboard-auth.md`
- 8 test files under `tests/hermes_cli/`

Modified:
- `hermes_cli/web_server.py` — add `should_require_auth`, register two middlewares, update `_serve_index`/`start_server`/WS endpoints
- `hermes_cli/plugins.py` — add `register_dashboard_auth_provider` method
- `hermes_cli/status.py` — report dashboard-auth state
- `web/src/App.tsx`, `web/src/lib/api.ts`, `web/src/pages/ChatPage.tsx`, `web/src/vite-env.d.ts`
- `website/sidebars.ts`

Cross-repo (nous-account-service):
- `src/server/oauth/access-token-issuer.ts` — register `hermes-dashboard` client_id
- New: `src/app/oauth/authorize/page.tsx` (or equivalent)
- `src/app/api/oauth/token/route.ts` — accept `grant_type=authorization_code`
- `src/server/oauth/access-token-issuer.ts` — add `email`/`name` claims for `profile email` scope
- Portal config — whitelist `https://*.fly.dev/auth/callback`