api/auth.py

@@ -536,15 +536,13 @@ def get_oidc_startup_warning() -> str | None:
 
 
 def is_auth_enabled() -> bool:
-    """True if password auth, passkeys, OIDC login, or trusted-header auth is configured.
-
-    PATCHED FOR WFDASH IFRAME: always returns False. Login screen is bypassed
-    so the Hermes WebUI can be embedded in the WFDASH /webview?src=hermes iframe
-    without requiring a separate password prompt. Hermes is reachable on a
-    public sslip.io URL, so do NOT use this patch on any deployment you
-    don't want publicly accessible.
-    """
-    return False
+    """True if password auth, passkeys, OIDC login, or trusted-header auth is configured."""
+    return (
+        is_password_auth_enabled()
+        or are_passkeys_enabled()
+        or is_oidc_auth_enabled()
+        or is_trusted_auth_enabled()
+    )
 
 
 def verify_password(plain: str) -> bool:

api/streaming.py

@@ -9555,6 +9555,7 @@ def _run_agent_streaming(
                 ),
                 task_id=session_id,
                 persist_user_message=msg_text,
+                persist_user_timestamp=getattr(s, 'pending_started_at', None),
             )
             # Only pass moa_config when a /moa override is actually active, so a
             # normal send never trips a TypeError on an older hermes-agent whose
@@ -10038,6 +10039,7 @@ def _run_agent_streaming(
                                     ),
                                     task_id=session_id,
                                     persist_user_message=msg_text,
+                                    persist_user_timestamp=getattr(s, 'pending_started_at', None),
                                 )
                                 if moa_config is not None:
                                     _heal_kwargs["moa_config"] = moa_config
@@ -11261,6 +11263,7 @@ def _run_agent_streaming(
                             ),
                             task_id=session_id,
                             persist_user_message=msg_text,
+                            persist_user_timestamp=getattr(s, 'pending_started_at', None),
                         )
                         if moa_config is not None:
                             _heal_kwargs2["moa_config"] = moa_config

docker-compose.yml

@@ -1,56 +1,57 @@
-services:
-  hermes-agent:
-    image: 'nousresearch/hermes-agent@sha256:2f1f2f1725e5dc9a61cf6a2dea5aca52a776ec4d022cb29679e6aa3ff303e77a'
-    command: 'gateway run'
-    environment:
-      - HERMES_HOME=/home/hermes/.hermes
-      - HERMES_UID=1000
-      - HERMES_GID=1000
-      - 'OPENROUTER_API_KEY=${OPENROUTER_API_KEY}'
-      - 'ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}'
-      - 'OPENAI_API_KEY=${OPENAI_API_KEY}'
-      - 'GOOGLE_API_KEY=${GOOGLE_API_KEY}'
-    volumes:
-      - 'hermes-home:/home/hermes/.hermes'
-      - 'hermes-agent-src:/opt/hermes'
-    healthcheck:
-      test:
-        - CMD-SHELL
-        - 'test -d /home/hermes/.hermes || exit 1'
-      interval: 10s
-      timeout: 5s
-      retries: 5
+# Hermes WebUI — single-container Docker Compose
+#
+# QUICK START (most users):
+#   1. (Optional) Copy .env.docker.example to .env and edit values
+#   2. docker compose up -d
+#   3. Open http://localhost:8787
+#
+# This is the simplest setup: one WebUI container that runs the agent in-process.
+# The WebUI auto-detects host UID/GID from the mounted .hermes volume.
+#
+# For multi-container setups (separate agent + webui or agent+webui+dashboard),
+# see docker-compose.two-container.yml or docker-compose.three-container.yml.
 
+services:
   hermes-webui:
-    build:
-      context: .
-      dockerfile: Dockerfile
-    image: hermes-webui:0.51.92-frameable
-    depends_on:
-      - hermes-agent
+    build: .
+    ports:
+    # select only one; use 127.0.0.1 version to expose to localhost only
+      - "127.0.0.1:8787:8787"
+#      - "8787:8787"
+    volumes:
+      # Mount your Hermes home directory into the container.
+      # The default (${HOME}/.hermes) works on both macOS (/Users/<you>/.hermes)
+      # and Linux (/home/<you>/.hermes) — no change needed for standard installs.
+      # Only set HERMES_HOME explicitly if your .hermes lives somewhere non-standard.
+      # macOS note: set UID and GID below to match your user ID (run `id -u` and `id -g`).
+      - ${HERMES_HOME:-${HOME}/.hermes}:/home/hermeswebui/.hermes
+      # Your workspace directory shown on first launch (adapt if yours is different, the container will use the mounted /workspace)
+      - ${HERMES_WORKSPACE:-${HOME}/workspace}:/workspace
     environment:
-      - SERVICE_URL_HERMESWEBUI_8787
+      # Set to your host user ID: run `id -u` and `id -g` to find them.
+      # On macOS, UIDs start at 501 (not 1000), so set UID and GID in a .env file:
+      #   echo "UID=$(id -u)" >> .env
+      #   echo "GID=$(id -g)" >> .env
+      # Without this, the container may not be able to read your mounted files.
+      - WANTED_UID=${UID:-1000}
+      - WANTED_GID=${GID:-1000}
+      # Required: bind address and port
       - HERMES_WEBUI_HOST=0.0.0.0
       - HERMES_WEBUI_PORT=8787
+      # Where to store sessions, workspaces, and other state (default: ~/.hermes/webui)
       - HERMES_WEBUI_STATE_DIR=/home/hermeswebui/.hermes/webui
-      - WANTED_UID=1000
-      - WANTED_GID=1000
-      - 'HERMES_WEBUI_PASSWORD=${SERVICE_PASSWORD_HERMESWEBUI}'
-    volumes:
-      - 'hermes-home:/home/hermeswebui/.hermes'
-      - 'hermes-agent-src:/home/hermeswebui/.hermes/hermes-agent:ro'
-      - 'hermes-workspace:/workspace'
-    healthcheck:
-      test:
-        - CMD
-        - curl
-        - '-f'
-        - 'http://127.0.0.1:8787/health'
-      interval: 30s
-      timeout: 5s
-      retries: 3
-
-volumes:
-  hermes-home:
-  hermes-agent-src:
-  hermes-workspace:
+      # Default workspace directory shown on first launch
+#      - HERMES_WEBUI_DEFAULT_WORKSPACE=/workspace
+      # Optional: set a password for remote access
+      # - HERMES_WEBUI_PASSWORD=your-secret-password
+      #
+      # Bind-mount permission handling (fixes #1389, #1399):
+      #   When you mount an EXISTING ~/.hermes directory (the common case),
+      #   the WebUI's startup credential-permission fixer can clash with
+      #   your host file modes (e.g. 0640 group-readable .env files).
+      #   Set HERMES_SKIP_CHMOD=1 to bypass the fixer entirely, OR set
+      #   HERMES_HOME_MODE=0640 to allow group bits while still stripping
+      #   world-readable. Both are documented in api/startup.py.
+      # - HERMES_SKIP_CHMOD=1
+      # - HERMES_HOME_MODE=0640
+    restart: unless-stopped