- • Direct Gateway API streaming via /v1/chat/completions
- • api.streamChat() async generator with SSE parsing
- • True abort via AbortController (no tmux polling)
- • Session continuity via X-Hermes-Session-Id
- • DnaLoader helix animation during wait
- • Dual Ed25519 (primary) + HMAC-SHA256 (fallback)
- • Bearer session tokens via /api/auth/session-token
- • CORS restricted to known origins
- • Per-IP rate limiting (10 fails/60s → 15min lockout)
- • CSP headers, XSS sanitization, SRI
- • Standalone repo → deploy.sh → hermes-agent
- • Post-merge git hook auto-redeploys after update
- • Builds from source, syncs 25+ web/src/ files
- • Pre-flight check: verifies TG initData in built JS
- • tmux agents still on Agents page for power users