- Ports now bind to HERMES_PUBLISHED_BIND_IP (default 127.0.0.1) so
NPM on the same host proxies to 127.0.0.1:7843/8645/8646 and direct
LAN/internet access is blocked without firewall rules
- runHermes: settle promise immediately on timeout (SIGKILL) instead of
waiting for close event — prevents hanging when hermes spawns children
that keep stdout/stderr open after the parent is killed
- Add HERMES_ADMIN_COOKIE_SECURE env var to set Secure flag on admin
session cookie when the admin UI is served over HTTPS
- Document NPM deployment shapes in README
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
ZachariahSharma
74e276af92