Bug Description

CORS headers are present on non-streaming responses but completely missing on streaming (SSE) responses. This breaks browser frontends like Open WebUI when using client-side direct connections.

Steps to Reproduce

1. Set API_SERVER_CORS_ORIGINS=* and API_SERVER_HOST=0.0.0.0
2. Send POST with stream:false → CORS headers present ✅
3. Send POST with stream:true → NO CORS headers ❌

curl -v -X POST "http://localhost:8642/v1/chat/completions"
-H "Origin: https://example.com"
-H "Authorization: Bearer xxx"
-H "Content-Type: application/json"
-d '{"model":"hermes-agent","messages":[{"role":"user","content":"Hi"}],"stream":true}'

Expected Behavior

Access-Control-Allow-Origin: * should be present on ALL responses,
including streaming SSE responses (stream:true), just like it is
on non-streaming responses (stream:false).

Actual Behavior

Browser blocks the streaming request with CORS error:
"No 'Access-Control-Allow-Origin' header is present on the requested resource"

Streaming response headers (MISSING CORS):
Content-Type: text/event-stream
Cache-Control: no-cache
Transfer-Encoding: chunked
← Access-Control-Allow-Origin is NOT present!

Non-streaming response headers (correct, for comparison):
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, DELETE, OPTIONS
Access-Control-Allow-Headers: Authorization, Content-Type

Browser console error:
Access to fetch at 'http://192.168.178.142:8642/v1/chat/completions' from origin
'https://chat.clp-djs.de' has been blocked by CORS policy: No
'Access-Control-Allow-Origin' header is present on the requested resource.

Affected Component

Gateway (Telegram/Discord/Slack/WhatsApp)

Messaging Platform (if gateway-related)

No response

Operating System

Windows 11

Python Version

Python 3.12.3

Hermes Version

Hermes Agent v0.4.0 (2026.3.23)

Relevant Logs / Traceback

Root Cause Analysis (optional)

No response

Proposed Fix (optional)

No response

Are you willing to submit a PR for this?

• I'd like to fix this myself and submit a PR