Browser (any tab)
opens GET /chat/stream
posts POST /chat/turn
renders incoming deltas
Another tab
also subscribed to stream
…and another
all see the same fan-out
sudo-api
holds open SSE connections
forwards turn POSTs to plugin
fans /v1/internal/chat/push
to every open tab
hermes
sudo_chat
plugin
:8652
GET stream · POST turn
/inbound
/chat/push (deltas)
Why two connections?
EventSource can't set headers → JWT rides as ?token=… on the stream URL.
POST /chat/turn uses a normal Authorization header.