diff --git a/packages/server/src/index.ts b/packages/server/src/index.ts
index d883d574..2bdb6ff5 100644
--- a/packages/server/src/index.ts
+++ b/packages/server/src/index.ts
@@ -99,7 +99,16 @@ export async function bootstrap() {
         })
         ctx.body = { success: true, message: output.trim() }
         // Restart the server after response is sent
-        setTimeout(() => process.exit(0), 1000)
+        setTimeout(() => {
+          const { spawn } = require('child_process')
+          const isWin = process.platform === 'win32'
+          spawn(isWin ? 'cmd' : 'sh', isWin ? ['/c', 'hermes-web-ui restart'] : ['-c', 'hermes-web-ui restart'], {
+            detached: true,
+            stdio: 'ignore',
+            windowsHide: true,
+          }).unref()
+          process.exit(0)
+        }, 2000)
       } catch (err: any) {
         ctx.status = 500
         ctx.body = { success: false, message: err.stderr || err.message }
diff --git a/packages/server/src/services/auth.ts b/packages/server/src/services/auth.ts
index 4db4b2f2..55f66eee 100644
--- a/packages/server/src/services/auth.ts
+++ b/packages/server/src/services/auth.ts
@@ -48,7 +48,7 @@ export async function authMiddleware(token: string | null) {
     }
 
     // Skip non-API paths (static files, health check, SPA)
-    const path = ctx.path
+    const path = ctx.path.toLowerCase()
     if (
       path === '/health' ||
       (!path.startsWith('/api') && !path.startsWith('/v1') && path !== '/webhook')