Dashboard memory provider switching (salvage of #57425)#60569
Merged
Conversation
alt-glitch
added
type/feature
…p commands
Strict charset allowlist (alnum + - _, max 64) on the {name} path param of
the memory-provider config/setup endpoints. Prevents traversal-shaped names
from reaching find_provider_dir(), and setup now 404s when neither a
loadable provider nor a plugin manifest exists, so the command-running path
is only reachable for discoverable plugins. Adds regression tests.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hosted dashboard users can now switch and configure memory providers safely, with dependency install and readiness gating built in — no CLI access to
hermes memory setuprequired.Salvage of #57425 by @shannonsands, cherry-picked onto current main (clean pick), authorship preserved.
Changes
hermes_cli/web_server.py: provider metadata endpoints (readiness, missing deps, write-only secrets), setup endpoint installing declared pip/external dependencies, schema-driven provider config APIweb/src/pages/PluginsPage.tsx: provider switcher + schema-driven config forms + inline setup results, activation gated on readinessweb/src/pages/SystemPage.tsx: memory provider status card, routes credential edits to Pluginsweb/src/lib/api.ts: client bindingstests/hermes_cli/test_web_server.py: +217 lines of endpoint coverageValidation
scripts/run_tests.sh tests/hermes_cli/test_web_server.pypython -m py_compile hermes_cli/web_server.pynpm run typecheck(web)Infographic