revert(plugins): restore user dashboard plugin backend API auto-import (#43719) (#51950)

* Revert "refactor(security): centralize non-bundled plugin sources in one constant"

This reverts commit e2bea0abe6.

* Revert "fix(security): restrict dashboard plugin backend import to bundled plugins (#43719)"

This reverts commit 8845f3316c.
This commit is contained in:
kshitij 2026-06-24 20:16:54 +05:30 committed by GitHub
parent 7fb2027d85
commit c42d44cb2f
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
6 changed files with 47 additions and 174 deletions

View file

@ -77,9 +77,7 @@ Then rescan dashboard plugins:
curl http://127.0.0.1:9119/api/dashboard/plugins/rescan
```
When installed as a user plugin, the dashboard UI loads but Python backend API
routes are not auto-imported. Backend routes are available when this plugin is
bundled with Hermes.
If backend API routes 404, restart `hermes dashboard`; plugin APIs are mounted at dashboard startup.
## Updating
@ -91,11 +89,7 @@ git pull --ff-only
curl http://127.0.0.1:9119/api/dashboard/plugins/rescan
```
For a user-installed plugin at `~/.hermes/plugins/hermes-achievements`, a plugin
rescan is enough because Python backend routes are not auto-imported. If you
update the bundled plugin by pulling changes in the hermes-agent repository, and
that bundled plugin update changes backend routes or `plugin_api.py`, restart
`hermes dashboard` after pulling.
If the update changes backend routes or `plugin_api.py`, restart `hermes dashboard` after pulling.
As of 2026-04-29, updating is strongly recommended because scan performance changed significantly:
- removed duplicate `/overview` scan path
@ -124,9 +118,6 @@ dashboard/
## API
These backend routes are mounted for the bundled plugin. User-installed copies
load their dashboard UI but do not auto-import Python backend routes.
Routes are mounted under:
```text