hermes-agent/hermes_cli/setup_hidden_env.py
teknium1 339d968689
Some checks are pending
CI / Detect affected areas (push) Waiting to run
CI / Python tests (push) Blocked by required conditions
CI / Python lints (push) Blocked by required conditions
CI / JS & TS checks (push) Blocked by required conditions
CI / Desktop E2E (push) Blocked by required conditions
CI / Docs Site (push) Blocked by required conditions
CI / Deny unrelated histories (push) Blocked by required conditions
CI / Check contributors (push) Blocked by required conditions
CI / Check uv.lock (push) Blocked by required conditions
CI / package-lock.json diff (push) Blocked by required conditions
CI / Lint Docker scripts (push) Blocked by required conditions
CI / Build&Test Docker image (push) Blocked by required conditions
CI / Supply-chain scan (push) Blocked by required conditions
CI / Review label gate (push) Blocked by required conditions
CI / OSV scan (push) Waiting to run
CI / CI review comment (live) (push) Blocked by required conditions
CI / All required checks pass (push) Blocked by required conditions
CI / CI timing report (push) Blocked by required conditions
Deploy Site / deploy-vercel (push) Waiting to run
Deploy Site / deploy-docs (push) Waiting to run
Docker Build, Test, and Publish / build (amd64, type=gha,scope=docker-amd64, type=gha,mode=max,scope=docker-amd64, linux/amd64, ubuntu-latest) (push) Waiting to run
Docker Build, Test, and Publish / build (arm64, type=gha,scope=docker-arm64, type=gha,mode=max,scope=docker-arm64, linux/arm64, ubuntu-24.04-arm) (push) Waiting to run
Docker Build, Test, and Publish / publish (amd64, type=gha,scope=docker-amd64, type=gha,mode=max,scope=docker-amd64, linux/amd64, ubuntu-latest) (push) Blocked by required conditions
Docker Build, Test, and Publish / publish (arm64, type=gha,scope=docker-arm64, type=gha,mode=max,scope=docker-arm64, linux/arm64, ubuntu-24.04-arm) (push) Blocked by required conditions
Docker Build, Test, and Publish / merge (push) Blocked by required conditions
auto-fix lint issues & formatting / Generate eslint --fix patch (push) Waiting to run
auto-fix lint issues & formatting / Apply patch (push) Blocked by required conditions
fix(setup): stop asking about self-configuring platform knobs
Connecting Discord asked five questions when the platform needs one. The card
listed a home channel ID you need Developer Mode to copy, an allow-all-users
security toggle, a reply-threading preference, and a home channel display name
— all with working defaults, none discoverable from the form.

Drops them from the setup surfaces entirely: the dashboard/Desktop channel
cards and the `hermes setup gateway` wizard. Discord is now bot token +
allowlist. Matrix drops from 11 fields to 7, Mattermost from 6 to 3.

Suffix-matched (`*_HOME_CHANNEL*`, `*_ALLOW_ALL_USERS`, `*_REPLY_TO_MODE`,
`*_REQUIRE_MENTION`, `*_AUTO_THREAD`, `*_FREE_RESPONSE_*`, `*_PROXY`) so plugin
platforms nobody enumerated get the same treatment. Allowlists deliberately
stay — the gateway denies everyone until one is set, so that IS the decision a
new user has to make. Required credentials are never hidden.

Nothing is removed from the product. The vars still work through
`hermes config set`, .env, and config.yaml, the gateway reads them unchanged,
and dropping them from the cards hands them back to the Keys page rather than
orphaning them (Keys hides only what a Channels card owns).
2026-07-26 08:43:24 -07:00

56 lines
2.3 KiB
Python

"""Which platform env vars the setup surfaces hide.
Every messaging platform ships the same handful of knobs that are either set
for the user later or already correct by default. Listing them on a setup form
turns "paste your bot token" into a five-field interrogation where none of the
answers are discoverable — the Discord card asked for a home channel ID you
need Developer Mode to copy, next to a reply-threading preference.
Hiding them is a *presentation* decision only. The env vars keep working
through ``hermes config set``, ``.env``, and ``config.yaml``; the gateway reads
them exactly as before. This module just says what a new user is asked during
setup.
Lives here rather than in ``web_server`` so the CLI wizard can share it without
importing the dashboard's FastAPI surface.
"""
# Suffix match, so plugin adapters nobody enumerated (IRC, SimpleX, LINE, ntfy)
# get the same treatment without a code change here.
#
# *_HOME_CHANNEL* the bot offers /sethome on the first chat
# *_ALLOW_ALL_USERS defaults off; enabling it is a security decision
# *_REPLY_TO_MODE cosmetic threading preference
# *_REPLY_MODE same, Mattermost's spelling
# *_REQUIRE_MENTION behavior toggle with a sane default
# *_AUTO_THREAD same
# *_FREE_RESPONSE_* per-channel tuning, done once the bot is in a server
# *_ALLOWED_CHANNELS same
# *_PROXY only for networks that block the platform
#
# Allowlists (*_ALLOWED_USERS) deliberately stay visible: that IS the decision
# a new user has to make, and the gateway denies everyone until it's set.
SETUP_HIDDEN_ENV_SUFFIXES = (
"_HOME_CHANNEL",
"_HOME_CHANNEL_NAME",
"_HOME_CHANNEL_THREAD_ID",
"_HOME_ADDRESS",
"_ALLOW_ALL_USERS",
"_REPLY_TO_MODE",
"_REPLY_MODE",
"_REQUIRE_MENTION",
"_AUTO_THREAD",
"_FREE_RESPONSE_CHANNELS",
"_FREE_RESPONSE_ROOMS",
"_ALLOWED_CHANNELS",
"_PROXY",
)
def is_setup_hidden_env(name: str) -> bool:
"""True when a var is self-configuring and shouldn't appear in setup forms.
Callers must still keep any var a platform lists as *required* — hiding a
required credential would make that platform unconfigurable from the UI.
"""
return name.endswith(SETUP_HIDDEN_ENV_SUFFIXES)