Skip to content

feat(dashboard): rehaul Skills hub browser — connected hubs, featured, preview + security scan#40384

Merged
teknium1 merged 1 commit into
mainfrom
hermes/hermes-f0b0af19
Jun 6, 2026
Merged

feat(dashboard): rehaul Skills hub browser — connected hubs, featured, preview + security scan#40384
teknium1 merged 1 commit into
mainfrom
hermes/hermes-f0b0af19

Conversation

@teknium1

@teknium1 teknium1 commented Jun 6, 2026

Copy link
Copy Markdown
Contributor

Summary

The dashboard's Browse hub tab (Skills page) goes from a blank search box with sparse one-button result cards to a full skill browser: it shows which hubs are connected, surfaces featured skills on arrival, lets you read the actual SKILL.md before installing, and runs the same security scan we do at install time — visually, on demand.

What was wrong

  • Arriving on the tab showed an empty page — no indication it was hooked up to any hubs.
  • Result cards had only name + source + a single Install button — no way to read the skill source, no trust-tier signal, no tags.
  • No way to run the security scan and see the verdict before committing to an install.
  • Search felt slow with zero feedback on what was happening or which sources answered.

Changes

Backend — hermes_cli/web_server.py

  • GET /api/skills/hub/sources — configured hubs (label, trust tier, GitHub rate-limit, index availability) + featured skills from the centralized index (zero extra API calls) + installed-skill provenance.
  • GET /api/skills/hub/preview — a skill's SKILL.md text + file manifest, without installing (decodes byte-stored text, masks binaries).
  • GET /api/skills/hub/scan — runs the exact quarantine_bundle → scan_skill → should_allow_install pipeline the CLI installer uses, cleans up quarantine, returns verdict / per-finding detail / severity tally / install-policy decision.
  • search now returns per-source counts + timed-out sources + installed map (drives feedback + "installed" badges).

Frontend — web/src/pages/SkillsPage.tsx (HubBrowser)

  • Landing state: connected-hubs strip + featured skill grid.
  • Rich result cards: trust-level color coding, source, tags, identifier, Details + Install (or Installed).
  • Detail dialog: read the actual SKILL.md, on-demand visual security scan (verdict pill, severity tally, per-finding list, allow/block policy), GitHub repo link.
  • Search meta line: result count + timing + per-source breakdown.

web/src/lib/api.ts — types + client methods for the new endpoints.

Validation

Before After
Arrival state blank page connected-hubs strip + 12 featured skills
Result card name + source + Install trust badge, tags, identifier, Details + Install/Installed
Read skill source not possible SKILL.md rendered in detail dialog
Security scan not exposed visual verdict + severity tally + findings + policy, on demand
Search feedback none 20 results · 0.4s · hermes-index:50 official:1
  • Live browser-tested end-to-end (landing, search "social media", preview, scan) for both a builtin/allow skill (sherlock → safe/allowed) and a community/block skill (caution → blocked, red verdict). No JS errors; Radix dialog aria-describedby wired.
  • All 3 endpoints verified live via curl; quarantine cleaned up after scan.
  • Backend: 4 new endpoint test classes + updated search-shape test — tests/hermes_cli/test_dashboard_admin_endpoints.py 53 passed.
  • npx vite build clean; rebased onto current main.

Infographic

skills-hub-browser-rehaul

@teknium1
feat(dashboard): rehaul Skills hub browser — connected hubs, featured…
b35bb2f 
…, preview + security scan

The Browse-hub tab was a blank search box with sparse result cards (name +
source + one Install button), no way to read a skill before installing, no
visual security scan, and no indication it was even connected to any hubs.

Backend (web_server.py):
- GET /api/skills/hub/sources — lists the configured hubs (label + trust
  tier + GitHub rate-limit + index availability) and featured skills pulled
  from the centralized index (zero extra API calls), plus installed-skill
  provenance so the UI can mark already-installed results.
- GET /api/skills/hub/preview — fetches a skill's SKILL.md text + file
  manifest WITHOUT installing (decodes byte-stored text, masks binaries).
- GET /api/skills/hub/scan — runs the SAME quarantine + scan_skill +
  should_allow_install pipeline the CLI installer uses, then cleans up
  quarantine, returning verdict / per-finding detail / severity tally /
  install-policy decision.
- search now returns per-source counts + timed-out sources + installed map.

Frontend (SkillsPage HubBrowser):
- Landing state: connected-hubs strip + featured skill grid (no more blank
  page).
- Rich cards: trust-level color coding, source, tags, identifier,
  Details + Install (or Installed state).
- Detail dialog: read the actual SKILL.md, on-demand visual security scan
  (verdict pill, severity tally, per-finding list, allow/block policy),
  GitHub repo link.
- Search meta line: result count + timing + per-source breakdown (the
  'feels slow / no feedback' complaint).

Tests: 4 new endpoint test classes (sources/preview/scan + updated search
shape) in test_dashboard_admin_endpoints.py.
@github-actions

github-actions Bot commented Jun 6, 2026

Copy link
Copy Markdown
Contributor

🔎 Lint report: hermes/hermes-f0b0af19 vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 9959 on HEAD, 9956 on base (🆕 +3)

🆕 New issues (3):

Rule Count
invalid-assignment 3
First entries 
hermes_cli/web_server.py:6803: [invalid-assignment] invalid-assignment: Invalid subscript assignment with key of type `Literal["rate_limited"]` and value of type `Literal[False]` on object of type `dict[str, str]`
hermes_cli/web_server.py:6809: [invalid-assignment] invalid-assignment: Invalid subscript assignment with key of type `Literal["available"]` and value of type `bool` on object of type `dict[str, str]`
hermes_cli/web_server.py:6801: [invalid-assignment] invalid-assignment: Invalid subscript assignment with key of type `Literal["rate_limited"]` and value of type `bool` on object of type `dict[str, str]`

✅ Fixed issues: none

Unchanged: 5162 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.

@alt-glitch alt-glitch added type/feature New feature or request comp/cli CLI entry point, hermes_cli/, setup wizard tool/skills Skills system (list, view, manage) P3 Low — cosmetic, nice to have labels Jun 6, 2026
@teknium1 teknium1 merged commit 56236b1 into main Jun 6, 2026
30 of 31 checks passed
@teknium1 teknium1 deleted the hermes/hermes-f0b0af19 branch June 6, 2026 09:44
@teknium1 teknium1 mentioned this pull request Jun 6, 2026
Merged
changman pushed a commit to changman/hermes-agent that referenced this pull request Jun 10, 2026
@teknium1 @changman
feat(dashboard): rehaul Skills hub browser — connected hubs, featured…
862dcb6 
…, preview + security scan (NousResearch#40384)

The Browse-hub tab was a blank search box with sparse result cards (name +
source + one Install button), no way to read a skill before installing, no
visual security scan, and no indication it was even connected to any hubs.

Backend (web_server.py):
- GET /api/skills/hub/sources — lists the configured hubs (label + trust
  tier + GitHub rate-limit + index availability) and featured skills pulled
  from the centralized index (zero extra API calls), plus installed-skill
  provenance so the UI can mark already-installed results.
- GET /api/skills/hub/preview — fetches a skill's SKILL.md text + file
  manifest WITHOUT installing (decodes byte-stored text, masks binaries).
- GET /api/skills/hub/scan — runs the SAME quarantine + scan_skill +
  should_allow_install pipeline the CLI installer uses, then cleans up
  quarantine, returning verdict / per-finding detail / severity tally /
  install-policy decision.
- search now returns per-source counts + timed-out sources + installed map.

Frontend (SkillsPage HubBrowser):
- Landing state: connected-hubs strip + featured skill grid (no more blank
  page).
- Rich cards: trust-level color coding, source, tags, identifier,
  Details + Install (or Installed state).
- Detail dialog: read the actual SKILL.md, on-demand visual security scan
  (verdict pill, severity tally, per-finding list, allow/block policy),
  GitHub repo link.
- Search meta line: result count + timing + per-source breakdown (the
  'feels slow / no feedback' complaint).

Tests: 4 new endpoint test classes (sources/preview/scan + updated search
shape) in test_dashboard_admin_endpoints.py.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

comp/cli CLI entry point, hermes_cli/, setup wizard P3 Low — cosmetic, nice to have tool/skills Skills system (list, view, manage) type/feature New feature or request

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@teknium1 @alt-glitch