feat(dashboard): catalogue all memory-provider API keys in OPTIONAL_ENV_VARS

[benbarclay]

Infographic

What

The dashboard Keys page (and hermes setup) renders an API-key row for a
memory provider only if that provider's env var has an entry in
OPTIONAL_ENV_VARS. Today only Honcho has one — so the other memory
providers read their keys straight from os.environ but offer no place to
set them in the GUI:

Provider	Key it reads	Catalogued before?
honcho	HONCHO_API_KEY	✅
hindsight	HINDSIGHT_API_KEY	❌
supermemory	SUPERMEMORY_API_KEY	❌
mem0	MEM0_API_KEY	❌
retaindb	RETAINDB_API_KEY	❌
byterover	BRV_API_KEY	❌
openviking	OPENVIKING_API_KEY	❌

(holographic is a local HRR store with no key, so nothing to add.)

Change

Add OPTIONAL_ENV_VARS entries for all six missing providers, mirroring the
existing Honcho block: category="tool", password=True, a get-key url, and
the tools badge for the tool each key powers. Also adds the relevant
non-secret companions (HINDSIGHT_API_URL, RETAINDB_BASE_URL,
OPENVIKING_ENDPOINT) marked advanced.

This is pure declaration — no new endpoints or UI:

• GET /api/env already iterates OPTIONAL_ENV_VARS, so the rows appear next
  to Honcho under the Tools section automatically.
• The save (PUT /api/env) and reveal (POST /api/env/reveal) paths are
  generic and already handle any key.
• The sandbox env blocklist (tools/environments/local.py) auto-derives
  from tool/messaging-category OPTIONAL_ENV_VARS, so these secrets are now
  correctly stripped from the sandboxed terminal env with no extra wiring.

These are not new HERMES_* env vars — every key is an existing credential
the corresponding plugin already reads; this only makes them settable from the
GUI instead of requiring a hand-edited .env.

Tests

tests/hermes_cli/test_config.py::TestMemoryProviderEnvVarsRegistry — a
behavior contract (not a snapshot count) asserting every memory provider's
primary credential key is catalogued, tool-categorised, password-masked, and
advertises its tool. Verified to fail on origin/main (6 of 7 keys missing)
and pass with this change. The existing
test_optional_tool_and_messaging_vars_are_in_blocklist continues to pass
(the new keys are auto-blocklisted).

[github-actions]

🔎 Lint report: feat/memory-provider-env-keys vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 11699 on HEAD, 11696 on base (🆕 +3)

🆕 New issues (3):

Rule	Count
unresolved-attribute	2
unsupported-operator	1

First entries

tests/run_agent/test_credits_notices_toggle.py:76: [unresolved-attribute] unresolved-attribute: Unresolved attribute `_credits_session_start_micros` on type `AIAgent`
run_agent.py:3040: [unresolved-attribute] unresolved-attribute: Object of type `Self@get_credits_spent_micros` has no attribute `_credits_session_start_micros`
tests/hermes_cli/test_config.py:743: [unsupported-operator] unsupported-operator: Operator `in` is not supported between objects of type `str` and `str | None | bool | list[Unknown] | list[str]`

✅ Fixed issues (1):

Rule	Count
invalid-assignment	1

First entries

tests/run_agent/test_credits_notices_toggle.py:76: [invalid-assignment] invalid-assignment: Object of type `None` is not assignable to attribute `_credits_session_start_micros` of type `int`

Unchanged: 6140 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.

[tonydwb]

Code Review Summary

Verdict: LGTM

Clean feature that catalogs memory provider API keys in OPTIONAL_ENV_VARS.

Key observations:

• Comprehensive: Adds entries for Hindsight, Supermemory, Mem0, RetainDB, ByteRover, and OpenViking API keys with proper metadata (description, prompt, url, tools, password, category).
• Well-tested: Dedicated test class verifies all provider keys are catalogued, tool-categorized, password-masked, and advertise their tools.
• Consistent: Follows the same pattern as existing entries (Honcho).
• No security concerns: API keys are properly marked as password=True for redaction.

---

Reviewed by Hermes Agent