Add workspace API endpoints and regression coverage to api_server

[mingefei-cloud]

Summary

This PR expands the API server with workspace-facing endpoints and adds regression coverage for the new behavior.

What’s included

Workspace API endpoints

Add /api/* routes for:

• sessions list/create/get/update/delete
• session messages
• session chat
• session streaming chat
• session search
• session fork
• skills list/detail/category lookup
• memory read
• config read/update
• cron job management

Behavior fixes and guardrails

• Make /api/sessions return a total that matches the applied source filter
• Return 409 title_conflict when session title creation/update collides
• Return 409 ambiguous_skill_name when a skill slug exists in multiple categories without an explicit category
• Resolve short session IDs before workspace chat / streaming chat uses session history
• Harden config patching:
  • reject non-object PATCH payloads with 400
  • ignore unsupported top-level keys
  • use atomic YAML writes
  • preserve key order on write

Regression coverage

Add focused tests for:

• workspace sessions behavior
• skill ambiguity handling
• config redaction and patch semantics
• session chat behavior
• SSE streaming chat behavior

Validation

Ran:

env -u API_SERVER_CORS_ORIGINS pytest -q tests/gateway/test_api_server.py tests/gateway/test_api_server_jobs.py tests/gateway/test_api_server_workspace.py tests/gateway/test_api_server_workspace_extra.py tests/gateway/test_sse_agent_cancel.py

Result:

• 155 passed

Notes

This API is intended as a workspace-facing surface for Hermes workspace/front-end flows, not as a fully generalized third-party public API contract.

Follow-ups

Possible follow-up improvements:

• add structured error codes/messages across all workspace endpoints
• validate query params like limit / offset with 400 instead of falling through to 500
• expand endpoint coverage further as frontend contract evolves

[alt-glitch]

Overlaps with open #8772 — both add workspace /api/* endpoints to api_server.

[teknium1]

Thanks for the workspace API coverage. The session-control work has since been independently implemented on current main (gateway/platforms/api_server.py:1693-2059, registered at :4777-4785), so this needs a focused salvage rather than a direct cherry-pick.

Problems

• The added workspace handlers are not registered in the PR's production connect() route table. Inspection of PR head finds only /api/jobs registrations at gateway/platforms/api_server.py:2540-2547; the new handlers beginning at :1153 are unreachable. The added tests manually mount handlers, so they do not catch this.
• The new state access hardcodes Path.home() / ".hermes" (gateway/platforms/api_server.py:1684, :1846, :1872, :1903). This breaks named-profile isolation; state paths must use get_hermes_home().
• Current capabilities explicitly advertise admin_config_rw: false and memory_write_api: false (gateway/platforms/api_server.py:1502-1505), so the config/memory portion needs an explicit current-contract decision.

Suggested changes

• Re-scope onto current main, register accepted routes in connect(), and add a production-route integration test.
• Replace hardcoded state paths with get_hermes_home() and test an active profile.

Automated hermes-sweeper review.

[teknium1]

This handler (and the other new workspace handlers) is never registered on the PR's production connect() route table: PR-head inspection finds only /api/jobs registrations at lines 2540-2547. The tests manually mount handlers, so these endpoints would be unreachable after starting APIServerAdapter.

[teknium1]

Use get_hermes_home() / "config.yaml" here. Path.home() / ".hermes" writes the default profile even when the API server runs with a named HERMES_HOME; the same profile-isolation issue also exists in the new skill and memory handlers.