Skip to content

feat(hermes): enable webhook platform #2319

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shunkakinoki merged 2 commits into from
Aug 9, 2026
Merged

feat(hermes): enable webhook platform #2319

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
65f7e40
feat(hermes): enable webhook platform
shunkakinoki Aug 9, 2026
4629c58
fix(hermes): use HERMES_WEBHOOK_SECRET env var for consistency
shunkakinoki Aug 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions config/hermes/config.template.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -327,3 +327,9 @@ custom_providers:
base_url: https://cliproxy.shunkakinoki.com/v1
api_key: __CLIPROXY_API_KEY__
api_mode: chat_completions
platforms:
webhook:
enabled: true

@indent-zero indent-zero Bot Aug 9, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Webhook enabled on all hosts: default.nix sets mode to gateway on Kyber and client on macOS, but hydrate.sh never branches on @mode@ for this block, so client hosts will also bind TCP 8644. If the webhook endpoint is only reachable via the gateway host's public URL, consider gating this section on mode (or on WEBHOOK_SECRET being non-empty) inside hydrate.sh.

extra:
port: 8644
secret: __WEBHOOK_SECRET__

@coderabbitai coderabbitai Bot Aug 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Quote and escape the webhook secret.

secret: __WEBHOOK_SECRET__ is an unquoted YAML scalar. Values such as true, null, #value, or values containing YAML indicators can parse incorrectly or invalidate the generated configuration. Quote and YAML-escape the substituted value, or enforce a documented safe token format before substitution.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@config/hermes/config.template.yaml` at line 335, Update the webhook secret
substitution near the secret configuration so the generated YAML always treats
the value as a string: quote the substituted __WEBHOOK_SECRET__ value and apply
YAML escaping, or enforce and document a safe token format before substitution.
Preserve the existing secret value while preventing YAML booleans, nulls,
indicators, and special characters from being misparsed.

2 changes: 2 additions & 0 deletions config/hermes/hydrate.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,7 @@ fi
TELEGRAM_TOKEN="${HERMES_TELEGRAM_TOKEN:-${TELEGRAM_TOKEN:-$(read_secret "${SECRETS_DIR}/telegram-token")}}"
GATEWAY_TOKEN="${HERMES_GATEWAY_TOKEN:-${GATEWAY_TOKEN:-$(read_secret "${SECRETS_DIR}/gateway-token")}}"
WHATSAPP_ALLOW_FROM="${WHATSAPP_ALLOW_FROM:-$(read_secret "${SECRETS_DIR}/whatsapp-allow-from")}"
WEBHOOK_SECRET="${HERMES_WEBHOOK_SECRET:-$(read_secret "${SECRETS_DIR}/webhook-secret")}"

if [ -z "${GATEWAY_TOKEN}" ]; then
echo "Warning: HERMES_GATEWAY_TOKEN not set, skipping Hermes hydration" >&2
Expand All @@ -72,6 +73,7 @@ fi
# Hydrate config.yaml
@sed@ \
-e "s|__CLIPROXY_API_KEY__|${CLIPROXY_API_KEY}|g" \
-e "s|__WEBHOOK_SECRET__|${WEBHOOK_SECRET}|g" \

@coderabbitai coderabbitai Bot Aug 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Escape WEBHOOK_SECRET before using it as a sed replacement.

The raw value is interpolated into the replacement expression. A secret containing &, |, or \ can change the generated value or make hydration fail. Escape the replacement value before constructing the sed expression. This is a substitution bug, not shell command injection.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@config/hermes/hydrate.sh` at line 76, Escape WEBHOOK_SECRET for sed
replacement semantics before interpolating it into the substitution expression,
handling &, |, and backslash characters without altering the intended secret
value. Use the escaped value in the existing __WEBHOOK_SECRET__ replacement
within hydrate.sh.

"$CONFIG_TEMPLATE" >"${STATE_DIR}/config.yaml"
chmod 600 "${STATE_DIR}/config.yaml"

Expand Down
Loading