shira-hermes

espocrm-extensions/shira-hermes

Archived

Fork 0

Commit Graph

Author	SHA1	Message	Date
chaim	e947bca655	fix: code audit — security, correctness, and robustness fixes Security: - Path traversal: validate user_id, case_id, skill_name against safe regex - Input sanitization in memory.py and skills.py file path construction Correctness: - ISR timezone: replace hardcoded UTC+3 with ZoneInfo("Asia/Jerusalem") for DST - save_rule: use EspoCrmApiError.status_code instead of fragile string matching - Background tasks: store references to prevent GC before completion - Lock race: use dict.setdefault() for atomic lock creation - Version: health.py now matches main.py (0.2.0) - Skill names: normalized to lowercase for dedup consistency Build: - Dockerfile: install from pyproject.toml instead of hardcoded pip list - Remove unused mcp>=1.0.0 dependency from pyproject.toml Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-13 20:18:01 +00:00
chaim	a990f527a2	fix: save_rule falls back to user profile when AssistantRule 404 The AssistantRule entity may not exist on some CRM instances. When save_rule gets a 404, it now falls back to saving the rule in the local user profile (update_user_profile). Also improved update_user_profile description so Shira is more likely to use it for user preferences. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-13 20:10:10 +00:00
chaim	4aad81e11e	feat: add skills, memory, delegation and self-learning (Phase 3) Add three Hermes-inspired capabilities to Shira: - Skills system: firm-wide workflow templates (list/view/manage tools), 4 pre-seeded skills (case summary, hearing prep, direct access report, deadline tracker), auto-learning via post-conversation meta-prompt - Cross-conversation memory: per-lawyer profiles and per-case memory stored as bounded markdown files, injected into system prompts - Sub-agent delegation: spawn up to 3 child AgentRunner instances for parallel document analysis and complex multi-step tasks New files: skills.py, memory.py, delegate.py, learner.py, 4 SKILL.md Updated: agent_runner (6 new tools, depth/blocked_tools support), prompt_builder (skills/memory injection), route (memory loading, background learning), main.py (data dirs), Dockerfile (pyyaml, skills) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-13 19:33:57 +00:00

Author

SHA1

Message

Date

chaim

e947bca655

fix: code audit — security, correctness, and robustness fixes

Security:
- Path traversal: validate user_id, case_id, skill_name against safe regex
- Input sanitization in memory.py and skills.py file path construction

Correctness:
- ISR timezone: replace hardcoded UTC+3 with ZoneInfo("Asia/Jerusalem") for DST
- save_rule: use EspoCrmApiError.status_code instead of fragile string matching
- Background tasks: store references to prevent GC before completion
- Lock race: use dict.setdefault() for atomic lock creation
- Version: health.py now matches main.py (0.2.0)
- Skill names: normalized to lowercase for dedup consistency

Build:
- Dockerfile: install from pyproject.toml instead of hardcoded pip list
- Remove unused mcp>=1.0.0 dependency from pyproject.toml

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-13 20:18:01 +00:00

chaim

a990f527a2

fix: save_rule falls back to user profile when AssistantRule 404

The AssistantRule entity may not exist on some CRM instances. When save_rule
gets a 404, it now falls back to saving the rule in the local user profile
(update_user_profile). Also improved update_user_profile description so
Shira is more likely to use it for user preferences.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-13 20:10:10 +00:00

chaim

4aad81e11e

feat: add skills, memory, delegation and self-learning (Phase 3)

Add three Hermes-inspired capabilities to Shira:

- Skills system: firm-wide workflow templates (list/view/manage tools),
  4 pre-seeded skills (case summary, hearing prep, direct access report,
  deadline tracker), auto-learning via post-conversation meta-prompt
- Cross-conversation memory: per-lawyer profiles and per-case memory
  stored as bounded markdown files, injected into system prompts
- Sub-agent delegation: spawn up to 3 child AgentRunner instances for
  parallel document analysis and complex multi-step tasks

New files: skills.py, memory.py, delegate.py, learner.py, 4 SKILL.md
Updated: agent_runner (6 new tools, depth/blocked_tools support),
prompt_builder (skills/memory injection), route (memory loading,
background learning), main.py (data dirs), Dockerfile (pyyaml, skills)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-13 19:33:57 +00:00

3 Commits