feat: headless auth via env + client_credentials service token#2
Open
irresi wants to merge 1 commit into
Open
Conversation
Enables CI/headless use without a browser login or token file: - MEMBASE_API_URL overrides the API base (point at staging/preview). - MEMBASE_ACCESS_TOKEN / MEMBASE_REFRESH_TOKEN inject tokens directly. - MEMBASE_SERVICE_CLIENT_ID / MEMBASE_SERVICE_CLIENT_SECRET mint a short-lived access token via the client_credentials grant (membase#318). Env takes precedence over the config file / token file. resolve_auth_state() centralizes the precedence (explicit token → service-credential exchange → fall back to browser-login tokens) and is used by both the CLI and the provider. Adds oauth.exchange_client_credentials(). Config-file fallbacks (serviceClientId/serviceClientSecret) included for symmetry. Verified live against staging: env-only → minted token → ingest + search succeed, no browser, no refresh token. Adds unit tests for env precedence and auth resolution. Bumps 0.1.5 → 0.1.6. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This was referenced Jul 3, 2026
irresi
added a commit
to aristoapp/membase
that referenced
this pull request
Jul 13, 2026
…oup B) Pure copy-in (option a): bring the working hermes-membase Python runtime in AS-IS, then refactor toward a shared core later. Replaces the disabled "review scaffold" with the real provider/client/oauth/capture/mirror/cli runtime, including the headless client_credentials auth (aristoapp/hermes-membase#2). - clients/hermes/python/src/membase_hermes/: real runtime (17 files). Adopts the source package name `membase_hermes` (dropped the `hermes_membase` stub). - pyproject: real deps (httpx, PyYAML) + entry points; version pinned to the repo-wide 0.0.0; plugin.yaml synced to the adapter-generated manifest. - Rewrote the guards that were purpose-built to assert "runtime NOT copied yet" to instead verify the runtime IS present (source inspection only — no import, so CI needs no Python deps; live behavior stays covered by the e2e tiers): check-hermes-python-parity (real tools, no scaffold markers), check-hermes-native-artifacts (policy -> "ported", assert modules present), version-parity + review-readiness path renames. - docs/consolidation-execution-plan-group-b.md. Group A adapter untouched. No publishing (private package, no PyPI). pnpm check green. OpenClaw copy-in is next; shared-core refactor + test migration later. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Source: https://github.com/aristoapp/hermes-membase Co-authored-by: Seunghyun00Kim <151034001+Seunghyun00Kim@users.noreply.github.com> Co-authored-by: Joshua Park <inyoung@aristo.so> Co-authored-by: Shinhyeok Hwang <shinhyeok@aristo.so>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Lets hermes-membase authenticate headlessly (CI/Docker) — no browser login, no pre-seeded token file — so it can be verified end-to-end in an automated pipeline. This is the connector-side enablement for the Docker "Tier 4" e2e.
Env support (all take precedence over config/token files)
MEMBASE_API_URLMEMBASE_ACCESS_TOKEN/MEMBASE_REFRESH_TOKENMEMBASE_SERVICE_CLIENT_ID/MEMBASE_SERVICE_CLIENT_SECRETclient_credentials(aristoapp/membase#318)How
resolve_auth_state(config)centralizes precedence: explicit access token → service-credential exchange → fall back to existing (browser-login) tokens. Used by both the CLI (_build_client_from_config) and the memory provider.oauth.exchange_client_credentials()performs the grant (access token only; no refresh — re-exchanges on expiry).parse_config()reads the new env vars; config-file fallbacks (serviceClientId/serviceClientSecret) included for symmetry.Verified
client_credentials→ingest+searchsucceeded, no browser, no refresh token.Bumps 0.1.5 → 0.1.6.
🤖 Generated with Claude Code