feat(plugin:codebase-memory): dashboard plugin embedding local codebase-memory-mcp UI

[SirMinionBot]

What this is

A new dashboard plugin codebase-memory under plugins/codebase-memory/
that embeds the local codebase-memory-mcp
graph UI (DeusData) inside the existing Hermes dashboard via an iframe.
Browse, search and explore indexed code repositories without leaving
the dashboard.

It follows the same native plugin pattern as plugins/knowledge-graph/
(PR #4): FastAPI plugin_api.py auto-mounted at
/api/plugins/codebase-memory/…, plus a plain IIFE consuming
window.__HERMES_PLUGIN_SDK__. Zero changes to hermes-agent core, no
new model tools, no entry in the core tree.

Why an iframe, not a reimplementation

codebase-memory-mcp ships a fast WebGL/canvas renderer and a
sophisticated graph UI of its own (already serving 2 084 nodes / 2 201
edges for the codigosinsiesta repo on the local instance).
Reimplementing it would couple the plugin to DeusData's release cadence
and bury us in code we don't own.

The dashboard's iframe approach:

• Zero rebuild cost — when DeusData ships UI improvements, the
  dashboard reflects them automatically.
• CORS already works — the binary's HTTP UI server explicitly
  allows the dashboard origin (Access-Control-Allow-Origin: http://127.0.0.1:9119).
• The plugin stays small — 494 lines of JS, no vendored graph
  library, no build step.

What's in this PR

Plugin scaffold (commit 2c145850c4)

• plugins/codebase-memory/dashboard/manifest.json — registers
  /codebase-memory tab after knowledge-graph, icon GitBranch.
• plugins/codebase-memory/dashboard/plugin_api.py — single FastAPI
  APIRouter (354 lines) exposing /health, /projects,
  /project/{name}/health, /iframe-url, /open. Proxies the
  codebase-memory-mcp CLI for project enumeration and per-project
  health, falls back gracefully when the binary is missing.
• plugins/codebase-memory/dashboard/dist/index.js — IIFE (494 lines)
  implementing CodebaseMemoryPage. Defensive registration,
  structured state (loading / ok / error) per endpoint with explicit
  retry button when the plugin backend can't be reached. The embedded
  iframe carries a sandbox="allow-scripts allow-same-origin allow-forms allow-popups"
  attribute (no allow-top-navigation, no allow-modals).
• plugins/codebase-memory/dashboard/dist/style.css — scoped
  .hermes-cbm-* classes using the dashboard's semantic tokens
  (var(--bg-card), var(--text-primary), etc.).
• 3 pytest tests embedded at the bottom of plugin_api.py:
  test_plugin_self_check, test_health_endpoint_shape,
  test_iframe_url_endpoint_shape.

Verified state

• pytest plugins/codebase-memory/dashboard/plugin_api.py — 3/3 green
• Bundle served at
  http://127.0.0.1:9119/dashboard-plugins/codebase-memory/dist/index.js
• Plugin appears in the sidebar between KANBAN and ACHIEVEMENTS,
  label "Codebase Memory", icon GitBranch.
• Status pill reports binary/UI state; sidebar lists projects; main
  pane embeds the upstream UI; explicit "dashboard error" + Retry
  button on auth failures (when the host dashboard rotates its
  session token after a restart).

Configuration

plugins:
  codebase_memory:
    binary_path: ~/.local/bin/codebase-memory-mcp   # default
    ui_port: 9749                                    # default
    ui_host: 127.0.0.1                              # default (loopback only)

All keys are optional. The plugin probes ~/.local/bin/codebase-memory-mcp
and port 9749 by default and surfaces helpful empty-state cards when
either is missing.

Operational setup

# Install the upstream binary (pin to a known release)
curl -fsSL https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/v0.8.1/install.sh | bash

# Bring up the UI server the plugin embeds
codebase-memory-mcp --ui=true --port=9749

# Restart the dashboard so it picks up the new plugin directory
# (see plugins/knowledge-graph/ README for the canonical kill+relaunch pattern)

Roadmap

• PR feat(plugin:codebase-memory): v0.2.0 — SQLite-direct Cytoscape graph (no daemon, ~30 MB vs 6 GB) #7 (this one) — iframe wrapper + status sidebar + retry on auth error.
• PR Update snapshot id for ipython NousResearch/hermes-agent#8 — postMessage bridge to the upstream UI for project selection
  without reload (the upstream UI already keeps ?project= as a
  forward-compatible hint).
• PR Add logging for first 100 chars of the tool call args json / tool response NousResearch/hermes-agent#9 — optional export of indexed nodes to the mcp_gbrain_*
  catalog so the codebase graph shows up alongside the Obsidian vault
  the knowledge-graph plugin already exposes.

Out of scope

• Reimplementing the codebase-memory-mcp graph view (intentional — see
  "Why an iframe").
• Bundling or vendoring the upstream binary or its UI bundle (the
  plugin reads both at runtime from the locally running binary).
• New HERMES_* env vars — the existing config.yaml block is the
  single source of truth.

cc @TellMeAlex