fleet-memory/hindsight-integrations/ag2
Derek Bouius ee4510a762
fix(deps): address critical and high severity security vulnerabilities (#827)
* fix(deps): address critical and high severity security vulnerabilities

Bump vulnerable dependencies to patched versions across the monorepo:

Python (critical/high):
- fastmcp >=2.14.0 → >=3.2.0 (SSRF, path traversal, OAuth confused deputy, command injection)
- langchain-core >=1.2.11 → >=1.2.22 (path traversal in legacy load_prompt)

Python (low):
- cryptography >=46.0.5 → >=46.0.6 (incomplete DNS name constraint enforcement)
- pygments: add >=2.20.0 pin (ReDoS via GUID regex)

Node.js:
- serialize-javascript ^7.0.3 → ^7.0.5 (CPU exhaustion DoS)
- handlebars: add >=4.7.9 override (JS injection via AST type confusion)
- path-to-regexp: add >=0.1.13 override (ReDoS via route params)
- brace-expansion: add version range override (process hang/memory exhaustion)

Also adds type: ignore comments for FastMCP 2.x private attribute access that
ty now flags since FastMCP 3.x removed _tool_manager (guarded by try/except
and hasattr at runtime).

Regenerated all lock files across API, integrations, and tests.

* fix(deps): add ajv v8 scoped overrides for schema-utils and ajv-keywords

The global ajv ^6.14.0 override caused schema-utils and ajv-keywords to
receive ajv v6, but they require ajv v8 (for dist/compile/codegen). Add
scoped overrides to ensure these packages get ajv v8 while the global
override remains for packages that need v6.

* fix(tests): remove stateless_http from FastMCP() constructor calls

FastMCP 3.x no longer accepts stateless_http in the constructor. The
tests call tools directly without HTTP transport, so the parameter is
not needed.

* fix: update MCP tests for FastMCP 3.x _tool_manager removal

FastMCP 3.x removed _tool_manager. Tests now use
_local_provider._components for sync tool dict access and
mcp.list_tools() for async filtered tool listing.

* fix: resolve docusaurus build failures (ajv overrides + missing blog date)

- Remove global ajv ^6.14.0 override and scoped ajv-keywords/schema-utils
  overrides that caused webpack compilation errors manifesting as
  "Cannot read properties of undefined (reading 'date')" during SSR
  and "these parameters are deprecated" warnings. Natural version
  resolution (v6.12.6+ for v6 consumers, v8+ for v8 consumers) already
  satisfies the security fix (>= 6.12.3).
- Add missing date frontmatter to learning-capabilities blog post.

* chore: regenerate openapi spec and docs skill
2026-04-01 09:20:34 +02:00
..
hindsight_ag2 fix(ag2): code cleanup and CI/release integration (#721) 2026-03-27 10:10:14 +01:00
tests feat(integrations): add AG2 framework integration (#720) 2026-03-27 09:41:37 +01:00
pyproject.toml release(ag2): v0.1.1 2026-03-27 10:12:30 +01:00
README.md feat(integrations): add AG2 framework integration (#720) 2026-03-27 09:41:37 +01:00
uv.lock fix(deps): address critical and high severity security vulnerabilities (#827) 2026-04-01 09:20:34 +02:00

hindsight-ag2

AG2 integration for Hindsight — persistent long-term memory for AI agents.

Provides Hindsight-backed tool functions that give AG2 agents long-term memory across conversations via retain/recall/reflect operations.

Prerequisites

  • Python 3.10+
  • Running Hindsight instance (quickstart)

Installation

pip install hindsight-ag2

Quick Start

from autogen import AssistantAgent, UserProxyAgent, LLMConfig
from hindsight_ag2 import register_hindsight_tools

llm_config = LLMConfig(api_type="openai", model="gpt-4o-mini")

with llm_config:
    assistant = AssistantAgent(
        name="assistant",
        system_message="You are a helpful assistant with long-term memory.",
    )
    user_proxy = UserProxyAgent(
        name="user",
        human_input_mode="NEVER",
    )

# Register Hindsight memory tools on both agents
register_hindsight_tools(
    assistant, user_proxy,
    bank_id="my-bank",
    hindsight_api_url="http://localhost:8888",
)

# The assistant can now use hindsight_retain, hindsight_recall, hindsight_reflect
result = user_proxy.initiate_chat(
    assistant,
    message="Remember that I prefer Python over JavaScript.",
)

Tools

Tool Operation Description
hindsight_retain Retain Store facts, preferences, decisions to long-term memory
hindsight_recall Recall Multi-strategy search across stored memories
hindsight_reflect Reflect Synthesize reasoned answers from memories

Configuration

Global config

from hindsight_ag2 import configure

configure(
    hindsight_api_url="http://localhost:8888",
    api_key="your-key",       # or set HINDSIGHT_API_KEY env var
    budget="mid",              # low / mid / high
    max_tokens=4096,
    tags=["source:ag2"],       # default tags for retain
)

Per-call overrides

All global settings can be overridden per create_hindsight_tools() call:

Parameter Description Default
bank_id Memory bank ID (required)
client Pre-configured Hindsight client
hindsight_api_url API URL Global config or production
api_key API key Global config or env var
budget Recall/reflect budget "mid"
max_tokens Max tokens for recall 4096
tags Tags for retain operations None
recall_tags Tags to filter recall None
recall_tags_match Tag match mode "any"
retain_metadata Metadata dict for retain None
retain_document_id Document ID for retain None
recall_types Fact types to filter None
recall_include_entities Include entities in recall False
reflect_context Additional context for reflect None
reflect_max_tokens Max tokens for reflect max_tokens
reflect_response_schema JSON schema for reflect output None
reflect_tags Tags for reflect (fallback: recall_tags) None
reflect_tags_match Tag match for reflect recall_tags_match

Advanced: Manual Registration

from hindsight_ag2 import create_hindsight_tools

tools = create_hindsight_tools(
    bank_id="my-bank",
    hindsight_api_url="http://localhost:8888",
)
for tool_fn in tools:
    assistant.register_for_llm(description=tool_fn.__doc__)(tool_fn)
    user_proxy.register_for_execution()(tool_fn)

Advanced: GroupChat with Shared Memory

from autogen import AssistantAgent, UserProxyAgent, GroupChat, GroupChatManager, LLMConfig
from hindsight_ag2 import register_hindsight_tools

llm_config = LLMConfig(api_type="openai", model="gpt-4o-mini")

with llm_config:
    researcher = AssistantAgent(name="researcher", system_message="You research topics.")
    writer = AssistantAgent(name="writer", system_message="You write content.")
    executor = UserProxyAgent(name="executor", human_input_mode="NEVER")

# All agents share the same memory bank
for agent in [researcher, writer]:
    register_hindsight_tools(agent, executor, bank_id="team-memory")

group_chat = GroupChat(agents=[researcher, writer, executor], messages=[])
manager = GroupChatManager(groupchat=group_chat)

Requirements

  • ag2>=0.9.0
  • hindsight-client>=0.4.0

Documentation