fleet-memory/hindsight-integrations/llamaindex
Derek Bouius ee4510a762
fix(deps): address critical and high severity security vulnerabilities (#827)
* fix(deps): address critical and high severity security vulnerabilities

Bump vulnerable dependencies to patched versions across the monorepo:

Python (critical/high):
- fastmcp >=2.14.0 → >=3.2.0 (SSRF, path traversal, OAuth confused deputy, command injection)
- langchain-core >=1.2.11 → >=1.2.22 (path traversal in legacy load_prompt)

Python (low):
- cryptography >=46.0.5 → >=46.0.6 (incomplete DNS name constraint enforcement)
- pygments: add >=2.20.0 pin (ReDoS via GUID regex)

Node.js:
- serialize-javascript ^7.0.3 → ^7.0.5 (CPU exhaustion DoS)
- handlebars: add >=4.7.9 override (JS injection via AST type confusion)
- path-to-regexp: add >=0.1.13 override (ReDoS via route params)
- brace-expansion: add version range override (process hang/memory exhaustion)

Also adds type: ignore comments for FastMCP 2.x private attribute access that
ty now flags since FastMCP 3.x removed _tool_manager (guarded by try/except
and hasattr at runtime).

Regenerated all lock files across API, integrations, and tests.

* fix(deps): add ajv v8 scoped overrides for schema-utils and ajv-keywords

The global ajv ^6.14.0 override caused schema-utils and ajv-keywords to
receive ajv v6, but they require ajv v8 (for dist/compile/codegen). Add
scoped overrides to ensure these packages get ajv v8 while the global
override remains for packages that need v6.

* fix(tests): remove stateless_http from FastMCP() constructor calls

FastMCP 3.x no longer accepts stateless_http in the constructor. The
tests call tools directly without HTTP transport, so the parameter is
not needed.

* fix: update MCP tests for FastMCP 3.x _tool_manager removal

FastMCP 3.x removed _tool_manager. Tests now use
_local_provider._components for sync tool dict access and
mcp.list_tools() for async filtered tool listing.

* fix: resolve docusaurus build failures (ajv overrides + missing blog date)

- Remove global ajv ^6.14.0 override and scoped ajv-keywords/schema-utils
  overrides that caused webpack compilation errors manifesting as
  "Cannot read properties of undefined (reading 'date')" during SSR
  and "these parameters are deprecated" warnings. Natural version
  resolution (v6.12.6+ for v6 consumers, v8+ for v8 consumers) already
  satisfies the security fix (>= 6.12.3).
- Add missing date frontmatter to learning-capabilities blog post.

* chore: regenerate openapi spec and docs skill
2026-04-01 09:20:34 +02:00
..
hindsight_llamaindex fix(llamaindex): document_id, memory API, and ReAct trace fixes (#777) 2026-03-30 18:33:03 +02:00
tests fix(llamaindex): document_id, memory API, and ReAct trace fixes (#777) 2026-03-30 18:33:03 +02:00
pyproject.toml release(llamaindex): v0.1.3 2026-03-30 18:34:25 +02:00
README.md refactor(llamaindex): merge into single hindsight-llamaindex package (#760) 2026-03-30 14:30:48 +02:00
uv.lock fix(deps): address critical and high severity security vulnerabilities (#827) 2026-04-01 09:20:34 +02:00

hindsight-llamaindex

LlamaIndex integration for Hindsight — persistent long-term memory for AI agents.

Provides two complementary patterns:

  • Tools (HindsightToolSpec) — Agent-driven memory via LlamaIndex's BaseToolSpec. The agent decides when to retain/recall/reflect.
  • Memory (HindsightMemory) — Automatic memory via LlamaIndex's BaseMemory interface. Messages are stored on every turn and recalled as context.

Installation

pip install hindsight-llamaindex

Quick Start: Agent Tools

import asyncio
from hindsight_client import Hindsight
from hindsight_llamaindex import HindsightToolSpec
from llama_index.llms.openai import OpenAI
from llama_index.core.agent import ReActAgent

async def main():
    client = Hindsight(base_url="http://localhost:8888")

    spec = HindsightToolSpec(
        client=client,
        bank_id="user-123",
        mission="Track user preferences",
    )
    tools = spec.to_tool_list()

    agent = ReActAgent(tools=tools, llm=OpenAI(model="gpt-4o"))
    response = await agent.run("Remember that I prefer dark mode")
    print(response)

asyncio.run(main())

Quick Start: Automatic Memory

from hindsight_client import Hindsight
from hindsight_llamaindex import HindsightMemory

client = Hindsight(base_url="http://localhost:8888")
memory = HindsightMemory.from_client(
    client=client,
    bank_id="user-123",
    mission="Track user preferences",
)

agent = ReActAgent(tools=tools, llm=llm, memory=memory)

Configuration

from hindsight_llamaindex import configure

configure(
    hindsight_api_url="http://localhost:8888",
    api_key="your-api-key",
    budget="mid",
    tags=["source:llamaindex"],
    context="my-app",
    mission="Track user preferences",
)

Requirements

  • Python 3.10+
  • llama-index-core >= 0.11.0
  • hindsight-client >= 0.4.0

Documentation