hermes - 💡(How to fix) Fix fix(dashboard): plugin enable/disable routes return 405 for category-namespaced plugins [2 pull requests]

Bug Description

All plugin enable/disable/update/delete buttons in the Hermes dashboard return HTTP 405 Method Not Allowed for any plugin whose discovery name contains a / (e.g. model-providers/alibaba, browser/browser_use, image_gen/openai).

Only flat plugins without slashes work (e.g. disk-cleanup).

Steps to Reproduce

1. Start Hermes dashboard on 0.0.0.0:9119
2. Open dashboard → Plugins page
3. Click Enable Runtime on any plugin with / in its name
4. Observe 405 error in browser console

Curl proof:

# Works: disk-cleanup (no slash)
curl -X POST /api/dashboard/agent-plugins/disk-cleanup/enable → 200

# Fails: model-providers/alibaba (slash → %2F encoded)
curl -X POST /api/dashboard/agent-plugins/model-providers%2Falibaba/enable → 405

Root Cause

hermes_cli/web_server.py routes use {name} instead of {name:path}:

• {name} requires exactly one path segment
• Starlette does NOT decode %2F during route matching
• So model-providers%2Falibaba counts as 2+ segments → route never matches
• Falls through to SPA catch-all GET /{full_path:path} → 405

Proposed Fix

Change four routes from {name} to {name:path} and update _validate_plugin_name() to allow / (valid plugin identifiers) while rejecting .. (path traversal).

File: hermes_cli/web_server.py lines 4318-4368

Affected Plugins

All category-namespaced: model-providers/*, browser/*, image_gen/*, observability/* — i.e. the majority of bundled plugins.