feat(sdk-playground): interactive SDK chat playground by Dhravya · Pull Request #1437 · supermemoryai/supermemory

Dhravya · 2026-08-08T02:40:38Z

Summary

Add apps/sdk-playground — chat UI to test TS/Python SDK integrations
Context panel with document memories, API keys in dashboard, tools reference tab
Python FastAPI server on port 8792; portless entry in portless.json

Stacked on #1436

Test plan

cd apps/sdk-playground && bun run check-types
bun run dev with Supermemory + OpenAI keys in UI
Switch SDKs and verify chat + context panel

Made with Cursor

claude · 2026-08-08T02:40:55Z

Claude finished @ved015's task in 1m 46s —— View job

Code Review Complete

Fetch PR diff and existing review comments
Analyze code changes for bugs, security issues, and logic errors
Check critical files in detail
Submit review findings

Overview: Adds an SDK playground app with Next.js frontend and Python FastAPI backend for interactively testing Supermemory SDK integrations across TypeScript and Python.

Issues found: None — this looks good to ship.

I reviewed ~5700 lines of new code across 29 files including:

Next.js API routes (/api/chat, /api/context) with proper request validation
Python FastAPI server with multiple SDK integration handlers
Frontend components (chat UI, API keys panel, context panel)
Core business logic (chat-handlers.ts, context-api.ts, request-validation.ts)
CI workflow additions for Python validation

Previous review issues addressed:

The latest commits fix the issues from the earlier Cursor Bugbot review:

Context API no longer requires OpenAI key — now uses resolveSupermemoryApiKey at api/context/route.ts:2,20-21 instead of resolveApiKeys
No more env-var race condition — The withPlaygroundEnvKeys function that temporarily overwrote environment variables has been removed entirely. API keys are now passed directly to SDK clients via the keys: PlaygroundApiKeys parameter

Security measures in place:

TrustedHostMiddleware restricts Python server to localhost only (server.py:359-362)
assertTrustedBrowserRequest validates request origin and rejects cross-site requests (request-validation.ts:75-96)
mayUseEnvironmentKeys restricts env-key usage to trusted hosts — localhost and sdk.dev.supermemory.ai (request-validation.ts:99-112)
Comprehensive input validation with length limits, pattern matching, and body size checks
SecretStr used for API keys in Python Pydantic models (server.py:380-384)
API keys stored in sessionStorage (not localStorage), scoped to tab lifetime (api-keys.ts:47,61)

Design choices appropriate for a dev playground:

8-step tool loop limit prevents runaway execution (chat-handlers.ts:297, server.py:559)
Proper timeout handling with best-effort debug info collection (chat-handlers.ts:62-115)
Port configuration is consistent throughout (8792)

Score: 9/10

Minor deduction: The debug memory panel explicitly notes it shows a "post-response snapshot" rather than the exact context injected by middleware — this is working as designed and clearly labeled, not a bug.

cloudflare-workers-and-pages · 2026-08-08T02:41:07Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	supermemory-mcp	`8a78b11`	Aug 24 2026, 04:26 PM

cloudflare-workers-and-pages · 2026-08-08T02:41:27Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	supermemory-app	`8a78b11`	Commit Preview URL Branch Preview URL	Aug 24 2026, 04:28 PM

socket-security · 2026-08-08T02:41:32Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/openai@2.53.0
	npm/concurrently@9.2.4
	pypi/uvicorn@0.52.1
	pypi/python-dotenv@1.2.2
	pypi/requests@2.34.2
	pypi/supermemory@3.56.0
	pypi/fastapi@0.141.1

View full report

cursor

Cursor Bugbot has reviewed your changes using default effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 93f92cd. Configure here.}

cursor · 2026-08-08T02:42:08Z

+				},
+				{ status: 400 },
+			)
+		}


Context API needs OpenAI key

Medium Severity

The context routes use resolveApiKeys, which returns null unless both Supermemory and OpenAI keys are present. Loading container context only calls Supermemory, and the context panel only validates the Supermemory key, so a dashboard with just a Supermemory key still gets a 400 from /api/context.

Additional Locations (1)

apps/sdk-playground/src/lib/api-keys.ts#L7-L18

^{Reviewed by Cursor Bugbot for commit 93f92cd. Configure here.}

cursor · 2026-08-08T02:42:08Z

+		} else {
+			delete process.env.OPENAI_API_KEY
+		}
+	}


Shared env keys race

Medium Severity

Chat handlers temporarily overwrite global SUPERMEMORY_API_KEY and OPENAI_API_KEY on the shared Node process and Python process. Overlapping requests with different dashboard keys can read or write the wrong credentials mid-flight.

Additional Locations (1)

apps/sdk-playground/python/server.py#L87-L103

^{Reviewed by Cursor Bugbot for commit 93f92cd. Configure here.}

cursor · 2026-08-08T02:42:08Z

+			skipMemoryOnError: middlewareConfig.skipMemoryOnError,
+		},
+		keys.supermemoryApiKey,
+	)


Debug shows post-chat profile

Low Severity

Middleware memory debug is built by fetching profile after the model response (and after auto-save). The “Context injected into prompt” preview can include memories written in that same turn, not what middleware actually injected.

Additional Locations (1)

apps/sdk-playground/python/server.py#L469-L484

^{Reviewed by Cursor Bugbot for commit 93f92cd. Configure here.}

claude

Overview: Adds a new SDK playground app with Next.js frontend and Python FastAPI backend for interactively testing Supermemory SDK integrations across TypeScript and Python.

Issues found: None — this looks good to ship.

I reviewed ~4000 lines of new code across 26 files including:

Next.js API routes (/api/chat, /api/context)
Python FastAPI server with multiple SDK integration handlers
Frontend components (chat UI, API keys panel, context panel)
Core business logic (chat-handlers.ts, context-api.ts, api-keys.ts)

Design choices appropriate for a dev playground:

API keys in localStorage with clear user messaging
Permissive CORS on Python server (allow_origins=["*"])
Temporary env var manipulation for SDK compatibility

Code quality observations:

Good error handling throughout both TypeScript and Python
Proper API key resolution chain (user input → env vars)
Clean SDK abstraction via registry pattern
Tool loop limits prevent runaway execution (8 steps max)

Score: 9/10

Minor deduction for documentation mismatch (README says port 8791, env example says 8792) — not a blocker.

Dhravya · 2026-08-08T02:47:57Z

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

How to use the Graphite Merge Queue

Add the label Main to this PR to add it to the merge queue.

You must have a Graphite account in order to use the merge queue. Sign up using this link.

_{An organization admin has enabled the Graphite Merge Queue in this repository.} _{Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.}

This stack of pull requests is managed by Graphite. Learn more about stacking.

Next.js UI with TypeScript and Python chat backends, context panel, API key management, tools reference, and middleware configuration. Co-authored-by: Cursor <cursoragent@cursor.com>

claude

Overview: Adds an SDK playground app with Next.js frontend and Python FastAPI backend for interactively testing Supermemory SDK integrations across TypeScript and Python.

Issues found: None — this looks good to ship.

I reviewed ~5000 lines of new code across 29 files including:

Next.js API routes (/api/chat, /api/context) with proper request validation
Python FastAPI server with multiple SDK integration handlers
Frontend components (chat UI, API keys panel, context panel)
Core business logic (chat-handlers.ts, context-api.ts, request-validation.ts)
CI workflow additions for Python validation

Previous review issues addressed:
The latest commit (4e04a0d) fixes the two substantive issues from the earlier Cursor Bugbot review:

✅ Context API no longer requires OpenAI key (now uses resolveSupermemoryApiKey)
✅ API keys are passed directly to SDK clients, eliminating the env-var race condition

Security measures in place:

TrustedHostMiddleware restricts Python server to localhost only
assertTrustedBrowserRequest validates request origin and rejects cross-site requests
mayUseEnvironmentKeys restricts env-key usage to trusted hosts (localhost, sdk.dev.supermemory.ai)
Comprehensive input validation with length limits, pattern matching, and body size checks
SecretStr used for API keys in Python Pydantic models
API keys stored in sessionStorage (not localStorage), scoped to tab lifetime

Design choices appropriate for a dev playground:

Permissive CORS on Python server (localhost-only anyway)
8-step tool loop limit prevents runaway execution
Proper timeout handling with best-effort debug info collection

Score: 9/10

Minor deduction for documentation mismatch (README mentions port 8791 in one place, env example says 8792) — not a blocker.

graphite-app Bot assigned Dhravya Aug 8, 2026

cursor Bot reviewed Aug 8, 2026

View reviewed changes

claude Bot reviewed Aug 8, 2026

View reviewed changes

Dhravya changed the base branch from chore/ci-js-tools-unit-tests to graphite-base/1437 August 18, 2026 15:18

This was referenced Aug 18, 2026

feat(tools): SDK-level cross-source memory deduplication #1531

Open

feat(python-sdks): SDK-level cross-source memory deduplication #1532

Open

feat(sdk-playground): reflect SDK-owned memory block in debug view #1533

Open

Dhravya assigned ved015 Aug 18, 2026

Dhravya requested a review from MaheshtheDev August 18, 2026 15:20

Dhravya and others added 2 commits August 24, 2026 20:01

feat(sdk-playground): add interactive chat playground for SDK testing

ff66abb

Next.js UI with TypeScript and Python chat backends, context panel, API key management, tools reference, and middleware configuration. Co-authored-by: Cursor <cursoragent@cursor.com>

fix(sdk-playground): harden runtime and CI

4e04a0d

ved015 force-pushed the graphite-base/1437 branch from 78269ff to 69def1a Compare August 24, 2026 14:43

ved015 force-pushed the feat/sdk-playground branch from 93f92cd to 4e04a0d Compare August 24, 2026 14:43

claude Bot reviewed Aug 24, 2026

View reviewed changes

Merge branch 'rebuild/pr1436' into rebuild/pr1437

8a78b11

ved015 approved these changes Aug 24, 2026

View reviewed changes

Navigation Menu

Uh oh!

feat(sdk-playground): interactive SDK chat playground - #1437

feat(sdk-playground): interactive SDK chat playground#1437
Dhravya wants to merge 3 commits into
graphite-base/1437from
feat/sdk-playground

Dhravya commented Aug 8, 2026

Uh oh!

claude Bot commented Aug 8, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Aug 8, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Aug 8, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Aug 8, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Aug 8, 2026

Uh oh!

cursor Bot Aug 8, 2026

Uh oh!

cursor Bot Aug 8, 2026

Uh oh!

claude Bot left a comment

Uh oh!

Dhravya commented Aug 8, 2026 •

edited

Loading

Uh oh!

claude Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Dhravya commented Aug 8, 2026

Summary

Test plan

Uh oh!

claude Bot commented Aug 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Complete

Uh oh!

cloudflare-workers-and-pages Bot commented Aug 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

cloudflare-workers-and-pages Bot commented Aug 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

socket-security Bot commented Aug 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Aug 8, 2026

Choose a reason for hiding this comment

Context API needs OpenAI key

Uh oh!

cursor Bot Aug 8, 2026

Choose a reason for hiding this comment

Shared env keys race

Uh oh!

cursor Bot Aug 8, 2026

Choose a reason for hiding this comment

Debug shows post-chat profile

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Dhravya commented Aug 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

How to use the Graphite Merge Queue

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

claude Bot commented Aug 8, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Aug 8, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Aug 8, 2026 •

edited

Loading

socket-security Bot commented Aug 8, 2026 •

edited

Loading

Dhravya commented Aug 8, 2026 •

edited

Loading