Pins 6722dba, which merges teknium1's PR #1 on the plugin repo: the
api_key config field declared type: "secret" but not secret: True, and
Hermes keys on the secret flag alone. Without it the setup wizard
prompted unmasked, the key reached save_config() and landed in
qdrant.json or config.yaml, and the dashboard's config GET returned it
in plaintext. Verified against core source (_schema_field_kind consults
kind/type only for bool/int/float; memory_setup keys solely on secret)
before merging.
Also carries the venv re-sync fix and the bounded fastembed floor from
0.1.3. Gates re-run green at this pin: structural OK, validate
--install-deps exit 0, self-updater grep empty, banner 200.
Pins fdaf86e, which carries two fixes that affect an installer:
- Runtime state moved out of the plugin member dir. PM's members_stamp()
hashes every file in a plugin dir, so the old status.json write on each
store/recall changed the dependency stamp and re-synced the venv on nearly
every launch. State now lives in <HERMES_HOME>/qdrant.json (0600).
- fastembed bounded at >=0.4.0,<1, closing the last bare dependency floor
that rule 9 asks to be bounded. Under PM's unified resolve an unbounded
floor can refuse the whole install.
The entry now discloses where runtime state lives and why, and the
residual .pytest_cache stamp behaviour is stated in known_issues as an
upstream constraint rather than left unmentioned.
New upstream commit 4ce4b85 adds progress display for memory operations:
status_callback events rendered as 'stored (N points)' and 'recalled N
memories', configurable via memory.qdrant.progress (off/minimal/verbose).
Also fixes recall_status to return the actual recall count.
Catalog SHA bump per plugin-catalog/README.md rule 4 (SHA bumps are new PRs).
Re-pins AhmetArif0/hermes-ntfy-approval to 95d3a4b (1.0.1). Stopping a turn
(/stop, Ctrl-C) while an approval was on the phone left its buttons there until
approvals.timeout ran out, and for good if Hermes exited first. The plugin now
withdraws the notification from post_approval_response before Hermes moves on.
Adds post_approval_response to hooks and to the disclosure.
Points image at docs/card.png at the pinned commit (outside the plugin
directory, so installs don't carry it). The card stays inside the plugin
page hero's visible band (rows 110-490), checked on the live site at six
widths in both themes.
Answer Hermes' approval prompts from an ntfy push notification with
Approve once, Approve for session and Deny buttons; silence still
denies. An approval transport (register_approval_transport): the phone
posts a one-time answer code to a reply topic, so nothing listens on the
Hermes machine.
Declares requires_hermes and websockets, stops the double-type on an
unreadable field, drops the dead tool-timeout knob, and corrects the README.
The entry's version also caught up with the pinned manifest (0.3.2 -> 0.3.4).
pricewin 0.2.0 is a portable Agent Plugins v1 package: mcp.json (the
PriceWin server over Streamable HTTP, no credentials), the
pricewin-travel-search skill, and the existing desktop/plugin.js cards.
One install now gives the tools, the workflow and the cards; 0.1.1 drew
cards only and needed the MCP server installed separately.
Supersedes #118868 (optional-mcps entry) and #118869 (optional skill), the
same shape #108908 retired for TouchDesigner.
