tabro bundles a prebuilt Windows .exe (relay-native-host-0.4.2.exe) in its
plugin tree. The install scanner cannot read machine code, and the SHA-256 the
plugin checks it against is committed in the same commit, so it only proves the
file was not changed after that commit, not where it came from. A reviewer
cannot tell it matches the in-repo C++ source. That is a precedent worth
closing before someone ships a binary that is not benign.
- Delists tabro (deletes plugin-catalog/tabro.yaml). Existing installs keep
working; not added to removed.yaml — there is no evidence of malice, only no
way to verify the binary. An attested build (rule 17) is the way back.
- Adds admission rule 17: no compiled binaries, committed Python bytecode, or
archives hiding either, detected by file header not extension. A native
component is allowed only with a GitHub build-provenance attestation tying it
to the plugin repo's own workflow at the pinned commit; a setup-time download
is allowed only from the tool's official source, pinned by checksum and
disclosed. Mirrored into the docs submission guide (the mirror test enforces
identical text).
A full-content scan of all 543 pinned entries found tabro is the only one with
a native executable. The enforcing gate ships in a follow-up PR.
hermes-memory-wiki, hermes-telegram-business, blender, snyk and touchdesigner
move to subdirectories of NousResearch/hermes-official-plugins (history kept)
and get catalog card images; accent-picker, the Desktop accent colour picker
that left the app bundle, joins the catalog from the same repo.
The re-pins carry no new tools, hooks or dependencies. telegram-business and
blender also pick up their unpinned main commits (an owner-check fail-open fix
with a regression test; a docs correction).
The floor named a version that doesn't exist yet, so #134485's requires_hermes
enforcement would refuse the pack on every current release. 0.21.6 is the first
release with the language-pack loader it uses (same floor as hermes-lang-it).
/speed days groups streaming speed by local calendar day, newest first, and the record now reads a file saved with a byte-order mark. Pins 4c174f03f7d5305c814257aa3315f352696d3af5; disclosure unchanged.
v1.0.17 fixes the last unguarded confirmation path: the star/label action
(the card Star button and the detail bottom-row Star) opened the review
dialog even with "Confirm every action" off. It now honours the same master
switch as the other three paths (bulk, per-card, detail).
/aux days groups auxiliary calls by local calendar day, newest first, and the ledger now reads a file saved with a byte-order mark. Pins b2f7fc5f9b78871c8a9d6b1e8cce68b431abc347; disclosure unchanged.
Bumps the entry from 1.4.2 (0009d8e, landed in #134417) to 1.5.0 (e735cd2): the 40-char
pin, the version, and the four image URLs that are pinned to the same commit, per rule 4.
The range this pin adopts, in the plugin repository:
- e735cd2 chore(release): 1.5.0 — the detail as a modal, attachments at last
- e143a64 fix(detail): the modal needs no dock button, and the switch belongs by the close
- b739557 feat(detail): open the task detail as a modal, and show its attachments
- dc3c8e9 fix(boards): resolve the default board's path through the core (NousResearch#10)
- 0d1e15a fix(markdown): render bodies with the app's own markdown component
- 8e20c1b test(search): assert the predicate, not the row list
- 3cc6e0b feat(api): list and serve task attachments
- 1d72682 feat(search): find a task by its id
Eight commits, all released as 1.5.0:
- the task detail can be presented as the dockable panel it has always been, or as a
centred modal with its own metadata column (status, assignee, workspace, created, last
activity, attachments) — the shape the official kanban plugin's detail uses. The body is
built once and rendered into either container, so the two cannot drift apart;
- attachments are listed per task, with a preview button on the markdown ones and a
download button on all of them. The plugin REST door speaks JSON only, so the new
backend route returns decoded text for text-like files and base64 otherwise (the client
rebuilds a Blob), and it resolves the stored path and refuses anything outside the
board's own attachments tree with a 404 rather than serving it;
- the search accepts a task id, with or without its `t_` prefix and case-insensitively,
while titles and labels keep matching as before;
- markdown bodies render through the SDK's MessageTextContent. The old containers asked
for Tailwind Typography's `prose-sm`, which is not in the desktop's precompiled
stylesheet at all — measured, 0 occurrences while the base variant and its heading rules
are compiled — so the base ratios applied (h1 at 2.25em) on a body pinned to 11px and
every title came out about twice its size;
- the `default` board is no longer refused by the board-path guard, which modelled its
back-compat database one directory too deep, and a board-path refusal is no longer
reported as "backend unreachable" (reported by @Helios766).
Checked before pushing: `hermes plugins validate` passes at the pinned commit (12 checks,
including `security scan — safe` and `desktop surface — stays inside the plugin SDK
surface`), the entry parses, the sha is 40 hex, and all four image URLs answer 200 at the
pinned commit. Suite: 70 node tests, 11 ESM render checks, 51 pytest, plus the standalone
move integration run.
The qdrant entry's display.level sentence claimed the verbose log lines
carry 'numbers and identifiers only, never message text', but at the
pinned 0.1.8 (f65e62d) _log_md_search deliberately echoes the search
query ('md_search "%s" -> ...', __init__.py:1853). teknium1 flagged
the mismatch as a review nit on #133557.
Wording only: no pin, version or behaviour change. The catalog sentence
now matches the plugin README's qualified claim ('never recalled message
text or search-result snippets') and discloses the query echo as the
one non-numeric element -- it is the searcher's own input, not recalled
content. scripts/validate_plugin_catalog.py: OK.
homeassistant, spotify and claude-subscription-directsdk now live as
subdirectories of NousResearch/hermes-official-plugins, the single repo for
Nous's official plugins (each old repo's history carried over). Plugin code
is unchanged, so the manifest surface is identical and the re-pin needs no
new consent.
Existing installs follow on their own: the left-core migration installs by
catalog name, and a catalog re-pin clones the entry's current repo/subdir and
rewrites the install record. Adds 1200x600 card images.
Plugins read declared secrets with agent.secret_scope.get_secret and use a
subscription sign-in only through credentialed_provider_request
(requires_auth), so Hermes attaches the token. They never read .env,
Hermes's auth.json, another tool's login or any credential store directly,
and never refresh, rotate or write OAuth tokens. Missing route = ask Hermes
for one. The plugin developer guide's own examples switch from os.environ to
get_secret to match.
