The follow-up review found that the entry pointed at 6f464f72 while the engine
pin inside it still said a9641795, so an install fetched the old engine and lost
both of the fixes that round was meant to deliver. The pin is fixed in the
plugin itself now; this repins the catalog entry to that corrected commit so the
reviewed revision and the installed revision are the same thing again.
Also updated:
- `docs_url` and `image` now resolve at the new commit (both verified reachable).
- The description no longer implies "runs fully local" without qualification: it
notes that an embedding key already present in the environment is
auto-detected, and points at the README's egress section as the authoritative
list. That was the third finding.
Validation: `scripts/validate_plugin_catalog.py plugin-catalog/nexus.yaml` →
`OK: 1 file(s) valid`.
A second review pass over e420433 found five issues, one of them a real leak:
the endpoint matcher used a substring host test, so a lookalike domain could
receive a real provider key. Fixed in 616258b, along with the docstring that
promised a redirect the code never performed, a silent key rejection, an unused
import and a dependency-bound drift across three manifests.
Suite on the new pin: 2171 passed, 3 skipped.
Final revision: the mcp floor is corrected and the paid-station tests opt in
explicitly, so the audit passes on a clean machine. Audit run on this commit:
completed/success.
Carries the corrected mcp floor (>=2.0.0,<3.0.0). The previous pin resolved
mcp 1.x on CI, where `add_request_handler` does not exist, and the audit run
failed at collection. Reproduced and fixed; the CI job now passes in a clean
replica.
Points at 3be00e5, which carries the review fixes: opt-in cloud embedding,
opt-in query rewriting and paid stations, no cwd/.env load, key only paired
with its own endpoint, full egress documentation. The description no longer
claims a blanket 'runs fully local' without naming the opt-in paths.
Nexus Memory is a self-hosted MemoryProvider: Qdrant for storage, a
knowledge graph, and auto-detected embeddings (Voyage, OpenAI, Google,
Jina, Ollama, sentence-transformers). It prefetches before each turn and
writes back after it, and shares one collection with the Nexus MCP server
so Hermes and any MCP-connected agent read and write the same memories.
Fully local operation is supported — no cloud key is required with Ollama
or sentence-transformers.
The pinned tree is a dependency shim: its engine resolves from the same
repository at the pinned commit through tool.uv.sources, so the provider
arrives with its runtime rather than asking an index for a bare name.
Disclosure for review (admission rule 13):
- Network: Qdrant over HTTP (localhost by default), and HTTPS to the
configured embedding provider (Voyage/OpenAI/Google/Jina) or to a local
Ollama instance. No other hosts are contacted.
- Reads outside its own data: it checks ~/.hermes/scripts/*.sh and
~/Library/LaunchAgents/*.plist for a backup entry naming its backups
directory, only to decide whether to mention setting up off-site backup.
- Credentials: only its own config (the embedding provider key). It reads
no other tool's token file.
- Background: daemon threads for write-back, prefetch, backup and entity
extraction. No shell commands, no self-update (opt-in and off here).
This reverts commit 945ffcd257.
Hermes does not maintain a tirith plugin. If upstream ships one, it goes through
the normal catalog admission under their name.
Pins NousResearch/hermes-plugin-tirith@77405987: a pre_tool_call hook that runs
`tirith check --offline` on terminal commands and escalates findings to the normal
approval gate. Uses a tirith binary the user installs; nothing is downloaded.
Validated at the pin with `hermes plugins validate --install-deps` (scan: safe).
Supersedes the v0.6.3 bump on this branch. Pin evalroute>=0.9.2,<0.10: the library's 0.9.2
records the agent harness as part of the arm and adds a verified claude-code runner for
`hermes evalroute dispatch --runner claude-code` (spawns `claude -p` under the user's own
Claude account; the disclosure gains that sentence). Plugin code unchanged.
Pin evalroute>=0.9.1,<0.10. The library's 0.9.1 ships flywheel schema 2 — lane-correction
rows leave as lane pairs (from_lane, to_lane, method, week), never task text — and records
max_turns as part of the arm, so the contribute disclosure gains one sentence. Plugin code
unchanged from 0.6.2 (#132926).
