Re-pins the entry to the 1.3.1 release: the page follows a websocket push (an out-of-UI write reaches it in ~1s with zero /gantt polls), a board missing on the active gateway falls back instead of answering 503 forever, and the plugin's board paths are asserted against the pinned HERMES_KANBAN_DB trap. Screenshot URLs follow the same pin.
The v1.3.0 tag was moved onto the commit that also retires the demo harness, so
the entry follows it: sha and both screenshot URLs now point at 9d0b776.
Validation unchanged (hermes plugins validate: 14/14 at this commit).
Re-pins the community plugin `kanban-gantt` to its 1.3.0 release:
- sha 0bac644 -> 4c0e226 (tag v1.3.0), the release that added task creation
(the official dialog's field set: project, workspace, skills, model override,
goal mode, parent, triage) and re-parenting by drag & drop or from the
drawer's "Move under…" picker;
- requires_hermes '>=0.19' -> '>=0.21.5': the plugin contributes to the
page-header board-switcher area, which needs 0.21.5;
- version "1.3.0" so the card label matches the pinned code;
- screenshots pinned to the same commit, so the docs page finally has a gallery
(docs/screenshot-en-01.png, docs/screenshot-en-02-details.png).
Verified with `hermes plugins validate` at the pinned commit: all 14 checks
pass, security scan included (the two documentation lines that used to trip
`dangerous` findings in the vendored skill were reworded in this release).
- name hermes-chutes-provider -> chutes-provider (manifest name) + file renamed
- disclosure appended
Wording from the maintainer review of the pinned tree.
2.0.1 stays inactive on a Hermes core that still bundles Home Assistant (no duplicate ha_* tools
or adapter override) and carries the multiplex endpoint-scope tests ported from core.
The Home Assistant gateway platform and ha_* tools as a standalone catalog plugin
(NousResearch/hermes-homeassistant). Core still bundles Home Assistant until #132469 lands; that
PR removes the bundled copy and migrates every profile that used it onto this entry.
Catalog entry PRs may only touch plugin-catalog/** (pinned-source-validate), so the entry moves to a
separate PR that lands first; the migration installs it from the live catalog once both are in.
The Home Assistant gateway platform (plugins/platforms/homeassistant) and the
homeassistant toolset (tools/homeassistant_tool.py) now ship as the official
catalog plugin `homeassistant` (NousResearch/hermes-homeassistant), with the
same platform name, toolset/tool names, config keys and env vars.
Migration (hermes_cli/left_core_migration.py, a generic "left core" table
reusing the memory-provider migration's helpers): every profile home that
used Home Assistant (HASS_TOKEN in its .env, platforms.homeassistant enabled
or holding a token, or the homeassistant toolset selected) gets the plugin
installed from the catalog at its reviewed pin by `hermes update`, and lazily
once per process at agent start / gateway start (honours
security.allow_lazy_installs). Every outcome reaches terminal, Desktop and
chat; a gateway-start outcome is handed to that home's first agent.
Core HA special cases become generic PlatformEntry seams the plugin uses:
trusted_inbound (allowlist bypass for event-bus platforms), display_tier
(built-in display defaults) and shared_env_prefixes (profile-clone ownership
rule for env shared with the plugin's tools). Cron delivery uses the existing
cron_deliver_env_var seam; HASS_TOKEN stays stripped from subprocesses via the
installed plugin's manifest secrets.
Both upstream repositories return 404 (chris-yyau/hermes-herdr-auto-reconcile,
tylerbrevard/hermes-localsend; the owner accounts still exist), so the
pinned SHAs cannot be fetched and an install from the catalog fails.
The description named a register_system_prompt_section call the plugin
never makes; the opt-in rerank sends data off-host, so it gets a
Disclosure line.
README rule 9 (#130795): listed plugins extend Hermes only through public
surfaces. These 11 entries rebind core functions/methods/module tables or
reach into the Desktop app's own markup, and fail the no core override /
app DOM reach admission checks at their pinned shas.
Plain delisting, not removed.yaml: installed copies keep working, and each
plugin is welcome back with a SHA bump once it moves to a public hook. Every
author has an issue on their repo explaining the finding and the public path.
Dropped from the original list because their compliant re-pins were
approved: clinepass (#130439), prompt-enhance (#130900),
custom-dangerous-patterns (#131920), hermes-zh (#131464) and
skill-retrieval (#131290).
#131398 added a risk disclosure quoting the plugin's own /tmp handoff
file to the description, and the no-tmp lint (Python lints) went red on
main and on every PR's merge commit. The line documents third-party
behavior; dropping the path would weaken the disclosure, so it gets the
opt-out marker instead.
The doctor reports one error across several jobs as one scheduler fault,
found in production on 0.21.3 (restart-safe worker without linger).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Doctor hardening after an independent review: corrupt data, a real --job
check, instant-ordered run history; 37 stdlib tests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
