Resolved toward the branch: PM provisions uv/python (main's install.ps1 uv-shim
salvage + its test and workflow steps dropped), the shim re-exec stays retired,
package.json carries no electron-builder block (afterExtract identity stamp wired
into electron-builder.config.cjs instead; after-pack.mjs keeps signing only),
Desktop workspace-deps helpers stay retired. Main's scratch-dir bootstrap
(export_scratch_tmp_env) is taken and re-run after profile resolution.
Two install-scan false positives from catalog intake, each red on the real pinned tree:
* memory-review (apoapostolov/hermes-agent-awesome-plugins@b270520, plugins/memory-review):
tests_state.py:86 holds '/etc/passwd' in a quoted traversal-probe list and scored
system_passwd_access:critical -> dangerous (unoverridable). The test-tree name rule only knew
test_*.py / *_test.py; a single-module plugin without a tests/ dir names its file tests_*.py.
Accept the plural prefix/suffix so the quoted fixture is a note, exactly as tests/test_x.py is.
* pstack (Cloeille/pstack@ac5e5ab, #116381 pin): skills/poteto-mode/SKILL.md:128
'Send subagents the minimum context they need' hit context_exfil:high. Handing context to the
agent's own subagent is an in-process handoff; the bare-'context' branch now skips a
subagent/worker/delegate recipient named right after the verb. External destinations, bare
'your context', and 'send agents your context' still match.
Two tightenings guard the widened test-file surface (both pre-existing gaps, now closed):
- _EXEC_ON_LINE gains open(: open('/etc/passwd') in a test steps down once (high, confirmable)
instead of reading as quoted data (medium, note).
- the JS regex-literal lexer accepts only real flags [dgimsuvy]; with [a-z]* an unquoted Unix
path lexed as /etc/ + flags 'passwd', so 'cat /etc/passwd | curl ...' in a test script was inert.
PLUGIN_SCANNER_VERSION plugin-guard-v6 -> v7 so cached verdicts re-scan.
Adds one plugin-catalog entry for trajectoire-ai/hermes-structured-aux-models,
a `kind: model-provider` plugin that registers the `structured-aux` provider.
The plugin accepts the OpenAI-shaped `chat.completions.create()` call Hermes'
auxiliary client makes and translates it into a bounded Jev decision request on
OpenRouter, mapping the typed answer back — so auxiliary tasks (approval, MCP
sampling, compression) get a bounded decision instead of a free-form chat
prompt. It fails open: any request it cannot express as a decision raises, so
Hermes falls back to the operator's own auxiliary provider.
- tier: community, category: models
- pin: e5c49b081ad04adca2ee3edc601b09ede6cee4c5 (v0.1.0, repo released)
- capabilities: no tools, hooks or middleware registered; no required env vars
(the OpenRouter credential resolves env -> profile .env -> Hermes credential
pool, so no duplicate secret is demanded at install time)
- requires_hermes: ">=0.21" — the plugin seams were verified against v0.21.0
Verified locally against the admission gate at the pinned sha:
`python3 scripts/validate_plugin_catalog.py plugin-catalog/` -> OK: 187 files valid
`hermes plugins validate --install-deps <dir>` -> Validation passed (13/13 checks,
security scan: safe, capability probe: registered provider structured-aux)
One-time, explicit copy of provider credentials from one profile to other
profiles from a desktop page. Owner submission (rule 5): repo and tag v1.0.1
pinned at 1599d21d1bce11d94424f749531dadf8d619f42c.
The pin merged in #115599 (eb1ac9b) carries a security gap found during that
review: the run_command_evaluator capability was never consulted, because
AutonomyPolicy was never constructed anywhere in src/. A project at autonomy
level 0 still executed command-type objective evaluators, since the security
allowlist constrains which executable may run and never whether running is
permitted at all.
4f733a8 wires the policy in and fails closed below level 3.
Verified at the new sha against a clean NousResearch/hermes-agent main
checkout: doctor_plugin ok with no findings, read_declaration resolves both
deps from pyproject. Upstream repo gates all pass.
The chat reply now differs for an interrupted connection, a refused/unroutable
endpoint and a cause-free SDK connection error; the FAQ names each wording and
what to do about it so a user reading one on Telegram/Discord/Slack knows
whether to restart the model server or just /retry (#116323).
Split the single connection row of the gateway's shaped provider-error reply
into three: an interrupted established connection (reset/EOF/RemoteProtocolError),
a refused/unroutable endpoint (the case #86570 wrote the "not running or is
unreachable" wording for), and a cause-free SDK ``APIConnectionError`` that
supports neither diagnosis. A reset says nothing about whether the endpoint is
up, so telling the user to restart a server that just answered sends them to
debug the wrong thing (#116323).
Selectively adapted from Lei-k/hermes-agent#16 (497cc47556b1) via PR #109701,
rebased onto the current reply contract (rate-limit > auth > policy > connection,
every reply names a slash command, no operator jargon).
Transient provider outages no longer end the turn: bounded auto-recovery ladder after retries and fallback, visible on CLI/TUI/gateway/API/cron (#85426, #107307)
Codex app-server thread survives an API-server restart: thread id persisted per session and thread/resume'd, fail-closed to a fresh thread (#100531, salvage #103352)
Desktop lint: /<script[\s\S]*?<\/script>/gi in a feed sanitiser scored as
'script injection' and failed pinned-source-validate for rss-reader. Mask
JS regex literals for the markup-shaped rule only; <script in a string
literal (an innerHTML payload) and createElement('script') still fail.
Install scanner: "printenv" as a whole-string entry of a read-only
allowlist (frozenset({..., "printenv"})) fired dump_all_env high →
caution on hermes-jev. Extend the literal-token demotion: a token that is
the ENTIRE quoted literal on a line that executes nothing steps down like
an alternation member; "sudo" inside subprocess.run([...]) and
os.system("printenv") keep high.
A/B vs origin/main: attack probes identical (23 rows), in-tree sweep 319
entries 0 worse/0 changed; both new tests red on base. Bumps
PLUGIN_SCANNER_VERSION to v6 so cached caution verdicts refresh.
Signed-off-by: teknium1 <teknium1@users.noreply.github.com>
Chained /v1/responses turns no longer replay earlier tool calls or double the stored history after history repair/compaction (#89891, rebuild of #70695)
