`opaque-composer`, `iteration-budget-meter`, and `reasoning-switch` still installed from this repository's old `plugins/<id>` layout, which was replaced by the personal/public split. Their pinned commits still resolve, so they install today, but the entries point at a tree that is no longer maintained and cannot receive catalog fixes.
All three now point at `public/<id>` on a current commit, with `docs_url` and the hero image following the same move so nothing 404s.
Also carried forward:
- `provider-status` 1.5.11 to 1.5.12. GLM quota parsing was silently broken: z.ai renamed the limit `type` to `CREDIT_LIMIT`, so no window matched and the chip painted a full quota while the account sat at 82% of its weekly allowance. The public edition also shows both GLM windows in the bar now.
- `intelligent-tool-break` 1.3.3 to 1.3.4, which moves the public edition's settings onto the `ctx.storage` hook so it stays inside the plugin SDK.
- `prompt-enhance` repinned to the same commit. No code change there; it was already on the composer draft API.
Rebased onto current `main` rather than stacked on the old base, which had drifted thousands of commits. The screenshots added earlier in this PR are unchanged.
Verified before pushing: every entry's pinned commit, plugin directory, and hero image resolve; each screenshot URL still returns an image at its own pinned commit; and no file outside `plugin-catalog/` is touched.
Re-pin the catalog entry at 1399a77, the commit carrying the fixes for
teknium1's CHANGES_REQUESTED review on
https://github.com/NousResearch/hermes-agent/pull/129857:
- the locked-DB fallback now makes its scratch copy with mkstemp under
HERMES_HOME instead of copying to a predictable name in /tmp via
shutil.copy2, which followed symlinks and left a copy containing
install_id world-traversable
- HERMES_HOME resolves per request rather than at import
- 19 regression tests, 6 of which fail against the previous shape
category moves from desktop to general: the plugin ships dashboard/ only
and has no desktop/ bundle, so the desktop shelf was wrong.
Screenshots re-pinned to the same sha and verified reachable (HTTP 200).
Catalog validator: OK.
Re-pins the entry to the release commit that carries the review fixes
(briancaffey/hermes-otel#255: OTEL_* opt-in for vendor env-var mode,
package imports for the dashboard backends) and the non-blocking notes
(owner-only live store, measured OpenTelemetry floor >=1.35). The file is
the hermes-otel.yaml asset attached to release hermes-otel-v1.18.2,
rendered from plugin.yaml at that commit.
- fix the single-quoted description (unescaped apostrophe in "plugin's" broke YAML parsing)
- append the reviewed Disclosure line
Salvage of #127990 (org fork, maintainer edits not allowed).
Also documents the plugin's one switch (KANBAN_GANTT_WS) in the description, since the catalogue's capabilities block has no field for an optional variable.
Re-pins the entry to the 1.3.1 release: the page follows a websocket push (an out-of-UI write reaches it in ~1s with zero /gantt polls), a board missing on the active gateway falls back instead of answering 503 forever, and the plugin's board paths are asserted against the pinned HERMES_KANBAN_DB trap. Screenshot URLs follow the same pin.
The v1.3.0 tag was moved onto the commit that also retires the demo harness, so
the entry follows it: sha and both screenshot URLs now point at 9d0b776.
Validation unchanged (hermes plugins validate: 14/14 at this commit).
Re-pins the community plugin `kanban-gantt` to its 1.3.0 release:
- sha 0bac644 -> 4c0e226 (tag v1.3.0), the release that added task creation
(the official dialog's field set: project, workspace, skills, model override,
goal mode, parent, triage) and re-parenting by drag & drop or from the
drawer's "Move under…" picker;
- requires_hermes '>=0.19' -> '>=0.21.5': the plugin contributes to the
page-header board-switcher area, which needs 0.21.5;
- version "1.3.0" so the card label matches the pinned code;
- screenshots pinned to the same commit, so the docs page finally has a gallery
(docs/screenshot-en-01.png, docs/screenshot-en-02-details.png).
Verified with `hermes plugins validate` at the pinned commit: all 14 checks
pass, security scan included (the two documentation lines that used to trip
`dangerous` findings in the vendored skill were reworded in this release).
- name hermes-chutes-provider -> chutes-provider (manifest name) + file renamed
- disclosure appended
Wording from the maintainer review of the pinned tree.
fold2 finding 1 (2c, Medium): the connect-time missing-pin warning was gated on
`not is_reconnect`. An account whose FIRST startup connect fails (transient
IMAP/SMTP error) is brought up by the reconnect watcher with is_reconnect=True,
so it never warned while silently dropping every sender's mail.
Dedupe per address instead: a class-level _missing_pin_warned set (the watcher
builds a fresh adapter per retry, like _seen_uids_snapshot), checked after both
IMAP and SMTP probes succeed. The existing connect test now covers a failed
first connect followed by a reconnect (one warning), a second reconnect (none),
two accounts (one each) and pinned/opted-out accounts (silent).
fold2 finding 4 (quality, Low): _verify_sender_authentication defaulted
authserv_id to "" (a silent fail-closed for any caller that forgot it) and
re-stripped/lowercased a value EmailAdapter.__init__ already normalises. Make it
a required keyword, test it with `if not authserv_id:`, and compare directly.
All callers (the adapter and the test helper) already pass normalised ids by
keyword, so no call site changes.
fold2 finding 2 (reuse+quality, Low): the per-message no-header drop hint and
the connect-time missing-authserv_id hint each spelled out the same
require_authenticated_sender / EMAIL_TRUST_FROM_HEADER opt-out sentence. Build
both from one _OPT_OUT_HINT so they cannot drift. Rendered text is byte-for-byte
unchanged (printed before/after).
fold2 finding 3 (quality, Low): the __init__ comment still said an absent pin
fails closed only "when an allowlist grants access". With sender auth on, an
unset authserv_id rejects every sender's Authentication-Results, and connect()
names the fix once per account. Comment only.
The _verify helper derived the expected pin from prod's own
_ar_clauses(...)[0], so every row was pinned to whatever its topmost
header claimed and an authserv-id parsing regression could not go red
(r1 2c Low). Default the helper to the literal "mx.ourserver.com" and
stamp that id on the rows; the forged/exact-pin rows keep their own ids
and are still refused, and the unpinned row still fails closed.
The missing-pin warning lived in the per-message drop path behind a
process-wide class bool. That hid it twice over (r1 2ab/2c Medium):
- a second unpinned mailbox in the same process (multiplex) never
warned once the first had tripped the flag;
- pairing/decline-only deployments never warned at all, because a
first-contact sender is not granted and its drop logs at debug.
A missing pin is account config, not something one sender did, so
connect() now names the fix once per account after the IMAP/SMTP
probes succeed, skipping reconnect-watcher retries (is_reconnect).
Pinned or opted-out accounts stay quiet. The per-message drop path is
back to main's rule: a listed sender's drop warns (with the reason, no
hint), an unlisted one logs at debug, so it is never noisier than main.
The guide still told users to "leave authserv_id unset" when their
server's host varies, which now drops every message that needs an
authenticated From:. State that the pin is required, how to find it
(the token before the first ';' of the topmost Authentication-Results
header your server writes), what to do when it seems to vary (RFC 8601
authserv-id names the administrative domain, so configure a stable one
and pin it), and that the only alternative is the explicit
require_authenticated_sender: false / EMAIL_TRUST_FROM_HEADER=true
opt-out. Mirror the reference tables, plugin.yaml prompt and zh-Hans
translation.
Co-authored-by: JiuYue0820 <287222957+FirmaSpring@users.noreply.github.com>
The salvaged #88560 change makes an unpinned deployment refuse every
Authentication-Results header, so each message from an allowlisted
sender is dropped. Logged per message, that warning would flood the gateway log.
The salvage gave the reason its own constant and drop hint (set
EMAIL_AUTHSERV_ID / platforms.email.authserv_id, or opt out with
require_authenticated_sender: false / EMAIL_TRUST_FROM_HEADER=true);
this logs it once per process, and later drops stay at debug.
Tests: the verifier helper now pins the topmost header's own id by
default (a correctly configured receiver), the topmost/exact-pin test
gains the unpinned forged-header row, and the dispatch warning test
checks the once-per-process warning and its text.
Co-authored-by: JiuYue0820 <287222957+FirmaSpring@users.noreply.github.com>
Trust only the topmost Authentication-Results field from the explicitly configured receiving MTA. Fail closed for allowlisted senders when no exact pin is configured, preventing injected or lower matching headers from authorizing a sender.
(cherry picked from commit e013fda3facc005e8f4d5f81e20c2d21aee698df)
Fold2 PROFX finding 2 (quality): `_DOT_DIRS` hand-copied six of the eight
HOME_CREDENTIAL_DIRS entries. Build it from the shared constant so a dir
added there is seeded as a directory store without editing the test.
`.config/gh` and `.config/gcloud` were already seeded as directories by the
dotless-name rule, so the seeded tree is unchanged.
Fold2 PROFX finding 1 (reuse/quality): `_SENSITIVE_HOME_DIRS` had become a
bare alias of agent.file_safety.HOME_CREDENTIAL_DIRS with one reader. Drop
the alias and use the shared constant at that reader so there is one name
for the list. No other references exist in the repo (tests/ and plugins/
included).
Gate r1 (2c note): agent/context_references._SENSITIVE_HOME_DIRS was a hand
copy of the home credential dirs and missed .config/gcloud, so
`@file:~/.config/gcloud/application_default_credentials.json` expanded the
gcloud refresh token into context; the canonical read deny-list does not
cover it either. The gateway feeds untrusted remote text through this
expansion, so this is the same leak class the profile-export fix closes.
_SENSITIVE_HOME_DIRS now is agent.file_safety.HOME_CREDENTIAL_DIRS, the
single list the write denylist and profile export already derive from.
file_safety imports stdlib only, so there is no import cycle.
The existing canonical-denylist test gains a .config/gcloud ADC row.
Co-authored-by: Keiran Haax <196126709+keiranhaax@users.noreply.github.com>
#132201 stopped profile export shipping .ssh/.aws/.gnupg/.kube/.envrc, but
the other credential dirs the file tools already write-deny still shipped:
a skill dir copied from a home carries .docker/config.json (registry auth),
.azure/accessTokens.json, .config/gh/hosts.yml (GitHub token) and
.config/gcloud/ (ADC / credentials.db), and the default-profile export plus
named exports archived them verbatim (binary DBs skip the redact pass).
The home-relative credential dirs now live once in
agent.file_safety.HOME_CREDENTIAL_DIRS; build_write_denied_prefixes and the
profile export (_OS_CREDENTIAL_STORES) both derive from it, so the write
denylist and the export filter cannot drift. Nested stores (.config/gh) are
matched on trailing path components, so only .config/gh and .config/gcloud
are dropped and the rest of .config still ships. .config/gcloud is included
for parity with file_safety. Distribution installs treat the same paths as
installer-owned via PROFILE_CREDENTIAL_PATHS.
Co-authored-by: Keiran Haax <196126709+keiranhaax@users.noreply.github.com>
