db8dcbe94c
Annotated-tag pins (F8): a catalog `sha` recorded as `git rev-parse <tag>` names
the TAG object, while HEAD can only ever be the commit it points at. The scan
trust check compared HEAD against the unpeeled sha (so every tag-pinned entry
lost the reviewed-pin bypass and prompted on caution findings) and the sidecar
recorded the peeled commit, so `update_available` was true forever and every
`update` re-installed. The installer now peels the pin (`<sha>^{commit}`) for
trust, records `pin` on the catalog block only when the checkout satisfies it
(empty for an off-pin `--ref` install), and every at-pin check goes through
`at_catalog_pin(sidecar, entry_sha)` (repin, dashboard payload, TUI rows).
Re-pin consent (F10): `hermes plugins update` on a catalog install replaced the
tree without asking, even when the new pin declared new tools, hooks, Python
dependencies, host capabilities or a Desktop half. `repin_catalog_plugin` now
diffs the installed manifest against the staged clone BEFORE anything moves
(`_install_plugin_core(before_swap=...)`) and, on a widening:
- CLI: prints the delta and asks y/N (non-interactive → not applied, fail
closed); after a changed re-pin it runs the same `_run_capability_consent`
grant path as the git-pull `update`.
- `plugins.manage update` RPC and the dashboard REST route answer
`{ok: false, consent_required: true, delta, delta_lines}` with nothing
changed; a retry with `accept_capabilities: true` applies it. Desktop shows
the delta in its confirm dialog; the web dashboard uses `window.confirm`.
- Gateway contract regenerated (`accept_capabilities` param; `consent_required`,
`delta`, `delta_lines`, `error` result fields).
Catalog audit findings F8 and F10 (low severity, no issue filed).
Website
This website is built using Docusaurus, a modern static website generator.
Reading the docs on GitHub? The Markdown under
docs/is authored for the rendered site at https://hermes-agent.nousresearch.com/docs/. Cross-page links are relative Markdown paths, so they follow through on GitHub's file viewer too. Every page on the site has an Edit this page link that opens the source file here.
Authoring links in docs/
- Link to another page with a relative Markdown path, anchors included:
[Profiles](../user-guide/profiles.md),[Bundles](../user-guide/features/skills.md#skill-bundles). Docusaurus turns the file path into the page route; GitHub follows the same path. Site routes (/user-guide/profiles,/docs/user-guide/profiles) only work on the rendered site — GitHub resolves them as repository paths and 404s, and the/docs/form also emits/docs/zh-Hans/docs/...404s in the zh-Hans build becausebaseUrlis already/docs/. python3 website/scripts/check_doc_links.pyfails on any route-style link in hand-authored pages (EN and the zh-Hans mirror);--fixrewrites them. It runs in theDocs Site Checksworkflow. Generated pages (user-guide/skills/{bundled,optional},reference/*skills-catalog.md) are produced byscripts/generate-skill-docs.py, which emits the same relative form.- Pin
{#anchor}on cross-linked headings so the zh-Hans mirror keeps the same id.
Installation
yarn
Local Development
yarn start
This command starts a local development server and opens up a browser window. Most changes are reflected live without having to restart the server.
Build
yarn build
This command generates static content into the build directory and can be served using any static contents hosting service.
Deployment
Using SSH:
USE_SSH=true yarn deploy
Not using SSH:
GIT_USER=<Your GitHub username> yarn deploy
If you are using GitHub pages for hosting, this command is a convenient way to build the website and push to the gh-pages branch.
Diagram Linting
CI runs ascii-guard to lint docs for ASCII box diagrams. Use Mermaid (````mermaid`) or plain lists/tables instead of ASCII boxes to avoid CI failures.