llmAntidote v3.2.4

Addresses the Hermes plugin-catalog review blocker at 2070999.

• Fix a denial-of-service in the environment_secret detection regex
  (llm_antidote/policy.py): the unbounded (?:\S*/)?env\b alternative
  backtracked quadratically on long single-line tool arguments (a ~100 KB run of
  ; took seconds per assess() while holding the GIL, stalling the whole
  agent). Replaced with a bounded path form,
  (?:^|[\s;&|])(?:[^\s;&|/]{0,256}/){0,16}env\b, which still detects env,
  /usr/bin/env, and friends but in linear time.
• Add tests/test_policy_performance.py, timing the full sensitive-pattern set
  plus _UPLOAD_SINK/_DOWNLOAD_EXECUTE (and _NETWORK_SINK/_REVERSE_SHELL)
  on ";"*150_000 and "x=1;"*40_000, plus an end-to-end double assess(),
  asserting a sub-second budget.

Before: ~4.4 s at 50 KB for the env pattern alone. After: ~34 ms at 150 KB.

llmAntidote v3.2.3

Catalog-readiness pass for submission to the Hermes plugin catalog. No behavior change to the runtime policy.

Changes

• Dependency policy: cryptography>=42 → cryptography>=42,<51 in pyproject.toml and requirements.txt (bounded ceiling; still co-installs with Hermes' pinned 50.0.1).
• Credentials: the evaluation CLI now resolves its API key through Hermes' secret scope (agent.secret_scope.get_secret) when running inside Hermes, falls back to the named environment variable only in the standalone entry point, and fails closed if a scoped read raises.
• Disclosure: README gains a Disclosure section (network, reads outside own data, generated private keys, SQLite storage; no shell/subprocess/telemetry) and documents the three caution security-scan findings as detection regexes, not behavior.
• docs/CATALOG_SUBMISSION.md: ready plugin-catalog/llm-antidote.yaml entry, validation commands, and rule-13 PR disclosure text.
• mypy override for the optional agent.* import.

Verification

• hermes plugins doctor . --ci — pass.
• hermes plugins validate . --install-deps — pass in a clean environment (caution only).
• pytest: 192 passed; coverage 81.8% (branch).
• ruff check . and mypy: clean; pip-audit -r requirements.txt: no known vulnerabilities.
• CI matrix (3.11/3.12/3.13), manifest validation, and the real-Hermes e2e job (standalone + enforced) all green.

Compatibility

• Drop-in upgrade from 3.2.2. Python 3.11+; Hermes Agent 0.21.x.

Full details in CHANGELOG.md.

llmAntidote v3.2.2

Fixes a taint-bypass egress channel found in review.

Bug

text_to_speech was classified as a local write (outbound=False), and its required text argument is a "content key". Two compounding mis-scopings:

1. A tainted session did not block speaking a secret, while web_search/browser_exec were blocked.
2. The payload was exempted from scanning and the oversized-arguments gate as a content key.

Hermes sends TTS text to a provider; the built-in providers (edge, elevenlabs, openai, minimax, xai, mistral, gemini) are remote. Only a user-configured type: command provider is local.

Fix

• Reclassified text_to_speech as an outbound-network capability, so it is scanned in full, size-gated, and blocked by session taint like other outbound tools. Bumped the capability classifier version to 3.
• Limited the content-key exemption to the file-write tools (write_file/patch/apply_patch) instead of every local-write capability, so other local-write payloads are no longer silently unscanned and uncapped.

Verification

• pytest: 188 passed; coverage 81.8% (branch).
• ruff check . and mypy: clean.
• pip-audit -r requirements.txt: no known vulnerabilities.
• CI matrix (3.11/3.12/3.13), manifest validation, and the real-Hermes e2e job (standalone + enforced, including a tainted-TTS case) all green.

Compatibility

• Drop-in upgrade from 3.2.1. Python 3.11+; Hermes Agent 0.21.x.
• Note: TTS is now conservatively treated as egress even with a local command provider.

Full details in CHANGELOG.md.

llmAntidote v3.2.1

Follow-up corrections to the v3.2.0 hardening pass, from a fresh review. Validated against a running Hermes 0.21.6 install.

Fixes

• Pending call-id collision (fail-open): pending reservations are now tracked per session (SessionRisk.pending_ids) instead of in one global call_id map. Two sessions that reuse a tool_call_id (per-session counters, resumed sessions) each keep their own reservation and can no longer drop or cross-release the other's.
• Large-write block (regression): the oversized-arguments gate now applies to the scanned (content-excluded) text for write tools. write_file/patch carrying more than max_scan_bytes of content is allowed again, while oversized terminal/execute_code still blocks.
• Route-config footgun: enforced mode with required model binding and an empty admission_model_name now refuses admission with admission.model_route_unconfigured rather than skipping the route check. /antidote status prints the route reason and registration logs the enforcement configuration (warning when unconfigured); the plugin still registers so the host is never left silently unguarded.
• Docs: name the single-call terminal/execute_code read+exfil residual and the enforced-mode pre_api_request dependency; align the documented coverage floor with CI (80% branch).

Verification

• pytest: 185 passed; coverage 81.7% (branch).
• ruff check . and mypy: clean.
• pip-audit -r requirements.txt: no known vulnerabilities.
• CI matrix (3.11/3.12/3.13), manifest validation, and the real-Hermes e2e job (standalone + enforced) all green.

Compatibility

• Drop-in upgrade from 3.2.0. Python 3.11+; Hermes Agent 0.21.x.

Full details in CHANGELOG.md.

llmAntidote v3.2.0

A hardening release driven by the live-review findings against v3.1.0 (docs/IMPROVEMENT_LIST.md). Validated end-to-end against a running Hermes v0.21.6 install.

Highlights

• Fail closed on the enforced model route: an unobserved or empty model string is no longer treated as admitted. New admission.model_route_unobserved vs admission.model_route_mismatch, plus admission_require_route_observation (default true).
• Oversized arguments are refused (input.arguments_exceed_scan_limit); the whole bounded text is scanned so a pattern hidden mid-payload is caught. Cap configurable via max_scan_bytes.
• Content vs intent: write_file/patch content is no longer scanned for egress patterns; writes into sensitive roots carry access.sensitive_root_write.
• Capability-scoped taint (taint_scope: egress | egress_persist_shell (default) | all), so a secret read no longer blocks harmless local reads/writes.
• Real Hermes tool surface: new persist capability (memory/skills/scheduled jobs), vision/browser-vault egress, a maintained inventory fixture, and capabilities.py as the single name/family source shared with audit.
• Exact correlation: pending/taint keyed by Hermes' tool_call_id; session/task ids are no longer merged; id-less sessions use a per-instance sentinel; pending_ttl_minutes bounds orphaned reservations.
• Ledger trust root: fleet ledger trust|allow-signer|revoke-signer|rotate-signer with legacy pin auto-migration.
• Trusted plain-HTTP evaluation endpoints can pin host:port.

Testing & tooling

• Real-Hermes end-to-end hook harness for standalone and enforced modes, wired into CI.
• Hypothesis property tests; oversized/unknown-key/trusted-host regression tests.
• mypy, coverage floor (80% branch), pip-audit, and ruff S in CI; Python 3.13 added.

Verification

• pytest: 179 passed; coverage 82% (branch).
• ruff check . and mypy: clean.
• pip-audit -r requirements.txt: no known vulnerabilities.
• CI matrix (3.11/3.12/3.13), manifest validation, and the Hermes e2e job all green.

Compatibility

• Python 3.11+; Hermes Agent 0.21.x.
• Existing deployments upgrade in place; the legacy ledger signer pin migrates automatically.

Full details in CHANGELOG.md.

llmAntidote v3.1.0

Hardens the runtime policy path and adds enforced fleet admission, validated against a real Hermes v0.21.6 install.

Highlights

• Capability classification (llm_antidote/capabilities.py): a versioned classifier reasons about what a tool can do, not only its argument text. Outbound connector/message tools and unknown plugin tools are treated as egress-capable.
• Safe/sensitive roots: reads outside operator-configured safe_read_roots require approval even for unrecognized filenames; sensitive_roots always do.
• Pending taint reservation: sensitive reads reserve access atomically before execution and outbound calls check pending-in-flight or completed taint, closing the concurrent-read decision window.
• Enforced fleet admission: a signed fleet policy and verified deployed-model binding are required at plugin startup; signed runtime.mode/taint_ttl_minutes are authoritative and conflicting local overrides are refused. Tool calls are blocked when the served model route stops matching the admitted model.
• fleet runtime-verify: an external supervisor gate for environments where a failed plugin register leaves the host running unguarded.
• Spark endpoints: explicit --trusted-host plaintext HTTP opt-in (loopback default retained, redirects refused).

Packaging fixes

• Moved development tooling to requirements-dev.txt; the previous [dev] extra was folded into Hermes' --all-extras install and conflicted with its pinned pytest.
• Relaxed the cryptography pin so the plugin co-installs with the version Hermes ships (previously excluded 50.0.1).

Compatibility

• Python 3.11+; Hermes Agent 0.21.x.
• New settings: safe_read_roots, sensitive_roots, and the admission_* family (see docs/FLEET_ADMISSION.md).

Validation

• hermes plugins validate / doctor --ci: pass (6 hooks).
• Runtime hook E2E via real Hermes dispatch and enforced-mode admission (signed strict, route-swap block, tamper fail-closed, external gate exit 1).
• pytest: 143 passed; ruff check . clean.

Full details in CHANGELOG.md.

llmAntidote v3.0.0

Signed fleet admission release for Hermes Agent. Adds role-separated Ed25519 policy, attestation, and receipt signatures; strict canonical JSON; out-of-band trusted policy digests; evidence-bound model promotion gates; signed PASS/DENY receipts; a signer-pinned metadata-only SQLite fleet ledger; standalone CI/CD commands; and protected GitHub admission workflow guidance. Includes updated README instructions for policy digest capture, model-lock-bound behavioral evaluation, admission, and receipt ingestion.

llmAntidote v0.2.0

Behavioral evaluation release for Hermes Agent. Adds paired control/candidate trials against explicit OpenAI-compatible endpoints, non-executing synthetic tools, salted tool-trajectory comparisons, per-candidate coverage and error gates, trigger minimization, and bounded JSON/Markdown reports with four coverage-scoped verdicts. Runtime guardrails now also require approval for standalone network-capable shell and code operations.

llmAntidote v0.1.0

Initial working MVP for Hermes Agent. Adds deterministic tool-call guardrails, session-scoped taint tracking, metadata-only audit events, local and Hugging Face model provenance inspection, and SHA-256 model lockfile verification.