Skip to content

Hermes for T3 Code v0.1.1

Choose a tag to compare

View all tags
@m-check1B m-check1B released this 08 Aug 05:03
· 118 commits to main since this release
v0.1.1
3d40fff
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Hermes for T3 Code v0.1.1

This patch release turns the first public bridge into a safer unattended local
watcher while preserving the original three bidirectional flows.

Security boundary

  • Mention routing now fails closed until the operator explicitly authorizes
    source projects and provider instances, or deliberately selects
    --allow-all-projects for a fully local deployment.
  • Thread history is transferred as bounded, role-labelled untrusted context.
  • Watcher state is versioned, ownership-marked, size-bounded, and validated
    before use; corrupt or foreign state is never reset into a replay risk.
  • HTTP/RPC failures are redacted, and the LaunchAgent, runtime manifest, status,
    and service configuration exclude bearer values, tickets, prompts, and routed
    content.

Reliability and operations

  • Retry/backoff and dead letters prevent one failing source from starving later
    healthy mentions.
  • Origination accepts an idempotency key and reconciles ambiguous accepted
    responses without duplicate projects, threads, or turns.
  • Existing v0.1.0 state is migrated atomically before dispatch while preserving
    links, cursors, and replay guards. A legacy file with unresolved pending
    deliveries fails closed for operator audit.
  • The routing lock uses a unique owner identity and crash-safe recovery barrier.
  • macOS LaunchAgents are namespaced by profile and bridge instance. Installation
    snapshots an immutable runtime, lints and verifies activation, and restores
    the prior owned service when bootstrap fails.
  • service-status reports bounded private watcher health without reading or
    printing the token.

Verification

The release test suite covers routing policy,
untrusted-context bounds, replay prevention, lock recovery, retry isolation,
idempotent origination, state validation, error redaction, provider ownership,
loopback transport, token files, response limits, and namespaced service
lifecycle behavior.

Compatibility remains intentionally narrow: T3 Code 0.0.31, Hermes Agent
0.20.0, Node.js 22, and macOS. This is an independent community project and is
not affiliated with either upstream project.

Assets 6
Loading