Skip to content

v0.1.1

Latest
Latest

Choose a tag to compare

View all tags
@mojomast mojomast released this 12 Nov 13:55
· 179 commits to main since this release
v0.1.1
f251c06
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

bundlebees v0.1.1

Fixes from the Hermes catalog review of 0.1.0 (NousResearch/hermes-agent#153888). Tested against real Hermes 0.23.0.

Fixed

  • The launcher token is read with agent.secret_scope.get_secret("BUNDLEBEES_LAUNCHER_TOKEN") directly. 0.1.0 expected an agent on the plugin context or handler kwargs, which Hermes never passes, so the token was never found.
  • Settings are read per key with ctx.get_config(key) (tools and CLI) and with hermes_cli.config.load_config_readonly() in the dashboard API. 0.1.0 read a ctx.config attribute that does not exist.
  • desktop/plugin.js now default-exports { id: "bundlebees", name, register(ctx) } and contributes the pane with ctx.register({ id, area: "panes", render }), as the Desktop runtime loader requires. React comes from import * as React from "react" (the SDK does not export React).
  • dashboard/manifest.json declares "api": "plugin_api.py", so Hermes mounts the routes at /api/plugins/bundlebees/. The backend is built lazily per request from the current settings; nothing has to call configure_backend.
  • hermes bundlebees doctor printed token: [redacted] configured because its own scrubber masked the word after token:. The fixed status line now reads token: configured or token: not configured.
  • CLI and dashboard state live in plugins.plugin_storage.plugin_data_dir("bundlebees"). The XDG fallback is gone; with no Hermes host the CLI asks for --state-dir.

Security

  • Cross-origin launcher redirects (any change of scheme, host, or port) are refused with unsafe_redirect before a request is sent, and Authorization is stripped from any non-origin URL as defence in depth.
  • bundlebees_attempt with op cancel or review now goes through a pre_tool_call approval (provides_hooks: [pre_tool_call]), not only the model-set confirm=true argument.
  • child_env() keeps the user's HOME, PATH, USER, LOGNAME, LANG, TZ, and TMPDIR (exact names) so a user-run git push finds its config and credential helper. Nothing else is inherited.

Tool schemas are unchanged: 4 tools, 571 o200k tokens.

Install pinned to this release: hermes plugins install mojomast/bundlebees --ref f251c069d8360607dee10301b6cdad7fae90d24b

Assets 2
Loading