* fix(deps): address critical and high severity security vulnerabilities Bump vulnerable dependencies to patched versions across the monorepo: Python (critical/high): - fastmcp >=2.14.0 → >=3.2.0 (SSRF, path traversal, OAuth confused deputy, command injection) - langchain-core >=1.2.11 → >=1.2.22 (path traversal in legacy load_prompt) Python (low): - cryptography >=46.0.5 → >=46.0.6 (incomplete DNS name constraint enforcement) - pygments: add >=2.20.0 pin (ReDoS via GUID regex) Node.js: - serialize-javascript ^7.0.3 → ^7.0.5 (CPU exhaustion DoS) - handlebars: add >=4.7.9 override (JS injection via AST type confusion) - path-to-regexp: add >=0.1.13 override (ReDoS via route params) - brace-expansion: add version range override (process hang/memory exhaustion) Also adds type: ignore comments for FastMCP 2.x private attribute access that ty now flags since FastMCP 3.x removed _tool_manager (guarded by try/except and hasattr at runtime). Regenerated all lock files across API, integrations, and tests. * fix(deps): add ajv v8 scoped overrides for schema-utils and ajv-keywords The global ajv ^6.14.0 override caused schema-utils and ajv-keywords to receive ajv v6, but they require ajv v8 (for dist/compile/codegen). Add scoped overrides to ensure these packages get ajv v8 while the global override remains for packages that need v6. * fix(tests): remove stateless_http from FastMCP() constructor calls FastMCP 3.x no longer accepts stateless_http in the constructor. The tests call tools directly without HTTP transport, so the parameter is not needed. * fix: update MCP tests for FastMCP 3.x _tool_manager removal FastMCP 3.x removed _tool_manager. Tests now use _local_provider._components for sync tool dict access and mcp.list_tools() for async filtered tool listing. * fix: resolve docusaurus build failures (ajv overrides + missing blog date) - Remove global ajv ^6.14.0 override and scoped ajv-keywords/schema-utils overrides that caused webpack compilation errors manifesting as "Cannot read properties of undefined (reading 'date')" during SSR and "these parameters are deprecated" warnings. Natural version resolution (v6.12.6+ for v6 consumers, v8+ for v8 consumers) already satisfies the security fix (>= 6.12.3). - Add missing date frontmatter to learning-capabilities blog post. * chore: regenerate openapi spec and docs skill |
||
|---|---|---|
| .. | ||
| hindsight_hermes | ||
| tests | ||
| pyproject.toml | ||
| README.md | ||
| uv.lock | ||
hindsight-hermes
Persistent long-term memory for Hermes Agent using Hindsight. Automatically recalls relevant context before every LLM call and retains conversations for future sessions.
Quick Start
# 1. Install into Hermes's Python environment
uv pip install hindsight-hermes --python $HOME/.hermes/hermes-agent/venv/bin/python
# 2. Configure
mkdir -p ~/.hindsight
cat > ~/.hindsight/hermes.json << 'EOF'
{
"hindsightApiUrl": "http://localhost:9077",
"bankId": "hermes"
}
EOF
# 3. Start Hermes — the plugin activates automatically
hermes
What it does
Automatic memory on every turn (via Hermes lifecycle hooks):
pre_llm_call— Recalls relevant memories and injects them into the system prompt. The model sees cross-session context automatically, no tool call needed.post_llm_call— Retains the user/assistant exchange so it can be recalled in future sessions.
Three explicit tools (via Hermes plugin system):
hindsight_retain— Store information to long-term memoryhindsight_recall— Search long-term memory for relevant informationhindsight_reflect— Synthesize a reasoned answer from stored memories
The lifecycle hooks require hermes-agent with PR #2823 or later. On older versions, only the tools are registered — hooks are silently skipped.
Configuration
All settings live in ~/.hindsight/hermes.json. Environment variables override file values.
Same field names as the openclaw and claude-code integrations.
Example config
{
"hindsightApiUrl": "http://localhost:9077",
"bankId": "hermes",
"autoRecall": true,
"autoRetain": true,
"recallBudget": "mid",
"recallMaxTokens": 4096,
"bankMission": "Focus on user preferences, project context, and technical decisions."
}
Connection
| Setting | Env Var | Default | Description |
|---|---|---|---|
hindsightApiUrl |
HINDSIGHT_API_URL |
— | Hindsight API URL |
hindsightApiToken |
HINDSIGHT_API_TOKEN / HINDSIGHT_API_KEY |
— | Auth token |
apiPort |
HINDSIGHT_API_PORT |
9077 |
Local daemon port |
daemonIdleTimeout |
HINDSIGHT_DAEMON_IDLE_TIMEOUT |
0 |
Idle shutdown (seconds, 0 = never) |
embedVersion |
HINDSIGHT_EMBED_VERSION |
"latest" |
hindsight-embed version |
Memory Bank
| Setting | Env Var | Default | Description |
|---|---|---|---|
bankId |
HINDSIGHT_BANK_ID |
— | Memory bank ID |
bankMission |
HINDSIGHT_BANK_MISSION |
"" |
Agent purpose for the bank |
retainMission |
— | — | Custom extraction prompt |
bankIdPrefix |
— | "" |
Prefix for bank IDs |
Auto-Recall
| Setting | Env Var | Default | Description |
|---|---|---|---|
autoRecall |
HINDSIGHT_AUTO_RECALL |
true |
Enable pre_llm_call recall |
recallBudget |
HINDSIGHT_RECALL_BUDGET |
"mid" |
Effort: low/mid/high |
recallMaxTokens |
HINDSIGHT_RECALL_MAX_TOKENS |
4096 |
Max tokens in response |
recallMaxQueryChars |
HINDSIGHT_RECALL_MAX_QUERY_CHARS |
800 |
Max query chars |
recallPromptPreamble |
— | see below | Header before recalled memories |
Auto-Retain
| Setting | Env Var | Default | Description |
|---|---|---|---|
autoRetain |
HINDSIGHT_AUTO_RETAIN |
true |
Enable post_llm_call retain |
retainEveryNTurns |
— | 1 |
Retain every Nth turn |
retainOverlapTurns |
— | 2 |
Overlap turns for continuity |
retainRoles |
— | ["user", "assistant"] |
Roles to retain |
LLM (daemon mode)
| Setting | Env Var | Default | Description |
|---|---|---|---|
llmProvider |
HINDSIGHT_LLM_PROVIDER |
auto-detect | openai/anthropic/gemini/groq/ollama |
llmModel |
HINDSIGHT_LLM_MODEL |
provider default | Model override |
Misc
| Setting | Env Var | Default | Description |
|---|---|---|---|
debug |
HINDSIGHT_DEBUG |
false |
Debug logging |
Disabling Hermes's built-in memory
Hermes has a built-in memory tool that saves to local files. Disable it so the LLM uses Hindsight instead:
hermes tools disable memory
Troubleshooting
Plugin not loading — verify the entry point:
python -c "
import importlib.metadata
eps = importlib.metadata.entry_points(group='hermes_agent.plugins')
print(list(eps))
"
Tools missing from /tools — the plugin skips registration when hindsightApiUrl is not configured. Check ~/.hindsight/hermes.json or env vars.
Connection refused — verify the API is running: curl http://localhost:9077/health
No memories recalled — memories need at least one retain cycle. Store a fact, start a new session, then ask about it.