Plugin dependencies follow the plugin's own security policy; Hermes's 14-day quarantine applies to Hermes deps only (reverses #118841 item 3, unblocks #120076 #114530)

[teknium1]

Plugin python_dependencies now install under the plugin's own dependency-security policy; Hermes's 14-day exclude-newer quarantine applies to Hermes's own dependencies only — so catalog re-pins floored on a fresh release (#120076 hindsight 1.0.1 → hindsight-client>=0.10.1) install again, while hermes update / lazy extras stay quarantined.

Reverses item 3 of #118841 (merged 74f726c), which pinned the uv tier's cwd to the checkout for every install so the quarantine reached plugin deps from any cwd. Maintainer ruling:

plugins dont have to abide by our 14 day rule btw. They can have their own security policy on that. Only hermes' dependencies themselves have to. We should recommend that they do this for their plugins and we should give guidance to plugin devs that they should though.
— @teknium1

Changes

• tools/lazy_deps.py — the line is drawn in code, not by cwd tricks: INSTALL_POLICIES = ("core", "plugin"). _uv_policy_args(policy) replaces _uv_policy_cwd(): core runs uv from the checkout root (quarantine + exclude-newer-package exceptions apply from $HOME, a service, the Desktop backend); plugin passes --no-config (no project file discovered from any cwd; env knobs UV_INDEX_URL / UV_EXCLUDE_NEWER still apply, so an operator can quarantine plugin deps themselves). _venv_pip_install(policy=) defaults to core (ensure() / LAZY_DEPS extras); install_specs(policy=) defaults to plugin — every caller of install_specs installs plugin/provider-manifest deps (plugin_python_deps.resolve → CLI install/enable/update, catalog installs, dashboard memory-provider setup, hermes memory setup, post-update reapply_all, memory-provider migration, mem0/honcho SDK self-installs). The core constraints file still bounds plugin resolution.
• hermes_cli/plugin_python_deps.py — resolve() passes policy="plugin" explicitly.
• Hermes's own pinning untouched — pyproject.toml [tool.uv], uv lock/sync in managed_uv, the exact-pin/upper-bound lint in tests/test_packaging_metadata.py.
• Docs / guidance (half the ask)
  • website/docs/developer-guide/plugins/index.md — new Dependency security policy section: Hermes does not quarantine plugin deps; plugin authors are responsible for their own deps and strongly recommended to pin upper bounds, floor on the oldest API-compatible version, adopt their own new-release quarantine (uv --exclude-newer "14 days" / UV_EXCLUDE_NEWER in their CI), review bumps; the catalog review reads the dependency list at the pin.
  • plugin-catalog/README.md — admission rule 9: dependency policy is the plugin's; reviewers recommend (not require) bounds + oldest floor + own quarantine; a recent floor alone is not grounds to hold an entry.
  • AGENTS.md § Dependency Pinning Policy — scope of the quarantine and the ruling, with the code seam named.
  • Catalog intake skill (local, hermes-plugin-catalog-intake) — the stale "quarantine applies to plugin installs from any cwd, hold until it ages" rule replaced by the ruling + recommend-not-require guidance.
• Tests — the Plugin loader: version gate reads running code, SystemExit isolated, uv quarantine from any cwd, impostor dirs refused, range pins (#72052 #104404 #101962 #112096 #108371 #71650 #86992 #98407) #118841 test (uv tier runs from the checkout) is replaced by two invariants in tests/tools/test_lazy_deps.py: a plugin install_specs call carries --no-config and no checkout cwd (red on base, green fixed); a core ensure() install keeps the checkout cwd and no --no-config (control, green both sides).

Validation

Check	Before (origin/main eb8960f)	After
hermes plugins install vectorize-io/hindsight#hindsight-integrations/hermes --ref f7a153dd… (fresh scratch venv, fake HOME/HERMES_HOME, cwd=$HOME)	refused: Because only hindsight-client<=0.9.2 is available and you require hindsight-client>=0.10.1,<1 … filtered by exclude-newer (the #120076 symptom)	✓ Plugin installed, hindsight-client==0.10.1 in the venv
_venv_pip_install(("hindsight-client>=0.10.1,<1",), dry_run=True, policy="core") from $HOME	—	still refused: filtered by exclude-newer to only include packages uploaded before 2026-09-09 — Hermes's quarantine holds from any cwd
… policy="plugin"	—	resolves + hindsight-client==0.10.1
uv pip install --dry-run --show-settings from checkout / checkout --no-config / $HOME	14d / — / None	14d / None / None (--no-config deterministic from any cwd; UV_EXCLUDE_NEWER="7 days" under --no-config → 7d)
tests/tools/test_lazy_deps.py new plugin invariant	1 red on base	green
scripts/run_tests.sh tests/tools/ tests/hermes_cli/test_plugin*.py …	—	see thread if anything is red

Live repro: before — HOME=<scratch>/fakehome HERMES_HOME=… python -m hermes_cli.main plugins install vectorize-io/hindsight#hindsight-integrations/hermes --ref f7a153dd9050e800cb295fd278f0a3ed0af29f32 exits 1 with the exclude-newer refusal; after — same command exits 0 and installs hindsight-client 0.10.1; core dry-run under policy="core" from the same cwd still refuses.

Root cause in one sentence: #118841 applied a project-scoped uv policy to installs that are not the project's, by making cwd carry the policy for every install.

Trade-off noted: --no-config also skips a user-level ~/.config/uv/uv.toml for plugin installs (env vars such as UV_INDEX_URL still apply; pip.conf/PIP_INDEX_URL are bridged already). A --project <dir> alternative preserved user config but walks up the directory tree and is not deterministic.

Unblocks #120076 and #114530 (the re-pins land once this merges). Follow-up to #118841.

Infographic

[github-actions]

૮ >ﻌ< ა ci review

_{ran on cf931e5 — chore: retrigger CI (zero-job dispatch failure, auto-heal)}

⚠️ Warnings

CI timings · View report · View job

Wall time 6m8s vs 1m17s (+377.9%). 1 faster, 1 unchanged.

• Detect affected areas: -59.0s