fix: restrict PluginContext for user-loaded plugins

[ErnestHysa]

Summary

Restricts the PluginContext handed to user-installed plugins (~/.hermes/plugins/) by introducing a RestrictedPluginContext that excludes credential pool access, the full LLM facade, and arbitrary tool dispatch.

Before

All plugins — whether bundled with the repository or installed by the user to ~/.hermes/plugins/ — received a full PluginContext with:

• ctx.llm — LLM facade with the user's API credentials and auth tokens
• ctx.register_tool(override=True) — ability to replace any built-in tool
• ctx.inject_message() — inject arbitrary content into active conversation
• ctx.dispatch_tool() — call any registered tool directly
• Full access to provider registration methods (image gen, TTS, etc.)

A user who installs a malicious plugin to their own ~/.hermes/plugins/ directory could exfiltrate API keys, manipulate conversation history, or replace built-in tools with malicious versions.

After

A new RestrictedPluginContext class is introduced for user-sourced plugins (manifest.source == "user"). Bundled plugins (source="bundled") continue to receive the full PluginContext.

RestrictedPluginContext provides:

• register_tool() — tool registration (for legitimate plugin functionality)
• inject_message() — message injection
• register_cli_command() / register_command() — command registration

RestrictedPluginContext omits:

• llm property — returns None; no LLM facade access
• dispatch_tool() — no arbitrary tool dispatch
• All provider registration methods (register_context_engine, register_image_gen_provider, register_tts_provider, etc.)
• Credential pool access

if manifest.source == "user":
    ctx = RestrictedPluginContext(...)
else:
    ctx = PluginContext(...)

Impact

• Before: A malicious plugin installed to ~/.hermes/plugins/ had full access to all API keys, could make LLM calls on the user's behalf, and could replace any built-in tool
• After: User-installed plugins can only register tools and inject messages; credential pool, LLM facade, and tool dispatch are inaccessible
• Severity: Low (self-DOE — requires user writes malicious code to their own plugin directory; fix hardens the design for multi-user or shared-environment scenarios)

[teknium1]

Thanks for the security-focused contribution. The skin-path issue is worth preserving, but the PluginContext change does not create the claimed isolation boundary.

Problems

• hermes_cli/plugins.py:1533 only chooses a facade after arbitrary plugin code has already been imported. On current main, _load_plugin() imports the user directory module at hermes_cli/plugins.py:1762 before calling register() at :1775; an enabled plugin therefore retains ordinary process capabilities regardless of ctx. This also removes documented ctx.llm and ctx.dispatch_tool capabilities from user plugins without providing sandboxing.
• hermes_cli/skin_engine.py:762 uses a string-prefix containment check. A symlink resolving to a sibling such as skins_evil/... can pass startswith() while escaping the skins directory.
• The diff has no tests for either security path.

Suggested changes

• Split and test the skin fix, using path-aware containment such as Path.is_relative_to() after resolution.
• Rework the plugin proposal around a real execution-isolation boundary, rather than treating a Python facade as one.

Automated hermes-sweeper review.

[teknium1]

This facade is selected only after _load_directory_module() has imported arbitrary user Python. Current main imports at hermes_cli/plugins.py:1762 before calling register() at :1775, so an enabled plugin can use ordinary process capabilities regardless of ctx. This cannot provide the claimed security boundary and breaks documented user-plugin APIs without actual execution isolation.

[teknium1]

startswith() is not a path-containment check: a skin symlink resolving to a sibling directory such as skins_evil/... passes this prefix test while escaping skins_path. Use resolved-path containment (is_relative_to() or relative_to() with ValueError) and add a symlink regression test.