feat(plugins): add safe exact-session message delivery seam

[Sahil-SS9]

Summary

Adds a small, generic host-owned delivery seam so standalone plugins can route conversational input to the correct live Hermes session without accessing private host queues or interrupting active tools.

This is the Hermes core prerequisite for the standalone Hermes Walkie Talkie plugin and for local cross-session messaging requested in #81885. The transport and product-specific peer logic remain outside this repository.

ctx.inject_message(
    content,
    role="user",
    *,
    mode="queue",
    target_session=None,
) -> bool

What changes

• Extends PluginContext.inject_message() additively with mode and target_session.
• Adds host-owned routing for CLI, TUI/Desktop and gateway sessions.
• Makes queue the safe default: idle sessions start a turn; busy sessions receive the message at the next safe boundary.
• Preserves explicit steer and legacy interrupt modes where supported.
• Adds the on_session_open lifecycle event for live, addressable sessions before their first model turn.
• Adds exact session context to opt-in plugin slash-command handlers while preserving legacy one-argument handlers.
• Makes host-open notification idempotent and releases its identity when the session closes.
• Documents the public contracts and surface behaviour.

No new core model tool is added. The external peer transport remains a standalone plugin.

Safety properties

• Injected text is conversational input only.
• It cannot invoke slash commands, execute bang-shell input, attach local files, select resume entries, approve tools, or answer protected confirmation prompts.
• queue never interrupts an active tool.
• Unknown, closed, rotated or unauthorised exact-session targets fail closed.
• Gateway injection is disabled per plugin unless plugins.entries.<id>.allow_gateway_injection: true is configured.
• Gateway delivery reuses the existing authorised route; it does not fabricate a platform route.

Compatibility

• Existing two-argument ctx.inject_message(content, role) callers remain valid.
• Legacy one-argument plugin command handlers remain valid.
• CLI, TUI/Desktop and gateway hosts expose the same generic seam while retaining their existing scheduling behaviour.
• This reconciles the host-contract direction of feat(gateway): allow plugin injection into existing sessions #64436, fix(gateway): inject work into exact live session #70406 and fix(plugins): route inject_message to dashboard sessions, targeted at the originating session #80920 without adding the standalone Walkie Talkie implementation to Hermes core.

Verification

Verified from a clean worktree based directly on NousResearch/main at 2cdb30a474d76cca9eb61714d889c18f493aa7fc:

• Focused core injection, lifecycle, gateway and TUI regression matrix: 605 passed.
• Standalone real-process E2E against this clean core transplant: 16 passed.
• Cross-surface CLI/TUI/gateway import and routing matrix under the Hermes environment: 4 passed, no skips.
• py_compile on all changed runtime modules: passed.
• ruff check on all changed Python files: passed.
• git diff --check: passed.
• Six commits ahead of upstream; all commits attributed to Sahil-SS9 <218421507+Sahil-SS9@users.noreply.github.com>.

Scope boundary

This draft contains only the generic V1 host seam, tests and documentation. Groups, broadcasts, structured request/reply workflows, native Windows transport, operational metrics and the full Desktop collaboration UI are planned as a separately tested V1.1 enhancement and are not part of this PR.

[Sahil-SS9]

V1.1 follow-up checklist — explicitly out of scope for this V1 PR

The current draft is intentionally limited to the generic safe-delivery and exact-session lifecycle seam. The following work will be built and tested in separate successor worktrees, then proposed separately after V1 is validated:

• Add stable profile-level agent_id alongside session peer_id and process instance_id
• Add persistent group CRUD using stable agent membership
• Add bounded broadcasts with deterministic per-recipient child messages and aggregate receipts
• Add structured request/reply workflows with persisted state transitions, progress, cancellation, expiry and idempotent retries
• Add parent/child workflow aggregation for group requests
• Add local operational metrics, status, health, stale-peer detection and doctor output without outbound telemetry
• Extract a backend-neutral local transport contract while preserving the V1 AF_UNIX path
• Add secure native Windows 10/11 named-pipe transport with SID/DACL ownership checks
• Add a Hermes Desktop disk plugin with Peers, Groups, Inbox, Requests and Health views
• Add namespaced Desktop REST/event APIs with profile isolation and polling fallback
• Run real two-process and two-Hermes E2E matrices on Linux, macOS and native Windows
• Complete independent exact-SHA review before publishing a separate V1.1 branch/PR

Standalone V1 implementation: https://github.com/Sahil-SS9/hermes-walkie-talkie

The V1.1 changes will not be added to this PR branch. The core successor worktree will be stacked from this draft PR head for development only, then rebased/transplanted onto upstream main after V1 lands.

[Sahil-SS9]

Walkie Talkie V1.1 — Security Review Complete + Fixes Applied

The standalone V1.1 branch has been pushed and a PR opened: Sahil-SS9/hermes-walkie-talkie#1

Security review (direct, by KENSEI)

Two findings identified and fixed:

SEC-R1 — Sender identity spoofing (MEDIUM)
PeerRuntimeManager.send() accepted envelopes with arbitrary sender identities. Fixed: sender is now authenticated against registered peers; unregistered senders rejected with INVALID; registered senders have identity overridden from the bound peer record.

SEC-R2 — Boundary marker injection (LOW-MEDIUM)
peer_message_marker/peer_request_marker did not sanitise content or sender names. Fixed: sender names stripped of newlines and boundary tags; content/summary boundary tags neutralised with zero-width space insertion.

Verification at 0d5d02c

• 763 tests passed, 25 skipped (native Windows)
• Coverage 92.7%
• ruff/ty clean, git diff --check clean
• hermes verify ok:true
• Deterministic verifier: 13/14 PASS, PARTIAL exit 2
• Post-gate cleanliness: porcelain empty

Core PR status

This core PR (#83661) remains the V1 delivery seam — the minimal core transplant that enables the plugin. The V1.1 features (groups, broadcasts, requests, Dashboard) live entirely in the standalone repo and do not require additional core changes.