$ show Cyrene963/hermes-patches
This repository is a community patch overlay for Nous Research's Hermes Agent, adding a durable 'Memory OS': a PostgreSQL-backed URI-addressed memory graph (core://, writer://, system:// domains) with row-level security multi-tenancy, vector semantic recall via a hindsight embeddings service, and a fail-closed write pipeline that classifies candidate memories, verifies them by readback before promotion, routes uncertain writes to human review, and tracks corrections in a regression-replay ledger. It ships a standalone FastAPI + React memory review WebUI, watchdog/scorecard/canary scripts, systemd units, and CI gates including patch verification and a secret-scraping privacy guard. The dominant character is application: an agent-runtime extension integrated with the Hermes CLI, Telegram gateway, and cron scheduler, with tools registered through a central tool registry and policy modules (confidence calibration, privacy inference, relationship boundaries, completion fidelity) returning frozen dataclass verdicts that gate tool execution. Security discipline is unusually strong — writes are readback-verified, secrets are redacted/hashed before persistence, LLM failures block writes rather than proceeding, memory deletion uses HMAC-signed short-TTL grants with nonce replay protection, and roughly 100 test files exercise gates, CLI behavior, gateway gating, plugins, and operational scripts. The main structural weaknesses are two parallel memory-graph backend implementations (embedded agent/memory_graph vs standalone-memory-graph-webui/backend) with duplicate ORM models that may diverge, many hardcoded ~/.hermes profile paths and deployment-specific service names in scripts/tests, and an explicit patch-overlay design that must be re-applied as upstream Hermes evolves. Some data-research flavored utilities exist (trajectory_compressor.py for fine-tuning corpus compression, precision/recall eval harnesses, CJK-aware search tokenization), but they serve the application rather than defining it. For an AI agent looking for memory infrastructure patterns — readback-verified writes, fail-closed policy verdicts, RLS namespace isolation, HMAC-granted deletes — this repo is a strong reference; for direct reuse, treat the standalone WebUI and embedded backend as candidates for consolidation, and expect to parameterize path assumptions.
The LLM identified 5 files worth highlighting for reuse:
Standalone fire.CLI utility that compresses ShareGPT-style JSONL agent trajectories to fit fine-tuning token budgets while preserving first/last turns, replacing compressed middle regions with a single human-role [CONTEXT SUMMARY] message, and emitting per-trajectory and aggregate compression metrics. Zero coupling to the Hermes runtime — extractable into any LLM trajectory preprocessing pipeline.
Contains StreamingContextScrubber, a stateful chunk-safe state machine that strips <memory-context> spans from streaming LLM output even when spans split across chunks or escape sequences, without buffering the whole stream. The class is self-contained and can be lifted into any streaming LLM response pipeline needing redaction or context fencing.
Provider-agnostic embeddings factory with auto-dimension detection and backend support for local, OpenAI, Cohere, Google, LiteLLM, and TEI endpoints. Isolated from agent internals; reusable in any retrieval pipeline that needs swappable embedding backends behind a single interface.
Large runtime provider resolver covering a broad LLM provider matrix (OpenAI, Anthropic, OpenRouter, xAI, Gemini OAuth, Bedrock, Azure Entra, custom/local endpoints) with host-gated env-var fallbacks, lookalike-host protection, and per-provider API-mode auto-detection. The _host_derived_api_key and _detect_api_mode_for_url helpers are portable security patterns for any multi-provider LLM client or gateway.
Implements time-limited HMAC-signed delete grants with nonce replay protection and ContextVar turn binding, so memory deletions are authorized per-turn without persistent permission state, plus a lifecycle manager for archiving stale leaves and cascading rollback. A non-obvious security pattern reusable wherever privileged single-use operations need short-lived delegated authority.