Ufonik88

Durable local memory for Hermes agents: SQLite FTS5 facts with cited, explainable recall; a Markdown vault with knowledge-graph export and an interactive visual graph; and turn-prefetch context injection with reason tokens. Write policy auto-redacts high-confidence secrets at write time (other PII types are warn-only findings) and stored-content injection screening flags and warns on recall and prefetch payloads (flag-and-warn, fail-open by design, not a blocking filter). Includes a 34-command CLI, destructive-op gates with automatic backups, and an append-only audit log. Disclosure — all memory data (vault markdown, memory.db, index.db, backups) stays local under HERMES_HOME/entropicmem/; a shared publish DB defaults to HERMES_HOME/entropicmem-shared/. The CLI init command appends ENTROPICMEM_* settings to HERMES_HOME/.env (append-only). Vector embeddings are off by default; only with embeddings_enabled: true (provider) or ENTROPICMEM_EMBEDDINGS=1 / query --semantic (CLI) and the optional sentence-transformers extra installed does first use download all-MiniLM-L6-v2 weights from huggingface.co; otherwise the provider has no network egress. The CLI ingest command fetches a user-supplied URL; CLI graph export writes to ./export in the cwd by default and its HTML loads D3/marked from d3js.org and cdn.jsdelivr.net when opened; CLI graph serve starts a loopback HTTP server. entropicmem_patch_core edits the plugin's own Core-memory markdown (Persona/User_Profile), not Hermes core, and is off by default.

Secret-leak protection for Hermes chats. Scans inbound messages and outbound replies for API keys, tokens, and passwords with a 28-pattern detector registry, redacts them before they reach session storage or the user, and injects safe secret-handling rules so the agent never asks for secrets in chat. Zero dependencies, fully offline detection; pairs with the optional hermes-vault CLI for encrypted storage. Disclosure — rewrites inbound user messages (regex secret redaction, may false-positive on password-like strings), injects a secret-handling prompt each conversation and rewrites assistant replies that ask for secrets; outbound replies are value-redacted with the same registry (regex-based, so a shape no detector covers passes through), with findings logged as detector name plus SHA-256 fingerprint and never the raw value. The vaultknox tool is inert unless the separate vaultknox pip package is installed, its write gate is a tool argument the model sets, and a vault policy that authorises raw consume_token returns the plaintext to the model.