feat(hermes-plugin): use OpenViking MCP tools

.github/workflows/hermes-plugin-tests.yml

@@ -37,7 +37,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           repository: NousResearch/hermes-agent
-          ref: 7951ddd7297a284d6da48804241ee05a8a0c621c
+          ref: 818c13be1dc4fd28987e1e881a9408224afd4535
           path: .ci/hermes-agent
           persist-credentials: false
 
@@ -97,12 +97,6 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-24.04, ubuntu-24.04-arm, macos-14, windows-2025]
-        host: [main]
-        include:
-          - os: ubuntu-24.04
-            host: release
-            python: '3.13'
-            hermes_ref: v2026.9.24
     runs-on: ${{ matrix.os }}
     timeout-minutes: 30
     defaults:
@@ -116,12 +110,12 @@ jobs:
       - uses: actions/checkout@v6
         with:
           repository: NousResearch/hermes-agent
-          ref: ${{ matrix.hermes_ref || '7951ddd7297a284d6da48804241ee05a8a0c621c' }}
+          ref: 818c13be1dc4fd28987e1e881a9408224afd4535
           path: .ci/hermes-agent
           persist-credentials: false
       - uses: actions/setup-python@v6
         with:
-          python-version: ${{ matrix.python || '3.14' }}
+          python-version: '3.14'
       - uses: astral-sh/setup-uv@v7
         with:
           version: '0.12.3'
@@ -131,13 +125,14 @@ jobs:
             examples/hermes-plugin/local_packages.py
       - name: Install the reviewed host and test dependencies
         run: |
-          if [ '${{ matrix.host }}' = release ]; then
-            uv sync --frozen --extra dev --no-install-project
-          else
-            uv sync --frozen --group dev --no-install-project
-          fi
+          uv sync --frozen --group dev --no-install-project
           PYTHON=$(uv run --no-sync python -c 'import sys; print(sys.executable)')
-          uv pip install --python "$PYTHON" PyYAML==6.0.3
+          uv export --frozen --group dev --no-emit-project --no-hashes \
+            --output-file "$RUNNER_TEMP/hermes-plugin-constraints.txt"
+          uv pip install --python "$PYTHON" \
+            --constraint "$RUNNER_TEMP/hermes-plugin-constraints.txt" \
+            --requirement "$GITHUB_WORKSPACE/examples/hermes-plugin/pyproject.toml" \
+            PyYAML==6.0.3
       - name: Check process ownership and installer failures
         run: |
           uv run --no-sync python -m pytest \
@@ -146,25 +141,14 @@ jobs:
             "$GITHUB_WORKSPACE/examples/hermes-plugin/tests/test_quick_local_routes.py" \
             "$GITHUB_WORKSPACE/examples/hermes-plugin/tests/test_quick_local_preflight.py" \
             --confcutdir="$GITHUB_WORKSPACE/examples/hermes-plugin/tests" -p no:cacheprovider -q
-      - name: Run the complete provider suite on the release host
-        if: matrix.host == 'release'
-        env:
-          HERMES_TEST_FILE_RETRIES: '0'
-          HERMES_TEST_WORKERS: '2'
-        run: |
-          HERMES_PYTHON=$(uv run --no-sync python -c 'import sys; print(sys.executable)') \
-            scripts/run_tests.sh "$GITHUB_WORKSPACE/examples/hermes-plugin/tests" \
-            --confcutdir="$GITHUB_WORKSPACE/examples/hermes-plugin/tests" -p no:cacheprovider -q
       - name: Install and run real Quick Local services
         run: |
-          ARGS=()
-          if [ '${{ matrix.host }}' = release ]; then ARGS+=(--legacy-uv); fi
           uv run --no-sync python "$GITHUB_WORKSPACE/scripts/check-hermes-quick-local.py" \
-            --hermes-root "$PWD" --output-dir "$RUNNER_TEMP/quick-local" "${ARGS[@]}"
+            --hermes-root "$PWD" --output-dir "$RUNNER_TEMP/quick-local"
       - uses: actions/upload-artifact@v4
         if: always()
         with:
-          name: quick-local-${{ matrix.os }}-${{ matrix.host }}
+          name: quick-local-${{ matrix.os }}
           path: |
             ${{ runner.temp }}/quick-local/evidence.json
             ${{ runner.temp }}/quick-local/*/logs/openviking-server.log

docs/en/agent-integrations/16-capability-reference.md

@@ -38,7 +38,7 @@ Long-term memories are extracted from a session only after a **commit**. Capture
 | [DSH](#dsh) | In-process Cordis plugin plus an MCP proxy | Server MCP tools, named `mcp__openviking__<tool>` |
 | [pi](#pi) | Native extension with a built-in MCP client | Server MCP tools, registered as `openviking_<tool>` after the MCP handshake succeeds |
 | [OpenClaw](#openclaw) | Context-engine plugin | 15 native tools, 14 enabled by default |
-| [Hermes](#hermes) | Hermes memory provider | 6 native `viking_*` tools |
+| [Hermes](#hermes) | Hermes memory provider and MCP adapter | Server MCP tools, named `mcp__openviking__<tool>` |
 | [MCP clients, Agent Plugins](#other-integrations) | MCP only | Server MCP tools |
 | [ov CLI](#ov-cli) | Command-line client | Every operation as an explicit command; no agent involved |
 
@@ -120,7 +120,9 @@ OpenClaw registers its own tools instead of passing MCP tools through.
 
 ### Hermes tools
 
-Hermes has six tools: `viking_search`, `viking_read`, `viking_browse`, `viking_remember`, `viking_forget`, and `viking_add_resource`. There is no skill tool. `viking_remember` submits a fact through its own session and returns before extraction finishes; extraction may add, merge, or skip the fact. See [Hermes](#hermes) for the differences between the bundled provider and the external plugin.
+The external Hermes plugin uses the server's MCP tools, including resource and skill tools. New connections use `trust: untrusted`. Read-only tools run without approval. Other tools require approval and cannot run unattended. Existing trust choices and tool filters are preserved. Automatic recall, capture and commits do not use this approval gate.
+
+Earlier bundled providers expose six native `viking_*` tools. See [Hermes](#hermes) for the differences between the bundled provider and the external plugin.
 
 <a id="_3-5-type-boundaries-for-writes-and-deletes"></a><a id="_3-5-1-write-boundary"></a><a id="_3-5-2-delete-boundary"></a>
 
@@ -136,11 +138,11 @@ These checks protect namespaces, not content types. Restrictions by type come fr
 
 | Entry point | Can delete | Client-side limits |
 |---|---|---|
-| MCP `forget` (every MCP integration, including DSH and pi) | Any URI it is given | Non-recursive unless `recursive=true`; no type or score check |
+| MCP `forget` (every MCP integration, including Hermes, DSH and pi) | Any URI it is given | Non-recursive unless `recursive=true`; no type or score check |
 | `ov rm` | Any URI | No confirmation; `-r` deletes recursively |
 | `ov tui`, `d` key | Any URI except roots and scope directories | Asks for confirmation |
 | OpenClaw `memory_forget` | Memory files only | URI must match a user, peer, or agent memory path. A search-based delete runs only for a single candidate scoring at least 0.85; otherwise the candidates are listed. Always non-recursive |
-| Hermes `viking_forget` | One user memory `.md` file | Rejects directories, non-`.md` files, generated `.abstract.md` and `.overview.md` files, and URIs with a query or fragment |
+| Earlier Hermes `viking_forget` | One user memory `.md` file | Rejects directories, non-`.md` files, generated `.abstract.md` and `.overview.md` files, and URIs with a query or fragment |
 | LangChain `viking_forget` | Any URI | Exposed only with `profile="admin"` or `allow_forget=True`; the model controls `recursive` |
 | Open WebUI | Nothing | No delete tool |
 
@@ -694,7 +696,7 @@ The two are separate code bases. Where their behavior differs:
 | Commits during a session | Only at session boundaries | A background commit at 20,000 pending tokens (`commit_token_threshold`) |
 | Recall digests | Not supported | Optional server digest (`recall_compress`) |
 | Mirroring Hermes's built-in memory | Additions only | Additions, replacements, and removals, tracked in a URI registry |
-| `viking_forget` | User memory files with an explicit user ID | Also accepts `viking://~/`, rejects user-ID-less layouts, and checks ownership before deleting |
+| Explicit tools | Six native `viking_*` tools | Server MCP tools with Hermes's configured approval policy |
 | Cron, subagent, and flush contexts | Not documented at that commit | Recall works. Automatic writes and mirroring are skipped |
 
 Behavior of the pinned bundled provider:

docs/zh/agent-integrations/16-capability-reference.md

@@ -38,7 +38,7 @@
 | [DSH](#dsh) | 同进程 Cordis 插件 + MCP 代理 | 服务端 MCP 工具，名为 `mcp__openviking__<tool>` |
 | [pi](#pi) | 原生扩展，内置 MCP 客户端 | 服务端 MCP 工具；MCP 握手成功后注册为 `openviking_<tool>` |
 | [OpenClaw](#openclaw) | context-engine 插件 | 15 个原生工具，默认启用 14 个 |
-| [Hermes](#hermes) | Hermes memory provider | 6 个原生 `viking_*` 工具 |
+| [Hermes](#hermes) | Hermes memory provider 和 MCP 适配器 | 服务端 MCP 工具，名为 `mcp__openviking__<tool>` |
 | [MCP 客户端、Agent Plugins](#其他集成) | 仅 MCP | 服务端 MCP 工具 |
 | [ov CLI](#ov-cli) | 命令行客户端 | 每个操作都是显式命令，不经过 Agent |
 
@@ -119,7 +119,9 @@ OpenClaw 注册自己的工具，不转发 MCP 工具。
 
 ### Hermes 工具
 
-Hermes 有 6 个工具：`viking_search`、`viking_read`、`viking_browse`、`viking_remember`、`viking_forget` 和 `viking_add_resource`，没有 skill 工具。`viking_remember` 通过独立会话提交一条事实，在抽取完成前就返回；抽取可能新增、合并或跳过这条事实。内置 provider 与外部插件的区别见 [Hermes](#hermes)。
+Hermes 外部插件使用服务端 MCP 工具，包括资源和 skill 工具。新连接使用 `trust: untrusted`。只读工具无需批准，其他工具需要批准，无法在无人值守运行中执行。已有的信任设置和工具过滤器保持不变。自动召回、捕获和提交不受此批准策略限制。
+
+旧版内置 provider 提供 6 个原生 `viking_*` 工具。内置 provider 与外部插件的区别见 [Hermes](#hermes)。
 
 <a id="_3-5-写入与删除的类型边界"></a><a id="_3-5-1-写入边界"></a><a id="_3-5-2-删除边界"></a>
 
@@ -135,11 +137,11 @@ Hermes 有 6 个工具：`viking_search`、`viking_read`、`viking_browse`、`vi
 
 | 入口 | 能删除 | 客户端限制 |
 |---|---|---|
-| MCP `forget`（所有 MCP 集成，含 DSH 与 pi） | 传入的任意 URI | 除非 `recursive=true`，否则不递归；不检查类型或分数 |
+| MCP `forget`（所有 MCP 集成，含 Hermes、DSH 与 pi） | 传入的任意 URI | 除非 `recursive=true`，否则不递归；不检查类型或分数 |
 | `ov rm` | 任意 URI | 不确认；`-r` 递归删除 |
 | `ov tui` 的 `d` 键 | 根目录和 scope 目录以外的任意 URI | 需要确认 |
 | OpenClaw `memory_forget` | 只能删记忆文件 | URI 必须匹配用户、peer 或 agent 的记忆路径。按搜索删除时，只有唯一候选且分数不低于 0.85 才执行，否则列出候选。始终不递归 |
-| Hermes `viking_forget` | 一个用户记忆 `.md` 文件 | 拒绝目录、非 `.md` 文件、自动生成的 `.abstract.md` 和 `.overview.md`，以及带 query 或 fragment 的 URI |
+| 旧版 Hermes `viking_forget` | 一个用户记忆 `.md` 文件 | 拒绝目录、非 `.md` 文件、自动生成的 `.abstract.md` 和 `.overview.md`，以及带 query 或 fragment 的 URI |
 | LangChain `viking_forget` | 任意 URI | 只在 `profile="admin"` 或 `allow_forget=True` 时提供；`recursive` 由模型决定 |
 | Open WebUI | 无 | 没有删除工具 |
 
@@ -691,7 +693,7 @@ OpenViking 的 profile 会自动尝试安装目录插件。provider 名、配置
 | 会话中的提交 | 无，只在会话边界 | 待提交 token 达到 20,000 时后台提交（`commit_token_threshold`） |
 | 召回摘要 | 不支持 | 可选的服务端摘要（`recall_compress`） |
 | 镜像 Hermes 内置记忆 | 只同步新增 | 同步新增、替换和删除，用 URI 注册表跟踪 |
-| `viking_forget` | 带明确用户 ID 的用户记忆文件 | 还接受 `viking://~/`，拒绝不带用户 ID 的路径，删除前检查归属 |
+| 显式工具 | 6 个原生 `viking_*` 工具 | 服务端 MCP 工具，使用 Hermes 配置的批准策略 |
 | cron、子代理和 flush 上下文 | 该提交中没有说明 | 召回可用；跳过自动写入和镜像 |
 
 上述固定提交中内置 provider 的行为：