feat: add native Hermes Agent support

[ildunari]

Summary

Add first-class Hermes Agent support using context-mode's existing MCP server and session pipeline rather than introducing a parallel storage implementation.

This adds:

• a native Hermes Python plugin at the repository root (plugin.yaml + __init__.py) installable with hermes plugins install mksglu/context-mode --enable
• Hermes platform detection, adapter loading, client-name mapping, exact MCP tool naming, hook formatting, and profile-aware storage
• bounded, fail-open bridging from Hermes lifecycle hooks to context-mode hook hermes <event>
• exact compaction continuity through Hermes' pre_llm_call(compaction_applied=...) signal
• conservative oversized-result indexing through the canonical mcp__context_mode__ctx_index tool, with unique per-tool-call sources and replacement only after confirmed success
• /ctx-stats, /ctx-doctor, and /ctx-search Hermes commands backed by the same MCP server
• npm publication/version-sync coverage for the Hermes plugin files
• installation and platform-support documentation

This is intended as a more complete native-integration path alongside the work discussed in #981: the MCP server remains the data plane, while the Hermes plugin is only the lifecycle/control-plane bridge.

Architecture

Hermes Agent
  ├─ native Python plugin hooks
  │    └─ context-mode hook hermes <event>
  │         └─ existing routing + SessionDB continuity pipeline
  └─ configured MCP server: context_mode
       └─ existing ctx_execute / ctx_index / ctx_search / stats / doctor tools

The integration does not register a Hermes memory provider or context engine. It uses public plugin hooks and PluginContext.dispatch_tool only.

Safety and failure behavior

• Hook subprocesses have bounded timeouts and fail open.
• Hermes cannot rewrite tool arguments at pre_tool_call, so context-mode modify decisions become enforceable blocks with routing guidance rather than silently running the original command.
• Automatic result replacement is limited to a conservative read-only tool allowlist.
• Every indexed result gets a unique source label using Hermes' tool_call_id (UUID fallback), preventing later calls from overwriting earlier indexed results.
• MCP indexing runs through one bounded daemon dispatch lane. A slow or stuck dispatch returns the original result and cannot accumulate worker threads.
• Context-mode's own MCP tools are exempt from result transformation to prevent recursion.
• Storage follows $HERMES_HOME/context-mode (normally ~/.hermes/context-mode) so named/profile-scoped Hermes instances do not bleed state.

Install

npm install -g context-mode
hermes plugins install mksglu/context-mode --enable

mcp_servers:
  context_mode:
    command: context-mode
    args: []
    enabled: true

Verification

• npm run typecheck
• npm run build
• npm test
  • 211 test files passed
  • 4,727 tests passed
  • 24 skipped
• git diff --check
• real Hermes PluginManager discovery/load with isolated HERMES_HOME
• real pre_llm_call hook bridge created a profile-scoped SessionDB and injected the Hermes routing block
• real MCP stdio smoke:
  • server initialized as context-mode
  • 11 tools discovered
  • required ctx_index, ctx_search, ctx_stats, and ctx_doctor present
  • ctx_index succeeded
  • ctx_search retrieved the indexed marker
• independent adversarial review completed; two P1 findings and one P2 finding were fixed, followed by a narrow closure review with no remaining P0/P1