From b3593518ff13ccd10a4e41691e420d4aed726c18 Mon Sep 17 00:00:00 2001
From: Teknium <127238744+teknium1@users.noreply.github.com>
Date: Mon, 2 Nov 2026 13:28:00 -0800
Subject: [PATCH] chore(catalog): review disclosure for statejar

---
 plugin-catalog/statejar.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugin-catalog/statejar.yaml b/plugin-catalog/statejar.yaml
index a0ca7a7aca..fd9b19da7f 100644
--- a/plugin-catalog/statejar.yaml
+++ b/plugin-catalog/statejar.yaml
@@ -2,7 +2,7 @@ name: statejar
 repo: https://github.com/KING-OF-FLAME/statejar-integrations
 sha: e4cb293be7dac91093d0376d190af3e0a6a70c1b
 subdir: hermes/statejar
-description: "Verifiable memory for Hermes Agent (memory.provider statejar): typed facts with one value per field, append-only content-addressed versions, recall of only what a message needs with the handle of the state it came from, and an audit trail of every disclosure. Disclosure — the user's current message (first 2,000 characters) is sent to api.statejar.com as a recall query, and the user's own messages are sent there in batches for capture, with STATEJAR_API_KEY; the assistant's replies and tool output are never sent, and API keys, tokens, private keys and passwords are removed locally first. StateJar's server sends each message to a cloud model provider it uses for extraction (today Google Gemini and OpenRouter); no language model runs on StateJar's own server, and if every provider fails the message is held and read again once one answers. A capture queue (mode 600) is kept under the Hermes home."
+description: "Verifiable memory for Hermes Agent (memory.provider statejar): typed facts with one value per field, append-only content-addressed versions, recall of only what a message needs with the handle of the state it came from, and an audit trail of every disclosure. Disclosure — the user's current message (first 2,000 characters) is sent to api.statejar.com as a recall query on every turn, and the user's own messages (three words or more), every entry Hermes's built-in memory tool saves, and the text or query the agent passes to the statejar_* tools are sent there with STATEJAR_API_KEY; assistant replies and tool output are not captured, and API keys, tokens, private keys, passwords and card numbers are removed locally first (best effort). StateJar's server sends each captured message to a cloud model provider it uses for extraction (today Google Gemini and OpenRouter). A capture queue is kept under the Hermes home (created mode 600; a queue rewritten after a failed send uses default permissions). Only the primary agent writes; cron and subagent runs only recall."
 maintainer: KING-OF-FLAME
 tier: community
 category: memory