mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-11-06 13:26:40 +00:00
Desktop's hermes://plugin/install?catalog= links fetch /docs/api/plugins.json cross-origin. The docs host answers with a 301 to GitHub Pages, and a browser fails the fetch at that hop unless it carries Access-Control-Allow-Origin. The skills-index watchdog probes with curl -L, which never checks CORS, so it stayed green while every catalog link failed. scripts/ci/check_catalog_cors.py fetches the catalog hop by hop with Origin: null (what a packaged Desktop renderer sends) and fails when any response lacks the header. A new check-catalog-cors job in skills-index-freshness.yml runs it every 4 hours and files its own [plugin-catalog-cors-watchdog] issue, so its reports never land on a skills-index issue. Refs #136483