Hermes: install from the plugin catalog (hermes plugins install simular-box)

README.md

@@ -10,7 +10,7 @@ Most agents need no plugin: add the MCP server `https://mcp.box.simular.ai/mcp`
 | DeepSeek Harness (dsh) | [`dsh/`](dsh/) | Personal key (`cb_...`), pasted on the plugin's page in Plugins | [dsh/README.md](dsh/README.md) |
 | OpenClaw | [`openclaw/`](openclaw/) | OAuth, once from the plugin's page in Settings | `openclaw plugins install @simular-ai/openclaw-box` |
 | Any of Claude Code, Codex, Cursor, OpenCode, Gemini CLI, Hermes, OpenClaw, VS Code (and steps for Claude Desktop) | [`cli/`](cli/) | OAuth; personal key with `--auth key` for Hermes and OpenClaw | `npx @simular-ai/box connect` (check with `npx @simular-ai/box doctor`) |
-| Hermes Agent | [`hermes/`](hermes/) | Personal key (`cb_...`) in `MCP_BOX_API_KEY`; OAuth optional | [hermes/README.md](hermes/README.md) |
+| Hermes Agent | [`hermes/`](hermes/) | Personal key (`cb_...`) in `MCP_BOX_API_KEY`; OAuth optional | `hermes plugins install simular-box` ([hermes/README.md](hermes/README.md)) |
 | ChatGPT and Codex (OpenAI plugin directory) | [`openai/`](openai/) | OAuth, once in the browser | Listed by OpenAI after review; build the upload with `openai/build-zip.sh` ([openai/README.md](openai/README.md)) |
 
 ## Offload: move a coding task into your box and back
@@ -27,6 +27,6 @@ Add a folder named after the agent with its own manifest, MCP config and, where
 - `openclaw/`: bump `version` in `openclaw/package.json` and `openclaw/openclaw.plugin.json`, then `npm run build` and `clawhub package publish .` from `openclaw/`.
 - `dsh/`: bump `version` in `dsh/package.json`, then push a tag `dsh-vX.Y.Z`. The release workflow attaches `dsh-box.tgz`.
 - `openai/`: bump `version` in `openai/plugin.json` and `publication.release_notes`, run `openai/build-zip.sh`, upload the ZIP at platform.openai.com/plugins.
-- `hermes/`: bump `version` in `hermes/plugin.json`. Users copy the folder by hand until box is in the Hermes plugin catalog.
+- `hermes/`: bump `version` in `hermes/plugin.json`, merge, then open a PR to [NousResearch/hermes-agent](https://github.com/NousResearch/hermes-agent) that moves `sha:` (and `version:`) in `plugin-catalog/box.yaml` to the merge commit. Hermes installs only the pinned, reviewed commit.
 - The Claude plugin's CLI pin: since 1.0.0, `@simular-ai/box` on npm is the Rust CLI released from [simular-ai/box-cli](https://github.com/simular-ai/box-cli). To move the plugin to a new CLI release, change the exact pin `npx -y @simular-ai/box@X.Y.Z` in `claude/skills/box-offload/SKILL.md` and bump `version` in `claude/.claude-plugin/plugin.json` in one PR (CI fails unless every pin under `claude/` names the same exact version and that version is on npm; never a range, because the Claude directory review requires that what runs is what it read).
 - `cli/`: the JavaScript CLI (0.2.x). It no longer publishes to npm: its trusted publisher on `@simular-ai/box` was removed when the Rust 1.0.0 shipped, so do not push `cli-v*` tags. The endpoint and CLI changes now go to simular-ai/box-cli.

hermes/README.md

@@ -13,7 +13,16 @@ This folder is a portable Agent Plugins v1 package (`plugin.json`, `mcp.json`, `
 
    `MCP_BOX_API_KEY` is the name Hermes's own `hermes mcp add --auth header` uses, and the same one `npx @simular-ai/box connect --client hermes --auth key` writes, so one key serves either install.
 
-3. Install the plugin into your profile's plugin folder, enable it, and restart the gateway so it picks up the key:
+3. Install box from the Hermes plugin catalog and restart the gateway so it picks up the key:
+
+   ```bash
+   hermes plugins install simular-box
+   hermes gateway restart
+   ```
+
+   You can also install it from the Plugins page in the Hermes dashboard or desktop app. The catalog pins a reviewed commit of this folder. The plugin is named `simular-box` so it isn't confused with Box, the cloud-files company. box's tools show up from the `box` server, and the `box` skill tells the agent how to use them.
+
+   If `hermes plugins install simular-box` says there is no such entry, your Hermes can't read the current catalog: Hermes from before 10 Nov 2026 rejects the catalog file because it grew past 2 MB. Run `hermes update` and try again, or copy the folder by hand:
 
    ```bash
    git clone https://github.com/simular-ai/box-plugin /tmp/box-plugin
@@ -22,13 +31,11 @@ This folder is a portable Agent Plugins v1 package (`plugin.json`, `mcp.json`, `
    hermes gateway restart
    ```
 
-   `hermes plugins install` takes a catalog name, a Git URL or `owner/repo`, not a folder inside a repo, so until box is in the Hermes plugin catalog the folder is copied by hand. Check it with `hermes plugins validate ~/.hermes/plugins/simular-box`. The plugin is named `simular-box` so it isn't confused with Box, the cloud-files company. box's tools show up from the `box` server, and the `box` skill tells the agent how to use them.
-
    Hermes asks you the first time the agent uses each box tool that can change something (clicking, typing, running a command, writing or deleting a file). Answer **Always** and it won't ask for that tool again; screenshots and other read-only tools never ask. A scheduled or unattended run can't answer, so approve the tools once in a chat first.
 
    If you change the key later, run `hermes gateway restart`: a running gateway keeps the old value and parks the server.
 
-   To update, copy the folder again the same way and restart the gateway. Version 0.2.0 renamed the plugin from `box` to `simular-box`: if you installed an earlier version, run `hermes plugins disable box`, delete `~/.hermes/plugins/box`, then install as above. Version 0.1.1 moved box to `https://mcp.box.simular.ai/mcp`.
+   To update, run `hermes plugins update simular-box` (or copy the folder again if you installed it by hand) and restart the gateway. Version 0.2.0 renamed the plugin from `box` to `simular-box`: if you installed an earlier version, run `hermes plugins disable box`, delete `~/.hermes/plugins/box`, then install as above. Version 0.1.1 moved box to `https://mcp.box.simular.ai/mcp`.
 
 **On a desktop with a browser**, you can sign in instead of using a key: `hermes mcp add box --url https://mcp.box.simular.ai/mcp --auth oauth`, then `hermes mcp login box`. A server you add this way overrides the plugin's entry of the same name. On a server, prefer the key: when an OAuth refresh token expires, Hermes parks the server until someone signs in again by hand.