hmem Humanlike Memory for AI Agents

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  plugins/hermes-hmem/__init__.py, line 71

  result = subprocess.run(

  plugins/hermes-hmem/__init__.py, line 96

  subprocess.Popen(

  src/cli-checkpoint-agent.ts, line 250

  try { fs.unlinkSync(mcpConfigPath); } catch {}

  Show more

  src/cli-deactivate.ts, line 62

  try { fs.unlinkSync(activeProjectFilePath(pid)); } catch { /* may not exist */ }

  src/cli-deactivate.ts, line 71

  try { fs.unlinkSync(`${tmpDir}/${f}`); } catch { /* ignore */ }

  src/cli-init.ts, line 701

  try { fs.unlinkSync(p); } catch {}

  src/cli-init.ts, line 929

  fs.rmSync(dest, { recursive: true, force: true });

  src/cli-init.ts, line 941

  fs.rmSync(stalePath, { recursive: true, force: true });

  src/diagnostics.ts, line 39

  try { fs.unlinkSync(rotated); } catch { /* ignore */ }

  src/mcp-server.ts, line 130

  try { fs.unlinkSync(CACHE_RESET_SIGNAL); } catch {}

  CHANGELOG.md, line 64

  - **Sync I/O no longer blocks the event loop.** `syncPull`, `syncPullThenPush`, `syncPushSync`, `syncPushWithRetry`, `reserveId`, `reserveNextId`, and `reserveNextSubIds` now retur

  hermes-hooks/hermes-cli-hmem-statusline.patch, line 16

  + result = subprocess.run(

• Install and update

  Concern

  runs a script at install time.

  INSTALL_LIFECYCLE_HOOK

  package.json, line 59

  postinstall

• Network

  Concern

  can reach server. The description does not name that host. can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

  skills/hmem-sync-setup/SKILL.md, line 187

  curl -X POST https://server/hmem-sync/announcements \

  skills/hmem-sync-setup/SKILL.md, line 197

  curl -s https://server/hmem-sync/announcements -H "Authorization: Bearer $TOKEN"

  skills/hmem-sync-setup/SKILL.md, line 200

  curl -X PUT https://server/hmem-sync/announcements/2 \

  Show more

  skills/hmem-sync-setup/SKILL.md, line 206

  curl -X DELETE https://server/hmem-sync/announcements/2 \

  src/extensions/pi-hmem.ts, line 383

  const res = await fetch(`${provider.baseUrl}/chat/completions`, {

  src/sync/api.ts, line 51

  const res = await fetch(`${this.baseUrl}${path}`, {

  src/sync/api.ts, line 73

  const res = await fetch(`${this.baseUrl}/health`, { signal: AbortSignal.timeout(3000) })

  skills/hmem-search-workspace/iteration-1/review.html, line 666

  const resp = await fetch("/api/feedback");

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_UNCONFIRMED

  skills/hmem-write/SKILL.md, line 198

  needs DISCORD_TOKEN + WEATHER_API_KEY in .env\n\tCodebase\n\t\tEntry point - bot.py,

  src/cli-checkpoint-agent.ts, line 275

  if (process.env.CODEX_SESSION_ID || process.env.CODEX_API_KEY) return "codex";

  src/extensions/pi-hmem.ts, line 361

  const dsKey = process.env.DEEPSEEK_API_KEY;

  Show more

  src/extensions/pi-hmem.ts, line 365

  const oaKey = process.env.OPENAI_API_KEY;

  src/extensions/pi-hmem.ts, line 370

  const apiKey = process.env.OPENAI_API_KEY;

  .gitignore, line 5

  *.tmp

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  package-lock.json, line 1

  {

  src/hmem-store.ts, line 1

  /**

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 0e35095bf675. can delete files. runs a script at install time. can reach server. The description does not name that host. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked: 17 Oct 2026

Read how this letter is chosen