remove: BOOT.md built-in hook by teknium1 · Pull Request #17093 · NousResearch/hermes-agent

teknium1 · 2026-04-28T16:50:20Z

Summary

BOOT.md ships removed from the repo. The infrastructure for built-in gateway hooks stays — just no BOOT.md.

Why

BOOT.md (merged in #3733) spawned a bare AIAgent() with no model or runtime kwargs, which immediately 401s against any provider configured with a custom endpoint. Three community PRs (#5240, #12514, #14992) tried to retrofit runtime resolution onto it. The feature wasn't ready to ship in the first place — pulling it rather than layering fixes on top.

Changes

gateway/builtin_hooks/boot_md.py — deleted
gateway/hooks.py — _register_builtin_hooks() kept as empty stub (extension point for future always-on hooks preserved)
gateway/builtin_hooks/__init__.py — kept (package scaffolding for future built-ins)
hermes_cli/tips.py — removed BOOT.md tip
Docs: removed the Boot Checklist example from user-guide/features/hooks.md; rewrote the builtin_hooks/ row in AGENTS.md, developer-guide/architecture.md, and developer-guide/gateway-internals.md to "Extension point for always-registered hooks (none shipped)"

Validation

scripts/run_tests.sh tests/gateway/test_hooks.py -q → 21 passed.

Closes #5239. Supersedes #5240, #12514, #14992.

BOOT.md was merged in PR #3733 before the feature was ready — the built-in hook spawned a bare AIAgent() with no model/runtime kwargs, which immediately 401s on any provider with a custom endpoint. Three separate community PRs (#5240, #12514, #14992) tried to paper over it. Remove the BOOT.md hook entirely and its user-facing docs/tips. Keep the gateway/builtin_hooks/ package and the HookRegistry._register_builtin_hooks() hook-point intact as the extension surface for future always-on gateway hooks. Closes #5239.

github-actions · 2026-04-28T16:50:42Z

🚨 CRITICAL Supply Chain Risk Detected

This PR contains a pattern that has been used in real supply chain attacks. A maintainer must review the flagged code carefully before merging.

🚨 CRITICAL: Install-hook file added or modified

These files can execute code during package installation or interpreter startup.

Files:

hermes_cli/setup.py

Scanner only fires on high-signal indicators: .pth files, base64+exec/eval combos, subprocess with encoded commands, or install-hook files. Low-signal warnings were removed intentionally — if you're seeing this comment, the finding is worth inspecting.

BOOT.md was merged in PR #3733 before the feature was ready — the built-in hook spawned a bare AIAgent() with no model/runtime kwargs, which immediately 401s on any provider with a custom endpoint. Three separate community PRs (#5240, #12514, #14992) tried to paper over it. Remove the BOOT.md hook entirely and its user-facing docs/tips. Keep the gateway/builtin_hooks/ package and the HookRegistry._register_builtin_hooks() hook-point intact as the extension surface for future always-on gateway hooks. Closes #5239. Co-authored-by: teknium1 <teknium@users.noreply.github.com>

Replace the removed built-in boot-md hook (#17093) with a how-to that shows users how to wire up the same behavior themselves via the hooks system. Uses _resolve_gateway_model() + _resolve_runtime_agent_kwargs() so the example works against custom endpoints and OAuth providers, not just the aggregator defaults that the old built-in silently assumed. Co-authored-by: teknium1 <teknium@users.noreply.github.com>

BOOT.md was merged in PR NousResearch#3733 before the feature was ready — the built-in hook spawned a bare AIAgent() with no model/runtime kwargs, which immediately 401s on any provider with a custom endpoint. Three separate community PRs (NousResearch#5240, NousResearch#12514, NousResearch#14992) tried to paper over it. Remove the BOOT.md hook entirely and its user-facing docs/tips. Keep the gateway/builtin_hooks/ package and the HookRegistry._register_builtin_hooks() hook-point intact as the extension surface for future always-on gateway hooks. Closes NousResearch#5239. Co-authored-by: teknium1 <teknium@users.noreply.github.com>

…ch#17202) Replace the removed built-in boot-md hook (NousResearch#17093) with a how-to that shows users how to wire up the same behavior themselves via the hooks system. Uses _resolve_gateway_model() + _resolve_runtime_agent_kwargs() so the example works against custom endpoints and OAuth providers, not just the aggregator defaults that the old built-in silently assumed. Co-authored-by: teknium1 <teknium@users.noreply.github.com>