feat: add Desktop Plugin Atlas

[Dannyzen]

Summary

• publish a separate source-verified evidence catalog for 121 public Hermes Desktop plugin repositories without weakening the curated data/repos.json quality bar
• add a searchable, alphabetical Desktop Plugins evidence index with distribution and Atlas-status filters, visible reviewed-commit/timestamp/source provenance, sitemap, and LLM discovery
• add a read-only GitHub verifier/refresher that parses JavaScript and TypeScript with scope-aware Babel AST analysis, binds contracts to actual @hermes/plugin-sdk imports, pins full commit SHAs, validates provenance before every write, and never executes third-party content
• package the repeatable workflow as the locally installable profiles/desktop-plugin-scout Hermes profile

Evidence boundary

source-verified means a parseable source file contained app-side @hermes/plugin-sdk evidence and a concrete registration or contribution contract at the cited immutable revision. It is not endorsement, compatibility certification, dynamic testing, maintenance assessment, or a categorical safety claim.

This is a retrospective cutoff reconstruction reviewed after 2026-08-14 17:29:59 UTC. Commit-controlled timestamps bound the inventory, but do not prove that every commit was available on GitHub by the cutoff. The catalog contains 121 repositories, 162 direct source proofs, and 3 fetched auxiliary paths explicitly excluded from entrypoint evidence. data/repos.json remains unchanged and quality-filtered.

Review improvements

• merged current upstream main; PR is conflict-free and mergeable
• changed the evidence index from star-ranked to alphabetical while preserving star ranking for curated lists
• added accessible, scoped search/filter controls with a live visible-result count
• expose each repository's reviewed commit, review timestamp, and every immutable direct source proof on the generated public page
• replaced the hand-written lexical scanner with scope-aware Babel AST analysis for JavaScript, TypeScript, JSX, and TSX; added import aliases, namespace/CommonJS bindings, shadowing, unrelated-object boundaries, exported manifests, Object.freeze, regex, and division regressions
• excluded JustaRico/HermOdy: its only pinned candidate source is syntactically invalid at the reviewed revision and current head
• removed the unavailable external CSV seed importer so the committed catalog is the only refresh source of truth
• validate the complete catalog before serialization or disk write, including malformed object shapes, observations, canonical raw URLs, exact methodology destination, and strict calendar/UTC timestamps
• clarify that --check verifies recorded known evidence paths; it does not discover arbitrary new entrypoints
• promote newly valid ignored paths without retaining stale auxiliary records
• pinned every focused third-party methodology link to its reviewed commit
• added a dedicated Node 22 Desktop evidence workflow with SHA-pinned actions, symmetric dependency-complete path triggers, contents: read, no persisted checkout credential, no Actions cache write, and npm ci --ignore-scripts
• keep the hand-reviewed data/desktop-plugins.json outside the scheduled page-build staging manifest; an unexpected catalog mutation now remains unstaged and fails the build bot guard

Verification

• independent immutable-source audit: 165/165 retained paths fetched, parsed, and matched; 0 unavailable, 0 parse errors, 0 mismatches
• Node 22 workflow parity: artifact-ownership/Desktop/verifier/DOM tests 18/18 passed; focused page/provenance tests 2/2 passed; deterministic catalog validation passed
• merged current upstream main at a4b59f05101b808447dcc8f33a0be2d6b7684a20; the only overlaps were generated lists/index.html and sitemap.xml, regenerated from the combined source
• full suite: 295/295 passed
• node scripts/validate-repos-json.js passes for 230 curated repositories
• generated Desktop artifacts reproduce exactly; syntax, whitespace, and staged secret-pattern gates pass
• isolated hermes profile install, profile update, and profile delete lifecycle passes with no residue
• Mr. Tester independently returned PASS_BOUNDED for exact tree 51c823c43b0c03dd36a852884aea9ee31a163188: 295/295 full suite, 18/18 focused Desktop/ownership, 2/2 provenance, deterministic catalog validation, no upstream reversion
• final reviewed commit: a540ec225162f287698b7fcfb8d1d02e36d85a84

Notes

The methodology recommends Hermes Desktop's built-in Context Meter when context pressure is the actual need, and evaluates third-party options by fit and authority surface rather than popularity.

The no-write current-path check correctly reports one post-cutoff evidence drift: DingJun1028/esggo moved or removed its recorded plugin path. Advancing that repository requires manual review. The checker does not claim to discover paths not already recorded.

The verifier currently has no source byte cap. The observed immutable corpus maximum is 278,031 bytes; independent QA classified this as residual verifier-availability risk, not a permissive evidence-acceptance or publication blocker.

GitHub Actions runs 32382831026 (Desktop evidence validation) and 32382831030 (preview smoke) are action_required with zero jobs on exact commit a540ec225162f287698b7fcfb8d1d02e36d85a84. They require upstream authorization and are not code-test failures. Vercel separately requires team authorization. Local Node 22 parity is not represented as a hosted CI result.

[vercel]

@Dannyzen is attempting to deploy a commit to the Kevin's projects Team on Vercel.

A member of the Team first needs to authorize it.