atbash-hermes-plugin 0.12.0.dev0__tar.gz → 0.15.0__tar.gz

{atbash_hermes_plugin-0.12.0.dev0/atbash_hermes_plugin.egg-info → atbash_hermes_plugin-0.15.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: atbash-hermes-plugin
-Version: 0.12.0.dev0
+Version: 0.15.0
 Summary: Atbash safety plugin for Hermes Agent
 Author: atbash
 License-Expression: Apache-2.0
@@ -11,7 +11,7 @@ Requires-Python: <3.13,>=3.9
 Description-Content-Type: text/markdown
 License-File: LICENSE
 License-File: NOTICE
-Requires-Dist: atbash-sdk<1.0.0,>=0.12.0.dev0
+Requires-Dist: atbash-sdk<1.0.0,>=0.15.0
 Requires-Dist: httpx<1,>=0.27
 Requires-Dist: opentelemetry-exporter-otlp-proto-http<2,>=1.29
 Requires-Dist: opentelemetry-sdk<2,>=1.29
@@ -294,14 +294,72 @@ repo.
 For `HOLD`, the user-facing block message is:
 
 ```text
-Action held for operator review. The agent will not be jailed — please approve or reject this request from the Atbash dashboard, then ask the agent to try again.
+Action flagged as a policy gap. The agent will not be jailed — please adjust your policy in the Atbash dashboard, then ask the agent to try again.
 Reason: <original reason from judge>
 Tool Call ID: <held judgment id, when provided by the SDK>
 ```
 
-After dashboard approval or rejection, the SDK can query held-action status with
+After the policy is adjusted in the dashboard, the SDK can query held-action status with
 the judgment ID. The Hermes plugin blocks the original tool call and asks the
-user to retry after review, rather than automatically re-running the action.
+user to retry after the policy is updated, rather than automatically re-running the action.
+
+## Guard Self-Protection And Memory Baselines
+
+- **The guard's own state is not writable by the agent.** Write tools (`write`, `edit`,
+  `multiedit`, `write_file`, `create_file`, `patch`, `apply_patch`, `str_replace_editor`,
+  `fs_write`, `notebook_edit`, and anything the tool map classes as `filesystem_write`)
+  are refused, before judging and in monitor mode too, when they target
+  `~/.config/atbash`, the configured tool map, agent key and hash baseline, a dedicated
+  key directory (such as `/opt/data/atbash`), the Hermes home's `.env`, `.op.env`,
+  `config.yaml` and `SOUL.md` (`~/.hermes`, `$HERMES_HOME`, and `%LOCALAPPDATA%\hermes` on
+  Windows), the Hermes install folder's `.env`, or the plugin's install directory. To
+  change one of these (for example your persona in `SOUL.md`), edit the file yourself;
+  the agent's write is refused even if you approve it inside Hermes. Paths are
+  compared by file identity, so hard links and case variants count. Patch tools are also
+  refused when their body names one of those paths.
+- **A memory file with no trusted baseline is blocked, and nothing is sent anywhere.**
+  A memory file is one of `AGENTS.md`, `AGENTS.override.md`, `CLAUDE.md`, `MEMORY.md`,
+  `USER.md`, `DREAMS.md`, `.hermes.md`, `HERMES.md`, `.cursorrules` (by exact name, and on
+  Windows also the spellings Windows opens as that file, such as `AGENTS.md.`), a
+  `.cursor/rules/*.mdc` file, a `.md`/`.txt` document inside a `memory/` or `memories/`
+  folder, or a file under `~/.claude/projects/` or `~/.openclaw/{workspace,memory}/`.
+  Ordinary code such as `src/memory/alloc.rs` is not memory and is judged like any other
+  file.
+  Files the guard records itself (judged writes) are trusted. For files that existed
+  before the guard (a repository's `AGENTS.md`), review them and trust them yourself,
+  outside the agent:
+
+  ```bash
+  python -m atbash_hermes_plugin seed AGENTS.md memory/notes.md
+  ```
+
+  Run it from outside the repository you are trusting, with absolute paths (for example
+  `cd ~ && python -m atbash_hermes_plugin seed /path/to/repo/AGENTS.md`): `python -m`
+  puts the current folder first on Python's import path, so a hostile repository could
+  otherwise shadow a standard module. The command itself never imports Hermes code.
+
+  It prints the baseline file it wrote. That is the one the guard reads:
+  `ATBASH_MEMORY_HASH_PATH` from your environment or from the Hermes home `.env`, else
+  `~/.config/atbash/hermes-memory-hashes.json`. Pass `--store <file>` to choose it
+  explicitly. If any file in the list cannot be read, nothing is trusted.
+
+  The guard refuses agent tool calls that look like they run the seeder (the command,
+  `seed_memory_baselines`, the baseline file's name, including quoted, variable-split or
+  base64-encoded forms). This is best effort - see the known limit below - and it also
+  refuses harmless agent calls that merely mention those names (editing these docs, a
+  grep for the command).
+
+  In Docker, point the baseline file at the mounted volume so trust survives restarts,
+  e.g. `-e ATBASH_MEMORY_HASH_PATH=/opt/data/atbash/hermes-memory-hashes.json`, and run
+  the seed command inside the container.
+- **What the guard sees:** tool calls only. Hermes loads its context files (`AGENTS.md`,
+  `.hermes.md`, `SOUL.md`, ...) into a new session's instructions without a tool call, so
+  baselines protect the agent's tool reads, and the real control on those files is that
+  agent writes to them are scanned and judged.
+- **Known limit:** the baseline file (`~/.config/atbash/hermes-memory-hashes.json`) is
+  plain JSON. The guard refuses the agent's file tools on it, but a shell command that
+  rewrites a memory file and recomputes its SHA-256 is left to the judge. Closing that
+  needs an authenticated baseline (a MAC) or state outside the agent's reach.
 
 ## Guard Self-Protection And Memory Baselines
 

{atbash_hermes_plugin-0.12.0.dev0 → atbash_hermes_plugin-0.15.0}/README.md

@@ -275,14 +275,72 @@ repo.
 For `HOLD`, the user-facing block message is:
 
 ```text
-Action held for operator review. The agent will not be jailed — please approve or reject this request from the Atbash dashboard, then ask the agent to try again.
+Action flagged as a policy gap. The agent will not be jailed — please adjust your policy in the Atbash dashboard, then ask the agent to try again.
 Reason: <original reason from judge>
 Tool Call ID: <held judgment id, when provided by the SDK>
 ```
 
-After dashboard approval or rejection, the SDK can query held-action status with
+After the policy is adjusted in the dashboard, the SDK can query held-action status with
 the judgment ID. The Hermes plugin blocks the original tool call and asks the
-user to retry after review, rather than automatically re-running the action.
+user to retry after the policy is updated, rather than automatically re-running the action.
+
+## Guard Self-Protection And Memory Baselines
+
+- **The guard's own state is not writable by the agent.** Write tools (`write`, `edit`,
+  `multiedit`, `write_file`, `create_file`, `patch`, `apply_patch`, `str_replace_editor`,
+  `fs_write`, `notebook_edit`, and anything the tool map classes as `filesystem_write`)
+  are refused, before judging and in monitor mode too, when they target
+  `~/.config/atbash`, the configured tool map, agent key and hash baseline, a dedicated
+  key directory (such as `/opt/data/atbash`), the Hermes home's `.env`, `.op.env`,
+  `config.yaml` and `SOUL.md` (`~/.hermes`, `$HERMES_HOME`, and `%LOCALAPPDATA%\hermes` on
+  Windows), the Hermes install folder's `.env`, or the plugin's install directory. To
+  change one of these (for example your persona in `SOUL.md`), edit the file yourself;
+  the agent's write is refused even if you approve it inside Hermes. Paths are
+  compared by file identity, so hard links and case variants count. Patch tools are also
+  refused when their body names one of those paths.
+- **A memory file with no trusted baseline is blocked, and nothing is sent anywhere.**
+  A memory file is one of `AGENTS.md`, `AGENTS.override.md`, `CLAUDE.md`, `MEMORY.md`,
+  `USER.md`, `DREAMS.md`, `.hermes.md`, `HERMES.md`, `.cursorrules` (by exact name, and on
+  Windows also the spellings Windows opens as that file, such as `AGENTS.md.`), a
+  `.cursor/rules/*.mdc` file, a `.md`/`.txt` document inside a `memory/` or `memories/`
+  folder, or a file under `~/.claude/projects/` or `~/.openclaw/{workspace,memory}/`.
+  Ordinary code such as `src/memory/alloc.rs` is not memory and is judged like any other
+  file.
+  Files the guard records itself (judged writes) are trusted. For files that existed
+  before the guard (a repository's `AGENTS.md`), review them and trust them yourself,
+  outside the agent:
+
+  ```bash
+  python -m atbash_hermes_plugin seed AGENTS.md memory/notes.md
+  ```
+
+  Run it from outside the repository you are trusting, with absolute paths (for example
+  `cd ~ && python -m atbash_hermes_plugin seed /path/to/repo/AGENTS.md`): `python -m`
+  puts the current folder first on Python's import path, so a hostile repository could
+  otherwise shadow a standard module. The command itself never imports Hermes code.
+
+  It prints the baseline file it wrote. That is the one the guard reads:
+  `ATBASH_MEMORY_HASH_PATH` from your environment or from the Hermes home `.env`, else
+  `~/.config/atbash/hermes-memory-hashes.json`. Pass `--store <file>` to choose it
+  explicitly. If any file in the list cannot be read, nothing is trusted.
+
+  The guard refuses agent tool calls that look like they run the seeder (the command,
+  `seed_memory_baselines`, the baseline file's name, including quoted, variable-split or
+  base64-encoded forms). This is best effort - see the known limit below - and it also
+  refuses harmless agent calls that merely mention those names (editing these docs, a
+  grep for the command).
+
+  In Docker, point the baseline file at the mounted volume so trust survives restarts,
+  e.g. `-e ATBASH_MEMORY_HASH_PATH=/opt/data/atbash/hermes-memory-hashes.json`, and run
+  the seed command inside the container.
+- **What the guard sees:** tool calls only. Hermes loads its context files (`AGENTS.md`,
+  `.hermes.md`, `SOUL.md`, ...) into a new session's instructions without a tool call, so
+  baselines protect the agent's tool reads, and the real control on those files is that
+  agent writes to them are scanned and judged.
+- **Known limit:** the baseline file (`~/.config/atbash/hermes-memory-hashes.json`) is
+  plain JSON. The guard refuses the agent's file tools on it, but a shell command that
+  rewrites a memory file and recomputes its SHA-256 is left to the judge. Closing that
+  needs an authenticated baseline (a MAC) or state outside the agent's reach.
 
 ## Guard Self-Protection And Memory Baselines
 

{atbash_hermes_plugin-0.12.0.dev0 → atbash_hermes_plugin-0.15.0}/atbash_hermes_plugin/__init__.py

@@ -18,16 +18,9 @@ from typing import Any, Dict, Iterable, Optional
 logger = logging.getLogger("atbash-hermes-plugin")
 _TELEMETRY_SHUTDOWN_REGISTERED = False
 
-try:
-    from atbash_core import redact_secrets as _redact_secrets  # type: ignore
-    _REDACT_AVAILABLE = True
-except Exception:
-    _redact_secrets = None  # type: ignore
-    _REDACT_AVAILABLE = False
-
 HOLD_MESSAGE = (
-    "Action held for operator review. The agent will not be jailed — please approve "
-    "or reject this request from the Atbash dashboard, then ask the agent to try "
+    "Action flagged as a policy gap. The agent will not be jailed — please adjust "
+    "your policy in the Atbash dashboard, then ask the agent to try "
     "again.\nReason: {reason}"
 )
 
@@ -2343,20 +2336,13 @@ class AtbashHermesGuard:
             # Redact embedded secrets before sending to the judge — mirrors SDK's
             # scanMemory → redactSecrets → judgeAction path to prevent secrets inside
             # memory content from being signed and posted to chain.
-            if not _REDACT_AVAILABLE:
-                # N-8: unredacted memory content must never be signed and
-                # posted — a broken/partial SDK is a block, not a silent send.
-                logger.warning("Atbash memory write redaction unavailable")
-                if self.fail_closed:
-                    return {
-                        "action": "block",
-                        "message": "Memory write blocked (secret redaction unavailable).",
-                    }
-                return None
             try:
-                formatted = _redact_secrets(formatted).redacted  # type: ignore
+                from atbash_core import redact_secrets  # type: ignore
+                formatted = redact_secrets(formatted).redacted
             except Exception as _re:
-                logger.warning("Atbash memory write redaction failed err=%s", _re)
+                # N-8: unredacted memory content must never be signed and
+                # posted — a broken/partial SDK is a block, not a silent send.
+                logger.warning("Atbash memory write redaction unavailable err=%s", _re)
                 if self.fail_closed:
                     return {
                         "action": "block",

{atbash_hermes_plugin-0.12.0.dev0 → atbash_hermes_plugin-0.15.0/atbash_hermes_plugin.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: atbash-hermes-plugin
-Version: 0.12.0.dev0
+Version: 0.15.0
 Summary: Atbash safety plugin for Hermes Agent
 Author: atbash
 License-Expression: Apache-2.0
@@ -11,7 +11,7 @@ Requires-Python: <3.13,>=3.9
 Description-Content-Type: text/markdown
 License-File: LICENSE
 License-File: NOTICE
-Requires-Dist: atbash-sdk<1.0.0,>=0.12.0.dev0
+Requires-Dist: atbash-sdk<1.0.0,>=0.15.0
 Requires-Dist: httpx<1,>=0.27
 Requires-Dist: opentelemetry-exporter-otlp-proto-http<2,>=1.29
 Requires-Dist: opentelemetry-sdk<2,>=1.29
@@ -294,14 +294,72 @@ repo.
 For `HOLD`, the user-facing block message is:
 
 ```text
-Action held for operator review. The agent will not be jailed — please approve or reject this request from the Atbash dashboard, then ask the agent to try again.
+Action flagged as a policy gap. The agent will not be jailed — please adjust your policy in the Atbash dashboard, then ask the agent to try again.
 Reason: <original reason from judge>
 Tool Call ID: <held judgment id, when provided by the SDK>
 ```
 
-After dashboard approval or rejection, the SDK can query held-action status with
+After the policy is adjusted in the dashboard, the SDK can query held-action status with
 the judgment ID. The Hermes plugin blocks the original tool call and asks the
-user to retry after review, rather than automatically re-running the action.
+user to retry after the policy is updated, rather than automatically re-running the action.
+
+## Guard Self-Protection And Memory Baselines
+
+- **The guard's own state is not writable by the agent.** Write tools (`write`, `edit`,
+  `multiedit`, `write_file`, `create_file`, `patch`, `apply_patch`, `str_replace_editor`,
+  `fs_write`, `notebook_edit`, and anything the tool map classes as `filesystem_write`)
+  are refused, before judging and in monitor mode too, when they target
+  `~/.config/atbash`, the configured tool map, agent key and hash baseline, a dedicated
+  key directory (such as `/opt/data/atbash`), the Hermes home's `.env`, `.op.env`,
+  `config.yaml` and `SOUL.md` (`~/.hermes`, `$HERMES_HOME`, and `%LOCALAPPDATA%\hermes` on
+  Windows), the Hermes install folder's `.env`, or the plugin's install directory. To
+  change one of these (for example your persona in `SOUL.md`), edit the file yourself;
+  the agent's write is refused even if you approve it inside Hermes. Paths are
+  compared by file identity, so hard links and case variants count. Patch tools are also
+  refused when their body names one of those paths.
+- **A memory file with no trusted baseline is blocked, and nothing is sent anywhere.**
+  A memory file is one of `AGENTS.md`, `AGENTS.override.md`, `CLAUDE.md`, `MEMORY.md`,
+  `USER.md`, `DREAMS.md`, `.hermes.md`, `HERMES.md`, `.cursorrules` (by exact name, and on
+  Windows also the spellings Windows opens as that file, such as `AGENTS.md.`), a
+  `.cursor/rules/*.mdc` file, a `.md`/`.txt` document inside a `memory/` or `memories/`
+  folder, or a file under `~/.claude/projects/` or `~/.openclaw/{workspace,memory}/`.
+  Ordinary code such as `src/memory/alloc.rs` is not memory and is judged like any other
+  file.
+  Files the guard records itself (judged writes) are trusted. For files that existed
+  before the guard (a repository's `AGENTS.md`), review them and trust them yourself,
+  outside the agent:
+
+  ```bash
+  python -m atbash_hermes_plugin seed AGENTS.md memory/notes.md
+  ```
+
+  Run it from outside the repository you are trusting, with absolute paths (for example
+  `cd ~ && python -m atbash_hermes_plugin seed /path/to/repo/AGENTS.md`): `python -m`
+  puts the current folder first on Python's import path, so a hostile repository could
+  otherwise shadow a standard module. The command itself never imports Hermes code.
+
+  It prints the baseline file it wrote. That is the one the guard reads:
+  `ATBASH_MEMORY_HASH_PATH` from your environment or from the Hermes home `.env`, else
+  `~/.config/atbash/hermes-memory-hashes.json`. Pass `--store <file>` to choose it
+  explicitly. If any file in the list cannot be read, nothing is trusted.
+
+  The guard refuses agent tool calls that look like they run the seeder (the command,
+  `seed_memory_baselines`, the baseline file's name, including quoted, variable-split or
+  base64-encoded forms). This is best effort - see the known limit below - and it also
+  refuses harmless agent calls that merely mention those names (editing these docs, a
+  grep for the command).
+
+  In Docker, point the baseline file at the mounted volume so trust survives restarts,
+  e.g. `-e ATBASH_MEMORY_HASH_PATH=/opt/data/atbash/hermes-memory-hashes.json`, and run
+  the seed command inside the container.
+- **What the guard sees:** tool calls only. Hermes loads its context files (`AGENTS.md`,
+  `.hermes.md`, `SOUL.md`, ...) into a new session's instructions without a tool call, so
+  baselines protect the agent's tool reads, and the real control on those files is that
+  agent writes to them are scanned and judged.
+- **Known limit:** the baseline file (`~/.config/atbash/hermes-memory-hashes.json`) is
+  plain JSON. The guard refuses the agent's file tools on it, but a shell command that
+  rewrites a memory file and recomputes its SHA-256 is left to the judge. Closing that
+  needs an authenticated baseline (a MAC) or state outside the agent's reach.
 
 ## Guard Self-Protection And Memory Baselines
 

{atbash_hermes_plugin-0.12.0.dev0 → atbash_hermes_plugin-0.15.0}/atbash_hermes_plugin.egg-info/requires.txt

@@ -1,4 +1,4 @@
-atbash-sdk<1.0.0,>=0.12.0.dev0
+atbash-sdk<1.0.0,>=0.15.0
 httpx<1,>=0.27
 opentelemetry-exporter-otlp-proto-http<2,>=1.29
 opentelemetry-sdk<2,>=1.29

{atbash_hermes_plugin-0.12.0.dev0 → atbash_hermes_plugin-0.15.0}/plugin.yaml

@@ -1,5 +1,5 @@
 name: atbash-hermes-plugin
-version: 0.12.0.dev0
+version: 0.15.0
 description: Atbash guardrail plugin for Hermes Agent (pre-tool-call policy enforcement)
 author: Chromia
 entry: atbash_hermes_plugin

{atbash_hermes_plugin-0.12.0.dev0 → atbash_hermes_plugin-0.15.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "atbash-hermes-plugin"
-version = "0.12.0.dev0"
+version = "0.15.0"
 description = "Atbash safety plugin for Hermes Agent"
 readme = "README.md"
 requires-python = ">=3.9,<3.13"
@@ -24,7 +24,7 @@ keywords = [
   "policy"
 ]
 dependencies = [
-  "atbash-sdk>=0.12.0.dev0,<1.0.0",
+  "atbash-sdk>=0.15.0,<1.0.0",
   "httpx>=0.27,<1",
   "opentelemetry-exporter-otlp-proto-http>=1.29,<2",
   "opentelemetry-sdk>=1.29,<2",

{atbash_hermes_plugin-0.12.0.dev0 → atbash_hermes_plugin-0.15.0}/tests/test_memory_poisoning.py

@@ -14,13 +14,6 @@ import unittest
 import unittest.mock as mock
 from pathlib import Path
 
-if "atbash_core" not in sys.modules:
-    _stub = types.ModuleType("atbash_core")
-    _stub.redact_secrets = lambda text: types.SimpleNamespace(redacted=text)
-    _stub.create_memory_snapshot = lambda entries: None
-    _stub.diff_memory_snapshots = lambda *a, **k: None
-    sys.modules["atbash_core"] = _stub
-
 _MODULE_PATH = Path(__file__).resolve().parents[1] / "atbash_hermes_plugin" / "__init__.py"
 _plugin = types.ModuleType("atbash_hermes_plugin_under_test")
 _plugin.__file__ = str(_MODULE_PATH)

{atbash_hermes_plugin-0.12.0.dev0 → atbash_hermes_plugin-0.15.0}/tests/test_pre_tool_call_verdicts.py

@@ -462,7 +462,7 @@ class LegitimateOutcomesUnchanged(unittest.TestCase):
     def test_hold_blocks_with_review_message(self):
         result = call(make_guard(decision=FakeDecision("HOLD")))
         self.assertTrue(is_blocked(result))
-        self.assertIn("held for operator review", result["message"].lower())
+        self.assertIn("flagged as a policy gap", result["message"].lower())
 
     def test_block_words_block(self):
         for verdict in ["BLOCK", "DENY", "REJECT", "DISALLOW"]:

{atbash_hermes_plugin-0.12.0.dev0 → atbash_hermes_plugin-0.15.0}/tests/test_zero_bugs_issues.py

@@ -17,13 +17,6 @@ import unittest
 import unittest.mock
 from pathlib import Path
 
-if "atbash_core" not in sys.modules:
-    _stub = types.ModuleType("atbash_core")
-    _stub.redact_secrets = lambda text: types.SimpleNamespace(redacted=text)
-    _stub.create_memory_snapshot = lambda entries: None
-    _stub.diff_memory_snapshots = lambda *a, **k: None
-    sys.modules["atbash_core"] = _stub
-
 _MODULE_PATH = Path(__file__).resolve().parents[1] / "atbash_hermes_plugin" / "__init__.py"
 _plugin = types.ModuleType("atbash_hermes_plugin_zero_bugs_issues")
 _plugin.__file__ = str(_MODULE_PATH)

{atbash_hermes_plugin-0.12.0.dev0 → atbash_hermes_plugin-0.15.0}/tests/test_zero_bugs_more.py

@@ -15,13 +15,6 @@ import types
 import unittest
 from pathlib import Path
 
-if "atbash_core" not in sys.modules:
-    _stub = types.ModuleType("atbash_core")
-    _stub.redact_secrets = lambda text: types.SimpleNamespace(redacted=text)
-    _stub.create_memory_snapshot = lambda entries: None
-    _stub.diff_memory_snapshots = lambda *a, **k: None
-    sys.modules["atbash_core"] = _stub
-
 _MODULE_PATH = Path(__file__).resolve().parents[1] / "atbash_hermes_plugin" / "__init__.py"
 _plugin = types.ModuleType("atbash_hermes_plugin_more")
 _plugin.__file__ = str(_MODULE_PATH)

{atbash_hermes_plugin-0.12.0.dev0 → atbash_hermes_plugin-0.15.0}/tests/test_zero_bugs_round.py

@@ -19,16 +19,6 @@ from pathlib import Path
 
 _ATBASH_AVAILABLE = importlib.util.find_spec("atbash") is not None
 
-# Pass-through stub so unit tests can exercise memory-write paths without the
-# real atbash-sdk installed. The SDK tests that need the real package are
-# guarded with @skipUnless(_ATBASH_AVAILABLE, ...) below.
-if "atbash_core" not in sys.modules:
-    _stub = types.ModuleType("atbash_core")
-    _stub.redact_secrets = lambda text: types.SimpleNamespace(redacted=text)
-    _stub.create_memory_snapshot = lambda entries: None
-    _stub.diff_memory_snapshots = lambda *a, **k: None
-    sys.modules["atbash_core"] = _stub
-
 _MODULE_PATH = Path(__file__).resolve().parents[1] / "atbash_hermes_plugin" / "__init__.py"
 _plugin = types.ModuleType("atbash_hermes_plugin_zero_bugs")
 _plugin.__file__ = str(_MODULE_PATH)
@@ -242,8 +232,8 @@ class SdkCapabilityAgainstRealSdk(unittest.TestCase):
 
         version = _v("atbash-sdk")
         self.assertTrue(
-            version.startswith("0.12"),
-            f"expected the current SDK line 0.12.x, got {version}",
+            version.startswith("0.15"),
+            f"expected the current SDK line 0.15.x, got {version}",
         )
         _plugin._assert_sdk_capabilities(atbash, Atbash, ToolCallInput)