hermes - 💡(How to fix) Fix [workflow-engine] chore: manifest gaps, side-effectful register(), dead code, unauth kanban dispatch

Severity: MEDIUM (convention cleanup bundle)

Several convention divergences from upstream NousResearch plugin standards. Bundled.

WE-5: plugin.yaml manifest gaps

plugins/workflow-engine/plugin.yaml:1-6 — version: 0.1.0 unquoted (upstream quotes semver); no pip_dependencies though code imports httpx, fastapi, pyyaml; no requires_env; no hooks:. Violates rubric #1. Fix: quote version, declare pip_dependencies, add requires_env: [].

WE-6: register() is not side-effect-free

plugins/workflow-engine/__init__.py:35 and dashboard/plugin_api.py:37 — register() eagerly calls get_engine() which opens SQLite, runs migrations, seeds defaults, and writes a manifest (heavy I/O). Module-level _engine = get_engine() does the same at import. Violates rubric #2 (register must be thin / no I/O / no client init). Fix: defer engine construction to first request/tool call; the _shared singleton already supports lazy init.

WE-7: dead temp-file path in script node

plugins/workflow-engine/engine/nodes/script.py:132-151 — use_temp is set True at 134 then unconditionally reset to False in both inline branches (137-138, 142). The temp-file block (145-151) is unreachable; the finally unlink (174-179) never fires. Fix: remove the dead path, or fix the inline bun/uv branches to use it where intended.

WE-8: unauthenticated internal kanban dispatch

plugins/workflow-engine/engine/dispatcher/kanban.py:21, 103-104 — POSTs to hardcoded http://127.0.0.1:8642/api/plugins/kanban/tasks with no auth header. If the gateway enforces session auth on plugin APIs this 401s; if not, it's an unauthenticated internal call surface. Fix: forward the gateway session token, or document why localhost-only is acceptable.

Filed from opus-4.8 plugin audit (workflow-engine).