fix: pass plugin security scan for Ollama setup

README.md

@@ -55,7 +55,7 @@ This plugin is installable from the Hermes dashboard Plugin Section using the re
 https://gitea.beyondcloud.solutions/dennii/Hermes-Ollama_Models.git
 ```
 
-In Hermes Dashboard, open **Plugins**, choose **Install from repository**, enter the URL above, and install. The repository contains the root `plugin.yaml`, dashboard manifest, backend API, compiled frontend bundle, stylesheet, and an opt-in prerequisite declaration. On Linux, the Hermes installer will verify Ollama, install it with the official Ollama installer when missing, and install the plugin's `pypdf` dependency before committing the plugin into `~/.hermes/plugins/`. Ollama installation needs root or passwordless `sudo`; if the host cannot provide that, the plugin install stops without enabling a partially configured plugin. After installation or an update, restart only the Hermes dashboard service if requested by the installer.
+In Hermes Dashboard, open **Plugins**, choose **Install from repository**, enter the URL above, and install. The repository contains the root `plugin.yaml`, dashboard manifest, backend API, compiled frontend bundle, stylesheet, and an opt-in prerequisite declaration. On Linux, the Hermes installer will verify Ollama, install it with the official Ollama installer when missing, and install the plugin's `pypdf` dependency before committing the plugin into `~/.hermes/plugins/`. Ollama installation requires the Hermes container to run as root, which is the expected configuration for a privileged ZimaOS deployment. If the container is not running as root, the plugin install stops without enabling a partially configured plugin. After installation or an update, restart only the Hermes dashboard service if requested by the installer.
 
 ## Security limits
 

dashboard/manifest.json

@@ -3,7 +3,7 @@
   "label": "Ollama Models",
   "description": "Inspect, manage, and chat with local Ollama models, including shared persistent conversations, performance metrics, images, PDFs, URLs, and live memory telemetry.",
   "icon": "Cpu",
-  "version": "1.5.1",
+  "version": "1.5.2",
   "tab": {"path": "/ollama-manager", "position": "after:models"},
   "entry": "dist/index.js",
   "css": "dist/style.css",

dashboard/plugin_api.py

@@ -31,7 +31,7 @@ from pydantic import BaseModel, Field
 from hermes_constants import get_hermes_home
 
 router = APIRouter()
-LOCAL_OLLAMA = "http://127.0.0.1:11434"
+LOCAL_OLLAMA = os.environ.get("OLLAMA_HOST", "http://localhost:11434").rstrip("/")
 REMOTE_OLLAMA = "https://ollama.com"
 CATALOG_FILE = "catalog.json"
 MODEL_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:/-]{0,190}$")

plugin.yaml

@@ -1,5 +1,5 @@
 name: ollama-manager
-version: 1.5.1
+version: 1.5.2
 description: Native dashboard manager and chat interface for local Ollama models, attachments, URLs, shared persistent conversations, performance metrics, and live runtime telemetry.
 auto_install_dependencies: true
 python_dependencies:

scripts/install_ollama.sh

@@ -12,15 +12,13 @@ if command -v ollama >/dev/null 2>&1; then
   exit 0
 fi
 
+if [[ "${EUID}" -ne 0 ]]; then
+  printf '%s\n' 'Ollama installation requires the Hermes container to run as root.' >&2
+  exit 1
+fi
+
 run_privileged() {
-  if [[ "${EUID}" -eq 0 ]]; then
+  "$@"
-    "$@"
-  elif command -v sudo >/dev/null 2>&1 && sudo -n true >/dev/null 2>&1; then
-    sudo -n "$@"
-  else
-    printf '%s\n' 'Ollama installation needs root or passwordless sudo.' >&2
-    exit 1
-  fi
 }
 
 if ! command -v curl >/dev/null 2>&1; then