aean0x

pre_llm_call hook plugin, enabled with `hermes plugins enable`: injects ambient context from a GBrain instance before each turn (volunteer_context, then a hybrid-query fallback). Not a `memory.provider`. Silent no-op when GBrain is unreachable or no token is set. Disclosure — before each non-trivial turn the last six user and assistant messages (truncated) and the current message are sent with a GBRAIN_TOKEN bearer token to GBRAIN_MCP_URL (default http://127.0.0.1:3131/mcp), and returned brain-page text is injected into the turn.

Auto fetch/pull before reads, and commit + push only the files each turn changed, for every git worktree Hermes touches. Disclosure — after each turn it commits and pushes (push on by default; GIT_HOOK_PUSH=0 keeps commits local) the changed files of git worktrees under GIT_HOOK_ROOTS (default PROJECTS_ROOT, "*" for every repo), pushing to origin HEAD when no upstream is set; it pulls --ff-only before reads.

Ephemeral credential paste: request_secret asks through clarify and injects the reply over CDP, never storing it. Disclosure — the password is collected through an ordinary unmasked clarify prompt, so it is visible in CLI scrollback and stays in messaging-platform chat history; it is typed over CDP only into a page whose origin matches the requested service.