Pairs this machine's Hermes bots with the AI Chipmunk mobile app from inside Hermes Desktop — pick a bot, get the reachable host, profile and API key as a scannable code. Registers a `hermes aichipmunk` CLI command, a desktop page and a dashboard API; no tools or hooks. Disclosure — on an explicit confirmed "Switch to Tailscale" it adds a persistent tailscale serve handler putting the API server's own port (plain HTTP inside the tailnet, API_SERVER_KEY auth) onto the tailnet; on a machine with no Tailscale CLI it instead runs hermes config set platforms.api_server.host <tailnet IP> on the owning profile and restarts that gateway; reads API_SERVER_KEY from every profile's .env on this machine on each status poll (masked in lists, the full key only in the pairing link and QR returned to an authenticated dashboard caller, which may be the phone over a published dashboard); shells out to the tailscale and hermes CLIs and probes only this machine's own /health; no third-party network calls.
PlatformsRead-only audit of local TLS posture — certificate validity, key strength, deprecated protocols, weak cipher suites, and the certificate each server's configuration points at. Disclosure — reads a fixed list of system certificate and nginx/Apache config paths under / (or a caller-supplied prefix); makes no network connections and runs no subprocesses. If the sibling plugin pcs-security-core is installed, its copy of the shared contract is loaded in preference to the bundled one.
Tools