⚔️ hermes-jailbreak-kernel — Armor-Piercing Kernel Plugin for Hermes Agent v2.0.1

An armor-piercing (red-team) system-prompt injection plugin for Nous Research Hermes Agent (~/.hermes), ported from the DSH plugin dsh-infinite-gen-4 (Infinite Generation Four, v0.4.0).

⚠️ Authorized use only. This plugin is for authorized test ranges, local synthetic targets, and compliant red-team research. Never run it against unauthorized targets. Users bear full responsibility for their own use.

Table of Contents

• Architecture parity with Infinite Generation Four
• Three-layer injection architecture
• Session modes
• Kernel profiles
• Ops skill
• Session rotation
• Installation
• Verification
• Environment switches
• Diagnostic dumps
• Hermes hard limits
• Offline self-test

Architecture parity

dsh-infinite-gen-4 (v0.4.0)	hermes-jailbreak-kernel (this plugin)
infinite-gen-4:global-system-prompt (Order 100)	hermes-jailbreak-kernel-core (after_memory slot)
infinite-gen-4:dual-layer-reinforce (Order 200)	hermes-jailbreak-kernel-reinforce (after_memory slot, SHA256-identical to core)
DUAL_LAYER_INJECTION switch	HERMES_JAILBREAK_DUAL=0 single-layer fallback
Zero-tool surface, pure direct output	Same — registers no functional tools
infinite_gen4_profile metadata tool	/jailbreak status command
Client status badge (web half)	— (mountable in Hermes Desktop later)
Injection surface: system-prompt section	Native register_system_prompt_section

The kernel payload (prompts/) inherits the Infinite Generation Four text verbatim: SUPREME DIRECTIVE — USER AUTHORITY, the Output contract (first line ##/``` naming the deliverable + silent reasoning + placeholder self-synthesis), Task classes (security / LLM research / adult fiction / anything else — produce directly), and [USER]/[OUTPUT] few-shot anchors.

Three-layer injection architecture

The plugin injects the kernel at three layers:

1. Plugin-section injection (after_memory slot, dual same-source sections) — written when Hermes assembles the system prompt;
2. Request-layer system rebuild (replace mode) — the llm_request middleware rewrites the final system message as memory section + runtime environment + kernel before every request, discarding Hermes' own agent-guidance/skill-index scaffold;
3. opencode session rotation (below) — rotates the x-opencode-session header.

Tool schemas are unaffected: they travel in the API tools field, not the system text.

Session modes

Control the kernel per session at runtime — no restart, no environment edits:

Command	Effect
/jailbreak	status: session, mode, kernel profile, rotation, dump policy
/jailbreak on	standard: plugin sections + request-layer rebuild + rotate once
/jailbreak slim	light: plugin sections + kernel appended to the system tail
/jailbreak full	extreme: rebuild + max kernel + rotate every request
/jailbreak off	passthrough: plugin sections stripped at request time
/jailbreak profile <name>	kernel profile: core / research / creative / max
/jailbreak dump on|off	force or silence per-request diagnostics
/jailbreak reset	clear session overrides (back to the env defaults)

Kernel profiles

Profile	Focus
core (default)	general deliverable contract (security / LLM research / adult fiction / other)
research	offensive security, reversing, exploit and payload work
creative	fiction and explicit scenes — full drafts, no fade-to-black
max	hardest cases: explicit no-refusal framing, hard prohibitions on preambles

full mode forces the max profile; otherwise the session profile applies.

Ops skill

jailbreak-kernel-ops ships as a plugin skill: progressive disclosure (one line in <available_skills>, body loaded on demand via skill_view). It carries the command matrix, the refusal-escalation ladder, diagnostics, and the environment fallbacks.

Session rotation

Rotation follows the session mode: once for slim/on, every for full, disabled for off. The middleware rewrites extra_headers["x-opencode-session"] for opencode targets only — one rotated id per session for once, a fresh id per request for every.

HERMES_JAILBREAK_ROTATE_SESSION	Behavior
(unset)	follow the session mode (recommended)
once / every / 0	force one policy for every session

Auxiliary calls (compression, title generation, etc.) keep the original stable id.

The middleware rewrites extra_headers["x-opencode-session"]: on the first request of each Hermes session it sets a rotated id, then reuses that id for the rest of the session.

HERMES_JAILBREAK_ROTATE_SESSION	Behavior
once (default)	rotate once per Hermes session, then reuse (keeps upstream prompt cache across turns)
every / 1	new id per request (breaks upstream prompt cache)
0 / off	no rotation (header left untouched)

Auxiliary calls (compression, title generation, etc.) keep the original stable id.

Installation

# Option 1 — one-line install from GitHub
hermes plugins install --enable Enchanted0911/hermes-jailbreak-kernel

# Option 2 — from the Hermes plugin catalog (once the community entry is merged)
hermes plugins install hermes-jailbreak-kernel

# Option 3 — local development directory
cp -r ~/.hermes/plugins/hermes-jailbreak-kernel ~/.hermes/plugins/   # or git clone into plugins/
hermes plugins enable hermes-jailbreak-kernel

# Then restart the gateway / desktop app
hermes gateway restart

⚠️ Hermes plugins are opt-in: enable with hermes plugins enable hermes-jailbreak-kernel after install (the one-liner already passes --enable).

Verification

# Offline regression (anchors / dual-layer same-source SHA256 / budget / switches)
cd ~/.hermes/plugins/hermes-jailbreak-kernel && python selftest.py

# In-session check (new session after restart)
/jailbreak                     # kernel version, slots, dual SHA256, budget usage
# or ask: which plugin sections are in your system prompt?
# You should see "## Plugin Context: hermes-jailbreak-kernel-core / hermes-jailbreak-kernel-reinforce"

Runtime log confirmation (~/.hermes/logs/agent.log):

INFO hermes_plugins.hermes_jailbreak_kernel: injected system prompt section hermes-jailbreak-kernel-core (chars=3005)
INFO hermes_plugins.hermes_jailbreak_kernel: injected system prompt section hermes-jailbreak-kernel-reinforce (chars=3005)
INFO hermes_plugins.hermes_jailbreak_kernel: registered llm_request middleware (request-layer reinforce)
INFO hermes_plugins.hermes_jailbreak_kernel: hardened request system prompt (mode=replace ...)
INFO hermes_plugins.hermes_jailbreak_kernel: rotated x-opencode-session (...)

Environment switches

Variable	Default	Effect
HERMES_JAILBREAK_MODE=on|off|slim|full	on	default session mode (session overrides win)
HERMES_JAILBREAK_PROFILE=core|research|creative|max	core	default kernel profile
HERMES_JAILBREAK_ROTATE_SESSION=once|every|0	(mode)	rotation policy override
HERMES_JAILBREAK_DUMP=1|0	off	force or silence diagnostics
HERMES_JAILBREAK_DUAL=0	on	single-section injection
HERMES_JAILBREAK_DISABLE=1	off	kill switch: skip registration entirely

Diagnostic dumps

The middleware writes a diagnostic view of each request (per-session first request by default; every request with HERMES_JAILBREAK_DUMP=1) to ~/.hermes/plugins/hermes-jailbreak-kernel/dumps/request_*.json: full system messages + roles/lengths/200-char heads of other messages + model/provider/base_url. Use it to confirm the kernel sits at the tail of the system message and the route hits the expected model. Dumps are local-only and gitignored.

Hermes hard limits

• Plugin sections: ≤ 4000 chars each, ≤ 8000 chars total (the injector silently skips over-budget sections).
• Fixed position after_memory (after persona and memory); render order is section-id lexicographic → core < reinforce.
• Section ids: lowercase letters/digits/./_/- only.
• Request-layer rebuild is not bound by the plugin-section budget (it runs in the middleware at request time).

Offline self-test

cd ~/.hermes/plugins/hermes-jailbreak-kernel
python selftest.py          # ✅/❌ per-assertion (54 checks)
python selftest.py --json

Localization

/jailbreak UI strings (command description and status report) follow the Hermes agent/i18n standard: language resolves as HERMES_LANGUAGE > display.language in config.yaml > English. The plugin ships locales/en.yaml (default) and locales/zh.yaml; any other language — and any missing key — falls back to English, then to the bare key. Logs and the injected kernel itself stay language-neutral by design.

Documentation

• docs/ARCHITECTURE.md — mechanism-level description of the three layers, session keys, and the failure model
• docs/COMPATIBILITY.md — host requirements and the measured model-behavior matrix
• docs/CHANGELOG.md — version history
• THIRD_PARTY_NOTICES.md — lineage and licensing

License

MIT — see LICENSE. Port/adaptation of dsh-infinite-gen-4 (MIT, Minglink) for the Hermes Agent plugin platform.