GitHub profilePlugins by percyhendrux123-prog
5 plugins by percyhendrux123-prog in the catalog, most-starred first.
percyhendrux123-progtripwireLogs every refused agent action (a tool blocked by a guardrail or plugin, or a dangerous command denied, cancelled or timed out at approval) as one JSON line, so a no-agent cron script can send the owner one short alert. Observer only, fails open. Disclosure — appends one JSON line per refused action to ~/.hermes/tripwire/events.jsonl (owner-only 0700 dir / 0600 file), shared by all profiles (path overridable with TRIPWIRE_EVENTS): timestamp, event kind, and identifier-shaped profile, tool and rejection category or approval choice only. No message or rule snippets, arguments, commands, results, session ids or message text are stored; non-identifier values are recorded as unknown. A pre_tool_call hook reads ~/.hermes/tripwire/TEST_BLOCK and, only while that file exists, blocks the single tool it names for the single profile it names (a drill switch to prove the alarm). No network calls, no shell commands, no background processes, no stored credentials, no telemetry.Communitytools1percyhendrux123-proghermes-axiom-agentAdds the nine-article Axiom Doctrine as pre_llm_call context (compact form capped at 1800 characters, full at 4000, owner additions separately at 800) and a /doctrine command that reports, per article, whether a matching enforcer plugin (standing, hermes-axioma, tripwire, handydandy, hermes-gatekeeper) is loaded and enabled. Enforces nothing itself: no tools, middleware or approval hooks, and ENFORCED means an enforcer is loaded and enabled, not verified coverage. Reads an optional owner additions file and only the top-level name line of user-plugin manifests, without following symlinked files; makes no writes, network, subprocess or model calls. No Python dependencies.Communityautomationpercyhendrux123-proghermes-axiomaInline signal color in the agent's normal reply. The agent marks the few phrases that deserve a second look (stop, caution, go, whisper) and the plugin renders them per surface with color, a style cue and a word, never color alone: Desktop through KaTeX color, CLI/TUI through truecolor ANSI, Telegram/Discord/Slack as bold plus the word, SMS and email as the word only. Green renders only when a tool call Hermes reported as successful in this session backs it; a rarity budget caps marks per reply; in completed replies Axioma transforms, malformed tags in prose are removed when a recognized tag is present; malformed-only replies, preserved code and raw tags during streaming can still show brackets. A color-vision-safe palette and a style-and-words-only mode are one setting away. Secondary: an advisory card (intent, light, signal, question) staged before configured send/spend/spin/scrub tool calls and shown through Hermes's own approval prompt. Each card and notice carries a short card code (a keyed hash of the exact text shown, the tool, its arguments and the card id), logged when shown and again with the answer; /signals verify <code> reports in plain words whether what was staged, shown and answered line up (spec section 5.6, shown equals staged). Advisor, not a gate: it never blocks, approves or executes anything. Disclosure — before configured send/spend/spin/scrub tool calls (by default send_message, email/post/publish tools, payment/checkout tools, cron and kanban creation, delegate_task, terminal deploy and git push/gh pr commands, and terminal rm/mv when no workspace is configured) it escalates the call to Hermes's own approval prompt with an advisory card, using a fresh rule key each time so remembered Session/Always approvals never skip later prompts; under cron and other unattended runs Hermes's approval policy (default deny) then refuses those calls; it never auto-approves or executes anything, makes no network, model or subprocess calls, reads credentials only as presence checks through agent.secret_scope, adds a short markup guide to the system context through pre_llm_call, rewrites the agent's reply text to render the marks, and writes metadata, salted span hashes and keyed card-code digests (no message bodies) to an owner-only SQLite file plus a separate owner-only key file under its own plugin data directory. Optional operator-configured preflights probe file-presence metadata for required SKILL.md paths under external skill roots and lstat metadata for external device-lock paths; the policy resolves configured workspace/output roots and candidate remove/move paths, including symlinks, for containment checks, without reading those files' contents. Pasted-card verification optionally imports undocumented gateway.platforms.base_exec_approval text helpers and agent.i18n.t behind one compatibility function to recognize localized host framing, falling back to built-in English text if they are absent or change; it neither inspects approval state nor overrides approval. The card-code key must be owner-only; if its permissions cannot be confirmed, durable verification is refused.Communitytoolspercyhendrux123-proghermes-gatekeeperGatekeeper enforces rules the owner configures; not legal advice and not a compliance guarantee. A deterministic pre_tool_call gate for recognized outbound sends: literal `hermes send` and `imsg send` terminal commands (including terminal calls made from execute_code), and a send_message call if one ever traverses the hook, are checked in full. Hermes registers no model-callable send_message tool. Other tools whose names look like a send (connectors__*, mcp tools, plain names, and a cronjob_manage create/update/run with a delivery target) are not parsed: they only require owner approval, because consent, STOP and quiet hours cannot be checked for them. Browser and computer-use driving of an app and scripts that send through a subprocess are not inspected. Rules: absolute suppression, per-channel consent and recipient-local quiet hours (block), and native Hermes approval requests for unanswered threads, minimum gaps and unapproved wording (the host auto-approves these under --yolo, approvals off and hermes -z). Uses the public post_gateway_admission hook to record observed STOP keywords and DM replies (excludes control, approval, steering and slash-command traffic). Reads tool arguments, results and normalized inbound snapshots; writes only profile-local SQLite (owner-only permissions) with recipient/thread hashes, message SHA-256, decision metadata, consent source/date, timezone/region and owner template variables. No raw message-body log; hashes are not anonymity. No network, subprocess, model calls, telemetry, credential reads, external file scans or core patches. Invalid settings or storage errors block recognized sends. Disclosure — gates only the outbound sends it recognizes (literal `hermes send` / `imsg send` terminal commands and send_message calls) and asks owner approval for other send-looking tools; a whole-message STOP, STOPALL, UNSUBSCRIBE, CANCEL, END or QUIT from any admitted gateway sender silently suppresses that sender and is consumed without reaching the agent or getting a reply; a storage or inbound-observation failure blocks every recognized send until the owner repairs records and reloads; writes only a profile-local SQLite ledger of hashes and decision metadata, with no network, subprocess or credential access.Communityautomationpercyhendrux123-proghermes-standingEarned trust for Hermes workers. Each profile has a level (L0 read, L1 draft, L2 act, L3 trusted) that decides which tool calls need the owner's approval, and a local record of checks that held up and checks that did not. A worker can always report on its own card (block, comment, request review, heartbeat), but it cannot mark the task done on its word: kanban_complete is blocked until the task has a passing standing_proof in the same session, and Standing runs that check itself (owner-scoped file, owner-allowlisted HTTP URL, or exact owner-allowlisted read-only command). Ten clean passes raise a level (capped at L1 automatically; L2 needs the owner's explicit opt-in); one failed check lowers it; a check that could not run is logged as unavailable and changes nothing. Seeds only create new actors, so restarts never undo a demotion. /standing shows the record, /standing log the last events, and /standing set (local owner only) changes a level. Optional same-machine shared ledger for a governor and its workers, and a short score line on the task card after a completion or demotion. Disclosure — pre_tool_call returns Hermes' own approve directive for every tool call outside the profile's level (at the default L1 that includes every terminal/shell, send and unknown-tool call) and blocks kanban_complete until a Standing proof passes in the same session; a worker's block/comment/review/heartbeat calls on its own assigned card skip the Standing prompt; under cron and other unattended runs Hermes' approval policy (default deny) decides; it adds a guidance note to the model context through pre_llm_call; it never auto-approves or calls a model, and makes network or subprocess calls only for owner-scoped proofs (HTTP GET with no redirects, proxies or credentials; exact allowlisted argv, shell=False, minimal environment); it stores actors and hashed proof events in SQLite under its plugin data directory (or an owner-set db_path) and, when card_line is on, posts task-card comments through the public kanban_comment tool.Communityautomation
