PhiBao

GitHub profile1 plugin in the catalog

Plugins by PhiBao

1 plugins by PhiBao in the catalog, most-starred first.

PhiBaomanyhandsIdentity, memory and permissions for every person who talks to one Hermes bot. A gateway is a single-operator agent: the platform already carries sender_id and platform into every turn and nothing acts on it, so everybody in a group or a household shares the same memory, the same tools and the same approval authority. manyhands acts on it. Roles (owner, member, guest, blocked) are resolved from the platform event, never from message text, and applied as three states per tool: allow runs, ask parks the call under a four-character code and sends it to the owner's own DM, and everything else is refused with a message that names only the asker's own role. `/many approve CODE` opens a one-shot grant bound to that person and that tool, spent by the next call and expired on silence — only a human typing the slash command can approve, and nobody can approve their own ask. The operator's own MEMORY.md and USER.md blocks are withheld from everybody else's system prompt and replaced with a card about that person, because "everyone gets their own Hermes" has to include not handing a stranger your notes; each person also gets their own facts, their own token budget, and `/many pause`. Six tools (whoami, people, remember, recall, share, audit — `people` is read-only: a roster change is a human-typed verb, never a tool call) and `/many` (roster, invite, claim, add, role, tools, budget, audit, approve, deny, pause) whose owner-only verbs stay owner-only because a command's identity comes from the platform event too, so a stranger typing in the owner's own chat session is still a stranger. Identity fails closed: a session with no human turn on it — a restart, a subagent, a tool driven from the gateway socket — gets the guest allowlist, not the owner's, and a tool call in a session more than one person has spoken in is attributed by the task id the host dispatches with (or refused, never guessed from the last speaker). Every turn, tool decision, refusal, escalation, approval, spent grant and token count is an audit row you can read back. Disclosure — hooks, one middleware, six tools, the `/many` command and the `manyhands` approval transport, no other capability. pre_llm_call resolves the sender from the platform event, records the session and turn to person map, redeems `join CODE` invites and appends that person's facts to their turn; pre_tool_call applies the role to the tool allowlist, parks asks, spends grants and fails closed; post_api_request records token usage per person; an llm_request middleware rewrites the outgoing provider request for non-owners, removing the operator's memory blocks and injecting the person card. One SQLite file under plugin-data/manyhands (people, facts, shared facts, invites, approvals, sessions, settings, audit) holding sender ids as platform:sender_id, roster names you set, the facts people store and the audit trail; `/many remove` deletes a person and their facts. Reads no other file on disk, runs no command, makes no network call, imports nothing outside the Python standard library and calls no model. Approval prompts are delivered through the host's own gateway injection into the owner's DM, which the host records as a turn in that chat.Communitytools