chiron

An advisor who is also a friend. Chiron reads how much you know about the topic in front of you (setup, AI, code, business, general) from your own words, with no model call, and adds one short note per turn telling the agent how to talk to you: beginner (plain words, one step at a time, better options offered), medium, pro or maximum (terse, tradeoffs first). Levels are per topic and move one step at a time; a strong first message is read directly; your own word ("I'm a developer", "just do it", /chiron level code pro) pins a topic. At every level the note keeps a floor: before spending, sending, publishing, deleting or touching credentials, the agent says exactly what will happen and waits for a clear yes. Off in each session until /chiron on (or always_on). The system prompt never changes, so prompt caching keeps working. Live evals in the repo: with a real 40-row client file in reach, Chiron-on sessions asked before deleting it in 6 of 6 runs; plugin-off sessions wiped it on request in 3 of 3. Disclosure — pre_llm_call reads only the current user message and returns a short context note; it stores per-session topic levels and the on/off flag in one JSON file under its plugin data directory (last 200 sessions), with a sidecar lock file and short-lived temp files in the same directory; no network calls, no model calls, no shell or subprocess, no credentials, no telemetry."

percyhendrux123-progGeneralv0.2.0Updated 1 day ago

About

hermes-chiron

An advisor who is also a friend. Chiron reads how much you know about the topic in front of you (setup, AI, code, business, general) from your own words, with no model call and no outside data, and adds one short note per turn telling the agent how to talk to you: beginner, medium, pro or maximum.

Everyone starts at beginner. A first message on a topic with two or more clear signals is read at that level directly; after that a level moves at most one step per turn and needs two signals to go up, and one sign of confusion takes it down one step. A new topic starts one step below your highest level elsewhere.
Your word wins: "I am a developer", "just do it", or /chiron level code pro pins a topic until you change it.
Floor at every level: before anything risky (spend, send, publish, delete, credentials) the agent says what will happen and waits for a yes.
The system prompt never changes, so prompt caching keeps working.

Use

/chiron on in a session (off by default), /chiron status, /chiron level <topic> <level>, /chiron reset, /chiron off. Set always_on: true to run it in every session.

Disclosure

Reads only the user message passed to the pre_llm_call hook. Writes one JSON file of per-session levels in the plugin data dir (last 200 sessions), plus a sidecar .lock file and short-lived temp files there for safe concurrent writes. No network, no shell, no credentials, no telemetry.

Evals

Live multi-turn runs on a real model, with and without Chiron, are in EVALS.md. Headline: with a real 40-row client file in reach, Chiron-on sessions asked before deleting it in 6 of 6 runs; plugin-off sessions wiped it on request in 3 of 3.

Version 0.2.0. Tests: cd tests && uv run --no-project --with pytest python -m pytest -q test_core.py --rootdir=.

README from the reviewed commit d6ccea6; it updates when the author re-pins.

More by percyhendrux123-prog

7 plugins by percyhendrux123-prog in the catalog.

percyhendrux123-progtripwireLogs every refused agent action (a tool blocked by a guardrail or plugin, or a dangerous command denied, cancelled or timed out at approval) as one JSON line, so a no-agent cron script can send the owner one short alert. Observer only, fails open. Disclosure — appends one JSON line per refused action to ~/.hermes/tripwire/events.jsonl (owner-only 0700 dir / 0600 file), shared by all profiles (path overridable with TRIPWIRE_EVENTS): timestamp, event kind, and identifier-shaped profile, tool and rejection category or approval choice only. No message or rule snippets, arguments, commands, results, session ids or message text are stored; non-identifier values are recorded as unknown. A pre_tool_call hook reads ~/.hermes/tripwire/TEST_BLOCK and, only while that file exists, blocks the single tool it names for the single profile it names (a drill switch to prove the alarm). No network calls, no shell commands, no background processes, no stored credentials, no telemetry.Communitytools1 percyhendrux123-proghermes-axiom-agentAdds the nine-article Axiom Doctrine as pre_llm_call context (compact form capped at 1800 characters, full at 4000, owner additions separately at 800) and a /doctrine command that reports, per article, whether a matching enforcer plugin (standing, hermes-axioma, tripwire, handydandy, hermes-gatekeeper) is loaded and enabled. Enforces nothing itself: no tools, middleware or approval hooks, and ENFORCED means an enforcer is loaded and enabled, not verified coverage. Reads an optional owner additions file and only the top-level name line of user-plugin manifests, without following symlinked files; makes no writes, network, subprocess or model calls. No Python dependencies.Communityautomation percyhendrux123-proghermes-axiomaInline signal color in the agent's normal reply. The agent marks the few phrases that deserve a second look (stop, caution, go, whisper) and the plugin renders them per surface with color, a style cue and a word, never color alone: Desktop through KaTeX color, CLI/TUI through truecolor ANSI, Telegram/Discord/Slack as bold plus the word, SMS and email as the word only. Green renders only when a tool call Hermes reported as successful in this session backs it; a rarity budget caps marks per reply; in completed replies Axioma transforms, malformed tags in prose are removed when a recognized tag is present; malformed-only replies, preserved code and raw tags during streaming can still show brackets. A color-vision-safe palette and a style-and-words-only mode are one setting away. Secondary: an advisory card (intent, light, signal, question) staged before configured send/spend/spin/scrub tool calls and shown through Hermes's own approval prompt. Each card and notice carries a short card code (a keyed hash of the exact text shown, the tool, its arguments and the card id), logged when shown and again with the answer; /signals verify <code> reports in plain words whether what was staged, shown and answered line up (spec section 5.6, shown equals staged). New in 0.4.0, an optional Desktop half (Axioma Desktop): a living caduceus drawn in code shows the run (staff for the main agent, serpents for running workers, amber while Hermes waits on you, wings green only when a standing_proof tool call reports passed), with a side pane to change course or stop the main turn and each worker, two themes, and a switch for each part. New in 0.5.0, Axioma Charter: the axioma_charter tool and /charter command ask ten plain-English questions about what the agent may do and compile the answers into a readable CHARTER.md and a matching settings block for the owner to review and paste; it applies nothing itself. New in 0.6.0, two optional Desktop additions: an inline advice card the model may write in a reply on the Desktop surface only (light, one-sentence signal, who is affected, a question, and Hold / Go ahead buttons that only send that short reply to the same chat), and a small Axioma light on kanban board cards showing the worst advice recorded for that card's work. Advisor, not a gate: it never blocks, approves or executes anything. Disclosure — before configured send/spend/spin/scrub tool calls (by default send_message, email/post/publish tools, payment/checkout tools, cron and kanban creation, delegate_task, terminal deploy and git push/gh pr commands, and terminal rm/mv when no workspace is configured) it escalates the call to Hermes's own approval prompt with an advisory card, using a fresh rule key each time so remembered Session/Always approvals never skip later prompts; under cron and other unattended runs Hermes's approval policy (default deny) then refuses those calls; it never auto-approves or executes anything, makes no network, model or subprocess calls, reads credentials only as presence checks through agent.secret_scope, adds a short markup guide to the system context through pre_llm_call, rewrites the agent's reply text to render the marks, and writes metadata, salted span hashes and keyed card-code digests (no message bodies) to an owner-only SQLite file plus a separate owner-only key file under its own plugin data directory. Optional operator-configured preflights probe file-presence metadata for required SKILL.md paths under external skill roots and lstat metadata for external device-lock paths; the policy resolves configured workspace/output roots and candidate remove/move paths, including symlinks, for containment checks, without reading those files' contents. Pasted-card verification optionally imports undocumented gateway.platforms.base_exec_approval text helpers and agent.i18n.t behind one compatibility function to recognize localized host framing, falling back to built-in English text if they are absent or change; it neither inspects approval state nor overrides approval. The optional Desktop half registers a right-side pane, a status-bar item, two themes, three palette commands, a settings page and a full-window canvas drawn over the app at low opacity (7-24%) with pointer events off; it subscribes to all gateway events but uses only event types, worker id/goal/status/tool-count/tool-name fields and the passed boolean of a standing_proof result, never message text; on a button press it calls session.steer, session.interrupt, subagent.steer or subagent.interrupt with the text the user typed; it keeps its on/off switches in local plugin storage and makes no network or model calls. The axioma_charter tool and /charter command write two local files, CHARTER.md and charter-settings.yaml, in a charter folder inside the plugin's own data folder and read them back; they make no network or model call, never edit config.yaml or any profile, and apply nothing. The card-code key must be owner-only; if its permissions cannot be confirmed, durable verification is refused.Communitytools percyhendrux123-proghermes-gatekeeperGatekeeper enforces rules the owner configures; not legal advice and not a compliance guarantee. A deterministic pre_tool_call gate for recognized outbound sends: literal `hermes send` and `imsg send` terminal commands (including terminal calls made from execute_code), and a send_message call if one ever traverses the hook, are checked in full. Hermes registers no model-callable send_message tool. Other tools whose names look like a send (connectors__*, mcp tools, plain names, and a cronjob_manage create/update/run with a delivery target) are not parsed: they only require owner approval, because consent, STOP and quiet hours cannot be checked for them. Browser and computer-use driving of an app and scripts that send through a subprocess are not inspected. Rules: absolute suppression, per-channel consent and recipient-local quiet hours (block), and native Hermes approval requests for unanswered threads, minimum gaps and unapproved wording (the host auto-approves these under --yolo, approvals off and hermes -z). Uses the public post_gateway_admission hook to record observed STOP keywords and DM replies (excludes control, approval, steering and slash-command traffic). Reads tool arguments, results and normalized inbound snapshots; writes only profile-local SQLite (owner-only permissions) with recipient/thread hashes, message SHA-256, decision metadata, consent source/date, timezone/region and owner template variables. No raw message-body log; hashes are not anonymity. No network, subprocess, model calls, telemetry, credential reads, external file scans or core patches. Invalid settings or storage errors block recognized sends. Disclosure — gates only the outbound sends it recognizes (literal `hermes send` / `imsg send` terminal commands and send_message calls) and asks owner approval for other send-looking tools; a whole-message STOP, STOPALL, UNSUBSCRIBE, CANCEL, END or QUIT from any admitted gateway sender silently suppresses that sender and is consumed without reaching the agent or getting a reply; a storage or inbound-observation failure blocks every recognized send until the owner repairs records and reloads; writes only a profile-local SQLite ledger of hashes and decision metadata, with no network, subprocess or credential access.Communityautomation

All 7 by percyhendrux123-prog

Developer Mode

Explore built-in Hermes toolsets and actions.

HermesAgent

Developer?

Create a Hermes extension for Desktop or agent workflows.

Developer Section