Hermes Agent Setup and Cloaking

Status: ✅ Shipped

Prismor supports Hermes Agent in two separate layers:

Runtime hooks via prismor install-hooks --agent hermes
Secret cloaking via prismor cloak install --agent hermes

This doc covers the tested setup path, verification, and cloaking behavior.

Setup

1. Install runtime hooks

For a repo-local install, prefer project scope so the registration lives inside the workspace:

prismor install-hooks --agent hermes --scope project --mode enforce
cat .hermes/plugins.json

Expected plugins.json:

{
  "plugins": [
    "/abs/path/to/your/repo/prismor/runtime/hermes-plugin"
  ]
}

This is the runtime-monitoring layer. It is separate from cloaking.

2. Install cloaking

Project scope:

prismor cloak install --agent hermes --scope project

User scope:

prismor cloak install --agent hermes --scope user

# Option A: pip install + auto-discovery (recommended)
pip install prismor

# Register your first secret
prismor cloak add stripe_key

# Option B: explicit filesystem install
pip install prismor
prismor cloak install --agent hermes --scope user

# Install for both Claude Code + Hermes in one command
prismor cloak install --agent all

3. Verify

prismor cloak status --scope project

Expected output:

CLOAKING
──────────────────────────────────────────────────
Claude Code:    installed
Config:         ~/.claude/settings.json
Events:         UserPromptSubmit, PreToolUse, PostToolUse
Hermes Agent:   installed
Plugin dir:     ./.hermes/plugins/prismor-cloak/
Hooks:          pre_tool_call, transform_terminal_output, transform_tool_result, pre_gateway_dispatch
Secrets dir:    ~/.prismor/secrets/
Registered:     1 placeholder(s)

Two important notes:

prismor cloak status does not take an --agent flag; it reports both Claude and Hermes together.
On a tested Ubuntu host, both prismor install-hooks --agent hermes --scope project --mode enforce and prismor cloak install --agent hermes --scope project completed successfully and cleanly uninstalled.

4. Uninstall

prismor uninstall-hooks --agent hermes --scope project
prismor cloak uninstall --agent hermes --scope project

OpenClaw and Hermes Side By Side

OpenClaw and Hermes use the same high-level pattern for runtime hooks:

prismor install-hooks --agent openclaw --scope project --mode enforce
prismor install-hooks --agent hermes --scope project --mode enforce

Expected generated files:

cat .openclaw/plugins.json
cat .hermes/plugins.json

Expected contents:

{ "plugins": ["/abs/path/to/your/repo/prismor/runtime/openclaw-plugin"] }
{ "plugins": ["/abs/path/to/your/repo/prismor/runtime/hermes-plugin"] }

That is the verified project-scoped setup path for both agents.

Architecture

                            HERMES AGENT
  ┌─────────────────────────────────────────────────────────────┐
  │                                                             │
  │  Gateway (Telegram)  →  Agent (LLM)  →  Tools (shell/fs)   │
  │        │                   │                   │            │
  │        ▼                   ▼                   ▼            │
  │  ┌──────────┐      ┌────────────┐      ┌──────────────┐    │
  │  │pre_gw    │      │pre_tool    │      │transform_    │    │
  │  │dispatch  │      │call        │      │terminal_out  │    │
  │  └──────────┘      └────────────┘      └──────────────┘    │
  └─────────────────────────────────────────────────────────────┘
        │                       │                    │
        ▼                       ▼                    ▼
  ┌──────────────┐     ┌──────────────┐      ┌──────────────┐
  │ Paste guard  │     │ Decloak      │      │ Scrub output │
  │ Detect raw   │     │ Substitute   │      │ Replace real │
  │ secrets in   │     │ @@SECRET@@   │      │ values with  │
  │ user prompts │     │ → real value │      │ placeholders │
  │ Auto-vault   │     │ at exec time │      │ before model │
  └──────────────┘     └──────────────┘      └──────────────┘

Hooks

Hook	Phase	What it does
`pre_gateway_dispatch`	Before any user message reaches the LLM	Detects raw secrets in pasted prompts, auto-vaults them, replaces with `@@SECRET:auto_xxx@@`, re-sends sanitized prompt
`pre_tool_call`	Before a tool executes	Substitutes `@@SECRET:name@@` with real value; detects and blocks raw secrets in tool arguments, auto-vaults them
`transform_terminal_output`	After shell command output	Scans stdout/stderr for raw secret values, replaces them with `@@SECRET:name@@` before the model sees the result
`transform_tool_result`	After any tool result	Same scrub logic as transform_terminal_output but covers all tool result types

Everyday Use

The flow is fully automatic — you mostly do nothing:

Paste a secret into Telegram → the pre_gateway_dispatch hook detects it, vaults it, and re-sends the sanitized version. The agent only sees @@SECRET:auto_xxxx@@.
The agent emits a raw secret in a command → pre_tool_call denies the call, vaults the value, and tells the agent to use the placeholder.
The agent uses a placeholder → pre_tool_call substitutes the real value at execution time; transform_terminal_output scrubs it back out of the output.
You can bypass the paste guard by prefixing the message with !!allow .

Integration Details

Plugin Discovery

Hermes discovers the cloaking plugin via two mechanisms:

pip install prismor
        │
        ▼
  Hermes auto-discovers
  entry_point "hermes_agent.plugins"     ◄── Prefer this
  → prismor.runtime.cloaking.hermes_plugin_entry
        │
        └── If not found (e.g. dev install):
            ┌───────────────────────────┐
            │ Filesystem fallback       │
            │ ~/.hermes/plugins/        │
            │   prismor-cloak/          │
            │     plugin.yaml           │
            │     __init__.py           │
            └───────────────────────────┘

Entry Point

Registered in pyproject.toml:

[project.entry-points."hermes_agent.plugins"]
prismor-cloak = "prismor.runtime.cloaking.hermes_plugin_entry:register"

Plugin Manifest

# prismor/runtime/cloaking/hermes-plugin/plugin.yaml
name: prismor-cloak
version: 1.0.0
kind: standalone
hooks:
  - pre_tool_call
  - post_tool_call
  - transform_terminal_output
  - transform_tool_result
  - pre_gateway_dispatch

Code

prismor/runtime/cloaking/hermes_plugin_entry.py — shared register() function consumed by both pip discovery and filesystem install
prismor/runtime/cloaking/hermes_installer.py — install()/uninstall()/status() for filesystem-level setup
prismor/runtime/cloaking/hermes-plugin/__init__.py — re-exports register() for the filesystem install path
prismor/runtime/cloaking/hermes-plugin/plugin.yaml — plugin manifest with hook declarations

Test Plan

pip install → Hermes auto-discovers prismor-cloak entry point
prismor install-hooks --agent hermes --scope project --mode enforce writes .hermes/plugins.json
prismor cloak install --agent hermes → filesystem install succeeds
prismor cloak status → shows Hermes as installed
pre_gateway_dispatch hook detects and auto-vaults pasted Stripe/OpenAI/AWS keys
pre_tool_call hook substitutes @@SECRET:stripe_key@@ → real value at exec time
transform_terminal_output scrubs real values from tool output
!!allow prefix bypasses paste guard
prismor cloak uninstall --agent hermes → clean removal
Agent sees @@SECRET:auto_xxx@@ not the raw pasted secret