plugin-catalog: airlock 0.2.4 → 0.3.0 (context files seal until reviewed)

plugin-catalog/airlock.yaml

@@ -1,9 +1,9 @@
 name: airlock
 title: airlock
 repo: https://github.com/otsoa-dubief/airlock
-sha: 37ba4551176e3247a636f2a2c4334043bcf1fe87
+sha: 4d3919745b97cd21d1448c04fc776b40f4552aa3
 subdir: airlock
-version: "0.2.4"
+version: "0.3.0"
 description: >-
   Guardrails that follow what a conversation has read. Once a session reads untrusted content (a web page, a
   browser snapshot, an MCP or third-party plugin's output, a customer's message), airlock seals it: messages to
@@ -12,13 +12,15 @@ description: >-
   in every session: credential paths and secret files, the guard's own files and Hermes's config, shell startup
   files, other profiles, commands that switch approvals off. Shell commands are read the way the shell reads
   them, so a command that computes or hides what it runs (eval, base64 | sh, $G push, wildcards, write-then-run)
-  is refused until written in clear. Subagents inherit the seal. It also catches an injection by its signature:
+  is refused until written in clear. Subagents inherit the seal. A project's AGENTS.md, CLAUDE.md,
+  .cursorrules or .hermes.md that Hermes loads at startup seals the session from its first turn until the owner
+  has reviewed it (`hermes airlock trust`), and again when its content changes (a cloned repository, a pull). It also catches an injection by its signature:
   recognized secrets never leave in a call; a private marker in the agent's context locks the session if it shows
   up in a tool call; a send to an address the untrusted content named is blocked; repeated refusals lock the
   session; lookalike Unicode in commands is refused. A file behind a wall cannot leave as a message
   attachment, and attached files are checked for secrets. A call that names a cloud metadata service is
   refused. Plugin and MCP tools nobody admitted need approval. Observe mode, stop switch,
-  `hermes airlock check|demo|log`. On Windows, paths are read in every form Windows and Git Bash give them, and
+  `hermes airlock check|demo|log|trust`. On Windows, paths are read in every form Windows and Git Bash give them, and
   a path on another machine is refused without being opened. Tested on a corpus of 362 attacks and everyday
   commands, on Linux, macOS and Windows, and end to end in the official image.
   Disclosure — hooks only (pre_tool_call, post_tool_call, pre_llm_call, subagent_start, on_session_reset,
@@ -26,11 +28,14 @@ description: >-
   (home channels, approvals mode) and its own policy file (<HERMES_HOME>/airlock.yaml); lists directories to
   expand wildcards in commands it checks; reads the first 200 KB of each file a send_message attaches, locally, to
   look for secrets. On Windows, reads the machine's own name (no lookup), tests which drive letters exist, and
-  imports tools.environments.local._find_bash to know Git Bash's root. Imports Hermes's attachment reader (gateway.platforms.base.BasePlatformAdapter.extract_media)
+  imports tools.environments.local._find_bash to know Git Bash's root. On a session's first turn, imports
+  agent.prompt_builder.discover_context_files and _project_context_suppressed and
+  agent.runtime_cwd.resolve_context_cwd (guarded) to know which project context files Hermes loaded, and hashes
+  them (sha256). Imports Hermes's attachment reader (gateway.platforms.base.BasePlatformAdapter.extract_media)
   to see exactly what a message would attach, with its own reader as a fallback.
   Writes under plugin-data/airlock: a journal of decisions, taints and
-  approvals that includes tool arguments, truncated (journal.args: none leaves them out), the taint state and the
-  stop switch. When nobody can approve (--yolo, /yolo, hermes -z, approvals.mode: off, cron, -q or webhook set to
+  approvals that includes tool arguments, truncated (journal.args: none leaves them out), the taint state, the
+  stop switch and the context files the owner trusted (path and sha256). When nobody can approve (--yolo, /yolo, hermes -z, approvals.mode: off, cron, -q or webhook set to
   approve, a subagent under delegation.subagent_auto_approve) it blocks instead of letting Hermes auto-approve;
   to know it, it imports gateway.session_finite.unattended_turn and reads tools.approval (_yolo_active,
   _unattended_contexts, approval_context._get_approval_mode), each guarded, config.yaml as fallback (policy
@@ -42,11 +47,11 @@ tier: community
 category: tools
 requires_hermes: ">=0.21.6"
 docs_url: https://github.com/otsoa-dubief/airlock#readme
-image: https://raw.githubusercontent.com/otsoa-dubief/airlock/37ba4551176e3247a636f2a2c4334043bcf1fe87/docs/images/social-preview.png
+image: https://raw.githubusercontent.com/otsoa-dubief/airlock/4d3919745b97cd21d1448c04fc776b40f4552aa3/docs/images/social-preview.png
 screenshots:
-  - https://raw.githubusercontent.com/otsoa-dubief/airlock/37ba4551176e3247a636f2a2c4334043bcf1fe87/docs/images/live-session.gif
-  - https://raw.githubusercontent.com/otsoa-dubief/airlock/37ba4551176e3247a636f2a2c4334043bcf1fe87/docs/images/how-it-works.png
-  - https://raw.githubusercontent.com/otsoa-dubief/airlock/37ba4551176e3247a636f2a2c4334043bcf1fe87/docs/images/check.png
+  - https://raw.githubusercontent.com/otsoa-dubief/airlock/4d3919745b97cd21d1448c04fc776b40f4552aa3/docs/images/live-session.gif
+  - https://raw.githubusercontent.com/otsoa-dubief/airlock/4d3919745b97cd21d1448c04fc776b40f4552aa3/docs/images/how-it-works.png
+  - https://raw.githubusercontent.com/otsoa-dubief/airlock/4d3919745b97cd21d1448c04fc776b40f4552aa3/docs/images/check.png
 platforms: []
 known_issues:
   - "Built for in-process plugins (Hermes's default): under plugins.isolation: host it cannot tell third-party plugin tools from Hermes's own."