chore(catalog): review disclosure for hermes-proton

plugin-catalog/hermes-proton.yaml

@@ -1,7 +1,7 @@
 name: hermes-proton
 repo: https://github.com/Maytrella007/hermes-proton
 sha: 3e0612848cf20116294f9ff58e74aadf34bc858e
-description: "Proton Mail, Calendar, Contacts and Drive for a Hermes Agent, through an MIT-licensed client built from Proton's own open-source Go libraries (go-srp, go-proton-api) — no Proton Bridge and no paid plan. Reads, searches and sends mail (attachments, scheduled send, labels, folders), manages calendar events and RSVPs, contacts (signed/encrypted vCards), and Drive (upload, download, move, rename, trash, public share links). Sign-in runs in a terminal via `hermes proton login` and the account password is never taken through chat; sending is refused until a recipient allowlist is set and every send is gated by Hermes's pre_tool_call approval. Disclosure — talks to Proton's private, undocumented web API over the network; writes attachment downloads and uploads to local files under the session directory; shells out to gpg for calendar/Drive key provisioning; stores a per-account session file (0600) holding OAuth-style tokens and the derived key passphrase, never the password; no self-update, no downloaded binaries, no telemetry, no background process."
+description: "Proton Mail, Calendar, Contacts and Drive for a Hermes Agent, through an MIT-licensed client built from Proton's own open-source Go libraries (go-srp, go-proton-api) — no Proton Bridge and no paid plan. Reads, searches and sends mail (attachments, scheduled send, labels, folders), manages calendar events and RSVPs, contacts (signed/encrypted vCards), and Drive (upload, download, move, rename, trash, public share links). Sign-in runs in a terminal via `hermes proton login` and the account password is never taken through chat; sending is refused until a recipient allowlist is set and every send is gated by Hermes's pre_tool_call approval. Disclosure — talks to Proton's private, undocumented web API over the network; stores a per-account session file (0600) holding OAuth-style tokens and the derived key passphrase (never the password) under the profile's plugin-data folder, and on first load copies any sessions from the standalone client's `~/.config/protonlite` into it; reads local files you approve for attachments and Drive uploads and writes downloaded attachments and Drive files under that plugin-data folder; shells out to gpg for calendar/Drive key provisioning; `proton_schedule_followup` creates one-shot Hermes cron jobs (read-only Proton toolset) that run unattended and deliver to your home channel; no self-update, no downloaded binaries, no telemetry."
 maintainer: Maytrella007
 tier: community
 category: tools