mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-11-06 05:17:15 +00:00
Yicheng-Mark
e1f356c10f
The monorepo's head adds a Windows CI matrix that runs every plugin's suite, and fixes the windows-ops packaged-payload scan so it no longer counts the bytecode the test run itself writes. No plugin behaviour changed: the only files touched between the two pins are the workflow and one test file.
22 lines
3.4 KiB
YAML
22 lines
3.4 KiB
YAML
name: hermes-windows-eventlog
|
|
repo: https://github.com/Yicheng-Mark/hermes-windows-plugins
|
|
sha: 5bad3fb2baf04ce6befecfefce6d14f4c9c98934
|
|
subdir: windows-eventlog
|
|
description: "Answer \"why did this process die\" on Windows: three read-only tools over the Windows Event Log. win_crash_events reads Application Error / Application Hang / Windows Error Reporting / .NET Runtime records for a time window, decodes the exception code (0xC0000005 -> ACCESS_VIOLATION and the other codes a debugger would name), reports the faulting module, its path and the fault offset, and groups repeated crashes by app and signature. Records are classified by provider as well as by event id, so unrelated providers that reuse ids 1000 and 1001 for informational events are not reported as crashes. win_shutdown_events reads the System log for Kernel-Power 41 unexpected restarts, bugchecks decoded to names (0x9F -> DRIVER_POWER_STATE_FAILURE, accepting the decimal form some providers emit), EventLog 6008 dirty shutdowns, 1074 operator-initiated restarts with the process and comment, and the 6005/6006/12/13 start and stop markers. win_eventlog_query is the general case: any channel, filtered by event ids, levels, an exact provider name or a payload substring, returning structured records instead of raw XML. Queries read newest-first and stop at the window start or at a 5000-record scan cap; a call returns at most 200 records and marks truncated payload text. Channel names, provider names and numeric filters are validated before anything is interpolated into the query. Disclosure - this plugin reads the local Windows event logs and hands what it finds to the model: application and faulting-module paths, exception codes and offsets, report ids, service names and provider message text, which routinely includes user and machine paths (C:\\Users\\<name>\\...). Treat tool output like any other local diagnostic dump when sharing it. It reads only the channels the current account may read - Security and some operational logs answer with an access-denied error rather than any attempt to obtain elevation - and it never writes to a log, clears one or configures a channel. Stdlib-only (ctypes wevtapi plus xml.etree): no Python dependencies, no child processes, no network calls, no file writes, no self-update. Windows only. Disclosure — reads the local Windows event logs and hands what it finds to the model: application and faulting-module paths, exception codes and offsets, report ids, service names and provider message text, which routinely include user and machine paths (C:\\Users\\<name>\\...); win_eventlog_query reads any channel the account running Hermes may read, so an unelevated account gets access-denied on Security and some operational logs while an elevated Hermes can return Security-log records (logon events with account names and source addresses). It never requests elevation, never writes to, clears or configures a log, and has no Python dependencies, child processes, network calls, file writes or self-update. Windows only."
|
|
maintainer: Yicheng-Mark
|
|
tier: community
|
|
category: tools
|
|
requires_hermes: ">=0.21.4"
|
|
docs_url: https://github.com/Yicheng-Mark/hermes-windows-plugins/tree/main/windows-eventlog
|
|
version: "0.1.0"
|
|
platforms:
|
|
- windows
|
|
capabilities:
|
|
provides_tools:
|
|
- win_crash_events
|
|
- win_shutdown_events
|
|
- win_eventlog_query
|
|
provides_hooks: []
|
|
provides_middleware: []
|
|
requires_env: []
|