Files
hermes-agent/plugin-catalog/hermes-windows-startup.yaml
Yicheng-Mark 12cc143512 feat(plugin-catalog): add hermes-windows-startup (what launches itself, from where, and what was switched off)
Two read-only tools over Windows autostart. win_startup_table sweeps the six
Run/RunOnce registry keys (HKCU, HKLM, both 32-bit views) and the two Startup
folders, and folds in Explorer's StartupApproved verdicts, so 'switched off in
Task Manager' becomes an answer Win32_StartupCommand has no field for; approval
records uninstalled programs leave behind are reported as leftovers, unknown
state bytes surfaced as-is. win_startup_detail resolves the command the way the
loader does (quoting, arguments, environment variables, unquoted paths with
spaces by longest existing prefix) and says whether the binary is still on disk.
Startup folders are read through Explorer's User Shell Folders values, so
OneDrive-redirected folders are found.

Pin a2162423 = the monorepo head; the admission validator passes 15/15 with zero
warnings and the 16-test suite (11 unit including an import behind a winreg
blocker + 5 live) passes on the working copy and inside the pin tarball. The
whole sweep is registry and directory reads only - about a millisecond for three
Run values and two folders on the writing machine, no PowerShell, no WMI.
2026-11-05 10:53:47 -08:00

41 lines
2.2 KiB
YAML

name: hermes-windows-startup
repo: https://github.com/Yicheng-Mark/hermes-windows-plugins
sha: a2162423aeaa5f5b1379a9290de810ea48f9d12e
subdir: windows-startup
description: >-
Answer "what launches itself on this machine" on Windows: win_startup_table lists every
autostart entry across the six Run/RunOnce registry keys (HKCU and HKLM, plus the 32-bit
views) and the two Startup folders, with where each one comes from, whether it is machine-
or user-scoped, and whether the person switched it off in Task Manager - Explorer's
StartupApproved verdict, with the date it was last changed, a state Win32_StartupCommand
has no field for; approval records uninstalled programs left behind are reported as
leftovers, their unknown state bytes surfaced as-is rather than guessed into verdicts.
win_startup_detail takes one entry and resolves its command the way the loader does -
quoting, arguments, environment variables, and unquoted paths with spaces resolved by
longest existing prefix - and says whether the binary is still on disk, plus a folder
file's size and last change. Use it for what added itself since last month, for slimming
a slow sign-in, and for a launcher whose program is already gone. Read-only: nothing is
enabled, disabled or deleted; the Startup folders are read through Explorer's User Shell
Folders values so OneDrive-redirected folders are found. The sweep is registry and
directory reads only - about a millisecond for three Run values and two folders on the
machine it was written on, no PowerShell, no WMI. The plugin declares no Python
dependencies; there is no network call and no file write. Windows only. Disclosure - the
tools report program names, launch commands, binary paths under C:\Program Files and
C:\Users\<name>, and what the person chose to keep from starting, to the model; treat
the output like the Startup tab of the person's own Task Manager.
maintainer: Yicheng-Mark
tier: community
category: tools
requires_hermes: ">=0.21.4"
docs_url: https://github.com/Yicheng-Mark/hermes-windows-plugins/tree/main/windows-startup
version: "0.1.0"
platforms:
- windows
capabilities:
provides_tools:
- win_startup_table
- win_startup_detail
provides_hooks: []
provides_middleware: []
requires_env: []