# hermes-sfw

Restricted dependency operations through Socket Firewall Free for Hermes Agent.

## install

Install the `sfw` prerequisite and place the Python package in the exact environment that launches `hermes`:

```bash
npm i -g sfw
/path/to/hermes-python -m pip install hermes-sfw
hermes plugins enable hermes-sfw --no-allow-tool-override
hermes plugins list --enabled --plain
```

Run `/reset` or restart Hermes. Do not use the monorepo URL with `hermes plugins install`.

Verify without changing a project:

```text
sfw action=status
```

## use

```text
sfw action=run command="npm install express" workdir="/project"
sfw action=run command="uv pip install requests" workdir="/project"
sfw action=run command="cargo fetch" workdir="/project"
```

Accepted ecosystems:

- JavaScript/TypeScript: npm, yarn, pnpm
- Python: pip, pip3, uv
- Rust: cargo

`npx`, `rustup`, runner subcommands, arbitrary shell commands, and hidden runner forms are rejected.

The plugin's pre-tool hook blocks accepted dependency operations sent directly through Hermes `terminal` and tells the agent to use `sfw`. Set `HERMES_SFW_ENFORCE_DIRECT=off` only when the user explicitly wants direct terminal installs.

Output beyond 10,000 characters is discarded after a truncation notice. Commands time out after 300 seconds by default.

This is a dependency guard, not a sandbox. Package lifecycle scripts and build backends still run with the Hermes process's permissions.
