# Hermes Deploy Guard

> >-

- **Type:** Skill
- **Install:** `agentstack add skill-davidgut1982-hermes-toolkit-hermes-deploy-guard`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [davidgut1982](https://agentstack.voostack.com/s/davidgut1982)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [davidgut1982](https://github.com/davidgut1982)
- **Source:** https://github.com/davidgut1982/hermes-toolkit/tree/main/skills/hermes-deploy-guard

## Install

```sh
agentstack add skill-davidgut1982-hermes-toolkit-hermes-deploy-guard
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Hermes Deploy Guard

A Hermes **editable install** has no build step: **the checked-out git branch is
the running code.** This skill is the invariant that keeps that safe and the exact
recovery when it breaks. (Background: `hermes-internals` → "Homelab deployment
realities".)

## The invariant

- Live checkout: `/opt/hermes/home/.hermes/hermes-agent`.
- It **MUST stay on branch `integrated`** (carries profile-aware delegation).
- **Never `git checkout` a feature branch on the live tree.** Two prior outages
  came from exactly that. Dev work goes in a `git worktree` or `hermes -p dev`.

## Two config files (fix both)

| File | Read by |
|---|---|
| `/opt/hermes/home/config.yaml` | gateway (Telegram / messaging) |
| `/opt/hermes/home/.hermes/config.yaml` | TUI / CLI (`HERMES_HOME=/opt/hermes/home/.hermes`) |

A config change in one only silently fails on the other surface.

## Health checks

```bash
# 1. branch integrity — must print: integrated
git -C /opt/hermes/home/.hermes/hermes-agent rev-parse --abbrev-ref HEAD

# 2. PID/lock symlinks (required after a dashboard restart)
ls -l /opt/hermes/home/.hermes/gateway.pid /opt/hermes/home/.hermes/gateway.lock
#    -> should point at /opt/hermes/home/gateway.{pid,lock}
```
Ops/service checks go through the **cluster-ops MCP** (`service_status`,
`disk_usage`, `journal_tail`, …) — `terminal`/`code_execution` are disabled on
this build.

## Recovery (run in order, only when drift/breakage is confirmed)

```bash
cd /opt/hermes/home/.hermes/hermes-agent
git checkout integrated                                   # restore running branch (the ONE allowed checkout)
pip install -e .                                          # re-link editable install
# restart the gateway (dashboard, or `hermes gateway stop --all` then start)
ln -sf /opt/hermes/home/gateway.pid  /opt/hermes/home/.hermes/gateway.pid    # recreate symlinks
ln -sf /opt/hermes/home/gateway.lock /opt/hermes/home/.hermes/gateway.lock
# verify end-to-end (Woodstock IL weather + chat should go green):
python ../hermes-eval-harness/scripts/hermes_eval.py \
  --suite ../hermes-eval-harness/scripts/suites/smoke.yaml --backend library --workers 4
```

## Verification

Done = branch is `integrated`, both config files agree, both symlinks resolve to
`/opt/hermes/home/gateway.*`, and the smoke suite passes weather + chat. Report
the raw outputs, not a "looks healthy" claim.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [davidgut1982](https://github.com/davidgut1982)
- **Source:** [davidgut1982/hermes-toolkit](https://github.com/davidgut1982/hermes-toolkit)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-davidgut1982-hermes-toolkit-hermes-deploy-guard
- Seller: https://agentstack.voostack.com/s/davidgut1982
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.