Memory Shield v1.0.0

The first stable release. What the plugin does as of this release is listed under Added and the two fixes since 0.1.4 under Fixed; the README, its banner, a catalog card and a short demo video are new.

Added

• A policy for Hermes' built-in memory tool through one pre_tool_call hook, per store: the owner's profile (USER.md, setting user_profile) is append-only, and the agent's own notes (MEMORY.md, setting agent_notes) can be added to and updated but not deleted. Levels off, no_delete, append_only and read_only; a batch is checked operation by operation.
• Shared chats (groups, channels, forum topics, guild threads, webhook runs) are read-only (group_chats), except for the people in trusted_users (ids as platform:id) and the owner-only chats in trusted_chats, which are judged like a direct chat. scheduled_jobs adds an extra limit in cron runs; it is off by default.
• Modes: block refuses with a hint the model can act on, approve asks through Hermes' approval prompt in direct chats (with a key for that exact call) and blocks elsewhere, observe allows the call and logs it.
• Replacing an entry with empty or placeholder text ("n/a", "[deleted]", and placeholder words in Russian, Spanish, Portuguese, German and French) counts as removing it.
• Direct edits of USER.md and MEMORY.md through write_file, patch, terminal and execute_code, and shell commands that wipe or move the whole memory folder, are judged as an add, a replace and a remove at once.
• A snapshot of the memory file right before an edit or deletion goes through: 20 per file by default, at most 200, snapshots: 0 turns them off. /memory-shield snapshots lists them, and /memory-shield restore <n> puts one back in a direct chat or a chat in trusted_chats, after saving the current file.
• An audit log of refused and flagged writes (the last 500, each with a 160-character excerpt; audit_log: false turns it off), shown by /memory-shield log [n] in a direct chat, the CLI or a chat in trusted_chats. /memory-shield shows the policy and how many events and snapshots are kept; /memory-shield whoami shows the user id and, in a shared chat, the chat key.
• A card for the Hermes plugin catalog, docs/card.png (1200x600): in a group, a stranger asks the agent to forget everything about its owner, the agent's notes stay, and the shield sits on the chat. docs/banner.png stays the README banner.
• The README shows a short demo (docs/demo.webp, also as docs/demo.mp4, 20 seconds), re-drawn from a local test run with fictional people, in two scenes: in the group "Friends", Sam asks the agent to remember "Alex owes me $100" and it refuses; in a direct chat, the owner, Alex, asks it to forget everything, and it refuses and offers a dated note. Under What you get, five screenshots from docs/screenshots.

Changed

• The README follows the layout of Telegram Stickers: badges in one style, a one-line introduction to Hermes Agent, a Quick start (install and restart, /memory-shield to check, trusted_users for groups), What you get, the commands, Configuration, the comparison with memory.write_approval, Privacy and safety, Known limitations and Troubleshooting as a list. Known limitations is new: groups where the gateway does not pass the message author to plugins (trusted_chats covers an owner-only one), memory provider plugins, best-effort file and shell detection, facts about the owner that only the owner can fix by default, and approve depending on Hermes' approvals. Privacy and safety now also say who can run which subcommand and that the plugin holds the memory store's lock file while it reads or writes a memory file.
• The README banner is redrawn as a mini chat, like the Telegram Stickers banner: in a group, Sam tries to plant a claim about the owner, Alex, then to wipe what the agent knows, and the agent's notes stay. It drops its pills and uses larger text so it reads in small link previews.

Fixed

• /memory-shield log answers only in a direct chat, the CLI or a chat in trusted_chats, like /memory-shield restore, and in any other chat says where to run it. Before, it worked in any chat, so whoever could run the agent's slash commands in a group could read up to 50 events from every chat, with excerpts from the owner's direct chats (for a deletion, words from the memory entry itself). /memory-shield snapshots still works in any chat: it shows times, stores and sizes, no memory text.
• A level set to off with hermes config set or as an unquoted off in config.yaml is stored as YAML false; the plugin now reads that as off instead of silently keeping the default. This applies to user_profile, agent_notes, group_chats and scheduled_jobs.