Adaptation for Hermes-Agent

[XXnormal]

feat: 双运行时支持（OpenClaw + Hermes）+ 改名 agent-aegis + WebUI 改版

把 L1（工具调用层）插件适配成一套代码同时跑在 OpenClaw 和 Hermes 上，完成claw-aegis → agent-aegis 改名，并重做 WebUI。

• Hermes 运行时：新增 adapters/hermes/ 的 Python↔Node 桥接（install.sh、bridge.py、tool_wrappers.py、paths.py、web-server.py），以及 rpc-server/rpc-handlers——通过 JSON-RPC 暴露共享检测引擎；新增根入口（init.py、plugin.yaml）和
  start-web-hermes.sh 启动脚本。
• 改名：claw-aegis → agent-aegis，覆盖 index/config/清单/文档（含遗漏的驼峰 clawAegis → agentAegis）。仅内部命名，无行为变化。
• WebUI：响应式 Dashboard + 图表（事件分布 / Skill 信任 / 周趋势）、多列配置、全宽页面；后端按磁盘自动识别 config.yaml（Hermes）还是 openclaw.plugin.json（OpenClaw）。
• Hermes 加固：工具加载晚于 register() 时也能武装工具调用拦截；install.sh 把备份移出 plugins/ 避免加载到旧副本；支持 hermes plugins enable 流程与可选 approvals.mode。
• 文档：运维提示（改配置后需重启、observe vs enforce、Hermes 插件加载注意点）。

[gemini-code-assist]

Code Review

This pull request rebrands the plugin from 'ClawAegis' to 'AgentAegis' and introduces a comprehensive adapter for the Hermes Agent, enabling the TypeScript-based security engine to run on both OpenClaw and Hermes runtimes via a Node.js JSON-RPC subprocess bridge. The Web UI has also been enhanced with new visualization charts. The review feedback highlights several critical improvements for the Hermes adapter, such as using asyncio.to_thread to prevent blocking the asyncio event loop in async tool wrappers, resolving a race condition on stderr reading during Web server startup, ensuring UTF-8 encoding is specified when reading configuration files, and addressing an unused timeout variable in the RPC bridge.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

engine.call 是一个阻塞式的同步 I/O 调用（内部向 stdin 写入并阻塞等待 stdout 的 readline）。在 async_handler 这个异步函数中直接调用它会阻塞整个 asyncio 事件循环，从而导致异步 Agent 的整体性能严重下降。建议使用 asyncio.to_thread 将该同步阻塞调用放到线程池中执行。

Suggested change

	async def async_handler(args: dict, **kwargs: Any) -> str:
	# Same logic but for async handlers — the check itself is sync
	# (short RPC call), only the original handler is awaited
	try:
	result = engine.call("check_before_tool", {
	"tool": tool_name,
	"args": args,
	"sessionKey": session_key_fn(),
	"runId": run_id_fn(),
	})
	async def async_handler(args: dict, **kwargs: Any) -> str:
	# Same logic but for async handlers — the check itself is sync
	# (short RPC call), only the original handler is awaited
	try:
	import asyncio
	result = await asyncio.to_thread(
	engine.call,
	"check_before_tool",
	{
	"tool": tool_name,
	"args": args,
	"sessionKey": session_key_fn(),
	"runId": run_id_fn(),
	}
	)

[gemini-code-assist]

在启动 Web 服务器进程后，立即启动了后台线程 _drain_stderr 来读取 stderr。随后如果检测到进程退出，又调用了 self._proc.communicate()。由于后台线程和 communicate() 会同时尝试读取同一个管道（stderr），这会引发竞争条件（Race Condition），可能导致 ValueError 或日志丢失。此外，Web 服务器启动失败的错误通常输出到 stderr，而原代码只打印了 stdout。建议先检查进程状态，如果启动成功再启动后台线程；如果启动失败，则通过 communicate() 同时获取 stdout 和 stderr 进行排查。

Suggested change

	# Background thread to drain stderr and forward to Python logging
	self._stderr_thread = threading.Thread(
	target=self._drain_stderr, daemon=True,
	)
	self._stderr_thread.start()
	# Wait a moment and check if process started successfully
	time.sleep(0.5)
	if self._proc.poll() is not None:
	stdout, _ = self._proc.communicate(timeout=1)
	logger.error("Web server failed to start: %s", stdout)
	self._started = False
	raise RuntimeError("Web server process exited immediately")
	# Wait a moment and check if process started successfully
	time.sleep(0.5)
	if self._proc.poll() is not None:
	stdout, stderr = self._proc.communicate(timeout=1)
	logger.error("Web server failed to start: stdout=%s, stderr=%s", stdout, stderr)
	self._started = False
	raise RuntimeError("Web server process exited immediately")
	# Background thread to drain stderr and forward to Python logging
	self._stderr_thread = threading.Thread(
	target=self._drain_stderr, daemon=True,
	)
	self._stderr_thread.start()

[gemini-code-assist]

在读取配置文件时，未指定 encoding='utf-8'。在非 UTF-8 默认编码的系统（如 Windows）上，如果配置文件包含非 ASCII 字符，可能会导致 UnicodeDecodeError。建议显式指定编码。

Suggested change

	with open(config_path) as f:
	with open(config_path, encoding="utf-8") as f:

[gemini-code-assist]

在读取 Hermes 配置文件时，未指定 encoding='utf-8'。建议显式指定编码以避免在不同操作系统上出现编码解析问题。

Suggested change

	with open(hermes_config_path) as f:
	with open(hermes_config_path, encoding="utf-8") as f:

[gemini-code-assist]

定义了 _CALL_TIMEOUT = 5.0 但在代码中并未实际使用。目前 proc.stdout.readline() 是一个完全阻塞的调用，如果 Node.js RPC 服务端挂起或未输出换行符，Python 进程将无限期阻塞。建议移除未使用的变量，或者实现超时机制以提高健壮性。