What happened
Moodtuner997's GitHub repository describes undo-effects, an MIT-licensed plugin for Hermes Agent. Its central behavior is to snapshot targets immediately before a covered tool call runs, using a tool-execution middleware layer. The README says it does not block, rewrite, approve, or auto-approve calls: Hermes' existing approval gate and guardrails see the same call the model made. Users can inspect recent effects with /undo-effects list and restore a numbered snapshot with /undo-effects restore N; related commands include showing entries, dry runs, force restores, pruning, and diagnostics. It can also be invoked from a shell through hermes undo-effects.
The repository lists write_file, patch operations, and a range of shell file changes as covered, including rm, rmdir, unlink, shred, mv, copies onto paths, output redirection, tee, sed -i, truncate, dd of=, and find ... -delete. It says parsing handles wrappers such as sudo, env, bash -c, pipes, chained commands, and common path expansions. Snapshots are stored in a content-addressed store under HERMES_HOME/plugin-data/undo-effects/. Restoring refuses to overwrite a file edited after the agent's change unless forced, keeps a safety copy of replaced content, and does not delete content it could not snapshot.
The plugin explicitly marks unsupported operations rather than silently claiming coverage. Its listed gaps include git clean, git reset --hard, git checkout --, git restore, find -exec, xargs rm, command substitution, heredocs, eval, PowerShell and cmd commands, inline Python or Node code that writes files, and execute_code calls that appear to write. Version-one scope excludes non-file effects such as messages, tickets, and MCP side effects. It covers only the local terminal backend; a remote sandbox configured through TERMINAL_ENV is outside scope.
The settings cap an individual file at 50 MB and a per-tool-call snapshot at 200 MB, retain snapshots for 14 days by default, and impose an eight-second snapshot time budget. A snapshot that exceeds that budget is cut short and reported, while the tool still runs. The README says the plugin reads the contents and metadata of files a covered call is about to change and writes unencrypted copies; credential-looking filenames are skipped, but secrets under ordinary names may be copied. Installation is hermes plugins install undo-effects followed by hermes plugins enable undo-effects. The maintainer reports unit tests, catalog validation, and end-to-end checks on Linux arm64 Ubuntu and native Windows 11, including a real Windows agent turn. macOS is untested. The GitHub page listed one star and zero forks when checked.
What the archive adds
New Runtime's earlier coverage on November 6, 2026 described Hermes Agent v0.23.0 as consolidating roughly 1,950 merged pull requests and adding a browser-served Desktop workspace with sessions unified through one gateway. That Hermes Agent release provides product context; undo-effects is a new community plugin and a new fact on the broader Hermes Agent story.
Trend signal
This weakly supports agent security moves to runtime boundaries: the plugin snapshots before file-changing calls, preserves the existing approval flow, and makes some effects reversible. It does not establish a general safety layer, because unsupported commands still run and non-file side effects are out of scope.
Why now
The repository presents the plugin as a response to agent mistakes that conversational undo cannot fix, such as deleting a directory or overwriting an uncommitted file. Its design addresses a specific gap between an agent's tool call and recovery after the call has already changed the filesystem.
Why it matters
For teams trying Hermes Agent on codebases or scratch workspaces, recovery independent of Git can help with files that were never committed and with directories that ordinary version-control workflows do not cover. The middleware approach also makes the distinction between permission and recovery explicit: the plugin says it does not authorize the action, but records a snapshot before it runs.
That distinction matters operationally. A snapshot is not a substitute for limiting access, reviewing commands, or maintaining backups. Teams need to decide whether the data copied into the plugin store is acceptable, set retention deliberately on shared machines, and understand that unsupported commands are only reported—not intercepted. The eight-second budget and 200 MB per-call cap also mean a large or slow snapshot may not protect the full operation. This is best treated as a supplementary recovery tool for a specific runtime, not as evidence that agent file changes are safe by default.
Limits and uncertainty
The repository's claims and test results come from the plugin maintainer and have not been independently verified. The README reports tests on Linux and Windows, but not macOS, and says remote terminal backends are not covered. It does not provide adoption data beyond the repository's one star and zero forks. The parser's real-world accuracy across varied shell syntax, large repositories, concurrent background changes, and unusual filesystems is not established by the published account. Snapshot failure leaves the tool call running, so the plugin is not a prevention mechanism. Its unencrypted copies also create a data-handling risk if sensitive content uses an ordinary filename.
Skill to build now
If evaluating this plugin, use a disposable Hermes workspace and test both a covered write and an explicitly unsupported operation. Confirm that restoration preserves a later manual edit, inspect the plugin data directory to understand what is copied, and set a shorter retention period before trying it on shared machines. Do not use the test as a replacement for version control or backups.
Reader takeaway
undo-effects offers a useful, narrow recovery layer for file changes made through some Hermes Agent tools, including files outside Git. Its safeguards and explicit coverage list are more informative than a promise of universal undo—but unsupported calls still run, and snapshots are unencrypted. Treat it as a testable supplement, not a rollback guarantee.