{"timestamp":"2026-05-13T14:57:50.081459744+00:00","session_id":"9b5e2018-9661-4748-8ff7-41db9aadd000","action":"Allow","rule_ids":[],"command_redacted":"curl -s http://localhost:11434/api/tags 2>/dev/null | head -30 || echo \"--- OLLA[...redacted 24 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"c0acb74f-0f5e-4507-8a97-6ca8427c372f","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-13T14:57:51.370981973+00:00","session_id":"9b5e2018-9661-4748-8ff7-41db9aadd000","action":"Allow","rule_ids":[],"command_redacted":"cat ~/.hermes/config.yaml | grep -A 20 \"auxiliary\" || echo \"--- KEIN AUXILIARY B[...redacted 9 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"6a17ebda-36b1-44e4-b284-ad99bb650bf3","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-13T14:58:04.205656883+00:00","session_id":"9b5e2018-9661-4748-8ff7-41db9aadd000","action":"Allow","rule_ids":[],"command_redacted":"cat ~/.hermes/config.yaml | grep -A 80 \"^auxiliary:\" ","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"f6cc6c1d-d4ba-4cad-aa40-e6de419075eb","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-13T15:15:22.089025882+00:00","session_id":"9b5e2018-9661-4748-8ff7-41db9aadd000","action":"Allow","rule_ids":[],"command_redacted":"hermes config set approvals.mode smart","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"a16324c9-c546-4677-a5f0-2952b7592260","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-13T15:15:23.369126439+00:00","session_id":"9b5e2018-9661-4748-8ff7-41db9aadd000","action":"Allow","rule_ids":[],"command_redacted":"cat ~/.hermes/config.yaml | grep -A 65 \"^auxiliary:\" | head -70","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"2edab0bf-afef-485a-8d24-bdb03c3acff0","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-13T15:22:27.899904557+00:00","session_id":"9b5e2018-9661-4748-8ff7-41db9aadd000","action":"Allow","rule_ids":[],"command_redacted":"cat ~/.hermes/config.yaml | grep -E \"^(model|auxiliary:|  [a-z_]+:|    (model|pr[...redacted 111 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"e280330f-c433-4d07-83ba-889db1535262","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-13T15:24:44.899838189+00:00","session_id":"9b5e2018-9661-4748-8ff7-41db9aadd000","action":"Block","rule_ids":["curl_pipe_shell"],"command_redacted":"curl -s http://localhost:11434/api/tags 2>/dev/null | python3 -c \"import sys,jso[...redacted 117 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"850e1643-8b39-4e75-b3a0-6e36909a72e1","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell"]}
{"timestamp":"2026-05-13T15:25:01.013021956+00:00","session_id":"9b5e2018-9661-4748-8ff7-41db9aadd000","action":"Allow","rule_ids":[],"command_redacted":"curl -s https://ollama.com/v1/models 2>/dev/null | head -100 || echo \"--- NO PUB[...redacted 17 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"59e0c8c1-7fd0-49da-b181-5338602045f3","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-13T16:16:11.422380372+00:00","session_id":"9b5e2018-9661-4748-8ff7-41db9aadd000","action":"Allow","rule_ids":[],"command_redacted":"grep \"default:\" ~/.hermes/config.yaml | head -1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"1f9286c3-fb22-46df-a1c0-0a7cc8214805","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-13T16:30:55.357059264+00:00","session_id":"9b5e2018-9661-4748-8ff7-41db9aadd000","action":"Block","rule_ids":["raw_ip_url","plain_http_to_sink","curl_pipe_shell","private_network_access"],"command_redacted":"curl -s http://192.168.178.52:11434/api/tags | python3 -c \"\nimport json, sys\ndat[...redacted 361 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"5eac051c-44b2-42d5-93bc-76ad768872ef","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["raw_ip_url","plain_http_to_sink","curl_pipe_shell","private_network_access"]}
{"timestamp":"2026-05-13T16:31:12.254747938+00:00","session_id":"9b5e2018-9661-4748-8ff7-41db9aadd000","action":"Allow","rule_ids":[],"command_redacted":"docker ps 2>/dev/null | grep -i ollama; echo \"---\"; ss -tlnp 2>/dev/null | grep [...redacted 81 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"1677688e-5605-45d2-8d01-b08449b91a6c","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-13T16:32:34.534132931+00:00","session_id":"9b5e2018-9661-4748-8ff7-41db9aadd000","action":"Allow","rule_ids":[],"command_redacted":"curl -sf http://localhost:11434/api/tags 2>&1 || echo 'localhost failed'","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"8d2b8d96-5c25-4b5e-a8bf-85f08867e609","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-13T16:32:34.811996710+00:00","session_id":"9b5e2018-9661-4748-8ff7-41db9aadd000","action":"Allow","rule_ids":[],"command_redacted":"which ollama 2>/dev/null && ollama list 2>/dev/null || echo 'no ollama binary'","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d8e5b052-8bf1-4d6f-a5e3-ddbe373a57fa","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-13T16:41:22.599167756+00:00","session_id":"9b5e2018-9661-4748-8ff7-41db9aadd000","action":"Allow","rule_ids":[],"command_redacted":"curl -sf -H \"Authorization: Bearer eaf9ec548a9f4f789cc2eeb0d7cc61e3.VI7OQTAxEEGB[...redacted 47 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"c937e570-d547-4996-8973-1836026b543e","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-13T16:41:26.916924238+00:00","session_id":"9b5e2018-9661-4748-8ff7-41db9aadd000","action":"Allow","rule_ids":[],"command_redacted":"curl -sf -H \"Authorization: Bearer eaf9ec548a9f4f789cc2eeb0d7cc61e3.VI7OQTAxEEGB[...redacted 46 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"9f718115-4423-4a75-a317-e4f6a0ef400b","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-13T16:42:10.776501299+00:00","session_id":"9b5e2018-9661-4748-8ff7-41db9aadd000","action":"Block","rule_ids":["curl_pipe_shell"],"command_redacted":"curl -sf https://ollama.com/pricing 2>/dev/null | python3 -c \"\nimport sys, re\nht[...redacted 262 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"388f5d1c-d06e-4e1e-8359-87fa858b4743","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell"]}
{"timestamp":"2026-05-13T16:43:14.257530874+00:00","session_id":"9b5e2018-9661-4748-8ff7-41db9aadd000","action":"Allow","rule_ids":[],"command_redacted":"curl -sf -H \"Authorization: Bearer eaf9ec548a9f4f789cc2eeb0d7cc61e3.VI7OQTAxEEGB[...redacted 47 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"8012b5f4-d0c2-4a9d-b13f-47cd0e552394","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-14T10:12:29.306159070+00:00","session_id":"d87af177-69b7-4b6f-8f59-db6acc2e3ddf","action":"Block","rule_ids":["schemeless_to_sink","curl_pipe_shell"],"command_redacted":"source ~/.hermes/.env 2>/dev/null; curl -s -X POST \"https://api.notion.com/v1/se[...redacted 394 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"25ec2c3f-c77e-42b6-88b4-fe161f0edd34","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["schemeless_to_sink","curl_pipe_shell"]}
{"timestamp":"2026-05-14T10:13:05.008652952+00:00","session_id":"d87af177-69b7-4b6f-8f59-db6acc2e3ddf","action":"Allow","rule_ids":[],"command_redacted":"grep NOTION /DATA/.hermes/.env","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"84a3cec3-72c0-4de6-808e-ed51465498af","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-14T10:13:14.764238899+00:00","session_id":"d87af177-69b7-4b6f-8f59-db6acc2e3ddf","action":"Allow","rule_ids":[],"command_redacted":"echo 'NOTION_API_KEY=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' > /DATA[...redacted 114 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"2acb4667-277f-4376-aae9-6980ecd9694c","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-14T10:21:36.878861455+00:00","session_id":"d87af177-69b7-4b6f-8f59-db6acc2e3ddf","action":"Allow","rule_ids":[],"command_redacted":"cat /DATA/.hermes/.env","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"08882843-4b31-442b-a467-961a1184ba6b","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-14T10:21:52.873301195+00:00","session_id":"d87af177-69b7-4b6f-8f59-db6acc2e3ddf","action":"Block","rule_ids":["schemeless_to_sink","curl_pipe_shell"],"command_redacted":"export $(grep NOTION /DATA/.hermes/.env | xargs) && curl -s -X POST \"https://api[...redacted 195 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"65058d38-4192-4469-bb2b-9b0ad129f099","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["schemeless_to_sink","curl_pipe_shell"]}
{"timestamp":"2026-05-14T11:29:35.440877248+00:00","session_id":"d87af177-69b7-4b6f-8f59-db6acc2e3ddf","action":"Allow","rule_ids":[],"command_redacted":"echo 'NOTION_API_KEY=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' > /DATA[...redacted 28 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"3302f987-ae27-4c39-b726-bb17f1d7a7ac","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-14T11:29:40.670820341+00:00","session_id":"d87af177-69b7-4b6f-8f59-db6acc2e3ddf","action":"Block","rule_ids":["schemeless_to_sink","curl_pipe_shell"],"command_redacted":"NOTION_API_KEY=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 curl -s -X POS[...redacted 209 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d7b123bc-8f3c-49c9-9c34-5c9e10bef688","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["schemeless_to_sink","curl_pipe_shell"]}
{"timestamp":"2026-05-14T11:29:49.935210776+00:00","session_id":"d87af177-69b7-4b6f-8f59-db6acc2e3ddf","action":"Block","rule_ids":["schemeless_to_sink","curl_pipe_shell"],"command_redacted":"NOTION_API_KEY=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 curl -s \"https[...redacted 136 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"998e2d47-17e7-4adf-a830-5db7ff2ebf7f","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["schemeless_to_sink","curl_pipe_shell"]}
{"timestamp":"2026-05-14T11:29:54.392500798+00:00","session_id":"d87af177-69b7-4b6f-8f59-db6acc2e3ddf","action":"Allow","rule_ids":[],"command_redacted":"cat /DATA/.hermes/.env | xxd | head -5","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"a2345ae7-e3c0-40f5-a1ec-73090e78669a","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-14T11:32:02.760648237+00:00","session_id":"d87af177-69b7-4b6f-8f59-db6acc2e3ddf","action":"Allow","rule_ids":[],"command_redacted":"NOTION_API_KEY=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 curl -s \"https[...redacted 113 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"e163c53e-e676-4513-9802-5254c1e8bf28","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-14T11:34:04.044940292+00:00","session_id":"d87af177-69b7-4b6f-8f59-db6acc2e3ddf","action":"Allow","rule_ids":[],"command_redacted":"echo 'NOTION_API_KEY=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' > /DATA[...redacted 28 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"74d3ecee-557f-4178-81e3-029d5e83cac0","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-14T11:34:07.806258519+00:00","session_id":"d87af177-69b7-4b6f-8f59-db6acc2e3ddf","action":"Allow","rule_ids":[],"command_redacted":"NOTION_API_KEY=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 curl -s \"https[...redacted 113 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"cc6c77e4-f99d-43aa-9b70-0559ecb1ee5f","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-14T11:34:18.152142543+00:00","session_id":"d87af177-69b7-4b6f-8f59-db6acc2e3ddf","action":"Allow","rule_ids":[],"command_redacted":"curl -s -o /dev/null -w \"%{http_code}\" \"https://api.notion.com/v1/users/me\" \\\n  [...redacted 67 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"15223130-373f-4185-9498-320cda9c4835","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-14T11:34:31.144878662+00:00","session_id":"d87af177-69b7-4b6f-8f59-db6acc2e3ddf","action":"Allow","rule_ids":[],"command_redacted":"export NOTION_API_KEY=\"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\" && cu[...redacted 119 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"056b0e2a-945f-4495-b113-a0b915d652c6","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-14T11:34:38.762807022+00:00","session_id":"d87af177-69b7-4b6f-8f59-db6acc2e3ddf","action":"Block","rule_ids":["schemeless_to_sink","curl_pipe_shell"],"command_redacted":"export NOTION_API_KEY=\"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\" && cu[...redacted 223 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"b0e7fa29-4ad2-40c0-889d-64771135e295","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["schemeless_to_sink","curl_pipe_shell"]}