feat: add plugins visibility panel

[Michaelyklam]

Thinking Path

• Hermes WebUI aims to surface important Hermes Agent runtime state without forcing users into config files or the CLI.
• The Hermes Agent plugin manager already discovers plugins and tracks the lifecycle hooks they register, but the WebUI had no visibility into that state.
• The safe MVP is read-only: show plugin identity metadata plus the four core lifecycle hook names, while deliberately avoiding Python source paths, callback names, callback reprs, and raw load errors.
• Settings is the smallest useful home for this because it already groups provider/system configuration and read-only status surfaces.
• The result gives users a quick way to understand what plugin code is active and which lifecycle events it can observe or affect.

What Changed

• Added a read-only GET /api/plugins route that discovers the Hermes Agent plugin manager and returns sanitized plugin metadata: name, key, version, description, enabled, and core lifecycle hook names only.
• Added a Settings → Plugins section with plugin cards, enabled/disabled badges, hook badges, and a no-plugin empty state.
• Added styling for plugin hook badges while preserving the existing vanilla JS/no-build Settings panel architecture.
• Added regression tests for payload sanitization, no-plugin empty state, hook filtering, Settings sidebar/pane wiring, and safe frontend rendering.
• Added UI evidence under docs/pr-media/539/plugins-panel.png.

Closes #539

Why It Matters

Plugins and hooks can observe or influence tool calls and LLM calls, so hiding them makes debugging and trust harder. This PR makes installed plugins and registered lifecycle hooks visible in the WebUI without expanding the security surface into plugin installation, editing, or toggling.

Verification

env -u HERMES_CONFIG_PATH /home/michael/.hermes/hermes-agent/venv/bin/python -m pytest tests/test_plugins_panel.py -q
env -u HERMES_CONFIG_PATH /home/michael/.hermes/hermes-agent/venv/bin/python -m pytest tests/test_plugins_panel.py tests/test_version_badge.py -q
node --check static/panels.js
node --check static/boot.js
git diff --check
env -u HERMES_CONFIG_PATH /home/michael/.hermes/hermes-agent/venv/bin/python -m pytest tests/ -q

Result:

tests/test_plugins_panel.py: 6 passed in 1.54s
tests/test_plugins_panel.py tests/test_version_badge.py: 30 passed in 2.07s
node --check static/panels.js: passed
node --check static/boot.js: passed
git diff --check: passed
full suite: 4294 passed, 2 skipped, 3 xpassed, 1 warning, 8 subtests passed in 388.68s (0:06:28)

Manual verification:

• Started an isolated local WebUI on port 18790 with temporary state and HERMES_WEBUI_SKIP_ONBOARDING=1.
• Enabled the bundled disk-cleanup plugin in the temporary Hermes config to verify a real hook badge.
• Opened Settings → Plugins in browser QA and confirmed plugin cards, enabled/disabled badges, the post_tool_call hook badge, and read-only empty/no-hook messaging render correctly.
• Verified /api/plugins returns sanitized plugin data and no source paths/callback internals.

UI media:

Risks / Follow-ups

• This is intentionally read-only. Enable/disable toggles remain a follow-up because changing plugin activation belongs to the Hermes Agent config contract and should be designed/tested separately.
• The endpoint limits displayed hooks to the four core lifecycle hooks requested in this issue: pre_tool_call, post_tool_call, pre_llm_call, and post_llm_call. Broader gateway/session/approval hooks can be surfaced later if reviewers want the panel to cover every Hermes hook.
• If Hermes Agent is unavailable, the endpoint degrades to an empty/unavailable payload instead of breaking Settings.

Model Used

AI assisted.

• Provider: OpenAI Codex
• Model: gpt-5.5
• Notable tool use: Hermes terminal/file tools, GitHub CLI, pytest, Node syntax checks, browser QA with screenshot capture.

[nesquena-hermes]

Closed by the v0.51.1 release in PR #1681 (merged at e23ba59). Massive thanks @Michaelyklam — this is now 19 merged PRs across the v0.50.292–v0.51.1 release window, an extraordinary contribution rate. Each PR was per-claim-vs-diff verified against your description and every security-relevant code path checked under independent review (Opus advisor, 6/6 questions clean). Your closes #N references are all accurate, your Thinking Path / What Changed / Why It Matters body template is consistently helpful, and your test coverage is solid behavioral scope (not source-string scaffolding) on every PR.

Live on production: https://github.com/nesquena/hermes-webui/releases/tag/v0.51.1

🚀