fix: harden hermes lifecycle detection

1 files changed, 11 insertions, 1 deletions

diff --git a/src/detect/mod.rs b/src/detect/mod.rs
index b8eb8f60..33c4361c 100644
--- a/src/detect/mod.rs
+++ b/src/detect/mod.rs
@@ -286,13 +286,16 @@ pub(crate) fn full_lifecycle_hook_authority(source: &str, agent_label: &str) ->
         ("herdr:pi", "pi")
             | ("herdr:omp", "omp")
             | ("herdr:mastracode", "mastracode")
-            | ("herdr:hermes", "hermes")
             | ("herdr:opencode", "opencode")
             | ("herdr:kilo", "kilo")
             | ("herdr:kimi", "kimi")
     )
 }
 
+pub(crate) fn session_identity_only_integration(source: &str, agent_label: &str) -> bool {
+    (source, agent_label) == ("herdr:hermes", "hermes")
+}
+
 // ---------------------------------------------------------------------------
 // Process identification (platform-specific)
 // ---------------------------------------------------------------------------
@@ -768,6 +771,13 @@ mod tests {
     }
 
     #[test]
+    fn hermes_session_integration_leaves_state_to_screen_detection() {
+        assert!(!full_lifecycle_hook_authority("herdr:hermes", "hermes"));
+        assert!(session_identity_only_integration("herdr:hermes", "hermes"));
+        assert!(Agent::SCREEN_MANIFEST_AGENTS.contains(&Agent::Hermes));
+    }
+
+    #[test]
     fn identify_unknown_processes() {
         assert_eq!(identify_agent("bash"), None);
         assert_eq!(identify_agent("zsh"), None);