capthvnsen

Idle check-ins from the primary bot of a Hermes gateway on a Linux machine or a macOS guest VM: when the bound Telegram chat has been quiet for two hours, during 08:00-22:00 in the user's timezone, the bot checks in once (does one safe step and reports it, suggests one, or asks one question), backing off when unanswered. The model tool can only make check-ins quieter; more often, resume and wider hours are operator-only via /proactivity or the CLI. After install, the workspace-setup skill walks the agent through a separate companion app and Tailscale setup on the user's computer (macOS, Windows or Linux); desktop input goes only through Hermes's approval-gated computer_use tool. Disclosure — once the gateway connects Telegram, a background thread checks every 60 seconds. When the bound Telegram DM has been quiet (2 h by default, doubling per unanswered check-in, 08:00-22:00 user time), it injects an internal user-role prompt into that chat (needs plugins.entries.alans-way.allow_gateway_injection, which setup sets), so the bot runs a turn on its own and may take one "safe, reversible" step; the user still approves tool calls in Telegram. Its pre_llm_call/post_llm_call hooks see every session's turns and store only the bound chat's timestamps in plugin state. On first load it reads $HERMES_HOME/companion/proactivity/proactivity.sqlite3 once, read-only. The workspace-setup skill has the agent clone this repo at the catalog pin and run setup.sh, which: installs long-running services (Linux systemd units hermes-alans-way-chromium/-browser with loginctl enable-linger and a mac-watch.service with Restart=always; a KeepAlive LaunchAgent on a macOS guest; logon Scheduled Tasks on Windows); adds a TimeoutStartSec=180 drop-in to the hermes-gateway unit and restarts the gateway from a transient systemd-run timer; appends the user's computer's public key to ~/.ssh/authorized_keys (administrators_authorized_keys on a Windows admin account), pins its host key in known_hosts and adds a ControlMaster block to ~/.ssh/config, for Tailscale hosts only; for the main profile and every profile with its own Telegram bot, writes a managed mcp_servers.workspace_browser block (removing other entries that run this router, with a backup), turns off the built-in browser toolset for Telegram and cron, and turns computer_use back on for Telegram and cron; and reads each profile's TELEGRAM_BOT_TOKEN only to derive the numeric bot id. The workspace router reaches the user's computer over SSH on their tailnet. The companion setup page has the human run the alans-way connect script from its main branch on their own computer, and the agent may install Tailscale with its official install script. Desktop input goes through Hermes's approval-gated computer_use tool. The manual --allow-desktop-actions setup flag, which the skill offers but never adds itself, adds cua:*:background entries to command_allowlist. On a Hermes without the computer-use provider API, including 0.21.5, it also exposes workspace_computer_action, which drives the user's desktop, Terminal included, with no approval.

Computer-use provider for Hermes: the stock computer_use tool drives desktop apps on the user's computer through the Alan's Way app, and on the VM's own desktop when the computer is offline. Needs the alans-way plugin's workspace setup. Select it with computer_use.backend: alans-way-computer. Disclosure — starts the workspace router from the profile's mcp_servers.workspace_browser block (command and args from config.yaml, with a filtered environment plus HERMES_WORKSPACE_ALLOW_DESKTOP_ACTIONS=1, which lets this private router child serve desktop input) as a long-running node child per session. It talks to the router over stdio (app lists, element trees, screenshots and input actions). The router reaches the user's computer over SSH on the user's tailnet and falls back to the VM's desktop. The provider never takes the focused window, and every input action still goes through Hermes's computer_use approval gate (cua:*:background entries in command_allowlist, which alans-way's --allow-desktop-actions adds, skip the prompt). On Hermes 0.21.5, which has no provider API, it installs and does nothing.