Where this build goes wrong

Each one is a specific switch, cap or default. Half fail silently.

1 · Allow-all makes the bot public

Hermes checks per-platform allow-all first, before the pairing list or any allowlist. Turn it on to get the group working and anyone who finds the bot can DM it. In a group, anyone added to the group can drive an agent holding your Home Assistant token. Pair each member with hermes pairing approve and test with an unpaired account. You should get silence.

2 · Cloning copies secrets

--clone-from household hands a fifteen-year-old’s agent your HASS_TOKEN, calendar credentials and metered Portal access. Strip the member .env, then ask the member agent to list its tools (prompt 1). If it can see ha_call_service, there’s no boundary.

3 · One shared profile

Memory is per profile: one MEMORY.md (capped at 2,200 characters), one USER.md, one session history that session_search can dig through. Sam’s Tuesday DM can turn up in Thursday’s group brief, and four people’s preferences overwrite each other in 2,200 characters. Privacy and per-person memory both need separate profiles.

4 · MEMORY.md as a database

Truncation is quiet. 2,200 characters of MEMORY.md holds house rules and preferences. A grocery list, a schedule and everyone’s allergies go in the vault as files a skill keeps up, and past sessions are already searchable. If the agent “forgot” something, check whether it ever fit.

5 · Metered tools and a chatty family

The cloud browser and web tools bill per use. Every “is the pool open tomorrow?” can become a paid web_search, and a cart run is dozens of browser_* calls. Keep Portal credentials in the household profile, have SOUL.md say “answer from knowledge unless asked to look it up”, announce cart runs, and watch the first month’s bill before adding any browser cron jobs.

6 · The cart run drifting toward pay

Shop sites redesign monthly, substitution pop-ups appear mid-flow, and a retried click can double an order. So the agent loads the cart only on request, never past a payment step, and no payment credential exists in ~/.hermes/. If saving four minutes a week means storing a card in an agent’s config, spend the four minutes.

7 · Cron that nags

Jobs are easy to create, so people create seven, the family mutes the bot within two weeks, and the clash warnings go unread. Keep two fixed messages (07:00 and 21:30) and make the rest exception-driven. hermes cron pause anything disputed. Keep Home Assistant state events out of the group: watch_all in a busy house floods it with motion alerts, and the 30-second cooldown_seconds default only slows that down. Scope watch_domains to things a person would mention.

8 · Members on the local terminal

The docs say execute_code and the terminal aren’t sandboxed on local. “Try a script for my homework” means untrusted code on the box that runs your house. Use the docker backend for member profiles (capabilities dropped, no-new-privileges, process and tmpfs caps), with approvals.deny and HERMES_WRITE_SAFE_ROOT as backup. The hardline blocklist stops rm -rf /, but don’t rely on it for your family’s server.