Agent stack build plans · № 3 · part 4

Set it up

Six stages, ~40 minutes. Everything here is a real command or a real file path as of v0.19.0, July 2026; where a config key isn’t publicly documented, we have Hermes edit its own config and show you the diff instead of guessing.

1 · Install Hermes

curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash

iex (irm https://hermes-agent.nousresearch.com/install.ps1)

Config lands in ~/.hermes/config.yaml, secrets in ~/.hermes/.env, OAuth in auth.json. Precedence: CLI args > config.yaml > .env > defaults.

2 · Model and web tools

Hermes is model-agnostic — Nous Portal, OpenRouter, OpenAI, or your own endpoint, set in the model section of config.yaml. Two cost facts to internalize before the cron exists: the model bill scales with report length and source count, and the web tools (web_search/web_extract, Firecrawl-powered, plus x_search) come through the paid, metered Nous Portal tool gateway — without a Portal subscription this plan has no eyes, and with one, every search is billed. A cheap-but-competent model is the right default for a daily digest; save the frontier model for weeks when the beat catches fire.

3 · Switch the terminal backend to Docker

The intern will run self-written scraper scripts unattended. execute_code is not sandboxed on the default local backend, so this stage is mandatory, not paranoia. Install Docker if the machine lacks it, then paste this into a Hermes session:

Open ~/.hermes/config.yaml and switch the terminal backend from local to docker. Show me the exact diff before saving, and tell me which image it will use. Then run a trivial command through the terminal tool and confirm it executed inside the container, not on my host. While you're in there: confirm skills.write_approval is enabled and approvals.mode is smart or manual — if either is looser, tighten it and show me that diff too.

The hardened Docker backend drops all capabilities, sets no-new-privileges, and caps the container at 256 processes with a 512 MB tmpfs /tmp — the container is the security boundary. Also note Hermes strips your environment from child processes by default (terminal.env_passthrough is the escape hatch) and protects paths like ~/.ssh/ and .env — leave all of that alone.

4 · The archive directory

mkdir -p ~/research-intern/reports

This is the “you build this” layer from the architecture page: one dated markdown file per run, which the intern greps before writing. It’s plain files on purpose — inspectable, diffable, yours.

5 · The Telegram gateway

Hermes’s messaging gateway is a background daemon (installable as a systemd/launchd service). Follow the messaging docs to connect Telegram — the bot token goes in ~/.hermes/.env — then start it:

hermes gateway

Telegram is one of twenty-plus supported platforms (Discord, Slack, WhatsApp, Signal, email, ntfy…); cron delivery works to any of them, so pick where you actually read mornings. Gateway access is allowlist-based with DM pairing for unknown senders — approve yourself and stop there; this intern needs an audience of one.

6 · Create and verify the cron job

You’ll create the job in natural language in prompt stage 4 — Hermes’s cronjob tool handles the schedule and the delivery target, and jobs live in ~/.hermes/cron/. Verify from the CLI:

hermes cron list
hermes cron status

hermes cron run
hermes cron pause
hermes cron resume

Also useful: hermes cron edit and hermes cron remove. Run the job manually for a few days (hermes cron run) before you trust the schedule — the traps page explains why the first unattended week is where the money leaks.