feat: hermes agent for m3-ares

.gitignore

@@ -24,3 +24,19 @@ Thumbs.db
 # Opencode rules
 .opencode-rules
 opencode.json
+
+# Taskplane runtime artifacts (machine-specific, do not commit)
+.pi/batch-state.json
+.pi/batch-history.json
+.pi/lane-state-*
+.pi/merge-result-*
+.pi/merge-request-*
+.pi/worker-conversation-*
+.pi/orch-logs/
+.pi/orch-abort-signal
+.pi/settings.json
+.worktrees/
+.taskplane-tasks/
+
+# Pi project-local packages (if using pi install -l)
+.pi/npm/

flake.lock

@@ -268,11 +268,11 @@
         "uv2nix": "uv2nix_2"
       },
       "locked": {
-        "lastModified": 1775649585,
+        "lastModified": 1775750438,
-        "narHash": "sha256-m1DICRvc4jc1Rar0zKrVA6TYXjef8QFRXjRc5/AU0rc=",
+        "narHash": "sha256-8HoZTK49+dK26iBcaizanUpy37JH3nkPVrZHcPBVtUM=",
         "owner": "NousResearch",
         "repo": "hermes-agent",
-        "rev": "ff6a86cb529a372198b4b80d5e022e32a4a3f2cc",
+        "rev": "d9753720f366287d52be14386e8f1eabbbe89fe3",
         "type": "github"
       },
       "original": {
@@ -432,14 +432,17 @@
         "openspec": "openspec"
       },
       "locked": {
-        "lastModified": 1775658058,
+        "lastModified": 1775663240,
-        "narHash": "sha256-CceoYh5lvS6CdqvsRk79XE6qTEuXEMtRzjEahsRlILo=",
+        "narHash": "sha256-W81Zj1C6Beuqgd2yKhW0no84H7FJhEh74hPvecO4bbU=",
-        "path": "/home/m3tam3re/p/NIX/nixpkgs",
+        "ref": "refs/heads/master",
-        "type": "path"
+        "rev": "77833a7ecaa4b30999872c31b90cb023b4a348f3",
+        "revCount": 216,
+        "type": "git",
+        "url": "https://code.m3ta.dev/m3tam3re/nixpkgs"
       },
       "original": {
-        "path": "/home/m3tam3re/p/NIX/nixpkgs",
+        "type": "git",
-        "type": "path"
+        "url": "https://code.m3ta.dev/m3tam3re/nixpkgs"
       }
     },
     "nix-colors": {
@@ -640,16 +643,16 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1751274312,
+        "lastModified": 1775036866,
-        "narHash": "sha256-/bVBlRpECLVzjV19t5KMdMFWSwKLtb5RyXdjz3LJT+g=",
+        "narHash": "sha256-ZojAnPuCdy657PbTq5V0Y+AHKhZAIwSIT2cb8UgAz/U=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "50ab793786d9de88ee30ec4e4c24fb4236fc2674",
+        "rev": "6201e203d09599479a3b3450ed24fa81537ebc4e",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-24.11",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }

flake.nix

@@ -106,6 +106,7 @@
           ./hosts/m3-ares
           agenix.nixosModules.default
           m3ta-nixpkgs.nixosModules.default
+          inputs.hermes-agent.nixosModules.default
         ];
       };
       m3-atlas = nixpkgs.lib.nixosSystem {

home/features/cli/nushell.nix

@@ -24,7 +24,7 @@ in {
         $env.XDG_DATA_HOME = $"($env.HOME)/.local/share"
         $env.FZF_DEFAULT_COMMAND = "fd --type f --exclude .git --follow --hidden"
         $env.SSH_AUTH_SOCK = "/run/user/1000/gnupg/S.gpg-agent.ssh"
-        $env.PATH = ($env.PATH | split row (char esep) | append "/home/sascha.koenig/.cache/.bun/bin" | uniq)
+        $env.PATH = ($env.PATH | split row (char esep) | append $"($env.HOME)/.cache/.bun/bin" | append $"($env.HOME)/.npm-global/bin" | uniq)
         $env.FLAKE = $"($env.HOME)/p/NIX/nixos-config"
 
         # Load kestractl-env from agenix

home/features/desktop/default.nix

@@ -114,7 +114,9 @@
     # clipman
     distrobox
     eigent
-    element-desktop
+    (element-desktop.override {
+      commandLineArgs = "--password-store=gnome-libsecret";
+    })
     launch-webapp
     # eww
     # firefox-devedition

home/m3tam3re/home.nix

@@ -205,7 +205,7 @@
       "m3-hermes" = {
         hostname = "204.168.229.93";
         user = "m3tam3re";
-        identityFile = "~/.ssh/sascha.koenig";
+        identityFile = "~/.ssh/m3tam3re";
       };
       "m3-zelda" = {
         hostname = "95.217.189.186";

hosts/m3-ares/secrets.nix

@@ -50,6 +50,10 @@
         file = ../../secrets/m3tam3re-secrets.age;
         owner = "m3tam3re";
       };
+      hermes-env = {
+        file = ../../secrets/hermes-env.age;
+        owner = "m3tam3re";
+      };
     };
   };
 }

hosts/m3-ares/services/default.nix

@@ -1,6 +1,7 @@
 {pkgs, ...}: {
   imports = [
     ./containers
+    ./hermes-agent.nix
     ./netbird.nix
     #./n8n.nix
     ./mem0.nix

hosts/m3-ares/services/hermes-agent.nix

@@ -0,0 +1,184 @@
+{config, ...}: let
+  # Default ElevenLabs voice: Bella (German-capable female)
+  elevenlabsVoiceId = "hpp4J3VqNfWAUOO0d1Us";
+in {
+  services.hermes-agent = {
+    enable = true;
+    addToSystemPackages = true;
+
+    # Secrets via agenix
+    environmentFiles = [config.age.secrets."hermes-env".path];
+
+    # Non-secret environment variables
+    environment = {
+      GLM_BASE_URL = "https://api.z.ai/api/coding/paas/v4/";
+    };
+
+    settings = {
+      # ── Model ──────────────────────────────────────────────────────────
+      model = {
+        default = "glm-5.1";
+        provider = "zai";
+      };
+
+      credential_pool_strategies = {
+        zai = "fill_first";
+      };
+
+      toolsets = ["all"];
+
+      # ── Agent ──────────────────────────────────────────────────────────
+      agent = {
+        max_turns = 90;
+        gateway_timeout = 1800;
+        tool_use_enforcement = "auto";
+      };
+
+      # ── Terminal ───────────────────────────────────────────────────────
+      terminal = {
+        backend = "ssh";
+        modal_mode = "auto";
+        cwd = ".";
+        timeout = 180;
+        persistent_shell = true;
+      };
+
+      # ── Browser ────────────────────────────────────────────────────────
+      browser = {
+        inactivity_timeout = 120;
+        command_timeout = 30;
+        cloud_provider = "local";
+      };
+
+      # ── Checkpoints / Compression ──────────────────────────────────────
+      checkpoints = {
+        enabled = true;
+        max_snapshots = 50;
+      };
+
+      file_read_max_chars = 100000;
+
+      compression = {
+        enabled = true;
+        threshold = 0.5;
+        target_ratio = 0.2;
+        protect_last_n = 20;
+      };
+
+      # ── Display ────────────────────────────────────────────────────────
+      display = {
+        compact = false;
+        personality = "kawaii";
+        resume_display = "full";
+        busy_input_mode = "interrupt";
+        inline_diffs = true;
+        skin = "default";
+        tool_progress = "all";
+      };
+
+      # ── TTS / STT / Voice ──────────────────────────────────────────────
+      tts = {
+        provider = "elevenlabs";
+        elevenlabs = {
+          voice_id = elevenlabsVoiceId;
+          model_id = "eleven_multilingual_v2";
+        };
+      };
+
+      stt = {
+        enabled = true;
+        provider = "local";
+        local = {model = "base";};
+      };
+
+      voice = {
+        record_key = "ctrl+b";
+        max_recording_seconds = 120;
+        silence_threshold = 200;
+        silence_duration = 3.0;
+      };
+
+      # ── Memory ─────────────────────────────────────────────────────────
+      memory = {
+        memory_enabled = true;
+        user_profile_enabled = true;
+        memory_char_limit = 2200;
+        user_char_limit = 1375;
+      };
+
+      # ── Delegation ─────────────────────────────────────────────────────
+      delegation = {
+        max_iterations = 50;
+      };
+
+      # ── Discord ────────────────────────────────────────────────────────
+      discord = {
+        require_mention = true;
+        auto_thread = true;
+        reactions = true;
+      };
+
+      # ── Approvals / Security ───────────────────────────────────────────
+      approvals = {
+        mode = "manual";
+        timeout = 60;
+      };
+
+      security = {
+        redact_secrets = true;
+        tirith_enabled = true;
+        tirith_fail_open = true;
+      };
+
+      # ── Cron / Session ─────────────────────────────────────────────────
+      cron = {wrap_response = true;};
+
+      session_reset = {
+        mode = "both";
+        idle_minutes = 1440;
+        at_hour = 4;
+      };
+
+      # ── Web ────────────────────────────────────────────────────────────
+      web = {backend = "exa";};
+
+      # ── Platform Toolsets ──────────────────────────────────────────────
+      platform_toolsets = {
+        cli = [
+          "browser"
+          "clarify"
+          "code_execution"
+          "cronjob"
+          "delegation"
+          "file"
+          "image_gen"
+          "memory"
+          "session_search"
+          "skills"
+          "terminal"
+          "todo"
+          "tts"
+          "vision"
+          "web"
+        ];
+        telegram = [
+          "browser"
+          "clarify"
+          "code_execution"
+          "cronjob"
+          "delegation"
+          "file"
+          "image_gen"
+          "memory"
+          "session_search"
+          "skills"
+          "terminal"
+          "todo"
+          "tts"
+          "vision"
+          "web"
+        ];
+      };
+    };
+  };
+}

hosts/m3-atlas/configuration.nix

@@ -59,7 +59,11 @@
 
   # List packages installed in system profile. To search, run:
   # $ nix search wget
-  environment.systemPackages = with pkgs; [neovim git];
+  environment.systemPackages = with pkgs; [
+    neovim
+    git
+    ghostty.terminfo
+  ];
 
   # Some programs need SUID wrappers, can be configured further or are
   # started in user sessions.

hosts/m3-hermes/configuration.nix

@@ -16,7 +16,11 @@
   time.timeZone = "Europe/Berlin";
   i18n.defaultLocale = "en_US.UTF-8";
 
-  environment.systemPackages = with pkgs; [neovim git];
+  environment.systemPackages = with pkgs; [
+    neovim
+    git
+    ghostty.terminfo
+  ];
 
   services.openssh = {
     enable = true;