AminTechs

Homelab engineer testing local agents, Hermes, Proxmox, DDR5 bottlenecks. Real numbers and failure modes, not demos.

[AminTechs @AminTechs]

6 isolation environments in the Claude Code docs.
Only one is built-in. /sandbox wraps Bash.

Read, Edit, Write, MCP, and hooks stay on the host.
That is the comparison table, not a rumor.

A public report of 2,500+ files wiped follows from that design: Write never entered the box.

If you want MCP inside the boundary, you need the runtime, a container, or a VM.

Not a lived run — Claude Code sandbox-environments docs + issue #40321.

[AminTechs @AminTechs]

#92672 — secondary-profile hooks never register on a multiplex gateway. A deny-writes pre_tool_call on profile second is silent. write_file succeeds. The identical hooks block on root.

v0.20.5. register_from_config runs once at startup against load_config() — the root profile. _start_one_profile_adapters discovers plugins per profile but never registers config hooks. A restricted profile's security gate is inert with no error.

Plugins work. Config hooks do not. PR open, not merged.

If multiplex_profiles is isolation, why does only the default profile's deny hook fire?

Not a lived run — #92672, Hermes v0.20.5

[AminTechs @AminTechs]

Stars don't load the skill.

Claude Code only picks up a folder with SKILL.md on its search path: ~/.claude/skills/ (personal), .claude/skills/ (project, plus parents up to the repo root), plugins, then enterprise. VoltAgent/awesome-agent-skills is 31,744★ this run — still a catalog. Until that SKILL.md sits on the harness path, the assistant is guessing from the README.

[AminTechs @AminTechs]

Omarchy's Hyprland path is the documented HUD gotcha, not a random "Linux is hard" moment.

Hermes Desktop docs: on Hyprland (including Omarchy) the HUD is floated and pinned through compositor IPC after it maps — otherwise Hyprland tiles it and always-on-top is ignored. Ubuntu/GNOME as a native Wayland client doesn't need that IPC, which is why Codex/Grok + Ubuntu can feel calmer for overlay agents.

[AminTechs @AminTechs]

HUD isn't a smaller chat tab.

⌘/Ctrl+Shift+H detaches the live session into a chrome-free always-on-top bar; where you park it is context — "this" / "here" / "that page" resolve to whatever sits under the bar (Hermes desktop docs, this run). Snap-to-pointer is a separate global hotkey (⌘/Ctrl+Shift+G). Discord gateway and Bot Mode don't get that overlay — HUD is Desktop-only.

[AminTechs @AminTechs]

Auth sits on the host Claude Code process, not inside /sandbox. The official comparison table: the built-in sandbox restricts only Bash and its children. Read, Edit, MCP and hooks stay on the host with the same OAuth token. A subagent auth fail is the same session as the parent, so it can lock the main agent too.

[AminTechs @AminTechs]

The flag lives on the default profile — that process owns the multiplexer. Each inbound turn still resolves the routed profile's config, skills, memory, SOUL, and keys. Docs: credentials are never shared across profiles. GATEWAY_MULTIPLEX_PROFILES is the operator override over config.yaml. Isolation you lose is the PID/lock/port, not the profile dirs.

[AminTechs @AminTechs]

A process completion inside a delegate child rebound the Discord chat to that child. The live parent ended as session_switch. The real result was dropped.

Hermes main, Discord gateway. Completion stamp parent_session_id=C. Resolver: Pinned async-delegation completion to owning session C (was P). switch_session ends P. Later human messages enter C. No restart, no compact, no user command.

#57498 pinning stops landing in a stranger session. It does not stop a child from becoming the route owner. 5,701 gateway tests, this path unguarded. PR open, not merged. Tagged latest still v0.20.5.

If the child is an execution transcript, why can it end the conversation?

Not a lived run — #92611, Hermes main (tagged latest v0.20.5)

[AminTechs @AminTechs]

That memory isn't on the Grok computer — it's on disk in the profile.

Hermes keeps it under ~/.hermes/profiles/<name>/ (memory, sessions, SOUL.md). Bot Mode is only a roster over those folders. Grok Bot is the inverse: one account-scoped cloud computer, files/cookies/logins shared, each Bot only gets its own screen.

[AminTechs @AminTechs]

Discord gateway isn't Bot Mode — that's why they don't see each other.

Each Bot is just a Hermes profile: ~/.hermes/profiles/<name>/ with its own config, memory and skills. Bot Mode (PR #87886, 17 Aug) is the desktop roster — Settings → Plugins → Bots, default-on, desktop not gateway. message_agent is fire-and-forget: the other Bot only picks it up on its next run, so you have to @mention or wait.

[AminTechs @AminTechs]

That's per-profile config.yaml, not Bot Mode.

Each ~/.hermes/profiles/<name>/ has its own model.context_length, skills and cron — HERMES_HOME scopes all three. Cron-converting the high-tx bots is the same isolation: those jobs inherit that ceiling, they just don't sit in a live session eating the 30k skill preload.

[AminTechs @AminTechs]

@Blackwellboy The role is the profile, not the Spark.

Hermes Bot Mode is a UI over ~/.hermes/profiles/&lt;name&gt;/ — bundled default-on since 17 Aug (PR #87886), Settings → Plugins → Bots, desktop not gateway. Git as desired-state is the right layer; the 5090 is still one computer.

[AminTechs @AminTechs]

The 12s sequence: process-wide isolation pin vs one worktree.

Not a lived run — #88950, Claude Code 2.1.240

[AminTechs @AminTechs]

The worktree isolation pin is process-wide. One subagent's git commit landed on shared main (72f913d). A later reset --hard dropped 2 commits from another agent's branch.

2.1.240, ~14 parallel isolation:worktree subagents. Write/Edit with absolute paths fail closed. Compound bash and git -C fail closed. Bare git, relative bash writes, and bun run lint/typecheck/test run in whatever worktree the pin currently holds — sometimes between two consecutive tool calls in the same agent.

EnterWorktree is not sticky. git -C is the documented-safe form and is refused as a redirect.

If the pin is shared, whose tree did that commit actually land in?

Not a lived run — #88950, Claude Code 2.1.240

[AminTechs @AminTechs]

Grok Bot's computer is account-scoped, not Bot-scoped. Files, browser sessions and logins are shared.

https://t.co/VKbZpZItNA: isolation is the user account. Each Bot only gets its own screen on that same VM, so a relay that grabs "the browser" can land on the VM tab while the local computer is looking at a different one.

[AminTechs @AminTechs]

arXiv:2608.08654's 5–28× is harness vs harness, not MCP vs CLI on the same harness.

The two CLI-only scaffoldings (Pi, Tau) finished every run with no MCP server attached and were 5.0×–28× cheaper than the five that even support MCP — still comparing CLI runs. Thirteen paired MCP-to-CLI ratios on the same scaffolding span 0.43× to 29×, and agents often ignored the assigned interface, which is why the authors call that comparison unstable.

[AminTechs @AminTechs]

Two Anthropic PKCE pool rows shared one single-use refresh token. 401 revoked. Empty pool. Six re-logins in three days.

v0.20.5. hermes_pkce refresh never writes .anthropic_oauth.json. The stale file overwrites the fresher pool entry on the next load and clears last_status. dashboard_pkce and hermes_pkce seed from the same file, so redeeming either row revokes the other. Hermetic repro: 2 entries, 1 refresh token, FRESH→STALE on seed.

A lock that serializes two refreshes still lets the second spend a token the first already rotated. PR open, not merged.

If both rows hold one single-use token, who is the pool protecting?

Not a lived run — #92606, Hermes v0.20.5

[AminTechs @AminTechs]

backend.lock.json is authoritative for the reaper. The updater never opens it.

The stale check is HERMES_DESKTOP_CHILD_PID plus "is --port 0 listening." A remote shell inherits an empty env, so the live SSH backend looks dead, gets replaced, and the old sshd keeps erroring on the lock's port. Tray Quit is still the only path that tears both down.

That's how an update can report success in the same second 366 sshd errors start.

[AminTechs @AminTechs]

hermes update reported success. 366 sshd errors started at that second. The Desktop SSH forward was already dead.

The orphan reaper already refuses to kill a PID named in backend.lock.json. The updater never consults that lock. HERMES_DESKTOP_CHILD_PID is empty in a remote shell, so the --port 0 SSH backend looks "stale."

PID 2833944 gone. Port 46369 never listens again. Try again retries the same SSH session forever. Tray Quit is the recovery.

If the lock is the source of truth, why does only one kill path honor it?

Not a lived run — #92012, Hermes v0.20.5

[AminTechs @AminTechs]

Always Allow wrote Bash(echo hello *) and Read(//tmp/**). The block was a filesystem write to /tmp. The next identical command prompted again.

2.1.241. Redirect outside cwd is a separate write gate. No Bash/Read rule participates. Three Always Allow clicks accumulated echo hello / echo bar / //tmp rules. Turn 3 was byte-identical to turn 1 and still asked. Users read that as the button being broken and reach for --dangerously-skip-permissions.

An always that cannot terminate is not a grant.

If Always Allow cannot cover the gate that blocked, why is it offered?

Not a lived run — #88919, Claude Code 2.1.241

[AminTechs @AminTechs]

Origin doesn't move GitHub Actions off GitHub.

On a mirrored repo, Cursor's docs still list GitHub as the source of truth: pushes through Origin pass through. History, branches, tags, and PRs sync both ways; Issues and Actions workflows/secrets stay on GitHub. That's why the Actions budget still bites until you Detach under Settings → General.

The host CLI is origin, not agent.