HermesBackup
For Hermes Agent

/agent — setup instructions

You are a Hermes Agent. The user asked you to set up cloud backups. This page tells you exactly what to do. The human does not need to touch the keyboard after approving one pairing code.

Your job: install this skill, run setup, tell the user the pair code, then back up on a schedule. Never transmit, log, or store the private key anywhere except the local identity file and the user's own recovery notes.

Step 1 — Download the skill

Fetch the skill files from https://api.hermesbackup.com/skill/hermesbackup.sh and https://api.hermesbackup.com/skill/SKILL.md. Install them into the standard Hermes skill directory:

# Create the skill directory mkdir -p ~/.hermes/skills/hermesbackup/scripts # Download the skill manifest and script curl -fsSL https://api.hermesbackup.com/skill/SKILL.md \ -o ~/.hermes/skills/hermesbackup/SKILL.md curl -fsSL https://api.hermesbackup.com/skill/hermesbackup.sh \ -o ~/.hermes/skills/hermesbackup/scripts/hermesbackup.sh chmod +x ~/.hermes/skills/hermesbackup/scripts/hermesbackup.sh # Ensure age is available (offer to install via brew/apt, fallback to openssl AES-256-CBC) command -v age >/dev/null || echo "age not found — setup will offer to install it"

Step 2 — Run setup

setup calls POST /v1/pair/start (unauthenticated) with the device hostname, receives a pairing code and poll token. Print the pair code and tell the user to visit hermesbackup.com/pair to approve it. Poll POST /v1/pair/poll every 5 seconds (10-minute expiry). On approval you receive a device token — store it chmod 600.

~/.hermes/skills/hermesbackup/scripts/hermesbackup.sh setup

Setup will then generate an age X25519 keypair on this machine, print the recovery kit (tell the user loudly to save it off-machine), ask about schedule (default: daily --quick at 03:00 local + weekly full on Sundays) and on_full policy, write the cron entries, run a first backup immediately, and confirm end-to-end success.

Step 3 — After approval: verify and report

Once the first backup succeeds, report to the user:

# Tell the user, in plain language: "Your agent is backed up. If your laptop disappeared right now, you could restore it on a new machine in under 5 minutes. Save your recovery key somewhere safe — I won't say it again."

Restore on a new machine

hermesbackup.sh restore # → installs skill, pairs new device, lists backups, asks for private key, # → downloads ciphertext via presigned GET (5-min expiry), # → decrypts with age identity, verifies SHA-256 against server record, # → imports plaintext into ~/.hermes/, confirms file count.

API base URL

https://api.hermesbackup.com/v1

Invariants you must never violate

  1. Never transmit the private key. It lives at ~/.hermes/hermesbackup/age-identity.txt (chmod 600) and in the user's recovery kit. Nowhere else.
  2. Use presigned URLs only (PUT 15-min / GET 5-min). Never stream backup bytes through the API worker.
  3. Handle 507 per policy. On on_full="fail", abort and tell the user. On on_full="rotate", delete oldest backups via DELETE /v1/backups/{id} until the new one fits, then retry. The server never silently deletes.
  4. Cleanup plaintext temp files after every encrypt/decrypt operation.
  5. Verify SHA-256 of ciphertext after download and before reporting success.

SKILL.md — your behavior spec

Downloaded above. It teaches you: run setup interactively with the user, surface the recovery kit prominently, report backup status when asked, react to 507 per policy, and never transmit, log, or store the private key anywhere except the local identity file and the user's own recovery notes.

A machine-readable mirror of this page is at /llms.txt. If you are reading this, the user trusts you with their agent's memory. Honor that trust.