CLI reference

The text below is the output of hermetic <command> --help for every command, generated from the CLI at build time. Run the same command locally for the version you have installed.

hermetic

Usage: hermetic [options] [command]

fleet manager for Hermes agents on AWS

Commands, grouped as in docs/design.md §9:

  fleet
    init [options]                     verify and freeze an account; attach to an existing foundation or create one
    fleet                              the account's fleets: what exists, and which one a bare command means
    directory                          the account-global table that records every fleet (§4.8)
    config                             the frozen local configuration
    runs [options]                     local log of commands this laptop ran, with output
    artifacts                          the hermeticd artifact in the fleet bucket
    doctor [options]                   foundation health, account/fleet guard, drift between DynamoDB / EC2 / Tailscale
    foundation                         the CloudFormation foundation: which contract version the fleet is on, and updating it
    teardown [options]                 DeleteStack; refuses if agents exist
    plan                               what a destructive command would do, without doing it
  agent
    agent                              create, inspect and operate agents
  secrets
    secrets                            secret slots in SSM Parameter Store
  settings
    settings                           the fleet's shared settings: defaults every laptop inherits
    providers                          the fleet's provider profiles: named credentials an agent is created against
  ops
    upgrade [options] [name]           pin a new hermes version per agent, or move the whole fleet to a new hermeticd
    ssh [options] <name>               tailscale ssh into an agent
    logs [options] <name> [unit]       stream an agent's logs over the loopback RPC
  chat
    chat [options] <target> [message]  send one turn to a bot and stream the reply
    bots [options]                     the bots this fleet's boxes are running
    inbox [options]                    notifications this laptop has raised about the fleet
  other
    teardowns [options]                permanent local record of every teardown this home has run
    volume                             data volumes: what exists, and what nothing is reading
    presets                            this laptop's create presets: the machine bundles agent create starts from
    rooms [options]
    routines [options]
    policy [options]                   hermetic's own entries in the tailnet policy file, and any drift
    network [options]                  the fleet's network mode (§5): public addresses or a NAT appliance
    apply [options] <plan-file>        execute a plan written by `hermetic plan …`
    help [command]                     display help for command

Global options:
  --json                             print a machine-readable document on stdout and nothing else
  --fleet <fleet-id|alias>           which frozen fleet to run against, by fleet id or display alias; else HERMETIC_FLEET, else the default from `hermetic fleet use`
  --version                          print the hermetic version and exit
  -h, --help                         display help for command

Examples:
  hermetic init                      target an AWS account, first run on this laptop
  hermetic agent create atlas         create an agent named atlas
  hermetic agent ps --json | jq .     scriptable output; --json is stdout-only, see above

Run `hermetic <command> --help` for a command's own options and examples.

Exit codes (`hermetic help exit-codes` for the full table with names):
    0  ok
    1  INTERNAL / unmapped, CHAT_TURN_FAILED, FOUNDATION_UPDATE_FAILED, NETWORK_UPDATE_FAILED
    2  FLEET_REQUIRED, VALIDATION, AMBIGUOUS_PROFILE
    3  NOT_INITIALIZED
    4  ACCOUNT_MISMATCH, FLEET_MISMATCH, FOUNDATION_NEWER, FORBIDDEN
    5  NAME_INVALID, NAME_TAKEN
    6  NOT_FOUND
    7  CONFLICT, PLAN_STALE, LOCKED, INVALID_TRANSITION, AGENTS_EXIST, FOUNDATION_UNSAFE, VOLUME_IN_USE, VOLUME_UNUSABLE, VOLUME_MISSING, RESOURCE_NOT_OWNED, PROFILE_IN_USE, MODEL_NOT_GRANTED, BROWSER_NEEDS_FOUNDATION_UPDATE, TERMINAL_LIMIT
    8  CONFIRMATION_REQUIRED
    9  SG_INBOUND_RULE, DIRECTORY_UNAVAILABLE, SECRETS_DISABLED, TAILSCALE_UNAVAILABLE, HERMETICD_UNAVAILABLE, MANIFEST_REFUSED, WORKING_TREE_DIRTY, PROVIDER_UNREACHABLE, PROVIDER_AUTH, PROVIDER_MALFORMED, CHAT_UNREACHABLE, CHAT_NO_TOKEN, CHAT_PROTOCOL, CHAT_NO_SLOT, BROWSER_MIRROR_MISMATCH, TERMINAL_AGENT_OFF, TAILSCALE_MISSING, TAILSCALE_STOPPED, TAILSCALE_WRONG_TAILNET
   10  UNSUPPORTED
  130  ABORTED, Ctrl-C

fleet commands

hermetic init

Usage: hermetic init [options]

verify and freeze an account; attach to an existing foundation or create one

Options:
  --json                         print a machine-readable document on stdout and
                                 nothing else
  --fleet <fleet-id|alias>       which frozen fleet to run against, by fleet id
                                 or display alias; else HERMETIC_FLEET, else the
                                 default from `hermetic fleet use`
  --yes                          skip the interactive confirmation
  --attach                       fail unless a foundation already exists
  --create                       fail unless there is no foundation yet
  --reset                        re-target this home at another account; mints a
                                 new fleet_id
  --profile <name>               AWS profile to freeze
  --region <region>              region for the fleet
  --network <mode>               public | nat
  --directory-region <region>    region the account-global fleet directory lives
                                 in (default us-east-1, then whatever this home
                                 recorded)
  --tailnet <name>               override the tailnet detected from this
                                 machine, e.g. acme.ts.net
  --skip-tailscale-check         create a foundation even though this machine is
                                 not on a tailnet (headless/CI)
  --skip-policy                  do not write hermetic's entries into the
                                 tailnet policy file (for policies deployed from
                                 git)
  --skip-artifacts               create without pushing hermeticd (headless/CI);
                                 no agent can launch until `hermetic artifacts
                                 push` runs
  --confirm-account-id <digits>  the twelve digits, for scripts; interactively
                                 you type them at the prompt
  -h, --help                     display help for command

A fleet is created with no display alias: it shows as its own fleet id
until `hermetic fleet alias <fleet-id> <alias>` gives it one. `--fleet`
selects an existing fleet to attach to, by id or alias, and never renames.

Examples:
  hermetic init                                    pick a profile interactively, attach or create
  hermetic init --create --profile acme-prod       create a new foundation in that profile
  hermetic init --attach                           fail unless a foundation already exists
  hermetic init --attach --fleet abcdefgh          freeze a fleet this laptop does not have yet
  hermetic init --create --skip-tailscale-check --tailnet acme.ts.net
                                                    create from a machine that is not on the tailnet
  hermetic init --reset --confirm-account-id 123456789012
                                                    re-target this home, scripted (no prompt)

hermetic fleet

Usage: hermetic fleet [options] [command]

the account's fleets: what exists, and which one a bare command means

Options:
  -h, --help                          display help for command

Commands:
  ls [options]                        every fleet this laptop has frozen and
                                      every fleet the account's directory knows
  alias [options] <fleet-id> [alias]  assign, replace or clear a fleet's
                                      optional display alias
  use [options] <fleet-id|alias>      record which fleet a bare command means on
                                      this laptop
  help [command]                      display help for command

hermetic fleet ls

Usage: hermetic fleet ls [options]

every fleet this laptop has frozen and every fleet the account's directory knows

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

Columns:
  NAME        the display alias, or the fleet id when it has none;
              `*` marks the fleet this command opened
  LOCAL       whether this laptop has the fleet frozen; only those can be commanded
  FOUNDATION  the version the directory recorded, and whether this build is newer
  DEFAULT     `*` marks what a bare command means — set it with `hermetic fleet use`

Works with nothing frozen at all, and with several frozen and none chosen:
it is the command that says so. The header line then reads
`▸ (no fleet chosen) · …` or `▸ (not initialized)`, because there is no fleet
name to put in it.

hermetic fleet alias

Usage: hermetic fleet alias [options] <fleet-id> [alias]

assign, replace or clear a fleet's optional display alias

Arguments:
  fleet-id                  the immutable fleet id; an alias is never the target
                            of this command
  alias                     the new display alias: lowercase letters, digits and
                            hyphens, ≤31 chars

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --clear                   remove the display alias; the fleet id remains its
                            display name
  -h, --help                display help for command

A fleet is created without an alias and keeps working without one: every
head falls back to the fleet id. An alias is unique across the account,
including fleets that have been torn down — their labels stay reserved, so
clear the alias on the old fleet before reusing it.

Examples:
  hermetic fleet alias k7m2x9qa prod     call that fleet `prod`
  hermetic fleet alias k7m2x9qa --clear  go back to showing its id

hermetic fleet use

Usage: hermetic fleet use [options] <fleet-id|alias>

record which fleet a bare command means on this laptop

Arguments:
  fleet-id|alias            a fleet frozen in this home, by fleet id or display
                            alias; `hermetic fleet ls` lists both

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

Local only: it records a preference, it does not touch the fleet or the
directory. What is recorded is the fleet id, so a later `fleet alias`
does not move the default. `--fleet <fleet-id|alias>` overrides it for one
command, and `HERMETIC_FLEET` for one shell.

hermetic directory

Usage: hermetic directory [options] [command]

the account-global table that records every fleet (§4.8)

Options:
  -h, --help        display help for command

Commands:
  status [options]  where the fleet directory is, how it is billed, and what it
                    holds
  help [command]    display help for command

hermetic directory status

Usage: hermetic directory status [options]

where the fleet directory is, how it is billed, and what it holds

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

The table is provisioned by `init`, not by the foundation stack: it outlives
every fleet in the account, which is why it carries deletion protection and a
point-in-time recovery window rather than backups.

hermetic config

Usage: hermetic config [options] [command]

the frozen local configuration

Options:
  -h, --help      display help for command

Commands:
  show [options]  frozen account, profile, region, fleet_id
  help [command]  display help for command

hermetic config show

Usage: hermetic config show [options]

frozen account, profile, region, fleet_id

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

hermetic runs

Usage: hermetic runs [options]

local log of commands this laptop ran, with output

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --last                    only the most recent run
  --agent <name>            only runs against this agent
  --limit <n>               at most N runs
  --full                    include each run's captured output
  -h, --help                display help for command

hermetic artifacts

Usage: hermetic artifacts [options] [command]

the hermeticd artifact in the fleet bucket

Options:
  -h, --help                display help for command

Commands:
  push [options] [version]  push hermeticd to the bucket (run by init and
                            upgrade)
  help [command]            display help for command

hermetic artifacts push

Usage: hermetic artifacts push [options] [version]

push hermeticd to the bucket (run by init and upgrade)

Arguments:
  version                   version to publish; defaults to this build's

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --path <file>             a compiled hermeticd to push; default finds one
                            (HERMETIC_HERMETICD, next to this binary, or built
                            from source)
  -h, --help                display help for command

hermetic doctor

Usage: hermetic doctor [options]

foundation health, account/fleet guard, drift between DynamoDB / EC2 / Tailscale

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

hermetic foundation

Usage: hermetic foundation [options] [command]

the CloudFormation foundation: which contract version the fleet is on, and
updating it

Options:
  -h, --help        display help for command

Commands:
  status [options]  fleet vs available foundation version, and every agent's
                    hermeticd
  update [options]  apply this build's foundation: stack, release, and a rollout
                    to every agent
  help [command]    display help for command

hermetic foundation status

Usage: hermetic foundation status [options]

fleet vs available foundation version, and every agent's hermeticd

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

hermetic foundation update

Usage: hermetic foundation update [options]

apply this build's foundation: stack, release, and a rollout to every agent

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --yes                     skip the interactive confirmation
  -h, --help                display help for command

Examples:
  hermetic plan foundation                          what it would do, without doing it
  hermetic foundation update                        interactive: review the plan, then confirm
  hermetic foundation update --yes                  scripted

hermetic teardown

Usage: hermetic teardown [options]

DeleteStack; refuses if agents exist

Options:
  --json                         print a machine-readable document on stdout and
                                 nothing else
  --fleet <fleet-id|alias>       which frozen fleet to run against, by fleet id
                                 or display alias; else HERMETIC_FLEET, else the
                                 default from `hermetic fleet use`
  --yes                          skip the interactive confirmation
  --no-purge                     keep the SSM parameters under /hermetic/ and
                                 /hermes/, and a nat fleet's Elastic IP, instead
                                 of deleting them
  --delete-snapshots             also delete the DLM snapshots tagged
                                 hermetic:role=data
  --delete-volumes               also delete leftover volumes tagged
                                 hermetic:managed=true
  --no-reset-local               keep this laptop's frozen config instead of
                                 resetting it so `init` can run again
  --confirm-account-id <digits>  the twelve digits, for scripts; interactively
                                 you type them at the prompt
  -h, --help                     display help for command

Examples:
  hermetic teardown --yes                          interactive: type the account id
  hermetic teardown --yes --confirm-account-id 123456789012
                                                    scripted, no prompt
  hermetic teardown --yes --no-reset-local          keep this home frozen after teardown

hermetic plan

Usage: hermetic plan [options] [command]

what a destructive command would do, without doing it

Options:
  -h, --help                 display help for command

Commands:
  destroy [options] <name>   the plan `agent destroy` would execute
  recreate [options] <name>  the plan `agent recreate` would execute
  teardown [options]         the plan `teardown` would execute
  foundation [options]       the plan `foundation update` would execute (§6.6)
  rollout [options]          re-render every agent's config and converge the
                             boxes that are behind (§6.5)
  policy [options]           the change `hermetic apply` would make to the
                             tailnet policy file
  network [options]          what `hermetic apply` would do to move this fleet
                             between `public` and `nat`
  help [command]             display help for command

hermetic plan destroy

Usage: hermetic plan destroy [options] <name>

the plan `agent destroy` would execute

Arguments:
  name                      agent name

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --keep-volume             plan keeping the data volume (default: it is
                            deleted)
  -h, --help                display help for command

hermetic plan recreate

Usage: hermetic plan recreate [options] <name>

the plan `agent recreate` would execute

Arguments:
  name                      agent name

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

hermetic plan teardown

Usage: hermetic plan teardown [options]

the plan `teardown` would execute

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --no-purge                keep the SSM parameters under /hermetic/ and
                            /hermes/ instead of deleting them
  --delete-snapshots        also delete the DLM snapshots tagged
                            hermetic:role=data
  --delete-volumes          also delete leftover volumes tagged
                            hermetic:managed=true
  --no-reset-local          keep this laptop's frozen config instead of
                            resetting it so `init` can run again
  -h, --help                display help for command

hermetic plan foundation

Usage: hermetic plan foundation [options]

the plan `foundation update` would execute (§6.6)

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

hermetic plan rollout

Usage: hermetic plan rollout [options]

re-render every agent's config and converge the boxes that are behind (§6.5)

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --agent <name...>         converge only these agents; default is every agent
                            in the fleet
  --concurrency <n>         how many boxes converge at once (default 1 — a bad
                            render then stops at the first)
  -h, --help                display help for command

hermetic plan policy

Usage: hermetic plan policy [options]

the change `hermetic apply` would make to the tailnet policy file

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

hermetic plan network

Usage: hermetic plan network [options]

what `hermetic apply` would do to move this fleet between `public` and `nat`

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --to <mode>               the mode to move to: public or nat
  -h, --help                display help for command

agent commands

hermetic agent

Usage: hermetic agent [options] [command]

create, inspect and operate agents

Options:
  -h, --help                  display help for command

Commands:
  create [options] <name>     create an agent
  ps [options]                fleet table: status, health, heartbeat age,
                              versions, lock
  status [options] <name>     everything known about one agent
  probe [options] <name>      actively check an agent: EC2, hermeticd over the
                              tailnet, and its dashboard
  desktop [options] <name>    the address and session token Hermes Desktop
                              attaches with
  rerun [options] <name>      re-run the bootstrap stages that are not ok, from
                              the first failure
  reboot [options] <name>     reboot the agent's instance; same box, same disks
  set [options] <name>        change an agent's settings; takes effect on the
                              next rerun or recreate
  stop [options] <name>       stop an agent's instance
  start [options] <name>      start an agent's instance
  recreate [options] <name>   replace the instance, keep the data volume
  destroy [options] <name>    terminate the instance and delete this agent's
                              resources
  history [options] <name>    the append-only event log for one agent
  destroyed [options] [name]  destroyed agents, newest first: when, by whom, and
                              what became of the volume
  help [command]              display help for command

hermetic agent create

Usage: hermetic agent create [options] <name>

create an agent

Arguments:
  name                          agent name

Options:
  --json                        print a machine-readable document on stdout and
                                nothing else
  --fleet <fleet-id|alias>      which frozen fleet to run against, by fleet id
                                or display alias; else HERMETIC_FLEET, else the
                                default from `hermetic fleet use`
  --model <id>                  model id, spelled the way the provider spells it
                                (default: the provider's)
  --terminal <backend>          how the terminal tool runs commands: local |
                                docker
  --max-turns <n>               ceiling on tool-calling turns in one agent run
  --reasoning <effort>          low | medium | high
  --approvals <mode>            smart | manual | off (default off)
  --hold <keys>                 settings hermetic holds, comma-separated:
                                terminal,max-turns,reasoning (or none)
  --preset <id|name>            a create preset (`hermetic presets show`);
                                default: this laptop's default preset
  --size <size>                 micro | xxsmall | xsmall | small | medium |
                                large | xlarge | xxlarge | 3xlarge |
                                gpu-xsmall..gpu-xlarge; overrides the preset
  --instance-type <type>        raw EC2 instance type, overrides --size
  --provider-profile <id|name>  the provider profile this agent runs on
                                (`hermetic providers ls`)
  --provider <provider>         bedrock | anthropic | openrouter | nous | openai
                                | vercel — shorthand for this fleet's profile of
                                that provider
  --secrets <mode>              none | bitwarden
  --volume-gib <gib>            data volume size in GiB; overrides the preset
  --root-gib <gib>              root (system) disk size in GiB, 8-500; replaced
                                with the instance; overrides the preset
  --volume <volume-id>          build on an existing data volume instead of
                                creating one (`hermetic volume ls`)
  --rollback-on-failure         if the create fails, undo everything it made
                                instead of leaving it for a re-run (an interrupt
                                still leaves it resumable)
  -h, --help                    display help for command

A setting you name here is the agent's starting value: it is written to the
agent's own config, changeable from its dashboard, and hermetic writes it
again only when you change the answer here. A setting you leave out is seeded
once with the fleet default.

--hold makes hermetic hold a setting instead: it is written to the agent's
managed config on every apply and cannot be changed on the box. On `set` the
list replaces the one before it. The model is always held (it comes from the
agent's provider profile); --approvals can never be held. An agent created
before --hold existed holds every setting it was given until --hold is set.


Examples:
  hermetic agent create atlas                             this laptop's default preset, the fleet's default profile
  hermetic agent create atlas --preset heavy              a preset from `hermetic presets show`
  hermetic agent create atlas --preset heavy --root-gib 80   a preset with one field changed
  hermetic agent create atlas --provider-profile openrouter-cheap
  hermetic agent create atlas --provider nous             the fleet's nous profile, if it has exactly one
  hermetic agent create atlas --secrets bitwarden
  hermetic agent create cinder-2 --volume vol-0c85d3b7f1a94e620   reuse a destroyed agent's memory

The machine (size, data volume, system disk) comes from this laptop's create
presets unless you name it: --preset, else the default preset when no machine
flag is given. A machine flag overrides the preset's value for that field, and
--volume keeps the volume's own size. Everything else left out comes from the
fleet's defaults (`hermetic settings show`).

There is no key to type. A credential belongs to a provider profile:
  hermetic providers create --provider openrouter --name cheap --api-key-stdin

hermetic agent ps

Usage: hermetic agent ps [options]

fleet table: status, health, heartbeat age, versions, lock

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --status <status>         only agents in this display status
  -h, --help                display help for command

A destroyed agent has no row here: it is reviewed with `hermetic agent destroyed`.

hermetic agent status

Usage: hermetic agent status [options] <name>

everything known about one agent

Arguments:
  name                      agent name

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

hermetic agent probe

Usage: hermetic agent probe [options] <name>

actively check an agent: EC2, hermeticd over the tailnet, and its dashboard

Arguments:
  name                      agent name

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

`ps` calls an agent `unreachable` when its heartbeat is stale — one word for
a stopped box, a dead hermeticd, a broken heartbeat write and a laptop that is
off the tailnet. `probe` asks each layer directly and says which one it is.

It writes nothing: no row update, no event, no lock. A layer that does not
answer is reported, not thrown — the exit code is 0 unless the agent is
missing or the account guard refuses.

hermetic agent desktop

Usage: hermetic agent desktop [options] <name>

the address and session token Hermes Desktop attaches with

Arguments:
  name                      agent name

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

Desktop's remote-gateway form wants two things and can discover neither: the
box's Serve URL, and the dashboard session token. It scrapes that token only
from a backend it started itself, so a remote gateway with none saved passes
the connection test — which skips the WebSocket leg — and fails the real
connection.

The token belongs to the box's running dashboard process. A reboot, an apply,
`agent recreate` or a Hermes update mints a new one; run this again then.

hermetic agent rerun

Usage: hermetic agent rerun [options] <name>

re-run the bootstrap stages that are not ok, from the first failure

Arguments:
  name                      agent name

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

Only an agent in `error` has stages to resume. hermetic writes the request
on the agent's row; the box picks it up within about ten seconds and
`hermetic agent status <name>` shows the stages moving.

hermetic agent reboot

Usage: hermetic agent reboot [options] <name>

reboot the agent's instance; same box, same disks

Arguments:
  name                      agent name

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

An OS reboot of the instance the agent already has — it keeps its instance
id, its root disk, its data volume and its tailnet address. Use it for a box
that has wedged. `agent recreate` is the from-scratch rebuild; `agent stop`
then `agent start` powers the same box off and on.

hermetic agent set

Usage: hermetic agent set [options] <name>

change an agent's settings; takes effect on the next rerun or recreate

Arguments:
  name                          agent name

Options:
  --json                        print a machine-readable document on stdout and
                                nothing else
  --fleet <fleet-id|alias>      which frozen fleet to run against, by fleet id
                                or display alias; else HERMETIC_FLEET, else the
                                default from `hermetic fleet use`
  --model <id>                  model id, spelled the way the provider spells it
                                (default: the provider's)
  --terminal <backend>          how the terminal tool runs commands: local |
                                docker
  --max-turns <n>               ceiling on tool-calling turns in one agent run
  --reasoning <effort>          low | medium | high
  --approvals <mode>            smart | manual | off (default off)
  --hold <keys>                 settings hermetic holds, comma-separated:
                                terminal,max-turns,reasoning (or none)
  --secrets <mode>              none | bitwarden
  --provider-profile <id|name>  move this agent onto another provider profile;
                                staged until `hermetic apply`
  --refresh-profile             re-pin the profile this agent is already on at
                                its latest revision (a rotated key, an edited
                                model)
  --provider <provider>         bedrock | anthropic | openrouter | nous | openai
                                | vercel — shorthand for this fleet's profile of
                                that provider
  --size <size>                 micro | xxsmall | xsmall | small | medium |
                                large | xlarge | xxlarge | 3xlarge |
                                gpu-xsmall..gpu-xlarge
  --instance-type <type>        raw EC2 instance type
  --root-gib <gib>              root (system) disk size in GiB, 8-500; applied
                                by the next recreate
  --hermes-version <version>    pin a hermes version
  --expected-version <n>        refuse unless the agent row is still at this
                                version (`agent status --json` prints it)
  -h, --help                    display help for command

A setting you name here is the agent's starting value: it is written to the
agent's own config, changeable from its dashboard, and hermetic writes it
again only when you change the answer here. A setting you leave out is seeded
once with the fleet default.

--hold makes hermetic hold a setting instead: it is written to the agent's
managed config on every apply and cannot be changed on the box. On `set` the
list replaces the one before it. The model is always held (it comes from the
agent's provider profile); --approvals can never be held. An agent created
before --hold existed holds every setting it was given until --hold is set.


A provider change is saved, not applied: `hermetic plan rollout <name>` shows
what it will do and `hermetic apply` performs it — copying the credential,
re-rendering the configuration and restarting Hermes on the box.

hermetic agent stop

Usage: hermetic agent stop [options] <name>

stop an agent's instance

Arguments:
  name                      agent name

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

hermetic agent start

Usage: hermetic agent start [options] <name>

start an agent's instance

Arguments:
  name                      agent name

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

hermetic agent recreate

Usage: hermetic agent recreate [options] <name>

replace the instance, keep the data volume

Arguments:
  name                      agent name

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --yes                     skip the interactive confirmation
  -h, --help                display help for command

hermetic agent destroy

Usage: hermetic agent destroy [options] <name>

terminate the instance and delete this agent's resources

Arguments:
  name                      agent name

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --yes                     skip the interactive confirmation
  --keep-volume             keep the data volume, released from the name
  -h, --help                display help for command

By default destroy deletes the data volume along with the instance; only the
agent's history survives (`hermetic agent destroyed`). --keep-volume leaves
the volume behind, released from the name (tagged hermetic:former_agent), so a
later create of the same name starts fresh; adopt it on purpose with
`hermetic agent create <name> --volume vol-…`.

hermetic agent history

Usage: hermetic agent history [options] <name>

the append-only event log for one agent

Arguments:
  name                      agent name

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --limit <n>               most recent N events
  --since <iso>             only events at or after this instant (ISO 8601)
  --until <iso>             only events at or before this instant (ISO 8601)
  -h, --help                display help for command

A reused name's log holds every incarnation back to back. Pass a tombstone's
created_at and released_at (destroyed_at when it has none; `hermetic agent
destroyed <name> --json`) as --since/--until to read one life alone.

hermetic agent destroyed

Usage: hermetic agent destroyed [options] [name]

destroyed agents, newest first: when, by whom, and what became of the volume

Arguments:
  name                      only this name's incarnations

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --limit <n>               most recent N records
  -h, --help                display help for command

secrets commands

hermetic secrets

Usage: hermetic secrets [options] [command]

secret slots in SSM Parameter Store

Options:
  -h, --help               display help for command

Commands:
  push [options] <name>    push a value into one of an agent's slots, or the
                           fleet's
  verify [options] <name>  report which slots exist and which are still
                           placeholders
  ls [options]             the fleet's shared secret slots: state, who reads
                           them, when they were set
  rm [options] <slug>      delete one shared secret slot
  help [command]           display help for command

hermetic secrets push

Usage: hermetic secrets push [options] <name>

push a value into one of an agent's slots, or the fleet's

Arguments:
  name                      agent name, or _fleet for --tailscale-oauth /
                            --shared

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --provider-key            push the model provider's API key
  --bws-token               push the Bitwarden Secrets Manager access token
  --from-bitwarden          pull the value out of Bitwarden instead of reading
                            it
  --tailscale-oauth         rotate the fleet's Tailscale OAuth client secret
                            (verifies it can mint tag:hermetic keys and list
                            devices before storing)
  --shared <slug>           push a fleet-level shared key into
                            /hermetic/<fleet_id>/secrets/<slug>
  --label <text>            what to call that shared slot in `secrets ls`
  --rekey [agents]          re-copy the new value into agents already running on
                            this slot: `all`, or a comma-separated list
  -h, --help                display help for command

Examples:
  hermetic secrets push atlas --provider-key
                                                 prompts, writes the slot atlas's own `credential_ref` names
                                                 (/hermes/<fleet_id>/atlas/<slot>; `provider-key` on a row
                                                 that predates provider profiles)
  hermetic secrets push atlas --bws-token
                                                 prompts, writes /hermes/<fleet_id>/atlas/bws-token
  hermetic secrets push _fleet --tailscale-oauth
                                                 prompts, writes /hermetic/<fleet_id>/tailscale/oauth-secret
  hermetic secrets push _fleet --shared nous-key --label 'Nous Portal'
                                                 prompts, writes /hermetic/<fleet_id>/secrets/nous-key
  hermetic secrets push _fleet --shared nous-key --rekey all
                                                 and re-copies it into every agent whose provider reads it

A shared slot is *copied* into an agent at create, never read by the box:
/hermetic/* is outside what an instance role may read. So rotating one does
not reach live agents unless --rekey says so, and each re-keyed agent takes
the new value on its next `agent recreate`.

The Tailscale OAuth client secret is proved before it is stored: a client that
cannot mint a tag:hermetic key is refused and nothing is written. Create the
new client with Auth Keys -> Write and Devices -> Core -> Read, Write, both
tagged tag:hermetic, then delete the old one once this succeeds.

hermetic secrets verify

Usage: hermetic secrets verify [options] <name>

report which slots exist and which are still placeholders

Arguments:
  name                      agent name, or _fleet for the fleet-wide Tailscale
                            OAuth slots

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

hermetic secrets ls

Usage: hermetic secrets ls [options]

the fleet's shared secret slots: state, who reads them, when they were set

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

STATE:
  set      a value is in the slot
  empty    the slot exists but still holds hermetic's placeholder
  missing  named by settings, but there is no parameter behind it
  orphan   a parameter under /hermetic/<fleet_id>/secrets/ nothing names

No value is ever printed, by this or any other read (§8.3).

hermetic secrets rm

Usage: hermetic secrets rm [options] <slug>

delete one shared secret slot

Arguments:
  slug                      the slug of the shared slot, e.g. nous-key

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --yes                     skip the interactive confirmation
  -h, --help                display help for command

Refused while anything in the fleet still reads the slug; core names what
does. Free it by moving those agents onto another provider profile
(`hermetic agent set <name> --provider-profile <id|name>`, then apply) or by
recreating them; a slug a provider profile owns goes with
`hermetic providers rm <id|name>`.

Agents already holding a copy keep it — this deletes the fleet's slot, not
theirs.

settings commands

hermetic settings

Usage: hermetic settings [options] [command]

the fleet's shared settings: defaults every laptop inherits

Options:
  -h, --help      display help for command

Commands:
  show [options]  the fleet's shared defaults, agent defaults and provider
                  profiles
  set [options]   change the fleet's defaults, or the Hermes settings a create
                  seeds
  help [command]  display help for command

hermetic settings show

Usage: hermetic settings show [options]

the fleet's shared defaults, agent defaults and provider profiles

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

These live on `_fleet` in DynamoDB, so a second laptop that attaches to this
fleet reads the same answers. `version (not written yet)` means the fleet
predates shared settings and this is what it would have: run
`hermetic foundation update`, or simply set something.

hermetic settings set

Usage: hermetic settings set [options]

change the fleet's defaults, or the Hermes settings a create seeds

Options:
  --json                       print a machine-readable document on stdout and
                               nothing else
  --fleet <fleet-id|alias>     which frozen fleet to run against, by fleet id or
                               display alias; else HERMETIC_FLEET, else the
                               default from `hermetic fleet use`
  --size <size>                default instance size for a new agent
  --default-profile <id|name>  the provider profile a create with no flags uses
  --volume-gib <gib>           default data volume size in GiB
  --root-gib <gib>             default root (system) disk size in GiB
  --secrets <mode>             none | bitwarden
  --model <id>                 fleet-wide default model id
  --terminal <backend>         local | docker
  --max-turns <n>              ceiling on tool-calling turns in one agent run
  --reasoning <effort>         low | medium | high
  --approvals <mode>           smart | manual | off (default off)
  --clear-agent-defaults       drop the fleet-wide Hermes settings entirely
  --expected-version <n>       refuse unless the settings are still at this
                               version
  -h, --help                   display help for command

A fleet default is not a per-agent instruction: an agent that never stated a
setting is *seeded* with the fleet's answer and then owns it, so its own
dashboard can still change it (§6.4).

Examples:
  hermetic settings set --default-profile anthropic-main
  hermetic settings set --size large --volume-gib 200
  hermetic settings set --model claude-sonnet-5 --expected-version 3

hermetic providers

Usage: hermetic providers [options] [command]

the fleet's provider profiles: named credentials an agent is created against

Options:
  -h, --help                  display help for command

Commands:
  ls [options]                every provider profile: model, readiness, linked
                              agents, fleet default
  create [options]            create a named provider profile and store its key
  update [options] <profile>  rename, re-model, enable, disable, rotate the key
                              of, or default one profile
  rm [options] <profile>      delete a provider profile and the credential slot
                              it owns
  models [options]            the provider's live model catalog, for a saved
                              profile or a draft key
  help [command]              display help for command

hermetic providers ls

Usage: hermetic providers ls [options]

every provider profile: model, readiness, linked agents, fleet default

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

READY is whether an agent can be created on this profile. `no (key-missing)`
and `no (key-placeholder)` are a slot nobody has filled; `no (grant-missing)`
is a Bedrock model this fleet's instance role may not invoke yet, fixed by
`hermetic foundation update`. A stored key is never a verified one.

hermetic providers create

Usage: hermetic providers create [options]

create a named provider profile and store its key

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --provider <provider>     bedrock | anthropic | openrouter | nous | openai |
                            vercel
  --name <name>             what to call this profile, unique on the fleet
  --model <id>              model this profile defaults to; omitted takes the
                            catalog's
  --api-key-stdin           read the provider's API key from stdin instead of
                            prompting
  --no-key                  create the profile without a key; it is not ready
                            until one is pushed
  --disabled                create it disabled, so `agent create` does not offer
                            it
  --default                 make this the fleet's default profile
  --expected-version <n>    refuse unless the settings are still at this version
  -h, --help                display help for command

The key is never a flag value — `hermetic runs` records a command's arguments
and a shell records its history — so it is read from a password prompt or
stdin and written straight to the fleet's own SSM slot (§8.3).

Examples:
  hermetic providers create --provider anthropic --name main --default
  cat key.txt | hermetic providers create --provider vercel --name gw --api-key-stdin
  hermetic providers create --provider bedrock --name role --model zai.glm-4.7-flash

hermetic providers update

Usage: hermetic providers update [options] <profile>

rename, re-model, enable, disable, rotate the key of, or default one profile

Arguments:
  profile                   profile id or name

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --name <name>             rename the profile
  --model <id>              the model this profile resolves to
  --enable                  offer this profile to `agent create`
  --disable                 hide it; the fleet default profile may not be
                            disabled
  --api-key-stdin           rotate the key, read from stdin instead of prompting
  --rotate-key              rotate the key, prompting for it
  --default                 make this the fleet's default profile
  --provider <provider>     refused: a profile's provider is immutable
  --expected-version <n>    refuse unless the settings are still at this version
  -h, --help                display help for command

Every change bumps the profile's revision, the key rotation included: an
agent pinned to an older revision is stale the moment anything moves.
A model set here is persisted exactly as given and is never re-derived from
a catalog read, so refreshing the picker cannot move it (§8.3).

hermetic providers rm

Usage: hermetic providers rm [options] <profile>

delete a provider profile and the credential slot it owns

Arguments:
  profile                   profile id or name

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --yes                     skip the confirmation
  -h, --help                display help for command

Refused while any agent still runs on the profile, and while it is the
fleet default. The slot it deletes is the one the profile owns; a slot the
profile merely inherited from the pre-profile settings is left alone.

hermetic providers models

Usage: hermetic providers models [options]

the provider's live model catalog, for a saved profile or a draft key

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --profile <profile>       a saved profile, by id or name
  --provider <provider>     bedrock | anthropic | openrouter | nous | openai |
                            vercel
  --api-key-stdin           read a draft key from stdin; goes with --provider
  -h, --help                display help for command

A read of somebody else's service, nothing more: it stores nothing, caches
nothing, and cannot move a profile's model. The selected model is listed
first, and an id the provider's catalog does not contain is marked
`unlisted` rather than dropped.

Examples:
  hermetic providers models --profile main
  cat key.txt | hermetic providers models --provider openai --api-key-stdin

ops commands

hermetic upgrade

Usage: hermetic upgrade [options] [name]

pin a new hermes version per agent, or move the whole fleet to a new hermeticd

Arguments:
  name                      a single agent for --hermes; omit with --all, and
                            always for --hermeticd

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --hermes <version>        hermes version to pin; takes effect on the next
                            recreate, or at once with --now
  --hermeticd <version>     hermeticd version the whole fleet moves to; rewrites
                            the fleet manifest, takes no agent name
  --all                     every agent in the fleet
  --now                     with --hermes: ask each running box to apply the new
                            pin in place and wait for it to report (§6.5)
  -h, --help                display help for command

Examples:
  hermetic upgrade atlas --hermes 0.22.0             pin it; the box installs it on its next recreate
  hermetic upgrade atlas --hermes 0.22.0 --now       pin it and converge the running box in place
  hermetic upgrade --all --hermes 0.22.0 --now       the same, one agent at a time across the fleet
  hermetic upgrade --hermeticd 0.6.0                 the fleet's hermeticd, on each box's nightly update

--now writes the same converge request `hermetic plan rollout` does: hermeticd
reinstalls Hermes and restarts its units, and this waits up to ten minutes per
box for it to report the new config. A box that is not up (stopped, still
booting) is skipped and keeps the pin for its next boot; one that does not
report in time is a warning, not a failure. The box installs this build's
Hermes ref, exactly as a recreate from this checkout would.

hermetic ssh

Usage: hermetic ssh [options] <name>

tailscale ssh into an agent

Arguments:
  name                      agent name

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

hermetic logs

Usage: hermetic logs [options] <name> [unit]

stream an agent's logs over the loopback RPC

Arguments:
  name                      agent name
  unit                      systemd unit; defaults to every hermetic unit

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -f, --follow              keep the stream open
  --file <name>             one of Hermes's own log files on the data volume,
                            instead of a systemd unit (choices: "agent",
                            "errors", "gateway")
  --console                 read the instance's serial console instead of the
                            RPC
  -h, --help                display help for command

chat commands

hermetic chat

Usage: hermetic chat [options] [command] <target> [message]

send one turn to a bot and stream the reply

Arguments:
  target                       `<instance>` or `<instance>/<bot>`
  message                      the message; omit it to send piped stdin

Options:
  --json                       print a machine-readable document on stdout and
                               nothing else
  --fleet <fleet-id|alias>     which frozen fleet to run against, by fleet id or
                               display alias; else HERMETIC_FLEET, else the
                               default from `hermetic fleet use`
  --session <id>               continue a session instead of the bot's canonical
                               one
  -h, --help                   display help for command

Commands:
  ls [options] <target>        one bot's conversations, and where each of them
                               came from
  log [options] <target>       a bot's transcript, read from the box
  watch [options] <target>     watch a conversation for messages, including ones
                               sent elsewhere
  abort [options] <target>     stop the turn a bot is in the middle of
  listening [options]          list instances this laptop listens to in the
                               selected fleet
  listen [options] <instance>  listen to an instance, or stop listening with
                               --off
  settings [options]           read or change this laptop's chat settings
  open [options]               chat.open: profile-scoped Bot Mode operation
  compact [options]            chat.compact: profile-scoped Bot Mode operation
  archive [options]            chat.archive: profile-scoped Bot Mode operation
  respond [options]            chat.respond: profile-scoped Bot Mode operation

  hermetic chat atlas 'what is the disk at'      one turn, reply streamed
  echo 'summarise today' | hermetic chat atlas   the same, from stdin
  hermetic chat atlas 'hello' --json             ChatFrame NDJSON on stdout

A turn is not an op: it is a live pipe to Hermes on the box, so it is not in
`hermetic ops`, it cannot be resumed, and Ctrl-C ends it here and on the box.

There is no interactive session yet. Pass a message or pipe one.

hermetic chat ls

Usage: hermetic chat ls [options] <target>

one bot's conversations, and where each of them came from

Arguments:
  target                    `<instance>` or `<instance>/<bot>`

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

ORIGIN is where the session came from, and it is a safety field: a reply into
a `channel` session leaves the tailnet and lands in somebody's Slack, and a
reply into a `peer` session is answering another bot.

hermetic chat log

Usage: hermetic chat log [options] <target>

a bot's transcript, read from the box

Arguments:
  target                    `<instance>` or `<instance>/<bot>`

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --session <id>            one session instead of the canonical one
  --limit <n>               at most N messages
  -h, --help                display help for command

The transcript lives on the box, on the data volume, so it survives a
recreate and is read fresh every time — hermetic keeps no copy of it.

hermetic chat watch

Usage: hermetic chat watch [options] <target>

watch a conversation for messages, including ones sent elsewhere

Arguments:
  target                    `<instance>` or `<instance>/<bot>`

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --session <id>            one session instead of the canonical one
  -h, --help                display help for command

  hermetic chat watch atlas            new messages as they land
  hermetic chat watch atlas --json     ChatObserveEvent NDJSON on stdout

A watch sends nothing. It exists so that a message typed into Hermes Desktop,
sent from another laptop, or produced by a cron routine reaches you without
anybody refreshing anything. It never creates a session, warms a model or
starts a turn, and Ctrl-C stops watching here and changes nothing on the box.

It does not end on its own: a conversation is never over.

hermetic chat abort

Usage: hermetic chat abort [options] <target>

stop the turn a bot is in the middle of

Arguments:
  target                    `<instance>` or `<instance>/<bot>`

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --session <id>            the session whose turn to stop
  -h, --help                display help for command

hermetic chat listening

Usage: hermetic chat listening [options]

list instances this laptop listens to in the selected fleet

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

hermetic chat listen

Usage: hermetic chat listen [options] <instance>

listen to an instance, or stop listening with --off

Arguments:
  instance                  the instance to monitor

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --off                     stop monitoring and disconnect chat
  -h, --help                display help for command

hermetic chat settings

Usage: hermetic chat settings [options]

read or change this laptop's chat settings

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --redact <on|off>         mask secrets in transcripts (rosters, sessions,
                            history, turns)
  -h, --help                display help for command

Local to this laptop, shared with the portal. Redaction is off by default: a
transcript shows what the box wrote, secrets included. With it on, every read
and every live turn is masked before it leaves core. Errors are masked either way.

hermetic chat open

Usage: hermetic chat open [options]

chat.open: profile-scoped Bot Mode operation

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --input <json>            typed request JSON; instance and bot/room identify
                            the target
  -h, --help                display help for command

hermetic chat compact

Usage: hermetic chat compact [options]

chat.compact: profile-scoped Bot Mode operation

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --input <json>            typed request JSON; instance and bot/room identify
                            the target
  -h, --help                display help for command

hermetic chat archive

Usage: hermetic chat archive [options]

chat.archive: profile-scoped Bot Mode operation

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --input <json>            typed request JSON; instance and bot/room identify
                            the target
  -h, --help                display help for command

hermetic chat respond

Usage: hermetic chat respond [options]

chat.respond: profile-scoped Bot Mode operation

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --input <json>            typed request JSON; instance and bot/room identify
                            the target
  -h, --help                display help for command

hermetic bots

Usage: hermetic bots [options] [command]

the bots this fleet's boxes are running

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

Commands:
  ls [options]              every listened-to instance's swarm, or one
                            instance's
  capabilities [options]    bots.capabilities: profile-scoped Bot Mode operation
  get [options]             bots.get: profile-scoped Bot Mode operation
  create [options]          bots.create: profile-scoped Bot Mode operation
  update [options]          bots.update: profile-scoped Bot Mode operation
  delete [options]          bots.delete: profile-scoped Bot Mode operation
  help [command]            display help for command

hermetic bots ls

Usage: hermetic bots ls [options]

every listened-to instance's swarm, or one instance's

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --instance <name>         one listened-to agent box
  -h, --help                display help for command

An instance is an agent box and a bot is a Hermes profile on it. Today every
box runs exactly one bot, `default`, which is $HERMES_HOME itself — so
`atlas` and `atlas/default` address the same bot.

A box that does not answer is listed as unreachable with the reason, never
omitted: a fleet read that dropped the boxes it could not reach would read
as a fleet that is smaller than it is.

hermetic bots capabilities

Usage: hermetic bots capabilities [options]

bots.capabilities: profile-scoped Bot Mode operation

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --input <json>            typed request JSON; instance and bot/room identify
                            the target
  -h, --help                display help for command

hermetic bots get

Usage: hermetic bots get [options]

bots.get: profile-scoped Bot Mode operation

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --input <json>            typed request JSON; instance and bot/room identify
                            the target
  -h, --help                display help for command

hermetic bots create

Usage: hermetic bots create [options]

bots.create: profile-scoped Bot Mode operation

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --input <json>            typed request JSON; instance and bot/room identify
                            the target
  -h, --help                display help for command

hermetic bots update

Usage: hermetic bots update [options]

bots.update: profile-scoped Bot Mode operation

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --input <json>            typed request JSON; instance and bot/room identify
                            the target
  -h, --help                display help for command

hermetic bots delete

Usage: hermetic bots delete [options]

bots.delete: profile-scoped Bot Mode operation

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --input <json>            typed request JSON; instance and bot/room identify
                            the target
  -h, --help                display help for command

hermetic inbox

Usage: hermetic inbox [options] [command]

notifications this laptop has raised about the fleet

Options:
  --json                     print a machine-readable document on stdout and
                             nothing else
  --fleet <fleet-id|alias>   which frozen fleet to run against, by fleet id or
                             display alias; else HERMETIC_FLEET, else the
                             default from `hermetic fleet use`
  --unread                   only rows that have not been acked
  --limit <n>                at most N rows
  --view <view>              inbox (default), snoozed, history or all
  --all                      every row, whatever its state (same as --view all)
  -h, --help                 display help for command

Commands:
  ack [options] [ids...]     mark notifications read (or unread), or every
                             unread one
  clear [options] [ids...]   move notifications out of the inbox and into
                             history
  snooze [options] <ids...>  hide notifications from the inbox until a later
                             time
  settings [options]         read or change the inbox's auto-clear rules and
                             terminal alerts
  mute [options] <target>    silence an agent, or a whole source, in this
                             laptop's inbox

Kept in ~/.hermetic/hermetic.db beside `runs`, for 30 days. A notification is
about who is watching, not about the fleet: another laptop on the same fleet
keeps its own inbox, and `inbox mute` here silences nothing there.

Views: `inbox` is what is still in front of you; `snoozed` is hidden until a
time you chose; `history` is what was cleared (by you, or by the auto-clear
rules in `inbox settings`) plus conditions that resolved; `all` is everything.

STATE reads `*` unread, `~` muted, then `cleared`, `snoozed until …`,
`resolved` where the condition it reported has since gone away, or the row's
class. Resolved is not read: the fleet fixed itself, nobody acknowledged
anything, and the row stays listed as the record that it happened.

hermetic inbox ack

Usage: hermetic inbox ack [options] [ids...]

mark notifications read (or unread), or every unread one

Arguments:
  ids                       the notification ids; omit with --all

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --all                     every unread row of this fleet
  --unread                  mark the named rows unread instead
  -h, --help                display help for command

hermetic inbox clear

Usage: hermetic inbox clear [options] [ids...]

move notifications out of the inbox and into history

Arguments:
  ids                       the notification ids; omit with --read or --resolved

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --read                    every read row in the inbox
  --resolved                every resolved row in the inbox
  --restore                 put the named rows back in the inbox (un-clear and
                            un-snooze)
  -h, --help                display help for command

A cleared row is kept in history until retention deletes it (30 days), and
clearing an unread row marks it read. Clearing a condition that still holds
hides it until it changes: once it resolves, a recurrence is a new row.

hermetic inbox snooze

Usage: hermetic inbox snooze [options] <ids...>

hide notifications from the inbox until a later time

Arguments:
  ids                       the notification ids

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --for <duration>          how long: 1h, 4h, 1d, 1w (any <n>m|h|d|w)
  --until <iso>             until this moment (ISO 8601, UTC `Z`)
  --clear                   unsnooze: bring the rows back now
  -h, --help                display help for command

hermetic inbox settings

Usage: hermetic inbox settings [options]

read or change the inbox's auto-clear rules and terminal alerts

Options:
  --json                             print a machine-readable document on stdout
                                     and nothing else
                                     AWS
  --fleet <fleet-id|alias>           which frozen fleet to run against, by fleet
                                     id or display alias; else HERMETIC_FLEET,
                                     else the default from `hermetic fleet use`
  --auto-clear <after>               clear read rows after never, 1d, 7d or 30d
  --clear-resolved-on-read <on|off>  clear a resolved condition once it is read
  --terminal-alerts <on|off>         notify about desktop terminal sessions; off
                                     also resolves their open rows
  -h, --help                         display help for command

Local to this laptop, shared with the portal. The rules run whenever the inbox
is read or written, so an idle inbox still converges.

The first list after upgrading to a build with these rules applies the
defaults at once: every row read more than 7 days ago, and every row both read
and resolved, moves to History. Nothing is deleted; `inbox --view history`
shows them and `inbox clear <id> --restore` brings one back, and a restored row
is not cleared again until it is read again or ages out from the restore.

hermetic inbox mute

Usage: hermetic inbox mute [options] <target>

silence an agent, or a whole source, in this laptop's inbox

Arguments:
  target                    an agent name, or
                            `source:operation|agent|fleet|chat|budget|terminal`

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --clear                   unmute instead
  -h, --help                display help for command

A mute hides nothing: muted rows still appear in `inbox`, marked, and stop
asking for attention. It is local to this laptop and shared with the portal.

other commands

hermetic teardowns

Usage: hermetic teardowns [options]

permanent local record of every teardown this home has run

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --last                    only the most recent teardown
  --limit <n>               at most N receipts
  --events                  include each receipt's full event log
  -h, --help                display help for command

Kept in ~/.hermetic/hermetic.db and never cleared — `teardown --reset-local`
forgets which account this home was pointed at; this is what still says
what was left in it.

hermetic volume

Usage: hermetic volume [options] [command]

data volumes: what exists, and what nothing is reading

Options:
  -h, --help                    display help for command

Commands:
  ls [options]                  every data volume, grouped by what is reading it
  status [options] <volume-id>  everything known about one volume, with its
                                snapshots
  delete [options] <volume-id>  delete a volume nothing is reading; its
                                snapshots are kept
  help [command]                display help for command

hermetic volume ls

Usage: hermetic volume ls [options]

every data volume, grouped by what is reading it

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --unattached              only volumes nothing is attached to
  -h, --help                display help for command

Groups, in the order they print:
  no agent    free, and no live agent row owns it — the reclaimable case
  ambiguous   two volumes carry one agent tag; hermetic will not guess (§1)
  detached    free, but a live agent still owns it — `agent recreate` wants it back
  attached    an instance is reading it
  not this fleet   unattached volumes hermetic did not create; listed because they bill

To put a new agent on one:
  hermetic agent create <name> --volume <volume-id>

hermetic volume status

Usage: hermetic volume status [options] <volume-id>

everything known about one volume, with its snapshots

Arguments:
  volume-id                 EBS volume id, e.g. vol-0c85d3b7f1a94e620

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

hermetic volume delete

Usage: hermetic volume delete [options] <volume-id>

delete a volume nothing is reading; its snapshots are kept

Arguments:
  volume-id                 EBS volume id

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --yes                     skip the interactive confirmation
  -h, --help                display help for command

One step and a typed confirmation, the same ceremony `agent destroy --yes` has:
the whole plan is one line, so there is nothing a plan stage could show that
the confirmation does not. It refuses an attached volume, one a live agent row
still owns, an ambiguous one, and any volume hermetic did not create.

hermetic presets

Usage: hermetic presets [options] [command]

this laptop's create presets: the machine bundles agent create starts from

Options:
  -h, --help      display help for command

Commands:
  show [options]  the loadout, its default, and every built-in and custom preset
  set [options]   change the loadout, the default, or the custom presets
  help [command]  display help for command

hermetic presets show

Usage: hermetic presets show [options]

the loadout, its default, and every built-in and custom preset

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

hermetic presets set

Usage: hermetic presets set [options]

change the loadout, the default, or the custom presets

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --file <path>             a JSON object with any of loadout, default, custom
                            (`presets show --json` is one)
  --loadout <ids>           four comma-separated preset ids, `-` for an empty
                            slot
  --default <id>            the preset a create with no machine flags uses
  --reset                   forget this laptop's presets: back to Light ·
                            Standard · Heavy · GPU
  -h, --help                display help for command

A preset is a machine: size, data volume and system disk. It lives on this
laptop only; another laptop on the same fleet keeps its own.

Examples:
  hermetic presets set --default heavy
  hermetic presets set --loadout light,standard,heavy,gpu-m
  hermetic presets show --json > p.json   # edit custom, then:
  hermetic presets set --file p.json
  hermetic presets set --reset

hermetic rooms

Usage: hermetic rooms [options] [command]

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

Commands:
  list [options]            rooms.list: profile-scoped Bot Mode operation
  get [options]             rooms.get: profile-scoped Bot Mode operation
  create [options]          rooms.create: profile-scoped Bot Mode operation
  rename [options]          rooms.rename: profile-scoped Bot Mode operation
  delete [options]          rooms.delete: profile-scoped Bot Mode operation
  history [options]         rooms.history: profile-scoped Bot Mode operation
  send [options]            rooms.send: profile-scoped Bot Mode operation
  control [options]         rooms.control: profile-scoped Bot Mode operation
  respond [options]         rooms.respond: profile-scoped Bot Mode operation
  help [command]            display help for command

hermetic rooms list

Usage: hermetic rooms list [options]

rooms.list: profile-scoped Bot Mode operation

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --input <json>            typed request JSON; instance and bot/room identify
                            the target
  -h, --help                display help for command

hermetic rooms get

Usage: hermetic rooms get [options]

rooms.get: profile-scoped Bot Mode operation

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --input <json>            typed request JSON; instance and bot/room identify
                            the target
  -h, --help                display help for command

hermetic rooms create

Usage: hermetic rooms create [options]

rooms.create: profile-scoped Bot Mode operation

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --input <json>            typed request JSON; instance and bot/room identify
                            the target
  -h, --help                display help for command

hermetic rooms rename

Usage: hermetic rooms rename [options]

rooms.rename: profile-scoped Bot Mode operation

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --input <json>            typed request JSON; instance and bot/room identify
                            the target
  -h, --help                display help for command

hermetic rooms delete

Usage: hermetic rooms delete [options]

rooms.delete: profile-scoped Bot Mode operation

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --input <json>            typed request JSON; instance and bot/room identify
                            the target
  -h, --help                display help for command

hermetic rooms history

Usage: hermetic rooms history [options]

rooms.history: profile-scoped Bot Mode operation

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --input <json>            typed request JSON; instance and bot/room identify
                            the target
  -h, --help                display help for command

hermetic rooms send

Usage: hermetic rooms send [options]

rooms.send: profile-scoped Bot Mode operation

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --input <json>            typed request JSON; instance and bot/room identify
                            the target
  -h, --help                display help for command

hermetic rooms control

Usage: hermetic rooms control [options]

rooms.control: profile-scoped Bot Mode operation

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --input <json>            typed request JSON; instance and bot/room identify
                            the target
  -h, --help                display help for command

hermetic rooms respond

Usage: hermetic rooms respond [options]

rooms.respond: profile-scoped Bot Mode operation

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --input <json>            typed request JSON; instance and bot/room identify
                            the target
  -h, --help                display help for command

hermetic routines

Usage: hermetic routines [options] [command]

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

Commands:
  list [options]            routines.list: profile-scoped Bot Mode operation
  create [options]          routines.create: profile-scoped Bot Mode operation
  update [options]          routines.update: profile-scoped Bot Mode operation
  delete [options]          routines.delete: profile-scoped Bot Mode operation
  run [options]             routines.run: profile-scoped Bot Mode operation
  history [options]         routines.history: profile-scoped Bot Mode operation
  help [command]            display help for command

hermetic routines list

Usage: hermetic routines list [options]

routines.list: profile-scoped Bot Mode operation

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --input <json>            typed request JSON; instance and bot/room identify
                            the target
  -h, --help                display help for command

hermetic routines create

Usage: hermetic routines create [options]

routines.create: profile-scoped Bot Mode operation

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --input <json>            typed request JSON; instance and bot/room identify
                            the target
  -h, --help                display help for command

hermetic routines update

Usage: hermetic routines update [options]

routines.update: profile-scoped Bot Mode operation

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --input <json>            typed request JSON; instance and bot/room identify
                            the target
  -h, --help                display help for command

hermetic routines delete

Usage: hermetic routines delete [options]

routines.delete: profile-scoped Bot Mode operation

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --input <json>            typed request JSON; instance and bot/room identify
                            the target
  -h, --help                display help for command

hermetic routines run

Usage: hermetic routines run [options]

routines.run: profile-scoped Bot Mode operation

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --input <json>            typed request JSON; instance and bot/room identify
                            the target
  -h, --help                display help for command

hermetic routines history

Usage: hermetic routines history [options]

routines.history: profile-scoped Bot Mode operation

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  --input <json>            typed request JSON; instance and bot/room identify
                            the target
  -h, --help                display help for command

hermetic policy

Usage: hermetic policy [options]

hermetic's own entries in the tailnet policy file, and any drift

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

hermetic manages only the lines between its `// hermetic:managed` markers.
Everything else in the policy — your comments, your key order, your own
rules — is written back byte for byte. `hermetic plan policy` shows the
diff; `hermetic apply` writes it.

hermetic network

Usage: hermetic network [options] [command]

the fleet's network mode (§5): public addresses or a NAT appliance

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

Commands:
  status [options]          which mode this fleet is in, whether the record
                            agrees, and which agents drifted
  help [command]            display help for command

hermetic network status

Usage: hermetic network status [options]

which mode this fleet is in, whether the record agrees, and which agents drifted

Options:
  --json                    print a machine-readable document on stdout and
                            nothing else
  --fleet <fleet-id|alias>  which frozen fleet to run against, by fleet id or
                            display alias; else HERMETIC_FLEET, else the default
                            from `hermetic fleet use`
  -h, --help                display help for command

CloudFormation owns the answer: the stack's `Network` parameter decides
which subnets exist, and the `_fleet` item is only a cache of it. A mode
change strands every existing agent on the old subnets until each is
recreated — `hermetic plan network --to <mode>` says so before it happens.

hermetic apply

Usage: hermetic apply [options] <plan-file>

execute a plan written by `hermetic plan …`

Arguments:
  plan-file                      path to a plan JSON document, or - for stdin

Options:
  --json                         print a machine-readable document on stdout and
                                 nothing else
  --fleet <fleet-id|alias>       which frozen fleet to run against, by fleet id
                                 or display alias; else HERMETIC_FLEET, else the
                                 default from `hermetic fleet use`
  --yes                          skip the interactive confirmation
  --confirm-account-id <digits>  the twelve digits, required for a teardown
                                 plan; interactively you type them at the prompt
  -h, --help                     display help for command

Examples:
  hermetic apply plan.json                          interactive: confirm, then apply
  hermetic apply plan.json --yes                    scripted, for a destroy or recreate plan
  hermetic apply teardown.json --yes --confirm-account-id 123456789012
                                                    a teardown plan also needs the account id