v1.2.0 Tripwire

Honeyfile decoys that catch an agent reaching for credentials, rendered as a facility alarm.

Honeyfile decoys

Every agent workspace is seeded with a few convincing fake secrets files (.aws/credentials, .env.production, secrets/api_keys.txt), each embedding a unique canary token. A well-behaved agent never reads unrequested credentials; one that does trips the alarm.

Two detection layers

A direct read of a decoy by path (caught before the contents ever reach the model), and a canary token surfacing in any tool's output (catches a shell cat, grep, etc. via run_command).

On a trip

The run is flagged and, by default, killed; a row is written to a new tripwires audit table; the agent enters a new TRIPPED state; a Telegram DM is sent if configured. HEARTH_TRIPWIRE=flag records and warns without killing; HEARTH_DECOYS=off disables planting.

System decoys

nixos/modules/tripwire.nix plants world-readable bait under /var/lib/hearth/decoys and a sudo-only decoy inside the secrets dir, for an agent that goes looking beyond its workspace. Raw-open detection via auditd arrives in v2.0.

Spectacle

The world map flashes red with an alarm banner when any agent trips, the sprite shows a pulsing siren, and the cockpit security scoreboard goes armed with a live trip count. New GET /tripwires.

v1.1.0 Manifest

Per-run containment you can declare at launch, and the first spectacle counter.

Capability manifests

Declare tools: [...] on any launch and the run may use ONLY those tools, in every permission mode including bypass. Enforced as a hard deny in the permission engine, filtered out of the model's advertised tool list, and excluded from text-emitted tool-call parsing, so there is no path around the cap. Works on background runs, interactive sessions, missions, marathons, and self-evolve (--allowed-tools / HEARTH_ALLOWED_TOOLS).

Egress allowlists (tool layer)

Declare allowed_hosts and the web tools (web_fetch, web_search, http_request, fetch_to_kb) may reach ONLY those hosts (subdomains included, loopback always allowed). Every outbound attempt, allowed or blocked, is recorded to a new egress_log audit table, readable at GET /egress. OS-level enforcement lands in v1.4; this layer stops accidents and naive injection and makes all egress visible.

Swarm scoping inheritance

Specialists spawned by a mission manager now inherit the manager's credential, tool, and host scoping. Previously scoping did not propagate to children.

Cloud cost saved

The audit log now shows what your runs would have cost on a frontier cloud model: a live counter in the world HUD and the cockpit stats panel.

Security scoreboard

GET /security and a cockpit panel showing what containment is active right now: remote auth, rate limit, manifests, egress activity, tripwire status (arriving in v1.2), daemon health.

New endpoints: GET /tools, GET /egress, GET /security.

hearth v1.0.0

hearth 1.0 🔥

Local LLMs and autonomous agents on NixOS: sandboxed by default, every run audited, the whole OS reproducible from one flake.

hearth is stable. What started as a declarative way to run local agents safely is now a complete local AI platform, and the surface is solid enough to call 1.0.

What hearth does

• Sandboxed agents. Ephemeral systemd units with a written threat model: no writes outside their workspace, no host secrets, no privilege escalation. Permission modes (plan / auto / bypass), an approvals queue, and a kill switch.
• Every run audited to local SQLite: tokens, cost, latency, errors.
• Reproducible whole-OS flake with atomic, bootloader-level rollback.
• OpenAI-compatible API. Point Cursor, Continue, or the openai SDK at hearth and use your local models, with real token streaming and full auditing.
• Knowledge base (RAG). Ingest docs or a whole repo; semantic retrieval via local embeddings with lexical fallback; auto-recalled into agent context.
• Standing missions. A scheduler that runs missions on a cadence, the works-while-you-sleep layer.
• Self-improvement. An always-on loop proposes changes to hearth's own config, validates them with nix flake check, compounds and learns, and produces reviewable branches with one-click promote-to-live and an auto-rollback watchdog.
• Observability. A Prometheus /metrics endpoint, a usage-over-time view, and hearth-doctor for a one-command health check.
• Local and private throughout. Ollama on your own GPU, nothing leaves the box.

Honest about the ceiling

Local model quality is the real limit, not the platform. The swarm (decompose hard work into small parts) is the mitigation, and the credential + OpenAI tooling let you reach a stronger model for one hard step when you choose to. Autonomous changes are always gated and only ever produce reviewable branches; they never alter a running system on their own.

Getting started

Docs: https://ericfinland.github.io/hearth/ · Full history: CHANGELOG

git clone https://github.com/EricFinland/hearth
cd hearth
nix flake check

Change the default console password on first boot (see SECURITY.md). Thanks for trying hearth.

hearth v0.9.0 - Ready

Pre-1.0 hardening. New hearth-doctor command runs a one-shot health check (Ollama, audit DB, disk, services) with a pass/warn/fail checklist and a non-zero exit on failure. mapd's POST endpoints now have a per-IP sliding-window rate limiter (remote callers only; localhost stays unlimited), returning 429 over the limit. The command cockpit stacks into a single column on phones/tablets. Docs: https://ericfinland.github.io/hearth/

hearth v0.8.0 - Projects

Project-aware agents. The new index_dir tool (and hearth_project module) walks a directory and ingests its code/text files into the knowledge base under name/relpath, skipping binaries and build dirs. Point an agent at a codebase, let it index, then kb_search to answer grounded in the real files. Docs: https://ericfinland.github.io/hearth/

hearth v0.7.0 - Insight

Observability: a Prometheus-style /metrics endpoint exposes total runs, tokens, and errors as counters, runs per model, and a daemon_up gauge per unit. Point Grafana or any scraper at it to graph hearth's activity and health. Docs: https://ericfinland.github.io/hearth/

hearth v0.6.0 - Toolsmith

Two new agent tools. replace_in_files: exact find/replace across every matching file under a path (multi-file refactor, optional glob). fetch_to_kb: fetch a web page and add its readable text to the knowledge base in one step. Both respect permission modes. Docs: https://ericfinland.github.io/hearth/

hearth v0.5.0 - Understanding

Semantic knowledge base. Retrieval now ranks by meaning using local Ollama embeddings (nomic-embed-text), cached per chunk, with automatic fallback to lexical TF-IDF when embeddings are unavailable. kb_add/kb_search use it transparently; the embed model is in the declarative manifest. Everything stays local. Docs: https://ericfinland.github.io/hearth/

hearth v0.4.0 - Recall

hearth v0.4.0 - "Recall"

This release makes hearth's knowledge work for you automatically, and makes the OpenAI endpoint feel native.

Auto-recall

Agents now start grounded. Before a run begins, hearth retrieves the knowledge-base chunks and memory lessons most relevant to the goal and injects them into the agent's context, so background workers and swarm specialists draw on your documents and on what past runs learned without having to search first. Best-effort and behind a flag, so it never gets in the way.

Real token streaming

The OpenAI-compatible endpoint (/v1/chat/completions with stream: true) now forwards the local model's tokens as they arrive, instead of a single chunk. Cursor, Continue, and any OpenAI client get native token-by-token output, and the run is still recorded to the audit log on completion.

Notes

Auto-recall uses the v0.3 knowledge base and the existing memory store; with both empty it is a silent no-op. Retrieval is still local TF-IDF (semantic embeddings remain a clean future upgrade behind the existing seam). Docs: https://ericfinland.github.io/hearth/

hearth v0.3.0 - Knowledge

hearth v0.3.0 - "Knowledge"

hearth agents can now ground their answers in your own documents, fully local and private.

New: local knowledge base (RAG)

• kb_add - ingest a document (inline text or a workspace file) into hearth's knowledge base. Re-ingesting a source updates it.
• kb_search - retrieve the chunks most relevant to a query, so a local model can answer from your material instead of guessing.

Retrieval is pure-stdlib TF-IDF cosine similarity: no embedding model to pull, deterministic, works offline. The ranking sits behind a seam, so it can be upgraded to Ollama embeddings later without changing how agents use it. Everything lives in the local audit database; nothing leaves the box.

The tools respect permission modes (kb_search is a safe read; kb_add is an edit), so they behave correctly under plan / auto / bypass.

Notes

Still honest about the ceiling: TF-IDF is lexical retrieval, great for keyword-rich material and a solid base for semantic search later. As always, every run is audited and the system is reproducible from the flake. Docs: https://ericfinland.github.io/hearth/