1# Personal agent and VM research
2
3Investigated on 2026-10-05 for a private assistant using Snow Globe and existing
4VMs. Clover rejected both Hermes and Open Dot after real trials. Both services,
5SSO clients, routes, and service secrets were removed; their data is retained.
6She intends to build her own product later. These source findings are historical.
7
8## Candidate comparison
9
10| Candidate | Existing local endpoint | Guest control | Assessment |
11| --- | --- | --- | --- |
12| [OpenClaw](https://github.com/openclaw/openclaw) | Custom Responses, Chat Completions, or Anthropic provider; image input must be declared | One Gateway routes commands and computer actions to paired nodes; macOS native app, experimental Linux/Windows CUA plugin | Best match for one assistant choosing among several existing VMs. MIT. |
13| [Hermes](https://github.com/NousResearch/hermes-agent) | Custom OpenAI endpoint, including an existing llama-server | Cross-platform CUA driver; computer follows local, Docker, SSH, or Singularity terminal placement; desktop connects to several backends | Strong personal-agent candidate with persistent memory. Multi-backend UI is documented; seamless switching of one agent across our guest fleet is untested. MIT. |
14| [Open Dot](https://github.com/composio-community/open-dot) | OpenRouter URL is hardcoded; OpenAI model discovery filters out Qwen IDs; hosted search is built into the agent loop | E2B cloud desktop, local Docker shell plus local Chromium, or local host shell | Closest product concept, but not a drop-in local model or existing VM integration. No license file or package license field found in the pinned tree; GitHub reports no detected license. |
15| [Odysseus](https://github.com/odysseus-dev/odysseus) | Local/API models and MCP documented | Inspected README describes shell/tools; arbitrary guest desktop routing was not established | Better fit for a private workspace with mail, notes, and calendar than this VM control requirement. AGPL-3.0. |
16
17Sources: OpenClaw [local providers](https://docs.openclaw.ai/gateway/local-models),
18[node hosts](https://docs.openclaw.ai/cli/node), and
19[computer use](https://docs.openclaw.ai/nodes/computer-use);
20Hermes [local models](https://hermes-agent.nousresearch.com/docs/user-guide/local-models),
21[computer use](https://hermes-agent.nousresearch.com/docs/user-guide/features/computer-use),
22[persistent memory](https://hermes-agent.nousresearch.com/docs/user-guide/features/memory),
23and [multiple backends](https://hermes-agent.nousresearch.com/docs/user-guide/multi-connection-desktop).
24
25## Open Dot source findings
26
27The inspected revision is
28[`f838e17`](https://github.com/composio-community/open-dot/tree/f838e17cf5c3a88ade5ceea54680a8145d048c1d).
29Its [computer selector](https://github.com/composio-community/open-dot/blob/f838e17cf5c3a88ade5ceea54680a8145d048c1d/src/server/computer/index.ts)
30silently changes an explicit Docker preference to local mode when Docker is
31unavailable. Its [shell executor](https://github.com/composio-community/open-dot/blob/f838e17cf5c3a88ade5ceea54680a8145d048c1d/src/server/computer/shell.ts)
32then runs `bash -lc` on the application host with inherited environment. A
33workspace working directory is not OS isolation. Its path guard uses a string
34prefix check, which also accepts a sibling whose name starts with the workspace
35path; a symlink can cross the intended boundary too. These are source findings,
36not tested exploits.
37
38The [OpenAI client](https://github.com/composio-community/open-dot/blob/f838e17cf5c3a88ade5ceea54680a8145d048c1d/src/server/agent/client.ts)
39constructs the SDK without an explicit local base URL and selects GPT/o-series
40IDs. The [OpenRouter client](https://github.com/composio-community/open-dot/blob/f838e17cf5c3a88ade5ceea54680a8145d048c1d/src/server/agent/openrouter.ts)
41pins OpenRouter's cloud URL. An SDK environment override alone would not fix
42model discovery or the unsupported hosted search used by the
43[runtime](https://github.com/composio-community/open-dot/blob/f838e17cf5c3a88ade5ceea54680a8145d048c1d/src/server/agent/runtime.ts).
44
45The [README](https://github.com/composio-community/open-dot/blob/f838e17cf5c3a88ade5ceea54680a8145d048c1d/README.md)
46describes persistent browser profiles, scheduled routines, an encrypted vault,
47Composio integrations, and approval review. It also says missed routines are
48skipped while the Mac sleeps and that the app has no authentication. Composio
49integrations and voice introduce cloud services. Those flows need separate
50data authorization even if model inference is local.
51
52## Proposed VM boundary
53
54```text
55Private assistant Gateway ─── Snow Globe model API
56 │
57 └── VM broker: ownership, start, stop, snapshot, lease
58 │
59 ├── Linux guest node + desktop driver
60 ├── macOS guest app + desktop permissions
61 └── Windows guest node + interactive-session driver
62
63Dashboard console ─────────── existing authenticated VM console
64```
65
66This is a proposed integration, not deployed infrastructure. Existing
67`tools/vms.py` and dashboard VM authorization provide the relevant ownership
68and console boundaries. Neither candidate replaces libvirt provisioning or
69proves that an untested guest has a usable interactive desktop. VNC visibility
70alone is insufficient for native accessibility/input control.
71
72OpenClaw's computer contract explicitly selects a paired node, binds coordinate
73input to screenshot references, and refuses to redirect an unavailable selected
74computer. Linux/Windows support is documented as experimental. Its native CUA
75driver runs unrestricted behind Gateway authorization, so the guest remains
76the containment boundary; node pairing is not a sandbox against a compromised
77guest user. Inspected [policy source](https://github.com/openclaw/openclaw/blob/553841e490220a6c723da84a4fdd3caf0dcb2a11/extensions/cua-computer/src/node-invoke-policy.ts)
78classifies high-risk actions but does not itself add a prompt for each action.
79
80Hermes supports reviewed bounded driver manifests; its
81[backend source](https://github.com/NousResearch/hermes-agent/blob/6590f13a1ba21b18224a0f53ef2ead004b5fa7d6/tools/computer_use/cua_backend.py)
82places the driver in the terminal sandbox and disables driver telemetry by
83default. Its docs require Windows autostart for SSH to reach the interactive
84session, Linux display/AT-SPI availability, and macOS Accessibility/Screen
85Recording grants. Automatic downloads and updates should be pinned or disabled
86for a reproducible trial. Both candidates support broad tool access, so guest
87network, credentials, and writable mounts need to reflect the task's scope.
88
89## Trial criteria
90
91A meaningful first trial uses one disposable Linux desktop and synthetic data:
92connect only the Snow Globe endpoint, read a screenshot, edit and save a file in
93a GUI, confirm the result, and exercise a scheduled action after process restart.
94Disconnecting the guest must refuse control without falling back to the host;
95cancelled input must not be replayed. Capture outbound traffic to check that
96model data stays local and that disabled cloud features remain disabled.
97
98The fleet trial adds macOS and Windows, selects each guest explicitly, verifies
99the displayed guest matches the action target, and tests disconnect/reconnect
100and simultaneous human console use. Qwen's desktop reliability must be measured
101separately from the successful coding harness tests. A 3090's single inference
102slot serializes these agent calls alongside coding and approval requests.
103
104Source snapshots inspected: OpenClaw `553841e490220a6c723da84a4fdd3caf0dcb2a11`,
105Hermes `6590f13a1ba21b18224a0f53ef2ead004b5fa7d6`, and Odysseus
106`2992bf6d368a11472323e47d3bfed91e79cefc6b`. Recheck capabilities and licenses
107against the version selected for a trial; source documentation is not runtime
108verification on these VMs.