Hermes SSH Relay

Use on the first conversation after someone installs the Hermes SSH Relay template: learn their Hermes host setup and get them to a working ask-relay.

Use when installing or wiring the Hermes SSH ask-relay connector so a Grok Bot can talk to a Desktop-primary Hermes host over a private network.

Use when deciding between Hermes SSH Relay and Hermes API Fleet (:8642) for putting Hermes inside Grok Bot — fleet default is HTTP-only.

Use this when documenting Hermes fleet Bitwarden secrets for messaging bots or any per-host credential — never share one TELEGRAM_BOT_TOKEN (or other per-host key) across hosts; store only FOO_<PROFILE> so Hermes auto-aliases per active profile.

Use when turning messy notes, an SOP, checklist, email thread, or playbook into a Hermes-ready SKILL.md — open paste-to-skill, Hermes flavor, install under ~/.hermes/skills/.

Use when a Grok connector ask to Desktop-primary Hermes dies around ~120s (-32001) — escape via host-local POST /v1/runs; also restarting a gateway from a work order and telling provider failure from host failure. Not a fleet ask path.

Use after Hermes/Grok sprints before DONE or marketplace Share→Update — clean orphan browsers, stuck CLI harnesses, leftover SSH ask paths; HTTP :8642 only for fleet; long jobs via /v1/runs when a connector ask times out at ~120s.

Use this when setting up Tailscale (or any installed tool, daemon, or key) on the Grok Bot computer, when the computer may have been updated or reset, or when the bot can't reach tailnet hosts. It makes the setup survive a Computer Update and restore itself with no human step.