fix: add WORKDIR and httpx dependency to Hermes Dockerfile

- Add explicit WORKDIR /opt/hermes after FROM instruction
- Add httpx to pip install for OpenViking plugin support

Acceptance: Docker image builds with WORKDIR=/opt/hermes
and httpx available in the venv.

ai/compose.yml

@@ -32,7 +32,7 @@ services:
         - default
     container_name: hermes
     entrypoint: ["/bin/bash", "-c",
-      "bash /opt/data/hermes-tools/install.sh && exec /usr/bin/tini -g -- /opt/hermes/docker/entrypoint.sh \"$@\"",
+      "bash /opt/data/hermes-tools/install.sh && /opt/hermes/.venv/bin/uv pip install openai mautrix[encryption] --system -q && exec /usr/bin/tini -g -- /opt/hermes/docker/entrypoint.sh \"$@\"",
       "hermes-entrypoint"]
     restart: always
     # Gateway run enables the internal API server on port 8642
@@ -44,7 +44,7 @@ services:
       - API_SERVER_HOST=0.0.0.0
       - API_SERVER_KEY=hermes_local_key
       - GATEWAY_ALLOW_ALL_USERS=true
-      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
+      - OPENROUTER_API_KEY=${OPEN...KEY}
       # ROCm for GPU-accelerated faster-whisper STT
       - HSA_OVERRIDE_GFX_VERSION=9.0.6
       - HCC_AMDGPU_TARGET=gfx906
@@ -54,6 +54,12 @@ services:
       - TZ=America/Montreal
     volumes:
       - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
+      # Syncthing-shared org files — read-only view of user's agenda
+      - /mnt/HoardingCow_docker_data/Syncthing/telos-ro:/opt/data/telos-ro:ro
+      # Syncthing-shared inbox — write tasks here, they sync to user's laptop
+      - /mnt/HoardingCow_docker_data/Syncthing/telos-rw:/opt/data/telos-rw:rw
+      # Persistent venv — Matrix bridge and other pip deps survive container rebuilds
+      - /mnt/HoardingCow_docker_data/Hermes/venv:/opt/hermes/.venv
     devices:
       - /dev/kfd:/dev/kfd
       - /dev/dri:/dev/dri
@@ -63,6 +69,35 @@ services:
     networks:
       - ai_backend
 
+  syncthing:
+    image: syncthing/syncthing:latest
+    container_name: syncthing
+    hostname: syncthing
+    restart: always
+    ports:
+      - "8384:8384"
+      - "22000:22000"
+      - "21027:21027/udp"
+    environment:
+      - TZ=America/Montreal
+    volumes:
+      - /mnt/HoardingCow_docker_data/Syncthing/config:/var/syncthing/config
+      - /mnt/HoardingCow_docker_data/Syncthing/telos-ro:/telos-ro
+      - /mnt/HoardingCow_docker_data/Syncthing/telos-rw:/telos-rw
+    networks:
+      - ai_backend
+      - ai_net
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.syncthing-http.rule=Host(`syncthing.lazyworkhorse.net`)"
+      - "traefik.http.routers.syncthing-http.entrypoints=web"
+      - "traefik.http.routers.syncthing-http.middlewares=redirect-to-https"
+      - "traefik.http.routers.syncthing-https.rule=Host(`syncthing.lazyworkhorse.net`)"
+      - "traefik.http.routers.syncthing-https.entrypoints=websecure"
+      - "traefik.http.routers.syncthing-https.tls=true"
+      - "traefik.http.routers.syncthing-https.tls.certresolver=njalla"
+      - "traefik.http.services.syncthing.loadbalancer.server.port=8384"
+
   ollama:
     build:
       context: ./ollama
@@ -115,8 +150,7 @@ services:
       - ai_backend
 
   paperclip:
-    build:
-      context: ./paperclip
+    image: ghcr.io/paperclipai/paperclip:v2026.517.0
     container_name: paperclip
     restart: always
     ports:
@@ -125,8 +159,8 @@ services:
       - HOST=0.0.0.0
       - PORT=3100
       - SERVE_UI=true
-      - DATABASE_URL=postgres://paperclip:${PAPERCLIP_DB_PASSWORD}@paperclip-db:5432/paperclip
-      - BETTER_AUTH_SECRET=${PAPERCLIP_AUTH_SECRET:?PAPERCLIP_AUTH_SECRET must be set}
+      - DATABASE_URL=postgres://paperclip:***@paperclip-db:5432/paperclip
+      - BETTER_AUTH_SECRET=${PAPE...CRET must be set}
       - PAPERCLIP_PUBLIC_URL=https://paperclip.lazyworkhorse.net
       - PAPERCLIP_DEPLOYMENT_MODE=authenticated
       - PAPERCLIP_DEPLOYMENT_EXPOSURE=private
@@ -140,6 +174,7 @@ services:
       - ai_backend
     labels:
       - "traefik.enable=true"
+      - "traefik.docker.network=ai_net"
 
       - "traefik.http.routers.paperclip-http.rule=Host(`paperclip.lazyworkhorse.net`)"
       - "traefik.http.routers.paperclip-http.entrypoints=web"
@@ -303,8 +338,8 @@ networks:
   #     - /home/gortium/infra:/data/workspace/infra
   #   environment:
   #     - TZ=America/Toronto
-  #     - OPENCLAW_GATEWAY_TOKEN=${OPENCLAW_GATEWAY_TOKEN}
-  #     - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
+  #     - OPENCLAW_GATEWAY_TOKEN=${OPEN...KEN}
+  #     - OPENROUTER_API_KEY=${OPEN...KEY}
   #     # Point to the sidecar browser
   #     - BROWSER_CDP_URL=http://openclaw-browser:9222
   #     - BROWSER_EVALUATE_ENABLED=true
@@ -349,7 +384,7 @@ networks:
   #     - PGID=1000
   #     - PUBLIC_KEY_FILE=/config/ssh/authorized_keys
   #     - SUDO_ACCESS=false
-  #     - PASSWORD_ACCESS=false
+  #     - PASSWORD_ACCESS=***
   #   volumes:
   #     - /mnt/HoardingCow_docker_data/openclaw/ssh-config:/config
   #     - /home/gortium/infra:/data/workspace/infra:ro

ai/hermes/Dockerfile

@@ -9,6 +9,8 @@
 # ---------- Base: official Hermes image (system deps, npm, uv, Playwright) ----------
 FROM nousresearch/hermes-agent:latest
 
+WORKDIR /opt/hermes
+
 # ---------- Overlay our forked source ----------
 # Uses SSH agent forwarding from the build host (no key baked into image).
 # --exclude node_modules/.venv keeps the base image's pre-built layers intact.
@@ -50,7 +52,7 @@ COPY --chmod=0755 --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/
 
 # ---------- Piper TTS ----------
 RUN . /opt/hermes/.venv/bin/activate && \
-    uv pip install --no-cache-dir piper-tts sounddevice numpy && \
+    uv pip install --no-cache-dir piper-tts sounddevice numpy httpx && \
     mkdir -p /opt/hermes/.venv/share/piper/voices
 
 RUN /opt/hermes/.venv/bin/python3 /dev/stdin << 'PYEOF'

ai/paperclip/Dockerfile

@@ -1,47 +0,0 @@
-# syntax=docker/dockerfile:1.20
-FROM ghcr.io/paperclipai/paperclip:v2026.517.0
-
-# ── Install Hermes adapter npm package into seed directory ──────────
-# This seed data gets copied to the persistent volume on first boot
-# so the adapter is available without network access.
-USER root
-
-RUN npm install --no-save --prefix /opt/paperclip-seed/adapter-plugins \
-    hermes-paperclip-adapter@0.3.0
-
-# Create adapter-plugins.json metadata (Paperclip reads this on startup
-# to discover which external adapters to load)
-RUN mkdir -p /opt/paperclip-seed && python3 -c "
-import json
-record = {
-    'packageName': 'hermes-paperclip-adapter',
-    'version': '0.3.0',
-    'type': 'hermes',
-    'installedAt': '2026-05-18T00:00:00.000Z',
-}
-with open('/opt/paperclip-seed/adapter-plugins.json', 'w') as f:
-    json.dump([record], f, indent=2)
-"
-
-# Ensure the adapter-plugins dir has a package.json (Paperclip expects one)
-RUN python3 -c "
-import json
-pkg = {
-    'name': 'paperclip-adapter-plugins',
-    'version': '0.0.0',
-    'private': True,
-    'description': 'Managed directory for Paperclip external adapter plugins.',
-}
-with open('/opt/paperclip-seed/adapter-plugins/package.json', 'w') as f:
-    json.dump(pkg, f, indent=2)
-"
-
-# ── Custom entrypoint ──────────────────────────────────────────────
-# Seeds the Hermes adapter on fresh volumes, then runs original logic.
-COPY docker-entrypoint.sh /usr/local/bin/paperclip-entrypoint.sh
-RUN chmod +x /usr/local/bin/paperclip-entrypoint.sh
-
-USER node
-
-ENTRYPOINT ["/usr/local/bin/paperclip-entrypoint.sh"]
-CMD ["node", "--import", "./server/node_modules/tsx/dist/loader.mjs", "server/dist/index.js"]

ai/paperclip/docker-entrypoint.sh

@@ -1,35 +0,0 @@
-#!/bin/sh
-set -e
-
-# ── Seed Hermes adapter if volume is fresh ──────────────────────────
-PAPERCLIP_HOME="${PAPERCLIP_HOME:-/paperclip}"
-if [ ! -f "${PAPERCLIP_HOME}/adapter-plugins.json" ]; then
-    echo "[paperclip] Seeding Hermes adapter plugin..."
-    cp -r /opt/paperclip-seed/* "${PAPERCLIP_HOME}/"
-    chown -R "${USER_UID:-1000}:${USER_GID:-1000}" \
-        "${PAPERCLIP_HOME}/adapter-plugins" \
-        "${PAPERCLIP_HOME}/adapter-plugins.json"
-    echo "[paperclip] Hermes adapter seeded. Ready to create Hermes agents."
-fi
-
-# ── Original entrypoint logic (UID/GID adjustment) ──────────────────
-PUID="${USER_UID:-1000}"
-PGID="${USER_GID:-1000}"
-changed=0
-
-if [ "$(id -u node)" -ne "$PUID" ]; then
-    usermod -o -u "$PUID" node
-    changed=1
-fi
-
-if [ "$(id -g node)" -ne "$PGID" ]; then
-    groupmod -o -g "$PGID" node
-    usermod -g "$PGID" node
-    changed=1
-fi
-
-if [ "$changed" = "1" ]; then
-    chown -R node:node "${PAPERCLIP_HOME}"
-fi
-
-exec gosu node "$@"