Use your owner Google session for normal dashboard access. Token access remains available as break-glass recovery.
Advanced: break-glass token
Invalid token or unauthorized account. Check access and try again.
Familiar control desk
Your familiar is here.
Start with identity, reachability, and model access. Operator controls are still available through advanced mode.
connecting…
Tunnel
checking…
Public ingress route
Email
Familiar email identity
First look
Your familiar is here.
This is the home base for setup and controls. The useful first thing is not an API key — it is knowing who this familiar is, how to reach it, and what it needs next.
Best for daily chat, nudges, and check-ins once the first mission is picked.
Set a Telegram bot token, then generate a claim code here and send it to the bot with /claim. Claiming makes your private Telegram chat the approval owner.
Status
✓Browser/control desk reachable
○Email status loading
○Telegram recommended for daily chat
○Model access needed
○First mission not started
Next: connect model access and choose a current strong recognized model so your familiar can think and respond. Model access does not grant access to email, calendar, files, banks, or other services.
Sessions
Known conversation sessions
These are the stable session aliases this familiar has seen, including default and named sessions from email, Telegram, or direct chat. Trust policies can route people into these aliases.
The alias is the human-facing name. The session id is the underlying execution engine thread the kernel reuses for that alias.
Email trust
Route inbound email by sender trust
Unknown and explicitly untrusted senders land in email-untrusted. Trusted senders can route only to their default session or allowlisted subject sessions. Principal senders are trusted and may route to any valid session. Blocked senders do not execute.
Sender policies
Telegram trust
Route Telegram chats by trust and session policy
Unknown Telegram identities land in telegram-untrusted. Trusted identities route to their assigned default session or allowlisted [session] switches. Principal identities may route to any valid session. Blocked identities do not execute.
For simple preassignment, enter a public @username. On first matching Telegram message, the kernel hydrates that placeholder to a stable numeric identity key. Raw keys such as telegram:private:123:user:456 remain available for known IDs or group/thread policies.
Telegram policies
Harness runtime
Config
Harness-level runtime settings written to config.json. Model and effort defaults apply to new session lanes; existing session overrides stay isolated.
Familiar network
Home Base Connection
Configure where this familiar sends call_home_send and network_request_send requests. The token is write-only; this panel only shows whether it is configured.
Used when OHK_HOME_BASE_URL is not set in the runtime environment. Save this URL with the main Save config button below; use Save / replace token only for the token.
Checking token status…
Data-directory mode copies common oh-omp data files into each new session directory. Container-backed mode routes dispatches into runtime-group containers with group-local volumes; scoped tokens remain a later authority-isolation phase.
Used when container-backed dispatch is enabled. Deployment grouping falls back to session grouping when a dispatch has no deployment identity.
Leave a field empty and check "delete" to remove it; edit to update.
Model Access
Give your familiar a good enough brain
Connect subscription or API-key model access and choose a current strong model. Model access lets your familiar think and respond; it does not grant access to email, calendar, files, banks, or other services.
Checking model readiness…
Selected model
Choose the model your familiar will use
A model may already be preselected from the bundled default config. You can change it here after connecting subscription or API-key access.
Fallback models
Optional. Select fallback models from the available model catalog. They are tried in order after the default model on retryable provider failures.
oh-omp clamps to what the active model supports. Frontier reasoning models benefit most from higher levels; smaller models ignore the setting.
Subscription sign-in
Use an existing provider subscription
Start a provider sign-in, then paste the localhost redirect URL or authorization code here to finish on this server.
The provider will eventually show a browser error because it redirects to localhost. That is expected: copy the entire URL from the address bar and paste it below.
After the browser sign-in opens, the provider will redirect to localhost and show an error page. Copy the entire URL from the address bar, including code= and state= if present, then paste it below.
API keys
Bring your own key
Use the key rows below for Anthropic, OpenAI, Google, OpenRouter, or Mistral. You can keep multiple providers connected and change the default model at any time.
First Mission
Choose one real job for your familiar
A mission is one ongoing job your familiar can notice, remember, or follow through on. Start with something small enough to begin today.
What makes a good first mission?
Pick something concrete, recurring, and easy to observe. The familiar will help turn your rough need into two or three options, then record the one you choose.
Ongoing: it should keep mattering after today.
Concrete: you can tell whether it happened.
Small: the first step should be obvious.
1Describe the needTell the familiar what is falling through the cracks.
2Choose one missionThe familiar proposes options and asks you to pick.
3Record the first stepThe chosen mission becomes durable setup state.
Ready to choose your first mission.
Start with a rough situation; precision can come from the conversation.
No messages yet. Use an example above or write freely; your familiar will narrow it into one mission before anything is recorded.
First mission recorded
Your familiar now has a job to do
This is the durable outcome of the setup conversation. It only appears after the familiar records a mission and concrete first step.
Mission title
First step: —
Next: continue below so this mission does not stay trapped in setup.
Agent tools
Credentials
Arbitrary secrets read on demand by stdlib tools (e.g. TELEGRAM_BOT_TOKEN, GITHUB_TOKEN). Written to credentials.json. Key names must match ^[A-Z][A-Z0-9_]*$.
Add credential
Runtime extensions
Extensions
Adapters installed via registry.json. Status reflects each extension's last load attempt this boot. Click Reload all after fixing a broken adapter to re-attempt without a full kernel restart.
Network permissions
Outbound access approvals
Familiars request outbound approvals via request_entropy_exemption, request_dlp_pattern_exemption, and request_tls_passthrough. Each request maps to one exact pipelock.yaml mutation: entropy exclusions, DLP pattern exempt domains, or TLS passthrough domains. Approve to apply that mutation; deny to leave pipelock enforcing. Retry a failed apply after resolving the underlying issue.