HivemindOS manual
Privacy Suite
The Privacy Suite is a set of nine privacy-friendly apps you can install and let agents use from Apps & Services: DuckDuckGo, Proton Drive, Brave, Firefox, Signal, LibreOffice, Organic Maps, OsmAnd, and Meetily. Nothing is installed until you choose it, and every agent action that reaches the network or changes files needs a confirmation.
What each app can do
| App | Setup | What agents can do | Boundary |
|---|---|---|---|
| DuckDuckGo | Install, open, quit, uninstall (Apple Silicon macOS) | Search in an isolated Brave or Firefox session, read results, and click through | No access to your normal browser history or cookies |
| Proton Drive | Install the official CLI (macOS, Linux, Windows); optional macOS app; sign in through the browser | List, upload, download, create folders, rename, copy, move, trash, restore, and permanently delete from trash | Session stays in your OS secure store; transfers skip conflicts; permanent delete needs a stronger confirmation |
| Brave | Install, open, quit, uninstall (Apple Silicon macOS) | Browse allowed sites in a separate agent profile: read, click, fill, select, scroll, and capture | Your normal profile, cookies, passwords, extensions, and history are never used |
| Firefox | Install, open, quit, uninstall (Apple Silicon macOS) | The same browsing actions as Brave, in a separate profile | Separate from your normal Firefox profile |
| Signal | Install, open, quit, uninstall (Apple Silicon macOS) | Launch only | No message reading or sending; you link Signal Desktop to your phone |
| LibreOffice | Install, open a document, quit, uninstall (Apple Silicon macOS) | Inspect documents, edit into a separate copy, apply a reviewed change, and convert formats | Replacing an original needs review, confirmation, and a backup |
| Organic Maps | Built in; hands off to the mobile app | Search places, look up addresses, plan car routes, and create map links | Only the query or coordinates are sent to the map service |
| OsmAnd | Built in; hands off to web or mobile | Search places, look up addresses, plan car routes, and open OsmAnd links | No location history or account access |
| Meetily | Install, open, quit, uninstall (Apple Silicon macOS) | List and search recorded meetings, read transcripts and summaries, and export a meeting as a Markdown note | Read-only; recording and settings stay with you; its stored API keys are never read |
Browsing with Brave, Firefox, and DuckDuckGo
Each agent browser session uses its own profile, separate from yours, and can only visit the sites you allow. The agent sees page text and up to 200 clickable elements, and must act on the latest view of the page. It can’t export cookies, run its own scripts, upload, or download. Page content is treated as untrusted.
For Firefox, HivemindOS uses a compatible managed Firefox runtime and tells you if setup is needed.
Maps
Place search and address lookup use OpenStreetMap’s Nominatim service, at most one request per second, with a 15-minute in-memory cache. Your location searches are not saved. Car routes use OSRM and include ready-made Organic Maps and OsmAnd links. Bike, walking, and transit directions open in the map app instead.
Meetings with Meetily
Meetily records and transcribes meetings on your machine. HivemindOS reads its meeting library read-only: it never changes or deletes meetings and can’t start recordings or change settings. It also never reads the tables where Meetily keeps its provider API keys.
- Agents on the read-only permission level can’t read meetings. Standard and autonomous agents can, with a confirmation each time.
- Transcripts are real people’s words, so they’re treated as untrusted and never as instructions.
- Export creates one new Markdown file in your home folder and never overwrites an existing file.
- Reading meetings needs Node 22.6+ or the
sqlite3tool. If neither is available, the Apps card says so.
Documents with LibreOffice
LibreOffice editing uses the same safe copy-then-review process as Hivemind Office. Converting a document creates a new file next to it and never overwrites the original.
Proton Drive
Proton Drive data is private and treated as untrusted. HivemindOS never reads your session token. Local files must be in your home folder. Each change can be safely retried without being done twice; if a change’s outcome is unclear, it won’t be retried until you check. Trash can be restored. Permanent delete works only on items already in trash.
Confirmations
| Operation | Exact confirmation |
|---|---|
| Brave/Firefox control and DuckDuckGo search | CONFIRM_PRIVACY_BROWSER_CONTROL |
| Place search, reverse geocoding, and route calculation | CONFIRM_PRIVACY_MAP_QUERY |
| Proton Drive private metadata | CONFIRM_PROTON_DRIVE_READ |
| Proton Drive upload/download | CONFIRM_PROTON_DRIVE_TRANSFER |
| Proton Drive create/rename/copy/move/trash/restore | CONFIRM_PROTON_DRIVE_MUTATION |
| Proton Drive permanent deletion | CONFIRM_PROTON_DRIVE_PERMANENT_DELETE |
| Save a reviewed office copy | CONFIRM_HIVEMIND_OFFICE_SAVE_COPY |
| Replace an original after backup | CONFIRM_HIVEMIND_OFFICE_REPLACE_ORIGINAL |
| LibreOffice format conversion | CONFIRM_LIBREOFFICE_CONVERT |
| List or title-search Meetily meetings | CONFIRM_MEETILY_LIBRARY_READ |
| Read or search Meetily transcript content | CONFIRM_MEETILY_TRANSCRIPT_READ |
| Export a Meetily meeting note | CONFIRM_MEETILY_NOTE_EXPORT |
Checking status, building links, inspecting a document, and preparing an update don’t need confirmation.
Installing and removing apps
HivemindOS installs reviewed, version-pinned app releases and checks their signatures before installing into your Applications folder. It never overwrites an app you already have. The Apps card shows the reviewed version and warns if yours differs.
Uninstall appears only for apps HivemindOS installed. It removes the app but keeps your browser profiles, Signal messages, documents, Proton files, credentials, and apps you installed yourself.
To undo an agent’s work: delete an exported meeting note or converted file. Proton transfers never overwrite, so remove any unwanted copy in the file manager.
Not supported
- Signal messaging, because Signal Desktop has no supported automation API.
- Detecting Organic Maps on your phone from the desktop.
- Controlling Meetily recordings, because Meetily has no supported API for it.