GitHub - YuriKovalov22/the-finn: A grumpy Gibson construct living in an office router. It only knows what the router can see.

A small, grumpy agent that lives inside your router and only knows what the router can see. Named after the character in William Gibson's Sprawl trilogy who ends up as a construct in an armoured box bolted into an alley, where people come to hear the oracle complain. This one runs on a GL.iNet GL-MT3000 on an office wall. It watches the hallway it is in, and occasionally has something to say about it. It is deliberately not an assistant. No tools, no memory beyond a state file, no access to your mail or calendar or tickets, and nothing to be helpful with. It has a view of one hallway and an opinion about it. Six failed SSH logins in the last minute, usually it's zero all night. Bloody hell, some tosser out there fancies his chances. Твой десктоп качает на скорости 9.5 Мбит/с, обычно там крутится жалких 200 Кбит/с. В глотку будто ведро воды опрокинули, аж кадык свело. Everything runs on the router itself. If the rest of your infrastructure is on fire, this still works, which was most of the point. Quick start You need about ten minutes, a router you own, and a card on file with an LLM provider. 1. Check your router can host it. OpenWrt-based, with lua, lua-cjson and a curl built with TLS. On GL.iNet firmware all three are usually there already: ssh root@192.168.8.1 'lua -e "require(\"cjson\") print(\"ok\")"; curl --version | head -1' # missing anything? opkg update && opkg install lua lua-cjson curl It needs a few megabytes of overlay and nothing else. Tested on a GL-MT3000, OpenWrt 21.02, 512 MB RAM. 2. Make him a Telegram bot. In Telegram, open @BotFather, send /newbot, give it a name and a username. He hands you a token like 123456789:AAF.... That token is the bot; anyone holding it can post as him, so treat it as a password. 3. Find your own Telegram id. Message @userinfobot; it replies with a number. He answers that id and no other, so nobody else can talk to your router. 4. Get an API key. Anthropic or OpenAI, both are wired up. Create a dedicated key with a low monthly limit. It will sit in plaintext on a device that shares a network with other people; a key that can only ever spend five dollars is a key you can shrug about. Expect single-digit dollars a month at the default settings. 5. Install. git clone https://github.com/YuriKovalov22/the-finn && cd the-finn cp env.example env && $EDITOR env # paste the token, your id, the key ./install.sh root@192.168.8.1 The installer checks the router, copies two files, writes env with mode 0600, installs the minute cron entry, enables cron, and prints what he can see right now. 6. Say hello first. Open your bot in Telegram and press Start. Telegram does not let a bot open a conversation, so that message is what tells him where to write. He picks it up on his next tick, within a minute. Send /help to see what he understands. That is the whole setup. He will stay quiet for the first fifteen minutes while he learns what normal looks like, then speak when something is not. How he decides to speak There is no list of interesting events, which is the part worth stealing. Every minute the box takes a wide reading of itself and the room, keeps a rolling history of every reading in RAM, and looks for anything that has fallen outside its own recent range. Whatever is unusual today is what he talks about, so he does not become the same five notifications forever. Two kinds of oddity are detected generically: numeric, when a sensor leaves the band it has held for the last 45 minutes by more than a per-sensor floor that keeps ordinary wobble out; membership, when anything appears in or disappears from a set: a device, a neighbour on the upstream network, an unusual destination port. Variety is enforced along three axes, and the coarsest one matters most. Kind is what a remark is actually about: traffic, presence, neighbours, an intruder, his own body, the rhythm of the place. Connections, throughput and per-device flow churn are different sensors and different themes but the same observation to a reader, and traffic is by far the twitchiest thing on a network, so left to itself it wins nearly every round: five of six consecutive remarks here were some counter going up. Traffic is therefore rationed to one remark in six hours, and the kind that has waited longest is chosen first. Which means the other kinds have to have something to say, so several observations exist that are not counters at all: a machine arriving or leaving and how long it was gone, someone at the desk at an hour the room is normally empty, an uptime milestone, a stretch of stillness, and hour-of-day profiles for the slow human sensors, because what is normal at nine on a Tuesday is not what is normal at nine on a Sunday and a 45 minute band cannot tell the difference. Variety is enforced along two further axes, and the second one is easy to miss. Theme keeps him off one subject; shape keeps him off one sentence. Six remarks reading "X is N now, usually M" are varied by theme and identical to read, so each oddity also carries a shape (a level rising, something quieting, an arrival, a departure, a change of rhythm, a stretch of stillness) and the longest-waiting combination of the two wins. He is also shown his own last few remarks and told not to reuse their form. Stillness is itself an observation: after some hours in which nothing has left its range, he is handed that fact rather than staying mute, because a resident would remark on a quiet evening. Two rules stop him degenerating into a monitor for whichever sensor twitches most. Every oddity carries a theme (ports, the room, the wider network, people, his own body, the network, an intruder); a theme that has just been used goes quiet for ninety minutes, and among what is left the longest-waiting theme is the one he is handed. And churn is not news: a port or a neighbour that was here yesterday and came back does not count, only genuine novelty does. Only then is a model asked, and it is asked as a resident rather than a monitoring system: react to this one thing, or reply NOTHING if it is bloodless bookkeeping. A subject he has raised is muted for six hours, and a failed API call is not treated as a decision to stay quiet. What he can feel Sense Source who is on your wifi, and how strong their signal is iwinfo assoclist who they are /tmp/dhcp.leases, by hostname, so MAC rotation does not break it which of them are furniture rather than strangers FINN_KNOWN_HOSTS, hostname to plain name which of them are people you know FINN_PEOPLE, hostname to a person's name whether a machine is in use or asleep per-device flow churn in /proc/net/nf_conntrack how much each device is pulling and sending conntrack byte counters, when they can be trusted (see below) how long each machine has been here, and since it last stirred tracked between ticks how many devices the upstream network has, and which are new neighbour table on that interface what the network talks to, and on what ports conntrack, common ports filtered out link health, latency and loss to the gateway dmesg, ping throughput both ways /proc/net/dev deltas whether a tunnel is alive, and who is on his VPN wg show his own temperature, load, memory, disk, uptime /sys, /proc failed SSH logins and real kernel errors logread, with the wifi driver's constant screaming filtered out whether you arrived earlier or later than usual rolling history of first phone appearance Per-device throughput deserves a warning. It is read from conntrack byte counters, and on any router with hardware NAT offload, which includes this one, established flows are handled in silicon and those counters stop growing. A busy video call shows up as a handful of packets. Left alone this produces devices that appear to be sending more than the entire uplink carried, and an agent will faithfully narrate the impossible number. Each tick therefore checks the parts against the whole and publishes nothing rather than something wrong. Association is useless as presence, which is worth knowing before you build something like this: a sleeping Mac stays associated all night, and so does a printer. Flow churn is the honest signal. A sleeping machine opens no new connections; a machine someone is sitting at opens between three and fifty a minute. Every sensor is also wired to a sensation. He is not handed "temperature 63, was 45", he is handed heat climbing inside his case; a device drawing closer is a tickle, a yanked cable is a slap, unfamiliar broadcasts from beyond the wall are ghosts he can hear and never see. He has an anatomy to complain about: the antennas are his ears, the ports his fingers and toes, the flash his gut. Talking to him He answers anything you write, always, in any mode. He also takes commands, handled locally at no cost: Command Effect /status mode, what he has said today, model calls spent, which brain he is thinking with /off speaks only when spoken to /rare at most 2 unprompted a day, 3 hours apart /normal at most 5 a day, an hour apart /chatty at most 10 a day, 15 minutes apart /test no daily ceiling, one a minute, for two hours, then back to /chatty by itself /voice beep plays a pip when he posts, speak reads the remark aloud, off keeps him to Telegram Test mode spends its own budget. Otherwise an afternoon of watching him work leaves him mute for the rest of the day, which is exactly what happened here: two hours of testing burned 22 remarks against a ceiling of 10, and he went silent the moment the test expired. The daily allowance opens gradually rather than all at once. Mornings are the richest hours for oddities, so a flat cap gets spent before eleven and leaves nothing for whatever happens at five; instead it unlocks in proportion to how much of the speaking window has passed, with one message always available. He calls you by whatever you put in FINN_OWNER_NAME, and he only ever talks to the one Telegram id you configured. Unprompted remarks come out in Russian or English by coin toss. He answers you in whichever