Eir

Eir watches a Windows machine and deals with the routine failures on its own — the stopped service, the filling disk, the event log error that’s repeated a hundred times. It collects health signals, asks an AI model what’s worth doing, applies the safe reversible fixes automatically, and routes anything genuinely destructive through a tray approval so a human keeps the last word.

It runs as two components:

• EirSvc — a Windows service running as LocalSystem with access to protected event logs and the ability to apply fixes without UAC prompts.
• Eir tray app — a lightweight desktop UI for viewing current status, recent repairs, AI usage and cost, and approving anything the agent flags as risky.

The two communicate over a secured local named pipe.

What it is for

Eir is designed for personal or small-environment Windows machines where common faults should be noticed and repaired without constant manual babysitting:

• stopped or failing services
• repeated event log errors
• disk pressure
• memory pressure
• network issues
• broken scheduled tasks
• known application update gaps
• recurring Windows noise that needs filtering from real faults

It is not intended to be a blind “run any fix” tool. The service has a policy layer that blocks or gates risky actions.

How it works

Each decision cycle (default every 10 minutes):

1. Collect signals — Windows Event Log channels, service states, CPU/memory/disk, network errors, and any watched log directories.
2. Decide whether to think — the AI is only called when something actionable has changed, plus a periodic heartbeat. Idle cycles are essentially free.
3. Diagnose — the AI returns a structured list of problems, each with a confidence score and a proposed root-cause fix.
4. Gate through policy — findings below 80% confidence and benign Windows noise are dropped; software uninstall is permanently blocked; catastrophic actions (boot-config edits, driver disabling, arbitrary PowerShell) always require approval.
5. Execute — reversible, whitelisted fixes (service restart/start/stop, log and disk cleanup, task enable/disable, registry reset, process kill, file delete) run automatically at ≥80% confidence. Everything else waits in the tray UI.

Policy model

Eir is useful only if its autonomy is bounded. Its policy model separates routine reversible fixes from actions that need approval or must never happen.

Action type	Default handling
service restart/start/stop	automatic when confidence is high
log cleanup	automatic when confidence is high
disk cleanup	automatic when confidence is high
task enable/disable	automatic when confidence is high
process kill	automatic only when policy allows
file delete	automatic only for whitelisted cleanup targets
registry reset	automatic only for whitelisted safe resets
arbitrary PowerShell	approval required
boot configuration edits	approval required or blocked
driver disabling	approval required or blocked
software uninstall	hard blocked

The “never uninstall” guarantee is enforced at the policy layer, not just in the prompt.

AI providers

Provider	Notes
OpenRouter (default)	Free models available; uses the web plugin for search. An OpenRouter CLI login can also supply the key.
Claude CLI	Reuses your logged-in claude session — no API key needed.
Anthropic API	Direct pay-as-you-go access via your API key.
Kilo CLI	Reuses your logged-in Kilo Code session. Models use the kilo/ prefix, such as kilo/minimax/minimax-m2.5.

Provider choice controls where diagnostic summaries are sent for reasoning. The local service still performs collection and execution. Use the provider and model that match your privacy, cost, and reliability requirements.

Key features

• Autonomous repair — reversible fixes run automatically when confidence is high; no babysitting required.
• Approval backstop — genuinely destructive actions are always held for human approval.
• Never-uninstall guarantee — software removal is a hard-blocked action at the policy layer.
• App update monitoring — surfaces available updates via winget and AI-assisted web search for apps no package manager tracks.
• Usage transparency — shows AI call counts, token usage, and estimated cost in GBP. Free models are clearly marked.
• Self-updating — signed auto-updates via the GitHub releases feed.

Install

Download the latest release from:

https://github.com/Swatto86/eir/releases

The installer bundles the tray app and service. After install, configure the AI provider and review policy/approval settings before leaving the agent unattended.

First run

1. Install Eir.
2. Open the tray app.
3. Configure the AI provider.
4. Review current status and recent checks.
5. Let the agent complete at least one decision cycle.
6. Review any pending approvals.
7. Check AI usage/cost reporting.

Tray app

Use the tray app to:

• see service state
• see current machine health
• review recent repairs
• approve or reject risky proposed actions
• inspect AI usage and estimated cost
• configure provider settings
• check for updates

The tray app is the human control point. If Eir is unsure or a proposed action crosses the policy boundary, it waits there.

Service

EirSvc runs as LocalSystem so it can access protected logs and perform approved repairs without a UAC prompt every cycle. The service should be treated as privileged infrastructure:

• keep it updated
• review policy defaults before widening automation
• keep API keys protected
• inspect the approval queue regularly until you trust the setup

Configuration

Eir supports multiple AI backends:

• OpenRouter
• Claude CLI
• Anthropic API
• Kilo CLI

Configure the provider that matches your environment. Legacy openai_compatible configs are treated as Anthropic API configs, and legacy kilocode/kilo configs load as the Kilo CLI provider.

Building from source

git clone https://github.com/Swatto86/eir.git
cd eir
cargo build --workspace

The repository is a Rust workspace with:

• eir-proto for shared protocol/types
• eir-svc for the Windows service
• eir-ui for the Tauri tray UI

The release build uses Tauri/NSIS packaging to stage the service binary and bundle the tray app and service together.

Security notes

• Eir is privileged software. Treat configuration changes like service changes.
• Do not widen automatic action policy casually.
• Keep arbitrary shell/PowerShell actions behind approval.
• Review provider privacy policies before sending diagnostics to hosted AI models.
• Free models reduce cost but may be less reliable for diagnosis.

Troubleshooting

No repairs happen

Check whether the service is running, whether the provider is configured, whether Eir has seen an actionable signal, and whether proposed actions are below the confidence threshold.

Fixes are waiting

Open the tray app and review pending approvals. Risky actions intentionally wait for a human.

AI calls are expensive

Use a cheaper/free OpenRouter model, reduce check frequency, or tune the “decide whether to think” rules so unchanged idle cycles do not call a model.

Service is not responding

Restart the service and tray app, then check Windows Event Log entries for EirSvc.

Links

• GitHub: https://github.com/Swatto86/eir
• Releases: https://github.com/Swatto86/eir/releases

← All tools