Initial Hermes Space

.dockerignore

@@ -0,0 +1,6 @@
+.git
+.DS_Store
+.env
+.venv
+__pycache__
+*.pyc

.gitattributes

@@ -0,0 +1,35 @@
+*.7z filter=lfs diff=lfs merge=lfs -text
+*.arrow filter=lfs diff=lfs merge=lfs -text
+*.bin filter=lfs diff=lfs merge=lfs -text
+*.bz2 filter=lfs diff=lfs merge=lfs -text
+*.ckpt filter=lfs diff=lfs merge=lfs -text
+*.ftz filter=lfs diff=lfs merge=lfs -text
+*.gz filter=lfs diff=lfs merge=lfs -text
+*.h5 filter=lfs diff=lfs merge=lfs -text
+*.joblib filter=lfs diff=lfs merge=lfs -text
+*.lfs.* filter=lfs diff=lfs merge=lfs -text
+*.mlmodel filter=lfs diff=lfs merge=lfs -text
+*.model filter=lfs diff=lfs merge=lfs -text
+*.msgpack filter=lfs diff=lfs merge=lfs -text
+*.npy filter=lfs diff=lfs merge=lfs -text
+*.npz filter=lfs diff=lfs merge=lfs -text
+*.onnx filter=lfs diff=lfs merge=lfs -text
+*.ot filter=lfs diff=lfs merge=lfs -text
+*.parquet filter=lfs diff=lfs merge=lfs -text
+*.pb filter=lfs diff=lfs merge=lfs -text
+*.pickle filter=lfs diff=lfs merge=lfs -text
+*.pkl filter=lfs diff=lfs merge=lfs -text
+*.pt filter=lfs diff=lfs merge=lfs -text
+*.pth filter=lfs diff=lfs merge=lfs -text
+*.rar filter=lfs diff=lfs merge=lfs -text
+*.safetensors filter=lfs diff=lfs merge=lfs -text
+saved_model/**/* filter=lfs diff=lfs merge=lfs -text
+*.tar.* filter=lfs diff=lfs merge=lfs -text
+*.tar filter=lfs diff=lfs merge=lfs -text
+*.tflite filter=lfs diff=lfs merge=lfs -text
+*.tgz filter=lfs diff=lfs merge=lfs -text
+*.wasm filter=lfs diff=lfs merge=lfs -text
+*.xz filter=lfs diff=lfs merge=lfs -text
+*.zip filter=lfs diff=lfs merge=lfs -text
+*.zst filter=lfs diff=lfs merge=lfs -text
+*tfevents* filter=lfs diff=lfs merge=lfs -text

.gitignore

@@ -0,0 +1,5 @@
+.DS_Store
+.env
+.venv/
+__pycache__/
+*.pyc

Dockerfile

@@ -0,0 +1,43 @@
+FROM ghcr.io/nesquena/hermes-webui:latest
+
+USER root
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+ARG HTTP_PROXY
+ARG HTTPS_PROXY
+ARG NO_PROXY
+ARG http_proxy
+ARG https_proxy
+ARG no_proxy
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        ca-certificates \
+        git \
+        ripgrep \
+        sudo \
+    && git clone --depth=1 https://github.com/NousResearch/hermes-agent.git /opt/hermes \
+    && mkdir -p /data/.hermes /data/.hermes/webui-mvp /workspace \
+    && rm -rf /home/hermeswebui/.hermes \
+    && ln -s /data/.hermes /home/hermeswebui/.hermes \
+    && chown -R hermeswebui:hermeswebui /data /workspace /opt/hermes \
+    && chown -h hermeswebui:hermeswebui /home/hermeswebui/.hermes \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --chmod=755 space-entrypoint.sh /space-entrypoint.sh
+
+ENV HERMES_HOME=/home/hermeswebui/.hermes \
+    HERMES_CONFIG_PATH=/home/hermeswebui/.hermes/config.yaml \
+    HERMES_WEBUI_STATE_DIR=/home/hermeswebui/.hermes/webui-mvp \
+    HERMES_WEBUI_DEFAULT_WORKSPACE=/workspace \
+    HERMES_WEBUI_HOST=0.0.0.0 \
+    HERMES_WEBUI_PORT=8787 \
+    HERMES_EXEC_ASK=1 \
+    WANTED_UID=1024 \
+    WANTED_GID=1024
+
+EXPOSE 8787
+
+CMD ["/space-entrypoint.sh"]

LOCAL_BUILD.md

@@ -0,0 +1,30 @@
+# Local build
+
+Normal build:
+
+```bash
+docker build -t hfspace-hermes .
+```
+
+Build through a proxy:
+
+```bash
+docker build \
+  --build-arg HTTP_PROXY=http://127.0.0.1:7890 \
+  --build-arg HTTPS_PROXY=http://127.0.0.1:7890 \
+  --build-arg http_proxy=http://127.0.0.1:7890 \
+  --build-arg https_proxy=http://127.0.0.1:7890 \
+  -t hfspace-hermes .
+```
+
+Run locally:
+
+```bash
+docker run --rm -p 8787:8787 \
+  -e HERMES_WEBUI_PASSWORD=change-me \
+  -e DEEPSEEK_API_KEY="$DEEPSEEK_API_KEY" \
+  -e HERMES_WEBUI_USER_PASSWORD=change-me-too \
+  hfspace-hermes
+```
+
+Then open `http://localhost:8787`.

README.md

@@ -0,0 +1,57 @@
+---
+title: Hermes Agent WebUI
+emoji: 👁
+colorFrom: blue
+colorTo: gray
+sdk: docker
+app_port: 8787
+pinned: false
+license: mit
+---
+
+# Hermes Agent WebUI Space
+
+This Space runs the community Hermes WebUI with Hermes Agent source available in
+the container.
+
+## Required Space secrets
+
+Set these in Hugging Face Space settings before exposing the app:
+
+- `HERMES_WEBUI_PASSWORD`: password for the browser UI.
+
+Optional provider secrets:
+
+- `DEEPSEEK_API_KEY`
+- `OPENAI_API_KEY`
+- `OPENROUTER_API_KEY`
+- `ANTHROPIC_API_KEY`
+- `GOOGLE_API_KEY`
+- `HF_TOKEN`
+
+Optional runtime secret:
+
+- `HERMES_WEBUI_USER_PASSWORD`: sets the `hermeswebui` Linux user password and
+  enables password-based `sudo` inside the container. Use only when you need it.
+
+## Workspace and state
+
+The default workspace is `/workspace`.
+
+Hermes reads and writes its state at `/home/hermeswebui/.hermes`. In this Space
+that path is a symlink to `/data/.hermes`, so Hermes Agent and Hermes WebUI use
+one shared home directory. On a free Space this is ephemeral and can be lost
+after rebuilds. Enable Hugging Face persistent storage if you want Hermes memory,
+sessions, and profile configuration to survive rebuilds.
+
+## Security notes
+
+Use a private or protected Space. This app can inspect files and run agent tools,
+so do not publish it without `HERMES_WEBUI_PASSWORD`.
+
+If you set `HERMES_WEBUI_USER_PASSWORD`, anyone who can control the WebUI may be
+able to run privileged commands inside the container. Prefer baking system
+packages into the Dockerfile instead of using sudo at runtime.
+
+This repo intentionally does not include keep-alive automation. Free Spaces can
+sleep; for always-on usage, use paid hardware or accept cold starts.

space-entrypoint.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ -z "${HERMES_WEBUI_PASSWORD:-}" ]]; then
+  echo "WARNING: HERMES_WEBUI_PASSWORD is not set. Set it as a Space secret before public use."
+fi
+
+if [[ -n "${HERMES_WEBUI_USER_PASSWORD:-}" ]]; then
+  echo "Configuring password-based sudo for hermeswebui."
+  printf 'hermeswebui:%s\n' "${HERMES_WEBUI_USER_PASSWORD}" | chpasswd
+  printf 'hermeswebui ALL=(ALL) ALL\n' > /etc/sudoers.d/hermeswebui
+  chmod 0440 /etc/sudoers.d/hermeswebui
+  unset HERMES_WEBUI_USER_PASSWORD
+fi
+
+mkdir -p /data/.hermes
+
+if [[ -e /home/hermeswebui/.hermes && ! -L /home/hermeswebui/.hermes ]]; then
+  cp -a /home/hermeswebui/.hermes/. /data/.hermes/ 2>/dev/null || true
+  rm -rf /home/hermeswebui/.hermes
+fi
+
+if [[ ! -L /home/hermeswebui/.hermes ]]; then
+  ln -s /data/.hermes /home/hermeswebui/.hermes
+fi
+
+mkdir -p "${HERMES_HOME:-/home/hermeswebui/.hermes}" \
+  "${HERMES_WEBUI_STATE_DIR:-/home/hermeswebui/.hermes/webui-mvp}" \
+  "${HERMES_WEBUI_DEFAULT_WORKSPACE:-/workspace}"
+
+chown -R hermeswebui:hermeswebui \
+  /data/.hermes \
+  "${HERMES_HOME:-/home/hermeswebui/.hermes}" \
+  "${HERMES_WEBUI_STATE_DIR:-/home/hermeswebui/.hermes/webui-mvp}" \
+  "${HERMES_WEBUI_DEFAULT_WORKSPACE:-/workspace}" \
+  /opt/hermes || true
+
+chown -h hermeswebui:hermeswebui /home/hermeswebui/.hermes || true
+
+exec /hermeswebui_init.bash