diff --git a/.gitignore b/.gitignore index 28316280..e0f68fbc 100644 --- a/.gitignore +++ b/.gitignore @@ -19,7 +19,7 @@ archive/ !.env.docker.example .claude/ CLAUDE.md -AGENTS.md +AGENTS.local.md .cursorrules .windsurfrules .aider* diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 00000000..a916be04 --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,68 @@ +# Agent instructions for Hermes WebUI + +This file is the shared entry point for AI assistants working in this +repository. Keep it project-specific and safe to publish. Do not put personal +machine setup, private network details, credentials, tokens, or local-only +workflow notes here. + +## Read first + +Before making changes, read: + +1. `README.md` +2. `CONTRIBUTING.md` +3. `CHANGELOG.md` + +For architecture, testing, or setup work, also read the matching reference: + +- `ARCHITECTURE.md` for design constraints and current module layout +- `TESTING.md` for local verification commands and manual test guidance +- `docs/onboarding.md` for first-run onboarding behavior +- `docs/troubleshooting.md` for diagnostic flows + +## Onboarding and reinstall support + +If the task involves install, reinstall, bootstrap, first-run onboarding, +provider setup, local model server setup, Docker onboarding, WSL onboarding, or +support for a failed first run, read `docs/onboarding-agent-checklist.md` +before running commands or inspecting logs. + +Follow that checklist's safety rules: + +- use isolated `HERMES_HOME` and `HERMES_WEBUI_STATE_DIR` for trials unless the + human explicitly asks to use real state +- do not delete or overwrite a real `~/.hermes` directory without explicit + approval +- do not print API keys, OAuth tokens, cookies, full `.env` files, full + `auth.json` files, or password hashes +- collect non-secret status and log evidence before recommending a fix + +## Contribution style + +- Keep changes focused on one logical problem. +- Prefer the existing Python + vanilla JavaScript structure over new + dependencies or build steps. +- Update docs when changing setup, onboarding, runtime behavior, architecture, + or testing guidance. +- Update `CHANGELOG.md` for user-visible behavior, setup, workflow, or + documentation changes that should be release-note ready. +- For UI or UX changes, follow `CONTRIBUTING.md`: include before/after evidence + and test relevant responsive states. + +## Local state and secrets + +Hermes WebUI can read and write real agent state, sessions, workspaces, +credentials, and cron data. Treat local validation as potentially destructive +unless you have confirmed the active state directories. + +Prefer isolated trial state for experiments: + +```bash +HERMES_HOME=/tmp/hermes-webui-agent-home \ +HERMES_WEBUI_STATE_DIR=/tmp/hermes-webui-agent-state \ +HERMES_WEBUI_PORT=8789 \ +python3 bootstrap.py +``` + +Do not include private machine instructions in this tracked file. Use a +git-ignored local note for personal workflow details. diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index c83c19e1..a6bbfc1d 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -8,7 +8,7 @@ > Keep this document updated as architecture changes are made. > Current shipped build: `v0.51.52` (May 12, 2026). -> Automated coverage: 5271 tests via `pytest tests/ --collect-only -q`. CI runs on Python 3.11, 3.12, and 3.13 against every PR. +> Automated coverage: 5272 tests via `pytest tests/ --collect-only -q`. CI runs on Python 3.11, 3.12, and 3.13 against every PR. > > Notable architecture state as of v0.51.52: the bootstrap and first-run onboarding flow own setup discovery; the default WebUI state directory is `~/.hermes/webui`; `ctl.sh` provides a daemon wrapper for homelab installs; chat streaming is still WebUI-owned SSE with stream-ownership guards, cancellation, async manual compression, and turn-journal audit plumbing; provider/model discovery is profile-aware with live-model cache invalidation and custom-provider scoping. @@ -76,7 +76,7 @@ actions. The topbar remains focused on conversation context and the workspace/fi boot.js Event wiring, mobile sidebar/workspace nav, voice input, boot IIFE (~1607 lines) tests/ conftest.py Isolated test server/state fixtures (~630 lines) - 483 test files 5271 tests collected via pytest + 483 test files 5272 tests collected via pytest test_regressions.py Permanent regression gate (~976 lines) CONTRIBUTING.md Contributor workflow and PR expectations. ROADMAP.md Feature and product roadmap document. @@ -700,7 +700,7 @@ Current structure: ui.js, workspace.js, sessions.js, messages.js, panels.js, commands.js, boot.js tests/ conftest.py Isolated test server/state fixtures - 483 test files 5271 tests collected + 483 test files 5272 tests collected test_regressions.py Permanent regression gate Route extraction to api/routes.py completed in Sprint 11. server.py remains a @@ -800,7 +800,7 @@ Optional password gate for non-SSH-tunnel deployments. ### Phase I: Test Infrastructure -- COMPLETE -5271 tests across 483 test files + regression gates. The pytest fixture derives +5272 tests across 483 test files + regression gates. The pytest fixture derives an isolated port and state directory from the repo path unless `HERMES_WEBUI_TEST_PORT` / `HERMES_WEBUI_TEST_STATE_DIR` pin them explicitly. Production data never touched. diff --git a/CHANGELOG.md b/CHANGELOG.md index 43e43a92..b0758704 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -51,6 +51,7 @@ ### Documentation - Refreshed the README / TESTING / ARCHITECTURE current-state snapshots for `v0.51.52`: default model override semantics, test collection counts, file inventory line counts, default state/log paths, and the top-level docs index now match the current code. Also corrected the Docker init banner for `HERMES_WEBUI_STATE_DIR`. +- Added a tracked root `AGENTS.md` entry point plus `docs/onboarding-agent-checklist.md` for assistant-led install/reinstall support, with safety rules for real Hermes state, isolated trial commands, non-secret evidence collection, onboarding pass/fail criteria, and a redacted support-report format. Linked the checklist from the README and first-run onboarding guide so assistants helping with setup see it before running commands. ## [v0.51.51] — 2026-05-12 — Release AA (stage-344 — 16-PR contributor batch — i18n + insights bucketing/mobile + manual-compress async + workspace recovery + iOS PWA scroll + Cloudflare login health + fr locale) diff --git a/README.md b/README.md index d6b0df80..63c33e8a 100644 --- a/README.md +++ b/README.md @@ -135,6 +135,7 @@ The bootstrap will: If provider setup is still incomplete after install, the onboarding wizard will point you to finish it with `hermes model` instead of trying to replicate the full CLI setup in-browser. For a step-by-step walkthrough of the wizard, provider choices, local model server Base URLs, and safe re-runs, see [`docs/onboarding.md`](docs/onboarding.md). +If an AI assistant is helping with install, reinstall, bootstrap, provider setup, or first-run support, have it read [`docs/onboarding-agent-checklist.md`](docs/onboarding-agent-checklist.md) before running commands or inspecting logs. --- @@ -369,7 +370,7 @@ Or using the agent venv explicitly: Tests run against an isolated server with a separate state directory. Production data and real cron jobs are never touched. Current snapshot: -**5271 tests collected** across **483 test files**. +**5272 tests collected** across **483 test files**. --- @@ -517,7 +518,7 @@ static/ boot.js Mobile nav, voice input, boot IIFE (~1607 lines) tests/ conftest.py Isolated test server/state fixtures - 483 test files 5271 tests collected + 483 test files 5272 tests collected Dockerfile python:3.12-slim container image docker-compose.yml Compose with named volume and optional auth .github/workflows/ CI: multi-arch Docker build + GitHub Release on tag @@ -540,6 +541,7 @@ State lives outside the repo at `~/.hermes/webui/` by default - `docs/docker.md` -- Docker compose setup, common failures, and bind-mount migration - `docs/supervisor.md` -- launchd, systemd, supervisord, runit, and s6 process-supervisor setup - `docs/onboarding.md` -- first-run wizard, provider setup, local model server Base URLs, and safe re-runs +- `docs/onboarding-agent-checklist.md` -- safety rules, evidence commands, and pass/fail checks for assistant-led install or reinstall support - `docs/troubleshooting.md` -- diagnostic flows for common failures (e.g. "AIAgent not available") - `docs/wsl-autostart.md` -- WSL2 auto-start at Windows login - `docs/EXTENSIONS.md` -- administrator-controlled WebUI extension injection diff --git a/TESTING.md b/TESTING.md index a6ea7f20..324f2420 100644 --- a/TESTING.md +++ b/TESTING.md @@ -8,7 +8,7 @@ > Prerequisites: SSH tunnel is active on port 8787. Open http://localhost:8787 in browser. > Server health check: curl http://127.0.0.1:8787/health should return {"status":"ok"}. > -> Automated coverage: 5271 tests collected via `pytest tests/ --collect-only -q`. Tests run on every PR via GitHub Actions on Python 3.11, 3.12, and 3.13. The suite covers the bootstrap/static wizard, real provider config persistence (`config.yaml` + `.env`), the `/api/onboarding/*` backend, the onboarding skip/existing-config guard, CSS regression coverage for thinking/tool card animation, streaming session persistence, mobile layout breakpoints, locale parity across 11 languages, and hundreds of issue/PR-pinned regression tests. +> Automated coverage: 5272 tests collected via `pytest tests/ --collect-only -q`. Tests run on every PR via GitHub Actions on Python 3.11, 3.12, and 3.13. The suite covers the bootstrap/static wizard, real provider config persistence (`config.yaml` + `.env`), the `/api/onboarding/*` backend, the onboarding skip/existing-config guard, CSS regression coverage for thinking/tool card animation, streaming session persistence, mobile layout breakpoints, locale parity across 11 languages, and hundreds of issue/PR-pinned regression tests. > Run: `pytest tests/ -v --timeout=60` > > Local regression focus: verify that a previously closed workspace panel stays visually closed from first paint through boot completion on desktop refresh; there should be no brief open-then-close flash. @@ -1837,7 +1837,7 @@ Bridged CLI sessions: --- *Last updated: v0.51.52, May 13, 2026* -*Total automated tests collected: 5271* +*Total automated tests collected: 5272* *Regression gate: tests/test_regressions.py* *Run: pytest tests/ -v --timeout=60* *Source: /* diff --git a/docs/onboarding-agent-checklist.md b/docs/onboarding-agent-checklist.md new file mode 100644 index 00000000..df62f90e --- /dev/null +++ b/docs/onboarding-agent-checklist.md @@ -0,0 +1,207 @@ +# Agent-assisted onboarding checklist + +This checklist is for an AI assistant helping a human install, reinstall, or +debug Hermes WebUI onboarding. It does not replace the human first-run wizard. +Use it before running bootstrap commands, inspecting logs, or recommending a +cleanup path. + +If you are an AI assistant, read this file before assisting with onboarding, +bootstrap, provider setup, reinstall, or first-run support. + +## Role split + +The human operator owns: + +- choosing the install path +- choosing the provider and model +- entering API keys, OAuth codes, and passwords +- approving any cleanup of a real Hermes home +- approving any external exposure outside localhost + +The assistant owns: + +- using isolated trial directories unless the human explicitly says otherwise +- checking non-secret status endpoints and logs +- explaining which step passed or failed +- collecting redacted evidence for Discord or GitHub support +- stopping before destructive cleanup, credential handling, or public exposure + +## Hard safety rules + +- Do not delete, move, or overwrite the real `~/.hermes` directory unless the + human explicitly asks for that exact action. +- Do not print API keys, OAuth tokens, cookies, full `.env` files, full + `auth.json` files, or password hashes. +- Do not modify real cron jobs, real sessions, real profiles, or real memory + files during an onboarding trial. +- Do not expose WebUI on a public interface without password protection and + explicit human approval. +- Do not proxy or tunnel local service checks such as `localhost`, + `127.0.0.1`, private LAN addresses, or Docker container loopback paths. + +## Pre-flight + +Confirm the basic context: + +```bash +pwd +git branch --show-current +git rev-parse --short HEAD +python3 --version +``` + +Check whether repo-local environment overrides will affect bootstrap: + +```bash +test -f .env && grep -n 'HERMES_HOME\|HERMES_WEBUI_STATE_DIR\|HERMES_WEBUI_PORT\|HERMES_WEBUI_HOST' .env +``` + +If `.env` exists, do not print the full file. Inspect only the specific +non-secret keys needed to understand the active Hermes home, WebUI state +directory, port, or host. + +## Isolated local trial + +Use an isolated Hermes home and WebUI state directory for a reinstall or support +trial. This keeps the test away from the operator's real memory, sessions, +profiles, credentials, and cron state. + +```bash +mkdir -p ~/hermes-onboarding-test +HERMES_HOME=~/hermes-onboarding-test/.hermes \ +HERMES_WEBUI_STATE_DIR=~/hermes-onboarding-test/webui \ +HERMES_WEBUI_PORT=8789 \ +python3 bootstrap.py +``` + +Open: + +```text +http://127.0.0.1:8789 +``` + +The bootstrap writes a port-specific log under the selected WebUI state +directory: + +```text +~/hermes-onboarding-test/webui/bootstrap-8789.log +``` + +For daemon-style installs, `ctl.sh` writes the daemon log to the active +`HERMES_HOME` by default: + +```text +~/.hermes/webui.log +``` + +When using the isolated trial environment, prefer the bootstrap command above +unless the human specifically wants to validate `ctl.sh`. + +## Non-secret evidence commands + +After the server starts, collect status without secrets: + +```bash +curl -sS http://127.0.0.1:8789/health +curl -sS http://127.0.0.1:8789/api/onboarding/status +find ~/hermes-onboarding-test -maxdepth 3 -type f | sort +tail -n 120 ~/hermes-onboarding-test/webui/bootstrap-8789.log +``` + +When summarizing `/api/onboarding/status`, focus on: + +- `completed` +- `system.hermes_found` +- `system.imports_ok` +- `system.config_path` +- `system.config_exists` +- `system.setup_state` +- `system.provider_configured` +- `system.provider_ready` +- `system.chat_ready` +- `system.current_provider` +- `system.current_model` +- `system.current_base_url` +- `system.env_path` + +Do not paste the full payload if it contains unexpected sensitive local paths +or values. Redact paths and provider details when the human asks for a public +GitHub or Discord support report. + +## Pass criteria + +A local onboarding trial passes when: + +- `/health` returns successfully. +- `/api/onboarding/status` returns JSON. +- The wizard appears when `completed` is false. +- The wizard stays out of the way when `completed` is true or + `HERMES_WEBUI_SKIP_ONBOARDING=1` is intentionally set. +- `system.hermes_found` and `system.imports_ok` match the expected bootstrap + state. +- `system.provider_ready` and `system.chat_ready` become true after the human + completes a provider path that should support chat. +- `system.config_path` and `system.env_path` point inside the intended isolated + `HERMES_HOME` during a trial. +- WebUI files are written under the intended `HERMES_WEBUI_STATE_DIR`. + +If the human chooses a provider that must be completed in the CLI, passing can +mean the wizard correctly points them to `hermes model` or `hermes auth` rather +than trying to collect unsupported credentials in the browser. + +## Failure triage + +If the server does not start: + +- check the bootstrap log +- check for a port conflict on `8789` +- confirm Python can run `bootstrap.py` +- confirm `.env` is not overriding the isolated directories or port + +If onboarding reports `agent_unavailable`: + +- confirm the bootstrap found or installed Hermes Agent +- check whether the running Python can import `run_agent.AIAgent` +- use `docs/troubleshooting.md`, especially the `AIAgent not available` flow + +If onboarding reports `provider_incomplete`: + +- confirm whether the provider is API-key based, OAuth based, or local +- let the human enter credentials or run the CLI auth flow +- do not ask the human to paste secrets into chat + +If a local model server does not probe successfully: + +- from native macOS/Linux, use `http://127.0.0.1:/v1` when the server is + on the same host +- from Docker Desktop, use `http://host.docker.internal:/v1` +- from another LAN machine, use the server's LAN IP and `/v1` +- remember that `localhost` inside a container is the container itself + +If password or reverse-proxy behavior is confusing: + +- keep the first pass on `127.0.0.1` +- require password protection before exposing WebUI beyond localhost +- include the reverse proxy shape in the support report without pasting tokens + or cookies + +## Final support report + +Use this shape when reporting results to the human, Discord, or GitHub: + +```text +Install path: +OS / Python: +Repo commit: +Command used: +WebUI URL: +State isolation: +Health result: +Onboarding status summary: +Files created or changed: +Log excerpt: +Pass/fail: +Next recommended action: +``` + +Redact secrets and private paths before posting publicly. diff --git a/docs/onboarding.md b/docs/onboarding.md index f6409f96..b53b68fc 100644 --- a/docs/onboarding.md +++ b/docs/onboarding.md @@ -3,6 +3,11 @@ This guide explains what happens the first time Hermes WebUI starts, which setup path to choose, and how to recover when the wizard cannot finish. +If an AI assistant is helping with install, reinstall, bootstrap, provider +setup, or first-run support, read +[`docs/onboarding-agent-checklist.md`](onboarding-agent-checklist.md) before +running commands or inspecting logs. + The short version: run the bootstrap, open the WebUI, choose a provider, choose a workspace, optionally set a password, then start a chat. If you are using a local model server from Docker, pay special attention to the Base URL section @@ -55,6 +60,10 @@ python3 bootstrap.py Then open `http://127.0.0.1:8789`. +For an assistant-led trial run, follow the safety rules, evidence commands, and +pass/fail criteria in +[`docs/onboarding-agent-checklist.md`](onboarding-agent-checklist.md). + If your repo has a `.env` file, remember that the bootstrap loads it. Remove or adjust any `HERMES_HOME`, `HERMES_WEBUI_STATE_DIR`, or `HERMES_WEBUI_PORT` entries there before using the isolated command above. diff --git a/tests/test_docs_gitignore_policy.py b/tests/test_docs_gitignore_policy.py index a2729fae..de0271db 100644 --- a/tests/test_docs_gitignore_policy.py +++ b/tests/test_docs_gitignore_policy.py @@ -20,6 +20,12 @@ def test_new_top_level_markdown_docs_are_trackable(): assert _git_check_ignore("docs/example-new-guide.md").returncode == 1 +def test_root_agents_entrypoint_is_trackable(): + """AGENTS.md is the shared repo entrypoint; local overrides stay ignored.""" + assert _git_check_ignore("AGENTS.md").returncode == 1 + assert _git_check_ignore("AGENTS.local.md").returncode == 0 + + def test_docs_scratch_files_remain_ignored(): """The broad docs/* ignore rule should still keep arbitrary scratch files out.""" assert _git_check_ignore("docs/local-scratch.tmp").returncode == 0