hermes-webui AGENTS.md

Repository-specific instructions for AI coding assistants working on Hermes WebUI, including which project documents to read before making changes.

In plain words
What is it for?
Use it when modifying Hermes WebUI, especially for setup, onboarding, troubleshooting, UI, testing, or contribution work.
Why use it?
It reduces the risk of changes that conflict with the project's architecture, testing rules, design guidance, or onboarding behavior.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/nesquena/hermes-webui/agents-md
Clone the repo
git clone --depth 1 https://github.com/nesquena/hermes-webui

Made for: Codex, OpenCode.

Per session 1,537 This file is loaded in full into every session.
When invoked 1,537 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.01537 $0.01537
Opus 5 $0.00768 $0.00768
Sonnet 5 $0.00307 $0.00307
Haiku 4.5 $0.00154 $0.00154

Measured yesterday against content hash aa279d0a6bd9, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

hermes-webui AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 127 lines

How it starts

The opening of the file, as written. The whole thing — 127 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Agent instructions for Hermes WebUI

This file is the shared entry point for AI assistants working in this repository. Keep it project-specific and safe to publish. Do not put personal machine setup, private network details, credentials, tokens, or local-only workflow notes here.

Read first

Before making changes, read:

  1. README.md
  2. CONTRIBUTING.md
  3. docs/CONTRACTS.md
  4. CHANGELOG.md

For architecture, testing, or setup work, also read the matching reference:

  • ARCHITECTURE.md for design constraints and current module layout
  • TESTING.md for local verification commands and manual test guidance
  • docs/onboarding.md for first-run onboarding behavior
  • docs/troubleshooting.md for diagnostic flows
  • docs/rfcs/README.md for larger RFCs and state/durability contracts

For UI or UX work, read docs/UIUX-GUIDE.md and DESIGN.md before changing layout, interaction flow, themes, chat rendering, or composer chrome.

Onboarding and reinstall support

If the task involves install, reinstall, bootstrap, first-run onboarding, provider setup, local model server setup, Docker onboarding, WSL onboarding, or support for a failed first run, read docs/onboarding-agent-checklist.md before running commands or inspecting logs.

Follow that checklist's safety rules:

  • use isolated HERMES_HOME and HERMES_WEBUI_STATE_DIR for trials unless the human explicitly asks to use real state
  • do not delete or overwrite a real ~/.hermes directory without explicit approval
  • do not print API keys, OAuth tokens, cookies, full .env files, full auth.json files, or password hashes
  • collect non-secret status and log evidence before recommending a fix

Contribution style

  • Keep one logical change per PR; split unrelated refactors or cleanup.
  • Read docs/CONTRACTS.md and the linked contract/RFC for the touched subsystem before editing.
  • For local pytest runs, use ./scripts/test.sh instead of bare python3, python -m pytest, or pytest. The script creates/uses the repo .venv, pins execution to Python 3.11-3.13, and installs missing dev test dependencies. HERMES_WEBUI_TEST_PYTHON selects the supported base interpreter used to create or rebuild .venv; it must not install test dependencies into a system/Homebrew interpreter directly. If a direct pytest invocation reports an unsupported interpreter, rerun through ./scripts/test.sh before debugging product code.
  • Prefer the existing Python + vanilla JavaScript structure. Do not add dependencies, build tools, frameworks, or long-lived processes without clear justification and a rollback story.
  • Update docs when changing setup, onboarding, runtime behavior, architecture, testing guidance, or user-facing workflows.
  • Do not edit CHANGELOG.md in ordinary contributor PRs. The release workflow owns changelog updates through release commits. If a change is release-note worthy, include concise release-note wording in the PR body instead.
  • For UI or UX changes, include before/after evidence and test relevant desktop, narrow, and mobile states.
  • For behavior changes, add or update automated tests where practical and list the manual verification performed.
  • For runtime, streaming, recovery, replay, compression, or sidebar metadata changes, name the state layer being mutated and prove the relevant invariant.
  • For Docker build changes in docker_init.bash, mirror directory exclusions in both the rsync and cp -a paths — /opt/hermes may contain subdirectories with restricted permissions (e.g. .playwright/).

Read the full file on GitHub · 127 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 127 lines · 1,537 tokens per session scan A aa279d0a6bd9

Subscribe to this mod's changes

hermes-webui AGENTS.md is an instructions file published in the GitHub repository nesquena/hermes-webui (17,892 stars, last pushed 6d ago), licensed MIT. It adds 1,537 tokens to every session, about $0.0077 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.