Skip to content

Commit 91ec395

Browse files
Wizarckclaude
Wizarck
and
claude
committed
Merge upstream/main + add web_via_http_sse platform (preserves WABA)
Sync of fork with upstream/main (first sync since #1 WABA merge). Resolved ~219 file conflicts; ~210 of them were upstream-only changes (refactors of agent/, tests/, hermes_cli/, web/, ui-tui/, nix/, docs/, etc.) where we had no fork-specific changes — took theirs. The 10 WABA-touchpoint files needed manual resolution to preserve the integration: * gateway/config.py — kept Platform.WHATSAPP_VIA_MCP_META_BUSINESS_API + env loader; added Platform.WEB_VIA_HTTP_SSE for the new platform. * gateway/run.py — kept WABA factory + auth allowlists; added WEB_VIA_HTTP_SSE factory + auth allowlists. * agent/prompt_builder.py — kept WABA PLATFORM_HINTS; added web_via_http_sse hint. * toolsets.py — restored hermes-whatsapp-via-mcp-meta-business-api toolset (upstream refactor dropped it) + added hermes-web-via-http-sse; both re-included in the hermes-gateway composite. * cron/scheduler.py, tools/send_message_tool.py, hermes_cli/{status,gateway}.py, website/docusaurus.config.ts — upstream refactored these to use the Platform enum dynamically (via _missing_) instead of explicit per-platform static maps; took theirs since WABA dispatch now works via the enum. Net new: gateway/platforms/web_via_http_sse.py (~430 LOC, generic SSE platform mirroring the WABA structure — new file, no conflict). Verified: ast.parse passes for all modified Python files; gateway/platforms/ whatsapp_via_mcp_meta_business_api.py untouched (binary-equivalent); no merge markers remain. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
2 parents e6062f0 + 773cf48 commit 91ec395

1,781 files changed

Lines changed: 365754 additions & 23940 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.dockerignore‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,15 @@
55

66
# Dependencies
77
node_modules
8+
**/node_modules
89
.venv
10+
**/.venv
11+
12+
# Built artifacts that are regenerated inside the image. Excluded so local
13+
# rebuilds on the developer's machine don't invalidate the npm-install layer
14+
# that now depends on the full ui-tui/packages/hermes-ink/ tree being present.
15+
ui-tui/dist/
16+
ui-tui/packages/hermes-ink/dist/
917

1018
# CI/CD
1119
.github
@@ -14,3 +22,10 @@ node_modules
1422
.env
1523

1624
*.md
25+
26+
# Runtime data (bind-mounted at /opt/data; must not leak into build context)
27+
data/
28+
29+
# Compose/profile runtime state (bind-mounted; avoid ownership/secret issues)
30+
hermes-config/
31+
runtime/

‎.env.example‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -244,6 +244,15 @@ BROWSERBASE_PROXIES=true
244244
# Uses custom Chromium build to avoid bot detection altogether
245245
BROWSERBASE_ADVANCED_STEALTH=false
246246

247+
# Browser engine for local mode (default: auto = Chrome)
248+
# "auto" — use Chrome (don't pass --engine flag)
249+
# "lightpanda" — use Lightpanda (1.3-5.8x faster navigation, no screenshots)
250+
# "chrome" — explicitly request Chrome
251+
# Requires agent-browser v0.25.3+. Lightpanda commands that fail or return
252+
# empty results are automatically retried with Chrome.
253+
# Also configurable via browser.engine in config.yaml.
254+
# AGENT_BROWSER_ENGINE=auto
255+
247256
# Browser session timeout in seconds (default: 300)
248257
# Sessions are cleaned up after this duration of inactivity
249258
BROWSER_SESSION_TIMEOUT=300
@@ -398,3 +407,19 @@ IMAGE_TOOLS_DEBUG=false
398407
# Override STT provider endpoints (for proxies or self-hosted instances)
399408
# GROQ_BASE_URL=https://api.groq.com/openai/v1
400409
# STT_OPENAI_BASE_URL=https://api.openai.com/v1
410+
411+
# =============================================================================
412+
# MICROSOFT TEAMS INTEGRATION
413+
# =============================================================================
414+
# Register a Bot in Azure: https://dev.botframework.com/ → "Register a bot"
415+
# Or use Azure Portal: Azure Active Directory → App registrations → New registration
416+
# Then add the bot to Teams via the Bot Framework or App Studio.
417+
#
418+
# TEAMS_CLIENT_ID= # Azure AD App (client) ID
419+
# TEAMS_CLIENT_SECRET= # Azure AD client secret value
420+
# TEAMS_TENANT_ID= # Azure AD tenant ID (or "common" for multi-tenant)
421+
# TEAMS_ALLOWED_USERS= # Comma-separated AAD object IDs or UPNs
422+
# TEAMS_ALLOW_ALL_USERS=false # Set true to skip the allowlist
423+
# TEAMS_HOME_CHANNEL= # Default channel/chat ID for cron delivery
424+
# TEAMS_HOME_CHANNEL_NAME= # Display name for the home channel
425+
# TEAMS_PORT=3978 # Webhook listen port (Bot Framework default)

‎.github/actions/nix-setup/action.yml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,18 @@
11
name: 'Setup Nix'
2-
description: 'Install Nix with DeterminateSystems and enable magic-nix-cache'
2+
description: 'Install Nix and configure Cachix binary cache'
3+
4+
inputs:
5+
cachix-auth-token:
6+
description: 'Cachix auth token (enables push). Omit for read-only.'
7+
required: false
8+
default: ''
39

410
runs:
511
using: composite
612
steps:
713
- uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
8-
- uses: DeterminateSystems/magic-nix-cache-action@565684385bcd71bad329742eefe8d12f2e765b39 # v13
14+
- uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
15+
with:
16+
name: hermes-agent
17+
authToken: ${{ inputs.cachix-auth-token }}
18+
continue-on-error: true

‎.github/dependabot.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# Dependabot configuration for hermes-agent.
2+
#
3+
# Deliberately scoped to github-actions only.
4+
#
5+
# We do NOT enable Dependabot for pip / npm / any source-dependency ecosystem
6+
# because we pin source dependencies exactly (uv.lock, package-lock.json) as
7+
# part of our supply-chain posture. Automatic version-bump PRs against those
8+
# pins would undermine the strategy — pins are moved deliberately, after
9+
# review, not on a schedule.
10+
#
11+
# github-actions is the exception: action pins (we use full commit SHAs per
12+
# supply-chain policy) must be updated when upstream actions publish
13+
# patches — usually themselves security fixes. Dependabot opens a PR with
14+
# the new SHA and release notes; we review and merge like any other PR.
15+
#
16+
# Security-update PRs for source dependencies (opened ONLY when a CVE is
17+
# published affecting a currently-pinned version) are enabled separately
18+
# via the repo's Dependabot security updates setting
19+
# (Settings → Code security → Dependabot → Dependabot security updates).
20+
# Those are CVE-only, not schedule-driven, and do not conflict with our
21+
# pinning strategy — they fire when a pinned version becomes known-bad,
22+
# which is exactly when we want to move the pin.
23+
24+
version: 2
25+
updates:
26+
- package-ecosystem: "github-actions"
27+
directory: "/"
28+
schedule:
29+
interval: "weekly"
30+
day: "monday"
31+
open-pull-requests-limit: 5
32+
labels:
33+
- "dependencies"
34+
- "github-actions"
35+
commit-message:
36+
prefix: "chore(actions)"
37+
include: "scope"
38+
groups:
39+
# Batch routine action bumps into one PR per week to reduce noise.
40+
# Security updates still open individually and bypass grouping.
41+
actions-minor-patch:
42+
update-types:
43+
- "minor"
44+
- "patch"

‎.github/workflows/deploy-site.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,9 @@ jobs:
5353
- name: Extract skill metadata for dashboard
5454
run: python3 website/scripts/extract-skills.py
5555

56+
- name: Regenerate per-skill docs pages + catalogs
57+
run: python3 website/scripts/generate-skill-docs.py
58+
5659
- name: Build skills index (if not already present)
5760
env:
5861
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -73,6 +76,16 @@ jobs:
7376
run: |
7477
mkdir -p _site/docs
7578
cp -r website/build/* _site/docs/
79+
# llms.txt / llms-full.txt are also published at the site root
80+
# (https://hermes-agent.nousresearch.com/llms.txt) because some
81+
# agents and IDE plugins probe the classic root-level path rather
82+
# than /docs/llms.txt. Same file, two URLs, one source of truth.
83+
if [ -f website/build/llms.txt ]; then
84+
cp website/build/llms.txt _site/llms.txt
85+
fi
86+
if [ -f website/build/llms-full.txt ]; then
87+
cp website/build/llms-full.txt _site/llms-full.txt
88+
fi
7689
7790
- name: Upload artifact
7891
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3

‎.github/workflows/docs-site-checks.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,9 @@ jobs:
3636
- name: Extract skill metadata for dashboard
3737
run: python3 website/scripts/extract-skills.py
3838

39+
- name: Regenerate per-skill docs pages + catalogs
40+
run: python3 website/scripts/generate-skill-docs.py
41+
3942
- name: Lint docs diagrams
4043
run: npm run lint:diagrams
4144
working-directory: website

‎.github/workflows/nix-lockfile-fix.yml‎

Lines changed: 108 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,13 @@
11
name: Nix Lockfile Fix
22

33
on:
4+
push:
5+
branches: [main]
6+
paths:
7+
- 'ui-tui/package-lock.json'
8+
- 'ui-tui/package.json'
9+
- 'web/package-lock.json'
10+
- 'web/package.json'
411
workflow_dispatch:
512
inputs:
613
pr_number:
@@ -19,9 +26,105 @@ concurrency:
1926
cancel-in-progress: false
2027

2128
jobs:
29+
# ── Auto-fix on main ───────────────────────────────────────────────
30+
# Fires when a push to main touches package.json or package-lock.json
31+
# in ui-tui/ or web/. Runs fix-lockfiles and pushes the hash
32+
# update commit directly to main so Nix builds never stay broken.
33+
#
34+
# Safety invariants:
35+
# 1. The fix commit only touches nix/*.nix files, which are NOT in
36+
# the paths filter above, so this cannot re-trigger itself.
37+
# 2. An explicit file-whitelist check before commit aborts if
38+
# fix-lockfiles ever modifies unexpected files.
39+
# 3. Job-level concurrency with cancel-in-progress: true ensures
40+
# back-to-back pushes collapse to the newest; ref: main checkout
41+
# always operates on the latest branch state.
42+
# 4. Uses a GitHub App token (not GITHUB_TOKEN) so the fix commit
43+
# triggers downstream nix.yml verification.
44+
auto-fix-main:
45+
if: github.event_name == 'push'
46+
runs-on: ubuntu-latest
47+
timeout-minutes: 25
48+
concurrency:
49+
group: auto-fix-main
50+
cancel-in-progress: true
51+
steps:
52+
- name: Generate GitHub App token
53+
id: app-token
54+
uses: actions/create-github-app-token@7bfa3a4717ef143a604ee0a99d859b8886a96d00 # v1.9.3
55+
with:
56+
app-id: ${{ secrets.APP_ID }}
57+
private-key: ${{ secrets.APP_PRIVATE_KEY }}
58+
59+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
60+
with:
61+
ref: main
62+
token: ${{ steps.app-token.outputs.token }}
63+
64+
- uses: ./.github/actions/nix-setup
65+
with:
66+
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
67+
68+
- name: Apply lockfile hashes
69+
id: apply
70+
run: nix run .#fix-lockfiles -- --apply
71+
72+
- name: Commit & push
73+
if: steps.apply.outputs.changed == 'true'
74+
shell: bash
75+
run: |
76+
set -euo pipefail
77+
78+
# Ensure only nix files were modified — prevents accidental
79+
# self-triggering if fix-lockfiles ever touches package files.
80+
unexpected="$(git diff --name-only | grep -Ev '^nix/(tui|web)\.nix$' || true)"
81+
if [ -n "$unexpected" ]; then
82+
echo "::error::Unexpected modified files: $unexpected"
83+
exit 1
84+
fi
85+
86+
# Record the base SHA before committing — used to detect package
87+
# file changes if we need to rebase after a non-fast-forward push.
88+
BASE_SHA="$(git rev-parse HEAD)"
89+
90+
git config user.name 'github-actions[bot]'
91+
git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
92+
git add nix/tui.nix nix/web.nix
93+
git commit -m "fix(nix): auto-refresh npm lockfile hashes" \
94+
-m "Source: $GITHUB_SHA" \
95+
-m "Run: $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"
96+
97+
# Retry push with rebase in case main advanced with an unrelated
98+
# commit during the nix build. Without this, a non-fast-forward
99+
# rejection silently loses the fix. If package files changed during
100+
# the rebase, abort — a fresh auto-fix run will handle the new state.
101+
for attempt in 1 2 3; do
102+
if git push origin HEAD:main; then
103+
exit 0
104+
fi
105+
echo "::warning::Push attempt $attempt failed (non-fast-forward?), rebasing…"
106+
git fetch origin main
107+
108+
# If package files changed between our base and the new main,
109+
# our computed hashes are stale. Abort and let the next triggered
110+
# run recompute from the correct package-lock state.
111+
pkg_changed="$(git diff --name-only "$BASE_SHA"..origin/main -- \
112+
'ui-tui/package-lock.json' 'ui-tui/package.json' \
113+
'web/package-lock.json' 'web/package.json' || true)"
114+
if [ -n "$pkg_changed" ]; then
115+
echo "::warning::Package files changed since hash computation — aborting; a fresh run will recompute"
116+
exit 0
117+
fi
118+
119+
git rebase origin/main
120+
done
121+
echo "::error::Failed to push after 3 rebase attempts"
122+
exit 1
123+
124+
# ── PR fix (manual / checkbox) ─────────────────────────────────────
125+
# Existing behavior: run on manual dispatch OR when a task-list
126+
# checkbox in the sticky lockfile-check comment flips from [ ] to [x].
22127
fix:
23-
# Run on manual dispatch OR when a task-list checkbox in the sticky
24-
# lockfile-check comment flips from `[ ]` to `[x]`.
25128
if: |
26129
github.event_name == 'workflow_dispatch' ||
27130
(github.event_name == 'issue_comment'
@@ -99,10 +202,12 @@ jobs:
99202
fetch-depth: 0
100203

101204
- uses: ./.github/actions/nix-setup
205+
with:
206+
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
102207

103208
- name: Apply lockfile hashes
104209
id: apply
105-
run: nix run .#fix-lockfiles -- --apply
210+
run: nix run .#fix-lockfiles
106211

107212
- name: Commit & push
108213
if: steps.apply.outputs.changed == 'true'

0 commit comments

Comments
 (0)