Metadata-Version: 2.4
Name: horo-next-webui
Version: 0.52.544
Summary: Unofficial PyPI distribution of Hermes WebUI
Author: Hermes WebUI contributors
Maintainer: horo-next-webui contributors
License-Expression: MIT
Project-URL: Source, https://github.com/iscodesnippet2/horo-next-webui
Project-URL: Issues, https://github.com/iscodesnippet2/horo-next-webui/issues
Project-URL: Security, https://github.com/iscodesnippet2/horo-next-webui/blob/horo/SECURITY.md
Project-URL: Upstream, https://github.com/nesquena/hermes-webui
Classifier: Operating System :: POSIX :: Linux
Classifier: Operating System :: MacOS
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Requires-Python: <3.14,>=3.11
Description-Content-Type: text/markdown
License-File: LICENSE
License-File: THIRD_PARTY_LICENSES
Requires-Dist: pyyaml>=6.0
Requires-Dist: cryptography>=50.0.0
Dynamic: license-file

# horo-next-webui

An **unofficial** PyPI distribution of [Hermes WebUI](https://github.com/nesquena/hermes-webui), the browser interface for Hermes Agent. It is not affiliated with, endorsed by, or sponsored by the Hermes WebUI authors or Nous Research.

```bash
pip install horo-next horo-next-webui
hermes-webui
```

Install it into the same environment as [horo-next](https://pypi.org/project/horo-next/) (Hermes Agent). The command is `hermes-webui` and state lives in `~/.hermes/webui`, as upstream.

## What differs from upstream

Packaging and launch only. Product behaviour is upstream's.

- **Works offline.** Prism, xterm, Mermaid and PDF.js are served from the wheel instead of cdn.jsdelivr.net.
- **No known advisories in shipped code at release time**, in OSV or Sonatype's public data. Every front-end library is moved to the lowest clean release, and Mermaid is rebuilt from a lockfile so the DOMPurify it embeds is a fixed release too. Python dependency floors that admit a vulnerable version are raised. Each release notes exactly what changed.
- **The launcher never installs anything.** Without Hermes Agent it tells you to `pip install horo-next`, instead of running upstream's GitHub installer or creating a virtualenv inside site-packages.
- The server's working directory is the WebUI state directory, not site-packages.
- **No automatic outbound traffic.** The GitHub update check is off by default, and the CSP names no CDN, analytics or font host.
- Python 3.11–3.13.

## Versions

`horo-next-webui X.Y.Z` is built from upstream `vX.Y.Z` or `exp-vX.Y.Z`. A packaging-only fix on the same upstream release is published as `X.Y.Z.postN`.

## Offline installation

Each release attaches `requirements-X.Y.Z.txt`, the full resolved dependency set for Linux / CPython 3.12, and `requirements-X.Y.Z-hashes.txt`, the same set for `pip install --require-hashes`. On a machine with internet access:

```bash
pip download horo-next-webui==X.Y.Z -d wheelhouse
```

Then on the offline machine:

```bash
pip install --no-index --find-links wheelhouse horo-next-webui
```

## Security review

Each [GitHub release](https://github.com/iscodesnippet2/horo-next-webui/releases) attaches a CycloneDX SBOM, the vulnerability audit and the third-party notices. See the [security policy](https://github.com/iscodesnippet2/horo-next-webui/blob/horo/SECURITY.md) and the [reviewer's guide](https://github.com/iscodesnippet2/horo-next-webui/blob/horo/docs/security-review.md).

## License

MIT. Hermes WebUI is copyright its contributors; bundled front-end libraries carry their own licenses, in `THIRD_PARTY_LICENSES` inside the wheel. KaTeX's fonts are OFL-1.1.
