Hermo v0.1.0-beta.2

Hermo v0.1.0-beta.2

Hermo turns authorized website workflows into local REST APIs and MCP tools.
This beta is source-available under the Hermo License; personal and internal
business use is free under its terms.

Install on Windows

1. Install Node.js 24 or newer with npm.
2. Download the source ZIP below and fully extract it to a writable folder, or run:

   git clone --branch v0.1.0-beta.2 https://github.com/PraveenNimilka/Hermo.git
   cd Hermo

3. Double-click Start Hermo.cmd. First setup installs locked dependencies,
   builds the dashboard and opens http://127.0.0.1:4317. Keep its terminal open.
4. Create a workspace password. For managed browsing, run
   npx.cmd playwright install chromium in the extracted folder.
5. For existing Chrome tabs, load companion/browser as an unpacked extension at
   chrome://extensions, create a Connect code in Hermo, and authorize the tab.

Manual startup: npm.cmd ci, npm.cmd run build, then npm.cmd start.

Installation and upgrades ·
Complete first-workflow guide ·
User guide

Correction in this beta

Fix a publication-readiness race after verification finishes outside the test
dialog. The dialog now reads the current verified draft before enabling Publish,
and run completion refreshes the overview. A deterministic stale-data regression
covers the failure without relaxing approval or permission checks.

Supported capabilities

• Record authorized controls, parameterize inputs and extract typed nested results.
• Run in a selected Chrome tab or a dedicated managed Chromium profile.
• Retain complete managed profiles encrypted between sessions, with safe locking
  and recovery from the last completed snapshot.
• Review exact-origin permissions, perform scoped HTTP submissions and secure
  WebSocket interactions, or keep retrieval limited to GET/HEAD.
• Verify output freshness, configure waits, approve protected steps and repair targets.
• Publish immutable revisions; invoke through scoped REST, OpenAPI and MCP interfaces.
• Organize projects, inspect run evidence, rotate keys and export structural templates.

Hosted checks

• pull_request Windows verification — passed
• push Windows verification — passed

Verification

• Full regression suite: 554 passed, 0 failed, 1 skipped (555 tests).
• The privileged Windows symlink case passed separately as Administrator.
• Consumer checks: 28 passed. Publication and interface checks: 11 passed.
• The stale-card regression fails against the previous release and passes with the correction.
• Clean installation, independent profile/network review, and real Chromium
  recording → verification → publication → REST/MCP → tab closure → process restart
  → REST/MCP passed with disposable authenticated website data and no duplicate replay.
• Public JavaScript, HTTP form POST and secure WebSocket demonstration sites passed.
• The locked dependency audit reported zero known vulnerabilities at release preparation.

Verification scope and evidence

Known limitations

• Windows is release-tested. macOS and Linux lack equivalent end-to-end verification
  and require a stable externally supplied encryption key.
• Keep the local runtime and computer running. Public hosting is not configured.
• Connected Chrome needs its original authorized tab and valid owner lease;
  restart requires reconnection. Managed calls can reopen their saved profile
  only while the website still accepts that session.
• Expired logins, quotas, verification screens, changed pages and unsupported
  layouts can stop workflows. Provider compatibility is not universal.
• Active profiles use temporary readable files. Crashes can lose changes since
  the last completed encrypted snapshot; operating-system account security matters.
• Service workers and arbitrary downloads remain disabled. Protected or expired
  media links may not be portable.
• Cancellation cannot undo website changes. Inspect uncertain submissions before
  retrying; they are not automatically replayed.
• Tests include synthetic fixtures and public demonstrations; they are not an
  external penetration-test certification or proof for every authenticated service.

Back up the complete stopped data directory and retain its encryption-key context
before upgrading. Never publish workspace databases, profiles, credentials or keys.
Report reproducible problems without private data through the repository's issues;
follow SECURITY.md for security reports.

Hermo v0.1.0-beta.1

Superseded by v0.1.0-beta.2, which corrects a publication-readiness race exposed by hosted Windows verification. Install the corrected beta for new workspaces.

Hermo v0.1.0-beta.1

Hermo turns authorized website workflows into local REST APIs and MCP tools.
This beta is source-available under the Hermo License; personal and internal
business use is free under its terms.

Install on Windows

1. Install Node.js 24 or newer with npm.
2. Download the source ZIP below and fully extract it to a writable folder, or run:

   git clone --branch v0.1.0-beta.1 https://github.com/PraveenNimilka/Hermo.git
   cd Hermo

3. Double-click Start Hermo.cmd. First setup installs locked dependencies,
   builds the dashboard and opens http://127.0.0.1:4317. Keep its terminal open.
4. Create a workspace password. For managed browsing, run
   npx.cmd playwright install chromium in the extracted folder.
5. For existing Chrome tabs, load companion/browser as an unpacked extension at
   chrome://extensions, create a Connect code in Hermo, and authorize the tab.

Manual startup: npm.cmd ci, npm.cmd run build, then npm.cmd start.

Installation and upgrades ·
Complete first-workflow guide ·
User guide

Supported capabilities

• Record authorized controls, parameterize inputs and extract typed nested results.
• Run in a selected Chrome tab or a dedicated managed Chromium profile.
• Retain complete managed profiles encrypted between sessions, with safe locking
  and recovery from the last completed snapshot.
• Review exact-origin permissions, perform scoped HTTP submissions and secure
  WebSocket interactions, or keep retrieval limited to GET/HEAD.
• Verify output freshness, configure waits, approve protected steps and repair targets.
• Publish immutable revisions; invoke through scoped REST, OpenAPI and MCP interfaces.
• Organize projects, inspect run evidence, rotate keys and export structural templates.

Verification

• Full regression suite: 554 passed, 0 failed, 1 skipped (555 tests).
• The privileged Windows symlink case passed separately as Administrator.
• Consumer checks: 28 passed. Final interface-copy checks: 21 passed.
• Clean installation, independent profile/network review, and real Chromium
  recording → verification → publication → REST/MCP → tab closure → process restart
  → REST/MCP passed with disposable authenticated website data and no duplicate replay.
• Public JavaScript, HTTP form POST and secure WebSocket demonstration sites passed.
• The locked dependency audit reported zero known vulnerabilities at release preparation.

Verification scope and evidence

Known limitations

• Windows is release-tested. macOS and Linux lack equivalent end-to-end verification
  and require a stable externally supplied encryption key.
• Keep the local runtime and computer running. Public hosting is not configured.
• Connected Chrome needs its original authorized tab and valid owner lease;
  restart requires reconnection. Managed calls can reopen their saved profile
  only while the website still accepts that session.
• Expired logins, quotas, verification screens, changed pages and unsupported
  layouts can stop workflows. Provider compatibility is not universal.
• Active profiles use temporary readable files. Crashes can lose changes since
  the last completed encrypted snapshot; operating-system account security matters.
• Service workers and arbitrary downloads remain disabled. Protected or expired
  media links may not be portable.
• Cancellation cannot undo website changes. Inspect uncertain submissions before
  retrying; they are not automatically replayed.
• Tests include synthetic fixtures and public demonstrations; they are not an
  external penetration-test certification or proof for every authenticated service.

Back up the complete stopped data directory and retain its encryption-key context
before upgrading. Never publish workspace databases, profiles, credentials or keys.
Report reproducible problems without private data through the repository's issues;
follow SECURITY.md for security reports.