Publishing Sites and Using Drives with the here.now Skill in Hermes Agent

The here.now skill gives an agent two distinct capabilities: publishing static sites and files to a public URL under the {slug}.here.now domain, and storing private files in cloud Drives. You would reach for this when an agent needs to share a rendered report, a set of assets, or a simple web page with a human, or when it needs persistent private storage for documents, context, or intermediate work products that should not be published.

What it does

The skill wraps two scripts that live in the Hermes Agent skill directory: publish.sh for sites and drive.sh for Drives. Publishing a site is a three-step flow (create or update, upload files, finalize) that the script handles in one call. The result is a live URL. Drives are private cloud folders tied to an account; every signed-in account has a default Drive named My Drive. The skill also handles API key management, anonymous versus authenticated publishing, and scoped token sharing for agent-to-agent Drive access.

Before you start

Three binaries must be on the system PATH: curl, file, and jq. The skill is optional and installed on demand. It runs on macOS and Linux. The skill helper scripts live at these paths:

• ${HERMES_SKILL_DIR}/scripts/publish.sh for publishing sites
• ${HERMES_SKILL_DIR}/scripts/drive.sh for private Drive storage

You can supply credentials through an environment variable ($HERENOW_API_KEY), a Drive token variable ($HERENOW_DRIVE_TOKEN), or a credentials file at ~/.herenow/credentials. The credentials file is the recommended method for agents.

Create a site

To publish a file or directory as a site, run the publish script:

PUBLISH="${HERMES_SKILL_DIR}/scripts/publish.sh"
bash "$PUBLISH" {file-or-dir} --client hermes

The script outputs the live URL, for example https://bright-canvas-a7k2.here.now/. Under the hood this is a three-step flow: create/update, upload files, finalize. A site is not live until finalize succeeds.

Without an API key this creates an anonymous site that expires in 24 hours. With a saved API key, the site is permanent.

File structure: For HTML sites, place index.html at the root of the directory you publish, not inside a subdirectory. The directory's contents become the site root. For example, publish my-site/ where my-site/index.html exists. Do not publish a parent folder that contains my-site/.

You can also publish raw files without any HTML. Single files get a rich auto-viewer (images, PDF, video, audio). Multiple files get an auto-generated directory listing with folder navigation and an image gallery.

Update an existing site

To update a site you already created, pass its slug:

PUBLISH="${HERMES_SKILL_DIR}/scripts/publish.sh"
bash "$PUBLISH" {file-or-dir} --slug {slug} --client hermes

The script auto-loads the claimToken from .herenow/state.json when updating anonymous sites. Pass --claim-token {token} to override. Authenticated updates require a saved API key.

Use a Drive

Use a Drive when the user wants private cloud storage for agent files: documents, context, memory, plans, assets, media, research, code, and anything else that should persist without being published as a website.

Every signed-in account has a default Drive named My Drive.

DRIVE="${HERMES_SKILL_DIR}/scripts/drive.sh"
bash "$DRIVE" default
bash "$DRIVE" ls "My Drive"
bash "$DRIVE" put "My Drive" notes/today.md --from ./notes/today.md
bash "$DRIVE" cat "My Drive" notes/today.md
bash "$DRIVE" share "My Drive" --perms write --prefix notes/ --ttl 7d

Use scoped Drive tokens for agent-to-agent handoff. If you receive a herenow_drive share block, use its token as Authorization: Bearer against api_base, respect pathPrefix when present, and preserve ETags on writes. A pathPrefix of null means full-Drive access. If the skill is available, prefer drive.sh; otherwise call the listed API operations directly.

API key storage

The publish script reads the API key from these sources (first match wins):

1. --api-key {key} flag (CI/scripting only, avoid in interactive use)
2. $HERENOW_API_KEY environment variable
3. ~/.herenow/credentials file (recommended for agents)

To store a key, write it to the credentials file:

mkdir -p ~/.herenow && echo "{API_KEY}" > ~/.herenow/credentials && chmod 600 ~/.herenow/credentials

IMPORTANT: After receiving an API key, save it immediately. Run the command above yourself. Do not ask the user to run it manually. Avoid passing the key via CLI flags (e.g. --api-key) in interactive sessions; the credentials file is the preferred storage method.

Never commit credentials or local state files (~/.herenow/credentials, .herenow/state.json) to source control.

Getting an API key

To upgrade from anonymous (24h) to permanent sites:

1. Ask the user for their email address.
2. Request a one-time sign-in code:

curl -sS https://here.now/api/auth/agent/request-code \
  -H "content-type: application/json" \
  -d '{"email": "user@example.com"}'

3. Tell the user: "Check your inbox for a sign-in code from here.now and paste it here."
4. Verify the code and get the API key:

curl -sS https://here.now/api/auth/agent/verify-code \
  -H "content-type: application/json" \
  -d '{"email":"user@example.com","code":"ABCD-2345"}'

5. Save the returned apiKey yourself (do not ask the user to do this):

mkdir -p ~/.herenow && echo "{API_KEY}" > ~/.herenow/credentials && chmod 600 ~/.herenow/credentials

State file

After every site create or update, the script writes to .herenow/state.json in the working directory:

{
  "publishes": {
    "bright-canvas-a7k2": {
      "siteUrl": "https://bright-canvas-a7k2.here.now/",
      "claimToken": "abc123",
      "claimUrl": "https://here.now/claim?slug=bright-canvas-a7k2&token=abc123",
      "expiresAt": "2026-02-18T01:00:00.000Z"
    }
  }
}

Before creating or updating sites, you may check this file to find prior slugs. Treat .herenow/state.json as internal cache only. Never present this local file path as a URL, and never use it as source of truth for auth mode, expiry, or claim URL.

What to tell the user

For published sites:

• Always share the siteUrl from the current script run.
• Read and follow publish_result.* lines from script stderr to determine auth mode.
• When publish_result.auth_mode=authenticated: tell the user the site is permanent and saved to their account. No claim URL is needed.
• When publish_result.auth_mode=anonymous: tell the user the site expires in 24 hours. Share the claim URL (if publish_result.claim_url is non-empty and starts with https://) so they can keep it permanently. Warn that claim tokens are only returned once and cannot be recovered.
• Never tell the user to inspect .herenow/state.json for claim URLs or auth status.

For Drives:

• Do not describe Drive files as public URLs.
• Tell the user Drive contents are private unless shared with a scoped token.
• When sharing access with another agent, prefer a scoped token with a narrow pathPrefix and short TTL.

publish.sh options

Flag	Description
--slug {slug}	Update an existing site instead of creating
--claim-token {token}	Override claim token for anonymous updates
--title {text}	Viewer title (non-HTML sites)
--description {text}	Viewer description
--ttl {seconds}	Set expiry (authenticated only)
--client {name}	Agent name for attribution (e.g. hermes)
--base-url {url}	API base URL (default: https://here.now)
--allow-nonherenow-base-url	Allow sending auth to non-default --base-url
--api-key {key}	API key override (prefer credentials file)
--spa	Enable SPA routing (serve index.html for unknown paths)
--forkable	Allow others to fork this site

Beyond publish.sh

For Drive operations, use drive.sh or the Drive API. For broader account and site management (delete, metadata, passwords, payments, domains, handles, links, variables, proxy routes, forking, duplication, and more), see the current docs:

→ https://here.now/docs

Full docs: https://here.now/docs

When not to use it

The source does not list explicit alternatives or exclusions. However, the skill is designed for publishing static sites and storing private files. It is not a general-purpose web server, a database, or a compute platform. If the agent needs dynamic server-side logic, a database-backed application, or long-running processes, this is the wrong tool.

Limits and gotchas

• Anonymous sites expire in 24 hours. The claim token is returned only once and cannot be recovered.
• The credentials file and state file must never be committed to source control.
• The state file is internal cache only. Do not present its paths as URLs or use it as a source of truth for auth mode, expiry, or claim URL.
• If the docs fetch fails or times out, continue with the local skill and live API or script output. Prefer live API behavior for active operations.
• If docs and live API behavior disagree, trust the live API behavior.

What pairs with this

The source points to the full here.now documentation for account and site management operations beyond what the skill scripts cover. For Drives, the drive.sh script and the Drive API are the two paths. For agent-to-agent handoff, scoped Drive tokens are the recommended mechanism.