Hermes Agent v0.18.2 (v2026.7.7.2)

Release Date: July 7, 2026

Same-day patch on top of v0.18.1, picking up the WhatsApp Baileys dependency fix needed for tagged-release Docker builds.

What's in this patch

• fix(whatsapp): unpin Baileys from git commit, use published 7.0.0-rc13 (#60643) — the WhatsApp bridge dependency now installs from the published npm release instead of a pinned git commit, making installs and Docker image builds reliable.

Full curated release notes for the entire post-v0.18.0 window ship with v0.19.0.

Updating

• hermes update # existing installs
• pip install -U hermes-agent

Full Changelog: v2026.7.7...v2026.7.7.2

Original source

Hermes Agent v0.18.1 (v2026.7.7)

Release Date: July 7, 2026

Patch release. This tag rolls up the ~660 PRs merged since v0.18.0 (July 1) — bug fixes, hardening, and in-progress feature work — into a stable tagged release for downstream consumers (Docker images, hosted deployments, PyPI installs).

About this release

This is an infrastructure-driven patch tag rather than a fully curated release. Since v0.18.0 shipped six days ago, main has accumulated roughly 667 commits across ~990 files (+89.5k/−10.4k lines), including installer/updater self-healing on Windows, dashboard and gateway fixes, WhatsApp dashboard pairing, MCP and provider fixes, and a large volume of stability work.

Full curated release notes for this window will ship with v0.19.0, which will document everything from v0.18.0 onward — highlights, feature areas, and complete contributor credits. Nothing in this window is skipped; it's documented in the next minor release.

Updating

hermes update # existing installs
pip install -U hermes-agent

Full Changelog: v2026.7.1...v2026.7.7

Original source

Hermes Agent v0.18.0 (v2026.7.1)

Release Date: July 1, 2026

Since v0.17.0: ~1,720 commits · 998 merged PRs · 2,215 files changed · ~251,000 insertions · ~41,000 deletions · 949 issues closed · 370+ community contributors

The Judgment Release. Over the last week and a half the team put nearly all of its effort into one goal: resolve every P0 and P1 issue and PR in the entire Hermes Agent repo — and as of this release, 100% of them are closed. Zero open P0s. Zero open P1s. That's ~700 highest-priority items cleared as part of ~1,950 total issues and PRs closed this window. We intend to keep P0/P1 at zero from here on.

On top of that clean-sweep, v0.18.0 is about how well Hermes thinks and how it knows when its work is actually done. Mixture-of-Agents became a first-class citizen — named ensembles of models you can pick like any other model, with every reference model's reasoning shown to you and the aggregator's answer streamed live. The agent learned to verify its own work against evidence instead of vibes, /goal gained completion contracts, and /learn + /journey turned self-improvement into something you can see and steer. Underneath, the gateway became genuinely deployable-at-scale (scale-to-zero, drain coordination), the desktop grew first-class coding projects and a playable memory graph, and subagents can now fan out in the background.

🎯 The P0/P1 Clean Sweep — 100% resolved

This is the release headline. For a week and a half the team hammered the priority backlog day and night, and every single P0 and P1 across the whole repo is now closed:

Priority
Issues closed
PRs merged
P0 (critical)
3
8
P1 (high)
493
188
Total
496
196

That's ~692 highest-priority items resolved in twelve days — and at the moment the sweep completed, the open P0/P1 count hit 0 across the entire repo. The final cluster to fall was the interrupt-protected-compression sibling-fork bug (issue #56391) and its fix (#56416), closed on an all-nighter right before this release cut.

Special shoutout to @kshitijk4poor, who burned through the priority backlog day and night alongside the core team — the cron reliability wave, the compression-fork fix, the credential-exfil hardening, and a huge share of the P1 closures are his.

We're keeping P0/P1 at 0 from here forward. 🫡

✨ Highlights

Mixture-of-Agents is now a first-class model you can pick — MoA used to be a mode you toggled; now every named MoA preset shows up as a selectable model under a moa provider, right alongside Claude, GPT, and Grok in every model picker (CLI, TUI, desktop, gateway). Pick "my-council" the same way you'd pick any model, and Hermes routes your prompt through that ensemble automatically. An ensemble of frontier models deliberating on your hardest questions is now one selection away, on every surface. (#46081, #53548, #53561 — @teknium1)

See every model's reasoning, then watch the answer stream in — When a MoA ensemble runs, each reference model's full output now renders as its own labelled block — you can read what GPT-5 thought, what Claude thought, and what Grok thought, before the aggregator synthesizes them into one answer. And that final answer now streams to you live instead of appearing all at once after a long silence. This works in the CLI, the TUI, and the desktop app. You get to watch the committee deliberate, not just read the verdict. (#53793, #53855, #55625, #56101 — @teknium1)

The agent verifies its own work — "done" means proven, not claimed — Hermes now records verification evidence for coding work and can decide it's finished by actually running your project's checks, not by asserting success. /goal gained completion contracts: you state what "done" looks like, and the standing-goal loop judges completion against that evidence instead of stopping when the model feels like it. There's a pre_verify hook for wiring in custom checks and a one-time migration that tunes the defaults sensibly. The difference between "I think I fixed it" and "the tests pass, here's proof." (#50501, #52285, #55413, #53552 — @teknium1, @OutThisLife)

/learn — turn anything into a reusable skill by describing it — Run /learn <anything> and Hermes distills a reusable skill out of whatever you point it at — a directory, a URL, or just the workflow you walked it through five minutes ago. It writes the skill to the standards in your CONTRIBUTING.md automatically. The next time you need that workflow, it's already there. Teaching Hermes a new trick is now a single command, not a manual skill-authoring session. (#51506, #52372 — @teknium1)

/journey — a playable timeline of everything Hermes has learned about you — The CLI and TUI gained /journey, a learning timeline that shows the memories and skills Hermes has accumulated over time — and you can edit or delete any of them right from the view. Pair it with the desktop's new memory graph (a top-down, playable radial timeline of memories and skills) and for the first time you can actually see what your agent knows, watch it grow, and prune what's wrong. Your agent's memory stops being a black box. (#55555, #55859, #55226 — @OutThisLife)

Delegate a pile of work and keep going — background fan-out — delegate_task can now fan out multiple subagents that all run in the background: your chat is never blocked, and when every subagent finishes, their results come back as a single consolidated turn. Kick off "research these five competitors in parallel" or "audit these three modules," then carry on with something else while a small fleet works. When it's all done, you get one clean summary instead of babysitting each one. (#49734 — @teknium1)

First-class coding Projects in the desktop app — The desktop app gained real, per-profile Projects — a sidebar of your codebases, a coding rail, a review pane, git worktree management, and agent-facing project tools, all backed by a proper project → repo → lane model. Instead of scattered chat sessions, your coding work is organized into projects the agent understands and can act on. It's the desktop turning into an actual coding cockpit. (#49037, #54385, #54517 — @OutThisLife)

Run Hermes at scale — scale-to-zero and drain coordination — The gateway can now go dormant when idle and quiesce cleanly before a restart, migration, or auto-update — without dropping in-flight conversations. A hosted or relay-only Hermes can scale to zero when nobody's talking to it and wake back up on demand, and disruptive lifecycle actions coordinate an external drain so nobody gets cut off mid-turn. Running Hermes for a team or as a hosted service just got a lot more production-grade. (#52243, #52937, #54824 — @teknium1, @benbarclay)

Cheaper self-improvement — smarter background review — The post-turn self-improvement fork (the one that decides whether to save a memory or skill) now routes to an auxiliary model, digests context instead of replaying the whole conversation, and adapts its cadence — so the "learn from what just happened" loop that runs after your turns costs a fraction of what it used to. You keep the self-improvement, you stop paying full main-model price for it. (#49252 — @teknium1)

Compose your next prompt in your editor — /prompt — /prompt opens your $EDITOR so you can hand-write a long, multi-line prompt in real markdown instead of fighting a one-line input box. Draft a detailed spec, a structured question, or a big paste, save, and it's queued as your next message. Small thing, huge quality-of-life win for anyone who writes Hermes more than a sentence at a time. (#50509 — @teknium1)

Google Vertex AI — Gemini through your GCP service account, no static key — Vertex AI is now a first-class provider for Gemini models over Vertex's OpenAI-compatible endpoint. The reason a plain custom-provider setup always died mid-session is that Vertex has no static API key — every request needs a short-lived OAuth2 access token (~1h TTL) minted from a service-account JSON or Application Default Credentials. Hermes now mints and auto-refreshes those tokens for you, so if your org runs Gemini through Google Cloud, you point Hermes at your service account and it just works — no token-pasting, no mid-session expiry. (#56363 — @teknium1, @slawt)

Security round — This window hardened several surfaces: MCP-config persistence attack surface locked down, cron base_url overrides that could exfiltrate provider credentials blocked, a non-reusable sentinel for prefix secrets in file reads, Slack app-level (xapp-) token redaction, a browser cloud-metadata floor enforced on every backend, and an aiohttp CVE floor across the lazy messaging paths. Fewer ways for a prompt-injected or misconfigured session to leak a credential. (#50476, #56196, #54166, #56227, #52349, #56237 — @teknium1, @kshitijk4poor, @claudlos)

🧠 Mixture-of-Agents (MoA)

MoA graduated from a mode to a first-class part of the model system this window.

• Presets as selectable virtual models — each named MoA preset appears as a model under provider moa; pick it in any model picker and Hermes routes through the ensemble (#46081, #53561, #53775 — @teknium1)
• /moa is now one-shot sugar — runs a single prompt through the default preset and restores your model afterward; persistent switching goes through the model picker (#53548 — @teknium1)
• Reference-model output shown as labelled blocks in CLI, TUI, and desktop — read each model's reasoning before the aggregator's synthesis (#53793, #53855 — @teknium1)
• Aggregator response streams live instead of appearing whole after a silence (#55625 — @teknium1)
• References see full tool state and fire on every user/tool response; advisory references end on a user turn and get a reference-role system prompt (#54016, #54007 — @teknium1)
• Opt-in full-turn trace persistence to JSONL (moa.save_traces) for debugging and eval (#56101 — @teknium1)
• Reliability: reference + aggregator models called through their provider's real route; context window resolved from the aggregator (not the 256K default); auxiliary tasks resolve to the aggregator; virtual provider blocked as a reference/aggregator slot; tolerant of hand-edited preset config (#53580, #53780, #53827, #53281, #53275, #53556 — @teknium1)
• MoA slot provider-identity unified on the single call_llm chokepoint; HermesBench results documented (#55991, #53206 — @teknium1)

✅ Verification & Goals — the agent proves its work

• Completion contracts for /goal — state what "done" looks like; the standing-goal loop judges against evidence, not the model's say-so (#50501 — @teknium1)
• /goal wait <pid> — park the standing-goal loop on a background process instead of re-poking the agent (#50503 — @teknium1)
• Coding verification evidence ledger — profile-scoped record of canonical project checks detected by agent.coding_context; gateway exposes verification status (#52285, #52286 — @OutThisLife)
• pre_verify hook + coding guidance config; verification stop loop + ad-hoc verification scripts (#55413, #52296, #52297 — @OutThisLife)
• verify-on-stop defaults OFF with a one-time v32 migration; skips doc-only edits; surface-aware "auto" default restored; gated off for messaging surfaces (#53552, #54740, #55449, #52412 — @teknium1, @OutThisLife, @GodsBoy)

🎓 Self-Improvement (Learn / Journey)

• /learn <anything> — distill a reusable skill from a directory, URL, or a workflow you just walked through; honors CONTRIBUTING.md skill standards and mixed requirements (#51506, #52372, #55956 — @teknium1)
• /journey — CLI + TUI learning timeline of accumulated memories and skills, with in-place edit/delete (#55555, #55859 — @OutThisLife)
• Cheaper background review — aux-model routing + context digest + adaptive cadence for the post-turn self-improvement fork (#49252 — @teknium1)
• memory graph in the desktop — playable radial timeline of memories + skills over time (#55226 — @OutThisLife)

🖥️ Hermes Desktop App

Coding cockpit

• First-class Projects — per-profile sidebar, coding rail, review pane, agent project tools (project → repo → lane); remote-gateway-aware folder picker + git cockpit (status, review, worktrees) (#49037, #54385 — @OutThisLife)
• Multi-terminal panel with read-only agent terminals; persist & restore terminal tabs + scrollback across relaunch (#54517, #54585 — @OutThisLife)
• PR-style file diffs in chat; in-app spot editor for the file preview pane; inline rich embeds, diagrams & alerts in assistant markdown (#50731, #52772, #52935 — @OutThisLife)

UX & surfaces

• Conversation timeline rail for long threads; context-usage breakdown popover; read-only spectator transcript for subagent watch windows; pop the composer into a draggable floating window (#51094, #54907, #55033, #49488 — @OutThisLife, @austinpickett)
• Read replies aloud (auto-TTS) composer toggle; remember window size/position/maximized across launches; redesigned clarify prompt; shared overlay Panel primitive for cron/profiles/agents (#55154, #52086, #52993, #54558 — @OutThisLife)
• Backup import/create/download from the web UI; add context-usage popover; flag already-installed themes in install pickers; config-driven Electron launch flags + GPU policy (#54611, #55410, #53991 — @teknium1, @OutThisLife)
• Pets — roaming pet (opt-in), calmer/realistic roam, Alt+wheel scaling never cropped, frame-perfect hatch flow + CPU-safe chroma, pop-out overlay + notifications (#55114, #55400, #52877, #47959, #52303 — @OutThisLife)

Refactor wave (composer / god-file de-entangle)

• Decomposed the composer into isolated engine hooks; extracted branch/esc/url/placeholder/popout engines; split thread.tsx, sidebar/index.tsx, onboarding overlay, and use-prompt-actions god files into focused modules; shared WebSocket layer decoupling desktop from dashboard (hermes serve) (#55500, #55842, #55451, #55453, #55807, #55504, #54568 — @OutThisLife)
• perf: bound tool-result rendering so big /learn runs don't freeze; fast session switching under load (#52273, #52620 — @OutThisLife)

📊 Web Dashboard

• Auto-initiate portal SSO redirect on unauthenticated load; interactive auth setup on no-provider non-loopback bind; confidential-client (client_secret) support in self-hosted OIDC (#54846, #50551, #55344 — @teknium1, @benbarclay)
• Catalogue all memory-provider API keys in OPTIONAL_ENV_VARS; list & add arbitrary custom .env keys on the Keys page; expose cron job execution fields; backup import/create/download (#54546, #54552, #53551, #54611 — @benbarclay, @teknium1)
• Offload PTY spawn/close off the event loop; exclude non-interactive providers from interactive login surfaces (#53227, #53239 — @IAvecilla)

🏗️ Core Agent & Architecture

Delegation & subagents

• Background fan-out — parallel subagents run in the background, one consolidated return when all finish; calm "will resume" affordance for background delegate_task (#49734, #52756 — @teknium1, @OutThisLife)
• Track background subagents in the CLI + TUI status bar (#51441, #51485 — @teknium1)

Agent loop, tools & coding context

• One-shot LLM helper + llm.oneshot gateway RPC; expose coding-context project facts (project.facts RPC) (#51261, #51259 — @OutThisLife)
• web_extract truncate-and-store instead of LLM summarization; concurrent @-reference expansion (#54843, #55207 — @teknium1, @kshitijk4poor)
• Friendly human-phrased tool labels for built-in tools; /reasoning full (uncapped thinking); /timestamps + timestamps in /history; /prompt composes in $EDITOR (#55166, #50499, #50506, #50509 — @teknium1)
• Per-reasoning-model stale-timeout floor in stream + non-stream detectors; escalate SIGTERM→SIGKILL on host-pid termination after grace (#52845, #50489 — @teknium1)
• Multiple HERMES_WRITE_SAFE_ROOT dirs; opt-in HTTP/WS body capture to an isolated, share-excluded gui_bodies.log (#53292, #49044 — @kshitijk4poor)

Compression & sessions

• In-place compaction option (single session id); flip in_place default to True with a guard fix (#49739, #52658 — @teknium1)
• Backup includes projects.db and kanban boards in the pre-update snapshot (#52990 — @kshitijk4poor)

Providers & models

• Google Vertex AI first-class provider for Gemini over the OpenAI-compatible endpoint — auto-mints and refreshes short-lived OAuth2 tokens from a service-account JSON / ADC (no static key); salvages & modernizes #8427 by @slawt (#56363 — @teknium1, @slawt)
• Krea via managed Nous Subscription gateway; Z.AI endpoint picker (Global/China/Coding Plan); Ollama-cloud reasoning_effort wiring; remove google-gemini-cli + google-antigravity OAuth providers (#52647, #52364, #51494, #50492 — @teknium1, @kshitijk4poor)
• Honor NOUS_INFERENCE_BASE_URL env override for Nous OAuth; keep Nous auth fresh for idle dashboard/gateway agents (#52270, #50567 — @benbarclay, @teknium1)

🌐 Gateway, Fleet & Relay

Scale-to-zero & drain

• Scale-to-zero idle detection + dormant-quiesce (Phase 0); hardened dormancy guards; fixed arm-gate counting disabled placeholder platforms (#52243, #52359, #52831 — @teknium1, @benbarclay)
• External drain coordination (safe-shutdown Phase 2); suppress home-channel shutdown broadcast on flagged drains; persist in-flight transcript on restart/shutdown drain timeout; busy/idle readout for safe lifecycle actions (#52937, #54824, #50312, #50131 — @teknium1, @benbarclay, @kshitijk4poor)
• Default restart_drain_timeout to 0 to kill a systemd crash loop; self-heal a gateway stranded in draining/degraded (#54066, #55397 — @teknium1)

Relay (Phase 5 / 6)

• Wake primitive (gateway side); going-idle / buffered-flip primitive; passthrough_forward over WS; multi-platform-per-agent identity + per-frame egress; forward stable instance id at self-provision; declare relevance policy to the connector (#51595, #51572, #50702, #52830, #50772, #51248 — @benbarclay)
• Authorize relay-delivered events by delivery, not source.platform; adopt scope_id wire key; purge platform-specific scope terminology (#52306, #55289, #56016 — @benbarclay)

Gateway core & rendering

• Typed send-error classification (SendResult.error_kind); per-platform typing_indicator toggle; per-category context breakdown in /usage (#50342, #55394, #55204 — @teknium1)
• API server: configurable concurrent-run cap to prevent DoS; scope run approvals by run id (#50007, #56129 — @teknium1)

📱 Messaging Platforms

• Cron continuations — continuable cron jobs (thread-preferred continuation with DM-mirror fallback); flat in-channel continuable cron delivery for Slack; warn when gateway not running on cron create/list (#52250, #56254, #51696 — @teknium1)
• Telegram: configurable command menu + raised default cap so skills stay visible; gate rich draft previews separately; drain general send pool on pool timeout before retry (#51716, #52088, #54121 — @teknium1, @helix4u)
• Slack: opt-in Block Kit rendering for agent messages; --no-assistant flag for manifest generation (#56102, #51487 — @teknium1)
• Discord: render reasoning as -# subtext via display.reasoning_style (#51168 — @teknium1)
• Native WhatsApp media delivery via the Baileys bridge; Teams native send_video/send_voice/send_document; photon sidecar upgraded to spectrum-ts v8 with tapback correlation; Raft gateway setup wizard (#53598, #49308, #53451, #56230 — @teknium1)
• Signal: AAC voice-note remux + shared markdown formatting (#49530 — @kshitijk4poor)
• Migrate slack/dingtalk/whatsapp/matrix/feishu/telegram/wecom/email/sms adapters to bundled (#49408 — @teknium1)

🔧 Tool System, Skills & MCP

• Blank Slate setup mode — minimal agent, opt in to everything (#36733 — @teknium1)
• MCP: config persistence attack surface hardened; block base_url exfil; keepalive for short-TTL sessions (see Security) — plus catalog & UX carried from v0.17.0
• Skills: /learn distillation (see Self-Improvement); cloudflare-temporary-deploy optional skill; creative-ideation v2.1.0 method library (#50849, #42402 — @teknium1)
• Kanban: task lifecycle plugin hooks (claimed/completed/blocked); typed block reasons + unblock-loop breaker; handoff freshness stamping (#50349, #52848, #53973 — @teknium1)
• Plugins: ctx.profile_name for session-agnostic profile access (#50346 — @teknium1)
• LSP: PowerShellEditorServices language server; mem0 v3 API + OSS mode + update/delete tools (#55930, #15624 — @teknium1, @kartik-mem0)

⚡ Performance

• Cold start: lazy-load gateway platform adapters; parse config + plugin manifests with libyaml CSafeLoader (#54448, #54486 — @teknium1)
• State: merge FTS5 segments + handoff_state index to curb write-lock contention; single-pass list_profiles alias map + skill-count cache + event-loop offload (#54752, #54770 — @kshitijk4poor, @teknium1)

🔒 Security & Reliability

• Harden MCP-config persistence attack surface; block cron base_url overrides that exfiltrate provider credentials; non-reusable sentinel for prefix secrets in file reads (#50476, #56196, #54166 — @teknium1, @kshitijk4poor)
• Redact Slack App-Level (xapp-) tokens; browser cloud-metadata floor on all backends (CDP non-local); re-check private-network guard after browser_back navigation; scope /resume and /sessions to caller origin (IDOR); aiohttp 3.14.1 CVE floor across lazy messaging paths + pin-drift guard (#56227, #52349, #56526, #56378, #56237 — @teknium1, @claudlos, @kshitijk4poor)
• Cron reliability wave: fail closed when an unpinned job's provider drifts; run missed-grace jobs once instead of deferring forever; keep the ticker alive on BaseException + heartbeat-aware status; layer enabled MCP servers onto per-job toolsets; guard cron model-tool path + auto-resume loop breaker (#51051, #50062, #50016, #50117, #56240 — @kshitijk4poor, @teknium1)
• Windows: suppress console flashes + harden gateway restarts; prefer cmd npm shim on PATH fallback; respawn gateway windowless after GUI update; prefer managed node for whatsapp/desktop (#52340, #50398, #52239 — @helix4u, @teknium1)

🔁 Reverts (in-window, for the record)

• cron job storage returned to per-profile (reverts #32117 + #50993); don't clone auth.json (duplicating OAuth grant causes sibling revocation); windows terminal-popup PRs rolled back; prompt_caching.enabled toggle backed out for re-evaluation (#51116, #51732, #53853, #56126 — @teknium1)

👥 Contributors

381 people contributed to this release (via commits, co-author trailers, and salvaged PRs). Thank you, all of you.

Core

@teknium1 — release lead; MoA first-class, verification/goals, /learn, background review, security round, providers, the P0/P1 clean-sweep

@OutThisLife — desktop app (projects, memory graph, /journey, multi-terminal, composer refactor wave, pets, verification UX)

Top community contributors

@kshitijk4poor — the P0/P1 backlog burn: cron reliability wave, state perf, security (cron credential-exfil), gateway/signal, TUI config — a huge share of the priority closures

@benbarclay — relay Phase 5/6, scale-to-zero / drain coordination, dashboard auth/keys, gateway hardening

@ethernet8023 — CI/docker (unified jobs, faster builds, timings report)

@helix4u — Windows hardening (console flashes, npm shim, gateway restarts)

All contributors

@0xbyt4, @0xDevNinja, @0xsir0000, @1RB, @595650661, @aaronlab, @abchiaravalle, @adammatski1972, @AetherAgents,
@Afnath-max, @agt-user, @ahmadashfq, @AhmetArif0, @AIalliAI, @aieng-abdullah, @ailang323, @ailthrim, @aj-nt,
@alelpoan, @alloevil, @amathxbt, @ambition0802, @anderskev, @andressommerhoff, @angelos, @annguyenNous,
@Antimatter543, @arminanton, @arthurzhang, @asimons81, @austinpickett, @baolingao, @Bartok9, @basilalshukaili,
@BBCrypto-web, @bbopen, @Beandon13, @beardthelion, @benbarclay, @benbenlijie, @binhnt92, @bitcryptic-gw,
@Blaryxoff, @bogerman1, @bradhallett, @brett539, @briandevans, @buihongduc132, @bykim0119, @catapreta,
@chaithanyak42, @charleneleong-ai, @CharlieKerfoot, @chazmaniandinkle, @chrispersico, @Christopher-Schulze,
@chriswesley4, @claudlos, @clovericbot, @cmcejas, @codexGW, @Cossackx, @counterposition, @coygeek, @CRWuTJ,
@cyb0rgk1tty, @cyb3rwr3n, @cypctlinux, @cypres0099, @dalenguyen, @Danamove, @DanAsBjorn, @DataAdvisory,
@davidgut1982, @DavidMetcalfe, @davidvv, @de1tydev, @denisqq, @devorun, @devsart95, @DhivinX, @DiamondEyesFox,
@difujia, @Disaster-Terminator, @djimit, @djstunami, @dodo-reach, @donovan-yohan, @Dr1985, @DrZM007, @Dusk1e,
@egilewski, @ehz0ah, @Eji4h, @EloquentBrush0x, @Elshayib, @emozilla, @entropy-0x, @erosika, @EtherAura,
@etherman-os, @ethernet8023, @f-trycua, @fayenix, @fesalfayed, @firefly, @flamiinngo, @flobo3, @francescomucio,
@franksong2702, @friendshipisover, @fsaad1984, @fyzanshaik, @GauravPatil2515, @gdeyoung, @georgex8001,
@GodsBoy, @graphanov, @Gromykoss, @gustavosmendes, @Gutslabs, @H2KFORGIVEN, @haileymarshall, @hakanpak,
@happy5318, @haran2001, @harjothkhara, @heathley, @hehehe0803, @helix4u, @herbalizer404, @HexLab98,
@HiddenPuppy, @Hinotoi-agent, @HODLCLONE, @houko, @huangsen365, @huangxudong663-sys, @huangxun375-stack,
@HwangJohn, @iaji, @iamlukethedev, @IamSanchoPanza, @IAvecilla, @Icather, @iizotov, @indigokarasu,
@infinitycrew39, @ipriyaaanshu, @isair, @islam666, @itenev, @itsflownium, @izumi0uu, @Jaaneek, @JabberELF,
@jackjin1997, @jackroofan, @janrenz, @jasnoorgill, @jasonQin6, @jcjc81, @jearnest11, @jeeves-assistant,
@Jeffgithub0029, @jeffrobodie-glitch, @JezzaHehn, @jimmyjohansson84, @jmmaloney4, @jnibarger01, @JoaoMarcos44,
@jplew, @Junass1, @justemu, @justin-cyhuang, @JustinOhms, @jvradahellys24-art, @Kailigithub, @kaishi00,
@kangsoo-bit, @kartik-mem0, @keiravoss94, @kenyonxu, @kernel-t1, @Kewe63, @KeyArgo, @KiruyaMomochi, @kn8-codes,
@Kolektori, @konsisumer, @kshitijk4poor, @kyssta-exe, @Kyzcreig, @Lazymonter, @LehaoLin, @LeonSGP43, @lEWFkRAD,
@libre-7, @LIC99, @LifeJiggy, @linyubin, @liuhao1024, @lkevincc0, @lkz-de, @loes5050, @londo161, @lubosxyz,
@m24927605, @MaheshtheDev, @manus-use, @marco0158, @MarioYounger, @martinramos002-bot, @MattKotsenas,
@max-chen, @MaxFreedomPollard, @maxmilian, @maxpetrusenko, @memosr, @Mibayy, @Minksgo, @mintybasil, @mkslzk,
@mohamedorigami-jpg, @MorAlekss, @mrparker0980, @ms-alan, @namredips, @nankingjing, @natehale, @necoweb3,
@neo-2026, @Nickperillo, @nightq, @nikshepsvn, @nnnet, @nocturnum91, @nodejun, @NousResearch, @nycomar,
@OmarB97, @orbisai0security, @oreoluwa, @outsourc-e, @OutThisLife, @p-andhika, @panghuer023, @Paperclip,
@peetwan, @pefontana, @petrichor-op, @pinguarmy, @PINKIIILQWQ, @pmos69, @PolyphonyRequiem, @pprism13,
@PRATHAMESH75, @professorpalmer, @pyxl-dev, @Que0x, @qWaitCrypto, @r266-tech, @RafaelMiMi, @Railway9784,
@randomuser2026x, @rayjun, @rc-int, @rebel0789, @redactdeveloper, @riyas22, @rlaope, @rob-maron, @rodboev,
@rodrigoeqnit, @rratmansky, @rrevenanttt, @ruangraung, @Ruzzgar, @ryo-solo, @s010mn, @Sahil-SS9,
@SahilRakhaiya05, @SandroHub013, @Sanjays2402, @sasquatch9818, @ScotterMonk, @season179, @sgabel, @sgaofen,
@sgtworkman, @shandian64, @shannonsands, @shashwatgokhe, @shawchanshek, @sherman-yang, @SHL0MS, @SidUParis,
@SimoKiihamaki, @simpolism, @sjh9714, @skabartem, @skyc1e, @slawt, @soynchux, @spiky02plateau, @spjoes,
@sprmn24, @srojk34, @stepanov1975, @steveonjava, @Subway2023, @sweetcornna, @swissly, @Sworntech-dev,
@syahidfrd, @synapsesx, @szzhoujiarui-sketch, @talmax1124, @telos-oc, @testingbuddies24, @texhy, @tgmerritt,
@theAgenticBuilder, @thestral123, @tkwong, @Tortugasaur, @Tranquil-Flow, @trevorgordon981, @truenorth-lj,
@tt-a1i, @tuancookiez-hub, @TutkuEroglu, @tymrtn, @udatny, @UgwujaGeorge, @underthestars-zhy, @uperLu,
@uzunkuyruk, @valenteff, @valentt, @vanthinh6886, @Versun, @victor-kyriazakos, @virtuadex, @vKongv,
@w31rdm4ch1nZ, @weidzhou, @wgu9, @whoislikemiha, @wnuuee1, @woaini30050, @WuKongAI-CMU, @WuTianyi123, @WXBR,
@x7peeps, @x9x9x9x9x9x91, @Xowiek, @xxchan, @xxxigm, @xydigit-zt, @yapsrubricsz0, @yashiels, @yeyitech, @ygd58,
@YLChen-007, @yong2bba, @yoniebans, @ypwcharles, @yu-xin-c, @yungchentang, @yusekiotacode, @YuShu, @yyzquwu,
@zapabob, @zccyman, @zeapsu, @zmlgit, @znding04, @Zyxxx-xxxyZ

Also: Lucas Nicolas.

Full Changelog: v2026.6.19...v2026.7.1

Original source

Hermes Agent v0.17.0 (v2026.6.19)

Release Date: June 19, 2026

Since v0.16.0: ~1,475 commits · ~800 merged PRs · 1,693 files changed · 235,390 insertions · 50,730 deletions · 300+ issues closed · 245 community contributors

The Reach Release. v0.16.0 put Hermes on your desktop. v0.17.0 is about how far that reach extends — across new places to talk to it, deeper into the tools you already use, and out to the people running Hermes for a team. Hermes reached two new channels (iMessage via Photon, and the Raft agent network), the desktop app gained substantial new capability, subagents can now run in the background, image generation learned to edit, and Cursor's Composer model is reachable through an xAI Grok subscription. The dashboard got a full profile builder and secure login, the Skills Hub browser was rehauled, the memory tool got a major upgrade, and the curator stopped spending aux-model budget on every routine run. 300+ issues closed ride along, plus a security round.

✨ Highlights

Hermes reaches iMessage — Photon Spectrum, no Mac relay required — There's now an iMessage platform plugin built on Photon's managed line pool. Run hermes photon login, authenticate with a device code, and Hermes can send and receive iMessage — no Mac sitting in a closet running a relay, no BlueBubbles bridge to babysit. It's positioned as the successor to BlueBubbles: free to start, nothing to self-host. If your friends and family live in the blue bubbles, Hermes lives there now too. (#32348, #42582, #44713 — @teknium1)

Raft — Hermes joins the Raft agent network as a gateway channel — A new bundled Raft platform adapter lets Hermes connect to Raft as an external agent through a wake-channel bridge. Set RAFT_PROFILE, run the bridge, and Raft can wake Hermes to handle messages — with a privacy-by-contract design where wake payloads carry only metadata (event IDs, timestamps), never message bodies. Another surface where Hermes can show up and do work. (#48210 — @xxchan, @teknium1)

A substantially more capable desktop app — v0.16.0 shipped the desktop app; v0.17.0 deepened it across dozens of PRs. Rebindable keyboard shortcuts, native OS notifications with per-type toggles, live subagent watch-windows that stream a delegated agent's activity into its own pane, a composer model selector with per-model presets, automatic RTL/bidi text direction, a resizable VS Code-themed terminal pane, per-thread composer drafts, and the ability to install any VS Code Marketplace theme directly into the app. The desktop is now a serious daily driver, not a preview. (#45866, #40660, #47060, #46959, #43292, #44596 — @OutThisLife, @teknium1)

Background / async subagents — delegate work and keep going — delegate_task(background=true) now dispatches a subagent that runs in the background and returns a handle immediately. You and the model keep working while it churns, and the full result re-enters the conversation as a new turn the moment it finishes. Kick off a long research dive or a multi-step build, then carry on with something else instead of sitting blocked waiting on it. (#40946, #46968 — @teknium1)

Edit images, not just generate them — image-to-image in image_generate — image_generate can now edit and transform a source image, not only create one from scratch. Pass an existing image and a prompt and it routes to the backend's edit endpoint (same tool, same pattern as video_generate), across every supported image provider. "Make this logo blue," "remove the background," "turn this sketch into a render" — all from the tool you already use. (#48705 — @teknium1)

Automation Blueprints — schedule things without learning cron — Pick an automation by name and Hermes asks you for what it needs — no cron syntax, no slot=value typing. One blueprint definition renders natively on every surface: a form in the dashboard, a slash command in the CLI/TUI/messenger, a conversation with the agent, an entry in the docs catalog. "Daily news briefing at 8am" becomes a thing you set up by answering questions, not by memorizing 0 8 * * *. (#41309 — @teknium1)

Cursor's Composer model, through your xAI Grok subscription — grok-composer-2.5-fast is now in the xAI OAuth model picker, with its context window reconciled to the full 200k. Composer is the fast coding model behind Cursor — and if you have an xAI Grok subscription, you can now point Hermes at it directly over OAuth, no separate API key. Your Grok plan, Hermes's agent loop, Composer's coding speed. (#47908, #6f89e17 — @teknium1)

Full profile builder in the dashboard — Build a complete Hermes profile from the browser — pick its model, choose its skills, attach its MCP servers — without hand-editing config.yaml. The dashboard also unified multi-profile management into one machine-wide view with a global profile switcher, so you manage every profile from a single place. (#39084, #44007 — @teknium1)

Skills Hub browser rehaul — The dashboard's Skills Hub got a ground-up rework: connected hubs, a Featured section, full skill previews before you install, and a security scan on each skill. Browsing and installing skills from the trusted taps (OpenAI, Anthropic, HuggingFace, NVIDIA) is now a real browsing experience, not a flat list. (#40384, #43398 — @teknium1)

The memory tool got a major upgrade — atomic batch operations — The memory tool gained an operations array that applies a batch of add/replace/remove edits atomically against the final character budget. The model can free up space and add new entries in a single call — even when an add alone would overflow the budget — collapsing what used to be a fragile multi-turn dance into one reliable operation. Memory updates are now faster and far less likely to fail mid-edit. (#48507 — @teknium1)

Secure dashboard login — The dashboard's authentication was hardened: every token-required endpoint now correctly returns 401 behind the OAuth gate, websocket auth uses the served dashboard token, and a warning fires when a public_url override is silently rejected. Exposing your dashboard to the network is safer by default. (#42578, #42578 — @benbarclay, @teknium1)

Official WhatsApp Business Cloud API adapter — Alongside the existing Baileys bridge, Hermes now speaks the official WhatsApp Business Cloud API — Meta's first-party, hosted, no-bridge-process path. Point it at your Business API credentials and Hermes talks WhatsApp through the supported channel, with no QR-scanning bridge process to keep alive. (#44331, #43921 — @jquesnelle, @teknium1)

Rich text for Telegram — Bot API 10.1 rich messages — Telegram replies now render as proper rich messages via Bot API 10.1: better formatting, cleaner long-message handling, native markup instead of flattened text. It's on by default with an opt-out, so your Telegram conversations look the way they should without any configuration. (#44829, #45584, #45953 — @teknium1)

Curator cost optimization — no aux-model spend on routine runs — The skill curator now prunes stale skills by default but no longer runs its LLM-powered consolidation pass unless you opt in (curator.consolidate: true or hermes curator run --consolidate). The deterministic inactivity sweep keeps running for free; the opinionated, aux-model-spending "build umbrella skills" fork is now off by default. Routine background curation costs you zero tokens. (#47840 — @teknium1)

🖥️ Hermes Desktop App

New surfaces & UX

Rebindable keyboard shortcuts panel; native OS notifications with per-type toggles; curated turn-completion cue + dismissable error banners (#40660, #45866, #42480, #47985 — @OutThisLife, @teknium1)

Live subagent watch-windows — stream a delegated agent's activity into its own pane; composer status stack + editable prompts; open any chat in its own window; new-session-in-compact-window hotkey (#47060, #44630, #43219, #46951 — @OutThisLife, @teknium1)

Composer model selector + per-model presets + external-provider disconnect; surface every provider/model from hermes model in the GUI; unify provider list to one source; warn when a main-model switch leaves auxiliary tasks pinned elsewhere (#46959, #40563, #49080, #40286 — @teknium1, @OutThisLife)

Install any VS Code Marketplace theme; assignable themes per profile; window translucency slider; unified overlay design system + BrandMark + onboarding redesign (#43292, #42286, #45086, #40708 — @teknium1, @OutThisLife)

Resizable VS Code-themed terminal pane + palette polish; auto-detect RTL/bidi text direction in chat; Mac-style session switcher (^Tab / ^1-9); worktree-aware sidebar grouping; hover-reveal collapsed sidebars; messaging source folders in sidebar (#42521, #44596, #43111, #45273, #41670, #41751 — @OutThisLife)

Arrow-key history + queue editing in composer; expand full command inline from the approval bar; follow-streaming-at-bottom + jump-to-bottom button; first-class cron jobs in the sidebar + dashboard scheduler (#40234, #44864, #45263, #40684 — @OutThisLife, @teknium1)

Desktop pets — pop-out overlay + notifications (#47938 — @teknium1)

Full tool-backend config (pickers + per-backend settings) in Settings; run tool-backend post-setup installs from the GUI; uninstall the Chat GUI without removing the agent; Shift+click status-bar zap to toggle YOLO globally; /browser connect on a local gateway (#41232, #40559, #40355, #41666, #47245 — @teknium1, @OutThisLife)

Japanese + Traditional Chinese language switching (#40114)

"Restart gateway" action (renamed from "Restart messaging") surfaced in the statusbar + on messaging save/toggle toasts; rendered logs are selectable/copyable (#49094 — @OutThisLife)

Remote-gateway & multi-profile

Remote media relay — attach images/PDFs and display agent-written images over the network for the first time; remote-gateway file attachments via file.attach (#41336, #42634 — @teknium1)

Client + backend version buttons + remote-backend update flow; browse remote backend files; route global-remote profile REST calls; recover chat after sleep/wake by revalidating a stale remote backend (#42181, #44326, #47011, #41350 — @OutThisLife, @teknium1)

Multi-profile fallout cleanup — WS auth + cross-profile session reads; release profile backends before delete; scope session list/model switch/timer per session (#44529, #42613, #41103, #41120, #41182 — @OutThisLife, @teknium1)

Stream subagent activity into watch windows; keep streaming painting in unfocused secondary chat windows; recover stranded session windows (#47060, #47919, #47655 — @OutThisLife)

📊 Web Dashboard

Full-featured profile builder (model + skills + MCPs); unify multi-profile management — one machine dashboard + global profile switcher; profile-scoped skills & toolsets; session switcher panel on the Chat tab (#39084, #44007, #43808, #49077 — @teknium1)

Skills hub browser rehaul — connected hubs, featured, preview + security scan; SKILL.md editor on Skills page + attach-skill selector in cron modals; full per-MCP catalog detail; full tool-backend config in the GUI (#40384, #44231, #48520, #40418 — @teknium1)

Enable webhooks from the Webhooks page; idempotent hermes dashboard register; auto-restart gateway after Telegram QR onboarding; file browser; change UI font from the theme picker; reasoning-effort picker in the chat sidebar (#44021, #42455, #43424, #43512, #41145, #49141 — @teknium1)

🏗️ Core Agent & Architecture

God-file refactor wave (run_agent.py / cli.py / gateway/run.py)

cli.py main() 3297 → 954 lines — extracted 28 subcommand parsers into hermes_cli/subcommands/, then promoted 9 closure handlers; 32 slash-command handlers → CLICommandsMixin; 18 model-flow wizard functions → model_setup_flows; agent-construction cluster → CLIAgentSetupMixin (#41798, #41835, #41942, #42174, #42153 — @teknium1)

gateway/run.py 19157 → 15870 lines — 42 slash-command handlers → GatewaySlashCommandsMixin; authorization cluster → GatewayAuthorizationMixin; kanban watcher loops → GatewayKanbanWatchersMixin (#41886, #42159, #41849 — @teknium1)

run_agent.py turn loop — extracted prologue into TurnContext, post-loop tail into finalize_turn, consolidated inner-retry-loop recovery flags into TurnRetryState (#41778, #42169, #41828 — @teknium1)

Agent loop, prompt & tools

memory batch operations — atomic add/replace/remove array against the final char budget, so a single call can free space and add entries (#48507 — @teknium1)

search_files lossless densification — headroom evaluation report + the one densification improvement worth shipping (fewer tokens per result, same matches) (#47866 — @teknium1)

Removed the agent-callable send_message tool; coding-context posture across CLI/TUI/desktop/ACP; read_file extracts .ipynb/.docx/.xlsx to text (#47856, #43316, #37082 — @teknium1)

Context-file handling: configurable truncation limit + warnings; scale context-file cap to model window + point agent at the truncated file (#47251, #47846 — @teknium1)

Compression: temporal anchoring in compaction summaries; raise compaction trigger to 85% for gpt-5.5 on Codex OAuth (#41102, #40957 — @teknium1)

Adaptive middleware (consumed by NeMo-Relay observer telemetry); usable mid-turn steer — desktop affordance + trusted injection (#29724, #40240 — @teknium1)

Provider & model support

New models: z-ai/glm-5.2 (verified 1M context, OpenRouter + Nous), anthropic/claude-fable-5, laguna-m.1 + nemotron-3-ultra, xAI Composer 2.5 in the OAuth picker; default xAI to grok-build-0.1 (#47391, #45695, #42979, #42629, #47908, #47371 — @teknium1)

Model picker: Refresh-Models control to bust stale cache; persist Nous recommended-models to disk + fall back on Portal failure; seed catalog disk cache from checkout on update; MiniMax-M3 reports true 1M context (#48691, #42628, #42614, #43338 — @teknium1)

Anthropic adaptive models: default to modern thinking contract; never send reasoning field; route reasoning_effort to verbosity; require confirmation for very expensive selections (#42991, #43012, #43436, #43391 — @teknium1)

Auth: auto-detect OpenRouter credential from the pool; keep Codex OAuth pool accounts distinct on add/re-auth; resolve xAI OAuth across profiles + write rotated tokens back to root; honor model.default_headers for custom OpenAI-compatible providers (#42263, #42316, #46614, #41096 — @teknium1)

Bedrock falls back to non-streaming InvokeModel when IAM denies the streaming variant; Ollama default max_tokens=65536; surface model refusals as content_filter (#44293, #41694, #46013 — @teknium1)

Sessions, state & multi-agent

Optional max session cap; drop empty sessions on CLI exit and rotation; ACP session-provenance metadata for compression rotation (#42389, #43855, #41724 — @teknium1)

Delegation: resolve custom-endpoint subagent pools by endpoint identity; remove the default subagent wall-clock timeout; stop subagent completion lines leaking into parent CLI display (#41730, #45149, #44223 — @teknium1)

Kanban: config-gated auto-subscribe on kanban_create; machine-global singleton lock for the embedded dispatcher; pin assigned profile toolsets for workers; hold reclaim while worker still alive (#48635, #49068, #45590, #49064 — @teknium1)

Memory: configurable Hindsight retain observation scopes; OpenViking setup UX; Honcho gateway-gated identity tree; Supermemory session-level ingest (#46611, #48262, #44431, #38756 — @teknium1, @alt-glitch)

📱 Messaging Platforms (Gateway)

New channels

iMessage via Photon Spectrum — hermes photon login (device-code OAuth), gRPC-native channel (no webhook), markdown rendering, emoji reactions, outbound media via spectrum-ts (#32348, #42582, #44713, #42397 — @teknium1)

WhatsApp Business Cloud API adapter (official, no bridge process) (#44331, #43921 — @jquesnelle, @teknium1)

SimpleX — groups, native attachments, text batching, auto-accept; Raft bundled platform plugin with activity hooks (#42584, #48210 — @teknium1)

Gateway core & rendering

Render terminal tool calls as native bash code blocks on markdown platforms; bare fenced code blocks in chat; optional message timestamps for LLM context; configurable tool_progress_grouping (#41215, #42576, #47253, #47228 — @teknium1)

Telegram: Bot API 10.1 rich messages (now always-on with opt-out); opt-in Online/Offline bot status indicator; stop cutting long streamed responses; MarkdownV2 on progress edits; gate oversized voice/audio before download (#44829, #45584, #49134, #43761, #44245 — @teknium1)

Discord: propagate role_authorized so DISCORD_ALLOWED_ROLES works end-to-end; recover from runtime gateway task exits; cancel _bot_task on connect failure; stop typing after replies (#43327, #44383, #44432, #44836 — @teknium1)

Slack: scope top-level channel messages when reply_in_thread=false; thread approval UX (block-size overflow + typed-prefix); make video attachments available to agents; register_slack_action_handler plugin API (#41703, #43444, #45512, #44664 — @teknium1)

Replied-to media attachments included; document attachments classified as DOCUMENT on Signal/Email/SimpleX/Teams; WhatsApp restarts stale bridge processes; Matrix room-context isolation; QQbot CPU-spin fix; Weixin rate-limit circuit breaker (#46107, #44695, #44205, #18505, #40574, #41718 — @teknium1, @banditburai)

🖥️ CLI, TUI & Setup

/version slash command; /billing interactive terminal billing (TUI + CLI); show time since last final agent response on the status bar; persist resolved approval/clarify prompts in scrollback (#40214, #45449, #44265, #44702 — @teknium1)

Lock hermes worktrees so concurrent processes can't clobber them; display custom profile alias names in list/show; clone profiles from any source (#48699, #40371, #45630 — @teknium1)

Opt-in structured profile-build path on first contact; configurable per-platform system-prompt hints; configurable background memory/skill notifications (#41114, #48630, #47226 — @teknium1)

TUI: interactive Plugins Hub enable/disable overlay; session name in the terminal titlebar; paint approval/clarify/sudo/secret modals directly (not via throttle); wrap long approval commands instead of truncating (#42965, #43188, #41155, #44691 — @teknium1)

TTS: Gemini persona prompts + audio tags; xAI auto speech tags + speed/streaming knobs; Piper speaker_id; OGG for Telegram auto-TTS (#43442, #49061, #49062, #49060, #41644 — @teknium1)

🔧 Tool System, Skills & MCP

image-to-image / editing in image_generate across all backends; shrink images to provider dimension limit (#48705, #45979 — @teknium1)

MCP: official Unreal Engine 5.8 MCP server in the catalog; elicitation handler so MCP servers can prompt for mid-tool-call confirmation (payment/OAuth) on whichever surface owns the session — CLI/TUI/Telegram/Slack; expose late-connecting MCP tools to the agent between turns (cache-safe); keepalive ping for short-TTL HTTP sessions; block exfil-shaped / suspicious stdio configs before probe; capability-gate tools/list so prompt-only servers connect; preserve stdio argv passthrough + Windows env vars (#48397, #49203, #49208, #49221, #46083, #44550, #44324 — @teknium1, @lgalabru)

Skills: simplify-code skill (parallel 3-agent code review & cleanup) + risk-tiered application with Chesterton's Fence; find & diff user-modified bundled skills; optional payments skills (Stripe Link, MPP, Projects); CLI-based shop skill; live per-source browse progress (#41691, #49070, #48286, #31343, #47309, #43398 — @teknium1, @colinwren-stripe)

Curator: make skill consolidation opt-in (prune stays default-on) (#47840 — @teknium1)

Plugins: install from a subdirectory within a repo; accept browser-pasted GitHub URLs in hermes plugins install; session:compress lifecycle event + thread_id/chat_type in agent:start/end context (#42963, #33539, #47252, #41672 — @teknium1)

Memory/skill write approval gate (default off) — boolean write_approval replaces the tri-state write_mode (#38199, #43354 — @teknium1)

🌐 Fleet, Relay & Automation

Managed scope — administrator-pinned, user-immutable config & secrets from a root-owned /etc/hermes (#49098 — @teknium1)

Multiplex all profiles over one gateway process (opt-in) (#48273 — @benbarclay)

Pluggable CronScheduler + Chronos managed-cron provider (scale-to-zero) (#48275 — @benbarclay)

Automation Blueprints — parameterized automation templates across every surface (#41309 — @teknium1)

Gateway-Gateway relay (phases 0-3): relay adapter + capability descriptor, connector⇄gateway channel auth + signed-HTTP inbound + enroll CLI, WS-only inbound, managed-boot self-provision client (#48078, #48147, #48294, #48242 — @teknium1)

🐳 Docker, Nix & Installer

s6: detect supervisor directly for gateway restart; register profile gateways without auto-starting; persist desired state; clear stale log locks (#46290, #46266, #46292, #46289 — @teknium1)

Docker: optimize image size (.dockerignore, drop dev deps, split layers); pre-install matrix deps; supervised gateway uses --replace; harden hosted install tree against self-modification (#38749, #42413, #47555, #47490 — @teknium1)

Nix: cold npm build fixes + auto-fix-lockfiles workflow; hashless npm deps via importNpmLock; refresh npmDepsHash after Electron 40.10.2 pin (#41867, #48883, #48457 — @teknium1)

Installer: clear unmerged git index before autostash; scope install-method stamp to the code tree (#45515, #48188 — @teknium1)

🔒 Security & Reliability

Fail closed on own-policy gateway adapters; fail closed for approval-button auth on Slack/Feishu/Discord when no allowlist is set (#45634, #41226 — @teknium1)

Redact secrets in request debug dumps; withhold host metadata from public status; block exfil-shaped / suspicious MCP stdio configs before probe (#46637, #45642, #46083 — @teknium1)

Close shell-escape denylist bypass + fail-closed on missing approval module; scrub operator environment before launching cua-driver MCP; sanitize env for cron job-script subprocesses; bound TodoStore content length/count; scan REST cron prompts for parity with the agent tool (#40591, #48423, #49207, #41648, #41335 — @teknium1, @kshitijk4poor)

Bump urllib3 and PyJWT to clear CVEs; Langfuse redacts base64 data URIs instead of truncating into invalid base64 (#40179, #43322 — @teknium1)

🪟 Windows

Dashboard /chat tab via ConPTY (win_pty_bridge) + tests; resolve PowerShell host instead of bare powershell for uv install; resolve powershell.exe by absolute path so Desktop install doesn't stall (#42251, #48341, #40927 — @teknium1)

Repair stale winget registration + refresh/merge PATH; kill hermes before recreating venv to release _bcrypt.pyd lock; read HERMES_HOME from the registry when env is stale; quarantine running hermes.exe during update repair (#44084, #45120, #46772, #40409 — @teknium1)

JOB-breakaway watcher reliability + status --deep probes; handle Windows PTY stdin + detached WS frames; decode subprocess output as UTF-8; confirm-modal on native Windows (#40909, #41953, #44328, #42419 — @teknium1)

🐛 Notable Bug Fixes

Percent-encode non-ascii URL components; sanitize : in FTS5 queries so colon searches don't silently return empty (#41430, #40653 — @teknium1)

Preserve multimodal user content through crash-resilience persist; flatten multimodal content before provider sync; strip MEDIA directives from compressor input (#47907, #44738, #44708 — @teknium1)

Re-enter retry loop on genuine Nous 429 so the fallback guard runs; scope Nous tags to Nous auxiliary calls; suppress "Credit access paused" notice on free models (#45136, #45801, #43669 — @teknium1)

Cron: don't strict-scan script-injected output in no-skills jobs; resolve per-job provider "custom" to providers.custom instead of codex; repair cron ownership on container restart (#42323, #43505, #41976 — @teknium1)

(300+ issues closed this window; full per-area fix list is exhaustive — these are the highest-impact.)

↩️ Reverted in this window (not shipping)

html-artifact skill + sketch/architecture-diagram/concept-diagrams fold (#48899) — reverted (#49053); absent on main.

Cron per-job profile support reverted (#43956); a nix patchPhase workaround reverted (#42151).

👥 Contributors

A huge thank-you to everyone who contributed to this release — 245 contributors across commits, co-author trailers, and salvaged PRs.

Core

@teknium1

Top community contributors (by merged PRs)

@OutThisLife — 92 PRs (desktop app maturity (shortcuts, notifications, watch-windows, themes))

@kshitijk4poor — 60 PRs (onboarding, model picker, cron env sanitization)

@xxxigm — 27 PRs (desktop & gateway fixes)

@benbarclay — 23 PRs (gateway multiplex, Chronos cron, dashboard auth)

@helix4u — 21 PRs (gateway & installer reliability)

@austinpickett — 19 PRs (dashboard & desktop UX)

@alt-glitch — 14 PRs (usage-aware credits, Supermemory)

@ethernet8023 — 14 PRs (desktop build pipeline & Linux/Windows)

@liuhao1024 — 5 PRs (session lifecycle fixes)

All contributors (alphabetical)

@0z1-ghb, @0xdany, @0xneobyte, @0xyg3n, @1960697431, @895252509, @achaljhawar, @Adolanium, @AhmetArif0, @AIalliAI,
@aimable100, @AJ, @ak2k, @alarcritty, @AlchemistChaos, @aldoeliacim, @alelpoan, @AlexanderBFoley,
@alfred-smith-0, @ali-nld, @alt-glitch, @am423, @AMEOBIUS, @AMIK-coorporations, @annguyenNous, @ArcanePivot,
@ARegalado1, @asdlem, @ashishpatel26, @austinpickett, @banditburai, @barronlroth, @Bartok9, @basilalshukaili,
@bbednarski9, @bcsmith528, @benbarclay, @benegessarit, @benfrank241, @bionicbutterfly13, @BlackishGreen33,
@blut-agent, @bmoore210, @bpasquini, @briandevans, @BROCCOLO1D, @capt-marbles, @ccook1963, @Cdddo, @channkim,
@ChasLui, @chimpera, @chromalinx, @CiarasClaws, @claytonchew, @cnfi, @colinwren-stripe, @cresslank,
@cyb0rgk1tty, @dangelo352, @davidgut1982, @deaneeth, @definitelynotguru, @Diyoncrz18, @draix, @dschnurbusch,
@Dusk1e, @dusterbloom, @ehz0ah, @emozilla, @enesilhaydin, @erosika, @ethernet8023, @Evisolpxe, @firefly,
@flooryyyy, @flyinhigh, @foras910521-lab, @Frowtek, @ft-ioxcs, @fyzanshaik, @Ganesh0690, @gauravsaxena1997,
@giladbau, @glesperance, @GodsBoy, @goku94123, @H-Ali13381, @HaozheZhang6, @haran2001, @harshitAgr, @hbentel,
@helix4u, @HeLLGURD, @Hermes, @huangxun375-stack, @iamlukethedev, @ianculling, @IAvecilla, @iborazzi,
@infinitycrew39, @islam666, @ITheEqualizer, @itsflownium, @Jaaneek, @james47kjv, @jeeves-assistant,
@jeffrobodie-glitch, @JezzaHehn, @jiangkoumo, @jimjsong, @JimLiu, @JimStenstrom, @jmsunseri, @JoaoMarcos44,
@joel611, @JoelJJohnson, @joerj123, @johnjacobkenny, @jooray, @joshuadow, @jplew, @justinbao19, @Justlrnal4,
@Kailigithub, @kamonspecial, @kdunn926, @Kenmege, @Kewe63, @kmccammon, @konsisumer, @kristianvast,
@kshitijk4poor, @kyssta-exe, @l37525778-coder, @LaPhilosophie, @leo4226, @LeonSGP43, @liuhao1024, @Llugaes,
@loongfay, @LoongZhao, @lsaether, @m4dni5, @manishbyatroy, @MaxFreedomPollard, @maxmilian, @maxtrigify,
@mnajafian-nv, @mohamedorigami-jpg, @mollusk, @MrDiamondBallz, @mssteuer, @mvanhorn, @naqerl, @Nea74,
@necoweb3, @nepenth, @nicoloboschi, @NormallyGaussian, @OmarB97, @omegazheng, @OndrejDrapalik, @OutThisLife,
@oxngon, @OYLFLMH, @paperclip, @paulb26, @pengyuyanITYU, @PhilipAD, @pinguarmy, @plcunha, @ProgramCaiCai,
@psionic73, @qin-ctx, @qingshan89, @Que0x, @qWaitCrypto, @r266-tech, @randomsnowflake, @rbrtbn, @rewbs,
@rio-jeong, @Rivuza, @rob-maron, @rodboev, @ruangraung, @RyTsYdUp, @Sahil-SS9, @salesondemandio, @sanidhyasin,
@sarvesh1327, @sdyckjq-lab, @shannonsands, @SHL0MS, @simpolism, @sitkarev, @skyc1e, @skylarbpayne, @SNooZyy2,
@Spaceman-Spiffy, @srojk34, @sweetcornna, @synapsesx, @Tamaz-sujashvili, @tangtaizong666, @temalo, @tfournet,
@thedavidweng, @TheGardenGallery, @tim404x, @tomekpanek, @Tranquil-Flow, @tt-a1i, @tuancookiez-hub,
@underthestars-zhy, @Veritas-7, @victor-kyriazakos, @wesleysimplicio, @WolframRavenwolf, @WompaJango, @x1erra,
@xiaoxinova, @xtymac, @xushibo, @XVVH, @xxchan, @xxxigm, @xy200303, @y0shua1ee, @yanxue06, @yatesjalex,
@YLChen-007, @yoniebans, @youjunxiaji, @yubingz, @zakame, @zapabob, @zccyman, @zimigit2020, @ziwon, @zwcf5200,
@zxcasongs.

Full Changelog: v2026.6.5...v2026.6.19

Original source

Hermes Agent v0.16.0 (v2026.6.5)

Release Date: June 5, 2026

Since v0.15.2: 874 commits · 542 merged PRs · 1,962 files changed · 205,216 insertions · 46,217 deletions · 399 issues closed (2 P0, 62 P1, 16 security-tagged) · 170 community contributors (including co-authors)

The Surface Release. Hermes meets you wherever you work. A brand-new native desktop app — built across 100 PRs and 159 commits in a single week — gives you Hermes as a real macOS/Linux/Windows application: one-click install, in-app self-update, drag-and-drop files into chat, an inline model picker in the status bar, concurrent multi-profile sessions, a full Simplified Chinese translation, and the ability to connect to a remote Hermes gateway over OAuth or username/password. Alongside it, the web dashboard grew a full browser-based administration panel (MCP catalog, messaging channels, credentials, webhooks, memory, pluggable OIDC / username-password login), and first-time setup got a "Quick Setup via Nous Portal" path that gets you from install to first message in seconds. The default skill set was trimmed to what you actually need, NVIDIA/skills joined the trusted Skills Hub taps, the model picker is now fuzzy-searchable everywhere (desktop, web, TUI, CLI), and /undo finally lets you take back the last N turns. 2 P0 and 62 P1 closures ride along, plus a security round (CVE-2026-48710 Starlette pin, SSRF off-loop hardening, subprocess credential stripping).

✨ Highlights

Hermes Desktop — a real native app, not a terminal wrapper — This is the headline. There's now a apps/desktop/ Electron application that installs like any other desktop app on macOS, Linux, and Windows, updates itself in place from inside the app, and gives you a polished GUI for everything Hermes does. You get a proper chat window with streaming, a session list you can archive and search, drag-and-drop files anywhere in the chat area, clipboard image paste, a Cmd+K command palette, and a model picker right in the status bar. If you've been telling friends "it's a CLI agent" and watching their eyes glaze over — now you can just send them an installer. None of this existed a week ago. (#20059, #35607, #37099, #37379, #38631 — @OutThisLife, @jquesnelle, @ethernet8023, @austinpickett, @benbarclay)

Run the desktop app against a remote Hermes — sign in with OAuth or username/password — The desktop app doesn't have to run Hermes locally. Point it at a remote Hermes gateway (your homelab, a hosted box, a teammate's server) and it connects over a secure WebSocket, authenticating with OAuth or a username/password login — no fiddling with --insecure flags or hand-copied session tokens. Each profile can target its own remote host, and you can run concurrent sessions across multiple profiles in one window with cross-profile @session links. The practical version: your laptop runs a thin GUI, the heavy agent runs wherever your API keys and compute live. (#37888, #38851, #39330, #39778 — @benbarclay, @OutThisLife, @teknium1)

The web dashboard is now a full admin panel — configure everything from the browser — The dashboard grew from "view your sessions" into a complete administration surface. There's a Channels page that sets up every gateway messaging platform (Telegram, Discord, Slack, etc.) from the browser, an admin panel for the MCP catalog with enable/disable toggles, credential management, webhook and hook creation, memory configuration, gateway controls, and a System page with check-before-update and one-click Debug Share. You no longer have to SSH in and edit config.yaml to wire up a new messaging channel or MCP server — it's all point-and-click now. (#36704, #36736, #37211, #38205, #38600 — @teknium1)

Hermes Desktop speaks Simplified Chinese — full 简体中文 in the chat GUI — The desktop app now ships a complete Simplified Chinese (简体中文) translation across every UI surface — the chat window itself, sidebar, settings, command center, cron, messaging, profiles, skills, agents, the lot. English stays the default; switch language in Appearance settings and the choice persists to your config (display.language). It's built on a proper typed i18n layer, so adding more languages from here is straightforward. (#38241 — @JimLiu)

Leaner default skill set — Hermes ships only what you actually need — The bundled skill set got a deliberate trim. Skills that were redundant or dead are gone (spotify — superseded by the native Spotify plugin's 7 tools; linear — superseded by hermes mcp install linear; kanban-codex-lane, debugging-hermes-tui-commands, a stale domain orphan, and several empty category markers). Heavier or niche skills moved from bundled to optional (the Baoyu creative set, dspy, subagent-driven-development, minecraft-modpack-server, pokemon-player, hermes-s6-container-supervision) — still one hermes skills install away, just not loaded by default. And a new environments: relevance gate keeps context-specific skills (kanban, docker/s6) out of the skills index for users who'll never use them, while still loading them on explicit request. The result: a smaller, sharper default skill list, less noise in the picker, and a lighter prompt. The curator can now prune unused built-in skills too (not just agent-created ones), with usage tracked for every skill. (#39028, #36701, #36228 — @teknium1)

NVIDIA/skills is now a built-in trusted skills tap — NVIDIA/skills joins OpenAI, Anthropic, and HuggingFace as a default trusted tap in the Skills Hub — discoverable, browsable, searchable, and auto-updating through the same pipeline. NVIDIA's verified skills for CUDA-X, AIQ, cuOpt and the rest of their product stack are one install away, with real category labels from the repo's skills.sh.json sidecar. (#34333 — @teknium1)

Quick Setup via Nous Portal — from install to first message in seconds — First-time setup was thinned down to two clear paths: Quick Setup (sign in with Nous Portal, get a model picker, start chatting immediately) or Full Setup (the detailed wizard for power users). hermes portal is now the human-readable alias that runs the full quick-setup Nous flow. The first-run menu explains the difference inline so newcomers aren't guessing. The goal: a brand-new user shouldn't need to read docs to send their first message. (#35723, #36227, #38449, #38465 — @teknium1, @kshitijk4poor)

Fuzzy model picker, everywhere — type a few letters, find your model — The model picker now does fuzzy search across the desktop app, web dashboard, TUI, and CLI. Type "v4fl" and deepseek-v4-flash surfaces; multi-endpoint providers are grouped under one row instead of cluttering the list with duplicates, and each row carries a description so you know what you're picking. The catalog refreshes hourly instead of daily, so new models show up the same day they launch. New this window: deepseek-v4-flash, MiniMax-M3 with 1M context, qwen3.7-plus. (#36928, #35227, #35756, #35659, #36214 — @kshitijk4poor, @teknium1)

/undo [N] — take back the last N turns — Said the wrong thing, or sent the agent down a bad path? /undo backs up N user turns, prefills your last message so you can edit and resend, and soft-deletes the turns in between. It works in the CLI, the TUI, and across messaging platforms (Telegram, Discord, etc.) with full parity. Closes a long-standing request (#21910). (#36229, #36699 — @teknium1)

Choose your default interface — cli or tui — You can now set whether hermes chat drops you into the classic CLI or the Ink TUI by default, with a --cli flag to override per-invocation. The TUI also got a single unified /model command and a Sessions overlay for switching between live sessions. Use the interface you actually like. (#37782, #37112 — @OutThisLife)

🖥️ Hermes Desktop App (NEW)

Install & lifecycle

macOS desktop install + in-app self-update; rebuild-and-relaunch cleanly on macOS (#35607, #36198, #38296 — @OutThisLife)

macOS installer renamed to "Hermes" and turned into a launcher (#37516 — @OutThisLife)

Build desktop in its own desktop stage on macOS/Linux instead of silently skipping; content-hash build stamp, --build-only / --force-build flags (#36134 — @OutThisLife, #37597 — @ethernet8023)

Boot-failure recovery + live API-key validation; cancellable install; recover from corrupt cached Electron download (#35864, #37379, #39032 — @OutThisLife, @teknium1)

Windows: recover from corrupt Electron cache in bootstrap install; stop racing our own backend during in-app update (#39465, #39828 — @teknium1, @OutThisLife)

Linux: configure Electron sandbox helper; detect linux arm64 binary; disable GPU acceleration on remote displays to stop flicker (#37691, #38594, #37932 — @ethernet8023, @OutThisLife)

Require Node ≥20.19/22.12 for the desktop build; zero eslint/typecheck debt + prettier pass (#38255, #39100 — @OutThisLife)

Remote-gateway & multi-profile

Connect to OAuth-gated remote gateways; username/password login for remote gateways; per-profile remote gateway hosts (#37888, #38851, #39778 — @benbarclay, @teknium1, @OutThisLife)

Concurrent multi-profile sessions, cross-profile @session links; re-mint OAuth WS ticket on gateway reconnect; gate OAuth remote connect on AT-or-RT (#39330, #38886, #39464 — @OutThisLife, @teknium1, @benbarclay)

Offer remote sign-in on a gated-gateway boot failure; validate live WebSocket in remote gateway test (#39402, #39511 — @teknium1)

Chat UX & settings

Drop files anywhere in the chat area; clipboard image paste with dedupe; attachments on Enter, IME composition handling (#36262, #38306, #38677 — @OutThisLife, @teknium1)

Background needs-input indicator, clarify redesign, Cmd+K palette & UI consistency pass; inline model picker in the status bar; YOLO toggle in the status bar (TUI parity) (#38631, #37738, #38517 — @OutThisLife)

Session-list overhaul, session hygiene/archive, media streaming + connecting overlay; search sessions by id (SQL-bounded) (#37379, #37099, #39062 — @OutThisLife, @teknium1)

Dedicated Providers settings + polished Accounts/API-keys UX; consolidate skills + tools management into one pane; move model management into Settings (#38551, @austinpickett, #37310, #37330 — @jquesnelle)

Render approval/sudo/secret prompts so tools stop silently timing out; surface skill & quick-command slash commands in the palette; first-class xAI Grok OAuth provider in the launcher (#38578, #38531, #37697 — @teknium1, @OutThisLife)

"Choose provider later" skip on first-run onboarding; onboarding can configure a local/custom endpoint without an API key; custom zoom shortcuts (#39483, #38572, #37894 — @teknium1, @ethernet8023)

macOS helper microphone entitlement; scroll-jump fixes (native anchoring, at-rest jump, wheel-up snap-back); thinking block stays open mid-streaming (#37745 — @xxxigm, #37866, #38221, #38809 — @OutThisLife, @teknium1, @stremtec)

GUI quality-of-life triage batch; salvaged AhmetArif0 desktop/dashboard fixes; rename session via session.title RPC so /title works (#37536 — @austinpickett, #39070, #39410 — @teknium1, @benbarclay)

hermes debug share / /debug / hermes logs now include desktop.log (#38203 — @teknium1)

Simplified Chinese (简体中文) translation across every desktop UI surface — typed i18n layer, switch in Appearance settings, persisted via display.language (English remains default) (#38241 — @JimLiu)

Full multi-profile support over one global-remote dashboard; remote-profile sessions are first-class (resume, read, rename/archive/delete); new chats honor their profile in global-remote mode (#39921, #39894, #39993 — @OutThisLife)

📊 Web Dashboard

Administration panel (NEW)

Full administration panel — MCP catalog with enable/disable toggles, pairing, webhooks, credentials, memory, gateway, hook creation, system settings (#36704, #36736 — @teknium1)

Channels page — set up every gateway messaging channel from the browser (#37211 — @teknium1)

System page: check-before-update flow + Debug Share (#38205, #38600 — @teknium1)

nous-blue theme, bulk sessions, schedule picker; enriched profiles dashboard + de-dupe channel env vars; configurable terminal background via theme (#37383, #37872 — @austinpickett, #37156 — @teknium1)

Always enable embedded chat; remove dashboard --tui flag (#38591 — @benbarclay)

Auth

Pluggable username/password login (Option B); generic self-hosted OIDC provider + multi-provider verify fix; hermes dashboard register for self-hosted OAuth client (#38819 — @benbarclay, #38917, #38802 — @teknium1)

Rotate dashboard sessions via refresh token; share /api/* public allowlist between legacy and OAuth gates; drop /api/* paths from OAuth next= round trip (#37247, #34254, #36244 — @benbarclay)

Chat tab works in gated (OAuth) mode; trust non-web WS origins on OAuth-gated binds after ticket auth; authenticate server-spawned PTY child WS; sanction plugin WS/upload auth via SDK helpers (#34793, #37870, #37972, #38549 — @teknium1, @benbarclay, @kshitijk4poor)

Allow desktop websocket origins on remote binds (#37747 — @teknium1)

🏗️ Core Agent & Architecture

Provider & model support

New models: deepseek-v4-flash (+ trimmed variants, maker-grouped curated lists), MiniMax-M3 with 1M context on native minimax providers, qwen3.7-plus (Nous + OpenRouter), gemini-3.5-flash to Gemini OAuth + API-key pickers (#35659, #36214, #39409, #37046 — @teknium1)

Model picker: fuzzy search across WebUI/TUI/CLI; group multi-endpoint providers under one row; refresh provider descriptions + describe grouped rows; refresh catalog hourly; stop routing OpenAI selection to OpenRouter (#36928 — @kshitijk4poor, #35227, #35773, #35756, #37175)

Always show Nous Tool Gateway backends, login on select; surface the Nous free tool pool (entitlement + setup prompt); route FAL video gen through managed Nous gateway (#35792 — @teknium1, #36153, #33259 — @alt-glitch)

Persist mid-session model switch to database; recover model on post-interrupt recovery turn (#35256, #35381 — @teknium1)

Credential pool: STATUS_DEAD for terminal OAuth failures; isolate custom provider picker credentials (#34412, #34810 — @teknium1)

Disable Nous Portal legacy session-key inference fallback — JWT-only (#34508 — @kshitijk4poor)

Agent loop, prompt & tools

/undo [N] — backs up N user turns with prefill + soft-delete (CLI/TUI + messaging-platform parity) (#36229, #36699 — @teknium1)

Progressive tool disclosure for MCP and plugin tools (scoped); embedder environment-hint hook for the system prompt; universal task-completion guidance + local Python toolchain probe (#34493, #34574, #34340 — @teknium1)

Uncap delegation max_spawn_depth (floor 1, no ceiling); broaden Hermes self-knowledge pointer to docs + skill; hermes prompt-size diagnostic (#39772, #38538, #35276 — @teknium1)

perf(read_file): compact line-number gutter — ~14% fewer tokens per read (now the only format) (#35368, #35532 — @teknium1)

Resolve agent cwd from TERMINAL_CWD via one reader; align prefill messages key handling; resume relaunches in the session's original working directory (#35028 — @banditburai, #38760 — @helix4u, #38562 — @teknium1)

Prevent session-id fork from concurrent compressions; observer telemetry hooks + NeMo-Relay plugin (gated tool emit) (#34351, #38232 — @teknium1)

Sessions, state & memory

perf(state): merge FTS5 segments on VACUUM + hermes sessions optimize; keep /branch sessions visible after parent reopen; survive missing FTS5 runtimes (#34596, #39214 — @teknium1, @kshitijk4poor, #35452 — @helix4u)

Honcho: make startup fail open; harden self-hosted setup paths (#24847 — @stephenschoettler, #35170 — @kshitijk4poor)

Supermemory: session-level ingest + kebab aliases (#38756 — @alt-glitch)

🧩 Multi-Agent (Kanban) & Skills

Kanban

goal_mode cards run workers in a /goal loop; file attachments on tasks; attach images referenced in task bodies to worker vision (#35710, #35395, #34210 — @teknium1)

default_assignee fallback + per-profile concurrency cap; POST /runs/{run_id}/terminate endpoint; gate notifier watcher on dispatch_in_gateway (#34244, #34449, #37174 — @teknium1)

CLI dispatch config passthrough + humanizer skill swap (#34337 — @teknium1)

Skills

Leaner default skill set (#39028 — @teknium1):

• Removed (redundant / dead): spotify (→ Spotify plugin's 7 native tools), linear (→ hermes mcp install linear), kanban-codex-lane, debugging-hermes-tui-commands, stale domain orphan, empty category markers (diagramming, gifs, inference-sh, mlops/training, mlops/vector-databases)
• Bundled → optional: baoyu-article-illustrator, baoyu-comic, creative-ideation, pixel-art, dspy, subagent-driven-development, minecraft-modpack-server, pokemon-player, hermes-s6-container-supervision
• Consolidated: webhook-subscriptions + native-mcp folded into the hermes-agent skill as on-demand references; writing-plans merged into plan (v2.0.0)
• New environments: frontmatter relevance gate (kanban / docker / s6) — context-specific skills stop appearing in the index for users who won't use them, still load on explicit request
• Curator can now prune unused built-in skills (not just agent-created), with usage tracked for every skill (#36701 — @teknium1)

Blank-slate skills — install --no-skills + opt-out/opt-in for the default profile (#36228 — @teknium1)

NVIDIA/skills trusted tap — NVIDIA/skills is now a default trusted Skills Hub tap alongside OpenAI/Anthropic/HuggingFace; skills.sh.json sidecar gives taps real category labels (#34333 — @teknium1)

Skills Hub: fix browse cap, add source links + copy buttons + category cleanup (#37143 — @teknium1)

New optional skills: grok (xAI Grok Build CLI), antigravity-cli operator (under autonomous-ai-agents) (#34582, #34583, #34604 — @teknium1)

📱 Messaging Platforms (Gateway)

Structured stream-event protocol + Telegram draft formatting parity; per-platform streaming defaults (Telegram on, Discord off) + dashboard toggles; surface gateway streaming block in DEFAULT_CONFIG (#37250, #37303, #37285 — @teknium1)

Discord voice-channel mixer — ambient idle bed + verbal acks that overlap TTS; explain /voice usage when toggled bare (#39659, #39766 — @teknium1)

Handle Feishu meeting invitations; bluebubbles group mention gating; matrix bang-command aliases; matrix fail-closed approval reaction auth (#39040, #37091, #38175 — @teknium1, @alt-glitch, #34567)

Clean service restart flow; close ResponseStore + dispose unowned adapter on reconnect failure; weixin asyncio.wait_for timeouts (#36188 — @helix4u, #37679 — @Fearvox, #35117 — @banditburai)

🖥️ CLI, TUI & Setup

Configurable default interface (cli vs tui) + --cli flag; TUI single /model command + unified Sessions overlay; nudge toward /agents dashboard when delegation starts (#37782, #37112 — @OutThisLife, #34704 — @kshitijk4poor)

Thin out setup — Quick Setup via Nous Portal + Full Setup defaults; explain Quick vs Full inline; hermes portal human-readable Portal onboarding alias + full quick-setup Nous flow (#35723, #36227, #38449, #38465 — @teknium1, @kshitijk4poor)

Set process title to hermes in ps/top/htop; warn on unsupported pip installs + fix stale update-check cache (#35143, #34846 — @teknium1)

TUI perf: stop slow/dead MCP servers from freezing startup; stop eager MCP discovery from blocking agent-capable startup; stop persisting full tool output in trail lines (silent OOM) (#35273, #35397, #38224 — @teknium1)

TUI fixes: auto-recover session on unexpected gateway death; reassemble split SGR mouse sequences; preserve UTF-8 in PowerShell clipboard; reset terminal input modes on exit; /save snapshots under Hermes home (#35893, #38564 — @OutThisLife, #35222 — @teknium1, #36864 — @maxmilian, #38251 — @austinpickett)

Setup model/provider pickers migrated off simple_term_menu to curses (ESC + ghost-row fixes); default browser/TTS picker to free local backend, not paid Nous (#35806, #37800 — @teknium1)

🔧 Tool System & Installer

single managed-uv path, delete fts5 installer escalation; installer commit pinning opt-in (default branch-follow); shallow clones (#37660 — @ethernet8023, #37123 — @jquesnelle, #39423 — @ethernet8023)

ensure_uv() survives the update boundary (no first-run crash); harden venv rebuild + verify core deps after install; require managed marker before destructive clean; stash/restore by default for non-interactive updates (#39780 — @OutThisLife, #38887, #39568, #39645 — @teknium1, @helix4u)

MCP: stop reporting false OAuth success when no token was obtained; vision honors model.supports_vision in vision_analyze + browser_vision; MiniMax t2a_v2 TTS raise_for_status (#34807, #34562, #39057 — @teknium1)

yuanbao: cache resolved media resources by resourceId (#34474 — @teknium1)

🐳 Docker & Deployment

Container reuse + bounded-sync cleanup + orphan reaper; auto-join Docker socket group for docker-in-docker backend; boot non-root containers (skip s6-setuidgid drop when already unprivileged) (#33645, #34407 — @benbarclay, #34837 — @IAvecilla)

Skip unnecessary boot chown when volume ownership matches remapped UID; seed gateway_state.json from HERMES_GATEWAY_BOOTSTRAP_STATE on first boot; tag containers with hermes-agent labels for identification (#35027 — @Foldblade, #37896 — @benbarclay)

Point TUI launcher at prebuilt bundle via HERMES_TUI_DIR; consolidate node/nix workspace lockfile + update all consumers (#37923, #36171 — @benbarclay, @ethernet8023)

🔒 Security & Reliability

CVE-2026-48710 (Starlette BadHost) — pin patched Starlette ≥1.0.1 (#35118 — @teknium1)

Run URL SSRF checks off the event loop in async paths; strip Bedrock inference bearer token from subprocess env; add bws_cache.json to file-safety read guard; neutralize file paths in mutation-verifier footer (#39046, #34498, #34421, #35684 — @teknium1)

Restore approval/sudo context in execute_code + guard entry points; add docker restart/stop/kill to DANGEROUS_PATTERNS; sanitize invisible unicode in vetted skill content; deepcopy tools before in-place xAI mutation (#34497, #33438 — @teknium1, @Sarbai, #37245, #34416)

Sandbox-mirror soft guard for writes to per-task .hermes mirrors; honcho fail-open on startup (#32213 — @briandevans, #24847 — @stephenschoettler)

🐛 Notable Bug Fixes

399 issues closed this window (2 P0, 62 P1, 16 security-tagged, 262 bug-labeled).

Desktop: keep in-flight new chats from vanishing on refresh; Stop button actually interrupts when a turn is queued; stop background session messages bleeding into the active transcript; slash/@ completion menu navigable & Esc-dismissable; IME Enter no longer splits messages (#37908 — @OutThisLife, #37948, #37975, #37937 — @kshitijk4poor, #38333 — @stremtec)

Update: stop stash/restore from clobbering desktop source on managed clones; don't fail desktop rebuild/skills sync on mid-rebuild venv; export launcher virtualenv to uv (#38542, #38885, #35224 — @teknium1)

Voice: honor PIPEWIRE_REMOTE in PortAudio fallback; allow /voice over SSH when a sound server is reachable; restore mistralai (2.4.8 clean, ban lifted) (#33473 — @Dusk1e, #35719, #34841 — @teknium1)

📚 Documentation

New Desktop App guide + remote-backend sections (session token, --tui requirement, username/password connect, dashboard/gateway prerequisites) (#37457, #38144, #38180, #38534, #39128 — @teknium1)

Dashboard auth-provider suitability + registration across dashboard/Docker/Desktop; network egress isolation guide for Docker (#39633 — @benbarclay, #26385 — @Manzela)

👥 Contributors

A huge thank-you to the 170 community contributors (including co-authors) who shipped work in this release.

Core

@teknium1

Top community contributors (by merged-PR count)

@OutThisLife (52) — built the desktop app end to end: install, self-update, remote-gateway connect, multi-profile sessions, chat UX, status-bar model picker
@benbarclay (44) — Docker hardening, dashboard auth (OIDC, username/password, refresh-token rotation), desktop OAuth remote connect
@kshitijk4poor (29) — fuzzy model picker, setup/portal onboarding, desktop completion-menu & Stop-button fixes, honcho hardening
@ethernet8023 (18) — desktop build pipeline (content-hash stamp, build flags), Linux/arm64 desktop support, managed-uv consolidation
@austinpickett (8) — dashboard nous-blue theme + bulk sessions, desktop Providers settings, GUI QoL triage
@alt-glitch (7) — Nous tool-pool entitlement surfacing, FAL video-gen managed gateway, supermemory session ingest, matrix aliases
@helix4u (6) — gateway service-restart flow, update destructive-clean guard, config prefill alignment
@jquesnelle (4) — installer commit-pinning opt-in, desktop skills/tools + model-management consolidation
@JimLiu — full Simplified Chinese (简体中文) desktop translation + typed i18n layer

All Contributors

@0xharryriddle, @a1245582339, @adybag14-cyber, @AhmetArif0, @alaamohanad169-ship-it, @alelpoan, @alt-glitch,
@Aman113114-IITD, @amathxbt, @aminvakil, @annguyenNous, @aqilaziz, @Archerouyang, @ashishpatel26, @asimons81,
@austinpickett, @banditburai, @baofuen, @Bartok9, @bbednarski9, @beardthelion, @bedirhancode, @benbarclay,
@benfrank241, @blackpilledsoftware-prog, @bluefishs, @brian-doherty, @briancl2, @briandevans, @BROCCOLO1D,
@caojiguang, @CharZhou, @counterposition, @coygeek, @CryptoByz, @davetist, @davidgut1982, @dchenk, @dirtyren,
@donovan-yohan, @dparikh79, @dskwe, @Dusk1e, @dvir-pashut, @EloquentBrush0x, @emozilla, @ErnestHysa, @erosika,
@ethernet8023, @f3rs3n, @faisfamilytravel, @Fearvox, @ferminquant, @fesalfayed, @firefly, @flooryyyy,
@Foldblade, @Frowtek, @gbarany, @Glucksberg, @GodsBoy, @haran2001, @harjothkhara, @HashClawAI, @hayka-pacha,
@helix4u, @HeLLGURD, @Hinotoi-agent, @hllqkb, @IAvecilla, @inchargeautomation-lab, @Interstellar-code, @isair,
@ITheEqualizer, @jeffrobodie-glitch, @JezzaHehn, @JimLiu, @Julientalbot, @julio-cloudvisor, @karmeleon,
@Kenmege, @Kewe63, @Kolektori, @konsisumer, @kshitijk4poor, @kurobaryo, @kweiner, @kyssta-exe, @Kyzcreig,
@LengR, @leonardsellem, @LeonSGP43, @libre-7, @liuboacean, @liuhao1024, @LoongZhao, @luyao618, @MaheshtheDev,
@Manzela, @mathijsvandenhurk, @MattMaximo, @maxcz79, @maxmilian, @Moikapy, @MustafaKara7, @nateGeorge,
@nepenth, @nielskaspers, @ninjmnky, @octavioturra, @OCWC22, @ohMyJason, @ousiaresearch, @outsourc-e,
@OutThisLife, @Pluviobyte, @polnikale, @pxdsgnco, @Que0x, @r266-tech, @redpiggy-cyber, @rewbs, @rexdotsh,
@rob-maron, @SaguaroDev, @sahibzada-allahyar, @Sarbai, @sarvesh1327, @scubamount, @SeaXen, @seppegadeyne,
@shannonsands, @SHL0MS, @SimoKiihamaki, @SiTaggart, @solaitken, @sprmn24, @stephenschoettler, @steveonjava,
@stremtec, @Subway2023, @sweetcornna, @Sylw3ster, @ThyFriendlyFox, @tillfalko, @tmchow, @TonyPepeBear,
@Tranquil-Flow, @truenorth-lj, @tuancookiez-hub, @Twanislas, @tymrtn, @uzunkuyruk, @ViewWay, @VinciZhu,
@vinoth12940, @vladkvlchk, @vynxevainglory-ai, @WadydX, @wenchengxucool, @whyhkzk, @worlldz, @wysie, @x1am1,
@xxxigm, @ygd58, @youngstar-eth, @zapabob, @zhaoleibd, @Zyrixtrex

Full Changelog: v2026.5.29.2...v2026.6.5

Original source

Hermes Agent v0.15.1 (v2026.5.29)

Release Date: May 29, 2026

Since v0.15.0: 28 commits · 21 merged PRs · hotfix release · 9 contributors

The Patch Release. A same-day hotfix for v0.15.0. Headline fix: the dashboard infinite-reload loop that hit anyone running v0.15.0 in loopback mode (Docker, hosted Hermes, fresh installs). A handful of other v0.15.0 follow-ups go along for the ride — kanban worker SIGTERM, /model picker unification, /yolo session bypass, the full 19,932-entry skills.sh catalog, .md media delivery restoration, gateway probe-stepdown safety, web-URL redaction passthrough, kanban worker vision on referenced images, hindsight observation-default. Docker users get an explicit --insecure opt-in env var (no more bind-host inference), MCP server bare-command PATH resolution, and arm64 PR-build cache fixes.

✨ Highlights

• Dashboard 401 reload loop fixed — In loopback mode the dashboard's identity probe (/api/auth/me) returns 401 by design, but v0.15.0's stale-token reload guard treated every 401 as a rotated session token and full-page-reloaded to pick up a fresh one. Every successful sibling call cleared the one-shot reload guard, so the page reload-looped forever (Firefox: "Navigated to /sessions" storm; Chrome: React re-render storm). Fix adds an allowUnauthorized opt-out to fetchJSON that skips only the loopback stale-token reload — 401 still throws so AuthWidget swallows it, gated-mode login_url redirects are unaffected. Closes #34206, #34202. (#30698 — @austinpickett)
• Docker dashboard --insecure is now an explicit env opt-in, never derived from bind host — Previously the Docker entrypoint inferred --insecure when the dashboard bound to a non-loopback host. That conflated "I want LAN access" with "I want to disable the same-origin guard." The fix splits them: bind host is bind host, and disabling the dashboard's loopback auth requires an explicit HERMES_DASHBOARD_INSECURE=1. Existing setups that genuinely wanted insecure binding must now set the env var. (#34188, #34204 — @benbarclay)
• MCP bare command resolution under Docker — MCP servers configured with bare commands (npx, npm, node) now resolve against /usr/local/bin so they actually launch inside the Docker image where those binaries live. v0.15.0 left these failing silently in containers when the agent's effective PATH didn't include the Node toolchain location. (#34186 — @benbarclay)
• Skills page sidebar / source pills restored — A stale useMemo dependency in the new dashboard skills page collapsed the source pills and category sidebar to "All" only. Fixed; both surfaces now reflect the live catalog state. (#34194)
• Kanban worker can be killed again — SIGTERM on a kanban worker was being absorbed by an intermediate process and the worker stayed running. Closes #28181. (#34045)
• Full skills.sh catalog (858 → 19,932 entries) — The skills hub page was pulling a partial paginated catalog. The fetch now walks the sitemap, so all 19,932 skills.sh entries surface in the picker instead of just the first 858. (#34025)

🐛 Bug Fixes

Dashboard / Web

• /api/auth/me 401 no longer triggers reload loop in loopback mode — (#30698 — @austinpickett)
• Skills page source pills + category sidebar restored — stale useMemo dep (#34194)

Docker

• --insecure is now explicit opt-in via env var, not derived from bind host (#34188 — @benbarclay)
• Dashboard test suite repaired to match the insecure-opt-in fix (#34204 — @benbarclay)
• arm64 PR builds skip the GHA cache to avoid cache-thrash on cross-arch builders (#33704 — @BROCCOLO1D)

MCP

• Bare npx/npm/node resolve against /usr/local/bin for Docker compatibility (#34186 — @benbarclay)

Kanban

• Worker SIGTERM actually terminates the process (#34045)
• Workers receive images referenced in task bodies for vision-capable models (#34210)

Gateway

• .md files deliver again — media-delivery validation defaults to denylist-only instead of an overly-narrow allowlist (#34022)
• Probe stepdown safety — on a context-overflow without an explicit provider context limit, the agent no longer steps down to a smaller model based on an unknown ceiling (salvage of #33673) (#33826)

CLI

• /yolo mid-session enables the per-session bypass instead of just toggling the env var (which the running agent had already snapshotted) (#33931 — @kshitijk4poor)
• /model and hermes model show the same list, plus disk cache for picker startup (#33867)

Skills

• Full skills.sh catalog via sitemap — 858 → 19,932 entries (#34025)

Redaction

• Web URLs pass through unchanged — the redactor was eating query parameters that looked credential-shaped (#34029)

✨ Small Features

• Hindsight default narrowed to observation-only for recall_types — tool path is also narrowed (#34079 — @nicoloboschi, follow-up #34091 — @kshitijk4poor)
• Memory providers receive completed-turn message context — salvage of #28065 (#34097 — @kshitijk4poor, credit to @devwdave)

📚 Documentation

• --no-supervise / HERMES_GATEWAY_NO_SUPERVISE documented in the reference docs (follow-up to #33583) (#33751 — @r266-tech)

🛠️ Infrastructure

• Vercel deploy workflow accepts workflow_dispatch so docs deploys can be manually triggered (#34081)
• @nous-research/ui bumped to 0.18.2 (Nix npmDepsHash also updated to match) (#34193 follow-ups — @austinpickett)

👥 Contributors

Core

• @teknium1

Community

• @austinpickett — dashboard 401 reload-loop fix (the headline), @nous-research/ui bump, Nix npmDepsHash updates
• @benbarclay — Docker --insecure opt-in, MCP bare-command resolution, dashboard test repair
• @kshitijk4poor — /yolo session bypass, completed-turn memory context salvage, hindsight follow-up docs
• @nicoloboschi — hindsight recall_types observation default
• @BROCCOLO1D — arm64 PR build cache fix
• @r266-tech — --no-supervise reference docs
• @yangguangjin — probe stepdown safety (salvage of @yanghd's #33673)
• @devwdave — completed-turn memory context (credited via salvage)
• @andrewhosf — co-author

Issue Reporters (the 401 loop)

• @routesmith (#34206)
• @beeaton (#34202)

Full Changelog: v2026.5.28...v2026.5.29

Original source

Move provider adapters (anthropic, bedrock, azure), platform adapters
(telegram, slack, discord, feishu, dingtalk, matrix), and terminal backends
(modal, daytona) out of core into plugins/ workspace members. Core references
them via the plugin registries (get_provider_namespace / get_provider_service /
get_tool_provider / get_credential_pool_hook) instead of direct imports.

Provider/platform/terminal adapters relocated under plugins/; pyproject
extras reference workspace members; nix variants aggregate per-platform extras.

Anthropic credential discovery + OAuth-masquerade guard live in the plugin's
credential_pool_hook; browser-open guarded by _can_open_graphical_browser.

Vercel AI Gateway + Vercel Sandbox removed (upstream deletion); get_bedrock_model_ids
removed (replaced by bedrock_model_ids_or_none + discover_bedrock_models).

Terminal backends resolve ModalEnvironment / DaytonaEnvironment lazily from
the plugin registry.

uv.lock regenerated against the pluginified workspace.

Plugin test suites updated for the relocation: imports point at
hermes_agent_.adapter, caplog logger-name filters and monkeypatch targets
use the new module paths, and credential/rollback tests patch
registries.get_provider_service rather than the removed agent.*_adapter modules.

Verified: zero dead imports of relocated modules in core (import smoke test +
rename-map grep); nix develop succeeds; targeted plugin suites green
(bedrock, anthropic-auxiliary, matrix, dingtalk, feishu, credential_pool,
switch_model_rollback). Remaining full-suite failures are pre-existing on the
pre-merge tree (telegram setUpModule code) or environmental (voice/media/
PTY/network-dependent), not introduced here.

Original source

STRUCTURAL DECISIONS

ai-gateway + vercel_sandbox: honored main's PR #33067 deletion. Dropped our orphaned plugins/terminals/vercel/ dir and all 3 stale vercel refs that survived in pyproject (workspace member, [all] entry, uv source).

tools/lazy_deps.py: kept main's version. Our branch deleted it incompletely (WIP) while main has 30 live callers + active maintenance. main's intent won.

agent/agent_runtime_helpers.py: COMBINED — main's atomic swap+rollback snapshot envelope wraps our pluginified registries-based anthropic imports.

agent/credential_pool.py: took our plugin-hook indirection AND ported main's api_key_path_explicit OAuth-masquerade security fix INTO the anthropic credential_pool_hook (it was pluginified from a pre-fix base and would have been silently dropped otherwise).

hermes_cli/model_switch.py, hermes_cli/models.py: took main's logic (cached_provider_model_ids, AI-gateway removal) then re-applied our pluginify import rewrites (agent.bedrock_adapter/anthropic_adapter -> registries namespace lookups) since those modules moved to plugins.

tools/terminal_tool.py: took main's version (vercel_sandbox deletion) then restored our lazy registry resolution for modal + daytona environments (both moved to plugins; main's direct imports would crash at runtime).

nix/checks.nix: kept both — our hermetic-boundary checks + main's messaging-variant discord.py guard.

pyproject.toml: plugin extras as workspace members (ours) + main's new wecom extra; vercel removed throughout.

uv.lock: regenerated with uv lock (not hand-merged); 233 packages.

VERIFICATION

Zero conflict markers anywhere.

Exhaustive 17-moved-module grep: no dead imports of relocated modules in core.

Import smoke test: all hot core modules import clean.

Targeted tests (21 files incl. credential_pool, anthropic plugin, run_agent, project_metadata): pass.

3 credential_pool security tests rewired to register the real plugin hook (core tests don't trigger plugin discovery): pass.

Full suite: remaining failures are pre-existing on premerge-oh-god (telegram collection error: setUpModule MagicMock code) or environmental (matrix DNS/e2ee-deps, network) — NOT introduced by this merge. See PR notes.

Original source

Hermes Agent v0.15.0 (v2026.5.28)
Release Date: May 28, 2026
Since v0.14.0: 1,302 commits · 747 merged PRs · 1,746 files changed · 282,712 insertions · 36,699 deletions · 560+ issues closed (15 P0, 65 P1, 19 security-tagged) · 321 community contributors (including co-authors)
The Velocity Release. Hermes gets dramatically faster — to start, to run, to ship work, and to grow. The 16,083-line run_agent.py collapses to 3,821 (-76%) across 14 cohesive agent/* modules. Kanban grew into a real multi-agent platform across 104 PRs — orchestrator auto-decomposition, swarm topology, scheduled tasks, worktree-per-task, per-task model overrides. The cold-start perf wave keeps going: another second shaved off launch, 47% fewer per-conversation function calls, hermes --version flipping the head-to-head benchmark against Codex CLI. session_search is 4,500× faster and free now. Promptware defense lands against Brainworm-class attacks. Bitwarden Secrets Manager replaces N per-provider API keys with one bootstrap token. Skill bundles let one slash command load a whole workflow. The Ink TUI gets a multi-session orchestrator. Two new image_gen providers (Krea 2 Medium + Large, FAL ported to plugin), the Nous-approved MCP catalog with an interactive picker, an OpenHands orchestration skill, ntfy as the 23rd messaging platform, and a deep xAI integration round (Web Search plugin, xai-oauth hermes proxy upstream, retired-May-15 model detection + hermes migrate xai, natural TTS speech-tag pauses, base_url leak guard, OpenAI-style execution guidance for Grok). 15 P0 + 65 P1 closures alongside.
✨ Highlights
The Big Refactor — run_agent.py is no longer 16,000 lines — The file at the heart of Hermes — the agent conversation loop — has been reduced from 16,083 lines to 3,821 (-76%), with the extracted code redistributed across 14 cohesive modules under agent/. Behavior is unchanged: every extraction keeps a thin forwarder on AIAgent, every test patch path still works, every external caller is compatible. The reason you care: future Hermes development moves faster, plugin authors can finally grep the codebase, and the file that took 90 seconds to load in your editor opens in a blink. (#27248)
Kanban grew into a real multi-agent platform — 104 PRs end to end — Triage auto-decomposes one task into a tree of sub-tasks. hermes kanban swarm creates a full Swarm v1 graph in one command — root, parallel workers, gated verifier, gated synthesizer, shared blackboard. Tasks support per-task model overrides (cheap models for boilerplate, expensive ones for hard sub-tasks), board-level default workdirs, per-task worktree paths and branches, scheduled start times, configurable claim TTL, retry fingerprinting, stale-task detection, respawn guards, and a drag-to-delete trash zone. Workers report through /workers/active, /runs/{id}, and /inspect endpoints. (#27572, #28443, #28364, #28394, #28462, #28384, #28467, #28455, #28452, #28432, #28468, #28420)
Cold-start perf wave keeps going — another second saved, 47% fewer per-turn function calls — Three new optimization rounds: defer openai._base_client import (-240ms / -17MB on every CLI invocation), hot-path optimizations cut 47% of per-conversation function calls (399k → 213k for 31-turn chat), defer compression-feasibility check (-170 to -290ms on every agent construction), adaptive subprocess polling (-195ms per tool call, 1+ second per turn). Termux cold start drops from 2.9s to 0.8s. hermes --version cold drops 63% (701ms → 258ms), flipping the head-to-head benchmark against Codex CLI from 5/11 wins to 6/11. (#28864, #28866, #28957, #29006, #29419, #30121, #30609, #31968)
session_search rebuilt — no LLM, no cost, 4,500× faster — The old session_search was an aux-LLM-powered tool that cost ~$0.30/call and took ~30 seconds to summarize three sessions, sometimes confabulating when the right session wasn't even in the FTS5 hit list. The new shape is one tool with three modes (discovery, scroll, browse) inferred from which args are set — no mode parameter, no aux-LLM, no config knob, no companion skill. Discovery is ~20ms instead of ~90s; scroll is ~1ms. Searching your past sessions for context is now free and instant. (#27590)
Promptware defense — Brainworm-class attacks blocked at three chokepoints — Inspired by recent Brainworm / Promptware Kill Chain research (Origin HQ, arxiv 2601.09625), Hermes now defends the context window against prompt-injection attacks that try to hijack the agent via tool output, recalled memory, or stored skills. Single source of truth (tools/threat_patterns.py) with ~15 new Brainworm/C2 patterns; recalled memory is scanned at load time; tool results get delimiter markers so a malicious file or remote service can't impersonate Hermes' own system content. Paired with a new security-guidance plugin that pattern-matches dangerous code writes. (#32269, #33131, #9151)
Bitwarden Secrets Manager — one bootstrap token replaces every per-provider API key — Stop keeping plaintext API keys in ~/.hermes/.env. Install Bitwarden Secrets Manager (bws auto-installs lazily on first use), point Hermes at it with one bootstrap token (BWS_ACCESS_TOKEN), and every credential you need comes from Bitwarden at startup. Rotate a key in the Bitwarden web app and the rotation actually takes effect — Bitwarden defaults to source-of-truth so its values overwrite matching env vars on startup. Flip secrets.bitwarden.override_existing: false to invert. EU Cloud and self-hosted Bitwarden server URLs supported. Detected credentials are now labeled with their source so you can see at a glance which keys came from Bitwarden vs. the local env. (#30035, #31378, #30364)
ntfy as the 23rd messaging platform — push notifications without an account — ntfy is the self-hostable push-notification service with no signup, no API key, just a topic URL. Hermes now adapts to it as a platform plugin (zero edits to core), so your agent can send you push notifications from any cron job, kanban task completion, or chat send_message — to your phone, your watch, your desktop, your homelab. (salvages #30625 → originally #4043) (#30867)
Skill bundles — /<name> loads multiple skills at once — A skill bundle is a named group of skills that loads them all together with one slash command. Set up your "writing day" bundle (humanizer + ideation + obsidian + youtube-content) and /writing-day activates all four for the session. Skills Hub now has health checks, a freshness badge, and a watchdog cron. Three new optional skills land: code-wiki (Karpathy's LLM-Wiki, persistent indexed dev wiki), openhands (delegate to OpenHands for parallel coding agents), and web-pentest (OWASP-style web pentest recipes). (#28373, #32345, #32240, #32261, #32265)
TUI session orchestrator — multiple live sessions in one TUI window — The Ink TUI gained an active-session switcher overlay. List, switch between, refresh, and close multiple live process-local sessions without leaving the TUI; dispatch a new session with a session-scoped model picker. Plus a wave of TUI polish — mouse-tracking DEC mode presets, scrollback preservation across branches and termux, slash-dropdown fixes, x.com link rendering, and CJK / IME input rendering improvements. (salvages #27642) (#32980, #30084)
Two new image_gen providers — Krea 2 Medium + Large, FAL ported to plugin — Krea joins the image_gen lineup as a built-in plugin: Krea 2 Medium ($0.03) and Krea 2 Large ($0.06), auto-discovered, selectable via hermes tools → Image Generation → Krea. Available through both the native Krea plugin and the FAL.ai catalog. The FAL.ai backend got pulled out of the monolithic image-generation tool into plugins/image_gen/fal/, completing the four-way architectural parity already established by web, browser, and video_gen — new image providers are now one file, not a fork. (#33236, #30380, #33506)
Nous-approved MCP catalog with interactive picker — A curated catalog of Nous-vetted MCP servers, mirroring the optional-skills shape. Run hermes mcp and you get an interactive picker; install with one keystroke, credentials prompted at install time and written to ~/.hermes/.env. Ships with the n8n manifest first. Closes the discovery gap that left users hunting GitHub for trusted MCP servers. (#30870)
OpenHands orchestration skill — A new optional skill under optional-skills/autonomous-ai-agents/openhands/ lets the agent delegate coding tasks to the OpenHands CLI alongside claude-code, codex, and opencode. OpenHands is the model-agnostic member of that family — any LiteLLM-supported provider works (OpenAI, Anthropic, OpenRouter, your own), so you can route a sub-task to the cheapest model that can finish it. Drop-in worker for kanban swarms and /delegate flows. (closes #477) (#32261)
Deep xAI integration round — Web Search plugin, OAuth proxy upstream, May 15 retirement detection, natural TTS, security hardening — Six interlocking xAI improvements:
xAI Web Search lands as a plugins/web/xai/ provider, slots alongside Brave / Tavily / Exa / SearXNG / DDGS / Firecrawl — reuses your existing Grok OAuth or XAI_API_KEY credentials, no new env vars. (#29042)
hermes proxy gains an xAI upstream — your local OpenAI-compatible endpoint can now be backed by SuperGrok OAuth, no PKCE-refresh code to write in your client. (#28356)
May 15 model retirement detection — grok-4, grok-4-fast{,-reasoning,-non-reasoning}, grok-3, grok-code-fast-1, grok-imagine-image-pro etc. are detected in doctor and chat startup, with hermes migrate xai to one-shot config migration to the supported model. No more silent 404s after the retirement date. (#29277)
Opt-in auto_speech_tags for xAI TTS — inserts light [pause] tags between paragraphs and sentences for more natural-sounding voice replies. Default OFF. (#29376)
xai-oauth base_url pinned to x.ai origin — closes a silent credential-leak vector where XAI_BASE_URL could repoint OAuth-authenticated inference to an attacker-controlled host. (#28952)
OpenAI-style execution guidance applied to Grok models — Grok and xai-oauth now get the same family-specific execution discipline block GPT/Codex have, so the model stops claiming completion without tool calls and stops suggesting workarounds instead of using existing tools. (#27797)
Plus x_search degraded-results surfacing, tier-gated 403 with API-key fallback, PKCE code_challenge round-trip fix, dead-token quarantine on terminal refresh failure, MiniMax-style short-token refresh on per-request, and WKE=unauthenticated honor at both classifier sites. (#29484, #28351, #27560, #28116, #30619, #30872)
🏗️ Core Agent & Architecture
The Big Refactor — run_agent.py 16k → 3.8k
run_agent.py from 16,083 → 3,821 lines (-76%), extracted into 14 cohesive agent/* modules. run_conversation alone was 3,877 lines before the refactor. Every extraction keeps a thin forwarder on AIAgent, every test-patch path is preserved, every external caller stays compatible. (#27248)
Agent loop & conversation
Auxiliary task layered fallback (primary → chain → main agent → graceful fail) on capacity errors (402/429/connection). (salvages #26811 + #26998) (#27625)
Buffer retry/fallback status; surface only on terminal failure (no more noisy "retrying..." spam in mid-run output). (#33816)
Host contract for external context engines — condenses 5 prior PRs into one extension surface. (#33750)
Fallback immediately on provider content-policy blocks. (#33883)
Re-pad reasoning_content on cross-provider fallback to require-side providers. (salvage #33784) (#33795)
Per-turn tool-outcome verifier — patch tool gets indent preservation, CRLF preservation, per-file failure escalation. (#32273)
Single-knob native vision for custom-provider models. (#29679)
Background review fork isolated from external memory plugins. (#27190)
Background review inherits parent toolset config for tools[] cache parity. (#29704)
Recover from providers returning list-type tool content. (#30259)
Treat partial-stream stub responses as length truncation rather than clean stop. (#30998)
OpenAI execution guidance applied to xAI Grok / xai-oauth. (#27797)
ContextVars propagate to concurrent tool worker threads.
Preload jiter native parser. (#33692)
Expose context engine tools with saved toolsets. (salvage of #31194) (#33719)
Sessions & memory
session_search rebuilt — single-shape (discovery + scroll + browse), no aux-LLM, ~20ms vs. ~90s. (#27590)
Salvage #29182 — opt-in JSON snapshot writer for sessions. (#29278)
Persist platform_message_id for recall across gateway restarts. (#29449)
Inline memory-context mentions stay visible in conversation. (#28132)
Recalled memory labeled informational, not authoritative. (#28583)
Memory + context-engine tool injection gated on enabled_toolsets. (#30177)
Guard against external drift in MEMORY.md / USER.md. (#30877)
Honcho runtime peer mapping — correctness follow-ups + setup wizard + docs. (#30077)
Periodic memory logging for leak detection. (salvage of #17667) (#27102)
Codex / Responses-API maturation
TTFB watchdog for stalled Codex Responses streams. (#32042)
Actionable hint when stale-call detector fires on known silent-reject pattern. (#32016, #33133)
Drop SDK responses.stream() helper; consume events directly. (#33042)
Gracefully recover from invalid_encrypted_content. (salvage of #10144) (#33035)
Recover Codex Responses streams with null output. (#32963, #33390)
Drop foreign-issuer reasoning and transient rs_tmp reasoning replay state. (#33156, #33146)
Codex 429 quota classified as rate-limit, not missing credentials. (#33168)
Codex chat path falls back to credential_pool when singleton is empty. (#33189)
Codex re-auth syncs credential_pool. (#33164)
Omit tools key when no tools registered. (#33409)
Parse Codex image-generation SSE directly. (#32933)
🎛️ Kanban — Multi-Agent Maturation Wave
Orchestration & dispatch
Orchestrator-driven auto-decomposition on triage. (#27572)
Kanban swarm topology helper — hermes kanban swarm creates a Swarm v1 graph (root + parallel workers + gated verifier + gated synthesizer + shared blackboard). (salvages #26791 by @Niraven) (#28443)
Dispatcher wires review agents from the review column. (#28449)
Stale-detection for running tasks in dispatcher. (#28452)
Respawn guard blocks repeat worker storms. (#28455)
Respawn guard defers blocker_auth instead of auto-blocking. (#28683)
Cross-profile cron jobs surface in dashboard. (#28457)
Worker visibility endpoints: /workers/active, /runs/{id}, /inspect. (salvages #23761 by @Interstellar-code) (#28432)
Task configuration & scheduling
Per-task model override. (#28364)
Board-level default workdir. (#28394)
Configurable worktree paths and branches. (#28462)
Scheduled task start times. (#28384)
Scheduled status for delayed follow-ups. (#28467)
Trimmed task comments. (#28399)
Initial-status for human-ops cards. (#28414)
max_in_progress config to cap concurrent running tasks. (#28420)
Filter tasks by workflow fields. (#28454)
--sort for hermes kanban list. (#28427)
Optional board parameter on all MCP tools. (#28444)
Stamp originating ACP session_id on tasks. (#28447)
auto_promote_children config toggle. (#28344)
archive --rm to hard-delete archived tasks. (#28355)
Promote dependents when parent is archived. (#28372)
Promote blocked tasks when parent dependencies complete. (#28377)
Demote ready children when parent is reopened. (#28382)
promote verb for manual todo→ready recovery + bulk --ids. (salvage #29464) (#31334)
Dashboard
Drag-to-delete trash zone + bulk delete. (#28468)
Surface per-task model_override in show + tool output. (#28442)
Cross-profile notification delivery via kanban.notification_sources. (#28395)
Scratch-workspace deletion warning for users. (#30949)
Mobile dashboard UX polish. (#28127)
Reliability
Worker log retention configurable. (#27867)
Configurable claim TTL. (#28392)
Fingerprint crash errors to prevent fleet-wide retry exhaustion. (#28380)
Reset failure counters on unblock_task. (#28379)
Detect cycles in decompose_triage_task sibling-link pre-validation. (#28088)
Surface unusable triage auxiliary model (auto-decompose aware). (#27871)
Align failure diagnostics with retry limit. (#27868)
Align worker terminal timeout with task runtime. (#27864)
Auto-install bundled skills (kanban-worker) on init. (#28368)
Make legacy task migration idempotent. (#28397)
Serialize DB initialization. (#28383)
Persist worker session metadata on completion. (#28387)
Pass accept-hooks to worker chat subprocess. (#28393)
Preserve worker tools with restricted toolsets. (#28396)
Avoid unsafe Windows worker Hermes shim resolution. (#28398)
Sync slash subcommands with live parser. (#28376)
Show scheduled kanban tasks in dashboard. (#28400)
Assign single-task kanban decompositions. (#28401)
Configurable max_tokens for kanban specify. (#28374)
Per-job profile support for cron. (#28124)
Codex app-server: include every Kanban-pinned path in writable_roots. (#28435)
Cache kanban worker guidance at session init for prompt-cache reuse. (#28425)
⚡ Performance
openai.base_client import deferred — 240ms / 17MB off every CLI cold start. (#28864)
Agent-loop hot-path optimizations — 47% fewer per-conversation function calls (399k → 213k for 31-turn chat). (#28866)
Compression-feasibility check deferred — 170-290ms off every agent construction. (#28957)
Adaptive subprocess poll — ~195ms off every tool call, 1+ second per turn. (#29006)
Termux TUI cold start speedup. (#29419)
Termux non-TUI cold start speedup. (salvage #29438) (#30121)
Termux fast-path version + deferred bare-prompt agent startup. (#30609)
Cut hermes --version wall time 63% — flips head-to-head vs Codex CLI. (#31968)
Date-only timestamp + loud gateway-DB roundtrip logging — improves prompt-cache hit rate. (#27675)
Cache kanban worker guidance at session init for prompt-cache reuse. (#28425)
🔧 Tool System
Tool surface
patch: indent preservation, CRLF preservation, per-file failure escalation. (#32273)
terminal: warn at call time when background=true runs silently. (#31289)
terminal: nudge homebrewed CI pollers at the tool surface. (#33142)
x_search: surface degraded results + validate dates. (#29484)
x_search: auto-enable toolset when xAI credentials are configured. (#27376)
computer_use: route SOM/vision captures via auxiliary.vision. (#30126)
transcription: reject symlinked audio inputs. (#10082)
TTS: prevent double [pause] in xAI auto speech tags. (#32237)
TTS: preserve native audio outside Telegram voice delivery. (#28512)
TTS: opt-in xAI auto_speech_tags speech-tag pauses for natural voice replies. (#29376)
Voice: chunk oversized CLI recordings. (#30044)
Voice: honor PULSE_SERVER / PIPEWIRE_REMOTE inside Docker. (#22534)
Browser
All cloud browser providers (Browserbase, Anchor, Camofox, Hyperbrowser, etc.) migrated to image_gen-style plugins. (salvages #25580) (#27403)
Auto-launch Chromium-family browser for CDP. (#29106)
Docker: discover agent-browser Chromium binary at boot. (#33184)
Image generation
Krea provider plugin (Krea 2 Medium + Large). (#33236)
FAL backend ported to plugins/image_gen/fal. (salvage #27966) (#30380)
Cache xAI ephemeral URL responses to disk. (#31759)
Web search
xAI Web Search as a provider plugin. (#29042)
MCP
Nous-approved MCP catalog with interactive picker. (#30870)
TLS client certificate (mTLS) support for HTTP and SSE MCP servers. (#33721)
Stdin paste-back fallback for headless OAuth flow. (#32053)
skip at paste prompt bypasses auth without disabling server. (#32069)
Registry-aware mcp prefix on both ends of round-trip. (#31700)
🧩 Skills Ecosystem
Skills system
Skill bundles — /<name> loads multiple skills. (#28373)
Skills Hub: health checks, freshness badge, and a watchdog cron. (#32345)
Opt-in AST deep diagnostics on skill writes. (salvage of #30918) (#31198)
Bundled/pinned skill protection in background-review prompts. (#28338)
Show user-modified skill names in bundled skill sync summary. (#28671)
Load symlinked skill slash commands. (#27759)
Deduplicate Skills Hub search results by identifier, not name. (#29490)
New skills
openhands — delegate-to-OpenHands orchestration skill (closes #477) (#32261)
code-wiki — persistent indexed dev wiki (closes #486) (#32240)
web-pentest — OWASP recipes (closes #400) (#32265)
baoyu-article-illustrator (#28287)
☁️ Providers
xAI deep integration
xAI Web Search as a plugins/web/xai/ provider plugin. (#29042)
hermes proxy xAI upstream — OpenAI-compatible local proxy backed by xai-oauth. (#28356)
May 15 model retirement detection + hermes migrate xai for grok-4 / grok-3 / grok-code-fast-1 / grok-imagine-image-pro. (#29277)
Opt-in auto_speech_tags for natural xAI TTS voice replies. (#29376)
xai-oauth base_url pinned to x.ai origin — closes silent credential-leak vector. (#28952)
OpenAI-style execution guidance applied to Grok / xai-oauth models. (#27797)
xAI: detect retired May 15 models in doctor/chat startup. (#29277)
xAI: resolve Grok Build context for OAuth. (#30579)
xAI OAuth: tier-gated 403 with API-key fallback. (#28351)
xAI OAuth: PKCE code_challenge echo. (#27560)
xAI OAuth: quarantine dead tokens on terminal refresh failure. (#28116)
xAI OAuth: honor WKE=unauthenticated disambiguator at both classifier sites. (#30872)
xAI OAuth: accept bare-code manual paste (state=None). (closes #26923) (#33880)
xAI OAuth: fall back to manual paste on loopback timeout. (#33231)
xAI proxy: handle 429 rate-limit responses in proxy retry path. (#33743)
Other providers
OpenAI API as a first-class provider (distinct from Codex runtime). (#31898)
Microsoft Entra ID auth for Azure Foundry (with 1M Anthropic-Messages beta preserved on Bearer). (salvages #27509, #27022) (#28101, #28084)
OpenRouter sticky routing — session_id passed via extra_body so a long-running session keeps landing on the same upstream provider. (@Cybourgeoisie) (#33939)
Nous: JWT token for inference; stop replaying invalid Nous refresh tokens. (@rewbs) (#27663)
Nous Portal: one-shot setup, status CLI, and Nous-included markers. (#30860)
Anthropic adapter: extract 7 helpers from convert_messages_to_anthropic. (salvage #27784) (#30386)
Catalog: add qwen3.7-max to Alibaba + Alibaba-Coding-Plan model lists. (#33129)
opencode-go: route qwen3.7-max via anthropic_messages. (@beardthelion) (#32780)
opencode-go: expose Kimi K2 + DeepSeek reasoning controls. (#30845)
Remove Vercel AI Gateway and Vercel Sandbox.
MiniMax OAuth: refresh short-lived access tokens per request. (#30619)
Codex OAuth: quarantine terminal refresh errors. (#28118)
Codex: drop dead model slugs that HTTP 400 on ChatGPT Pro. (#33424)
Codex: sync manual:device_code pool entries on re-auth. (#33744)
MiniMax OAuth: quarantine terminal refresh errors. (#28119)
🔑 Secrets
Bitwarden Secrets Manager integration with lazy bws install. (#30035)
Bitwarden: EU Cloud + self-hosted server URL support. (#31378)
Label detected credentials with their source (Bitwarden). (#30364)
📱 Messaging Platforms (Gateway)
Gateway core
Deliverable mode — agents ship artifacts as native uploads from any platform (Slack/Discord/Telegram/Teams/Email). (#27813)
hermes send — pipe any script's output to any messaging platform. (salvage of #19631) (#27188)
Debounce queued text follow-ups during active sessions. (salvage of #31235) (#31341)
Plugin-transformed final_response delivered through streaming gate. (#31433)
Refresh cached agent tools on /reload-mcp. (#32815)
Harden kanban + provider cleanup races on long-running workloads. (#29479)
New / reorganized adapters
ntfy — 23rd platform, push notifications, plugin shape, zero core edits. (salvages #30625 → #4043) (#30867)
Discord adapter migrated to bundled plugin. (salvage of #24356) (#30591)
Mattermost adapter migrated to bundled plugin. (salvage of #30916) (#31748)
Telegram
Edit status messages in place instead of appending. (based on #30141 by @qike-ms) (#30864)
Skip-STT audio path + 2GB cap via local Bot API server. (#28541)
Route image documents (.png/.jpg/.webp/.gif) through vision pipeline. (#28519)
Route audio file attachments away from STT pipeline. (#28478)
disable_topic_auto_rename gateway flag. (#28523)
ignore_root_dm config to drop messages without thread_id. (#28536)
Chat-scoped auth without sender user_id. (#28525)
Fail-closed auth fallback when TELEGRAM_ALLOWED_USERS is empty. (#28494)
Roll over tool progress bubbles + scope audio_file_paths. (#28482)
Avoid duplicate text after auto-TTS voice replies. (#28509)
Mark final voice reply notify-worthy so Telegram delivers it audibly. (#28504)
Discord
Recover Windows voice opus decoding. (#33182)
allow_any_attachment config to accept arbitrary file types. (#27245)
Transcribe native voice notes. (#28993)
Define UI view classes after lazy install. (#28817)
Signal / Matrix / Feishu / Slack / WeCom
Signal: require_mention filter for group chats. (#28574)
Matrix: warn on clock-skew silent message drops. (#27330)
Matrix E2EE installs full dep set; plugins respect is_connected. (#31688)
Feishu: require webhook auth secret + honor config extras. (#30746)
Feishu: enforce auth and chat binding for approval buttons. (#30744)
Slack: socket recovery + Windows restart dedupe. (#28873)
WeCom: safe-parse untrusted XML. (#32442)
DingTalk / Webhooks / Microsoft Graph
DingTalk: transcribe native voice notes. (#28993)
Webhook: enforce INSECURE_NO_AUTH safety rail on dynamic route reloads. (#30863)
Webhook: restrict default toolset capabilities. (#30745)
Microsoft Graph: harden webhook auth requirements. (#30169)
🖥️ CLI & TUI
CLI
/update slash command in CLI and TUI. (#23854)
Update auto-rollback when post-pull syntax check fails. (#28669)
--branch flag for hermes update. (@jquesnelle) (#29591)
/exit --delete flag to remove session on quit. (salvage of #17665) (#27101)
▶ N indicator in status bar for running /background tasks. (#27175)
Live background terminal-process count in status bar. (#32061)
Append session recap to /status output. (salvage of #18587) (#27176)
Configurable paste-collapse thresholds (TUI + CLI). (salvage #29723) (#32087)
/resume accepts position numbers. (#31709)
Bring tool-call display back — verbose mode, specific failure reasons, todo progress. (#31293)
Validate runtime token refresh in Qwen auth status. (#31196)
TUI
TUI session orchestrator — multiple live sessions in one TUI window. (salvages #27642) (#32980)
mouse_tracking DEC mode presets. (salvage of #26681 by @OutThisLife) (#30084)
Termux scrollback preservation + touch-friendly defaults. (#28910)
Full assistant text in scrollback (no history truncation). (#28829)
Preserve scrollback when branching sessions. (#30162)
Preserve Python dunder identifiers in markdown. (#28582)
Active profile shown in TUI prompt. (#28581)
Improve Charizard completion menu contrast. (#28346)
Stop slash dropdown chopping last char of /goal. (#31311)
Clipboard copy on linux/wayland. (#29342)
Anchor splitReasoning unclosed-tag regex; stop eating last paragraph. (#29426)
Surface verbose tool details. (#30225)
Load Linux skills on Termux + salvage @adybag14-cyber's Termux gates. (#30166)
Handle images with codex app-server. (#31220)
Refresh virtual transcript on viewport resize. (#31077)
Ignore late thinking deltas after completion. (#31055)
Commit composer input bursts immediately. (#31053)
Log parent gateway lifecycle exits. (#31051)
Clear TTS env var on voice off + TTS indicator in status bar. (#30987)
Pass --expose-gc as node argv instead of NODE_OPTIONS. (#29998)
Align composer cursorLayout with wrap-ansi to kill multiline cursor drift. (#27489)
Harden Terminal.app rendering and color paths. (#27251)
Keep /goal verdict out of compact status row. (#27971)
Clamp curses color 8 for 8-color terminals (Docker). (#30260)
🔒 Security & Reliability
Promptware & memory hardening
Promptware defense — shared threat patterns + memory load-time scan + tool-result delimiters. (#32269)
Expand memory content scanning patterns to parity with skills guard. (#9151)
Harden Skills Guard multi-word prompt patterns. (@YLChen-007) (#26852)
Split cron scanner so skill prose stops false-positiving exfil patterns. (#32339)
File safety
Protect Hermes control-plane files from prompt injection (auth.json, config.yaml, webhook_subscriptions.json, mcp-tokens/). (salvages @PratikRai0101's #14157) (#30397)
Write-deny <root>/.env when running under a profile. (#29687)
Defense-in-depth read-deny on credential stores. (salvages #17659 + #8055) (#30721)
TTS output_path traversal + update ZIP symlink reject. (salvage #6693 + #15881) (#32056)
Reject symlinked audio inputs. (#10082)
Credential safety
Avoid persisting borrowed credential secrets — runtime env-sourced keys no longer leak into auth.json. (#31416)
Validate Nous Portal inference_base_url against host allowlist. (salvages #27612) (#30611)
Harden API server key placeholder handling. (#30738)
Harden Google Chat OAuth credential persistence. (@Zyrixtrex) (#24788)
xAI OAuth: pin inference base_url to x.ai origin. (#28952)
Quarantine dead OAuth tokens on terminal refresh failure (xAI, Codex, MiniMax). (#28116, #28118, #28119)
Supply-chain
On-demand supply-chain audit via OSV.dev — hermes audit. (#31460)
hermes update syntax-validates critical files post-pull, auto-rollback on failure. (#28669)
Quarantine hermes.exe vs concurrent Windows instance. (#26677)
Other hardening
Restrict default webhook toolset capabilities. (#30745)
Harden Microsoft Graph webhook auth requirements. (#30169)
Require source CIDR allowlisting for public msgraph webhook binds. (#33722)
Require API_SERVER_KEY before dispatching API server work. (#33232)
env_passthrough: apply GHSA-rhgp-j443-p4rf filter to config.yaml path. (@roadhero) (#27794)
Dashboard + WeCom: restrict markdown link schemes; safe-parse untrusted XML. (#32442)
Salvage project-plugin RCE bypass fix from PR #29311 (GHSA-5qr3-c538-wm9j). (#30837)
Cross-profile soft guard on file-write tools + system-prompt hint. (#31290)
Reject unsafe tar members in Android psutil compatibility installer. (#33742)
Reject non-regular tar members during tirith auto-install. (#33786)
🪟 Native Windows (Beta Continued)
Complete Windows bootstrap — dep_ensure + install.ps1 + detection. (@alt-glitch) (#27845)
install.ps1: strip BOM, -Commit/-Tag pin params, harden git ops. (@jquesnelle) (#28169)
Consolidate ACP browser bootstrap into install.{sh,ps1}. (@alt-glitch) (#27851)
hermes update quarantines live hermes.exe. (#26677)
Discord voice opus decoding on Windows. (#33182)
Windows Docker Desktop compatible compose file. (@Sunil123135) (#31031)
🖥️ Web Dashboard
Hardened Slack socket recovery + Windows restart dedupe. (#28873)
Web dashboard: migrate checkboxes to @nous-research/ui + design-system polish. (@austinpickett) (#28814)
Web dashboard: collapsible sidebar. (@austinpickett) (#33421)
Dashboard typography & contrast pass. (salvage of #28832) (#30714)
Skills page: lazy-fetch catalog instead of bundling 34MB into JS. (#33809)
🐳 Docker
s6-overlay container supervision — abstract ServiceManager protocol (systemd/launchd/Windows/s6 backends), per-profile gateway supervision in-container, container-restart reconciliation, hadolint/shellcheck CI. (salvage of #30136, @benbarclay) (#31760)
Auto-redirect gateway run to supervised mode inside the s6 image. (@benbarclay) (#33583)
Tee supervised gateway stdout to docker logs. (@benbarclay) (#33621)
Drop docker exec to hermes uid before invoking the CLI. (@benbarclay) (#33628)
Align HOME for dashboard and s6 gateway services. (@Dusk1e) (#33481)
Bake build-time git SHA into image so hermes dump reports it. (@benbarclay) (#33655)
hermes update prints docker pull guidance instead of bogus git error. (@benbarclay) (#33659)
Upgrade Node to 22 LTS via multi-stage from node:22-bookworm-slim. (@benbarclay) (#33060)
Drop build-essential from apt install. (@benbarclay) (#33028)
Propagate env through s6 to cont-init and main CMD. (#32412)
Targeted chown to preserve host file ownership in HERMES_HOME. (#33033)
mkdir HERMES_HOME as root in stage2 before chown / privilege drop. (#33078)
chown ui-tui and node_modules on UID remap so TUI esbuild works. (#33045)
Include anthropic, bedrock, azure-identity extras in image. (#30504)
Stop pushing per-commit SHA tags to Docker Hub. (#29387)
Simplify Docker tagging — push both :main and :latest on main push. (#33225)
Test slicing across GH actions jobs. (@ethernet8023) (#30575)
Discover agent-browser Chromium binary at boot. (#33184)
🌐 API Server
Session control API — /api/sessions/* (list/create/read/patch/delete/fork) + SSE-streaming chat. (salvages #29302 by @Codename-11 + multimodal followup by @Schwartz10) (#33134)
GET /v1/skills and /v1/toolsets. (#33016)
Coerce stringified booleans in stream/store/approval payloads. (salvage #26639) (#27293)
Honor key_env in auth-failure fallback resolution. (#30840)
🎟️ ACP (VS Code / Zed / JetBrains)
Session edit auto-approval modes. (salvage of #27034) (#27862)
Enrich Zed permission cards — command in title + reject_always. (#28148)
Replay session history before responding to session/load. (#26957, #26943)
Plugin-transformed final_response delivered through streaming gate. (#31433)
🔌 Plugin Surface
register_tts_provider() plugin hook. (salvage of #30420) (#31745)
register_transcription_provider() hook + stt.providers command-provider registry. (salvage of #30493) (#31907)
register_auxiliary_task() in PluginContext API. (salvage #29817) (#31177)
Bundled security-guidance plugin. (#33131)
Discord and Mattermost migrated to bundled plugins. (#30591, #31748)
ntfy as platform plugin. (#30867)
Surface category-namespaced plugins in hermes plugins list. (#27187)
Plugin discovery failures raised to WARNING level. (#28318)
hermes_plugins included in gateway.log component filter. (#28313)
Seed plugin extras before is_connected gate. (#31703)
Dashboard: allowlist plugin assets + denylist subprocess-influencing env vars. (#32277)
📦 Distribution & Install
Install-method stamping + Docker detection. (@alt-glitch) (#27843)
Nix #messaging and #full package variants. (@alt-glitch) (#33108)
Pre-load messaging gateway deps via --extra messaging. (salvage #26394) (#27558)
Avoid piping installer directly into iex (Windows). (#28347)
Ship bundled skills in wheel. (#28421)
Ship dashboard plugin assets in wheel. (#28406)
Make Camofox lazy-installed instead of eager. (#27055)
Wire STT lazy-install into transcription_tools.py. (#30256)
🐛 Notable Bug Fixes (highlights only)
Match bare custom provider by active base URL in hermes model. (#28908)
Route auxiliary.vision.provider=openai to api.openai.com, skip text-only main. (#31452)
Lint: skip per-file shell linter when LSP will handle the file. (#29054)
Treat empty credential pool entries as unauthenticated in /model picker. (#28312)
Reverted within window: Firecrawl integration tag, send_message @username auto-mentions, Telegram quick-command-only menus, Telegram pin-on-turn.
🧪 Testing
Disarm lazy-install probe so _HAS_FASTER_WHISPER patches work. (#30334)
Cover default board dashboard pin. (#28361)
Cover _task_dict task_age fallback. (#28365)
Allowlist tmp_path for kanban_notify artifact delivery tests. (#30851, #30852)
Cover null output stream terminal events in Codex. (#33137)
📚 Documentation
30-day docs overhaul — full correctness audit, every PR in the window covered, Nous Portal weave, sidebar reorg. (#33782)
Dedicated Nous Portal integration page and setup guide. (#31296)
Providers: move Nous Portal first, Google Gemini OAuth last. (#31287)
session_search rewrite for single-shape tool. (#27840)
Kanban: document failure_limit, max_retries, inline create shortcuts, goals & kanban settings. (#28357, #28358, #28359, #28360, #28362)
Kanban Codex lane skill. (#28430)
xAI OAuth: note X Premium+ also unlocks Grok OAuth. (#29055)
Docs site: Docker audio bridge notes, "Installing more tools in the container", xurl auth HOME in Docker.
Email: clarify gateway vs Himalaya setup. (@helix4u) (#33634)
Auth docs: replace stale hermes login references with hermes auth add. (#32859)
👥 Contributors
Core
@teknium1 (lead)
Notable salvages & cherry-picks
@benbarclay — s6-overlay container supervision (29 commits salvaged), Node 22 LTS upgrade, build-essential cleanup, gateway run auto-redirect in s6, tee supervised stdout to docker logs, hermes update Docker guidance, build-time SHA stamping
@OutThisLife — mouse_tracking DEC mode presets
@jquesnelle — Windows installer hardening, --branch flag for hermes update, install.ps1 BOM strip / commit-pin
@alt-glitch — Windows dep_ensure bootstrap, Nix package variants (.#messaging, .#full), install-method stamping, ACP browser bootstrap consolidation
@austinpickett — /update slash command, dashboard checkboxes → @nous-research/ui, mobile dashboard polish, collapsible sidebar
@ethernet8023 — CI test slicing across GH Actions jobs, TUI clipboard copy fix
@kshitijk4poor — doctor section banner + fail-and-issue helpers extraction, post-tag salvage cluster (curator-fallout, kanban SQLite hardening, install world-readable uv dirs, xAI bare-code paste)
@rewbs — Nous JWT inference switch + refresh-token replay fix
@Codename-11 + @Schwartz10 — session control API (REST + SSE + multimodal followup)
@Niraven — kanban swarm topology helper
@Interstellar-code — kanban worker visibility endpoints
@adybag14-cyber — termux cold-start optimizations (multiple PRs)
@qike-ms — Telegram in-place status edits design
@sprmn24 — ntfy adapter
@Jaaneek — xAI Web Search provider plugin
@yannsunn — xAI upstream adapter for hermes proxy
@Cybourgeoisie — OpenRouter sticky routing via session_id
@memosr — Nous Portal base_url allowlist validation
@Sunil123135 — Windows Docker Desktop compose file
@Dusk1e — Docker HOME alignment for dashboard + s6 gateway services
@beardthelion — opencode-go anthropic_messages routing
@YLChen-007 — Skills Guard multi-word prompt patterns
@roadhero — env_passthrough GHSA-rhgp-j443-p4rf filter
@Zyrixtrex — Google Chat OAuth credential persistence hardening
@briandevans, @tomqiaozc — defense-in-depth read-deny on credential stores
@PratikRai0101 — control-plane file write protection
@helix4u, @Bartok9, @zccyman — auxiliary fallback ladder components
@ms-alan, @ticketclosed-wontfix, @donovan-yohan — TUI session orchestrator + follow-ups
@daimon-nous[bot] — cron per-job profile support
@bisko — re-pad reasoning_content on cross-provider fallback
All Contributors
@02356abc, @0xchainer, @0xDevNinja, @0xjackyang, @0xsir0000, @0z1-ghb, @8bit64k, @aaronlab, @AceWattGit,
@ACR27, @adam91holt, @AdamPlatin123, @Ade5954, @AdityaRajeshGadgil, @adybag14-cyber, @AhmetArif0, @ai-hana-ai,
@alaamohanad169-ship-it, @alber70g, @albert748, @alt-glitch, @aqilaziz, @argabor, @asdlem, @austinpickett,
@avifenesh, @awizemann, @B0Tch1, @Bartok9, @BaxBit, @Beandon13, @beardthelion, @benbarclay, @bensargotest-sys,
@binhnt92, @bird, @bisko, @BlackishGreen33, @booker1207, @bradhallett, @briandevans, @Brixyy, @brndnsvr,
@BROCCOLO1D, @btorresgil, @burjorjee, @carltonawong, @Carry00, @chaconne67, @chdlc, @chromalinx, @ChyuWei,
@CipherFrame, @cmullins70, @CNSeniorious000, @codeblackhole1024, @Codename-11, @colin-chang, @counterposition,
@cresslank, @CryptoByz, @cyb0rgk1tty, @Cybourgeoisie, @daizhonggeng, @darvsum, @davidcampbelldc, @deas,
@dgians, @dillweed, @DoGMaTiiC, @donovan-yohan, @draplater, @Drexuxux, @dskwe, @dsr-restyn, @Dusk1e,
@dusterbloom, @duyua9, @egilewski, @el-analista, @eliteworkstation94-ai, @eloklam, @EloquentBrush0x, @emonty,
@emozilla, @erhnysr, @erikengervall, @erosika, @ether-btc, @ethernet8023, @EvilHumphrey, @fabiosiqueira,
@falasi, @falconexe, @fardoche6, @felix-windsor, @Fewmanism, @ffr31mr, @flamiinngo, @flanny7, @flooryyyy,
@fonhal, @francip, @fujinice, @gianfrancopiana, @glennc, @Glucksberg, @godlin-gh, @Grogger, @guillaumemeyer,
@Gutslabs, @H-Ali13381, @hanzckernel, @haran2001, @hawknewton, @hayka-pacha, @hehehe0803, @helix4u, @HenkDz,
@Hermes, @hermesagent26, @Hinotoi-agent, @hongchen1993, @honor2030, @houenyang-momo, @ht1072, @hueilau,
@iamfoz, @ilonagaja509-glitch, @InB4DevOps, @indigokarasu, @Interstellar-code, @iqdoctor, @iRonin, @Jaaneek,
@JabberELF, @jacevys, @jackey8616, @jackjin1997, @jdelmerico, @jfuenmayor, @Jiahui-Gu, @JimLiu, @joe102084,
@JohnC1009, @jonpol01, @Jpalmer95, @Julientalbot, @justemu, @justincc, @jvinals, @karthikeyann, @kasunvinod,
@kchuang1015, @kenyonxu, @khungate, @kiranvk-2011, @kjames2001, @konsisumer, @kpadilha, @kriscolab,
@krislidimo, @kronexoi, @kshitijk4poor, @kunci115, @Kylejeong2, @kylekahraman, @LaPhilosophie, @leeseoki0,
@lemassykoi, @Lempkey, @LeonJS, @LeonSGP43, @lidge-jun, @LifeJiggy, @liuhao1024, @LizerAIDev, @loicnico96,
@loongfay, @m0n3r0, @malaiwah, @matthewlai, @mavrickdeveloper, @maxmilian, @McClean-Edison, @memosr,
@Mind-Dragon, @momowind, @MoonJuhan, @MoonRay305, @moortekweb-art, @MorAlekss, @ms-alan, @Nami4D,
@nehaaprasaad, @nekwo, @nftpoetrist, @NickLarcombe, @nidhi-singh02, @Niraven, @nnnet, @noctilust, @novax635,
@nthrow, @nv-kasikritc, @nycomar, @OCWC22, @oemtalks, @OmX, @ooovenenoso, @orcool, @oseftg, @outsourc-e,
@OutThisLife, @Paperclip, @PaTTeeL, @pepelax, @phoenixshen, @Pluviobyte, @pnascimento9596, @pochi-gio, @pr7426,
@PratikRai0101, @Prithvi1994, @psionic73, @ptichalouf, @Que0x, @QuenVix, @quocanh261997, @qWaitCrypto, @Qwinty,
@r266-tech, @rak135, @rdasilva1016-ui, @rewbs, @roadhero, @rodrigoeqnit, @RonHillDev, @roycepersonalassistant,
@rudi193-cmd, @RyanRana, @sadiksaifi, @samahn0601, @samggggflynn, @SamuelZ12, @sanghyuk-seo-nexcube,
@Saurav0989, @savanne-kham, @Schrotti77, @Schwartz10, @SerenityTn, @sgtworkman, @sharziki, @shaun0927,
@shellybotmoyer, @shunsuke-hikiyama, @SimbaKingjoe, @SimoKiihamaki, @sir-ad, @Slimydog21, @slowtokki0409,
@Soju06, @someaka, @soynchux, @sprmn24, @Stark-X, @steezkelly, @stepanov1975, @stephenschoettler,
@stevehq26-bot, @steveonjava, @Strontvod, @subtract0, @Sunil123135, @superearn-fisher, @Sylw3ster, @tchanee,
@that-ambuj, @thedavidmurray, @TheOnlyMika, @therahul-yo, @thewillhuang, @ticketclosed-wontfix, @Timur00Kh,
@tomqiaozc, @Tosko4, @Tranquil-Flow, @tw2818, @uzunkuyruk, @vaddisrinivas, @vanthinh6886, @vgocoder,
@victorGPT, @vynxevainglory-ai, @waefrebeorn, @walli, @wangpuv, @wanwan2qq, @wesleysimplicio, @worlldz,
@wpengpeng168, @WuKongAI-CMU, @wuli666, @Wysie, @wysie, @xxxigm, @yannsunn, @YanzhongSu, @YarrowQiao, @ygd58,
@YLChen-007, @yoniebans, @yu-xin-c, @YuanHanzhong, @zapabob, @zccyman, @ziliangpeng, @zwolniony, @Zyrixtrex
Full Changelog: v2026.5.16...v2026.5.28

Original source

Hermes Agent v0.14.0 (v2026.5.16)

Release Date: May 16, 2026

Since v0.13.0: 808 commits · 633 merged PRs · 1393 files changed · 165,061 insertions · 545 issues closed (12 P0, 50 P1) · 215 community contributors (including co-authors)

The Foundation Release — Hermes installs and runs anywhere, ships with the things you actually want to use, and stops shipping the things you don't. xAI Grok lands as a SuperGrok OAuth provider with grok-4.3 bumped to a 1M context window. A new OpenAI-compatible local proxy turns any OAuth-authed Hermes provider — Claude Pro, ChatGPT Pro, SuperGrok — into an endpoint that Codex / Aider / Cline / Continue can hit. x_search lands as a first-class X (Twitter) search tool with OAuth-or-API-key auth. The Microsoft Teams stack is wired end-to-end (Graph auth + webhook listener + pipeline runtime + outbound delivery). A debloating wave makes installs dramatically lighter — heavyweight backends now lazy-install on first use, the [all] extras drop everything covered by lazy-deps, and a tiered install falls back when a wheel rejects on your platform. pip install hermes-agent works from PyPI. The cold-start wave shaves ~19 seconds off hermes launch. Browser CDP calls are 180x faster. Two new messaging platforms (LINE + SimpleX Chat) bring the total to 22. Cross-session 1-hour Claude prompt caching, /handoff that actually transfers sessions live, native button UI for clarify on Telegram and Discord, Discord channel history backfill, LSP semantic diagnostics on every write, a unified pluggable video_generate, a computer_use cua-driver backend that finally works with non-Anthropic providers, clickable URLs in any terminal, Zed ACP Registry integration via uvx, native Windows beta, 9 new optional skills, OpenRouter Pareto Code router, huggingface/skills as a trusted default tap. 12 P0 + 50 P1 closures.

✨ Highlights

xAI Grok via SuperGrok OAuth — and grok-4.3 jumps to a 1M context window — If you pay for SuperGrok, you can now use Grok inside Hermes by signing in with your xAI account — no API key, no separate billing. The wire-through also bumps grok-4.3 to a 1M token context window, so you can drop whole codebases or research corpora into a single prompt. Includes proper handling for entitlement errors and an SSH-to-tunnel docs page for when you're SSH'd into a remote box and need to complete the OAuth flow. (#26534, #26664, #26644, #26592)

OpenAI-compatible local proxy for OAuth providers — Run hermes proxy and you get a http://localhost:port endpoint that speaks the OpenAI API but is backed by whichever OAuth provider you're signed into — Claude Pro, ChatGPT Pro, SuperGrok. Now any tool that expects an OpenAI-compatible endpoint (Codex CLI, Aider, Cline, Continue, your custom scripts) just works with your existing subscription, no API key required. One subscription, every tool. (#25969)

x_search — first-class X (Twitter) search tool — The agent can now search X directly without installing a skill or wiring up a custom integration. Search the timeline, find threads, surface specific posts — straight from the chat. Auth with either your X OAuth login or an API key, whichever you have. (#26763)

Microsoft Teams — end-to-end — Hermes can now read messages from Teams and post back. The full Microsoft Graph stack lands together: auth + client foundation, a webhook listener that receives Teams events, a pipeline plugin runtime, and outbound delivery. Wire up the bot once, then chat to your agent from any Teams channel, DM, or group. (salvages of #21408–#21411) (#21922, #21969, #22007, #22024)

Debloating wave — lighter installs, less you don't use — A clean pip install hermes-agent used to pull down everything: every messaging adapter SDK, every image-gen SDK, every voice/TTS provider, whether you used them or not. Now those heavy backends (Slack / Matrix / Feishu / DingTalk adapters, hindsight client, codex app-server, Pixverse / Camofox / image-gen SDKs, voice/TTS providers) install automatically the first time you actually use them. The [all] extras drop everything covered by lazy-deps, the installer falls back through tiers when a wheel doesn't fit your platform, and a supply-chain advisory checker scans every install for unsafe versions. Faster installs, smaller disk footprint, fewer transitive vulnerabilities. (#24220, #24515, #25014, #25038, #25766, #21818)

pip install hermes-agent && hermes — Hermes Agent is now a real PyPI package. No more cloning the repo or running shell installers — one pip command and you're running. The wheel ships with the Ink TUI bundle and the shell launcher, so the full experience comes out of the box. (salvage of #26350) (#26593, #26148)

Cross-session 1h Claude prompt cache — When you use Claude through Anthropic, OpenRouter, or Nous Portal, the prompt prefix (system prompt, skills, memory) now caches for an hour across sessions. Start a /new session and the first response comes back faster and cheaper because the cache is still warm from your last session. Background memory review hits the cache too, so it's not paying full price every turn. (#23828, #25434, #24778)

180x faster browser_console evaluations — When the agent uses the browser tool to inspect a page or run JavaScript, those calls now share one persistent connection to Chrome instead of spinning up a new DevTools session every time. The difference is huge: things that used to take a couple of seconds per call return in milliseconds. Real-world page interactions feel instant. (#23226)

Cold-start performance wave — ~19 seconds off hermes launch — Running hermes used to make you wait through a chunk of import overhead and network calls before you saw a prompt. Now the launch path is mostly deferred: heavy adapters only load when you use them, model catalogs come from disk cache first, doctor checks run in parallel, and chat -q skips the welcome banner entirely. The hermes tools All-Platforms screen alone dropped from 14 seconds to under 1.5 seconds. (#22138, #22120, #22681, #22790, #22808, #22831, #22859, #22904, #22766, #25341)

Two new messaging platforms — LINE + SimpleX Chat — LINE is huge in Japan, Korea, and Taiwan, and now Hermes runs natively on the LINE Messaging API. SimpleX Chat is the privacy-focused decentralized messenger with no user IDs — also wired up as a first-class platform. That brings Hermes to 22 messaging platforms total, so wherever you and your team chat, the agent can be there. (#23197, #26232)

/handoff actually transfers the session live — Switching models or personalities mid-conversation used to mean losing context or starting over. Now /handoff moves your active session — every message, every tool call, every piece of context — to the target model, persona, or profile, live, without dropping anything. Mid-debugging hand off from a fast model to a deep-reasoning one, or pass a session between profiles for different parts of a task. (#23395)

Native button UI for clarify on Telegram and Discord — When the agent uses the clarify tool to ask you a multiple-choice question, it now shows real platform-native buttons on Telegram and Discord instead of asking you to type back the option number. Tap the button, the agent gets your answer. Especially nice on mobile. (#24199, #25485)

Discord channel history backfill (default on) — When Hermes joins a Discord channel or thread for the first time, it now reads the recent message history so it knows what's been said before it responds. No more "what are we talking about?" — the agent has the context that's already on screen for everyone else. (#25984)

vision_analyze returns pixels to vision-capable models — When you point the agent at an image with vision_analyze and the active model can actually see (GPT-5, Claude, Gemini, Grok-vision), Hermes now passes the raw pixels straight to the model instead of converting them to a text description first. You get the model's actual visual reasoning instead of a degraded text-summary round-trip. (#22955)

Per-turn file-mutation verifier footer — After every turn that wrote or edited files, the agent now gets a short footer summarizing exactly what changed on disk — the file paths, the line counts, the actual delta. That means the agent catches its own mistakes when a write didn't land or got silently overwritten, instead of confidently telling you "I added the function" when the file wasn't actually saved. (#24498)

LSP semantic diagnostics on every write — When the agent uses write_file or patch, Hermes now runs a real language server against the edited file and surfaces any new errors back to the agent before the next turn. Type errors, undefined symbols, missing imports — caught immediately. Goes way beyond v0.13.0's basic Python/JSON/YAML/TOML linting because it's actual semantic analysis. (#24168, #25978)

Unified video_generate with pluggable provider backends — One tool, any video model. Hermes ships with the obvious backends already, but you can drop in a new video provider as a plugin without touching core. So when a new video model lands next month, it can be a one-file plugin instead of a fork. (#25126)

computer_use cua-driver backend — works with non-Anthropic models now — Computer-use (the agent controlling your mouse and keyboard to drive GUI apps) used to be locked to Anthropic's SDK. The new cua-driver backend works with non-Anthropic providers too, has proper focus-safe operations, and refreshes itself on hermes update. Now any vision-capable model can drive your desktop. (re-salvage of #16936) (#21967, #24063)

Clickable URLs in any terminal — Links in agent output are now real OSC8 hyperlinks with hover-highlight in any terminal that supports them. Click to open in your browser — no more copy-paste-trim of long URLs from the transcript. Just works in iTerm2, Kitty, Ghostty, modern Windows Terminal, etc. (@OutThisLife) (#25071, #24013)

Zed ACP Registry — uvx install in one click — Hermes is now listed in Zed's Agent Client Protocol registry, so Zed users can install it with one click. The install path uses uvx so there's no npm dependency. hermes acp --setup-browser bootstraps the browser tools for registry-driven installs. (salvage of #25908) (#26079, #26120, #26234)

OpenRouter Pareto Code router with min_coding_score knob — OpenRouter's "Pareto" router automatically picks the cheapest model that meets a minimum quality bar. The new min_coding_score config lets you set that bar for coding tasks specifically — Hermes routes to the most affordable model that's at least that good at code. Stop paying for top-tier models when a mid-tier one would do. (#22838)

NovitaAI as a new model provider — NovitaAI joins the provider lineup, giving you another option for open-source model hosting (Llama, Qwen, DeepSeek, etc.) with their pricing and rate limits. (salvage #7219) (@kshitijk4poor) (#25507)

Codex app-server runtime for OpenAI/Codex models — An optional runtime that drives OpenAI's Codex CLI under the hood when you're using OpenAI or Codex paths. You get session reuse, automatic retirement of wedged sessions, and proper OAuth refresh classification — the kind of plumbing that makes long agentic runs not fall over. (#24182, #25769)

huggingface/skills as a trusted default tap — The community skills index hosted at huggingface.co/skills is now wired into the Skills Hub by default. So when somebody publishes a useful skill there, you can install it from your own hermes skills browser without any extra config. (closes #2549) (#26219)

9 new optional skills — Hyperliquid (perp + spot trading via the SDK and REST API), Yahoo Finance (live market data, fundamentals, historicals), api-testing (REST + GraphQL debug recipes), unified EVM multi-chain (one skill covers Ethereum + L2s + Base), darwinian-evolver (evolutionary prompt/skill tuning), osint-investigation (OSINT recipes for people / domains / orgs), pinggy-tunnel (expose local services to the public internet), watchers (polls RSS / HTTP JSON / GitHub via cron no_agent mode for change detection), and a full Notion overhaul for the May 2026 Developer Platform. (#23582, #23583, #23590, #25299, #26760, #26729, #26765, #21881, #26612)

API server exposes run approval events — If you're driving Hermes programmatically through the HTTP API, long-running runs no longer silently hang when the agent hits an approval-required command. The approval request now surfaces on the API stream so your client can prompt the user and reply — no more silent stalls. (salvage of #20311) (#21899)

Plugins can run any LLM call via ctx.llm + replace built-in tools via tool_override — If you're writing a Hermes plugin, you now get first-class access to make LLM calls through the active provider and credentials — no manual client wiring. The new tool_override flag lets a plugin swap out a built-in tool with its own implementation cleanly. Plugin authors get the same model-routing and auth plumbing the core agent uses. (closes #11049) (#23194, #26759)

Brave Search (free tier) + DuckDuckGo (DDGS) as web-search providers — Two new free web-search backends join Tavily, SearXNG, and Exa. Brave Search has a generous free tier; DDGS is the DuckDuckGo scraper that needs no key at all. Pick whichever fits your budget and rate-limit needs. (#21337)

Sudo brute-force block + 3 dangerous-command bypasses closed + tool-error sanitization — The approval gate now blocks sudo -S brute-force attempts and classifies stdin-fed or askpass-stripped sudo invocations as DANGEROUS. Three known bypasses of dangerous-command detection are closed (inspired by Claude Code's command-detection work). And tool error strings are now sanitized before being re-injected into the model context, so a malicious file or remote service can't pass instructions to your agent through error output. (#23736, #26829, #26823)

/subgoal — user-added criteria appended to an active /goal — When you've got a /goal running (the persistent Ralph-loop goal where the agent keeps going until criteria are met), you can now use /subgoal to layer extra success criteria onto it mid-run. The judge factors your new criteria into the done-or-keep-going decision without restarting the loop. (#25449)

Provider rename — Alibaba Cloud → Qwen Cloud — The Alibaba Cloud provider is renamed to Qwen Cloud in the picker and config to match what the rest of the world calls it. Existing config keys still work — no breaking changes — but the UI matches the actual brand now. (#24835)

Native Windows support (early beta) — Hermes now runs natively on cmd.exe and PowerShell without WSL. A full PowerShell installer handles MinGit auto-install, Microsoft Store python stub detection, and the foreground Ctrl+C dance. There's still rough edges (this is the "early beta" stamp) — ~40 follow-up Windows-only fixes already landed in the window — but the basic loop works end-to-end on a clean Windows box. (#21561)

🪟 Windows — Native Support (Early Beta)

Bootstrap & installer

Native Windows support (early beta) — first-class native Windows path across CLI / gateway / TUI / tools (#21561)

PyPI wheel packaging — pip install hermes-agent && hermes (salvage of #26350) (#26593)

Recognise Shift+Enter as a newline key + Windows docs (salvage #21545) (#22130)

Preserve Ctrl+C for Windows foreground runs (@helix4u) (#22752)

Stop spamming cwd-missing + tirith-spawn warnings on every terminal call (#26618)

Use --extra all not --all-extras; drop lazy-covered extras from [all] (#24515)

Windows-specific fixes (40+ across cli / tools / gateway / curator / TUI)

A long tail of native-Windows fixes shipped alongside the beta — taskkill-based subprocess management, MinGit auto-install, Microsoft Store python stub detection, npm prefix handling, native PTY paths, signal handling differences, foreground process management, ANSI sequence handling, path normalization, file-locking semantics, and many more. Full list in commit log under fix(windows) / feat(windows) / windows.

🚀 Performance Wave

Cold start

Cut ~19s from hermes cold start — skills cache + lazy Feishu + no Nous HTTP at startup (#22138)

Skip eager plugin discovery on known built-in subcommands (#22120)

Cache Nous auth + .env loads — hermes tools All Platforms from 14s to <1.5s (#25341)

Skip welcome banner on chat -q single-query mode (#22904)

Defer heavy google-cloud imports in google_chat to first adapter use (#22681)

Defer QQAdapter and YuanbaoAdapter imports via PEP 562 (#22790)

Defer httpx import in teams to first webhook call (#22831)

Defer fal_client import to first generation request (#22859)

models.dev cache-first lookup, skip network when disk cache is fresh (#22808)

Parallelize API connectivity checks in hermes doctor and disable IMDS (#22766)

Runtime

180x faster browser_console evaluations — route through supervisor's persistent CDP WebSocket (#23226)

Tune Telegram cadence + adaptive fast-path for short replies (salvage of #10388) (#23587)

Accumulate length-continuation prefix via list+join (#26237)

Prompt caching

Cross-session 1h prefix cache for Claude on Anthropic / OpenRouter / Nous Portal (#23828)

Hit prefix cache in background review fork (salvage #17276 + #25427) (#25434)

📦 Installation & Distribution

PyPI + supply-chain

PyPI wheel packaging — pip install hermes-agent && hermes (salvage of #26350) (#26593)

Supply-chain advisory checker + lazy-install framework + tiered install fallback (#24220)

Use --extra all not --all-extras; drop lazy-covered extras from [all] (#24515)

Skip browser download when system chromium exists (@helix4u) (#25317)

Nix

extraDependencyGroups for sealed venv extras (@alt-glitch) (#21817)

Refresh npm lockfile hashes — keeps Nix flake builds reproducible

Docker

Bootstrap auth.json from env on first boot (#21880)

Drop manual @hermes/ink build, rely on esbuild bundle — slimmer image

ACP / Zed

Zed ACP Registry integration (salvage of #25908) (#26079)

Switch to uvx distribution, drop npm launcher (#26120)

hermes acp --setup-browser bootstraps browser tools for registry installs (#26234)

🏗️ Core Agent & Architecture

Sessions & handoff

/handoff actually transfers the session live (#23395)

Expose HERMES_SESSION_ID env var to agent tools (@alt-glitch) (#23847)

Goals (Ralph loop)

/subgoal — user-added criteria appended to active /goal (#25449)

/goal checklist + /subgoal user controls (#23456) — rolled back in window (#23813); /subgoal returned in simpler form via #25449

Compression

Make protect_first_n configurable (#25447)

Verification

Per-turn file-mutation verifier footer (#24498)

Stream retry

Log inner cause, upstream headers, bytes/elapsed on every drop (#23005)

🤖 Models & Providers

New providers

xAI Grok OAuth (SuperGrok Subscription) provider (#26534)

NovitaAI provider (salvage #7219) (@kshitijk4poor) (#25507)

NVIDIA NIM billing origin header (salvage #25211) (#26585)

Provider work

OpenRouter Pareto Code router with min_coding_score knob (#22838)

Optional codex app-server runtime for OpenAI/Codex models (#24182)

Codex-runtime: retire wedged sessions + post-tool watchdog + OAuth refresh classify (#25769)

Codex-runtime: skip unavailable plugins during migration (#25437)

Codex-runtime: de-dup [plugins.X] tables and stop leaking HERMES_HOME into config.toml (#26250) (@kshitijk4poor) (#26260)

Pass reasoning.effort to xAI Responses API (#22807)

Custom provider: prompt and persist explicit api_mode (#25068)

Rename Alibaba Cloud → Qwen Cloud, reorder picker (#24835)

Restore gpt-5.3-codex-spark for ChatGPT Pro (salvage #18286 + #19530, fixes #16172) (@kshitijk4poor) (#22991)

Inject tool-use enforcement for GLM models (#24715)

Use Nous Portal as model metadata authority (@rob-maron) (#24502)

Unified client=hermes-client-v tag on every Portal request (#24779)

Prevent stale Ollama credentials after provider switch (@kshitijk4poor) (#21703)

Auxiliary client: rotate pooled auth after quota failures (salvage #22779) (#22792)

Auxiliary client: skip providers without credentials immediately (#25395) (#25487)

Auth: send Nous refresh token via header (@shannonsands) (#21578)

MiniMax: harden OAuth dashboard and runtime (#24165)

OpenAI-compatible proxy

Local OpenAI-compatible proxy for OAuth providers — Codex / Aider / Cline can hit Claude Pro, ChatGPT Pro, SuperGrok (#25969)

📱 Messaging Platforms (Gateway)

New platforms

LINE Messaging API platform plugin (#23197)

SimpleX Chat platform plugin (salvages #2558) (#26232)

Microsoft Graph foundation

msgraph: add auth and client foundation (salvage of #21408) (#21922)

msgraph: add webhook listener platform (salvage of #21409) (#21969)

teams-pipeline: add plugin runtime and operator cli (salvage of #21410) (#22007)

teams: add pipeline outbound delivery via existing adapter (salvage of #21411) (#22024)

Cross-platform

Per-platform admin/user split for slash commands (salvage of #4443) (#23373)

Forensics on signal handling — non-blocking diag, per-phase timing, stale-unit warning (#23285)

Keep gateway running when platforms fail; add per-platform circuit breaker + /platform (#26600)

Wire clarify tool with inline keyboard buttons on Telegram (#24199)

Add chat_id to hook_ctx for message source tracking (#24710)

Telegram

Native draft streaming via sendMessageDraft (Bot API 9.5+) (salvage of #3412) (#23512)

Stream Telegram edits safely — salvage of #22264 (@kshitijk4poor) (#22518)

Telegram notification mode (salvage #22772) (#22793)

Telegram guest mention mode (@kshitijk4poor) (#22759)

Split-and-deliver oversized edits instead of silent truncation (salvage of #19537) (#23576)

Preserve DM topic routing via reply fallback (salvage #22053) (@kshitijk4poor) (#22410)

Pass source.thread_id explicitly on auto-reset notice (carve-out of #7404) (#23440)

Discord

Render clarify choices as buttons (#25485)

Channel history backfill — default on, broadened scope (#25984)

thread_require_mention for multi-bot threads (salvage #25313) (#25445)

Slack

Support !cmd as alternate prefix for slash commands in threads (#25355)

WhatsApp

Surface quoted reply metadata from Baileys (#25398) (#25489)

Feishu / Google Chat / others

Feishu: native update prompt cards (@kshitijk4poor) (#22448)

Google Chat: repair setup prompt imports (@helix4u) (#22038)

Google Chat: honor relay-declared sender_type (salvage of #22107) (@kshitijk4poor) (#22432)

LINE: use build_source instead of nonexistent create_source (#24717)

Add weixin, and more to gateway docs (salvage of #21063 by @wuwuzhijing)

🖥️ CLI & TUI

CLI

Show YOLO mode warning in banner and status bar (#26238)

Confirm prompt for destructive slash commands (#4069) (#22687)

docker_extra_args + display.timestamps (#23599)

Delegate tool: show user's actual concurrency / spawn-depth limits in description (#22694)

TUI

/sessions slash command for browsing and resuming previous sessions (@austinpickett) (#20805)

Segment turns with rule above non-first user msgs; trim ticker dead space (@OutThisLife) (#21846)

Support attaching to an existing gateway (@OutThisLife) (#21978)

Resolve markdown links to readable page titles (@OutThisLife) (#24013)

Width-aware markdown table rendering with vertical fallback (@alt-glitch) (#26195)

Keep Ink displayCursor in sync with fast-echo writes so cursor stops drifting (@OutThisLife) (#26717)

Allow transcript scroll + Esc during approval/clarify/confirm prompts (@OutThisLife) (#26414)

Preserve session when switching personality (@austinpickett) (#20942)

Skip native safety net on OSC52-capable terminals (@benbarclay) (#20954)

Dashboard / GUI

Route embedded TUI through dashboard gateway (@OutThisLife) (#21979)

Hide token/cost analytics behind config flag (default off) (#25438)

Fix Langfuse observability — trace I/O, tool outputs, placeholder credentials (closes #22342, #22763) (@kshitijk4poor) (#26320)

MiniMax 'Login' button launched Claude OAuth (salvage #22849) (#24058)

Update cron modals (@austinpickett) (#25985)

Analytics: prevent silent token loss and add Claude 4.5–4.7 pricing (@austinpickett) (#21455)

🔧 Tools & Capabilities

Vision & video

vision_analyze returns pixels to vision-capable models (#22955)

Unified video_generate with pluggable provider backends (#25126)

image_gen: actionable setup message when no FAL backend is reachable (#26222)

Computer use

computer_use cua-driver backend + focus-safe ops + non-Anthropic provider fix (re-salvage #16936) (#21967)

Refresh cua-driver on hermes update + add install --upgrade (#24063)

LSP & write-time diagnostics

Semantic diagnostics from real language servers in write_file/patch (#24168)

Shift baseline diagnostics into post-edit coordinates (#25978)

Search & web

Brave Search (free tier) and DDGS search providers (#21337)

Bearer auth header for Tavily /crawl endpoint (#24658)

X (Twitter)

Gated x_search tool with OAuth-or-API-key auth (#26763)

Browser

Route browser_console eval through supervisor's persistent CDP WS (180x faster) (#23226)

Support externally managed Camofox sessions (#24499)

MCP

supports_parallel_tool_calls for MCP servers (salvage of #9944) (#26825)

Codex preset for Codex CLI MCP server (salvage #22663) (#22679)

Stop retrying initial MCP auth failures (#25624) (#25776)

Google Workspace

Drive write ops + Docs/Sheets create/append (#21895)

Per-turn verifier

Per-turn file-mutation verifier footer (#24498)

🧩 Kanban (Multi-Agent)

specify — auxiliary LLM fleshes out triage tasks (#21435)

Orchestrator board tools — kanban_list + kanban_unblock (carve-out of #20568) (#23012)

stranded_in_ready diagnostic for unclaimed tasks (#23578)

Dashboard batch QOL upgrade (salvage of #23240) (#23550)

Tooltips and docs link across dashboard (#21541)

Dedupe notifier delivery via atomic claim + rewind on failure (salvage #22558) (#23401)

Keep notifier subscriptions alive across retry cycles (salvage #21398) (#23423)

Drop caller-controlled author override in kanban_comment (salvage of #22109) (@kshitijk4poor) (#22435)

Sanitize comment author rendering in build_worker_context (#22769)

🧠 Plugins & Extension

Plugin surface

Run any LLM call from inside a plugin via ctx.llm (#23194)

tool_override flag for replacing built-in tools (closes #11049) (#26759)

standalone_sender_fn for out-of-process cron delivery (@kshitijk4poor) (#22461)

HERMES_PLUGINS_DEBUG=1 surfaces plugin discovery logs (#22684)

Hindsight-client as optional dependency (@alt-glitch) (#21818)

Profile & distribution

Shareable profile distributions via git (#20831)

⏰ Cron

Routing intent — deliver=all fans out to every connected channel (#21495)

Support name-based lookup for job operations (#26231)

Blank Cron dashboard tab + partial-record crashes (salvage of #21042 + #22330) (@kshitijk4poor) (#22389)

Do not seed HERMES_SESSION_* contextvars from cron origin (salvage of #22356) (@kshitijk4poor) (#22382)

Scan assembled prompt including skill content for prompt injection (#3968)

🧩 Skills Ecosystem

Skills Hub

hermes-skills/huggingface as a trusted default tap (closes #2549) (#26219)

Show per-skill pages in the left sidebar (#26646)

Richer info panels on the Skills Hub (#22905)

Refuse skill_view name collisions instead of guessing (closes #6136 @polkn)

Curator

Show rename map in user-visible summary (#22910)

Hint at hermes curator pin in the rename block (#23212)

New optional skills

Hyperliquid — perp/spot trading via SDK + REST (salvage of #1952) (#23583)

Yahoo Finance market data (#23590)

api-testing (REST/GraphQL debug, salvages #1800) (#23582)

Unified EVM multi-chain skill (salvages #25291 + #2010 + folds in base/) (#25299)

darwinian-evolver (#26760)

osint-investigation (closes #355) (#26729)

pinggy-tunnel (#26765)

watchers — RSS / HTTP JSON / GitHub polling via cron no-agent (#21881)

Notion overhaul for the Developer Platform (May 2026) (#26612)

🔒 Security & Reliability

Security hardening

Sudo brute-force block + sudo-stdin/askpass DANGEROUS (salvage of #22194 + #21128) (@kshitijk4poor) (#23736)

Drop caller-controlled author override in kanban_comment (salvage of #22109) (@kshitijk4poor) (#22435)

Cover remaining SSRF fetch paths in skills-hub (salvage #22804) (#22843)

Use credential_pool for custom endpoint model listing probes (salvage #22810) (#22842)

Require dashboard auth for plugin API routes (salvage #19541) (#23220)

Sanitize env and redact output in quick commands + remove write-only _pending_messages (#23584)

Reduce unnecessary shell=True in subprocess calls (#25149)

Sanitize Google Chat sender_type from relay (salvage of #22107) (@kshitijk4poor) (#22432)

Supply-chain advisory checker (#24220)

Rewrite security policy around OS-level isolation as the boundary (@jquesnelle) (#20317)

Remove public security advisory page (#24253)

Reliability — notable bug closures

SQLite: fall back to journal_mode=DELETE on NFS/SMB/FUSE (fixes /resume on network mounts) (@kshitijk4poor) (#22043)

Codex-runtime: retire wedged sessions + post-tool watchdog + OAuth refresh classify (#25769)

Codex-runtime: de-dup [plugins.X] tables and stop leaking HERMES_HOME (#26250) (@kshitijk4poor) (#26260)

Daytona: migrate legacy-sandbox lookup to cursor-based list() (#24587)

MCP: stop retrying initial MCP auth failures (#25624) (#25776)

Gateway: enable text-intercept for multi-choice clarify fallback (#25587) (#25778)

Gateway: keep running when platforms fail; per-platform circuit breaker + /platform (#26600)

Delegate: salvage #21933 JSON-string batch + diagnostic logging (@kshitijk4poor) (#22436)

Profiles+banner: exclude infrastructure from --clone-all + fix stale update-check repo resolution (@kshitijk4poor) (#22475)

ACP: inline file attachment resources (salvage #21400 + image support) (#21407)

CI: unblock shared PR checks (@stephenschoettler) (#21012, #25957)

Notable reverts in window

/goal checklist + /subgoal feature stack — rolled back (#23813); /subgoal returned in simpler form via #25449

Scrollback box width clamp (#25975) rolled back to restore full-width borders (#26163)

fix(cli): tolerate unreadable dirs when building systemd PATH rolled back

🌍 i18n

Localize all gateway commands + web dashboard, add 8 new locales (16 total) (#22914)

📚 Documentation

Repair Voice & TTS provider table (@nightcityblade, fixes #24101) (#24138)

Show per-skill pages in the left sidebar (#26646)

Mention Weixin in gateway help and docstrings (salvage of #21063 by @wuwuzhijing)

Richer info panels on the Skills Hub (#22905)

Many more doc updates across providers, platforms, skills, Windows install paths, and dashboard.

🧪 Testing & CI

Unblock shared PR checks (@stephenschoettler) (#21012)

Stabilize shared test state after 21012 (@stephenschoettler) (#25957)

A long tail of test additions for platforms, providers, plugins, and edge cases — 8 explicit test: PRs plus ~250 fix PRs that also added regression coverage.

👥 Contributors

Core

@teknium1 — release lead, architecture, ~406 PRs merged in window

Top community contributors

@kshitijk4poor — 38 PRs · Telegram cadence/streaming/topic routing, security hardening (sudo, SSRF, kanban_comment, dashboard auth), codex-runtime hygiene, NovitaAI provider, profile/banner fixes, Feishu update cards, gateway QOL across the board

@alt-glitch — 13 PRs · Markdown-table TUI rendering, HERMES_SESSION_ID env var, hindsight-client optional dep, Nix extraDependencyGroups

@OutThisLife (Brooklyn Nicholson) — 12 PRs · TUI turn segmentation, attach-to-gateway, markdown link titles, embedded TUI via dashboard gateway, Ink cursor sync, scroll/Esc during prompts

@austinpickett — 8 PRs · /sessions slash command, personality switching preserves session, cron modals, dashboard analytics

@helix4u — 5 PRs · Google Chat setup, browser install skip on system chromium, Windows Ctrl+C preservation

@rob-maron — 4 PRs · Nous Portal as model metadata authority, provider polish

@stephenschoettler — 3 PRs · CI stabilization

@ethernet8023 — 3 PRs · platform/gateway work

All contributors (alphabetical)

@02356abc, @0xbyt4, @0xharryriddle, @1000Delta, @1RB, @29206394, @A-kamal, @aashizpoudel, @Abd0r,
@adybag14-cyber, @AgentArcLab, @ahmedbadr3, @AhmetArif0, @alblez, @Alex-yang00, @ALIYILD, @AllynSheep,
@alt-glitch, @am423, @amathxbt, @amethystani, @ArecaNon, @Arkmusn, @askclaw-vesper, @AsoTora, @austinpickett,
@aydnOktay, @ayushere, @baocin, @Bartok9, @benbarclay, @BennetYrWang, @Bihruze, @binhnt92, @briandevans,
@brooklynnicholson, @btorresgil, @buntingszn, @CalmProton, @chrisworksai, @CoinTheHat, @dandacompany, @Dangooy,
@DanielLSM, @David-0x221Eight, @ddupont808, @dhruv-saxena, @diablozzc, @dlkakbs, @dmahan93, @dmnkhorvath,
@domtriola, @donrhmexe, @Dusk1e, @eloklam, @emozilla, @ephron-ren, @ErenKarakus, @EthanGuo-coder,
@ethernet8023, @evgyur, @explainanalyze, @fahdad, @fr33d3m0n, @Freeman-Consulting, @freqyfreqy, @Frowtek,
@fu576, @github-actions[bot], @gnanirahulnutakki, @GodsBoy, @guglielmofonda, @Gutslabs, @hanzckernel,
@heathley, @hekaru-agent, @helix4u, @HenkDz, @HiddenPuppy, @hllqkb, @hrygo, @HuangYuChuh, @Hugo-SEQUIER, @HxT9,
@iacker, @InB4DevOps, @isaachuangGMICLOUD, @iuyup, @Jaaneek, @jackey8616, @jackjin1997, @Jaggia, @jak983464779,
@jelrod27, @jethac, @JithendraNara, @johnisag, @Julientalbot, @Jwd-gity, @kallidean, @keyuyuan, @kfa-ai,
@kidonng, @KiraKatana, @kjames2001, @konsisumer, @Korkyzer, @kshitijk4poor, @KvnGz, @lars-hagen, @leehack,
@leepoweii, @LeonSGP43, @li0near, @libo1106, @liquidchen, @littlewwwhite, @liuhao1024, @liyoungc, @luandiasrj,
@luoyuctl, @luyao618, @magic524, @mbac, @McClean, @memosr, @Mibayy, @ming1523, @mizgyo, @mrshu, @ms-alan,
@MustafaKara7, @nederev, @nicoechaniz, @nidhi-singh02, @nightcityblade, @nik1t7n, @Ninso112, @NivOO5,
@novax635, @nv-kasikritc, @oferlaor, @oswaldb22, @outdoorsea, @oxngon, @PaTTeeL, @pearjelly, @pefontana,
@perng, @PhilipAD, @phuongvm, @polkn, @Prasanna28Devadiga, @princepal9120, @pty819, @purzbeats, @Quarkex,
@quocanh261997, @qWaitCrypto, @Qwinty, @rahimsais, @raymaylee, @ReqX, @rewbs, @RhombusMaximus, @rob-maron,
@Ruzzgar, @ryptotalent, @Sanjays2402, @shannonsands, @shaun0927, @SiliconID, @silv-mt-holdings, @simpolism,
@smwbev, @soichiyo, @sprmn24, @steezkelly, @stephenschoettler, @Sylw3ster, @szymonclawd, @teyrebaz33,
@Tianyu199509, @Tranquil-Flow, @TreyDong, @TurgutKural, @tw2818, @tymrtn, @uzunkuyruk, @v1b3coder,
@vanthinh6886, @VinceZcrikl, @vKongv, @vominh1919, @voteblake, @VTRiot, @wali-reheman, @wesleysimplicio,
@wilsen0, @WorldWriter, @worlldz, @wuli666, @wuwuzhijing, @Wysie, @XiaoXiao0221, @xieNniu, @xxxigm, @yehuosi,
@ygd58, @yifengingit, @yuga-hashimoto, @zccyman, @ZeterMordio, @Zhekinmaksim, @zhengyn0001

Also: @Nagatha (Claude Opus 4.7).

Full Changelog: v2026.5.7...v2026.5.16

Original source

Hermes Agent v0.13.0 (v2026.5.7)
Release Date: May 7, 2026
Since v0.12.0: 864 commits · 588 merged PRs · 829 files changed · 128,366 insertions · 282 issues closed (13 P0, 36 P1) · 295 community contributors (including co-authors)
The Tenacity Release — Hermes Agent now finishes what it starts. Kanban ships as a durable multi-agent board (heartbeat, reclaim, zombie detection, auto-block on incomplete exit, per-task retries, hallucination recovery). /goal keeps the agent locked on a target across turns (Ralph loop). Checkpoints v2 rewrites state persistence with real pruning. Gateway auto-resumes interrupted sessions after restart. Cron grows a no_agent watchdog mode. A security wave closes 8 P0s — redaction is now ON by default, Discord role-allowlists are guild-scoped, WhatsApp rejects strangers by default, and TOCTOU windows close across auth.json and MCP OAuth. Google Chat becomes the 20th platform. Providers become a pluggable surface. Seven i18n locales ship.
✨ Highlights
Multi-agent Kanban — delegate to an AI team that actually finishes — Spin up a durable board, drop tasks on it, and let multiple Hermes workers pick them up, hand off, and close them out. Heartbeats, reclaim, zombie detection, retry budgets, and a hallucination gate keep the team honest. One install, many kanbans. (#17805, #19653, #20232, #20332, #21330, #21183, #21214)
/goal — the agent doesn't forget what you asked it to do — Lock the agent onto a target and it stays on task across turns. The Ralph loop as a first-class primitive. (#18262, #18275, #21287)
Show it a video — new video_analyze tool for native video understanding on Gemini and compatible multimodal models. (@alt-glitch) (#19301)
Clone a voice — xAI Custom Voices lands as a TTS provider with voice cloning support. (@alt-glitch) (#18776)
Hermes speaks your language — static gateway + CLI messages translate to 7 locales: Chinese, Japanese, German, Spanish, French, Ukrainian, and Turkish. Docs site gains a Chinese (zh-Hans) locale. (#20231, #20329, #20467, #20474, #20430, #20431)
Google Chat — the 20th messaging platform — plus a generic platform-plugin hooks surface so third-party adapters drop in without touching core (IRC and Teams migrated). (#21306, #21331)
Sessions survive restarts — gateway bounces mid-agent, /update restarts, source-file reloads — conversations auto-resume when the gateway comes back. (#21192)
Security wave — 8 P0 closures — redaction ON by default, Discord role-allowlists guild-scoped (CVSS 8.1 cross-guild DM bypass closed), WhatsApp rejects strangers by default, TOCTOU windows closed across auth.json and MCP OAuth, browser enforces cloud-metadata SSRF floor, cron prompt-injection scans assembled skill content, hermes debug share redacts at upload. (#21193, #21241, #21291, #21176, #21194, #21228, #21350, #19318)
Checkpoints v2 — state persistence rewritten. Real pruning, disk guardrails, no more orphan shadow repos. (#20709)
The agent lints its own writes — post-write delta lint on write_file + patch. Python, JSON, YAML, TOML. Syntax errors surface immediately instead of shipping downstream. (#20191)
no_agent cron mode — script-only watchdog — cron jobs can now skip the agent entirely and just run a script. Empty stdout is silent, non-empty gets delivered verbatim. (#19709)
Platform allowlists everywhere — allowed_channels / allowed_chats / allowed_rooms config across Slack, Telegram, Mattermost, Matrix, and DingTalk. (#21251)
Providers are now plugins — ProviderProfile ABC + plugins/model-providers/. Drop in third-party providers without touching core. (#20324)
API server — long-term memory per session — X-Hermes-Session-Key header gives memory providers a stable session identifier. (#20199)
MCP levels up — SSE transport with OAuth forwarding, stale-pipe retries, image results surface as MEDIA tags instead of getting dropped, keepalive on long-lived lifecycle waits. (#21227, #21323, #21289, #21328, #20209)
Curator grows subcommands — hermes curator archive, prune, list-archived. Manual hermes curator run is synchronous now — you see results without polling. (#20200, #21236, #21216)
ACP — /steer and /queue — direct the in-flight agent or queue follow-ups from Zed, VS Code, or JetBrains. Plus atomic session persistence and reasoning-metadata preservation across restarts. (@HenkDz) (#18114, #20279, #20296, #20433)
TUI glow-up — /model picker matches hermes model with inline auth (@austinpickett), collapsible startup banner sections (@kshitijk4poor), context-compression counter in the status bar. (#18117, #20625, #21218)
Dashboard grows up — Plugins page (manage, enable/disable, auth status) (@austinpickett), Profiles management page (@vincez-hms-coder), sortable analytics tables, reverse-proxy support via X-Forwarded-Prefix, new default-large 18px theme. (#18095, #16419, #18192, #21296, #20820)
SearXNG + split web tools — SearXNG ships as a native search-only backend; web tools now let you pick different backends per capability (search vs extract vs browse). (@kshitijk4poor) (#20823, #20061, #20841)
OpenRouter response caching — explicit cache control for models that expose it. (@kshitijk4poor) (#19132)
[[as_document]] — skill media-routing directive — skills can force the gateway to deliver output as a document on platforms that support it. (#21210)
transform_llm_output plugin hook — new lifecycle hook that lets plugins reshape or filter LLM output before it hits the conversation. Useful for context-window reducers and content filters. (#21235)
Nous OAuth persists across profiles — shared token store: sign in once, every profile inherits the session. (#19712)
QQBot — native approval keyboards — feature parity with Telegram / Discord approval UX. Chunked upload, quoted attachments. (#21342, #21353)
6 new optional skills — Shopify (Admin + Storefront GraphQL), here.now, shop-app personal shopping assistant, Anthropic financial-services bundle, kanban-video-orchestrator (@SHL0MS), searxng-search (@kshitijk4poor). (#18116, #18170, #20702, #21180, #19281, #20841)
New models — deepseek/deepseek-v4-pro, x-ai/grok-4.3, openrouter/owl-alpha (free), tencent/hy3-preview (@Contentment003111), Arcee Trinity Large Thinking temperature + compression overrides. (#20495, #20497, #18071, #21077, #20473)
100 fresh CLI startup tips — the random tip banner gets 100 new entries covering cron, kanban, curator, plugins, and lesser-known flags. (#20168)
🧩 Multi-Agent Kanban (Durable)
New — durable multi-profile collaboration board
feat(kanban): durable multi-profile collaboration board — post-revert reimplementation, multi-profile by design (#17805)
Multi-project boards — one install, many kanbans (#19653, #19679)
Share board, workspaces, and worker logs across profiles (#19378)
Hallucination gate + recovery UX for worker-created-card claims (closes #20017) (#20232)
Generic diagnostics engine for task distress signals (#20332)
Per-task max_retries override (supersedes #20972) (#21330)
Multiline textarea for inline-create title (salvage of #20970) (#21243)
Kanban Dashboard
Workspace kind + path inputs in inline create form (#19679)
Per-platform home-channel notification toggles (#19864)
Sharper home-channel toggle contrast + drop → running action (#19916)
Fix: reject direct status transition to 'running' via dashboard API (salvage of #19554) (#19705)
Fix: dashboard board pin authoritative over server current file (#20879) (#21230)
Fix: treat dashboard event-stream cancellation as normal shutdown (#20790) (#21222)
Fix: filter dashboard board by selected tenant (#19817) (#21349)
Fix: code/pre styling theme-immune across all themes (#21086) (#21247)
Fix: reset <code> background inside dashboard board (#20687)
Fix: preserve dashboard completion summaries + add kanban edit (salvages #20016) (#20195)
Fix: avoid fragile failure-column renames (salvage #20848) (@kshitijk4poor) (#20855)
Worker lifecycle + reliability
Heartbeat + reclaim + zombie + retry-cap fixes (#21147, #21141, #21169, #20881) (#21183)
Auto-block workers that exit without completing + shutdown race (#20894) (#21214)
Detect darwin zombie workers (salvages #20023) (#20188)
Unify failure counter across spawn/timeout/crash outcomes (#20410)
Enforce worker task-ownership on destructive tool calls (#19713)
Drop worker identity claim from KANBAN_GUIDANCE (#19427)
Fix: skip dispatch for tasks assigned to non-profile lanes (salvages #20105, #20134) (#20165)
Fix: include default profile in on-disk assignee enumeration (salvages #20123) (#20170)
Fix: ignore stale current board pointers (salvages #20063) (#20183)
Fix: profile discovery ignores HERMES_HOME in custom-root deployments (@jackey8616) (#19020)
Fix: allow orchestrator profiles to see kanban tools via toolsets config (#19606)
Batch salvages
Tier-1 batch — metadata test, max_spawn config, run-id lifecycle guard (salvages #19522 #19556 #19829) (#20440)
Tier-2 batch — doctor, started_at, parent-guard, latest_summary, selects, linked-children (#20448)
Documentation
Backfill multi-board refs in reference docs (#19704)
Document /kanban slash command (#19584)
Document recommended handoff evidence metadata (salvage #19512) (#20415)
Fix orchestrator + worker skill setup instructions (@helix4u) (#20958, #20960)
🎯 Persistent Goals, Checkpoints & Session Durability
/goal — persistent cross-turn goals (Ralph loop)
feat: /goal — persistent cross-turn goals (#18262)
Docs page — Persistent Goals (/goal) (#18275)
Fix: honor configured goal turn budget (salvage #19423) (#21287)
Checkpoints v2
Single-store rewrite with real pruning + disk guardrails (#20709)
Session durability
Auto-resume interrupted sessions after gateway restart (salvage #20888) (#21192)
Preserve pending update prompts across restarts (#20160)
Preserve home-channel thread targets across restart notifications (salvage #18440) (#19271)
Preserve thread routing from cached live session sources (#21206)
Preserve assistant metadata when branching sessions (#18222)
Preserve thread routing for /update progress and prompts (#18193)
Preserve document type when merging queued events (#18215)
🛡️ Security & Reliability
Security hardening (8 P0 closures)
Enable secret redaction by default (#17691, #20785) (#21193)
Discord — scope DISCORD_ALLOWED_ROLES to originating guild (#12136, CVSS 8.1) (#21241)
WhatsApp — reject strangers by default, never respond in self-chat (#8389) (#21291)
MCP OAuth — close TOCTOU window when saving credentials (#21176)
hermes_cli/auth.py — close TOCTOU window in credential writers (#21194)
Browser — enforce cloud-metadata SSRF floor in hybrid routing (#16234) (#21228)
hermes debug share — redact log content at upload time (@GodsBoy) (#19318)
Cron — scan assembled prompt including skill content for prompt injection (#3968) (#21350)
Restore .env/auth.json/state.db with 0600 perms (#19699)
SRI integrity for dashboard plugin scripts (salvage #19389) (#21277)
Bind Meet node server to localhost, restrict token file to owner read (#19597)
Extend sensitive-write target to cover shell RC and credential files (#19282)
Harden YOLO mode env parsing against quoted-bool strings (#18214)
OSV-Scanner CI + Dependabot for github-actions only (#20037)
Reliability — critical bug closures
CLI crash on startup — Invalid key 'c-S-c' (P0, prompt_toolkit doesn't support Shift modifier) (#19895, #19919)
CLOSE_WAIT fd leak audit — httpx keepalive + WhatsApp aiohttp leak + Feishu hygiene (#18451) (#18766)
Gateway creates AIAgent with empty OpenRouter API key when OPENROUTER_API_KEY is missing (#20982) — fallback providers correctly honored
Background review + curator protected from overwriting bundled/hub skills (#20273) (#20194)
TUI compression continuation — ghost sessions with incomplete metadata (#20001)
hermes mcp add silently launches chat instead of registering MCP server (#19785) (#21204)
Background review agent runtime propagation — provider/model/credentials now actually inherit from parent
Inbound document host paths translated to container paths for Docker backend (salvage #19048) (#21184)
Matrix gateway race between auto-redaction and message delivery with high-speed models (#19075)
/new during active agent session never sends response on Telegram (#18912)
📱 Messaging Platforms (Gateway)
New platform
Google Chat — 20th platform + generic env_enablement_fn / cron_deliver_env_var platform-plugin hooks (IRC + Teams migrated) (#21306, #21331)
Cross-platform
allowed_{channels,chats,rooms} whitelist — Slack (salvage #7401), Telegram, Mattermost, Matrix, DingTalk (#21251)
Per-platform gateway_restart_notification flag (#20892)
busy_ack_enabled config — suppress ack messages (#18194)
Auto-delete slash-command system notices after TTL (#18266)
Opt-in cleanup of temporary progress bubbles (#21186)
[[as_document]] directive — skill media routing (salvage #19069) (#21210)
hermes gateway list — cross-profile status (salvage #19129) (#21225)
Auto-resume interrupted sessions after restart (salvage #20888) (#21192)
Atomic restart markers + Windows runtime-lock offset (#17842) (#18179)
Fix: config.yaml wins over .env for agent/display/timezone settings (#18764)
Fix: auto-restart when source files change out from under us (#17648) (#18409)
Fix: use git HEAD SHA for stale-code check, not file mtimes (#19740)
Fix: shutdown + restart hygiene — drain timeout, false-fatal, success log (#18761)
Fix: preserve max_turns after env reload (salvage #19183) (#21240)
Fix: exclude ancestor PIDs from gateway process scan (#19586)
Fix: move quick-command alias dispatch before built-ins (#19588)
Fix: show other profiles in 'gateway status' to prevent confusion (#19582)
Fix: include external_dirs skills in Telegram/Discord slash commands (salvage #8790) (#18741)
Fix: match disabled/optional skills by frontmatter slug, not dir name (#18753)
Fix: read /status token totals from SessionDB (#17158) (#18206)
Fix: snapshot callback generation after agent binds it, not before (#18219)
Fix: re-inject topic-bound skill after /new or /reset (#18205)
Fix: isolate pending native image paths by session (#18202)
Fix: clear queued reload skills notes on new/resume/branch (#19431)
Fix: hide required-arg commands from Telegram menu (#19400)
Fix: bridge top-level require_mention to Telegram config (#19429)
Fix: suppress duplicate voice transcripts (#19428)
Fix: show friendly error when service is not installed (#19707)
Fix: read context_length from custom_providers in session info header (#19708)
Fix: preserve WSL interop PATH in systemd units (#19867)
Fix: handle planned service stops (salvage #19876) (#19936)
Fix: keep DoH-confirmed Telegram IPs that match system DNS (salvage #17043) (#20175)
Fix: load reply_to_mode from config.yaml for Discord + Telegram (salvage #17117) (#20171)
Fix: tolerate malformed HERMES_HUMAN_DELAY_* env vars (salvage #16933) (#20217)
Fix: deterministic thread eviction preserves newest entries (salvage #13639) (#20285)
Fix: don't dead-end setup wizard when only system-scope unit is installed (#20905)
Fix: wait for systemd restart readiness + harden Discord slash-command sync (#20949)
Fix: avoid duplicated Responses history (salvage #18995) (#21185)
Fix: surface bootstrap failures to stderr (salvage #21157) (#21278)
Fix: log agent task failures instead of silently losing usage data (salvage #21159) (#21274)
Fix: log runtime-status write failures with rate-limiting (salvage #21158) (#21285)
Fix: reset-failed before every fallback restart so the gateway can't get stranded (#21371)
Fix: Telegram — preserve thread_id=1 for forum General typing indicator (#21390)
Fix: batch critical fixes — session resume, /new race, HA WebSocket scheme (@kshitijk4poor) (#19182)
Telegram
DM user-managed multi-session topics (salvage of #19185) (#19206)
Discord
Message deletion action (salvage #19052) (#21197)
Fix: allow free_response_channels to override DISCORD_IGNORE_NO_MENTION (#19629)
Slack
Fix: ephemeral slash-command ack, private notice delivery, format_message fixes (@kshitijk4poor) (#18198)
WhatsApp
Fix: load WhatsApp home channel from env overrides (#18190)
Feishu
Operator-configurable bot admission and mention policy (#18208)
Fix: force text mode for markdown tables (salvage of #13723 by @WuTianyi123) (#20275)
Matrix + Email
Fix: /sethome on Matrix and Email now persists across restarts (#18272)
Teams
Docs + feat: sidebar + threading with group-chat fallback (#20042)
Weixin
Fix: deduplicate Weixin messages by content fingerprint (#19742)
QQBot
Port SDK improvements in-tree — chunked upload, approval keyboards, quoted attachments (#21342)
Wire native tool-approval UX via inline keyboards (#21353)
🏗️ Core Agent & Architecture
Provider & Model Support
Pluggable providers
ProviderProfile ABC + plugins/model-providers/ — inference providers are now a pluggable surface (salvage of #14424) (#20324)
list_picker_providers — credential-filtered picker (salvage #13561) (#20298)
Remove /provider alias for /model (#20358)
Shared Hermes dotenv loader across CLI + plugins (salvage #13660) (#20281)
Nous OAuth persisted across profiles via shared token store (#19712)
New models
deepseek/deepseek-v4-pro added to OpenRouter + Nous Portal (#20495)
x-ai/grok-4.3 added to OpenRouter + Nous Portal (#20497)
openrouter/owl-alpha (free tier) added to curated OpenRouter list (#18071)
tencent/hy3-preview paid route on OpenRouter (@Contentment003111) (#21077)
Arcee Trinity Large Thinking — temperature + compression overrides (#20473)
Rename x-ai/grok-4.20-beta to x-ai/grok-4.20 (#19640)
Demote Vercel AI Gateway to bottom of provider picker (#18112)
Provider configuration
OpenRouter — response caching support (@kshitijk4poor) (#19132)
image_gen.model from config.yaml honored (salvage #19376) (#21273)
Fix: honor runtime default model during delegate provider resolution (@johnncenae) (#17587)
Fix: avoid Bedrock credential probe in provider picker (@helix4u) (#18998)
Fix: drop stale env-var override of persisted provider for cron (#19627)
Fix: auxiliary curator api_key/base_url into runtime resolution (#19421)
Agent Loop & Conversation
video_analyze — native video understanding tool (@alt-glitch) (#19301)
Show context compression count in status bar (CLI + TUI) (#21218)
Isolate get_tool_definitions quiet_mode cache + dedup LCM injection (#17335) (#17889)
Fix: warning-first tool-call loop guardrails (#18227)
Fix: break permanent empty-response loop from orphan tool-tail (#21385)
Fix: propagate ContextVars to concurrent tool worker threads (salvage #16660) (#18123)
Fix: surface self-improvement review summaries across CLI, TUI, and gateway (#18073)
Fix: serialize concurrent hermes_tools RPC calls from execute_code (#17894, #17902)
Fix: include system prompt + tool schemas in token estimates for compression (#18265)
Compression
Fix: skip non-string tool content in dedup pass to prevent AttributeError (#19398)
Fix: reset _summary_failure_cooldown_until on session reset (#19622)
Fix: trigger fallback on timeout errors alongside model-unavailable errors (#19665)
Fix: _prune_old_tool_results boundary direction (#19725)
Fix: soften summary prompt for content filters (salvage #19456) (#21302)
Delegate
Fix: inherit parent fallback_chain in _build_child_agent (#19601)
Fix: guard _load_config() against delegation: null in config.yaml (#19662)
Fix: inherit parent api_key when delegation.base_url set without delegation.api_key (#19741)
Fix: expand composite toolsets before intersection (salvage #19455) (#21300)
Fix: correct ACP docs — Claude Code CLI has no --acp flag (salvage #19058) (#21201)
Session & Memory
Hindsight — probe API for update_mode='append' to dedupe across processes (@nicoloboschi) (#20222)
Curator
hermes curator archive and prune subcommands (#20200)
hermes curator list-archived (#20651) (#21236)
Synchronous manual hermes curator run (#20555) (#21216)
Fix: preserve last_report_path in state (#18169)
Fix: rewrite cron job skill refs after consolidation (#18253)
Fix: defer first run + --dry-run preview (#18373) (#18389)
Fix: authoritative absorbed_into on delete + restore cron skill links on rollback (#18671) (#18731)
Fix: prevent false-positive consolidation from substring matching (#19573)
Fix: only mark agent-created for background-review sediment (#19621)
Fix: protect hub skills by frontmatter name (#20194)
🔧 Tool System
File tools
Post-write delta lint on write_file + patch — in-proc linters for Python, JSON, YAML, TOML (#20191)
Cron
no_agent mode — script-only cron jobs (watchdog pattern) (#19709)
context_from chaining docs (salvage #15724) (#20394)
Fix: treat non-dict origin as missing instead of crashing tick (#19283)
Fix: bump skill usage when cron jobs load skills (#19433)
Fix: recover null next_run_at jobs (#19576)
Fix: skip AI call when prerun script produces no output (#19628)
Fix: expand config.yaml refs during job execution (#19872)
Fix: serialize get_due_jobs writes to prevent parallel state corruption (#19874)
Fix: initialize MCP servers before constructing the cron AIAgent (#21354)
MCP
SSE transport support (salvage #19135) (#21227)
Forward OAuth auth + bump sse_read_timeout on SSE transport (#21323)
Retry stale pipe transport failures as session-expired (#21289)
Surface image tool results as MEDIA tags instead of dropping them (#21328)
Periodic keepalive to wait_for_lifecycle_event (salvage #17016) (#20209)
Fix: reconnect on terminated sessions (#19380)
Fix: decouple AnyUrl import from mcp dependency (#19695)
Fix: mcp add --command gets distinct argparse dest (#21204)
Fix: clear stale thread interrupt before MCP discovery (#21276)
Fix: report configured timeout in MCP call errors (#21281)
Fix: include exception type in error messages when str(exc) is empty (salvage #19425) (#21292)
Fix: re-raise CancelledError explicitly in MCPServerTask.run (#21318)
Fix: coerce numeric tool args defensively in mcp_serve (#21329)
Fix: gate utility stubs on server-advertised capabilities (#21347)
Browser
Fix: allow explicit CDP override without local agent-browser (#19670)
Fix: inject --no-sandbox for root + AppArmor userns restrictions (#19747)
Fix: tighten Lightpanda fallback edge cases (@kshitijk4poor) (#20672)
Web tools
Per-capability backend selection — search/extract split (@kshitijk4poor) (#20061)
SearXNG native search-only backend (@kshitijk4poor) (#20823)
Approval / Tool gating
Fix: wake blocked gateway approvals on session cleanup (#18171)
Fix: harden YOLO mode env parsing against quoted-bool strings (#18214)
Fix: extend sensitive write target to cover shell RC and credential files (#19282)
🔌 Plugin System
transform_llm_output plugin hook (salvage of #20813) (#21235)
Document env_enablement_fn + cron_deliver_env_var platform-plugin hooks (#21331)
Pluggable surfaces coverage — model-provider guide, full plugin map, opt-in fix (#20749)
Plugin-authoring gaps — image-gen provider guide + publishing a skill tap (#20800)
🧩 Skills Ecosystem
New optional skills
Shopify — Admin + Storefront GraphQL optional skill (#18116)
here.now — optional skill (#18170)
shop-app — personal shopping assistant (optional) (#20702)
Anthropic financial-services bundle — ported as optional finance skills (#21180)
kanban-video-orchestrator — creative optional skill (@SHL0MS) (#19281)
searxng-search — optional skill + Web Search + Extract docs page (@kshitijk4poor) (#20841, #20844)
Skill UX
Linear skill — add Documents support + Python helper script (#20752)
Modernize Obsidian skill to use file tools (salvage #19332) (#20413)
Default custom tool creation to plugins (@kshitijk4poor) (#19755)
skill_commands cache — rescan on platform scope changes (salvage #14570 by @LeonSGP43) (#18739)
Skills — additional rescan paths in skill_commands cache (salvage #19042) (#21181)
Fix: regression tests for non-dict metadata in extract_skill_conditions (#18213)
Docs: explain restoring bundled skills (salvage #19254) (#20404)
Docs: document hermes skills reset subcommand (salvage #11544) (#20395)
Docs: himalaya v1.2.0 folder.aliases syntax (#19882)
Point agent at hermes-agent skill + docs site sync (#20390)
🖥️ CLI & User Experience
CLI
/new accepts optional session name argument (salvage of #19555) (#19637)
100 new CLI startup tips (#20168)
display.language — static message translation (zh/ja/de/es) (#20231)
French (fr) locale (@Foolafroos) (#20329)
Ukrainian (uk) locale (#20467)
Turkish (tr) locale (#20474)
Fix: recover classic CLI output after resize (@helix4u) (#20444)
Fix: complete absolute paths as paths (@helix4u) (#19930)
Fix: resolve lazy session creation regressions (#18370 fallout) (@alt-glitch) (#20363)
Fix: local backend CLI always uses launch directory (@alt-glitch) (#19334)
Refactor: drop dead c-S-c key binding (follow-up to #19895) (#19919)
TUI (Ink)
/model picker overhaul to match hermes model with inline auth (@austinpickett) (#18117)
Collapsible sections in startup banner — skills, system prompt, MCP (@kshitijk4poor) (#20625)
Show context compression count in status bar (#21218)
Perf: reduce overlay render churn with focused selectors (@OutThisLife) (#20393)
Fix: restore voice push-to-talk parity (salvage of #16189 by @Montbra) (@OutThisLife) (#20897)
Fix: kanban button (@austinpickett) (#18358)
Dashboard
Plugins page — manage, enable/disable, auth status (@austinpickett) (#18095)
Profiles management page (@vincez-hms-coder) (#16419)
Interactive column sorting in analytics tables (#18192)
default-large built-in theme with 18px base size (#20820)
Support serving under URL prefix via X-Forwarded-Prefix (salvage #19450) (#21296)
Launch dashboard as side-process via HERMES_DASHBOARD=1 in Docker (@benbarclay) (#19540)
Fix: dashboard theme layout shift (@AllardQuek) (#17232)
Fix: gateway model picker current context (@helix4u) (#20513)
Update + setup
hermes update --yes/-y to skip interactive prompts (#18261)
Restart manual profile gateways after update (#18178)
Profiles
--no-skills flag for empty profile creation (#20986)
🎵 Voice, Image & Media
xAI Custom Voices — voice cloning (@alt-glitch) (#18776)
Achievements — share card render on unlocked badges (#19657)
Refresh systemd unit on gateway boot (not just start/restart) (@alt-glitch) (#19684)
🔗 API Server & Remote Access
X-Hermes-Session-Key header for long-term memory scoping (closes #20060) (#20199)
🧰 ACP Adapter (VS Code / Zed / JetBrains)
/steer and /queue slash commands (@HenkDz) (#18114)
Fix: translate Windows cwd for WSL sessions (salvage #18128) (#18233)
Fix: run /steer as a regular prompt on idle sessions (#18258)
Fix: route Zed thoughts to reasoning + polish tool/context rendering (#19139)
Fix: atomic session persistence via replace_messages (salvage #13675) (#20279)
Fix: preserve assistant reasoning metadata in session persistence (salvage #13575) (#20296)
Docs: update VS Code setup for ACP Client extension (salvage #12495) (#20433)
🐳 Docker
Launch dashboard as side-process via HERMES_DASHBOARD=1 (@benbarclay) (#19540)
Refuse root gateway runs in official image (salvage #19215) (#21250)
Chown runtime node_modules trees to hermes user (salvage #19303) (#21267)
Fix: exclude compose/profile runtime state from build context (#19626)
CI: don't cancel overlapping builds, guard :latest (@ethernet8023) (#20890)
Test: align Dockerfile contract tests with simplified TUI flow (salvage #19024) (#21174)
Docs: connect to local inference servers (vLLM, Ollama) (salvage #12335) (#20407)
Docs: document API_SERVER* env vars (salvage #11758) (#20409)
Docs: clarify Docker terminal backend is a single persistent container (#20003)
🐛 Notable Bug Fixes
Agent
Fix: recover lazy session creation regressions (#18370 fallout) (@alt-glitch) (#20363)
Fix: propagate ContextVars to concurrent tool worker threads (salvage #16660) (#18123)
Fix: warning-first tool-call loop guardrails (#18227)
Fix: surface self-improvement review summaries across CLI, TUI, and gateway (#18073)
Gateway streaming
Fix: harden StreamingConfig bool and numeric coercion (@simbam99) (#16463)
Model
Fix: avoid Bedrock credential probe in provider picker (@helix4u) (#18998)
Doctor
Fix: check global agent-browser when local install not found (#19671)
Test: kimi-coding-cn provider validation regression (#19734)
Update
Fix: patch isatty on real streams to fix xdist-flaky --yes tests (salvage #19026) (#21175)
Fix: teach restart-mocks about the post-update survivor sweep (salvage #19031) (#21177)
Auth
Fix: acp preserve assistant reasoning metadata (#20296)
Redact
Fix: add code_file param to skip false-positive ENV/JSON patterns (#19715)
Email
Fix: quoted-relative file-drop paths + Date header on tool email path (#19646)
🧪 Testing
ACP — accept prompt persistence kwargs in MCP E2E mocks (@stephenschoettler) (#18047)
Toolsets — include kanban in expected post-#17805 toolset assertions (@briandevans) (#18122)
Agent — cover max-iterations summary message sanitization (#19580)
run_agent — -inf and nan regression coverage for _coerce_number (#19703)
📚 Documentation
Major docs additions
llms.txt + llms-full.txt — agent-friendly ingestion (#18276)
User Stories and Use Cases collage page (#18282)
Persistent Goals (/goal) feature page (#18275)
Windows (WSL2) guide expansion — filesystem, networking, services, pitfalls (#20748)
Chinese (zh-CN) README translation (salvage #13508) (#20431)
zh-Hans Docusaurus locale + Tool Gateway / image-gen / WSL quickstart translations (salvage #11728) (#20430)
Tool Gateway docs restructure — lead with what it does, config moved to bottom (#20827)
Quickstart — Onchain AI Garage Hermes tutorials playlist (#20192)
Open WebUI bootstrap script (salvage #9566) (#20427)
Local Ollama setup guide (salvage #5842) (#20426)
Google Gemini guide (salvage #17450) (#20401)
Custom model aliases for /model command (#20475)
Together/Groq/Perplexity cookbook via custom_providers (salvage #15214) (#20400)
Doubao speech integration examples (TTS + STT) (salvage #18065) (#20418)
WSL-to-Windows Chrome MCP bridge (salvage #8313) (#20428)
Hermes skills docs sync — slash commands + durable-systems section (#20390)
AGENTS.md — curator/cron/delegation/toolsets + fix plugin tree (#20226)
Bedrock quickstart entry + fallback comment + deployment link (salvage #11093) (#20397)
Docs polish
Collapse exploding skills tree to a single Skills node (#18259)
Clarify session_search auxiliary model docs (#19593)
Open WebUI Quick Setup gap fill (#19654)
Default custom tool creation to plugins (@kshitijk4poor) (#19755)
Clarify Telegram group chat troubleshooting (salvage #18672) (#20416)
Codex OAuth auth prerequisite clarification (salvage #18688) (#20417)
Discord Server Members Intent + SSRC-mapping drift + /voice join slash Choice (salvage #11350) (#20411)
Document ctx.dispatch_tool() (salvage #10955) (#20391)
Document hermes webhook subscribe --deliver-only (salvage #12612) (#20392)
Document hermes import reference (salvage #14711) (#20396)
Document per-provider TTS max_text_length caps (salvage #13825) (#20389)
Clarify supported prompt customization surfaces (salvage #19987) (#20383)
Correct web_extract summarizer timeout comment (salvage #20051) (#20381)
Fix fallback provider config paths (salvage #20033) (#20382)
Fix misleading RL install-extras claim (salvage #19080) (#21213)
Clarify API server tool execution locality (salvage #19117) (#21223)
Prefer .venv to match AGENTS.md and scripts/run_tests.sh (@xxxigm) (#21334)
Align tool discovery + test runner with AGENTS.md (@xxxigm) (#20791)
Align terminal-backend count and naming across docs and code (salvage #19044) (#20402)
Refresh stale platform counts (salvage #19053) (#20403)
👥 Contributors
Core
@teknium1 — salvage, triage, review, feature work, and release management
Top Community Contributors
@kshitijk4poor (21 PRs) — SearXNG native search backend, per-capability backend selection, collapsible TUI startup banner, Slack ephemeral ack + format fixes, Lightpanda fallback hardening, searxng-search optional skill + Web Search + Extract docs, default custom tool creation to plugins, kanban failure-column fix
@alt-glitch (13 PRs) — video_analyze tool, xAI Custom Voices (voice cloning), local-backend CLI launch-directory fix, lazy-session creation regression recovery, systemd unit refresh on gateway boot
@OutThisLife (9 PRs) — TUI perf — overlay render churn reduction, voice push-to-talk parity restoration (salvaging @Montbra)
@helix4u (6 PRs) — Classic CLI output recovery after resize, absolute-path TUI completion, gateway model picker current-context fix, Bedrock credential probe avoidance, kanban docs fixes
@ethernet8023 (3 PRs) — Docker CI — don't cancel overlapping builds, :latest guard
@benbarclay (3 PRs) — Docker — launch dashboard as side-process via HERMES_DASHBOARD=1
@austinpickett (3 PRs) — Dashboard Plugins page, TUI /model picker overhaul with inline auth, kanban button fix
@sprmn24 (2 PRs) — Contributor (2 PRs)
@asheriif (2 PRs) — Contributor (2 PRs)
@xxxigm (2 PRs) — Contributing docs — .venv preference and test runner alignment with AGENTS.md
@stephenschoettler (1 PR) — ACP — MCP E2E mock kwargs
@vincez-hms-coder (1 PR) — Dashboard — Profiles management page
@cdanis (1 PR) — Contributor
@briandevans (1 PR) — Toolsets test — kanban assertions post-#17805
@heyitsaamir (1 PR) — Contributor
All Contributors
Thanks to everyone who contributed to v0.13.0 — commits, co-authored work, and salvaged PRs. 295 contributors in one week.
@0oAstro, @0xDevNinja, @0xharryriddle, @0xKingBack, @0xsir0000, @0xyg3n, @0z1-ghb, @abhinav11082001-stack,
@acc001k, @acesjohnny, @adamludwin, @adybag14-cyber, @agentlinker, @agilejava, @ai-ag2026, @AJV20,
@alanxchen85, @albert748, @AllardQuek, @alt-glitch, @altmazza0-star, @ambition0802, @amitgaur, @amroessam,
@andrewhosf, @Asce66, @asheriif, @ashermorse, @asimons81, @Aslaaen, @Asunfly, @atongrun, @austinpickett,
@banditburai, @barteqpl, @Bartok9, @Beandon13, @beardthelion, @beibi9966, @benbarclay, @binhnt92, @bjianhang,
@BlackJulySnow, @bobashopcashier, @bogerman1, @Bongulielmi, @Brecht-H, @briandevans, @brooklynnicholson,
@c3115644151, @camaragon, @CashWilliams, @CCClelo, @cdanis, @CES4751, @cg2aigc, @changchun989, @ChanlerDev,
@CharlieKerfoot, @chengoak, @chenyunbo411, @chinadbo, @cirwel, @cixuuz, @cmcgrabby-hue, @colorcross,
@Contentment003111, @CoreyNoDream, @counterposition, @curiouscleo, @DaniuXie, @deep-name, @dengtaoyuan450-a11y,
@discodirector, @donramon77, @dpaluy, @ee-blog, @ehz0ah, @el-analista, @elmatadorgh, @EmelyanenkoK,
@Emidomenge, @emozilla, @Es1la, @EthanGuo-coder, @etherman-os, @ethernet8023, @EvilDrag0n, @exxmen, @Fearvox,
@Feranmi10, @firefly, @flobo3, @fmercurio, @Foolafroos, @formulahendry, @franksong2702, @ggnnggez, @GinWU05,
@giwaov, @glesperance, @gnanirahulnutakki, @GodsBoy, @Gosuj, @Grey0202, @guillaumemeyer, @Gutslabs, @h0tp-ftw,
@haidao1919, @halmisen, @happy5318, @hedirman, @helix4u, @hendrixfreire, @HenkDz, @hex-clawd, @heyitsaamir,
@hharry11, @Hinotoi-agent, @holynn-q, @hrkzogw, @Hypn0sis, @Hypnus-Yuan, @ideathinklab01-source, @IMHaoyan,
@Interstellar-code, @ishardo, @jacdevos, @jackey8616, @JanCong, @jasonoutland, @jatingodnani, @JayGwod,
@jethac, @JezzaHehn, @JiaDe-Wu, @jjjojoj, @jkausel-ai, @John-tip, @johnncenae, @jrusso1020, @jslizar,
@JTroyerOvermatch, @julysir, @Junass1, @JustinUssuri, @Kailigithub, @keepcalmqqf, @kiala9, @konsisumer,
@kowenhaoai, @Krionex, @kshitijk4poor, @kyan12, @leavrcn, @leon7609, @LeonSGP43, @leprincep35700, @lhysdl,
@likejudy, @lisanhu, @liu-collab, @liuguangyong93, @liuhao1024, @LucianoSP, @luoyuctl, @luyao618, @M3RCUR2Y,
@maciekczech, @Magicray1217, @Magicray1217, @MaHaoHao-ch, @malaiwah, @manateelazycat, @masonjames, @megastary,
@memosr, @MichaelWDanko, @mikeyobrien, @millerc79, @Mind-Dragon, @mioimotoai-lgtm, @misery-hl, @molvikar,
@momowind, @Montbra, @MottledShadow, @mrbob-git, @mrcharlesiv, @mrcoferland, @ms-alan, @mwnickerson,
@nazirulhafiy, @nftpoetrist, @nicoloboschi, @nightq, @nikolay-bratanov, @NikolayGusev-astra, @nocturnum91,
@noOne-list, @nouseman666, @novax635, @npmisantosh, @nudiltoys-cmyk, @olisikh, @oluwadareab12, @Oxidane-bot,
@pama0227, @pander, @pasevin, @paul-tian, @pdonizete, @perlowja, @pingchesu, @PratikRai0101, @priveperfumes,
@probepark, @QifengKuang, @quocanh261997, @qWaitCrypto, @qxxaa, @r266-tech, @rames-jusso, @revaraver,
@Ricardo-M-L, @rob-maron, @Roy-oss1, @rxdxxxx, @SandroHub013, @Sanjays2402, @Sertug17, @shashwatgokhe,
@shellybotmoyer, @SHL0MS, @SimbaKingjoe, @simbam99, @simplenamebox-ops, @socrates1024, @sonic-netizen,
@sprmn24, @steezkelly, @stephen0110, @stephenschoettler, @stevenchanin, @stevenchouai, @stormhierta,
@subtract0, @suncokret12, @swithek, @taeng0204, @TakeshiSawaguchi, @tangyuanjc, @TheEpTic, @thelumiereguy,
@Tkander1715, @tmdgusya, @Tranquil-Flow, @TruaShamu, @UgwujaGeorge, @valda, @vincez-hms-coder, @VinVC,
@vominh1919, @wabrent, @WadydX, @wanazhar, @WanderWang, @warabe1122, @web-dev0521, @WideLee, @willy-scr,
@wmagev, @WuTianyi123, @wxst, @wysie, @Wysie, @xsfX20, @xxxigm, @xyiy001, @YanzhongSu, @ygd58, @Yoimex,
@yuehei, @Yukipukii1, @yuqianma, @YX234, @zeejaytan, @zhanggttry, @zhao0112, @zng8418, @zons-zhaozhy, @Zyproth
Full Changelog: v2026.4.30...v2026.5.7

Original source

Hermes Agent v0.12.0 (v2026.4.30)

Release Date: April 30, 2026

Since v0.11.0: 1,096 commits · 550 merged PRs · 1,270 files changed · 217,776 insertions · 213 community contributors (including co-authors)

The Curator release — Hermes Agent now maintains itself. An autonomous background Curator grades, prunes, and consolidates your skill library on its own schedule. The self-improvement loop that reviews what to save got a substantial upgrade. Four new inference providers, a 18th messaging platform, a 19th via Teams plugin, native Spotify + Google Meet integrations, ComfyUI and TouchDesigner-MCP moved from optional to bundled-by-default, and a ~57% cut to visible TUI cold start.

✨ Highlights

• Autonomous Curator — hermes curator runs as a background agent on the gateway's cron ticker (7-day cycle default). It grades your skill library, consolidates related skills, prunes dead ones, and writes per-run reports to logs/curator/run.json + REPORT.md. Archived skills are classified consolidated-vs-pruned via model + heuristic. Defense-in-depth gates protect bundled/hub skills from mutation. Unified under auxiliary.curator — pick the curator's model in hermes model, manage it from the dashboard. hermes curator status ranks skills by usage (most-used / least-used). (#17277, #17307, #17941, #17868, #18033)
• Self-improvement loop — substantially upgraded — The background review fork (the core of Hermes' self-improvement: after each turn it decides what memories/skills to save or update) is now class-first (rubric-based rather than free-form), active-update biased (prefers the skill the agent just loaded), handles references//templates/ sub-files, and properly inherits the parent's live runtime (provider, model, credentials actually propagate). Restricted to memory + skills toolsets so it can't sprawl. Memory providers shut down cleanly. Prior-turn tool messages excluded from the summary so the fork sees a clean context. (#16026, #17213, #16099, #16569, #16204, #15057)
• Skill integrations — major expansion — ComfyUI v5 with official CLI + REST + hardware-gated local install, moved from optional to built-in by default (#17610, #17631, #17734). TouchDesigner-MCP bundled by default, expanded with GLSL, post-FX, audio, geometry, and 9 new reference docs (#16753, #16624, #16768 — @kshitijk4poor + @SHL0MS). Humanizer skill ports a text-cleaner that strips AI-isms (#16787). claude-design HTML artifact skill + design-md (Google DESIGN.md spec) + airtable salvage + skill_manage edits in external_dirs + direct-URL skill install + /reload-skills slash command. (#16358, #14876, #16291, #17512, #16323, #17744)
• LM Studio — first-class provider — upgraded from a custom-endpoint alias to a full-blown native provider: dedicated auth, hermes doctor checks, reasoning transport, live /models listing. (Salvage of @kshitijk4poor's #17061.) (#17102)
• Four more new inference providers — GMI Cloud (first-class, salvage of #11955 — @isaachuangGMICLOUD), Azure AI Foundry with auto-detection, MiniMax OAuth with PKCE browser flow (salvage #15203), Tencent Tokenhub (salvage of #16860). (#16663, #15845, #17524, #16960)
• Pluggable gateway platforms + Microsoft Teams — the gateway is now a plugin host. Drop-in messaging adapters live outside the core, and Microsoft Teams is the first plugin-shipped platform. (Salvage of #17664.) (#17751, #17828)
• Tencent 元宝 (Yuanbao) — 18th messaging platform — native gateway adapter with text + media delivery. (#16298, #17424)
• Spotify — native tools + bundled skill + wizard — 7 tools (play, search, queue, playlists, devices) behind PKCE OAuth, interactive setup wizard, bundled skill, surfacing in hermes tools, cron usage documented. (#15121, #15130, #15154, #15180)
• Google Meet plugin — join calls, transcribe, speak, follow up. Realtime OpenAI transport + Node bot server, full pipeline bundled as a plugin. (#16364)
• hermes -z one-shot mode + hermes update --check — non-interactive hermes -z <prompt> with --model/--provider/HERMES_INFERENCE_MODEL. hermes update --check preflight. Opt-in pre-update HERMES_HOME backup. (#15702, #15704, #15841, #16539, #16566)
• Models dashboard tab + in-browser model config — rich per-model analytics, switch main + auxiliary models from the dashboard. (#17745, #17802)
• Remote model catalog manifest — OpenRouter + Nous Portal model catalogs are now pulled from a remote manifest so new models show up without a release. (#16033)
• Native multimodal image routing — images now route based on the model's actual vision capability rather than provider defaults. (#16506)
• Gateway media parity — native multi-image sending across Telegram, Discord, Slack, Mattermost, Email, and Signal; centralized audio routing with FLAC support + Telegram document fallback. (#17909, #17833)
• TUI catches up to (and past) the classic CLI — LaTeX rendering (@austinpickett), /reload .env hot-reload, pluggable busy-indicator styles (@OutThisLife, #13610), opt-in auto-resume of last session, expanded light-terminal auto-detection, session delete from /resume picker with d, modified mouse-wheel line scroll, and a /mouse toggle that kills ConPTY's phantom mouse injection (@kevin-ho). (#17175, #17286, #17150, #17130, #17113, #17668, #17669, #15488)
• Observability + achievements plugins — bundled Langfuse observability plugin (salvage #16845) + bundled hermes-achievements plugin that scans full session history. (#16917, #17754)
• TTS provider registry + Piper local TTS — pluggable tts.providers.<name> registry; Piper ships as a native local TTS provider. (Closes #8508.) (#17843, #17885)
• Vercel Sandbox backend — Vercel sandboxes as an execute_code/terminal backend (@kshitijk4poor). (#17445)
• Secret redaction off by default — default flipped to off. Prevents the long-standing patch-corruption incidents where fake secret-shaped substrings mangled tool outputs. Opt in via redaction.enabled: true when you need it. (#16794)
• Cold-start performance — visible TUI cold start cut ~57% via lazy agent init (@OutThisLife), lazy imports of OpenAI / Anthropic / Firecrawl / account_usage, mtime-cached load_config(), memoized get_tool_definitions() with TTL-cached check_fn results, precompiled dangerous-command patterns. (#17190, #17046, #17041, #17098, #17206)
• Configurable prompt cache TTL — prompt_caching.cache_ttl (5m default, 1h opt-in — cost savings for bursty sessions that keep cache warm). Salvage of #12659. (#15065)

🧠 Autonomous Curator & Self-Improvement Loop

Curator — autonomous skill maintenance

• hermes curator as a background agent — runs on the gateway's cron ticker, 7-day cycle by default, umbrella-first prompt, inherits parent config, unbounded iterations (#17277 — issue #7816)
• Per-run reports — logs/curator/run.json + REPORT.md per cycle (#17307)
• Consolidated vs pruned classification — archived skills split with model + heuristic (#17941)
• hermes curator status — ranks skills by usage, shows most-used and least-used (#18033)
• Unified under auxiliary.curator — pick the model in hermes model, configure from the dashboard (#17868)
• Documentation — dedicated curator feature page on the docs site (#17563)
• Fix: seed defaults on update, create logs/curator/ directory, defer fire import (#17927)
• Fix: scan nested archive subdirs in restore_skill (@0xDevNinja) (#17951)
• Fix: use actual skill activity in curator status (@y0shua1ee) (#17953)
• Fix: skill_manage refuses writes on pinned skills; pinning now blocks curator writes (#17562, #17578)
• Fix: bump_use() wired into skill invocation + preload + skill_view (salvage #17782) (#17932)

Self-improvement loop (background review fork)

• Class-first skill-review prompt — rubric-based grading rather than free-form "should this update" (#16026)
• Active-update bias — prefers updating skills the agent just loaded, handles references/ + templates/ sub-files (#17213)
• Fork inherits parent's live runtime — provider, model, credentials actually propagate now (#16099)
• Scoped toolsets — review fork restricted to memory + skills (no shell, no web) (#16569)
• Clean shutdown — background review memory providers exit properly (salvage #15289) (#16204)
• Clean context — prior-history tool messages excluded from review summary (salvage #14967) (#15057)

🧩 Skills Ecosystem

Skill integrations — newly bundled or promoted

• ComfyUI v5 — official CLI + REST + hardware-gated local install; moved from optional to built-in (#17610, #17631, #17734, #17612)
• TouchDesigner-MCP — bundled by default (#16753 — @kshitijk4poor), expanded with GLSL, post-FX, audio, geometry references (#16624), 9 new reference docs (#16768 — @SHL0MS)
• Humanizer — strips AI-isms from text (#16787)
• claude-design — HTML artifact skill with disambiguation from other design skills (#16358)
• design-md — Google's DESIGN.md spec skill (#14876)
• airtable — salvaged skill + skill API keys wired into .env (#15838) (#16291)
• pretext — creative browser demos with @chenglou/pretext (#17259)
• spike + sketch — throwaway experiments + HTML mockups, adapted from gsd-build (#17421)

Skills UX

• Install skills from a direct HTTP(S) URL — hermes skills install <url> (#16323)
• /reload-skills slash command (salvage #17670) (#17744)
• hermes skills list shows enabled/disabled status (#16129)
• skill_manage refuses writes on pinned skills (#17562)
• skill_manage edits external_dirs skills in place (salvage #9966) (#17512, #17289)
• Fix: inline-shell rendering in skill_view (#15376)
• Fix: exclude .archive/ from skill index walk (salvage #17639) (#17931)
• Fix: dedicated docs page per bundled + optional skill (#14929)
• Fix: google-workspace shared HERMES_HOME helper + ship deps as optional extra (#15405)
• Fix: auto-wrap ASCII-art code blocks in generated skill pages (#16497)
• Point agent at hermes-agent skill + docs site for Hermes questions (#16535)

🏗️ Core Agent & Architecture

Provider & Model Support

New providers

• GMI Cloud — first-class API-key provider on par with Arcee/Kilocode/Xiaomi (salvage of #11955 — @isaachuangGMICLOUD) (#16663)
• Azure AI Foundry — auto-detection, full wiring (#15845)
• LM Studio — upgraded from custom-endpoint alias to first-class provider: dedicated auth, doctor checks, reasoning transport, live /models (salvage of #17061 — @kshitijk4poor) (#17102)
• MiniMax OAuth — PKCE browser flow with full OAuth integration (salvage #15203) (#17524)
• Tencent Tokenhub — new provider (salvage of #16860) (#16960)

Model catalog

• Remote model catalog manifest — OpenRouter + Nous Portal catalogs pulled from remote manifest so new models show up without a release (#16033)
• openai/gpt-5.5 and gpt-5.5-pro added to OpenRouter + Nous Portal (#15343)
• deepseek-v4-pro and deepseek-v4-flash added (#14934)
• qwen3.6-plus added to Alibaba-supported models (#16896)
• Gemini free-tier keys blocked at setup with 429 guidance surfacing (#15100)

Model configuration

• Configurable prompt_caching.cache_ttl — 5m default, 1h opt-in (salvage #12659) (#15065)
• /fast whitelist broadened to all OpenAI + Anthropic models (#16883)
• auxiliary.extra_body.reasoning translates into Codex Responses API (#17004)
• hermes fallback command for managing fallback providers (#16052)

Agent Loop & Conversation

• Native multimodal image routing — based on model vision capability, not provider defaults (#16506)
• Delegate child_timeout_seconds default bumped to 600s (#14809)
• Diagnostic dump when subagent times out with 0 API calls (#15105)
• Gateway busts cached agent on compression/context_length config edits (#17008)
• Opt-in runtime-metadata footer on final replies (#17026)
• /reload-mcp awareness — rebuild cached agents + prompt-cache cost confirmation (#17729)
• Fix: repair CamelCase + _tool suffix tool-call emissions (#15124)
• Fix: retry on json.JSONDecodeError instead of treating as local validation error (#15107)
• Fix: handle unescaped control chars in tool_call.arguments (#15356)
• Fix: ordering fix in _copy_reasoning_content_for_api — cross-provider reasoning isolation (@Zjianru) (#15749)
• Fix: inject empty reasoning_content for DeepSeek/Kimi tool_calls unconditionally (@Zjianru) (#15762)
• Fix: persist streamed reasoning_content on assistant turns (#16844) (#16892)
• Fix: cancel coroutine on timeout so worker thread exits; full traceback on tool failure (#17428)
• Fix: isolate get_tool_definitions quiet_mode cache + dedup LCM injection (#17335) (#17889)
• Fix: serialize concurrent hermes_tools RPC calls from execute_code (#17770) (#17894, #17902)
• Fix: rename [SYSTEM: → [IMPORTANT: in all user-injected markers (dodges Azure content filter) (#16114)

Compression

• Retry summary on main model for unknown errors before giving up (#16774)
• Notify users when configured aux model fails even if main-model fallback recovers (#16775)
• /compress wrapped in _busy_command to block input during compression (#15388)
• Fix: reserve system + tools headroom when aux binds threshold (#15631)
• Fix: use text-char sum for multimodal token estimation in _find_tail_cut_by_tokens (#16369)

Session, Memory & State

• Trigram FTS5 index for CJK search, replace LIKE fallback (@alt-glitch) (#16651)
• Index tool_name + tool_calls in FTS5, with repair + migration (salvages #16866) (#16914)
• Checkpoints: auto-prune orphan and stale shadow repos at startup (#16303)
• Memory providers notified on mid-process session_id rotation (#6672) (#17409)
• Fix: quote underscored terms in FTS5 query sanitization (#16915)
• Fix: resolve viking_read 500/412 on file URIs + pseudo-summary URIs (salvage #5886) (#17869)
• Fix: skip external-provider sync on interrupted turns (#15395)
• Fix: close embedded Hindsight async client cleanly (salvage #14605) (#16209)
• Fix: pass session transcript to shutdown_memory_provider on gateway + CLI (#15165) (#16571)
• Fix: write-origin metadata seam (#15346)
• Fix: preserve symlinks during atomic file writes (#16980)
• Refactor: remove flush_memories entirely (#15696)

Auxiliary models

• Fix: surface auxiliary failures in UI (previously silent) (#15324)
• Fix: surface title-gen auxiliary failures instead of silently dropping (#16371)
• Fix: generalize unsupported-parameter detector and harden max_tokens retry (#15633)

📱 Messaging Platforms (Gateway)

New Platforms

• Microsoft Teams (19th platform) — as a plugin, + xdist collision guard (#17828)
• Yuanbao (Tencent 元宝, 18th platform) — native adapter with text + media delivery (#16298, #17424, #16880)

Pluggable Gateway Platforms

• Drop-in messaging adapters — the gateway is now a plugin host for platforms (salvage of #17664) (#17751)

Telegram

• Chat allowlists for groups and forums (@web3blind) (#15027)
• Send fresh finals for stale preview streams (port openclaw#72038) (#16261)
• Render markdown tables as row-group bullets + prompt hint (#16997)
• Document fallback in centralized audio routing (#17833)
• Native multi-image sending (#17909)

Discord

• Opt-in toolsets + ID injection + tool split + Feishu wiring (salvage #15457, #15458) (#15610, #15613)
• Fix: coerce limit parameter to int before min() call (#16319)

Slack

• Register every gateway command as a native slash (Discord/Telegram parity) (#16164)
• strict_mention config — prevents thread auto-engagement (#16193)
• channel_skill_bindings — bind specific skills to specific Slack channels (#16283)

Signal

• Native formatting — markdown → bodyRanges, reply quotes, reactions (#17417)
• Native multi-image sending (#17909)

Feishu / Mattermost / Email / Signal

• All participate in native multi-image sending (#17909)

Gateway Core

• Centralized audio routing + FLAC support + Telegram doc fallback (#17833)
• Native multi-image sending across Telegram, Discord, Slack, Mattermost, Email, Signal (#17909)
• Make hygiene hard message limit configurable (#17000)
• Opt-in runtime-metadata footer on final replies (#17026)
• pre_gateway_dispatch hook — plugins can intercept before dispatch (#15050)
• pre_approval_request / post_approval_response hooks (#16776)
• Fix: timeouts — guard load_config() call against runtime exceptions (#16318)
• Fix: support passing handler tools via registry (#15613)

🔧 Tool System

Plugin-first architecture

• Pluggable gateway platforms — platforms can ship as plugins (#17751)
• Microsoft Teams as first plugin-shipped platform (#17828)
• pre_gateway_dispatch hook (#15050)
• pre_approval_request + post_approval_response hooks (#16776)
• duration_ms on post_tool_call (inspired by Claude Code 2.1.119) (#15429)
• Bundled plugins: Spotify (#15174), Google Meet (#16364), Langfuse observability (#16917), hermes-achievements (#17754)
• Page-scoped plugin slots for built-in dashboard pages (#15658)
• Declarative plugin installation for NixOS module (@alt-glitch) (#15953)

Browser

• CDP supervisor — dialog detection + response + cross-origin iframe eval (#14540)
• Auto-spawn local Chromium for LAN/localhost URLs when cloud provider is configured (#16136)

Execute code / Terminal

• Vercel Sandbox backend for execute_code / terminal (@kshitijk4poor) (#17445)
• Collapse subagent task_ids to shared container (#16177)
• Docker: run container as host user to avoid root-owned bind mounts (@benbarclay) (#17305)
• Fix: safely quote ~/ subpaths in wrapped cd commands (#15394)
• Fix: close file descriptor in LocalEnvironment._update_cwd (#17300)
• Fix: SSH — prevent tar from overwriting remote home dir permissions (#17898, #17867)

Image generation

See Provider section for updates; no new image providers this window.

TTS / Voice

• Pluggable TTS provider registry under tts.providers.<name> (#17843)
• Piper as native local TTS provider (closes #8508) (#17885)
• Voice mode CLI parity in the TUI — VAD loop + TTS + crash forensics (#14810)
• Fix: vision — use HERMES_HOME-based cache dir instead of cwd (#17719)

Cron

• Honor hermes tools config for the cron platform (#14798)
• Per-job workdir — project-aware cron runs (#15110)
• context_from field — chain cron job outputs (#15606)
• Fix: promote croniter to a core dependency (#17577)

Web search

• Expose limit for web_search (#16934)

Maps

• Fix: include seconds in timezone UTC offset output (#16300)

Approvals

• Hardline blocklist for unrecoverable commands (#15878)
• Perf: precompile DANGEROUS_PATTERNS and HARDLINE_PATTERNS (#17206)

ACP

• Advertise and forward image prompts (#18030)

API Server

• POST /v1/runs/{run_id}/stop (salvage of #15656) (#15842)
• Expose run status for external UIs (#17085) (#17458)

Nix

• Declarative plugin installation for NixOS module (@alt-glitch) (#15953)
• Fix: use --rebuild in fix-lockfiles to bypass cached FOD store paths (#15444)
• Fix: extraPackages now actually works via per-user profile (#17047)
• Fix: refresh web/ npm-deps hash to unblock main builds (#17174)
• Fix: replace magic-nix-cache with Cachix (#17928)

🖥️ TUI

New features

• LaTeX rendering (@austinpickett) (#17175)
• /reload .env hot-reload — ported from the classic CLI (#17286)
• Pluggable busy-indicator styles (@OutThisLife, #13610) (#17150)
• Opt-in auto-resume of the most recent session (@OutThisLife) (#17130)
• Expanded light-terminal auto-detection — HERMES_TUI_THEME + background hex (@OutThisLife) (#17113)
• Delete sessions from /resume picker with d (@OutThisLife) (#17668)
• Line-by-line scroll on modified mouse wheel (@OutThisLife) (#17669)
• Delete queued message while editing with ctrl-x / cancel with esc (@OutThisLife) (#16707)
• Per-section visibility for the details accordion (@OutThisLife) (#14968)
• Voice mode CLI parity — VAD loop + TTS + crash forensics (#14810)
• Contextual first-touch hints ported to TUI — /busy, /verbose (#16054)
• Mini help menu on ? in the input field (@ethernet8023) (#18043)

Fixes

• Fix: proactive mouse disable on ConPTY + /mouse toggle command (@kevin-ho, WSL2 ghost-mouse fix) (#15488)
• Fix: restore skills search RPC (#15870)
• Perf: cache text measurements across yoga flex re-passes (#14818)
• Perf: stabilize long-session scrolling (#15926)
• Perf: lazily seed virtual history heights (#16523)
• Perf: cut visible cold start ~57% with lazy agent init (#17190)

🖱️ CLI & User Experience

New commands

• hermes -z <prompt> — non-interactive one-shot mode (#15702)
• hermes -z with --model / --provider / HERMES_INFERENCE_MODEL (#15704)
• hermes update --check preflight flag (#15841)
• hermes fallback command for managing fallback providers (#16052)
• /busy slash command for busy input mode (#15382)
• /busy input mode 'steer' as a third option (#16279)
• /btw as alias for /background (#16053)
• /reload-skills slash command (salvage #17670) (#17744)
• Surface /queue, /bg, /steer in agent-running placeholder (#16118)

Setup / onboarding

• Auto-reconfigure on existing installs (#15879)
• Contextual first-touch hints for /busy and /verbose (#16046)
• Cost-saving tips from the April 30 tip-of-the-day (#17841)
• Hyperlink startup banner title to the latest GitHub Release (#14945)

Update / backup

• Snapshot pairing data before git pull (#16383)
• Auto-backup HERMES_HOME before hermes update (opt-in, off by default) (#16539, #16566)
• Exclude checkpoints/ from backups (#16572)
• Exclude SQLite WAL/SHM/journal sidecars from backups (#16576)
• Installer FHS layout for root installs on Linux (#15608)
• Fix: kill stale dashboards instead of warning (#17832)
• Fix: show correct update status on nix-built hermes (#17550)

Slash-command housekeeping

• Refactor: drop /provider, /plan handler, and clean up slash registry (#15047)
• Refactor: drop persist_session plumbing + fix broken /btw mid-turn bypass (#16075)

OpenClaw migration (for folks coming from OpenClaw)

• Hardened OpenClaw import — plan-first apply, redaction, pre-migration backup (#16911)
• Fix: case-preserving brand rewrite + one-time ~/.openclaw residue banner (#16327)
• Fix: resolve openclaw workspace files from agents.defaults.workspace (#16879)
• Fix: resolve model aliases against real OpenClaw catalog schema (salvage #16778) (#16977)

📊 Web Dashboard

• Models tab — rich per-model analytics (#17745)
• Configure main + auxiliary models from the Models page (#17802)
• Dashboard Chat tab — xterm.js + JSON-RPC sidecar (supersedes #12710 + #13379, @OutThisLife) (#14890)
• Dashboard layout refresh (@austinpickett) (#14899)
• --stop and --status flags on the dashboard CLI (#17840)
• Page-scoped plugin slots for built-in pages (#15658)
• Fix: replace all buttons for design system buttons (#17007)

⚡ Performance

• TUI visible cold start cut ~57% via lazy agent init (#17190)
• Lazy-import OpenAI, Anthropic, Firecrawl, account_usage (#17046)
• mtime-cache load_config() and read_raw_config() (#17041)
• Memoize get_tool_definitions() + TTL-cache check_fn results (#17098)
• Precompile DANGEROUS_PATTERNS and HARDLINE_PATTERNS (#17206)
• Cache Ink text measurements across yoga flex re-passes (#14818)
• Stabilize long-session scrolling (#15926)
• Lazily seed virtual history heights (#16523)

🔒 Security & Reliability

• Secret redaction off by default — stops corrupting patches / API payloads with fake-key substitutions. Opt in via redaction.enabled: true (#16794)
• [SYSTEM: → [IMPORTANT: in all user-injected markers (Azure content filter dodge) (#16114)
• Hardline blocklist for unrecoverable commands (#15878)
• Canonical mask_secret helper; fix status.py DIM drift (#17207)
• Sweep expired paste.rs uploads on a real timer (#16431)
• Preserve symlinks during atomic file writes (#16980)
• Probe /dev/tty by opening it, not bare existence (#17024)

🐛 Notable Bug Fixes

This window includes 360 fix: PRs. Selected highlights from across the stack:

• Background review fork inherits parent's live runtime — provider/model/creds now propagate correctly (#16099)
• Hindsight configurable HINDSIGHT_TIMEOUT env var (#15077)
• Tools: normalize numeric entries + clear stale no_mcp in _save_platform_tools (#15607)
• MCP: rewrite definitions refs to $defs in input schemas — closes provider-side 400s
• Azure content filter compatibility — renamed [SYSTEM: markers so Azure's content filter stops flagging them (#16114)
• Vision cache uses HERMES_HOME instead of cwd (#17719)
• FTS5 search — tool_name + tool_calls indexing with repair + migration (#16914)
• Streaming reasoning persists on assistant turns (#16892)
• execute_code concurrent RPC serialization (#17770) (#17894, #17902)
• Background reviewer scoped to memory + skills toolsets — no more accidental web/shell escapes (#16569)
• Compression recovery — retry on main before giving up; notify user when aux fails (#16774, #16775)
• croniter promoted to a core dependency (#17577)
• Discord tool limit parameter coerced to int before min() call (#16319)
• Yuanbao messaging platform entrance fix (#16880)
• ACP advertise and forward image prompts (#18030)
• DeepSeek / Kimi reasoning content isolation across cross-provider histories (@Zjianru) (#15749, #15762)
• Preserve reasoning_content replay on DeepSeek v4 + Kimi/Moonshot thinking (#18045)

The vast majority of the 360 fixes landed in the streaming/compression/tool-calling paths across all providers — DeepSeek, Kimi, Moonshot, GLM, Qwen, MiniMax, Gemini, Anthropic, OpenAI — alongside TUI polish (resize, scroll, sticky-prompt) and gateway platform-specific edge cases.

🧪 Testing & CI

• Hermetic test parity (scripts/run_tests.sh) held across this window
• Microsoft Teams xdist collision guard — prevents worker collisions when Teams platform tests run in parallel (#17828)
• Chore: remove unused imports and dead locals (ruff F401, F841) (#17010)

📚 Documentation

• Curator feature page added to docs site (#17563)
• Document pin also blocking skill_manage writes (#17578)
• Direct-URL skill install documented across features, reference, guide, and hermes-agent skill (#16355)
• Hooks tutorial — build a BOOT.md startup checklist (replaces the removed built-in hook) (#17202)
• ComfyUI docs: ask local vs cloud FIRST before hardware check (#17612)
• Obliteratus skill: link YouTube video guide in SKILL.md (#15808)
• Per-skill docs pages generated for bundled + optional skills; ASCII art code blocks auto-wrapped (#14929, #16497)

⚖️ Removed / Reverted

• Kanban multi-profile collaboration board — landed in #16081, reverted in (#16098) while the design is reworked
• computer-use cua-driver — 3 preparatory PRs landed then were reverted in (#16927)
• BOOT.md built-in hook removed (#17093); the hooks tutorial (#17202) shows how to build the same workflow yourself with a shell hook
• /provider + /plan slash commands dropped (#15047)
• flush_memories removed entirely (#15696)

👥 Contributors

Core

• @teknium1 (Teknium)

Top Community Contributors (by merged PR count since v0.11.0)

• @OutThisLife (Brooklyn) — 52 PRs · TUI — light-terminal detection + pluggable busy styles + auto-resume + session-delete from /resume + mouse-wheel scrolling + xterm.js dashboard Chat tab + cold-start cut + accordion polish
• @kshitijk4poor — 12 PRs · LM Studio first-class provider (salvage), Vercel Sandbox backend, GMI Cloud salvage, bundled-by-default touchdesigner-mcp, many tool-call / reasoning fixes
• @helix4u — 10 PRs · MCP schema robustness, assorted stability fixes
• @alt-glitch — 8 PRs · trigram FTS5 CJK search, declarative Nix plugin install, matrix/feishu hints and fixes
• @ethernet8023 — 4 PRs
• @austinpickett — 4 PRs · LaTeX rendering in TUI, dashboard layout refresh
• @benbarclay — 3 PRs · Docker run-as-host-user so bind mounts don't get root-owned
• @vominh1919 — 2 PRs
• @stephenschoettler — 2 PRs
• @kevin-ho — ConPTY mouse-injection fix (#15488)
• @Zjianru — cross-provider reasoning_content isolation + DeepSeek/Kimi empty-reasoning injection (#15749, #15762)
• @web3blind — Telegram chat allowlists for groups and forums (#15027)
• @SHL0MS — 9 new TouchDesigner-MCP reference docs (#16768)
• @0xDevNinja — curator restore_skill nested-archive fix (#17951)
• @y0shua1ee — curator use activity fix (#17953)

Also contributing

Salvaged or co-authored work from @isaachuangGMICLOUD (GMI Cloud), earlier upstream PRs from the original author of each salvage chain, and a long tail of one-shot fixes, documentation nudges, and skill contributions from the community.

All Contributors (alphabetical, excluding @teknium1)

@0xbyt4, @0xharryriddle, @0xDevNinja, @0z1-ghb, @5park1e, @A-FdL-Prog, @aj-nt, @akhater, @alblez, @alexg0bot,
@alexzhu0, @AllardQuek, @alt-glitch, @amanning3390, @amanuel2, @AndreKurait, @andrewhosf, @Andy283, @andyylin,
@angel12, @AntAISecurityLab, @ash, @austinpickett, @badgerbees, @BadTechBandit, @Bartok9, @beenherebefore,
@beesrsj2500, @BeliefanX, @benbarclay, @benjaminsehl, @BlackishGreen33, @bloodcarter, @BlueBirdBack,
@briandevans, @brooklynnicholson, @bsgdigital, @buray, @bwjoke, @camaragon, @cdanis, @cgarwood82,
@charles-brooks, @chen1749144759, @chengoak, @ching-kaching, @Contentment003111, @crayfish-ai, @CruxExperts,
@cyclingwithelephants, @dandaka, @danklynn, @ddupont808, @dhabibi, @difujia, @dimitrovi, @dlkakbs,
@dontcallmejames, @EKKOLearnAI, @emozilla, @ericnicolaides, @erosika, @ethernet8023, @exiao, @Feranmi10,
@flobo3, @foxion37, @georgeglessner, @georgex8001, @ghostmfr, @H-Ali13381, @HangGlidersRule, @harryplusplus,
@haru398801, @heathley, @hejuntt1014, @hekaru-agent, @helix4u, @Heltman, @HenkDz, @heyitsaamir, @hharry11,
@hhhonzik, @hhuang91, @HiddenPuppy, @htsh, @iamagenius00, @in-liberty420, @innocarpe, @irispillars, @iRonin,
@isaachuangGMICLOUD, @Ito-69, @j3ffffff, @jackjin1997, @jakubkrcmar, @Jason2031, @JayGwod, @jerome-benoit,
@johnncenae, @Kailigithub, @keiravoss94, @kevin-ho, @knockyai, @konsisumer, @kshitijk4poor, @kunlabs, @l0hde,
@Leihb, @leoneparise, @LeonSGP43, @liizfq, @liuhao1024, @LoongZhao, @lsdsjy, @luyao618, @ma-pony, @Magaav,
@Magicray1217, @math0r-be, @MattMaximo, @maxims-oss, @MaxyMoos, @maymuneth, @mcndjxlefnd, @memosr,
@MestreY0d4-Uninter, @mewwts, @Mirac1eSky, @MorAlekss, @mrhwick, @mrunmayee17, @mssteuer, @Nanako0129,
@nazirulhafiy, @Nerijusas, @Nicecsh, @nicoloboschi, @nightq, @ningfangbin, @octo-patch, @octopus,
@OutThisLife, @paperclip, @pein892, @perlowja, @prasadus92, @qike-ms, @qiyin-code, @Readon, @ReginaldasR,
@revaraver, @rfilgueiras, @rmoen, @romanornr, @rugvedS07, @rylena, @samrusani, @Sanjays2402, @sasha-id,
@Satoshi-agi, @scheidti, @scotttrinh, @season179, @SeeYangZhi, @sgaofen, @shamork, @shannonsands, @SHL0MS,
@simbam99, @Societus, @socrates1024, @Sonoyunchu, @sprmn24, @stephenschoettler, @tangyuanjc, @TechPrototyper,
@tekgnosis-net, @ThomassJonax, @tmimmanuel, @tochukwuada, @Tosko4, @Tranquil-Flow, @twozle, @txbxxx,
@UgwujaGeorge, @versun, @vlwkaos, @voidborne-d, @vominh1919, @Wang-tianhao, @Wangshengyang2004, @web3blind,
@westers, @Wysie, @xandersbell, @xiahu88988, @XieNBi, @xinbenlv, @xnbi, @y0shua1ee, @yatesjalex, @yes999zc,
@yeyitech, @Yoimex, @YueLich, @Yukipukii1, @zhiyanliu, @zicochaos, @Zjianru, @zkl2333, @zons-zhaozhy,
@ztexydt-cqh.

Also: @Siddharth Balyan, @YuShu.

Full Changelog: v2026.4.23...v2026.4.30

Original source