Your Profile Export Was Shipping Your Cloud Credentials
A tar.gz from hermes profile export is meant to let a teammate reproduce your setup — but it also carried .docker, .azure, .config/gh and .config/gcloud credential stores. Two PRs closed the gap.
Read more
Home Assistant Left the Core: What Happens to Your Setup
The Home Assistant gateway platform and its tools moved out of Hermes core into an official catalog plugin — with an automatic migration that installs it per profile, leaving config keys, env vars and tool names untouched.
Read more
Hermes Stopped Believing the Sender's Own dmarc=pass
An Authentication-Results header is text the sender can write. Hermes now requires an authserv-id pin and drops mail until one is set — a deliberate behaviour change with a one-line fix.
Read more
Memory Has a Budget: Why It Eventually Stops Remembering
Hermes' long-term memory has a character limit, and when it fills up writes are skipped silently. The hermes-dreaming plugin adds a deterministic nightly pass that records what matters and retires what does not.
Read more
Third-Party Plugins Move Out of the Main Process: Inside plugins.isolation: host
A plugin you install used to share one Python process with every session, secret and in-memory key you own. The new plugins.isolation: host gives each profile its own plugin host process — no plugin code changes, and a short, documented list of what cannot move.
Read more
Your Agent Wrote to Your Real crontab at 2am: Sandboxing HOME and cron
A sandbox that isolates HERMES_HOME still leaves the agent writing to the real home directory, the real crontab and the real systemd user bus. Three ghost cron jobs left behind by one eval run show which exits an isolation story has to cover.
Read more
Running Hermes Inside Codex: A Community MCP Extension
Editing code in Codex while Hermes runs your automations usually means two windows and a lost train of thought. This community MCP extension embeds Hermes chats, profiles, model switching and the scheduler into Codex, with credentials kept in the local bridge process.
Read more
Why Your /save Export Was Missing Turns — and the Cap Behind It
The same session could export completely from the CLI and come up short in the desktop app, losing turns that in-place compaction had archived; a very large session could exhaust memory instead. The fix unifies all three surfaces on one code path and applies each profile's own export cap.
Read more
Why Third-Party Embeds in the Desktop App Have to Be Sandboxed
How Hermes isolates X, Instagram and YouTube embeds in the desktop app, one already-public security issue and its fix, and the version status today.
Read more
Three Tools in One tool_call Is No Longer an Error: Hermes Splits the Batch
When a model packed three MCP tools into a single tool_call, the local-tools-one-at-a-time rule bounced it back and burned a whole round trip. Now the agent splits the batch into individual calls before the turn is saved.
Read more
Reverted After 11 Hours: Why Hermes Approval Prompts Keep a Deadline
The change that made approval prompts wait for you forever was rolled back the same night it merged — not out of indecision, but because it deadlocked a session that has nobody to answer. Here is the timeline and what actually applies now.
Read more
One commit, three silent failures: backup deleted the wrong file, JSON written wrong, quotes flattened
A negative keep deletes your newest backup, a write slips in NaN, and replace_all flattens smart quotes to ASCII — three bugs that all returned success while doing the wrong thing. PR #130619 fixes all three.
Read more
The approval prompt that used to vanish mid-coffee now waits for you
Hit approvals.timeout and the prompt expired, silently denying the command — you were just in a meeting. PR #130167 keeps CLI, TUI and Desktop prompts open until you answer or interrupt the turn, while messaging platforms keep their 300-second deadline.
Read more
Signed in to a Nous account — so why is the free fast search still refused?
Three local gates blocked the request before it was ever sent: paid entitlement, a live tool pool, and an autodetect ladder that only recognised Firecrawl. PR #130660 splits out an identity-scoped free search route — any registered account qualifies, anonymous guests keep the keyless ring, and a failed account lookup fails closed.
Read more
Your Codex quota reopened days ago, but Hermes is still on the fallback
A long-lived session pinned to its fallback never calls the probe that notices an early quota reopen, so it stays there until a restart. PR #130716 wires that check into the restore path — and throttles it, so a probe that lies cannot make the session flip back and forth every turn.
Read more
Before you open a plugin-catalog PR, look at what its gate actually checks
The catalog admission gate does two things, but it is fussier than you expect: a renamed entry, a subdir that escapes the pinned clone, and a sha that names a tag object all get rejected. PR #130712 closes those bypasses — and fixes an over-strict rule that would have failed a third of all catalog PRs.
Read more