The scan said safe — then looking at the skill ran it
The skills guard had three blind spots: destructive deletes that used a bare tilde, no rule for the inline-shell auto-exec syntax, and installs blocked by the scan reporting success. PR #128443 fixes all three and bumps the scanner to v7.
Read more
Exiting a session deleted code you never committed
Worktree exit cleanup only checks for unpushed commits and never reads the working tree, so git worktree remove --force takes your uncommitted and untracked files with it — while the docs promise dirty trees are kept.
Read more
One update filled a 434 GB hole in the disk
A desktop version check walked a path-filtered history on a tree:0 clone, left 2,659 promisor packs behind, and filled a 1 TB SSD — while the pre-fix build kept looping.
Read more
Someone else's API key ran inside your cron job
A UX cleanup commit deleted cron's per-profile secret isolation, letting a routed fire write another profile's .env into the shared process environment. PR #126982 puts it back.
Read more
You pasted a hermes dump for help — and it carried your own API key
The debug bundle printed every fallback provider api_key and any credential hidden in a base_url. Patches merged 2026-09-29 force-redact the dump itself and the upload boundary; here is what gets masked, what --no-redact really means, and how to share logs safely.
Read more
/rollback reported success — and silently ate the uncommitted work in your nested repo
A checkpoint stores a nested git repository as a gitlink, a commit reference, never as files. So /rollback overwrote the sub-repo work while printing success. A patch merged 2026-09-29 makes rollback refuse before it changes anything, and labels checkpoints that did not capture a nested repo.
Read more
Config rot: hermes config check now speaks up about renamed, uninstalled and disabled selections
A renamed toolset, an uninstalled plugin, a platform disabled while its token is still configured — saved selections that no longer resolve used to just vanish. Now hermes config check reports them, judged by the same resolver hermes config migrate uses.
Read more
The model sent an array as a string — so why do only some tools complain?
Registry tools get an automatic argument repair for the same mistake that makes clarify, todo_list, memory and session_search fail: those inline tools bypass the one place that fixes argument types. A patch merged 2026-09-29 gives them the same repair.
Read more
Mixture of Agents, explained: pay twice, get a better answer
MoA collects several models' opinions into one answer and scores about six points above its strongest component on the official bench. What it actually runs, who gets billed, how the three fanout cadences differ, and why the MoA row in your model picker now means you configured something.
Read more
Your plugin stopped loading? The old import paths died on 2026-09-14
September's module decomposition moved Hermes internals into new files, and the compatibility layer that kept old import paths resolving is gone. How to diagnose an ImportError, how to fix it, and which surfaces were never part of the plugin contract.
Read more
Why restarting your gateway pays for the same cache twice
A multiplexed gateway paying a full cache write per profile, a first message after every restart that behaves like a cold start, and a /steer leftover that drops the channel prompt — three fixes merged 2026-09-28, all chasing the same thing: a prefix that changed for no reason.
Read more
hermes update hangs, lies about being up to date, or refuses your CA — four fixes landed
Shallow clones that time out, a detached checkout that moves your code while printing “Already up to date!”, corporate roots that never reach git, and failures booked as successes. Four update patches merged 2026-09-28, explained.
Read more
The session you deleted came back: two bugs and a new guard
Deleting a session that was still running used to be a no-op in the worst way: the agent object stayed alive, every later turn hit a foreign-key failure and was dropped silently, and on the desktop the row could be resurrected by the next write. PR #125157, merged 2026-09-27, refuses the delete instead — paired with the rebuild fix in #124117.
Read more
"Chat out of date": when the desktop refused every send
In a long, tool-heavy chat the desktop app could refuse every send with "Chat out of date" — surviving reload and relaunch. Nothing was actually stale: one component releases history by weight, the other judged freshness by message count. PR #125523 compares the transcript tail instead of totals.
Read more
190 wasted calls and no guard said a word
To wait on 10 background subagents, one model held the turn open with no-op execute_code calls: 190 main-model calls, 31 million input tokens, 49 minutes — and zero loop-guard notices. The verdict hash carried two bookkeeping fields that change on every call. PR #124724 drops exactly those two.
Read more
Your address is on the allowlist — does that make the sender you?
Two security fixes merged on 2026-09-27 closed the same class of hole in two gateways: email and SimpleX both treated a field the sender can write freely as an identity. One let any contact rename themselves past the allowlist; the other let a From: header carry a second address and pass as you.
Read more