v0.13.0

Hermes Agent v0.13.0 — The Tenacity Release

Overview

v0.13.0 — The Tenacity Release. Released May 7, 2026. 864 commits · 588 merged PRs · 829 files changed · 128,366 insertions · 282 issues closed (13 P0, 36 P1) · 295 community contributors (including co-authors).

The Tenacity Release answers one question with three different mechanisms: how does an agent finish what it starts? Before v0.13, Hermes was smart but not persistent — it could start a multi-step task, hit a snag, and silently drift or die. v0.13 ships three interlocking solutions: durable multi-agent Kanban (task boards with heartbeat, zombie detection, and hallucination recovery), /goal (the Ralph loop — lock the agent on a target across turns), and Checkpoints v2 (state persistence rewritten with real pruning). Together they make Hermes the first open-source agent framework with built-in completion guarantees.

This is also the biggest security release in the project’s history — 8 P0 closures in one release. Redaction is now ON by default. Discord role-allowlists are guild-scoped. WhatsApp rejects strangers by default. TOCTOU windows close across auth.json and MCP OAuth. The agent’s attack surface shrinks dramatically while its reach expands: Google Chat joins as the 20th messaging platform, providers become a pluggable surface, and the CLI and gateway now speak seven languages.

Major Features

1. Multi-Agent Kanban — Delegate to an AI Team That Actually Finishes

The headline feature of v0.13. Kanban turns Hermes into a durable multi-agent task board. Spin up a board, drop tasks on it, and let multiple Hermes workers pick them up, hand off, and close them out. The plumbing is what matters: heartbeats, reclaim on timeout, zombie detection, per-task retry budgets, auto-block on incomplete exit, and a hallucination recovery gate.

Create and manage a kanban board:

# Create a new board and switch to it
hermes kanban boards create project-a --name "Project A" --switch

# Add tasks
hermes kanban create "Implement OAuth flow" \
  --priority 1 \
  --body "Add OAuth 2.0 with PKCE support to the auth service"

hermes kanban create "Write integration tests" \
  --priority 2 \
  --body "Test coverage for all auth endpoints"

# List all tasks
hermes kanban list

# Check board statistics
hermes kanban stats

How the durability machinery works:

When a worker picks up a task, it starts sending heartbeats. If heartbeats stop (crash, network loss, OOM), another worker reclaims the task after a configurable timeout. Zombie detection catches workers that appear alive but aren’t making progress — they’re marked dead and their tasks are redistributed. If a task fails N times in a row, the retry budget kicks it to a human-review lane rather than looping forever. Workers that exit without completing their current task are auto-blocked to prevent silent abandonment.

The hallucination gate is what makes this production-grade, not a demo. When a worker claims it completed a task, the system verifies the claim before accepting it — checking for evidence that work was actually done, not just asserted.

# hermes.config.yaml — kanban worker profile
kanban:
  board: project-a
  worker:
    max_spawn: 5              # up to 5 concurrent workers
    heartbeat_interval: 30s
    reclaim_timeout: 120s     # how long before an idle task is reclaimed
    max_retries: 3            # default retry budget per task
    auto_block_on_exit: true  # block tasks left incomplete on exit

You can also override retries per task for tasks that need more (or fewer) attempts:

hermes kanban create "Fragile data migration" --max-retries 1
hermes kanban create "Brute-force search job" --max-retries 10

Under the hood, the Kanban system includes:

  • Multi-project boards — one Hermes install, many independent kanbans
  • Atomic state writes — no partial board corruption on crash
  • Per-platform home-channel notifications — get notified in Telegram, Discord, or Slack when tasks change state
  • A generic diagnostics engine for task distress signals — workers can flag “I’m stuck, here’s why”
  • Dashboard integration — real-time board view, inline task creation, workspace and path inputs

2. /goal — The Agent Doesn’t Forget What You Asked It to Do

The Ralph loop, now a first-class primitive. /goal locks the agent onto a target and keeps it there across turns. If the user tries to derail mid-conversation, the agent acknowledges the detour and returns to the objective. If a tool fails, it finds another way. If the session spans hours, the goal stays pinned.

# Set a persistent goal
/goal "Research the top 5 CRM tools, compare their pricing, and summarize the best fit for a 50-person startup"

# The agent stays locked on this across turns.
# You can ask unrelated questions — it'll answer, then circle back.

The /goal system uses a judge model to evaluate whether the objective is satisfied. The judge runs after each turn, assessing progress against the stated goal. The agent can take detours (side tasks, clarifications, tool failures) but cannot permanently abandon the goal until the judge declares it complete.

# Check goal status at any time
/goal status

# Pause and resume
/goal pause
/goal resume

# Clear and set a new one
/goal clear

/goal pairs with /subgoal (landing in v0.14.0) to let you add success criteria mid-flight. Together they approximate what a traditional project plan does — an objective plus refinements as you go.

3. Checkpoints v2 — State Persistence Rewritten

The old checkpoint system accumulated orphan shadow repos, had no real pruning, and grew unbounded. Checkpoints v2 is a clean rewrite:

  • Single-store architecture — no more scattered state across directories
  • Real pruning — old checkpoints are actually deleted, with configurable retention
  • Disk guardrails — refuses to checkpoint when disk is critically low
  • No orphan repos — every git shadow has a tracked lifecycle

Combined with the new gateway auto-resume feature, the agent now survives restarts transparently. Gateway bounces mid-agent? The conversation resumes. /update restarts the process? Back where you left off. Source file reloads? The session picks up.

4. Security Wave — 8 P0 Closures

This is the most security-hardened release in Hermes history. Eight critical vulnerabilities closed in a single release:

# Fix Severity What changed
1 Redaction ON by default P0 Agent output redacts sensitive content automatically — you don’t enable it, it’s on
2 Discord role-allowlists guild-scoped CVSS 8.1 Previously, roles from one guild could authorize access in another (cross-guild DM bypass)
3 WhatsApp rejects strangers P0 New WhatsApp connections blocked unless explicitly allowlisted; never responds in self-chat
4 MCP OAuth TOCTOU closed P0 Time-of-check-to-time-of-use window closed when saving OAuth credentials
5 auth.json TOCTOU closed P0 Credential writers hardened against race conditions
6 Browser cloud-metadata SSRF floor P0 Hybrid routing enforces cloud metadata endpoint block even on non-local CDP backends
7 Cron prompt-injection scans P0 Assembled skill content scanned for prompt injection before cron execution
8 hermes debug share redaction P0 Log content redacted at upload time, not after

Plus additional hardening:

  • .env, auth.json, and state.db restored with 0600 permissions — owner read/write only
  • SRI integrity for dashboard plugin scripts
  • Meet node server bound to localhost only, token file restricted to owner read
  • Sensitive-write target extended to cover shell RC files and credential files
  • YOLO mode hardened against quoted-bool string parsing
  • OSV-Scanner CI + Dependabot for dependency vulnerability monitoring

5. Google Chat — The 20th Messaging Platform

Hermes now supports 20 messaging platforms natively, with Google Chat as the newest addition. The full list:

Telegram, Discord, Slack, WhatsApp, Signal, DingTalk, SMS (Twilio), Mattermost, Matrix, Webhook, Email (IMAP/SMTP), Home Assistant, Feishu/Lark, WeCom, Weixin, BlueBubbles (iMessage), QQBot, Yuanbao, Microsoft Teams, Google Chat.

All 20 platforms run from one gateway process with unified session management, restart handling, and thread routing. The gateway architecture now includes generic platform-plugin hooks — env_enablement_fn and cron_deliver_env_var — so third-party adapters drop in without touching core. IRC and Teams have already been migrated to this surface.

New cross-platform capabilities in this release:

  • allowed_channels / allowed_chats / allowed_rooms config across Slack, Telegram, Mattermost, Matrix, and DingTalk — restrict which channels the agent can interact with
  • Per-platform gateway_restart_notification flag — control whether each platform gets a “I’m back” message after restart
  • busy_ack_enabled config — suppress “I’m working on it” acknowledgment messages
  • Auto-delete slash-command system notices after TTL
  • [[as_document]] directive — skills can force the gateway to deliver output as a document on platforms that support it

6. Providers Become a Pluggable Surface

Inference providers are no longer hardcoded into the core. A new ProviderProfile ABC and plugins/model-providers/ directory make them a first-class plugin surface:

# plugins/model-providers/my_provider.py
from hermes.abc import ProviderProfile

class MyProvider(ProviderProfile):
    name = "my-custom-provider"
    display_name = "My Custom Provider"

    def list_models(self) -> list[ModelInfo]:
        ...
    
    def chat_completion(self, request: ChatRequest) -> ChatResponse:
        ...

Drop provider plugins into the directory, and they appear in the model picker alongside OpenAI, Anthropic, and the built-in set. No core code changes needed.

New models added in this release:

Model Provider Notes
deepseek/deepseek-v4-pro OpenRouter + Nous Portal Latest DeepSeek flagship
x-ai/grok-4.3 OpenRouter + Nous Portal xAI’s newest
openrouter/owl-alpha OpenRouter Free tier
tencent/hy3-preview OpenRouter Paid route
Arcee Trinity Large Thinking OpenRouter Temperature + compression overrides

OpenRouter response caching is now supported for models that expose it — reduce costs on repeated context.

Nous OAuth now persists across profiles via a shared token store: sign in once, every profile inherits the session. No more re-authenticating for each profile.

7. Internationalization — 7 Locales

Hermes now speaks Chinese, Japanese, German, Spanish, French, Ukrainian, and Turkish — plus English. Static gateway messages (CLI help text, agent status, error messages) are fully translated. The docs site gains a Chinese (zh-Hans) locale.

# hermes.config.yaml
display:
  language: zh  # or ja, de, es, fr, uk, tr

8. Video & Voice — See and Speak

video_analyze gives Hermes native video understanding on Gemini and compatible multimodal models:

# Analyze a video from a file
hermes run "Watch meeting-recording.mp4 and summarize the decisions made"

# From a URL
hermes run "Analyze https://example.com/demo.mp4 — what's the workflow shown?"

xAI Custom Voices lands as a TTS provider with voice cloning support. Record a voice sample and Hermes will speak replies in your voice — or any voice you provide.

9. Delta Linting — The Agent Lints Its Own Writes

After every write_file or patch operation, Hermes now runs in-process linters for Python, JSON, YAML, and TOML. Syntax errors surface immediately instead of shipping downstream:

WRITE src/auth.py
  ✓ Syntax OK (Python 3.12)
  ✓ Import check passed

WRITE config.json
  ✗ Syntax error: Unexpected token at line 14, column 3

No more discovering broken syntax ten turns later when you try to run the code.

New Built-in Tools & Commands

Tool / Command Description Usage
/goal Persistent cross-turn goal tracking (Ralph loop) /goal "Research X and summarize"
/goal status Check current goal progress /goal status
/goal pause / /goal resume Pause or resume goal pursuit /goal pause
/goal clear Clear the current goal /goal clear
video_analyze Native video understanding on multimodal models video_analyze path/to/video.mp4
hermes curator archive Archive curated skills hermes curator archive
hermes curator prune Prune old/consolidated curator entries hermes curator prune
hermes curator list-archived List all archived entries hermes curator list-archived
[[as_document]] Skill directive — deliver output as a document Add [[as_document]] in skill frontmatter
transform_llm_output Plugin hook — reshape/filter LLM output Implement in plugin
X-Hermes-Session-Key API header for stable session memory scoping Pass via HTTP header
no_agent cron mode Script-only watchdog — run scripts without an agent Set no_agent: true in cron job config
OpenRouter cache control Explicit caching for supported models Via cache: true in provider config

Improvements

Core Agent & Conversation

  • [[as_document]] skill directive — skills can force the gateway to deliver output as a downloadable document instead of inline text
  • transform_llm_output plugin hook — new lifecycle hook that lets plugins reshape or filter LLM output before it hits the conversation; useful for context-window reducers and content filters
  • Context compression count shown in the status bar (CLI + TUI) — see how many times the context has been compressed
  • Isolated get_tool_definitions cache — deduplicates LCM injection and avoids redundant tool schema queries
  • Warning-first tool-call loop guardrails — the agent warns before entering infinite tool loops instead of silently spinning
  • Break permanent empty-response loops — orphan tool tails no longer cause infinite empty-response cycles
  • ContextVars propagated to concurrent tool worker threads
  • Surface self-improvement review summaries across CLI, TUI, and gateway
  • Token estimates now include system prompt + tool schemas for accurate compression triggers

Platform Allowlists

  • allowed_channels (Slack), allowed_chats (Telegram), allowed_rooms (Mattermost, Matrix), and allowed_robots (DingTalk) — restrict agent interaction to specific channels
  • Per-platform gateway_restart_notification — granular control over post-restart messages
  • busy_ack_enabled — suppress “I’m working on it” acknowledgment messages
  • Auto-cleanup of temporary progress bubbles

Session Durability

  • Gateway auto-resumes interrupted sessions after restart — no lost conversations
  • Pending update prompts preserved across restarts
  • Home-channel thread targets preserved across restart notifications
  • Thread routing preserved from cached live session sources
  • Assistant metadata preserved when branching sessions
  • Document type preserved when merging queued events

Curator (from v0.12, matured in v0.13)

  • hermes curator archive — archive curated entries for long-term storage
  • hermes curator prune — clean up old, consolidated, or orphaned entries
  • hermes curator list-archived — view archived entries
  • Synchronous manual hermes curator run — see results immediately without polling
  • Protected from overwriting bundled and hub skills

MCP (Model Context Protocol)

  • SSE transport with OAuth forwarding and bumped sse_read_timeout
  • Stale-pipe transport retries as session-expired (auto-reconnect)
  • Image tool results surface as MEDIA tags instead of being silently dropped
  • Periodic keepalive on long-lived lifecycle waits
  • Reconnect on terminated sessions automatically
  • Defensive numeric tool arg coercion in mcp_serve
  • Utility stubs gated on server-advertised capabilities

Kanban Dashboard

  • Workspace kind + path inputs in inline task creation
  • Per-platform notification toggles for home-channel alerts
  • Multiline textarea for task titles
  • Boards filter by selected tenant
  • Dashboard board pin authoritative over server current file

QQBot

  • Native approval keyboards — inline Approve/Deny buttons for tool authorization
  • Chunked upload for large files
  • Quoted attachment support

TUI & CLI

  • 100 new CLI startup tips covering cron, kanban, curator, plugins, and lesser-known flags
  • /model picker matches hermes model with inline auth for all providers
  • Collapsible sections in the startup banner (skills, system prompt, MCP)
  • /new accepts optional session name: /new my-refactor-session
  • hermes update --yes/-y to skip interactive prompts

Dashboard

  • Plugins page — manage, enable/disable, and check auth status for all plugins
  • Profiles management page — create, edit, and delete profiles from the web UI
  • Interactive column sorting in analytics tables
  • default-large theme with 18px base font size
  • Reverse-proxy support via X-Forwarded-Prefix header
  • Launch as side-process via HERMES_DASHBOARD=1 in Docker

Web Tools

  • SearXNG ships as a native search-only backend
  • Per-capability backend selection — pick different backends for search vs extract vs browse

ACP (VS Code / Zed / JetBrains)

  • /steer slash command — direct the in-flight agent
  • /queue slash command — queue follow-up tasks
  • Atomic session persistence via replace_messages
  • Assistant reasoning metadata preserved across session persistence
  • Windows cwd translation for WSL sessions

Security & Reliability

Critical Bug Fixes

  • CLI crash on startup — Invalid key 'c-S-c' (P0): prompt_toolkit doesn’t support the Shift modifier; keybinding removed
  • CLOSE_WAIT fd leak audit: httpx keepalive + WhatsApp aiohttp leak + Feishu hygiene — all fixed
  • Gateway creates AIAgent with empty OpenRouter API key when OPENROUTER_API_KEY is missing — fallback providers now correctly honored
  • Background review + curator protected from overwriting bundled/hub skills
  • TUI compression continuation ghost sessions with incomplete metadata — fixed
  • hermes mcp add silently launches chat instead of registering MCP server — fixed
  • Background review agent runtime propagation — provider/model/credentials now actually inherit from parent
  • Inbound document host paths translated to container paths for Docker backend
  • Matrix gateway race between auto-redaction and message delivery with high-speed models — fixed
  • /new during active agent session never sends response on Telegram — fixed
  • Config.yaml wins over .env for agent/display/timezone settings
  • Git HEAD SHA used for stale-code check, not file mtimes
  • Plan service stops handled without false-fatal errors
  • Source file auto-restart when files change out from under the gateway

WhatsApp Hardening

In addition to the P0 stranger-rejection fix:

  • Load home channel from env overrides
  • Never respond in self-chat (prevents loop amplification)

Platform Reliability

  • Gateway reset-failed before every fallback restart — prevents stranded gateway states
  • Atomic restart markers + Windows runtime-lock offset
  • Shutdown + restart hygiene — drain timeout, false-fatal, success log
  • Ancestor PIDs excluded from gateway process scan
  • Quick-command alias dispatch moved before built-ins (prevents accidental override)
  • Other profiles shown in gateway status to prevent confusion

File Security

  • Restore .env / auth.json / state.db with 0600 permissions
  • Meet node server bound to localhost only
  • Token file restricted to owner read
  • Sensitive-write target extended to shell RC files and credential files

Upgrade

hermes update

For new installations, visit the install guide.

Full changelog on GitHub

← Hermes Agent Changelog