v0.16.0

Hermes Agent v0.16.0 — The Surface Release

Overview

v0.16.0 — The Surface Release. Released June 5, 2026. 874 commits · 542 merged PRs · 1,962 files changed · 205,216 insertions · 46,217 deletions · 399 issues closed (2 P0, 62 P1, 16 security-tagged) · 170 community contributors.

The Surface Release is about one thing: Hermes meets you wherever you work. A brand-new native desktop app — built across 100 PRs and 159 commits in a single week — delivers Hermes as a real macOS/Linux/Windows application with one-click install, in-app self-update, drag-and-drop files into chat, and an inline model picker. The web dashboard evolves into a full browser-based administration panel (MCP catalog, messaging channels, credentials, webhooks, memory, pluggable OIDC/username-password login). First-time setup is trimmed to “Quick Setup via Nous Portal” — from install to first message in seconds. The default skill set is leaner, NVIDIA/skills joins the trusted Skills Hub, the model picker is fuzzy-searchable everywhere, and /undo lets you take back the last N turns.

This release fundamentally changes who can use Hermes. Not just terminal dwellers — anyone with a desktop.

Major Features

1. Hermes Desktop — A Real Native App

This is the headline. After a year as a terminal-and-messaging tool, Hermes gets a proper GUI. The apps/desktop/ Electron application installs like any desktop app on macOS, Linux, and Windows, updates itself in place, and delivers a polished chat interface.

What you get out of the box:

# Launch the desktop app from CLI
hermes desktop

# Or download the installer for your platform:
# macOS: .dmg
# Windows: .exe
# Linux: --include-desktop flag on the shell installer

Key capabilities:

  • Streaming chat window with live tool-activity display
  • Session list with archive, search, and folder grouping — every conversation is a named, persistent session
  • Drag-and-drop files anywhere in the chat area + clipboard image paste with dedupe
  • Cmd+K command palette for quick actions
  • Inline model picker right in the status bar — switch models without leaving the chat
  • YOLO toggle in the status bar (TUI parity)
  • One-click install + in-app self-update — detects your platform, fetches the latest release, rebuilds if needed, and relaunches cleanly
  • Boot-failure recovery + live API-key validation + cancellable install

The architecture matters: The desktop app runs the exact same Hermes Agent core as the CLI. Same config file. Same API keys. Same sessions. Same skills. Same memory. Start a session in the CLI, resume it in the desktop window, or the reverse. Nothing is forked, nothing is duplicated — it’s the same agent, with a new surface.

2. Remote Gateway — Sign In with OAuth or Username/Password

The desktop app doesn’t have to run Hermes locally. Point it at a remote Hermes gateway and it connects over a secure WebSocket, authenticating with OAuth or username/password — no --insecure flags, no hand-copied session tokens.

# Connect the desktop app to a remote gateway
# 1. Open the desktop app
# 2. Add a profile pointing to your remote host
# 3. Sign in with OAuth or username/password
# 4. Start chatting — heavy compute runs wherever your API keys live

Multi-profile sessions in one window: Each profile targets its own remote host, and you can run concurrent sessions across profiles with cross-profile @session links. Your laptop is a thin GUI; the agent runs wherever your compute lives.

Production details:

  • Per-profile remote gateway hosts with live WebSocket validation
  • OAuth WS ticket re-minting on gateway reconnect
  • Offers remote sign-in on gated-gateway boot failure
  • Full multi-profile support over one global-remote dashboard

3. Web Dashboard — Full Administration Panel

The dashboard grew from “view your sessions” into a complete administration surface. Configure your entire gateway from the browser — no more SSH and YAML edits.

What’s now point-and-click:

Panel What you can do
MCP Catalog Enable/disable MCP servers, pairing, webhooks
Channels Set up every gateway messaging platform (Telegram, Discord, Slack, etc.)
Credentials Manage API keys and OAuth grants
Webhooks & Hooks Create and configure webhooks and hook triggers
Memory Configure memory providers and settings
Gateway Gateway controls, status, and configuration
System Check-before-update flow + one-click Debug Share

Auth improvements:

  • Pluggable username/password login (Option B)
  • Generic self-hosted OIDC provider with multi-provider verify
  • hermes dashboard register for self-hosted OAuth client setup
  • Rotate dashboard sessions via refresh token
  • Chat tab works in gated (OAuth) mode

The practical result: you can onboard a teammate, wire up a new messaging channel, or add an MCP server entirely from the browser — no terminal access needed.

4. Simplified Chinese (简体中文) Translation

The desktop app now ships a complete Simplified Chinese translation across every UI surface — the chat window, sidebar, settings, command center, cron, messaging, profiles, skills, and agents.

# Switch language in Appearance settings
# Persisted to config:
display:
  language: zh  # English (default) or zh

It’s built on a proper typed i18n layer, so adding more languages is straightforward from here.

5. Leaner Default Skill Set

The bundled skill set got a deliberate trim. Hermes now ships only what you actually need — less noise in the picker, lighter prompts, faster startup.

Removed (redundant or dead):

  • spotify — superseded by native Spotify plugin’s 7 tools
  • linear — superseded by hermes mcp install linear
  • kanban-codex-lane, debugging-hermes-tui-commands, stale domain orphan
  • Empty category markers (diagramming, gifs, inference-sh, mlops/training, mlops/vector-databases)

Moved from bundled to optional (one hermes skills install away):

  • baoyu-article-illustrator, baoyu-comic, creative-ideation, pixel-art
  • dspy, subagent-driven-development
  • minecraft-modpack-server, pokemon-player, hermes-s6-container-supervision

New environments: relevance gate — context-specific skills (kanban, docker, s6) stay out of the index for users who’ll never use them, but still load on explicit request.

# Start fresh with zero skills — opt into everything
hermes skills install --no-skills

6. NVIDIA/skills — Built-in Trusted Skills Tap

NVIDIA/skills joins OpenAI, Anthropic, and HuggingFace as a default trusted tap in the Skills Hub. NVIDIA’s verified skills for CUDA-X, AIQ, cuOpt, and their full product stack are discoverable, browsable, searchable, and auto-updating through the same pipeline.

# Browse NVIDIA skills in the Skills Hub
hermes skills browse nvidia

# Install one
hermes skills install nvidia/cuda-x-toolkit

Real category labels come from the repo’s skills.sh.json sidecar — no guessing what a skill does.

7. Fuzzy Model Picker, Everywhere

Type a few letters, find your model. The model picker now does fuzzy search across desktop, web, TUI, and CLI.

# Type "v4fl" and deepseek-v4-flash surfaces
# Type "mini" and MiniMax-M3 with 1M context appears
# Type "qwen" and qwen3.7-plus shows up

What changed under the hood:

  • Multi-endpoint providers grouped under one row — no more duplicate clutter
  • Each row carries a description so you know what you’re picking
  • Catalog refreshes hourly instead of daily — new models available the same day they launch
  • Always shows Nous Tool Gateway backends; login on select

8. /undo [N] — Take Back the Last N Turns

Said the wrong thing, or sent the agent down a bad path? /undo backs up N user turns, prefills your last message so you can edit and resend, and soft-deletes the turns in between.

# Undo the last turn
/undo

# Undo the last 3 turns
/undo 3

Works in CLI, TUI, and across messaging platforms (Telegram, Discord, etc.) with full parity. This closes a long-standing community request.

9. Quick Setup via Nous Portal

First-time setup is now two clear paths:

# Path 1: Quick Setup — sign in, pick a model, start chatting (seconds)
hermes portal

# Path 2: Full Setup — detailed wizard for power users
hermes setup

The first-run menu explains the difference inline. A brand-new user can go from install to first message without reading docs.

10. Choose Your Default Interface — CLI or TUI

Set whether hermes chat drops you into classic CLI or the Ink TUI by default.

# hermes.config.yaml
default_interface: tui  # or cli
# Override per invocation
hermes chat --cli

The TUI also gained a unified /model command and a Sessions overlay for switching between live sessions.

New Built-in Tools & Commands

Tool / Command Description Usage
/undo [N] Take back the last N user turns with prefill + soft-delete /undo or /undo 3
/model Unified model switcher in TUI /model
hermes portal Quick Setup via Nous Portal hermes portal
hermes skills install --no-skills Blank-slate install — opt into everything hermes skills install --no-skills

Core Agent & Architecture

Provider & Model Support

  • New models: deepseek-v4-flash (+ trimmed variants, maker-grouped curated lists), MiniMax-M3 with 1M context on native minimax providers, qwen3.7-plus (Nous + OpenRouter), gemini-3.5-flash to Gemini OAuth + API-key pickers
  • Model picker: fuzzy search across WebUI/TUI/CLI; group multi-endpoint providers under one row; refresh provider descriptions; catalog refreshes hourly
  • Always show Nous Tool Gateway backends; surface the Nous free tool pool (entitlement + setup prompt)
  • Persist mid-session model switch to database; recover model on post-interrupt recovery turn
  • Credential pool: STATUS_DEAD for terminal OAuth failures; isolate custom provider picker credentials

Agent Loop & Tools

  • Progressive tool disclosure for MCP and plugin tools (scoped)
  • Embedder environment-hint hook for the system prompt
  • Universal task-completion guidance + local Python toolchain probe
  • Uncap delegation max_spawn_depth (floor 1, no ceiling)
  • perf(read_file): compact line-number gutter — ~14% fewer tokens per read (now the only format)
  • Resolve agent cwd from TERMINAL_CWD via one reader
  • Observer telemetry hooks + NeMo-Relay plugin (gated tool emit)

Sessions & Memory

  • perf(state): merge FTS5 segments on VACUUM + hermes sessions optimize; keep /branch sessions visible after parent reopen
  • Honcho: make startup fail open; harden self-hosted setup paths
  • Supermemory: session-level ingest + kebab aliases

Multi-Agent (Kanban) & Skills

Kanban

  • goal_mode cards run workers in a /goal loop
  • File attachments on tasks; attach images referenced in task bodies to worker vision
  • default_assignee fallback + per-profile concurrency cap
  • POST /runs/{run_id}/terminate endpoint
  • CLI dispatch config passthrough + humanizer skill swap

Skills

  • Curator can now prune unused built-in skills (not just agent-created), with usage tracked for every skill
  • Blank-slate skills — install --no-skills + opt-out/opt-in for the default profile
  • Skills Hub: fix browse cap, add source links + copy buttons + category cleanup
  • New optional skills: grok (xAI Grok Build CLI), antigravity-cli operator

Messaging Platforms (Gateway)

  • Structured stream-event protocol + Telegram draft formatting parity; per-platform streaming defaults (Telegram on, Discord off) + dashboard toggles
  • Discord voice-channel mixer — ambient idle bed + verbal acks that overlap TTS; explain /voice usage when toggled bare
  • Handle Feishu meeting invitations; BlueBubbles group mention gating; Matrix bang-command aliases; Matrix fail-closed approval reaction auth
  • Clean service restart flow; close ResponseStore + dispose unowned adapter on reconnect failure

CLI, TUI & Setup

  • Thin out setup — Quick Setup via Nous Portal + Full Setup defaults; explain Quick vs Full inline
  • Set process title to hermes in ps/top/htop
  • Warn on unsupported pip installs + fix stale update-check cache
  • TUI perf: stop slow/dead MCP servers from freezing startup; stop eager MCP discovery from blocking agent-capable startup; stop persisting full tool output in trail lines (silent OOM)
  • TUI fixes: auto-recover session on unexpected gateway death; reassemble split SGR mouse sequences; preserve UTF-8 in PowerShell clipboard; reset terminal input modes on exit; /save snapshots under Hermes home
  • Setup model/provider pickers migrated off simple_term_menu to curses (ESC + ghost-row fixes); default browser/TTS picker to free local backend

Tool System & Installer

  • single managed-uv path, delete fts5 installer escalation; installer commit pinning opt-in (default branch-follow); shallow clones
  • ensure_uv() survives the update boundary (no first-run crash); harden venv rebuild + verify core deps after install
  • MCP: stop reporting false OAuth success when no token was obtained; vision honors model.supports_vision in vision_analyze + browser_vision
  • MiniMax t2a_v2 TTS raise_for_status
  • Yuanbao: cache resolved media resources by resourceId

Docker & Deployment

  • Container reuse + bounded-sync cleanup + orphan reaper; auto-join Docker socket group for docker-in-docker backend
  • Boot non-root containers (skip s6-setuidgid drop when already unprivileged)
  • Skip unnecessary boot chown when volume ownership matches remapped UID
  • Seed gateway_state.json from HERMES_GATEWAY_BOOTSTRAP_STATE on first boot
  • Tag containers with hermes-agent labels for identification
  • Point TUI launcher at prebuilt bundle via HERMES_TUI_DIR

Security & Reliability

CVEs & Hardening

  • CVE-2026-48710 (Starlette BadHost) — pin patched Starlette ≥1.0.1
  • Run URL SSRF checks off the event loop in async paths
  • Strip Bedrock inference bearer token from subprocess env
  • Add bws_cache.json to file-safety read guard
  • Neutralize file paths in mutation-verifier footer

Guard Rails

  • Restore approval/sudo context in execute_code + guard entry points
  • Add docker restart/stop/kill to DANGEROUS_PATTERNS
  • Sanitize invisible unicode in vetted skill content
  • Deepcopy tools before in-place xAI mutation
  • Sandbox-mirror soft guard for writes to per-task .hermes mirrors

Notable Bug Fixes

  • Desktop: keep in-flight new chats from vanishing on refresh; Stop button actually interrupts when a turn is queued; stop background session messages bleeding into the active transcript; slash/@ completion menu navigable & Esc-dismissable; IME Enter no longer splits messages
  • Update: stop stash/restore from clobbering desktop source on managed clones; don’t fail desktop rebuild/skills sync on mid-rebuild venv
  • Voice: honor PIPEWIRE_REMOTE in PortAudio fallback; allow /voice over SSH when a sound server is reachable; restore mistralai (2.4.8 clean, ban lifted)

Community Impact

This release attracted significant industry attention. ZDNet ranked Hermes with Ollama as its top desktop AI tool after extensive comparative testing. Ollama amplified the review to its developer audience, generating ~1,900 bookmarks within two days. The Hermes-Ollama pairing — a fully local, persistent-memory agent stack — was highlighted as a credible alternative to cloud-dependent agent platforms from Anthropic, OpenAI, and Google.

The desktop app fundamentally changed Hermes’s accessibility. Before v0.16.0, telling someone “it’s a CLI agent” meant watching their eyes glaze over. Now you send them an installer.

Upgrade

hermes update

For new installations, visit the install guide.

Full changelog on GitHub

← Hermes Agent Changelog