Overview

v0.20.6 — The Steady Roll Release. Released August 27, 2026. ~525 merged PRs · ~1,313 commits · ~1,557 files changed (+177,113 / −21,682) since v0.20.5.

This window is a steady roll of substance: the top story is consent-gated real-profile browsing — the agent can now drive a snapshot of your own browser profile, so it browses as you, with your existing logins and cookies, always under explicit consent and off by default. Around that, the desktop Browser gains its own OS window and a managed SSH remote-update engine; the built-in remote MCP catalog passes 50 live-verified vendor-hosted servers (Cloudflare, Grafana Cloud, Better Stack, Railway and more); web_search/web_extract add TTL result caching so repeat lookups stop re-billing vendors; lean-tail compression becomes the default; tool_search learns multi-query searches with stemming; stored secrets can opt into OS-keychain encryption (no more per-launch macOS Keychain prompts); updaters pause gateways over the control socket instead of tree-killing them; and new models appear across the pickers (GLM-5.3-Flash, MiniMax M3 free, MiniMax H3 Max video).

This is a patch release, so the official notes are brief and the full curated documentation ships with v0.21.0. This page covers the most valuable parts of the window.

---

Highlights

1. Real-profile browsing: the agent browses as you

The agent’s browser used to run in a clean, logged-out world — fine for public research, frustrating the moment a task needs your logged-in state. v0.20.6 adds consent-gated real-profile browsing (#1f4d095fd8, #830e4a29be): when enabled, Hermes copies your default browser’s active profile (cookies, saved logins, preferences) into a managed snapshot under ~/.hermes/browser-profile/, then drives that snapshot with its packaged Chromium. Your live profile is never opened directly, and auth files re-sync whenever a fresh session launches, so logins you do in your own browser show up in the agent’s session.

# ~/.hermes/config.yaml
browser:
  use_real_profile: true

The browser_exec tool exposes a local argument (only when the toggle is on) that forces a real-profile session even under a cloud browser backend. Windows needs the browser fully quit before copying (Chrome/Edge/Brave lock their cookie DBs), and browser.real_profile_autoclose: true lets Hermes offer to close it for you — it never closes it on its own. Turning the toggle off deletes the snapshot store, so copied credentials don’t linger after you revoke consent. Supported browsers: Chrome, Edge, Brave, Chromium; a non-Chromium default (e.g. Firefox) fails closed with a clear message. Also on desktop: Settings → Browser → Use My Real Browser Profile.

2. Desktop Browser in its own OS window + managed SSH remote-update engine

The desktop Browser graduates from an embedded pane: it can now open in its own OS window — resize it, move it between monitors, keep it beside your editor. Desktop also gains a managed SSH remote-update engine: per-connection updates over SSH for remote gateways, so a fleet of machines stays current from one desktop app (fleet profile rail included — switch profiles and the update targets follow).

3. Remote MCP catalog: 50+ live-verified vendor servers

The built-in remote MCP catalog grows to 50+ live-verified vendor-hosted servers — Cloudflare, Grafana Cloud, Better Stack, Railway, Canva, Dropbox, GitLab, Strava and more. Every entry is verified against the vendor’s live endpoint, and ?codemode=false is pinned so tool_search sees the full endpoint surface of each catalog entry. One command to see what’s available:

hermes mcp catalog list --remote

4. TTL result caching for web_search / web_extract

Repeat searches and extracts within a short window no longer re-bill the vendor: web_search/web_extract results are cached with a TTL (configurable via web.cache_ttl), so a retry, a re-run of the same prompt, or a cron job that checks the same URL twice gets the cached answer instead of a fresh (paid) call. Saves money on long agent runs and recurring jobs.

5. Lean-tail compression is now the default

Compression got quieter and cheaper: lean-tail is the default mode — instead of keeping a long tail of low-value turns, the compressor keeps a compact summary plus a short, high-value tail, cutting what every turn re-sends after compression. Existing configs that never set agent.compression.tail_mode pick up the new default on upgrade; explicit settings are untouched.

6. tool_search: multi-query with stemming

tool_search now accepts queries: string[] — searched independently against the same catalog, limit applies per query (default 5, max 25) — and returns grouped results: per-query groups carry tool names only, with one shared tools map holding each matched tool’s source, description, and required parameters. tool_describe takes names: string[] and returns a map keyed by name, so one bad name no longer fails the whole call. Snowball stemming matches ‘browsing’ to ‘browser’ and ‘searches’ to ‘search’.

{ "queries": ["browser snapshot", "web search cache", "read pdf"] }

7. Opt-in OS-keychain encryption for stored secrets

Electron’s safeStorage used to park a per-app key in the macOS login keychain, and on machines with a locked/missing keychain that turned every Desktop launch into a blocking “Keychain Not Found” dialog. Keychain-backed encryption is now an explicit opt-in (Settings → Gateway): the default path never calls any safeStorage API, and a one-shot migration converts existing encrypted blobs to plain 0600 files at first launch. Flip the toggle and every stored secret store (connection.json, connections.json, native-oauth-tokens.json) re-encodes in place.

8. Updaters pause gateways over the control socket

hermes update no longer tree-kills running gateways: updaters pause gateways over the control socket — services quiesce gracefully, the update lands, and gateways resume — so in-flight turns and messaging connections survive the upgrade. Image/package-managed installs also refuse unsafe in-place updates through one shared gate (#91277 Phase 3), and gitignored user files block the destructive ZIP overlay.

Improvements

• Cron: durable-incident acks (a job that hit an incident can be acknowledged once, and the ack persists), and clearer code-skew failures when the scheduler and gateway disagree on code version.
• Slack: link-unfurl controls (unfurl_links/unfurl_media stamped onto outbound frame metadata) — teams can stop the agent’s links from expanding into cards.
• Docker: trusted profiles can opt into one shared persistent container instead of splitting per chat; stage2 API_SERVER_KEY bootstrap no longer depends on .env existing.
• Terminal: third-party sandboxes plug in as terminal backends without touching core.
• Models: GLM-5.3-Flash reaches the z.ai + OpenCode pickers; MiniMax M3 free joins OpenRouter; MiniMax H3 Max joins the FAL video picker (t2v + i2v).
• state.db: journal_mode choices are no longer silently ignored; synchronous is pinnable on every platform.
• browser_exec: tool rows are titled by their leading # step comment, and the schema dieted ~17% (803 → 663 tokens/call) at accuracy parity.

Fixes

• Gateway: two-witness loop liveness — the watchdog’s own heartbeat can no longer freeze or kill a healthy gateway (#92315, salvage of #90502).
• Gateway: launchd --replace double-kill fixed — SIGUSR1 graceful restart instead of supervised-argv takeover (#96427).
• Sessions: the empty-session sweep no longer deletes an archived transcript (#96401); legacy NULL-owner sessions get single-match owner backfill + read-only stored-transcript resume (#96110).
• MCP: stdio fast-fail gate requests a respawn when it finds a dead subprocess; un-inverted the children liveness check (#94339).
• Gemini 3.x: images are embedded in functionResponse.parts so multimodal tool results actually reach the model (#96466).
• Desktop: group chats stop leaking empty sentinels and stop swallowing real answers; an @mentioned bot always gets its turn (#96239, #96240).
• Update: gitignored user files also block the destructive ZIP overlay (#96440).
• Approval: oversized approvals.timeout no longer crashes parallel tool batches — clamped at config read (#86412).

Upgrade

hermes update

After upgrading, run hermes doctor to verify the install and restart the gateway (hermes gateway) so platform changes take effect. To see what the next update will touch before running it: hermes update --plan.

← Hermes Agent Changelog