Overview

v0.21.4 — The One-Gateway Patch. Released September 21, 2026. Since v0.21.3: 5,071 non-merge commits · 5,169 changed files (+312,961 / −62,855) · 1,812 merged PRs · 2,116 closed issues, measured at commit 4b8a8134009a8727a289bcabeb0019fedd353128.

This tag exists for downstream consumers: Docker images, Hermes Cloud and hosted deployments all build from the newest release tag, so the fixes in this window have to land in a stable version before cloud users can get them. The release body is explicit that the full curated write-up is deferred to v0.22.0, which will document everything from v0.21.0 onward — highlights, feature areas and contributor credits. This page records what the tag is for, and the changes in the window that are already live on your machine and not yet written up anywhere.

---

Highlights

1. Gateway topology convergence: one host gateway per machine

The largest architectural change in the window. Exactly one hermes gateway run process per host per OS user, serving every profile; a secondary profile’s gateway run now attaches to the host process (printing its PID and served set, exit 0) instead of starting a second one. gateway start --all and restart --all mean that one host multiplexer, and never sweep away a gateway another profile is running.

The old gateway.multiplex_profiles: false switch is retired: it still parses, but it can no longer pin a separate gateway process — it resolves like an unset key and logs a warning. A named profile cannot install a new gateway unit without --force, and --standalone is deleted. The upgrade path is hermes gateway migrate --multiplex --dry-run to read the plan, then hermes gateway migrate --multiplex to apply it — convergence is defined by topology, not by the config flag, so re-running the command is the recovery path after an interrupted migration. PRs #118273, #118097, #118433.

2. Connectors: connect an app from the conversation

A user asks in chat to connect Notion and the backend runs the whole connection: it collects the values, shows the sign-in link, and the agent can call the new tool in the same turn. Desktop, hermes --tui and the classic CLI all draw the same setup step. The repository ships a catalog of 65 reviewed MCP servers, 55 of them using OAuth (#111008).

3. CLI and agent surface: structured output, pinned skills, journal mode

• hermes chat -q "..." --format stream-json emits JSONL events on stdout (init / text / tool_use / tool_result / result), with the terminal envelope carrying token stats and an exit code — so CI can consume a run without scraping the screen (#90411).
• skills.auto_load in config.yaml pins skills as fully loaded at the start of every new session, across CLI, TUI, gateway, cron and API agents; the injection resolves once per agent and is byte-stable, so prompt caching survives (#92048).
• hermes sessions set-journal-mode delete|wal converts state.db (or another store via --db) between WAL and DELETE journal mode offline: it refuses while any process holds the file, names each holder, and reads the header bytes back to verify (#117684).

4. Profile isolation: a run of P1 fixes

“One backend, many profiles” amplifies scoping mistakes, and this window closed a batch of them. #118275 makes every REST route honour the profile the request names — previously POST /api/memory/reset?profile=worker_beta deleted the launch profile’s MEMORY.md, and destructive routes now return 400 for an unnamed target on a multi-profile host. #118373 restores root-profile OAuth resolution for named profiles, fixing the post-update No Codex credentials stored failures. #118246 makes Desktop attach to the host backend instead of spawning a hermes serve per profile.

Improvements

• mcp.discovery_concurrency bounds MCP connect concurrency at boot (default 4, 0 for unlimited): with 8 stdio servers the measured peak drops from 8 to 4, removing the spawn storm (#117956).
• Three-state unauthorized DMs: gateway.unauthorized_dm_behavior gains decline, with unauthorized_dm_decline_message for the wording, and per-platform overrides.
• session_search time window: new after / before bounds (ISO dates or relative durations like 7d / 24h / 2w), plus a relaxed OR-matching retry when strict matching finds nothing.
• Desktop: chat/UI font picker (#111226), minimize to tray (#118441), modifier-tap HUD summoning (#118446), a per-chat status stack drawer (#118407), plugin uninstall and one-click local engine updates.
• One gateway restart per update: hermes -p X update and hermes -p Y update restart the host gateway once between them, with the notice reaching every served profile (#118108).
• Catalog updates: LTX 2.5 and Kling O3 Standard join the FAL video family; the plugin catalog gained a batch of community plugins, and every plugin and author now has its own page with the README pinned to a reviewed commit.

Fixes

• A managed-gateway 429 on image_generate and FAL video is recognised as a rate limit and retried once, instead of reporting “the model may not yet be enabled” (#118311).
• A post-update notice addressed to a platform that never connects stops retrying instead of logging every 2 seconds forever (#118312).
• The auto-title call no longer races the turn’s reply on a single-slot self-hosted model server (#117494).
• When a provider rejects an image, only the request copy is stripped — the session is no longer marked vision-unsupported (#118316).
• A compression worker’s TimeoutError is no longer mistaken for a poll timeout (#118319); session housekeeping runs on its own pool so it cannot starve turn bodies (#118318); conversation history survives ASCII-codec recovery (#118313).
• Read-only git-object cleanup on Windows (checkpoints, plugins, MCP catalog, profile distributions) no longer fails (#117609).

Upgrade

hermes update                      # git installs
# Docker / Hermes Cloud: images build from this tag
docker pull nousresearch/hermes-agent:v2026.9.21

On a machine running several profiles, start with hermes gateway status, then read hermes gateway migrate --multiplex --dry-run once.

← Hermes Agent Changelog