v0.22.0

Hermes Agent v0.22.0

Overview

v0.22.0 — The Threshold Release. Released October 13, 2026. Since v0.21.0: ~24,200 commits · ~6,080 merged PRs · ~15,600 files changed (+2,045,000 / −1,140,000) · ~7,180 issues closed · ~2,520 contributors.

Hermes was the god of thresholds: the doorway, the crossing, the boundary stone. v0.21.0 assembled the pantheon; v0.22.0 is about getting through the door. A fresh desktop install now opens on a guided setup chat that runs on a free trial model, so a newcomer is talking to Hermes before they own an API key. Connectors carry the agent across into the apps you already use, with no account needed to start. Local models bring it home to your own hardware with a one-click llama.cpp runtime. And the threshold itself got sturdier: tested SemVer stable releases that installs follow by default, signed desktop packages (including the Microsoft Store), and one package manager underneath everything. Around that spine: a 600-plugin catalog, the Claude 5.5 / GPT-6 model wave, password-manager sign-in for the browser, a bot screen you can take over, one backend and one gateway for every profile, and a codebase a third smaller.

This is the largest window Hermes has shipped, about 2.5x the v0.21.0 cycle, and it rolls up and fully documents the v0.21.1–v0.21.7 patch releases.

Highlights

1. A first launch that sets itself up

Open the desktop app on a computer where you have never used Hermes and it starts a short setup chat instead of a settings screen. One card at a time it asks your name, an accent color and a layout, which apps to connect, which plugins to install, then gives a quick tour and offers up to four first tasks picked for you. It runs on a free trial model (nous/welcome, once per OS user), so it needs no key; Skip setup ends it and Settings → Run onboarding again brings it back. The agent also gained set_theme, so “make it violet, dark mode” works in any desktop chat (#137429, #137522, #137807, #134209, #105258).

2. Connectors: Hermes works inside your apps

Through the Nous tool gateway, the agent can now act in hosted apps such as Linear and Notion: ask for an app, sign in once in your browser, and the tools are usable in the same turn. You do not need a Nous account to start; the first time you use an app, Hermes creates a free connectors-only identity. The desktop has a new Connectors page that puts hosted apps and your MCP servers in one list (it replaces the MCP tab), the same setup card appears in the TUI and CLI, and you can connect several named accounts of one app (a work and a home account) and manage them with /connectors or hermes connectors (#106842, #111008, #119074, #135143, #135072, #135097, #135151, #135173, #137426).

3. Local models in one click

Hermes can now run open models entirely on your machine with nothing leaving it: no account, no API key. It installs and maintains llama.cpp with the right engine for your hardware (CPU, CUDA, Metal, Vulkan or ROCm), rates every catalog model against your GPU and RAM, and picks the highest-quality build that fits. Downloads pause and resume, the server starts and stops with Hermes, and engine updates are one click. Start from Settings → Providers → Local Models on Windows, macOS and Linux, or hermes model → Local models in a terminal. The catalog includes Qwen3.8 27B, Qwen3.8 Flash Next (with its MTP speculative head), Qwen3.6 35B-A3B and DeepSeek V4 Flash, plus any GGUF from Hugging Face (#100667, #101823, #128768, #111423, #133111, #134116).

4. Stable release channels

Hermes now ships tested SemVer releases. Every release passes source CI, Docker, Nix, signed desktop builds and install/upgrade runs on every OS before it is published, and source installs now move from release to release by default instead of tracking every commit on main. Prefer the bleeding edge? hermes update --set-channel main, or the new channel switch in Desktop Settings → About. Moving to an older release is labelled a rollback and never happens without asking, and installer reruns keep you on the channel you chose (#102765, #135847, #135949, #136313, #137780).

5. Signed desktop packages, the Microsoft Store, and one package manager

The desktop app is now a sealed, signed package that carries its own Python and Node and updates itself, so first launch builds nothing. Windows gets a signed MSIX (x64 and ARM64) through App Installer or the Microsoft Store; macOS gets a signed, notarized build for Apple Silicon. Underneath, a new unified package manager (hermes pm) owns every pinned, hash-checked tool and Python environment: updates build a new environment and switch only once it passes its check, so a failed or killed update can no longer leave you half-applied (#102765, #132361, #132386, #120339, #122221).

6. The Plugin Catalog: 600 reviewed plugins

The plugin catalog launched this cycle and grew to 600 entries, each pinned to a reviewed commit and installable from Hermes Desktop or the CLI. Browse by category and star ranking with a page per plugin and per author; catalog rules keep listed plugins from patching Hermes internals or shipping unscannable binaries. Memory providers now live with their makers (Honcho, Supermemory, Hindsight, Mem0, OpenViking, Holographic), as do Home Assistant, Spotify and Langfuse: existing users are migrated automatically, and the default install got leaner (#69446, #111415, #117808, #113381, #114732, #131267, #132476, #136436).

7. The Claude 5.5 and GPT-6 model wave

Claude Fable 5.1, Opus 5.5, Sonnet 5.5 and Haiku 5.5, GPT-6 Astra, Sol and Luna plus GPT-6.1 Sol, and Gemini 4 Argon are pickable on Nous Portal, OpenRouter and native routes where offered. Prior reasoning is now replayed by default on every provider that can read it, across resume, branches and compaction, so long multi-step work keeps its train of thought. And when a provider has a bad hour, Hermes waits out transient 503/529/timeouts in visible, bounded cycles instead of ending your turn (#100577, #119304, #126842, #134759, #128248, #137955, #136358, #116353).

8. Sign in to websites with your password manager

The browser agent can log into sites with logins from 1Password, Bitwarden or Hermes’s own encrypted vault, and the model never sees the password. If nothing is saved, you get a masked prompt in the CLI, TUI or Desktop to save it, one-time codes are filled without entering the conversation, and card and address fills at checkout need your confirmation (#106480, #107585, #137084).

9. Bot Screen: watch your bot work, take over when it needs you

A bot running on a Linux gateway can have its own desktop that Hermes Desktop streams live. When it hits a login, a 2FA prompt or a CAPTCHA, you take the screen, finish the step yourself, and hand control back while the bot carries on with your session. With a Docker, SSH or Singularity backend, the bot’s screen, computer use and the browser run inside the sandbox, never on your host (#108914, #121169, #121110).

10. One backend and one gateway for every profile

Hermes now runs a single messaging gateway and a single desktop backend per machine that serve all of your profiles, instead of one process per profile. Creating a profile makes its bots live without a restart, each profile keeps its own credentials, allowlists, cron jobs and sessions, and hermes update migrates existing per-profile setups automatically. Fewer processes, no token clashes, one thing to start and stop (#112854, #108928, #118273, #117983, #118246, #118027).

11. See and steer your subagents live

Running subagents now stay visible above the composer in the CLI (F6), TUI (Ctrl+T) and Desktop with each child’s task, elapsed time and live transcript, plus Steer and Stop buttons. /stop reaches background children and hands back their partial work, and delegate_task can pass screenshots and mocks to vision-capable children (#105593, #115616, #97689).

12. A model picker that knows your plans

Star your favorite models, see a subscription running low (“17% left · resets 3:00 PM”) and when a rate limit lifts right in the picker, and pick reasoning effort as part of choosing a model in hermes model, /model (/model X --reasoning high) and Desktop. You switch before you hit the wall instead of after (#126535, #133392, #133408, #110346, #113117).

13. Hermes in your language, everywhere

Every user-facing string in the CLI, messaging gateway, TUI and Desktop now goes through one translation catalog with full coverage in the bundled languages. New languages can ship as plugins, and any profile can override individual strings with a small YAML file (#126296).

14. Leaner in every sense

The whole codebase was simplified with zero behavior change: source went from about 1.06M to 698K lines (−34%) and gateway/run.py shrank from 34,847 lines to 5,512. Prompts got lighter too: about 19 rarely used tools now load only when the agent searches for them, roughly halving the desktop tool schema sent on every call, and another ~2.1k tokens came off the fixed prompt. Local models prefill less on every turn (#102117, #97979, #106676, #137084).

15. Small comforts that add up

Opt-in vim keys in the CLI prompt, a git-branch field in the status bar, a bell and desktop notification when Hermes is waiting on you, Ctrl+C that clears your draft instead of killing the turn, an editable /queue, and hermes --native to let your own terminal handle TUI scrollback and search. On Desktop, a new Simple mode turns the app into a plain chat window, and errors now say what went wrong with a one-click fix (#106412, #106434, #101284, #101320, #137065, #95999, #121035, #118587, #111601).

⚠️ Upgrade notes

  • Python 3.14 is the runtime for managed installs (the package manager installs it for you). KittenTTS is unavailable on 3.14 (#102765).
  • Windows desktop is MSIX-only and needs Windows 11 22H2 or newer; the NSIS/MSI installers are gone. The macOS app is Apple Silicon only in default builds (#102765, #136603).
  • One gateway per machine is the default. hermes update folds per-profile gateways into the multiplexed default when nothing conflicts (#112854).
  • Chats no longer reset on an idle/daily timer. session_reset idle/daily modes are retired (configs that still set them log a warning); /new or /reset starts fresh (#105021, #126244).
  • Old sessions are pruned automatically. sessions.auto_prune now defaults to on: ended sessions inactive for 90 days are deleted at startup. Pinned and open sessions are never touched; set sessions.auto_prune: false to keep everything.
  • Memory providers moved to catalog plugins (Honcho, Supermemory, Hindsight, Mem0, OpenViking, Holographic), as did Home Assistant, Spotify and Langfuse. Existing users are migrated on update or first start, with data intact. ByteRover and RetainDB remain bundled.
  • Plugin authors: the old plugin compatibility import layer is gone (#126164), hermes sync (Skill Sync) was removed (#132465), and the bundled tirith scanner was removed (#133832). Several tools were renamed (todo → todo_list, cronjob → cronjob_manage, process → process_manage); the old names still work (#97979).

🚪 Onboarding, Free Tier, Connectors & Local Models

  • First-run onboarding — a fresh desktop install gets the guided setup chat (see Highlight 1). Existing installs and remote (SSH, URL, Cloud) backends do not get it automatically; the old setup-profile flow and /initiate-setup are deleted (#137420, #134215, #108292).
  • set_theme — the agent can set the accent (a swatch or any #rrggbb), light/dark/system mode and layout, or show a picker (#137522).
  • Free tier — a first desktop install with no provider and no Nous account gets the free nous/welcome model as a one-time trial (once per OS user). The CLI, TUI and gateway get no account and no free model; HERMES_GUEST_ONBOARDING is gone. hermes auth upgrade, or /login in any chat or messaging DM, upgrades that free identity to a full Nous account while keeping your connected apps (#137807, #105258, #105259, #105260, #105261).
  • Clear free-tier limits — the free rate limit ends the turn at once with the reset time; every free-tier failure has a code and a plain sentence; the app handles the account service’s browser check; free-tier users see a Terms and Privacy notice. Nous accounts without credits can pick models billed to a subscription they hold and get free managed fast web search (#134049, #111970, #133824, #117079).
  • Connectors — hosted app connectors, the Connectors page and several accounts per app (see Highlight 2). Connector tools can also send your local files as attachments and save the files they return. nous.guest: false turns guest identities off; tools.connectors.enabled: false turns connectors off (#111238, #138014).
  • Local models — one-click install (see Highlight 3); Hugging Face GGUF downloads with pause/resume; a one-time setup offer after onboarding on machines that can run the recommended model (#129506). Engine updates in one click: NVIDIA on Linux gets CUDA, AMD and Intel GPUs get Vulkan sized by their own memory, and every backend runs llama.cpp b11370 (#111423, #133111, #131782). Better recommendations: only models that fit fully in GPU memory are recommended, and the 27B is no longer suggested on hardware that runs it poorly (#108429, #135438, #134116, #112107). Your own local servers: LM Studio has a provider profile, Ollama pickers no longer flicker, a self-started llama.cpp server shows up in /model, and fallback to the desktop-managed model works (#134320, #113129, #116679, #131795).

📦 Stable Releases, Desktop Packages & Package Manager

  • Stable releases and update channels — tested SemVer stable releases and the channel switch (see Highlight 4). v0.21.6 and v0.21.7 were the first through the new gate; forks stay on main, and an install ahead of the newest release waits for the next. Lighter update checks: one GitHub API call a day replaces git fetch every 30 minutes (#107648).
  • Sealed, signed desktop packages — see Highlight 5. In a package, hermes update points to the right updater (App Installer, Store or macOS) (#134911). Packaged installs work end to end: the agent’s terminal runs hermes, Uninstall explains OS removal, and Python-dependency plugins install inside MSIX (#134051, #135333).
  • hermes pm — the unified package manager (see Highlight 5): pinned, hash-checked Python 3.14, uv, Node, ripgrep, FFmpeg, Chromium and Git/Bash on Windows, with hermes pm doctor|status|repair|gc. Contributors use source ./activate (or .ps1/.fish).
  • Dependency environments are generations — new ones are checked before use, so a failed install keeps the working one; updates and hermes pm gc reclaim old ones (92 GB to 18 GB on one host) (#124968, #133808). Optional SDKs (Anthropic, Bedrock) load mid-session without a restart; security.allow_lazy_installs: false turns this off (#122221). Plugins declare Python dependencies, resolved with core across profiles; conflicts are refused, and an update disables a plugin that no longer fits (#113851, #122103, #114569, #132469).
  • Updates can’t half-apply — see Highlight 5; a killed update repairs itself on the next launch (#132361, #120339). Faster updates, smaller checkouts — updates rebuild only what changed (16.5 s vs 32.5 s on macOS), clones are blobless, and partial-clone .git growth is fixed (#135092, #133016, #131679).
  • Installers — install.sh/install.ps1 verify pinned uv and Git, hand off to PM, log to logs/install.log, and now work on musl Linux (Alpine, Void), Windows 10 and Unicode Windows paths (#124964, #125598, #132430). With opt-in telemetry, install, update, skill and plugin failures record a reason (#133809).
  • Docker / Nix / Termux / Windows — Docker pins a Debian 13 base with full Chromium; stable/latest move only on a published release; baked-in extras return after a restart (#135726, #135084). Nix shares the pins and its desktop app gets Wayland; Termux moves to a signed APT package (pkg upgrade hermes-agent), though its docs still warn it is broken; Windows updates finish while the old runtime is in use (#128144, #122146, #131779).

🧠 Providers & Models

  • Providers as plugins — ACP and CLI-driven providers install out of tree via hermes plugins install; --provider chatgpt picks ChatGPT Codex OAuth (#101456, #115761). Bedrock serves GPT-6 (1M) and enforces Claude Guardrails; Azure Foundry lists deployments; Gemini takes full JSON Schema tools; OpenCode Go routes Claude via Messages (#133573, #107815, #115770, #98928, #134848).
  • New knobs — agent.text_verbosity sets Responses answer length; named custom providers run on the Codex app-server (#115880, #115905).
  • Model catalog — Claude 5.x (Opus 5.5 also on native Anthropic and Bedrock, 1M); GPT-6 Astra/Astra Pro in standard, fast and flex, opt-in Codex -900k, and /fast ultrafast for Astra and 6.1 Sol; Gemini 3.8 Flash and Gemini 4 Argon; DeepSeek V4.1 Flash, Qwen3.8-Max-0902, Grok 4.7, GLM-5.3-FlashX, Muse Spark 1.3, Solar Pro 4/Mini 4 (#122633, #103261, #119410, #136950, #101450, #137989, #107489, #100966, #118371, #117435, #101948, #131645).
  • Auth — profiles share OAuth logins safely (single-use grants never fork, a profile’s own login is kept); Nous sign-in survives hourly expiry, concurrent subagents, Portal outages and edge checks (#100929, #134574, #103526, #121488). Dead logins are named once with the hermes auth add fix; auth.adopt_external_logins: false stops borrowing Codex CLI/Claude Code logins (#113816, #115586).
  • Routing, fallback and caching — agent.auto_recovery_cycles (default 5) bounds the wait, and fallback returns to a Codex primary whose quota reopened (#116353, #130716). Auto-routing never bills a provider you did not pick; provider_routing.models pins OpenRouter per model (#107366, #104159). Opt-in cache_ttl: auto (1h interactive, 5m subagents/cron); a cache-breaking /model in a big session asks first; compaction keeps the prefix (#118337, #95267, #104455).
  • Reasoning — replayed on every provider that reads it; effort is settable in every picker, with custom tier names; Anthropic fast mode follows the docs (#136358, #110346, #115735, #120517).

🏗️ Core Agent, Sessions & Memory

  • Stalled turns recover — a watchdog (agent.turn_liveness.timeout_s, default 600 s) interrupts a no-progress turn and frees its session; repeated transcript repairs now raise one error instead of staying silent (#99758, #99687). Text-less dead streams retry, repetition loops are cut, and interrupted turns are not reported as done (#113135, #130551, #112272).
  • Compaction triggers on real token counts — provider-reported usage, not bytes over four; the protected tail is capped at 20% so small-window models compact too (#104555, #117957). Bad summaries cannot wipe context: refused or overloaded summary providers leave the transcript alone, and an uncommitted compaction changes nothing (#118920, #115906, #136083). New provider-scoped keys compression.model_thresholds and auxiliary.<task>.no_progress_timeout (#108061, #115804).
  • Sessions and state.db — lock timeouts name the holding process, a busy database no longer kills a turn, and sibling PID namespaces cannot steal leases (#116967, #134577, #132161). state.db stops growing: auto-prune is on by default (ended sessions over 90 days) and closes stale cron/kanban/subagent sessions; VACUUM runs only when 25% is reclaimable (#101316, #100903). Repair commands: hermes sessions set-journal-mode delete|wal, repair-profiles, repair-prompts (#117684, #115689, #124200).
  • Memory — OpenViking and Holographic move to the plugin catalog on update or first start, data intact, or say why not (#134350, #136436, #131269). Hand-formatted MEMORY.md/USER.md are accepted, refusals say what to fix, and secrets are scrubbed before providers see them (#133038, #134429).
  • Profiles and config — a broken config.yaml falls back to the last good copy and read errors cannot wipe it (#109463, #120343). hermes config get masks secrets (--raw opts out), set refuses typo paths and stores env-style names in .env (#111341, #112250). Profiles stay separate: REST routes act on the profile they name, exports skip .ssh/.aws/.gnupg, and import-agent --sync keeps imports current (#118275, #132201, #88855).

📱 Messaging Platforms (Gateway)

  • One gateway serves every profile — hermes gateway status explains any boot-guard refusal, hermes gateway migrate --multiplex migrates by hand, webhook platforms serve each profile at /p/<profile>/, hermes -p X gateway stop|start parks one profile, and gateway.standalone: true is a temporary opt-out (#112854, #108952, #119774, #119680). Profiles stay isolated: clones skip bot tokens unless --clone-channels, and profile_routes can route by sender (#109502, #115642).
  • Sessions and commands — /login signs free-tier users in from a DM; idle/daily session_reset is retired, so only /new and /reset start fresh; /branch opens a sibling thread on Discord, Telegram, Slack and Matrix (--here keeps the old behavior); decline mode sends unauthorized DMs one polite refusal; an opt-in served_model footer names the model that answered (#105261, #126244, #117450, #88028, #115925).
  • Platforms — Telegram’s opt-in bots_require_mention stops bot reply loops, extra.drop_pending_on_cold_boot: false keeps messages sent while offline, CJK can opt in to rich messages; Discord setup verifies the token, links the Message Content Intent and allowlists you, and free-response channels can auto-thread; Slack gets a Block Kit /model picker, with status/titles on the Agent Sessions API; WhatsApp does native mentions via hermes send --mention with no 5 s batching delay, and paired sessions on every profile; Signal tables render monospace, Matrix LaTeX typesets in Element, Email refuses spoofed senders and requires an authserv_id pin (mail drops until set), and QQ Bot send_message delivers media (#106534, #116134, #111831, #132456, #116168, #103436, #101477, #115253, #117104, #132518, #106538, #106515, #132663, #131927).
  • Webhooks and the API server — opt-in coalesce folds event bursts into one run, cron_job routes fire cron jobs on events, Standard Webhooks signatures verify, and opt-in mirror_to_session gives replies context (#92066, #95262, #104183, #120825). The API server streams reasoning to OpenAI-compatible clients, and stream approvals are answerable (#115797, #121769).
  • Relay and Bot Chat — Bot Mode rooms can edit members, Reply to @handle, keep 200 messages of history, and support sender-aware bot DMs with an ALLOW_BOTS loop guard (#113384, #107520). Relay checks send_message targets; NeMo Relay tracing at 0.10.0 tags spans with the working directory (#99220, #135787, #108345).

🖥️ Desktop App

  • Simple / Advanced mode — Simple hides developer panes, Advanced stays the default (#118587). Titlebar tabs; profiles open in their own window or as startup default (#107099, #113176). Sidebar grouping by gateway/profile, reusable Cloud instances, drag New session onto a pane (#105813, #70571). Import and continue another coding agent’s transcript (#104229). Goal / Loop / Heartbeat cards pause, resume and stop above the composer (#104246).
  • Chat and composer — a reasoning-effort pill; add a model by slug; pastes over 3,000 characters attach as .txt; opt-in macOS window-screenshot shortcut (#109907, #120693, #108901, #113349). Actionable errors name the problem and the fix; usage-limit cards show the reset time and can schedule a retry (#111601, #116288). Browser comment mode pins page elements with notes, sending crops, selectors and styles to the composer (#100083).
  • Settings and plugins — ordered subpages searchable from ⌘K; Chat Font (e.g. OpenDyslexic); Russian, French, German and Spanish (#117127, #111226, #100429). One row per plugin; plugins get settings pages, and desktop plugins can run app actions by id, speak via the pet, add Appearance controls and reorder sidebar nav (#133182, #136417, #135504, #120912, #120922).
  • Bot Mode — Bot Screen (see Highlight 9), off by default and needing host packages (#108914). Group chats can reorder rooms and compress a member’s hidden history (#105909, #117015).
  • Performance and platforms — the Desktop attaches to the running backend, which serves every profile (#118246). Faster Windows startup; Linux runs without sudo and under WSLg/Wayland (#111002, #100136, #113247). Sessions follow the agent’s git worktree and branch; the Review pane scopes work; browse SSH workspaces, drag sessions onto projects, search logs, see and clear Kanban blocks (#128428, #127200, #99538, #126543, #126658, #125647).

⌨️ CLI, TUI & Dashboard

  • CLI — display.vim_mode, a git_branch status field and display.bell_on_prompt (bell plus OSC 9 notification), all off by default (#106412, #106434, #101284, #101320). Ctrl+T opens the subagent monitor; a mid-turn multi-line paste is one message (#105879, #109146). Scriptable commands: hermes usage --json (quota, no session), hermes worktree --json/--older-than, kanban edit --title/--body/--priority, and -t to pick MCP servers to start (#115899, #95257, #117632, #101634). Also: hermes -z exits non-zero on failure; -m custom:<name>:<model> reaches that provider; the footer no longer collapses to “Window too small” (#113234, #115293, #117439).
  • TUI — --native or display.tui_native uses native terminal mode (#121035). Running-turn control: double-Esc interrupts, push-to-talk cuts speech, and the live dock (CLI too) shows /goal and queued prompts (#125803). Typing fixes: Shift+letter on extended-key terminals, macOS Ctrl+D, Wayland image paste, steady idle redraws (#90674, #116851, #116824, #87907). Attached TUIs rejoin their session; attachments.storage: workspace stages files a sandboxed agent can read (#112227, #125816).
  • Dashboard — chat on more devices: screen readers, iPad touch-scroll, no doubled mobile-keyboard characters, and a second tab gets its own terminal (#133960, #134181, #116978, #117061). Errors are a sentence and a fix button instead of raw JSON, with title search, a live switcher and per-API-call analytics (#111602, #133981, #134100, #133991). Self-hosting: reverse-proxy subpaths, password sign-in beside OAuth, non-expiring remote sessions (#133903, #107018, #110061).
  • Slash commands — reasoning effort in every picker (hermes model, aux models, /model), and /model X --reasoning high works too (#110346). An editable /queue can list, edit, move or remove prompts; /s is /steer (#95999, #125803). /context shows each instruction file as loaded, truncated or shadowed (#91272).

🔧 Tools, MCP & Browser

  • Rare tools load on demand — computer_use, session_search, image_generate, cron and Desktop GUI tools sit behind tool_search by default (desktop schemas 13,367 → 6,883 tokens; defer: [] opts out); todo/cronjob/process become todo_list/cronjob_manage/process_manage (aliases kept) (#97979). The tool list is frozen per session across TUI, -q --resume and gateway hops so the prompt cache holds (#120289). Unattended gateway/cron sessions hard-stop tool loops, and five identical replays halt any tool (#100967).
  • Smarter file and web tools — read_file shows SQLite schemas and flags merge conflicts, search_files runs ripgrep directly (5–6x faster), and keyless web_search fails over between free vendors (#115974, #104502, #134048).
  • MCP — hermes mcp login <server> --flow device for headless terminals (#104891). Sturdier OAuth: refresh tokens are never erased, double-spent or sent to another issuer; RFC 9207, Google-hosted and WAF-fronted servers log in; gateways never open browser tabs (#106185, #111186). More servers connect: SSE-only servers fall back, strict servers connect (opt-in sampling.tools), and the catalog adds official n8n and Asana V2 (#106432, #131891, #116048). Startup connects up to mcp.discovery_concurrency (4) servers at once; vision models see MCP images; dead stdio servers respawn without replaying a call (#117956, #133815, #106546).
  • Browser and computer use — password-manager sign-in also fills cards and addresses after you confirm; hermes-sandbox:desktop is the new default image (existing sandboxes kept) (#106480, #121169). browser_exec works out of the box, driving bundled Chromium (also the cloud fallback) and opening localhost via a sidecar (#102986).
  • Terminal and code execution — foreground timeouts over 600 s become background jobs, heartbeat=N sends progress, and the live-work dock lists them (#103529). Sandbox results flag a recreated environment; SSH paths resolve remotely (#107093, #122657). LSP adds lsp.servers and lsp.package_manager and never runs a cloned repo’s own interpreter or SDK (#115714, #126239).
  • Media — new models: GPT Image 2.5 and Kling Image v3; video: Kling 3.0, Kling O3, LTX 2.5, Wan 3.0, MiniMax H3 Max Turbo, Gemini Omni Flash 1.1 (#105988). Opt-in stt.streaming shows words as you speak (CLI, TUI, Desktop) and long recordings transcribe on all cloud providers (#133853, #133825). Opt-in voice.voice_chat_mode: gpt-live gives Desktop full-duplex voice; auxiliary.voice_chat runs spoken turns on a faster model and TTS starts sooner (#108137, #133986, #115846).

🧩 Plugins, Skills & the Plugin Catalog

  • Plugin Catalog — plugin and author pages: /docs/plugins shelves plugins under Memory, Desktop, Platforms, Web, Tools, Voice, Automation and Models. Pages show the description, a disclosure callout, screenshots, the README from the pinned commit, an “Open in Hermes Desktop” button and a copyable install command (#111415, #111547, #117808). Easier-to-read cards carry a version label next to the pinned commit (1.2.0 @ ad3f352b), banner images, a uniform size and light mode (#113381, #125065, #124001). Listings can declare known issues, which hermes plugins install and the dashboard show on install (#124058). Listing rules: Desktop plugins must stay within SDK slots, 11 plugins that patched internals were delisted (installed copies keep working), and the submission guide matches what CI enforces (#115579, #130860, #131048).
  • New in the catalog — all 600 listings are new this cycle. Moved out of core, besides the five memory providers, Holographic has a new community maintainer, and Home Assistant, Spotify, Langfuse and TouchDesigner are now official catalog plugins (#114732, #136196, #132476, #137130). Official additions: Blender Lab, Snyk, NVIDIA App and NVIDIA Broadcast (Windows only), Telegram Business, Memory Wiki (#119365, #109084). Shelf sizes: Memory 65 (Cognee, LanceDB, ReMe, Memoria, HydraDB, Mnemosyne, YantrikDB, BetterDB), Web and search 34 (Apify, Parallel, Linkup, SerpApi, You.com, TinyFish, Oxylabs), model providers 48 (JetBrains Junie, Telnyx, NetMind, Groq, Chutes, Kiro, Opper, AIHubMix), platforms 32 (Inline, Microsoft 365, Rocket.Chat, VK, Zalo, iMessage, Sendblue), voice 18 (Speechify, Deepgram, Fish Audio, Gemini Live), desktop panes 140, tools 180 (#112292, #118231, #118512, #114202).
  • Plugin system — out-of-tree model providers show in model pickers, log in via hermes auth (built-in OAuth PKCE) and refresh tokens (#116552). Opt-in per-profile plugin host: plugins.isolation: host runs third-party plugins in a per-profile process with only that profile’s secrets (#126911). New APIs: hooks for interrupted turns, auxiliary LLM calls and human-input prompts; plugins can start gateway sessions, add Automation Blueprints and aux model slots, ship the computer-use driver, and make Codex-signed requests (#118909). Desktop plugin SDK: config_schema settings render as a form in Capabilities → Plugins; plugins get a skills/toolsets/profiles bridge and model-pill and menu slots (#118917). Install, pin, update: private repos install with your git credentials, Desktop pins a plugin to a commit, updates keep user data, and plugin skills run as /plugin:skill (#106981, #107321, #133175). Sturdier loader and scanner: hung imports are skipped after plugins.load_timeout_seconds (10 s), guard hooks fail closed, and prose, fixtures and regex literals no longer block installs (#118915, #115954).
  • Skills — new optional skills: pr-lens, system-atlas, anatomy, mono-color, dream-loop, scrollcraft, auteur, ip-as-logo, ai-presenter-video, live-dashboard, dynamic-workflow, reddit-reading, rss-feeds (#109306, #103821). Skills Hub’s index builds again with about 480 science skills, and search also finds unindexed skills (#109178). skills.auto_load pins skills into every session and skills.create_dir chooses where agent-made skills go (#92048, #100377). Better self-improvement: learnings and corrections go into the task’s skill, background review can improve any skill, and skills added mid-chat reach the next message (#102107). Lighter curator: no longer blocks the CLI prompt, one install fell from 1.9 GB to about 200 MB, and unused skills archive at 30 days instead of 90 (#115862). Skills Guard: blocked installs in a 421-skill sample fell from 83 to 68, and inline shell is limited to non-community skills (#135595).

⏰ Cron, Kanban & Delegation

  • Cron — unpinned jobs use the model configured at fire time and pinned locks one (#113679). Self-healing schedules: a fire that never reached the model re-runs after 5, 15 and 30 minutes, a provider “retry after” window parks the job quietly, and a slot missed during a restart fires once (#108731, #115843). Quieter alerts: one alert per incident plus a reminder every cron.failure_repeat_alert_hours; failure_deliver reroutes or mutes failure notices; an agent can fail its run with [CRON_FAILURE] (#114807, #101373, #113155). New job options: --paused creates a job unarmed, and --interpreter runs scripts on your own venv (#104984, #125392). A multiplexed gateway runs each profile’s jobs with that profile’s env and secrets; delivery needs positive evidence, output is secret-redacted everywhere, and late or satellite runs are labelled (#118027, #100908, #112830).
  • Kanban — workers ride out provider trouble: failed turns retry in place with context, and rate limits or 5xx requeue instead of burning retries (#112318, #112500). A board that explains itself: cards show the worker’s last output on failure, and dispatch says why a card is held (#112618). One workflow definition drives columns; workers get kanban_schedule; kanban create --body-file; Desktop follows gateway switches (#134340, #130455, #116791, #119054).
  • Delegation and multi-agent — live subagents, images and /stop (see Highlight 11). Fan-outs lose less: failed children surface at once, an owner crash keeps finished work, children can hand processes to the parent, and per-task completions are opt-in (#103549, #116707, #105125). Child routing: delegation.fallback_providers gives children their own chain and child_timeout_seconds measures inactivity (#105347, #117606). /goal is consistent on CLI, Desktop and messaging, the judge waits on subagents, /goal pause for now no longer overwrites the goal, and gates run in the session workspace (#104833, #132251, #125453).

🔒 Security, Privacy & Codebase

  • v0.21.6 security fixes — dashboard sign-in hardening (spoofed X-Forwarded-For, size caps, loopback-only login codes); automatic git skips repo filter programs; the email allowlist resists display-name spoofing (#133367, #130685, #130661, #125212). Secrets stay put: child processes do not inherit adapter or dashboard secrets, remote execute_code keeps its token out of argv, profile exports skip credential stores, and keys never reach foreign hosts on refresh or fallback (#125755, #124262, #130525, #120299). Sharper redaction: debug share redacts before truncating, file reads and terminal output mask .env and config secrets, hermes config get masks unless --raw, and memory hand-offs are scrubbed (#132270, #111422, #111341, #134429, #100564). Owner-only files at rest: credentials, state.db, snapshots, browser profiles, media caches, whatever your umask says (#109509, #127229).
  • Wider guards — more fetches pass the SSRF guard (security.fake_ip_ranges for fake-ip proxies); cloud-metadata fetches, zsh/dash pipe-to-shell and deno eval need approval; approvals.deny works in sandboxes; built-in rules replace the bundled tirith scanner (#114887, #113156, #116726, #103649, #133832). Holes closed: the MCP OAuth callback stops reflecting HTML, and webhook, SMS and WhatsApp Cloud inbound reject blank signing secrets (#92612, #133257). Opt-in shared metrics: daily usage stats reach Nous only with consent, both telemetry.shared_metrics switches default off, each profile asks once, and Enter means “No thanks” (#95278).
  • Codebase and performance — about 2.1k fewer prompt tokens per request, on-demand vault tools, one-round-trip file probes, and hermes -w no longer repacks on every launch (#137084, #101599). Safer backups: hermes backup keeps the newest 3 and flags incomplete archives; hermes import refuses damaged ones (#106455, #121498). Also: KEY_2… env vars join credential pools; a one-screen hermes status; opt-in display.suppress_warning_notifications; Desktop Bots roster sections; only Hermes’ own node/npm/uv are used; Xiaomi MiMo v2.6 (#112390, #131034, #114370, #101290, #125589, #118502).
  • For contributors — CODEOWNERS replaces the label gate; E2E (including native Windows) runs only on release builds; stable releases skip macOS Intel/Termux by default (#131726, #136603).

🐛 Notable Bug Fixes

  • Onboarding, connectors and local models — managed llama-server no longer crashes on Windows with 0xC0000374 and no longer inherits your credentials (#116923); Windows local-model servers are contained and orphans recovered safely; two backends booting together start one router (#111038, #117600).
  • Install, update and packaging — Docker agents no longer lose their built-in API server, messaging and MCP dependencies after a restart (#135726); a hermes update killed mid-pull no longer breaks every entry point (#120339).
  • Providers and models — a rate-limited Claude model no longer benches the whole credential for every other Claude model (#113171); Codex app-server sessions now get SOUL.md and the Hermes system prompt (#115759).
  • Agent loop, sessions and memory — a chat whose session row was deleted recreates it instead of silently dropping every later turn (#124117); messages flushed at gateway shutdown are recovered into their session (#114225).
  • The full fix list lives in the release body.

Upgrade

hermes update

Managed installs get a Python 3.14 runtime. After upgrading, run hermes doctor to verify the install and restart the gateway (hermes gateway) so platform changes take effect. To see what the next update will touch before running it: hermes update --plan.

Full Changelog: v0.21.0…v0.22.0

← Hermes Agent Changelog