v0.5.0

Hermes Agent v0.5.0 — The Hardening Release

Overview

v0.5.0 — The Hardening Release. Released March 28, 2026. This release is all about making Hermes Agent production-ready: 50+ security and reliability fixes, a comprehensive supply chain audit, and major platform expansions that position Hermes as a serious contender in the autonomous agent space.

By this point, the project had surpassed 15,700 GitHub stars since its initial public launch in February 2026, with over 242 contributors. Nous Research described this as the release that “hardens” every layer of the stack — from dependency pinning and CVE patching, to SSRF protections and shell injection prevention.

Major Features

1. Hugging Face as a First-Class Inference Provider

Hermes Agent now natively integrates with the Hugging Face Inference API, complete with authentication, setup wizard, and an intelligent model picker that maps OpenRouter’s agentic defaults to their HF equivalents.

# During setup, Hugging Face appears as a provider option
hermes setup
# Select "Hugging Face" → enter your HF API token → choose from curated agentic models

# Switch to a Hugging Face model at runtime
hermes model --provider huggingface

How it works under the hood:

  • Curated model list mapping OpenRouter defaults to HF equivalents, so you get the right model without guesswork
  • Providers with 8+ curated models skip the live /models endpoint probe for instant startup
  • Full auth flow with your HF API token, stored securely in the Hermes credential store

2. Telegram Private Chat Topics

Project-based conversations with functional skill binding per topic — you can now run isolated workflows within a single Telegram chat. Each topic gets its own skill set, its own context, and its own agent personality.

# hermes.config.yaml
telegram:
  private_chat_topics: true
  topic_skills:
    - topic: "ml-experiments"
      skills: [python-ml, data-analysis, notebook]
    - topic: "devops"
      skills: [docker, terraform, kubernetes]

This means one Telegram chat can host your ML workflow, your infrastructure management, and your code review — all isolated, all persistent, all in one place.

3. Native Modal SDK Backend

Replaced the swe-rex dependency with native Modal SDK (Sandbox.create.aio + exec.aio), eliminating SSH tunnels and dramatically simplifying the Modal terminal backend.

# Before: swe-rex created SSH tunnels for every sandbox operation
# After: direct SDK calls — faster, simpler, no tunnel management

# The agent now uses Modal's native async primitives:
# Sandbox.create.aio()  — create sandboxes without tunnel overhead
# exec.aio()            — execute commands directly via the SDK

This change removes a significant architectural dependency and makes sandboxed execution more reliable and easier to debug.

4. Plugin Lifecycle Hooks Activated

The plugin hook system is now fully live. Four lifecycle hooks fire at key points in the agent loop:

Hook Trigger Point Use Case
pre_llm_call Before each LLM API call Modify prompts, inject context, log requests
post_llm_call After each LLM API call Post-process responses, extract structured data
on_session_start When a session begins Initialize resources, set up workspace
on_session_end When a session ends Clean up, persist state, send notifications 
# Example plugin using lifecycle hooks
# my_plugin.py
def pre_llm_call(context, messages):
    # Add custom system context before the LLM sees the prompt
    messages.insert(0, {"role": "system", "content": "Today's date: 2026-03-28"})
    return messages

def post_llm_call(context, response):
    # Log token usage to your analytics platform
    log_usage(response.usage)
    return response

These hooks fire in CLI, gateway, and all messaging platforms — completing a long-requested extensibility feature.

5. GPT Tool-Use Enforcement

GPT models had a persistent quirk: they’d describe what they intended to do instead of actually making tool calls. v0.5.0 adds GPT_TOOL_USE_GUIDANCE — a specialized system prompt injection that forces GPT models to use tools rather than narrate actions.

# Internal: before each GPT API call, the agent injects guidance:
GPT_TOOL_USE_GUIDANCE = """
When you need to perform an action, you MUST use the appropriate tool.
Do NOT describe what you would do — actually call the tool.
"""

Additionally, stale budget warnings that accumulated in conversation history (and caused models to avoid tools across turns) are now automatically stripped from the transcript.

6. Anthropic Output Limits Fix

Replaced the hardcoded 16K max_tokens limit with per-model native output limits:

Model Old Limit New Limit
Claude Opus 4.6 16K 128K
Claude Sonnet 4.6 16K 64K
Other Claude models 16K Model-specific

This fixes two long-standing issues:

  • “Response truncated” errors when the agent needed more than 16K output tokens
  • Thinking-budget exhaustion — the agent now detects when a model uses all output tokens on reasoning and intelligently skips useless continuation retries

7. Nix Flake Support

By @alt-glitch — full uv2nix build, NixOS module with persistent container mode, auto-generated config keys from Python source, and suffix PATHs for agent-friendliness.

# flake.nix
{
  inputs.hermes-agent.url = "github:NousResearch/hermes-agent";
  # ...
  hermes-agent.nixosModules.default
  # Provides: hermes-agent service with persistent container mode
}

8. Supply Chain Hardening

This release mounted a comprehensive supply chain defense:

  • Removed compromised litellm dependency — a widely-publicized supply chain incident
  • Pinned all dependency version ranges — no more floating version drift
  • Regenerated uv.lock with cryptographic hashes — every dependency is verified at install time
  • Added CI workflow that scans every PR for supply chain attack patterns
  • Bumped dependencies to fix known CVEs across the dependency tree

New Skills

Skill Description
G0DM0D3 Godmode jailbreaking skill for advanced prompt engineering and capability exploration
Docker Management Container lifecycle management, image building, and compose orchestration
OpenClaw Migration v2 17 new modules for migrating from OpenClaw to Hermes Agent, including terminal recap

Skills System Improvements

  • Environment variable passthrough — skills can declare which env vars they need, and Hermes passes them through securely
  • Cached skills prompt with shared skill_utils module for significantly faster time-to-first-token (TTFT)
  • Git Trees API used for skill installation to prevent silent subdirectory loss
  • Agent-created skills are now properly treated as trusted (not untrusted community content)

Messaging Platforms

Telegram

  • Private Chat Topics with per-topic skill binding (see Major Features above)
  • Auto-discover fallback IPs via DNS-over-HTTPS when api.telegram.org is unreachable — the agent finds alternative routes
  • Configurable reply threading mode — control how the agent threads its responses
  • Self-rescheduling reconnect when polling fails after 502 errors

Discord

  • Fixed phantom typing indicator that persisted after the agent’s turn completed

Slack

  • Tool call progress messages now correctly routed to the right Slack thread

WhatsApp

  • Media download support — documents, audio, and video messages are now downloadable by the agent

Gateway Core

  • /verbose command for messaging platforms — toggle tool output verbosity from any chat
  • Background review notifications delivered directly to user chat
  • Retry transient send failures and notify the user when retries are exhausted
  • /stop hard-kills session lock — recover from hung agents without restarting the gateway
  • Thread-safe SessionStore with threading.Lock
  • Gateway no longer wastes ~10K tokens loading the Hermes repo’s AGENTS.md into every session
  • Request timeouts added to HA, Email, Mattermost, and SMS adapters

CLI & User Experience

Interactive CLI Improvements

  • Configurable busy input mode — control what happens when you type during agent processing
  • Multiline paste preserved — no more garbled input when pasting multi-line commands
  • Tool generation callback — streaming “preparing terminal…” updates while the agent generates tool arguments
  • Status bar fixes: tokens with trailing zeros now display correctly (260K instead of 26K), duplicates and degradation fixed during long sessions
  • Reasoning box no longer renders 3x during tool-calling loops
  • “Event loop is closed” / “Press ENTER to continue” during idle sessions — fixed with a three-layer solution
  • TUI refreshes before background task output to prevent visual overlap

Setup & Configuration

  • /model command overhaul — extracted shared pipeline for CLI and gateway, custom endpoint support
  • Return user setup menu now uses explicit key mapping instead of fragile positional index
  • hermes update hardened against diverged history, non-main branches, and gateway edge cases
  • OpenClaw migration no longer overwrites defaults; setup wizard skips already-imported sections
  • AGENTS.md loading now stops at the top-level — no more recursive directory walk
  • macOS Homebrew paths added to browser and terminal PATH resolution
  • Default SOUL.md reset to baseline identity text

Tool System

API Server

  • Idempotency-Key support — safe retry semantics for API calls
  • Body size limits and OpenAI-compatible error envelope
  • Cancels orphaned agents on SSE disconnect with true interrupt
  • Streaming no longer breaks when the agent makes tool calls

Terminal & File Operations

  • V4A patch parser now handles addition-only hunks correctly
  • Exponential backoff for persistent shell polling — reduced CPU usage
  • Timeout added to subprocess calls in context_references

Browser & Vision

  • SSRF protection added to browser_navigate, vision_tools, and web_tools
  • 402 insufficient credits error handled gracefully in vision tool
  • Browser command timeout now configurable via config.yaml

MCP

  • Runtime and config-based MCP toolset resolution unified
  • MCP tool name collision protection — prevents silently overwriting tools

Security & Reliability

Security Hardening (50+ fixes)

Category Fix
SSRF Protection browser_navigate, vision_tools, and web_tools now block server-side request forgery
Subagent Restriction Subagent toolsets restricted to parent’s enabled set — no privilege escalation
Zip-Slip Prevention Self-update hardened against path traversal attacks
Shell Injection ~user path expansion no longer allows command injection
Command Detection Input normalized before dangerous-command detection
Tirith Block verdicts now approvable instead of hard-blocking (human-in-the-loop)
Dependencies Compromised litellm/typer/platformdirs removed, all ranges pinned, lockfile with hashes

Reliability

  • SQLite WAL write-lock contention causing 15-20s TUI freezes — fixed
  • SQLite concurrency hardened with session transcript integrity guarantees
  • Cron job re-fire prevention on gateway crash/restart loops
  • Cron sessions properly marked as ended after job completion

Performance

  • TTFT startup optimizations — easy-win improvements for faster cold starts
  • Skills prompt caching with shared skill_utils module reduces repeated computation
  • Redundant file re-reads eliminated for skill conditions in the prompt builder
  • API timeout default increased from 900s to 1800s for slow-thinking models

Upgrade

hermes update

For new installations, visit the install guide.

Full changelog on GitHub

← Hermes Agent Changelog