v0.7.0

Hermes Agent v0.7.0 — The Resilience Release

Overview

v0.7.0 — The Resilience Release. Released April 3, 2026. 168 merged PRs · 46 resolved issues · hundreds of files changed.

v0.7.0 is about one thing — resilience. No flashy new features. Just systematic answers to the questions every real-world agent deployment faces: What happens when your API key runs out of quota? When the browser gets detected? When the memory backend isn’t flexible enough? When the Gateway crashes under concurrency? When secrets leak through LLM output?

The answer in every case: Hermes now handles it.

Major Features

1. Pluggable Memory Provider Interface

The memory system has been refactored from a single built-in implementation into an extensible plugin architecture. Third-party memory backends — Honcho, vector databases, custom storage — implement a simple ABC interface and register through the plugin system. Built-in memory is the default provider; Honcho has been restored to full feature parity as the reference plugin, with profile-scoped host/peer resolution.

Pick the right memory backend for the job: built-in for dev and testing, Honcho for persistent production storage, or wire up your own vector database for semantic memory.

(#4623, #4616, #4355)

2. Same-Provider Credential Pools — Say Goodbye to Rate Limits

Configure multiple API keys for the same provider. The system automatically distributes load across keys using a least_used thread-safe strategy. When a key returns a 401, the system rotates to the next credential in the pool — no manual intervention needed.

# config.yaml
credential_pool:
  openai:
    - sk-key-1
    - sk-key-2
    - sk-key-3

Enable via the setup wizard or by editing credential_pool directly in config. For heavy users, this virtually eliminates workflow interruptions from single-key quota exhaustion.

(#4188, #4300, #4361)

3. Camofox Anti-Detection Browser Backend

A brand-new local browser backend powered by Camoufox (Camouflage + Firefox) for stealth browsing. For web automation scenarios that need to bypass anti-bot detection — scraping, form filling, automated testing — Camofox is significantly harder for target sites to detect than traditional headless Chromium.

Key capabilities:

  • Persistent sessions: browser state preserved across calls
  • VNC URL discovery: automatically exposes a VNC connection for visual debugging
  • Local backend SSRF bypass: configurable access to internal addresses
  • One-command install: hermes tools install camofox
# Install Camofox
hermes tools install camofox

# Configure Camofox as the browser backend
hermes config set browser.backend camofox

(#4008, #4419, #4292)

4. Inline Diff Previews

File write and patch operations now show inline diffs directly in the tool activity feed. Before the agent moves on to its next step, you see exactly what changed — highlighted additions and deletions, line by line.

It’s faster than manually running git diff or rolling back to compare. Everything renders in real-time in your terminal.

(#4411, #4423)

5. API Server Session Continuity & Tool Streaming

The API server (used by Open WebUI and other frontend integrations) gets two critical upgrades:

  • Real-time streaming tool progress: intermediate tool execution events stream via SSE to clients
  • X-Hermes-Session-Id header: maintain the same session across multiple HTTP requests, with session data persisted to the shared SessionDB

The Web UI experience now approaches CLI parity — you can see in real-time which tools the agent is calling and where it is in the execution flow.

(#4092, #4478, #4802)

6. ACP: Client-Provided MCP Servers

Editor integrations (VS Code, Zed, JetBrains) via ACP (Agent Communication Protocol) can now register their MCP servers directly as agent tools. Your editor’s MCP ecosystem — code analysis, LSP capabilities, project indexing — flows seamlessly into Hermes’ tool calling.

(#4705)

7. Gateway Hardening & Secret Exfiltration Blocking

The Gateway (messaging platform hub) received a major stability pass, paired with systemic security hardening.

Gateway stability fixes:

  • Race condition fixes for photo media loss, flood control, and stuck sessions
  • Approval routing fix: /approve and /deny now route correctly when the agent is blocked waiting for approval

Secret exfiltration blocking:

  • Browser URLs and LLM responses are automatically scanned for secret patterns (API keys, tokens, passwords)
  • Blocks exfiltration via URL encoding, Base64 encoding, or prompt injection vectors
  • execute_code sandbox output is automatically redacted
  • Credential directory protection extended to .docker, .azure, .config/gh

(#4727, #4750, #4483, #4360, #4305)

Core Agent & Architecture

Provider & Model Support

  • Same-provider credential pools — multi-key auto least_used rotation + 401 failover
  • Credential pool preserved through smart routing — pool state survives fallback provider switches, defers eager fallback on 429
  • Per-turn primary runtime restoration — after fallback, auto-restores primary provider on next turn with transport recovery
  • GPT-5 / Codex developer role — uses OpenAI’s recommended system message role for newer models
  • Google model operational guidance — Gemini and Gemma get provider-specific prompting guidance
  • Anthropic long-context 429 handling — auto-reduces context to 200K when hitting tier limits
  • New models: Claude-sonnet-4.6 (OpenRouter / Nous model lists), Qwen 3.6 Plus Preview, MiniMax M2.7
  • Fireworks context length auto-detection
  • DashScope international endpoint fix — Alibaba provider no longer hardcoded to wrong address
  • Custom provider context_length honored in compression
  • Non-sk-ant keys treated as regular API keys, not OAuth tokens
  • Auto-detect models from server probe in custom endpoint setup
  • Config.yaml as single source of truth for endpoint URLs — no more env var vs config.yaml conflicts
  • Setup wizard no longer overwrites custom endpoint config
  • Unified setup wizard provider selection with hermes model — single code path

Agent Loop & Conversation

  • Preserve Anthropic thinking block signatures across tool-use turns
  • Classify think-only empty responses before retrying — prevents infinite retry loops on models that produce thinking blocks without content
  • Prevent compression death spiral from API disconnects — the loop where compression triggers, fails, compresses again is now detected and halted
  • Mid-run compression persisted to gateway session
  • Context-exceeded error messages now include actionable guidance
  • Strip orphaned </think> tags from user-facing responses
  • Codex response preflight hardening and stream error handling
  • Deterministic call_id fallbacks — no more random UUIDs, preserving prompt cache consistency
  • Context pressure warning spam prevented after compression
  • AsyncOpenAI created lazily — avoids closed event loop errors in trajectory compressor

Memory & Sessions

  • Honcho full integration parity restored as reference memory provider plugin (by @erosika)
  • Honcho profile-scoped host and peer resolution
  • Memory flush state persisted — prevents redundant re-flushes on gateway restart
  • Memory provider tools routed through sequential execution path
  • Honcho config written to instance-local path for profile isolation
  • API server sessions persist to shared SessionDB
  • Token usage persisted for non-CLI sessions
  • Quote dotted terms in FTS5 queries — fixes session search for terms containing dots (e.g., version numbers)

Messaging Platforms (Gateway)

Gateway Core

  • Race condition fixes — photo media loss, flood control, stuck sessions, STT config issues resolved in one hardening pass
  • Approval routing fix — /approve and /deny route correctly when agent is blocked waiting, instead of being swallowed as interrupts
  • Resume agent after /approve — tool result no longer lost when executing blocked commands
  • DM thread sessions seeded with parent transcript to preserve context
  • Skill-aware slash commands — gateway dynamically registers installed skills as slash commands with paginated /commands list
  • Per-platform disabled skills respected in Telegram menu and gateway dispatch
  • Remove user-facing compression warnings — cleaner message flow
  • Gateway service -v/-q flags wired to stderr logging
  • HERMES_HOME remapped to target user in systemd service unit
  • Honor default for invalid bool-like config values
  • /update uses setsid instead of systemd-run — avoids systemd permission issues
  • “Initializing agent…” shown on first message for better UX
  • Allow running gateway service as root — LXC/container environment support

Telegram

  • 32-char limit on command names + collision avoidance
  • Priority order enforced in menu — core > plugins > skills
  • Capped at 50 commands — Telegram API rejects above ~60
  • Skip empty/whitespace text to prevent 400 errors
  • E2E gateway tests (by @pefontana)

Discord

  • Button-based approval UI — register /approve and /deny as native slash commands with interactive buttons
  • Configurable reactions — discord.reactions option to control message processing reactions
  • Skip reactions and auto-threading for unauthorized users

Slack

  • Reply in thread — slack.reply_in_thread config option, resolving a year-long community request

WhatsApp

  • Enforce require_mention in group chats — only respond when explicitly mentioned

Webhook

  • Platform support fixes — skip home channel prompt, disable tool progress for webhook adapters

Matrix

  • E2EE decryption hardening — request missing keys, auto-trust devices, retry buffered events

CLI & User Experience

New Slash Commands

Command Description
/yolo Toggle dangerous command approvals — skip all confirmations for the session
/btw Ephemeral side question (By The Way) — doesn’t affect main conversation context
/profile Show active profile info without leaving the chat session 
# YOLO mode: skip all approval prompts
/yolo

# Ask an unrelated question without polluting context
/btw what algorithm does this function use?

# Quick profile check
/profile

Interactive CLI

  • Inline diff previews for write and patch operations in the tool activity feed
  • TUI pinned to bottom on startup — no more large blank spaces between response and input
  • /history and /resume surface recent sessions directly instead of requiring search
  • /insights shows cache tokens — totals now add up correctly
  • --max-turns CLI flag for hermes chat to limit agent iterations
  • Detect dragged file paths — no longer treated as slash commands (by @rolme)
  • config set supports empty strings and falsy values
  • Voice mode in WSL when PulseAudio bridge is configured
  • Respect NO_COLOR and TERM=dumb for accessibility (by @SHL0MS)
  • Correct exit code in quiet mode — successful -q queries return 0 instead of nonzero (by @devorun)
  • on_session_end hook fires on interrupted exits
  • Profile list correctly reads model.default key

Setup & Configuration

  • allowed_users preserved during setup + quiet unconfigured provider warnings (by @kshitijk4poor)
  • Save API key to model config for custom endpoints
  • Claude Code credentials gated behind explicit Hermes config in wizard trigger
  • Atomic writes in save_config_value — prevents config loss on interrupt
  • Scopes field written to Claude Code credentials on token refresh

Update System

  • Fork detection and upstream sync in hermes update — supports forked repos
  • Preserve working optional extras when one extra fails during update
  • Handle conflicted git index — more reliable update process
  • Avoid launchd restart race on macOS
  • Correct shell reload instruction for macOS/zsh users
  • subprocess.run() timeouts added to doctor and status commands

Tool System

Browser

  • Camofox anti-detection browser backend — one-command install via hermes tools install camofox
  • Persistent Camofox sessions + VNC URL auto-discovery
  • Skip SSRF check for local backends — Camofox, headless Chromium
  • Configurable SSRF check — browser.allow_private_urls option (by @nils010485)
  • CAMOFOX_PORT=9377 added to Docker commands

File Operations

  • Inline diff previews on write and patch actions — see additions and deletions with highlights
  • Stale file detection — warns when file was modified externally since last read before overwriting
  • Staleness timestamp refreshed after writes
  • read_file size guard, dedup, and device blocking

MCP

  • Stability fix pack — reload timeout, shutdown cleanup, event loop handler, OAuth non-blocking startup

Skills System

  • Size limits for agent writes + fuzzy matching for skill patch — prevents oversized writes, improves edit reliability
  • Validate hub bundle paths before install — blocks path traversal in skill bundles
  • Unified hermes-agent and hermes-agent-setup into single skill
  • Skill metadata type check in extract_skill_conditions

New & Updated Skills

  • research-paper-writing — full end-to-end research pipeline, replacing ml-paper-writing (by @SHL0MS)
  • ascii-video — text readability techniques and external layout oracle (by @SHL0MS)
  • youtube-transcript updated for youtube-transcript-api v1.x (by @el-analista)
  • Skills browse and search page added to documentation site (by @IAvecilla)

Security & Reliability

Security Hardening

  • Block secret exfiltration via browser URLs and LLM responses — scans for secret patterns in URL encoding, Base64, and prompt injection vectors
  • Redact secrets from execute_code sandbox output — sensitive info automatically replaced
  • Protect .docker, .azure, .config/gh credential directories from read/write via file tools and terminal (by @memosr)
  • GitHub OAuth token patterns added to redaction + snapshot redact flag
  • Reject private and loopback IPs in Telegram DoH fallback
  • Reject path traversal in credential file registration
  • Validate tar archive member paths on profile import — blocks zip-slip attacks
  • Exclude auth.json and .env from profile exports

Reliability

  • Prevent compression death spiral — API disconnect loop detected and halted instead of looping forever
  • OpenAI SDK is_closed as method not property — fixes false positive client closure detection
  • Exclude Matrix from [all] extras — python-olm is upstream-broken, prevents install failures
  • OpenCode model routing repaired
  • Docker container image optimized (by @bcross)

Windows & Cross-Platform

  • Voice mode in WSL with PulseAudio bridge
  • Homebrew packaging preparation
  • CI fork conditionals — prevent workflow failures on forks

Notable Bug Fixes

  • Gateway approval blocked agent thread — approval now blocks like CLI does, preventing tool result loss
  • Compression death spiral from API disconnects — detected and halted instead of looping
  • Anthropic thinking blocks lost across tool-use turns — signatures now correctly preserved
  • Profile model config ignored with -p flag — model.model correctly promoted to model.default
  • CLI blank space between response and input area — TUI pinned to bottom
  • Dragged file paths treated as slash commands instead of file references — now correctly detected
  • Orphaned </think> tags leaking into user-facing responses — now stripped
  • OpenAI SDK is_closed is a method not a property — false positive client closure fixed
  • MCP OAuth server blocking Hermes startup — now degrades gracefully instead
  • MCP event loop closed on shutdown — HTTP server scenario fixed
  • Alibaba provider hardcoded to wrong endpoint — switched to standard DashScope international endpoint
  • Slack reply_in_thread config missing — full support added
  • Quiet mode exit code nonzero — -q successful queries now correctly return 0
  • Mobile sidebar shows only close button due to backdrop-filter issue in docs site (by @xsmyile)
  • Config restore reverted by stale-branch squash merge — _config_version fixed

Testing

  • Telegram gateway E2E tests — full integration test suite (by @pefontana)
  • 11 real test failures fixed + sys.modules cascade poisoner resolved
  • 7 CI failures resolved across hooks, plugins, and skill tests
  • Codex 401 refresh tests updated for CI compatibility
  • Stale OPENAI_BASE_URL test fixed

Documentation

  • Comprehensive documentation audit — 9 HIGH and 20+ MEDIUM gaps fixed across 21 files
  • Site navigation restructured — Features and Platforms promoted to top-level
  • Tool progress streaming documented for API Server and Open WebUI
  • Telegram webhook mode documentation
  • Local LLM provider guides — comprehensive setup guides with context length warnings
  • WhatsApp allowlist behavior clarified with WHATSAPP_ALLOW_ALL_USERS documentation
  • Slack configuration options — new config section in Slack docs
  • Terminal backends section expanded + docs build fixes
  • Adding-providers guide updated for unified setup flow
  • ACP Zed config fixed
  • Community FAQ entries for common workflows and troubleshooting
  • Skills browse and search page live on docs site

Upgrade

hermes update

For new installations, visit the install guide.

Full changelog on GitHub

← Hermes Agent Changelog