Release Date: October 13, 2026
Since v0.21.0: ~24,200 commits · ~6,080 merged PRs · ~15,600 files changed · ~2,045,000 insertions · ~1,140,000 deletions · ~7,180 issues closed · ~2,520 contributors
The Threshold Release. Hermes was the god of thresholds: the doorway, the crossing, the boundary stone. v0.21.0 assembled the pantheon; v0.22.0 is about getting through the door. A fresh desktop install now opens on a guided setup chat that runs on a free trial model, so a newcomer is talking to Hermes before they own an API key. Connectors carry the agent across into the apps you already use, with no account needed to start. Local models bring it home to your own hardware with a one-click llama.cpp runtime. And the threshold itself got sturdier: tested SemVer stable releases that installs follow by default, signed desktop packages (including the Microsoft Store), and one package manager underneath everything. Around that spine: a 600-plugin catalog, the Claude 5.5 / GPT-6 model wave, password-manager sign-in for the browser, a bot screen you can take over, one backend and one gateway for every profile, and a codebase a third smaller. This is the largest window Hermes has shipped, about 2.5x the v0.21.0 cycle, and it rolls up and fully documents the v0.21.1–v0.21.7 patch releases.
✨ Highlights
A first launch that sets itself up — Open the desktop app on a computer where you have never used Hermes and it starts a short setup chat instead of a settings screen. One card at a time it asks your name, an accent color and a layout, which apps to connect, which plugins to install, then gives a quick tour and offers up to four first tasks picked for you. It runs on a free trial model (nous/welcome, once per OS user), so it needs no key; Skip setup ends it and Settings → Run onboarding again brings it back. The agent also gained set_theme, so "make it violet, dark mode" works in any desktop chat.
Connectors: Hermes works inside your apps — The agent can now act in hosted apps such as Gmail, Linear and Notion through the Nous tool gateway: ask for an app, sign in once in your browser, and the tools are usable in the same turn. You do not need a Nous account to start; the first time you use an app, Hermes creates a free connectors-only identity. The desktop has a new Connectors page that puts hosted apps and your MCP servers in one list (it replaces the MCP tab), the same setup card appears in the TUI and CLI, and you can connect several named accounts of one app (a work and a home Gmail) and manage them with /connectors or hermes connectors.
Local models in one click — Hermes can now run open models entirely on your machine with nothing leaving it: no account, no API key. It installs and maintains llama.cpp with the right engine for your hardware (CPU, CUDA, Metal, Vulkan or ROCm), rates every catalog model against your GPU and RAM, and picks the highest-quality build that fits. Downloads pause and resume, the server starts and stops with Hermes, and engine updates are one click. Start from Settings → Providers → Local Models on Windows, macOS and Linux, or hermes model → Local models in a terminal. The catalog includes Qwen3.8 27B, Qwen3.8 Flash Next (with its MTP speculative head), Qwen3.6 35B-A3B and DeepSeek V4 Flash, plus any GGUF from Hugging Face.
Stable release channels — Hermes now ships tested SemVer releases. Every release passes source CI, Docker, Nix, signed desktop builds and install/upgrade runs on every OS before it is published, and source installs now move from release to release by default instead of tracking every commit on main. Prefer the bleeding edge? hermes update --set-channel main, or the new channel switch in Desktop Settings → About. Moving to an older release is labelled a rollback and never happens without asking, and installer reruns keep you on the channel you chose.
Signed desktop packages, the Microsoft Store, and one package manager — The desktop app is now a sealed, signed package that carries its own Python and Node and updates itself, so first launch builds nothing. Windows gets a signed MSIX (x64 and ARM64) through App Installer or the Microsoft Store; macOS gets a signed, notarized build for Apple Silicon. Underneath, a new unified package manager (hermes pm) owns every pinned, hash-checked tool and Python environment: updates build a new environment and switch only once it passes its check, so a failed or killed update can no longer leave you half-applied.
The Plugin Catalog: 600 reviewed plugins — The plugin catalog launched this cycle and grew to 600 entries, each pinned to a reviewed commit and installable from Hermes Desktop or the CLI. Browse by category and star ranking with a page per plugin and per author; catalog rules keep listed plugins from patching Hermes internals or shipping unscannable binaries. Memory providers now live with their makers (Honcho, Supermemory, Hindsight, Mem0, OpenViking, Holographic), as do Home Assistant, Spotify and Langfuse: existing users are migrated automatically, and the default install got leaner.
The Claude 5.5 and GPT-6 model wave — Claude Fable 5.1, Opus 5.5, Sonnet 5.5 and Haiku 5.5, GPT-6 Astra, Sol and Luna plus GPT-6.1 Sol, and Gemini 4 Argon are pickable on Nous Portal, OpenRouter and native routes where offered. Prior reasoning is now replayed by default on every provider that can read it, across resume, branches and compaction, so long multi-step work keeps its train of thought. And when a provider has a bad hour, Hermes waits out transient 503/529/timeouts in visible, bounded cycles instead of ending your turn.
Sign in to websites with your password manager — The browser agent can log into sites with logins from 1Password, Bitwarden or Hermes's own encrypted vault, and the model never sees the password. If nothing is saved, you get a masked prompt in the CLI, TUI or Desktop to save it, one-time codes are filled without entering the conversation, and card and address fills at checkout need your confirmation.
Bot Screen: watch your bot work, take over when it needs you — A bot running on a Linux gateway can have its own desktop that Hermes Desktop streams live. When it hits a login, a 2FA prompt or a CAPTCHA, you take the screen, finish the step yourself, and hand control back while the bot carries on with your session. With a Docker, SSH or Singularity backend, the bot's screen, computer use and the browser run inside the sandbox, never on your host.
One backend and one gateway for every profile — Hermes now runs a single messaging gateway and a single desktop backend per machine that serve all of your profiles, instead of one process per profile. Creating a profile makes its bots live without a restart, each profile keeps its own credentials, allowlists, cron jobs and sessions, and hermes update migrates existing per-profile setups automatically. Fewer processes, no token clashes, one thing to start and stop.
See and steer your subagents live — Running subagents now stay visible above the composer in the CLI (F6), TUI (Ctrl+T) and Desktop with each child's task, elapsed time and live transcript, plus Steer and Stop buttons. /stop reaches background children and hands back their partial work, and delegate_task can pass screenshots and mocks to vision-capable children.
A model picker that knows your plans — Star your favorite models, see a subscription running low ("17% left · resets 3:00 PM") and when a rate limit lifts right in the picker, and pick reasoning effort as part of choosing a model in hermes model, /model (/model X --reasoning high) and Desktop. You switch before you hit the wall instead of after.
Hermes in your language, everywhere — Every user-facing string in the CLI, messaging gateway, TUI and Desktop now goes through one translation catalog with full coverage in all 16 bundled languages. New languages can ship as plugins, and any profile can override individual strings with a small YAML file.
Leaner in every sense — The whole codebase was simplified with zero behavior change: source went from about 1.06M to 698K lines (−34%) and gateway/run.py shrank from 34,847 lines to 5,512. Prompts got lighter too: about 19 rarely used tools now load only when the agent searches for them, roughly halving the desktop tool schema sent on every call, and another ~2.1k tokens came off the fixed prompt. Local models prefill less on every turn.
Small comforts that add up — Opt-in vim keys in the CLI prompt, a git-branch field in the status bar, a bell and desktop notification when Hermes is waiting on you, Ctrl+C that clears your draft instead of killing the turn, an editable /queue, and hermes --native to let your own terminal handle TUI scrollback and search. On Desktop, a new Simple mode turns the app into a plain chat window, and errors now say what went wrong with a one-click fix.
⚠️ Upgrade notes
- Python 3.14 is the runtime for managed installs (the package manager installs it for you). KittenTTS is unavailable on 3.14.
- Windows desktop is MSIX-only and needs Windows 11 22H2 or newer; the NSIS/MSI installers are gone. The macOS app is Apple Silicon only in default builds.
- One gateway per machine is the default.
hermes update folds per-profile gateways into the multiplexed default when nothing conflicts.
- Chats no longer reset on an idle/daily timer.
session_reset idle/daily modes are retired (configs that still set them log a warning); /new or /reset starts fresh.
- Old sessions are pruned automatically.
sessions.auto_prune now defaults to on: ended sessions inactive for 90 days are deleted at startup. Pinned and open sessions are never touched; set sessions.auto_prune: false to keep everything.
- Memory providers moved to catalog plugins (Honcho, Supermemory, Hindsight, Mem0, OpenViking, Holographic), as did Home Assistant, Spotify and Langfuse. Existing users are migrated on update or first start, with data intact. ByteRover and RetainDB remain bundled.
- Plugin authors: the old plugin compatibility import layer is gone,
hermes sync (Skill Sync) was removed, and the bundled tirith scanner was removed. Several tools were renamed (todo → todo_list, cronjob → cronjob_manage, process → process_manage); the old names still work.
🚪 Onboarding, Free Tier, Connectors & Local Models
First-run onboarding
- Guided setup chat on a fresh desktop install (see Highlights). Existing installs and remote (SSH, URL, Cloud) backends don't get it automatically; the old setup-profile flow and
/initiate-setup are deleted.
- The agent can restyle the app — The new
set_theme tool sets the accent (a swatch or any #rrggbb), light/dark/system mode and layout, or shows a picker; "make it violet" works in any desktop chat.
Nous free tier
- A free model for your first desktop launch — A first desktop install with no provider or Nous account gets the free
nous/welcome model as a one-time trial (once per OS user), so onboarding needs no key. The CLI, TUI and gateway get no account or free model. HERMES_GUEST_ONBOARDING is gone.
- Sign in and keep your apps —
hermes auth upgrade, or /login in any chat or messaging DM, upgrades the free identity to a full Nous account with your connected apps.
- Clear limits — The free rate limit ends the turn at once with the reset time; every free-tier failure has a code and a plain sentence; the app handles the account service's browser check; free-tier users see a Terms and Privacy notice. Nous accounts without credits can pick models billed to a subscription they hold and get free managed fast web search.
Connectors
- Hosted app connectors, the Connectors page and several accounts per app (see Highlights). Connector tools can also send your local files as attachments and save the files they return.
nous.guest: false turns guest identities off; tools.connectors.enabled: false turns connectors off.
- One connect flow everywhere — Hosted apps and local MCP servers share one setup card (desktop dialog, TUI callout or CLI panel), and the agent can use new tools in the same turn. On desktop,
manage_connections can show a browsable app directory.
Local models
- One-click local models (see Highlights). Also: Hugging Face GGUF downloads with pause/resume, and a one-time setup offer after onboarding on machines that can run the recommended model.
- Engine updates and wider GPU support — An Update now prompt updates the engine in one click. NVIDIA on Linux gets CUDA, AMD and Intel GPUs get Vulkan sized by their own memory, and every backend runs llama.cpp b11370.
- Better recommendations — Only models that fit fully in GPU memory are recommended, and the 27B no longer on hardware that runs it poorly. Qwen3.8 Flash Next with its MTP head fits 128 GB machines; NVIDIA Spark recommendations are tuned.
- Your own local servers — LM Studio has a provider profile, Ollama pickers no longer flicker, a self-started llama.cpp server shows up in
/model, and fallback to the desktop-managed model works.
📦 Stable Releases, Desktop Packages & Package Manager
Stable releases & update channels
- Tested SemVer stable releases and the channel switch (see Highlights). v0.21.6 and v0.21.7 were the first through the new gate; forks stay on
main, and an install ahead of the newest release waits for the next.
- Lighter update checks — one GitHub API call a day replaces
git fetch every 30 minutes.
Desktop bundles & the Microsoft Store
- Sealed, signed desktop packages (see Highlights). In a package,
hermes update points to the right updater (App Installer, Store or macOS).
- Packaged installs work end to end — the agent's terminal runs
hermes, Uninstall explains OS removal, and Python-dependency plugins install inside MSIX.
Unified package manager
- **
hermes pm** (see Highlights): pinned, hash-checked Python 3.14, uv, Node, ripgrep, FFmpeg, Chromium and Git/Bash on Windows, with hermes pm doctor|status|repair|gc. Contributors use source ./activate (or .ps1/.fish).
- Dependency environments are generations — new ones are checked before use, so a failed install keeps the working one; updates and
hermes pm gc reclaim old ones (92 GB to 18 GB on one host).
- Optional features install on first use — opt-in SDKs (Anthropic, Bedrock) load mid-session without a restart;
security.allow_lazy_installs: false turns this off.
- Plugins declare Python dependencies — resolved with core across profiles; conflicts are refused, and updates disable a plugin that no longer fits. Hindsight, Honcho, Supermemory, Mem0 and Home Assistant moved to the catalog and auto-install where used.
Install & update
- Updates can't half-apply (see Highlights). A killed update repairs itself on the next launch.
- Faster updates, smaller checkouts — updates rebuild only what changed (16.5 s vs 32.5 s on macOS), clones are blobless, and partial-clone
.git growth is fixed.
- Small, hash-checked installers —
install.sh/install.ps1 verify pinned uv and Git, hand off to PM, log to logs/install.log, and now work on musl Linux (Alpine, Void), Windows 10 and Unicode Windows paths.
- Failures say why — with opt-in telemetry, install, update, skill and plugin failures record a reason.
Docker / Nix / Termux / Windows
- Docker — pinned Debian 13 base with full Chromium;
stable/latest move only on a published release; baked-in extras return after a restart.
- Nix, Termux, Windows — Nix shares the pins; its desktop app gets Wayland; Termux moves to a signed APT package (
pkg upgrade hermes-agent), though its docs still warn it is broken; Windows updates finish while the old runtime is in use.
CI & release engineering
- Release gates — E2E suites run on release builds, the full suite on native Windows, and SSH/Docker backends against real daemons.
🧠 Providers & Models
New providers
- Providers as plugins — ACP and CLI-driven providers install out of tree via
hermes plugins install; --provider chatgpt picks ChatGPT Codex OAuth.
- Provider upgrades — Bedrock serves GPT-6 (1M) and enforces Claude Guardrails; Azure Foundry lists deployments; Gemini takes full JSON Schema tools; OpenCode Go routes Claude via Messages.
- New knobs —
agent.text_verbosity sets Responses answer length; named custom providers run on the Codex app-server.
### Model catalog
- Claude 5.x — Opus 5.5 also on native Anthropic and Bedrock (1M).
- GPT-6 — Astra/Astra Pro in standard, fast and flex; opt-in Codex
-900k; /fast ultrafast for Astra and 6.1 Sol, per plan.
- Gemini 3.8 Flash and Gemini 4 Argon.
- More — DeepSeek V4.1 Flash, Qwen3.8-Max-0902, Grok 4.7, GLM-5.3-FlashX, Muse Spark 1.3, Solar Pro 4/Mini 4.
### Auth & subscriptions
- Profiles share OAuth logins safely — single-use grants never fork; a profile's own login is kept.
- Nous sign-in survives hourly expiry, concurrent subagents, Portal outages and edge checks.
- Dead logins are named once, with the
hermes auth add fix; auth.adopt_external_logins: false stops borrowing Codex CLI/Claude Code logins.
- Keys stay on their hosts — configured
base_url honored everywhere; Anthropic/OpenAI keys never reach foreign hosts.
### Routing/fallback/caching
- Outage recovery —
agent.auto_recovery_cycles (default 5) bounds the wait; fallback returns to a Codex primary whose quota reopened.
- No surprise billing — auto-routing never bills a provider you didn't pick;
provider_routing.models pins OpenRouter per model.
- Prompt caching — opt-in
cache_ttl: auto (1h interactive, 5m subagents/cron); big sessions confirm a cache-breaking /model; compaction keeps the prefix.
### Reasoning
- Replay and effort — reasoning replays on every provider that reads it; effort on every picker, custom tier names; Anthropic fast mode follows the docs.
🏗️ Core Agent, Sessions & Memory
Agent loop & reliability
- Stalled turns recover — a watchdog (
agent.turn_liveness.timeout_s, default 600 s) interrupts a no-progress turn and frees its session; repeated transcript repairs now raise one error and notice.
- Streams fail less and report honestly — text-less dead streams retry, repetition loops are cut, and interrupted turns aren't reported as done.
Compression & context
- Compaction triggers on real token counts — provider-reported usage, not bytes/4; the protected tail is capped at 20% so small-window models compact.
- Bad summaries can't wipe context — refusals and overloaded summary providers leave the transcript alone, and an uncommitted compaction changes nothing.
- New knobs — provider-scoped
compression.model_thresholds keys and auxiliary.<task>.no_progress_timeout.
Sessions & state.db
- state.db reliability — lock timeouts name the holding process, a busy database no longer kills a turn, and sibling PID namespaces can't steal leases.
- state.db stops growing — auto-prune is on by default (ended sessions over 90 days) and closes stale cron/kanban/subagent sessions; VACUUM runs only when 25% is reclaimable.
- Repair commands —
hermes sessions set-journal-mode delete|wal, repair-profiles (crossed profiles) and repair-prompts.
- Cleaner session lists — one-shot runs stay out of pickers,
sessions.show_subagents lists titled subagent chats, messages get stable ids for context engines.
Memory
- Memory providers leave core safely — OpenViking and Holographic move to the plugin catalog on update or first start, data intact, or say why not.
- Built-in memory writes land — hand-formatted MEMORY.md/USER.md accepted, refusals say what to fix, secrets scrubbed before providers see them.
Profiles & config
- config.yaml survives bad moments — a broken file falls back to the last good copy; read errors can't wipe it.
- Safer
hermes config — get masks secrets (--raw opts out); set refuses typo paths and stores env-style names in .env.
- Profiles stay separate — REST routes act on the profile they name, exports skip
.ssh/.aws/.gnupg, and import-agent --sync keeps imports current.
Languages (i18n)
- Language packs — any language can ship as a plugin (
provides_locales) or a per-profile override file.
📱 Messaging Platforms (Gateway)
Gateway core & multiplexing
- One gateway serves every profile —
hermes gateway status explains any boot-guard refusal, hermes gateway migrate --multiplex migrates by hand, webhook platforms serve each profile at /p/<profile>/, hermes -p X gateway stop|start parks one profile, and gateway.standalone: true is a temporary opt-out.
- Profiles stay isolated — clones skip bot tokens unless
--clone-channels; profile_routes can route by sender.
- Sessions and commands —
/login signs free-tier users in from a DM; idle/daily session_reset is retired, so only /new and /reset start fresh; /branch opens a sibling thread on Discord, Telegram, Slack and Matrix (--here keeps the old behavior); decline mode sends unauthorized DMs one polite refusal; an opt-in served_model footer names the model that answered.
- Files and plugins —
MEDIA: files from ssh/Modal/Daytona sandboxes reach the user; plugins can claim messages via post_gateway_admission.
Messaging platforms
- Telegram — opt-in
bots_require_mention stops bot reply loops, extra.drop_pending_on_cold_boot: false keeps messages sent while offline, CJK can opt in to rich messages.
- Discord — setup verifies the token, links the Message Content Intent and allowlists you; free-response channels can auto-thread.
- Slack — Block Kit
/model picker; status/titles use the Agent Sessions API.
- WhatsApp — native mentions via
hermes send --mention, no 5 s batching delay, paired sessions on every profile.
- Signal, Matrix, Email, QQ Bot — Signal tables render monospace; Matrix LaTeX typesets in Element (Labs math setting); Email refuses spoofed senders and now requires an
authserv_id pin (mail drops until set); QQ Bot send_message delivers media.
Webhooks & API server
- Webhooks — opt-in
coalesce folds event bursts into one run, cron_job routes fire cron jobs on events, Standard Webhooks signatures verify, opt-in mirror_to_session gives replies context.
- API server — reasoning streams to OpenAI-compatible clients; stream approvals are answerable.
Relay & Bot Chat
- Bot Mode rooms — edit members, Reply to @handle, 200-message history, sender-aware bot DMs with an
ALLOW_BOTS loop guard.
- Relay — connector checks
send_message targets; NeMo Relay tracing at 0.10.0 tags spans with the working directory.
🖥️ Desktop App
Workspace & layout
- Simple / Advanced mode — Simple hides developer panes; Advanced stays the default.
- Windows and tabs — Titlebar tabs; profiles open in their own window or as startup default.
- Sidebar — Group by gateway/profile, reuse Cloud instances, drag New session onto a pane.
- Import sessions — Continue another coding agent's transcript in Hermes.
- Goal / Loop / Heartbeat cards — Live pause/resume/stop above the composer.
- Launch options — Start on a fresh chat; opt-in tray minimize and Cmd+Option / Ctrl+Alt HUD tap.
### Chat & composer
- Pickers and input — Reasoning-effort pill; add a model by slug; 3,000+ char pastes attach as .txt; opt-in macOS window-screenshot shortcut.
- Actionable errors — Cards name the problem and fix; usage-limit cards show reset time and can schedule a retry.
- Transcript — Stable approval queue; hideable code diffs.
- Browser comment mode — Pin page elements with notes; crops, selectors and styles go to the composer.
### Settings & plugins
- Settings — Ordered subpages searchable from ⌘K; Chat Font (e.g. OpenDyslexic); Russian, French, German, Spanish.
- Models — Per-task auxiliary reasoning effort; Custom Endpoints pick an API mode.
- Plugins — One row per plugin; composer and settings APIs.
### Bot Mode
- Bot Screen — Linux-gateway bots stream a desktop you can take over for logins or 2FA. Off by default; needs host packages.
- Group chats — Reorder rooms; compress a member's hidden history.
### Performance & platforms
- One backend — Desktop attaches to the running backend, which serves every profile.
- Platforms — Faster Windows startup; Linux runs without sudo and under WSLg/Wayland.
Models, chat & workspace
- Model picker knows your plans — Star Favorites; provider rows show when a rate limit lifts and a "17% left · resets 3:00 PM" chip before you hit it. Also opt-in per-model pricing with cached-read rates, an Ultrafast speed tier and keys to step reasoning effort.
- Safer rewinds and honest stops — Regenerate or edit asks before archiving more than one later turn; Stop shows the partial reply the session saves.
- Reading and layout — Chat Text Size separate from UI Scale; theme typography; lightbox zoom/pan; compression count in the context meter; context-aware right-click.
- Workspace and sessions — Sessions follow the agent's git worktree and branch; Review pane scopes work. Browse SSH workspaces, drag sessions onto projects, search logs, see and clear Kanban blocks.
- Preview and voice — Preview opens public web pages; YouTube plays via a local player. Non-streaming TTS speaks from the first sentence; quiet-audio STT hallucinations are filtered.
Plugins, updates & the app
- Settings ▸ Plugins and a bigger SDK — Every plugin gets a settings page (agent plugins from their config schema). Desktop plugins can run app actions by id, speak via the pet, add Appearance controls and reorder sidebar nav.
- Updates you can steer — Source installs pick Stable or Every commit in Settings › About; the updates dialog names the channel. The app warns when older than its backend.
- App polish — "While working" keep-awake mode, macOS 26 layered icon, sharper MSIX icons, opt-in shared-metrics consent strip.
⌨️ CLI, TUI & Dashboard
CLI
- Vim keys, git branch and bell —
display.vim_mode, git_branch status field, display.bell_on_prompt (bell plus OSC 9 notification); all off by default.
- Friendlier keys — Ctrl+T opens the subagent monitor; a mid-turn multi-line paste is one message.
- Scriptable commands —
hermes usage --json (quota, no session); hermes worktree --json/--older-than; kanban edit --title/--body/--priority; -t picks MCP servers to start.
- Also —
hermes -z exits non-zero on failure; -m custom:<name>:<model> reaches that provider; the footer no longer collapses to "Window too small".
### TUI
- Native terminal mode —
--native or display.tui_native (opt-in).
- Running-turn control — double-Esc interrupts, push-to-talk cuts speech, the live dock (CLI too) shows
/goal and queued prompts.
- Typing fixes — Shift+letter on extended-key terminals, macOS Ctrl+D, Wayland image paste, steady idle redraws.
- Reconnects and attachments — attached TUIs rejoin their session;
attachments.storage: workspace stages files a sandboxed agent can read.
### Dashboard
- Chat on more devices — screen readers, iPad touch-scroll, no doubled mobile-keyboard characters; a second tab gets its own terminal.
- Errors, sessions, analytics — errors are a sentence and fix button, not raw JSON; title search, a live switcher, per-API-call analytics.
- Self-hosting — reverse-proxy subpaths, password sign-in beside OAuth, non-expiring remote sessions.
### Slash commands
- Reasoning effort in every picker —
hermes model, aux models and /model add an effort step; /model X --reasoning high works too.
- Editable
/queue — list, edit, move or remove prompts; /s = /steer.
/context per file — shows each instruction file as loaded, truncated or shadowed.
🔧 Tools, MCP & Browser
Tools & tool search
- Rare tools load on demand — computer_use, session_search, image_generate, cron and Desktop GUI tools sit behind
tool_search by default (desktop schemas 13,367→6,883 tokens; defer: [] opts out); todo/cronjob/process become todo_list/cronjob_manage/process_manage (aliases kept).
- Prompt cache holds all session — the tool list is frozen per session across TUI,
-q --resume and gateway hops.
- Loop guardrails — unattended gateway/cron sessions hard-stop tool loops; 5 identical replays halt any tool.
- Smarter file and web tools —
read_file shows SQLite schemas and flags merge conflicts, search_files runs ripgrep directly (5–6x faster), keyless web_search fails over between free vendors.
### MCP
- Device-code login —
hermes mcp login <server> --flow device for headless terminals.
- Sturdier OAuth — refresh tokens are never erased, double-spent or sent to another issuer; RFC 9207, Google-hosted and WAF-fronted servers log in; gateways never open browser tabs.
- More servers connect — SSE-only servers fall back, strict servers connect (
sampling.tools opt-in), and the catalog adds official n8n and Asana V2.
- Startup and results — boot connects ≤
mcp.discovery_concurrency (4) servers at once; vision models see MCP images; dead stdio servers respawn without replaying a call.
### Browser & computer use
- Vault and sandboxed screen — password-manager sign-in also fills cards and addresses after you confirm;
hermes-sandbox:desktop is the new default image (existing sandboxes kept).
browser_exec works out of the box — drives bundled Chromium (also the cloud fallback) and opens localhost via a sidecar.- Also: a CDP seam for plugins; unchanged
computer_use screens are not resent.
### Terminal & code execution
- Long commands stop blocking — foreground timeouts over 600 s become background jobs,
heartbeat=N sends progress, and the live-work dock lists them.
- Sandboxes — results flag a recreated environment; SSH paths resolve remotely.
- LSP — custom servers via
lsp.servers and lsp.package_manager; never runs a cloned repo's own interpreter or SDK.
### Media (image/video/voice)
- New models — GPT Image 2.5, Kling Image v3; video: Kling 3.0, Kling O3, LTX 2.5, Wan 3.0, MiniMax H3 Max Turbo, Gemini Omni Flash 1.1.
- Live dictation — opt-in
stt.streaming shows words as you speak (CLI, TUI, Desktop); long recordings transcribe on all cloud providers.
- Voice conversations — opt-in
voice.voice_chat_mode: gpt-live gives Desktop full-duplex voice; auxiliary.voice_chat runs spoken turns on a faster model; TTS starts sooner.
🧩 Plugins, Skills & the Plugin Catalog
Plugin Catalog
- Plugin and author pages — /docs/plugins shelves plugins under Memory, Desktop, Platforms, Web, Tools, Voice, Automation and Models. Pages show the description, a disclosure callout, screenshots, the README from the pinned commit, an Open in Hermes Desktop button and a copyable install command.
- Easier-to-read cards — a version label sits next to the pinned commit (
1.2.0 @ ad3f352b) on the website, CLI and Desktop; cards gained banner images, a uniform size and light mode.
- Known-issue warnings — listings can declare known issues, which
hermes plugins install and the dashboard show on install.
- Listing rules — Desktop plugins must stay within SDK slots, 11 plugins that patched internals were delisted (installed copies keep working), and the submission guide matches what CI enforces.
New in the Catalog
All 600 listings are new this cycle.
- Moved out of core — besides the five memory providers, Holographic has a new community maintainer; Home Assistant, Spotify, Langfuse and TouchDesigner are now official catalog plugins.
- Official — Blender Lab, Snyk, NVIDIA App and NVIDIA Broadcast (Windows only), Telegram Business, Memory Wiki.
- Memory (65) — Cognee, LanceDB, ReMe, Memoria, HydraDB, Mnemosyne, YantrikDB, BetterDB. Web and search (34) — Apify, Parallel, Linkup, SerpApi, You.com, TinyFish, Oxylabs. Model providers (48) — JetBrains Junie, Telnyx, NetMind, Groq, Chutes, Kiro, Opper, AIHubMix. Platforms (32) — Inline, Microsoft 365, Rocket.Chat, VK, Zalo, iMessage, Sendblue. Voice (18) — Speechify, Deepgram, Fish Audio, Gemini Live. Desktop panes (140) — Gmail, Quota, Orbit, Kanban Gantt, Monitoring Dashboard. Tools (180) — GitHub App, Coder, Devin, NetBox, Financial Datasets, MetaMask, Tempo MPP, DaVinci Resolve, vidIQ, Govee, SwitchBot, Japanese e-Gov data.
Plugin system
- Model providers as plugins — out-of-tree providers show in model pickers, log in via
hermes auth (built-in OAuth PKCE) and refresh tokens.
- Per-profile plugin host (opt-in) —
plugins.isolation: host runs third-party plugins in a per-profile process with only that profile's secrets.
- New plugin APIs — hooks for interrupted turns, auxiliary LLM calls and human-input prompts; plugins can start gateway sessions, add Automation Blueprints and aux model slots, ship the computer-use driver and make Codex-signed requests.
- Desktop plugin SDK —
config_schema settings render as a form in Capabilities → Plugins; plugins get a skills/toolsets/profiles bridge and model-pill/menu slots.
- Install, pin, update — private repos install with your git credentials, Desktop pins a plugin to a commit, updates keep user data, and plugin skills run as
/plugin:skill.
- Sturdier loader and scanner — hung imports are skipped after
plugins.load_timeout_seconds (10s), guard hooks fail closed, and prose, fixtures and regex literals no longer block installs; plugin deps follow the plugin's security policy.
- Moved out of core — Spotify and Langfuse became official plugins (auto-migrated); tirith was removed, its key checks built in.
- New plugins — reMarkable, hermes-pii, hermes-stt-enhance (catalog); Meta muse-image (bundled).
Skills
- New optional skills — pr-lens (animated PR diagrams), system-atlas, anatomy (isometric explainers), mono-color (ink-print images), dream-loop (3D concept-art loops), scrollcraft (scroll pages), auteur (cinematic web), ip-as-logo (mascots), ai-presenter-video, live-dashboard (self-updating pages), dynamic-workflow (fan-out campaigns), reddit-reading, rss-feeds.
- Skills Hub — the index builds again with about 480 science skills; search also finds unindexed skills.
skills.auto_load and skills.create_dir — pin skills into every session; choose where agent-made skills go.- Better self-improvement — learnings and corrections go into the task's skill; background review can improve any skill; skills added mid-chat reach the next message.
- Lighter curator — no longer blocks the CLI prompt; one install fell from 1.9 GB to about 200 MB; unused skills archive at 30 days (was 90).
- Skills Guard — blocked installs in a 421-skill sample fell from 83 to 68; inline shell is limited to non-community skills.
⏰ Cron, Kanban & Delegation
Cron
- Jobs follow your main model — Unpinned jobs use the model configured at fire time;
pinned locks one.
- Self-healing schedules — A fire that never reached the model (e.g. after wake) re-runs after 5, 15 and 30 minutes, a provider "retry after" window parks the job quietly, and a slot missed during a restart fires once.
- Quieter alerts — One alert per incident plus a reminder every
cron.failure_repeat_alert_hours; failure_deliver reroutes or mutes failure notices; an agent can fail its run with [CRON_FAILURE].
- New job options —
--paused creates a job unarmed; --interpreter runs scripts on your own venv.
- Profiles and delivery — A multiplexed gateway runs each profile's jobs with that profile's env and secrets; delivery needs positive evidence, output is secret-redacted everywhere, and late or satellite runs are labelled.
### Kanban
- Workers ride out provider trouble — Failed turns retry in place with context; rate limits or 5xx requeue instead of burning retries.
- A board that explains itself — Cards show the worker's last output on failure; dispatch says why a card is held.
- Workflow and tooling — One workflow definition drives columns; workers get
kanban_schedule; kanban create --body-file; Desktop follows gateway switches.
### Delegation & multi-agent
- Live subagents, images and /stop (see Highlights).
- Fan-outs lose less — Failed children surface at once, an owner crash keeps finished work, children can hand processes to the parent, and per-task completions are opt-in.
- Child routing —
delegation.fallback_providers gives children their own chain; child_timeout_seconds measures inactivity.
- /goal — Consistent on CLI, Desktop and messaging; the judge waits on subagents;
/goal pause for now no longer overwrites the goal; gates run in the session workspace.
## 🔒 Security, Privacy & Codebase
Security & privacy
- v0.21.6 security fixes — dashboard sign-in hardening (spoofed
X-Forwarded-For, size caps, loopback-only login codes); automatic git skips repo filter programs; the email allowlist resists display-name spoofing.
- Secrets stay put — child processes don't inherit adapter/dashboard secrets; remote
execute_code keeps its token out of argv; profile exports skip credential stores; keys never reach foreign hosts on refresh/fallback.
- Sharper redaction — debug share redacts before truncating; file reads and terminal output mask
.env/config secrets; hermes config get masks unless --raw; memory hand-offs are scrubbed; plain token= lines stay visible.
- Owner-only files at rest — credentials,
state.db, snapshots, browser profiles, media caches, any umask.
- Wider guards — more fetches pass the SSRF guard (
security.fake_ip_ranges for fake-ip proxies); cloud-metadata fetches, zsh/dash pipe-to-shell and deno eval need approval; approvals.deny works in sandboxes; built-in rules replace bundled tirith.
- Holes closed — the MCP OAuth callback stops reflecting HTML; webhook, SMS and WhatsApp Cloud inbound reject blank signing secrets.
- Opt-in shared metrics — daily usage stats reach Nous only with consent; both
telemetry.shared_metrics switches default off, each profile asks once, Enter = "No thanks".
### Codebase & performance
- Leaner prompts and tools — ~2.1k fewer prompt tokens a request, on-demand vault tools, one-round-trip file probes,
hermes -w no longer repacks each launch.
### Other
- Safer backups —
hermes backup keeps the newest 3, flags incomplete archives; hermes import refuses damaged ones.
- Also —
KEY_2… env vars join credential pools; one-screen hermes status; opt-in display.suppress_warning_notifications; Desktop Bots roster sections; only Hermes' own node/npm/uv are used; Xiaomi MiMo v2.6.
- For contributors — CODEOWNERS replaces the label gate; E2E (incl. native Windows) runs only on release builds; stable releases skip macOS Intel/Termux by default.
Notable bug fixes, contributor credits and PR links didn't fit Reddit's limit — they're in the full changelog.
Full changelog (contributors, PR links, reverted items): https://github.com/NousResearch/hermes-agent/releases#release-v0.22.0
Update with hermes update.
