One Token, Whole Dashboard: Making the Deployment Token a First-Class Credential
Binding the web dashboard to a non-loopback address used to fail closed unless you had basic auth or OAuth. Now a single deployment token authorizes both REST and the WebSocket upgrade.
Read more
Your theme stopped at the desktop app: Hermes now stores UI settings per machine
A single machine-level ui-preferences.json now backs both the Desktop app and the webapp: one store for every address, two-way sync across tabs, a directory lock plus rename on every write, and why it never degrades into one file per profile.
Read more
Every session freezes at once, the log stays clean: Hermes moves eight measured blockers off the event loop
You are typing in Desktop and the UI goes dead for half a minute. You restart, the log is empty. The gateway is single-threaded asyncio, so anything that waits on disk on the loop thread stalls every session at once — this change moves eight measured blockers off it.
Read more
One URL, Two Hosts: Patching the Parser Gap in Hermes' SSRF Guard
urlsplit saw 1.1.1.1; the browser dialed 127.0.0.1. Hermes' URL safety check used to wave that through. PR #145578 makes both layers refuse ambiguous authorities instead of guessing.
Read more
You rotated the key, the process kept the old one: how Hermes fixed a same-tick cache staleness bug
You rotate a key, revoke a pairing, refresh a token — and a live process keeps using the old value until you restart it. The cause sits in filesystem timestamp precision. Here is how twenty caches were fixed at once.
Read more
Two logins in the same second, two identical keys: inside the Hermes webapp session-isolation bug
You hit sign out and the browser session was gone — but a login created in the same second held your exact tokens. How a five-line fix closed it, and what the design lesson is.
Read more
Let the agent cut video on your own machine: Kinocut joins the Hermes plugin catalog
A two-hour recording, three clips to publish, and no appetite for uploading the raw footage. Kinocut wraps local FFmpeg as MCP tools, so the agent trims and exports on your laptop — no account, no API key.
Read more
127.0.0.1 is not a security boundary: Hermes now teaches its A2A port to refuse browsers
Binding an A2A listener to loopback looks private — but any web page in your browser can reach it too. Here are the two doors this fix added: a Host check and a refusal of browser-originated POSTs.
Read more
Why typing gets slower the longer a session runs — and how Hermes Desktop cut the cost by two thirds
In a 300-turn session, every keystroke cost 34 ms of main-thread time. Not the model — every key press re-ran the whole transcript. Here is the cause, the fix, and the numbers.
Read more
Eighty-one PRs in one tag, and the notes admit they left it undocumented on purpose
v0.22.5 bundles 81 merged PRs into one stable point for CLI, Store, Docker and Cloud, while the curated write-up waits for v0.23.0. Here is what the release body does say: update checks that withhold a release they will not take, more features leaving the core for plugins, and a desktop build that finally says which bot is working.
Read more
Three Characters, One Throat: Picking an ElevenLabs Voice per Call in Hermes
On the ElevenLabs provider, text_to_speech now takes a per-call voice_id and a find_voices search object, so one script can have a blacksmith, a narrator and a girl without editing config or restarting.
Read more
Switching Agents Costs You the Rules You Already Wrote, Not the Install
hermes import-agent reads your Claude Code, Codex, Cursor or OpenClaw config, shows a per-item plan before writing anything, and carries over memory, allow rules, MCP servers and skills — while leaving every credential behind on purpose.
Read more
Every command waited 6.7 seconds first: how Hermes moved three startup chores off the critical path
Scratch pruning, a fifteen-subprocess git version lookup and a two-month-stale commit-graph all sat in front of every Hermes process. Three PRs merged on 2026-10-26 moved them out of the way — and none of it is in a release yet.
Read more
Your Hermes workspace in a browser tab — no install, no relay
How the gateway now serves the Desktop workspace straight to a browser: the four-line config, the three reasons it silently refuses to open, what plain HTTP quietly takes away, and why a one-time 60-second link is the only way in.
Read more
One batch, many brains: delegate_task now picks a model or a profile per task
Eight subtasks in one batch — six lookups and two hard architecture jobs — used to share a single delegation.model. PR #142563 makes delegation a pluggable backend: delegation.backend takes default, model_map or profile_routes, the model only ever sees the names you wrote, every result carries a route receipt, and a mis-routed task fails loudly instead of quietly falling back.
Read more
Allowance-based plans: what /usage shows you now, and what happens at the limit
Some subscriptions do not run on a credit balance but on day, week and month allowances, plus a separate one for large models. PR #142308 makes Hermes draw whatever the server sends: one bar per allowance in /usage and Desktop billing, Free/Small/Medium/Large tags in the model pickers, and a limit message that names the allowance, its reset time and what still works. Hermes never switches models for you.
Read more