When Hermes is stuck waiting on a human, your plugin can now tell
A new on_human_input_request / on_human_input_resolved hook pair covers sudo prompts, clarify questions and dangerous-command approvals, so a notifier no longer needs one hook per prompt type.
Read more
The gateway heals every platform but one — here is why
Three gateway reliability fixes: a platform whose plugin failed to load now retries its import, Telegram messages held during a disconnect are delivered after the adapter is rebuilt, and in-flight /v1 runs finish on gateway stop instead of being killed after 0s.
Read more
Agents write code faster than anyone can review it. Here is the ratchet that keeps the codebase from rotting
Hermes added a ratchet: every function and file may only stay the same or improve, new code has to meet the target, and one local command runs exactly what CI runs. Includes the CC/line/nesting thresholds, the escape hatch, and a 318-PR replay.
Read more
Your Profile Export Was Shipping Your Cloud Credentials
A tar.gz from hermes profile export is meant to let a teammate reproduce your setup — but it also carried .docker, .azure, .config/gh and .config/gcloud credential stores. Two PRs closed the gap.
Read more
Home Assistant Left the Core: What Happens to Your Setup
The Home Assistant gateway platform and its tools moved out of Hermes core into an official catalog plugin — with an automatic migration that installs it per profile, leaving config keys, env vars and tool names untouched.
Read more
Hermes Stopped Believing the Sender's Own dmarc=pass
An Authentication-Results header is text the sender can write. Hermes now requires an authserv-id pin and drops mail until one is set — a deliberate behaviour change with a one-line fix.
Read more
Memory Has a Budget: Why It Eventually Stops Remembering
Hermes' long-term memory has a character limit, and when it fills up writes are skipped silently. The hermes-dreaming plugin adds a deterministic nightly pass that records what matters and retires what does not.
Read more
Third-Party Plugins Move Out of the Main Process: Inside plugins.isolation: host
A plugin you install used to share one Python process with every session, secret and in-memory key you own. The new plugins.isolation: host gives each profile its own plugin host process — no plugin code changes, and a short, documented list of what cannot move.
Read more
Your Agent Wrote to Your Real crontab at 2am: Sandboxing HOME and cron
A sandbox that isolates HERMES_HOME still leaves the agent writing to the real home directory, the real crontab and the real systemd user bus. Three ghost cron jobs left behind by one eval run show which exits an isolation story has to cover.
Read more
Running Hermes Inside Codex: A Community MCP Extension
Editing code in Codex while Hermes runs your automations usually means two windows and a lost train of thought. This community MCP extension embeds Hermes chats, profiles, model switching and the scheduler into Codex, with credentials kept in the local bridge process.
Read more
Why Your /save Export Was Missing Turns — and the Cap Behind It
The same session could export completely from the CLI and come up short in the desktop app, losing turns that in-place compaction had archived; a very large session could exhaust memory instead. The fix unifies all three surfaces on one code path and applies each profile's own export cap.
Read more
Why Third-Party Embeds in the Desktop App Have to Be Sandboxed
How Hermes isolates X, Instagram and YouTube embeds in the desktop app, one already-public security issue and its fix, and the version status today.
Read more
Three Tools in One tool_call Is No Longer an Error: Hermes Splits the Batch
When a model packed three MCP tools into a single tool_call, the local-tools-one-at-a-time rule bounced it back and burned a whole round trip. Now the agent splits the batch into individual calls before the turn is saved.
Read more
Reverted After 11 Hours: Why Hermes Approval Prompts Keep a Deadline
The change that made approval prompts wait for you forever was rolled back the same night it merged — not out of indecision, but because it deadlocked a session that has nobody to answer. Here is the timeline and what actually applies now.
Read more
One commit, three silent failures: backup deleted the wrong file, JSON written wrong, quotes flattened
A negative keep deletes your newest backup, a write slips in NaN, and replace_all flattens smart quotes to ASCII — three bugs that all returned success while doing the wrong thing. PR #130619 fixes all three.
Read more
The approval prompt that used to vanish mid-coffee now waits for you
Hit approvals.timeout and the prompt expired, silently denying the command — you were just in a meeting. PR #130167 keeps CLI, TUI and Desktop prompts open until you answer or interrupt the turn, while messaging platforms keep their 300-second deadline.
Read more