feat(secrets): pluggable SecretSource interface + Bitwarden & 1Password providers by teknium1 · Pull Request #59498 · NousResearch/hermes-agent

teknium1 · 2026-07-06T08:45:32Z

Summary

Secret managers now plug into one orchestrated interface — and this PR ships both first providers: a SecretSource ABC + registry replaces the Bitwarden-hardcoded path in env_loader, Bitwarden is converted onto it (zero behavior change), and 1Password lands as the reference mapped source (salvaged from @hwrdprkns' #36896 with authorship preserved). Multiple vaults can be enabled simultaneously with deterministic precedence, conflict warnings, and per-var provenance.

Motivation

Six competing 1Password PRs (#32254, #36896, #38569, #39445, #45439, #51462, #55055) plus Vaultwarden (#42300), Infisical (#33316), Proton Pass (#34393), command-source (#44509), and a plugin-hook proposal (#38406) — each reinventing cache, env-apply, precedence, and CLI wiring. Per the AGENTS.md rubric ("3+ PRs integrating the same category → design an ABC + orchestrator"), this establishes the shared interface and turns the cleanest contributor implementation into the reference provider, mirroring the March 2026 memory-provider consolidation.

Changes

Interface (ours)

agent/secret_sources/base.py (new) — SecretSource ABC (fetch-only contract: never raises, never prompts, sync with enforced timeout), ErrorKind taxonomy, shared FetchResult, run_secret_cli() (minimal allowlisted child env, argv-only, ANSI-scrubbed, stdin=devnull), SECRET_SOURCE_API_VERSION gate.
agent/secret_sources/registry.py (new) — registration gating (name/scheme uniqueness, api_version, shape) + apply_all() orchestrator: mapped sources (explicit VAR→ref) beat bulk sources (project dumps); within a shape secrets.sources order, first claim wins; cross-source conflicts always warned; override_existing beats .env but never another source's claim; protected bootstrap tokens; per-source wall-clock timeout; per-var provenance.
hermes_cli/env_loader.py — startup path drives the orchestrator; provenance labels resolve through the registry.
hermes_cli/plugins.py — PluginContext.register_secret_source() for external backends (bundled set closed, mirroring memory-provider policy).
tests/secret_sources/ (new) — registry/precedence/timeout/containment suite + reusable SecretSourceConformance kit, run against both bundled sources.

1Password (salvaged from #36896, @hwrdprkns — 4 commits cherry-picked, authorship preserved)

agent/secret_sources/_cache.py — contributor's shared DiskCache substrate (atomic 0600 writes, 0700 cache dir, TTL-gated read AND write); Bitwarden migrated onto it; FetchResult/is_valid_env_name canonicalized in base.
agent/secret_sources/onepassword.py — op:// ref validation, per-ref op read (argv + -- terminator, minimal allowlisted child env incl. OP_SESSION_*, auth fingerprinted into cache key — token never on disk), empty-value rejection, complete-pull-only caching.
hermes_cli/onepassword_secrets_cli.py — hermes secrets onepassword {setup,status,set,remove,sync,disable} (aliases op, 1password).
.op.env bootstrap auto-load + credential-pool resolved-vs-raw op:// precedence (contributor's follow-up fixes for cron/launchd/Docker).
Docs: website/docs/user-guide/secrets/onepassword.md + multi-source semantics in index.md.

Adapter (ours, follow-up commit)

OnePasswordSource (shape=mapped, scheme=op) registered as a builtin — explicit op:// bindings outrank bulk Bitwarden dumps on contested vars; ErrorKind classification for op failures; registry + conformance coverage incl. the dual-vault contested-var test.

Validation

	Result
`tests/secret_sources/` (new, incl. both conformance runs)	all pass
1Password suite (#36896's tests) + Bitwarden + env_loader + op-bootstrap + secrets CLI + config	291 pass, 0 fail
Dual-vault E2E (real imports, temp HERMES_HOME, fake `op` + `bws` binaries as real subprocesses)	mapped-beats-bulk on contested var ✓, both tokens protected ✓, minimal-env asserted inside the `op` child ✓, `--` terminator asserted ✓, provenance + labels ✓
ruff on all touched files	clean

Credit: @hwrdprkns (1Password implementation, #36896 — cherry-picked with authorship preserved). @tsaiDavid's #32254 was the earliest 1Password submission; #38406 (@firestrife23) proposed the plugin-hook direction. All competing PRs will be closed with credit pointers after merge.

Infographic

alt-glitch · 2026-07-06T09:05:09Z

This was generated by AI during triage.

Related: this is the consolidation ABC for the secret-source cluster — #30649 (Proton Pass request), #57062 (script/exec source), #42300 (Vaultwarden), #42193 (Apple Keychain), plus the open 1Password PRs (#32254, #36896, #38569, #39445, #45439, #51462, #55055). Per the AGENTS.md "3+ integrations → design an ABC" rubric, these can build on this shared SecretSource contract. Flagging the cluster for a maintainer to sequence.

…trator Introduces a first-class secret-source contract so password managers (Bitwarden today, 1Password next, third-party vaults as plugins) plug into one orchestrated startup path instead of each hardcoding into env_loader. - agent/secret_sources/base.py: SecretSource ABC (fetch-only contract: never raises, never prompts, sync with orchestrator-enforced timeout), shared ErrorKind taxonomy, FetchResult, run_secret_cli() minimal-env subprocess helper, API versioning for plugin compatibility. - agent/secret_sources/registry.py: registration gating (name/scheme uniqueness, api_version, shape), apply_all() orchestrator owning precedence (mapped-beats-bulk, first-claim-wins, override_existing never crosses sources, protected bootstrap tokens), conflict warnings, per-var provenance, per-source wall-clock timeout. - Bitwarden converted to a registered BitwardenSource (bulk shape); behavior unchanged, apply_bitwarden_secrets kept as legacy shim. - env_loader._apply_external_secret_sources now drives the orchestrator; provenance labels resolve through registry (e.g. '(from 1Password)'). - PluginContext.register_secret_source() for external backends. - secrets.sources optional ordering key in DEFAULT_CONFIG + example. - tests/secret_sources/: 47 new tests incl. reusable conformance kit (SecretSourceConformance) that plugin authors run against their source.

…ources Pull the disk-cache + FetchResult substrate out of bitwarden.py into a new agent/secret_sources/_cache.py: FetchResult, CachedFetch, is_valid_env_name, and a generic DiskCache (atomic mkstemp -> chmod 0600 -> os.replace write, 0700 cache dir, TTL-gated read AND write). Bitwarden now consumes it via a module-level DiskCache instance and thin wrappers, so the security-sensitive atomic-write/0600/TTL logic lives in exactly one place instead of being copy-pasted per backend (and drifting). Behavior is unchanged — the full Bitwarden suite passes untouched. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Resolve provider credentials from 1Password op://vault/item/field references at startup via the official `op` CLI, alongside the existing Bitwarden source. Users map env-var names to references in secrets.onepassword.env; after .env loads, each is resolved with `op read` and injected into os.environ. Auth is whatever `op` already uses (service-account token or desktop/interactive session) — Hermes never authenticates or installs `op` itself. Startup-safe and fail-open: a missing binary, expired auth, a bad reference, or an empty value each warn and fall back to existing credentials, never blocking startup. Successful, complete pulls are cached in-process and on disk (<hermes_home>/cache/op_cache.json, 0600) via the shared DiskCache; only secret values are stored, never the token (auth is fingerprinted into the key). Adds `hermes secrets onepassword {setup,status,set,remove,sync,disable}` (aliases op/1password), config defaults, the cli-config example, docs, and hermetic tests. Hardening applied across both backends in env_loader: each source runs in its own guard, config sections are coerced to dict, and cache_ttl_seconds is coerced defensively — so a malformed secrets: section can't abort startup. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…ord CLI Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

The 1Password secret source resolves op:// references using OP_SERVICE_ACCOUNT_TOKEN read from os.environ. Under systemd the gateway gets that token via EnvironmentFile, but cron jobs, subprocesses, CLI runs, macOS launchd, and Docker containers spawn fresh interpreters with no inherited shell state — so they silently failed to resolve any reference and fell back to empty strings. Two patches close the gap, matching Bitwarden's reliability guarantees: 1. env_loader: auto-load ~/.hermes/.op.env after .env so the gitignored bootstrap token is available everywhere. override=False plus an explicit guard ensure it never clobbers a token already in env (e.g. from a systemd EnvironmentFile, which keeps precedence). 2. credential_pool: _get_env_prefer_dotenv() now prefers the resolved value in os.environ when .env still holds a raw op:// reference, instead of handing a URL to provider auth. Non-op:// values keep the existing .env-takes-precedence behaviour. Also gitignore .op.env, document the three bootstrap-token options, and add tests covering auto-load, no-override, and the resolved-vs-raw precedence (plus regression guards). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

@hwrdprkns

Follow-up on the cherry-picked #36896 commits, wiring 1Password into the new registry as the reference *mapped* source: - OnePasswordSource adapter (shape=mapped, scheme=op): fetch-only — precedence, override semantics, conflict warnings, and env writes move to the orchestrator; apply_onepassword_secrets kept as legacy shim like Bitwarden's. - Registered in _ensure_builtin_sources; mapped op:// bindings now outrank bulk Bitwarden project dumps on contested vars. - _cache.py FetchResult/is_valid_env_name re-exported from base so there is exactly one canonical definition; bitwarden.py re-adapted onto the contributor's DiskCache substrate. - ErrorKind classification for op failures (auth/binary/empty/network). - Registry + conformance coverage for OnePasswordSource, incl. the headline multi-source test: both vaults claim the same var, mapped 1Password wins, conflict surfaced, provenance correct. - env_loader tests migrated off the legacy apply_* mocks onto the fetch layer; AUTHOR_MAP entry for @hwrdprkns.

…ation for 1Password page - New developer-guide/secret-source-plugin.md: SecretSource contract (never raises/prompts, fetch-only, timeout budget), framework-vs-plugin ownership table, mapped-vs-bulk shape guidance, run_secret_cli() subprocess-safety, registration + timing note, conformance kit usage, ErrorKind reference. - Register user-guide/secrets/onepassword in the sidebar (page shipped in #59498 but was not listed, so it was unreachable from nav). - Cross-link the user-guide plugin section to the new dev guide.

…e + 1Password sidebar fix (#59613) * docs(secrets): secret-source plugin developer guide + sidebar registration for 1Password page - New developer-guide/secret-source-plugin.md: SecretSource contract (never raises/prompts, fetch-only, timeout budget), framework-vs-plugin ownership table, mapped-vs-bulk shape guidance, run_secret_cli() subprocess-safety, registration + timing note, conformance kit usage, ErrorKind reference. - Register user-guide/secrets/onepassword in the sidebar (page shipped in #59498 but was not listed, so it was unreachable from nav). - Cross-link the user-guide plugin section to the new dev guide. * docs: group all plugin guides under a Plugins subcategory in Extending - Move guides/build-a-hermes-plugin.md -> developer-guide/plugins/index.md (both locales) and make it the category landing page (slug pinned to /developer-guide/plugins). - New sidebar subcategory Developer Guide > Extending > Plugins holding the general guide + all 8 provider-plugin docs (llm-access, memory, context-engine, secret-source, model, image-gen, video-gen, web-search); provider-doc URLs unchanged. - Client redirect /guides/build-a-hermes-plugin -> /developer-guide/plugins. - Update 30 cross-links across both locales.

…e + 1Password sidebar fix (NousResearch#59613) * docs(secrets): secret-source plugin developer guide + sidebar registration for 1Password page - New developer-guide/secret-source-plugin.md: SecretSource contract (never raises/prompts, fetch-only, timeout budget), framework-vs-plugin ownership table, mapped-vs-bulk shape guidance, run_secret_cli() subprocess-safety, registration + timing note, conformance kit usage, ErrorKind reference. - Register user-guide/secrets/onepassword in the sidebar (page shipped in NousResearch#59498 but was not listed, so it was unreachable from nav). - Cross-link the user-guide plugin section to the new dev guide. * docs: group all plugin guides under a Plugins subcategory in Extending - Move guides/build-a-hermes-plugin.md -> developer-guide/plugins/index.md (both locales) and make it the category landing page (slug pinned to /developer-guide/plugins). - New sidebar subcategory Developer Guide > Extending > Plugins holding the general guide + all 8 provider-plugin docs (llm-access, memory, context-engine, secret-source, model, image-gen, video-gen, web-search); provider-doc URLs unchanged. - Client redirect /guides/build-a-hermes-plugin -> /developer-guide/plugins. - Update 30 cross-links across both locales.

* chore(release): map author emails for PR #56854/#57417 salvage * test(gateway): pin source.profile=None on MagicMock fixtures hitting _adapter_for_source The routing sweep sends these paths through _adapter_for_source, which reads source.profile. A bare MagicMock auto-attribute is truthy, so the fixtures looked like stamped secondary profiles and hit the new fail-closed branch. Real SessionSource.profile is None or str (AGENTS.md pitfall #17). * test(gateway): pin random tip in topic-mode /new test to kill 1-in-380 flake (#59380) test_group_new_keeps_existing_reset_semantics_when_dm_topic_mode_enabled asserts 'parallel work' not in the /new reply — but /new appends a random tip from hermes_cli.tips (380 entries), and one tip's text contains exactly that phrase (the delegate_task concurrency tip). CI failed on PR #59331 slice 2 when the dice landed on it. Pin get_random_tip in the test. * fix(gateway): isolate multiplex profile config env reads Fixes #50051 by preserving nested gateway.multiplex_profiles and routing gateway config env reads through the active profile secret scope when present. This keeps secondary profile adapter startup from inheriting default-profile platform tokens or port-binding enables while preserving legacy single-profile behavior outside a scope. Constraint: latest upstream main f57ff7aef1d3 still reproduced both nested-config loss and cross-profile env leakage Rejected: special-casing API_SERVER_* only | left other profile-scoped tokens vulnerable to the same leak Confidence: high Scope-risk: moderate Directive: keep future gateway/config env reads on the scoped helper path unless a variable is explicitly process-global Tested: pytest -q tests/gateway/test_multiplex_phase0.py tests/gateway/test_multiplex_credential_isolation.py tests/gateway/test_config.py -k 'multiplex or scope or getenv or api_server or relay' Not-tested: full gateway startup across live platform adapters * feat(sessions): full filter surface for prune + bulk archive subcommand (#59327) * feat(sessions): full filter surface for prune + new bulk archive subcommand hermes sessions prune previously only supported --older-than N (integer days) and --source — no way to target a window like 'the last 5 hours' (e.g. a batch of CI smoke-test sessions), and no non-destructive option. - SessionDB.prune_sessions gains keyword filters that AND together: started_before/started_after epoch bounds, title_like, end_reason, cwd_prefix, min/max_messages, archived tri-state. Default call is byte-for-byte compatible (90-day cutoff, ended-only, source). - New SessionDB.list_prune_candidates (backs --dry-run + confirmation previews) and SessionDB.archive_sessions (bulk soft-hide via the existing set_session_archived lineage-aware path; nothing deleted). - CLI: prune gains --newer-than/--before/--after (durations like 5h/2d/1w, bare days, or ISO timestamps), --title, --end-reason, --cwd, --min/--max-messages, --include-archived, --dry-run. New 'hermes sessions archive' takes the same filters, requires at least one, and is idempotent. Both show a preview before confirming. - Dashboard /api/sessions/prune accepts the same filters + dry_run. - Docs: sessions.md + cli-commands.md updated. Filter parsing lives in hermes_cli/session_filters.py with unit tests; DB filters covered in tests/test_hermes_state.py. * feat(sessions): prune/archive filters for model, provider, user, chat, branch, tokens, cost, tool calls Extends the prune/archive filter surface to everything identifiable in the sessions table: - --model (substring on model slug), --provider (exact on billing_provider, case-insensitive), --user, --chat-id, --chat-type (exact), --branch (substring on git_branch), --min/--max-tokens (input+output), --min/--max-cost (USD, actual_cost_usd falling back to estimated_cost_usd), --min/--max-tool-calls. - SessionDB prune/archive/list_prune_candidates now share the filter kwargs via **filters into _prune_filter_where (unknown names raise TypeError); candidates listing + CLI preview now include the model. - Any attribute filter (except legacy --source) suppresses the implicit 90-day default so 'prune --model X' matches all ages. - Dashboard /api/sessions/prune passes the new fields through. - Docs + tests updated (7 new DB tests, 3 new parser tests). * fix(gateway): read multiplex_profiles from nested gateway section load_gateway_config() only surfaced the top-level `multiplex_profiles` key into gw_data before calling GatewayConfig.from_dict(). A config.yaml that pinned the flag under the nested `gateway:` section -- the form written by `hermes config set gateway.multiplex_profiles true` -- was silently ignored, so the gateway loaded with multiplex_profiles=False. from_dict() already honors the nested fallback, but load_gateway_config() builds gw_data from top-level keys first, so the nested value never reached it. Read gateway.multiplex_profiles into gw_data when the top-level key is absent, mirroring the existing nested fallback for max_concurrent_sessions. Adds a load_gateway_config() regression test that writes a config.yaml with `gateway.multiplex_profiles: true` and asserts the loaded config has multiplex_profiles=True (fails without the fix). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(skills): don't request Brotli for the centralized skills index The Skills Hub 'Browse Hub' landing page and index-backed search render empty on fresh deployments (e.g. Fly.io VPS agents) with no stale cache. Root cause: the centralized index at /docs/api/skills-index.json is a large body (~34MB, tens of MB compressed) served with Content-Encoding: br. httpx's streaming Brotli decoder — backed by brotlicffi 1.2.0.1, which is pinned so aiohttp can decode Discord attachments — trips over its own output_buffer_limit on a payload this size and raises: DecodingError("brotli: decoder process called with data when 'can_accept_more_data()' is False") _load_hermes_index() catches that (DecodingError is an httpx.HTTPError subclass) and silently falls back to the on-disk cache. On a fresh box that cache never existed, so HermesIndexSource.is_available is False, the index contributes 0 skills, and the hub landing page — which is built solely from an empty-query index search — is blank. Existing installs only appear to work because they serve a (possibly weeks-)stale cached index instead. Fix: request 'gzip, deflate' on the index fetch so httpx never negotiates the broken Brotli path, and retry once with 'identity' if a DecodingError still occurs (defends against a proxy that ignores the header). Falls through to the stale cache only when both attempts fail. Verified on a live staging VPS agent: index_available flips False->True and the featured landing list repopulates from 0 to 12. Also un-freezes already-deployed images: skills added after an image was built (e.g. the 'unbroker' optional skill) become reachable again via the index, which is the whole point of the centralized catalog. * feat(sessions): any prune filter matches all ages; preview shows age span (#59415) Bare 'hermes sessions prune' keeps the historical 90-day default, but any filter — now including --source — suppresses the implicit cutoff, so 'prune --source cron' targets ALL cron sessions instead of silently only those older than 90 days (the surprise a user hit live: 'No sessions match ... source cron' despite plenty of recent cron runs). - CLI preview + confirmation now show the match count plus the oldest and newest matching session start times before deleting. - Dashboard /api/sessions/prune mirrors the semantics: attribute filters without an explicit older_than_days match all ages (model_fields_set distinguishes an explicit 90 from the Pydantic default); dry_run responses gain oldest_started_at/newest_started_at. - Docs + argparse help updated; tests for both surfaces. * fix: reject stale one-shot cron jobs * fix(cron): guard update_job past-one-shot + enrich rejection message (#59395) Widen the #59395 fix to the sibling site: update_job's schedule-change path (cron/jobs.py) had the SAME unguarded compute_next_run -> next_run_at pattern, so updating a job's schedule to a one-shot >ONESHOT_GRACE_SECONDS in the past would re-create the ghost job (next_run_at=None, state='scheduled', never fires) that create_job now rejects. Apply the identical guard on update (raise before any disk write, so the original job is left intact), with regression tests for the reject + future-accept cases. Also surface ONESHOT_GRACE_SECONDS in the raised ValueError (not just the warning log) so a caller knows how far in the past is too far. Message from the competing PR #59410 by @isheng-eqi. Co-authored-by: isheng-eqi <265044697+isheng-eqi@users.noreply.github.com> * perf(cli): TTFT round 2 — live reasoning by default, partial-line streaming, prompt-build cache, stale budget-warning docs (#59389) Follow-up to #59332 targeting the remaining PERCEIVED first-token latency (the wire streaming was already per-token; these fix what the user sees): 1. display.show_reasoning default ON. On thinking models the reasoning phase streams for tens of seconds; with the display off users stare at a spinner the whole time and read it as a stall. Flipped in DEFAULT_CONFIG, load_cli_config defaults, tui_gateway raw-YAML fallbacks, and the hermes setup status line (all four read sites kept in sync). Gateway per-platform defaults intentionally stay off — messaging chats shouldn't fill with thinking text. /reasoning hide still turns it off and persists. 2. Response box force-flushes long partial lines. _emit_stream_text only painted on newline, so a response opening with a long paragraph stayed invisible until the first \n — seconds of blank box. Now partial lines wrap at terminal width and paint as tokens arrive (mirrors the reasoning box's 80-char force-flush that existed since day one). Table blocks remain batch-aligned; no content loss at wrap boundaries (regression tests added). 3. hermes_time timezone resolution uses read_raw_config (mtime-cached + libyaml C loader) instead of a raw yaml.safe_load of config.yaml (~110-140ms measured) inside the FIRST system prompt build. First build drops 320ms -> ~155ms on a 200-skill install. 4. Stale docs: configuration.md (en+zh) still documented the 70%/90% [BUDGET WARNING] tool-result injections. Those were removed in April 2026 (c8aff7463) precisely because they hurt task completion; current behavior is exhaustion-message + one grace call, no mid-loop injection, no cache impact. Docs now describe reality. Verified: token-count compression decisions already use API-reported last_prompt_tokens (rough estimators are preflight-only and cost ~1.7ms even on 1.7MB histories — not worth touching). * fix(cron): reject past one-shot timestamps in update_job fallback + resume_job (#59395) Completes the #59395 bug-class fix. create_job and update_job's schedule-change path already reject past one-shots (via #59410/#59438); this closes the two remaining doors that stored next_run_at=None for a 'once' schedule and re-created the silent ghost job: 1. update_job fallback-recompute (the safety-net that re-derives next_run_at when it's missing on an enabled, non-paused job) 2. resume_job (resuming a paused one-shot whose time has already passed — empirically confirmed to create a scheduled job that never fires) The redundant update_job schedule-change hunk from the original PR was dropped (already on main via #59438). Adds resume-reject + update-reject/ accept regression tests. Salvaged from #59428 by isheng-eqi. * chore: map isheng-eqi in AUTHOR_MAP for #59428 salvage check-attribution CI fails on unmapped bare (non-noreply) contributor emails. isheng-eqi's commit email (ishengeqi@163.com) has no + so it does not auto-resolve — add the explicit mapping. * fix(file-sync): re-deliver deferred Ctrl+C via raise_signal, not os.kill (Windows hard-kill) _sync_back_once defers a SIGINT that lands mid-sync, then re-delivers it once the sync completes so the user's Ctrl+C isn't lost. It did so with os.kill(os.getpid(), signal.SIGINT). That is not graceful on Windows: os.kill only treats CTRL_C_EVENT(0)/CTRL_BREAK_EVENT(1) as console events; any other value (SIGINT == 2) routes to TerminateProcess(sig), so a Ctrl+C during a remote-backend (ssh/daytona/modal) sync-back hard-kills the whole CLI session (exit code 2) on Windows instead of raising KeyboardInterrupt. Use signal.raise_signal(signal.SIGINT) (3.8+), which invokes the restored handler through C raise() on every platform. Verified on Windows: raise_signal runs the handler (graceful) while os.kill(getpid, SIGINT) TerminateProcess-es the process. Adds a cross-platform regression test that runs on Windows too (it stubs the locked sync body, so unlike test_file_sync_back.py it needs no fcntl). * fix(error-classifier): retry HTTP 408 as timeout instead of aborting as format_error _classify_by_status() routes every other transient HTTP status to a retryable reason (500/502 -> server_error, 503/529 -> overloaded, 429 -> rate_limit, 413 -> payload_too_large), but 408 Request Timeout fell through to the generic `400 <= status < 500` branch and was classified as a non-retryable format_error -- the same bucket as a 400 Bad Request. A 408 is a transient timing failure the server itself flags as safe to retry (RFC 9110 15.5.9), not a malformed request, so the retry loop aborted the turn when a simple retry would recover. Common trigger: a reverse proxy in front of a self-hosted backend (llama.cpp / Ollama / vLLM) returns 408 when a long generation outruns the proxy's request-read window. Route 408 to the existing FailoverReason.timeout (rebuild client + retry). Add a regression test plus a boundary test asserting 400 stays non-retryable. * test(error-classifier): 408 boundary coverage — Copilot user_request_timeout shape, never auto-compress, falsification guard Folded from PR #56932 (@allenliang2022) — same fix as #56909, submitted 45min later; the test coverage was the richer half. * chore: map allenliang2022 in AUTHOR_MAP for #56932 test fold-in * test(cron): cover cron_list/status/tick/create CLI helpers Salvaged from #40430; re-verified on main, tightened, tested. Co-authored-by: xuezhaolan <xuezhaolan@users.noreply.github.com> * fix(web): use get_env_value for Firecrawl config resolution The Firecrawl provider used os.getenv() to read FIRECRAWL_API_KEY and FIRECRAWL_API_URL, which only checks the process environment. When values are supplied through Hermes's ~/.hermes/.env config mechanism (via hermes_cli.config.get_env_value), they are not guaranteed to be present in os.environ for every gateway/tool execution path. Switch to get_env_value() which checks both os.environ and the .env file, matching the pattern used by other providers (nous_subscription, setup, discord adapter). Fixes #40190 * fix(web): widen config-aware env resolution to exa/parallel/tavily/brave-free providers Same bug class as #40190: these providers read credentials via bare os.getenv(), so keys stored in ~/.hermes/.env (hermes config layer) were invisible in execution paths that never exported them into the process environment. Add get_provider_env() on the WebSearchProvider module as the shared config-aware lookup (get_env_value with os.getenv fallback) and route all credential reads through it. SearXNG already did this (#34290); Firecrawl fixed in the preceding cherry-picked commit by @liuhao1024. * fix(skills): apply disabled-skill gate to CLI/TUI preloaded skills build_preloaded_skills_prompt() (hermes -s <skill>, and tui_gateway's HERMES_TUI_SKILLS deployment env var) loads skills via _load_skill_payload() with a raw identifier, bypassing get_skill_commands()' scan-time disabled filter entirely. Result: a skill an operator disabled via skills.disabled still gets force-loaded and injected into every session — including every session on a shared tui_gateway deployment where the operator set HERMES_TUI_SKILLS. The bundle-invocation path (#59156) already re-checks get_disabled_skill_names() for exactly this reason; preloaded-skill loading was the other _load_skill_payload call site still missing it. Fix: check each resolved skill's name (and raw identifier) against get_disabled_skill_names() before injecting it. A disabled skill is now reported the same way an unknown one already is (skipped, listed in the returned missing_identifiers) — no return-shape or caller changes needed. No behavior change when no skill is disabled. * fix(cli): pass custom_providers to resolve_display_context_length (#59314) The CLI model-switch display (both picker and direct-switch paths) omitted the custom_providers keyword when calling resolve_display_context_length(). The function already supports it (and the gateway correctly passes it), but the CLI call sites relied on the fallthrough to probe-down default (256K) even when a custom_providers entry specified a per-model context_length. Fix: pass agent._custom_providers at both resolve_display_context_length call sites in HermesCLI._apply_model_switch_result(), matching the pattern already used for config_context_length. * fix(gateway): relax session_key traversal guard to allow interior '/' (#59322) The CWE-22 traversal guard in SessionEntry.from_dict rejects any interior '/' in session_key, but session_key is a logical routing key (never used as a filesystem path) and Google Chat resource names legitimately contain '/' (spaces/<id>, spaces/<id>/threads/<id>). All Google Chat sessions were silently dropped on gateway start. Split the validation: session_id keeps the strict _is_path_unsafe guard (it's the value used as a filename); session_key now uses a relaxed _is_session_key_unsafe helper that only blocks genuine traversal vectors (parent-dir '..', leading '/', leading '\', leading Windows drive-letter prefix) and allows interior '/'. * fix(tui_gateway): honor launch profile terminal.cwd for dashboard chat Dashboard /chat for the default (launch) profile attaches to the dashboard process's in-memory TUI gateway. The Node PTY child receives a bridged TERMINAL_CWD env var, but the in-memory gateway process does not, so cwd resolution fell through to os.getcwd() (wherever `hermes dashboard` was launched) and ignored the configured terminal.cwd. Read the launch profile's config.yaml directly in the in-memory cwd resolution: a configured terminal.cwd now wins over a stale process env and the launch directory. Widened to the resume/fallback session-cwd sites (not just _completion_cwd) via a shared _default_session_cwd() helper so fresh AND resumed sessions honor the config. Co-authored-by: ygd58 <buraysandro9@gmail.com> * fix(cron): prevent double-execution of one-shot jobs across concurrent schedulers When two scheduler processes (gateway + desktop) run concurrently, both could pick up the same one-shot job from get_due_jobs() because its next_run_at was not advanced before execution started — only recurring jobs were advanced (L3446). This caused duplicate deliveries and wasted token spend (#59229). Now _get_due_jobs_locked advances a one-shot's next_run_at by 60s before returning it as due, persisted immediately under the same file lock. mark_job_run re-anchors next_run_at on completion, so a tick death between advance and execution only delays the job by one tick window — it is never lost. Closes #59229 * chore: credit isheng-eqi for #59446 in AUTHOR_MAP * fix(cron): durable run-claim for one-shots instead of a fixed +60s advance The +60s next_run_at advance only delayed a duplicate one-shot dispatch by one tick — a job that outlives the 60s tick interval (the reported 2.5-min research prompt) still re-fired on the next tick after the window expired, so the concurrent gateway+desktop double-delivery persisted. Replace it with a durable run_claim (at+by, mirroring fire_claim) stamped on the one-shot under the same jobs lock get_due_jobs holds, and checked at the top of the due-scan: a fresh claim held by an in-flight run makes every other scheduler process skip the job for its ENTIRE run, not one tick. mark_job_run() clears the claim on completion; a ONESHOT_RUN_CLAIM_TTL (30 min) safety valve re-dispatches a claim left by a tick that died mid-run so a one-shot is never wedged. E2E: long-running one-shot no longer double-fires at +28/+61/+120/+179s; completion clears the claim + disables the job; crash recovery re-arms past the TTL. +3 regression tests. * fix(dashboard): accept HA ingress prefix paths Allow mainstream reverse-proxy path mounts to keep their X-Forwarded-Prefix when Home Assistant Supervisor ingress already consumes nearly the old 64-character budget. Keep validation bounded and keep rejected non-empty prefixes diagnosable with a deduplicated warning. Constraint: HA Supervisor ingress prefixes are 63 chars before add-on subpaths, so the old 64-char cap dropped valid dashboard deployments. Rejected: remove the length cap entirely | a bounded header budget is still a conservative validation guard. Confidence: high Scope-risk: narrow Directive: Keep prefix validation centralized in hermes_cli.dashboard_auth.prefix so auth routes, cookies, and SPA asset rewriting agree. Tested: python probe for the 73-char HA ingress prefix; scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_prefix.py -q; .venv/bin/python -m pytest tests/hermes_cli/test_web_server.py -k 'spa_assets_are_read_as_utf8' -q; python -m ruff check hermes_cli/dashboard_auth/prefix.py tests/hermes_cli/test_dashboard_auth_prefix.py; git diff --check Not-tested: full test suite * fix(mcp): sanitize server names for auth env keys Server names with non-env-safe characters (dots, slashes, spaces) produced invalid env-var keys like MCP_MY.SERVER_API_KEY or MCP_GITHUB/MCP_API_KEY, breaking .env writes and ${VAR} header substitution. _env_key_for_server now replaces any character outside [A-Za-z0-9_] with an underscore. Co-authored-by: Hermes Agent <agent@nousresearch.com> * fix telegram explicit private thread routing * fix(background-review): guard summarize against list-shaped tool responses (#59437) `summarize_background_review_actions` was structured on the assumption that every parsed tool response is a fully-typed dict-of-fields. In practice the memory/skill tools — and their wrappers over Mem0 OSS and the skill_manage MCP server — sometimes serialize `_change` as a list or scalar, and clamp `operations` to a single string when the field came in via a partial JSON bridge. The original code did the equivalent of: change = data.get("_change", {}) change.get("description", "") so when `_change` was a list the inner .get crashed with `AttributeError: 'list' object has no attribute 'get'`, every ~10 turns the user saw the entire background review collapse. Three defensive guards in summarize_background_review_actions: - `call_details.get(tcid, {})` → `call_details.get(tcid) or {}` plus `isinstance(detail, dict)` coercion. Catches stale scalar/None values when a fork inherits partial state from a stale tool_call_id. - `operations = detail.get("operations") or []` → `isinstance(ops_raw, list)` coerce, then per-entry isinstance check before `.get()`. Skips non-dict items without raising; an entire surrounding review no longer goes down because one entry was malformed. - `change = data.get("_change", {})` → `isinstance(change_raw, dict)` coerce. The originally-reported crash class for skill_manage with list-shaped _change now falls through to the generic summary path. And the caller in `_run_review_in_thread` is wrapped in a try/except that maps any residual summarize exception to `actions = []` and emits a 'partial results' warning, so even an entirely unanticipated shape won't take down the outer review — the user only sees 'Background memory/skill review failed' instead of the prior hard crash that lost every successful action the fork had completed. Tests: tests/test_background_review_list_shapes.py — standalone pytest-free runner, 7/7 PASS: a_change_as_list_does_not_crash (originally-reported shape) a_change_as_int_does_not_crash (scalar fallback) b_operations_as_string_treated_as_empty b_operations_as_none_treated_as_empty c_operations_contains_non_dict_entries (verbose-mode per-entry filter) d_detail_non_dict_replaced_with_empty e_call_defends_via_try_except (structural anchor) Refs NousResearch/hermes-agent#59437 * chore: map Ahmett101 noreply email in AUTHOR_MAP for #59455 * test(tui_gateway): isolate verification.status not_applicable test from stray tmp markers test_verification_status_outside_workspace_is_not_applicable passed tmp_path as the cwd and asserted status == not_applicable, relying on tmp_path having no project-marker ancestor. _marker_root() walks up to ~6 levels, so a stray marker in a shared tmp-root ancestor (e.g. a /tmp/package.json left by another tool) made project_facts_for() resolve tmp_path as a workspace and flip the status to unverified. Green in clean CI, red on any dev box with a polluted /tmp. Force the no-facts precondition by monkeypatching project_facts_for -> None so the test deterministically exercises the not_applicable branch regardless of ambient filesystem state. Test-only; no production change. * fix(gateway): stop post-/stop stale interrupt from silently swallowing the next message A /stop sets _interrupt_requested on the session's cached agent, but the flag is only cleared by the turn finalizer. When the stopped run is hung or still draining, the flag survives the forced lock release and the session's NEXT user message is killed at the top of the tool loop (conversation_loop.py interrupt check): the run completes with interrupted=True, api_calls=0 and an empty response, which _normalize_empty_agent_response passed through as pure silence — the user's message was swallowed with no trace except a 'response ready: ... api_calls=0 response=0 chars' log line. Two-layer fix: - _interrupt_and_clear_session now evicts the cached agent whenever it releases the running state. The next message rebuilds the agent from session history (mirroring the /new and /model paths), while the old agent object keeps its interrupt flag so a hung drain still dies when it unblocks. This intentionally does NOT clear the flag in place: turn_context deliberately preserves a pending interrupt across turn start (it carries interrupt-message delivery), and clearing it could revive a hung run the user just stopped. - _normalize_empty_agent_response distinguishes a drain from a swallowed turn: an interrupted run that did work (api_calls > 0) stays silent as before (deliberate stop/steer; queued messages are delivered by the recursive drain inside _run_agent), but an interrupted run with ZERO api_calls never processed the user's message at all and now surfaces a 'send it again' notice instead of nothing. Same silent-delivery class as a1f76ba7e (#29346), which covered the extract-stripped case; regression tests added next to that coverage. Fixes #44212 * test(gateway): update stale expectation — #31884 surfaces retry hint for uninterrupted zero-call drops The PR predates #31884, which changed the non-interrupted api_calls==0 empty path from silence to a retry hint. Flip the contributed test to assert the current (correct) behavior. * chore: map AIalliAI id-form noreply email in AUTHOR_MAP for #44222 salvage * fix(gateway): drop interrupt sentinel before chat delivery (#7921) * chore: map waseemshahwan in AUTHOR_MAP for #56841 salvage * docs: correct Python support to 3.11-3.13 (#59572) requires-python is >=3.11,<3.14, so '3.11+' was misleading (implied 3.14+ works). Fixed in CONTRIBUTING.md and the docs-site mirror. * fix(web): correct 'disabled plugin' diagnosis for web backends (#59573) When a bundled web provider (firecrawl, tavily, exa, ...) is listed in plugins.disabled, its provider never registers and the web_search/ web_extract dispatchers emitted the misleading "No web extract provider configured. Set web.extract_backend to ..." — even though the backend was configured correctly. The real fix is to re-enable the plugin. - web_tools.py + web_search_registry.py: when the configured backend names a disabled bundled web plugin, both dispatchers now point the user at the actual cause (re-enable the plugin) instead of a wrong config hint. - plugins_cmd.py cmd_enable: enabling by canonical key now also clears the manifest-name alias (web-firecrawl) from plugins.disabled, so the suggested command actually re-enables the plugin ('explicit disable wins' matches on the name too). - plugins_cmd.py cmd_toggle / _run_composite_ui / _run_composite_fallback: the interactive 'hermes plugins' menu now persists the canonical key (web/firecrawl), never the bare manifest name — the drift that put the offending entry in plugins.disabled in the first place. Follow-up to #59518 (which fixed web credential resolution, a different cause). Fixes the disabled-plugin symptom reported after that PR. * refactor(cron): derive one-shot run-claim TTL from HERMES_CRON_TIMEOUT (#59567) Follow-up to #59524. The one-shot running-claim stale-recovery window was a fixed 30-min constant. Derive it from the cron inactivity timeout instead (HERMES_CRON_TIMEOUT, the same limit the scheduler enforces per run) so the safety valve tracks how long a run may actually go quiet: - unset/invalid -> default 600s inactivity -> TTL 1800s (unchanged behaviour) - positive N -> max(N * 3 headroom, 1800s floor) - 0 (unlimited) -> no finite bound -> fall back to the 1800s constant The fixed constant is kept as the floor + unlimited-case fallback. Resolved once per due-scan. HERMES_CRON_TIMEOUT is a pre-existing internal env var (already read by cron/scheduler.py); no new config surface. E2E: with HERMES_CRON_TIMEOUT=1200 the claim now survives to 60min where the old fixed 1800s constant wrongly expired it at 30min mid-run. +1 derivation test; 640/640 cron tests pass. * feat(secrets): pluggable SecretSource interface + multi-source orchestrator Introduces a first-class secret-source contract so password managers (Bitwarden today, 1Password next, third-party vaults as plugins) plug into one orchestrated startup path instead of each hardcoding into env_loader. - agent/secret_sources/base.py: SecretSource ABC (fetch-only contract: never raises, never prompts, sync with orchestrator-enforced timeout), shared ErrorKind taxonomy, FetchResult, run_secret_cli() minimal-env subprocess helper, API versioning for plugin compatibility. - agent/secret_sources/registry.py: registration gating (name/scheme uniqueness, api_version, shape), apply_all() orchestrator owning precedence (mapped-beats-bulk, first-claim-wins, override_existing never crosses sources, protected bootstrap tokens), conflict warnings, per-var provenance, per-source wall-clock timeout. - Bitwarden converted to a registered BitwardenSource (bulk shape); behavior unchanged, apply_bitwarden_secrets kept as legacy shim. - env_loader._apply_external_secret_sources now drives the orchestrator; provenance labels resolve through registry (e.g. '(from 1Password)'). - PluginContext.register_secret_source() for external backends. - secrets.sources optional ordering key in DEFAULT_CONFIG + example. - tests/secret_sources/: 47 new tests incl. reusable conformance kit (SecretSourceConformance) that plugin authors run against their source. * refactor(secrets): extract shared cache/result substrate for secret sources Pull the disk-cache + FetchResult substrate out of bitwarden.py into a new agent/secret_sources/_cache.py: FetchResult, CachedFetch, is_valid_env_name, and a generic DiskCache (atomic mkstemp -> chmod 0600 -> os.replace write, 0700 cache dir, TTL-gated read AND write). Bitwarden now consumes it via a module-level DiskCache instance and thin wrappers, so the security-sensitive atomic-write/0600/TTL logic lives in exactly one place instead of being copy-pasted per backend (and drifting). Behavior is unchanged — the full Bitwarden suite passes untouched. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * feat(secrets): add 1Password (op://) secret source Resolve provider credentials from 1Password op://vault/item/field references at startup via the official `op` CLI, alongside the existing Bitwarden source. Users map env-var names to references in secrets.onepassword.env; after .env loads, each is resolved with `op read` and injected into os.environ. Auth is whatever `op` already uses (service-account token or desktop/interactive session) — Hermes never authenticates or installs `op` itself. Startup-safe and fail-open: a missing binary, expired auth, a bad reference, or an empty value each warn and fall back to existing credentials, never blocking startup. Successful, complete pulls are cached in-process and on disk (<hermes_home>/cache/op_cache.json, 0600) via the shared DiskCache; only secret values are stored, never the token (auth is fingerprinted into the key). Adds `hermes secrets onepassword {setup,status,set,remove,sync,disable}` (aliases op/1password), config defaults, the cli-config example, docs, and hermetic tests. Hardening applied across both backends in env_loader: each source runs in its own guard, config sections are coerced to dict, and cache_ttl_seconds is coerced defensively — so a malformed secrets: section can't abort startup. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(secrets): remove unused masked_secret_prompt import from onepassword CLI Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(secrets): make 1Password bootstrap token reliable outside systemd The 1Password secret source resolves op:// references using OP_SERVICE_ACCOUNT_TOKEN read from os.environ. Under systemd the gateway gets that token via EnvironmentFile, but cron jobs, subprocesses, CLI runs, macOS launchd, and Docker containers spawn fresh interpreters with no inherited shell state — so they silently failed to resolve any reference and fell back to empty strings. Two patches close the gap, matching Bitwarden's reliability guarantees: 1. env_loader: auto-load ~/.hermes/.op.env after .env so the gitignored bootstrap token is available everywhere. override=False plus an explicit guard ensure it never clobbers a token already in env (e.g. from a systemd EnvironmentFile, which keeps precedence). 2. credential_pool: _get_env_prefer_dotenv() now prefers the resolved value in os.environ when .env still holds a raw op:// reference, instead of handing a URL to provider auth. Non-op:// values keep the existing .env-takes-precedence behaviour. Also gitignore .op.env, document the three bootstrap-token options, and add tests covering auto-load, no-override, and the resolved-vs-raw precedence (plus regression guards). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * feat(secrets): adapt 1Password onto the SecretSource interface Follow-up on the cherry-picked #36896 commits, wiring 1Password into the new registry as the reference *mapped* source: - OnePasswordSource adapter (shape=mapped, scheme=op): fetch-only — precedence, override semantics, conflict warnings, and env writes move to the orchestrator; apply_onepassword_secrets kept as legacy shim like Bitwarden's. - Registered in _ensure_builtin_sources; mapped op:// bindings now outrank bulk Bitwarden project dumps on contested vars. - _cache.py FetchResult/is_valid_env_name re-exported from base so there is exactly one canonical definition; bitwarden.py re-adapted onto the contributor's DiskCache substrate. - ErrorKind classification for op failures (auth/binary/empty/network). - Registry + conformance coverage for OnePasswordSource, incl. the headline multi-source test: both vaults claim the same var, mapped 1Password wins, conflict surfaced, provenance correct. - env_loader tests migrated off the legacy apply_* mocks onto the fetch layer; AUTHOR_MAP entry for @hwrdprkns. * fix(interrupt): run user-approved commands from a clean interrupt slate A user-approved terminal/execute_code command could be SIGINT-killed (exit 130 + "[Command interrupted]") by a stale interrupt bit that landed on the execution thread during the blocking approval-wait, while the result still carried the "...approved by the user." note. The terminal tool runs sequentially inline on the execution thread, and nothing cleared or re-checked the bit between approval-grant and env.execute. Clear the current thread's interrupt bit once before an approved command spawns its child (terminal foreground; execute_code local + remote), and enrich the note to "...approved by the user, then interrupted." on a genuine post-start interrupt instead of implying success. A genuine interrupt arriving after execution starts (or during a retry backoff) still SIGINTs the command; non-approved commands keep current behavior. Adds regression tests covering stale-bit-clears, genuine-interrupt-still- kills, the retry-backoff window, natural-exit-130 (not mislabeled), and execute_code local + remote. * chore: map hellno in AUTHOR_MAP for #49033 salvage * feat(oneshot): add --usage-file JSON usage report to hermes -z (#59615) * feat(oneshot): add --usage-file JSON usage report to hermes -z Pipelines driving hermes -z (batch reviewers, cron scripts, eval harnesses) had no way to account for per-invocation spend: the agent computes estimated_cost_usd and full token counts internally, but oneshot mode discards everything except the final response text. - hermes -z PROMPT --usage-file PATH writes a JSON report after the run: estimated_cost_usd, cost_status/source, input/output/cache/ reasoning/total tokens, api_calls, model, provider, session_id, completed, failed. - Written even when the run fails (with a failure field) so callers can always account for spend; the write itself is best-effort and never masks the run's own outcome. - Flag registered in both the full parser and the Termux fast path; added to both value-flag scan sets so profile detection stays correct. Validation: 6 unit tests + live E2E (real -z run produced a report with real OpenRouter cost + token counts). * test: include usage_file kwarg in oneshot dispatch assertions The two dispatch tests assert the exact kwargs dict passed to run_oneshot; the new usage_file kwarg must appear there. * test(desktop): regression-guard fetchJsonViaOauthSession headers (#40069) Closes #40069. Salvaged from #40242; re-verified on main, tightened, tested. Co-authored-by: maxpetrusenkoagent <maxpetrusenkoagent@users.noreply.github.com> * fix(desktop): default HERMES_DESKTOP_CWD to cwd when --cwd omitted Salvaged from #40363; re-verified on main, tightened, tested. Co-authored-by: alex-heritier <alex-heritier@users.noreply.github.com> * feat(banner): size skills display to terminal width instead of fixed 8/47 Salvaged from #40273; re-verified on main, tightened, tested. Co-authored-by: liuhao1024 <liuhao1024@users.noreply.github.com> * feat(plugins): surface entry-point plugins in hermes plugins list Salvaged from #40346; re-verified on main, tightened, tested. Co-authored-by: tjboudreaux <tjboudreaux@users.noreply.github.com> * feat(config): add display.timestamp_format and honor it in CLI timestamps Salvaged from #40303; re-verified on main, tightened, tested. Co-authored-by: pdmartins <pdmartins@users.noreply.github.com> * docs: Plugins subcategory under Extending + secret-source plugin guide + 1Password sidebar fix (#59613) * docs(secrets): secret-source plugin developer guide + sidebar registration for 1Password page - New developer-guide/secret-source-plugin.md: SecretSource contract (never raises/prompts, fetch-only, timeout budget), framework-vs-plugin ownership table, mapped-vs-bulk shape guidance, run_secret_cli() subprocess-safety, registration + timing note, conformance kit usage, ErrorKind reference. - Register user-guide/secrets/onepassword in the sidebar (page shipped in #59498 but was not listed, so it was unreachable from nav). - Cross-link the user-guide plugin section to the new dev guide. * docs: group all plugin guides under a Plugins subcategory in Extending - Move guides/build-a-hermes-plugin.md -> developer-guide/plugins/index.md (both locales) and make it the category landing page (slug pinned to /developer-guide/plugins). - New sidebar subcategory Developer Guide > Extending > Plugins holding the general guide + all 8 provider-plugin docs (llm-access, memory, context-engine, secret-source, model, image-gen, video-gen, web-search); provider-doc URLs unchanged. - Client redirect /guides/build-a-hermes-plugin -> /developer-guide/plugins. - Update 30 cross-links across both locales. * refactor(skills): finish shop-app→shop rename in zh-Hans docs The English-side rename from #38138 already landed on main; this carries the remaining zh-Hans i18n catalog + doc-page rename so the localized docs match the skill's canonical name. * feat(skills): add dynamic-workflow orchestration skill Adapts Claude Code's research-preview dynamic workflows (plan-in-code fan-out, hundreds of subagents per session) to Hermes invariants. The ported mechanic is plan/loop/intermediate-state-out-of-context, not more subagents. Documents the two real orchestration layers and the hard capability boundary between them: - Layer A (execute_code): deterministic fan-out, SANDBOX_ALLOWED_TOOLS only, cannot call delegate_task - Layer B (delegate_task batch): LLM-judgment fan-out Plus the synchronous trap (delegate_task is turn-scoped, cancelled on new message; durable/resumable = kanban swarm) and the genuinely-new piece: the adversarial-convergence verification recipe (N independent attempts with varied framings + M refuters, keep only located claims that survive refutation, iterate to convergence). Self-contained: inlines the load-bearing fan-out hygiene rather than hard-depending on local-only skills; references the shipped kanban swarm subsystem for the durable path. * docs(skills): tighten dynamic-workflow per donovan-yohan review Address all 5 review points against actual delegate_task behavior: - child toolsets are subject to delegate restrictions (leaf strips delegate_task/clarify/memory/send_message/execute_code), not 'full' - durable work has lighter options than kanban (cron one-shot, managed background terminal) for simpler cases - unique per-run /tmp/wf_<name>_<uuid> dir + freshness/count check so a stale interrupted run isn't read as success - note that one delegate_task batch is capped by delegation.max_concurrent_children; large fan-out needs bounded waves - delegate_task exposes no per-task model/profile field (per-task keys are goal/context/toolsets/role); model/profile-scoped runs go via delegation config, cron, kanban, or separate process * feat(curator): add `hermes curator usage` — all-skills usage view Surfaces the usage_report()/provenance() data layer added in #36701 as a user-facing CLI command. Unlike `hermes curator status` (scoped to curator-managed agent-created candidates), `usage` lists every skill on disk — bundled built-ins and hub-installed included — with per-skill use/view/patch counts and an agent/bundled/hub provenance tag. Flags: --sort {activity,recent,name}, --provenance {agent,bundled,hub} filter, --json for machine-readable output. * docs: browser provider plugin guide + complete the plugin routing map (#59817) - New developer-guide/browser-provider-plugin.md: BrowserProvider ABC (session lifecycle, CDP contract, bb_session_id back-compat key, raise/never-raise split between create and close/cleanup), get_setup_schema() hermes-tools integration, discovery, checklist. Closes the one gap in the provider-plugin family — the ABC and ctx.register_browser_provider() existed with zero docs. - Register the page in the Plugins sidebar subcategory. - Extend the routing map on the Plugins landing page (both locales) with the previously missing rows: web-search, browser, secret-source, and dashboard-auth surfaces. * [verified] fix: account for codex replay in compression tail budget * chore: add bigstar0920 to AUTHOR_MAP * fix(ci): make the CI timing report unflakeable (#59818) The 'CI timing report' job is pure observability — it collects per-job/step durations from the GitHub API after the run and publishes an HTML gantt report + PR-vs-main timing diff. It gates nothing (all-checks-pass does not include it), yet it could redden a PR: the script makes dozens of paginated API calls with the shared repo GITHUB_TOKEN and had zero retry handling, so a single 403 (rate-limit burst when several PRs run CI concurrently) failed the job. Observed twice in a row on PR #59805. - api_get(): retry 403/429/5xx and connection errors with exponential backoff, honoring Retry-After / X-RateLimit-Reset (max 5 attempts, 120s cap). Non-transient statuses (404 etc.) still fail fast. - main(): exhausted retries raise TimingsUnavailable, caught to emit a degraded summary line + placeholder HTML artifact and exit 0 — a metrics collector must never fail the PR's checks. No timings JSON is written on the degraded path so an empty baseline can never be cached. - ci.yml: baseline-save steps on main skip gracefully when no JSON exists. Verified with a mocked urlopen harness: retry-then-success (3 attempts), exhausted-retries -> TimingsUnavailable, 404 fails fast without retry, degraded main() exits 0 with summary + placeholder and no JSON, and the --from-json happy path is unchanged. * fix(auxiliary): floor compression timeout so reasoning models don't fall back to marker (#54915) * feat(compression): extend Codex 272K compaction autoraise to gpt-5.4 The ChatGPT Codex OAuth backend caps both gpt-5.4 and gpt-5.5 at a 272K context window, but the autoraise that lifts the compaction trigger to 85% only matched gpt-5.5. On gpt-5.4 the global 50% threshold fired at ~136K — half the usable window — compacting far earlier than necessary. Rename _is_codex_gpt55 -> _is_codex_gpt54_or_gpt55 and match both families. The one-time user notice is now model-aware (shows the actual slug). The config key codex_gpt55_autoraise is kept as-is for backward compatibility. Adds gpt-5.4 coverage to the autoraise tests. * fix(compression): autoraise gpt-5.3-codex-spark threshold to 70% (#48621) gpt-5.3-codex-spark has a native 128K context window but the default 50% compaction trigger fires at ~64K, wasting half the usable window before the session has accumulated enough turns to summarize meaningfully. This raises the trigger to 70% (~90K) on the Codex OAuth route only, leaving ~38K headroom for the summary and continued conversation before the 128K hard limit. The override is not gated by allow_codex_gpt55_autoraise because 128K is the model's native window (unlike gpt-5.5's artificial 272K Codex cap). Non-Codex routes are unaffected. Also adds a boundary regression test verifying the short-session scenario from the issue always yields a non-empty compressible window (no silent context wipe). * fix(compression): keep Codex gpt-5.5 autoraise from lowering a higher threshold The Codex gpt-5.5 compaction autoraise (#40957) overrode the effective threshold unconditionally. If a user had set compression.threshold above 0.85, agent_init dropped them down to 0.85. That wastes usable window and contradicts the feature's whole point: use more of the context, not less. It happened silently too, since the one-time notice is suppressed when the override doesn't raise. The override is an autoraise. It must only raise. Pulled the apply logic into a small pure helper that clamps the Codex case to never lower a higher-or-equal user threshold, and emits the notice only when it actually fires. Other overrides (Arcee Trinity) keep their existing unconditional behavior. Fixes the Codex gpt-5.5 compaction autoraise lowering a user's higher configured threshold. A user on the Codex OAuth route with compression.threshold > 0.85 was silently clamped to 0.85, compacting earlier than they asked and using less of the 272K window the feature was meant to unlock. The autoraise now only ever raises. N/A - [x] 🐛 Bug fix (non-breaking change that fixes an issue) - [ ] ✨ New feature (non-breaking change that adds functionality) - [ ] 🔒 Security fix - [ ] 📝 Documentation update - [ ] ✅ Tests (adding or improving test coverage) - [ ] ♻️ Refactor (no behavior change) - [ ] 🎯 New skill (bundled or hub) - `agent/agent_init.py`: added `_resolve_compression_threshold()`, a pure helper that combines the global threshold with a per-model override. The Codex gpt-5.5 autoraise never lowers a higher-or-equal user threshold; the notice is returned only when it actually raises. Rewired `init_agent` to call it, replacing the unconditional `compression_threshold = _model_cthresh`. - `tests/agent/test_arcee_trinity_overrides.py`: added 5 cases for the helper — raise from default, never-lower regression, equal-is-noop, no-override passthrough, and non-codex (Trinity) unconditional apply. 1. Set `compression.threshold: 0.90` and run gpt-5.5 on provider `openai-codex`. 2. Before: effective threshold drops to 0.85, no notice. After: stays 0.90. 3. Run `scripts/run_tests.sh tests/agent/test_arcee_trinity_overrides.py`. Stash `agent/agent_init.py` and the new cases fail; restore and they pass. - [x] I've read the [Contributing Guide](https://github.com/NousResearch/hermes-agent/blob/main/CONTRIBUTING.md) - [x] My commit messages follow [Conventional Commits](https://www.conventionalcommits.org/) (`fix(scope):`, `feat(scope):`, etc.) - [x] I searched for [existing PRs](https://github.com/NousResearch/hermes-agent/pulls) to make sure this isn't a duplicate - [x] My PR contains **only** changes related to this fix/feature (no unrelated commits) - [x] I've run `pytest tests/ -q` and all tests pass - [x] I've added tests for my changes (required for bug fixes, strongly encouraged for features) - [x] I've tested on my platform: macOS 15 (Darwin 25.5) - [x] I've updated relevant documentation (README, `docs/`, docstrings) — or N/A - [x] I've updated `cli-config.yaml.example` if I added/changed config keys — or N/A - [x] I've updated `CONTRIBUTING.md` or `AGENTS.md` if I changed architecture or workflows — or N/A - [x] I've considered cross-platform impact (Windows, macOS) per the [compatibility guide](https://github.com/NousResearch/hermes-agent/blob/main/CONTRIBUTING.md#cross-platform-compatibility) — or N/A - [x] I've updated tool descriptions/schemas if I changed tool behavior — or N/A * fix(agent): dedupe Codex gpt-5.5 autoraise notice across agent inits The Codex gpt-5.5 compaction-threshold autoraise notice re-fired on every agent init. Because the gateway rebuilds the agent per inbound message, the notice spammed long-running Discord/Telegram/etc. sessions, and the only documented remedy (`compression.codex_gpt55_autoraise false`) disables the useful autoraise behavior itself. Gate both emission surfaces — the CLI startup print and the gateway `_compression_warning` replay — on a persisted per-profile marker under `$HERMES_HOME` (`.codex_gpt55_autoraise_notice`), keyed on the from→to percentages the notice displays. The notice now shows at most once per profile; the autoraise still fires and `codex_gpt55_autoraise: false` still disables it; and a later change to the raised threshold re-notifies once. Docs updated to match. * fix(agent): don't apply Codex gpt-5.5 autoraise notice when an external context engine is active When context.engine selects a plugin engine (e.g. LCM), the host compression threshold — including the Codex gpt-5.5 50% -> 85% autoraise — only configures the built-in ContextCompressor and never reaches the plugin. The autoraise notice still fired, telling the user auto-compaction was raised when nothing actually changed, and the startup context-limit line printed the host percent next to the engine's own threshold_tokens, contradicting itself. - Clear _compression_threshold_autoraised when a plugin engine is selected, suppressing both the CLI startup notice and the gateway turn-1 replay via _compression_warning. - Print the active engine's own threshold_percent in the startup context-limit line so percent and token count agree. - Built-in behavior is preserved, including the fallback path where a configured engine fails to load and the built-in compressor takes over. Fixes #44439 * test: expect model slug in autoraise notice dict (follow-up to gpt-5.4 extension) * chore: add tanmayxchoudhary to AUTHOR_MAP * fix(tui): stop hermes --tui -m from persisting the model globally (#59805) The -m flag seeds HERMES_MODEL/HERMES_INFERENCE_MODEL for the launched TUI process only. But the per-turn config sync (_sync_agent_model_with_config) computed its target via _config_model_target(), which fell back to those env vars whenever config.yaml had no model.default — the normal state for custom-provider-only setups. The sync then replayed the -m model as a /model switch, and with model.persist_switch_by_default (default true) _persist_model_switch wrote model.default/provider/base_url into config.yaml. A one-shot CLI flag became the permanent global model, visible in every new session and every model picker. Two-sided fix: - _config_model_target() no longer falls back to the env seed. Empty model = config expresses no preference = sync is a no-op. The agent keeps the session-scoped -m model; config.yaml edits still sync. - _apply_model_switch() gains persist_override; all three internal callers (config sync, /moa one-shot swap, /moa post-turn restore) pass persist_override=False so session-mechanical switches can never write config.yaml regardless of the persist-by-default setting. User-typed /model keeps its existing flag/config behavior. E2E-verified against an isolated HERMES_HOME with a custom-provider-only config + -m env seed: sync no longer fires, config.yaml byte-identical, _resolve_model() still returns the seed for the session's own agent. * fix(tui): support model picker refresh * fix(tui): probe active custom model provider * fix(tui): keep bare custom model listing stable * fix(web): refresh dashboard model picker * fix(auxiliary): refresh auto-routed provider credentials on 401 Infer the concrete auxiliary auth provider from the selected client base URL so provider:auto routes can refresh Copilot/Codex/Anthropic/Nous credentials after auth errors, instead of skipping refresh because resolved_provider stayed 'auto'. Adds the copilot branch to _refresh_provider_credentials and evicts the stale auto-route cache before retrying. Fixes #20832. Salvaged from PR #20837, reapplied surgically onto current main (branch predated the _retry_same_provider_sync/async extraction). * fix(auxiliary): recover from stale fallback-candidate credentials instead of aborting A fallback candidate can itself carry a stale credential (e.g. an expired ANTHROPIC_TOKEN picked up by _try_anthropic). Its 401 previously propagated out of the fallback call site and aborted the auxiliary task — for compression: a 60s cooldown + context marker while the session kept growing past the context cap. Live case: mattalachia debug dump (Jul 2026), Codex timeout → Anthropic 401 x5 → 296K 'Cannot compress further'. Now each fallback candidate call is wrapped: on auth error, refresh the candidate's provider credentials and retry once; if unrefreshable, mark the provider unhealthy and walk the discovery chain again so the next viable candidate serves. Sync + async paths. Non-auth errors still raise unchanged. * chore: add fanyangCS to AUTHOR_MAP * Revert "docs(skills): tighten dynamic-workflow per donovan-yohan review" This reverts commit 4f008b6412588a54a0e7569bdb9dd07cc537378b. * Revert "feat(skills): add dynamic-workflow orchestration skill" This reverts commit 5e5191b9faeaf2ea6aac64fa5fe6d753fc95e0f0. * fix(agent): run Z.AI overload adaptive backoff on the overloaded path Z.AI Coding Plan GLM-5.2 reports server overload as HTTP 429 code 1305 ("temporarily overloaded"). classify_api_error routes that to FailoverReason.overloaded (so a valid credential pool isn't burned), but the adaptive Z.AI backoff was gated on is_rate_limited — which excludes overloaded — so it never ran (policy=default) and the request failed after a few quick short retries. Two compounding causes, both fixed here: 1. Detect the Z.AI overload 429 directly and let its adaptive backoff run on the overloaded path, not only the rate_limit path. 2. Raise the retry ceiling for this narrow case via zai_coding_overload_retry_ceiling(). The long-backoff tier (30/60/90/120s) starts after short_attempts (3) retries, but the default api_max_retries is also 3, so the loop always gave up before the long tier could run — leaving the whole long-backoff schedule as dead code. Scope is limited to the existing narrow is_zai_coding_overload_error match, so other providers' 429/503/529 handling is unchanged. * test(retry): cover Z.AI overload retry ceiling reachability Assert the invariant that the Z.AI overload retry ceiling exceeds the short-retry threshold (the original bug had them equal, so the long tier was dead code), and walk the attempt range the retry loop actually traverses to prove the full 30/60/90/120s long-backoff schedule now runs. * refactor(retry): single-source Z.AI overload short-attempts + drop change-detector assert Follow-up on the salvage of #59523. Two low-risk cleanups surfaced by review: - Extract _ZAI_CODING_OVERLOAD_SHORT_ATTEMPTS as a module constant so adaptive_rate_limit_backoff() and zai_coding_overload_retry_ceiling() share one source of truth. Previously both hardcoded short_attempts=3 independently; tuning one without the other would silently desync the retry ceiling from the backoff schedule. - Replace the tautological formula-mirroring assert in test_zai_overload_retry_ceiling_exceeds_short_attempts with a behavior invariant (ceiling leaves headroom for every long-backoff entry), per the repo's contracts-over-snapshots testing rule. * fix: fetch Codex quota from credential pool * test: lock Codex usage percent polarity * fix(usage): scope Codex usage pool fallback to AuthError, keep singleton token on account_id read failure Follow-up hardening on the cherry-picked pool-fallback fix. The original _resolve_codex_usage_credentials wrapped BOTH resolve_codex_runtime_credentials() and the separate _read_codex_tokens() account_id read in one broad 'except Exception: pass', which had three problems: 1. A transient refresh/network failure (non-AuthError) from the resolver was silently swallowed and downgraded to pool.select(), which could report /usage limits for a DIFFERENT pool account than the one actually running. On main that error surfaced. This is a real behavior regression for the multi-account/pool case. 2. If the resolver succeeded but only the account_id read raised, the whole singleton tier was abandoned in favor of a pool token that carries no ChatGPT-Account-Id header (PooledCredential has no account_id concept), risking a wrong-account read or 401. 3. 'except Exception' masked genuine programming errors. Fix: narrow the outer catch to AuthError (the documented 'no creds' failure mode of both functions), and read account_id in a best-effort inner try so a partial/missing singleton store can't sink an otherwise-usable credential. Transient errors now propagate and fail open via the outer fetch_account_usage guard rather than mis-routing to the wrong account. Adds debug breadcrumbs and a comment characterizing when the tier-3 pool path actually fires. Guard tests: a non-AuthError resolver failure must NOT swap to the pool (fail-open, no snapshot); an account_id read failure keeps the singleton token. Updated the existing pool-fallback test to use AuthError (the real failure mode) instead of a generic RuntimeError. * chore: map spiky02plateau in AUTHOR_MAP for #32824 salvage The salvaged commits from #32824 use a bare spiky02plateau@users.noreply.github.com (no numeric-id + prefix), which the contributor-check.yml gate does not auto-resolve (it only skips the <id>+<user>@users.noreply form). Add the explicit mapping so attribution CI passes and release notes credit @spiky02plateau. * feat(docker): re-seed a terminally-dead Nous bootstrap session on boot (#59983) The stage2-hook auth.json seed is first-boot-only ([ ! -f auth.json ]) to avoid clobbering rotated refresh tokens on restart. That guard means a container whose Nous bootstrap session took a terminal invalid_grant (tokens cleared, providers.nous.last_auth_error.relogin_required stamped) cannot recover from a restart — it stays unauthenticated until the credential is replaced. Add a self-heal path: an orchestrator that manages the container supplies a freshly-issued session via HERMES_AUTH_JSON_REBOOTSTRAP (distinct from the create-only *_BOOTSTRAP var). On boot, scripts/docker_rebootstrap_nous_session.py swaps ONLY the providers.nous entry, and ONLY when the on-disk entry is provably terminal (quarantine marker + no usable tokens). Healthy/rotating/absent/ unparseable auth.json is always a no-op, so the env is safe to leave set across restarts and never clobbers a good token. Pure stdlib, runs as its own subprocess, always exits 0 so a re-seed error never fails the boot. Reuses the same terminal predicate as get_nous_session_validity() so we re-seed only a session that is genuinely dead. * feat(auth): log forensic detail at Nous quarantine so terminal auth death is visible A NAS-hosted Fly agent's Nous bootstrap session can take a terminal invalid_grant and get quarantined in _quarantine_nous_oauth_state, which clears the dead tokens from auth.json. Until now this quarantine was completely silent: the only signal was a downstream "No access token found" WARNING once the credential pool was already empty, which is too late to root-cause. Because the Fly log drain is WARNING-only, nothing about the terminal death reached centralized logging, and a real incident could not be diagnosed because the evidence was never recorded. Emit a WARNING+ forensic record AT the quarantine point, before the token material is cleared. Fields: refresh_token hash prefix (12-char SHA-256 hex, correlates to NAS's refreshTokenHash), client_id, agent_key_id, error code, reason, auth.json path/size/mtime/exists, and whether the token was already past its own expiry. WARNING level is deliberate — INFO never reaches the Fly drain. Redaction safety (load-bearing): the log dict is built only from computed values (hash prefix, sizes, booleans). No raw refresh_token, access_token, or agent_key bytes are ever passed into the log call, avoiding Hermes's known credential-literal corruption bug class. A test asserts the raw refresh token substring is absent from all emitted log output. Note: no session_id field exists on Nous auth state; provenance is captured via client_id + agent_key_id, which are non-secret routing identifiers. * test: drop worktree-path sanity guard that fails in CI The test_module_resolves_to_this_worktree guard asserted auth.__file__ contained 'worktrees/bootstrap-h2-logging' — a local dev crutch to defeat the editable- install trap (venv points at the main checkout). In CI the code lives at /home/runner/work/... so the assertion always fails. It never belonged in the committed suite; the 5 behavioural tests are what matter. * feat(status): expose nous_session_valid on /api/status for hosted-agent self-heal A hosted agent whose Nous bootstrap session dies terminally (invalid_grant / quarantine) looks HEALTHY to every liveness/connectivity probe — the machine, relay ws, and dashboard all stay up — yet every inference turn hard-fails with a provider-auth error until a human re-logs-in. Nothing currently surfaces that condition to NAS. Add get_nous_session_validity() (valid|terminal|unknown), classified from local auth-store state (no working token required), and report it on the public /api/status payload. NAS's 2-min health sweep reads it and re-mints the bootstrap session in place on 'terminal'. Anti-flap: only a terminal failure (relogin_required / persisted quarantine marker with tokens cleared) maps to 'terminal'; transient/mid-rotation blips and merely-expiring tokens report 'unknown' so a healthy box never triggers a spurious re-mint. Part of the hosted-agent bootstrap-session self-heal (NAS side reads this field). * feat(display): show file_path in skill_view tool progress lines (#60079) When skill_view loads a supporting file (references/, scripts/, templates/) instead of the main SKILL.md, the CLI quiet-mode line and the friendly tool labels now show 'name → file_path' so it's clear which file was actually read. * fix(gateway): detect config token credential collisions (#59321) Co-authored-by: markoub <2418548+markoub@users.noreply.github.com> * fix(gateway): avoid cross-profile session recove…

…e + 1Password sidebar fix (NousResearch#59613) * docs(secrets): secret-source plugin developer guide + sidebar registration for 1Password page - New developer-guide/secret-source-plugin.md: SecretSource contract (never raises/prompts, fetch-only, timeout budget), framework-vs-plugin ownership table, mapped-vs-bulk shape guidance, run_secret_cli() subprocess-safety, registration + timing note, conformance kit usage, ErrorKind reference. - Register user-guide/secrets/onepassword in the sidebar (page shipped in NousResearch#59498 but was not listed, so it was unreachable from nav). - Cross-link the user-guide plugin section to the new dev guide. * docs: group all plugin guides under a Plugins subcategory in Extending - Move guides/build-a-hermes-plugin.md -> developer-guide/plugins/index.md (both locales) and make it the category landing page (slug pinned to /developer-guide/plugins). - New sidebar subcategory Developer Guide > Extending > Plugins holding the general guide + all 8 provider-plugin docs (llm-access, memory, context-engine, secret-source, model, image-gen, video-gen, web-search); provider-doc URLs unchanged. - Client redirect /guides/build-a-hermes-plugin -> /developer-guide/plugins. - Update 30 cross-links across both locales.

…7.7 ➔ v2026.7.20) (#10) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/gabrielcosi/hermes-agent](https://github.com/NousResearch/hermes-agent) | patch | `v2026.7.7` → `v2026.7.20` | --- ### Release Notes <details> <summary>NousResearch/hermes-agent (ghcr.io/gabrielcosi/hermes-agent)</summary> ### [`v2026.7.20`](https://github.com/NousResearch/hermes-agent/releases/tag/v2026.7.20): Hermes Agent v0.19.0 (2026.7.20) — The Quicksilver Release [Compare Source](https://github.com/NousResearch/hermes-agent/compare/v2026.7.7...v2026.7.20) ##### Hermes Agent v0.19.0 (v2026.7.20) **Release Date:** July 20, 2026 **Since v0.18.0:** \~2,245 commits · \~1,065 merged PRs · \~2,465 files changed · \~300,000 insertions · \~36,000 deletions · **\~3,300 issues closed** · **450+ community contributors** > **The Quicksilver Release.** Hermes is the messenger god, and this window we made him move like it. First-turn time-to-first-token dropped **\~80% on every platform**, reasoning streams live by default, the desktop app got a \~20-PR speed overhaul (14× faster streaming markdown, virtualized diffs, snappy session switching), and the TUI renders markdown incrementally. Around that speed spine: you can now **manage your Nous subscription without leaving the terminal**, plug **Bitwarden and 1Password** straight into Hermes, let **smart approvals** judge flagged commands for you by default, **watch your subagents work live**, and trust that a finished response **survives a gateway crash** thanks to a durable delivery ledger. This release also rolls up everything from the v0.18.1 and v0.18.2 infrastructure patch tags — those windows are fully documented here. *** ##### ✨ Highlights - **Hermes got dramatically faster — first token in a fraction of the time** — Cold-start "Initializing agent..." used to eat \~4.3 seconds before your first turn even reached the model; it's now \~0.9s, an \~80% cut that applies to the CLI, gateway, TUI, desktop, and cron alike. Round 2 attacked what you *see* while waiting: reasoning models now stream their thinking live by default (no more staring at a spinner for 30 seconds), and the response box paints per token instead of per line. If Hermes ever felt like it took a deep breath before answering, that breath is gone. ([#59332](https://github.com/NousResearch/hermes-agent/pull/59332), [#59389](https://github.com/NousResearch/hermes-agent/pull/59389) — [@teknium1](https://github.com/teknium1)) - **The desktop app speed wave — 20+ targeted perf PRs** — Long replies used to cost 14× more CPU in the markdown splitter than they do now; giant diffs froze the review pane until we virtualized it; switching sessions thrashes layout no more. Streaming no longer re-renders the sidebar and every tool row per token, profile backends pre-warm on hover intent, and boot-hidden panes mount at idle instead of on the cold-start critical path. The net effect: the desktop app feels like a native app under load, even with huge transcripts and busy agents. ([#67154](https://github.com/NousResearch/hermes-agent/pull/67154), [#67818](https://github.com/NousResearch/hermes-agent/pull/67818), [#65898](https://github.com/NousResearch/hermes-agent/pull/65898), [#66033](https://github.com/NousResearch/hermes-agent/pull/66033), [#66747](https://github.com/NousResearch/hermes-agent/pull/66747), [#67742](https://github.com/NousResearch/hermes-agent/pull/67742) and more — [@OutThisLife](https://github.com/OutThisLife)) - **Manage your Nous plan from the terminal — `/subscription` and `/topup`** — Changing your subscription used to mean a trip to the billing website. Now `/subscription` opens a full flow right in the TUI or classic CLI: see your plan and remaining allowance, preview exactly what an upgrade costs ("Pay $46.30 & upgrade now") or when a downgrade takes effect, and apply it — with scheduled-change banners and undo. The desktop app got a matching billing settings tab. Your wallet never has to leave the keyboard. ([#51639](https://github.com/NousResearch/hermes-agent/pull/51639), [#61054](https://github.com/NousResearch/hermes-agent/pull/61054), [#61067](https://github.com/NousResearch/hermes-agent/pull/61067) — [@alt-glitch](https://github.com/alt-glitch)) - **Smart approvals are now the default** — When Hermes wants to run a flagged command, an LLM reviewer now assesses it independently instead of asking you to approve every single one — and each verdict covers only that exact command, so a later command matching the same pattern gets its own review. Combined with the new **user-defined deny rules** (which block commands even under yolo mode) and `/deny <reason>` (which tells the agent *why* you refused so it course-corrects), day-to-day approval fatigue drops sharply without giving up control. ([#62661](https://github.com/NousResearch/hermes-agent/pull/62661), [#59164](https://github.com/NousResearch/hermes-agent/pull/59164), [#54518](https://github.com/NousResearch/hermes-agent/pull/54518) — [@teknium1](https://github.com/teknium1)) - **Plug your password manager into Hermes — Bitwarden & 1Password secret sources** — API keys no longer have to live in a plaintext `.env`. A new pluggable `SecretSource` interface lets Hermes fetch secrets from Bitwarden and 1Password (`op://` references) at load time, with multiple vaults enabled simultaneously, deterministic precedence, conflict warnings, and per-variable provenance. This consolidated eleven competing community PRs into one orchestrated interface — future vault providers drop in as plugins. ([#59498](https://github.com/NousResearch/hermes-agent/pull/59498) — [@teknium1](https://github.com/teknium1), 1Password provider salvaged from [@hwrdprkns](https://github.com/hwrdprkns)) - **Watch your subagents work — live transcripts + durable background delegation** — `delegate_task` dispatches now return live transcript files you can `tail -f` the moment the subagents launch: every tool call, result, and streamed reply, one human-readable log per child. And background delegation completions are now **durable** — if the process restarts mid-run, results are restored and delivered through an ownership-checked ledger instead of vanishing. Fan out a fleet, watch any worker live, and never lose the results. ([#67479](https://github.com/NousResearch/hermes-agent/pull/67479), [#63494](https://github.com/NousResearch/hermes-agent/pull/63494) — [@teknium1](https://github.com/teknium1)) - **A finished answer can no longer be lost — the delivery-obligation ledger** — If the gateway died between generating your response and confirming the platform actually delivered it, that answer used to be silently gone (and you'd paid for the turn). Final responses are now recorded in a durable ledger in `state.db` around the platform send and **redelivered on the next boot** — closing a P1 silent-loss window for Telegram, Discord, Slack, and every other channel. ([#67181](https://github.com/NousResearch/hermes-agent/pull/67181) — [@teknium1](https://github.com/teknium1)) - **One gateway, many profiles — profile-based message routing** — A single multiplexed gateway sharing one bot token can now route specific guilds, channels, or threads to different profiles — each with fully isolated config, skills, memory, and secrets. Point your work Discord server at the `work` profile and your hobby server at `personal`, from one bot. A second multiplex hardening wave means one misconfigured profile can no longer take down the whole gateway. ([#64835](https://github.com/NousResearch/hermes-agent/pull/64835) salvaging [@Burgunthy](https://github.com/Burgunthy), [#65700](https://github.com/NousResearch/hermes-agent/pull/65700), [#60589](https://github.com/NousResearch/hermes-agent/pull/60589) — [@teknium1](https://github.com/teknium1), [@benbarclay](https://github.com/benbarclay) + six salvaged contributors) - **New providers and the newest frontier models** — Fireworks AI and DeepInfra land as first-class providers (Fireworks with cost estimation and a [#2](https://github.com/NousResearch/hermes-agent/issues/2) slot in the provider picker), Upstage Solar joins via salvage, and the model catalogs picked up **GPT-5.6 (Sol/Terra/Luna + Pro variants, wired end-to-end across every route)**, **grok-4.5 (GA)**, **moonshotai/kimi-k3**, **claude-fable-5 / claude-sonnet-5**, and GA **tencent/hy3** — plus LM Studio JIT model loading for local setups. ([#62593](https://github.com/NousResearch/hermes-agent/pull/62593), [#63969](https://github.com/NousResearch/hermes-agent/pull/63969), [#61616](https://github.com/NousResearch/hermes-agent/pull/61616) — [@kshitijk4poor](https://github.com/kshitijk4poor) completing [@rob-maron](https://github.com/rob-maron)'s [#61578](https://github.com/NousResearch/hermes-agent/issues/61578), [#60887](https://github.com/NousResearch/hermes-agent/pull/60887), [#65913](https://github.com/NousResearch/hermes-agent/pull/65913), [#64541](https://github.com/NousResearch/hermes-agent/pull/64541), [#65472](https://github.com/NousResearch/hermes-agent/pull/65472)) - **Crank the thinking to max — new reasoning effort tiers and per-model control** — Reasoning effort gained `max` and `ultra` levels (GPT-5.6 and Codex's top tiers), selectable everywhere from the CLI to the desktop, with sane clamping on providers with smaller scales. You can now also pin **per-model reasoning-effort overrides** in config, set **per-slot effort in MoA presets** (your advisors think hard, your synthesizer stays fast), and per-task effort for auxiliary models. Thinking depth is now a dial, not a global switch. ([#62650](https://github.com/NousResearch/hermes-agent/pull/62650), [#64458](https://github.com/NousResearch/hermes-agent/pull/64458), [#64631](https://github.com/NousResearch/hermes-agent/pull/64631), [#64597](https://github.com/NousResearch/hermes-agent/pull/64597) — [@teknium1](https://github.com/teknium1)) - **Your sessions, your data — export everything** — `hermes sessions export` now writes Markdown, Quarto, HTML, prompt-only, and even Hugging Face-ready trace formats, with the full filter surface (age, workspace, platform), an opt-in `--redact` secret-scrubbing pass, and compacted-session lineage stitched into one logical export. Pair with the new prune filters and bulk archive to keep your session store tidy. Your conversation history is a real dataset now, not a black box. ([#60186](https://github.com/NousResearch/hermes-agent/pull/60186) salvaging [@web3blind](https://github.com/web3blind), [#60492](https://github.com/NousResearch/hermes-agent/pull/60492), [#60507](https://github.com/NousResearch/hermes-agent/pull/60507), [#59327](https://github.com/NousResearch/hermes-agent/pull/59327) — [@teknium1](https://github.com/teknium1)) - **Security hardening round** — This window closed a long list of credential-surface gaps: Vertex credentials scoped away from subprocess env and through profile secret scopes, media/vision/image-gen local-file reads routed through one shared credential-read guard, a webhook body-size-cap sweep across every aiohttp server, bot-token redaction in Telegram transport errors, Fireworks token prefixes added to the redactor, six P1 browser/MEDIA/.env hardening PRs salvaged in one pass, and CI hardened against untrusted-ref interpolation. ([#57660](https://github.com/NousResearch/hermes-agent/pull/57660), [#58709](https://github.com/NousResearch/hermes-agent/pull/58709), [#59215](https://github.com/NousResearch/hermes-agent/pull/59215), [#56582](https://github.com/NousResearch/hermes-agent/pull/56582), [#57842](https://github.com/NousResearch/hermes-agent/pull/57842) — [@teknium1](https://github.com/teknium1), [@srojk34](https://github.com/srojk34), [@kshitijk4poor](https://github.com/kshitijk4poor), [@jquesnelle](https://github.com/jquesnelle)) *** ##### ⚡ Performance — the speed spine ##### First-turn latency (all platforms) - **\~80% TTFT cut** — Discord capability detection off the critical path (token-keyed 24h disk cache + background refresh), Ollama probe skipped for known non-Ollama providers, agent-init blocking work removed; cold submit→dispatch \~4.3s → \~0.9s ([#59332](https://github.com/NousResearch/hermes-agent/pull/59332) — [@teknium1](https://github.com/teknium1)) - **Perceived-latency round 2** — `display.show_reasoning` default ON (watch the model think instead of a spinner), per-token response-box painting with width-aware force-flush, prompt-build caching, mtime-cached timezone resolution ([#59389](https://github.com/NousResearch/hermes-agent/pull/59389) — [@teknium1](https://github.com/teknium1)) - Segment mixed tool batches to recover lost concurrency; drop per-call base64 re-serialization from request-size estimates ([#64460](https://github.com/NousResearch/hermes-agent/pull/64460), [#67788](https://github.com/NousResearch/hermes-agent/pull/67788) — [@teknium1](https://github.com/teknium1), [@OutThisLife](https://github.com/OutThisLife)) ##### Desktop speed wave - 14× less splitter CPU via incremental block lexing for streaming markdown; virtualized review-pane diffs (no more full-Shiki freeze); snappy session switching on large transcripts; killed the layout-thrash cascade on session switch ([#67154](https://github.com/NousResearch/hermes-agent/pull/67154), [#67818](https://github.com/NousResearch/hermes-agent/pull/67818), [#65898](https://github.com/NousResearch/hermes-agent/pull/65898), [#66033](https://github.com/NousResearch/hermes-agent/pull/66033) — [@OutThisLife](https://github.com/OutThisLife)) - Cut startup serialization + per-turn REST amplification; pre-warm profile backends and gateway sockets on hover intent; idle-mount boot-hidden panes; fast model picker + dialogs ([#66747](https://github.com/NousResearch/hermes-agent/pull/66747), [#66347](https://github.com/NousResearch/hermes-agent/pull/66347), [#67857](https://github.com/NousResearch/hermes-agent/pull/67857), [#66470](https://github.com/NousResearch/hermes-agent/pull/66470) — [@OutThisLife](https://github.com/OutThisLife)) - Stop per-token sidebar + tool-row re-renders during streaming; stop eager JSON.stringify of every tool's args/result; scope tool-diff subscriptions; batch sidebar session slices into one profile-DB pass; targeted file-tree revalidation; rAF-coalesced sash resizes ([#67742](https://github.com/NousResearch/hermes-agent/pull/67742), [#67842](https://github.com/NousResearch/hermes-agent/pull/67842), [#67195](https://github.com/NousResearch/hermes-agent/pull/67195), [#67245](https://github.com/NousResearch/hermes-agent/pull/67245), [#67824](https://github.com/NousResearch/hermes-agent/pull/67824), [#67838](https://github.com/NousResearch/hermes-agent/pull/67838), [#67844](https://github.com/NousResearch/hermes-agent/pull/67844) — [@OutThisLife](https://github.com/OutThisLife)) - Systematized perf benchmark harness with trustworthy cold-start + first-token measurement, replacing 12 one-off scripts ([#67466](https://github.com/NousResearch/hermes-agent/pull/67466), [#67697](https://github.com/NousResearch/hermes-agent/pull/67697) — [@OutThisLife](https://github.com/OutThisLife)) ##### Everywhere else - TUI renders streamed markdown incrementally per block ([#67236](https://github.com/NousResearch/hermes-agent/pull/67236) — [@OutThisLife](https://github.com/OutThisLife)) - Skill discovery cached by scan signature; snapshot manifest builds \~5× faster; text prefilter before AST parse in tool discovery ([#61414](https://github.com/NousResearch/hermes-agent/pull/61414), [#61131](https://github.com/NousResearch/hermes-agent/pull/61131), [#63941](https://github.com/NousResearch/hermes-agent/pull/63941) — [@kshitijk4poor](https://github.com/kshitijk4poor), [@ethernet8023](https://github.com/ethernet8023)) - Copy-on-write message prep instead of full deepcopy; model-metadata probe-cache cluster; gateway `session.resume` model + display history from one SELECT ([#61133](https://github.com/NousResearch/hermes-agent/pull/61133), [#61368](https://github.com/NousResearch/hermes-agent/pull/61368), [#67247](https://github.com/NousResearch/hermes-agent/pull/67247) — [@kshitijk4poor](https://github.com/kshitijk4poor), [@OutThisLife](https://github.com/OutThisLife)) - `hermes update` skips npm install when Node manifests are unchanged; dashboard session-list payloads trimmed + messages paginated ([#61580](https://github.com/NousResearch/hermes-agent/pull/61580), [#60883](https://github.com/NousResearch/hermes-agent/pull/60883) — [@kshitijk4poor](https://github.com/kshitijk4poor)) - Byte-stable gateway system prompts — pinned session-context render keeps the prompt cache alive across turns ([#67403](https://github.com/NousResearch/hermes-agent/pull/67403) — [@kshitijk4poor](https://github.com/kshitijk4poor)) ##### 🏗️ Core Agent & Architecture ##### Providers & models - **Fireworks AI provider** with cost estimation + cached picker price columns, promoted to [#2](https://github.com/NousResearch/hermes-agent/issues/2) in provider pickers ([#62593](https://github.com/NousResearch/hermes-agent/pull/62593), [#65476](https://github.com/NousResearch/hermes-agent/pull/65476), [#65214](https://github.com/NousResearch/hermes-agent/pull/65214) — [@teknium1](https://github.com/teknium1)) - **DeepInfra** hardened integration; **Upstage Solar** provider ([#42231](https://github.com/NousResearch/hermes-agent/issues/42231) salvage) ([#63969](https://github.com/NousResearch/hermes-agent/pull/63969), [#64541](https://github.com/NousResearch/hermes-agent/pull/64541) — [@kshitijk4poor](https://github.com/kshitijk4poor)) - **GPT-5.6 (Sol/Terra/Luna + Pro) end-to-end** — context lengths, native/Codex catalogs, pricing, compaction caps across every route ([#61616](https://github.com/NousResearch/hermes-agent/pull/61616) — [@kshitijk4poor](https://github.com/kshitijk4poor), building on [@rob-maron](https://github.com/rob-maron)) - grok-4.5 (GA) catalog + reasoning allowlist; kimi-k3 on Nous Portal + OpenRouter (kimi-k2.x retired) + K3 discovery on the Kimi Coding endpoint; claude-fable-5 / claude-sonnet-5 / fugu-ultra curated; GA tencent/hy3 ([#60887](https://github.com/NousResearch/hermes-agent/pull/60887), [#65913](https://github.com/NousResearch/hermes-agent/pull/65913), [#65922](https://github.com/NousResearch/hermes-agent/pull/65922), [#56617](https://github.com/NousResearch/hermes-agent/pull/56617), [#60943](https://github.com/NousResearch/hermes-agent/pull/60943) — [@teknium1](https://github.com/teknium1)) - Catalog-labeled silent default (GLM-5.2) + bare-provider `/model` cost-safe routing; LM Studio JIT load mode; adaptive thinking for Kimi-family Anthropic endpoints ([#64771](https://github.com/NousResearch/hermes-agent/pull/64771), [#65472](https://github.com/NousResearch/hermes-agent/pull/65472), [#67606](https://github.com/NousResearch/hermes-agent/pull/67606) — [@teknium1](https://github.com/teknium1), [@kshitijk4poor](https://github.com/kshitijk4poor)) - GLM-5.2 native reasoning\_effort controls; Gemini request-context improvements; extra HTTP headers for LLM API calls; per-client model routing on the API server ([#58884](https://github.com/NousResearch/hermes-agent/pull/58884), [#61873](https://github.com/NousResearch/hermes-agent/pull/61873) — [@vishal-dharm](https://github.com/vishal-dharm), [#57038](https://github.com/NousResearch/hermes-agent/pull/57038), [#57028](https://github.com/NousResearch/hermes-agent/pull/57028) — [@teknium1](https://github.com/teknium1)) - **Claude Sonnet 5 fully wired** — curated lists, intro pricing, and metadata across every route ([#67932](https://github.com/NousResearch/hermes-agent/pull/67932) — [@teknium1](https://github.com/teknium1)) - **Hide providers you don't use** — `enabled: false` per-provider flag + `excluded_providers` config scrub unwanted providers from `/model` pickers and built-in resolution ([#67971](https://github.com/NousResearch/hermes-agent/pull/67971) — [@teknium1](https://github.com/teknium1)) - Bedrock catalog wave: real context-window probing from the live endpoint, 1M-context rows for current-gen Claude + Fable, geo-prefix parity, versioned profile-ID pricing, Opus 4.8/4.7 rows ([#68007](https://github.com/NousResearch/hermes-agent/pull/68007), [#67977](https://github.com/NousResearch/hermes-agent/pull/67977), [#68005](https://github.com/NousResearch/hermes-agent/pull/68005), [#67976](https://github.com/NousResearch/hermes-agent/pull/67976) — [@teknium1](https://github.com/teknium1)) - kimi-k3 rollout completed across Kimi-direct catalog surfaces with 1M context on canonical Kimi Coding endpoints ([#68108](https://github.com/NousResearch/hermes-agent/pull/68108) — [@teknium1](https://github.com/teknium1)) - Provider pickers: Qwen providers folded into one group row; collapsible provider groups in the desktop model picker; friendlier TUI model display grouping same-endpoint providers ([#67758](https://github.com/NousResearch/hermes-agent/pull/67758), [#67904](https://github.com/NousResearch/hermes-agent/pull/67904), [#67908](https://github.com/NousResearch/hermes-agent/pull/67908) — [@teknium1](https://github.com/teknium1)) ##### Reasoning & MoA - `max` + `ultra` effort levels across every surface and route ([#62650](https://github.com/NousResearch/hermes-agent/pull/62650) — [@teknium1](https://github.com/teknium1)) - Per-model reasoning\_effort overrides via a unified resolution chokepoint; per-task auxiliary effort; per-slot MoA preset effort; session-scoped `/reasoning` in the CLI ([#64458](https://github.com/NousResearch/hermes-agent/pull/64458), [#64597](https://github.com/NousResearch/hermes-agent/pull/64597), [#64631](https://github.com/NousResearch/hermes-agent/pull/64631), [#67946](https://github.com/NousResearch/hermes-agent/pull/67946) — [@teknium1](https://github.com/teknium1)) - MoA: `reference_max_tokens` to cap advisor output and cut latency; per-preset fanout cadence (`user_turn` runs advisors once per user turn); stale presets surfaced without retries; half-filled preset saves rejected at the API boundary; aggregator resolves reasoning like an acting model ([#56756](https://github.com/NousResearch/hermes-agent/pull/56756), [#57591](https://github.com/NousResearch/hermes-agent/pull/57591), [#64756](https://github.com/NousResearch/hermes-agent/pull/64756) — [@teknium1](https://github.com/teknium1)) ##### Delegation, approvals & the agent loop - Live subagent transcripts + durable background completions (see Highlights) ([#67479](https://github.com/NousResearch/hermes-agent/pull/67479), [#63494](https://github.com/NousResearch/hermes-agent/pull/63494) — [@teknium1](https://github.com/teknium1)) - Smart approvals default; user-defined deny rules (block even under yolo); `/deny <reason>` relays the denial reason; plugin `pre_tool_call` approve action escalates to a human gate (re-landed with rule keys) ([#62661](https://github.com/NousResearch/hermes-agent/pull/62661), [#59164](https://github.com/NousResearch/hermes-agent/pull/59164), [#54518](https://github.com/NousResearch/hermes-agent/pull/54518), [#60504](https://github.com/NousResearch/hermes-agent/pull/60504) — [@teknium1](https://github.com/teknium1), [@kshitijk4poor](https://github.com/kshitijk4poor)) - Unified delegation concurrency caps (`max_async_children` deprecated); explain long provider waits on the live status line; deterministic tool-output risk exposure ([#56955](https://github.com/NousResearch/hermes-agent/pull/56955), [#64775](https://github.com/NousResearch/hermes-agent/pull/64775), [#61793](https://github.com/NousResearch/hermes-agent/pull/61793) — [@teknium1](https://github.com/teknium1)) - Codex: live TUI/desktop tool cards for the app-server runtime, commentary streamed as visible interim messages, compaction routed through `thread/compact/start`, max-output truncation recovery, oversized message ids dropped on replay, banked usage-limit resets via `/usage reset` ([#66514](https://github.com/NousResearch/hermes-agent/pull/66514), [#66115](https://github.com/NousResearch/hermes-agent/pull/66115), [#60114](https://github.com/NousResearch/hermes-agent/pull/60114), [#58155](https://github.com/NousResearch/hermes-agent/pull/58155), [#62225](https://github.com/NousResearch/hermes-agent/pull/62225) — [@teknium1](https://github.com/teknium1), [@kshitijk4poor](https://github.com/kshitijk4poor), [@JoaoMarcos44](https://github.com/JoaoMarcos44), [#64280](https://github.com/NousResearch/hermes-agent/pull/64280) — [@teknium1](https://github.com/teknium1)) - Hooks: oversized hook-injected context spills to disk ([#20468](https://github.com/NousResearch/hermes-agent/pull/20468) — [@teknium1](https://github.com/teknium1)) - Vibe reactions — floating hearts on affection across CLI/TUI/desktop, token-free core detection ([#62016](https://github.com/NousResearch/hermes-agent/pull/62016) — [@OutThisLife](https://github.com/OutThisLife)) ##### Secrets & config - Pluggable `SecretSource` interface + Bitwarden & 1Password providers (see Highlights) ([#59498](https://github.com/NousResearch/hermes-agent/pull/59498) — [@teknium1](https://github.com/teknium1), [@hwrdprkns](https://github.com/hwrdprkns)) - `hermes config get` / `unset`; warn on unknown root config keys + doctor deprecated-key reporting; `display.timestamp_format` ([#65540](https://github.com/NousResearch/hermes-agent/pull/65540), [#67370](https://github.com/NousResearch/hermes-agent/pull/67370), [#40622](https://github.com/NousResearch/hermes-agent/pull/40622) — [@teknium1](https://github.com/teknium1)) - Auxiliary model usage recorded per task in session accounting; conversation-scoped Nous Portal usage tags across aux/MoA/delegate calls; `--usage-file` JSON report for `hermes -z` ([#65537](https://github.com/NousResearch/hermes-agent/pull/65537), [#65468](https://github.com/NousResearch/hermes-agent/pull/65468), [#59615](https://github.com/NousResearch/hermes-agent/pull/59615) — [@teknium1](https://github.com/teknium1)) ##### Sessions & compression - Sessions export: Markdown/QMD/HTML/prompt-only/trace formats, HF upload, `--redact`, unified filters; full prune filter surface + bulk archive; CLI workspace filter + restore-cwd-on-resume ([#60186](https://github.com/NousResearch/hermes-agent/pull/60186), [#60492](https://github.com/NousResearch/hermes-agent/pull/60492), [#60507](https://github.com/NousResearch/hermes-agent/pull/60507), [#59327](https://github.com/NousResearch/hermes-agent/pull/59327), [#63091](https://github.com/NousResearch/hermes-agent/pull/63091) — [@teknium1](https://github.com/teknium1), [@web3blind](https://github.com/web3blind)) - Compression: preserve human intent and durable handoffs; retain prompt cache when memory is unchanged; flatten multimodal content for the summarizer keeping image handles; gateway compression routing integrity ([#67275](https://github.com/NousResearch/hermes-agent/pull/67275), [#67916](https://github.com/NousResearch/hermes-agent/pull/67916), [#65046](https://github.com/NousResearch/hermes-agent/pull/65046), [#56868](https://github.com/NousResearch/hermes-agent/pull/56868) — [@kshitijk4poor](https://github.com/kshitijk4poor), [@teknium1](https://github.com/teknium1)) - Gateway session metadata consolidated into state.db; routing index moved to state.db (sessions.json now an optional legacy mirror); exact API bytes persisted in an `api_content` sidecar ([#58899](https://github.com/NousResearch/hermes-agent/pull/58899), [#59203](https://github.com/NousResearch/hermes-agent/pull/59203), [#67274](https://github.com/NousResearch/hermes-agent/pull/67274) — [@teknium1](https://github.com/teknium1), [@kshitijk4poor](https://github.com/kshitijk4poor)) ##### 🌐 Gateway, Fleet & Relay - **Durable delivery-obligation ledger** for final responses (see Highlights) ([#67181](https://github.com/NousResearch/hermes-agent/pull/67181) — [@teknium1](https://github.com/teknium1)) - **Profile-based routing for inbound messages** + multiplex hardening wave 2 + `GATEWAY_MULTIPLEX_PROFILES` override (see Highlights) ([#64835](https://github.com/NousResearch/hermes-agent/pull/64835), [#65700](https://github.com/NousResearch/hermes-agent/pull/65700), [#60589](https://github.com/NousResearch/hermes-agent/pull/60589) — [@teknium1](https://github.com/teknium1), [@benbarclay](https://github.com/benbarclay) + salvaged contributors) - Per-session turn lease + conversation-scope funnel; unified session reset boundaries (reset sessions stay reset); truthful runtime readiness checks; per-channel model and system prompt overrides; per-session `/model` overrides persist across restarts ([#67401](https://github.com/NousResearch/hermes-agent/pull/67401), [#65783](https://github.com/NousResearch/hermes-agent/pull/65783), [#62645](https://github.com/NousResearch/hermes-agent/pull/62645), [#56967](https://github.com/NousResearch/hermes-agent/pull/56967), [#57030](https://github.com/NousResearch/hermes-agent/pull/57030) — [@teknium1](https://github.com/teknium1)) - Session auto-reset default off; `/sessions search <query>`; webhook payload filters + route scripts; platform HTTP event callback routing; configurable long-running status phrases ([#60194](https://github.com/NousResearch/hermes-agent/pull/60194), [#57685](https://github.com/NousResearch/hermes-agent/pull/57685), [#60944](https://github.com/NousResearch/hermes-agent/pull/60944), [#65702](https://github.com/NousResearch/hermes-agent/pull/65702), [#58872](https://github.com/NousResearch/hermes-agent/pull/58872) — [@teknium1](https://github.com/teknium1)) - Relay: generic OIDC client-credentials provisioning (NAS-free), routed profile carried from the connector wire source, channel context consumed from the connector; Nous auth forensics + `nous_session_valid` on `/api/status` for hosted self-heal; Docker re-seeds a terminally-dead Nous bootstrap session on boot ([#60730](https://github.com/NousResearch/hermes-agent/pull/60730), [#60586](https://github.com/NousResearch/hermes-agent/pull/60586), [#64649](https://github.com/NousResearch/hermes-agent/pull/64649), [#59976](https://github.com/NousResearch/hermes-agent/pull/59976), [#59969](https://github.com/NousResearch/hermes-agent/pull/59969), [#59983](https://github.com/NousResearch/hermes-agent/pull/59983) — [@benbarclay](https://github.com/benbarclay)) ##### 📱 Messaging Platforms - **Inline choice pickers** for `/reasoning` and `/fast` on Telegram, Discord, and Matrix — one-tap native buttons instead of typing ([#65799](https://github.com/NousResearch/hermes-agent/pull/65799) — [@teknium1](https://github.com/teknium1)) - WhatsApp: native Baileys polls (clarify renders as a poll), locations, rich inbound metadata; dashboard pairing flow ([#58865](https://github.com/NousResearch/hermes-agent/pull/58865), [#60571](https://github.com/NousResearch/hermes-agent/pull/60571) — [@teknium1](https://github.com/teknium1)) - Discord: recover messages missed during reconnect; auto-created threads renamed to generated session titles; configurable interactive view timeout; opt-in owner mentions on exec-approval prompts; optional admin-only gate for approval buttons ([#66149](https://github.com/NousResearch/hermes-agent/pull/66149), [#60187](https://github.com/NousResearch/hermes-agent/pull/60187), [#60230](https://github.com/NousResearch/hermes-agent/pull/60230), [#60493](https://github.com/NousResearch/hermes-agent/pull/60493), [#51751](https://github.com/NousResearch/hermes-agent/pull/51751) — [@teknium1](https://github.com/teknium1)) - Slack: live per-tool status line ([#67080](https://github.com/NousResearch/hermes-agent/pull/67080) — [@teknium1](https://github.com/teknium1), salvaging [#62007](https://github.com/NousResearch/hermes-agent/issues/62007)) - Telegram: per-topic free-response allowlist; Google Chat clarify prompts rendered as cards ([#65543](https://github.com/NousResearch/hermes-agent/pull/65543), [#65546](https://github.com/NousResearch/hermes-agent/pull/65546) — [@teknium1](https://github.com/teknium1)) - Voice: `stt.echo_transcripts` toggle; MEDIA: captions attached to the media bubble on standalone sends; `display.tool_progress: log` option ([#58859](https://github.com/NousResearch/hermes-agent/pull/58859), [#61415](https://github.com/NousResearch/hermes-agent/pull/61415), [#57014](https://github.com/NousResearch/hermes-agent/pull/57014) — [@teknium1](https://github.com/teknium1), [@kshitijk4poor](https://github.com/kshitijk4poor)) ##### 🖥️ Hermes Desktop App - **Contribution-driven shell on a layout-tree model** — panes, zones, and layouts as data; plugin-scoped i18n locale bundles followed ([#60638](https://github.com/NousResearch/hermes-agent/pull/60638), [#67303](https://github.com/NousResearch/hermes-agent/pull/67303) — [@OutThisLife](https://github.com/OutThisLife)) - **Capabilities page** — Skills/Tools/MCP + Hub in one place, with responsive overlay nav; CLI/dashboard parity for skills hub, MCP test/toggle/catalog, maintenance ops, log filters; five UX fixes from live testing ([#57590](https://github.com/NousResearch/hermes-agent/pull/57590), [#57441](https://github.com/NousResearch/hermes-agent/pull/57441), [#67482](https://github.com/NousResearch/hermes-agent/pull/67482) — [@OutThisLife](https://github.com/OutThisLife), [@teknium1](https://github.com/teknium1)) - **Hermes Cloud connection mode** (salvage of [#55402](https://github.com/NousResearch/hermes-agent/issues/55402)); soft gateway switch + gateway-settings polish; terminal execution backend picker with health probes ([#61912](https://github.com/NousResearch/hermes-agent/pull/61912), [#61916](https://github.com/NousResearch/hermes-agent/pull/61916), [#67203](https://github.com/NousResearch/hermes-agent/pull/67203) — [@OutThisLife](https://github.com/OutThisLife), [@teknium1](https://github.com/teknium1)) - Keybind hint tooltips + keybinds settings tab + unified worktree dialog; base-branch picker for new worktrees; green unread dot for background-finished sessions; background-task sidebar indicators; grouped tool calls across text-less messages; auto-scrolling window for long tool-call runs ([#65204](https://github.com/NousResearch/hermes-agent/pull/65204), [#62243](https://github.com/NousResearch/hermes-agent/pull/62243), [#65109](https://github.com/NousResearch/hermes-agent/pull/65109), [#65174](https://github.com/NousResearch/hermes-agent/pull/65174), [#61147](https://github.com/NousResearch/hermes-agent/pull/61147), [#57913](https://github.com/NousResearch/hermes-agent/pull/57913) — [@ethernet8023](https://github.com/ethernet8023), [@OutThisLife](https://github.com/OutThisLife)) - Session + project color system (inherit from project, per-session override, shared across sidebar/tabs); unified active-project identity in chat status; workspace path status action ([#67469](https://github.com/NousResearch/hermes-agent/pull/67469), [#67681](https://github.com/NousResearch/hermes-agent/pull/67681), [#67282](https://github.com/NousResearch/hermes-agent/pull/67282), [#63086](https://github.com/NousResearch/hermes-agent/pull/63086) — [@OutThisLife](https://github.com/OutThisLife)) - Declarative memory-provider panel + full-config modal; config-defined TTS/STT providers + xAI TTS params; custom endpoint settings; per-job cron model picker; profile-aware approval mode control; UI scale setting; Ctrl/Cmd+wheel zoom; chat backdrop toggle; `/journey` opens the memory graph overlay ([#67206](https://github.com/NousResearch/hermes-agent/pull/67206) salvaging [@erosika](https://github.com/erosika), [#67209](https://github.com/NousResearch/hermes-agent/pull/67209), [#67759](https://github.com/NousResearch/hermes-agent/pull/67759) — [@austinpickett](https://github.com/austinpickett), [#67472](https://github.com/NousResearch/hermes-agent/pull/67472), [#63520](https://github.com/NousResearch/hermes-agent/pull/63520), [#60457](https://github.com/NousResearch/hermes-agent/pull/60457), [#67029](https://github.com/NousResearch/hermes-agent/pull/67029), [#64598](https://github.com/NousResearch/hermes-agent/pull/64598), [#57267](https://github.com/NousResearch/hermes-agent/pull/57267) — [@teknium1](https://github.com/teknium1), [@OutThisLife](https://github.com/OutThisLife)) - Full TypeScript conversion of the desktop tree ([#57855](https://github.com/NousResearch/hermes-agent/pull/57855) — [@ethernet8023](https://github.com/ethernet8023)) ##### 📊 Web Dashboard - Memory provider switching; safe session import flow; WhatsApp pairing; Discord-specific toolsets editable from the web UI; clarified manual Telegram bot setup ([#60569](https://github.com/NousResearch/hermes-agent/pull/60569), [#63699](https://github.com/NousResearch/hermes-agent/pull/63699), [#60571](https://github.com/NousResearch/hermes-agent/pull/60571), [#65361](https://github.com/NousResearch/hermes-agent/pull/65361), [#64636](https://github.com/NousResearch/hermes-agent/pull/64636) — [@teknium1](https://github.com/teknium1), [@kshitijk4poor](https://github.com/kshitijk4poor), [@shannonsands](https://github.com/shannonsands)) - Terminal keep-alive + reattach for dashboard chat sessions; heavy turns isolated in a compute host; paste/drop images into Chat; `browser.headed` schema toggle; profile + gateway topology on `/api/status`; mobile/hosted OpenAI OAuth login ([#60515](https://github.com/NousResearch/hermes-agent/pull/60515), [#65895](https://github.com/NousResearch/hermes-agent/pull/65895), [#61929](https://github.com/NousResearch/hermes-agent/pull/61929), [#67046](https://github.com/NousResearch/hermes-agent/pull/67046), [#60537](https://github.com/NousResearch/hermes-agent/pull/60537), [#61330](https://github.com/NousResearch/hermes-agent/pull/61330) — [@teknium1](https://github.com/teknium1), [@OutThisLife](https://github.com/OutThisLife), [@benbarclay](https://github.com/benbarclay)) - `hermes serve` is a true headless backend (no web UI build/mount) ([#55923](https://github.com/NousResearch/hermes-agent/pull/55923) — [@OutThisLife](https://github.com/OutThisLife)) ##### 🧰 CLI & TUI - `/subscription` + `/topup` terminal billing (see Highlights) ([#51639](https://github.com/NousResearch/hermes-agent/pull/51639) — [@alt-glitch](https://github.com/alt-glitch)) - **`/model --once`** — one-turn model override that reverts automatically ([#67113](https://github.com/NousResearch/hermes-agent/pull/67113) — [@teknium1](https://github.com/teknium1), salvaging [#29923](https://github.com/NousResearch/hermes-agent/issues/29923)) - **Stacked slash-skill invocations** — `/skill-a /skill-b do XYZ` loads both skills in order (Claude Code port), with autocomplete + ghost text ([#57987](https://github.com/NousResearch/hermes-agent/pull/57987), [#58763](https://github.com/NousResearch/hermes-agent/pull/58763) — [@teknium1](https://github.com/teknium1)) - `--safe-mode` troubleshooting flag; uninstall dry-run; TLS failures fail fast with fix hints; `/compact` alias + preview flags; pip/Homebrew installs warned unsupported ([#45300](https://github.com/NousResearch/hermes-agent/pull/45300), [#60111](https://github.com/NousResearch/hermes-agent/pull/60111), [#57992](https://github.com/NousResearch/hermes-agent/pull/57992), [#57029](https://github.com/NousResearch/hermes-agent/pull/57029), [#57225](https://github.com/NousResearch/hermes-agent/pull/57225) — [@teknium1](https://github.com/teknium1), [@ethernet8023](https://github.com/ethernet8023)) - TUI: model picker refresh support; custom skill bundles dispatched as agent turns; banner sizes skills display to terminal width ([#59782](https://github.com/NousResearch/hermes-agent/pull/59782) — [@helix4u](https://github.com/helix4u), [#62859](https://github.com/NousResearch/hermes-agent/pull/62859) — [@Adolanium](https://github.com/Adolanium), [#40624](https://github.com/NousResearch/hermes-agent/pull/40624) — [@teknium1](https://github.com/teknium1)) - Hermes Console REPL + perf follow-ups; `hermes curator usage` all-skills view; entry-point plugins surfaced in `hermes plugins list` ([#57781](https://github.com/NousResearch/hermes-agent/pull/57781) — [@kshitijk4poor](https://github.com/kshitijk4poor), [#36727](https://github.com/NousResearch/hermes-agent/pull/36727), [#40623](https://github.com/NousResearch/hermes-agent/pull/40623) — [@teknium1](https://github.com/teknium1)) ##### 🔧 Tool System, Skills & MCP - MCP: `mcp__server__tool` naming convention; server log notifications surfaced in agent.log; hosted OAuth completed across Dashboard + Desktop; configurable `redirect_uri`/`redirect_host` for proxied/WAF setups; OAuth callback port races closed; Blender added to the MCP catalog with a curated 4-tool default ([#52750](https://github.com/NousResearch/hermes-agent/pull/52750), [#57416](https://github.com/NousResearch/hermes-agent/pull/57416), [#66151](https://github.com/NousResearch/hermes-agent/pull/66151), [#65610](https://github.com/NousResearch/hermes-agent/pull/65610), [#65622](https://github.com/NousResearch/hermes-agent/pull/65622), [#64463](https://github.com/NousResearch/hermes-agent/pull/64463) — [@teknium1](https://github.com/teknium1), [@benbarclay](https://github.com/benbarclay)) - Skills: `security/unbroker` (autonomous data-broker removal) + blind opt-out hardening; `unreal-mcp` companion skill; blender-mcp reworked around the catalog entry; humanizer pattern expansion; `mcp-oauth-remote-gateway` optional skill ([#57438](https://github.com/NousResearch/hermes-agent/pull/57438), [#57902](https://github.com/NousResearch/hermes-agent/pull/57902), [#65989](https://github.com/NousResearch/hermes-agent/pull/65989), [#64715](https://github.com/NousResearch/hermes-agent/pull/64715) — [@SHL0MS](https://github.com/SHL0MS), [#65066](https://github.com/NousResearch/hermes-agent/pull/65066), [#65486](https://github.com/NousResearch/hermes-agent/pull/65486) — [@teknium1](https://github.com/teknium1)) - Browser: full snapshots stored on truncation, eval denylist opt-in; computer\_use follows cua-driver's verify→escalate ladder ([#65923](https://github.com/NousResearch/hermes-agent/pull/65923), [#67123](https://github.com/NousResearch/hermes-agent/pull/67123) — [@teknium1](https://github.com/teknium1)) - Kanban: modal create-task dialog + editable board project directory; Done-card results made obvious; grab-to-pan board scrolling; attachment toolset + CLI with SSRF-guarded URL fetch; project directory captured at board creation ([#66333](https://github.com/NousResearch/hermes-agent/pull/66333), [#63638](https://github.com/NousResearch/hermes-agent/pull/63638), [#60226](https://github.com/NousResearch/hermes-agent/pull/60226), [#65698](https://github.com/NousResearch/hermes-agent/pull/65698), [#63249](https://github.com/NousResearch/hermes-agent/pull/63249) — [@teknium1](https://github.com/teknium1)) - Cron: durable execution audit history; one-shot stale-removal race fixed; run-claim TTL derived from HERMES\_CRON\_TIMEOUT ([#61791](https://github.com/NousResearch/hermes-agent/pull/61791) — [@teknium1](https://github.com/teknium1), [#62014](https://github.com/NousResearch/hermes-agent/pull/62014) — [@PRATHAMESH75](https://github.com/PRATHAMESH75), [#59567](https://github.com/NousResearch/hermes-agent/pull/59567)) - mem0: self-hosted dashboard backend + recall tuning + setup-wizard mode ([#56943](https://github.com/NousResearch/hermes-agent/pull/56943), [#60494](https://github.com/NousResearch/hermes-agent/pull/60494) — [@kshitijk4poor](https://github.com/kshitijk4poor), [@teknium1](https://github.com/teknium1)) - Image gen: Codex image inputs; unsupported Codex image accounts classified; tool args recursively normalized by schema (cline port) ([#57017](https://github.com/NousResearch/hermes-agent/pull/57017), [#63627](https://github.com/NousResearch/hermes-agent/pull/63627), [#52220](https://github.com/NousResearch/hermes-agent/pull/52220) — [@teknium1](https://github.com/teknium1), [@kshitijk4poor](https://github.com/kshitijk4poor)) ##### 🔒 Security & Reliability - Vertex: credential/project/region resolution through the profile secret scope; `VERTEX_CREDENTIALS_PATH`/`GOOGLE_APPLICATION_CREDENTIALS` stripped from subprocess env ([#56680](https://github.com/NousResearch/hermes-agent/pull/56680), [#56582](https://github.com/NousResearch/hermes-agent/pull/56582) — [@srojk34](https://github.com/srojk34)) - Six P1 hardening PRs salvaged in one pass — browser guards, MEDIA anchoring, .env lockdown, delegate ACP transport ([#57660](https://github.com/NousResearch/hermes-agent/pull/57660) — [@teknium1](https://github.com/teknium1)) - Media/vision/image-gen local-file reads routed through the shared credential-read guard; native image routing guarded by file-safety policy; unified image-source resolver + terminal-backend confinement ([#58709](https://github.com/NousResearch/hermes-agent/pull/58709), [#58752](https://github.com/NousResearch/hermes-agent/pull/58752), [#57890](https://github.com/NousResearch/hermes-agent/pull/57890) — [@teknium1](https://github.com/teknium1)) - Webhook body-cap sweep: explicit `client_max_size` on 3 uncapped aiohttp servers + completion sweep; Raft chunked-request body limit; timestamp-bound V2 webhook signatures ([#59180](https://github.com/NousResearch/hermes-agent/pull/59180), [#59215](https://github.com/NousResearch/hermes-agent/pull/59215), [#58902](https://github.com/NousResearch/hermes-agent/pull/58902), [#58508](https://github.com/NousResearch/hermes-agent/pull/58508) — [@teknium1](https://github.com/teknium1), [@srojk34](https://github.com/srojk34)) - Redaction: Fireworks token prefixes + Telegram transport errors; env-lookup false positives fixed for KEY=value and JSON/YAML config fields; bot tokens scrubbed from Telegram connect/send errors ([#58501](https://github.com/NousResearch/hermes-agent/pull/58501), [#58534](https://github.com/NousResearch/hermes-agent/pull/58534), [#58915](https://github.com/NousResearch/hermes-agent/pull/58915), [#58893](https://github.com/NousResearch/hermes-agent/pull/58893) — [@teknium1](https://github.com/teknium1)) - computer-use: subprocess env sanitized across all five cua-driver spawn sites ([#58889](https://github.com/NousResearch/hermes-agent/pull/58889), [#59165](https://github.com/NousResearch/hermes-agent/pull/59165) — [@teknium1](https://github.com/teknium1)) - Dashboard: managed-files credential guard widened past .env + dir-tree gap closed; OAuth token TOCTOU closed with atomic 0o600 writes; stale dashboards can't recreate deleted profiles ([#58222](https://github.com/NousResearch/hermes-agent/pull/58222) — [@kshitijk4poor](https://github.com/kshitijk4poor), [#60236](https://github.com/NousResearch/hermes-agent/pull/60236) — [@teknium1](https://github.com/teknium1), [#49435](https://github.com/NousResearch/hermes-agent/pull/49435) — [@LeonSGP43](https://github.com/LeonSGP43)) - CI: untrusted refs passed through env, not `run:` interpolation; JS/TS tests wired into CI with source-regex tests banned; js-autofix pushes via PR instead of direct-to-main ([#57842](https://github.com/NousResearch/hermes-agent/pull/57842) — [@jquesnelle](https://github.com/jquesnelle), [#60707](https://github.com/NousResearch/hermes-agent/pull/60707), [#65186](https://github.com/NousResearch/hermes-agent/pull/65186) — [@ethernet8023](https://github.com/ethernet8023)) - Docker: terminal network toggle with full-path coverage; Git Bash Mandatory-ASLR install failures detected; Windows updater console hidden during handoff ([#59149](https://github.com/NousResearch/hermes-agent/pull/59149) — [@teknium1](https://github.com/teknium1), [#64651](https://github.com/NousResearch/hermes-agent/pull/64651), [#66040](https://github.com/NousResearch/hermes-agent/pull/66040) — [@helix4u](https://github.com/helix4u)) - Anthropic: request-local clients so the stale/interrupt watchdog never corrupts SQLite; per-profile OAuth file; OAuth login 429 fixed (UA must not be claude-code/) ([#67238](https://github.com/NousResearch/hermes-agent/pull/67238) — [@OutThisLife](https://github.com/OutThisLife), [#59339](https://github.com/NousResearch/hermes-agent/pull/59339), [#58178](https://github.com/NousResearch/hermes-agent/pull/58178) — [@teknium1](https://github.com/teknium1)) - Gateway/agent: tool\_call\_id deduplicated across pre-API sanitizers; background review inherits parent reasoning\_config for Anthropic cache parity; `/new` memory extraction moved off the command path ([#58350](https://github.com/NousResearch/hermes-agent/pull/58350), [#64379](https://github.com/NousResearch/hermes-agent/pull/64379), [#61139](https://github.com/NousResearch/hermes-agent/pull/61139) — [@teknium1](https://github.com/teknium1), [@kshitijk4poor](https://github.com/kshitijk4poor)) ##### 🔁 Reverted in this window (for the record) - iron-proxy credential-injection egress firewall ([#30179](https://github.com/NousResearch/hermes-agent/issues/30179) → reverted in [#58489](https://github.com/NousResearch/hermes-agent/pull/58489)) — not shipping in this release - dynamic-workflow orchestration skill (landed, then reverted) — not shipping - memory provider-actions extension point (landed, then reverted) — not shipping - Note: the plugin `pre_tool_call` approve escalation was reverted mid-window but **re-landed** in [#60504](https://github.com/NousResearch/hermes-agent/pull/60504) and ships in this release. ##### 👥 Contributors **450+ people** contributed to this release (via commits, co-author trailers, and salvaged PRs) — the biggest contributor window yet. Thank you, all of you. ##### Core team - [@teknium1](https://github.com/teknium1) — release lead; TTFT perf wave, delivery + delegation durability, smart approvals, SecretSource, gateway multiplex + profile routing, sessions export, security round, and a \~290-PR community salvage burn - [@OutThisLife](https://github.com/OutThisLife) — desktop app (the speed wave, layout-tree shell, Capabilities page, session colors, vibe reactions, TUI incremental markdown, perf harness) - [@kshitijk4poor](https://github.com/kshitijk4poor) — GPT-5.6 end-to-end, DeepInfra + Upstage Solar providers, perf cluster, compression integrity, mem0, dashboard guards - [@ethernet8023](https://github.com/ethernet8023) — CI overhaul (JS/TS tests wired in, autofix-via-PR, python speedups), desktop keybinds/worktrees/status indicators, full desktop TypeScript conversion - [@benbarclay](https://github.com/benbarclay) — relay OIDC provisioning, gateway multiplex override, Nous auth self-heal, hosted MCP OAuth groundwork - [@alt-glitch](https://github.com/alt-glitch) — terminal billing (`/subscription`, `/topup`), desktop billing tab - [@helix4u](https://github.com/helix4u) — desktop provider/model UX, TUI model picker refresh, Windows install/updater hardening - [@austinpickett](https://github.com/austinpickett) — desktop custom endpoint settings - [@SHL0MS](https://github.com/SHL0MS) — unbroker + unreal-mcp skills, humanizer expansion ##### Top community contributors - [@srojk34](https://github.com/srojk34) — security hardening: Vertex credential/project/region scoping through the profile secret scope, subprocess env stripping, Raft chunked-request body limits - [@HexLab98](https://github.com/HexLab98) — 11 fixes across MCP capability gating, Windows installer PATH, desktop cron editing, gateway systemd warnings - [@UnathiCodex](https://github.com/UnathiCodex) — desktop stability: zoom across display moves, LaTeX rendering, resume-stall and runtime-readiness fixes - [@xxxigm](https://github.com/xxxigm) — `<think>` leak fix after thinking-only retry flush, dashboard auth/theme/PTY fixes - [@erosika](https://github.com/erosika) — desktop declarative memory-provider panel + honcho recall/timeout correctness - [@Frowtek](https://github.com/Frowtek) — credential security: master stores never mounted into skill sandboxes, live-transcript redaction, dashboard api\_key precedence - [@necoweb3](https://github.com/necoweb3) — browser private-page CDP guard, cron one-shot liveness, gateway compression fail-closed - [@DavidMetcalfe](https://github.com/DavidMetcalfe) — desktop updater version pill, Local/custom endpoint exposure, sidebar collapse behavior - [@shannonsands](https://github.com/shannonsands) — dashboard: mobile channel setup, Discord toolsets from web UI, Telegram setup clarity - [@vishal-dharm](https://github.com/vishal-dharm) — Gemini request-context improvements - [@PRATHAMESH75](https://github.com/PRATHAMESH75) — cron one-shot stale-removal race, dashboard multiplex port-binding guard - [@alelpoan](https://github.com/alelpoan), [@embwl0x](https://github.com/embwl0x), [@Adolanium](https://github.com/Adolanium), [@giggling-ginger](https://github.com/giggling-ginger), [@Drexuxux](https://github.com/Drexuxux), [@frizikk](https://github.com/frizikk), [@JoaoMarcos44](https://github.com/JoaoMarcos44), [@wesleysimplici](https://github.com/wesleysimplici), [@LeonSGP43](https://github.com/LeonSGP43), [@pierrenode](https://github.com/pierrenode), [@simpolism](https://github.com/simpolism), [@MorAlekss](https://github.com/MorAlekss), [@r266-tech](https://github.com/r266-tech), [@WadydX](https://github.com/WadydX), [@nv-kasikritc](https://github.com/nv-kasikritc) — targeted fixes across desktop, TUI, gateway, cron, webhook, nix, and browser surfaces - Salvaged-work authors whose PRs were cherry-picked with credit this window: [@Burgunthy](https://github.com/Burgunthy) (profile routing), [@web3blind](https://github.com/web3blind) (sessions export), [@hwrdprkns](https://github.com/hwrdprkns) (1Password), [@Christopher-Schulze](https://github.com/Christopher-Schulze), [@Ahmett101](https://github.com/Ahmett101), [@sjiangtao2024](https://github.com/sjiangtao2024), and many more — see the salvage PR bodies for full attribution ##### All contributors [@0-CYBERDYNE-SYSTEMS-0](https://github.com/0-CYBERDYNE-SYSTEMS-0), [@0disoft](https://github.com/0disoft), [@0xbyt4](https://github.com/0xbyt4), [@100yenadmin](https://github.com/100yenadmin), [@17324393074](https://github.com/17324393074), [@2751738943](https://github.com/2751738943), [@8294](https://github.com/8294), [@abhibansal-sg](https://github.com/abhibansal-sg), [@adambiggs](https://github.com/adambiggs), [@Adolanium](https://github.com/Adolanium), [@aeyeopsdev](https://github.com/aeyeopsdev), [@aguung](https://github.com/aguung), [@AhmetArif0](https://github.com/AhmetArif0), [@Ahmett101](https://github.com/Ahmett101), [@ai-ag2026](https://github.com/ai-ag2026), [@AIalliAI](https://github.com/AIalliAI), [@ajzrva-sys](https://github.com/ajzrva-sys), [@alastraz](https://github.com/alastraz), [@alelpoan](https://github.com/alelpoan), [@alex-fireworks](https://github.com/alex-fireworks), [@alex-heritier](https://github.com/alex-heritier), [@alex107ivanov](https://github.com/alex107ivanov), [@AlexFucuson9](https://github.com/AlexFucuson9), [@Alix-007](https://github.com/Alix-007), [@allenliang2022](https://github.com/allenliang2022), [@Almurat123](https://github.com/Almurat123), [@AlsayedHoota](https://github.com/AlsayedHoota), [@alt-glitch](https://github.com/alt-glitch), [@alvarosanchez](https://github.com/alvarosanchez), [@amanning3390](https://github.com/amanning3390), [@AmAzing129](https://github.com/AmAzing129), [@AndreasHiltner](https://github.com/AndreasHiltner), [@andrewhomeyer](https://github.com/andrewhomeyer), [@annguyenNous](https://github.com/annguyenNous), [@ansel-f](https://github.com/ansel-f), [@antydizajn](https://github.com/antydizajn), [@arminanton](https://github.com/arminanton), [@arnispiekus](https://github.com/arnispiekus), [@asimons81](https://github.com/asimons81), [@asscan](https://github.com/asscan), [@ats3v](https://github.com/ats3v), [@austinlaw076](https://github.com/austinlaw076), [@austinpickett](https://github.com/austinpickett), [@avifenesh](https://github.com/avifenesh), [@aydnOktay](https://github.com/aydnOktay), [@Bartok9](https://github.com/Bartok9), [@bautrey](https://github.com/bautrey), [@bbednarski9](https://github.com/bbednarski9), [@bbopen](https://github.com/bbopen), [@benbarclay](https://github.com/benbarclay), [@bigstar0920](https://github.com/bigstar0920), [@binhnt92](https://github.com/binhnt92), [@bird](https://github.com/bird), [@Black0Fox0](https://github.com/Black0Fox0), [@BlackishGreen33](https://github.com/BlackishGreen33), [@bo](https://github.com/bo).fu, [@brendandebeasi](https://github.com/brendandebeasi), [@briandevans](https://github.com/briandevans), [@BROCCOLO1D](https://github.com/BROCCOLO1D), [@Bruce-anle](https://github.com/Bruce-anle), [@brunz-me](https://github.com/brunz-me), [@Burgunthy](https://github.com/Burgunthy), [@bytesnail](https://github.com/bytesnail), [@catbearlove1-lang](https://github.com/catbearlove1-lang), [@Cdddo](https://github.com/Cdddo), [@cgarwood82](https://github.com/cgarwood82), [@CharmingGroot](https://github.com/CharmingGroot), [@chouqin](https://github.com/chouqin), [@Christopher-Schulze](https://github.com/Christopher-Schulze), [@claudlos](https://github.com/claudlos), [@CocaKova](https://github.com/CocaKova), [@Code-suphub](https://github.com/Code-suphub), [@CodeForgeNet](https://github.com/CodeForgeNet), [@craigdfrench](https://github.com/craigdfrench), [@CrazyBoyM](https://github.com/CrazyBoyM), [@crazywriter1](https://github.com/crazywriter1), [@cresslank](https://github.com/cresslank), [@cruzanstx](https://github.com/cruzanstx), [@cyrkstudios](https://github.com/cyrkstudios), [@danilofalcao](https://github.com/danilofalcao), [@datachainsystems](https://github.com/datachainsystems), [@DatTheMaster](https://github.com/DatTheMaster), [@davidb73-hub](https://github.com/davidb73-hub), [@davidgut1982](https://github.com/davidgut1982), [@DavidMetcalfe](https://github.com/DavidMetcalfe), [@davidrobertson](https://github.com/davidrobertson), [@deacon-botdoctor](https://github.com/deacon-botdoctor), [@DECK6](https://github.com/DECK6), [@deepujain](https://github.com/deepujain), [@derek2000139](https://github.com/derek2000139), [@designnotdrum](https://github.com/designnotdrum), [@deusyu](https://github.com/deusyu), [@devatnull](https://github.com/devatnull), [@devorun](https://github.com/devorun), [@dexhunter](https://github.com/dexhunter), [@dfein38347g](https://github.com/dfein38347g), [@Dhravya](https://github.com/Dhravya), [@DictatorBacon](https://github.com/DictatorBacon), [@digitalbase](https://github.com/digitalbase), [@dlkakbs](https://github.com/dlkakbs), [@dmabry](https://github.com/dmabry), [@DNAlec](https://github.com/DNAlec), [@dodo-reach](https://github.com/dodo-reach), [@doncazper](https://github.com/doncazper), [@dorokuma](https://github.com/dorokuma), [@doxe0x](https://github.com/doxe0x), [@Drexuxux](https://github.com/Drexuxux), [@dschnurbusch](https://github.com/dschnurbusch), [@Dusk1e](https://github.com/Dusk1e), [@EdderTalmor](https://github.com/EdderTalmor), [@egilewski](https://github.com/egilewski), [@elashera](https://github.com/elashera), [@Elektrofussel](https://github.com/Elektrofussel), [@eliteworkstation94-ai](https://github.com/eliteworkstation94-ai), [@embwl0x](https://github.com/embwl0x), [@emo-eth](https://github.com/emo-eth), [@emozilla](https://github.com/emozilla), [@enzo-adami](https://github.com/enzo-adami), [@Epoxidex](https://github.com/Epoxidex), [@ErnestHysa](https://github.com/ErnestHysa), [@Erosika](https://github.com/Erosika), [@esthonjr](https://github.com/esthonjr), [@ethernet8023](https://github.com/ethernet8023), [@evefromwayback](https://github.com/evefromwayback), [@evelynburger](https://github.com/evelynburger), [@F4TB0Yz](https://github.com/F4TB0Yz), [@falkoro](https://github.com/falkoro), [@fanyangCS](https://github.com/fanyangCS), [@firefly](https://github.com/firefly), [@fjlaowan1983](https://github.com/fjlaowan1983), [@flewe](https://github.com/flewe), [@flo1t](https://github.com/flo1t), [@flow-digital-ny](https://github.com/flow-digital-ny), [@floze-the-genius](https://github.com/floze-the-genius), [@frizikk](https://github.com/frizikk), [@Frowtek](https://github.com/Frowtek), [@FuryMartin](https://github.com/FuryMartin), [@fyzanshaik](https://github.com/fyzanshaik), [@gauravsaxena1997](https://github.com/gauravsaxena1997), [@geoffreybutler94](https://github.com/geoffreybutler94), [@georgedrury](https://github.com/georgedrury), [@gigakun3030](https://github.com/gigakun3030), [@giggling-ginger](https://github.com/giggling-ginger), [@Git-on-my-level](https://github.com/Git-on-my-level), [@gitcommit90](https://github.com/gitcommit90), [@githubespresso407](https://github.com/githubespresso407), [@gnodet](https://github.com/gnodet), [@GottZ](https://github.com/G…

…e + 1Password sidebar fix (NousResearch#59613) * docs(secrets): secret-source plugin developer guide + sidebar registration for 1Password page - New developer-guide/secret-source-plugin.md: SecretSource contract (never raises/prompts, fetch-only, timeout budget), framework-vs-plugin ownership table, mapped-vs-bulk shape guidance, run_secret_cli() subprocess-safety, registration + timing note, conformance kit usage, ErrorKind reference. - Register user-guide/secrets/onepassword in the sidebar (page shipped in NousResearch#59498 but was not listed, so it was unreachable from nav). - Cross-link the user-guide plugin section to the new dev guide. * docs: group all plugin guides under a Plugins subcategory in Extending - Move guides/build-a-hermes-plugin.md -> developer-guide/plugins/index.md (both locales) and make it the category landing page (slug pinned to /developer-guide/plugins). - New sidebar subcategory Developer Guide > Extending > Plugins holding the general guide + all 8 provider-plugin docs (llm-access, memory, context-engine, secret-source, model, image-gen, video-gen, web-search); provider-doc URLs unchanged. - Client redirect /guides/build-a-hermes-plugin -> /developer-guide/plugins. - Update 30 cross-links across both locales.

teknium1 force-pushed the feat/secret-source-interface branch from d6e27c9 to c0be3d9 Compare July 6, 2026 09:28

teknium1 changed the title ~~feat(secrets): pluggable SecretSource interface + multi-source orchestrator (Bitwarden as first provider)~~ feat(secrets): pluggable SecretSource interface + Bitwarden & 1Password providers Jul 6, 2026

teknium1 and others added 6 commits July 6, 2026 04:47

fix(secrets): remove unused masked_secret_prompt import from onepassw…

9634181

…ord CLI Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

teknium1 force-pushed the feat/secret-source-interface branch from c0be3d9 to c038b4a Compare July 6, 2026 11:48

teknium1 merged commit 8235f48 into main Jul 6, 2026
31 checks passed

teknium1 deleted the feat/secret-source-interface branch July 6, 2026 11:58

flamerged mentioned this pull request Jul 6, 2026

feat(secrets): add Proton Pass secret source (pass-cli, agent-token aware) #34393

Closed

14 tasks

hansipie mentioned this pull request Jul 10, 2026

feat(secrets): add native Vaultwarden / bw CLI secret source #42300

Closed

6 tasks

teknium1 mentioned this pull request Jul 14, 2026

Feature Request: Apple Keychain as a secrets backend #42193

Closed

BrewTestBot mentioned this pull request Jul 20, 2026

hermes-agent 2026.7.20 Homebrew/homebrew-core#294218

Merged

1 task

This was referenced Jul 20, 2026

Upstream Hermes v2026.7.20 disponible (ultimo sync: v2026.6.5) samuelgradientai-sys/clawksis-agent#63

Open

chore: bump NousResearch/hermes-agent version from v2026.7.7.2 to v2026.7.20 Docker-Hub-sirmark/docker-hermes-agent#16

Merged

tomfuertes mentioned this pull request Jul 21, 2026

chore: bump Hermes to v2026.7.20 (0.19.0) notambourine/hermes-agent-template#27

Merged

github-actions Bot mentioned this pull request Aug 3, 2026

Update docker.io/nousresearch/hermes-agent Docker tag to v2026.8.3 claytono/infra#2587

Open

1 task

This was referenced Aug 15, 2026

feat(secrets): keep 1Password-managed provider keys off disk in Hermes home #86701

Closed

feat(secrets): keep 1Password-managed provider keys off disk in Hermes home #86716

Open

Navigation Menu

Uh oh!

feat(secrets): pluggable SecretSource interface + Bitwarden & 1Password providers - #59498

feat(secrets): pluggable SecretSource interface + Bitwarden & 1Password providers#59498
teknium1 merged 6 commits into
mainfrom
feat/secret-source-interface

teknium1 commented Jul 6, 2026 •

edited

Loading

Uh oh!

alt-glitch commented Jul 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

teknium1 commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Motivation

Changes

Validation

Infographic

Uh oh!

alt-glitch commented Jul 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

teknium1 commented Jul 6, 2026 •

edited

Loading